archcheck 0.2.0

package/dist/probes/types.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The second seam: a probe.
+ *
+ * What rule this enforces: every probe can either RUN a tool or INGEST the report another gate
+ * already produced (LLD §1.3). Without that, archcheck re-runs the type checker, the linter and
+ * the graph reader and doubles CI time for no new information. CI builds each artefact once and
+ * archcheck normalises; running directly is the local convenience path.
+ *
+ * What a caller must know: `ctx.graph()` is MEMOISED by the caller. One parse, shared by every
+ * probe — a probe that builds its own graph has broken the property the whole design rests on.
+ */
+import type { FileSystem } from '../fs/index.js';
+import type { ModuleGraph } from '../graph/types.js';
+import type { Result } from '../result.js';
+import type { ContractKind, RawFinding, Rule } from '../types.js';
+/** A probe that could not run. `skipped` in the RunResult is built from these. */
+export type Skip = {
+    skipped: true;
+    reason: string;
+};
+export declare function isSkip(value: unknown): value is Skip;
+export type RunCtx = {
+    root: string;
+    tsconfigPath: string;
+    /** Active rules only — `severity: 'off'` never reaches a probe. */
+    rules: readonly Rule[];
+    /**
+     * Repo-relative POSIX paths of the changed set, or undefined for the whole repository.
+     * Diff scoping is where the real saving is: rule evaluation and every model call (LLD §1.8).
+     */
+    changed?: readonly string[];
+    /** The shared module graph, built at most once per run. */
+    graph(): Result<ModuleGraph>;
+    /** Every filesystem read goes through here, so a probe can be run with no disk at all. */
+    fs: FileSystem;
+    /** Repo-relative path of the manifest — where a registry-level finding is reported against. */
+    configPath: string;
+};
+export type Probe = {
+    name: string;
+    handles: readonly ContractKind[];
+    run(ctx: RunCtx): Promise<RawFinding[] | Skip>;
+    /** Map a report another gate wrote back into findings. */
+    ingest?(report: unknown, ctx: RunCtx): RawFinding[];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/probes/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/probes/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAElE,kFAAkF;AAClF,MAAM,MAAM,IAAI,GAAG;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAEpD;AAED,MAAM,MAAM,MAAM,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IACvB;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,2DAA2D;IAC3D,KAAK,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7B,0FAA0F;IAC1F,EAAE,EAAE,UAAU,CAAC;IACf,+FAA+F;IAC/F,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,KAAK,GAAG;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,0DAA0D;IAC1D,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,CAAC;CACrD,CAAC"}

package/dist/probes/types.js

@@ -0,0 +1,15 @@
+/**
+ * The second seam: a probe.
+ *
+ * What rule this enforces: every probe can either RUN a tool or INGEST the report another gate
+ * already produced (LLD §1.3). Without that, archcheck re-runs the type checker, the linter and
+ * the graph reader and doubles CI time for no new information. CI builds each artefact once and
+ * archcheck normalises; running directly is the local convenience path.
+ *
+ * What a caller must know: `ctx.graph()` is MEMOISED by the caller. One parse, shared by every
+ * probe — a probe that builds its own graph has broken the property the whole design rests on.
+ */
+export function isSkip(value) {
+    return typeof value === 'object' && value !== null && value.skipped === true;
+}
+//# sourceMappingURL=types.js.map

package/dist/probes/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/probes/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAAc,CAAC,OAAO,KAAK,IAAI,CAAC;AACzF,CAAC"}

package/dist/registry/define.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `defineArchitecture` — the one function a manifest calls.
+ *
+ * What this is for: giving `architecture.config.ts` a type without giving it any runtime
+ * behaviour. It is an identity function on purpose. A manifest that ran logic at load time would
+ * be a program pretending to be a declaration, and the whole value of the manifest is that it can
+ * be read by a person, a generator and a diff.
+ *
+ * What a caller must know: nothing here validates. Validation is total and lives in
+ * `validate.ts`, because it must be able to return every problem at once rather than throwing on
+ * the first (a malformed manifest exits 2, not 1).
+ */
+import type { ArchitectureException } from '../exceptions/index.js';
+import type { Rule } from '../types.js';
+export type ArchitectureManifest = {
+    /**
+     * The repository root every path in the manifest is relative to. Defaults to the directory
+     * holding the config, which is what almost everyone wants.
+     */
+    root?: string;
+    /** The tsconfig the module graph is built from. Defaults to `<root>/tsconfig.json`. */
+    tsconfig?: string;
+    /** Where generated output is written. Defaults to `generated`. */
+    generatedDir?: string;
+    /**
+     * Documents with an `archcheck:begin rules-table` fence. Only the fenced region is generated —
+     * long-form prose stays hand-written, because a manifest holding paragraphs is a config file
+     * pretending to be a document (LLD §1.9).
+     */
+    docs?: string[];
+    /** The only place a rule is defined. */
+    rules: Rule[];
+    /**
+     * The only legitimate way past a rule: owned, reasoned and expiring. Never inline — an inline
+     * suppression comment is itself a violation (plan 12, plan 15).
+     */
+    exceptions?: ArchitectureException[];
+};
+export declare function defineArchitecture(config: ArchitectureManifest): ArchitectureManifest;
+//# sourceMappingURL=define.d.ts.map

package/dist/registry/define.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define.d.ts","sourceRoot":"","sources":["../../src/registry/define.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,wCAAwC;IACxC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd;;;OAGG;IACH,UAAU,CAAC,EAAE,qBAAqB,EAAE,CAAC;CACtC,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,GAAG,oBAAoB,CAErF"}

package/dist/registry/define.js

@@ -0,0 +1,4 @@
+export function defineArchitecture(config) {
+    return config;
+}
+//# sourceMappingURL=define.js.map

package/dist/registry/define.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define.js","sourceRoot":"","sources":["../../src/registry/define.ts"],"names":[],"mappings":"AAwCA,MAAM,UAAU,kBAAkB,CAAC,MAA4B;IAC7D,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/registry/ids.d.ts

@@ -0,0 +1,19 @@
+import { type Result } from '../result.js';
+import type { Rule } from '../types.js';
+export type IdLedger = {
+    schemaVersion: 1;
+    ids: string[];
+    /**
+     * Set when a ledger file exists but could not be understood, and holds the whole message to
+     * print. `checkIdImmutability` refuses to run against it, and the CLI refuses to let `emit`
+     * rebuild it: an empty `ids` list would otherwise read as "no id has ever been committed",
+     * which passes every rename. `tests/cli.test.ts` → 'a corrupt id ledger' pins both paths.
+     */
+    unreadable?: string;
+};
+export declare const ID_LEDGER_PATH = ".archcheck/ids.json";
+export declare function readIdLedger(path: string): IdLedger;
+/** The ledger `emit` should write: every id ever seen, plus today's, sorted and deduplicated. */
+export declare function nextIdLedger(previous: IdLedger, rules: readonly Rule[]): IdLedger;
+export declare function checkIdImmutability(rules: readonly Rule[], ledger: IdLedger): Result<void>;
+//# sourceMappingURL=ids.d.ts.map

package/dist/registry/ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../src/registry/ids.ts"],"names":[],"mappings":"AAYA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,MAAM,QAAQ,GAAG;IACrB,aAAa,EAAE,CAAC,CAAC;IACjB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,eAAO,MAAM,cAAc,wBAAwB,CAAC;AAcpD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAgCnD;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,IAAI,EAAE,GAAG,QAAQ,CAIjF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAmB1F"}

package/dist/registry/ids.js

@@ -0,0 +1,86 @@
+/**
+ * Rule ids are immutable once committed.
+ *
+ * What rule this enforces: LLD §1.6. A rename silently orphans every baseline entry and every
+ * historical annotation that keyed off the old id — and it fails open, because the renamed rule
+ * still passes. `.archcheck/ids.json` is the ledger of every id ever committed, and a load fails
+ * if a listed id has vanished without a successor declaring `replaces`.
+ *
+ * What a caller must know: this reads a file but never writes it. `archcheck emit` owns the write,
+ * so the ledger grows as a reviewed diff rather than as a side effect of running a check.
+ */
+import { readFileSync } from 'node:fs';
+import { err, ok } from '../result.js';
+export const ID_LEDGER_PATH = '.archcheck/ids.json';
+function unreadableLedger(path, reason) {
+    return {
+        schemaVersion: 1,
+        ids: [],
+        unreadable: [
+            `the id ledger ${path} exists but could not be read: ${reason}`,
+            '  → restore it from version control, or delete it and re-run `npx archcheck emit`',
+            '  an empty ledger would read as "no id has ever been committed", which passes every rename',
+        ].join('\n'),
+    };
+}
+export function readIdLedger(path) {
+    let source;
+    try {
+        source = readFileSync(path, 'utf8');
+    }
+    catch (error) {
+        // No ledger yet is the normal first-run state, not a failure. Anything else — a directory in
+        // its place, a permission error — is one, and must not borrow the first-run answer.
+        if (error.code === 'ENOENT')
+            return { schemaVersion: 1, ids: [] };
+        return unreadableLedger(path, error instanceof Error ? error.message : String(error));
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(source);
+    }
+    catch (error) {
+        return unreadableLedger(path, error instanceof Error ? error.message : String(error));
+    }
+    if (typeof parsed !== 'object' || parsed === null) {
+        return unreadableLedger(path, 'its top level is not a JSON object');
+    }
+    const listed = parsed.ids;
+    if (!Array.isArray(listed))
+        return unreadableLedger(path, 'it has no `ids` array');
+    const ids = [];
+    for (const id of listed) {
+        // Dropping a malformed entry would silently shrink the ledger, which is the same failure as
+        // not reading it at all.
+        if (typeof id !== 'string')
+            return unreadableLedger(path, '`ids` holds an entry that is not a string');
+        ids.push(id);
+    }
+    return { schemaVersion: 1, ids };
+}
+/** The ledger `emit` should write: every id ever seen, plus today's, sorted and deduplicated. */
+export function nextIdLedger(previous, rules) {
+    const ids = new Set(previous.ids);
+    for (const rule of rules)
+        ids.add(rule.id);
+    return { schemaVersion: 1, ids: [...ids].sort() };
+}
+export function checkIdImmutability(rules, ledger) {
+    // A ledger nobody can read proves nothing, so it fails the load rather than passing it.
+    if (ledger.unreadable !== undefined)
+        return err([ledger.unreadable]);
+    const present = new Set(rules.map((r) => r.id));
+    const superseded = new Set(rules.map((r) => r.replaces).filter((r) => Boolean(r)));
+    const errors = [];
+    for (const id of ledger.ids) {
+        if (present.has(id) || superseded.has(id))
+            continue;
+        errors.push([
+            `id disappeared: ${id}`,
+            `  → either restore it, or add a rule with replaces: '${id}'`,
+            '  ids are immutable because the baseline and every past annotation key off them',
+        ].join('\n'));
+    }
+    return errors.length > 0 ? err(errors) : ok(undefined);
+}
+//# sourceMappingURL=ids.js.map

package/dist/registry/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../src/registry/ids.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,cAAc,CAAC;AAepD,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAc;IACpD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,GAAG,EAAE,EAAE;QACP,UAAU,EAAE;YACV,iBAAiB,IAAI,kCAAkC,MAAM,EAAE;YAC/D,mFAAmF;YACnF,4FAA4F;SAC7F,CAAC,IAAI,CAAC,IAAI,CAAC;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6FAA6F;QAC7F,oFAAoF;QACpF,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACzF,OAAO,gBAAgB,CAAC,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,gBAAgB,CAAC,IAAI,EAAE,oCAAoC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAI,MAA4B,CAAC,GAAG,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEnF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,EAAE,IAAI,MAA4B,EAAE,CAAC;QAC9C,4FAA4F;QAC5F,yBAAyB;QACzB,IAAI,OAAO,EAAE,KAAK,QAAQ;YACxB,OAAO,gBAAgB,CAAC,IAAI,EAAE,2CAA2C,CAAC,CAAC;QAC7E,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;AACnC,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,KAAsB;IACrE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAsB,EAAE,MAAgB;IAC1E,wFAAwF;IACxF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAErE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhG,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACpD,MAAM,CAAC,IAAI,CACT;YACE,mBAAmB,EAAE,EAAE;YACvB,wDAAwD,EAAE,GAAG;YAC7D,iFAAiF;SAClF,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;AACzD,CAAC"}

package/dist/registry/index.d.ts

@@ -0,0 +1,45 @@
+import type { ArchitectureException } from '../exceptions/index.js';
+import { type Result } from '../result.js';
+import type { ContractKind, Coverage, Rule } from '../types.js';
+import type { ArchitectureManifest } from './define.js';
+import { type IdLedger } from './ids.js';
+import { type ParamsValidator } from './validate.js';
+export type Registry = {
+    readonly root: string;
+    readonly configPath: string;
+    readonly manifest: ArchitectureManifest;
+    all(): readonly Rule[];
+    /** Rules that can actually fire — everything except `severity: 'off'`. */
+    active(): readonly Rule[];
+    byId(id: string): Rule | undefined;
+    byKind(kind: ContractKind): readonly Rule[];
+    coverage(): Coverage;
+    exceptions(): readonly ArchitectureException[];
+    /** Things that load fine but somebody should see. Printed, never silently dropped. */
+    warnings(): readonly string[];
+    /** The id ledger `emit` should write next. */
+    ledger(): IdLedger;
+};
+export type OpenOptions = {
+    /** Where to start looking for the manifest. Ignored when `configPath` is given. */
+    cwd?: string;
+    configPath?: string;
+    /** Kind-specific params validation, injected by the composition root. */
+    validateParams: ParamsValidator;
+    /** Kind-specific load-time warnings, injected the same way. */
+    collectWarnings?: (rules: readonly Rule[]) => string[];
+    /**
+     * Whether archcheck can check this rule's kind at all. Injected, because the registry knows a
+     * rule has a kind and must never learn what a kind means. Defaults to "yes" so the registry
+     * stays testable with no contract kind present.
+     */
+    isCheckable?: (rule: Rule) => boolean;
+    /** Skip the id-immutability ledger. Only `emit` and tests have a reason to. */
+    skipIdCheck?: boolean;
+};
+export declare function open(options: OpenOptions): Result<Registry>;
+export { type ArchitectureManifest, defineArchitecture } from './define.js';
+export { checkIdImmutability, ID_LEDGER_PATH, type IdLedger, nextIdLedger, readIdLedger, } from './ids.js';
+export { CONFIG_FILENAME, findConfig, type LoadedManifest } from './load.js';
+export { type ParamsValidator, validateManifest } from './validate.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/registry/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/registry/index.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEpE,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAuC,KAAK,QAAQ,EAAgB,MAAM,UAAU,CAAC;AAE5F,OAAO,EAAE,KAAK,eAAe,EAAoB,MAAM,eAAe,CAAC;AAEvE,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,GAAG,IAAI,SAAS,IAAI,EAAE,CAAC;IACvB,0EAA0E;IAC1E,MAAM,IAAI,SAAS,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACnC,MAAM,CAAC,IAAI,EAAE,YAAY,GAAG,SAAS,IAAI,EAAE,CAAC;IAC5C,QAAQ,IAAI,QAAQ,CAAC;IACrB,UAAU,IAAI,SAAS,qBAAqB,EAAE,CAAC;IAC/C,sFAAsF;IACtF,QAAQ,IAAI,SAAS,MAAM,EAAE,CAAC;IAC9B,8CAA8C;IAC9C,MAAM,IAAI,QAAQ,CAAC;CACpB,CAAC;AAsCF,MAAM,MAAM,WAAW,GAAG;IACxB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,cAAc,EAAE,eAAe,CAAC;IAChC,+DAA+D;IAC/D,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;IACvD;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC;IACtC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,wBAAgB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,CA2B3D;AAED,OAAO,EAAE,KAAK,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,KAAK,QAAQ,EACb,YAAY,EACZ,YAAY,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,KAAK,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}

package/dist/registry/index.js

@@ -0,0 +1,71 @@
+/**
+ * The registry — the only thing that knows a rule exists.
+ *
+ * What rule this enforces: coverage is computed, never stored (plan 03). The three counts come
+ * from counting the manifest at load time, so nobody can claim a number the manifest does not
+ * support. If someone adds a rule with no real check, the model count goes up and the percentage
+ * drops, in the same commit.
+ *
+ * What a caller must know: `open()` is the only way in, and it returns a Result. Everything past
+ * it can assume every rule is well-formed, which is why no downstream module re-validates.
+ */
+import { join } from 'node:path';
+import { validateExceptions } from '../exceptions/index.js';
+import { err, ok } from '../result.js';
+import { checkIdImmutability, ID_LEDGER_PATH, readIdLedger } from './ids.js';
+import { loadManifest, loadManifestFrom } from './load.js';
+import { validateManifest } from './validate.js';
+function createRegistry(loaded, ledger, warnings, isCheckable) {
+    const rules = loaded.manifest.rules;
+    const byId = new Map(rules.map((rule) => [rule.id, rule]));
+    return {
+        root: loaded.root,
+        configPath: loaded.configPath,
+        manifest: loaded.manifest,
+        all: () => rules,
+        active: () => rules.filter((rule) => rule.severity !== 'off'),
+        byId: (id) => byId.get(id),
+        byKind: (kind) => rules.filter((rule) => rule.kind === kind),
+        coverage: () => {
+            const active = rules.filter((rule) => rule.severity !== 'off');
+            const checkable = active.filter(isCheckable);
+            const count = (confidence) => checkable.filter((rule) => rule.confidence === confidence).length;
+            return {
+                total: active.length,
+                deterministic: count('deterministic'),
+                proxy: count('proxy'),
+                model: count('model'),
+                unchecked: active.length - checkable.length,
+            };
+        },
+        exceptions: () => loaded.manifest.exceptions ?? [],
+        warnings: () => warnings,
+        ledger: () => ledger,
+    };
+}
+export function open(options) {
+    const loadedResult = options.configPath
+        ? loadManifestFrom(options.configPath)
+        : loadManifest(options.cwd ?? process.cwd());
+    if (!loadedResult.ok)
+        return loadedResult;
+    const loaded = loadedResult.value;
+    const validated = validateManifest(loaded.manifest, options.validateParams);
+    if (!validated.ok)
+        return err(validated.error);
+    const exceptionsOk = validateExceptions(loaded.manifest.exceptions ?? [], loaded.manifest.rules);
+    if (!exceptionsOk.ok)
+        return err(exceptionsOk.error);
+    const ledger = readIdLedger(join(loaded.root, ID_LEDGER_PATH));
+    if (options.skipIdCheck !== true) {
+        const immutable = checkIdImmutability(loaded.manifest.rules, ledger);
+        if (!immutable.ok)
+            return err(immutable.error);
+    }
+    return ok(createRegistry(loaded, ledger, options.collectWarnings?.(loaded.manifest.rules) ?? [], options.isCheckable ?? (() => true)));
+}
+export { defineArchitecture } from './define.js';
+export { checkIdImmutability, ID_LEDGER_PATH, nextIdLedger, readIdLedger, } from './ids.js';
+export { CONFIG_FILENAME, findConfig } from './load.js';
+export { validateManifest } from './validate.js';
+//# sourceMappingURL=index.js.map

package/dist/registry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/registry/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAiB,YAAY,EAAE,MAAM,UAAU,CAAC;AAC5F,OAAO,EAAuB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAwB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAmBvE,SAAS,cAAc,CACrB,MAAsB,EACtB,MAAgB,EAChB,QAA2B,EAC3B,WAAoC;IAEpC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3D,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;QAChB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC;QAC7D,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;QAC5D,QAAQ,EAAE,GAAG,EAAE;YACb,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;YAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,CAAC,UAA8B,EAAE,EAAE,CAC/C,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;YACpE,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,MAAM;gBACpB,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC;gBACrC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;gBACrB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;gBACrB,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM;aAC5C,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE;QAClD,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ;QACxB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;KACrB,CAAC;AACJ,CAAC;AAoBD,MAAM,UAAU,IAAI,CAAC,OAAoB;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU;QACrC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC;QACtC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,YAAY,CAAC;IAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC;IAElC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5E,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAE/C,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjG,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,CACP,cAAc,CACZ,MAAM,EACN,MAAM,EACN,OAAO,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EACtD,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CACpC,CACF,CAAC;AACJ,CAAC;AAED,OAAO,EAA6B,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,cAAc,EAEd,YAAY,EACZ,YAAY,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAuB,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAwB,gBAAgB,EAAE,MAAM,eAAe,CAAC"}

package/dist/registry/load.d.ts

@@ -0,0 +1,14 @@
+import { type Result } from '../result.js';
+import { type ArchitectureManifest } from './define.js';
+export declare const CONFIG_FILENAME = "architecture.config.ts";
+/** Walk up from `start` looking for the manifest. Returns its absolute path, or null. */
+export declare function findConfig(start: string): string | null;
+export type LoadedManifest = {
+    manifest: ArchitectureManifest;
+    configPath: string;
+    /** Absolute, and the base every relative path in the manifest resolves against. */
+    root: string;
+};
+export declare function loadManifestFrom(configPath: string): Result<LoadedManifest>;
+export declare function loadManifest(startDir: string): Result<LoadedManifest>;
+//# sourceMappingURL=load.d.ts.map

package/dist/registry/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/registry/load.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,KAAK,oBAAoB,EAAsB,MAAM,aAAa,CAAC;AAE5E,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAExD,yFAAyF;AACzF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASvD;AAaD,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,CAiE3E;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,CASrE"}

package/dist/registry/load.js

@@ -0,0 +1,108 @@
+/**
+ * Finding, compiling and evaluating `architecture.config.ts`.
+ *
+ * What this is for: the manifest is TypeScript, so it has to be compiled to be read. It is
+ * compiled with the consumer's own `typescript` (our single peer dependency) — no bundler, no
+ * ts-node, and no temporary file on disk, because a tool that scatters temp files into a repo it
+ * is auditing has already lost the argument.
+ *
+ * How: transpile to CommonJS in memory, then evaluate the result with an injected `require`. The
+ * one specifier a manifest actually needs at run time is `archcheck` itself, and that resolves to
+ * a value we already hold — so the common case needs no module resolution at all, and works
+ * identically under Node and Bun. Anything else the manifest imports goes through Node's own
+ * resolver, rooted at the config file.
+ *
+ * What a caller must know: this executes the config. That is what a config file is for, and it is
+ * the operator's own committed code — but it does mean `load()` is not a safe place to point at an
+ * untrusted file.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join, resolve } from 'node:path';
+import ts from 'typescript';
+import { err, ok } from '../result.js';
+import { missingCompilerApi } from '../util/compilerApi.js';
+import { defineArchitecture } from './define.js';
+export const CONFIG_FILENAME = 'architecture.config.ts';
+/** Walk up from `start` looking for the manifest. Returns its absolute path, or null. */
+export function findConfig(start) {
+    let dir = resolve(start);
+    for (;;) {
+        const candidate = join(dir, CONFIG_FILENAME);
+        if (existsSync(candidate))
+            return candidate;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/** The module we hand back for `import ... from 'archcheck'`, without resolving anything. */
+function archcheckModule() {
+    return { defineArchitecture, default: { defineArchitecture } };
+}
+function isArchcheckSpecifier(specifier) {
+    if (specifier === 'archcheck' || specifier.startsWith('archcheck/'))
+        return true;
+    // archcheck's own manifest reaches its source directly; treat that as the same module.
+    return /(^|\/)src\/index(\.[jt]s)?$/.test(specifier) || /(^|\/)dist\/index\.js$/.test(specifier);
+}
+export function loadManifestFrom(configPath) {
+    const unusable = missingCompilerApi(ts);
+    if (unusable)
+        return err(unusable);
+    let source;
+    try {
+        source = readFileSync(configPath, 'utf8');
+    }
+    catch (error) {
+        return err([`cannot read ${configPath}: ${error.message}`]);
+    }
+    const transpiled = ts.transpileModule(source, {
+        fileName: configPath,
+        reportDiagnostics: true,
+        compilerOptions: {
+            module: ts.ModuleKind.CommonJS,
+            target: ts.ScriptTarget.ES2022,
+            esModuleInterop: true,
+            isolatedModules: true,
+        },
+    });
+    const syntaxErrors = (transpiled.diagnostics ?? []).filter((d) => d.category === ts.DiagnosticCategory.Error);
+    if (syntaxErrors.length > 0) {
+        return err(syntaxErrors.map((d) => `${CONFIG_FILENAME}: ${ts.flattenDiagnosticMessageText(d.messageText, ' ')}`));
+    }
+    const nodeRequire = createRequire(configPath);
+    const requireShim = (specifier) => isArchcheckSpecifier(specifier) ? archcheckModule() : nodeRequire(specifier);
+    const moduleShim = { exports: {} };
+    try {
+        // `new Function` rather than `eval`: the config body gets its own scope with exactly the five
+        // CommonJS bindings it expects and nothing of ours. Compiling the operator's own committed
+        // config is the job of this module, not an escape hatch.
+        const evaluate = new Function('exports', 'require', 'module', '__filename', '__dirname', transpiled.outputText);
+        evaluate(moduleShim.exports, requireShim, moduleShim, configPath, dirname(configPath));
+    }
+    catch (error) {
+        return err([`${CONFIG_FILENAME} threw while loading: ${error.message}`]);
+    }
+    const exported = moduleShim.exports.default ?? moduleShim.exports;
+    if (typeof exported !== 'object' || exported === null) {
+        return err([
+            `${CONFIG_FILENAME} must export a default: export default defineArchitecture({ rules: [...] })`,
+        ]);
+    }
+    const manifest = exported;
+    const root = manifest.root ? resolve(dirname(configPath), manifest.root) : dirname(configPath);
+    return ok({ manifest, configPath, root });
+}
+export function loadManifest(startDir) {
+    const configPath = findConfig(startDir);
+    if (configPath === null) {
+        return err([
+            `no ${CONFIG_FILENAME} found in ${resolve(startDir)} or any parent directory`,
+            '  → create one: export default defineArchitecture({ rules: [] })',
+        ]);
+    }
+    return loadManifestFrom(configPath);
+}
+//# sourceMappingURL=load.js.map

package/dist/registry/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/registry/load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAA6B,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAExD,yFAAyF;AACzF,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACzB,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAS,eAAe;IACtB,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB;IAC7C,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,uFAAuF;IACvF,OAAO,6BAA6B,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACnG,CAAC;AASD,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,QAAQ;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEnC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,CAAC,eAAe,UAAU,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,UAAU,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE;QAC5C,QAAQ,EAAE,UAAU;QACpB,iBAAiB,EAAE,IAAI;QACvB,eAAe,EAAE;YACf,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ;YAC9B,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM;YAC9B,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;SACtB;KACF,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAClD,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,CACR,YAAY,CAAC,GAAG,CACd,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,eAAe,KAAK,EAAE,CAAC,4BAA4B,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CACpF,CACF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAW,EAAE,CACjD,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAE/E,MAAM,UAAU,GAAyC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzE,IAAI,CAAC;QACH,8FAA8F;QAC9F,2FAA2F;QAC3F,yDAAyD;QACzD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC3B,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,UAAU,CAAC,UAAU,CACtB,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACzF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,CAAC,GAAG,eAAe,yBAA0B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;IAClE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,GAAG,CAAC;YACT,GAAG,eAAe,6EAA6E;SAChG,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,QAAgC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/F,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC;YACT,MAAM,eAAe,aAAa,OAAO,CAAC,QAAQ,CAAC,0BAA0B;YAC7E,kEAAkE;SACnE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC;AACtC,CAAC"}

package/dist/registry/validate.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Manifest validation. Total, and it never throws.
+ *
+ * What rule this enforces: a malformed manifest exits 2, never 1 (LLD §6). An agent must be able
+ * to tell "the config is broken" from "the code is broken", or it will spend its turn editing the
+ * wrong file. That means every problem is returned together — one pass, every field named —
+ * rather than thrown one at a time.
+ *
+ * What a caller must know: the per-kind params check is INJECTED, not imported. The registry knows
+ * that a rule has a kind; only the contract type knows what that kind's params mean. Wiring the
+ * two together is the facade's job, which keeps this module testable without any kind at all.
+ */
+import { type Result } from '../result.js';
+import { type Rule } from '../types.js';
+import type { ArchitectureManifest } from './define.js';
+/**
+ * The seam: kind-specific params validation, supplied by the contracts layer. It receives the
+ * whole rule set because one question genuinely needs it — "does this mayImport name a layer that
+ * exists?" — and passing it here rather than closing over it keeps the registry's only entry point
+ * a single call.
+ */
+export type ParamsValidator = (rule: Rule, rules: readonly Rule[]) => Result<void>;
+export declare function validateManifest(manifest: ArchitectureManifest, validateParams: ParamsValidator): Result<ArchitectureManifest>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/registry/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/registry/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAqC,KAAK,IAAI,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,IAAI,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;AAuInF,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,oBAAoB,EAC9B,cAAc,EAAE,eAAe,GAC9B,MAAM,CAAC,oBAAoB,CAAC,CA6C9B"}