@ploaness/cli 1.0.0

package/dist/checks/history.js

@@ -0,0 +1,71 @@
+// History gates. They read the repository rather than the build, so none of them needs a compilation and
+// a freshly written commit can still be amended.
+import { findMergeCommits, isNonTrivial, OWNED_HISTORY_REVISIONS, parseMessage, parseNumstat, validateMessage, } from '@ploaness/governance';
+import { git } from '../context.js';
+import { failed, passed } from '../exec.js';
+const nonEmptyLines = (raw) => raw.split('\n').filter((line) => line.trim().length > 0);
+const shasOf = (context, revisionArguments) => nonEmptyLines(git(context, ['rev-list', ...revisionArguments]));
+/** Extended verification walks every commit, so a shallow clone is rejected up front. */
+// Enough of a commit hash to identify it in a report without filling the line.
+const SHORT_SHA_LENGTH = 9;
+export const requireFullHistory = (context) => {
+    try {
+        return git(context, ['rev-parse', '--is-shallow-repository']) === 'true'
+            ? failed('the repository is shallow', [
+                'the history gates walk every commit; check out with full depth (fetch-depth: 0 in CI)',
+            ])
+            : passed('the full history is present');
+    }
+    catch {
+        return failed('this is not a git repository', ['ploaness governs a versioned working tree']);
+    }
+};
+/**
+ * Validate commit messages. Every commit is held to every rule, including the ones git writes for you: a
+ * merge, a revert, or an autosquash subject must be given a conforming form by hand.
+ *
+ * It walks the same refs `linearHistory` does, and the default is the shared constant rather than a
+ * literal so the two cannot drift apart. Walking only HEAD was the earlier spelling and it left a hole
+ * this repository's own rules describe: a branch off HEAD's ancestry is history the repository owns and
+ * can rewrite, so a banned message there is a violation nothing reported. A real project carried an
+ * agent-attribution trailer on such a branch past a passing gate.
+ */
+export const commitHistory = (context, revisionArguments = OWNED_HISTORY_REVISIONS) => {
+    const shas = shasOf(context, revisionArguments);
+    const findings = shas.flatMap((sha) => {
+        const message = parseMessage(git(context, ['log', '--format=%B', '-n', '1', sha]));
+        const isBodyRequired = isNonTrivial(parseNumstat(git(context, ['show', '--numstat', '--format=', sha])));
+        return validateMessage(message, isBodyRequired).map((problem) => `${sha.slice(0, SHORT_SHA_LENGTH)} ${problem}`);
+    });
+    return findings.length > 0
+        ? failed(`${String(findings.length)} commit-message problem(s) across ${String(shas.length)} commit(s)`, findings)
+        : passed(`${String(shas.length)} commit message(s) conform`);
+};
+/** Validate one pending message, from a message file the author points at. */
+export const commitMessageProblems = (context, raw) => {
+    const isRequireBody = isNonTrivial(parseNumstat(git(context, ['diff', '--cached', '--numstat'])));
+    return validateMessage(parseMessage(raw), isRequireBody);
+};
+// One line per commit: the commit hash followed by its parent hashes, all space separated. Counting the
+// parents git recorded is what makes the rule unforgeable: a subject that mentions merging is an ordinary
+// commit, and rewording a merge does not hide it.
+const PARENT_FORMAT = '--format=%H %P';
+/** The history is linear: a merge commit is prohibited wherever this repository owns it. */
+export const linearHistory = (context) => {
+    const commits = nonEmptyLines(git(context, ['log', ...OWNED_HISTORY_REVISIONS, PARENT_FORMAT])).map((line) => {
+        const hashes = line.trim().split(' ');
+        return {
+            sha: hashes[0] ?? '',
+            subject: '',
+            parentCount: Math.max(0, hashes.length - 1),
+        };
+    });
+    const violations = findMergeCommits(commits.map((commit) => ({
+        ...commit,
+        subject: commit.parentCount > 1 ? git(context, ['log', '--format=%s', '-n', '1', commit.sha]) : '',
+    })));
+    return violations.length > 0
+        ? failed(`${String(violations.length)} merge commit(s) in the history`, violations.map((violation) => `${violation.sha.slice(0, SHORT_SHA_LENGTH)} ${violation.reason}`))
+        : passed(`${String(commits.length)} commit(s) form a linear history`);
+};
+//# sourceMappingURL=history.js.map

package/dist/checks/history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"history.js","sourceRoot":"","sources":["../../src/checks/history.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,iDAAiD;AACjD,OAAO,EAEL,gBAAgB,EAEhB,YAAY,EACZ,uBAAuB,EAEvB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAgB,GAAG,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,aAAa,GAAG,CAAC,GAAW,EAAqB,EAAE,CACvD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAE3E,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAE,iBAAoC,EAAqB,EAAE,CAC3F,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;AAEjE,yFAAyF;AACzF,+EAA+E;AAC/E,MAAM,gBAAgB,GAAW,CAAC,CAAA;AAElC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAgB,EAAc,EAAE;IACjE,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,KAAK,MAAM;YACtE,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE;gBAClC,uFAAuF;aACxF,CAAC;YACJ,CAAC,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,8BAA8B,EAAE,CAAC,2CAA2C,CAAC,CAAC,CAAA;IAC9F,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,OAAgB,EAChB,oBAAuC,uBAAuB,EAClD,EAAE;IACd,MAAM,IAAI,GAAsB,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAsB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAW,EAAqB,EAAE;QAClF,MAAM,OAAO,GAAkB,YAAY,CACzC,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CACrD,CAAA;QACD,MAAM,cAAc,GAAY,YAAY,CAC1C,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CACpE,CAAA;QACD,OAAO,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,GAAG,CACjD,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,IAAI,OAAO,EAAE,CAC5E,CAAA;IACH,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CACJ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,qCAAqC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAC9F,QAAQ,CACT;QACH,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAA;AAChE,CAAC,CAAA;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAAgB,EAAE,GAAW,EAAqB,EAAE;IACxF,MAAM,aAAa,GAAY,YAAY,CACzC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,CAC9D,CAAA;IACD,OAAO,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAA;AAC1D,CAAC,CAAA;AAED,wGAAwG;AACxG,0GAA0G;AAC1G,kDAAkD;AAClD,MAAM,aAAa,GAAW,gBAAgB,CAAA;AAE9C,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC5D,MAAM,OAAO,GAA2B,aAAa,CACnD,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,uBAAuB,EAAE,aAAa,CAAC,CAAC,CACjE,CAAC,GAAG,CAAC,CAAC,IAAY,EAAe,EAAE;QAClC,MAAM,MAAM,GAAsB,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxD,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;YACpB,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;SAC5C,CAAA;IACH,CAAC,CAAC,CAAA;IACF,MAAM,UAAU,GAAgC,gBAAgB,CAC9D,OAAO,CAAC,GAAG,CACT,CAAC,MAAmB,EAAe,EAAE,CAAC,CAAC;QACrC,GAAG,MAAM;QACT,OAAO,EACL,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;KAC5F,CAAC,CACH,CACF,CAAA;IACD,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,MAAM,CACJ,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,iCAAiC,EAC7D,UAAU,CAAC,GAAG,CACZ,CAAC,SAA2B,EAAU,EAAE,CACtC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,CACpE,CACF;QACH,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAA;AACzE,CAAC,CAAA"}

package/dist/checks/images.d.ts

@@ -0,0 +1,14 @@
+/** What the image half of the freshness report found, or why it could not look. */
+export interface ImageReport {
+    readonly scanned: number;
+    /** Report lines, each already phrased for the gate's finding list. */
+    readonly lines: readonly string[];
+    /** Set when the registry could not establish what is current, which fails the gate. */
+    readonly failure: string | undefined;
+}
+/**
+ * Read every image the harness pins against its registry.
+ * @returns the report lines, or the failure that stopped the registry from answering.
+ */
+export declare const imageFreshness: () => Promise<ImageReport>;
+//# sourceMappingURL=images.d.ts.map

package/dist/checks/images.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"images.d.ts","sourceRoot":"","sources":["../../src/checks/images.ts"],"names":[],"mappings":"AA8BA,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CACrC;AA6ED;;;GAGG;AACH,eAAO,MAAM,cAAc,QAAa,OAAO,CAAC,WAAW,CA0C1D,CAAA"}

package/dist/checks/images.js

@@ -0,0 +1,100 @@
+// The registry reads behind the image half of the freshness report.
+//
+// Everything that decides anything lives in `@ploaness/governance`: what a stable tag is, which tags
+// are comparable with the pinned one, which is newest, and how a finding reads. What is left here is
+// the HTTP, which is why this file is in the CLI at all.
+//
+// A newer image never fails the run. The freshness bound is a claim about a release line, and a tag is
+// not required to carry one - so an update is reported and the build carries on. Failure stays where
+// the guideline puts it: a declaration this cannot parse, or a registry that cannot say what is current.
+import { asRecord, CONTAINER_IMAGES, describeContainerDrift, describeContainerUpdate, isArray, judgeContainer, parseContainerReference, REQUEST_TIMEOUT_MS, } from '@ploaness/governance';
+const DOCKER_HUB = 'https://hub.docker.com';
+const PAGE_SIZE = 100;
+// Enough for the largest repository the harness pins; hadolint publishes several hundred tags.
+const MAX_PAGES = 10;
+const FIRST_PAGE = 1;
+const fetchJson = async (url) => {
+    const response = await fetch(url, { signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+    if (!response.ok) {
+        throw new Error(`Docker Hub returned ${String(response.status)} for ${url}`);
+    }
+    return await response.json();
+};
+const repoUrl = (reference) => `${DOCKER_HUB}/v2/namespaces/${reference.namespace}/repositories/${reference.repository}`;
+const tagNames = (body) => {
+    const results = asRecord(body)['results'];
+    if (!isArray(results)) {
+        throw new TypeError('Docker Hub returned no tag list');
+    }
+    return results
+        .map((entry) => asRecord(entry)['name'])
+        .filter((name) => typeof name === 'string');
+};
+// Paged rather than taking the first hundred. A repository that publishes every patch of every minor
+// pushes its newest tag off page one within a year, and reading only that page would report "current"
+// forever - a silent wrong answer, which is worse than the failure an unreachable registry produces.
+const tagsFrom = async (reference, page, soFar) => {
+    const names = tagNames(await fetchJson(`${repoUrl(reference)}/tags?page_size=${String(PAGE_SIZE)}&page=${String(page)}`));
+    const collected = [...soFar, ...names];
+    return names.length < PAGE_SIZE || page >= MAX_PAGES
+        ? collected
+        : await tagsFrom(reference, page + 1, collected);
+};
+const digestOf = async (reference, tag) => {
+    const answered = await fetchJson(`${repoUrl(reference)}/tags/${tag}`);
+    const digest = asRecord(answered)['digest'];
+    if (typeof digest !== 'string') {
+        throw new TypeError(`Docker Hub returned no digest for ${reference.name}:${tag}`);
+    }
+    return digest;
+};
+const inspect = async (reference) => ({
+    reference,
+    available: await tagsFrom(reference, FIRST_PAGE, []),
+    currentDigest: await digestOf(reference, reference.tag),
+});
+// The replacement digest is read only where an update exists, so a fully current harness costs one
+// extra request per image rather than two.
+const describe = async (verdict) => {
+    const newer = verdict.newer;
+    const update = newer === undefined
+        ? []
+        : [
+            describeContainerUpdate(verdict.reference, newer, await digestOf(verdict.reference, newer.raw)),
+        ];
+    const drift = verdict.hasDrifted
+        ? [describeContainerDrift(verdict.reference, verdict.currentDigest)]
+        : [];
+    return [...update, ...drift];
+};
+/**
+ * Read every image the harness pins against its registry.
+ * @returns the report lines, or the failure that stopped the registry from answering.
+ */
+export const imageFreshness = async () => {
+    const declared = Object.entries(CONTAINER_IMAGES).map(([tool, reference]) => parseContainerReference(tool, reference));
+    const pinned = declared.filter((reference) => reference !== undefined);
+    if (pinned.length !== declared.length) {
+        return {
+            scanned: 0,
+            lines: [],
+            failure: `${String(declared.length - pinned.length)} pinned image(s) are not written as ` +
+                '<repo>:<tag>@sha256:<digest>',
+        };
+    }
+    try {
+        const inspected = await Promise.all(pinned.map(async (reference) => inspect(reference)));
+        const verdicts = inspected.map((inspection) => judgeContainer(inspection));
+        const described = await Promise.all(verdicts.map(async (verdict) => describe(verdict)));
+        return { scanned: pinned.length, lines: described.flat(), failure: undefined };
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        return {
+            scanned: pinned.length,
+            lines: [],
+            failure: `the image registry could not establish what is current: ${reason}`,
+        };
+    }
+};
+//# sourceMappingURL=images.js.map

package/dist/checks/images.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"images.js","sourceRoot":"","sources":["../../src/checks/images.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,yDAAyD;AACzD,EAAE;AACF,uGAAuG;AACvG,qGAAqG;AACrG,yGAAyG;AACzG,OAAO,EACL,QAAQ,EACR,gBAAgB,EAKhB,sBAAsB,EACtB,uBAAuB,EACvB,OAAO,EACP,cAAc,EACd,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,sBAAsB,CAAA;AAE7B,MAAM,UAAU,GAAW,wBAAwB,CAAA;AACnD,MAAM,SAAS,GAAW,GAAG,CAAA;AAC7B,+FAA+F;AAC/F,MAAM,SAAS,GAAW,EAAE,CAAA;AAC5B,MAAM,UAAU,GAAW,CAAC,CAAA;AAW5B,MAAM,SAAS,GAAG,KAAK,EAAE,GAAW,EAAoB,EAAE;IACxD,MAAM,QAAQ,GAAa,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAA;IAChG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;AAC9B,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,SAA6B,EAAU,EAAE,CACxD,GAAG,UAAU,kBAAkB,SAAS,CAAC,SAAS,iBAAiB,SAAS,CAAC,UAAU,EAAE,CAAA;AAE3F,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAqB,EAAE;IACpD,MAAM,OAAO,GAAY,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAA;IAClD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;SACzD,MAAM,CAAC,CAAC,IAAa,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAA;AACxE,CAAC,CAAA;AAED,qGAAqG;AACrG,sGAAsG;AACtG,qGAAqG;AACrG,MAAM,QAAQ,GAAG,KAAK,EACpB,SAA6B,EAC7B,IAAY,EACZ,KAAwB,EACI,EAAE;IAC9B,MAAM,KAAK,GAAsB,QAAQ,CACvC,MAAM,SAAS,CACb,GAAG,OAAO,CAAC,SAAS,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,EAAE,CACjF,CACF,CAAA;IACD,MAAM,SAAS,GAAsB,CAAC,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC,CAAA;IACzD,OAAO,KAAK,CAAC,MAAM,GAAG,SAAS,IAAI,IAAI,IAAI,SAAS;QAClD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,EAAE,SAAS,CAAC,CAAA;AACpD,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,KAAK,EAAE,SAA6B,EAAE,GAAW,EAAmB,EAAE;IACrF,MAAM,QAAQ,GAAY,MAAM,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,GAAG,EAAE,CAAC,CAAA;IAC9E,MAAM,MAAM,GAAY,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAA;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,qCAAqC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,KAAK,EAAE,SAA6B,EAAgC,EAAE,CAAC,CAAC;IACtF,SAAS;IACT,SAAS,EAAE,MAAM,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;IACpD,aAAa,EAAE,MAAM,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC;CACxD,CAAC,CAAA;AAEF,mGAAmG;AACnG,2CAA2C;AAC3C,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAyB,EAA8B,EAAE;IAC/E,MAAM,KAAK,GAA6B,OAAO,CAAC,KAAK,CAAA;IACrD,MAAM,MAAM,GACV,KAAK,KAAK,SAAS;QACjB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,uBAAuB,CACrB,OAAO,CAAC,SAAS,EACjB,KAAK,EACL,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAC7C;SACF,CAAA;IACP,MAAM,KAAK,GAAsB,OAAO,CAAC,UAAU;QACjD,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC,CAAC,EAAE,CAAA;IACN,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,CAAA;AAC9B,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,IAA0B,EAAE;IAC7D,MAAM,QAAQ,GAAgD,MAAM,CAAC,OAAO,CAC1E,gBAAgB,CACjB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAA4B,EAAkC,EAAE,CACrF,uBAAuB,CAAC,IAAI,EAAE,SAAS,CAAC,CACzC,CAAA;IACD,MAAM,MAAM,GAAkC,QAAQ,CAAC,MAAM,CAC3D,CAAC,SAAyC,EAAmC,EAAE,CAC7E,SAAS,KAAK,SAAS,CAC1B,CAAA;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO;YACL,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,EAAE;YACT,OAAO,EACL,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,sCAAsC;gBAChF,8BAA8B;SACjC,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAmC,MAAM,OAAO,CAAC,GAAG,CACjE,MAAM,CAAC,GAAG,CACR,KAAK,EAAE,SAA6B,EAAgC,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1F,CACF,CAAA;QACD,MAAM,QAAQ,GAAgC,SAAS,CAAC,GAAG,CACzD,CAAC,UAA+B,EAAoB,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAClF,CAAA;QACD,MAAM,SAAS,GAAmC,MAAM,OAAO,CAAC,GAAG,CACjE,QAAQ,CAAC,GAAG,CACV,KAAK,EAAE,OAAyB,EAA8B,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CACnF,CACF,CAAA;QACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;IAChF,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,MAAM,GAAW,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC7E,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,2DAA2D,MAAM,EAAE;SAC7E,CAAA;IACH,CAAC;AACH,CAAC,CAAA"}

package/dist/checks/install.d.ts

@@ -0,0 +1,5 @@
+import type { Repository as Repo } from '../context.js';
+import { type GateResult } from '../exec.js';
+/** The repository must name the dependencies permitted to run an install script. */
+export declare const installScripts: (repo: Repo) => GateResult;
+//# sourceMappingURL=install.d.ts.map

package/dist/checks/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/checks/install.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,IAAI,IAAI,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAQ5D,oFAAoF;AACpF,eAAO,MAAM,cAAc,GAAI,MAAM,IAAI,KAAG,UAMpC,CAAA"}

package/dist/checks/install.js

@@ -0,0 +1,21 @@
+// Install-script allowlist. The decision lives in governance; this reads the two files pnpm accepts it in.
+//
+// Left undeclared, every package in the resolved set may run a build or postinstall script during
+// `pnpm install` - the broadest surface a project has for executing code it never called. The gate
+// requires the allowlist to exist and says nothing about what is on it: which packages a project trusts
+// with an install script is a decision for the project to record, not one the harness can make for it.
+import { declaresInstallScriptAllowlist } from '@ploaness/governance';
+import { failed, passed } from '../exec.js';
+const WORKSPACE_FILE = 'pnpm-workspace.yaml';
+// The workspace file arrives already read, from the repository root. It used to be read relative to
+// whatever directory the run started in, which in a workspace member is a directory the file cannot be
+// in - and pnpm honours `pnpm.onlyBuiltDependencies` only at the root too, so the finding advised
+// declaring the key somewhere it would have no effect.
+/** The repository must name the dependencies permitted to run an install script. */
+export const installScripts = (repo) => declaresInstallScriptAllowlist(repo.workspaceFile, repo.packageJson)
+    ? passed('the dependencies permitted to run an install script are declared')
+    : failed('no install-script allowlist is declared', [
+        `declare onlyBuiltDependencies in ${WORKSPACE_FILE}, or under the "pnpm" key of package.json`,
+        'an empty list is a valid answer: it permits no dependency to run an install script',
+    ]);
+//# sourceMappingURL=install.js.map

package/dist/checks/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/checks/install.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,wGAAwG;AACxG,uGAAuG;AACvG,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AAErE,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,cAAc,GAAW,qBAAqB,CAAA;AAEpD,oGAAoG;AACpG,uGAAuG;AACvG,kGAAkG;AAClG,uDAAuD;AACvD,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAU,EAAc,EAAE,CACvD,8BAA8B,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC;IAClE,CAAC,CAAC,MAAM,CAAC,kEAAkE,CAAC;IAC5E,CAAC,CAAC,MAAM,CAAC,yCAAyC,EAAE;QAChD,oCAAoC,cAAc,2CAA2C;QAC7F,oFAAoF;KACrF,CAAC,CAAA"}

package/dist/checks/integrity.d.ts

@@ -0,0 +1,11 @@
+import { type Context } from '../context.js';
+import { type GateResult } from '../exec.js';
+/** Decode every tracked image and fail on any that is corrupt or truncated. */
+export declare const imageAssets: (context: Context) => GateResult;
+/**
+ * Measure the total gzipped client JavaScript against the budget. Gzipped byte counts of built output are
+ * a fixed function of the source and the pinned dependency versions, so the number moves only when your
+ * change moves the bundle. That determinism is why this is a gate and a Lighthouse score is not.
+ */
+export declare const bundle: (context: Context) => GateResult;
+//# sourceMappingURL=integrity.d.ts.map

package/dist/checks/integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../../src/checks/integrity.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,KAAK,OAAO,EAA+B,MAAM,eAAe,CAAA;AACzE,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAE5D,+EAA+E;AAC/E,eAAO,MAAM,WAAW,GAAI,SAAS,OAAO,KAAG,UAc9C,CAAA;AAeD;;;;GAIG;AACH,eAAO,MAAM,MAAM,GAAI,SAAS,OAAO,KAAG,UA8BzC,CAAA"}

package/dist/checks/integrity.js

@@ -0,0 +1,66 @@
+// Asset integrity: an image that will not render, and a client bundle that has quietly doubled. Both are
+// defects a status check and an accessibility sweep miss, because the response is a valid 200 and the
+// markup is correct.
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { gzipSync } from 'node:zlib';
+import { evaluateBundle, isSupportedImagePath, validateImageBytes, } from '@ploaness/governance';
+import { hasOwnRuntime, trackedFiles } from '../context.js';
+import { failed, passed } from '../exec.js';
+/** Decode every tracked image and fail on any that is corrupt or truncated. */
+export const imageAssets = (context) => {
+    const images = trackedFiles(context.root)
+        .filter(isSupportedImagePath)
+        .filter((file) => existsSync(path.join(context.root, file)));
+    const findings = images.flatMap((file) => {
+        const reason = validateImageBytes(file, readFileSync(path.join(context.root, file)));
+        return reason === null ? [] : [`${file}: ${reason}`];
+    });
+    return findings.length > 0
+        ? failed(`${String(findings.length)} corrupt or truncated image asset(s)`, findings)
+        : passed(`all ${String(images.length)} tracked image asset(s) decode`);
+};
+const collectJavaScript = (directory) => readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const full = path.join(directory, entry.name);
+    if (entry.isDirectory()) {
+        return collectJavaScript(full);
+    }
+    return entry.name.endsWith('.js') ? [full] : [];
+});
+const BYTES_PER_KIB = 1024;
+const KIB_DECIMALS = 1;
+const asKiB = (bytes) => `${(bytes / BYTES_PER_KIB).toFixed(KIB_DECIMALS)} KiB`;
+/**
+ * Measure the total gzipped client JavaScript against the budget. Gzipped byte counts of built output are
+ * a fixed function of the source and the pinned dependency versions, so the number moves only when your
+ * change moves the bundle. That determinism is why this is a gate and a Lighthouse score is not.
+ */
+export const bundle = (context) => {
+    // A library ships no client bundle, so there is no `.next/static` to measure and its absence is not
+    // a missing build. Reported as a pass here for the same reason `build` reports one: the member has no
+    // runtime, which is a fact about what it declares rather than a step somebody skipped.
+    if (!hasOwnRuntime(context)) {
+        return passed('this package has no runtime of its own, so it ships no client bundle');
+    }
+    const staticDirectory = path.join(context.root, '.next', 'static');
+    if (!existsSync(staticDirectory)) {
+        return failed('the production build output is missing', [
+            `${path.relative(context.root, staticDirectory)} not found; the build gate must run first`,
+        ]);
+    }
+    const files = collectJavaScript(staticDirectory).map((file) => ({
+        path: file,
+        gzipBytes: gzipSync(readFileSync(file), { level: 9 }).length,
+    }));
+    const report = evaluateBundle(files, context.settings.bundleBudgetBytes);
+    const summary = `client JS ${asKiB(report.totalGzipBytes)} gzip across ${String(report.fileCount)} files ` +
+        `(budget ${asKiB(report.budgetBytes)})`;
+    return report.isWithinBudget
+        ? passed(summary)
+        : failed(`${summary} and is over budget`, [
+            // Not "raise the setting": `readSettings` clamps it with `Math.min`, so a project can only
+            // ever lower it. Advising an action the code forbids is the defect this message used to be.
+            "investigate the added weight; the ceiling is the harness's, and a project may only lower it",
+        ]);
+};
+//# sourceMappingURL=integrity.js.map

package/dist/checks/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../src/checks/integrity.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,sGAAsG;AACtG,qBAAqB;AACrB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC/D,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAGL,cAAc,EACd,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAgB,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACzE,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC1D,MAAM,MAAM,GAAsB,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;SACzD,MAAM,CAAC,oBAAoB,CAAC;SAC5B,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IAC/E,MAAM,QAAQ,GAAsB,MAAM,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE;QACrF,MAAM,MAAM,GAAkB,kBAAkB,CAC9C,IAAI,EACJ,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAC5C,CAAA;QACD,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,sCAAsC,EAAE,QAAQ,CAAC;QACpF,CAAC,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAA;AAC1E,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAqB,EAAE,CACjE,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAqB,EAAE;IACnF,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACjD,CAAC,CAAC,CAAA;AAEJ,MAAM,aAAa,GAAW,IAAI,CAAA;AAClC,MAAM,YAAY,GAAW,CAAC,CAAA;AAC9B,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,GAAG,CAAC,KAAK,GAAG,aAAa,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAA;AAE/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAc,EAAE;IACrD,oGAAoG;IACpG,sGAAsG;IACtG,uFAAuF;IACvF,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,sEAAsE,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,eAAe,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC1E,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,wCAAwC,EAAE;YACtD,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,2CAA2C;SAC3F,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,KAAK,GAA0B,iBAAiB,CAAC,eAAe,CAAC,CAAC,GAAG,CACzE,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM;KAC7D,CAAC,CACH,CAAA;IACD,MAAM,MAAM,GAAiB,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;IACtF,MAAM,OAAO,GACX,aAAa,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS;QAC1F,WAAW,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAA;IACzC,OAAO,MAAM,CAAC,cAAc;QAC1B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACjB,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,qBAAqB,EAAE;YACtC,2FAA2F;YAC3F,4FAA4F;YAC5F,6FAA6F;SAC9F,CAAC,CAAA;AACR,CAAC,CAAA"}

package/dist/checks/payload.d.ts

@@ -0,0 +1,7 @@
+import { type Context, type Member } from '../context.js';
+import { type GateResult } from '../exec.js';
+/** Regenerate the Payload types and admin import map, then fail on any drift. */
+export declare const payloadGenerated: (context: Context) => GateResult;
+/** Apply the source rules to every tracked TypeScript file under the declared source roots. */
+export declare const payloadRules: (context: Member) => GateResult;
+//# sourceMappingURL=payload.d.ts.map

package/dist/checks/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../src/checks/payload.ts"],"names":[],"mappings":"AASA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,MAAM,EAIZ,MAAM,eAAe,CAAA;AACtB,OAAO,EAAsB,KAAK,UAAU,EAAmC,MAAM,YAAY,CAAA;AAWjG,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,KAAG,UA0CnD,CAAA;AAaD,+FAA+F;AAC/F,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,KAAG,UAkB9C,CAAA"}

package/dist/checks/payload.js

@@ -0,0 +1,81 @@
+// The Payload-specific gates: the generated artefacts must match the configuration that produces them,
+// and the Local API must be used in a way that neither over-fetches nor skips access control.
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { findPayloadViolations, findSourceViolations, } from '@ploaness/governance';
+import { git, resolveProjectTool, runEnvironment, trackedFiles, } from '../context.js';
+import { asFindings, failed, passed, runNode } from '../exec.js';
+// Resolution failure is an answer rather than an exception the caller must catch.
+const resolveProjectToolOrUndefined = (context, tool) => {
+    try {
+        return resolveProjectTool(context, tool);
+    }
+    catch {
+        return undefined;
+    }
+};
+/** Regenerate the Payload types and admin import map, then fail on any drift. */
+export const payloadGenerated = (context) => {
+    const payloadCli = resolveProjectToolOrUndefined(context, 'payload');
+    if (payloadCli === undefined) {
+        return failed('the payload CLI could not be resolved from the project', [
+            'ploaness governs Payload projects, so "payload" must be installed in the project itself',
+        ]);
+    }
+    for (const target of ['generate:types', 'generate:importmap']) {
+        const result = runNode(payloadCli, [target], {
+            cwd: context.root,
+            // The project's own environment first, then the one option ploaness owns - so a `.env` cannot
+            // silence the deprecation flag, and every other variable the configuration reads is present.
+            env: { ...runEnvironment(context), NODE_OPTIONS: '--no-deprecation' },
+        });
+        if (result.code !== 0) {
+            return failed(`payload ${target} failed`, asFindings(result.output));
+        }
+    }
+    // The SETTING rather than the constant behind it. Every other consumer of the artefact list already
+    // read the setting - the write denials, the biome carve-outs, the scaffolder - and this one did not,
+    // so a project that declared where its import map actually lives had that file denied, excluded, and
+    // regenerated, but never diffed. The gate then reported that the artefacts matched a configuration it
+    // had not compared them against, and the drift it had just written surfaced two gates later as an
+    // unexplained working-tree change.
+    const drifted = context.settings.generatedArtefacts.filter((target) => {
+        if (!existsSync(path.join(context.root, target))) {
+            return false;
+        }
+        try {
+            return git(context, ['diff', '--name-only', '--', target]).length > 0;
+        }
+        catch {
+            return false;
+        }
+    });
+    return drifted.length > 0
+        ? failed('generated Payload artefacts drifted from the configuration', [
+            ...drifted.map((target) => `${target} changed when regenerated`),
+            'commit the regenerated files',
+        ])
+        : passed('the generated Payload artefacts match the configuration');
+};
+const SOURCE_EXTENSIONS = ['.ts', '.tsx'];
+// The language rules apply to every package; the Payload ones only to a package that has Payload to
+// misuse. Held together, the import rule ran only where Payload did - so a frontend beside the CMS, the
+// place a parent-relative import is MOST likely because it has no Payload config to anchor on, was the
+// one package never checked for it.
+const violationsIn = (source, isPayload) => [
+    ...findSourceViolations(source),
+    ...(isPayload ? findPayloadViolations(source) : []),
+];
+/** Apply the source rules to every tracked TypeScript file under the declared source roots. */
+export const payloadRules = (context) => {
+    const roots = context.settings.sourceRoots;
+    const candidates = trackedFiles(context.root).filter((file) => SOURCE_EXTENSIONS.some((extension) => file.endsWith(extension)) &&
+        roots.some((root) => file.startsWith(`${root}/`)) &&
+        !file.endsWith('payload-types.ts') &&
+        existsSync(path.join(context.root, file)));
+    const findings = candidates.flatMap((file) => violationsIn(readFileSync(path.join(context.root, file), 'utf8'), context.isPayload).map((violation) => `${file}:${String(violation.line)} [${violation.rule}] ${violation.reason}`));
+    return findings.length > 0
+        ? failed(`${String(findings.length)} source usage violation(s)`, findings)
+        : passed(`${String(candidates.length)} source file(s) follow the usage rules`);
+};
+//# sourceMappingURL=payload.js.map

package/dist/checks/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../src/checks/payload.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,8FAA8F;AAC9F,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GAErB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,GAAG,EAEH,kBAAkB,EAClB,cAAc,EACd,YAAY,GACb,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,EAAmB,MAAM,EAAkB,OAAO,EAAE,MAAM,YAAY,CAAA;AAEjG,kFAAkF;AAClF,MAAM,6BAA6B,GAAG,CAAC,OAAgB,EAAE,IAAY,EAAsB,EAAE;IAC3F,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC/D,MAAM,UAAU,GAAuB,6BAA6B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACxF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,wDAAwD,EAAE;YACtE,yFAAyF;SAC1F,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAc,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE;YACtD,GAAG,EAAE,OAAO,CAAC,IAAI;YACjB,8FAA8F;YAC9F,6FAA6F;YAC7F,GAAG,EAAE,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE;SACtE,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,WAAW,MAAM,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IACD,oGAAoG;IACpG,qGAAqG;IACrG,qGAAqG;IACrG,sGAAsG;IACtG,kGAAkG;IAClG,mCAAmC;IACnC,MAAM,OAAO,GAAsB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAC3E,CAAC,MAAc,EAAW,EAAE;QAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CACF,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,MAAM,CAAC,4DAA4D,EAAE;YACnE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,MAAM,2BAA2B,CAAC;YAChF,8BAA8B;SAC/B,CAAC;QACJ,CAAC,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAA;AACvE,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAE5D,oGAAoG;AACpG,wGAAwG;AACxG,uGAAuG;AACvG,oCAAoC;AACpC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,SAAkB,EAA+B,EAAE,CAAC;IACxF,GAAG,oBAAoB,CAAC,MAAM,CAAC;IAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CACpD,CAAA;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAc,EAAE;IAC1D,MAAM,KAAK,GAAsB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAA;IAC7D,MAAM,UAAU,GAAsB,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CACrE,CAAC,IAAY,EAAW,EAAE,CACxB,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QAClE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAC5C,CAAA;IACD,MAAM,QAAQ,GAAsB,UAAU,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE,CACzF,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CACtF,CAAC,SAA2B,EAAU,EAAE,CACtC,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAC9E,CACF,CAAA;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,4BAA4B,EAAE,QAAQ,CAAC;QAC1E,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAA;AAClF,CAAC,CAAA"}

package/dist/checks/preflight.d.ts

@@ -0,0 +1,5 @@
+import { type Repository } from '../context.js';
+import { type GateResult } from '../exec.js';
+/** Verify the project is a Payload application on a supported runtime. */
+export declare const preflight: (context: Repository) => GateResult;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/checks/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/checks/preflight.ts"],"names":[],"mappings":"AAaA,OAAO,EAAe,KAAK,UAAU,EAAY,MAAM,eAAe,CAAA;AACtE,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAoC5D,0EAA0E;AAC1E,eAAO,MAAM,SAAS,GAAI,SAAS,UAAU,KAAG,UAc/C,CAAA"}

package/dist/checks/preflight.js

@@ -0,0 +1,48 @@
+// The gate that runs before every other one. ploaness governs Payload CMS projects, so it refuses to
+// judge a project that is not one. Running anyway would produce a verdict about a contract the project
+// never agreed to.
+import { asOptionalText, asStringRecord, findPayloadMemberViolations, findPnpmRuntimeViolations, minimumNodeMajor, pinnedPnpmVersion, } from '@ploaness/governance';
+import { readPins } from '../context.js';
+import { failed, passed } from '../exec.js';
+// Read from `pins.json`, not written here. The floor was a constant in this file, which made it a rule
+// living in the I/O layer and a fourth copy of a number the pins already state - and this copy is the
+// one that decided a verdict, so it was the copy that could silently disagree with `engines.node`.
+const requiredNodeMajor = () => minimumNodeMajor(asStringRecord(readPins()['engines'])['node']);
+// The pnpm this run is executing under, which is a different fact from the one the wiring gate reads.
+// `packageManager` is what the project DECLARES, and Corepack obeys it only where Corepack is enabled;
+// this is what actually resolved the tree every later gate then judges. Read from the pin rather than
+// from `engines.pnpm`, which is derived from the same field.
+const requiredPnpm = () => pinnedPnpmVersion(asOptionalText(readPins()['packageManager']));
+// The two questions preflight asks about the project itself, separated from the runtime question so
+// neither has to accumulate into a shared list.
+// Asked of the REPOSITORY rather than of one directory. A workspace legitimately holds packages that
+// are not Payload applications - a shared library, a frontend reading the CMS over HTTP - and refusing
+// each of those individually would refuse the repository they belong to. What ploaness still will not
+// judge is a repository with no Payload in it anywhere, which is the same refusal, one level up.
+const projectProblems = (repository) => {
+    if (repository.packageJson === undefined) {
+        return ['no package.json found; run ploaness from the repository root'];
+    }
+    return findPayloadMemberViolations(repository.members.map((member) => ({
+        path: member.path,
+        isPayload: member.isPayload,
+        sourceRoots: member.settings.sourceRoots,
+    })));
+};
+/** Verify the project is a Payload application on a supported runtime. */
+export const preflight = (context) => {
+    const projectFindings = projectProblems(context);
+    const nodeMajor = Number(process.versions.node.split('.', 1)[0] ?? '0');
+    const required = requiredNodeMajor();
+    const findings = [
+        ...projectFindings,
+        ...(required !== undefined && nodeMajor < required
+            ? [`Node ${process.versions.node} is below the required ${String(required)}`]
+            : []),
+        ...findPnpmRuntimeViolations(process.env['npm_config_user_agent'], requiredPnpm()),
+    ];
+    return findings.length > 0
+        ? failed('project is not a supported Payload application on a pinned toolchain', findings)
+        : passed(`Payload project on Node ${process.versions.node}`);
+};
+//# sourceMappingURL=preflight.js.map

package/dist/checks/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/checks/preflight.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,uGAAuG;AACvG,mBAAmB;AAEnB,OAAO,EACL,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EAEzB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAgC,QAAQ,EAAE,MAAM,eAAe,CAAA;AACtE,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,uGAAuG;AACvG,sGAAsG;AACtG,mGAAmG;AACnG,MAAM,iBAAiB,GAAG,GAAuB,EAAE,CACjD,gBAAgB,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;AAEjE,sGAAsG;AACtG,uGAAuG;AACvG,sGAAsG;AACtG,6DAA6D;AAC7D,MAAM,YAAY,GAAG,GAAuB,EAAE,CAC5C,iBAAiB,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAA;AAEjE,oGAAoG;AACpG,gDAAgD;AAChD,qGAAqG;AACrG,uGAAuG;AACvG,sGAAsG;AACtG,iGAAiG;AACjG,MAAM,eAAe,GAAG,CAAC,UAAsB,EAAqB,EAAE;IACpE,IAAI,UAAU,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,CAAC,8DAA8D,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,2BAA2B,CAChC,UAAU,CAAC,OAAO,CAAC,GAAG,CACpB,CAAC,MAAc,EAAe,EAAE,CAAC,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW;KACzC,CAAC,CACH,CACF,CAAA;AACH,CAAC,CAAA;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAmB,EAAc,EAAE;IAC3D,MAAM,eAAe,GAAsB,eAAe,CAAC,OAAO,CAAC,CAAA;IACnE,MAAM,SAAS,GAAW,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;IAC/E,MAAM,QAAQ,GAAuB,iBAAiB,EAAE,CAAA;IACxD,MAAM,QAAQ,GAAsB;QAClC,GAAG,eAAe;QAClB,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,SAAS,GAAG,QAAQ;YAChD,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,0BAA0B,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7E,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,YAAY,EAAE,CAAC;KACnF,CAAA;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,sEAAsE,EAAE,QAAQ,CAAC;QAC1F,CAAC,CAAC,MAAM,CAAC,2BAA2B,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;AAChE,CAAC,CAAA"}

package/dist/checks/references.d.ts

@@ -0,0 +1,18 @@
+import { type Context, type Repository as Repo } from '../context.js';
+import { type GateResult } from '../exec.js';
+/**
+ * Every npm script and full-path file the agent docs name must still exist.
+ * @param repository the repository being judged, and the members whose docs it holds.
+ * @param reservedWords words that look like a script but name something else, such as a gate. The
+ *   registry supplies them, so this module does not have to import it back and create a cycle.
+ */
+export declare const documentation: (repository: Repo, reservedWords?: ReadonlySet<string>) => GateResult;
+/**
+ * A concrete source file carved out of a tool config must still exist on disk, and a declared exclusion
+ * must exclude something. Both are the same defect at different scales: a carve-out that reaches
+ * nothing leaves the report reading exactly as it would have read without it.
+ */
+export declare const configReferences: (context: Context) => GateResult;
+/** The frontmatter an agent uses to discover and invoke a skill must be well formed. */
+export declare const skills: (context: Context) => GateResult;
+//# sourceMappingURL=references.d.ts.map

package/dist/checks/references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"references.d.ts","sourceRoot":"","sources":["../../src/checks/references.ts"],"names":[],"mappings":"AAoBA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,UAAU,IAAI,IAAI,EAGxB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AA4B5D;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GACxB,YAAY,IAAI,EAChB,gBAAe,WAAW,CAAC,MAAM,CAAqB,KACrD,UA4BF,CAAA;AAiCD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,KAAG,UAoBnD,CAAA;AAED,wFAAwF;AACxF,eAAO,MAAM,MAAM,GAAI,SAAS,OAAO,KAAG,UAgBzC,CAAA"}