@venizia/dev-configs 0.4.7-0 → 0.4.7-1

package/dist/checks/purity/probe.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.probeEntry = exports.stripBundlerPathComments = exports.GLOBAL_PATTERNS = exports.ProbeSeverities = exports.PURITY_SCRATCH_DIR = void 0;
+exports.PurityProbe = exports.GLOBAL_PATTERNS = exports.ProbeSeverities = exports.PURITY_SCRATCH_DIR = void 0;
 const node_crypto_1 = require("node:crypto");
 const promises_1 = require("node:fs/promises");
 const node_module_1 = require("node:module");
@@ -39,7 +39,7 @@ exports.ProbeSeverities = ProbeSeverities;
  * gate cry wolf on a dependency; the unguarded `process.` and `globalThis.process.` forms stay
  * fatal, and those are the ones that are unambiguously browser-breaking.
  *
- * Exported for `probe.test.ts` to assert against directly, alongside {@link stripBundlerPathComments}.
+ * Exported for `probe.test.ts` to assert against directly, alongside {@link PurityProbe.stripBundlerPathComments}.
  */
 exports.GLOBAL_PATTERNS = [
     { name: 'process', pattern: /(?<![A-Za-z0-9_$.])process\s*\./, severity: 'error' },
@@ -84,15 +84,6 @@ exports.GLOBAL_PATTERNS = [
  * information, so it cannot tell a path comment from code - stripped before matching.
  */
 const BUNDLER_PATH_COMMENT = /^\/\/ [\w@./-]+\.(?:c|m)?js$/gm;
-/**
- * Exported so `probe.test.ts` can assert against the literal collision string directly, without
- * spawning `bun build` - a fixture whose OWN entry-path comment happens to reproduce the collision
- * is not something a filename choice can be relied on to keep reproducing.
- */
-const stripBundlerPathComments = (text) => {
-    return text.replace(BUNDLER_PATH_COMMENT, '');
-};
-exports.stripBundlerPathComments = stripBundlerPathComments;
 /**
  * `node:module`'s own list, not a hand-maintained one: a bare `import ... from 'fs'` bundles
  * identically to `'node:fs'` (Bun stubs both to an empty object), and the metafile records
@@ -177,7 +168,7 @@ const findUnresolvedExternalSpecifiers = (opts) => {
 };
 /**
  * Reads and removes the metafile unconditionally. Returns `undefined` rather than throwing -
- * `probeEntry` reports on every entry it is given rather than aborting the run of the other five.
+ * `PurityProbe.probeEntry` reports on every entry it is given rather than aborting the run of the other five.
  */
 const readMetafile = async (path) => {
     try {
@@ -193,104 +184,114 @@ const readMetafile = async (path) => {
         await (0, promises_1.rm)(path, { force: true });
     }
 };
-/**
- * The CLI, not `Bun.build()`: the in-process bundler resolves this workspace's symlinked
- * dependencies to directories and dies on them.
- */
-const probeEntry = async (opts) => {
-    const { entry, cwd, external = [], scratchDir = (0, node_path_1.join)(cwd, exports.PURITY_SCRATCH_DIR) } = opts;
-    await (0, promises_1.mkdir)(scratchDir, { recursive: true });
-    const metafilePath = (0, node_path_1.join)(scratchDir, `purity-${(0, node_crypto_1.randomUUID)()}.json`);
-    // `--env=disable`: Bun inlines `process.env.NODE_ENV` as a compile-time string constant by
-    // default, regardless of whether the read is reachable. That erases the very read this probe
-    // exists to catch, and the erasure depends on the ambient `NODE_ENV` the probe happens to run
-    // under - the same failure shape as the undetected leak this gate was built to prevent.
-    const externalArgs = external.flatMap((specifier) => ['--external', specifier]);
-    const proc = Bun.spawn([
-        'bun',
-        'build',
-        entry,
-        '--target=browser',
-        '--format=esm',
-        '--env=disable',
-        `--metafile=${metafilePath}`,
-        ...externalArgs,
-    ], { cwd, stdout: 'pipe', stderr: 'pipe' });
-    const [stdout, stderr, exitCode] = await Promise.all([
-        new Response(proc.stdout).text(),
-        new Response(proc.stderr).text(),
-        proc.exited,
-    ]);
-    if (exitCode !== 0) {
-        await (0, promises_1.rm)(metafilePath, { force: true });
-        return {
-            entry,
-            ok: false,
-            sizeBytes: 0,
-            builtins: [],
-            globals: [],
-            guardedGlobals: [],
-            external,
-            buildError: stderr.trim(),
-        };
+class PurityProbe {
+    /**
+     * Public so `probe.test.ts` can assert against the literal collision string directly, without
+     * spawning `bun build` - a fixture whose OWN entry-path comment happens to reproduce the collision
+     * is not something a filename choice can be relied on to keep reproducing.
+     */
+    static stripBundlerPathComments(opts) {
+        return opts.text.replace(BUNDLER_PATH_COMMENT, '');
     }
-    const metafile = await readMetafile(metafilePath);
-    if (!metafile) {
-        return {
+    /**
+     * The CLI, not `Bun.build()`: the in-process bundler resolves this workspace's symlinked
+     * dependencies to directories and dies on them.
+     */
+    static async probeEntry(opts) {
+        const { entry, cwd, external = [], scratchDir = (0, node_path_1.join)(cwd, exports.PURITY_SCRATCH_DIR) } = opts;
+        await (0, promises_1.mkdir)(scratchDir, { recursive: true });
+        const metafilePath = (0, node_path_1.join)(scratchDir, `purity-${(0, node_crypto_1.randomUUID)()}.json`);
+        // `--env=disable`: Bun inlines `process.env.NODE_ENV` as a compile-time string constant by
+        // default, regardless of whether the read is reachable. That erases the very read this probe
+        // exists to catch, and the erasure depends on the ambient `NODE_ENV` the probe happens to run
+        // under - the same failure shape as the undetected leak this gate was built to prevent.
+        const externalArgs = external.flatMap((specifier) => ['--external', specifier]);
+        const proc = Bun.spawn([
+            'bun',
+            'build',
             entry,
-            ok: false,
-            sizeBytes: stdout.length,
-            builtins: [],
-            globals: [],
-            guardedGlobals: [],
-            external,
-            buildError: 'Could not read the bun build metafile - the probe result is not trustworthy',
-        };
-    }
-    const builtins = findBuiltinSpecifiers(metafile);
-    const reachesDevConfigs = Object.keys(metafile.inputs).some((inputPath) => DEV_CONFIGS_PATH.test(inputPath));
-    const unresolvedExternals = findUnresolvedExternalSpecifiers({
-        metafile,
-        builtins: new Set(builtins),
-        requestedExternal: new Set(external),
-    });
-    const scannableText = (0, exports.stripBundlerPathComments)(stdout);
-    const matched = exports.GLOBAL_PATTERNS.filter((g) => g.pattern.test(scannableText));
-    const globals = matched.filter((g) => g.severity === ProbeSeverities.ERROR).map((g) => g.name);
-    const guardedGlobals = matched
-        .filter((g) => g.severity === ProbeSeverities.GUARDED)
-        .map((g) => g.name);
-    if (builtins.length > 0 || unresolvedExternals.length > 0 || reachesDevConfigs) {
-        const reasons = [];
-        if (reachesDevConfigs) {
-            reasons.push('reaches @venizia/dev-configs, which is Bun-only tooling and never a browser dependency');
+            '--target=browser',
+            '--format=esm',
+            '--env=disable',
+            `--metafile=${metafilePath}`,
+            ...externalArgs,
+        ], { cwd, stdout: 'pipe', stderr: 'pipe' });
+        const [stdout, stderr, exitCode] = await Promise.all([
+            new Response(proc.stdout).text(),
+            new Response(proc.stderr).text(),
+            proc.exited,
+        ]);
+        if (exitCode !== 0) {
+            await (0, promises_1.rm)(metafilePath, { force: true });
+            return {
+                entry,
+                ok: false,
+                sizeBytes: 0,
+                builtins: [],
+                globals: [],
+                guardedGlobals: [],
+                external,
+                buildError: stderr.trim(),
+            };
         }
-        if (builtins.length > 0) {
-            reasons.push(`node builtin import(s): ${builtins.join(', ')}`);
+        const metafile = await readMetafile(metafilePath);
+        if (!metafile) {
+            return {
+                entry,
+                ok: false,
+                sizeBytes: stdout.length,
+                builtins: [],
+                globals: [],
+                guardedGlobals: [],
+                external,
+                buildError: 'Could not read the bun build metafile - the probe result is not trustworthy',
+            };
         }
-        if (unresolvedExternals.length > 0) {
-            reasons.push(`unresolved external import(s): ${unresolvedExternals.join(', ')}`);
+        const builtins = findBuiltinSpecifiers(metafile);
+        const reachesDevConfigs = Object.keys(metafile.inputs).some((inputPath) => DEV_CONFIGS_PATH.test(inputPath));
+        const unresolvedExternals = findUnresolvedExternalSpecifiers({
+            metafile,
+            builtins: new Set(builtins),
+            requestedExternal: new Set(external),
+        });
+        const scannableText = PurityProbe.stripBundlerPathComments({ text: stdout });
+        const matched = exports.GLOBAL_PATTERNS.filter((g) => g.pattern.test(scannableText));
+        const globals = matched.filter((g) => g.severity === ProbeSeverities.ERROR).map((g) => g.name);
+        const guardedGlobals = matched
+            .filter((g) => g.severity === ProbeSeverities.GUARDED)
+            .map((g) => g.name);
+        if (builtins.length > 0 || unresolvedExternals.length > 0 || reachesDevConfigs) {
+            const reasons = [];
+            if (reachesDevConfigs) {
+                reasons.push('reaches @venizia/dev-configs, which is Bun-only tooling and never a browser dependency');
+            }
+            if (builtins.length > 0) {
+                reasons.push(`node builtin import(s): ${builtins.join(', ')}`);
+            }
+            if (unresolvedExternals.length > 0) {
+                reasons.push(`unresolved external import(s): ${unresolvedExternals.join(', ')}`);
+            }
+            return {
+                entry,
+                ok: false,
+                sizeBytes: stdout.length,
+                builtins,
+                globals,
+                guardedGlobals,
+                external,
+                buildError: reasons.join(' | '),
+            };
         }
         return {
             entry,
-            ok: false,
+            ok: globals.length === 0,
             sizeBytes: stdout.length,
             builtins,
             globals,
             guardedGlobals,
             external,
-            buildError: reasons.join(' | '),
         };
     }
-    return {
-        entry,
-        ok: globals.length === 0,
-        sizeBytes: stdout.length,
-        builtins,
-        globals,
-        guardedGlobals,
-        external,
-    };
-};
-exports.probeEntry = probeEntry;
+}
+exports.PurityProbe = PurityProbe;
 //# sourceMappingURL=probe.js.map

package/dist/checks/purity/probe.js.map

@@ -1 +1 @@
-{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../../src/checks/purity/probe.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AACzC,+CAA6C;AAC7C,6CAA6C;AAC7C,yCAAiC;AAmBjC,kIAAkI;AACrH,QAAA,kBAAkB,GAAG,mBAAmB,CAAC;AAEtD;;;GAGG;AACH,MAAM,gBAAgB,GACpB,2FAA2F,CAAC;AAE9F,wFAAwF;AACxF,MAAa,eAAe;aACV,UAAK,GAAG,OAAO,CAAC;aAChB,YAAO,GAAG,SAAS,CAAC;aAEpB,eAAU,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,0CASC;AAOD;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,eAAe,GAIvB;IACH,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,iCAAiC,EAAE,QAAQ,EAAE,OAAO,EAAE;IAClF,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,mCAAmC,EAAE,QAAQ,EAAE,SAAS,EAAE;IACxF;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,mDAAmD;QAC5D,QAAQ,EAAE,OAAO;KAClB;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,SAAS;KACpB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,+CAA+C;QACxD,QAAQ,EAAE,OAAO;KAClB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,OAAO;KAClB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,uCAAuC;QAChD,QAAQ,EAAE,OAAO;KAClB;IACD,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,iCAAiC,EAAE,QAAQ,EAAE,OAAO,EAAE;IACnF,6FAA6F;IAC7F,8CAA8C;IAC9C,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,6BAA6B,EAAE,QAAQ,EAAE,OAAO,EAAE;CAC3E,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;AAE9D;;;;GAIG;AACI,MAAM,wBAAwB,GAAG,CAAC,IAAY,EAAU,EAAE;IAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC;AAFW,QAAA,wBAAwB,4BAEnC;AAgBF;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,4BAAc,CAAC,CAAC;AAErD,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAW,EAAE;IACxD,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,OAAO,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,CAAC,QAAmB,EAAY,EAAE;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,MAAM,qBAAqB,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,qBAAqB,EAAE,CAAC;QACvD,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC;YACzD,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,CAAC,SAAiB,EAAW,EAAE;IACzD,OAAO,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,CAAC;AAEF,MAAM,gCAAgC,GAAG,CAAC,IAIzC,EAAY,EAAE;IACb,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,MAAM,mBAAmB,GAAG,CAAC,SAAiB,EAAW,EAAE;QACzD,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,CAAC;YAC1C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC;YACzD,IACE,mBAAmB,CAAC,SAAS,CAAC;gBAC9B,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;gBACvB,mBAAmB,CAAC,SAAS,CAAC,EAC9B,CAAC;gBACD,SAAS;YACX,CAAC;YAED,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,YAAY,GAAG,KAAK,EAAE,IAAY,EAAkC,EAAE;IAC1E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAc,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,CAAC,KAAK,CAAC,iDAAiD,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,MAAM,IAAA,aAAE,EAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,UAAU,GAAG,KAAK,EAAE,IAMhC,EAA0B,EAAE;IAC3B,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,GAAG,EAAE,EAAE,UAAU,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,0BAAkB,CAAC,EAAE,GAAG,IAAI,CAAC;IACvF,MAAM,IAAA,gBAAK,EAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,UAAU,EAAE,UAAU,IAAA,wBAAU,GAAE,OAAO,CAAC,CAAC;IAErE,2FAA2F;IAC3F,6FAA6F;IAC7F,8FAA8F;IAC9F,wFAAwF;IACxF,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CACpB;QACE,KAAK;QACL,OAAO;QACP,KAAK;QACL,kBAAkB;QAClB,cAAc;QACd,eAAe;QACf,cAAc,YAAY,EAAE;QAC5B,GAAG,YAAY;KAChB,EACD,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CACxC,CAAC;IAEF,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;QAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;QAChC,IAAI,CAAC,MAAM;KACZ,CAAC,CAAC;IAEH,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAA,aAAE,EAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO;YACL,KAAK;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,CAAC;YACZ,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE;YACX,cAAc,EAAE,EAAE;YAClB,QAAQ;YACR,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,MAAM,CAAC,MAAM;YACxB,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE;YACX,cAAc,EAAE,EAAE;YAClB,QAAQ;YACR,UAAU,EAAE,6EAA6E;SAC1F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACxE,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CACjC,CAAC;IACF,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;QAC3D,QAAQ;QACR,QAAQ,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC;QAC3B,iBAAiB,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC;KACrC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,IAAA,gCAAwB,EAAC,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,uBAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/F,MAAM,cAAc,GAAG,OAAO;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,eAAe,CAAC,OAAO,CAAC;SACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEtB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,EAAE,CAAC;QAC/E,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CACV,wFAAwF,CACzF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,2BAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,kCAAkC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,OAAO;YACL,KAAK;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,MAAM,CAAC,MAAM;YACxB,QAAQ;YACR,OAAO;YACP,cAAc;YACd,QAAQ;YACR,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK;QACL,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC,MAAM;QACxB,QAAQ;QACR,OAAO;QACP,cAAc;QACd,QAAQ;KACT,CAAC;AACJ,CAAC,CAAC;AAnHW,QAAA,UAAU,cAmHrB","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { mkdir, rm } from 'node:fs/promises';\nimport { builtinModules } from 'node:module';\nimport { join } from 'node:path';\n\nexport interface IPurityResult {\n  entry: string;\n  ok: boolean;\n  sizeBytes: number;\n  builtins: string[];\n  globals: string[];\n  /** Node-global reads that cannot throw in a browser. Reported, never fatal. */\n  guardedGlobals: string[];\n  /**\n   * Specifiers this probe run excluded from its own module graph. Always echoed back, on both the\n   * passing and failing path - an entry that externalises something is measuring less than an entry\n   * that does not, and that must stay visible next to the result, not be a silent input.\n   */\n  external: string[];\n  buildError?: string;\n}\n\n/** Where the probe keeps its metafile, relative to the `cwd` it is given: the repository's own scratch, never the system temp. */\nexport const PURITY_SCRATCH_DIR = '.agents/local/tmp';\n\n/**\n * A browser entry must never reach `@venizia/dev-configs`: it is the Bun-only tooling package (its\n * `./testing` entry imports `bun:test`). Matches the workspace folder (not its own test fixtures) and the installed copy.\n */\nconst DEV_CONFIGS_PATH =\n  /(^|\\/)(packages\\/dev-configs\\/(?!src\\/__tests__\\/)|node_modules\\/@venizia\\/dev-configs\\/)/;\n\n/** What a matched global means: ERROR is fatal, GUARDED is reported and never fatal. */\nexport class ProbeSeverities {\n  static readonly ERROR = 'error';\n  static readonly GUARDED = 'guarded';\n\n  static readonly SCHEME_SET = new Set<string>([this.ERROR, this.GUARDED]);\n\n  static isValid(value: string): value is TProbeSeverity {\n    return this.SCHEME_SET.has(value);\n  }\n}\n\nexport type TProbeSeverity = Extract<\n  (typeof ProbeSeverities)[keyof typeof ProbeSeverities],\n  string\n>;\n\n/**\n * Node globals survive verbatim into a `target: 'browser'` bundle, so a gate reading only module\n * specifiers reports clean on `process.env.NODE_ENV`. Each pattern must be anchored: a bundle\n * legitimately contains identifiers like `processQueue`. A lookbehind that rejects a preceding dot\n * also rejects `globalThis.process`, so every access path needs its own pattern.\n *\n * `severity` separates a read that throws from one that cannot. Optional chaining is not itself the\n * difference: `process?.env` throws a ReferenceError when `process` is a free identifier, while\n * `globalThis.process?.env` is an ordinary property read on an object that always exists.\n *\n * `guarded` means \"reported, never fatal\". Bare `process?.` sits there because this probe matches\n * bundled text and has no scope information: hono's `getColorEnabled` writes\n * `const { process, Deno } = globalThis;` and then `process?.env`, which is a local binding and\n * perfectly safe, and no regex can tell that apart from a free global. Failing on it would make the\n * gate cry wolf on a dependency; the unguarded `process.` and `globalThis.process.` forms stay\n * fatal, and those are the ones that are unambiguously browser-breaking.\n *\n * Exported for `probe.test.ts` to assert against directly, alongside {@link stripBundlerPathComments}.\n */\nexport const GLOBAL_PATTERNS: Array<{\n  name: string;\n  pattern: RegExp;\n  severity: TProbeSeverity;\n}> = [\n  { name: 'process', pattern: /(?<![A-Za-z0-9_$.])process\\s*\\./, severity: 'error' },\n  { name: 'process?.', pattern: /(?<![A-Za-z0-9_$.])process\\s*\\?\\./, severity: 'guarded' },\n  {\n    name: 'globalThis.process',\n    pattern: /(?<![A-Za-z0-9_$.])globalThis\\s*\\.\\s*process\\s*\\./,\n    severity: 'error',\n  },\n  {\n    name: 'globalThis.process?.',\n    pattern: /(?<![A-Za-z0-9_$.])globalThis\\s*\\.\\s*process\\s*\\?\\./,\n    severity: 'guarded',\n  },\n  {\n    name: '__dirname',\n    pattern: /(?<![A-Za-z0-9_$.])__dirname(?![A-Za-z0-9_$])/,\n    severity: 'error',\n  },\n  {\n    name: '__filename',\n    pattern: /(?<![A-Za-z0-9_$.])__filename(?![A-Za-z0-9_$])/,\n    severity: 'error',\n  },\n  {\n    name: 'createRequire',\n    pattern: /(?<![A-Za-z0-9_$.])createRequire\\s*\\(/,\n    severity: 'error',\n  },\n  { name: 'require(', pattern: /(?<![A-Za-z0-9_$.])require\\s*\\(/, severity: 'error' },\n  // Member access only. `typeof Bun !== 'undefined'` is the legitimate runtime probe and never\n  // throws; `Bun.serve(...)` in a browser does.\n  { name: 'Bun', pattern: /(?<![A-Za-z0-9_$.])Bun\\s*\\./, severity: 'error' },\n];\n\n/**\n * Bun's bundler prefixes every CommonJS-wrapped module with a full-line `// <path>.js` header (this\n * whole workspace emits CJS `dist/*.js` - no package declares `\"type\": \"module\"`). A source path is\n * free-form and can legitimately contain `process` as a substring with no identifier boundary on\n * its left, e.g. this gate's own `transport/in-process.js`: the header reads\n * `// packages/core-worker/dist/transport/in-process.js`, and `process.` there is a filename\n * fragment, not a read of the global. `GLOBAL_PATTERNS` matches bundled TEXT with no scope\n * information, so it cannot tell a path comment from code - stripped before matching.\n */\nconst BUNDLER_PATH_COMMENT = /^\\/\\/ [\\w@./-]+\\.(?:c|m)?js$/gm;\n\n/**\n * Exported so `probe.test.ts` can assert against the literal collision string directly, without\n * spawning `bun build` - a fixture whose OWN entry-path comment happens to reproduce the collision\n * is not something a filename choice can be relied on to keep reproducing.\n */\nexport const stripBundlerPathComments = (text: string): string => {\n  return text.replace(BUNDLER_PATH_COMMENT, '');\n};\n\ninterface IMetafileImport {\n  path: string;\n  original?: string;\n  external?: boolean;\n}\n\ninterface IMetafileInput {\n  imports: IMetafileImport[];\n}\n\ninterface IMetafile {\n  inputs: Record<string, IMetafileInput>;\n}\n\n/**\n * `node:module`'s own list, not a hand-maintained one: a bare `import ... from 'fs'` bundles\n * identically to `'node:fs'` (Bun stubs both to an empty object), and the metafile records\n * whichever spelling the source used. Matching by prefix alone misses the bare form entirely.\n */\nconst BUILTIN_MODULE_NAMES = new Set(builtinModules);\n\nconst isBuiltinSpecifier = (specifier: string): boolean => {\n  const bareName = specifier.startsWith('node:') ? specifier.slice('node:'.length) : specifier;\n  return BUILTIN_MODULE_NAMES.has(bareName);\n};\n\n/**\n * Measured against Bun 1.3.14: `--target=browser` never fails on a `node:` import and never leaves\n * the specifier in the bundled text. An unpolyfillable builtin (`fs`, `child_process`, ...) is\n * stubbed to an empty object; a polyfillable one (`crypto`, `path`, ...) is inlined in full under a\n * `/bun-vfs$$/` virtual path. Either way `exitCode` stays 0 and the specifier never survives into\n * stdout. The `--metafile` module graph is the only place it is preserved.\n */\nconst findBuiltinSpecifiers = (metafile: IMetafile): string[] => {\n  const builtins = new Set<string>();\n\n  const metafileInputsEntries = Object.entries(metafile.inputs);\n  for (const [inputPath, input] of metafileInputsEntries) {\n    if (isBuiltinSpecifier(inputPath)) {\n      builtins.add(inputPath);\n    }\n\n    for (const dependency of input.imports) {\n      const specifier = dependency.original ?? dependency.path;\n      if (isBuiltinSpecifier(specifier)) {\n        builtins.add(specifier);\n      }\n    }\n  }\n\n  return [...builtins].sort();\n};\n\n/**\n * A real npm dependency bundles in full under this target (measured: `zod` produces zero\n * `external` entries) and a genuinely missing package fails the build outright (nonzero exit,\n * caught before this runs). But a package's own `browser` field can remap a dependency to `false` -\n * the standard convention for disabling a Node-only dependency in browser builds - and Bun honours\n * that remap by leaving the import external with exit 0, whether or not the remapped name is a\n * builtin. An unresolved import in a browser bundle is not safe to wave through either way -\n * UNLESS the manifest entry asked for exactly this specifier via `external`, in which case its\n * presence here is the requested exclusion working, not a leak.\n */\n/**\n * A relative specifier is the package's own file, and a truly unreachable one fails the build with a\n * nonzero exit, which is caught before this runs. Bun's METAFILE nonetheless marks a re-export of the\n * form `export { name } from './x.js'` as `external` while inlining it - measured on\n * `helpers/dist/esm/core.js`: six such specifiers reported external, `Bundled 192 modules`, and the\n * output contains `class BaseHelper` with no bare relative import left in it. Reading the metafile\n * literally there reports a leak the bundle does not have.\n */\nconst isRelativeSpecifier = (specifier: string): boolean => {\n  return specifier.startsWith('./') || specifier.startsWith('../');\n};\n\nconst findUnresolvedExternalSpecifiers = (opts: {\n  metafile: IMetafile;\n  builtins: Set<string>;\n  requestedExternal: Set<string>;\n}): string[] => {\n  const { metafile, builtins, requestedExternal } = opts;\n  const unresolved = new Set<string>();\n\n  const isRequestedExternal = (specifier: string): boolean => {\n    for (const requested of requestedExternal) {\n      if (specifier === requested || specifier.startsWith(`${requested}/`)) {\n        return true;\n      }\n    }\n    return false;\n  };\n\n  const metafileInputsValues = Object.values(metafile.inputs);\n  for (const input of metafileInputsValues) {\n    for (const dependency of input.imports) {\n      if (!dependency.external) {\n        continue;\n      }\n\n      const specifier = dependency.original ?? dependency.path;\n      if (\n        isRelativeSpecifier(specifier) ||\n        builtins.has(specifier) ||\n        isRequestedExternal(specifier)\n      ) {\n        continue;\n      }\n\n      unresolved.add(specifier);\n    }\n  }\n\n  return [...unresolved].sort();\n};\n\n/**\n * Reads and removes the metafile unconditionally. Returns `undefined` rather than throwing -\n * `probeEntry` reports on every entry it is given rather than aborting the run of the other five.\n */\nconst readMetafile = async (path: string): Promise<IMetafile | undefined> => {\n  try {\n    const result = await Bun.file(path).text();\n    return JSON.parse(result) as IMetafile;\n  } catch (error) {\n    const reason = error instanceof Error ? error.message : String(error);\n    console.error(`[purity] Failed to read the build metafile at ${path}: ${reason}`);\n    return undefined;\n  } finally {\n    await rm(path, { force: true });\n  }\n};\n\n/**\n * The CLI, not `Bun.build()`: the in-process bundler resolves this workspace's symlinked\n * dependencies to directories and dies on them.\n */\nexport const probeEntry = async (opts: {\n  entry: string;\n  cwd: string;\n  external?: string[];\n  /** Defaults to {@link PURITY_SCRATCH_DIR} under `cwd`. */\n  scratchDir?: string;\n}): Promise<IPurityResult> => {\n  const { entry, cwd, external = [], scratchDir = join(cwd, PURITY_SCRATCH_DIR) } = opts;\n  await mkdir(scratchDir, { recursive: true });\n  const metafilePath = join(scratchDir, `purity-${randomUUID()}.json`);\n\n  // `--env=disable`: Bun inlines `process.env.NODE_ENV` as a compile-time string constant by\n  // default, regardless of whether the read is reachable. That erases the very read this probe\n  // exists to catch, and the erasure depends on the ambient `NODE_ENV` the probe happens to run\n  // under - the same failure shape as the undetected leak this gate was built to prevent.\n  const externalArgs = external.flatMap((specifier) => ['--external', specifier]);\n  const proc = Bun.spawn(\n    [\n      'bun',\n      'build',\n      entry,\n      '--target=browser',\n      '--format=esm',\n      '--env=disable',\n      `--metafile=${metafilePath}`,\n      ...externalArgs,\n    ],\n    { cwd, stdout: 'pipe', stderr: 'pipe' },\n  );\n\n  const [stdout, stderr, exitCode] = await Promise.all([\n    new Response(proc.stdout).text(),\n    new Response(proc.stderr).text(),\n    proc.exited,\n  ]);\n\n  if (exitCode !== 0) {\n    await rm(metafilePath, { force: true });\n    return {\n      entry,\n      ok: false,\n      sizeBytes: 0,\n      builtins: [],\n      globals: [],\n      guardedGlobals: [],\n      external,\n      buildError: stderr.trim(),\n    };\n  }\n\n  const metafile = await readMetafile(metafilePath);\n  if (!metafile) {\n    return {\n      entry,\n      ok: false,\n      sizeBytes: stdout.length,\n      builtins: [],\n      globals: [],\n      guardedGlobals: [],\n      external,\n      buildError: 'Could not read the bun build metafile - the probe result is not trustworthy',\n    };\n  }\n\n  const builtins = findBuiltinSpecifiers(metafile);\n  const reachesDevConfigs = Object.keys(metafile.inputs).some((inputPath) =>\n    DEV_CONFIGS_PATH.test(inputPath),\n  );\n  const unresolvedExternals = findUnresolvedExternalSpecifiers({\n    metafile,\n    builtins: new Set(builtins),\n    requestedExternal: new Set(external),\n  });\n  const scannableText = stripBundlerPathComments(stdout);\n  const matched = GLOBAL_PATTERNS.filter((g) => g.pattern.test(scannableText));\n  const globals = matched.filter((g) => g.severity === ProbeSeverities.ERROR).map((g) => g.name);\n  const guardedGlobals = matched\n    .filter((g) => g.severity === ProbeSeverities.GUARDED)\n    .map((g) => g.name);\n\n  if (builtins.length > 0 || unresolvedExternals.length > 0 || reachesDevConfigs) {\n    const reasons: string[] = [];\n    if (reachesDevConfigs) {\n      reasons.push(\n        'reaches @venizia/dev-configs, which is Bun-only tooling and never a browser dependency',\n      );\n    }\n    if (builtins.length > 0) {\n      reasons.push(`node builtin import(s): ${builtins.join(', ')}`);\n    }\n    if (unresolvedExternals.length > 0) {\n      reasons.push(`unresolved external import(s): ${unresolvedExternals.join(', ')}`);\n    }\n\n    return {\n      entry,\n      ok: false,\n      sizeBytes: stdout.length,\n      builtins,\n      globals,\n      guardedGlobals,\n      external,\n      buildError: reasons.join(' | '),\n    };\n  }\n\n  return {\n    entry,\n    ok: globals.length === 0,\n    sizeBytes: stdout.length,\n    builtins,\n    globals,\n    guardedGlobals,\n    external,\n  };\n};\n"]}
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../../src/checks/purity/probe.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AACzC,+CAA6C;AAC7C,6CAA6C;AAC7C,yCAAiC;AAmBjC,kIAAkI;AACrH,QAAA,kBAAkB,GAAG,mBAAmB,CAAC;AAEtD;;;GAGG;AACH,MAAM,gBAAgB,GACpB,2FAA2F,CAAC;AAE9F,wFAAwF;AACxF,MAAa,eAAe;aACV,UAAK,GAAG,OAAO,CAAC;aAChB,YAAO,GAAG,SAAS,CAAC;aAEpB,eAAU,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,0CASC;AAOD;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,eAAe,GAIvB;IACH,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,iCAAiC,EAAE,QAAQ,EAAE,OAAO,EAAE;IAClF,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,mCAAmC,EAAE,QAAQ,EAAE,SAAS,EAAE;IACxF;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,mDAAmD;QAC5D,QAAQ,EAAE,OAAO;KAClB;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,SAAS;KACpB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,+CAA+C;QACxD,QAAQ,EAAE,OAAO;KAClB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,OAAO;KAClB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,uCAAuC;QAChD,QAAQ,EAAE,OAAO;KAClB;IACD,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,iCAAiC,EAAE,QAAQ,EAAE,OAAO,EAAE;IACnF,6FAA6F;IAC7F,8CAA8C;IAC9C,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,6BAA6B,EAAE,QAAQ,EAAE,OAAO,EAAE;CAC3E,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;AAgB9D;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,4BAAc,CAAC,CAAC;AAErD,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAW,EAAE;IACxD,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,OAAO,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,CAAC,QAAmB,EAAY,EAAE;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,MAAM,qBAAqB,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,qBAAqB,EAAE,CAAC;QACvD,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC;YACzD,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,CAAC,SAAiB,EAAW,EAAE;IACzD,OAAO,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,CAAC;AAEF,MAAM,gCAAgC,GAAG,CAAC,IAIzC,EAAY,EAAE;IACb,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,MAAM,mBAAmB,GAAG,CAAC,SAAiB,EAAW,EAAE;QACzD,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,CAAC;YAC1C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC;YACzD,IACE,mBAAmB,CAAC,SAAS,CAAC;gBAC9B,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;gBACvB,mBAAmB,CAAC,SAAS,CAAC,EAC9B,CAAC;gBACD,SAAS;YACX,CAAC;YAED,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,YAAY,GAAG,KAAK,EAAE,IAAY,EAAkC,EAAE;IAC1E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAc,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,CAAC,KAAK,CAAC,iDAAiD,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,MAAM,IAAA,aAAE,EAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;AACH,CAAC,CAAC;AAEF,MAAa,WAAW;IACtB;;;;OAIG;IACH,MAAM,CAAC,wBAAwB,CAAC,IAAsB;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAMvB;QACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,GAAG,EAAE,EAAE,UAAU,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,0BAAkB,CAAC,EAAE,GAAG,IAAI,CAAC;QACvF,MAAM,IAAA,gBAAK,EAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,UAAU,EAAE,UAAU,IAAA,wBAAU,GAAE,OAAO,CAAC,CAAC;QAErE,2FAA2F;QAC3F,6FAA6F;QAC7F,8FAA8F;QAC9F,wFAAwF;QACxF,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CACpB;YACE,KAAK;YACL,OAAO;YACP,KAAK;YACL,kBAAkB;YAClB,cAAc;YACd,eAAe;YACf,cAAc,YAAY,EAAE;YAC5B,GAAG,YAAY;SAChB,EACD,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CACxC,CAAC;QAEF,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACnD,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;YAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;YAChC,IAAI,CAAC,MAAM;SACZ,CAAC,CAAC;QAEH,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAA,aAAE,EAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,OAAO;gBACL,KAAK;gBACL,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,CAAC;gBACZ,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,EAAE;gBACX,cAAc,EAAE,EAAE;gBAClB,QAAQ;gBACR,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE;aAC1B,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,KAAK;gBACL,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,MAAM,CAAC,MAAM;gBACxB,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,EAAE;gBACX,cAAc,EAAE,EAAE;gBAClB,QAAQ;gBACR,UAAU,EAAE,6EAA6E;aAC1F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACxE,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CACjC,CAAC;QACF,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;YAC3D,QAAQ;YACR,QAAQ,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC;YAC3B,iBAAiB,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,WAAW,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,uBAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/F,MAAM,cAAc,GAAG,OAAO;aAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,eAAe,CAAC,OAAO,CAAC;aACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAEtB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,EAAE,CAAC;YAC/E,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CACV,wFAAwF,CACzF,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,2BAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,kCAAkC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnF,CAAC;YAED,OAAO;gBACL,KAAK;gBACL,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,MAAM,CAAC,MAAM;gBACxB,QAAQ;gBACR,OAAO;gBACP,cAAc;gBACd,QAAQ;gBACR,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;aAChC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK;YACL,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;YACxB,SAAS,EAAE,MAAM,CAAC,MAAM;YACxB,QAAQ;YACR,OAAO;YACP,cAAc;YACd,QAAQ;SACT,CAAC;IACJ,CAAC;CACF;AAlID,kCAkIC","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { mkdir, rm } from 'node:fs/promises';\nimport { builtinModules } from 'node:module';\nimport { join } from 'node:path';\n\nexport interface IPurityResult {\n  entry: string;\n  ok: boolean;\n  sizeBytes: number;\n  builtins: string[];\n  globals: string[];\n  /** Node-global reads that cannot throw in a browser. Reported, never fatal. */\n  guardedGlobals: string[];\n  /**\n   * Specifiers this probe run excluded from its own module graph. Always echoed back, on both the\n   * passing and failing path - an entry that externalises something is measuring less than an entry\n   * that does not, and that must stay visible next to the result, not be a silent input.\n   */\n  external: string[];\n  buildError?: string;\n}\n\n/** Where the probe keeps its metafile, relative to the `cwd` it is given: the repository's own scratch, never the system temp. */\nexport const PURITY_SCRATCH_DIR = '.agents/local/tmp';\n\n/**\n * A browser entry must never reach `@venizia/dev-configs`: it is the Bun-only tooling package (its\n * `./testing` entry imports `bun:test`). Matches the workspace folder (not its own test fixtures) and the installed copy.\n */\nconst DEV_CONFIGS_PATH =\n  /(^|\\/)(packages\\/dev-configs\\/(?!src\\/__tests__\\/)|node_modules\\/@venizia\\/dev-configs\\/)/;\n\n/** What a matched global means: ERROR is fatal, GUARDED is reported and never fatal. */\nexport class ProbeSeverities {\n  static readonly ERROR = 'error';\n  static readonly GUARDED = 'guarded';\n\n  static readonly SCHEME_SET = new Set<string>([this.ERROR, this.GUARDED]);\n\n  static isValid(value: string): value is TProbeSeverity {\n    return this.SCHEME_SET.has(value);\n  }\n}\n\nexport type TProbeSeverity = Extract<\n  (typeof ProbeSeverities)[keyof typeof ProbeSeverities],\n  string\n>;\n\n/**\n * Node globals survive verbatim into a `target: 'browser'` bundle, so a gate reading only module\n * specifiers reports clean on `process.env.NODE_ENV`. Each pattern must be anchored: a bundle\n * legitimately contains identifiers like `processQueue`. A lookbehind that rejects a preceding dot\n * also rejects `globalThis.process`, so every access path needs its own pattern.\n *\n * `severity` separates a read that throws from one that cannot. Optional chaining is not itself the\n * difference: `process?.env` throws a ReferenceError when `process` is a free identifier, while\n * `globalThis.process?.env` is an ordinary property read on an object that always exists.\n *\n * `guarded` means \"reported, never fatal\". Bare `process?.` sits there because this probe matches\n * bundled text and has no scope information: hono's `getColorEnabled` writes\n * `const { process, Deno } = globalThis;` and then `process?.env`, which is a local binding and\n * perfectly safe, and no regex can tell that apart from a free global. Failing on it would make the\n * gate cry wolf on a dependency; the unguarded `process.` and `globalThis.process.` forms stay\n * fatal, and those are the ones that are unambiguously browser-breaking.\n *\n * Exported for `probe.test.ts` to assert against directly, alongside {@link PurityProbe.stripBundlerPathComments}.\n */\nexport const GLOBAL_PATTERNS: Array<{\n  name: string;\n  pattern: RegExp;\n  severity: TProbeSeverity;\n}> = [\n  { name: 'process', pattern: /(?<![A-Za-z0-9_$.])process\\s*\\./, severity: 'error' },\n  { name: 'process?.', pattern: /(?<![A-Za-z0-9_$.])process\\s*\\?\\./, severity: 'guarded' },\n  {\n    name: 'globalThis.process',\n    pattern: /(?<![A-Za-z0-9_$.])globalThis\\s*\\.\\s*process\\s*\\./,\n    severity: 'error',\n  },\n  {\n    name: 'globalThis.process?.',\n    pattern: /(?<![A-Za-z0-9_$.])globalThis\\s*\\.\\s*process\\s*\\?\\./,\n    severity: 'guarded',\n  },\n  {\n    name: '__dirname',\n    pattern: /(?<![A-Za-z0-9_$.])__dirname(?![A-Za-z0-9_$])/,\n    severity: 'error',\n  },\n  {\n    name: '__filename',\n    pattern: /(?<![A-Za-z0-9_$.])__filename(?![A-Za-z0-9_$])/,\n    severity: 'error',\n  },\n  {\n    name: 'createRequire',\n    pattern: /(?<![A-Za-z0-9_$.])createRequire\\s*\\(/,\n    severity: 'error',\n  },\n  { name: 'require(', pattern: /(?<![A-Za-z0-9_$.])require\\s*\\(/, severity: 'error' },\n  // Member access only. `typeof Bun !== 'undefined'` is the legitimate runtime probe and never\n  // throws; `Bun.serve(...)` in a browser does.\n  { name: 'Bun', pattern: /(?<![A-Za-z0-9_$.])Bun\\s*\\./, severity: 'error' },\n];\n\n/**\n * Bun's bundler prefixes every CommonJS-wrapped module with a full-line `// <path>.js` header (this\n * whole workspace emits CJS `dist/*.js` - no package declares `\"type\": \"module\"`). A source path is\n * free-form and can legitimately contain `process` as a substring with no identifier boundary on\n * its left, e.g. this gate's own `transport/in-process.js`: the header reads\n * `// packages/core-worker/dist/transport/in-process.js`, and `process.` there is a filename\n * fragment, not a read of the global. `GLOBAL_PATTERNS` matches bundled TEXT with no scope\n * information, so it cannot tell a path comment from code - stripped before matching.\n */\nconst BUNDLER_PATH_COMMENT = /^\\/\\/ [\\w@./-]+\\.(?:c|m)?js$/gm;\n\ninterface IMetafileImport {\n  path: string;\n  original?: string;\n  external?: boolean;\n}\n\ninterface IMetafileInput {\n  imports: IMetafileImport[];\n}\n\ninterface IMetafile {\n  inputs: Record<string, IMetafileInput>;\n}\n\n/**\n * `node:module`'s own list, not a hand-maintained one: a bare `import ... from 'fs'` bundles\n * identically to `'node:fs'` (Bun stubs both to an empty object), and the metafile records\n * whichever spelling the source used. Matching by prefix alone misses the bare form entirely.\n */\nconst BUILTIN_MODULE_NAMES = new Set(builtinModules);\n\nconst isBuiltinSpecifier = (specifier: string): boolean => {\n  const bareName = specifier.startsWith('node:') ? specifier.slice('node:'.length) : specifier;\n  return BUILTIN_MODULE_NAMES.has(bareName);\n};\n\n/**\n * Measured against Bun 1.3.14: `--target=browser` never fails on a `node:` import and never leaves\n * the specifier in the bundled text. An unpolyfillable builtin (`fs`, `child_process`, ...) is\n * stubbed to an empty object; a polyfillable one (`crypto`, `path`, ...) is inlined in full under a\n * `/bun-vfs$$/` virtual path. Either way `exitCode` stays 0 and the specifier never survives into\n * stdout. The `--metafile` module graph is the only place it is preserved.\n */\nconst findBuiltinSpecifiers = (metafile: IMetafile): string[] => {\n  const builtins = new Set<string>();\n\n  const metafileInputsEntries = Object.entries(metafile.inputs);\n  for (const [inputPath, input] of metafileInputsEntries) {\n    if (isBuiltinSpecifier(inputPath)) {\n      builtins.add(inputPath);\n    }\n\n    for (const dependency of input.imports) {\n      const specifier = dependency.original ?? dependency.path;\n      if (isBuiltinSpecifier(specifier)) {\n        builtins.add(specifier);\n      }\n    }\n  }\n\n  return [...builtins].sort();\n};\n\n/**\n * A real npm dependency bundles in full under this target (measured: `zod` produces zero\n * `external` entries) and a genuinely missing package fails the build outright (nonzero exit,\n * caught before this runs). But a package's own `browser` field can remap a dependency to `false` -\n * the standard convention for disabling a Node-only dependency in browser builds - and Bun honours\n * that remap by leaving the import external with exit 0, whether or not the remapped name is a\n * builtin. An unresolved import in a browser bundle is not safe to wave through either way -\n * UNLESS the manifest entry asked for exactly this specifier via `external`, in which case its\n * presence here is the requested exclusion working, not a leak.\n */\n/**\n * A relative specifier is the package's own file, and a truly unreachable one fails the build with a\n * nonzero exit, which is caught before this runs. Bun's METAFILE nonetheless marks a re-export of the\n * form `export { name } from './x.js'` as `external` while inlining it - measured on\n * `helpers/dist/esm/core.js`: six such specifiers reported external, `Bundled 192 modules`, and the\n * output contains `class BaseHelper` with no bare relative import left in it. Reading the metafile\n * literally there reports a leak the bundle does not have.\n */\nconst isRelativeSpecifier = (specifier: string): boolean => {\n  return specifier.startsWith('./') || specifier.startsWith('../');\n};\n\nconst findUnresolvedExternalSpecifiers = (opts: {\n  metafile: IMetafile;\n  builtins: Set<string>;\n  requestedExternal: Set<string>;\n}): string[] => {\n  const { metafile, builtins, requestedExternal } = opts;\n  const unresolved = new Set<string>();\n\n  const isRequestedExternal = (specifier: string): boolean => {\n    for (const requested of requestedExternal) {\n      if (specifier === requested || specifier.startsWith(`${requested}/`)) {\n        return true;\n      }\n    }\n    return false;\n  };\n\n  const metafileInputsValues = Object.values(metafile.inputs);\n  for (const input of metafileInputsValues) {\n    for (const dependency of input.imports) {\n      if (!dependency.external) {\n        continue;\n      }\n\n      const specifier = dependency.original ?? dependency.path;\n      if (\n        isRelativeSpecifier(specifier) ||\n        builtins.has(specifier) ||\n        isRequestedExternal(specifier)\n      ) {\n        continue;\n      }\n\n      unresolved.add(specifier);\n    }\n  }\n\n  return [...unresolved].sort();\n};\n\n/**\n * Reads and removes the metafile unconditionally. Returns `undefined` rather than throwing -\n * `PurityProbe.probeEntry` reports on every entry it is given rather than aborting the run of the other five.\n */\nconst readMetafile = async (path: string): Promise<IMetafile | undefined> => {\n  try {\n    const result = await Bun.file(path).text();\n    return JSON.parse(result) as IMetafile;\n  } catch (error) {\n    const reason = error instanceof Error ? error.message : String(error);\n    console.error(`[purity] Failed to read the build metafile at ${path}: ${reason}`);\n    return undefined;\n  } finally {\n    await rm(path, { force: true });\n  }\n};\n\nexport class PurityProbe {\n  /**\n   * Public so `probe.test.ts` can assert against the literal collision string directly, without\n   * spawning `bun build` - a fixture whose OWN entry-path comment happens to reproduce the collision\n   * is not something a filename choice can be relied on to keep reproducing.\n   */\n  static stripBundlerPathComments(opts: { text: string }): string {\n    return opts.text.replace(BUNDLER_PATH_COMMENT, '');\n  }\n\n  /**\n   * The CLI, not `Bun.build()`: the in-process bundler resolves this workspace's symlinked\n   * dependencies to directories and dies on them.\n   */\n  static async probeEntry(opts: {\n    entry: string;\n    cwd: string;\n    external?: string[];\n    /** Defaults to {@link PURITY_SCRATCH_DIR} under `cwd`. */\n    scratchDir?: string;\n  }): Promise<IPurityResult> {\n    const { entry, cwd, external = [], scratchDir = join(cwd, PURITY_SCRATCH_DIR) } = opts;\n    await mkdir(scratchDir, { recursive: true });\n    const metafilePath = join(scratchDir, `purity-${randomUUID()}.json`);\n\n    // `--env=disable`: Bun inlines `process.env.NODE_ENV` as a compile-time string constant by\n    // default, regardless of whether the read is reachable. That erases the very read this probe\n    // exists to catch, and the erasure depends on the ambient `NODE_ENV` the probe happens to run\n    // under - the same failure shape as the undetected leak this gate was built to prevent.\n    const externalArgs = external.flatMap((specifier) => ['--external', specifier]);\n    const proc = Bun.spawn(\n      [\n        'bun',\n        'build',\n        entry,\n        '--target=browser',\n        '--format=esm',\n        '--env=disable',\n        `--metafile=${metafilePath}`,\n        ...externalArgs,\n      ],\n      { cwd, stdout: 'pipe', stderr: 'pipe' },\n    );\n\n    const [stdout, stderr, exitCode] = await Promise.all([\n      new Response(proc.stdout).text(),\n      new Response(proc.stderr).text(),\n      proc.exited,\n    ]);\n\n    if (exitCode !== 0) {\n      await rm(metafilePath, { force: true });\n      return {\n        entry,\n        ok: false,\n        sizeBytes: 0,\n        builtins: [],\n        globals: [],\n        guardedGlobals: [],\n        external,\n        buildError: stderr.trim(),\n      };\n    }\n\n    const metafile = await readMetafile(metafilePath);\n    if (!metafile) {\n      return {\n        entry,\n        ok: false,\n        sizeBytes: stdout.length,\n        builtins: [],\n        globals: [],\n        guardedGlobals: [],\n        external,\n        buildError: 'Could not read the bun build metafile - the probe result is not trustworthy',\n      };\n    }\n\n    const builtins = findBuiltinSpecifiers(metafile);\n    const reachesDevConfigs = Object.keys(metafile.inputs).some((inputPath) =>\n      DEV_CONFIGS_PATH.test(inputPath),\n    );\n    const unresolvedExternals = findUnresolvedExternalSpecifiers({\n      metafile,\n      builtins: new Set(builtins),\n      requestedExternal: new Set(external),\n    });\n    const scannableText = PurityProbe.stripBundlerPathComments({ text: stdout });\n    const matched = GLOBAL_PATTERNS.filter((g) => g.pattern.test(scannableText));\n    const globals = matched.filter((g) => g.severity === ProbeSeverities.ERROR).map((g) => g.name);\n    const guardedGlobals = matched\n      .filter((g) => g.severity === ProbeSeverities.GUARDED)\n      .map((g) => g.name);\n\n    if (builtins.length > 0 || unresolvedExternals.length > 0 || reachesDevConfigs) {\n      const reasons: string[] = [];\n      if (reachesDevConfigs) {\n        reasons.push(\n          'reaches @venizia/dev-configs, which is Bun-only tooling and never a browser dependency',\n        );\n      }\n      if (builtins.length > 0) {\n        reasons.push(`node builtin import(s): ${builtins.join(', ')}`);\n      }\n      if (unresolvedExternals.length > 0) {\n        reasons.push(`unresolved external import(s): ${unresolvedExternals.join(', ')}`);\n      }\n\n      return {\n        entry,\n        ok: false,\n        sizeBytes: stdout.length,\n        builtins,\n        globals,\n        guardedGlobals,\n        external,\n        buildError: reasons.join(' | '),\n      };\n    }\n\n    return {\n      entry,\n      ok: globals.length === 0,\n      sizeBytes: stdout.length,\n      builtins,\n      globals,\n      guardedGlobals,\n      external,\n    };\n  }\n}\n"]}

package/dist/checks/purity/run.d.ts

@@ -28,20 +28,22 @@ export interface IPurityReport {
     waived: number;
     checked: number;
 }
-/**
- * Probes every row of the claims and returns the report. `print` receives the human report line by
- * line, in the exact shape the repository scripts printed before the engine moved here.
- */
-export declare const checkPurity: (opts: {
-    root: string;
-    claims: IPurityClaim[];
-    options?: IPurityOptions;
-    /** Only the rows of this package; a token that matches nothing is a broken gate and returns `undefined`. */
-    filter?: string;
-    /** The claims file, repository-relative, named in the hint printed for a stale waiver. */
-    claimsFile: string;
-    print: (line: string) => void;
-    /** Where the no-match message goes (stderr for the command): it is an error, not a report line. */
-    printError: (line: string) => void;
-}) => Promise<IPurityReport | undefined>;
+export declare class PurityCheck {
+    /**
+     * Probes every row of the claims and returns the report. `print` receives the human report line by
+     * line, in the exact shape the repository scripts printed before the engine moved here.
+     */
+    static run(opts: {
+        root: string;
+        claims: IPurityClaim[];
+        options?: IPurityOptions;
+        /** Only the rows of this package; a token that matches nothing is a broken gate and returns `undefined`. */
+        filter?: string;
+        /** The claims file, repository-relative, named in the hint printed for a stale waiver. */
+        claimsFile: string;
+        print: (line: string) => void;
+        /** Where the no-match message goes (stderr for the command): it is an error, not a report line. */
+        printError: (line: string) => void;
+    }): Promise<IPurityReport | undefined>;
+}
 //# sourceMappingURL=run.d.ts.map

package/dist/checks/purity/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/checks/purity/run.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAgB,cAAc,EAAE,MAAM,YAAY,CAAC;AAI7E,oFAAoF;AACpF,qBAAa,cAAc;IACzB,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IACpC,MAAM,CAAC,QAAQ,CAAC,YAAY,kBAAkB;IAE9C,MAAM,CAAC,QAAQ,CAAC,UAAU,cAMvB;IAEH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,cAAc;CAGvD;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;AAEnG,gHAAgH;AAChH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,cAAc,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAID;;;GAGG;AACH,eAAO,MAAM,WAAW,GAAU,MAAM;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,4GAA4G;IAC5G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,mGAAmG;IACnG,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC,KAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAgHpC,CAAC"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/checks/purity/run.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAgB,cAAc,EAAE,MAAM,YAAY,CAAC;AAI7E,oFAAoF;AACpF,qBAAa,cAAc;IACzB,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IACpC,MAAM,CAAC,QAAQ,CAAC,YAAY,kBAAkB;IAE9C,MAAM,CAAC,QAAQ,CAAC,UAAU,cAMvB;IAEH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,cAAc;CAGvD;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;AAEnG,gHAAgH;AAChH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,cAAc,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,qBAAa,WAAW;IACtB;;;OAGG;WACU,GAAG,CAAC,IAAI,EAAE;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,EAAE,cAAc,CAAC;QACzB,4GAA4G;QAC5G,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,0FAA0F;QAC1F,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAC9B,mGAAmG;QACnG,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;KACpC,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;CAsHvC"}

package/dist/checks/purity/run.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkPurity = exports.PurityVerdicts = void 0;
+exports.PurityCheck = exports.PurityVerdicts = void 0;
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const manifest_1 = require("./manifest");
@@ -25,97 +25,101 @@ class PurityVerdicts {
 }
 exports.PurityVerdicts = PurityVerdicts;
 const formatList = (values) => values.join(', ') || 'none';
-/**
- * Probes every row of the claims and returns the report. `print` receives the human report line by
- * line, in the exact shape the repository scripts printed before the engine moved here.
- */
-const checkPurity = async (opts) => {
-    const { root, claims, options, filter, claimsFile, print, printError } = opts;
-    const manifest = (0, manifest_1.buildManifest)({ claims, root, options });
-    const rows = filter ? manifest.filter((row) => row.package === filter) : manifest;
-    // Non-zero, not a friendly note: a mistyped `package` or a renamed directory would otherwise turn
-    // a release-blocking gate into a silent no-op that still reports success.
-    if (rows.length === 0) {
-        const known = [...new Set(manifest.map((row) => row.package))].sort().join(', ');
-        printError(`[purity] No manifest entry matches "${filter}" | Known packages: ${known} - a filter that ` +
-            `matches nothing is a broken gate, not an empty one.`);
-        return undefined;
-    }
-    const labelWidth = Math.max(...rows.map((row) => row.label.length));
-    const verdicts = [];
-    let failed = 0;
-    let waived = 0;
-    for (const row of rows) {
-        const entry = (0, node_path_1.join)(root, row.entry);
-        // The `exports` map is the source of these rows, so a missing file is either an unbuilt package
-        // or a manifest pointing at something the build never emits - both fatal, and neither is worth
-        // reporting as a bundler error twenty lines long.
-        if (!(0, node_fs_1.existsSync)(entry)) {
-            failed += 1;
-            print(`  ✗ ${row.label.padEnd(labelWidth)} MISSING ${row.entry}`);
-            print(`    The package's \`exports\` map points here and nothing is built - run \`make ${row.package}\``);
-            verdicts.push({ label: row.label, entry: row.entry, verdict: PurityVerdicts.MISSING });
-            continue;
+class PurityCheck {
+    /**
+     * Probes every row of the claims and returns the report. `print` receives the human report line by
+     * line, in the exact shape the repository scripts printed before the engine moved here.
+     */
+    static async run(opts) {
+        const { root, claims, options, filter, claimsFile, print, printError } = opts;
+        const manifest = manifest_1.PurityManifest.build({ claims, root, options });
+        const rows = filter
+            ? manifest.filter((row) => row.package === filter)
+            : manifest;
+        // Non-zero, not a friendly note: a mistyped `package` or a renamed directory would otherwise turn
+        // a release-blocking gate into a silent no-op that still reports success.
+        if (rows.length === 0) {
+            const known = [...new Set(manifest.map((row) => row.package))].sort().join(', ');
+            printError(`[purity] No manifest entry matches "${filter}" | Known packages: ${known} - a filter that ` +
+                `matches nothing is a broken gate, not an empty one.`);
+            return undefined;
         }
-        const result = await (0, probe_1.probeEntry)({
-            entry,
-            cwd: root,
-            external: row.external,
-        });
-        const detail = {
-            label: row.label,
-            entry: row.entry,
-            sizeBytes: result.sizeBytes,
-            builtins: result.builtins,
-            globals: result.globals,
-            guardedGlobals: result.guardedGlobals,
-            external: result.external,
-            // The bundler's message names absolute paths; the verdict must read the same on any machine.
-            ...(result.buildError ? { buildError: result.buildError.replaceAll(root, '<root>') } : {}),
-        };
-        // Guarded reads are printed on the passing path too: they are safe, but a reviewer needs to
-        // see that the entry is clean by construction and not merely by the shape of one expression.
-        const guarded = result.guardedGlobals.length > 0 ? ` | guarded: ${result.guardedGlobals.join(', ')}` : '';
-        // Same reasoning as `guarded`, printed on both paths: an entry that externalises a dependency
-        // measures less than one that does not, and that must stay visible next to the verdict.
-        const external = result.external.length > 0 ? ` | external: ${result.external.join(', ')}` : '';
-        // Checked before the normal verdict, because for a waived row the two outcomes swap meaning.
-        if (row.expectImpure) {
-            // A waived entry that comes back pure fails: the waiver now describes something untrue, and
-            // the reader who trusts it next will be trusting it about a different entry.
-            if (result.ok) {
+        const labelWidth = Math.max(...rows.map((row) => row.label.length));
+        const verdicts = [];
+        let failed = 0;
+        let waived = 0;
+        for (const row of rows) {
+            const entry = (0, node_path_1.join)(root, row.entry);
+            // The `exports` map is the source of these rows, so a missing file is either an unbuilt package
+            // or a manifest pointing at something the build never emits - both fatal, and neither is worth
+            // reporting as a bundler error twenty lines long.
+            if (!(0, node_fs_1.existsSync)(entry)) {
                 failed += 1;
-                print(`  ✗ ${row.label.padEnd(labelWidth)} STALE WAIVER - this entry is browser-pure now`);
-                print(`    Drop it from \`impure\` in ${claimsFile} so the gate measures it again`);
-                verdicts.push({ ...detail, verdict: PurityVerdicts.STALE_WAIVER });
+                print(`  ✗ ${row.label.padEnd(labelWidth)} MISSING ${row.entry}`);
+                print(`    The package's \`exports\` map points here and nothing is built - run \`make ${row.package}\``);
+                verdicts.push({ label: row.label, entry: row.entry, verdict: PurityVerdicts.MISSING });
                 continue;
             }
-            waived += 1;
-            print(`  ~ ${row.label.padEnd(labelWidth)} waived | builtins: ${formatList(result.builtins)} | globals: ${formatList(result.globals)}${external}`);
-            verdicts.push({ ...detail, verdict: PurityVerdicts.WAIVED });
-            continue;
+            const result = await probe_1.PurityProbe.probeEntry({
+                entry,
+                cwd: root,
+                external: row.external,
+            });
+            const detail = {
+                label: row.label,
+                entry: row.entry,
+                sizeBytes: result.sizeBytes,
+                builtins: result.builtins,
+                globals: result.globals,
+                guardedGlobals: result.guardedGlobals,
+                external: result.external,
+                // The bundler's message names absolute paths; the verdict must read the same on any machine.
+                ...(result.buildError ? { buildError: result.buildError.replaceAll(root, '<root>') } : {}),
+            };
+            // Guarded reads are printed on the passing path too: they are safe, but a reviewer needs to
+            // see that the entry is clean by construction and not merely by the shape of one expression.
+            const guarded = result.guardedGlobals.length > 0 ? ` | guarded: ${result.guardedGlobals.join(', ')}` : '';
+            // Same reasoning as `guarded`, printed on both paths: an entry that externalises a dependency
+            // measures less than one that does not, and that must stay visible next to the verdict.
+            const external = result.external.length > 0 ? ` | external: ${result.external.join(', ')}` : '';
+            // Checked before the normal verdict, because for a waived row the two outcomes swap meaning.
+            if (row.expectImpure) {
+                // A waived entry that comes back pure fails: the waiver now describes something untrue, and
+                // the reader who trusts it next will be trusting it about a different entry.
+                if (result.ok) {
+                    failed += 1;
+                    print(`  ✗ ${row.label.padEnd(labelWidth)} STALE WAIVER - this entry is browser-pure now`);
+                    print(`    Drop it from \`impure\` in ${claimsFile} so the gate measures it again`);
+                    verdicts.push({ ...detail, verdict: PurityVerdicts.STALE_WAIVER });
+                    continue;
+                }
+                waived += 1;
+                print(`  ~ ${row.label.padEnd(labelWidth)} waived | builtins: ${formatList(result.builtins)} | globals: ${formatList(result.globals)}${external}`);
+                verdicts.push({ ...detail, verdict: PurityVerdicts.WAIVED });
+                continue;
+            }
+            if (result.ok) {
+                print(`  ✓ ${row.label.padEnd(labelWidth)} ${(result.sizeBytes / 1024).toFixed(1)} KB${guarded}${external}`);
+                verdicts.push({ ...detail, verdict: PurityVerdicts.PASS });
+                continue;
+            }
+            failed += 1;
+            print(`  ✗ ${row.label.padEnd(labelWidth)} builtins: ${formatList(result.builtins)} | globals: ${formatList(result.globals)}${guarded}${external}`);
+            if (result.buildError) {
+                print(`    ${result.buildError.split('\n')[0]}`);
+            }
+            verdicts.push({ ...detail, verdict: PurityVerdicts.FAIL });
         }
-        if (result.ok) {
-            print(`  ✓ ${row.label.padEnd(labelWidth)} ${(result.sizeBytes / 1024).toFixed(1)} KB${guarded}${external}`);
-            verdicts.push({ ...detail, verdict: PurityVerdicts.PASS });
-            continue;
+        const note = waived > 0 ? ` (${waived} waived as known-impure)` : '';
+        if (failed > 0) {
+            print(`\n[purity] ${failed}/${rows.length} entries are not browser-pure${note}.`);
         }
-        failed += 1;
-        print(`  ✗ ${row.label.padEnd(labelWidth)} builtins: ${formatList(result.builtins)} | globals: ${formatList(result.globals)}${guarded}${external}`);
-        if (result.buildError) {
-            print(`    ${result.buildError.split('\n')[0]}`);
+        else {
+            const checked = rows.length - waived;
+            print(`\n[purity] ${checked}/${checked} entries are browser-pure${note}.`);
         }
-        verdicts.push({ ...detail, verdict: PurityVerdicts.FAIL });
+        return { rows: verdicts, failed, waived, checked: rows.length - waived };
     }
-    const note = waived > 0 ? ` (${waived} waived as known-impure)` : '';
-    if (failed > 0) {
-        print(`\n[purity] ${failed}/${rows.length} entries are not browser-pure${note}.`);
-    }
-    else {
-        const checked = rows.length - waived;
-        print(`\n[purity] ${checked}/${checked} entries are browser-pure${note}.`);
-    }
-    return { rows: verdicts, failed, waived, checked: rows.length - waived };
-};
-exports.checkPurity = checkPurity;
+}
+exports.PurityCheck = PurityCheck;
 //# sourceMappingURL=run.js.map