@svp-labs/talos 0.0.0 → 0.1.0

package/dist/config/load.js

@@ -0,0 +1,41 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { parse } from 'yaml';
+import { z } from 'zod';
+import { talosConfigSchema } from './schema.js';
+export const CONFIG_FILE = 'talos.yml';
+export class ConfigError extends Error {
+    name = 'ConfigError';
+}
+/** Validates `talos.yml`'s text; every problem is listed with its path. */
+export function parseConfig(text, source = CONFIG_FILE) {
+    let raw;
+    try {
+        raw = parse(text);
+    }
+    catch (error) {
+        throw new ConfigError(`${source} is not valid YAML: ${error.message}`);
+    }
+    const result = talosConfigSchema.safeParse(raw ?? {});
+    if (!result.success) {
+        throw new ConfigError(`${source} is invalid:\n${z.prettifyError(result.error)}`);
+    }
+    return result.data;
+}
+/**
+ * The `talos.yml` at `root`. Without one, `fallback` stands in when given: the head's, for a
+ * commit from before the repository adopted Talos, so its run judges the same components.
+ */
+export async function loadConfig(root, fallback) {
+    let text;
+    try {
+        text = await readFile(join(root, CONFIG_FILE), 'utf8');
+    }
+    catch {
+        if (fallback !== undefined)
+            return fallback;
+        throw new ConfigError(`${CONFIG_FILE} not found in ${root}: run \`talos adopt\` first`);
+    }
+    return parseConfig(text);
+}
+//# sourceMappingURL=load.js.map

package/dist/config/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/config/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAElE,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AAEvC,MAAM,OAAO,WAAY,SAAQ,KAAK;IAClB,IAAI,GAAG,aAAa,CAAC;CACxC;AAED,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAM,GAAG,WAAW;IAC5D,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,GAAG,MAAM,uBAAwB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,WAAW,CAAC,GAAG,MAAM,iBAAiB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,QAAsB;IACnE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,IAAI,WAAW,CAAC,GAAG,WAAW,iBAAiB,IAAI,6BAA6B,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC"}

package/dist/config/schema.js

@@ -0,0 +1,75 @@
+import { posix } from 'node:path';
+import { z } from 'zod';
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+/**
+ * A path as every check compares it, by prefix: `./apps/web/` and `apps//web` are `apps/web`,
+ * and the root is `.`.
+ */
+function canonical(path) {
+    const normal = posix.normalize(path);
+    const trimmed = normal.endsWith('/') ? normal.slice(0, -1) : normal;
+    return trimmed === '' ? '.' : trimmed;
+}
+const relativePath = z
+    .string()
+    .min(1)
+    .refine((path) => !path.includes('\\'), { message: 'must use / between directories' })
+    .refine((path) => !path.startsWith('/') && !path.split('/').includes('..'), {
+    message: 'must be a path inside the repository',
+})
+    .transform(canonical);
+const exception = z.strictObject({
+    reason: z.string().min(1),
+    expires: z.string().regex(DATE, 'must be a date, YYYY-MM-DD'),
+});
+const component = z.strictObject({
+    lang: z.enum(['ts', 'py', 'php', 'lua', 'rust']),
+    root: relativePath.default('.'),
+    os: z
+        .array(z.enum(['linux', 'windows', 'macos']))
+        .min(1)
+        .default(['linux']),
+});
+const service = z.strictObject({
+    image: z.string().regex(/@sha256:[0-9a-f]{64}$/, 'must be pinned by digest (image@sha256:…)'),
+    env: z.record(z.string(), z.string()).default({}),
+    ports: z.array(z.number().int().positive()).default([]),
+});
+const customCheck = z.strictObject({
+    run: z.string().min(1),
+    scope: z.enum(['commit', 'head']).default('head'),
+});
+export const talosConfigSchema = z.strictObject({
+    name: z.string().min(1),
+    prefix: z
+        .string()
+        .regex(/^[A-Z][A-Z0-9]{0,5}$/, 'must be 1 to 6 capitals or digits, a capital first'),
+    components: z.array(component).default([]),
+    exclude: z.array(relativePath).default([]),
+    tests: z.strictObject({ full: z.array(relativePath).default([]) }).default({ full: [] }),
+    services: z.record(z.string().regex(/^[a-z][a-z0-9-]*$/), service).default({}),
+    setup: relativePath.optional(),
+    mutation: z.array(relativePath).default([]),
+    size: relativePath.optional(),
+    licences: z.record(z.string().min(1), z.string().min(1)).default({}),
+    docs: z
+        .strictObject({
+        glossary: relativePath.default('docs/glossary.md'),
+        briefs: relativePath.default('docs/requirements'),
+    })
+        .default({ glossary: 'docs/glossary.md', briefs: 'docs/requirements' }),
+    protected: z.array(z.string().min(1)).default([]),
+    checks: z.record(z.string().regex(/^[a-z][a-z0-9-]*$/), customCheck).default({}),
+    agents: z
+        .strictObject({ max_claims: z.number().int().min(1).max(10).default(2) })
+        .default({ max_claims: 2 }),
+    supply_chain: z
+        .strictObject({
+        allow: z
+            .record(z.string().regex(/^.+@[^@]+$/, 'must be name@version'), exception)
+            .default({}),
+        exceptions: z.record(z.string().min(1), exception).default({}),
+    })
+        .default({ allow: {}, exceptions: {} }),
+});
+//# sourceMappingURL=schema.js.map

package/dist/config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,IAAI,GAAG,qBAAqB,CAAC;AAEnC;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACpE,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACxC,CAAC;AAED,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;KACrF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;IAC1E,OAAO,EAAE,sCAAsC;CAChD,CAAC;KACD,SAAS,CAAC,SAAS,CAAC,CAAC;AAExB,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC;CAC9D,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;IAC/B,EAAE,EAAE,CAAC;SACF,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,CAAC;SACN,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,EAAE,2CAA2C,CAAC;IAC7F,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxD,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAClD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,sBAAsB,EAAE,oDAAoD,CAAC;IACtF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACxF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9E,KAAK,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE,IAAI,EAAE,CAAC;SACJ,YAAY,CAAC;QACZ,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAClD,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC;KAClD,CAAC;SACD,OAAO,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChF,MAAM,EAAE,CAAC;SACN,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAC7B,YAAY,EAAE,CAAC;SACZ,YAAY,CAAC;QACZ,KAAK,EAAE,CAAC;aACL,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC;aACzE,OAAO,CAAC,EAAE,CAAC;QACd,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC/D,CAAC;SACD,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;CAC1C,CAAC,CAAC"}

package/dist/configs/drift.js

@@ -0,0 +1,112 @@
+import { createHash } from 'node:crypto';
+import { renderConfigs } from './files.js';
+import { withoutVersion } from './header.js';
+import { APPLIES, EngineError, skip } from '../core/check.js';
+import { generatedTargets } from '../engine/prepare.js';
+import { git, showFile } from '../repo/git.js';
+import { ownVersion } from '../version/self.js';
+function comparable(text) {
+    return withoutVersion(text.replaceAll('\r\n', '\n'));
+}
+function hash(text) {
+    return createHash('sha256').update(text).digest('hex').slice(0, 16);
+}
+/** The 1-based line where two texts first differ. */
+export function firstDifference(committed, rendered) {
+    const ours = committed.split('\n');
+    const theirs = rendered.split('\n');
+    const index = ours.findIndex((line, at) => line !== theirs[at]);
+    return index === -1 ? Math.max(1, ours.length) : index + 1;
+}
+function generatedFinding(file, committed) {
+    const content = committed.contents.get(file.path);
+    if (content === undefined) {
+        return {
+            rule: 'config/drift',
+            key: `${file.path} missing`,
+            message: `${file.path} is missing: run \`talos configs\` to write it.`,
+        };
+    }
+    const ours = comparable(content);
+    if (ours === comparable(file.content))
+        return undefined;
+    const line = firstDifference(ours, comparable(file.content));
+    return {
+        rule: 'config/drift',
+        key: `${file.path} ${hash(content)}`,
+        location: { file: file.path, line },
+        message: `${file.path} differs from what Talos renders, from line ${line}: run \`talos configs\`.`,
+    };
+}
+function extensionFinding(file, committed) {
+    const extension = file.extension;
+    if (extension === undefined || committed.paths.has(extension.path))
+        return undefined;
+    return {
+        rule: 'config/missing-extension',
+        key: extension.path,
+        message: `${extension.path}, the project's extension of ${file.path}, is missing: ` +
+            'run `talos configs` to create it.',
+    };
+}
+/**
+ * Each generated file that is missing or differs from the rendering (its version aside), keyed
+ * by its path and a hash of what is committed: an unchanged stale copy keeps its fingerprint and
+ * is debt, while an edit makes a new one. Each extension file a base imports and the commit
+ * lacks is a finding too.
+ */
+export function driftFindings(rendered, committed) {
+    const extensions = new Set();
+    const findings = [];
+    for (const file of rendered) {
+        const generated = generatedFinding(file, committed);
+        if (generated !== undefined)
+            findings.push(generated);
+        const extension = extensionFinding(file, committed);
+        if (extension !== undefined && !extensions.has(extension.key ?? '')) {
+            extensions.add(extension.key ?? '');
+            findings.push(extension);
+        }
+    }
+    return findings;
+}
+/** The commit's copy of the files, read from git: the working copy holds the rendering. */
+async function readCommitted(ctx, rendered) {
+    const repo = git(ctx.exec, ctx.root);
+    let listing;
+    try {
+        listing = await repo.run(['ls-tree', '-r', '-z', '--name-only', ctx.sha]);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new EngineError(`could not list commit ${ctx.sha.slice(0, 12)}: ${reason}`);
+    }
+    const paths = new Set(listing.split('\0').filter(Boolean));
+    const contents = new Map();
+    for (const file of rendered.filter((f) => paths.has(f.path))) {
+        const content = await showFile(repo, ctx.sha, file.path);
+        if (content !== undefined)
+            contents.set(file.path, content);
+    }
+    return { paths, contents };
+}
+/**
+ * `configs/drift`: the generated files committed at the judged commit against this Talos's
+ * rendering of them, for the packs given.
+ */
+export function driftCheck(packs) {
+    return {
+        id: 'configs/drift',
+        tier: 'head',
+        scope: 'repo',
+        title: 'generated configs as Talos renders them, and their extension files',
+        applies: (ctx) => generatedTargets(packs, ctx).length > 0
+            ? APPLIES
+            : skip('no generated config applies to the repository'),
+        run: async (ctx) => {
+            const rendered = renderConfigs(packs, ctx, ownVersion());
+            return driftFindings(rendered, await readCommitted(ctx, rendered));
+        },
+    };
+}
+//# sourceMappingURL=drift.js.map

package/dist/configs/drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift.js","sourceRoot":"","sources":["../../src/configs/drift.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAuB,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAiC,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG7F,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAQhD,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,QAAgB;IACjE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAoB,EAAE,SAAoB;IAClE,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,UAAU;YAC3B,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,iDAAiD;SACvE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7D,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE;QACpC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;QACnC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,+CAA+C,IAAI,0BAA0B;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAoB,EAAE,SAAoB;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrF,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,GAAG,EAAE,SAAS,CAAC,IAAI;QACnB,OAAO,EACL,GAAG,SAAS,CAAC,IAAI,gCAAgC,IAAI,CAAC,IAAI,gBAAgB;YAC1E,mCAAmC;KACtC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAmC,EACnC,SAAoB;IAEpB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,SAAS,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YACpE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,aAAa,CAC1B,GAAiB,EACjB,QAAmC;IAEnC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,WAAW,CAAC,yBAAyB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,SAAS;YAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,oEAAoE;QAC3E,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;YACrC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,+CAA+C,CAAC;QAC3D,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;YACzD,OAAO,aAAa,CAAC,QAAQ,EAAE,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/configs/files.js

@@ -0,0 +1,35 @@
+import { generatedTargets, targetPath } from '../engine/prepare.js';
+function inComponent(component, path) {
+    return component === undefined || component.root === '.' ? path : `${component.root}/${path}`;
+}
+/**
+ * Every generated file that applies to the repository and its components, rendered at
+ * `version`, each with its extension file's path and initial content. One entry per path.
+ */
+export function renderConfigs(packs, ctx, version) {
+    const byPath = new Map();
+    for (const target of generatedTargets(packs, ctx)) {
+        const render = {
+            config: ctx.config,
+            facts: ctx.facts,
+            version,
+            ...(target.component === undefined ? {} : { component: target.component }),
+        };
+        const path = targetPath(target);
+        const extension = target.file.extension;
+        byPath.set(path, {
+            path,
+            content: target.file.render(render),
+            ...(extension === undefined
+                ? {}
+                : {
+                    extension: {
+                        path: inComponent(target.component, extension.path),
+                        content: extension.initial(render),
+                    },
+                }),
+        });
+    }
+    return [...byPath.values()];
+}
+//# sourceMappingURL=files.js.map

package/dist/configs/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/configs/files.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAQpE,SAAS,WAAW,CAAC,SAAgC,EAAE,IAAY;IACjE,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAsB,EACtB,GAAiB,EACjB,OAAe;IAEf,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAkB;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO;YACP,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;SAC3E,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE;YACf,IAAI;YACJ,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACnC,GAAG,CAAC,SAAS,KAAK,SAAS;gBACzB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,SAAS,EAAE;wBACT,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC;wBACnD,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;qBACnC;iBACF,CAAC;SACP,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC"}

package/dist/configs/header.js

@@ -0,0 +1,31 @@
+/** The marker every generated file carries; the drift check and `talos adopt` look for it. */
+export const GENERATED_MARKER = 'Generated by Talos';
+/**
+ * The first line of a generated file: what wrote it, at which version, and where the project's
+ * own additions go instead.
+ */
+export function generatedHeader(style, version, extension) {
+    const where = extension === undefined
+        ? 'Do not edit.'
+        : `Do not edit: extend it in ${extension}, which may only tighten it.`;
+    return `${style} ${GENERATED_MARKER} ${version}. ${where}\n`;
+}
+/** For JSON files, which carry no comments: the same words under a `//` key. */
+export function generatedJsonNote(version, extension) {
+    return generatedHeader('//', version, extension).slice(3).trim();
+}
+/** How far into a file the marker may sit: the header line, or a JSON file's `//` key. */
+const MARKER_LINES = 3;
+/** Whether a file's text starts with a generated-file header (any pack's). */
+export function carriesGeneratedMarker(text) {
+    return text.split('\n', MARKER_LINES).some((line) => line.includes(GENERATED_MARKER));
+}
+const VERSION_STAMP = new RegExp(`${GENERATED_MARKER} \\S+?\\.(?=\\s|"|$)`, 'g');
+/**
+ * The text with the version in its generated-file header left out, so a copy written by an
+ * earlier release that renders the same rules compares equal to this release's rendering.
+ */
+export function withoutVersion(text) {
+    return text.replaceAll(VERSION_STAMP, `${GENERATED_MARKER}.`);
+}
+//# sourceMappingURL=header.js.map

package/dist/configs/header.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"header.js","sourceRoot":"","sources":["../../src/configs/header.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAIrD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAmB,EAAE,OAAe,EAAE,SAAkB;IACtF,MAAM,KAAK,GACT,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,6BAA6B,SAAS,8BAA8B,CAAC;IAC3E,OAAO,GAAG,KAAK,IAAI,gBAAgB,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC;AAC/D,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,SAAkB;IACnE,OAAO,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnE,CAAC;AAED,0FAA0F;AAC1F,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,GAAG,gBAAgB,sBAAsB,EAAE,GAAG,CAAC,CAAC;AAEjF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,GAAG,gBAAgB,GAAG,CAAC,CAAC;AAChE,CAAC"}

package/dist/configs/index.js

@@ -0,0 +1,8 @@
+import { driftCheck } from './drift.js';
+import { RENDERING_PACKS } from './packs.js';
+/** Generated-file drift: each base config committed as this Talos renders it. */
+export const configsPack = {
+    name: 'configs',
+    checks: [driftCheck(RENDERING_PACKS)],
+};
+//# sourceMappingURL=index.js.map

package/dist/configs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/configs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG7C,iFAAiF;AACjF,MAAM,CAAC,MAAM,WAAW,GAAS;IAC/B,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;CACtC,CAAC"}

package/dist/configs/json.js

@@ -0,0 +1,26 @@
+/** Prettier's line width for every governed repository. */
+const WIDTH = 100;
+function stringArray(prefix, items, comma) {
+    const inline = `${prefix}[${items.map((item) => JSON.stringify(item)).join(', ')}]${comma}`;
+    if (items.length === 0 || inline.length <= WIDTH)
+        return inline;
+    const lines = items.map((item, index) => `    ${JSON.stringify(item)}${index === items.length - 1 ? '' : ','}`);
+    return `${prefix}[\n${lines.join('\n')}\n  ]${comma}`;
+}
+function property(key, value, last) {
+    const prefix = `  ${JSON.stringify(key)}: `;
+    const comma = last ? '' : ',';
+    if (typeof value === 'object')
+        return stringArray(prefix, value, comma);
+    return `${prefix}${JSON.stringify(value)}${comma}`;
+}
+/**
+ * A flat JSON object as Prettier writes it, so a project's formatter leaves the generated file
+ * alone: one key a line, and a list on one line when it fits, else one item a line.
+ */
+export function renderFlatJson(entries) {
+    const pairs = Object.entries(entries);
+    const body = pairs.map(([key, value], index) => property(key, value, index === pairs.length - 1));
+    return `{\n${body.join('\n')}\n}\n`;
+}
+//# sourceMappingURL=json.js.map

package/dist/configs/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../src/configs/json.ts"],"names":[],"mappings":"AAGA,2DAA2D;AAC3D,MAAM,KAAK,GAAG,GAAG,CAAC;AAElB,SAAS,WAAW,CAAC,MAAc,EAAE,KAAwB,EAAE,KAAa;IAC1E,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;IAC5F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,MAAM,CAAC;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CACrB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CACvF,CAAC;IACF,OAAO,GAAG,MAAM,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,KAAgB,EAAE,IAAa;IAC5D,MAAM,MAAM,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACxE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,EAAE,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAA4C;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAClG,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;AACtC,CAAC"}

package/dist/configs/packs.js

@@ -0,0 +1,30 @@
+import { commonPack } from '../checks/common/index.js';
+import { docsPack } from '../checks/docs/index.js';
+import { infraPack } from '../checks/infra/index.js';
+import { runtimePack } from '../checks/runtime/index.js';
+import { securityPack } from '../checks/security/index.js';
+import { supplyPack } from '../checks/supply/index.js';
+import { luaPack } from '../langs/lua/index.js';
+import { phpPack } from '../langs/php/index.js';
+import { pyPack } from '../langs/py/index.js';
+import { rustPack } from '../langs/rust/index.js';
+import { tsPack } from '../langs/ts/index.js';
+/**
+ * The packs whose generated files the drift check compares: the registry's, less the configs
+ * pack, which renders none. The registry lists the configs pack, so the drift check can't read
+ * the registry without an import cycle; a test keeps the two lists the same.
+ */
+export const RENDERING_PACKS = [
+    tsPack,
+    pyPack,
+    phpPack,
+    luaPack,
+    rustPack,
+    commonPack,
+    securityPack,
+    supplyPack,
+    runtimePack,
+    docsPack,
+    infraPack,
+];
+//# sourceMappingURL=packs.js.map

package/dist/configs/packs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packs.js","sourceRoot":"","sources":["../../src/configs/packs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,UAAU;IACV,WAAW;IACX,QAAQ;IACR,SAAS;CACV,CAAC"}

package/dist/core/check.js

@@ -0,0 +1,9 @@
+export const APPLIES = { applies: true };
+export function skip(reason) {
+    return { applies: false, reason };
+}
+/** Thrown by a check that couldn't judge (a tool missing, output it can't read): a Talos bug. */
+export class EngineError extends Error {
+    name = 'EngineError';
+}
+//# sourceMappingURL=check.js.map

package/dist/core/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/core/check.ts"],"names":[],"mappings":"AA2BA,MAAM,CAAC,MAAM,OAAO,GAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAExD,MAAM,UAAU,IAAI,CAAC,MAAc;IACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AA6CD,iGAAiG;AACjG,MAAM,OAAO,WAAY,SAAQ,KAAK;IAClB,IAAI,GAAG,aAAa,CAAC;CACxC"}

package/dist/core/compare.js

@@ -0,0 +1,46 @@
+import { touches } from '../repo/changes.js';
+function countByFingerprint(findings) {
+    const counts = new Map();
+    for (const finding of findings) {
+        counts.set(finding.fingerprint, (counts.get(finding.fingerprint) ?? 0) + 1);
+    }
+    return counts;
+}
+function verdict(finding, isNew, touched) {
+    switch (finding.policy) {
+        case 'always':
+            return { blocking: true, why: 'security' };
+        case 'info':
+            return { blocking: false, why: 'info' };
+        case 'lost':
+            return isNew && !touched
+                ? { blocking: true, why: 'lost' }
+                : { blocking: false, why: 'existing' };
+        case 'standard':
+            if (isNew)
+                return { blocking: true, why: 'new' };
+            return touched
+                ? { blocking: true, why: 'changed-line' }
+                : { blocking: false, why: 'existing' };
+    }
+}
+/**
+ * Judges head's findings against base's. Fingerprints are compared by count, so copying a
+ * violating line adds one; of several occurrences, those on changed lines count as the new ones.
+ */
+export function judge(base, head, changes) {
+    const remaining = countByFingerprint(base);
+    // Base occurrences are matched to untouched lines first, so those on changed lines are new.
+    const ordered = head
+        .map((finding, index) => ({ finding, index, touched: touches(changes, finding.location) }))
+        .sort((a, b) => Number(a.touched) - Number(b.touched));
+    const judged = ordered.map(({ finding, index, touched }) => {
+        const left = remaining.get(finding.fingerprint) ?? 0;
+        const isNew = left === 0;
+        if (!isNew)
+            remaining.set(finding.fingerprint, left - 1);
+        return { index, judged: { ...finding, isNew, ...verdict(finding, isNew, touched) } };
+    });
+    return judged.toSorted((a, b) => a.index - b.index).map((entry) => entry.judged);
+}
+//# sourceMappingURL=compare.js.map

package/dist/core/compare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare.js","sourceRoot":"","sources":["../../src/core/compare.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAW7D,SAAS,kBAAkB,CAAC,QAA6B;IACvD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CACd,OAAiB,EACjB,KAAc,EACd,OAAgB;IAEhB,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,QAAQ;YACX,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAC7C,KAAK,MAAM;YACT,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC1C,KAAK,MAAM;YACT,OAAO,KAAK,IAAI,CAAC,OAAO;gBACtB,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE;gBACjC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAC3C,KAAK,UAAU;YACb,IAAI,KAAK;gBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;YACjD,OAAO,OAAO;gBACZ,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE;gBACzC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,KAAK,CACnB,IAAyB,EACzB,IAAyB,EACzB,OAAkB;IAElB,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3C,4FAA4F;IAC5F,MAAM,OAAO,GAAG,IAAI;SACjB,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;SAC1F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK;YAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IACvF,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACnF,CAAC"}

package/dist/core/component.js

@@ -0,0 +1,57 @@
+import { access } from 'node:fs/promises';
+import { join, posix } from 'node:path';
+import { EngineError, } from './check.js';
+/** The component a component-scoped check runs for. */
+export function componentOf(ctx, lang) {
+    if (ctx.component === undefined)
+        throw new EngineError(`a ${lang} check ran without a component`);
+    return ctx.component;
+}
+/** The component's directory, absolute. */
+export function componentDir(place) {
+    return place.component.root === '.' ? place.root : join(place.root, place.component.root);
+}
+function prefix(root) {
+    let end = root.length;
+    while (end > 0 && root[end - 1] === '/')
+        end -= 1;
+    return root === '.' || end === 0 ? '' : `${root.slice(0, end)}/`;
+}
+/** A repository-relative path made relative to the component's root, or undefined outside it. */
+export function inComponent(root, path) {
+    const start = prefix(root);
+    return path.startsWith(start) ? path.slice(start.length) : undefined;
+}
+/** A component-relative path made repository-relative. */
+export function inRepo(root, path) {
+    return posix.normalize(`${prefix(root)}${path}`);
+}
+export async function fileExists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** The last lines of a tool's output, for an engine error's message. */
+export function tail(result, lines = 15) {
+    return (result.stderr || result.stdout).trim().split('\n').slice(-lines).join('\n');
+}
+export function failed(what, result) {
+    return new EngineError(`${what} exited ${result.code}:\n${tail(result)}`);
+}
+/** A language pack's component check, run with its context bound to the component. */
+export function componentCheck(lang, bind, applies, spec) {
+    return {
+        id: `${lang}/${spec.name}`,
+        tier: spec.tier,
+        scope: 'component',
+        langs: [lang],
+        title: spec.title,
+        applies: spec.applies ?? applies,
+        run: (ctx) => spec.run(bind(ctx)),
+    };
+}
+//# sourceMappingURL=component.js.map

package/dist/core/component.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"component.js","sourceRoot":"","sources":["../../src/core/component.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAML,WAAW,GAIZ,MAAM,YAAY,CAAC;AAWpB,uDAAuD;AACvD,MAAM,UAAU,WAAW,CAAC,GAAuC,EAAE,IAAU;IAC7E,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,IAAI,WAAW,CAAC,KAAK,IAAI,gCAAgC,CAAC,CAAC;IAClG,OAAO,GAAG,CAAC,SAAS,CAAC;AACvB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,YAAY,CAAC,KAAwC;IACnE,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,IAAI,CAAC,CAAC;IAClD,OAAO,IAAI,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;AACnE,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,IAAY;IAC/C,OAAO,KAAK,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,IAAI,CAAC,MAAkB,EAAE,KAAK,GAAG,EAAE;IACjD,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,MAAkB;IACrD,OAAO,IAAI,WAAW,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAUD,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAC5B,IAAU,EACV,IAA8B,EAC9B,OAA6C,EAC7C,IAA2B;IAE3B,OAAO;QACL,EAAE,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE;QAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,WAAW;QAClB,KAAK,EAAE,CAAC,IAAI,CAAC;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO;QAChC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KAClC,CAAC;AACJ,CAAC"}

package/dist/core/finding.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=finding.js.map

package/dist/core/finding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.js","sourceRoot":"","sources":["../../src/core/finding.ts"],"names":[],"mappings":""}

package/dist/core/fingerprint.js

@@ -0,0 +1,29 @@
+import { createHash } from 'node:crypto';
+/** The most lines of a finding's span that go into its fingerprint. */
+const MAX_SPAN = 200;
+/** Collapses whitespace so reindenting or reflowing code keeps a finding's identity. */
+export function normalise(code) {
+    return code.replaceAll(/\s+/g, ' ').trim();
+}
+/** The code a finding points at, or its key, or its message when it points at nothing. */
+export function identity(finding, lines) {
+    if (finding.key !== undefined)
+        return finding.key;
+    const location = finding.location;
+    if (location === undefined || lines === undefined)
+        return finding.message;
+    const first = Math.max(location.line, 1);
+    const last = Math.min(location.endLine ?? first, first + MAX_SPAN - 1, lines.length);
+    const span = lines.slice(first - 1, last).join('\n');
+    return normalise(span) || `${location.file}:empty`;
+}
+/** The rule plus a hash of the normalised code, never the path or line: moved code keeps it. */
+export function fingerprint(rule, identityText) {
+    return createHash('sha256')
+        .update(rule)
+        .update('\0')
+        .update(identityText)
+        .digest('hex')
+        .slice(0, 32);
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/core/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../src/core/fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,uEAAuE;AACvE,MAAM,QAAQ,GAAG,GAAG,CAAC;AAErB,wFAAwF;AACxF,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,QAAQ,CAAC,OAAgB,EAAE,KAAoC;IAC7E,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,QAAQ,CAAC;AACrD,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,YAAoB;IAC5D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC"}