cachelint 0.1.0

package/dist/chunk-UUVSBJ62.js

@@ -0,0 +1,77 @@
+import {
+  ExactCountUnavailableError
+} from "./chunk-XKRPGMZT.js";
+
+// src/exact/anthropic.ts
+var DEFAULT_EXACT_LIMIT = 100;
+var DEFAULT_EXACT_MODEL = "claude-opus-4-7";
+var memo = /* @__PURE__ */ new Map();
+async function countTokensExact(requests, limit = DEFAULT_EXACT_LIMIT) {
+  const apiKey = process.env["ANTHROPIC_API_KEY"];
+  if (apiKey === void 0 || apiKey === "") {
+    throw new ExactCountUnavailableError(
+      "`--exact` needs ANTHROPIC_API_KEY to call the count-tokens API",
+      "Export ANTHROPIC_API_KEY (your own key \u2014 cachelint never sees it), or drop --exact for the estimate."
+    );
+  }
+  let SDK;
+  try {
+    SDK = (await import("@anthropic-ai/sdk")).default;
+  } catch {
+    throw new ExactCountUnavailableError(
+      "`--exact` needs the optional dependency @anthropic-ai/sdk",
+      "Install it: `npm i @anthropic-ai/sdk`. (It's an optional peer dep so it isn't installed by default.)"
+    );
+  }
+  const AnthropicCtor = SDK;
+  let client;
+  try {
+    client = new AnthropicCtor({ apiKey, timeout: 3e4, maxRetries: 2 });
+  } catch (err) {
+    throw new ExactCountUnavailableError(
+      `could not initialize the @anthropic-ai/sdk client: ${err instanceof Error ? err.message : String(err)}`,
+      "Check the ANTHROPIC_API_KEY format, or drop --exact for the estimate."
+    );
+  }
+  const out = [];
+  let calls = 0;
+  let skippedDueToCap = 0;
+  for (const req of requests) {
+    const key = `${req.model}\0${req.sha256}`;
+    const cached = memo.get(key);
+    if (cached !== void 0) {
+      out.push({ sha256: req.sha256, model: req.model, tokens: cached });
+      continue;
+    }
+    if (calls >= limit) {
+      skippedDueToCap++;
+      continue;
+    }
+    calls++;
+    let resp;
+    try {
+      resp = await client.messages.countTokens({ model: req.model, messages: [{ role: "user", content: req.text }] });
+    } catch (err) {
+      throw new ExactCountUnavailableError(
+        `the Anthropic count-tokens API call failed: ${err instanceof Error ? err.message : String(err)}`,
+        "Retry later, or drop --exact for the estimate. (cachelint never logs your API key.)"
+      );
+    }
+    const tokens = typeof resp.input_tokens === "number" ? resp.input_tokens : 0;
+    memo.set(key, tokens);
+    out.push({ sha256: req.sha256, model: req.model, tokens });
+  }
+  if (skippedDueToCap > 0) {
+    process.stderr.write(
+      `cachelint: --exact reached the per-run cap (${limit}); ${skippedDueToCap} file(s) were not counted. Raise --exact-limit to count more.
+`
+    );
+  }
+  return out;
+}
+
+export {
+  DEFAULT_EXACT_LIMIT,
+  DEFAULT_EXACT_MODEL,
+  countTokensExact
+};

package/dist/chunk-VWE5TDL5.js

@@ -0,0 +1,91 @@
+// src/cost/format.ts
+var MIN_RENDERABLE_USD_PER_1K = 0.01;
+function formatUsdPer1k(usd) {
+  if (!Number.isFinite(usd) || usd <= 0 || usd < MIN_RENDERABLE_USD_PER_1K) return null;
+  return `$${Number(usd.toPrecision(2))}`;
+}
+function costLabel(pricing, asOf) {
+  return `est. if caching is enabled, ${pricing.model} pricing, ${asOf}`;
+}
+function formatTokens(n) {
+  return String(n).replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+}
+function costLineInvalidates(fromHereTokens) {
+  return `\u2192 invalidates ~${formatTokens(fromHereTokens)} stable prefix tokens from here`;
+}
+function costLineWasted(usd, label) {
+  return `\u2248 ${usd} wasted per 1,000 calls (${label})`;
+}
+var COST_LINE_OVERLAPPED = "(overlapped by the finding above \u2014 no additional waste)";
+function costLineAtRisk(fromHereTokens) {
+  return `~${formatTokens(fromHereTokens)} prefix tokens at risk (byte-stable \u2014 changes on edit/regeneration, not per call)`;
+}
+function costSummary(totals, label) {
+  if (totals.wastedTokens <= 0) return null;
+  const usd = formatUsdPer1k(totals.wastedUsdPer1kCalls);
+  const atRisk = totals.atRiskTokens > 0 ? ` \xB7 ~${formatTokens(totals.atRiskTokens)} prefix tokens at risk` : "";
+  if (usd === null) {
+    return `est. waste ~${formatTokens(totals.wastedTokens)} stable prefix tokens per call (under $0.01 per 1,000 calls)${atRisk}`;
+  }
+  return `est. waste \u2248 ${usd} per 1,000 calls${atRisk} (${label})`;
+}
+function receiptProtectedLine(tokens, engagedBundles, usd, label) {
+  const noun = engagedBundles === 1 ? "bundle" : "bundles";
+  const worth = usd === null ? "worth under $0.01 per 1,000 calls" : `worth at most ${usd} per 1,000 calls`;
+  return `protected \u2014 ~${formatTokens(tokens)} stable prefix tokens across ${engagedBundles} ${noun}, ${worth} (${label})`;
+}
+function receiptWontEngageLine(name, tokens, minimumTokens) {
+  return `bundle "${name}": caching won't engage yet (~${formatTokens(tokens)} tokens < ${formatTokens(minimumTokens)}-token minimum)`;
+}
+function receiptAllBelowMinimumLine(minimumTokens, minimumSource) {
+  return `all bundles are below the cacheable minimum (${formatTokens(minimumTokens)} tokens, ${minimumSource}) \u2014 caching won't engage yet`;
+}
+function receiptWarnQualifier(totals) {
+  const parts = [];
+  if (totals.wastedTokens > 0) {
+    const usd = formatUsdPer1k(totals.wastedUsdPer1kCalls);
+    parts.push(
+      usd === null ? `est. waste ~${formatTokens(totals.wastedTokens)} stable prefix tokens per call (under $0.01 per 1,000 calls)` : `est. waste \u2248 ${usd} per 1,000 calls`
+    );
+  }
+  if (totals.atRiskTokens > 0) parts.push(`~${formatTokens(totals.atRiskTokens)} prefix tokens at risk`);
+  if (parts.length === 0) return null;
+  return `of that, ${parts.join(" \xB7 ")} \u2014 see the warnings above`;
+}
+function buildReceiptLines(cost, label) {
+  const receipt = cost.receipt;
+  const engaged = receipt.bundles.filter((b) => b.engaged).length;
+  const qualifier = receiptWarnQualifier(cost.totals);
+  const out = [];
+  if (engaged > 0) {
+    out.push(receiptProtectedLine(receipt.protectedTokens, engaged, formatUsdPer1k(receipt.protectedUsdPer1kCalls), label));
+    if (qualifier !== null) out.push(qualifier);
+  }
+  for (const b of receipt.bundles) {
+    if (!b.engaged) out.push(receiptWontEngageLine(b.name, b.protectedTokens, receipt.engagementMinimumTokens));
+  }
+  if (engaged === 0) {
+    out.push(receiptAllBelowMinimumLine(receipt.engagementMinimumTokens, receipt.engagementMinimumSource));
+    if (qualifier !== null) out.push(qualifier);
+  }
+  if (receipt.exactFallbackReason !== void 0) out.push(receipt.exactFallbackReason);
+  return out;
+}
+var RECEIPT_EXACT_FALLBACK_LINE = "--exact did not cover every bundle file (call cap reached, or content changed during the run) \u2014 affected bundles use the chars/4 estimate";
+
+export {
+  formatUsdPer1k,
+  costLabel,
+  formatTokens,
+  costLineInvalidates,
+  costLineWasted,
+  COST_LINE_OVERLAPPED,
+  costLineAtRisk,
+  costSummary,
+  receiptProtectedLine,
+  receiptWontEngageLine,
+  receiptAllBelowMinimumLine,
+  receiptWarnQualifier,
+  buildReceiptLines,
+  RECEIPT_EXACT_FALLBACK_LINE
+};

package/dist/chunk-WKFGRNYK.js

@@ -0,0 +1,494 @@
+import {
+  DEFAULT_RULE_SEVERITY,
+  DEFAULT_RULE_VOLATILITY,
+  RULE_IDS
+} from "./chunk-4GHSUBAY.js";
+import {
+  RuleError
+} from "./chunk-XKRPGMZT.js";
+
+// src/rules/text-utils.ts
+function splitLines(text) {
+  if (text === "") return [""];
+  const lines = text.split(/\r\n|\r|\n/);
+  if (lines.length > 1 && lines[lines.length - 1] === "") lines.pop();
+  return lines;
+}
+function lineColAt(text, index) {
+  let line = 1;
+  let lastBreak = -1;
+  for (let i = 0; i < index && i < text.length; i++) {
+    if (text.charCodeAt(i) === 10) {
+      line++;
+      lastBreak = i;
+    }
+  }
+  return { line, column: index - lastBreak };
+}
+function snippetOf(line, max = 120) {
+  const t = line.trim();
+  return t.length <= max ? t : t.slice(0, max - 1) + "\u2026";
+}
+function* matchesWithLocation(text, re) {
+  if (!re.global) throw new Error("matchesWithLocation requires a global regex");
+  const lines = splitLines(text);
+  re.lastIndex = 0;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const { line, column } = lineColAt(text, m.index);
+    yield { match: m, line, column, sourceLine: lines[line - 1] ?? "" };
+    if (m.index === re.lastIndex) re.lastIndex++;
+  }
+}
+
+// src/rules/pragmas.ts
+var MARKER = "cachelint-disable-next-line";
+var ID_TOKEN_RE = /R\d{3}|\*/g;
+function computePragmaExemptions(raw) {
+  const out = /* @__PURE__ */ new Map();
+  const lines = splitLines(raw);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    if (!line.includes(MARKER)) continue;
+    const segments = line.split(MARKER);
+    const exemptLine = i + 2;
+    const set = out.get(exemptLine) ?? /* @__PURE__ */ new Set();
+    for (let s = 1; s < segments.length; s++) {
+      const rest = stripCommentClose(segments[s] ?? "");
+      const tokens = rest.match(ID_TOKEN_RE) ?? [];
+      const ids = tokens.length > 0 ? tokens : ["*"];
+      for (const id of ids) set.add(id);
+    }
+    out.set(exemptLine, set);
+  }
+  return out;
+}
+function stripCommentClose(s) {
+  const close = Math.min(indexOrInfinity(s, "-->"), indexOrInfinity(s, "*/"));
+  return close === Infinity ? s : s.slice(0, close);
+}
+function indexOrInfinity(s, needle) {
+  const i = s.indexOf(needle);
+  return i === -1 ? Infinity : i;
+}
+
+// src/rules/R001-interpolated-timestamp.ts
+var PATTERNS = [
+  {
+    re: /\{\{[~#/]?\s*(?:now|today|date|datetime|timestamp|moment|current[_-]?date(?:[_-]?time)?|current[_-]?time|iso[_-]?now|now[_-]?iso)\b[^}]*\}\}/gi,
+    message: "template helper injects the current date/time into the prompt",
+    fixHint: "Remove the time helper, or move it after the last cache breakpoint.",
+    volatility: "per-call"
+  },
+  {
+    re: /\$\{[^}]*\b(?:new\s+Date\b|Date\.now\s*\(\s*\)|performance\.now\s*\(\s*\))[^}]*\}/g,
+    message: "template literal interpolates a JavaScript timestamp",
+    fixHint: "Compute the timestamp outside the cached prefix, or drop it.",
+    volatility: "per-call"
+  },
+  {
+    re: /\{[^{}\n]*\b(?:datetime|date|time)\s*\.\s*(?:now|today|utcnow)\s*\([^)]*\)[^{}\n]*\}/g,
+    message: "f-string/format placeholder injects a Python timestamp",
+    fixHint: "Build the timestamp before the cached prefix, or remove it.",
+    volatility: "per-call"
+  },
+  {
+    re: /\bnew\s+Date\s*\([^)]*\)/g,
+    message: "`new Date(...)` in prompt content \u2014 likely injects the current time",
+    fixHint: "If this must vary, keep it after the last cache_control breakpoint.",
+    volatility: "per-call"
+  },
+  {
+    re: /\bDate\.now\s*\(\s*\)/g,
+    message: "`Date.now()` in prompt content \u2014 injects the current epoch millis",
+    fixHint: "Move it out of the stable prefix, or hardcode a fixed value.",
+    volatility: "per-call"
+  },
+  {
+    re: /\b(?:datetime\.datetime\.(?:now|utcnow)|datetime\.now|datetime\.utcnow|time\.time)\s*\([^)]*\)/g,
+    message: "Python `datetime.now()` / `time.time()` in prompt content",
+    fixHint: "Compute it before the cached prefix, or remove it.",
+    volatility: "per-call"
+  },
+  {
+    re: /\b(?:Current\s+Date(?:\s*&\s*Time)?|Current\s+date(?:\s*\/\s*time)?|Today'?s?\s+date|As\s+of(?:\s+date)?|Last\s+updated|Generated\s+(?:on|at))\s*[:=]\s*\S/gi,
+    message: "a \u201Ccurrent date/time\u201D label in the prompt body \u2014 usually filled at edit time, breaking the cache",
+    fixHint: "Drop the line, or move it below the last cache breakpoint.",
+    volatility: "per-call"
+  },
+  {
+    re: /\b\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2})?(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?\b/g,
+    message: "hardcoded ISO-8601 timestamp \u2014 if this is \u201Cnow\u201D it changes every time you regenerate the file",
+    fixHint: "If it's meant to be dynamic, don't bake it into the cached prefix; if it's truly fixed, ignore this warning.",
+    volatility: "regeneration"
+  }
+];
+var ruleR001 = {
+  id: "R001",
+  defaultSeverity: "warn",
+  volatility: "per-call",
+  title: "Interpolated timestamp in a cached prompt",
+  match(raw, _ctx) {
+    const seen = /* @__PURE__ */ new Set();
+    const out = [];
+    for (const { re, message, fixHint, volatility } of PATTERNS) {
+      for (const { line, column, sourceLine } of matchesWithLocation(raw, re)) {
+        const key = `${line}:${column}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        out.push({ line, column, message, fixHint, snippet: snippetOf(sourceLine), volatility });
+      }
+    }
+    return out;
+  }
+};
+
+// src/rules/R002-interpolated-uuid-or-random.ts
+var PATTERNS2 = [
+  {
+    re: /\bcrypto\.randomUUID\s*\(\s*\)/g,
+    message: "`crypto.randomUUID()` in prompt content \u2014 a fresh UUID every call",
+    fixHint: "Generate the id outside the cached prefix (or after the last breakpoint)."
+  },
+  {
+    re: /\bMath\.random\s*\(\s*\)/g,
+    message: "`Math.random()` in prompt content \u2014 non-deterministic",
+    fixHint: "Move it out of the stable prefix, or remove it."
+  },
+  {
+    re: /\buuid(?:v[1345]|V[1345])\s*\(/g,
+    message: "`uuidv4()` (or similar) in prompt content \u2014 a fresh UUID every call",
+    fixHint: "Compute the id before the cached prefix."
+  },
+  {
+    re: /\buuid\s*\.\s*(?:v[1345]|uuid[1345])\s*\(/g,
+    message: "`uuid.v4()` / `uuid.uuid4()` in prompt content \u2014 non-deterministic",
+    fixHint: "Generate it outside the cached prefix."
+  },
+  {
+    re: /\bnanoid\s*\([^)]*\)/g,
+    message: "`nanoid()` in prompt content \u2014 random id every call",
+    fixHint: "Move it out of the stable prefix."
+  },
+  {
+    re: /\bsecrets\.token_(?:hex|urlsafe|bytes)\s*\([^)]*\)/g,
+    message: "Python `secrets.token_*()` in prompt content \u2014 random every call",
+    fixHint: "Compute it before the cached prefix."
+  },
+  {
+    re: /\bos\.urandom\s*\([^)]*\)/g,
+    message: "Python `os.urandom()` in prompt content \u2014 random bytes every call",
+    fixHint: "Move it out of the stable prefix."
+  },
+  {
+    re: /\$\{[^}]*\b(?:randomUUID|Math\.random|nanoid|uuidv?[1345])\b[^}]*\}/g,
+    message: "template literal interpolates a random value",
+    fixHint: "Compute the value outside the cached prefix."
+  },
+  {
+    re: /\{\{[~#/]?\s*(?:uuid|guid|random|nanoid|request[_-]?id|requestId|correlation[_-]?id|correlationId|trace[_-]?id|traceId|nonce|session[_-]?id|sessionId)\b[^}]*\}\}/gi,
+    message: "template helper injects a per-request id/random value into the prompt",
+    fixHint: "Drop the helper, or move it after the last cache breakpoint."
+  }
+];
+var ruleR002 = {
+  id: "R002",
+  defaultSeverity: "warn",
+  volatility: "per-call",
+  title: "Interpolated UUID / random value in a cached prompt",
+  match(raw, _ctx) {
+    const seen = /* @__PURE__ */ new Set();
+    const out = [];
+    for (const { re, message, fixHint } of PATTERNS2) {
+      for (const { line, column, sourceLine } of matchesWithLocation(raw, re)) {
+        const key = `${line}:${column}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        out.push({ line, column, message, fixHint, snippet: snippetOf(sourceLine) });
+      }
+    }
+    return out;
+  }
+};
+
+// src/rules/R003-unsorted-json-stringify.ts
+import { parse as acornParse } from "acorn";
+import { simple as walkSimple } from "acorn-walk";
+var JS_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".cjs", ".mjs", ".jsx"]);
+var MESSAGE = "`JSON.stringify(...)` without a key-sorting replacer \u2014 output key order isn't guaranteed stable";
+var FIX_HINT = "Pass a replacer that sorts keys, e.g. JSON.stringify(obj, Object.keys(obj).sort()), or a recursive stable-stringify.";
+var ruleR003 = {
+  id: "R003",
+  defaultSeverity: "warn",
+  // "regeneration", deliberately conservative: unsorted stringify is a
+  // fragility/risk — output is often byte-stable run-to-run, so pricing it as
+  // per-call waste would overstate.
+  volatility: "regeneration",
+  title: "Unsorted JSON.stringify in a cached prompt",
+  match(raw, ctx) {
+    if (!ctx.promptScoped) return [];
+    if (JS_EXTENSIONS.has(ctx.ext)) {
+      const viaAst = tryAst(raw);
+      if (viaAst !== null) return viaAst;
+    }
+    return viaRegex(raw);
+  }
+};
+function tryAst(raw) {
+  let ast;
+  try {
+    ast = acornParse(raw, {
+      ecmaVersion: "latest",
+      sourceType: "module",
+      locations: true,
+      allowHashBang: true,
+      allowReturnOutsideFunction: true,
+      allowAwaitOutsideFunction: true
+    });
+  } catch {
+    return null;
+  }
+  const lines = splitLines(raw);
+  const out = [];
+  walkSimple(ast, {
+    CallExpression(rawNode) {
+      const node = rawNode;
+      const callee = node["callee"];
+      if (callee && callee.type === "MemberExpression" && callee["computed"] === false && callee["object"]?.type === "Identifier" && callee["object"].name === "JSON" && callee["property"]?.type === "Identifier" && callee["property"].name === "stringify") {
+        const args = node["arguments"];
+        const argCount = Array.isArray(args) ? args.length : 0;
+        if (argCount < 2) {
+          const loc = node.loc?.start ?? { line: 1, column: 0 };
+          out.push({
+            line: loc.line,
+            column: loc.column + 1,
+            // acorn columns are 0-based
+            message: MESSAGE,
+            fixHint: FIX_HINT,
+            snippet: snippetOf(lines[loc.line - 1] ?? "")
+          });
+        }
+      }
+    }
+  });
+  return out;
+}
+var CALL_RE = /\bJSON\.stringify\s*\(([^()]*)\)/g;
+function viaRegex(raw) {
+  const out = [];
+  for (const { match, line, column, sourceLine } of matchesWithLocation(raw, CALL_RE)) {
+    const args = match[1] ?? "";
+    if (hasTopLevelComma(args)) continue;
+    out.push({ line, column, message: MESSAGE, fixHint: FIX_HINT, snippet: snippetOf(sourceLine) });
+  }
+  return out;
+}
+function hasTopLevelComma(s) {
+  let depth = 0;
+  let quote = null;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (quote !== null) {
+      if (c === "\\") {
+        i++;
+        continue;
+      }
+      if (c === quote) quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      quote = c;
+      continue;
+    }
+    if (c === "[" || c === "{") depth++;
+    else if (c === "]" || c === "}") depth = Math.max(0, depth - 1);
+    else if (c === "," && depth === 0) return true;
+  }
+  return false;
+}
+
+// src/rules/R004-bom-byte.ts
+var ruleR004 = {
+  id: "R004",
+  defaultSeverity: "error",
+  volatility: "regeneration",
+  title: "Leading UTF-8 BOM in a prompt file",
+  match(raw, _ctx) {
+    if (raw.length === 0 || raw.charCodeAt(0) !== 65279) return [];
+    return [
+      {
+        line: 1,
+        column: 1,
+        message: "file begins with a UTF-8 BOM (U+FEFF) \u2014 an invisible character at the head of the prompt",
+        fixHint: "Re-save the file as UTF-8 *without* BOM (most editors have a 'Save with Encoding' option)."
+      }
+    ];
+  }
+};
+
+// src/rules/R005-mixed-line-endings.ts
+var ruleR005 = {
+  id: "R005",
+  defaultSeverity: "error",
+  volatility: "regeneration",
+  title: "Mixed line endings in a prompt file",
+  match(raw, _ctx) {
+    let line = 1;
+    let firstKind = null;
+    for (let i = 0; i < raw.length; i++) {
+      const c = raw.charCodeAt(i);
+      let kind = null;
+      if (c === 13) {
+        if (raw.charCodeAt(i + 1) === 10) {
+          kind = "crlf";
+          i++;
+        } else {
+          kind = "cr";
+        }
+      } else if (c === 10) {
+        kind = "lf";
+      }
+      if (kind !== null) {
+        if (firstKind === null) {
+          firstKind = kind;
+        } else if (kind !== firstKind) {
+          return [
+            {
+              line,
+              column: 1,
+              message: `mixed line endings \u2014 file uses ${labelOf(firstKind)} elsewhere but this line ends with ${labelOf(kind)}`,
+              fixHint: "Normalize the file to LF (e.g. `.gitattributes`: `* text=auto eol=lf`, then re-checkout)."
+            }
+          ];
+        }
+        line++;
+      }
+    }
+    return [];
+  }
+};
+function labelOf(e) {
+  return e === "crlf" ? "CRLF" : e === "lf" ? "LF" : "bare CR";
+}
+
+// src/rules/index.ts
+var RULE_DOCS_BASE = "https://github.com/davioe/cachelint/blob/main/docs/rules/";
+var REGISTRY = Object.freeze([
+  ruleR001,
+  ruleR002,
+  ruleR003,
+  ruleR004,
+  ruleR005
+]);
+(() => {
+  const got = REGISTRY.map((r) => r.id);
+  const want = [...RULE_IDS];
+  const sameOrder = got.length === want.length && got.every((id, i) => id === want[i]);
+  if (!sameOrder) {
+    throw new RuleError({
+      code: "RULE_REGISTRY_MISMATCH",
+      message: `rule registry [${got.join(", ")}] does not match the id allow-list [${want.join(", ")}]`,
+      hint: "Keep src/rules/ids.ts (RULE_IDS) and src/rules/index.ts (REGISTRY) in sync."
+    });
+  }
+  for (const r of REGISTRY) {
+    if (r.defaultSeverity !== DEFAULT_RULE_SEVERITY[r.id]) {
+      throw new RuleError({
+        code: "RULE_SEVERITY_MISMATCH",
+        message: `rule ${r.id} default severity ${r.defaultSeverity} != ids.ts ${DEFAULT_RULE_SEVERITY[r.id]}`,
+        ruleId: r.id
+      });
+    }
+    if (r.volatility !== DEFAULT_RULE_VOLATILITY[r.id]) {
+      throw new RuleError({
+        code: "RULE_VOLATILITY_MISMATCH",
+        message: `rule ${r.id} volatility ${r.volatility} != ids.ts ${DEFAULT_RULE_VOLATILITY[r.id]}`,
+        ruleId: r.id
+      });
+    }
+  }
+})();
+function allRules() {
+  return REGISTRY;
+}
+function getRule(id) {
+  return REGISTRY.find((r) => r.id === id);
+}
+function ruleDocsUrl(id) {
+  return `${RULE_DOCS_BASE}${id}.md`;
+}
+function resolveSeverities(settings = {}) {
+  const disabled = new Set(settings.disable ?? []);
+  const out = {};
+  for (const id of RULE_IDS) {
+    if (disabled.has(id)) {
+      out[id] = null;
+      continue;
+    }
+    const override = settings.rules?.[id];
+    if (override === "off") out[id] = null;
+    else if (override === "warn" || override === "error") out[id] = override;
+    else out[id] = DEFAULT_RULE_SEVERITY[id];
+  }
+  return out;
+}
+function runRules(sources, opts = {}) {
+  const severities = resolveSeverities(opts.settings);
+  const diagnostics = [];
+  for (const src of sources) {
+    const exemptions = computePragmaExemptions(src.raw);
+    const ctx = {
+      file: src.file,
+      ext: src.ext,
+      bomByte: src.bomByte,
+      mixedLineEndings: src.mixedLineEndings,
+      promptScoped: src.promptScoped
+    };
+    for (const rule of REGISTRY) {
+      const severity = severities[rule.id];
+      if (severity === null) continue;
+      let raws;
+      try {
+        raws = rule.match(src.raw, ctx);
+      } catch (err) {
+        throw new RuleError({
+          code: "RULE_THREW",
+          message: `rule ${rule.id} threw while scanning ${src.file}: ${err instanceof Error ? err.message : String(err)}`,
+          ruleId: rule.id,
+          cause: err
+        });
+      }
+      for (const d of raws) {
+        if (isExempt(exemptions, d.line, rule.id)) continue;
+        diagnostics.push({
+          rule: rule.id,
+          severity,
+          file: src.file,
+          line: d.line,
+          column: d.column,
+          message: d.message,
+          ...d.fixHint !== void 0 ? { fixHint: d.fixHint } : {},
+          whyUrl: ruleDocsUrl(rule.id),
+          ...d.snippet !== void 0 ? { snippet: d.snippet } : {},
+          volatility: d.volatility ?? rule.volatility
+        });
+      }
+    }
+  }
+  diagnostics.sort(
+    (a, b) => a.file < b.file ? -1 : a.file > b.file ? 1 : a.line - b.line || a.column - b.column || (a.rule < b.rule ? -1 : a.rule > b.rule ? 1 : 0)
+  );
+  return diagnostics;
+}
+function isExempt(exemptions, line, ruleId) {
+  const set = exemptions.get(line);
+  if (set === void 0) return false;
+  return set.has("*") || set.has(ruleId);
+}
+
+export {
+  allRules,
+  getRule,
+  ruleDocsUrl,
+  runRules
+};

package/dist/chunk-WPJYUQMU.js

@@ -0,0 +1,26 @@
+// src/version.ts
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, resolve } from "path";
+function readPackageJsonVersion() {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const pkgPath = resolve(here, "..", "package.json");
+  const raw = readFileSync(pkgPath, "utf8");
+  const parsed = JSON.parse(raw);
+  if (typeof parsed === "object" && parsed !== null && "version" in parsed) {
+    const v = parsed.version;
+    if (typeof v === "string") return v;
+  }
+  throw new Error("cachelint: could not read version from package.json");
+}
+var CACHELINT_VERSION = readPackageJsonVersion();
+var NORMALIZATION_POLICY_VERSION = 1;
+var RULE_TABLE_VERSION = 1;
+var COST_MODEL_VERSION = 1;
+
+export {
+  CACHELINT_VERSION,
+  NORMALIZATION_POLICY_VERSION,
+  RULE_TABLE_VERSION,
+  COST_MODEL_VERSION
+};