@ploaness/cli 1.1.0 → 1.3.0

package/dist/checks/infra.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra.js","sourceRoot":"","sources":["../../src/checks/infra.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,oGAAoG;AACpG,sGAAsG;AACtG,0FAA0F;AAC1F,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,sGAAsG;AACtG,qGAAqG;AACrG,qEAAqE;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,uBAAuB,EAGvB,sBAAsB,EACtB,WAAW,EACX,eAAe,EAEf,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EACL,UAAU,EACV,MAAM,EAEN,MAAM,EAEN,GAAG,EACH,UAAU,GACX,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAE9D,MAAM,aAAa,GAAW,gBAAgB,CAAC,OAAO,CAAA;AACtD,MAAM,UAAU,GAAW,yBAAyB,CAAA;AAEpD,6FAA6F;AAC7F,MAAM,gBAAgB,GAAW,CAAC,CAAA;AAWlC,uDAAuD;AACvD,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAE,KAAwB,EAAyB,EAAE,CACxF,KAAK,CAAC,GAAG,CACP,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC;IAC7B,IAAI;IACJ,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;CAC1D,CAAC,CACH,CAAA;AAEH,MAAM,iBAAiB,GAAG,CAAC,OAA8B,EAAqB,EAAE,CAC9E,OAAO,CAAC,OAAO,CAAC,CAAC,MAAkB,EAAqB,EAAE,CACxD,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CACtC,CAAC,SAA6B,EAAU,EAAE,CACxC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CACrF,CACF,CAAA;AAEH,MAAM,cAAc,GAAG,CAAC,OAA8B,EAA8B,EAAE,CACpF,OAAO,CAAC,OAAO,CAAC,CAAC,MAAkB,EAA8B,EAAE,CACjE,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CACrC,CAAC,WAAgC,EAAmB,EAAE,CAAC,CAAC;IACtD,GAAG,WAAW;IACd,IAAI,EAAE,MAAM,CAAC,IAAI;CAClB,CAAC,CACH,CACF,CAAA;AAEH,MAAM,MAAM,GAAG,CAAC,KAAwB,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAErE,MAAM,sBAAsB,GAAG,CAAC,IAAqB,EAAE,KAAsB,EAAW,EAAE,CACxF,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAA;AAE9D,0FAA0F;AAC1F,MAAM,iBAAiB,GAAG,CACxB,YAAwC,EACxC,SAA4B,EACA,EAAE,CAC9B,YAAY,CAAC,MAAM,CACjB,CAAC,WAA4B,EAAE,KAAa,EAAW,EAAE,CACvD,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC;IACxC,YAAY,CAAC,SAAS,CAAC,CAAC,KAAsB,EAAW,EAAE,CACzD,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAC3C,KAAK,KAAK,CACd,CAAA;AAEH,kGAAkG;AAClG,oGAAoG;AACpG,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG,CAC1B,QAAgC,EAChC,YAAwC,EACxC,QAA2B,EACf,EAAE,CACd,MAAM,CAAC,gDAAgD,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE;IACtF,GAAG,iBAAiB,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,GAAG,CAC3D,CAAC,WAA4B,EAAU,EAAE,CACvC,GAAG,WAAW,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,WAAW,CAAC,OAAO,QAAQ;QACvF,uCAAuC,WAAW,CAAC,QAAQ,WAAW,CACzE;IACD,8FAA8F;QAC5F,iDAAiD;IACnD,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,6CAA6C,EAAE,GAAG,QAAQ,CAAC,CAAC;CAC/F,CAAC,CAAA;AAEJ,kGAAkG;AAClG,MAAM,cAAc,GAAG,CAAC,QAAgC,EAAU,EAAE;IAClE,MAAM,OAAO,GAAsB;QACjC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YACnC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,mCAAmC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;KACjE,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,wCAAwC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG;QACrE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACxB,CAAC,CAAA;AAED,sGAAsG;AACtG,0DAA0D;AAC1D,MAAM,WAAW,GAAG,CAAC,OAA0B,EAAU,EAAE,CACzD,GAAG,OAAO;KACP,GAAG,CAAC,CAAC,QAAgB,EAAU,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;KACxF,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAA;AAErC,MAAM,cAAc,GAAG,CAAC,QAA2B,EAAE,OAAe,EAAc,EAAE,CAClF,QAAQ,CAAC,MAAM,KAAK,CAAC;IACnB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IACjB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAA2B,EAAE,QAAQ,CAAC,CAAA;AAE7E,oGAAoG;AACpG,gGAAgG;AAChG,MAAM,YAAY,GAAG,CAAC,MAAiB,EAA0B,EAAE,CACjE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;IACnD,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,MAAM,CAAC,GAAG,UAAU,sCAAsC,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;AAE5F,mGAAmG;AACnG,gGAAgG;AAChG,mEAAmE;AACnE,MAAM,mBAAmB,GAAG,CAAC,WAAuB,EAAE,QAA2B,EAAc,EAAE,CAC/F,QAAQ,CAAC,MAAM,KAAK,CAAC;IACnB,CAAC,CAAC,WAAW;IACb,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;QAC1B,GAAG,WAAW,CAAC,QAAQ;QACvB,sEAAsE;QACtE,GAAG,QAAQ;KACZ,CAAC,CAAA;AAER,qGAAqG;AACrG,uGAAuG;AACvG,mGAAmG;AACnG,2EAA2E;AAC3E,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,yFAAyF;AACzF,EAAE;AACF,sGAAsG;AACtG,iGAAiG;AACjG,qGAAqG;AACrG,gBAAgB;AAChB,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAa,EAAE,CACjD,GAAG,CACD,QAAQ,EACR;IACE,KAAK;IACL,MAAM;IACN,IAAI;IACJ,GAAG,OAAO,CAAC,IAAI,WAAW;IAC1B,WAAW;IACX,GAAG;IACH,aAAa;IACb,aAAa;IACb,OAAO;IACP,aAAa;IACb,WAAW;IACX,SAAS;IACT,gBAAgB,EAAE;IAClB,iBAAiB;IACjB,WAAW;IACX,SAAS;IACT,UAAU;IACV,KAAK;CACN,EACD,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CACtB,CAAA;AAEH,MAAM,OAAO,GAAG,CACd,OAAgB,EAChB,QAA2B,EAC3B,WAAmB,EACP,EAAE;IACd,MAAM,WAAW,GAA2B,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAA;IAC5F,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,mBAAmB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IACnD,CAAC;IACD,MAAM,MAAM,GAAc,UAAU,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,OAAO,GACX,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAA;IACjF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,OAAO,UAAU,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;AAClF,CAAC,CAAA;AAED,qGAAqG;AACrG,kGAAkG;AAClG,oFAAoF;AACpF,MAAM,eAAe,GAAG,CACtB,MAAiB,EACjB,QAA2B,EAC3B,WAAmB,EACP,EAAE;IACd,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACrC,OAAO,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAuB,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACpE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,GAAG,UAAU,wCAAwC,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,2BAA2B,EAAE;QAC9E,GAAG,QAAQ;QACX,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KAC7B,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,mGAAmG;AACnG,qGAAqG;AACrG,qEAAqE;AACrE,MAAM,KAAK,GAAG,CACZ,OAAgB,EAChB,OAA8B,EAC9B,YAAwC,EACxC,QAAgC,EACpB,EAAE;IACd,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC9D,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,mBAAmB,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,KAAK,GAAW,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAA;IACxE,MAAM,SAAS,GAAW,eAAe,CAAC,YAAY,CAAC,CAAA;IACvD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,cAAc,CACnB,QAAQ,EACR,GAAG,KAAK,qEAAqE,CAC9E,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,cAAc,CAAC,QAAQ,EAAE,GAAG,KAAK,4BAA4B,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,OAAO,CACZ,OAAO,EACP,QAAQ,EACR,GAAG,KAAK,cAAc,MAAM,CAAC,SAAS,CAAC,oBAAoB;QACzD,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,wBAAwB,CAC3D,CAAA;AACH,CAAC,CAAA;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC7D,MAAM,OAAO,GAAsB,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACjE,MAAM,KAAK,GAAsB,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC1D,yFAAyF;IACzF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,gDAAgD,CAAC,CAAA;IACjE,CAAC;IACD,qGAAqG;IACrG,iEAAiE;IACjE,MAAM,SAAS,GAAsB,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC9D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,sEAAsE,EAAE;YACpF,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,GAAG,IAAI,yCAAyC,CAAC;YAC5F,sEAAsE;SACvE,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,OAAO,GAA0B,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAClE,MAAM,YAAY,GAA+B,cAAc,CAAC,OAAO,CAAC,CAAA;IACxE,OAAO,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;AAC5F,CAAC,CAAA"}

package/dist/checks/install.d.ts

@@ -2,4 +2,6 @@ import type { Repository as Repo } from '../context.js';
 import { type GateResult } from '../exec.js';
 /** The repository must name the dependencies permitted to run an install script. */
 export declare const installScripts: (repo: Repo) => GateResult;
+/** The repository must keep pnpm's release-age floor strict, and may exempt only the harness from it. */
+export declare const releaseAge: (repo: Repo) => GateResult;
 //# sourceMappingURL=install.d.ts.map

package/dist/checks/install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/checks/install.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,IAAI,IAAI,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAQ5D,oFAAoF;AACpF,eAAO,MAAM,cAAc,GAAI,MAAM,IAAI,KAAG,UAMpC,CAAA"}
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/checks/install.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,IAAI,IAAI,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAQ5D,oFAAoF;AACpF,eAAO,MAAM,cAAc,GAAI,MAAM,IAAI,KAAG,UAMpC,CAAA;AAIR,yGAAyG;AACzG,eAAO,MAAM,UAAU,GAAI,MAAM,IAAI,KAAG,UAQvC,CAAA"}

package/dist/checks/install.js

@@ -4,7 +4,7 @@
 // `pnpm install` - the broadest surface a project has for executing code it never called. The gate
 // requires the allowlist to exist and says nothing about what is on it: which packages a project trusts
 // with an install script is a decision for the project to record, not one the harness can make for it.
-import { declaresInstallScriptAllowlist } from '@ploaness/governance';
+import { declaresInstallScriptAllowlist, findReleaseAgeViolations } from '@ploaness/governance';
 import { failed, passed } from '../exec.js';
 const WORKSPACE_FILE = 'pnpm-workspace.yaml';
 // The workspace file arrives already read, from the repository root. It used to be read relative to
@@ -18,4 +18,13 @@ export const installScripts = (repo) => declaresInstallScriptAllowlist(repo.work
         `declare onlyBuiltDependencies in ${WORKSPACE_FILE}, or under the "pnpm" key of package.json`,
         'an empty list is a valid answer: it permits no dependency to run an install script',
     ]);
+// The same file, read the same way, for the other half of install policy: what pnpm may install at all.
+// The decisions are in `install-policy.ts`; this hands over the file and names the gate.
+/** The repository must keep pnpm's release-age floor strict, and may exempt only the harness from it. */
+export const releaseAge = (repo) => {
+    const findings = findReleaseAgeViolations(repo.workspaceFile);
+    return findings.length > 0
+        ? failed(`${String(findings.length)} release-age setting(s) weaken the floor pnpm enforces`, findings)
+        : passed('the release-age floor is strict, and only the harness is excluded from it');
+};
 //# sourceMappingURL=install.js.map

package/dist/checks/install.js.map

@@ -1 +1 @@
-{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/checks/install.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,wGAAwG;AACxG,uGAAuG;AACvG,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AAErE,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,cAAc,GAAW,qBAAqB,CAAA;AAEpD,oGAAoG;AACpG,uGAAuG;AACvG,kGAAkG;AAClG,uDAAuD;AACvD,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAU,EAAc,EAAE,CACvD,8BAA8B,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC;IAClE,CAAC,CAAC,MAAM,CAAC,kEAAkE,CAAC;IAC5E,CAAC,CAAC,MAAM,CAAC,yCAAyC,EAAE;QAChD,oCAAoC,cAAc,2CAA2C;QAC7F,oFAAoF;KACrF,CAAC,CAAA"}
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/checks/install.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,wGAAwG;AACxG,uGAAuG;AACvG,OAAO,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAE/F,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,cAAc,GAAW,qBAAqB,CAAA;AAEpD,oGAAoG;AACpG,uGAAuG;AACvG,kGAAkG;AAClG,uDAAuD;AACvD,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAU,EAAc,EAAE,CACvD,8BAA8B,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC;IAClE,CAAC,CAAC,MAAM,CAAC,kEAAkE,CAAC;IAC5E,CAAC,CAAC,MAAM,CAAC,yCAAyC,EAAE;QAChD,oCAAoC,cAAc,2CAA2C;QAC7F,oFAAoF;KACrF,CAAC,CAAA;AAER,wGAAwG;AACxG,yFAAyF;AACzF,yGAAyG;AACzG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAU,EAAc,EAAE;IACnD,MAAM,QAAQ,GAAsB,wBAAwB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAChF,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CACJ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,wDAAwD,EAClF,QAAQ,CACT;QACH,CAAC,CAAC,MAAM,CAAC,2EAA2E,CAAC,CAAA;AACzF,CAAC,CAAA"}

package/dist/checks/oxlint.d.ts

@@ -0,0 +1,5 @@
+import { type Member } from '../context.js';
+import { type GateResult } from '../exec.js';
+/** Native core checks for every member, with accessibility only in the existing application scope. */
+export declare const oxlint: (member: Member) => GateResult;
+//# sourceMappingURL=oxlint.d.ts.map

package/dist/checks/oxlint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxlint.d.ts","sourceRoot":"","sources":["../../src/checks/oxlint.ts"],"names":[],"mappings":"AAmBA,OAAO,EAGL,KAAK,MAAM,EAKZ,MAAM,eAAe,CAAA;AACtB,OAAO,EAAU,KAAK,UAAU,EAA+C,MAAM,YAAY,CAAA;AAsGjG,sGAAsG;AACtG,eAAO,MAAM,MAAM,GAAI,QAAQ,MAAM,KAAG,UAmBvC,CAAA"}

package/dist/checks/oxlint.js

@@ -0,0 +1,85 @@
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { asRecord, asText, isEslintOwnedSuppression, isOxlintConfig, oxlintArguments, oxlintConfig, oxlintGroups, oxlintReportProblems, oxlintRuleNames, oxlintSourceFiles, oxlintSuppressionProblems, } from '@ploaness/governance';
+import { cliDirectory, hasOwnRuntime, readJson, resolveTool, shippedDirectory, workingTreeFiles, } from '../context.js';
+import { failed, passed, runNode, withOutput } from '../exec.js';
+import { sourceComments } from '../source-comments.js';
+const JSON_INDENT = 2;
+const manifestIn = (directory) => asRecord(readJson(path.join(directory, 'package.json')));
+const versionProblems = () => {
+    const cli = manifestIn(cliDirectory());
+    const expected = asText(asRecord(cli['dependencies'])['oxlint']);
+    const manifest = manifestIn(shippedDirectory('oxlint'));
+    return expected.length > 0 && manifest['version'] === expected
+        ? []
+        : [`Oxlint must resolve to the harness-owned version ${expected}`];
+};
+const eligibleFiles = (member, inventory) => oxlintSourceFiles(inventory, member.settings.generatedArtefacts, member.siblingPaths).filter((file) => {
+    const absolute = path.join(member.root, file);
+    return existsSync(absolute) && statSync(absolute).isFile();
+});
+const suppressionProblems = (member, group) => group.files.flatMap((file) => {
+    const text = readFileSync(path.join(member.root, file), 'utf8');
+    const problems = oxlintSuppressionProblems(sourceComments(text, file), oxlintRuleNames(group.rules));
+    return problems.map((problem) => `${file}: ${problem}`);
+});
+const legacySitesIn = (member, files) => files.flatMap((file) => {
+    const text = readFileSync(path.join(member.root, file), 'utf8');
+    return sourceComments(text, file)
+        .filter(isEslintOwnedSuppression)
+        .map((comment) => ({ file, line: comment.line }));
+});
+const nativeVerdict = (result, group, legacy) => {
+    const findings = oxlintReportProblems(result.stdout, group.files.length, group.rules.length, { exitCode: result.code, output: result.output, legacy });
+    return withOutput(findings.length === 0
+        ? passed(`${String(group.files.length)} source file(s) pass ${String(group.rules.length)} native rules`)
+        : failed('Oxlint did not establish conformance', [
+            ...findings,
+            ...(result.code === 0 ? [] : [result.output]),
+        ]), result.output);
+};
+const analyze = (member, group) => {
+    const directory = mkdtempSync(path.join(tmpdir(), 'ploaness-oxlint-'));
+    try {
+        const config = path.join(directory, 'oxlint.json');
+        writeFileSync(config, `${JSON.stringify(oxlintConfig(group.rules), null, JSON_INDENT)}\n`);
+        const legacy = legacySitesIn(member, group.files);
+        return nativeVerdict(runNode(resolveTool('oxlint'), [...oxlintArguments(config, group.files)], {
+            cwd: member.root,
+        }), group, legacy);
+    }
+    finally {
+        rmSync(directory, { recursive: true, force: true });
+    }
+};
+/** Run disjoint groups sequentially, preserving each invocation's measured coverage. */
+const analyzeGroups = (member, groups) => {
+    const [first, ...rest] = groups;
+    if (first === undefined) {
+        return passed('no eligible source remains to analyze');
+    }
+    const result = analyze(member, first);
+    if (!result.ok || rest.length === 0) {
+        return result;
+    }
+    const remaining = analyzeGroups(member, rest);
+    return withOutput({ ...remaining, summary: `${result.summary}; ${remaining.summary}` }, [result.output, remaining.output].filter(Boolean).join('\n'));
+};
+/** Native core checks for every member, with accessibility only in the existing application scope. */
+export const oxlint = (member) => {
+    const inventory = workingTreeFiles(member.root);
+    const groups = oxlintGroups(eligibleFiles(member, inventory), hasOwnRuntime(member));
+    const problems = [
+        ...versionProblems(),
+        ...inventory
+            .filter(isOxlintConfig)
+            .map((file) => `${file}: Oxlint configuration is owned by ploaness`),
+        ...groups.flatMap((group) => suppressionProblems(member, group)),
+    ];
+    if (problems.length > 0) {
+        return failed('Oxlint wiring or suppression policy is violated', problems);
+    }
+    return analyzeGroups(member, groups);
+};
+//# sourceMappingURL=oxlint.js.map

package/dist/checks/oxlint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxlint.js","sourceRoot":"","sources":["../../src/checks/oxlint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAChG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,QAAQ,EACR,MAAM,EACN,wBAAwB,EACxB,cAAc,EAGd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,yBAAyB,GAE1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,YAAY,EACZ,aAAa,EAEb,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAkB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,MAAM,WAAW,GAAW,CAAC,CAAA;AAE7B,MAAM,UAAU,GAAG,CAAC,SAAiB,EAA2B,EAAE,CAChE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAA;AAE1D,MAAM,eAAe,GAAG,GAAsB,EAAE;IAC9C,MAAM,GAAG,GAA4B,UAAU,CAAC,YAAY,EAAE,CAAC,CAAA;IAC/D,MAAM,QAAQ,GAAW,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxE,MAAM,QAAQ,GAA4B,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAA;IAChF,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,QAAQ;QAC5D,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,oDAAoD,QAAQ,EAAE,CAAC,CAAA;AACtE,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,SAA4B,EAAqB,EAAE,CACxF,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAC1F,CAAC,IAAY,EAAW,EAAE;IACxB,MAAM,QAAQ,GAAW,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACrD,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAA;AAC5D,CAAC,CACF,CAAA;AAEH,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,KAAkB,EAAqB,EAAE,CACpF,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE;IACtD,MAAM,IAAI,GAAW,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAsB,yBAAyB,CAC3D,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,EAC1B,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAC7B,CAAA;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAA;AACzE,CAAC,CAAC,CAAA;AAEJ,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,KAAwB,EAA+B,EAAE,CAC9F,KAAK,CAAC,OAAO,CAAC,CAAC,IAAY,EAA+B,EAAE;IAC1D,MAAM,IAAI,GAAW,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IACvE,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC;SAC9B,MAAM,CAAC,wBAAwB,CAAC;SAChC,GAAG,CAAC,CAAC,OAAsB,EAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AACtF,CAAC,CAAC,CAAA;AAEJ,MAAM,aAAa,GAAG,CACpB,MAAiB,EACjB,KAAkB,EAClB,MAAmC,EACvB,EAAE;IACd,MAAM,QAAQ,GAAsB,oBAAoB,CACtD,MAAM,CAAC,MAAM,EACb,KAAK,CAAC,KAAK,CAAC,MAAM,EAClB,KAAK,CAAC,KAAK,CAAC,MAAM,EAClB,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CACzD,CAAA;IACD,OAAO,UAAU,CACf,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,MAAM,CACJ,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,wBAAwB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAC/F;QACH,CAAC,CAAC,MAAM,CAAC,sCAAsC,EAAE;YAC7C,GAAG,QAAQ;YACX,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SAC9C,CAAC,EACN,MAAM,CAAC,MAAM,CACd,CAAA;AACH,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,KAAkB,EAAc,EAAE;IACjE,MAAM,SAAS,GAAW,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAC9E,IAAI,CAAC;QACH,MAAM,MAAM,GAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QAC1D,aAAa,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAA;QAC1F,MAAM,MAAM,GAAgC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QAC9E,OAAO,aAAa,CAClB,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE;YACxE,GAAG,EAAE,MAAM,CAAC,IAAI;SACjB,CAAC,EACF,KAAK,EACL,MAAM,CACP,CAAA;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,CAAC;AACH,CAAC,CAAA;AAED,wFAAwF;AACxF,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,MAA8B,EAAc,EAAE;IACnF,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAA2B,MAAM,CAAA;IACvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,uCAAuC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,MAAM,GAAe,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,SAAS,GAAe,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACzD,OAAO,UAAU,CACf,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,EAAE,EAAE,EACpE,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7D,CAAA;AACH,CAAC,CAAA;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAc,EAAE;IACnD,MAAM,SAAS,GAAsB,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClE,MAAM,MAAM,GAA2B,YAAY,CACjD,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,EAChC,aAAa,CAAC,MAAM,CAAC,CACtB,CAAA;IACD,MAAM,QAAQ,GAAsB;QAClC,GAAG,eAAe,EAAE;QACpB,GAAG,SAAS;aACT,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,GAAG,IAAI,6CAA6C,CAAC;QACtF,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAkB,EAAqB,EAAE,CAC1D,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CACnC;KACF,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,iDAAiD,EAAE,QAAQ,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AACtC,CAAC,CAAA"}

package/dist/checks/payload.d.ts

@@ -2,6 +2,17 @@ import { type Context, type Member } from '../context.js';
 import { type GateResult } from '../exec.js';
 /** Regenerate the Payload types and admin import map, then fail on any drift. */
 export declare const payloadGenerated: (context: Context) => GateResult;
+/**
+ * Every collection and global in the BUILT configuration decides its access.
+ *
+ * The static rule reads the access blocks a project wrote; this one imports the configuration Payload
+ * actually boots, so the collections the framework builds for the project - the folder tree, the job
+ * queue, a plugin's own - are judged too. Each of those arrives with Payload's default, which admits
+ * every signed-in user, and the anonymous sweep cannot see that because a signed-in user is not
+ * anonymous. The harness's own tsx loads the configuration against the project's tsconfig, with the
+ * project root as the working directory so `payload` resolves from the project.
+ */
+export declare const payloadDefaults: (context: Member) => GateResult;
 /** Apply the source rules to every TypeScript file under the declared source roots. */
 export declare const payloadRules: (context: Member) => GateResult;
 /**

package/dist/checks/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../src/checks/payload.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,MAAM,EAIZ,MAAM,eAAe,CAAA;AACtB,OAAO,EAAsB,KAAK,UAAU,EAAmC,MAAM,YAAY,CAAA;AA2BjG,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,KAAG,UAgDnD,CAAA;AAsCD,uFAAuF;AACvF,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,KAAG,UAmB9C,CAAA;AAOD;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,KAAG,UAmC5C,CAAA"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../src/checks/payload.ts"],"names":[],"mappings":"AA+BA,OAAO,EACL,KAAK,OAAO,EAGZ,KAAK,MAAM,EAOZ,MAAM,eAAe,CAAA;AACtB,OAAO,EAGL,KAAK,UAAU,EAKhB,MAAM,YAAY,CAAA;AA2BnB,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,KAAG,UAgDnD,CAAA;AAuDD;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,KAAG,UA6CjD,CAAA;AAuED,uFAAuF;AACvF,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,KAAG,UAoB9C,CAAA;AAOD;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,KAAG,UAmC5C,CAAA"}

package/dist/checks/payload.js

@@ -1,10 +1,10 @@
 // The Payload-specific gates: the generated artefacts must match the configuration that produces them,
 // and the Local API must be used in a way that neither over-fetches nor skips access control.
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import path from 'node:path';
-import { findDeclaredAdminViews, findGeneratedDrift, findPayloadViolations, findSourceViolations, findUnguardedRelationships, findUnscannedAdminViews, } from '@ploaness/governance';
-import { git, resolveProjectTool, runEnvironment, workingTreeFiles, } from '../context.js';
-import { asFindings, failed, passed, runNode } from '../exec.js';
+import { declaredMigrationDirectoryIn, declaresPushingAdapter, findBootstrapWrites, findDeclaredAdminViews, findEndpointViolations, findGeneratedDrift, findInheritedAccess, findMissingMigrations, findPayloadViolations, findSourceViolations, findUnconstrainedDraftReads, findUnguardedRelationships, findUnscannedAdminViews, migrationDirectoriesFor, parseInheritedAccessReport, payloadConfigPathOf, stripComments, } from '@ploaness/governance';
+import { cliDirectory, git, manifestPathFrom, readJson, resolveProjectTool, resolveTool, runEnvironment, workingTreeFiles, } from '../context.js';
+import { asFindings, failed, passed, runNode, withOutput, } from '../exec.js';
 // Resolution failure is an answer rather than an exception the caller must catch.
 const resolveProjectToolOrUndefined = (context, tool) => {
     try {
@@ -75,14 +75,111 @@ export const payloadGenerated = (context) => {
         ])
         : passed('the generated Payload artefacts match the configuration');
 };
+// Where Payload keeps the function it fills an undeclared operation with. Named by path because the
+// package's exports map does not expose it; ploaness pins `payload` exactly, so a layout change arrives
+// with a ploaness release rather than silently, and an absent file fails closed below.
+const DEFAULT_ACCESS_MODULE = ['dist', 'auth', 'defaultAccess.js'];
+const PROBE_FILE = ['dist', 'probes', 'payload-defaults.probe.js'];
+// Building a configuration opens no socket, but a plugin might, and a hung import must end as a verdict.
+const PROBE_TIMEOUT_MS = 120_000;
+const defaultAccessFileOf = (context) => {
+    const manifest = manifestPathFrom('payload', path.join(context.root, 'package.json'));
+    return manifest === undefined
+        ? undefined
+        : path.join(path.dirname(manifest), ...DEFAULT_ACCESS_MODULE);
+};
+// The two defects the report can carry, named separately so the summary says which one was found
+// rather than counting them together under whichever wording came first.
+const summariseAccessFindings = (inherited, draftReads) => {
+    const parts = [
+        ...(inherited > 0
+            ? [`${String(inherited)} collection(s) or global(s) inherit Payload's default access`]
+            : []),
+        ...(draftReads > 0
+            ? [`${String(draftReads)} drafts read(s) serve an unapproved document to a stranger`]
+            : []),
+    ];
+    return parts.join('; ');
+};
+// The probe's outcome, once it ran: a report that was not printed, or not readable, is a failure of its
+// own rather than an empty finding list, because nothing else stands between a crashed probe and a pass.
+const judgeProbe = (result) => {
+    if (result.code !== 0) {
+        return failed('the Payload configuration could not be built', asFindings(result.output));
+    }
+    const report = parseInheritedAccessReport(result.stdout);
+    if (report === undefined) {
+        return failed('the access probe printed no readable report', asFindings(result.output));
+    }
+    const inherited = findInheritedAccess(report);
+    const draftReads = findUnconstrainedDraftReads(report);
+    const findings = [...inherited, ...draftReads];
+    return findings.length > 0
+        ? failed(summariseAccessFindings(inherited.length, draftReads.length), findings)
+        : passed('every collection and global decides its access, framework-built ones included, and no ' +
+            'drafts read serves an unapproved document to a stranger');
+};
+/**
+ * Every collection and global in the BUILT configuration decides its access.
+ *
+ * The static rule reads the access blocks a project wrote; this one imports the configuration Payload
+ * actually boots, so the collections the framework builds for the project - the folder tree, the job
+ * queue, a plugin's own - are judged too. Each of those arrives with Payload's default, which admits
+ * every signed-in user, and the anonymous sweep cannot see that because a signed-in user is not
+ * anonymous. The harness's own tsx loads the configuration against the project's tsconfig, with the
+ * project root as the working directory so `payload` resolves from the project.
+ */
+export const payloadDefaults = (context) => {
+    const tsconfig = path.join(context.root, 'tsconfig.json');
+    const configPath = payloadConfigPathOf(readJson(tsconfig));
+    const configFile = path.join(context.root, configPath);
+    if (!existsSync(configFile)) {
+        return failed('the Payload configuration could not be found', [
+            `${configPath} does not exist; a Payload member names its configuration under ` +
+                'compilerOptions.paths["@payload-config"] in tsconfig.json, which `ploaness init` writes',
+        ]);
+    }
+    const defaultAccessFile = defaultAccessFileOf(context);
+    if (defaultAccessFile === undefined) {
+        return failed('payload could not be resolved from the project', [
+            'ploaness governs Payload projects, so "payload" must be installed in the project itself',
+        ]);
+    }
+    if (!existsSync(defaultAccessFile)) {
+        return failed("Payload's default access could not be located", [
+            `${defaultAccessFile} is missing; ploaness knows the layout of the Payload version it pins, ` +
+                'and this installation differs',
+        ]);
+    }
+    const result = runNode(resolveTool('tsx'), [
+        '--tsconfig',
+        tsconfig,
+        path.join(cliDirectory(), ...PROBE_FILE),
+        configFile,
+        defaultAccessFile,
+    ], {
+        cwd: context.root,
+        // The placeholders every analyzer that imports the project receives, then the project's own
+        // environment, then the one option ploaness owns: the same layering the knip and generated gates
+        // use, so a configuration that validates `process.env` on import survives here as it does there.
+        env: {
+            ...context.settings.analysisEnv,
+            ...runEnvironment(context),
+            NODE_OPTIONS: '--no-deprecation',
+        },
+        timeoutMs: PROBE_TIMEOUT_MS,
+    });
+    return withOutput(judgeProbe(result), result.output);
+};
 const SOURCE_EXTENSIONS = ['.ts', '.tsx'];
 // The language rules apply to every package; the Payload ones only to a package that has Payload to
 // misuse. Held together, the import rule ran only where Payload did - so a frontend beside the CMS, the
 // place a parent-relative import is MOST likely because it has no Payload config to anchor on, was the
 // one package never checked for it.
-const violationsIn = (source, isPayload) => [
-    ...findSourceViolations(source),
-    ...(isPayload ? findPayloadViolations(source) : []),
+const violationsIn = (file, isPayload) => [
+    ...findSourceViolations(file.source),
+    ...(isPayload ? findPayloadViolations(file.source) : []),
+    ...(isPayload ? findEndpointViolations(file.path, file.source) : []),
 ];
 const sourceCandidates = (context) => {
     const roots = context.settings.sourceRoots;
@@ -97,8 +194,31 @@ const reported = (file, violation) => `${file}:${String(violation.line)} [${viol
 // set rather than one text, and it reports the file that declares the relationship rather than the file
 // it happens to be judged from.
 const crossFileFindings = (context, files) => context.isPayload
-    ? findUnguardedRelationships(files).map((located) => reported(located.path, located.violation))
+    ? [...findUnguardedRelationships(files), ...findBootstrapWrites(files)].map((located) => reported(located.path, located.violation))
     : [];
+// Only the files that declare a configuration are read for one, so a member's whole source is not
+// stripped twice to answer a question about its database.
+const configSources = (files) => files
+    .filter((file) => file.source.includes('buildConfig('))
+    .map((file) => stripComments(file.source));
+// The filesystem half of the migration rule. WHICH directories to read is decided by governance, from
+// the configuration; what they hold is the only thing this reads, and what it means is decided there
+// too - so a schema recorded under a directory the project named is found the same way as a default one.
+const migrationEvidenceOf = (context, files) => {
+    const configs = configSources(files);
+    const declaresPush = configs.some((code) => declaresPushingAdapter(code));
+    const declared = configs
+        .map((code) => declaredMigrationDirectoryIn(code))
+        .find((found) => found !== undefined);
+    return {
+        declaresPushingAdapter: declaresPush,
+        directories: migrationDirectoriesFor(declared).flatMap((relative) => {
+            const directory = path.join(context.root, relative);
+            return existsSync(directory) ? [{ path: relative, names: readdirSync(directory) }] : [];
+        }),
+    };
+};
+const migrationFindings = (context, files) => context.isPayload ? findMissingMigrations(migrationEvidenceOf(context, files)) : [];
 /** Apply the source rules to every TypeScript file under the declared source roots. */
 export const payloadRules = (context) => {
     const candidates = sourceCandidates(context);
@@ -107,8 +227,9 @@ export const payloadRules = (context) => {
         source: readFileSync(path.join(context.root, file), 'utf8'),
     }));
     const findings = [
-        ...files.flatMap((file) => violationsIn(file.source, context.isPayload).map((violation) => reported(file.path, violation))),
+        ...files.flatMap((file) => violationsIn(file, context.isPayload).map((violation) => reported(file.path, violation))),
         ...crossFileFindings(context, files),
+        ...migrationFindings(context, files),
     ];
     return findings.length > 0
         ? failed(`${String(findings.length)} source usage violation(s)`, findings)

package/dist/checks/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../src/checks/payload.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,8FAA8F;AAC9F,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAEL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,GAKxB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,GAAG,EAEH,kBAAkB,EAClB,cAAc,EACd,gBAAgB,GACjB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,EAAmB,MAAM,EAAkB,OAAO,EAAE,MAAM,YAAY,CAAA;AAEjG,kFAAkF;AAClF,MAAM,6BAA6B,GAAG,CAAC,OAAgB,EAAE,IAAY,EAAsB,EAAE;IAC3F,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,MAAc,EAAsB,EAAE;IACzE,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC5C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAClE,CAAC,CAAA;AAED,uGAAuG;AACvG,wGAAwG;AACxG,8BAA8B;AAC9B,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAE,MAAc,EAAW,EAAE;IAC9D,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC/D,MAAM,UAAU,GAAuB,6BAA6B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACxF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,wDAAwD,EAAE;YACtE,yFAAyF;SAC1F,CAAC,CAAA;IACJ,CAAC;IACD,oGAAoG;IACpG,qGAAqG;IACrG,qGAAqG;IACrG,sGAAsG;IACtG,kGAAkG;IAClG,mCAAmC;IACnC,MAAM,OAAO,GAAsB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAA;IACtE,+FAA+F;IAC/F,wBAAwB;IACxB,MAAM,MAAM,GAA4C,IAAI,GAAG,CAC7D,OAAO,CAAC,GAAG,CAAC,CAAC,MAAc,EAAyC,EAAE,CAAC;QACrE,MAAM;QACN,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KACpC,CAAC,CACH,CAAA;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAc,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE;YACtD,GAAG,EAAE,OAAO,CAAC,IAAI;YACjB,8FAA8F;YAC9F,6FAA6F;YAC7F,GAAG,EAAE,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE;SACtE,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,WAAW,MAAM,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAmC,OAAO,CAAC,GAAG,CAC7D,CAAC,MAAc,EAAuB,EAAE,CAAC,CAAC;QACxC,MAAM;QACN,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC;QACrC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KAC3C,CAAC,CACH,CAAA;IACD,MAAM,OAAO,GAAsB,kBAAkB,CAAC,WAAW,CAAC,CAAA;IAClE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,MAAM,CAAC,4DAA4D,EAAE;YACnE,GAAG,OAAO;YACV,8BAA8B;SAC/B,CAAC;QACJ,CAAC,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAA;AACvE,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAE5D,oGAAoG;AACpG,wGAAwG;AACxG,uGAAuG;AACvG,oCAAoC;AACpC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,SAAkB,EAA+B,EAAE,CAAC;IACxF,GAAG,oBAAoB,CAAC,MAAM,CAAC;IAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CACpD,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAqB,EAAE;IAC9D,MAAM,KAAK,GAAsB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAA;IAC7D,OAAO,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAC1C,CAAC,IAAY,EAAW,EAAE,CACxB,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QAClE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAC5C,CAAA;AACH,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,SAA2B,EAAU,EAAE,CACrE,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAA;AAE7E,uGAAuG;AACvG,uGAAuG;AACvG,wGAAwG;AACxG,gCAAgC;AAChC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,KAA4B,EAAqB,EAAE,CAC7F,OAAO,CAAC,SAAS;IACf,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,OAAyB,EAAU,EAAE,CAC1E,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAC1C;IACH,CAAC,CAAC,EAAE,CAAA;AAER,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAc,EAAE;IAC1D,MAAM,UAAU,GAAsB,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC/D,MAAM,KAAK,GAA0B,UAAU,CAAC,GAAG,CACjD,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;KAC5D,CAAC,CACH,CAAA;IACD,MAAM,QAAQ,GAAsB;QAClC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAgB,EAAqB,EAAE,CACvD,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,SAA2B,EAAU,EAAE,CACvF,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAC/B,CACF;QACD,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC;KACrC,CAAA;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,4BAA4B,EAAE,QAAQ,CAAC;QAC1E,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAA;AAClF,CAAC,CAAA;AAED,iGAAiG;AACjG,uGAAuG;AACvG,0FAA0F;AAC1F,MAAM,SAAS,GAAW,QAAQ,CAAA;AAElC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAe,EAAc,EAAE;IACxD,MAAM,KAAK,GAA0B,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAChE,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;KAC5D,CAAC,CACH,CAAA;IACD,MAAM,KAAK,GAA0B,KAAK,CAAC,MAAM,CAAC,CAAC,IAAgB,EAAW,EAAE,CAC9E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAChC,CAAA;IACD,kGAAkG;IAClG,2DAA2D;IAC3D,MAAM,QAAQ,GAAqE,KAAK;SACrF,MAAM,CAAC,CAAC,IAAgB,EAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SACvE,GAAG,CAAC,CAAC,IAAgB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAU,CAAC,CAAA;IAClF,MAAM,QAAQ,GAAsB,QAAQ,CAAC,OAAO,CAClD,CAAC,CAAC,IAAI,EAAE,KAAK,CAAsD,EAAqB,EAAE,CACxF,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,CAC9C,CAAC,SAA2B,EAAU,EAAE,CACtC,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CACnF,CACJ,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,uCAAuC,EAAE,QAAQ,CAAC,CAAA;IAC5F,CAAC;IACD,MAAM,KAAK,GAAW,QAAQ,CAAC,MAAM,CACnC,CAAC,KAAa,EAAE,CAAC,EAAE,KAAK,CAAsD,EAAU,EAAE,CACxF,KAAK,GAAG,KAAK,CAAC,MAAM,EACtB,CAAC,CACF,CAAA;IACD,OAAO,MAAM,CACX,KAAK,KAAK,CAAC;QACT,CAAC,CAAC,4CAA4C;QAC9C,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAC1E,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../src/checks/payload.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,8FAA8F;AAC9F,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC/D,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAEL,4BAA4B,EAC5B,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EAKvB,uBAAuB,EAEvB,0BAA0B,EAC1B,mBAAmB,EAGnB,aAAa,GACd,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,YAAY,EACZ,GAAG,EAEH,gBAAgB,EAChB,QAAQ,EACR,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,UAAU,EACV,MAAM,EAEN,MAAM,EAEN,OAAO,EACP,UAAU,GACX,MAAM,YAAY,CAAA;AAEnB,kFAAkF;AAClF,MAAM,6BAA6B,GAAG,CAAC,OAAgB,EAAE,IAAY,EAAsB,EAAE;IAC3F,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,MAAc,EAAsB,EAAE;IACzE,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC5C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAClE,CAAC,CAAA;AAED,uGAAuG;AACvG,wGAAwG;AACxG,8BAA8B;AAC9B,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAE,MAAc,EAAW,EAAE;IAC9D,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC/D,MAAM,UAAU,GAAuB,6BAA6B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACxF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,wDAAwD,EAAE;YACtE,yFAAyF;SAC1F,CAAC,CAAA;IACJ,CAAC;IACD,oGAAoG;IACpG,qGAAqG;IACrG,qGAAqG;IACrG,sGAAsG;IACtG,kGAAkG;IAClG,mCAAmC;IACnC,MAAM,OAAO,GAAsB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAA;IACtE,+FAA+F;IAC/F,wBAAwB;IACxB,MAAM,MAAM,GAA4C,IAAI,GAAG,CAC7D,OAAO,CAAC,GAAG,CAAC,CAAC,MAAc,EAAyC,EAAE,CAAC;QACrE,MAAM;QACN,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KACpC,CAAC,CACH,CAAA;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAc,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE;YACtD,GAAG,EAAE,OAAO,CAAC,IAAI;YACjB,8FAA8F;YAC9F,6FAA6F;YAC7F,GAAG,EAAE,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE;SACtE,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,WAAW,MAAM,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAmC,OAAO,CAAC,GAAG,CAC7D,CAAC,MAAc,EAAuB,EAAE,CAAC,CAAC;QACxC,MAAM;QACN,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC;QACrC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KAC3C,CAAC,CACH,CAAA;IACD,MAAM,OAAO,GAAsB,kBAAkB,CAAC,WAAW,CAAC,CAAA;IAClE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,MAAM,CAAC,4DAA4D,EAAE;YACnE,GAAG,OAAO;YACV,8BAA8B;SAC/B,CAAC;QACJ,CAAC,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAA;AACvE,CAAC,CAAA;AAED,oGAAoG;AACpG,wGAAwG;AACxG,uFAAuF;AACvF,MAAM,qBAAqB,GAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAA;AACrF,MAAM,UAAU,GAAsB,CAAC,MAAM,EAAE,QAAQ,EAAE,2BAA2B,CAAC,CAAA;AACrF,yGAAyG;AACzG,MAAM,gBAAgB,GAAW,OAAO,CAAA;AAExC,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAsB,EAAE;IACnE,MAAM,QAAQ,GAAuB,gBAAgB,CACnD,SAAS,EACT,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CACxC,CAAA;IACD,OAAO,QAAQ,KAAK,SAAS;QAC3B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,qBAAqB,CAAC,CAAA;AACjE,CAAC,CAAA;AAED,iGAAiG;AACjG,yEAAyE;AACzE,MAAM,uBAAuB,GAAG,CAAC,SAAiB,EAAE,UAAkB,EAAU,EAAE;IAChF,MAAM,KAAK,GAAsB;QAC/B,GAAG,CAAC,SAAS,GAAG,CAAC;YACf,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,8DAA8D,CAAC;YACtF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,GAAG,CAAC;YAChB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,4DAA4D,CAAC;YACrF,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC,CAAA;AAED,wGAAwG;AACxG,yGAAyG;AACzG,MAAM,UAAU,GAAG,CAAC,MAAiB,EAAc,EAAE;IACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,8CAA8C,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAC1F,CAAC;IACD,MAAM,MAAM,GAAsC,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3F,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,6CAA6C,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,SAAS,GAAsB,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAChE,MAAM,UAAU,GAAsB,2BAA2B,CAAC,MAAM,CAAC,CAAA;IACzE,MAAM,QAAQ,GAAsB,CAAC,GAAG,SAAS,EAAE,GAAG,UAAU,CAAC,CAAA;IACjE,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;QAChF,CAAC,CAAC,MAAM,CACJ,wFAAwF;YACtF,yDAAyD,CAC5D,CAAA;AACP,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAc,EAAE;IAC7D,MAAM,QAAQ,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;IACjE,MAAM,UAAU,GAAW,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;IAClE,MAAM,UAAU,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IAC9D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,8CAA8C,EAAE;YAC5D,GAAG,UAAU,kEAAkE;gBAC7E,yFAAyF;SAC5F,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAuB,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC1E,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,gDAAgD,EAAE;YAC9D,yFAAyF;SAC1F,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,+CAA+C,EAAE;YAC7D,GAAG,iBAAiB,yEAAyE;gBAC3F,+BAA+B;SAClC,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,MAAM,GAAc,OAAO,CAC/B,WAAW,CAAC,KAAK,CAAC,EAClB;QACE,YAAY;QACZ,QAAQ;QACR,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,UAAU,CAAC;QACxC,UAAU;QACV,iBAAiB;KAClB,EACD;QACE,GAAG,EAAE,OAAO,CAAC,IAAI;QACjB,4FAA4F;QAC5F,iGAAiG;QACjG,iGAAiG;QACjG,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW;YAC/B,GAAG,cAAc,CAAC,OAAO,CAAC;YAC1B,YAAY,EAAE,kBAAkB;SACjC;QACD,SAAS,EAAE,gBAAgB;KAC5B,CACF,CAAA;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;AACtD,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAE5D,oGAAoG;AACpG,wGAAwG;AACxG,uGAAuG;AACvG,oCAAoC;AACpC,MAAM,YAAY,GAAG,CAAC,IAAgB,EAAE,SAAkB,EAA+B,EAAE,CAAC;IAC1F,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;IACpC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CACrE,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAqB,EAAE;IAC9D,MAAM,KAAK,GAAsB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAA;IAC7D,OAAO,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAC1C,CAAC,IAAY,EAAW,EAAE,CACxB,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QAClE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAC5C,CAAA;AACH,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,SAA2B,EAAU,EAAE,CACrE,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAA;AAE7E,uGAAuG;AACvG,uGAAuG;AACvG,wGAAwG;AACxG,gCAAgC;AAChC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,KAA4B,EAAqB,EAAE,CAC7F,OAAO,CAAC,SAAS;IACf,CAAC,CAAC,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CACvE,CAAC,OAAyB,EAAU,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CACjF;IACH,CAAC,CAAC,EAAE,CAAA;AAER,kGAAkG;AAClG,0DAA0D;AAC1D,MAAM,aAAa,GAAG,CAAC,KAA4B,EAAqB,EAAE,CACxE,KAAK;KACF,MAAM,CAAC,CAAC,IAAgB,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;KAC3E,GAAG,CAAC,CAAC,IAAgB,EAAU,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAElE,sGAAsG;AACtG,qGAAqG;AACrG,yGAAyG;AACzG,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAE,KAA4B,EAAqB,EAAE;IAC/F,MAAM,OAAO,GAAsB,aAAa,CAAC,KAAK,CAAC,CAAA;IACvD,MAAM,YAAY,GAAY,OAAO,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CACnE,sBAAsB,CAAC,IAAI,CAAC,CAC7B,CAAA;IACD,MAAM,QAAQ,GAAuB,OAAO;SACzC,GAAG,CAAC,CAAC,IAAY,EAAsB,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC;SAC7E,IAAI,CAAC,CAAC,KAAyB,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;IAC5E,OAAO;QACL,sBAAsB,EAAE,YAAY;QACpC,WAAW,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC,OAAO,CACpD,CAAC,QAAgB,EAAiC,EAAE;YAClD,MAAM,SAAS,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YAC3D,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACzF,CAAC,CACF;KACF,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,KAA4B,EAAqB,EAAE,CAC7F,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAErF,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAc,EAAE;IAC1D,MAAM,UAAU,GAAsB,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC/D,MAAM,KAAK,GAA0B,UAAU,CAAC,GAAG,CACjD,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;KAC5D,CAAC,CACH,CAAA;IACD,MAAM,QAAQ,GAAsB;QAClC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAgB,EAAqB,EAAE,CACvD,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,SAA2B,EAAU,EAAE,CAChF,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAC/B,CACF;QACD,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC;QACpC,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC;KACrC,CAAA;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,4BAA4B,EAAE,QAAQ,CAAC;QAC1E,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAA;AAClF,CAAC,CAAA;AAED,iGAAiG;AACjG,uGAAuG;AACvG,0FAA0F;AAC1F,MAAM,SAAS,GAAW,QAAQ,CAAA;AAElC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAe,EAAc,EAAE;IACxD,MAAM,KAAK,GAA0B,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAChE,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;KAC5D,CAAC,CACH,CAAA;IACD,MAAM,KAAK,GAA0B,KAAK,CAAC,MAAM,CAAC,CAAC,IAAgB,EAAW,EAAE,CAC9E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAChC,CAAA;IACD,kGAAkG;IAClG,2DAA2D;IAC3D,MAAM,QAAQ,GAAqE,KAAK;SACrF,MAAM,CAAC,CAAC,IAAgB,EAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SACvE,GAAG,CAAC,CAAC,IAAgB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAU,CAAC,CAAA;IAClF,MAAM,QAAQ,GAAsB,QAAQ,CAAC,OAAO,CAClD,CAAC,CAAC,IAAI,EAAE,KAAK,CAAsD,EAAqB,EAAE,CACxF,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,CAC9C,CAAC,SAA2B,EAAU,EAAE,CACtC,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CACnF,CACJ,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,uCAAuC,EAAE,QAAQ,CAAC,CAAA;IAC5F,CAAC;IACD,MAAM,KAAK,GAAW,QAAQ,CAAC,MAAM,CACnC,CAAC,KAAa,EAAE,CAAC,EAAE,KAAK,CAAsD,EAAU,EAAE,CACxF,KAAK,GAAG,KAAK,CAAC,MAAM,EACtB,CAAC,CACF,CAAA;IACD,OAAO,MAAM,CACX,KAAK,KAAK,CAAC;QACT,CAAC,CAAC,4CAA4C;QAC9C,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAC1E,CAAA;AACH,CAAC,CAAA"}

package/dist/checks/shell.d.ts

@@ -0,0 +1,5 @@
+import { type Context } from '../context.js';
+import { type GateResult } from '../exec.js';
+/** Run the pinned ShellCheck over every tracked shell script. */
+export declare const shell: (context: Context) => GateResult;
+//# sourceMappingURL=shell.d.ts.map

package/dist/checks/shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../src/checks/shell.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,KAAK,OAAO,EAAoB,MAAM,eAAe,CAAA;AAC9D,OAAO,EAGL,KAAK,UAAU,EAKhB,MAAM,YAAY,CAAA;AA2CnB,iEAAiE;AACjE,eAAO,MAAM,KAAK,GAAI,SAAS,OAAO,KAAG,UAkDxC,CAAA"}

package/dist/checks/shell.js

@@ -0,0 +1,78 @@
+// ShellCheck over every shell script the repository tracks.
+//
+// A repository's operational scripts are code it runs against its own database and its own deployments,
+// and nothing else in the harness reads them. The image is the one already pinned beside the other
+// containerised analyzers, so this gate adds a rule rather than a dependency.
+import { readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { CONTAINER_IMAGES, findBlanketShellDirectives, shellScriptsIn, } from '@ploaness/governance';
+import { workingTreeFiles } from '../context.js';
+import { asFindings, failed, passed, run, withOutput, } from '../exec.js';
+import { acquireImage, dockerFault } from './container-run.js';
+const SHELLCHECK_IMAGE = CONTAINER_IMAGES.shellcheck;
+const SHELL_GATE = 'the shell gate';
+/** ShellCheck exits 1 when it has findings; 2, 3 and 4 mean it could not analyse at all. */
+const SHELLCHECK_FINDINGS = 1;
+// Read defensively and to a bounded set: `git ls-files` reports symlinks and gitlinks too, and the
+// classifier asks only about paths whose extension could not already have answered. An unreadable file
+// answers with no shebang, which leaves it out of scope rather than failing the run.
+const readTextOrEmpty = (root, file) => {
+    try {
+        const full = path.join(root, file);
+        return statSync(full).isFile() ? readFileSync(full, 'utf8') : '';
+    }
+    catch {
+        return '';
+    }
+};
+const firstLineReader = (root) => (file) => readTextOrEmpty(root, file).split('\n', 1)[0] ?? '';
+const blanketFindings = (context, scripts) => scripts.flatMap((file) => findBlanketShellDirectives(readTextOrEmpty(context.root, file)).map((directive) => `${file}:${String(directive.line)} disables shellcheck wholesale with ` +
+    `"disable=${directive.directive}"; name the codes a line genuinely needs, or repair the finding`));
+// ShellCheck has three outcomes rather than two, so `fromRun` cannot express the verdict: 0 is a pass, 1
+// is a finding about the project, and 2, 3 and 4 mean it could not read what it was given. Reporting the
+// last as a project defect is the misattribution the docker classifier exists to prevent.
+const shellcheckFault = (result) => result.code === 0 || result.code === SHELLCHECK_FINDINGS
+    ? undefined
+    : failed(`${SHELL_GATE} could not analyse the scripts it was given`, asFindings(result.output));
+/** Run the pinned ShellCheck over every tracked shell script. */
+export const shell = (context) => {
+    const scripts = shellScriptsIn(workingTreeFiles(context.root), firstLineReader(context.root));
+    // No script means no container: a project that ships none never needs the image at all.
+    if (scripts.length === 0) {
+        return passed('the project ships no shell script');
+    }
+    const blanket = blanketFindings(context, scripts);
+    const unavailable = acquireImage(context, SHELLCHECK_IMAGE, SHELL_GATE);
+    if (unavailable !== undefined) {
+        return unavailable;
+    }
+    // `--norc` is the load-bearing flag. Without it ShellCheck reads a `.shellcheckrc` from each script's
+    // directory and every parent, so a committed `disable=all` would silence this gate from inside the
+    // tree it judges - the shadowing the harness already refuses for every other analyzer. `--` keeps a
+    // tracked file whose name begins with a dash from being read as an option, and the default severity
+    // stands, because a check has two verdicts and neither of them is a warning.
+    const result = run('docker', [
+        'run',
+        '--rm',
+        '-v',
+        `${context.root}:/mnt:ro`,
+        '--workdir',
+        '/mnt',
+        SHELLCHECK_IMAGE,
+        '--norc',
+        '--',
+        ...scripts,
+    ], { cwd: context.root });
+    const faulted = dockerFault(context, SHELLCHECK_IMAGE, SHELL_GATE, result) ?? shellcheckFault(result);
+    if (faulted !== undefined) {
+        return faulted;
+    }
+    const findings = [
+        ...blanket,
+        ...(result.code === SHELLCHECK_FINDINGS ? asFindings(result.output) : []),
+    ];
+    return withOutput(findings.length > 0
+        ? failed(`${String(findings.length)} shell script defect(s)`, findings)
+        : passed(`${String(scripts.length)} shell script(s) pass shellcheck`), result.output);
+};
+//# sourceMappingURL=shell.js.map

package/dist/checks/shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../src/checks/shell.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,wGAAwG;AACxG,mGAAmG;AACnG,8EAA8E;AAC9E,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAChD,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAE1B,cAAc,GACf,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EACL,UAAU,EACV,MAAM,EAEN,MAAM,EAEN,GAAG,EACH,UAAU,GACX,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAE9D,MAAM,gBAAgB,GAAW,gBAAgB,CAAC,UAAU,CAAA;AAC5D,MAAM,UAAU,GAAW,gBAAgB,CAAA;AAE3C,4FAA4F;AAC5F,MAAM,mBAAmB,GAAW,CAAC,CAAA;AAErC,mGAAmG;AACnG,uGAAuG;AACvG,qFAAqF;AACrF,MAAM,eAAe,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC,CAAA;AAED,MAAM,eAAe,GACnB,CAAC,IAAY,EAAE,EAAE,CACjB,CAAC,IAAY,EAAU,EAAE,CACvB,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AAEvD,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAE,OAA0B,EAAqB,EAAE,CAC1F,OAAO,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE,CAClD,0BAA0B,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CACjE,CAAC,SAAyB,EAAU,EAAE,CACpC,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,sCAAsC;IACvE,YAAY,SAAS,CAAC,SAAS,iEAAiE,CACnG,CACF,CAAA;AAEH,yGAAyG;AACzG,yGAAyG;AACzG,0FAA0F;AAC1F,MAAM,eAAe,GAAG,CAAC,MAAiB,EAA0B,EAAE,CACpE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB;IACtD,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,MAAM,CAAC,GAAG,UAAU,6CAA6C,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;AAEnG,iEAAiE;AACjE,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAc,EAAE;IACpD,MAAM,OAAO,GAAsB,cAAc,CAC/C,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAC9B,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAC9B,CAAA;IACD,wFAAwF;IACxF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,mCAAmC,CAAC,CAAA;IACpD,CAAC;IACD,MAAM,OAAO,GAAsB,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACpE,MAAM,WAAW,GAA2B,YAAY,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAA;IAC/F,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,sGAAsG;IACtG,mGAAmG;IACnG,oGAAoG;IACpG,oGAAoG;IACpG,6EAA6E;IAC7E,MAAM,MAAM,GAAc,GAAG,CAC3B,QAAQ,EACR;QACE,KAAK;QACL,MAAM;QACN,IAAI;QACJ,GAAG,OAAO,CAAC,IAAI,UAAU;QACzB,WAAW;QACX,MAAM;QACN,gBAAgB;QAChB,QAAQ;QACR,IAAI;QACJ,GAAG,OAAO;KACX,EACD,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CACtB,CAAA;IACD,MAAM,OAAO,GACX,WAAW,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAA;IACvF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,QAAQ,GAAsB;QAClC,GAAG,OAAO;QACV,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAA;IACD,OAAO,UAAU,CACf,QAAQ,CAAC,MAAM,GAAG,CAAC;QACjB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,yBAAyB,EAAE,QAAQ,CAAC;QACvE,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,kCAAkC,CAAC,EACvE,MAAM,CAAC,MAAM,CACd,CAAA;AACH,CAAC,CAAA"}

package/dist/checks/suppressions.d.ts

@@ -1,5 +1,5 @@
-import { type Context } from '../context.js';
+import { type Member } from '../context.js';
 import { type GateResult } from '../exec.js';
 /** Count suppressions and source lines across the project's own code. */
-export declare const suppressions: (context: Context) => GateResult;
+export declare const suppressions: (context: Member) => GateResult;
 //# sourceMappingURL=suppressions.d.ts.map

package/dist/checks/suppressions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/checks/suppressions.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,OAAO,EAAoB,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAW5D,yEAAyE;AACzE,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,UAsD/C,CAAA"}
+{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/checks/suppressions.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,KAAK,MAAM,EAAoB,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAgD5D,yEAAyE;AACzE,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,KAAG,UA4C9C,CAAA"}

package/dist/checks/suppressions.js

@@ -7,33 +7,53 @@
 // a separate informational report such as dependency freshness.
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
-import { countSourceLines, findSuppressions, isGovernedCode, judgeSuppressions, } from '@ploaness/governance';
+import { countSourceLines, findSuppressions, hasExtension, isGovernedCode, isOxlintSuppression, judgeSuppressions, OXLINT_EXTENSIONS, oxlintSourceFiles, } from '@ploaness/governance';
 import { workingTreeFiles } from '../context.js';
 import { failed, passed } from '../exec.js';
+import { sourceComments } from '../source-comments.js';
 import { managedPaths } from './assets.js';
 const isUnderSourceRoots = (file, sourceRoots) => sourceRoots.some((sourceRoot) => file.startsWith(`${sourceRoot}/`));
-/** Count suppressions and source lines across the project's own code. */
-export const suppressions = (context) => {
-    const excluded = context.settings.typographyExclusions;
-    // A managed file is ploaness's, byte for byte, and the project can neither remove a suppression
-    // inside it nor be asked to justify one. Its lines are left out of the denominator for the same
-    // reason: a ceiling earned by code the project did not write would be an allowance, not a measure.
+const sitesOf = (scanned) => [
+    ...findSuppressions(scanned.file, scanned.content),
+    ...(hasExtension(scanned.file, OXLINT_EXTENSIONS)
+        ? sourceComments(scanned.content, scanned.file)
+            .filter(isOxlintSuppression)
+            .map((comment) => ({
+            file: scanned.file,
+            line: comment.line,
+            token: 'oxlint-disable',
+        }))
+        : []),
+];
+const eligibleFiles = (context, inventory, native) => {
     const managed = managedPaths(context);
-    // An enumerated path is not always a regular file: a symlink and a submodule gitlink both appear here.
-    const files = workingTreeFiles(context.root).filter((file) => {
+    const excluded = context.settings.typographyExclusions;
+    return inventory.filter((file) => {
         const full = path.join(context.root, file);
-        return (isUnderSourceRoots(file, context.settings.sourceRoots) &&
+        return ((hasExtension(file, OXLINT_EXTENSIONS)
+            ? native.has(file)
+            : isUnderSourceRoots(file, context.settings.sourceRoots)) &&
             !managed.has(file) &&
             isGovernedCode(file, excluded) &&
             existsSync(full) &&
             statSync(full).isFile());
     });
+};
+/** Count suppressions and source lines across the project's own code. */
+export const suppressions = (context) => {
+    // A managed file is ploaness's, byte for byte, and the project can neither remove a suppression
+    // inside it nor be asked to justify one. Its lines are left out of the denominator for the same
+    // reason: a ceiling earned by code the project did not write would be an allowance, not a measure.
+    // An enumerated path is not always a regular file: a symlink and a submodule gitlink both appear here.
+    const inventory = workingTreeFiles(context.root);
+    const native = new Set(oxlintSourceFiles(inventory, context.settings.generatedArtefacts, context.siblingPaths));
+    const files = eligibleFiles(context, inventory, native);
     // Read once, then derive both figures from the same contents rather than accumulating as we go.
     const contents = files.map((file) => ({
         file,
         content: readFileSync(path.join(context.root, file), 'utf8'),
     }));
-    const sites = contents.flatMap((scanned) => findSuppressions(scanned.file, scanned.content));
+    const sites = contents.flatMap((scanned) => sitesOf(scanned));
     const sourceLines = contents.reduce((total, scanned) => total + countSourceLines(scanned.content), 0);
     const report = judgeSuppressions(sites, sourceLines, context.settings.maxSuppressions);
     const summary = `${String(report.count)} of ${String(report.ceiling)} permitted, ` +

package/dist/checks/suppressions.js.map

@@ -1 +1 @@
-{"version":3,"file":"suppressions.js","sourceRoot":"","sources":["../../src/checks/suppressions.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,EAAE;AACF,uGAAuG;AACvG,wGAAwG;AACxG,kGAAkG;AAClG,wGAAwG;AACxG,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,GAGlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAO1C,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAE,WAA8B,EAAW,EAAE,CACnF,WAAW,CAAC,IAAI,CAAC,CAAC,UAAkB,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,CAAA;AAEtF,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC3D,MAAM,QAAQ,GAAsB,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAA;IACzE,gGAAgG;IAChG,gGAAgG;IAChG,mGAAmG;IACnG,MAAM,OAAO,GAAwB,YAAY,CAAC,OAAO,CAAC,CAAA;IAC1D,uGAAuG;IACvG,MAAM,KAAK,GAAsB,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CACpE,CAAC,IAAY,EAAW,EAAE;QACxB,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAClD,OAAO,CACL,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YACtD,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAClB,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC9B,UAAU,CAAC,IAAI,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CACxB,CAAA;IACH,CAAC,CACF,CAAA;IAED,gGAAgG;IAChG,MAAM,QAAQ,GAA2B,KAAK,CAAC,GAAG,CAChD,CAAC,IAAY,EAAe,EAAE,CAAC,CAAC;QAC9B,IAAI;QACJ,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;KAC7D,CAAC,CACH,CAAA;IACD,MAAM,KAAK,GAA+B,QAAQ,CAAC,OAAO,CACxD,CAAC,OAAoB,EAA8B,EAAE,CACnD,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAClD,CAAA;IACD,MAAM,WAAW,GAAW,QAAQ,CAAC,MAAM,CACzC,CAAC,KAAa,EAAE,OAAoB,EAAU,EAAE,CAAC,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,EAC1F,CAAC,CACF,CAAA;IAED,MAAM,MAAM,GAAsB,iBAAiB,CACjD,KAAK,EACL,WAAW,EACX,OAAO,CAAC,QAAQ,CAAC,eAAe,CACjC,CAAA;IACD,MAAM,OAAO,GACX,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;QAClE,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAA;IACtF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE;QACrB,8BAA8B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;YACzD,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,iDAAiD;QAChF,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CACjB,CAAC,IAAqB,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CACrF;KACF,CAAC,CAAA;AACJ,CAAC,CAAA"}
+{"version":3,"file":"suppressions.js","sourceRoot":"","sources":["../../src/checks/suppressions.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,EAAE;AACF,uGAAuG;AACvG,wGAAwG;AACxG,kGAAkG;AAClG,wGAAwG;AACxG,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAKlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAe,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAO1C,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAE,WAA8B,EAAW,EAAE,CACnF,WAAW,CAAC,IAAI,CAAC,CAAC,UAAkB,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,CAAA;AAEtF,MAAM,OAAO,GAAG,CAAC,OAAoB,EAA8B,EAAE,CAAC;IACpE,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAC/C,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC;aAC1C,MAAM,CAAC,mBAAmB,CAAC;aAC3B,GAAG,CACF,CAAC,OAAsB,EAAmB,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,gBAAgB;SACxB,CAAC,CACH;QACL,CAAC,CAAC,EAAE,CAAC;CACR,CAAA;AAED,MAAM,aAAa,GAAG,CACpB,OAAe,EACf,SAA4B,EAC5B,MAA2B,EACR,EAAE;IACrB,MAAM,OAAO,GAAwB,YAAY,CAAC,OAAO,CAAC,CAAA;IAC1D,MAAM,QAAQ,GAA2B,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAA;IAC9E,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE;QAChD,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAClD,OAAO,CACL,CAAC,YAAY,CAAC,IAAI,EAAE,iBAAiB,CAAC;YACpC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAClB,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC3D,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAClB,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC9B,UAAU,CAAC,IAAI,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CACxB,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAc,EAAE;IAC1D,gGAAgG;IAChG,gGAAgG;IAChG,mGAAmG;IACnG,uGAAuG;IACvG,MAAM,SAAS,GAAsB,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,MAAM,MAAM,GAAwB,IAAI,GAAG,CACzC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,YAAY,CAAC,CACxF,CAAA;IACD,MAAM,KAAK,GAAsB,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;IAE1E,gGAAgG;IAChG,MAAM,QAAQ,GAA2B,KAAK,CAAC,GAAG,CAChD,CAAC,IAAY,EAAe,EAAE,CAAC,CAAC;QAC9B,IAAI;QACJ,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;KAC7D,CAAC,CACH,CAAA;IACD,MAAM,KAAK,GAA+B,QAAQ,CAAC,OAAO,CACxD,CAAC,OAAoB,EAA8B,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CACvE,CAAA;IACD,MAAM,WAAW,GAAW,QAAQ,CAAC,MAAM,CACzC,CAAC,KAAa,EAAE,OAAoB,EAAU,EAAE,CAAC,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,EAC1F,CAAC,CACF,CAAA;IAED,MAAM,MAAM,GAAsB,iBAAiB,CACjD,KAAK,EACL,WAAW,EACX,OAAO,CAAC,QAAQ,CAAC,eAAe,CACjC,CAAA;IACD,MAAM,OAAO,GACX,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;QAClE,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAA;IACtF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE;QACrB,8BAA8B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;YACzD,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,iDAAiD;QAChF,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CACjB,CAAC,IAAqB,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CACrF;KACF,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/checks/tree.d.ts

@@ -1,4 +1,4 @@
-import { type Context } from '../context.js';
+import type { Context } from '../context.js';
 import { type GateResult } from '../exec.js';
 export declare const treeSnapshot: (context: Context) => GateResult;
 /**