codictator 0.0.0-stage → 0.1.2

package/dist/features/packs/enforcers/integrity-guards.js

@@ -0,0 +1,202 @@
+import { ok } from "../../../kernel/index.js";
+import { bindRule, findingFor, selectFiles } from "./binding.js";
+import { blankCode } from "./health-lex.js";
+import { baseEnforcer, loadScopeText, parseMarkers, } from "./health-measures.js";
+function arrowPair(text) {
+    const match = /(\d+)\s*->\s*(\d+)/.exec(text);
+    if (match === null) {
+        return undefined;
+    }
+    return [
+        Number.parseInt(match[1] ?? "0", 10),
+        Number.parseInt(match[2] ?? "0", 10),
+    ];
+}
+// SPEC §5.5 core/no-assertion-loss: a test edit that drops assertions flags.
+export function resolveNoAssertionLoss(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            const pair = arrowPair(parseMarkers(text).get("assertions") ?? text);
+            if (pair !== undefined && pair[1] < pair[0]) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `assertion count falls in ${file}`,
+                    vars: {
+                        path: file,
+                        value: `${String(pair[0])} -> ${String(pair[1])}`,
+                    },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+const SKIP_PATTERN = /(?:test|it|describe)\s*\.\s*(?:skip|only|todo)\s*\(|^\s*(?:xit|xdescribe|xtest|fit|fdescribe)\s*\(/m;
+// SPEC §5.5 core/no-skipped-tests: an added skip, only, todo or focus
+// marker flags. Skips inside strings and comments are vectors and prose,
+// not skipped tests, so the pattern runs on blanked code.
+export function resolveNoSkippedTests(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined || !SKIP_PATTERN.test(blankCode(text))) {
+                continue;
+            }
+            findings.push(findingFor(binding, {
+                path: file,
+                message: `skipped or focused test in ${file}`,
+                vars: { path: file },
+            }));
+        }
+        return findings;
+    }));
+}
+const SUPPRESSION_PATTERN = /eslint-disable|biome-ignore|@ts-ignore|@ts-expect-error|istanbul ignore|c8 ignore|#pragma warning disable|SuppressMessage|noqa|type: ignore|pragma: no cover/;
+// SPEC §5.5 core/no-new-suppressions: an added lint, type or coverage
+// suppression flags. The report is an `added:` marker line; bare words in
+// prose, vocabulary tables, pattern sources and test vectors are not
+// added suppressions.
+export function resolveNoNewSuppressions(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            const added = [...text.matchAll(/^[ \t]*added:[ \t]*(.+)$/gm)].some((match) => SUPPRESSION_PATTERN.test(match[1] ?? ""));
+            if (!added) {
+                continue;
+            }
+            findings.push(findingFor(binding, {
+                path: file,
+                message: `new suppression in ${file}`,
+                vars: { path: file },
+            }));
+        }
+        return findings;
+    }));
+}
+// SPEC §5.5 core/no-fixture-shrink: a fixture that loses rows flags.
+export function resolveNoFixtureShrink(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            const pair = arrowPair(parseMarkers(text).get("fixture-rows") ?? text);
+            if (pair !== undefined && pair[1] < pair[0]) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `fixture shrinks in ${file}`,
+                    vars: {
+                        path: file,
+                        value: `${String(pair[0])} -> ${String(pair[1])}`,
+                    },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.5 core/no-threshold-lowering: a lowered coverage floor flags.
+export function resolveNoThresholdLowering(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            const markers = parseMarkers(text);
+            for (const key of ["floor-lines", "floor-branches"]) {
+                const pair = arrowPair(markers.get(key) ?? "");
+                if (pair !== undefined && pair[1] < pair[0]) {
+                    findings.push(findingFor(binding, {
+                        path: file,
+                        message: `threshold lowered in ${file}`,
+                        vars: {
+                            path: file,
+                            limit: String(pair[0]),
+                            value: String(pair[1]),
+                        },
+                    }));
+                }
+            }
+        }
+        return findings;
+    }));
+}
+const COMMAND_WEAKENERS = [
+    "|| true",
+    "; exit 0",
+    "--passWithNoTests",
+    "continue-on-error",
+];
+// SPEC §5.5 core/test-command-intact: a weakened or narrowed test command
+// flags. The report is a `test:` marker line; substrings in prose, CI
+// docs and the guard's own source are not test commands.
+const NARROWED_FILE = /\.(ts|tsx|js|jsx|mjs|cjs|mts|cts|py|cs|go|rs)(?![\w])/;
+export function resolveTestCommandIntact(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            const weakened = [...text.matchAll(/^[ \t]*test:[ \t]*(.+)$/gm)].some((match) => {
+                const command = match[1] ?? "";
+                return (COMMAND_WEAKENERS.some((weakener) => command.includes(weakener)) || NARROWED_FILE.test(command));
+            });
+            if (!weakened) {
+                continue;
+            }
+            findings.push(findingFor(binding, {
+                path: file,
+                message: `test command weakened in ${file}`,
+                vars: { path: file },
+            }));
+        }
+        return findings;
+    }));
+}
+// SPEC §5.5 core/no-baseline-raise: a raised baseline entry flags.
+export function resolveNoBaselineRaise(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            const pair = arrowPair(parseMarkers(text).get("baseline") ?? text);
+            if (pair !== undefined && pair[1] > pair[0]) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `baseline raised in ${file}`,
+                    vars: {
+                        path: file,
+                        value: `${String(pair[0])} -> ${String(pair[1])}`,
+                    },
+                }));
+            }
+        }
+        return findings;
+    }));
+}

package/dist/features/packs/enforcers/jsonkey.d.ts

@@ -0,0 +1,13 @@
+import type { Ports } from "../../../kernel/index.ts";
+import { type Result } from "../../../kernel/index.ts";
+import type { Finding } from "../../engine/index.ts";
+import { type RuleBinding } from "./binding.ts";
+export interface JsonKeyConfig {
+    readonly file: string;
+    readonly key: string;
+    readonly mode: "required" | "forbidden";
+    readonly hasValue: boolean;
+    readonly value: unknown;
+}
+export declare function narrowJsonKeyArgs(declId: string, args: unknown): Result<JsonKeyConfig>;
+export declare function checkJsonKey(ports: Ports, binding: RuleBinding, config: JsonKeyConfig): Promise<Array<Finding>>;

package/dist/features/packs/enforcers/jsonkey.js

@@ -0,0 +1,95 @@
+// SPEC §4.4.6 json-key: a required key or value is present in a JSON file,
+// or a forbidden one is absent. Dotted paths walk records and arrays; the
+// comparison is canonical JSON, so key order never matters. Values never
+// reach a message: only the key and the file are named (§9.2).
+import { err, ok, parseJson, stableStringify, } from "../../../kernel/index.js";
+import { field, isRecord } from "../manifest.js";
+import { argsRecord, bindingError, findingFor, nonEmptyString, readErrorFinding, } from "./binding.js";
+export function narrowJsonKeyArgs(declId, args) {
+    const record = argsRecord(declId, args);
+    if (!record.ok) {
+        return err(record.error);
+    }
+    const file = field(record.value, "file");
+    const key = field(record.value, "key");
+    if (!nonEmptyString(file) || !nonEmptyString(key)) {
+        return bindingError(declId, "needs non-empty file and key strings in args");
+    }
+    const mode = field(record.value, "mode") ?? "required";
+    if (mode !== "required" && mode !== "forbidden") {
+        return bindingError(declId, "needs a mode of required or forbidden in args");
+    }
+    return ok({
+        file,
+        key,
+        mode,
+        hasValue: "value" in record.value,
+        value: field(record.value, "value"),
+    });
+}
+function atPath(document, key) {
+    let current = document;
+    for (const segment of key.split(".")) {
+        if (Array.isArray(current)) {
+            const index = Number(segment);
+            if (!Number.isInteger(index) || index < 0) {
+                return undefined;
+            }
+            current = current[index];
+        }
+        else if (isRecord(current)) {
+            current = field(current, segment);
+        }
+        else {
+            return undefined;
+        }
+        if (current === undefined) {
+            return undefined;
+        }
+    }
+    return current;
+}
+export async function checkJsonKey(ports, binding, config) {
+    const loaded = await ports.fs.readText(config.file);
+    if (!loaded.ok) {
+        return [readErrorFinding(binding, config.file, loaded.error, "read")];
+    }
+    const parsed = parseJson(loaded.value);
+    if (!parsed.ok) {
+        return [readErrorFinding(binding, config.file, parsed.error, "parse")];
+    }
+    const found = atPath(parsed.value, config.key);
+    const vars = { path: config.file, detail: config.key };
+    if (config.mode === "forbidden") {
+        if (found !== undefined) {
+            return [
+                findingFor(binding, {
+                    path: config.file,
+                    message: `forbidden key ${config.key} present in ${config.file}`,
+                    vars,
+                }),
+            ];
+        }
+        return [];
+    }
+    if (found === undefined) {
+        return [
+            findingFor(binding, {
+                path: config.file,
+                message: `required key ${config.key} absent from ${config.file}`,
+                vars,
+            }),
+        ];
+    }
+    if (config.hasValue &&
+        stableStringify(found) !== stableStringify(config.value)) {
+        return [
+            findingFor(binding, {
+                path: config.file,
+                message: `required key ${config.key} has an unexpected value in ${config.file}`,
+                vars,
+            }),
+        ];
+    }
+    return [];
+}

package/dist/features/packs/enforcers/parametric.d.ts

@@ -0,0 +1,7 @@
+import type { Ports } from "../../../kernel/index.ts";
+import { type Result } from "../../../kernel/index.ts";
+import type { Enforcer } from "../../engine/index.ts";
+import type { PackRule } from "../index.ts";
+import type { EnforcerDecl } from "../manifest.ts";
+export declare function isParametricKind(kind: string): boolean;
+export declare function resolveParametric(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer | undefined>;

package/dist/features/packs/enforcers/parametric.js

@@ -0,0 +1,138 @@
+// SPEC §4.4.6 registry: the loader resolves every parametric decl to a
+// real enforcer bound to its referencing rule. Per-kind behaviour lives in
+// the sibling kind modules; this file owns the kind set and the dispatch.
+import { err, ok } from "../../../kernel/index.js";
+import { bindingError, bindRule, isUnboundArgs, tunableNumber, } from "./binding.js";
+import { checkCommandForbid, narrowCommandForbidArgs, } from "./command-forbid.js";
+import { checkJsonKey, narrowJsonKeyArgs } from "./jsonkey.js";
+import { checkPatternForbid, checkPatternRequire, narrowPatternArgs, } from "./pattern.js";
+import { checkPlacement, narrowPlacementArgs } from "./placement.js";
+import { checkRequired, narrowRequiredArgs } from "./required.js";
+import { checkSize, narrowSizeArgs } from "./sizes.js";
+const PARAMETRIC_KINDS = [
+    "pattern-forbid",
+    "pattern-require",
+    "path-placement",
+    "file-size",
+    "file-required",
+    "command-forbid",
+    "json-key",
+];
+export function isParametricKind(kind) {
+    return PARAMETRIC_KINDS.includes(kind);
+}
+function baseEnforcer(rule, binding, decl) {
+    return { id: rule.id, kinds: binding.triggers, budgetMs: decl.budgetMs };
+}
+// A decl with no binding stays deferred instead of failing the load, so
+// frozen manifests keep loading while unbound enforcers stay inert. Only
+// file-size can bind from rule tunables alone; path-placement with no
+// config is a valid vacuous constraint.
+function unboundDecl(decl, binding) {
+    if (!isUnboundArgs(decl.args)) {
+        return false;
+    }
+    if (decl.kind === "path-placement") {
+        return false;
+    }
+    if (decl.kind === "file-size") {
+        return (tunableNumber(binding, "maxLines") === undefined &&
+            tunableNumber(binding, "maxBytes") === undefined);
+    }
+    return true;
+}
+// SPEC §4.4.3 step 4: one enforcer per referencing rule, so findings carry
+// the rule id the self-test asserts (CDX-E212/E213). An unbound decl
+// resolves to undefined and the registry defers it; unknown kinds here
+// are a wiring error and fail the load.
+export function resolveParametric(decl, rule, ports) {
+    const binding = bindRule(rule);
+    if (unboundDecl(decl, binding)) {
+        return ok(undefined);
+    }
+    switch (decl.kind) {
+        case "pattern-forbid": {
+            const config = narrowPatternArgs(decl.id, decl.args);
+            if (!config.ok) {
+                return err(config.error);
+            }
+            const resolved = config.value;
+            return ok({
+                ...baseEnforcer(rule, binding, decl),
+                check: (ctx) => checkPatternForbid(ports, binding, resolved, ctx),
+            });
+        }
+        case "pattern-require": {
+            const config = narrowPatternArgs(decl.id, decl.args);
+            if (!config.ok) {
+                return err(config.error);
+            }
+            const resolved = config.value;
+            return ok({
+                ...baseEnforcer(rule, binding, decl),
+                check: (ctx) => checkPatternRequire(ports, binding, resolved, ctx),
+            });
+        }
+        case "path-placement": {
+            const config = narrowPlacementArgs(decl.id, binding, decl.args);
+            if (!config.ok) {
+                return err(config.error);
+            }
+            const resolved = config.value;
+            return ok({
+                ...baseEnforcer(rule, binding, decl),
+                check: (ctx) => Promise.resolve(checkPlacement(binding, resolved, ctx)),
+            });
+        }
+        case "file-size": {
+            const config = narrowSizeArgs(decl.id, binding, decl.args);
+            if (!config.ok) {
+                return err(config.error);
+            }
+            const resolved = config.value;
+            return ok({
+                ...baseEnforcer(rule, binding, decl),
+                check: (ctx) => checkSize(ports, binding, resolved, ctx),
+            });
+        }
+        case "file-required": {
+            const config = narrowRequiredArgs(decl.id, decl.args);
+            if (!config.ok) {
+                return err(config.error);
+            }
+            const resolved = config.value;
+            return ok({
+                ...baseEnforcer(rule, binding, decl),
+                check: () => checkRequired(ports, binding, resolved),
+            });
+        }
+        case "command-forbid": {
+            if (isUnboundArgs(decl.args)) {
+                return ok(undefined);
+            }
+            const config = narrowCommandForbidArgs(decl.id, decl.args);
+            if (!config.ok) {
+                return err(config.error);
+            }
+            const resolved = config.value;
+            return ok({
+                ...baseEnforcer(rule, binding, decl),
+                check: (ctx) => checkCommandForbid(ports, binding, resolved, ctx),
+            });
+        }
+        case "json-key": {
+            const config = narrowJsonKeyArgs(decl.id, decl.args);
+            if (!config.ok) {
+                return err(config.error);
+            }
+            const resolved = config.value;
+            return ok({
+                ...baseEnforcer(rule, binding, decl),
+                check: () => checkJsonKey(ports, binding, resolved),
+            });
+        }
+        default: {
+            return bindingError(decl.id, `names a non-parametric kind "${decl.kind}" for this resolver`);
+        }
+    }
+}

package/dist/features/packs/enforcers/pattern.d.ts

@@ -0,0 +1,11 @@
+import type { Ports } from "../../../kernel/index.ts";
+import { type Result } from "../../../kernel/index.ts";
+import type { CheckContext, Finding } from "../../engine/index.ts";
+import { type RuleBinding } from "./binding.ts";
+export interface PatternConfig {
+    readonly pattern: RegExp;
+    readonly paths: ReadonlyArray<string>;
+}
+export declare function narrowPatternArgs(declId: string, args: unknown): Result<PatternConfig>;
+export declare function checkPatternForbid(ports: Ports, binding: RuleBinding, config: PatternConfig, ctx: CheckContext): Promise<Array<Finding>>;
+export declare function checkPatternRequire(ports: Ports, binding: RuleBinding, config: PatternConfig, ctx: CheckContext): Promise<Array<Finding>>;

package/dist/features/packs/enforcers/pattern.js

@@ -0,0 +1,88 @@
+// SPEC §4.4.6 pattern-forbid and pattern-require: a kernel-checked regex
+// over files matching globs. Forbid flags every matching line; require
+// flags every file with no matching line. No file content ever reaches a
+// message (§9.2); the per-file scan is line-wise so an unsafe pattern
+// cannot hide inside a long line.
+import { checkPattern, err, globMatch, ok, } from "../../../kernel/index.js";
+import { field } from "../manifest.js";
+import { argsRecord, bindingError, findingFor, nonEmptyString, readErrorFinding, readLossyText, selectFiles, stringList, } from "./binding.js";
+// SPEC §9.2: the kernel safety check runs before any compile, and the
+// compile itself still cannot throw past the loader. One compilation per
+// load, reused by every check.
+export function narrowPatternArgs(declId, args) {
+    const record = argsRecord(declId, args);
+    if (!record.ok) {
+        return err(record.error);
+    }
+    const raw = field(record.value, "pattern");
+    if (!nonEmptyString(raw)) {
+        return bindingError(declId, "needs a non-empty string pattern in args");
+    }
+    const safe = checkPattern(raw);
+    if (!safe.ok) {
+        return err(safe.error);
+    }
+    let pattern;
+    try {
+        pattern = new RegExp(raw);
+    }
+    catch {
+        return bindingError(declId, "carries a pattern the regex engine rejects");
+    }
+    return ok({ pattern, paths: stringList(field(record.value, "paths")) ?? [] });
+}
+function patternCandidates(binding, config, ctx) {
+    const selected = selectFiles(ctx.scope.files, binding.scopeGlobs);
+    if (config.paths.length === 0) {
+        return selected;
+    }
+    return selected.filter((file) => config.paths.some((glob) => globMatch(glob, file)));
+}
+export async function checkPatternForbid(ports, binding, config, ctx) {
+    const findings = [];
+    for (const file of patternCandidates(binding, config, ctx)) {
+        const loaded = await readLossyText(ports.fs, file);
+        if (!loaded.ok) {
+            findings.push(readErrorFinding(binding, file, loaded.error, "read"));
+            continue;
+        }
+        let line = 0;
+        for (const content of loaded.value.text.split("\n")) {
+            line += 1;
+            if (config.pattern.test(content)) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    line,
+                    message: `forbidden pattern matched ${file}:${String(line)}`,
+                    vars: { path: file, line: String(line) },
+                }));
+            }
+        }
+    }
+    return findings;
+}
+export async function checkPatternRequire(ports, binding, config, ctx) {
+    const findings = [];
+    for (const file of patternCandidates(binding, config, ctx)) {
+        const loaded = await readLossyText(ports.fs, file);
+        if (!loaded.ok) {
+            findings.push(readErrorFinding(binding, file, loaded.error, "read"));
+            continue;
+        }
+        let matched = false;
+        for (const content of loaded.value.text.split("\n")) {
+            if (config.pattern.test(content)) {
+                matched = true;
+                break;
+            }
+        }
+        if (!matched) {
+            findings.push(findingFor(binding, {
+                path: file,
+                message: `required pattern absent from ${file}`,
+                vars: { path: file },
+            }));
+        }
+    }
+    return findings;
+}

package/dist/features/packs/enforcers/placement.d.ts

@@ -0,0 +1,10 @@
+import { type Result } from "../../../kernel/index.ts";
+import type { CheckContext, Finding } from "../../engine/index.ts";
+import { type RuleBinding } from "./binding.ts";
+export interface PlacementConfig {
+    readonly paths: ReadonlyArray<string>;
+    readonly allowed: ReadonlyArray<string>;
+    readonly denied: ReadonlyArray<string>;
+}
+export declare function narrowPlacementArgs(declId: string, binding: RuleBinding, args: unknown): Result<PlacementConfig>;
+export declare function checkPlacement(binding: RuleBinding, config: PlacementConfig, ctx: CheckContext): Array<Finding>;

package/dist/features/packs/enforcers/placement.js

@@ -0,0 +1,54 @@
+// SPEC §4.4.6 path-placement: files live in allowed locations, never in
+// denied ones. The allowedGlobs tunable is additive (§5.10): the pack args
+// and the rule tunable unite, so either layer can own locations.
+import { err, globMatch, ok } from "../../../kernel/index.js";
+import { field } from "../manifest.js";
+import { argsRecord, bindingError, findingFor, selectFiles, stringList, tunableStringList, } from "./binding.js";
+function unionSorted(lists) {
+    return [...new Set(lists.flat())].sort();
+}
+export function narrowPlacementArgs(declId, binding, args) {
+    const record = argsRecord(declId, args);
+    if (!record.ok) {
+        return err(record.error);
+    }
+    const allowed = unionSorted([
+        stringList(field(record.value, "allowedGlobs")) ?? [],
+        tunableStringList(binding, "allowedGlobs") ?? [],
+    ]);
+    const denied = unionSorted([
+        stringList(field(record.value, "deniedGlobs")) ?? [],
+        tunableStringList(binding, "deniedGlobs") ?? [],
+    ]);
+    const paths = stringList(field(record.value, "paths")) ?? [];
+    for (const glob of [...paths, ...allowed, ...denied]) {
+        if (glob.length === 0) {
+            return bindingError(declId, "needs non-empty globs in args");
+        }
+    }
+    return ok({ paths, allowed, denied });
+}
+export function checkPlacement(binding, config, ctx) {
+    const selected = selectFiles(ctx.scope.files, binding.scopeGlobs);
+    const candidates = config.paths.length === 0
+        ? selected
+        : selected.filter((file) => config.paths.some((glob) => globMatch(glob, file)));
+    const findings = [];
+    for (const file of candidates) {
+        const denied = config.denied.some((glob) => globMatch(glob, file));
+        const allowed = config.allowed.length === 0 ||
+            config.allowed.some((glob) => globMatch(glob, file));
+        if (!denied && allowed) {
+            continue;
+        }
+        const reason = denied
+            ? "in a denied location"
+            : "outside its allowed locations";
+        findings.push(findingFor(binding, {
+            path: file,
+            message: `file ${reason}: ${file}`,
+            vars: { path: file },
+        }));
+    }
+    return findings;
+}

package/dist/features/packs/enforcers/py-checks.d.ts

@@ -0,0 +1,7 @@
+import type { Ports } from "../../../kernel/index.ts";
+import { type Result } from "../../../kernel/index.ts";
+import type { Enforcer } from "../../engine/index.ts";
+import type { PackRule } from "../index.ts";
+import type { EnforcerDecl } from "../manifest.ts";
+export declare function resolvePythonTypecheck(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolvePythonLint(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;