limina 0.0.1 → 0.0.2

package/cli.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import "./chunks/dep-lkQg1P9Q.js";
 import { d as normalizeSlashes, f as normalizeWorkspacePath, h as toRelativePath, i as loadConfig, l as isPathInsideDirectory, m as toPosixPath, n as getActiveCheckerExtensions, p as toAbsolutePath, r as getActiveCheckers, u as normalizeAbsolutePath } from "./chunks/dep-jgc7X0zw.js";
-import { A as collectImporters, B as createFormatHost, C as inferPackageProject$1, D as parseProject$1, E as isWorkspacePackageFile, F as collectGraphProjectRoute, G as isOrdinaryTypecheckConfigPath, H as getDtsCompanionConfigPath, I as collectGraphProjectRouteFromRoot, J as readJsonConfig, K as parseProjectFileNames, L as collectGraphProjectRoutes, M as findPackageForSpecifier, N as getPackageRootSpecifier, O as resolveInternalImport$1, P as collectCheckerEntryProjectRoutes, S as getTypecheckConfigPath, T as isRelativeSpecifier, U as getRawReferencePaths, V as formatReferences, W as isDtsConfigPath, X as resolveReferencePath, Y as resolveProjectConfigPath, _ as createFileOwnerLookup$1, a as runSourceCheck, b as findTargetProject, c as PackageLogger, d as clearCliScreen, f as formatErrorMessage$1, g as collectImportsFromFile$1, h as normalizeGraphRules, i as runCheckerTypecheck, j as collectWorkspacePackages, k as shouldResolveThroughGraph$1, l as PathsLogger, m as getDeniedWorkspaceDepRule, n as createLiminaFlowReporter, o as CliLogger, p as getDeniedRefRule, q as parseProjectFileNamesForExtensions, r as runCheckerBuild, s as GraphLogger, u as ProofLogger, v as findImporterForFile$1, w as isDtsProjectConfig, x as formatArtifactDependencyPolicy, y as findPackageForFile, z as createExtensionPattern } from "./chunks/dep-DoSHsBSP.js";
+import { A as shouldResolveThroughGraph$1, B as createExtensionPattern, C as formatArtifactDependencyPolicy, D as isRelativeSpecifier, E as isDtsProjectConfig, F as collectCheckerEntryProjectRoutes, G as isDtsConfigPath, H as formatReferences, I as collectGraphProjectRoute, J as parseProjectFileNamesForExtensions, K as isOrdinaryTypecheckConfigPath, L as collectGraphProjectRouteFromRoot, M as collectWorkspacePackages, N as findPackageForSpecifier, O as parseProject$1, P as getPackageRootSpecifier, R as collectGraphProjectRoutes, S as findTargetProject, T as inferPackageProject$1, U as getDtsCompanionConfigPath, V as createFormatHost, W as getRawReferencePaths, X as resolveProjectConfigPath, Y as readJsonConfig, Z as resolveReferencePath, _ as normalizeGraphRules, a as runSourceCheck, b as findImporterForFile$1, c as GraphLogger, d as ProofLogger, f as clearCliScreen, g as getDeniedRefRule, h as getDeniedDepRuleForSpecifier, i as runCheckerTypecheck, j as collectImporters, k as resolveInternalImport$1, l as PackageLogger, m as getDeniedDepRuleForPackage, n as createLiminaFlowReporter, o as runInit, p as formatErrorMessage$1, q as parseProjectFileNames, r as runCheckerBuild, s as CliLogger, u as PathsLogger, v as collectImportsFromFile$1, w as getTypecheckConfigPath, x as findPackageForFile, y as createFileOwnerLookup$1 } from "./chunks/dep-uPXyoC0V.js";
 import { builtinModules } from "node:module";
 import { cac } from "cac";
-import { createElapsedTimer } from "@docs-islands/logger/helper";
+import { createElapsedTimer } from "logaria/helper";
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import ts from "typescript";
 import { spawn, spawnSync } from "node:child_process";
 import { glob } from "tinyglobby";
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { checkPackage, createPackageFromTarballData } from "@arethetypeswrong/core";
 import { pack } from "@publint/pack";
 import { init, parse } from "es-module-lexer";
-import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { publint } from "publint";
 import { formatMessage } from "publint/utils";
@@ -146,7 +146,7 @@ function addDeniedReferenceProblems(options) {
 		if (!options.projectsByPath.has(referencePath)) continue;
 		const deniedRefRule = getDeniedRefRule(options.rules, options.project.label, referencePath);
 		const targetPackage = findPackageForFile(referencePath, options.packages);
-		const deniedDepRule = targetPackage ? getDeniedWorkspaceDepRule(options.rules, options.project.label, targetPackage.name) : null;
+		const deniedDepRule = targetPackage ? getDeniedDepRuleForPackage(options.rules, options.project.label, targetPackage.name) : null;
 		if (!deniedRefRule && !deniedDepRule) continue;
 		const lines = [
 			"Denied graph access:",
@@ -154,12 +154,12 @@ function addDeniedReferenceProblems(options) {
 			`  referencing project: ${toRelativePath(options.config.rootDir, options.project.configPath)}`,
 			`  referenced project: ${toRelativePath(options.config.rootDir, referencePath)}`
 		];
-		if (deniedRefRule) lines.push(`  denied ref: ${toRelativePath(options.config.rootDir, deniedRefRule.path)}`, `  reason: ${deniedRefRule.reason}`);
-		else if (deniedDepRule) lines.push(`  denied dependency: ${deniedDepRule.name}`, `  reason: ${deniedDepRule.reason}`);
+		if (deniedDepRule) lines.push(`  denied dependency: ${deniedDepRule.name}`, `  reason: ${deniedDepRule.reason}`);
+		else if (deniedRefRule) lines.push(`  denied ref: ${toRelativePath(options.config.rootDir, deniedRefRule.path)}`, `  reason: ${deniedRefRule.reason}`);
 		options.problems.push(lines.join("\n"));
 	}
 }
-function addDeniedPackageImportProblem(options) {
+function addDeniedDepImportProblem(options) {
 	options.problems.push([
 		"Denied graph access:",
 		`  rule: ${options.project.label}`,
@@ -182,6 +182,25 @@ function addDeniedRefImportProblem(options) {
 		`  reason: ${options.rule.reason}`
 	].join("\n"));
 }
+function getNodeModulesPackageName(filePath) {
+	const parts = filePath.split("/");
+	const nodeModulesIndex = parts.lastIndexOf("node_modules");
+	if (nodeModulesIndex === -1) return null;
+	const packageName = parts[nodeModulesIndex + 1];
+	if (!packageName) return null;
+	if (packageName.startsWith("@")) {
+		const scopedName = parts[nodeModulesIndex + 2];
+		return scopedName ? `${packageName}/${scopedName}` : null;
+	}
+	return packageName;
+}
+function getResolvedPackageName(filePath, packages) {
+	return getNodeModulesPackageName(filePath) ?? findPackageForFile(filePath, packages)?.name ?? null;
+}
+function getResolvedWorkspacePackage(filePath, packages) {
+	if (getNodeModulesPackageName(filePath)) return null;
+	return findPackageForFile(filePath, packages);
+}
 function addWorkspaceReferenceDependencyProblems(config, project, projectsByPath, packages, importers, problems) {
 	if (!isDtsProjectConfig(project.configPath)) return;
 	const sourcePackage = findPackageForFile(project.configPath, packages);
@@ -216,9 +235,8 @@ async function runGraphCheckInternal(config, options = {}) {
 	const graphRules = normalizeGraphRules({
 		config,
 		include: {
-			nodeBuiltins: false,
-			refs: true,
-			workspaceDeps: true
+			deps: true,
+			refs: true
 		},
 		packages,
 		problems,
@@ -238,21 +256,21 @@ async function runGraphCheckInternal(config, options = {}) {
 		});
 		addWorkspaceReferenceDependencyProblems(config, project, projectsByPath, packages, importers, problems);
 		for (const filePath of project.fileNames) for (const importRecord of collectImportsFromFile$1(filePath)) {
+			const rawDeniedDepRule = getDeniedDepRuleForSpecifier(graphRules, project.label, importRecord.specifier);
+			if (rawDeniedDepRule) {
+				addDeniedDepImportProblem({
+					config,
+					importRecord,
+					problems,
+					project,
+					rule: rawDeniedDepRule
+				});
+				continue;
+			}
 			const resolvedFilePath = resolveInternalImport$1(importRecord.specifier, filePath, project.options);
 			const targetPackage = findPackageForSpecifier(importRecord.specifier, packages);
-			const importer = targetPackage ? findImporterForFile$1(importRecord.filePath, importers) : null;
-			const unresolvedDeniedDepRule = targetPackage ? getDeniedWorkspaceDepRule(graphRules, project.label, targetPackage.name) : null;
+			const importer = findImporterForFile$1(importRecord.filePath, importers);
 			if (!resolvedFilePath) {
-				if (unresolvedDeniedDepRule) {
-					addDeniedPackageImportProblem({
-						config,
-						importRecord,
-						problems,
-						project,
-						rule: unresolvedDeniedDepRule
-					});
-					continue;
-				}
 				if (!targetPackage) continue;
 				problems.push([
 					"Unresolved workspace import:",
@@ -264,10 +282,12 @@ async function runGraphCheckInternal(config, options = {}) {
 				].join("\n"));
 				continue;
 			}
-			const targetWorkspacePackageForResolved = findPackageForFile(resolvedFilePath, packages);
-			const deniedDepRule = (targetPackage ? getDeniedWorkspaceDepRule(graphRules, project.label, targetPackage.name) : null) ?? (targetWorkspacePackageForResolved ? getDeniedWorkspaceDepRule(graphRules, project.label, targetWorkspacePackageForResolved.name) : null);
+			const targetWorkspacePackageForResolved = getResolvedWorkspacePackage(resolvedFilePath, packages);
+			const targetPackageForGraph = targetPackage;
+			const resolvedPackageName = getResolvedPackageName(resolvedFilePath, packages);
+			const deniedDepRule = resolvedPackageName ? getDeniedDepRuleForPackage(graphRules, project.label, resolvedPackageName) : null;
 			if (deniedDepRule) {
-				addDeniedPackageImportProblem({
+				addDeniedDepImportProblem({
 					config,
 					importRecord,
 					problems,
@@ -292,9 +312,8 @@ async function runGraphCheckInternal(config, options = {}) {
 					continue;
 				}
 			}
-			if (targetPackage && !shouldResolveThroughGraph$1(importer, targetPackage)) continue;
-			if (targetPackage && shouldResolveThroughGraph$1(importer, targetPackage) && !fileOwnerLookup.has(resolvedFilePath)) {
-				const referencedProjectPath = inferPackageProject$1(resolvedFilePath, targetPackage, projectPaths);
+			if (targetPackageForGraph && shouldResolveThroughGraph$1(importer, targetPackageForGraph) && !fileOwnerLookup.has(resolvedFilePath)) {
+				const referencedProjectPath = inferPackageProject$1(resolvedFilePath, targetPackageForGraph, projectPaths);
 				const hasProjectReference = referencedProjectPath && project.references.has(referencedProjectPath);
 				problems.push([
 					hasProjectReference ? "Referenced workspace dependency resolves through package exports to a build artifact:" : "Workspace source dependency resolved outside the source graph:",
@@ -304,7 +323,7 @@ async function runGraphCheckInternal(config, options = {}) {
 					`  imported specifier: ${importRecord.specifier}`,
 					`  resolved file: ${toRelativePath(config.rootDir, resolvedFilePath)}`,
 					"  reason: workspace:* dependencies are source dependencies, but TypeScript resolved this package export to a file not owned by the source graph. tsc -b does not rewrite package exports through project references.",
-					`  fix: expose source files from the dependency package exports, add a source paths config to this declaration leaf extends, or stop using workspace:* plus project references for artifact consumption; ${formatArtifactDependencyPolicy(targetPackage)}`,
+					`  fix: expose source files from the dependency package exports, add a source paths config to this declaration leaf extends, or stop using workspace:* plus project references for artifact consumption; ${formatArtifactDependencyPolicy(targetPackageForGraph)}`,
 					"  hint: run `limina paths generate` to create a compatibility paths file, then manually add it to the first position of the listed tsconfig*.dts.json extends array."
 				].join("\n"));
 				continue;
@@ -317,15 +336,15 @@ async function runGraphCheckInternal(config, options = {}) {
 				specifier: importRecord.specifier
 			});
 			if (!targetProjectPath) {
-				if (!targetPackage) continue;
-				if (!isWorkspacePackageFile(resolvedFilePath, packages)) {
-					if (targetPackage && shouldResolveThroughGraph$1(importer, targetPackage)) problems.push([
+				if (!targetPackageForGraph) continue;
+				if (!targetWorkspacePackageForResolved) {
+					if (targetPackageForGraph && shouldResolveThroughGraph$1(importer, targetPackageForGraph)) problems.push([
 						"Workspace source import resolved outside the workspace graph:",
 						`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
 						`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
 						`  imported specifier: ${importRecord.specifier}`,
 						`  resolved file: ${toRelativePath(config.rootDir, resolvedFilePath)}`,
-						`  reason: workspace:* dependencies are source dependency edges and must resolve to files owned by the source graph; ${formatArtifactDependencyPolicy(targetPackage)}`
+						`  reason: workspace:* dependencies are source dependency edges and must resolve to files owned by the source graph; ${formatArtifactDependencyPolicy(targetPackageForGraph)}`
 					].join("\n"));
 					continue;
 				}
@@ -352,6 +371,7 @@ async function runGraphCheckInternal(config, options = {}) {
 				});
 				continue;
 			}
+			if (targetPackageForGraph && !shouldResolveThroughGraph$1(importer, targetPackageForGraph)) continue;
 			if (!projectsByPath.has(targetProjectPath)) {
 				problems.push([
 					"Expected graph target is not reachable from any checker entry:",
@@ -416,6 +436,7 @@ const ATTW_PROFILE_IGNORED_RESOLUTIONS = {
 	"esm-only": ["node16-cjs"]
 };
 const nodeBuiltinSpecifiers = new Set(builtinModules.flatMap((specifier) => specifier.startsWith("node:") ? [specifier, specifier.slice(5)] : [specifier, `node:${specifier}`]));
+const REQUIRED_PUBLIC_PACKAGE_FILES = ["README.md", "LICENSE.md"];
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -625,7 +646,7 @@ function logPackageCheckPlan(options) {
 	].join("\n"));
 }
 async function packOutputTarball(outDir) {
-	const destination = await mkdtemp(path.join(tmpdir(), "__LATTICE_PACKAGE__"));
+	const destination = await mkdtemp(path.join(tmpdir(), "__LIMINA_PACKAGE__"));
 	return {
 		cleanup: async () => {
 			await rm(destination, {
@@ -640,6 +661,20 @@ async function packOutputTarball(outDir) {
 		}))
 	};
 }
+async function readDistPackageJson(options) {
+	if (!existsSync(options.packageJsonPath)) throw new Error(`outDir package.json not found${options.label ? ` for ${options.label}` : ""} at ${options.config ? toRelativePath(options.config.rootDir, options.packageJsonPath) : options.packageJsonPath}. Run the package build first.`);
+	return JSON.parse(await readFile(options.packageJsonPath, "utf8"));
+}
+async function assertPublicPackageMetadata(options) {
+	if ((await readDistPackageJson({
+		config: options.config,
+		label: options.label,
+		packageJsonPath: options.packageJsonPath
+	})).private === true) return;
+	const missingFiles = REQUIRED_PUBLIC_PACKAGE_FILES.filter((fileName) => !existsSync(path.join(options.outDir, fileName)));
+	if (missingFiles.length === 0) return;
+	throw new Error(`publishable package output for ${options.label} at ${toRelativePath(options.config.rootDir, options.outDir)} is missing required file(s): ${missingFiles.join(", ")}. Add them to the built output or set "private": true in the output package.json.`);
+}
 async function runPublintCheck(options) {
 	const task = options.flow?.start(`publint: ${options.label}`, { depth: options.flowDepth ?? 0 });
 	PackageLogger.info(`publint started: ${options.label}`);
@@ -720,7 +755,12 @@ async function runPackageCheckTarget(options) {
 	const task = options.flow?.start(`package target: ${label}`, { depth: options.flowDepth ?? 0 });
 	let packedDist;
 	try {
-		if (!existsSync(outputPackageJsonPath)) throw new Error(`outDir package.json not found for ${label} at ${toRelativePath(options.config.rootDir, outputPackageJsonPath)}. Run the package build first.`);
+		await assertPublicPackageMetadata({
+			config: options.config,
+			label,
+			outDir: target.outDir,
+			packageJsonPath: outputPackageJsonPath
+		});
 		if (options.checks.includes("publint") || options.checks.includes("attw")) {
 			const packTask = options.flow?.start(`package tarball: ${label}`, { depth: (options.flowDepth ?? 0) + 1 });
 			PackageLogger.info(`package tarball packing started: ${label}`);
@@ -774,8 +814,7 @@ async function runPackageCheckTarget(options) {
 	}
 }
 async function auditPublishedPackageBoundaries(target) {
-	const manifestPath = path.join(target.outDir, "package.json");
-	const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+	const manifest = await readDistPackageJson({ packageJsonPath: path.join(target.outDir, "package.json") });
 	const allowedExternalPackages = new Set([
 		...Object.keys(manifest.dependencies ?? {}),
 		...Object.keys(manifest.peerDependencies ?? {}),
@@ -860,7 +899,7 @@ async function runPackageCheck(options) {
 }
 
 //#endregion
-//#region src/commands/paths.ts
+//#region src/package-exports.ts
 const defaultSourceExtensions = [
 	".ts",
 	".tsx",
@@ -887,110 +926,11 @@ const defaultArtifactDirectories = [
 	"cjs",
 	"out"
 ];
-function generatedFileName(config) {
-	return config.paths?.generatedFileName ?? "tsconfig.dts.paths.generated.json";
-}
-function generatedFileMarker(config) {
-	return config.paths?.generatedFileMarker ?? "GENERATED FILE - DO NOT EDIT BY HAND.";
-}
-function parseProject(config, configPath) {
-	const diagnostics = [];
-	const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
-		...ts.sys,
-		onUnRecoverableConfigFileDiagnostic: (diagnostic) => {
-			diagnostics.push(diagnostic);
-		}
-	});
-	if (!parsed) throw new Error(ts.formatDiagnosticsWithColorAndContext(diagnostics, {
-		getCanonicalFileName: (fileName) => fileName,
-		getCurrentDirectory: () => config.rootDir,
-		getNewLine: () => "\n"
-	}));
-	if (parsed.errors.length > 0) throw new Error(ts.formatDiagnosticsWithColorAndContext(parsed.errors, {
-		getCanonicalFileName: (fileName) => fileName,
-		getCurrentDirectory: () => config.rootDir,
-		getNewLine: () => "\n"
-	}));
-	return {
-		configPath: normalizeAbsolutePath(configPath),
-		fileNames: parsed.fileNames.filter((fileName) => /\.(?:[cm]?tsx?|d\.[cm]?ts)$/u.test(fileName)).map(normalizeAbsolutePath),
-		options: parsed.options,
-		references: new Set(getRawReferencePaths(config, configPath))
-	};
-}
-function getSourceFileKind(filePath) {
-	if (filePath.endsWith(".tsx")) return ts.ScriptKind.TSX;
-	if (filePath.endsWith(".jsx")) return ts.ScriptKind.JSX;
-	return ts.ScriptKind.TS;
-}
-function stringLiteralValue(node) {
-	return node && ts.isStringLiteralLike(node) ? node.text : null;
-}
-function collectImportsFromFile(filePath) {
-	const sourceText = readFileSync(filePath, "utf8");
-	const sourceFile = ts.createSourceFile(filePath, sourceText, ts.ScriptTarget.Latest, true, getSourceFileKind(filePath));
-	const imports = [];
-	const addImport = (specifier, node) => {
-		const location = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
-		imports.push({
-			filePath,
-			line: location.line + 1,
-			specifier
-		});
-	};
-	const visit = (node) => {
-		if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) {
-			const specifier = stringLiteralValue(node.moduleSpecifier);
-			if (specifier) addImport(specifier, node);
-		} else if (ts.isImportTypeNode(node)) {
-			const specifier = ts.isLiteralTypeNode(node.argument) ? stringLiteralValue(node.argument.literal) : null;
-			if (specifier) addImport(specifier, node);
-		} else if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword) {
-			const specifier = stringLiteralValue(node.arguments[0]);
-			if (specifier) addImport(specifier, node);
-		}
-		ts.forEachChild(node, visit);
-	};
-	visit(sourceFile);
-	return imports;
-}
-function resolveInternalImport(specifier, containingFile, options) {
-	const resolved = ts.resolveModuleName(specifier, containingFile, options, ts.sys).resolvedModule;
-	return resolved?.resolvedFileName ? normalizeAbsolutePath(resolved.resolvedFileName) : null;
-}
-function resolveImportWithoutMatchingPaths(specifier, containingFile, options) {
-	if (!options.paths) return resolveInternalImport(specifier, containingFile, options);
-	const paths = Object.fromEntries(Object.entries(options.paths).filter(([alias]) => !aliasMatchesSpecifier(alias, specifier)));
-	return resolveInternalImport(specifier, containingFile, {
-		...options,
-		paths: Object.keys(paths).length > 0 ? paths : void 0
-	});
-}
-function createFileOwnerLookup(projects) {
-	const ownerLookup = /* @__PURE__ */ new Map();
-	for (const project of projects) for (const fileName of project.fileNames) {
-		const owners = ownerLookup.get(fileName) ?? [];
-		owners.push(project.configPath);
-		ownerLookup.set(fileName, owners);
-	}
-	return ownerLookup;
-}
-function projectExtendsGeneratedConfig(config, configPath) {
-	const extendsValue = readJsonConfig(config, configPath).extends;
-	return (typeof extendsValue === "string" ? [extendsValue] : Array.isArray(extendsValue) ? extendsValue : []).some((entry) => typeof entry === "string" && path.basename(entry) === generatedFileName(config));
-}
-function findImporterForFile(filePath, importers) {
-	return importers.find((importer) => isPathInsideDirectory(filePath, importer.directory)) ?? null;
-}
-function shouldResolveThroughGraph(importer, targetPackage) {
-	if (!importer || !targetPackage) return false;
-	return importer.name === targetPackage.name || importer.workspaceDependencies.has(targetPackage.name);
+function configuredArtifactDirectories(config) {
+	return config.paths?.artifactDirectories ?? defaultArtifactDirectories;
 }
-function inferPackageProject(resolvedFilePath, workspacePackage, projectPaths) {
-	if (!isPathInsideDirectory(resolvedFilePath, workspacePackage.directory)) return null;
-	return projectPaths.find((projectPath) => {
-		return projectPath.startsWith(`${workspacePackage.directory}/`) && projectPath.endsWith("/tsconfig.lib.dts.json");
-	}) ?? null;
+function configuredSourceExtensions(config) {
+	return config.paths?.sourceExtensions ?? defaultSourceExtensions;
 }
 function collectTargetCandidates(config, value) {
 	if (typeof value === "string") return [value];
@@ -1033,12 +973,6 @@ function removeKnownExtension(filePath) {
 	]) if (filePath.endsWith(extension)) return filePath.slice(0, -extension.length);
 	return filePath;
 }
-function configuredArtifactDirectories(config) {
-	return config.paths?.artifactDirectories ?? defaultArtifactDirectories;
-}
-function configuredSourceExtensions(config) {
-	return config.paths?.sourceExtensions ?? defaultSourceExtensions;
-}
 function hasConfiguredSourceExtension(config, target) {
 	return configuredSourceExtensions(config).some((extension) => target.endsWith(extension));
 }
@@ -1151,6 +1085,114 @@ function aliasMatchesSpecifier(alias, specifier) {
 	const suffix = alias.slice(wildcardIndex + 1);
 	return specifier.startsWith(prefix) && specifier.endsWith(suffix);
 }
+
+//#endregion
+//#region src/commands/paths.ts
+function generatedFileName(config) {
+	return config.paths?.generatedFileName ?? "tsconfig.dts.paths.generated.json";
+}
+function generatedFileMarker(config) {
+	return config.paths?.generatedFileMarker ?? "GENERATED FILE - DO NOT EDIT BY HAND.";
+}
+function parseProject(config, configPath) {
+	const diagnostics = [];
+	const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
+		...ts.sys,
+		onUnRecoverableConfigFileDiagnostic: (diagnostic) => {
+			diagnostics.push(diagnostic);
+		}
+	});
+	if (!parsed) throw new Error(ts.formatDiagnosticsWithColorAndContext(diagnostics, {
+		getCanonicalFileName: (fileName) => fileName,
+		getCurrentDirectory: () => config.rootDir,
+		getNewLine: () => "\n"
+	}));
+	if (parsed.errors.length > 0) throw new Error(ts.formatDiagnosticsWithColorAndContext(parsed.errors, {
+		getCanonicalFileName: (fileName) => fileName,
+		getCurrentDirectory: () => config.rootDir,
+		getNewLine: () => "\n"
+	}));
+	return {
+		configPath: normalizeAbsolutePath(configPath),
+		fileNames: parsed.fileNames.filter((fileName) => /\.(?:[cm]?tsx?|d\.[cm]?ts)$/u.test(fileName)).map(normalizeAbsolutePath),
+		options: parsed.options,
+		references: new Set(getRawReferencePaths(config, configPath))
+	};
+}
+function getSourceFileKind(filePath) {
+	if (filePath.endsWith(".tsx")) return ts.ScriptKind.TSX;
+	if (filePath.endsWith(".jsx")) return ts.ScriptKind.JSX;
+	return ts.ScriptKind.TS;
+}
+function stringLiteralValue(node) {
+	return node && ts.isStringLiteralLike(node) ? node.text : null;
+}
+function collectImportsFromFile(filePath) {
+	const sourceText = readFileSync(filePath, "utf8");
+	const sourceFile = ts.createSourceFile(filePath, sourceText, ts.ScriptTarget.Latest, true, getSourceFileKind(filePath));
+	const imports = [];
+	const addImport = (specifier, node) => {
+		const location = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+		imports.push({
+			filePath,
+			line: location.line + 1,
+			specifier
+		});
+	};
+	const visit = (node) => {
+		if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) {
+			const specifier = stringLiteralValue(node.moduleSpecifier);
+			if (specifier) addImport(specifier, node);
+		} else if (ts.isImportTypeNode(node)) {
+			const specifier = ts.isLiteralTypeNode(node.argument) ? stringLiteralValue(node.argument.literal) : null;
+			if (specifier) addImport(specifier, node);
+		} else if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword) {
+			const specifier = stringLiteralValue(node.arguments[0]);
+			if (specifier) addImport(specifier, node);
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return imports;
+}
+function resolveInternalImport(specifier, containingFile, options) {
+	const resolved = ts.resolveModuleName(specifier, containingFile, options, ts.sys).resolvedModule;
+	return resolved?.resolvedFileName ? normalizeAbsolutePath(resolved.resolvedFileName) : null;
+}
+function resolveImportWithoutMatchingPaths(specifier, containingFile, options) {
+	if (!options.paths) return resolveInternalImport(specifier, containingFile, options);
+	const paths = Object.fromEntries(Object.entries(options.paths).filter(([alias]) => !aliasMatchesSpecifier(alias, specifier)));
+	return resolveInternalImport(specifier, containingFile, {
+		...options,
+		paths: Object.keys(paths).length > 0 ? paths : void 0
+	});
+}
+function createFileOwnerLookup(projects) {
+	const ownerLookup = /* @__PURE__ */ new Map();
+	for (const project of projects) for (const fileName of project.fileNames) {
+		const owners = ownerLookup.get(fileName) ?? [];
+		owners.push(project.configPath);
+		ownerLookup.set(fileName, owners);
+	}
+	return ownerLookup;
+}
+function projectExtendsGeneratedConfig(config, configPath) {
+	const extendsValue = readJsonConfig(config, configPath).extends;
+	return (typeof extendsValue === "string" ? [extendsValue] : Array.isArray(extendsValue) ? extendsValue : []).some((entry) => typeof entry === "string" && path.basename(entry) === generatedFileName(config));
+}
+function findImporterForFile(filePath, importers) {
+	return importers.find((importer) => isPathInsideDirectory(filePath, importer.directory)) ?? null;
+}
+function shouldResolveThroughGraph(importer, targetPackage) {
+	if (!importer || !targetPackage) return false;
+	return importer.name === targetPackage.name || importer.workspaceDependencies.has(targetPackage.name);
+}
+function inferPackageProject(resolvedFilePath, workspacePackage, projectPaths) {
+	if (!isPathInsideDirectory(resolvedFilePath, workspacePackage.directory)) return null;
+	return projectPaths.find((projectPath) => {
+		return projectPath.startsWith(`${workspacePackage.directory}/`) && projectPath.endsWith("/tsconfig.lib.dts.json");
+	}) ?? null;
+}
 function addPathEntry(paths, alias, target) {
 	const targets = paths.get(alias) ?? [];
 	if (!targets.includes(target)) targets.push(target);
@@ -2015,6 +2057,12 @@ const builtInTaskNames = new Set([
 	"proof:check",
 	"source:check"
 ]);
+const defaultCheckPipeline = [
+	"graph:check",
+	"source:check",
+	"proof:check",
+	"checker:typecheck"
+];
 function isBuiltinTaskName(value) {
 	return builtInTaskNames.has(value);
 }
@@ -2128,7 +2176,7 @@ function runCommandStep(config, step, options = {}) {
 }
 async function runPipeline(config, pipelineName, options = {}) {
 	const steps = config.pipelines?.[pipelineName];
-	if (!steps) throw new Error(`Unknown limina pipeline "${pipelineName}".`);
+	if (!steps) throw new Error([`Pipeline instruction "${pipelineName}" was not found.`, `Define it in ${path.relative(config.rootDir, config.configPath)} under the "pipelines" field, then run "limina check ${pipelineName}" again.`].join("\n"));
 	const normalizedSteps = steps.map(normalizePipelineStep);
 	const pipelineTask = options.flow?.start(`pipeline: ${pipelineName}`, { collapseOnSuccess: false });
 	for (const [stepIndex, step] of normalizedSteps.entries()) if (!(step.type === "task" ? await runBuiltinTask(config, step.name, options) : await runCommandStep(config, step, options))) {
@@ -2140,6 +2188,18 @@ async function runPipeline(config, pipelineName, options = {}) {
 	pipelineTask?.pass();
 	return true;
 }
+async function runDefaultCheck(config, options = {}) {
+	const normalizedSteps = defaultCheckPipeline.map(normalizePipelineStep);
+	const pipelineTask = options.flow?.start("default check", { collapseOnSuccess: false });
+	for (const [stepIndex, step] of normalizedSteps.entries()) if (!(step.type === "task" ? await runBuiltinTask(config, step.name, options) : await runCommandStep(config, step, options))) {
+		const label = getPipelineStepLabel(step);
+		pipelineTask?.fail(`default check blocked at ${label}`);
+		for (const remainingStep of normalizedSteps.slice(stepIndex + 1)) options.flow?.skip(`skipped: ${getPipelineStepLabel(remainingStep)}`, { depth: 1 });
+		return false;
+	}
+	pipelineTask?.pass();
+	return true;
+}
 
 //#endregion
 //#region src/cli.ts
@@ -2176,10 +2236,25 @@ async function main() {
 	cli.option("--config <path>", "Path to limina.config.mjs");
 	cli.option("--mode <mode>", "Mode passed to limina config functions");
 	cli.help();
-	cli.command("check <pipeline>", "Run a configured governance pipeline").action(async (pipeline, flags) => {
+	cli.command("init", "Initialize Limina files for a pnpm workspace").option("--yes", "Accept all init prompts").action(async (flags) => {
+		const flow = createCliFlow();
+		flow.intro("limina init");
+		await runInit({
+			clearScreen: false,
+			cwd: process.cwd(),
+			flow,
+			yes: flags.yes
+		});
+		flow.outro("limina init finished");
+	});
+	cli.command("check [pipeline]", "Run the default check or a configured pipeline").action(async (pipeline, flags) => {
 		const flow = createCliFlow();
 		flow.intro("limina check");
-		const passed = await runPipeline(await load(flags, "check"), pipeline, {
+		const config = await load(flags, "check");
+		const passed = pipeline ? await runPipeline(config, pipeline, {
+			cwd: process.cwd(),
+			flow
+		}) : await runDefaultCheck(config, {
 			cwd: process.cwd(),
 			flow
 		});

package/config.d.ts

@@ -173,39 +173,14 @@ interface GraphRuleRefDenyEntry {
   reason: string;
 }
 /**
-* Workspace package dependency denied to projects with a matching Limina label.
+* Dependency denied to projects with a matching Limina label.
 */
 interface GraphRuleDepDenyEntry {
   /**
-  * Target workspace package name.
+  * Target package root, package.json imports specifier, or Node builtin name.
   *
-  * @deprecated Use `workspaceDeps` for new configs.
-  */
-  name: string;
-  /**
-  * Human-readable explanation shown when the rule fails.
-  */
-  reason: string;
-}
-/**
-* Workspace package dependency denied to projects with a matching Limina label.
-*/
-interface GraphRuleWorkspaceDepDenyEntry {
-  /**
-  * Target workspace package name.
-  */
-  name: string;
-  /**
-  * Human-readable explanation shown when the rule fails.
-  */
-  reason: string;
-}
-/**
-* Node builtin denied to source files with a matching Limina label.
-*/
-interface GraphRuleNodeBuiltinDenyEntry {
-  /**
-  * Target Node builtin name, such as `fs`, `node:fs`, or `node:*`.
+  * Examples: `@acme/internal`, `zod`, `#internal/*`, `fs`, `node:fs`,
+  * or `node:*`.
   */
   name: string;
   /**
@@ -222,19 +197,10 @@ interface GraphRuleDenyConfig {
   */
   refs?: GraphRuleRefDenyEntry[];
   /**
-  * Workspace packages that matching projects must not reference or import.
-  *
-  * @deprecated Use `workspaceDeps` for new configs.
+  * Packages, package imports, and Node builtins that matching projects must
+  * not reference or import.
   */
   deps?: GraphRuleDepDenyEntry[];
-  /**
-  * Node builtins that matching projects must not import.
-  */
-  nodeBuiltins?: GraphRuleNodeBuiltinDenyEntry[];
-  /**
-  * Workspace packages that matching projects must not reference or import.
-  */
-  workspaceDeps?: GraphRuleWorkspaceDepDenyEntry[];
 }
 /**
 * Package-level graph governance rule keyed by a label declared in
@@ -480,4 +446,4 @@ interface LoadConfigOptions {
 }
 declare function loadConfig(options?: LoadConfigOptions): Promise<ResolvedLiminaConfig>;
 //#endregion
-export { BuiltinCheckerPreset, BuiltinTaskName, CheckerConfig, CheckerExecutionKind, CheckerPreset, GraphConfig, GraphRule, GraphRuleDenyConfig, GraphRuleDepDenyEntry, GraphRuleNodeBuiltinDenyEntry, GraphRuleRefDenyEntry, GraphRuleWorkspaceDepDenyEntry, LiminaCommand, LiminaConfig, LiminaConfigEnv, LiminaConfigExport, LiminaConfigFn, LiminaConfigFnObject, LiminaConfigFnPromise, LoadConfigOptions, PackageAttwCheckConfig, PackageAttwProfile, PackageBoundaryCheckConfig, PackageCheckTarget, PackageCheckTool, PackageCheckToolSelection, PackageChecksConfig, PackagePublintCheckConfig, PathsConfig, PipelineStep, ProofAllowlistEntry, ProofConfig, ResolvedCheckerConfig, ResolvedLiminaConfig, RuntimeEnvironment, SharedLiminaConfig, SourceBoundaryConfig, defineConfig, getActiveCheckerExtensions, getActiveCheckers, loadConfig, validateLiminaConfig };
+export { BuiltinCheckerPreset, BuiltinTaskName, CheckerConfig, CheckerExecutionKind, CheckerPreset, GraphConfig, GraphRule, GraphRuleDenyConfig, GraphRuleDepDenyEntry, GraphRuleRefDenyEntry, LiminaCommand, LiminaConfig, LiminaConfigEnv, LiminaConfigExport, LiminaConfigFn, LiminaConfigFnObject, LiminaConfigFnPromise, LoadConfigOptions, PackageAttwCheckConfig, PackageAttwProfile, PackageBoundaryCheckConfig, PackageCheckTarget, PackageCheckTool, PackageCheckToolSelection, PackageChecksConfig, PackagePublintCheckConfig, PathsConfig, PipelineStep, ProofAllowlistEntry, ProofConfig, ResolvedCheckerConfig, ResolvedLiminaConfig, RuntimeEnvironment, SharedLiminaConfig, SourceBoundaryConfig, defineConfig, getActiveCheckerExtensions, getActiveCheckers, loadConfig, validateLiminaConfig };