@limenet-ch/baseline 2.9.0

package/js/dist/checks/check.js

@@ -0,0 +1,54 @@
+export function isError(result) {
+    return result === 'fail';
+}
+export function icon(result) {
+    return { pass: '✅', fail: '❌', warn: '⚠️' }[result];
+}
+/** Collects the actionable messages a single check run produced. */
+export class CommentCollector {
+    comments = [];
+    add(comment) {
+        this.comments.push(comment);
+    }
+    all() {
+        return [...this.comments];
+    }
+    reset() {
+        this.comments = [];
+    }
+}
+export class Check {
+    project;
+    comments;
+    /**
+     * The check's stable identifier — the same string the PHP runner derives from
+     * its class name, and the key used in .baseline.json excludes and in fixtures.
+     * Declared explicitly rather than derived, so a bundler renaming a class can
+     * never silently rename a check.
+     */
+    static checkName;
+    constructor(project, comments) {
+        this.project = project;
+        this.comments = comments;
+    }
+    comment(message) {
+        this.comments.add(message);
+    }
+    get name() {
+        return this.constructor.checkName;
+    }
+}
+/**
+ * A check that can repair what it detects. check() is the dry run, so detection
+ * and repair can never drift apart — the same shape as the PHP
+ * AbstractFixableCheck.
+ */
+export class FixableCheck extends Check {
+    check() {
+        return this.fix(true);
+    }
+}
+export function isFixable(check) {
+    return check instanceof FixableCheck;
+}
+//# sourceMappingURL=check.js.map

package/js/dist/checks/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/checks/check.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,OAAO,CAAC,MAAmB;IACvC,OAAO,MAAM,KAAK,MAAM,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,MAAmB;IACpC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAA;AACvD,CAAC;AAED,oEAAoE;AACpE,MAAM,OAAO,gBAAgB;IACjB,QAAQ,GAAa,EAAE,CAAA;IAE/B,GAAG,CAAC,OAAe;QACf,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC/B,CAAC;IAED,GAAG;QACC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC7B,CAAC;IAED,KAAK;QACD,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAA;IACtB,CAAC;CACJ;AAED,MAAM,OAAgB,KAAK;IAUA,OAAO;IACP,QAAQ;IAV/B;;;;;OAKG;IACH,MAAM,CAAU,SAAS,CAAQ;IAEjC,YACuB,OAAgB,EAChB,QAA0B;uBAD1B,OAAO;wBACP,QAAQ;IAC5B,CAAC;IAIM,OAAO,CAAC,OAAe;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAED,IAAI,IAAI;QACJ,OAAQ,IAAI,CAAC,WAA4B,CAAC,SAAS,CAAA;IACvD,CAAC;CACJ;AAED;;;;GAIG;AACH,MAAM,OAAgB,YAAa,SAAQ,KAAK;IAC5C,KAAK;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;CAGJ;AAED,MAAM,UAAU,SAAS,CAAC,KAAY;IAClC,OAAO,KAAK,YAAY,YAAY,CAAA;AACxC,CAAC"}

package/js/dist/checks/ci-sets-node-version-check.d.ts

@@ -0,0 +1,10 @@
+import { type CheckResult, FixableCheck } from './check.js';
+/**
+ * With no DDEV to derive the Node version from the project, the CI variable is
+ * what keeps the pipeline and the developer's machine on the same major — the
+ * shared template resolves it.
+ */
+export declare class CiSetsNodeVersionCheck extends FixableCheck {
+    static readonly checkName = "ciSetsNodeVersion";
+    fix(dry?: boolean): CheckResult;
+}

package/js/dist/checks/ci-sets-node-version-check.js

@@ -0,0 +1,43 @@
+import { parseDocument } from 'yaml';
+import { policy } from '../policy.js';
+import { FixableCheck } from './check.js';
+const CI_FILE = '.gitlab-ci.yml';
+/**
+ * With no DDEV to derive the Node version from the project, the CI variable is
+ * what keeps the pipeline and the developer's machine on the same major — the
+ * shared template resolves it.
+ */
+export class CiSetsNodeVersionCheck extends FixableCheck {
+    static checkName = 'ciSetsNodeVersion';
+    fix(dry = false) {
+        const contents = this.project.read(CI_FILE);
+        if (contents === null) {
+            this.comment(`${CI_FILE} not found`);
+            return 'fail';
+        }
+        const name = policy().string('ci.nodeVersionVariable.name');
+        const value = policy().string('ci.nodeVersionVariable.value');
+        // parseDocument() collects syntax errors on the document instead of
+        // throwing, and such a document cannot be stringified — so this has to be
+        // checked up front, or the write below crashes the CLI on a malformed
+        // pipeline rather than reporting it.
+        const document = parseDocument(contents);
+        if (document.errors.length > 0) {
+            this.comment(`${CI_FILE} could not be parsed: ${document.errors[0]?.message ?? 'invalid YAML'}`);
+            return 'fail';
+        }
+        if (String(document.getIn(['variables', name]) ?? '') === value) {
+            return 'pass';
+        }
+        this.comment(`${CI_FILE} must set variables.${name} to "${value}" so the shared CI template resolves the Node version`);
+        if (dry) {
+            return 'fail';
+        }
+        // setIn on the parsed document rather than a re-dump, so comments and
+        // formatting elsewhere in the pipeline survive.
+        document.setIn(['variables', name], value);
+        this.project.write(CI_FILE, document.toString());
+        return this.fix(true);
+    }
+}
+//# sourceMappingURL=ci-sets-node-version-check.js.map

package/js/dist/checks/ci-sets-node-version-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-sets-node-version-check.js","sourceRoot":"","sources":["../../src/checks/ci-sets-node-version-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAoB,YAAY,EAAE,MAAM,YAAY,CAAA;AAE3D,MAAM,OAAO,GAAG,gBAAgB,CAAA;AAEhC;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,YAAY;IACpD,MAAM,CAAmB,SAAS,GAAG,mBAAmB,CAAA;IAExD,GAAG,CAAC,GAAG,GAAG,KAAK;QACX,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAE3C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,GAAG,OAAO,YAAY,CAAC,CAAA;YAEpC,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAA;QAC3D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAA;QAE7D,oEAAoE;QACpE,0EAA0E;QAC1E,sEAAsE;QACtE,qCAAqC;QACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;QAExC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,OAAO,yBAAyB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc,EAAE,CAAC,CAAA;YAEhG,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;YAC9D,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,IAAI,CAAC,OAAO,CACR,GAAG,OAAO,uBAAuB,IAAI,QAAQ,KAAK,uDAAuD,CAC5G,CAAA;QAED,IAAI,GAAG,EAAE,CAAC;YACN,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,sEAAsE;QACtE,gDAAgD;QAChD,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAA;QAC1C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QAEhD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;CACJ"}

package/js/dist/checks/claude-settings-check.d.ts

@@ -0,0 +1,30 @@
+import { type CheckResult, FixableCheck } from './check.js';
+export declare const CLAUDE_SETTINGS_FILE = ".claude/settings.json";
+export interface ClaudeSettings {
+    permissions?: {
+        allow?: string[];
+        deny?: string[];
+    };
+    hooks?: Record<string, Array<{
+        matcher?: string;
+        hooks?: Array<{
+            type?: string;
+            command?: string;
+        }>;
+    }>>;
+}
+/**
+ * Shared plumbing for the .claude/settings.json checks, mirroring
+ * src/Checks/AbstractClaudeSettingsCheck.php.
+ */
+export declare abstract class ClaudeSettingsCheck extends FixableCheck {
+    protected readSettings(): ClaudeSettings;
+    protected writeSettings(settings: ClaudeSettings): void;
+    /** Append the required values that are absent, preserving existing entries and order. */
+    protected mergeMissing(existing: string[], required: string[]): string[];
+    /**
+     * The permissions.allow / permissions.deny checks are the same shape: diff a
+     * required list against what is there, comment on each gap, then append.
+     */
+    protected requireEntries(kind: 'allow' | 'deny', required: string[], message: (entry: string) => string, dry: boolean): CheckResult;
+}

package/js/dist/checks/claude-settings-check.js

@@ -0,0 +1,43 @@
+import { FixableCheck } from './check.js';
+export const CLAUDE_SETTINGS_FILE = '.claude/settings.json';
+/**
+ * Shared plumbing for the .claude/settings.json checks, mirroring
+ * src/Checks/AbstractClaudeSettingsCheck.php.
+ */
+export class ClaudeSettingsCheck extends FixableCheck {
+    readSettings() {
+        return this.project.readJson(CLAUDE_SETTINGS_FILE) ?? {};
+    }
+    writeSettings(settings) {
+        this.project.write(CLAUDE_SETTINGS_FILE, `${JSON.stringify(settings, null, 4)}\n`);
+    }
+    /** Append the required values that are absent, preserving existing entries and order. */
+    mergeMissing(existing, required) {
+        return [...existing, ...required.filter((value) => !existing.includes(value))];
+    }
+    /**
+     * The permissions.allow / permissions.deny checks are the same shape: diff a
+     * required list against what is there, comment on each gap, then append.
+     */
+    requireEntries(kind, required, message, dry) {
+        const settings = this.readSettings();
+        const existing = settings.permissions?.[kind] ?? [];
+        const missing = required.filter((entry) => !existing.includes(entry));
+        if (missing.length === 0) {
+            return 'pass';
+        }
+        for (const entry of missing) {
+            this.comment(message(entry));
+        }
+        if (dry) {
+            return 'fail';
+        }
+        settings.permissions = {
+            ...settings.permissions,
+            [kind]: this.mergeMissing(existing, required),
+        };
+        this.writeSettings(settings);
+        return 'pass';
+    }
+}
+//# sourceMappingURL=claude-settings-check.js.map

package/js/dist/checks/claude-settings-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-settings-check.js","sourceRoot":"","sources":["../../src/checks/claude-settings-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,YAAY,EAAE,MAAM,YAAY,CAAA;AAE3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAA;AAO3D;;;GAGG;AACH,MAAM,OAAgB,mBAAoB,SAAQ,YAAY;IAChD,YAAY;QAClB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAiB,oBAAoB,CAAC,IAAI,EAAE,CAAA;IAC5E,CAAC;IAES,aAAa,CAAC,QAAwB;QAC5C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;IACtF,CAAC;IAED,yFAAyF;IAC/E,YAAY,CAAC,QAAkB,EAAE,QAAkB;QACzD,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAClF,CAAC;IAED;;;OAGG;IACO,cAAc,CACpB,IAAsB,EACtB,QAAkB,EAClB,OAAkC,EAClC,GAAY;QAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;QACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAErE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;QAChC,CAAC;QAED,IAAI,GAAG,EAAE,CAAC;YACN,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,QAAQ,CAAC,WAAW,GAAG;YACnB,GAAG,QAAQ,CAAC,WAAW;YACvB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC;SAChD,CAAA;QAED,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;QAE5B,OAAO,MAAM,CAAA;IACjB,CAAC;CACJ"}

package/js/dist/checks/denies-env-reads-in-claude-settings-check.d.ts

@@ -0,0 +1,13 @@
+import type { CheckResult } from './check.js';
+import { ClaudeSettingsCheck } from './claude-settings-check.js';
+export declare class DeniesEnvReadsInClaudeSettingsCheck extends ClaudeSettingsCheck {
+    static readonly checkName = "deniesEnvReadsInClaudeSettings";
+    fix(dry?: boolean): CheckResult;
+    /**
+     * The policy's shared entries plus every environment that ships an encrypted
+     * file (.env.{environment}.encrypted => deny .env.{environment}).
+     *
+     * .env.example is intentionally never denied so it stays readable.
+     */
+    private requiredDenyEntries;
+}

package/js/dist/checks/denies-env-reads-in-claude-settings-check.js

@@ -0,0 +1,25 @@
+import { readdirSync } from 'node:fs';
+import { policy } from '../policy.js';
+import { ClaudeSettingsCheck } from './claude-settings-check.js';
+export class DeniesEnvReadsInClaudeSettingsCheck extends ClaudeSettingsCheck {
+    static checkName = 'deniesEnvReadsInClaudeSettings';
+    fix(dry = false) {
+        return this.requireEntries('deny', this.requiredDenyEntries(), (entry) => `Claude settings: add "${entry}" to permissions.deny in .claude/settings.json — prevents Claude from reading secrets`, dry);
+    }
+    /**
+     * The policy's shared entries plus every environment that ships an encrypted
+     * file (.env.{environment}.encrypted => deny .env.{environment}).
+     *
+     * .env.example is intentionally never denied so it stays readable.
+     */
+    requiredDenyEntries() {
+        const entries = policy().strings('claude.deny.shared');
+        for (const name of readdirSync(this.project.basePath).sort()) {
+            if (name.startsWith('.env.') && name.endsWith('.encrypted')) {
+                entries.push(`Read(./${name.slice(0, -'.encrypted'.length)})`);
+            }
+        }
+        return entries;
+    }
+}
+//# sourceMappingURL=denies-env-reads-in-claude-settings-check.js.map

package/js/dist/checks/denies-env-reads-in-claude-settings-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"denies-env-reads-in-claude-settings-check.js","sourceRoot":"","sources":["../../src/checks/denies-env-reads-in-claude-settings-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAEhE,MAAM,OAAO,mCAAoC,SAAQ,mBAAmB;IACxE,MAAM,CAAmB,SAAS,GAAG,gCAAgC,CAAA;IAErE,GAAG,CAAC,GAAG,GAAG,KAAK;QACX,OAAO,IAAI,CAAC,cAAc,CACtB,MAAM,EACN,IAAI,CAAC,mBAAmB,EAAE,EAC1B,CAAC,KAAK,EAAE,EAAE,CACN,yBAAyB,KAAK,uFAAuF,EACzH,GAAG,CACN,CAAA;IACL,CAAC;IAED;;;;;OAKG;IACK,mBAAmB;QACvB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;QAEtD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3D,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1D,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAClE,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAA;IAClB,CAAC;CACJ"}

package/js/dist/checks/does-not-have-copilot-or-junie-agent-files-check.d.ts

@@ -0,0 +1,5 @@
+import { type CheckResult, FixableCheck } from './check.js';
+export declare class DoesNotHaveCopilotOrJunieAgentFilesCheck extends FixableCheck {
+    static readonly checkName = "doesNotHaveCopilotOrJunieAgentFiles";
+    fix(dry?: boolean): CheckResult;
+}

package/js/dist/checks/does-not-have-copilot-or-junie-agent-files-check.js

@@ -0,0 +1,25 @@
+import { policy } from '../policy.js';
+import { FixableCheck } from './check.js';
+export class DoesNotHaveCopilotOrJunieAgentFilesCheck extends FixableCheck {
+    static checkName = 'doesNotHaveCopilotOrJunieAgentFiles';
+    fix(dry = false) {
+        const present = [];
+        for (const [path, reason] of Object.entries(policy().stringMap('agentFiles.forbidden'))) {
+            if (this.project.exists(path)) {
+                present.push(path);
+                this.comment(`Remove ${path} — ${reason}`);
+            }
+        }
+        if (present.length === 0) {
+            return 'pass';
+        }
+        if (dry) {
+            return 'fail';
+        }
+        for (const path of present) {
+            this.project.remove(path);
+        }
+        return this.fix(true);
+    }
+}
+//# sourceMappingURL=does-not-have-copilot-or-junie-agent-files-check.js.map

package/js/dist/checks/does-not-have-copilot-or-junie-agent-files-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"does-not-have-copilot-or-junie-agent-files-check.js","sourceRoot":"","sources":["../../src/checks/does-not-have-copilot-or-junie-agent-files-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAoB,YAAY,EAAE,MAAM,YAAY,CAAA;AAE3D,MAAM,OAAO,wCAAyC,SAAQ,YAAY;IACtE,MAAM,CAAmB,SAAS,GAAG,qCAAqC,CAAA;IAE1E,GAAG,CAAC,GAAG,GAAG,KAAK;QACX,MAAM,OAAO,GAAa,EAAE,CAAA;QAE5B,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC;YACtF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAClB,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,MAAM,MAAM,EAAE,CAAC,CAAA;YAC9C,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,IAAI,GAAG,EAAE,CAAC;YACN,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC7B,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;CACJ"}

package/js/dist/checks/does-not-use-both-baseline-runners-check.d.ts

@@ -0,0 +1,13 @@
+import { Check, type CheckResult } from './check.js';
+/**
+ * The mirror image of the PHP runner's check of the same name: a project runs
+ * one runner, and where both could run, the Composer one wins. It is the larger
+ * registry — every check here has a counterpart there, plus the Laravel ones —
+ * so this runner is the one that steps aside.
+ *
+ * Uninstalling is the developer's call, so this detects and reports.
+ */
+export declare class DoesNotUseBothBaselineRunnersCheck extends Check {
+    static readonly checkName = "doesNotUseBothBaselineRunners";
+    check(): CheckResult;
+}

package/js/dist/checks/does-not-use-both-baseline-runners-check.js

@@ -0,0 +1,30 @@
+import { policy } from '../policy.js';
+import { Check } from './check.js';
+/**
+ * The mirror image of the PHP runner's check of the same name: a project runs
+ * one runner, and where both could run, the Composer one wins. It is the larger
+ * registry — every check here has a counterpart there, plus the Laravel ones —
+ * so this runner is the one that steps aside.
+ *
+ * Uninstalling is the developer's call, so this detects and reports.
+ */
+export class DoesNotUseBothBaselineRunnersCheck extends Check {
+    static checkName = 'doesNotUseBothBaselineRunners';
+    check() {
+        const composerJson = this.project.readJson('composer.json');
+        if (composerJson === null) {
+            return 'pass';
+        }
+        const composerPackage = policy().string('baseline.composerPackage');
+        for (const section of ['require', 'require-dev']) {
+            if (composerJson[section]?.[composerPackage] === undefined) {
+                continue;
+            }
+            const npmPackage = policy().string('baseline.npmPackage');
+            this.comment(`Two baseline runners in one project: composer.json requires ${composerPackage} in ${section}, and that runner covers everything this one does and more. Run "npm uninstall ${npmPackage}" and drop its "baseline check" entry from the ci-lint npm script.`);
+            return 'fail';
+        }
+        return 'pass';
+    }
+}
+//# sourceMappingURL=does-not-use-both-baseline-runners-check.js.map

package/js/dist/checks/does-not-use-both-baseline-runners-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"does-not-use-both-baseline-runners-check.js","sourceRoot":"","sources":["../../src/checks/does-not-use-both-baseline-runners-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,KAAK,EAAoB,MAAM,YAAY,CAAA;AAOpD;;;;;;;GAOG;AACH,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IACzD,MAAM,CAAmB,SAAS,GAAG,+BAA+B,CAAA;IAEpE,KAAK;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAe,eAAe,CAAC,CAAA;QAEzE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAA;QAEnE,KAAK,MAAM,OAAO,IAAI,CAAC,SAAS,EAAE,aAAa,CAAU,EAAE,CAAC;YACxD,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;gBACzD,SAAQ;YACZ,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;YAEzD,IAAI,CAAC,OAAO,CACR,+DAA+D,eAAe,OAAO,OAAO,kFAAkF,UAAU,oEAAoE,CAC/P,CAAA;YAED,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,OAAO,MAAM,CAAA;IACjB,CAAC;CACJ"}

package/js/dist/checks/hardens-npm-supply-chain-check.d.ts

@@ -0,0 +1,5 @@
+import { type CheckResult, FixableCheck } from './check.js';
+export declare class HardensNpmSupplyChainCheck extends FixableCheck {
+    static readonly checkName = "hardensNpmSupplyChain";
+    fix(dry?: boolean): CheckResult;
+}

package/js/dist/checks/hardens-npm-supply-chain-check.js

@@ -0,0 +1,68 @@
+import { policy } from '../policy.js';
+import { parseNpmrc, upsertNpmrc } from '../support/npmrc.js';
+import { guaranteesAtLeast } from '../support/versions.js';
+import { FixableCheck } from './check.js';
+export class HardensNpmSupplyChainCheck extends FixableCheck {
+    static checkName = 'hardensNpmSupplyChain';
+    fix(dry = false) {
+        const packageJson = this.project.readJson('package.json');
+        if (packageJson === null) {
+            this.comment('Package.json missing: Create package.json in project root');
+            return 'fail';
+        }
+        // npm 12 blocks dependency lifecycle scripts by default and defaults
+        // --allow-git/--allow-remote to none, so requiring it hardens installs for free.
+        const floor = policy().string('npm.minMajor');
+        const constraint = policy().string('npm.constraint');
+        const minReleaseAgeDays = policy().number('npm.minReleaseAgeDays');
+        const npm = packageJson.engines?.npm ?? null;
+        const npmTooLow = npm !== null && !guaranteesAtLeast(npm, floor);
+        if (npm === null) {
+            this.comment(`package.json missing engines.npm: add "engines": { "npm": "${constraint}" } (npm ${floor} blocks dependency lifecycle scripts by default)`);
+            if (dry) {
+                return 'fail';
+            }
+        }
+        else if (npmTooLow) {
+            this.comment(`engines.npm (${npm}) allows npm < ${floor}; require npm >= ${floor} (e.g. "${constraint}")`);
+            if (dry) {
+                return 'fail';
+            }
+        }
+        const npmrcContents = this.project.read('.npmrc');
+        const npmrc = parseNpmrc(npmrcContents);
+        if (policy().boolean('npm.engineStrict') && npmrc['engine-strict'] !== 'true') {
+            this.comment('.npmrc missing engine-strict=true: add "engine-strict=true" so the required npm version is enforced, not just advised');
+            if (dry) {
+                return 'fail';
+            }
+        }
+        const declared = npmrc['min-release-age'];
+        const minReleaseAge = declared === undefined || declared === '' ? null : Number.parseInt(declared, 10);
+        if (minReleaseAge === null || Number.isNaN(minReleaseAge)) {
+            this.comment(`.npmrc missing min-release-age: add "min-release-age=${minReleaseAgeDays}" for a ${minReleaseAgeDays}-day dependency install cooldown`);
+            if (dry) {
+                return 'fail';
+            }
+        }
+        else if (minReleaseAge < minReleaseAgeDays) {
+            this.comment(`.npmrc min-release-age (${minReleaseAge}) is below the recommended ${minReleaseAgeDays}-day cooldown`);
+            if (dry) {
+                return 'fail';
+            }
+        }
+        if (dry) {
+            return 'pass';
+        }
+        if (npm === null || npmTooLow) {
+            packageJson.engines = { ...packageJson.engines, npm: constraint };
+            this.project.writeJson('package.json', packageJson);
+        }
+        this.project.write('.npmrc', upsertNpmrc(npmrcContents, {
+            'engine-strict': 'true',
+            'min-release-age': String(minReleaseAgeDays),
+        }));
+        return this.fix(true);
+    }
+}
+//# sourceMappingURL=hardens-npm-supply-chain-check.js.map

package/js/dist/checks/hardens-npm-supply-chain-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardens-npm-supply-chain-check.js","sourceRoot":"","sources":["../../src/checks/hardens-npm-supply-chain-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAoB,YAAY,EAAE,MAAM,YAAY,CAAA;AAM3D,MAAM,OAAO,0BAA2B,SAAQ,YAAY;IACxD,MAAM,CAAmB,SAAS,GAAG,uBAAuB,CAAA;IAE5D,GAAG,CAAC,GAAG,GAAG,KAAK;QACX,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAc,cAAc,CAAC,CAAA;QAEtE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAA;YAEzE,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,qEAAqE;QACrE,iFAAiF;QACjF,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;QAC7C,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QACpD,MAAM,iBAAiB,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAA;QAElE,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAA;QAC5C,MAAM,SAAS,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAEhE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CACR,8DAA8D,UAAU,YAAY,KAAK,kDAAkD,CAC9I,CAAA;YAED,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;QACL,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,CACR,gBAAgB,GAAG,kBAAkB,KAAK,oBAAoB,KAAK,WAAW,UAAU,IAAI,CAC/F,CAAA;YAED,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,UAAU,CAAC,aAAa,CAAC,CAAA;QAEvC,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,CAAC;YAC5E,IAAI,CAAC,OAAO,CACR,uHAAuH,CAC1H,CAAA;YAED,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAA;QACzC,MAAM,aAAa,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;QAEtG,IAAI,aAAa,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,OAAO,CACR,wDAAwD,iBAAiB,WAAW,iBAAiB,kCAAkC,CAC1I,CAAA;YAED,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;QACL,CAAC;aAAM,IAAI,aAAa,GAAG,iBAAiB,EAAE,CAAC;YAC3C,IAAI,CAAC,OAAO,CACR,2BAA2B,aAAa,8BAA8B,iBAAiB,eAAe,CACzG,CAAA;YAED,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;QACL,CAAC;QAED,IAAI,GAAG,EAAE,CAAC;YACN,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS,EAAE,CAAC;YAC5B,WAAW,CAAC,OAAO,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAA;YACjE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;QACvD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,CACd,QAAQ,EACR,WAAW,CAAC,aAAa,EAAE;YACvB,eAAe,EAAE,MAAM;YACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC;SAC/C,CAAC,CACL,CAAA;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;CACJ"}

package/js/dist/checks/has-ci-jobs-check.d.ts

@@ -0,0 +1,9 @@
+import { Check, type CheckResult } from './check.js';
+/**
+ * The same shared GitLab CI templates the Laravel projects extend, minus the
+ * php job — see ci.requiredJobs.js in the policy.
+ */
+export declare class HasCiJobsCheck extends Check {
+    static readonly checkName = "hasCiJobs";
+    check(): CheckResult;
+}

package/js/dist/checks/has-ci-jobs-check.js

@@ -0,0 +1,14 @@
+import { policy } from '../policy.js';
+import { checkRequiredCiJobs } from '../support/ci-jobs.js';
+import { Check } from './check.js';
+/**
+ * The same shared GitLab CI templates the Laravel projects extend, minus the
+ * php job — see ci.requiredJobs.js in the policy.
+ */
+export class HasCiJobsCheck extends Check {
+    static checkName = 'hasCiJobs';
+    check() {
+        return checkRequiredCiJobs(this.project, policy().stringListMap('ci.requiredJobs.js'), (message) => this.comment(message));
+    }
+}
+//# sourceMappingURL=has-ci-jobs-check.js.map

package/js/dist/checks/has-ci-jobs-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"has-ci-jobs-check.js","sourceRoot":"","sources":["../../src/checks/has-ci-jobs-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,KAAK,EAAoB,MAAM,YAAY,CAAA;AAEpD;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACrC,MAAM,CAAmB,SAAS,GAAG,WAAW,CAAA;IAEhD,KAAK;QACD,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,oBAAoB,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAC/F,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CACxB,CAAA;IACL,CAAC;CACJ"}

package/js/dist/checks/has-editorconfig-check.d.ts

@@ -0,0 +1,6 @@
+import { type CheckResult, FixableCheck } from './check.js';
+export declare class HasEditorconfigCheck extends FixableCheck {
+    static readonly checkName = "hasEditorconfig";
+    fix(dry?: boolean): CheckResult;
+    private canonicalContent;
+}

package/js/dist/checks/has-editorconfig-check.js

@@ -0,0 +1,42 @@
+import { policy } from '../policy.js';
+import { FixableCheck } from './check.js';
+export class HasEditorconfigCheck extends FixableCheck {
+    static checkName = 'hasEditorconfig';
+    fix(dry = false) {
+        const contents = this.project.read('.editorconfig');
+        if (contents === null) {
+            this.comment('Editorconfig missing: Create .editorconfig in project root');
+            if (dry) {
+                return 'fail';
+            }
+            this.project.write('.editorconfig', this.canonicalContent());
+            return this.fix(true);
+        }
+        if (contents.trim() === '') {
+            this.comment('Editorconfig empty: Add content to .editorconfig');
+            if (dry) {
+                return 'fail';
+            }
+            this.project.write('.editorconfig', this.canonicalContent());
+            return this.fix(true);
+        }
+        // A subset of the canonical file, so a project may add its own sections
+        // without failing.
+        const missing = policy()
+            .strings('editorconfig.requiredProperties')
+            .filter((property) => !contents.includes(property));
+        if (missing.length === 0) {
+            return 'pass';
+        }
+        this.comment(`Editorconfig incomplete: Add "${missing[0]}" to .editorconfig`);
+        if (dry) {
+            return 'fail';
+        }
+        this.project.write('.editorconfig', this.canonicalContent());
+        return this.fix(true);
+    }
+    canonicalContent() {
+        return policy().template(policy().string('editorconfig.template'));
+    }
+}
+//# sourceMappingURL=has-editorconfig-check.js.map

package/js/dist/checks/has-editorconfig-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"has-editorconfig-check.js","sourceRoot":"","sources":["../../src/checks/has-editorconfig-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAoB,YAAY,EAAE,MAAM,YAAY,CAAA;AAE3D,MAAM,OAAO,oBAAqB,SAAQ,YAAY;IAClD,MAAM,CAAmB,SAAS,GAAG,iBAAiB,CAAA;IAEtD,GAAG,CAAC,GAAG,GAAG,KAAK;QACX,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAEnD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAA;YAE1E,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAA;YAE5D,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAA;YAEhE,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAA;YAE5D,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QAED,wEAAwE;QACxE,mBAAmB;QACnB,MAAM,OAAO,GAAG,MAAM,EAAE;aACnB,OAAO,CAAC,iCAAiC,CAAC;aAC1C,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;QAEvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,iCAAiC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;QAE7E,IAAI,GAAG,EAAE,CAAC;YACN,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAE5D,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAEO,gBAAgB;QACpB,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAA;IACtE,CAAC;CACJ"}

package/js/dist/checks/has-npm-scripts-check.d.ts

@@ -0,0 +1,5 @@
+import { Check, type CheckResult } from './check.js';
+export declare class HasNpmScriptsCheck extends Check {
+    static readonly checkName = "hasNpmScripts";
+    check(): CheckResult;
+}

package/js/dist/checks/has-npm-scripts-check.js

@@ -0,0 +1,20 @@
+import { policy } from '../policy.js';
+import { Check } from './check.js';
+export class HasNpmScriptsCheck extends Check {
+    static checkName = 'hasNpmScripts';
+    check() {
+        const packageJson = this.project.readJson('package.json');
+        if (packageJson === null) {
+            this.comment('Package.json missing: Create package.json in project root');
+            return 'fail';
+        }
+        for (const script of policy().strings('npmScripts.required')) {
+            if (packageJson.scripts?.[script] === undefined) {
+                this.comment(`Missing ${script} script in package.json: Add "${script}" to scripts section`);
+                return 'fail';
+            }
+        }
+        return 'pass';
+    }
+}
+//# sourceMappingURL=has-npm-scripts-check.js.map

package/js/dist/checks/has-npm-scripts-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"has-npm-scripts-check.js","sourceRoot":"","sources":["../../src/checks/has-npm-scripts-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,KAAK,EAAoB,MAAM,YAAY,CAAA;AAMpD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACzC,MAAM,CAAmB,SAAS,GAAG,eAAe,CAAA;IAEpD,KAAK;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAc,cAAc,CAAC,CAAA;QAEtE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAA;YAEzE,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC3D,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC9C,IAAI,CAAC,OAAO,CAAC,WAAW,MAAM,iCAAiC,MAAM,sBAAsB,CAAC,CAAA;gBAE5F,OAAO,MAAM,CAAA;YACjB,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAA;IACjB,CAAC;CACJ"}

package/js/dist/checks/has-trivy-config-check.d.ts

@@ -0,0 +1,26 @@
+import { type CheckResult, FixableCheck } from './check.js';
+/**
+ * Trivy's setup, identical to the Laravel runner's: the security CI job, the
+ * canonical trivy.yaml, an ignore file, and the cache directory in .gitignore.
+ *
+ * The canonical config skips paths a JS project does not have (`vendor/**`,
+ * `storage/logs/`, `.ddev/`). Skipping a directory that is not there costs
+ * nothing, and one shared template means the two runners cannot drift — so the
+ * npm runner requires the same file rather than a trimmed variant.
+ */
+export declare class HasTrivyConfigCheck extends FixableCheck {
+    static readonly checkName = "hasTrivyConfig";
+    fix(dry?: boolean): CheckResult;
+    /** The canonical body, written verbatim into a project that has none. */
+    private canonicalConfig;
+    /**
+     * The canonical config read as a requirement set: every scalar leaf must be
+     * equal in the project's file, every list leaf contained in it. Keys the
+     * template does not mention are the project's own business.
+     */
+    private requirements;
+    private getByPath;
+    /** Adds each missing job, leaving the rest of the pipeline untouched. */
+    private addMissingCiJobs;
+    private ensureGitignoreEntry;
+}