@ploaness/cli 1.1.0 → 1.3.0

package/dist/probes/payload-defaults.probe.js

@@ -0,0 +1,116 @@
+// The half of the `payload-defaults` gate that runs inside the project: it imports the project's built
+// Payload configuration and reports which operations of which entities still carry Payload's own
+// `defaultAccess`. It is spawned by the gate through tsx, with the project root as its working directory
+// so that `payload` and the configuration's own imports resolve from the project, and it prints one
+// marker-prefixed JSON line that the gate parses. What the report MEANS is decided in
+// `@ploaness/governance`; this file only reads.
+//
+// It also asks every drafts-enabled entity's read rule what it answers a caller with no credentials.
+// That is the one place the harness CALLS a project's function rather than inspecting it, and it is
+// deliberate: the constraint a read returns is the half `/api/access` reports and the anonymous sweep
+// never opens, so there is nowhere else to see it. The call is confined to entities that keep drafts,
+// it is awaited so a legitimately asynchronous rule is not punished for being one, and a rule that
+// throws is reported as undecidable rather than assumed safe. The harness already requires an access
+// decision to be a pure function of the values it is handed, which is the shape this relies on.
+//
+// Two arguments, both absolute: the configuration file, and Payload's `dist/auth/defaultAccess.js`.
+// Identity is judged by reference first and by source text second, because a loader can register the
+// same module twice under two URLs and a project function cannot be byte-identical to Payload's by
+// accident. Nothing here imports `payload` by name: the harness never depends on it, and the copy that
+// matters is the one the project installed.
+import { pathToFileURL } from 'node:url';
+import { accessOperationsFor, INHERITED_ACCESS_REPORT_MARKER, isArray, isRecord, QUERY_PRESETS_SLUG, readKey, } from '@ploaness/governance';
+// node, the probe, then the two paths.
+const ARGUMENT_OFFSET = 2;
+const [configFile, defaultAccessFile] = process.argv.slice(ARGUMENT_OFFSET);
+if (configFile === undefined || defaultAccessFile === undefined) {
+    throw new Error('usage: payload-defaults.probe.js <payload.config.ts> <defaultAccess.js>');
+}
+const defaultAccessModule = await import(pathToFileURL(defaultAccessFile).href);
+const defaultAccess = readKey(defaultAccessModule, 'defaultAccess');
+if (typeof defaultAccess !== 'function') {
+    throw new TypeError(`Payload's default access could not be established from ${defaultAccessFile}`);
+}
+const defaultAccessSource = String(defaultAccess);
+// Undeclared counts as inherited, and not only as a convenience. `executeAccess` runs the rule it is
+// given and, handed nothing, falls through to `if (req.user) return true` - so a missing rule is not an
+// absent permission but an open one, indistinguishable at runtime from Payload's own default. Payload
+// fills every operation but `readVersions` in during sanitisation, which is the one this reaches.
+const isInherited = (rule) => rule === undefined ||
+    rule === defaultAccess ||
+    (typeof rule === 'function' && String(rule) === defaultAccessSource);
+const configModule = await import(pathToFileURL(configFile).href);
+// Awaited either way: `buildConfig` returns a promise, and a configuration handed over as a plain
+// object is read the same.
+const config = await readKey(configModule, 'default');
+const collections = readKey(config, 'collections');
+const globals = readKey(config, 'globals');
+if (!(isArray(collections) && isArray(globals))) {
+    throw new Error(`the default export of ${configFile} is not a built Payload configuration`);
+}
+// Which operations an entity owes depends on what it is, and sanitisation is what makes that legible:
+// `auth` survives as an object on an auth collection and as `false` elsewhere, and `versions` survives
+// as an object where it is enabled and is deleted where it is not. Both reads are therefore about the
+// built object rather than the source the project wrote.
+// The access a project decided, which for one collection is not the access the collection carries.
+// Payload builds the query-presets collection's rules itself, wrapping each operation in a closure that
+// falls back to its own default, so the wrapper is never the default this probe recognises; the block
+// the project wrote sits on the configuration instead. See QUERY_PRESETS_SLUG for what that hides.
+const accessOf = (entity, slug) => readKey(slug === QUERY_PRESETS_SLUG ? readKey(config, 'queryPresets') : entity, 'access');
+const entryOf = (entity, kind) => {
+    const slug = String(readKey(entity, 'slug'));
+    const access = accessOf(entity, slug);
+    const operations = accessOperationsFor({
+        kind,
+        hasAuth: Boolean(readKey(entity, 'auth')),
+        hasVersions: Boolean(readKey(entity, 'versions')),
+    });
+    return {
+        slug,
+        inherited: operations.filter((operation) => isInherited(readKey(access, operation))),
+    };
+};
+const hasDrafts = (entity) => Boolean(readKey(readKey(entity, 'versions'), 'drafts'));
+// A predicate rather than an assertion, for the reason `isArray` is one: calling a value narrowed only
+// to `Function` hands back `any`, and an assertion is what type coverage counts against the harness.
+const isAccessRule = (value) => typeof value === 'function';
+const anonymousReadOf = async (entity) => {
+    const rule = readKey(readKey(entity, 'access'), 'read');
+    if (!isAccessRule(rule)) {
+        // An undeclared read is Payload's own default, which the inherited half of this report names.
+        return { kind: 'denied' };
+    }
+    try {
+        const answer = await rule({ req: { user: null } });
+        if (answer === true) {
+            return { kind: 'open' };
+        }
+        return isRecord(answer) ? { kind: 'filtered', where: answer } : { kind: 'denied' };
+    }
+    catch (error) {
+        return {
+            kind: 'undecidable',
+            reason: error instanceof Error ? error.message : String(error),
+        };
+    }
+};
+const draftReadsOf = async (entities, kind) => await Promise.all(entities
+    .filter((entity) => hasDrafts(entity))
+    .map(async (entity) => {
+    const anonymousRead = await anonymousReadOf(entity);
+    return { kind, slug: String(readKey(entity, 'slug')), anonymousRead };
+}));
+const report = {
+    collections: collections.map((collection) => entryOf(collection, 'collection')),
+    draftReads: [
+        ...(await draftReadsOf(collections, 'collection')),
+        ...(await draftReadsOf(globals, 'global')),
+    ],
+    globals: globals.map((global) => entryOf(global, 'global')),
+};
+process.stdout.write(`${INHERITED_ACCESS_REPORT_MARKER}${JSON.stringify(report)}\n`);
+// The exit code rather than `process.exit()`, for the reason bin.ts states: the report is flushed
+// before the process ends. A plugin that keeps a handle open after import holds the process until the
+// gate's own timeout, which then reports it as a build that did not finish rather than as a pass.
+process.exitCode = 0;
+//# sourceMappingURL=payload-defaults.probe.js.map

package/dist/probes/payload-defaults.probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-defaults.probe.js","sourceRoot":"","sources":["../../src/probes/payload-defaults.probe.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,iGAAiG;AACjG,yGAAyG;AACzG,oGAAoG;AACpG,sFAAsF;AACtF,gDAAgD;AAChD,EAAE;AACF,qGAAqG;AACrG,oGAAoG;AACpG,sGAAsG;AACtG,sGAAsG;AACtG,mGAAmG;AACnG,qGAAqG;AACrG,gGAAgG;AAChG,EAAE;AACF,oGAAoG;AACpG,qGAAqG;AACrG,mGAAmG;AACnG,uGAAuG;AACvG,4CAA4C;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAEL,mBAAmB,EAEnB,8BAA8B,EAG9B,OAAO,EACP,QAAQ,EAER,kBAAkB,EAClB,OAAO,GACR,MAAM,sBAAsB,CAAA;AAE7B,uCAAuC;AACvC,MAAM,eAAe,GAAW,CAAC,CAAA;AACjC,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;AAC3E,IAAI,UAAU,KAAK,SAAS,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;IAChE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;AAC5F,CAAC;AAED,MAAM,mBAAmB,GAAY,MAAM,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAA;AACxF,MAAM,aAAa,GAAY,OAAO,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAA;AAC5E,IAAI,OAAO,aAAa,KAAK,UAAU,EAAE,CAAC;IACxC,MAAM,IAAI,SAAS,CAAC,0DAA0D,iBAAiB,EAAE,CAAC,CAAA;AACpG,CAAC;AACD,MAAM,mBAAmB,GAAW,MAAM,CAAC,aAAa,CAAC,CAAA;AAEzD,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,kGAAkG;AAClG,MAAM,WAAW,GAAG,CAAC,IAAa,EAAW,EAAE,CAC7C,IAAI,KAAK,SAAS;IAClB,IAAI,KAAK,aAAa;IACtB,CAAC,OAAO,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,mBAAmB,CAAC,CAAA;AAEtE,MAAM,YAAY,GAAY,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAA;AAC1E,kGAAkG;AAClG,2BAA2B;AAC3B,MAAM,MAAM,GAAY,MAAM,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;AAC9D,MAAM,WAAW,GAAY,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAC3D,MAAM,OAAO,GAAY,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;AACnD,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;IAChD,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,uCAAuC,CAAC,CAAA;AAC7F,CAAC;AAED,sGAAsG;AACtG,uGAAuG;AACvG,sGAAsG;AACtG,yDAAyD;AACzD,mGAAmG;AACnG,wGAAwG;AACxG,sGAAsG;AACtG,mGAAmG;AACnG,MAAM,QAAQ,GAAG,CAAC,MAAe,EAAE,IAAY,EAAW,EAAE,CAC1D,OAAO,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;AAE3F,MAAM,OAAO,GAAG,CAAC,MAAe,EAAE,IAAwB,EAAwB,EAAE;IAClF,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACpD,MAAM,MAAM,GAAY,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAsB,mBAAmB,CAAC;QACxD,IAAI;QACJ,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;KAClD,CAAC,CAAA;IACF,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,SAAiB,EAAW,EAAE,CAC1D,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CACxC;KACF,CAAA;AACH,CAAC,CAAA;AAMD,MAAM,SAAS,GAAG,CAAC,MAAe,EAAW,EAAE,CAC7C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;AAEzD,uGAAuG;AACvG,qGAAqG;AACrG,MAAM,YAAY,GAAG,CAAC,KAAc,EAAuB,EAAE,CAAC,OAAO,KAAK,KAAK,UAAU,CAAA;AAEzF,MAAM,eAAe,GAAG,KAAK,EAAE,MAAe,EAA0B,EAAE;IACxE,MAAM,IAAI,GAAY,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;IAChE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,8FAA8F;QAC9F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC3B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;QAC3D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACzB,CAAC;QACD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IACpF,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,KAAK,EACxB,QAA4B,EAC5B,IAAwB,EACY,EAAE,CACtC,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ;KACL,MAAM,CAAC,CAAC,MAAe,EAAW,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;KACvD,GAAG,CAAC,KAAK,EAAE,MAAe,EAA2B,EAAE;IACtD,MAAM,aAAa,GAAkB,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,aAAa,EAAE,CAAA;AACvE,CAAC,CAAC,CACL,CAAA;AAEH,MAAM,MAAM,GAA0B;IACpC,WAAW,EAAE,WAAW,CAAC,GAAG,CAC1B,CAAC,UAAmB,EAAwB,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CACjF;IACD,UAAU,EAAE;QACV,GAAG,CAAC,MAAM,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAClD,GAAG,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;KAC3C;IACD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAe,EAAwB,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CAC3F,CAAA;AAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,8BAA8B,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AACpF,kGAAkG;AAClG,sGAAsG;AACtG,kGAAkG;AAClG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA"}

package/dist/source-comments.d.ts

@@ -0,0 +1,9 @@
+import type { SourceComment } from '@ploaness/governance';
+/**
+ * Read actual source comments without mistaking strings, regular expressions, or JSX text for directives.
+ * @param text the source being checked.
+ * @param file the filename, which determines whether angle brackets are types or JSX.
+ * @returns comments once each, located at their original source lines.
+ */
+export declare const sourceComments: (text: string, file?: string) => readonly SourceComment[];
+//# sourceMappingURL=source-comments.d.ts.map

package/dist/source-comments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-comments.d.ts","sourceRoot":"","sources":["../src/source-comments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAqCzD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,OAAM,MAAqB,KAC1B,SAAS,aAAa,EAuBxB,CAAA"}

package/dist/source-comments.js

@@ -0,0 +1,54 @@
+import ts from 'typescript';
+const LITERAL_KINDS = new Set([
+    ts.SyntaxKind.JsxText,
+    ts.SyntaxKind.StringLiteral,
+    ts.SyntaxKind.RegularExpressionLiteral,
+    ts.SyntaxKind.NoSubstitutionTemplateLiteral,
+    ts.SyntaxKind.TemplateHead,
+    ts.SyntaxKind.TemplateMiddle,
+    ts.SyntaxKind.TemplateTail,
+]);
+const literalRangesOf = (node, source) => [
+    ...(LITERAL_KINDS.has(node.kind)
+        ? [
+            {
+                pos: node.kind === ts.SyntaxKind.JsxText ? node.pos : node.getStart(source),
+                end: node.end,
+            },
+        ]
+        : []),
+    ...node
+        .getChildren(source)
+        .flatMap((child) => literalRangesOf(child, source)),
+];
+const rangesOf = (node, source) => [
+    ...(node.kind === ts.SyntaxKind.JsxText
+        ? []
+        : (ts.getLeadingCommentRanges(source.text, node.getFullStart()) ?? [])),
+    ...(ts.getTrailingCommentRanges(source.text, node.end) ?? []),
+    ...node
+        .getChildren(source)
+        .flatMap((child) => rangesOf(child, source)),
+];
+/**
+ * Read actual source comments without mistaking strings, regular expressions, or JSX text for directives.
+ * @param text the source being checked.
+ * @param file the filename, which determines whether angle brackets are types or JSX.
+ * @returns comments once each, located at their original source lines.
+ */
+export const sourceComments = (text, file = 'source.tsx') => {
+    const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true);
+    const ranges = new Map(rangesOf(source, source).map((range) => [
+        range.pos,
+        range,
+    ]));
+    const literals = literalRangesOf(source, source);
+    return [...ranges.values()]
+        .filter((range) => !literals.some((literal) => range.pos >= literal.pos && range.pos < literal.end))
+        .toSorted((left, right) => left.pos - right.pos)
+        .map((range) => ({
+        line: source.getLineAndCharacterOfPosition(range.pos).line + 1,
+        text: text.slice(range.pos, range.end),
+    }));
+};
+//# sourceMappingURL=source-comments.js.map

package/dist/source-comments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-comments.js","sourceRoot":"","sources":["../src/source-comments.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,YAAY,CAAA;AAE3B,MAAM,aAAa,GAA+B,IAAI,GAAG,CAAC;IACxD,EAAE,CAAC,UAAU,CAAC,OAAO;IACrB,EAAE,CAAC,UAAU,CAAC,aAAa;IAC3B,EAAE,CAAC,UAAU,CAAC,wBAAwB;IACtC,EAAE,CAAC,UAAU,CAAC,6BAA6B;IAC3C,EAAE,CAAC,UAAU,CAAC,YAAY;IAC1B,EAAE,CAAC,UAAU,CAAC,cAAc;IAC5B,EAAE,CAAC,UAAU,CAAC,YAAY;CAC3B,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,IAAa,EAAE,MAAqB,EAA2B,EAAE,CAAC;IACzF,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,CAAC,CAAC;YACE;gBACE,GAAG,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC3E,GAAG,EAAE,IAAI,CAAC,GAAG;aACd;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,IAAI;SACJ,WAAW,CAAC,MAAM,CAAC;SACnB,OAAO,CAAC,CAAC,KAAc,EAA2B,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;CACxF,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAE,MAAqB,EAA8B,EAAE,CAAC;IACrF,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,OAAO;QACrC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7D,GAAG,IAAI;SACJ,WAAW,CAAC,MAAM,CAAC;SACnB,OAAO,CAAC,CAAC,KAAc,EAA8B,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;CACpF,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,IAAY,EACZ,OAAe,YAAY,EACD,EAAE;IAC5B,MAAM,MAAM,GAAkB,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC3F,MAAM,MAAM,GAAyC,IAAI,GAAG,CAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAsB,EAAsC,EAAE,CAAC;QAC3F,KAAK,CAAC,GAAG;QACT,KAAK;KACN,CAAC,CACH,CAAA;IACD,MAAM,QAAQ,GAA4B,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;SACxB,MAAM,CACL,CAAC,KAAsB,EAAW,EAAE,CAClC,CAAC,QAAQ,CAAC,IAAI,CACZ,CAAC,OAAqB,EAAW,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CACxF,CACJ;SACA,QAAQ,CAAC,CAAC,IAAqB,EAAE,KAAsB,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;SACzF,GAAG,CACF,CAAC,KAAsB,EAAiB,EAAE,CAAC,CAAC;QAC1C,IAAI,EAAE,MAAM,CAAC,6BAA6B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;QAC9D,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;KACvC,CAAC,CACH,CAAA;AACL,CAAC,CAAA"}

package/dist/working-tree.d.ts

@@ -0,0 +1,5 @@
+/** Enumerate tracked and non-ignored untracked paths on each call, including indexed deletions. */
+export declare const workingTreeFiles: (root: string) => readonly string[];
+/** Fingerprint paths, file kinds, modes, and bytes without following symbolic links. */
+export declare const workingTreeFingerprint: (root: string) => string;
+//# sourceMappingURL=working-tree.d.ts.map

package/dist/working-tree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"working-tree.d.ts","sourceRoot":"","sources":["../src/working-tree.ts"],"names":[],"mappings":"AASA,mGAAmG;AACnG,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,SAAS,MAAM,EAYuB,CAAA;AAgBtF,wFAAwF;AACxF,eAAO,MAAM,sBAAsB,GAAI,MAAM,MAAM,KAAG,MASpC,CAAA"}

package/dist/working-tree.js

@@ -0,0 +1,36 @@
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { lstatSync, readFileSync, readlinkSync } from 'node:fs';
+import path from 'node:path';
+const BYTES_PER_KIB = 1024;
+const KIB_PER_MIB = 1024;
+const MAX_OUTPUT_MIB = 64;
+/** Enumerate tracked and non-ignored untracked paths on each call, including indexed deletions. */
+export const workingTreeFiles = (root) => [
+    ...new Set(execFileSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], {
+        cwd: root,
+        encoding: 'utf8',
+        maxBuffer: MAX_OUTPUT_MIB * KIB_PER_MIB * BYTES_PER_KIB,
+        stdio: ['ignore', 'pipe', 'pipe'],
+    })
+        .split('\0')
+        .filter((file) => file !== '')),
+].toSorted((left, right) => left.localeCompare(right, 'en'));
+const fileState = (root, file) => {
+    const full = path.join(root, file);
+    const stat = lstatSync(full, { throwIfNoEntry: false });
+    if (stat === undefined) {
+        return [file, 'absent'];
+    }
+    if (stat.isSymbolicLink()) {
+        return [file, 'symlink', readlinkSync(full)];
+    }
+    return stat.isFile()
+        ? [file, 'file', stat.mode, createHash('sha256').update(readFileSync(full)).digest('hex')]
+        : [file, 'directory'];
+};
+/** Fingerprint paths, file kinds, modes, and bytes without following symbolic links. */
+export const workingTreeFingerprint = (root) => createHash('sha256')
+    .update(JSON.stringify(workingTreeFiles(root).map((file) => fileState(root, file))))
+    .digest('hex');
+//# sourceMappingURL=working-tree.js.map

package/dist/working-tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"working-tree.js","sourceRoot":"","sources":["../src/working-tree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC/D,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,MAAM,aAAa,GAAW,IAAI,CAAA;AAClC,MAAM,WAAW,GAAW,IAAI,CAAA;AAChC,MAAM,cAAc,GAAW,EAAE,CAAA;AAEjC,mGAAmG;AACnG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAqB,EAAE,CAClE;IACE,GAAG,IAAI,GAAG,CACR,YAAY,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE;QACpF,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,cAAc,GAAG,WAAW,GAAG,aAAa;QACvD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC;SACC,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAClD;CACF,CAAC,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;AAEtF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,IAAY,EAAgC,EAAE;IAC7E,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC1C,MAAM,IAAI,GAA6C,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;IACjG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACzB,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,EAAE;QAClB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;AACzB,CAAC,CAAA;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7D,UAAU,CAAC,QAAQ,CAAC;KACjB,MAAM,CACL,IAAI,CAAC,SAAS,CACZ,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAgC,EAAE,CACxE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CACtB,CACF,CACF;KACA,MAAM,CAAC,KAAK,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ploaness/cli",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "The executable half of ploaness: the verification gates and the commands that run them.",
   "license": "MIT",
   "author": "Herman Ciechanowiec <herman@ciechanowiec.eu>",
@@ -32,13 +32,14 @@
   ],
   "dependencies": {
     "@biomejs/biome": "2.5.11",
-    "@ploaness/assets": "1.1.0",
-    "@ploaness/config": "1.1.0",
-    "@ploaness/governance": "1.1.0",
+    "@ploaness/assets": "1.3.0",
+    "@ploaness/config": "1.3.0",
+    "@ploaness/governance": "1.3.0",
     "@vitest/coverage-v8": "4.1.11",
     "dependency-cruiser": "18.2.0",
     "eslint": "10.9.1",
     "knip": "6.34.0",
+    "oxlint": "1.81.0",
     "stylelint": "17.14.1",
     "tsx": "4.23.13",
     "type-coverage": "2.30.1",
@@ -52,7 +53,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "@types/node": "26.4.0"
+    "@types/node": "26.4.1"
   },
   "scripts": {
     "build": "tsc --build"