@ploaness/governance 1.0.0

package/dist/doc-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doc-blocks.js","sourceRoot":"","sources":["../src/doc-blocks.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,iGAAiG;AACjG,EAAE;AACF,qGAAqG;AACrG,uGAAuG;AACvG,iGAAiG;AACjG,8FAA8F;AAC9F,qGAAqG;AACrG,WAAW;AACX,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,sFAAsF;AAEtF,oGAAoG;AACpG,qGAAqG;AACrG,yCAAyC;AACzC,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;CACP,CAAA;AAED,MAAM,QAAQ,GAAW,KAAK,CAAA;AAC9B,MAAM,WAAW,GAAW,IAAI,CAAA;AAEhC,qGAAqG;AACrG,MAAM,aAAa,GAAW,CAAC,CAAC,CAAA;AAEhC,uEAAuE;AACvE,MAAM,UAAU,GAAW,CAAC,CAAA;AAa5B,MAAM,UAAU,GAAc,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AAEjE,iGAAiG;AACjG,kGAAkG;AAClG,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAW,EAAE,CACrD,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAEtD,MAAM,aAAa,GAAG,CAAC,KAAgB,EAAE,OAAe,EAAE,IAAY,EAAa,EAAE;IACnF,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAO,CAAC;QAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;QAC7E,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;AAC1C,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,KAAgB,EAAE,OAAe,EAAE,IAAY,EAAa,EAAE,CACnF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;IACzF,CAAC,CAAC,KAAK,CAAA;AAEX,uGAAuG;AACvG,sGAAsG;AACtG,0EAA0E;AAC1E,MAAM,SAAS,GAAG,CAAC,KAAwB,EAAuB,EAAE,CAClE,KAAK,CAAC,MAAM,CAAC,CAAC,KAAgB,EAAE,GAAW,EAAE,KAAa,EAAa,EAAE;IACvE,MAAM,OAAO,GAAW,GAAG,CAAC,IAAI,EAAE,CAAA;IAClC,MAAM,IAAI,GAAW,KAAK,GAAG,UAAU,CAAA;IACvC,OAAO,KAAK,CAAC,IAAI,KAAK,aAAa;QACjC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;QACrC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;AACzC,CAAC,EAAE,UAAU,CAAC,CAAC,MAAM,CAAA;AAEvB,qGAAqG;AACrG,uGAAuG;AACvG,uEAAuE;AACvE,MAAM,iBAAiB,GAAG,CAAC,KAAwB,EAAE,OAAe,EAAW,EAAE;IAC/E,MAAM,IAAI,GAAuB,KAAK;SACnC,KAAK,CAAC,OAAO,CAAC;SACd,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC1D,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;AACtD,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAuB,EAAE;IACzE,MAAM,KAAK,GAAsB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1E,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAe,EAAW,EAAE,CAC1D,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CACxC,CAAA;AACH,CAAC,CAAA"}

package/dist/document-references.d.ts

@@ -0,0 +1,44 @@
+/** A documentation reference that no longer resolves to a real script or file. */
+export interface DocumentViolation {
+    readonly reference: string;
+    readonly kind: 'script' | 'path';
+    readonly reason: string;
+}
+/** Inputs for {@link findDocumentReferenceViolations}, with `isExistingFile` injected so the core stays pure. */
+interface DocumentReferenceInputs {
+    readonly markdown: string;
+    readonly scriptNames: ReadonlySet<string>;
+    readonly isExistingFile: (relativePath: string) => boolean;
+    /**
+     * Words that look like a script name but are not one, so a mention of them is not rot. Under ploaness
+     * the gate identifiers (`knip`, `tests`, `build`) share a vocabulary with the old npm scripts they
+     * replaced, and documenting a gate must not be read as referencing a script that no longer exists.
+     */
+    readonly reservedWords: ReadonlySet<string>;
+    /**
+     * The dependency names this document may name a subpath of. A token beginning with one is a module
+     * SPECIFIER rather than a repository path, so it is not judged as a file.
+     */
+    readonly packageNames: ReadonlySet<string>;
+}
+/**
+ * Return every documentation reference that no longer resolves: a named script absent from
+ * package.json, or a full-path file that does not exist. An empty array means the docs are in sync.
+ */
+export declare const findDocumentReferenceViolations: (inputs: DocumentReferenceInputs) => readonly DocumentViolation[];
+/** One instruction file, paired with the member that owns it. */
+export interface DocumentLocation {
+    /** Repo-relative path of the file. */
+    readonly file: string;
+    /** Repo-relative directory it belongs to, {@link ROOT_MEMBER_PATH} at the repository root. */
+    readonly directory: string;
+}
+/**
+ * Locate every agent instruction file this repository holds.
+ * @param memberPaths the governed members, repo-relative.
+ * @param isExistingFile whether a repo-relative path exists.
+ * @returns one entry per file present, the root's first, then each member's in the order given.
+ */
+export declare const findAgentDocuments: (memberPaths: readonly string[], isExistingFile: (relativePath: string) => boolean) => readonly DocumentLocation[];
+export {};
+//# sourceMappingURL=document-references.d.ts.map

package/dist/document-references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-references.d.ts","sourceRoot":"","sources":["../src/document-references.ts"],"names":[],"mappings":"AAYA,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,iHAAiH;AACjH,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAA;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAC3C;AAqDD;;;GAGG;AACH,eAAO,MAAM,+BAA+B,GAC1C,QAAQ,uBAAuB,KAC9B,SAAS,iBAAiB,EA4B5B,CAAA;AAgBD,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAKD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,aAAa,SAAS,MAAM,EAAE,EAC9B,gBAAgB,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,KAChD,SAAS,gBAAgB,EAOuD,CAAA"}

package/dist/document-references.js

@@ -0,0 +1,94 @@
+// Doc-rot policy: the pure logic that finds references in the agent docs (AGENTS.md, CLAUDE.md) which
+// no longer match reality. The `docs` gate in packages/cli/src/checks/references.ts reads the files.
+//
+// Two reference kinds are validated, both chosen to be HIGH-SIGNAL and false-positive-free:
+//   1. Script references - a backticked npm-script token (`lint:arch`, `verify:full`, `knip`, ...) or a
+//      `pnpm run <name>` invocation - must name a script that exists in package.json.
+//   2. Path references - a backticked FULL repository path to a concrete file (contains `/` and a file
+//      extension) - must exist on disk. Directory/glob references (`src/access/**`) and bare filenames
+//      are deliberately NOT checked: docs legitimately mention not-yet-existing dirs (e.g. the
+//      "no src/migrations yet" note) and use shorthand, and flagging those would make the gate lie.
+import { ROOT_MEMBER_PATH } from './workspace-policy.js';
+const BACKTICK_TOKEN = /`[^`\n]+`/g;
+const PNPM_RUN = /pnpm run [a-z][a-z0-9:_-]*/g;
+const SCRIPT_TOKEN = /^(?:verify(?::full)?|format|knip|(?:lint|test|generate):[a-z][a-z:-]*|ensure:db|with:test-db)$/;
+const PATH_EXTENSION = /\.(?:tsx?|mts|cts|mjs|cjs|js|jsonc?|ya?ml|md|css|scss|grit)$/;
+const PNPM_RUN_PREFIX = 'pnpm run ';
+const backtickTokens = (markdown) => (markdown.match(BACKTICK_TOKEN) ?? []).map((raw) => raw.slice(1, -1).trim());
+const pnpmRunScripts = (markdown) => (markdown.match(PNPM_RUN) ?? []).map((raw) => raw.slice(PNPM_RUN_PREFIX.length));
+// Strip a trailing `/**` or `/*` glob so `src/access/**` becomes `src/access`; a token with any other
+// `*` cannot be existence-checked and is dropped by the caller.
+const stripTrailingGlob = (token) => token.replace(/\/\*\*?$/, '');
+const extractScriptReferences = (markdown) => {
+    const backticked = backtickTokens(markdown).filter((token) => SCRIPT_TOKEN.test(token));
+    return new Set([...backticked, ...pnpmRunScripts(markdown)]);
+};
+// A token beginning with the name of a declared dependency is a module SPECIFIER, not a repository
+// path, and the header above says this rule judges repository paths. `ploaness/tsconfig.json` is the
+// case that forced the distinction: the wiring gate mandates that exact `extends` value, so a project
+// documenting what another gate REQUIRES was reported for naming a file it is obliged to name.
+//
+// The exemption is derived from what the project declares rather than from a list of the harness's own
+// subpaths, which keeps the useful half: drop the dependency and the same reference is rot again.
+// A scope and a name: the most of a specifier that can still be a package name.
+const PACKAGE_NAME_SEGMENTS = 2;
+const specifierPackage = (token) => {
+    const [first = '', second = ''] = token.split('/', PACKAGE_NAME_SEGMENTS);
+    return first.startsWith('@') ? `${first}/${second}` : first;
+};
+const extractPathReferences = (markdown, packageNames) => {
+    const paths = backtickTokens(markdown)
+        .filter((token) => token.includes('/') && !token.includes(' '))
+        .map((token) => stripTrailingGlob(token))
+        .filter((token) => !token.includes('*') && PATH_EXTENSION.test(token))
+        .filter((token) => !packageNames.has(specifierPackage(token)));
+    return new Set(paths);
+};
+/**
+ * Return every documentation reference that no longer resolves: a named script absent from
+ * package.json, or a full-path file that does not exist. An empty array means the docs are in sync.
+ */
+export const findDocumentReferenceViolations = (inputs) => {
+    const scriptViolations = [
+        ...extractScriptReferences(inputs.markdown),
+    ]
+        .filter((name) => !(inputs.scriptNames.has(name) || inputs.reservedWords.has(name)))
+        .map((name) => ({
+        reference: name,
+        kind: 'script',
+        reason: 'no matching script in package.json',
+    }));
+    const pathViolations = [
+        ...extractPathReferences(inputs.markdown, inputs.packageNames),
+    ]
+        .filter((path) => !inputs.isExistingFile(path))
+        .map((path) => ({
+        reference: path,
+        kind: 'path',
+        reason: 'referenced file does not exist',
+    }));
+    return [...scriptViolations, ...pathViolations];
+};
+// Which instruction files a repository has, and whose scripts each one is read against. This was a
+// constant list joined onto the repository root, which meant a workspace's member docs were never read
+// at all: a real project carried three AGENTS.md, two of them naming a config file the harness forbids
+// and a pipeline no commit ever added, past a gate reporting that every reference resolved.
+//
+// The root is a candidate whether or not it is a MEMBER, and that is the whole reason this is a
+// function rather than a mapped member list. pnpm does not require the workspace root to appear in
+// `packages:`, and the project that exposed the defect does not list it - so deriving the candidates
+// from the member list alone would have stopped reading the root's own docs, trading one blind spot
+// for the other.
+/** The instruction files an agent reads, in the order it meets them. */
+const DOCUMENT_FILES = ['AGENTS.md', 'CLAUDE.md'];
+const joinPath = (directory, file) => directory === ROOT_MEMBER_PATH ? file : `${directory}/${file}`;
+/**
+ * Locate every agent instruction file this repository holds.
+ * @param memberPaths the governed members, repo-relative.
+ * @param isExistingFile whether a repo-relative path exists.
+ * @returns one entry per file present, the root's first, then each member's in the order given.
+ */
+export const findAgentDocuments = (memberPaths, isExistingFile) => [ROOT_MEMBER_PATH, ...memberPaths.filter((path) => path !== ROOT_MEMBER_PATH)]
+    .flatMap((directory) => DOCUMENT_FILES.map((file) => ({ file: joinPath(directory, file), directory })))
+    .filter((location) => isExistingFile(location.file));
+//# sourceMappingURL=document-references.js.map

package/dist/document-references.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-references.js","sourceRoot":"","sources":["../src/document-references.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,qGAAqG;AACrG,EAAE;AACF,4FAA4F;AAC5F,wGAAwG;AACxG,sFAAsF;AACtF,uGAAuG;AACvG,uGAAuG;AACvG,+FAA+F;AAC/F,oGAAoG;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AA2BxD,MAAM,cAAc,GAAW,YAAY,CAAA;AAC3C,MAAM,QAAQ,GAAW,6BAA6B,CAAA;AACtD,MAAM,YAAY,GAChB,gGAAgG,CAAA;AAClG,MAAM,cAAc,GAAW,8DAA8D,CAAA;AAC7F,MAAM,eAAe,GAAW,WAAW,CAAA;AAE3C,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAqB,EAAE,CAC7D,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AAE9F,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAqB,EAAE,CAC7D,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;AAElG,sGAAsG;AACtG,gEAAgE;AAChE,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;AAElF,MAAM,uBAAuB,GAAG,CAAC,QAAgB,EAAuB,EAAE;IACxE,MAAM,UAAU,GAAsB,cAAc,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAC/F,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CACzB,CAAA;IACD,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC,CAAA;AAED,mGAAmG;AACnG,qGAAqG;AACrG,sGAAsG;AACtG,+FAA+F;AAC/F,EAAE;AACF,uGAAuG;AACvG,kGAAkG;AAClG,gFAAgF;AAChF,MAAM,qBAAqB,GAAW,CAAC,CAAA;AAEvC,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAU,EAAE;IACjD,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAsB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAA;IAC5F,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;AAC7D,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAC5B,QAAgB,EAChB,YAAiC,EACZ,EAAE;IACvB,MAAM,KAAK,GAAsB,cAAc,CAAC,QAAQ,CAAC;SACtD,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SAC/E,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;SACxD,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACtF,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACjF,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;AACvB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,MAA+B,EACD,EAAE;IAChC,MAAM,gBAAgB,GAAiC;QACrD,GAAG,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC;KAC5C;SACE,MAAM,CACL,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAC7F;SACA,GAAG,CACF,CAAC,IAAY,EAAqB,EAAE,CAAC,CAAC;QACpC,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,oCAAoC;KAC7C,CAAC,CACH,CAAA;IAEH,MAAM,cAAc,GAAiC;QACnD,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC;KAC/D;SACE,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;SAC/D,GAAG,CACF,CAAC,IAAY,EAAqB,EAAE,CAAC,CAAC;QACpC,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,gCAAgC;KACzC,CAAC,CACH,CAAA;IAEH,OAAO,CAAC,GAAG,gBAAgB,EAAE,GAAG,cAAc,CAAC,CAAA;AACjD,CAAC,CAAA;AAED,mGAAmG;AACnG,uGAAuG;AACvG,uGAAuG;AACvG,4FAA4F;AAC5F,EAAE;AACF,gGAAgG;AAChG,mGAAmG;AACnG,qGAAqG;AACrG,oGAAoG;AACpG,iBAAiB;AAEjB,wEAAwE;AACxE,MAAM,cAAc,GAAsB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;AAUpE,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAE,IAAY,EAAU,EAAE,CAC3D,SAAS,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAA;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,WAA8B,EAC9B,cAAiD,EACpB,EAAE,CAC/B,CAAC,gBAAgB,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;KAC5F,OAAO,CAAC,CAAC,SAAiB,EAA+B,EAAE,CAC1D,cAAc,CAAC,GAAG,CAChB,CAAC,IAAY,EAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CACrF,CACF;KACA,MAAM,CAAC,CAAC,QAA0B,EAAW,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA"}

package/dist/editorconfig-policy.d.ts

@@ -0,0 +1,24 @@
+/** The standard's line cap. Not configurable: a cap is never raised. */
+export declare const MAX_LINE_LENGTH: number;
+/** The properties this rule reads out of an `.editorconfig`. */
+export interface EditorconfigRules {
+    readonly endOfLine: string | undefined;
+    readonly insertFinalNewline: boolean;
+    readonly trimTrailingWhitespace: boolean;
+    readonly indentStyle: string | undefined;
+}
+/** One place a file departs from the committed configuration. */
+export interface EditorconfigViolation {
+    readonly line: number;
+    readonly reason: string;
+}
+export declare const parseEditorconfig: (text: string) => EditorconfigRules;
+/**
+ * Check one file against the committed configuration.
+ * @param content the file's decoded content.
+ * @param rules the properties read from the `.editorconfig`.
+ * @param isLineLengthEnforced whether the standard's line cap applies to this file's role.
+ * @returns one violation per departure, in line order.
+ */
+export declare const findEditorconfigViolations: (content: string, rules: EditorconfigRules, isLineLengthEnforced: boolean) => readonly EditorconfigViolation[];
+//# sourceMappingURL=editorconfig-policy.d.ts.map

package/dist/editorconfig-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"editorconfig-policy.d.ts","sourceRoot":"","sources":["../src/editorconfig-policy.ts"],"names":[],"mappings":"AAaA,wEAAwE;AACxE,eAAO,MAAM,eAAe,EAAE,MAAY,CAAA;AAE1C,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAA;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;CACzC;AAED,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AA8BD,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,KAAG,iBAqBhD,CAAA;AA2CD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GACrC,SAAS,MAAM,EACf,OAAO,iBAAiB,EACxB,sBAAsB,OAAO,KAC5B,SAAS,qBAAqB,EAgBhC,CAAA"}

package/dist/editorconfig-policy.js

@@ -0,0 +1,106 @@
+// Conformance to the committed `.editorconfig`, plus the standard's line cap.
+//
+// The `.editorconfig` is a pinned managed file, so every project holds the same one - and until now
+// nothing checked a single file against it. The formatter covers only the globs it owns, which leaves
+// Markdown, YAML, shell scripts, and Dockerfiles free to carry a CRLF, a tab, a trailing space, or a
+// missing final newline.
+//
+// The expectations are read from the `.editorconfig` itself rather than restated here, so editing the
+// pinned file moves the gate with it and the gate cannot contradict the file it checks against. The one
+// value that does NOT come from there is the line cap: `max_line_length` is an editor hint that tells a
+// ruler where to sit, while the standard's 120 characters is a cap that binds as an error. A project's
+// formatter may aim shorter, and frequently does.
+/** The standard's line cap. Not configurable: a cap is never raised. */
+export const MAX_LINE_LENGTH = 120;
+const FIRST_LINE = 1;
+// Named by code point rather than written out, for the reason `banned-typography.ts` gives about the
+// characters IT bans: a source file that spells an invisible character invites a tool to normalise it
+// away - and here that tool would silently disarm the very rule this constant implements.
+const BYTE_ORDER_MARK = 0xfe_ff;
+const BOM = String.fromCodePoint(BYTE_ORDER_MARK);
+/**
+ * Read the `[*]` section of an `.editorconfig`.
+ * @param text the file's content.
+ * @returns the properties the conformance rule binds.
+ */
+// The `[*]` section is the span between that header and the next one, so it can be sliced out before
+// any property is read rather than tracked with a flag while reading.
+const wildcardSection = (text) => {
+    const lines = text.split('\n').map((raw) => raw.trim());
+    const start = lines.indexOf('[*]');
+    if (start === -1) {
+        return [];
+    }
+    const rest = lines.slice(start + 1);
+    const end = rest.findIndex((line) => line.startsWith('['));
+    return end === -1 ? rest : rest.slice(0, end);
+};
+const isProperty = (line) => line.length > 0 && !line.startsWith('#') && !line.startsWith(';') && line.includes('=');
+export const parseEditorconfig = (text) => {
+    const properties = Object.fromEntries(wildcardSection(text)
+        .filter((line) => isProperty(line))
+        .map((line) => {
+        const separator = line.indexOf('=');
+        return [
+            line.slice(0, separator).trim().toLowerCase(),
+            line
+                .slice(separator + 1)
+                .trim()
+                .toLowerCase(),
+        ];
+    }));
+    return {
+        endOfLine: properties['end_of_line'],
+        insertFinalNewline: properties['insert_final_newline'] === 'true',
+        trimTrailingWhitespace: properties['trim_trailing_whitespace'] === 'true',
+        indentStyle: properties['indent_style'],
+    };
+};
+const lineRules = (rules, isLineLengthEnforced) => [
+    (_body, raw) => rules.endOfLine === 'lf' && raw.endsWith('\r')
+        ? 'carriage return; end_of_line is lf'
+        : undefined,
+    (body) => rules.trimTrailingWhitespace && /[ \t]$/.test(body) ? 'trailing whitespace' : undefined,
+    (body) => rules.indentStyle === 'space' && body.startsWith('\t')
+        ? 'tab indentation; indent_style is space'
+        : undefined,
+    (body) => isLineLengthEnforced && body.length > MAX_LINE_LENGTH
+        ? `line is ${String(body.length)} characters; the cap is ${String(MAX_LINE_LENGTH)}`
+        : undefined,
+];
+const lineViolations = (content, rules, isLineLengthEnforced) => {
+    const checks = lineRules(rules, isLineLengthEnforced);
+    return content
+        .split('\n')
+        .flatMap((raw, index) => {
+        const body = raw.replace(/\r$/, '');
+        return checks.flatMap((check) => {
+            const reason = check(body, raw);
+            return reason === undefined ? [] : [{ line: index + 1, reason }];
+        });
+    });
+};
+/**
+ * Check one file against the committed configuration.
+ * @param content the file's decoded content.
+ * @param rules the properties read from the `.editorconfig`.
+ * @param isLineLengthEnforced whether the standard's line cap applies to this file's role.
+ * @returns one violation per departure, in line order.
+ */
+export const findEditorconfigViolations = (content, rules, isLineLengthEnforced) => {
+    if (content.length === 0) {
+        return [];
+    }
+    const byteOrderMark = content.startsWith(BOM)
+        ? [{ line: FIRST_LINE, reason: 'byte order mark; charset is utf-8' }]
+        : [];
+    const finalNewline = rules.insertFinalNewline && !content.endsWith('\n')
+        ? [{ line: content.split('\n').length, reason: 'no final newline' }]
+        : [];
+    return [
+        ...byteOrderMark,
+        ...lineViolations(content, rules, isLineLengthEnforced),
+        ...finalNewline,
+    ];
+};
+//# sourceMappingURL=editorconfig-policy.js.map

package/dist/editorconfig-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"editorconfig-policy.js","sourceRoot":"","sources":["../src/editorconfig-policy.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,oGAAoG;AACpG,sGAAsG;AACtG,qGAAqG;AACrG,yBAAyB;AACzB,EAAE;AACF,sGAAsG;AACtG,wGAAwG;AACxG,wGAAwG;AACxG,uGAAuG;AACvG,kDAAkD;AAElD,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAW,GAAG,CAAA;AAgB1C,MAAM,UAAU,GAAW,CAAC,CAAA;AAC5B,qGAAqG;AACrG,sGAAsG;AACtG,0FAA0F;AAC1F,MAAM,eAAe,GAAW,OAAO,CAAA;AACvC,MAAM,GAAG,GAAW,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,CAAA;AAEzD;;;;GAIG;AACH,qGAAqG;AACrG,sEAAsE;AACtE,MAAM,eAAe,GAAG,CAAC,IAAY,EAAqB,EAAE;IAC1D,MAAM,KAAK,GAAsB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1F,MAAM,KAAK,GAAW,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC1C,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAsB,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IACtD,MAAM,GAAG,GAAW,IAAI,CAAC,SAAS,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACnF,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAC/C,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE,CAC3C,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAEzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAqB,EAAE;IACnE,MAAM,UAAU,GAA2B,MAAM,CAAC,WAAW,CAC3D,eAAe,CAAC,IAAI,CAAC;SAClB,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;SACnD,GAAG,CAAC,CAAC,IAAY,EAA6B,EAAE;QAC/C,MAAM,SAAS,GAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3C,OAAO;YACL,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;YAC7C,IAAI;iBACD,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;iBACpB,IAAI,EAAE;iBACN,WAAW,EAAE;SACjB,CAAA;IACH,CAAC,CAAC,CACL,CAAA;IACD,OAAO;QACL,SAAS,EAAE,UAAU,CAAC,aAAa,CAAC;QACpC,kBAAkB,EAAE,UAAU,CAAC,sBAAsB,CAAC,KAAK,MAAM;QACjE,sBAAsB,EAAE,UAAU,CAAC,0BAA0B,CAAC,KAAK,MAAM;QACzE,WAAW,EAAE,UAAU,CAAC,cAAc,CAAC;KACxC,CAAA;AACH,CAAC,CAAA;AAMD,MAAM,SAAS,GAAG,CAChB,KAAwB,EACxB,oBAA6B,EACR,EAAE,CAAC;IACxB,CAAC,KAAa,EAAE,GAAW,EAAsB,EAAE,CACjD,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC5C,CAAC,CAAC,oCAAoC;QACtC,CAAC,CAAC,SAAS;IACf,CAAC,IAAY,EAAsB,EAAE,CACnC,KAAK,CAAC,sBAAsB,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS;IACzF,CAAC,IAAY,EAAsB,EAAE,CACnC,KAAK,CAAC,WAAW,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACpD,CAAC,CAAC,wCAAwC;QAC1C,CAAC,CAAC,SAAS;IACf,CAAC,IAAY,EAAsB,EAAE,CACnC,oBAAoB,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe;QACnD,CAAC,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,2BAA2B,MAAM,CAAC,eAAe,CAAC,EAAE;QACpF,CAAC,CAAC,SAAS;CAChB,CAAA;AAED,MAAM,cAAc,GAAG,CACrB,OAAe,EACf,KAAwB,EACxB,oBAA6B,EACK,EAAE;IACpC,MAAM,MAAM,GAAwB,SAAS,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAA;IAC1E,OAAO,OAAO;SACX,KAAK,CAAC,IAAI,CAAC;SACX,OAAO,CAAC,CAAC,GAAW,EAAE,KAAa,EAAoC,EAAE;QACxE,MAAM,IAAI,GAAW,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAC3C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAe,EAAoC,EAAE;YAC1E,MAAM,MAAM,GAAuB,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;YACnD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QAClE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACN,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,OAAe,EACf,KAAwB,EACxB,oBAA6B,EACK,EAAE;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,aAAa,GAAqC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAC7E,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,YAAY,GAChB,KAAK,CAAC,kBAAkB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACjD,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACpE,CAAC,CAAC,EAAE,CAAA;IACR,OAAO;QACL,GAAG,aAAa;QAChB,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC;QACvD,GAAG,YAAY;KAChB,CAAA;AACH,CAAC,CAAA"}

package/dist/environment-files.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The environment files a run reads, highest precedence first. `.env.local` leads because it is the
+ * personal, untracked override of `.env`; the managed `.gitignore` ignores both, which is what makes
+ * these the two a project can be assumed to keep out of the tree.
+ */
+export declare const RUN_ENVIRONMENT_FILES: readonly string[];
+/**
+ * The environment files a run should read, in the order it must read them.
+ * @param isExistingFile whether a repository-relative path names a file that exists.
+ * @returns the present subset of {@link RUN_ENVIRONMENT_FILES}, highest precedence first.
+ */
+export declare const runEnvironmentFiles: (isExistingFile: (relativePath: string) => boolean) => readonly string[];
+/**
+ * The port an origin names, as a string a child process's environment can carry.
+ *
+ * A project declares the origin its application serves, and ploaness starts that application itself.
+ * Reading the origin without reading the port meant the two disagreed: the server was started on the
+ * framework's default while the runner waited on the declared one, so the only setting that exists to
+ * describe a non-default port made the run hang rather than work.
+ * @param serverUrl the declared origin.
+ * @returns the port, or undefined when the origin names none and the default applies.
+ */
+export declare const portOf: (serverUrl: string) => string | undefined;
+/**
+ * The variables a run must be GIVEN, as distinct from the ones it inherits.
+ *
+ * `process.loadEnvFile` is the answer where the process reading the files is the process that boots the
+ * project. A gate is not: it starts a CHILD, and mutating the gate's own environment to configure that
+ * child would take the project's settings into the harness for every gate after it. So the same
+ * precedence has to be rebuilt as an override map - and it is the REVERSE of what spawning does by
+ * default, where an override beats the inherited value. Here a file must LOSE to a variable the run
+ * already carries, for the reason stated above: that variable was there before any file was read.
+ *
+ * Returning only the names the run lacks is what makes that safe to hand to a plain merge. The
+ * alternative, merging the files under `process.env`, silently reinstates any name the parent happens
+ * to carry as empty rather than absent.
+ * @param current the environment the run already has, typically `process.env`.
+ * @param parsedFiles the parsed files, in the order {@link runEnvironmentFiles} returned them.
+ * @returns the names the run does not carry, each with the value of the FIRST file to declare it.
+ */
+export declare const runEnvironmentOverrides: (current: Readonly<Record<string, string | undefined>>, parsedFiles: readonly Readonly<Record<string, string | undefined>>[]) => Readonly<Record<string, string>>;
+//# sourceMappingURL=environment-files.d.ts.map

package/dist/environment-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-files.d.ts","sourceRoot":"","sources":["../src/environment-files.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAA2B,CAAA;AAE9E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC9B,gBAAgB,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,KAChD,SAAS,MAAM,EAC6D,CAAA;AAE/E;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM,GAAI,WAAW,MAAM,KAAG,MAAM,GAAG,SASnD,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,uBAAuB,GAClC,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACrD,aAAa,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,KACnE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAe/B,CAAA"}

package/dist/environment-files.js

@@ -0,0 +1,76 @@
+// The environment files a run of the project reads into its own process.
+//
+// A Payload config validates `process.env` at module scope, so anything that boots the project boots
+// its configuration first. Next reads these files itself, which is why the application under test never
+// had a problem - but a test runner does not, and the runner ploaness ships a Playwright config for
+// boots the project in its OWN process: an end-to-end helper that seeds a user through `getPayload`
+// evaluates `payload.config.ts` at spec-collection time, before a browser or a server is involved.
+//
+// The project used to load them from its own `playwright.config.ts`. The wiring gate now requires that
+// file to be a bare re-export, which removes the only seam it had, so the harness that took the seam
+// away owes the load. Vitest is the other half of the same shape and keeps its own answer: a project
+// writes `vitest.setup.ts` and ploaness loads it, which is a seam the project still owns.
+//
+// The order is the part that carries meaning, and it is stated here rather than at the call site so
+// that it is measured: `packages/config` is an analyzer configuration that no coverage floor reads,
+// while everything in this package is unit-tested. Nothing loaded later may replace a value already
+// set, so the file that must win is read first, and a variable the real environment already carries -
+// a CI secret, a `DATABASE_URL` exported by a service container - outranks every file, because it was
+// there before any of them was read.
+/**
+ * The environment files a run reads, highest precedence first. `.env.local` leads because it is the
+ * personal, untracked override of `.env`; the managed `.gitignore` ignores both, which is what makes
+ * these the two a project can be assumed to keep out of the tree.
+ */
+export const RUN_ENVIRONMENT_FILES = ['.env.local', '.env'];
+/**
+ * The environment files a run should read, in the order it must read them.
+ * @param isExistingFile whether a repository-relative path names a file that exists.
+ * @returns the present subset of {@link RUN_ENVIRONMENT_FILES}, highest precedence first.
+ */
+export const runEnvironmentFiles = (isExistingFile) => RUN_ENVIRONMENT_FILES.filter((file) => isExistingFile(file));
+/**
+ * The port an origin names, as a string a child process's environment can carry.
+ *
+ * A project declares the origin its application serves, and ploaness starts that application itself.
+ * Reading the origin without reading the port meant the two disagreed: the server was started on the
+ * framework's default while the runner waited on the declared one, so the only setting that exists to
+ * describe a non-default port made the run hang rather than work.
+ * @param serverUrl the declared origin.
+ * @returns the port, or undefined when the origin names none and the default applies.
+ */
+export const portOf = (serverUrl) => {
+    try {
+        const port = new URL(serverUrl).port;
+        return port.length > 0 ? port : undefined;
+    }
+    catch {
+        // A malformed origin is the project's to fix, and the gate that drives it will say so far more
+        // clearly than a crash inside a configuration file that no stack trace points at.
+        return undefined;
+    }
+};
+/**
+ * The variables a run must be GIVEN, as distinct from the ones it inherits.
+ *
+ * `process.loadEnvFile` is the answer where the process reading the files is the process that boots the
+ * project. A gate is not: it starts a CHILD, and mutating the gate's own environment to configure that
+ * child would take the project's settings into the harness for every gate after it. So the same
+ * precedence has to be rebuilt as an override map - and it is the REVERSE of what spawning does by
+ * default, where an override beats the inherited value. Here a file must LOSE to a variable the run
+ * already carries, for the reason stated above: that variable was there before any file was read.
+ *
+ * Returning only the names the run lacks is what makes that safe to hand to a plain merge. The
+ * alternative, merging the files under `process.env`, silently reinstates any name the parent happens
+ * to carry as empty rather than absent.
+ * @param current the environment the run already has, typically `process.env`.
+ * @param parsedFiles the parsed files, in the order {@link runEnvironmentFiles} returned them.
+ * @returns the names the run does not carry, each with the value of the FIRST file to declare it.
+ */
+export const runEnvironmentOverrides = (current, parsedFiles) => Object.fromEntries(parsedFiles
+    .flatMap((file) => Object.entries(file))
+    .filter((entry) => entry[1] !== undefined && current[entry[0]] === undefined)
+    // Among the files the earliest wins, and `Object.fromEntries` gives the LAST entry for a repeated
+    // name, so the list is reversed rather than de-duplicated by hand.
+    .toReversed());
+//# sourceMappingURL=environment-files.js.map

package/dist/environment-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-files.js","sourceRoot":"","sources":["../src/environment-files.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,qGAAqG;AACrG,wGAAwG;AACxG,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,EAAE;AACF,uGAAuG;AACvG,qGAAqG;AACrG,qGAAqG;AACrG,0FAA0F;AAC1F,EAAE;AACF,oGAAoG;AACpG,oGAAoG;AACpG,oGAAoG;AACpG,sGAAsG;AACtG,sGAAsG;AACtG,qCAAqC;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,cAAiD,EAC9B,EAAE,CACrB,qBAAqB,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;AAE/E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAsB,EAAE;IAC9D,IAAI,CAAC;QACH,MAAM,IAAI,GAAW,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAA;QAC5C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,+FAA+F;QAC/F,kFAAkF;QAClF,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAAqD,EACrD,WAAoE,EAClC,EAAE,CACpC,MAAM,CAAC,WAAW,CAChB,WAAW;KACR,OAAO,CACN,CACE,IAAkD,EACT,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CACnE;KACA,MAAM,CACL,CAAC,KAA4C,EAA6B,EAAE,CAC1E,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAC5D;IACD,kGAAkG;IAClG,mEAAmE;KAClE,UAAU,EAAE,CAChB,CAAA"}

package/dist/file-roles.d.ts

@@ -0,0 +1,39 @@
+/** Extensions the Code Rules apply to, used where a rule is about code rather than about any text. */
+export declare const CODE_EXTENSIONS: readonly string[];
+/** Extensions whose role is prose, where a code-shaped rule such as a line cap does not apply. */
+export declare const PROSE_EXTENSIONS: readonly string[];
+/**
+ * Decide whether a file is binary, from the file itself rather than from its name.
+ * @param bytes the file's leading content.
+ * @returns true when a NUL byte appears in the probed span, which no text encoding produces.
+ */
+export declare const isBinary: (bytes: Uint8Array) => boolean;
+/**
+ * Decide whether a path carries one of the given extensions.
+ * @param filePath the repo-relative path.
+ * @param extensions the extensions to test.
+ * @returns true when the path ends with one of them.
+ */
+export declare const hasExtension: (filePath: string, extensions: readonly string[]) => boolean;
+/**
+ * Decide whether a path is excluded by a declared role pattern.
+ * @param filePath the repo-relative path.
+ * @param patterns the declared exclusion patterns.
+ * @returns true when any pattern matches.
+ */
+export declare const matchesRole: (filePath: string, patterns: readonly string[]) => boolean;
+/**
+ * Whether a repo-relative path matches a glob pattern of the kind the coverage settings carry.
+ * @param pattern the glob, such as `src/app/**` or `src/**\/*.tsx`.
+ * @param filePath the repo-relative path to test.
+ * @returns whether the whole path matches the whole pattern.
+ */
+export declare const matchesGlob: (pattern: string, filePath: string) => boolean;
+/**
+ * Decide whether a path holds code the Code Rules govern.
+ * @param filePath the repo-relative path.
+ * @param excluded the declared generated-role patterns.
+ * @returns true when the file is code and no declared role excludes it.
+ */
+export declare const isGovernedCode: (filePath: string, excluded: readonly string[]) => boolean;
+//# sourceMappingURL=file-roles.d.ts.map

package/dist/file-roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-roles.d.ts","sourceRoot":"","sources":["../src/file-roles.ts"],"names":[],"mappings":"AAYA,sGAAsG;AACtG,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAU5C,CAAA;AAED,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAA6B,CAAA;AAE3E;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GAAI,OAAO,UAAU,KAAG,OACM,CAAA;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,UAAU,MAAM,EAAE,YAAY,SAAS,MAAM,EAAE,KAAG,OACA,CAAA;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,MAAM,EAAE,UAAU,SAAS,MAAM,EAAE,KAAG,OACK,CAAA;AA2BjF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAG9C,CAAA;AAElB;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,UAAU,MAAM,EAAE,UAAU,SAAS,MAAM,EAAE,KAAG,OACF,CAAA"}

package/dist/file-roles.js

@@ -0,0 +1,82 @@
+// File roles: the categories a repository can determine from a file itself and uses to include or
+// exclude it from a check.
+//
+// The typography ban used to carry its own allowlist of ten extensions, which is the wrong shape for a
+// rule that reaches "every tracked file the repository does not exclude by role": a `.css`, a `.adoc`,
+// a shell script, or a Dockerfile went unscanned, and every new text format arrived unscanned until
+// someone remembered to extend the list. A role predicate is default-safe in the opposite direction -
+// a new format is covered by construction, and exclusion is the thing that must be stated.
+/** How much of a file is inspected before deciding it is text. Enough to reach any real header. */
+const BINARY_PROBE_BYTES = 8192;
+/** Extensions the Code Rules apply to, used where a rule is about code rather than about any text. */
+export const CODE_EXTENSIONS = [
+    '.ts',
+    '.tsx',
+    '.mts',
+    '.cts',
+    '.js',
+    '.mjs',
+    '.cjs',
+    '.css',
+    '.scss',
+];
+/** Extensions whose role is prose, where a code-shaped rule such as a line cap does not apply. */
+export const PROSE_EXTENSIONS = ['.md', '.adoc', '.txt'];
+/**
+ * Decide whether a file is binary, from the file itself rather than from its name.
+ * @param bytes the file's leading content.
+ * @returns true when a NUL byte appears in the probed span, which no text encoding produces.
+ */
+export const isBinary = (bytes) => bytes.subarray(0, BINARY_PROBE_BYTES).includes(0);
+/**
+ * Decide whether a path carries one of the given extensions.
+ * @param filePath the repo-relative path.
+ * @param extensions the extensions to test.
+ * @returns true when the path ends with one of them.
+ */
+export const hasExtension = (filePath, extensions) => extensions.some((extension) => filePath.endsWith(extension));
+/**
+ * Decide whether a path is excluded by a declared role pattern.
+ * @param filePath the repo-relative path.
+ * @param patterns the declared exclusion patterns.
+ * @returns true when any pattern matches.
+ */
+export const matchesRole = (filePath, patterns) => patterns.some((pattern) => new RegExp(pattern).test(filePath));
+// The glob dialect the coverage settings are written in, which is not the regex dialect `matchesRole`
+// reads. `**/` crosses directory boundaries and `*` does not, which is the whole distinction between
+// `src/**/*.tsx` and `src/*.tsx`; collapsing the two would silently widen every pattern that uses one.
+const GLOB_TOKEN = /\*\*\/|\*\*|[*?.+^${}()|[\]\\]/g;
+const asRegexToken = (token) => {
+    switch (token) {
+        case '**/': {
+            return '(?:[^/]*/)*';
+        }
+        case '**': {
+            return '.*';
+        }
+        case '*': {
+            return '[^/]*';
+        }
+        case '?': {
+            return '[^/]';
+        }
+        default: {
+            return `\\${token}`;
+        }
+    }
+};
+/**
+ * Whether a repo-relative path matches a glob pattern of the kind the coverage settings carry.
+ * @param pattern the glob, such as `src/app/**` or `src/**\/*.tsx`.
+ * @param filePath the repo-relative path to test.
+ * @returns whether the whole path matches the whole pattern.
+ */
+export const matchesGlob = (pattern, filePath) => new RegExp(`^${pattern.replaceAll(GLOB_TOKEN, (token) => asRegexToken(token))}$`).test(filePath);
+/**
+ * Decide whether a path holds code the Code Rules govern.
+ * @param filePath the repo-relative path.
+ * @param excluded the declared generated-role patterns.
+ * @returns true when the file is code and no declared role excludes it.
+ */
+export const isGovernedCode = (filePath, excluded) => hasExtension(filePath, CODE_EXTENSIONS) && !matchesRole(filePath, excluded);
+//# sourceMappingURL=file-roles.js.map

package/dist/file-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-roles.js","sourceRoot":"","sources":["../src/file-roles.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,2BAA2B;AAC3B,EAAE;AACF,uGAAuG;AACvG,uGAAuG;AACvG,oGAAoG;AACpG,sGAAsG;AACtG,2FAA2F;AAE3F,mGAAmG;AACnG,MAAM,kBAAkB,GAAW,IAAI,CAAA;AAEvC,sGAAsG;AACtG,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;CACR,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAiB,EAAW,EAAE,CACrD,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAE,UAA6B,EAAW,EAAE,CACvF,UAAU,CAAC,IAAI,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAE,QAA2B,EAAW,EAAE,CACpF,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;AAEjF,sGAAsG;AACtG,qGAAqG;AACrG,uGAAuG;AACvG,MAAM,UAAU,GAAW,iCAAiC,CAAA;AAE5D,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE;IAC7C,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,OAAO,aAAa,CAAA;QACtB,CAAC;QACD,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,OAAO,IAAI,CAAA;QACb,CAAC;QACD,KAAK,GAAG,CAAC,CAAC,CAAC;YACT,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,KAAK,GAAG,CAAC,CAAC,CAAC;YACT,OAAO,MAAM,CAAA;QACf,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,KAAK,KAAK,EAAE,CAAA;QACrB,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAW,EAAE,CACxE,IAAI,MAAM,CACR,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,KAAa,EAAU,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CACtF,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAElB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,QAA2B,EAAW,EAAE,CACvF,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA"}

package/dist/generated-denial.d.ts

@@ -0,0 +1,42 @@
+/** The artefacts Payload derives from the configuration. Declared once and consumed by every rule. */
+export declare const GENERATED_ARTEFACTS: readonly string[];
+/**
+ * The deny rules a runtime must carry for a set of generated artefacts.
+ *
+ * The artefacts are a parameter rather than the constant above so the rule stays a statement about a
+ * SET of generated paths rather than about Payload's three. What ploaness governs is one such set; the
+ * ploaness repository denies its own regenerated asset bodies through the same shaped list, written by
+ * hand in `.claude/settings.json` because nothing here runs `ploaness sync`. Closing over the constant
+ * would have made the rule untestable against any set but that one.
+ * @param artefacts the repo-relative paths a generator owns.
+ * @returns the Edit and Write denials the runtime settings must carry.
+ */
+export declare const requiredDenyRules: (artefacts: readonly string[]) => readonly string[];
+/**
+ * Merge the required deny rules into an existing runtime settings object.
+ * @param existing the parsed settings, or undefined when the file does not exist.
+ * @param artefacts the repo-relative paths a generator owns.
+ * @returns the settings to write, preserving every key the project owns.
+ */
+export declare const applyDenyRules: (existing: unknown, artefacts: readonly string[]) => Record<string, unknown>;
+/**
+ * Report every required denial the runtime settings do not carry, and every re-permission of one.
+ * @param settings the parsed runtime settings, or undefined when absent.
+ * @param localSettings the parsed machine-local overrides, or undefined when absent.
+ * @param artefacts the repo-relative paths a generator owns.
+ * @returns one message per missing denial or re-permitted artefact.
+ */
+export declare const findDenialViolations: (settings: unknown, localSettings: unknown, artefacts: readonly string[]) => readonly string[];
+/**
+ * The generated paths a repository denies, across every member that has any.
+ *
+ * The runtime reads one settings file, at the repository root, while the artefacts are named relative
+ * to the member that generates them. A rule written for one member would therefore bind nothing in a
+ * workspace. For a single member at the root the union is the artefact list unchanged, which is what
+ * keeps a single-package project's settings file byte-identical.
+ * @param memberPaths the repo-relative paths of the members that own generated artefacts.
+ * @param artefacts the member-relative paths a generator owns.
+ * @returns every repo-relative path the runtime must deny, in member order.
+ */
+export declare const deniedPathsFor: (memberPaths: readonly string[], artefacts: readonly string[]) => readonly string[];
+//# sourceMappingURL=generated-denial.d.ts.map

package/dist/generated-denial.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-denial.d.ts","sourceRoot":"","sources":["../src/generated-denial.ts"],"names":[],"mappings":"AAWA,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAIhD,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAAI,WAAW,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAI5E,CAAA;AASJ;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GACzB,UAAU,OAAO,EACjB,WAAW,SAAS,MAAM,EAAE,KAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CASxB,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,UAAU,OAAO,EACjB,eAAe,OAAO,EACtB,WAAW,SAAS,MAAM,EAAE,KAC3B,SAAS,MAAM,EAgBjB,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,GACzB,aAAa,SAAS,MAAM,EAAE,EAC9B,WAAW,SAAS,MAAM,EAAE,KAC3B,SAAS,MAAM,EAKf,CAAA"}