archcheck 0.2.0

package/dist/report/types.js

@@ -0,0 +1,11 @@
+/** Deterministic failures first, then proxies, then advisories — ordered by authority. */
+export const CONFIDENCE_ORDER = ['deterministic', 'proxy', 'model'];
+/**
+ * What a reader should see. Baselined and exempted findings are suppressed by their own mechanisms
+ * and counted rather than printed — but they are counted, and the count is always shown, because a
+ * suppression nobody can see is one nobody reviews.
+ */
+export function visible(result, ctx) {
+    return result.diagnostics.filter((d) => d.severity !== 'off' && (ctx.showBaselined === true || (!d.baselined && !d.exempted)));
+}
+//# sourceMappingURL=types.js.map

package/dist/report/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/report/types.ts"],"names":[],"mappings":"AAsBA,0FAA0F;AAC1F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAE7E;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,MAAiB,EAAE,GAAc;IACvD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAC7F,CAAC;AACJ,CAAC"}

package/dist/report/verdict.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The verdict reporter — for a blocking hook.
+ *
+ * What this is for: a pre-commit hook or an agent's pre-write guard needs one question answered,
+ * "may this proceed?", plus enough detail to fix it if not. Prose is the wrong shape for that, and
+ * so is a full RunResult.
+ *
+ * What a caller must know: only ERROR severity blocks. A warn or an advisory finding is reported
+ * and does not block, because a non-deterministic or narrower-than-the-rule check that blocks is
+ * how a check suite loses trust (LLD §1.10).
+ */
+import type { Diagnostic, RunResult } from '../types.js';
+import type { ReportCtx, Reporter } from './types.js';
+export type Verdict = {
+    block: boolean;
+    reason: string;
+    diagnostics: Diagnostic[];
+};
+export declare function verdictFor(result: RunResult, ctx?: ReportCtx): Verdict;
+export declare function createVerdictReporter(): Reporter;
+//# sourceMappingURL=verdict.d.ts.map

package/dist/report/verdict.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../../src/report/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGtD,MAAM,MAAM,OAAO,GAAG;IACpB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B,CAAC;AAEF,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,GAAE,SAAc,GAAG,OAAO,CAqB1E;AAED,wBAAgB,qBAAqB,IAAI,QAAQ,CAOhD"}

package/dist/report/verdict.js

@@ -0,0 +1,31 @@
+import { visible } from './types.js';
+export function verdictFor(result, ctx = {}) {
+    const shown = visible(result, ctx);
+    const blocking = shown.filter((d) => d.severity === 'error');
+    if (blocking.length === 0) {
+        const skipped = result.skipped.length;
+        return {
+            block: false,
+            reason: skipped > 0
+                ? `no blocking violations (${skipped} probe(s) did not run)`
+                : 'no blocking violations',
+            diagnostics: shown,
+        };
+    }
+    const first = blocking[0];
+    const more = blocking.length === 1 ? '' : ` (and ${blocking.length - 1} more)`;
+    return {
+        block: true,
+        reason: `${first?.statement ?? 'a rule was broken'} — ${first?.file ?? ''}${more}`,
+        diagnostics: blocking,
+    };
+}
+export function createVerdictReporter() {
+    return {
+        name: 'verdict',
+        async report(result, ctx) {
+            return `${JSON.stringify(verdictFor(result, ctx))}\n`;
+        },
+    };
+}
+//# sourceMappingURL=verdict.js.map

package/dist/report/verdict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../../src/report/verdict.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAQrC,MAAM,UAAU,UAAU,CAAC,MAAiB,EAAE,MAAiB,EAAE;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACtC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EACJ,OAAO,GAAG,CAAC;gBACT,CAAC,CAAC,2BAA2B,OAAO,wBAAwB;gBAC5D,CAAC,CAAC,wBAAwB;YAC9B,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC;IAC/E,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,GAAG,KAAK,EAAE,SAAS,IAAI,mBAAmB,MAAM,KAAK,EAAE,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE;QAClF,WAAW,EAAE,QAAQ;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,MAAM,CAAC,MAAiB,EAAE,GAAc;YAC5C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/result.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Result for the validation paths that must not throw.
+ *
+ * What rule this enforces: a malformed manifest exits 2, never 1 — which means validation has to
+ * be able to *return* every problem it found rather than throwing on the first. A thrown error
+ * gives an agent one field name; a Result gives it all of them in one pass (LLD §1.6, plan 03).
+ *
+ * What a caller must know: `error` is a list by default, and collecting errors is the point.
+ * Do not reach for exceptions in validate() paths.
+ */
+export type Result<T, E = string[]> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: E;
+};
+export declare function ok<T>(value: T): Result<T, never>;
+export declare function err<E>(error: E): Result<never, E>;
+/** Collect a list of Results into one Result, concatenating every error rather than stopping. */
+export declare function allOk<T>(results: Result<T>[]): Result<T[]>;
+//# sourceMappingURL=result.d.ts.map

package/dist/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../src/result.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAC;AAEvF,wBAAgB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAEhD;AAED,wBAAgB,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAEjD;AAED,iGAAiG;AACjG,wBAAgB,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAQ1D"}

package/dist/result.js

@@ -0,0 +1,19 @@
+export function ok(value) {
+    return { ok: true, value };
+}
+export function err(error) {
+    return { ok: false, error };
+}
+/** Collect a list of Results into one Result, concatenating every error rather than stopping. */
+export function allOk(results) {
+    const values = [];
+    const errors = [];
+    for (const r of results) {
+        if (r.ok)
+            values.push(r.value);
+        else
+            errors.push(...r.error);
+    }
+    return errors.length > 0 ? err(errors) : ok(values);
+}
+//# sourceMappingURL=result.js.map

package/dist/result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.js","sourceRoot":"","sources":["../src/result.ts"],"names":[],"mappings":"AAYA,MAAM,UAAU,EAAE,CAAI,KAAQ;IAC5B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,GAAG,CAAI,KAAQ;IAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,KAAK,CAAI,OAAoB;IAC3C,MAAM,MAAM,GAAQ,EAAE,CAAC;IACvB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;;YAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;AACtD,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,178 @@
+/**
+ * The five types. Everything else in archcheck is a function between them (LLD §2).
+ *
+ * What this is for: the shared kernel. Every layer reads these; this module reads nothing —
+ * not another archcheck module, and not the TypeScript SDK. That is deliberate and enforced by
+ * archcheck's own `kernel` layer, whose `mayImport` list is empty.
+ *
+ * What a caller must know: two fields are computed, never supplied. `identity` is the
+ * normaliser's job (a probe that invents one is wrong), and `schemaVersion` is stamped by
+ * construction. See `src/normalize/`.
+ */
+import type { SchemaVersion } from './version.js';
+/** The closed set of eight. Adding a ninth is a design decision, not a task (LLD §4). */
+export type ContractKind = 'layers' | 'forbidden' | 'encapsulation' | 'naming' | 'required-file' | 'declared-field' | 'banned-syntax' | 'judgement';
+export declare const CONTRACT_KINDS: readonly ContractKind[];
+export type Severity = 'error' | 'warn' | 'advisory' | 'off';
+/**
+ * Severity and confidence are orthogonal. A `model` rule can be `error` in principle — that is
+ * policy, not a type constraint. The default is what stops it; the type does not (plan 02).
+ */
+export type Confidence = 'deterministic' | 'proxy' | 'model';
+export type Remedy = {
+    /** One imperative sentence. Goes into the emitted lint message beside the statement. */
+    summary: string;
+    allowed?: string[];
+    autofix?: boolean;
+    docs?: string;
+};
+/** What the consumer writes, one entry per rule in `architecture.config.ts`. */
+export type Rule = {
+    /** Immutable once committed. Renaming means a new id plus `replaces` (LLD §1.6). */
+    id: string;
+    kind: ContractKind;
+    /** One sentence. This is the text that ends up in the editor squiggle. */
+    statement: string;
+    severity: Severity;
+    confidence: Confidence;
+    /** Kind-specific, validated by the kind's `validate()`. Never read without validating. */
+    params: Record<string, unknown>;
+    remedy: Remedy;
+    /** Set when this rule supersedes a retired id. */
+    replaces?: string;
+    /** Required on an exception (plan 15). */
+    owner?: string;
+    expires?: string;
+};
+/** What a probe returns, before enrichment. Evidence, never prose. */
+export type RawFinding = {
+    ruleId: string;
+    /** Repo-relative POSIX path. */
+    file: string;
+    line?: number;
+    col?: number;
+    endLine?: number;
+    /** The semantic facts: `{ from, to }` for a graph edge, `{ symbol }` for a naming miss. */
+    evidence: Record<string, unknown>;
+    /**
+     * Stable hash — survives line moves. Computed by the normaliser from ruleId + evidence.
+     * A probe leaves this empty; `normalize()` fills it.
+     */
+    identity: string;
+};
+/**
+ * What everything downstream consumes. Diagnostic *extends* RawFinding: the normaliser only
+ * adds, it never rewrites what a probe observed, which keeps probe output auditable against
+ * the diagnostic a person finally reads (plan 02).
+ */
+export type Diagnostic = RawFinding & {
+    schemaVersion: SchemaVersion;
+    statement: string;
+    severity: Severity;
+    confidence: Confidence;
+    remedy: Remedy;
+    /**
+     * The probes that observed this. A list rather than the LLD's single string, because
+     * deduplication by identity legitimately collapses two observations of one violation —
+     * the graph sees the edge, lint sees the statement — and losing the second is losing
+     * evidence (plan 07).
+     */
+    detectedBy: string[];
+    /**
+     * How many raw findings collapsed into this one identity — normally 1. Evidence carries no
+     * position by design, so two empty catches in one file are literally the same evidence and the
+     * same hash (`computeIdentity`, src/normalize/identity.ts); this count is what keeps "one
+     * diagnostic" from being read as "one violation". It lives HERE and not in `evidence` precisely
+     * so the hash is untouched — pinned by 'counting occurrences leaves the identity hash alone' in
+     * src/normalize/normalize.test.ts.
+     *
+     * Optional because a required field would break every existing producer of the agent contract.
+     * Absent means 1; `normalize()` always sets it.
+     */
+    occurrences?: number;
+    /** Where those occurrences are, sorted and de-duplicated. Only the lines a probe reported. */
+    occurrenceLines?: number[];
+    /** Recorded in the baseline as pre-existing debt. Debt, not policy — see `exempted`. */
+    baselined: boolean;
+    /**
+     * Covered by a declared exception: owned, reasoned and expiring. Kept separate from `baselined`
+     * on purpose. A baseline entry is debt nobody has signed for; an exception is a deliberate
+     * permanent allowance somebody has. Conflating them is how debt quietly becomes policy
+     * (plan 14).
+     */
+    exempted: boolean;
+};
+/**
+ * One recorded pre-existing violation. KEYED by identity, never by line — but it also records how
+ * many occurrences that identity stood for, because one identity can cover several violations of
+ * one rule in one file (see `Diagnostic.occurrences`). Without the count, a single entry would
+ * suppress every later occurrence in that file for ever.
+ *
+ * An entry written before this field existed reads as 1, filled in by `readBaseline`
+ * (src/baseline/index.ts), so no existing baseline file is invalidated.
+ */
+export type BaselineEntry = {
+    identity: string;
+    ruleId: string;
+    /** ISO date. For auditing how long a piece of debt has been carried. */
+    addedAt: string;
+    /** How many occurrences this identity covered when it was recorded. At least 1. */
+    occurrences: number;
+    note?: string;
+};
+/** A declared allowance, as the run sees it once today's date is known. */
+export type ExceptionStatus = {
+    ruleId: string;
+    owner: string;
+    expires: string;
+    expired: boolean;
+    /** Negative once expired. */
+    daysLeft: number;
+    reason: string;
+    /** How many findings it actually suppressed this run. Zero means it is doing nothing. */
+    suppressed: number;
+};
+/** Emitted config, grouped by sink. One rule may produce several (LLD §1.2). */
+export type FragmentTarget = 'graph' | 'lint' | 'boundaries' | 'test' | 'exports';
+export type Fragment = {
+    target: FragmentTarget;
+    /** The rule that produced it — the generated header names them all. */
+    ruleId: string;
+    content: unknown;
+};
+export type Coverage = {
+    total: number;
+    deterministic: number;
+    proxy: number;
+    model: number;
+    /**
+     * Rules whose KIND no version of archcheck checks yet. Counted apart from the three tiers on
+     * purpose: the tier a rule declares is a claim by its author, and for an unimplemented kind
+     * archcheck knows that claim is wrong whatever the manifest says. Folding these into
+     * `deterministic` would inflate the one number nobody is supposed to be able to inflate.
+     */
+    unchecked: number;
+};
+/** A probe that did not run. Present even when empty: "clean" must be distinguishable. */
+export type SkipRecord = {
+    probe: string;
+    reason: string;
+};
+export type RunResult = {
+    ok: boolean;
+    diagnostics: Diagnostic[];
+    skipped: SkipRecord[];
+    coverage: Coverage;
+    /**
+     * Baseline entries that no longer reproduce. The ratchet turns ONE WAY: a fixed violation that
+     * is still listed exits 4, because a baseline that only ever grows silently over-suppresses
+     * forever — the failure mode that makes baselines worthless wherever they are used badly.
+     */
+    baselineStale: BaselineEntry[];
+    /**
+     * Every declared exception, always — including the ones suppressing nothing. A silent exception
+     * decays into a permanent one (plan 15).
+     */
+    exceptions: ExceptionStatus[];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,yFAAyF;AACzF,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,WAAW,GACX,eAAe,GACf,QAAQ,GACR,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,WAAW,CAAC;AAEhB,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EASxC,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC;AAE7D;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,OAAO,GAAG,OAAO,CAAC;AAE7D,MAAM,MAAM,MAAM,GAAG;IACnB,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,gFAAgF;AAChF,MAAM,MAAM,IAAI,GAAG;IACjB,oFAAoF;IACpF,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,YAAY,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,0FAA0F;IAC1F,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,sEAAsE;AACtE,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG;IACpC,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,wFAAwF;IACxF,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,2EAA2E;AAC3E,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,gFAAgF;AAChF,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,GAAG,YAAY,GAAG,MAAM,GAAG,SAAS,CAAC;AAElF,MAAM,MAAM,QAAQ,GAAG;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,0FAA0F;AAC1F,MAAM,MAAM,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;OAIG;IACH,aAAa,EAAE,aAAa,EAAE,CAAC;IAC/B;;;OAGG;IACH,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B,CAAC"}

package/dist/types.js

@@ -0,0 +1,11 @@
+export const CONTRACT_KINDS = [
+    'layers',
+    'forbidden',
+    'encapsulation',
+    'naming',
+    'required-file',
+    'declared-field',
+    'banned-syntax',
+    'judgement',
+];
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAwBA,MAAM,CAAC,MAAM,cAAc,GAA4B;IACrD,QAAQ;IACR,WAAW;IACX,eAAe;IACf,QAAQ;IACR,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,WAAW;CACH,CAAC"}

package/dist/util/compilerApi.d.ts

@@ -0,0 +1,2 @@
+export declare function missingCompilerApi(compiler: unknown): string[] | undefined;
+//# sourceMappingURL=compilerApi.d.ts.map

package/dist/util/compilerApi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compilerApi.d.ts","sourceRoot":"","sources":["../../src/util/compilerApi.ts"],"names":[],"mappings":"AAcA,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,CAa1E"}

package/dist/util/compilerApi.js

@@ -0,0 +1,28 @@
+/**
+ * One guard for "is the TypeScript compiler API actually here?".
+ *
+ * Why this exists: archcheck reads the compiler API that TypeScript 5.x exposes from its package
+ * root — `ts.sys`, `ts.createProgram`, `ts.transpileModule`. TypeScript 7 is the native port, and
+ * its root entry exports only `version`; the compiler API moved to a different subpath with a
+ * different shape. A consumer who installs `typescript@7` therefore gets an archcheck that fails
+ * with `Cannot read properties of undefined (reading 'readFile')`, which names nothing useful.
+ *
+ * The peer range now excludes 7, so npm warns at install time. This is the second half: a clear
+ * message at run time, because a peer warning is easy to miss and a lockfile can carry anything.
+ */
+const REQUIRED = ['sys', 'createProgram', 'transpileModule', 'readConfigFile'];
+export function missingCompilerApi(compiler) {
+    const api = compiler;
+    const absent = REQUIRED.filter((name) => api?.[name] === undefined);
+    if (absent.length === 0)
+        return undefined;
+    const version = typeof api?.version === 'string' ? api.version : 'unknown';
+    return [
+        `the installed typescript (${version}) does not expose the compiler API archcheck reads`,
+        `  missing: ${absent.join(', ')}`,
+        '  archcheck needs typescript >=5.4 and <7. TypeScript 7 is the native port, and it exposes',
+        '  a different API from a different subpath.',
+        '  → install a 6.x or 5.x release: npm install -D typescript@^5.9',
+    ];
+}
+//# sourceMappingURL=compilerApi.js.map

package/dist/util/compilerApi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compilerApi.js","sourceRoot":"","sources":["../../src/util/compilerApi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,CAAU,CAAC;AAExF,MAAM,UAAU,kBAAkB,CAAC,QAAiB;IAClD,MAAM,GAAG,GAAG,QAA+C,CAAC;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1C,MAAM,OAAO,GAAG,OAAO,GAAG,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,OAAO;QACL,6BAA6B,OAAO,oDAAoD;QACxF,cAAc,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACjC,4FAA4F;QAC5F,6CAA6C;QAC7C,kEAAkE;KACnE,CAAC;AACJ,CAAC"}

package/dist/util/glob.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The glob matcher used by every `match` and `appliesTo` in a manifest.
+ *
+ * Why ours rather than a dependency: archcheck ships with zero runtime dependencies so that
+ * adopting it cannot drag a transitive tree into a consumer's build. The supported surface is
+ * deliberately small — it is a path matcher, not a shell.
+ *
+ * What a caller must know: patterns are POSIX and repo-relative, matched against paths already
+ * put through `repoRelative()`. Supported:
+ *   *        any run of characters except `/`
+ *   **       zero or more whole path segments (and `a/**` also matches `a` itself)
+ *   ?        exactly one character except `/`
+ *   {a,b}    alternation
+ *   dir/     a trailing slash is that directory and everything under it
+ *   !pat     negation, when a pattern list is matched with `matchesAny`
+ */
+/**
+ * The structural defects in a pattern — empty when it is sound. One sentence per defect, every one
+ * at once, each phrased to follow a field name so a caller can compose "params.appliesTo pattern
+ * 'x' has an empty path segment ...".
+ *
+ * Why it exists: a pattern that matches nothing is indistinguishable from a rule that is satisfied
+ * (AGENTS.md rule 14). `layers.match` fails loudly when it matches nothing — the files become
+ * unlayered — but every other glob in a manifest just stops checking, silently and forever.
+ *
+ * Why it walks the SAME segments as the compiler, through `toSegments` and `segmentToRegex`: a
+ * second, independent parser would drift from `patternToRegexSource` and start approving patterns
+ * the matcher quietly drops. So this reports only what that walk decides structurally, and it is
+ * deliberately silent about whether any file exists — "this matches nothing in THIS repo" needs the
+ * file list and is a warning, not an error.
+ *
+ * Called from the shared pass in `src/registry/validate.ts`, so every rule kind is covered without
+ * opting in. Pinned by the `globProblems` suite in `src/util/glob.test.ts`.
+ */
+export declare function globProblems(pattern: string): string[];
+export declare function globToRegExp(pattern: string): RegExp;
+export declare function matches(pattern: string, path: string): boolean;
+/**
+ * Match against a list. A leading `!` negates, and negations win, so a list like
+ * `['src/**', '!src/test-only']` reads the way a reader expects it to.
+ */
+export declare function matchesAny(patterns: readonly string[], path: string): boolean;
+//# sourceMappingURL=glob.d.ts.map

package/dist/util/glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../../src/util/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAiHH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAsBtD;AAID,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAU7E"}

package/dist/util/glob.js

@@ -0,0 +1,195 @@
+/**
+ * The glob matcher used by every `match` and `appliesTo` in a manifest.
+ *
+ * Why ours rather than a dependency: archcheck ships with zero runtime dependencies so that
+ * adopting it cannot drag a transitive tree into a consumer's build. The supported surface is
+ * deliberately small — it is a path matcher, not a shell.
+ *
+ * What a caller must know: patterns are POSIX and repo-relative, matched against paths already
+ * put through `repoRelative()`. Supported:
+ *   *        any run of characters except `/`
+ *   **       zero or more whole path segments (and `a/**` also matches `a` itself)
+ *   ?        exactly one character except `/`
+ *   {a,b}    alternation
+ *   dir/     a trailing slash is that directory and everything under it
+ *   !pat     negation, when a pattern list is matched with `matchesAny`
+ */
+const SPECIAL = /[.+^${}()|[\]\\]/g;
+/**
+ * One path segment — no slashes. `*`, `?` and `{a,b}` only; `**` is handled a level up, where the
+ * pattern has already been split on `/`.
+ *
+ * ponytail: a brace group containing a slash (`{a/b,c}`) is not supported, because the split
+ * happens first. Nothing in this repo or its fixtures writes one. Upgrade path if that changes:
+ * tokenise before splitting instead of after.
+ *
+ * `problems`, when supplied, collects the structural defects this walk sees — the sink
+ * `globProblems` passes in so that the validator and the compiler are one walk and cannot
+ * disagree. Compilation is unchanged either way: nothing here reads the sink back.
+ */
+function segmentToRegex(pattern, problems) {
+    let out = '';
+    let i = 0;
+    while (i < pattern.length) {
+        const ch = pattern[i];
+        if (ch === '*') {
+            out += '[^/]*';
+            i += 1;
+            continue;
+        }
+        if (ch === '?') {
+            out += '[^/]';
+            i += 1;
+            continue;
+        }
+        if (ch === '{') {
+            const close = pattern.indexOf('}', i);
+            if (close !== -1) {
+                const alts = pattern.slice(i + 1, close).split(',');
+                if (alts.some((a) => a.length === 0)) {
+                    problems?.push(`has an empty alternative in the group '${pattern.slice(i, close + 1)}'`);
+                }
+                out += `(?:${alts.map((a) => segmentToRegex(a, problems)).join('|')})`;
+                i = close + 1;
+                continue;
+            }
+            problems?.push("has an unclosed '{'");
+        }
+        out += ch.replace(SPECIAL, '\\$&');
+        i += 1;
+    }
+    return out;
+}
+/**
+ * Split a pattern into the segments `patternToRegexSource` walks, with the two shapes that would
+ * otherwise compile to an unmatchable regex folded away first. Both folds exist because a pattern
+ * that matches nothing looks exactly like a rule that is satisfied (AGENTS.md rule 14).
+ *
+ * - A trailing slash is TOLERATED rather than rejected, and reads gitignore-style: the directory
+ *   and everything under it. Tolerating it costs one line, matches what every reader of a
+ *   manifest already expects a directory to mean, and a manifest is written by hand — rejecting
+ *   it would need a validation seam that does not exist here yet. So the empty final segment a
+ *   trailing slash produces becomes a globstar, which is already the spelling for "this directory
+ *   and everything beneath it". Without this the regex required a trailing slash, and no
+ *   `repoRelative()` path has one.
+ * - Consecutive globstars collapse to one. Each non-final globstar emits its own mandatory
+ *   separator, so two in a row required a double slash, which no path has either.
+ *
+ * `src/util/glob.test.ts` pins both.
+ */
+function toSegments(pattern) {
+    const raw = pattern.split('/');
+    if (raw.length > 1 && raw[raw.length - 1] === '')
+        raw[raw.length - 1] = '**';
+    return raw.filter((segment, index) => !(segment === '**' && raw[index - 1] === '**'));
+}
+/**
+ * The whole pattern, segment by segment. `**` is the only token that spans segments, and it has
+ * three distinct shapes — getting any of them wrong is silent, because a pattern that matches
+ * nothing looks exactly like a rule that is satisfied:
+ *
+ * - a lone globstar matches everything.
+ * - a globstar as the LAST segment matches its parent directory and anything beneath it.
+ * - a globstar in any other position matches zero or more intervening segments.
+ *
+ * The third shape at the START of a pattern was the one that was broken: it produced a regex
+ * requiring a leading slash, so a leading globstar followed by a filename pattern matched only
+ * top-level files. The model probe's file scan was the caller that found it.
+ *
+ * Repeated globstars and a trailing slash are folded away by `toSegments` before this walk, so
+ * every shape below sees at most one globstar in a row and no empty final segment.
+ */
+function patternToRegexSource(pattern) {
+    const segments = toSegments(pattern);
+    let out = '';
+    let needsSeparator = false;
+    for (const [index, segment] of segments.entries()) {
+        const isLast = index === segments.length - 1;
+        if (segment === '**') {
+            if (isLast) {
+                out += out === '' ? '.*' : '(?:/.*)?';
+            }
+            else {
+                out += out === '' ? '(?:[^/]+/)*' : '(?:/[^/]+)*/';
+                needsSeparator = false;
+            }
+            continue;
+        }
+        if (needsSeparator)
+            out += '/';
+        out += segmentToRegex(segment);
+        needsSeparator = true;
+    }
+    return out;
+}
+/**
+ * The structural defects in a pattern — empty when it is sound. One sentence per defect, every one
+ * at once, each phrased to follow a field name so a caller can compose "params.appliesTo pattern
+ * 'x' has an empty path segment ...".
+ *
+ * Why it exists: a pattern that matches nothing is indistinguishable from a rule that is satisfied
+ * (AGENTS.md rule 14). `layers.match` fails loudly when it matches nothing — the files become
+ * unlayered — but every other glob in a manifest just stops checking, silently and forever.
+ *
+ * Why it walks the SAME segments as the compiler, through `toSegments` and `segmentToRegex`: a
+ * second, independent parser would drift from `patternToRegexSource` and start approving patterns
+ * the matcher quietly drops. So this reports only what that walk decides structurally, and it is
+ * deliberately silent about whether any file exists — "this matches nothing in THIS repo" needs the
+ * file list and is a warning, not an error.
+ *
+ * Called from the shared pass in `src/registry/validate.ts`, so every rule kind is covered without
+ * opting in. Pinned by the `globProblems` suite in `src/util/glob.test.ts`.
+ */
+export function globProblems(pattern) {
+    // A negation is legal in every list form (`matchesAny`), and it is not part of the path.
+    const body = pattern.startsWith('!') ? pattern.slice(1) : pattern;
+    if (body.length === 0)
+        return ['is empty, so it matches nothing'];
+    const problems = [];
+    if (body.startsWith('/')) {
+        problems.push('starts with a separator, but every path it is matched against is repo-relative');
+    }
+    for (const [index, segment] of toSegments(body).entries()) {
+        if (segment === '') {
+            // Index 0 is the leading separator, already named. A trailing separator is folded to a
+            // globstar by `toSegments` and is legal, so any empty segment left here is a doubled one.
+            if (index > 0)
+                problems.push('has an empty path segment, from a doubled separator');
+            continue;
+        }
+        if (segment === '**')
+            continue;
+        segmentToRegex(segment, problems);
+    }
+    return problems;
+}
+const cache = new Map();
+export function globToRegExp(pattern) {
+    const cached = cache.get(pattern);
+    if (cached)
+        return cached;
+    const compiled = new RegExp(`^${patternToRegexSource(pattern)}$`);
+    cache.set(pattern, compiled);
+    return compiled;
+}
+export function matches(pattern, path) {
+    return globToRegExp(pattern).test(path);
+}
+/**
+ * Match against a list. A leading `!` negates, and negations win, so a list like
+ * `['src/**', '!src/test-only']` reads the way a reader expects it to.
+ */
+export function matchesAny(patterns, path) {
+    let hit = false;
+    for (const pattern of patterns) {
+        if (pattern.startsWith('!')) {
+            if (matches(pattern.slice(1), path))
+                return false;
+        }
+        else if (matches(pattern, path)) {
+            hit = true;
+        }
+    }
+    return hit;
+}
+//# sourceMappingURL=glob.js.map

package/dist/util/glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.js","sourceRoot":"","sources":["../../src/util/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAEpC;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,QAAmB;IAC1D,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAW,CAAC;QAChC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,GAAG,IAAI,OAAO,CAAC;YACf,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,GAAG,IAAI,MAAM,CAAC;YACd,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACtC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACpD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;oBACrC,QAAQ,EAAE,IAAI,CAAC,0CAA0C,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC3F,CAAC;gBACD,GAAG,IAAI,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBACvE,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;gBACd,SAAS;YACX,CAAC;YACD,QAAQ,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;QACD,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IAC7E,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,KAAK,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,MAAM,EAAE,CAAC;gBACX,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC;gBACnD,cAAc,GAAG,KAAK,CAAC;YACzB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,cAAc;YAAE,GAAG,IAAI,GAAG,CAAC;QAC/B,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;QAC/B,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,yFAAyF;IACzF,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAClE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAElE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAClG,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,uFAAuF;YACvF,0FAA0F;YAC1F,IAAI,KAAK,GAAG,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;AAExC,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,IAAY;IACnD,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAA2B,EAAE,IAAY;IAClE,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;QACpD,CAAC;aAAM,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAClC,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/util/paths.d.ts

@@ -0,0 +1,6 @@
+/** POSIX separators, always — a generated file must be byte-identical on Windows and macOS. */
+export declare function toPosix(path: string): string;
+/** Repo-relative and POSIX. The canonical form for evidence, findings and generated output. */
+export declare function repoRelative(root: string, path: string): string;
+export declare function absoluteFrom(root: string, path: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/util/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/util/paths.ts"],"names":[],"mappings":"AAUA,+FAA+F;AAC/F,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED,+FAA+F;AAC/F,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/D"}