@ontrails/warden 1.0.0-beta.46 → 1.0.0-beta.48

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @ontrails/warden
 
+## 1.0.0-beta.48
+
+## 1.0.0-beta.47
+
+### Patch Changes
+
+- [`ea2f296`](https://github.com/outfitter-dev/trails/commit/ea2f296e8119cf79bd03aeca3f0aa804f2fbcdd6): Classify adjacent package-route variants in the authored Warden AST regression
+  fixtures as explicit preserves so the completed transition remains auditable.
+- [`90d394c`](https://github.com/outfitter-dev/trails/commit/90d394c005fdf6b898ba7052d0b56755af0f4954): Derive nested worktree, repository, and submodule collection boundaries in the
+  shared Source walker. Regrade and Warden now observe one directly targeted
+  working tree per run, and Regrade audit summaries expose boundary skip counts.
+
 ## 1.0.0-beta.46
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ontrails/warden",
-  "version": "1.0.0-beta.46",
+  "version": "1.0.0-beta.48",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/outfitter-dev/trails.git",
@@ -32,20 +32,20 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@ontrails/adapter-kit": "^1.0.0-beta.46",
-    "@ontrails/cli": "^1.0.0-beta.46",
-    "@ontrails/config": "^1.0.0-beta.46",
-    "@ontrails/permits": "^1.0.0-beta.46",
-    "@ontrails/source": "^1.0.0-beta.46",
-    "@ontrails/store": "^1.0.0-beta.46",
+    "@ontrails/adapter-kit": "^1.0.0-beta.48",
+    "@ontrails/cli": "^1.0.0-beta.48",
+    "@ontrails/config": "^1.0.0-beta.48",
+    "@ontrails/permits": "^1.0.0-beta.48",
+    "@ontrails/source": "^1.0.0-beta.48",
+    "@ontrails/store": "^1.0.0-beta.48",
     "oxc-resolver": "11.19.1",
     "zod": "^4.3.5"
   },
   "devDependencies": {
-    "@ontrails/testing": "^1.0.0-beta.46"
+    "@ontrails/testing": "^1.0.0-beta.48"
   },
   "peerDependencies": {
-    "@ontrails/core": "^1.0.0-beta.46",
-    "@ontrails/topography": "^1.0.0-beta.46"
+    "@ontrails/core": "^1.0.0-beta.48",
+    "@ontrails/topography": "^1.0.0-beta.48"
   }
 }

package/src/cli.ts

@@ -63,7 +63,12 @@ import {
   collectCrudTableIds as collectCrudTableIdsFromAst,
   collectReconcileTableIds as collectReconcileTableIdsFromAst,
 } from './rules/source/stores.js';
-import { findTrailDefinitions, parse } from '@ontrails/source';
+import {
+  collectSourceTree,
+  findTrailDefinitions,
+  parse,
+} from '@ontrails/source';
+import type { SourceTreeCollection } from '@ontrails/source';
 import { collectFileCrudCoverage } from './rules/incomplete-crud.js';
 import { wardenRules, wardenTopoRules } from './rules/index.js';
 import { getWardenRuleMetadata } from './rules/metadata.js';
@@ -238,29 +243,28 @@ export interface WardenReport {
  * surfaces that should not contribute most committed-source diagnostics.
  */
 const collectFilesMatching = (
-  dir: string,
+  collection: NonNullable<ReturnType<typeof collectSourceTree>>,
   pattern: string,
   dot = false
 ): readonly string[] => {
   const glob = new Bun.Glob(pattern);
-  let matches: IterableIterator<string>;
-  try {
-    matches = glob.scanSync({ cwd: dir, dot, onlyFiles: true });
-  } catch {
-    return [];
-  }
-
   const files: string[] = [];
-  for (const match of matches) {
-    if (isWardenSourceScanTarget(match)) {
-      files.push(`${dir}/${match}`);
+  for (const file of collection.files) {
+    if (
+      (dot ||
+        !file.path.split('/').some((segment) => segment.startsWith('.'))) &&
+      glob.match(file.path) &&
+      isWardenSourceScanTarget(file.path)
+    ) {
+      files.push(file.absolutePath);
     }
   }
   return files;
 };
 
-const collectTsFiles = (dir: string): readonly string[] =>
-  collectFilesMatching(dir, '**/*.ts');
+const collectTsFiles = (
+  collection: NonNullable<ReturnType<typeof collectSourceTree>>
+): readonly string[] => collectFilesMatching(collection, '**/*.ts');
 
 const draftModeIncludesFile = (
   filePath: string,
@@ -309,41 +313,42 @@ const filterSourceFilesByScope = (
 
 const EMPTY_WARDEN_SCOPE: WardenScope = { exclude: [] };
 
-const collectDevPermitTestFiles = (dir: string): readonly string[] => {
+const collectDevPermitTestFiles = (
+  collection: NonNullable<ReturnType<typeof collectSourceTree>>
+): readonly string[] => {
   const glob = new Bun.Glob('**/*.ts');
-  let matches: IterableIterator<string>;
-  try {
-    matches = glob.scanSync({ cwd: dir, onlyFiles: true });
-  } catch {
-    return [];
-  }
-
   const files: string[] = [];
-  for (const match of matches) {
-    if (isWardenDevPermitTestScanTarget(match)) {
-      files.push(`${dir}/${match}`);
+  for (const file of collection.files) {
+    if (
+      !file.path.split('/').some((segment) => segment.startsWith('.')) &&
+      glob.match(file.path) &&
+      isWardenDevPermitTestScanTarget(file.path)
+    ) {
+      files.push(file.absolutePath);
     }
   }
   return files;
 };
 
-const collectTextScanFiles = (dir: string): readonly string[] => [
-  ...collectFilesMatching(dir, '**/*.sh', true),
-  ...collectFilesMatching(dir, '**/*.bash', true),
-  ...collectFilesMatching(dir, '**/*.zsh', true),
-  ...collectFilesMatching(dir, '**/*.yml', true),
-  ...collectFilesMatching(dir, '**/*.yaml', true),
-  ...collectFilesMatching(dir, 'plugin/**/*.json', true),
-  ...collectFilesMatching(dir, 'plugin/**/*.jsonc', true),
-  ...collectFilesMatching(dir, 'plugin/**/*.toml', true),
-  ...collectFilesMatching(dir, 'plugin/**/*.cjs', true),
-  ...collectFilesMatching(dir, 'plugin/**/*.mjs', true),
-  ...collectFilesMatching(dir, 'scripts/**/*.json', true),
-  ...collectFilesMatching(dir, 'scripts/**/*.jsonc', true),
-  ...collectFilesMatching(dir, 'scripts/**/*.toml', true),
-  ...collectFilesMatching(dir, 'scripts/**/*.cjs', true),
-  ...collectFilesMatching(dir, 'scripts/**/*.mjs', true),
-  ...collectFilesMatching(dir, '**/package.json', true),
+const collectTextScanFiles = (
+  collection: NonNullable<ReturnType<typeof collectSourceTree>>
+): readonly string[] => [
+  ...collectFilesMatching(collection, '**/*.sh', true),
+  ...collectFilesMatching(collection, '**/*.bash', true),
+  ...collectFilesMatching(collection, '**/*.zsh', true),
+  ...collectFilesMatching(collection, '**/*.yml', true),
+  ...collectFilesMatching(collection, '**/*.yaml', true),
+  ...collectFilesMatching(collection, 'plugin/**/*.json', true),
+  ...collectFilesMatching(collection, 'plugin/**/*.jsonc', true),
+  ...collectFilesMatching(collection, 'plugin/**/*.toml', true),
+  ...collectFilesMatching(collection, 'plugin/**/*.cjs', true),
+  ...collectFilesMatching(collection, 'plugin/**/*.mjs', true),
+  ...collectFilesMatching(collection, 'scripts/**/*.json', true),
+  ...collectFilesMatching(collection, 'scripts/**/*.jsonc', true),
+  ...collectFilesMatching(collection, 'scripts/**/*.toml', true),
+  ...collectFilesMatching(collection, 'scripts/**/*.cjs', true),
+  ...collectFilesMatching(collection, 'scripts/**/*.mjs', true),
+  ...collectFilesMatching(collection, '**/package.json', true),
 ];
 
 const isDocumentationScanTarget = (match: string): boolean => {
@@ -367,19 +372,19 @@ const isDocumentationScanTarget = (match: string): boolean => {
   );
 };
 
-const collectDocumentationFiles = (dir: string): readonly string[] => {
+const collectDocumentationFiles = (
+  collection: NonNullable<ReturnType<typeof collectSourceTree>>
+): readonly string[] => {
   const glob = new Bun.Glob('**/*.md');
-  let matches: IterableIterator<string>;
-  try {
-    matches = glob.scanSync({ cwd: dir, onlyFiles: true });
-  } catch {
-    return [];
-  }
-
   const files: string[] = [];
-  for (const match of matches) {
-    if (isWardenSourceScanTarget(match) && isDocumentationScanTarget(match)) {
-      files.push(`${dir}/${match}`);
+  for (const file of collection.files) {
+    if (
+      !file.path.split('/').some((segment) => segment.startsWith('.')) &&
+      glob.match(file.path) &&
+      isWardenSourceScanTarget(file.path) &&
+      isDocumentationScanTarget(file.path)
+    ) {
+      files.push(file.absolutePath);
     }
   }
   return files;
@@ -692,12 +697,34 @@ const collectReconcileTableIds = (
   }
 };
 
-const loadSourceFiles = async (
-  rootDir: string
-): Promise<readonly SourceFile[]> => {
+interface LoadedSourceFiles {
+  readonly collection: SourceTreeCollection | null;
+  readonly sourceFiles: readonly SourceFile[];
+}
+
+const loadSourceFiles = async (rootDir: string): Promise<LoadedSourceFiles> => {
   const sourceFiles: SourceFile[] = [];
+  const collection = collectSourceTree(rootDir, {
+    classify: (entry) => {
+      if (
+        entry.kind === 'directory' &&
+        ['.git', 'dist', 'node_modules'].includes(entry.name)
+      ) {
+        return { action: 'skip', reason: 'ignored-directory' };
+      }
+      if (entry.kind === 'directory') {
+        return { action: 'recurse' };
+      }
+      return entry.kind === 'file'
+        ? { action: 'collect' }
+        : { action: 'skip', reason: 'unsupported-entry' };
+    },
+  });
+  if (!collection) {
+    return { collection, sourceFiles };
+  }
 
-  for (const filePath of collectTsFiles(rootDir)) {
+  for (const filePath of collectTsFiles(collection)) {
     try {
       sourceFiles.push({
         filePath,
@@ -709,7 +736,7 @@ const loadSourceFiles = async (
     }
   }
 
-  for (const filePath of collectTextScanFiles(rootDir)) {
+  for (const filePath of collectTextScanFiles(collection)) {
     try {
       sourceFiles.push({
         filePath,
@@ -721,7 +748,7 @@ const loadSourceFiles = async (
     }
   }
 
-  for (const filePath of collectDocumentationFiles(rootDir)) {
+  for (const filePath of collectDocumentationFiles(collection)) {
     try {
       sourceFiles.push({
         filePath,
@@ -733,7 +760,7 @@ const loadSourceFiles = async (
     }
   }
 
-  for (const filePath of collectDevPermitTestFiles(rootDir)) {
+  for (const filePath of collectDevPermitTestFiles(collection)) {
     try {
       sourceFiles.push({
         filePath,
@@ -745,7 +772,7 @@ const loadSourceFiles = async (
     }
   }
 
-  return sourceFiles;
+  return { collection, sourceFiles };
 };
 
 const collectTopoKnownIds = (
@@ -983,6 +1010,7 @@ const collectAuthoredMcpSurfaceBindingSets = (
 
 const buildProjectContext = (
   sourceFiles: readonly SourceFile[],
+  collection: SourceTreeCollection | null,
   rootDir: string,
   appTopos: readonly Topo[] = [],
   scope: WardenScope = EMPTY_WARDEN_SCOPE,
@@ -1003,6 +1031,11 @@ const buildProjectContext = (
     (sourceFile) => sourceFile.kind === 'documentation'
   );
   context.publicWorkspaces = collectPublicWorkspaces(rootDir, {
+    collectedPackageJsonPaths: new Set(
+      collection?.files
+        .filter((file) => file.path.endsWith('package.json'))
+        .map((file) => file.path)
+    ),
     exclude: scope.exclude,
   });
   context.governedVocabularyHistoryRequired =
@@ -1366,13 +1399,15 @@ const lintFiles = async (
     };
   }
 
+  const loaded = await loadSourceFiles(rootDir);
   const sourceFiles = filterSourceFilesByScope(
-    filterSourceFilesByDraftMode(await loadSourceFiles(rootDir), drafts),
+    filterSourceFilesByDraftMode(loaded.sourceFiles, drafts),
     rootDir,
     scope
   );
   const context = buildProjectContext(
     sourceFiles,
+    loaded.collection,
     rootDir,
     topoTargets.map((target) => target.topo),
     scope,

package/src/rules/retired-vocabulary.ts

@@ -744,6 +744,16 @@ export const governedVocabularyTransitions =
           reason:
             'Preserve transition regression fixtures and the intentional negative resolver assertion after the public route is retired.',
         },
+        {
+          paths: [
+            'apps/trails/src/__tests__/regrade.test.ts',
+            'packages/regrade/src/downstream/__tests__/ast-rewrite.test.ts',
+            'packages/regrade/src/downstream/__tests__/vocabulary.test.ts',
+          ],
+          pattern: '^@ontrails/warden/ast(?:\\.js|\\.utils|/utils)$',
+          reason:
+            'Preserve the adjacent package-route variants used by the authored Warden AST transition regression fixtures.',
+        },
       ],
       reviewForms: [],
       safeRewriteForms: {

package/src/workspaces.ts

@@ -2,10 +2,14 @@
  * Workspace-manifest discovery for Warden project-aware rules.
  */
 
-import { realpathSync } from 'node:fs';
-import { dirname, join, relative, resolve } from 'node:path';
+import { readFileSync, realpathSync } from 'node:fs';
+import { dirname, join, posix, relative, resolve } from 'node:path';
 
-import { listWorkspacePackages, matchesAnyPathGlob } from '@ontrails/core';
+import {
+  listWorkspacePackages,
+  listWorkspacePatterns,
+  matchesAnyPathGlob,
+} from '@ontrails/core';
 
 export interface WardenPublicWorkspace {
   readonly name: string;
@@ -18,6 +22,8 @@ export interface WardenPublicWorkspace {
 }
 
 export interface WardenWorkspaceCollectionOptions {
+  /** Root-relative package manifests observed by the owning source collection. */
+  readonly collectedPackageJsonPaths?: ReadonlySet<string> | undefined;
   readonly exclude?: readonly string[];
 }
 
@@ -27,6 +33,7 @@ interface PackageManifest {
   readonly files?: unknown;
   readonly name?: unknown;
   readonly private?: unknown;
+  readonly workspaces?: unknown;
 }
 
 const normalizePath = (path: string): string => path.replaceAll('\\', '/');
@@ -42,6 +49,60 @@ const normalizeRealPath = (path: string): string => {
 const rootRelativePath = (rootDir: string, path: string): string =>
   normalizePath(relative(rootDir, path));
 
+const readPackageManifest = (path: string): PackageManifest | undefined => {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8')) as PackageManifest;
+  } catch {
+    return undefined;
+  }
+};
+
+const matchesWorkspacePattern = (
+  workspacePath: string,
+  pattern: string
+): boolean => {
+  const normalizedPattern = normalizePath(pattern).replace(/^\.\//, '');
+  return normalizedPattern.endsWith('/*')
+    ? posix.dirname(workspacePath) === normalizedPattern.slice(0, -2)
+    : workspacePath === normalizedPattern;
+};
+
+interface WorkspaceManifestCandidate {
+  readonly manifest: PackageManifest;
+  readonly packageJsonPath: string;
+}
+
+const collectedWorkspaceManifests = (
+  rootDir: string,
+  packageJsonPaths: ReadonlySet<string>
+): readonly WorkspaceManifestCandidate[] => {
+  if (!packageJsonPaths.has('package.json')) {
+    return [];
+  }
+  const rootManifest = readPackageManifest(join(rootDir, 'package.json'));
+  const patterns = listWorkspacePatterns(rootManifest);
+
+  return [...packageJsonPaths]
+    .filter((path) => path !== 'package.json' && path.endsWith('/package.json'))
+    .toSorted()
+    .flatMap((path): readonly WorkspaceManifestCandidate[] => {
+      const normalizedPath = normalizePath(path).replace(/^\.\//, '');
+      const workspacePath = posix.dirname(normalizedPath);
+      if (
+        posix.isAbsolute(normalizedPath) ||
+        normalizedPath.startsWith('../') ||
+        !patterns.some((pattern) =>
+          matchesWorkspacePattern(workspacePath, pattern)
+        )
+      ) {
+        return [];
+      }
+      const packageJsonPath = resolve(rootDir, normalizedPath);
+      const manifest = readPackageManifest(packageJsonPath);
+      return manifest ? [{ manifest, packageJsonPath }] : [];
+    });
+};
+
 const isRecord = (value: unknown): value is Record<string, unknown> =>
   Boolean(value && typeof value === 'object' && !Array.isArray(value));
 
@@ -172,10 +233,14 @@ export const collectPublicWorkspaces = (
 ): ReadonlyMap<string, WardenPublicWorkspace> => {
   const normalizedRoot = normalizeRealPath(rootDir);
   const workspaces = new Map<string, WardenPublicWorkspace>();
+  const candidates = options.collectedPackageJsonPaths
+    ? collectedWorkspaceManifests(
+        normalizedRoot,
+        options.collectedPackageJsonPaths
+      )
+    : listWorkspacePackages<PackageManifest>(normalizedRoot);
 
-  for (const workspacePackage of listWorkspacePackages<PackageManifest>(
-    normalizedRoot
-  )) {
+  for (const workspacePackage of candidates) {
     const workspace = publicWorkspaceFromManifest(
       workspacePackage.packageJsonPath,
       workspacePackage.manifest