oxlint-plugin-boundaries 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Paul Cedrick Artigo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,131 @@
+# oxlint-plugin-boundaries
+
+Config-driven **cross-package / element-type boundaries** for [oxlint](https://oxc.rs) — enforce an architectural dependency matrix (which parts of your codebase may import which) **without a module resolver**.
+
+You declare your own element table and allow-matrix in `.oxlintrc.json`; the plugin classifies every import by file path and flags edges your matrix disallows. Works in any monorepo (Bun / npm / pnpm / Yarn workspaces) and in single-package repos.
+
+> **Status: alpha.** oxlint's JS plugin system (`jsPlugins`) is itself alpha and not yet semver-stable. This plugin pins a tested `oxlint` range in `peerDependencies` and is exercised against an oxlint-version matrix in CI. Expect a new minor when oxlint changes the plugin API. See [Versioning & the alpha pin](#versioning--the-alpha-pin).
+
+## Why this exists
+
+oxlint has no native cross-package boundaries rule, and the popular [`eslint-plugin-boundaries`](https://github.com/javierbrea/eslint-plugin-boundaries) **cannot run under oxlint's JS-plugin layer**: that layer intentionally exposes _no module resolver_ (no `context.resolve`, empty `parserServices`), and `eslint-plugin-boundaries` depends on one (`eslint-import-resolver-typescript`).
+
+This plugin sidesteps the missing resolver by **classifying purely from the file path**. It walks up to your workspace root, reads each package's `package.json` `name` once to build a `name → directory` index, and resolves bare specifiers like `@scope/pkg` to a directory — then to an element type. No resolver required.
+
+## Install
+
+```sh
+bun add -D oxlint-plugin-boundaries
+# or: npm i -D oxlint-plugin-boundaries  /  pnpm add -D oxlint-plugin-boundaries
+```
+
+`oxlint` is a peer dependency — install it yourself and keep it within the supported range.
+
+## Usage
+
+Reference the plugin in `jsPlugins`, describe your architecture under `settings.boundaries`, and turn the rules on:
+
+```jsonc
+{
+  "jsPlugins": ["oxlint-plugin-boundaries"],
+  "settings": {
+    "boundaries": {
+      // Ordered: more-specific patterns BEFORE their parents. First match wins.
+      "elements": [
+        { "type": "core", "pattern": "packages/core/**" },
+        { "type": "db", "pattern": "packages/db/**" },
+        { "type": "schemas", "pattern": "packages/schemas/**" },
+        { "type": "api-client", "pattern": "packages/api-client/**" },
+        { "type": "app-web", "pattern": "apps/web/**" },
+      ],
+      "rules": [
+        { "from": "core", "allow": ["db", "schemas"] },
+        { "from": "db", "allow": ["schemas"] },
+        { "from": "app-web", "allow": ["api-client", "schemas"] },
+        {
+          "from": "api-client",
+          "allow": ["app-api"],
+          "importKind": "type",
+          "message": "api-client may import apps/api only as `import type`.",
+        },
+      ],
+      "default": "disallow",
+      "ignore": ["**/*.test.ts", "**/*.spec.ts"],
+    },
+  },
+  "rules": {
+    "boundaries/element-types": "error",
+    "boundaries/no-unknown": "error",
+  },
+}
+```
+
+> oxlint resolves `jsPlugins` paths **relative to the config file**. Using the package name (as above) is the normal case; a relative path would be resolved against the `.oxlintrc.json` location, not your shell's cwd.
+
+## Configuration (`settings.boundaries`)
+
+This object is the plugin's public API.
+
+| Field            | Type                      | Required                  | Meaning                                                                                                                                                                                                                                                                                                                              |
+| ---------------- | ------------------------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `elements`       | `Element[]`               | yes                       | Ordered list mapping path patterns to element types. **First match wins**, so list specific patterns before their parents.                                                                                                                                                                                                           |
+| `rules`          | `Rule[]`                  | yes                       | Directional allow-matrix. Each entry says what a `from` element may import.                                                                                                                                                                                                                                                          |
+| `default`        | `"disallow"` \| `"allow"` | no (default `"disallow"`) | Verdict for an edge not covered by any rule.                                                                                                                                                                                                                                                                                         |
+| `ignore`         | `string[]`                | no                        | Glob-ish patterns for files to skip entirely.                                                                                                                                                                                                                                                                                        |
+| `workspaceScope` | `string`                  | no (derived)              | The package-name prefix marking workspace-internal imports (e.g. `"@acme/"`). A bare specifier starting with it is a candidate boundary edge; anything else is an external dependency and ignored. When omitted, it is derived from the common scope of your workspace packages; set it explicitly if your packages don't share one. |
+
+**`Element`**
+
+| Field     | Type     | Meaning                                                        |
+| --------- | -------- | -------------------------------------------------------------- |
+| `type`    | `string` | Element type name, referenced by `rules`.                      |
+| `pattern` | `string` | Path pattern (root-relative) classifying files into this type. |
+
+**`Rule`**
+
+| Field        | Type                  | Meaning                                                                                          |
+| ------------ | --------------------- | ------------------------------------------------------------------------------------------------ |
+| `from`       | `string`              | The importing element type this rule governs.                                                    |
+| `allow`      | `string[]`            | Element types `from` may import.                                                                 |
+| `importKind` | `"value"` \| `"type"` | Optional. `"type"` narrows the `allow` list to `import type` edges only (a type-only carve-out). |
+| `message`    | `string`              | Optional. Custom message shown when this edge is violated.                                       |
+
+Self-imports (an element importing its own type) are always allowed. External dependencies (npm packages outside your workspace) are never boundary edges and are ignored.
+
+### Rules
+
+- **`boundaries/element-types`** — the core rule. For every import, classifies both ends and reports edges your matrix disallows (honoring the type-only carve-out).
+- **`boundaries/no-unknown`** — flags a workspace-style specifier that resolves to _no_ package (typically a typo or a deleted package). Closes the gap that `element-types` leaves when a target classifies to nothing.
+
+## How classification works
+
+1. **Find the workspace root** — walk up from the file to the nearest `package.json` declaring `workspaces` (falls back to oxlint's cwd). Keying off the file path keeps results identical no matter which directory you run oxlint from.
+2. **Index packages** — read each workspace package's `name` once; memoize a `name → dir` map.
+3. **Classify both ends of each import** — the importing file by its path; the target by resolving a relative specifier against the file's directory, or a bare workspace specifier (`@scope/pkg[/sub]`) to its package dir via longest-prefix match.
+4. **Evaluate** — `self` → allowed; in the value allow-list → allowed; `import type` and in the type-only allow-list → allowed; otherwise the `default` decides.
+
+## Versioning & the alpha pin
+
+oxlint's `jsPlugins` API is **alpha** and not semver-stable. The policy here:
+
+- `peerDependencies.oxlint` is pinned to a **tested range**; CI runs an oxlint-version matrix.
+- When oxlint ships a breaking plugin-API change, this package cuts a new release with an updated range. The test suite is the tripwire — there are no defensive version guards in the runtime.
+- Keep your `oxlint` within the supported range for predictable behavior.
+
+## Authoring / build (for contributors)
+
+Authored in TypeScript, shipped as compiled **ESM `.js` + `.d.ts`** so the published artifact loads on any supported Node — including versions below the 22.18 floor that raw `.ts` oxlint plugins require. Built with [tsdown](https://tsdown.dev) (oxc / Rolldown).
+
+```sh
+bun install
+bun run build        # tsdown -> dist/ (.js + .d.ts), runs publint + attw
+bun run type-check
+bun run lint         # dogfoods this very plugin
+bun test
+```
+
+> tsdown requires Node ≥ 22.18 / ≥ 24 to _run the build_. This affects contributors and CI only — never consumers of the published package.
+
+## License
+
+[MIT](./LICENSE) © Paul Cedrick Artigo

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+//#region src/index.d.ts
+declare const plugin: import("@oxlint/plugins").Plugin;
+//#endregion
+export { plugin as default };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";cA8EM,MAAA,4BAAM,MAuFV"}

package/dist/index.js

@@ -0,0 +1,471 @@
+import { definePlugin, defineRule } from "@oxlint/plugins";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { dirname, dirname as dirname$1, join, resolve } from "node:path";
+//#region src/discover.ts
+/**
+* Walk up from `startDir` to the monorepo root: the nearest ancestor whose
+* `package.json` declares `"workspaces"`. Falls back to `fallback` (typically
+* `context.cwd`) when no such ancestor exists.
+*
+* Keying off the file path (not cwd) is what makes classification
+* cwd-independent — running oxlint from a workspace subdir resolves the same
+* root as running from the repo root.
+*/
+function findWorkspaceRoot(startDir, fallback) {
+	let dir = startDir;
+	for (;;) {
+		const pkgPath = join(dir, "package.json");
+		if (existsSync(pkgPath)) try {
+			const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+			if (pkg && pkg.workspaces !== void 0) return dir;
+		} catch {}
+		const parent = dirname$1(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return fallback;
+}
+/**
+* Read the `workspaces` field of a root `package.json` and return the raw glob
+* patterns. Supports both the array form (`["apps/*", ...]`) and the Bun/Yarn
+* object form (`{ packages: [...] }`). Returns `[]` on any problem.
+*/
+function readWorkspaceGlobs(root) {
+	try {
+		const ws = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).workspaces;
+		if (Array.isArray(ws)) return ws;
+		if (ws && typeof ws === "object" && Array.isArray(ws.packages)) return ws.packages;
+	} catch {}
+	return [];
+}
+/**
+* Expand a single workspace glob into concrete package directories.
+*
+* Only the two shapes monorepos actually use are handled: a literal directory
+* (`packages/core`) and a single-level wildcard (`packages/*`, `apps/*`). A
+* `**` glob is treated as the directory before it. No glob engine needed.
+*/
+function expandGlob(root, glob) {
+	const normalized = glob.replaceAll("\\", "/").replace(/\/+$/, "");
+	const starIdx = normalized.indexOf("*");
+	if (starIdx === -1) {
+		const dir = resolve(root, normalized);
+		return existsSync(dir) ? [dir] : [];
+	}
+	const parentDir = resolve(root, normalized.slice(0, starIdx).replace(/\/[^/]*$/, "").replace(/\/$/, ""));
+	if (!existsSync(parentDir)) return [];
+	const out = [];
+	for (const entry of readdirSync(parentDir)) {
+		if (entry.startsWith(".")) continue;
+		const child = join(parentDir, entry);
+		try {
+			if (statSync(child).isDirectory()) out.push(child);
+		} catch {}
+	}
+	return out;
+}
+/**
+* Discover every workspace package under `root`: read each candidate dir's
+* `package.json` and pair its `name` with its absolute directory.
+*/
+function discoverPackages(root) {
+	const packages = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const glob of readWorkspaceGlobs(root)) for (const dir of expandGlob(root, glob)) {
+		if (seen.has(dir)) continue;
+		seen.add(dir);
+		try {
+			const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+			if (pkg && typeof pkg.name === "string") packages.push({
+				name: pkg.name,
+				dir
+			});
+		} catch {}
+	}
+	return packages;
+}
+/**
+* Build a `packageName -> absoluteDir` map, memoized per monorepo root so the
+* filesystem scan runs once across all linted files (mirrors oxlint's
+* once-per-process `createOnce` design).
+*/
+const indexCache = /* @__PURE__ */ new Map();
+function getPackageIndex(root) {
+	const cached = indexCache.get(root);
+	if (cached) return cached;
+	const index = /* @__PURE__ */ new Map();
+	for (const { name, dir } of discoverPackages(root)) index.set(name, dir);
+	indexCache.set(root, index);
+	return index;
+}
+/**
+* Resolve a bare package specifier to its package directory via the index.
+*
+* Handles subpath specifiers (`@scope/pkg/sub`) by matching the longest
+* package name that the specifier equals or starts with (`name + "/"`). The
+* matched package's directory is returned; subpath refinement (mapping
+* `@scope/pkg/sub` to a sub-element) is intentionally NOT done here — callers
+* classify the returned dir. Today only bare names are used.
+*/
+function resolveSpecifierDir(specifier, index) {
+	const exact = index.get(specifier);
+	if (exact) return exact;
+	let bestDir = null;
+	let bestLen = -1;
+	for (const [name, dir] of index) {
+		const prefix = name + "/";
+		if (specifier.startsWith(prefix) && name.length > bestLen) {
+			bestDir = dir;
+			bestLen = name.length;
+		}
+	}
+	return bestDir;
+}
+//#endregion
+//#region src/engine.ts
+/**
+* Normalize an absolute path to forward slashes and strip the monorepo-root
+* prefix, yielding a root-relative path the element tests match against
+* (e.g. `apps/api/src/http/app.ts`). This mirrors the old
+* `eslint-plugin-boundaries` `mode:"full"` behavior, which matched patterns
+* against root-relative paths.
+*
+* @param absPath absolute path
+* @param root absolute monorepo root
+* @returns root-relative, forward-slashed path
+*/
+function toRelative(absPath, root) {
+	const normAbs = absPath.replaceAll("\\", "/");
+	const normRoot = root.replaceAll("\\", "/").replace(/\/+$/, "");
+	if (normAbs === normRoot) return "";
+	if (normAbs.startsWith(normRoot + "/")) return normAbs.slice(normRoot.length + 1);
+	return normAbs;
+}
+/**
+* Classify an absolute path to an element type, or null if it matches no
+* element. The first matching element in `ELEMENTS` wins, so the table MUST be
+* ordered specific-before-parent.
+*
+* @param absPath absolute path to classify
+* @param root absolute monorepo root
+* @param elements ordered element list
+*/
+function classifyPath(absPath, root, elements) {
+	const rel = toRelative(absPath, root);
+	if (!rel) return null;
+	for (const element of elements) if (element.test(rel)) return element.type;
+	return null;
+}
+/**
+* Classify a bare workspace specifier (`@scope/pkg[/sub]`) to an element type
+* by resolving it to its package directory and classifying that dir.
+*
+* @param specifier import specifier as written
+* @param root absolute monorepo root
+* @param elements ordered element list
+*/
+function classifySpecifier(specifier, root, elements) {
+	const dir = resolveSpecifierDir(specifier, getPackageIndex(root));
+	if (!dir) return null;
+	return classifyPath(dir, root, elements);
+}
+/**
+* Resolve an import specifier (relative or bare workspace) to the element type
+* of its target. Returns null for external deps (`zod`, `hono`, …) and for
+* anything that classifies to no element.
+*
+* @param specifier import specifier as written (`node.source.value`)
+* @param fromFile absolute path of the importing file
+* @param root absolute monorepo root
+* @param options elements + workspace scope
+*/
+function classifyTarget(specifier, fromFile, root, { elements, workspaceScope }) {
+	if (specifier.startsWith(".")) return classifyPath(resolve(dirname$1(fromFile), specifier), root, elements);
+	if (specifier.startsWith(workspaceScope)) return classifySpecifier(specifier, root, elements);
+	return null;
+}
+/**
+* Evaluate whether `fromType` may import `toType` given the import kind.
+*
+* Rules:
+*   - self (`toType === fromType`)            -> allowed (intra-package).
+*   - `ALLOW[fromType]` contains `toType`     -> allowed (value edge).
+*   - `typeOnly` AND `TYPE_ONLY_ALLOW[from]`
+*     contains `toType`                       -> allowed (type-only carve-out).
+*   - otherwise                               -> disallowed.
+*
+* @param fromType element type of the importing file
+* @param toType element type of the imported target
+* @param typeOnly whether the import is `import type` (declaration-level)
+* @param table the repo-specific table (passed in)
+*/
+function evaluate(fromType, toType, typeOnly, table) {
+	if (toType === fromType) return {
+		allowed: true,
+		reason: "self"
+	};
+	if (table.ALLOW[fromType]?.has(toType)) return {
+		allowed: true,
+		reason: "value-allow"
+	};
+	if (typeOnly && table.TYPE_ONLY_ALLOW[fromType]?.has(toType)) return {
+		allowed: true,
+		reason: "type-allow"
+	};
+	return {
+		allowed: false,
+		reason: "disallow"
+	};
+}
+//#endregion
+//#region src/config.ts
+var BoundariesConfigError = class extends Error {
+	constructor(message) {
+		super(`Invalid settings.boundaries: ${message}`);
+		this.name = "BoundariesConfigError";
+	}
+};
+function fail(message) {
+	throw new BoundariesConfigError(message);
+}
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function escapeLiteral(literal) {
+	return literal.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function compileElementPattern(pattern, label) {
+	const dir = pattern.replaceAll("\\", "/").replace(/^\.\//, "").replace(/\/\*\*$/, "").replace(/\/+$/, "");
+	if (dir === "" || dir === "**") fail(`${label} pattern ${JSON.stringify(pattern)} is too broad - name a directory.`);
+	if (dir.includes("*")) fail(`${label} pattern ${JSON.stringify(pattern)} is unsupported - element patterns must be a directory ("dir") or a directory tree ("dir" + slash + globstar), with no wildcards inside the path.`);
+	const re = new RegExp(`^${escapeLiteral(dir)}(/|$)`);
+	return (relPath) => re.test(relPath);
+}
+function compileIgnorePattern(pattern) {
+	const normalized = pattern.replaceAll("\\", "/").replace(/^\.\//, "");
+	const trailingTree = normalized.endsWith("/**");
+	const body = trailingTree ? normalized.slice(0, -3) : normalized;
+	let source = "";
+	let i = 0;
+	while (i < body.length) if (body.startsWith("**/", i)) {
+		source += "(?:.*/)?";
+		i += 3;
+	} else if (body.startsWith("**", i)) {
+		source += ".*";
+		i += 2;
+	} else if (body[i] === "*") {
+		source += "[^/]*";
+		i += 1;
+	} else {
+		source += escapeLiteral(body[i]);
+		i += 1;
+	}
+	const re = new RegExp(`^${source}${trailingTree ? "(/|$)" : "$"}`);
+	return (relPath) => re.test(relPath);
+}
+function validateElements(raw) {
+	if (!Array.isArray(raw)) fail("`elements` is required and must be an array.");
+	if (raw.length === 0) fail("`elements` must be a non-empty array.");
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	raw.forEach((entry, idx) => {
+		if (!isObject(entry)) fail(`elements[${idx}] must be an object.`);
+		const { type, pattern } = entry;
+		if (typeof type !== "string" || type === "") fail(`elements[${idx}] is missing a string \`type\`.`);
+		if (typeof pattern !== "string" || pattern === "") fail(`elements[${idx}] (type ${JSON.stringify(type)}) is missing a string \`pattern\`.`);
+		if (seen.has(type)) fail(`duplicate element type ${JSON.stringify(type)}.`);
+		seen.add(type);
+		out.push({
+			type,
+			pattern
+		});
+	});
+	return out;
+}
+function validateRules(raw, knownTypes) {
+	if (!Array.isArray(raw)) fail("`rules` is required and must be an array.");
+	const out = [];
+	raw.forEach((entry, idx) => {
+		if (!isObject(entry)) fail(`rules[${idx}] must be an object.`);
+		const { from, allow, importKind, message } = entry;
+		if (typeof from !== "string" || from === "") fail(`rules[${idx}] is missing a string \`from\`.`);
+		if (!knownTypes.has(from)) fail(`rules[${idx}].from references unknown element type ${JSON.stringify(from)}.`);
+		if (!Array.isArray(allow)) fail(`rules[${idx}] (from ${JSON.stringify(from)}) is missing an \`allow\` array.`);
+		allow.forEach((to, j) => {
+			if (typeof to !== "string" || to === "") fail(`rules[${idx}].allow[${j}] must be a non-empty string.`);
+			if (!knownTypes.has(to)) fail(`rules[${idx}].allow references unknown element type ${JSON.stringify(to)}.`);
+		});
+		if (importKind !== void 0 && importKind !== "value" && importKind !== "type") fail(`rules[${idx}].importKind must be "value" or "type" (got ${JSON.stringify(importKind)}).`);
+		if (message !== void 0 && typeof message !== "string") fail(`rules[${idx}].message must be a string.`);
+		out.push({
+			from,
+			allow,
+			...importKind !== void 0 ? { importKind } : {},
+			...message !== void 0 ? { message } : {}
+		});
+	});
+	return out;
+}
+function deriveWorkspaceScope(packageNames) {
+	const scopes = /* @__PURE__ */ new Set();
+	for (const name of packageNames) {
+		const match = /^(@[^/]+\/)/.exec(name);
+		if (!match) return null;
+		scopes.add(match[1]);
+	}
+	if (scopes.size !== 1) return null;
+	return [...scopes][0];
+}
+function compileConfig(raw, options = {}) {
+	if (!isObject(raw)) fail("settings.boundaries must be an object.");
+	const elementConfigs = validateElements(raw.elements);
+	const knownTypes = new Set(elementConfigs.map((e) => e.type));
+	const ruleConfigs = validateRules(raw.rules, knownTypes);
+	let dflt = "disallow";
+	if (raw.default !== void 0) {
+		if (raw.default !== "allow" && raw.default !== "disallow") fail(`\`default\` must be "allow" or "disallow" (got ${JSON.stringify(raw.default)}).`);
+		dflt = raw.default;
+	}
+	let ignorePatterns = [];
+	if (raw.ignore !== void 0) {
+		if (!Array.isArray(raw.ignore)) fail("`ignore` must be an array of glob strings.");
+		raw.ignore.forEach((p, idx) => {
+			if (typeof p !== "string" || p === "") fail(`ignore[${idx}] must be a non-empty string.`);
+		});
+		ignorePatterns = raw.ignore;
+	}
+	let workspaceScope;
+	if (raw.workspaceScope !== void 0) {
+		if (typeof raw.workspaceScope !== "string" || raw.workspaceScope === "") fail("`workspaceScope` must be a non-empty string (e.g. \"@acme/\").");
+		workspaceScope = raw.workspaceScope;
+	} else {
+		const derived = deriveWorkspaceScope(options.packageNames ?? []);
+		if (derived === null) fail("`workspaceScope` is required and could not be derived from the workspace package names. Set settings.boundaries.workspaceScope to your packages' shared scope (e.g. \"@acme/\").");
+		workspaceScope = derived;
+	}
+	const elements = elementConfigs.map((e) => ({
+		type: e.type,
+		test: compileElementPattern(e.pattern, `elements[type ${JSON.stringify(e.type)}]`)
+	}));
+	const ignore = ignorePatterns.map((pattern, idx) => ({
+		type: `ignore[${idx}]`,
+		test: compileIgnorePattern(pattern)
+	}));
+	const ALLOW = {};
+	const TYPE_ONLY_ALLOW = {};
+	const messages = /* @__PURE__ */ new Map();
+	const edgeKey = (from, to) => `${from} ${to}`;
+	for (const rule of ruleConfigs) {
+		const target = rule.importKind === "type" ? TYPE_ONLY_ALLOW : ALLOW;
+		const set = target[rule.from] ??= /* @__PURE__ */ new Set();
+		for (const to of rule.allow) {
+			set.add(to);
+			if (rule.message !== void 0) messages.set(edgeKey(rule.from, to), rule.message);
+		}
+	}
+	return {
+		elements,
+		table: {
+			ELEMENTS: elements,
+			ALLOW,
+			TYPE_ONLY_ALLOW
+		},
+		default: dflt,
+		ignore,
+		workspaceScope,
+		messageFor: (fromType, toType) => messages.get(edgeKey(fromType, toType))
+	};
+}
+//#endregion
+//#region src/index.ts
+const rootCache = /* @__PURE__ */ new Map();
+function rootFor(filename, cwd) {
+	const fileDir = dirname(filename);
+	const cached = rootCache.get(fileDir);
+	if (cached !== void 0) return cached;
+	const root = findWorkspaceRoot(fileDir, cwd);
+	rootCache.set(fileDir, root);
+	return root;
+}
+const compiledCache = /* @__PURE__ */ new Map();
+function compiledFor(context, root) {
+	const cached = compiledCache.get(root);
+	if (cached !== void 0) return cached;
+	const settings = context.settings;
+	if (settings.boundaries === void 0 || settings.boundaries === null) {
+		compiledCache.set(root, null);
+		return null;
+	}
+	const packageNames = discoverPackages(root).map((p) => p.name);
+	const compiled = compileConfig(settings.boundaries, { packageNames });
+	compiledCache.set(root, compiled);
+	return compiled;
+}
+function isIgnored(compiled, filename, root) {
+	if (compiled.ignore.length === 0) return false;
+	const rel = toRelative(filename, root);
+	return compiled.ignore.some((matcher) => matcher.test(rel));
+}
+const plugin = definePlugin({
+	meta: { name: "boundaries" },
+	rules: {
+		"element-types": defineRule({
+			meta: {
+				type: "problem",
+				docs: { description: "Enforce the configured cross-package dependency matrix (which element types may import which)." }
+			},
+			createOnce(context) {
+				return { ImportDeclaration(node) {
+					const filename = context.filename;
+					const root = rootFor(filename, context.cwd);
+					const compiled = compiledFor(context, root);
+					if (!compiled) return;
+					if (isIgnored(compiled, filename, root)) return;
+					const fromType = classifyPath(filename, root, compiled.elements);
+					if (fromType === null) return;
+					const specifier = node.source.value;
+					const toType = classifyTarget(specifier, filename, root, {
+						elements: compiled.elements,
+						workspaceScope: compiled.workspaceScope
+					});
+					if (toType === null) return;
+					const typeOnly = node.importKind === "type";
+					if (evaluate(fromType, toType, typeOnly, compiled.table).allowed) return;
+					if (compiled.default === "allow") return;
+					const message = compiled.messageFor(fromType, toType) ?? `'${fromType}' is not allowed to import '${toType}'.` + (typeOnly ? "" : ` (If this should be type-only, use \`import type\`.)`);
+					context.report({
+						message,
+						node
+					});
+				} };
+			}
+		}),
+		"no-unknown": defineRule({
+			meta: {
+				type: "problem",
+				docs: { description: "Disallow importing a workspace-scope specifier that resolves to no package (typo / nonexistent)." }
+			},
+			createOnce(context) {
+				return { ImportDeclaration(node) {
+					const filename = context.filename;
+					const root = rootFor(filename, context.cwd);
+					const compiled = compiledFor(context, root);
+					if (!compiled) return;
+					if (isIgnored(compiled, filename, root)) return;
+					if (classifyPath(filename, root, compiled.elements) === null) return;
+					const specifier = node.source.value;
+					if (!specifier.startsWith(compiled.workspaceScope)) return;
+					if (resolveSpecifierDir(specifier, getPackageIndex(root)) !== null) return;
+					context.report({
+						message: `Unknown workspace import: '${specifier}' resolves to no ${compiled.workspaceScope}* package (typo?).`,
+						node
+					});
+				} };
+			}
+		})
+	}
+});
+//#endregion
+export { plugin as default };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["dirname","dirname"],"sources":["../src/discover.ts","../src/engine.ts","../src/config.ts","../src/index.ts"],"sourcesContent":["// GENERIC engine module — package discovery.\n//\n// Zero repo-specific constants live here. This is part of the extraction seam\n// for the standalone package: `discover.ts` + `engine.ts` form the reusable\n// engine; the boundary table is passed in.\n//\n// oxlint exposes NO module resolver to JS plugins (verified against oxlint\n// 1.69.0): a rule sees one file's AST + that file's path + config `settings`,\n// nothing cross-file. So we classify by PATH. To turn a bare workspace\n// specifier (e.g. `@scope/core`) into a directory, we read every workspace\n// `package.json`'s `name` once and build a name -> dir index.\n\nimport { existsSync, readdirSync, readFileSync, statSync } from \"node:fs\";\nimport { dirname, join, resolve, sep } from \"node:path\";\n\nexport interface DiscoveredPackage {\n  name: string;\n  dir: string;\n}\n\n// Minimal shape we read off a parsed package.json. `JSON.parse` yields `any`;\n// narrowing through this type keeps the loose runtime checks below honest.\ninterface PackageJson {\n  name?: unknown;\n  workspaces?: unknown;\n}\n\n/**\n * Walk up from `startDir` to the monorepo root: the nearest ancestor whose\n * `package.json` declares `\"workspaces\"`. Falls back to `fallback` (typically\n * `context.cwd`) when no such ancestor exists.\n *\n * Keying off the file path (not cwd) is what makes classification\n * cwd-independent — running oxlint from a workspace subdir resolves the same\n * root as running from the repo root.\n */\nexport function findWorkspaceRoot(startDir: string, fallback: string): string {\n  let dir = startDir;\n  // Guard against symlink / root loops: stop when `dirname` stops changing.\n  for (;;) {\n    const pkgPath = join(dir, \"package.json\");\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(readFileSync(pkgPath, \"utf8\")) as PackageJson;\n        if (pkg && pkg.workspaces !== undefined) return dir;\n      } catch {\n        // Unreadable/!JSON package.json — keep walking up.\n      }\n    }\n    const parent = dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return fallback;\n}\n\n/**\n * Read the `workspaces` field of a root `package.json` and return the raw glob\n * patterns. Supports both the array form (`[\"apps/*\", ...]`) and the Bun/Yarn\n * object form (`{ packages: [...] }`). Returns `[]` on any problem.\n */\nfunction readWorkspaceGlobs(root: string): string[] {\n  try {\n    const pkg = JSON.parse(readFileSync(join(root, \"package.json\"), \"utf8\")) as PackageJson;\n    const ws = pkg.workspaces;\n    if (Array.isArray(ws)) return ws as string[];\n    if (ws && typeof ws === \"object\" && Array.isArray((ws as { packages?: unknown }).packages)) {\n      return (ws as { packages: string[] }).packages;\n    }\n  } catch {\n    // fall through\n  }\n  return [];\n}\n\n/**\n * Expand a single workspace glob into concrete package directories.\n *\n * Only the two shapes monorepos actually use are handled: a literal directory\n * (`packages/core`) and a single-level wildcard (`packages/*`, `apps/*`). A\n * `**` glob is treated as the directory before it. No glob engine needed.\n */\nfunction expandGlob(root: string, glob: string): string[] {\n  const normalized = glob.replaceAll(\"\\\\\", \"/\").replace(/\\/+$/, \"\");\n  const starIdx = normalized.indexOf(\"*\");\n  if (starIdx === -1) {\n    const dir = resolve(root, normalized);\n    return existsSync(dir) ? [dir] : [];\n  }\n  // Parent of the first wildcard segment, e.g. \"packages/*\" -> \"packages\".\n  const beforeStar = normalized.slice(0, starIdx);\n  const parentRel = beforeStar.replace(/\\/[^/]*$/, \"\").replace(/\\/$/, \"\");\n  const parentDir = resolve(root, parentRel);\n  if (!existsSync(parentDir)) return [];\n  const out: string[] = [];\n  for (const entry of readdirSync(parentDir)) {\n    if (entry.startsWith(\".\")) continue;\n    const child = join(parentDir, entry);\n    try {\n      if (statSync(child).isDirectory()) out.push(child);\n    } catch {\n      // ignore unreadable entries\n    }\n  }\n  return out;\n}\n\n/**\n * Discover every workspace package under `root`: read each candidate dir's\n * `package.json` and pair its `name` with its absolute directory.\n */\nexport function discoverPackages(root: string): DiscoveredPackage[] {\n  const packages: DiscoveredPackage[] = [];\n  const seen = new Set<string>();\n  for (const glob of readWorkspaceGlobs(root)) {\n    for (const dir of expandGlob(root, glob)) {\n      if (seen.has(dir)) continue;\n      seen.add(dir);\n      try {\n        const pkg = JSON.parse(readFileSync(join(dir, \"package.json\"), \"utf8\")) as PackageJson;\n        if (pkg && typeof pkg.name === \"string\") {\n          packages.push({ name: pkg.name, dir });\n        }\n      } catch {\n        // No/!JSON package.json in this dir — not a package; skip.\n      }\n    }\n  }\n  return packages;\n}\n\n/**\n * Build a `packageName -> absoluteDir` map, memoized per monorepo root so the\n * filesystem scan runs once across all linted files (mirrors oxlint's\n * once-per-process `createOnce` design).\n */\nconst indexCache = new Map<string, Map<string, string>>();\n\nexport function getPackageIndex(root: string): Map<string, string> {\n  const cached = indexCache.get(root);\n  if (cached) return cached;\n  const index = new Map<string, string>();\n  for (const { name, dir } of discoverPackages(root)) index.set(name, dir);\n  indexCache.set(root, index);\n  return index;\n}\n\n/**\n * Resolve a bare package specifier to its package directory via the index.\n *\n * Handles subpath specifiers (`@scope/pkg/sub`) by matching the longest\n * package name that the specifier equals or starts with (`name + \"/\"`). The\n * matched package's directory is returned; subpath refinement (mapping\n * `@scope/pkg/sub` to a sub-element) is intentionally NOT done here — callers\n * classify the returned dir. Today only bare names are used.\n */\nexport function resolveSpecifierDir(specifier: string, index: Map<string, string>): string | null {\n  // Exact package name.\n  const exact = index.get(specifier);\n  if (exact) return exact;\n  // Longest-prefix match for subpath specifiers (`@scope/pkg/sub`).\n  let bestDir: string | null = null;\n  let bestLen = -1;\n  for (const [name, dir] of index) {\n    const prefix = name + \"/\";\n    if (specifier.startsWith(prefix) && name.length > bestLen) {\n      bestDir = dir;\n      bestLen = name.length;\n    }\n  }\n  return bestDir;\n}\n\n// Re-export for callers that build paths relative to a file.\nexport { dirname, resolve, sep };\n","// GENERIC engine module — path classification + matrix evaluation.\n//\n// Zero repo-specific constants live here. Everything repo-specific (the element\n// list, the allow-matrix, the type-only carve-out) is passed in via a `table`\n// object. This is the extraction seam for the standalone package: `engine.ts` +\n// `discover.ts` are the reusable engine.\n//\n// Classification is by FILE PATH, because oxlint exposes no module resolver to\n// JS plugins (verified against oxlint 1.69.0). Both ends of an import are\n// classified to an element type from the path alone:\n//   - importing file  -> `context.filename`            (absolute)\n//   - imported target -> relative spec resolved against the file dir, OR a bare\n//                         workspace specifier mapped to its package dir.\n\nimport { dirname, getPackageIndex, resolve, resolveSpecifierDir } from \"./discover.js\";\n\nexport interface Element {\n  type: string;\n  test: (relPath: string) => boolean;\n}\n\nexport interface BoundaryTable {\n  /** Ordered, specific-before-parent. First matching element wins. */\n  ELEMENTS: Element[];\n  /** `fromType -> Set(allowed toType)` for VALUE imports. */\n  ALLOW: Record<string, Set<string>>;\n  /** `fromType -> Set(allowed toType)` permitted ONLY for `import type` edges. */\n  TYPE_ONLY_ALLOW: Record<string, Set<string>>;\n}\n\n/** Options for {@link classifyTarget}. */\nexport interface ClassifyTargetOptions {\n  /** Ordered element list. */\n  elements: Element[];\n  /**\n   * Scope prefix marking workspace packages (e.g. `\"@scope/\"`). Bare specifiers\n   * outside this scope are treated as external and ignored.\n   */\n  workspaceScope: string;\n}\n\n/**\n * Normalize an absolute path to forward slashes and strip the monorepo-root\n * prefix, yielding a root-relative path the element tests match against\n * (e.g. `apps/api/src/http/app.ts`). This mirrors the old\n * `eslint-plugin-boundaries` `mode:\"full\"` behavior, which matched patterns\n * against root-relative paths.\n *\n * @param absPath absolute path\n * @param root absolute monorepo root\n * @returns root-relative, forward-slashed path\n */\nexport function toRelative(absPath: string, root: string): string {\n  const normAbs = absPath.replaceAll(\"\\\\\", \"/\");\n  const normRoot = root.replaceAll(\"\\\\\", \"/\").replace(/\\/+$/, \"\");\n  if (normAbs === normRoot) return \"\";\n  if (normAbs.startsWith(normRoot + \"/\")) return normAbs.slice(normRoot.length + 1);\n  return normAbs; // outside the root — return as-is; element tests just won't match\n}\n\n/**\n * Classify an absolute path to an element type, or null if it matches no\n * element. The first matching element in `ELEMENTS` wins, so the table MUST be\n * ordered specific-before-parent.\n *\n * @param absPath absolute path to classify\n * @param root absolute monorepo root\n * @param elements ordered element list\n */\nexport function classifyPath(absPath: string, root: string, elements: Element[]): string | null {\n  const rel = toRelative(absPath, root);\n  if (!rel) return null;\n  for (const element of elements) {\n    if (element.test(rel)) return element.type;\n  }\n  return null;\n}\n\n/**\n * Classify a bare workspace specifier (`@scope/pkg[/sub]`) to an element type\n * by resolving it to its package directory and classifying that dir.\n *\n * @param specifier import specifier as written\n * @param root absolute monorepo root\n * @param elements ordered element list\n */\nexport function classifySpecifier(\n  specifier: string,\n  root: string,\n  elements: Element[],\n): string | null {\n  const dir = resolveSpecifierDir(specifier, getPackageIndex(root));\n  if (!dir) return null;\n  return classifyPath(dir, root, elements);\n}\n\n/**\n * Resolve an import specifier (relative or bare workspace) to the element type\n * of its target. Returns null for external deps (`zod`, `hono`, …) and for\n * anything that classifies to no element.\n *\n * @param specifier import specifier as written (`node.source.value`)\n * @param fromFile absolute path of the importing file\n * @param root absolute monorepo root\n * @param options elements + workspace scope\n */\nexport function classifyTarget(\n  specifier: string,\n  fromFile: string,\n  root: string,\n  { elements, workspaceScope }: ClassifyTargetOptions,\n): string | null {\n  if (specifier.startsWith(\".\")) {\n    const abs = resolve(dirname(fromFile), specifier);\n    return classifyPath(abs, root, elements);\n  }\n  if (specifier.startsWith(workspaceScope)) {\n    return classifySpecifier(specifier, root, elements);\n  }\n  return null; // external dependency — not a boundary edge\n}\n\nexport interface Verdict {\n  allowed: boolean;\n  reason: \"self\" | \"value-allow\" | \"type-allow\" | \"disallow\";\n}\n\n/**\n * Evaluate whether `fromType` may import `toType` given the import kind.\n *\n * Rules:\n *   - self (`toType === fromType`)            -> allowed (intra-package).\n *   - `ALLOW[fromType]` contains `toType`     -> allowed (value edge).\n *   - `typeOnly` AND `TYPE_ONLY_ALLOW[from]`\n *     contains `toType`                       -> allowed (type-only carve-out).\n *   - otherwise                               -> disallowed.\n *\n * @param fromType element type of the importing file\n * @param toType element type of the imported target\n * @param typeOnly whether the import is `import type` (declaration-level)\n * @param table the repo-specific table (passed in)\n */\nexport function evaluate(\n  fromType: string,\n  toType: string,\n  typeOnly: boolean,\n  table: BoundaryTable,\n): Verdict {\n  if (toType === fromType) return { allowed: true, reason: \"self\" };\n  if (table.ALLOW[fromType]?.has(toType)) return { allowed: true, reason: \"value-allow\" };\n  if (typeOnly && table.TYPE_ONLY_ALLOW[fromType]?.has(toType)) {\n    return { allowed: true, reason: \"type-allow\" };\n  }\n  return { allowed: false, reason: \"disallow\" };\n}\n","// Config layer - translate the user's `settings.boundaries` into exactly the\n// structures the generic engine consumes.\n//\n// The engine (engine.ts) is table-free: it takes an ordered `Element[]`, an\n// `ALLOW` map and a `TYPE_ONLY_ALLOW` map and evaluates edges. It knows nothing\n// about the public config schema. THIS module is the only place that schema is\n// understood: it validates the raw config once (throwing actionable errors),\n// compiles element/ignore patterns to matchers, and normalizes the directional\n// rules into the engine's two allow-maps. Pure - no oxlint imports, no\n// filesystem; the Step-4 rule layer wires the compiled output into oxlint.\n\nimport type { BoundaryTable, Element } from \"./engine.js\";\n// Re-export the engine verdict type so Step 4 can import everything it needs\n// from one place.\nexport type { BoundaryTable, Element, Verdict } from \"./engine.js\";\n\n// A single `settings.boundaries.elements[]` entry, post-validation.\nexport interface ElementConfig {\n  type: string;\n  pattern: string;\n}\n\n// A single `settings.boundaries.rules[]` entry, post-validation.\nexport interface RuleConfig {\n  from: string;\n  allow: string[];\n  importKind?: \"value\" | \"type\";\n  message?: string;\n}\n\n// The compiled, validated config the Step-4 rules consume. `elements` and\n// `table.ELEMENTS` are the SAME array (the engine classifies against\n// `table.ELEMENTS`); both are exposed for call-site clarity.\nexport interface CompiledBoundaries {\n  // Ordered, first-match-wins element matchers.\n  elements: Element[];\n  // The engine table: ELEMENTS + ALLOW + TYPE_ONLY_ALLOW.\n  table: BoundaryTable;\n  // Verdict for an edge no rule covers. Applied by the Step-4 rule, not the engine.\n  default: \"allow\" | \"disallow\";\n  // Compiled matchers for files to skip entirely (root-relative path tests).\n  ignore: Element[];\n  // Scope prefix marking workspace-internal bare specifiers, e.g. \"@scope/\".\n  workspaceScope: string;\n  // Per-edge custom message, or undefined when none was configured.\n  messageFor: (fromType: string, toType: string) => string | undefined;\n}\n\n// Options for compileConfig.\nexport interface CompileConfigOptions {\n  // Workspace package names (from `discoverPackages`) used to DERIVE\n  // `workspaceScope` when the config omits it. Ignored when the config sets\n  // `workspaceScope` explicitly.\n  packageNames?: string[];\n}\n\n// Thrown for any invalid `settings.boundaries`. The message is actionable.\nexport class BoundariesConfigError extends Error {\n  constructor(message: string) {\n    super(`Invalid settings.boundaries: ${message}`);\n    this.name = \"BoundariesConfigError\";\n  }\n}\n\nfunction fail(message: string): never {\n  throw new BoundariesConfigError(message);\n}\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n// --- pattern compilation ----------------------------------------------------\n\n// Escape every RegExp metacharacter in a literal path fragment.\nfunction escapeLiteral(literal: string): string {\n  return literal.replaceAll(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\n// Compile an ELEMENT pattern (a root-relative path prefix) to a matcher.\n//\n// Supported shapes - the small set monorepos actually use:\n//   - \"dir/<star><star>\" -> match the dir itself AND anything under it.\n//   - \"dir\"              -> identical (a bare directory).\n//\n// Both compile to `^<dir>(/|$)` (gotcha G6). The `(/|$)` boundary is the whole\n// point: a bare workspace specifier (`@scope/core`) resolves to a package dir\n// with NO trailing segment, so a \"must be followed by slash\" test would\n// silently classify it as null and no-op the rule. `(/|$)` matches the dir\n// itself while still preventing `apps/api` from matching `apps/api-client`.\n//\n// Anything else (a mid-segment wildcard, a `*.ext` tail, a leading globstar\n// segment) is rejected - element patterns are prefixes, not file globs.\nfunction compileElementPattern(pattern: string, label: string): (relPath: string) => boolean {\n  const normalized = pattern.replaceAll(\"\\\\\", \"/\").replace(/^\\.\\//, \"\");\n  // Strip an optional trailing globstar segment (or bare slash) for the prefix.\n  const dir = normalized.replace(/\\/\\*\\*$/, \"\").replace(/\\/+$/, \"\");\n  if (dir === \"\" || dir === \"**\") {\n    fail(`${label} pattern ${JSON.stringify(pattern)} is too broad - name a directory.`);\n  }\n  if (dir.includes(\"*\")) {\n    fail(\n      `${label} pattern ${JSON.stringify(pattern)} is unsupported - element patterns must be a ` +\n        `directory (\"dir\") or a directory tree (\"dir\" + slash + globstar), with no wildcards ` +\n        `inside the path.`,\n    );\n  }\n  const re = new RegExp(`^${escapeLiteral(dir)}(/|$)`);\n  return (relPath) => re.test(relPath);\n}\n\n// Compile an IGNORE glob to a matcher. Ignore patterns are file globs (they\n// match a whole root-relative path), so they support a broader vocabulary than\n// element prefixes:\n//   - globstar -> any characters, any depth (`.*`)\n//   - `*`      -> any characters within a single segment (`[^/]*`)\n//   - a trailing \"dir/\" + globstar also matches the bare dir (`(/|$)`\n//     boundary), matching element semantics so an ignore and an element written\n//     the same way agree.\n//\n// Everything else is treated as a literal.\nfunction compileIgnorePattern(pattern: string): (relPath: string) => boolean {\n  const normalized = pattern.replaceAll(\"\\\\\", \"/\").replace(/^\\.\\//, \"\");\n  // Special-case a trailing globstar segment so `packages/core/<star><star>`\n  // also matches the bare dir `packages/core` (same `(/|$)` boundary as\n  // element patterns).\n  const trailingTree = normalized.endsWith(\"/**\");\n  const body = trailingTree ? normalized.slice(0, -3) : normalized;\n\n  let source = \"\";\n  let i = 0;\n  while (i < body.length) {\n    if (body.startsWith(\"**/\", i)) {\n      // Leading globstar segment - any number of leading segments (incl. none).\n      source += \"(?:.*/)?\";\n      i += 3;\n    } else if (body.startsWith(\"**\", i)) {\n      source += \".*\";\n      i += 2;\n    } else if (body[i] === \"*\") {\n      source += \"[^/]*\";\n      i += 1;\n    } else {\n      source += escapeLiteral(body[i] as string);\n      i += 1;\n    }\n  }\n  const tail = trailingTree ? \"(/|$)\" : \"$\";\n  const re = new RegExp(`^${source}${tail}`);\n  return (relPath) => re.test(relPath);\n}\n\n// --- validation -------------------------------------------------------------\n\nfunction validateElements(raw: unknown): ElementConfig[] {\n  if (!Array.isArray(raw)) fail(\"`elements` is required and must be an array.\");\n  if (raw.length === 0) fail(\"`elements` must be a non-empty array.\");\n  const seen = new Set<string>();\n  const out: ElementConfig[] = [];\n  raw.forEach((entry, idx) => {\n    if (!isObject(entry)) fail(`elements[${idx}] must be an object.`);\n    const { type, pattern } = entry;\n    if (typeof type !== \"string\" || type === \"\") {\n      fail(`elements[${idx}] is missing a string \\`type\\`.`);\n    }\n    if (typeof pattern !== \"string\" || pattern === \"\") {\n      fail(`elements[${idx}] (type ${JSON.stringify(type)}) is missing a string \\`pattern\\`.`);\n    }\n    if (seen.has(type)) fail(`duplicate element type ${JSON.stringify(type)}.`);\n    seen.add(type);\n    out.push({ type, pattern });\n  });\n  return out;\n}\n\nfunction validateRules(raw: unknown, knownTypes: Set<string>): RuleConfig[] {\n  if (!Array.isArray(raw)) fail(\"`rules` is required and must be an array.\");\n  const out: RuleConfig[] = [];\n  raw.forEach((entry, idx) => {\n    if (!isObject(entry)) fail(`rules[${idx}] must be an object.`);\n    const { from, allow, importKind, message } = entry;\n    if (typeof from !== \"string\" || from === \"\") {\n      fail(`rules[${idx}] is missing a string \\`from\\`.`);\n    }\n    if (!knownTypes.has(from)) {\n      fail(`rules[${idx}].from references unknown element type ${JSON.stringify(from)}.`);\n    }\n    if (!Array.isArray(allow)) {\n      fail(`rules[${idx}] (from ${JSON.stringify(from)}) is missing an \\`allow\\` array.`);\n    }\n    allow.forEach((to, j) => {\n      if (typeof to !== \"string\" || to === \"\") {\n        fail(`rules[${idx}].allow[${j}] must be a non-empty string.`);\n      }\n      if (!knownTypes.has(to)) {\n        fail(`rules[${idx}].allow references unknown element type ${JSON.stringify(to)}.`);\n      }\n    });\n    if (importKind !== undefined && importKind !== \"value\" && importKind !== \"type\") {\n      fail(\n        `rules[${idx}].importKind must be \"value\" or \"type\" (got ${JSON.stringify(importKind)}).`,\n      );\n    }\n    if (message !== undefined && typeof message !== \"string\") {\n      fail(`rules[${idx}].message must be a string.`);\n    }\n    out.push({\n      from,\n      allow: allow as string[],\n      ...(importKind !== undefined ? { importKind: importKind as \"value\" | \"type\" } : {}),\n      ...(message !== undefined ? { message: message as string } : {}),\n    });\n  });\n  return out;\n}\n\n// --- workspaceScope ---------------------------------------------------------\n\n// Derive the workspace scope prefix shared by every package name, e.g.\n// `[\"@acme/core\", \"@acme/api\"]` -> `\"@acme/\"`. Returns null when the names do\n// not all share a single `@scope/` prefix (so the caller can fall back to the\n// explicit config field or fail loudly).\nexport function deriveWorkspaceScope(packageNames: string[]): string | null {\n  const scopes = new Set<string>();\n  for (const name of packageNames) {\n    const match = /^(@[^/]+\\/)/.exec(name);\n    if (!match) return null; // an unscoped package - no common scope\n    scopes.add(match[1] as string);\n  }\n  if (scopes.size !== 1) return null;\n  return [...scopes][0] as string;\n}\n\n// --- entry point ------------------------------------------------------------\n\n// Validate and compile a raw `settings.boundaries` object into the structures\n// the Step-4 rules consume. Throws BoundariesConfigError with an actionable\n// message on any invalid config.\nexport function compileConfig(\n  raw: unknown,\n  options: CompileConfigOptions = {},\n): CompiledBoundaries {\n  if (!isObject(raw)) {\n    fail(\"settings.boundaries must be an object.\");\n  }\n\n  const elementConfigs = validateElements(raw.elements);\n  const knownTypes = new Set(elementConfigs.map((e) => e.type));\n  const ruleConfigs = validateRules(raw.rules, knownTypes);\n\n  // `default`.\n  let dflt: \"allow\" | \"disallow\" = \"disallow\";\n  if (raw.default !== undefined) {\n    if (raw.default !== \"allow\" && raw.default !== \"disallow\") {\n      fail(`\\`default\\` must be \"allow\" or \"disallow\" (got ${JSON.stringify(raw.default)}).`);\n    }\n    dflt = raw.default;\n  }\n\n  // `ignore`.\n  let ignorePatterns: string[] = [];\n  if (raw.ignore !== undefined) {\n    if (!Array.isArray(raw.ignore)) fail(\"`ignore` must be an array of glob strings.\");\n    raw.ignore.forEach((p, idx) => {\n      if (typeof p !== \"string\" || p === \"\") fail(`ignore[${idx}] must be a non-empty string.`);\n    });\n    ignorePatterns = raw.ignore as string[];\n  }\n\n  // `workspaceScope`: explicit field wins; otherwise derive from package names.\n  let workspaceScope: string;\n  if (raw.workspaceScope !== undefined) {\n    if (typeof raw.workspaceScope !== \"string\" || raw.workspaceScope === \"\") {\n      fail('`workspaceScope` must be a non-empty string (e.g. \"@acme/\").');\n    }\n    workspaceScope = raw.workspaceScope;\n  } else {\n    const derived = deriveWorkspaceScope(options.packageNames ?? []);\n    if (derived === null) {\n      fail(\n        \"`workspaceScope` is required and could not be derived from the workspace package \" +\n          \"names. Set settings.boundaries.workspaceScope to your packages' shared scope \" +\n          '(e.g. \"@acme/\").',\n      );\n    }\n    workspaceScope = derived;\n  }\n\n  // Compile element matchers (ordered, first-match-wins preserved).\n  const elements: Element[] = elementConfigs.map((e) => ({\n    type: e.type,\n    test: compileElementPattern(e.pattern, `elements[type ${JSON.stringify(e.type)}]`),\n  }));\n\n  // Compile ignore matchers - reuse the Element shape (type is a placeholder\n  // label; only `test` is used by the rule).\n  const ignore: Element[] = ignorePatterns.map((pattern, idx) => ({\n    type: `ignore[${idx}]`,\n    test: compileIgnorePattern(pattern),\n  }));\n\n  // Normalize rules into ALLOW / TYPE_ONLY_ALLOW (union same-`from`, never\n  // overwrite). Keep a per-edge message lookup.\n  const ALLOW: Record<string, Set<string>> = {};\n  const TYPE_ONLY_ALLOW: Record<string, Set<string>> = {};\n  const messages = new Map<string, string>();\n  const edgeKey = (from: string, to: string) => `${from} ${to}`;\n\n  for (const rule of ruleConfigs) {\n    const target = rule.importKind === \"type\" ? TYPE_ONLY_ALLOW : ALLOW;\n    const set = (target[rule.from] ??= new Set<string>());\n    for (const to of rule.allow) {\n      set.add(to);\n      if (rule.message !== undefined) messages.set(edgeKey(rule.from, to), rule.message);\n    }\n  }\n\n  const table: BoundaryTable = { ELEMENTS: elements, ALLOW, TYPE_ONLY_ALLOW };\n\n  return {\n    elements,\n    table,\n    default: dflt,\n    ignore,\n    workspaceScope,\n    messageFor: (fromType, toType) => messages.get(edgeKey(fromType, toType)),\n  };\n}\n","// Public entry point for oxlint-plugin-boundaries.\n//\n// Wires the generic engine (engine.ts) and the config layer (config.ts) into two\n// oxlint jsPlugins rules:\n//   - boundaries/element-types — enforce the configured allow-matrix (with the\n//     type-only carve-out and the `default` verdict).\n//   - boundaries/no-unknown    — flag a workspace specifier that resolves to no\n//     package (typo / deleted package).\n//\n// oxlint's plugin layer exposes NO module resolver, so both ends of an import are\n// classified by FILE PATH (see engine.ts / discover.ts). The element table and\n// allow-matrix come entirely from `settings.boundaries` (config.ts), which is\n// what makes this package generic — no repo-specific constants live here.\n//\n// Honored alpha-API gotchas (verified against oxlint / @oxlint/plugins 1.69.0):\n//   G1 — `createOnce` runs ONCE across all files. `context.filename` is read\n//        INSIDE the visitor, never in the `createOnce` body.\n//   G2 — `report()` needs a node carrying `range`; we report on the real\n//        `ImportDeclaration` node.\n//   G5 — plugin name `boundaries`; rule ids `boundaries/element-types`,\n//        `boundaries/no-unknown`.\n\nimport { definePlugin, defineRule } from \"@oxlint/plugins\";\nimport type { Context, ESTree } from \"@oxlint/plugins\";\n\nimport { classifyPath, classifyTarget, evaluate, toRelative } from \"./engine.js\";\nimport {\n  discoverPackages,\n  findWorkspaceRoot,\n  getPackageIndex,\n  resolveSpecifierDir,\n} from \"./discover.js\";\nimport { dirname } from \"node:path\";\nimport { compileConfig, type CompiledBoundaries } from \"./config.js\";\n\n// oxlint exposes its AST node types under the `ESTree` namespace, not as\n// top-level exports. Alias the one node we visit.\ntype ImportDeclaration = ESTree.ImportDeclaration;\n\n// Resolve the monorepo root for a file, memoized by the file's directory. Keying\n// off the file path (not cwd) keeps classification cwd-independent.\nconst rootCache = new Map<string, string>();\nfunction rootFor(filename: string, cwd: string): string {\n  const fileDir = dirname(filename);\n  const cached = rootCache.get(fileDir);\n  if (cached !== undefined) return cached;\n  const root = findWorkspaceRoot(fileDir, cwd);\n  rootCache.set(fileDir, root);\n  return root;\n}\n\n// Compile `settings.boundaries` once per workspace root, memoized. Returns null\n// when no `boundaries` config is present (rule is then a no-op). A present but\n// INVALID config throws BoundariesConfigError (actionable) — not swallowed.\nconst compiledCache = new Map<string, CompiledBoundaries | null>();\nfunction compiledFor(context: Context, root: string): CompiledBoundaries | null {\n  const cached = compiledCache.get(root);\n  if (cached !== undefined) return cached;\n\n  const settings = context.settings as { boundaries?: unknown };\n  if (settings.boundaries === undefined || settings.boundaries === null) {\n    compiledCache.set(root, null);\n    return null;\n  }\n  const packageNames = discoverPackages(root).map((p) => p.name);\n  const compiled = compileConfig(settings.boundaries, { packageNames });\n  compiledCache.set(root, compiled);\n  return compiled;\n}\n\n// True when the importing file should be skipped entirely (matches an `ignore`\n// pattern), computed against the file's root-relative path.\nfunction isIgnored(compiled: CompiledBoundaries, filename: string, root: string): boolean {\n  if (compiled.ignore.length === 0) return false;\n  const rel = toRelative(filename, root);\n  return compiled.ignore.some((matcher) => matcher.test(rel));\n}\n\nconst plugin = definePlugin({\n  meta: { name: \"boundaries\" },\n  rules: {\n    \"element-types\": defineRule({\n      meta: {\n        type: \"problem\",\n        docs: {\n          description:\n            \"Enforce the configured cross-package dependency matrix (which element types may import which).\",\n        },\n      },\n      createOnce(context: Context) {\n        // G1: nothing that reads context.filename here — only inside the visitor.\n        return {\n          ImportDeclaration(node: ImportDeclaration) {\n            const filename = context.filename;\n            const root = rootFor(filename, context.cwd);\n            const compiled = compiledFor(context, root);\n            if (!compiled) return; // rule enabled but not configured -> no-op\n            if (isIgnored(compiled, filename, root)) return;\n\n            const fromType = classifyPath(filename, root, compiled.elements);\n            if (fromType === null) return; // importing file is not a known element\n\n            const specifier = node.source.value;\n            const toType = classifyTarget(specifier, filename, root, {\n              elements: compiled.elements,\n              workspaceScope: compiled.workspaceScope,\n            });\n            if (toType === null) return; // external dep / unclassifiable — not an edge\n\n            const typeOnly = node.importKind === \"type\";\n            const verdict = evaluate(fromType, toType, typeOnly, compiled.table);\n            // The engine never applies `default`; do it here. An uncovered edge\n            // (verdict.allowed === false with reason \"disallow\") is permitted\n            // when default is \"allow\".\n            if (verdict.allowed) return;\n            if (compiled.default === \"allow\") return;\n\n            // G2: report on the real ImportDeclaration node (carries range).\n            const custom = compiled.messageFor(fromType, toType);\n            const message =\n              custom ??\n              `'${fromType}' is not allowed to import '${toType}'.` +\n                (typeOnly ? \"\" : ` (If this should be type-only, use \\`import type\\`.)`);\n            context.report({ message, node });\n          },\n        };\n      },\n    }),\n\n    \"no-unknown\": defineRule({\n      meta: {\n        type: \"problem\",\n        docs: {\n          description:\n            \"Disallow importing a workspace-scope specifier that resolves to no package (typo / nonexistent).\",\n        },\n      },\n      createOnce(context: Context) {\n        return {\n          ImportDeclaration(node: ImportDeclaration) {\n            const filename = context.filename;\n            const root = rootFor(filename, context.cwd);\n            const compiled = compiledFor(context, root);\n            if (!compiled) return;\n            if (isIgnored(compiled, filename, root)) return;\n\n            // Only meaningful from a recognized element.\n            if (classifyPath(filename, root, compiled.elements) === null) return;\n\n            const specifier = node.source.value;\n            if (!specifier.startsWith(compiled.workspaceScope)) return; // external/relative\n\n            const dir = resolveSpecifierDir(specifier, getPackageIndex(root));\n            if (dir !== null) return; // resolves to a real workspace package\n\n            // G2: report on the real node.\n            context.report({\n              message: `Unknown workspace import: '${specifier}' resolves to no ${compiled.workspaceScope}* package (typo?).`,\n              node,\n            });\n          },\n        };\n      },\n    }),\n  },\n});\n\nexport default plugin;\n"],"mappings":";;;;;;;;;;;;;AAoCA,SAAgB,kBAAkB,UAAkB,UAA0B;CAC5E,IAAI,MAAM;CAEV,SAAS;EACP,MAAM,UAAU,KAAK,KAAK,cAAc;EACxC,IAAI,WAAW,OAAO,GACpB,IAAI;GACF,MAAM,MAAM,KAAK,MAAM,aAAa,SAAS,MAAM,CAAC;GACpD,IAAI,OAAO,IAAI,eAAe,KAAA,GAAW,OAAO;EAClD,QAAQ,CAER;EAEF,MAAM,SAASA,UAAQ,GAAG;EAC1B,IAAI,WAAW,KAAK;EACpB,MAAM;CACR;CACA,OAAO;AACT;;;;;;AAOA,SAAS,mBAAmB,MAAwB;CAClD,IAAI;EAEF,MAAM,KADM,KAAK,MAAM,aAAa,KAAK,MAAM,cAAc,GAAG,MAAM,CACzD,CAAC,CAAC;EACf,IAAI,MAAM,QAAQ,EAAE,GAAG,OAAO;EAC9B,IAAI,MAAM,OAAO,OAAO,YAAY,MAAM,QAAS,GAA8B,QAAQ,GACvF,OAAQ,GAA8B;CAE1C,QAAQ,CAER;CACA,OAAO,CAAC;AACV;;;;;;;;AASA,SAAS,WAAW,MAAc,MAAwB;CACxD,MAAM,aAAa,KAAK,WAAW,MAAM,GAAG,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAChE,MAAM,UAAU,WAAW,QAAQ,GAAG;CACtC,IAAI,YAAY,IAAI;EAClB,MAAM,MAAM,QAAQ,MAAM,UAAU;EACpC,OAAO,WAAW,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;CACpC;CAIA,MAAM,YAAY,QAAQ,MAFP,WAAW,MAAM,GAAG,OACZ,CAAC,CAAC,QAAQ,YAAY,EAAE,CAAC,CAAC,QAAQ,OAAO,EAC5B,CAAC;CACzC,IAAI,CAAC,WAAW,SAAS,GAAG,OAAO,CAAC;CACpC,MAAM,MAAgB,CAAC;CACvB,KAAK,MAAM,SAAS,YAAY,SAAS,GAAG;EAC1C,IAAI,MAAM,WAAW,GAAG,GAAG;EAC3B,MAAM,QAAQ,KAAK,WAAW,KAAK;EACnC,IAAI;GACF,IAAI,SAAS,KAAK,CAAC,CAAC,YAAY,GAAG,IAAI,KAAK,KAAK;EACnD,QAAQ,CAER;CACF;CACA,OAAO;AACT;;;;;AAMA,SAAgB,iBAAiB,MAAmC;CAClE,MAAM,WAAgC,CAAC;CACvC,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,QAAQ,mBAAmB,IAAI,GACxC,KAAK,MAAM,OAAO,WAAW,MAAM,IAAI,GAAG;EACxC,IAAI,KAAK,IAAI,GAAG,GAAG;EACnB,KAAK,IAAI,GAAG;EACZ,IAAI;GACF,MAAM,MAAM,KAAK,MAAM,aAAa,KAAK,KAAK,cAAc,GAAG,MAAM,CAAC;GACtE,IAAI,OAAO,OAAO,IAAI,SAAS,UAC7B,SAAS,KAAK;IAAE,MAAM,IAAI;IAAM;GAAI,CAAC;EAEzC,QAAQ,CAER;CACF;CAEF,OAAO;AACT;;;;;;AAOA,MAAM,6BAAa,IAAI,IAAiC;AAExD,SAAgB,gBAAgB,MAAmC;CACjE,MAAM,SAAS,WAAW,IAAI,IAAI;CAClC,IAAI,QAAQ,OAAO;CACnB,MAAM,wBAAQ,IAAI,IAAoB;CACtC,KAAK,MAAM,EAAE,MAAM,SAAS,iBAAiB,IAAI,GAAG,MAAM,IAAI,MAAM,GAAG;CACvE,WAAW,IAAI,MAAM,KAAK;CAC1B,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,oBAAoB,WAAmB,OAA2C;CAEhG,MAAM,QAAQ,MAAM,IAAI,SAAS;CACjC,IAAI,OAAO,OAAO;CAElB,IAAI,UAAyB;CAC7B,IAAI,UAAU;CACd,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO;EAC/B,MAAM,SAAS,OAAO;EACtB,IAAI,UAAU,WAAW,MAAM,KAAK,KAAK,SAAS,SAAS;GACzD,UAAU;GACV,UAAU,KAAK;EACjB;CACF;CACA,OAAO;AACT;;;;;;;;;;;;;;ACvHA,SAAgB,WAAW,SAAiB,MAAsB;CAChE,MAAM,UAAU,QAAQ,WAAW,MAAM,GAAG;CAC5C,MAAM,WAAW,KAAK,WAAW,MAAM,GAAG,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAC9D,IAAI,YAAY,UAAU,OAAO;CACjC,IAAI,QAAQ,WAAW,WAAW,GAAG,GAAG,OAAO,QAAQ,MAAM,SAAS,SAAS,CAAC;CAChF,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,aAAa,SAAiB,MAAc,UAAoC;CAC9F,MAAM,MAAM,WAAW,SAAS,IAAI;CACpC,IAAI,CAAC,KAAK,OAAO;CACjB,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,KAAK,GAAG,GAAG,OAAO,QAAQ;CAExC,OAAO;AACT;;;;;;;;;AAUA,SAAgB,kBACd,WACA,MACA,UACe;CACf,MAAM,MAAM,oBAAoB,WAAW,gBAAgB,IAAI,CAAC;CAChE,IAAI,CAAC,KAAK,OAAO;CACjB,OAAO,aAAa,KAAK,MAAM,QAAQ;AACzC;;;;;;;;;;;AAYA,SAAgB,eACd,WACA,UACA,MACA,EAAE,UAAU,kBACG;CACf,IAAI,UAAU,WAAW,GAAG,GAE1B,OAAO,aADK,QAAQC,UAAQ,QAAQ,GAAG,SACjB,GAAG,MAAM,QAAQ;CAEzC,IAAI,UAAU,WAAW,cAAc,GACrC,OAAO,kBAAkB,WAAW,MAAM,QAAQ;CAEpD,OAAO;AACT;;;;;;;;;;;;;;;;AAsBA,SAAgB,SACd,UACA,QACA,UACA,OACS;CACT,IAAI,WAAW,UAAU,OAAO;EAAE,SAAS;EAAM,QAAQ;CAAO;CAChE,IAAI,MAAM,MAAM,SAAS,EAAE,IAAI,MAAM,GAAG,OAAO;EAAE,SAAS;EAAM,QAAQ;CAAc;CACtF,IAAI,YAAY,MAAM,gBAAgB,SAAS,EAAE,IAAI,MAAM,GACzD,OAAO;EAAE,SAAS;EAAM,QAAQ;CAAa;CAE/C,OAAO;EAAE,SAAS;EAAO,QAAQ;CAAW;AAC9C;;;ACjGA,IAAa,wBAAb,cAA2C,MAAM;CAC/C,YAAY,SAAiB;EAC3B,MAAM,gCAAgC,SAAS;EAC/C,KAAK,OAAO;CACd;AACF;AAEA,SAAS,KAAK,SAAwB;CACpC,MAAM,IAAI,sBAAsB,OAAO;AACzC;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAKA,SAAS,cAAc,SAAyB;CAC9C,OAAO,QAAQ,WAAW,uBAAuB,MAAM;AACzD;AAgBA,SAAS,sBAAsB,SAAiB,OAA6C;CAG3F,MAAM,MAFa,QAAQ,WAAW,MAAM,GAAG,CAAC,CAAC,QAAQ,SAAS,EAE7C,CAAC,CAAC,QAAQ,WAAW,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;CAChE,IAAI,QAAQ,MAAM,QAAQ,MACxB,KAAK,GAAG,MAAM,WAAW,KAAK,UAAU,OAAO,EAAE,kCAAkC;CAErF,IAAI,IAAI,SAAS,GAAG,GAClB,KACE,GAAG,MAAM,WAAW,KAAK,UAAU,OAAO,EAAE,kJAG9C;CAEF,MAAM,KAAK,IAAI,OAAO,IAAI,cAAc,GAAG,EAAE,MAAM;CACnD,QAAQ,YAAY,GAAG,KAAK,OAAO;AACrC;AAYA,SAAS,qBAAqB,SAA+C;CAC3E,MAAM,aAAa,QAAQ,WAAW,MAAM,GAAG,CAAC,CAAC,QAAQ,SAAS,EAAE;CAIpE,MAAM,eAAe,WAAW,SAAS,KAAK;CAC9C,MAAM,OAAO,eAAe,WAAW,MAAM,GAAG,EAAE,IAAI;CAEtD,IAAI,SAAS;CACb,IAAI,IAAI;CACR,OAAO,IAAI,KAAK,QACd,IAAI,KAAK,WAAW,OAAO,CAAC,GAAG;EAE7B,UAAU;EACV,KAAK;CACP,OAAO,IAAI,KAAK,WAAW,MAAM,CAAC,GAAG;EACnC,UAAU;EACV,KAAK;CACP,OAAO,IAAI,KAAK,OAAO,KAAK;EAC1B,UAAU;EACV,KAAK;CACP,OAAO;EACL,UAAU,cAAc,KAAK,EAAY;EACzC,KAAK;CACP;CAGF,MAAM,KAAK,IAAI,OAAO,IAAI,SADb,eAAe,UAAU,KACG;CACzC,QAAQ,YAAY,GAAG,KAAK,OAAO;AACrC;AAIA,SAAS,iBAAiB,KAA+B;CACvD,IAAI,CAAC,MAAM,QAAQ,GAAG,GAAG,KAAK,8CAA8C;CAC5E,IAAI,IAAI,WAAW,GAAG,KAAK,uCAAuC;CAClE,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,MAAuB,CAAC;CAC9B,IAAI,SAAS,OAAO,QAAQ;EAC1B,IAAI,CAAC,SAAS,KAAK,GAAG,KAAK,YAAY,IAAI,qBAAqB;EAChE,MAAM,EAAE,MAAM,YAAY;EAC1B,IAAI,OAAO,SAAS,YAAY,SAAS,IACvC,KAAK,YAAY,IAAI,gCAAgC;EAEvD,IAAI,OAAO,YAAY,YAAY,YAAY,IAC7C,KAAK,YAAY,IAAI,UAAU,KAAK,UAAU,IAAI,EAAE,mCAAmC;EAEzF,IAAI,KAAK,IAAI,IAAI,GAAG,KAAK,0BAA0B,KAAK,UAAU,IAAI,EAAE,EAAE;EAC1E,KAAK,IAAI,IAAI;EACb,IAAI,KAAK;GAAE;GAAM;EAAQ,CAAC;CAC5B,CAAC;CACD,OAAO;AACT;AAEA,SAAS,cAAc,KAAc,YAAuC;CAC1E,IAAI,CAAC,MAAM,QAAQ,GAAG,GAAG,KAAK,2CAA2C;CACzE,MAAM,MAAoB,CAAC;CAC3B,IAAI,SAAS,OAAO,QAAQ;EAC1B,IAAI,CAAC,SAAS,KAAK,GAAG,KAAK,SAAS,IAAI,qBAAqB;EAC7D,MAAM,EAAE,MAAM,OAAO,YAAY,YAAY;EAC7C,IAAI,OAAO,SAAS,YAAY,SAAS,IACvC,KAAK,SAAS,IAAI,gCAAgC;EAEpD,IAAI,CAAC,WAAW,IAAI,IAAI,GACtB,KAAK,SAAS,IAAI,yCAAyC,KAAK,UAAU,IAAI,EAAE,EAAE;EAEpF,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,KAAK,SAAS,IAAI,UAAU,KAAK,UAAU,IAAI,EAAE,iCAAiC;EAEpF,MAAM,SAAS,IAAI,MAAM;GACvB,IAAI,OAAO,OAAO,YAAY,OAAO,IACnC,KAAK,SAAS,IAAI,UAAU,EAAE,8BAA8B;GAE9D,IAAI,CAAC,WAAW,IAAI,EAAE,GACpB,KAAK,SAAS,IAAI,0CAA0C,KAAK,UAAU,EAAE,EAAE,EAAE;EAErF,CAAC;EACD,IAAI,eAAe,KAAA,KAAa,eAAe,WAAW,eAAe,QACvE,KACE,SAAS,IAAI,8CAA8C,KAAK,UAAU,UAAU,EAAE,GACxF;EAEF,IAAI,YAAY,KAAA,KAAa,OAAO,YAAY,UAC9C,KAAK,SAAS,IAAI,4BAA4B;EAEhD,IAAI,KAAK;GACP;GACO;GACP,GAAI,eAAe,KAAA,IAAY,EAAc,WAA+B,IAAI,CAAC;GACjF,GAAI,YAAY,KAAA,IAAY,EAAW,QAAkB,IAAI,CAAC;EAChE,CAAC;CACH,CAAC;CACD,OAAO;AACT;AAQA,SAAgB,qBAAqB,cAAuC;CAC1E,MAAM,yBAAS,IAAI,IAAY;CAC/B,KAAK,MAAM,QAAQ,cAAc;EAC/B,MAAM,QAAQ,cAAc,KAAK,IAAI;EACrC,IAAI,CAAC,OAAO,OAAO;EACnB,OAAO,IAAI,MAAM,EAAY;CAC/B;CACA,IAAI,OAAO,SAAS,GAAG,OAAO;CAC9B,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB;AAOA,SAAgB,cACd,KACA,UAAgC,CAAC,GACb;CACpB,IAAI,CAAC,SAAS,GAAG,GACf,KAAK,wCAAwC;CAG/C,MAAM,iBAAiB,iBAAiB,IAAI,QAAQ;CACpD,MAAM,aAAa,IAAI,IAAI,eAAe,KAAK,MAAM,EAAE,IAAI,CAAC;CAC5D,MAAM,cAAc,cAAc,IAAI,OAAO,UAAU;CAGvD,IAAI,OAA6B;CACjC,IAAI,IAAI,YAAY,KAAA,GAAW;EAC7B,IAAI,IAAI,YAAY,WAAW,IAAI,YAAY,YAC7C,KAAK,kDAAkD,KAAK,UAAU,IAAI,OAAO,EAAE,GAAG;EAExF,OAAO,IAAI;CACb;CAGA,IAAI,iBAA2B,CAAC;CAChC,IAAI,IAAI,WAAW,KAAA,GAAW;EAC5B,IAAI,CAAC,MAAM,QAAQ,IAAI,MAAM,GAAG,KAAK,4CAA4C;EACjF,IAAI,OAAO,SAAS,GAAG,QAAQ;GAC7B,IAAI,OAAO,MAAM,YAAY,MAAM,IAAI,KAAK,UAAU,IAAI,8BAA8B;EAC1F,CAAC;EACD,iBAAiB,IAAI;CACvB;CAGA,IAAI;CACJ,IAAI,IAAI,mBAAmB,KAAA,GAAW;EACpC,IAAI,OAAO,IAAI,mBAAmB,YAAY,IAAI,mBAAmB,IACnE,KAAK,gEAA8D;EAErE,iBAAiB,IAAI;CACvB,OAAO;EACL,MAAM,UAAU,qBAAqB,QAAQ,gBAAgB,CAAC,CAAC;EAC/D,IAAI,YAAY,MACd,KACE,kLAGF;EAEF,iBAAiB;CACnB;CAGA,MAAM,WAAsB,eAAe,KAAK,OAAO;EACrD,MAAM,EAAE;EACR,MAAM,sBAAsB,EAAE,SAAS,iBAAiB,KAAK,UAAU,EAAE,IAAI,EAAE,EAAE;CACnF,EAAE;CAIF,MAAM,SAAoB,eAAe,KAAK,SAAS,SAAS;EAC9D,MAAM,UAAU,IAAI;EACpB,MAAM,qBAAqB,OAAO;CACpC,EAAE;CAIF,MAAM,QAAqC,CAAC;CAC5C,MAAM,kBAA+C,CAAC;CACtD,MAAM,2BAAW,IAAI,IAAoB;CACzC,MAAM,WAAW,MAAc,OAAe,GAAG,KAAK,GAAG;CAEzD,KAAK,MAAM,QAAQ,aAAa;EAC9B,MAAM,SAAS,KAAK,eAAe,SAAS,kBAAkB;EAC9D,MAAM,MAAO,OAAO,KAAK,0BAAU,IAAI,IAAY;EACnD,KAAK,MAAM,MAAM,KAAK,OAAO;GAC3B,IAAI,IAAI,EAAE;GACV,IAAI,KAAK,YAAY,KAAA,GAAW,SAAS,IAAI,QAAQ,KAAK,MAAM,EAAE,GAAG,KAAK,OAAO;EACnF;CACF;CAIA,OAAO;EACL;EACA,OAAA;GAJ6B,UAAU;GAAU;GAAO;EAIpD;EACJ,SAAS;EACT;EACA;EACA,aAAa,UAAU,WAAW,SAAS,IAAI,QAAQ,UAAU,MAAM,CAAC;CAC1E;AACF;;;AC9RA,MAAM,4BAAY,IAAI,IAAoB;AAC1C,SAAS,QAAQ,UAAkB,KAAqB;CACtD,MAAM,UAAU,QAAQ,QAAQ;CAChC,MAAM,SAAS,UAAU,IAAI,OAAO;CACpC,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,MAAM,OAAO,kBAAkB,SAAS,GAAG;CAC3C,UAAU,IAAI,SAAS,IAAI;CAC3B,OAAO;AACT;AAKA,MAAM,gCAAgB,IAAI,IAAuC;AACjE,SAAS,YAAY,SAAkB,MAAyC;CAC9E,MAAM,SAAS,cAAc,IAAI,IAAI;CACrC,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MAAM,WAAW,QAAQ;CACzB,IAAI,SAAS,eAAe,KAAA,KAAa,SAAS,eAAe,MAAM;EACrE,cAAc,IAAI,MAAM,IAAI;EAC5B,OAAO;CACT;CACA,MAAM,eAAe,iBAAiB,IAAI,CAAC,CAAC,KAAK,MAAM,EAAE,IAAI;CAC7D,MAAM,WAAW,cAAc,SAAS,YAAY,EAAE,aAAa,CAAC;CACpE,cAAc,IAAI,MAAM,QAAQ;CAChC,OAAO;AACT;AAIA,SAAS,UAAU,UAA8B,UAAkB,MAAuB;CACxF,IAAI,SAAS,OAAO,WAAW,GAAG,OAAO;CACzC,MAAM,MAAM,WAAW,UAAU,IAAI;CACrC,OAAO,SAAS,OAAO,MAAM,YAAY,QAAQ,KAAK,GAAG,CAAC;AAC5D;AAEA,MAAM,SAAS,aAAa;CAC1B,MAAM,EAAE,MAAM,aAAa;CAC3B,OAAO;EACL,iBAAiB,WAAW;GAC1B,MAAM;IACJ,MAAM;IACN,MAAM,EACJ,aACE,iGACJ;GACF;GACA,WAAW,SAAkB;IAE3B,OAAO,EACL,kBAAkB,MAAyB;KACzC,MAAM,WAAW,QAAQ;KACzB,MAAM,OAAO,QAAQ,UAAU,QAAQ,GAAG;KAC1C,MAAM,WAAW,YAAY,SAAS,IAAI;KAC1C,IAAI,CAAC,UAAU;KACf,IAAI,UAAU,UAAU,UAAU,IAAI,GAAG;KAEzC,MAAM,WAAW,aAAa,UAAU,MAAM,SAAS,QAAQ;KAC/D,IAAI,aAAa,MAAM;KAEvB,MAAM,YAAY,KAAK,OAAO;KAC9B,MAAM,SAAS,eAAe,WAAW,UAAU,MAAM;MACvD,UAAU,SAAS;MACnB,gBAAgB,SAAS;KAC3B,CAAC;KACD,IAAI,WAAW,MAAM;KAErB,MAAM,WAAW,KAAK,eAAe;KAKrC,IAJgB,SAAS,UAAU,QAAQ,UAAU,SAAS,KAIpD,CAAC,CAAC,SAAS;KACrB,IAAI,SAAS,YAAY,SAAS;KAIlC,MAAM,UADS,SAAS,WAAW,UAAU,MAEtC,KACL,IAAI,SAAS,8BAA8B,OAAO,OAC/C,WAAW,KAAK;KACrB,QAAQ,OAAO;MAAE;MAAS;KAAK,CAAC;IAClC,EACF;GACF;EACF,CAAC;EAED,cAAc,WAAW;GACvB,MAAM;IACJ,MAAM;IACN,MAAM,EACJ,aACE,mGACJ;GACF;GACA,WAAW,SAAkB;IAC3B,OAAO,EACL,kBAAkB,MAAyB;KACzC,MAAM,WAAW,QAAQ;KACzB,MAAM,OAAO,QAAQ,UAAU,QAAQ,GAAG;KAC1C,MAAM,WAAW,YAAY,SAAS,IAAI;KAC1C,IAAI,CAAC,UAAU;KACf,IAAI,UAAU,UAAU,UAAU,IAAI,GAAG;KAGzC,IAAI,aAAa,UAAU,MAAM,SAAS,QAAQ,MAAM,MAAM;KAE9D,MAAM,YAAY,KAAK,OAAO;KAC9B,IAAI,CAAC,UAAU,WAAW,SAAS,cAAc,GAAG;KAGpD,IADY,oBAAoB,WAAW,gBAAgB,IAAI,CACzD,MAAM,MAAM;KAGlB,QAAQ,OAAO;MACb,SAAS,8BAA8B,UAAU,mBAAmB,SAAS,eAAe;MAC5F;KACF,CAAC;IACH,EACF;GACF;EACF,CAAC;CACH;AACF,CAAC"}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "oxlint-plugin-boundaries",
+  "version": "0.1.0",
+  "description": "Config-driven cross-package / element-type boundaries enforcement for oxlint — a resolver-less JS plugin. Each repo declares its own element table and allow-matrix in `.oxlintrc.json` settings.",
+  "keywords": [
+    "architecture",
+    "boundaries",
+    "dependency-rules",
+    "lint",
+    "monorepo",
+    "oxc",
+    "oxlint",
+    "oxlint-plugin"
+  ],
+  "homepage": "https://github.com/paulcedrick/oxlint-plugin-boundaries#readme",
+  "bugs": {
+    "url": "https://github.com/paulcedrick/oxlint-plugin-boundaries/issues"
+  },
+  "license": "MIT",
+  "author": "Paul Cedrick Artigo",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/paulcedrick/oxlint-plugin-boundaries.git"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsdown",
+    "type-check": "tsc --noEmit",
+    "lint": "oxlint",
+    "lint:fix": "oxlint --fix",
+    "fmt": "oxfmt",
+    "fmt:check": "oxfmt --check",
+    "test": "bun test",
+    "prepublishOnly": "bun run build"
+  },
+  "dependencies": {
+    "@oxlint/plugins": "^1.69.0"
+  },
+  "devDependencies": {
+    "@arethetypeswrong/core": "^0.18.3",
+    "@types/bun": "latest",
+    "oxfmt": "^0.54.0",
+    "oxlint": "1.69.0",
+    "publint": "^0.3.21",
+    "tsdown": "^0.22.2",
+    "typescript": "^6.0.0"
+  },
+  "peerDependencies": {
+    "oxlint": ">=1.69.0 <2"
+  },
+  "engines": {
+    "node": ">=20.19"
+  }
+}