Combric Guard

Combric

Combric Guard is an optional static checker for an existing consumer project. It is published as @combric/guard@1.1.1. Combric components work without Guard.

Install the version corresponding to this documentation snapshot as a development dependency and run:

pnpm add --save-dev @combric/guard@1.1.1
pnpm exec combric-guard check
pnpm exec combric-guard check --json
pnpm exec combric-guard check --project ./my-app

The bare combric-guard command is the same as check. --help and --version do not require a project.

Output and CI

Human output lists each diagnostic as [severity] RULE_ID: path:line:column: message. JSON output is a single schema-version-1 object with projectRoot: ".", summary counts (errors, warnings, checkedFiles, checkedContracts), and a deterministic diagnostics array. File paths are project-relative. Each diagnostic has a stable ruleId, severity (pass, warning, or error), message, and, where applicable, file, line, and column.

• Exit 0: completed with no error-level violations; warnings are allowed.
• Exit 1: completed and found at least one error-level rule violation.
• Exit 2: could not complete, including unreadable/missing project, unsafe configured path, malformed package.json, or a bounded-scan limit.

For CI, run pnpm exec combric-guard check --json and preserve its exit code. Do not interpret a warning-only result as failure.

Checks

Guard reads package.json, optional combric.config.json schema 1, and bounded local CSS files. Zero-config projects are checked using declared Combric packages. A configured project additionally checks its selected mode and CSS entry.

Rule ID	Severity and contract
GUARD_CONFIG_SCHEMA	Error for unsupported or malformed config schema.
GUARD_CONFIG_UNKNOWN	Warning for unrecognized config fields.
GUARD_MANAGER_CONFLICT	Error when package-manager evidence conflicts with configuration.
GUARD_PACKAGE_MISSING	Error when a required package is not declared.
GUARD_REACT_VERSION, GUARD_TAILWIND_VERSION	Errors for unsupported React 19 or Tailwind >=4.3 <5 integrations.
GUARD_REACT_VERSION_UNKNOWN, GUARD_TAILWIND_VERSION_UNKNOWN	Warnings when an opaque version declaration cannot be checked statically.
GUARD_CSS_ENTRY, GUARD_CSS_IMPORT, GUARD_TAILWIND_IMPORT	Errors for an invalid CSS entry, missing public imports, or incorrect Tailwind import order.
GUARD_TOKEN_UNKNOWN	Error for unknown var(--combric-...) references not exported by @combric/tokens.
GUARD_NO_COMBRIC	Warning when no Combric package is declared.
GUARD_SCAN_SKIPPED, GUARD_SYMLINK_SKIPPED	Warnings when bounded traversal skips a deep directory or symlink.
GUARD_CONFIG, GUARD_PACKAGES, GUARD_CSS_READY, GUARD_TOKENS	Pass diagnostics for successfully checked contracts.

Pass diagnostics such as GUARD_PACKAGES, GUARD_CONFIG, GUARD_CSS_READY, and GUARD_TOKENS indicate checked contracts, not additional policy. Guard does not ban ordinary CSS literals such as #ffffff or 1rem, lint JSX/TSX, inspect generated/dependency directories, or enforce a generic design style.

Security and scope

Guard is read-only and offline. It does not import/evaluate consumer JavaScript or TypeScript, execute scripts, install packages, follow symlinks, modify files, or offer --fix. It skips common generated directories (.git, node_modules, dist, build, and related tool output). The scan is bounded: manifests are at most 1 MiB, config is at most 64 KiB, each CSS file is at most 1 MiB, traversal is limited to 2,000 directory entries and depth 8. Deeper directories and symlinks are skipped with warnings; unsafe core-file paths and exceeded hard limits fail operationally rather than being executed.

Guard is consumer-side validation. Repository maintainers separately run pnpm validate and package-boundary/packed-artifact checks. Guard is also not an accessibility audit. The accessibility guide explains the automated component regression matrix and the remaining application-level responsibilities.