carveout 0.2.0 → 0.3.0

package/dist/src/pseudonyms/legacy/vocabulary-v1.js

@@ -0,0 +1,460 @@
+// Frozen: sandbox-factory's packages/core/src/sandbox/vocabulary.ts as of its
+// commit f31d780, the renaming every platform version built before carveout
+// 0.3.0 was made with. Never edited: a version carries back only under the
+// renaming it was built with. carveout's own is ../vocabulary.ts. Exported, with a
+// V1 suffix, from ../legacy.ts.
+/** Shorter names, separators aside, match too much to block on. */
+export const VOCABULARY_TERM_MIN = 4;
+/** Files a leak's detail names before it counts the rest. */
+const LEAK_FILES_SHOWN = 5;
+const LETTER = /\p{L}/u;
+const UPPER = /\p{Lu}/u;
+const LOWER = /\p{Ll}/u;
+const DIGIT = /\p{N}/u;
+const is = (pattern, char) => char !== undefined && pattern.test(char);
+/** Words any workspace might name itself with, which say nothing about whose. */
+const GENERIC_WORDS = new Set([
+    "admin",
+    "android",
+    "api",
+    "app",
+    "apps",
+    "backend",
+    "client",
+    "code",
+    "common",
+    "company",
+    "core",
+    "corp",
+    "dashboard",
+    "demo",
+    "docs",
+    "example",
+    "frontend",
+    "internal",
+    "ios",
+    "lib",
+    "libs",
+    "local",
+    "main",
+    "mobile",
+    "mono",
+    "monorepo",
+    "packages",
+    "personal",
+    "platform",
+    "private",
+    "project",
+    "repo",
+    "root",
+    "server",
+    "service",
+    "services",
+    "shared",
+    "site",
+    "src",
+    "team",
+    "test",
+    "tests",
+    "utils",
+    "web",
+    "website",
+    "workspace",
+    "www",
+]);
+/**
+ * Words an organization's name is made of that say nothing about which
+ * organization: its legal form, its trade and the words code uses anyway.
+ * Matched whole, they are part of its name; alone, they are not scanned for.
+ */
+const ORGANIZATION_WORDS = new Set([
+    "academy",
+    "agency",
+    "airlines",
+    "analytics",
+    "bank",
+    "bhd",
+    "capital",
+    "cloud",
+    "co",
+    "communications",
+    "construction",
+    "consulting",
+    "corporation",
+    "data",
+    "design",
+    "digital",
+    "education",
+    "email",
+    "energy",
+    "engineering",
+    "enterprise",
+    "enterprises",
+    "finance",
+    "financial",
+    "foods",
+    "foundation",
+    "games",
+    "global",
+    "gmbh",
+    "group",
+    "health",
+    "holding",
+    "holdings",
+    "inc",
+    "incorporated",
+    "industries",
+    "info",
+    "insurance",
+    "interactive",
+    "international",
+    "labs",
+    "limited",
+    "llc",
+    "llp",
+    "logistics",
+    "ltd",
+    "mail",
+    "manufacturing",
+    "marketing",
+    "media",
+    "medical",
+    "motors",
+    "network",
+    "networks",
+    "official",
+    "online",
+    "open",
+    "partners",
+    "payments",
+    "pharma",
+    "plc",
+    "properties",
+    "pt",
+    "pte",
+    "pty",
+    "realty",
+    "retail",
+    "sdn",
+    "shop",
+    "software",
+    "solutions",
+    "source",
+    "store",
+    "studio",
+    "studios",
+    "supply",
+    "systems",
+    "tbk",
+    "tech",
+    "technologies",
+    "technology",
+    "telecom",
+    "trading",
+    "transport",
+    "ventures",
+    "work",
+    "works",
+]);
+/**
+ * Everyday English words an organization's name is often made of (`First
+ * Choice`, `Blue Harbor`, `Bright Path`) that code also uses for itself
+ * (`firstName`, `blueButton`, `pathname`). Matched whole, they are part of
+ * its name; alone, they are not scanned for. Brand-like words (`acme`,
+ * `payflow`) are deliberately absent.
+ */
+const COMMON_WORDS = new Set(("able about above access account action active actual advance after " +
+    "again agent alert align alpha amber anchor angle apex apple area " +
+    "army arrow asset atlas atom audio auto avenue away back badge " +
+    "balance band base basic beach beacon bear beat bell best beta better " +
+    "beyond bird black blank blaze block blue board body bold bolt bond " +
+    "book boost border boss bound brain branch brand brave bread break " +
+    "bridge bright broad brown budget build bull button cache call camp " +
+    "canvas card care cargo carbon case cash castle catch cedar cell " +
+    "center central chain change channel charge chart chase check chef " +
+    "cherry chief choice circle city civic class clean clear click climb " +
+    "clock close cloud coast coin color comet command compass connect " +
+    "contact content control coral count country county cove craft crane " +
+    "create credit crest cross crown crystal cube current custom cycle " +
+    "daily dash date dawn deal deep delta desk detail direct domain door " +
+    "double dove draft dragon dream drive drop eagle early earth east " +
+    "easy echo eden edge elite ember empire entry equal ever event every " +
+    "exact expert express fair faith falcon family farm fast field fire " +
+    "first fish flag flash fleet flex flight float flow focus force " +
+    "forest form forward fountain free fresh front frost fuel full fund " +
+    "fusion future galaxy game garden gate gear giant gold golden good " +
+    "grand graph great green grid ground grove guard guide happy harbor " +
+    "harbour harmony hawk head heart helix help hero high hill home honey " +
+    "hope horizon host house human idea image impact index inner input " +
+    "insight iron island item jade join journey jump just keep kind king " +
+    "kite label land large laser last launch layer leader leaf legacy " +
+    "level liberty life light lime line link lion list little live local " +
+    "lock logic long loop lotus love lucky lunar magic main major maple " +
+    "mark market master match matrix meadow mega member mercury merit " +
+    "meta metro middle mind mint mission mode model modern moment monster " +
+    "moon motion mountain move name nation national native nature navy " +
+    "near nest next noble node north nova number oasis ocean office omega " +
+    "orange orbit order origin output pacific page palm panda panel paper " +
+    "park path peak pearl people phoenix photo pilot pine pink pixel " +
+    "place plan planet plus pocket point polar portal post power premier " +
+    "press prime profile progress pulse pure purple quality quantum quest " +
+    "quick radar rain rainbow range rapid raven ready real record region " +
+    "reliable result ridge right ring rise river road rock rocket rose " +
+    "round royal ruby safe sage sail sales salt scale scope search secure " +
+    "select sense series shape share shield shift signal silver simple " +
+    "single smart snow social solar solid sound south space spark speed " +
+    "sphere spirit spring square stack standard star start state status " +
+    "steel step stone storm stream street strong summit sunrise super " +
+    "swift table talent target task team terra thunder tide tiger time " +
+    "title today token total touch tower track trade trail tree trend " +
+    "tribe trinity true trust truth turbo twin union unique united unity " +
+    "urban user valley value vector venture vertex view village vision " +
+    "vista vital voice wave west white wild wind wing winter wise wolf " +
+    "wood world year yellow young zero zone").split(" "));
+/**
+ * Mail providers anyone may have an address at: an author's address there
+ * says who they are, not whom they work for.
+ */
+const PUBLIC_MAIL_DOMAINS = new Set([
+    "163.com",
+    "aol.com",
+    "fastmail.com",
+    "gmail.com",
+    "gmx.com",
+    "gmx.de",
+    "gmx.net",
+    "googlemail.com",
+    "hey.com",
+    "hotmail.com",
+    "icloud.com",
+    "live.com",
+    "mac.com",
+    "mail.com",
+    "me.com",
+    "msn.com",
+    "outlook.com",
+    "pm.me",
+    "proton.me",
+    "protonmail.com",
+    "qq.com",
+    "tutanota.com",
+    "users.noreply.github.com",
+    "yahoo.com",
+    "yandex.com",
+    "yandex.ru",
+    "ymail.com",
+    "zoho.com",
+]);
+/** Names that say who the organization is, to be scanned word by word too. */
+export function organizationNames(names) {
+    return names.map((name) => ({ name, kind: "organization" }));
+}
+/**
+ * The names the slice's privately hosted packages give (see the module
+ * comment): one of the workspace's own, or one a lockfile or `.npmrc` says
+ * comes from another registry. A package nothing says is public is mocked
+ * too, but by default, so it is not one.
+ */
+export function privatePackageNames(packages) {
+    const names = [];
+    for (const item of packages) {
+        if (item.workspace !== true && item.registry?.source !== "private")
+            continue;
+        const slash = item.name.indexOf("/");
+        if (item.name.startsWith("@") && slash > 1)
+            names.push({ name: item.name.slice(1, slash), kind: "organization" });
+        else if (termWords(item.name).length > 1)
+            names.push({ name: item.name, kind: "name" });
+    }
+    return names;
+}
+/** Shared and automated mailboxes: they name a function, not a person. */
+const ROLE_MAILBOXES = new Set([
+    "abuse",
+    "accounts",
+    "admin",
+    "billing",
+    "bot",
+    "careers",
+    "ci",
+    "contact",
+    "dev",
+    "developer",
+    "developers",
+    "devops",
+    "engineering",
+    "github",
+    "hello",
+    "help",
+    "hi",
+    "hostmaster",
+    "hr",
+    "info",
+    "it",
+    "jobs",
+    "legal",
+    "mail",
+    "maintainers",
+    "marketing",
+    "noreply",
+    "npm",
+    "office",
+    "ops",
+    "opensource",
+    "oss",
+    "postmaster",
+    "press",
+    "privacy",
+    "release",
+    "releases",
+    "root",
+    "sales",
+    "security",
+    "support",
+    "team",
+    "tech",
+    "webmaster",
+]);
+/**
+ * The names a package author's address gives: its local part unless a role
+ * mailbox's (`support@`) or without a letter, and its domain as the
+ * organization's unless it is a public mail provider's. A GitHub noreply
+ * address (`12345+octocat@users.noreply.github.com`) gives the login after
+ * the `+`; any other drops its `+tag`.
+ */
+export function emailNames(email) {
+    const at = email.lastIndexOf("@");
+    if (at <= 0)
+        return [];
+    const domain = email
+        .slice(at + 1)
+        .trim()
+        .toLowerCase();
+    const address = email.slice(0, at).trim();
+    const plus = address.indexOf("+");
+    const local = plus === -1
+        ? address
+        : domain === "users.noreply.github.com"
+            ? address.slice(plus + 1)
+            : address.slice(0, plus);
+    const names = [];
+    if (/\p{L}/u.test(local) && !ROLE_MAILBOXES.has(termWords(local).join("")))
+        names.push({ name: local, kind: "name" });
+    if (domain !== "" && !PUBLIC_MAIL_DOMAINS.has(domain))
+        names.push({ name: domain, kind: "organization" });
+    return names;
+}
+/**
+ * A name's words, lowercased: split at anything not a letter or digit, and
+ * at each case change an identifier marks (`acmeOrders`, `XMLParser`).
+ */
+export function termWords(name) {
+    return name
+        .replace(/(\p{Ll}|\p{N})(\p{Lu})/gu, "$1 $2")
+        .replace(/(\p{Lu})(\p{Lu}\p{Ll})/gu, "$1 $2")
+        .split(/[^\p{L}\p{N}]+/u)
+        .filter((word) => word.length > 0)
+        .map((word) => word.toLowerCase());
+}
+/**
+ * The names worth scanning for, each as its words joined by `-`, in the
+ * order first given; an organization's name is followed by each of its
+ * distinctive words (see the module comment). Repeats, names under
+ * `VOCABULARY_TERM_MIN`, names without a letter and names made only of
+ * generic words are dropped.
+ */
+export function workspaceVocabulary(names) {
+    const terms = [];
+    const add = (term) => {
+        if (!terms.includes(term))
+            terms.push(term);
+    };
+    for (const entry of names) {
+        const { name, kind } = typeof entry === "string" ? { name: entry, kind: "name" } : entry;
+        const words = termWords(name);
+        if (words.join("").length < VOCABULARY_TERM_MIN)
+            continue;
+        if (!LETTER.test(name))
+            continue;
+        if (words.every((word) => GENERIC_WORDS.has(word)))
+            continue;
+        add(words.join("-"));
+        if (kind !== "organization")
+            continue;
+        for (const word of words)
+            if (word.length >= VOCABULARY_TERM_MIN &&
+                LETTER.test(word) &&
+                !GENERIC_WORDS.has(word) &&
+                !ORGANIZATION_WORDS.has(word) &&
+                !COMMON_WORDS.has(word))
+                add(word);
+    }
+    return terms;
+}
+/**
+ * Every match of `term` in `text` that starts and ends on a word boundary:
+ * not a letter, or a case change an identifier marks (`myAcme`, `acmeOrders`,
+ * and in a run of capitals the last one before a lowercase, `XMLAcme`,
+ * `ACMEOrders`), or a capital after a digit (`web3Labs`). A term that starts
+ * or ends on a digit (`web3`) needs a non-digit there too, so `web3` is not
+ * found in `web30`.
+ */
+export function termMatches(text, term) {
+    const pattern = new RegExp(term.split("-").join("[\\s_\\-./]*"), "giu");
+    const matches = [];
+    for (const match of text.matchAll(pattern)) {
+        const start = match.index;
+        const end = start + match[0].length;
+        const before = text[start - 1];
+        const after = text[end];
+        if (is(DIGIT, text[start]) && is(DIGIT, before))
+            continue;
+        if (is(DIGIT, text[end - 1]) && is(DIGIT, after))
+            continue;
+        const opens = !is(LETTER, before) ||
+            (is(LOWER, before) && is(UPPER, text[start])) ||
+            (is(UPPER, before) &&
+                is(UPPER, text[start]) &&
+                is(LOWER, text[start + 1]));
+        const closes = !is(LETTER, after) ||
+            (is(UPPER, after) &&
+                (is(LOWER, text[end - 1]) || is(DIGIT, text[end - 1]))) ||
+            (is(UPPER, after) &&
+                is(UPPER, text[end - 1]) &&
+                is(LOWER, text[end + 1]));
+        if (opens && closes)
+            matches.push({ start, end });
+    }
+    return matches;
+}
+const countTerm = (text, term) => termMatches(text, term).length;
+/** Each term found in the files' paths or text, in the vocabulary's order. */
+export function vocabularyLeaks(files, vocabulary) {
+    const leaks = [];
+    for (const term of vocabulary) {
+        let occurrences = 0;
+        const found = [];
+        for (const file of files) {
+            const count = countTerm(file.path, term) + countTerm(file.text, term);
+            if (count === 0)
+                continue;
+            occurrences += count;
+            found.push(file.path);
+        }
+        if (occurrences > 0)
+            leaks.push({ term, occurrences, files: found });
+    }
+    return leaks;
+}
+/** A blocker for each leak, naming where it was found and what clears it. */
+export function vocabularyBlockers(leaks) {
+    return leaks.map((leak) => {
+        const shown = leak.files.slice(0, LEAK_FILES_SHOWN).join(", ");
+        const rest = leak.files.length - LEAK_FILES_SHOWN;
+        return {
+            code: "vocabulary_leaked",
+            file: leak.files[0] ?? null,
+            detail: `"${leak.term}" names the workspace and appears ${leak.occurrences} time${leak.occurrences === 1 ? "" : "s"} in ${leak.files.length} public file${leak.files.length === 1 ? "" : "s"}: ${shown}${rest > 0 ? `, and ${rest} more` : ""}. Give it a pseudonym.`,
+        };
+    });
+}

package/dist/src/pseudonyms/legacy.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The platform's renaming and vocabulary scan as they were before carveout
+ * 0.3.0 (sandbox-factory's packages/core/src/sandbox `aliases.ts` and
+ * `vocabulary.ts`, commit f31d780), frozen under a V1 suffix, for one reason
+ * each:
+ *
+ * - A version the platform already built was renamed by `applyAliasesV1`,
+ *   and carries back only under the same renaming: `ALIASES_V1` to
+ *   `reverseSubmission`, `forwardChange` or `projectPathOf` (`carry.ts`).
+ *   carveout's renaming matches a path rule after a `/` too, and lets a
+ *   path hold any character but a NUL, a backslash, a quote or a newline.
+ * - carveout's scan (`scanVocabulary`) leaves out a found name of one word
+ *   too common to scan for alone (`tooCommonAlone`), and joins a term's
+ *   words across a space, `_`, `-` or `.` but never a `/`; the old one
+ *   scanned for every name and joined across `/`. For one release a
+ *   platform can block on both: `unionVocabularyLeaks` of `vocabularyLeaks`
+ *   and `vocabularyLeaksV1`.
+ *
+ * `organizationNames`, `privatePackageNames`, `emailNames`, `termWords`
+ * and `workspaceVocabulary` are the same in both; the V1 workspace
+ * vocabulary is exported for a caller that keeps the old scan whole.
+ */
+import type { AliasImplementation } from "./carry.js";
+import type { VocabularyLeak } from "./vocabulary.js";
+export { applyAliases as applyAliasesV1, invertAliasRules as invertAliasRulesV1, renameFile as renameFileV1, validateAliasRules as validateAliasRulesV1, } from "./legacy/aliases-v1.js";
+export { termMatches as termMatchesV1, vocabularyBlockers as vocabularyBlockersV1, vocabularyLeaks as vocabularyLeaksV1, workspaceVocabulary as workspaceVocabularyV1, } from "./legacy/vocabulary-v1.js";
+/** The renaming of versions built before carveout 0.3.0, for `carry.ts`. */
+export declare const ALIASES_V1: AliasImplementation;
+/**
+ * Leaks under either scan, by term: carveout's first in its order, then
+ * the terms only the other found. A term both found counts the larger
+ * number of occurrences, in the files either named.
+ */
+export declare function unionVocabularyLeaks(current: readonly VocabularyLeak[], legacy: readonly VocabularyLeak[]): VocabularyLeak[];

package/dist/src/pseudonyms/legacy.js

@@ -0,0 +1,46 @@
+/**
+ * The platform's renaming and vocabulary scan as they were before carveout
+ * 0.3.0 (sandbox-factory's packages/core/src/sandbox `aliases.ts` and
+ * `vocabulary.ts`, commit f31d780), frozen under a V1 suffix, for one reason
+ * each:
+ *
+ * - A version the platform already built was renamed by `applyAliasesV1`,
+ *   and carries back only under the same renaming: `ALIASES_V1` to
+ *   `reverseSubmission`, `forwardChange` or `projectPathOf` (`carry.ts`).
+ *   carveout's renaming matches a path rule after a `/` too, and lets a
+ *   path hold any character but a NUL, a backslash, a quote or a newline.
+ * - carveout's scan (`scanVocabulary`) leaves out a found name of one word
+ *   too common to scan for alone (`tooCommonAlone`), and joins a term's
+ *   words across a space, `_`, `-` or `.` but never a `/`; the old one
+ *   scanned for every name and joined across `/`. For one release a
+ *   platform can block on both: `unionVocabularyLeaks` of `vocabularyLeaks`
+ *   and `vocabularyLeaksV1`.
+ *
+ * `organizationNames`, `privatePackageNames`, `emailNames`, `termWords`
+ * and `workspaceVocabulary` are the same in both; the V1 workspace
+ * vocabulary is exported for a caller that keeps the old scan whole.
+ */
+import { invertAliasRules, renameFile } from "./legacy/aliases-v1.js";
+export { applyAliases as applyAliasesV1, invertAliasRules as invertAliasRulesV1, renameFile as renameFileV1, validateAliasRules as validateAliasRulesV1, } from "./legacy/aliases-v1.js";
+export { termMatches as termMatchesV1, vocabularyBlockers as vocabularyBlockersV1, vocabularyLeaks as vocabularyLeaksV1, workspaceVocabulary as workspaceVocabularyV1, } from "./legacy/vocabulary-v1.js";
+/** The renaming of versions built before carveout 0.3.0, for `carry.ts`. */
+export const ALIASES_V1 = { renameFile, invertAliasRules };
+/**
+ * Leaks under either scan, by term: carveout's first in its order, then
+ * the terms only the other found. A term both found counts the larger
+ * number of occurrences, in the files either named.
+ */
+export function unionVocabularyLeaks(current, legacy) {
+    const merged = new Map();
+    for (const leak of [...current, ...legacy]) {
+        const known = merged.get(leak.term);
+        merged.set(leak.term, known === undefined
+            ? { term: leak.term, occurrences: leak.occurrences, files: [...leak.files] }
+            : {
+                term: leak.term,
+                occurrences: Math.max(known.occurrences, leak.occurrences),
+                files: [...new Set([...known.files, ...leak.files])],
+            });
+    }
+    return [...merged.values()];
+}

package/dist/src/pseudonyms/vocabulary.d.ts

@@ -84,6 +84,26 @@ export declare function workspaceVocabulary(names: readonly (string | Vocabulary
  * of. A name of several words is scanned whole whatever its words.
  */
 export declare function tooCommonAlone(name: string): boolean;
+/**
+ * More spellings an organization's or a person's name goes by: the stem of
+ * a handle (`lunox` of `lunoxhq`), its words split at a digit (`web3 labs`
+ * of `web3labs`), and its letters without accents (`lunox` of `Lunöx`).
+ */
+export declare function nameSpellings(entry: VocabularyName): VocabularyName[];
+/**
+ * The names a public folder is scanned for, from the names a repository
+ * goes by (`found`) and the owner's own (`owner`, always scanned, as an
+ * organization's): a found name of one word too common to scan for alone
+ * (`tooCommonAlone`) is dropped, and each name is joined by its other
+ * spellings (`nameSpellings`). `workspaceVocabulary` turns them into terms.
+ */
+export declare function scannedNames(found: readonly (string | VocabularyName)[], owner?: readonly string[]): VocabularyName[];
+/**
+ * carveout's vocabulary: the terms a public folder must not hold, as
+ * `carveout cut --public` scans for them (`scannedNames`, then
+ * `workspaceVocabulary`). `vocabularyLeaks` finds them in files.
+ */
+export declare function scanVocabulary(found: readonly (string | VocabularyName)[], owner?: readonly string[]): string[];
 export interface VocabularyLeak {
     readonly term: string;
     readonly occurrences: number;

package/dist/src/pseudonyms/vocabulary.js

@@ -451,6 +451,63 @@ export function tooCommonAlone(name) {
     const word = words[0] ?? "";
     return GENERIC_WORDS.has(word) || ORGANIZATION_WORDS.has(word) || COMMON_WORDS.has(word) || CODE_WORDS.has(word);
 }
+/** Affixes a handle wraps a name in: `lunoxhq`, `getlunox`, `lunoxapp`. */
+const HANDLE_PREFIXES = ["get", "try", "use", "join", "go", "hello", "meet"];
+const HANDLE_SUFFIXES = ["hq", "app", "apps", "inc", "io", "dev", "devs", "labs", "lab", "team", "co", "ai", "hub", "official", "corp", "tech", "studio", "group"];
+/**
+ * More spellings an organization's or a person's name goes by: the stem of
+ * a handle (`lunox` of `lunoxhq`), its words split at a digit (`web3 labs`
+ * of `web3labs`), and its letters without accents (`lunox` of `Lunöx`).
+ */
+export function nameSpellings(entry) {
+    const out = [entry];
+    const plain = entry.name.normalize("NFD").replace(/\p{M}/gu, "");
+    if (plain !== entry.name)
+        out.push({ ...entry, name: plain });
+    // Matched whole: its words alone (`web3`) are everyone's.
+    const split = plain.replace(/(\d)(\p{L})/gu, "$1 $2");
+    if (split !== plain)
+        out.push({ name: split, kind: "name" });
+    if (entry.kind === "organization") {
+        const word = plain.toLowerCase();
+        // A stem of letters alone, and not one everyone's code uses (`web3`).
+        const stem = (candidate) => {
+            if (candidate.length >= 4 && /^\p{L}+$/u.test(candidate) && !tooCommonAlone(candidate))
+                out.push({ name: candidate, kind: "organization" });
+        };
+        for (const prefix of HANDLE_PREFIXES)
+            if (word.startsWith(prefix))
+                stem(word.slice(prefix.length));
+        for (const suffix of HANDLE_SUFFIXES)
+            if (word.endsWith(suffix))
+                stem(word.slice(0, -suffix.length));
+    }
+    return out;
+}
+/**
+ * The names a public folder is scanned for, from the names a repository
+ * goes by (`found`) and the owner's own (`owner`, always scanned, as an
+ * organization's): a found name of one word too common to scan for alone
+ * (`tooCommonAlone`) is dropped, and each name is joined by its other
+ * spellings (`nameSpellings`). `workspaceVocabulary` turns them into terms.
+ */
+export function scannedNames(found, owner = []) {
+    const named = found.map((entry) => (typeof entry === "string" ? { name: entry, kind: "name" } : entry));
+    // A name found, of one word the code calls its own things by, is not
+    // scanned for alone; the owner's own names always are.
+    return [
+        ...owner.map((name) => ({ name, kind: "organization" })),
+        ...named.filter((entry) => !tooCommonAlone(entry.name)),
+    ].flatMap(nameSpellings);
+}
+/**
+ * carveout's vocabulary: the terms a public folder must not hold, as
+ * `carveout cut --public` scans for them (`scannedNames`, then
+ * `workspaceVocabulary`). `vocabularyLeaks` finds them in files.
+ */
+export function scanVocabulary(found, owner = []) {
+    return workspaceVocabulary(scannedNames(found, owner));
+}
 /**
  * Every match of `term` in `text` that starts and ends on a word boundary:
  * not a letter, or a case change an identifier marks (`myAcme`, `acmeOrders`,

package/dist/src/pseudonyms.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `carveout/pseudonyms`: the pure half of the pseudonyms, for a caller that
+ * cannot load the compiler or Node's modules (a web app): the alias table
+ * and its application (`aliases.ts`), the names a workspace goes by and the
+ * scan for them (`vocabulary.ts`), the rule-based draft of a table
+ * (`draft.ts`), carrying a change between a version's public names and the
+ * repository's (`carry.ts`), the platform's renaming and scan before 0.3.0
+ * (`legacy.ts`), and the recording mock runtime's text.
+ *
+ * Nothing this entry loads imports `typescript` or a `node:` module;
+ * `test/pseudonyms-entry.test.ts` holds it to that. How a cut and a patch
+ * use the table (`pseudonyms/folder.ts`, which reads Git) is not here.
+ */
+export * from "./pseudonyms/aliases.js";
+export * from "./pseudonyms/vocabulary.js";
+export * from "./pseudonyms/draft.js";
+export * from "./pseudonyms/carry.js";
+export * from "./pseudonyms/legacy.js";
+export { MOCK_RUNTIME, MOCK_RUNTIME_TYPES } from "./project/mock-runtime.js";
+export { dirnameOf, relativeSpecifier, runtimePath } from "./project/paths.js";

package/dist/src/pseudonyms.js

@@ -0,0 +1,20 @@
+/**
+ * `carveout/pseudonyms`: the pure half of the pseudonyms, for a caller that
+ * cannot load the compiler or Node's modules (a web app): the alias table
+ * and its application (`aliases.ts`), the names a workspace goes by and the
+ * scan for them (`vocabulary.ts`), the rule-based draft of a table
+ * (`draft.ts`), carrying a change between a version's public names and the
+ * repository's (`carry.ts`), the platform's renaming and scan before 0.3.0
+ * (`legacy.ts`), and the recording mock runtime's text.
+ *
+ * Nothing this entry loads imports `typescript` or a `node:` module;
+ * `test/pseudonyms-entry.test.ts` holds it to that. How a cut and a patch
+ * use the table (`pseudonyms/folder.ts`, which reads Git) is not here.
+ */
+export * from "./pseudonyms/aliases.js";
+export * from "./pseudonyms/vocabulary.js";
+export * from "./pseudonyms/draft.js";
+export * from "./pseudonyms/carry.js";
+export * from "./pseudonyms/legacy.js";
+export { MOCK_RUNTIME, MOCK_RUNTIME_TYPES } from "./project/mock-runtime.js";
+export { dirnameOf, relativeSpecifier, runtimePath } from "./project/paths.js";