@ploaness/governance 1.0.0 → 1.2.0

package/dist/route-map.d.ts

@@ -0,0 +1,65 @@
+/** A page a project's file tree declares, and the address it answers at. */
+export interface DeclaredRoute {
+    /** The file declaring it, relative to the member root. */
+    readonly file: string;
+    /** The address, with dynamic segments left in their file-tree spelling. */
+    readonly route: string;
+    /** Whether that address carries a dynamic segment, and so names a family rather than one page. */
+    readonly isDynamic: boolean;
+}
+/**
+ * Which directory holds the application's routes.
+ *
+ * Chosen from the conventional two rather than searched for, and confirmed by the root layout Next.js
+ * requires, so a library with a `src/app` module of its own is not mistaken for an application.
+ * @param paths every file of the member, relative to its root, separated by forward slashes.
+ * @returns the app directory, or nothing when the member declares no routes.
+ */
+export declare const appRootOf: (paths: readonly string[]) => string | undefined;
+/**
+ * Strip a trailing slash, so an address written with one and an address written without are one.
+ *
+ * The crawl records whatever `URL.pathname` gave it and a link may be written either way, while a file
+ * tree never produces a trailing slash at all. Comparing the two without this reports every page of a
+ * project that sets `trailingSlash`.
+ * @param route the address to normalise.
+ * @returns the address without its trailing slash, and the root route unchanged.
+ */
+export declare const normalisedRoute: (route: string) => string;
+/**
+ * The address one file answers at, if it declares a page at all.
+ * @param file the file, relative to the app directory.
+ * @returns the declared route, or nothing when the file declares no independently reachable address.
+ */
+export declare const declaredRouteOf: (file: string) => DeclaredRoute | undefined;
+/**
+ * Every address a member's file tree declares.
+ *
+ * Deduplicated by address, because a parallel route's slot and the page beside it reduce to the same
+ * one and reporting it twice would ask a project to answer for the same page under two file names.
+ * @param paths every file of the member, relative to its root, separated by forward slashes.
+ * @param appRoot the app directory, as `appRootOf` chose it.
+ * @returns one entry per declared address, in the order the paths were given.
+ */
+export declare const declaredRoutesOf: (paths: readonly string[], appRoot: string) => readonly DeclaredRoute[];
+/**
+ * The part of an address before its first dynamic segment.
+ *
+ * What a specification can be searched for when the address itself cannot be: a spec never contains
+ * `/posts/[slug]`, it contains `/posts/` and then a value.
+ * @param route the declared address.
+ * @returns the leading static part, which is the root route when the first segment is dynamic.
+ */
+export declare const staticPrefixOf: (route: string) => string;
+/**
+ * Whether one visited address is a page the declared route produces.
+ *
+ * A static route matches itself. A dynamic one matches any address its segments admit, which is what
+ * lets the crawl answer for it: if the sweep scanned `/posts/hello`, the file behind `/posts/[slug]`
+ * has been scanned, whatever else it can also serve.
+ * @param route the declared address, dynamic segments in their file-tree spelling.
+ * @param visited an address the crawl reached.
+ * @returns true when scanning that address scanned this route.
+ */
+export declare const matchesRoute: (route: string, visited: string) => boolean;
+//# sourceMappingURL=route-map.d.ts.map

package/dist/route-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-map.d.ts","sourceRoot":"","sources":["../src/route-map.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,kGAAkG;IAClG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AA8CD;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,OAAO,SAAS,MAAM,EAAE,KAAG,MAAM,GAAG,SAG3D,CAAA;AAyBH;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,KAAG,MACoC,CAAA;AAEpF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,aAAa,GAAG,SAsB9D,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAC3B,OAAO,SAAS,MAAM,EAAE,EACxB,SAAS,MAAM,KACd,SAAS,aAAa,EAaxB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,MAK9C,CAAA;AAmCD;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,MAAM,EAAE,SAAS,MAAM,KAAG,OACL,CAAA"}

package/dist/route-map.js

@@ -0,0 +1,168 @@
+// Map Next.js route files to URL patterns for comparison with actual crawl results.
+// Next.js reads a page from any of these; `pageExtensions` can add more, which is one of the reasons
+// the module comment above declines to guess at a configured project.
+const PAGE_FILES = new Set([
+    'page.tsx',
+    'page.ts',
+    'page.jsx',
+    'page.js',
+    'page.mdx',
+]);
+// A root layout is required of a Next.js application and of nothing else, so it is what tells an app
+// directory apart from a directory that happens to be called `app`.
+const ROOT_LAYOUTS = new Set([
+    'layout.tsx',
+    'layout.ts',
+    'layout.jsx',
+    'layout.js',
+]);
+// `src/app` first, because that is where a Payload application puts it and where a stray top-level
+// `app/` is least likely to be mistaken for one.
+const APP_ROOTS = ['src/app', 'app'];
+const ROOT_ROUTE = '/';
+const SEGMENT_SEPARATOR = '/';
+// Whether a path is the ROOT layout of a candidate app directory. Next.js requires one, and allows it
+// to sit inside route groups rather than at the top: a Payload application has no `src/app/layout.tsx`
+// at all, because `(frontend)` and `(payload)` each carry their own. Requiring the top-level file
+// found no app directory in the commonest project this harness governs, and the check then passed by
+// doing nothing - which is the one way a rule like this fails that nobody notices.
+const isRootLayout = (path, root) => {
+    const prefix = `${root}${SEGMENT_SEPARATOR}`;
+    if (!path.startsWith(prefix)) {
+        return false;
+    }
+    const segments = path.slice(prefix.length).split(SEGMENT_SEPARATOR);
+    const addressed = segments.filter((segment) => !isRouteGroup(segment));
+    return addressed.length === 1 && ROOT_LAYOUTS.has(addressed[0] ?? '');
+};
+/**
+ * Which directory holds the application's routes.
+ *
+ * Chosen from the conventional two rather than searched for, and confirmed by the root layout Next.js
+ * requires, so a library with a `src/app` module of its own is not mistaken for an application.
+ * @param paths every file of the member, relative to its root, separated by forward slashes.
+ * @returns the app directory, or nothing when the member declares no routes.
+ */
+export const appRootOf = (paths) => APP_ROOTS.find((root) => paths.some((path) => isRootLayout(path, root)));
+// A segment wholly inside parentheses is a route group: it organises the tree and contributes nothing
+// to the address. `(.)photo` is not one - it is an intercepting route, and it opens with a parenthesis
+// without closing on one, which is exactly what tells the two apart.
+const isRouteGroup = (segment) => segment.startsWith('(') && segment.endsWith(')');
+// `(.)`, `(..)`, `(...)` and `(..)(..)`, each followed by the segment being intercepted. A file behind
+// one of these declares no independently reachable address: on a hard navigation the INTERCEPTED route
+// renders instead, and that route has a declaration of its own. So the file is skipped rather than
+// mapped to an address no server serves.
+const isIntercepting = (segment) => segment.startsWith('(') && !segment.endsWith(')');
+// A slot of a parallel route. Its own `page` file is the slot's default content, rendered by the
+// parent's layout rather than at an address of its own, so the segment is dropped and the address that
+// results is the parent's - which the parent already declares, and which the dedup below collapses.
+const isParallelSlot = (segment) => segment.startsWith('@');
+// Next.js serves nothing from a folder whose name opens with an underscore.
+const isPrivate = (segment) => segment.startsWith('_');
+const isDynamicSegment = (segment) => segment.startsWith('[') && segment.endsWith(']');
+/**
+ * Strip a trailing slash, so an address written with one and an address written without are one.
+ *
+ * The crawl records whatever `URL.pathname` gave it and a link may be written either way, while a file
+ * tree never produces a trailing slash at all. Comparing the two without this reports every page of a
+ * project that sets `trailingSlash`.
+ * @param route the address to normalise.
+ * @returns the address without its trailing slash, and the root route unchanged.
+ */
+export const normalisedRoute = (route) => route.length > 1 && route.endsWith(SEGMENT_SEPARATOR) ? route.slice(0, -1) : route;
+/**
+ * The address one file answers at, if it declares a page at all.
+ * @param file the file, relative to the app directory.
+ * @returns the declared route, or nothing when the file declares no independently reachable address.
+ */
+export const declaredRouteOf = (file) => {
+    const parts = file.split(SEGMENT_SEPARATOR);
+    if (!PAGE_FILES.has(parts.at(-1) ?? '')) {
+        return undefined;
+    }
+    const directories = parts.slice(0, -1);
+    if (directories.some((segment) => isPrivate(segment) || isIntercepting(segment))) {
+        return undefined;
+    }
+    const addressed = directories.filter((segment) => !(isRouteGroup(segment) || isParallelSlot(segment)));
+    return {
+        file,
+        route: addressed.length === 0
+            ? ROOT_ROUTE
+            : `${SEGMENT_SEPARATOR}${addressed.join(SEGMENT_SEPARATOR)}`,
+        isDynamic: addressed.some((segment) => isDynamicSegment(segment)),
+    };
+};
+/**
+ * Every address a member's file tree declares.
+ *
+ * Deduplicated by address, because a parallel route's slot and the page beside it reduce to the same
+ * one and reporting it twice would ask a project to answer for the same page under two file names.
+ * @param paths every file of the member, relative to its root, separated by forward slashes.
+ * @param appRoot the app directory, as `appRootOf` chose it.
+ * @returns one entry per declared address, in the order the paths were given.
+ */
+export const declaredRoutesOf = (paths, appRoot) => {
+    const prefix = `${appRoot}${SEGMENT_SEPARATOR}`;
+    const declared = paths.flatMap((file) => {
+        if (!file.startsWith(prefix)) {
+            return [];
+        }
+        const found = declaredRouteOf(file.slice(prefix.length));
+        return found === undefined ? [] : [{ ...found, file }];
+    });
+    return declared.filter((route, index) => declared.findIndex((other) => other.route === route.route) === index);
+};
+/**
+ * The part of an address before its first dynamic segment.
+ *
+ * What a specification can be searched for when the address itself cannot be: a spec never contains
+ * `/posts/[slug]`, it contains `/posts/` and then a value.
+ * @param route the declared address.
+ * @returns the leading static part, which is the root route when the first segment is dynamic.
+ */
+export const staticPrefixOf = (route) => {
+    const segments = route.split(SEGMENT_SEPARATOR).slice(1);
+    const upTo = segments.findIndex((segment) => isDynamicSegment(segment));
+    const kept = upTo === -1 ? segments : segments.slice(0, upTo);
+    return kept.length === 0 ? ROOT_ROUTE : `${SEGMENT_SEPARATOR}${kept.join(SEGMENT_SEPARATOR)}`;
+};
+// An address as the segments it is made of, with the leading slash and any trailing one gone. The root
+// route is no segments at all, which is what lets an optional catch-all match it.
+const segmentsOf = (route) => normalisedRoute(route)
+    .split(SEGMENT_SEPARATOR)
+    .filter((segment) => segment !== '');
+const isCatchAll = (segment) => segment.startsWith('[...') && segment.endsWith(']');
+const isOptionalCatchAll = (segment) => segment.startsWith('[[...') && segment.endsWith(']]');
+// Segment by segment, because a catch-all is the only one whose width is not one and Next.js allows it
+// only in the last position. Written as a recursion rather than a regular expression: the address a
+// project declares is attacker-adjacent text in no sense, but a pattern built by concatenation is one
+// nobody can read afterwards, and the whole point of this module is that its edge cases are legible.
+const matchesSegments = (pattern, actual) => {
+    const [head, ...rest] = pattern;
+    if (head === undefined) {
+        return actual.length === 0;
+    }
+    if (isOptionalCatchAll(head)) {
+        return true;
+    }
+    if (isCatchAll(head)) {
+        return actual.length > 0;
+    }
+    if (isDynamicSegment(head)) {
+        return actual.length > 0 && matchesSegments(rest, actual.slice(1));
+    }
+    return actual[0] === head && matchesSegments(rest, actual.slice(1));
+};
+/**
+ * Whether one visited address is a page the declared route produces.
+ *
+ * A static route matches itself. A dynamic one matches any address its segments admit, which is what
+ * lets the crawl answer for it: if the sweep scanned `/posts/hello`, the file behind `/posts/[slug]`
+ * has been scanned, whatever else it can also serve.
+ * @param route the declared address, dynamic segments in their file-tree spelling.
+ * @param visited an address the crawl reached.
+ * @returns true when scanning that address scanned this route.
+ */
+export const matchesRoute = (route, visited) => matchesSegments(segmentsOf(route), segmentsOf(visited));
+//# sourceMappingURL=route-map.js.map

package/dist/route-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-map.js","sourceRoot":"","sources":["../src/route-map.ts"],"names":[],"mappings":"AAAA,oFAAoF;AAYpF,qGAAqG;AACrG,sEAAsE;AACtE,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAS;IACtD,UAAU;IACV,SAAS;IACT,UAAU;IACV,SAAS;IACT,UAAU;CACX,CAAC,CAAA;AAEF,qGAAqG;AACrG,oEAAoE;AACpE,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAS;IACxD,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;CACZ,CAAC,CAAA;AAEF,mGAAmG;AACnG,iDAAiD;AACjD,MAAM,SAAS,GAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;AAEvD,MAAM,UAAU,GAAW,GAAG,CAAA;AAE9B,MAAM,iBAAiB,GAAW,GAAG,CAAA;AAErC,sGAAsG;AACtG,uGAAuG;AACvG,kGAAkG;AAClG,qGAAqG;AACrG,mFAAmF;AACnF,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE;IAC3D,MAAM,MAAM,GAAW,GAAG,IAAI,GAAG,iBAAiB,EAAE,CAAA;IACpD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,QAAQ,GAAsB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACtF,MAAM,SAAS,GAAsB,QAAQ,CAAC,MAAM,CAClD,CAAC,OAAe,EAAW,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CACrD,CAAA;IACD,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AACvE,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAwB,EAAsB,EAAE,CACxE,SAAS,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CACvC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAChE,CAAA;AAEH,sGAAsG;AACtG,uGAAuG;AACvG,qEAAqE;AACrE,MAAM,YAAY,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAEnG,uGAAuG;AACvG,uGAAuG;AACvG,mGAAmG;AACnG,yCAAyC;AACzC,MAAM,cAAc,GAAG,CAAC,OAAe,EAAW,EAAE,CAClD,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAEnD,iGAAiG;AACjG,uGAAuG;AACvG,oGAAoG;AACpG,MAAM,cAAc,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;AAE5E,4EAA4E;AAC5E,MAAM,SAAS,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;AAEvE,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAW,EAAE,CACpD,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAElD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CACvD,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAA6B,EAAE;IACzE,MAAM,KAAK,GAAsB,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IAC9D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACxC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,WAAW,GAAsB,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACzD,IACE,WAAW,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,EAC7F,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAsB,WAAW,CAAC,MAAM,CACrD,CAAC,OAAe,EAAW,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,CAClF,CAAA;IACD,OAAO;QACL,IAAI;QACJ,KAAK,EACH,SAAS,CAAC,MAAM,KAAK,CAAC;YACpB,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,GAAG,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE;QAChE,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;KACnF,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,KAAwB,EACxB,OAAe,EACW,EAAE;IAC5B,MAAM,MAAM,GAAW,GAAG,OAAO,GAAG,iBAAiB,EAAE,CAAA;IACvD,MAAM,QAAQ,GAA6B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAY,EAAmB,EAAE;QACzF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,KAAK,GAA8B,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACnF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,KAAoB,EAAE,KAAa,EAAW,EAAE,CAC/C,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAoB,EAAW,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,CAC/F,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAU,EAAE;IACtD,MAAM,QAAQ,GAAsB,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3E,MAAM,IAAI,GAAW,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;IAChG,MAAM,IAAI,GAAsB,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAChF,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAA;AAC/F,CAAC,CAAA;AAED,uGAAuG;AACvG,kFAAkF;AAClF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAqB,EAAE,CACtD,eAAe,CAAC,KAAK,CAAC;KACnB,KAAK,CAAC,iBAAiB,CAAC;KACxB,MAAM,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAA;AAEzD,MAAM,UAAU,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAEpG,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAW,EAAE,CACtD,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAEvD,uGAAuG;AACvG,oGAAoG;AACpG,sGAAsG;AACtG,qGAAqG;AACrG,MAAM,eAAe,GAAG,CAAC,OAA0B,EAAE,MAAyB,EAAW,EAAE;IACzF,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAA;IAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAA;IAC5B,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;IAC1B,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AACrE,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,OAAe,EAAW,EAAE,CACtE,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA"}

package/dist/run-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-plan.d.ts","sourceRoot":"","sources":["../src/run-plan.ts"],"names":[],"mappings":"AAoBA,+CAA+C;AAC/C,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAA;AAE5D,0DAA0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CACpC;AAuBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,GACpB,OAAO,SAAS,cAAc,EAAE,EAChC,SAAS,SAAS,gBAAgB,EAAE,EACpC,YAAY,OAAO,KAClB,SAAS,QAAQ,EAGgE,CAAA"}
+{"version":3,"file":"run-plan.d.ts","sourceRoot":"","sources":["../src/run-plan.ts"],"names":[],"mappings":"AAEA,+CAA+C;AAC/C,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAA;AAE5D,0DAA0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CACpC;AAuBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,GACpB,OAAO,SAAS,cAAc,EAAE,EAChC,SAAS,SAAS,gBAAgB,EAAE,EACpC,YAAY,OAAO,KAClB,SAAS,QAAQ,EAGgE,CAAA"}

package/dist/run-plan.js

@@ -1,22 +1,4 @@
-// The order a verification run visits its gates, and which member each gate is asked about.
-//
-// The order is a rule, not an implementation detail: it decides which finding a project sees first, and
-// the reasoning behind it is stated in the guide - the structural gates that catch a mis-wired project
-// run before the analyzers whose output is harder to read, the tracked-tree fingerprint brackets
-// everything that could rewrite a file, and the two preconditions lead because a survey of findings
-// below either would be a list of verdicts about nothing.
-//
-// Registry order IS run order, and this module deliberately adds no second ordering rule on top of it.
-// Grouping the run by member instead - every gate for one member, then the next - reads better in a
-// multi-member report, and it was the first design here. It was dropped because it also reorders a
-// SINGLE-member run, which is every consumer that exists today: `conventions` would overtake `eslint`,
-// the container gates would move to the end, and a project's first finding could change without one
-// rule changing. Making workspaces work is not a licence to renumber the run for projects that have no
-// workspace. A repository with one member therefore produces exactly the sequence that shipped before
-// members existed, and that equality is pinned by a spec rather than argued.
-//
-// The cost is that a multi-member run interleaves members gate by gate. The report layer answers that by
-// labelling each step with its member, which costs a single-member run nothing because it has none.
+// Expand gates in registry order across their applicable members; tree verification remains last.
 // A package-scope gate asks about every member; a payload-scope gate asks only about the members that
 // are Payload applications. Derived from what the member declares rather than from anything it opts
 // into, so a project cannot silence the Payload rules by describing itself differently.

package/dist/run-plan.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-plan.js","sourceRoot":"","sources":["../src/run-plan.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,EAAE;AACF,wGAAwG;AACxG,uGAAuG;AACvG,iGAAiG;AACjG,oGAAoG;AACpG,0DAA0D;AAC1D,EAAE;AACF,uGAAuG;AACvG,oGAAoG;AACpG,mGAAmG;AACnG,uGAAuG;AACvG,oGAAoG;AACpG,uGAAuG;AACvG,sGAAsG;AACtG,6EAA6E;AAC7E,EAAE;AACF,yGAAyG;AACzG,oGAAoG;AAyBpG,sGAAsG;AACtG,oGAAoG;AACpG,wFAAwF;AACxF,MAAM,UAAU,GAAG,CACjB,IAAoB,EACpB,OAAoC,EACP,EAAE,CAC/B,IAAI,CAAC,KAAK,KAAK,SAAS;IACtB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAwB,EAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;IACzE,CAAC,CAAC,OAAO,CAAA;AAEb,MAAM,QAAQ,GAAG,CACf,IAAoB,EACpB,OAAoC,EACf,EAAE,CACvB,IAAI,CAAC,KAAK,KAAK,YAAY;IACzB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAC3B,CAAC,MAAwB,EAAY,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CACnF,CAAA;AAEP;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,KAAgC,EAChC,OAAoC,EACpC,UAAmB,EACE,EAAE,CACvB,KAAK;KACF,MAAM,CAAC,CAAC,IAAoB,EAAW,EAAE,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;KACzE,OAAO,CAAC,CAAC,IAAoB,EAAuB,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA"}
+{"version":3,"file":"run-plan.js","sourceRoot":"","sources":["../src/run-plan.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAyBlG,sGAAsG;AACtG,oGAAoG;AACpG,wFAAwF;AACxF,MAAM,UAAU,GAAG,CACjB,IAAoB,EACpB,OAAoC,EACP,EAAE,CAC/B,IAAI,CAAC,KAAK,KAAK,SAAS;IACtB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAwB,EAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;IACzE,CAAC,CAAC,OAAO,CAAA;AAEb,MAAM,QAAQ,GAAG,CACf,IAAoB,EACpB,OAAoC,EACf,EAAE,CACvB,IAAI,CAAC,KAAK,KAAK,YAAY;IACzB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAC3B,CAAC,MAAwB,EAAY,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CACnF,CAAA;AAEP;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,KAAgC,EAChC,OAAoC,EACpC,UAAmB,EACE,EAAE,CACvB,KAAK;KACF,MAAM,CAAC,CAAC,IAAoB,EAAW,EAAE,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;KACzE,OAAO,CAAC,CAAC,IAAoB,EAAuB,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA"}

package/dist/secret-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-policy.d.ts","sourceRoot":"","sources":["../src/secret-policy.ts"],"names":[],"mappings":"AAaA,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AA2CD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,YAAY,SAAS,eAAe,EAAE,KAAG,MAiB7E,CAAA"}
+{"version":3,"file":"secret-policy.d.ts","sourceRoot":"","sources":["../src/secret-policy.ts"],"names":[],"mappings":"AAGA,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AA2CD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,YAAY,SAAS,eAAe,EAAE,KAAG,MAiB7E,CAAA"}

package/dist/secret-policy.js

@@ -1,14 +1,4 @@
-// The secret allowlist.
-//
-// The standard requires a repository to list every fake credential it commits as a test fixture, and
-// requires the secret scan to fail on anything outside that list. Until now there was no way to satisfy
-// both: `.gitleaks.toml` is a forbidden managed path, precisely so a project cannot weaken the scanner's
-// own rules, and no setting replaced it. A project with a fixture credential could not pass at all.
-//
-// The resolution keeps the file forbidden and makes the allowlist data instead. ploaness renders the
-// scanner's configuration itself, outside the working tree, from entries the project declares. The
-// rendered config always extends the tool's default rules, so a declared entry can only add a named
-// exception and can never replace or disable what the scanner already looks for.
+// Allow declared fake credentials without replacing scanner rules or narrowing unrelated files.
 import { escapeForRegex } from './text-escapes.js';
 // The characters a TOML basic string cannot carry literally: its two delimiters, and every control
 // character. Named by code point rather than written out, for the reason `banned-typography.ts` gives:
@@ -24,15 +14,15 @@ const NAMED_ESCAPES = new Map([
     ['\r', String.raw `\r`],
     ['\t', String.raw `\t`],
 ]);
-// `Number(...)` rather than a fallback: `codePointAt` is typed as possibly undefined, an empty string
-// yields NaN, and `NaN < FIRST_PRINTABLE` is false - so the character passes through as itself without
-// a branch no input can reach.
+// `?? Number.NaN` rather than an `undefined` branch: `codePointAt` is typed as possibly undefined, but
+// the caller spreads a string into code points so no character here is empty. NaN keeps the comparison
+// below false, so the character passes through as itself without a branch no input can reach.
 const escapeCharacter = (character) => {
     const named = NAMED_ESCAPES.get(character);
     if (named !== undefined) {
         return named;
     }
-    const codePoint = Number(character.codePointAt(0));
+    const codePoint = character.codePointAt(0) ?? Number.NaN;
     return codePoint < FIRST_PRINTABLE ? String.raw `\u${asHex(codePoint)}` : character;
 };
 // A basic TOML string, which is the only string form that escapes anything. Both fields go through it.

package/dist/secret-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-policy.js","sourceRoot":"","sources":["../src/secret-policy.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,EAAE;AACF,qGAAqG;AACrG,wGAAwG;AACxG,yGAAyG;AACzG,oGAAoG;AACpG,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,oGAAoG;AACpG,iFAAiF;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AASlD,mGAAmG;AACnG,uGAAuG;AACvG,wFAAwF;AACxF,MAAM,eAAe,GAAW,IAAI,CAAA;AACpC,MAAM,SAAS,GAAW,EAAE,CAAA;AAC5B,MAAM,qBAAqB,GAAW,CAAC,CAAA;AAEvC,MAAM,KAAK,GAAG,CAAC,SAAiB,EAAU,EAAE,CAC1C,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAA;AAEpE,MAAM,aAAa,GAAgC,IAAI,GAAG,CAAC;IACzD,CAAC,IAAI,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACrB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACtB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACtB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;CACvB,CAAC,CAAA;AAEF,sGAAsG;AACtG,uGAAuG;AACvG,+BAA+B;AAC/B,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAU,EAAE;IACpD,MAAM,KAAK,GAAuB,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,SAAS,GAAW,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,OAAO,SAAS,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACpF,CAAC,CAAA;AAED,uGAAuG;AACvG,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE;AAC9C,iGAAiG;AACjG,sFAAsF;AACtF,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,SAAiB,EAAU,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAsC,EAAU,EAAE;IACrF,MAAM,MAAM,GAAW;QACrB,mGAAmG;QACnG,2EAA2E;QAC3E,UAAU;QACV,mBAAmB;QACnB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,MAAM,MAAM,GAAsB,UAAU,CAAC,GAAG,CAAC,CAAC,SAA0B,EAAU,EAAE,CACtF;QACE,gBAAgB;QAChB,kBAAkB,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG;QACpD,cAAc,aAAa,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK;QAChE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAA;IACD,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvC,CAAC,CAAA"}
+{"version":3,"file":"secret-policy.js","sourceRoot":"","sources":["../src/secret-policy.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AASlD,mGAAmG;AACnG,uGAAuG;AACvG,wFAAwF;AACxF,MAAM,eAAe,GAAW,IAAI,CAAA;AACpC,MAAM,SAAS,GAAW,EAAE,CAAA;AAC5B,MAAM,qBAAqB,GAAW,CAAC,CAAA;AAEvC,MAAM,KAAK,GAAG,CAAC,SAAiB,EAAU,EAAE,CAC1C,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAA;AAEpE,MAAM,aAAa,GAAgC,IAAI,GAAG,CAAC;IACzD,CAAC,IAAI,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACrB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACtB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACtB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;CACvB,CAAC,CAAA;AAEF,uGAAuG;AACvG,uGAAuG;AACvG,8FAA8F;AAC9F,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAU,EAAE;IACpD,MAAM,KAAK,GAAuB,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,SAAS,GAAW,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAA;IAChE,OAAO,SAAS,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACpF,CAAC,CAAA;AAED,uGAAuG;AACvG,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE;AAC9C,iGAAiG;AACjG,sFAAsF;AACtF,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,SAAiB,EAAU,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAsC,EAAU,EAAE;IACrF,MAAM,MAAM,GAAW;QACrB,mGAAmG;QACnG,2EAA2E;QAC3E,UAAU;QACV,mBAAmB;QACnB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,MAAM,MAAM,GAAsB,UAAU,CAAC,GAAG,CAAC,CAAC,SAA0B,EAAU,EAAE,CACtF;QACE,gBAAgB;QAChB,kBAAkB,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG;QACpD,cAAc,aAAa,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK;QAChE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAA;IACD,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvC,CAAC,CAAA"}

package/dist/settings-layering.d.ts

@@ -7,39 +7,17 @@ import { type DeclaredExclusion, type Settings } from './settings.js';
  */
 export declare const layerSettingBlocks: (base: Record<string, unknown>, overlay: Record<string, unknown>) => Record<string, unknown>;
 /**
- * Move a member's exclusion into the repository's path space.
- *
- * The gates that walk the tracked tree run once, at the repository root, while a member declares its
- * exclusions relative to itself. `^src/generated/` written inside `apps/web` therefore matches nothing
- * when the repository-scope gate walks past `apps/web/src/generated/`, and a generated directory a
- * project correctly excused starts failing the typography ban.
- *
- * An UNANCHORED pattern is left alone, deliberately. `importMap\.js$` already matches at any depth, and
- * prefixing it would narrow it to one member - so the rule errs toward a pattern that matches too much
- * at repository scope rather than one that silently stops matching. Too wide is the safe direction here:
- * a repository-scope gate that skips one extra path reports one fewer finding, while a narrowed pattern
- * reports a project for a file it had already accounted for.
- * @param memberPath the member's repo-relative path, `.` for the member at the root.
- * @param entry the exclusion as the member declared it.
- * @returns the exclusion as the repository-scope gates must read it.
+ * Preserve a regex's package-relative meaning when repository gates read member exclusions.
+ * @param memberPath the declaring package's repository-relative path.
+ * @param entry the original exclusion.
+ * @returns a scoped regex, a rebased glob, or the unchanged root/route declaration.
  */
 export declare const rebaseExclusion: (memberPath: string, entry: DeclaredExclusion) => DeclaredExclusion;
 /**
- * The settings one member runs under.
- *
- * Effective VALUES are layered - a member inherits the repository's source roots, its typography
- * exclusions, its floor. `declaredExclusions` is not, and that asymmetry is the point: it is the list of
- * decisions THIS package made, and every consumer of it judges the declarer. Layering it made a member
- * answer for the repository's declarations, so a workspace root that correctly excused its Vale detector
- * definitions - whose content IS the character the ban detects - had every member report that exclusion
- * as reaching nothing, because no member contains the file. One correct declaration, two gates failed,
- * and nothing a member could edit would have fixed it.
- *
- * The mirror direction was already handled: `rebaseExclusion` moves a member's exclusion up into the
- * repository's path space. This is the same seam read downward.
- * @param repositoryBlock the raw `ploaness` block of the repository root.
- * @param ownBlock the raw `ploaness` block of the member itself.
- * @returns the member's settings, inheriting values and owning declarations.
+ * Inherit effective values while retaining only the member's own declarations for reach checks.
+ * @param repositoryBlock the root settings before defaults.
+ * @param ownBlock the member settings before defaults.
+ * @returns effective settings and the member's declared exclusions.
  */
 export declare const readMemberSettings: (repositoryBlock: Record<string, unknown>, ownBlock: Record<string, unknown>) => Settings;
 //# sourceMappingURL=settings-layering.d.ts.map

package/dist/settings-layering.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-layering.d.ts","sourceRoot":"","sources":["../src/settings-layering.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,KAAK,iBAAiB,EAAmB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAA;AA8DtF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAUxB,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,eAAe,GAC1B,YAAY,MAAM,EAClB,OAAO,iBAAiB,KACvB,iBAaF,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,kBAAkB,GAC7B,iBAAiB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAChC,QAGD,CAAA"}
+{"version":3,"file":"settings-layering.d.ts","sourceRoot":"","sources":["../src/settings-layering.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,iBAAiB,EAAmB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAA;AAoEtF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAUxB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAC1B,YAAY,MAAM,EAClB,OAAO,iBAAiB,KACvB,iBAWF,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,iBAAiB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAChC,QAGD,CAAA"}

package/dist/settings-layering.js

@@ -1,13 +1,4 @@
-// How a member's settings sit on top of the repository's.
-//
-// A workspace declares some facts once and some per package. Which is which is not uniform, and reading
-// it wrong is silent either way: concatenating two `pretest` commands would run a mangled argv, while
-// letting a member REPLACE `sourceRoots` would narrow the scope the harness refuses to narrow.
-//
-// Layering happens on the RAW blocks, before any default is applied. Merging defaulted objects instead
-// would make "declared nothing" indistinguishable from "declared exactly the default", so a repository
-// that declared a stricter bundle budget would be silently overwritten by every member that declared
-// none.
+// Layer raw declarations before defaults, preserving inherited constraints and each member's ownership.
 import { asRecord, isArray } from './json-shapes.js';
 import { readRawSettings } from './settings.js';
 /** Keys where a member ADDS to what the repository declared, the way `sourceRoots` always has. */
@@ -23,6 +14,7 @@ const ADDITIVE = new Set([
     'auxiliaryServers',
     'accessibilitySkipRoutes',
     'frameworkGlue',
+    'generatedArtefacts',
     'pureLogicRoots',
 ]);
 // Keys where only a smaller number is honoured. A member may hold itself to more than the repository
@@ -44,18 +36,21 @@ const mergeArrays = (base, overlay) => [
     ...(isArray(base) ? base : []),
     ...(isArray(overlay) ? overlay : []),
 ];
-const smaller = (base, overlay) => {
-    if (typeof base !== 'number') {
-        return overlay;
+const isValidCeiling = (key, value) => typeof value === 'number' &&
+    Number.isSafeInteger(value) &&
+    (key === 'maxSuppressions' ? value >= 0 : value > 0);
+const smaller = (key, base, overlay) => {
+    if (!isValidCeiling(key, base)) {
+        return isValidCeiling(key, overlay) ? overlay : undefined;
     }
-    return typeof overlay === 'number' ? Math.min(base, overlay) : base;
+    return isValidCeiling(key, overlay) ? Math.min(base, overlay) : base;
 };
 const mergeValue = (key, base, overlay) => {
     if (ADDITIVE.has(key)) {
         return mergeArrays(base, overlay);
     }
     if (STRICTEST_NUMBER.has(key)) {
-        return smaller(base, overlay);
+        return smaller(key, base, overlay);
     }
     if (REPLACED.has(key)) {
         return overlay ?? base;
@@ -80,21 +75,10 @@ export const layerSettingBlocks = (base, overlay) => {
     ]));
 };
 /**
- * Move a member's exclusion into the repository's path space.
- *
- * The gates that walk the tracked tree run once, at the repository root, while a member declares its
- * exclusions relative to itself. `^src/generated/` written inside `apps/web` therefore matches nothing
- * when the repository-scope gate walks past `apps/web/src/generated/`, and a generated directory a
- * project correctly excused starts failing the typography ban.
- *
- * An UNANCHORED pattern is left alone, deliberately. `importMap\.js$` already matches at any depth, and
- * prefixing it would narrow it to one member - so the rule errs toward a pattern that matches too much
- * at repository scope rather than one that silently stops matching. Too wide is the safe direction here:
- * a repository-scope gate that skips one extra path reports one fewer finding, while a narrowed pattern
- * reports a project for a file it had already accounted for.
- * @param memberPath the member's repo-relative path, `.` for the member at the root.
- * @param entry the exclusion as the member declared it.
- * @returns the exclusion as the repository-scope gates must read it.
+ * Preserve a regex's package-relative meaning when repository gates read member exclusions.
+ * @param memberPath the declaring package's repository-relative path.
+ * @param entry the original exclusion.
+ * @returns a scoped regex, a rebased glob, or the unchanged root/route declaration.
  */
 export const rebaseExclusion = (memberPath, entry) => {
     if (memberPath === '.') {
@@ -106,26 +90,13 @@ export const rebaseExclusion = (memberPath, entry) => {
     if (entry.kind === 'glob') {
         return { ...entry, pattern: `${memberPath}/${entry.pattern}` };
     }
-    return entry.pattern.startsWith('^')
-        ? { ...entry, pattern: `^${memberPath}/${entry.pattern.slice(1)}` }
-        : entry;
+    return { ...entry, memberPath };
 };
 /**
- * The settings one member runs under.
- *
- * Effective VALUES are layered - a member inherits the repository's source roots, its typography
- * exclusions, its floor. `declaredExclusions` is not, and that asymmetry is the point: it is the list of
- * decisions THIS package made, and every consumer of it judges the declarer. Layering it made a member
- * answer for the repository's declarations, so a workspace root that correctly excused its Vale detector
- * definitions - whose content IS the character the ban detects - had every member report that exclusion
- * as reaching nothing, because no member contains the file. One correct declaration, two gates failed,
- * and nothing a member could edit would have fixed it.
- *
- * The mirror direction was already handled: `rebaseExclusion` moves a member's exclusion up into the
- * repository's path space. This is the same seam read downward.
- * @param repositoryBlock the raw `ploaness` block of the repository root.
- * @param ownBlock the raw `ploaness` block of the member itself.
- * @returns the member's settings, inheriting values and owning declarations.
+ * Inherit effective values while retaining only the member's own declarations for reach checks.
+ * @param repositoryBlock the root settings before defaults.
+ * @param ownBlock the member settings before defaults.
+ * @returns effective settings and the member's declared exclusions.
  */
 export const readMemberSettings = (repositoryBlock, ownBlock) => ({
     ...readRawSettings(layerSettingBlocks(repositoryBlock, ownBlock)),

package/dist/settings-layering.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings-layering.js","sourceRoot":"","sources":["../src/settings-layering.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,wGAAwG;AACxG,sGAAsG;AACtG,+FAA+F;AAC/F,EAAE;AACF,uGAAuG;AACvG,uGAAuG;AACvG,qGAAqG;AACrG,QAAQ;AACR,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAA0B,eAAe,EAAiB,MAAM,eAAe,CAAA;AAEtF,kGAAkG;AAClG,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAS;IACpD,aAAa;IACb,iBAAiB;IACjB,sBAAsB;IACtB,qBAAqB;IACrB,iBAAiB;IACjB,wBAAwB;IACxB,iBAAiB;IACjB,cAAc;IACd,kBAAkB;IAClB,yBAAyB;IACzB,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAA;AAEF,qGAAqG;AACrG,qGAAqG;AACrG,eAAe;AACf,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAS;IAC5D,0BAA0B;IAC1B,mBAAmB;IACnB,iBAAiB;CAClB,CAAC,CAAA;AAEF,2GAA2G;AAC3G,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAS;IACpD,SAAS;IACT,aAAa;IACb,WAAW;IACX,uBAAuB;CACxB,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,IAAa,EAAE,OAAgB,EAAW,EAAE,CAAC;IAChE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;CACrC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,IAAa,EAAE,OAAgB,EAAW,EAAE;IAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACrE,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAa,EAAE,OAAgB,EAAW,EAAE;IAC3E,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC;IACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,OAAO,IAAI,IAAI,CAAA;IACxB,CAAC;IACD,qGAAqG;IACrG,oEAAoE;IACpE,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAA;AACpD,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,IAA6B,EAC7B,OAAgC,EACP,EAAE;IAC3B,MAAM,IAAI,GAAwB,IAAI,GAAG,CAAS,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAClG,OAAO,MAAM,CAAC,WAAW,CACvB,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAW,EAA8B,EAAE,CAAC;QACzD,GAAG;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC;YACrD,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;KAChC,CAAC,CACH,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,UAAkB,EAClB,KAAwB,EACL,EAAE;IACrB,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAA;IAChE,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAClC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QACnE,CAAC,CAAC,KAAK,CAAA;AACX,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,eAAwC,EACxC,QAAiC,EACvB,EAAE,CAAC,CAAC;IACd,GAAG,eAAe,CAAC,kBAAkB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACjE,kBAAkB,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,kBAAkB;CACjE,CAAC,CAAA"}
+{"version":3,"file":"settings-layering.js","sourceRoot":"","sources":["../src/settings-layering.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAA0B,eAAe,EAAiB,MAAM,eAAe,CAAA;AAEtF,kGAAkG;AAClG,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAS;IACpD,aAAa;IACb,iBAAiB;IACjB,sBAAsB;IACtB,qBAAqB;IACrB,iBAAiB;IACjB,wBAAwB;IACxB,iBAAiB;IACjB,cAAc;IACd,kBAAkB;IAClB,yBAAyB;IACzB,eAAe;IACf,oBAAoB;IACpB,gBAAgB;CACjB,CAAC,CAAA;AAEF,qGAAqG;AACrG,qGAAqG;AACrG,eAAe;AACf,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAS;IAC5D,0BAA0B;IAC1B,mBAAmB;IACnB,iBAAiB;CAClB,CAAC,CAAA;AAEF,2GAA2G;AAC3G,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAS;IACpD,SAAS;IACT,aAAa;IACb,WAAW;IACX,uBAAuB;CACxB,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,IAAa,EAAE,OAAgB,EAAW,EAAE,CAAC;IAChE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;CACrC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,KAAc,EAAmB,EAAE,CACtE,OAAO,KAAK,KAAK,QAAQ;IACzB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;IAC3B,CAAC,GAAG,KAAK,iBAAiB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;AAEtD,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,IAAa,EAAE,OAAgB,EAAW,EAAE;IACxE,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3D,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACtE,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAa,EAAE,OAAgB,EAAW,EAAE;IAC3E,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC;IACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACpC,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,OAAO,IAAI,IAAI,CAAA;IACxB,CAAC;IACD,qGAAqG;IACrG,oEAAoE;IACpE,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAA;AACpD,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,IAA6B,EAC7B,OAAgC,EACP,EAAE;IAC3B,MAAM,IAAI,GAAwB,IAAI,GAAG,CAAS,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAClG,OAAO,MAAM,CAAC,WAAW,CACvB,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAW,EAA8B,EAAE,CAAC;QACzD,GAAG;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC;YACrD,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;KAChC,CAAC,CACH,CAAA;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,UAAkB,EAClB,KAAwB,EACL,EAAE;IACrB,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAA;IAChE,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,CAAA;AACjC,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,eAAwC,EACxC,QAAiC,EACvB,EAAE,CAAC,CAAC;IACd,GAAG,eAAe,CAAC,kBAAkB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACjE,kBAAkB,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,kBAAkB;CACjE,CAAC,CAAA"}

package/dist/settings.d.ts

@@ -1,3 +1,4 @@
+import { type RolePattern } from './file-roles.js';
 import type { SecretException } from './secret-policy.js';
 import type { VulnerabilityException } from './vulnerability-policy.js';
 /**
@@ -8,6 +9,8 @@ import type { VulnerabilityException } from './vulnerability-policy.js';
 export type ExclusionKind = 'regex' | 'glob' | 'route';
 /** One exclusion a project declared, and the file role it claims. */
 export interface DeclaredExclusion {
+    /** Internal scope retained when a repository gate reads a member-owned regex. */
+    readonly memberPath?: string;
     /** Which setting it came from, so a finding can name it. */
     readonly setting: string;
     readonly pattern: string;
@@ -29,6 +32,20 @@ export interface PublicAccess {
     /** The operation granted: create, read, update, or delete. */
     readonly operation: string;
     readonly reason: string;
+    /**
+     * The fields of that entity a stranger reaches through this operation, each named by the path that
+     * reaches it (`sessions.id`), and `*` for the map Payload collapsed because every field was open.
+     *
+     * One entry carries the whole list rather than one entry per field, because a public collection has
+     * as many readable fields as it has columns and a list of twelve declarations sharing one reason is
+     * a list nobody rereads. A field absent from the list is undeclared, so adding a column to a public
+     * collection reopens the finding, which is the moment worth stopping at.
+     *
+     * A path ending in `.**` (`sizes.**`) declares that group and every field beneath it, including one
+     * added there later, which is the trade that form makes; `**` anywhere else is a literal name that
+     * matches nothing.
+     */
+    readonly fields?: readonly string[];
 }
 /** A managed path a project has taken over from the catalogue, with the reason it did so. */
 export interface UnmanagedAsset {
@@ -65,7 +82,7 @@ export interface Settings {
     /** Managed paths the project owns instead, each with a recorded reason. */
     readonly unmanagedAssets: readonly UnmanagedAsset[];
     /** Repo-relative path patterns exempt from the typography ban (generated files only). */
-    readonly typographyExclusions: readonly string[];
+    readonly typographyExclusions: readonly RolePattern[];
     /**
      * Paths holding framework-generated scaffolding, which the lint pass relaxes rather than judges.
      *
@@ -97,7 +114,7 @@ export interface Settings {
     /** Every exclusion the project declared, honoured or not, so a gate can judge them. */
     readonly declaredExclusions: readonly DeclaredExclusion[];
     /** Repo-relative path patterns exempt from the hand-written-JavaScript ban. */
-    readonly javascriptAllowlist: readonly string[];
+    readonly javascriptAllowlist: readonly RolePattern[];
     /** Glob patterns excluded from coverage measurement, by role rather than by convenience. */
     readonly coverageExclude: readonly string[];
     /** Ceiling for total gzipped client JavaScript, in bytes. */

package/dist/settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../src/settings.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AAEvE;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;AAEtD,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,mGAAmG;AACnG,MAAM,WAAW,QAAQ;IACvB,yFAAyF;IACzF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,SAAS,cAAc,EAAE,CAAA;IACnD,yFAAyF;IACzF,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAA;IAChD;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,uFAAuF;IACvF,QAAQ,CAAC,kBAAkB,EAAE,SAAS,iBAAiB,EAAE,CAAA;IACzD,+EAA+E;IAC/E,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/C,4FAA4F;IAC5F,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,6DAA6D;IAC7D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,qGAAqG;IACrG,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5C,iGAAiG;IACjG,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAA;IAClD,mEAAmE;IACnE,QAAQ,CAAC,sBAAsB,EAAE,SAAS,sBAAsB,EAAE,CAAA;IAClE,gGAAgG;IAChG,QAAQ,CAAC,eAAe,EAAE,SAAS,eAAe,EAAE,CAAA;IACpD,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,SAAS,YAAY,EAAE,CAAA;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,6GAA6G;IAC7G,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAA;IACrD;;;OAGG;IACH,QAAQ,CAAC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAA;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAA;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACvD;AAgDD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAAgC,CAAA;AAmBlF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAuC,CAAA;AA0KrF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,aAAa,OAAO,KAAG,QACP,CAAA;AAE7C,6EAA6E;AAC7E,eAAO,MAAM,aAAa,GAAI,aAAa,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAC9B,CAAA;AAS7C;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,QAmD9D,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GACpC,SAAS,SAAS,iBAAiB,EAAE,KACpC,SAAS,MAAM,EAQf,CAAA;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,GAClC,SAAS,SAAS,iBAAiB,EAAE,EACrC,YAAY,SAAS,MAAM,EAAE,KAC5B,SAAS,MAAM,EAWb,CAAA;AAeL;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAAI,OAAO,MAAM,KAAG,MACmB,CAAA;AAiBxE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAS9E,CAAA;AAuBD;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,GAC3C,SAAS,SAAS,iBAAiB,EAAE,EACrC,SAAS,SAAS,MAAM,EAAE,KACzB,SAAS,MAAM,EASf,CAAA"}
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../src/settings.ts"],"names":[],"mappings":"AAUA,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAK5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AAEvE;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;AAEtD,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,mGAAmG;AACnG,MAAM,WAAW,QAAQ;IACvB,yFAAyF;IACzF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,SAAS,cAAc,EAAE,CAAA;IACnD,yFAAyF;IACzF,QAAQ,CAAC,oBAAoB,EAAE,SAAS,WAAW,EAAE,CAAA;IACrD;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,uFAAuF;IACvF,QAAQ,CAAC,kBAAkB,EAAE,SAAS,iBAAiB,EAAE,CAAA;IACzD,+EAA+E;IAC/E,QAAQ,CAAC,mBAAmB,EAAE,SAAS,WAAW,EAAE,CAAA;IACpD,4FAA4F;IAC5F,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,6DAA6D;IAC7D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,qGAAqG;IACrG,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5C,iGAAiG;IACjG,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAA;IAClD,mEAAmE;IACnE,QAAQ,CAAC,sBAAsB,EAAE,SAAS,sBAAsB,EAAE,CAAA;IAClE,gGAAgG;IAChG,QAAQ,CAAC,eAAe,EAAE,SAAS,eAAe,EAAE,CAAA;IACpD,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,SAAS,YAAY,EAAE,CAAA;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,6GAA6G;IAC7G,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAA;IACrD;;;OAGG;IACH,QAAQ,CAAC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAA;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAA;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACvD;AAgDD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAAgC,CAAA;AAmBlF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAuC,CAAA;AA8KrF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,aAAa,OAAO,KAAG,QACP,CAAA;AAE7C,6EAA6E;AAC7E,eAAO,MAAM,aAAa,GAAI,aAAa,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAC9B,CAAA;AAS7C;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,QAmD9D,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GACpC,SAAS,SAAS,iBAAiB,EAAE,KACpC,SAAS,MAAM,EAQf,CAAA;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,GAClC,SAAS,SAAS,iBAAiB,EAAE,EACrC,YAAY,SAAS,MAAM,EAAE,KAC5B,SAAS,MAAM,EAWb,CAAA;AAeL;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAAI,OAAO,MAAM,KAAG,MACmB,CAAA;AAiBxE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAS9E,CAAA;AAuBD;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,GAC3C,SAAS,SAAS,iBAAiB,EAAE,EACrC,SAAS,SAAS,MAAM,EAAE,KACzB,SAAS,MAAM,EASf,CAAA"}

package/dist/settings.js

@@ -161,8 +161,12 @@ const asPublicAccess = (raw) => isArray(raw)
         const entity = asText(record['entity']).trim();
         const operation = asText(record['operation']).trim();
         const reason = asText(record['reason']).trim();
+        // `fields` is optional, so a malformed one falls back to declaring no field rather than
+        // dropping the entry: the entity-level grant it also carries was stated correctly, and
+        // discarding that would report a finding the project did answer.
+        const fields = asStringArray(record['fields'], []);
         return entity.length > 0 && operation.length > 0 && reason.length > 0
-            ? [{ entity, operation, reason }]
+            ? [{ entity, operation, reason, fields }]
             : [];
     })
     : [];