@roomi-fields/grillhouse 0.0.0-stage → 0.23.0

package/scripts/etat-du-circuit.mjs

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+// The summary of the circuit's state of a ticket, bounded, as `kubectl describe` or `gh run view`
+// give a view of an object in place of its raw record: the regulator reads the state by it (its
+// instruction names it), since the state, its report carrying the detail of a final pass, can pass
+// the limit of the tool Read (BPScript 320.4: 33 k tokens, past the 25 k of Read).
+//
+//   npx grillhouse etat-du-circuit <état>      <état> the path of `<copie>.circuit.json`
+//
+// prints, in BORNE characters at most: the step (« 2.3 Code ») and its component, its attempt and
+// its loops; the stop, its name and code; the components of the title and those reached; the
+// returns kept for a component; the last reds of the report (its lines `- …`); the head of the
+// report; and the files: the ticket's log, its proofs (the last ones), its sheets, and what the
+// copy changes against HEAD (`git status --porcelain`). Each line is cut to LIGNE characters. An
+// unreadable state is said on stderr, exit 1.
+import { spawnSync } from 'node:child_process';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { etapeDuCircuit, libelle } from './etapes.mjs';
+
+// The bound of the summary, in characters: under the 25 000 tokens of Read at any count of
+// characters per token above 1.
+export const BORNE = 20_000;
+const LIGNE = 300;
+const ROUGES = 20;
+const TETE = 30;
+const PREUVES = 3;
+const CHANGES = 40;
+
+const couper = l => (l.length > LIGNE ? `${l.slice(0, LIGNE - 1)}…` : l);
+// The <n> first (or, <fin>, last) items of <liste>, the rest counted.
+function borner(liste, n, fin = false) {
+  if (liste.length <= n) return liste;
+  const reste = `… ${liste.length - n} de plus`;
+  return fin ? [reste, ...liste.slice(-n)] : [...liste.slice(0, n), reste];
+}
+
+// The summary of the state in the file <fichier>; throws when it cannot be read.
+export function resumeDeLEtat(fichier) {
+  const etat = JSON.parse(readFileSync(fichier, 'utf8'));
+  const copie = fichier.replace(/\.circuit\.json$/, '');
+  const ticket = path.basename(copie);
+  const e = etapeDuCircuit(etat);
+  const rapport = String(etat.rapport ?? '')
+    .split('\n')
+    .map(l => l.trimEnd());
+  const rouges = rapport.filter(l => /^\s*- /.test(l)).map(l => l.trim());
+  const dossier = path.dirname(fichier);
+  const preuves = existsSync(dossier)
+    ? readdirSync(dossier)
+        .map(f => [
+          f,
+          new RegExp(
+            `^${ticket.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\.preuve-(\\d+)\\.md$`
+          ).exec(f),
+        ])
+        .filter(([, m]) => m)
+        .sort(([, a], [, b]) => Number(a[1]) - Number(b[1]))
+        .map(([f]) => path.join(dossier, f))
+    : [];
+  const statut = existsSync(copie)
+    ? spawnSync('git', ['-C', copie, 'status', '--porcelain'], { encoding: 'utf8' })
+    : null;
+  const changes = statut?.status === 0 ? statut.stdout.split('\n').filter(Boolean) : [];
+  const renvois = Object.entries(etat.renvois ?? {}).map(
+    ([c, r]) => `- ${c} → ${r?.etape ?? '?'} : ${String(r?.[r?.etape] ?? '').replace(/\s+/g, ' ')}`
+  );
+  const lignes = [
+    `L'ÉTAT DU CIRCUIT de ${ticket} (${fichier})`,
+    '',
+    `Étape : ${e ? libelle(e) : etat.etape} — composant ${etat.composant ?? 'aucun'} — tentative ${etat.tentative ?? 0}${etat.boucles ? ` — boucles ${JSON.stringify(etat.boucles)}` : ''}`,
+    `Arrêt : ${etat.raison ?? 'aucun'} (code ${etat.code ?? 'aucun'})`,
+    `Composants du titre : ${(etat.composants ?? []).join(', ') || 'aucun'}`,
+    `Atteints : ${(etat.atteints ?? []).join(', ') || 'aucun'}`,
+    ...(renvois.length ? ['', 'Renvois :', ...renvois] : []),
+    '',
+    `Les derniers rouges du rapport (${rouges.length}) :`,
+    ...(rouges.length ? borner(rouges, ROUGES, true) : ['aucun']),
+    '',
+    `Le rapport, sa tête (${rapport.length} lignes ; le détail est au journal) :`,
+    ...borner(rapport, TETE),
+    '',
+    'Les fichiers :',
+    `- le journal : ${etat.journal ?? `${copie}.log`}`,
+    ...borner(preuves, PREUVES, true).map(p => (p.startsWith('…') ? p : `- une preuve : ${p}`)),
+    `- les fiches : ${copie}.fiches.jsonl`,
+    `- ce que la copie change (${changes.length}) :`,
+    ...(changes.length ? borner(changes, CHANGES) : ['aucun']),
+  ].map(couper);
+  let texte = `${lignes.join('\n')}\n`;
+  if (texte.length > BORNE) texte = `${texte.slice(0, BORNE - 2)}…\n`;
+  return texte;
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+  const fichier = process.argv[2];
+  try {
+    if (!fichier) throw new Error('usage : npx grillhouse etat-du-circuit <état>');
+    process.stdout.write(resumeDeLEtat(path.resolve(fichier)));
+  } catch (e) {
+    process.stderr.write(`grillhouse etat-du-circuit : ${fichier ?? ''} illisible : ${e.message}\n`);
+    process.exitCode = 1;
+  }
+}

package/scripts/frontieres.mjs

@@ -0,0 +1,456 @@
+#!/usr/bin/env node
+// The boundaries of the code, checked by dependency-cruiser. Its configuration
+// (`.dependency-cruiser.cjs`) is generated from the components of the repository, like the index
+// of the interfaces; a project adds its own rules and options in `.dependency-cruiser.projet.cjs`
+// (`module.exports = { forbidden: [...], options: {...} }`), which the generated file reads when
+// dependency-cruiser loads it. The file brings every key of dependency-cruiser's configuration:
+// its `forbidden`, `allowed` and `required` rules add to the frame's; `allowedSeverity` and
+// `extends` pass as they are. Its `exclude` and `doNotFollow` patterns add to the frame's; any
+// other option replaces the frame's at its first level, as the `extends` of dependency-cruiser does.
+//
+//   npx grillhouse frontieres           refuses a stale configuration, then runs dependency-cruiser
+//   npx grillhouse frontieres --ecrire  writes the configuration
+//
+// The rules: no cycle; a package reaches another by its name, never by a path into its tree; a
+// module of `src/` reaches another by its entry (`index`); the code of `src/` imports no test; the
+// published code imports no development dependency, whether it imports values or only types: it
+// is the code of `src/` outside the test files, and every file that the `exports` of a package
+// reach (each target of a condition, the exported test material included) with the files these
+// import; every import resolves (a path a package does not export is refused); an orphan file is
+// reported, without refusing, unless it is an entry: an index, a configuration, a declaration, a
+// test, or a file that the `bin` field of a package names (its commands, as knip takes them). Who uses which component is the consumers check's
+// (`scripts/consommateurs.mjs`). The files of a package out of the frame
+// (`docs/agents/hors-cadre.txt`) are excluded, and no module rule is written for it.
+//
+// An error of dependency-cruiser inscribed in the project's debt (`grillhouse-dette.json`, see
+// `dette.mjs`) passes, keyed by the file it starts from and the rule's name; the report, written by
+// dependency-cruiser's `err-long` reporter, ignores the errors the debt covers as known violations
+// (`--ignore-known`). A stale configuration and an entry without a source are never inscribed.
+//
+// The published code is found before dependency-cruiser runs: each package under `packages/`
+// names its entries, the targets of its `exports`; an entry is a TypeScript source, a JavaScript
+// source that no `tsconfig*.json` of the package emits (a package written in JavaScript, the
+// frame's own), or a built file that comes back to its sources by what TypeScript emits with the
+// `tsconfig*.json` of the package; a declaration (`.d.ts`) or a JSON file carries no code and is
+// no entry; an entry that is none of these is refused, named. A first run of dependency-cruiser gives
+// the files these sources import; the second judges them, through the file that
+// `GRILLHOUSE_JUGES` names, which the generated configuration reads.
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { composants } from './consommateurs.mjs';
+import { horsCadre } from './paquets.mjs';
+import { trancher } from './dette.mjs';
+
+export const CONFIGURATION = '.dependency-cruiser.cjs';
+export const RACINES = ['src', 'packages'];
+const TESTS = '(^|/)(test|tests|__tests__)/|[.](test|spec)[.][a-z]+$';
+const CODE = '^src/|^packages/[^/]+/src/';
+const REGLE_OUTILS = 'pas-d-outil-de-developpement-dans-le-code';
+// The environment variable naming the file that holds the pattern of the published files.
+const JUGES = 'GRILLHOUSE_JUGES';
+
+// The `exclude` patterns of the configuration: built files, and the directories under `src/` and
+// `packages/` that the list out of the frame names.
+function exclus(racine) {
+  const motifs = ['^(dist|build|coverage)/', '^packages/[^/]+/(dist|build|coverage)/'];
+  for (const nom of [...horsCadre(racine)].sort()) {
+    motifs.push(`^(packages|src)/${nom.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}/`);
+  }
+  return motifs;
+}
+
+// The width of a line of the generated configuration, the project's (`.prettierrc`).
+const LARGEUR = 100;
+
+// A rule as JavaScript lines at indent <retrait>, each within LARGEUR columns: one key per line,
+// a string too long for its line cut at a space, a `|` or the width into pieces joined by `+`.
+function ecrire(regle, retrait) {
+  const lignes = JSON.stringify(regle, null, 2).split('\n');
+  return lignes
+    .map(l => {
+      const ligne = retrait + l;
+      const m = /^(\s*(?:"[^"]*": )?)"(.*)"(,?)$/.exec(ligne);
+      if (ligne.length <= LARGEUR || !m) return ligne;
+      const [, tete, valeur, virgule] = m;
+      const pieces = [];
+      let reste = valeur;
+      const place = LARGEUR - tete.length - 6;
+      while (reste.length > place) {
+        const dans = reste.slice(0, place);
+        let coupe = Math.max(dans.lastIndexOf(' '), dans.lastIndexOf('|')) + 1;
+        if (coupe === 0) coupe = place;
+        while (reste[coupe - 1] === '\\') coupe -= 1;
+        pieces.push(reste.slice(0, coupe));
+        reste = reste.slice(coupe);
+      }
+      pieces.push(reste);
+      const pas = `${/^\s*/.exec(tete)[0]}  `;
+      return `${tete}"${pieces.join(`" +\n${pas}"`)}"${virgule}`;
+    })
+    .join('\n');
+}
+
+// The patterns of the files that the `bin` field of a package of <racine> names (a path, or an
+// object of paths), each from the root: entries of the package, as knip takes them.
+function entreesBin(racine) {
+  return composants(racine).flatMap(({ dir }) => {
+    const fichier = path.join(dir, 'package.json');
+    if (!existsSync(fichier)) return [];
+    const { bin } = JSON.parse(readFileSync(fichier, 'utf8'));
+    const cibles = typeof bin === 'string' ? [bin] : Object.values(bin ?? {});
+    return cibles
+      .filter(c => typeof c === 'string')
+      .map(c => `^${echappe(posix(path.relative(racine, path.resolve(dir, c))))}$`);
+  });
+}
+
+// The configuration text for the repository at <racine>.
+export function configuration(racine) {
+  const modules = composants(racine).filter(c => path.relative(racine, c.dir).startsWith('src/'));
+  const bin = [...new Set(entreesBin(racine))].sort();
+  const regles = [
+    {
+      name: 'pas-de-cycle',
+      comment: 'aucun module ne dépend de lui-même par un détour',
+      severity: 'error',
+      from: {},
+      to: { circular: true },
+    },
+    {
+      name: 'un-paquet-par-son-nom',
+      comment: 'un paquet en importe un autre par son nom, jamais par un chemin dans son arbre',
+      severity: 'error',
+      from: { path: '^packages/([^/]+)/' },
+      to: { path: '^packages/([^/]+)/', pathNot: '^packages/$1/' },
+    },
+    {
+      name: 'pas-de-test-dans-le-code',
+      comment: "le code livré n'importe aucun test",
+      severity: 'error',
+      from: { path: CODE, pathNot: TESTS },
+      to: { path: TESTS },
+    },
+    {
+      name: REGLE_OUTILS,
+      comment:
+        "le code livré (src et ce que les exports du paquet atteignent) n'importe aucune " +
+        'dépendance de développement, types compris',
+      severity: 'error',
+      from: { path: CODE, pathNot: TESTS },
+      to: { dependencyTypes: ['npm-dev'] },
+    },
+    {
+      name: 'tout-import-se-resout',
+      comment: "un import se résout : un chemin qu'un paquet n'exporte pas est refusé",
+      severity: 'error',
+      from: {},
+      to: { couldNotResolve: true },
+    },
+    {
+      name: 'pas-d-orphelin',
+      comment: "un fichier que rien n'importe est signalé",
+      severity: 'warn',
+      from: {
+        orphan: true,
+        pathNot: [`${TESTS}|(^|/)index[.][a-z]+$|[.]d[.]ts$|[.]config[.][a-z]+$`, ...bin].join('|'),
+      },
+      to: {},
+    },
+  ];
+  if (modules.length) {
+    regles.splice(2, 0, {
+      name: 'un-module-par-son-entree',
+      comment:
+        "un module de src en importe un autre par son entrée (index), jamais par l'intérieur",
+      severity: 'error',
+      from: { path: '^src/([^/]+)/' },
+      to: { path: '^src/([^/]+)/', pathNot: '^src/$1/|^src/[^/]+/index[.][a-z]+$' },
+    });
+  }
+  const tsconfig = existsSync(path.join(racine, 'tsconfig.json'));
+  return `// Généré par \`npx grillhouse frontieres --ecrire\` ; ne pas éditer. Les règles et les options
+// propres au projet vivent dans .dependency-cruiser.projet.cjs, lu au chargement.
+const fs = require('node:fs');
+const projet = fs.existsSync(\`\${__dirname}/.dependency-cruiser.projet.cjs\`)
+  ? require('./.dependency-cruiser.projet.cjs')
+  : {};
+
+// The non-empty patterns of a filter written in any form dependency-cruiser accepts.
+const motifs = f => {
+  if (typeof f === 'string') return [f];
+  if (Array.isArray(f)) return f;
+  return f && typeof f === 'object' ? motifs(f.path) : [];
+};
+// A filter of the frame plus the project's: the patterns add up, the other keys are the project's.
+const ajoute = (cadre, propre) => {
+  const ajouts = motifs(propre).filter(Boolean);
+  const reste = propre && typeof propre === 'object' && !Array.isArray(propre) ? propre : {};
+  return { ...reste, path: [cadre.path, ...ajouts].join('|') };
+};
+// The published files that the script found (a pattern, in the file ${JUGES} names)
+// replace the default scope of the rule that refuses a development dependency.
+const fichierJuges = process.env.${JUGES};
+const juges = fichierJuges ? fs.readFileSync(fichierJuges, 'utf8') : null;
+const portee = regle =>
+  regle.name === '${REGLE_OUTILS}' && juges !== null
+    ? { ...regle, from: { path: juges } }
+    : regle;
+const cadre = {
+  doNotFollow: { path: 'node_modules' },
+  exclude: {
+    path: [
+${exclus(racine)
+  .map(m => `      '${m.replace(/[\\']/g, '\\$&')}',`)
+  .join('\n')}
+    ].join('|'),
+  },
+  tsPreCompilationDeps: true,
+  preserveSymlinks: true,
+${tsconfig ? "  tsConfig: { fileName: 'tsconfig.json' },\n" : ''}  enhancedResolveOptions: {
+    exportsFields: ['exports'],
+    conditionNames: ['import', 'require', 'default', 'types'],
+  },
+};
+
+module.exports = {
+  forbidden: [
+    ...[
+${regles.map(r => `${ecrire(r, '      ')},`).join('\n')}
+    ].map(portee),
+    ...(projet.forbidden ?? []),
+  ],
+  ...(projet.allowed ? { allowed: projet.allowed } : {}),
+  ...(projet.required ? { required: projet.required } : {}),
+  ...(projet.allowedSeverity ? { allowedSeverity: projet.allowedSeverity } : {}),
+  ...(projet.extends ? { extends: projet.extends } : {}),
+  options: {
+    ...cadre,
+    ...projet.options,
+    doNotFollow: ajoute(cadre.doNotFollow, projet.options?.doNotFollow),
+    exclude: ajoute(cadre.exclude, projet.options?.exclude),
+  },
+};
+`;
+}
+
+// ---- The published code -------------------------------------------------------------------------
+
+const requis = createRequire(import.meta.url);
+const posix = chemin => chemin.split(path.sep).join('/');
+const echappe = texte => texte.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const DECLARATION = /[.]d[.]ts$/;
+const SOURCE_TS = /[.]tsx?$/;
+const SOURCE_JS = /[.][mc]?js$/;
+
+// What the `tsconfig*.json` of the package at <dir> emit, as TypeScript reads them (their
+// `extends` included) and computes their output (`getOutputFileNames`): a Map from the absolute
+// path of an emitted file to the sources it comes from.
+export function sorties(dir) {
+  const ts = requis('typescript');
+  const hote = { ...ts.sys, onUnRecoverableConfigFileDiagnostic: () => {} };
+  const table = new Map();
+  for (const e of readdirSync(dir, { withFileTypes: true })) {
+    if (!e.isFile() || !/^tsconfig.*[.]json$/.test(e.name)) continue;
+    const analyse = ts.getParsedCommandLineOfConfigFile(path.join(dir, e.name), {}, hote);
+    if (!analyse || analyse.options.noEmit) continue;
+    for (const source of analyse.fileNames.map(f => path.resolve(f))) {
+      if (DECLARATION.test(source) || !existsSync(source)) continue;
+      const emises = ts.getOutputFileNames(analyse, source, ts.sys.useCaseSensitiveFileNames);
+      for (const sortie of emises) {
+        const chemin = path.resolve(sortie);
+        if (chemin !== source) table.set(chemin, new Set([...(table.get(chemin) ?? []), source]));
+      }
+    }
+  }
+  return table;
+}
+
+// The targets of an `exports` value: the string itself, or the targets of each value of an object
+// (its subpaths and its conditions).
+function cibles(valeur) {
+  if (typeof valeur === 'string') return [valeur];
+  return valeur && typeof valeur === 'object' ? Object.values(valeur).flatMap(cibles) : [];
+}
+
+// The source files published by the package at <dir>, and the entries without a source:
+// { sources: Set of absolute paths, refus: [message] }. An entry is its own source when it is a
+// TypeScript source that exists, or a JavaScript source that exists and TypeScript does not emit,
+// else its sources are those TypeScript emits it from; a declaration or a JSON file is skipped.
+function sourcesDuPaquet(racine, dir) {
+  const sources = new Set();
+  const refus = [];
+  const fichier = path.join(dir, 'package.json');
+  if (!existsSync(fichier)) return { sources, refus };
+  const entrees = cibles(JSON.parse(readFileSync(fichier, 'utf8')).exports);
+  if (entrees.length === 0) return { sources, refus };
+  const emis = sorties(dir);
+  for (const cible of entrees) {
+    const abs = path.resolve(dir, cible);
+    if (DECLARATION.test(abs) || abs.endsWith('.json')) continue;
+    const source =
+      SOURCE_TS.test(abs) || (SOURCE_JS.test(abs) && !emis.has(abs) && existsSync(abs));
+    const trouvees = source ? [abs].filter(f => existsSync(f)) : [...(emis.get(abs) ?? [])];
+    if (trouvees.length === 0) {
+      refus.push(
+        `⛔ ${posix(path.relative(racine, fichier))} : l'entrée ${cible} n'a pas de source — ` +
+          'ni fichier source, ni configuration TypeScript du paquet qui la produise.'
+      );
+    }
+    for (const f of trouvees) sources.add(f);
+  }
+  return { sources, refus };
+}
+
+// The sources published by the packages of the repository at <racine>, as paths relative to
+// <racine>, with the entries refused: { sources: Set, refus: [message] }.
+export function publiees(racine) {
+  const sources = new Set();
+  const refus = [];
+  for (const { dir } of composants(racine)) {
+    const trouve = sourcesDuPaquet(racine, dir);
+    for (const f of trouve.sources) sources.add(posix(path.relative(racine, f)));
+    refus.push(...trouve.refus);
+  }
+  return { sources, refus };
+}
+
+// One run of dependency-cruiser over <racines>; `json` gives the graph on the standard output.
+// <connues>, when given, names the file of the known violations dependency-cruiser ignores
+// (`--ignore-known`).
+function depcruise(racine, racines, type, environnement, connues = null) {
+  const json = type === 'json';
+  const ignorees = connues ? ['--ignore-known', connues] : [];
+  return spawnSync(
+    'npx',
+    [
+      '--no-install',
+      'depcruise',
+      ...racines,
+      '--config',
+      CONFIGURATION,
+      '--output-type',
+      type,
+      ...ignorees,
+    ],
+    {
+      cwd: racine,
+      env: environnement,
+      encoding: 'utf8',
+      stdio: json ? ['ignore', 'pipe', 'inherit'] : 'inherit',
+      maxBuffer: 1024 * 1024 * 512,
+    }
+  );
+}
+
+// The files the rule judges, from the graph that dependency-cruiser gives: the code of `src/`
+// outside the test files, and every file reached from a published source without crossing
+// node_modules.
+function aJuger(graphe, sources) {
+  const modules = new Map(graphe.modules.map(m => [m.source, m]));
+  const juges = new Set(
+    [...modules.keys()].filter(f => new RegExp(CODE).test(f) && !new RegExp(TESTS).test(f))
+  );
+  const atteints = new Set();
+  const pile = [...sources];
+  while (pile.length) {
+    const f = pile.pop();
+    if (atteints.has(f)) continue;
+    atteints.add(f);
+    juges.add(f);
+    for (const d of modules.get(f)?.dependencies ?? []) {
+      if (d.couldNotResolve || d.coreModule || /(^|\/)node_modules\//.test(d.resolved)) continue;
+      pile.push(d.resolved);
+    }
+  }
+  return juges;
+}
+
+// The errors of a cruise result as findings the debt (`dette.mjs`) judges: keyed by the file a
+// violation starts from and its rule's name, the violation kept to be reported.
+export function constats(resultat) {
+  return resultat.summary.violations
+    .filter(v => v.rule.severity === 'error')
+    .map(v => ({
+      fichier: v.from,
+      regle: v.rule.name,
+      message: `${v.rule.name}: ${v.from} → ${v.to}`,
+      violation: v,
+    }));
+}
+
+// The pattern of the files to judge, as dependency-cruiser's `path` filter reads it.
+const motifDes = fichiers => `^(${[...fichiers].sort().map(echappe).join('|')})$`;
+
+// The command on the repository at <racine>, with <args>: its exit code.
+function frontieres(racine, args) {
+  const attendu = configuration(racine);
+  const cible = path.join(racine, CONFIGURATION);
+  if (args.includes('--ecrire')) {
+    writeFileSync(cible, attendu);
+    return 0;
+  }
+  const present = existsSync(cible) ? readFileSync(cible, 'utf8') : '';
+  if (present !== attendu) {
+    process.stderr.write(
+      `⛔ ${CONFIGURATION} n'est pas à jour avec les composants : npx grillhouse frontieres --ecrire le régénère.\n`
+    );
+    return 1;
+  }
+  // An entry without a source stops the check before dependency-cruiser runs.
+  const { sources, refus } = publiees(racine);
+  if (refus.length > 0) {
+    process.stderr.write(`${refus.join('\n')}\n`);
+    return 1;
+  }
+  const racines = RACINES.filter(r => existsSync(path.join(racine, r)));
+  if (racines.length === 0) return 0;
+  const environnement = { ...process.env };
+  delete environnement[JUGES];
+  let dossier = null;
+  try {
+    if (sources.size > 0) {
+      const graphe = depcruise(racine, racines, 'json', environnement);
+      if (!graphe.stdout) return graphe.status || 1;
+      dossier = mkdtempSync(path.join(tmpdir(), 'frontieres-'));
+      const fichier = path.join(dossier, 'juges.txt');
+      writeFileSync(fichier, motifDes(aJuger(JSON.parse(graphe.stdout), sources)));
+      environnement[JUGES] = fichier;
+    }
+    const r = depcruise(racine, racines, 'json', environnement);
+    if (!r.stdout) return r.status || 1;
+    const resultat = JSON.parse(r.stdout);
+    const { refus, lignes } = trancher(racine, 'frontieres', constats(resultat));
+    // The report is dependency-cruiser's own (`err-long`): the result formatted as it is when the
+    // debt covers nothing, else a cruise that ignores the violations the debt covers, given as its
+    // known violations (`--ignore-known`).
+    const refusees = new Set(refus.map(c => c.violation));
+    const couvertes = resultat.summary.violations.filter(
+      v => v.rule.severity === 'error' && !refusees.has(v)
+    );
+    dossier ??= mkdtempSync(path.join(tmpdir(), 'frontieres-'));
+    if (couvertes.length) {
+      const connues = path.join(dossier, 'connues.json');
+      writeFileSync(connues, JSON.stringify(couvertes));
+      depcruise(racine, racines, 'err-long', environnement, connues);
+    } else {
+      const fichier = path.join(dossier, 'resultat.json');
+      writeFileSync(fichier, r.stdout);
+      spawnSync('npx', ['--no-install', 'depcruise-fmt', fichier, '--output-type', 'err-long'], {
+        cwd: racine,
+        stdio: 'inherit',
+      });
+    }
+    for (const l of lignes) process.stderr.write(`${l}\n`);
+    return refus.length ? 1 : 0;
+  } finally {
+    if (dossier) rmSync(dossier, { recursive: true, force: true });
+  }
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+  process.exitCode = frontieres(process.cwd(), process.argv.slice(2));
+}

package/scripts/gardes-du-cadre.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+// `grillhouse:gardes`: the frame's guards, the one list of them, played in its order.
+//
+//   npx grillhouse gardes-du-cadre      (npm run grillhouse:gardes, a task of Turborepo)
+//
+// - Each guard is a script of the package, beside this one, and plays in the working directory, under the environment of the run
+//   (`GRILLHOUSE_DETTE` among it, scripts/dette.mjs), whatever the verdict of the ones before: a
+//   red does not stop the pass, as `--continue` does for Turborepo's tasks.
+// - Each red guard is named with its code at the end; the exit code is 1 when one guard is red,
+//   0 when all are green.
+// - While the run names its results directory (`GRILLHOUSE_RESULTATS`, scripts/resultats.mjs),
+//   each guard writes its findings there in SARIF; a red guard that wrote no finding has one
+//   written for it, without location, its name (its script's, without extension) and its code:
+//   a red no reader can place.
+// - The build is not among them: Turborepo builds before this task (turbo.json).
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { ecrireSarif, lireSarif, RESULTATS } from './resultats.mjs';
+
+// A script of the package, beside this one, by its name.
+const ici = nom => fileURLToPath(new URL(nom, import.meta.url));
+
+// The guards of the frame, each its script and its arguments, in the order they play.
+export const GARDES_DU_CADRE = [
+  [ici('turbo-des-paquets.mjs')],
+  [ici('index-interfaces.mjs'), '--verifier'],
+  [ici('consommateurs.mjs')],
+  [ici('consommateurs-arbitres.mjs')],
+  [ici('frontieres.mjs')],
+  [ici('interfaces-contre-code.mjs')],
+  [ici('resumes.mjs')],
+  [ici('code-mort.mjs')],
+];
+
+// The name of each guard of the frame, as its findings carry it: its script's, without extension.
+const nomDeGarde = garde => path.basename(garde[0]).replace(/\.[cm]?js$/, '');
+export const NOMS_DES_GARDES = GARDES_DU_CADRE.map(nomDeGarde);
+// A guard as its lines name it: its subcommand and its arguments.
+const libelle = garde => ['grillhouse', nomDeGarde(garde), ...garde.slice(1)].join(' ');
+
+// Plays each guard of <gardes> in <racine> under <env>; its verdict, 0 or 1. `dire` writes a line.
+export function jouerLesGardes({
+  racine = process.cwd(),
+  gardes = GARDES_DU_CADRE,
+  env = process.env,
+  dire = l => process.stdout.write(`${l}\n`),
+}) {
+  const rouges = [];
+  for (const garde of gardes) {
+    const avant = env[RESULTATS] ? lireSarif(env[RESULTATS]).constats.length : 0;
+    const r = spawnSync(process.execPath, garde, { cwd: racine, env, stdio: 'inherit' });
+    if (r.status === 0) continue;
+    const code = `code ${r.status ?? r.signal}`;
+    rouges.push(`${libelle(garde)} (${code})`);
+    if (env[RESULTATS] && lireSarif(env[RESULTATS]).constats.length === avant) {
+      ecrireSarif({
+        garde: nomDeGarde(garde),
+        racine,
+        env,
+        constats: [{ message: `${libelle(garde)} rouge (${code}), sans constat situé.` }],
+      });
+    }
+  }
+  if (rouges.length === 0) return 0;
+  for (const r of rouges) dire(`⛔ garde rouge : ${r}`);
+  return 1;
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+  process.exitCode = jouerLesGardes({});
+}