codictator 0.0.0 → 0.1.2

package/dist/features/adapters/opencode-tables.js

@@ -0,0 +1,63 @@
+import { normalizeToolName } from "./contract.js";
+// SPEC §4.5.3: per-adapter table. OpenCode tool names are unverified until a
+// first-party capture (§4.5.7); an unknown name maps to other and is still
+// seen by tool.pre.other rules.
+export const OPENCODE_TOOL_TABLE = {
+    write: "write",
+    edit: "write",
+    notebookedit: "write",
+    create: "write",
+    apply_patch: "write",
+    bash: "shell",
+    shell: "shell",
+    exec: "shell",
+    terminal: "shell",
+    bashoutput: "shell",
+    read: "read",
+    cat: "read",
+    view: "read",
+    glob: "search",
+    grep: "search",
+    search: "search",
+    find: "search",
+    ls: "search",
+    webfetch: "web",
+    websearch: "web",
+    fetch: "web",
+    curl: "web",
+    task: "task",
+    todo: "task",
+    todowrite: "task",
+    todoread: "task",
+};
+export function normalizeOpenCodeToolName(name) {
+    return normalizeToolName(OPENCODE_TOOL_TABLE, name);
+}
+// SPEC §4.5.3: OpenCode events to normalised triggers. The per-prompt hooks
+// (chat.message, the experimental transform) both feed the prompt trigger:
+// the bridge spawns prompt.submit and caches the returned additionalContext,
+// so the launcher evaluates the same steering content either way (EC-22).
+const OPENCODE_EVENT_TABLE = {
+    "tool.execute.before": "pre-tool",
+    "tool.pre.write": "pre-tool",
+    "tool.pre.shell": "pre-tool",
+    "tool.pre.read": "pre-tool",
+    "tool.pre.search": "pre-tool",
+    "tool.pre.other": "pre-tool",
+    "tool.execute.after": "post-tool",
+    "tool.post.write": "post-tool",
+    "session.idle": "post-tool",
+    "message.updated": "post-tool",
+    stop: "post-tool",
+    "session.created": "startup",
+    "session.start": "startup",
+    "session.compacted": "compact",
+    "experimental.session.compacting": "compact",
+    "compact.post": "compact",
+    "prompt.submit": "prompt",
+    "chat.message": "prompt",
+    "experimental.chat.system.transform": "prompt",
+};
+export function mapOpenCodeEvent(event) {
+    return OPENCODE_EVENT_TABLE[event];
+}

package/dist/features/adapters/opencode.d.ts

@@ -0,0 +1,10 @@
+import type { Adapter, HookDecision, HookReply } from "./contract.ts";
+import { parseOpenCodeEvent } from "./opencode-parse.ts";
+import { normalizeOpenCodeToolName } from "./opencode-tables.ts";
+export { normalizeOpenCodeToolName, parseOpenCodeEvent };
+export declare function replyOpenCode(decision: HookDecision): HookReply;
+export declare function staticBlockOpenCode(code: string, message: string): HookReply;
+export declare const OPENCODE_VERSION_MINIMUM = "1.15.0";
+export declare const OPENCODE_VERSION_MAXIMUM_EXCLUSIVE = "2.0.0";
+export declare function isOpenCodeVersionSupported(version: string): boolean;
+export declare const opencodeAdapter: Adapter;

package/dist/features/adapters/opencode.js

@@ -0,0 +1,97 @@
+// SPEC §4.5.4: the OpenCode adapter. Parse, reply and staticBlock are pure;
+// hookIoVerified stays false until a first-party capture lands (§4.5.7).
+// Tables live in opencode-tables.ts and payload narrowing in
+// opencode-parse.ts; this file owns the reply/render/adapter assembly and
+// keeps the original barrel path, so existing imports keep working.
+import { stableStringify } from "../../kernel/index.js";
+import { OPENCODE_BRIDGE_SOURCE } from "./opencode-bridge.js";
+import { OPENCODE_CAPABILITIES } from "./opencode-capabilities.js";
+import { parseOpenCodeEvent } from "./opencode-parse.js";
+import { normalizeOpenCodeToolName } from "./opencode-tables.js";
+export { normalizeOpenCodeToolName, parseOpenCodeEvent };
+// SPEC §4.5.4 with S29: the wire is Codictator's own HookDecision JSON on
+// stdout, exit 0. The bridge throws on a block reply, so gating stays closed.
+export function replyOpenCode(decision) {
+    return {
+        exitCode: 0,
+        stdout: JSON.stringify({
+            decision: decision.decision,
+            ...(decision.message === undefined ? {} : { message: decision.message }),
+            ...(decision.additionalContext === undefined
+                ? {}
+                : { additionalContext: decision.additionalContext }),
+            eventId: decision.eventId,
+        }),
+        stderr: "",
+    };
+}
+// SPEC §4.5.1: the pre-engine deny form, embedded by regen for CDX-E002 and
+// CDX-E003. No engine state, so it works when the engine is missing.
+export function staticBlockOpenCode(code, message) {
+    return replyOpenCode({
+        decision: "block",
+        message: `${code} ${message}`,
+        eventId: "static",
+    });
+}
+// SPEC §4.5.4 OpenCode version range (SPEC §11 S32): the hooks above exist
+// in the type definitions across >=1.15.0 <2.0.0. status compares
+// opencode --version against this range (EC-24); outside it, L1 and
+// contextInject show unknown while L3 and L4 keep enforcing.
+export const OPENCODE_VERSION_MINIMUM = "1.15.0";
+export const OPENCODE_VERSION_MAXIMUM_EXCLUSIVE = "2.0.0";
+function versionParts(version) {
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(version.trim());
+    if (match === null) {
+        return undefined;
+    }
+    const parts = match.slice(1, 4).map((part) => Number(part));
+    if (parts.some((part) => !Number.isSafeInteger(part))) {
+        return undefined;
+    }
+    return parts;
+}
+function compareVersions(left, right) {
+    for (let index = 0; index < 3; index += 1) {
+        const a = left[index] ?? 0;
+        const b = right[index] ?? 0;
+        if (a !== b) {
+            return a < b ? -1 : 1;
+        }
+    }
+    return 0;
+}
+export function isOpenCodeVersionSupported(version) {
+    const seen = versionParts(version);
+    const minimum = versionParts(OPENCODE_VERSION_MINIMUM);
+    const maximum = versionParts(OPENCODE_VERSION_MAXIMUM_EXCLUSIVE);
+    if (seen === undefined || minimum === undefined || maximum === undefined) {
+        return false;
+    }
+    return (compareVersions(seen, minimum) >= 0 && compareVersions(seen, maximum) < 0);
+}
+// SPEC §4.5.4: owned opencode.json keys. Bypass-command deny patterns come
+// from §4.14.3 in phase 9; until then the owned list is empty.
+function renderOpenCodeJson() {
+    return stableStringify({
+        compaction: { auto: true },
+        permission: { bash: [] },
+    });
+}
+function renderOpenCode(_input) {
+    return [
+        {
+            path: ".opencode/plugins/codictator.mjs",
+            content: OPENCODE_BRIDGE_SOURCE,
+        },
+        { path: "opencode.json", content: renderOpenCodeJson() },
+    ];
+}
+export const opencodeAdapter = {
+    id: "opencode",
+    capabilities: OPENCODE_CAPABILITIES,
+    render: renderOpenCode,
+    parse: parseOpenCodeEvent,
+    reply: replyOpenCode,
+    staticBlock: staticBlockOpenCode,
+};

package/dist/features/adapters/runtime.d.ts

@@ -0,0 +1,25 @@
+import type { Clock, Env, Net, Ports, Proc, Result } from "../../kernel/index.ts";
+import type { Enforcer, EngineOptions } from "../engine/index.ts";
+import type { HookReply } from "./contract.ts";
+export interface HookBasePorts {
+    readonly proc: Proc;
+    readonly net: Net;
+    readonly clock: Clock;
+    readonly env: Env;
+}
+export type HookAppend = (repoRoot: string, event: Parameters<NonNullable<EngineOptions["append"]>>[0]) => Promise<Result<void>>;
+export interface HookRunRequest {
+    readonly harness: string;
+    readonly event: string;
+    readonly stdinText: string;
+    readonly cwd: string;
+    readonly ports: HookBasePorts;
+    readonly append: HookAppend;
+    readonly budgetMs?: number;
+    readonly engineVersion?: string;
+    readonly loadEnforcers?: HookEnforcerLoader;
+}
+export type HookEnforcerLoader = (ports: Ports, packIds: ReadonlyArray<string>) => Promise<Result<ReadonlyArray<Enforcer>>>;
+export declare function runHookEvent(request: HookRunRequest): Promise<HookReply>;
+export declare function supportedHarness(harness: string): boolean;
+export declare function staticBlock(harness: string, code: string, message: string): HookReply | undefined;

package/dist/features/adapters/runtime.js

@@ -0,0 +1,148 @@
+import { NodeFs, NodeGit, parseJson } from "../../kernel/index.js";
+import { ENGINE_VERSION } from "../config/index.js";
+import { createEngine } from "../engine/index.js";
+import { HOOK_PAYLOAD_MAX_BYTES } from "./contract.js";
+import { adapterFor, allowReply, blockReply, hookBudgetMs, stopHookActive, unknownHarnessReply, } from "./hook-dispatch.js";
+import { emitInjectionEvent } from "./hook-injection.js";
+import { errorCodeOf, errorMessageOf, hookEnv, loadEffective, resolveRoot, } from "./hook-load.js";
+import { hookScope } from "./hook-scope.js";
+// SPEC §4.19.3: any uncaught error blocks CDX-E901; the time limit blocks
+// CDX-E902. Both replies go through the adapter so the harness gates
+// closed in its own deny form.
+export async function runHookEvent(request) {
+    const adapter = adapterFor(request.harness);
+    if (adapter === undefined) {
+        return unknownHarnessReply(request.harness);
+    }
+    try {
+        return await runHookInner(request, adapter);
+    }
+    catch {
+        return blockReply(adapter, "CDX-E901", "the hook runtime failed before replying");
+    }
+}
+async function runHookInner(request, adapter) {
+    if (new TextEncoder().encode(request.stdinText).length > HOOK_PAYLOAD_MAX_BYTES) {
+        return blockReply(adapter, "CDX-E305", "hook payload over 8 MiB is refused; write the file in smaller edits");
+    }
+    if (request.stdinText.trim() === "") {
+        return blockReply(adapter, "CDX-E303", "hook stdin is empty");
+    }
+    const parsed = parseJson(request.stdinText);
+    if (!parsed.ok) {
+        return blockReply(adapter, "CDX-E303", "hook payload is not JSON");
+    }
+    const raw = parsed.value;
+    const hookEvent = adapter.parse(request.event, raw);
+    if (!hookEvent.ok) {
+        return blockReply(adapter, hookEvent.error.code, hookEvent.error.message);
+    }
+    const event = hookEvent.value;
+    const root = await resolveRoot(request.ports, event.cwd === "" ? request.cwd : event.cwd);
+    if (root === undefined) {
+        return allowReply(adapter, "no-root");
+    }
+    if (stopHookActive(adapter, event, raw)) {
+        return allowReply(adapter, "stop-active");
+    }
+    const effective = await loadEffective(request.ports, root, adapter, request.engineVersion ?? ENGINE_VERSION);
+    if (!effective.ok) {
+        return effective.reply;
+    }
+    const fsMade = await NodeFs.create({ root });
+    if (!fsMade.ok) {
+        return blockReply(adapter, "CDX-E801", fsMade.error.message);
+    }
+    if (request.loadEnforcers === undefined) {
+        return blockReply(adapter, "CDX-E901", "the hook cannot evaluate without enforcers");
+    }
+    const ports = {
+        fs: fsMade.value,
+        proc: request.ports.proc,
+        net: request.ports.net,
+        clock: request.ports.clock,
+        git: new NodeGit(request.ports.proc, root),
+        env: hookEnv(request.ports.env),
+    };
+    const loaded = await request.loadEnforcers(ports, effective.value.config.packs.map((entry) => entry.id));
+    if (!loaded.ok) {
+        return blockReply(adapter, errorCodeOf(loaded.error, "CDX-E203"), errorMessageOf(loaded.error));
+    }
+    const engine = createEngine(loaded.value, {
+        configHash: effective.value.configHash,
+        append: (verdict) => request.append(root, verdict),
+    });
+    const scope = hookScope(event, root);
+    // SPEC §4.6.3 + §4.18.3: the L0 triggers render the scoped injection
+    // and land the auditable event before evaluation, so the status row
+    // reads live evidence even when the verdict blocks. An unwritable log
+    // blocks CDX-E801, like the verdict path.
+    const injected = await emitInjectionEvent({
+        event,
+        scope,
+        steering: effective.value.config.steering,
+        configHash: effective.value.configHash,
+        root,
+        append: request.append,
+    });
+    if (!injected.ok) {
+        return blockReply(adapter, injected.error.code, injected.error.message);
+    }
+    const budgetMs = hookBudgetMs(request.harness, request.budgetMs);
+    const timeoutSignal = Symbol("hook-timeout");
+    let timer;
+    try {
+        const pending = engine.evaluate(event.trigger, scope, request.ports.clock.now());
+        const verdict = await Promise.race([
+            pending,
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => {
+                    reject(timeoutSignal);
+                }, budgetMs);
+            }),
+        ]);
+        if (verdict.decision === "block" || verdict.decision === "escalate") {
+            return adapter.reply({
+                decision: "block",
+                message: verdict.message,
+                eventId: verdict.eventId,
+            });
+        }
+        // Muse Code has no advise form: without steering injection (phase 9)
+        // an advise collapses to allow. OpenCode carries it on the wire.
+        if (verdict.decision === "advise" &&
+            verdict.message !== "" &&
+            adapter.id === "opencode") {
+            return adapter.reply({
+                decision: "advise",
+                message: verdict.message,
+                eventId: verdict.eventId,
+            });
+        }
+        return adapter.reply({ decision: "allow", eventId: verdict.eventId });
+    }
+    catch (error) {
+        if (error === timeoutSignal) {
+            return blockReply(adapter, "CDX-E902", "the hook exceeded its time limit");
+        }
+        throw error;
+    }
+    finally {
+        if (timer !== undefined) {
+            clearTimeout(timer);
+        }
+    }
+}
+export function supportedHarness(harness) {
+    return adapterFor(harness) !== undefined;
+}
+// The pre-engine deny in the harness's own form (SPEC §4.5.1): staticBlock
+// carries no engine state, so the launcher and the CLI start path use it
+// when the engine cannot run (CDX-E002, CDX-E003).
+export function staticBlock(harness, code, message) {
+    const adapter = adapterFor(harness);
+    if (adapter === undefined) {
+        return undefined;
+    }
+    return adapter.staticBlock(code, message);
+}

package/dist/features/adapters/universal.d.ts

@@ -0,0 +1,7 @@
+import type { Result } from "../../kernel/index.ts";
+import type { Adapter, CapabilityDeclaration, HookDecision, HookEvent, HookReply } from "./contract.ts";
+export declare const UNIVERSAL_CAPABILITIES: CapabilityDeclaration;
+export declare function parseUniversalEvent(event: string, _raw: unknown): Result<HookEvent>;
+export declare function replyUniversal(decision: HookDecision): HookReply;
+export declare function staticBlockUniversal(code: string, message: string): HookReply;
+export declare const universalAdapter: Adapter;

package/dist/features/adapters/universal.js

@@ -0,0 +1,89 @@
+import { err, makeError } from "../../kernel/index.js";
+export const UNIVERSAL_CAPABILITIES = {
+    harness: "universal",
+    adapterVersion: "0.0.0",
+    verifiedAgainst: {
+        version: "1.0.0",
+        date: "2026-10-26",
+        source: "no vendor release; fixture note packages/codictator/fixtures/harness/universal/1.0.0 (§4.5.7)",
+    },
+    layers: {
+        L0: "native",
+        L1: "none",
+        L2: "none",
+        L3: "native",
+        L4: "native",
+        L5: "none",
+    },
+    controls: {
+        contextFile: true,
+        contextInject: false,
+        postCompactInject: false,
+        promptBlock: false,
+        preToolBlock: false,
+        readBlock: false,
+        postToolFeedback: false,
+        autoCompactConfig: "none",
+        forceCompact: false,
+        forceClear: false,
+        usageData: "none",
+        skills: false,
+        subagents: false,
+        commands: false,
+        projectPermissions: false,
+        trustRequired: false,
+        timeoutFailMode: "unknown",
+        launcherMissingFailMode: "unknown",
+        hookIoVerified: false,
+        projectRootSource: "git",
+        agentEnvMarkers: [],
+    },
+    gaps: [
+        "no native hook traffic: L1 is none by design, never verified",
+        "git-hook and CI enforcement land with phases 9.5 and 9.6",
+    ],
+};
+// SPEC §4.5.4: no native hook traffic exists, so any hook payload fails
+// closed with CDX-E303. This is unreachable through regen (no hook command
+// is ever installed for universal); it only guards a hand-run launcher.
+export function parseUniversalEvent(event, _raw) {
+    return err(makeError("CDX-E303", `unparseable universal hook payload: no hook traffic for ${event}`, "Configure a native harness adapter, or rely on git hooks and CI."));
+}
+// SPEC §4.5.1: the static deny form. Universal has no native deny shape, so
+// the wire is Codictator's own HookDecision JSON, the same wire the OpenCode
+// bridge already speaks (§7.8).
+export function replyUniversal(decision) {
+    return {
+        exitCode: 0,
+        stdout: JSON.stringify({
+            decision: decision.decision,
+            ...(decision.message === undefined ? {} : { message: decision.message }),
+            ...(decision.additionalContext === undefined
+                ? {}
+                : { additionalContext: decision.additionalContext }),
+            eventId: decision.eventId,
+        }),
+        stderr: "",
+    };
+}
+export function staticBlockUniversal(code, message) {
+    return replyUniversal({
+        decision: "block",
+        message: `${code} ${message}`,
+        eventId: "static",
+    });
+}
+// SPEC §4.5.4: universal owns no harness-native files. AGENTS.md is rendered
+// by steering (§4.6.2), the git hooks by integrity (§4.14.4) and the workflow
+// by CI (§4.15); this render stays empty so regen never writes a file here.
+function renderUniversal(_input) {
+    return [];
+}
+export const universalAdapter = {
+    id: "universal",
+    capabilities: UNIVERSAL_CAPABILITIES,
+    render: renderUniversal,
+    parse: parseUniversalEvent,
+    reply: replyUniversal,
+    staticBlock: staticBlockUniversal,
+};

package/dist/features/arch/arch-profiles.d.ts

@@ -0,0 +1,3 @@
+export declare const ARCH_PROFILES: readonly ["app", "library", "cli", "service"];
+export type ArchProfile = (typeof ARCH_PROFILES)[number];
+export declare function isArchProfile(value: string): value is ArchProfile;

package/dist/features/arch/arch-profiles.js

@@ -0,0 +1,5 @@
+// SPEC §4.11.1: the four profiles and the module kinds each one allows.
+export const ARCH_PROFILES = ["app", "library", "cli", "service"];
+export function isArchProfile(value) {
+    return ARCH_PROFILES.includes(value);
+}

package/dist/features/arch/checks.d.ts

@@ -0,0 +1,25 @@
+import type { CheckContext, Finding } from "../engine/index.ts";
+import type { ModuleNode } from "./index.ts";
+import { type ArchDenyRule } from "./module-mapping.ts";
+export interface ArchCheckOptions {
+    readonly modules?: ReadonlyArray<ModuleNode>;
+    readonly profile?: string;
+    readonly layerDirs?: ReadonlyArray<string>;
+    readonly deny?: ReadonlyArray<ArchDenyRule>;
+}
+export declare function checkArchProfile(profile: string | undefined, modules: ReadonlyArray<ModuleNode>): Array<Finding>;
+export interface ModuleSizeSummary {
+    readonly module: string;
+    readonly files: number;
+    readonly lines: number;
+}
+export interface ModuleSizeLimits {
+    readonly maxFiles?: number;
+    readonly maxLines?: number;
+}
+export declare function checkModuleSize(summary: ReadonlyArray<ModuleSizeSummary>, limits?: ModuleSizeLimits): Array<Finding>;
+export declare function checkArch(ctx: CheckContext, refs: ReadonlyArray<{
+    readonly from: string;
+    readonly to: string;
+    readonly line: number;
+}>, options?: ArchCheckOptions): Promise<Array<Finding>>;

package/dist/features/arch/checks.js

@@ -0,0 +1,173 @@
+import { isArchProfile } from "./arch-profiles.js";
+import { findModuleCycle } from "./cycle-walk.js";
+import { checkResolvedEdge, resolveEdge, } from "./edge-checks.js";
+import { deriveModules, mappedFinding, } from "./module-mapping.js";
+// SPEC §4.11.4 core/arch-no-cycles: Tarjan over the resolved module edges;
+// L1 judges only cycles through new edges, so the message prints the cycle.
+function addEdgeToGraph(depends, edgeAt, edge) {
+    if (edge.fromMod === undefined ||
+        edge.toMod === undefined ||
+        edge.fromMod.name === edge.toMod.name) {
+        return;
+    }
+    const list = depends.get(edge.fromMod.name) ?? [];
+    if (!list.includes(edge.toMod.name)) {
+        list.push(edge.toMod.name);
+        list.sort();
+    }
+    depends.set(edge.fromMod.name, list);
+    const key = `${edge.fromMod.name}|${edge.toMod.name}`;
+    if (!edgeAt.has(key)) {
+        edgeAt.set(key, edge);
+    }
+}
+function collectArchGraph(edges) {
+    const depends = new Map();
+    const edgeAt = new Map();
+    for (const edge of edges) {
+        addEdgeToGraph(depends, edgeAt, edge);
+    }
+    return { depends, edgeAt };
+}
+function cycleFindingFor(cycle, edgeAt) {
+    const finding = {
+        ruleId: "core/arch-no-cycles",
+        message: `module cycle closes through new edges: ${cycle.join(" -> ")}`,
+        remediation: "Remove one edge of the cycle, or merge the modules.",
+    };
+    const first = edgeAt.get(`${cycle[0]}|${cycle[1] ?? ""}`);
+    if (first === undefined) {
+        return finding;
+    }
+    return { ...finding, path: first.from, line: first.line };
+}
+function checkCycles(edges) {
+    const { depends, edgeAt } = collectArchGraph(edges);
+    const names = [...depends.keys()].sort();
+    const cycle = findModuleCycle(names, depends);
+    if (cycle === undefined) {
+        return [];
+    }
+    return [cycleFindingFor(cycle, edgeAt)];
+}
+// SPEC §4.11.4 core/arch-profile-declared: the profile is set and every
+// module kind is valid for it.
+export function checkArchProfile(profile, modules) {
+    if (profile === undefined) {
+        return [];
+    }
+    if (!isArchProfile(profile)) {
+        return [
+            {
+                ruleId: "core/arch-profile-declared",
+                message: `unknown architecture profile "${profile}"`,
+                remediation: "Use one of app, library, cli or service (SPEC §4.11.1).",
+            },
+        ];
+    }
+    const valid = {
+        app: ["feature", "shared", "kernel", "composition"],
+        library: ["public", "internal", "kernel"],
+        cli: ["command", "feature", "kernel", "composition"],
+        service: ["transport", "feature", "shared", "kernel", "composition"],
+    };
+    const allowed = valid[profile] ?? [];
+    return modules
+        .filter((mod) => mod.kind !== undefined && !allowed.includes(mod.kind))
+        .map((mod) => ({
+        ruleId: "core/arch-profile-declared",
+        message: `module ${mod.name} has kind "${mod.kind ?? ""}", invalid for profile ${profile}`,
+        remediation: `Give the module a kind ${profile} allows (${allowed.join(", ")}).`,
+    }));
+}
+// SPEC §4.11.4 core/arch-module-size: the fitness function over per-module
+// file and line counts. Without limits it only reports the summary.
+export function checkModuleSize(summary, limits = {}) {
+    const findings = [];
+    for (const row of summary) {
+        if (limits.maxFiles !== undefined && row.files > limits.maxFiles) {
+            findings.push({
+                ruleId: "core/arch-module-size",
+                message: `module ${row.module} holds ${row.files} files, over the limit ${limits.maxFiles}`,
+                remediation: "Split the module along responsibilities, never mechanically at the limit.",
+            });
+        }
+        if (limits.maxLines !== undefined && row.lines > limits.maxLines) {
+            findings.push({
+                ruleId: "core/arch-module-size",
+                message: `module ${row.module} holds ${row.lines} lines, over the limit ${limits.maxLines}`,
+                remediation: "Split the module along responsibilities, never mechanically at the limit.",
+            });
+        }
+    }
+    return findings;
+}
+function findingKey(finding) {
+    return JSON.stringify([
+        finding.ruleId,
+        finding.path ?? "",
+        finding.line ?? 0,
+        finding.code ?? "",
+        finding.message,
+    ]);
+}
+function compareFindings(left, right) {
+    if (left.ruleId !== right.ruleId) {
+        return left.ruleId < right.ruleId ? -1 : 1;
+    }
+    const leftPath = left.path ?? "";
+    const rightPath = right.path ?? "";
+    if (leftPath !== rightPath) {
+        return leftPath < rightPath ? -1 : 1;
+    }
+    return (left.line ?? 0) - (right.line ?? 0);
+}
+function dedupeFindings(findings) {
+    const seen = new Set();
+    const kept = [];
+    for (const finding of findings) {
+        const key = findingKey(finding);
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        kept.push(finding);
+    }
+    kept.sort(compareFindings);
+    return kept;
+}
+// SPEC §4.11.4: the boundary and layering checks for the evaluation path.
+// Without a configured map the modules derive from the refs and every
+// cross-module edge fails closed, so L1 blocks a violation before it exists.
+export async function checkArch(ctx, refs, options = {}) {
+    void ctx;
+    const modules = options.modules ?? deriveModules(refs);
+    const profile = options.profile ?? "app";
+    const layerDirs = options.layerDirs ?? [];
+    const deny = options.deny ?? [];
+    const ordered = [...refs].sort((left, right) => left.from < right.from
+        ? -1
+        : left.from > right.from
+            ? 1
+            : left.line - right.line);
+    const edges = ordered.map((ref) => resolveEdge(modules, ref.from, ref.line, ref.to));
+    const findings = [];
+    const unmappedFrom = new Map();
+    for (const edge of edges) {
+        if (edge.fromMod === undefined) {
+            const first = unmappedFrom.get(edge.from);
+            if (first === undefined || edge.line < first) {
+                unmappedFrom.set(edge.from, edge.line);
+            }
+        }
+    }
+    for (const from of [...unmappedFrom.keys()].sort()) {
+        findings.push(mappedFinding(from, unmappedFrom.get(from) ?? 1, `source file ${from} sits outside every architecture module`));
+    }
+    for (const edge of edges) {
+        findings.push(...checkResolvedEdge(edge, profile, layerDirs, deny));
+    }
+    findings.push(...checkCycles(edges));
+    findings.push(...checkArchProfile(options.profile, modules));
+    return dedupeFindings(findings);
+}

package/dist/features/arch/codictator-modules.d.ts

@@ -0,0 +1,4 @@
+import type { ArchProfile } from "./arch-profiles.ts";
+import type { ModuleNode } from "./index.ts";
+export declare const CODICTATOR_PROFILE: ArchProfile;
+export declare const CODICTATOR_MODULES: ReadonlyArray<ModuleNode>;