@objectstack/lint 17.0.0-rc.6 → 17.1.0

package/dist/{runtime-B50yywI_.d.cts → runtime-s3X9D9hm.d.cts}

@@ -1,4 +1,4 @@
-type AnyRec = Record<string, unknown>;
+type AnyRec$1 = Record<string, unknown>;
 /** The three commands that hold a stack to the same author-time bar. */
 declare const AUTHORING_COMMANDS: readonly ["validate", "build", "lint"];
 type AuthoringCommand = (typeof AUTHORING_COMMANDS)[number];
@@ -152,7 +152,7 @@ interface AuthoringRule {
     runtimeTypes?: readonly string[];
     /** REQUIRED when `surfaces` omits `'runtime-publish'`: why the runtime gate does not run it. */
     surfaceReason?: string;
-    run: (stack: AnyRec, ctx: AuthoringRuleContext) => readonly AuthoringFinding[];
+    run: (stack: AnyRec$1, ctx: AuthoringRuleContext) => readonly AuthoringFinding[];
 }
 /**
  * `ExprIssue` is the one rule finding that carries no rule id of its own — it
@@ -168,12 +168,12 @@ declare const AUTHORING_RULES: readonly AuthoringRule[];
 /** The stack tiers a command has in hand when it runs the registry. */
 interface AuthoringRuleRun extends AuthoringRuleContext {
     /** `normalizeStackInput` output — pre-Zod-parse. Always required. */
-    normalized: AnyRec;
+    normalized: AnyRec$1;
     /**
      * Post-Zod-parse stack. Omitted by `os lint`, which does not parse; `parsed`
      * rules then read `normalized` (see `AuthoringRuleInputTier`).
      */
-    parsed?: AnyRec;
+    parsed?: AnyRec$1;
 }
 /** The rules `command` runs, in registry order. */
 declare function authoringRulesFor(command: AuthoringCommand): readonly AuthoringRule[];
@@ -243,7 +243,21 @@ declare function splitBySeverity(findings: readonly AuthoringFinding[]): {
  * a draft autosave). That is the correct place to spend it.
  */
 
-/** Everything the gate needs from the host runtime to build a snapshot. */
+type AnyRec = Record<string, unknown>;
+/**
+ * Everything the gate needs from the host runtime to build a snapshot.
+ *
+ * [#8309] Each key here doubles as the stack key the collection occupies in
+ * the per-write snapshot — see {@link CONTEXT_STACK_KEYS}, which is derived
+ * from this shape and keeps the two from drifting. The set is deliberately
+ * BOUNDED to what the runtime-wired rules actually read (measured, not
+ * projected): the three cross-collection security rules compare
+ * objects × permissions × books, `validateWidgetBindings` resolves widget
+ * bindings against datasets (#7529), and nothing on the runtime surface reads
+ * `positions` / `apps` — so those are NOT carried. Widening the snapshot is a
+ * one-key edit here plus a `CONTEXT_STACK_KEYS` entry, made when a rule that
+ * reads the collection actually crosses the wall, never in advance.
+ */
 interface RuntimeStackContext {
     /**
      * The live object declarations (registry + tenant overlay), as authored.
@@ -254,7 +268,102 @@ interface RuntimeStackContext {
      * package's config file and has to hedge.
      */
     objects?: readonly unknown[];
+    /**
+     * The live permission-set declarations (stack key `permissions`).
+     *
+     * [#8309] The collection the three cross-collection security rules compare
+     * against. Without it a per-write snapshot holds exactly ONE permission set
+     * (the written item), so `security-master-detail-ungranted` reads every
+     * detail object the tenant's OTHER sets grant as ungranted — measured as 38
+     * phantom findings per-write vs 4 whole-stack over the shipped corpus
+     * (PR #7886). `security-book-audience-unknown-set` needs the set NAMES to
+     * resolve a book's `audience.permissionSet` for the same reason.
+     */
+    permissions?: readonly unknown[];
+    /**
+     * The live documentation-book declarations (stack key `books`).
+     *
+     * [#8309] Carried so a `book` write is judged with its siblings present and
+     * replace-not-erase semantics apply to it (an updated book must not read as
+     * a second book of the same name), and so book-derived findings cancel in
+     * the differential for every other write type.
+     */
+    books?: readonly unknown[];
+    /**
+     * The live dataset declarations (stack key `datasets`).
+     *
+     * [#7529] The resolution universe `validateWidgetBindings` links a widget's
+     * `dataset` / `dimensions` / `values` against. Without it a per-write
+     * dashboard snapshot holds no datasets at all, so every widget on a fully
+     * legitimate board reads as dangling — measured as 3 phantom
+     * `widget-dataset-unknown` errors on a 3-widget board bound to a real
+     * dataset, vs 0 with the collection carried (and the genuinely dangling
+     * binding still yields exactly its 1 true error). Carrying it in BOTH
+     * passes also cancels dataset-level findings (`measure-aggregate-incoherent`
+     * is judged per dataset, independent of any widget) in the differential, so
+     * a stored dataset's pre-existing condition is not this write's to answer
+     * for (#4463 D4).
+     */
+    datasets?: readonly unknown[];
 }
+/**
+ * Which package a write belongs to, and what that package is allowed to reach.
+ *
+ * [#9612] The maintainer's ruling, verbatim, is the product decision this type
+ * exists for:
+ *
+ * > 大客户(420 个对象),就不应该出现在一个软件包中啊,这就是划分软件包的价值。
+ * > 客户开发开发,校验是否也应该基于软件包
+ * > 当然这里面要考虑系统对象
+ *
+ * A tenant that has grown to 420 objects is not ONE package — it is many — and
+ * judging one package's write against all 420 is validating against the wrong
+ * unit, not merely validating slowly. A package's declared `dependencies`
+ * bound what it MAY reference, so `package + declared deps + platform/system`
+ * is a closure the platform computes EXACTLY rather than estimates. That is
+ * what separates this from "narrow to whatever the rule can be proven to
+ * reach", which was considered and refused: a per-rule proof is a second
+ * opinion that drifts the moment a rule changes.
+ *
+ * ⛔ Absent — or carrying a package whose dependency declaration cannot be
+ * read — narrows NOTHING. The whole collection is handed over, exactly as
+ * before. The fallback direction is deliberate and is the opposite of a size
+ * threshold: an unknown provenance buys MORE validation input, never less, so
+ * the gate never stops judging (the #9798 / #9261 / ADR-0110 D3 fail-open
+ * shape this card was explicitly forbidden from re-creating).
+ */
+interface RuntimePackageScope {
+    /** The package the written item belongs to. */
+    packageId: string;
+    /**
+     * Every OTHER package this one may reference — the transitive closure of the
+     * written package's declared `dependencies`. Resolved by the host, which is
+     * the side that holds the package registry; this module only reads the set.
+     */
+    dependencies: readonly string[];
+}
+/**
+ * `objects` reduced to the written item's package closure (#9612).
+ *
+ * An object survives when ANY of these holds — the four limbs are the closure
+ * the ruling names, and each one is load-bearing:
+ *
+ *  1. it is a **platform / system object** ({@link isSystemObject}, imported
+ *     rather than re-decided). ⛔ Unconditional: a package legitimately
+ *     references `sys_*` objects it never declares a dependency on, and a
+ *     closure that dropped them would manufacture "unresolved reference"
+ *     findings that describe nothing — the false-positive class PR #7886
+ *     already paid for on the `permissions` collection;
+ *  2. it carries **no package provenance** — a tenant-authored overlay row.
+ *     Nothing declares what such a row may reference, so nothing bounds it and
+ *     it is kept. Conservative by construction;
+ *  3. it belongs to the **written package** itself;
+ *  4. it belongs to one of that package's **declared dependencies**.
+ *
+ * Pure, allocation-light, and total: a non-object member is kept rather than
+ * inspected, because deciding it is not this function's job.
+ */
+declare function narrowObjectsToPackageClosure(objects: readonly unknown[], scope: RuntimePackageScope | undefined): readonly unknown[];
 /** One rule's verdict at the runtime surface, carrying which rule produced it. */
 interface RuntimeGateResult {
     /** Findings the written item ADDED, severity `error` — the reason to refuse the write. */
@@ -275,6 +384,58 @@ declare function runtimeAuthoringRulesFor(type: string): readonly AuthoringRule[
 declare function runtimeGatedTypes(): string[];
 /** The stack key a metadata type occupies in a stack view, or null when unmapped. */
 declare function stackKeyForType(type: string): string | null;
+/**
+ * The baseline/candidate stack pair the gate judges one write against, or
+ * `null` when no snapshot can be built (unmapped type, non-object body).
+ *
+ * Exported (#8309) so the tests that measure per-write vs whole-stack
+ * agreement exercise the REAL construction instead of a hand-kept mirror —
+ * `validate-security-posture.runtime-surface.test.ts` used to mirror this
+ * logic in a local `wouldGateAdd`, which is exactly the drift surface a
+ * snapshot change here would have missed.
+ *
+ * Shape:
+ * - The baseline carries every context collection ({@link CONTEXT_STACK_KEYS})
+ *   WITHOUT the written item. Anything found there is somebody else's
+ *   pre-existing condition and is not this write's to answer for (#4463 D4 —
+ *   the gate blocks new writes, never stored rows). Carrying the sibling
+ *   collections in BOTH passes is what makes their findings cancel in the
+ *   diff — and what gives the cross-collection rules the sibling collection
+ *   they compare against, so the per-write verdict agrees with the
+ *   whole-stack one instead of inventing findings (the 38-vs-4 measurement,
+ *   PR #7886).
+ * - The candidate is the same context with this write's item added. When the
+ *   written type IS one of the context collections (an `object`, `permission`
+ *   or `book` write), the item REPLACES its stored self rather than appearing
+ *   beside it — otherwise an update reads as a duplicate name, and for
+ *   `objects` every lookup in the tenant's model would read as dangling. For
+ *   any other type the item is the sole member of its own collection, so
+ *   index-0 paths in the findings are unambiguously this write.
+ *
+ * Cost (the #4463 D2 question, measured rather than assumed): built per
+ * write, never cached. The construction is one filter + one spread over the
+ * written type's collection; the sibling collections are passed by reference.
+ * Over the shipped corpus (30 objects, 10 permission sets, 1 book) that is
+ * microseconds on a PUBLISH (never a draft autosave, D1) — a cache would buy
+ * nothing and would need cross-org invalidation the gate has no seam for.
+ */
+declare function buildRuntimeWriteSnapshots(args: {
+    /** Singular metadata type of the item being written. */
+    type: string;
+    /** The item body as it will be persisted. */
+    item: unknown;
+    /** Live resolution context from the host runtime. */
+    context?: RuntimeStackContext;
+    /**
+     * [#9612] The written item's package and what it may reach. Omitted — or
+     * carrying a package whose dependencies the host could not read — hands the
+     * rules the WHOLE `objects` collection, exactly as before.
+     */
+    packageScope?: RuntimePackageScope;
+}): {
+    baseline: AnyRec;
+    candidate: AnyRec;
+} | null;
 /**
  * Judge one about-to-be-published metadata item against the shared registry.
  *
@@ -292,8 +453,14 @@ declare function runRuntimeAuthoringRules(args: {
     item: unknown;
     /** Live resolution context from the host runtime. */
     context?: RuntimeStackContext;
+    /**
+     * [#9612] The written item's package closure. Omit to judge against the
+     * whole collection — the pre-#9612 behaviour, and the behaviour every caller
+     * that cannot state a package keeps.
+     */
+    packageScope?: RuntimePackageScope;
     /** ADR-0080 SDUI manifest, when the host has one. */
     sduiManifest?: unknown;
 }): RuntimeGateResult;
 
-export { AUTHORING_COMMANDS as A, EXPRESSION_INVALID as E, type RuntimeGateResult as R, AUTHORING_RULES as a, AUTHORING_SURFACES as b, type AuthoringCommand as c, type AuthoringFinding as d, type AuthoringRule as e, type AuthoringRuleContext as f, type AuthoringRuleInputTier as g, type AuthoringRuleRun as h, type AuthoringRuleTier as i, type AuthoringSeverity as j, type AuthoringSurface as k, type RuntimeStackContext as l, authoringRulesFor as m, runRuntimeAuthoringRules as n, runtimeAuthoringRulesFor as o, runtimeGatedTypes as p, stackKeyForType as q, runAuthoringRules as r, splitBySeverity as s };
+export { AUTHORING_COMMANDS as A, EXPRESSION_INVALID as E, type RuntimeGateResult as R, AUTHORING_RULES as a, AUTHORING_SURFACES as b, type AuthoringCommand as c, type AuthoringFinding as d, type AuthoringRule as e, type AuthoringRuleContext as f, type AuthoringRuleInputTier as g, type AuthoringRuleRun as h, type AuthoringRuleTier as i, type AuthoringSeverity as j, type AuthoringSurface as k, type RuntimePackageScope as l, type RuntimeStackContext as m, authoringRulesFor as n, buildRuntimeWriteSnapshots as o, narrowObjectsToPackageClosure as p, runRuntimeAuthoringRules as q, runAuthoringRules as r, runtimeAuthoringRulesFor as s, runtimeGatedTypes as t, splitBySeverity as u, stackKeyForType as v };

package/dist/{runtime-B50yywI_.d.ts → runtime-s3X9D9hm.d.ts}

@@ -1,4 +1,4 @@
-type AnyRec = Record<string, unknown>;
+type AnyRec$1 = Record<string, unknown>;
 /** The three commands that hold a stack to the same author-time bar. */
 declare const AUTHORING_COMMANDS: readonly ["validate", "build", "lint"];
 type AuthoringCommand = (typeof AUTHORING_COMMANDS)[number];
@@ -152,7 +152,7 @@ interface AuthoringRule {
     runtimeTypes?: readonly string[];
     /** REQUIRED when `surfaces` omits `'runtime-publish'`: why the runtime gate does not run it. */
     surfaceReason?: string;
-    run: (stack: AnyRec, ctx: AuthoringRuleContext) => readonly AuthoringFinding[];
+    run: (stack: AnyRec$1, ctx: AuthoringRuleContext) => readonly AuthoringFinding[];
 }
 /**
  * `ExprIssue` is the one rule finding that carries no rule id of its own — it
@@ -168,12 +168,12 @@ declare const AUTHORING_RULES: readonly AuthoringRule[];
 /** The stack tiers a command has in hand when it runs the registry. */
 interface AuthoringRuleRun extends AuthoringRuleContext {
     /** `normalizeStackInput` output — pre-Zod-parse. Always required. */
-    normalized: AnyRec;
+    normalized: AnyRec$1;
     /**
      * Post-Zod-parse stack. Omitted by `os lint`, which does not parse; `parsed`
      * rules then read `normalized` (see `AuthoringRuleInputTier`).
      */
-    parsed?: AnyRec;
+    parsed?: AnyRec$1;
 }
 /** The rules `command` runs, in registry order. */
 declare function authoringRulesFor(command: AuthoringCommand): readonly AuthoringRule[];
@@ -243,7 +243,21 @@ declare function splitBySeverity(findings: readonly AuthoringFinding[]): {
  * a draft autosave). That is the correct place to spend it.
  */
 
-/** Everything the gate needs from the host runtime to build a snapshot. */
+type AnyRec = Record<string, unknown>;
+/**
+ * Everything the gate needs from the host runtime to build a snapshot.
+ *
+ * [#8309] Each key here doubles as the stack key the collection occupies in
+ * the per-write snapshot — see {@link CONTEXT_STACK_KEYS}, which is derived
+ * from this shape and keeps the two from drifting. The set is deliberately
+ * BOUNDED to what the runtime-wired rules actually read (measured, not
+ * projected): the three cross-collection security rules compare
+ * objects × permissions × books, `validateWidgetBindings` resolves widget
+ * bindings against datasets (#7529), and nothing on the runtime surface reads
+ * `positions` / `apps` — so those are NOT carried. Widening the snapshot is a
+ * one-key edit here plus a `CONTEXT_STACK_KEYS` entry, made when a rule that
+ * reads the collection actually crosses the wall, never in advance.
+ */
 interface RuntimeStackContext {
     /**
      * The live object declarations (registry + tenant overlay), as authored.
@@ -254,7 +268,102 @@ interface RuntimeStackContext {
      * package's config file and has to hedge.
      */
     objects?: readonly unknown[];
+    /**
+     * The live permission-set declarations (stack key `permissions`).
+     *
+     * [#8309] The collection the three cross-collection security rules compare
+     * against. Without it a per-write snapshot holds exactly ONE permission set
+     * (the written item), so `security-master-detail-ungranted` reads every
+     * detail object the tenant's OTHER sets grant as ungranted — measured as 38
+     * phantom findings per-write vs 4 whole-stack over the shipped corpus
+     * (PR #7886). `security-book-audience-unknown-set` needs the set NAMES to
+     * resolve a book's `audience.permissionSet` for the same reason.
+     */
+    permissions?: readonly unknown[];
+    /**
+     * The live documentation-book declarations (stack key `books`).
+     *
+     * [#8309] Carried so a `book` write is judged with its siblings present and
+     * replace-not-erase semantics apply to it (an updated book must not read as
+     * a second book of the same name), and so book-derived findings cancel in
+     * the differential for every other write type.
+     */
+    books?: readonly unknown[];
+    /**
+     * The live dataset declarations (stack key `datasets`).
+     *
+     * [#7529] The resolution universe `validateWidgetBindings` links a widget's
+     * `dataset` / `dimensions` / `values` against. Without it a per-write
+     * dashboard snapshot holds no datasets at all, so every widget on a fully
+     * legitimate board reads as dangling — measured as 3 phantom
+     * `widget-dataset-unknown` errors on a 3-widget board bound to a real
+     * dataset, vs 0 with the collection carried (and the genuinely dangling
+     * binding still yields exactly its 1 true error). Carrying it in BOTH
+     * passes also cancels dataset-level findings (`measure-aggregate-incoherent`
+     * is judged per dataset, independent of any widget) in the differential, so
+     * a stored dataset's pre-existing condition is not this write's to answer
+     * for (#4463 D4).
+     */
+    datasets?: readonly unknown[];
 }
+/**
+ * Which package a write belongs to, and what that package is allowed to reach.
+ *
+ * [#9612] The maintainer's ruling, verbatim, is the product decision this type
+ * exists for:
+ *
+ * > 大客户(420 个对象),就不应该出现在一个软件包中啊,这就是划分软件包的价值。
+ * > 客户开发开发,校验是否也应该基于软件包
+ * > 当然这里面要考虑系统对象
+ *
+ * A tenant that has grown to 420 objects is not ONE package — it is many — and
+ * judging one package's write against all 420 is validating against the wrong
+ * unit, not merely validating slowly. A package's declared `dependencies`
+ * bound what it MAY reference, so `package + declared deps + platform/system`
+ * is a closure the platform computes EXACTLY rather than estimates. That is
+ * what separates this from "narrow to whatever the rule can be proven to
+ * reach", which was considered and refused: a per-rule proof is a second
+ * opinion that drifts the moment a rule changes.
+ *
+ * ⛔ Absent — or carrying a package whose dependency declaration cannot be
+ * read — narrows NOTHING. The whole collection is handed over, exactly as
+ * before. The fallback direction is deliberate and is the opposite of a size
+ * threshold: an unknown provenance buys MORE validation input, never less, so
+ * the gate never stops judging (the #9798 / #9261 / ADR-0110 D3 fail-open
+ * shape this card was explicitly forbidden from re-creating).
+ */
+interface RuntimePackageScope {
+    /** The package the written item belongs to. */
+    packageId: string;
+    /**
+     * Every OTHER package this one may reference — the transitive closure of the
+     * written package's declared `dependencies`. Resolved by the host, which is
+     * the side that holds the package registry; this module only reads the set.
+     */
+    dependencies: readonly string[];
+}
+/**
+ * `objects` reduced to the written item's package closure (#9612).
+ *
+ * An object survives when ANY of these holds — the four limbs are the closure
+ * the ruling names, and each one is load-bearing:
+ *
+ *  1. it is a **platform / system object** ({@link isSystemObject}, imported
+ *     rather than re-decided). ⛔ Unconditional: a package legitimately
+ *     references `sys_*` objects it never declares a dependency on, and a
+ *     closure that dropped them would manufacture "unresolved reference"
+ *     findings that describe nothing — the false-positive class PR #7886
+ *     already paid for on the `permissions` collection;
+ *  2. it carries **no package provenance** — a tenant-authored overlay row.
+ *     Nothing declares what such a row may reference, so nothing bounds it and
+ *     it is kept. Conservative by construction;
+ *  3. it belongs to the **written package** itself;
+ *  4. it belongs to one of that package's **declared dependencies**.
+ *
+ * Pure, allocation-light, and total: a non-object member is kept rather than
+ * inspected, because deciding it is not this function's job.
+ */
+declare function narrowObjectsToPackageClosure(objects: readonly unknown[], scope: RuntimePackageScope | undefined): readonly unknown[];
 /** One rule's verdict at the runtime surface, carrying which rule produced it. */
 interface RuntimeGateResult {
     /** Findings the written item ADDED, severity `error` — the reason to refuse the write. */
@@ -275,6 +384,58 @@ declare function runtimeAuthoringRulesFor(type: string): readonly AuthoringRule[
 declare function runtimeGatedTypes(): string[];
 /** The stack key a metadata type occupies in a stack view, or null when unmapped. */
 declare function stackKeyForType(type: string): string | null;
+/**
+ * The baseline/candidate stack pair the gate judges one write against, or
+ * `null` when no snapshot can be built (unmapped type, non-object body).
+ *
+ * Exported (#8309) so the tests that measure per-write vs whole-stack
+ * agreement exercise the REAL construction instead of a hand-kept mirror —
+ * `validate-security-posture.runtime-surface.test.ts` used to mirror this
+ * logic in a local `wouldGateAdd`, which is exactly the drift surface a
+ * snapshot change here would have missed.
+ *
+ * Shape:
+ * - The baseline carries every context collection ({@link CONTEXT_STACK_KEYS})
+ *   WITHOUT the written item. Anything found there is somebody else's
+ *   pre-existing condition and is not this write's to answer for (#4463 D4 —
+ *   the gate blocks new writes, never stored rows). Carrying the sibling
+ *   collections in BOTH passes is what makes their findings cancel in the
+ *   diff — and what gives the cross-collection rules the sibling collection
+ *   they compare against, so the per-write verdict agrees with the
+ *   whole-stack one instead of inventing findings (the 38-vs-4 measurement,
+ *   PR #7886).
+ * - The candidate is the same context with this write's item added. When the
+ *   written type IS one of the context collections (an `object`, `permission`
+ *   or `book` write), the item REPLACES its stored self rather than appearing
+ *   beside it — otherwise an update reads as a duplicate name, and for
+ *   `objects` every lookup in the tenant's model would read as dangling. For
+ *   any other type the item is the sole member of its own collection, so
+ *   index-0 paths in the findings are unambiguously this write.
+ *
+ * Cost (the #4463 D2 question, measured rather than assumed): built per
+ * write, never cached. The construction is one filter + one spread over the
+ * written type's collection; the sibling collections are passed by reference.
+ * Over the shipped corpus (30 objects, 10 permission sets, 1 book) that is
+ * microseconds on a PUBLISH (never a draft autosave, D1) — a cache would buy
+ * nothing and would need cross-org invalidation the gate has no seam for.
+ */
+declare function buildRuntimeWriteSnapshots(args: {
+    /** Singular metadata type of the item being written. */
+    type: string;
+    /** The item body as it will be persisted. */
+    item: unknown;
+    /** Live resolution context from the host runtime. */
+    context?: RuntimeStackContext;
+    /**
+     * [#9612] The written item's package and what it may reach. Omitted — or
+     * carrying a package whose dependencies the host could not read — hands the
+     * rules the WHOLE `objects` collection, exactly as before.
+     */
+    packageScope?: RuntimePackageScope;
+}): {
+    baseline: AnyRec;
+    candidate: AnyRec;
+} | null;
 /**
  * Judge one about-to-be-published metadata item against the shared registry.
  *
@@ -292,8 +453,14 @@ declare function runRuntimeAuthoringRules(args: {
     item: unknown;
     /** Live resolution context from the host runtime. */
     context?: RuntimeStackContext;
+    /**
+     * [#9612] The written item's package closure. Omit to judge against the
+     * whole collection — the pre-#9612 behaviour, and the behaviour every caller
+     * that cannot state a package keeps.
+     */
+    packageScope?: RuntimePackageScope;
     /** ADR-0080 SDUI manifest, when the host has one. */
     sduiManifest?: unknown;
 }): RuntimeGateResult;
 
-export { AUTHORING_COMMANDS as A, EXPRESSION_INVALID as E, type RuntimeGateResult as R, AUTHORING_RULES as a, AUTHORING_SURFACES as b, type AuthoringCommand as c, type AuthoringFinding as d, type AuthoringRule as e, type AuthoringRuleContext as f, type AuthoringRuleInputTier as g, type AuthoringRuleRun as h, type AuthoringRuleTier as i, type AuthoringSeverity as j, type AuthoringSurface as k, type RuntimeStackContext as l, authoringRulesFor as m, runRuntimeAuthoringRules as n, runtimeAuthoringRulesFor as o, runtimeGatedTypes as p, stackKeyForType as q, runAuthoringRules as r, splitBySeverity as s };
+export { AUTHORING_COMMANDS as A, EXPRESSION_INVALID as E, type RuntimeGateResult as R, AUTHORING_RULES as a, AUTHORING_SURFACES as b, type AuthoringCommand as c, type AuthoringFinding as d, type AuthoringRule as e, type AuthoringRuleContext as f, type AuthoringRuleInputTier as g, type AuthoringRuleRun as h, type AuthoringRuleTier as i, type AuthoringSeverity as j, type AuthoringSurface as k, type RuntimePackageScope as l, type RuntimeStackContext as m, authoringRulesFor as n, buildRuntimeWriteSnapshots as o, narrowObjectsToPackageClosure as p, runRuntimeAuthoringRules as q, runAuthoringRules as r, runtimeAuthoringRulesFor as s, runtimeGatedTypes as t, splitBySeverity as u, stackKeyForType as v };