workspace-conformance 0.0.0 → 1.0.0

package/dist/cli.js

@@ -0,0 +1,1600 @@
+#!/usr/bin/env node
+import { dirname, join, posix, relative, resolve, sep } from "node:path";
+import { parseArgs } from "node:util";
+import { existsSync } from "node:fs";
+import { escapePath, glob, isDynamicPattern } from "tinyglobby";
+import { Node, Project } from "ts-morph";
+import { createJitiLoader, validateStandard } from "cosmiconfig-extends";
+import { readFile, realpath } from "node:fs/promises";
+import { parse } from "yaml";
+import { execFile } from "node:child_process";
+import { defineSection, layoutSection, loadSection } from "@exadev/config";
+import { z } from "zod";
+//#region src/files.ts
+/**
+* Directories no check descends into: installed dependencies are not the workspace's own files.
+*/
+const INSTALLED_DEPENDENCIES_GLOB = "**/node_modules/**";
+/**
+* The name of the entry git puts at the top of a checkout: a directory in a clone, a file in a linked worktree.
+*/
+const GIT_ENTRY = ".git";
+/**
+* Directories no check descends into besides installed dependencies: git's own data, and every other checkout below `cwd` (a linked worktree or a nested clone, found by its own `.git` entry). Such a checkout is another copy of a repository, and its files would be judged as if they were part of this workspace.
+*/
+async function ignoredDirectories(cwd) {
+	const nested = (await glob([`**/${GIT_ENTRY}`], {
+		cwd,
+		dot: true,
+		onlyFiles: false,
+		expandDirectories: false,
+		ignore: [INSTALLED_DEPENDENCIES_GLOB, `**/${GIT_ENTRY}/*/**`]
+	})).map((entry) => entry.replace(/\/$/u, "")).filter((entry) => entry !== GIT_ENTRY);
+	return [`**/${GIT_ENTRY}/**`, ...nested.map((entry) => `${escapePath(entry.slice(0, -4))}**`)];
+}
+/**
+* The negative patterns that leave the paths matching `exclude` out of a search; none when there is no `exclude`.
+*/
+function excludedFrom(exclude) {
+	return exclude === void 0 ? [] : exclude.map((pattern) => `!${pattern}`);
+}
+/**
+* The files under `cwd` matching any of `patterns`, relative to `cwd` with `/` separators and sorted, so results do not depend on directory order. Dotfiles match; installed dependencies, git's own data and other checkouts below `cwd` never do.
+*/
+async function findFiles(cwd, patterns) {
+	return (await glob([...patterns], {
+		cwd,
+		dot: true,
+		ignore: [INSTALLED_DEPENDENCIES_GLOB, ...await ignoredDirectories(cwd)],
+		onlyFiles: true
+	})).sort();
+}
+/**
+* The directories under `cwd` matching any of `patterns`, relative to `cwd` with `/` separators, without a trailing separator, and sorted.
+*/
+async function findDirectories(cwd, patterns) {
+	return (await glob([...patterns], {
+		cwd,
+		dot: true,
+		ignore: [INSTALLED_DEPENDENCIES_GLOB, ...await ignoredDirectories(cwd)],
+		onlyDirectories: true
+	})).map((directory) => directory.replace(/\/$/u, "")).sort();
+}
+//#endregion
+//#region src/paths.ts
+/**
+* `path` with the platform separator replaced by `/`, the form paths take in violations and in options.
+*/
+function toPosix(path) {
+	return path.split(sep).join("/");
+}
+/**
+* `absolute` relative to `cwd`, with `/` separators.
+*/
+function relativePosix(cwd, absolute) {
+	return toPosix(relative(cwd, absolute));
+}
+//#endregion
+//#region src/errors.ts
+/**
+* A problem with how the tool was used or configured rather than a finding about the workspace: an unknown or disabled check, a missing or invalid section, a layout that cannot be resolved, a repository that is not a git checkout. The command line reports it and exits 2.
+*/
+var ConformanceError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "ConformanceError";
+	}
+};
+//#endregion
+//#region src/template.ts
+const PLACEHOLDER = /\{([a-z]+)\}/gu;
+/**
+* `template` with each `{name}` replaced by the value of that name. Throws `ConformanceError` for a placeholder with no value, so a typo in an option cannot produce a path that silently matches nothing.
+*/
+function expandTemplate(template, values) {
+	return template.replace(PLACEHOLDER, (placeholder, name) => {
+		const value = values[name];
+		if (value === void 0) throw new ConformanceError(`the placeholder ${placeholder} in '${template}' is not available here; use ${Object.keys(values).map((key) => `{${key}}`).join(", ")}`);
+		return value;
+	});
+}
+//#endregion
+//#region src/ts-project.ts
+/**
+* The tsconfig used for compiler options and module resolution when the options name none.
+*/
+const DEFAULT_TS_CONFIG = "tsconfig.json";
+/**
+* A ts-morph project for the files matching `patterns`. Compiler options come from the tsconfig; its file list is not used, so only these files and what they import are loaded. Throws `ConformanceError` when the tsconfig does not exist or no file matches, naming the options and not their values.
+*/
+async function createProject(cwd, tsConfig, patterns, names) {
+	const tsConfigFilePath = resolve(cwd, tsConfig ?? "tsconfig.json");
+	if (!existsSync(tsConfigFilePath)) throw new ConformanceError(tsConfig === void 0 ? `checks.${names.check}: the working directory has no ${DEFAULT_TS_CONFIG}; name one with the 'tsConfig' option` : `checks.${names.check}.tsConfig: the file does not exist`);
+	const files = await findFiles(cwd, patterns);
+	if (files.length === 0) throw new ConformanceError(`checks.${names.check}.${names.files}: no file matches`);
+	const project = new Project({
+		tsConfigFilePath,
+		skipAddingFilesFromTsConfig: true
+	});
+	project.addSourceFilesAtPaths(files.map((file) => resolve(cwd, file)));
+	return {
+		project,
+		files
+	};
+}
+//#endregion
+//#region src/checks/exported-types.ts
+function isExportedType(declaration) {
+	return Node.isInterfaceDeclaration(declaration) || Node.isTypeAliasDeclaration(declaration);
+}
+function collectFromNamespace(namespace, prefix, found) {
+	for (const declaration of [...namespace.getInterfaces(), ...namespace.getTypeAliases()]) if (declaration.isExported()) found.set(`${prefix}${declaration.getName()}`, declaration);
+	for (const nested of namespace.getModules()) if (nested.isExported()) collectFromNamespace(nested, `${prefix}${nested.getName()}.`, found);
+}
+function collectFromFile(file, prefix, found, entered) {
+	for (const [name, declarations] of file.getExportedDeclarations()) {
+		const declaration = declarations.find(isExportedType);
+		if (declaration !== void 0) found.set(`${prefix}${name}`, declaration);
+		for (const member of declarations) if (Node.isModuleDeclaration(member)) collectFromNamespace(member, `${prefix}${name}.`, found);
+		else if (Node.isSourceFile(member) && !entered.has(member)) collectFromFile(member, `${prefix}${name}.`, found, /* @__PURE__ */ new Set([...entered, member]));
+	}
+}
+/**
+* The interfaces and type aliases `file` exports, by name, wherever they are declared: a re-export counts. Those inside an exported namespace, or in a module re-exported as a namespace (`export * as ns from './x'`), are included under their qualified name (`Namespace.Type`). Values, classes and enums are not types in this sense and are left out.
+*/
+function exportedTypes(file) {
+	const found = /* @__PURE__ */ new Map();
+	collectFromFile(file, "", found, /* @__PURE__ */ new Set([file]));
+	return found;
+}
+/**
+* Where the declaration's name is written, as a file relative to `cwd`'s path and a line and column.
+*/
+function declarationLocation(declaration) {
+	const { line, column } = declaration.getSourceFile().getLineAndColumnAtPos(declaration.getNameNode().getStart());
+	return {
+		line,
+		column
+	};
+}
+//#endregion
+//#region src/checks/aggregate-mappers.ts
+/**
+* Every exported interface and type alias of a contract file is an aggregate and has a mapper file where the template puts it, in each adapter directory when `adapters` is set.
+*
+* It looks for the file, not for what is in it, and it counts a type as exported when the contract re-exports it.
+*/
+const aggregateMappers = async ({ cwd, options }) => {
+	const { project, files } = await createProject(cwd, options.tsConfig, options.contracts, {
+		check: "aggregate-mappers",
+		files: "contracts"
+	});
+	const excluded = new Set(options.exclude);
+	const violations = [];
+	for (const contract of files) {
+		const contractValues = {
+			dir: posix.dirname(contract),
+			file: contract
+		};
+		let adapters = [void 0];
+		if (options.adapters !== void 0) {
+			const pattern = posix.normalize(expandTemplate(options.adapters, contractValues));
+			const matched = await findDirectories(cwd, [pattern]);
+			if (matched.length === 0) violations.push({
+				code: "aggregate-mappers/no-adapters",
+				message: `no adapter directory matches ${pattern}, so no aggregate of ${contract} can have a mapper`,
+				file: contract
+			});
+			adapters = matched;
+		}
+		const source = project.getSourceFileOrThrow(resolve(cwd, contract));
+		for (const [name, declaration] of exportedTypes(source)) {
+			if (excluded.has(name)) continue;
+			for (const adapter of adapters) {
+				const expected = posix.normalize(expandTemplate(options.mapper, adapter === void 0 ? {
+					...contractValues,
+					name
+				} : {
+					...contractValues,
+					name,
+					adapter
+				}));
+				if (!existsSync(resolve(cwd, expected))) violations.push({
+					code: "aggregate-mappers/missing-mapper",
+					message: `${name} has no mapper at ${expected}`,
+					file: relativePosix(cwd, declaration.getSourceFile().getFilePath()),
+					location: declarationLocation(declaration)
+				});
+			}
+		}
+	}
+	return violations.sort((a, b) => a.file.localeCompare(b.file) || (a.location?.line ?? 0) - (b.location?.line ?? 0) || a.message.localeCompare(b.message));
+};
+//#endregion
+//#region src/checks/command-types.ts
+/**
+* The last names of the generics that turn a schema into its type, used when the options name none: `z.infer`, `z.input`, `z.output`, `z.TypeOf` and Valibot's `InferInput` and `InferOutput`.
+*/
+const DEFAULT_INFERENCES = [
+	"infer",
+	"input",
+	"output",
+	"TypeOf",
+	"InferInput",
+	"InferOutput"
+];
+/**
+* The member Standard Schema requires of every schema object, which is what makes a value a schema whatever library made it.
+*/
+const STANDARD_SCHEMA_MEMBER = "~standard";
+/**
+* The names a type reference goes by: the last name as written, and the name it was declared with when that differs, as for `Infer` in `import type { infer as Infer } from 'zod'`, which is also `infer`. A library may itself re-export a generic under another name, so both count.
+*/
+function namesOf(typeName) {
+	const identifier = Node.isQualifiedName(typeName) ? typeName.getRight() : typeName;
+	const symbol = identifier.getSymbol();
+	const declared = (symbol?.getAliasedSymbol() ?? symbol)?.getName();
+	return declared === void 0 ? [identifier.getText()] : [.../* @__PURE__ */ new Set([identifier.getText(), declared])];
+}
+/**
+* The local alias without type parameters that a type reference names, or `undefined` when it names anything else. Such an alias is a name for the type it is written as, so it is judged by that.
+*/
+function aliasNamed(typeName) {
+	const symbol = typeName.getSymbol();
+	const declaration = (symbol?.getAliasedSymbol() ?? symbol)?.getDeclarations().find(Node.isTypeAliasDeclaration);
+	return declaration?.getTypeParameters().length === 0 ? declaration : void 0;
+}
+/**
+* Why a command type is not derived from a schema, or `undefined` when it is. `followed` holds the aliases already followed from the exported type, so a chain of aliases is followed to its end and a loop of them is not followed twice.
+*/
+function problem(declaration, name, inferences, followed = /* @__PURE__ */ new Set()) {
+	if (Node.isInterfaceDeclaration(declaration)) return {
+		reason: "hand-written-interface",
+		message: `${name} is a hand-written interface; derive the command from its schema`
+	};
+	const written = declaration.getTypeNode();
+	if (Node.isTypeReference(written)) {
+		const inference = namesOf(written.getTypeName()).find((candidate) => inferences.includes(candidate));
+		if (inference !== void 0) {
+			const [argument] = written.getTypeArguments();
+			if (argument !== void 0 && Node.isTypeQuery(argument) && argument.getExprName().getType().getProperty(STANDARD_SCHEMA_MEMBER) !== void 0) return;
+			return {
+				reason: "not-a-schema",
+				message: `${name} applies '${inference}' to something that is not a schema: its type has no '${STANDARD_SCHEMA_MEMBER}' member`
+			};
+		}
+		const alias = aliasNamed(written.getTypeName());
+		if (alias !== void 0 && !followed.has(alias)) return problem(alias, name, inferences, /* @__PURE__ */ new Set([...followed, alias]));
+	}
+	return {
+		reason: "hand-written-alias",
+		message: `${name} is a type alias that does not apply ${inferences.map((inference) => `'${inference}'`).join(", ")} to a schema; derive the command from its schema`
+	};
+}
+/**
+* Every exported interface and type alias of a command file is derived from a schema: an alias of `infer<typeof schema>` (or another generic in `inferences`) where the type of `schema` is a Standard Schema. Interfaces and other aliases are hand-written, and so are aliases of something that is not a schema.
+*
+* The schema is recognised by type, so it may be imported from another file or renamed; it does not need to come from Zod. A union of the commands is not a command: list its name in `exclude`.
+*/
+const commandTypes = async ({ cwd, options }) => {
+	const { project, files } = await createProject(cwd, options.tsConfig, options.commands, {
+		check: "command-types",
+		files: "commands"
+	});
+	const excluded = new Set(options.exclude);
+	const inferences = options.inferences ?? DEFAULT_INFERENCES;
+	const seen = /* @__PURE__ */ new Set();
+	const violations = [];
+	for (const file of files) for (const [name, declaration] of exportedTypes(project.getSourceFileOrThrow(resolve(cwd, file)))) {
+		if (excluded.has(name) || seen.has(declaration)) continue;
+		seen.add(declaration);
+		const found = problem(declaration, name, inferences);
+		if (found !== void 0) violations.push({
+			code: `command-types/${found.reason}`,
+			message: found.message,
+			file: relativePosix(cwd, declaration.getSourceFile().getFilePath()),
+			location: declarationLocation(declaration)
+		});
+	}
+	return violations.sort((a, b) => a.file.localeCompare(b.file) || (a.location?.line ?? 0) - (b.location?.line ?? 0));
+};
+//#endregion
+//#region src/config-files.ts
+/**
+* A record: a non-null, non-array object.
+*/
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* The default export of the config file at `file` (relative to `cwd`), evaluated through the shared jiti loader, with the `alias` and `fsCache` of `configFiles`, so a TypeScript config runs as its own tool would run it, or `undefined` when the file does not exist.
+*/
+async function evaluateConfigFile(cwd, file, configFiles) {
+	const absolute = resolve(cwd, file);
+	if (!existsSync(absolute)) return;
+	return createJitiLoader({
+		...configFiles?.alias === void 0 ? {} : { alias: configFiles.alias },
+		fsCache: configFiles?.fsCache ?? false
+	}).importer.importDefault(absolute);
+}
+//#endregion
+//#region src/checks/commit-types.ts
+const DEFAULT_COMMITLINT_CONFIG = "commitlint.config.ts";
+const DEFAULT_RELEASE_CONFIG = "release.config.ts";
+const COMMIT_ANALYZER = "@semantic-release/commit-analyzer";
+const RELEASE_NOTES_GENERATOR = "@semantic-release/release-notes-generator";
+function stringsOf(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string") ? value : void 0;
+}
+const RULE_OFF = 0;
+/**
+* The `type-enum` rule of the commitlint config, or `undefined` when the config does not set it and so takes the rule of its preset. The rule is `[level, condition, types]`: `'always'` lists the only accepted types, `'never'` lists forbidden ones (every other type is accepted), and level 0 switches the rule off (every type is accepted).
+*/
+function commitTypeRule(config, file) {
+	const rules = config["rules"];
+	if (!isRecord(rules) || !("type-enum" in rules)) return;
+	const rule = rules["type-enum"];
+	const [level, condition, listed] = Array.isArray(rule) ? rule.map((part) => part) : [];
+	const types = stringsOf(listed);
+	if (typeof level !== "number" || condition !== "always" && condition !== "never" || types === void 0) throw new ConformanceError(`${file}: the 'type-enum' rule must be written as [level, 'always' or 'never', [types]] for its types to be read`);
+	if (level === RULE_OFF) return {
+		enumerated: void 0,
+		accepts: () => true
+	};
+	return condition === "always" ? {
+		enumerated: types,
+		accepts: (type) => types.includes(type)
+	} : {
+		enumerated: void 0,
+		accepts: (type) => !types.includes(type)
+	};
+}
+/**
+* The options of the semantic-release plugin named `plugin`, or `undefined` when it is not configured or has no options.
+*/
+function pluginOptions(release, plugin) {
+	const plugins = release["plugins"];
+	if (!Array.isArray(plugins)) return;
+	for (const entry of plugins) if (Array.isArray(entry) && entry[0] === plugin && isRecord(entry[1])) return entry[1];
+}
+function typesOfEntries(entries, file, what) {
+	if (entries === void 0) return;
+	if (!Array.isArray(entries)) throw new ConformanceError(`${file}: ${what} must be an array for its types to be read`);
+	return entries.flatMap((entry) => isRecord(entry) && typeof entry["type"] === "string" ? [entry["type"]] : []);
+}
+async function readObject(cwd, file, configFiles) {
+	const config = await evaluateConfigFile(cwd, file, configFiles);
+	if (config === void 0) return;
+	if (!isRecord(config)) throw new ConformanceError(`${file}: the default export must be an object`);
+	return config;
+}
+/**
+* The commit types the conventional presets know, which is the `type-enum` of `@commitlint/config-conventional` and the type list the conventional changelog presets label. Their release behaviour is the preset's own, so a preset type needs no release rule or changelog section to be accounted for; a type outside this list does.
+*/
+const PRESET_COMMIT_TYPES = [
+	"build",
+	"chore",
+	"ci",
+	"docs",
+	"feat",
+	"fix",
+	"perf",
+	"refactor",
+	"revert",
+	"style",
+	"test"
+];
+function isCustom(type) {
+	return !PRESET_COMMIT_TYPES.includes(type);
+}
+/**
+* The commit types commitlint accepts are accounted for in the release config. A type no preset knows must have a release rule and, when the config lists changelog sections (`presetConfig.types` of the release notes generator), a section, or it can be committed and never released or shown; a release rule or changelog section for a type commitlint rejects can never apply. Types are enumerated only by a `type-enum` rule of the form `[level, 'always', [types]]`; a `'never'` rule forbids the types it lists and enumerates none, and a rule that is off (level 0) accepts every type. A preset type may be left out of either list: leaving out a type that does not release is how a release rule list is normally written.
+*
+* It compares only what is written. The check has nothing to say when the commit types are the preset's and every listed type is one of them. A commitlint config that does not set `type-enum` while the release config lists a type no preset knows is a violation, since the commit types cannot then be read. Both configs are evaluated, so a list may be derived from one shared constant.
+*/
+const commitTypes = async ({ cwd, options, configFiles }) => {
+	const commitlintFile = options.commitlint ?? DEFAULT_COMMITLINT_CONFIG;
+	const releaseFile = options.release ?? DEFAULT_RELEASE_CONFIG;
+	const commitlint = await readObject(cwd, commitlintFile, configFiles);
+	const release = await readObject(cwd, releaseFile, configFiles);
+	const violations = [];
+	if (commitlint === void 0) violations.push({
+		code: "commit-types/missing-config",
+		message: `${commitlintFile} does not exist`,
+		file: commitlintFile
+	});
+	if (release === void 0) violations.push({
+		code: "commit-types/missing-config",
+		message: `${releaseFile} does not exist`,
+		file: releaseFile
+	});
+	if (commitlint === void 0 || release === void 0) return violations;
+	const releaseRules = typesOfEntries(pluginOptions(release, COMMIT_ANALYZER)?.["releaseRules"], releaseFile, "releaseRules");
+	const presetConfig = pluginOptions(release, RELEASE_NOTES_GENERATOR)?.["presetConfig"];
+	const changelog = typesOfEntries(isRecord(presetConfig) ? presetConfig["types"] : void 0, releaseFile, "presetConfig.types");
+	const accepted = commitTypeRule(commitlint, commitlintFile);
+	if (accepted === void 0) {
+		const unknown = [releaseRules, changelog].flatMap((list) => list ?? []).filter(isCustom);
+		if (unknown.length > 0) violations.push({
+			code: "commit-types/no-type-enum",
+			message: `${releaseFile} lists ${unknown.map((type) => `'${type}'`).join(", ")}, which no preset knows, but ${commitlintFile} sets no 'type-enum' rule, so the commit types cannot be read`,
+			file: commitlintFile
+		});
+		return violations;
+	}
+	const lists = [{
+		listed: releaseRules,
+		required: true,
+		noun: "release rule",
+		absent: "no-release-rule",
+		extra: "release-rule-not-a-commit-type"
+	}, {
+		listed: changelog,
+		required: changelog !== void 0,
+		noun: "changelog section",
+		absent: "no-changelog-section",
+		extra: "changelog-section-not-a-commit-type"
+	}];
+	for (const { listed, required, noun, absent, extra } of lists) {
+		for (const type of required ? (accepted.enumerated ?? []).filter(isCustom) : []) if (listed?.includes(type) !== true) violations.push({
+			code: `commit-types/${absent}`,
+			message: `'${type}' is a commit type in ${commitlintFile} that no preset knows, and ${releaseFile} has no ${noun} for it`,
+			file: releaseFile
+		});
+		for (const type of (listed ?? []).filter((candidate) => !accepted.accepts(candidate))) violations.push({
+			code: `commit-types/${extra}`,
+			message: `'${type}' has a ${noun} in ${releaseFile} but is not a commit type in ${commitlintFile}`,
+			file: commitlintFile
+		});
+	}
+	return violations;
+};
+//#endregion
+//#region src/checks/dockerfile-package-manager.ts
+const DEFAULT_DOCKERFILES = [
+	"**/Dockerfile",
+	"**/Dockerfile.*",
+	"**/*.Dockerfile"
+];
+const DEFAULT_PACKAGE_JSON = "package.json";
+/**
+* A package manager and a version, `pnpm@12.4.1` or `pnpm@12.4.1+sha512.abc`, as `packageManager` and corepack write them.
+*/
+const PACKAGE_MANAGER = /^([a-z]+)@([^+\s]+)/u;
+/**
+* A variable reference in a version: `$NAME` or `${NAME}`, capturing the name.
+*/
+const VARIABLE = /\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/gu;
+/**
+* `<manager>@<version>` wherever a Dockerfile installs or activates a package manager. The manager is not the end of a longer name (`create-pnpm`, `@scope/pnpm`). The version is what a version is made of, plus variable references, and stops at anything else, such as a comma or a quote; a `+` suffix such as `+sha512.abc` is not part of it.
+*/
+const PIN = /(?<![\w./@-])(pnpm|yarn|npm)@((?:\$\{[A-Za-z_][A-Za-z0-9_]*\}|\$[A-Za-z_][A-Za-z0-9_]*|[0-9A-Za-z._-])+)/gu;
+const INSTRUCTION = /^\s*(ARG|ENV)\s+(.*)$/iu;
+const ASSIGNMENT = /([A-Za-z_][A-Za-z0-9_]*)=("[^"]*"|'[^']*'|\S*)/gu;
+function unquoted(value) {
+	return value.replace(/^(["'])(.*)\1$/u, "$2");
+}
+/**
+* The variables an `ARG` or `ENV` instruction sets, with the value it gives each, or `undefined` for an `ARG` without a default. `ARG NAME=value`, `ENV NAME=value NAME2=value2` and `ENV NAME value` are read; any other line sets nothing.
+*/
+function variablesSetBy(line) {
+	const [, instruction, body] = INSTRUCTION.exec(line) ?? [];
+	const variables = /* @__PURE__ */ new Map();
+	if (instruction === void 0 || body === void 0) return variables;
+	for (const [, name, value] of body.matchAll(ASSIGNMENT)) if (name !== void 0 && value !== void 0) variables.set(name, unquoted(value));
+	if (variables.size === 0) {
+		const [name, ...value] = body.trim().split(/\s+/u);
+		if (name !== void 0 && name !== "") variables.set(name, instruction.toUpperCase() === "ENV" && value.length > 0 ? unquoted(value.join(" ")) : void 0);
+	}
+	return variables;
+}
+/**
+* The version a pin names once the variables it refers to are replaced by the values in effect, or `undefined` when a variable has no value there (an `ARG` without a default, or a variable this file does not set) or its value refers to another variable, which makes the version unknowable from the file. A `+sha` suffix is dropped.
+*/
+function versionOf(token, variables) {
+	const unknown = [];
+	const replaced = token.replace(VARIABLE, (_reference, variable) => {
+		const value = variables.get(variable);
+		if (value === void 0 || value.includes("$")) {
+			unknown.push(variable);
+			return "";
+		}
+		return value;
+	});
+	return unknown.length === 0 ? replaced.split("+")[0] : void 0;
+}
+/**
+* Every pin of the package manager that `packageManager` names, in each Dockerfile, is the version `packageManager` names, with any `+sha` integrity suffix ignored on both sides. Pins of other package managers are not the workspace's package manager and are left alone.
+*
+* It reads `<manager>@<version>` as written on a line that is not a comment. A version that refers to a variable is compared with the value the file gives that variable by an `ARG` or `ENV` before the pin (the latest such value, whichever build stage it was in); one whose variable has no value in the file is not compared, since the build supplies it.
+*/
+const dockerfilePackageManager = async ({ cwd, options }) => {
+	const packageJson = options.packageJson ?? DEFAULT_PACKAGE_JSON;
+	const manifest = JSON.parse(await readFile(resolve(cwd, packageJson), "utf8"));
+	const declared = isRecord(manifest) && typeof manifest["packageManager"] === "string" ? PACKAGE_MANAGER.exec(manifest["packageManager"]) : null;
+	const name = declared?.[1];
+	const version = declared?.[2];
+	if (name === void 0 || version === void 0) return [{
+		code: "dockerfile-package-manager/no-package-manager",
+		message: `${packageJson} has no valid 'packageManager' field to compare Dockerfile pins with`,
+		file: packageJson
+	}];
+	const violations = [];
+	for (const file of await findFiles(cwd, [...options.dockerfiles ?? DEFAULT_DOCKERFILES, ...excludedFrom(options.exclude)])) {
+		const variables = /* @__PURE__ */ new Map();
+		(await readFile(resolve(cwd, file), "utf8")).split("\n").forEach((text, index) => {
+			if (text.trimStart().startsWith("#")) return;
+			for (const [variable, value] of variablesSetBy(text)) variables.set(variable, value);
+			for (const match of text.matchAll(PIN)) {
+				const pinned = versionOf(String(match[2]), variables);
+				if (match[1] === name && pinned !== void 0 && pinned !== version) violations.push({
+					code: "dockerfile-package-manager/version-mismatch",
+					message: `${file} pins ${name}@${pinned} but packageManager in ${packageJson} is ${name}@${version}`,
+					file,
+					location: {
+						line: index + 1,
+						column: match.index + 1
+					}
+				});
+			}
+		});
+	}
+	return violations;
+};
+//#endregion
+//#region src/workspace/rules.ts
+const REGEXP_SPECIAL = /[.*+?^${}()|[\]\\]/gu;
+function escapeRegExp(text) {
+	return text.replace(REGEXP_SPECIAL, "\\$&");
+}
+/**
+* A regular expression, as source text, matching every file inside any of the packages. The trailing `/` keeps `packages/a` from matching `packages/ab`.
+*/
+function packagesPattern(packages) {
+	return `^(${packages.map((member) => `${escapeRegExp(member.dir)}/`).join("|")})`;
+}
+/**
+* A regular expression, as source text, matching the name an import uses for any of the named packages: the name itself or a subpath of it. It matches nothing but those names, and is `undefined` when no package has a name.
+*/
+function packageNamesPattern(packages) {
+	const names = packages.flatMap((member) => member.name === void 0 ? [] : [escapeRegExp(member.name)]);
+	return names.length === 0 ? void 0 : `^(${names.join("|")})(/|$)`;
+}
+/**
+* The paths a graph of these packages is limited to: their files, and the names other packages import them by. An import that dependency-cruiser cannot resolve to a file (a package whose entry point is not built, or a workspace that is not installed) is known to it only by that name.
+*/
+function graphScopePattern(packages) {
+	const names = packageNamesPattern(packages);
+	return names === void 0 ? packagesPattern(packages) : `${packagesPattern(packages)}|${names}`;
+}
+/**
+* The rules that forbid files of `from` to import `to`: one for the files the packages resolve to and, when any of them has a name, one for an import of the name that cannot be resolved to a file. Both are named after `name`, which is also each rule's comment prefix.
+*/
+function forbid(name, comment, from, to) {
+	const names = packageNamesPattern(to);
+	const byPath = {
+		name,
+		severity: "error",
+		comment,
+		from: { path: packagesPattern(from) },
+		to: { path: packagesPattern(to) }
+	};
+	return names === void 0 ? [byPath] : [byPath, {
+		name: `${name}-by-name`,
+		severity: "error",
+		comment,
+		from: { path: packagesPattern(from) },
+		to: {
+			path: names,
+			couldNotResolve: true
+		}
+	}];
+}
+function groupBy(packages, keyOf) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const member of packages) {
+		const key = keyOf(member);
+		if (key === void 0) continue;
+		const existing = groups.get(key);
+		if (existing === void 0) groups.set(key, [member]);
+		else existing.push(member);
+	}
+	return groups;
+}
+/**
+* A package's rank, or a `ConformanceError` naming every package that has none. A rank check that skipped an unranked package would look clean while checking less.
+*/
+function ranked(packages) {
+	const unranked = packages.filter((member) => member.rank === void 0);
+	if (unranked.length > 0) throw new ConformanceError(`no rank resolves for ${unranked.map((member) => member.dir).join(", ")}; give the group a rank, add a matching nameRanks pattern, or set defaultRank in the layout`);
+	return packages.flatMap((member) => member.rank === void 0 ? [] : [{
+		...member,
+		rank: member.rank
+	}]);
+}
+/**
+* One rule per rank that has a higher rank above it: files of a package at that rank may not import a package at a strictly higher rank. A rule compares no numbers, so the ordering is expanded into path alternations here. Each rule comes with a `-by-name` rule for imports that do not resolve to a file.
+*/
+function uphillRules(packages) {
+	const members = ranked(packages);
+	return [...groupBy(members, (member) => member.rank).entries()].sort(([a], [b]) => a - b).flatMap(([rank, own]) => {
+		const higher = members.filter((member) => member.rank > rank);
+		return higher.length === 0 ? [] : forbid(`uphill-rank-${String(rank)}`, `a package of rank ${String(rank)} may not import a package of a higher rank`, own, higher);
+	});
+}
+/**
+* One rule per rank with a package more than `rankSkip.maxDistance` ranks below it that is not an exempt rank.
+*/
+function rankSkipRules(packages, rankSkip) {
+	const members = ranked(packages);
+	return [...groupBy(members, (member) => member.rank).entries()].sort(([a], [b]) => a - b).flatMap(([rank, own]) => {
+		const skipped = members.filter((member) => member.rank < rank - rankSkip.maxDistance && !rankSkip.exemptRanks.includes(member.rank));
+		return skipped.length === 0 ? [] : forbid(`rank-skip-${String(rank)}`, `a package of rank ${String(rank)} may import at most ${String(rankSkip.maxDistance)} rank(s) below it, apart from the exempt ranks`, own, skipped);
+	});
+}
+/**
+* One rule per slice: a package in it may not import a package that has a different slice. A package without a slice is in none and is never restricted.
+*/
+function crossSliceRules(packages) {
+	return [...groupBy(packages, (member) => member.slice).entries()].sort(([a], [b]) => a.localeCompare(b)).flatMap(([slice, own]) => {
+		const others = packages.filter((member) => member.slice !== void 0 && member.slice !== slice);
+		return others.length === 0 ? [] : forbid(`cross-slice-${slice}`, `a package in the '${slice}' slice may not import a package in another slice`, own, others);
+	});
+}
+/**
+* Two rules per isolated pair, one for each direction.
+*/
+function isolatedGroupRules(packages, isolatedGroups) {
+	const byGroup = groupBy(packages, (member) => member.group);
+	return isolatedGroups.flatMap(([first, second]) => [{
+		from: first,
+		to: second
+	}, {
+		from: second,
+		to: first
+	}].flatMap(({ from, to }) => {
+		const own = byGroup.get(from);
+		const other = byGroup.get(to);
+		return own === void 0 || other === void 0 ? [] : forbid(`isolated-${from}-${to}`, `the '${from}' group may not import the '${to}' group`, own, other);
+	}));
+}
+/**
+* The rule that forbids any import cycle among the packages' files.
+*/
+function cycleRule() {
+	return {
+		name: "import-cycle",
+		severity: "error",
+		comment: "files may not import each other in a cycle",
+		from: {},
+		to: { circular: true }
+	};
+}
+/**
+* The rule that reports every import of a named package by a name that resolves to no file. It marks edges for the cycle check to follow, so a finding of it is an import and not a defect.
+*
+* It is `undefined` when no package has a name.
+*/
+function unresolvedNameImportRule(packages) {
+	const names = packageNamesPattern(packages);
+	return names === void 0 ? void 0 : {
+		name: "unresolved-name-import",
+		severity: "error",
+		comment: "marks an import of a workspace package by a name that resolves to no file",
+		from: { path: packagesPattern(packages) },
+		to: {
+			path: names,
+			couldNotResolve: true
+		}
+	};
+}
+//#endregion
+//#region src/workspace/packages.ts
+function segmentsOf(path) {
+	return path.split("/").filter((segment) => segment !== "" && segment !== ".");
+}
+function groupRoot(group) {
+	return segmentsOf(group.path ?? group.name);
+}
+function startsWithSegments(segments, prefix) {
+	return prefix.every((segment, index) => segments[index] === segment);
+}
+/**
+* The group whose root is the longest prefix of `dir`; the first declared wins a tie. `undefined` when no group owns the directory.
+*/
+function owningGroup(dir, groups) {
+	const segments = segmentsOf(dir);
+	let best;
+	let bestLength = -1;
+	for (const group of groups) {
+		const root = groupRoot(group);
+		if (root.length > bestLength && startsWithSegments(segments, root)) {
+			best = group;
+			bestLength = root.length;
+		}
+	}
+	return best;
+}
+function rankOf(name, group, layout) {
+	if (name !== void 0) {
+		const rule = layout.nameRanks?.find((candidate) => new RegExp(candidate.pattern, "u").test(name));
+		if (rule !== void 0) return rule.rank;
+	}
+	return group.rank ?? layout.defaultRank;
+}
+/**
+* The name without its npm scope: `@scope/store-cli` gives `store-cli`.
+*/
+function unscoped(name) {
+	return name.replace(/^@[^/]+\//u, "");
+}
+/**
+* The longest slice value that is the whole unscoped name or its prefix up to a `-`.
+*/
+function sliceByNamePrefix(name, known) {
+	const bare = unscoped(name);
+	return [...known].filter((candidate) => bare === candidate || bare.startsWith(`${candidate}-`)).sort((a, b) => b.length - a.length)[0];
+}
+/**
+* Classify discovered packages by the layout: group, rank and slice. Pure.
+*
+* A package no group owns is a configuration error, because every check would otherwise skip it without saying so. Nested package directories are one too: the checks attribute a file to the package whose directory is its prefix, which is ambiguous for a package inside another. A `namePrefix` slice takes the longest slice value that a `segment` group produced and that prefixes the package's unscoped name; a package without a name has no such slice.
+*/
+function classifyPackages(discovered, layout) {
+	const owned = discovered.map((found) => {
+		const group = owningGroup(found.dir, layout.groups);
+		if (group === void 0) throw new ConformanceError(`the package directory '${found.dir}' is not under any layout group's path; add a group whose path prefixes it, or narrow the workspace package globs`);
+		return {
+			found,
+			group
+		};
+	});
+	const knownSlices = /* @__PURE__ */ new Set();
+	for (const { found, group } of owned) if (group.slice !== void 0 && "segment" in group.slice) {
+		const value = segmentsOf(found.dir).slice(groupRoot(group).length)[group.slice.segment];
+		if (value !== void 0) knownSlices.add(value);
+	}
+	const packages = owned.map(({ found, group }) => {
+		let slice;
+		if (group.slice !== void 0 && "segment" in group.slice) slice = segmentsOf(found.dir).slice(groupRoot(group).length)[group.slice.segment];
+		else if (group.slice !== void 0 && found.name !== void 0) slice = sliceByNamePrefix(found.name, knownSlices);
+		return {
+			...found,
+			group: group.name,
+			rank: rankOf(found.name, group, layout),
+			slice
+		};
+	});
+	for (const outer of packages) {
+		const nested = packages.find((inner) => inner.dir !== outer.dir && inner.dir.startsWith(`${outer.dir}/`));
+		if (nested !== void 0) throw new ConformanceError(`the package directory '${nested.dir}' is inside the package directory '${outer.dir}'; workspace packages must not nest`);
+	}
+	return packages;
+}
+/**
+* The workspace root: `layout.root` resolved against `cwd`, or `cwd` itself.
+*/
+function workspaceRoot(cwd, layout) {
+	return layout.root === void 0 ? cwd : resolve(cwd, layout.root);
+}
+/**
+* The package globs: `layout.packages`, else the `packages` list of `pnpm-workspace.yaml` in `root`.
+*/
+async function workspacePatterns(root, layout) {
+	if (layout.packages !== void 0) return layout.packages;
+	const file = join(root, "pnpm-workspace.yaml");
+	let source;
+	try {
+		source = await readFile(file, "utf8");
+	} catch (error) {
+		throw new ConformanceError(`the layout has no 'packages' and ${file} cannot be read`, { cause: error });
+	}
+	const document = parse(source);
+	if (typeof document !== "object" || document === null || !("packages" in document) || !Array.isArray(document.packages)) throw new ConformanceError(`${file} has no 'packages' list`);
+	const patterns = document.packages;
+	if (!patterns.every((pattern) => typeof pattern === "string")) throw new ConformanceError(`${file}: every entry of 'packages' must be a string`);
+	return patterns;
+}
+async function readName(manifest) {
+	let content;
+	try {
+		content = JSON.parse(await readFile(manifest, "utf8"));
+	} catch (error) {
+		throw new ConformanceError(`${manifest} cannot be read as JSON`, { cause: error });
+	}
+	if (typeof content === "object" && content !== null && "name" in content && typeof content.name === "string") return content.name;
+}
+/**
+* The directories under `root` that the pnpm-style `patterns` select and that hold a `package.json`, sorted. A `!` pattern excludes. The root package itself (`.`) is not a member of any group and is left out.
+*/
+async function discoverPackages(root, patterns) {
+	const manifests = patterns.map((pattern) => pattern.startsWith("!") ? `!${pattern.slice(1)}/**` : `${pattern}/package.json`);
+	const dirs = (await glob(manifests, {
+		cwd: root,
+		dot: true,
+		ignore: [INSTALLED_DEPENDENCIES_GLOB],
+		onlyFiles: true
+	})).map((manifest) => manifest.replace(/\/?package\.json$/u, "")).filter((dir) => dir !== "");
+	return Promise.all([...new Set(dirs)].sort().map(async (dir) => ({
+		dir,
+		name: await readName(join(root, dir, "package.json"))
+	})));
+}
+/**
+* The layout's packages found under the workspace root.
+*/
+async function readWorkspacePackages(cwd, layout) {
+	const root = workspaceRoot(cwd, layout);
+	return classifyPackages(await discoverPackages(root, await workspacePatterns(root, layout)), layout);
+}
+//#endregion
+//#region src/checks/import-graph.ts
+/**
+* Paths left out of the import graph unless the options say otherwise: a package's own installed dependencies.
+*/
+const DEFAULT_GRAPH_EXCLUDES = ["(^|/)node_modules/"];
+/**
+* Paths whose files are imported but whose own imports are not followed unless the options say otherwise: build output, which repeats the sources it was built from. A package that exports its build output is imported through it, so the output has to stay in the graph as a target.
+*/
+const DEFAULT_DO_NOT_FOLLOW = ["(^|/)dist/"];
+/**
+* The package a path in the graph belongs to: the one whose directory holds the file, and only when no directory does, the one whose name the path is (an import that resolved to no file is known only by the name it was written with, or a subpath of it). The directory wins because an unscoped package name can equal the leading directory of another package's files. It throws `ConformanceError` for a path the graph should not contain.
+*/
+function packageOfPath(packages, path) {
+	const found = packages.find((member) => path.startsWith(`${member.dir}/`)) ?? packages.find((member) => member.name !== void 0 && (path === member.name || path.startsWith(`${member.name}/`)));
+	if (found === void 0) throw new ConformanceError(`${path} is in no workspace package, although the graph is limited to the packages' files and names`);
+	return found;
+}
+/**
+* The tsconfig as dependency-cruiser should read its compiler options, with `baseUrl` set when the tsconfig has none.
+*
+* dependency-cruiser hands its path alias resolver a `baseUrl` of `./` when the parsed tsconfig has none, and that resolves against the working directory of the process, not against the tsconfig. `paths` without `baseUrl` is the form TypeScript 4.1 and later accepts (`baseUrl` is deprecated), and it means relative to the tsconfig. Given any `baseUrl`, dependency-cruiser leaves the alias resolver to read the tsconfig file itself, which applies that meaning wherever the process runs. The value set here is only that signal and is never used as a directory.
+*/
+function withBaseUrl(parsed, tsConfigFile) {
+	return "baseUrl" in parsed.options ? parsed : {
+		...parsed,
+		options: {
+			...parsed.options,
+			baseUrl: dirname(tsConfigFile)
+		}
+	};
+}
+/**
+* Throws `ConformanceError` unless dependency-cruiser can load the installed TypeScript. Without it dependency-cruiser cruises no `.ts` file and reports success, so every import check would pass whatever the workspace imports.
+*/
+function assertTypeScriptAvailable(transpilers) {
+	const typescript = transpilers.find((transpiler) => transpiler.name === "typescript");
+	if (typescript?.available !== true) throw new ConformanceError(`dependency-cruiser cannot load TypeScript, so the import checks would find no TypeScript file and report nothing; install ${typescript === void 0 ? "a version it supports" : `a version in ${typescript.version}`} as the 'typescript' of this workspace`);
+}
+/**
+* The violations of `rules` among the files of `packages`. The graph is limited to the packages' own files, so nothing outside them is a dependant or a dependency.
+*
+* The base directory is the real path of the root: dependency-cruiser resolves symbolic links, so the path of a file behind one would otherwise not be relative to it.
+*
+* The result is read from the cruise summary: `cruise()` reports success in its exit code whatever the summary holds, so the code is not consulted.
+*/
+async function cruiseViolations(input) {
+	const { cwd, root, packages, rules, options } = input;
+	if (rules.length === 0) return [];
+	const tsConfigFile = options.tsConfig === void 0 ? void 0 : resolve(cwd, options.tsConfig);
+	const { cruise, getAvailableTranspilers } = await import("dependency-cruiser");
+	assertTypeScriptAvailable(getAvailableTranspilers());
+	const { default: extractTsConfig } = await import("dependency-cruiser/config-utl/extract-ts-config");
+	const result = await cruise(packages.map((member) => member.dir), {
+		baseDir: await realpath(root),
+		exclude: { path: [...options.exclude ?? DEFAULT_GRAPH_EXCLUDES] },
+		doNotFollow: { path: [...options.doNotFollow ?? DEFAULT_DO_NOT_FOLLOW] },
+		includeOnly: { path: graphScopePattern(packages) },
+		ruleSet: { forbidden: [...rules] },
+		tsPreCompilationDeps: true,
+		validate: true,
+		...tsConfigFile === void 0 ? {} : { tsConfig: { fileName: tsConfigFile } }
+	}, {}, tsConfigFile === void 0 ? {} : { tsConfig: withBaseUrl(extractTsConfig(tsConfigFile), tsConfigFile) });
+	if (typeof result.output === "string") throw new ConformanceError("dependency-cruiser returned text where a result object was requested");
+	return result.output.summary.violations;
+}
+/**
+* Run one import check: generate its rules from the layout, cruise the packages and report each finding.
+*/
+async function runImportCheck(context, spec) {
+	const root = workspaceRoot(context.cwd, context.layout);
+	const packages = await readWorkspacePackages(context.cwd, context.layout);
+	const rules = spec.rules(packages, context);
+	return (await cruiseViolations({
+		cwd: context.cwd,
+		root,
+		packages,
+		rules,
+		options: context.options
+	})).map((finding) => {
+		const from = packageOfPath(packages, finding.from);
+		const to = packageOfPath(packages, finding.to);
+		return {
+			code: `${spec.name}/${spec.reason}`,
+			message: spec.message({
+				from,
+				to,
+				fromFile: finding.from,
+				toFile: finding.to
+			}),
+			file: relativePosix(context.cwd, join(root, finding.from))
+		};
+	}).sort((a, b) => a.file.localeCompare(b.file) || a.message.localeCompare(b.message));
+}
+/**
+* How a package is named in a message: its declared name, else its directory.
+*/
+function describePackage(member) {
+	return member.name ?? member.dir;
+}
+/**
+* How an import's target is named in a message: the file and the package it is in, or just the name when the import resolved to no file and is known only by the name it was written with.
+*/
+function describeTarget(edge) {
+	const { to, toFile } = edge;
+	return !toFile.startsWith(`${to.dir}/`) && to.name !== void 0 && (toFile === to.name || toFile.startsWith(`${to.name}/`)) ? toFile : `${toFile} in ${describePackage(to)}`;
+}
+//#endregion
+//#region src/checks/import-cross-slice.ts
+/**
+* A package imports a package in a different slice.
+*/
+const importCrossSlice = async (context) => runImportCheck(context, {
+	name: "import-cross-slice",
+	reason: "other-slice",
+	rules: (packages) => {
+		if (!packages.some((member) => member.slice !== void 0)) throw new ConformanceError("the 'import-cross-slice' check is enabled but no package in the layout has a slice");
+		return crossSliceRules(packages);
+	},
+	message: (edge) => `${describePackage(edge.from)} (slice '${String(edge.from.slice)}') imports ${describeTarget(edge)} (slice '${String(edge.to.slice)}')`
+});
+//#endregion
+//#region src/checks/import-cycles.ts
+/**
+* `items` rotated to start at the one with the smallest key, so the same ring found from any of its elements has one form.
+*/
+function rotatedToSmallest(items, keyOf) {
+	const keys = items.map(keyOf);
+	const smallest = keys.toSorted()[0];
+	if (smallest === void 0) throw new ConformanceError("an import cycle with no members was reported");
+	const start = keys.indexOf(smallest);
+	return [...items.slice(start), ...items.slice(0, start)];
+}
+/**
+* The cycles among files that dependency-cruiser found, each as its files in import order from its smallest path. A cycle is one ring of files, so two distinct rings over the same files are two cycles.
+*/
+function fileCycles(findings) {
+	const cycles = /* @__PURE__ */ new Map();
+	for (const finding of findings) {
+		const ring = [finding.from, ...(finding.cycle ?? []).map((step) => step.name)];
+		const ordered = rotatedToSmallest(ring[ring.length - 1] === finding.from ? ring.slice(0, -1) : ring, (file) => file);
+		cycles.set(ordered.join("\n"), ordered);
+	}
+	return cycles;
+}
+/**
+* The shortest ring of packages that starts and ends at the package in `startDir` along the name imports, or `undefined` when none returns to it.
+*/
+function shortestRing(startDir, edges) {
+	const reached = /* @__PURE__ */ new Map();
+	let frontier = [[]];
+	while (frontier.length > 0) {
+		const next = [];
+		for (const path of frontier) {
+			const last = path[path.length - 1];
+			for (const edge of edges.get(last === void 0 ? startDir : last.to.dir) ?? []) {
+				const ring = [...path, edge];
+				if (edge.to.dir === startDir) return ring;
+				if (!reached.has(edge.to.dir)) {
+					reached.set(edge.to.dir, ring);
+					next.push(ring);
+				}
+			}
+		}
+		frontier = next;
+	}
+}
+/**
+* The cycles among packages that import each other by a name that resolves to no file (a workspace that is not installed, or whose entry points are not built). There is no file to follow, so the packages stand for their files, and a package importing its own name is not a cycle.
+*/
+function nameCycles(imports) {
+	const edges = /* @__PURE__ */ new Map();
+	for (const edge of imports) {
+		if (edge.from.dir === edge.to.dir) continue;
+		const existing = edges.get(edge.from.dir);
+		if (existing === void 0) edges.set(edge.from.dir, [edge]);
+		else if (!existing.some((known) => known.to.dir === edge.to.dir)) existing.push(edge);
+	}
+	const cycles = /* @__PURE__ */ new Map();
+	for (const dir of [...edges.keys()].sort()) {
+		const ring = shortestRing(dir, edges);
+		if (ring !== void 0) {
+			const ordered = rotatedToSmallest(ring, (edge) => edge.from.dir);
+			cycles.set(ordered.map((edge) => edge.from.dir).join("\n"), ordered);
+		}
+	}
+	return cycles;
+}
+/**
+* Files of the workspace's packages import each other in a cycle, and so do packages that import each other by a name that resolves to no file. Each cycle is reported once, at its first file (or, for packages, the file of the first import), starting from its smallest path.
+*
+* Cycles among packages are found only when every import in the ring is by a name that resolves to no file. A ring that mixes such imports with imports that do resolve to files has no complete path through either graph and is not seen.
+*/
+const importCycles = async (context) => {
+	const root = workspaceRoot(context.cwd, context.layout);
+	const packages = await readWorkspacePackages(context.cwd, context.layout);
+	const nameRule = unresolvedNameImportRule(packages);
+	const found = await cruiseViolations({
+		cwd: context.cwd,
+		root,
+		packages,
+		rules: nameRule === void 0 ? [cycleRule()] : [cycleRule(), nameRule],
+		options: context.options
+	});
+	const inFiles = fileCycles(found.filter((finding) => finding.rule.name === cycleRule().name));
+	const inPackages = nameCycles(found.filter((finding) => finding.rule.name === nameRule?.name).map((finding) => ({
+		from: packageOfPath(packages, finding.from),
+		to: packageOfPath(packages, finding.to),
+		file: finding.from
+	})));
+	return [...[...inFiles.values()].map((ordered) => {
+		const [first] = ordered;
+		if (first === void 0) throw new ConformanceError("an import cycle with no files was reported");
+		return {
+			code: "import-cycles/cycle",
+			message: `import cycle: ${[...ordered, first].join(" -> ")}`,
+			file: relativePosix(context.cwd, join(root, first))
+		};
+	}), ...[...inPackages.values()].map((ring) => {
+		const [first] = ring;
+		if (first === void 0) throw new ConformanceError("an import cycle with no packages was reported");
+		return {
+			code: "import-cycles/cycle",
+			message: `import cycle between packages that import each other by a name that resolves to no file: ${[...ring.map((edge) => describePackage(edge.from)), describePackage(first.from)].join(" -> ")}`,
+			file: relativePosix(context.cwd, join(root, first.file))
+		};
+	})].sort((a, b) => a.file.localeCompare(b.file) || a.message.localeCompare(b.message));
+};
+//#endregion
+//#region src/checks/import-isolated-groups.ts
+/**
+* A package imports a package in a group the layout isolates from its own.
+*/
+const importIsolatedGroups = async (context) => runImportCheck(context, {
+	name: "import-isolated-groups",
+	reason: "isolated-group",
+	rules: (packages) => {
+		if (context.layout.isolatedGroups === void 0) throw new ConformanceError("the 'import-isolated-groups' check is enabled but the layout has no 'isolatedGroups'");
+		return isolatedGroupRules(packages, context.layout.isolatedGroups);
+	},
+	message: (edge) => `${describePackage(edge.from)} (group '${edge.from.group}') imports ${describeTarget(edge)} (group '${edge.to.group}'), which the layout isolates from it`
+});
+//#endregion
+//#region src/checks/import-rank-skip.ts
+/**
+* A package imports a package more than `rankSkip.maxDistance` ranks below it that is not in `rankSkip.exemptRanks`.
+*/
+const importRankSkip = async (context) => runImportCheck(context, {
+	name: "import-rank-skip",
+	reason: "skipped-rank",
+	rules: (packages) => {
+		if (context.layout.rankSkip === void 0) throw new ConformanceError("the 'import-rank-skip' check is enabled but the layout has no 'rankSkip'");
+		return rankSkipRules(packages, context.layout.rankSkip);
+	},
+	message: (edge) => `${describePackage(edge.from)} (rank ${String(edge.from.rank)}) imports ${describeTarget(edge)} (rank ${String(edge.to.rank)}), further below than the layout allows`
+});
+//#endregion
+//#region src/checks/import-uphill.ts
+/**
+* A package imports a package of a strictly higher rank: dependencies run downhill only.
+*/
+const importUphill = async (context) => runImportCheck(context, {
+	name: "import-uphill",
+	reason: "higher-rank",
+	rules: (packages) => uphillRules(packages),
+	message: (edge) => `${describePackage(edge.from)} (rank ${String(edge.from.rank)}) imports ${describeTarget(edge)} (rank ${String(edge.to.rank)}), a higher rank`
+});
+async function git(cwd, args) {
+	return new Promise((resolve, reject) => {
+		execFile("git", [...args], {
+			cwd,
+			encoding: "utf8"
+		}, (error, stdout) => {
+			if (error === null) resolve(stdout);
+			else reject(new ConformanceError(`git ${args.join(" ")} failed in ${cwd}; this check reads the git index, so it needs a git working tree`, { cause: error }));
+		});
+	});
+}
+/**
+* The index entry for `path` (relative to `cwd`), or `undefined` when git does not track it.
+*/
+async function indexEntry(cwd, path) {
+	const listing = await git(cwd, [
+		"ls-files",
+		"--stage",
+		"--",
+		path
+	]);
+	const match = /^(\d+) ([0-9a-f]+) \d\t/u.exec(listing);
+	const mode = match?.[1];
+	const blob = match?.[2];
+	return mode === void 0 || blob === void 0 ? void 0 : {
+		mode,
+		blob
+	};
+}
+/**
+* The content of a blob. For a symbolic link it is the link's target.
+*/
+async function blobContent(cwd, blob) {
+	return git(cwd, [
+		"cat-file",
+		"blob",
+		blob
+	]);
+}
+//#endregion
+//#region src/checks/instruction-symlinks.ts
+/**
+* The instruction file names checked when the options name none.
+*/
+const DEFAULT_INSTRUCTION_FILES = ["AGENTS.md", "CLAUDE.md"];
+async function directoriesOf(cwd, patterns) {
+	const found = await Promise.all(patterns.map(async (pattern) => isDynamicPattern(pattern) ? findDirectories(cwd, [pattern]) : [posix.normalize(pattern)]));
+	return [...new Set(found.flat())].sort();
+}
+/**
+* Whether the tracked symbolic link `file` (with index entry `entry`) leads to `destination`: its target, resolved against the directory of the link, is `destination`, or is another tracked symbolic link that leads there. A link back to a link already followed leads nowhere.
+*/
+async function leadsTo(cwd, file, entry, destination) {
+	const followed = /* @__PURE__ */ new Set();
+	let current = {
+		file,
+		entry
+	};
+	for (;;) {
+		const linked = (await blobContent(cwd, current.entry.blob)).trim();
+		if (posix.isAbsolute(linked)) return false;
+		const resolved = posix.join(posix.dirname(current.file), linked);
+		if (resolved === destination) return true;
+		const next = followed.has(resolved) ? void 0 : await indexEntry(cwd, resolved);
+		if (next?.mode !== "120000") return false;
+		followed.add(resolved);
+		current = {
+			file: resolved,
+			entry: next
+		};
+	}
+}
+/**
+* Each agent instruction file is tracked by git as a symbolic link (mode 120000) whose target is the README beside it, so the two cannot diverge. The link may be written in any form that resolves there (`./README.md`), and may lead through other tracked links, as in `CLAUDE.md` to `AGENTS.md` to `README.md`. It reads the index, not the working tree, so a checkout with `core.symlinks` false, where a link is written out as a plain file, is judged by what is committed.
+*/
+const instructionSymlinks = async ({ cwd, options }) => {
+	const files = options.files ?? DEFAULT_INSTRUCTION_FILES;
+	const target = options.target ?? "README.md";
+	const violations = [];
+	for (const directory of await directoriesOf(cwd, options.directories ?? ["."])) {
+		const readme = posix.join(directory, target);
+		for (const name of files) {
+			const file = posix.join(directory, name);
+			const entry = await indexEntry(cwd, file);
+			if (entry === void 0) violations.push({
+				code: "instruction-symlinks/missing",
+				message: `${file} is not tracked; commit it as a symbolic link to ${target}`,
+				file
+			});
+			else if (entry.mode !== "120000") violations.push({
+				code: "instruction-symlinks/not-a-symlink",
+				message: `${file} is committed as a regular file (mode ${entry.mode}); commit it as a symbolic link to ${target}`,
+				file
+			});
+			else if (!await leadsTo(cwd, file, entry, readme)) {
+				const linked = (await blobContent(cwd, entry.blob)).trim();
+				violations.push({
+					code: "instruction-symlinks/wrong-target",
+					message: `${file} links to ${linked}; it should link to ${target}`,
+					file
+				});
+			} else if (await indexEntry(cwd, readme) === void 0) violations.push({
+				code: "instruction-symlinks/dangling",
+				message: `${file} links to ${target}, which is not tracked`,
+				file
+			});
+		}
+	}
+	return violations;
+};
+//#endregion
+//#region src/checks/single-storybook.ts
+const STORYBOOK_DIRECTORY = ".storybook";
+/**
+* At most one Storybook exists, in the permitted directory (the workspace root unless the options say otherwise), and none in a package such as a UI package. A Storybook is a `.storybook` directory.
+*/
+const singleStorybook = async ({ cwd, options }) => {
+	const location = posix.normalize(options.location ?? ".");
+	const permitted = posix.normalize(posix.join(location, STORYBOOK_DIRECTORY));
+	return (await findDirectories(cwd, [`**/${STORYBOOK_DIRECTORY}`, ...excludedFrom(options.exclude)])).filter((directory) => directory !== permitted).map((directory) => ({
+		code: "single-storybook/misplaced",
+		message: `${directory} is a Storybook outside ${location === "." ? "the workspace root" : location}; keep the one Storybook there`,
+		file: directory
+	}));
+};
+//#endregion
+//#region src/registry.ts
+/**
+* The options of an enabled check, or `undefined` when the setting is absent or `false`.
+*/
+function enabledOptions(setting) {
+	return setting === false ? void 0 : setting;
+}
+function plain(spec) {
+	return {
+		name: spec.name,
+		description: spec.description,
+		requiresLayout: false,
+		isEnabled: (checks) => spec.select(checks) !== void 0,
+		run: async ({ cwd, checks, configFiles }) => {
+			const options = spec.select(checks);
+			if (options === void 0) throw new ConformanceError(`the check '${spec.name}' is not enabled`);
+			return spec.check({
+				cwd,
+				options,
+				...configFiles === void 0 ? {} : { configFiles }
+			});
+		}
+	};
+}
+function withLayout(spec) {
+	return {
+		name: spec.name,
+		description: spec.description,
+		requiresLayout: true,
+		isEnabled: (checks) => spec.select(checks) !== void 0,
+		run: async ({ cwd, checks, layout }) => {
+			const options = spec.select(checks);
+			if (options === void 0) throw new ConformanceError(`the check '${spec.name}' is not enabled`);
+			if (layout === void 0) throw new ConformanceError(`the check '${spec.name}' reads the workspace layout, which was not supplied`);
+			return spec.check({
+				cwd,
+				options,
+				layout
+			});
+		}
+	};
+}
+/**
+* Every check, by name, in the order they run. The key is the name used in the `checks` map, on the command line and in violation codes.
+*/
+const registry = {
+	"aggregate-mappers": plain({
+		name: "aggregate-mappers",
+		description: "Every exported aggregate type in a contract file has a mapper file where the template puts it",
+		select: (checks) => enabledOptions(checks["aggregate-mappers"]),
+		check: aggregateMappers
+	}),
+	"command-types": plain({
+		name: "command-types",
+		description: "Every exported command type is derived from a schema, not hand-written",
+		select: (checks) => enabledOptions(checks["command-types"]),
+		check: commandTypes
+	}),
+	"import-uphill": withLayout({
+		name: "import-uphill",
+		description: "No package imports a package of a higher rank",
+		select: (checks) => enabledOptions(checks["import-uphill"]),
+		check: importUphill
+	}),
+	"import-rank-skip": withLayout({
+		name: "import-rank-skip",
+		description: "No package imports further below itself than the layout allows",
+		select: (checks) => enabledOptions(checks["import-rank-skip"]),
+		check: importRankSkip
+	}),
+	"import-cross-slice": withLayout({
+		name: "import-cross-slice",
+		description: "No package imports a package in a different slice",
+		select: (checks) => enabledOptions(checks["import-cross-slice"]),
+		check: importCrossSlice
+	}),
+	"import-isolated-groups": withLayout({
+		name: "import-isolated-groups",
+		description: "No package imports a package in a group the layout isolates from its own",
+		select: (checks) => enabledOptions(checks["import-isolated-groups"]),
+		check: importIsolatedGroups
+	}),
+	"import-cycles": withLayout({
+		name: "import-cycles",
+		description: "No files of the workspace packages import each other in a cycle",
+		select: (checks) => enabledOptions(checks["import-cycles"]),
+		check: importCycles
+	}),
+	"instruction-symlinks": plain({
+		name: "instruction-symlinks",
+		description: "Agent instruction files are git symlinks to the README beside them",
+		select: (checks) => enabledOptions(checks["instruction-symlinks"]),
+		check: instructionSymlinks
+	}),
+	"single-storybook": plain({
+		name: "single-storybook",
+		description: "At most one Storybook exists, at the workspace root, and none inside a package",
+		select: (checks) => enabledOptions(checks["single-storybook"]),
+		check: singleStorybook
+	}),
+	"commit-types": plain({
+		name: "commit-types",
+		description: "The commit types commitlint accepts match the release rules and changelog sections",
+		select: (checks) => enabledOptions(checks["commit-types"]),
+		check: commitTypes
+	}),
+	"dockerfile-package-manager": plain({
+		name: "dockerfile-package-manager",
+		description: "A package manager version pinned in a Dockerfile is the version packageManager names",
+		select: (checks) => enabledOptions(checks["dockerfile-package-manager"]),
+		check: dockerfilePackageManager
+	})
+};
+/**
+* The names of all checks, in the order they run.
+*/
+const checkNames = Object.keys(registry).filter(isCheckName);
+/**
+* Whether `name` is the name of a check.
+*/
+function isCheckName(name) {
+	return Object.hasOwn(registry, name);
+}
+//#endregion
+//#region src/config.ts
+const path = z.string().min(1);
+const paths = z.array(path).min(1);
+const names = z.array(z.string().min(1));
+function compiles(source) {
+	try {
+		new RegExp(source);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Source text of a regular expression that dependency-cruiser compiles as written. It is checked here because dependency-cruiser reports one that does not compile as a slow pattern and quotes it.
+*/
+const pattern = z.string().min(1).refine(compiles, "not a valid regular expression");
+const patterns = z.array(pattern);
+const importGraph = z.strictObject({
+	exclude: z.exactOptional(patterns),
+	doNotFollow: z.exactOptional(patterns),
+	tsConfig: z.exactOptional(path)
+});
+/**
+* A check's setting: `false`, or its options. A union reports only "Invalid input" for a setting that is wrong, so the issues of the options branch, which is the one the person meant unless they wrote `false`, are put in the message.
+*/
+const enabled = (options) => z.union([z.literal(false), options], { error: (issue) => {
+	const [, optionsIssues] = issue.errors;
+	if (optionsIssues === void 0) return;
+	return `expected false or an options object: ${optionsIssues.map((found) => found.path.length === 0 ? found.message : `${found.path.map(String).join(".")}: ${found.message}`).join("; ")}`;
+} });
+const checks = z.strictObject({
+	"aggregate-mappers": z.exactOptional(enabled(z.strictObject({
+		contracts: paths,
+		mapper: path,
+		adapters: z.exactOptional(path),
+		exclude: z.exactOptional(names),
+		tsConfig: z.exactOptional(path)
+	}))),
+	"command-types": z.exactOptional(enabled(z.strictObject({
+		commands: paths,
+		exclude: z.exactOptional(names),
+		inferences: z.exactOptional(paths),
+		tsConfig: z.exactOptional(path)
+	}))),
+	"import-uphill": z.exactOptional(enabled(importGraph)),
+	"import-rank-skip": z.exactOptional(enabled(importGraph)),
+	"import-cross-slice": z.exactOptional(enabled(importGraph)),
+	"import-isolated-groups": z.exactOptional(enabled(importGraph)),
+	"import-cycles": z.exactOptional(enabled(importGraph)),
+	"instruction-symlinks": z.exactOptional(enabled(z.strictObject({
+		files: z.exactOptional(paths),
+		directories: z.exactOptional(paths),
+		target: z.exactOptional(path)
+	}))),
+	"single-storybook": z.exactOptional(enabled(z.strictObject({
+		location: z.exactOptional(path),
+		exclude: z.exactOptional(paths)
+	}))),
+	"commit-types": z.exactOptional(enabled(z.strictObject({
+		commitlint: z.exactOptional(path),
+		release: z.exactOptional(path)
+	}))),
+	"dockerfile-package-manager": z.exactOptional(enabled(z.strictObject({
+		dockerfiles: z.exactOptional(paths),
+		exclude: z.exactOptional(paths),
+		packageJson: z.exactOptional(path)
+	})))
+});
+/**
+* The Standard Schema for {@link ConformanceConfig}. It rejects unknown keys at every level, so a misspelt check name or option fails when the section loads.
+*/
+const conformanceSchema = z.strictObject({ checks });
+/**
+* The `conformance` section. Pass it to `withSections` beside `layoutSection` when authoring `exadev.config.ts`.
+*/
+const conformanceSection = defineSection("conformance", conformanceSchema);
+//#endregion
+//#region src/run-checks.ts
+/**
+* The process exit codes of the command line: nothing found, something found, or the checks could not run.
+*/
+const EXIT_CODES = {
+	clean: 0,
+	violations: 1,
+	failed: 2
+};
+async function conformanceOf(options) {
+	if (options.config !== void 0) return validateStandard(conformanceSection.schema, options.config, `'${conformanceSection.name}' section passed to runChecks`);
+	const loaded = await loadSection(conformanceSection, {
+		...options.configFiles,
+		cwd: options.cwd
+	});
+	if (loaded === void 0) throw new ConformanceError(`no 'conformance' section in ${options.cwd}; define it in exadev.config.ts or in exadev.conformance.config.ts`);
+	return loaded;
+}
+async function layoutOf(options, needed) {
+	if (options.layout !== void 0) return validateStandard(layoutSection.schema, options.layout, `'${layoutSection.name}' section passed to runChecks`);
+	if (needed.length === 0) return;
+	const loaded = await loadSection(layoutSection, {
+		...options.configFiles,
+		cwd: options.cwd
+	});
+	if (loaded === void 0) throw new ConformanceError(`${needed.join(", ")} read the workspace layout, and there is no 'layout' section in ${options.cwd}; define it in exadev.config.ts or in exadev.layout.config.ts`);
+	return loaded;
+}
+function selected(config, requested) {
+	const enabled = checkNames.filter((name) => registry[name].isEnabled(config.checks));
+	if (requested === void 0) {
+		if (enabled.length === 0) throw new ConformanceError("no check is enabled; add one to the 'checks' of the 'conformance' section");
+		return enabled;
+	}
+	const disabled = requested.filter((name) => !enabled.includes(name));
+	if (disabled.length > 0) throw new ConformanceError(`${disabled.join(", ")} ${disabled.length === 1 ? "is" : "are"} not enabled in the 'conformance' section`);
+	return checkNames.filter((name) => requested.includes(name));
+}
+/**
+* Run the enabled checks, or the enabled ones among `checks`, and return what they found. Sections not supplied in the options are loaded from `cwd` with `@exadev/config`.
+*
+* Violations do not throw. It throws `ConformanceError` when the checks cannot run (nothing enabled, a requested check disabled, a section missing) and `ConfigValidationError` when a section fails its schema, whether it was loaded from `cwd` or passed in.
+*/
+async function runChecks(options) {
+	const config = await conformanceOf(options);
+	const names = selected(config, options.checks);
+	const layout = await layoutOf(options, names.filter((name) => registry[name].requiresLayout));
+	const results = [];
+	for (const name of names) results.push({
+		check: name,
+		violations: await registry[name].run({
+			cwd: options.cwd,
+			checks: config.checks,
+			layout,
+			configFiles: options.configFiles
+		})
+	});
+	const violations = results.flatMap((result) => result.violations);
+	return {
+		results,
+		violations,
+		exitCode: violations.length === 0 ? EXIT_CODES.clean : EXIT_CODES.violations
+	};
+}
+//#endregion
+//#region src/cli-command.ts
+const USAGE = `Usage: workspace-conformance check [--cwd <directory>] [--check <name>]... [--list]
+
+Runs the conformance checks enabled in the 'conformance' section of exadev.config.ts (or exadev.conformance.config.ts).
+
+  --cwd <directory>   Directory that holds the config files. Defaults to the current directory.
+  --check <name>      Run only this check, which must be enabled. Repeatable.
+  --list              Print the names of all checks and stop.
+  --help, -h          Show this message.
+
+Exit status: ${String(EXIT_CODES.clean)} when nothing is found, ${String(EXIT_CODES.violations)} when a check finds a violation, ${String(EXIT_CODES.failed)} when the checks could not run.
+`;
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function formatViolation(violation) {
+	return `${violation.location === void 0 ? violation.file : `${violation.file}:${String(violation.location.line)}:${String(violation.location.column)}`}: ${violation.code}: ${violation.message}\n`;
+}
+function requestedChecks(names) {
+	return names.map((name) => {
+		if (!isCheckName(name)) throw new TypeError(`unknown check '${name}'; the checks are ${checkNames.join(", ")}`);
+		return name;
+	});
+}
+async function runCheck(args, output) {
+	const { values } = parseArgs({
+		args: [...args],
+		options: {
+			cwd: { type: "string" },
+			check: {
+				type: "string",
+				multiple: true
+			},
+			list: { type: "boolean" },
+			help: {
+				type: "boolean",
+				short: "h"
+			}
+		},
+		allowPositionals: false
+	});
+	if (values.help === true) {
+		output.stdout(USAGE);
+		return EXIT_CODES.clean;
+	}
+	const requested = values.check === void 0 ? void 0 : requestedChecks(values.check);
+	if (values.list === true) {
+		for (const name of checkNames) output.stdout(`${name}\t${registry[name].description}\n`);
+		return EXIT_CODES.clean;
+	}
+	const result = await runChecks({
+		cwd: resolve(values.cwd ?? process.cwd()),
+		...requested === void 0 ? {} : { checks: requested }
+	});
+	for (const violation of result.violations) output.stderr(formatViolation(violation));
+	if (result.violations.length === 0) output.stdout(`no violations from ${result.results.map((entry) => entry.check).join(", ")}\n`);
+	return result.exitCode;
+}
+/**
+* Run the `workspace-conformance` command with the arguments after the program name and return the exit code. A failure to run (missing or unknown command or option, unknown check, unloadable config) is reported on `stderr` and returns {@link EXIT_CODES}`.failed`.
+*/
+async function runCommand(args, output) {
+	try {
+		const [command, ...rest] = args;
+		if (command === "check") return await runCheck(rest, output);
+		if (command === "--help" || command === "-h" || command === "help") {
+			output.stdout(USAGE);
+			return EXIT_CODES.clean;
+		}
+		if (command === void 0) throw new TypeError(`missing command\n\n${USAGE}`);
+		throw new TypeError(`unknown command '${command}'\n\n${USAGE}`);
+	} catch (error) {
+		output.stderr(`${messageOf(error)}\n`);
+		return EXIT_CODES.failed;
+	}
+}
+//#endregion
+//#region src/closed-reader.ts
+/**
+* The `code` of the error a write fails with when the process reading the other end of the pipe has already exited, as `head` does after enough lines.
+*/
+const CLOSED_PIPE = "EPIPE";
+/**
+* Handle the failure of writes to `stream` after its reader has gone away: `onClosed` is called, and nothing is thrown, because the output has nowhere to go and is not an error of the checks. Any other stream error is rethrown, which fails the process.
+*/
+function onReaderClosed(stream, onClosed) {
+	stream.on("error", (error) => {
+		if (error.code !== CLOSED_PIPE) throw error;
+		onClosed();
+	});
+}
+//#endregion
+//#region src/cli.ts
+let undelivered = false;
+const markUndelivered = () => {
+	undelivered = true;
+	process.exitCode = EXIT_CODES.failed;
+};
+onReaderClosed(process.stdout, markUndelivered);
+onReaderClosed(process.stderr, markUndelivered);
+runCommand(process.argv.slice(2), {
+	stdout: (text) => {
+		process.stdout.write(text);
+	},
+	stderr: (text) => {
+		process.stderr.write(text);
+	}
+}).then((code) => {
+	process.exitCode = undelivered ? EXIT_CODES.failed : code;
+});
+//#endregion
+export {};