@ploaness/governance 1.0.0

package/dist/workspace-policy.d.ts

@@ -0,0 +1,177 @@
+/** The repo-relative path of the member that sits at the repository root. */
+export declare const ROOT_MEMBER_PATH: string;
+/** A directory holding a package.json, and what that manifest declares. */
+export interface ProjectManifest {
+    /** Repo-relative, {@link ROOT_MEMBER_PATH} for the repository root. */
+    readonly path: string;
+    readonly packageJson: unknown;
+}
+/** A governed member, reduced to what the repository-scope rules need to know about it. */
+export interface MemberShape {
+    readonly path: string;
+    readonly isPayload: boolean;
+    /** The member's own source roots, used to decide whether a nested project is already covered. */
+    readonly sourceRoots: readonly string[];
+}
+/**
+ * Locate the repository root from the directories above the working directory.
+ *
+ * Deliberately not `git rev-parse --show-toplevel`. The integration fixtures run cases in directories
+ * that are never `git init`-ed, and asking git there walks out of the fixture and adopts whichever
+ * repository happens to contain the temporary directory - so a case would be judged against a tree
+ * nobody wrote. A workspace file is the stronger signal anyway: it is what pnpm itself reads to decide
+ * where the workspace begins.
+ * @param ancestors the working directory first, then each parent up to the filesystem root.
+ * @param hasEntry whether a directory holds a named entry.
+ * @returns the repository root, falling back to the working directory when nothing above it qualifies.
+ */
+export declare const findRepositoryRoot: (ancestors: readonly string[], hasEntry: (directory: string, entry: string) => boolean) => string;
+/**
+ * The directory patterns a workspace file declares.
+ * @param workspaceFile the contents of pnpm-workspace.yaml, or an empty string when absent.
+ * @returns one pattern per entry, in declaration order, including any leading-`!` exclusions.
+ */
+export declare const readWorkspacePackages: (workspaceFile: string) => readonly string[];
+/**
+ * The directories a workspace file selects as pnpm projects.
+ *
+ * The repository root is always a project whether or not `packages:` names it: it carries the manifest
+ * that declares the package manager, the engines and the scripts a run is invoked through, so a
+ * repository whose root were not a project would have no place to state any of them.
+ * @param patterns the declared directory patterns.
+ * @param directoriesWithManifest every repo-relative directory holding a tracked package.json.
+ * @returns the selected directories, root first, without duplicates.
+ */
+export declare const selectProjects: (patterns: readonly string[], directoriesWithManifest: readonly string[]) => readonly string[];
+/**
+ * Whether a project's manifest declares ploaness, which is what makes it a governed member.
+ *
+ * The marker is not a switch a project flips to escape. Under pnpm's strict layout a package that does
+ * not depend on ploaness cannot resolve `ploaness/biome`, `ploaness/eslint` or `ploaness/tsconfig.json`
+ * from its own configuration files, so its wiring could not work whatever this rule said - and dropping
+ * the declaration to avoid the gates is reported by {@link findUngovernedProjects} rather than obeyed.
+ * @param packageJson the project's parsed manifest.
+ * @returns true when ploaness is a declared dependency.
+ */
+export declare const isGovernedProject: (packageJson: unknown) => boolean;
+/**
+ * Whether a project's manifest declares Payload, which decides the third scope.
+ * @param packageJson the project's parsed manifest.
+ * @returns true when payload is a declared dependency.
+ */
+export declare const isPayloadProject: (packageJson: unknown) => boolean;
+/**
+ * What kind of package a member is, which decides the configurations it receives.
+ *
+ * Three kinds rather than the Payload/not-Payload pair this started as. A Next application that is not
+ * a Payload one - a public site reading a CMS over HTTP - has route handlers, a client bundle and a
+ * browser suite, so handing it a library's configuration would leave all three ungoverned; handing it
+ * Payload's would judge it against generated files it does not have. The kind is DERIVED from what the
+ * member declares and never declared directly, so a project cannot receive a weaker configuration by
+ * describing itself differently.
+ */
+export type MemberKind = 'payload' | 'application' | 'library';
+/**
+ * Decide a member's kind from its manifest.
+ * @param packageJson the member's parsed manifest.
+ * @returns `payload` when it declares Payload, `application` when it declares Next, else `library`.
+ */
+export declare const memberKindOf: (packageJson: unknown) => MemberKind;
+/**
+ * Whether a member has a server of its own, and therefore a build, a client bundle and a browser to
+ * drive. A library has none of the three, so the gates and configurations about them do not apply to it.
+ * @param kind the member's kind.
+ * @returns true for a Payload or Next application.
+ */
+export declare const hasRuntime: (kind: MemberKind) => boolean;
+/**
+ * The projects ploaness governs.
+ *
+ * A repository where nothing declares ploaness still has one member - its root - so a project that has
+ * not been initialised yet is reported by `preflight` and `wiring` rather than by an empty run that
+ * would look like a pass.
+ * @param projects every pnpm project the workspace selects.
+ * @returns the governed member paths, or the root alone when none qualifies.
+ */
+export declare const findGovernedMembers: (projects: readonly ProjectManifest[]) => readonly string[];
+/**
+ * Report every pnpm project ploaness is not judging.
+ *
+ * This is the anti-bypass half of the member marker. Dropping `ploaness` from a package's manifest
+ * removes it from the governed set, which without this rule would be a silent way to take a whole
+ * application out of verification.
+ * @param projects every pnpm project the workspace selects.
+ * @param members the governed members.
+ * @returns one finding per project that is neither governed nor inside a governed member's source.
+ */
+export declare const findUngovernedProjects: (projects: readonly ProjectManifest[], members: readonly MemberShape[]) => readonly string[];
+/**
+ * Verify the repository is a Payload project.
+ *
+ * Asked of the repository rather than of one directory, because a workspace legitimately holds packages
+ * that are not Payload applications. What ploaness refuses to judge is a repository with no Payload in
+ * it at all, which is the same refusal `preflight` always made, moved up one level.
+ * @param members the governed members.
+ * @returns a single finding when no member declares payload.
+ */
+export declare const findPayloadMemberViolations: (members: readonly MemberShape[]) => readonly string[];
+/** A member's declared origin, which the end-to-end run drives. */
+export interface MemberOrigin {
+    readonly path: string;
+    readonly serverUrl: string;
+}
+/**
+ * Report members that would drive the same origin.
+ *
+ * The end-to-end configuration starts the application and reuses an existing server when one already
+ * answers. Two members sharing an origin therefore do not collide loudly: the second run finds the first
+ * application still listening, sweeps it, and passes - reporting on an application that was never under
+ * test. Nothing else in the harness can see that, and it exists only once more than one member has a
+ * browser suite.
+ * @param origins each member's path and declared origin.
+ * @returns one finding per member sharing an origin with an earlier one.
+ */
+export declare const findServerUrlCollisions: (origins: readonly MemberOrigin[]) => readonly string[];
+/**
+ * The patterns that stop an analyzer walking below this member into another member.
+ *
+ * A tool that reads everything under the directory it runs in has no idea where a package ends, and at a
+ * workspace root every sibling sits underneath. knip reported each sibling's entry point as an unused
+ * file that way; ESLint reported findings no member's own gate reports, because a shipped configuration
+ * reads its settings from the working directory - so the framework glue and the generated artefacts a
+ * member declares are absent from the configuration a root-started run renders, whichever config file
+ * that run resolves. Nothing is lost by stopping: each sibling is a separate analysis, under its own
+ * settings and its own entry points, which is what running the gate per member does.
+ *
+ * Shared rather than spelled out at each call site, because a boundary two analyzers disagree about is
+ * one analyzer reaching past it.
+ * @param siblingPaths the other members' paths, relative to this member's directory.
+ * @returns one recursive ignore pattern per sibling.
+ */
+export declare const analysisBoundaries: (siblingPaths: readonly string[]) => readonly string[];
+/** Whether an ESLint run applies its fixable rules or reports what it finds. */
+export type EslintRunMode = 'fix' | 'report';
+/**
+ * The arguments an ESLint run takes, whether it is judging a member or writing to one.
+ *
+ * The boundary has to ride on the command line rather than sit in a configuration file, because ESLint
+ * resolves its ignores from the working directory: a run started at a workspace root renders the ROOT's
+ * settings over a member's files, so the framework glue and generated artefacts that member declares are
+ * simply absent from what that run sees. `analysisBoundaries` states where to stop; this states that
+ * both runs are told.
+ *
+ * They were not. The gate carried the boundary and `ploaness format` did not, which is the worse of the
+ * two halves to get wrong: a judge reaching too far reports a finding somebody argues with, while a
+ * WRITER reaching too far edits files no gate will ever look at. A root-started format rewrote a Payload
+ * member's generated import map - stripping the `@type` annotation and rewriting an import - and every
+ * gate in the repository stayed green, because each member's own run correctly excludes that file.
+ *
+ * The mode flag is the only legitimate difference. `--max-warnings=0` is a verdict, which a run that
+ * writes does not render; `ploaness format` deliberately succeeds while findings remain, since the
+ * unfixable ones are for `ploaness verify` to report.
+ * @param siblingPaths the other members' paths, relative to this member's directory.
+ * @param mode whether this run writes fixes or renders a verdict.
+ * @returns the full argument list, the target first.
+ */
+export declare const eslintArguments: (siblingPaths: readonly string[], mode: EslintRunMode) => readonly string[];
+//# sourceMappingURL=workspace-policy.d.ts.map

package/dist/workspace-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-policy.d.ts","sourceRoot":"","sources":["../src/workspace-policy.ts"],"names":[],"mappings":"AAaA,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,EAAE,MAAY,CAAA;AAK3C,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED,2FAA2F;AAC3F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,iGAAiG;IACjG,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,SAAS,MAAM,EAAE,EAC5B,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,KACtD,MAYF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,eAAe,MAAM,KAAG,SAAS,MAAM,EAC7B,CAAA;AAmBhD;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GACzB,UAAU,SAAS,MAAM,EAAE,EAC3B,yBAAyB,SAAS,MAAM,EAAE,KACzC,SAAS,MAAM,EAMjB,CAAA;AAKD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,aAAa,OAAO,KAAG,OACV,CAAA;AAE/C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,aAAa,OAAO,KAAG,OACT,CAAA;AAE/C;;;;;;;;;GASG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAAA;AAE9D;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,aAAa,OAAO,KAAG,UAKnD,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,MAAM,UAAU,KAAG,OAA6B,CAAA;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,UAAU,SAAS,eAAe,EAAE,KAAG,SAAS,MAAM,EAKzF,CAAA;AAYD;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,GACjC,UAAU,SAAS,eAAe,EAAE,EACpC,SAAS,SAAS,WAAW,EAAE,KAC9B,SAAS,MAAM,EAeb,CAAA;AAEL;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,GAAI,SAAS,SAAS,WAAW,EAAE,KAAG,SAAS,MAAM,EAMtF,CAAA;AAEP,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,SAAS,YAAY,EAAE,KAAG,SAAS,MAAM,EAYtF,CAAA;AAEJ;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAAI,cAAc,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EACpB,CAAA;AAEhE,gFAAgF;AAChF,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,QAAQ,CAAA;AAE5C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,eAAe,GAC1B,cAAc,SAAS,MAAM,EAAE,EAC/B,MAAM,aAAa,KAClB,SAAS,MAAM,EAOjB,CAAA"}

package/dist/workspace-policy.js

@@ -0,0 +1,228 @@
+// What a repository is made of: where its root is, which directories are pnpm projects, and which of
+// those ploaness governs.
+//
+// ploaness governed exactly one package until now - `process.cwd()`, with every path joined onto it. That
+// was not a simplification of workspaces, it was blindness to them: run from a member, the gates read the
+// member's directory for files that only exist at the workspace root, and two of them reported a verdict
+// about a file they had not found. This module is the missing distinction, kept pure so the rules about
+// which directories are governed can be spec'd against directory lists no filesystem has to produce.
+import { matchesGlob } from './file-roles.js';
+import { declaredDependencies } from './json-shapes.js';
+import { HARNESS_PACKAGE, NEXT_PACKAGE, PAYLOAD_PACKAGE } from './version-policy.js';
+import { topLevelListItems } from './yaml-blocks.js';
+/** The repo-relative path of the member that sits at the repository root. */
+export const ROOT_MEMBER_PATH = '.';
+/** The workspace file key naming the directories pnpm treats as projects. */
+const PACKAGES_KEY = 'packages';
+/**
+ * Locate the repository root from the directories above the working directory.
+ *
+ * Deliberately not `git rev-parse --show-toplevel`. The integration fixtures run cases in directories
+ * that are never `git init`-ed, and asking git there walks out of the fixture and adopts whichever
+ * repository happens to contain the temporary directory - so a case would be judged against a tree
+ * nobody wrote. A workspace file is the stronger signal anyway: it is what pnpm itself reads to decide
+ * where the workspace begins.
+ * @param ancestors the working directory first, then each parent up to the filesystem root.
+ * @param hasEntry whether a directory holds a named entry.
+ * @returns the repository root, falling back to the working directory when nothing above it qualifies.
+ */
+export const findRepositoryRoot = (ancestors, hasEntry) => {
+    const workspace = ancestors.find((directory) => hasEntry(directory, 'pnpm-workspace.yaml'));
+    if (workspace !== undefined) {
+        return workspace;
+    }
+    const checkout = ancestors.find((directory) => hasEntry(directory, '.git') && hasEntry(directory, 'package.json'));
+    return checkout ?? ancestors[0] ?? ROOT_MEMBER_PATH;
+};
+/**
+ * The directory patterns a workspace file declares.
+ * @param workspaceFile the contents of pnpm-workspace.yaml, or an empty string when absent.
+ * @returns one pattern per entry, in declaration order, including any leading-`!` exclusions.
+ */
+export const readWorkspacePackages = (workspaceFile) => topLevelListItems(workspaceFile, PACKAGES_KEY);
+const EXCLUSION_MARKER = '!';
+// pnpm applies every exclusion after every inclusion rather than in written order, so a directory named
+// by both is excluded whichever came first. Reading them in order would make the result depend on how
+// the file happens to be arranged.
+const isSelected = (patterns, directory) => {
+    const isIncluded = patterns
+        .filter((pattern) => !pattern.startsWith(EXCLUSION_MARKER))
+        .some((pattern) => matchesGlob(pattern, directory));
+    const isExcluded = patterns
+        .filter((pattern) => pattern.startsWith(EXCLUSION_MARKER))
+        .some((pattern) => matchesGlob(pattern.slice(EXCLUSION_MARKER.length), directory));
+    return isIncluded && !isExcluded;
+};
+/**
+ * The directories a workspace file selects as pnpm projects.
+ *
+ * The repository root is always a project whether or not `packages:` names it: it carries the manifest
+ * that declares the package manager, the engines and the scripts a run is invoked through, so a
+ * repository whose root were not a project would have no place to state any of them.
+ * @param patterns the declared directory patterns.
+ * @param directoriesWithManifest every repo-relative directory holding a tracked package.json.
+ * @returns the selected directories, root first, without duplicates.
+ */
+export const selectProjects = (patterns, directoriesWithManifest) => [
+    ...(directoriesWithManifest.includes(ROOT_MEMBER_PATH) ? [ROOT_MEMBER_PATH] : []),
+    ...directoriesWithManifest.filter((directory) => directory !== ROOT_MEMBER_PATH && isSelected(patterns, directory)),
+];
+const declaresPackage = (packageJson, packageName) => Object.hasOwn(declaredDependencies(packageJson), packageName);
+/**
+ * Whether a project's manifest declares ploaness, which is what makes it a governed member.
+ *
+ * The marker is not a switch a project flips to escape. Under pnpm's strict layout a package that does
+ * not depend on ploaness cannot resolve `ploaness/biome`, `ploaness/eslint` or `ploaness/tsconfig.json`
+ * from its own configuration files, so its wiring could not work whatever this rule said - and dropping
+ * the declaration to avoid the gates is reported by {@link findUngovernedProjects} rather than obeyed.
+ * @param packageJson the project's parsed manifest.
+ * @returns true when ploaness is a declared dependency.
+ */
+export const isGovernedProject = (packageJson) => declaresPackage(packageJson, HARNESS_PACKAGE);
+/**
+ * Whether a project's manifest declares Payload, which decides the third scope.
+ * @param packageJson the project's parsed manifest.
+ * @returns true when payload is a declared dependency.
+ */
+export const isPayloadProject = (packageJson) => declaresPackage(packageJson, PAYLOAD_PACKAGE);
+/**
+ * Decide a member's kind from its manifest.
+ * @param packageJson the member's parsed manifest.
+ * @returns `payload` when it declares Payload, `application` when it declares Next, else `library`.
+ */
+export const memberKindOf = (packageJson) => {
+    if (declaresPackage(packageJson, PAYLOAD_PACKAGE)) {
+        return 'payload';
+    }
+    return declaresPackage(packageJson, NEXT_PACKAGE) ? 'application' : 'library';
+};
+/**
+ * Whether a member has a server of its own, and therefore a build, a client bundle and a browser to
+ * drive. A library has none of the three, so the gates and configurations about them do not apply to it.
+ * @param kind the member's kind.
+ * @returns true for a Payload or Next application.
+ */
+export const hasRuntime = (kind) => kind !== 'library';
+/**
+ * The projects ploaness governs.
+ *
+ * A repository where nothing declares ploaness still has one member - its root - so a project that has
+ * not been initialised yet is reported by `preflight` and `wiring` rather than by an empty run that
+ * would look like a pass.
+ * @param projects every pnpm project the workspace selects.
+ * @returns the governed member paths, or the root alone when none qualifies.
+ */
+export const findGovernedMembers = (projects) => {
+    const governed = projects
+        .filter((project) => isGovernedProject(project.packageJson))
+        .map((project) => project.path);
+    return governed.length > 0 ? governed : [ROOT_MEMBER_PATH];
+};
+// A project inside a member's declared source roots is already judged as that member's source. Treating
+// it as ungoverned would report every fixture and example directory a governed package legitimately
+// carries.
+const isCoveredBy = (member, projectPath) => member.sourceRoots.some((root) => projectPath.startsWith(member.path === ROOT_MEMBER_PATH ? `${root}/` : `${member.path}/${root}/`));
+/**
+ * Report every pnpm project ploaness is not judging.
+ *
+ * This is the anti-bypass half of the member marker. Dropping `ploaness` from a package's manifest
+ * removes it from the governed set, which without this rule would be a silent way to take a whole
+ * application out of verification.
+ * @param projects every pnpm project the workspace selects.
+ * @param members the governed members.
+ * @returns one finding per project that is neither governed nor inside a governed member's source.
+ */
+export const findUngovernedProjects = (projects, members) => projects
+    .filter((project) => {
+    const isMember = members.some((member) => member.path === project.path);
+    return !(isMember ||
+        members.some((member) => isCoveredBy(member, project.path)));
+})
+    .map((project) => `${project.path}/package.json: is a pnpm project ploaness does not govern; ` +
+    `declare "${HARNESS_PACKAGE}" so its source is verified, or remove the package`);
+/**
+ * Verify the repository is a Payload project.
+ *
+ * Asked of the repository rather than of one directory, because a workspace legitimately holds packages
+ * that are not Payload applications. What ploaness refuses to judge is a repository with no Payload in
+ * it at all, which is the same refusal `preflight` always made, moved up one level.
+ * @param members the governed members.
+ * @returns a single finding when no member declares payload.
+ */
+export const findPayloadMemberViolations = (members) => members.some((member) => member.isPayload)
+    ? []
+    : [
+        'no package in this repository declares "payload"; ploaness governs Payload CMS projects ' +
+            'and will not judge another kind',
+    ];
+/**
+ * Report members that would drive the same origin.
+ *
+ * The end-to-end configuration starts the application and reuses an existing server when one already
+ * answers. Two members sharing an origin therefore do not collide loudly: the second run finds the first
+ * application still listening, sweeps it, and passes - reporting on an application that was never under
+ * test. Nothing else in the harness can see that, and it exists only once more than one member has a
+ * browser suite.
+ * @param origins each member's path and declared origin.
+ * @returns one finding per member sharing an origin with an earlier one.
+ */
+export const findServerUrlCollisions = (origins) => origins.flatMap((origin, index) => {
+    const earlier = origins
+        .slice(0, index)
+        .find((other) => other.serverUrl === origin.serverUrl);
+    return earlier === undefined
+        ? []
+        : [
+            `${origin.path}/package.json ploaness.serverUrl: is "${origin.serverUrl}", which ` +
+                `${earlier.path} already drives; the end-to-end run would reuse that application's ` +
+                'server and sweep the wrong one',
+        ];
+});
+/**
+ * The patterns that stop an analyzer walking below this member into another member.
+ *
+ * A tool that reads everything under the directory it runs in has no idea where a package ends, and at a
+ * workspace root every sibling sits underneath. knip reported each sibling's entry point as an unused
+ * file that way; ESLint reported findings no member's own gate reports, because a shipped configuration
+ * reads its settings from the working directory - so the framework glue and the generated artefacts a
+ * member declares are absent from the configuration a root-started run renders, whichever config file
+ * that run resolves. Nothing is lost by stopping: each sibling is a separate analysis, under its own
+ * settings and its own entry points, which is what running the gate per member does.
+ *
+ * Shared rather than spelled out at each call site, because a boundary two analyzers disagree about is
+ * one analyzer reaching past it.
+ * @param siblingPaths the other members' paths, relative to this member's directory.
+ * @returns one recursive ignore pattern per sibling.
+ */
+export const analysisBoundaries = (siblingPaths) => siblingPaths.map((sibling) => `${sibling}/**`);
+/**
+ * The arguments an ESLint run takes, whether it is judging a member or writing to one.
+ *
+ * The boundary has to ride on the command line rather than sit in a configuration file, because ESLint
+ * resolves its ignores from the working directory: a run started at a workspace root renders the ROOT's
+ * settings over a member's files, so the framework glue and generated artefacts that member declares are
+ * simply absent from what that run sees. `analysisBoundaries` states where to stop; this states that
+ * both runs are told.
+ *
+ * They were not. The gate carried the boundary and `ploaness format` did not, which is the worse of the
+ * two halves to get wrong: a judge reaching too far reports a finding somebody argues with, while a
+ * WRITER reaching too far edits files no gate will ever look at. A root-started format rewrote a Payload
+ * member's generated import map - stripping the `@type` annotation and rewriting an import - and every
+ * gate in the repository stayed green, because each member's own run correctly excludes that file.
+ *
+ * The mode flag is the only legitimate difference. `--max-warnings=0` is a verdict, which a run that
+ * writes does not render; `ploaness format` deliberately succeeds while findings remain, since the
+ * unfixable ones are for `ploaness verify` to report.
+ * @param siblingPaths the other members' paths, relative to this member's directory.
+ * @param mode whether this run writes fixes or renders a verdict.
+ * @returns the full argument list, the target first.
+ */
+export const eslintArguments = (siblingPaths, mode) => [
+    '.',
+    mode === 'fix' ? '--fix' : '--max-warnings=0',
+    ...analysisBoundaries(siblingPaths).flatMap((pattern) => [
+        '--ignore-pattern',
+        pattern,
+    ]),
+];
+//# sourceMappingURL=workspace-policy.js.map

package/dist/workspace-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-policy.js","sourceRoot":"","sources":["../src/workspace-policy.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,0BAA0B;AAC1B,EAAE;AACF,0GAA0G;AAC1G,0GAA0G;AAC1G,yGAAyG;AACzG,wGAAwG;AACxG,qGAAqG;AACrG,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAW,GAAG,CAAA;AAE3C,6EAA6E;AAC7E,MAAM,YAAY,GAAW,UAAU,CAAA;AAiBvC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,SAA4B,EAC5B,QAAuD,EAC/C,EAAE;IACV,MAAM,SAAS,GAAuB,SAAS,CAAC,IAAI,CAAC,CAAC,SAAiB,EAAW,EAAE,CAClF,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAC3C,CAAA;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAuB,SAAS,CAAC,IAAI,CACjD,CAAC,SAAiB,EAAW,EAAE,CAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,CACrE,CAAA;IACD,OAAO,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAA;AACrD,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,aAAqB,EAAqB,EAAE,CAChF,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;AAEhD,MAAM,gBAAgB,GAAW,GAAG,CAAA;AAEpC,wGAAwG;AACxG,sGAAsG;AACtG,mCAAmC;AACnC,MAAM,UAAU,GAAG,CAAC,QAA2B,EAAE,SAAiB,EAAW,EAAE;IAC7E,MAAM,UAAU,GAAY,QAAQ;SACjC,MAAM,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;SAC3E,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;IACtE,MAAM,UAAU,GAAY,QAAQ;SACjC,MAAM,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;SAC1E,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CACjC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAC/D,CAAA;IACH,OAAO,UAAU,IAAI,CAAC,UAAU,CAAA;AAClC,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,QAA2B,EAC3B,uBAA0C,EACvB,EAAE,CAAC;IACtB,GAAG,CAAC,uBAAuB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,GAAG,uBAAuB,CAAC,MAAM,CAC/B,CAAC,SAAiB,EAAW,EAAE,CAC7B,SAAS,KAAK,gBAAgB,IAAI,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CACpE;CACF,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,WAAoB,EAAE,WAAmB,EAAW,EAAE,CAC7E,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAA;AAE/D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,WAAoB,EAAW,EAAE,CACjE,eAAe,CAAC,WAAW,EAAE,eAAe,CAAC,CAAA;AAE/C;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,WAAoB,EAAW,EAAE,CAChE,eAAe,CAAC,WAAW,EAAE,eAAe,CAAC,CAAA;AAc/C;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,WAAoB,EAAc,EAAE;IAC/D,IAAI,eAAe,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;QAClD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAW,EAAE,CAAC,IAAI,KAAK,SAAS,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAoC,EAAqB,EAAE;IAC7F,MAAM,QAAQ,GAAsB,QAAQ;SACzC,MAAM,CAAC,CAAC,OAAwB,EAAW,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;SACrF,GAAG,CAAC,CAAC,OAAwB,EAAU,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1D,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAA;AAC5D,CAAC,CAAA;AAED,wGAAwG;AACxG,oGAAoG;AACpG,WAAW;AACX,MAAM,WAAW,GAAG,CAAC,MAAmB,EAAE,WAAmB,EAAW,EAAE,CACxE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAChD,WAAW,CAAC,UAAU,CACpB,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,GAAG,CAC1E,CACF,CAAA;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,QAAoC,EACpC,OAA+B,EACZ,EAAE,CACrB,QAAQ;KACL,MAAM,CAAC,CAAC,OAAwB,EAAW,EAAE;IAC5C,MAAM,QAAQ,GAAY,OAAO,CAAC,IAAI,CACpC,CAAC,MAAmB,EAAW,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAC/D,CAAA;IACD,OAAO,CAAC,CACN,QAAQ;QACR,OAAO,CAAC,IAAI,CAAC,CAAC,MAAmB,EAAW,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAClF,CAAA;AACH,CAAC,CAAC;KACD,GAAG,CACF,CAAC,OAAwB,EAAU,EAAE,CACnC,GAAG,OAAO,CAAC,IAAI,6DAA6D;IAC5E,YAAY,eAAe,oDAAoD,CAClF,CAAA;AAEL;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAA+B,EAAqB,EAAE,CAChG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAmB,EAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;IAC9D,CAAC,CAAC,EAAE;IACJ,CAAC,CAAC;QACE,0FAA0F;YACxF,iCAAiC;KACpC,CAAA;AAQP;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,OAAgC,EAAqB,EAAE,CAC7F,OAAO,CAAC,OAAO,CAAC,CAAC,MAAoB,EAAE,KAAa,EAAqB,EAAE;IACzE,MAAM,OAAO,GAA6B,OAAO;SAC9C,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;SACf,IAAI,CAAC,CAAC,KAAmB,EAAW,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,CAAA;IAC/E,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,GAAG,MAAM,CAAC,IAAI,yCAAyC,MAAM,CAAC,SAAS,WAAW;gBAChF,GAAG,OAAO,CAAC,IAAI,qEAAqE;gBACpF,gCAAgC;SACnC,CAAA;AACP,CAAC,CAAC,CAAA;AAEJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,YAA+B,EAAqB,EAAE,CACvF,YAAY,CAAC,GAAG,CAAC,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,OAAO,KAAK,CAAC,CAAA;AAKhE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,YAA+B,EAC/B,IAAmB,EACA,EAAE,CAAC;IACtB,GAAG;IACH,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB;IAC7C,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,OAAe,EAAqB,EAAE,CAAC;QAClF,kBAAkB;QAClB,OAAO;KACR,CAAC;CACH,CAAA"}

package/dist/yaml-blocks.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Whether an install config declares a top-level key at all.
+ *
+ * Separate from reading the block because a key can be meaningful while its body is empty:
+ * `onlyBuiltDependencies: []` permits no dependency to run a script, which is an answer rather than
+ * an omission.
+ * @param file the contents of a YAML file, or an empty string when it is absent.
+ * @param key the top-level key to look for.
+ * @returns true when the key appears unindented.
+ */
+export declare const declaresTopLevelKey: (file: string, key: string) => boolean;
+/**
+ * The lines of one top-level block, which run until the next unindented line.
+ * @param file the contents of a YAML file, or an empty string when it is absent.
+ * @param key the top-level key whose body to read.
+ * @returns the block's lines, or an empty array when the key is absent.
+ */
+export declare const topLevelBlockLines: (file: string, key: string) => readonly string[];
+/**
+ * Strip one layer of matching or unmatched surrounding quotes.
+ * @param value the raw scalar.
+ * @returns the value without its surrounding quote characters.
+ */
+export declare const withoutQuotes: (value: string) => string;
+/**
+ * The items of a top-level YAML sequence, such as the `packages:` block of a workspace file.
+ * @param file the contents of a YAML file, or an empty string when it is absent.
+ * @param key the top-level key whose sequence to read.
+ * @returns one unquoted entry per `- item` line, in declaration order.
+ */
+export declare const topLevelListItems: (file: string, key: string) => readonly string[];
+/**
+ * The `key: value` entries of a top-level YAML mapping, such as an `overrides:` block.
+ *
+ * Split at the FIRST colon, not the last: a value carries colons of its own - `npm:preact@10`,
+ * `link:../fork`, `git+ssh://...` - and splitting at the last one read `react: npm:preact@10` as a
+ * package called "react: npm", so every alias form walked straight through the rule meant to catch it.
+ * @param file the contents of a YAML file, or an empty string when it is absent.
+ * @param key the top-level key whose mapping to read.
+ * @returns one `[name, value]` pair per entry, both unquoted.
+ */
+export declare const topLevelMappingEntries: (file: string, key: string) => readonly (readonly [string, string])[];
+//# sourceMappingURL=yaml-blocks.d.ts.map

package/dist/yaml-blocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml-blocks.d.ts","sourceRoot":"","sources":["../src/yaml-blocks.ts"],"names":[],"mappings":"AAeA;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,EAAE,KAAK,MAAM,KAAG,OACY,CAAA;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,KAAK,MAAM,KAAG,SAAS,MAAM,EAW7E,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,MAA8C,CAAA;AAe5F;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,EAAE,KAAK,MAAM,KAAG,SAAS,MAAM,EAIpB,CAAA;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,GACjC,MAAM,MAAM,EACZ,KAAK,MAAM,KACV,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAcpC,CAAA"}

package/dist/yaml-blocks.js

@@ -0,0 +1,87 @@
+// The small reader for the top-level blocks pnpm reads out of a workspace file.
+//
+// It is not a YAML parser and must not become one. pnpm honours these keys only at the top level of
+// `pnpm-workspace.yaml`, so what has to be recognised is exactly "an unindented key, and the indented
+// lines beneath it" - a shape a regex reads correctly and a parser would only read more expensively.
+//
+// It lives here rather than in `install-policy.ts`, which wrote it first, because `workspace-policy.ts`
+// needs the same three predicates to read the `packages:` block. Two crude readers in one package would
+// not stay equal, and the one that drifted would be the one deciding which directories are governed.
+const isTopLevelKey = (line, key) => new RegExp(String.raw `^${key}\s*:`).test(line);
+const isIndented = (line) => /^\s+\S/.test(line);
+/**
+ * Whether an install config declares a top-level key at all.
+ *
+ * Separate from reading the block because a key can be meaningful while its body is empty:
+ * `onlyBuiltDependencies: []` permits no dependency to run a script, which is an answer rather than
+ * an omission.
+ * @param file the contents of a YAML file, or an empty string when it is absent.
+ * @param key the top-level key to look for.
+ * @returns true when the key appears unindented.
+ */
+export const declaresTopLevelKey = (file, key) => file.split('\n').some((line) => isTopLevelKey(line, key));
+/**
+ * The lines of one top-level block, which run until the next unindented line.
+ * @param file the contents of a YAML file, or an empty string when it is absent.
+ * @param key the top-level key whose body to read.
+ * @returns the block's lines, or an empty array when the key is absent.
+ */
+export const topLevelBlockLines = (file, key) => {
+    const lines = file.split('\n');
+    const start = lines.findIndex((line) => isTopLevelKey(line, key));
+    if (start === -1) {
+        return [];
+    }
+    const rest = lines.slice(start + 1);
+    const end = rest.findIndex((line) => line.trim().length > 0 && !isIndented(line));
+    return end === -1 ? rest : rest.slice(0, end);
+};
+/**
+ * Strip one layer of matching or unmatched surrounding quotes.
+ * @param value the raw scalar.
+ * @returns the value without its surrounding quote characters.
+ */
+export const withoutQuotes = (value) => value.replaceAll(/^['"]|['"]$/g, '');
+// A whole-line comment is not content. Trailing text after a `#` is stripped only where it cannot be
+// part of a value: a path glob carries no `#`, but an override specifier does - `git+ssh://host/repo#tag`
+// is a legal pin, and cutting at the `#` would silently rewrite which commit the rule judges.
+const contentLines = (lines) => lines
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0 && !line.startsWith('#'));
+const withoutTrailingComment = (line) => {
+    const hash = line.indexOf('#');
+    return hash === -1 ? line : line.slice(0, hash).trim();
+};
+/**
+ * The items of a top-level YAML sequence, such as the `packages:` block of a workspace file.
+ * @param file the contents of a YAML file, or an empty string when it is absent.
+ * @param key the top-level key whose sequence to read.
+ * @returns one unquoted entry per `- item` line, in declaration order.
+ */
+export const topLevelListItems = (file, key) => contentLines(topLevelBlockLines(file, key))
+    .filter((line) => line.startsWith('-'))
+    .map((line) => withoutQuotes(withoutTrailingComment(line.slice(1).trim())))
+    .filter((entry) => entry.length > 0);
+/**
+ * The `key: value` entries of a top-level YAML mapping, such as an `overrides:` block.
+ *
+ * Split at the FIRST colon, not the last: a value carries colons of its own - `npm:preact@10`,
+ * `link:../fork`, `git+ssh://...` - and splitting at the last one read `react: npm:preact@10` as a
+ * package called "react: npm", so every alias form walked straight through the rule meant to catch it.
+ * @param file the contents of a YAML file, or an empty string when it is absent.
+ * @param key the top-level key whose mapping to read.
+ * @returns one `[name, value]` pair per entry, both unquoted.
+ */
+export const topLevelMappingEntries = (file, key) => contentLines(topLevelBlockLines(file, key)).flatMap((line) => {
+    const separator = line.indexOf(':');
+    if (separator === -1) {
+        return [];
+    }
+    return [
+        [
+            withoutQuotes(line.slice(0, separator).trim()),
+            withoutQuotes(line.slice(separator + 1).trim()),
+        ],
+    ];
+});
+//# sourceMappingURL=yaml-blocks.js.map

package/dist/yaml-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml-blocks.js","sourceRoot":"","sources":["../src/yaml-blocks.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,oGAAoG;AACpG,sGAAsG;AACtG,qGAAqG;AACrG,EAAE;AACF,wGAAwG;AACxG,wGAAwG;AACxG,qGAAqG;AAErG,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,GAAW,EAAW,EAAE,CAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEhD,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEjE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAE,GAAW,EAAW,EAAE,CACxE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;AAE5E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAE,GAAW,EAAqB,EAAE;IACjF,MAAM,KAAK,GAAsB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjD,MAAM,KAAK,GAAW,KAAK,CAAC,SAAS,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;IAC1F,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAsB,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IACtD,MAAM,GAAG,GAAW,IAAI,CAAC,SAAS,CAChC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CACvE,CAAA;IACD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAC/C,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;AAE5F,qGAAqG;AACrG,0GAA0G;AAC1G,8FAA8F;AAC9F,MAAM,YAAY,GAAG,CAAC,KAAwB,EAAqB,EAAE,CACnE,KAAK;KACF,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;KAC1C,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AAEhF,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAU,EAAE;IACtD,MAAM,IAAI,GAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACtC,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;AACxD,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,GAAW,EAAqB,EAAE,CAChF,YAAY,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;KACxC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;KACvD,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,aAAa,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;KAC1F,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,IAAY,EACZ,GAAW,EAC6B,EAAE,CAC1C,YAAY,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CACjD,CAAC,IAAY,EAA0C,EAAE;IACvD,MAAM,SAAS,GAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO;QACL;YACE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9C,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SAChD;KACF,CAAA;AACH,CAAC,CACF,CAAA"}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@ploaness/governance",
+  "version": "1.0.0",
+  "description": "Pure, unit-tested governance rules for ploaness. No filesystem, process, or network access.",
+  "license": "MIT",
+  "author": "Herman Ciechanowiec <herman@ciechanowiec.eu>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ciechanowiec/ploaness.git",
+    "directory": "packages/governance"
+  },
+  "homepage": "https://github.com/ciechanowiec/ploaness#readme",
+  "bugs": {
+    "url": "https://github.com/ciechanowiec/ploaness/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=26"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@types/node": "26.4.0",
+    "typescript": "6.0.3"
+  },
+  "scripts": {
+    "build": "tsc --build"
+  }
+}