archcheck 0.2.0

package/dist/cli/args.js

@@ -0,0 +1,233 @@
+/**
+ * Argument parsing, and nothing else.
+ *
+ * What a caller must know: this returns a Result too. An unknown flag is a CONFIG-class mistake —
+ * exit 2, not 1 — because an agent that typed the wrong flag must not read "no violations" as
+ * success.
+ */
+import { execFileSync } from 'node:child_process';
+import { err, ok } from '../result.js';
+const FORMATS = {
+    terminal: 'terminal',
+    json: 'json',
+    'json-pretty': 'json-pretty',
+    sarif: 'sarif',
+    verdict: 'verdict',
+};
+const TIERS = {
+    deterministic: 'deterministic',
+    proxy: 'proxy',
+    model: 'model',
+};
+export const HELP = `archcheck — architecture conformance, declared once and checked everywhere
+
+  archcheck                      run every rule, terminal output
+  archcheck --changed            diff-scoped · the pre-commit path
+  archcheck --format json        the agent format
+  archcheck --format sarif       SARIF 2.1.0, for CI code scanning and editors
+  archcheck --format verdict     one blocking answer, for a hook
+  archcheck --only deterministic skip the proxy and model tiers
+  archcheck --show-baselined     include findings the baseline records
+  archcheck --write-graph        write .archcheck/graph.json for later gates to ingest
+  archcheck --ingest-graph       read .archcheck/graph.json instead of re-reading the graph
+
+  archcheck emit                 regenerate the emitted configs
+  archcheck emit --check         fail if the committed output is stale
+  archcheck explain <ruleId>     statement, remedy and current violations
+  archcheck coverage             the three counts, computed from the manifest
+  archcheck baseline --write     record today's violations as pre-existing debt
+  archcheck baseline --prune     drop entries that no longer reproduce
+  archcheck init                 write a starting architecture.config.ts from the folders
+  archcheck --version
+
+exit codes
+  0  clean, or only baselined and advisory findings
+  1  new violations of error-severity rules      → fix the code
+  2  configuration invalid                       → fix the manifest, not the code
+  3  emitted output is stale                     → run archcheck emit
+  4  a baselined finding no longer reproduces    → run archcheck baseline --prune
+`;
+/**
+ * Ask git for the changed set. Local only — archcheck makes no network call it was not told to.
+ *
+ * A git that cannot answer is a CONFIG failure (exit 2), never an empty changed set. git missing
+ * from PATH, an unborn or detached HEAD, or a directory outside any work tree used to be swallowed
+ * by a bare catch returning `[]`: every probe then filtered to nothing and the run reported clean,
+ * so a pre-commit hook passed every commit forever. Exit 2 because the manifest and the code are
+ * both fine — the environment is not, which is the same call `init` makes when it cannot read the
+ * module graph. `tests/cli.test.ts` → '--changed > git failing is a config error (2)' pins it.
+ */
+export function gitChangedFiles(cwd) {
+    const files = new Set();
+    for (const args of [
+        ['diff', '--name-only', '--diff-filter=ACMR', 'HEAD'],
+        ['diff', '--name-only', '--diff-filter=ACMR', '--cached'],
+        ['ls-files', '--others', '--exclude-standard'],
+    ]) {
+        let output;
+        try {
+            output = execFileSync('git', args, {
+                cwd,
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'pipe'],
+            });
+        }
+        catch (error) {
+            const said = error.stderr;
+            const detail = said === undefined || said.trim() === '' ? describeError(error) : said.trim();
+            return err([
+                `--changed asked git for the changed set, and \`git ${args.join(' ')}\` failed:`,
+                // git answers a misuse with its whole usage screen. The first two lines carry the reason;
+                // the rest would bury the two suggestions below.
+                ...detail
+                    .split('\n')
+                    .filter((line) => line.trim() !== '')
+                    .slice(0, 2)
+                    .map((line) => `  ${line.trim()}`),
+                '  → the environment is wrong, not the code: an empty changed set would check nothing',
+                '  → name the files yourself (--changed a.ts,b.ts), or drop --changed to check everything',
+            ]);
+        }
+        for (const line of output.split('\n')) {
+            const file = line.trim();
+            if (file.length > 0)
+                files.add(file);
+        }
+    }
+    return ok([...files].sort());
+}
+function describeError(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export function parseArgs(argv) {
+    const parsed = {
+        command: 'check',
+        format: 'terminal',
+        emitCheck: false,
+        force: false,
+        showBaselined: false,
+        ingestGraph: false,
+        writeGraph: false,
+        noColor: false,
+    };
+    const errors = [];
+    const rest = [...argv];
+    let sawCommand = false;
+    // The subcommand is recognised WHEREVER it appears, not only at argv[0]. `--cwd x baseline
+    // --write` is a perfectly natural thing to type, and a parser that silently rejected it read
+    // as "unexpected argument 'baseline'" — which names the wrong thing.
+    const COMMANDS = new Set(['check', 'emit', 'explain', 'coverage', 'baseline', 'init']);
+    while (rest.length > 0) {
+        const arg = rest.shift();
+        const [flag, inlineValue] = arg.startsWith('--') && arg.includes('=')
+            ? [arg.slice(0, arg.indexOf('=')), arg.slice(arg.indexOf('=') + 1)]
+            : [arg, undefined];
+        const takeValue = () => inlineValue ?? (rest[0]?.startsWith('-') === false ? rest.shift() : undefined);
+        switch (flag) {
+            case '--version':
+            case '-v':
+                parsed.command = 'version';
+                break;
+            case '--help':
+            case '-h':
+                parsed.command = 'help';
+                break;
+            case '--format': {
+                const value = takeValue();
+                const format = value === undefined ? undefined : FORMATS[value];
+                if (format === undefined) {
+                    errors.push(`--format expects one of ${Object.keys(FORMATS).join(', ')} (got ${String(value)})`);
+                }
+                else {
+                    parsed.format = format;
+                }
+                break;
+            }
+            case '--only': {
+                const value = takeValue();
+                const tier = value === undefined ? undefined : TIERS[value];
+                if (tier === undefined) {
+                    errors.push(`--only expects one of ${Object.keys(TIERS).join(', ')} (got ${String(value)})`);
+                }
+                else {
+                    parsed.only = tier;
+                }
+                break;
+            }
+            case '--changed': {
+                const value = takeValue();
+                parsed.changed =
+                    value === undefined
+                        ? []
+                        : value
+                            .split(',')
+                            .map((f) => f.trim())
+                            .filter(Boolean);
+                break;
+            }
+            case '--check':
+                parsed.emitCheck = true;
+                break;
+            case '--write':
+                parsed.baselineMode = 'write';
+                break;
+            case '--prune':
+                parsed.baselineMode = 'prune';
+                break;
+            case '--force':
+                parsed.force = true;
+                break;
+            case '--show-baselined':
+                parsed.showBaselined = true;
+                break;
+            case '--ingest-graph':
+                parsed.ingestGraph = true;
+                break;
+            case '--write-graph':
+                parsed.writeGraph = true;
+                break;
+            case '--no-color':
+                parsed.noColor = true;
+                break;
+            case '--cwd': {
+                const value = takeValue();
+                if (value === undefined)
+                    errors.push('--cwd expects a directory');
+                else
+                    parsed.cwd = value;
+                break;
+            }
+            default:
+                if (flag.startsWith('-'))
+                    errors.push(`unknown flag '${flag}' — see archcheck --help`);
+                else if (COMMANDS.has(flag) && !sawCommand) {
+                    parsed.command = flag;
+                    sawCommand = true;
+                }
+                else if (parsed.command === 'explain' && parsed.ruleId === undefined)
+                    parsed.ruleId = flag;
+                else
+                    errors.push(`unexpected argument '${flag}'`);
+        }
+    }
+    if (parsed.command === 'explain' && parsed.ruleId === undefined) {
+        errors.push('explain needs a rule id: archcheck explain <ruleId>');
+    }
+    if (parsed.emitCheck && parsed.command !== 'emit') {
+        errors.push('--check applies to `archcheck emit` only');
+    }
+    if (parsed.baselineMode !== undefined && parsed.command !== 'baseline') {
+        errors.push('--write and --prune apply to `archcheck baseline` only');
+    }
+    if (parsed.force && parsed.command !== 'init') {
+        errors.push('--force applies to `archcheck init` only');
+    }
+    if (parsed.command === 'baseline' && parsed.baselineMode === undefined) {
+        errors.push("baseline needs a mode: --write to record today's violations, --prune to drop what no longer reproduces");
+    }
+    if (parsed.writeGraph && parsed.ingestGraph) {
+        errors.push('--write-graph and --ingest-graph are mutually exclusive: one produces the report the other consumes');
+    }
+    return errors.length > 0 ? err(errors) : ok(parsed);
+}
+//# sourceMappingURL=args.js.map

package/dist/cli/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,cAAc,CAAC;AAgCpD,MAAM,OAAO,GAAiC;IAC5C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,aAAa,EAAE,aAAa;IAC5B,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;CACnB,CAAC;AAEF,MAAM,KAAK,GAA+B;IACxC,aAAa,EAAE,eAAe;IAC9B,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BnB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI;QACjB,CAAC,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,CAAC;QACrD,CAAC,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,UAAU,CAAC;QACzD,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC;KAC/C,EAAE,CAAC;QACF,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;gBACjC,GAAG;gBACH,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA6B,CAAC,MAAM,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7F,OAAO,GAAG,CAAC;gBACT,sDAAsD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY;gBAChF,0FAA0F;gBAC1F,iDAAiD;gBACjD,GAAG,MAAM;qBACN,KAAK,CAAC,IAAI,CAAC;qBACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;qBACpC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;qBACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBACpC,sFAAsF;gBACtF,0FAA0F;aAC3F,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,MAAM,GAAe;QACzB,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,KAAK;QACpB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,KAAK;KACf,CAAC;IACF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,2FAA2F;IAC3F,6FAA6F;IAC7F,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAEvF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAY,CAAC;QACnC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,GACvB,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YACvC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,GAAuB,EAAE,CACzC,WAAW,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAEjF,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,WAAW,CAAC;YACjB,KAAK,IAAI;gBACP,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC;gBAC3B,MAAM;YACR,KAAK,QAAQ,CAAC;YACd,KAAK,IAAI;gBACP,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;gBACxB,MAAM;YACR,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAChE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CACT,2BAA2B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,KAAK,CAAC,GAAG,CACpF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;gBACzB,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC5D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,MAAM,CAAC,IAAI,CACT,yBAAyB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,KAAK,CAAC,GAAG,CAChF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;gBACrB,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;gBAC1B,MAAM,CAAC,OAAO;oBACZ,KAAK,KAAK,SAAS;wBACjB,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,KAAK;6BACF,KAAK,CAAC,GAAG,CAAC;6BACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;6BACpB,MAAM,CAAC,OAAO,CAAC,CAAC;gBACzB,MAAM;YACR,CAAC;YACD,KAAK,SAAS;gBACZ,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;gBACxB,MAAM;YACR,KAAK,SAAS;gBACZ,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC;gBAC9B,MAAM;YACR,KAAK,SAAS;gBACZ,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC;gBAC9B,MAAM;YACR,KAAK,SAAS;gBACZ,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,KAAK,kBAAkB;gBACrB,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC5B,MAAM;YACR,KAAK,gBAAgB;gBACnB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;gBAC1B,MAAM;YACR,KAAK,eAAe;gBAClB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;gBACzB,MAAM;YACR,KAAK,YAAY;gBACf,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;;oBAC7D,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;gBACxB,MAAM;YACR,CAAC;YACD;gBACE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,0BAA0B,CAAC,CAAC;qBAClF,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC3C,MAAM,CAAC,OAAO,GAAG,IAAe,CAAC;oBACjC,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;qBAAM,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;oBACpE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;;oBAClB,MAAM,CAAC,IAAI,CAAC,wBAAwB,IAAI,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvE,MAAM,CAAC,IAAI,CACT,wGAAwG,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CACT,qGAAqG,CACtG,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;AACtD,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { type ExitCode } from '../archcheck.js';
+export declare function main(argv: readonly string[]): Promise<ExitCode>;
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAYA,OAAO,EAIL,KAAK,QAAQ,EAId,MAAM,iBAAiB,CAAC;AAgLzB,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0BrE"}

package/dist/cli/index.js

@@ -0,0 +1,219 @@
+#!/usr/bin/env node
+/**
+ * The command surface. Thin by construction: parse args → one ArchCheck method → a reporter.
+ *
+ * What rule this enforces: this file owns NO behaviour. Every capability is reachable through
+ * `ArchCheck`, because the agent hook does not shell out (plan 10). A feature that only works from
+ * here would be a feature an agent cannot use.
+ *
+ * This is an app entry point — the one place allowed to write to the console (PROD-1).
+ */
+import { existsSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { buildInitManifest, CONFIG_FILENAME, EXIT, exitCodeFor, initSummary, load, } from '../archcheck.js';
+import { automatablePercent, MARK } from '../coverage/index.js';
+import { describeUnimplemented } from '../emit/index.js';
+import { describeStale } from '../emit/write.js';
+import { reporterFor } from '../report/index.js';
+import { gitChangedFiles, HELP, parseArgs } from './args.js';
+import { packageVersion } from './version.js';
+function fail(lines, code) {
+    for (const line of lines)
+        console.error(line);
+    return code;
+}
+async function runCheck(args, cwd) {
+    const loaded = load({ cwd });
+    if (!loaded.ok)
+        return fail(loaded.error, EXIT.config);
+    // Load-time warnings first: a judgement rule promoted to `error` is legal, and it must not be
+    // possible to promote one quietly.
+    for (const warning of loaded.value.registry.warnings())
+        console.error(`warning: ${warning}`);
+    // `--changed` with no value means "ask git". A git that cannot answer is a failure, never an
+    // empty changed set: every probe would filter to nothing and the run would read as clean
+    // (gitChangedFiles, src/cli/args.ts).
+    let changed = args.changed;
+    if (args.changed?.length === 0) {
+        const asked = gitChangedFiles(cwd);
+        if (!asked.ok)
+            return fail(asked.error, EXIT.config);
+        changed = asked.value;
+    }
+    const result = await loaded.value.check({
+        ...(changed === undefined ? {} : { changed }),
+        ...(args.only === undefined ? {} : { only: args.only }),
+        ingestGraph: args.ingestGraph,
+        writeGraph: args.writeGraph,
+    });
+    if (!result.ok)
+        return fail(result.error, EXIT.config);
+    const text = await reporterFor(args.format).report(result.value, {
+        showBaselined: args.showBaselined,
+        noColor: args.noColor || process.env.NO_COLOR !== undefined || !process.stdout.isTTY,
+        root: cwd,
+    });
+    if (typeof text === 'string')
+        process.stdout.write(text);
+    return exitCodeFor(result.value);
+}
+async function runEmit(args, cwd) {
+    // `emit` is the command that WRITES the id ledger, so it must be able to run while the ledger
+    // and the manifest disagree — otherwise recording a new id would require the record to exist.
+    const loaded = load({ cwd, skipIdCheck: args.emitCheck === false });
+    if (!loaded.ok)
+        return fail(loaded.error, EXIT.config);
+    // Skipping the immutability check is not the same as accepting a ledger nobody could read:
+    // `emit` WRITES the ledger, so it would replace it with one rebuilt from today's manifest and
+    // every retired id would vanish. `readIdLedger` (src/registry/ids.ts) marks it.
+    const ledger = loaded.value.registry.ledger();
+    if (ledger.unreadable !== undefined)
+        return fail([ledger.unreadable], EXIT.config);
+    // A kind no contract type implements generates nothing. `emit` has no `skipped` channel, so
+    // this is the one place it is said — on both the write and the --check path.
+    for (const line of describeUnimplemented(loaded.value.registry.all()))
+        console.error(line);
+    if (args.emitCheck) {
+        const stale = loaded.value.emitCheck();
+        if (!stale.ok)
+            return fail(stale.error, EXIT.config);
+        if (stale.value.length === 0) {
+            console.log('emitted output is up to date');
+            return EXIT.clean;
+        }
+        return fail([
+            'emitted output is stale:',
+            ...describeStale(stale.value).map((line) => `  ${line}`),
+            // `unreadable` is the one reason re-emitting cannot fix — the document `docs` names is not
+            // there — so an agent is not sent round a loop that changes nothing.
+            ...(stale.value.some((file) => file.reason !== 'unreadable')
+                ? ['  → run: npx archcheck emit']
+                : []),
+        ], EXIT.stale);
+    }
+    const emitted = loaded.value.emit();
+    if (!emitted.ok)
+        return fail(emitted.error, EXIT.config);
+    const changed = emitted.value.written.filter((file) => file.changed);
+    if (changed.length === 0)
+        console.log('emitted output already matched the manifest');
+    for (const file of changed)
+        console.log(`wrote ${file.path}`);
+    console.log(`wrote ${emitted.value.ledgerPath}`);
+    return EXIT.clean;
+}
+function runInit(args, cwd) {
+    const configPath = join(cwd, CONFIG_FILENAME);
+    if (existsSync(configPath) && !args.force) {
+        return fail([
+            `${CONFIG_FILENAME} already exists — archcheck init will not overwrite your manifest`,
+            '  → pass --force if you really mean to replace it',
+        ], EXIT.config);
+    }
+    const built = buildInitManifest(cwd, join(cwd, 'tsconfig.json'));
+    if (!built.ok)
+        return fail(built.error, EXIT.config);
+    writeFileSync(configPath, built.value.manifest);
+    for (const line of initSummary(cwd, built.value.layers))
+        console.log(line);
+    console.log('');
+    if (!built.value.observed) {
+        // Never silent. Without the graph every allow-list is empty, so the manifest names the layers
+        // and describes nothing about how they depend on each other.
+        for (const line of built.value.notObservedBecause ?? [])
+            console.error(`warning: ${line}`);
+        console.error('');
+        console.error(`wrote ${CONFIG_FILENAME}, but archcheck could not read your module graph, so every ` +
+            'mayImport list is EMPTY.');
+        console.error('  → fix the problem above, delete the file, and run `archcheck init --force`');
+        return EXIT.config;
+    }
+    console.log(`wrote ${CONFIG_FILENAME} — every rule is 'warn', so the first run is green`);
+    console.log('  next: npx archcheck          see what it observes');
+    console.log('        npx archcheck emit     write the generated configs');
+    return EXIT.clean;
+}
+async function runBaseline(args, cwd) {
+    const loaded = load({ cwd });
+    if (!loaded.ok)
+        return fail(loaded.error, EXIT.config);
+    const outcome = await loaded.value.baseline(args.baselineMode ?? 'write');
+    if (!outcome.ok)
+        return fail(outcome.error, EXIT.config);
+    const { path, entries, removed, reduced } = outcome.value;
+    // Both halves of the ratchet, on one line: a prune that drops nothing and only lowers a recorded
+    // count has still tightened it, and `removed` alone reported that as having done nothing
+    // (`BaselineOutcome.reduced`, src/archcheck.ts).
+    console.log(args.baselineMode === 'prune'
+        ? `pruned ${removed} entr${removed === 1 ? 'y' : 'ies'}, reduced ${reduced} ` +
+            `count${reduced === 1 ? '' : 's'} — ${entries} remaining in ${path}`
+        : `recorded ${entries} entr${entries === 1 ? 'y' : 'ies'} in ${path}`);
+    if (args.baselineMode === 'write' && entries > 0) {
+        console.log('  these are debt, not policy: no owner and no expiry, so they stay visible');
+    }
+    return EXIT.clean;
+}
+async function runExplain(args, cwd) {
+    const loaded = load({ cwd });
+    if (!loaded.ok)
+        return fail(loaded.error, EXIT.config);
+    const explained = await loaded.value.explain(args.ruleId ?? '');
+    if (!explained.ok)
+        return fail(explained.error, EXIT.config);
+    console.log(explained.value);
+    return EXIT.clean;
+}
+function runCoverage(cwd) {
+    const loaded = load({ cwd });
+    if (!loaded.ok)
+        return fail(loaded.error, EXIT.config);
+    const coverage = loaded.value.coverage();
+    const { total, deterministic, proxy, model, unchecked } = coverage;
+    console.log(`${MARK.deterministic} ${deterministic} deterministic`);
+    console.log(`${MARK.proxy} ${proxy} proxy`);
+    console.log(`${MARK.model} ${model} judgement`);
+    if (unchecked > 0) {
+        console.log(`  ${unchecked} declared, but no version of archcheck checks their kind yet`);
+    }
+    console.log(`  ${total} rules total · ${automatablePercent(coverage)}% automatable`);
+    return EXIT.clean;
+}
+export async function main(argv) {
+    const parsed = parseArgs(argv);
+    if (!parsed.ok)
+        return fail([...parsed.error, '', 'see archcheck --help'], EXIT.config);
+    const args = parsed.value;
+    const cwd = args.cwd ?? process.cwd();
+    switch (args.command) {
+        case 'version':
+            console.log(packageVersion());
+            return EXIT.clean;
+        case 'help':
+            console.log(HELP);
+            return EXIT.clean;
+        case 'emit':
+            return runEmit(args, cwd);
+        case 'explain':
+            return runExplain(args, cwd);
+        case 'coverage':
+            return runCoverage(cwd);
+        case 'baseline':
+            return runBaseline(args, cwd);
+        case 'init':
+            return runInit(args, cwd);
+        case 'check':
+            return runCheck(args, cwd);
+    }
+}
+// This module IS the bin, and nothing imports it, so it runs unconditionally. It previously
+// guarded on `process.argv[1]` ending in `cli/index.js` — which is false when npm installs the
+// package, because argv[1] is then the `node_modules/.bin/archcheck` symlink. The CLI silently
+// did nothing and exited 0, so a consumer read "clean" from a check that never ran. A guard that
+// can be wrong about whether to run at all has no place in an entry point.
+main(process.argv.slice(2))
+    .then((code) => process.exit(code))
+    .catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(EXIT.config);
+});
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,IAAI,EAEJ,WAAW,EACX,WAAW,EACX,IAAI,GACL,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,IAAI,EAAmB,SAAS,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,SAAS,IAAI,CAAC,KAAwB,EAAE,IAAc;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB,EAAE,GAAW;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAEvD,8FAA8F;IAC9F,mCAAmC;IACnC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;QAAE,OAAO,CAAC,KAAK,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC;IAE7F,6FAA6F;IAC7F,yFAAyF;IACzF,sCAAsC;IACtC,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC3B,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;IACxB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QACtC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACvD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAEvD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;QAC/D,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;QACpF,IAAI,EAAE,GAAG;KACV,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,GAAW;IAClD,8FAA8F;IAC9F,8FAA8F;IAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAEvD,2FAA2F;IAC3F,8FAA8F;IAC9F,gFAAgF;IAChF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC9C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAEnF,4FAA4F;IAC5F,6EAA6E;IAC7E,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE3F,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,OAAO,IAAI,CACT;YACE,0BAA0B;YAC1B,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YACxD,2FAA2F;YAC3F,qEAAqE;YACrE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC;gBAC1D,CAAC,CAAC,CAAC,6BAA6B,CAAC;gBACjC,CAAC,CAAC,EAAE,CAAC;SACR,EACD,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;IACrF,KAAK,MAAM,IAAI,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,SAAS,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,IAAgB,EAAE,GAAW;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1C,OAAO,IAAI,CACT;YACE,GAAG,eAAe,mEAAmE;YACrF,mDAAmD;SACpD,EACD,IAAI,CAAC,MAAM,CACZ,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAErD,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC1B,8FAA8F;QAC9F,6DAA6D;QAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE;YAAE,OAAO,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CACX,SAAS,eAAe,6DAA6D;YACnF,0BAA0B,CAC7B,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,SAAS,eAAe,oDAAoD,CAAC,CAAC;IAC1F,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,GAAW;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC;IAC1E,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;IAC1D,iGAAiG;IACjG,yFAAyF;IACzF,iDAAiD;IACjD,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,YAAY,KAAK,OAAO;QAC3B,CAAC,CAAC,UAAU,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,aAAa,OAAO,GAAG;YACzE,QAAQ,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,OAAO,iBAAiB,IAAI,EAAE;QACxE,CAAC,CAAC,YAAY,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,EAAE,CACxE,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,KAAK,OAAO,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAgB,EAAE,GAAW;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IACzC,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,aAAa,IAAI,aAAa,gBAAgB,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,YAAY,CAAC,CAAC;IAChD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,8DAA8D,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,kBAAkB,kBAAkB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAuB;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,sBAAsB,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEtC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,KAAK,UAAU;YACb,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,KAAK,UAAU;YACb,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChC,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,+FAA+F;AAC/F,+FAA+F;AAC/F,iGAAiG;AACjG,2EAA2E;AAC3E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KACxB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAClC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IACxB,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC,CAAC,CAAC"}

package/dist/cli/version.d.ts

@@ -0,0 +1,2 @@
+export declare function packageVersion(): string;
+//# sourceMappingURL=version.d.ts.map

package/dist/cli/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../src/cli/version.ts"],"names":[],"mappings":"AAWA,wBAAgB,cAAc,IAAI,MAAM,CAkBvC"}

package/dist/cli/version.js

@@ -0,0 +1,29 @@
+/**
+ * The package version, read from package.json at run time.
+ *
+ * Why read rather than inline: an inlined version drifts from the manifest the first time
+ * someone bumps one and not the other, and `archcheck --version` is the field a bug report
+ * quotes. `node:` builtins only — src/ stays Node-compatible.
+ */
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export function packageVersion() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    // src/cli/ in development, dist/cli/ once built — package.json is two levels up from both.
+    for (const candidate of [
+        join(here, '..', '..', 'package.json'),
+        join(here, '..', 'package.json'),
+    ]) {
+        try {
+            const raw = JSON.parse(readFileSync(candidate, 'utf8'));
+            if (raw.name === 'archcheck' && typeof raw.version === 'string')
+                return raw.version;
+        }
+        catch {
+            // try the next candidate — a missing package.json here is not an error yet
+        }
+    }
+    return '0.0.0-unknown';
+}
+//# sourceMappingURL=version.js.map

package/dist/cli/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/cli/version.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,2FAA2F;IAC3F,KAAK,MAAM,SAAS,IAAI;QACtB,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC;KACjC,EAAE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAGrD,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/contracts/banned-syntax.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The `banned-syntax` kind. Constructs that are wrong wherever they appear in a given scope.
+ *
+ * What rule this enforces, and why the selector is a CLOSED SET rather than a selector language:
+ * the six rule families this kind exists for are
+ *   no clock in a pure rule, no computed dynamic import, no console outside an entry point,
+ *   no inline suppression comment, no branching on a literal name, no empty catch.
+ * Each is one named construct. A CSS-ish selector string would have to be parsed, would be
+ * half-implemented for years, and would let a manifest declare a selector that silently matches
+ * nothing — which looks exactly like compliance. A closed enum cannot do that: an unknown
+ * construct fails validation and exits 2.
+ *
+ * The inline-suppression ban is self-referential and deliberate. Exceptions live in the manifest
+ * with an owner and an expiry (plan 15); making the inline escape hatch itself a violation is what
+ * stops the manifest being bypassed.
+ *
+ * What a caller must know: these are evaluated over OUR OWN AST. We already hold the program from
+ * the graph reader, so a second parse would be waste. `remedy.autofix` stays false.
+ */
+import ts from 'typescript';
+import type { Edge } from '../graph/types.js';
+import type { Rule } from '../types.js';
+import type { ContractType } from './types.js';
+/** The closed set. Adding one is a deliberate change with a fixture, not a config value. */
+export declare const BANNED_CONSTRUCTS: readonly ["member-access", "new-expression", "computed-dynamic-import", "suppression-comment", "string-literal-comparison", "empty-catch"];
+export type BannedConstruct = (typeof BANNED_CONSTRUCTS)[number];
+export type BannedSyntaxParams = {
+    appliesTo: string | string[];
+    selector: BannedConstruct;
+    /** The dotted name to ban, e.g. `Date.now` or `console`. Required by some constructs. */
+    target?: string;
+};
+export declare function asBannedSyntaxParams(rule: Rule): BannedSyntaxParams;
+export declare function bannedSyntaxApplies(params: BannedSyntaxParams, relativePath: string): boolean;
+export type BannedOccurrence = {
+    line: number;
+    col: number;
+    snippet: string;
+};
+/**
+ * Occurrences of the banned construct in one file.
+ *
+ * `computedImports` comes from the graph reader, which already detects a computed dynamic import —
+ * re-detecting it here would be a second implementation of the one thing that is hard to get right.
+ */
+export declare function findBannedOccurrences(params: BannedSyntaxParams, source: ts.SourceFile | undefined, computedImports: readonly Edge[]): BannedOccurrence[];
+export declare const bannedSyntaxContract: ContractType;
+//# sourceMappingURL=banned-syntax.d.ts.map

package/dist/contracts/banned-syntax.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"banned-syntax.d.ts","sourceRoot":"","sources":["../../src/contracts/banned-syntax.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE9C,OAAO,KAAK,EAAwB,IAAI,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAgD,MAAM,YAAY,CAAC;AAE7F,4FAA4F;AAC5F,eAAO,MAAM,iBAAiB,4IAOpB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAKjE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,QAAQ,EAAE,eAAe,CAAC;IAC1B,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,GAAG,kBAAkB,CAEnE;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAG7F;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AA0G9E;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,EAAE,CAAC,UAAU,GAAG,SAAS,EACjC,eAAe,EAAE,SAAS,IAAI,EAAE,GAC/B,gBAAgB,EAAE,CAepB;AA6DD,eAAO,MAAM,oBAAoB,EAAE,YAMlC,CAAC"}