@runlith/tagma 0.0.0-stage → 0.2.3

package/plugin/value.d.ts

@@ -0,0 +1,8 @@
+/// <reference path="../types/node/index.d.ts" />
+/// <reference path="../host.d.ts" />
+export type ToolResult = {
+    readonly text: string;
+    readonly structuredContent?: Readonly<Record<string, unknown>>;
+};
+export declare const toolResultOf: (value: unknown) => ToolResult;
+export declare const toolValueOf: (text: string, structuredContent?: unknown) => unknown;

package/plugin/value.js

@@ -0,0 +1,2 @@
+// @bun
+import{_g,fR}from"./plugin-w8f977my.js";export{_g as toolResultOf,fR as toolValueOf};

package/plugin/vendor-pn6b5a8f.js

@@ -0,0 +1,2 @@
+// @bun
+var t=(e)=>e;export{t as subscriptionAccounts};

package/plugin/vendorCall-6n5chrn0.js

@@ -0,0 +1,2 @@
+// @bun
+import{js}from"./plugin-krbbb4ts.js";export{js as VENDOR_CALL_TIMEOUT_MS};

package/plugin/vendorCall-82evk8b3.js

@@ -0,0 +1,2 @@
+// @bun
+import{uk,Gg,lk,Fl}from"./plugin-0e34qaar.js";import"./plugin-dqxdznvd.js";import"./plugin-w3zbkmy6.js";import"./plugin-6vzw5yyr.js";import"./plugin-d28d8jar.js";import"./plugin-7te9b50h.js";import"./plugin-krbbb4ts.js";import"./plugin-72xxqm1t.js";import"./plugin-me00x60n.js";import"./plugin-q6pvb1xf.js";import"./plugin-v80m00bq.js";export{Fl as runFlow,uk as vendorCall,Gg as vendorCallOrFail,lk as vendorWire};

package/plugin/vendorPayload-458354fv.js

@@ -0,0 +1,2 @@
+// @bun
+import{Xn,Jg,ka,uc,dk,gf,yf,Kg}from"./plugin-dqxdznvd.js";import"./plugin-krbbb4ts.js";import"./plugin-72xxqm1t.js";import"./plugin-v80m00bq.js";export{Xn as OAuthFlowFailed,dk as oauthErrorSchema,uc as oauthFailure,yf as parseVendorPayload,Kg as readOAuthError,ka as readableVendorAnswer,gf as vendorSeconds,Jg as withOAuthVendorCallTimeout};

package/plugin/vendorWeb-cz5t01m7.js

@@ -0,0 +1,2 @@
+// @bun
+import{tf,z_}from"./plugin-9zbh7788.js";import"./plugin-v80m00bq.js";export{tf as WebRefused,z_ as mapWebTools};

package/plugin/verbatim-2f2d9n02.js

@@ -0,0 +1,2 @@
+// @bun
+import{e_,t_,n_,Ma}from"./plugin-w3zbkmy6.js";import"./plugin-6vzw5yyr.js";import"./plugin-d28d8jar.js";import"./plugin-7te9b50h.js";import"./plugin-me00x60n.js";import"./plugin-q6pvb1xf.js";import"./plugin-v80m00bq.js";export{e_ as RequestOptions,t_ as head,Ma as layer,n_ as verbatimHttpClient};

package/plugin/xai-2cqraa99.js

@@ -0,0 +1,2 @@
+// @bun
+import"./plugin-v80m00bq.js";import"./plugin-d28d8jar.js";import"./plugin-me00x60n.js";import"./plugin-q6pvb1xf.js";import"./plugin-7te9b50h.js";import"./plugin-6vzw5yyr.js";import"./plugin-3t0qp574.js";import"./plugin-g4hst0jz.js";import"./plugin-8q44b578.js";import"./plugin-72xxqm1t.js";import"./plugin-y9cdpmbv.js";import"./plugin-a3vzpk4e.js";import"./plugin-yp736z4n.js";import"./plugin-g7hrtg2p.js";import"./plugin-24j9hnc7.js";import"./plugin-r7g3vqrm.js";import"./plugin-p6x7emar.js";import"./plugin-w3zbkmy6.js";import"./plugin-krbbb4ts.js";import"./plugin-e5ybk2a2.js";import"./plugin-fjsmz1vy.js";import"./plugin-7xmwhj5h.js";import"./plugin-pdww1ma8.js";import"./plugin-7swap1ad.js";import"./plugin-psj9935q.js";import{Rs,as}from"./plugin-zrb8bbr4.js";import"./plugin-zsv7wawc.js";import"./plugin-2s6bq45c.js";import{am,cm}from"./plugin-ak62rhwz.js";import{Hn}from"./plugin-dd951075.js";import{Is}from"./plugin-fre9hdcg.js";import{Yn}from"./plugin-g0zv4vrz.js";import"./plugin-kc4z9msd.js";import{r}from"./plugin-xfcgt5ba.js";var l="https://api.x.ai/v1",e=32000,t={fromHeaders:()=>null,read:Is},a="The model is currently at capacity due to high demand",p=(o)=>o.code===void 0&&o.message.startsWith(a)?{retryable:!0}:null;function u(o){return Rs({store:!1,reasoningEffort:Yn(o.rung),parallelToolCalls:o.parallelToolCalls})}var m={output:{budget:e,sent:!0},model:(o)=>r(f(o.model,am,Hn(o.credentials,o.ownerId,am,o.account).bearer(),t)),options:u};function f(o,i,s,n){return as.with({provider:i,quota:n.fromHeaders,refusals:p,endpoint:{baseURL:l},limits:{output:e},auth:s}).model({id:o})}var h={...cm,profile:m,quota:t};export{l as XAI_BASE_URL,e as XAI_OUTPUT_RESERVATION,h as xaiConsoleRegistration,f as xaiModel,u as xaiOptions,p as xaiRefusals};

package/plugin/xai-e8sbtk6a.js

@@ -0,0 +1,2 @@
+// @bun
+import{am,L_,pw,cm,D_}from"./plugin-ak62rhwz.js";export{L_ as DEFAULT_XAI_MODEL,am as XAI_PROVIDER,pw as XAI_SPECS,cm as xaiConsoleDescription,D_ as xaiVendor};

package/rules/effect.d.ts

@@ -0,0 +1,55 @@
+import type { Builtin } from './rules.js';
+export type SwallowedFailuresParams = {
+    /** The directory the entries are relative to, from the repository root, with no leading or trailing `/`; empty for the root itself. Default: `""`. */
+    readonly base?: string;
+    /** The directory prefixes, relative to `base`, whose selected files are judged; every entry ends in `/`. */
+    readonly region: readonly [string, ...string[]];
+    /** The files read; absent, every file of the inspection’s languages. */
+    readonly files?: {
+        /** The file extensions read; a changed file with any other is neither read nor failed. Default: `[".ts",".mts",".cts",".tsx",".js",".mjs",".cjs",".jsx",".svelte"]`. */
+        readonly extensions?: readonly ('.ts' | '.mts' | '.cts' | '.tsx' | '.js' | '.mjs' | '.cjs' | '.jsx' | '.svelte')[];
+        /** Glob patterns matched against the path relative to `base`; a matching file is neither read nor failed. Default: `[]`. */
+        readonly exclude?: readonly string[];
+    };
+    /** Exact allowances: the file relative to `base`, the owning symbol, the form and the site, each with its one-line reason. Default: `[]`. */
+    readonly allow?: readonly ({
+        readonly path: string;
+        /** The owning declaration: a top-level name, or `Top.inner` for the nearest named declaration inside it; `(top)` for a module-level statement. */
+        readonly symbol: string;
+        readonly form: 'catch' | 'catchEager' | 'catchCause' | 'orElseSucceed' | 'ignore' | 'ignoreCause' | 'catchTag' | 'catchTags' | 'catchReason' | 'catchReasons' | 'catchIf' | 'catchFilter' | 'failureConditional' | 'failureReturn' | 'getOrElse' | 'optionGetOrElse' | 'match';
+        /** The site as a violation or an unjudged entry prints it: eight hex digits of the whitespace-normalized recovery form, with nested function bodies omitted except the recovery itself, so an edited fallback needs its reason declared again. */
+        readonly site: string;
+        readonly why: string;
+    })[];
+};
+export type CallServicesParams = {
+    /** The directory the entries are relative to, from the repository root, with no leading or trailing `/`; empty for the root itself. Default: `""`. */
+    readonly base?: string;
+    /** The directory prefixes, relative to `base`, whose selected files are judged; every entry ends in `/`. */
+    readonly region: readonly [string, ...string[]];
+    /** The files read; absent, every file of the inspection’s languages. */
+    readonly files?: {
+        /** The file extensions read; a changed file with any other is neither read nor failed. Default: `[".ts",".mts",".cts",".tsx",".js",".mjs",".cjs",".jsx",".svelte"]`. */
+        readonly extensions?: readonly ('.ts' | '.mts' | '.cts' | '.tsx' | '.js' | '.mjs' | '.cjs' | '.jsx' | '.svelte')[];
+        /** Glob patterns matched against the path relative to `base`; a matching file is neither read nor failed. Default: `[]`. */
+        readonly exclude?: readonly string[];
+    };
+    /** The call-service tags, each by the file relative to `base` that declares it and its exported name. */
+    readonly tags: readonly [
+        {
+            readonly path: string;
+            /** The exported name the file declares the tag under. */
+            readonly symbol: string;
+        },
+        ...{
+            readonly path: string;
+            readonly symbol: string;
+        }[]
+    ];
+    /** The directories (ending in `/`) and files, relative to `base`, that may provide the tags. */
+    readonly allow: readonly string[];
+};
+export declare const Effect: {
+    noSwallowedFailures: (params: SwallowedFailuresParams) => Builtin<"swallowed-failures", SwallowedFailuresParams>;
+    servicesOnlyIn: (params: CallServicesParams) => Builtin<"call-services", CallServicesParams>;
+};

package/rules/effect.js

@@ -0,0 +1,11 @@
+// src/rules/effect.ts
+var Effect = {
+  noSwallowedFailures: (params) => ({
+    builtin: "swallowed-failures",
+    params
+  }),
+  servicesOnlyIn: (params) => ({ builtin: "call-services", params })
+};
+export {
+  Effect
+};

package/rules/rules.d.ts

@@ -0,0 +1,342 @@
+export type ModulesParams = {
+    /** The directory the entries are relative to, from the repository root, with no leading or trailing `/`; empty for the root itself. Default: `""`. */
+    readonly base?: string;
+    /** Virtual framework specifiers with no source file in the tree, treated like external packages. An exact name matches itself; a name ending in `/*` matches its subpaths; `./name` matches that sibling import written in any directory. Resolved files still undergo module checks. */
+    readonly framework?: readonly string[];
+    /** Query suffixes a bundler reads off an import, such as `?raw`: a specifier ending in one is resolved and judged as the file it names without it. An undeclared query stays part of the path. */
+    readonly queries?: readonly string[];
+    /** The runtimes the judged code runs on: a specifier one of them names a built-in is the runtime’s own, never a package or a path. */
+    readonly runtimes?: readonly string[];
+    /** Directories a bundler resolves a `/`-leading `import.meta.glob` pattern from, such as a Vite project's `root`, each from the repository root with no leading or trailing `/`, empty for the root itself. A file resolves such a pattern from the deepest one holding it; a glob in a file none holds is named in `unjudged`. */
+    readonly roots?: readonly string[];
+    /** Exact built output files, relative to base, each with the tracked source that stands for it and the reason: an import landing on the output is judged at the source, and a config extending an output the tree lacks reads the source in its place. A missing source stays unresolved. */
+    readonly built?: readonly {
+        readonly output: string;
+        readonly source: string;
+        readonly why: string;
+    }[];
+    /** The infixes that mark a test file. A test belongs to its own path's module or, where no territory covers that path, to its subject's — its first name segment with its extension, `x.ts` for `x.store.test.ts`; absent, no file is a test. */
+    readonly tests?: readonly string[];
+    /** Whether the relations of the module map open to all code may close a cycle (`allow`) or must stand in an order (`refuse`); a `testing` relation closes none. Default: `"refuse"`. */
+    readonly cycles?: 'refuse' | 'allow';
+    /** Whether a selected file of the region no territory covers, and an import landing on a path no territory covers, is a violation (`refuse`) or left unjudged (`allow`). Default: `"refuse"`. */
+    readonly coverage?: 'refuse' | 'allow';
+    /** Whether a literal import aiming under `base` that lands on no listed path is a violation (`refuse`) or named in `unjudged` (`unjudged`). A load whose target is known only at run time is named in `unjudged` under either. Default: `"refuse"`. */
+    readonly unresolved?: 'refuse' | 'unjudged';
+    /** Which import spellings count: `from` clauses, what survives compilation including dynamic imports and globs (`runtime`), or both with type-position imports (`every`). Default: `"runtime"`. */
+    readonly reads?: 'from' | 'runtime' | 'every';
+    /** The conditions a workspace package's `exports` map is read under, besides `default`, which always matches; absent, `default` alone. Default: `[]`. */
+    readonly conditions?: readonly string[];
+    /** The files read; absent, every file of the inspection’s languages. */
+    readonly files?: {
+        /** The file extensions read; a changed file with any other is neither read nor failed. Default: `[".ts",".mts",".cts",".tsx",".js",".mjs",".cjs",".jsx",".svelte",".py",".pyi"]`. */
+        readonly extensions?: readonly ('.ts' | '.mts' | '.cts' | '.tsx' | '.js' | '.mjs' | '.cjs' | '.jsx' | '.svelte' | '.py' | '.pyi')[];
+        /** Glob patterns matched against the path relative to `base`; a matching file is neither read nor failed. Default: `[]`. */
+        readonly exclude?: readonly string[];
+    };
+};
+export type LoadsParams = {
+    /** The directory the entries are relative to, from the repository root, with no leading or trailing `/`; empty for the root itself. Default: `""`. */
+    readonly base?: string;
+    /** The directories and files, relative to `base`, whose runtime loads are judged, and the modules whose territory under `base` is. */
+    readonly from: readonly [
+        string | {
+            /** A module name: letters, digits, `.`, `_` and `-`, or a package name with its `@scope/`. */
+            readonly module: string;
+        },
+        ...(string | {
+            readonly module: string;
+        })[]
+    ];
+    /** What a selected file may not load at runtime, directly or through anything it loads. */
+    readonly refuses: readonly [string, ...string[]];
+    /** What may be loaded although a refused entry covers it; an allowed workspace package is followed into. The narrowest entry of `refuses` and `allows` covering a specifier decides it: the one with the longer path, and at an equal path the one ending in `/*`. Default: `[]`. */
+    readonly allows?: readonly string[];
+    /** Which loads are followed: what loads with the module — value and side-effect imports, re-exports and `require` (`static`) — or those and every `import()` call (`runtime`). A type-only import is never followed. Default: `"runtime"`. */
+    readonly reads?: 'static' | 'runtime';
+    /** The conditions a workspace package's `exports` map is read under, besides `default`, which always matches. Default: `[]`. */
+    readonly conditions?: readonly string[];
+    /** The runtimes the judged code runs on: a specifier one of them names a built-in is the runtime’s own, never a package or a path. */
+    readonly runtimes?: readonly string[];
+    /** Exact built output files, relative to base, each with the tracked source that stands for it and the reason: a tsconfig extending an output the tree lacks reads the source in its place, so its `paths` and `baseUrl` aliases resolve bare imports. */
+    readonly built?: readonly {
+        readonly output: string;
+        readonly source: string;
+        readonly why: string;
+    }[];
+    /** The files read; absent, every file of the inspection’s languages. */
+    readonly files?: {
+        /** The file extensions read; a changed file with any other is neither read nor failed. Default: `[".ts",".mts",".cts",".tsx",".js",".mjs",".cjs",".jsx",".svelte"]`. */
+        readonly extensions?: readonly ('.ts' | '.mts' | '.cts' | '.tsx' | '.js' | '.mjs' | '.cjs' | '.jsx' | '.svelte')[];
+        /** Glob patterns matched against the path relative to `base`; a matching file is neither read nor failed. Default: `[]`. */
+        readonly exclude?: readonly string[];
+    };
+};
+export type ReexportsParams = {
+    /** The directory the entries are relative to, from the repository root, with no leading or trailing `/`; empty for the root itself. Default: `""`. */
+    readonly base?: string;
+    /** Glob patterns matched against the path relative to `base`; a matching file may forward bindings, as a published library's entry does, and is not read. Default: `[]`. */
+    readonly allows?: readonly string[];
+    /** The files read; absent, every file of the inspection’s languages. */
+    readonly files?: {
+        /** The file extensions read; a changed file with any other is neither read nor failed. Default: `[".ts",".mts",".cts",".tsx",".js",".mjs",".cjs",".jsx",".svelte"]`. */
+        readonly extensions?: readonly ('.ts' | '.mts' | '.cts' | '.tsx' | '.js' | '.mjs' | '.cjs' | '.jsx' | '.svelte')[];
+        /** Glob patterns matched against the path relative to `base`; a matching file is neither read nor failed. Default: `[]`. */
+        readonly exclude?: readonly string[];
+    };
+};
+export type SizeParams = {
+    /** The directory the entries are relative to, from the repository root, with no leading or trailing `/`; empty for the root itself. Default: `""`. */
+    readonly base?: string;
+    /** The files read; absent, every file of the inspection’s languages. */
+    readonly files?: {
+        /** The file extensions read; a changed file with any other is neither read nor failed. Default: `[".ts",".mts",".cts",".tsx",".js",".mjs",".cjs",".jsx",".svelte",".py",".pyi"]`. */
+        readonly extensions?: readonly ('.ts' | '.mts' | '.cts' | '.tsx' | '.js' | '.mjs' | '.cjs' | '.jsx' | '.svelte' | '.py' | '.pyi')[];
+        /** Glob patterns matched against the path relative to `base`; a matching file is neither read nor failed. Default: `[]`. */
+        readonly exclude?: readonly string[];
+    };
+    /** The ceilings by glob; a file matching several is held to the lowest, and one matching none is not judged. */
+    readonly thresholds: readonly [
+        {
+            /** A glob matched against the path relative to `base`; a file it matches is held to `lines`. */
+            readonly glob: string;
+            /** What the language adapter measures in each file: `non-import` is its lines outside import statements, blank and comment lines included. Default: `"non-import"`. */
+            readonly metric?: 'non-import';
+            /** The ceiling on the metric: a file over it is a violation whose value is its measure. */
+            readonly lines: number;
+        },
+        ...{
+            readonly glob: string;
+            /** Default: `"non-import"`. */
+            readonly metric?: 'non-import';
+            readonly lines: number;
+        }[]
+    ];
+};
+export type Concern = "imports" | "loading" | "code" | "size";
+export type FactKind = "imports" | "declarations";
+export type Finding = {
+    readonly fingerprint: string;
+    readonly path: string;
+    readonly line?: number;
+    /** What is wrong at this place, one phrase without the file: every reader prints it after `path:line`. */
+    readonly message: string;
+    /** How to remove this one finding. Absent, readers print the general way out: remove it where the message points, or name the work that removes it. */
+    readonly fix?: string;
+    readonly value?: number;
+    readonly sites?: readonly {
+        readonly line: number;
+        readonly specifier?: string;
+        readonly chain?: readonly string[];
+        readonly message?: string;
+        readonly fix?: string;
+    }[];
+};
+export type Facts = {
+    readonly side: 'tree' | 'base';
+    readonly commit: string;
+    readonly tree: string;
+    readonly complete: boolean;
+    readonly files: readonly ({
+        readonly path: string;
+        readonly language: string;
+        readonly imports?: readonly ({
+            readonly specifier: string;
+            readonly line: number;
+            readonly kind: 'value' | 'type' | 'dynamic' | 'side-effect';
+            readonly forwards: boolean;
+            readonly target: {
+                readonly path: string;
+            } | {
+                readonly external: string;
+            } | {
+                readonly unlisted: string;
+            } | {
+                readonly unjudged: string;
+            };
+        })[];
+        readonly declarations?: readonly ({
+            readonly name: string;
+            readonly kind: 'class' | 'function' | 'variable' | 'type' | 'interface' | 'enum' | 'namespace';
+            readonly line: number;
+            readonly exported: boolean;
+        })[];
+        readonly lacks?: readonly ('imports' | 'declarations')[];
+        readonly unjudged?: string;
+    })[];
+    readonly reached: readonly ({
+        readonly path: string;
+        readonly language: string;
+        readonly imports?: readonly ({
+            readonly specifier: string;
+            readonly line: number;
+            readonly kind: 'value' | 'type' | 'dynamic' | 'side-effect';
+            readonly forwards: boolean;
+            readonly target: {
+                readonly path: string;
+            } | {
+                readonly external: string;
+            } | {
+                readonly unlisted: string;
+            } | {
+                readonly unjudged: string;
+            };
+        })[];
+        readonly declarations?: readonly ({
+            readonly name: string;
+            readonly kind: 'class' | 'function' | 'variable' | 'type' | 'interface' | 'enum' | 'namespace';
+            readonly line: number;
+            readonly exported: boolean;
+        })[];
+        readonly lacks?: readonly ('imports' | 'declarations')[];
+        readonly unjudged?: string;
+    })[];
+    readonly unread: readonly string[];
+};
+export type Argv = readonly [string, ...string[]];
+export type Builtin<Id extends string, Params extends object> = {
+    readonly builtin: Id;
+    readonly params: Params;
+};
+export type Reach = {
+    readonly files?: readonly string[];
+};
+export type ProgramInspection = {
+    readonly program: string;
+    readonly name: string;
+    readonly concern: Concern;
+    readonly needs?: readonly FactKind[];
+    readonly params: object;
+    readonly files?: readonly string[];
+};
+export type NamedTool = {
+    readonly tool: 'eslint' | 'oxlint' | 'ruff' | 'semgrep' | 'ast-grep';
+    readonly config?: string;
+    readonly argv?: Argv;
+};
+export type SarifCommand = {
+    readonly tool: 'command';
+    readonly argv: Argv;
+    readonly output: 'sarif';
+};
+export type FindingsCommand = {
+    readonly tool: 'command';
+    readonly argv: Argv;
+    readonly output: 'findings';
+};
+export type LinterInspection = {
+    readonly linter: NamedTool | SarifCommand;
+    readonly rule: string;
+    readonly files?: readonly string[];
+} | {
+    readonly linter: FindingsCommand;
+    readonly files?: readonly string[];
+};
+export type Inspection = Builtin<string, object> | ProgramInspection | LinterInspection;
+export type FormatCommand = {
+    readonly run: Argv;
+    readonly files: readonly string[];
+    readonly ok?: readonly number[];
+    readonly reads?: 'tree' | 'nearby';
+    readonly on?: 'commit';
+};
+export type DeriveCommand = {
+    readonly paths: readonly string[];
+    readonly from?: readonly string[];
+    readonly run: Argv;
+};
+export type Config = {
+    readonly inspections?: {
+        readonly [key: string]: Inspection;
+    };
+    readonly format?: {
+        readonly [key: string]: FormatCommand;
+    };
+    readonly derive?: {
+        readonly [key: string]: DeriveCommand;
+    };
+};
+export declare const defineConfig: (config: Config) => Config;
+export declare const Imports: {
+    modules: (options?: ModulesParams) => Builtin<"modules", ModulesParams>;
+};
+export declare const Loading: {
+    forbid: (params: LoadsParams) => Builtin<"loads", LoadsParams>;
+};
+export declare const Code: {
+    noReexports: (options?: ReexportsParams) => Builtin<"reexports", ReexportsParams>;
+};
+export type Threshold = SizeParams['thresholds'][number];
+export type MaxLines = {
+    readonly base?: SizeParams['base'];
+    readonly files?: SizeParams['files'];
+    readonly by?: readonly Threshold[];
+};
+export declare const Files: {
+    maxLines: (lines: number, { by, ...selection }?: MaxLines) => Builtin<"size", SizeParams>;
+    tests: readonly ["**/*.test.*", "**/*.itest.*", "**/*.e2e.*", "**/*.stest.*", "**/*.spec.*", "**/*.bench.*", "**/*.fixture.*"];
+};
+export type Linter = {
+    readonly rule: (id: string, reach?: Reach) => LinterInspection;
+};
+declare function command(options: {
+    readonly argv: Argv;
+    readonly output: 'sarif';
+}): Linter;
+declare function command(options: {
+    readonly argv: Argv;
+    readonly output: 'findings';
+}, reach?: Reach): LinterInspection;
+export type ToolOptions = {
+    readonly config?: string;
+    readonly argv?: Argv;
+};
+export declare const Linters: {
+    command: typeof command;
+    eslint: (options?: ToolOptions) => Linter;
+    oxlint: (options?: ToolOptions) => Linter;
+    ruff: (options?: ToolOptions) => Linter;
+    semgrep: (options?: ToolOptions) => Linter;
+    astGrep: (options?: ToolOptions) => Linter;
+};
+export declare const Format: {
+    command: (command: FormatCommand) => FormatCommand;
+};
+export declare const Derive: {
+    command: (command: DeriveCommand) => DeriveCommand;
+};
+export type ProgramDeclaration = {
+    readonly program: string;
+    readonly name: string;
+    readonly concern: Concern;
+    readonly needs?: readonly FactKind[];
+};
+export type DeclaredInspection<Params extends object> = (params: Params, reach?: Reach) => ProgramInspection;
+export declare const defineInspection: <Params extends object>(declaration: ProgramDeclaration) => DeclaredInspection<Params>;
+export type Side = {
+    readonly commit: string;
+    readonly paths: readonly string[];
+    readonly whole: boolean;
+    readonly read: (path: string) => Promise<string | null>;
+    readonly facts: Facts | null;
+};
+export type InspectionInput<Params extends object> = {
+    readonly params: Params;
+    readonly tree: Side;
+    readonly base: Side | null;
+    readonly mode?: ('change' | 'measure');
+};
+export type Reading = {
+    readonly findings: readonly Finding[];
+    readonly covered?: 'paths' | 'reach' | readonly string[];
+    readonly remeasure?: ('delta');
+};
+export type Answer = {
+    readonly tree: Reading;
+    readonly base?: Reading;
+};
+export type Program<Params extends object> = (input: InspectionInput<Params>) => Answer | Promise<Answer>;
+export declare const defineProgram: <Params extends {
+    readonly [name: string]: object;
+}>(programs: { readonly [Name in keyof Params]: Program<Params[Name]>; }) => { readonly [Name in keyof Params]: Program<Params[Name]>; };
+export {};

package/rules/rules.js

@@ -0,0 +1,50 @@
+// src/rules/rules.ts
+var defineConfig = (config) => config;
+var Imports = {
+  modules: (options = {}) => ({ builtin: "modules", params: options })
+};
+var Loading = {
+  forbid: (params) => ({ builtin: "loads", params })
+};
+var Code = {
+  noReexports: (options = {}) => ({ builtin: "reexports", params: options })
+};
+var Files = {
+  maxLines: (lines, { by = [], ...selection } = {}) => ({
+    builtin: "size",
+    params: { ...selection, thresholds: [{ glob: "**", lines }, ...by] }
+  }),
+  tests: ["**/*.test.*", "**/*.itest.*", "**/*.e2e.*", "**/*.stest.*", "**/*.spec.*", "**/*.bench.*", "**/*.fixture.*"]
+};
+var linter = (tool) => ({ rule: (rule, reach = {}) => ({ linter: tool, rule, ...reach }) });
+function command(options, reach = {}) {
+  return options.output === "sarif" ? linter({ tool: "command", argv: options.argv, output: "sarif" }) : { linter: { tool: "command", argv: options.argv, output: "findings" }, ...reach };
+}
+var Linters = {
+  command,
+  eslint: (options = {}) => linter({ tool: "eslint", ...options }),
+  oxlint: (options = {}) => linter({ tool: "oxlint", ...options }),
+  ruff: (options = {}) => linter({ tool: "ruff", ...options }),
+  semgrep: (options = {}) => linter({ tool: "semgrep", ...options }),
+  astGrep: (options = {}) => linter({ tool: "ast-grep", ...options })
+};
+var Format = {
+  command: (command) => command
+};
+var Derive = {
+  command: (command) => command
+};
+var defineInspection = (declaration) => (params, reach = {}) => ({ ...declaration, params, ...reach });
+var defineProgram = (programs) => programs;
+export {
+  Code,
+  Derive,
+  Files,
+  Format,
+  Imports,
+  Linters,
+  Loading,
+  defineConfig,
+  defineInspection,
+  defineProgram
+};

package/types/node/assert/strict.d.ts

@@ -0,0 +1,12 @@
+declare module "node:assert/strict" {
+    import { Assert, AssertionError, AssertionErrorOptions, AssertOptions, AssertPredicate, AssertStrict, deepStrictEqual, doesNotMatch, doesNotReject, doesNotThrow, fail, ifError, match, notDeepStrictEqual, notStrictEqual, ok, partialDeepStrictEqual, rejects, strictEqual, throws, } from "node:assert";
+    function strict(value: unknown, message?: string | Error): asserts value;
+    namespace strict {
+        export { Assert, AssertionError, AssertionErrorOptions, AssertOptions, AssertPredicate, AssertStrict, deepStrictEqual, deepStrictEqual as deepEqual, doesNotMatch, doesNotReject, doesNotThrow, fail, ifError, match, notDeepStrictEqual, notDeepStrictEqual as notDeepEqual, notStrictEqual, notStrictEqual as notEqual, ok, partialDeepStrictEqual, rejects, strict, strictEqual, strictEqual as equal, throws, };
+    }
+    export = strict;
+}
+declare module "assert/strict" {
+    import strict = require("node:assert/strict");
+    export = strict;
+}

package/types/node/assert.d.ts

@@ -0,0 +1,76 @@
+declare module "node:assert" {
+    import strict = require("node:assert/strict");
+    function assert(value: unknown, message?: string | Error): asserts value;
+    const kOptions: unique symbol;
+    namespace assert {
+        type AssertMethodNames = "deepEqual" | "deepStrictEqual" | "doesNotMatch" | "doesNotReject" | "doesNotThrow" | "equal" | "fail" | "ifError" | "match" | "notDeepEqual" | "notDeepStrictEqual" | "notEqual" | "notStrictEqual" | "ok" | "partialDeepStrictEqual" | "rejects" | "strictEqual" | "throws";
+        interface AssertOptions {
+            diff?: "simple" | "full" | undefined;
+            strict?: boolean | undefined;
+            skipPrototype?: boolean | undefined;
+        }
+        interface Assert extends Pick<typeof assert, AssertMethodNames> {
+            readonly [kOptions]: AssertOptions & {
+                strict: false;
+            };
+        }
+        interface AssertStrict extends Pick<typeof strict, AssertMethodNames> {
+            readonly [kOptions]: AssertOptions & {
+                strict: true;
+            };
+        }
+        var Assert: {
+            new (options?: AssertOptions & {
+                strict?: true | undefined;
+            }): AssertStrict;
+            new (options: AssertOptions): Assert;
+        };
+        interface AssertionErrorOptions {
+            message?: string | undefined;
+            actual?: unknown;
+            expected?: unknown;
+            operator?: string | undefined;
+            stackStartFn?: Function | undefined;
+            diff?: "simple" | "full" | undefined;
+        }
+        class AssertionError extends Error {
+            constructor(options: AssertionErrorOptions);
+            actual: unknown;
+            expected: unknown;
+            generatedMessage: boolean;
+            code: "ERR_ASSERTION";
+            operator: string;
+        }
+        type AssertPredicate = RegExp | (new () => object) | ((thrown: unknown) => boolean) | object | Error;
+        function fail(message?: string | Error): never;
+        function ok(value: unknown, message?: string | Error): asserts value;
+        function equal(actual: unknown, expected: unknown, message?: string | Error): void;
+        function notEqual(actual: unknown, expected: unknown, message?: string | Error): void;
+        function deepEqual(actual: unknown, expected: unknown, message?: string | Error): void;
+        function notDeepEqual(actual: unknown, expected: unknown, message?: string | Error): void;
+        function strictEqual<T>(actual: unknown, expected: T, message?: string | Error): asserts actual is T;
+        function notStrictEqual(actual: unknown, expected: unknown, message?: string | Error): void;
+        function deepStrictEqual<T>(actual: unknown, expected: T, message?: string | Error): asserts actual is T;
+        function notDeepStrictEqual(actual: unknown, expected: unknown, message?: string | Error): void;
+        function throws(block: () => unknown, message?: string | Error): void;
+        function throws(block: () => unknown, error: AssertPredicate, message?: string | Error): void;
+        function doesNotThrow(block: () => unknown, message?: string | Error): void;
+        function doesNotThrow(block: () => unknown, error: AssertPredicate, message?: string | Error): void;
+        function ifError(value: unknown): asserts value is null | undefined;
+        function rejects(block: (() => Promise<unknown>) | Promise<unknown>, message?: string | Error): Promise<void>;
+        function rejects(block: (() => Promise<unknown>) | Promise<unknown>, error: AssertPredicate, message?: string | Error): Promise<void>;
+        function doesNotReject(block: (() => Promise<unknown>) | Promise<unknown>, message?: string | Error): Promise<void>;
+        function doesNotReject(block: (() => Promise<unknown>) | Promise<unknown>, error: AssertPredicate, message?: string | Error): Promise<void>;
+        function match(value: string, regExp: RegExp, message?: string | Error): void;
+        function doesNotMatch(value: string, regExp: RegExp, message?: string | Error): void;
+        function partialDeepStrictEqual(actual: unknown, expected: unknown, message?: string | Error): void;
+    }
+    namespace assert {
+        export { strict };
+    }
+    export = assert;
+}
+declare module "assert" {
+    import assert = require("node:assert");
+    export = assert;
+}