archstrict 0.0.0 → 0.1.0

package/dist/project-path.js

@@ -0,0 +1,59 @@
+// Responsibility: convert between absolute file paths and the normalized,
+// project-relative POSIX paths used by configuration and persistent caches.
+// Boundary: callers own path validation and filesystem access.
+import { relative, sep } from "node:path";
+// A graph asks for the same file through membership and rule checks. Keep
+// one spelling so those checks do not repeat native path parsing.
+export function makeProjectRelativePosix(projectRoot) {
+    const cache = new Map();
+    const rootPrefix = projectRoot.endsWith(sep) ? projectRoot : `${projectRoot}${sep}`;
+    return (filePath) => {
+        const cached = cache.get(filePath);
+        if (cached !== undefined)
+            return cached;
+        // The project walk produces descendants of one absolute root. Prefix
+        // removal avoids parsing both absolute paths for that dominant case.
+        const nativeResult = filePath === projectRoot ? ""
+            : filePath.startsWith(rootPrefix) ? filePath.slice(rootPrefix.length)
+                : relative(projectRoot, filePath);
+        const result = sep === "/" ? nativeResult : nativeResult.split(sep).join("/");
+        cache.set(filePath, result);
+        return result;
+    };
+}
+// Cache paths are normalized project-relative POSIX paths. Parse the root
+// once because a warm read restores every file and resolved target.
+export function makeAbsolutePosix(projectRoot) {
+    const windowsRoot = /^(?:[A-Za-z]:[\\/]|[\\/]{2})/.test(projectRoot);
+    const normalizedRoot = windowsRoot ? projectRoot.replace(/\\/g, "/") : projectRoot;
+    function splitAbsolute(path) {
+        const drive = /^([A-Za-z]:)\/(.*)$/.exec(path);
+        if (drive !== null)
+            return { anchor: `${drive[1]}/`, parts: drive[2].split("/").filter(Boolean) };
+        const unc = /^\/\/([^/]+)\/([^/]+)\/?(.*)$/.exec(path);
+        if (unc !== null)
+            return { anchor: `//${unc[1]}/${unc[2]}/`, parts: unc[3].split("/").filter(Boolean) };
+        return { anchor: "/", parts: path.replace(/^\/+/, "").split("/").filter(Boolean) };
+    }
+    function appendNormalized(anchor, baseParts, path) {
+        const parts = [...baseParts];
+        for (const part of path.split("/")) {
+            if (part === "" || part === ".")
+                continue;
+            if (part === "..")
+                parts.pop();
+            else
+                parts.push(part);
+        }
+        return anchor + parts.join("/");
+    }
+    const root = splitAbsolute(normalizedRoot);
+    return (relativePath) => {
+        const normalized = windowsRoot ? relativePath.replace(/\\/g, "/") : relativePath;
+        if (/^(?:[A-Za-z]:\/|\/)/.test(normalized)) {
+            const absolute = splitAbsolute(normalized);
+            return appendNormalized(absolute.anchor, absolute.parts, "");
+        }
+        return appendNormalized(root.anchor, root.parts, normalized);
+    };
+}

package/dist/report-error.js

@@ -0,0 +1,13 @@
+// Responsibility: a thrown config or usage failure that carries the same
+// `do` a violation already carries. The CLI prints both, text or JSON,
+// so this path is not the one report that omits the command to run.
+// Boundary: the message and the next command only. Formatting belongs to
+// the CLI.
+export class ReportError extends Error {
+    do;
+    constructor(message, doText) {
+        super(message);
+        this.name = "ReportError";
+        this.do = doText;
+    }
+}

package/dist/rules/config-meaning.js

@@ -0,0 +1,143 @@
+import { withPointerSpecs } from "../config-pointer.js";
+// Each entry gets one decision; no later triage of a larger candidate set filters out model noise.
+// Use a conservative 0.7 bar instead of a casual 0.5 guess; weaker contradictions remain undecided because model noise can resemble a problem.
+const CONTRADICTION_THRESHOLD = 0.7;
+// Fixed instructions compare each entry's JSON shape with its own because text to assess the config's internal consistency.
+// They do not assess design fitness against source code; empty-rule.ts checks structural applicability against real graph edges.
+const STATE = "This is an architecture-linting config for a TypeScript project. " +
+    "allowDeny restricts which tags may depend on which; order enforces a layer sequence; point forbids specific from/to edges. " +
+    "Every entry has a mandatory, human-written because text that explains its intent. " +
+    "Assess whether each rule's configured shape contradicts its own because text.";
+const QUESTION = "Does this rule's configured shape agree with (consistent) or contradict (contradicts) " +
+    "what its because text claims the rule restricts?";
+const CRITERIA = {
+    consistent: "the shape agrees with what the because text claims",
+    contradicts: "the shape actually permits something the because text says must never happen",
+};
+export class ProverFailure extends Error {
+    kind;
+    constructor(kind) {
+        super(kind);
+        this.kind = kind;
+    }
+}
+function isTimeout(error) {
+    return typeof error === "object" && error !== null && "name" in error &&
+        (error.name === "AbortError" || error.name === "TimeoutError");
+}
+export const realProver = async (request) => {
+    const key = process.env.TYPESAFE_API_KEY;
+    if (!key)
+        throw new ProverFailure("missing-key");
+    const response = await fetch("https://api.typesafe.ai/v1/systemone", {
+        method: "POST",
+        headers: { Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ ...request, model: "jev-latest" }),
+        signal: AbortSignal.timeout(5000),
+    });
+    if (!response.ok)
+        throw new ProverFailure("http-status");
+    try {
+        return await response.json();
+    }
+    catch (error) {
+        if (isTimeout(error))
+            throw error;
+        throw new ProverFailure("invalid-json");
+    }
+};
+// HTTP errors can echo request details, including credentials; proving otherwise for every failure path is costly.
+// Fixed, authored reasons prevent caught request details from leaking TYPESAFE_API_KEY into evidence without repeated sanitization.
+// Error categories can select a reason, but evidence must never copy error.message or error.name.
+function skipped(config, reason, doText) {
+    return [withPointerSpecs({ rule: "config-meaning", path: config.configPath, line: 1, column: 1,
+            tier: "calibrated", skipped: true, evidence: reason,
+            because: "a rule that checks nothing must not look like a pass", do: doText }, [{ pointer: "edges", role: "governs" }])];
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function probability(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1;
+}
+// Every finding reports at `config.configPath` (`skipped`/`record` above
+// both fix `path: config.configPath`) - never a single file's own edge.
+// check() itself, not this function, skips calling checkConfigMeaning
+// entirely on a `check <file>` run whose focus isn't the config file:
+// unlike every other rule, a real call here can cost a paid, networked
+// prove request, so that decision happens before the request goes out at
+// all, not after - it would otherwise still be filtered away by runRules'
+// own end-of-call filter, but only after paying for it.
+export async function checkConfigMeaning(config, prove, prover = realProver) {
+    // Other tools can share this credential. Only --prove authorizes paid calls for this invocation.
+    // A key alone must not cause paid requests during routine CI or pre-commit checks.
+    if (!prove)
+        return [];
+    // Kind and index provide unique keys within one batch request and response; stable identities serve no purpose here.
+    // These keys are neither persisted nor compared across checks, and this config-level check never uses todo fingerprints.
+    const entries = [
+        ...(config.edges?.allowDeny ?? []).map((rule, i) => ({ id: `allowDeny-${i}`, kind: "allowDeny", rule, pointer: `edges.allowDeny[${i}]`,
+            label: `allowDeny rule (source '${rule.source}', targetNamespace '${rule.targetNamespace}')` })),
+        ...(config.edges?.order ?? []).map((rule, i) => ({ id: `order-${i}`, kind: "order", rule, pointer: `edges.order[${i}]`,
+            label: `order rule (tagNamespace '${rule.tagNamespace}', within ${JSON.stringify(rule.within ?? null)}, sequence ${JSON.stringify(rule.sequence)})` })),
+        ...(config.edges?.point ?? []).map((rule, i) => ({ id: `point-${i}`, kind: "point", rule, pointer: `edges.point[${i}]`,
+            label: `point rule (from ${JSON.stringify(rule.from)}, to ${JSON.stringify(rule.to)})` })),
+    ];
+    if (entries.length === 0)
+        return [];
+    const questions = Object.fromEntries(entries.map(({ id, kind, rule }) => [id, {
+            type: "choice",
+            instructions: `${JSON.stringify({ kind, ...rule })}\nbecause: ${rule.because}\n${QUESTION}`,
+            criteria: { ...CRITERIA },
+        }]));
+    try {
+        const response = await prover({ state: STATE, questions });
+        // Every expected answer must satisfy the response contract before we report any assessment.
+        // One skip marks an incomplete batch; partial findings would require guessing which answers to trust after a contract failure.
+        if (!record(response) || !record(response.answers)) {
+            return skipped(config, "the Jev API request failed: invalid answers", "retry archstrict check --prove after checking the service response");
+        }
+        const assessments = [];
+        for (const { id } of entries) {
+            const answer = response.answers[id];
+            if (!Object.hasOwn(response.answers, id)) {
+                return skipped(config, "the Jev API request failed: missing an expected answer", "retry archstrict check --prove after checking the service response");
+            }
+            if (!record(answer) || answer.type !== "choice" ||
+                (answer.choice !== "consistent" && answer.choice !== "contradicts") || !probability(answer.confidence) ||
+                !record(answer.probabilities) || !probability(answer.probabilities.consistent) || !probability(answer.probabilities.contradicts)) {
+                return skipped(config, "the Jev API request failed: invalid choice answer", "retry archstrict check --prove after checking the service response");
+            }
+            assessments.push({ type: "choice", choice: answer.choice, confidence: answer.confidence,
+                probabilities: { consistent: answer.probabilities.consistent, contradicts: answer.probabilities.contradicts } });
+        }
+        return entries.flatMap(({ rule, label, pointer }, i) => {
+            const { choice, confidence, probabilities } = assessments[i];
+            if (choice === "consistent")
+                return [];
+            // A skip means the request never ran or failed to yield a valid assessment; it cannot establish agreement with the reason.
+            // Here Jev answered contradicts successfully, but its confidence does not justify a finding.
+            // A separate undecided category preserves this inconclusive assessment instead of hiding it among request failures.
+            if (confidence < CONTRADICTION_THRESHOLD) {
+                return [withPointerSpecs({ rule: "config-meaning", path: config.configPath, line: 1, column: 1,
+                        evidence: `${label}: Jev returned contradicts but could not decide with sufficient confidence (confidence ${confidence}; probabilities ${JSON.stringify(probabilities)})`,
+                        because: rule.because,
+                        do: `request a human review of the ${label} in archstrict.config.ts: the automated check could not decide`,
+                        undecided: true, tier: "calibrated" }, [{ pointer, role: "fired" }])];
+            }
+            return [withPointerSpecs({ rule: "config-meaning", path: config.configPath, line: 1, column: 1,
+                    evidence: `${label}: Jev assessed that its configured shape contradicts its 'because' text (confidence ${confidence})`,
+                    because: rule.because,
+                    do: `review the ${label} in archstrict.config.ts: correct its configured shape or its because text so they describe the same restriction`,
+                    confidence, tier: "calibrated" }, [{ pointer, role: "fired" }])];
+        });
+    }
+    catch (error) {
+        if (error instanceof ProverFailure && error.kind === "missing-key") {
+            return skipped(config, "TYPESAFE_API_KEY is not set", "set TYPESAFE_API_KEY and re-run archstrict check --prove");
+        }
+        const reason = isTimeout(error) ? "timeout" : error instanceof ProverFailure && error.kind === "http-status" ? "non-2xx HTTP status" :
+            error instanceof ProverFailure && error.kind === "invalid-json" ? "invalid JSON response" : "network error";
+        return skipped(config, `the Jev API request failed: ${reason}`, "check service access and retry archstrict check --prove");
+    }
+}

package/dist/rules/constraints.js

@@ -0,0 +1,417 @@
+// Responsibility: the constraint engine over `config.edges` - three
+// shapes, generalizing over tags (src/classify.ts) instead of the fixed
+// module/kind vocabulary rules 1-6 use. `allowDeny` (a source tag's
+// allow/deny list over one target namespace at a time), `order` (a tag
+// namespace's sequence, scoped within another namespace's equal value),
+// and `point` (an explicit from/to edge, glob or tag-predicate on either
+// side). One shared idea across all three: a rule scoped to a namespace
+// says nothing about a target with no tag in that namespace - that's rule
+// 3's ("uncovered") territory, not this rule's concern.
+//
+// Composition rule (the one sentence an implementer would otherwise get
+// wrong): each `allowDeny`/`order` rule is evaluated independently, blind
+// to every other rule's namespace. An edge violates if ANY ONE applicable
+// rule says no - a plane-scoped rule and a domain-scoped rule can each
+// clear the same edge or each independently condemn it; neither knows the
+// other exists.
+//
+// `edgeType`/`importForm` filter which edges a rule can match at all,
+// checked before the rule's own from/to or allow/deny logic runs. Default
+// "both" for each - unfiltered, matching every prior ticket's edges.
+// Also identifies allow lists that cover every real target value in the graph.
+// Boundary: pure predicates over a ModuleGraph and a Config, same as every
+// other rule file. No I/O, no output formatting, no todo handling.
+import { computeMoves } from "./moves.js";
+import { compileGlob } from "../classify.js";
+import { classifyFile } from "../classify.js";
+import {} from "../module-graph.js";
+import { ReportError } from "../report-error.js";
+import { withPointerSpecs } from "../config-pointer.js";
+export function formatPredicate(predicate) {
+    return typeof predicate === "string" ? predicate : JSON.stringify(predicate);
+}
+// A resolved edge's target tags: a synthesized `pkg:<name>` tag when the
+// edge reaches outside this project entirely (a real npm package, a
+// workspace dependency, a node builtin - module-graph.ts's own
+// `externalPackage`), or the classified tags of the real file otherwise.
+//
+// A package shipping no bundled type declarations of its own resolves
+// through its own `@types/<name>` shadow package instead - TypeScript's
+// own resolver, not this project's choice - so `externalPackage` carries
+// that shadow identity, not the bare specifier a rule author actually
+// wrote. Measured directly, against a real project: two ordinary
+// packages resolved to their own real name; two others (shipping no
+// bundled types) resolved to their own `@types/` identity instead, so a
+// deny/allow/point rule written against the bare name matched zero real
+// edges - silently, with `evaluated` still nonzero (the edge WAS judged,
+// just against the wrong identity), so rule 4's own empty-rule-set check
+// could never have caught it. Both identities are tagged so a rule
+// written against either one matches the same real edge.
+function tagsForTarget(edge, config, relativePath) {
+    if (edge.externalPackage !== undefined) {
+        const tags = new Set([`pkg:${edge.externalPackage}`]);
+        const barePackage = bareNameFromTypesPackage(edge.externalPackage);
+        if (barePackage !== undefined)
+            tags.add(`pkg:${barePackage}`);
+        // A node builtin's own resolvedFile is synthesized as "node:<name>"
+        // (module-graph.ts's own convention - no real file exists for one) -
+        // the one reliable signal distinguishing it from a real npm package,
+        // whose resolvedFile is always a genuine filesystem path. Without
+        // this, a rule author who wants to ban every Node builtin from a
+        // browser-runtime layer or similar has to enumerate each bare name
+        // (pkg:fs, pkg:path, ...) individually, which silently under-protects
+        // against a future builtin nobody thought to add when writing the
+        // rule - a real, measured case, authoring a rule against a real
+        // bundler tool's own source. `pkg:node` matches every builtin at
+        // once; a rule naming one specific builtin still works exactly as
+        // before, since its own bare-name tag is unchanged.
+        if (edge.resolvedFile.startsWith("node:"))
+            tags.add("pkg:node");
+        return tags;
+    }
+    return classifyFile(relativePath(edge.resolvedFile), config);
+}
+// DefinitelyTyped's own naming convention: an unscoped package "foo" ships
+// as "@types/foo"; a scoped package "@scope/foo" ships as
+// "@types/scope__foo" (a literal double underscore standing in for the
+// slash, since npm package names can't nest a real "/" under a scope
+// beyond the scope itself).
+function bareNameFromTypesPackage(packageName) {
+    if (!packageName.startsWith("@types/"))
+        return undefined;
+    const rest = packageName.slice("@types/".length);
+    const scopeSplit = rest.indexOf("__");
+    return scopeSplit === -1 ? rest : `@${rest.slice(0, scopeSplit)}/${rest.slice(scopeSplit + 2)}`;
+}
+// A glob can only match a real project-relative path - an external
+// target's `resolvedFile` (node_modules, or a synthesized "node:x" for a
+// builtin) has no such path, so a string `to`/`from` predicate simply
+// never matches an external edge; only a tag predicate (matching the
+// synthesized `pkg:` tag) can.
+function targetRelPathForGlob(edge, relativePath) {
+    return edge.externalPackage !== undefined ? undefined : relativePath(edge.resolvedFile);
+}
+function matchesEdgeFilters(edge, edgeType, importForm) {
+    if (edgeType === "value" && edge.isTypeOnly)
+        return false;
+    if (edgeType === "type" && !edge.isTypeOnly)
+        return false;
+    if (importForm === "static" && edge.isDynamic)
+        return false;
+    if (importForm === "dynamic" && !edge.isDynamic)
+        return false;
+    return true;
+}
+export function matchesPredicate(predicate, relPath, tags) {
+    if (typeof predicate === "string") {
+        return relPath !== undefined && compileGlob(predicate).test(relPath);
+    }
+    if (!predicate.tags.every((t) => tags.has(t)))
+        return false;
+    if (predicate.exclude !== undefined && predicate.exclude.tags.every((t) => tags.has(t)))
+        return false;
+    return true;
+}
+export function isExemptedByGlobPair(edge, exceptions, relativePath) {
+    if (exceptions === undefined || exceptions.length === 0)
+        return false;
+    const fromRel = relativePath(edge.fromFile);
+    const toRel = targetRelPathForGlob(edge, relativePath);
+    return exceptions.some((ex) => compileGlob(ex.from).test(fromRel) && toRel !== undefined && compileGlob(ex.to).test(toRel));
+}
+// `graph.edges` follows the edge build's own walk order (rootNames order -
+// a directory scan, not a promise about reading order across files), not
+// a promise about output order - checkAllowDeny/checkOrder/checkPoint
+// (not their own compute* helpers, which return each match's own
+// ruleIndex/coverage bookkeeping alongside it, order and all) sort by
+// this before returning their own violations, so that output stays
+// stable regardless of it. Code-unit order (`<`/`>`), not localeCompare:
+// a locale-aware compare can order the same two paths differently on
+// different machines.
+function byPosition(a, b) {
+    return (a.path < b.path ? -1 : a.path > b.path ? 1 : 0) || a.line - b.line || a.column - b.column;
+}
+// `focus`, threaded through all three of this file's own rule shapes
+// (allowDeny/order/point below), is check()'s own realpath'd target for a
+// `check <file>` run - every one of the three reports at `edge.fromFile`
+// (compared directly, not through `resolve()`: an edge's own `fromFile` is
+// always already an absolute, real path, the same invariant
+// checkPublicSurfaceBypass's own comment already documents), never at any
+// other path. Unlike rule 1, `focus` here only gates what gets pushed into
+// `violations`/`matches` - the loop still runs over every real edge in
+// `graph.edges` regardless, because `evaluatedCounts` (and so
+// `EdgeRuleCoverage.evaluated`, which checkEdgesCoverage's own callers use
+// unscoped - checkEmptyRuleSet's own vacuous-rule check needs the real,
+// whole-project count, not a count of one file's own edges) has to stay a
+// whole-project fact either way.
+export function computeAllowDeny(graph, config, focus) {
+    const rules = config.edges?.allowDeny ?? [];
+    const relativePath = graph.relativePath;
+    const violations = [];
+    const matches = [];
+    const evaluatedCounts = rules.map(() => 0);
+    if (rules.length === 0)
+        return { violations, coverage: [], matches };
+    for (const edge of graph.edges) {
+        const sourceTags = classifyFile(relativePath(edge.fromFile), config);
+        if (sourceTags.size === 0)
+            continue;
+        const targetTags = tagsForTarget(edge, config, relativePath);
+        if (targetTags.size === 0)
+            continue;
+        rules.forEach((rule, i) => {
+            if (!matchesEdgeFilters(edge, rule.edgeType, rule.importForm))
+                return;
+            if (!sourceTags.has(rule.source))
+                return;
+            if (targetTags.has(rule.source))
+                return; // same group as source: unconstrained by this rule
+            if (isExemptedByGlobPair(edge, rule.exceptions, relativePath))
+                return;
+            const namespacePrefix = `${rule.targetNamespace}:`;
+            const targetValues = [...targetTags].filter((t) => t.startsWith(namespacePrefix));
+            if (targetValues.length === 0)
+                return; // no tag in this namespace: not this rule's concern
+            evaluatedCounts[i]++; // this rule genuinely had a real edge to judge, whatever the verdict below
+            let violatingTag;
+            if (rule.allow !== undefined) {
+                const allowed = new Set(rule.allow.map((v) => `${namespacePrefix}${v}`));
+                violatingTag = targetValues.find((v) => !allowed.has(v));
+            }
+            else if (rule.deny !== undefined) {
+                const denied = new Set(rule.deny.map((v) => `${namespacePrefix}${v}`));
+                violatingTag = targetValues.find((v) => denied.has(v));
+            }
+            if (violatingTag === undefined)
+                return;
+            if (focus !== undefined && edge.fromFile !== focus)
+                return; // evaluated (coverage counted above); not built for a scoped run
+            const pointers = rule.deny === undefined
+                ? [{ pointer: `edges.allowDeny[${i}].allow`, role: "fired" }]
+                : [
+                    { pointer: `edges.allowDeny[${i}].deny[${rule.deny.indexOf(violatingTag.slice(namespacePrefix.length))}]`, role: "fired" },
+                    { pointer: `edges.allowDeny[${i}].allow`, role: "edit-here" },
+                ];
+            const violation = withPointerSpecs({
+                rule: "tag-boundary",
+                path: edge.fromFile,
+                line: edge.fromPosition.line,
+                column: edge.fromPosition.column,
+                evidence: `'${edge.specifier}' (from '${rule.source}') reaches '${violatingTag}'`,
+                because: rule.because,
+                do: `remove this edge, or add '${violatingTag.slice(namespacePrefix.length)}' to '${rule.source}'s allow list in archstrict.config.ts and record why`,
+                todoModule: edge.fromModule,
+            }, pointers);
+            violations.push(violation);
+            matches.push({ violation, edge, ruleIndex: i, violatingTag });
+        });
+    }
+    const coverage = rules.map((rule, i) => ({
+        kind: "allowDeny",
+        identifier: `${rule.source} -> ${rule.targetNamespace}`,
+        evaluated: evaluatedCounts[i],
+    }));
+    return { violations, coverage, matches };
+}
+export function targetTagsInGraph(graph, config) {
+    const tags = new Set();
+    for (const edge of graph.edges) {
+        for (const tag of tagsForTarget(edge, config, graph.relativePath))
+            tags.add(tag);
+    }
+    return tags;
+}
+// Use the whole graph: a value reached only by another source still gives
+// this rule something to forbid if its source later imports that value.
+// Looking only at the source's current edges would mistake a healthy rule
+// for an exhaustive list whenever those edges happen to obey it.
+// Exclude the source tag itself: computeAllowDeny exempts targets carrying
+// that tag, so this value cannot be a violation candidate for this rule.
+// exceptions, edgeType, and importForm select edges to judge, not values
+// that exist. An out-of-list value prevents exhaustiveness even when only
+// exempted, type-only, or dynamic edges currently reach it.
+// Apply this check only to allow lists. A deny list can legitimately name
+// a value that does not exist yet to guard against a future regression.
+export function checkExhaustiveAllow(graph, config) {
+    const rules = config.edges?.allowDeny ?? [];
+    if (!rules.some(rule => rule.allow !== undefined))
+        return [];
+    const { coverage } = computeAllowDeny(graph, config);
+    const allTargetTags = targetTagsInGraph(graph, config);
+    return rules.flatMap((rule, i) => {
+        if (rule.allow === undefined || coverage[i].evaluated === 0)
+            return [];
+        const prefix = `${rule.targetNamespace}:`;
+        const universe = [...allTargetTags].filter(tag => tag.startsWith(prefix) && tag !== rule.source);
+        const allowed = new Set(rule.allow.map(value => `${prefix}${value}`));
+        return universe.length > 0 && universe.every(tag => allowed.has(tag))
+            ? [{ identifier: coverage[i].identifier, rule, ruleId: "exhaustive-allow-list" }] : [];
+    });
+}
+export function checkAllowDeny(graph, config, focus) {
+    return computeAllowDeny(graph, config, focus).matches.map(match => {
+        const moves = computeMoves(match.violation, graph, config, match);
+        return moves?.length ? Object.assign(match.violation, { moves }) : match.violation;
+    }).sort(byPosition);
+}
+// Two different things, confirmed distinct by running against Prisma's own
+// real config: a `within` value absent from `sequence` ENTIRELY (e.g.
+// Prisma's own layerOrder has no "targets" or "extensions" entry at all -
+// those domains simply have no internal layering declared) is not this
+// rule's concern for that domain - silently out of scope, not an error.
+// A `within` value that DOES have a sequence, but doesn't list this
+// specific layer value, is the real config error: classify assigned a
+// value the config's author forgot to place.
+export function sequenceFor(rule, withinValue) {
+    return rule.sequence[withinValue ?? ""];
+}
+export function assertSequenceListsValue(rule, withinValue, sequence, tag) {
+    const value = tag.slice(rule.tagNamespace.length + 1);
+    if (!sequence.includes(value)) {
+        throw new ReportError(`order rule for '${rule.tagNamespace}' (within '${withinValue ?? "(unscoped)"}') does not list '${value}' - every value classify assigns within that scope must appear in its sequence`, `add '${value}' to that order rule's sequence in archstrict.config.ts, then run archstrict check`);
+    }
+}
+// See computeAllowDeny's own comment above for `focus`'s meaning here:
+// reports at `edge.fromFile` too, and `evaluatedCounts`/coverage stay
+// whole-project regardless of it.
+function computeOrder(graph, config, focus) {
+    const rules = config.edges?.order ?? [];
+    const relativePath = graph.relativePath;
+    const violations = [];
+    const evaluatedCounts = rules.map(() => 0);
+    if (rules.length === 0)
+        return { violations, coverage: [] };
+    for (const edge of graph.edges) {
+        const sourceTags = classifyFile(relativePath(edge.fromFile), config);
+        const targetTags = tagsForTarget(edge, config, relativePath);
+        rules.forEach((rule, i) => {
+            if (!matchesEdgeFilters(edge, rule.edgeType, rule.importForm))
+                return;
+            const namespacePrefix = `${rule.tagNamespace}:`;
+            const sourceLayer = [...sourceTags].find((t) => t.startsWith(namespacePrefix));
+            const targetLayer = [...targetTags].find((t) => t.startsWith(namespacePrefix));
+            if (sourceLayer === undefined || targetLayer === undefined)
+                return;
+            let withinValue;
+            if (rule.within !== undefined) {
+                const withinPrefix = `${rule.within}:`;
+                const sourceWithin = [...sourceTags].find((t) => t.startsWith(withinPrefix));
+                const targetWithin = [...targetTags].find((t) => t.startsWith(withinPrefix));
+                if (sourceWithin === undefined || targetWithin === undefined)
+                    return;
+                if (sourceWithin !== targetWithin)
+                    return; // different scope entirely: this order rule doesn't cross it
+                withinValue = sourceWithin.slice(withinPrefix.length);
+            }
+            const sequence = sequenceFor(rule, withinValue);
+            if (sequence === undefined)
+                return; // this within-value has no declared sequence at all: out of scope, not an error
+            assertSequenceListsValue(rule, withinValue, sequence, sourceLayer);
+            assertSequenceListsValue(rule, withinValue, sequence, targetLayer);
+            evaluatedCounts[i]++; // this rule genuinely had a real edge, within a real declared sequence, to judge
+            const sourceIndex = sequence.indexOf(sourceLayer.slice(namespacePrefix.length));
+            const targetIndex = sequence.indexOf(targetLayer.slice(namespacePrefix.length));
+            // "downward-only": a source may depend on its own layer or one
+            // closer to the sequence's start (index 0 = innermost/core); reaching
+            // a later index moves away from core, which is forbidden. Matches
+            // dependency-cruiser's own generator: forbidden iff targetIndex >
+            // sourceIndex.
+            if (targetIndex <= sourceIndex)
+                return;
+            if (focus !== undefined && edge.fromFile !== focus)
+                return; // evaluated (coverage counted above); not built for a scoped run
+            violations.push(withPointerSpecs({
+                rule: "tag-order",
+                path: edge.fromFile,
+                line: edge.fromPosition.line,
+                column: edge.fromPosition.column,
+                evidence: `'${edge.specifier}' reaches '${targetLayer}' from '${sourceLayer}' (${rule.tagNamespace} sequence: ${sequence.join(" -> ")})`,
+                because: rule.because,
+                do: `move this edge to depend only on '${rule.tagNamespace}' values at or before '${sourceLayer.slice(namespacePrefix.length)}' in archstrict.config.ts's sequence, or restructure the code so it does`,
+                todoModule: edge.fromModule,
+            }, [{ pointer: `edges.order[${i}].sequence`, role: "fired" }]));
+        });
+    }
+    const coverage = rules.map((rule, i) => ({
+        kind: "order",
+        identifier: `${rule.tagNamespace}${rule.within !== undefined ? ` within ${rule.within}` : ""}`,
+        evaluated: evaluatedCounts[i],
+    }));
+    return { violations, coverage };
+}
+export function checkOrder(graph, config, focus) {
+    return computeOrder(graph, config, focus).violations.sort(byPosition);
+}
+// Unlike allowDeny/order (which have an "applicable but allowed" middle
+// state), a point rule's from/to predicates ARE the whole rule - any edge
+// whose from side matches is a real opportunity for this rule to fire,
+// whether or not the to side happens to match as well. So "evaluated"
+// here means "the from predicate matched a real edge", the strongest
+// vacuousness signal point can offer: a from glob/tags that never matches
+// anything real is a rule that can never fire, and a to side that never
+// matches doesn't make the rule vacuous on its own (it may be correctly
+// finding zero forbidden edges among real, matched-from-side candidates).
+// See computeAllowDeny's own comment above for `focus`'s meaning here:
+// reports at `edge.fromFile` too, and `evaluatedCounts`/coverage stay
+// whole-project regardless of it.
+function computePoint(graph, config, focus) {
+    const rules = config.edges?.point ?? [];
+    const identifiers = rules.map((rule) => `${formatPredicate(rule.from)} -> ${formatPredicate(rule.to)}`);
+    const relativePath = graph.relativePath;
+    const violations = [];
+    const evaluatedCounts = rules.map(() => 0);
+    if (rules.length === 0)
+        return { violations, coverage: [] };
+    for (const edge of graph.edges) {
+        const sourceRel = relativePath(edge.fromFile);
+        const sourceTags = classifyFile(sourceRel, config);
+        const targetTags = tagsForTarget(edge, config, relativePath);
+        const targetRel = targetRelPathForGlob(edge, relativePath);
+        rules.forEach((rule, i) => {
+            if (!matchesEdgeFilters(edge, rule.edgeType, rule.importForm))
+                return;
+            if (!matchesPredicate(rule.from, sourceRel, sourceTags))
+                return;
+            evaluatedCounts[i]++;
+            if (!matchesPredicate(rule.to, targetRel, targetTags))
+                return;
+            if (focus !== undefined && edge.fromFile !== focus)
+                return; // evaluated (coverage counted above); not built for a scoped run
+            violations.push(withPointerSpecs({
+                rule: "point-rule",
+                path: edge.fromFile,
+                line: edge.fromPosition.line,
+                column: edge.fromPosition.column,
+                evidence: `'${edge.specifier}' matches a forbidden edge`,
+                because: rule.because,
+                do: `remove this edge, or narrow the point rule '${identifiers[i]}' in archstrict.config.ts if it's too broad`,
+                todoModule: edge.fromModule,
+            }, [{ pointer: `edges.point[${i}]`, role: "fired" }]));
+        });
+    }
+    const coverage = identifiers.map((identifier, i) => ({
+        kind: "point",
+        identifier,
+        evaluated: evaluatedCounts[i],
+    }));
+    return { violations, coverage };
+}
+export function checkPoint(graph, config, focus) {
+    return computePoint(graph, config, focus).violations.sort(byPosition);
+}
+export function checkConstraints(graph, config) {
+    return [...checkAllowDeny(graph, config), ...checkOrder(graph, config), ...checkPoint(graph, config)];
+}
+// All configured allowDeny/order/point rules, each with how many real
+// edges reached the point where it could have judged one - not just
+// whether it violated. checkEmptyRuleSet (rule 4) uses this to flag a
+// rule that structurally never applies to anything, the same "a rule
+// that checks nothing must not look like a pass" idea rule 4 already
+// applies to classify/declaredModules.
+export function checkEdgesCoverage(graph, config) {
+    return [
+        ...computeAllowDeny(graph, config).coverage,
+        ...computeOrder(graph, config).coverage,
+        ...computePoint(graph, config).coverage,
+    ];
+}