@antelopejs/tooling-configs 0.2.1 → 0.2.3

package/dist/bin/sync.mjs

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
-import { a as formatCeilings, t as CEILINGS_FILE } from "../ceilings--pJmhSde.mjs";
-import { a as repositoryRoot, o as runCli } from "../files-Bocv-qA8.mjs";
-import { a as repositoryTools, i as parseManifest, n as managedPackage, o as toolingVersions, r as packageManager, t as execCommand } from "../package-B1aipTbn.mjs";
-import { t as measureBaseline } from "../ratchet-B2-4XxAl.mjs";
+import { a as formatCeilings, o as isRetired, s as readCeilings, t as CEILINGS_FILE } from "../ceilings-BSw9p4YB.mjs";
+import { i as repositoryRoot, u as runCli } from "../files-jKlueTMd.mjs";
+import { a as repositoryTools, i as parseManifest, n as managedPackage, o as toolingVersions, r as packageManager, t as execCommand } from "../package-Ckd7e4tA.mjs";
+import { t as measureBaseline } from "../ratchet-CNbpU42F.mjs";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+import { execFileSync } from "node:child_process";
 import { parseArgs } from "node:util";
 import { isMap, isScalar, isSeq, parseDocument } from "yaml";
 //#region src/guardrails/agents-block.ts
@@ -12,7 +13,11 @@ const AGENTS_BLOCK_START = "<!-- antelopejs-guardrails:start -->";
 const AGENTS_BLOCK_END = "<!-- antelopejs-guardrails:end -->";
 const COMMENTS = `### Comments
 
-Say it in code. A constraint belongs in a type, a lint rule, or a test. A public item's contract belongs in TSDoc (\`/** */\`) on that item. The only other comments are lint directives that name their rules, \`@ts-expect-error <reason>\`, \`SAFETY: <reason>\` above a type assertion, \`/*!\` license headers, and bundler or formatter directives.`;
+Say it in code. A constraint belongs in a type, a lint rule, or a test. A public item's contract belongs in TSDoc (\`/** */\`) on that item. The only other comments are lint directives that name their rules, \`@ts-expect-error <reason>\`, \`SAFETY: <reason>\` above a type assertion, \`/*!\` license headers, and bundler or formatter directives.
+
+Before suppressing a type rule, try inference or a type derived from its owner with \`Parameters\`, \`ReturnType\`, or indexed access. A private alias can still appear in a published declaration. Keep a suppression only after checking the published contract and the unchecked boundary it protects.
+
+Check each directive reason against the current line and its callers. Returning a value is not the same as awaiting and discarding it. A reason must describe what the code does now.`;
 const TESTS = `### Tests
 
 Hold every test you write or keep to this checklist:
@@ -20,6 +25,15 @@ Hold every test you write or keep to this checklist:
 - Name the wrong implementation this test fails on. A test with no answer is deleted, not kept.
 - No test reads the file it tests. Drive the behaviour through the public interface.
 - An invariant over many files is a lint rule, not a test.`;
+const CLEANUP_PROOF = `### Cleanup proof
+
+A behaviour-preserving cleanup PR shows \`antelopejs-api-diff <base-ref>\` passing. Published declarations and built runtime exports stay unchanged. A comment-only PR shows \`antelopejs-comment-proof <base-ref>\` passing instead of a verifier. Both compare committed HEAD.
+
+Copy counts from the proof's base and HEAD table. Never type counts by hand. Keep the command and the committed head beside the copied output. Directive lines are not individual suppressed rules.
+
+Pass \`--probe <file.cjs>\` to api-diff when changing receivers, positional calls, or modules that no published entry reaches. The same captured script runs against both worktree roots, supplied as \`argv[2]\`, and prints JSON observations. Matching metadata alone does not prove those behaviours.
+
+An entry-only rule exempts only its own module. Add a second module entry rather than exempting another importer. A no-upward rule must reject peers in the same tier as well as higher tiers. Probe the rank decision with an import, not just a reading of the configuration.`;
 const SHARED_RULES = [
 	["Formatting", "oxfmt"],
 	["Lint findings are errors; no rule warns", "oxlint preset"],
@@ -28,14 +42,20 @@ const SHARED_RULES = [
 	["Tests read no files outside fixtures, helpers, locales", "`antelopejs/no-fs-read-in-tests`"],
 	["No assertion that restates a constant", "`antelopejs/no-constant-value-assertion`"],
 	["No test whose only check is \"is a function\"", "`antelopejs/no-typeof-function-only-test`"],
-	["Params ≤ 5, function ≤ 120 lines, file ≤ 500 lines, depth ≤ 4, complexity ≤ 20", "`eslint/max-*`, `eslint/complexity`"]
+	["Params ≤ 5, function ≤ 120 lines, file ≤ 500 lines, depth ≤ 4, complexity ≤ 20", "`eslint/max-*`, `eslint/complexity`"],
+	["Cleanup preserves declarations and built runtime export metadata", "`antelopejs-api-diff <base-ref>`"],
+	["Comment-only changes preserve JavaScript emit", "`antelopejs-comment-proof <base-ref>`"],
+	["PR-body counts come from tracked code files", "api-diff and comment-proof tables"],
+	["Receiver, positional and unpublished-module behaviour", "`antelopejs-api-diff <base-ref> --probe <file.cjs>`"],
+	["Type suppressions and directive reasons are justified", "review; no tool"],
+	["No-upward rules reject same-tier peers", "review and import probes"]
 ];
 const FULL_RULES = [
 	["Files ≤ 20,000 bytes, tests included", "`antelopejs-check-size` (pre-commit)"],
-	["Existing debt only shrinks", "`antelopejs-ratchet`"],
 	["Types check", "`tsc` (pre-push)"],
 	["No dead files, exports, or dependencies", "knip"],
 	["Managed files match the pack", "`antelopejs-sync --check`"],
+	["Entry-only rules exempt no tracked outsider", "`antelopejs-sync --check`"],
 	["A test names the wrong implementation it catches", "review; no tool"]
 ];
 /** Pads each column the way oxfmt does, so formatting AGENTS.md never reports sync drift. */
@@ -62,7 +82,7 @@ function fullBody(context) {
 	return [
 		"## Guardrails",
 		"",
-		"Finish every change with `pnpm run checks`. It runs typecheck, lint, format, knip, tests, size, ratchet, and sync, and prints only what failed. The change is done when it prints no failure.",
+		`Finish every change with \`pnpm run checks\`. It runs typecheck, lint, format, knip, tests, size, ${context.ratchet ? "ratchet, " : ""}and sync, and prints only what failed. The change is done when it prints no failure.`,
 		"",
 		...pointers(context).flatMap((line) => [line, ""]),
 		"The tools enforce most rules, listed in the table at the end. The sections below hold the rules no tool checks.",
@@ -71,11 +91,19 @@ function fullBody(context) {
 		"",
 		TESTS,
 		"",
-		"### Debt",
+		CLEANUP_PROOF,
 		"",
-		"`guardrails.ratchet.json` records the lint findings and oversize files this repository already had. Its numbers only go down. After you remove debt, run `pnpm run ratchet:update` and commit the lowered file. A rule listed there is off for `oxlint`. The ratchet counts it instead, and the pre-commit hook rejects it on every line you add.",
-		"",
-		ruleTable([...SHARED_RULES, ...FULL_RULES])
+		...context.ratchet ? [
+			"### Debt",
+			"",
+			"`guardrails.ratchet.json` records the lint findings and oversize files this repository already had. Its numbers only go down. After you remove debt, run `pnpm run ratchet:update` and commit the lowered file. A rule listed there is off for `oxlint`. The ratchet counts it instead, and the pre-commit hook rejects it on every line you add.",
+			""
+		] : [],
+		ruleTable([
+			...SHARED_RULES,
+			...FULL_RULES,
+			...context.ratchet ? [["Existing debt only shrinks", "`antelopejs-ratchet`"]] : []
+		])
 	];
 }
 function templateBody(context) {
@@ -89,6 +117,8 @@ function templateBody(context) {
 		"",
 		TESTS,
 		"",
+		CLEANUP_PROOF,
+		"",
 		ruleTable(SHARED_RULES)
 	];
 }
@@ -140,7 +170,7 @@ function presetConfig(current, preset, tools) {
 	const importLine = preset.content.split("\n").filter((line) => line.includes(preset.specifier)).join("\n").replace(preset.specifier, target);
 	throw new Error(`${preset.path} does not import its preset. Add \`${importLine}\` and extend that preset, then rerun antelopejs-sync. The file was not replaced.`);
 }
-function lefthook(current, manager, tools) {
+function lefthook(current, manager, tools, ratchet = true) {
 	const exec = execCommand(manager);
 	const document = parseDocument(current ?? "{}\n");
 	if (document.errors.length) throw new Error(`lefthook.yml: ${document.errors.map(({ message }) => message).join("; ")}`);
@@ -176,6 +206,11 @@ function lefthook(current, manager, tools) {
 			key
 		], document.createNode(command));
 	}
+	if (!ratchet) document.deleteIn([
+		"pre-commit",
+		"commands",
+		"antelopejs-ratchet"
+	]);
 	return document.toString({ lineWidth: 0 });
 }
 const SETUP_SCRIPT = `#!/usr/bin/env bash
@@ -239,8 +274,79 @@ function hasChecksWorkflow(root) {
 	return false;
 }
 //#endregion
+//#region src/guardrails/entry-only.ts
+const LOAD_RULES = `
+const advisories = [];
+const rules = [];
+const SUPPORTED = { from: ["pathNot"], to: ["path", "pathNot"] };
+function patterns(value) {
+  if (value === undefined) return [];
+  const list = Array.isArray(value) ? value : [value];
+  if (list.some(pattern => typeof pattern !== "string")) return null;
+  try { list.forEach(pattern => new RegExp(pattern)); } catch { return null; }
+  return list;
+}
+function problem(rule) {
+  if (!rule.from || typeof rule.from !== "object" || !rule.to || typeof rule.to !== "object")
+    return "Warning: entry-only rule " + rule.name + " has no from and to selectors, so its exemptions cannot be checked.";
+  const unsupported = [
+    ...(rule.severity === "error" ? [] : ["severity " + String(rule.severity)]),
+    ...Object.keys(rule.from).filter(key => !SUPPORTED.from.includes(key)).map(key => "from." + key),
+    ...Object.keys(rule.to).filter(key => !SUPPORTED.to.includes(key)).map(key => "to." + key),
+  ];
+  if (unsupported.length)
+    return "Note: entry-only rule " + rule.name + " skipped, because its selectors are not supported (" + unsupported.join(", ") + "); only error rules built from from.pathNot and to.path or to.pathNot patterns are checked.";
+  if (rule.to.path === undefined)
+    return "Warning: entry-only rule " + rule.name + " has no to.path, so there is no module to exempt against.";
+  if (patterns(rule.from.pathNot) === null || !patterns(rule.to.path)?.length || patterns(rule.to.pathNot) === null)
+    return "Warning: entry-only rule " + rule.name + " has selectors that are not valid regular expression strings, so its exemptions cannot be checked.";
+  return undefined;
+}
+try {
+  const forbidden = require(process.cwd()+"/.dependency-cruiser.cjs").forbidden;
+  if (!Array.isArray(forbidden)) advisories.push("Warning: .dependency-cruiser.cjs has no forbidden rule array, so entry-only exemptions are not checked.");
+  else for (const rule of forbidden) {
+    if (!rule || typeof rule.name !== "string" || !rule.name.endsWith("-entry-only")) continue;
+    const advisory = problem(rule);
+    if (advisory === undefined) rules.push({ name: rule.name, exempt: patterns(rule.from.pathNot), domain: patterns(rule.to.path) });
+    else advisories.push(advisory);
+  }
+} catch (error) {
+  advisories.push("Warning: .dependency-cruiser.cjs could not be loaded, so entry-only exemptions are not checked (" + String(error && error.message) + ").");
+}
+process.stdout.write(JSON.stringify({ rules, advisories }));
+`;
+function matcher(patterns) {
+	return patterns.map((pattern) => new RegExp(pattern));
+}
+/** Rejects tracked importers exempted from another module's entry-only boundary. A rule it cannot interpret yields a printed note or warning in `advisories` and never a failure. */
+function checkEntryOnlyConfiguration(root) {
+	if (!existsSync(join(root, ".dependency-cruiser.cjs"))) return {
+		errors: [],
+		advisories: []
+	};
+	const { rules, advisories } = JSON.parse(execFileSync(process.execPath, ["-e", LOAD_RULES], {
+		cwd: root,
+		encoding: "utf8",
+		timeout: 1e4
+	}));
+	const paths = execFileSync("git", ["ls-files", "-z"], {
+		cwd: root,
+		encoding: "utf8"
+	}).split("\0").filter(Boolean);
+	return {
+		errors: rules.flatMap((rule) => {
+			const domain = matcher(rule.domain);
+			const exemption = matcher(rule.exempt);
+			return paths.filter((path) => exemption.some((pattern) => pattern.test(path)) && !domain.some((pattern) => pattern.test(path))).map((path) => `${rule.name} exempts ${path} outside its module; give the module a second entry instead`);
+		}),
+		advisories
+	};
+}
+//#endregion
 //#region src/guardrails/sync.ts
 const LEGACY_COMMENT_INSTRUCTION = "- Explain non-obvious constraints and decisions in comments; avoid restating the code. Document public contracts with TSDoc.";
+const RETIRED_RATCHET = `${CEILINGS_FILE} has no debt left. Run ratchet:update to delete it, then run antelopejs-sync.`;
 function managedAgents(current = "", context) {
 	const start = current.indexOf(AGENTS_BLOCK_START);
 	const end = current.indexOf(AGENTS_BLOCK_END);
@@ -273,7 +379,7 @@ const MANAGED_ARTIFACTS = [
 		path: "lefthook.yml",
 		profiles: ["full"],
 		desired: (current, context) => ({
-			content: lefthook(current, context.manager, context.tools),
+			content: lefthook(current, context.manager, context.tools, context.ratchet),
 			notes: []
 		})
 	},
@@ -333,6 +439,7 @@ function planSync(current, modes, context) {
 	});
 	for (const artifact of MANAGED_ARTIFACTS) {
 		if (!artifact.profiles.includes(context.profile)) continue;
+		if (artifact.path === "guardrails.ratchet.json" && !context.ratchet) continue;
 		try {
 			const { content, notes } = artifact.desired(current.get(artifact.path), context);
 			const changed = current.get(artifact.path) !== content || artifact.mode !== void 0 && (artifact.mode & 73) !== 0 && ((modes.get(artifact.path) ?? 0) & 73) === 0;
@@ -407,6 +514,7 @@ function repositoryContext(root, current, profile) {
 	const desiredLint = current.get(lint.path) ?? lint.content;
 	return {
 		profile,
+		ratchet: current.has(CEILINGS_FILE),
 		manager: packageManager(manifest),
 		versions: toolingVersions(),
 		tools: repositoryTools(manifest),
@@ -427,6 +535,13 @@ function writeArtifacts(root, artifacts) {
 		if (artifact.mode !== void 0) chmodSync(path, artifact.mode);
 	}
 }
+function repositoryNotices(root, context) {
+	const notices = [];
+	if (context.profile === "full" && !hasChecksWorkflow(root)) notices.push(MISSING_CHECKS_WORKFLOW);
+	if (context.ratchet && isRetired(readCeilings(root))) notices.push(RETIRED_RATCHET);
+	return notices;
+}
+/** Measures debt only on first adoption, before sync has written the sync:check script; retired repositories stay retired. */
 function syncRepository(root, options = {}) {
 	const profile = options.profile ?? "full";
 	const { current, modes } = repositorySnapshot(root);
@@ -434,15 +549,16 @@ function syncRepository(root, options = {}) {
 	const context = repositoryContext(root, current, profile);
 	let plan = planSync(current, modes, context);
 	const errors = plan.filter((artifact) => artifact.kind === "error").map(({ message }) => message);
+	const entryOnly = checkEntryOnlyConfiguration(root);
+	errors.push(...entryOnly.errors);
 	const notes = plan.flatMap((artifact) => artifact.kind === "migrated" ? artifact.notes : []);
-	if (profile === "full" && !hasChecksWorkflow(root)) {
-		if (options.check) errors.push(MISSING_CHECKS_WORKFLOW);
-		else notes.push(MISSING_CHECKS_WORKFLOW);
-	}
-	if (!errors.length && profile === "full" && !options.check && !current.has("guardrails.ratchet.json")) {
+	(options.check ? errors : notes).push(...repositoryNotices(root, context));
+	if (!errors.length && profile === "full" && !options.check && !current.has("guardrails.ratchet.json") && manifest.scripts?.["sync:check"] === void 0) {
 		const lint = PRESET_CONFIGS[0];
 		const desired = presetConfig(current.get(lint.path), lint, context.tools);
-		context.baseline = formatCeilings(measureBaseline(root, desired === current.get(lint.path) ? void 0 : desired));
+		const baseline = measureBaseline(root, desired === current.get(lint.path) ? void 0 : desired);
+		context.ratchet = !isRetired(baseline);
+		context.baseline = formatCeilings(baseline);
 		plan = planSync(current, modes, context);
 	}
 	const writes = plan.filter((artifact) => artifact.kind === "write" || artifact.kind === "migrated");
@@ -455,6 +571,7 @@ function syncRepository(root, options = {}) {
 		paths: errors.length ? [] : writes.map(({ path }) => path),
 		errors,
 		notes,
+		advisories: entryOnly.advisories,
 		dependenciesAdded
 	};
 }
@@ -474,6 +591,7 @@ runCli(() => {
 		profile: values.profile
 	});
 	for (const note of result.notes) process.stdout.write(`Note: ${values.check || result.errors.length ? "Planned migration. " : ""}${note}\n`);
+	for (const advisory of result.advisories) process.stdout.write(`${advisory}\n`);
 	for (const error of result.errors) process.stderr.write(`${error}\n`);
 	if (result.errors.length) return 1;
 	for (const path of result.paths) process.stdout.write(`${values.check ? "Drift" : "Updated"}: ${path}${values.check ? "; run antelopejs-sync" : ""}\n`);

package/dist/{ceilings--pJmhSde.mjs → ceilings-BSw9p4YB.mjs}

@@ -14,6 +14,10 @@ const EMPTY_CEILINGS = {
 	rules: {},
 	oversizeFiles: {}
 };
+/** A repository retires its ratchet once no lint or file debt remains. */
+function isRetired(ceilings) {
+	return Object.values(ceilings.rules).every((count) => count === 0) && Object.keys(ceilings.oversizeFiles).length === 0;
+}
 /** Finds the nearest git directory or worktree marker, falling back to cwd outside git. */
 function findGitRoot(cwd = process.cwd()) {
 	let directory = resolve(cwd);
@@ -61,4 +65,4 @@ function formatCeilings(ceilings) {
 	return `${JSON.stringify(sorted, null, 2)}\n`;
 }
 //#endregion
-export { formatCeilings as a, findGitRoot as i, MAX_FILE_BYTES as n, readCeilings as o, MEASURE_ENV as r, CEILINGS_FILE as t };
+export { formatCeilings as a, findGitRoot as i, MAX_FILE_BYTES as n, isRetired as o, MEASURE_ENV as r, readCeilings as s, CEILINGS_FILE as t };

package/dist/files-jKlueTMd.mjs

@@ -0,0 +1,298 @@
+import "./ceilings-BSw9p4YB.mjs";
+import { n as IGNORE_PATTERNS, t as AGENT_IGNORE_PATTERNS } from "./shared-CsXIMK3I.mjs";
+import { closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readSync, rmSync, symlinkSync } from "node:fs";
+import { dirname, join, matchesGlob, relative, resolve } from "node:path";
+import { execFileSync, spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+//#region src/guardrails/cli.ts
+function runCli(main) {
+	try {
+		process.exitCode = main();
+	} catch (error) {
+		process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+		process.exitCode = 1;
+	}
+}
+//#endregion
+//#region src/guardrails/revisions.ts
+function trackedManifests(root) {
+	return execFileSync("git", ["ls-files", "-z"], {
+		cwd: root,
+		encoding: "utf8"
+	}).split("\0").filter((file) => file === "package.json" || file.endsWith("/package.json"));
+}
+const DIRECTORY_LINK = process.platform === "win32" ? "junction" : "dir";
+function linkDependencies(root, worktree) {
+	const directories = /* @__PURE__ */ new Set([".", ...trackedManifests(root).map(dirname)]);
+	for (const directory of directories) {
+		const source = join(root, directory, "node_modules");
+		const target = join(worktree, directory, "node_modules");
+		if (existsSync(source) && existsSync(dirname(target)) && !existsSync(target)) symlinkSync(source, target, DIRECTORY_LINK);
+	}
+}
+/** Compares isolated committed revisions and removes both worktrees even when compilation fails. */
+function compareRevisions(root, baseRef, label, emit) {
+	const temporary = mkdtempSync(join(tmpdir(), "antelope-proof-"));
+	const worktrees = [];
+	const results = [];
+	try {
+		for (const [side, ref] of [["base", baseRef], ["head", "HEAD"]]) {
+			const revision = execFileSync("git", [
+				"rev-parse",
+				"--verify",
+				"--end-of-options",
+				`${ref}^{commit}`
+			], {
+				cwd: root,
+				encoding: "utf8",
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				]
+			}).trim();
+			const worktree = join(temporary, "worktrees", side);
+			execFileSync("git", [
+				"worktree",
+				"add",
+				"--quiet",
+				"--detach",
+				worktree,
+				revision
+			], {
+				cwd: root,
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				]
+			});
+			worktrees.push(worktree);
+			linkDependencies(root, worktree);
+			const output = join(temporary, side);
+			mkdirSync(output, { recursive: true });
+			results.push(emit(worktree, output, join(temporary, "emit", side)));
+		}
+		const diff = spawnSync("git", [
+			"diff",
+			"--no-index",
+			"--no-color",
+			"--no-renames",
+			"--no-ext-diff",
+			"--no-textconv",
+			"--",
+			"base",
+			"head"
+		], {
+			cwd: temporary,
+			encoding: "utf8",
+			maxBuffer: 67108864
+		});
+		if (diff.error) throw diff.error;
+		if (diff.status !== 0 && diff.status !== 1) throw new Error(diff.stderr || "Could not compare revision outputs.");
+		const packages = new Set(results.flatMap((result) => result.packages)).size;
+		return {
+			different: diff.status === 1,
+			output: diff.status === 1 ? `${label}: differences against ${baseRef} (committed HEAD).\n${diff.stdout}` : `${label}: ${packages} packages, ${results[1].entries} entries unchanged against ${baseRef} (committed HEAD).\n`
+		};
+	} finally {
+		for (const worktree of worktrees.reverse()) execFileSync("git", [
+			"worktree",
+			"remove",
+			"--force",
+			worktree
+		], {
+			cwd: root,
+			stdio: "pipe"
+		});
+		rmSync(temporary, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+const COUNTS = [
+	["oxlint-disable / eslint-disable directive lines", /^\s*(?:\/\/|\/\*|\*)\s*(?:oxlint|eslint)-disable\b/u],
+	["SAFETY: lines", /^\s*(?:\/\/|\/\*|\*)\s*SAFETY:/u],
+	["@ts-expect-error lines", /^\s*(?:\/\/|\/\*|\*)\s*@ts-expect-error\b/u]
+];
+const CODE_PATHSPECS = [
+	"*.ts",
+	"*.tsx",
+	"*.mts",
+	"*.cts",
+	"*.js",
+	"*.jsx",
+	"*.mjs",
+	"*.cjs",
+	"*.vue"
+];
+function countsAt(root, ref) {
+	const result = spawnSync("git", [
+		"grep",
+		"-h",
+		"-I",
+		"-E",
+		"-e",
+		"(oxlint|eslint)-disable|SAFETY:|@ts-expect-error",
+		ref,
+		"--",
+		...CODE_PATHSPECS
+	], {
+		cwd: root,
+		encoding: "utf8",
+		maxBuffer: 67108864
+	});
+	if (result.error) throw result.error;
+	if (result.status !== 0 && result.status !== 1) throw new Error(result.stderr);
+	const lines = result.stdout.split("\n");
+	return COUNTS.map(([, pattern]) => lines.filter((line) => pattern.test(line)).length);
+}
+/** Counts directive, `SAFETY:` and `@ts-expect-error` lines in every tracked code file at the base and at committed HEAD, so a PR body copies them instead of typing them. */
+function revisionCounts(root, baseRef) {
+	const base = countsAt(root, baseRef);
+	const head = countsAt(root, "HEAD");
+	return `\nCounts in tracked code files (${baseRef} and committed HEAD).\n| Lines | base | HEAD |\n| --- | ---: | ---: |\n${COUNTS.map(([label], index) => `| ${label} | ${base[index]} | ${head[index]} |`).join("\n")}\n`;
+}
+//#endregion
+//#region src/guardrails/files.ts
+const SIZE_EXCLUSIONS = [
+	{
+		kind: "generated",
+		patterns: [
+			...IGNORE_PATTERNS,
+			...AGENT_IGNORE_PATTERNS,
+			"**/*.generated.*",
+			"**/generated/**",
+			"**/__snapshots__/**"
+		]
+	},
+	{
+		kind: "fixtures",
+		patterns: ["**/fixtures/**", "**/__fixtures__/**"]
+	},
+	{
+		kind: "data",
+		patterns: [
+			"**/locales/**/*.json",
+			"**/i18n/**/*.json",
+			"**/blocks.json",
+			"**/schema.json",
+			"**/evals/**/cases.json"
+		]
+	},
+	{
+		kind: "lockfiles",
+		patterns: [
+			"**/{pnpm-lock.yaml,package-lock.json,npm-shrinkwrap.json,yarn.lock,bun.lock,bun.lockb,Cargo.lock,poetry.lock,uv.lock,Gemfile.lock,composer.lock,go.sum}",
+			"**/*.lock",
+			"**/*.lockb"
+		]
+	},
+	{
+		kind: "documentation",
+		patterns: ["**/CHANGELOG.md", "**/*.{md,mdx,markdown,MD}"]
+	},
+	{
+		kind: "assets",
+		patterns: ["**/*.{png,jpg,jpeg,gif,webp,avif,ico,svg,bmp,tiff,pdf,mp3,wav,ogg,flac,mp4,webm,mov,avi,woff,woff2,ttf,otf,eot,zip,gz,tgz,bz2,xz,7z,tar,rar,wasm,bin,exe,dll,so,dylib,db,sqlite,sqlite3,icns}"]
+	}
+];
+function gitFiles(root) {
+	return [...new Set(execFileSync("git", [
+		"ls-files",
+		"--cached",
+		"--others",
+		"--exclude-standard",
+		"-z"
+	], {
+		cwd: root,
+		encoding: "utf8"
+	}).split("\0").filter(Boolean))];
+}
+function repositoryRoot(cwd = process.cwd()) {
+	return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+		cwd,
+		encoding: "utf8"
+	}).trim();
+}
+/** Resolves a user-supplied revision to a commit id, so it can never read as an option. */
+function resolveRevision(root, revision) {
+	return execFileSync("git", [
+		"rev-parse",
+		"--verify",
+		"--end-of-options",
+		`${revision}^{commit}`
+	], {
+		cwd: root,
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	}).trim();
+}
+function repositoryPath(root, file) {
+	return relative(root, resolve(root, file)).split("\\").join("/");
+}
+function fileBytes(root, file, staged = false) {
+	if (staged) {
+		const result = spawnSync("git", [
+			"cat-file",
+			"-s",
+			`:${file}`
+		], {
+			cwd: root,
+			encoding: "utf8"
+		});
+		if (result.error) throw result.error;
+		return result.status === 0 ? Number(result.stdout.trim()) : void 0;
+	}
+	const path = join(root, file);
+	if (!existsSync(path)) return void 0;
+	const stat = lstatSync(path);
+	return stat.isFile() ? stat.size : void 0;
+}
+/** A package root is the directory of a tracked manifest outside every `src` directory; its top-level `build` and `output` are generated output. */
+function packageOutputPatterns(root) {
+	return trackedManifests(root).flatMap((manifest) => {
+		const directory = dirname(manifest);
+		if (directory === "." || directory.split("/").includes("src")) return [];
+		return [`${directory}/build/**`, `${directory}/output/**`];
+	});
+}
+/** `path.matchesGlob` never lets `*` or `**` cross a segment starting with a dot, so each path is also tried with those dots removed. */
+function isExcluded(file, packageOutputs) {
+	const undotted = file.replace(/(^|\/)\./gu, "$1");
+	const matches = (pattern) => matchesGlob(file, pattern) || matchesGlob(undotted, pattern);
+	return SIZE_EXCLUSIONS.some(({ patterns }) => patterns.some(matches)) || packageOutputs.some(matches);
+}
+function isBinary(root, file, staged) {
+	if (staged) return execFileSync("git", ["show", `:${file}`], {
+		cwd: root,
+		maxBuffer: fileBytes(root, file, true)
+	}).subarray(0, 8e3).includes(0);
+	const descriptor = openSync(join(root, file), "r");
+	try {
+		const prefix = Buffer.alloc(8e3);
+		const length = readSync(descriptor, prefix, 0, prefix.length, 0);
+		return prefix.subarray(0, length).includes(0);
+	} finally {
+		closeSync(descriptor);
+	}
+}
+function authoredSizes(root, files = gitFiles(root), staged = false) {
+	const sizes = /* @__PURE__ */ new Map();
+	const packageOutputs = packageOutputPatterns(root);
+	for (const input of files) {
+		const file = repositoryPath(root, input);
+		if (isExcluded(file, packageOutputs)) continue;
+		const size = fileBytes(root, file, staged);
+		if (size !== void 0 && size > 2e4 && isBinary(root, file, staged)) continue;
+		if (size !== void 0) sizes.set(file, size);
+	}
+	return sizes;
+}
+//#endregion
+export { resolveRevision as a, revisionCounts as c, repositoryRoot as i, trackedManifests as l, gitFiles as n, DIRECTORY_LINK as o, repositoryPath as r, compareRevisions as s, authoredSizes as t, runCli as u };

package/dist/oxc/fmt.mjs

@@ -1,4 +1,4 @@
-import { n as IGNORE_PATTERNS, t as AGENT_IGNORE_PATTERNS } from "../shared-NC0T8ykm.mjs";
+import { n as IGNORE_PATTERNS, t as AGENT_IGNORE_PATTERNS } from "../shared-CsXIMK3I.mjs";
 import { defineConfig } from "oxfmt";
 //#region src/oxc/fmt.ts
 /**

package/dist/oxc/lint.mjs

@@ -1,6 +1,7 @@
-import { i as findGitRoot, o as readCeilings } from "../ceilings--pJmhSde.mjs";
+import { i as findGitRoot } from "../ceilings-BSw9p4YB.mjs";
+import { t as readCarriedCeilings } from "../renames-BGO4dWJ8.mjs";
 import { n as TEST_FILE_GLOBS, t as ASSERTION_FUNCTION_NAMES } from "../shared-WC0z3y9F.mjs";
-import { n as IGNORE_PATTERNS, t as AGENT_IGNORE_PATTERNS } from "../shared-NC0T8ykm.mjs";
+import { n as IGNORE_PATTERNS, t as AGENT_IGNORE_PATTERNS } from "../shared-CsXIMK3I.mjs";
 import { defineConfig } from "oxlint";
 //#region src/oxc/lint.ts
 /**
@@ -179,7 +180,7 @@ function importSortingPreset() {
 /** Overrides run after rules, including test-specific rules; measurement bypasses all ceilings. */
 function ratchetOverrides() {
 	if (process.env["ANTELOPEJS_RATCHET_MEASURE"] !== void 0) return [];
-	const ceilings = readCeilings(findGitRoot());
+	const ceilings = readCarriedCeilings(findGitRoot());
 	const rules = Object.fromEntries(Object.keys(ceilings.rules).map((rule) => [rule, "off"]));
 	return [...Object.keys(ceilings.oversizeFiles).map((path) => ({
 		files: [path.replaceAll(/([*?[\]{}])/gu, "\\$1")],

package/dist/{package-B1aipTbn.mjs → package-Ckd7e4tA.mjs}

@@ -101,6 +101,10 @@ function managedPackage(current, versions, options = {}) {
 		"ratchet:update": `${tools.commands.ratchet} --update`,
 		"sync:check": `${tools.commands.sync} --check`
 	});
+	if (options.ratchet === false) {
+		delete scripts.ratchet;
+		delete scripts["ratchet:update"];
+	}
 	for (const [name, command] of Object.entries(DEFAULT_SCRIPTS)) scripts[name] ??= name === "typecheck" && options.nuxt ? "nuxi typecheck" : command;
 	const dependencies = manifest.devDependencies ??= {};
 	dependencies.lefthook ??= versions.lefthook;