@ploaness/governance 1.0.0

package/dist/generated-denial.js

@@ -0,0 +1,87 @@
+// Write denial for generated files.
+//
+// A generated file changes only as the output of its generator, and the regeneration check already
+// fails on a hand edit. That check reports the damage after the fact; the denial stops the edit from
+// being made, which is the difference between a build that fails and work that was never wasted.
+//
+// The standard scopes this to "where the runtime used by AI agents supports the denial", so a rule here
+// binds one runtime and cannot bind them all. That is conformance rather than a shortfall, and the gate
+// says so rather than implying a guarantee it does not have.
+import { asRecord, isArray, readKey } from './json-shapes.js';
+/** The artefacts Payload derives from the configuration. Declared once and consumed by every rule. */
+export const GENERATED_ARTEFACTS = [
+    'src/payload-types.ts',
+    'src/app/(payload)/admin/importMap.js',
+    'src/payload-generated-schema.ts',
+];
+/**
+ * The deny rules a runtime must carry for a set of generated artefacts.
+ *
+ * The artefacts are a parameter rather than the constant above so the rule stays a statement about a
+ * SET of generated paths rather than about Payload's three. What ploaness governs is one such set; the
+ * ploaness repository denies its own regenerated asset bodies through the same shaped list, written by
+ * hand in `.claude/settings.json` because nothing here runs `ploaness sync`. Closing over the constant
+ * would have made the rule untestable against any set but that one.
+ * @param artefacts the repo-relative paths a generator owns.
+ * @returns the Edit and Write denials the runtime settings must carry.
+ */
+export const requiredDenyRules = (artefacts) => artefacts.flatMap((artefact) => [
+    `Edit(${artefact})`,
+    `Write(${artefact})`,
+]);
+const stringsAt = (settings, section, key) => {
+    const inner = readKey(readKey(settings, section), key);
+    return isArray(inner)
+        ? inner.filter((entry) => typeof entry === 'string')
+        : [];
+};
+/**
+ * Merge the required deny rules into an existing runtime settings object.
+ * @param existing the parsed settings, or undefined when the file does not exist.
+ * @param artefacts the repo-relative paths a generator owns.
+ * @returns the settings to write, preserving every key the project owns.
+ */
+export const applyDenyRules = (existing, artefacts) => {
+    const base = { ...asRecord(existing) };
+    const permissions = { ...asRecord(base['permissions']) };
+    const deny = stringsAt(base, 'permissions', 'deny');
+    const merged = [
+        ...deny,
+        ...requiredDenyRules(artefacts).filter((rule) => !deny.includes(rule)),
+    ];
+    return { ...base, permissions: { ...permissions, deny: merged } };
+};
+/**
+ * Report every required denial the runtime settings do not carry, and every re-permission of one.
+ * @param settings the parsed runtime settings, or undefined when absent.
+ * @param localSettings the parsed machine-local overrides, or undefined when absent.
+ * @param artefacts the repo-relative paths a generator owns.
+ * @returns one message per missing denial or re-permitted artefact.
+ */
+export const findDenialViolations = (settings, localSettings, artefacts) => {
+    const required = requiredDenyRules(artefacts);
+    const deny = stringsAt(settings, 'permissions', 'deny');
+    const missing = required
+        .filter((rule) => !deny.includes(rule))
+        .map((rule) => `no write denial for ${rule}; run \`ploaness sync\` to add it`);
+    // A local override that re-permits a denied artefact undoes the denial on the one machine where it
+    // matters most, and it is untracked, so nothing else would ever report it.
+    const allowed = stringsAt(localSettings, 'permissions', 'allow');
+    const rePermitted = allowed
+        .filter((rule) => required.includes(rule))
+        .map((rule) => `local settings re-permit ${rule}, which the project denies; remove the local allow entry`);
+    return [...missing, ...rePermitted];
+};
+/**
+ * The generated paths a repository denies, across every member that has any.
+ *
+ * The runtime reads one settings file, at the repository root, while the artefacts are named relative
+ * to the member that generates them. A rule written for one member would therefore bind nothing in a
+ * workspace. For a single member at the root the union is the artefact list unchanged, which is what
+ * keeps a single-package project's settings file byte-identical.
+ * @param memberPaths the repo-relative paths of the members that own generated artefacts.
+ * @param artefacts the member-relative paths a generator owns.
+ * @returns every repo-relative path the runtime must deny, in member order.
+ */
+export const deniedPathsFor = (memberPaths, artefacts) => memberPaths.flatMap((memberPath) => artefacts.map((artefact) => memberPath === '.' ? artefact : `${memberPath}/${artefact}`));
+//# sourceMappingURL=generated-denial.js.map

package/dist/generated-denial.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-denial.js","sourceRoot":"","sources":["../src/generated-denial.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,EAAE;AACF,mGAAmG;AACnG,qGAAqG;AACrG,iGAAiG;AACjG,EAAE;AACF,wGAAwG;AACxG,wGAAwG;AACxG,6DAA6D;AAC7D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE7D,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,sBAAsB;IACtB,sCAAsC;IACtC,iCAAiC;CAClC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAA4B,EAAqB,EAAE,CACnF,SAAS,CAAC,OAAO,CAAC,CAAC,QAAgB,EAAqB,EAAE,CAAC;IACzD,QAAQ,QAAQ,GAAG;IACnB,SAAS,QAAQ,GAAG;CACrB,CAAC,CAAA;AAEJ,MAAM,SAAS,GAAG,CAAC,QAAiB,EAAE,OAAe,EAAE,GAAW,EAAqB,EAAE;IACvF,MAAM,KAAK,GAAY,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/D,OAAO,OAAO,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC9E,CAAC,CAAC,EAAE,CAAA;AACR,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,QAAiB,EACjB,SAA4B,EACH,EAAE;IAC3B,MAAM,IAAI,GAA4B,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC/D,MAAM,WAAW,GAA4B,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAA;IACjF,MAAM,IAAI,GAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAA;IACtE,MAAM,MAAM,GAAsB;QAChC,GAAG,IAAI;QACP,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;KACxF,CAAA;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;AACnE,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,QAAiB,EACjB,aAAsB,EACtB,SAA4B,EACT,EAAE;IACrB,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,SAAS,CAAC,CAAA;IAChE,MAAM,IAAI,GAAsB,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAsB,QAAQ;SACxC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SACvD,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,uBAAuB,IAAI,mCAAmC,CAAC,CAAA;IAChG,mGAAmG;IACnG,2EAA2E;IAC3E,MAAM,OAAO,GAAsB,SAAS,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IACnF,MAAM,WAAW,GAAsB,OAAO;SAC3C,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SAC1D,GAAG,CACF,CAAC,IAAY,EAAU,EAAE,CACvB,4BAA4B,IAAI,0DAA0D,CAC7F,CAAA;IACH,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,WAAW,CAAC,CAAA;AACrC,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,WAA8B,EAC9B,SAA4B,EACT,EAAE,CACrB,WAAW,CAAC,OAAO,CAAC,CAAC,UAAkB,EAAqB,EAAE,CAC5D,SAAS,CAAC,GAAG,CAAC,CAAC,QAAgB,EAAU,EAAE,CACzC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,QAAQ,EAAE,CAC5D,CACF,CAAA"}

package/dist/history-policy.d.ts

@@ -0,0 +1,32 @@
+/** One commit reduced to the facts the history-shape rule needs. */
+export interface CommitShape {
+    readonly sha: string;
+    readonly subject: string;
+    readonly parentCount: number;
+}
+/** A commit that breaks the linear-history rule. */
+export interface HistoryViolation {
+    readonly sha: string;
+    readonly reason: string;
+}
+/**
+ * Return every merge commit reachable from the tip.
+ * @param commits the history, each with the number of parents git recorded.
+ * @returns one violation per merge commit; empty means the history is linear.
+ */
+export declare const findMergeCommits: (commits: readonly CommitShape[]) => readonly HistoryViolation[];
+/**
+ * Report the ref namespaces a revision argument reaches.
+ * @param revision one revision argument, as passed to `git log`.
+ * @returns the namespaces it selects; empty when the argument names no namespace.
+ */
+export declare const namespacesReachedBy: (revision: string) => readonly string[];
+/**
+ * Decide whether a ref namespace holds history this repository owns.
+ * @param namespace a ref namespace, slash-terminated.
+ * @returns true when a commit there is the repository's to rewrite.
+ */
+export declare const isOwnedNamespace: (namespace: string) => boolean;
+/** The revisions a history gate walks: every commit this repository owns, and no other. */
+export declare const OWNED_HISTORY_REVISIONS: readonly string[];
+//# sourceMappingURL=history-policy.d.ts.map

package/dist/history-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"history-policy.d.ts","sourceRoot":"","sources":["../src/history-policy.ts"],"names":[],"mappings":"AAQA,oEAAoE;AACpE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,SAAS,WAAW,EAAE,KAAG,SAAS,gBAAgB,EAUvF,CAAA;AAqBL;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,UAAU,MAAM,KAAG,SAAS,MAAM,EAC9B,CAAA;AAExC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,WAAW,MAAM,KAAG,OAA6C,CAAA;AAElG,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAAqC,CAAA"}

package/dist/history-policy.js

@@ -0,0 +1,50 @@
+// History-shape policy. The history is linear, so a merge commit is prohibited
+// wherever it sits, including between two side branches: a branch takes the work of another by rebase or
+// cherry-pick. The check counts the parents git recorded rather than reading the subject, so a commit
+// that merely mentions merging is an ordinary commit, and rewording a merge does not hide it.
+//
+// The rule reaches back to the first commit and has no exception. Avoid a merge rather than plan to
+// repair one: once it is published, only a fresh history satisfies the rule.
+/**
+ * Return every merge commit reachable from the tip.
+ * @param commits the history, each with the number of parents git recorded.
+ * @returns one violation per merge commit; empty means the history is linear.
+ */
+export const findMergeCommits = (commits) => commits
+    .filter((commit) => commit.parentCount > 1)
+    .map((commit) => ({
+    sha: commit.sha,
+    reason: `merge commit with ${String(commit.parentCount)} parents ` +
+        `("${commit.subject}"); rebase or cherry-pick instead`,
+}));
+// Which refs a history gate may judge. `--all` was the obvious spelling and the wrong one: git defines it
+// as every ref under `refs/` plus HEAD, so it also walks `refs/remotes/`, which mirrors branches on a
+// server this repository cannot rewrite, and `refs/notes/`, whose commit messages git writes rather than
+// an author. Failing there asks a project to force-push a teammate's unmerged topic branch, and a fetch
+// restores whatever it rewrote. Narrowing loses no violation: work on such a branch reaches a local branch
+// the moment it lands, and is judged there.
+/** The ref namespaces a revision argument reaches, as git defines them. */
+const NAMESPACES_BY_REVISION = {
+    '--all': ['refs/heads/', 'refs/tags/', 'refs/remotes/', 'refs/notes/'],
+    '--branches': ['refs/heads/'],
+    '--remotes': ['refs/remotes/'],
+    '--tags': ['refs/tags/'],
+    HEAD: ['refs/heads/'],
+};
+/** Namespaces holding history this repository cannot rewrite, or did not write. */
+const UNOWNED_NAMESPACES = new Set(['refs/notes/', 'refs/remotes/']);
+/**
+ * Report the ref namespaces a revision argument reaches.
+ * @param revision one revision argument, as passed to `git log`.
+ * @returns the namespaces it selects; empty when the argument names no namespace.
+ */
+export const namespacesReachedBy = (revision) => NAMESPACES_BY_REVISION[revision] ?? [];
+/**
+ * Decide whether a ref namespace holds history this repository owns.
+ * @param namespace a ref namespace, slash-terminated.
+ * @returns true when a commit there is the repository's to rewrite.
+ */
+export const isOwnedNamespace = (namespace) => !UNOWNED_NAMESPACES.has(namespace);
+/** The revisions a history gate walks: every commit this repository owns, and no other. */
+export const OWNED_HISTORY_REVISIONS = ['--branches', '--tags', 'HEAD'];
+//# sourceMappingURL=history-policy.js.map

package/dist/history-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"history-policy.js","sourceRoot":"","sources":["../src/history-policy.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,yGAAyG;AACzG,sGAAsG;AACtG,8FAA8F;AAC9F,EAAE;AACF,oGAAoG;AACpG,6EAA6E;AAe7E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAA+B,EAA+B,EAAE,CAC/F,OAAO;KACJ,MAAM,CAAC,CAAC,MAAmB,EAAW,EAAE,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC;KAChE,GAAG,CACF,CAAC,MAAmB,EAAoB,EAAE,CAAC,CAAC;IAC1C,GAAG,EAAE,MAAM,CAAC,GAAG;IACf,MAAM,EACJ,qBAAqB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW;QAC1D,KAAK,MAAM,CAAC,OAAO,mCAAmC;CACzD,CAAC,CACH,CAAA;AAEL,0GAA0G;AAC1G,sGAAsG;AACtG,yGAAyG;AACzG,wGAAwG;AACxG,2GAA2G;AAC3G,4CAA4C;AAE5C,2EAA2E;AAC3E,MAAM,sBAAsB,GAAgD;IAC1E,OAAO,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,CAAC;IACtE,YAAY,EAAE,CAAC,aAAa,CAAC;IAC7B,WAAW,EAAE,CAAC,eAAe,CAAC;IAC9B,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,IAAI,EAAE,CAAC,aAAa,CAAC;CACtB,CAAA;AAED,mFAAmF;AACnF,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAS,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,CAAA;AAEjG;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAgB,EAAqB,EAAE,CACzE,sBAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAW,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAElG,2FAA2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAAsB,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA"}

package/dist/image-assets.d.ts

@@ -0,0 +1,14 @@
+/** The lowercased file extensions the image-asset gate validates. */
+export declare const SUPPORTED_IMAGE_EXTENSIONS: readonly string[];
+/** Whether a path is an image asset this gate validates (by extension). */
+export declare const isSupportedImagePath: (filePath: string) => boolean;
+/**
+ * Validate the bytes of one image, dispatched by the path's extension. Returns a human-readable reason
+ * when the image is structurally broken (corrupt, truncated, or empty), or null when it is intact. A
+ * path whose extension is not a supported image returns null (the caller filters to supported paths).
+ * @param filePath the image's path, used only to pick the validator by extension.
+ * @param bytes the raw file contents.
+ * @returns the failure reason, or null when the image is intact.
+ */
+export declare const validateImageBytes: (filePath: string, bytes: Uint8Array) => string | null;
+//# sourceMappingURL=image-assets.d.ts.map

package/dist/image-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-assets.d.ts","sourceRoot":"","sources":["../src/image-assets.ts"],"names":[],"mappings":"AA8NA,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAA4B,CAAA;AAOpF,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,GAAI,UAAU,MAAM,KAAG,OACN,CAAA;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,EAAE,OAAO,UAAU,KAAG,MAAM,GAAG,IAUjF,CAAA"}

package/dist/image-assets.js

@@ -0,0 +1,205 @@
+// Image-asset integrity policy: the pure, unit-tested logic behind the repo-wide gate
+// (`image-assets`, in packages/cli/src/checks/integrity.ts). Given the bytes of a
+// tracked image, it reports whether the image is structurally broken - corrupt or truncated - so a
+// committed asset that will not render cannot ship. This is the class of defect that a 200 response and
+// a passing a11y sweep both miss: the original failure was a seeded PNG whose header parsed but whose
+// compressed image data was truncated, so it served fine yet rendered as "Image corrupt or truncated".
+//
+// PNG (the format that broke, and the one the CMS stores) gets a REAL decode: its IDAT stream is fully
+// inflated with zlib, which throws exactly on that truncation. The other formats get a structural
+// signature-and-trailer check that catches truncation cheaply and dependency-free.
+import { inflateSync } from 'node:zlib';
+const LATIN1 = new TextDecoder('latin1');
+const dataView = (bytes) => new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+// Read a run of bytes as a Latin-1 string (each byte maps 1:1 to a code point), for magic-number headers.
+const asciiSlice = (bytes, start, end) => LATIN1.decode(bytes.subarray(start, end));
+// The PNG signature, written as the byte string the format specification defines rather than as eight
+// bare numbers: a high bit, "PNG", then a CRLF/EOF/LF run that detects a transfer which mangled line
+// endings. Spelling it this way makes the bytes readable and leaves no unexplained number behind.
+const PNG_SIGNATURE_BYTES = '\u{89}PNG\r\n\u{1A}\n';
+const PNG_SIGNATURE = Array.from(PNG_SIGNATURE_BYTES, (character) => character.codePointAt(0) ?? 0);
+const PNG_HEADER_BYTES = 8;
+// Every chunk carries a 4-byte length, a 4-byte type, and a 4-byte CRC around its payload.
+const CHUNK_LENGTH_BYTES = 4;
+const CHUNK_TYPE_BYTES = 4;
+const CHUNK_CRC_BYTES = 4;
+const CHUNK_OVERHEAD_BYTES = CHUNK_LENGTH_BYTES + CHUNK_TYPE_BYTES + CHUNK_CRC_BYTES;
+// The payload begins after the length and the type.
+const CHUNK_PAYLOAD_OFFSET = CHUNK_LENGTH_BYTES + CHUNK_TYPE_BYTES;
+const hasPngSignature = (bytes) => PNG_SIGNATURE.every((byte, index) => bytes[index] === byte);
+// Walk the PNG chunk stream from the end of the signature, collecting IDAT payloads and stopping at
+// IEND. Any chunk whose declared length runs past the file, or a missing IEND, means a truncated image.
+const walkPngChunks = (bytes, view) => {
+    /* eslint-disable functional/no-let -- a PNG can carry thousands of chunks, so recursion would risk
+       the stack; the cursor and the payloads it collects escape only as the returned value */
+    let parts = [];
+    let offset = PNG_HEADER_BYTES;
+    /* eslint-enable functional/no-let -- the walk above is the only place this file mutates */
+    while (offset + CHUNK_OVERHEAD_BYTES <= bytes.length) {
+        const length = view.getUint32(offset);
+        const type = asciiSlice(bytes, offset + CHUNK_LENGTH_BYTES, offset + CHUNK_PAYLOAD_OFFSET);
+        const dataEnd = offset + CHUNK_PAYLOAD_OFFSET + length;
+        if (dataEnd + CHUNK_CRC_BYTES > bytes.length) {
+            return { parts, error: `truncated PNG (chunk "${type}" runs past end of file)` };
+        }
+        if (type === 'IDAT') {
+            parts = [...parts, bytes.subarray(offset + CHUNK_PAYLOAD_OFFSET, dataEnd)];
+        }
+        else if (type === 'IEND') {
+            return { parts, error: null };
+        }
+        offset = dataEnd + CHUNK_CRC_BYTES;
+    }
+    return { parts, error: 'truncated PNG (no IEND chunk)' };
+};
+const inflatePng = (parts) => {
+    try {
+        inflateSync(Buffer.concat([...parts]));
+        return null;
+    }
+    catch {
+        return 'corrupt PNG (image data failed to inflate)';
+    }
+};
+const validatePng = (bytes) => {
+    if (bytes.length < PNG_HEADER_BYTES || !hasPngSignature(bytes)) {
+        return 'not a valid PNG (bad signature)';
+    }
+    const walk = walkPngChunks(bytes, dataView(bytes));
+    if (walk.error !== null) {
+        return walk.error;
+    }
+    if (walk.parts.length === 0) {
+        return 'invalid PNG (no IDAT image data)';
+    }
+    return inflatePng(walk.parts);
+};
+// JPEG brackets its data with a start-of-image and an end-of-image marker, each two bytes.
+const JPEG_MARKER_PREFIX = 0xff;
+const JPEG_START_OF_IMAGE = 0xd8;
+const JPEG_END_OF_IMAGE = 0xd9;
+const JPEG_MARKER_BYTES = 2;
+// A JPEG must carry at least its start-of-image and end-of-image markers.
+const JPEG_MARKER_COUNT = 2;
+const JPEG_MINIMUM_BYTES = JPEG_MARKER_BYTES * JPEG_MARKER_COUNT;
+const SECOND_BYTE = 1;
+const LAST_BYTE = -1;
+const SECOND_TO_LAST_BYTE = -2;
+const validateJpeg = (bytes) => {
+    if (bytes.length < JPEG_MINIMUM_BYTES ||
+        bytes[0] !== JPEG_MARKER_PREFIX ||
+        bytes[SECOND_BYTE] !== JPEG_START_OF_IMAGE) {
+        return 'not a valid JPEG (bad SOI marker)';
+    }
+    if (bytes.at(SECOND_TO_LAST_BYTE) !== JPEG_MARKER_PREFIX ||
+        bytes.at(LAST_BYTE) !== JPEG_END_OF_IMAGE) {
+        return 'truncated JPEG (missing EOI marker)';
+    }
+    return null;
+};
+const GIF_HEADER_BYTES = 6;
+const GIF_TRAILER = 0x3b;
+const validateGif = (bytes) => {
+    const header = asciiSlice(bytes, 0, GIF_HEADER_BYTES);
+    if (header !== 'GIF87a' && header !== 'GIF89a') {
+        return 'not a valid GIF (bad header)';
+    }
+    if (bytes.at(LAST_BYTE) !== GIF_TRAILER) {
+        return 'truncated GIF (missing trailer byte)';
+    }
+    return null;
+};
+// A WebP file is a RIFF container: the tag, a 32-bit size, then the form type.
+const RIFF_TAG_BYTES = 4;
+const RIFF_SIZE_OFFSET = RIFF_TAG_BYTES;
+const RIFF_FORM_OFFSET = 8;
+const WEBP_HEADER_BYTES = 12;
+// The declared size counts everything after the tag and the size field itself.
+const RIFF_SIZE_EXCLUDES_BYTES = 8;
+const validateWebp = (bytes) => {
+    if (bytes.length < WEBP_HEADER_BYTES ||
+        asciiSlice(bytes, 0, RIFF_TAG_BYTES) !== 'RIFF' ||
+        asciiSlice(bytes, RIFF_FORM_OFFSET, WEBP_HEADER_BYTES) !== 'WEBP') {
+        return 'not a valid WebP (bad RIFF/WEBP header)';
+    }
+    const declaredLength = dataView(bytes).getUint32(RIFF_SIZE_OFFSET, true) + RIFF_SIZE_EXCLUDES_BYTES;
+    if (declaredLength > bytes.length) {
+        return 'truncated WebP (RIFF size exceeds file length)';
+    }
+    return null;
+};
+const ICO_HEADER_BYTES = 6;
+const ICO_DIR_ENTRY_BYTES = 16;
+// Within a directory entry: the payload size, then the offset the payload begins at.
+const ICO_ENTRY_SIZE_OFFSET = 8;
+const ICO_ENTRY_DATA_OFFSET = 12;
+// The ICO header is a zero reserved field, an image type of 1, then the entry count.
+const ICO_RESERVED_OFFSET = 0;
+const ICO_TYPE_OFFSET = 2;
+const ICO_COUNT_OFFSET = 4;
+const ICO_ICON_TYPE = 1;
+const validateIcoEntries = (bytes, view, count) => {
+    const entryIndexes = Array.from({ length: count }, (_, at) => at);
+    for (const index of entryIndexes) {
+        const entry = ICO_HEADER_BYTES + index * ICO_DIR_ENTRY_BYTES;
+        if (entry + ICO_DIR_ENTRY_BYTES > bytes.length) {
+            return 'truncated ICO (directory runs past end of file)';
+        }
+        const imageSize = view.getUint32(entry + ICO_ENTRY_SIZE_OFFSET, true);
+        const imageOffset = view.getUint32(entry + ICO_ENTRY_DATA_OFFSET, true);
+        if (imageOffset + imageSize > bytes.length) {
+            return 'truncated ICO (image data runs past end of file)';
+        }
+    }
+    return null;
+};
+const validateIco = (bytes) => {
+    const view = dataView(bytes);
+    if (bytes.length < ICO_HEADER_BYTES ||
+        view.getUint16(ICO_RESERVED_OFFSET, true) !== 0 ||
+        view.getUint16(ICO_TYPE_OFFSET, true) !== ICO_ICON_TYPE) {
+        return 'not a valid ICO (bad header)';
+    }
+    const count = view.getUint16(ICO_COUNT_OFFSET, true);
+    if (count === 0) {
+        return 'invalid ICO (no image entries)';
+    }
+    return validateIcoEntries(bytes, view, count);
+};
+// The image extensions this gate understands, each mapped to its byte validator. A tracked file with any
+// other extension is not an image this gate checks.
+const VALIDATORS = {
+    png: validatePng,
+    jpg: validateJpeg,
+    jpeg: validateJpeg,
+    gif: validateGif,
+    webp: validateWebp,
+    ico: validateIco,
+};
+/** The lowercased file extensions the image-asset gate validates. */
+export const SUPPORTED_IMAGE_EXTENSIONS = Object.keys(VALIDATORS);
+const extensionOf = (filePath) => {
+    const lastDot = filePath.lastIndexOf('.');
+    return lastDot === -1 ? '' : filePath.slice(lastDot + 1).toLowerCase();
+};
+/** Whether a path is an image asset this gate validates (by extension). */
+export const isSupportedImagePath = (filePath) => Object.hasOwn(VALIDATORS, extensionOf(filePath));
+/**
+ * Validate the bytes of one image, dispatched by the path's extension. Returns a human-readable reason
+ * when the image is structurally broken (corrupt, truncated, or empty), or null when it is intact. A
+ * path whose extension is not a supported image returns null (the caller filters to supported paths).
+ * @param filePath the image's path, used only to pick the validator by extension.
+ * @param bytes the raw file contents.
+ * @returns the failure reason, or null when the image is intact.
+ */
+export const validateImageBytes = (filePath, bytes) => {
+    const validator = VALIDATORS[extensionOf(filePath)];
+    if (validator === undefined) {
+        return null;
+    }
+    if (bytes.length === 0) {
+        return 'empty file';
+    }
+    return validator(bytes);
+};
+//# sourceMappingURL=image-assets.js.map

package/dist/image-assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-assets.js","sourceRoot":"","sources":["../src/image-assets.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,kFAAkF;AAClF,mGAAmG;AACnG,wGAAwG;AACxG,sGAAsG;AACtG,uGAAuG;AACvG,EAAE;AACF,uGAAuG;AACvG,kGAAkG;AAClG,mFAAmF;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEvC,MAAM,MAAM,GAAgB,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAA;AAErD,MAAM,QAAQ,GAAG,CAAC,KAAiB,EAAY,EAAE,CAC/C,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;AAEhE,0GAA0G;AAC1G,MAAM,UAAU,GAAG,CAAC,KAAiB,EAAE,KAAa,EAAE,GAAW,EAAU,EAAE,CAC3E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;AAE3C,sGAAsG;AACtG,qGAAqG;AACrG,kGAAkG;AAClG,MAAM,mBAAmB,GAAW,uBAAuB,CAAA;AAC3D,MAAM,aAAa,GAAsB,KAAK,CAAC,IAAI,CACjD,mBAAmB,EACnB,CAAC,SAAiB,EAAU,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAC7D,CAAA;AACD,MAAM,gBAAgB,GAAW,CAAC,CAAA;AAClC,2FAA2F;AAC3F,MAAM,kBAAkB,GAAW,CAAC,CAAA;AACpC,MAAM,gBAAgB,GAAW,CAAC,CAAA;AAClC,MAAM,eAAe,GAAW,CAAC,CAAA;AACjC,MAAM,oBAAoB,GAAW,kBAAkB,GAAG,gBAAgB,GAAG,eAAe,CAAA;AAC5F,oDAAoD;AACpD,MAAM,oBAAoB,GAAW,kBAAkB,GAAG,gBAAgB,CAAA;AAE1E,MAAM,eAAe,GAAG,CAAC,KAAiB,EAAW,EAAE,CACrD,aAAa,CAAC,KAAK,CAAC,CAAC,IAAY,EAAE,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAA;AAOtF,oGAAoG;AACpG,wGAAwG;AACxG,MAAM,aAAa,GAAG,CAAC,KAAiB,EAAE,IAAc,EAAgB,EAAE;IACxE;8FAC0F;IAC1F,IAAI,KAAK,GAA0B,EAAE,CAAA;IACrC,IAAI,MAAM,GAAW,gBAAgB,CAAA;IACrC,2FAA2F;IAC3F,OAAO,MAAM,GAAG,oBAAoB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACrD,MAAM,MAAM,GAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAW,UAAU,CAC7B,KAAK,EACL,MAAM,GAAG,kBAAkB,EAC3B,MAAM,GAAG,oBAAoB,CAC9B,CAAA;QACD,MAAM,OAAO,GAAW,MAAM,GAAG,oBAAoB,GAAG,MAAM,CAAA;QAC9D,IAAI,OAAO,GAAG,eAAe,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,IAAI,0BAA0B,EAAE,CAAA;QAClF,CAAC;QACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,KAAK,GAAG,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAA;QAC5E,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QAC/B,CAAC;QACD,MAAM,GAAG,OAAO,GAAG,eAAe,CAAA;IACpC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAA;AAC1D,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,KAA4B,EAAiB,EAAE;IACjE,IAAI,CAAC;QACH,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,4CAA4C,CAAA;IACrD,CAAC;AACH,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,KAAiB,EAAiB,EAAE;IACvD,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,iCAAiC,CAAA;IAC1C,CAAC;IACD,MAAM,IAAI,GAAiB,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAChE,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,kCAAkC,CAAA;IAC3C,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC/B,CAAC,CAAA;AAED,2FAA2F;AAC3F,MAAM,kBAAkB,GAAW,IAAI,CAAA;AACvC,MAAM,mBAAmB,GAAW,IAAI,CAAA;AACxC,MAAM,iBAAiB,GAAW,IAAI,CAAA;AACtC,MAAM,iBAAiB,GAAW,CAAC,CAAA;AACnC,0EAA0E;AAC1E,MAAM,iBAAiB,GAAW,CAAC,CAAA;AACnC,MAAM,kBAAkB,GAAW,iBAAiB,GAAG,iBAAiB,CAAA;AACxE,MAAM,WAAW,GAAW,CAAC,CAAA;AAC7B,MAAM,SAAS,GAAW,CAAC,CAAC,CAAA;AAC5B,MAAM,mBAAmB,GAAW,CAAC,CAAC,CAAA;AAEtC,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAiB,EAAE;IACxD,IACE,KAAK,CAAC,MAAM,GAAG,kBAAkB;QACjC,KAAK,CAAC,CAAC,CAAC,KAAK,kBAAkB;QAC/B,KAAK,CAAC,WAAW,CAAC,KAAK,mBAAmB,EAC1C,CAAC;QACD,OAAO,mCAAmC,CAAA;IAC5C,CAAC;IACD,IACE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,KAAK,kBAAkB;QACpD,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,iBAAiB,EACzC,CAAC;QACD,OAAO,qCAAqC,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAW,CAAC,CAAA;AAClC,MAAM,WAAW,GAAW,IAAI,CAAA;AAEhC,MAAM,WAAW,GAAG,CAAC,KAAiB,EAAiB,EAAE;IACvD,MAAM,MAAM,GAAW,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAA;IAC7D,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,8BAA8B,CAAA;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,WAAW,EAAE,CAAC;QACxC,OAAO,sCAAsC,CAAA;IAC/C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,+EAA+E;AAC/E,MAAM,cAAc,GAAW,CAAC,CAAA;AAChC,MAAM,gBAAgB,GAAW,cAAc,CAAA;AAC/C,MAAM,gBAAgB,GAAW,CAAC,CAAA;AAClC,MAAM,iBAAiB,GAAW,EAAE,CAAA;AACpC,+EAA+E;AAC/E,MAAM,wBAAwB,GAAW,CAAC,CAAA;AAE1C,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAiB,EAAE;IACxD,IACE,KAAK,CAAC,MAAM,GAAG,iBAAiB;QAChC,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,cAAc,CAAC,KAAK,MAAM;QAC/C,UAAU,CAAC,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,KAAK,MAAM,EACjE,CAAC;QACD,OAAO,yCAAyC,CAAA;IAClD,CAAC;IACD,MAAM,cAAc,GAClB,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,wBAAwB,CAAA;IAC9E,IAAI,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAClC,OAAO,gDAAgD,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAW,CAAC,CAAA;AAClC,MAAM,mBAAmB,GAAW,EAAE,CAAA;AACtC,qFAAqF;AACrF,MAAM,qBAAqB,GAAW,CAAC,CAAA;AACvC,MAAM,qBAAqB,GAAW,EAAE,CAAA;AACxC,qFAAqF;AACrF,MAAM,mBAAmB,GAAW,CAAC,CAAA;AACrC,MAAM,eAAe,GAAW,CAAC,CAAA;AACjC,MAAM,gBAAgB,GAAW,CAAC,CAAA;AAClC,MAAM,aAAa,GAAW,CAAC,CAAA;AAE/B,MAAM,kBAAkB,GAAG,CAAC,KAAiB,EAAE,IAAc,EAAE,KAAa,EAAiB,EAAE;IAC7F,MAAM,YAAY,GAAsB,KAAK,CAAC,IAAI,CAChD,EAAE,MAAM,EAAE,KAAK,EAAE,EACjB,CAAC,CAAU,EAAE,EAAU,EAAU,EAAE,CAAC,EAAE,CACvC,CAAA;IACD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,KAAK,GAAW,gBAAgB,GAAG,KAAK,GAAG,mBAAmB,CAAA;QACpE,IAAI,KAAK,GAAG,mBAAmB,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/C,OAAO,iDAAiD,CAAA;QAC1D,CAAC;QACD,MAAM,SAAS,GAAW,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,qBAAqB,EAAE,IAAI,CAAC,CAAA;QAC7E,MAAM,WAAW,GAAW,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,qBAAqB,EAAE,IAAI,CAAC,CAAA;QAC/E,IAAI,WAAW,GAAG,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,kDAAkD,CAAA;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,KAAiB,EAAiB,EAAE;IACvD,MAAM,IAAI,GAAa,QAAQ,CAAC,KAAK,CAAC,CAAA;IACtC,IACE,KAAK,CAAC,MAAM,GAAG,gBAAgB;QAC/B,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC;QAC/C,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,aAAa,EACvD,CAAC;QACD,OAAO,8BAA8B,CAAA;IACvC,CAAC;IACD,MAAM,KAAK,GAAW,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;IAC5D,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,gCAAgC,CAAA;IACzC,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;AAC/C,CAAC,CAAA;AAED,yGAAyG;AACzG,oDAAoD;AACpD,MAAM,UAAU,GAAmE;IACjF,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;CACjB,CAAA;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAsB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;AAEpF,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAU,EAAE;IAC/C,MAAM,OAAO,GAAW,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjD,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;AACxE,CAAC,CAAA;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAgB,EAAW,EAAE,CAChE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAA;AAElD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,KAAiB,EAAiB,EAAE;IACvF,MAAM,SAAS,GACb,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAA;IACnC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAA;AACzB,CAAC,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,49 @@
+export * from './access-boundary.js';
+export * from './agent-references.js';
+export * from './architecture-layers.js';
+export * from './asset-policy.js';
+export * from './banned-typography.js';
+export * from './bundle-budget.js';
+export * from './commit-message.js';
+export * from './config-references.js';
+export * from './container-failure.js';
+export * from './container-files.js';
+export * from './container-freshness.js';
+export * from './dependency-freshness.js';
+export * from './doc-blocks.js';
+export * from './document-references.js';
+export * from './editorconfig-policy.js';
+export * from './environment-files.js';
+export * from './file-roles.js';
+export * from './generated-denial.js';
+export * from './history-policy.js';
+export * from './image-assets.js';
+export * from './install-policy.js';
+export * from './json-shapes.js';
+export * from './license-allowlist.js';
+export * from './network-policy.js';
+export * from './paired-assets.js';
+export * from './payload-access.js';
+export * from './payload-policy.js';
+export * from './payload-source.js';
+export * from './release-age.js';
+export * from './request-limits.js';
+export * from './run-plan.js';
+export * from './run-policy.js';
+export * from './secret-policy.js';
+export * from './settings.js';
+export * from './settings-layering.js';
+export * from './skill-manifest.js';
+export * from './source-text.js';
+export * from './suppression-ceiling.js';
+export * from './tailwind-tokens.js';
+export * from './text-escapes.js';
+export * from './toolchain-pins.js';
+export * from './url-safety.js';
+export * from './version-policy.js';
+export * from './vulnerability-policy.js';
+export * from './wiring-policy.js';
+export * from './wiring-violation.js';
+export * from './workspace-policy.js';
+export * from './yaml-blocks.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}

package/dist/index.js

@@ -0,0 +1,53 @@
+// Public surface of the ploaness governance layer: the pure, unit-tested rules, free of filesystem,
+// process, and network access. Every gate in the CLI is a thin I/O shell around a function exported
+// here. The split is what makes the rules cheap to test exhaustively: a pure function over strings
+// needs no fixture repository to exercise its edge cases.
+export * from './access-boundary.js';
+export * from './agent-references.js';
+export * from './architecture-layers.js';
+export * from './asset-policy.js';
+export * from './banned-typography.js';
+export * from './bundle-budget.js';
+export * from './commit-message.js';
+export * from './config-references.js';
+export * from './container-failure.js';
+export * from './container-files.js';
+export * from './container-freshness.js';
+export * from './dependency-freshness.js';
+export * from './doc-blocks.js';
+export * from './document-references.js';
+export * from './editorconfig-policy.js';
+export * from './environment-files.js';
+export * from './file-roles.js';
+export * from './generated-denial.js';
+export * from './history-policy.js';
+export * from './image-assets.js';
+export * from './install-policy.js';
+export * from './json-shapes.js';
+export * from './license-allowlist.js';
+export * from './network-policy.js';
+export * from './paired-assets.js';
+export * from './payload-access.js';
+export * from './payload-policy.js';
+export * from './payload-source.js';
+export * from './release-age.js';
+export * from './request-limits.js';
+export * from './run-plan.js';
+export * from './run-policy.js';
+export * from './secret-policy.js';
+export * from './settings.js';
+export * from './settings-layering.js';
+export * from './skill-manifest.js';
+export * from './source-text.js';
+export * from './suppression-ceiling.js';
+export * from './tailwind-tokens.js';
+export * from './text-escapes.js';
+export * from './toolchain-pins.js';
+export * from './url-safety.js';
+export * from './version-policy.js';
+export * from './vulnerability-policy.js';
+export * from './wiring-policy.js';
+export * from './wiring-violation.js';
+export * from './workspace-policy.js';
+export * from './yaml-blocks.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,0DAA0D;AAE1D,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}

package/dist/install-policy.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The install-config keys that can redefine a resolved version.
+ *
+ * Exported because `version-policy.ts` reads the same four keys out of package.json, where they are an
+ * escape from a pin rather than a workspace-wide one. It carried its own copy of this list, in a module
+ * that already imports this one - two arrays that had to stay equal, in the same gate.
+ */
+export declare const OVERRIDE_KEYS: readonly string[];
+/** A dependency whose resolved version a project has redefined. */
+export interface OverrideEntry {
+    readonly key: string;
+    readonly packageName: string;
+    /** What the override resolves to, which decides whether it redefines a version or an artefact. */
+    readonly specifier: string;
+}
+/**
+ * Read the package names whose resolved version an install config redefines.
+ * @param workspaceFile the contents of pnpm-workspace.yaml, or an empty string when absent.
+ * @returns one entry per redefined package, naming the block it came from.
+ */
+export declare const findOverrides: (workspaceFile: string) => readonly OverrideEntry[];
+/**
+ * Decide whether an install config names the dependencies allowed to run an install script.
+ * @param workspaceFile the contents of pnpm-workspace.yaml, or an empty string when absent.
+ * @param packageJson the parsed package.json, where pnpm also accepts the key.
+ * @returns true when the allowlist is declared in either place.
+ */
+export declare const declaresInstallScriptAllowlist: (workspaceFile: string, packageJson: unknown) => boolean;
+/**
+ * Report an audit configuration that would silence the vulnerability gate.
+ * @param packageJson the parsed package.json.
+ * @returns one message per silencing key found.
+ */
+export declare const findSilencedAdvisories: (packageJson: unknown) => readonly string[];
+//# sourceMappingURL=install-policy.d.ts.map

package/dist/install-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-policy.d.ts","sourceRoot":"","sources":["../src/install-policy.ts"],"names":[],"mappings":"AAaA;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAK1C,CAAA;AAQD,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,kGAAkG;IAClG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,eAAe,MAAM,KAAG,SAAS,aAAa,EASzE,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GACzC,eAAe,MAAM,EACrB,aAAa,OAAO,KACnB,OAKF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,aAAa,OAAO,KAAG,SAAS,MAAM,EAG5E,CAAA"}

package/dist/install-policy.js

@@ -0,0 +1,61 @@
+// Install-time configuration: the surface a project can use to undo what the harness pinned.
+//
+// A pinned version is only a pin while nothing else can change it. `checkTestLibraries` requires an
+// exact version in package.json, but an `overrides` entry installs a different one and leaves that
+// declaration untouched - so the gate passes while the code runs against a version ploaness never saw.
+// The same shape of escape silences the vulnerability gate through `pnpm.auditConfig`.
+//
+// The reader lives in `yaml-blocks.ts`. It is deliberately small and not a YAML parser: it looks for the
+// block keys pnpm reads at the top level of a workspace file, which is where they must appear to take
+// effect.
+import { readKey } from './json-shapes.js';
+import { declaresTopLevelKey, topLevelMappingEntries } from './yaml-blocks.js';
+/**
+ * The install-config keys that can redefine a resolved version.
+ *
+ * Exported because `version-policy.ts` reads the same four keys out of package.json, where they are an
+ * escape from a pin rather than a workspace-wide one. It carried its own copy of this list, in a module
+ * that already imports this one - two arrays that had to stay equal, in the same gate.
+ */
+export const OVERRIDE_KEYS = [
+    'overrides',
+    'resolutions',
+    'patchedDependencies',
+    'packageExtensions',
+];
+/** The key naming the dependencies permitted to run an install script. */
+const ALLOWLIST_KEY = 'onlyBuiltDependencies';
+/** The `pnpm.auditConfig` keys that drop an advisory the vulnerability gate would otherwise report. */
+const SILENCING_KEYS = ['ignoreCves', 'ignoreGhsas'];
+/**
+ * Read the package names whose resolved version an install config redefines.
+ * @param workspaceFile the contents of pnpm-workspace.yaml, or an empty string when absent.
+ * @returns one entry per redefined package, naming the block it came from.
+ */
+export const findOverrides = (workspaceFile) => OVERRIDE_KEYS.flatMap((key) => topLevelMappingEntries(workspaceFile, key).map(([packageName, specifier]) => ({
+    key,
+    packageName,
+    specifier,
+})));
+/**
+ * Decide whether an install config names the dependencies allowed to run an install script.
+ * @param workspaceFile the contents of pnpm-workspace.yaml, or an empty string when absent.
+ * @param packageJson the parsed package.json, where pnpm also accepts the key.
+ * @returns true when the allowlist is declared in either place.
+ */
+export const declaresInstallScriptAllowlist = (workspaceFile, packageJson) => {
+    if (declaresTopLevelKey(workspaceFile, ALLOWLIST_KEY)) {
+        return true;
+    }
+    return Array.isArray(readKey(readKey(packageJson, 'pnpm'), ALLOWLIST_KEY));
+};
+/**
+ * Report an audit configuration that would silence the vulnerability gate.
+ * @param packageJson the parsed package.json.
+ * @returns one message per silencing key found.
+ */
+export const findSilencedAdvisories = (packageJson) => {
+    const auditConfig = readKey(readKey(packageJson, 'pnpm'), 'auditConfig');
+    return SILENCING_KEYS.filter((key) => Array.isArray(readKey(auditConfig, key)));
+};
+//# sourceMappingURL=install-policy.js.map