@svp-labs/talos 0.0.0 → 0.1.0

package/dist/checks/common/jscpd-report.js

@@ -0,0 +1,62 @@
+import { isAbsolute, relative } from 'node:path';
+import { z } from 'zod';
+import { EngineError } from '../../core/check.js';
+const fragment = z.object({
+    name: z.string().min(1),
+    start: z.number().int().nonnegative(),
+    end: z.number().int().nonnegative(),
+});
+const report = z.object({
+    duplicates: z.array(z.object({
+        tokens: z.number().int().nonnegative(),
+        firstFile: fragment,
+        secondFile: fragment,
+    })),
+});
+/**
+ * jscpd names a file given on its command line by its base name alone, so the gate asks it for
+ * absolute paths and makes them relative here.
+ */
+function toFragment(raw, root) {
+    const local = isAbsolute(raw.name) ? relative(root, raw.name) : raw.name;
+    const file = local.replaceAll('\\', '/').replace(/^\.\//, '');
+    const start = Math.max(1, raw.start);
+    return { file, start, end: Math.max(start, raw.end) };
+}
+/** Which of two fragments comes first, by path and then line, so the choice never varies. */
+function ordered(a, b) {
+    const first = a.file === b.file ? a.start <= b.start : a.file < b.file;
+    return first ? [a, b] : [b, a];
+}
+function where(other, later) {
+    const lines = `lines ${other.start}-${other.end}`;
+    return other.file === later.file ? `${lines} of this file` : `${other.file} ${lines}`;
+}
+function cloneFinding(tokens, a, b) {
+    const [earlier, later] = ordered(a, b);
+    return {
+        rule: 'jscpd/clone',
+        message: `Lines ${later.start}-${later.end} repeat ${where(earlier, later)} (${tokens} tokens): ` +
+            'keep one copy and share it.',
+        location: { file: later.file, line: later.start, endLine: later.end },
+    };
+}
+/**
+ * One finding per repeated fragment in jscpd's JSON report, on the later of the two copies by
+ * path and line, naming the other. Paths are made relative to `root`.
+ */
+export function cloneFindings(text, root) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw new EngineError('jscpd wrote a report that is not JSON');
+    }
+    const parsed = report.safeParse(raw);
+    if (!parsed.success) {
+        throw new EngineError(`jscpd's report has an unknown shape: ${z.prettifyError(parsed.error)}`);
+    }
+    return parsed.data.duplicates.map((duplicate) => cloneFinding(duplicate.tokens, toFragment(duplicate.firstFile, root), toFragment(duplicate.secondFile, root)));
+}
+//# sourceMappingURL=jscpd-report.js.map

package/dist/checks/common/jscpd-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jscpd-report.js","sourceRoot":"","sources":["../../../src/checks/common/jscpd-report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,UAAU,EAAE,CAAC,CAAC,KAAK,CACjB,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,QAAQ;KACrB,CAAC,CACH;CACF,CAAC,CAAC;AAIH;;;GAGG;AACH,SAAS,UAAU,CAAC,GAA6B,EAAE,IAAY;IAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACzE,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,6FAA6F;AAC7F,SAAS,OAAO,CAAC,CAAW,EAAE,CAAW;IACvC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACvE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,KAAK,CAAC,KAAe,EAAE,KAAe;IAC7C,MAAM,KAAK,GAAG,SAAS,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,CAAW,EAAE,CAAW;IAC5D,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,OAAO,EACL,SAAS,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,WAAW,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,MAAM,YAAY;YACxF,6BAA6B;QAC/B,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE;KACtE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY;IACtD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,uCAAuC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,WAAW,CAAC,wCAAwC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC9C,YAAY,CACV,SAAS,CAAC,MAAM,EAChB,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,EACrC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CACvC,CACF,CAAC;AACJ,CAAC"}

package/dist/checks/common/suppression-rules.js

@@ -0,0 +1,271 @@
+function silences(directive, tool) {
+    return `\`${directive}\` silences ${tool}: fix what it reports instead.`;
+}
+function uncovers(directive) {
+    return `\`${directive}\` hides code from coverage: test it instead.`;
+}
+function formatterSkips(directive, tool) {
+    return `\`${directive}\` keeps ${tool} from formatting this code: let it format it.`;
+}
+function mutationSkips(directive, tool) {
+    return `\`${directive}\` keeps ${tool} from mutating this code: test it so its mutants die.`;
+}
+function hidesSecret(directive, tool) {
+    return `\`${directive}\` hides a possible secret from ${tool}: remove the secret instead.`;
+}
+function reconfigures(directive, tool) {
+    return `A \`${directive}\` comment changes ${tool}'s rules here: keep the rules Talos sets.`;
+}
+/** TypeScript and JavaScript tools, read from comments. */
+const JS = [
+    {
+        kind: 'eslint-disable',
+        pattern: /^eslint-disable(?:-next-line|-line)?(?![\w-])/,
+        message: silences('eslint-disable', 'ESLint'),
+    },
+    {
+        kind: 'eslint-config',
+        pattern: /^eslint\s+[@\w/-]+\s*:/,
+        message: reconfigures('eslint', 'ESLint'),
+    },
+    { kind: 'ts-ignore', pattern: /^@ts-ignore\b/, message: silences('@ts-ignore', 'TypeScript') },
+    {
+        kind: 'ts-expect-error',
+        pattern: /^@ts-expect-error\b/,
+        message: silences('@ts-expect-error', 'TypeScript'),
+    },
+    { kind: 'ts-nocheck', pattern: /^@ts-nocheck\b/, message: silences('@ts-nocheck', 'TypeScript') },
+    {
+        kind: 'istanbul-ignore',
+        pattern: /^istanbul\s+ignore\b/,
+        message: uncovers('istanbul ignore'),
+    },
+    { kind: 'c8-ignore', pattern: /^c8\s+ignore\b/, message: uncovers('c8 ignore') },
+    { kind: 'v8-ignore', pattern: /^v8\s+ignore\b/, message: uncovers('v8 ignore') },
+    {
+        kind: 'node-coverage-ignore',
+        pattern: /^node:coverage\s+(?:ignore|disable)\b/,
+        message: uncovers('node:coverage ignore'),
+    },
+    {
+        kind: 'prettier-ignore',
+        pattern: /^prettier-ignore(?:-start)?\b/,
+        message: formatterSkips('prettier-ignore', 'Prettier'),
+    },
+    {
+        kind: 'type-coverage-ignore',
+        pattern: /^type-coverage:ignore-(?:next-)?line\b/,
+        message: '`type-coverage:ignore` hides untyped code from type coverage: type it instead.',
+    },
+    {
+        kind: 'stryker-disable',
+        pattern: /^Stryker\s+disable\b/i,
+        message: mutationSkips('Stryker disable', 'Stryker'),
+    },
+];
+/** Python tools, read from comments. */
+const PYTHON = [
+    {
+        kind: 'noqa',
+        pattern: /(?:^|#\s*)(?:(?:ruff|flake8):\s*)?noqa\b/i,
+        message: silences('noqa', 'Ruff'),
+    },
+    {
+        kind: 'type-ignore',
+        pattern: /(?:^|#\s*)type:\s*ignore\b/,
+        message: silences('type: ignore', 'the type checker'),
+    },
+    {
+        kind: 'pyright-ignore',
+        pattern: /(?:^|#\s*)(?:based)?pyright:\s*ignore\b/,
+        message: silences('pyright: ignore', 'basedpyright'),
+    },
+    {
+        kind: 'pyright-config',
+        pattern: /^(?:based)?pyright:\s*(?!ignore\b|strict\s*$)\S/,
+        message: reconfigures('pyright:', 'basedpyright'),
+    },
+    {
+        kind: 'mypy-config',
+        pattern: /^mypy:\s*\S/,
+        message: reconfigures('mypy:', 'the type checker'),
+    },
+    {
+        kind: 'pragma-no-cover',
+        pattern: /^pragma:\s*no\s+(?:cover|branch)\b/,
+        message: uncovers('pragma: no cover'),
+    },
+    {
+        kind: 'pragma-no-mutate',
+        pattern: /^pragma:\s*no\s+mutate\b/,
+        message: mutationSkips('pragma: no mutate', 'mutmut'),
+    },
+    {
+        kind: 'fmt-off',
+        pattern: /(?:^|#\s*)fmt:\s*(?:off|skip)\b/,
+        message: formatterSkips('fmt: off', 'Ruff'),
+    },
+    {
+        kind: 'pylint-disable',
+        pattern: /^pylint:\s*disable\b/,
+        message: silences('pylint: disable', 'Pylint'),
+    },
+];
+/** PHP tools, read from comments and doc comments. */
+const PHP = [
+    {
+        kind: 'phpstan-ignore',
+        pattern: /^@phpstan-ignore(?:-line|-next-line|-error)?\b/,
+        message: silences('@phpstan-ignore', 'PHPStan'),
+    },
+    {
+        kind: 'psalm-suppress',
+        pattern: /^@psalm-suppress\b/,
+        message: silences('@psalm-suppress', 'Psalm'),
+    },
+    {
+        kind: 'code-coverage-ignore',
+        pattern: /^@codeCoverageIgnore(?!End)/,
+        message: uncovers('@codeCoverageIgnore'),
+    },
+    {
+        kind: 'suppress-warnings',
+        pattern: /^@SuppressWarnings\s*\(/,
+        message: silences('@SuppressWarnings', 'PHPMD'),
+    },
+    {
+        kind: 'phpcs-ignore',
+        pattern: /^(?:phpcs:(?:ignore|disable)\b|@codingStandardsIgnore)/,
+        message: silences('phpcs:ignore', 'PHP_CodeSniffer'),
+    },
+    {
+        kind: 'infection-ignore',
+        pattern: /^@infection-ignore-all\b/,
+        message: mutationSkips('@infection-ignore-all', 'Infection'),
+    },
+];
+/** Lua tools, read from comments. */
+const LUA = [
+    {
+        kind: 'luacheck',
+        pattern: /^luacheck:\s*(?!pop\b|push\s*$)\S/,
+        message: silences('luacheck:', 'luacheck'),
+    },
+    {
+        kind: 'diagnostic-disable',
+        pattern: /^@diagnostic\s+disable\b/,
+        message: silences('@diagnostic disable', 'LuaLS'),
+    },
+    {
+        kind: 'stylua-ignore',
+        pattern: /^stylua:\s*ignore\b/,
+        message: formatterSkips('stylua: ignore', 'StyLua'),
+    },
+    { kind: 'luacov-disable', pattern: /^luacov:\s*disable\b/, message: uncovers('luacov: disable') },
+];
+/** Scripts, containers, workflows and docs, read from comments. */
+const INFRA = [
+    {
+        kind: 'shellcheck-disable',
+        pattern: /^shellcheck\s+(?:\S+\s+)*?disable=/,
+        message: silences('shellcheck disable', 'ShellCheck'),
+    },
+    {
+        kind: 'hadolint-ignore',
+        pattern: /^hadolint\s+(?:global\s+)?ignore=/,
+        message: silences('hadolint ignore', 'hadolint'),
+    },
+    {
+        kind: 'zizmor-ignore',
+        pattern: /^zizmor:\s*ignore\b/,
+        message: silences('zizmor: ignore', 'zizmor'),
+    },
+    {
+        kind: 'markdownlint-disable',
+        pattern: /^markdownlint-(?:disable|configure-file)\b/,
+        message: silences('markdownlint-disable', 'markdownlint'),
+    },
+];
+/** Tools that read the same markers in every language. */
+const ANY = [
+    {
+        kind: 'jscpd-ignore',
+        pattern: /^jscpd:ignore-start\b/,
+        message: '`jscpd:ignore-start` hides repeated code from jscpd: keep one copy and share it.',
+    },
+    {
+        kind: 'cspell',
+        pattern: /^(?:cspell|spell-checker):\s*(?:disable|ignore|words)\b/i,
+        message: 'A `cspell:` comment silences the spell checker: fix the word or add it to the word list.',
+    },
+    {
+        kind: 'nosemgrep',
+        pattern: /(?:^|#\s*)nosemgrep\b/,
+        message: silences('nosemgrep', 'Semgrep'),
+    },
+    { kind: 'nosonar', pattern: /\bNOSONAR\b/, message: silences('NOSONAR', "Sonar's rules") },
+    {
+        kind: 'nosec',
+        pattern: /(?:^#?|#\s*)nosec\b/,
+        message: silences('nosec', 'the security linter'),
+    },
+    {
+        kind: 'gitleaks-allow',
+        pattern: /\bgitleaks:allow\b/,
+        message: hidesSecret('gitleaks:allow', 'gitleaks'),
+    },
+    {
+        kind: 'allowlist-secret',
+        pattern: /(?:^|#\s*)pragma:\s*allowlist\s+(?:nextline\s+)?secret\b/,
+        message: hidesSecret('pragma: allowlist secret', 'the secret scanners'),
+    },
+];
+/**
+ * Every directive a comment can carry. Each is looked for in every language's comments: the
+ * markers are distinct enough that one never reads as another tool's.
+ */
+export const COMMENT_DIRECTIVES = [
+    ...JS,
+    ...PYTHON,
+    ...PHP,
+    ...LUA,
+    ...INFRA,
+    ...ANY,
+];
+/** Rust's attributes, read from code lines. */
+export const RUST_ATTRIBUTES = [
+    {
+        kind: 'allow',
+        pattern: /^\s*#!?\[\s*(?:allow\s*\(|cfg_attr\s*\(.*\ballow\s*\()/,
+        message: silences('#[allow]', 'the compiler and Clippy'),
+    },
+    {
+        kind: 'expect',
+        pattern: /^\s*#!?\[\s*(?:expect\s*\(|cfg_attr\s*\(.*\bexpect\s*\()/,
+        message: silences('#[expect]', 'the compiler and Clippy'),
+    },
+    {
+        kind: 'rustfmt-skip',
+        pattern: /^\s*#!?\[\s*rustfmt::skip\b/,
+        message: formatterSkips('#[rustfmt::skip]', 'rustfmt'),
+    },
+    {
+        kind: 'coverage-off',
+        pattern: /^\s*#!?\[\s*(?:coverage\s*\(\s*off|cfg_attr\s*\(.*\bcoverage\s*\(\s*off)/,
+        message: uncovers('coverage(off)'),
+    },
+    {
+        kind: 'mutants-skip',
+        pattern: /^\s*#!?\[\s*mutants::skip\b/,
+        message: mutationSkips('#[mutants::skip]', 'cargo-mutants'),
+    },
+];
+/** PowerShell's attribute, read from code lines; PowerShell ignores case. */
+export const POWERSHELL_ATTRIBUTES = [
+    {
+        kind: 'suppress-message',
+        pattern: /^\s*\[\s*(?:System\.)?(?:Diagnostics\.CodeAnalysis\.)?SuppressMessage(?:Attribute)?\s*\(/i,
+        message: silences('[SuppressMessage]', 'PSScriptAnalyzer'),
+    },
+];
+//# sourceMappingURL=suppression-rules.js.map

package/dist/checks/common/suppression-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppression-rules.js","sourceRoot":"","sources":["../../../src/checks/common/suppression-rules.ts"],"names":[],"mappings":"AAQA,SAAS,QAAQ,CAAC,SAAiB,EAAE,IAAY;IAC/C,OAAO,KAAK,SAAS,eAAe,IAAI,gCAAgC,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB;IACjC,OAAO,KAAK,SAAS,+CAA+C,CAAC;AACvE,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,IAAY;IACrD,OAAO,KAAK,SAAS,YAAY,IAAI,+CAA+C,CAAC;AACvF,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,IAAY;IACpD,OAAO,KAAK,SAAS,YAAY,IAAI,uDAAuD,CAAC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,IAAY;IAClD,OAAO,KAAK,SAAS,mCAAmC,IAAI,8BAA8B,CAAC;AAC7F,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,IAAY;IACnD,OAAO,OAAO,SAAS,sBAAsB,IAAI,2CAA2C,CAAC;AAC/F,CAAC;AAED,2DAA2D;AAC3D,MAAM,EAAE,GAAyB;IAC/B;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC;KAC9C;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC;KAC1C;IACD,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE;IAC9F;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,qBAAqB;QAC9B,OAAO,EAAE,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;KACpD;IACD,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE;IACjG;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,sBAAsB;QAC/B,OAAO,EAAE,QAAQ,CAAC,iBAAiB,CAAC;KACrC;IACD,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE;IAChF,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE;IAChF;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,uCAAuC;QAChD,OAAO,EAAE,QAAQ,CAAC,sBAAsB,CAAC;KAC1C;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,cAAc,CAAC,iBAAiB,EAAE,UAAU,CAAC;KACvD;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,wCAAwC;QACjD,OAAO,EAAE,gFAAgF;KAC1F;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,uBAAuB;QAChC,OAAO,EAAE,aAAa,CAAC,iBAAiB,EAAE,SAAS,CAAC;KACrD;CACF,CAAC;AAEF,wCAAwC;AACxC,MAAM,MAAM,GAAyB;IACnC;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,2CAA2C;QACpD,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KAClC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,4BAA4B;QACrC,OAAO,EAAE,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;KACtD;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,yCAAyC;QAClD,OAAO,EAAE,QAAQ,CAAC,iBAAiB,EAAE,cAAc,CAAC;KACrD;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,YAAY,CAAC,UAAU,EAAE,cAAc,CAAC;KAClD;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,aAAa;QACtB,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,kBAAkB,CAAC;KACnD;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,oCAAoC;QAC7C,OAAO,EAAE,QAAQ,CAAC,kBAAkB,CAAC;KACtC;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,0BAA0B;QACnC,OAAO,EAAE,aAAa,CAAC,mBAAmB,EAAE,QAAQ,CAAC;KACtD;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,iCAAiC;QAC1C,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC;KAC5C;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,sBAAsB;QAC/B,OAAO,EAAE,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC;KAC/C;CACF,CAAC;AAEF,sDAAsD;AACtD,MAAM,GAAG,GAAyB;IAChC;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,gDAAgD;QACzD,OAAO,EAAE,QAAQ,CAAC,iBAAiB,EAAE,SAAS,CAAC;KAChD;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,oBAAoB;QAC7B,OAAO,EAAE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;KAC9C;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,QAAQ,CAAC,qBAAqB,CAAC;KACzC;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,yBAAyB;QAClC,OAAO,EAAE,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;KAChD;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,wDAAwD;QACjE,OAAO,EAAE,QAAQ,CAAC,cAAc,EAAE,iBAAiB,CAAC;KACrD;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,0BAA0B;QACnC,OAAO,EAAE,aAAa,CAAC,uBAAuB,EAAE,WAAW,CAAC;KAC7D;CACF,CAAC;AAEF,qCAAqC;AACrC,MAAM,GAAG,GAAyB;IAChC;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,mCAAmC;QAC5C,OAAO,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,0BAA0B;QACnC,OAAO,EAAE,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;KAClD;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,qBAAqB;QAC9B,OAAO,EAAE,cAAc,CAAC,gBAAgB,EAAE,QAAQ,CAAC;KACpD;IACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE;CAClG,CAAC;AAEF,mEAAmE;AACnE,MAAM,KAAK,GAAyB;IAClC;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,oCAAoC;QAC7C,OAAO,EAAE,QAAQ,CAAC,oBAAoB,EAAE,YAAY,CAAC;KACtD;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,mCAAmC;QAC5C,OAAO,EAAE,QAAQ,CAAC,iBAAiB,EAAE,UAAU,CAAC;KACjD;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,qBAAqB;QAC9B,OAAO,EAAE,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC;KAC9C;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,4CAA4C;QACrD,OAAO,EAAE,QAAQ,CAAC,sBAAsB,EAAE,cAAc,CAAC;KAC1D;CACF,CAAC;AAEF,0DAA0D;AAC1D,MAAM,GAAG,GAAyB;IAChC;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,uBAAuB;QAChC,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,0DAA0D;QACnE,OAAO,EACL,0FAA0F;KAC7F;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,uBAAuB;QAChC,OAAO,EAAE,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC;KAC1C;IACD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE;IAC1F;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,qBAAqB;QAC9B,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;KAClD;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,oBAAoB;QAC7B,OAAO,EAAE,WAAW,CAAC,gBAAgB,EAAE,UAAU,CAAC;KACnD;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,0DAA0D;QACnE,OAAO,EAAE,WAAW,CAAC,0BAA0B,EAAE,qBAAqB,CAAC;KACxE;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAyB;IACtD,GAAG,EAAE;IACL,GAAG,MAAM;IACT,GAAG,GAAG;IACN,GAAG,GAAG;IACN,GAAG,KAAK;IACR,GAAG,GAAG;CACP,CAAC;AAEF,+CAA+C;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,wDAAwD;QACjE,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;KACzD;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,0DAA0D;QACnE,OAAO,EAAE,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;KAC1D;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,SAAS,CAAC;KACvD;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,0EAA0E;QACnF,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC;KACnC;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,aAAa,CAAC,kBAAkB,EAAE,eAAe,CAAC;KAC5D;CACF,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAyB;IACzD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EACL,2FAA2F;QAC7F,OAAO,EAAE,QAAQ,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;KAC3D;CACF,CAAC"}

package/dist/checks/common/suppression-scan.js

@@ -0,0 +1,103 @@
+import { COMMENT_DIRECTIVES, POWERSHELL_ATTRIBUTES, RUST_ATTRIBUTES, } from './suppression-rules.js';
+import { commentsIn, SOURCE_GLOBS } from '../../docs/comments/index.js';
+import { isDockerfile } from '../infra/files.js';
+const PYTHON = /\.pyi?$/;
+const POWERSHELL = /\.ps[dm]?1$/i;
+const HASH_CONFIGS = /\.(?:ya?ml|toml)$/i;
+const MARKDOWN = /\.(?:md|markdown)$/i;
+/** Source code, container files, workflows and configs, and docs. */
+export const SUPPRESSION_GLOBS = [
+    ...SOURCE_GLOBS,
+    '**/{Dockerfile,Containerfile}',
+    '**/{Dockerfile,Containerfile}.*',
+    '**/*.{Dockerfile,dockerfile}',
+    '**/*.{yml,yaml,toml}',
+    '**/*.{md,markdown}',
+];
+/** Comments of a language Talos reads; a Python doc string is a string, not a comment. */
+function sourceComments(file, text) {
+    const python = PYTHON.test(file);
+    return commentsIn(file, text).filter((comment) => !(python && comment.doc));
+}
+/** `#` comments: a `#` at a line's start or after white space, to the line's end. */
+function hashComments(text) {
+    return text.split('\n').flatMap((line, index) => {
+        const match = /(?:^|\s)#(.*)$/.exec(line);
+        return match === null ? [] : [{ line: index + 1, text: (match[1] ?? '').trim() }];
+    });
+}
+/** The lines with fenced code blanked and inline code spaced out, keeping every offset. */
+function proseOnly(text) {
+    let fenced = false;
+    return text
+        .split('\n')
+        .map((line) => {
+        if (/^\s*(?:```|~~~)/.test(line)) {
+            fenced = !fenced;
+            return '';
+        }
+        return fenced ? '' : line.replaceAll(/`[^`]*`/g, (code) => ' '.repeat(code.length));
+    })
+        .join('\n');
+}
+/** HTML comments in Markdown prose, line by line. */
+function markdownComments(text) {
+    const prose = proseOnly(text);
+    return [...prose.matchAll(/<!--([\s\S]*?)-->/g)].flatMap((match) => {
+        const first = prose.slice(0, match.index).split('\n').length;
+        return (match[1] ?? '').split('\n').map((body, index) => ({
+            line: first + index,
+            text: body.trim(),
+        }));
+    });
+}
+function commentsOf(file, text) {
+    if (isDockerfile(file) || HASH_CONFIGS.test(file))
+        return hashComments(text);
+    if (MARKDOWN.test(file))
+        return markdownComments(text);
+    return sourceComments(file, text);
+}
+/** Comments with their inline code left out: a directive quoted in prose is not one. */
+function commentTexts(file, text) {
+    return commentsOf(file, text).map((comment) => ({
+        line: comment.line,
+        text: comment.text.replaceAll(/`[^`]*`/g, ' ').trim(),
+    }));
+}
+function attributesFor(file) {
+    if (file.endsWith('.rs'))
+        return RUST_ATTRIBUTES;
+    return POWERSHELL.test(file) ? POWERSHELL_ATTRIBUTES : [];
+}
+function matches(lines, directives) {
+    return lines.flatMap(({ line, text }) => directives
+        .filter((directive) => directive.pattern.test(text))
+        .map((directive) => ({ kind: directive.kind, line, message: directive.message })));
+}
+/**
+ * Every suppression in a file: a directive in a comment that silences a linter, a type checker,
+ * a formatter, coverage, mutation or a scanner, and Rust's and PowerShell's attributes that do
+ * the same. One per kind and line, in line order.
+ */
+export function suppressionsIn(file, text) {
+    const attributes = attributesFor(file);
+    const code = attributes.length === 0
+        ? []
+        : text.split('\n').map((line, index) => ({ line: index + 1, text: line }));
+    const found = [
+        ...matches(commentTexts(file, text), COMMENT_DIRECTIVES),
+        ...matches(code, attributes),
+    ];
+    const seen = new Set();
+    return found
+        .filter((hit) => {
+        const key = `${hit.line}:${hit.kind}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    })
+        .sort((a, b) => a.line - b.line);
+}
+//# sourceMappingURL=suppression-scan.js.map

package/dist/checks/common/suppression-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppression-scan.js","sourceRoot":"","sources":["../../../src/checks/common/suppression-scan.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAElB,qBAAqB,EACrB,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAWjD,MAAM,MAAM,GAAG,SAAS,CAAC;AACzB,MAAM,UAAU,GAAG,cAAc,CAAC;AAClC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAC1C,MAAM,QAAQ,GAAG,qBAAqB,CAAC;AAEvC,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,GAAG,YAAY;IACf,+BAA+B;IAC/B,iCAAiC;IACjC,8BAA8B;IAC9B,sBAAsB;IACtB,oBAAoB;CACrB,CAAC;AAEF,0FAA0F;AAC1F,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,qFAAqF;AACrF,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,GAAG,CAAC,MAAM,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,qDAAqD;AACrD,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACjE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACxD,IAAI,EAAE,KAAK,GAAG,KAAK;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;SAClB,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE;KACtD,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,OAAO,CAAC,KAA6B,EAAE,UAAgC;IAC9E,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CACtC,UAAU;SACP,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACnD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY;IACvD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GACR,UAAU,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,kBAAkB,CAAC;QACxD,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;KAC7B,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACd,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC"}

package/dist/checks/common/suppressions.js

@@ -0,0 +1,26 @@
+import { SUPPRESSION_GLOBS, suppressionsIn } from './suppression-scan.js';
+import { ownTexts } from './texts.js';
+import { APPLIES, skip } from '../../core/check.js';
+async function suppressions(ctx) {
+    const texts = await ownTexts(ctx.root, ctx.facts.matching(...SUPPRESSION_GLOBS));
+    return texts.flatMap(({ file, text }) => suppressionsIn(file, text).map((hit) => ({
+        rule: `suppression/${hit.kind}`,
+        message: hit.message,
+        location: { file, line: hit.line },
+    })));
+}
+/**
+ * Every suppression is a finding, so a new one fails its commit and the ones a repository
+ * already had become debt.
+ */
+export const suppressionsCheck = {
+    id: 'common/suppressions',
+    tier: 'commit',
+    scope: 'repo',
+    title: 'no suppression comments',
+    applies: (ctx) => ctx.facts.has(...SUPPRESSION_GLOBS)
+        ? APPLIES
+        : skip('the repository has no code, scripts, configs or docs'),
+    run: suppressions,
+};
+//# sourceMappingURL=suppressions.js.map

package/dist/checks/common/suppressions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressions.js","sourceRoot":"","sources":["../../../src/checks/common/suppressions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,OAAO,EAAiC,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAGnF,KAAK,UAAU,YAAY,CAAC,GAAiB;IAC3C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CACtC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAW,EAAE,CAAC,CAAC;QAChD,IAAI,EAAE,eAAe,GAAG,CAAC,IAAI,EAAE;QAC/B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;KACnC,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAU;IACtC,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,yBAAyB;IAChC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC;QACjC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC;IAClE,GAAG,EAAE,YAAY;CAClB,CAAC"}

package/dist/checks/common/texts.js

@@ -0,0 +1,34 @@
+import { readFile, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { carriesGeneratedMarker } from '../../configs/header.js';
+/** Larger files are bundles or data, not code anyone wrote. */
+const MAX_BYTES = 2_000_000;
+/** Files read at once, so thousands of them never run out of file handles. */
+const CHUNK = 64;
+async function readOne(root, file) {
+    try {
+        const path = join(root, file);
+        if ((await stat(path)).size > MAX_BYTES)
+            return undefined;
+        return { file, text: await readFile(path, 'utf8') };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The project's own files among `files`: the ones it can read, minus the configs Talos rendered,
+ * which the gate rewrites before any check and so are never the project's to fix.
+ */
+export async function ownTexts(root, files) {
+    const texts = [];
+    for (let start = 0; start < files.length; start += CHUNK) {
+        const chunk = files.slice(start, start + CHUNK);
+        for (const text of await Promise.all(chunk.map((file) => readOne(root, file)))) {
+            if (text !== undefined && !carriesGeneratedMarker(text.text))
+                texts.push(text);
+        }
+    }
+    return texts;
+}
+//# sourceMappingURL=texts.js.map

package/dist/checks/common/texts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"texts.js","sourceRoot":"","sources":["../../../src/checks/common/texts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAKjE,+DAA+D;AAC/D,MAAM,SAAS,GAAG,SAAS,CAAC;AAC5B,8EAA8E;AAC9E,MAAM,KAAK,GAAG,EAAE,CAAC;AAEjB,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,IAAY;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,KAAwB;IACnE,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/checks/docs/claude-md.js

@@ -0,0 +1,71 @@
+import { readText } from './files.js';
+import { APPLIES } from '../../core/check.js';
+import { claudeBlocks, kitBlock, loadKitTemplate, PROJECT_BLOCK_CAP, sameKitBlock, } from '../../docs/claude.js';
+const CLAUDE_MD = 'CLAUDE.md';
+function staleBlock(blocks, rendered) {
+    const { kit } = blocks;
+    if (kit === undefined) {
+        return [
+            {
+                rule: 'claude/stale-block',
+                message: 'CLAUDE.md has no Talos block; regenerate it rather than writing one by hand.',
+                location: { file: CLAUDE_MD, line: 1 },
+            },
+        ];
+    }
+    if (sameKitBlock(kit.text, rendered))
+        return [];
+    return [
+        {
+            rule: 'claude/stale-block',
+            message: "CLAUDE.md's Talos block differs from the one this release renders; regenerate it " +
+                'rather than editing it.',
+            location: { file: CLAUDE_MD, line: kit.line, endLine: kit.endLine },
+        },
+    ];
+}
+function tooLong(file, blocks) {
+    const { project } = blocks;
+    if (project === undefined || project.lines <= PROJECT_BLOCK_CAP)
+        return [];
+    return [
+        {
+            rule: 'claude/too-long',
+            message: `${file} holds ${String(project.lines)} lines of its own, over the cap of ` +
+                `${String(PROJECT_BLOCK_CAP)}; keep instructions there and move the rest into docs/.`,
+            location: { file, line: project.line, endLine: project.endLine },
+        },
+    ];
+}
+async function claudeMd(ctx) {
+    const findings = [];
+    const root = await readText(ctx, CLAUDE_MD);
+    if (root === undefined) {
+        findings.push({
+            rule: 'claude/stale-block',
+            message: 'The repository has no CLAUDE.md; Talos writes it with its block.',
+            key: CLAUDE_MD,
+        });
+    }
+    else {
+        const blocks = claudeBlocks(root);
+        findings.push(...staleBlock(blocks, kitBlock(loadKitTemplate(), ctx.config)));
+        findings.push(...tooLong(CLAUDE_MD, blocks));
+    }
+    for (const file of ctx.facts.matching('**/CLAUDE.md').filter((f) => f !== CLAUDE_MD)) {
+        const text = await readText(ctx, file);
+        if (text !== undefined)
+            findings.push(...tooLong(file, claudeBlocks(text)));
+    }
+    return findings;
+}
+/** `CLAUDE.md`: Talos's block as this release renders it, and a capped block of the project's. */
+export const claudeMdCheck = {
+    id: 'docs/claude-md',
+    tier: 'head',
+    scope: 'repo',
+    title: "CLAUDE.md's Talos block and length",
+    applies: () => APPLIES,
+    run: claudeMd,
+};
+//# sourceMappingURL=claude-md.js.map

package/dist/checks/docs/claude-md.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-md.js","sourceRoot":"","sources":["../../../src/checks/docs/claude-md.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAiC,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EACL,YAAY,EAEZ,QAAQ,EACR,eAAe,EACf,iBAAiB,EACjB,YAAY,GACb,MAAM,sBAAsB,CAAC;AAE9B,MAAM,SAAS,GAAG,WAAW,CAAC;AAE9B,SAAS,UAAU,CAAC,MAAoB,EAAE,QAAgB;IACxD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IACvB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO;YACL;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,8EAA8E;gBACvF,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE;aACvC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,OAAO;QACL;YACE,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EACL,mFAAmF;gBACnF,yBAAyB;YAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;SACpE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAoB;IACjD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,IAAI,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAC3E,OAAO;QACL;YACE,IAAI,EAAE,iBAAiB;YACvB,OAAO,EACL,GAAG,IAAI,UAAU,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,qCAAqC;gBAC3E,GAAG,MAAM,CAAC,iBAAiB,CAAC,yDAAyD;YACvF,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;SACjE;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAiB;IACvC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,kEAAkE;YAC3E,GAAG,EAAE,SAAS;SACf,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,eAAe,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9E,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,aAAa,GAAU;IAClC,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,oCAAoC;IAC3C,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO;IACtB,GAAG,EAAE,QAAQ;CACd,CAAC"}

package/dist/checks/docs/comments.js

@@ -0,0 +1,31 @@
+import { decisionTexts, readOwnTexts } from './files.js';
+import { APPLIES, skip } from '../../core/check.js';
+import { commentProblems, SOURCE_GLOBS } from '../../docs/comments/index.js';
+import { decisionIds } from '../../docs/decisions.js';
+async function comments(ctx) {
+    const decisions = decisionIds(await decisionTexts(ctx));
+    const sources = await readOwnTexts(ctx, ctx.facts.matching(...SOURCE_GLOBS));
+    return sources.flatMap((source) => commentProblems(source.file, source.text, { decisions }).map((problem) => ({
+        rule: problem.rule,
+        message: problem.message,
+        location: {
+            file: source.file,
+            line: problem.line,
+            ...(problem.endLine === undefined ? {} : { endLine: problem.endLine }),
+        },
+    })));
+}
+/**
+ * Comments state invariants, outside constraints, non-obvious reasons and API docs. What can
+ * be told mechanically fails: work markers, references to issues, tickets and decisions,
+ * history, and commented-out code where the language's linter doesn't already find it.
+ */
+export const commentsCheck = {
+    id: 'docs/comments',
+    tier: 'commit',
+    scope: 'repo',
+    title: 'what code comments may say',
+    applies: (ctx) => ctx.facts.has(...SOURCE_GLOBS) ? APPLIES : skip('the repository has no source files'),
+    run: comments,
+};
+//# sourceMappingURL=comments.js.map

package/dist/checks/docs/comments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comments.js","sourceRoot":"","sources":["../../../src/checks/docs/comments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,OAAO,EAAiC,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,KAAK,UAAU,QAAQ,CAAC,GAAiB;IACvC,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC;IAC7E,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAW,EAAE,CAAC,CAAC;QAClF,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;SACvE;KACF,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAU;IAClC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,4BAA4B;IACnC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;IACvF,GAAG,EAAE,QAAQ;CACd,CAAC"}