@ploaness/governance 1.0.0

package/dist/source-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-text.d.ts","sourceRoot":"","sources":["../src/source-text.ts"],"names":[],"mappings":"AAkBA,wDAAwD;AACxD,eAAO,MAAM,cAAc,EAAE,MAAW,CAAA;AAExC,8FAA8F;AAC9F,eAAO,MAAM,SAAS,EAAE,MAAW,CAAA;AAEnC;;;;;GAKG;AACH,eAAO,MAAM,MAAM,GAAI,QAAQ,MAAM,EAAE,OAAO,MAAM,KAAG,MACZ,CAAA;AAqI3C,yEAAyE;AACzE,MAAM,WAAW,MAAM,CAAC,KAAK;IAC3B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CACvB;AAoED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,MAA8B,CAAA;AAE7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,MAA6B,CAAA;AAE3E,qGAAqG;AACrG,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AASD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,EACjC,QAAQ,MAAM,EACd,OAAO,MAAM,EACb,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,EACrD,SAAS,KAAK,KACb,KA0BF,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,MAAM,EAAE,MAAM,MAAM,KAAG,MAAM,GAAG,SAWzE,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,MAAM,KAAG,MAgBlD,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,EAAE,QAAQ,MAAM,KAAG,SAAS,MAAM,EAGzE,CAAA;AAKH;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,EAAE,OAAO,MAAM,KAAG,SAAS,MAAM,EAY3E,CAAA"}

package/dist/source-text.js

@@ -0,0 +1,310 @@
+// Reading source text without parsing it: comment stripping, balanced-delimiter scanning, and the
+// depth-aware key lookups that tell a literal's own key from a nested one.
+//
+// It is the generic half of what was `payload-policy.ts`, extracted when that file reached the size cap
+// and then again when a second layer needed it. Three readers share it now: the Payload rules in
+// `payload-source.ts`, and the JSONC reader in `json-shapes.ts` - a tsconfig legally carries comments,
+// so the rule that judges one has to strip them the same way, and a second stripper is a second set of
+// edge cases about string literals nobody would keep in step.
+//
+// The walk is deliberately conservative. A reader returns undefined wherever the answer is not
+// statically decidable, because a false positive in a build-failing gate costs far more than a dynamic
+// construct a reviewer would catch anyway.
+import { escapeForRegex } from './text-escapes.js';
+const OPENERS = new Set(['(', '[', '{']);
+const CLOSERS = new Set([')', ']', '}']);
+const QUOTES = new Set(["'", '"', '`']);
+/** The offset `at` reads to reach the final element. */
+export const LAST_CHARACTER = -1;
+/** The value `indexOf` and this module's readers return when there is nothing to point at. */
+export const NOT_FOUND = -1;
+/**
+ * The one-based line a source offset falls on.
+ * @param source the file contents.
+ * @param index the offset.
+ * @returns the line number, counting from one.
+ */
+export const lineOf = (source, index) => source.slice(0, index).split('\n').length;
+// A `/` begins a regular-expression literal only where a value may start. Tracking that lets the comment
+// scanner skip a literal such as /https:\/\// without mistaking its escaped slashes for a comment.
+const VALUE_POSITION = new Set([
+    '(',
+    ',',
+    '=',
+    ':',
+    '[',
+    '!',
+    '&',
+    '|',
+    '?',
+    '{',
+    '}',
+    ';',
+    '+',
+    '-',
+    '*',
+    '%',
+    '<',
+    '>',
+    '~',
+    '^',
+]);
+const lastMeaningful = (text) => text.trimEnd().at(LAST_CHARACTER) ?? '';
+// Each scanner below answers one question: where does the construct that starts at `index` end? Keeping
+// them apart is what lets stripComments read as the dispatch it is rather than as four interleaved
+// state machines sharing one cursor.
+// A replacement FUNCTION rather than a replacement string: a string replacement reads `$&` and its
+// siblings as syntax, and the character to fill with is a parameter here rather than a literal.
+const fill = (text, character) => text.replaceAll(/[^\n]/g, () => character);
+const blank = (text) => fill(text, ' ');
+// A masked string becomes a filler that is NOT whitespace, unlike an erased comment. A caller reads the
+// mask for syntax, and a string blanked to spaces stops being a token: `["a", "b"]` would mask to a
+// comma followed by whitespace and a bracket, which is precisely the trailing comma such a caller
+// looks for. The character itself carries no meaning beyond being neither space nor delimiter.
+const STRING_FILLER = 'x';
+// `/*`, `*/`, and `//` are each two characters wide, and a backslash escape is the character after it.
+const DELIMITER_WIDTH = 2;
+const BLOCK_COMMENT_END = '*/';
+const endOfLineComment = (source, index) => {
+    const end = source.indexOf('\n', index);
+    return end === NOT_FOUND ? source.length : end;
+};
+const endOfBlockComment = (source, index) => {
+    const end = source.indexOf(BLOCK_COMMENT_END, index + DELIMITER_WIDTH);
+    return end === NOT_FOUND ? source.length : end + DELIMITER_WIDTH;
+};
+// Iterative rather than recursive, for the reason the main walk below is: a single string literal can be
+// a whole inlined data URI, and V8 does not eliminate the tail call that a per-character recursion
+// leaves on the stack.
+const scanStringLiteral = (source, quote, start) => {
+    // eslint-disable-next-line functional/no-let -- one cursor confined to this walk
+    let cursor = start;
+    while (cursor < source.length) {
+        const inner = source[cursor] ?? '';
+        if (inner === '\\') {
+            cursor += DELIMITER_WIDTH;
+            continue;
+        }
+        if (inner === quote) {
+            return cursor + 1;
+        }
+        cursor += 1;
+    }
+    return cursor;
+};
+const endOfStringLiteral = (source, index) => {
+    const quote = source[index] ?? '';
+    return scanStringLiteral(source, quote, index + 1);
+};
+// A regex literal ends at the first unescaped slash outside a character class, and never spans a line.
+// Its end depends on escapes, newlines, and character-class nesting at once; splitting the three apart
+// would hide the single cursor they share behind three functions that each need the others' state.
+const isInClassAfter = (character, isInClass) => {
+    if (character === '[') {
+        return true;
+    }
+    return character === ']' ? false : isInClass;
+};
+// One character of the walk, so the loop below carries the cursor and this carries the decisions. A
+// newline ends the literal without consuming it (a regex never spans a line); an unescaped slash
+// outside a character class ends it and is part of it.
+const afterRegexCharacter = (character, cursor) => {
+    if (character === '\\') {
+        return { ...cursor, index: cursor.index + DELIMITER_WIDTH };
+    }
+    if (character === '\n') {
+        return { ...cursor, end: cursor.index };
+    }
+    return character === '/' && !cursor.isInClass
+        ? { ...cursor, end: cursor.index + 1 }
+        : {
+            index: cursor.index + 1,
+            isInClass: isInClassAfter(character, cursor.isInClass),
+            end: undefined,
+        };
+};
+const scanRegexLiteral = (source, start) => {
+    // eslint-disable-next-line functional/no-let -- one cursor confined to this walk
+    let cursor = { index: start, isInClass: false, end: undefined };
+    while (cursor.index < source.length && cursor.end === undefined) {
+        cursor = afterRegexCharacter(source[cursor.index] ?? '', cursor);
+    }
+    return cursor.end ?? cursor.index;
+};
+const endOfRegexLiteral = (source, index) => scanRegexLiteral(source, index + 1);
+// A line or block comment, if one opens at `index`. Split out of the construct dispatch below so each
+// reads as the single question it asks.
+const commentAt = (source, index) => {
+    if (source[index] !== '/') {
+        return undefined;
+    }
+    const next = source[index + 1] ?? '';
+    if (next === '/') {
+        return { stop: endOfLineComment(source, index), erased: true };
+    }
+    return next === '*' ? { stop: endOfBlockComment(source, index), erased: true } : undefined;
+};
+// A string literal is kept because its contents are the only place a banned construct can legitimately
+// appear as data. Everything else here is erased, so prose naming a construct is never read as one.
+const constructAt = (source, index, output) => {
+    const comment = commentAt(source, index);
+    if (comment !== undefined) {
+        return comment;
+    }
+    const character = source[index] ?? '';
+    if (QUOTES.has(character)) {
+        return { stop: endOfStringLiteral(source, index), erased: false };
+    }
+    if (character === '/' && VALUE_POSITION.has(lastMeaningful(output))) {
+        return { stop: endOfRegexLiteral(source, index), erased: true };
+    }
+    return undefined;
+};
+// One walk, two callers. A string is the only construct the two disagree about, so the difference is a
+// parameter rather than a second scanner - which is what this module's own header says it exists to
+// avoid, and what a second set of edge cases about where a string ends would cost.
+const replacementFor = (text, skipped, isStringMasked) => {
+    if (skipped.erased) {
+        return blank(text);
+    }
+    return isStringMasked ? fill(text, STRING_FILLER) : text;
+};
+const strip = (source, isStringMasked) => {
+    /* eslint-disable functional/no-let -- a whole source file is walked here, so recursion would risk
+       the stack; the cursor and the output it builds are confined to this loop and escape as a value */
+    let output = '';
+    let index = 0;
+    /* eslint-enable functional/no-let -- the walk above is the only place this file mutates */
+    while (index < source.length) {
+        const skipped = constructAt(source, index, output);
+        if (skipped === undefined) {
+            output += source[index] ?? '';
+            index += 1;
+            continue;
+        }
+        const text = source.slice(index, skipped.stop);
+        output += replacementFor(text, skipped, isStringMasked);
+        index = skipped.stop;
+    }
+    return output;
+};
+/**
+ * Blank every comment and regular-expression literal to spaces, leaving newlines intact so reported line
+ * numbers still point at real source positions. Without this, prose that merely names a banned construct
+ * would be reported as the construct itself, which is the difference between a gate that is trusted and
+ * one that is worked around.
+ * @param source the file contents.
+ * @returns the source with comments and regex literals replaced by spaces of equal length.
+ */
+export const stripComments = (source) => strip(source, false);
+/**
+ * The source with every string literal replaced by filler of equal length, on top of what
+ * {@link stripComments} erases.
+ *
+ * A mask, for a caller that must locate syntax without reading inside a string. Offsets still line up
+ * with the source, so a position found here names the same character there, and a masked string is
+ * still a token rather than a gap. `parseJsonc` is that caller: it removed trailing commas from the
+ * document itself, so a comma sitting inside a string before a closing bracket - as a brace-expansion
+ * glob ending in one carries - was deleted from the parsed value, and nothing said so.
+ * @param source the file contents.
+ * @returns the source with comments erased, strings filled, and newlines intact.
+ */
+export const maskLiterals = (source) => strip(source, true);
+const depthAfter = (character, depth) => {
+    if (OPENERS.has(character)) {
+        return depth + 1;
+    }
+    return CLOSERS.has(character) ? depth - 1 : depth;
+};
+/**
+ * Walk `source` from `start`, tracking string literals and bracket nesting so that a bracket or a quote
+ * inside a string cannot unbalance the scan. Every reader below needs exactly this bookkeeping and they
+ * differ only in what they do with each character, so it lives here once rather than in each of them.
+ * @param source the text to walk.
+ * @param start the index to begin at.
+ * @param fold called for every character outside a string literal; return stop to end the walk.
+ * @param initial the state the fold begins with.
+ */
+export const scanDelimited = (source, start, fold, initial) => {
+    // One cursor carries depth across a character walk. Every split of this loop has to pass that cursor
+    // back and forth, which is harder to review than the loop, and this is the code the unbounded-call
+    // rules are decided by.
+    // eslint-disable-next-line functional/no-let -- one cursor shared by the whole walk
+    let cursor = {
+        index: start,
+        depth: 0,
+        state: initial,
+    };
+    while (cursor.index < source.length) {
+        const character = source[cursor.index] ?? '';
+        // A string literal is jumped over whole rather than tracked character by character, so a bracket or
+        // a quote inside it can never reach the depth count.
+        if (QUOTES.has(character)) {
+            cursor = { ...cursor, index: endOfStringLiteral(source, cursor.index) };
+            continue;
+        }
+        const depth = depthAfter(character, cursor.depth);
+        const folded = fold(cursor.state, { character, index: cursor.index, depth });
+        if (folded.stop) {
+            return folded.state;
+        }
+        cursor = { index: cursor.index + 1, depth, state: folded.state };
+    }
+    return cursor.state;
+};
+/**
+ * Read the text between the parenthesis at `open` and its match.
+ * @param source the file contents.
+ * @param open the index of the opening parenthesis.
+ * @returns the argument text, or undefined when the call is unterminated (a parse error another gate reports).
+ */
+export const balancedArguments = (source, open) => {
+    const close = scanDelimited(source, open, (found, step) => CLOSERS.has(step.character) && step.depth === 0
+        ? { state: step.index, stop: true }
+        : { state: found, stop: false }, undefined);
+    return close === undefined ? undefined : source.slice(open + 1, close);
+};
+/**
+ * Reduce an argument list to the characters sitting directly inside its outermost object literal, so a
+ * key nested in a `where` clause is not mistaken for a bound declared on the call itself.
+ * @param argumentText the text between a call's parentheses.
+ * @returns the depth-one characters, with nested structures elided.
+ */
+export const topLevelSlice = (argumentText) => scanDelimited(argumentText, 0, (collected, step) => {
+    if (OPENERS.has(step.character)) {
+        // The outermost opener collapses to one space so its keys cannot run into the previous token;
+        // a nested one contributes nothing, which is what elides the structure beneath it.
+        return { state: collected + (step.depth === 1 ? ' ' : ''), stop: false };
+    }
+    if (!CLOSERS.has(step.character) && step.depth === 1) {
+        return { state: collected + step.character, stop: false };
+    }
+    return { state: collected, stop: false };
+}, '');
+/**
+ * Every offset at which `needle` occurs literally.
+ * @param source the text to search.
+ * @param needle the literal to find; its punctuation is not read as pattern syntax.
+ * @returns the offsets, in reading order.
+ */
+export const occurrences = (source, needle) => [...source.matchAll(new RegExp(escapeForRegex(needle), 'g'))].map((match) => match.index);
+// A key opens the literal or follows a comma, which is what keeps a colon inside a value out of it.
+const TOP_LEVEL_KEY = /(?:^|[{,])\s*([a-z_$][\w$]*)\s*:/gi;
+/**
+ * The keys sitting directly inside the object literal that opens after `index`.
+ * @param source the text to read.
+ * @param index where to look for the opening brace.
+ * @returns the depth-one key names, with every nested structure elided.
+ */
+export const topLevelKeys = (source, index) => {
+    const open = source.indexOf('{', index);
+    if (open === NOT_FOUND) {
+        return [];
+    }
+    const body = balancedArguments(source, open);
+    if (body === undefined) {
+        return [];
+    }
+    return [...topLevelSlice(`{${body}}`).matchAll(TOP_LEVEL_KEY)].map((match) => match[1] ?? '');
+};
+//# sourceMappingURL=source-text.js.map

package/dist/source-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-text.js","sourceRoot":"","sources":["../src/source-text.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,2EAA2E;AAC3E,EAAE;AACF,wGAAwG;AACxG,iGAAiG;AACjG,uGAAuG;AACvG,uGAAuG;AACvG,8DAA8D;AAC9D,EAAE;AACF,+FAA+F;AAC/F,uGAAuG;AACvG,2CAA2C;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAElD,MAAM,OAAO,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AAC7D,MAAM,OAAO,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AAC7D,MAAM,MAAM,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AAE5D,wDAAwD;AACxD,MAAM,CAAC,MAAM,cAAc,GAAW,CAAC,CAAC,CAAA;AAExC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,SAAS,GAAW,CAAC,CAAC,CAAA;AAEnC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAa,EAAU,EAAE,CAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;AAE3C,yGAAyG;AACzG,mGAAmG;AACnG,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;CACJ,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;AAExF,wGAAwG;AACxG,mGAAmG;AACnG,qCAAqC;AAErC,mGAAmG;AACnG,gGAAgG;AAChG,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAU,EAAE,CACvD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAW,EAAE,CAAC,SAAS,CAAC,CAAA;AAEpD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;AAEvD,wGAAwG;AACxG,oGAAoG;AACpG,kGAAkG;AAClG,+FAA+F;AAC/F,MAAM,aAAa,GAAW,GAAG,CAAA;AAEjC,uGAAuG;AACvG,MAAM,eAAe,GAAW,CAAC,CAAA;AACjC,MAAM,iBAAiB,GAAW,IAAI,CAAA;AAEtC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAE,KAAa,EAAU,EAAE;IACjE,MAAM,GAAG,GAAW,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC/C,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA;AAChD,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,KAAa,EAAU,EAAE;IAClE,MAAM,GAAG,GAAW,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,GAAG,eAAe,CAAC,CAAA;IAC9E,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,eAAe,CAAA;AAClE,CAAC,CAAA;AAED,yGAAyG;AACzG,mGAAmG;AACnG,uBAAuB;AACvB,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,KAAa,EAAU,EAAE;IACjF,iFAAiF;IACjF,IAAI,MAAM,GAAW,KAAK,CAAA;IAC1B,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAW,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CAAA;YACzB,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,OAAO,MAAM,GAAG,CAAC,CAAA;QACnB,CAAC;QACD,MAAM,IAAI,CAAC,CAAA;IACb,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAE,KAAa,EAAU,EAAE;IACnE,MAAM,KAAK,GAAW,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;IACzC,OAAO,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;AACpD,CAAC,CAAA;AAED,uGAAuG;AACvG,uGAAuG;AACvG,mGAAmG;AACnG,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAE,SAAkB,EAAW,EAAE;IACxE,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9C,CAAC,CAAA;AASD,oGAAoG;AACpG,iGAAiG;AACjG,uDAAuD;AACvD,MAAM,mBAAmB,GAAG,CAAC,SAAiB,EAAE,MAAmB,EAAe,EAAE;IAClF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,GAAG,eAAe,EAAE,CAAA;IAC7D,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;IACzC,CAAC;IACD,OAAO,SAAS,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS;QAC3C,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE;QACtC,CAAC,CAAC;YACE,KAAK,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC;YACvB,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;YACtD,GAAG,EAAE,SAAS;SACf,CAAA;AACP,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAE,KAAa,EAAU,EAAE;IACjE,iFAAiF;IACjF,IAAI,MAAM,GAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;IAC5E,OAAO,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAA;AACnC,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,KAAa,EAAU,EAAE,CAClE,gBAAgB,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;AAcrC,sGAAsG;AACtG,wCAAwC;AACxC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,KAAa,EAAuB,EAAE;IACvE,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5C,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAChE,CAAC;IACD,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5F,CAAC,CAAA;AAED,uGAAuG;AACvG,oGAAoG;AACpG,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc,EAAuB,EAAE;IACzF,MAAM,OAAO,GAAwB,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC7D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,SAAS,GAAW,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;IAC7C,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IACnE,CAAC;IACD,IAAI,SAAS,KAAK,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED,uGAAuG;AACvG,oGAAoG;AACpG,mFAAmF;AACnF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,OAAgB,EAAE,cAAuB,EAAU,EAAE;IACzF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC;IACD,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1D,CAAC,CAAA;AAED,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,cAAuB,EAAU,EAAE;IAChE;wGACoG;IACpG,IAAI,MAAM,GAAW,EAAE,CAAA;IACvB,IAAI,KAAK,GAAW,CAAC,CAAA;IACrB,2FAA2F;IAC3F,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAwB,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACvE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;YAC7B,KAAK,IAAI,CAAC,CAAA;YACV,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAW,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QACtD,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;QACvD,KAAK,GAAG,OAAO,CAAC,IAAI,CAAA;IACtB,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AAE7E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AAS3E,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,KAAa,EAAU,EAAE;IAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,GAAG,CAAC,CAAA;IAClB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AACnD,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAAc,EACd,KAAa,EACb,IAAqD,EACrD,OAAc,EACP,EAAE;IACT,qGAAqG;IACrG,mGAAmG;IACnG,wBAAwB;IACxB,oFAAoF;IACpF,IAAI,MAAM,GAA8E;QACtF,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC;QACR,KAAK,EAAE,OAAO;KACf,CAAA;IACD,OAAO,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,SAAS,GAAW,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QACpD,oGAAoG;QACpG,qDAAqD;QACrD,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;YACvE,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAW,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACzD,MAAM,MAAM,GAAkB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3F,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,KAAK,CAAA;QACrB,CAAC;QACD,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;IAClE,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAA;AACrB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAsB,EAAE;IACpF,MAAM,KAAK,GAAuB,aAAa,CAC7C,MAAM,EACN,IAAI,EACJ,CAAC,KAAyB,EAAE,IAAc,EAA8B,EAAE,CACxE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QAC7C,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;QACnC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EACnC,SAAS,CACV,CAAA;IACD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;AACxE,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,YAAoB,EAAU,EAAE,CAC5D,aAAa,CACX,YAAY,EACZ,CAAC,EACD,CAAC,SAAiB,EAAE,IAAc,EAAkB,EAAE;IACpD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,8FAA8F;QAC9F,mFAAmF;QACnF,OAAO,EAAE,KAAK,EAAE,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAC1E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAC3D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AAC1C,CAAC,EACD,EAAE,CACH,CAAA;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,MAAc,EAAqB,EAAE,CAC/E,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAC/D,CAAC,KAAsB,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAChD,CAAA;AAEH,oGAAoG;AACpG,MAAM,aAAa,GAAW,oCAAoC,CAAA;AAElE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,KAAa,EAAqB,EAAE;IAC/E,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAChE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,CAAC,GAAG,aAAa,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAChE,CAAC,KAAsB,EAAU,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CACnD,CAAA;AACH,CAAC,CAAA"}

package/dist/suppression-ceiling.d.ts

@@ -0,0 +1,48 @@
+/** Suppressions permitted before any code is written, so a greenfield project is not born at zero. */
+export declare const BASE_ALLOWANCE: number;
+/** Source lines that earn one further suppression. */
+export declare const LINES_PER_SUPPRESSION: number;
+/** One suppression comment, located so an over-budget project is told which ones to reconsider. */
+export interface SuppressionSite {
+    readonly file: string;
+    readonly line: number;
+    readonly token: string;
+}
+/** What the ceiling rule decided, including the numbers every run reports. */
+export interface SuppressionReport {
+    readonly count: number;
+    readonly ceiling: number;
+    readonly remaining: number;
+    readonly sourceLines: number;
+    readonly withinCeiling: boolean;
+    readonly sites: readonly SuppressionSite[];
+}
+/**
+ * Locate every suppression comment in one file.
+ * @param file the path reported alongside each site.
+ * @param text the file's content.
+ * @returns one site per suppression, in line order.
+ */
+export declare const findSuppressions: (file: string, text: string) => readonly SuppressionSite[];
+/**
+ * Count the lines that the ceiling is measured against.
+ * @param text a source file's content.
+ * @returns its non-blank line count.
+ */
+export declare const countSourceLines: (text: string) => number;
+/**
+ * The permitted suppression count for a body of code.
+ * @param sourceLines non-blank lines of first-party source.
+ * @param declaredMaximum a project's own stricter cap, or undefined when it declares none.
+ * @returns the ceiling, which a declared maximum may lower and can never raise.
+ */
+export declare const suppressionCeiling: (sourceLines: number, declaredMaximum: number | undefined) => number;
+/**
+ * Judge a repository's suppressions against its ceiling.
+ * @param sites every suppression found.
+ * @param sourceLines non-blank lines of first-party source.
+ * @param declaredMaximum a project's own stricter cap, or undefined.
+ * @returns the verdict and the numbers every verification run reports.
+ */
+export declare const judgeSuppressions: (sites: readonly SuppressionSite[], sourceLines: number, declaredMaximum: number | undefined) => SuppressionReport;
+//# sourceMappingURL=suppression-ceiling.d.ts.map

package/dist/suppression-ceiling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppression-ceiling.d.ts","sourceRoot":"","sources":["../src/suppression-ceiling.ts"],"names":[],"mappings":"AAoDA,sGAAsG;AACtG,eAAO,MAAM,cAAc,EAAE,MAAU,CAAA;AAEvC,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,EAAE,MAAY,CAAA;AAEhD,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAA;CAC3C;AA2BD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,SAAS,eAAe,EAIlF,CAAA;AAEJ;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,MACmC,CAAA;AAEnF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,aAAa,MAAM,EACnB,iBAAiB,MAAM,GAAG,SAAS,KAClC,MAGF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAC5B,OAAO,SAAS,eAAe,EAAE,EACjC,aAAa,MAAM,EACnB,iBAAiB,MAAM,GAAG,SAAS,KAClC,iBAUF,CAAA"}

package/dist/suppression-ceiling.js

@@ -0,0 +1,115 @@
+// The suppression ceiling.
+//
+// A justification never stops a suppression from being added: whoever adds one writes it. What stops
+// one is a budget, because a full budget makes the next suppression cost the removal of an existing
+// one. So the ceiling is the mechanism, and the justification rules that analyzers already enforce are
+// the complement rather than the substitute.
+//
+// The ceiling is a density against the size of the code rather than a bare count, so it neither
+// strangles a small repository nor loosens as a large one grows. A project may declare a STRICTER
+// ceiling and never a looser one: a setting that raised it would be the bypass that makes the whole
+// mechanism decorative, and zero must be expressible, since "no suppression is permitted" is a
+// position the standard names explicitly.
+//
+// The search tokens are assembled from fragments rather than written whole. This module would otherwise
+// report itself, which is the same self-reference the typography rule solves by naming code points.
+const DISABLE = 'disable';
+const IGNORE = 'ignore';
+const ALLOW = 'allow';
+// One entry per suppression form. `eslint-enable`, `biome-ignore-end`, and `stylelint-enable` close a
+// block that its opener already counted, so counting them would double every block suppression.
+//
+// `@ts-nocheck` was missing, and it is the broadest suppression available: it turns the type checker off
+// for a whole file rather than for one line. `ban-ts-comment` refuses it wherever ESLint reads, so it
+// was never free - but a file ESLint's config ignores escaped both, and the ceiling is what makes the
+// next suppression cost the removal of an existing one.
+//
+// The three coverage forms belong here for a sharper reason than the rest. Every other suppression
+// silences a finding; a coverage directive deletes the measurement, so the per-file floor is met by
+// dropping the line out of the report rather than by writing the test that would cover it. That was the
+// cheapest way in a governed repository to make a floor read as satisfied.
+const SUPPRESSION_TOKENS = [
+    `eslint-${DISABLE}`,
+    `biome-${IGNORE}`,
+    `stylelint-${DISABLE}`,
+    `@ts-expect-error`,
+    `@ts-${IGNORE}`,
+    `@ts-nocheck`,
+    `v8 ${IGNORE}`,
+    `c8 ${IGNORE}`,
+    `istanbul ${IGNORE}`,
+];
+const CLOSING_TOKENS = [
+    `eslint-enable`,
+    `biome-${IGNORE}-end`,
+    `stylelint-enable`,
+    `v8 ${IGNORE} stop`,
+    `c8 ${IGNORE} stop`,
+];
+/** Suppressions permitted before any code is written, so a greenfield project is not born at zero. */
+export const BASE_ALLOWANCE = 2;
+/** Source lines that earn one further suppression. */
+export const LINES_PER_SUPPRESSION = 500;
+// A suppression token must open the comment that carries it. Prose ABOUT suppressions mentions the same
+// words - a config comment reading "every eslint-disable needs a reason" is documentation, not a
+// suppression - and counting those would charge a repository for explaining its own policy.
+const COMMENT_OPENER = String.raw `(?:\/\/|\/\*|^\s*\*|^\s*#)\s*`;
+const opensWith = (line, token) => new RegExp(`${COMMENT_OPENER}${token}`).test(line);
+// The one suppression form that is not a comment convention. gitleaks reads a line for this literal and
+// skips the line that carries it, whatever syntax the surrounding file comments in, so anchoring it to a
+// comment opener the way the others are anchored would leave every non-C-style file free. A governed
+// repository records a committed fake credential in the declared secret allowlist; this is the way
+// around that, and it costs a suppression like any other.
+const BARE_TOKENS = [`gitleaks:${ALLOW}`];
+const tokenOnLine = (line) => {
+    if (CLOSING_TOKENS.some((closing) => opensWith(line, closing))) {
+        return undefined;
+    }
+    return (SUPPRESSION_TOKENS.find((token) => opensWith(line, token)) ??
+        BARE_TOKENS.find((token) => line.includes(token)));
+};
+/**
+ * Locate every suppression comment in one file.
+ * @param file the path reported alongside each site.
+ * @param text the file's content.
+ * @returns one site per suppression, in line order.
+ */
+export const findSuppressions = (file, text) => text.split('\n').flatMap((line, index) => {
+    const token = tokenOnLine(line);
+    return token === undefined ? [] : [{ file, line: index + 1, token }];
+});
+/**
+ * Count the lines that the ceiling is measured against.
+ * @param text a source file's content.
+ * @returns its non-blank line count.
+ */
+export const countSourceLines = (text) => text.split('\n').filter((line) => line.trim().length > 0).length;
+/**
+ * The permitted suppression count for a body of code.
+ * @param sourceLines non-blank lines of first-party source.
+ * @param declaredMaximum a project's own stricter cap, or undefined when it declares none.
+ * @returns the ceiling, which a declared maximum may lower and can never raise.
+ */
+export const suppressionCeiling = (sourceLines, declaredMaximum) => {
+    const earned = BASE_ALLOWANCE + Math.floor(sourceLines / LINES_PER_SUPPRESSION);
+    return declaredMaximum === undefined ? earned : Math.min(earned, declaredMaximum);
+};
+/**
+ * Judge a repository's suppressions against its ceiling.
+ * @param sites every suppression found.
+ * @param sourceLines non-blank lines of first-party source.
+ * @param declaredMaximum a project's own stricter cap, or undefined.
+ * @returns the verdict and the numbers every verification run reports.
+ */
+export const judgeSuppressions = (sites, sourceLines, declaredMaximum) => {
+    const ceiling = suppressionCeiling(sourceLines, declaredMaximum);
+    return {
+        count: sites.length,
+        ceiling,
+        remaining: Math.max(0, ceiling - sites.length),
+        sourceLines,
+        withinCeiling: sites.length <= ceiling,
+        sites,
+    };
+};
+//# sourceMappingURL=suppression-ceiling.js.map

package/dist/suppression-ceiling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppression-ceiling.js","sourceRoot":"","sources":["../src/suppression-ceiling.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,EAAE;AACF,qGAAqG;AACrG,oGAAoG;AACpG,uGAAuG;AACvG,6CAA6C;AAC7C,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,oGAAoG;AACpG,+FAA+F;AAC/F,0CAA0C;AAC1C,EAAE;AACF,wGAAwG;AACxG,oGAAoG;AAEpG,MAAM,OAAO,GAAW,SAAS,CAAA;AACjC,MAAM,MAAM,GAAW,QAAQ,CAAA;AAC/B,MAAM,KAAK,GAAW,OAAO,CAAA;AAE7B,sGAAsG;AACtG,gGAAgG;AAChG,EAAE;AACF,yGAAyG;AACzG,sGAAsG;AACtG,sGAAsG;AACtG,wDAAwD;AACxD,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,wGAAwG;AACxG,2EAA2E;AAC3E,MAAM,kBAAkB,GAAsB;IAC5C,UAAU,OAAO,EAAE;IACnB,SAAS,MAAM,EAAE;IACjB,aAAa,OAAO,EAAE;IACtB,kBAAkB;IAClB,OAAO,MAAM,EAAE;IACf,aAAa;IACb,MAAM,MAAM,EAAE;IACd,MAAM,MAAM,EAAE;IACd,YAAY,MAAM,EAAE;CACrB,CAAA;AAED,MAAM,cAAc,GAAsB;IACxC,eAAe;IACf,SAAS,MAAM,MAAM;IACrB,kBAAkB;IAClB,MAAM,MAAM,OAAO;IACnB,MAAM,MAAM,OAAO;CACpB,CAAA;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,cAAc,GAAW,CAAC,CAAA;AAEvC,sDAAsD;AACtD,MAAM,CAAC,MAAM,qBAAqB,GAAW,GAAG,CAAA;AAmBhD,wGAAwG;AACxG,iGAAiG;AACjG,4FAA4F;AAC5F,MAAM,cAAc,GAAW,MAAM,CAAC,GAAG,CAAA,+BAA+B,CAAA;AAExE,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa,EAAW,EAAE,CACzD,IAAI,MAAM,CAAC,GAAG,cAAc,GAAG,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEpD,wGAAwG;AACxG,yGAAyG;AACzG,qGAAqG;AACrG,mGAAmG;AACnG,0DAA0D;AAC1D,MAAM,WAAW,GAAsB,CAAC,YAAY,KAAK,EAAE,CAAC,CAAA;AAE5D,MAAM,WAAW,GAAG,CAAC,IAAY,EAAsB,EAAE;IACvD,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,CACL,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3E,WAAW,CAAC,IAAI,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACnE,CAAA;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,IAAY,EAA8B,EAAE,CACzF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAE,KAAa,EAA8B,EAAE;IACnF,MAAM,KAAK,GAAuB,WAAW,CAAC,IAAI,CAAC,CAAA;IACnD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;AACtE,CAAC,CAAC,CAAA;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAU,EAAE,CACvD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAA;AAEnF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,WAAmB,EACnB,eAAmC,EAC3B,EAAE;IACV,MAAM,MAAM,GAAW,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,qBAAqB,CAAC,CAAA;IACvF,OAAO,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;AACnF,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,KAAiC,EACjC,WAAmB,EACnB,eAAmC,EAChB,EAAE;IACrB,MAAM,OAAO,GAAW,kBAAkB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAA;IACxE,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;QAC9C,WAAW;QACX,aAAa,EAAE,KAAK,CAAC,MAAM,IAAI,OAAO;QACtC,KAAK;KACN,CAAA;AACH,CAAC,CAAA"}

package/dist/tailwind-tokens.d.ts

@@ -0,0 +1,16 @@
+/** One arbitrary-Tailwind-value occurrence: where it is, and the token that caused it. */
+export interface ArbitraryValueViolation {
+    /** 1-based line. */
+    readonly line: number;
+    /** 1-based column. */
+    readonly column: number;
+    /** The offending token, as written. */
+    readonly value: string;
+}
+/**
+ * Find every arbitrary Tailwind value in one file's text.
+ * @param content the file's text.
+ * @returns the violations, each with a 1-based line and column and the offending token.
+ */
+export declare const findArbitraryValues: (content: string) => readonly ArbitraryValueViolation[];
+//# sourceMappingURL=tailwind-tokens.d.ts.map

package/dist/tailwind-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailwind-tokens.d.ts","sourceRoot":"","sources":["../src/tailwind-tokens.ts"],"names":[],"mappings":"AAkBA,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACtC,oBAAoB;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sBAAsB;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAgDD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,MAAM,KAAG,SAAS,uBAAuB,EAoBrF,CAAA"}

package/dist/tailwind-tokens.js

@@ -0,0 +1,70 @@
+// The token-bound rule: every colour, size, spacing, radius and motion value a Tailwind project
+// renders must come from the theme, applied through a utility class.
+//
+// An arbitrary value - `bg-[#0a7]`, `p-[13px]`, `translate-y-[2px]` - hardcodes the number instead.
+// Nothing downstream can see that it happened: the page renders, the build passes, and the design
+// system quietly stops being the single source of the value. That is the defect this rule names, and
+// it is a rule about Tailwind rather than about any one project, which is why it is here rather than
+// in a script a project owns and can edit.
+//
+// The match is deliberately narrow, because the two things it must not confuse look alike:
+//
+//   - An arbitrary VALUE is `<utility>-[<value>]` and IS a finding. The `-` before the bracket is what
+//     separates it from TypeScript index access (`medalChip[result.medal]`), which has no dash.
+//   - An arbitrary VARIANT is `data-[state=open]:...` or `[&>tr]:...` and is NOT. A variant is a
+//     selector prefix rather than a value, and is always followed by `:`. The negative lookahead below
+//     is what keeps it out - and is the reason this is a rule in TypeScript rather than a GritQL
+//     plugin, whose Rust regex engine has no lookahead to express it with.
+// A utility with a bracketed value, not immediately followed by `:` (which would make it a variant).
+const ARBITRARY_VALUE = /-\[[^\]]+\](?!:)/g;
+// Utilities whose bracket takes something OTHER than a themeable value.
+//
+// `transition-[color,box-shadow]` names which properties animate and `will-change-[margin-top]` names
+// which one is about to. `flex-[1_0_auto]` is the CSS `flex` shorthand - a grow/shrink/basis triple
+// describing how a box behaves, not a colour, size, spacing, radius or motion value. Tailwind v4 has
+// namespaces for every kind of value this rule governs and none for any of these, so reporting them
+// asked for a token that cannot exist, and the only way out was a suppression: a real allowance spent
+// on a false finding.
+//
+// `flex-[1]` is NOT excused by this. It is still reported, because Tailwind ships `flex-1` for it - the
+// finding there is an arbitrary value written where a utility already exists, which is the defect.
+// Only the shorthand form, which no utility and no token can express, is out of scope.
+const PROPERTY_UTILITIES = ['transition', 'will-change'];
+// The `flex` shorthand, told apart from `flex-[1]` by carrying more than one component. Written as a
+// separate test rather than as another entry above, because `flex` is not a property utility: the
+// bracket holds values, there is simply no namespace any of them could come from.
+const FLEX_SHORTHAND = /^-\[[^\s\]_]*[\s_][^\]]*\]$/;
+const carriesFlexShorthand = (lineText, index, value) => lineText.slice(0, index).endsWith('flex') && FLEX_SHORTHAND.test(value);
+const carriesProperty = (lineText, index) => PROPERTY_UTILITIES.some((utility) => lineText.slice(0, index).endsWith(utility));
+// A bracketed value that COMPUTES rather than states one is the opposite of a hardcoded value.
+//
+// `var(--x)` is how a value computed at render - a width from a prop, a gap from a CMS field - reaches a
+// utility class, and a static theme cannot hold a per-instance value.
+//
+// A calculation is judged by what it computes OVER, which is where this rule previously drew the line in
+// the wrong place. `calc(100px_+_2rem)` is arithmetic on two lengths that both belong in the theme, and
+// is still a finding. `calc(100%_-_1px)` is not: a percentage resolves against whatever contains the
+// element, so the number it produces is not knowable where a token would have to be written - the same
+// reason `var(--x)` is excused, reached by a different route. The same holds for a viewport unit.
+const CUSTOM_PROPERTY = /var\(\s*--/;
+// A length that only means something once the element has a container or a viewport.
+const CONTEXT_RELATIVE = /\d(?:%|v(?:w|h|min|max)\b)/;
+const carriesComputedValue = (value) => CUSTOM_PROPERTY.test(value) || (value.includes('calc(') && CONTEXT_RELATIVE.test(value));
+/**
+ * Find every arbitrary Tailwind value in one file's text.
+ * @param content the file's text.
+ * @returns the violations, each with a 1-based line and column and the offending token.
+ */
+export const findArbitraryValues = (content) => {
+    const lines = content.split('\n');
+    return lines.flatMap((lineText, index) => [...lineText.matchAll(ARBITRARY_VALUE)]
+        .filter((match) => !(carriesProperty(lineText, match.index) ||
+        carriesComputedValue(match[0]) ||
+        carriesFlexShorthand(lineText, match.index, match[0])))
+        .map((match) => ({
+        line: index + 1,
+        column: match.index + 1,
+        value: match[0],
+    })));
+};
+//# sourceMappingURL=tailwind-tokens.js.map

package/dist/tailwind-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailwind-tokens.js","sourceRoot":"","sources":["../src/tailwind-tokens.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,qEAAqE;AACrE,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,qGAAqG;AACrG,qGAAqG;AACrG,2CAA2C;AAC3C,EAAE;AACF,2FAA2F;AAC3F,EAAE;AACF,uGAAuG;AACvG,gGAAgG;AAChG,iGAAiG;AACjG,uGAAuG;AACvG,iGAAiG;AACjG,2EAA2E;AAY3E,qGAAqG;AACrG,MAAM,eAAe,GAAW,mBAAmB,CAAA;AAEnD,wEAAwE;AACxE,EAAE;AACF,sGAAsG;AACtG,oGAAoG;AACpG,qGAAqG;AACrG,oGAAoG;AACpG,sGAAsG;AACtG,sBAAsB;AACtB,EAAE;AACF,wGAAwG;AACxG,mGAAmG;AACnG,uFAAuF;AACvF,MAAM,kBAAkB,GAAsB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;AAE3E,qGAAqG;AACrG,kGAAkG;AAClG,kFAAkF;AAClF,MAAM,cAAc,GAAW,6BAA6B,CAAA;AAE5D,MAAM,oBAAoB,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAE,KAAa,EAAW,EAAE,CACvF,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAEzE,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAW,EAAE,CACnE,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;AAEnG,+FAA+F;AAC/F,EAAE;AACF,yGAAyG;AACzG,sEAAsE;AACtE,EAAE;AACF,yGAAyG;AACzG,wGAAwG;AACxG,qGAAqG;AACrG,uGAAuG;AACvG,kGAAkG;AAClG,MAAM,eAAe,GAAW,YAAY,CAAA;AAE5C,qFAAqF;AACrF,MAAM,gBAAgB,GAAW,4BAA4B,CAAA;AAE7D,MAAM,oBAAoB,GAAG,CAAC,KAAa,EAAW,EAAE,CACtD,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AAE1F;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAsC,EAAE;IACzF,MAAM,KAAK,GAAsB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACpD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,QAAgB,EAAE,KAAa,EAAsC,EAAE,CAC3F,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;SACpC,MAAM,CACL,CAAC,KAAsB,EAAW,EAAE,CAClC,CAAC,CACC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;QACtC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CACtD,CACJ;SACA,GAAG,CACF,CAAC,KAAsB,EAA2B,EAAE,CAAC,CAAC;QACpD,IAAI,EAAE,KAAK,GAAG,CAAC;QACf,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;QACvB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;KAChB,CAAC,CACH,CACJ,CAAA;AACH,CAAC,CAAA"}

package/dist/text-escapes.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Escape every character a regular expression would read as syntax.
+ * @param text the literal to match.
+ * @returns the text, safe to embed in a pattern.
+ */
+export declare const escapeForRegex: (text: string) => string;
+//# sourceMappingURL=text-escapes.d.ts.map

package/dist/text-escapes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"text-escapes.d.ts","sourceRoot":"","sources":["../src/text-escapes.ts"],"names":[],"mappings":"AAQA;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,MACU,CAAA"}

package/dist/text-escapes.js

@@ -0,0 +1,14 @@
+// One escaper, because two rules build a pattern out of text a project supplies.
+//
+// `secret-policy.ts` renders a declared exception path into a scanner's allowlist, and
+// `payload-source.ts` searches for a literal call expression such as `payload.find(`. Both had their
+// own copy of this function, character for character, in modules that never import each other - which
+// is the shape of duplication that survives a review precisely because neither copy looks wrong.
+const REGEX_METACHARACTERS = /[.*+?^${}()|[\]\\]/g;
+/**
+ * Escape every character a regular expression would read as syntax.
+ * @param text the literal to match.
+ * @returns the text, safe to embed in a pattern.
+ */
+export const escapeForRegex = (text) => text.replaceAll(REGEX_METACHARACTERS, String.raw `\$&`);
+//# sourceMappingURL=text-escapes.js.map

package/dist/text-escapes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"text-escapes.js","sourceRoot":"","sources":["../src/text-escapes.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,EAAE;AACF,uFAAuF;AACvF,qGAAqG;AACrG,sGAAsG;AACtG,iGAAiG;AACjG,MAAM,oBAAoB,GAAW,qBAAqB,CAAA;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE,CACrD,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG,CAAA,KAAK,CAAC,CAAA"}