@maverickcer/env-cap 0.2.0

package/dist/.dts/build/resolution/resolve-tsconfig-paths.d.ts

@@ -0,0 +1,101 @@
+import ts from "typescript";
+import type { ParseWarning } from "../parse.js";
+import type { BuildFileSystem } from "../types.js";
+/**
+ * TypeScript path-alias resolution (ADR 0023, Experimental -- see VERSIONING.md).
+ *
+ * Resolves a bare import specifier (`"@/lib/env.schema.js"`) against a project's own
+ * `tsconfig.json` `compilerOptions.paths`/`baseUrl`, so a schema or consumer reached only
+ * through an alias isn't misreported by `link.ts`/`dependency-graph.ts` as unresolved or
+ * abandoned. Unlike `resolve-package-schema.ts` (ADR 0014), this never crosses a
+ * trust/versioning boundary -- every resolved file is already local, already-trusted
+ * project source -- so it is on by default (auto-detecting `root/tsconfig.json`) rather
+ * than requiring an explicit allowlist.
+ *
+ * The actual `paths`/`baseUrl` matching algorithm (longest-prefix matching, `*` wildcard
+ * substitution, multiple fallback targets, `extends`-chain merging, JSONC parsing) is
+ * delegated entirely to the TypeScript compiler via `ts.resolveModuleName()` and
+ * `ts.parseJsonConfigFileContent()` -- the same functions `tsc`/`tsserver` themselves use --
+ * rather than reimplemented here. This module's own logic is limited to loading the config,
+ * caching resolutions, and enforcing the `node_modules` safety boundary below.
+ */
+/** Parsed `tsconfig.json` `paths`/`baseUrl` configuration, immutable for the life of one generate*() run. See {@link loadTsconfigPaths}. */
+export interface TsconfigPathsResolution {
+    /** The subset of `compilerOptions` `ts.resolveModuleName()` needs -- at minimum `paths` and/or `baseUrl`. */
+    readonly compilerOptions: ts.CompilerOptions;
+    /** Absolute path of the tsconfig.json this was loaded from, for diagnostics. */
+    readonly configFile: string;
+}
+/**
+ * Opaque memoization for {@link resolveAliasImport}, created once per generate*() run via
+ * {@link createAliasResolutionCache} and threaded through `ImportResolutionContext`. Kept
+ * distinct from `TsconfigPathsResolution` (immutable config) so the cache's internal
+ * representation stays free to change without touching that type's shape.
+ */
+export interface AliasResolutionCache {
+    /**
+     * Keyed by `` `${importingFile}\0${specifier}` ``, not by `specifier` alone. With one
+     * fixed `compilerOptions` object and no project-reference support, `paths`-pattern
+     * substitution itself doesn't depend on the importing file -- but `ts.resolveModuleName()`'s
+     * fallback behavior when `paths` doesn't match a real file (classic-mode ancestor search,
+     * extension-preference edge cases) legitimately can. A `Map`, not a network call, so
+     * keying defensively by both costs nothing.
+     */
+    readonly resolutions: Map<string, string | undefined>;
+}
+/** Creates a fresh, empty {@link AliasResolutionCache} for one generate*()/computeArtifacts() run. */
+export declare function createAliasResolutionCache(): AliasResolutionCache;
+export interface LoadTsconfigPathsResult {
+    readonly resolution: TsconfigPathsResolution | undefined;
+    readonly warning: ParseWarning | undefined;
+}
+/**
+ * Loads and parses a `tsconfig.json` for alias resolution. Called exactly once per
+ * `generate*()`/`computeArtifacts()` invocation, at the same point
+ * `resolveAllowlistedPackages()` is already called once -- so at most one tsconfig-related
+ * warning is ever produced per run, never once per file scanned.
+ *
+ * @remarks
+ * `tsconfigOption === false` disables alias resolution entirely.
+ * `tsconfigOption === undefined` (the default) looks for `root/tsconfig.json` exactly --
+ * deliberately not `ts.findConfigFile()`'s upward directory walk, since every other
+ * root-relative mechanism in this codebase (schema discovery, `packages` resolution)
+ * treats `root` as a hard boundary. A missing default tsconfig is silent (most projects
+ * don't use aliases); a missing *explicit* `tsconfigOption` is a real misconfiguration and
+ * warns. `jsconfig.json` is intentionally not auto-detected -- pass `tsconfig:
+ * "jsconfig.json"` explicitly if needed; this loader only cares about the file's JSON
+ * shape, not its name.
+ *
+ * The gate for building a resolution is "`paths` non-empty OR `baseUrl` set", not `paths`
+ * alone -- a `baseUrl`-only tsconfig (no `paths` at all) still makes TypeScript resolve
+ * bare specifiers relative to `baseUrl`, and `ts.resolveModuleName()` already handles that
+ * once `compilerOptions.baseUrl` is passed through.
+ */
+export declare function loadTsconfigPaths(root: string, tsconfigOption: string | false | undefined, fs: BuildFileSystem): Promise<LoadTsconfigPathsResult>;
+/**
+ * Resolves one bare import specifier against a project's `tsconfig.json` `paths`/`baseUrl`,
+ * or returns `undefined` if it doesn't resolve through this mechanism.
+ *
+ * @remarks
+ * Necessarily synchronous -- `ts.resolveModuleName()` has no async form, matching how
+ * `tsc`/`tsserver` themselves always call it. `ts.sys` is used directly as the resolution
+ * host (an existing Node-backed singleton the `typescript` package exports; nothing to
+ * construct).
+ *
+ * Two safety/scope filters apply to any candidate `ts.resolveModuleName()` returns,
+ * independent of its own internal fallback behavior:
+ *  - **Never resolves into `node_modules`.** `ts.resolveModuleName()` can, in principle,
+ *    fall through to classic Node resolution and land inside `node_modules`; any resolved
+ *    path containing a `node_modules` path segment (checked after `path.normalize()`, so
+ *    mixed separators can't slip past it on Windows) is discarded here. Bare package
+ *    specifiers continue to be handled exclusively by `resolvePackageImport()`
+ *    (ADR 0014) -- this mechanism never overlaps with that trust boundary.
+ *  - **`.ts`/`.tsx` only.** Matches `resolveRelativeImport()`'s own existing candidate set
+ *    and `resolve-package-schema.ts`'s `SCHEMA_FILE_EXTENSIONS` -- this codebase's static-
+ *    analysis pipeline is `.ts`/`.tsx` only today. A resolved non-`.ts`/`.tsx` file is a
+ *    real risk, not just a gap: feeding it straight into `ts.createSourceFile()` wouldn't
+ *    error, it would silently parse garbage -- exactly the "guess" this codebase's
+ *    warn-don't-guess philosophy exists to avoid.
+ */
+export declare function resolveAliasImport(specifier: string, importingFile: string, resolution: TsconfigPathsResolution, cache: AliasResolutionCache): string | undefined;
+//# sourceMappingURL=resolve-tsconfig-paths.d.ts.map

package/dist/.dts/build/resolution/resolve-tsconfig-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-tsconfig-paths.d.ts","sourceRoot":"","sources":["../../../../src/build/resolution/resolve-tsconfig-paths.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD;;;;;;;;;;;;;;;;;GAiBG;AAEH,4IAA4I;AAC5I,MAAM,WAAW,uBAAuB;IACtC,6GAA6G;IAC7G,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAA;IAC5C,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CACtD;AAED,sGAAsG;AACtG,wBAAgB,0BAA0B,IAAI,oBAAoB,CAEjE;AAcD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,uBAAuB,GAAG,SAAS,CAAA;IACxD,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,SAAS,CAAA;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,EAC1C,EAAE,EAAE,eAAe,GAClB,OAAO,CAAC,uBAAuB,CAAC,CA4ClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,uBAAuB,EACnC,KAAK,EAAE,oBAAoB,GAC1B,MAAM,GAAG,SAAS,CAiBpB"}

package/dist/.dts/build/resolution/resolve-within-root.d.ts

@@ -0,0 +1,35 @@
+import type { CompatibilityIssue } from "../compatibility.js";
+export type ResolveWithinRootResult = {
+    readonly ok: true;
+    readonly resolved: string;
+} | {
+    readonly ok: false;
+    readonly issue: CompatibilityIssue;
+};
+/**
+ * Plain lexical bounds-check: is `targetPath` inside `baseDir`? Shared by
+ * `resolveWithinRoot()` below (output paths, checked lexically since they
+ * usually don't exist on disk yet) and `resolve-package-schema.ts` (which
+ * additionally re-checks this against `fs.realpath`-resolved paths, since a
+ * package-declared schema path both exists on disk and crosses a real trust
+ * boundary -- see ADR 0014). Boundary-agnostic on purpose: neither caller's
+ * notion of "root" is baked in here.
+ */
+export declare function isWithinDirectory(baseDir: string, targetPath: string): boolean;
+/**
+ * Resolves `location` against `root` and checks the result doesn't escape it
+ * (e.g. `location: "../../malicious.ts"`, or an absolute path on another
+ * branch of the filesystem entirely). Discovery (`include`/`exclude`) is
+ * already safe by construction -- it only ever walks *down* from `root` via
+ * `readdir`, so a pattern can't make it read outside `root`. Output
+ * locations have no such structural guarantee, since `path.resolve` happily
+ * walks back out via `..` segments, so this is a plain lexical bounds-check
+ * (not a symlink-aware `realpath` check -- these are *output* paths that
+ * usually don't exist yet).
+ *
+ * Never throws itself -- returns a `CompatibilityIssue`-shaped finding on
+ * escape so each generator function (`generateEnvManifest`, `generateDocumentation`,
+ * `generateUsageReport`, `generateEnvArtifacts`) can wrap it in its own error type.
+ */
+export declare function resolveWithinRoot(root: string, location: string, optionName: string, functionName: string): ResolveWithinRootResult;
+//# sourceMappingURL=resolve-within-root.d.ts.map

package/dist/.dts/build/resolution/resolve-within-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-within-root.d.ts","sourceRoot":"","sources":["../../../../src/build/resolution/resolve-within-root.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAE7D,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAA;AAE9D;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAG9E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,uBAAuB,CAgBzB"}

package/dist/.dts/build/resolve-import.d.ts

@@ -0,0 +1,50 @@
+import { type PackageSchemaResolutionResult } from "./resolve-package-schema.js";
+import { type AliasResolutionCache, type TsconfigPathsResolution } from "./resolve-tsconfig-paths.js";
+/**
+ * Resolves a relative import specifier (as written in source: `"./schema.js"`,
+ * matching this codebase's own convention of `.js`-suffixed relative imports
+ * pointing at `.ts` source files) to an absolute file path, relative to the
+ * file that contains the import.
+ *
+ * @remarks
+ * Deliberately narrow: only handles a direct relative specifier resolving to
+ * a real `.ts`/`.tsx` file on disk. Bare/package specifiers, namespace
+ * imports, and anything requiring real module resolution (re-export chains,
+ * `exports` map lookups, etc.) return `undefined` -- the caller treats that
+ * as "couldn't statically link" and warns rather than guesses, the same
+ * philosophy `evaluateLiteral` already uses for non-literal expressions.
+ *
+ * @returns The resolved absolute path, or `undefined` when the specifier isn't relative or doesn't resolve to a real file.
+ */
+export declare function resolveRelativeImport(importingFile: string, specifier: string): Promise<string | undefined>;
+/** Shared inputs threaded through every call to {@link resolveImportSpecifier} for one discovery/link run. */
+export interface ImportResolutionContext {
+    /** Absolute path of the project root, used to resolve package specifiers. */
+    readonly root: string;
+    /** Explicit allowlist -- see ADR 0014. Empty/omitted means package resolution never fires, identical to today's behavior. */
+    readonly packages: readonly string[];
+    /** Memoizes package resolution per specifier across the whole run -- see `resolvePackageImport`'s own doc comment for why. */
+    readonly cache: Map<string, Promise<PackageSchemaResolutionResult>>;
+    /** Parsed `tsconfig.json` `paths`/`baseUrl`, or `undefined` when alias resolution found nothing to do or was disabled -- see ADR 0023. */
+    readonly tsconfigPaths: TsconfigPathsResolution | undefined;
+    /** Memoizes alias resolution across the whole run -- see `resolveAliasImport`'s own doc comment for why. Always allocated, even when `tsconfigPaths` is `undefined`, mirroring `cache` above. */
+    readonly aliasCache: AliasResolutionCache;
+}
+/**
+ * The one specifier-resolution entry point `link.ts` and `dependency-graph.ts`
+ * call, instead of each duplicating a
+ * `(await resolveRelativeImport(...)) ?? resolveAliasImport(...) ?? (await resolvePackageImport(...))`
+ * chain at every call site.
+ *
+ * @remarks
+ * Purely a composition point -- no new resolution logic lives here. Tries, in order: the
+ * relative resolver (cheap, no `fs.stat` beyond the local filesystem check it already
+ * does); tsconfig path-alias resolution (ADR 0023, on by default) for a bare specifier
+ * matching the project's own `tsconfig.json` `paths`/`baseUrl`; then package resolution
+ * (ADR 0014) for a bare specifier matching an allow-listed package name. Alias resolution
+ * runs before package resolution because it resolves the consuming project's own local
+ * source (already-trusted, no versioning boundary), the same precedence relative
+ * resolution already has over package resolution.
+ */
+export declare function resolveImportSpecifier(importingFile: string, specifier: string, context: ImportResolutionContext): Promise<string | undefined>;
+//# sourceMappingURL=resolve-import.d.ts.map

package/dist/.dts/build/resolve-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-import.d.ts","sourceRoot":"","sources":["../../../src/build/resolve-import.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAA;AAEpC;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAe7B;AAWD,8GAA8G;AAC9G,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,6HAA6H;IAC7H,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,8HAA8H;IAC9H,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAA;IACnE,0IAA0I;IAC1I,QAAQ,CAAC,aAAa,EAAE,uBAAuB,GAAG,SAAS,CAAA;IAC3D,iMAAiM;IACjM,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;CAC1C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAe7B"}

package/dist/.dts/build/resolve-package-schema.d.ts

@@ -0,0 +1,99 @@
+import type { ParseWarning } from "./parse.js";
+/**
+ * Cross-package schema discovery (ADR 0014, Experimental -- see VERSIONING.md).
+ *
+ * Resolves an explicitly allow-listed installed package name to the one
+ * schema file it declares via its own `"envCap": { "schema": "<path>" }`
+ * package.json field. Every step here is `createRequire(...).resolve(...)`,
+ * `fs.stat`/`fs.realpath`/`fs.readFile` on a path already fully known --
+ * never a `readdir` walk of any directory, named package or not. This is a
+ * completely separate code path from `discover.ts`'s `discoverSchemaFiles()`,
+ * which continues to unconditionally prune `node_modules` during its own
+ * walk exactly as before; the two never overlap.
+ *
+ * This module only ever locates a file. It never imports, requires, or
+ * executes it -- a package-resolved file is fed into the exact same
+ * `parseSchemaFile()`/AST-only pipeline as a locally-discovered file,
+ * indistinguishable from it after resolution. See ADR 0002 and ADR 0014.
+ */
+export declare const SCHEMA_FILE_EXTENSIONS: readonly [".ts", ".tsx"];
+/** 1 MiB. New hardening specific to this trust tier -- a package crosses a
+ *  real versioning/trust boundary that locally-discovered source doesn't,
+ *  so this caps the cost of parsing an oversized or adversarial file before
+ *  any of its content is even read into memory. See ADR 0014. */
+export declare const MAX_PACKAGE_SCHEMA_FILE_BYTES = 1048576;
+export type PackageResolutionFailureCode = "PACKAGE_NOT_FOUND" | "MALFORMED_PACKAGE_JSON" | "FIELD_MISSING" | "INVALID_EXTENSION" | "OUTSIDE_PACKAGE" | "FILE_TOO_LARGE";
+/** Both the authored and resolved forms are kept -- diagnostics benefit from
+ *  showing exactly what a package author wrote versus what it resolved to. */
+export interface PackageOrigin {
+    /** The allow-listed package name that declared this schema. */
+    readonly packageName: string;
+    /** The `"envCap.schema"` value exactly as the package author wrote it. */
+    readonly declaredField: string;
+    /** Absolute, realpath-canonicalized path to the resolved schema file. */
+    readonly resolvedFile: string;
+    /** Absolute, realpath-canonicalized path to the package's own directory. */
+    readonly packageDir: string;
+}
+export type PackageSchemaResolutionResult = {
+    readonly ok: true;
+    readonly origin: PackageOrigin;
+} | {
+    readonly ok: false;
+    readonly code: PackageResolutionFailureCode;
+    readonly reason: string;
+};
+/**
+ * Resolves one allow-listed package name. Memoized in a caller-owned
+ * `cache` (one per `generate*()` invocation, shared with linking/dependency-
+ * graph resolution) so a name referenced from multiple places -- multiple
+ * scanned files bare-importing the same package, or a duplicate entry in
+ * `packages` -- is only ever resolved once. The cache is populated with the
+ * in-flight promise before it settles, so concurrent callers await the same
+ * resolution rather than racing duplicate work.
+ */
+export declare function resolvePackageSchemaFile(packageName: string, root: string, cache: Map<string, Promise<PackageSchemaResolutionResult>>): Promise<PackageSchemaResolutionResult>;
+export interface ResolvedPackageFile {
+    readonly packageName: string;
+    readonly file: string;
+}
+export interface ResolvePackagesResult {
+    readonly files: readonly ResolvedPackageFile[];
+    /** Keyed by resolved file path, for `DiscoveredContract.packageOrigin` lookups downstream. */
+    readonly origins: ReadonlyMap<string, PackageOrigin>;
+    readonly warnings: readonly ParseWarning[];
+}
+/**
+ * Resolves every allow-listed package name. Input is deduplicated first, so
+ * a duplicate entry in `packages` (accidental or defensive) produces exactly
+ * one resolution attempt and, on failure, exactly one warning -- never two.
+ * Never throws: every failure becomes one `ParseWarning`, consistent with
+ * every other static-analysis boundary in this codebase.
+ */
+export declare function resolveAllowlistedPackages(packages: readonly string[], root: string, cache: Map<string, Promise<PackageSchemaResolutionResult>>): Promise<ResolvePackagesResult>;
+/**
+ * Combines local schema-discovery hits with package-resolved files into one
+ * deduplicated list, keyed by realpath rather than lexical absolute path --
+ * package-resolved files are already realpath-canonicalized (see
+ * `resolveUncached` above), but local `discoverSchemaFiles()` hits are plain
+ * `readdir`-derived absolute paths that may themselves traverse a symlink (a
+ * symlinked `root`, or an included path reached through one). Deduplicating
+ * on the lexical path alone would miss the case where the same physical file
+ * is reached twice through two different symlinked routes -- one via local
+ * glob discovery, one via package resolution -- and silently double-count it
+ * into two identical contracts, including the more mundane case of a package
+ * that's both locally glob-reachable (e.g. during a monorepo migration) and
+ * explicitly allow-listed. On a collision, the local path string identity
+ * wins (the package-resolved duplicate is dropped).
+ */
+export declare function mergeLocalAndPackageFiles(localFiles: readonly string[], packageFiles: readonly string[]): Promise<string[]>;
+/**
+ * Bare-specifier-to-allowlist matching, used by `resolve-import.ts`'s
+ * `resolveImportSpecifier()` as its package-resolution fallback. Only ever
+ * attempts resolution for a specifier that is (or is a subpath of) an
+ * allow-listed package name -- any other bare specifier is not this
+ * mechanism's concern and returns `undefined` immediately, identical to
+ * `resolveRelativeImport()`'s existing bare-specifier no-op.
+ */
+export declare function resolvePackageImport(specifier: string, allowedPackages: readonly string[], root: string, cache: Map<string, Promise<PackageSchemaResolutionResult>>): Promise<string | undefined>;
+//# sourceMappingURL=resolve-package-schema.d.ts.map

package/dist/.dts/build/resolve-package-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-package-schema.d.ts","sourceRoot":"","sources":["../../../src/build/resolve-package-schema.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAG9C;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,sBAAsB,0BAA2B,CAAA;AAE9D;;;iEAGiE;AACjE,eAAO,MAAM,6BAA6B,UAAY,CAAA;AAItD,MAAM,MAAM,4BAA4B,GACpC,mBAAmB,GACnB,wBAAwB,GACxB,eAAe,GACf,mBAAmB,GACnB,iBAAiB,GACjB,gBAAgB,CAAA;AAEpB;8EAC8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,MAAM,6BAA6B,GACrC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AA0LhG;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC,GACzD,OAAO,CAAC,6BAA6B,CAAC,CAOxC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAA;IAC9C,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IACpD,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAA;CAC3C;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC,GACzD,OAAO,CAAC,qBAAqB,CAAC,CAuBhC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,OAAO,CAAC,MAAM,EAAE,CAAC,CAuBnB;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,SAAS,MAAM,EAAE,EAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC,GACzD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAO7B"}

package/dist/.dts/build/resolve-tsconfig-paths.d.ts

@@ -0,0 +1,100 @@
+import ts from "typescript";
+import type { ParseWarning } from "./parse.js";
+/**
+ * TypeScript path-alias resolution (ADR 0023, Experimental -- see VERSIONING.md).
+ *
+ * Resolves a bare import specifier (`"@/lib/env.schema.js"`) against a project's own
+ * `tsconfig.json` `compilerOptions.paths`/`baseUrl`, so a schema or consumer reached only
+ * through an alias isn't misreported by `link.ts`/`dependency-graph.ts` as unresolved or
+ * abandoned. Unlike `resolve-package-schema.ts` (ADR 0014), this never crosses a
+ * trust/versioning boundary -- every resolved file is already local, already-trusted
+ * project source -- so it is on by default (auto-detecting `root/tsconfig.json`) rather
+ * than requiring an explicit allowlist.
+ *
+ * The actual `paths`/`baseUrl` matching algorithm (longest-prefix matching, `*` wildcard
+ * substitution, multiple fallback targets, `extends`-chain merging, JSONC parsing) is
+ * delegated entirely to the TypeScript compiler via `ts.resolveModuleName()` and
+ * `ts.parseJsonConfigFileContent()` -- the same functions `tsc`/`tsserver` themselves use --
+ * rather than reimplemented here. This module's own logic is limited to loading the config,
+ * caching resolutions, and enforcing the `node_modules` safety boundary below.
+ */
+/** Parsed `tsconfig.json` `paths`/`baseUrl` configuration, immutable for the life of one generate*() run. See {@link loadTsconfigPaths}. */
+export interface TsconfigPathsResolution {
+    /** The subset of `compilerOptions` `ts.resolveModuleName()` needs -- at minimum `paths` and/or `baseUrl`. */
+    readonly compilerOptions: ts.CompilerOptions;
+    /** Absolute path of the tsconfig.json this was loaded from, for diagnostics. */
+    readonly configFile: string;
+}
+/**
+ * Opaque memoization for {@link resolveAliasImport}, created once per generate*() run via
+ * {@link createAliasResolutionCache} and threaded through `ImportResolutionContext`. Kept
+ * distinct from `TsconfigPathsResolution` (immutable config) so the cache's internal
+ * representation stays free to change without touching that type's shape.
+ */
+export interface AliasResolutionCache {
+    /**
+     * Keyed by `` `${importingFile}\0${specifier}` ``, not by `specifier` alone. With one
+     * fixed `compilerOptions` object and no project-reference support, `paths`-pattern
+     * substitution itself doesn't depend on the importing file -- but `ts.resolveModuleName()`'s
+     * fallback behavior when `paths` doesn't match a real file (classic-mode ancestor search,
+     * extension-preference edge cases) legitimately can. A `Map`, not a network call, so
+     * keying defensively by both costs nothing.
+     */
+    readonly resolutions: Map<string, string | undefined>;
+}
+/** Creates a fresh, empty {@link AliasResolutionCache} for one generate*()/computeArtifacts() run. */
+export declare function createAliasResolutionCache(): AliasResolutionCache;
+export interface LoadTsconfigPathsResult {
+    readonly resolution: TsconfigPathsResolution | undefined;
+    readonly warning: ParseWarning | undefined;
+}
+/**
+ * Loads and parses a `tsconfig.json` for alias resolution. Called exactly once per
+ * `generate*()`/`computeArtifacts()` invocation, at the same point
+ * `resolveAllowlistedPackages()` is already called once -- so at most one tsconfig-related
+ * warning is ever produced per run, never once per file scanned.
+ *
+ * @remarks
+ * `tsconfigOption === false` disables alias resolution entirely.
+ * `tsconfigOption === undefined` (the default) looks for `root/tsconfig.json` exactly --
+ * deliberately not `ts.findConfigFile()`'s upward directory walk, since every other
+ * root-relative mechanism in this codebase (schema discovery, `packages` resolution)
+ * treats `root` as a hard boundary. A missing default tsconfig is silent (most projects
+ * don't use aliases); a missing *explicit* `tsconfigOption` is a real misconfiguration and
+ * warns. `jsconfig.json` is intentionally not auto-detected -- pass `tsconfig:
+ * "jsconfig.json"` explicitly if needed; this loader only cares about the file's JSON
+ * shape, not its name.
+ *
+ * The gate for building a resolution is "`paths` non-empty OR `baseUrl` set", not `paths`
+ * alone -- a `baseUrl`-only tsconfig (no `paths` at all) still makes TypeScript resolve
+ * bare specifiers relative to `baseUrl`, and `ts.resolveModuleName()` already handles that
+ * once `compilerOptions.baseUrl` is passed through.
+ */
+export declare function loadTsconfigPaths(root: string, tsconfigOption: string | false | undefined): Promise<LoadTsconfigPathsResult>;
+/**
+ * Resolves one bare import specifier against a project's `tsconfig.json` `paths`/`baseUrl`,
+ * or returns `undefined` if it doesn't resolve through this mechanism.
+ *
+ * @remarks
+ * Necessarily synchronous -- `ts.resolveModuleName()` has no async form, matching how
+ * `tsc`/`tsserver` themselves always call it. `ts.sys` is used directly as the resolution
+ * host (an existing Node-backed singleton the `typescript` package exports; nothing to
+ * construct).
+ *
+ * Two safety/scope filters apply to any candidate `ts.resolveModuleName()` returns,
+ * independent of its own internal fallback behavior:
+ *  - **Never resolves into `node_modules`.** `ts.resolveModuleName()` can, in principle,
+ *    fall through to classic Node resolution and land inside `node_modules`; any resolved
+ *    path containing a `node_modules` path segment (checked after `path.normalize()`, so
+ *    mixed separators can't slip past it on Windows) is discarded here. Bare package
+ *    specifiers continue to be handled exclusively by `resolvePackageImport()`
+ *    (ADR 0014) -- this mechanism never overlaps with that trust boundary.
+ *  - **`.ts`/`.tsx` only.** Matches `resolveRelativeImport()`'s own existing candidate set
+ *    and `resolve-package-schema.ts`'s `SCHEMA_FILE_EXTENSIONS` -- this codebase's static-
+ *    analysis pipeline is `.ts`/`.tsx` only today. A resolved non-`.ts`/`.tsx` file is a
+ *    real risk, not just a gap: feeding it straight into `ts.createSourceFile()` wouldn't
+ *    error, it would silently parse garbage -- exactly the "guess" this codebase's
+ *    warn-don't-guess philosophy exists to avoid.
+ */
+export declare function resolveAliasImport(specifier: string, importingFile: string, resolution: TsconfigPathsResolution, cache: AliasResolutionCache): string | undefined;
+//# sourceMappingURL=resolve-tsconfig-paths.d.ts.map

package/dist/.dts/build/resolve-tsconfig-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-tsconfig-paths.d.ts","sourceRoot":"","sources":["../../../src/build/resolve-tsconfig-paths.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C;;;;;;;;;;;;;;;;;GAiBG;AAEH,4IAA4I;AAC5I,MAAM,WAAW,uBAAuB;IACtC,6GAA6G;IAC7G,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,eAAe,CAAA;IAC5C,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CACtD;AAED,sGAAsG;AACtG,wBAAgB,0BAA0B,IAAI,oBAAoB,CAEjE;AAWD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,uBAAuB,GAAG,SAAS,CAAA;IACxD,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,SAAS,CAAA;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,GACzC,OAAO,CAAC,uBAAuB,CAAC,CAqClC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,uBAAuB,EACnC,KAAK,EAAE,oBAAoB,GAC1B,MAAM,GAAG,SAAS,CAiBpB"}

package/dist/.dts/build/resolve-within-root.d.ts

@@ -0,0 +1,35 @@
+import type { CompatibilityIssue } from "./compatibility.js";
+export type ResolveWithinRootResult = {
+    readonly ok: true;
+    readonly resolved: string;
+} | {
+    readonly ok: false;
+    readonly issue: CompatibilityIssue;
+};
+/**
+ * Plain lexical bounds-check: is `targetPath` inside `baseDir`? Shared by
+ * `resolveWithinRoot()` below (output paths, checked lexically since they
+ * usually don't exist on disk yet) and `resolve-package-schema.ts` (which
+ * additionally re-checks this against `fs.realpath`-resolved paths, since a
+ * package-declared schema path both exists on disk and crosses a real trust
+ * boundary -- see ADR 0014). Boundary-agnostic on purpose: neither caller's
+ * notion of "root" is baked in here.
+ */
+export declare function isWithinDirectory(baseDir: string, targetPath: string): boolean;
+/**
+ * Resolves `location` against `root` and checks the result doesn't escape it
+ * (e.g. `location: "../../malicious.ts"`, or an absolute path on another
+ * branch of the filesystem entirely). Discovery (`include`/`exclude`) is
+ * already safe by construction -- it only ever walks *down* from `root` via
+ * `readdir`, so a pattern can't make it read outside `root`. Output
+ * locations have no such structural guarantee, since `path.resolve` happily
+ * walks back out via `..` segments, so this is a plain lexical bounds-check
+ * (not a symlink-aware `realpath` check -- these are *output* paths that
+ * usually don't exist yet).
+ *
+ * Never throws itself -- returns a `CompatibilityIssue`-shaped finding on
+ * escape so each generator function (`generateEnvManifest`, `generateDocumentation`,
+ * `generateUsageReport`, `generateEnvArtifacts`) can wrap it in its own error type.
+ */
+export declare function resolveWithinRoot(root: string, location: string, optionName: string, functionName: string): ResolveWithinRootResult;
+//# sourceMappingURL=resolve-within-root.d.ts.map

package/dist/.dts/build/resolve-within-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-within-root.d.ts","sourceRoot":"","sources":["../../../src/build/resolve-within-root.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAA;AAE9D;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAG9E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,uBAAuB,CAgBzB"}

package/dist/.dts/build/sarif.d.ts

@@ -0,0 +1,66 @@
+/**
+ * SARIF export -- an adapter over Finding Model, not a new fact source.
+ * Produces a minimal, spec-conformant SARIF 2.1.0 log
+ * (https://docs.oasis-open.org/sarif/sarif/v2.1.0/) so env-cap's findings can
+ * be consumed by any SARIF-aware tool (GitHub code scanning, most CI security
+ * dashboards) without a bespoke integration.
+ *
+ * Pure and synchronous: every input is already computed by the time this
+ * runs, so this never re-derives a finding, never reads the filesystem, and
+ * never decides what is or isn't a problem -- it only re-shapes what
+ * `buildFindingModel()` already concluded.
+ */
+import type { FindingModel } from "./finding-model.js";
+/** SARIF's `level` enum -- see the SARIF 2.1.0 spec, section 3.27.10. */
+type SarifLevel = "none" | "note" | "warning" | "error";
+interface SarifLocation {
+    readonly physicalLocation: {
+        readonly artifactLocation: {
+            readonly uri: string;
+        };
+        readonly region?: {
+            readonly startLine: number;
+            readonly startColumn: number;
+        };
+    };
+}
+interface SarifResult {
+    readonly ruleId: string;
+    readonly level: SarifLevel;
+    readonly message: {
+        readonly text: string;
+    };
+    readonly locations?: readonly SarifLocation[];
+}
+/** A minimal SARIF 2.1.0 log -- only the properties this adapter actually populates, not the full spec surface. */
+export interface SarifLog {
+    readonly $schema: string;
+    readonly version: "2.1.0";
+    readonly runs: readonly {
+        readonly tool: {
+            readonly driver: {
+                readonly name: string;
+                readonly informationUri: string;
+                readonly version: string;
+                readonly rules: readonly {
+                    readonly id: string;
+                }[];
+            };
+        };
+        readonly results: readonly SarifResult[];
+    }[];
+}
+/**
+ * Projects Finding Model into a SARIF 2.1.0 log.
+ *
+ * @remarks
+ * `rules` lists every distinct `FindingCode` actually present in this run,
+ * sorted -- not the full `FindingCode` union. A SARIF consumer treats the
+ * rules array as "what this tool reported", and advertising rules that
+ * produced no result makes a clean run look like it has unexplained silent
+ * rules. `results` preserves Finding Model's own order, which a caller wanting
+ * a different one sorts themselves.
+ */
+export declare function buildSarifLog(findingModel: FindingModel): SarifLog;
+export {};
+//# sourceMappingURL=sarif.d.ts.map

package/dist/.dts/build/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../../src/build/sarif.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAW,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAG/D,yEAAyE;AACzE,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAA;AAOvD,UAAU,aAAa;IACrB,QAAQ,CAAC,gBAAgB,EAAE;QACzB,QAAQ,CAAC,gBAAgB,EAAE;YAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;QACnD,QAAQ,CAAC,MAAM,CAAC,EAAE;YAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;SAAE,CAAA;KAC/E,CAAA;CACF;AAuCD,UAAU,WAAW;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;CAC9C;AAED,mHAAmH;AACnH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS;QACtB,QAAQ,CAAC,IAAI,EAAE;YACb,QAAQ,CAAC,MAAM,EAAE;gBACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;gBACrB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;gBAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;gBACxB,QAAQ,CAAC,KAAK,EAAE,SAAS;oBAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;iBAAE,EAAE,CAAA;aACnD,CAAA;SACF,CAAA;QACD,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAA;KACzC,EAAE,CAAA;CACJ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,YAAY,EAAE,YAAY,GAAG,QAAQ,CA0BlE"}

package/dist/.dts/build/scan-dependencies.d.ts

@@ -0,0 +1,47 @@
+import type { ImportBinding } from "./parse.js";
+/**
+ * Why a tracked binding's value flowed somewhere this single-file, syntactic
+ * walk cannot follow -- see ADR 0039. Each reason names the exact construct
+ * so a downstream "cannot determine whether X is read" message can cite it,
+ * rather than a single opaque "escape" label.
+ */
+export type EscapeReason = 
+/** `const { ...rest } = contract` -- a rest element captures every remaining key at once. */
+"rest"
+/** `const { X: { Y } } = contract` -- the bound value itself gets destructured again, one level too deep for this pass. */
+ | "nested-pattern"
+/** `const { [expr]: v } = contract` where `expr` isn't a string literal -- the bound key can't be read without evaluating `expr`. */
+ | "computed-key"
+/** `const e = contract` where `e` isn't file-unique/never-assigned (see `resolveAliasTargets`) -- the read is real, but this pass declines to follow `e` any further. */
+ | "reassignment";
+/** One observed use of a tracked contract binding in a consumer file -- see ADR 0039. Consumed by `dependency-graph.ts`. */
+export type AccessSite = {
+    readonly kind: "member";
+    readonly member: string;
+    readonly line: number;
+    readonly column: number;
+} | {
+    readonly kind: "dynamic";
+    readonly line: number;
+    readonly column: number;
+} | {
+    readonly kind: "reference";
+    readonly line: number;
+    readonly column: number;
+} | {
+    readonly kind: "escape";
+    readonly via: EscapeReason;
+    readonly line: number;
+    readonly column: number;
+};
+export interface FileScanResult {
+    readonly file: string;
+    readonly imports: ReadonlyMap<string, ImportBinding>;
+    readonly accessesByLocalName: ReadonlyMap<string, readonly AccessSite[]>;
+    /** True if this file contains a bare `export * from "..."` -- used only to
+     *  flag ambiguous barrel forwarding elsewhere as "unresolved", never to
+     *  follow it (see ADR 0010's scope boundary). */
+    readonly hasWildcardReExport: boolean;
+}
+export declare function scanFileForDependencies(filePath: string, sourceText: string): FileScanResult;
+//# sourceMappingURL=scan-dependencies.d.ts.map

package/dist/.dts/build/scan-dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-dependencies.d.ts","sourceRoot":"","sources":["../../../src/build/scan-dependencies.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAG/C;;;;;GAKG;AACH,MAAM,MAAM,YAAY;AACtB,6FAA6F;AAC3F,MAAM;AACR,2HAA2H;GACzH,gBAAgB;AAClB,qIAAqI;GACnI,cAAc;AAChB,yKAAyK;GACvK,cAAc,CAAA;AAElB,4HAA4H;AAC5H,MAAM,MAAM,UAAU,GAClB;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9E;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAEL,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IACpD,QAAQ,CAAC,mBAAmB,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC,CAAA;IACxE;;qDAEiD;IACjD,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAA;CACtC;AAuPD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,cAAc,CAwK5F"}

package/dist/.dts/build/sort-by-identity.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The canonical ordering every fact model's contract list is sorted by: `file`
+ * (root-relative, POSIX) then `exportName`. One definition so `JSON.stringify`
+ * output is stable and diffs cleanly across Contract / Ownership / Lifecycle /
+ * Dependency Models. Internal -- not re-exported from the public `.` barrel.
+ */
+export declare function byContractIdentity(a: {
+    readonly file: string;
+    readonly exportName: string;
+}, b: {
+    readonly file: string;
+    readonly exportName: string;
+}): number;
+//# sourceMappingURL=sort-by-identity.d.ts.map

package/dist/.dts/build/sort-by-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sort-by-identity.d.ts","sourceRoot":"","sources":["../../../src/build/sort-by-identity.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,CAAC,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EACzD,CAAC,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACxD,MAAM,CAER"}