@ploaness/governance 1.0.0

package/dist/payload-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-policy.js","sourceRoot":"","sources":["../src/payload-policy.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,mGAAmG;AACnG,EAAE;AACF,wGAAwG;AACxG,qGAAqG;AACrG,uGAAuG;AACvG,wGAAwG;AACxG,sGAAsG;AACtG,EAAE;AACF,mGAAmG;AACnG,uGAAuG;AACvG,oGAAoG;AACpG,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,iBAAiB,EACjB,MAAM,EACN,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,kBAAkB,CAAA;AASzB,yGAAyG;AACzG,gGAAgG;AAChG,MAAM,aAAa,GAA+B;IAChD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC5B,IAAI,EAAE,mBAAmB;QACzB,MAAM,EACJ,uGAAuG;KAC1G;IACD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,gFAAgF;KACzF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,kFAAkF;KAC3F;CACF,CAAA;AAED,oGAAoG;AACpG,sGAAsG;AACtG,uGAAuG;AACvG,mGAAmG;AACnG,0DAA0D;AAC1D,MAAM,gBAAgB,GAAW,mEAAmE,CAAA;AAEpG,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAE,GAAW,EAAW,EAAE,CAC7D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,YAAY,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAE5D,oGAAoG;AACpG,sGAAsG;AACtG,oCAAoC;AACpC,MAAM,eAAe,GAAG,CACtB,MAAc,EACd,IAAqB,EACrB,KAAa,EACiB,EAAE;IAChC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,YAAY,GAAuB,iBAAiB,CAAC,MAAM,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAChG,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9F,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAW,aAAa,CAAC,YAAY,CAAC,CAAA;IACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAW,EAAW,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AAC9E,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACzE,aAAa,CAAC,OAAO,CAAC,CAAC,IAAqB,EAA+B,EAAE,CAC3E,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;KAC3B,GAAG,CAAC,CAAC,KAAa,EAAgC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;KAC1F,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CACJ,CAAA;AAEH,MAAM,eAAe,GAAW,4BAA4B,CAAA;AAE5D,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACzE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CACvC,CAAC,KAAsB,EAAoB,EAAE,CAAC,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;IACjC,IAAI,EAAE,oBAAoB;IAC1B,MAAM,EACJ,8GAA8G;CACjH,CAAC,CACH,CAAA;AAEH,oGAAoG;AACpG,sGAAsG;AACtG,uGAAuG;AACvG,iGAAiG;AACjG,MAAM,eAAe,GAAW,uDAAuD,CAAA;AACvF,oGAAoG;AACpG,iGAAiG;AACjG,EAAE;AACF,uGAAuG;AACvG,gGAAgG;AAChG,sGAAsG;AACtG,uGAAuG;AACvG,wGAAwG;AACxG,MAAM,sBAAsB,GAAW,2CAA2C,CAAA;AAElF,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAC9E,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAC3C,CAAC,KAAsB,EAA+B,EAAE;IACtD,MAAM,SAAS,GAAW,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACxC,OAAO,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;gBACjC,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,kEAAkE,SAAS,GAAG;aACvF;SACF,CAAA;AACP,CAAC,CACF,CAAA;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAClF,uBAAuB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAA+B,EAAE;IACnF,mGAAmG;IACnG,kFAAkF;IAClF,MAAM,IAAI,GAAW,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO;QACL,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,oBAAoB,CAAC,IAAI,CAAC;QAC7B,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,uBAAuB,CAAC,IAAI,CAAC;QAChC,GAAG,uBAAuB,CAAC,IAAI,CAAC;KACjC,CAAA;AACH,CAAC,CAAA"}

package/dist/payload-source.d.ts

@@ -0,0 +1,29 @@
+/** A Payload usage defect found in project source. */
+export interface PayloadViolation {
+    readonly line: number;
+    readonly rule: string;
+    readonly reason: string;
+}
+/**
+ * The raw text of a depth-one key's value, from its colon to the end of the enclosing literal.
+ * @param wrapped the config body, brace-delimited.
+ * @param key the key to read.
+ * @returns the text after the key's colon, or undefined when the key is not declared at depth one.
+ */
+export declare const depthOneValue: (wrapped: string, key: string) => string | undefined;
+/**
+ * The keys declared inside a depth-one key's own object literal.
+ * @param wrapped the config body, brace-delimited.
+ * @param key the key whose block to read.
+ * @returns the block's depth-one keys, or an empty list when the key is absent.
+ */
+export declare const depthOneBlockKeys: (wrapped: string, key: string) => readonly string[];
+/**
+ * The brace-delimited body of the config a marker names, in either declaration order.
+ * @param source the file contents.
+ * @param marker the offset of the type reference.
+ * @param isTrailing true when the type follows the value, as `satisfies` does.
+ * @returns the body wrapped in its own braces, or undefined when no literal belongs to the marker.
+ */
+export declare const configBody: (source: string, marker: number, isTrailing: boolean) => string | undefined;
+//# sourceMappingURL=payload-source.d.ts.map

package/dist/payload-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-source.d.ts","sourceRoot":"","sources":["../src/payload-source.ts"],"names":[],"mappings":"AAgBA,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAwBD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,EAAE,KAAK,MAAM,KAAG,MAAM,GAAG,SAOrE,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,MAAM,EAAE,KAAK,MAAM,KAAG,SAAS,MAAM,EAG/E,CAAA;AAkCD;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GACrB,QAAQ,MAAM,EACd,QAAQ,MAAM,EACd,YAAY,OAAO,KAClB,MAAM,GAAG,SAWX,CAAA"}

package/dist/payload-source.js

@@ -0,0 +1,84 @@
+// The Payload half of the source reader: which object literal in a file IS a collection or a global,
+// and what its own keys say.
+//
+// The generic scanning it stands on is in `source-text.ts`. What is here is everything that needs to
+// know Payload's shape - the three ways a config is declared, and the difference between a key the
+// config declares and one a field beneath it does.
+import { balancedArguments, LAST_CHARACTER, NOT_FOUND, scanDelimited, topLevelKeys, } from './source-text.js';
+// Where a key sits directly inside the outermost object literal, rather than inside something nested in
+// it. Searching the text instead would find a field-level `access` block and read it as the collection's
+// own, which is exactly the omission the access rules exist to catch.
+//
+// The boundary requirement is the same one `TOP_LEVEL_KEY` carries, and for the same reason: the scan
+// visits every offset, so a pattern anchored only at the start of the remaining text matched mid-word.
+// `oauth:` was read as `auth:` and reported a collection with no auth as one with unhardened auth. The
+// delimiter is required rather than merely allowed, so the returned offset is the brace or comma that
+// opens the key rather than the key itself; every reader below looks forward from it either way.
+const depthOneKeyIndex = (text, key) => {
+    const pattern = new RegExp(String.raw `^[{,]\s*${key}\s*:`);
+    return scanDelimited(text, 0, (found, step) => step.depth === 1 && pattern.test(text.slice(step.index))
+        ? { state: step.index, stop: true }
+        : { state: found, stop: false }, NOT_FOUND);
+};
+/**
+ * The raw text of a depth-one key's value, from its colon to the end of the enclosing literal.
+ * @param wrapped the config body, brace-delimited.
+ * @param key the key to read.
+ * @returns the text after the key's colon, or undefined when the key is not declared at depth one.
+ */
+export const depthOneValue = (wrapped, key) => {
+    const at = depthOneKeyIndex(wrapped, key);
+    if (at === NOT_FOUND) {
+        return undefined;
+    }
+    const colon = wrapped.indexOf(':', at);
+    return colon === NOT_FOUND ? undefined : wrapped.slice(colon + 1);
+};
+/**
+ * The keys declared inside a depth-one key's own object literal.
+ * @param wrapped the config body, brace-delimited.
+ * @param key the key whose block to read.
+ * @returns the block's depth-one keys, or an empty list when the key is absent.
+ */
+export const depthOneBlockKeys = (wrapped, key) => {
+    const at = depthOneKeyIndex(wrapped, key);
+    return at === NOT_FOUND ? [] : topLevelKeys(wrapped, at);
+};
+const withClose = (spans, close) => {
+    const last = spans.at(LAST_CHARACTER);
+    return last?.close === NOT_FOUND
+        ? [...spans.slice(0, LAST_CHARACTER), { open: last.open, close }]
+        : spans;
+};
+// Every module-level `{ ... }` in the file, collected in one pass. The `satisfies` form writes the type
+// AFTER the value, so its body cannot be found by scanning forward from the marker the way an
+// annotation's can - it is the literal that closes just before the marker instead, and finding that by
+// walking backwards would mean a second scanner that cannot skip string literals.
+const moduleLiterals = (source) => scanDelimited(source, 0, (spans, step) => {
+    if (step.character === '{' && step.depth === 1) {
+        return { state: [...spans, { open: step.index, close: NOT_FOUND }], stop: false };
+    }
+    return step.character === '}' && step.depth === 0
+        ? { state: withClose(spans, step.index), stop: false }
+        : { state: spans, stop: false };
+}, []);
+/**
+ * The brace-delimited body of the config a marker names, in either declaration order.
+ * @param source the file contents.
+ * @param marker the offset of the type reference.
+ * @param isTrailing true when the type follows the value, as `satisfies` does.
+ * @returns the body wrapped in its own braces, or undefined when no literal belongs to the marker.
+ */
+export const configBody = (source, marker, isTrailing) => {
+    const open = isTrailing
+        ? (moduleLiterals(source)
+            .filter((span) => span.close !== NOT_FOUND && span.close < marker)
+            .at(LAST_CHARACTER)?.open ?? NOT_FOUND)
+        : source.indexOf('{', marker);
+    if (open === NOT_FOUND) {
+        return undefined;
+    }
+    const body = balancedArguments(source, open);
+    return body === undefined ? undefined : `{${body}}`;
+};
+//# sourceMappingURL=payload-source.js.map

package/dist/payload-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-source.js","sourceRoot":"","sources":["../src/payload-source.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,6BAA6B;AAC7B,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,mDAAmD;AACnD,OAAO,EACL,iBAAiB,EAEjB,cAAc,EACd,SAAS,EAET,aAAa,EACb,YAAY,GACb,MAAM,kBAAkB,CAAA;AASzB,wGAAwG;AACxG,yGAAyG;AACzG,sEAAsE;AACtE,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AACvG,sGAAsG;AACtG,iGAAiG;AACjG,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,GAAW,EAAU,EAAE;IAC7D,MAAM,OAAO,GAAW,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,WAAW,GAAG,MAAM,CAAC,CAAA;IAClE,OAAO,aAAa,CAClB,IAAI,EACJ,CAAC,EACD,CAAC,KAAa,EAAE,IAAc,EAAkB,EAAE,CAChD,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;QACnC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EACnC,SAAS,CACV,CAAA;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,GAAW,EAAsB,EAAE;IAChF,MAAM,EAAE,GAAW,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACjD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAW,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC9C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;AACnE,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,GAAW,EAAqB,EAAE;IACnF,MAAM,EAAE,GAAW,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACjD,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AAC1D,CAAC,CAAA;AAQD,MAAM,SAAS,GAAG,CAAC,KAA6B,EAAE,KAAa,EAA0B,EAAE;IACzF,MAAM,IAAI,GAA4B,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,CAAA;IAC9D,OAAO,IAAI,EAAE,KAAK,KAAK,SAAS;QAC9B,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjE,CAAC,CAAC,KAAK,CAAA;AACX,CAAC,CAAA;AAED,wGAAwG;AACxG,8FAA8F;AAC9F,uGAAuG;AACvG,kFAAkF;AAClF,MAAM,cAAc,GAAG,CAAC,MAAc,EAA0B,EAAE,CAChE,aAAa,CACX,MAAM,EACN,CAAC,EACD,CAAC,KAA6B,EAAE,IAAc,EAAkC,EAAE;IAChF,IAAI,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACnF,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QAC/C,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;QACtD,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACnC,CAAC,EACD,EAAE,CACH,CAAA;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,MAAc,EACd,MAAc,EACd,UAAmB,EACC,EAAE;IACtB,MAAM,IAAI,GAAW,UAAU;QAC7B,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC;aACpB,MAAM,CAAC,CAAC,IAAiB,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;aACvF,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,IAAI,SAAS,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAChE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAA;AACrD,CAAC,CAAA"}

package/dist/release-age.d.ts

@@ -0,0 +1,23 @@
+/** Hours a published release must have existed before pnpm will install it. */
+export declare const RELEASE_AGE_FLOOR_HOURS: number;
+/** A release's publication instant measured against now, both as epoch milliseconds. */
+export interface ReleaseAge {
+    /** When the release was published, or undefined when the registry did not say. */
+    readonly publishedAt: number | undefined;
+    /** The instant to measure the publication against. */
+    readonly now: number;
+}
+/**
+ * Whole hours a release has existed, so a report can say how much of the wait is left.
+ * @param age the publication instant and the instant to measure it against.
+ * @returns the floored hours, or `undefined` when the publication instant is unknown.
+ */
+export declare const hoursPublished: (age: ReleaseAge) => number | undefined;
+/**
+ * Whether pnpm would refuse this release for being younger than the floor.
+ * @param age the publication instant and the instant to measure it against.
+ * @returns true only when the age is KNOWN and below the floor. An unknown date is never held, because
+ * a report that guessed would withhold an update the project can take today.
+ */
+export declare const isHeldByReleaseAge: (age: ReleaseAge) => boolean;
+//# sourceMappingURL=release-age.d.ts.map

package/dist/release-age.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-age.d.ts","sourceRoot":"","sources":["../src/release-age.ts"],"names":[],"mappings":"AAmBA,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,EAAE,MAAW,CAAA;AAEjD,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,KAAK,UAAU,KAAG,MAAM,GAAG,SAGW,CAAA;AAErE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,KAAK,UAAU,KAAG,OAGpD,CAAA"}

package/dist/release-age.js

@@ -0,0 +1,38 @@
+// Whether a published release is old enough to be installed at all.
+//
+// pnpm refuses a release younger than a minimum age. That guards against a compromised publish: a
+// malicious version is usually pulled within hours of being noticed, so the wait costs a day and buys
+// the window in which the registry corrects itself. The freshness report has to know about it, because
+// an update named without it sends a reader to an install pnpm will refuse, and the reader then either
+// waits without knowing why or spends the guard on an exclusion to get past it.
+//
+// The floor is pnpm's rather than ploaness's, and pnpm neither documents the default nor answers
+// `pnpm config get minimumReleaseAge` for it. The value below was established by observation - refused
+// at 13h and again at 23h58m, taken at 33h and at six days - so it is stated as a named constant a
+// reader can check and a maintainer can correct, rather than buried inside a comparison.
+//
+// Held is a third thing the report can say, not a fourth verdict the gate can reach. Nothing here
+// fails a build: a release too young to install is a fact about the registry, never a defect in the
+// project reading it.
+const MILLISECONDS_PER_HOUR = 3_600_000;
+/** Hours a published release must have existed before pnpm will install it. */
+export const RELEASE_AGE_FLOOR_HOURS = 24;
+/**
+ * Whole hours a release has existed, so a report can say how much of the wait is left.
+ * @param age the publication instant and the instant to measure it against.
+ * @returns the floored hours, or `undefined` when the publication instant is unknown.
+ */
+export const hoursPublished = (age) => age.publishedAt === undefined
+    ? undefined
+    : Math.floor((age.now - age.publishedAt) / MILLISECONDS_PER_HOUR);
+/**
+ * Whether pnpm would refuse this release for being younger than the floor.
+ * @param age the publication instant and the instant to measure it against.
+ * @returns true only when the age is KNOWN and below the floor. An unknown date is never held, because
+ * a report that guessed would withhold an update the project can take today.
+ */
+export const isHeldByReleaseAge = (age) => {
+    const hours = hoursPublished(age);
+    return hours !== undefined && hours < RELEASE_AGE_FLOOR_HOURS;
+};
+//# sourceMappingURL=release-age.js.map

package/dist/release-age.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-age.js","sourceRoot":"","sources":["../src/release-age.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AACvG,gFAAgF;AAChF,EAAE;AACF,iGAAiG;AACjG,uGAAuG;AACvG,mGAAmG;AACnG,yFAAyF;AACzF,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,sBAAsB;AAEtB,MAAM,qBAAqB,GAAW,SAAS,CAAA;AAE/C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAW,EAAE,CAAA;AAUjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAe,EAAsB,EAAE,CACpE,GAAG,CAAC,WAAW,KAAK,SAAS;IAC3B,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,qBAAqB,CAAC,CAAA;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAe,EAAW,EAAE;IAC7D,MAAM,KAAK,GAAuB,cAAc,CAAC,GAAG,CAAC,CAAA;IACrD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,uBAAuB,CAAA;AAC/D,CAAC,CAAA"}

package/dist/request-limits.d.ts

@@ -0,0 +1,39 @@
+/**
+ * How long any single request to a package or image registry may take.
+ *
+ * Shared by both registry readers rather than stated twice. They ask different hosts different
+ * questions, but "how long will the harness wait for an answer" is one decision, and two literals that
+ * must stay equal will not stay equal.
+ */
+export declare const REQUEST_TIMEOUT_MS: number;
+/**
+ * How long a networked tool the harness shells out to may run before it is killed.
+ *
+ * Far longer than a single request, because the tool resolves a whole lockfile before it asks anything.
+ * This is a bound on a hang rather than a performance budget: a healthy run never approaches it, and a
+ * run that does has stopped making progress.
+ */
+export declare const NETWORKED_TOOL_TIMEOUT_MS: number;
+/**
+ * How many registry requests the harness holds open at once.
+ *
+ * A workspace declares hundreds of distinct coordinates, and asking for all of them at once opens a
+ * socket per dependency - which the registry answers by rate-limiting, and which a corporate proxy
+ * answers by dropping. Neither failure names its cause, so both arrive as "the registry was
+ * unreachable" for a network that was reachable all along.
+ */
+export declare const REGISTRY_CONCURRENCY: number;
+/**
+ * Map over items with at most `limit` in flight, preserving input order.
+ *
+ * Windowed rather than a sliding pool, because a pool needs a shared cursor and this repository bans
+ * the mutation that would take. A window costs the tail of each batch waiting on its slowest member,
+ * which for short registry reads is a smaller price than the rule it would break.
+ * @param items what to work through, in the order the results must come back in.
+ * @param limit the most that may be in flight at once; a limit below one is read as one, since a
+ * limit of zero would otherwise consume nothing and never finish.
+ * @param work what to do with one item.
+ * @returns every result, in the order of `items`.
+ */
+export declare const mapWithConcurrency: <Item, Result>(items: readonly Item[], limit: number, work: (item: Item) => Promise<Result>) => Promise<readonly Result[]>;
+//# sourceMappingURL=request-limits.d.ts.map

package/dist/request-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-limits.d.ts","sourceRoot":"","sources":["../src/request-limits.ts"],"names":[],"mappings":"AAYA;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAe,CAAA;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAgB,CAAA;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAU,CAAA;AAE7C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,GAAU,IAAI,EAAE,MAAM,EACnD,OAAO,SAAS,IAAI,EAAE,EACtB,OAAO,MAAM,EACb,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,KACpC,OAAO,CAAC,SAAS,MAAM,EAAE,CAS3B,CAAA"}

package/dist/request-limits.js

@@ -0,0 +1,57 @@
+// The bounds the harness places on its OWN outbound work, and the one combinator that applies them.
+//
+// This is the first async module among the rules, and it is here rather than in the CLI for the reason
+// the split states: what it decides is a policy - how long the harness waits, and how many sockets it
+// will hold open at once - and a policy expressed as a pure function can be asserted against, while the
+// same policy expressed inline in a fetch call can only be observed by hanging. Nothing here performs
+// I/O; the work is supplied by the caller, which is where the I/O stays.
+//
+// The bound that was missing cost more than the bound that was wrong. An unbounded fetch produces no
+// output and no verdict, so on a team's CI a stuck gate is indistinguishable from a stuck build - and
+// unlike a gate failure, nothing says which it is, because nothing ends.
+/**
+ * How long any single request to a package or image registry may take.
+ *
+ * Shared by both registry readers rather than stated twice. They ask different hosts different
+ * questions, but "how long will the harness wait for an answer" is one decision, and two literals that
+ * must stay equal will not stay equal.
+ */
+export const REQUEST_TIMEOUT_MS = 30_000;
+/**
+ * How long a networked tool the harness shells out to may run before it is killed.
+ *
+ * Far longer than a single request, because the tool resolves a whole lockfile before it asks anything.
+ * This is a bound on a hang rather than a performance budget: a healthy run never approaches it, and a
+ * run that does has stopped making progress.
+ */
+export const NETWORKED_TOOL_TIMEOUT_MS = 300_000;
+/**
+ * How many registry requests the harness holds open at once.
+ *
+ * A workspace declares hundreds of distinct coordinates, and asking for all of them at once opens a
+ * socket per dependency - which the registry answers by rate-limiting, and which a corporate proxy
+ * answers by dropping. Neither failure names its cause, so both arrive as "the registry was
+ * unreachable" for a network that was reachable all along.
+ */
+export const REGISTRY_CONCURRENCY = 8;
+/**
+ * Map over items with at most `limit` in flight, preserving input order.
+ *
+ * Windowed rather than a sliding pool, because a pool needs a shared cursor and this repository bans
+ * the mutation that would take. A window costs the tail of each batch waiting on its slowest member,
+ * which for short registry reads is a smaller price than the rule it would break.
+ * @param items what to work through, in the order the results must come back in.
+ * @param limit the most that may be in flight at once; a limit below one is read as one, since a
+ * limit of zero would otherwise consume nothing and never finish.
+ * @param work what to do with one item.
+ * @returns every result, in the order of `items`.
+ */
+export const mapWithConcurrency = async (items, limit, work) => {
+    if (items.length === 0) {
+        return [];
+    }
+    const width = Math.max(1, limit);
+    const inFlight = await Promise.all(items.slice(0, width).map(async (item) => await work(item)));
+    return [...inFlight, ...(await mapWithConcurrency(items.slice(width), limit, work))];
+};
+//# sourceMappingURL=request-limits.js.map

package/dist/request-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-limits.js","sourceRoot":"","sources":["../src/request-limits.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,EAAE;AACF,uGAAuG;AACvG,sGAAsG;AACtG,wGAAwG;AACxG,sGAAsG;AACtG,yEAAyE;AACzE,EAAE;AACF,qGAAqG;AACrG,sGAAsG;AACtG,yEAAyE;AAEzE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAW,MAAM,CAAA;AAEhD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAW,OAAO,CAAA;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAW,CAAC,CAAA;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,KAAsB,EACtB,KAAa,EACb,IAAqC,EACT,EAAE;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,KAAK,GAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAsB,MAAM,OAAO,CAAC,GAAG,CACnD,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAU,EAAmB,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CACnF,CAAA;IACD,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;AACtF,CAAC,CAAA"}

package/dist/run-plan.d.ts

@@ -0,0 +1,32 @@
+/** Which of the three scopes a gate judges. */
+export type GateScope = 'repository' | 'package' | 'payload';
+/** One gate, reduced to what deciding the order needs. */
+export interface GateDescriptor {
+    readonly id: string;
+    readonly scope: GateScope;
+    readonly isExtended: boolean;
+}
+/** One governed member, reduced to what deciding the order needs. */
+export interface MemberDescriptor {
+    readonly path: string;
+    readonly isPayload: boolean;
+}
+/** One gate invocation: a gate, and the member it is asked about when it has one. */
+export interface PlanStep {
+    readonly gateId: string;
+    /** The member's path, or undefined for a repository-scope gate. */
+    readonly member: string | undefined;
+}
+/**
+ * Expand the gate registry into the ordered invocations one run performs.
+ *
+ * For a repository with a single member this yields exactly the sequence ploaness ran before it knew
+ * about members, which is the property that makes workspace support invisible to a single-package
+ * project rather than merely compatible with it.
+ * @param gates every gate ploaness knows, in registry order.
+ * @param members the governed members, in discovery order.
+ * @param isExtended whether extended verification's gates are included.
+ * @returns one step per gate invocation, in run order.
+ */
+export declare const planSteps: (gates: readonly GateDescriptor[], members: readonly MemberDescriptor[], isExtended: boolean) => readonly PlanStep[];
+//# sourceMappingURL=run-plan.d.ts.map

package/dist/run-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-plan.d.ts","sourceRoot":"","sources":["../src/run-plan.ts"],"names":[],"mappings":"AAoBA,+CAA+C;AAC/C,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAA;AAE5D,0DAA0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CACpC;AAuBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,GACpB,OAAO,SAAS,cAAc,EAAE,EAChC,SAAS,SAAS,gBAAgB,EAAE,EACpC,YAAY,OAAO,KAClB,SAAS,QAAQ,EAGgE,CAAA"}

package/dist/run-plan.js

@@ -0,0 +1,43 @@
+// The order a verification run visits its gates, and which member each gate is asked about.
+//
+// The order is a rule, not an implementation detail: it decides which finding a project sees first, and
+// the reasoning behind it is stated in the guide - the structural gates that catch a mis-wired project
+// run before the analyzers whose output is harder to read, the tracked-tree fingerprint brackets
+// everything that could rewrite a file, and the two preconditions lead because a survey of findings
+// below either would be a list of verdicts about nothing.
+//
+// Registry order IS run order, and this module deliberately adds no second ordering rule on top of it.
+// Grouping the run by member instead - every gate for one member, then the next - reads better in a
+// multi-member report, and it was the first design here. It was dropped because it also reorders a
+// SINGLE-member run, which is every consumer that exists today: `conventions` would overtake `eslint`,
+// the container gates would move to the end, and a project's first finding could change without one
+// rule changing. Making workspaces work is not a licence to renumber the run for projects that have no
+// workspace. A repository with one member therefore produces exactly the sequence that shipped before
+// members existed, and that equality is pinned by a spec rather than argued.
+//
+// The cost is that a multi-member run interleaves members gate by gate. The report layer answers that by
+// labelling each step with its member, which costs a single-member run nothing because it has none.
+// A package-scope gate asks about every member; a payload-scope gate asks only about the members that
+// are Payload applications. Derived from what the member declares rather than from anything it opts
+// into, so a project cannot silence the Payload rules by describing itself differently.
+const membersFor = (gate, members) => gate.scope === 'payload'
+    ? members.filter((member) => member.isPayload)
+    : members;
+const stepsFor = (gate, members) => gate.scope === 'repository'
+    ? [{ gateId: gate.id, member: undefined }]
+    : membersFor(gate, members).map((member) => ({ gateId: gate.id, member: member.path }));
+/**
+ * Expand the gate registry into the ordered invocations one run performs.
+ *
+ * For a repository with a single member this yields exactly the sequence ploaness ran before it knew
+ * about members, which is the property that makes workspace support invisible to a single-package
+ * project rather than merely compatible with it.
+ * @param gates every gate ploaness knows, in registry order.
+ * @param members the governed members, in discovery order.
+ * @param isExtended whether extended verification's gates are included.
+ * @returns one step per gate invocation, in run order.
+ */
+export const planSteps = (gates, members, isExtended) => gates
+    .filter((gate) => isExtended || !gate.isExtended)
+    .flatMap((gate) => stepsFor(gate, members));
+//# sourceMappingURL=run-plan.js.map

package/dist/run-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-plan.js","sourceRoot":"","sources":["../src/run-plan.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,EAAE;AACF,wGAAwG;AACxG,uGAAuG;AACvG,iGAAiG;AACjG,oGAAoG;AACpG,0DAA0D;AAC1D,EAAE;AACF,uGAAuG;AACvG,oGAAoG;AACpG,mGAAmG;AACnG,uGAAuG;AACvG,oGAAoG;AACpG,uGAAuG;AACvG,sGAAsG;AACtG,6EAA6E;AAC7E,EAAE;AACF,yGAAyG;AACzG,oGAAoG;AAyBpG,sGAAsG;AACtG,oGAAoG;AACpG,wFAAwF;AACxF,MAAM,UAAU,GAAG,CACjB,IAAoB,EACpB,OAAoC,EACP,EAAE,CAC/B,IAAI,CAAC,KAAK,KAAK,SAAS;IACtB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAwB,EAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;IACzE,CAAC,CAAC,OAAO,CAAA;AAEb,MAAM,QAAQ,GAAG,CACf,IAAoB,EACpB,OAAoC,EACf,EAAE,CACvB,IAAI,CAAC,KAAK,KAAK,YAAY;IACzB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAC3B,CAAC,MAAwB,EAAY,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CACnF,CAAA;AAEP;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,KAAgC,EAChC,OAAoC,EACpC,UAAmB,EACE,EAAE,CACvB,KAAK;KACF,MAAM,CAAC,CAAC,IAAoB,EAAW,EAAE,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;KACzE,OAAO,CAAC,CAAC,IAAoB,EAAuB,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA"}

package/dist/run-policy.d.ts

@@ -0,0 +1,32 @@
+/** What decides whether a run carries on after a gate. */
+export interface RunPoint {
+    /** Whether the gate that just ran failed. */
+    readonly isFailure: boolean;
+    /** Whether a failure here makes every later gate meaningless rather than merely unreported. */
+    readonly isPrecondition: boolean;
+    /** False in report-only mode, where findings print but the run still exits 0. */
+    readonly isEnforced: boolean;
+}
+/**
+ * Whether this gate ends the run rather than the next one following it.
+ * @param point the gate's outcome and the mode the run is in.
+ * @returns true when no later gate should run.
+ */
+export declare const endsRun: (point: RunPoint) => boolean;
+/**
+ * Whether a member holds source code its suite could be about.
+ *
+ * A workspace root is a member - it has to be, to own the scripts a run is invoked through - and it may
+ * hold nothing but a manifest. Running a test runner there fails on an empty include, which would report
+ * a package with nothing to test as a package that failed to test it.
+ *
+ * The condition is derived rather than declared, and deliberately narrow: a member holding code and no
+ * suite still fails. `--passWithNoTests` would have been the easy answer and the wrong one - it lets an
+ * application delete its specs and stay green.
+ * @param trackedPaths every tracked path inside the member, member-relative.
+ * @param sourceRoots the directories the member declared as holding first-party source.
+ * @param isCode whether a path is a code file.
+ * @returns true when at least one code file sits under a declared source root.
+ */
+export declare const carriesSourceCode: (trackedPaths: readonly string[], sourceRoots: readonly string[], isCode: (filePath: string) => boolean) => boolean;
+//# sourceMappingURL=run-policy.d.ts.map

package/dist/run-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-policy.d.ts","sourceRoot":"","sources":["../src/run-policy.ts"],"names":[],"mappings":"AAcA,0DAA0D;AAC1D,MAAM,WAAW,QAAQ;IACvB,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AAED;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAAI,OAAO,QAAQ,KAAG,OACqB,CAAA;AAE/D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,GAC5B,cAAc,SAAS,MAAM,EAAE,EAC/B,aAAa,SAAS,MAAM,EAAE,EAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,KACpC,OAKA,CAAA"}

package/dist/run-policy.js

@@ -0,0 +1,37 @@
+// When a verification run stops.
+//
+// The two modes want opposite things from a failure. An enforcing run stops at the first one: nothing
+// below a failing gate has been verified, and a gate is free to leave the tree in a shape the next one
+// misreads, so a column of passes beneath a failure describes a state nobody established.
+//
+// A report-only run wants the opposite, because it exists to survey a repository that has not adopted
+// the harness yet. Stopping there would report one finding out of the many such a project has, and the
+// project would learn its size one run at a time.
+//
+// One failure stops both. A gate whose failure makes every later gate meaningless is not reporting a
+// finding among others - it is saying that ploaness cannot judge this project, or cannot tell whether
+// what it is judging is what it thinks. Carrying on produces a list of verdicts about nothing.
+/**
+ * Whether this gate ends the run rather than the next one following it.
+ * @param point the gate's outcome and the mode the run is in.
+ * @returns true when no later gate should run.
+ */
+export const endsRun = (point) => point.isFailure && (point.isEnforced || point.isPrecondition);
+/**
+ * Whether a member holds source code its suite could be about.
+ *
+ * A workspace root is a member - it has to be, to own the scripts a run is invoked through - and it may
+ * hold nothing but a manifest. Running a test runner there fails on an empty include, which would report
+ * a package with nothing to test as a package that failed to test it.
+ *
+ * The condition is derived rather than declared, and deliberately narrow: a member holding code and no
+ * suite still fails. `--passWithNoTests` would have been the easy answer and the wrong one - it lets an
+ * application delete its specs and stay green.
+ * @param trackedPaths every tracked path inside the member, member-relative.
+ * @param sourceRoots the directories the member declared as holding first-party source.
+ * @param isCode whether a path is a code file.
+ * @returns true when at least one code file sits under a declared source root.
+ */
+export const carriesSourceCode = (trackedPaths, sourceRoots, isCode) => trackedPaths.some((filePath) => isCode(filePath) &&
+    sourceRoots.some((root) => filePath.startsWith(`${root}/`)));
+//# sourceMappingURL=run-policy.js.map

package/dist/run-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-policy.js","sourceRoot":"","sources":["../src/run-policy.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,0FAA0F;AAC1F,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,kDAAkD;AAClD,EAAE;AACF,qGAAqG;AACrG,sGAAsG;AACtG,+FAA+F;AAY/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,KAAe,EAAW,EAAE,CAClD,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;AAE/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,YAA+B,EAC/B,WAA8B,EAC9B,MAAqC,EAC5B,EAAE,CACX,YAAY,CAAC,IAAI,CACf,CAAC,QAAgB,EAAW,EAAE,CAC5B,MAAM,CAAC,QAAQ,CAAC;IAChB,WAAW,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAC/E,CAAA"}

package/dist/secret-policy.d.ts

@@ -0,0 +1,13 @@
+/** One committed fake credential, and the reason it is committed. */
+export interface SecretException {
+    /** A repo-relative path whose findings are excused. */
+    readonly path: string;
+    readonly reason: string;
+}
+/**
+ * Render a scanner configuration from the declared exceptions.
+ * @param exceptions the recorded exceptions.
+ * @returns TOML that extends the scanner's default rules and adds one allowlist per exception.
+ */
+export declare const renderGitleaksConfig: (exceptions: readonly SecretException[]) => string;
+//# sourceMappingURL=secret-policy.d.ts.map

package/dist/secret-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-policy.d.ts","sourceRoot":"","sources":["../src/secret-policy.ts"],"names":[],"mappings":"AAaA,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AA2CD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,YAAY,SAAS,eAAe,EAAE,KAAG,MAiB7E,CAAA"}

package/dist/secret-policy.js

@@ -0,0 +1,69 @@
+// The secret allowlist.
+//
+// The standard requires a repository to list every fake credential it commits as a test fixture, and
+// requires the secret scan to fail on anything outside that list. Until now there was no way to satisfy
+// both: `.gitleaks.toml` is a forbidden managed path, precisely so a project cannot weaken the scanner's
+// own rules, and no setting replaced it. A project with a fixture credential could not pass at all.
+//
+// The resolution keeps the file forbidden and makes the allowlist data instead. ploaness renders the
+// scanner's configuration itself, outside the working tree, from entries the project declares. The
+// rendered config always extends the tool's default rules, so a declared entry can only add a named
+// exception and can never replace or disable what the scanner already looks for.
+import { escapeForRegex } from './text-escapes.js';
+// The characters a TOML basic string cannot carry literally: its two delimiters, and every control
+// character. Named by code point rather than written out, for the reason `banned-typography.ts` gives:
+// a source file that spells an invisible character invites a tool to normalise it away.
+const FIRST_PRINTABLE = 0x20;
+const HEX_RADIX = 16;
+const UNICODE_ESCAPE_DIGITS = 4;
+const asHex = (codePoint) => codePoint.toString(HEX_RADIX).padStart(UNICODE_ESCAPE_DIGITS, '0');
+const NAMED_ESCAPES = new Map([
+    ['\\', '\\\\'],
+    ['"', String.raw `\"`],
+    ['\n', String.raw `\n`],
+    ['\r', String.raw `\r`],
+    ['\t', String.raw `\t`],
+]);
+// `Number(...)` rather than a fallback: `codePointAt` is typed as possibly undefined, an empty string
+// yields NaN, and `NaN < FIRST_PRINTABLE` is false - so the character passes through as itself without
+// a branch no input can reach.
+const escapeCharacter = (character) => {
+    const named = NAMED_ESCAPES.get(character);
+    if (named !== undefined) {
+        return named;
+    }
+    const codePoint = Number(character.codePointAt(0));
+    return codePoint < FIRST_PRINTABLE ? String.raw `\u${asHex(codePoint)}` : character;
+};
+// A basic TOML string, which is the only string form that escapes anything. Both fields go through it.
+//
+// The path used to be rendered into a multi-line LITERAL string, which escapes nothing at all, so a
+// path containing the `'''` delimiter would have closed the string early and left the remainder as
+// syntax. The regex escaping the path already carries is no help there: it protects the scanner's
+// pattern, not TOML's quoting. A doubled backslash reaches the scanner as the single one it wants.
+const escapeForToml = (value) => 
+// An escape is decided per code point, and a decomposed emoji is re-joined unchanged either way.
+// eslint-disable-next-line @typescript-eslint/no-misused-spread -- see the note above
+[...value].map((character) => escapeCharacter(character)).join('');
+/**
+ * Render a scanner configuration from the declared exceptions.
+ * @param exceptions the recorded exceptions.
+ * @returns TOML that extends the scanner's default rules and adds one allowlist per exception.
+ */
+export const renderGitleaksConfig = (exceptions) => {
+    const header = [
+        '# Generated by ploaness. Do not commit this file: a copy in the working tree could only shadow or',
+        '# weaken the rules ploaness supplies, which is why the path is forbidden.',
+        '[extend]',
+        'useDefault = true',
+        '',
+    ].join('\n');
+    const blocks = exceptions.map((exception) => [
+        '[[allowlists]]',
+        `description = "${escapeForToml(exception.reason)}"`,
+        `paths = ["^${escapeForToml(escapeForRegex(exception.path))}$"]`,
+        '',
+    ].join('\n'));
+    return [header, ...blocks].join('\n');
+};
+//# sourceMappingURL=secret-policy.js.map

package/dist/secret-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-policy.js","sourceRoot":"","sources":["../src/secret-policy.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,EAAE;AACF,qGAAqG;AACrG,wGAAwG;AACxG,yGAAyG;AACzG,oGAAoG;AACpG,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,oGAAoG;AACpG,iFAAiF;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AASlD,mGAAmG;AACnG,uGAAuG;AACvG,wFAAwF;AACxF,MAAM,eAAe,GAAW,IAAI,CAAA;AACpC,MAAM,SAAS,GAAW,EAAE,CAAA;AAC5B,MAAM,qBAAqB,GAAW,CAAC,CAAA;AAEvC,MAAM,KAAK,GAAG,CAAC,SAAiB,EAAU,EAAE,CAC1C,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAA;AAEpE,MAAM,aAAa,GAAgC,IAAI,GAAG,CAAC;IACzD,CAAC,IAAI,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACrB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACtB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACtB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;CACvB,CAAC,CAAA;AAEF,sGAAsG;AACtG,uGAAuG;AACvG,+BAA+B;AAC/B,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAU,EAAE;IACpD,MAAM,KAAK,GAAuB,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,SAAS,GAAW,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,OAAO,SAAS,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACpF,CAAC,CAAA;AAED,uGAAuG;AACvG,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE;AAC9C,iGAAiG;AACjG,sFAAsF;AACtF,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,SAAiB,EAAU,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAsC,EAAU,EAAE;IACrF,MAAM,MAAM,GAAW;QACrB,mGAAmG;QACnG,2EAA2E;QAC3E,UAAU;QACV,mBAAmB;QACnB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,MAAM,MAAM,GAAsB,UAAU,CAAC,GAAG,CAAC,CAAC,SAA0B,EAAU,EAAE,CACtF;QACE,gBAAgB;QAChB,kBAAkB,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG;QACpD,cAAc,aAAa,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK;QAChE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAA;IACD,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvC,CAAC,CAAA"}

package/dist/settings-layering.d.ts

@@ -0,0 +1,45 @@
+import { type DeclaredExclusion, type Settings } from './settings.js';
+/**
+ * Fold a member's raw settings block onto the repository's.
+ * @param base the repository's raw block.
+ * @param overlay the member's raw block.
+ * @returns one raw block, still undefaulted.
+ */
+export declare const layerSettingBlocks: (base: Record<string, unknown>, overlay: Record<string, unknown>) => Record<string, unknown>;
+/**
+ * Move a member's exclusion into the repository's path space.
+ *
+ * The gates that walk the tracked tree run once, at the repository root, while a member declares its
+ * exclusions relative to itself. `^src/generated/` written inside `apps/web` therefore matches nothing
+ * when the repository-scope gate walks past `apps/web/src/generated/`, and a generated directory a
+ * project correctly excused starts failing the typography ban.
+ *
+ * An UNANCHORED pattern is left alone, deliberately. `importMap\.js$` already matches at any depth, and
+ * prefixing it would narrow it to one member - so the rule errs toward a pattern that matches too much
+ * at repository scope rather than one that silently stops matching. Too wide is the safe direction here:
+ * a repository-scope gate that skips one extra path reports one fewer finding, while a narrowed pattern
+ * reports a project for a file it had already accounted for.
+ * @param memberPath the member's repo-relative path, `.` for the member at the root.
+ * @param entry the exclusion as the member declared it.
+ * @returns the exclusion as the repository-scope gates must read it.
+ */
+export declare const rebaseExclusion: (memberPath: string, entry: DeclaredExclusion) => DeclaredExclusion;
+/**
+ * The settings one member runs under.
+ *
+ * Effective VALUES are layered - a member inherits the repository's source roots, its typography
+ * exclusions, its floor. `declaredExclusions` is not, and that asymmetry is the point: it is the list of
+ * decisions THIS package made, and every consumer of it judges the declarer. Layering it made a member
+ * answer for the repository's declarations, so a workspace root that correctly excused its Vale detector
+ * definitions - whose content IS the character the ban detects - had every member report that exclusion
+ * as reaching nothing, because no member contains the file. One correct declaration, two gates failed,
+ * and nothing a member could edit would have fixed it.
+ *
+ * The mirror direction was already handled: `rebaseExclusion` moves a member's exclusion up into the
+ * repository's path space. This is the same seam read downward.
+ * @param repositoryBlock the raw `ploaness` block of the repository root.
+ * @param ownBlock the raw `ploaness` block of the member itself.
+ * @returns the member's settings, inheriting values and owning declarations.
+ */
+export declare const readMemberSettings: (repositoryBlock: Record<string, unknown>, ownBlock: Record<string, unknown>) => Settings;
+//# sourceMappingURL=settings-layering.d.ts.map