@promptci/core 0.2.2 → 0.4.0

package/dist/index.d.ts

@@ -6,12 +6,13 @@ export { detectProjectType, detectProjectTypeFromContent } from './project-type.
 export { detectDuplicates, detectDuplicateHeadings, normalizeSection } from './duplicates.js';
 export { detectConflicts, detectVersionConflicts, detectCompetingTechConflicts } from './conflicts.js';
 export { detectDeadReferences } from './dead-references.js';
-export { detectAgentPractices } from './agent-practices.js';
+export { detectAgentPractices, MISSING_PRACTICES_ISSUE_ID } from './agent-practices.js';
 export { parseSuppressions, buildValidationIssues, applySuppressions } from './suppression.js';
 export type { SuppressionAnnotation } from './suppression.js';
-export { computeHealthScore, selectTopFixes } from './health-score.js';
+export { computeHealthScore, selectTopFixes, isScored, UNSCORED_TAG } from './health-score.js';
 export { generateMarkdownReport, generateJsonReport, writeReport, readHistoryIndex, archiveExistingReport, historyIndexPath, scoreLabel } from './report.js';
 export type { WriteReportOptions, HistoryEntry } from './report.js';
+export { generateSarifReport } from './sarif.js';
 export { detectManifestConsistency } from './manifest-consistency.js';
 export { detectDependencyStaleness } from './dependency-staleness.js';
 export type { ManifestData } from './manifest-consistency.js';
@@ -38,10 +39,14 @@ export type { Frontmatter, FrontmatterValue, AiConfigFiles } from './ai-config.j
 export { analyzeContext } from './context-analysis.js';
 export type { ContextAnalysis } from './context-analysis.js';
 export { scan } from './scan.js';
+export { ADDRESSABLE_CATEGORIES, estimateTokens, annotateIssueTokens, computeAddressableTokens } from './token-estimates.js';
 export { computeFingerprint, createBaseline, filterNewIssues, assertValidBaseline } from './baseline.js';
 export { applyFixRecipe, resolveSafePath, isRepairable } from './fix-engine.js';
+export { closestUniqueMatch, isMechanicalRename, damerauLevenshtein, CLOSE_MATCH_MAX_DISTANCE, CLOSE_MATCH_MIN_LENGTH, MECHANICAL_TWO_EDIT_MIN_LENGTH, MECHANICAL_SEGMENT_MIN_LENGTH, } from './close-match.js';
 export type { FileChange } from './fix-engine.js';
 export { isWithinRoot, resolveWithinRoot, realPathWithinRoot, resolveReadableWithinRoot, writeTargetWithinRoot } from './path-containment.js';
+export { normalizeKnownPath } from './known-paths.js';
+export type { KnownPaths } from './known-paths.js';
 export { optimizeContext } from './context-optimizer.js';
 export type { OptimizeOptions, OptimizeResult } from './context-optimizer.js';
 export { TARGET_MODELS, MODEL_BUDGETS_REVIEW_BY, resolveTargetModel, modelBudget, budgetForTargetModel, } from './model-budgets.js';
@@ -49,4 +54,7 @@ export type { TargetModel, ModelBudget } from './model-budgets.js';
 export { loadCustomRules, parseCustomRules, runCustomRules, CustomRulesError, CUSTOM_RULE_TYPES, CUSTOM_RULES_FILE, } from './custom-rules.js';
 export type { CustomRule, CustomRuleType } from './custom-rules.js';
 export { PROMPTCI_GITIGNORE_LINES, PROMPTCI_GITIGNORE_BLOCK, renderPromptCiGitignore, } from './promptci-gitignore.js';
+export { selectScanPaths } from './discovery.js';
+export type { ScanPathEntry, SelectScanPathsOptions, SelectScanPathsResult } from './discovery.js';
+export * from './provenance/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9E,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC7J,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvH,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3H,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChF,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9I,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGpE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9E,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC7J,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvH,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3H,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAC7H,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAQ9I,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGpE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,aAAa,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAGnG,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -5,10 +5,11 @@ export { detectProjectType, detectProjectTypeFromContent } from './project-type.
 export { detectDuplicates, detectDuplicateHeadings, normalizeSection } from './duplicates.js';
 export { detectConflicts, detectVersionConflicts, detectCompetingTechConflicts } from './conflicts.js';
 export { detectDeadReferences } from './dead-references.js';
-export { detectAgentPractices } from './agent-practices.js';
+export { detectAgentPractices, MISSING_PRACTICES_ISSUE_ID } from './agent-practices.js';
 export { parseSuppressions, buildValidationIssues, applySuppressions } from './suppression.js';
-export { computeHealthScore, selectTopFixes } from './health-score.js';
+export { computeHealthScore, selectTopFixes, isScored, UNSCORED_TAG } from './health-score.js';
 export { generateMarkdownReport, generateJsonReport, writeReport, readHistoryIndex, archiveExistingReport, historyIndexPath, scoreLabel } from './report.js';
+export { generateSarifReport } from './sarif.js';
 export { detectManifestConsistency } from './manifest-consistency.js';
 export { detectDependencyStaleness } from './dependency-staleness.js';
 export { buildRepoContext, parsePackageJsonFacts } from './repo-context.js';
@@ -28,11 +29,24 @@ export { detectWithinSectionDedup } from './within-section-dedup.js';
 export { parseFrontmatter, discoverAiConfigFiles, emptyAiConfigFiles } from './ai-config.js';
 export { analyzeContext } from './context-analysis.js';
 export { scan } from './scan.js';
+export { ADDRESSABLE_CATEGORIES, estimateTokens, annotateIssueTokens, computeAddressableTokens } from './token-estimates.js';
 export { computeFingerprint, createBaseline, filterNewIssues, assertValidBaseline } from './baseline.js';
 export { applyFixRecipe, resolveSafePath, isRepairable } from './fix-engine.js';
+export { closestUniqueMatch, isMechanicalRename, damerauLevenshtein, CLOSE_MATCH_MAX_DISTANCE, CLOSE_MATCH_MIN_LENGTH, MECHANICAL_TWO_EDIT_MIN_LENGTH, MECHANICAL_SEGMENT_MIN_LENGTH, } from './close-match.js';
 export { isWithinRoot, resolveWithinRoot, realPathWithinRoot, resolveReadableWithinRoot, writeTargetWithinRoot } from './path-containment.js';
+// pcic-csf: a consumer needs only to BUILD a `knownPaths` list and hand it to
+// `scan()` — `KnownPaths` names its shape and `normalizeKnownPath` is the same
+// normalization the scan applies, so a caller can canonicalize and de-duplicate
+// its own list first. `RepoTree`, `PathInventory` and their types stay internal:
+// they are how the scan answers existence questions, not API anyone outside
+// calls, and exporting them would freeze that shape. Tests import them from
+// `../src/...` directly.
+export { normalizeKnownPath } from './known-paths.js';
 export { optimizeContext } from './context-optimizer.js';
 export { TARGET_MODELS, MODEL_BUDGETS_REVIEW_BY, resolveTargetModel, modelBudget, budgetForTargetModel, } from './model-budgets.js';
 export { loadCustomRules, parseCustomRules, runCustomRules, CustomRulesError, CUSTOM_RULE_TYPES, CUSTOM_RULES_FILE, } from './custom-rules.js';
 export { PROMPTCI_GITIGNORE_LINES, PROMPTCI_GITIGNORE_BLOCK, renderPromptCiGitignore, } from './promptci-gitignore.js';
+export { selectScanPaths } from './discovery.js';
+// pcic-kvv3.1: provenance of every check family (kind, claim, sources, appliesTo, lastVerified).
+export * from './provenance/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9E,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7J,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAG5E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE3H,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE7F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEhF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9I,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9E,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7J,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAG5E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE3H,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE7F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAC7H,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9I,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,4EAA4E;AAC5E,4EAA4E;AAC5E,yBAAyB;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGjD,iGAAiG;AACjG,cAAc,uBAAuB,CAAC"}

package/dist/known-paths.d.ts

@@ -0,0 +1,82 @@
+/**
+ * pcic-csf: a caller-supplied inventory of the paths a repository holds, used
+ * instead of (or alongside) the filesystem for every existence check a scan
+ * makes.
+ *
+ * A hosted scan does not have the repository on disk. It fetches the
+ * instruction files into a temp directory and leaves everything else
+ * unfetched, so every path a detector checks reads as missing and the scan
+ * reports references, commands and config targets as broken when they are
+ * merely absent from the temp dir. Naming the repository's real file list up
+ * front — `ScanInput.knownPaths`, with `knownPathsComplete` saying whether the
+ * list is the whole repository — makes those checks answer about the
+ * repository rather than about what happened to be downloaded.
+ *
+ * This module is pure: it holds no filesystem access and no I/O of any kind.
+ * {@link RepoTree} consults it first and falls back to the filesystem only for
+ * paths the inventory does not cover, and only while `knownPathsComplete` is
+ * false.
+ */
+/**
+ * Repo-relative POSIX paths of the files a repository holds. A `Set` is read
+ * as-is; an array is accepted for convenience (JSON, a database row).
+ *
+ * Only FILES need listing: every directory on the way to a listed file is
+ * implied, so `[".github/workflows/ci.yml"]` also says `.github` and
+ * `.github/workflows` are directories. An entry with a TRAILING SLASH names a
+ * directory instead — the way to list one that holds no files of its own
+ * (`"coverage/"`).
+ */
+export type KnownPaths = ReadonlySet<string> | readonly string[];
+/** What an inventory says about one path. */
+export type PathKind = 'file' | 'dir'
+/** The inventory covers the whole repository and does not list it. */
+ | 'absent'
+/** Not listed, and the inventory is partial: ask the filesystem. */
+ | 'unknown';
+/**
+ * `p` as a repo-relative POSIX path (`''` for the root itself), or `null` when
+ * it is not one: absolute on any platform, or climbing out of the repository.
+ *
+ * Backslashes are read as separators so a caller that built its list on
+ * Windows is not silently misread as holding one file named `a\b`. `.`
+ * segments are dropped and `..` is refused outright rather than resolved: an
+ * inventory entry is a statement about a path inside the repository, and a
+ * caller that means `a/b` should say so.
+ */
+export declare function normalizeKnownPath(p: string): string | null;
+/**
+ * pcic-csf: the paths a repository holds, as a lookup. Built once per scan and
+ * shared through {@link RepoTree}; immutable afterwards.
+ *
+ * A path is a directory when some listed path has it as a prefix, so no caller
+ * has to list directories separately. A listed path that is ALSO a prefix of
+ * another (`a/b` next to `a/b/c`) is a directory: the deeper entry can only be
+ * true if it is.
+ */
+export declare class PathInventory {
+    /**
+     * True when the list is the whole repository, so a path it does not hold is
+     * genuinely absent. False when it is a partial view and unlisted paths must
+     * still be looked for on the filesystem.
+     */
+    readonly complete: boolean;
+    /** Listed paths that are not also a directory. */
+    private readonly files;
+    /** Directory → its entries, by name. The root is `''`. */
+    private readonly tree;
+    constructor(knownPaths: KnownPaths, complete?: boolean);
+    /** What the inventory says `rel` (a normalized repo-relative path, `''` = root) is. */
+    classify(rel: string): PathKind;
+    /** The entries of the directory at `rel`, or `undefined` when it is not a listed directory. */
+    children(rel: string): ReadonlyMap<string, 'file' | 'dir'> | undefined;
+    /** Every listed file, sorted — the inventory's own view of the repository. */
+    listedFiles(): string[];
+}
+/**
+ * A {@link PathInventory} for `knownPaths`, or `undefined` when none was given.
+ * An EMPTY complete list is a real statement ("the repository holds nothing
+ * else"), so it still produces an inventory; `undefined`/absent does not.
+ */
+export declare function buildInventory(knownPaths: KnownPaths | undefined, knownPathsComplete: boolean | undefined): PathInventory | undefined;
+//# sourceMappingURL=known-paths.d.ts.map

package/dist/known-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-paths.d.ts","sourceRoot":"","sources":["../src/known-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;GASG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,CAAC;AAEjE,6CAA6C;AAC7C,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,KAAK;AACP,sEAAsE;GACpE,QAAQ;AACV,oEAAoE;GAClE,SAAS,CAAC;AAEd;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW3D;AAUD;;;;;;;;GAQG;AACH,qBAAa,aAAa;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,kDAAkD;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkD;gBAE3D,UAAU,EAAE,UAAU,EAAE,QAAQ,UAAQ;IAsCpD,uFAAuF;IACvF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ;IAO/B,+FAA+F;IAC/F,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,GAAG,SAAS;IAItE,8EAA8E;IAC9E,WAAW,IAAI,MAAM,EAAE;CAGxB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,UAAU,GAAG,SAAS,EAClC,kBAAkB,EAAE,OAAO,GAAG,SAAS,GACtC,aAAa,GAAG,SAAS,CAG3B"}

package/dist/known-paths.js

@@ -0,0 +1,152 @@
+/**
+ * pcic-csf: a caller-supplied inventory of the paths a repository holds, used
+ * instead of (or alongside) the filesystem for every existence check a scan
+ * makes.
+ *
+ * A hosted scan does not have the repository on disk. It fetches the
+ * instruction files into a temp directory and leaves everything else
+ * unfetched, so every path a detector checks reads as missing and the scan
+ * reports references, commands and config targets as broken when they are
+ * merely absent from the temp dir. Naming the repository's real file list up
+ * front — `ScanInput.knownPaths`, with `knownPathsComplete` saying whether the
+ * list is the whole repository — makes those checks answer about the
+ * repository rather than about what happened to be downloaded.
+ *
+ * This module is pure: it holds no filesystem access and no I/O of any kind.
+ * {@link RepoTree} consults it first and falls back to the filesystem only for
+ * paths the inventory does not cover, and only while `knownPathsComplete` is
+ * false.
+ */
+/**
+ * `p` as a repo-relative POSIX path (`''` for the root itself), or `null` when
+ * it is not one: absolute on any platform, or climbing out of the repository.
+ *
+ * Backslashes are read as separators so a caller that built its list on
+ * Windows is not silently misread as holding one file named `a\b`. `.`
+ * segments are dropped and `..` is refused outright rather than resolved: an
+ * inventory entry is a statement about a path inside the repository, and a
+ * caller that means `a/b` should say so.
+ */
+export function normalizeKnownPath(p) {
+    if (p === '')
+        return '';
+    // Absolute in any platform's form, or a Windows drive-relative path.
+    if (/^[/\\]/.test(p) || /^[A-Za-z]:/.test(p))
+        return null;
+    const segments = [];
+    for (const segment of p.split(/[/\\]+/)) {
+        if (segment === '' || segment === '.')
+            continue;
+        if (segment === '..')
+            return null;
+        segments.push(segment);
+    }
+    return segments.join('/');
+}
+/** `''`, plus every proper ancestor directory of `rel`, nearest last. */
+function ancestorsOf(rel) {
+    const out = [''];
+    const parts = rel.split('/');
+    for (let i = 1; i < parts.length; i++)
+        out.push(parts.slice(0, i).join('/'));
+    return out;
+}
+/**
+ * pcic-csf: the paths a repository holds, as a lookup. Built once per scan and
+ * shared through {@link RepoTree}; immutable afterwards.
+ *
+ * A path is a directory when some listed path has it as a prefix, so no caller
+ * has to list directories separately. A listed path that is ALSO a prefix of
+ * another (`a/b` next to `a/b/c`) is a directory: the deeper entry can only be
+ * true if it is.
+ */
+export class PathInventory {
+    /**
+     * True when the list is the whole repository, so a path it does not hold is
+     * genuinely absent. False when it is a partial view and unlisted paths must
+     * still be looked for on the filesystem.
+     */
+    complete;
+    /** Listed paths that are not also a directory. */
+    files = new Set();
+    /** Directory → its entries, by name. The root is `''`. */
+    tree = new Map();
+    constructor(knownPaths, complete = false) {
+        this.complete = complete;
+        const listed = new Set();
+        const explicitDirs = new Set();
+        for (const raw of knownPaths) {
+            const rel = normalizeKnownPath(raw);
+            if (rel === null || rel === '')
+                continue;
+            // A trailing slash is how a caller names an EMPTY directory — one with no
+            // listed file under it to imply it. Normalization has already dropped the
+            // slash, so the raw spelling is what says which it was.
+            if (/[/\\]\s*$/.test(raw))
+                explicitDirs.add(rel);
+            else
+                listed.add(rel);
+        }
+        const dirs = new Set(['', ...explicitDirs]);
+        for (const rel of [...listed, ...explicitDirs])
+            for (const dir of ancestorsOf(rel))
+                dirs.add(dir);
+        for (const rel of listed)
+            if (!dirs.has(rel))
+                this.files.add(rel);
+        // One pass over files and directories, each filed under its parent.
+        const place = (rel, kind) => {
+            const slash = rel.lastIndexOf('/');
+            const parent = slash === -1 ? '' : rel.slice(0, slash);
+            const name = slash === -1 ? rel : rel.slice(slash + 1);
+            let entries = this.tree.get(parent);
+            if (entries === undefined) {
+                entries = new Map();
+                this.tree.set(parent, entries);
+            }
+            // A directory wins over a file of the same name: see the class comment.
+            if (kind === 'dir' || !entries.has(name))
+                entries.set(name, kind);
+        };
+        for (const rel of this.files)
+            place(rel, 'file');
+        for (const dir of dirs) {
+            if (dir === '')
+                continue;
+            place(dir, 'dir');
+            if (!this.tree.has(dir))
+                this.tree.set(dir, new Map());
+        }
+        if (!this.tree.has(''))
+            this.tree.set('', new Map());
+    }
+    /** What the inventory says `rel` (a normalized repo-relative path, `''` = root) is. */
+    classify(rel) {
+        if (rel === '')
+            return 'dir';
+        if (this.tree.has(rel))
+            return 'dir';
+        if (this.files.has(rel))
+            return 'file';
+        return this.complete ? 'absent' : 'unknown';
+    }
+    /** The entries of the directory at `rel`, or `undefined` when it is not a listed directory. */
+    children(rel) {
+        return this.tree.get(rel);
+    }
+    /** Every listed file, sorted — the inventory's own view of the repository. */
+    listedFiles() {
+        return [...this.files].sort();
+    }
+}
+/**
+ * A {@link PathInventory} for `knownPaths`, or `undefined` when none was given.
+ * An EMPTY complete list is a real statement ("the repository holds nothing
+ * else"), so it still produces an inventory; `undefined`/absent does not.
+ */
+export function buildInventory(knownPaths, knownPathsComplete) {
+    if (knownPaths === undefined)
+        return undefined;
+    return new PathInventory(knownPaths, knownPathsComplete === true);
+}
+//# sourceMappingURL=known-paths.js.map

package/dist/known-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-paths.js","sourceRoot":"","sources":["../src/known-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAuBH;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACxB,qEAAqE;IACrE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;YAAE,SAAS;QAChD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,aAAa;IACxB;;;;OAIG;IACM,QAAQ,CAAU;IAC3B,kDAAkD;IACjC,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,0DAA0D;IACzC,IAAI,GAAG,IAAI,GAAG,EAAuC,CAAC;IAEvE,YAAY,UAAsB,EAAE,QAAQ,GAAG,KAAK;QAClD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE;gBAAE,SAAS;YACzC,0EAA0E;YAC1E,0EAA0E;YAC1E,wDAAwD;YACxD,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;gBAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,EAAE,GAAG,YAAY,CAAC;YAAE,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClG,KAAK,MAAM,GAAG,IAAI,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClE,oEAAoE;QACpE,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,IAAoB,EAAQ,EAAE;YACxD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACvD,IAAI,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACjC,CAAC;YACD,wEAAwE;YACxE,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpE,CAAC,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,KAAK,EAAE;gBAAE,SAAS;YACzB,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,uFAAuF;IACvF,QAAQ,CAAC,GAAW;QAClB,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,CAAC;IAED,+FAA+F;IAC/F,QAAQ,CAAC,GAAW;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,8EAA8E;IAC9E,WAAW;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAkC,EAClC,kBAAuC;IAEvC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,IAAI,aAAa,CAAC,UAAU,EAAE,kBAAkB,KAAK,IAAI,CAAC,CAAC;AACpE,CAAC"}

package/dist/makefile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"makefile.d.ts","sourceRoot":"","sources":["../src/makefile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,MAAM,MAAM,aAAa,GAAG;IAC1B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAuBF,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAa,GAAG,aAAa,CAwEtF;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAY7E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,QAAiC,GACtC,aAAa,GAAG,SAAS,CAe3B"}
+{"version":3,"file":"makefile.d.ts","sourceRoot":"","sources":["../src/makefile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,MAAM,MAAM,aAAa,GAAG;IAC1B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAuBF,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAa,GAAG,aAAa,CAwEtF;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAY7E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,QAAiC,GACtC,aAAa,GAAG,SAAS,CAwB3B"}

package/dist/makefile.js

@@ -11,7 +11,6 @@
  *
  * Deterministic and offline: it only reads the Makefile text.
  */
-import * as fs from 'node:fs';
 import { RepoTree } from './repo-tree.js';
 import { MAX_FILE_SIZE } from './scanner.js';
 /** GNU make's lookup order when no `-f` is given. */
@@ -138,19 +137,24 @@ export function makefileDefines(facts, target) {
 export function readMakefile(repoRoot, dir, tree = new RepoTree(repoRoot)) {
     for (const name of MAKEFILE_NAMES) {
         const rel = dir === '.' || dir === '' ? name : `${dir}/${name}`;
-        const found = tree.lookup(rel);
-        if (found.state !== 'found' || found.isDir)
-            continue;
-        try {
-            const stat = fs.statSync(found.path);
-            if (!stat.isFile())
-                continue;
-            if (stat.size > MAX_FILE_SIZE)
+        // pcic-e6xa: read through the tree, which containment-checks the file it
+        // actually opens — `lookup` alone cannot, since with a complete inventory
+        // (pcic-csf) no directory is listed and a real link at that path is never
+        // seen. A Makefile committed as a link out of the repository is not read.
+        const read = tree.readText(rel, { maxBytes: MAX_FILE_SIZE });
+        switch (read.state) {
+            case 'found':
+                return parseMakefileTargets(read.content, rel);
+            // The file is there and its targets cannot be known: oversized, not
+            // readable, or listed by a caller's inventory without being fetched.
+            // Reporting its targets as missing would be a false positive, so the
+            // facts say "unverifiable" and callers report nothing against it.
+            case 'too-large':
+            case 'unreadable':
+            case 'unfetched':
                 return { file: rel, targets: [], patterns: [], unverifiable: true };
-            return parseMakefileTargets(fs.readFileSync(found.path, 'utf8'), rel);
-        }
-        catch {
-            continue;
+            default:
+                continue; // absent, or out of the root: try the next name
         }
     }
     return undefined;

package/dist/makefile.js.map

@@ -1 +1 @@
-{"version":3,"file":"makefile.js","sourceRoot":"","sources":["../src/makefile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAgB7C,qDAAqD;AACrD,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAE/D,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C,yEAAyE;AACzE,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YAClC,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QACxB,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,IAAI,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,IAAI,GAAG,UAAU;IACrE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,4DAA4D;QAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,QAAQ,GAAG,KAAK,CAAC;YAC/C,SAAS;QACX,CAAC;QAED,kCAAkC;QAClC,IAAI,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QAED,mFAAmF;QACnF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,KAAK;YAAE,SAAS,CAAC,uCAAuC;QACtF,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,SAAS,CAAC,wBAAwB;QAE1F,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,kFAAkF,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAE5G,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,kDAAkD;YAClD,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,qEAAqE;YACrE,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;qBAC3E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,YAAY,GAAG,IAAI,CAAC;YACnD,CAAC;YACD,SAAS;QACX,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;;gBACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC;AAC9F,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,KAAoB,EAAE,MAAc;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO,CACL,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;YAC7C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YACzB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,GAAW,EACX,OAAiB,IAAI,QAAQ,CAAC,QAAQ,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK;YAAE,SAAS;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC7B,IAAI,IAAI,CAAC,IAAI,GAAG,aAAa;gBAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YACnG,OAAO,oBAAoB,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"makefile.js","sourceRoot":"","sources":["../src/makefile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAgB7C,qDAAqD;AACrD,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAE/D,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C,yEAAyE;AACzE,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YAClC,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QACxB,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,IAAI,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,IAAI,GAAG,UAAU;IACrE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,4DAA4D;QAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,QAAQ,GAAG,KAAK,CAAC;YAC/C,SAAS;QACX,CAAC;QAED,kCAAkC;QAClC,IAAI,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QAED,mFAAmF;QACnF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,KAAK;YAAE,SAAS,CAAC,uCAAuC;QACtF,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,SAAS,CAAC,wBAAwB;QAE1F,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,kFAAkF,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAE5G,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,kDAAkD;YAClD,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,qEAAqE;YACrE,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;qBAC3E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,YAAY,GAAG,IAAI,CAAC;YACnD,CAAC;YACD,SAAS;QACX,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;;gBACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC;AAC9F,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,KAAoB,EAAE,MAAc;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO,CACL,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;YAC7C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YACzB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,GAAW,EACX,OAAiB,IAAI,QAAQ,CAAC,QAAQ,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAChE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7D,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,OAAO;gBACV,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACjD,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,kEAAkE;YAClE,KAAK,WAAW,CAAC;YACjB,KAAK,YAAY,CAAC;YAClB,KAAK,WAAW;gBACd,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YACtE;gBACE,SAAS,CAAC,gDAAgD;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/manifest-consistency.d.ts

@@ -37,7 +37,7 @@ export type ManifestData = {
  *
  * @param files    Scanned instruction files.
  * @param manifests Raw text of any manifest files that were read by the scanner.
- * @param repoRoot  Absolute path to the repo root (used for file existence checks).
+ * File-existence checks go through `context.tree` (pcic-e6xa).
  */
 export declare function detectManifestConsistency(context: RepoContext): PromptCiIssue[];
 //# sourceMappingURL=manifest-consistency.d.ts.map

package/dist/manifest-consistency.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-consistency.d.ts","sourceRoot":"","sources":["../src/manifest-consistency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,KAAK,EAAmB,aAAa,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQrD,MAAM,MAAM,YAAY,GAAG;IACzB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AA2vBF;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,WAAW,GAAG,aAAa,EAAE,CAuB/E"}
+{"version":3,"file":"manifest-consistency.d.ts","sourceRoot":"","sources":["../src/manifest-consistency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAmB,aAAa,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAWrD,MAAM,MAAM,YAAY,GAAG;IACzB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAuwBF;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,WAAW,GAAG,aAAa,EAAE,CAuB/E"}

package/dist/manifest-consistency.js

@@ -18,12 +18,12 @@
  * Findings are heuristic — wording is intentionally cautious.
  */
 import * as crypto from 'node:crypto';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
 import { buildCodeMask } from './markdown-fences.js';
 import { fileIdPath } from './finding-id.js';
 import { BUN_BUILTINS, analyzeCommands } from './command-validity.js';
 import { anyWorkspaceHasScript, isKnownBinary } from './workspace-manifests.js';
+import { treeFor } from './repo-tree.js';
+import { collectCiPackageManagers } from './ci-alignment.js';
 // ── Helpers ───────────────────────────────────────────────────────────────────
 function issueId(key) {
     const hash = crypto.createHash('sha1').update(key).digest('hex').slice(0, 12);
@@ -35,15 +35,20 @@ function issueId(key) {
  * but the project actually uses Poetry (pyproject.toml with [tool.poetry]) and has no
  * requirements.txt. Running the pip command would immediately fail.
  */
-function checkPipVsPoetry(files, pyprojectContent, repoRoot) {
+function checkPipVsPoetry(files, pyprojectContent, tree) {
     const isPoetry = /\[tool\.poetry\]/.test(pyprojectContent) ||
         /build-backend\s*=\s*["'][^"']*poetry[^"']*["']/i.test(pyprojectContent);
     if (!isPoetry)
         return null;
     // Only flag when requirements.txt is genuinely absent — some Poetry projects
     // export a requirements.txt as an artefact; if it exists the instruction is valid.
-    const reqTxtPath = path.join(repoRoot, 'requirements.txt');
-    if (fs.existsSync(reqTxtPath))
+    //
+    // pcic-e6xa: asked through the scan's tree. The name is fixed, but a
+    // `requirements.txt` committed as a link out of the repository used to decide
+    // whether this `high` finding fires, and in the hosted product the scan root
+    // is a server temp directory. The tree also lets a caller's file inventory
+    // answer when the repository is not on disk (pcic-csf).
+    if (tree.exists('requirements.txt'))
         return null;
     const PIP_INSTALL_REQUIREMENTS_RE = /pip\s+install\s+-r\s+requirements\.txt/i;
     const offendingFiles = files.filter((f) => PIP_INSTALL_REQUIREMENTS_RE.test(f.content));
@@ -413,6 +418,10 @@ function checkPackageManagerMismatch(context) {
     }
     if (offendingFiles.length === 0)
         return null;
+    // pcic-1ik0.5: the CI-alignment check defers to this one when the manifest
+    // names the package manager, so say here when CI agrees. Summary only: the
+    // evidence is part of the baseline fingerprint and stays as it was.
+    const ciAgrees = context.workflows.files.length > 0 && collectCiPackageManagers(context.workflows.commands).has(preferred);
     return {
         id: 'manifest-package-manager-mismatch',
         severity: 'warning',
@@ -420,6 +429,7 @@ function checkPackageManagerMismatch(context) {
         title: `Possible package manager mismatch: instructions use alternatives to ${preferred}`,
         summary: `Instruction files refer to other package managers, but this project appears to use ${preferred} ` +
             `(based on ${packageJson.lockfiles.join(', ') || 'package.json'}). ` +
+            (ciAgrees ? `The CI workflows use ${preferred} too. ` : '') +
             `Mixing package managers can lead to inconsistent lockfiles and installation errors.`,
         filePaths: offendingFiles.map((f) => f.path),
         locations: offendingFiles.map((f) => ({ filePath: f.path })),
@@ -698,10 +708,10 @@ function checkJsToolingMismatch(context) {
  *
  * @param files    Scanned instruction files.
  * @param manifests Raw text of any manifest files that were read by the scanner.
- * @param repoRoot  Absolute path to the repo root (used for file existence checks).
+ * File-existence checks go through `context.tree` (pcic-e6xa).
  */
 export function detectManifestConsistency(context) {
-    const { files, manifests, repoRoot } = context;
+    const { files, manifests } = context;
     const issues = [];
     if (manifests.packageJson) {
         issues.push(...checkJsLibraryVersionMismatch(files, manifests.packageJson));
@@ -713,7 +723,7 @@ export function detectManifestConsistency(context) {
     if (pmIssue)
         issues.push(pmIssue);
     if (manifests.pyproject) {
-        const toolingIssue = checkPipVsPoetry(files, manifests.pyproject, repoRoot);
+        const toolingIssue = checkPipVsPoetry(files, manifests.pyproject, treeFor(context));
         if (toolingIssue)
             issues.push(toolingIssue);
         issues.push(...checkPythonVersionMismatch(files, manifests.pyproject));