@shrkcrft/boundaries 0.1.0-alpha.29 → 0.1.0-alpha.31

package/dist/index.js

@@ -1,24 +1,59 @@
 export * from "./model/boundary-rule.js";
+export * from "./model/boundary-rule-scope.js";
+export * from "./scan/import-pattern.js";
+export * from "./scan/node-builtin-package-names.js";
 export * from "./registry/boundary-registry.js";
 export * from "./registry/load-boundary-rules.js";
 export * from "./scan/glob.js";
+export * from "./scan/i-glob-unit-measure.js";
 export * from "./scan/scan-imports.js";
 export * from "./evaluate/evaluate-boundaries.js";
+// Round 13 (lane B): the boundary expectEmpty vocabulary and the one boundary settle.
+export * from "./model/boundary-markable-list.js";
+export * from "./model/boundary-rule-input.js";
+export * from "./model/boundary-rule-input-keys.js";
+export * from "./model/boundary-rule-key-problems.js";
+export * from "./model/boundary-rule-marker-problems.js";
+export * from "./model/boundary-unit-problem-issue.js";
+export * from "./model/normalize-boundary-rule.js";
+export * from "./model/boundary-intended-empty-line.js";
+export * from "./evaluate/i-boundary-rule-settle-input.js";
+export * from "./evaluate/i-boundary-rule-settlement.js";
+export * from "./evaluate/boundary-unit-kind.js";
+export * from "./evaluate/i-boundary-unit-finding.js";
+export * from "./evaluate/boundary-unit-finding.js";
+export * from "./evaluate/settle-boundary-rule.js";
+export * from "./evaluate/with-boundary-rule-settlement.js";
 export * from "./scan/tsconfig-aliases.js";
 export * from "./wiring/evaluate-wiring.js";
 export * from "./wiring/scan-wiring-files.js";
 export * from "./wiring/explain-wiring.js";
 export * from "./wiring/registry-query.js";
 export * from "./wiring/registration-graph.js";
+export * from "./wiring/i-registration-query-verdict.js";
+export * from "./wiring/registration-query-verdict.js";
+export * from "./wiring/i-registration-roles.js";
+export * from "./wiring/measure-registration-roles.js";
+export * from "./wiring/i-idiom-role-coverage.js";
+export * from "./wiring/measure-idiom-role-coverage.js";
+export * from "./generated/read-regen-tree.js";
 export * from "./wiring/trace-literal.js";
 export * from "./wiring/plan-wiring-fix.js";
+export * from "./wiring/sink-imports.js";
 export * from "./policy/extract-templates.js";
 export * from "./policy/evaluate-policy.js";
 export * from "./policy/run-policy.js";
 export * from "./extract/scan-literals.js";
 export * from "./extract/extract-tokens.js";
+export * from "./extract/parse-imports.js";
+export * from "./extract/import-edges.js";
 export * from "./extract/code-zones.js";
 export * from "./extract/inspect-source.js";
+// Round 13 (lane G): labelled sources and THE per-source liveness request.
+export * from "./extract/i-labeled-source.js";
+export * from "./extract/source-liveness-request.js";
+export * from "./wiring/wiring-labeled-sources.js";
+export * from "./policy/i-policy-rule-liveness.js";
 export * from "./baseline/canonicalize.js";
 export * from "./baseline/json-path-keys.js";
 export * from "./baseline/diff-baseline.js";
@@ -27,4 +62,23 @@ export * from "./generated/check-provenance.js";
 export * from "./generated/compare-trees.js";
 export * from "./generated/scan-generated.js";
 export * from "./util/safe-regex.js";
+export * from "./util/blank-run-hazard.js";
+export * from "./util/blank-run-hazard-finding.js";
 export * from "./util/walk-files.js";
+export * from "./util/unread-file-reason.js";
+export * from "./util/unread-file.js";
+export * from "./util/matched-files.js";
+export * from "./util/read-scope.js";
+export * from "./util/read-scope-coverage.js";
+export * from "./util/read-selected-files.js";
+export * from "./util/i-dead-glob-unit.js";
+export * from "./util/i-glob-negation.js";
+export * from "./util/i-glob-list-units.js";
+export * from "./util/dead-glob-units.js";
+// Round 13 (lane G): THE gate-plane glob liveness predicate and settle.
+export * from "./util/i-glob-liveness-list.js";
+export * from "./util/i-glob-liveness-request.js";
+export * from "./util/glob-list-liveness-input.js";
+export * from "./util/settle-glob-lists.js";
+export * from "./util/read-glob-list-liveness.js";
+export * from "./util/plane-scan-exclude-dirs.js";

package/dist/model/boundary-intended-empty-line.d.ts

@@ -0,0 +1,10 @@
+import type { IUnitMark } from '@shrkcrft/core';
+/**
+ * THE line `boundaries explain` and MCP `get_boundary_rule` print for one
+ * `expectEmpty` marker of a rule (round 13), next to its redundant and shadowed
+ * notes: `<list> <unit> — <reason>` (+ the stamped pack). It states the
+ * assertion only — whether the target has appeared since (went live) is a
+ * run-time fact, which `shrk check boundaries` reports.
+ */
+export declare function boundaryIntendedEmptyLine(mark: IUnitMark): string;
+//# sourceMappingURL=boundary-intended-empty-line.d.ts.map

package/dist/model/boundary-intended-empty-line.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary-intended-empty-line.d.ts","sourceRoot":"","sources":["../../src/model/boundary-intended-empty-line.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAGjE"}

package/dist/model/boundary-intended-empty-line.js

@@ -0,0 +1,11 @@
+/**
+ * THE line `boundaries explain` and MCP `get_boundary_rule` print for one
+ * `expectEmpty` marker of a rule (round 13), next to its redundant and shadowed
+ * notes: `<list> <unit> — <reason>` (+ the stamped pack). It states the
+ * assertion only — whether the target has appeared since (went live) is a
+ * run-time fact, which `shrk check boundaries` reports.
+ */
+export function boundaryIntendedEmptyLine(mark) {
+    const pack = mark.packageName !== undefined ? ` [marker from pack ${mark.packageName}]` : '';
+    return `${mark.list} ${mark.unit} — ${mark.reason ?? 'no reason given'}${pack}`;
+}

package/dist/model/boundary-markable-list.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The four boundary-rule lists an `expectEmpty` marker may sit in (round 13).
+ * Each value is the list's `listPath`: the `list` of every mark the loader
+ * records (`normalizeBoundaryRule`) and of every observation the evaluator
+ * settles, so a marker always meets the unit it marks. A `from` negation stays
+ * in `from` (its unit keeps its `!`); `exceptions[].target` is not markable — a
+ * stale exception is an error by design.
+ */
+export declare enum BoundaryMarkableList {
+    From = "from",
+    ExemptFiles = "exemptFiles",
+    ForbiddenImports = "forbiddenImports",
+    AllowedImports = "allowedImports"
+}
+//# sourceMappingURL=boundary-markable-list.d.ts.map

package/dist/model/boundary-markable-list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary-markable-list.d.ts","sourceRoot":"","sources":["../../src/model/boundary-markable-list.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,oBAAY,oBAAoB;IAC9B,IAAI,SAAS;IACb,WAAW,gBAAgB;IAC3B,gBAAgB,qBAAqB;IACrC,cAAc,mBAAmB;CAClC"}

package/dist/model/boundary-markable-list.js

@@ -0,0 +1,15 @@
+/**
+ * The four boundary-rule lists an `expectEmpty` marker may sit in (round 13).
+ * Each value is the list's `listPath`: the `list` of every mark the loader
+ * records (`normalizeBoundaryRule`) and of every observation the evaluator
+ * settles, so a marker always meets the unit it marks. A `from` negation stays
+ * in `from` (its unit keeps its `!`); `exceptions[].target` is not markable — a
+ * stale exception is an error by design.
+ */
+export var BoundaryMarkableList;
+(function (BoundaryMarkableList) {
+    BoundaryMarkableList["From"] = "from";
+    BoundaryMarkableList["ExemptFiles"] = "exemptFiles";
+    BoundaryMarkableList["ForbiddenImports"] = "forbiddenImports";
+    BoundaryMarkableList["AllowedImports"] = "allowedImports";
+})(BoundaryMarkableList || (BoundaryMarkableList = {}));

package/dist/model/boundary-rule-input-keys.d.ts

@@ -0,0 +1,11 @@
+import type { IBoundaryRuleInput } from './boundary-rule-input.js';
+/**
+ * Every key an authored boundary rule may carry — derived from
+ * {@link IBoundaryRuleInput} by type: the Record must name each key of the
+ * interface and no other, so a rule field added without listing it here fails
+ * tsc. `validateBoundaryRule` refuses any other key (round 13): an unknown key
+ * used to load and be silently ignored — a guessed rule-level `expectEmpty`
+ * among them, which switched nothing off while reading as if it had.
+ */
+export declare const BOUNDARY_RULE_INPUT_KEYS: Readonly<Record<keyof IBoundaryRuleInput, true>>;
+//# sourceMappingURL=boundary-rule-input-keys.d.ts.map

package/dist/model/boundary-rule-input-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary-rule-input-keys.d.ts","sourceRoot":"","sources":["../../src/model/boundary-rule-input-keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,kBAAkB,EAAE,IAAI,CAAC,CAoBrF,CAAC"}

package/dist/model/boundary-rule-input-keys.js

@@ -0,0 +1,29 @@
+/**
+ * Every key an authored boundary rule may carry — derived from
+ * {@link IBoundaryRuleInput} by type: the Record must name each key of the
+ * interface and no other, so a rule field added without listing it here fails
+ * tsc. `validateBoundaryRule` refuses any other key (round 13): an unknown key
+ * used to load and be silently ignored — a guessed rule-level `expectEmpty`
+ * among them, which switched nothing off while reading as if it had.
+ */
+export const BOUNDARY_RULE_INPUT_KEYS = {
+    id: true,
+    title: true,
+    description: true,
+    severity: true,
+    from: true,
+    forbiddenImports: true,
+    forbiddenMatch: true,
+    allowedImports: true,
+    failOnEmpty: true,
+    exemptFiles: true,
+    excludeTests: true,
+    exceptions: true,
+    tags: true,
+    appliesWhen: true,
+    message: true,
+    suggestedFix: true,
+    relatedRules: true,
+    relatedPathConventions: true,
+    references: true,
+};

package/dist/model/boundary-rule-input.d.ts

@@ -0,0 +1,23 @@
+import type { SelectorListEntry } from '@shrkcrft/core';
+import type { IBoundaryRule } from './boundary-rule.js';
+/**
+ * A boundary rule as AUTHORED (round 13). The four selector lists accept an
+ * `expectEmpty` marker beside plain strings — spec 13.1's own syntax:
+ *
+ *   forbiddenImports: ['@scope/kernel-*', { pattern: '@scope/plugin-react', expectEmpty: true }]
+ *
+ * The loader validates it (`validateBoundaryRule`) and normalises it
+ * (`normalizeBoundaryRule`) into the LOADED {@link IBoundaryRule}: the plain
+ * string lists every reader already consumes, plus the `expectEmptyUnits`
+ * ledger — derived, never authored. Its keys are the only keys a rule may
+ * carry (`BOUNDARY_RULE_INPUT_KEYS`). `exceptions[].target` stays a string: a
+ * stale exception is an error by design.
+ */
+export interface IBoundaryRuleInput extends Omit<IBoundaryRule, 'from' | 'forbiddenImports' | 'allowedImports' | 'exemptFiles' | 'expectEmptyUnits'> {
+    /** Scope globs; an entry starting with `!` exempts. A marker: `{ pattern: 'packages/plugin-react/**', expectEmpty: true }`. */
+    from: readonly SelectorListEntry[];
+    forbiddenImports?: readonly SelectorListEntry[];
+    allowedImports?: readonly SelectorListEntry[];
+    exemptFiles?: readonly SelectorListEntry[];
+}
+//# sourceMappingURL=boundary-rule-input.d.ts.map

package/dist/model/boundary-rule-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary-rule-input.d.ts","sourceRoot":"","sources":["../../src/model/boundary-rule-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBACf,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,aAAa,GAAG,kBAAkB,CAAC;IAChH,+HAA+H;IAC/H,IAAI,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACnC,gBAAgB,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,cAAc,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC9C,WAAW,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC5C"}

package/dist/model/boundary-rule-input.js

@@ -0,0 +1 @@
+export {};

package/dist/model/boundary-rule-key-problems.d.ts

@@ -0,0 +1,11 @@
+import type { IBoundaryRuleValidationIssue } from './boundary-rule.js';
+/**
+ * One issue per key an authored boundary rule may not carry (round 13): a
+ * rule-level `expectEmpty` / `allowDead` / `intendedEmpty` (the marker is per
+ * pattern), the derived `expectEmptyUnits` ledger, or any other key that is
+ * not an {@link BOUNDARY_RULE_INPUT_KEYS} key — with a did-you-mean through
+ * the repo's ONE scorer (`nearestIds`, `@shrkcrft/core`). A misplaced key used to
+ * load and be silently ignored.
+ */
+export declare function boundaryRuleKeyProblems(rule: Readonly<Record<string, unknown>>): IBoundaryRuleValidationIssue[];
+//# sourceMappingURL=boundary-rule-key-problems.d.ts.map

package/dist/model/boundary-rule-key-problems.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary-rule-key-problems.d.ts","sourceRoot":"","sources":["../../src/model/boundary-rule-key-problems.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAevE;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,4BAA4B,EAAE,CAe/G"}

package/dist/model/boundary-rule-key-problems.js

@@ -0,0 +1,36 @@
+import { nearestIds } from '@shrkcrft/core';
+import { BOUNDARY_RULE_INPUT_KEYS } from "./boundary-rule-input-keys.js";
+/**
+ * Rule-level spellings of "this rule may match nothing" an author carries over
+ * from another plane (baselines' rule-level `expectEmpty`), or from a guess —
+ * plus the derived ledger, which no author may write.
+ */
+const RULE_LEVEL_MARKER_KEYS = new Set(['expectEmpty', 'allowDead', 'intendedEmpty', 'expectEmptyUnits']);
+/** THE words for a rule-level marker (DECISIONS §4). */
+const PER_PATTERN = 'expectEmpty is per pattern on a boundary rule: forbiddenImports: [{ pattern, expectEmpty: true }]';
+const KNOWN_KEYS = Object.keys(BOUNDARY_RULE_INPUT_KEYS);
+/**
+ * One issue per key an authored boundary rule may not carry (round 13): a
+ * rule-level `expectEmpty` / `allowDead` / `intendedEmpty` (the marker is per
+ * pattern), the derived `expectEmptyUnits` ledger, or any other key that is
+ * not an {@link BOUNDARY_RULE_INPUT_KEYS} key — with a did-you-mean through
+ * the repo's ONE scorer (`nearestIds`, `@shrkcrft/core`). A misplaced key used to
+ * load and be silently ignored.
+ */
+export function boundaryRuleKeyProblems(rule) {
+    const issues = [];
+    for (const key of Object.keys(rule)) {
+        if (Object.prototype.hasOwnProperty.call(BOUNDARY_RULE_INPUT_KEYS, key))
+            continue;
+        if (RULE_LEVEL_MARKER_KEYS.has(key)) {
+            issues.push({ field: key, message: PER_PATTERN });
+            continue;
+        }
+        const near = nearestIds(key, KNOWN_KEYS, 1)[0];
+        issues.push({
+            field: key,
+            message: `unknown key '${key}' — not a boundary rule field, so it would be silently ignored${near !== undefined ? `; did you mean '${near.id}'?` : ''}`,
+        });
+    }
+    return issues;
+}

package/dist/model/boundary-rule-marker-problems.d.ts

@@ -0,0 +1,26 @@
+import { type IUnitList } from '@shrkcrft/core';
+import type { ForbiddenMatchMode, IBoundaryRuleValidationIssue } from './boundary-rule.js';
+/**
+ * The marker refusals a boundary rule adds on top of core's marker shape
+ * (round 13, DECISIONS §4), over the NORMALISED lists:
+ *
+ *   - a marker on a pattern dead by its SHAPE can never go live, so it could
+ *     only ever silence a real problem: an `importPatternDefect`, a
+ *     `forbiddenImports` entry a kept sibling already covers (redundant), or an
+ *     `allowedImports` entry a forbidden one shadows. Each is proved from the
+ *     rule alone, through the same authorities the evaluator and `boundaries
+ *     explain` read (`importPatternDefect`, `boundaryPatternOverlaps`);
+ *   - a marker on a pattern the dead-unit judge can NEVER call dead (a
+ *     relative one, a leading `*`, one a runtime builtin matches —
+ *     `importPatternNeverJudgedDead`) could only ever read went-live: refused
+ *     with that explanation (K5);
+ *   - `failOnEmpty: true` with EVERY `from` inclusion marked asserts both "an
+ *     empty result is intended" and "an empty result fails" (core's one
+ *     conflict rule, `markedListFailOnEmptyConflict`). Partial marking is legal.
+ */
+export declare function boundaryRuleMarkerProblems(lists: {
+    readonly from?: IUnitList;
+    readonly forbiddenImports?: IUnitList;
+    readonly allowedImports?: IUnitList;
+}, mode: ForbiddenMatchMode, failOnEmpty: unknown): IBoundaryRuleValidationIssue[];
+//# sourceMappingURL=boundary-rule-marker-problems.d.ts.map

package/dist/model/boundary-rule-marker-problems.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary-rule-marker-problems.d.ts","sourceRoot":"","sources":["../../src/model/boundary-rule-marker-problems.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAI3F;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE;IACL,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,CAAC;CACrC,EACD,IAAI,EAAE,kBAAkB,EACxB,WAAW,EAAE,OAAO,GACnB,4BAA4B,EAAE,CAqFhC"}

package/dist/model/boundary-rule-marker-problems.js

@@ -0,0 +1,94 @@
+import { markedListFailOnEmptyConflict } from '@shrkcrft/core';
+import { importPatternDefect, importPatternNeverJudgedDead } from "../scan/import-pattern.js";
+import { boundaryPatternOverlaps } from "./boundary-rule-scope.js";
+import { BoundaryMarkableList } from "./boundary-markable-list.js";
+/**
+ * The marker refusals a boundary rule adds on top of core's marker shape
+ * (round 13, DECISIONS §4), over the NORMALISED lists:
+ *
+ *   - a marker on a pattern dead by its SHAPE can never go live, so it could
+ *     only ever silence a real problem: an `importPatternDefect`, a
+ *     `forbiddenImports` entry a kept sibling already covers (redundant), or an
+ *     `allowedImports` entry a forbidden one shadows. Each is proved from the
+ *     rule alone, through the same authorities the evaluator and `boundaries
+ *     explain` read (`importPatternDefect`, `boundaryPatternOverlaps`);
+ *   - a marker on a pattern the dead-unit judge can NEVER call dead (a
+ *     relative one, a leading `*`, one a runtime builtin matches —
+ *     `importPatternNeverJudgedDead`) could only ever read went-live: refused
+ *     with that explanation (K5);
+ *   - `failOnEmpty: true` with EVERY `from` inclusion marked asserts both "an
+ *     empty result is intended" and "an empty result fails" (core's one
+ *     conflict rule, `markedListFailOnEmptyConflict`). Partial marking is legal.
+ */
+export function boundaryRuleMarkerProblems(lists, mode, failOnEmpty) {
+    const issues = [];
+    const markedIn = (list, listPath) => new Set((list?.marks ?? []).filter((m) => m.list === listPath).map((m) => m.unit));
+    const forbiddenMarked = markedIn(lists.forbiddenImports, BoundaryMarkableList.ForbiddenImports);
+    const allowedMarked = markedIn(lists.allowedImports, BoundaryMarkableList.AllowedImports);
+    const refuseDefects = (list, listPath, marked, listMode) => {
+        const reported = new Set();
+        list?.units.forEach((unit, i) => {
+            if (!marked.has(unit) || reported.has(unit) || importPatternDefect(unit, listMode) === undefined)
+                return;
+            reported.add(unit);
+            issues.push({
+                field: `${listPath}[${i}]`,
+                message: `'${unit}' is marked expectEmpty, but a defective pattern can never go live — fix the pattern; a marker cannot waive a defect`,
+            });
+        });
+    };
+    refuseDefects(lists.forbiddenImports, BoundaryMarkableList.ForbiddenImports, forbiddenMarked, mode);
+    refuseDefects(lists.allowedImports, BoundaryMarkableList.AllowedImports, allowedMarked, 'exact');
+    // Round 13 (K5): a marker on a pattern the dead-unit judge can NEVER call
+    // dead — a relative one, a leading `*`, one a runtime builtin matches — can
+    // only ever read went-live, so it would print a stale-marker line from the
+    // moment it is written. The judge's own reach rules decide it
+    // (`importPatternNeverJudgedDead`).
+    const refuseUnjudgeable = (list, listPath, marked, listMode) => {
+        const reported = new Set();
+        list?.units.forEach((unit, i) => {
+            if (!marked.has(unit) || reported.has(unit))
+                return;
+            const never = importPatternNeverJudgedDead(unit, listMode);
+            if (never === undefined)
+                return;
+            reported.add(unit);
+            issues.push({
+                field: `${listPath}[${i}]`,
+                message: `'${unit}' is marked expectEmpty, but ${never} — a marker on it could only ever read went-live; write the plain pattern (it needs no expectEmpty)`,
+            });
+        });
+    };
+    refuseUnjudgeable(lists.forbiddenImports, BoundaryMarkableList.ForbiddenImports, forbiddenMarked, mode);
+    refuseUnjudgeable(lists.allowedImports, BoundaryMarkableList.AllowedImports, allowedMarked, 'exact');
+    if (forbiddenMarked.size > 0 || allowedMarked.size > 0) {
+        const overlaps = boundaryPatternOverlaps({
+            forbiddenImports: lists.forbiddenImports?.units ?? [],
+            allowedImports: lists.allowedImports?.units ?? [],
+            forbiddenMatch: mode,
+        });
+        for (const o of overlaps.redundantForbidden) {
+            if (!forbiddenMarked.has(o.pattern))
+                continue;
+            issues.push({
+                field: `${BoundaryMarkableList.ForbiddenImports}[${o.index}]`,
+                message: `'${o.pattern}' is marked expectEmpty, but '${o.by}' already covers every import it could match — a redundant pattern can never decide a verdict, so it can never go live; delete it`,
+            });
+        }
+        for (const o of overlaps.shadowedAllowed) {
+            if (!allowedMarked.has(o.pattern))
+                continue;
+            issues.push({
+                field: `${BoundaryMarkableList.AllowedImports}[${o.index}]`,
+                message: `'${o.pattern}' is marked expectEmpty, but forbidden '${o.by}' is checked first and covers it — it can never admit an import, so it can never go live; ` +
+                    `carve the subpath out with exceptions[{ path, target, reason }]${mode === 'package' ? " or set forbiddenMatch: 'exact'" : ''}`,
+            });
+        }
+    }
+    if (lists.from !== undefined) {
+        const conflict = markedListFailOnEmptyConflict(lists.from, BoundaryMarkableList.From, typeof failOnEmpty === 'boolean' ? failOnEmpty : undefined);
+        if (conflict !== undefined)
+            issues.push({ field: 'failOnEmpty', message: conflict });
+    }
+    return issues;
+}

package/dist/model/boundary-rule-scope.d.ts

@@ -0,0 +1,88 @@
+import type { IUnreadFile } from '../util/unread-file.js';
+import type { BoundaryScopeDecision, BoundarySeverity, ForbiddenMatchMode, IBoundaryPatternOverlaps, IBoundaryRule, IBoundaryRuleScope } from './boundary-rule.js';
+/**
+ * The ONE answer to "is file F in rule R's scope?" and "how severe is R?".
+ *
+ * Before round 11 four code paths each read `rule.from` on their own — the
+ * evaluator, `why-file`, the rule-graph bridge, the changes summary — and the
+ * CLI renderers each defaulted an unset severity to `'warning'` while the
+ * evaluator enforced it as `'error'` (an author inspecting a rule was told
+ * "warning" for a rule that blocks CI). With exemptions in the model, any
+ * reader that kept matching `from` alone would keep claiming a rule applies to
+ * an exempted file. So every reader calls these, and the evaluator itself
+ * decides scope through {@link boundaryScopeDecision}.
+ */
+/**
+ * The test-file shorthand `excludeTests: true` expands to. Deliberately the
+ * common layouts only — a repo with another convention lists its own globs in
+ * `exemptFiles`.
+ */
+export declare const TEST_FILE_GLOBS: readonly string[];
+/**
+ * A rule's source-side scope: the globs that include files and the globs that
+ * exempt them.
+ *
+ * A `from` entry starting with `!` is normalised into an exemption — the syntax
+ * authors already type (`'!**\/*.spec.ts'`) used to compile to a literal `!`
+ * glob that matched nothing, silently, while the spec file stayed governed.
+ *
+ * `from` is split by core's ONE `!` parser (`parseGlobList`), the same one
+ * every gate plane selects through. The planes differ in what a negation DOES,
+ * never in what it is: here it EXEMPTS (the file is still scanned, its
+ * violations are marked suppressed and counted — the boundary counterpart of
+ * policy `exemptFiles`); on the gate planes it EXCLUDES (out of scope). Both
+ * share one liveness rule: a negation is alive iff it removes at least one
+ * file from its own positive set. A bare `!` is rejected at load
+ * (`globListProblem`), so the empty-glob guard below only meets an
+ * unvalidated rule.
+ */
+export declare function boundaryRuleScope(rule: IBoundaryRule): IBoundaryRuleScope;
+/**
+ * Where `relPath` sits relative to a precomputed scope: `in` (governed),
+ * `exempt` (inside `from`, but exempted — still scanned, its violations are
+ * MARKED suppressed, never dropped), or `out`.
+ */
+export declare function boundaryScopeDecision(scope: IBoundaryRuleScope, relPath: string): BoundaryScopeDecision;
+/**
+ * {@link boundaryScopeDecision} for an UNREAD entry: a file the scan matched
+ * but could not read, or a directory it could not list. A file is governed
+ * exactly as a read one would be. A directory is governed when an include glob
+ * could match beneath it and no exemption covers ALL of it — through the one
+ * unread-entry test every plane uses (`unreadEntryMatches` /
+ * `unreadEntryWhollyMatches`).
+ */
+export declare function boundaryScopeCoversUnread(scope: IBoundaryRuleScope, u: IUnreadFile): boolean;
+/** {@link boundaryScopeDecision} for one rule — the call every reader uses. */
+export declare function boundaryRuleCovers(rule: IBoundaryRule, relPath: string): BoundaryScopeDecision;
+/** The severity the evaluator ENFORCES: an unset severity is `error`. */
+export declare function boundaryRuleSeverity(rule: Pick<IBoundaryRule, 'severity'>): BoundarySeverity;
+/**
+ * Whether a rule whose scope matched no scanned file is a FAILURE rather than a
+ * skip — the gate planes' `failOnEmpty` default: on for `error` rules. The
+ * boundary VIEW of the one failOnEmpty authority (`failsWhenEmpty`,
+ * `@shrkcrft/core`), never a second default: an `info` rule, like a `warning`
+ * one, defaults off.
+ */
+export declare function boundaryRuleFailsOnEmpty(rule: Pick<IBoundaryRule, 'severity' | 'failOnEmpty'>): boolean;
+/** How the rule's `forbiddenImports` / `exceptions[].target` match: package semantics unless opted out. */
+export declare function boundaryForbiddenMatch(rule: Pick<IBoundaryRule, 'forbiddenMatch'>): ForbiddenMatchMode;
+/**
+ * The patterns of one rule that can never change its verdict (round 12,
+ * R12-5.3 / R12-5.6) — the ONE answer the evaluator (coverage `subsumedBy` /
+ * `shadowedBy`, the shadowed dead unit), `boundaries explain` and MCP
+ * `get_boundary_rule` read, through the one subsumption proof beside the
+ * matcher (`importPatternSubsumes`).
+ *
+ *   - `redundantForbidden`: a `forbiddenImports` entry another KEPT entry
+ *     already covers — `@scope/pkg/**` next to `@scope/pkg` under package
+ *     semantics, the `pkg` + `pkg/**` helper consumers wrote while a bare
+ *     pattern missed subpaths. Of two entries covering each other the FIRST is
+ *     kept, and a coverer is always a kept entry, so deleting every redundant
+ *     one never narrows the fence. INFO only.
+ *   - `shadowedAllowed`: an `allowedImports` entry a forbidden entry covers.
+ *     Forbidden is checked first and allowed never re-admits, so it can never
+ *     admit an import — under package semantics a bare forbidden package
+ *     shadows every allowed subpath of it (a carve-out alpha.30 honoured).
+ */
+export declare function boundaryPatternOverlaps(rule: Pick<IBoundaryRule, 'forbiddenImports' | 'allowedImports' | 'forbiddenMatch'>): IBoundaryPatternOverlaps;
+//# sourceMappingURL=boundary-rule-scope.d.ts.map

package/dist/model/boundary-rule-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary-rule-scope.d.ts","sourceRoot":"","sources":["../../src/model/boundary-rule-scope.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EACV,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAElB,wBAAwB,EACxB,aAAa,EACb,kBAAkB,EAEnB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;GAWG;AAEH;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAK5C,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,kBAAkB,CAWzE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,GAAG,qBAAqB,CAIvG;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAG5F;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,qBAAqB,CAE9F;AAED,yEAAyE;AACzE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG,gBAAgB,CAE5F;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,aAAa,CAAC,GAAG,OAAO,CAKvG;AAED,2GAA2G;AAC3G,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,kBAAkB,CAEtG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,kBAAkB,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,GAClF,wBAAwB,CAyC1B"}