@ploaness/cli 1.0.0

package/dist/checks/references.js

@@ -0,0 +1,100 @@
+// Rot gates: a reference that no longer resolves. Documentation drifts away from the repository, a tool
+// config keeps carving out a file that was renamed, and a skill manifest loses the frontmatter an agent
+// needs to find it. None of these break a build on their own, which is exactly why they accumulate.
+import { existsSync, globSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { asRecord, declaredDependencies, extractLiteralSourcePaths, findAgentDocuments, findDocumentReferenceViolations, findMissingConfigReferences, findSkillManifestViolations, findUnreachedExclusionsBySetting, requiredBiomeFiles, } from '@ploaness/governance';
+import { shippedDirectory, trackedFiles, } from '../context.js';
+import { failed, passed } from '../exec.js';
+const declaredScripts = (context) => asRecord(asRecord(context.packageJson)['scripts']);
+const biomeFilesJson = (context) => JSON.stringify(requiredBiomeFiles(context.settings.sourceRoots));
+// A doc is read against its OWN member and against the repository, never against one alone. A member
+// doc legitimately names a command the root declares - "run `verify:unmanaged` at the root" - and the
+// root doc names files that live inside a member, so resolving either against a single package.json
+// reports rot where there is none. What the union still catches is the only thing this gate is for: a
+// name that resolves NOWHERE.
+const ownerOf = (repository, directory) => repository.members.find((candidate) => candidate.path === directory);
+const namesFrom = (repository, owner, read) => new Set([...read(repository), ...(owner === undefined ? [] : read(owner))]);
+const scriptNames = (context) => Object.keys(declaredScripts(context));
+const dependencyNames = (context) => Object.keys(declaredDependencies(context.packageJson));
+/**
+ * Every npm script and full-path file the agent docs name must still exist.
+ * @param repository the repository being judged, and the members whose docs it holds.
+ * @param reservedWords words that look like a script but name something else, such as a gate. The
+ *   registry supplies them, so this module does not have to import it back and create a cycle.
+ */
+export const documentation = (repository, reservedWords = new Set()) => {
+    const existsAt = (relativePath) => existsSync(path.join(repository.root, relativePath));
+    const documents = findAgentDocuments(repository.members.map((member) => member.path), existsAt);
+    const findings = documents.flatMap((document) => {
+        const owner = ownerOf(repository, document.directory);
+        return findDocumentReferenceViolations({
+            markdown: readFileSync(path.join(repository.root, document.file), 'utf8'),
+            scriptNames: namesFrom(repository, owner, scriptNames),
+            packageNames: namesFrom(repository, owner, dependencyNames),
+            // A path is tried inside the owning member first, then at the repository root, for the same
+            // reason the script names are unioned.
+            isExistingFile: (relativePath) => existsAt(path.join(document.directory, relativePath)) || existsAt(relativePath),
+            reservedWords,
+        }).map((violation) => `${document.file}: ${violation.reference} (${violation.kind}) ${violation.reason}`);
+    });
+    return findings.length > 0
+        ? failed(`${String(findings.length)} stale reference(s) in the agent docs`, findings)
+        : passed(`references in ${String(documents.length)} agent doc(s) resolve`);
+};
+// Both the ploaness-owned configs and any the project still holds are scanned. A carve-out in the
+// harness config names a consumer path, so it rots when the consumer renames that file.
+const configTargets = (context) => {
+    const owned = shippedDirectory('@ploaness/config');
+    return [
+        path.join(owned, 'biome.json'),
+        path.join(owned, 'dependency-cruiser.json'),
+        path.join(owned, 'knip.json'),
+        path.join(context.root, 'biome.json'),
+        path.join(context.root, 'vitest.config.mts'),
+    ].filter((file) => existsSync(file));
+};
+// A carve-out ploaness itself dictates is not the project's to repair. The wiring gate requires the
+// biome file-selection block byte for byte, so a path inside it cannot be stale in the sense this gate
+// means: the project is forbidden to remove it. Reporting it anyway would fail a project for obeying
+// another gate, which is what a Payload project that has not generated its types yet would hit on its
+// first run. Whether those generated artefacts are correct is the payload-generated gate's question.
+const mandatedReferences = (context) => new Set(extractLiteralSourcePaths(biomeFilesJson(context)));
+// A declared exclusion is judged against the paths the gate it narrows would otherwise have read: a
+// coverage exclusion against what the coverage report measures, a typography or JavaScript exclusion
+// against the tracked tree the conventions gate walks. Judging either against the other's set would
+// report a finding about the wrong thing.
+// Which file set an exclusion has to reach is decided by the SETTING it came from, not by how its
+// pattern is written - the partition itself lives in `governance`, where it is spec'd against file lists
+// no repository has to be built to produce. What is left here is the one read it needs.
+const deadExclusions = (context) => findUnreachedExclusionsBySetting(context.settings.declaredExclusions, trackedFiles(context.root));
+/**
+ * A concrete source file carved out of a tool config must still exist on disk, and a declared exclusion
+ * must exclude something. Both are the same defect at different scales: a carve-out that reaches
+ * nothing leaves the report reading exactly as it would have read without it.
+ */
+export const configReferences = (context) => {
+    const isExistingFile = (relativePath) => existsSync(path.join(context.root, relativePath));
+    const mandated = mandatedReferences(context);
+    const dangling = configTargets(context).flatMap((configPath) => findMissingConfigReferences(extractLiteralSourcePaths(readFileSync(configPath, 'utf8')), isExistingFile)
+        .filter((violation) => !mandated.has(violation.path))
+        .map((violation) => `${path.basename(configPath)}: ${violation.path} (${violation.reason})`));
+    const findings = [...dangling, ...deadExclusions(context)];
+    return findings.length > 0
+        ? failed(`${String(findings.length)} carve-out(s) that reach nothing`, findings)
+        : passed('every carve-out of a tool config or setting reaches a file that exists');
+};
+/** The frontmatter an agent uses to discover and invoke a skill must be well formed. */
+export const skills = (context) => {
+    const found = globSync('.claude/skills/**/SKILL.md', { cwd: context.root });
+    const findings = [...found]
+        .sort((left, right) => left.localeCompare(right))
+        .flatMap((relativePath) => findSkillManifestViolations({
+        content: readFileSync(path.join(context.root, relativePath), 'utf8'),
+        directoryName: path.basename(path.dirname(relativePath)),
+    }).map((violation) => `${relativePath} [${violation.rule}] ${violation.reason}`));
+    return findings.length > 0
+        ? failed(`${String(findings.length)} skill frontmatter violation(s)`, findings)
+        : passed(`${String(found.length)} skill manifest(s) are well formed`);
+};
+//# sourceMappingURL=references.js.map

package/dist/checks/references.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"references.js","sourceRoot":"","sources":["../../src/checks/references.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,wGAAwG;AACxG,oGAAoG;AACpG,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,QAAQ,EAIR,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,+BAA+B,EAC/B,2BAA2B,EAC3B,2BAA2B,EAC3B,gCAAgC,EAChC,kBAAkB,GAEnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAIL,gBAAgB,EAChB,YAAY,GACb,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,eAAe,GAAG,CAAC,OAAgB,EAA2B,EAAE,CACpE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;AAEpD,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAU,EAAE,CAClD,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;AAElE,qGAAqG;AACrG,sGAAsG;AACtG,oGAAoG;AACpG,sGAAsG;AACtG,8BAA8B;AAC9B,MAAM,OAAO,GAAG,CAAC,UAAgB,EAAE,SAAiB,EAAsB,EAAE,CAC1E,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;AAEvF,MAAM,SAAS,GAAG,CAChB,UAAgB,EAChB,KAAyB,EACzB,IAA6C,EACxB,EAAE,CACvB,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AAE7E,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAqB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;AAElG,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAqB,EAAE,CAC9D,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAA;AAExD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,UAAgB,EAChB,gBAAqC,IAAI,GAAG,EAAU,EAC1C,EAAE;IACd,MAAM,QAAQ,GAAG,CAAC,YAAoB,EAAW,EAAE,CACjD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAA;IACtD,MAAM,SAAS,GAAgC,kBAAkB,CAC/D,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAc,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC/D,QAAQ,CACT,CAAA;IACD,MAAM,QAAQ,GAAsB,SAAS,CAAC,OAAO,CACnD,CAAC,QAA0B,EAAqB,EAAE;QAChD,MAAM,KAAK,GAAuB,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAA;QACzE,OAAO,+BAA+B,CAAC;YACrC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YACzE,WAAW,EAAE,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC;YACtD,YAAY,EAAE,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,eAAe,CAAC;YAC3D,4FAA4F;YAC5F,uCAAuC;YACvC,cAAc,EAAE,CAAC,YAAoB,EAAW,EAAE,CAChD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC;YACjF,aAAa;SACd,CAAC,CAAC,GAAG,CACJ,CAAC,SAA4B,EAAU,EAAE,CACvC,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CACrF,CAAA;IACH,CAAC,CACF,CAAA;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,uCAAuC,EAAE,QAAQ,CAAC;QACrF,CAAC,CAAC,MAAM,CAAC,iBAAiB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAA;AAC9E,CAAC,CAAA;AAED,kGAAkG;AAClG,wFAAwF;AACxF,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAqB,EAAE;IAC5D,MAAM,KAAK,GAAW,gBAAgB,CAAC,kBAAkB,CAAC,CAAA;IAC1D,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,yBAAyB,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC;KAC7C,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AACvD,CAAC,CAAA;AAED,oGAAoG;AACpG,uGAAuG;AACvG,qGAAqG;AACrG,sGAAsG;AACtG,qGAAqG;AACrG,MAAM,kBAAkB,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACnE,IAAI,GAAG,CAAC,yBAAyB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AAE7D,oGAAoG;AACpG,qGAAqG;AACrG,oGAAoG;AACpG,0CAA0C;AAC1C,kGAAkG;AAClG,yGAAyG;AACzG,wFAAwF;AACxF,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAqB,EAAE,CAC7D,gCAAgC,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;AAEnG;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC/D,MAAM,cAAc,GAAG,CAAC,YAAoB,EAAW,EAAE,CACvD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAwB,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAsB,aAAa,CAAC,OAAO,CAAC,CAAC,OAAO,CAChE,CAAC,UAAkB,EAAqB,EAAE,CACxC,2BAA2B,CACzB,yBAAyB,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,EAC3D,cAAc,CACf;SACE,MAAM,CAAC,CAAC,SAAmC,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;SACvF,GAAG,CACF,CAAC,SAAmC,EAAU,EAAE,CAC9C,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,GAAG,CAC1E,CACN,CAAA;IACD,MAAM,QAAQ,GAAsB,CAAC,GAAG,QAAQ,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7E,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,kCAAkC,EAAE,QAAQ,CAAC;QAChF,CAAC,CAAC,MAAM,CAAC,wEAAwE,CAAC,CAAA;AACtF,CAAC,CAAA;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAc,EAAE;IACrD,MAAM,KAAK,GAAsB,QAAQ,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9F,MAAM,QAAQ,GAAsB,CAAC,GAAG,KAAK,CAAC;SAC3C,IAAI,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACxE,OAAO,CAAC,CAAC,YAAoB,EAAqB,EAAE,CACnD,2BAA2B,CAAC;QAC1B,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QACpE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;KACzD,CAAC,CAAC,GAAG,CACJ,CAAC,SAAyB,EAAU,EAAE,CACpC,GAAG,YAAY,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAC5D,CACF,CAAA;IACH,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,iCAAiC,EAAE,QAAQ,CAAC;QAC/E,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAA;AACzE,CAAC,CAAA"}

package/dist/checks/suppressions.d.ts

@@ -0,0 +1,5 @@
+import { type Context } from '../context.js';
+import { type GateResult } from '../exec.js';
+/** Count suppressions and source lines across the project's own code. */
+export declare const suppressions: (context: Context) => GateResult;
+//# sourceMappingURL=suppressions.d.ts.map

package/dist/checks/suppressions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/checks/suppressions.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,OAAO,EAAgB,MAAM,eAAe,CAAA;AAC1D,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAW5D,yEAAyE;AACzE,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,UAoD/C,CAAA"}

package/dist/checks/suppressions.js

@@ -0,0 +1,50 @@
+// The suppression ceiling gate. The decision lives in governance; this reads the tree.
+//
+// Its summary is what satisfies the reporting rule. `reportGate` prints a gate's summary on every run,
+// pass or fail, so putting the count and the headroom there makes the trend readable before the ceiling
+// is reached without adding a reporting path of its own. Findings stay empty while the project is
+// within budget because the summary already carries the whole report; passing findings are reserved for
+// a separate informational report such as dependency freshness.
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { countSourceLines, findSuppressions, isGovernedCode, judgeSuppressions, } from '@ploaness/governance';
+import { trackedFiles } from '../context.js';
+import { failed, passed } from '../exec.js';
+import { managedPaths } from './assets.js';
+const isUnderSourceRoots = (file, sourceRoots) => sourceRoots.some((sourceRoot) => file.startsWith(`${sourceRoot}/`));
+/** Count suppressions and source lines across the project's own code. */
+export const suppressions = (context) => {
+    const excluded = context.settings.typographyExclusions;
+    // A managed file is ploaness's, byte for byte, and the project can neither remove a suppression
+    // inside it nor be asked to justify one. Its lines are left out of the denominator for the same
+    // reason: a ceiling earned by code the project did not write would be an allowance, not a measure.
+    const managed = managedPaths(context);
+    // A tracked path is not always a regular file: a symlink and a submodule gitlink both appear here.
+    const files = trackedFiles(context.root).filter((file) => {
+        const full = path.join(context.root, file);
+        return (isUnderSourceRoots(file, context.settings.sourceRoots) &&
+            !managed.has(file) &&
+            isGovernedCode(file, excluded) &&
+            existsSync(full) &&
+            statSync(full).isFile());
+    });
+    // Read once, then derive both figures from the same contents rather than accumulating as we go.
+    const contents = files.map((file) => ({
+        file,
+        content: readFileSync(path.join(context.root, file), 'utf8'),
+    }));
+    const sites = contents.flatMap((scanned) => findSuppressions(scanned.file, scanned.content));
+    const sourceLines = contents.reduce((total, scanned) => total + countSourceLines(scanned.content), 0);
+    const report = judgeSuppressions(sites, sourceLines, context.settings.maxSuppressions);
+    const summary = `${String(report.count)} of ${String(report.ceiling)} permitted, ` +
+        `${String(report.remaining)} remaining (${String(report.sourceLines)} source lines)`;
+    if (report.withinCeiling) {
+        return passed(summary);
+    }
+    return failed(summary, [
+        `the suppression ceiling is ${String(report.ceiling)} for ` +
+            `${String(report.sourceLines)} source lines; remove one before adding another`,
+        ...report.sites.map((site) => `${site.file}:${String(site.line)} ${site.token}`),
+    ]);
+};
+//# sourceMappingURL=suppressions.js.map

package/dist/checks/suppressions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressions.js","sourceRoot":"","sources":["../../src/checks/suppressions.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,EAAE;AACF,uGAAuG;AACvG,wGAAwG;AACxG,kGAAkG;AAClG,wGAAwG;AACxG,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,GAGlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAgB,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAO1C,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAE,WAA8B,EAAW,EAAE,CACnF,WAAW,CAAC,IAAI,CAAC,CAAC,UAAkB,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,CAAA;AAEtF,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC3D,MAAM,QAAQ,GAAsB,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAA;IACzE,gGAAgG;IAChG,gGAAgG;IAChG,mGAAmG;IACnG,MAAM,OAAO,GAAwB,YAAY,CAAC,OAAO,CAAC,CAAA;IAC1D,mGAAmG;IACnG,MAAM,KAAK,GAAsB,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE;QAC3F,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAClD,OAAO,CACL,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YACtD,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAClB,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC9B,UAAU,CAAC,IAAI,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CACxB,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,gGAAgG;IAChG,MAAM,QAAQ,GAA2B,KAAK,CAAC,GAAG,CAChD,CAAC,IAAY,EAAe,EAAE,CAAC,CAAC;QAC9B,IAAI;QACJ,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;KAC7D,CAAC,CACH,CAAA;IACD,MAAM,KAAK,GAA+B,QAAQ,CAAC,OAAO,CACxD,CAAC,OAAoB,EAA8B,EAAE,CACnD,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAClD,CAAA;IACD,MAAM,WAAW,GAAW,QAAQ,CAAC,MAAM,CACzC,CAAC,KAAa,EAAE,OAAoB,EAAU,EAAE,CAAC,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,EAC1F,CAAC,CACF,CAAA;IAED,MAAM,MAAM,GAAsB,iBAAiB,CACjD,KAAK,EACL,WAAW,EACX,OAAO,CAAC,QAAQ,CAAC,eAAe,CACjC,CAAA;IACD,MAAM,OAAO,GACX,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;QAClE,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAA;IACtF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE;QACrB,8BAA8B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;YACzD,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,iDAAiD;QAChF,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CACjB,CAAC,IAAqB,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CACrF;KACF,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/checks/tailwind.d.ts

@@ -0,0 +1,5 @@
+import { type Context } from '../context.js';
+import { type GateResult } from '../exec.js';
+/** Verify every visual value comes from the Tailwind theme rather than an arbitrary literal. */
+export declare const tailwindTokens: (context: Context) => GateResult;
+//# sourceMappingURL=tailwind.d.ts.map

package/dist/checks/tailwind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailwind.d.ts","sourceRoot":"","sources":["../../src/checks/tailwind.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,KAAK,OAAO,EAAgB,MAAM,eAAe,CAAA;AAC1D,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAc5D,gGAAgG;AAChG,eAAO,MAAM,cAAc,GAAI,SAAS,OAAO,KAAG,UAejD,CAAA"}

package/dist/checks/tailwind.js

@@ -0,0 +1,29 @@
+// The token-bound gate. The rule is pure and lives in @ploaness/governance; this file supplies the
+// I/O: which tracked files carry Tailwind classes, and what a finding reads like.
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { findArbitraryValues, hasExtension, matchesRole, } from '@ploaness/governance';
+import { trackedFiles } from '../context.js';
+import { failed, passed } from '../exec.js';
+// Scoped by role rather than by a list of folders. A Tailwind class is written in JSX, so `.tsx` is
+// where the rule can find one - and it is also the scope that keeps the rule from misreading a regex
+// or an index expression in ordinary TypeScript, which is what a whole-of-`src` scan would do.
+const MARKUP_EXTENSIONS = ['.tsx'];
+// A file under a source root, so a project that declares another one is covered without saying so
+// twice. `matchesRole` is reused rather than a second glob matcher.
+const isScanned = (context, file) => hasExtension(file, MARKUP_EXTENSIONS) &&
+    context.settings.sourceRoots.some((root) => file.startsWith(`${root}/`)) &&
+    !matchesRole(file, context.settings.typographyExclusions);
+/** Verify every visual value comes from the Tailwind theme rather than an arbitrary literal. */
+export const tailwindTokens = (context) => {
+    const scanned = trackedFiles(context.root).filter((file) => isScanned(context, file));
+    const findings = scanned.flatMap((file) => {
+        const content = readFileSync(path.join(context.root, file), 'utf8');
+        return findArbitraryValues(content).map((violation) => `${file}:${String(violation.line)}:${String(violation.column)} ` +
+            `arbitrary Tailwind value \`${violation.value}\`; apply a theme token through a utility class`);
+    });
+    return findings.length > 0
+        ? failed(`${String(findings.length)} arbitrary Tailwind value(s)`, findings)
+        : passed(`${String(scanned.length)} markup file(s) use only token-bound Tailwind utilities`);
+};
+//# sourceMappingURL=tailwind.js.map

package/dist/checks/tailwind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailwind.js","sourceRoot":"","sources":["../../src/checks/tailwind.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,kFAAkF;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAEL,mBAAmB,EACnB,YAAY,EACZ,WAAW,GACZ,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAgB,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,oGAAoG;AACpG,qGAAqG;AACrG,+FAA+F;AAC/F,MAAM,iBAAiB,GAAsB,CAAC,MAAM,CAAC,CAAA;AAErD,kGAAkG;AAClG,oEAAoE;AACpE,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAE,IAAY,EAAW,EAAE,CAC5D,YAAY,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IACzF,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAA;AAE3D,gGAAgG;AAChG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC7D,MAAM,OAAO,GAAsB,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAC7F,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CACzB,CAAA;IACD,MAAM,QAAQ,GAAsB,OAAO,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE;QACtF,MAAM,OAAO,GAAW,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC,GAAG,CACrC,CAAC,SAAkC,EAAU,EAAE,CAC7C,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG;YAChE,8BAA8B,SAAS,CAAC,KAAK,iDAAiD,CACjG,CAAA;IACH,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,8BAA8B,EAAE,QAAQ,CAAC;QAC5E,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAA;AAChG,CAAC,CAAA"}

package/dist/checks/tests.d.ts

@@ -0,0 +1,8 @@
+import { type Context, type Member } from '../context.js';
+import { type GateResult } from '../exec.js';
+export declare const tests: (context: Member) => GateResult;
+/** Run the Playwright end-to-end suite. */
+export declare const endToEnd: (context: Context) => GateResult;
+/** Produce the production build, which the bundle gate then measures. */
+export declare const build: (context: Context) => GateResult;
+//# sourceMappingURL=tests.d.ts.map

package/dist/checks/tests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tests.d.ts","sourceRoot":"","sources":["../../src/checks/tests.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,MAAM,EAGZ,MAAM,eAAe,CAAA;AACtB,OAAO,EAIL,KAAK,UAAU,EAIhB,MAAM,YAAY,CAAA;AA4DnB,eAAO,MAAM,KAAK,GAAI,SAAS,MAAM,KAAG,UAoBpC,CAAA;AAEJ,2CAA2C;AAC3C,eAAO,MAAM,QAAQ,GAAI,SAAS,OAAO,KAAG,UAwC3C,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,KAAK,GAAI,SAAS,OAAO,KAAG,UAwBxC,CAAA"}

package/dist/checks/tests.js

@@ -0,0 +1,123 @@
+// Test execution and the production build. The runner is the project's own Vitest instance, never the
+// harness copy: the project's specs import vitest directly, and a second copy would load a different
+// module registry and fail to match its own matchers.
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { CODE_EXTENSIONS, carriesSourceCode, hasExtension } from '@ploaness/governance';
+import { hasOwnRuntime, resolveProjectTool, trackedFiles, } from '../context.js';
+import { asFindings, failed, fromRun, passed, run, } from '../exec.js';
+// A Payload suite needs a database before it can boot, and how the project obtains one is a fact ploaness
+// cannot know. The project declares it; the thresholds and the gate itself stay ploaness's.
+const runPretest = (context) => {
+    const [command, ...rest] = context.settings.pretest;
+    if (command === undefined) {
+        return undefined;
+    }
+    return run(command, rest, { cwd: context.root });
+};
+const wrapped = (context, interpreterArguments) => {
+    const [wrapper, ...wrapperRest] = context.settings.testWrapper;
+    if (wrapper === undefined) {
+        return { command: process.execPath, commandArguments: interpreterArguments };
+    }
+    return {
+        command: wrapper,
+        commandArguments: [...wrapperRest, process.execPath, ...interpreterArguments],
+    };
+};
+const withPretest = (context, gate) => {
+    const pretest = runPretest(context);
+    if (pretest !== undefined && pretest.code !== 0) {
+        return failed('the declared pretest command failed', asFindings(pretest.output));
+    }
+    return gate();
+};
+// Resolution failure is an answer, not an exception to catch three times over.
+const resolveProjectToolOrUndefined = (context, tool, binary) => {
+    try {
+        return binary === undefined
+            ? resolveProjectTool(context, tool)
+            : resolveProjectTool(context, tool, binary);
+    }
+    catch {
+        return undefined;
+    }
+};
+/** Run the unit and integration suite with coverage, at the ploaness thresholds. */
+// A member that holds no first-party source has no suite to run, and a runner started there fails on an
+// empty include - reporting a package with nothing to test as one that failed to test it. A member
+// holding code and no suite is untouched by this and still fails.
+const hasSourceToTest = (context) => carriesSourceCode(trackedFiles(context.root), context.settings.sourceRoots, (filePath) => hasExtension(filePath, CODE_EXTENSIONS));
+export const tests = (context) => withPretest(context, () => {
+    if (!hasSourceToTest(context)) {
+        return passed('no first-party source in this package, so there is no suite to run');
+    }
+    const vitest = resolveProjectToolOrUndefined(context, 'vitest');
+    if (vitest === undefined) {
+        return failed('vitest could not be resolved from the project', [
+            'the project must declare vitest itself, because its specs import it directly',
+        ]);
+    }
+    const invocation = wrapped(context, [vitest, 'run', '--coverage']);
+    return fromRun(run(invocation.command, invocation.commandArguments, {
+        cwd: context.root,
+        env: { NODE_OPTIONS: '--no-deprecation' },
+    }), 'the suite passes and meets the per-file coverage thresholds', 'the suite failed, or a file is below a coverage threshold');
+});
+/** Run the Playwright end-to-end suite. */
+export const endToEnd = (context) => {
+    // A library has no browser to drive, and `assets` already withholds the managed specs from one on the
+    // same test. Without this the two gates contradicted each other: the catalogue correctly gave a
+    // library no `playwright.config.ts`, and this gate then failed it for the file's absence.
+    if (!hasOwnRuntime(context)) {
+        return passed('this package has no runtime of its own, so there is no end-to-end suite');
+    }
+    // Not optional, and no longer treated as such. ploaness ships the accessibility sweep as a managed
+    // spec, so a project with no Playwright config is a project whose managed files are missing rather
+    // than one that opted out; reporting a pass here would hide that behind a green gate.
+    if (!existsSync(path.join(context.root, 'playwright.config.ts'))) {
+        return failed('playwright.config.ts is missing, so the end-to-end suite cannot run', [
+            'run `ploaness init` to write it, then `ploaness sync` to materialise the managed specs',
+        ]);
+    }
+    return withPretest(context, () => {
+        const playwright = resolveProjectToolOrUndefined(context, '@playwright/test', 'playwright');
+        if (playwright === undefined) {
+            return failed('@playwright/test could not be resolved from the project', [
+                'the project must declare @playwright/test itself, because its specs import it directly',
+            ]);
+        }
+        const invocation = wrapped(context, [
+            playwright,
+            'test',
+            '--config=playwright.config.ts',
+        ]);
+        return fromRun(run(invocation.command, invocation.commandArguments, {
+            cwd: context.root,
+            env: { NODE_OPTIONS: '--no-deprecation --import=tsx/esm' },
+        }), 'the end-to-end suite passes', 'the end-to-end suite failed');
+    });
+};
+/** Produce the production build, which the bundle gate then measures. */
+export const build = (context) => {
+    if (!hasOwnRuntime(context)) {
+        return passed('this package has no runtime of its own, so there is nothing to build');
+    }
+    return withPretest(context, () => {
+        const next = resolveProjectToolOrUndefined(context, 'next');
+        if (next === undefined) {
+            return failed('next could not be resolved from the project', [
+                'a Payload application builds through Next, which the project must declare',
+            ]);
+        }
+        const invocation = wrapped(context, [next, 'build']);
+        return fromRun(run(invocation.command, invocation.commandArguments, {
+            cwd: context.root,
+            env: {
+                NEXT_TELEMETRY_DISABLED: '1',
+                NODE_OPTIONS: '--no-deprecation --max-old-space-size=8000',
+            },
+        }), 'the production build succeeds', 'the production build failed');
+    });
+};
+//# sourceMappingURL=tests.js.map

package/dist/checks/tests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tests.js","sourceRoot":"","sources":["../../src/checks/tests.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,qGAAqG;AACrG,sDAAsD;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACvF,OAAO,EAEL,aAAa,EAEb,kBAAkB,EAClB,YAAY,GACb,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,UAAU,EACV,MAAM,EACN,OAAO,EAEP,MAAM,EAEN,GAAG,GACJ,MAAM,YAAY,CAAA;AAEnB,0GAA0G;AAC1G,4FAA4F;AAC5F,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAyB,EAAE;IAC7D,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAA;IACnD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;AAClD,CAAC,CAAA;AAOD,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,oBAAuC,EAAc,EAAE;IACxF,MAAM,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAA;IAC9D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAA;IAC9E,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,gBAAgB,EAAE,CAAC,GAAG,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,oBAAoB,CAAC;KAC9E,CAAA;AACH,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAE,IAAsB,EAAc,EAAE;IAC3E,MAAM,OAAO,GAA0B,UAAU,CAAC,OAAO,CAAC,CAAA;IAC1D,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,qCAAqC,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAClF,CAAC;IACD,OAAO,IAAI,EAAE,CAAA;AACf,CAAC,CAAA;AAED,+EAA+E;AAC/E,MAAM,6BAA6B,GAAG,CACpC,OAAgB,EAChB,IAAY,EACZ,MAAe,EACK,EAAE;IACtB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC;YACnC,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,oFAAoF;AACpF,wGAAwG;AACxG,mGAAmG;AACnG,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAC,OAAe,EAAW,EAAE,CACnD,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE,CAC/F,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CACxC,CAAA;AAEH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAe,EAAc,EAAE,CACnD,WAAW,CAAC,OAAO,EAAE,GAAe,EAAE;IACpC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,oEAAoE,CAAC,CAAA;IACrF,CAAC;IACD,MAAM,MAAM,GAAuB,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACnF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,+CAA+C,EAAE;YAC7D,8EAA8E;SAC/E,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,UAAU,GAAe,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAA;IAC9E,OAAO,OAAO,CACZ,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,gBAAgB,EAAE;QACnD,GAAG,EAAE,OAAO,CAAC,IAAI;QACjB,GAAG,EAAE,EAAE,YAAY,EAAE,kBAAkB,EAAE;KAC1C,CAAC,EACF,6DAA6D,EAC7D,2DAA2D,CAC5D,CAAA;AACH,CAAC,CAAC,CAAA;AAEJ,2CAA2C;AAC3C,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAgB,EAAc,EAAE;IACvD,sGAAsG;IACtG,gGAAgG;IAChG,0FAA0F;IAC1F,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,yEAAyE,CAAC,CAAA;IAC1F,CAAC;IACD,mGAAmG;IACnG,mGAAmG;IACnG,sFAAsF;IACtF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,qEAAqE,EAAE;YACnF,wFAAwF;SACzF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,GAAe,EAAE;QAC3C,MAAM,UAAU,GAAuB,6BAA6B,CAClE,OAAO,EACP,kBAAkB,EAClB,YAAY,CACb,CAAA;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,yDAAyD,EAAE;gBACvE,wFAAwF;aACzF,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,UAAU,GAAe,OAAO,CAAC,OAAO,EAAE;YAC9C,UAAU;YACV,MAAM;YACN,+BAA+B;SAChC,CAAC,CAAA;QACF,OAAO,OAAO,CACZ,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,gBAAgB,EAAE;YACnD,GAAG,EAAE,OAAO,CAAC,IAAI;YACjB,GAAG,EAAE,EAAE,YAAY,EAAE,mCAAmC,EAAE;SAC3D,CAAC,EACF,6BAA6B,EAC7B,6BAA6B,CAC9B,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAc,EAAE;IACpD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,sEAAsE,CAAC,CAAA;IACvF,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,GAAe,EAAE;QAC3C,MAAM,IAAI,GAAuB,6BAA6B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC/E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,6CAA6C,EAAE;gBAC3D,2EAA2E;aAC5E,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,UAAU,GAAe,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;QAChE,OAAO,OAAO,CACZ,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,gBAAgB,EAAE;YACnD,GAAG,EAAE,OAAO,CAAC,IAAI;YACjB,GAAG,EAAE;gBACH,uBAAuB,EAAE,GAAG;gBAC5B,YAAY,EAAE,4CAA4C;aAC3D;SACF,CAAC,EACF,+BAA+B,EAC/B,6BAA6B,CAC9B,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/checks/toolchain.d.ts

@@ -0,0 +1,25 @@
+import { type Context, type Member } from '../context.js';
+import { type GateResult, type RunResult } from '../exec.js';
+/** Strict type checking against the project's tsconfig, which extends the ploaness one. */
+export declare const types: (context: Context) => GateResult;
+/** Formatting and fast lint. */
+export declare const biome: (context: Context) => GateResult;
+/** Apply Biome's own fixes, used by `ploaness format`. */
+export declare const biomeWrite: (context: Context) => RunResult;
+export declare const biomeSchema: () => GateResult;
+/** The type-aware lint layer, which catches what a syntax-only linter cannot. */
+export declare const eslint: (context: Member) => GateResult;
+/**
+ * The same run with its fixable rules applied, used by `ploaness format`.
+ *
+ * It lives beside the gate that judges what it writes, for the reason `biomeWrite` does: the two must
+ * not disagree about which files the tool touches, and the arguments they share say so in one place.
+ */
+export declare const eslintWrite: (context: Member) => RunResult;
+/** Style sheets. Biome remains the formatter, so Stylelint is lint-only. */
+export declare const css: (context: Context) => GateResult;
+export declare const architecture: (context: Member) => GateResult;
+/** Full type coverage on hand-written logic: no implicit or explicit `any` survives. */
+export declare const typeCoverage: (context: Context) => GateResult;
+export declare const knip: (context: Member) => GateResult;
+//# sourceMappingURL=toolchain.d.ts.map

package/dist/checks/toolchain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolchain.d.ts","sourceRoot":"","sources":["../../src/checks/toolchain.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,MAAM,EAA2C,MAAM,eAAe,CAAA;AAClG,OAAO,EAAmB,KAAK,UAAU,EAAU,KAAK,SAAS,EAAW,MAAM,YAAY,CAAA;AAI9F,2FAA2F;AAC3F,eAAO,MAAM,KAAK,GAAI,SAAS,OAAO,KAAG,UAOtC,CAAA;AAIH,gCAAgC;AAChC,eAAO,MAAM,KAAK,GAAI,SAAS,OAAO,KAAG,UAOtC,CAAA;AAEH,0DAA0D;AAC1D,eAAO,MAAM,UAAU,GAAI,SAAS,OAAO,KAAG,SACqD,CAAA;AASnG,eAAO,MAAM,WAAW,QAAO,UAiB9B,CAAA;AAOD,iFAAiF;AACjF,eAAO,MAAM,MAAM,GAAI,SAAS,MAAM,KAAG,UAOtC,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,MAAM,KAAG,SAG1C,CAAA;AAQJ,4EAA4E;AAC5E,eAAO,MAAM,GAAG,GAAI,SAAS,OAAO,KAAG,UAepC,CAAA;AAoCH,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,KAAG,UAe9C,CAAA;AA+BD,wFAAwF;AACxF,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,UAmB7C,CAAA;AAqBH,eAAO,MAAM,IAAI,GAAI,SAAS,MAAM,KAAG,UAUpC,CAAA"}

package/dist/checks/toolchain.js

@@ -0,0 +1,165 @@
+// The gates that delegate to a tool. Each one points the tool at the ploaness-owned configuration rather
+// than trusting a file in the consumer tree, because most of those files are FORBIDDEN paths: the
+// project has no copy to drift from.
+import { existsSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { analysisBoundaries, asRecord, eslintArguments, memberKindOf, pureLogicRule, } from '@ploaness/governance';
+import { readJson, resolveTool, shippedDirectory } from '../context.js';
+import { failed, fromRun, passed, runNode } from '../exec.js';
+const configFile = (name) => path.join(shippedDirectory('@ploaness/config'), name);
+/** Strict type checking against the project's tsconfig, which extends the ploaness one. */
+export const types = (context) => fromRun(runNode(resolveTool('typescript', 'tsc'), ['--noEmit', '-p', 'tsconfig.json'], {
+    cwd: context.root,
+}), 'the project type-checks under the ploaness compiler options', 'the project does not type-check under the ploaness compiler options');
+// `--error-on-warnings` for the reason the Stylelint invocation below carries `--max-warnings=0`: a
+// check has two verdicts, and a diagnostic Biome ranks as a warning would otherwise print and exit 0.
+/** Formatting and fast lint. */
+export const biome = (context) => fromRun(runNode(resolveTool('@biomejs/biome', 'biome'), ['check', '--error-on-warnings', '.'], {
+    cwd: context.root,
+}), 'Biome reports no formatting or lint defect', 'Biome reports a formatting or lint defect');
+/** Apply Biome's own fixes, used by `ploaness format`. */
+export const biomeWrite = (context) => runNode(resolveTool('@biomejs/biome', 'biome'), ['check', '--write', '.'], { cwd: context.root });
+const versionOf = (manifest) => typeof manifest['version'] === 'string' ? manifest['version'] : '';
+const SCHEMA_PATTERN = /biomejs\.dev\/schemas\/(\d+\.\d+\.\d+)\/schema\.json/;
+// Biome reports a schema mismatch only as a non-failing information notice, so without this gate a Biome
+// bump would leave the pinned `$schema` stale and silently out of date.
+export const biomeSchema = () => {
+    const manifest = readJson(path.join(shippedDirectory('@biomejs/biome'), 'package.json'));
+    const installed = versionOf(asRecord(manifest));
+    const declared = SCHEMA_PATTERN.exec(readFileSync(configFile('biome.json'), 'utf8'))?.[1];
+    if (declared === undefined) {
+        return failed('the ploaness Biome config declares no $schema URL', [
+            'this is a ploaness packaging defect; report it',
+        ]);
+    }
+    return declared === installed
+        ? passed(`Biome $schema matches the installed CLI (${installed})`)
+        : failed('the ploaness Biome $schema drifted from the installed CLI', [
+            `$schema is ${declared} but @biomejs/biome is ${installed}`,
+            'this is a ploaness packaging defect; report it',
+        ]);
+};
+// Which files the run covers is `eslintArguments`' to decide, so that the writing run below cannot
+// answer it differently. What stays here is why this run renders a verdict at all: `--max-warnings=0` is
+// the backstop behind the severity escalation in `eslint-core.js`. That escalation raises what the
+// current presets declare; the flag fails the build on a warning whatever its source, including a preset
+// added later whose severities nobody re-read.
+/** The type-aware lint layer, which catches what a syntax-only linter cannot. */
+export const eslint = (context) => fromRun(runNode(resolveTool('eslint'), [...eslintArguments(context.siblingPaths, 'report')], {
+    cwd: context.root,
+}), 'ESLint reports no defect', 'ESLint reports at least one defect');
+/**
+ * The same run with its fixable rules applied, used by `ploaness format`.
+ *
+ * It lives beside the gate that judges what it writes, for the reason `biomeWrite` does: the two must
+ * not disagree about which files the tool touches, and the arguments they share say so in one place.
+ */
+export const eslintWrite = (context) => runNode(resolveTool('eslint'), [...eslintArguments(context.siblingPaths, 'fix')], {
+    cwd: context.root,
+});
+// `--max-warnings=0` because the shipped config asks Stylelint to report a descriptionless, needless, or
+// wrongly scoped disable, and Stylelint reports those at warning severity. A warning severity does not
+// exist here: any finding is a failure.
+const stylesheetGlobs = (context) => context.settings.sourceRoots.map((sourceRoot) => `${sourceRoot}/**/*.css`);
+/** Style sheets. Biome remains the formatter, so Stylelint is lint-only. */
+export const css = (context) => fromRun(runNode(resolveTool('stylelint'), [
+    '--config',
+    configFile('stylelint.json'),
+    ...stylesheetGlobs(context),
+    '--allow-empty-input',
+    '--max-warnings=0',
+], { cwd: context.root }), 'style sheets pass Stylelint', 'a style sheet does not pass Stylelint');
+/** Module architecture: layer boundaries, cycles, and import hygiene. */
+// The layer map is rendered rather than shipped, because the pure-logic floor is the one genuinely
+// project-shaped part of the contract and a governed project may not own the analyzer's config file to
+// state it. Written outside the working tree, so a verification run still writes nothing a fingerprint
+// would notice, and pointed at the shipped rules by absolute path so the relative extends still resolves.
+// Matches the indent every JSON file ploaness writes.
+const JSON_INDENT = 2;
+const architectureConfig = (context, kind) => {
+    const shipped = configFile(kind === 'library' ? 'dependency-cruiser-core.json' : 'dependency-cruiser.json');
+    const floor = pureLogicRule(context.settings.pureLogicRoots);
+    if (floor === undefined) {
+        return shipped;
+    }
+    const directory = mkdtempSync(path.join(tmpdir(), 'ploaness-arch-'));
+    const rendered = path.join(directory, 'dependency-cruiser.json');
+    writeFileSync(rendered, `${JSON.stringify({ extends: shipped, forbidden: [floor] }, null, JSON_INDENT)}\n`);
+    return rendered;
+};
+// Every declared source root, not `src` alone: the acyclic-dependency rule is about the package's
+// dependency units, and a cycle through `scripts` or `tests` is still a cycle. Only the roots that
+// EXIST, though - the analyzer refuses a directory it cannot open, so a package holding shared scripts
+// and no `src` failed on the shape of its own layout rather than on anything about its architecture.
+const presentSourceRoots = (context) => context.settings.sourceRoots.filter((root) => existsSync(path.join(context.root, root)));
+export const architecture = (context) => {
+    const roots = presentSourceRoots(context);
+    if (roots.length === 0) {
+        return passed('this package holds no source directory to cruise');
+    }
+    const kind = memberKindOf(context.packageJson);
+    return fromRun(runNode(resolveTool('dependency-cruiser', 'depcruise'), [...roots, '--config', architectureConfig(context, kind)], { cwd: context.root }), 'module architecture holds', 'the module architecture contract is broken');
+};
+// Roles with no hand-written type surface to measure: framework glue, generated files, views, and
+// configuration. Measuring them would dilute the score rather than sharpen it.
+//
+// This list must never become empty, for a reason beyond what it names. type-coverage also reads a
+// `typeCoverage` key from the consumer's package.json, which ploaness does not police - and does not
+// need to, because a CLI `--ignore-files` REPLACES that key's `ignoreFiles` rather than merging with
+// it. Measured: with these flags the score is identical whether or not a consumer declares
+// `typeCoverage.ignoreFiles: ["src/**", "scripts/**"]`. Passing no `--ignore-files` would hand the
+// consumer that key back, which is a scope narrowing the harness is supposed to refuse.
+const TYPE_COVERAGE_IGNORE = [
+    '.next/**',
+    'src/app/**',
+    'src/**/*.tsx',
+    'src/payload.config.ts',
+    'src/payload-types.ts',
+    'src/seed/**',
+    // Test code is held to tsc at full strictness, to every ESLint rule, and to the coverage floors -
+    // the static-analysis checks the standard means. Type coverage is a different measurement: with
+    // `--strict` it counts every type assertion as uncovered, and a test's job is to construct inputs
+    // the production types cannot express. A Payload access predicate takes a full PayloadRequest, so
+    // asserting a partial one is the correct way to test the predicate, and the only way to reach 100%
+    // here would be to build framework objects nobody reads. This is a file role, not a convenience.
+    'tests/**',
+    '*.config.ts',
+    '*.config.mts',
+    '*.config.mjs',
+    'vitest.setup.ts',
+];
+/** Full type coverage on hand-written logic: no implicit or explicit `any` survives. */
+export const typeCoverage = (context) => fromRun(runNode(resolveTool('type-coverage'), [
+    '--at-least',
+    '100',
+    '--strict',
+    '--cache',
+    'false',
+    ...TYPE_COVERAGE_IGNORE.flatMap((pattern) => [
+        '--ignore-files',
+        pattern,
+    ]),
+], { cwd: context.root }), 'hand-written logic is fully typed', 'some hand-written logic is not fully typed');
+/** Dead code, unused files, and unused dependencies. */
+// The member boundary `analysisBoundaries` states, reaching knip. It takes the patterns as configuration
+// rather than as a flag, and its own config is a shipped file a project may not edit - so the boundary
+// has to be rendered into a copy for the run rather than passed on the command line as ESLint's is.
+const knipConfig = (context) => {
+    const boundaries = analysisBoundaries(context.siblingPaths);
+    if (boundaries.length === 0) {
+        return configFile('knip.json');
+    }
+    const shipped = asRecord(readJson(configFile('knip.json')));
+    const directory = mkdtempSync(path.join(tmpdir(), 'ploaness-knip-'));
+    const rendered = path.join(directory, 'knip.json');
+    writeFileSync(rendered, `${JSON.stringify({ ...shipped, ignore: boundaries }, null, JSON_INDENT)}\n`);
+    return rendered;
+};
+export const knip = (context) => fromRun(runNode(resolveTool('knip'), ['--config', knipConfig(context)], {
+    cwd: context.root,
+    // knip traces the graph by importing the project, and a Payload config validates `process.env`
+    // at module scope. Without placeholders the analysis dies on configuration rather than on code.
+    env: context.settings.analysisEnv,
+}), 'no dead code or unused dependency', 'dead code or an unused dependency was found');
+//# sourceMappingURL=toolchain.js.map

package/dist/checks/toolchain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolchain.js","sourceRoot":"","sources":["../../src/checks/toolchain.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,kGAAkG;AAClG,qCAAqC;AACrC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,kBAAkB,EAClB,QAAQ,EACR,eAAe,EAEf,YAAY,EACZ,aAAa,GACd,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAA6B,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAClG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAmB,MAAM,EAAkB,OAAO,EAAE,MAAM,YAAY,CAAA;AAE9F,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAAA;AAElG,2FAA2F;AAC3F,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAc,EAAE,CACpD,OAAO,CACL,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE;IAC7E,GAAG,EAAE,OAAO,CAAC,IAAI;CAClB,CAAC,EACF,6DAA6D,EAC7D,qEAAqE,CACtE,CAAA;AAEH,oGAAoG;AACpG,sGAAsG;AACtG,gCAAgC;AAChC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAc,EAAE,CACpD,OAAO,CACL,OAAO,CAAC,WAAW,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,EAAE,GAAG,CAAC,EAAE;IACrF,GAAG,EAAE,OAAO,CAAC,IAAI;CAClB,CAAC,EACF,4CAA4C,EAC5C,2CAA2C,CAC5C,CAAA;AAEH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAa,EAAE,CACxD,OAAO,CAAC,WAAW,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;AAEnG,MAAM,SAAS,GAAG,CAAC,QAAiC,EAAU,EAAE,CAC9D,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAEpE,MAAM,cAAc,GAAW,sDAAsD,CAAA;AAErF,yGAAyG;AACzG,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG,GAAe,EAAE;IAC1C,MAAM,QAAQ,GAAY,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,CAAC,CAAA;IACjG,MAAM,SAAS,GAAW,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAuB,cAAc,CAAC,IAAI,CACtD,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAC/C,EAAE,CAAC,CAAC,CAAC,CAAA;IACN,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,mDAAmD,EAAE;YACjE,gDAAgD;SACjD,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,QAAQ,KAAK,SAAS;QAC3B,CAAC,CAAC,MAAM,CAAC,4CAA4C,SAAS,GAAG,CAAC;QAClE,CAAC,CAAC,MAAM,CAAC,2DAA2D,EAAE;YAClE,cAAc,QAAQ,0BAA0B,SAAS,EAAE;YAC3D,gDAAgD;SACjD,CAAC,CAAA;AACR,CAAC,CAAA;AAED,mGAAmG;AACnG,yGAAyG;AACzG,mGAAmG;AACnG,yGAAyG;AACzG,+CAA+C;AAC/C,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAe,EAAc,EAAE,CACpD,OAAO,CACL,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,EAAE;IACnF,GAAG,EAAE,OAAO,CAAC,IAAI;CAClB,CAAC,EACF,0BAA0B,EAC1B,oCAAoC,CACrC,CAAA;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAa,EAAE,CACxD,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,EAAE;IAChF,GAAG,EAAE,OAAO,CAAC,IAAI;CAClB,CAAC,CAAA;AAEJ,yGAAyG;AACzG,uGAAuG;AACvG,wCAAwC;AACxC,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAqB,EAAE,CAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAkB,EAAU,EAAE,CAAC,GAAG,UAAU,WAAW,CAAC,CAAA;AAE5F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,OAAgB,EAAc,EAAE,CAClD,OAAO,CACL,OAAO,CACL,WAAW,CAAC,WAAW,CAAC,EACxB;IACE,UAAU;IACV,UAAU,CAAC,gBAAgB,CAAC;IAC5B,GAAG,eAAe,CAAC,OAAO,CAAC;IAC3B,qBAAqB;IACrB,kBAAkB;CACnB,EACD,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CACtB,EACD,6BAA6B,EAC7B,uCAAuC,CACxC,CAAA;AAEH,yEAAyE;AACzE,mGAAmG;AACnG,uGAAuG;AACvG,uGAAuG;AACvG,0GAA0G;AAC1G,sDAAsD;AACtD,MAAM,WAAW,GAAW,CAAC,CAAA;AAE7B,MAAM,kBAAkB,GAAG,CAAC,OAAgB,EAAE,IAAgB,EAAU,EAAE;IACxE,MAAM,OAAO,GAAW,UAAU,CAChC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,yBAAyB,CAChF,CAAA;IACD,MAAM,KAAK,GAAwC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACjG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,SAAS,GAAW,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;IAC5E,MAAM,QAAQ,GAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACxE,aAAa,CACX,QAAQ,EACR,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CACnF,CAAA;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,kGAAkG;AAClG,mGAAmG;AACnG,uGAAuG;AACvG,qGAAqG;AACrG,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAqB,EAAE,CAChE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAC5D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAC1C,CAAA;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAc,EAAE;IAC1D,MAAM,KAAK,GAAsB,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,kDAAkD,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,IAAI,GAAe,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAC1D,OAAO,OAAO,CACZ,OAAO,CACL,WAAW,CAAC,oBAAoB,EAAE,WAAW,CAAC,EAC9C,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,EACzD,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CACtB,EACD,2BAA2B,EAC3B,4CAA4C,CAC7C,CAAA;AACH,CAAC,CAAA;AAED,kGAAkG;AAClG,+EAA+E;AAC/E,EAAE;AACF,mGAAmG;AACnG,qGAAqG;AACrG,qGAAqG;AACrG,2FAA2F;AAC3F,mGAAmG;AACnG,wFAAwF;AACxF,MAAM,oBAAoB,GAAsB;IAC9C,UAAU;IACV,YAAY;IACZ,cAAc;IACd,uBAAuB;IACvB,sBAAsB;IACtB,aAAa;IACb,kGAAkG;IAClG,gGAAgG;IAChG,kGAAkG;IAClG,kGAAkG;IAClG,mGAAmG;IACnG,iGAAiG;IACjG,UAAU;IACV,aAAa;IACb,cAAc;IACd,cAAc;IACd,iBAAiB;CAClB,CAAA;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAc,EAAE,CAC3D,OAAO,CACL,OAAO,CACL,WAAW,CAAC,eAAe,CAAC,EAC5B;IACE,YAAY;IACZ,KAAK;IACL,UAAU;IACV,SAAS;IACT,OAAO;IACP,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC,OAAe,EAAqB,EAAE,CAAC;QACtE,gBAAgB;QAChB,OAAO;KACR,CAAC;CACH,EACD,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CACtB,EACD,mCAAmC,EACnC,4CAA4C,CAC7C,CAAA;AAEH,wDAAwD;AACxD,yGAAyG;AACzG,uGAAuG;AACvG,oGAAoG;AACpG,MAAM,UAAU,GAAG,CAAC,OAAe,EAAU,EAAE;IAC7C,MAAM,UAAU,GAAsB,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC,WAAW,CAAC,CAAA;IAChC,CAAC;IACD,MAAM,OAAO,GAA4B,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IACpF,MAAM,SAAS,GAAW,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;IAC5E,MAAM,QAAQ,GAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAC1D,aAAa,CACX,QAAQ,EACR,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAC7E,CAAA;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAAe,EAAc,EAAE,CAClD,OAAO,CACL,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE;IAC9D,GAAG,EAAE,OAAO,CAAC,IAAI;IACjB,+FAA+F;IAC/F,gGAAgG;IAChG,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW;CAClC,CAAC,EACF,mCAAmC,EACnC,6CAA6C,CAC9C,CAAA"}

package/dist/checks/tree.d.ts

@@ -0,0 +1,6 @@
+import { type Context } from '../context.js';
+import { type GateResult } from '../exec.js';
+export declare const treeSnapshot: (context: Context) => GateResult;
+/** Verify no gate modified a tracked file during verification. */
+export declare const treeVerify: (context: Context) => GateResult;
+//# sourceMappingURL=tree.d.ts.map

package/dist/checks/tree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree.d.ts","sourceRoot":"","sources":["../../src/checks/tree.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,OAAO,EAAgB,MAAM,eAAe,CAAA;AAC1D,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AA0B5D,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,UAK/C,CAAA;AAED,kEAAkE;AAClE,eAAO,MAAM,UAAU,GAAI,SAAS,OAAO,KAAG,UAY7C,CAAA"}