paperlint 3.1.2 → 3.2.0

package/src/venue-rules.test.ts

@@ -13,11 +13,7 @@ import { describe, expect, it } from "vitest";
 import { memoryFiles } from "./adapters/memory/index.ts";
 import { sha256Hex } from "./domain/sha256.ts";
 import { packageVenuesDir } from "../skills/paper-pipeline/scripts/consumer.mjs";
-import {
-  VENUE_RULE_LEVELS,
-  venueRules,
-  type VenueRuleModule,
-} from "./venue-rules.ts";
+import { VENUE_RULE_LEVELS, venueRules } from "./venue-rules.ts";
 import { buildConfig, OPTIONAL_RULES, SHIPPED_RULES } from "./cli.ts";
 
 const VENUES = packageVenuesDir();
@@ -34,9 +30,18 @@ const shipped = Object.fromEntries(
 );
 
 type Json = Record<string, unknown>;
+interface Font {
+  name: string;
+  type: string;
+  embedded: boolean;
+  program: string;
+}
+/** The facts file as these tests edit it: free-form, except the fonts they reach into. */
+type Facts = Json & { fonts: Font[] };
+type Patch = (f: Facts) => void;
 
 /** The facts of a short agenticdev paper that meets every number in its profile. */
-function goodFacts(): Json {
+function goodFacts(): Facts {
   return {
     schema: 2,
     pdf: "paper.pdf",
@@ -118,10 +123,7 @@ function lint(
   const files = memoryFiles(paperFiles(p));
   const rules = venueRules({ files, venuesDir: VENUES });
   const out: Finding[] = [];
-  for (const [name, rule] of Object.entries(rules) as [
-    string,
-    VenueRuleModule,
-  ][]) {
+  for (const [name, rule] of Object.entries(rules)) {
     const visitor = rule.create({
       filename,
       ...(cwd === undefined ? {} : { cwd }),
@@ -147,7 +149,13 @@ function lint(
 const DECL = { extends: "paperlint:agenticdev", kind: "short" };
 const ids = (fs: readonly Finding[]) =>
   fs.map((f) => `${f.rule}:${f.messageId}`).sort();
-const withFacts = (patch: (f: Json) => void): Json => {
+/** A patch that changes one field set of the `i`-th font. */
+const font =
+  (i: number, change: Partial<Font>): Patch =>
+  (f) => {
+    f.fonts = f.fonts.map((x, j) => (j === i ? { ...x, ...change } : x));
+  };
+const withFacts = (patch: Patch): Facts => {
   const f = goodFacts();
   patch(f);
   return f;
@@ -260,7 +268,7 @@ describe("pdf/profile — the kind", () => {
       // the fonts rule still runs with an unresolved kind
       const fonts = lint({
         venue,
-        facts: withFacts((f) => ((f.fonts as Json[])[0]!.embedded = false)),
+        facts: withFacts(font(0, { embedded: false })),
       });
       expect(ids(fonts)).toEqual([
         `pdf/fonts:notEmbedded`,
@@ -338,7 +346,7 @@ describe("pdf/measured — a paper that names a venue and was not measured says
         "pages_by_type",
       ])
         f[k] = null;
-      (f.fonts as Json[])[0]!.program = "Type3";
+      font(0, { program: "Type3" })(f);
     });
     expect(ids(lint({ venue: DECL, facts: g }))).toEqual([
       "pdf/fonts:type3",
@@ -348,7 +356,7 @@ describe("pdf/measured — a paper that names a venue and was not measured says
 });
 
 describe("pdf/fresh — facts about another build are not judged", () => {
-  it.each([
+  it.each<[string, Paper, string]>([
     [
       "a changed PDF",
       { pdf: new TextEncoder().encode("another build") },
@@ -364,55 +372,48 @@ describe("pdf/fresh — facts about another build are not judged", () => {
     ],
     [
       "a font entry of the wrong shape",
-      { facts: withFacts((f) => (f.fonts = [{ name: 3 }])) },
+      { facts: { ...goodFacts(), fonts: [{ name: 3 }] } },
       "factsBroken",
     ],
-  ] as [string, Paper, string][])(
-    "%s: one finding, from pdf/fresh only",
-    (_, p, messageId) => {
-      // Everything else planted wrong too — none of it may be reported over stale facts.
-      const facts =
-        p.facts ?? withFacts((f) => ((f.body_pages = 99), (f.columns = 1)));
-      expect(ids(lint({ venue: DECL, ...p, facts }))).toEqual([
-        `pdf/fresh:${messageId}`,
-      ]);
-    },
-  );
+  ])("%s: one finding, from pdf/fresh only", (_, p, messageId) => {
+    // Everything else planted wrong too — none of it may be reported over stale facts.
+    const facts =
+      p.facts ?? withFacts((f) => ((f.body_pages = 99), (f.columns = 1)));
+    expect(ids(lint({ venue: DECL, ...p, facts }))).toEqual([
+      `pdf/fresh:${messageId}`,
+    ]);
+  });
 });
 
 describe("pdf/fonts", () => {
-  it.each([
-    [
-      "a Type 3 font",
-      (f: Json) => ((f.fonts as Json[])[0]!.program = "Type3"),
-      ["pdf/fonts:type3"],
-    ],
+  it.each<[string, (f: Facts) => void, string[]]>([
+    ["a Type 3 font", font(0, { program: "Type3" }), ["pdf/fonts:type3"]],
     [
       "a font not embedded",
-      (f: Json) => ((f.fonts as Json[])[1]!.embedded = false),
+      font(1, { embedded: false }),
       ["pdf/fonts:notEmbedded"],
     ],
     [
       "the text family missing — acmart fell back to Computer Modern",
-      (f: Json) => ((f.fonts as Json[])[0]!.name = "CMR10"),
+      font(0, { name: "CMR10" }),
       ["pdf/fonts:noFamily"],
     ],
     [
       "both families missing: one finding per family",
-      (f: Json) =>
+      (f: Facts) =>
         (f.fonts = [
           { name: "CMR10", type: "Type 1", embedded: true, program: "Type1" },
         ]),
       ["pdf/fonts:noFamily", "pdf/fonts:noFamily"],
     ],
-  ] as [string, (f: Json) => void, string[]][])("%s", (_, patch, want) => {
+  ])("%s", (_, patch, want) => {
     expect(ids(lint({ venue: DECL, facts: withFacts(patch) }))).toEqual(want);
   });
 
   it("names the family and the fonts the PDF does have", () => {
     const [f] = lint({
       venue: DECL,
-      facts: withFacts((x) => ((x.fonts as Json[])[0]!.name = "CMR10")),
+      facts: withFacts(font(0, { name: "CMR10" })),
     });
     expect(f?.message).toMatch(/LinLibertine/);
     expect(f?.message).toMatch(/CMR10/);
@@ -420,28 +421,28 @@ describe("pdf/fonts", () => {
 });
 
 describe("pdf/geometry", () => {
-  it.each([
+  it.each<[string, (f: Facts) => void, string[]]>([
     [
       "A4 instead of letter",
-      (f: Json) => ((f.page_w_in = 8.27), (f.page_h_in = 11.69)),
+      (f: Facts) => ((f.page_w_in = 8.27), (f.page_h_in = 11.69)),
       ["pdf/geometry:dim", "pdf/geometry:dim"],
     ],
     [
       "one column instead of two",
-      (f: Json) => (f.columns = 1),
+      (f: Facts) => (f.columns = 1),
       ["pdf/geometry:columns"],
     ],
     [
       "a page size banal could not read",
-      (f: Json) => (f.page_w_in = null),
+      (f: Facts) => (f.page_w_in = null),
       ["pdf/geometry:dimMissing"],
     ],
     [
       "0.03 in off is inside the default tolerance",
-      (f: Json) => (f.page_w_in = 8.53),
+      (f: Facts) => (f.page_w_in = 8.53),
       [],
     ],
-  ] as [string, (f: Json) => void, string[]][])("%s", (_, patch, want) => {
+  ])("%s", (_, patch, want) => {
     expect(ids(lint({ venue: DECL, facts: withFacts(patch) }))).toEqual(want);
   });
 
@@ -455,46 +456,43 @@ describe("pdf/geometry", () => {
 });
 
 describe("pdf/limits", () => {
-  it.each([
+  it.each<[string, (f: Facts) => void, string[], RegExp | null]>([
     [
       "one body page over the short-paper limit",
-      (f: Json) => (f.body_pages = 6),
+      (f: Facts) => (f.body_pages = 6),
       ["pdf/limits:pages"],
       /body pages: 6, over the limit 5 for agenticdev\/short/,
     ],
     [
       "one reference page over",
-      (f: Json) => (f.ref_pages = 3),
+      (f: Facts) => (f.ref_pages = 3),
       ["pdf/limits:pages"],
       /reference pages: 3, over the limit 2/,
     ],
-    ["exactly at the limit", (f: Json) => (f.body_pages = 5), [], null],
+    ["exactly at the limit", (f: Facts) => (f.body_pages = 5), [], null],
     [
       "a reference font below the range",
-      (f: Json) => (f.ref_pt = 6),
+      (f: Facts) => (f.ref_pt = 6),
       ["pdf/limits:refPt"],
       /6 pt/,
     ],
     [
       "6.8 pt is inside the range once the measuring drift (body_pt_tol) is allowed",
-      (f: Json) => (f.ref_pt = 6.8),
+      (f: Facts) => (f.ref_pt = 6.8),
       [],
       null,
     ],
     [
       "no reference font measured (no bibliography) is not a finding",
-      (f: Json) => (f.ref_pt = null),
+      (f: Facts) => (f.ref_pt = null),
       [],
       null,
     ],
-  ] as [string, (f: Json) => void, string[], RegExp | null][])(
-    "%s",
-    (_, patch, want, text) => {
-      const fs = lint({ venue: DECL, facts: withFacts(patch) });
-      expect(ids(fs)).toEqual(want);
-      if (text) expect(fs[0]?.message).toMatch(text);
-    },
-  );
+  ])("%s", (_, patch, want, text) => {
+    const fs = lint({ venue: DECL, facts: withFacts(patch) });
+    expect(ids(fs)).toEqual(want);
+    if (text) expect(fs[0]?.message).toMatch(text);
+  });
 
   it("a longer kind of the same venue passes the same page count", () => {
     const facts = withFacts((f) => (f.body_pages = 9));
@@ -506,19 +504,19 @@ describe("pdf/limits", () => {
 });
 
 describe("pdf/body-size", () => {
-  it.each([
+  it.each<[string, (f: Facts) => void, string[]]>([
     [
       "10.2 pt against 9 ± 0.5",
-      (f: Json) => (f.body_pt = 10.2),
+      (f: Facts) => (f.body_pt = 10.2),
       ["pdf/body-size:body"],
     ],
-    ["9.4 pt is inside the tolerance", (f: Json) => (f.body_pt = 9.4), []],
+    ["9.4 pt is inside the tolerance", (f: Facts) => (f.body_pt = 9.4), []],
     [
       "no body size measured",
-      (f: Json) => (f.body_pt = null),
+      (f: Facts) => (f.body_pt = null),
       ["pdf/body-size:bodyMissing"],
     ],
-  ] as [string, (f: Json) => void, string[]][])("%s", (_, patch, want) => {
+  ])("%s", (_, patch, want) => {
     expect(ids(lint({ venue: DECL, facts: withFacts(patch) }))).toEqual(want);
   });
 });
@@ -567,7 +565,7 @@ describe("a project's own preset, and the facts' other spellings", () => {
       format: { columns: 2, body_pt: 9, ref_pt_min: 7, ref_pt_max: 8 },
     }),
   };
-  const house = (patch: (f: Json) => void = () => {}) =>
+  const house = (patch: (f: Facts) => void = () => {}) =>
     lint({
       venue: { extends: "./house.jsonc" },
       facts: withFacts(patch),

package/src/venue-rules.ts

@@ -48,7 +48,7 @@ import type { FlatGeometry } from "./domain/geometry.ts";
 import type { AbsolutePath } from "./domain/paths.ts";
 import { sha256Hex } from "./domain/sha256.ts";
 import type { Files } from "./ports/files.ts";
-import { CONFIG_FILE } from "../lib/paper-config.mjs";
+import { CONFIG_FILE } from "#lib/paper-config";
 
 // ── the verdict's vocabulary ─────────────────────────────────────────────────────────
 

package/tsconfig.json

@@ -11,13 +11,16 @@
     "sourceMap": true,
     "strict": true,
     "noUncheckedIndexedAccess": true,
-    "exactOptionalPropertyTypes": false,
+    "exactOptionalPropertyTypes": true,
     "skipLibCheck": true,
     "verbatimModuleSyntax": false,
     "types": ["node"],
     "allowImportingTsExtensions": true,
-    "rewriteRelativeImportExtensions": true
+    "rewriteRelativeImportExtensions": true,
+    "noImplicitOverride": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true
   },
   "include": ["src/**/*.ts"],
-  "exclude": ["src/**/*.test.ts"]
+  "exclude": ["src/**/*.test.ts", "src/**/*.harness.ts"]
 }

package/tsconfig.pkg.json

@@ -0,0 +1,10 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "rootDir": ".",
+    "outDir": "dist",
+    "resolveJsonModule": true
+  },
+  "include": ["lib/*.ts", "eslint-rules/*.ts", "eslint-rules/*.json"],
+  "exclude": ["**/*.test.ts", "**/*.harness.ts", "**/*.d.ts"]
+}

package/lib/check.d.mts

@@ -1,17 +0,0 @@
-// Types for lib/check.mjs — the shared harness assertion helper (see the module).
-
-/** A failure detail: text, any value (rendered with `util.inspect`), or a thunk producing one. */
-export type Detail = unknown;
-
-export declare function renderDetail(detail: Detail): string;
-export declare function failureMessage(label: string, detail: Detail): string;
-
-export interface Check {
-  (label: string, cond: unknown, detail?: Detail): void;
-  /** How many times this checker has been called. */
-  readonly count: number;
-}
-
-export declare function createChecker(options?: {
-  log?: (line: string) => void;
-}): Check;

package/lib/paper-config.d.mts

@@ -1,31 +0,0 @@
-// Types for lib/paper-config.mjs, which `src/*.ts` imports. Without this file TypeScript sees
-// `any` and each import needs a `@ts-expect-error`, which covers only the next line and stops
-// working as soon as a formatter wraps the import across several lines.
-//
-// The field names are typed as `string`, not as their values, so that the value is written
-// once, in paper-config.mjs.
-
-/** The tool's name — its settings file is named after it. */
-export declare const CONFIG_KEY: string;
-/** `paperlint.json`: the settings file, at the project root and in each paper. */
-export declare const CONFIG_FILE: string;
-/** The files that make a directory a paper. */
-export declare const PAPER_MARKERS: readonly string[];
-
-/** The project root, walking up from `startDir` (see the module). */
-export declare function findProjectRoot(
-  startDir: string,
-  isFile?: (path: string) => boolean,
-): string;
-
-/** The root `paperlint.json` of `root` — undefined when absent, unparsable or not an object. */
-export declare function settingsOf(
-  root: string,
-): Readonly<Record<string, unknown>> | undefined;
-export declare const DEFAULT_PAPERS_ROOT: string;
-export declare const PAPERS_DIR_FIELD: string;
-
-/** Every key a `paperlint.json` may hold, at either level, mapped to who reads it. */
-export declare const SETTINGS_KEYS: Readonly<Record<string, string>>;
-/** The keys refused in a paper's `paperlint.json`. */
-export declare const ROOT_ONLY_KEYS: readonly string[];

package/scripts/layer-legacy-frozen.d.mts

@@ -1,36 +0,0 @@
-/** Types for `layer-legacy-frozen.mjs`, for its TypeScript test. */
-export interface Suppressed {
-  readonly filePath: string;
-  readonly suppressedMessages?: readonly {
-    readonly ruleId: string | null;
-    readonly line: number;
-    readonly suppressions?: readonly { readonly justification?: string }[];
-  }[];
-}
-export type Counts = Record<string, Record<string, number>>;
-export declare const FROZEN_FILE: string;
-export declare const LAYER_RULES: readonly string[];
-export declare const NO_LEGACY_UNDER: readonly string[];
-export declare const LEGACY: RegExp;
-export declare function tally(results: readonly Suppressed[]): {
-  counts: Counts;
-  unexplained: string[];
-};
-export declare function judge(o: {
-  counts: Counts;
-  unexplained: readonly string[];
-  frozen: Counts;
-}): string[];
-export declare function checkFrozen(
-  root?: string,
-  options?: { lint?: (cwd: string) => Promise<unknown[]> },
-): Promise<{
-  problems: string[];
-  frozen: Counts;
-  counts: Counts;
-}>;
-export declare function main(options?: {
-  check?: () => Promise<{ problems: string[]; frozen: Counts; counts: Counts }>;
-  log?: (line: string) => void;
-  err?: (line: string) => void;
-}): Promise<number>;

package/scripts/rules-are-content-only.harness.mjs

@@ -1,105 +0,0 @@
-/**
- * Colocated test for `scripts/rules-are-content-only.mjs` — a rule may not ask git.
- * Run: `npx vigiles test scripts/rules-are-content-only.harness.mjs`
- *
- * 🔴 BOTH HALVES. Like its sibling, this guard's success state is silence, so silence alone is
- * no evidence it works:
- *   I.   QUIET on this repository's real `eslint-rules/`, and the count is asserted non-zero —
- *        a guard that scanned nothing is also quiet, and that is the reading to rule out first.
- *   II.  FIRES on each form the defect takes: static `import`, `require()`, dynamic `import()`,
- *        and the `node:` prefix — the prefix matters because a set membership test that lists
- *        only the bare specifier passes a file that writes the modern spelling.
- *   III. QUIET on sources that merely TALK about the banned module — a comment and a string
- *        literal. This is the half a grep cannot have, and the reason the check parses.
- */
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { createChecker } from "../lib/check.mjs";
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-const { rulesAreContentOnly, processImports } = await import(
-  join(HERE, "rules-are-content-only.mjs")
-);
-
-const check = createChecker();
-
-// ── I. quiet on the real corpus, and it actually looked ───────────────────────
-{
-  const { checked, findings } = rulesAreContentOnly({ cwd: join(HERE, "..") });
-  check(
-    `scanned something (${checked.length} rule sources)`,
-    checked.length > 0,
-  );
-  check(
-    `quiet on the real corpus (${findings.length} findings)`,
-    findings.length === 0,
-  );
-}
-
-// ── II. fires on every form the defect has taken ────────────────────────────
-for (const [label, src] of [
-  [
-    "execFileSync with a git argv",
-    `import { execFileSync } from "node:child_process";
-     execFileSync("git", ["cat-file", "-e", sha]);`,
-  ],
-  [
-    "a namespaced call",
-    `import cp from "node:child_process";
-     cp.spawnSync("git", ["rev-parse", ref]);`,
-  ],
-  [
-    "execSync with a git shell line",
-    `import { execSync } from "child_process";
-     execSync("git log --oneline -1");`,
-  ],
-  ["exec, async form", `exec("git rev-list --all", cb);`],
-]) {
-  check(`FIRES on ${label}`, processImports(src).length === 1);
-}
-
-// ── III. the FALSE POSITIVE that forced the narrowing, asserted so it cannot return ──
-// 🔴 `paper-texcount.mjs` in the consumer shells out to `texcount` to count words in a .tex.
-// The first version of this check keyed on importing `child_process` at all, so it claimed that
-// rule on its first run — a false positive on an `error` gate, which is worse than a miss
-// because the gate that cannot be cleared gets switched off rather than fixed.
-for (const [label, src] of [
-  [
-    "a rule spawning texcount",
-    `import { execFileSync } from "node:child_process";
-     execFileSync("texcount", ["-brief", file]);`,
-  ],
-  [
-    "a rule spawning pdflatex",
-    `import { spawnSync } from "node:child_process";
-     spawnSync("pdflatex", [tex]);`,
-  ],
-  [
-    "importing child_process without running git",
-    `import { execFileSync } from "node:child_process";
-     export default {};`,
-  ],
-]) {
-  check(`quiet on ${label}`, processImports(src).length === 0);
-}
-
-// ── IV. quiet on sources that only MENTION it — what a grep cannot do ───────
-for (const [label, src] of [
-  [
-    "a comment naming git",
-    `// never reach for git cat-file here\nexport default {};`,
-  ],
-  ["a string literal", `export const why = "git cat-file is banned in rules";`],
-  [
-    "a reported message",
-    `export default { meta: { messages: { m: "run git cat-file? no" } } };`,
-  ],
-  [
-    "a program merely NAMED git-something",
-    `execFileSync("git-lfs-helper", []);`,
-  ],
-]) {
-  check(`quiet on ${label}`, processImports(src).length === 0);
-}
-
-console.log(`rules-are-content-only.harness: ${check.count} assertions passed`);

package/scripts/rules-are-content-only.mjs

@@ -1,148 +0,0 @@
-/**
- * A RULE MAY NOT ASK GIT.
- *
- * 🔴 The defect it exists for, measured 2026-09-16. `paper/source` bound a paper's stage to a
- * commit sha and verified it with `git cat-file -e`. Of four shas recorded in the consumer's
- * front matter, ONE still resolved ninety minutes later: a squash-merge had orphaned the branch
- * commits and `gc` collected them. A recorded sha is a pointer to a pointer, and both hops are
- * removed by ROUTINE maintenance — squash, rebase, gc, force-push, filter-repo. Nobody is at
- * fault, so nobody is on the hook to fix it; the rule simply turns red and gets switched off.
- *
- * ── THE STRONGER LEG, AND THE REASON THIS IS A FLOOR CHECK ──────────────────
- * `actions/checkout` defaults to `fetch-depth: 1` — exactly one commit. Measured in the
- * consumer the same day: six checkouts, not one override. So a git-reading rule does not
- * resolve even a LIVE sha under CI, which is the one place it has to hold. Locally it stays
- * green, so the failure is one-directional and in the flattering direction.
- *
- * ── WHAT IT CHECKS, AND WHY NOT A GREP ──────────────────────────────────────
- * A `child_process` spawner called with `git` as the program, read from the AST. Parsed, not
- * grepped, so the words `git cat-file` in this very comment are not a finding — a text guard
- * would have to exempt itself, which is the failure mode that makes text guards unmaintainable.
- *
- * ⚠️ THE BOUND, stated so the check is not mistaken for more than it is. Two things pass: a
- * rule that opens `.git/` with `fs` (indistinguishable at this level from reading a data file),
- * and a rule that assembles the program name at runtime. Both accepted deliberately — see the
- * note on `SPAWNERS` for the false positive that forced the predicate this narrow.
- *
- * Run: `node scripts/rules-are-content-only.mjs`  (exit 1 and a named rule on a finding)
- * Tested by: `scripts/rules-are-content-only.harness.mjs` — quiet on the real corpus, firing on
- * a planted rule.
- */
-import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { parse } from "espree";
-import { isMain } from "../skills/paper-pipeline/scripts/consumer.mjs";
-
-/**
- * 🔴 THE PREDICATE IS "RUNS GIT", NOT "SPAWNS A PROCESS", and the narrowing was forced by a
- * FALSE POSITIVE on the consumer's corpus the hour this check shipped: `paper-texcount.mjs`
- * shells out to `texcount` to count words in a .tex, which is a measuring tool, not history.
- * A false positive on an `error` gate is worse than a miss — the gate that cannot be cleared
- * gets switched off, and this one would have been switched off on its first run.
- *
- * ⚠️ THE COST OF NARROWING, stated rather than hidden: a rule that builds the program name at
- * runtime (`const g = "gi" + "t"`) passes. That is accepted. The defect has taken exactly one
- * form — a literal `git` handed to a `child_process` function — and a check that also caught
- * the contrived form would have to claim every spawn, which is the false positive above.
- */
-const SPAWNERS = new Set([
-  "exec",
-  "execSync",
-  "execFile",
-  "execFileSync",
-  "spawn",
-  "spawnSync",
-  "fork",
-]);
-
-/** `"git"` as the program, or `"git …"` as the head of a shell line handed to `exec`. */
-const isGit = (v) =>
-  typeof v === "string" && (v === "git" || v.startsWith("git "));
-
-/** Rule sources only: a harness plants defects on purpose and asserts about them. */
-const isRuleSource = (f) => f.endsWith(".mjs") && !f.endsWith(".harness.mjs");
-
-/** @param {string} src @returns {string[]} the git invocations this source makes */
-export function processImports(src) {
-  const ast = parse(src, {
-    ecmaVersion: "latest",
-    sourceType: "module",
-    range: false,
-  });
-  const found = [];
-  const walk = (n) => {
-    if (n === null || typeof n !== "object") return;
-    if (Array.isArray(n)) return n.forEach(walk);
-    // Both spellings of the callee: `execFileSync(…)` after a named import, and
-    // `cp.execFileSync(…)` after a namespace import. Listed, not described — the node types a
-    // check walks are the only honest statement of its coverage.
-    if (n.type === "CallExpression") {
-      const name =
-        n.callee?.type === "MemberExpression"
-          ? n.callee.property?.name
-          : n.callee?.name;
-      if (SPAWNERS.has(String(name)) && isGit(n.arguments?.[0]?.value))
-        found.push(String(n.arguments[0].value));
-    }
-    for (const k of Object.keys(n)) if (k !== "parent") walk(n[k]);
-  };
-  walk(ast);
-  return found;
-}
-
-/** @param {{cwd: string}} options */
-export function rulesAreContentOnly({ cwd }) {
-  const dir = join(cwd, "eslint-rules");
-  const checked = [];
-  const findings = [];
-  // A repository with no `eslint-rules/` has no rule sources: `checked` stays empty and the gate
-  // says so by name. `readdirSync` would throw ENOENT instead — a stack trace, not the refusal.
-  const names = existsSync(dir) ? readdirSync(dir) : [];
-  for (const f of names.filter(isRuleSource)) {
-    const hits = processImports(readFileSync(join(dir, f), "utf8"));
-    // 🔴 The counter increments WITH the verdict, not before it: a `checked` that keeps
-    // counting while the verdict stops being reached is the failure recorded in the consumer's
-    // rules as "a counter that counts what it ignores".
-    checked.push(f);
-    for (const h of hits) findings.push({ file: f, specifier: h });
-  }
-  return { checked, findings };
-}
-
-/**
- * The gate over `cwd`'s `eslint-rules/`: exit 1 on no rule sources (a silent zero would read as
- * clean) or on any rule asking git; 0 otherwise.
- *
- * 🔴 `cwd` is `process.cwd()`, NOT the package root. A consumer installs this package and runs the
- * script from its own repository, where the rules that matter are ITS `eslint-rules/` — the
- * package's own are already checked by the package's own gate. Anchored to the package root the
- * consumer's gate would re-check the same eight files and report a confident zero about rules it
- * never opened: a counter that counts what it ignores.
- */
-export function main({
-  cwd = process.cwd(),
-  log = console.log,
-  err = console.error,
-} = {}) {
-  const { checked, findings } = rulesAreContentOnly({ cwd });
-  if (checked.length === 0) {
-    err(
-      `${join(cwd, "eslint-rules")}: no rule sources. Either this is not a repository with ` +
-        `ESLint rules, or the directory moved — a silent zero here would read as a clean run.`,
-    );
-    return 1;
-  }
-  for (const { file, specifier } of findings) {
-    err(
-      `${file}: imports \`${specifier}\`. A rule may not ask git: history is rewritten by ` +
-        `routine maintenance and CI clones one commit deep, so the fact does not survive where ` +
-        `the rule has to hold. Put the fact on disk and check it by bytes.`,
-    );
-  }
-  log(
-    `rules-are-content-only: ${checked.length} rule sources under ${cwd}, ${findings.length} findings`,
-  );
-  return findings.length === 0 ? 0 : 1;
-}
-
-if (isMain(import.meta.url)) process.exit(main());