@antelopejs/tooling-configs 0.2.2 → 0.2.3

package/README.md

@@ -173,7 +173,7 @@ pnpm install
 ```
 
 - A rule listed under `rules` is off for `oxlint`, so editors, hooks and `lint` stay green. `antelopejs-ratchet` counts it with every rule on, and fails when a count rises. It prints the findings in the files the change touched.
-- A file listed under `oversizeFiles` may exceed 20,000 bytes and `max-lines`, up to its recorded size. Any other file over either limit fails.
+- A file listed under `oversizeFiles` may exceed 20,000 bytes and `max-lines`, up to its recorded size. Any other file over either limit fails. When git sees a listed file renamed (`git mv`, or a staged delete and add), the allowance moves to the new path and never exceeds the old one; a copy or a new file inherits nothing. `antelopejs-ratchet --base <ref>` detects renames against that revision instead of `HEAD`, for a rename that was committed before the file was updated.
 - `antelopejs-ratchet --update` lowers each number to the current count and removes what reached zero. It never raises a number or adds an entry. Commit the lowered file.
 
 When every rule count is zero and `oversizeFiles` is empty, the ratchet is retired. `antelopejs-ratchet --update` deletes the file and asks you to run `antelopejs-sync`. Sync then removes `ratchet`, `ratchet:update`, the ratchet hook and the Debt instructions. Commit those changes together. An empty baseline on first adoption creates no file. Later syncs never recreate it because the `sync:check` script marks adoption.
@@ -182,7 +182,7 @@ When every rule count is zero and `oversizeFiles` is empty, the ratchet is retir
 
 ### Size
 
-`antelopejs-check-size` fails on an authored file over 20,000 bytes, tests included. Generated code, fixtures, lockfiles, `CHANGELOG.md`, Markdown and binary assets are excluded. Data JSON under `locales/` or `i18n/`, `blocks.json`, `schema.json`, and `evals/**/cases.json` are excluded too. Files over the limit with a NUL byte in their first 8,000 bytes are binary even without a known extension. Staged checks inspect the index blob. Excluded files are also removed from recorded size allowances on ratchet update.
+`antelopejs-check-size` fails on an authored file over 20,000 bytes, tests included. Generated code (`dist`, `coverage`, `.nuxt`, `.output`, and `build` or `output` at the repository root or a package root, never under `src/` or `test/`), fixtures, lockfiles, `CHANGELOG.md`, Markdown and binary assets are excluded. Data JSON under `locales/` or `i18n/`, `blocks.json`, `schema.json`, and `evals/**/cases.json` are excluded too. Files over the limit with a NUL byte in their first 8,000 bytes are binary even without a known extension. Staged checks inspect the index blob. Excluded files are also removed from recorded size allowances on ratchet update.
 
 Pass paths to check only those files, as the pre-commit hook does. The command also fails on an `oxlint-disable` or `eslint-disable` directive (line, next-line or file form) that names no rule: oxlint applies such a directive before any rule runs, so `no-comments` cannot report it.
 

package/dist/bin/api-diff.mjs

@@ -1,9 +1,190 @@
 #!/usr/bin/env node
-import { a as runCli, i as repositoryRoot } from "../files-DAD5OtfV.mjs";
-import { i as compareRevisions, n as isTestSource, r as packagesAt, t as emitPackage } from "../typescript-CHOlkIXa.mjs";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from "node:fs";
+import { c as revisionCounts, i as repositoryRoot, o as DIRECTORY_LINK, s as compareRevisions, u as runCli } from "../files-jKlueTMd.mjs";
+import { i as parseManifest, r as packageManager } from "../package-Ckd7e4tA.mjs";
+import { i as packagesAt, n as isTestSource, r as outputRoot, t as emitPackage } from "../typescript-aLCrMi2y.mjs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
+import { execFileSync, spawnSync } from "node:child_process";
 import { generateDtsBundle } from "dts-bundle-generator";
+//#region src/guardrails/runtime-diff.ts
+const DESCRIBE = `
+const { readFileSync, existsSync } = require("node:fs");
+const { dirname, join, extname } = require("node:path");
+const { pathToFileURL } = require("node:url");
+const file = process.argv[1];
+let directory = dirname(file);
+while (!existsSync(join(directory, "package.json")) && dirname(directory) !== directory) directory = dirname(directory);
+const manifest = existsSync(join(directory, "package.json")) ? JSON.parse(readFileSync(join(directory, "package.json"), "utf8")) : {};
+const esm = extname(file) === ".mjs" || (extname(file) === ".js" && manifest.type === "module");
+const seen = new Map();
+function functionInfo(fn) {
+  let constructible = true;
+  try { Reflect.construct(Object, [], fn); } catch { constructible = false; }
+  return { name: fn.name, length: fn.length, async: Object.getPrototypeOf(fn) === Object.getPrototypeOf(async function() {}), constructible };
+}
+function valueInfo(value) {
+  if (typeof value !== "function") return { kind: value === null ? "null" : typeof value };
+  if (seen.has(value)) return { kind: "reference", id: seen.get(value) };
+  const id = seen.size;
+  seen.set(value, id);
+  return { kind: "function", id, function: functionInfo(value), static: properties(value, false), prototype: value.prototype ? properties(value.prototype, false) : [] };
+}
+function properties(object, observe) {
+  if (object === null || !["object", "function"].includes(typeof object)) return [];
+  return Reflect.ownKeys(object).map(key => {
+    const d = Object.getOwnPropertyDescriptor(object, key);
+    const common = { key: typeof key === "symbol" ? { symbol: String(key) } : key, enumerable: d.enumerable, configurable: d.configurable };
+    return "value" in d
+      ? { ...common, kind: "data", writable: d.writable, value: valueInfo(d.value) }
+      : { ...common, kind: "accessor", get: d.get ? functionInfo(d.get) : null, set: d.set ? functionInfo(d.set) : null, observed: observe ? valueInfo(Reflect.get(object, key)) : null };
+  });
+}
+(async () => {
+  const value = esm ? await import(pathToFileURL(file).href) : require(file);
+  process.stdout.write(JSON.stringify({ kind: esm ? "esm" : "cjs", value: valueInfo(value), properties: typeof value === "function" ? [] : properties(value, true) }));
+})().catch(error => { process.stderr.write(String(error.stack)); process.exitCode = 1; });
+`;
+function runtimeTargets(target, entry = "exports") {
+	if (target == null) return [];
+	if (Array.isArray(target)) return target.flatMap((value, index) => runtimeTargets(value, `${entry}/${index}`));
+	if (target.constructor === String) return [{
+		entry,
+		target: String(target)
+	}];
+	return Object.entries(target).flatMap(([key, value]) => {
+		if (key === "types") return [];
+		if ([
+			"browser",
+			"deno",
+			"react-native"
+		].includes(key)) throw new Error(`${entry}/${key}: unsupported runtime environment.`);
+		return runtimeTargets(value, `${entry}/${key}`);
+	});
+}
+function builtEntries(directory, manifest) {
+	const targets = runtimeTargets(manifest.exports);
+	if (manifest.main) targets.push({
+		entry: "main",
+		target: manifest.main
+	});
+	if (!targets.length) throw new Error(`${directory}: no published runtime entry.`);
+	return targets.filter(({ target }) => !target.endsWith(".json")).flatMap(({ entry, target }) => {
+		if (!target.includes("*")) {
+			const file = resolve(directory, target);
+			if (!existsSync(file)) throw new Error(`${directory}: missing built runtime entry ${target}.`);
+			return [{
+				entry,
+				file
+			}];
+		}
+		const prefix = resolve(directory, target.slice(0, target.indexOf("*")));
+		const parent = dirname(prefix);
+		const pattern = new RegExp(`^${resolve(directory, target).split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")).join("(.*)")}$`, "u");
+		if (!existsSync(parent)) throw new Error(`${directory}: missing build output for ${target}.`);
+		const output = outputRoot(directory);
+		const matches = readdirSync(parent, {
+			recursive: true,
+			withFileTypes: true
+		}).filter((file) => file.isFile()).map((file) => join(file.parentPath, file.name)).filter((file) => pattern.test(file) && !isTestSource(output, file));
+		if (!matches.length) throw new Error(`${directory}: missing built runtime entry ${target}.`);
+		return matches.sort().map((file) => {
+			const capture = pattern.exec(file)?.[1] ?? relative(directory, file);
+			return {
+				entry: entry.replaceAll("*", capture),
+				file
+			};
+		});
+	});
+}
+function childJson(args, cwd) {
+	const result = spawnSync(process.execPath, args, {
+		cwd,
+		encoding: "utf8",
+		timeout: 1e4,
+		maxBuffer: 16777216,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	if (result.error) throw result.error;
+	if (result.status !== 0) throw new Error(result.stderr || `Runtime child exited with ${result.status ?? result.signal}.`);
+	return `${JSON.stringify(JSON.parse(result.stdout), null, 2)}\n`;
+}
+function buildPackage(directory, output, manifest) {
+	const buildManifest = parseManifest(readFileSync(join(directory, "package.json"), "utf8"));
+	if (buildManifest.scripts?.build) execFileSync(packageManager(buildManifest), ["run", "build"], {
+		cwd: directory,
+		encoding: "utf8",
+		shell: process.platform === "win32",
+		env: {
+			...process.env,
+			pnpm_config_verify_deps_before_run: "false"
+		},
+		timeout: 12e4,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	let entries;
+	try {
+		entries = builtEntries(directory, manifest);
+	} catch (error) {
+		if (buildManifest.scripts?.build) throw error;
+		return;
+	}
+	for (const { entry, file } of entries) {
+		const destination = join(output, `${encodeURIComponent(entry)}.json`);
+		const metadata = childJson([
+			"-e",
+			DESCRIBE,
+			file
+		], directory);
+		mkdirSync(dirname(destination), { recursive: true });
+		writeFileSync(destination, metadata);
+	}
+	return entries.length;
+}
+/** Builds both committed revisions and compares published runtime metadata and one captured optional probe. */
+function runtimeDiff(root, baseRef, probe) {
+	const errors = [];
+	const failedPackages = /* @__PURE__ */ new Set();
+	const skippedPackages = /* @__PURE__ */ new Set();
+	const result = compareRevisions(root, baseRef, "Runtime API", (worktree, output, scratch) => {
+		const packages = packagesAt(worktree, true);
+		let entries = 0;
+		for (const { directory, manifest } of packages) try {
+			const built = buildPackage(join(worktree, directory), join(output, encodeURIComponent(directory).replaceAll(".", "%2E")), manifest);
+			if (built === void 0) skippedPackages.add(directory);
+			else entries += built;
+		} catch (error) {
+			failedPackages.add(directory);
+			errors.push(`Execution error: ${directory}: ${error instanceof Error ? error.message : String(error)}\n`);
+		}
+		for (const directory of failedPackages) for (const side of ["base", "head"]) rmSync(join(dirname(output), side, encodeURIComponent(directory).replaceAll(".", "%2E")), {
+			recursive: true,
+			force: true
+		});
+		if (probe !== void 0) {
+			mkdirSync(scratch, { recursive: true });
+			const script = join(scratch, "probe.cjs");
+			writeFileSync(script, probe);
+			writeFileSync(join(output, "probe.json"), childJson([script, worktree], worktree));
+		}
+		return {
+			packages: packages.map(({ directory }) => directory),
+			entries
+		};
+	});
+	return {
+		different: result.different || errors.length > 0,
+		output: (errors.length && !result.different ? result.output.replace(/^Runtime API:[^\n]*\n/u, "Runtime API: comparison incomplete due to execution errors.\n") : result.output) + [...skippedPackages].map((directory) => `Runtime API: skipped ${directory}, which has no build script and no committed runtime entry.\n`).join("") + errors.join("")
+	};
+}
+//#endregion
 //#region src/guardrails/api-diff.ts
 function entrySegment(value) {
 	return encodeURIComponent(value).replaceAll(".", "%2E").replaceAll("*", "%2A");
@@ -99,7 +280,7 @@ function bundleDependencies(directory, scratch) {
 		if (parent === current) return;
 		current = parent;
 	}
-	symlinkSync(join(current, "node_modules"), join(scratch, "node_modules"), "dir");
+	symlinkSync(join(current, "node_modules"), join(scratch, "node_modules"), DIRECTORY_LINK);
 }
 /** dts-bundle-generator 9 remaps a .d.mts/.d.cts root twice; a source-named copy preserves its declaration text. */
 function generatorEntry(file) {
@@ -140,8 +321,7 @@ function bundlePackage(directory, output, scratch, manifest) {
 	}
 	return entries.length;
 }
-/** Proves published declarations match between a base commit and committed HEAD. */
-function apiDiff(root, baseRef) {
+function declarationDiff(root, baseRef) {
 	return compareRevisions(root, baseRef, "API", (worktree, output, scratch) => {
 		const packages = packagesAt(worktree, true);
 		let entries = 0;
@@ -152,12 +332,27 @@ function apiDiff(root, baseRef) {
 		};
 	});
 }
+/** Compares declarations and built runtime exports, with an optional behavioral probe captured before either build. */
+function apiDiff(root, baseRef, probeFile) {
+	const probe = probeFile === void 0 ? void 0 : readFileSync(resolve(root, probeFile));
+	const results = [];
+	const errors = [];
+	for (const compare of [() => declarationDiff(root, baseRef), () => runtimeDiff(root, baseRef, probe)]) try {
+		results.push(compare());
+	} catch (error) {
+		errors.push(`Execution error: ${error instanceof Error ? error.message : String(error)}\n`);
+	}
+	return {
+		different: errors.length > 0 || results.some((result) => result.different),
+		output: results.map((result) => result.output).join("") + errors.join("") + (probe === void 0 ? "No behavioural probe ran.\n" : "Behavioural probe supplied.\n") + revisionCounts(root, baseRef)
+	};
+}
 //#endregion
 //#region src/bin/api-diff.ts
 runCli(() => {
 	const args = process.argv.slice(2);
-	if (args.length !== 1) throw new Error("Usage: antelopejs-api-diff <base-ref>");
-	const result = apiDiff(repositoryRoot(), args[0]);
+	if (args.length !== 1 && !(args.length === 3 && args[1] === "--probe")) throw new Error("Usage: antelopejs-api-diff <base-ref> [--probe <file.cjs>]");
+	const result = apiDiff(repositoryRoot(), args[0], args[2]);
 	process.stdout.write(result.output);
 	return result.different ? 1 : 0;
 });

package/dist/bin/check-size.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { a as runCli, i as repositoryRoot, r as repositoryPath, t as authoredSizes } from "../files-DAD5OtfV.mjs";
-import { t as checkSize } from "../size-D7JJp_W4.mjs";
+import { i as repositoryRoot, r as repositoryPath, t as authoredSizes, u as runCli } from "../files-jKlueTMd.mjs";
+import { t as checkSize } from "../size-BdYmv57u.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";

package/dist/bin/checks.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import "../ceilings-BSw9p4YB.mjs";
-import { a as runCli, i as repositoryRoot } from "../files-DAD5OtfV.mjs";
+import { i as repositoryRoot, u as runCli } from "../files-jKlueTMd.mjs";
 import { i as parseManifest, r as packageManager } from "../package-Ckd7e4tA.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -29,6 +29,7 @@ function runChecks(root) {
 		const result = spawnSync(manager, ["run", step], {
 			cwd: root,
 			encoding: "utf8",
+			shell: process.platform === "win32",
 			env: {
 				...process.env,
 				CI: "1"

package/dist/bin/comment-proof.mjs

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { a as runCli, i as repositoryRoot } from "../files-DAD5OtfV.mjs";
-import { i as compareRevisions, r as packagesAt, t as emitPackage } from "../typescript-CHOlkIXa.mjs";
+import { c as revisionCounts, i as repositoryRoot, s as compareRevisions, u as runCli } from "../files-jKlueTMd.mjs";
+import { i as packagesAt, t as emitPackage } from "../typescript-aLCrMi2y.mjs";
 import { copyFileSync, mkdirSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 //#region src/guardrails/comment-proof.ts
 /** Proves comment-free JavaScript emit matches, including private packages and excluding tests. */
 function commentProof(root, baseRef) {
-	return compareRevisions(root, baseRef, "Comment proof", (worktree, output, scratch) => {
+	const result = compareRevisions(root, baseRef, "Comment proof", (worktree, output, scratch) => {
 		const packages = packagesAt(worktree, false);
 		let entries = 0;
 		for (const { directory } of packages) {
@@ -25,6 +25,10 @@ function commentProof(root, baseRef) {
 			entries
 		};
 	});
+	return {
+		...result,
+		output: result.output + revisionCounts(root, baseRef)
+	};
 }
 //#endregion
 //#region src/bin/comment-proof.ts

package/dist/bin/ratchet.mjs

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { s as readCeilings, t as CEILINGS_FILE } from "../ceilings-BSw9p4YB.mjs";
-import { a as runCli, i as repositoryRoot, r as repositoryPath } from "../files-DAD5OtfV.mjs";
-import { n as ratchet, r as lintDiagnostics } from "../ratchet-B2_QUucT.mjs";
+import { n as renamedPaths } from "../renames-BGO4dWJ8.mjs";
+import { a as resolveRevision, i as repositoryRoot, r as repositoryPath, u as runCli } from "../files-jKlueTMd.mjs";
+import { n as ratchet, r as lintDiagnostics } from "../ratchet-CNbpU42F.mjs";
 import { resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 import { parseArgs } from "node:util";
@@ -18,6 +19,7 @@ function stagedRatchet(root, files) {
 		encoding: "utf8"
 	}).split("\0").filter(Boolean);
 	if (!targets.length) return [];
+	const renames = renamedPaths(root, true);
 	const additions = /* @__PURE__ */ new Map();
 	for (const file of targets) {
 		const diff = execFileSync("git", [
@@ -26,8 +28,9 @@ function stagedRatchet(root, files) {
 			"--no-ext-diff",
 			"--no-color",
 			"--unified=0",
+			"--find-renames",
 			"--",
-			file
+			...[renames.get(file), file].filter((path) => path !== void 0)
 		], {
 			cwd: root,
 			encoding: "utf8"
@@ -46,18 +49,20 @@ runCli(() => {
 	const { values, positionals } = parseArgs({
 		options: {
 			update: { type: "boolean" },
-			staged: { type: "boolean" }
+			staged: { type: "boolean" },
+			base: { type: "string" }
 		},
 		allowPositionals: true
 	});
 	const root = repositoryRoot();
+	if (values.base !== void 0 && values.staged) throw new Error("--base cannot be combined with --staged.");
 	if (values.update && values.staged) throw new Error("--staged cannot be combined with --update.");
 	if (positionals.length && !values.staged) throw new Error("File arguments require --staged.");
 	const result = values.staged ? {
 		failures: stagedRatchet(root, positionals.length ? positionals.map((file) => repositoryPath(root, resolve(file))) : void 0),
 		lowered: [],
 		retired: false
-	} : ratchet(root, values.update);
+	} : ratchet(root, values.update, values.base === void 0 ? void 0 : resolveRevision(root, values.base));
 	if (result.retired) process.stdout.write(`Deleted ${CEILINGS_FILE}: no debt left. Run antelopejs-sync.\n`);
 	for (const message of result.lowered) process.stdout.write(`Lowered ${message}\n`);
 	for (const message of result.failures) process.stderr.write(`${message}\n`);

package/dist/bin/sync.mjs

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { a as formatCeilings, o as isRetired, s as readCeilings, t as CEILINGS_FILE } from "../ceilings-BSw9p4YB.mjs";
-import { a as runCli, i as repositoryRoot } from "../files-DAD5OtfV.mjs";
+import { i as repositoryRoot, u as runCli } from "../files-jKlueTMd.mjs";
 import { a as repositoryTools, i as parseManifest, n as managedPackage, o as toolingVersions, r as packageManager, t as execCommand } from "../package-Ckd7e4tA.mjs";
-import { t as measureBaseline } from "../ratchet-B2_QUucT.mjs";
+import { t as measureBaseline } from "../ratchet-CNbpU42F.mjs";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+import { execFileSync } from "node:child_process";
 import { parseArgs } from "node:util";
 import { isMap, isScalar, isSeq, parseDocument } from "yaml";
 //#region src/guardrails/agents-block.ts
@@ -12,7 +13,11 @@ const AGENTS_BLOCK_START = "<!-- antelopejs-guardrails:start -->";
 const AGENTS_BLOCK_END = "<!-- antelopejs-guardrails:end -->";
 const COMMENTS = `### Comments
 
-Say it in code. A constraint belongs in a type, a lint rule, or a test. A public item's contract belongs in TSDoc (\`/** */\`) on that item. The only other comments are lint directives that name their rules, \`@ts-expect-error <reason>\`, \`SAFETY: <reason>\` above a type assertion, \`/*!\` license headers, and bundler or formatter directives.`;
+Say it in code. A constraint belongs in a type, a lint rule, or a test. A public item's contract belongs in TSDoc (\`/** */\`) on that item. The only other comments are lint directives that name their rules, \`@ts-expect-error <reason>\`, \`SAFETY: <reason>\` above a type assertion, \`/*!\` license headers, and bundler or formatter directives.
+
+Before suppressing a type rule, try inference or a type derived from its owner with \`Parameters\`, \`ReturnType\`, or indexed access. A private alias can still appear in a published declaration. Keep a suppression only after checking the published contract and the unchecked boundary it protects.
+
+Check each directive reason against the current line and its callers. Returning a value is not the same as awaiting and discarding it. A reason must describe what the code does now.`;
 const TESTS = `### Tests
 
 Hold every test you write or keep to this checklist:
@@ -22,7 +27,13 @@ Hold every test you write or keep to this checklist:
 - An invariant over many files is a lint rule, not a test.`;
 const CLEANUP_PROOF = `### Cleanup proof
 
-A behaviour-preserving cleanup PR shows \`antelopejs-api-diff <base-ref>\` passing. Published declarations stay unchanged. A comment-only PR shows \`antelopejs-comment-proof <base-ref>\` passing instead of a verifier. Both compare committed HEAD.`;
+A behaviour-preserving cleanup PR shows \`antelopejs-api-diff <base-ref>\` passing. Published declarations and built runtime exports stay unchanged. A comment-only PR shows \`antelopejs-comment-proof <base-ref>\` passing instead of a verifier. Both compare committed HEAD.
+
+Copy counts from the proof's base and HEAD table. Never type counts by hand. Keep the command and the committed head beside the copied output. Directive lines are not individual suppressed rules.
+
+Pass \`--probe <file.cjs>\` to api-diff when changing receivers, positional calls, or modules that no published entry reaches. The same captured script runs against both worktree roots, supplied as \`argv[2]\`, and prints JSON observations. Matching metadata alone does not prove those behaviours.
+
+An entry-only rule exempts only its own module. Add a second module entry rather than exempting another importer. A no-upward rule must reject peers in the same tier as well as higher tiers. Probe the rank decision with an import, not just a reading of the configuration.`;
 const SHARED_RULES = [
 	["Formatting", "oxfmt"],
 	["Lint findings are errors; no rule warns", "oxlint preset"],
@@ -32,14 +43,19 @@ const SHARED_RULES = [
 	["No assertion that restates a constant", "`antelopejs/no-constant-value-assertion`"],
 	["No test whose only check is \"is a function\"", "`antelopejs/no-typeof-function-only-test`"],
 	["Params ≤ 5, function ≤ 120 lines, file ≤ 500 lines, depth ≤ 4, complexity ≤ 20", "`eslint/max-*`, `eslint/complexity`"],
-	["Cleanup preserves published declarations", "`antelopejs-api-diff <base-ref>`"],
-	["Comment-only changes preserve JavaScript emit", "`antelopejs-comment-proof <base-ref>`"]
+	["Cleanup preserves declarations and built runtime export metadata", "`antelopejs-api-diff <base-ref>`"],
+	["Comment-only changes preserve JavaScript emit", "`antelopejs-comment-proof <base-ref>`"],
+	["PR-body counts come from tracked code files", "api-diff and comment-proof tables"],
+	["Receiver, positional and unpublished-module behaviour", "`antelopejs-api-diff <base-ref> --probe <file.cjs>`"],
+	["Type suppressions and directive reasons are justified", "review; no tool"],
+	["No-upward rules reject same-tier peers", "review and import probes"]
 ];
 const FULL_RULES = [
 	["Files ≤ 20,000 bytes, tests included", "`antelopejs-check-size` (pre-commit)"],
 	["Types check", "`tsc` (pre-push)"],
 	["No dead files, exports, or dependencies", "knip"],
 	["Managed files match the pack", "`antelopejs-sync --check`"],
+	["Entry-only rules exempt no tracked outsider", "`antelopejs-sync --check`"],
 	["A test names the wrong implementation it catches", "review; no tool"]
 ];
 /** Pads each column the way oxfmt does, so formatting AGENTS.md never reports sync drift. */
@@ -258,6 +274,76 @@ function hasChecksWorkflow(root) {
 	return false;
 }
 //#endregion
+//#region src/guardrails/entry-only.ts
+const LOAD_RULES = `
+const advisories = [];
+const rules = [];
+const SUPPORTED = { from: ["pathNot"], to: ["path", "pathNot"] };
+function patterns(value) {
+  if (value === undefined) return [];
+  const list = Array.isArray(value) ? value : [value];
+  if (list.some(pattern => typeof pattern !== "string")) return null;
+  try { list.forEach(pattern => new RegExp(pattern)); } catch { return null; }
+  return list;
+}
+function problem(rule) {
+  if (!rule.from || typeof rule.from !== "object" || !rule.to || typeof rule.to !== "object")
+    return "Warning: entry-only rule " + rule.name + " has no from and to selectors, so its exemptions cannot be checked.";
+  const unsupported = [
+    ...(rule.severity === "error" ? [] : ["severity " + String(rule.severity)]),
+    ...Object.keys(rule.from).filter(key => !SUPPORTED.from.includes(key)).map(key => "from." + key),
+    ...Object.keys(rule.to).filter(key => !SUPPORTED.to.includes(key)).map(key => "to." + key),
+  ];
+  if (unsupported.length)
+    return "Note: entry-only rule " + rule.name + " skipped, because its selectors are not supported (" + unsupported.join(", ") + "); only error rules built from from.pathNot and to.path or to.pathNot patterns are checked.";
+  if (rule.to.path === undefined)
+    return "Warning: entry-only rule " + rule.name + " has no to.path, so there is no module to exempt against.";
+  if (patterns(rule.from.pathNot) === null || !patterns(rule.to.path)?.length || patterns(rule.to.pathNot) === null)
+    return "Warning: entry-only rule " + rule.name + " has selectors that are not valid regular expression strings, so its exemptions cannot be checked.";
+  return undefined;
+}
+try {
+  const forbidden = require(process.cwd()+"/.dependency-cruiser.cjs").forbidden;
+  if (!Array.isArray(forbidden)) advisories.push("Warning: .dependency-cruiser.cjs has no forbidden rule array, so entry-only exemptions are not checked.");
+  else for (const rule of forbidden) {
+    if (!rule || typeof rule.name !== "string" || !rule.name.endsWith("-entry-only")) continue;
+    const advisory = problem(rule);
+    if (advisory === undefined) rules.push({ name: rule.name, exempt: patterns(rule.from.pathNot), domain: patterns(rule.to.path) });
+    else advisories.push(advisory);
+  }
+} catch (error) {
+  advisories.push("Warning: .dependency-cruiser.cjs could not be loaded, so entry-only exemptions are not checked (" + String(error && error.message) + ").");
+}
+process.stdout.write(JSON.stringify({ rules, advisories }));
+`;
+function matcher(patterns) {
+	return patterns.map((pattern) => new RegExp(pattern));
+}
+/** Rejects tracked importers exempted from another module's entry-only boundary. A rule it cannot interpret yields a printed note or warning in `advisories` and never a failure. */
+function checkEntryOnlyConfiguration(root) {
+	if (!existsSync(join(root, ".dependency-cruiser.cjs"))) return {
+		errors: [],
+		advisories: []
+	};
+	const { rules, advisories } = JSON.parse(execFileSync(process.execPath, ["-e", LOAD_RULES], {
+		cwd: root,
+		encoding: "utf8",
+		timeout: 1e4
+	}));
+	const paths = execFileSync("git", ["ls-files", "-z"], {
+		cwd: root,
+		encoding: "utf8"
+	}).split("\0").filter(Boolean);
+	return {
+		errors: rules.flatMap((rule) => {
+			const domain = matcher(rule.domain);
+			const exemption = matcher(rule.exempt);
+			return paths.filter((path) => exemption.some((pattern) => pattern.test(path)) && !domain.some((pattern) => pattern.test(path))).map((path) => `${rule.name} exempts ${path} outside its module; give the module a second entry instead`);
+		}),
+		advisories
+	};
+}
+//#endregion
 //#region src/guardrails/sync.ts
 const LEGACY_COMMENT_INSTRUCTION = "- Explain non-obvious constraints and decisions in comments; avoid restating the code. Document public contracts with TSDoc.";
 const RETIRED_RATCHET = `${CEILINGS_FILE} has no debt left. Run ratchet:update to delete it, then run antelopejs-sync.`;
@@ -463,6 +549,8 @@ function syncRepository(root, options = {}) {
 	const context = repositoryContext(root, current, profile);
 	let plan = planSync(current, modes, context);
 	const errors = plan.filter((artifact) => artifact.kind === "error").map(({ message }) => message);
+	const entryOnly = checkEntryOnlyConfiguration(root);
+	errors.push(...entryOnly.errors);
 	const notes = plan.flatMap((artifact) => artifact.kind === "migrated" ? artifact.notes : []);
 	(options.check ? errors : notes).push(...repositoryNotices(root, context));
 	if (!errors.length && profile === "full" && !options.check && !current.has("guardrails.ratchet.json") && manifest.scripts?.["sync:check"] === void 0) {
@@ -483,6 +571,7 @@ function syncRepository(root, options = {}) {
 		paths: errors.length ? [] : writes.map(({ path }) => path),
 		errors,
 		notes,
+		advisories: entryOnly.advisories,
 		dependenciesAdded
 	};
 }
@@ -502,6 +591,7 @@ runCli(() => {
 		profile: values.profile
 	});
 	for (const note of result.notes) process.stdout.write(`Note: ${values.check || result.errors.length ? "Planned migration. " : ""}${note}\n`);
+	for (const advisory of result.advisories) process.stdout.write(`${advisory}\n`);
 	for (const error of result.errors) process.stderr.write(`${error}\n`);
 	if (result.errors.length) return 1;
 	for (const path of result.paths) process.stdout.write(`${values.check ? "Drift" : "Updated"}: ${path}${values.check ? "; run antelopejs-sync" : ""}\n`);

package/dist/files-jKlueTMd.mjs

@@ -0,0 +1,298 @@
+import "./ceilings-BSw9p4YB.mjs";
+import { n as IGNORE_PATTERNS, t as AGENT_IGNORE_PATTERNS } from "./shared-CsXIMK3I.mjs";
+import { closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readSync, rmSync, symlinkSync } from "node:fs";
+import { dirname, join, matchesGlob, relative, resolve } from "node:path";
+import { execFileSync, spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+//#region src/guardrails/cli.ts
+function runCli(main) {
+	try {
+		process.exitCode = main();
+	} catch (error) {
+		process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+		process.exitCode = 1;
+	}
+}
+//#endregion
+//#region src/guardrails/revisions.ts
+function trackedManifests(root) {
+	return execFileSync("git", ["ls-files", "-z"], {
+		cwd: root,
+		encoding: "utf8"
+	}).split("\0").filter((file) => file === "package.json" || file.endsWith("/package.json"));
+}
+const DIRECTORY_LINK = process.platform === "win32" ? "junction" : "dir";
+function linkDependencies(root, worktree) {
+	const directories = /* @__PURE__ */ new Set([".", ...trackedManifests(root).map(dirname)]);
+	for (const directory of directories) {
+		const source = join(root, directory, "node_modules");
+		const target = join(worktree, directory, "node_modules");
+		if (existsSync(source) && existsSync(dirname(target)) && !existsSync(target)) symlinkSync(source, target, DIRECTORY_LINK);
+	}
+}
+/** Compares isolated committed revisions and removes both worktrees even when compilation fails. */
+function compareRevisions(root, baseRef, label, emit) {
+	const temporary = mkdtempSync(join(tmpdir(), "antelope-proof-"));
+	const worktrees = [];
+	const results = [];
+	try {
+		for (const [side, ref] of [["base", baseRef], ["head", "HEAD"]]) {
+			const revision = execFileSync("git", [
+				"rev-parse",
+				"--verify",
+				"--end-of-options",
+				`${ref}^{commit}`
+			], {
+				cwd: root,
+				encoding: "utf8",
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				]
+			}).trim();
+			const worktree = join(temporary, "worktrees", side);
+			execFileSync("git", [
+				"worktree",
+				"add",
+				"--quiet",
+				"--detach",
+				worktree,
+				revision
+			], {
+				cwd: root,
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				]
+			});
+			worktrees.push(worktree);
+			linkDependencies(root, worktree);
+			const output = join(temporary, side);
+			mkdirSync(output, { recursive: true });
+			results.push(emit(worktree, output, join(temporary, "emit", side)));
+		}
+		const diff = spawnSync("git", [
+			"diff",
+			"--no-index",
+			"--no-color",
+			"--no-renames",
+			"--no-ext-diff",
+			"--no-textconv",
+			"--",
+			"base",
+			"head"
+		], {
+			cwd: temporary,
+			encoding: "utf8",
+			maxBuffer: 67108864
+		});
+		if (diff.error) throw diff.error;
+		if (diff.status !== 0 && diff.status !== 1) throw new Error(diff.stderr || "Could not compare revision outputs.");
+		const packages = new Set(results.flatMap((result) => result.packages)).size;
+		return {
+			different: diff.status === 1,
+			output: diff.status === 1 ? `${label}: differences against ${baseRef} (committed HEAD).\n${diff.stdout}` : `${label}: ${packages} packages, ${results[1].entries} entries unchanged against ${baseRef} (committed HEAD).\n`
+		};
+	} finally {
+		for (const worktree of worktrees.reverse()) execFileSync("git", [
+			"worktree",
+			"remove",
+			"--force",
+			worktree
+		], {
+			cwd: root,
+			stdio: "pipe"
+		});
+		rmSync(temporary, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+const COUNTS = [
+	["oxlint-disable / eslint-disable directive lines", /^\s*(?:\/\/|\/\*|\*)\s*(?:oxlint|eslint)-disable\b/u],
+	["SAFETY: lines", /^\s*(?:\/\/|\/\*|\*)\s*SAFETY:/u],
+	["@ts-expect-error lines", /^\s*(?:\/\/|\/\*|\*)\s*@ts-expect-error\b/u]
+];
+const CODE_PATHSPECS = [
+	"*.ts",
+	"*.tsx",
+	"*.mts",
+	"*.cts",
+	"*.js",
+	"*.jsx",
+	"*.mjs",
+	"*.cjs",
+	"*.vue"
+];
+function countsAt(root, ref) {
+	const result = spawnSync("git", [
+		"grep",
+		"-h",
+		"-I",
+		"-E",
+		"-e",
+		"(oxlint|eslint)-disable|SAFETY:|@ts-expect-error",
+		ref,
+		"--",
+		...CODE_PATHSPECS
+	], {
+		cwd: root,
+		encoding: "utf8",
+		maxBuffer: 67108864
+	});
+	if (result.error) throw result.error;
+	if (result.status !== 0 && result.status !== 1) throw new Error(result.stderr);
+	const lines = result.stdout.split("\n");
+	return COUNTS.map(([, pattern]) => lines.filter((line) => pattern.test(line)).length);
+}
+/** Counts directive, `SAFETY:` and `@ts-expect-error` lines in every tracked code file at the base and at committed HEAD, so a PR body copies them instead of typing them. */
+function revisionCounts(root, baseRef) {
+	const base = countsAt(root, baseRef);
+	const head = countsAt(root, "HEAD");
+	return `\nCounts in tracked code files (${baseRef} and committed HEAD).\n| Lines | base | HEAD |\n| --- | ---: | ---: |\n${COUNTS.map(([label], index) => `| ${label} | ${base[index]} | ${head[index]} |`).join("\n")}\n`;
+}
+//#endregion
+//#region src/guardrails/files.ts
+const SIZE_EXCLUSIONS = [
+	{
+		kind: "generated",
+		patterns: [
+			...IGNORE_PATTERNS,
+			...AGENT_IGNORE_PATTERNS,
+			"**/*.generated.*",
+			"**/generated/**",
+			"**/__snapshots__/**"
+		]
+	},
+	{
+		kind: "fixtures",
+		patterns: ["**/fixtures/**", "**/__fixtures__/**"]
+	},
+	{
+		kind: "data",
+		patterns: [
+			"**/locales/**/*.json",
+			"**/i18n/**/*.json",
+			"**/blocks.json",
+			"**/schema.json",
+			"**/evals/**/cases.json"
+		]
+	},
+	{
+		kind: "lockfiles",
+		patterns: [
+			"**/{pnpm-lock.yaml,package-lock.json,npm-shrinkwrap.json,yarn.lock,bun.lock,bun.lockb,Cargo.lock,poetry.lock,uv.lock,Gemfile.lock,composer.lock,go.sum}",
+			"**/*.lock",
+			"**/*.lockb"
+		]
+	},
+	{
+		kind: "documentation",
+		patterns: ["**/CHANGELOG.md", "**/*.{md,mdx,markdown,MD}"]
+	},
+	{
+		kind: "assets",
+		patterns: ["**/*.{png,jpg,jpeg,gif,webp,avif,ico,svg,bmp,tiff,pdf,mp3,wav,ogg,flac,mp4,webm,mov,avi,woff,woff2,ttf,otf,eot,zip,gz,tgz,bz2,xz,7z,tar,rar,wasm,bin,exe,dll,so,dylib,db,sqlite,sqlite3,icns}"]
+	}
+];
+function gitFiles(root) {
+	return [...new Set(execFileSync("git", [
+		"ls-files",
+		"--cached",
+		"--others",
+		"--exclude-standard",
+		"-z"
+	], {
+		cwd: root,
+		encoding: "utf8"
+	}).split("\0").filter(Boolean))];
+}
+function repositoryRoot(cwd = process.cwd()) {
+	return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+		cwd,
+		encoding: "utf8"
+	}).trim();
+}
+/** Resolves a user-supplied revision to a commit id, so it can never read as an option. */
+function resolveRevision(root, revision) {
+	return execFileSync("git", [
+		"rev-parse",
+		"--verify",
+		"--end-of-options",
+		`${revision}^{commit}`
+	], {
+		cwd: root,
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	}).trim();
+}
+function repositoryPath(root, file) {
+	return relative(root, resolve(root, file)).split("\\").join("/");
+}
+function fileBytes(root, file, staged = false) {
+	if (staged) {
+		const result = spawnSync("git", [
+			"cat-file",
+			"-s",
+			`:${file}`
+		], {
+			cwd: root,
+			encoding: "utf8"
+		});
+		if (result.error) throw result.error;
+		return result.status === 0 ? Number(result.stdout.trim()) : void 0;
+	}
+	const path = join(root, file);
+	if (!existsSync(path)) return void 0;
+	const stat = lstatSync(path);
+	return stat.isFile() ? stat.size : void 0;
+}
+/** A package root is the directory of a tracked manifest outside every `src` directory; its top-level `build` and `output` are generated output. */
+function packageOutputPatterns(root) {
+	return trackedManifests(root).flatMap((manifest) => {
+		const directory = dirname(manifest);
+		if (directory === "." || directory.split("/").includes("src")) return [];
+		return [`${directory}/build/**`, `${directory}/output/**`];
+	});
+}
+/** `path.matchesGlob` never lets `*` or `**` cross a segment starting with a dot, so each path is also tried with those dots removed. */
+function isExcluded(file, packageOutputs) {
+	const undotted = file.replace(/(^|\/)\./gu, "$1");
+	const matches = (pattern) => matchesGlob(file, pattern) || matchesGlob(undotted, pattern);
+	return SIZE_EXCLUSIONS.some(({ patterns }) => patterns.some(matches)) || packageOutputs.some(matches);
+}
+function isBinary(root, file, staged) {
+	if (staged) return execFileSync("git", ["show", `:${file}`], {
+		cwd: root,
+		maxBuffer: fileBytes(root, file, true)
+	}).subarray(0, 8e3).includes(0);
+	const descriptor = openSync(join(root, file), "r");
+	try {
+		const prefix = Buffer.alloc(8e3);
+		const length = readSync(descriptor, prefix, 0, prefix.length, 0);
+		return prefix.subarray(0, length).includes(0);
+	} finally {
+		closeSync(descriptor);
+	}
+}
+function authoredSizes(root, files = gitFiles(root), staged = false) {
+	const sizes = /* @__PURE__ */ new Map();
+	const packageOutputs = packageOutputPatterns(root);
+	for (const input of files) {
+		const file = repositoryPath(root, input);
+		if (isExcluded(file, packageOutputs)) continue;
+		const size = fileBytes(root, file, staged);
+		if (size !== void 0 && size > 2e4 && isBinary(root, file, staged)) continue;
+		if (size !== void 0) sizes.set(file, size);
+	}
+	return sizes;
+}
+//#endregion
+export { resolveRevision as a, revisionCounts as c, repositoryRoot as i, trackedManifests as l, gitFiles as n, DIRECTORY_LINK as o, repositoryPath as r, compareRevisions as s, authoredSizes as t, runCli as u };

package/dist/oxc/fmt.mjs

@@ -1,4 +1,4 @@
-import { n as IGNORE_PATTERNS, t as AGENT_IGNORE_PATTERNS } from "../shared-NC0T8ykm.mjs";
+import { n as IGNORE_PATTERNS, t as AGENT_IGNORE_PATTERNS } from "../shared-CsXIMK3I.mjs";
 import { defineConfig } from "oxfmt";
 //#region src/oxc/fmt.ts
 /**

package/dist/oxc/lint.mjs

@@ -1,6 +1,7 @@
-import { i as findGitRoot, s as readCeilings } from "../ceilings-BSw9p4YB.mjs";
+import { i as findGitRoot } from "../ceilings-BSw9p4YB.mjs";
+import { t as readCarriedCeilings } from "../renames-BGO4dWJ8.mjs";
 import { n as TEST_FILE_GLOBS, t as ASSERTION_FUNCTION_NAMES } from "../shared-WC0z3y9F.mjs";
-import { n as IGNORE_PATTERNS, t as AGENT_IGNORE_PATTERNS } from "../shared-NC0T8ykm.mjs";
+import { n as IGNORE_PATTERNS, t as AGENT_IGNORE_PATTERNS } from "../shared-CsXIMK3I.mjs";
 import { defineConfig } from "oxlint";
 //#region src/oxc/lint.ts
 /**
@@ -179,7 +180,7 @@ function importSortingPreset() {
 /** Overrides run after rules, including test-specific rules; measurement bypasses all ceilings. */
 function ratchetOverrides() {
 	if (process.env["ANTELOPEJS_RATCHET_MEASURE"] !== void 0) return [];
-	const ceilings = readCeilings(findGitRoot());
+	const ceilings = readCarriedCeilings(findGitRoot());
 	const rules = Object.fromEntries(Object.keys(ceilings.rules).map((rule) => [rule, "off"]));
 	return [...Object.keys(ceilings.oversizeFiles).map((path) => ({
 		files: [path.replaceAll(/([*?[\]{}])/gu, "\\$1")],

package/dist/{ratchet-B2_QUucT.mjs → ratchet-CNbpU42F.mjs}

@@ -1,6 +1,7 @@
-import { a as formatCeilings, n as MAX_FILE_BYTES, o as isRetired, r as MEASURE_ENV, s as readCeilings, t as CEILINGS_FILE } from "./ceilings-BSw9p4YB.mjs";
-import { n as gitFiles, r as repositoryPath, t as authoredSizes } from "./files-DAD5OtfV.mjs";
-import { n as sizeFailure } from "./size-D7JJp_W4.mjs";
+import { a as formatCeilings, n as MAX_FILE_BYTES, o as isRetired, r as MEASURE_ENV, t as CEILINGS_FILE } from "./ceilings-BSw9p4YB.mjs";
+import { t as readCarriedCeilings } from "./renames-BGO4dWJ8.mjs";
+import { n as gitFiles, r as repositoryPath, t as authoredSizes } from "./files-jKlueTMd.mjs";
+import { n as sizeFailure } from "./size-BdYmv57u.mjs";
 import { createRequire } from "node:module";
 import { existsSync, mkdtempSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
@@ -50,7 +51,7 @@ function lintDiagnostics(root, config, files) {
 			writeFileSync(path, config ?? "");
 			args.push("--config", path, "--ignore-pattern", `${basename(temporary)}/**`);
 		}
-		if (files) args.push("--", ...files);
+		if (files) args.push("--no-error-on-unmatched-pattern", "--", ...files);
 		const result = spawnSync(process.execPath, args, {
 			cwd: root,
 			encoding: "utf8",
@@ -137,9 +138,9 @@ function lowerCeilings(ceilings, current) {
 	}
 	return lowered;
 }
-function ratchet(root, update = false) {
+function ratchet(root, update = false, base = "HEAD") {
 	if (!existsSync(join(root, "guardrails.ratchet.json"))) throw new Error(`${CEILINGS_FILE} is missing. Run antelopejs-sync first.`);
-	const ceilings = readCeilings(root);
+	const ceilings = readCarriedCeilings(root, false, [base]);
 	const diagnostics = lintDiagnostics(root);
 	const current = baseline(root, diagnostics);
 	const changed = changedFiles(root);

package/dist/renames-BGO4dWJ8.mjs

@@ -0,0 +1,59 @@
+import { s as readCeilings } from "./ceilings-BSw9p4YB.mjs";
+import { spawnSync } from "node:child_process";
+//#region src/guardrails/renames.ts
+/**
+* Renames git detects, as new path to old path. Without `revisions` it
+* compares the index with HEAD when `staged`, otherwise the working tree with
+* HEAD; with revisions it compares those. Copies are never reported, and a
+* repository without HEAD has no renames.
+*/
+function renamedPaths(root, staged = false, revisions = staged ? [] : ["HEAD"]) {
+	const result = spawnSync("git", [
+		"diff",
+		"--find-renames",
+		"--diff-filter=R",
+		"--name-status",
+		"-z",
+		"--no-ext-diff",
+		...staged ? ["--cached"] : [],
+		...revisions,
+		"--"
+	], {
+		cwd: root,
+		encoding: "utf8",
+		maxBuffer: 67108864
+	});
+	const renames = /* @__PURE__ */ new Map();
+	if (result.error || result.status !== 0) return renames;
+	const fields = result.stdout.split("\0");
+	for (let index = 0; index + 2 < fields.length; index += 3) renames.set(fields[index + 2], fields[index + 1]);
+	return renames;
+}
+/**
+* Moves the oversize allowance of each renamed file to its new path. The new
+* path never gets more than the old allowance; a copy or a new file has no
+* rename entry and so inherits nothing.
+*/
+function carryAllowances(ceilings, renames) {
+	const oversizeFiles = { ...ceilings.oversizeFiles };
+	const moved = [];
+	for (const [file, previous] of renames) {
+		const allowance = ceilings.oversizeFiles[previous];
+		if (allowance === void 0) continue;
+		delete oversizeFiles[previous];
+		moved.push([file, Math.min(allowance, ceilings.oversizeFiles[file] ?? allowance)]);
+	}
+	for (const [file, allowance] of moved) oversizeFiles[file] = allowance;
+	return {
+		rules: ceilings.rules,
+		oversizeFiles
+	};
+}
+/** The ceilings at `root` with allowances carried across the renames in `staged` or working-tree scope. */
+function readCarriedCeilings(root, staged = false, revisions) {
+	const ceilings = readCeilings(root);
+	if (Object.keys(ceilings.oversizeFiles).length === 0) return ceilings;
+	return carryAllowances(ceilings, renamedPaths(root, staged, revisions));
+}
+//#endregion
+export { renamedPaths as n, readCarriedCeilings as t };

package/dist/{shared-NC0T8ykm.mjs → shared-CsXIMK3I.mjs}

@@ -3,16 +3,18 @@
 * Paths every AntelopeJS project generates or vendors, and that no linter should read.
 * `.github/ISSUE_TEMPLATE/**` holds GitHub's legacy issue templates: Markdown with
 * YAML frontmatter saved under a .yml extension, which a YAML formatter cannot parse.
+* `build/**` and `output/**` match only at the repository root: a directory with
+* either name under `src/` or another authored root is source, not build output.
 */
 const IGNORE_PATTERNS = [
 	"**/node_modules/**",
 	"**/dist/**",
-	"**/build/**",
 	"**/coverage/**",
 	"**/.antelope/**",
 	"**/.nuxt/**",
 	"**/.output/**",
-	"**/output/**",
+	"build/**",
+	"output/**",
 	"**/i18n-registry.generated.ts",
 	".github/ISSUE_TEMPLATE/**"
 ];

package/dist/{size-D7JJp_W4.mjs → size-BdYmv57u.mjs}

@@ -1,11 +1,12 @@
-import { s as readCeilings } from "./ceilings-BSw9p4YB.mjs";
-import { t as authoredSizes } from "./files-DAD5OtfV.mjs";
+import "./ceilings-BSw9p4YB.mjs";
+import { t as readCarriedCeilings } from "./renames-BGO4dWJ8.mjs";
+import { t as authoredSizes } from "./files-jKlueTMd.mjs";
 //#region src/guardrails/size.ts
 function sizeFailure(file, size, limit) {
 	return `${file}: ${size} bytes, ${size - limit} bytes over the ${limit}-byte ceiling. Split by responsibility into sibling modules, one cohesive group of exports each; keep the original path re-exporting only if it is a public entry point. Split a test file by behaviour under test, one file per describe. Do not minify, strip whitespace, or move code under an excluded path to pass.`;
 }
 function checkSize(root, files, staged = false) {
-	const ceilings = readCeilings(root);
+	const ceilings = readCarriedCeilings(root, staged);
 	const failures = [];
 	for (const [file, size] of authoredSizes(root, files, staged)) {
 		const limit = ceilings.oversizeFiles[file] ?? 2e4;

package/dist/{typescript-CHOlkIXa.mjs → typescript-aLCrMi2y.mjs}

@@ -1,106 +1,7 @@
-import { n as TEST_FILE_GLOBS } from "./shared-WC0z3y9F.mjs";
+import { l as trackedManifests } from "./files-jKlueTMd.mjs";
 import { createRequire } from "node:module";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
-import { dirname, join, matchesGlob, relative, sep } from "node:path";
-import { execFileSync, spawnSync } from "node:child_process";
-import { tmpdir } from "node:os";
-//#region src/guardrails/revisions.ts
-function trackedManifests(root) {
-	return execFileSync("git", ["ls-files", "-z"], {
-		cwd: root,
-		encoding: "utf8"
-	}).split("\0").filter((file) => file === "package.json" || file.endsWith("/package.json"));
-}
-function linkDependencies(root, worktree) {
-	const directories = /* @__PURE__ */ new Set([".", ...trackedManifests(root).map(dirname)]);
-	for (const directory of directories) {
-		const source = join(root, directory, "node_modules");
-		const target = join(worktree, directory, "node_modules");
-		if (existsSync(source) && existsSync(dirname(target)) && !existsSync(target)) symlinkSync(source, target, "dir");
-	}
-}
-/** Compares isolated committed revisions and removes both worktrees even when compilation fails. */
-function compareRevisions(root, baseRef, label, emit) {
-	const temporary = mkdtempSync(join(tmpdir(), "antelope-proof-"));
-	const worktrees = [];
-	const results = [];
-	try {
-		for (const [side, ref] of [["base", baseRef], ["head", "HEAD"]]) {
-			const revision = execFileSync("git", [
-				"rev-parse",
-				"--verify",
-				"--end-of-options",
-				`${ref}^{commit}`
-			], {
-				cwd: root,
-				encoding: "utf8",
-				stdio: [
-					"ignore",
-					"pipe",
-					"pipe"
-				]
-			}).trim();
-			const worktree = join(temporary, "worktrees", side);
-			execFileSync("git", [
-				"worktree",
-				"add",
-				"--quiet",
-				"--detach",
-				worktree,
-				revision
-			], {
-				cwd: root,
-				stdio: [
-					"ignore",
-					"pipe",
-					"pipe"
-				]
-			});
-			worktrees.push(worktree);
-			linkDependencies(root, worktree);
-			const output = join(temporary, side);
-			mkdirSync(output, { recursive: true });
-			results.push(emit(worktree, output, join(temporary, "emit", side)));
-		}
-		const diff = spawnSync("git", [
-			"diff",
-			"--no-index",
-			"--no-color",
-			"--no-renames",
-			"--no-ext-diff",
-			"--no-textconv",
-			"--",
-			"base",
-			"head"
-		], {
-			cwd: temporary,
-			encoding: "utf8",
-			maxBuffer: 67108864
-		});
-		if (diff.error) throw diff.error;
-		if (diff.status !== 0 && diff.status !== 1) throw new Error(diff.stderr || "Could not compare revision outputs.");
-		const packages = new Set(results.flatMap((result) => result.packages)).size;
-		return {
-			different: diff.status === 1,
-			output: diff.status === 1 ? `${label}: differences against ${baseRef} (committed HEAD).\n${diff.stdout}` : `${label}: ${packages} packages, ${results[1].entries} entries unchanged against ${baseRef} (committed HEAD).\n`
-		};
-	} finally {
-		for (const worktree of worktrees.reverse()) execFileSync("git", [
-			"worktree",
-			"remove",
-			"--force",
-			worktree
-		], {
-			cwd: root,
-			stdio: "pipe"
-		});
-		rmSync(temporary, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-//#endregion
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, matchesGlob, relative, resolve, sep } from "node:path";
 //#region src/guardrails/typescript.ts
 function packagesAt(root, publishedOnly) {
 	return trackedManifests(root).flatMap((file) => {
@@ -118,9 +19,16 @@ function packagesAt(root, publishedOnly) {
 function loadTypeScript(directory) {
 	return createRequire(join(directory, "package.json"))("typescript");
 }
+const TEST_SOURCE_GLOBS = [
+	"**/*.test.*",
+	"**/*.spec.*",
+	"**/__tests__/**",
+	"test/**",
+	"tests/**"
+];
 function isTestSource(root, file) {
 	const path = relative(root, file).split("\\").join("/");
-	return TEST_FILE_GLOBS.some((pattern) => matchesGlob(path, pattern));
+	return TEST_SOURCE_GLOBS.some((pattern) => matchesGlob(path, pattern));
 }
 function failDiagnostics(compiler, diagnostics) {
 	const errors = diagnostics.filter((item) => item.category === compiler.DiagnosticCategory.Error);
@@ -149,14 +57,24 @@ function copyDeclarations(program, directory, output) {
 	}
 	return files;
 }
-/** Emits with the package's compiler and config; test roots and outputs never enter either proof. */
-function emitPackage(directory, output, declarations) {
+function parseConfig(directory) {
 	const compiler = loadTypeScript(directory);
-	const configPath = join(directory, "tsconfig.json");
-	const config = compiler.readConfigFile(configPath, compiler.sys.readFile);
+	const config = compiler.readConfigFile(join(directory, "tsconfig.json"), compiler.sys.readFile);
 	if (config.error) failDiagnostics(compiler, [config.error]);
 	const parsed = compiler.parseJsonConfigFileContent(config.config, compiler.sys, directory);
 	failDiagnostics(compiler, parsed.errors);
+	return {
+		compiler,
+		parsed
+	};
+}
+/** The configured `outDir`, the root under which the declaration half already judges a built path as test output. */
+function outputRoot(directory) {
+	return resolve(directory, parseConfig(directory).parsed.options.outDir ?? ".");
+}
+/** Emits with the package's compiler and config; test roots and outputs never enter either proof. */
+function emitPackage(directory, output, declarations) {
+	const { compiler, parsed } = parseConfig(directory);
 	const options = {
 		...parsed.options,
 		rootDir: parsed.options.rootDir ?? (parsed.options.outDir ? void 0 : directory),
@@ -199,4 +117,4 @@ function emitPackage(directory, output, declarations) {
 	};
 }
 //#endregion
-export { compareRevisions as i, isTestSource as n, packagesAt as r, emitPackage as t };
+export { packagesAt as i, isTestSource as n, outputRoot as r, emitPackage as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antelopejs/tooling-configs",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Shared tooling presets for AntelopeJS repositories: oxlint (with the vendored anti-slop rules), oxfmt, ESLint for Nuxt layers, Knip, and an interface range check",
   "keywords": [
     "antelopejs",

package/dist/files-DAD5OtfV.mjs

@@ -1,129 +0,0 @@
-import "./ceilings-BSw9p4YB.mjs";
-import { n as IGNORE_PATTERNS, t as AGENT_IGNORE_PATTERNS } from "./shared-NC0T8ykm.mjs";
-import { closeSync, existsSync, lstatSync, openSync, readSync } from "node:fs";
-import { join, matchesGlob, relative, resolve } from "node:path";
-import { execFileSync, spawnSync } from "node:child_process";
-//#region src/guardrails/cli.ts
-function runCli(main) {
-	try {
-		process.exitCode = main();
-	} catch (error) {
-		process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
-		process.exitCode = 1;
-	}
-}
-//#endregion
-//#region src/guardrails/files.ts
-const SIZE_EXCLUSIONS = [
-	{
-		kind: "generated",
-		patterns: [
-			...IGNORE_PATTERNS,
-			...AGENT_IGNORE_PATTERNS,
-			"**/*.generated.*",
-			"**/generated/**",
-			"**/__snapshots__/**"
-		]
-	},
-	{
-		kind: "fixtures",
-		patterns: ["**/fixtures/**", "**/__fixtures__/**"]
-	},
-	{
-		kind: "data",
-		patterns: [
-			"**/locales/**/*.json",
-			"**/i18n/**/*.json",
-			"**/blocks.json",
-			"**/schema.json",
-			"**/evals/**/cases.json"
-		]
-	},
-	{
-		kind: "lockfiles",
-		patterns: [
-			"**/{pnpm-lock.yaml,package-lock.json,npm-shrinkwrap.json,yarn.lock,bun.lock,bun.lockb,Cargo.lock,poetry.lock,uv.lock,Gemfile.lock,composer.lock,go.sum}",
-			"**/*.lock",
-			"**/*.lockb"
-		]
-	},
-	{
-		kind: "documentation",
-		patterns: ["**/CHANGELOG.md", "**/*.{md,mdx,markdown,MD}"]
-	},
-	{
-		kind: "assets",
-		patterns: ["**/*.{png,jpg,jpeg,gif,webp,avif,ico,svg,bmp,tiff,pdf,mp3,wav,ogg,flac,mp4,webm,mov,avi,woff,woff2,ttf,otf,eot,zip,gz,tgz,bz2,xz,7z,tar,rar,wasm,bin,exe,dll,so,dylib,db,sqlite,sqlite3,icns}"]
-	}
-];
-function gitFiles(root) {
-	return [...new Set(execFileSync("git", [
-		"ls-files",
-		"--cached",
-		"--others",
-		"--exclude-standard",
-		"-z"
-	], {
-		cwd: root,
-		encoding: "utf8"
-	}).split("\0").filter(Boolean))];
-}
-function repositoryRoot(cwd = process.cwd()) {
-	return execFileSync("git", ["rev-parse", "--show-toplevel"], {
-		cwd,
-		encoding: "utf8"
-	}).trim();
-}
-function repositoryPath(root, file) {
-	return relative(root, resolve(root, file)).split("\\").join("/");
-}
-function fileBytes(root, file, staged = false) {
-	if (staged) {
-		const result = spawnSync("git", [
-			"cat-file",
-			"-s",
-			`:${file}`
-		], {
-			cwd: root,
-			encoding: "utf8"
-		});
-		if (result.error) throw result.error;
-		return result.status === 0 ? Number(result.stdout.trim()) : void 0;
-	}
-	const path = join(root, file);
-	if (!existsSync(path)) return void 0;
-	const stat = lstatSync(path);
-	return stat.isFile() ? stat.size : void 0;
-}
-/** `path.matchesGlob` never lets `*` or `**` cross a segment starting with a dot, so each path is also tried with those dots removed. */
-function isExcluded(file) {
-	const undotted = file.replace(/(^|\/)\./gu, "$1");
-	return SIZE_EXCLUSIONS.some(({ patterns }) => patterns.some((pattern) => matchesGlob(file, pattern) || matchesGlob(undotted, pattern)));
-}
-function isBinary(root, file, staged) {
-	if (staged) return execFileSync("git", ["show", `:${file}`], {
-		cwd: root,
-		maxBuffer: fileBytes(root, file, true)
-	}).subarray(0, 8e3).includes(0);
-	const descriptor = openSync(join(root, file), "r");
-	try {
-		const prefix = Buffer.alloc(8e3);
-		const length = readSync(descriptor, prefix, 0, prefix.length, 0);
-		return prefix.subarray(0, length).includes(0);
-	} finally {
-		closeSync(descriptor);
-	}
-}
-function authoredSizes(root, files = gitFiles(root), staged = false) {
-	const sizes = /* @__PURE__ */ new Map();
-	for (const input of files) {
-		const file = repositoryPath(root, input);
-		if (isExcluded(file)) continue;
-		const size = fileBytes(root, file, staged);
-		if (size !== void 0 && size > 2e4 && isBinary(root, file, staged)) continue;
-		if (size !== void 0) sizes.set(file, size);
-	}
-	return sizes;
-}
-//#endregion
-export { runCli as a, repositoryRoot as i, gitFiles as n, repositoryPath as r, authoredSizes as t };