@ploaness/cli 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Herman Ciechanowiec
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,13 @@
+# @ploaness/cli
+
+The executable half of ploaness: the verification gates and the commands that run them.
+
+This package is published as part of `ploaness` and is not meant to be depended on directly. Install `ploaness`, which re-exports what a project needs.
+
+## Documentation
+
+<https://github.com/ciechanowiec/ploaness#readme>
+
+## License
+
+MIT. See the LICENSE file in this package.

package/dist/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/dist/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":""}

package/dist/bin.js

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+import { commitMessage } from './commands/commit-message.js';
+import { format } from './commands/format.js';
+import { init } from './commands/init.js';
+import { sync } from './commands/sync.js';
+import { verify, verifyOne } from './commands/verify.js';
+// The `ploaness` command. Argument handling is deliberately small: ploaness offers commands, not
+// options that change what is checked. Two flags exist and neither reaches a rule: --enforce=false
+// changes whether findings are fatal, and --verbose changes what is shown. There is no flag that skips
+// a gate.
+import { createRepository as createRepo, memberAt, } from './context.js';
+import { ALL_GATES, gateById } from './gates.js';
+// argv begins with the node binary and the script path; the command follows them.
+const ARGV_COMMAND_OFFSET = 2;
+// Wide enough for the longest gate identifier, so the listing stays aligned.
+const GATE_ID_COLUMN = 22;
+const USAGE = `ploaness, the quality harness for Payload CMS projects
+
+  ploaness verify [--extended] [--enforce=false]   run Default or Extended verification
+  ploaness format                                  apply formatting and safe fixes
+  ploaness sync                                    materialise the managed files
+  ploaness init                                    scaffold the consumer wiring
+  ploaness gate <id> [--verbose]                   run one gate, for debugging
+  ploaness gates                                   list the gates in run order
+  ploaness commit-message <file|--range R|--all>   check one message, a range, or the history
+
+Report-only mode (--enforce=false) prints findings and exits 0. It is not a pass.
+Verbose mode (--verbose) prints what the gate's tool wrote, passing or failing.`;
+const HELP_COMMANDS = new Set(['--help', '-h', 'help']);
+const GATE_SCOPES = new Set(['repository', 'package', 'payload']);
+// Wide enough for the longest scope name, so the titles beside them line up.
+const GATE_SCOPE_COLUMN = 10;
+// `--scope` and `--ids` exist so a script can ask which gates judge a repository's shape rather than
+// keeping its own copy of the answer. ploaness's own verification runs such a list, in an order it
+// chooses deliberately; what it could not do before was notice a NEW repository-scope gate that nobody
+// had added to it - which is the failure that let `arch` sit unrun while a cycle grew behind it.
+const SCOPE_OPTION = '--scope=';
+const IDS_OPTION = '--ids';
+const listGates = (rest) => {
+    const requested = rest
+        .find((argument) => argument.startsWith(SCOPE_OPTION))
+        ?.slice(SCOPE_OPTION.length);
+    const selected = ALL_GATES.filter((gate) => requested === undefined || gate.scope === requested);
+    for (const gate of selected) {
+        if (rest.includes(IDS_OPTION)) {
+            console.info(gate.id);
+        }
+        else {
+            const mode = gate.isExtended ? 'extended' : 'default ';
+            console.info(`${mode}  ${gate.id.padEnd(GATE_ID_COLUMN)} ${gate.scope.padEnd(GATE_SCOPE_COLUMN)} ${gate.title}`);
+        }
+    }
+    return 0;
+};
+// A single gate names no member, so a member-scope gate is asked about the package the engineer is
+// standing in. That is the only reading that stays useful in a workspace and is exactly today's
+// behaviour in a single-package repository, where there is one member and it is the root.
+const runOneGate = async (repo, id, isVerbose) => {
+    const gate = id === undefined ? undefined : gateById(id);
+    if (gate === undefined) {
+        console.error(`unknown gate "${id ?? ''}". Run \`ploaness gates\` to list them.`);
+        return 1;
+    }
+    const member = gate.scope === 'repository' ? undefined : memberAt(repo, process.cwd());
+    return await verifyOne(repo, { gate, member }, isVerbose);
+};
+const COMMANDS = {
+    verify: async (repo, rest) => await verify(repo, rest.includes('--extended')),
+    format: (repo) => format(repo),
+    sync: (repo) => sync(repo),
+    init: (repo) => init(repo),
+    gates: (_repository, rest) => listGates(rest),
+    gate: async (repo, rest) => await runOneGate(repo, rest[0], rest.includes(VERBOSE_OPTION)),
+    'commit-message': (repo, rest) => commitMessage(repo, rest[0], rest[1]),
+};
+// Each command owns its grammar. A global allowlist rejected the documented `commit-message --all` and
+// `--range` modes while accepting `--extended` on commands that do not use it; checking the whole shape
+// also stops extra positional arguments and single-dash options from disappearing silently.
+const VERIFY_OPTIONS = new Set(['--extended', '--enforce=false']);
+const VERBOSE_OPTION = '--verbose';
+const GATE_OPTIONS = new Set([VERBOSE_OPTION]);
+const RANGE_ARGUMENT_COUNT = 2;
+const hasDistinctMembersOf = (values, allowed) => values.every((value) => allowed.has(value)) &&
+    new Set(values).size === values.length;
+const isCommitMessageArguments = (rest) => {
+    const [mode, value] = rest;
+    if (mode === '--all') {
+        return rest.length === 1;
+    }
+    if (mode === '--range') {
+        return rest.length === RANGE_ARGUMENT_COUNT && value !== undefined && !value.startsWith('-');
+    }
+    return rest.length === 1 && mode !== undefined && !mode.startsWith('-');
+};
+const acceptsArguments = {
+    verify: (rest) => hasDistinctMembersOf(rest, VERIFY_OPTIONS),
+    format: (rest) => rest.length === 0,
+    sync: (rest) => rest.length === 0,
+    init: (rest) => rest.length === 0,
+    // A scope must name one ploaness knows, so a typo lists nothing rather than silently listing
+    // everything - which for a script asking "have I missed a gate" would answer yes when it should not.
+    gates: (rest) => rest.every((argument) => argument === IDS_OPTION ||
+        (argument.startsWith(SCOPE_OPTION) && GATE_SCOPES.has(argument.slice(SCOPE_OPTION.length)))),
+    gate: (rest) => {
+        const [id, ...options] = rest;
+        return id !== undefined && !id.startsWith('-') && hasDistinctMembersOf(options, GATE_OPTIONS);
+    },
+    'commit-message': isCommitMessageArguments,
+};
+const main = async () => {
+    const argv = process.argv.slice(ARGV_COMMAND_OFFSET);
+    const [command, ...rest] = argv;
+    if (command === undefined || HELP_COMMANDS.has(command)) {
+        console.info(USAGE);
+        return 0;
+    }
+    // `Object.hasOwn`, not a bare index. The table is an object literal, so `ploaness toString` resolved
+    // to `Object.prototype.toString` and ran it as though it were a command.
+    if (!Object.hasOwn(COMMANDS, command)) {
+        console.error(`unknown command "${command}"\n\n${USAGE}`);
+        return 1;
+    }
+    const accepts = acceptsArguments[command];
+    const isAccepted = accepts?.(rest) ?? false;
+    if (!isAccepted) {
+        console.error(`invalid arguments for "${command}"\n\n${USAGE}`);
+        return 1;
+    }
+    const runCommand = COMMANDS[command];
+    if (runCommand === undefined) {
+        console.error(`unknown command "${command}"\n\n${USAGE}`);
+        return 1;
+    }
+    const isEnforce = !rest.includes('--enforce=false');
+    return await runCommand(createRepo(process.cwd(), isEnforce), rest);
+};
+// A command outside a gate has nothing above it to catch a throw, so an unreadable package.json used to
+// reach the user as a stack trace. The message is the finding; the trace is noise around it.
+const reportFailure = (error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 1;
+};
+// Setting the exit code is how Node reports a verdict while still flushing stdout. `process.exit()`
+// would truncate the report the gates just wrote.
+//
+// Neither half of this carries a suppression any more, and the pair is why the carve-out exists. The
+// assignment tripped `functional/immutable-data` while `unicorn/no-process-exit` banned the other
+// spelling, so a Node entry point had no legal way to report a non-zero verdict; the shipped config now
+// states `process.exitCode` as an accessor that rule is not aimed at. `.catch()` tripped
+// `unicorn/prefer-await`, and awaiting inside a `try` is what that rule asks for - it needs no `let`,
+// so `functional/no-let` has nothing to say, and `functional/no-try-statements` is off everywhere.
+const runToVerdict = async () => {
+    try {
+        return await main();
+    }
+    catch (error) {
+        return reportFailure(error);
+    }
+};
+process.exitCode = await runToVerdict();
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACxD,iGAAiG;AACjG,mGAAmG;AACnG,uGAAuG;AACvG,UAAU;AACV,OAAO,EACL,gBAAgB,IAAI,UAAU,EAE9B,QAAQ,GAET,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,SAAS,EAAa,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE3D,kFAAkF;AAClF,MAAM,mBAAmB,GAAW,CAAC,CAAA;AACrC,6EAA6E;AAC7E,MAAM,cAAc,GAAW,EAAE,CAAA;AAEjC,MAAM,KAAK,GAAW;;;;;;;;;;;gFAW0D,CAAA;AAEhF,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;AAEpF,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAS,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;AAE9F,6EAA6E;AAC7E,MAAM,iBAAiB,GAAW,EAAE,CAAA;AAEpC,qGAAqG;AACrG,mGAAmG;AACnG,uGAAuG;AACvG,iGAAiG;AACjG,MAAM,YAAY,GAAW,UAAU,CAAA;AACvC,MAAM,UAAU,GAAW,OAAO,CAAA;AAElC,MAAM,SAAS,GAAG,CAAC,IAAuB,EAAU,EAAE;IACpD,MAAM,SAAS,GAAuB,IAAI;SACvC,IAAI,CAAC,CAAC,QAAgB,EAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QACvE,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IAC9B,MAAM,QAAQ,GAAoB,SAAS,CAAC,MAAM,CAChD,CAAC,IAAU,EAAW,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAC7E,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAW,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAA;YAC9D,OAAO,CAAC,IAAI,CACV,GAAG,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CACnG,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED,mGAAmG;AACnG,gGAAgG;AAChG,0FAA0F;AAC1F,MAAM,UAAU,GAAG,KAAK,EACtB,IAAU,EACV,EAAsB,EACtB,SAAkB,EACD,EAAE;IACnB,MAAM,IAAI,GAAqB,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC1E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,yCAAyC,CAAC,CAAA;QACjF,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,MAAM,GACV,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IACzE,OAAO,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;AAC3D,CAAC,CAAA;AAMD,MAAM,QAAQ,GAA4C;IACxD,MAAM,EAAE,KAAK,EAAE,IAAU,EAAE,IAAuB,EAAmB,EAAE,CACrE,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,EAAE,CAAC,IAAU,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;IAC5C,IAAI,EAAE,CAAC,IAAU,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACxC,IAAI,EAAE,CAAC,IAAU,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACxC,KAAK,EAAE,CAAC,WAAiB,EAAE,IAAuB,EAAU,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC;IAC9E,IAAI,EAAE,KAAK,EAAE,IAAU,EAAE,IAAuB,EAAmB,EAAE,CACnE,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChE,gBAAgB,EAAE,CAAC,IAAU,EAAE,IAAuB,EAAU,EAAE,CAChE,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;CACxC,CAAA;AAED,uGAAuG;AACvG,wGAAwG;AACxG,4FAA4F;AAC5F,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAS,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAA;AAC9F,MAAM,cAAc,GAAW,WAAW,CAAA;AAC1C,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAS,CAAC,cAAc,CAAC,CAAC,CAAA;AAC3E,MAAM,oBAAoB,GAAW,CAAC,CAAA;AAEtC,MAAM,oBAAoB,GAAG,CAAC,MAAyB,EAAE,OAA4B,EAAW,EAAE,CAChG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,GAAG,CAAS,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAA;AAEhD,MAAM,wBAAwB,GAAG,CAAC,IAAuB,EAAW,EAAE;IACpE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,CAAA;IAC1B,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAA;IAC1B,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,MAAM,KAAK,oBAAoB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;AACzE,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAmE;IACvF,MAAM,EAAE,CAAC,IAAuB,EAAW,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC;IACxF,MAAM,EAAE,CAAC,IAAuB,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;IAC/D,IAAI,EAAE,CAAC,IAAuB,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;IAC7D,IAAI,EAAE,CAAC,IAAuB,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;IAC7D,6FAA6F;IAC7F,qGAAqG;IACrG,KAAK,EAAE,CAAC,IAAuB,EAAW,EAAE,CAC1C,IAAI,CAAC,KAAK,CACR,CAAC,QAAgB,EAAW,EAAE,CAC5B,QAAQ,KAAK,UAAU;QACvB,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAC9F;IACH,IAAI,EAAE,CAAC,IAAuB,EAAW,EAAE;QACzC,MAAM,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAA;QAC7B,OAAO,EAAE,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAC/F,CAAC;IACD,gBAAgB,EAAE,wBAAwB;CAC3C,CAAA;AAED,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE;IACvC,MAAM,IAAI,GAAsB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACvE,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/B,IAAI,OAAO,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnB,OAAO,CAAC,CAAA;IACV,CAAC;IACD,qGAAqG;IACrG,yEAAyE;IACzE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAA;QACzD,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAuD,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC7F,MAAM,UAAU,GAAY,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAA;IACpD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,0BAA0B,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAA;QAC/D,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,UAAU,GAA8B,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC/D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAA;QACzD,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,SAAS,GAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;IAC5D,OAAO,MAAM,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;AACrE,CAAC,CAAA;AAED,wGAAwG;AACxG,6FAA6F;AAC7F,MAAM,aAAa,GAAG,CAAC,KAAc,EAAU,EAAE;IAC/C,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACrE,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED,oGAAoG;AACpG,kDAAkD;AAClD,EAAE;AACF,qGAAqG;AACrG,kGAAkG;AAClG,wGAAwG;AACxG,yFAAyF;AACzF,sGAAsG;AACtG,mGAAmG;AACnG,MAAM,YAAY,GAAG,KAAK,IAAqB,EAAE;IAC/C,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAA;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;AACH,CAAC,CAAA;AAED,OAAO,CAAC,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAA"}

package/dist/checks/assets.d.ts

@@ -0,0 +1,30 @@
+import { type Context, type Repository } from '../context.js';
+import { type GateResult } from '../exec.js';
+/** Verify the working tree matches the managed-file catalogue, at the root and in every member. */
+export declare const assets: (repository: Repository) => GateResult;
+/**
+ * The paths ploaness owns in this working tree, minus any the project has taken over.
+ *
+ * A gate that measures the project's own code asks for this, because a file the project cannot edit is
+ * not the project's to answer for. The managed accessibility sweep carries a scoped lint exemption its
+ * crawl needs, and counting that against a consumer's suppression budget would spend a fifth of a small
+ * project's allowance on a decision the project did not make and cannot undo.
+ * @param context the resolved project environment.
+ * @returns every managed path ploaness materialises, as repository-relative paths.
+ */
+export declare const managedPaths: (context: Context) => ReadonlySet<string>;
+/** One change `ploaness sync` made to the working tree. */
+export interface SyncChange {
+    readonly path: string;
+    readonly action: 'wrote' | 'deleted' | 'spliced' | 'refused';
+}
+/**
+ * Materialise the managed files into the working tree. This is the only command that writes them: a
+ * PINNED file is rewritten so drift is repaired, a SEED file is written only when absent so the
+ * project's own edits survive, a FORBIDDEN path is removed, and a SECTION file has only its marked
+ * block replaced so the project's own text around it is carried through untouched.
+ */
+export declare const syncAssets: (repository: Repository) => readonly SyncChange[];
+/** Write a managed file only when the path is absent, used by `ploaness init`. */
+export declare const hasSeededFile: (root: string, assetPath: string, body: string) => boolean;
+//# sourceMappingURL=assets.d.ts.map

package/dist/checks/assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/checks/assets.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,KAAK,OAAO,EAAe,KAAK,UAAU,EAAoB,MAAM,eAAe,CAAA;AAC5F,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAiG5D,mGAAmG;AACnG,eAAO,MAAM,MAAM,GAAI,YAAY,UAAU,KAAG,UAyB/C,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,WAAW,CAAC,MAAM,CAUjE,CAAA;AAED,2DAA2D;AAC3D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;CAC7D;AA6CD;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,YAAY,UAAU,KAAG,SAAS,UAAU,EAetE,CAAA;AAED,kFAAkF;AAClF,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,EAAE,WAAW,MAAM,EAAE,MAAM,MAAM,KAAG,OAQ7E,CAAA"}

package/dist/checks/assets.js

@@ -0,0 +1,169 @@
+// The managed-file gate and the `ploaness sync` implementation. Both read the same catalogue, so the
+// gate can never disagree with the command that repairs it.
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import path from 'node:path';
+import { applyManagedSection, findAssetViolations, hasRuntime, memberAssets, memberKindOf, parseManifest, ROOT_MEMBER_PATH, repositoryAssets, syncAction, } from '@ploaness/governance';
+import { shippedDirectory } from '../context.js';
+import { failed, passed } from '../exec.js';
+const assetsRoot = () => shippedDirectory('@ploaness/assets');
+const readManifestText = () => readFileSync(path.join(assetsRoot(), 'manifest.tsv'), 'utf8');
+const catalogue = () => parseManifest(readManifestText());
+// Shipped bodies carry a `.asset` suffix because npm rewrites or strips certain dotfiles when it packs a
+// tarball: a shipped `.npmrc` is dropped outright and a shipped `.gitignore` is renamed. Suffixing every
+// body keeps the catalogue honest about what a consumer will actually receive.
+const bodyPath = (assetPath) => path.join(assetsRoot(), 'files', `${assetPath}.asset`);
+const shippedBody = (assetPath) => {
+    const source = bodyPath(assetPath);
+    return existsSync(source) ? readFileSync(source, 'utf8') : undefined;
+};
+// A PINNED or SEED entry with no shipped body would otherwise be reported as drift in the consumer's
+// tree, blaming the project for a ploaness packaging mistake. FORBIDDEN and REFERENCE entries have no
+// body by definition: ploaness writes neither, it only judges what it finds.
+const BODILESS = new Set(['FORBIDDEN', 'REFERENCE']);
+const packagingDefects = (assets) => assets
+    .filter((asset) => !(BODILESS.has(asset.disposition) || existsSync(bodyPath(asset.path))))
+    .map((asset) => `${asset.path}: the catalogue lists it but ploaness ships no body for it`);
+const unmanagedPaths = (context) => context.settings.unmanagedAssets.map((entry) => entry.path);
+// What each half of the repository is judged against. A member holds the sweeps for the server it runs
+// and the forbidden paths that shadow ploaness wherever they sit; everything a tool reads from the tree
+// root is judged once, at the root.
+const hostOf = (member) => ({
+    hasRuntime: hasRuntime(memberKindOf(member.packageJson)),
+    isPayload: member.isPayload,
+});
+const sitesOf = (repository, all) => {
+    const isSolo = repository.members.length <= 1;
+    const atRoot = repositoryAssets(all);
+    // A member sitting AT the repository root shares its directory, so a path that applies to both - any
+    // forbidden one - would be judged twice and reported twice for a single file. The repository site has
+    // already spoken for those.
+    const spokenFor = new Set(atRoot.map((asset) => asset.path));
+    const memberSite = (member) => {
+        const applicable = memberAssets(all, hostOf(member));
+        return {
+            root: member.root,
+            label: isSolo || member.path === ROOT_MEMBER_PATH ? '' : `${member.path}/`,
+            assets: member.root === repository.root
+                ? applicable.filter((asset) => !spokenFor.has(asset.path))
+                : applicable,
+            unmanaged: unmanagedPaths(member),
+        };
+    };
+    return [
+        {
+            root: repository.root,
+            label: '',
+            assets: atRoot,
+            unmanaged: unmanagedPaths(repository),
+        },
+        ...repository.members.map((member) => memberSite(member)),
+    ];
+};
+const stateOf = (root) => (assetPath) => {
+    const target = path.join(root, assetPath);
+    const isExists = existsSync(target);
+    // A FORBIDDEN entry may name a directory, so only read a regular file.
+    const actual = isExists && statSync(target).isFile() ? readFileSync(target, 'utf8') : undefined;
+    return { isPresent: isExists, actual, expected: shippedBody(assetPath) };
+};
+/** Verify the working tree matches the managed-file catalogue, at the root and in every member. */
+export const assets = (repository) => {
+    const parsed = catalogue();
+    if (parsed.problems.length > 0) {
+        return failed('the ploaness asset manifest is malformed', parsed.problems);
+    }
+    const defects = packagingDefects(parsed.assets);
+    if (defects.length > 0) {
+        return failed('the ploaness asset catalogue is incomplete', [
+            ...defects,
+            'this is a ploaness packaging defect; report it',
+        ]);
+    }
+    const sites = sitesOf(repository, parsed.assets);
+    const findings = sites.flatMap((site) => findAssetViolations(site.assets, site.unmanaged, stateOf(site.root)).map((violation) => `${site.label}${violation.path}: ${violation.reason}`));
+    const checked = sites.reduce((total, site) => total + site.assets.length, 0);
+    return findings.length > 0
+        ? failed(`${String(findings.length)} managed-file defect(s)`, findings)
+        : passed(`${String(checked)} managed path(s) match the catalogue`);
+};
+/**
+ * The paths ploaness owns in this working tree, minus any the project has taken over.
+ *
+ * A gate that measures the project's own code asks for this, because a file the project cannot edit is
+ * not the project's to answer for. The managed accessibility sweep carries a scoped lint exemption its
+ * crawl needs, and counting that against a consumer's suppression budget would spend a fifth of a small
+ * project's allowance on a decision the project did not make and cannot undo.
+ * @param context the resolved project environment.
+ * @returns every managed path ploaness materialises, as repository-relative paths.
+ */
+export const managedPaths = (context) => {
+    const owned = new Set(unmanagedPaths(context));
+    return new Set(catalogue()
+        .assets.filter((asset) => asset.disposition !== 'FORBIDDEN' && !owned.has(asset.path))
+        .map((asset) => asset.path));
+};
+const spliceSection = (assetPath, target, source) => {
+    const current = existsSync(target) ? readFileSync(target, 'utf8') : '';
+    const spliced = applyManagedSection(current, readFileSync(source, 'utf8').trim());
+    // Ambiguous markers are the one case sync will not touch: every guess it could make either duplicates
+    // the block or swallows text the project owns, and both are worse than stopping.
+    if (spliced === undefined) {
+        return { path: assetPath, action: 'refused' };
+    }
+    if (spliced === current) {
+        return undefined;
+    }
+    mkdirSync(path.dirname(target), { recursive: true });
+    writeFileSync(target, spliced);
+    return { path: assetPath, action: 'spliced' };
+};
+/** Apply one catalogue entry to the working tree, reporting the change it made. */
+const syncOne = (root, asset) => {
+    const target = path.join(root, asset.path);
+    const action = syncAction(asset, existsSync(target));
+    if (action === 'delete') {
+        rmSync(target, { recursive: true, force: true });
+        return { path: asset.path, action: 'deleted' };
+    }
+    const source = bodyPath(asset.path);
+    if (action === 'skip' || !existsSync(source)) {
+        return undefined;
+    }
+    if (action === 'splice') {
+        return spliceSection(asset.path, target, source);
+    }
+    mkdirSync(path.dirname(target), { recursive: true });
+    cpSync(source, target);
+    return { path: asset.path, action: 'wrote' };
+};
+/**
+ * Materialise the managed files into the working tree. This is the only command that writes them: a
+ * PINNED file is rewritten so drift is repaired, a SEED file is written only when absent so the
+ * project's own edits survive, a FORBIDDEN path is removed, and a SECTION file has only its marked
+ * block replaced so the project's own text around it is carried through untouched.
+ */
+export const syncAssets = (repository) => {
+    const sites = sitesOf(repository, catalogue().assets);
+    return sites.flatMap((site) => {
+        const owned = new Set(site.unmanaged);
+        return site.assets
+            .filter((asset) => !owned.has(asset.path))
+            .map((asset) => syncOne(site.root, asset))
+            .filter((change) => change !== undefined)
+            .map((change) => ({
+            action: change.action,
+            path: `${site.label}${change.path}`,
+        }));
+    });
+};
+/** Write a managed file only when the path is absent, used by `ploaness init`. */
+export const hasSeededFile = (root, assetPath, body) => {
+    const target = path.join(root, assetPath);
+    if (existsSync(target)) {
+        return false;
+    }
+    mkdirSync(path.dirname(target), { recursive: true });
+    writeFileSync(target, body);
+    return true;
+};
+//# sourceMappingURL=assets.js.map

package/dist/checks/assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../src/checks/assets.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,4DAA4D;AAC5D,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAA;AAChB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAIL,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EAEV,YAAY,EACZ,YAAY,EAEZ,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,GAEX,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAA8C,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC5F,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAA;AAErE,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAA;AAEpG,MAAM,SAAS,GAAG,GAAmB,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,CAAC,CAAA;AAEzE,yGAAyG;AACzG,yGAAyG;AACzG,+EAA+E;AAC/E,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAU,EAAE,CAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,SAAS,QAAQ,CAAC,CAAA;AAExD,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAsB,EAAE;IAC5D,MAAM,MAAM,GAAW,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC1C,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACtE,CAAC,CAAA;AAED,qGAAqG;AACrG,sGAAsG;AACtG,6EAA6E;AAC7E,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;AAEjF,MAAM,gBAAgB,GAAG,CAAC,MAA+B,EAAqB,EAAE,CAC9E,MAAM;KACH,MAAM,CACL,CAAC,KAAmB,EAAW,EAAE,CAC/B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CACzE;KACA,GAAG,CACF,CAAC,KAAmB,EAAU,EAAE,CAC9B,GAAG,KAAK,CAAC,IAAI,4DAA4D,CAC5E,CAAA;AAEL,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAqB,EAAE,CAC7D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAqB,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AAErF,uGAAuG;AACvG,wGAAwG;AACxG,oCAAoC;AACpC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAa,EAAE,CAAC,CAAC;IAC7C,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxD,SAAS,EAAE,MAAM,CAAC,SAAS;CAC5B,CAAC,CAAA;AAUF,MAAM,OAAO,GAAG,CAAC,UAAsB,EAAE,GAA4B,EAAwB,EAAE;IAC7F,MAAM,MAAM,GAAY,UAAU,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAA;IACtD,MAAM,MAAM,GAA4B,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC7D,qGAAqG;IACrG,sGAAsG;IACtG,4BAA4B;IAC5B,MAAM,SAAS,GAAwB,IAAI,GAAG,CAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAmB,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CACxD,CAAA;IACD,MAAM,UAAU,GAAG,CAAC,MAAc,EAAa,EAAE;QAC/C,MAAM,UAAU,GAA4B,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QAC7E,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG;YAC1E,MAAM,EACJ,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;gBAC7B,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAmB,EAAW,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjF,CAAC,CAAC,UAAU;YAChB,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC;SAClC,CAAA;IACH,CAAC,CAAA;IACD,OAAO;QACL;YACE,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC;SACtC;QACD,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAc,EAAa,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;KAC7E,CAAA;AACH,CAAC,CAAA;AAED,MAAM,OAAO,GACX,CAAC,IAAY,EAAE,EAAE,CACjB,CAAC,SAAiB,EAAc,EAAE;IAChC,MAAM,MAAM,GAAW,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAY,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5C,uEAAuE;IACvE,MAAM,MAAM,GACV,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,CAAA;AAC1E,CAAC,CAAA;AAEH,mGAAmG;AACnG,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,UAAsB,EAAc,EAAE;IAC3D,MAAM,MAAM,GAAmB,SAAS,EAAE,CAAA;IAC1C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,0CAA0C,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,OAAO,GAAsB,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,4CAA4C,EAAE;YAC1D,GAAG,OAAO;YACV,gDAAgD;SACjD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,KAAK,GAAyB,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACtE,MAAM,QAAQ,GAAsB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAe,EAAqB,EAAE,CACvF,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CACtE,CAAC,SAAyB,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAC7F,CACF,CAAA;IACD,MAAM,OAAO,GAAW,KAAK,CAAC,MAAM,CAClC,CAAC,KAAa,EAAE,IAAe,EAAU,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EACtE,CAAC,CACF,CAAA;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,yBAAyB,EAAE,QAAQ,CAAC;QACvE,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAA;AACtE,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAuB,EAAE;IACpE,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAA;IACnE,OAAO,IAAI,GAAG,CACZ,SAAS,EAAE;SACR,MAAM,CAAC,MAAM,CACZ,CAAC,KAAmB,EAAW,EAAE,CAC/B,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAC9D;SACA,GAAG,CAAC,CAAC,KAAmB,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CACpD,CAAA;AACH,CAAC,CAAA;AAQD,MAAM,aAAa,GAAG,CACpB,SAAiB,EACjB,MAAc,EACd,MAAc,EACU,EAAE;IAC1B,MAAM,OAAO,GAAW,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9E,MAAM,OAAO,GAAuB,mBAAmB,CACrD,OAAO,EACP,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CACpC,CAAA;IACD,sGAAsG;IACtG,iFAAiF;IACjF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC/C,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;AAC/C,CAAC,CAAA;AAED,mFAAmF;AACnF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,KAAmB,EAA0B,EAAE;IAC5E,MAAM,MAAM,GAAW,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IAClD,MAAM,MAAM,GAAkC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IACnF,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAChD,CAAC;IACD,MAAM,MAAM,GAAW,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3C,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;IACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtB,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAC9C,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,UAAsB,EAAyB,EAAE;IAC1E,MAAM,KAAK,GAAyB,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,CAAA;IAC3E,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAe,EAAyB,EAAE;QAC9D,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1D,OAAO,IAAI,CAAC,MAAM;aACf,MAAM,CAAC,CAAC,KAAmB,EAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAChE,GAAG,CAAC,CAAC,KAAmB,EAA0B,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;aAC/E,MAAM,CAAC,CAAC,MAA8B,EAAwB,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC;aACtF,GAAG,CACF,CAAC,MAAkB,EAAc,EAAE,CAAC,CAAC;YACnC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE;SACpC,CAAC,CACH,CAAA;IACL,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAE,IAAY,EAAW,EAAE;IACtF,MAAM,MAAM,GAAW,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACjD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC3B,OAAO,IAAI,CAAA;AACb,CAAC,CAAA"}

package/dist/checks/containers.d.ts

@@ -0,0 +1,9 @@
+import { type Context } from '../context.js';
+import { type GateResult } from '../exec.js';
+/** Scan the commit history for committed secrets. */
+export declare const secrets: (context: Context) => GateResult;
+/** Lint every Dockerfile and validate every compose project. */
+export declare const containers: (context: Context) => GateResult;
+/** Lint the GitHub Actions workflows. */
+export declare const actions: (context: Context) => GateResult;
+//# sourceMappingURL=containers.d.ts.map

package/dist/checks/containers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"containers.d.ts","sourceRoot":"","sources":["../../src/checks/containers.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,OAAO,EAAgB,MAAM,eAAe,CAAA;AAC1D,OAAO,EAIL,KAAK,UAAU,EAIhB,MAAM,YAAY,CAAA;AA4FnB,qDAAqD;AACrD,eAAO,MAAM,OAAO,GAAI,SAAS,OAAO,KAAG,UAiBvC,CAAA;AAqGJ,gEAAgE;AAChE,eAAO,MAAM,UAAU,GAAI,SAAS,OAAO,KAAG,UAkC7C,CAAA;AAED,yCAAyC;AACzC,eAAO,MAAM,OAAO,GAAI,SAAS,OAAO,KAAG,UAqB1C,CAAA"}