@savvy-web/silk-effects 0.6.0 → 1.0.0

package/commitlint/formatter/messages.js

@@ -0,0 +1,79 @@
+//#region src/commitlint/formatter/messages.ts
+/**
+* Error message templates for the formatter.
+*
+* @internal
+*/
+/**
+* Detailed error explanations for common rule failures.
+*
+* @remarks
+* Maps commitlint rule names to human-readable explanations of what
+* the rule enforces and why the commit message failed.
+*
+* @public
+*/
+const ERROR_EXPLANATIONS = {
+	"type-empty": "Commit messages must start with a type (e.g., feat, fix, docs).",
+	"type-enum": "The commit type must be one of: ai, build, chore, ci, docs, feat, fix, perf, refactor, release, revert, style, test.",
+	"subject-empty": "A subject describing the change is required after the type.",
+	"subject-case": "The subject should start with a lowercase letter.",
+	"subject-full-stop": "The subject should not end with a period.",
+	"header-max-length": "The first line of the commit message is too long. Keep it under 72 characters.",
+	"body-max-line-length": "Lines in the commit body should not exceed the configured maximum length.",
+	"body-leading-blank": "There should be a blank line between the subject and the body.",
+	"footer-leading-blank": "There should be a blank line between the body and the footer.",
+	"scope-enum": "The scope must be one of the allowed values for this project.",
+	"scope-empty": "A scope is required for this commit type.",
+	"signed-off-by": "This project requires DCO signoff. Add \"Signed-off-by: Your Name <email>\" to your commit, or use `git commit -s`.",
+	"silk/signed-off-by": "This project requires DCO signoff. Add \"Signed-off-by: Your Name <email>\" to your commit, or use `git commit -s`.",
+	"trailer-exists": "A required trailer is missing from the commit message.",
+	"references-empty": "This commit should reference an issue (e.g., #123 or PROJ-456)."
+};
+/**
+* Suggestions for fixing common errors.
+*
+* @remarks
+* Maps commitlint rule names to actionable suggestions for fixing
+* the rule violation.
+*
+* @public
+*/
+const ERROR_SUGGESTIONS = {
+	"type-empty": "Example: feat: add user authentication",
+	"type-enum": "Example: fix: resolve memory leak in cache",
+	"subject-empty": "Example: feat: add user authentication",
+	"subject-case": "Use lowercase: \"add feature\" instead of \"Add feature\"",
+	"subject-full-stop": "Remove the period: \"add feature\" instead of \"add feature.\"",
+	"header-max-length": "Move details to the commit body instead.",
+	"body-max-line-length": "Break long lines into multiple shorter lines.",
+	"body-leading-blank": "Add an empty line after the subject before the body.",
+	"footer-leading-blank": "Add an empty line before any footers like Signed-off-by.",
+	"signed-off-by": "Run: git commit --amend -s",
+	"silk/signed-off-by": "Run: git commit --amend -s"
+};
+/**
+* Get explanation for a rule failure.
+*
+* @param ruleName - Name of the failed rule
+* @returns Explanation string or undefined if no explanation exists
+*
+* @public
+*/
+function getExplanation(ruleName) {
+	return ERROR_EXPLANATIONS[ruleName];
+}
+/**
+* Get suggestion for fixing a rule failure.
+*
+* @param ruleName - Name of the failed rule
+* @returns Suggestion string or undefined if no suggestion exists
+*
+* @public
+*/
+function getSuggestion(ruleName) {
+	return ERROR_SUGGESTIONS[ruleName];
+}
+
+//#endregion
+export { ERROR_EXPLANATIONS, ERROR_SUGGESTIONS, getExplanation, getSuggestion };

package/commitlint/hook/diagnostics/branch.js

@@ -0,0 +1,36 @@
+import { Effect } from "effect";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+//#region src/commitlint/hook/diagnostics/branch.ts
+/**
+* Branch and inferred-ticket detection.
+*
+* @internal
+*/
+const execFileP = promisify(execFile);
+const TICKET_RE = /^[a-z]+\/(\d+)[-/_]/;
+function inferTicketId(branch) {
+	const m = branch.match(TICKET_RE);
+	return m ? Number(m[1]) : null;
+}
+function readBranchInfo() {
+	return Effect.tryPromise(async () => {
+		const { stdout } = await execFileP("git", [
+			"rev-parse",
+			"--abbrev-ref",
+			"HEAD"
+		]);
+		const branch = stdout.trim();
+		return {
+			branch,
+			inferredTicketId: inferTicketId(branch)
+		};
+	}).pipe(Effect.orElseSucceed(() => ({
+		branch: null,
+		inferredTicketId: null
+	})));
+}
+
+//#endregion
+export { inferTicketId, readBranchInfo };

package/commitlint/hook/diagnostics/cache.js

@@ -0,0 +1,37 @@
+import { Effect } from "effect";
+import { dirname } from "node:path";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+
+//#region src/commitlint/hook/diagnostics/cache.ts
+/**
+* JSON file cache with TTL. Writes are atomic-ish (mkdir -p, write,
+* rename). Reads return null on any error or staleness — callers
+* recompute silently.
+*
+* @internal
+*/
+function readCache(path, ttlSeconds) {
+	return Effect.tryPromise(async () => {
+		const raw = await readFile(path, "utf8");
+		const env = JSON.parse(raw);
+		const cachedMs = Date.parse(env.cachedAt);
+		if (Number.isNaN(cachedMs)) return null;
+		if (Date.now() - cachedMs > ttlSeconds * 1e3) return null;
+		return env.data;
+	}).pipe(Effect.orElseSucceed(() => null));
+}
+function writeCache(path, data, when = /* @__PURE__ */ new Date()) {
+	return Effect.tryPromise(async () => {
+		await mkdir(dirname(path), { recursive: true });
+		const env = {
+			cachedAt: when.toISOString(),
+			data
+		};
+		const tmp = `${path}.tmp`;
+		await writeFile(tmp, JSON.stringify(env), "utf8");
+		await rename(tmp, path);
+	}).pipe(Effect.orElseSucceed(() => void 0));
+}
+
+//#endregion
+export { readCache, writeCache };

package/commitlint/hook/diagnostics/commitlint-config.js

@@ -0,0 +1,36 @@
+import { isAbsolute, join, resolve } from "node:path";
+import { readFile } from "node:fs/promises";
+
+//#region src/commitlint/hook/diagnostics/commitlint-config.ts
+/**
+* Resolve the commitlint config path used by the husky commit-msg hook.
+*
+* The husky hook is the source of truth: `init` writes the chosen path into
+* its managed section as `--config "$ROOT/<path>"`. The post-commit verifier
+* extracts that same path so its replay matches the committed-time invocation.
+*
+* @internal
+*/
+const CONFIG_FLAG_RE = /--config\s+(?:"([^"]+)"|'([^']+)'|(\S+))/;
+const ROOT_PREFIXES = ["$ROOT/", "${ROOT}/"];
+function parseHuskyConfigPath(huskyContent, root) {
+	const m = huskyContent.match(CONFIG_FLAG_RE);
+	if (!m) return null;
+	let raw = m[1] ?? m[2] ?? m[3] ?? "";
+	if (!raw) return null;
+	for (const prefix of ROOT_PREFIXES) if (raw.startsWith(prefix)) {
+		raw = raw.slice(prefix.length);
+		break;
+	}
+	return isAbsolute(raw) ? raw : resolve(root, raw);
+}
+async function readCommitlintConfigPath(root) {
+	try {
+		return parseHuskyConfigPath(await readFile(join(root, ".husky/commit-msg"), "utf8"), root);
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+export { parseHuskyConfigPath, readCommitlintConfigPath };

package/commitlint/hook/diagnostics/open-issues.js

@@ -0,0 +1,56 @@
+import { readCache, writeCache } from "./cache.js";
+import { Effect } from "effect";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+//#region src/commitlint/hook/diagnostics/open-issues.ts
+/**
+* Open-issue lookup via gh CLI, cached on disk.
+*
+* @internal
+*/
+const execFileP = promisify(execFile);
+const ISSUES_CACHE_TTL_SECONDS = 600;
+/** Relative path under CLAUDE_PROJECT_DIR where the open-issues cache lives. */
+const ISSUES_CACHE_RELATIVE_PATH = ".claude/cache/issues.json";
+function readOpenIssuesFromCache(cachePath, ttlSeconds = 600) {
+	return readCache(cachePath, ttlSeconds);
+}
+function fetchAndCacheOpenIssues(cachePath) {
+	return Effect.gen(function* () {
+		const repo = (yield* Effect.tryPromise(() => execFileP("gh", [
+			"repo",
+			"view",
+			"--json",
+			"nameWithOwner",
+			"-q",
+			".nameWithOwner"
+		]))).stdout.trim();
+		if (!repo) return null;
+		const listResult = yield* Effect.tryPromise(() => execFileP("gh", [
+			"issue",
+			"list",
+			"--repo",
+			repo,
+			"--state",
+			"open",
+			"--limit",
+			"20",
+			"--json",
+			"number,title"
+		]));
+		const parsed = JSON.parse(listResult.stdout);
+		yield* writeCache(cachePath, parsed);
+		return parsed;
+	}).pipe(Effect.orElseSucceed(() => null));
+}
+function readOrFetchOpenIssues(cachePath) {
+	return Effect.gen(function* () {
+		const cached = yield* readOpenIssuesFromCache(cachePath);
+		if (cached !== null) return cached;
+		return yield* fetchAndCacheOpenIssues(cachePath);
+	});
+}
+
+//#endregion
+export { ISSUES_CACHE_RELATIVE_PATH, fetchAndCacheOpenIssues, readOpenIssuesFromCache, readOrFetchOpenIssues };

package/commitlint/hook/diagnostics/package-manager.js

@@ -0,0 +1,51 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { readFile } from "node:fs/promises";
+
+//#region src/commitlint/hook/diagnostics/package-manager.ts
+/**
+* Package manager detection for the commit-time hooks.
+*
+* Mirrors the husky hook detection: prefer `package.json#packageManager`,
+* fall back to lockfile presence in priority order pnpm \> yarn \> bun \> npm.
+*
+* @internal
+*/
+const VALID_PMS = new Set([
+	"pnpm",
+	"yarn",
+	"bun",
+	"npm"
+]);
+function parsePackageManagerField(packageJsonContent) {
+	let parsed;
+	try {
+		parsed = JSON.parse(packageJsonContent);
+	} catch {
+		return null;
+	}
+	const field = typeof parsed === "object" && parsed !== null && "packageManager" in parsed ? parsed.packageManager : void 0;
+	if (typeof field !== "string" || field.length === 0) return null;
+	const name = field.split("@")[0];
+	return VALID_PMS.has(name) ? name : null;
+}
+function detectFromLockfiles(presence) {
+	if (presence.pnpm) return "pnpm";
+	if (presence.yarn) return "yarn";
+	if (presence.bun) return "bun";
+	return "npm";
+}
+async function detectPackageManager(root) {
+	try {
+		const fromField = parsePackageManagerField(await readFile(join(root, "package.json"), "utf8"));
+		if (fromField !== null) return fromField;
+	} catch {}
+	return detectFromLockfiles({
+		pnpm: existsSync(join(root, "pnpm-lock.yaml")),
+		yarn: existsSync(join(root, "yarn.lock")),
+		bun: existsSync(join(root, "bun.lock"))
+	});
+}
+
+//#endregion
+export { detectFromLockfiles, detectPackageManager, parsePackageManagerField };

package/commitlint/hook/diagnostics/signing.js

@@ -0,0 +1,107 @@
+import { Effect } from "effect";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { stat } from "node:fs/promises";
+
+//#region src/commitlint/hook/diagnostics/signing.ts
+/**
+* GPG / SSH signing diagnostic.
+*
+* @internal
+*/
+const execFileP = promisify(execFile);
+function parseGpgKeyExpiry(colonsOutput) {
+	for (const line of colonsOutput.split("\n")) {
+		if (!line.startsWith("sec:")) continue;
+		const expires = line.split(":")[6];
+		if (expires && /^\d+$/.test(expires)) return (/* @__PURE__ */ new Date(Number(expires) * 1e3)).toISOString();
+	}
+	return null;
+}
+function buildSigningDiagnostic(raw) {
+	const signingKeyConfigured = !!raw.signingKey;
+	const format = !signingKeyConfigured ? "none" : raw.gpgFormat === "ssh" ? "ssh" : "gpg";
+	const autoSignEnabled = raw.commitGpgsign === "true";
+	const warnings = [];
+	if (!autoSignEnabled) warnings.push("commits will be unsigned (commit.gpgsign is not true)");
+	if (!signingKeyConfigured) warnings.push("user.signingkey is not configured");
+	if (signingKeyConfigured && !raw.keyResolves) warnings.push("user.signingkey does not resolve to an existing key/file");
+	if (raw.keyExpiry && Date.parse(raw.keyExpiry) < Date.now()) warnings.push(`signing key has expired (expired ${raw.keyExpiry})`);
+	if (format === "gpg" && !raw.agentResponsive) warnings.push("gpg-agent did not respond");
+	if (format === "ssh" && !raw.sshAllowedSignersFile) warnings.push("gpg.ssh.allowedSignersFile is unset; signature verification will fail");
+	return {
+		format,
+		autoSignEnabled,
+		signingKeyConfigured,
+		keyResolves: raw.keyResolves,
+		agentResponsive: raw.agentResponsive,
+		warnings
+	};
+}
+async function gitConfig(key) {
+	try {
+		const { stdout } = await execFileP("git", [
+			"config",
+			"--get",
+			key
+		]);
+		const v = stdout.trim();
+		return v.length > 0 ? v : null;
+	} catch {
+		return null;
+	}
+}
+const FALLBACK_DIAGNOSTIC = {
+	format: "none",
+	autoSignEnabled: false,
+	signingKeyConfigured: false,
+	keyResolves: false,
+	agentResponsive: false,
+	warnings: ["signing diagnostic unavailable"]
+};
+function readSigningDiagnostic() {
+	return Effect.tryPromise(async () => {
+		const gpgFormat = await gitConfig("gpg.format");
+		const commitGpgsign = await gitConfig("commit.gpgsign");
+		const signingKey = await gitConfig("user.signingkey");
+		const sshAllowedSignersFile = await gitConfig("gpg.ssh.allowedSignersFile");
+		const isSsh = gpgFormat === "ssh";
+		let keyResolves = false;
+		let keyExpiry = null;
+		if (signingKey) if (isSsh) try {
+			await stat(signingKey);
+			keyResolves = true;
+		} catch {
+			keyResolves = false;
+		}
+		else try {
+			const { stdout } = await execFileP("gpg", [
+				"--list-secret-keys",
+				"--with-colons",
+				signingKey
+			]);
+			keyResolves = stdout.trim().length > 0;
+			keyExpiry = parseGpgKeyExpiry(stdout);
+		} catch {
+			keyResolves = false;
+		}
+		let agentResponsive = true;
+		if (!isSsh) try {
+			await execFileP("gpg-connect-agent", ["/bye"], { timeout: 1e3 });
+		} catch {
+			agentResponsive = false;
+		}
+		return buildSigningDiagnostic({
+			gpgFormat,
+			commitGpgsign,
+			signingKey,
+			keyResolves,
+			agentResponsive,
+			keyExpiry,
+			sshAllowedSignersFile
+		});
+	}).pipe(Effect.orElseSucceed(() => FALLBACK_DIAGNOSTIC));
+}
+
+//#endregion
+export { buildSigningDiagnostic, parseGpgKeyExpiry, readSigningDiagnostic };

package/commitlint/hook/envelope.js

@@ -0,0 +1,46 @@
+import { Schema } from "effect";
+
+//#region src/commitlint/hook/envelope.ts
+/**
+* Schemas for the JSON stdin envelopes Claude passes to plugin hooks.
+*
+* @remarks
+* These are intentionally permissive — `Schema.Unknown` is used for fields
+* we don't inspect (the agent may add unknown keys; we don't want a forward-
+* compatibility break to make the hook fail).
+*
+* @internal
+*/
+const PreToolUseEnvelope = Schema.Struct({
+	hook_event_name: Schema.Literal("PreToolUse"),
+	tool_name: Schema.String,
+	tool_input: Schema.Record({
+		key: Schema.String,
+		value: Schema.Unknown
+	})
+});
+const PostToolUseEnvelope = Schema.Struct({
+	hook_event_name: Schema.Literal("PostToolUse"),
+	tool_name: Schema.String,
+	tool_input: Schema.Record({
+		key: Schema.String,
+		value: Schema.Unknown
+	}),
+	tool_response: Schema.Struct({
+		interrupted: Schema.optional(Schema.Boolean),
+		exit_code: Schema.optional(Schema.Number),
+		stdout: Schema.optional(Schema.String),
+		stderr: Schema.optional(Schema.String)
+	})
+});
+const UserPromptSubmitEnvelope = Schema.Struct({
+	hook_event_name: Schema.Literal("UserPromptSubmit"),
+	prompt: Schema.String
+});
+const SessionStartEnvelope = Schema.Struct({
+	hook_event_name: Schema.Literal("SessionStart"),
+	source: Schema.optional(Schema.String)
+});
+
+//#endregion
+export { PostToolUseEnvelope, PreToolUseEnvelope, SessionStartEnvelope, UserPromptSubmitEnvelope };

package/commitlint/hook/output.js

@@ -0,0 +1,45 @@
+//#region src/commitlint/hook/output.ts
+function preToolUseAllow(reason) {
+	return { hookSpecificOutput: {
+		hookEventName: "PreToolUse",
+		permissionDecision: "allow",
+		permissionDecisionReason: reason
+	} };
+}
+function preToolUseDeny(reason) {
+	return { hookSpecificOutput: {
+		hookEventName: "PreToolUse",
+		permissionDecision: "deny",
+		permissionDecisionReason: reason
+	} };
+}
+function preToolUseAdvise(message) {
+	return { hookSpecificOutput: {
+		hookEventName: "PreToolUse",
+		additionalContext: message
+	} };
+}
+function preToolUseSilent() {
+	return null;
+}
+function sessionStartContext(message) {
+	return { hookSpecificOutput: {
+		hookEventName: "SessionStart",
+		additionalContext: message
+	} };
+}
+function postToolUseAdvise(message) {
+	return { hookSpecificOutput: {
+		hookEventName: "PostToolUse",
+		additionalContext: message
+	} };
+}
+function userPromptSubmitContext(message) {
+	return { hookSpecificOutput: {
+		hookEventName: "UserPromptSubmit",
+		additionalContext: message
+	} };
+}
+
+//#endregion
+export { postToolUseAdvise, preToolUseAdvise, preToolUseAllow, preToolUseDeny, preToolUseSilent, sessionStartContext, userPromptSubmitContext };

package/commitlint/hook/parse-bash-command.js

@@ -0,0 +1,105 @@
+import { parse } from "shell-quote";
+
+//#region src/commitlint/hook/parse-bash-command.ts
+/**
+* Parse a Bash command string to extract the commit message and flags
+* for `git commit` / `gh pr create` / `gh pr edit` invocations.
+*
+* @remarks
+* Only enough Bash is parsed to handle the shapes Claude actually emits.
+* Heredocs surface as already-substituted strings inside Claude's tool
+* envelope, so we don't need full shell semantics — just argv tokenization.
+*
+* Operators (`&&`, `||`, `|`, `;`) are filtered out by `shell-quote`. The
+* parser inspects only `tokens[0]` and `tokens[1]`, so a compound command
+* like `true && git commit -m "x"` will be classified as `unknown` rather
+* than recursed into. That is the intended behaviour for the scaffold:
+* compound shapes are uncommon in agent-emitted commands, and silently
+* dropping them is safer than misattributing extracted state.
+*
+* @internal
+*/
+function emptyFlags() {
+	return {
+		sign: "default",
+		noVerify: false,
+		amend: false
+	};
+}
+function parseBashCommand(command) {
+	const tokens = parse(command).filter((t) => typeof t === "string");
+	if (tokens.length === 0) return {
+		kind: "unknown",
+		message: null,
+		flags: emptyFlags(),
+		source: "none"
+	};
+	if (tokens[0] === "git" && tokens[1] === "commit") {
+		const flags = extractGitCommitFlags(tokens);
+		const kind = flags.amend ? "git-commit-amend" : "git-commit";
+		const message = extractGitCommitMessage(tokens);
+		return {
+			kind,
+			message,
+			flags,
+			source: message === null ? "none" : "inline"
+		};
+	}
+	if (tokens[0] === "gh" && tokens[1] === "pr" && (tokens[2] === "create" || tokens[2] === "edit")) {
+		const kind = tokens[2] === "create" ? "gh-pr-create" : "gh-pr-edit";
+		const message = extractFlagValue(tokens, "--body", "-b");
+		return {
+			kind,
+			message,
+			flags: emptyFlags(),
+			source: message === null ? "none" : "inline"
+		};
+	}
+	return {
+		kind: "unknown",
+		message: null,
+		flags: emptyFlags(),
+		source: "none"
+	};
+}
+function extractGitCommitFlags(tokens) {
+	let sign = "default";
+	let noVerify = false;
+	let amend = false;
+	for (const tok of tokens.slice(2)) if (tok === "-S" || tok === "--gpg-sign" || tok.startsWith("--gpg-sign=")) sign = "force-on";
+	else if (tok === "--no-gpg-sign") sign = "force-off";
+	else if (tok === "--no-verify" || tok === "-n") noVerify = true;
+	else if (tok === "--amend") amend = true;
+	return {
+		sign,
+		noVerify,
+		amend
+	};
+}
+function extractGitCommitMessage(tokens) {
+	const parts = [];
+	for (let i = 2; i < tokens.length; i++) {
+		const tok = tokens[i];
+		if (tok === void 0) continue;
+		if (tok === "-m" || tok === "--message") {
+			const next = tokens[i + 1];
+			if (next !== void 0) {
+				parts.push(next);
+				i += 1;
+			}
+		} else if (tok.startsWith("--message=")) parts.push(tok.slice(10));
+	}
+	return parts.length > 0 ? parts.join("\n\n") : null;
+}
+function extractFlagValue(tokens, ...names) {
+	for (let i = 0; i < tokens.length; i++) {
+		const tok = tokens[i];
+		if (tok === void 0) continue;
+		if (names.includes(tok)) return tokens[i + 1] ?? null;
+		for (const name of names) if (tok.startsWith(`${name}=`)) return tok.slice(name.length + 1);
+	}
+	return null;
+}
+
+//#endregion
+export { parseBashCommand };

package/commitlint/hook/rules/closes-trailer.js

@@ -0,0 +1,31 @@
+import { Effect } from "effect";
+
+//#region src/commitlint/hook/rules/closes-trailer.ts
+/**
+* closes-trailer rule — advises when the branch encodes a ticket id but
+* the message body has no Closes/Fixes/Resolves trailer for it.
+*
+* @internal
+*/
+function hasClosingTrailer(message, ticketId) {
+	return new RegExp(`\\b(closes|fixes|resolves)\\s+#${ticketId}\\b`, "i").test(message);
+}
+const closesTrailerRule = {
+	id: "closes-trailer",
+	severity: "advise",
+	check: (input, ctx) => Effect.sync(() => {
+		const tid = ctx.branchInfo.inferredTicketId;
+		if (tid === null) return null;
+		if (hasClosingTrailer(input.message, tid)) return null;
+		const openList = ctx.openIssues.map((i) => `  #${i.number}  ${i.title}`).join("\n");
+		const tail = openList.length > 0 ? `\n\nOpen issues in this repo:\n${openList}` : "";
+		return {
+			ruleId: "closes-trailer",
+			severity: "advise",
+			message: `Branch ${ctx.branchInfo.branch} looks like ticket #${tid} but the message has no Closes/Fixes/Resolves #${tid} trailer. If this commit closes #${tid}, add 'Closes #${tid}' above the Signed-off-by line.${tail}`
+		};
+	})
+};
+
+//#endregion
+export { closesTrailerRule, hasClosingTrailer };

package/commitlint/hook/rules/forbidden-content.js

@@ -0,0 +1,32 @@
+import { Effect } from "effect";
+
+//#region src/commitlint/hook/rules/forbidden-content.ts
+/**
+* forbidden-content rule — denies markdown headers and code fences in
+* commit message bodies.
+*
+* @internal
+*/
+const forbiddenContentRule = {
+	id: "forbidden-content",
+	severity: "deny",
+	check: (input) => Effect.sync(() => {
+		const lines = input.message.split("\n");
+		for (const line of lines) {
+			if (/^#{1,6}\s/.test(line)) return {
+				ruleId: "forbidden-content",
+				severity: "deny",
+				message: "Body contains a markdown header (#, ##, ...). Headers are forbidden by the @savvy-web/commitlint Silk preset. Remove the header line and rewrite as plain prose or a bullet."
+			};
+			if (/^```/.test(line)) return {
+				ruleId: "forbidden-content",
+				severity: "deny",
+				message: "Body contains a code fence (```). Code fences are forbidden in commit bodies. Move code samples to the PR description."
+			};
+		}
+		return null;
+	})
+};
+
+//#endregion
+export { forbiddenContentRule };