@rigour-labs/core 6.4.0 → 6.4.1

package/dist/inference/sidecar-provider.js

@@ -29,13 +29,19 @@ const PLATFORM_PACKAGES = {
     'win32-x64': '@rigour-labs/brain-win-x64',
 };
 export class SidecarProvider {
+    modelPath;
     name = 'sidecar';
     binaryPath = null;
     model = null;
     schemaPath = null;
     tier;
     threads;
-    constructor(tier = 'lite', threads = 4) {
+    /**
+     * @param modelPath a local GGUF to load instead of the tier's published model:
+     *   how a fine-tune candidate is measured before it is published.
+     */
+    constructor(tier = 'lite', threads = 4, modelPath) {
+        this.modelPath = modelPath;
         this.tier = tier;
         this.threads = threads;
     }
@@ -58,11 +64,7 @@ export class SidecarProvider {
     async setup(onProgress) {
         this.binaryPath = await this.resolveBinaryPath() ?? await installLlamaEngine(onProgress);
         onProgress?.('✓ Inference engine ready');
-        await ensureModel(this.tier, (msg, percent) => {
-            if (percent !== undefined && percent < 100)
-                onProgress?.(`  ${msg}`);
-        });
-        this.model = await getCachedModel(this.tier);
+        this.model = this.modelPath ? await localModel(this.tier, this.modelPath) : await this.publishedModel(onProgress);
         if (!this.model) {
             throw new Error(`Model for tier "${this.tier}" is not cached after download.`);
         }
@@ -72,6 +74,13 @@ export class SidecarProvider {
         this.schemaPath = await writeFindingsSchema();
         onProgress?.('✓ Model ready');
     }
+    async publishedModel(onProgress) {
+        await ensureModel(this.tier, (msg, percent) => {
+            if (percent !== undefined && percent < 100)
+                onProgress?.(`  ${msg}`);
+        });
+        return getCachedModel(this.tier);
+    }
     /** The model file setup() loaded, or null before setup. */
     getActiveModel() {
         if (!this.model)
@@ -176,3 +185,16 @@ async function writeFindingsSchema() {
     await fs.writeJson(schemaPath, FINDINGS_JSON_SCHEMA);
     return schemaPath;
 }
+/** A GGUF on disk, used as is: no download, no version check. */
+export async function localModel(tier, modelPath) {
+    const resolved = path.resolve(modelPath);
+    const stat = await fs.stat(resolved).catch(() => null);
+    if (!stat?.isFile())
+        throw new Error(`Model file not found: ${resolved}`);
+    const filename = path.basename(resolved);
+    return {
+        path: resolved,
+        info: { tier, name: `${filename} (local)`, filename, url: '', sizeBytes: stat.size, sizeHuman: `${Math.round(stat.size / 1e6)}MB` },
+        fallback: false,
+    };
+}

package/dist/inference/types.d.ts

@@ -66,8 +66,15 @@ export interface DeepAnalysisResult {
  * - deep: Qwen2.5-Coder-1.5B fine-tuned — full power, company-hosted
  * - lite: Qwen2.5-Coder-0.5B fine-tuned — lightweight, ships as default CLI sidecar
  * - legacy: Qwen2.5-Coder-0.5B fine-tuned — previous default, reproducibility
+ * - max: Qwen2.5-Coder-7B (4.7GB q4) — the strongest model a 16GB laptop runs;
+ *   stock until a fine-tune passes the eval gate and the Review Arena
  */
-export type ModelTier = 'deep' | 'lite' | 'legacy';
+export type ModelTier = 'deep' | 'lite' | 'legacy' | 'max';
+/** The local tier for a run: --max, then --pro, then the lite default. */
+export declare function localTier(options: {
+    max?: boolean;
+    pro?: boolean;
+}): ModelTier;
 /**
  * Model info for download/caching.
  */

package/dist/inference/types.js

@@ -1,3 +1,7 @@
+/** The local tier for a run: --max, then --pro, then the lite default. */
+export function localTier(options) {
+    return options.max ? 'max' : options.pro ? 'deep' : 'lite';
+}
 /**
  * Minimum bundled model version — used as fallback when the auto-update
  * check fails (offline, HF down, first run). The RLAIF training pipeline
@@ -23,6 +27,7 @@ export function buildModelInfo(tier, version) {
         deep: { base: 'Qwen2.5-Coder-1.5B', size: 900_000_000, sizeH: '900MB' },
         lite: { base: 'Qwen2.5-Coder-0.5B', size: 400_000_000, sizeH: '400MB' },
         legacy: { base: 'Qwen2.5-Coder-0.5B', size: 350_000_000, sizeH: '350MB' },
+        max: { base: 'Qwen2.5-Coder-7B', size: 4_700_000_000, sizeH: '4.7GB' },
     };
     const m = meta[tier];
     return {
@@ -39,6 +44,7 @@ export const MODELS = {
     deep: buildModelInfo('deep', BUNDLED_MODEL_VERSION),
     lite: buildModelInfo('lite', BUNDLED_MODEL_VERSION),
     legacy: buildModelInfo('legacy', BUNDLED_MODEL_VERSION),
+    max: buildModelInfo('max', BUNDLED_MODEL_VERSION),
 };
 /**
  * Update MODELS in-place to point to a newer version.
@@ -79,4 +85,12 @@ export const FALLBACK_MODELS = {
         sizeBytes: 350_000_000,
         sizeHuman: '350MB',
     },
+    max: {
+        tier: 'max',
+        name: 'Qwen2.5-Coder-7B-Instruct (stock)',
+        filename: 'qwen2.5-coder-7b-instruct-q4_k_m.gguf',
+        url: 'https://huggingface.co/Qwen/Qwen2.5-Coder-7B-Instruct-GGUF/resolve/main/qwen2.5-coder-7b-instruct-q4_k_m.gguf',
+        sizeBytes: 4_683_073_536,
+        sizeHuman: '4.7GB',
+    },
 };

package/dist/inference/types.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/inference/types.test.js

@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest';
+import { buildModelInfo, FALLBACK_MODELS, localTier, MODELS } from './types.js';
+describe('local model tiers', () => {
+    it('picks max over pro over the lite default', () => {
+        expect(localTier({})).toBe('lite');
+        expect(localTier({ pro: true })).toBe('deep');
+        expect(localTier({ max: true })).toBe('max');
+        expect(localTier({ max: true, pro: true })).toBe('max');
+    });
+    it('asks for a published max fine-tune and falls back to the stock 7B coder model', () => {
+        expect(buildModelInfo('max', '6.0.0').url)
+            .toBe('https://huggingface.co/rigour-labs/rigour-max-v6.0.0-gguf/resolve/main/rigour-max-v6.0.0-q4_k_m.gguf');
+        expect(MODELS.max.tier).toBe('max');
+        expect(FALLBACK_MODELS.max).toMatchObject({
+            filename: 'qwen2.5-coder-7b-instruct-q4_k_m.gguf',
+            url: 'https://huggingface.co/Qwen/Qwen2.5-Coder-7B-Instruct-GGUF/resolve/main/qwen2.5-coder-7b-instruct-q4_k_m.gguf',
+        });
+    });
+});

package/dist/review/diff-test-findings.d.ts

@@ -0,0 +1,3 @@
+import type { DeepOptions, Failure } from '../types/index.js';
+import type { DiffSource } from './git-diff.js';
+export declare function diffTestFailures(cwd: string, source: DiffSource | undefined, deep: DeepOptions): Promise<Failure[]>;

package/dist/review/diff-test-findings.js

@@ -0,0 +1,41 @@
+/**
+ * `rigour review --diff-tests`: behaviour changes found by running changed
+ * functions before and after the change, as review findings on the changed line.
+ */
+import { execFileSync } from 'child_process';
+import { runDiffTests } from '../deep/diff-tests/run.js';
+import { createProvider } from '../inference/index.js';
+export async function diffTestFailures(cwd, source, deep) {
+    const provider = createProvider(deep);
+    await provider.setup();
+    try {
+        const changes = await runDiffTests({
+            cwd, baseRef: baseRef(cwd, source), focusLines: deep.focusLines ?? {}, prBody: deep.prBody,
+            provider, inference: { maxTokens: 1024, temperature: 0.2 },
+        });
+        return changes.map(toFailure);
+    }
+    finally {
+        provider.dispose();
+    }
+}
+/** What the change is compared with: the merge base for a branch review, HEAD for working changes. */
+function baseRef(cwd, source) {
+    if (source?.mode !== 'base')
+        return 'HEAD';
+    return execFileSync('git', ['merge-base', source.base, 'HEAD'], { cwd, encoding: 'utf8' }).trim();
+}
+function toFailure(change) {
+    return {
+        id: 'diff-tests',
+        title: `[diff-tests] ${change.name} behaves differently after this change`,
+        details: `\`${change.call}\` ${change.before} before this change and ${change.after} after it.`,
+        severity: 'medium',
+        provenance: 'deep-analysis',
+        files: [change.file],
+        line: change.line,
+        hint: 'If this is intended, say so in the PR description; otherwise restore the old behaviour for this input.',
+        source: 'hybrid',
+        verified: true,
+    };
+}

package/dist/review/review.d.ts

@@ -8,8 +8,10 @@ export interface ReviewInput {
     source?: DiffSource;
     /** Review exactly these files instead of the ones the diff touches. */
     files?: string[];
-    /** Deep analysis; `focusLines` is filled from the diff. */
-    deep?: Omit<DeepOptions, 'focusLines'>;
+    /** Run changed functions before and after the change (needs deep, on the max or a cloud tier). */
+    diffTests?: boolean;
+    /** Deep analysis; `focusLines` and `removedLines` are filled from the diff. */
+    deep?: Omit<DeepOptions, 'focusLines' | 'removedLines'>;
 }
 export interface ReviewResult {
     status: 'PASS' | 'FAIL' | 'ERROR';

package/dist/review/review.js

@@ -7,11 +7,12 @@
  * but could not analyze anything makes the result ERROR, never a clean PASS.
  */
 import { GateRunner } from '../gates/runner.js';
-import { changedLinesByFile, parseDiff } from '../utils/diff.js';
+import { changedLinesByFile, parseDiff, removedByFile } from '../utils/diff.js';
 import { normalizeScopePatterns } from '../utils/scope.js';
 import { deepAnalysisError } from '../utils/deep-status.js';
 import { splitByChangedLines } from './changed-lines.js';
 import { diffFromGit } from './git-diff.js';
+import { diffTestFailures } from './diff-test-findings.js';
 export async function reviewChange(input) {
     const diff = input.diff ?? diffFromGit(input.cwd, input.source);
     const changedLines = parseDiff(diff);
@@ -19,8 +20,10 @@ export async function reviewChange(input) {
     if (targets.length === 0) {
         return { status: 'PASS', findings: [], fileFindings: [], unlocated: 0, excludedOutsideChangedLines: 0, changedLines, report: null };
     }
-    const deep = input.deep ? { ...input.deep, focusLines: changedLinesByFile(changedLines) } : undefined;
+    const deep = input.deep ? { ...input.deep, focusLines: changedLinesByFile(changedLines), removedLines: removedByFile(diff) } : undefined;
     const report = await new GateRunner(input.config).run(input.cwd, await normalizeScopePatterns(input.cwd, targets), deep);
+    if (input.diffTests && deep)
+        report.failures.push(...await diffTestFailures(input.cwd, input.source, deep));
     const split = splitByChangedLines(report.failures, changedLines);
     const deepError = deepAnalysisError(report);
     return {

package/dist/semantic/benchmark.js

@@ -6,7 +6,7 @@
  */
 import fs from 'fs';
 import path from 'path';
-import { analyzeFiles } from './engine.js';
+import { ALL_RULES, analyzeFiles } from './engine.js';
 export function loadCases(root) {
     return fs.readdirSync(root, { withFileTypes: true })
         .filter(entry => entry.isDirectory() && fs.existsSync(path.join(root, entry.name, 'case.json')))
@@ -27,5 +27,5 @@ function findingsIn(dir) {
     if (!fs.existsSync(dir))
         return [];
     const files = fs.readdirSync(dir).filter(f => /\.[cm]?[jt]sx?$/.test(f));
-    return analyzeFiles(dir, files).map(f => `${f.rule} ${f.file}:${f.line}`);
+    return analyzeFiles(dir, files, { rules: ALL_RULES }).map(f => `${f.rule} ${f.file}:${f.line}`);
 }

package/dist/semantic/benchmark.test.js

@@ -1,12 +1,16 @@
 import path from 'path';
 import { describe, expect, it } from 'vitest';
+import { CANDIDATE_RULES, ECOSYSTEM_RULES } from './rules/ecosystem/index.js';
 import { loadCases, runCase } from './benchmark.js';
 const ROOT = path.resolve(__dirname, '../../../../benchmarks/semantic');
 describe('semantic benchmark', () => {
     const cases = loadCases(ROOT);
     it('has cases for every built-in rule, including negatives', () => {
         const rules = new Set(cases.map(c => c.rule));
-        expect(rules).toEqual(new Set(['in-memory-aggregation', 'credential-redirect', 'degraded-response-cached', null]));
+        expect(rules).toEqual(new Set([
+            'in-memory-aggregation', 'credential-redirect', 'degraded-response-cached',
+            ...[...ECOSYSTEM_RULES, ...CANDIDATE_RULES].map(rule => rule.id), null,
+        ]));
     });
     for (const bench of cases) {
         it(`${bench.name}: ${bench.note}`, () => {

package/dist/semantic/engine.d.ts

@@ -1,5 +1,8 @@
 import type { SemanticFinding, SemanticRule } from './types.js';
+/** Rules that run by default. */
 export declare const BUILT_IN_RULES: SemanticRule[];
+/** Every rule Rigour ships, candidates included: what can be named to run. */
+export declare const ALL_RULES: SemanticRule[];
 export interface EngineOptions {
     rules?: SemanticRule[];
     batchSize?: number;

package/dist/semantic/engine.js

@@ -3,11 +3,16 @@
  */
 import path from 'path';
 import { loadProjectConfig, programBatches } from './program.js';
+import { ProjectFacts } from './project-facts.js';
 import { Summaries } from './summaries.js';
 import { inMemoryAggregation } from './rules/in-memory-aggregation.js';
 import { credentialRedirect } from './rules/credential-redirect.js';
 import { degradedResponseCached } from './rules/degraded-response-cached.js';
-export const BUILT_IN_RULES = [inMemoryAggregation, credentialRedirect, degradedResponseCached];
+import { CANDIDATE_RULES, ECOSYSTEM_RULES } from './rules/ecosystem/index.js';
+/** Rules that run by default. */
+export const BUILT_IN_RULES = [inMemoryAggregation, credentialRedirect, degradedResponseCached, ...ECOSYSTEM_RULES];
+/** Every rule Rigour ships, candidates included: what can be named to run. */
+export const ALL_RULES = [...BUILT_IN_RULES, ...CANDIDATE_RULES];
 /** Analyze `files` (cwd-relative or absolute). Declaration files are skipped. */
 export function analyzeFiles(cwd, files, opts = {}) {
     const rules = opts.rules ?? BUILT_IN_RULES;
@@ -19,6 +24,7 @@ export function analyzeFiles(cwd, files, opts = {}) {
     const { options } = loadProjectConfig(cwd);
     const rootSet = new Set(roots.map(r => path.normalize(r)));
     const findings = [];
+    const project = new ProjectFacts(cwd);
     for (const program of programBatches(roots, options, opts.batchSize)) {
         const checker = program.getTypeChecker();
         const summaries = new Summaries(checker);
@@ -26,7 +32,7 @@ export function analyzeFiles(cwd, files, opts = {}) {
             if (!rootSet.has(path.normalize(sourceFile.fileName)))
                 continue;
             for (const rule of rules) {
-                findings.push(...rule.check({ cwd, checker, sourceFile, summaries }));
+                findings.push(...rule.check({ cwd, program, checker, sourceFile, summaries, project }));
             }
             rootSet.delete(path.normalize(sourceFile.fileName));
         }

package/dist/semantic/failure-handling.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Does a call handle its own failure? Shared by the intent checks and the
+ * training-site export, so both see a call the same way.
+ */
+import ts from 'typescript';
+import { type FunctionLike } from './ast.js';
+export declare function isPromiseAll(call: ts.CallExpression): boolean;
+export declare function isPromiseAllSettled(call: ts.CallExpression): boolean;
+/** Inside a `try` (with a catch) of the same function: the rejection is handled there. */
+export declare function isInsideTry(node: ts.Node, fn: FunctionLike): boolean;
+/** `x().catch(...)`, `x().then(ok, fail)`, or a callee whose body catches and returns. */
+export declare function handlesOwnFailure(checker: ts.TypeChecker, call: ts.CallExpression): boolean;

package/dist/semantic/failure-handling.js

@@ -0,0 +1,41 @@
+/**
+ * Does a call handle its own failure? Shared by the intent checks and the
+ * training-site export, so both see a call the same way.
+ */
+import ts from 'typescript';
+import { calledFunction } from './ast.js';
+export function isPromiseAll(call) {
+    return isPromiseMethod(call, 'all');
+}
+export function isPromiseAllSettled(call) {
+    return isPromiseMethod(call, 'allSettled');
+}
+function isPromiseMethod(call, name) {
+    const callee = call.expression;
+    return ts.isPropertyAccessExpression(callee) && callee.name.text === name
+        && ts.isIdentifier(callee.expression) && callee.expression.text === 'Promise';
+}
+/** Inside a `try` (with a catch) of the same function: the rejection is handled there. */
+export function isInsideTry(node, fn) {
+    for (let child = node, parent = node.parent; parent && parent !== fn; child = parent, parent = parent.parent) {
+        if (ts.isTryStatement(parent) && parent.tryBlock === child && parent.catchClause)
+            return true;
+    }
+    return false;
+}
+/** `x().catch(...)`, `x().then(ok, fail)`, or a callee whose body catches and returns. */
+export function handlesOwnFailure(checker, call) {
+    const callee = call.expression;
+    if (ts.isPropertyAccessExpression(callee)) {
+        if (callee.name.text === 'catch' || callee.name.text === 'finally')
+            return true;
+        if (callee.name.text === 'then' && call.arguments.length >= 2)
+            return true;
+    }
+    const target = calledFunction(checker, call);
+    const body = target?.body;
+    return !!body && ts.isBlock(body) && body.statements.some(s => ts.isTryStatement(s) && !!s.catchClause && catchReturns(s.catchClause));
+}
+function catchReturns(clause) {
+    return clause.block.statements.some(s => ts.isReturnStatement(s));
+}

package/dist/semantic/intent/parallel-reads.js

@@ -7,7 +7,8 @@
  * which the code cannot say; see intent-check.ts.
  */
 import ts from 'typescript';
-import { calledFunction, enclosingFunction, forEachNode, lineOf, relativeFile, unwrap } from '../ast.js';
+import { enclosingFunction, forEachNode, lineOf, relativeFile, unwrap } from '../ast.js';
+import { handlesOwnFailure, isInsideTry, isPromiseAll } from '../failure-handling.js';
 import { promiseAllItems } from '../origins.js';
 import { functionKeyOf } from '../learn/identity.js';
 export function findParallelReads(cwd, checker, sourceFile) {
@@ -28,32 +29,3 @@ export function findParallelReads(cwd, checker, sourceFile) {
     });
     return sites;
 }
-function isPromiseAll(call) {
-    const callee = call.expression;
-    return ts.isPropertyAccessExpression(callee) && callee.name.text === 'all'
-        && ts.isIdentifier(callee.expression) && callee.expression.text === 'Promise';
-}
-/** Inside a `try` (with a catch) of the same function: the rejection is handled there. */
-function isInsideTry(node, fn) {
-    for (let child = node, parent = node.parent; parent && parent !== fn; child = parent, parent = parent.parent) {
-        if (ts.isTryStatement(parent) && parent.tryBlock === child && parent.catchClause)
-            return true;
-    }
-    return false;
-}
-/** `x().catch(...)`, `x().then(ok, fail)`, or a callee whose body catches and returns. */
-function handlesOwnFailure(checker, call) {
-    const callee = call.expression;
-    if (ts.isPropertyAccessExpression(callee)) {
-        if (callee.name.text === 'catch' || callee.name.text === 'finally')
-            return true;
-        if (callee.name.text === 'then' && call.arguments.length >= 2)
-            return true;
-    }
-    const target = calledFunction(checker, call);
-    const body = target?.body;
-    return !!body && ts.isBlock(body) && body.statements.some(s => ts.isTryStatement(s) && !!s.catchClause && catchReturns(s.catchClause));
-}
-function catchReturns(clause) {
-    return clause.block.statements.some(s => ts.isReturnStatement(s));
-}

package/dist/semantic/project-facts.d.ts

@@ -0,0 +1,25 @@
+import ts from 'typescript';
+export declare class ProjectFacts {
+    private readonly cwd;
+    private readonly packages;
+    private readonly options;
+    constructor(cwd: string);
+    /** Declared dependency names and version ranges of the package that owns `file`. */
+    dependencies(file: string): Map<string, string>;
+    /** Directory of the package.json that owns `file`. */
+    packageDir(file: string): string | undefined;
+    /** The `name` of the package that owns `file`. */
+    packageName(file: string): string | undefined;
+    declares(file: string, ...names: string[]): boolean;
+    /**
+     * Highest major version a declared dependency may run on, across every field
+     * and `||` alternative (`>=18.0.0 || >=19.0.0` -> 19). A package that supports
+     * a major must work on it. Undefined when no range names a version (`catalog:`, `workspace:*`).
+     */
+    majorVersion(file: string, name: string): number | undefined;
+    /** Compiler options of the nearest tsconfig.json above `file`, extends resolved. */
+    compilerOptions(file: string): ts.CompilerOptions;
+    private dirsUp;
+    private nearestPackage;
+    private readPackage;
+}

package/dist/semantic/project-facts.js

@@ -0,0 +1,104 @@
+/**
+ * What a file's own package declares: its nearest package.json dependencies and
+ * nearest tsconfig compiler options. Ecosystem rules are gated on these, so a
+ * Solid rule only runs where Solid is a dependency, and in a monorepo each
+ * package is judged by its own manifest. Lookups never leave `cwd`, and are
+ * cached for one analysis run.
+ */
+import fs from 'fs';
+import path from 'path';
+import ts from 'typescript';
+const DEPENDENCY_FIELDS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+export class ProjectFacts {
+    cwd;
+    packages = new Map();
+    options = new Map();
+    constructor(cwd) {
+        this.cwd = cwd;
+    }
+    /** Declared dependency names and version ranges of the package that owns `file`. */
+    dependencies(file) {
+        return this.nearestPackage(file)?.dependencies ?? new Map();
+    }
+    /** Directory of the package.json that owns `file`. */
+    packageDir(file) {
+        return this.dirsUp(file).find(dir => this.readPackage(dir));
+    }
+    /** The `name` of the package that owns `file`. */
+    packageName(file) {
+        return this.nearestPackage(file)?.name;
+    }
+    declares(file, ...names) {
+        const deps = this.dependencies(file);
+        return names.some(name => deps.has(name));
+    }
+    /**
+     * Highest major version a declared dependency may run on, across every field
+     * and `||` alternative (`>=18.0.0 || >=19.0.0` -> 19). A package that supports
+     * a major must work on it. Undefined when no range names a version (`catalog:`, `workspace:*`).
+     */
+    majorVersion(file, name) {
+        const majors = (this.nearestPackage(file)?.ranges.get(name) ?? [])
+            .flatMap(range => range.split('||'))
+            .map(alternative => alternative.match(/(\d+)(?:\.[\dx*]+)*/)?.[1])
+            .filter((m) => m !== undefined)
+            .map(Number);
+        return majors.length ? Math.max(...majors) : undefined;
+    }
+    /** Compiler options of the nearest tsconfig.json above `file`, extends resolved. */
+    compilerOptions(file) {
+        const dir = path.dirname(path.resolve(this.cwd, file));
+        const cached = this.options.get(dir);
+        if (cached)
+            return cached;
+        const configPath = this.dirsUp(file).map(d => path.join(d, 'tsconfig.json')).find(p => fs.existsSync(p));
+        let options = {};
+        if (configPath) {
+            const read = ts.readConfigFile(configPath, ts.sys.readFile);
+            if (!read.error)
+                options = ts.parseJsonConfigFileContent(read.config, ts.sys, path.dirname(configPath)).options;
+        }
+        this.options.set(dir, options);
+        return options;
+    }
+    dirsUp(file) {
+        const root = path.resolve(this.cwd);
+        const dirs = [];
+        for (let dir = path.dirname(path.resolve(root, file)); dir.startsWith(root); dir = path.dirname(dir)) {
+            dirs.push(dir);
+            if (dir === root)
+                break;
+        }
+        return dirs;
+    }
+    nearestPackage(file) {
+        for (const dir of this.dirsUp(file)) {
+            const manifest = this.readPackage(dir);
+            if (manifest)
+                return manifest;
+        }
+        return undefined;
+    }
+    readPackage(dir) {
+        if (this.packages.has(dir))
+            return this.packages.get(dir);
+        let manifest = null;
+        try {
+            const json = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+            const dependencies = new Map();
+            const ranges = new Map();
+            for (const field of DEPENDENCY_FIELDS) {
+                for (const [name, range] of Object.entries(json[field] ?? {})) {
+                    dependencies.set(name, String(range));
+                    ranges.set(name, [...(ranges.get(name) ?? []), String(range)]);
+                }
+            }
+            manifest = { name: typeof json.name === 'string' ? json.name : undefined, dependencies, ranges };
+        }
+        catch {
+            manifest = null;
+        }
+        this.packages.set(dir, manifest);
+        return manifest;
+    }
+}

package/dist/semantic/project-facts.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/semantic/project-facts.test.js

@@ -0,0 +1,45 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { ProjectFacts } from './project-facts.js';
+let root;
+afterEach(() => { if (root)
+    fs.rmSync(root, { recursive: true, force: true }); root = undefined; });
+function write(files) {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), 'project-facts-'));
+    for (const [name, text] of Object.entries(files)) {
+        fs.mkdirSync(path.dirname(path.join(root, name)), { recursive: true });
+        fs.writeFileSync(path.join(root, name), text);
+    }
+    return root;
+}
+describe('ProjectFacts', () => {
+    it('reads the nearest package.json, so each monorepo package is judged by its own', () => {
+        const dir = write({
+            'package.json': JSON.stringify({ name: 'root', devDependencies: { vite: '^5.0.0' } }),
+            'packages/ui/package.json': JSON.stringify({ name: '@x/ui', peerDependencies: { 'solid-js': '^1.8.0' } }),
+            'packages/ui/src/a.tsx': '',
+        });
+        const facts = new ProjectFacts(dir);
+        expect(facts.declares('packages/ui/src/a.tsx', 'solid-js')).toBe(true);
+        expect(facts.declares('packages/ui/src/a.tsx', 'vite')).toBe(false);
+        expect(facts.majorVersion('packages/ui/src/a.tsx', 'solid-js')).toBe(1);
+        expect(facts.packageName('packages/ui/src/a.tsx')).toBe('@x/ui');
+        expect(facts.packageDir('packages/ui/src/a.tsx')).toBe(path.join(dir, 'packages/ui'));
+    });
+    it('never reads a manifest above cwd', () => {
+        const dir = write({ 'package.json': JSON.stringify({ dependencies: { react: '^19.0.0' } }), 'app/src/a.tsx': '' });
+        const facts = new ProjectFacts(path.join(dir, 'app'));
+        expect(facts.dependencies('src/a.tsx').size).toBe(0);
+        expect(facts.packageDir('src/a.tsx')).toBeUndefined();
+    });
+    it('resolves compiler options through tsconfig extends', () => {
+        const dir = write({
+            'tsconfig.base.json': JSON.stringify({ compilerOptions: { stripInternal: true } }),
+            'pkg/tsconfig.json': JSON.stringify({ extends: '../tsconfig.base.json' }),
+            'pkg/src/a.ts': '',
+        });
+        expect(new ProjectFacts(dir).compilerOptions('pkg/src/a.ts').stripInternal).toBe(true);
+    });
+});

package/dist/semantic/rules/ecosystem/deps-codegen-undeclared-import.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const depsCodegenUndeclaredImport: SemanticRule;