@codyswann/lisa 3.47.5 → 3.47.7

package/dist/configs/eslint/expo.d.ts

@@ -1,5 +1,46 @@
 import { defaultIgnores, defaultThresholds, getBaseConfigs, getBaseLanguageOptions, getSharedRules } from "./typescript.js";
 export { defaultIgnores, defaultThresholds, getBaseConfigs, getBaseLanguageOptions, getSharedRules, };
+/**
+ * Axes a project declares typed, read from its own `.lisa.config.json`.
+ *
+ * #2807: the design-value rule shipped installed, severity `"off"`, and arming
+ * it needed a severity AND a `typedAxes` option hand-written into
+ * `eslint.config.local.ts`. Nothing carried `design.tokens.axes` from
+ * `.lisa.config.json` to the rule, so a project could declare every axis,
+ * install the policy, pass every test, and enforce nothing.
+ *
+ * It is read HERE, at ESLint **config** load, rather than inside the rule at
+ * **rule** load. That distinction is what makes it unremarkable: the managed
+ * `eslint.config.ts` already reads `eslint.thresholds.json` and
+ * `eslint.ignore.config.json` from disk at exactly this moment, so this adds no
+ * new class of behaviour and gives ESLint's config cache nothing to fight. A
+ * rule reading project files on every `create()` would do both.
+ *
+ * It also needs no generation step, which is what the alternative — emitting
+ * rule options into a generated file during `lisa apply` — would have cost. A
+ * generated file can go stale against the config it was generated from; a value
+ * read at load cannot.
+ * @param projectRoot - Directory holding the project's `.lisa.config.json`.
+ * @returns The declared axes, or an empty list when none are declared.
+ * @throws {TypeError} When `design.tokens.axes` is present but is not a list of strings.
+ */
+export declare function readTypedAxes(projectRoot: string): string[];
+/**
+ * The `ui-standards/no-unbound-design-value` entry for a set of typed axes.
+ *
+ * Silence-by-default is deliberate and unchanged: an axis with no published
+ * variable collection behind it has no token to bind to, and a rule that fires
+ * on every project is a rule that gets switched off. What changes is that
+ * declaring an axis is now SUFFICIENT to arm it. Previously nothing was.
+ *
+ * An axis name outside the rule's fixed vocabulary is passed through rather
+ * than filtered out, so ESLint's own schema validation rejects it by name. A
+ * filter would turn a typo into silent non-enforcement, which is the defect
+ * this function exists to remove.
+ * @param typedAxes - Axes the project declares typed.
+ * @returns `"off"` when none are declared, an armed error entry otherwise.
+ */
+export declare function getDesignValueBindingRule(typedAxes: readonly string[]): import("eslint").Linter.RuleEntry;
 /**
  * Creates the Expo ESLint configuration.
  * @param {object} options - Configuration options
@@ -7,9 +48,10 @@ export { defaultIgnores, defaultThresholds, getBaseConfigs, getBaseLanguageOptio
  * @param {string[]} [options.ignorePatterns] - Patterns to ignore
  * @param {object} [options.thresholds] - Threshold overrides
  * @param {string} [options.sourceRoot] - Prefix for source-relative file globs (e.g. `"src/"` for the SDK 55+/56 `/src` convention; defaults to `""`)
+ * @param {string[]} [options.typedAxes] - Axes the project declares typed, mirroring `design.tokens.axes`. Empty leaves the design-value rule off.
  * @returns {import("eslint").Linter.Config[]} ESLint flat config array
  */
-export declare function getExpoConfig({ tsconfigRootDir, ignorePatterns, thresholds, sourceRoot, }: {
+export declare function getExpoConfig({ tsconfigRootDir, ignorePatterns, thresholds, sourceRoot, typedAxes, }: {
     tsconfigRootDir: string;
     ignorePatterns?: string[];
     thresholds?: typeof defaultThresholds;
@@ -21,5 +63,12 @@ export declare function getExpoConfig({ tsconfigRootDir, ignorePatterns, thresho
      * `src/features`, etc. Globs anchored with a leading globstar are unaffected.
      */
     sourceRoot?: string;
+    /**
+     * Axes the project declares typed, mirroring `design.tokens.axes` in
+     * `.lisa.config.json`. Read by the managed `eslint.config.ts` via
+     * {@link readTypedAxes}. Empty — the default — leaves
+     * `ui-standards/no-unbound-design-value` off.
+     */
+    typedAxes?: readonly string[];
 }): import("eslint").Linter.Config[];
 //# sourceMappingURL=expo.d.ts.map

package/dist/configs/eslint/expo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"expo.d.ts","sourceRoot":"","sources":["../../../src/configs/eslint/expo.ts"],"names":[],"mappings":"AAsBA,OAAO,EAEL,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EAItB,cAAc,EAIf,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,CAAC;AAwBF;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,EAC5B,eAAe,EACf,cAA+B,EAC/B,UAA8B,EAC9B,UAAe,GAChB,EAAE;IACD,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,OAAO,iBAAiB,CAAC;IACtC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CA6QnC"}
+{"version":3,"file":"expo.d.ts","sourceRoot":"","sources":["../../../src/configs/eslint/expo.ts"],"names":[],"mappings":"AAwBA,OAAO,EAEL,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EAItB,cAAc,EAIf,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,CAAC;AAwCF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAe3D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,OAAO,QAAQ,EAAE,MAAM,CAAC,SAAS,CAInC;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,EAC5B,eAAe,EACf,cAA+B,EAC/B,UAA8B,EAC9B,UAAe,EACf,SAAc,GACf,EAAE;IACD,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,OAAO,iBAAiB,CAAC;IACtC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B,GAAG,OAAO,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAgRnC"}

package/dist/configs/eslint/expo.js

@@ -16,7 +16,9 @@
 import oxlint from "eslint-plugin-oxlint";
 import react from "eslint-plugin-react";
 import reactCompiler from "eslint-plugin-react-compiler";
+import { readFileSync } from "fs";
 import { createRequire } from "module";
+import path from "path";
 import { fileURLToPath } from "url";
 // Import TypeScript config and utilities
 import { codeOrganization, defaultIgnores, defaultThresholds, getBaseConfigs, getBaseLanguageOptions, getJsFilesOverride, getScriptsFilesOverride, getSharedFilesOverride, getSharedRules, getTestFilesOverride, getTsFilesOverride, getTsTestFilesOverride, } from "./typescript.js";
@@ -32,6 +34,82 @@ const expoConfig = require("eslint-config-expo/flat");
 const reactPerf = require("eslint-plugin-react-perf");
 const jsxA11y = require("eslint-plugin-jsx-a11y");
 const tailwind = require("eslint-plugin-tailwindcss");
+/**
+ * A project's `.lisa.config.json`, when it has one.
+ *
+ * Absence is not an error: a project that has never run `lisa apply` has no
+ * such file and declares no axes.
+ * @param file - Absolute path to the candidate `.lisa.config.json`.
+ * @returns Its text, or undefined when the project has no such file.
+ */
+function readConfigText(file) {
+    try {
+        return readFileSync(file, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Axes a project declares typed, read from its own `.lisa.config.json`.
+ *
+ * #2807: the design-value rule shipped installed, severity `"off"`, and arming
+ * it needed a severity AND a `typedAxes` option hand-written into
+ * `eslint.config.local.ts`. Nothing carried `design.tokens.axes` from
+ * `.lisa.config.json` to the rule, so a project could declare every axis,
+ * install the policy, pass every test, and enforce nothing.
+ *
+ * It is read HERE, at ESLint **config** load, rather than inside the rule at
+ * **rule** load. That distinction is what makes it unremarkable: the managed
+ * `eslint.config.ts` already reads `eslint.thresholds.json` and
+ * `eslint.ignore.config.json` from disk at exactly this moment, so this adds no
+ * new class of behaviour and gives ESLint's config cache nothing to fight. A
+ * rule reading project files on every `create()` would do both.
+ *
+ * It also needs no generation step, which is what the alternative — emitting
+ * rule options into a generated file during `lisa apply` — would have cost. A
+ * generated file can go stale against the config it was generated from; a value
+ * read at load cannot.
+ * @param projectRoot - Directory holding the project's `.lisa.config.json`.
+ * @returns The declared axes, or an empty list when none are declared.
+ * @throws {TypeError} When `design.tokens.axes` is present but is not a list of strings.
+ */
+export function readTypedAxes(projectRoot) {
+    const file = path.join(projectRoot, ".lisa.config.json");
+    const raw = readConfigText(file);
+    if (raw === undefined)
+        return [];
+    const axes = JSON.parse(raw)
+        .design?.tokens?.axes;
+    if (axes === undefined)
+        return [];
+    if (!Array.isArray(axes) || axes.some(axis => typeof axis !== "string")) {
+        // Coercing a malformed declaration to "no axes" would disarm the rule
+        // silently — #2807 reproduced one layer down. Refuse loudly instead.
+        throw new TypeError(`${file}: design.tokens.axes must be an array of axis names, e.g. ["color"].`);
+    }
+    return axes;
+}
+/**
+ * The `ui-standards/no-unbound-design-value` entry for a set of typed axes.
+ *
+ * Silence-by-default is deliberate and unchanged: an axis with no published
+ * variable collection behind it has no token to bind to, and a rule that fires
+ * on every project is a rule that gets switched off. What changes is that
+ * declaring an axis is now SUFFICIENT to arm it. Previously nothing was.
+ *
+ * An axis name outside the rule's fixed vocabulary is passed through rather
+ * than filtered out, so ESLint's own schema validation rejects it by name. A
+ * filter would turn a typo into silent non-enforcement, which is the defect
+ * this function exists to remove.
+ * @param typedAxes - Axes the project declares typed.
+ * @returns `"off"` when none are declared, an armed error entry otherwise.
+ */
+export function getDesignValueBindingRule(typedAxes) {
+    return typedAxes.length > 0
+        ? ["error", { typedAxes: [...typedAxes] }]
+        : "off";
+}
 /**
  * Creates the Expo ESLint configuration.
  * @param {object} options - Configuration options
@@ -39,9 +117,10 @@ const tailwind = require("eslint-plugin-tailwindcss");
  * @param {string[]} [options.ignorePatterns] - Patterns to ignore
  * @param {object} [options.thresholds] - Threshold overrides
  * @param {string} [options.sourceRoot] - Prefix for source-relative file globs (e.g. `"src/"` for the SDK 55+/56 `/src` convention; defaults to `""`)
+ * @param {string[]} [options.typedAxes] - Axes the project declares typed, mirroring `design.tokens.axes`. Empty leaves the design-value rule off.
  * @returns {import("eslint").Linter.Config[]} ESLint flat config array
  */
-export function getExpoConfig({ tsconfigRootDir, ignorePatterns = defaultIgnores, thresholds = defaultThresholds, sourceRoot = "", }) {
+export function getExpoConfig({ tsconfigRootDir, ignorePatterns = defaultIgnores, thresholds = defaultThresholds, sourceRoot = "", typedAxes = [], }) {
     return [
         // Global ignores
         {
@@ -84,10 +163,12 @@ export function getExpoConfig({ tsconfigRootDir, ignorePatterns = defaultIgnores
                 "ui-standards/no-classname-outside-ui": "off",
                 "ui-standards/no-direct-rn-imports": "off",
                 // Regime-aware by declaration: silent until the project names the axes
-                // it publishes design variables for. Activate per axis in
-                // eslint.config.local.ts, mirroring `design.tokens.axes` in
-                // .lisa.config.json — e.g. ["error", { typedAxes: ["color"] }].
-                "ui-standards/no-unbound-design-value": "off",
+                // it publishes design variables for. Declaring `design.tokens.axes` in
+                // .lisa.config.json is what arms it — the managed eslint.config.ts
+                // reads that key and hands it here (#2807). Declaring nothing leaves
+                // the rule off, which is the correct default and was previously the
+                // ONLY reachable state.
+                "ui-standards/no-unbound-design-value": getDesignValueBindingRule(typedAxes),
                 // Tailwind
                 "tailwindcss/classnames-order": [
                     "error",

package/dist/configs/eslint/expo.js.map

@@ -1 +1 @@
-{"version":3,"file":"expo.js","sourceRoot":"","sources":["../../../src/configs/eslint/expo.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E;;;;;;;;;;;;;GAaG;AACH,OAAO,MAAM,MAAM,sBAAsB,CAAC;AAC1C,OAAO,KAAK,MAAM,qBAAqB,CAAC;AACxC,OAAO,aAAa,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,yCAAyC;AACzC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAEzB,mCAAmC;AACnC,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,CAAC;AAEF,+EAA+E;AAC/E,kFAAkF;AAClF,uFAAuF;AACvF,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,kBAAkB,GAAG,OAAO,CAChC,aAAa,CACX,IAAI,GAAG,CACL,qDAAqD,EACrD,MAAM,CAAC,IAAI,CAAC,GAAG,CAChB,CACF,CACF,CAAC;AACF,MAAM,WAAW,GAAG,OAAO,CACzB,aAAa,CACX,IAAI,GAAG,CAAC,8CAA8C,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CACzE,CACF,CAAC;AACF,MAAM,UAAU,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;AACtD,MAAM,SAAS,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AACtD,MAAM,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,eAAe,EACf,cAAc,GAAG,cAAc,EAC/B,UAAU,GAAG,iBAAiB,EAC9B,UAAU,GAAG,EAAE,GAahB;IACC,OAAO;QACL,iBAAiB;QACjB;YACE,OAAO,EAAE,cAAc;SACxB;QAED,yCAAyC;QACzC,GAAG,cAAc,EAAE;QAEnB,+BAA+B;QAC/B,GAAG,UAAU;QAEb,uBAAuB;QACvB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW;QAC9B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;QAEjC,gBAAgB;QAChB,OAAO,CAAC,WAAW,CAAC,MAAM;QAE1B,eAAe;QACf,GAAG,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAEvC,cAAc;QACd,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW;QAElC,mCAAmC;QACnC;YACE,eAAe,EAAE;gBACf,GAAG,sBAAsB,EAAE;gBAC3B,aAAa,EAAE;oBACb,GAAG,sBAAsB,EAAE,CAAC,aAAa;oBACzC,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;iBAC5B;aACF;YACD,OAAO,EAAE;gBACP,qBAAqB,EAAE,kBAAkB;gBACzC,mBAAmB,EAAE,gBAAgB;gBACrC,gBAAgB,EAAE,aAAa;gBAC/B,cAAc,EAAE,WAAW;aAC5B;YACD,KAAK,EAAE;gBACL,yBAAyB;gBACzB,GAAG,cAAc,CAAC,UAAU,CAAC;gBAE7B,oBAAoB;gBACpB,2CAA2C,EAAE,OAAO;gBAEpD,oCAAoC;gBACpC,sCAAsC,EAAE,KAAK;gBAC7C,mCAAmC,EAAE,KAAK;gBAC1C,uEAAuE;gBACvE,0DAA0D;gBAC1D,4DAA4D;gBAC5D,gEAAgE;gBAChE,sCAAsC,EAAE,KAAK;gBAE7C,WAAW;gBACX,8BAA8B,EAAE;oBAC9B,OAAO;oBACP;wBACE,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC;qBAC3D;iBACF;gBAED,eAAe;gBACf,+DAA+D;gBAC/D,6BAA6B;gBAC7B,iBAAiB,EAAE,KAAK;gBACxB,kBAAkB,EAAE,KAAK;gBACzB,mEAAmE;gBACnE,sBAAsB,EAAE,KAAK,EAAE,wFAAwF;gBACvH,8BAA8B,EAAE,KAAK;gBACrC,sBAAsB,EAAE,OAAO;gBAE/B,oBAAoB;gBACpB,sCAAsC,EAAE,OAAO;gBAC/C,qCAAqC,EAAE,OAAO;gBAC9C,wCAAwC,EAAE,OAAO;gBAEjD,cAAc;gBACd,yCAAyC,EAAE,OAAO;gBAClD,sBAAsB,EAAE,KAAK;gBAC7B,0BAA0B,EAAE,KAAK;gBACjC,6BAA6B,EAAE,OAAO;gBACtC,4BAA4B,EAAE,OAAO;gBACrC,iCAAiC,EAAE,OAAO;gBAC1C,yCAAyC,EAAE,OAAO;gBAClD,kBAAkB,EAAE,OAAO;gBAC3B,0BAA0B,EAAE,OAAO;gBACnC,+DAA+D;gBAC/D,6BAA6B;gBAC7B,+BAA+B,EAAE,KAAK;gBACtC,+BAA+B,EAAE,KAAK;gBACtC,mEAAmE;gBACnE,6DAA6D;gBAC7D,+CAA+C;gBAC/C,sBAAsB,EAAE;oBACtB,OAAO;oBACP;wBACE,QAAQ,EACN,8DAA8D;wBAChE,OAAO,EACL,iIAAiI;qBACpI;iBACF;gBAED,4BAA4B;gBAC5B,YAAY,EAAE,MAAM;gBAEpB,oFAAoF;gBACpF,uBAAuB,EAAE,OAAO;gBAEhC,kEAAkE;gBAClE,qBAAqB,EAAE;oBACrB,OAAO;oBACP;wBACE,OAAO,EAAE;4BACP,mBAAmB,EAAE,IAAI;4BACzB,gBAAgB,EAAE,KAAK;4BACvB,gBAAgB,EAAE,KAAK;4BACvB,uBAAuB,EAAE,KAAK;4BAC9B,kBAAkB,EAAE,KAAK;yBAC1B;wBACD,QAAQ,EAAE;4BACR,wBAAwB;4BACxB,wBAAwB;4BACxB,iGAAiG;yBAClG;qBACF;iBACF;aACF;SACF;QAED,4BAA4B;QAC5B,kBAAkB,EAAE;QAEpB,8BAA8B;QAC9B,sBAAsB,EAAE;QAExB,gBAAgB;QAChB;YACE,KAAK,EAAE;gBACL,GAAG,UAAU,wBAAwB;gBACrC,GAAG,UAAU,wBAAwB;gBACrC,GAAG,UAAU,+BAA+B;gBAC5C,GAAG,UAAU,+BAA+B;aAC7C;YACD,KAAK,EAAE;gBACL,sCAAsC,EAAE,KAAK;aAC9C;SACF;QAED,gDAAgD;QAChD,oBAAoB,CAAC;YACnB,eAAe;YACf,eAAe;YACf,cAAc;YACd,cAAc;SACf,CAAC;QAEF,gEAAgE;QAChE;YACE,GAAG,kBAAkB,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC;YAC/D,KAAK,EAAE;gBACL,GAAG,kBAAkB,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC,KAAK;gBACrE,kBAAkB,EAAE,KAAK;aAC1B;SACF;QAED,qDAAqD;QACrD;YACE,KAAK,EAAE,CAAC,UAAU,CAAC;YACnB,KAAK,EAAE;gBACL,uBAAuB,EAAE,KAAK;aAC/B;SACF;QAED,qFAAqF;QACrF,sBAAsB,CAAC;YACrB,cAAc;YACd,eAAe;YACf,aAAa;YACb,cAAc;SACf,CAAC;QAEF,4BAA4B;QAC5B;YACE,KAAK,EAAE;gBACL,GAAG,UAAU,gCAAgC;gBAC7C,GAAG,UAAU,iCAAiC;gBAC9C,GAAG,UAAU,iCAAiC;gBAC9C,GAAG,UAAU,6BAA6B;gBAC1C,GAAG,UAAU,8BAA8B;gBAC3C,GAAG,UAAU,8BAA8B;gBAC3C,GAAG,UAAU,oBAAoB;gBACjC,GAAG,UAAU,qBAAqB;gBAClC,GAAG,UAAU,qBAAqB;aACnC;YACD,OAAO,EAAE;gBACP,GAAG,UAAU,kBAAkB;gBAC/B,GAAG,UAAU,sBAAsB;gBACnC,GAAG,UAAU,qBAAqB;aACnC;YACD,KAAK,EAAE;gBACL,iDAAiD,EAAE,OAAO;gBAC1D,+CAA+C,EAAE,OAAO;aACzD;SACF;QAED,uBAAuB;QACvB;YACE,KAAK,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC;YACvC,KAAK,EAAE;gBACL,uCAAuC,EAAE,OAAO;aACjD;SACF;QAED,kDAAkD;QAClD;YACE,KAAK,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC;YACvC,OAAO,EAAE,CAAC,GAAG,UAAU,kBAAkB,CAAC;YAC1C,KAAK,EAAE;gBACL,0CAA0C,EAAE,OAAO;aACpD;SACF;QAED,gEAAgE;QAChE,wEAAwE;QACxE,+CAA+C;QAC/C;YACE,KAAK,EAAE,CAAC,gBAAgB,EAAE,YAAY,EAAE,2BAA2B,CAAC;YACpE,KAAK,EAAE;gBACL,sBAAsB,EAAE,KAAK;aAC9B;SACF;QAED,oEAAoE;QACpE,kEAAkE;QAClE;YACE,KAAK,EAAE;gBACL,+BAA+B;gBAC/B,wBAAwB;gBACxB,2BAA2B;aAC5B;YACD,KAAK,EAAE;gBACL,sBAAsB,EAAE,KAAK;aAC9B;SACF;QAED,4DAA4D;QAC5D;YACE,KAAK,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,YAAY,CAAC;YACxD,KAAK,EAAE;gBACL,sBAAsB,EAAE,KAAK;aAC9B;SACF;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAC/B,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;QAElC,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,uBAAuB,EAAE;KACqB,CAAC;AACnD,CAAC;AAED,8EAA8E"}
+{"version":3,"file":"expo.js","sourceRoot":"","sources":["../../../src/configs/eslint/expo.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E;;;;;;;;;;;;;GAaG;AACH,OAAO,MAAM,MAAM,sBAAsB,CAAC;AAC1C,OAAO,KAAK,MAAM,qBAAqB,CAAC;AACxC,OAAO,aAAa,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,yCAAyC;AACzC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAEzB,mCAAmC;AACnC,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,CAAC;AAEF,+EAA+E;AAC/E,kFAAkF;AAClF,uFAAuF;AACvF,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,kBAAkB,GAAG,OAAO,CAChC,aAAa,CACX,IAAI,GAAG,CACL,qDAAqD,EACrD,MAAM,CAAC,IAAI,CAAC,GAAG,CAChB,CACF,CACF,CAAC;AACF,MAAM,WAAW,GAAG,OAAO,CACzB,aAAa,CACX,IAAI,GAAG,CAAC,8CAA8C,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CACzE,CACF,CAAC;AACF,MAAM,UAAU,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;AACtD,MAAM,SAAS,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AACtD,MAAM,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAEtD;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkD;SAC3E,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC;IACxB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,IAAI,SAAS,CACjB,GAAG,IAAI,sEAAsE,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,IAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAA4B;IAE5B,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;QAC1C,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,eAAe,EACf,cAAc,GAAG,cAAc,EAC/B,UAAU,GAAG,iBAAiB,EAC9B,UAAU,GAAG,EAAE,EACf,SAAS,GAAG,EAAE,GAoBf;IACC,OAAO;QACL,iBAAiB;QACjB;YACE,OAAO,EAAE,cAAc;SACxB;QAED,yCAAyC;QACzC,GAAG,cAAc,EAAE;QAEnB,+BAA+B;QAC/B,GAAG,UAAU;QAEb,uBAAuB;QACvB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW;QAC9B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;QAEjC,gBAAgB;QAChB,OAAO,CAAC,WAAW,CAAC,MAAM;QAE1B,eAAe;QACf,GAAG,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAEvC,cAAc;QACd,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW;QAElC,mCAAmC;QACnC;YACE,eAAe,EAAE;gBACf,GAAG,sBAAsB,EAAE;gBAC3B,aAAa,EAAE;oBACb,GAAG,sBAAsB,EAAE,CAAC,aAAa;oBACzC,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;iBAC5B;aACF;YACD,OAAO,EAAE;gBACP,qBAAqB,EAAE,kBAAkB;gBACzC,mBAAmB,EAAE,gBAAgB;gBACrC,gBAAgB,EAAE,aAAa;gBAC/B,cAAc,EAAE,WAAW;aAC5B;YACD,KAAK,EAAE;gBACL,yBAAyB;gBACzB,GAAG,cAAc,CAAC,UAAU,CAAC;gBAE7B,oBAAoB;gBACpB,2CAA2C,EAAE,OAAO;gBAEpD,oCAAoC;gBACpC,sCAAsC,EAAE,KAAK;gBAC7C,mCAAmC,EAAE,KAAK;gBAC1C,uEAAuE;gBACvE,uEAAuE;gBACvE,mEAAmE;gBACnE,qEAAqE;gBACrE,oEAAoE;gBACpE,wBAAwB;gBACxB,sCAAsC,EACpC,yBAAyB,CAAC,SAAS,CAAC;gBAEtC,WAAW;gBACX,8BAA8B,EAAE;oBAC9B,OAAO;oBACP;wBACE,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC;qBAC3D;iBACF;gBAED,eAAe;gBACf,+DAA+D;gBAC/D,6BAA6B;gBAC7B,iBAAiB,EAAE,KAAK;gBACxB,kBAAkB,EAAE,KAAK;gBACzB,mEAAmE;gBACnE,sBAAsB,EAAE,KAAK,EAAE,wFAAwF;gBACvH,8BAA8B,EAAE,KAAK;gBACrC,sBAAsB,EAAE,OAAO;gBAE/B,oBAAoB;gBACpB,sCAAsC,EAAE,OAAO;gBAC/C,qCAAqC,EAAE,OAAO;gBAC9C,wCAAwC,EAAE,OAAO;gBAEjD,cAAc;gBACd,yCAAyC,EAAE,OAAO;gBAClD,sBAAsB,EAAE,KAAK;gBAC7B,0BAA0B,EAAE,KAAK;gBACjC,6BAA6B,EAAE,OAAO;gBACtC,4BAA4B,EAAE,OAAO;gBACrC,iCAAiC,EAAE,OAAO;gBAC1C,yCAAyC,EAAE,OAAO;gBAClD,kBAAkB,EAAE,OAAO;gBAC3B,0BAA0B,EAAE,OAAO;gBACnC,+DAA+D;gBAC/D,6BAA6B;gBAC7B,+BAA+B,EAAE,KAAK;gBACtC,+BAA+B,EAAE,KAAK;gBACtC,mEAAmE;gBACnE,6DAA6D;gBAC7D,+CAA+C;gBAC/C,sBAAsB,EAAE;oBACtB,OAAO;oBACP;wBACE,QAAQ,EACN,8DAA8D;wBAChE,OAAO,EACL,iIAAiI;qBACpI;iBACF;gBAED,4BAA4B;gBAC5B,YAAY,EAAE,MAAM;gBAEpB,oFAAoF;gBACpF,uBAAuB,EAAE,OAAO;gBAEhC,kEAAkE;gBAClE,qBAAqB,EAAE;oBACrB,OAAO;oBACP;wBACE,OAAO,EAAE;4BACP,mBAAmB,EAAE,IAAI;4BACzB,gBAAgB,EAAE,KAAK;4BACvB,gBAAgB,EAAE,KAAK;4BACvB,uBAAuB,EAAE,KAAK;4BAC9B,kBAAkB,EAAE,KAAK;yBAC1B;wBACD,QAAQ,EAAE;4BACR,wBAAwB;4BACxB,wBAAwB;4BACxB,iGAAiG;yBAClG;qBACF;iBACF;aACF;SACF;QAED,4BAA4B;QAC5B,kBAAkB,EAAE;QAEpB,8BAA8B;QAC9B,sBAAsB,EAAE;QAExB,gBAAgB;QAChB;YACE,KAAK,EAAE;gBACL,GAAG,UAAU,wBAAwB;gBACrC,GAAG,UAAU,wBAAwB;gBACrC,GAAG,UAAU,+BAA+B;gBAC5C,GAAG,UAAU,+BAA+B;aAC7C;YACD,KAAK,EAAE;gBACL,sCAAsC,EAAE,KAAK;aAC9C;SACF;QAED,gDAAgD;QAChD,oBAAoB,CAAC;YACnB,eAAe;YACf,eAAe;YACf,cAAc;YACd,cAAc;SACf,CAAC;QAEF,gEAAgE;QAChE;YACE,GAAG,kBAAkB,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC;YAC/D,KAAK,EAAE;gBACL,GAAG,kBAAkB,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC,KAAK;gBACrE,kBAAkB,EAAE,KAAK;aAC1B;SACF;QAED,qDAAqD;QACrD;YACE,KAAK,EAAE,CAAC,UAAU,CAAC;YACnB,KAAK,EAAE;gBACL,uBAAuB,EAAE,KAAK;aAC/B;SACF;QAED,qFAAqF;QACrF,sBAAsB,CAAC;YACrB,cAAc;YACd,eAAe;YACf,aAAa;YACb,cAAc;SACf,CAAC;QAEF,4BAA4B;QAC5B;YACE,KAAK,EAAE;gBACL,GAAG,UAAU,gCAAgC;gBAC7C,GAAG,UAAU,iCAAiC;gBAC9C,GAAG,UAAU,iCAAiC;gBAC9C,GAAG,UAAU,6BAA6B;gBAC1C,GAAG,UAAU,8BAA8B;gBAC3C,GAAG,UAAU,8BAA8B;gBAC3C,GAAG,UAAU,oBAAoB;gBACjC,GAAG,UAAU,qBAAqB;gBAClC,GAAG,UAAU,qBAAqB;aACnC;YACD,OAAO,EAAE;gBACP,GAAG,UAAU,kBAAkB;gBAC/B,GAAG,UAAU,sBAAsB;gBACnC,GAAG,UAAU,qBAAqB;aACnC;YACD,KAAK,EAAE;gBACL,iDAAiD,EAAE,OAAO;gBAC1D,+CAA+C,EAAE,OAAO;aACzD;SACF;QAED,uBAAuB;QACvB;YACE,KAAK,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC;YACvC,KAAK,EAAE;gBACL,uCAAuC,EAAE,OAAO;aACjD;SACF;QAED,kDAAkD;QAClD;YACE,KAAK,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC;YACvC,OAAO,EAAE,CAAC,GAAG,UAAU,kBAAkB,CAAC;YAC1C,KAAK,EAAE;gBACL,0CAA0C,EAAE,OAAO;aACpD;SACF;QAED,gEAAgE;QAChE,wEAAwE;QACxE,+CAA+C;QAC/C;YACE,KAAK,EAAE,CAAC,gBAAgB,EAAE,YAAY,EAAE,2BAA2B,CAAC;YACpE,KAAK,EAAE;gBACL,sBAAsB,EAAE,KAAK;aAC9B;SACF;QAED,oEAAoE;QACpE,kEAAkE;QAClE;YACE,KAAK,EAAE;gBACL,+BAA+B;gBAC/B,wBAAwB;gBACxB,2BAA2B;aAC5B;YACD,KAAK,EAAE;gBACL,sBAAsB,EAAE,KAAK;aAC9B;SACF;QAED,4DAA4D;QAC5D;YACE,KAAK,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,YAAY,CAAC;YACxD,KAAK,EAAE;gBACL,sBAAsB,EAAE,KAAK;aAC9B;SACF;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAC/B,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;QAElC,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,uBAAuB,EAAE;KACqB,CAAC;AACnD,CAAC;AAED,8EAA8E"}

package/dist/core/downstream-names.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Shortest name that may be added at runtime.
+ *
+ * A three-character entry matches an initialism somewhere in almost any
+ * repository. Refusing it is the difference between a list with no
+ * false-positive problem and a list that reintroduces the one the shape guard
+ * was written to avoid.
+ */
+export declare const MIN_NAME_LENGTH = 5;
+/**
+ * Strip a name to the form the digests are taken over.
+ *
+ * Case and separators are spelling, not identity: `Some-Host`, `some host` and
+ * `SomeHost` are one name.
+ * @param raw - A name or a candidate span of source text.
+ * @returns Lowercased, alphanumerics only.
+ */
+export declare function normalizeName(raw: string): string;
+/**
+ * The stored form of one name: its normalized length, then its digest.
+ *
+ * The length is carried in the clear on purpose. It is what lets a scan reject
+ * the overwhelming majority of candidate spellings with an integer comparison
+ * instead of a hash, and knowing that some name is eight characters long
+ * identifies nobody.
+ * @param raw - The name to encode.
+ * @returns `"<length>:<digest>"`.
+ */
+export declare function nameEntry(raw: string): string;
+/**
+ * Host org and company names, as entries.
+ *
+ * Org and company slugs only. The two other identity shapes this repository
+ * carries — host repository names and a host tracker's project-key prefix — are
+ * deliberately absent; arming them is a several-hundred-file rewrite and an
+ * owner decision, not a cleanup. See
+ * `.agents/rules/never-name-downstream-projects.md` for how to add one.
+ *
+ * Sorted, so the order of this array says nothing about the order the names
+ * were added or how they relate to each other.
+ */
+export declare const HOST_NAME_ENTRIES: readonly string[];
+/** Environment variable carrying extra names, comma-separated, in plaintext. */
+export declare const NAME_ENV_VAR = "LISA_DOWNSTREAM_NAMES";
+/**
+ * Everything a scan needs to test a candidate span, prepared once.
+ *
+ * `lengths` is not a convenience: deriving it per line would cost more than the
+ * matching does, and it is the filter that lets almost every candidate be
+ * rejected on an integer comparison instead of a hash.
+ */
+export interface NameMatcher {
+    /** `"<length>:<digest>"` for every known name. */
+    readonly entries: ReadonlySet<string>;
+    /** Every normalized length present in {@link entries}. */
+    readonly lengths: ReadonlySet<number>;
+    /** The longest normalized length present, used to stop widening a window. */
+    readonly maxLength: number;
+}
+/**
+ * The matcher a scan should use: the committed entries plus any supplied by
+ * the environment.
+ *
+ * Environment names shorter than {@link MIN_NAME_LENGTH} are dropped rather
+ * than rejected loudly — a scan is not the place to fail a run over a malformed
+ * environment variable, and a silently-ignored short name is visible the moment
+ * anyone checks whether the guard bites.
+ * @param env - Environment to read; defaults to the process environment.
+ * @returns A prepared matcher.
+ */
+export declare function hostNameEntries(env?: NodeJS.ProcessEnv): NameMatcher;
+/**
+ * Every span of one line that spells a known host name.
+ *
+ * Matching is anchored to word boundaries at both ends, which is what keeps a
+ * name from firing inside a longer word: an entry for `somehost` does not match
+ * `somehosting`.
+ * @param text - The line to scan.
+ * @param matcher - Prepared matcher from {@link hostNameEntries}.
+ * @returns The matched source spans, in order.
+ */
+export declare function findHostNames(text: string, matcher: NameMatcher): readonly string[];
+//# sourceMappingURL=downstream-names.d.ts.map

package/dist/core/downstream-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"downstream-names.d.ts","sourceRoot":"","sources":["../../src/core/downstream-names.ts"],"names":[],"mappings":"AAgFA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AAEjC;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQ7C;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAQ9C,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,YAAY,0BAA0B,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AA+CD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,MAAM,CAAC,UAA6B,GACxC,WAAW,CAQb;AA0FD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,GACnB,SAAS,MAAM,EAAE,CAKnB"}

package/dist/core/downstream-names.js

@@ -0,0 +1,289 @@
+/**
+ * The fixed list of host-project names the shape guard cannot see, stored so
+ * the list itself is never published.
+ *
+ * `downstream-references.ts` detects a *shape* — `github.com/owner/repo` and
+ * workflow `uses:` — and deliberately refuses to match bare `a/b` in prose,
+ * because that shape collides with file paths, date fractions and option
+ * syntax, and a guard with false positives gets disabled. That reasoning is
+ * sound and is left intact. It is also, measured on this repository, blind to
+ * every occurrence that actually happens: a host name in running prose, in a
+ * code comment, or inside a local absolute path, with no `github.com` in front
+ * of it and frequently no slash anywhere in it.
+ *
+ * A known list has no false-positive problem at all, which is the entire
+ * objection to widening the regex — a token either is one of a handful of known
+ * names or it is not, and `2026/08/20`, `src/core/index.ts` and `--flag=a/b`
+ * are none of them. The recorded objection to a list was different: a plaintext
+ * denylist in a public repository publishes the very names it exists to
+ * protect.
+ *
+ * **So the names are stored as truncated salted digests.** Be precise about
+ * what that buys, because overclaiming here would be worse than not doing it:
+ *
+ * - It prevents *enumeration*. Nobody can read this file, grep it, or receive
+ *   it in an npm tarball and come away with a list of names.
+ * - It does **not** prevent *confirmation*. Anyone holding a specific guess can
+ *   hash it and check. That is unavoidable for any in-tree denylist — the guard
+ *   must be able to answer "is this token a host name?", and so must anyone
+ *   holding the data that lets it. Truncation to 40 bits blunts even that:
+ *   a brute force over plausible slugs returns thousands of preimages per
+ *   digest, so a recovered candidate is not a recovered name.
+ *
+ * A name too sensitive to appear even as a digest belongs in
+ * `LISA_DOWNSTREAM_NAMES` instead — an out-of-tree, environment-supplied
+ * extension. The cost of that choice is stated plainly: an environment
+ * variable absent from required CI means the guard bites locally and not in
+ * CI, so it is the weaker of the two placements, not the stronger.
+ * @module core/downstream-names
+ */
+import { createHash } from "node:crypto";
+/**
+ * Domain separator mixed into every digest.
+ *
+ * Not a secret — it ships in this file and must, because required CI has to
+ * reproduce the digests. Its job is to make these values specific to this
+ * guard, so a digest here cannot be matched against a digest computed anywhere
+ * else for any other purpose.
+ */
+const DIGEST_SALT = "lisa/downstream-name/v1";
+/**
+ * Hex characters kept from each SHA-256 digest — 40 bits.
+ *
+ * Chosen against two opposing errors. Too wide and each digest has a single
+ * preimage, which turns "you can test a guess" into "you can recover the
+ * name". Too narrow and unrelated text collides: the tracked tree yields on the
+ * order of 10^7 candidate spellings per scan, so at 32 bits a handful of
+ * entries would be expected to produce a spurious hit roughly once every few
+ * dozen runs — a flaky guard, which is a disabled guard.
+ */
+const DIGEST_HEX_LENGTH = 10;
+/**
+ * Most words one name may span.
+ *
+ * Covers a company name written out in full (`Some Host Systems`) without
+ * paying for windows nobody uses.
+ */
+const MAX_NAME_WORDS = 3;
+/**
+ * The single characters allowed to sit between two words of one name.
+ *
+ * A name may be written spaced, hyphenated, underscored, dotted or slashed, and
+ * all of those must reach the same entry. A sentence boundary must not: `". "`
+ * is two characters, so `…the api. Creator of…` cannot join into `apicreator`.
+ */
+const NAME_SEPARATORS = new Set([" ", "-", "_", ".", "/", "\\"]);
+/**
+ * Shortest name that may be added at runtime.
+ *
+ * A three-character entry matches an initialism somewhere in almost any
+ * repository. Refusing it is the difference between a list with no
+ * false-positive problem and a list that reintroduces the one the shape guard
+ * was written to avoid.
+ */
+export const MIN_NAME_LENGTH = 5;
+/**
+ * Strip a name to the form the digests are taken over.
+ *
+ * Case and separators are spelling, not identity: `Some-Host`, `some host` and
+ * `SomeHost` are one name.
+ * @param raw - A name or a candidate span of source text.
+ * @returns Lowercased, alphanumerics only.
+ */
+export function normalizeName(raw) {
+    return raw.toLowerCase().replaceAll(/[^a-z0-9]+/gu, "");
+}
+/**
+ * The stored form of one name: its normalized length, then its digest.
+ *
+ * The length is carried in the clear on purpose. It is what lets a scan reject
+ * the overwhelming majority of candidate spellings with an integer comparison
+ * instead of a hash, and knowing that some name is eight characters long
+ * identifies nobody.
+ * @param raw - The name to encode.
+ * @returns `"<length>:<digest>"`.
+ */
+export function nameEntry(raw) {
+    const normalized = normalizeName(raw);
+    const digest = createHash("sha256")
+        .update(DIGEST_SALT)
+        .update(normalized)
+        .digest("hex")
+        .slice(0, DIGEST_HEX_LENGTH);
+    return `${normalized.length}:${digest}`;
+}
+/**
+ * Host org and company names, as entries.
+ *
+ * Org and company slugs only. The two other identity shapes this repository
+ * carries — host repository names and a host tracker's project-key prefix — are
+ * deliberately absent; arming them is a several-hundred-file rewrite and an
+ * owner decision, not a cleanup. See
+ * `.agents/rules/never-name-downstream-projects.md` for how to add one.
+ *
+ * Sorted, so the order of this array says nothing about the order the names
+ * were added or how they relate to each other.
+ */
+export const HOST_NAME_ENTRIES = [
+    "10:53a6dbd968",
+    "12:b6c1d2ff60",
+    "14:503e0725ea",
+    "6:cd2afeda7f",
+    "7:bf13141dea",
+    "8:3ad5ab7f19",
+    "8:c712a72605",
+];
+/** Environment variable carrying extra names, comma-separated, in plaintext. */
+export const NAME_ENV_VAR = "LISA_DOWNSTREAM_NAMES";
+/**
+ * Read the process environment through one narrow, reviewable exception.
+ *
+ * The ban exists so application code reaches configuration through a config
+ * service. This is a repository scanner with no project config to reach, and
+ * the variable it reads is the escape hatch for a name too sensitive to commit
+ * even as a digest.
+ * @returns The current process environment.
+ */
+function readProcessEnv() {
+    // eslint-disable-next-line no-restricted-syntax -- a repository scanner has no config service to read
+    return process.env;
+}
+/**
+ * Matchers already built, keyed by the environment value they were built from.
+ *
+ * Returning the same object for the same environment is what makes the
+ * per-matcher answer cache reachable across files; rebuilding per file would
+ * leave every scan hashing from cold. In practice this holds one entry.
+ */
+const built = new Map();
+/**
+ * Assemble a matcher from the committed entries plus a raw environment value.
+ * @param raw - Comma-separated extra names, possibly empty.
+ * @returns A prepared matcher.
+ */
+function buildMatcher(raw) {
+    const extra = raw
+        .split(",")
+        .map(part => normalizeName(part))
+        .filter(name => name.length >= MIN_NAME_LENGTH)
+        .map(name => nameEntry(name));
+    const entries = new Set([...HOST_NAME_ENTRIES, ...extra]);
+    const lengths = [...entries].map(entry => Number(entry.slice(0, entry.indexOf(":"))));
+    return {
+        entries,
+        lengths: new Set(lengths),
+        maxLength: Math.max(0, ...lengths),
+    };
+}
+/**
+ * The matcher a scan should use: the committed entries plus any supplied by
+ * the environment.
+ *
+ * Environment names shorter than {@link MIN_NAME_LENGTH} are dropped rather
+ * than rejected loudly — a scan is not the place to fail a run over a malformed
+ * environment variable, and a silently-ignored short name is visible the moment
+ * anyone checks whether the guard bites.
+ * @param env - Environment to read; defaults to the process environment.
+ * @returns A prepared matcher.
+ */
+export function hostNameEntries(env = readProcessEnv()) {
+    const raw = env[NAME_ENV_VAR] ?? "";
+    const existing = built.get(raw);
+    if (existing !== undefined)
+        return existing;
+    const matcher = buildMatcher(raw);
+    // eslint-disable-next-line functional/immutable-data -- a pure memo of a pure function; it changes how long an answer takes, never the answer
+    built.set(raw, matcher);
+    return matcher;
+}
+/** Maximal runs of alphanumerics — the only thing a name can be made of. */
+const WORD = /[A-Za-z0-9]+/gu;
+/**
+ * Per-matcher memo of which candidate spellings are names.
+ *
+ * A repository scan asks about the same handful of words several million times,
+ * and a digest costs three orders of magnitude more than a map lookup. Keyed by
+ * matcher rather than globally, because the answer depends on which entries are
+ * loaded — one shared cache would let a matcher answer another matcher's
+ * question, which is how a guard starts reporting a stale verdict.
+ */
+const answered = new WeakMap();
+/**
+ * Whether a candidate spelling is one of the known names.
+ * @param candidate - Alphanumerics only, in whatever case the source used.
+ * @param matcher - Prepared matcher.
+ * @returns True when the candidate hashes to a known entry.
+ */
+function isKnownName(candidate, matcher) {
+    const cache = answered.get(matcher) ?? new Map();
+    if (!answered.has(matcher))
+        answered.set(matcher, cache);
+    const remembered = cache.get(candidate);
+    if (remembered !== undefined)
+        return remembered;
+    const known = matcher.entries.has(nameEntry(candidate));
+    // eslint-disable-next-line functional/immutable-data -- same memo, same guarantee
+    cache.set(candidate, known);
+    return known;
+}
+/**
+ * Whether `next` continues the name that `previous` started.
+ *
+ * Exactly one separator may sit between them. A sentence boundary is two
+ * characters, so `the api. Creator of` cannot join into `apicreator`.
+ * @param text - The line both words came from.
+ * @param previous - The earlier word match.
+ * @param next - The later word match.
+ * @returns True when the two words belong to one name.
+ */
+function continues(text, previous, next) {
+    const gap = previous.index + previous[0].length;
+    return next.index - gap === 1 && NAME_SEPARATORS.has(text[gap] ?? "");
+}
+/* eslint-disable functional/no-let, functional/immutable-data -- a scan this size cannot afford an allocation per word, and neither accumulator escapes the call */
+/**
+ * Every span starting at one word that spells a known host name.
+ *
+ * The window stops widening as soon as it is longer than the longest known
+ * name, because adding a word can only make it longer still.
+ * @param text - The line being scanned.
+ * @param words - Every word on the line.
+ * @param first - Index of the word the window starts at.
+ * @param matcher - Prepared matcher.
+ * @returns The matched source spans.
+ */
+function namesStartingAt(text, words, first, matcher) {
+    const start = words[first]?.index ?? 0;
+    const found = [];
+    let candidate = "";
+    let previous;
+    for (const word of words.slice(first, first + MAX_NAME_WORDS)) {
+        if (previous !== undefined && !continues(text, previous, word))
+            break;
+        previous = word;
+        candidate += word[0];
+        if (candidate.length > matcher.maxLength)
+            break;
+        if (matcher.lengths.has(candidate.length) &&
+            isKnownName(candidate, matcher)) {
+            found.push(text.slice(start, word.index + word[0].length));
+        }
+    }
+    return found;
+}
+/* eslint-enable functional/no-let, functional/immutable-data -- back to repository defaults */
+/**
+ * Every span of one line that spells a known host name.
+ *
+ * Matching is anchored to word boundaries at both ends, which is what keeps a
+ * name from firing inside a longer word: an entry for `somehost` does not match
+ * `somehosting`.
+ * @param text - The line to scan.
+ * @param matcher - Prepared matcher from {@link hostNameEntries}.
+ * @returns The matched source spans, in order.
+ */
+export function findHostNames(text, matcher) {
+    const words = [...text.matchAll(WORD)];
+    return words.flatMap((_word, first) => namesStartingAt(text, words, first, matcher));
+}
+//# sourceMappingURL=downstream-names.js.map

package/dist/core/downstream-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"downstream-names.js","sourceRoot":"","sources":["../../src/core/downstream-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAE9C;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,WAAW,CAAC;SACnB,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC/B,OAAO,GAAG,UAAU,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,eAAe;IACf,eAAe;IACf,eAAe;IACf,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;CACf,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAkBpD;;;;;;;;GAQG;AACH,SAAS,cAAc;IACrB,sGAAsG;IACtG,OAAO,OAAO,CAAC,GAAG,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;AAE7C;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;SAChC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC;SAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,iBAAiB,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CACvC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAC3C,CAAC;IACF,OAAO;QACL,OAAO;QACP,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC;QACzB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAyB,cAAc,EAAE;IAEzC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,8IAA8I;IAC9I,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4EAA4E;AAC5E,MAAM,IAAI,GAAG,gBAAgB,CAAC;AAE9B;;;;;;;;GAQG;AACH,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAqC,CAAC;AAElE;;;;;GAKG;AACH,SAAS,WAAW,CAAC,SAAiB,EAAE,OAAoB;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAmB,CAAC;IAClE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACxD,kFAAkF;IAClF,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAChB,IAAY,EACZ,QAAyB,EACzB,IAAqB;IAErB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,IAAI,CAAC,KAAK,GAAG,GAAG,KAAK,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,oKAAoK;AACpK;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CACtB,IAAY,EACZ,KAAiC,EACjC,KAAa,EACb,OAAoB;IAEpB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,QAAqC,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,cAAc,CAAC,EAAE,CAAC;QAC9D,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC;YAAE,MAAM;QACtE,QAAQ,GAAG,IAAI,CAAC;QAChB,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS;YAAE,MAAM;QAChD,IACE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC;YACrC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,EAC/B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,+FAA+F;AAE/F;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,OAAoB;IAEpB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACpC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAC7C,CAAC;AACJ,CAAC"}

package/dist/core/downstream-references.d.ts

@@ -5,13 +5,26 @@
  * public and `dist/` is in the npm `files` allowlist, so a comment in `src/` is
  * published twice — on github.com and to every consumer that installs.
  *
- * **Shape detection, not a name list.** A guard that enumerated the client
- * names would publish the very list it exists to protect, in the same public
- * repository. So this allowlists the orgs that are legitimately public and
- * flags everything else, which also means a NEW downstream project is caught
- * without anyone remembering to add it.
+ * **Two detectors, because one shape was never the whole problem.**
+ *
+ * The first is shape detection: allowlist the orgs that are legitimately
+ * public, flag every other `github.com/owner/repo` or workflow `uses:`, and a
+ * newly onboarded downstream project is caught without anyone remembering to
+ * add it. That reach is real and it is kept.
+ *
+ * The second is a known-name check, added because the first measured zero
+ * violations on a tree that had them. Every occurrence that actually happens is
+ * a bare name in prose, in a code comment, or inside a local absolute path —
+ * no `github.com` in front of it, and frequently no slash in it at all. Shape
+ * detection cannot reach that without matching bare `a/b` everywhere, which
+ * collides with file paths, date fractions and option syntax; a guard with
+ * false positives gets disabled, which is worse than a known blind spot. A
+ * fixed list has no false-positive problem to trade against, and the objection
+ * to a list — that it publishes the names — is answered by storing digests
+ * rather than names. See `./downstream-names.js`.
  * @module core/downstream-references
  */
+import type { NameMatcher } from "./downstream-names.js";
 /**
  * GitHub orgs this repository may legitimately name.
  *
@@ -46,7 +59,9 @@ export interface DownstreamReference {
 /**
  * Find downstream-project references in one file's contents.
  * @param contents - The file's text.
+ * @param matcher - Name matcher to use; defaults to the committed list plus
+ *   anything the environment adds.
  * @returns Every violation found, in line order.
  */
-export declare function findDownstreamReferences(contents: string): readonly DownstreamReference[];
+export declare function findDownstreamReferences(contents: string, matcher?: NameMatcher): readonly DownstreamReference[];
 //# sourceMappingURL=downstream-references.d.ts.map