@fairfox/polly 0.47.0 → 0.50.0

package/dist/tools/quality/src/cli.js

@@ -1455,15 +1455,157 @@ async function runAttest(opts) {
   };
 }
 // tools/quality/src/config.ts
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 
 // tools/quality/src/plugins/core.ts
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 import { Glob as Glob5 } from "bun";
 
-// tools/quality/src/plugins/core-checks.ts
+// tools/quality/src/plugins/cliche-checks.ts
 import { readdir as readdir3 } from "node:fs/promises";
 import { join as join6, relative as relative3 } from "node:path";
+var SKIP_DIRS_DEFAULT = ["node_modules", ".git", "dist", ".bun", ".cache", "build", "coverage"];
+var DEFAULT_CODE_ZONES = ["src", "tools", "cli", "scripts", "recipes", "examples"];
+var DEFAULT_CODE_EXTENSIONS = [".ts", ".tsx"];
+var BANNER_RE = /^\s*\/\/.*(?:[=]{5,}|[-]{10,}|[─━═]{3,})/;
+var DECORATIVE_EMOJI_RE = /[\u{1F680}\u{2728}\u{1F3AF}\u{1F389}\u{26A1}\u{1F4E6}\u{1F9E9}]/u;
+var MARKETING_RE = /\b(comprehensive|robust|elegantly?|seamless(ly)?|leverages?|utili[sz]es?|ensures? that)\b/i;
+var NOTE_PREFIX_RE = /^\s*\/\/\s*(Note|Important|Warning|TIP|NB)\s*:/;
+var COMMENTED_CODE_RE = /^\s*\/\/\s+(import|const|let|var|function|class|return|if|for|while|export)\b/;
+var ALLOW_LINE_RE = /\/\/\s*audit-allow:\s*([\w-]+)/;
+function isLineAllowed(line, kind) {
+  const match = line.match(ALLOW_LINE_RE);
+  return match !== null && match[1] === kind;
+}
+function matchesExtension(name, extensions) {
+  const dotIdx = name.lastIndexOf(".");
+  if (dotIdx < 0)
+    return false;
+  return extensions.has(name.slice(dotIdx));
+}
+async function walkFilesByExt(dir, skipDirs, extensions, out) {
+  let entries;
+  try {
+    entries = await readdir3(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const fullPath = join6(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (skipDirs.has(entry.name) || entry.name.startsWith("."))
+        continue;
+      await walkFilesByExt(fullPath, skipDirs, extensions, out);
+    } else if (entry.isFile() && matchesExtension(entry.name, extensions)) {
+      out.push(fullPath);
+    }
+  }
+}
+function resolveCliche(cfg) {
+  const c = cfg ?? {};
+  return {
+    zones: c.zones ?? DEFAULT_CODE_ZONES,
+    skipDirs: new Set(c.skipDirs ?? SKIP_DIRS_DEFAULT),
+    allowFiles: new Set(c.allowFiles ?? []),
+    extensions: new Set(c.extensions ?? DEFAULT_CODE_EXTENSIONS)
+  };
+}
+async function collectClicheFiles(rootDir, cfg) {
+  const { zones, skipDirs, allowFiles, extensions } = resolveCliche(cfg);
+  const files = [];
+  for (const zone of zones) {
+    await walkFilesByExt(join6(rootDir, zone), skipDirs, extensions, files);
+  }
+  return { files, allowFiles };
+}
+function scanFile2(content, rel, pattern, allowKind) {
+  const out = [];
+  const lines = content.split(`
+`);
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    if (pattern.test(line) && !isLineAllowed(line, allowKind)) {
+      out.push(`${rel}:${i + 1}: ${line.trim()}`);
+    }
+  }
+  return out;
+}
+function makeClicheCheck(id, description, pattern, allowKind) {
+  return {
+    id,
+    description,
+    filesRead: async (cfg, root) => {
+      const { files, allowFiles } = await collectClicheFiles(root, cfg);
+      return files.filter((p) => !allowFiles.has(relative3(root, p)));
+    },
+    run: async ({ rootDir, config }) => {
+      const { files, allowFiles } = await collectClicheFiles(rootDir, config);
+      const violations = [];
+      for (const filePath of files) {
+        const rel = relative3(rootDir, filePath);
+        if (allowFiles.has(rel))
+          continue;
+        const content = await Bun.file(filePath).text();
+        violations.push(...scanFile2(content, rel, pattern, allowKind));
+      }
+      return { ok: violations.length === 0, messages: violations };
+    }
+  };
+}
+var noBanners = makeClicheCheck("polly:no-banners", "Ban decorative comment dividers (// ─────, // =====, // ----------)", BANNER_RE, "banner");
+var noDecorativeEmoji = makeClicheCheck("polly:no-decorative-emoji", "Ban a small set of Unicode emoji used as decorative flair in source", DECORATIVE_EMOJI_RE, "emoji");
+var noNotePrefix = makeClicheCheck("polly:no-note-prefix", "Ban `// Note:` / `// Important:` / `// Warning:` / `// TIP:` / `// NB:` comment prefixes", NOTE_PREFIX_RE, "note-prefix");
+var noCommentedCode = makeClicheCheck("polly:no-commented-code", "Ban single-line commented-out source (lines starting with `// import|const|let|...`)", COMMENTED_CODE_RE, "commented-code");
+var DEFAULT_MARKETING_ZONES = [...DEFAULT_CODE_ZONES, "docs"];
+var DEFAULT_MARKETING_EXTENSIONS = [".ts", ".tsx", ".md"];
+function resolveMarketing(cfg) {
+  const c = cfg ?? {};
+  return {
+    zones: c.zones ?? DEFAULT_MARKETING_ZONES,
+    skipDirs: new Set(c.skipDirs ?? SKIP_DIRS_DEFAULT),
+    allowFiles: new Set(c.allowFiles ?? []),
+    extensions: new Set(c.extensions ?? DEFAULT_MARKETING_EXTENSIONS)
+  };
+}
+var noMarketing = {
+  id: "polly:no-marketing",
+  description: 'Ban marketing language ("comprehensive / robust / seamless / leverages / ensures that") in source and docs',
+  filesRead: async (cfg, root) => {
+    const { zones, skipDirs, extensions, allowFiles } = resolveMarketing(cfg);
+    const out = [];
+    for (const zone of zones) {
+      await walkFilesByExt(join6(root, zone), skipDirs, extensions, out);
+    }
+    return out.filter((p) => !allowFiles.has(relative3(root, p)));
+  },
+  run: async ({ rootDir, config }) => {
+    const { zones, skipDirs, extensions, allowFiles } = resolveMarketing(config);
+    const violations = [];
+    for (const zone of zones) {
+      const files = [];
+      await walkFilesByExt(join6(rootDir, zone), skipDirs, extensions, files);
+      for (const filePath of files) {
+        const rel = relative3(rootDir, filePath);
+        if (allowFiles.has(rel))
+          continue;
+        const content = await Bun.file(filePath).text();
+        violations.push(...scanFile2(content, rel, MARKETING_RE, "no-marketing"));
+      }
+    }
+    return { ok: violations.length === 0, messages: violations };
+  }
+};
+var clicheCoreChecks = [
+  noBanners,
+  noDecorativeEmoji,
+  noMarketing,
+  noNotePrefix,
+  noCommentedCode
+];
+
+// tools/quality/src/plugins/core-checks.ts
+import { readdir as readdir4 } from "node:fs/promises";
+import { join as join7, relative as relative4 } from "node:path";
 async function semgrepInstalled() {
   const which = Bun.spawn(["which", "semgrep"], { stdout: "ignore", stderr: "ignore" });
   await which.exited;
@@ -1522,7 +1664,7 @@ function isTestFile(rel) {
 function resolveTargetZone(specifier, fromFile, rootDir) {
   if (!specifier.startsWith(".") && !specifier.startsWith("/"))
     return null;
-  const fromDir = relative3(rootDir, fromFile).split("/").slice(0, -1).join("/");
+  const fromDir = relative4(rootDir, fromFile).split("/").slice(0, -1).join("/");
   const segments = `${fromDir}/${specifier}`.split("/");
   const resolved = [];
   for (const seg of segments) {
@@ -1539,12 +1681,12 @@ function resolveTargetZone(specifier, fromFile, rootDir) {
 async function collectScannableFiles(dir, skipDirs, out) {
   let entries;
   try {
-    entries = await readdir3(dir, { withFileTypes: true });
+    entries = await readdir4(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
-    const fullPath = join6(dir, entry.name);
+    const fullPath = join7(dir, entry.name);
     if (entry.isDirectory()) {
       if (!skipDirs.has(entry.name))
         await collectScannableFiles(fullPath, skipDirs, out);
@@ -1586,7 +1728,7 @@ function scanLineForBoundary(line, ctx) {
   return out;
 }
 function scanFileForBoundaryViolations(filePath, content, rootDir, zone, bans) {
-  const rel = relative3(rootDir, filePath);
+  const rel = relative4(rootDir, filePath);
   const lines = content.split(`
 `);
   const out = [];
@@ -1610,9 +1752,9 @@ var boundaries = {
     const skipDirs = new Set(c.skipDirs ?? DEFAULT_BOUNDARIES.skipDirs ?? []);
     const out = [];
     for (const zone of c.zones ?? DEFAULT_BOUNDARIES.zones ?? []) {
-      await collectScannableFiles(join6(root, zone), skipDirs, out);
+      await collectScannableFiles(join7(root, zone), skipDirs, out);
     }
-    return out.filter((p) => !isTestFile(relative3(root, p)));
+    return out.filter((p) => !isTestFile(relative4(root, p)));
   },
   run: async ({ rootDir, config }) => {
     const c = { ...DEFAULT_BOUNDARIES, ...config ?? {} };
@@ -1622,12 +1764,12 @@ var boundaries = {
     const all = [];
     for (const zone of zones) {
       const files = [];
-      await collectScannableFiles(join6(rootDir, zone), skipDirs, files);
+      await collectScannableFiles(join7(rootDir, zone), skipDirs, files);
       const fromBans = bans[zone] ?? [];
       if (fromBans.length === 0)
         continue;
       for (const filePath of files) {
-        if (isTestFile(relative3(rootDir, filePath)))
+        if (isTestFile(relative4(rootDir, filePath)))
           continue;
         const content = await Bun.file(filePath).text();
         all.push(...scanFileForBoundaryViolations(filePath, content, rootDir, zone, fromBans));
@@ -1707,9 +1849,9 @@ var serverImports = {
     const allow = new Set(c.allowFiles ?? []);
     const out = [];
     for (const p of c.browserPaths ?? DEFAULT_SERVER_IMPORTS.browserPaths) {
-      await collectScannableFiles(join6(root, p), skipDirs, out);
+      await collectScannableFiles(join7(root, p), skipDirs, out);
     }
-    return out.filter((p) => !isExcludedFromServerCheck(relative3(root, p), allow));
+    return out.filter((p) => !isExcludedFromServerCheck(relative4(root, p), allow));
   },
   run: async ({ rootDir, config }) => {
     const c = config ?? {};
@@ -1719,9 +1861,9 @@ var serverImports = {
     const violations = [];
     for (const p of c.browserPaths ?? DEFAULT_SERVER_IMPORTS.browserPaths) {
       const files = [];
-      await collectScannableFiles(join6(rootDir, p), skipDirs, files);
+      await collectScannableFiles(join7(rootDir, p), skipDirs, files);
       for (const filePath of files) {
-        const rel = relative3(rootDir, filePath);
+        const rel = relative4(rootDir, filePath);
         if (isExcludedFromServerCheck(rel, allow))
           continue;
         const content = await Bun.file(filePath).text();
@@ -1738,10 +1880,10 @@ var additionalCoreChecks = [
 ];
 
 // tools/quality/src/plugins/extra-checks.ts
-import { readdir as readdir4 } from "node:fs/promises";
-import { join as join7, relative as relative4 } from "node:path";
+import { readdir as readdir5 } from "node:fs/promises";
+import { join as join8, relative as relative5 } from "node:path";
 import { Glob as Glob3 } from "bun";
-var SKIP_DIRS_DEFAULT = ["node_modules", ".git", "dist", ".bun", ".cache"];
+var SKIP_DIRS_DEFAULT2 = ["node_modules", ".git", "dist", ".bun", ".cache"];
 function isCommentLine2(trimmed) {
   return trimmed.startsWith("//") || trimmed.startsWith("*") || trimmed.startsWith("/*");
 }
@@ -1751,12 +1893,12 @@ function isTestFile2(rel) {
 async function walkScannableFiles(dir, skipDirs, out) {
   let entries;
   try {
-    entries = await readdir4(dir, { withFileTypes: true });
+    entries = await readdir5(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
-    const fullPath = join7(dir, entry.name);
+    const fullPath = join8(dir, entry.name);
     if (entry.isDirectory()) {
       if (!skipDirs.has(entry.name))
         await walkScannableFiles(fullPath, skipDirs, out);
@@ -1792,7 +1934,7 @@ var DEFAULT_FORBIDDEN = {
     "Date-handling libraries (use Date or built-ins)": ["moment", "moment-timezone"]
   },
   zones: ["src", "tools", "cli", "scripts"],
-  skipDirs: SKIP_DIRS_DEFAULT
+  skipDirs: SKIP_DIRS_DEFAULT2
 };
 var IMPORT_REGEX2 = /(?:import|export)\s+.*?from\s+['"]([^'"]+)['"]|require\(\s*['"]([^'"]+)['"]\s*\)/g;
 function lookupBanned(specifier, banned) {
@@ -1841,9 +1983,9 @@ var forbiddenDeps = {
     const skipDirs = new Set(c.skipDirs ?? DEFAULT_FORBIDDEN.skipDirs);
     const out = [];
     for (const z of c.zones ?? DEFAULT_FORBIDDEN.zones) {
-      await walkScannableFiles(join7(root, z), skipDirs, out);
+      await walkScannableFiles(join8(root, z), skipDirs, out);
     }
-    return out.filter((p) => !isTestFile2(relative4(root, p)));
+    return out.filter((p) => !isTestFile2(relative5(root, p)));
   },
   run: async ({ rootDir, config }) => {
     const c = config ?? {};
@@ -1852,9 +1994,9 @@ var forbiddenDeps = {
     const violations = [];
     for (const z of c.zones ?? DEFAULT_FORBIDDEN.zones) {
       const files = [];
-      await walkScannableFiles(join7(rootDir, z), skipDirs, files);
+      await walkScannableFiles(join8(rootDir, z), skipDirs, files);
       for (const filePath of files) {
-        const rel = relative4(rootDir, filePath);
+        const rel = relative5(rootDir, filePath);
         if (isTestFile2(rel))
           continue;
         violations.push(...await scanFileForForbidden(filePath, rel, banned));
@@ -1867,7 +2009,7 @@ var DEFAULT_NO_STATE_HOOKS = {
   banned: ["useState", "useReducer", "useSignal"],
   allowedFiles: [],
   zones: ["src", "tools", "cli", "scripts"],
-  skipDirs: SKIP_DIRS_DEFAULT
+  skipDirs: SKIP_DIRS_DEFAULT2
 };
 function escapeForAlternation(name) {
   return name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1892,10 +2034,10 @@ var noStateHooks = {
     const allowed = c.allowedFiles ?? DEFAULT_NO_STATE_HOOKS.allowedFiles;
     const out = [];
     for (const z of c.zones ?? DEFAULT_NO_STATE_HOOKS.zones) {
-      await walkScannableFiles(join7(root, z), skipDirs, out);
+      await walkScannableFiles(join8(root, z), skipDirs, out);
     }
     return out.filter((p) => {
-      const rel = relative4(root, p);
+      const rel = relative5(root, p);
       return !isTestFile2(rel) && !isAllowedByGlob(rel, allowed);
     });
   },
@@ -1910,9 +2052,9 @@ var noStateHooks = {
     const violations = [];
     for (const z of c.zones ?? DEFAULT_NO_STATE_HOOKS.zones) {
       const files = [];
-      await walkScannableFiles(join7(rootDir, z), skipDirs, files);
+      await walkScannableFiles(join8(rootDir, z), skipDirs, files);
       for (const filePath of files) {
-        const rel = relative4(rootDir, filePath);
+        const rel = relative5(rootDir, filePath);
         if (isTestFile2(rel) || isAllowedByGlob(rel, allowed))
           continue;
         violations.push(...await scanFileForHookCalls(filePath, rel, regex));
@@ -1941,7 +2083,7 @@ var DEFAULT_TYPOGRAPHIC = {
   typographicZone: [],
   straightZone: [],
   zones: ["src", "tools", "cli", "scripts"],
-  skipDirs: SKIP_DIRS_DEFAULT
+  skipDirs: SKIP_DIRS_DEFAULT2
 };
 function fileMatchesAnyGlob(rel, globs) {
   for (const g of globs) {
@@ -1958,7 +2100,7 @@ var typographicQuotes = {
     const skipDirs = new Set(c.skipDirs ?? DEFAULT_TYPOGRAPHIC.skipDirs);
     const out = [];
     for (const z of c.zones ?? DEFAULT_TYPOGRAPHIC.zones) {
-      await walkScannableFiles(join7(root, z), skipDirs, out);
+      await walkScannableFiles(join8(root, z), skipDirs, out);
     }
     return out;
   },
@@ -1992,9 +2134,9 @@ async function runTypographicScan(rootDir, c, tz, sz) {
   const violations = [];
   for (const z of c.zones ?? DEFAULT_TYPOGRAPHIC.zones) {
     const files = [];
-    await walkScannableFiles(join7(rootDir, z), skipDirs, files);
+    await walkScannableFiles(join8(rootDir, z), skipDirs, files);
     for (const filePath of files) {
-      const rel = relative4(rootDir, filePath);
+      const rel = relative5(rootDir, filePath);
       const inT = fileMatchesAnyGlob(rel, tz);
       const inS = fileMatchesAnyGlob(rel, sz);
       if (!inT && !inS)
@@ -2011,10 +2153,10 @@ var extraCoreChecks = [
 ];
 
 // tools/quality/src/plugins/import-checks.ts
-import { readdir as readdir5 } from "node:fs/promises";
-import { join as join8, relative as relative5 } from "node:path";
+import { readdir as readdir6 } from "node:fs/promises";
+import { join as join9, relative as relative6 } from "node:path";
 import { Glob as Glob4 } from "bun";
-var SKIP_DIRS_DEFAULT2 = ["node_modules", ".git", "dist", ".bun", ".cache"];
+var SKIP_DIRS_DEFAULT3 = ["node_modules", ".git", "dist", ".bun", ".cache"];
 function isCommentLine3(trimmed) {
   return trimmed.startsWith("//") || trimmed.startsWith("*") || trimmed.startsWith("/*");
 }
@@ -2024,12 +2166,12 @@ function isTestFile3(rel) {
 async function walkScannableFiles2(dir, skipDirs, out) {
   let entries;
   try {
-    entries = await readdir5(dir, { withFileTypes: true });
+    entries = await readdir6(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
-    const fullPath = join8(dir, entry.name);
+    const fullPath = join9(dir, entry.name);
     if (entry.isDirectory()) {
       if (!skipDirs.has(entry.name))
         await walkScannableFiles2(fullPath, skipDirs, out);
@@ -2062,7 +2204,7 @@ var DEFAULT_RELATIVE = {
   maxDepth: 1,
   allowedFiles: [],
   zones: ["src", "tools", "cli", "scripts"],
-  skipDirs: SKIP_DIRS_DEFAULT2
+  skipDirs: SKIP_DIRS_DEFAULT3
 };
 function relativeDepth(specifier) {
   if (!specifier.startsWith(".."))
@@ -2102,10 +2244,10 @@ var relativeImports = {
     const allowed = c.allowedFiles ?? DEFAULT_RELATIVE.allowedFiles;
     const out = [];
     for (const z of c.zones ?? DEFAULT_RELATIVE.zones) {
-      await walkScannableFiles2(join8(root, z), skipDirs, out);
+      await walkScannableFiles2(join9(root, z), skipDirs, out);
     }
     return out.filter((p) => {
-      const rel = relative5(root, p);
+      const rel = relative6(root, p);
       return !isTestFile3(rel) && !isAllowedByGlob2(rel, allowed);
     });
   },
@@ -2117,9 +2259,9 @@ var relativeImports = {
     const violations = [];
     for (const z of c.zones ?? DEFAULT_RELATIVE.zones) {
       const files = [];
-      await walkScannableFiles2(join8(rootDir, z), skipDirs, files);
+      await walkScannableFiles2(join9(rootDir, z), skipDirs, files);
       for (const filePath of files) {
-        const rel = relative5(rootDir, filePath);
+        const rel = relative6(rootDir, filePath);
         if (isTestFile3(rel) || isAllowedByGlob2(rel, allowed))
           continue;
         violations.push(...await scanFileForRelativeViolations(filePath, rel, maxDepth));
@@ -2134,16 +2276,16 @@ var DEFAULT_TSCONFIG_PATHS = {
 };
 async function findTsconfigs(rootDir, names) {
   const out = [];
-  const skipDirs = new Set(SKIP_DIRS_DEFAULT2);
+  const skipDirs = new Set(SKIP_DIRS_DEFAULT3);
   async function walk(dir) {
     let entries;
     try {
-      entries = await readdir5(dir, { withFileTypes: true });
+      entries = await readdir6(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const fullPath = join8(dir, entry.name);
+      const fullPath = join9(dir, entry.name);
       if (entry.isDirectory()) {
         if (!skipDirs.has(entry.name))
           await walk(fullPath);
@@ -2172,14 +2314,14 @@ var tsconfigPaths = {
       try {
         parsed = JSON.parse(stripped);
       } catch {
-        violations.push(`${relative5(rootDir, tsconfigPath)}: failed to parse as JSON`);
+        violations.push(`${relative6(rootDir, tsconfigPath)}: failed to parse as JSON`);
         continue;
       }
       const paths = parsed.compilerOptions?.paths ?? {};
       for (const alias of Object.keys(paths)) {
         if (allowed.has(alias))
           continue;
-        violations.push(`${relative5(rootDir, tsconfigPath)}: paths["${alias}"] is set`);
+        violations.push(`${relative6(rootDir, tsconfigPath)}: paths["${alias}"] is set`);
       }
     }
     return { ok: violations.length === 0, messages: violations };
@@ -2189,7 +2331,7 @@ var DEFAULT_NO_RAW_HTTP = {
   banned: ["fetch", "XMLHttpRequest", "axios"],
   allowedFiles: [],
   zones: ["src"],
-  skipDirs: SKIP_DIRS_DEFAULT2
+  skipDirs: SKIP_DIRS_DEFAULT3
 };
 function buildBannedCallRegex(banned) {
   const alts = banned.map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
@@ -2222,10 +2364,10 @@ var noRawHttp = {
     const allowed = cfg.allowedFiles ?? DEFAULT_NO_RAW_HTTP.allowedFiles;
     const out = [];
     for (const z of cfg.zones ?? DEFAULT_NO_RAW_HTTP.zones) {
-      await walkScannableFiles2(join8(root, z), skipDirs, out);
+      await walkScannableFiles2(join9(root, z), skipDirs, out);
     }
     return out.filter((p) => {
-      const rel = relative5(root, p);
+      const rel = relative6(root, p);
       return !isTestFile3(rel) && !isAllowedByGlob2(rel, allowed);
     });
   },
@@ -2241,9 +2383,9 @@ var noRawHttp = {
     const violations = [];
     for (const z of c.zones ?? DEFAULT_NO_RAW_HTTP.zones) {
       const files = [];
-      await walkScannableFiles2(join8(rootDir, z), skipDirs, files);
+      await walkScannableFiles2(join9(rootDir, z), skipDirs, files);
       for (const filePath of files) {
-        const rel = relative5(rootDir, filePath);
+        const rel = relative6(rootDir, filePath);
         if (isTestFile3(rel) || isAllowedByGlob2(rel, allowed))
           continue;
         violations.push(...await scanFileForRawHttp(filePath, rel, c.canonicalClient, bannedRegex));
@@ -2282,7 +2424,7 @@ var types = {
     return [];
   },
   run: async ({ rootDir, config }) => {
-    const patterns = (config ?? {}).workspaces ?? ["packages/*", "."];
+    const patterns = config?.workspaces ?? ["packages/*", "."];
     const packages = await findWorkspaces(rootDir, patterns);
     if (packages.length === 0)
       return { ok: true, messages: ["no workspace packages found"] };
@@ -2308,7 +2450,7 @@ function aggregateTypesResults(packages, results, rootDir) {
     if (!pkg || !r || r.ok)
       continue;
     ok = false;
-    appendTscFailure(messages, relative5(rootDir, pkg) || ".", r.output);
+    appendTscFailure(messages, relative6(rootDir, pkg) || ".", r.output);
   }
   return { ok, messages };
 }
@@ -2388,10 +2530,10 @@ var secrets = {
     const c = cfg ?? {};
     if (!c.configPath)
       return [];
-    return [join9(root, c.configPath)];
+    return [join10(root, c.configPath)];
   },
   cacheKeyExtras: (cfg) => ({
-    noGit: (cfg ?? {}).noGit === false ? "false" : "true"
+    noGit: cfg?.noGit === false ? "false" : "true"
   }),
   run: async ({ rootDir, config }) => {
     const cfg = config ?? {};
@@ -2420,8 +2562,8 @@ var gitignoreCrossCheck = {
   filesRead: (cfg, root) => {
     const c = cfg ?? {};
     return [
-      join9(root, c.tomlPath ?? ".gitleaks.toml"),
-      join9(root, c.gitignorePath ?? ".gitignore")
+      join10(root, c.tomlPath ?? ".gitleaks.toml"),
+      join10(root, c.gitignorePath ?? ".gitignore")
     ];
   },
   run: async ({ rootDir, config }) => {
@@ -2442,7 +2584,7 @@ var gitignoreCrossCheck = {
     };
   }
 };
-var POLLY_CORE_VERSION = "0.45.0";
+var POLLY_CORE_VERSION = "0.48.0";
 var pollyCorePlugin = {
   name: "polly",
   version: POLLY_CORE_VERSION,
@@ -2453,14 +2595,15 @@ var pollyCorePlugin = {
     gitignoreCrossCheck,
     ...additionalCoreChecks,
     ...extraCoreChecks,
-    ...importCoreChecks
+    ...importCoreChecks,
+    ...clicheCoreChecks
   ]
 };
 
 // tools/quality/src/config.ts
 var DEFAULT_PATHS = ["polly.config.ts", "polly.config.js", "polly.config.mjs"];
 async function loadQualityConfig(rootDir, explicitPath) {
-  const candidates = explicitPath ? [explicitPath] : DEFAULT_PATHS.map((p) => join10(rootDir, p));
+  const candidates = explicitPath ? [explicitPath] : DEFAULT_PATHS.map((p) => join11(rootDir, p));
   for (const path of candidates) {
     if (!await Bun.file(path).exists())
       continue;
@@ -2476,10 +2619,10 @@ async function loadQualityConfig(rootDir, explicitPath) {
   return { plugins: [pollyCorePlugin] };
 }
 // tools/quality/src/plugins/polly-ui.ts
-import { readdir as readdir6 } from "node:fs/promises";
-import { join as join11, relative as relative6 } from "node:path";
+import { readdir as readdir7 } from "node:fs/promises";
+import { join as join12, relative as relative7 } from "node:path";
 import { Glob as Glob6 } from "bun";
-var SKIP_DIRS_DEFAULT3 = ["node_modules", ".git", "dist", ".bun", ".cache"];
+var SKIP_DIRS_DEFAULT4 = ["node_modules", ".git", "dist", ".bun", ".cache"];
 function isCommentLine4(trimmed) {
   return trimmed.startsWith("//") || trimmed.startsWith("*") || trimmed.startsWith("/*");
 }
@@ -2493,12 +2636,12 @@ function isAllowedByGlob3(rel, globs) {
 async function walkScannableFiles3(dir, skipDirs, exts, out) {
   let entries;
   try {
-    entries = await readdir6(dir, { withFileTypes: true });
+    entries = await readdir7(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
-    const fullPath = join11(dir, entry.name);
+    const fullPath = join12(dir, entry.name);
     if (entry.isDirectory()) {
       if (!skipDirs.has(entry.name))
         await walkScannableFiles3(fullPath, skipDirs, exts, out);
@@ -2597,7 +2740,7 @@ var DEFAULT_NO_INLINE_HANDLERS = {
   ],
   allowedFiles: [],
   zones: ["src"],
-  skipDirs: SKIP_DIRS_DEFAULT3
+  skipDirs: SKIP_DIRS_DEFAULT4
 };
 function escapeRegex(name) {
   return name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -2633,10 +2776,10 @@ var noInlineHandlers = {
     const allowed = c.allowedFiles ?? DEFAULT_NO_INLINE_HANDLERS.allowedFiles;
     const out = [];
     for (const z of c.zones ?? DEFAULT_NO_INLINE_HANDLERS.zones) {
-      await walkScannableFiles3(join11(root, z), skipDirs, [".tsx"], out);
+      await walkScannableFiles3(join12(root, z), skipDirs, [".tsx"], out);
     }
     return out.filter((p) => {
-      const rel = relative6(root, p);
+      const rel = relative7(root, p);
       return !isTestFile4(rel) && !isAllowedByGlob3(rel, allowed);
     });
   },
@@ -2651,9 +2794,9 @@ var noInlineHandlers = {
     const violations = [];
     for (const z of c.zones ?? DEFAULT_NO_INLINE_HANDLERS.zones) {
       const files = [];
-      await walkScannableFiles3(join11(rootDir, z), skipDirs, [".tsx"], files);
+      await walkScannableFiles3(join12(rootDir, z), skipDirs, [".tsx"], files);
       for (const filePath of files) {
-        const rel = relative6(rootDir, filePath);
+        const rel = relative7(rootDir, filePath);
         if (isTestFile4(rel) || isAllowedByGlob3(rel, allowed))
           continue;
         violations.push(...await scanFileForInlineHandlers(filePath, rel, regex));
@@ -2903,4 +3046,4 @@ switch (subcommand) {
 }
 process.exit(exitCode);
 
-//# debugId=AB9249A5A8AE0E9164756E2164756E21
+//# debugId=C337428BF011F4B264756E2164756E21