@ploaness/governance 1.2.0 → 1.3.0

package/dist/environment-coherence.js

@@ -1,4 +1,6 @@
-// Require environment reads, example declarations, compose interpolation, and verifying workflows to agree.
+// Require environment reads, example declarations, compose interpolation, verifying workflows, and the
+// build arguments an image declares to agree.
+import { logicalLines } from './container-images.js';
 /**
  * The module a Payload project reads `process.env` in, which is the only module ploaness exempts from
  * the ban and therefore the only one this rule can read a variable name out of.
@@ -27,6 +29,19 @@ export const ENVIRONMENT_EXAMPLE_FILES = [
     '.env.sample',
     '.env.template',
 ];
+/**
+ * The framework configuration a member may hold at its own root.
+ *
+ * It is evaluated during the image build, so a variable it reads is one the build has to be given - and
+ * it sits outside `sourceRoots`, which is why the `process.env` ban never reached it and why this rule
+ * has to. Every spelling present is read, unlike the example files above, because a project ships one
+ * and reading all of them cannot produce two answers that disagree.
+ */
+export const BUILD_CONFIGURATION_FILES = [
+    'next.config.ts',
+    'next.config.mjs',
+    'next.config.js',
+];
 // BRACKET ACCESS ONLY, and that is the rule rather than a shortcut. `process.env` is an index
 // signature, so a variable this project invented can only be read with brackets; a variable node or the
 // framework DECLARES - `NODE_ENV` above all - is a known property and is read with a dot. The two forms
@@ -41,6 +56,23 @@ const EXAMPLE_ASSIGNMENT = /^[ \t]*(?:export[ \t]+)?(?<name>[A-Za-z_]\w*)[ \t]*=
 // gate's business. The braced form alone is read: `$NAME` is legal in compose and rare in practice, and
 // telling it apart from a `$$` escape or a shell fragment inside a `command:` is guesswork.
 const COMPOSE_INTERPOLATION = /\$\{(?<name>[A-Z_]\w*)\}/gi;
+// BOTH ACCESS FORMS, and the PREFIX is what makes that sound rather than a relaxation of the rule
+// above. `NEXT_PUBLIC_` is reserved by the framework for values the project invents; no runtime declares
+// one, so a dotted read of a prefixed name cannot be naming an ambient variable the way
+// `process.env.NODE_ENV` does. It is also the ONLY form the bundler substitutes, because the
+// substitution is textual - so the dotted read is not merely admissible here, it is the read that makes
+// the value a build input at all. A name read through a plain record parameter is not matched: nothing
+// is inlined there, and the value arrives from whoever built the record.
+const INLINED_DOTTED_READ = /process\.env\.(?<name>NEXT_PUBLIC_\w+)/g;
+const INLINED_BRACKETED_READ = /process\.env\[\s*(?<quote>['"])(?<name>NEXT_PUBLIC_\w+)\k<quote>\s*\]/g;
+// A build-argument DECLARATION, with or without a default. The compose analogue above puts
+// `${NAME:-5432}` out of scope because a default SUPPLIES the value and the claim was that something
+// must supply it. This containment runs the other way - the Dockerfile is the side that must DECLARE -
+// and `ARG NAME=x` declares NAME just as `ARG NAME` does: `--build-arg NAME=...` is honoured either way
+// and the read resolves. What this rule is about is a name the file never mentions.
+const ARG_DECLARATION = /^[ \t]*ARG[ \t]+(?<names>\S.*)$/i;
+const ARGUMENT_SEPARATOR = /[ \t]+/;
+const DEFAULT_SEPARATOR = '=';
 // A name a workflow supplies: a mapping key in SCREAMING_SNAKE, or a reference to a secret, a variable,
 // or the job environment. The key form is matched at any indentation, for the reason the header states.
 const WORKFLOW_KEY = /^[ \t]*(?<name>[A-Z_][A-Z0-9_]*)[ \t]*:/gm;
@@ -73,6 +105,32 @@ export const documentedEnvironmentNames = (example) => uniqueSorted(namesMatchin
  * @returns each name once, sorted.
  */
 export const interpolatedEnvironmentNames = (compose) => uniqueSorted(namesMatching(compose, COMPOSE_INTERPOLATION));
+/**
+ * The variables a file's reads inline into the image at build time.
+ * @param source the contents of a validated environment module or a framework configuration.
+ * @returns each name once, sorted.
+ */
+export const inlinedEnvironmentNames = (source) => uniqueSorted([
+    ...namesMatching(source, INLINED_DOTTED_READ),
+    ...namesMatching(source, INLINED_BRACKETED_READ),
+]);
+const argumentNamesIn = (declaration) => declaration
+    .split(ARGUMENT_SEPARATOR)
+    .map((token) => token.split(DEFAULT_SEPARATOR)[0] ?? '')
+    .filter((name) => name.length > 0);
+/**
+ * The build arguments a Dockerfile declares, in every stage and under either spelling.
+ *
+ * Every stage, because `ARG` scope is per stage and which stage runs the build is not a fact this text
+ * can establish. Reading the file as one namespace can only ACCEPT a declaration that sits in the wrong
+ * stage; resolving stages by guessing which `RUN` is the build would REJECT correct files.
+ * @param dockerfile the Dockerfile body.
+ * @returns each name once, sorted.
+ */
+export const declaredBuildArguments = (dockerfile) => uniqueSorted(logicalLines(dockerfile).flatMap((line) => {
+    const names = ARG_DECLARATION.exec(line)?.groups?.['names'];
+    return names === undefined ? [] : argumentNamesIn(names);
+}));
 /**
  * The variables a workflow supplies, by any means and at any nesting depth.
  * @param workflow the contents of the workflow file.
@@ -88,6 +146,22 @@ export const workflowSuppliedNames = (workflow) => uniqueSorted([
  * @returns true when the workflow invokes verification or a single gate.
  */
 export const isVerifyingWorkflow = (workflow) => VERIFYING_COMMANDS.some((command) => workflow.includes(command));
+const ROOT_MEMBER = '.';
+// The member a path belongs to: the deepest one whose directory contains it, the same rule a working
+// directory is resolved by, so a nested member keeps its own image instead of inheriting its parent's.
+const ownerOf = (file, everyMemberPath) => [...everyMemberPath]
+    .filter((candidate) => candidate !== ROOT_MEMBER && file.startsWith(`${candidate}/`))
+    .toSorted((left, right) => right.length - left.length)
+    .at(0) ?? ROOT_MEMBER;
+/**
+ * The Dockerfiles that build one member: those inside its own directory, and - for the member at the
+ * repository root - those no other member owns.
+ * @param memberPath the member's repo-relative path, `.` at the repository root.
+ * @param everyMemberPath every governed member's path.
+ * @param dockerfiles every Dockerfile the repository tracks.
+ * @returns the Dockerfiles that build this member, in the order given.
+ */
+export const dockerfilesBuilding = (memberPath, everyMemberPath, dockerfiles) => dockerfiles.filter((dockerfile) => ownerOf(dockerfile.file, everyMemberPath) === memberPath);
 const undocumented = (names, documented, origin, reason) => names
     .filter((name) => !documented.has(name))
     .map((name) => ({ name, origin, reason }));
@@ -104,15 +178,42 @@ const missingFromWorkflow = (names, workflow) => {
         ].join(' '),
     }));
 };
+const missingBuildArguments = (build) => {
+    // A member that ships no image owes no build argument. One-directional, like every rule above.
+    if (build.dockerfiles.length === 0) {
+        return [];
+    }
+    const declared = new Set(build.dockerfiles.flatMap((dockerfile) => declaredBuildArguments(dockerfile.content)));
+    const files = build.dockerfiles
+        .map((dockerfile) => dockerfile.file)
+        .join(', ');
+    return uniqueSorted(build.sources.flatMap((source) => inlinedEnvironmentNames(source)))
+        .filter((name) => !declared.has(name))
+        .map((name) => ({
+        name,
+        origin: 'dockerfile',
+        reason: [
+            `inlined into the image at build time but declared by no ARG in ${files},`,
+            'so docker discards the --build-arg that supplies it and warns rather than failing:',
+            `add "ARG ${name}" to the stage that runs the build`,
+        ].join(' '),
+    }));
+};
 /**
  * Every environment variable declared in one place and absent from another it has to reach.
  *
- * Three containments, each one-directional. What the application reads must be documented. What a
+ * Four containments, each one-directional. What the application reads must be documented. What a
  * compose file interpolates must be documented, because `docker compose config` reads the example file
- * a developer copied. And what a compose file interpolates must be supplied by every workflow that
- * verifies, because a workflow has no copied file to interpolate from.
+ * a developer copied. What a compose file interpolates must be supplied by every workflow that
+ * verifies, because a workflow has no copied file to interpolate from. And what a build inlines must be
+ * declared as an `ARG`, because docker discards a `--build-arg` the Dockerfile never named and warns
+ * rather than failing - so the value is absent from the image and nothing says so.
+ *
+ * The inlined names feed the Dockerfile containment ALONE. Joining them to the example-file rule would
+ * report a member that documents its public variables in its own example file rather than the
+ * repository's, which is where they belong and where this reader does not look.
  * @param inputs the files, already read.
- * @returns the violations, sorted by name within each rule. An empty array means the four places agree.
+ * @returns the violations, sorted by name within each rule. An empty array means the five places agree.
  */
 export const findEnvironmentViolations = (inputs) => {
     const documented = new Set(inputs.example === undefined ? [] : documentedEnvironmentNames(inputs.example));
@@ -123,6 +224,7 @@ export const findEnvironmentViolations = (inputs) => {
         ...undocumented(read, documented, 'application', 'read by the validated environment module but documented in no example file'),
         ...undocumented(interpolated, documented, 'compose', 'interpolated by a compose file but documented in no example file'),
         ...verifying.flatMap((workflow) => missingFromWorkflow(interpolated, workflow)),
+        ...inputs.builds.flatMap((build) => missingBuildArguments(build)),
     ];
 };
 //# sourceMappingURL=environment-coherence.js.map

package/dist/environment-coherence.js.map

@@ -1 +1 @@
-{"version":3,"file":"environment-coherence.js","sourceRoot":"","sources":["../src/environment-coherence.ts"],"names":[],"mappings":"AAAA,4GAA4G;AA8B5G;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAW,wBAAwB,CAAA;AAE5E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,4BAA4B;IAC5B,cAAc;CACf,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,cAAc;IACd,aAAa;IACb,eAAe;CAChB,CAAA;AAED,8FAA8F;AAC9F,wGAAwG;AACxG,wGAAwG;AACxG,iGAAiG;AACjG,yEAAyE;AACzE,MAAM,cAAc,GAAW,qEAAqE,CAAA;AAEpG,sGAAsG;AACtG,0DAA0D;AAC1D,MAAM,kBAAkB,GAAW,wDAAwD,CAAA;AAE3F,uGAAuG;AACvG,mGAAmG;AACnG,wGAAwG;AACxG,4FAA4F;AAC5F,MAAM,qBAAqB,GAAW,4BAA4B,CAAA;AAElE,wGAAwG;AACxG,wGAAwG;AACxG,MAAM,YAAY,GAAW,2CAA2C,CAAA;AACxE,MAAM,0BAA0B,GAC9B,4DAA4D,CAAA;AAE9D,gGAAgG;AAChG,wGAAwG;AACxG,6FAA6F;AAC7F,MAAM,kBAAkB,GAAsB,CAAC,iBAAiB,EAAE,eAAe,EAAE,YAAY,CAAC,CAAA;AAEhG,8FAA8F;AAC9F,qGAAqG;AACrG,qGAAqG;AACrG,sEAAsE;AACtE,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,OAAe,EAAqB,EAAE,CAC3E,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAsB,EAAU,EAAE,CACnE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAC/B,CAAA;AAEH,MAAM,YAAY,GAAG,CAAC,KAAwB,EAAqB,EAAE,CACnE,CAAC,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CACvE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAC1B,CAAA;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAqB,EAAE,CACxE,YAAY,CAAC,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAAe,EAAqB,EAAE,CAC/E,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAA;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,OAAe,EAAqB,EAAE,CACjF,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAA;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAqB,EAAE,CAC3E,YAAY,CAAC;IACX,GAAG,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC;IACxC,GAAG,aAAa,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CACvD,CAAC,CAAA;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC/D,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;AAEnF,MAAM,YAAY,GAAG,CACnB,KAAwB,EACxB,UAA+B,EAC/B,MAAyB,EACzB,MAAc,EACmB,EAAE,CACnC,KAAK;KACF,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;KACxD,GAAG,CAAC,CAAC,IAAY,EAAwB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;AAE5E,MAAM,mBAAmB,GAAG,CAC1B,KAAwB,EACxB,QAAsB,EACW,EAAE;IACnC,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;IACtF,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACtD,GAAG,CACF,CAAC,IAAY,EAAwB,EAAE,CAAC,CAAC;QACvC,IAAI;QACJ,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE;YACN,oDAAoD;YACpD,GAAG,QAAQ,CAAC,IAAI,uCAAuC;SACxD,CAAC,IAAI,CAAC,GAAG,CAAC;KACZ,CAAC,CACH,CAAA;AACL,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,MAAyB,EACQ,EAAE;IACnC,MAAM,UAAU,GAAwB,IAAI,GAAG,CAC7C,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAC/E,CAAA;IACD,MAAM,IAAI,GAAsB,YAAY,CAC1C,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,MAAc,EAAqB,EAAE,CACtE,oBAAoB,CAAC,MAAM,CAAC,CAC7B,CACF,CAAA;IACD,MAAM,YAAY,GAAsB,YAAY,CAClD,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,MAAc,EAAqB,EAAE,CAClE,4BAA4B,CAAC,MAAM,CAAC,CACrC,CACF,CAAA;IACD,MAAM,SAAS,GAA4B,MAAM,CAAC,SAAS,CAAC,MAAM,CAChE,CAAC,QAAsB,EAAW,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC3E,CAAA;IACD,OAAO;QACL,GAAG,YAAY,CACb,IAAI,EACJ,UAAU,EACV,aAAa,EACb,4EAA4E,CAC7E;QACD,GAAG,YAAY,CACb,YAAY,EACZ,UAAU,EACV,SAAS,EACT,kEAAkE,CACnE;QACD,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,QAAsB,EAAmC,EAAE,CAC/E,mBAAmB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAC5C;KACF,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"environment-coherence.js","sourceRoot":"","sources":["../src/environment-coherence.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,8CAA8C;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AA8CpD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAW,wBAAwB,CAAA;AAE5E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,4BAA4B;IAC5B,cAAc;CACf,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,cAAc;IACd,aAAa;IACb,eAAe;CAChB,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;CACjB,CAAA;AAED,8FAA8F;AAC9F,wGAAwG;AACxG,wGAAwG;AACxG,iGAAiG;AACjG,yEAAyE;AACzE,MAAM,cAAc,GAAW,qEAAqE,CAAA;AAEpG,sGAAsG;AACtG,0DAA0D;AAC1D,MAAM,kBAAkB,GAAW,wDAAwD,CAAA;AAE3F,uGAAuG;AACvG,mGAAmG;AACnG,wGAAwG;AACxG,4FAA4F;AAC5F,MAAM,qBAAqB,GAAW,4BAA4B,CAAA;AAElE,kGAAkG;AAClG,yGAAyG;AACzG,wFAAwF;AACxF,6FAA6F;AAC7F,wGAAwG;AACxG,uGAAuG;AACvG,yEAAyE;AACzE,MAAM,mBAAmB,GAAW,yCAAyC,CAAA;AAC7E,MAAM,sBAAsB,GAC1B,wEAAwE,CAAA;AAE1E,2FAA2F;AAC3F,qGAAqG;AACrG,uGAAuG;AACvG,wGAAwG;AACxG,oFAAoF;AACpF,MAAM,eAAe,GAAW,kCAAkC,CAAA;AAClE,MAAM,kBAAkB,GAAW,QAAQ,CAAA;AAC3C,MAAM,iBAAiB,GAAW,GAAG,CAAA;AAErC,wGAAwG;AACxG,wGAAwG;AACxG,MAAM,YAAY,GAAW,2CAA2C,CAAA;AACxE,MAAM,0BAA0B,GAC9B,4DAA4D,CAAA;AAE9D,gGAAgG;AAChG,wGAAwG;AACxG,6FAA6F;AAC7F,MAAM,kBAAkB,GAAsB,CAAC,iBAAiB,EAAE,eAAe,EAAE,YAAY,CAAC,CAAA;AAEhG,8FAA8F;AAC9F,qGAAqG;AACrG,qGAAqG;AACrG,sEAAsE;AACtE,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,OAAe,EAAqB,EAAE,CAC3E,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAsB,EAAU,EAAE,CACnE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAC/B,CAAA;AAEH,MAAM,YAAY,GAAG,CAAC,KAAwB,EAAqB,EAAE,CACnE,CAAC,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CACvE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAC1B,CAAA;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAqB,EAAE,CACxE,YAAY,CAAC,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAAe,EAAqB,EAAE,CAC/E,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAA;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,OAAe,EAAqB,EAAE,CACjF,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAA;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAqB,EAAE,CAC3E,YAAY,CAAC;IACX,GAAG,aAAa,CAAC,MAAM,EAAE,mBAAmB,CAAC;IAC7C,GAAG,aAAa,CAAC,MAAM,EAAE,sBAAsB,CAAC;CACjD,CAAC,CAAA;AAEJ,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAqB,EAAE,CACjE,WAAW;KACR,KAAK,CAAC,kBAAkB,CAAC;KACzB,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACvE,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAEvD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,UAAkB,EAAqB,EAAE,CAC9E,YAAY,CACV,YAAY,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE;IACnE,MAAM,KAAK,GAAuB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,CAAA;IAC/E,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;AAC1D,CAAC,CAAC,CACH,CAAA;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAqB,EAAE,CAC3E,YAAY,CAAC;IACX,GAAG,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC;IACxC,GAAG,aAAa,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CACvD,CAAC,CAAA;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC/D,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;AAEnF,MAAM,WAAW,GAAW,GAAG,CAAA;AAE/B,qGAAqG;AACrG,uGAAuG;AACvG,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,eAAkC,EAAU,EAAE,CAC3E,CAAC,GAAG,eAAe,CAAC;KACjB,MAAM,CACL,CAAC,SAAiB,EAAW,EAAE,CAAC,SAAS,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,CAC9F;KACA,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;KAC7E,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,CAAA;AAEzB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,UAAkB,EAClB,eAAkC,EAClC,WAAwC,EACX,EAAE,CAC/B,WAAW,CAAC,MAAM,CAChB,CAAC,UAA4B,EAAW,EAAE,CACxC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,eAAe,CAAC,KAAK,UAAU,CAC3D,CAAA;AAEH,MAAM,YAAY,GAAG,CACnB,KAAwB,EACxB,UAA+B,EAC/B,MAAyB,EACzB,MAAc,EACmB,EAAE,CACnC,KAAK;KACF,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;KACxD,GAAG,CAAC,CAAC,IAAY,EAAwB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;AAE5E,MAAM,mBAAmB,GAAG,CAC1B,KAAwB,EACxB,QAAsB,EACW,EAAE;IACnC,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;IACtF,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACtD,GAAG,CACF,CAAC,IAAY,EAAwB,EAAE,CAAC,CAAC;QACvC,IAAI;QACJ,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE;YACN,oDAAoD;YACpD,GAAG,QAAQ,CAAC,IAAI,uCAAuC;SACxD,CAAC,IAAI,CAAC,GAAG,CAAC;KACZ,CAAC,CACH,CAAA;AACL,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAAC,KAAiB,EAAmC,EAAE;IACnF,+FAA+F;IAC/F,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAC3C,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAA4B,EAAqB,EAAE,CAC5E,sBAAsB,CAAC,UAAU,CAAC,OAAO,CAAC,CAC3C,CACF,CAAA;IACD,MAAM,KAAK,GAAW,KAAK,CAAC,WAAW;SACpC,GAAG,CAAC,CAAC,UAA4B,EAAU,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;SAC9D,IAAI,CAAC,IAAI,CAAC,CAAA;IACb,OAAO,YAAY,CACjB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAc,EAAqB,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAC9F;SACE,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACtD,GAAG,CACF,CAAC,IAAY,EAAwB,EAAE,CAAC,CAAC;QACvC,IAAI;QACJ,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE;YACN,kEAAkE,KAAK,GAAG;YAC1E,oFAAoF;YACpF,YAAY,IAAI,oCAAoC;SACrD,CAAC,IAAI,CAAC,GAAG,CAAC;KACZ,CAAC,CACH,CAAA;AACL,CAAC,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,MAAyB,EACQ,EAAE;IACnC,MAAM,UAAU,GAAwB,IAAI,GAAG,CAC7C,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAC/E,CAAA;IACD,MAAM,IAAI,GAAsB,YAAY,CAC1C,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,MAAc,EAAqB,EAAE,CACtE,oBAAoB,CAAC,MAAM,CAAC,CAC7B,CACF,CAAA;IACD,MAAM,YAAY,GAAsB,YAAY,CAClD,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,MAAc,EAAqB,EAAE,CAClE,4BAA4B,CAAC,MAAM,CAAC,CACrC,CACF,CAAA;IACD,MAAM,SAAS,GAA4B,MAAM,CAAC,SAAS,CAAC,MAAM,CAChE,CAAC,QAAsB,EAAW,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC3E,CAAA;IACD,OAAO;QACL,GAAG,YAAY,CACb,IAAI,EACJ,UAAU,EACV,aAAa,EACb,4EAA4E,CAC7E;QACD,GAAG,YAAY,CACb,YAAY,EACZ,UAAU,EACV,SAAS,EACT,kEAAkE,CACnE;QACD,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,QAAsB,EAAmC,EAAE,CAC/E,mBAAmB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAC5C;QACD,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAiB,EAAmC,EAAE,CAC9E,qBAAqB,CAAC,KAAK,CAAC,CAC7B;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/index.d.ts

@@ -11,6 +11,8 @@ export * from './blocklist.js';
 export * from './blocklist-entries.js';
 export * from './build-diagnosis.js';
 export * from './bundle-budget.js';
+export * from './checkov-check.js';
+export * from './checkov-policy.js';
 export * from './commit-message.js';
 export * from './config-references.js';
 export * from './container-failure.js';
@@ -42,6 +44,8 @@ export * from './oxlint-scope.js';
 export * from './oxlint-suppressions.js';
 export * from './paired-assets.js';
 export * from './payload-access.js';
+export * from './payload-bootstrap.js';
+export * from './payload-database.js';
 export * from './payload-defaults.js';
 export * from './payload-policy.js';
 export * from './payload-source.js';
@@ -55,10 +59,14 @@ export * from './run-policy.js';
 export * from './secret-policy.js';
 export * from './settings.js';
 export * from './settings-layering.js';
+export * from './shell-files.js';
 export * from './skill-manifest.js';
 export * from './source-text.js';
 export * from './suppression-ceiling.js';
 export * from './tailwind-tokens.js';
+export * from './terraform-files.js';
+export * from './terraform-policy.js';
+export * from './terraform-providers.js';
 export * from './text-escapes.js';
 export * from './toolchain-pins.js';
 export * from './version-policy.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}

package/dist/index.js

@@ -15,6 +15,8 @@ export * from './blocklist.js';
 export * from './blocklist-entries.js';
 export * from './build-diagnosis.js';
 export * from './bundle-budget.js';
+export * from './checkov-check.js';
+export * from './checkov-policy.js';
 export * from './commit-message.js';
 export * from './config-references.js';
 export * from './container-failure.js';
@@ -46,6 +48,8 @@ export * from './oxlint-scope.js';
 export * from './oxlint-suppressions.js';
 export * from './paired-assets.js';
 export * from './payload-access.js';
+export * from './payload-bootstrap.js';
+export * from './payload-database.js';
 export * from './payload-defaults.js';
 export * from './payload-policy.js';
 export * from './payload-source.js';
@@ -59,10 +63,14 @@ export * from './run-policy.js';
 export * from './secret-policy.js';
 export * from './settings.js';
 export * from './settings-layering.js';
+export * from './shell-files.js';
 export * from './skill-manifest.js';
 export * from './source-text.js';
 export * from './suppression-ceiling.js';
 export * from './tailwind-tokens.js';
+export * from './terraform-files.js';
+export * from './terraform-policy.js';
+export * from './terraform-providers.js';
 export * from './text-escapes.js';
 export * from './toolchain-pins.js';
 export * from './version-policy.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,0DAA0D;AAE1D,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,0DAA0D;AAE1D,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}

package/dist/payload-bootstrap.d.ts

@@ -0,0 +1,52 @@
+import type { SpecSource } from './axe-coverage.js';
+import type { LocatedViolation } from './relationship-cleanup.js';
+/**
+ * The Local API operations that change stored state.
+ *
+ * Derived from the one catalogue rather than written out again: a second list is a second thing to keep
+ * in step, and the two would disagree the first time Payload gained an operation. A read at boot is
+ * legitimate and deliberately absent from this set.
+ */
+export declare const LOCAL_API_MUTATIONS: readonly string[];
+/** The body of a configuration's boot hook, and the line its configuration begins on. */
+export interface BootstrapHook {
+    readonly body: string;
+    readonly line: number;
+}
+/**
+ * The boot hook every root configuration in a source declares.
+ * @param code the file's text, with comments already stripped.
+ * @returns one entry per configuration that declares `onInit` with a body.
+ */
+export declare const bootstrapHooksIn: (code: string) => readonly BootstrapHook[];
+/**
+ * The module specifier a name is imported from.
+ * @param code the importing file's text.
+ * @param name the imported binding to find.
+ * @returns the specifier, or undefined when the file imports no such name.
+ */
+export declare const moduleOfImport: (code: string, name: string) => string | undefined;
+/**
+ * The repository-relative paths a specifier could name, in the order a resolver would try them.
+ * @param specifier the module specifier as written.
+ * @param fromPath the member-relative path of the importing file.
+ * @returns the candidate paths, empty when the specifier names a package rather than project source.
+ */
+export declare const candidatePathsFor: (specifier: string, fromPath: string) => readonly string[];
+/**
+ * The body of a named export.
+ * @param source the module's text, with comments already stripped.
+ * @param name the exported binding to read.
+ * @returns the body, or undefined when the module exports no such binding with one.
+ */
+export declare const exportedBodyIn: (source: string, name: string) => string | undefined;
+/**
+ * Report every Local API write a boot hook performs, or reaches in one call.
+ *
+ * Reported against the configuration that schedules the write rather than the module that performs it:
+ * the module may be a legitimate seed, and what makes it a defect is being wired into `onInit`.
+ * @param files every source file of the member, as read.
+ * @returns one violation per write, located on the configuration that declares the hook.
+ */
+export declare const findBootstrapWrites: (files: readonly SpecSource[]) => readonly LocatedViolation[];
+//# sourceMappingURL=payload-bootstrap.d.ts.map

package/dist/payload-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-bootstrap.d.ts","sourceRoot":"","sources":["../src/payload-bootstrap.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAInD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAajE;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAEhD,CAAA;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAaD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,SAAS,aAAa,EAKlE,CAAA;AAkDJ;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,MAAM,GAAG,SAI3D,CAAA;AAkCV;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,KAAG,SAAS,MAAM,EAQtF,CAAA;AAgBD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,EAAE,MAAM,MAAM,KAAG,MAAM,GAAG,SAGtE,CAAA;AAiDD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,SAAS,UAAU,EAAE,KAAG,SAAS,gBAAgB,EAexF,CAAA"}

package/dist/payload-bootstrap.js

@@ -0,0 +1,195 @@
+import { rootConfigsIn } from './payload-database.js';
+import { LOCAL_API_CALLS, PAYLOAD_RECEIVER } from './payload-policy.js';
+import { depthOneValue } from './payload-source.js';
+import { balancedArguments, NOT_FOUND, occurrences, stripComments } from './source-text.js';
+/** The operations that change stored state, named as the catalogue spells them. */
+const MUTATION_NAMES = new Set([
+    'create',
+    'delete',
+    'restoreGlobalVersion',
+    'restoreVersion',
+    'update',
+    'updateGlobal',
+]);
+/**
+ * The Local API operations that change stored state.
+ *
+ * Derived from the one catalogue rather than written out again: a second list is a second thing to keep
+ * in step, and the two would disagree the first time Payload gained an operation. A read at boot is
+ * legitimate and deliberately absent from this set.
+ */
+export const LOCAL_API_MUTATIONS = LOCAL_API_CALLS.filter((call) => MUTATION_NAMES.has(call.slice(1, -1)));
+const ARROW = '=>';
+// The body a hook value opens, found after the arrow rather than at the first brace: a hook written
+// `async ({ payload }) => { ... }` destructures before it opens, and the first brace is that pattern.
+const hookBodyIn = (value) => {
+    const arrow = value.indexOf(ARROW);
+    const from = arrow === NOT_FOUND ? 0 : arrow + ARROW.length;
+    const open = value.indexOf('{', from);
+    return open === NOT_FOUND ? undefined : balancedArguments(value, open);
+};
+/**
+ * The boot hook every root configuration in a source declares.
+ * @param code the file's text, with comments already stripped.
+ * @returns one entry per configuration that declares `onInit` with a body.
+ */
+export const bootstrapHooksIn = (code) => rootConfigsIn(code).flatMap((config) => {
+    const value = depthOneValue(config.body, 'onInit');
+    const body = value === undefined ? undefined : hookBodyIn(value);
+    return body === undefined ? [] : [{ body, line: config.line }];
+});
+// A Local API mutation performed on a Payload receiver, anywhere in a body.
+//
+// Distinct operations, not occurrences: a seed that writes two globals performs `updateGlobal` twice,
+// and reporting it twice would print the same sentence twice for one repair. What the reader has to act
+// on is that the body writes at all.
+const mutationsIn = (body) => [
+    ...new Set(LOCAL_API_MUTATIONS.flatMap((call) => occurrences(body, call)
+        .filter((found) => PAYLOAD_RECEIVER.test(body.slice(0, found)))
+        .map(() => call.slice(1, -1)))),
+];
+// The names a body calls. The keywords are removed because `if (` and `while (` are indistinguishable
+// from a call by this pattern, and a keyword can never name an import.
+const CALLED_IDENTIFIER = /\b([a-z_$][\w$]*)\s*\(/gi;
+const STATEMENT_KEYWORDS = new Set([
+    'await',
+    'catch',
+    'for',
+    'function',
+    'if',
+    'return',
+    'switch',
+    'typeof',
+    'while',
+]);
+const calledNamesIn = (body) => [
+    ...new Set([...body.matchAll(CALLED_IDENTIFIER)]
+        .map((match) => match[1] ?? '')
+        .filter((name) => !STATEMENT_KEYWORDS.has(name))),
+];
+// Every quantifier here is bounded by a literal that cannot itself match, so the scan is linear: a
+// binding clause runs to the one brace that closes it, and a specifier to the one quote that ends it.
+const IMPORT_BINDING = /\bimport\s+\{([^}]+)\}\s+from\s*['"]([^'"]+)['"]/g;
+const boundNames = (clause) => clause
+    .split(',')
+    .map((binding) => binding.trim().split(/\s+/).at(-1) ?? '')
+    .filter((name) => name.length > 0);
+/**
+ * The module specifier a name is imported from.
+ * @param code the importing file's text.
+ * @param name the imported binding to find.
+ * @returns the specifier, or undefined when the file imports no such name.
+ */
+export const moduleOfImport = (code, name) => [...code.matchAll(IMPORT_BINDING)]
+    .filter((match) => boundNames(match[1] ?? '').includes(name))
+    .map((match) => match[2])
+    .at(0);
+const SOURCE_EXTENSIONS = ['.ts', '.tsx'];
+const ALIAS = '@/';
+const ALIAS_ROOT = 'src/';
+const directoryOf = (filePath) => {
+    const slash = filePath.lastIndexOf('/');
+    return slash === NOT_FOUND ? '' : filePath.slice(0, slash);
+};
+// `.` and `..` resolved without node:path, which keeps this layer free of every runtime module.
+const flattened = (segments) => segments.reduce((kept, segment) => {
+    if (segment === '' || segment === '.') {
+        return kept;
+    }
+    return segment === '..' ? kept.slice(0, -1) : [...kept, segment];
+}, []);
+// The path a specifier names before an extension is tried. A package specifier resolves to nothing,
+// which is what keeps the rule inside the member's own source.
+const resolvedBase = (specifier, fromPath) => {
+    if (specifier.startsWith(ALIAS)) {
+        return `${ALIAS_ROOT}${specifier.slice(ALIAS.length)}`;
+    }
+    return specifier.startsWith('.')
+        ? flattened([...directoryOf(fromPath).split('/'), ...specifier.split('/')]).join('/')
+        : undefined;
+};
+/**
+ * The repository-relative paths a specifier could name, in the order a resolver would try them.
+ * @param specifier the module specifier as written.
+ * @param fromPath the member-relative path of the importing file.
+ * @returns the candidate paths, empty when the specifier names a package rather than project source.
+ */
+export const candidatePathsFor = (specifier, fromPath) => {
+    const base = resolvedBase(specifier, fromPath);
+    return base === undefined
+        ? []
+        : [
+            ...SOURCE_EXTENSIONS.map((extension) => `${base}${extension}`),
+            `${base}/index.ts`,
+        ];
+};
+// The body of one named export, so a module holding an unrelated writer beside the function the hook
+// actually calls is not reported for the writer it never reached.
+const declarationOf = (name) => new RegExp(String.raw `export\s+(?:async\s+)?(?:function\s+|const\s+)${name}\b`);
+const bodyAfter = (source, at) => {
+    const open = source.indexOf('(', at);
+    const parameters = open === NOT_FOUND ? undefined : balancedArguments(source, open);
+    const from = parameters === undefined ? at : open + parameters.length + 1;
+    const brace = source.indexOf('{', from);
+    return brace === NOT_FOUND ? undefined : balancedArguments(source, brace);
+};
+/**
+ * The body of a named export.
+ * @param source the module's text, with comments already stripped.
+ * @param name the exported binding to read.
+ * @returns the body, or undefined when the module exports no such binding with one.
+ */
+export const exportedBodyIn = (source, name) => {
+    const found = declarationOf(name).exec(source);
+    return found === null ? undefined : bodyAfter(source, found.index);
+};
+const RULE = 'no-boot-time-writes';
+const REPAIR = 'move the write behind a command the project runs deliberately, such as a seed script invoked by ' +
+    'its own package script';
+const directReason = (call) => `onInit: must not write through the Local API; ${call}() here runs on every boot of every ` +
+    'container, so a restart, a new replica and a redeploy each overwrite whatever an editor last ' +
+    `saved - ${REPAIR}`;
+const reachedReason = (name, specifier, call) => `onInit: must not reach a Local API write; it calls ${name}() from "${specifier}", which runs ` +
+    `${call}() in its own body, so every boot of every container overwrites whatever an editor last ` +
+    `saved - ${REPAIR}`;
+const sourceAt = (files, paths) => files
+    .filter((file) => paths.includes(file.path))
+    .map((file) => stripComments(file.source))
+    .at(0);
+// One call out of the hook: the name has to be imported, the module has to be one of this member's own
+// files, and the export it names has to perform the write itself.
+const reachedWrites = (code, hook, file, files) => calledNamesIn(hook.body).flatMap((name) => {
+    const specifier = moduleOfImport(code, name);
+    if (specifier === undefined) {
+        return [];
+    }
+    const target = sourceAt(files, candidatePathsFor(specifier, file.path));
+    const body = target === undefined ? undefined : exportedBodyIn(target, name);
+    return body === undefined
+        ? []
+        : mutationsIn(body).map((call) => ({
+            line: hook.line,
+            rule: RULE,
+            reason: reachedReason(name, specifier, call),
+        }));
+});
+/**
+ * Report every Local API write a boot hook performs, or reaches in one call.
+ *
+ * Reported against the configuration that schedules the write rather than the module that performs it:
+ * the module may be a legitimate seed, and what makes it a defect is being wired into `onInit`.
+ * @param files every source file of the member, as read.
+ * @returns one violation per write, located on the configuration that declares the hook.
+ */
+export const findBootstrapWrites = (files) => files.flatMap((file) => {
+    const code = stripComments(file.source);
+    return bootstrapHooksIn(code).flatMap((hook) => [
+        ...mutationsIn(hook.body).map((call) => ({
+            line: hook.line,
+            rule: RULE,
+            reason: directReason(call),
+        })),
+        ...reachedWrites(code, hook, file, files),
+    ].map((violation) => ({ path: file.path, violation })));
+});
+//# sourceMappingURL=payload-bootstrap.js.map

package/dist/payload-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-bootstrap.js","sourceRoot":"","sources":["../src/payload-bootstrap.ts"],"names":[],"mappings":"AAYA,OAAO,EAAwB,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC3E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACvE,OAAO,EAAE,aAAa,EAAyB,MAAM,qBAAqB,CAAA;AAE1E,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAE3F,mFAAmF;AACnF,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,QAAQ;IACR,QAAQ;IACR,sBAAsB;IACtB,gBAAgB;IAChB,QAAQ;IACR,cAAc;CACf,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB,eAAe,CAAC,MAAM,CAC1E,CAAC,IAAY,EAAW,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CACjE,CAAA;AAQD,MAAM,KAAK,GAAW,IAAI,CAAA;AAE1B,oGAAoG;AACpG,sGAAsG;AACtG,MAAM,UAAU,GAAG,CAAC,KAAa,EAAsB,EAAE;IACvD,MAAM,KAAK,GAAW,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAW,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAA;IACnE,MAAM,IAAI,GAAW,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC7C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;AACxE,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAA4B,EAAE,CACzE,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,MAAuB,EAA4B,EAAE;IAChF,MAAM,KAAK,GAAuB,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACtE,MAAM,IAAI,GAAuB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACpF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;AAChE,CAAC,CAAC,CAAA;AAEJ,4EAA4E;AAC5E,EAAE;AACF,sGAAsG;AACtG,wGAAwG;AACxG,qCAAqC;AACrC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAqB,EAAE,CAAC;IACvD,GAAG,IAAI,GAAG,CACR,mBAAmB,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE,CAC9D,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;SACpB,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;SAC/E,GAAG,CAAC,GAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CACxC,CACF;CACF,CAAA;AAED,sGAAsG;AACtG,uEAAuE;AACvE,MAAM,iBAAiB,GAAW,0BAA0B,CAAA;AAC5D,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,OAAO;IACP,OAAO;IACP,KAAK;IACL,UAAU;IACV,IAAI;IACJ,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;CACR,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,CAAC,IAAY,EAAqB,EAAE,CAAC;IACzD,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,KAAsB,EAAU,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACvD,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CACpE;CACF,CAAA;AAED,mGAAmG;AACnG,sGAAsG;AACtG,MAAM,cAAc,GAAW,mDAAmD,CAAA;AAElF,MAAM,UAAU,GAAG,CAAC,MAAc,EAAqB,EAAE,CACvD,MAAM;KACH,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KAC1E,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,IAAY,EAAsB,EAAE,CAC/E,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;KAC/B,MAAM,CAAC,CAAC,KAAsB,EAAW,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;KACtF,GAAG,CAAC,CAAC,KAAsB,EAAsB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KAC7D,EAAE,CAAC,CAAC,CAAC,CAAA;AAEV,MAAM,iBAAiB,GAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAC5D,MAAM,KAAK,GAAW,IAAI,CAAA;AAC1B,MAAM,UAAU,GAAW,MAAM,CAAA;AAEjC,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAU,EAAE;IAC/C,MAAM,KAAK,GAAW,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAC/C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;AAC5D,CAAC,CAAA;AAED,gGAAgG;AAChG,MAAM,SAAS,GAAG,CAAC,QAA2B,EAAqB,EAAE,CACnE,QAAQ,CAAC,MAAM,CACb,CAAC,IAAuB,EAAE,OAAe,EAAqB,EAAE;IAC9D,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;AAClE,CAAC,EACD,EAAE,CACH,CAAA;AAEH,oGAAoG;AACpG,+DAA+D;AAC/D,MAAM,YAAY,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAsB,EAAE;IAC/E,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAA;IACxD,CAAC;IACD,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAC9B,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACrF,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAqB,EAAE;IAC1F,MAAM,IAAI,GAAuB,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAClE,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAiB,EAAU,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC;YAC9E,GAAG,IAAI,WAAW;SACnB,CAAA;AACP,CAAC,CAAA;AAED,qGAAqG;AACrG,kEAAkE;AAClE,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,iDAAiD,IAAI,IAAI,CAAC,CAAA;AAEjF,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAU,EAAsB,EAAE;IACnE,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC5C,MAAM,UAAU,GACd,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAClE,MAAM,IAAI,GAAW,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;IACjF,MAAM,KAAK,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC/C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AAC3E,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,IAAY,EAAsB,EAAE;IACjF,MAAM,KAAK,GAA2B,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;AACpE,CAAC,CAAA;AAED,MAAM,IAAI,GAAW,qBAAqB,CAAA;AAC1C,MAAM,MAAM,GACV,kGAAkG;IAClG,wBAAwB,CAAA;AAE1B,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAC5C,iDAAiD,IAAI,sCAAsC;IAC3F,+FAA+F;IAC/F,WAAW,MAAM,EAAE,CAAA;AAErB,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAE,IAAY,EAAU,EAAE,CAC9E,sDAAsD,IAAI,YAAY,SAAS,gBAAgB;IAC/F,GAAG,IAAI,0FAA0F;IACjG,WAAW,MAAM,EAAE,CAAA;AAErB,MAAM,QAAQ,GAAG,CAAC,KAA4B,EAAE,KAAwB,EAAsB,EAAE,CAC9F,KAAK;KACF,MAAM,CAAC,CAAC,IAAgB,EAAW,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAChE,GAAG,CAAC,CAAC,IAAgB,EAAU,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;KAC7D,EAAE,CAAC,CAAC,CAAC,CAAA;AAEV,uGAAuG;AACvG,kEAAkE;AAClE,MAAM,aAAa,GAAG,CACpB,IAAY,EACZ,IAAmB,EACnB,IAAgB,EAChB,KAA4B,EACC,EAAE,CAC/B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAA+B,EAAE;IAC7E,MAAM,SAAS,GAAuB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAChE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,MAAM,GAAuB,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3F,MAAM,IAAI,GAAuB,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAChG,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CACnB,CAAC,IAAY,EAAoB,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;SAC7C,CAAC,CACH,CAAA;AACP,CAAC,CAAC,CAAA;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAA4B,EAA+B,EAAE,CAC/F,KAAK,CAAC,OAAO,CAAC,CAAC,IAAgB,EAA+B,EAAE;IAC9D,MAAM,IAAI,GAAW,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC/C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAmB,EAA+B,EAAE,CACzF;QACE,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAC3B,CAAC,IAAY,EAAoB,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;SAC3B,CAAC,CACH;QACD,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC;KAC1C,CAAC,GAAG,CAAC,CAAC,SAA2B,EAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAC3F,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/payload-database.d.ts

@@ -0,0 +1,80 @@
+import { type PayloadViolation } from './payload-source.js';
+/** One `buildConfig({ ... })` literal: its brace-wrapped body, and the line the call begins on. */
+export interface FoundRootConfig {
+    readonly body: string;
+    readonly line: number;
+}
+/**
+ * Every root configuration literal the source declares.
+ *
+ * The collection and global readers key on a type marker, which the root configuration does not carry:
+ * it is an argument to a call rather than an annotated declaration. So this reads the call instead.
+ * @param code the file's text, with comments already stripped.
+ * @returns one entry per `buildConfig` call whose argument is an object literal.
+ */
+export declare const rootConfigsIn: (code: string) => readonly FoundRootConfig[];
+/**
+ * The database adapters whose schema Payload can apply by pushing it.
+ *
+ * Only the adapter whose behaviour is established belongs here. Naming one that does not carry the
+ * option would report a project for failing to disable something it never had, and an adapter left out
+ * is merely unreported - the safe direction of the two.
+ */
+export declare const PUSHING_ADAPTERS: readonly string[];
+/** The rule name a schema-push finding carries. */
+export declare const SCHEMA_PUSH_RULE: string;
+/**
+ * Report a root configuration whose database adapter does not disable schema push.
+ * @param code the file's text, with comments already stripped.
+ * @returns one violation per configuration that pushes, declared or by omission.
+ */
+export declare const findUnreviewedSchemaPush: (code: string) => readonly PayloadViolation[];
+/**
+ * Whether a source declares a database adapter whose schema is applied by push.
+ * @param code the file's text, with comments already stripped.
+ * @returns true when at least one root configuration names such an adapter.
+ */
+export declare const declaresPushingAdapter: (code: string) => boolean;
+/**
+ * The migration directory a configuration names, when it names one.
+ * @param code the file's text, with comments already stripped.
+ * @returns the declared directory, or undefined when the adapter leaves it to Payload's default.
+ */
+export declare const declaredMigrationDirectoryIn: (code: string) => string | undefined;
+/** The directories Payload looks in, in the order its own resolver tries them. */
+export declare const MIGRATION_DIRECTORY_CANDIDATES: readonly string[];
+/**
+ * Whether a file name is one Payload reads as a migration.
+ *
+ * Taken from Payload's own reader rather than invented here: a `.ts` or `.js` file that is not the
+ * barrel. An empty directory, or one holding only a barrel, records no schema - and that is exactly the
+ * distinction a project would otherwise satisfy the rule with.
+ * @param name the file's base name.
+ * @returns true when Payload would read it as a migration.
+ */
+export declare const isMigrationFile: (name: string) => boolean;
+/**
+ * The directories to read for a member, the declared one first.
+ * @param declared the directory the configuration names, when it names one.
+ * @returns the candidate paths, relative to the member root.
+ */
+export declare const migrationDirectoriesFor: (declared: string | undefined) => readonly string[];
+/** One candidate directory as the gate found it: its path, and the entries it holds. */
+export interface MigrationDirectory {
+    readonly path: string;
+    readonly names: readonly string[];
+}
+/** What the gate read about where a member's schema would come from. */
+export interface MigrationEvidence {
+    readonly declaresPushingAdapter: boolean;
+    readonly directories: readonly MigrationDirectory[];
+}
+/** The rule name a missing-migration finding carries. */
+export declare const RECORDED_MIGRATIONS_RULE: string;
+/**
+ * Report a member that records no migration for the schema it expects.
+ * @param evidence the adapter it declares, and the candidate directories as they were read.
+ * @returns one finding when the member pushes and records nothing, or none.
+ */
+export declare const findMissingMigrations: (evidence: MigrationEvidence) => readonly string[];
+//# sourceMappingURL=payload-database.d.ts.map

package/dist/payload-database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-database.d.ts","sourceRoot":"","sources":["../src/payload-database.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAG1E,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,SAAS,eAAe,EASjE,CAAA;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAwB,CAAA;AAiCtE,mDAAmD;AACnD,eAAO,MAAM,gBAAgB,EAAE,MAAoC,CAAA;AAuBnE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,MAAM,KAAG,SAAS,gBAAgB,EAgB7E,CAAA;AAEJ;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,MAAM,MAAM,KAAG,OAGnD,CAAA;AAEH;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,GAAI,MAAM,MAAM,KAAG,MAAM,GAAG,SAMkB,CAAA;AAEvF,kFAAkF;AAClF,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAI3D,CAAA;AAKD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,OAE3B,CAAA;AAEpB;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,MAAM,GAAG,SAAS,KAAG,SAAS,MAAM,EAGnC,CAAA;AAEnD,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAA;IACxC,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAA;CACpD;AAED,yDAAyD;AACzD,eAAO,MAAM,wBAAwB,EAAE,MAAsC,CAAA;AAQ7E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,UAAU,iBAAiB,KAAG,SAAS,MAAM,EASlF,CAAA"}