@ploaness/cli 1.1.0 → 1.2.0

package/dist/checks/environment.js.map

@@ -1 +1 @@
-{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../src/checks/environment.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,mEAAmE;AACnE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAEL,iBAAiB,EACjB,yBAAyB,EAEzB,yBAAyB,EACzB,4BAA4B,GAE7B,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAwC,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACtF,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,kBAAkB,GAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;AACpE,MAAM,iBAAiB,GAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE9D,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,YAAoB,EAAsB,EAAE;IAC/E,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IAClD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAClE,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAAyB,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAA;AAErF,wGAAwG;AACxG,uGAAuG;AACvG,sCAAsC;AACtC,MAAM,WAAW,GAAG,CAAC,UAAgB,EAAsB,EAAE,CAC3D,yBAAyB,CAAC,GAAG,CAAC,CAAC,SAAiB,EAAsB,EAAE,CACtE,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAC1C,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAEnB,qGAAqG;AACrG,oBAAoB;AACpB,MAAM,UAAU,GAAG,CAAC,UAAgB,EAAqB,EAAE,CACzD,UAAU,CAAC,OAAO;KACf,GAAG,CAAC,CAAC,MAAc,EAAsB,EAAE,CAC1C,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC,CACrF;KACA,MAAM,CAAC,SAAS,CAAC,CAAA;AAEtB,MAAM,cAAc,GAAG,CAAC,UAAgB,EAAqB,EAAE,CAC7D,iBAAiB,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAuB,EAAU,EAAE,CAC3F,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAC/D,CAAA;AAEH,wGAAwG;AACxG,oGAAoG;AACpG,iDAAiD;AACjD,MAAM,SAAS,GAAG,CAAC,UAAgB,EAA2B,EAAE,CAC9D,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC;KAC9B,MAAM,CACL,CAAC,IAAY,EAAW,EAAE,CACxB,IAAI,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACnD,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC7E;KACA,GAAG,CACF,CAAC,IAAY,EAAgB,EAAE,CAAC,CAAC;IAC/B,IAAI;IACJ,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;CAChE,CAAC,CACH,CAAA;AAEL,MAAM,QAAQ,GAAG,CAAC,SAA+B,EAAU,EAAE,CAC3D,GAAG,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAA;AAE1C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,UAAgB,EAAc,EAAE;IAC1D,MAAM,UAAU,GAAoC,yBAAyB,CAAC;QAC5E,kBAAkB,EAAE,UAAU,CAAC,UAAU,CAAC;QAC1C,OAAO,EAAE,WAAW,CAAC,UAAU,CAAC;QAChC,cAAc,EAAE,cAAc,CAAC,UAAU,CAAC;QAC1C,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC;KACjC,CAAC,CAAA;IACF,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,MAAM,CACJ,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,6EAA6E,EACzG,UAAU,CAAC,GAAG,CAAC,CAAC,SAA+B,EAAU,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CACjF;QACH,CAAC,CAAC,MAAM,CAAC,qEAAqE,CAAC,CAAA;AACnF,CAAC,CAAA"}
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../src/checks/environment.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,mEAAmE;AACnE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAEL,iBAAiB,EACjB,yBAAyB,EAEzB,yBAAyB,EACzB,4BAA4B,EAE5B,WAAW,GACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAwC,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACtF,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,YAAoB,EAAsB,EAAE;IAC/E,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IAClD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAClE,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAAyB,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAA;AAErF,wGAAwG;AACxG,uGAAuG;AACvG,sCAAsC;AACtC,MAAM,WAAW,GAAG,CAAC,UAAgB,EAAsB,EAAE,CAC3D,yBAAyB,CAAC,GAAG,CAAC,CAAC,SAAiB,EAAsB,EAAE,CACtE,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAC1C,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAEnB,qGAAqG;AACrG,oBAAoB;AACpB,MAAM,UAAU,GAAG,CAAC,UAAgB,EAAqB,EAAE,CACzD,UAAU,CAAC,OAAO;KACf,GAAG,CAAC,CAAC,MAAc,EAAsB,EAAE,CAC1C,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC,CACrF;KACA,MAAM,CAAC,SAAS,CAAC,CAAA;AAEtB,MAAM,cAAc,GAAG,CAAC,UAAgB,EAAqB,EAAE,CAC7D,iBAAiB,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAuB,EAAU,EAAE,CAC3F,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAC/D,CAAA;AAEH,qGAAqG;AACrG,sBAAsB;AACtB,MAAM,SAAS,GAAG,CAAC,UAAgB,EAA2B,EAAE,CAC9D,WAAW,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAChD,CAAC,IAAY,EAAgB,EAAE,CAAC,CAAC;IAC/B,IAAI;IACJ,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;CAChE,CAAC,CACH,CAAA;AAEH,MAAM,QAAQ,GAAG,CAAC,SAA+B,EAAU,EAAE,CAC3D,GAAG,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAA;AAE1C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,UAAgB,EAAc,EAAE;IAC1D,MAAM,UAAU,GAAoC,yBAAyB,CAAC;QAC5E,kBAAkB,EAAE,UAAU,CAAC,UAAU,CAAC;QAC1C,OAAO,EAAE,WAAW,CAAC,UAAU,CAAC;QAChC,cAAc,EAAE,cAAc,CAAC,UAAU,CAAC;QAC1C,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC;KACjC,CAAC,CAAA;IACF,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,MAAM,CACJ,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,6EAA6E,EACzG,UAAU,CAAC,GAAG,CAAC,CAAC,SAA+B,EAAU,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CACjF;QACH,CAAC,CAAC,MAAM,CAAC,qEAAqE,CAAC,CAAA;AACnF,CAAC,CAAA"}

package/dist/checks/install.d.ts

@@ -2,4 +2,6 @@ import type { Repository as Repo } from '../context.js';
 import { type GateResult } from '../exec.js';
 /** The repository must name the dependencies permitted to run an install script. */
 export declare const installScripts: (repo: Repo) => GateResult;
+/** The repository must keep pnpm's release-age floor strict, and may exempt only the harness from it. */
+export declare const releaseAge: (repo: Repo) => GateResult;
 //# sourceMappingURL=install.d.ts.map

package/dist/checks/install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/checks/install.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,IAAI,IAAI,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAQ5D,oFAAoF;AACpF,eAAO,MAAM,cAAc,GAAI,MAAM,IAAI,KAAG,UAMpC,CAAA"}
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/checks/install.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,IAAI,IAAI,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAQ5D,oFAAoF;AACpF,eAAO,MAAM,cAAc,GAAI,MAAM,IAAI,KAAG,UAMpC,CAAA;AAIR,yGAAyG;AACzG,eAAO,MAAM,UAAU,GAAI,MAAM,IAAI,KAAG,UAQvC,CAAA"}

package/dist/checks/install.js

@@ -4,7 +4,7 @@
 // `pnpm install` - the broadest surface a project has for executing code it never called. The gate
 // requires the allowlist to exist and says nothing about what is on it: which packages a project trusts
 // with an install script is a decision for the project to record, not one the harness can make for it.
-import { declaresInstallScriptAllowlist } from '@ploaness/governance';
+import { declaresInstallScriptAllowlist, findReleaseAgeViolations } from '@ploaness/governance';
 import { failed, passed } from '../exec.js';
 const WORKSPACE_FILE = 'pnpm-workspace.yaml';
 // The workspace file arrives already read, from the repository root. It used to be read relative to
@@ -18,4 +18,13 @@ export const installScripts = (repo) => declaresInstallScriptAllowlist(repo.work
         `declare onlyBuiltDependencies in ${WORKSPACE_FILE}, or under the "pnpm" key of package.json`,
         'an empty list is a valid answer: it permits no dependency to run an install script',
     ]);
+// The same file, read the same way, for the other half of install policy: what pnpm may install at all.
+// The decisions are in `install-policy.ts`; this hands over the file and names the gate.
+/** The repository must keep pnpm's release-age floor strict, and may exempt only the harness from it. */
+export const releaseAge = (repo) => {
+    const findings = findReleaseAgeViolations(repo.workspaceFile);
+    return findings.length > 0
+        ? failed(`${String(findings.length)} release-age setting(s) weaken the floor pnpm enforces`, findings)
+        : passed('the release-age floor is strict, and only the harness is excluded from it');
+};
 //# sourceMappingURL=install.js.map

package/dist/checks/install.js.map

@@ -1 +1 @@
-{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/checks/install.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,wGAAwG;AACxG,uGAAuG;AACvG,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AAErE,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,cAAc,GAAW,qBAAqB,CAAA;AAEpD,oGAAoG;AACpG,uGAAuG;AACvG,kGAAkG;AAClG,uDAAuD;AACvD,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAU,EAAc,EAAE,CACvD,8BAA8B,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC;IAClE,CAAC,CAAC,MAAM,CAAC,kEAAkE,CAAC;IAC5E,CAAC,CAAC,MAAM,CAAC,yCAAyC,EAAE;QAChD,oCAAoC,cAAc,2CAA2C;QAC7F,oFAAoF;KACrF,CAAC,CAAA"}
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/checks/install.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,wGAAwG;AACxG,uGAAuG;AACvG,OAAO,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAE/F,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,cAAc,GAAW,qBAAqB,CAAA;AAEpD,oGAAoG;AACpG,uGAAuG;AACvG,kGAAkG;AAClG,uDAAuD;AACvD,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAU,EAAc,EAAE,CACvD,8BAA8B,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC;IAClE,CAAC,CAAC,MAAM,CAAC,kEAAkE,CAAC;IAC5E,CAAC,CAAC,MAAM,CAAC,yCAAyC,EAAE;QAChD,oCAAoC,cAAc,2CAA2C;QAC7F,oFAAoF;KACrF,CAAC,CAAA;AAER,wGAAwG;AACxG,yFAAyF;AACzF,yGAAyG;AACzG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAU,EAAc,EAAE;IACnD,MAAM,QAAQ,GAAsB,wBAAwB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAChF,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CACJ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,wDAAwD,EAClF,QAAQ,CACT;QACH,CAAC,CAAC,MAAM,CAAC,2EAA2E,CAAC,CAAA;AACzF,CAAC,CAAA"}

package/dist/checks/oxlint.d.ts

@@ -0,0 +1,5 @@
+import { type Member } from '../context.js';
+import { type GateResult } from '../exec.js';
+/** Native core checks for every member, with accessibility only in the existing application scope. */
+export declare const oxlint: (member: Member) => GateResult;
+//# sourceMappingURL=oxlint.d.ts.map

package/dist/checks/oxlint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxlint.d.ts","sourceRoot":"","sources":["../../src/checks/oxlint.ts"],"names":[],"mappings":"AAmBA,OAAO,EAGL,KAAK,MAAM,EAKZ,MAAM,eAAe,CAAA;AACtB,OAAO,EAAU,KAAK,UAAU,EAA+C,MAAM,YAAY,CAAA;AAsGjG,sGAAsG;AACtG,eAAO,MAAM,MAAM,GAAI,QAAQ,MAAM,KAAG,UAmBvC,CAAA"}

package/dist/checks/oxlint.js

@@ -0,0 +1,85 @@
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { asRecord, asText, isEslintOwnedSuppression, isOxlintConfig, oxlintArguments, oxlintConfig, oxlintGroups, oxlintReportProblems, oxlintRuleNames, oxlintSourceFiles, oxlintSuppressionProblems, } from '@ploaness/governance';
+import { cliDirectory, hasOwnRuntime, readJson, resolveTool, shippedDirectory, workingTreeFiles, } from '../context.js';
+import { failed, passed, runNode, withOutput } from '../exec.js';
+import { sourceComments } from '../source-comments.js';
+const JSON_INDENT = 2;
+const manifestIn = (directory) => asRecord(readJson(path.join(directory, 'package.json')));
+const versionProblems = () => {
+    const cli = manifestIn(cliDirectory());
+    const expected = asText(asRecord(cli['dependencies'])['oxlint']);
+    const manifest = manifestIn(shippedDirectory('oxlint'));
+    return expected.length > 0 && manifest['version'] === expected
+        ? []
+        : [`Oxlint must resolve to the harness-owned version ${expected}`];
+};
+const eligibleFiles = (member, inventory) => oxlintSourceFiles(inventory, member.settings.generatedArtefacts, member.siblingPaths).filter((file) => {
+    const absolute = path.join(member.root, file);
+    return existsSync(absolute) && statSync(absolute).isFile();
+});
+const suppressionProblems = (member, group) => group.files.flatMap((file) => {
+    const text = readFileSync(path.join(member.root, file), 'utf8');
+    const problems = oxlintSuppressionProblems(sourceComments(text, file), oxlintRuleNames(group.rules));
+    return problems.map((problem) => `${file}: ${problem}`);
+});
+const legacySitesIn = (member, files) => files.flatMap((file) => {
+    const text = readFileSync(path.join(member.root, file), 'utf8');
+    return sourceComments(text, file)
+        .filter(isEslintOwnedSuppression)
+        .map((comment) => ({ file, line: comment.line }));
+});
+const nativeVerdict = (result, group, legacy) => {
+    const findings = oxlintReportProblems(result.stdout, group.files.length, group.rules.length, { exitCode: result.code, output: result.output, legacy });
+    return withOutput(findings.length === 0
+        ? passed(`${String(group.files.length)} source file(s) pass ${String(group.rules.length)} native rules`)
+        : failed('Oxlint did not establish conformance', [
+            ...findings,
+            ...(result.code === 0 ? [] : [result.output]),
+        ]), result.output);
+};
+const analyze = (member, group) => {
+    const directory = mkdtempSync(path.join(tmpdir(), 'ploaness-oxlint-'));
+    try {
+        const config = path.join(directory, 'oxlint.json');
+        writeFileSync(config, `${JSON.stringify(oxlintConfig(group.rules), null, JSON_INDENT)}\n`);
+        const legacy = legacySitesIn(member, group.files);
+        return nativeVerdict(runNode(resolveTool('oxlint'), [...oxlintArguments(config, group.files)], {
+            cwd: member.root,
+        }), group, legacy);
+    }
+    finally {
+        rmSync(directory, { recursive: true, force: true });
+    }
+};
+/** Run disjoint groups sequentially, preserving each invocation's measured coverage. */
+const analyzeGroups = (member, groups) => {
+    const [first, ...rest] = groups;
+    if (first === undefined) {
+        return passed('no eligible source remains to analyze');
+    }
+    const result = analyze(member, first);
+    if (!result.ok || rest.length === 0) {
+        return result;
+    }
+    const remaining = analyzeGroups(member, rest);
+    return withOutput({ ...remaining, summary: `${result.summary}; ${remaining.summary}` }, [result.output, remaining.output].filter(Boolean).join('\n'));
+};
+/** Native core checks for every member, with accessibility only in the existing application scope. */
+export const oxlint = (member) => {
+    const inventory = workingTreeFiles(member.root);
+    const groups = oxlintGroups(eligibleFiles(member, inventory), hasOwnRuntime(member));
+    const problems = [
+        ...versionProblems(),
+        ...inventory
+            .filter(isOxlintConfig)
+            .map((file) => `${file}: Oxlint configuration is owned by ploaness`),
+        ...groups.flatMap((group) => suppressionProblems(member, group)),
+    ];
+    if (problems.length > 0) {
+        return failed('Oxlint wiring or suppression policy is violated', problems);
+    }
+    return analyzeGroups(member, groups);
+};
+//# sourceMappingURL=oxlint.js.map

package/dist/checks/oxlint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxlint.js","sourceRoot":"","sources":["../../src/checks/oxlint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAChG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,QAAQ,EACR,MAAM,EACN,wBAAwB,EACxB,cAAc,EAGd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,yBAAyB,GAE1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,YAAY,EACZ,aAAa,EAEb,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAkB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,MAAM,WAAW,GAAW,CAAC,CAAA;AAE7B,MAAM,UAAU,GAAG,CAAC,SAAiB,EAA2B,EAAE,CAChE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAA;AAE1D,MAAM,eAAe,GAAG,GAAsB,EAAE;IAC9C,MAAM,GAAG,GAA4B,UAAU,CAAC,YAAY,EAAE,CAAC,CAAA;IAC/D,MAAM,QAAQ,GAAW,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxE,MAAM,QAAQ,GAA4B,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAA;IAChF,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,QAAQ;QAC5D,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,oDAAoD,QAAQ,EAAE,CAAC,CAAA;AACtE,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,SAA4B,EAAqB,EAAE,CACxF,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAC1F,CAAC,IAAY,EAAW,EAAE;IACxB,MAAM,QAAQ,GAAW,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACrD,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAA;AAC5D,CAAC,CACF,CAAA;AAEH,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,KAAkB,EAAqB,EAAE,CACpF,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE;IACtD,MAAM,IAAI,GAAW,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAsB,yBAAyB,CAC3D,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,EAC1B,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAC7B,CAAA;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAA;AACzE,CAAC,CAAC,CAAA;AAEJ,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,KAAwB,EAA+B,EAAE,CAC9F,KAAK,CAAC,OAAO,CAAC,CAAC,IAAY,EAA+B,EAAE;IAC1D,MAAM,IAAI,GAAW,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IACvE,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC;SAC9B,MAAM,CAAC,wBAAwB,CAAC;SAChC,GAAG,CAAC,CAAC,OAAsB,EAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AACtF,CAAC,CAAC,CAAA;AAEJ,MAAM,aAAa,GAAG,CACpB,MAAiB,EACjB,KAAkB,EAClB,MAAmC,EACvB,EAAE;IACd,MAAM,QAAQ,GAAsB,oBAAoB,CACtD,MAAM,CAAC,MAAM,EACb,KAAK,CAAC,KAAK,CAAC,MAAM,EAClB,KAAK,CAAC,KAAK,CAAC,MAAM,EAClB,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CACzD,CAAA;IACD,OAAO,UAAU,CACf,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,MAAM,CACJ,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,wBAAwB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAC/F;QACH,CAAC,CAAC,MAAM,CAAC,sCAAsC,EAAE;YAC7C,GAAG,QAAQ;YACX,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SAC9C,CAAC,EACN,MAAM,CAAC,MAAM,CACd,CAAA;AACH,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,KAAkB,EAAc,EAAE;IACjE,MAAM,SAAS,GAAW,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAC9E,IAAI,CAAC;QACH,MAAM,MAAM,GAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QAC1D,aAAa,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAA;QAC1F,MAAM,MAAM,GAAgC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QAC9E,OAAO,aAAa,CAClB,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE;YACxE,GAAG,EAAE,MAAM,CAAC,IAAI;SACjB,CAAC,EACF,KAAK,EACL,MAAM,CACP,CAAA;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,CAAC;AACH,CAAC,CAAA;AAED,wFAAwF;AACxF,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,MAA8B,EAAc,EAAE;IACnF,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAA2B,MAAM,CAAA;IACvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,uCAAuC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,MAAM,GAAe,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,SAAS,GAAe,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACzD,OAAO,UAAU,CACf,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,EAAE,EAAE,EACpE,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7D,CAAA;AACH,CAAC,CAAA;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAc,EAAE;IACnD,MAAM,SAAS,GAAsB,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClE,MAAM,MAAM,GAA2B,YAAY,CACjD,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,EAChC,aAAa,CAAC,MAAM,CAAC,CACtB,CAAA;IACD,MAAM,QAAQ,GAAsB;QAClC,GAAG,eAAe,EAAE;QACpB,GAAG,SAAS;aACT,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,GAAG,IAAI,6CAA6C,CAAC;QACtF,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAkB,EAAqB,EAAE,CAC1D,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CACnC;KACF,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,iDAAiD,EAAE,QAAQ,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AACtC,CAAC,CAAA"}

package/dist/checks/payload.d.ts

@@ -2,6 +2,17 @@ import { type Context, type Member } from '../context.js';
 import { type GateResult } from '../exec.js';
 /** Regenerate the Payload types and admin import map, then fail on any drift. */
 export declare const payloadGenerated: (context: Context) => GateResult;
+/**
+ * Every collection and global in the BUILT configuration decides its access.
+ *
+ * The static rule reads the access blocks a project wrote; this one imports the configuration Payload
+ * actually boots, so the collections the framework builds for the project - the folder tree, the job
+ * queue, a plugin's own - are judged too. Each of those arrives with Payload's default, which admits
+ * every signed-in user, and the anonymous sweep cannot see that because a signed-in user is not
+ * anonymous. The harness's own tsx loads the configuration against the project's tsconfig, with the
+ * project root as the working directory so `payload` resolves from the project.
+ */
+export declare const payloadDefaults: (context: Member) => GateResult;
 /** Apply the source rules to every TypeScript file under the declared source roots. */
 export declare const payloadRules: (context: Member) => GateResult;
 /**

package/dist/checks/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../src/checks/payload.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,MAAM,EAIZ,MAAM,eAAe,CAAA;AACtB,OAAO,EAAsB,KAAK,UAAU,EAAmC,MAAM,YAAY,CAAA;AA2BjG,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,KAAG,UAgDnD,CAAA;AAsCD,uFAAuF;AACvF,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,KAAG,UAmB9C,CAAA;AAOD;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,KAAG,UAmC5C,CAAA"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../src/checks/payload.ts"],"names":[],"mappings":"AAuBA,OAAO,EACL,KAAK,OAAO,EAGZ,KAAK,MAAM,EAOZ,MAAM,eAAe,CAAA;AACtB,OAAO,EAGL,KAAK,UAAU,EAKhB,MAAM,YAAY,CAAA;AA2BnB,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,KAAG,UAgDnD,CAAA;AAuDD;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,KAAG,UA6CjD,CAAA;AAuCD,uFAAuF;AACvF,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,KAAG,UAmB9C,CAAA;AAOD;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,KAAG,UAmC5C,CAAA"}

package/dist/checks/payload.js

@@ -2,9 +2,9 @@
 // and the Local API must be used in a way that neither over-fetches nor skips access control.
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
-import { findDeclaredAdminViews, findGeneratedDrift, findPayloadViolations, findSourceViolations, findUnguardedRelationships, findUnscannedAdminViews, } from '@ploaness/governance';
-import { git, resolveProjectTool, runEnvironment, workingTreeFiles, } from '../context.js';
-import { asFindings, failed, passed, runNode } from '../exec.js';
+import { findDeclaredAdminViews, findEndpointViolations, findGeneratedDrift, findInheritedAccess, findPayloadViolations, findSourceViolations, findUnconstrainedDraftReads, findUnguardedRelationships, findUnscannedAdminViews, parseInheritedAccessReport, payloadConfigPathOf, } from '@ploaness/governance';
+import { cliDirectory, git, manifestPathFrom, readJson, resolveProjectTool, resolveTool, runEnvironment, workingTreeFiles, } from '../context.js';
+import { asFindings, failed, passed, runNode, withOutput, } from '../exec.js';
 // Resolution failure is an answer rather than an exception the caller must catch.
 const resolveProjectToolOrUndefined = (context, tool) => {
     try {
@@ -75,14 +75,111 @@ export const payloadGenerated = (context) => {
         ])
         : passed('the generated Payload artefacts match the configuration');
 };
+// Where Payload keeps the function it fills an undeclared operation with. Named by path because the
+// package's exports map does not expose it; ploaness pins `payload` exactly, so a layout change arrives
+// with a ploaness release rather than silently, and an absent file fails closed below.
+const DEFAULT_ACCESS_MODULE = ['dist', 'auth', 'defaultAccess.js'];
+const PROBE_FILE = ['dist', 'probes', 'payload-defaults.probe.js'];
+// Building a configuration opens no socket, but a plugin might, and a hung import must end as a verdict.
+const PROBE_TIMEOUT_MS = 120_000;
+const defaultAccessFileOf = (context) => {
+    const manifest = manifestPathFrom('payload', path.join(context.root, 'package.json'));
+    return manifest === undefined
+        ? undefined
+        : path.join(path.dirname(manifest), ...DEFAULT_ACCESS_MODULE);
+};
+// The two defects the report can carry, named separately so the summary says which one was found
+// rather than counting them together under whichever wording came first.
+const summariseAccessFindings = (inherited, draftReads) => {
+    const parts = [
+        ...(inherited > 0
+            ? [`${String(inherited)} collection(s) or global(s) inherit Payload's default access`]
+            : []),
+        ...(draftReads > 0
+            ? [`${String(draftReads)} drafts read(s) serve an unapproved document to a stranger`]
+            : []),
+    ];
+    return parts.join('; ');
+};
+// The probe's outcome, once it ran: a report that was not printed, or not readable, is a failure of its
+// own rather than an empty finding list, because nothing else stands between a crashed probe and a pass.
+const judgeProbe = (result) => {
+    if (result.code !== 0) {
+        return failed('the Payload configuration could not be built', asFindings(result.output));
+    }
+    const report = parseInheritedAccessReport(result.stdout);
+    if (report === undefined) {
+        return failed('the access probe printed no readable report', asFindings(result.output));
+    }
+    const inherited = findInheritedAccess(report);
+    const draftReads = findUnconstrainedDraftReads(report);
+    const findings = [...inherited, ...draftReads];
+    return findings.length > 0
+        ? failed(summariseAccessFindings(inherited.length, draftReads.length), findings)
+        : passed('every collection and global decides its access, framework-built ones included, and no ' +
+            'drafts read serves an unapproved document to a stranger');
+};
+/**
+ * Every collection and global in the BUILT configuration decides its access.
+ *
+ * The static rule reads the access blocks a project wrote; this one imports the configuration Payload
+ * actually boots, so the collections the framework builds for the project - the folder tree, the job
+ * queue, a plugin's own - are judged too. Each of those arrives with Payload's default, which admits
+ * every signed-in user, and the anonymous sweep cannot see that because a signed-in user is not
+ * anonymous. The harness's own tsx loads the configuration against the project's tsconfig, with the
+ * project root as the working directory so `payload` resolves from the project.
+ */
+export const payloadDefaults = (context) => {
+    const tsconfig = path.join(context.root, 'tsconfig.json');
+    const configPath = payloadConfigPathOf(readJson(tsconfig));
+    const configFile = path.join(context.root, configPath);
+    if (!existsSync(configFile)) {
+        return failed('the Payload configuration could not be found', [
+            `${configPath} does not exist; a Payload member names its configuration under ` +
+                'compilerOptions.paths["@payload-config"] in tsconfig.json, which `ploaness init` writes',
+        ]);
+    }
+    const defaultAccessFile = defaultAccessFileOf(context);
+    if (defaultAccessFile === undefined) {
+        return failed('payload could not be resolved from the project', [
+            'ploaness governs Payload projects, so "payload" must be installed in the project itself',
+        ]);
+    }
+    if (!existsSync(defaultAccessFile)) {
+        return failed("Payload's default access could not be located", [
+            `${defaultAccessFile} is missing; ploaness knows the layout of the Payload version it pins, ` +
+                'and this installation differs',
+        ]);
+    }
+    const result = runNode(resolveTool('tsx'), [
+        '--tsconfig',
+        tsconfig,
+        path.join(cliDirectory(), ...PROBE_FILE),
+        configFile,
+        defaultAccessFile,
+    ], {
+        cwd: context.root,
+        // The placeholders every analyzer that imports the project receives, then the project's own
+        // environment, then the one option ploaness owns: the same layering the knip and generated gates
+        // use, so a configuration that validates `process.env` on import survives here as it does there.
+        env: {
+            ...context.settings.analysisEnv,
+            ...runEnvironment(context),
+            NODE_OPTIONS: '--no-deprecation',
+        },
+        timeoutMs: PROBE_TIMEOUT_MS,
+    });
+    return withOutput(judgeProbe(result), result.output);
+};
 const SOURCE_EXTENSIONS = ['.ts', '.tsx'];
 // The language rules apply to every package; the Payload ones only to a package that has Payload to
 // misuse. Held together, the import rule ran only where Payload did - so a frontend beside the CMS, the
 // place a parent-relative import is MOST likely because it has no Payload config to anchor on, was the
 // one package never checked for it.
-const violationsIn = (source, isPayload) => [
-    ...findSourceViolations(source),
-    ...(isPayload ? findPayloadViolations(source) : []),
+const violationsIn = (file, isPayload) => [
+    ...findSourceViolations(file.source),
+    ...(isPayload ? findPayloadViolations(file.source) : []),
+    ...(isPayload ? findEndpointViolations(file.path, file.source) : []),
 ];
 const sourceCandidates = (context) => {
     const roots = context.settings.sourceRoots;
@@ -107,7 +204,7 @@ export const payloadRules = (context) => {
         source: readFileSync(path.join(context.root, file), 'utf8'),
     }));
     const findings = [
-        ...files.flatMap((file) => violationsIn(file.source, context.isPayload).map((violation) => reported(file.path, violation))),
+        ...files.flatMap((file) => violationsIn(file, context.isPayload).map((violation) => reported(file.path, violation))),
         ...crossFileFindings(context, files),
     ];
     return findings.length > 0

package/dist/checks/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../src/checks/payload.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,8FAA8F;AAC9F,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAEL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,GAKxB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,GAAG,EAEH,kBAAkB,EAClB,cAAc,EACd,gBAAgB,GACjB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,EAAmB,MAAM,EAAkB,OAAO,EAAE,MAAM,YAAY,CAAA;AAEjG,kFAAkF;AAClF,MAAM,6BAA6B,GAAG,CAAC,OAAgB,EAAE,IAAY,EAAsB,EAAE;IAC3F,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,MAAc,EAAsB,EAAE;IACzE,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC5C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAClE,CAAC,CAAA;AAED,uGAAuG;AACvG,wGAAwG;AACxG,8BAA8B;AAC9B,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAE,MAAc,EAAW,EAAE;IAC9D,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC/D,MAAM,UAAU,GAAuB,6BAA6B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACxF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,wDAAwD,EAAE;YACtE,yFAAyF;SAC1F,CAAC,CAAA;IACJ,CAAC;IACD,oGAAoG;IACpG,qGAAqG;IACrG,qGAAqG;IACrG,sGAAsG;IACtG,kGAAkG;IAClG,mCAAmC;IACnC,MAAM,OAAO,GAAsB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAA;IACtE,+FAA+F;IAC/F,wBAAwB;IACxB,MAAM,MAAM,GAA4C,IAAI,GAAG,CAC7D,OAAO,CAAC,GAAG,CAAC,CAAC,MAAc,EAAyC,EAAE,CAAC;QACrE,MAAM;QACN,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KACpC,CAAC,CACH,CAAA;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAc,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE;YACtD,GAAG,EAAE,OAAO,CAAC,IAAI;YACjB,8FAA8F;YAC9F,6FAA6F;YAC7F,GAAG,EAAE,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE;SACtE,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,WAAW,MAAM,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAmC,OAAO,CAAC,GAAG,CAC7D,CAAC,MAAc,EAAuB,EAAE,CAAC,CAAC;QACxC,MAAM;QACN,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC;QACrC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KAC3C,CAAC,CACH,CAAA;IACD,MAAM,OAAO,GAAsB,kBAAkB,CAAC,WAAW,CAAC,CAAA;IAClE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,MAAM,CAAC,4DAA4D,EAAE;YACnE,GAAG,OAAO;YACV,8BAA8B;SAC/B,CAAC;QACJ,CAAC,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAA;AACvE,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAE5D,oGAAoG;AACpG,wGAAwG;AACxG,uGAAuG;AACvG,oCAAoC;AACpC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,SAAkB,EAA+B,EAAE,CAAC;IACxF,GAAG,oBAAoB,CAAC,MAAM,CAAC;IAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CACpD,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAqB,EAAE;IAC9D,MAAM,KAAK,GAAsB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAA;IAC7D,OAAO,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAC1C,CAAC,IAAY,EAAW,EAAE,CACxB,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QAClE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAC5C,CAAA;AACH,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,SAA2B,EAAU,EAAE,CACrE,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAA;AAE7E,uGAAuG;AACvG,uGAAuG;AACvG,wGAAwG;AACxG,gCAAgC;AAChC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,KAA4B,EAAqB,EAAE,CAC7F,OAAO,CAAC,SAAS;IACf,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,OAAyB,EAAU,EAAE,CAC1E,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAC1C;IACH,CAAC,CAAC,EAAE,CAAA;AAER,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAc,EAAE;IAC1D,MAAM,UAAU,GAAsB,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC/D,MAAM,KAAK,GAA0B,UAAU,CAAC,GAAG,CACjD,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;KAC5D,CAAC,CACH,CAAA;IACD,MAAM,QAAQ,GAAsB;QAClC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAgB,EAAqB,EAAE,CACvD,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,SAA2B,EAAU,EAAE,CACvF,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAC/B,CACF;QACD,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC;KACrC,CAAA;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,4BAA4B,EAAE,QAAQ,CAAC;QAC1E,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAA;AAClF,CAAC,CAAA;AAED,iGAAiG;AACjG,uGAAuG;AACvG,0FAA0F;AAC1F,MAAM,SAAS,GAAW,QAAQ,CAAA;AAElC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAe,EAAc,EAAE;IACxD,MAAM,KAAK,GAA0B,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAChE,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;KAC5D,CAAC,CACH,CAAA;IACD,MAAM,KAAK,GAA0B,KAAK,CAAC,MAAM,CAAC,CAAC,IAAgB,EAAW,EAAE,CAC9E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAChC,CAAA;IACD,kGAAkG;IAClG,2DAA2D;IAC3D,MAAM,QAAQ,GAAqE,KAAK;SACrF,MAAM,CAAC,CAAC,IAAgB,EAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SACvE,GAAG,CAAC,CAAC,IAAgB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAU,CAAC,CAAA;IAClF,MAAM,QAAQ,GAAsB,QAAQ,CAAC,OAAO,CAClD,CAAC,CAAC,IAAI,EAAE,KAAK,CAAsD,EAAqB,EAAE,CACxF,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,CAC9C,CAAC,SAA2B,EAAU,EAAE,CACtC,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CACnF,CACJ,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,uCAAuC,EAAE,QAAQ,CAAC,CAAA;IAC5F,CAAC;IACD,MAAM,KAAK,GAAW,QAAQ,CAAC,MAAM,CACnC,CAAC,KAAa,EAAE,CAAC,EAAE,KAAK,CAAsD,EAAU,EAAE,CACxF,KAAK,GAAG,KAAK,CAAC,MAAM,EACtB,CAAC,CACF,CAAA;IACD,OAAO,MAAM,CACX,KAAK,KAAK,CAAC;QACT,CAAC,CAAC,4CAA4C;QAC9C,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAC1E,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../src/checks/payload.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,8FAA8F;AAC9F,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAEL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EAIvB,0BAA0B,EAC1B,mBAAmB,GAGpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,YAAY,EACZ,GAAG,EAEH,gBAAgB,EAChB,QAAQ,EACR,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,UAAU,EACV,MAAM,EAEN,MAAM,EAEN,OAAO,EACP,UAAU,GACX,MAAM,YAAY,CAAA;AAEnB,kFAAkF;AAClF,MAAM,6BAA6B,GAAG,CAAC,OAAgB,EAAE,IAAY,EAAsB,EAAE;IAC3F,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,MAAc,EAAsB,EAAE;IACzE,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC5C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAClE,CAAC,CAAA;AAED,uGAAuG;AACvG,wGAAwG;AACxG,8BAA8B;AAC9B,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAE,MAAc,EAAW,EAAE;IAC9D,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC/D,MAAM,UAAU,GAAuB,6BAA6B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACxF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,wDAAwD,EAAE;YACtE,yFAAyF;SAC1F,CAAC,CAAA;IACJ,CAAC;IACD,oGAAoG;IACpG,qGAAqG;IACrG,qGAAqG;IACrG,sGAAsG;IACtG,kGAAkG;IAClG,mCAAmC;IACnC,MAAM,OAAO,GAAsB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAA;IACtE,+FAA+F;IAC/F,wBAAwB;IACxB,MAAM,MAAM,GAA4C,IAAI,GAAG,CAC7D,OAAO,CAAC,GAAG,CAAC,CAAC,MAAc,EAAyC,EAAE,CAAC;QACrE,MAAM;QACN,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KACpC,CAAC,CACH,CAAA;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAc,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE;YACtD,GAAG,EAAE,OAAO,CAAC,IAAI;YACjB,8FAA8F;YAC9F,6FAA6F;YAC7F,GAAG,EAAE,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE;SACtE,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,WAAW,MAAM,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAmC,OAAO,CAAC,GAAG,CAC7D,CAAC,MAAc,EAAuB,EAAE,CAAC,CAAC;QACxC,MAAM;QACN,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC;QACrC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KAC3C,CAAC,CACH,CAAA;IACD,MAAM,OAAO,GAAsB,kBAAkB,CAAC,WAAW,CAAC,CAAA;IAClE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,MAAM,CAAC,4DAA4D,EAAE;YACnE,GAAG,OAAO;YACV,8BAA8B;SAC/B,CAAC;QACJ,CAAC,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAA;AACvE,CAAC,CAAA;AAED,oGAAoG;AACpG,wGAAwG;AACxG,uFAAuF;AACvF,MAAM,qBAAqB,GAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAA;AACrF,MAAM,UAAU,GAAsB,CAAC,MAAM,EAAE,QAAQ,EAAE,2BAA2B,CAAC,CAAA;AACrF,yGAAyG;AACzG,MAAM,gBAAgB,GAAW,OAAO,CAAA;AAExC,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAsB,EAAE;IACnE,MAAM,QAAQ,GAAuB,gBAAgB,CACnD,SAAS,EACT,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CACxC,CAAA;IACD,OAAO,QAAQ,KAAK,SAAS;QAC3B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,qBAAqB,CAAC,CAAA;AACjE,CAAC,CAAA;AAED,iGAAiG;AACjG,yEAAyE;AACzE,MAAM,uBAAuB,GAAG,CAAC,SAAiB,EAAE,UAAkB,EAAU,EAAE;IAChF,MAAM,KAAK,GAAsB;QAC/B,GAAG,CAAC,SAAS,GAAG,CAAC;YACf,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,8DAA8D,CAAC;YACtF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,GAAG,CAAC;YAChB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,4DAA4D,CAAC;YACrF,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC,CAAA;AAED,wGAAwG;AACxG,yGAAyG;AACzG,MAAM,UAAU,GAAG,CAAC,MAAiB,EAAc,EAAE;IACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,8CAA8C,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAC1F,CAAC;IACD,MAAM,MAAM,GAAsC,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3F,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,6CAA6C,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,SAAS,GAAsB,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAChE,MAAM,UAAU,GAAsB,2BAA2B,CAAC,MAAM,CAAC,CAAA;IACzE,MAAM,QAAQ,GAAsB,CAAC,GAAG,SAAS,EAAE,GAAG,UAAU,CAAC,CAAA;IACjE,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;QAChF,CAAC,CAAC,MAAM,CACJ,wFAAwF;YACtF,yDAAyD,CAC5D,CAAA;AACP,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAc,EAAE;IAC7D,MAAM,QAAQ,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;IACjE,MAAM,UAAU,GAAW,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;IAClE,MAAM,UAAU,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IAC9D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,8CAA8C,EAAE;YAC5D,GAAG,UAAU,kEAAkE;gBAC7E,yFAAyF;SAC5F,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAuB,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC1E,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,gDAAgD,EAAE;YAC9D,yFAAyF;SAC1F,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,+CAA+C,EAAE;YAC7D,GAAG,iBAAiB,yEAAyE;gBAC3F,+BAA+B;SAClC,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,MAAM,GAAc,OAAO,CAC/B,WAAW,CAAC,KAAK,CAAC,EAClB;QACE,YAAY;QACZ,QAAQ;QACR,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,CAAC;QACxC,UAAU;QACV,iBAAiB;KAClB,EACD;QACE,GAAG,EAAE,OAAO,CAAC,IAAI;QACjB,4FAA4F;QAC5F,iGAAiG;QACjG,iGAAiG;QACjG,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW;YAC/B,GAAG,cAAc,CAAC,OAAO,CAAC;YAC1B,YAAY,EAAE,kBAAkB;SACjC;QACD,SAAS,EAAE,gBAAgB;KAC5B,CACF,CAAA;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;AACtD,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAE5D,oGAAoG;AACpG,wGAAwG;AACxG,uGAAuG;AACvG,oCAAoC;AACpC,MAAM,YAAY,GAAG,CAAC,IAAgB,EAAE,SAAkB,EAA+B,EAAE,CAAC;IAC1F,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;IACpC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CACrE,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAqB,EAAE;IAC9D,MAAM,KAAK,GAAsB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAA;IAC7D,OAAO,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAC1C,CAAC,IAAY,EAAW,EAAE,CACxB,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QAClE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAC5C,CAAA;AACH,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,SAA2B,EAAU,EAAE,CACrE,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAA;AAE7E,uGAAuG;AACvG,uGAAuG;AACvG,wGAAwG;AACxG,gCAAgC;AAChC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,KAA4B,EAAqB,EAAE,CAC7F,OAAO,CAAC,SAAS;IACf,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,OAAyB,EAAU,EAAE,CAC1E,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAC1C;IACH,CAAC,CAAC,EAAE,CAAA;AAER,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAc,EAAE;IAC1D,MAAM,UAAU,GAAsB,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC/D,MAAM,KAAK,GAA0B,UAAU,CAAC,GAAG,CACjD,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;KAC5D,CAAC,CACH,CAAA;IACD,MAAM,QAAQ,GAAsB;QAClC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAgB,EAAqB,EAAE,CACvD,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,SAA2B,EAAU,EAAE,CAChF,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAC/B,CACF;QACD,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC;KACrC,CAAA;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,4BAA4B,EAAE,QAAQ,CAAC;QAC1E,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAA;AAClF,CAAC,CAAA;AAED,iGAAiG;AACjG,uGAAuG;AACvG,0FAA0F;AAC1F,MAAM,SAAS,GAAW,QAAQ,CAAA;AAElC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAe,EAAc,EAAE;IACxD,MAAM,KAAK,GAA0B,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAChE,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;KAC5D,CAAC,CACH,CAAA;IACD,MAAM,KAAK,GAA0B,KAAK,CAAC,MAAM,CAAC,CAAC,IAAgB,EAAW,EAAE,CAC9E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAChC,CAAA;IACD,kGAAkG;IAClG,2DAA2D;IAC3D,MAAM,QAAQ,GAAqE,KAAK;SACrF,MAAM,CAAC,CAAC,IAAgB,EAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SACvE,GAAG,CAAC,CAAC,IAAgB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAU,CAAC,CAAA;IAClF,MAAM,QAAQ,GAAsB,QAAQ,CAAC,OAAO,CAClD,CAAC,CAAC,IAAI,EAAE,KAAK,CAAsD,EAAqB,EAAE,CACxF,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,CAC9C,CAAC,SAA2B,EAAU,EAAE,CACtC,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CACnF,CACJ,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,uCAAuC,EAAE,QAAQ,CAAC,CAAA;IAC5F,CAAC;IACD,MAAM,KAAK,GAAW,QAAQ,CAAC,MAAM,CACnC,CAAC,KAAa,EAAE,CAAC,EAAE,KAAK,CAAsD,EAAU,EAAE,CACxF,KAAK,GAAG,KAAK,CAAC,MAAM,EACtB,CAAC,CACF,CAAA;IACD,OAAO,MAAM,CACX,KAAK,KAAK,CAAC;QACT,CAAC,CAAC,4CAA4C;QAC9C,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAC1E,CAAA;AACH,CAAC,CAAA"}

package/dist/checks/suppressions.d.ts

@@ -1,5 +1,5 @@
-import { type Context } from '../context.js';
+import { type Member } from '../context.js';
 import { type GateResult } from '../exec.js';
 /** Count suppressions and source lines across the project's own code. */
-export declare const suppressions: (context: Context) => GateResult;
+export declare const suppressions: (context: Member) => GateResult;
 //# sourceMappingURL=suppressions.d.ts.map

package/dist/checks/suppressions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/checks/suppressions.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,OAAO,EAAoB,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAW5D,yEAAyE;AACzE,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,UAsD/C,CAAA"}
+{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/checks/suppressions.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,KAAK,MAAM,EAAoB,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAgD5D,yEAAyE;AACzE,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,KAAG,UA4C9C,CAAA"}

package/dist/checks/suppressions.js

@@ -7,33 +7,53 @@
 // a separate informational report such as dependency freshness.
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
-import { countSourceLines, findSuppressions, isGovernedCode, judgeSuppressions, } from '@ploaness/governance';
+import { countSourceLines, findSuppressions, hasExtension, isGovernedCode, isOxlintSuppression, judgeSuppressions, OXLINT_EXTENSIONS, oxlintSourceFiles, } from '@ploaness/governance';
 import { workingTreeFiles } from '../context.js';
 import { failed, passed } from '../exec.js';
+import { sourceComments } from '../source-comments.js';
 import { managedPaths } from './assets.js';
 const isUnderSourceRoots = (file, sourceRoots) => sourceRoots.some((sourceRoot) => file.startsWith(`${sourceRoot}/`));
-/** Count suppressions and source lines across the project's own code. */
-export const suppressions = (context) => {
-    const excluded = context.settings.typographyExclusions;
-    // A managed file is ploaness's, byte for byte, and the project can neither remove a suppression
-    // inside it nor be asked to justify one. Its lines are left out of the denominator for the same
-    // reason: a ceiling earned by code the project did not write would be an allowance, not a measure.
+const sitesOf = (scanned) => [
+    ...findSuppressions(scanned.file, scanned.content),
+    ...(hasExtension(scanned.file, OXLINT_EXTENSIONS)
+        ? sourceComments(scanned.content, scanned.file)
+            .filter(isOxlintSuppression)
+            .map((comment) => ({
+            file: scanned.file,
+            line: comment.line,
+            token: 'oxlint-disable',
+        }))
+        : []),
+];
+const eligibleFiles = (context, inventory, native) => {
     const managed = managedPaths(context);
-    // An enumerated path is not always a regular file: a symlink and a submodule gitlink both appear here.
-    const files = workingTreeFiles(context.root).filter((file) => {
+    const excluded = context.settings.typographyExclusions;
+    return inventory.filter((file) => {
         const full = path.join(context.root, file);
-        return (isUnderSourceRoots(file, context.settings.sourceRoots) &&
+        return ((hasExtension(file, OXLINT_EXTENSIONS)
+            ? native.has(file)
+            : isUnderSourceRoots(file, context.settings.sourceRoots)) &&
             !managed.has(file) &&
             isGovernedCode(file, excluded) &&
             existsSync(full) &&
             statSync(full).isFile());
     });
+};
+/** Count suppressions and source lines across the project's own code. */
+export const suppressions = (context) => {
+    // A managed file is ploaness's, byte for byte, and the project can neither remove a suppression
+    // inside it nor be asked to justify one. Its lines are left out of the denominator for the same
+    // reason: a ceiling earned by code the project did not write would be an allowance, not a measure.
+    // An enumerated path is not always a regular file: a symlink and a submodule gitlink both appear here.
+    const inventory = workingTreeFiles(context.root);
+    const native = new Set(oxlintSourceFiles(inventory, context.settings.generatedArtefacts, context.siblingPaths));
+    const files = eligibleFiles(context, inventory, native);
     // Read once, then derive both figures from the same contents rather than accumulating as we go.
     const contents = files.map((file) => ({
         file,
         content: readFileSync(path.join(context.root, file), 'utf8'),
     }));
-    const sites = contents.flatMap((scanned) => findSuppressions(scanned.file, scanned.content));
+    const sites = contents.flatMap((scanned) => sitesOf(scanned));
     const sourceLines = contents.reduce((total, scanned) => total + countSourceLines(scanned.content), 0);
     const report = judgeSuppressions(sites, sourceLines, context.settings.maxSuppressions);
     const summary = `${String(report.count)} of ${String(report.ceiling)} permitted, ` +

package/dist/checks/suppressions.js.map

@@ -1 +1 @@
-{"version":3,"file":"suppressions.js","sourceRoot":"","sources":["../../src/checks/suppressions.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,EAAE;AACF,uGAAuG;AACvG,wGAAwG;AACxG,kGAAkG;AAClG,wGAAwG;AACxG,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,GAGlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAO1C,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAE,WAA8B,EAAW,EAAE,CACnF,WAAW,CAAC,IAAI,CAAC,CAAC,UAAkB,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,CAAA;AAEtF,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC3D,MAAM,QAAQ,GAAsB,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAA;IACzE,gGAAgG;IAChG,gGAAgG;IAChG,mGAAmG;IACnG,MAAM,OAAO,GAAwB,YAAY,CAAC,OAAO,CAAC,CAAA;IAC1D,uGAAuG;IACvG,MAAM,KAAK,GAAsB,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CACpE,CAAC,IAAY,EAAW,EAAE;QACxB,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAClD,OAAO,CACL,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YACtD,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAClB,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC9B,UAAU,CAAC,IAAI,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CACxB,CAAA;IACH,CAAC,CACF,CAAA;IAED,gGAAgG;IAChG,MAAM,QAAQ,GAA2B,KAAK,CAAC,GAAG,CAChD,CAAC,IAAY,EAAe,EAAE,CAAC,CAAC;QAC9B,IAAI;QACJ,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;KAC7D,CAAC,CACH,CAAA;IACD,MAAM,KAAK,GAA+B,QAAQ,CAAC,OAAO,CACxD,CAAC,OAAoB,EAA8B,EAAE,CACnD,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAClD,CAAA;IACD,MAAM,WAAW,GAAW,QAAQ,CAAC,MAAM,CACzC,CAAC,KAAa,EAAE,OAAoB,EAAU,EAAE,CAAC,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,EAC1F,CAAC,CACF,CAAA;IAED,MAAM,MAAM,GAAsB,iBAAiB,CACjD,KAAK,EACL,WAAW,EACX,OAAO,CAAC,QAAQ,CAAC,eAAe,CACjC,CAAA;IACD,MAAM,OAAO,GACX,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;QAClE,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAA;IACtF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE;QACrB,8BAA8B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;YACzD,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,iDAAiD;QAChF,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CACjB,CAAC,IAAqB,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CACrF;KACF,CAAC,CAAA;AACJ,CAAC,CAAA"}
+{"version":3,"file":"suppressions.js","sourceRoot":"","sources":["../../src/checks/suppressions.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,EAAE;AACF,uGAAuG;AACvG,wGAAwG;AACxG,kGAAkG;AAClG,wGAAwG;AACxG,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAKlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAe,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAO1C,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAE,WAA8B,EAAW,EAAE,CACnF,WAAW,CAAC,IAAI,CAAC,CAAC,UAAkB,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,CAAA;AAEtF,MAAM,OAAO,GAAG,CAAC,OAAoB,EAA8B,EAAE,CAAC;IACpE,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAC/C,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC;aAC1C,MAAM,CAAC,mBAAmB,CAAC;aAC3B,GAAG,CACF,CAAC,OAAsB,EAAmB,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,gBAAgB;SACxB,CAAC,CACH;QACL,CAAC,CAAC,EAAE,CAAC;CACR,CAAA;AAED,MAAM,aAAa,GAAG,CACpB,OAAe,EACf,SAA4B,EAC5B,MAA2B,EACR,EAAE;IACrB,MAAM,OAAO,GAAwB,YAAY,CAAC,OAAO,CAAC,CAAA;IAC1D,MAAM,QAAQ,GAA2B,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAA;IAC9E,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE;QAChD,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAClD,OAAO,CACL,CAAC,YAAY,CAAC,IAAI,EAAE,iBAAiB,CAAC;YACpC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAClB,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC3D,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAClB,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC9B,UAAU,CAAC,IAAI,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CACxB,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAc,EAAE;IAC1D,gGAAgG;IAChG,gGAAgG;IAChG,mGAAmG;IACnG,uGAAuG;IACvG,MAAM,SAAS,GAAsB,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,MAAM,MAAM,GAAwB,IAAI,GAAG,CACzC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,YAAY,CAAC,CACxF,CAAA;IACD,MAAM,KAAK,GAAsB,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;IAE1E,gGAAgG;IAChG,MAAM,QAAQ,GAA2B,KAAK,CAAC,GAAG,CAChD,CAAC,IAAY,EAAe,EAAE,CAAC,CAAC;QAC9B,IAAI;QACJ,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;KAC7D,CAAC,CACH,CAAA;IACD,MAAM,KAAK,GAA+B,QAAQ,CAAC,OAAO,CACxD,CAAC,OAAoB,EAA8B,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CACvE,CAAA;IACD,MAAM,WAAW,GAAW,QAAQ,CAAC,MAAM,CACzC,CAAC,KAAa,EAAE,OAAoB,EAAU,EAAE,CAAC,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,EAC1F,CAAC,CACF,CAAA;IAED,MAAM,MAAM,GAAsB,iBAAiB,CACjD,KAAK,EACL,WAAW,EACX,OAAO,CAAC,QAAQ,CAAC,eAAe,CACjC,CAAA;IACD,MAAM,OAAO,GACX,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;QAClE,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAA;IACtF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE;QACrB,8BAA8B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;YACzD,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,iDAAiD;QAChF,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CACjB,CAAC,IAAqB,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CACrF;KACF,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/checks/tree.d.ts

@@ -1,4 +1,4 @@
-import { type Context } from '../context.js';
+import type { Context } from '../context.js';
 import { type GateResult } from '../exec.js';
 export declare const treeSnapshot: (context: Context) => GateResult;
 /**

package/dist/checks/tree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tree.d.ts","sourceRoot":"","sources":["../../src/checks/tree.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,OAAO,EAAoB,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AA0B5D,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,UAK/C,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,OAAO,KAAG,UAa7C,CAAA"}
+{"version":3,"file":"tree.d.ts","sourceRoot":"","sources":["../../src/checks/tree.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAY5D,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,UAK/C,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,OAAO,KAAG,UAe7C,CAAA"}

package/dist/checks/tree.js

@@ -1,27 +1,5 @@
-// Working-tree integrity: a fingerprint taken before the gates, and checked again after. Verification must
-// judge the tree the project committed, not one a gate quietly rewrote as a side effect. A formatter or
-// a code generator that edits during `verify` would otherwise let a build pass on content that is not in
-// the repository, and the next clean checkout would fail.
-import { createHash } from 'node:crypto';
-import { readFileSync, statSync } from 'node:fs';
-import path from 'node:path';
-import { workingTreeFiles } from '../context.js';
 import { failed, passed } from '../exec.js';
-const fingerprint = (context) => {
-    const hash = createHash('sha256');
-    for (const file of workingTreeFiles(context.root)) {
-        const full = path.join(context.root, file);
-        hash.update(file);
-        try {
-            hash.update(statSync(full).isFile() ? readFileSync(full) : Buffer.alloc(0));
-        }
-        catch {
-            // An indexed-but-deleted path contributes its name only, so deleting one still changes the digest.
-            hash.update('<absent>');
-        }
-    }
-    return hash.digest('hex');
-};
+import { workingTreeFingerprint } from '../working-tree.js';
 // The fingerprint is taken by one gate and compared by another, so it must outlive both calls, and
 // there is no channel between gates to carry it as a value.
 // eslint-disable-next-line functional/no-let -- must outlive two separate gate invocations
@@ -32,7 +10,7 @@ const FINGERPRINT_PREVIEW = 12;
 export const treeSnapshot = (context) => {
     // Recording state the later tree-verify gate reads is this gate's whole purpose.
     // eslint-disable-next-line unicorn/no-top-level-assignment-in-function -- see the binding above
-    snapshot = fingerprint(context);
+    snapshot = workingTreeFingerprint(context.root);
     return passed(`tree fingerprint recorded (${snapshot.slice(0, FINGERPRINT_PREVIEW)})`);
 };
 /**
@@ -45,9 +23,11 @@ export const treeSnapshot = (context) => {
  */
 export const treeVerify = (context) => {
     if (snapshot === undefined) {
-        return passed('no tree snapshot was taken, so there is nothing to compare');
+        return failed('no tree snapshot was taken', [
+            'run complete verification to establish tree integrity',
+        ]);
     }
-    const current = fingerprint(context);
+    const current = workingTreeFingerprint(context.root);
     return current === snapshot
         ? passed('the working tree is unchanged since verification began')
         : failed('the working tree changed during verification', [

package/dist/checks/tree.js.map

@@ -1 +1 @@
-{"version":3,"file":"tree.js","sourceRoot":"","sources":["../../src/checks/tree.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,wGAAwG;AACxG,yGAAyG;AACzG,0DAA0D;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAChD,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAU,EAAE;IAC/C,MAAM,IAAI,GAAkC,UAAU,CAAC,QAAQ,CAAC,CAAA;IAChE,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,mGAAmG;YACnG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,mGAAmG;AACnG,4DAA4D;AAC5D,2FAA2F;AAC3F,IAAI,QAA4B,CAAA;AAEhC,uEAAuE;AACvE,oGAAoG;AACpG,MAAM,mBAAmB,GAAW,EAAE,CAAA;AAEtC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC3D,iFAAiF;IACjF,gGAAgG;IAChG,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;IAC/B,OAAO,MAAM,CAAC,8BAA8B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAA;AACxF,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAc,EAAE;IACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,4DAA4D,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,OAAO,GAAW,WAAW,CAAC,OAAO,CAAC,CAAA;IAC5C,OAAO,OAAO,KAAK,QAAQ;QACzB,CAAC,CAAC,MAAM,CAAC,wDAAwD,CAAC;QAClE,CAAC,CAAC,MAAM,CAAC,8CAA8C,EAAE;YACrD,2FAA2F;YAC3F,kGAAkG;YAClG,YAAY,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,cAAc,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,EAAE;YACvG,0CAA0C;SAC3C,CAAC,CAAA;AACR,CAAC,CAAA"}
+{"version":3,"file":"tree.js","sourceRoot":"","sources":["../../src/checks/tree.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAE3D,mGAAmG;AACnG,4DAA4D;AAC5D,2FAA2F;AAC3F,IAAI,QAA4B,CAAA;AAEhC,uEAAuE;AACvE,oGAAoG;AACpG,MAAM,mBAAmB,GAAW,EAAE,CAAA;AAEtC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC3D,iFAAiF;IACjF,gGAAgG;IAChG,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,OAAO,MAAM,CAAC,8BAA8B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAA;AACxF,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAc,EAAE;IACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,4BAA4B,EAAE;YAC1C,uDAAuD;SACxD,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,OAAO,GAAW,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5D,OAAO,OAAO,KAAK,QAAQ;QACzB,CAAC,CAAC,MAAM,CAAC,wDAAwD,CAAC;QAClE,CAAC,CAAC,MAAM,CAAC,8CAA8C,EAAE;YACrD,2FAA2F;YAC3F,kGAAkG;YAClG,YAAY,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,cAAc,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,EAAE;YACvG,0CAA0C;SAC3C,CAAC,CAAA;AACR,CAAC,CAAA"}

package/dist/checks/wiring.d.ts

@@ -1,5 +1,15 @@
 import { type Repository } from '../context.js';
 import { type GateResult } from '../exec.js';
+/**
+ * Every version ploaness decides for a project that declares the name: the analyzers read from the
+ * harness's own manifests, the framework pins from `pins.json`, and the runtime package at the release.
+ *
+ * Exported because the `deps` gate sorts its report by whose repair a finding is, and "a version the
+ * project declares but may not change" is precisely this map's key set. Read here rather than rebuilt
+ * there, so the report and the wiring gate cannot disagree about whose version a name is.
+ * @returns the pinned names, each mapped to the exact version the project must declare.
+ */
+export declare const harnessDecidedVersions: () => Readonly<Record<string, string>>;
 /** Verify the repository and each of its members have installed ploaness exactly as ploaness dictates. */
 export declare const wiring: (repository: Repository) => GateResult;
 //# sourceMappingURL=wiring.d.ts.map

package/dist/checks/wiring.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wiring.d.ts","sourceRoot":"","sources":["../../src/checks/wiring.ts"],"names":[],"mappings":"AAuBA,OAAO,EAEL,KAAK,UAAU,EAKhB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AA2O5D,0GAA0G;AAC1G,eAAO,MAAM,MAAM,GAAI,YAAY,UAAU,KAAG,UAyB/C,CAAA"}
+{"version":3,"file":"wiring.d.ts","sourceRoot":"","sources":["../../src/checks/wiring.ts"],"names":[],"mappings":"AAuBA,OAAO,EAEL,KAAK,UAAU,EAKhB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAgH5D;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBxE,CAAA;AA6GD,0GAA0G;AAC1G,eAAO,MAAM,MAAM,GAAI,YAAY,UAAU,KAAG,UAyB/C,CAAA"}

package/dist/checks/wiring.js

@@ -85,11 +85,23 @@ const declaredBy = (packageName) => {
 const requiredPackages = (kind) => new Set(pinGroups()
     .filter((group) => group.requiredFor.includes(kind))
     .flatMap((group) => Object.keys(group.versions)));
-const expectedTestLibraries = () => {
+/**
+ * Every version ploaness decides for a project that declares the name: the analyzers read from the
+ * harness's own manifests, the framework pins from `pins.json`, and the runtime package at the release.
+ *
+ * Exported because the `deps` gate sorts its report by whose repair a finding is, and "a version the
+ * project declares but may not change" is precisely this map's key set. Read here rather than rebuilt
+ * there, so the report and the wiring gate cannot disagree about whose version a name is.
+ * @returns the pinned names, each mapped to the exact version the project must declare.
+ */
+export const harnessDecidedVersions = () => {
     // Built from one flat list of entries rather than by folding an object into itself: a later source
     // still wins, because `fromEntries` keeps the last entry for a repeated key.
     const declared = Object.fromEntries(VERSION_SOURCES.flatMap((source) => Object.entries(declaredBy(source))));
-    const fromDependencies = asStringRecord(Object.fromEntries(TEST_LIBRARY_NAMES.map((name) => [name, declared[name]])));
+    const fromDependencies = asStringRecord(Object.fromEntries([...TEST_LIBRARY_NAMES, 'oxlint'].map((name) => [
+        name,
+        declared[name],
+    ])));
     return { ...fromDependencies, ...ownedVersions(), ...harnessRuntimeVersion() };
 };
 /**
@@ -148,7 +160,7 @@ const memberViolations = (member) => {
         declaredExclusions: member.settings.declaredExclusions,
         biomeConfig: readText(path.join(member.root, 'biome.json')),
         tsconfig: readText(path.join(member.root, 'tsconfig.json')),
-        expectedTestLibraries: expectedTestLibraries(),
+        expectedTestLibraries: harnessDecidedVersions(),
         requiredTestLibraries: requiredFor(kind),
         payloadVersion: ownedVersions()['payload'],
     });
@@ -181,7 +193,7 @@ export const wiring = (repository) => {
             packageJson: repository.packageJson,
             workspaceFile: repository.workspaceFile,
             declaredExclusions: repository.settings.declaredExclusions,
-            expectedTestLibraries: expectedTestLibraries(),
+            expectedTestLibraries: harnessDecidedVersions(),
             requiredPackageManager: asOptionalText(readPins()['packageManager']),
             requiredEngines: asStringRecord(readPins()['engines']),
             declaredAcrossMembers: declaredEverywhere(repository),