@ploaness/governance 1.0.0

package/dist/version-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-policy.js","sourceRoot":"","sources":["../src/version-policy.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,EAAE;AACF,kGAAkG;AAClG,wGAAwG;AACxG,mGAAmG;AACnG,iBAAiB;AACjB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAA;AACtF,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAGvD,sGAAsG;AACtG,oGAAoG;AACpG,kFAAkF;AAClF,MAAM,OAAO,GAAG,CAAC,WAAoC,EAAE,IAAY,EAAsB,EAAE;IACzF,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,cAAc,CAAA;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC;QACxE,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAU,EAAE,CACjE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAA;AAEhD,sGAAsG;AACtG,wGAAwG;AACxG,mGAAmG;AACnG,mGAAmG;AACnG,uGAAuG;AACvG,sEAAsE;AACtE,MAAM,aAAa,GAAW,YAAY,CAAA;AAC1C,MAAM,cAAc,GAAW,2BAA2B,CAAA;AAE1D,0GAA0G;AAC1G,MAAM,CAAC,MAAM,eAAe,GAAW,UAAU,CAAA;AAEjD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,WAAmB,EAAW,EAAE,CAC/D,WAAW,KAAK,eAAe,IAAI,WAAW,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AAE1E,MAAM,gBAAgB,GAAG,CAAC,KAAoB,EAAW,EAAE,CACzD,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;AAE7E,MAAM,iBAAiB,GAAG,CACxB,KAAoB,EACpB,QAA0C,EAC1C,QAAgC,EACJ,EAAE;IAC9B,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAW,uBAAuB,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAA;IAChF,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL;gBACE,QAAQ;gBACR,MAAM,EACJ,iFAAiF;oBACjF,mBAAmB;aACtB;SACF,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAuB,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAC3D,OAAO,GAAG,KAAK,SAAS;QACtB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,QAAQ;gBACR,MAAM,EACJ,gDAAgD,GAAG,4BAA4B;oBAC/E,2DAA2D;aAC9D;SACF,CAAA;AACP,CAAC,CAAA;AAED,oGAAoG;AACpG,qGAAqG;AACrG,uGAAuG;AACvG,oGAAoG;AACpG,qGAAqG;AACrG,+FAA+F;AAC/F,mGAAmG;AACnG,uGAAuG;AACvG,uBAAuB;AACvB,MAAM,0BAA0B,GAAG,CACjC,aAAqB,EACrB,QAA0C,EAC1C,qBAAuD,EAC3B,EAAE,CAC9B,aAAa,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,KAAoB,EAA8B,EAAE,CACxF,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,qBAAqB,EAAE,CAAC,CACjE,CAAA;AAEH,sGAAsG;AACtG,gGAAgG;AAChG,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,CAC1B,WAAoC,EACpC,QAA4B,EACA,EAAE;IAC9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAY,WAAW,CAAC,gBAAgB,CAAC,CAAA;IACvD,OAAO,QAAQ,KAAK,QAAQ;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,QAAQ,EAAE,6BAA6B;gBACvC,MAAM,EAAE,MAAM,aAAa,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,2BAA2B,QAAQ,GAAG;aAC5F;SACF,CAAA;AACP,CAAC,CAAA;AAED,kGAAkG;AAClG,qGAAqG;AACrG,qGAAqG;AACrG,kGAAkG;AAClG,MAAM,iBAAiB,GAAG,CAAC,MAG1B,EAAoC,EAAE;IACrC,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAA;IACjF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,CAAA;AAC1F,CAAC,CAAA;AAED,oGAAoG;AACpG,sGAAsG;AACtG,8FAA8F;AAC9F,MAAM,YAAY,GAAG,CACnB,WAAoC,EACpC,QAA0C,EACd,EAAE;IAC9B,MAAM,QAAQ,GAA2B,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAA;IAC/E,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CACrC,CAAC,CAAC,IAAI,EAAE,KAAK,CAA4B,EAA8B,EAAE,CACvE,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK;QACtB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,QAAQ,EAAE,wBAAwB,IAAI,EAAE;gBACxC,MAAM,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,2BAA2B,KAAK,GAAG;aAC/E;SACF,CACR,CAAA;AACH,CAAC,CAAA;AAED,wGAAwG;AACxG,uGAAuG;AACvG,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AAEvG,wGAAwG;AACxG,yCAAyC;AACzC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAU,EAAE;IAC5C,MAAM,EAAE,GAAW,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACvC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AACxC,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,WAAoC,EAAkC,EAAE,CAC7F,aAAa,CAAC,OAAO,CAAC,CAAC,GAAW,EAAkC,EAAE,CACpE,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAClD,CAAC,MAA+B,EAAkC,EAAE,CAClE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAa,EAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAC7F,CACF,CAAA;AAEH,MAAM,mBAAmB,GAAG,CAC1B,WAAoC,EACpC,QAA0C,EACd,EAAE,CAC9B,aAAa,CAAC,WAAW,CAAC;KACvB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAoB,EAAW,EAAE,CAChD,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CACpD;KACA,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAoB,EAAmB,EAAE,CAAC,CAAC;IACrD,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,EAAE;IACpD,MAAM,EACJ,oFAAoF;QACpF,sEAAsE;CACzE,CAAC,CACH,CAAA;AAEL,qGAAqG;AACrG,qGAAqG;AACrG,sEAAsE;AACtE,MAAM,YAAY,GAAW,qEAAqE,CAAA;AAElG,iGAAiG;AACjG,oGAAoG;AACpG,mGAAmG;AACnG,qGAAqG;AACrG,2DAA2D;AAC3D,MAAM,cAAc,GAAW,qBAAqB,CAAA;AACpD,iGAAiG;AACjG,6FAA6F;AAC7F,mEAAmE;AACnE,MAAM,WAAW,GAAW,oCAAoC,CAAA;AAEhE,+FAA+F;AAC/F,sGAAsG;AACtG,oGAAoG;AACpG,mGAAmG;AACnG,MAAM,aAAa,GAAW,KAAK,CAAA;AAEnC,mGAAmG;AACnG,wGAAwG;AACxG,+EAA+E;AAC/E,MAAM,SAAS,GAAW,MAAM,CAAA;AAEhC,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAW,EAAE;IACpD,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAW,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACzD,MAAM,EAAE,GAAW,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,OAAO,EAAE,GAAG,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,WAAoC,EAA8B,EAAE,CAC9F,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;KAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAA4B,EAAW,EAAE,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;KACzF,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,SAAS,CAA4B,EAAmB,EAAE,CAAC,CAAC;IAClE,QAAQ,EAAE,gBAAgB,IAAI,EAAE;IAChC,MAAM,EACJ,OAAO,SAAS,kEAAkE;QAClF,4DAA4D;CAC/D,CAAC,CACH,CAAA;AAEL,oGAAoG;AACpG,uGAAuG;AACvG,kGAAkG;AAClG,0DAA0D;AAC1D,MAAM,aAAa,GAAW,cAAc,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAW,SAAS,CAAA;AAEhD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAW,MAAM,CAAA;AAE1C,MAAM,kBAAkB,GAAG,CACzB,WAAoC,EACpC,cAAkC,EACN,EAAE;IAC9B,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;SACrD,MAAM,CACL,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAAW,EAAE,CACtD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,OAAO,KAAK,cAAc,CAC/D;SACA,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAAmB,EAAE,CAAC,CAAC;QAChE,QAAQ,EAAE,gBAAgB,IAAI,EAAE;QAChC,MAAM,EACJ,OAAO,OAAO,+BAA+B,cAAc,KAAK;YAChE,yDAAyD;KAC5D,CAAC,CACH,CAAA;AACL,CAAC,CAAA;AAED,sGAAsG;AACtG,oGAAoG;AACpG,mGAAmG;AACnG,kGAAkG;AAClG,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,CACzB,WAAoC,EACpC,QAA0C,EAC1C,QAA6B,EACD,EAAE;IAC9B,MAAM,QAAQ,GAA2B,oBAAoB,CAAC,WAAW,CAAC,CAAA;IAC1E,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CACrC,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAA8B,EAAE;QACzE,MAAM,KAAK,GAAuB,QAAQ,CAAC,IAAI,CAAC,CAAA;QAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBACvB,CAAC,CAAC;oBACE;wBACE,QAAQ,EAAE,gBAAgB,IAAI,EAAE;wBAChC,MAAM,EAAE,gEAAgE,OAAO,EAAE;qBAClF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAA;QACR,CAAC;QACD,OAAO,KAAK,KAAK,OAAO;YACtB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,QAAQ,EAAE,gBAAgB,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE;oBACpE,MAAM,EACJ,OAAO,KAAK,8BAA8B,OAAO,KAAK;wBACtD,mDAAmD;iBACtD;aACF,CAAA;IACP,CAAC,CACF,CAAA;AACH,CAAC,CAAA;AAyBD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,WAAoC,EACpC,MAA+B,EACH,EAAE,CAAC;IAC/B,GAAG,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,sBAAsB,CAAC;IAClE,GAAG,YAAY,CACb,WAAW,EACX,iBAAiB,CAAC;QAChB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;KACtD,CAAC,CACH;IACD,GAAG,0BAA0B,CAC3B,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,qBAAqB,CAC7B;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,WAAoC,EACpC,MAA4B,EACA,EAAE,CAAC;IAC/B,GAAG,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpE,GAAG,kBAAkB,CAAC,WAAW,CAAC;IAClC,GAAG,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;IACzD,GAAG,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC;CACrD,CAAA;AAYD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,WAAoC,EACpC,MAAqB,EACO,EAAE,CAAC;IAC/B,GAAG,4BAA4B,CAAC,WAAW,EAAE;QAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IACF,GAAG,+BAA+B,CAAC,WAAW,EAAE;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QACrD,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,qBAAqB,EAAE,oBAAoB,CAAC,WAAW,CAAC;KACzD,CAAC;CACH,CAAA"}

package/dist/vulnerability-policy.d.ts

@@ -0,0 +1,66 @@
+/** Advisory severities, ordered from least to most severe. */
+export declare const SEVERITY_ORDER: readonly string[];
+/** The severity ploaness declares. A project may lower this and never raise it. */
+export declare const DEFAULT_SEVERITY: string;
+/** One advisory reported by the database. */
+export interface Advisory {
+    readonly id: string;
+    readonly packageName: string;
+    readonly severity: string;
+    readonly title: string;
+    /** Alternative identifiers the advisory is also known by, such as its CVEs. */
+    readonly aliases: readonly string[];
+}
+/** A recorded exception for an advisory the repository cannot reach. */
+export interface VulnerabilityException {
+    readonly advisory: string;
+    readonly reason: string;
+    readonly addedOn: string;
+}
+/**
+ * Advisories carried by ploaness's OWN dependency chain, which a consuming project cannot repair.
+ *
+ * Every other exception is the project's to record, because every other advisory is reachable from a
+ * package the project chose. These are not: they arrive through `ploaness` itself, so a project asked to
+ * allowlist one would be excusing the harness's problem in its own manifest, and every consumer would
+ * carry the same entry. The harness answers for its own tree instead.
+ *
+ * The bar is the same one a project is held to - a reason and a date - and so is the staleness rule
+ * below. What differs is the repair a finding names: upgrading ploaness rather than editing package.json.
+ */
+export declare const HARNESS_EXCEPTIONS: readonly VulnerabilityException[];
+/** What the vulnerability rule decided. */
+export interface VulnerabilityReport {
+    readonly unsuppressed: readonly Advisory[];
+    readonly deadEntries: readonly string[];
+    readonly threshold: string;
+}
+/**
+ * Resolve the severity a project is held to.
+ * @param declared the project's declared severity, or undefined.
+ * @returns the declared severity when it is stricter than the default, otherwise the default.
+ */
+export declare const effectiveSeverity: (declared: string | undefined) => string;
+/**
+ * Decide whether an advisory reaches the threshold.
+ *
+ * A severity the database reports and this scale does not know is read as the most severe rather than
+ * as the least. It used to be dropped from the report entirely - the guard read `rank !== -1`, so an
+ * advisory whose severity was absent, misspelled, or newly introduced upstream simply vanished. That is
+ * a fail-open default inside the one gate whose whole design is fail-closed, and the wrong direction to
+ * be wrong in: a false failure is repaired by looking at the advisory, and a false pass by nothing.
+ * @param advisory the reported advisory.
+ * @param threshold the severity the repository is held to.
+ * @returns true when the advisory is at or above the threshold.
+ */
+export declare const reachesThreshold: (advisory: Advisory, threshold: string) => boolean;
+/**
+ * Judge the advisories the database reported against the recorded exceptions.
+ * @param advisories every advisory reported for the resolved set.
+ * @param exceptions the recorded exceptions.
+ * @param declaredSeverity the project's declared severity, or undefined.
+ * @param harnessExceptions the advisories ploaness answers for in its own chain.
+ * @returns the advisories that stand, and the exceptions that suppress nothing.
+ */
+export declare const judgeVulnerabilities: (advisories: readonly Advisory[], exceptions: readonly VulnerabilityException[], declaredSeverity: string | undefined, harnessExceptions?: readonly VulnerabilityException[]) => VulnerabilityReport;
+//# sourceMappingURL=vulnerability-policy.d.ts.map

package/dist/vulnerability-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerability-policy.d.ts","sourceRoot":"","sources":["../src/vulnerability-policy.ts"],"names":[],"mappings":"AAYA,8DAA8D;AAC9D,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAoD,CAAA;AAEhG,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,EAAE,MAAmB,CAAA;AAElD,6CAA6C;AAC7C,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,wEAAwE;AACxE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,sBAAsB,EAU/D,CAAA;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,QAAQ,EAAE,CAAA;IAC1C,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAOD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,MAAM,GAAG,SAAS,KAAG,MAOhE,CAAA;AAKD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,GAAI,UAAU,QAAQ,EAAE,WAAW,MAAM,KAAG,OAGxE,CAAA;AAKD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAC/B,YAAY,SAAS,QAAQ,EAAE,EAC/B,YAAY,SAAS,sBAAsB,EAAE,EAC7C,kBAAkB,MAAM,GAAG,SAAS,EAIpC,oBAAmB,SAAS,sBAAsB,EAAO,KACxD,mBAwCF,CAAA"}

package/dist/vulnerability-policy.js

@@ -0,0 +1,106 @@
+// Known vulnerabilities.
+//
+// The check reads every package in the resolved set against a public advisory database and fails on a
+// finding at or above the declared severity. It covers the packages the product, the tests, and the
+// build use: a build tool runs with build privileges, so its vulnerability is reachable by anyone who
+// can change the repository.
+//
+// Two properties matter as much as the failure itself. An allowlist entry must record why the
+// repository cannot reach the vulnerability and when the entry was added, because an undated exception
+// is one nobody can review. And an entry that suppresses nothing is itself a finding - the package was
+// upgraded or the advisory withdrawn, and a stale exception quietly widens the next scan.
+/** Advisory severities, ordered from least to most severe. */
+export const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
+/** The severity ploaness declares. A project may lower this and never raise it. */
+export const DEFAULT_SEVERITY = 'moderate';
+/**
+ * Advisories carried by ploaness's OWN dependency chain, which a consuming project cannot repair.
+ *
+ * Every other exception is the project's to record, because every other advisory is reachable from a
+ * package the project chose. These are not: they arrive through `ploaness` itself, so a project asked to
+ * allowlist one would be excusing the harness's problem in its own manifest, and every consumer would
+ * carry the same entry. The harness answers for its own tree instead.
+ *
+ * The bar is the same one a project is held to - a reason and a date - and so is the staleness rule
+ * below. What differs is the repair a finding names: upgrading ploaness rather than editing package.json.
+ */
+export const HARNESS_EXCEPTIONS = [
+    {
+        advisory: 'GHSA-ggr8-5vv4-36mx',
+        reason: 'deepmerge-ts is reached only through eslint-plugin-functional, which ploaness runs as a ' +
+            'linter over source the project already controls; the stack exhaustion needs a recursive ' +
+            'object graph, and an ESLint rule configuration is not one an attacker supplies. There is no ' +
+            'upgrade above it: eslint-plugin-functional 10.0.0 is the latest release and pins ^7.1.5.',
+        addedOn: '2026-08-25',
+    },
+];
+/** What `indexOf` returns for a severity this scale does not carry. */
+const NOT_RANKED = -1;
+const rank = (severity) => SEVERITY_ORDER.indexOf(severity.toLowerCase());
+/**
+ * Resolve the severity a project is held to.
+ * @param declared the project's declared severity, or undefined.
+ * @returns the declared severity when it is stricter than the default, otherwise the default.
+ */
+export const effectiveSeverity = (declared) => {
+    if (declared === undefined || rank(declared) === NOT_RANKED) {
+        return DEFAULT_SEVERITY;
+    }
+    // Only a stricter setting is honoured. A setting that raised the threshold would narrow the check's
+    // scope, which is the bypass the harness exists to refuse.
+    return rank(declared) < rank(DEFAULT_SEVERITY) ? declared.toLowerCase() : DEFAULT_SEVERITY;
+};
+/** The rank an unrecognised severity is read at, which is the top of the scale. */
+const UNKNOWN_SEVERITY_RANK = SEVERITY_ORDER.length;
+/**
+ * Decide whether an advisory reaches the threshold.
+ *
+ * A severity the database reports and this scale does not know is read as the most severe rather than
+ * as the least. It used to be dropped from the report entirely - the guard read `rank !== -1`, so an
+ * advisory whose severity was absent, misspelled, or newly introduced upstream simply vanished. That is
+ * a fail-open default inside the one gate whose whole design is fail-closed, and the wrong direction to
+ * be wrong in: a false failure is repaired by looking at the advisory, and a false pass by nothing.
+ * @param advisory the reported advisory.
+ * @param threshold the severity the repository is held to.
+ * @returns true when the advisory is at or above the threshold.
+ */
+export const reachesThreshold = (advisory, threshold) => {
+    const severity = rank(advisory.severity);
+    return (severity === NOT_RANKED ? UNKNOWN_SEVERITY_RANK : severity) >= rank(threshold);
+};
+const identifiersOf = (advisory) => [advisory.id, ...advisory.aliases].map((identifier) => identifier.toUpperCase());
+/**
+ * Judge the advisories the database reported against the recorded exceptions.
+ * @param advisories every advisory reported for the resolved set.
+ * @param exceptions the recorded exceptions.
+ * @param declaredSeverity the project's declared severity, or undefined.
+ * @param harnessExceptions the advisories ploaness answers for in its own chain.
+ * @returns the advisories that stand, and the exceptions that suppress nothing.
+ */
+export const judgeVulnerabilities = (advisories, exceptions, declaredSeverity, 
+// Defaulted to none rather than to the shipped list: a pure rule whose behaviour depends on a module
+// constant is one a spec cannot state the inputs of, and the strict end is the right default anyway.
+// The CLI injects HARNESS_EXCEPTIONS, which is the one place that knows it is judging a real project.
+harnessExceptions = []) => {
+    const threshold = effectiveSeverity(declaredSeverity);
+    const excused = new Set([...harnessExceptions, ...exceptions].map((exception) => exception.advisory.toUpperCase()));
+    const atThreshold = advisories.filter((advisory) => reachesThreshold(advisory, threshold));
+    const matched = new Set(atThreshold.flatMap((advisory) => identifiersOf(advisory).filter((identifier) => excused.has(identifier))));
+    return {
+        threshold,
+        unsuppressed: atThreshold.filter((advisory) => !identifiersOf(advisory).some((identifier) => excused.has(identifier))),
+        // An entry that excuses nothing has outlived its advisory. Reporting it is the vulnerability-domain
+        // twin of failing on a lint suppression that no longer suppresses anything.
+        // The project's own entries only. Whether a HARNESS entry still suppresses anything is a property
+        // of the tree being audited rather than of ploaness: this repository resolves the linter's
+        // dependency differently from a consumer that installs the published packages, so the same entry is
+        // live in one tree and dead in the other. Reporting it would fail whichever side was not the one it
+        // was written for, and a project cannot edit a manifest it does not own in either case. A harness
+        // entry is reviewed by its recorded date, by the person who can act on it.
+        deadEntries: exceptions
+            .filter((exception) => !matched.has(exception.advisory.toUpperCase()))
+            .map((exception) => `${exception.advisory} suppresses no current finding; the package was upgraded ` +
+            'or the advisory withdrawn, so remove the entry'),
+    };
+};
+//# sourceMappingURL=vulnerability-policy.js.map

package/dist/vulnerability-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerability-policy.js","sourceRoot":"","sources":["../src/vulnerability-policy.ts"],"names":[],"mappings":"AAAA,yBAAyB;AACzB,EAAE;AACF,sGAAsG;AACtG,oGAAoG;AACpG,sGAAsG;AACtG,6BAA6B;AAC7B,EAAE;AACF,8FAA8F;AAC9F,uGAAuG;AACvG,uGAAuG;AACvG,0FAA0F;AAE1F,8DAA8D;AAC9D,MAAM,CAAC,MAAM,cAAc,GAAsB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAEhG,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAW,UAAU,CAAA;AAmBlD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsC;IACnE;QACE,QAAQ,EAAE,qBAAqB;QAC/B,MAAM,EACJ,0FAA0F;YAC1F,0FAA0F;YAC1F,8FAA8F;YAC9F,0FAA0F;QAC5F,OAAO,EAAE,YAAY;KACtB;CACF,CAAA;AASD,uEAAuE;AACvE,MAAM,UAAU,GAAW,CAAC,CAAC,CAAA;AAE7B,MAAM,IAAI,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;AAEzF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA4B,EAAU,EAAE;IACxE,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,UAAU,EAAE,CAAC;QAC5D,OAAO,gBAAgB,CAAA;IACzB,CAAC;IACD,oGAAoG;IACpG,2DAA2D;IAC3D,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAA;AAC5F,CAAC,CAAA;AAED,mFAAmF;AACnF,MAAM,qBAAqB,GAAW,cAAc,CAAC,MAAM,CAAA;AAE3D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAkB,EAAE,SAAiB,EAAW,EAAE;IACjF,MAAM,QAAQ,GAAW,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAChD,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;AACxF,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,QAAkB,EAAqB,EAAE,CAC9D,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,UAAkB,EAAU,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;AAElG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,UAA+B,EAC/B,UAA6C,EAC7C,gBAAoC;AACpC,qGAAqG;AACrG,qGAAqG;AACrG,sGAAsG;AACtG,oBAAuD,EAAE,EACpC,EAAE;IACvB,MAAM,SAAS,GAAW,iBAAiB,CAAC,gBAAgB,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAwB,IAAI,GAAG,CAC1C,CAAC,GAAG,iBAAiB,EAAE,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,SAAiC,EAAU,EAAE,CACtF,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,CACjC,CACF,CAAA;IACD,MAAM,WAAW,GAAwB,UAAU,CAAC,MAAM,CAAC,CAAC,QAAkB,EAAW,EAAE,CACzF,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CACtC,CAAA;IACD,MAAM,OAAO,GAAwB,IAAI,GAAG,CAC1C,WAAW,CAAC,OAAO,CAAC,CAAC,QAAkB,EAAqB,EAAE,CAC5D,aAAa,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,UAAkB,EAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CACzF,CACF,CAAA;IACD,OAAO;QACL,SAAS;QACT,YAAY,EAAE,WAAW,CAAC,MAAM,CAC9B,CAAC,QAAkB,EAAW,EAAE,CAC9B,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,UAAkB,EAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAC1F;QACD,oGAAoG;QACpG,4EAA4E;QAC5E,kGAAkG;QAClG,2FAA2F;QAC3F,oGAAoG;QACpG,oGAAoG;QACpG,kGAAkG;QAClG,2EAA2E;QAC3E,WAAW,EAAE,UAAU;aACpB,MAAM,CACL,CAAC,SAAiC,EAAW,EAAE,CAC7C,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CACjD;aACA,GAAG,CACF,CAAC,SAAiC,EAAU,EAAE,CAC5C,GAAG,SAAS,CAAC,QAAQ,2DAA2D;YAChF,gDAAgD,CACnD;KACJ,CAAA;AACH,CAAC,CAAA"}

package/dist/wiring-policy.d.ts

@@ -0,0 +1,226 @@
+import { type DeclaredExclusion } from './settings.js';
+import type { WiringViolation } from './wiring-violation.js';
+import type { MemberKind } from './workspace-policy.js';
+/** The consumer files the wiring gate reads, injected so the core stays free of filesystem access. */
+export interface WiringInputs {
+    readonly packageJson: unknown;
+    readonly eslintConfig: string | undefined;
+    /** The project's vitest config. The tests gate runs the project's vitest against it. */
+    readonly vitestConfig: string | undefined;
+    /**
+     * The project's Playwright config. Required rather than optional: ploaness ships the accessibility
+     * sweep as a managed spec, so every project has an end-to-end suite and something must run it.
+     */
+    readonly playwrightConfig: string | undefined;
+    /** The contents of pnpm-workspace.yaml, or an empty string when the project ships none. */
+    readonly workspaceFile: string;
+    /** Every exclusion the project declared, so the gate can refuse one that narrows by convenience. */
+    readonly declaredExclusions: readonly DeclaredExclusion[];
+    readonly biomeConfig: string | undefined;
+    readonly tsconfig: string | undefined;
+    /**
+     * Test-authoring libraries the consumer's own specs import, mapped to the version ploaness was built
+     * against. The CLI reads these from the ploaness config package rather than hard-coding them here, so
+     * a harness bump moves the expectation in one place.
+     */
+    readonly expectedTestLibraries: Readonly<Record<string, string>>;
+    /** The subset every project must declare, because its own specs import them. */
+    readonly requiredTestLibraries: ReadonlySet<string>;
+    /**
+     * The exact version every `@payloadcms/*` package must carry, which is the pinned `payload` version.
+     * Derived from the pin rather than enumerated, so a project that adds a Payload plugin is covered
+     * without ploaness listing it.
+     */
+    readonly payloadVersion: string | undefined;
+    /**
+     * The exact `packageManager` field the project must declare. The package manager resolves the whole
+     * dependency graph, so it is the one piece of toolchain that decides what every other pin means.
+     */
+    readonly requiredPackageManager: string | undefined;
+    /** The `engines` block the project must declare, so a project states the runtime ploaness requires. */
+    readonly requiredEngines: Readonly<Record<string, string>>;
+    /** The `files` block the consumer's biome.json must declare, from {@link requiredBiomeFiles}. */
+    readonly requiredBiomeFiles: Readonly<Record<string, unknown>>;
+}
+/** The exact script bodies ploaness owns. The consumer declares the name; ploaness dictates the command. */
+export declare const REQUIRED_SCRIPTS: Readonly<Record<string, string>>;
+/**
+ * The specifier a consumer biome.json must extend. Declared once here rather than written as a literal
+ * in both the rule and the scaffolder that writes the file the rule judges, so the two cannot drift.
+ */
+export declare const REQUIRED_BIOME_EXTENDS: string;
+/**
+ * The specifier a consumer tsconfig.json must extend: the literal file path, not the bare
+ * `ploaness/tsconfig` package specifier. TypeScript honours both, but a Payload project is also parsed
+ * by Next.js, which does not read a package exports map and fails on the bare form. Requiring the path
+ * that works everywhere is the difference between `tsc` passing and `next build` dying on a config it
+ * cannot resolve.
+ */
+export declare const REQUIRED_TSCONFIG_EXTENDS: string;
+/**
+ * The setup file a project writes for itself.
+ *
+ * Named here because four things have to agree about it and none of them can see the others: the Biome
+ * block below includes it, the shipped Vitest config loads it, the fast-check message tells a project to
+ * put a seed in it, and the ESLint config exempts it from a rule aimed at code rather than at process
+ * configuration. A name written four times is a name that eventually differs in one of them.
+ */
+export declare const PROJECT_SETUP_FILE: string;
+/**
+ * The `files` block a consumer's biome.json must carry verbatim.
+ *
+ * File selection cannot live in the shared config the way rule configuration does. Biome resolves a
+ * relative glob against the directory of the config that declares it, and the shared config sits inside
+ * node_modules, where `src/**` matches nothing; Biome then falls back to checking the entire tree. So
+ * ploaness dictates the block and the wiring gate enforces it byte for byte, which keeps ownership with
+ * the harness even though the text has to sit at the project root.
+ * @param sourceRoots the directories the project declared as holding first-party source.
+ * @returns the exact block a conforming biome.json declares.
+ */
+export declare const requiredBiomeFiles: (sourceRoots: readonly string[], kind?: MemberKind, generatedArtefacts?: readonly string[]) => Readonly<Record<string, unknown>>;
+/**
+ * The `include` and `exclude` a consumer's tsconfig.json must carry verbatim.
+ *
+ * The same constraint as {@link requiredBiomeFiles}, for the same reason: TypeScript resolves these globs
+ * against the directory of the config that declares them. Left in the shared config they would walk the
+ * ploaness package itself rather than the project, so they must sit at the project root while ploaness
+ * keeps ownership of their contents.
+ */
+export declare const REQUIRED_TSCONFIG_PATHS: Readonly<Record<string, readonly string[]>>;
+/**
+ * The `include` and `exclude` a member with no Next application must carry.
+ *
+ * The Payload globs name `next-env.d.ts` and two `.next` type directories. In a package that never runs
+ * Next those are carve-outs reaching nothing, which is itself a finding - so the kind that cannot have
+ * them does not claim them.
+ */
+export declare const LIBRARY_TSCONFIG_PATHS: Readonly<Record<string, readonly string[]>>;
+/**
+ * The `include` and `exclude` one member must carry, given the members nested inside it.
+ *
+ * The required `include` is a recursive TypeScript glob, which at a WORKSPACE ROOT sweeps every
+ * member's sources into the root's own project - under the ROOT's `paths`, where a member's `@/*`
+ * resolves to the wrong directory. eoc's root read the CMS scripts that way and failed `types` on
+ * imports that resolve perfectly well inside the CMS. Excluding them is not a relaxation: a member's
+ * analysis stops at its own boundary, which is the rule `knipConfig` already applies for the same
+ * reason, and each nested member is compiled by its own run.
+ *
+ * Derived rather than declared, so a member cannot exclude a sibling it does not contain and cannot
+ * forget one it does - and `ploaness init` writes exactly what the rule then asks for.
+ * @param base the paths for this member's kind.
+ * @param nestedMembers the repo-relative paths of the governed members inside this one.
+ * @returns the same paths, with every nested member excluded.
+ */
+export declare const tsconfigPathsFor: (base: Readonly<Record<string, readonly string[]>>, nestedMembers: readonly string[]) => Readonly<Record<string, readonly string[]>>;
+/**
+ * Everything a member of one kind must point at.
+ *
+ * Declared once and consumed by both the rule and `ploaness init`, for the reason the whole module
+ * exists: two literals that must stay equal will not, and that has already shipped a defect where the
+ * scaffolder wrote a project the gate then failed.
+ */
+export interface MemberWiringTargets {
+    readonly biomeExtends: string;
+    readonly tsconfigExtends: string;
+    readonly tsconfigPaths: Readonly<Record<string, readonly string[]>>;
+    readonly eslintSpecifier: string;
+    readonly vitestSpecifier: string;
+    /** undefined when this kind has no application to drive, and so is not asked for a browser config. */
+    readonly playwrightSpecifier: string | undefined;
+}
+/**
+ * The wiring one kind of member must declare.
+ *
+ * A Next application receives the same configurations as a Payload one: it renders React, it builds
+ * through Next, and it serves pages a browser sweep can drive. What separates the two is the generated
+ * files only Payload has, which {@link requiredBiomeFiles} handles by kind rather than by a second
+ * configuration.
+ * @param kind the member's derived kind.
+ * @returns the specifiers and globs that kind is held to.
+ */
+export declare const wiringTargetsFor: (kind: MemberKind) => MemberWiringTargets;
+/**
+ * The files that must contain nothing but an import of a ploaness config and its default re-export.
+ *
+ * Exported because the ESLint configuration has to name them too: `unicorn/prefer-export-from` rewrites
+ * exactly this shape into `export { default } from '...'`, and it AUTOFIXES - so `ploaness format`
+ * turned a correctly wired project into one `wiring` then rejected, every time it ran. Two rules the
+ * harness owns, contradicting each other, with the formatter casting the deciding vote.
+ *
+ * The list is declared here, beside the rule that requires the shape, so the config that has to exempt
+ * them cannot fall out of step with it.
+ */
+export declare const REEXPORT_CONFIG_FILES: readonly string[];
+/** The repository-level files and declarations the wiring gate reads once, at the git root. */
+export interface RepositoryWiringInputs {
+    readonly packageJson: unknown;
+    readonly workspaceFile: string;
+    readonly declaredExclusions: readonly DeclaredExclusion[];
+    readonly expectedTestLibraries: Readonly<Record<string, string>>;
+    readonly requiredPackageManager: string | undefined;
+    readonly requiredEngines: Readonly<Record<string, string>>;
+    /** Every dependency any member declares, so a root override can be judged against all of them. */
+    readonly declaredAcrossMembers: Readonly<Record<string, string>>;
+    /** Findings the CLI supplies from rules that need the member list rather than one manifest. */
+    readonly repositoryFindings: readonly WiringViolation[];
+}
+/** The files and declarations the wiring gate reads inside one member. */
+export interface PackageWiringInputs {
+    readonly packageJson: unknown;
+    readonly kind: MemberKind;
+    /**
+     * Whether this member sits below the repository root. Biome refuses a second ROOT configuration in
+     * one tree, so a nested member has to say it is not one - and the shipped config cannot say it for
+     * the member, because `root` describes the file that declares it rather than the file it extends.
+     */
+    readonly isNestedMember: boolean;
+    /**
+     * The governed members nested INSIDE this one, repo-relative.
+     *
+     * Empty for every member of a single-package project and for a leaf member of a workspace; non-empty
+     * only for a member that contains others, which in practice is the workspace root.
+     */
+    readonly nestedMembers: readonly string[];
+    /** The `files` block this member's biome.json must carry, from {@link requiredBiomeFiles}. */
+    readonly requiredBiomeFiles: Readonly<Record<string, unknown>>;
+    readonly eslintConfig: string | undefined;
+    readonly vitestConfig: string | undefined;
+    readonly playwrightConfig: string | undefined;
+    readonly declaredExclusions: readonly DeclaredExclusion[];
+    readonly biomeConfig: string | undefined;
+    readonly tsconfig: string | undefined;
+    readonly expectedTestLibraries: Readonly<Record<string, string>>;
+    readonly requiredTestLibraries: ReadonlySet<string>;
+    readonly payloadVersion: string | undefined;
+}
+/**
+ * Return every way the repository has weakened or dropped its ploaness wiring.
+ *
+ * These are the declarations that exist once per repository however many packages it holds: the package
+ * manager that resolves the whole tree, the engines an installer reads, the scripts a run is invoked
+ * through, and the overrides pnpm honours only at the root.
+ * @param inputs the repository-level files to judge.
+ * @returns one violation per defect, in a stable order.
+ */
+export declare const findRepositoryWiringViolations: (inputs: RepositoryWiringInputs) => readonly WiringViolation[];
+/**
+ * Return every way one member has weakened or dropped its ploaness wiring.
+ *
+ * A library member is not asked for a Playwright configuration: it has no application to drive, and
+ * requiring the file would make a package fail for not having a browser it was never going to open.
+ * @param inputs the member's files to judge.
+ * @returns one violation per defect, in a stable order.
+ */
+export declare const findPackageWiringViolations: (inputs: PackageWiringInputs) => readonly WiringViolation[];
+/**
+ * The whole wiring contract for a repository holding exactly one package.
+ *
+ * Not a shim over the split: a single-package repository IS both scopes over one manifest, so composing
+ * the halves is what that case means. It is kept as an entry point because the behaviour it describes is
+ * pinned by a large spec written before the scopes existed - and that spec passing unchanged is the
+ * evidence the split dropped nothing.
+ * @param inputs the consumer files and expectations to judge.
+ * @returns one violation per defect, in a stable order.
+ */
+export declare const findWiringViolations: (inputs: WiringInputs) => readonly WiringViolation[];
+//# sourceMappingURL=wiring-policy.d.ts.map

package/dist/wiring-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wiring-policy.d.ts","sourceRoot":"","sources":["../src/wiring-policy.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,KAAK,iBAAiB,EAA6B,MAAM,eAAe,CAAA;AASjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAoBvD,sGAAsG;AACtG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,wFAAwF;IACxF,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,2FAA2F;IAC3F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,oGAAoG;IACpG,QAAQ,CAAC,kBAAkB,EAAE,SAAS,iBAAiB,EAAE,CAAA;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAChE,gFAAgF;IAChF,QAAQ,CAAC,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACnD;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3C;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,SAAS,CAAA;IACnD,uGAAuG;IACvG,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC1D,iGAAiG;IACjG,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAC/D;AAED,4GAA4G;AAC5G,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI7D,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAyB,CAAA;AAE9D;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAiC,CAAA;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAA0B,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAC7B,aAAa,SAAS,MAAM,EAAE,EAC9B,OAAM,UAAsB,EAC5B,qBAAoB,SAAS,MAAM,EAAwB,KAC1D,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqBjC,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAU/E,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAG9E,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EACjD,eAAe,SAAS,MAAM,EAAE,KAC/B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAG6B,CAAA;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IACnE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,sGAAsG;IACtG,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAA;CACjD;AAoBD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,UAAU,KAAG,mBACQ,CAAA;AAyF5D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAIlD,CAAA;AAkMD,+FAA+F;AAC/F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,iBAAiB,EAAE,CAAA;IACzD,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAChE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC1D,kGAAkG;IAClG,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAChE,+FAA+F;IAC/F,QAAQ,CAAC,kBAAkB,EAAE,SAAS,eAAe,EAAE,CAAA;CACxD;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,8FAA8F;IAC9F,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC9D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,iBAAiB,EAAE,CAAA;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAChE,QAAQ,CAAC,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;CAC5C;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,GACzC,QAAQ,sBAAsB,KAC7B,SAAS,eAAe,EAsB1B,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,GACtC,QAAQ,mBAAmB,KAC1B,SAAS,eAAe,EA8B1B,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,YAAY,KAAG,SAAS,eAAe,EA6BnF,CAAA"}