archcheck 0.2.0

package/dist/index.js

@@ -0,0 +1,20 @@
+/**
+ * archcheck's public surface.
+ *
+ * What a caller must know: this is what `import ... from 'archcheck'` gets. Explicit named exports
+ * only — never `export *`, so a dead-code pass can find a symbol nobody consumes. Nothing here has
+ * behaviour of its own; it re-exports the facade and the types an agent needs to read a RunResult.
+ */
+export { buildInitManifest, CONFIG_FILENAME, describeViolations, EXIT, exitCodeFor, inferLayers, initSummary, load, renderManifest, } from './archcheck.js';
+export { BASELINE_PATH, identitiesOf, readBaseline, } from './baseline/index.js';
+export { implementedKinds, } from './contracts/index.js';
+export { automatablePercent, FENCE_BEGIN, FENCE_END, MARK, RULES_JSON, renderRulesTable, replaceFencedRegion, rulesDocument, } from './coverage/index.js';
+export { applyExceptions, todayIso, validateExceptions, } from './exceptions/index.js';
+export { createMemoryFileSystem, createNodeFileSystem, } from './fs/index.js';
+export { createModelProbe, DEFAULT_BUDGET, DEFAULT_MODEL, } from './probes/model/index.js';
+export { defineArchitecture } from './registry/define.js';
+export { reporterFor, reporterNames, verdictFor, } from './report/index.js';
+export { allOk, err, ok } from './result.js';
+export { CONTRACT_KINDS, } from './types.js';
+export { SCHEMA_VERSION } from './version.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAGL,iBAAiB,EAEjB,eAAe,EACf,kBAAkB,EAElB,IAAI,EAEJ,WAAW,EACX,WAAW,EACX,WAAW,EAEX,IAAI,EACJ,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EAEb,YAAY,EACZ,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAIL,gBAAgB,GAGjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,SAAS,EACT,IAAI,EACJ,UAAU,EAGV,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,eAAe,EACf,QAAQ,EACR,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GAErB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,gBAAgB,EAChB,cAAc,EACd,aAAa,GAKd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAA6B,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,EAKL,WAAW,EACX,aAAa,EAEb,UAAU,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,aAAa,CAAC;AAC1D,OAAO,EAEL,cAAc,GAcf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAsB,MAAM,cAAc,CAAC"}

package/dist/init/index.d.ts

@@ -0,0 +1,23 @@
+import { type Result } from '../result.js';
+type CandidateLayer = {
+    name: string;
+    match: string;
+};
+export declare function inferLayers(root: string): CandidateLayer[];
+export declare function renderManifest(layers: readonly CandidateLayer[], mayImport: ReadonlyMap<string, readonly string[]>): string;
+export type InitResult = {
+    manifest: string;
+    layers: readonly CandidateLayer[];
+    /**
+     * Whether the module graph could be read. When it could not, every `mayImport` is empty and the
+     * manifest describes nothing — the caller MUST say so. An init that quietly produces an empty
+     * allow-list looks like a working manifest and is not one.
+     */
+    observed: boolean;
+    /** Why the graph could not be read. Present only when `observed` is false. */
+    notObservedBecause?: string[];
+};
+export declare function buildInitManifest(root: string, tsconfigPath: string): Result<InitResult>;
+export declare function initSummary(root: string, layers: readonly CandidateLayer[]): string[];
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/init/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/init/index.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAkCpD,KAAK,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CAgB1D;AAcD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GAChD,MAAM,CA6FR;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAkCxF;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,EAAE,CAKrF"}

package/dist/init/index.js

@@ -0,0 +1,218 @@
+/**
+ * `archcheck init` — write a starting manifest from the folder structure.
+ *
+ * This lives in its own layer rather than in `src/cli/`, because the CLI owns no behaviour: every
+ * capability has to be reachable programmatically, since the agent hook does not shell out.
+ * archcheck's own self-host run caught it sitting in the wrong place.
+ *
+ * Why this arrives last and not first: on a greenfield repository inference has nothing to read.
+ * By now archcheck has a graph reader, so it can infer the layers a codebase ALREADY has and the
+ * imports it ALREADY makes — which is a starting point somebody can tighten, rather than a blank
+ * file (plan 23).
+ *
+ * Two deliberate properties of the output:
+ *
+ *   EVERY RULE IS `warn`. Day one is green. Nothing about this file is a claim that the code is
+ *   correct — it is a description of what the code currently does, and the work is promoting rules
+ *   to `error` one at a time, each with a fixture.
+ *
+ *   `mayImport` DESCRIBES, it does not prescribe. It lists the layers each layer imports today. A
+ *   generated manifest that forbade everything would produce hundreds of findings on the first run
+ *   and be deleted the same afternoon.
+ */
+import { readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { readGraph } from '../graph/index.js';
+import { err, ok } from '../result.js';
+import { repoRelative, toPosix } from '../util/paths.js';
+const IGNORED = new Set(['node_modules', '.git', 'dist', 'generated', '.archcheck', 'fixtures']);
+/** Directories that look like source roots, in the order a reader would expect. */
+function sourceRoots(root) {
+    const candidates = ['src', 'packages', 'modules', 'apps', 'lib'];
+    return candidates.filter((name) => {
+        try {
+            return statSync(join(root, name)).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    });
+}
+function subdirectories(root, relative) {
+    try {
+        return readdirSync(join(root, relative))
+            .filter((name) => !IGNORED.has(name))
+            .filter((name) => {
+            try {
+                return statSync(join(root, relative, name)).isDirectory();
+            }
+            catch {
+                return false;
+            }
+        })
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+export function inferLayers(root) {
+    const roots = sourceRoots(root);
+    if (roots.length === 0)
+        return [];
+    const layers = [];
+    for (const sourceRoot of roots) {
+        const children = subdirectories(root, sourceRoot);
+        if (children.length === 0) {
+            layers.push({ name: sourceRoot, match: `${sourceRoot}/**` });
+            continue;
+        }
+        for (const child of children) {
+            layers.push({ name: child, match: `${sourceRoot}/${child}/**` });
+        }
+    }
+    return layers;
+}
+function layerOfPath(layers, relative) {
+    // Longest prefix wins, so a nested folder is attributed to the most specific layer.
+    let best;
+    for (const layer of layers) {
+        const prefix = layer.match.replace(/\*\*$/, '');
+        if (relative.startsWith(prefix) && (best === undefined || prefix.length > best.length)) {
+            best = { name: layer.name, length: prefix.length };
+        }
+    }
+    return best?.name;
+}
+export function renderManifest(layers, mayImport) {
+    const entries = layers.map((layer, index) => {
+        const allowed = [...(mayImport.get(layer.name) ?? [])].sort();
+        const allowedText = allowed.length === 0 ? '[]' : `[${allowed.map((n) => `'${n}'`).join(', ')}]`;
+        return [
+            '    {',
+            `      id: '${layer.name}-imports-only-what-it-declares',`,
+            "      kind: 'layers',",
+            `      statement: '${layer.name} imports only what it declares',`,
+            "      // Generated as 'warn'. Promote to 'error' one rule at a time, each with a fixture.",
+            "      severity: 'warn',",
+            "      confidence: 'deterministic',",
+            '      params: {',
+            `        name: '${layer.name}',`,
+            `        match: '${layer.match}',`,
+            `        // Observed, not prescribed: this is what ${layer.name} imports today. Remove an`,
+            '        // entry to tighten the rule, then fix what it finds.',
+            `        mayImport: ${allowedText},`,
+            ...(index === 0
+                ? [
+                    '        // Exactly one layers rule owns the unlayered-file report.',
+                    '        catchesUnlayered: true,',
+                ]
+                : []),
+            '      },',
+            `      remedy: { summary: 'declare the dependency, or invert the call' },`,
+            '    },',
+        ].join('\n');
+    });
+    return [
+        '/**',
+        ' * GENERATED BY `archcheck init` — then edited by you.',
+        ' *',
+        ' * This file describes the architecture your code has TODAY. Every rule is `warn`, so the',
+        ' * first run is green. The work is to tighten it:',
+        ' *',
+        ' *   1. Remove a `mayImport` entry that should not be there.',
+        ' *   2. Run `npx archcheck` and read what it finds.',
+        ' *   3. Fix the code, or record the debt with `npx archcheck baseline --write`.',
+        ' *   4. Promote that one rule to `severity: error`, and add its fixture.',
+        ' *',
+        ' * Repeat. One rule at a time is the point — a manifest switched on all at once gets reverted.',
+        ' */',
+        "import { defineArchitecture } from 'archcheck';",
+        '',
+        'export default defineArchitecture({',
+        '  rules: [',
+        ...entries,
+        '',
+        '    // Four bans that are worth having in every repository. Tighten `appliesTo` to match',
+        '    // your entry points, then promote them to `error`.',
+        '    {',
+        "      id: 'no-computed-dynamic-import',",
+        "      kind: 'banned-syntax',",
+        "      statement: 'a dynamic import names its module literally, so the graph stays complete',",
+        "      severity: 'warn',",
+        "      confidence: 'deterministic',",
+        "      params: { appliesTo: '**/*.ts', selector: 'computed-dynamic-import' },",
+        "      remedy: { summary: 'import the candidates statically and pick between them' },",
+        '    },',
+        '    {',
+        "      id: 'no-empty-catch',",
+        "      kind: 'banned-syntax',",
+        "      statement: 'a caught error is handled, rethrown, or its silence is explained',",
+        "      severity: 'warn',",
+        "      confidence: 'deterministic',",
+        "      params: { appliesTo: '**/*.ts', selector: 'empty-catch' },",
+        "      remedy: { summary: 'handle it, rethrow it, or say in a comment why ignoring is safe' },",
+        '    },',
+        '    {',
+        "      id: 'no-inline-suppression',",
+        "      kind: 'banned-syntax',",
+        "      statement: 'an exception lives in the manifest with an owner and an expiry, never inline',",
+        "      severity: 'warn',",
+        "      confidence: 'proxy',",
+        "      params: { appliesTo: '**/*.ts', selector: 'suppression-comment' },",
+        "      remedy: { summary: 'add an exception to this file, with an owner and an expiry' },",
+        '    },',
+        '    {',
+        "      id: 'no-console-outside-an-entry-point',",
+        "      kind: 'banned-syntax',",
+        "      statement: 'logging goes through one seam, never straight to the console',",
+        "      severity: 'warn',",
+        "      confidence: 'deterministic',",
+        "      params: { appliesTo: '**/*.ts', selector: 'member-access', target: 'console' },",
+        "      remedy: { summary: 'inject a logger, or list this path as an entry point in appliesTo' },",
+        '    },',
+        '  ],',
+        '});',
+        '',
+    ].join('\n');
+}
+export function buildInitManifest(root, tsconfigPath) {
+    const layers = inferLayers(root);
+    if (layers.length === 0) {
+        return err([
+            'found no source directory to infer layers from',
+            '  → archcheck init looks for src/, packages/, modules/, apps/ or lib/',
+        ]);
+    }
+    const mayImport = new Map();
+    for (const layer of layers)
+        mayImport.set(layer.name, new Set());
+    // The graph is optional here on purpose: without a tsconfig we can still name the layers. But
+    // "optional" must never mean "silent" — the caller is told, and says so.
+    const graph = readGraph({ root, tsconfigPath, cache: false });
+    if (graph.ok) {
+        for (const edge of graph.value.edges) {
+            if (edge.external)
+                continue;
+            const from = layerOfPath(layers, repoRelative(root, edge.from));
+            const to = layerOfPath(layers, repoRelative(root, edge.to));
+            if (from === undefined || to === undefined || from === to)
+                continue;
+            mayImport.get(from)?.add(to);
+        }
+    }
+    const frozen = new Map([...mayImport.entries()].map(([name, set]) => [name, [...set]]));
+    return ok({
+        manifest: renderManifest(layers, frozen),
+        layers,
+        observed: graph.ok,
+        ...(graph.ok ? {} : { notObservedBecause: graph.error }),
+    });
+}
+export function initSummary(root, layers) {
+    return [
+        `inferred ${layers.length} layer(s) from ${toPosix(root)}:`,
+        ...layers.map((layer) => `  ${layer.name.padEnd(20)} ${layer.match}`),
+    ];
+}
+//# sourceMappingURL=index.js.map

package/dist/init/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/init/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEzD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;AAEjG,mFAAmF;AACnF,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACjE,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAChC,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,QAAgB;IACpD,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;aACrC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aACpC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACf,IAAI,CAAC;gBACH,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC;aACD,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAID,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,UAAU,KAAK,EAAE,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,UAAU,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,MAAiC,EAAE,QAAgB;IACtE,oFAAoF;IACpF,IAAI,IAAkD,CAAC;IACvD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvF,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,EAAE,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,MAAiC,EACjC,SAAiD;IAEjD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,WAAW,GACf,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/E,OAAO;YACL,OAAO;YACP,cAAc,KAAK,CAAC,IAAI,kCAAkC;YAC1D,uBAAuB;YACvB,qBAAqB,KAAK,CAAC,IAAI,kCAAkC;YACjE,2FAA2F;YAC3F,yBAAyB;YACzB,oCAAoC;YACpC,iBAAiB;YACjB,kBAAkB,KAAK,CAAC,IAAI,IAAI;YAChC,mBAAmB,KAAK,CAAC,KAAK,IAAI;YAClC,qDAAqD,KAAK,CAAC,IAAI,2BAA2B;YAC1F,+DAA+D;YAC/D,sBAAsB,WAAW,GAAG;YACpC,GAAG,CAAC,KAAK,KAAK,CAAC;gBACb,CAAC,CAAC;oBACE,oEAAoE;oBACpE,iCAAiC;iBAClC;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,UAAU;YACV,0EAA0E;YAC1E,QAAQ;SACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,wDAAwD;QACxD,IAAI;QACJ,2FAA2F;QAC3F,mDAAmD;QACnD,IAAI;QACJ,8DAA8D;QAC9D,qDAAqD;QACrD,iFAAiF;QACjF,0EAA0E;QAC1E,IAAI;QACJ,gGAAgG;QAChG,KAAK;QACL,iDAAiD;QACjD,EAAE;QACF,qCAAqC;QACrC,YAAY;QACZ,GAAG,OAAO;QACV,EAAE;QACF,0FAA0F;QAC1F,yDAAyD;QACzD,OAAO;QACP,yCAAyC;QACzC,8BAA8B;QAC9B,8FAA8F;QAC9F,yBAAyB;QACzB,oCAAoC;QACpC,8EAA8E;QAC9E,sFAAsF;QACtF,QAAQ;QACR,OAAO;QACP,6BAA6B;QAC7B,8BAA8B;QAC9B,sFAAsF;QACtF,yBAAyB;QACzB,oCAAoC;QACpC,kEAAkE;QAClE,+FAA+F;QAC/F,QAAQ;QACR,OAAO;QACP,oCAAoC;QACpC,8BAA8B;QAC9B,kGAAkG;QAClG,yBAAyB;QACzB,4BAA4B;QAC5B,0EAA0E;QAC1E,0FAA0F;QAC1F,QAAQ;QACR,OAAO;QACP,gDAAgD;QAChD,8BAA8B;QAC9B,kFAAkF;QAClF,yBAAyB;QACzB,oCAAoC;QACpC,uFAAuF;QACvF,iGAAiG;QACjG,QAAQ;QACR,MAAM;QACN,KAAK;QACL,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAeD,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,YAAoB;IAClE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC;YACT,gDAAgD;YAChD,uEAAuE;SACxE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IAEjE,8FAA8F;IAC9F,yEAAyE;IACzE,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5D,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;gBAAE,SAAS;YACpE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAChE,CAAC;IACF,OAAO,EAAE,CAAC;QACR,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC;QACxC,MAAM;QACN,QAAQ,EAAE,KAAK,CAAC,EAAE;QAClB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;KACzD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAiC;IACzE,OAAO;QACL,YAAY,MAAM,CAAC,MAAM,kBAAkB,OAAO,CAAC,IAAI,CAAC,GAAG;QAC3D,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC"}

package/dist/normalize/identity.d.ts

@@ -0,0 +1,4 @@
+export declare function canonicalJson(value: unknown): string;
+export declare const IDENTITY_LENGTH = 16;
+export declare function computeIdentity(ruleId: string, evidence: Record<string, unknown>): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/normalize/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/normalize/identity.ts"],"names":[],"mappings":"AAgBA,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOpD;AAED,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAKzF"}

package/dist/normalize/identity.js

@@ -0,0 +1,33 @@
+/**
+ * The identity hash — archcheck's contract with the future.
+ *
+ * What rule this enforces: baselining, deduplication and "did my fix work" all key off this one
+ * string. It is computed from the ruleId plus the SEMANTIC evidence, and it contains
+ * **no line, no column, and no absolute path**. Moving a function must not produce a new identity,
+ * or the baseline ratchet becomes noise and people stop trusting it — at which point the ratchet
+ * gets deleted and no rule can ever be adopted on existing code again (LLD §1.4, plan 07).
+ *
+ * What a caller must know: `canonicalJson` sorts keys at every depth, so two probes that build the
+ * same evidence object in a different order agree. Any path put into evidence must already be
+ * repo-relative POSIX — `repoRelative()` is not applied here, because silently rewriting evidence
+ * would hide the mistake rather than surface it.
+ */
+import { createHash } from 'node:crypto';
+export function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value) ?? 'null';
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const entries = Object.entries(value)
+        .filter(([, v]) => v !== undefined)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(',')}}`;
+}
+export const IDENTITY_LENGTH = 16;
+export function computeIdentity(ruleId, evidence) {
+    return createHash('sha256')
+        .update([ruleId, canonicalJson(evidence)].join('\u0000'))
+        .digest('hex')
+        .slice(0, IDENTITY_LENGTH);
+}
+//# sourceMappingURL=identity.js.map

package/dist/normalize/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/normalize/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACxF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAClC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,QAAiC;IAC/E,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SACxD,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AAC/B,CAAC"}

package/dist/normalize/index.d.ts

@@ -0,0 +1,3 @@
+export { canonicalJson, computeIdentity, IDENTITY_LENGTH } from './identity.js';
+export { type NormalizeInput, type NormalizeOptions, normalize } from './normalize.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/normalize/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/normalize/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,gBAAgB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/normalize/index.js

@@ -0,0 +1,3 @@
+export { canonicalJson, computeIdentity, IDENTITY_LENGTH } from './identity.js';
+export { normalize } from './normalize.js';
+//# sourceMappingURL=index.js.map

package/dist/normalize/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/normalize/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAA8C,SAAS,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/normalize/normalize.d.ts

@@ -0,0 +1,34 @@
+/**
+ * RawFinding + Rule → Diagnostic. The single place a finding becomes something an agent can act on.
+ *
+ * What rule this enforces: the normaliser NEVER drops a finding. A finding whose ruleId is not in
+ * the registry is an error, not a silent skip — it means an emitted config has drifted from the
+ * manifest, which is precisely the failure the whole emit pipeline exists to prevent (plan 07).
+ *
+ * What a caller must know: it only ever ADDS. `Diagnostic extends RawFinding`, and nothing here
+ * rewrites what a probe observed, so probe output stays auditable against the diagnostic a person
+ * finally reads.
+ */
+import { type Result } from '../result.js';
+import type { Diagnostic, RawFinding, Remedy, Rule } from '../types.js';
+export type NormalizeInput = {
+    findings: readonly RawFinding[];
+    /** The probe that produced them. Becomes `detectedBy`. */
+    detectedBy: string;
+};
+export type NormalizeOptions = {
+    byId(id: string): Rule | undefined;
+    /** Identities already recorded in the baseline. Set here, consumed by the reporters. */
+    baselined?: ReadonlySet<string>;
+    /**
+     * Injected per-finding sharpening, wired by the facade to the contract kinds. The normaliser
+     * does not know what a `layers` rule is, and must not learn — this is the seam that lets one rule
+     * say different things about findings that need different fixes.
+     */
+    refine?(finding: RawFinding, rule: Rule): {
+        statement?: string;
+        remedy?: Remedy;
+    } | undefined;
+};
+export declare function normalize(inputs: readonly NormalizeInput[], options: NormalizeOptions): Result<Diagnostic[]>;
+//# sourceMappingURL=normalize.d.ts.map

package/dist/normalize/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../src/normalize/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAIxE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;IAChC,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACnC,wFAAwF;IACxF,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAC/F,CAAC;AA2BF,wBAAgB,SAAS,CACvB,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,OAAO,EAAE,gBAAgB,GACxB,MAAM,CAAC,UAAU,EAAE,CAAC,CAmEtB"}

package/dist/normalize/normalize.js

@@ -0,0 +1,91 @@
+/**
+ * RawFinding + Rule → Diagnostic. The single place a finding becomes something an agent can act on.
+ *
+ * What rule this enforces: the normaliser NEVER drops a finding. A finding whose ruleId is not in
+ * the registry is an error, not a silent skip — it means an emitted config has drifted from the
+ * manifest, which is precisely the failure the whole emit pipeline exists to prevent (plan 07).
+ *
+ * What a caller must know: it only ever ADDS. `Diagnostic extends RawFinding`, and nothing here
+ * rewrites what a probe observed, so probe output stays auditable against the diagnostic a person
+ * finally reads.
+ */
+import { err, ok } from '../result.js';
+import { SCHEMA_VERSION } from '../version.js';
+import { computeIdentity } from './identity.js';
+/**
+ * Two probes may legitimately observe the same violation — the graph sees the edge, lint sees the
+ * statement. Same identity, one diagnostic, `detectedBy` becomes the union.
+ */
+function merge(existing, incoming) {
+    const detectedBy = [...new Set([...existing.detectedBy, ...incoming.detectedBy])].sort();
+    // Keep the more precise position if one probe has it and the other does not.
+    return {
+        ...existing,
+        detectedBy,
+        line: existing.line ?? incoming.line,
+        col: existing.col ?? incoming.col,
+        endLine: existing.endLine ?? incoming.endLine,
+        // The count is the HIGHEST any single probe saw, never the sum: two probes each seeing this
+        // violation once is one violation, not two ('two probes observing ONE violation is one
+        // occurrence, not two' in normalize.test.ts), while three empty catches reported by one probe
+        // really are three ('several occurrences in one file collapse to ONE diagnostic that counts
+        // them'). Neither number reaches `evidence`, so the identity hash is untouched.
+        occurrences: Math.max(existing.occurrences ?? 1, incoming.occurrences ?? 1),
+        occurrenceLines: [
+            ...new Set([...(existing.occurrenceLines ?? []), ...(incoming.occurrenceLines ?? [])]),
+        ].sort((a, b) => a - b),
+    };
+}
+export function normalize(inputs, options) {
+    const baselined = options.baselined ?? new Set();
+    const byIdentity = new Map();
+    const unknown = new Map();
+    /** `identity\u0000probe` → how many findings THAT probe reported for it. See `merge`. */
+    const seenByProbe = new Map();
+    for (const input of inputs) {
+        for (const finding of input.findings) {
+            const rule = options.byId(finding.ruleId);
+            if (!rule) {
+                const probes = unknown.get(finding.ruleId) ?? new Set();
+                probes.add(input.detectedBy);
+                unknown.set(finding.ruleId, probes);
+                continue;
+            }
+            const identity = finding.identity.length > 0
+                ? finding.identity
+                : computeIdentity(finding.ruleId, finding.evidence);
+            const probeKey = `${identity}\u0000${input.detectedBy}`;
+            const seen = (seenByProbe.get(probeKey) ?? 0) + 1;
+            seenByProbe.set(probeKey, seen);
+            const refinement = options.refine?.(finding, rule);
+            const diagnostic = {
+                ...finding,
+                identity,
+                schemaVersion: SCHEMA_VERSION,
+                statement: refinement?.statement ?? rule.statement,
+                severity: rule.severity,
+                confidence: rule.confidence,
+                remedy: refinement?.remedy ?? rule.remedy,
+                detectedBy: [input.detectedBy],
+                occurrences: seen,
+                occurrenceLines: finding.line === undefined ? [] : [finding.line],
+                baselined: baselined.has(identity),
+                // Set by applyExceptions() once today's date is known, which the normaliser has no
+                // business knowing. Debt and policy are decided in different places on purpose.
+                exempted: false,
+            };
+            const existing = byIdentity.get(identity);
+            byIdentity.set(identity, existing ? merge(existing, diagnostic) : diagnostic);
+        }
+    }
+    if (unknown.size > 0) {
+        return err([...unknown.entries()].map(([ruleId, probes]) => `${[...probes].sort().join(', ')} reported rule '${ruleId}', which the manifest does not define\n` +
+            '  → an emitted config has drifted from the manifest: run `archcheck emit`'));
+    }
+    // Deterministic order: by file, then by line, then by identity. A reporter must not have to sort.
+    const diagnostics = [...byIdentity.values()].sort((a, b) => a.file.localeCompare(b.file) ||
+        (a.line ?? 0) - (b.line ?? 0) ||
+        a.identity.localeCompare(b.identity));
+    return ok(diagnostics);
+}
+//# sourceMappingURL=normalize.js.map

package/dist/normalize/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../src/normalize/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAoBhD;;;GAGG;AACH,SAAS,KAAK,CAAC,QAAoB,EAAE,QAAoB;IACvD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzF,6EAA6E;IAC7E,OAAO;QACL,GAAG,QAAQ;QACX,UAAU;QACV,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;QACpC,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG;QACjC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;QAC7C,4FAA4F;QAC5F,uFAAuF;QACvF,8FAA8F;QAC9F,4FAA4F;QAC5F,gFAAgF;QAChF,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,EAAE,QAAQ,CAAC,WAAW,IAAI,CAAC,CAAC;QAC3E,eAAe,EAAE;YACf,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;SACvF,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,MAAiC,EACjC,OAAyB;IAEzB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,GAAG,EAAU,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsB,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,yFAAyF;IACzF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;gBAChE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACpC,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACzB,CAAC,CAAC,OAAO,CAAC,QAAQ;gBAClB,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAExD,MAAM,QAAQ,GAAG,GAAG,QAAQ,SAAS,KAAK,CAAC,UAAU,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAClD,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAEhC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACnD,MAAM,UAAU,GAAe;gBAC7B,GAAG,OAAO;gBACV,QAAQ;gBACR,aAAa,EAAE,cAAc;gBAC7B,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;gBAClD,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,MAAM,EAAE,UAAU,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM;gBACzC,UAAU,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC9B,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;gBACjE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClC,mFAAmF;gBACnF,gFAAgF;gBAChF,QAAQ,EAAE,KAAK;aAChB,CAAC;YAEF,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,CACR,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACxB,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CACnB,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,MAAM,yCAAyC;YAClG,2EAA2E,CAC9E,CACF,CAAC;IACJ,CAAC;IAED,kGAAkG;IAClG,MAAM,WAAW,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC/C,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CACvC,CAAC;IACF,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC"}

package/dist/probes/graph.d.ts

@@ -0,0 +1,19 @@
+import type { Edge, ModuleGraph } from '../graph/types.js';
+import type { Probe } from './types.js';
+export declare const GRAPH_REPORT_PATH = ".archcheck/graph.json";
+/** What CI writes once and every other gate reads. Edges without their AST nodes. */
+export type GraphReport = {
+    schemaVersion: 1;
+    root: string;
+    files: string[];
+    edges: Omit<Edge, 'node'>[];
+    facts: Record<string, {
+        implementsPorts: string[];
+        exports: string[];
+    }>;
+};
+export declare function toGraphReport(graph: ModuleGraph, root: string): GraphReport;
+/** A ModuleGraph restored from a report. Absolute paths again, so evaluation is identical. */
+export declare function fromGraphReport(report: GraphReport, root: string): ModuleGraph;
+export declare function createGraphProbe(): Probe;
+//# sourceMappingURL=graph.d.ts.map

package/dist/probes/graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../src/probes/graph.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,IAAI,EAAa,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGtE,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,YAAY,CAAC;AAEtD,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD,qFAAqF;AACrF,MAAM,MAAM,WAAW,GAAG;IACxB,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,eAAe,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACzE,CAAC;AAEF,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAwB3E;AAED,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CA4B9E;AAmGD,wBAAgB,gBAAgB,IAAI,KAAK,CAuBxC"}