@orkestrel/scaffold 0.0.2 → 0.0.3

package/dist/host/scripts/deps.sh

@@ -1,11 +1,10 @@
 #!/bin/bash
 # ============================================================================
-# scripts/deps.sh — SessionStart hook: project dependencies ONLY
+# scripts/deps.sh — SessionStart hook: reproducible project dependencies
 # ----------------------------------------------------------------------------
-# Runs in every cloud environment (the setup script never sees the repo
-# checkout; $CLAUDE_PROJECT_DIR here always points at the real one).
-# SessionStart stdout is injected into Claude's context, so this script prints
-# ONE meaningful line and sends the npm noise to /tmp/deps.log.
+# Runs only in Claude Code's remote environment. The lockfile digest marker
+# prevents a resumed session from treating stale node_modules as a valid
+# installation after package-lock.json changes.
 # ============================================================================
 
 if [ "${CLAUDE_CODE_REMOTE:-}" != "true" ]; then
@@ -17,22 +16,41 @@ cd "$CLAUDE_PROJECT_DIR" || exit 0
 if [ ! -f package.json ]; then
   exit 0
 fi
-if [ -d node_modules ]; then
-  echo "deps.sh: dependencies already present (resumed session) — skipped."
+
+LOCK_MARKER="node_modules/.orkestrel-lock.sha256"
+DEPS_LOG="$(mktemp /tmp/orkestrel-deps.XXXXXX)" || {
+  echo "deps.sh: could not create a private dependency log — skipped."
   exit 0
-fi
+}
+chmod 600 "$DEPS_LOG"
+
+cleanup_deps_log() {
+  rm -f -- "$DEPS_LOG"
+}
+
+trap cleanup_deps_log EXIT
 
 if [ -f package-lock.json ]; then
-  if npm ci >/tmp/deps.log 2>&1; then
-    echo "deps.sh: dependencies installed (npm ci)."
-  else
-    echo "deps.sh: npm ci FAILED — see /tmp/deps.log before building or testing."
+  LOCK_HASH="$(node -e "process.stdout.write(require('node:crypto').createHash('sha256').update(require('node:fs').readFileSync('package-lock.json')).digest('hex'))" 2>"$DEPS_LOG")"
+
+  if [ -n "$LOCK_HASH" ] &&
+    [ -d node_modules ] &&
+    [ -f "$LOCK_MARKER" ] &&
+    [ "$(tr -d '\r\n' <"$LOCK_MARKER")" = "$LOCK_HASH" ]; then
+    echo "deps.sh: dependencies match package-lock.json — skipped."
+    exit 0
   fi
-else
-  if npm install >/tmp/deps.log 2>&1; then
-    echo "deps.sh: no package-lock.json — npm install succeeded. Commit a lockfile for reproducible installs."
+
+  if npm ci --ignore-scripts >"$DEPS_LOG" 2>&1; then
+    if [ -n "$LOCK_HASH" ]; then
+      printf '%s\n' "$LOCK_HASH" >"$LOCK_MARKER"
+    fi
+    echo "deps.sh: dependencies installed from package-lock.json (npm ci)."
   else
-    echo "deps.sh: npm install FAILED — see /tmp/deps.log before building or testing."
+    echo "deps.sh: npm ci failed; dependency installation remains incomplete."
   fi
+else
+  echo "deps.sh: no package-lock.json — automatic installation refused; commit a lockfile."
 fi
+
 exit 0

package/dist/host/scripts/ollama.sh

@@ -1,163 +1,20 @@
 #!/bin/bash
-# ============================================================================
-# scripts/ollama.sh — SessionStart hook: Ollama ONLY
-# ----------------------------------------------------------------------------
-# One job: bring the local-model daemon up for this session, healthy.
-# Project dependencies live in scripts/deps.sh; the Cursor bench check lives in
-# scripts/cursor.sh. All three are registered in .claude/settings.json and run
-# IN PARALLEL at session start, so the daemon boots while npm installs.
-#
-#   0. Guards -- the orchestration set (hooks included) is mirrored
-#      byte-identical across every @orkestrel repo, and this repo serves
-#      several cloud environments: exit quietly in any repo that isn't
-#      @orkestrel/ollama, and wherever the ollama binary isn't installed.
-#   1. Starts `ollama serve`  -- the environment cache snapshots FILES, not
-#      running processes, so the daemon must be restarted every session.
-#   2. Self-heals a known container defect -- this container class advertises
-#      AMX CPU flags but blocks AMX tile-state permissions at the kernel /
-#      seccomp level. Ollama's dynamic CPU-backend loader picks its only
-#      AMX-capable variant (libggml-cpu-sapphirerapids.so) on such hosts, and
-#      llama-server then segfaults on every model load. A cheap chat probe
-#      after the daemon comes up doubles as session warmup AND a canary for
-#      this failure; if it fires, we disable that .so and restart the daemon
-#      so the loader falls back to the next-best AVX-512 variant.
-#
-# SessionStart stdout is injected into Claude's context: keep stdout to terse
-# status lines (they tell Claude what this environment offers); diagnostics go
-# to stderr / /tmp/ollama.log. No `set -e`: a self-heal misfire should not
-# stop Ollama from coming up.
-# ============================================================================
+# SessionStart loopback capability probe. Lifecycle stays user-owned and no
+# caller-controlled endpoint is contacted or copied into model context.
 
-# Run only in cloud sessions. Locally you manage your own Ollama, so skip.
 if [ "${CLAUDE_CODE_REMOTE:-}" != "true" ]; then
   exit 0
 fi
 
-# --- 0. Guards ---------------------------------------------------------------
-# The daemon only serves the ollama package; every other @orkestrel repo
-# carries this script as part of the mirrored hook set and must skip silently.
-PKG_JSON="${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/.." && pwd)}/package.json"
-if ! grep -Eq '"name"[[:space:]]*:[[:space:]]*"@orkestrel/ollama"' "$PKG_JSON" 2>/dev/null; then
-  exit 0
-fi
 if ! command -v ollama >/dev/null 2>&1; then
-  echo "ollama.sh: ollama not installed in this environment — no local model daemon."
-  exit 0
-fi
-
-# Match the locations used by the setup script / environment variables.
-export OLLAMA_MODELS="${OLLAMA_MODELS:-/opt/ollama/models}"
-export OLLAMA_HOST="${OLLAMA_HOST:-127.0.0.1:11434}"
-
-# Your Copilot workflow set OLLAMA_ORIGINS="*" so browser page contexts could
-# call the API cross-origin. That was mainly a Playwright concern, so it is off
-# here. Uncomment if anything still hits Ollama from a browser:
-# export OLLAMA_ORIGINS="*"
-
-# --- 1. Start the daemon ----------------------------------------------------
-if ! curl -sf "http://${OLLAMA_HOST}/api/tags" >/dev/null 2>&1; then
-  nohup ollama serve >/tmp/ollama.log 2>&1 &
-fi
-
-ollama_ready=0
-for i in $(seq 1 30); do
-  if curl -sf "http://${OLLAMA_HOST}/api/tags" >/dev/null 2>&1; then
-    echo "Ollama ready on ${OLLAMA_HOST}"
-    ollama_ready=1
-    break
-  fi
-  sleep 1
-done
-
-if [ "$ollama_ready" != "1" ]; then
-  # Don't fail the session if the daemon is slow; Claude can retry mid-session.
-  echo "Warning: Ollama did not report ready within 30s (see /tmp/ollama.log)" >&2
+  echo "ollama.sh: loopback capability unavailable."
   exit 0
 fi
 
-# --- 2. Self-heal the AMX/XTILE-blocked-container defect --------------------
-# See header note 2. A minimal chat call against whatever model is already
-# installed both warms that model for the session AND tells us whether this
-# container hit the AMX-tile-permission wall. If it did, disable the
-# AMX-only CPU backend variant and restart the daemon so the loader falls
-# back to AVX-512, then re-probe once to confirm the fix landed.
-sapphirerapids_so="/usr/local/lib/ollama/libggml-cpu-sapphirerapids.so"
-
-probe_model() {
-  curl -sf "http://${OLLAMA_HOST}/api/tags" 2>/dev/null \
-    | grep -o '"name":"[^"]*"' \
-    | head -n 1 \
-    | sed -e 's/"name":"//' -e 's/"$//'
-}
-
-probe_chat() {
-  model="$1"
-  curl -s --max-time 120 "http://${OLLAMA_HOST}/api/chat" \
-    -d "{\"model\":\"${model}\",\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}],\"stream\":false,\"think\":false,\"keep_alive\":\"30m\",\"options\":{\"num_predict\":1}}"
-}
-
-model="$(probe_model)"
-if [ -z "$model" ]; then
-  # No model installed yet -- nothing to warm or probe against.
-  echo "ollama.sh: no installed model found, skipping warmup probe." >&2
-  exit 0
-fi
-
-probe_response="$(probe_chat "$model")"
-
-if echo "$probe_response" | grep -qi 'segmentation fault\|llama-server process has terminated'; then
-  echo "ollama.sh: detected llama-server crash on model warmup (likely the AMX/XTILE-blocked-container defect)." >&2
-  if [ -f "$sapphirerapids_so" ]; then
-    echo "ollama.sh: disabling AMX-only CPU backend variant so the loader falls back to AVX-512." >&2
-    if mv "$sapphirerapids_so" "${sapphirerapids_so}.disabled" 2>/dev/null; then
-      echo "ollama.sh: restarting Ollama daemon to pick up the backend change." >&2
-      ollama_pid="$(pgrep -x ollama | head -n 1)"
-      if [ -n "$ollama_pid" ]; then
-        kill "$ollama_pid" 2>/dev/null
-        # Wait for the old process to actually exit before relaunching, so the
-        # new daemon can't race the dying one for the port and the readiness
-        # poll below can't be satisfied by the dying daemon.
-        for i in $(seq 1 10); do
-          if ! kill -0 "$ollama_pid" 2>/dev/null; then
-            break
-          fi
-          sleep 0.5
-        done
-      fi
-      nohup ollama serve >/tmp/ollama.log 2>&1 &
-
-      restarted_ready=0
-      for i in $(seq 1 30); do
-        if curl -sf "http://${OLLAMA_HOST}/api/tags" >/dev/null 2>&1; then
-          restarted_ready=1
-          break
-        fi
-        sleep 1
-      done
-
-      if [ "$restarted_ready" = "1" ]; then
-        retry_response="$(probe_chat "$model")"
-        if echo "$retry_response" | grep -qi 'segmentation fault\|llama-server process has terminated'; then
-          echo "ollama.sh: self-heal restart complete, but the retry probe still failed. See /tmp/ollama.log." >&2
-        else
-          echo "ollama.sh: self-heal succeeded -- model warm (${model}) after AVX-512 fallback."
-        fi
-      else
-        echo "ollama.sh: daemon did not report ready after self-heal restart (see /tmp/ollama.log)." >&2
-      fi
-    else
-      echo "ollama.sh: warning -- could not rename ${sapphirerapids_so} (permissions?). Leaving daemon as-is." >&2
-    fi
-  else
-    echo "ollama.sh: warning -- AMX-only CPU backend not found at expected path; cannot self-heal automatically." >&2
-  fi
-elif echo "$probe_response" | grep -q '"message"\|"content"\|"done":true'; then
-  echo "ollama.sh: model warm (${model}) -- warmup probe succeeded."
+if curl -sf --max-time 2 "http://127.0.0.1:11434/api/tags" >/dev/null 2>&1; then
+  echo "ollama.sh: loopback capability ready; lifecycle remains user-owned."
 else
-  echo "ollama.sh: warning -- warmup probe returned an unexpected response (not a segfault, but no message/done payload either):" >&2
-  echo "ollama.sh: ${probe_response}" | head -c 500 >&2
-  echo "" >&2
-  echo "ollama.sh: leaving daemon as-is." >&2
+  echo "ollama.sh: loopback capability unreachable; lifecycle remains user-owned."
 fi
 
 exit 0

package/dist/host/tests/setupPolicy.ts

@@ -0,0 +1,354 @@
+import { globSync, readFileSync } from 'node:fs'
+import { basename, join } from 'node:path'
+import * as ts from 'typescript'
+
+/** Centralized source modules whose top-level declarations must all be exported. */
+export const CENTRAL_SOURCE_FILES: readonly string[] = Object.freeze([
+	'combinators.ts',
+	'cloners.ts',
+	'compilers.ts',
+	'constants.ts',
+	'contracts.ts',
+	'errors.ts',
+	'factories.ts',
+	'helpers.ts',
+	'handlers.ts',
+	'middlewares.ts',
+	'parsers.ts',
+	'relations.ts',
+	'schemas.ts',
+	'seeders.ts',
+	'shapers.ts',
+	'templates.ts',
+	'types.ts',
+	'validators.ts',
+])
+
+/** Centralized files that own module-scope function declarations. */
+export const FUNCTION_SOURCE_FILES: readonly string[] = Object.freeze([
+	'combinators.ts',
+	'cloners.ts',
+	'compilers.ts',
+	'errors.ts',
+	'factories.ts',
+	'handlers.ts',
+	'helpers.ts',
+	'middlewares.ts',
+	'parsers.ts',
+	'relations.ts',
+	'schemas.ts',
+	'seeders.ts',
+	'shapers.ts',
+	'validators.ts',
+])
+
+/** Centralized files that own module-scope data declarations. */
+export const DATA_SOURCE_FILES: readonly string[] = Object.freeze([
+	'combinators.ts',
+	'constants.ts',
+	'contracts.ts',
+	'relations.ts',
+	'schemas.ts',
+	'templates.ts',
+	'validators.ts',
+])
+
+/** One script block extracted from a Vue SFC by the official compiler. */
+export interface VueScriptBlockInterface {
+	readonly content: string
+	readonly lang?: string
+}
+
+/** An injected official Vue SFC script-block extractor. */
+export interface VueScriptExtractorInterface {
+	(path: string, content: string): readonly VueScriptBlockInterface[]
+}
+
+/** Normalize platform separators and duplicate glob segments for stable diagnostics. */
+export function normalizePolicyPath(path: string): string {
+	return path.replaceAll('\\', '/').replace(/\/+/gu, '/')
+}
+
+/** Whether a declaration carries an explicit export modifier. */
+export function hasExportModifier(node: ts.Node): boolean {
+	return (
+		ts.canHaveModifiers(node) &&
+		ts.getModifiers(node)?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) ===
+			true
+	)
+}
+
+/** Whether a declaration carries a specified modifier. */
+export function hasModifier(node: ts.Node, modifier: ts.SyntaxKind): boolean {
+	return (
+		ts.canHaveModifiers(node) &&
+		ts.getModifiers(node)?.some((candidate) => candidate.kind === modifier) === true
+	)
+}
+
+/** Whether a module specifier uses a URL scheme other than Node's builtin namespace. */
+export function isUnsupportedModuleSpecifier(specifier: string): boolean {
+	return /^[A-Za-z][A-Za-z0-9+.-]*:/u.test(specifier) && !specifier.startsWith('node:')
+}
+
+/** Whether an arrow/function expression is an anonymous callback passed directly as an argument. */
+export function isDirectCallback(node: ts.ArrowFunction | ts.FunctionExpression): boolean {
+	const parent = node.parent
+	return (
+		(ts.isCallExpression(parent) || ts.isNewExpression(parent)) &&
+		parent.arguments?.some((argument) => argument === node) === true
+	)
+}
+
+/** Whether a function expression is assigned by one module-scope variable declaration. */
+export function isModuleFunction(node: ts.ArrowFunction | ts.FunctionExpression): boolean {
+	const declaration = node.parent
+	const list = declaration.parent
+	const statement = list.parent
+	return (
+		ts.isVariableDeclaration(declaration) &&
+		ts.isVariableDeclarationList(list) &&
+		ts.isVariableStatement(statement) &&
+		ts.isSourceFile(statement.parent)
+	)
+}
+
+/** Whether a property signature belongs to a centralized interface or type alias contract. */
+export function isContractProperty(node: ts.PropertySignature): boolean {
+	let parent: ts.Node = node.parent
+	while (ts.isTypeLiteralNode(parent)) parent = parent.parent
+	return ts.isInterfaceDeclaration(parent) || ts.isTypeAliasDeclaration(parent)
+}
+
+/** Whether the sole production triple-slash reference is the generated browser Vite contract. */
+export function hasAllowedTripleSlashReference(path: string, source: ts.SourceFile): boolean {
+	return (
+		path.replaceAll('\\', '/') === 'app/browser/env.d.ts' &&
+		source.referencedFiles.length === 0 &&
+		source.libReferenceDirectives.length === 0 &&
+		source.typeReferenceDirectives.length === 1 &&
+		source.typeReferenceDirectives[0]?.fileName === 'vite/client'
+	)
+}
+
+/** Inspect a Vue single-file component for syntax that can bypass declared import policy. */
+export function inspectVueCodingLaw(
+	path: string,
+	scripts: readonly VueScriptBlockInterface[] = [],
+): readonly string[] {
+	const violations: string[] = []
+	for (const [index, script] of scripts.entries()) {
+		if (
+			script.lang !== 'ts' &&
+			script.lang !== 'tsx' &&
+			script.lang !== 'mts' &&
+			script.lang !== 'cts'
+		) {
+			violations.push(`${path}.script-${String(index)} requires a TypeScript script language`)
+		}
+		const extension =
+			script.lang === 'tsx' || script.lang === 'mts' || script.lang === 'cts' ? script.lang : 'ts'
+		violations.push(
+			...inspectCodingLaw(`${path}.script-${String(index)}.${extension}`, script.content),
+		)
+	}
+	return violations
+}
+
+/** Add syntax-wide coding-law violations while traversing one source tree. */
+export function inspectCodingNode(path: string, node: ts.Node, violations: string[]): void {
+	if (
+		ts.isAsExpression(node) ||
+		ts.isTypeAssertionExpression(node) ||
+		ts.isNonNullExpression(node)
+	) {
+		violations.push(`${path}:${node.getStart()} forbids type/non-null assertions`)
+	}
+	if (node.kind === ts.SyntaxKind.AnyKeyword) {
+		violations.push(`${path}:${node.getStart()} forbids any`)
+	}
+	if (
+		(ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) &&
+		node.moduleSpecifier !== undefined &&
+		ts.isStringLiteral(node.moduleSpecifier) &&
+		isUnsupportedModuleSpecifier(node.moduleSpecifier.text)
+	) {
+		violations.push(`${path}:${node.getStart()} forbids non-Node URL module specifiers`)
+	}
+	if (
+		ts.isPropertySignature(node) &&
+		isContractProperty(node) &&
+		!hasModifier(node, ts.SyntaxKind.ReadonlyKeyword)
+	) {
+		violations.push(`${path}:${node.getStart()} requires readonly contract properties`)
+	}
+	if (
+		ts.isCallExpression(node) &&
+		node.expression.kind === ts.SyntaxKind.ImportKeyword &&
+		(node.arguments.length !== 1 || !node.arguments.every(ts.isStringLiteral))
+	) {
+		violations.push(
+			`${path}:${node.getStart()} requires dynamic imports to use string literals so import policy remains enforceable`,
+		)
+	}
+	if (
+		ts.isCallExpression(node) &&
+		node.expression.kind === ts.SyntaxKind.ImportKeyword &&
+		node.arguments.length === 1 &&
+		node.arguments.every(ts.isStringLiteral) &&
+		isUnsupportedModuleSpecifier(node.arguments[0]?.text ?? '')
+	) {
+		violations.push(`${path}:${node.getStart()} forbids non-Node URL module specifiers`)
+	}
+	if (ts.isFunctionDeclaration(node) && !ts.isSourceFile(node.parent)) {
+		violations.push(`${path}:${node.getStart()} forbids nested function declarations`)
+	}
+	if (
+		(ts.isArrowFunction(node) || ts.isFunctionExpression(node)) &&
+		!isDirectCallback(node) &&
+		!isModuleFunction(node)
+	) {
+		violations.push(`${path}:${node.getStart()} forbids hidden function assignments`)
+	}
+	ts.forEachChild(node, (child) => inspectCodingNode(path, child, violations))
+}
+
+/** Inspect one TypeScript source module for repository coding-law violations. */
+export function inspectCodingLaw(path: string, content: string): readonly string[] {
+	const violations: string[] = []
+	const source = ts.createSourceFile(path, content, ts.ScriptTarget.Latest, true)
+	const file = basename(path)
+
+	if (/\.[cm]?jsx?$/u.test(path)) {
+		violations.push(`${path} production modules use TypeScript source extensions`)
+	}
+	if (/@ts-(?:expect-error|ignore|nocheck)|eslint-disable|oxlint-disable/u.test(content)) {
+		violations.push(`${path} forbids suppression directives`)
+	}
+	if (
+		(source.referencedFiles.length > 0 ||
+			source.libReferenceDirectives.length > 0 ||
+			source.typeReferenceDirectives.length > 0) &&
+		!hasAllowedTripleSlashReference(path, source)
+	) {
+		violations.push(`${path} forbids triple-slash references outside app/browser/env.d.ts`)
+	}
+
+	if (file === 'index.ts') {
+		for (const statement of source.statements) {
+			if (
+				!ts.isExportDeclaration(statement) ||
+				statement.exportClause !== undefined ||
+				statement.isTypeOnly ||
+				statement.moduleSpecifier === undefined
+			) {
+				violations.push(`${path} barrels contain only export * declarations`)
+			}
+		}
+	}
+
+	for (const statement of source.statements) {
+		if (
+			(ts.isInterfaceDeclaration(statement) || ts.isTypeAliasDeclaration(statement)) &&
+			file !== 'types.ts'
+		) {
+			violations.push(`${path} centralizes interfaces and type aliases in types.ts`)
+		}
+		if (
+			CENTRAL_SOURCE_FILES.includes(file) &&
+			(ts.isClassDeclaration(statement) ||
+				ts.isFunctionDeclaration(statement) ||
+				ts.isInterfaceDeclaration(statement) ||
+				ts.isTypeAliasDeclaration(statement) ||
+				ts.isVariableStatement(statement)) &&
+			!hasExportModifier(statement)
+		) {
+			violations.push(`${path} exports every centralized declaration`)
+		}
+		if (ts.isFunctionDeclaration(statement) && !FUNCTION_SOURCE_FILES.includes(file)) {
+			violations.push(`${path} places module functions in their centralized kind file`)
+		}
+		if (ts.isVariableStatement(statement) && !DATA_SOURCE_FILES.includes(file)) {
+			violations.push(`${path} places module data in its centralized kind file`)
+		}
+		if (
+			ts.isClassDeclaration(statement) &&
+			file !== 'errors.ts' &&
+			!/^[A-Z][A-Za-z0-9]*\.ts$/u.test(file)
+		) {
+			violations.push(`${path} places each class in its matching implementation or errors file`)
+		}
+		if (ts.isEnumDeclaration(statement) && file !== 'types.ts') {
+			violations.push(`${path} centralizes enum contracts in types.ts`)
+		}
+		if (file === 'constants.ts' && ts.isVariableStatement(statement)) {
+			if ((statement.declarationList.flags & ts.NodeFlags.Const) === 0) {
+				violations.push(`${path} constants.ts permits only const declarations`)
+			}
+			for (const declaration of statement.declarationList.declarations) {
+				if (
+					!ts.isIdentifier(declaration.name) ||
+					!/^[A-Z][A-Z0-9_]*$/u.test(declaration.name.text)
+				) {
+					violations.push(`${path}:${declaration.getStart()} requires UPPER_SNAKE_CASE constants`)
+				}
+				if (
+					declaration.initializer !== undefined &&
+					(ts.isArrayLiteralExpression(declaration.initializer) ||
+						ts.isObjectLiteralExpression(declaration.initializer))
+				) {
+					violations.push(`${path}:${declaration.getStart()} freezes collection constants`)
+				}
+			}
+		}
+	}
+
+	if (/^[A-Z][A-Za-z0-9]*\.ts$/u.test(file)) {
+		const classes = source.statements.filter(ts.isClassDeclaration)
+		const invalid = source.statements.filter(
+			(statement) => !ts.isImportDeclaration(statement) && !ts.isClassDeclaration(statement),
+		)
+		if (
+			classes.length !== 1 ||
+			invalid.length !== 0 ||
+			classes[0]?.name?.text !== file.slice(0, -3) ||
+			classes[0] === undefined ||
+			!hasExportModifier(classes[0])
+		) {
+			violations.push(
+				`${path} implementation modules contain imports and one matching exported class`,
+			)
+		}
+		for (const member of classes[0]?.members ?? []) {
+			if (hasModifier(member, ts.SyntaxKind.PrivateKeyword)) {
+				violations.push(`${path}:${member.getStart()} uses runtime # privacy`)
+			}
+		}
+	}
+
+	inspectCodingNode(path, source, violations)
+	return violations
+}
+
+/** Inspect every production TypeScript module under one workspace. */
+export function inspectCodingWorkspace(
+	root: string,
+	vueScripts?: VueScriptExtractorInterface,
+): readonly string[] {
+	const violations: string[] = []
+	for (const path of globSync('{app,src}/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx,vue}', {
+		cwd: root,
+	})) {
+		const content = readFileSync(join(root, path), 'utf8')
+		const normalizedPath = normalizePolicyPath(path)
+		if (path.endsWith('.vue') && !normalizedPath.startsWith('app/browser/')) {
+			violations.push(`${normalizedPath} Vue components belong in app/browser`)
+		}
+		violations.push(
+			...(path.endsWith('.vue')
+				? inspectVueCodingLaw(normalizedPath, vueScripts?.(normalizedPath, content))
+				: inspectCodingLaw(normalizedPath, content)),
+		)
+	}
+	return violations
+}