@limenet-ch/baseline 2.9.0

package/js/dist/commands/check.js

@@ -0,0 +1,59 @@
+import { CommentCollector, icon, isError, isFixable } from '../checks/check.js';
+import { isPeriodic } from '../checks/periodic-check.js';
+import { createChecks } from '../checks/registry.js';
+import { excludedChecks } from '../state.js';
+/** Runs every registered check and returns the process exit code. */
+export function runCheck(project, options) {
+    const comments = new CommentCollector();
+    const excluded = excludedChecks(project);
+    let errors = 0;
+    for (const check of createChecks(project, comments)) {
+        // A periodic check that does not apply yields no result at all, matching
+        // the PHP runner rather than counting as a pass.
+        if (isPeriodic(check) && !check.isApplicable()) {
+            continue;
+        }
+        if (excluded.includes(check.name)) {
+            console.log(`⚪ ${displayName(check.name)} (excluded)`);
+            continue;
+        }
+        comments.reset();
+        let fixed = false;
+        let result;
+        if (options.fix && isFixable(check)) {
+            result = check.check();
+            if (isError(result)) {
+                comments.reset();
+                result = check.fix();
+                fixed = !isError(result);
+            }
+        }
+        else {
+            result = check.check();
+        }
+        if (isError(result)) {
+            errors += 1;
+        }
+        const show = isError(result) || options.verbose || fixed;
+        if (show) {
+            console.log(`${fixed ? '🔧' : icon(result)} ${displayName(check.name)}${fixed ? ' (fixed)' : ''}`);
+            for (const comment of comments.all()) {
+                console.log(`   ${comment}`);
+            }
+            if (isError(result)) {
+                console.log(`   💡 To exclude, add "${check.name}" to excludes in .baseline.json`);
+            }
+        }
+    }
+    if (errors !== 0) {
+        console.error(`\nBaseline check failed with ${errors} error(s).`);
+        return 1;
+    }
+    console.log('\nBaseline check passed!');
+    return 0;
+}
+/** nodeVersion => Node Version, matching the PHP runner's ucsplit display. */
+function displayName(name) {
+    return name.replace(/(?<!^)([A-Z])/g, ' $1').replace(/^./, (first) => first.toUpperCase());
+}
+//# sourceMappingURL=check.js.map

package/js/dist/commands/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACjG,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAO5C,qEAAqE;AACrE,MAAM,UAAU,QAAQ,CAAC,OAAgB,EAAE,OAAqB;IAC5D,MAAM,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAA;IACvC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IAExC,IAAI,MAAM,GAAG,CAAC,CAAA;IAEd,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QAClD,yEAAyE;QACzE,iDAAiD;QACjD,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC;YAC7C,SAAQ;QACZ,CAAC;QAED,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YAEtD,SAAQ;QACZ,CAAC;QAED,QAAQ,CAAC,KAAK,EAAE,CAAA;QAEhB,IAAI,KAAK,GAAG,KAAK,CAAA;QACjB,IAAI,MAAmB,CAAA;QAEvB,IAAI,OAAO,CAAC,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAA;YAEtB,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClB,QAAQ,CAAC,KAAK,EAAE,CAAA;gBAChB,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;gBACpB,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YAC5B,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAA;QAC1B,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,CAAA;QACf,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,IAAI,KAAK,CAAA;QAExD,IAAI,IAAI,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAElG,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAA;YAChC,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,CAAC,IAAI,iCAAiC,CAAC,CAAA;YACtF,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,MAAM,YAAY,CAAC,CAAA;QAEjE,OAAO,CAAC,CAAA;IACZ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAA;IAEvC,OAAO,CAAC,CAAA;AACZ,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;AAC9F,CAAC"}

package/js/dist/commands/install-skills.d.ts

@@ -0,0 +1,16 @@
+import type { Project } from '../project.js';
+/**
+ * Copies the packaged skills into the project's .claude/skills/.
+ *
+ * The PHP runner does not need this: Laravel Boost discovers
+ * resources/boost/skills/ by scanning installed composer packages. A JS project
+ * has no vendor autoload and no Boost, so the runner installs them itself.
+ *
+ * js/src and js/dist sit at the same depth, so this resolves identically under
+ * vitest and in the published package.
+ */
+export declare function skillsDirectory(): string;
+export interface InstallSkillsOptions {
+    force: boolean;
+}
+export declare function runInstallSkills(project: Project, options: InstallSkillsOptions): number;

package/js/dist/commands/install-skills.js

@@ -0,0 +1,47 @@
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/**
+ * Copies the packaged skills into the project's .claude/skills/.
+ *
+ * The PHP runner does not need this: Laravel Boost discovers
+ * resources/boost/skills/ by scanning installed composer packages. A JS project
+ * has no vendor autoload and no Boost, so the runner installs them itself.
+ *
+ * js/src and js/dist sit at the same depth, so this resolves identically under
+ * vitest and in the published package.
+ */
+export function skillsDirectory() {
+    return join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'skills');
+}
+export function runInstallSkills(project, options) {
+    const source = skillsDirectory();
+    if (!existsSync(source)) {
+        console.error(`No packaged skills found at ${source}.`);
+        return 1;
+    }
+    let installed = 0;
+    let skipped = 0;
+    for (const skill of readdirSync(source).sort()) {
+        const file = join(source, skill, 'SKILL.md');
+        if (!existsSync(file)) {
+            continue;
+        }
+        const target = `.claude/skills/${skill}/SKILL.md`;
+        if (project.exists(target) && !options.force) {
+            console.log(`⏭  ${skill} (already installed — pass --force to overwrite)`);
+            skipped += 1;
+            continue;
+        }
+        project.write(target, readFileSync(file, 'utf8'));
+        console.log(`✅ ${skill} → ${target}`);
+        installed += 1;
+    }
+    if (installed === 0 && skipped === 0) {
+        console.error('No skills were installed.');
+        return 1;
+    }
+    console.log(`\n${installed} skill(s) installed, ${skipped} left untouched.`);
+    return 0;
+}
+//# sourceMappingURL=install-skills.js.map

package/js/dist/commands/install-skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-skills.js","sourceRoot":"","sources":["../../src/commands/install-skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAGxC;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;AAC9E,CAAC;AAMD,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,OAA6B;IAC5E,MAAM,MAAM,GAAG,eAAe,EAAE,CAAA;IAEhC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,GAAG,CAAC,CAAA;QAEvD,OAAO,CAAC,CAAA;IACZ,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QAE5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,SAAQ;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,KAAK,WAAW,CAAA;QAEjD,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,kDAAkD,CAAC,CAAA;YAC1E,OAAO,IAAI,CAAC,CAAA;YAEZ,SAAQ;QACZ,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QACjD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,MAAM,EAAE,CAAC,CAAA;QACrC,SAAS,IAAI,CAAC,CAAA;IAClB,CAAC;IAED,IAAI,SAAS,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAE1C,OAAO,CAAC,CAAA;IACZ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,wBAAwB,OAAO,kBAAkB,CAAC,CAAA;IAE5E,OAAO,CAAC,CAAA;AACZ,CAAC"}

package/js/dist/commands/periodic.d.ts

@@ -0,0 +1,6 @@
+import type { Project } from '../project.js';
+/**
+ * Walks the developer through every expired periodic check and records the ones
+ * they confirm. Mirrors the artisan limenet:laravel-baseline:periodic command.
+ */
+export declare function runPeriodic(project: Project): Promise<number>;

package/js/dist/commands/periodic.js

@@ -0,0 +1,40 @@
+import { createInterface } from 'node:readline/promises';
+import { CommentCollector } from '../checks/check.js';
+import { isPeriodic } from '../checks/periodic-check.js';
+import { createChecks } from '../checks/registry.js';
+import { recordRun } from '../state.js';
+/**
+ * Walks the developer through every expired periodic check and records the ones
+ * they confirm. Mirrors the artisan limenet:laravel-baseline:periodic command.
+ */
+export async function runPeriodic(project) {
+    const comments = new CommentCollector();
+    const expired = createChecks(project, comments)
+        .filter(isPeriodic)
+        .filter((check) => check.isApplicable())
+        .filter((check) => check.check() === 'fail');
+    if (expired.length === 0) {
+        console.log('All periodic checks are up to date!');
+        return 0;
+    }
+    const readline = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        for (const check of expired) {
+            console.log(`\n${check.name}`);
+            console.log(check.promptDescription());
+            const answer = await readline.question('\nHave you completed this task? [y/N] ');
+            if (answer.trim().toLowerCase().startsWith('y')) {
+                recordRun(project, check.name);
+                console.log('✅ Marked as done.');
+            }
+            else {
+                console.log('⏭ Skipped.');
+            }
+        }
+    }
+    finally {
+        readline.close();
+    }
+    return 0;
+}
+//# sourceMappingURL=periodic.js.map

package/js/dist/commands/periodic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"periodic.js","sourceRoot":"","sources":["../../src/commands/periodic.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB;IAC9C,MAAM,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAA;IAEvC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC;SAC1C,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;SACvC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,MAAM,CAAC,CAAA;IAEhD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAA;QAElD,OAAO,CAAC,CAAA;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAElF,IAAI,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;YAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAA;YAEtC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAA;YAEhF,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9C,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC9B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACJ,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YAC7B,CAAC;QACL,CAAC;IACL,CAAC;YAAS,CAAC;QACP,QAAQ,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;IAED,OAAO,CAAC,CAAA;AACZ,CAAC"}

package/js/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { Check, type CheckResult, CommentCollector, FixableCheck, icon, isError, isFixable, } from './checks/check.js';
+export { isPeriodic, PeriodicCheck } from './checks/periodic-check.js';
+export { allChecks, checkNames, createChecks, findCheck } from './checks/registry.js';
+export { runCheck } from './commands/check.js';
+export { runPeriodic } from './commands/periodic.js';
+export { Policy, PolicyError, policy, setPolicy } from './policy.js';
+export { Project } from './project.js';
+export { type BaselineState, excludedChecks, lastRun, readState, recordRun, STATE_FILE, writeState, } from './state.js';

package/js/dist/index.js

@@ -0,0 +1,9 @@
+export { Check, CommentCollector, FixableCheck, icon, isError, isFixable, } from './checks/check.js';
+export { isPeriodic, PeriodicCheck } from './checks/periodic-check.js';
+export { allChecks, checkNames, createChecks, findCheck } from './checks/registry.js';
+export { runCheck } from './commands/check.js';
+export { runPeriodic } from './commands/periodic.js';
+export { Policy, PolicyError, policy, setPolicy } from './policy.js';
+export { Project } from './project.js';
+export { excludedChecks, lastRun, readState, recordRun, STATE_FILE, writeState, } from './state.js';
+//# sourceMappingURL=index.js.map

package/js/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,KAAK,EAEL,gBAAgB,EAChB,YAAY,EACZ,IAAI,EACJ,OAAO,EACP,SAAS,GACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAEH,cAAc,EACd,OAAO,EACP,SAAS,EACT,SAAS,EACT,UAAU,EACV,UAAU,GACb,MAAM,YAAY,CAAA"}

package/js/dist/policy.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The policy values shared verbatim with the PHP runner (limenet/laravel-baseline).
+ * Both read policy/policy.json, so a version floor or a required key is bumped in
+ * exactly one place.
+ *
+ * Accessors narrow to concrete types and throw otherwise, mirroring
+ * src/Policy/Policy.php so the two runners stay legible side by side.
+ */
+export declare class PolicyError extends Error {
+    static wrongType(key: string, expected: string): PolicyError;
+}
+export declare class Policy {
+    private readonly data;
+    private readonly baseDirectory;
+    constructor(data: unknown, baseDirectory: string);
+    /**
+     * The shipped policy directory. `js/src` and `js/dist` sit at the same depth,
+     * so this resolves identically under vitest and in the published package.
+     */
+    static defaultDirectory(): string;
+    static fromDirectory(directory?: string): Policy;
+    static fromObject(data: unknown, baseDirectory?: string): Policy;
+    number(key: string): number;
+    string(key: string): string;
+    boolean(key: string): boolean;
+    strings(key: string): string[];
+    stringMap(key: string): Record<string, string>;
+    /**
+     * A map whose values are either a single string or a list of them, always
+     * returned as lists — for keys where one accepted value and several are
+     * equally valid, such as the CI templates a job may extend.
+     */
+    stringListMap(key: string): Record<string, string[]>;
+    /**
+     * The verbatim body of a canonical file under policy/templates/. Multi-line
+     * bodies live there rather than JSON-escaped into policy.json, so their diffs
+     * stay readable and their newlines survive both loaders unchanged.
+     */
+    template(name: string): string;
+    private lookup;
+}
+/** The shipped policy, read once per process. */
+export declare function policy(): Policy;
+/** Test seam: swap the process-wide policy, or reset it by passing nothing. */
+export declare function setPolicy(replacement?: Policy): void;

package/js/dist/policy.js

@@ -0,0 +1,145 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/**
+ * The policy values shared verbatim with the PHP runner (limenet/laravel-baseline).
+ * Both read policy/policy.json, so a version floor or a required key is bumped in
+ * exactly one place.
+ *
+ * Accessors narrow to concrete types and throw otherwise, mirroring
+ * src/Policy/Policy.php so the two runners stay legible side by side.
+ */
+export class PolicyError extends Error {
+    static wrongType(key, expected) {
+        return new PolicyError(`Policy key "${key}" is not a ${expected}`);
+    }
+}
+export class Policy {
+    data;
+    baseDirectory;
+    constructor(data, baseDirectory) {
+        this.data = data;
+        this.baseDirectory = baseDirectory;
+    }
+    /**
+     * The shipped policy directory. `js/src` and `js/dist` sit at the same depth,
+     * so this resolves identically under vitest and in the published package.
+     */
+    static defaultDirectory() {
+        return join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'policy');
+    }
+    static fromDirectory(directory = Policy.defaultDirectory()) {
+        const file = join(directory, 'policy.json');
+        if (!existsSync(file)) {
+            throw new PolicyError(`Policy file "${file}" is missing or unreadable. It ships with the package — check the "files" whitelist in package.json.`);
+        }
+        return new Policy(JSON.parse(readFileSync(file, 'utf8')), directory);
+    }
+    static fromObject(data, baseDirectory = '') {
+        return new Policy(data, baseDirectory);
+    }
+    number(key) {
+        const value = this.lookup(key);
+        if (typeof value !== 'number' || !Number.isInteger(value)) {
+            throw PolicyError.wrongType(key, 'integer');
+        }
+        return value;
+    }
+    string(key) {
+        const value = this.lookup(key);
+        if (typeof value !== 'string') {
+            throw PolicyError.wrongType(key, 'string');
+        }
+        return value;
+    }
+    boolean(key) {
+        const value = this.lookup(key);
+        if (typeof value !== 'boolean') {
+            throw PolicyError.wrongType(key, 'boolean');
+        }
+        return value;
+    }
+    strings(key) {
+        const value = this.lookup(key);
+        if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) {
+            throw PolicyError.wrongType(key, 'list of strings');
+        }
+        // A copy, as Policy::strings() returns one: the policy is cached for the
+        // whole process, so handing out the live array would let a caller that
+        // appends to the result (DeniesEnvReadsInClaudeSettingsCheck does)
+        // permanently extend the policy for every later check.
+        return [...value];
+    }
+    stringMap(key) {
+        const value = this.lookup(key);
+        if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+            throw PolicyError.wrongType(key, 'map of strings');
+        }
+        for (const item of Object.values(value)) {
+            if (typeof item !== 'string') {
+                throw PolicyError.wrongType(key, 'map of strings');
+            }
+        }
+        return { ...value };
+    }
+    /**
+     * A map whose values are either a single string or a list of them, always
+     * returned as lists — for keys where one accepted value and several are
+     * equally valid, such as the CI templates a job may extend.
+     */
+    stringListMap(key) {
+        const value = this.lookup(key);
+        const expected = 'map of strings or lists of strings';
+        if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+            throw PolicyError.wrongType(key, expected);
+        }
+        const map = {};
+        for (const [mapKey, item] of Object.entries(value)) {
+            if (typeof item === 'string') {
+                map[mapKey] = [item];
+                continue;
+            }
+            if (!Array.isArray(item) ||
+                item.length === 0 ||
+                item.some((entry) => typeof entry !== 'string')) {
+                throw PolicyError.wrongType(key, expected);
+            }
+            // Copied for the same reason strings() copies — see above.
+            map[mapKey] = [...item];
+        }
+        return map;
+    }
+    /**
+     * The verbatim body of a canonical file under policy/templates/. Multi-line
+     * bodies live there rather than JSON-escaped into policy.json, so their diffs
+     * stay readable and their newlines survive both loaders unchanged.
+     */
+    template(name) {
+        const file = join(this.baseDirectory, 'templates', name);
+        if (!existsSync(file)) {
+            throw new PolicyError(`Policy template "${file}" is missing or unreadable.`);
+        }
+        return readFileSync(file, 'utf8');
+    }
+    lookup(key) {
+        let value = this.data;
+        for (const segment of key.split('.')) {
+            if (typeof value !== 'object' || value === null || !(segment in value)) {
+                throw new PolicyError(`Policy key "${key}" is not defined in policy/policy.json`);
+            }
+            value = value[segment];
+        }
+        return value;
+    }
+}
+let cached;
+/** The shipped policy, read once per process. */
+export function policy() {
+    cached ??= Policy.fromDirectory();
+    return cached;
+}
+/** Test seam: swap the process-wide policy, or reset it by passing nothing. */
+export function setPolicy(replacement) {
+    cached = replacement;
+}
+//# sourceMappingURL=policy.js.map

package/js/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC;;;;;;;GAOG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAClC,MAAM,CAAC,SAAS,CAAC,GAAW,EAAE,QAAgB;QAC1C,OAAO,IAAI,WAAW,CAAC,eAAe,GAAG,cAAc,QAAQ,EAAE,CAAC,CAAA;IACtE,CAAC;CACJ;AAED,MAAM,OAAO,MAAM;IAEM,IAAI;IACJ,aAAa;IAFlC,YACqB,IAAa,EACb,aAAqB;oBADrB,IAAI;6BACJ,aAAa;IAC/B,CAAC;IAEJ;;;OAGG;IACH,MAAM,CAAC,gBAAgB;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,SAAS,GAAG,MAAM,CAAC,gBAAgB,EAAE;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QAE3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CACjB,gBAAgB,IAAI,sGAAsG,CAC7H,CAAA;QACL,CAAC;QAED,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,IAAa,EAAE,aAAa,GAAG,EAAE;QAC/C,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,CAAC,GAAW;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAE9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC/C,CAAC;QAED,OAAO,KAAK,CAAA;IAChB,CAAC;IAED,MAAM,CAAC,GAAW;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAE9B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,CAAC;QAED,OAAO,KAAK,CAAA;IAChB,CAAC;IAED,OAAO,CAAC,GAAW;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAE9B,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC/C,CAAC;QAED,OAAO,KAAK,CAAA;IAChB,CAAC;IAED,OAAO,CAAC,GAAW;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAE9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC1E,MAAM,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;QACvD,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,uDAAuD;QACvD,OAAO,CAAC,GAAI,KAAkB,CAAC,CAAA;IACnC,CAAC;IAED,SAAS,CAAC,GAAW;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAE9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;QACtD,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;YACtD,CAAC;QACL,CAAC;QAED,OAAO,EAAE,GAAI,KAAgC,EAAE,CAAA;IACnD,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,GAAW;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,QAAQ,GAAG,oCAAoC,CAAA;QAErD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,CAAC;QAED,MAAM,GAAG,GAA6B,EAAE,CAAA;QAExC,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBAEpB,SAAQ;YACZ,CAAC;YAED,IACI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBACpB,IAAI,CAAC,MAAM,KAAK,CAAC;gBACjB,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACjD,CAAC;gBACC,MAAM,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAC9C,CAAC;YAED,2DAA2D;YAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAI,IAAiB,CAAC,CAAA;QACzC,CAAC;QAED,OAAO,GAAG,CAAA;IACd,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,IAAY;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;QAExD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CAAC,oBAAoB,IAAI,6BAA6B,CAAC,CAAA;QAChF,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACrC,CAAC;IAEO,MAAM,CAAC,GAAW;QACtB,IAAI,KAAK,GAAY,IAAI,CAAC,IAAI,CAAA;QAE9B,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,WAAW,CAAC,eAAe,GAAG,wCAAwC,CAAC,CAAA;YACrF,CAAC;YAED,KAAK,GAAI,KAAiC,CAAC,OAAO,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,KAAK,CAAA;IAChB,CAAC;CACJ;AAED,IAAI,MAA0B,CAAA;AAE9B,iDAAiD;AACjD,MAAM,UAAU,MAAM;IAClB,MAAM,KAAK,MAAM,CAAC,aAAa,EAAE,CAAA;IAEjC,OAAO,MAAM,CAAA;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,WAAoB;IAC1C,MAAM,GAAG,WAAW,CAAA;AACxB,CAAC"}

package/js/dist/project.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The project under inspection. Every file access a check makes goes through
+ * here, so checks never touch absolute paths and the whole runner can be pointed
+ * at a temporary directory in tests.
+ *
+ * The PHP runner's equivalent is base_path() plus the file helpers on
+ * AbstractCheck.
+ */
+export declare class Project {
+    readonly basePath: string;
+    constructor(basePath: string);
+    static at(basePath?: string): Project;
+    path(relative: string): string;
+    exists(relative: string): boolean;
+    isDirectory(relative: string): boolean;
+    read(relative: string): string | null;
+    readJson<T = Record<string, unknown>>(relative: string): T | null;
+    write(relative: string, contents: string): void;
+    /**
+     * Four-space indent plus a trailing newline, matching the PHP runner's
+     * writePackageJson() so the two never fight over formatting in a project
+     * that runs both.
+     */
+    writeJson(relative: string, data: unknown): void;
+    remove(relative: string): void;
+}

package/js/dist/project.js

@@ -0,0 +1,64 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+/**
+ * The project under inspection. Every file access a check makes goes through
+ * here, so checks never touch absolute paths and the whole runner can be pointed
+ * at a temporary directory in tests.
+ *
+ * The PHP runner's equivalent is base_path() plus the file helpers on
+ * AbstractCheck.
+ */
+export class Project {
+    basePath;
+    constructor(basePath) {
+        this.basePath = basePath;
+    }
+    static at(basePath = process.cwd()) {
+        return new Project(resolve(basePath));
+    }
+    path(relative) {
+        return join(this.basePath, relative);
+    }
+    exists(relative) {
+        return existsSync(this.path(relative));
+    }
+    isDirectory(relative) {
+        const path = this.path(relative);
+        return existsSync(path) && statSync(path).isDirectory();
+    }
+    read(relative) {
+        return this.exists(relative) ? readFileSync(this.path(relative), 'utf8') : null;
+    }
+    readJson(relative) {
+        const contents = this.read(relative);
+        if (contents === null) {
+            return null;
+        }
+        // Throws rather than yielding null, as the PHP runner's JSON_THROW_ON_ERROR
+        // does: null is how callers spell "the file isn't there", so swallowing a
+        // syntax error would let --fix overwrite a file it never managed to read.
+        try {
+            return JSON.parse(contents);
+        }
+        catch (error) {
+            throw new Error(`${relative} is not valid JSON: ${error instanceof Error ? error.message : error}`);
+        }
+    }
+    write(relative, contents) {
+        const path = this.path(relative);
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, contents);
+    }
+    /**
+     * Four-space indent plus a trailing newline, matching the PHP runner's
+     * writePackageJson() so the two never fight over formatting in a project
+     * that runs both.
+     */
+    writeJson(relative, data) {
+        this.write(relative, `${JSON.stringify(data, null, 4)}\n`);
+    }
+    remove(relative) {
+        rmSync(this.path(relative), { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=project.js.map

package/js/dist/project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC9F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD;;;;;;;GAOG;AACH,MAAM,OAAO,OAAO;IACK,QAAQ;IAA7B,YAAqB,QAAgB;wBAAhB,QAAQ;IAAW,CAAC;IAEzC,MAAM,CAAC,EAAE,CAAC,QAAQ,GAAW,OAAO,CAAC,GAAG,EAAE;QACtC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IACzC,CAAC;IAED,IAAI,CAAC,QAAgB;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,CAAC,QAAgB;QACnB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,WAAW,CAAC,QAAgB;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEhC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IAC3D,CAAC;IAED,IAAI,CAAC,QAAgB;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACnF,CAAC;IAED,QAAQ,CAA8B,QAAgB;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEpC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,IAAI,CAAA;QACf,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAM,CAAA;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACX,GAAG,QAAQ,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CACrF,CAAA;QACL,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAgB,EAAE,QAAgB;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEhC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7C,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACjC,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,QAAgB,EAAE,IAAa;QACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,CAAC,QAAgB;QACnB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;CACJ"}

package/js/dist/state.d.ts

@@ -0,0 +1,21 @@
+import type { Project } from './project.js';
+/**
+ * Per-project runner state, in `.baseline.json` at the project root.
+ *
+ * The PHP runner keeps the same two things in `config/baseline.php` — a JS
+ * project has no `config/` directory to write a PHP file into, so the shape is
+ * mirrored in JSON instead:
+ *
+ *   { "excludes": ["hasEditorconfig"], "periodic": { "updatesDependencies": "…" } }
+ */
+export declare const STATE_FILE = ".baseline.json";
+export interface BaselineState {
+    excludes?: string[];
+    periodic?: Record<string, string>;
+}
+export declare function readState(project: Project): BaselineState;
+export declare function excludedChecks(project: Project): string[];
+export declare function writeState(project: Project, state: BaselineState): void;
+/** When the developer last confirmed a periodic check, or null if never. */
+export declare function lastRun(project: Project, checkName: string): Date | null;
+export declare function recordRun(project: Project, checkName: string, when?: Date): void;

package/js/dist/state.js

@@ -0,0 +1,36 @@
+/**
+ * Per-project runner state, in `.baseline.json` at the project root.
+ *
+ * The PHP runner keeps the same two things in `config/baseline.php` — a JS
+ * project has no `config/` directory to write a PHP file into, so the shape is
+ * mirrored in JSON instead:
+ *
+ *   { "excludes": ["hasEditorconfig"], "periodic": { "updatesDependencies": "…" } }
+ */
+export const STATE_FILE = '.baseline.json';
+export function readState(project) {
+    return project.readJson(STATE_FILE) ?? {};
+}
+export function excludedChecks(project) {
+    return readState(project).excludes ?? [];
+}
+export function writeState(project, state) {
+    project.writeJson(STATE_FILE, state);
+}
+/** When the developer last confirmed a periodic check, or null if never. */
+export function lastRun(project, checkName) {
+    const recorded = readState(project).periodic?.[checkName];
+    if (recorded === undefined) {
+        return null;
+    }
+    const parsed = new Date(recorded);
+    return Number.isNaN(parsed.getTime()) ? null : parsed;
+}
+export function recordRun(project, checkName, when = new Date()) {
+    const state = readState(project);
+    writeState(project, {
+        ...state,
+        periodic: { ...state.periodic, [checkName]: when.toISOString() },
+    });
+}
+//# sourceMappingURL=state.js.map

package/js/dist/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAA;AAO1C,MAAM,UAAU,SAAS,CAAC,OAAgB;IACtC,OAAO,OAAO,CAAC,QAAQ,CAAgB,UAAU,CAAC,IAAI,EAAE,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC3C,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,KAAoB;IAC7D,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;AACxC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,OAAO,CAAC,OAAgB,EAAE,SAAiB;IACvD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAA;IAEzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAA;IAEjC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;AACzD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,SAAiB,EAAE,IAAI,GAAS,IAAI,IAAI,EAAE;IAClF,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAEhC,UAAU,CAAC,OAAO,EAAE;QAChB,GAAG,KAAK;QACR,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE;KACnE,CAAC,CAAA;AACN,CAAC"}

package/js/dist/support/ci-jobs.d.ts

@@ -0,0 +1,13 @@
+import type { CheckResult } from '../checks/check.js';
+import type { Project } from '../project.js';
+export declare const CI_FILE = ".gitlab-ci.yml";
+/**
+ * The TS counterpart of AbstractCiJobCheck. A function rather than a base class:
+ * hasCiJobs is a plain Check and hasTrivyConfig a FixableCheck, and TS has no
+ * way to sit one shared base under both.
+ */
+export declare function checkRequiredCiJobs(project: Project, required: Record<string, string[]>, comment: (message: string) => void): CheckResult;
+/** The parsed pipeline, or null with the reason already commented. */
+export declare function readCiJobs(project: Project, comment: (message: string) => void): Record<string, {
+    extends?: unknown;
+} | undefined> | null;

package/js/dist/support/ci-jobs.js

@@ -0,0 +1,42 @@
+import { parseDocument } from 'yaml';
+export const CI_FILE = '.gitlab-ci.yml';
+/**
+ * The TS counterpart of AbstractCiJobCheck. A function rather than a base class:
+ * hasCiJobs is a plain Check and hasTrivyConfig a FixableCheck, and TS has no
+ * way to sit one shared base under both.
+ */
+export function checkRequiredCiJobs(project, required, comment) {
+    const jobs = readCiJobs(project, comment);
+    if (jobs === null) {
+        return 'fail';
+    }
+    for (const [job, accepted] of Object.entries(required)) {
+        const declared = jobs[job]?.extends;
+        if (!Array.isArray(declared) || declared.length !== 1 || !accepted.includes(declared[0])) {
+            const rendered = accepted.map((template) => `[${template}]`).join(' or ');
+            comment(`Missing or misconfigured CI job in ${CI_FILE}: Add job '${job}' with 'extends: ${rendered}'`);
+            return 'fail';
+        }
+    }
+    return 'pass';
+}
+/** The parsed pipeline, or null with the reason already commented. */
+export function readCiJobs(project, comment) {
+    const contents = project.read(CI_FILE);
+    if (contents === null) {
+        comment(`${CI_FILE} not found`);
+        return null;
+    }
+    const document = parseDocument(contents);
+    if (document.errors.length > 0) {
+        comment(`${CI_FILE} could not be parsed: ${document.errors[0]?.message ?? 'invalid YAML'}`);
+        return null;
+    }
+    const config = document.toJS();
+    if (typeof config !== 'object' || config === null) {
+        comment(`${CI_FILE} is empty or invalid`);
+        return null;
+    }
+    return config;
+}
+//# sourceMappingURL=ci-jobs.js.map

package/js/dist/support/ci-jobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-jobs.js","sourceRoot":"","sources":["../../src/support/ci-jobs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAIpC,MAAM,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAA;AAEvC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAC/B,OAAgB,EAChB,QAAkC,EAClC,OAAkC;IAElC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAEzC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChB,OAAO,MAAM,CAAA;IACjB,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;QAEnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAW,CAAC,EAAE,CAAC;YACjG,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACzE,OAAO,CACH,sCAAsC,OAAO,cAAc,GAAG,oBAAoB,QAAQ,GAAG,CAChG,CAAA;YAED,OAAO,MAAM,CAAA;QACjB,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAA;AACjB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,UAAU,CACtB,OAAgB,EAChB,OAAkC;IAElC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAEtC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,OAAO,YAAY,CAAC,CAAA;QAE/B,OAAO,IAAI,CAAA;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IAExC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,OAAO,yBAAyB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc,EAAE,CAAC,CAAA;QAE3F,OAAO,IAAI,CAAA;IACf,CAAC;IAED,MAAM,MAAM,GAAY,QAAQ,CAAC,IAAI,EAAE,CAAA;IAEvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,OAAO,sBAAsB,CAAC,CAAA;QAEzC,OAAO,IAAI,CAAA;IACf,CAAC;IAED,OAAO,MAA2D,CAAA;AACtE,CAAC"}