@hominis/fireforge 0.55.0 → 0.60.0

package/dist/src/core/patch-parse.js

@@ -1,416 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-import { assert } from '../utils/assert.js';
-/**
- * Pure parsing functions for extracting information from patch files. All
- * functions are synchronous and operate on string content.
- *
- * This module is the one unified-diff walker in the codebase. Hand-rolled
- * `diff --git` walkers diverge in ways that matter: CRLF handling (a
- * CRLF-saved patch file silently fails target-file matching and
- * `\ No newline` detection on Windows), quoted-path support, and greedy path
- * captures that mis-split any path containing ` b/`. New diff-shaped parsing
- * must build on {@link parseDiffSections} rather than re-walking lines.
- */
-/** Width of the zero-padded numeric prefix on a patch filename ("001-…"). */
-const PATCH_ORDER_WIDTH = 3;
-/**
- * Renders a patch order as the zero-padded prefix used in filenames and in
- * every message that names an order.
- *
- * Eleven call sites across `patch-policy`, `patch-export`, `export-flow`,
- * `export-placement-policy` and `patch move-files` spelled this as
- * `String(order).padStart(3, '0')`, so the padding width lived in eleven
- * places while the filenames it has to agree with are produced in one.
- * @param order - Numeric patch order.
- * @param width - Prefix width. Defaults to the on-disk convention.
- * @returns The zero-padded order, e.g. `007`.
- */
-export function formatPatchOrder(order, width = PATCH_ORDER_WIDTH) {
-    return String(order).padStart(width, '0');
-}
-/**
- * Renders an inclusive order range the way `patchPolicy` diagnostics name it.
- * @param range - Inclusive `from`/`to` order bounds.
- * @returns The range label, e.g. `100-199`.
- */
-export function formatOrderRange(range) {
-    return `${formatPatchOrder(range.from)}-${formatPatchOrder(range.to)}`;
-}
-/**
- * Extracts the order number from a patch filename.
- * Expects format like "001-description.patch"
- * @param filename - Patch filename
- * @returns Order number, or Infinity if no prefix
- */
-export function extractOrder(filename) {
-    const match = /^(\d+)-/.exec(filename);
-    if (match?.[1]) {
-        return parseInt(match[1], 10);
-    }
-    return Infinity;
-}
-/**
- * Extracts the order number from a patch filename that is about to be
- * written into the manifest.
- *
- * The write-side counterpart to {@link extractOrder}. That one answers
- * `Infinity` for a prefix-less filename, which sorts such a patch last and
- * is the right answer for a read: an unparseable name should not crash a
- * status listing. Persisting `Infinity` (or a fallback `0`) is a different
- * matter: it puts an order in the manifest
- * that no filename on disk agrees with, and the queue then applies in an
- * order the operator cannot see. Callers here have just built or
- * looked up a real prefixed filename, so absence is a bug, not input.
- *
- * @param filename - Patch filename carrying a numeric order prefix
- * @returns The parsed order
- * @throws {@link InternalInvariantError} when `filename` has no numeric prefix.
- */
-export function requirePatchOrder(filename) {
-    const match = /^(\d+)-/.exec(filename);
-    assert(match?.[1] !== undefined, () => `patch filename carries a numeric order prefix (got "${filename}")`);
-    return parseInt(match[1], 10);
-}
-/**
- * Un-escapes a path from git's C-style quoted form (`"a/pfad m\303\244..."`).
- * Handles the escapes git emits: `\\`, `\"`, `\t`, `\n`, `\r` and three-digit
- * octal byte escapes. Octal bytes are decoded through a byte buffer so
- * multibyte UTF-8 sequences (git's default `core.quotePath=true` encodes any
- * non-ASCII path this way) come back as the real characters.
- */
-function unquoteGitPath(quoted) {
-    const bytes = [];
-    for (let i = 0; i < quoted.length; i++) {
-        const ch = quoted[i];
-        if (ch !== '\\') {
-            // Plain character, which may itself be multi-byte when the diff already
-            // contains raw UTF-8. Push its bytes.
-            const encoded = Buffer.from(quoted[i] ?? '', 'utf-8');
-            for (const b of encoded)
-                bytes.push(b);
-            continue;
-        }
-        const next = quoted[i + 1];
-        if (next === undefined)
-            break;
-        if (next >= '0' && next <= '7') {
-            const octal = quoted.slice(i + 1, i + 4);
-            bytes.push(parseInt(octal, 8));
-            i += 3;
-            continue;
-        }
-        const mapped = next === 'n' ? 0x0a : next === 't' ? 0x09 : next === 'r' ? 0x0d : next.charCodeAt(0);
-        bytes.push(mapped);
-        i += 1;
-    }
-    return Buffer.from(bytes).toString('utf-8');
-}
-/**
- * Parses a `diff --git` line into its two paths.
- *
- * Handles the quoted form git emits for paths with special characters
- * (`diff --git "a/x y" "b/x y"`), and disambiguates the unquoted form for
- * paths that themselves contain ` b/`: for the overwhelmingly common
- * non-rename case the two paths are identical, so a symmetric split
- * (`a/<p> b/<p>`) is tried first: a greedy `a\/.+ b\/(.+)$` splits such
- * lines at the last ` b/` and returns a truncated path. Falls back to a
- * non-greedy split for renames.
- *
- * @returns null when the line is not a diff --git header.
- */
-export function parseDiffGitHeader(line) {
-    const stripped = line.endsWith('\r') ? line.slice(0, -1) : line;
-    if (!stripped.startsWith('diff --git '))
-        return null;
-    const body = stripped.slice('diff --git '.length);
-    // Quoted form (either or both sides may be quoted).
-    const quoted = /^(?:"a\/((?:[^"\\]|\\.)*)"|a\/(\S+)) (?:"b\/((?:[^"\\]|\\.)*)"|b\/(.+))$/.exec(body);
-    if (quoted && (quoted[1] !== undefined || quoted[3] !== undefined)) {
-        const sourcePath = quoted[1] !== undefined ? unquoteGitPath(quoted[1]) : (quoted[2] ?? '');
-        const targetPath = quoted[3] !== undefined ? unquoteGitPath(quoted[3]) : (quoted[4] ?? '');
-        return { sourcePath, targetPath };
-    }
-    if (!body.startsWith('a/'))
-        return null;
-    const rest = body.slice(2);
-    // Symmetric split: body === `a/<p> b/<p>`. Correct even when <p>
-    // contains ` b/`, which defeats any single-regex approach.
-    if ((rest.length - 3) % 2 === 0) {
-        const pathLength = (rest.length - 3) / 2;
-        const candidate = rest.slice(0, pathLength);
-        if (rest === `${candidate} b/${candidate}`) {
-            return { sourcePath: candidate, targetPath: candidate };
-        }
-    }
-    // Rename/copy (differing paths): split at the first ` b/` with a path on
-    // each side. indexOf keeps this linear where a lazy regex backtracks.
-    if (/[\n\r\u2028\u2029]/.test(rest))
-        return null;
-    const split = rest.indexOf(' b/', 1);
-    if (split === -1 || split + 3 >= rest.length)
-        return null;
-    return { sourcePath: rest.slice(0, split), targetPath: rest.slice(split + 3) };
-}
-/**
- * Splits raw diff content into lines, tolerating CRLF-saved patch files.
- *
- * The distinction matters: a patch file saved with CRLF endings (Windows
- * editor, `core.autocrlf` checkout) has `\r` on every line including
- * structural ones. Strip it, or headers, `@@` lines and the
- * `` marker all fail to match. But an LF patch
- * of a file whose content is CRLF has `\r` only on payload lines, where it
- * is significant and must be preserved. Detect the former by checking the
- * structural lines themselves for a trailing `\r`.
- */
-function splitDiffLines(diffContent) {
-    const lines = diffContent.split('\n');
-    const isCrlfPatchFile = lines.some((line) => (line.startsWith('diff --git') || line.startsWith('@@ ')) &&
-        line.endsWith('\r') &&
-        line.length > 1);
-    if (!isCrlfPatchFile)
-        return lines;
-    return lines.map((line) => (line.endsWith('\r') ? line.slice(0, -1) : line));
-}
-/**
- * Parses a unified diff into structured per-file sections. This is the
- * single shared walker every diff consumer builds on.
- */
-export function parseDiffSections(diffContent) {
-    const sections = [];
-    const lines = splitDiffLines(diffContent);
-    let current = null;
-    let currentHunk = null;
-    const finishHunk = () => {
-        if (current && currentHunk) {
-            current.hunks.push(currentHunk);
-        }
-        currentHunk = null;
-    };
-    for (const line of lines) {
-        const header = parseDiffGitHeader(line);
-        if (header) {
-            finishHunk();
-            current = {
-                targetPath: header.targetPath,
-                sourcePath: header.sourcePath,
-                isNewFile: false,
-                isDeletedFile: false,
-                isBinary: false,
-                hasBinaryDelta: false,
-                hunks: [],
-            };
-            sections.push(current);
-            continue;
-        }
-        if (!current)
-            continue;
-        if (currentHunk === null) {
-            // File metadata zone (between the header and the first hunk).
-            if (line.startsWith('new file mode')) {
-                current.isNewFile = true;
-                continue;
-            }
-            if (line.startsWith('deleted file mode')) {
-                current.isDeletedFile = true;
-                continue;
-            }
-            if (line === 'GIT binary patch') {
-                current.isBinary = true;
-                current.hasBinaryDelta = true;
-                continue;
-            }
-            if (/^Binary files .* differ$/.test(line)) {
-                // Informational form: binary, but with no payload to apply.
-                current.isBinary = true;
-                continue;
-            }
-            // `git diff --binary` always records full blob hashes here (git
-            // apply requires them). Text sections carry abbreviated ones. The
-            // hashes let binary sections be compared by identity when their
-            // payload cannot be applied as text.
-            const indexMatch = /^index ([0-9a-f]{7,64})\.\.([0-9a-f]{7,64})(?: \d{6})?$/.exec(line);
-            if (indexMatch?.[1] !== undefined && indexMatch[2] !== undefined) {
-                current.indexOldHash = indexMatch[1];
-                current.indexNewHash = indexMatch[2];
-                continue;
-            }
-        }
-        if (current.isBinary)
-            continue;
-        const hunkMatch = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/.exec(line);
-        if (hunkMatch) {
-            finishHunk();
-            currentHunk = {
-                oldStart: parseInt(hunkMatch[1] ?? '0', 10),
-                oldCount: parseInt(hunkMatch[2] ?? '1', 10),
-                newStart: parseInt(hunkMatch[3] ?? '0', 10),
-                newCount: parseInt(hunkMatch[4] ?? '1', 10),
-                lines: [],
-                noNewlineAtEndOld: false,
-                noNewlineAtEndNew: false,
-            };
-            continue;
-        }
-        if (!currentHunk)
-            continue;
-        if (line === '\') {
-            // The marker is an annotation on the immediately preceding body
-            // line. Peek the last collected line to decide which side(s) the
-            // annotation applies to. A single boolean cannot represent the
-            // asymmetric case where only one side lacks the trailing newline.
-            const previous = currentHunk.lines[currentHunk.lines.length - 1] ?? '';
-            if (previous.startsWith('-')) {
-                currentHunk.noNewlineAtEndOld = true;
-            }
-            else if (previous.startsWith('+')) {
-                currentHunk.noNewlineAtEndNew = true;
-            }
-            else if (previous.startsWith(' ')) {
-                // Context line: present in both sides, so the trailing-newline
-                // absence applies to both. This is rare (it only happens when
-                // the hunk ends on an unchanged line that itself is the last
-                // line of the file) but real: git emits it.
-                currentHunk.noNewlineAtEndOld = true;
-                currentHunk.noNewlineAtEndNew = true;
-            }
-            // If the marker appears with no preceding body line (malformed
-            // diff), leave both flags false. The downstream apply logic
-            // will still produce a defined result.
-            continue;
-        }
-        if (line.startsWith('+') || line.startsWith('-') || line.startsWith(' ')) {
-            currentHunk.lines.push(line);
-        }
-    }
-    finishHunk();
-    return sections;
-}
-/** A `---`/`+++` file name, without a trailing timestamp or git's `a/`/`b/`. */
-function plainDiffPath(raw) {
-    const name = raw.split('\t')[0]?.trim() ?? '';
-    return name.startsWith('a/') || name.startsWith('b/') ? name.slice(2) : name;
-}
-/** The git header block for one plain `---`/`+++` pair. */
-function gitHeaderFor(oldPath, newPath) {
-    if (oldPath !== '/dev/null' && newPath !== '/dev/null') {
-        return [`diff --git a/${oldPath} b/${newPath}`, `--- a/${oldPath}`, `+++ b/${newPath}`];
-    }
-    // A side on /dev/null is a create or delete; consumers decide by the
-    // `new file mode` / `deleted file mode` marker whether they accept it.
-    const path = oldPath === '/dev/null' ? newPath : oldPath;
-    return [
-        `diff --git a/${path} b/${path}`,
-        oldPath === '/dev/null' ? 'new file mode 100644' : 'deleted file mode 100644',
-        oldPath === '/dev/null' ? '--- /dev/null' : `--- a/${path}`,
-        newPath === '/dev/null' ? '+++ /dev/null' : `+++ b/${path}`,
-    ];
-}
-/**
- * Gives a plain unified diff (`diff -u`, no `diff --git` lines) the git
- * header {@link parseDiffSections} keys on, one per `---`/`+++` pair. A
- * diff that already carries `diff --git` headers is returned unchanged.
- * Hunk bodies are skipped by their header counts, so a removed line that
- * reads `-- x` is never taken for a file header.
- *
- * The two sides keep the names the diff gives them, so a section written
- * as `diff -u <(body) engine/<file>` has a different path on each side;
- * the caller decides which side names the file.
- *
- * @param content - The diff file's text
- * @returns The diff with a `diff --git` header before each file
- */
-export function withGitHeaders(content) {
-    const lines = content.split('\n');
-    if (lines.some((line) => line.startsWith('diff --git ')))
-        return content;
-    const out = [];
-    let oldLeft = 0;
-    let newLeft = 0;
-    for (let index = 0; index < lines.length; index += 1) {
-        const line = lines[index] ?? '';
-        if (oldLeft > 0 || newLeft > 0) {
-            const marker = line[0];
-            if (marker !== '+' && marker !== '\\')
-                oldLeft -= 1;
-            if (marker !== '-' && marker !== '\\')
-                newLeft -= 1;
-            out.push(line);
-            continue;
-        }
-        const hunk = /^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(line);
-        if (hunk) {
-            oldLeft = parseInt(hunk[1] ?? '1', 10);
-            newLeft = parseInt(hunk[2] ?? '1', 10);
-            out.push(line);
-            continue;
-        }
-        const next = lines[index + 1] ?? '';
-        if (line.startsWith('--- ') && next.startsWith('+++ ')) {
-            out.push(...gitHeaderFor(plainDiffPath(line.slice(4)), plainDiffPath(next.slice(4))));
-            index += 1;
-            continue;
-        }
-        out.push(line);
-    }
-    return out.join('\n');
-}
-/**
- * Checks whether a specific file is a new-file addition within a patch.
- * For multi-file patches, only inspects the section belonging to targetFile.
- * @param patchContent - The full patch content
- * @param targetFile - The file path to check
- * @returns true if the patch creates targetFile as a new file
- */
-export function isNewFileInPatch(patchContent, targetFile) {
-    return parseDiffSections(patchContent).some((section) => section.targetPath === targetFile && section.isNewFile);
-}
-/**
- * Extracts affected file paths from a diff/patch content.
- * @param diffContent - The diff content to parse
- * @returns Array of file paths
- */
-export function extractAffectedFiles(diffContent) {
-    const files = new Set();
-    for (const section of parseDiffSections(diffContent)) {
-        files.add(section.targetPath);
-    }
-    if (files.size === 0) {
-        // Header-less unified diff (no `diff --git` lines, e.g. hand-written
-        // or `diff -u` output): fall back to the `+++ b/<path>` markers.
-        for (const line of splitDiffLines(diffContent)) {
-            const addMatch = /^\+\+\+ b\/(.+)$/.exec(line);
-            if (addMatch?.[1] && addMatch[1] !== '/dev/null') {
-                files.add(addMatch[1]);
-            }
-        }
-    }
-    return Array.from(files).sort();
-}
-/**
- * Parses hunks from a patch file for a specific target file.
- * @param patchContent - The full patch content
- * @param targetFile - The file path to extract hunks for
- * @returns Array of hunk objects with line info and changes
- */
-export function parseHunksForFile(patchContent, targetFile) {
-    return parseDiffSections(patchContent)
-        .filter((section) => section.targetPath === targetFile)
-        .flatMap((section) => section.hunks);
-}
-/**
- * Extracts conflicting file paths from git apply error message.
- */
-export function extractConflictingFiles(error) {
-    if (!error)
-        return [];
-    const files = [];
-    const lines = error.split('\n');
-    for (const line of lines) {
-        // Match "error: patch failed: path/to/file:line"
-        const match = /error: patch failed: ([^:]+)/.exec(line);
-        if (match?.[1]) {
-            files.push(match[1]);
-        }
-    }
-    return files;
-}

package/dist/src/core/patch-policy-content.d.ts

@@ -1,40 +0,0 @@
-/**
- * Registration-only patch policy: the `patchPolicy` rules that need the
- * patch bodies, not just the manifest.
- *
- * - `upstreamAllowlist`: which upstream files (files no patch in the queue
- *   creates) a non-reserved patch may modify.
- * - `addOnly` allowlist entries: for shared registration files, a patch may
- *   only add lines, and each non-blank added line must carry the marker.
- * - `scopeRules`: limit a class of patch (a category, or a filename pattern
- *   such as `-tests\.patch$`) to the files its globs name.
- * - `verifyDocumentPaths`: every reserved allowlist entry's `adr` /
- *   `documentation` path must exist.
- *
- * Every rule is opt-in, and none can be evaluated from `patches.json`
- * alone, which is why they live apart from `patch-policy.ts`: that module
- * answers synchronously over a (possibly projected) manifest, this one reads
- * patch bodies and the filesystem. `verify` and `lint --per-patch` run both.
- */
-import type { PatchesManifest } from '../types/commands/index.js';
-import type { FireForgeConfig } from '../types/config.js';
-import { type PatchQueueEntry } from './patch-lint-cross.js';
-import type { PatchPolicyIssue } from './patch-policy.js';
-/** True when the policy sets any rule this module evaluates. */
-export declare function hasPatchPolicyContentRules(config: FireForgeConfig): boolean;
-/**
- * Evaluates the body-dependent `patchPolicy` rules over a patch queue.
- *
- * @param config - Project configuration
- * @param projectRoot - Project root, for the document-path check
- * @param manifest - Current manifest (category and order per patch)
- * @param entries - Patch queue entries with their bodies
- * @returns Findings, in the same shape {@link evaluatePatchPolicy} returns
- */
-export declare function evaluatePatchPolicyContent(config: FireForgeConfig, projectRoot: string, manifest: PatchesManifest, entries: readonly PatchQueueEntry[]): Promise<PatchPolicyIssue[]>;
-/**
- * {@link evaluatePatchPolicyContent} for a caller without a queue context
- * in hand (`verify`): reads the patch bodies only when a body-dependent
- * rule is configured.
- */
-export declare function evaluatePatchPolicyContentForQueue(config: FireForgeConfig, projectRoot: string, patchesDir: string, manifest: PatchesManifest): Promise<PatchPolicyIssue[]>;

package/dist/src/core/patch-policy-content.js

@@ -1,219 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-/**
- * Registration-only patch policy: the `patchPolicy` rules that need the
- * patch bodies, not just the manifest.
- *
- * - `upstreamAllowlist`: which upstream files (files no patch in the queue
- *   creates) a non-reserved patch may modify.
- * - `addOnly` allowlist entries: for shared registration files, a patch may
- *   only add lines, and each non-blank added line must carry the marker.
- * - `scopeRules`: limit a class of patch (a category, or a filename pattern
- *   such as `-tests\.patch$`) to the files its globs name.
- * - `verifyDocumentPaths`: every reserved allowlist entry's `adr` /
- *   `documentation` path must exist.
- *
- * Every rule is opt-in, and none can be evaluated from `patches.json`
- * alone, which is why they live apart from `patch-policy.ts`: that module
- * answers synchronously over a (possibly projected) manifest, this one reads
- * patch bodies and the filesystem. `verify` and `lint --per-patch` run both.
- */
-import { join } from 'node:path';
-import { pathExists } from '../utils/fs.js';
-import { matchesAnyGlob } from '../utils/path-glob.js';
-import { buildPatchQueueContext } from './patch-lint-cross.js';
-import { parseDiffSections } from './patch-parse.js';
-/** True when the policy sets any rule this module evaluates. */
-export function hasPatchPolicyContentRules(config) {
-    const cfg = config.patchPolicy;
-    return (cfg !== undefined &&
-        (cfg.upstreamAllowlist !== undefined ||
-            cfg.scopeRules !== undefined ||
-            cfg.verifyDocumentPaths === true));
-}
-function normalizeAllowEntry(entry) {
-    return typeof entry === 'string' ? { path: entry } : entry;
-}
-function isReservedOrder(cfg, order) {
-    return (cfg.reservedRanges ?? []).some((range) => order >= range.from && order <= range.to);
-}
-/**
- * The upstream files a patch body edits, keyed by path: every section that
- * does not create its file, minus paths some patch in the queue creates. A
- * rename counts against both of its paths.
- */
-function collectUpstreamEdits(diff, queueCreated) {
-    const edits = new Map();
-    for (const section of parseDiffSections(diff)) {
-        if (section.isNewFile)
-            continue;
-        const paths = new Set([section.sourcePath, section.targetPath]);
-        for (const path of paths) {
-            if (queueCreated.has(path))
-                continue;
-            const edit = edits.get(path) ?? { added: [], removed: [], deleted: false, binary: false };
-            edit.deleted ||= section.isDeletedFile;
-            edit.binary ||= section.isBinary;
-            for (const hunk of section.hunks) {
-                for (const line of hunk.lines) {
-                    if (line.startsWith('+'))
-                        edit.added.push(line.slice(1));
-                    else if (line.startsWith('-'))
-                        edit.removed.push(line.slice(1));
-                }
-            }
-            edits.set(path, edit);
-        }
-    }
-    return edits;
-}
-/**
- * Why an add-only file's edit breaks the mode, or undefined when it holds.
- * Blank lines are free in both directions: they carry no registration. A
- * removed line that names one of `retiredPaths` is free too: it drops the
- * registration of a reviewed retirement.
- */
-function addOnlyViolation(edit, marker, retiredPaths) {
-    if (edit.deleted)
-        return 'deletes the file';
-    if (edit.binary)
-        return 'carries a binary change';
-    const removed = edit.removed.filter((line) => line.trim() !== '' && !retiredPaths.some((path) => line.includes(path)));
-    if (removed.length > 0) {
-        return `removes ${String(removed.length)} line(s), first: ${JSON.stringify(removed[0])}`;
-    }
-    const needle = marker.toLowerCase();
-    const unmarked = edit.added.filter((line) => line.trim() !== '' && !line.toLowerCase().includes(needle));
-    if (unmarked.length > 0) {
-        return (`adds ${String(unmarked.length)} line(s) without the "${marker}" marker, ` +
-            `first: ${JSON.stringify(unmarked[0])}`);
-    }
-    return undefined;
-}
-function evaluateUpstreamEdits(cfg, filename, edits, severity) {
-    const allowlist = (cfg.upstreamAllowlist ?? []).map(normalizeAllowEntry);
-    const issues = [];
-    const outside = [];
-    for (const [path, edit] of [...edits].sort(([a], [b]) => a.localeCompare(b))) {
-        const matches = allowlist.filter((entry) => matchesAnyGlob(path, [entry.path]));
-        if (matches.length === 0) {
-            outside.push(path);
-            continue;
-        }
-        // Strictest wins: any add-only match makes the file add-only.
-        const addOnly = matches.find((entry) => entry.addOnly === true);
-        if (!addOnly)
-            continue;
-        const marker = addOnly.marker ?? cfg.addOnlyMarker ?? '';
-        const retiredPaths = matches.flatMap((entry) => entry.retiredPaths ?? []);
-        const violation = addOnlyViolation(edit, marker, retiredPaths);
-        if (violation !== undefined) {
-            issues.push({
-                code: 'add-only',
-                filename,
-                severity,
-                message: `${filename} edits ${path}, which patchPolicy.upstreamAllowlist marks add-only ` +
-                    `(added lines carrying "${marker}"), but ${violation}.`,
-            });
-        }
-    }
-    if (outside.length > 0) {
-        issues.push({
-            code: 'upstream-allowlist',
-            filename,
-            severity,
-            message: `${filename} modifies upstream file(s) outside patchPolicy.upstreamAllowlist: ` +
-                `${outside.join(', ')}. Move the change into a fork-owned file, or add a reviewed allowlist entry.`,
-        });
-    }
-    return issues;
-}
-function evaluateScopeRules(cfg, filename, category, files, severity) {
-    const issues = [];
-    for (const [index, rule] of (cfg.scopeRules ?? []).entries()) {
-        if (rule.category !== undefined && rule.category !== category)
-            continue;
-        if (rule.filenamePattern !== undefined && !new RegExp(rule.filenamePattern).test(filename)) {
-            continue;
-        }
-        const outside = files.filter((file) => !matchesAnyGlob(file, rule.files));
-        if (outside.length === 0)
-            continue;
-        issues.push({
-            code: 'scope',
-            filename,
-            severity,
-            message: `${filename} is scoped by patchPolicy.scopeRules[${String(index)}] to ` +
-                `${rule.files.join(', ')}, but touches: ${outside.join(', ')}. ` +
-                'Move those files to a patch of the class that owns them.',
-        });
-    }
-    return issues;
-}
-async function evaluateDocumentPaths(cfg, projectRoot, severity) {
-    if (cfg.verifyDocumentPaths !== true)
-        return [];
-    const issues = [];
-    for (const range of cfg.reservedRanges ?? []) {
-        for (const allowed of range.allowed) {
-            for (const [field, path] of [
-                ['adr', allowed.adr],
-                ['documentation', allowed.documentation],
-            ]) {
-                if (path === undefined || (await pathExists(join(projectRoot, path))))
-                    continue;
-                issues.push({
-                    code: 'reserved-document-missing',
-                    filename: allowed.filename,
-                    severity,
-                    message: `${allowed.filename}'s reserved-range allowlist entry names ${field} "${path}", ` +
-                        'which does not exist. Restore the document or correct the path.',
-                });
-            }
-        }
-    }
-    return issues;
-}
-/**
- * Evaluates the body-dependent `patchPolicy` rules over a patch queue.
- *
- * @param config - Project configuration
- * @param projectRoot - Project root, for the document-path check
- * @param manifest - Current manifest (category and order per patch)
- * @param entries - Patch queue entries with their bodies
- * @returns Findings, in the same shape {@link evaluatePatchPolicy} returns
- */
-export async function evaluatePatchPolicyContent(config, projectRoot, manifest, entries) {
-    const cfg = config.patchPolicy;
-    if (!cfg || !hasPatchPolicyContentRules(config))
-        return [];
-    const severity = cfg.mutationMode === 'warn' ? 'warning' : 'error';
-    const queueCreated = new Set();
-    for (const entry of entries)
-        for (const file of entry.createdFiles)
-            queueCreated.add(file);
-    const bodies = new Map(entries.map((entry) => [entry.filename, entry.diff]));
-    const issues = [];
-    for (const patch of manifest.patches) {
-        const diff = bodies.get(patch.filename);
-        if (cfg.upstreamAllowlist !== undefined && diff !== undefined) {
-            if (!isReservedOrder(cfg, patch.order)) {
-                const edits = collectUpstreamEdits(diff, queueCreated);
-                issues.push(...evaluateUpstreamEdits(cfg, patch.filename, edits, severity));
-            }
-        }
-        issues.push(...evaluateScopeRules(cfg, patch.filename, patch.category, patch.filesAffected, severity));
-    }
-    issues.push(...(await evaluateDocumentPaths(cfg, projectRoot, severity)));
-    return issues;
-}
-/**
- * {@link evaluatePatchPolicyContent} for a caller without a queue context
- * in hand (`verify`): reads the patch bodies only when a body-dependent
- * rule is configured.
- */
-export async function evaluatePatchPolicyContentForQueue(config, projectRoot, patchesDir, manifest) {
-    if (!hasPatchPolicyContentRules(config))
-        return [];
-    const { entries } = await buildPatchQueueContext(patchesDir);
-    return evaluatePatchPolicyContent(config, projectRoot, manifest, entries);
-}