ddd-ts-kit 0.19.0 → 0.21.0

package/CHANGELOG.md

@@ -4,6 +4,87 @@ What each version changes for someone who uses the kit. The packages of `package
 together, under one version; the notes of each [GitHub release](https://github.com/gbourgeat/ddd-ts-kit/releases)
 list the pull requests behind it.
 
+## 0.21.0
+
+**A rule can be set for some files only, and a rule off everywhere is said.** `rules.<id>` in
+`ddd-ts-kit.config.json` also takes `{ "severity": "error" | "warn" | "off", "files": ["<glob>"] }`:
+a finding on a matching file takes that severity, every other file keeps the one of the project.
+The ESLint preset applies the same setting to the same files. A lowered setting still needs its
+`deviations` entry. The new rule `config/rule-off-everywhere` (a warning) reports a bare `"off"`,
+which hides every finding of the rule and not only the ones its exception was about. To move,
+narrow each reported rule to the files it is about, or write `"files": ["**"]` when the whole
+project is meant.
+
+**The generated barrel of a context is not judged by `clean/file-size`.** `<context>.declarations.ts`
+and `<context>.dependencies.ts`, at the root of their context, are written by the kit and may grow
+past 350 lines; a project no longer has to turn the rule off for them. A file of the same name
+elsewhere is still judged. To move, remove an exception you wrote for them.
+
+**`worker-scope` briefs one batch, from a checked base.** `--base <ref>` cuts the worktree from
+that ref (`origin/main`) and gives it as the trunk of the checks; `--rows <id,...>` limits the
+briefing to those rows of `slices.md`, in that order. Without `--base`, the command refuses to run
+from a worker's worktree, and an existing worktree or branch that does not contain the base is
+refused with the fix. The `rules:` of a row is filled from the line of rules that `plan-slices`
+writes under the table. The `context-builder` agent takes one or two rows, keeps its last turns for
+its report and never ends without it; `architecture-reviewer` keeps turns for its verdict.
+
+**A worker may generate a working migration.** `npm run db:generate working-<what>` in a worker's
+worktree is allowed by the guard, and `persistence/migration-history` accepts it there, so a branch
+that changes the stored state is green alone. On the trunk the same file is reported: at the merge
+the conductor deletes it and generates the real one (`parallel-work`, merge step). Any other
+migration stays refused to a worker.
+
+**`db:generate` under drizzle-kit no longer waits or pretends.** Without a terminal, drizzle-kit
+refused its rename question, wrote no migration and exited 0; under a pseudo-terminal it waited
+for an answer. `db:generate` is now `ddd-ts-kit drizzle-generate --name`: in a terminal it is
+`drizzle-kit generate` as before; without one, those two silent failures exit 2 with the fix (split
+the rename, or write a custom migration). To move, in a Drizzle project, set the `db:generate`
+script to `ddd-ts-kit drizzle-generate --name`, or run `npx ddd-ts-kit init --force`.
+
+**One `regenerate` script for every derived file.** `npm run regenerate` runs
+`ddd-ts-kit depcruise-config --write` then `npm run docs:generate` (the context documents, the
+barrels, the OpenAPI and event documents, the clients): the one step after a change of route,
+schema, event or config. To move, run `npx ddd-ts-kit init --force` after the upgrade, which adds
+the script and allows it to agents.
+
+**`generate adr` takes `--number <n>`.** A team that numbers its decision records by block
+(`0401` for one story, `0701` for another) chooses the number instead of taking the highest plus
+one. The number goes to the file, the `# ADR-NNNN` title and the `deviations` entry; a number
+already taken, or one that is not a number, is refused.
+
+**Where a shared type, a pure function and a strategy live in the domain.** `docs/ARCHITECTURE.md`
+says it, with no new directory: a side-effect-free function on one value is a method of that value
+object, a computation over several is a domain service, a shape of business data is a value object,
+an interchangeable rule is an abstract class of `domain/services/` with its implementations.
+`test/spec-required` no longer asks a spec of a file that exports abstract classes only; each
+implementation keeps its own.
+
+**The integration specs of a generated project give the test database a minute to open.** Their
+hooks had the default 10 seconds of Vitest, which opening PGlite outlasted under coverage on a busy
+machine. To move, add `hookTimeout: 60_000` to the `integration` project of `vitest.config.ts`, or
+run `npx ddd-ts-kit init --force`.
+
+## 0.20.0
+
+**A permission no role holds is said.** In a project whose rights are roles (`stack.authz`
+`rbac`), `authz/granted` (`ddd-ts-kit check`) reports each permission a context declares that no
+role names in `platform/auth/roles.ts`, nor `platform/auth/signed-in-grants.ts`: the super-admin
+`*` was the only one to reach it, so the checks stayed green and every other person was refused
+at run time. It is a warning: `check` does not fail on it. A grant counts by the entry of the set
+(`billingPermissions['invoice.issue']`), by the id (`'billing:invoice.issue'`) or by the wildcard
+of the context (`'billing:*'`); a grant to `Role.System`, written by `generate job`, counts too.
+The rule is silent under attributes, relationships or an authorizer of the project's own.
+
+**`generate command`, `query` and `file-upload` take `--grant <role>`.** With `--permission`, it
+writes the grant in `platform/auth/roles.ts` and adds the role to `platform/auth/role.ts` when it
+is new. It is refused with `--public`, and when the rights are not roles. Without it, a `next`
+step points at the roles to edit. `init --force` writes the roles from their template again, and
+the warning names the grants to give back. To move, run `ddd-ts-kit check --rule authz/granted`
+and grant each permission it lists to the roles that hold it, by the entry of its set, in
+`roles.ts`; a permission meant for administrators only is granted to `Role.Admin` by name. A
+context worker never passes `--grant` (`--local-only` refuses it): the conductor grants on the
+trunk.
+
 ## 0.19.0
 
 **`status` and `worker-scope` read every slices table.** `docs/architecture/slices.md` may plan

package/README.fr.md

@@ -1,5 +1,5 @@
 [English](README.md) · **Français**
-<!-- translation-of: README.md sha256:fa841c4ea81f2c5d -->
+<!-- translation-of: README.md sha256:91cb20f36ff1d090 -->
 
 # ddd-ts-kit
 
@@ -30,7 +30,7 @@ Aucune dépendance d'exécution. Node 22.12 ou ultérieur.
 npx ddd-ts-kit init
 npx ddd-ts-kit generate context billing --classification core --term "Invoice=A request for payment"
 npx ddd-ts-kit generate aggregate billing Invoice
-npx ddd-ts-kit generate command billing IssueInvoice --aggregate Invoice --permission invoice.issue --term "Issue=To make an invoice final"
+npx ddd-ts-kit generate command billing IssueInvoice --aggregate Invoice --permission invoice.issue --grant accountant --term "Issue=To make an invoice final"
 npx ddd-ts-kit generate route billing IssueInvoice --method POST --path /invoices
 npx ddd-ts-kit check
 ```
@@ -642,12 +642,12 @@ Next, in this order: the language of the context first, then the business decisi
 | `domain-service` | `<context> <Name>` | service, *spec* |
 | `state-machine` | `<context> <Aggregate> [--value <state>]... [--transition "<intention>:<from>[,<from>]...[><to>]"]...` | le vocabulaire `<Aggregate>Status` (créé depuis `--value`, deux états au moins, ou complété des valeurs qui lui manquent), `domain/state-machines/<aggregate>.state-machine.ts` (`<aggregate>Lifecycle` : chaque valeur un état, la première initiale, les transitions demandées, un `TODO(domain)` pour le refus de l'erreur du concept) et `test/unit/<aggregate>.state-machine.spec.ts` (chaque transition là où elle mène, un refus depuis un état qu'elle ne quitte pas) ; c'est à l'agrégat de l'utiliser |
 | `repository` | `<context> <Aggregate> [--tenant-scoped]` | le port `domain/repositories/<name>.repository.ts` (`abstract class <Name>Repository extends Repository<<Name>>`), l'adaptateur de l'ORM du projet (qui `implements` le port) avec son *mapper* et sa table (ou son modèle), un *fake*, une *spec* `repositoryContract` exécutée sur les deux, l'enregistrement |
-| `command` | `<context> <UseCaseName> (--permission <aggregate>.<action> \| --public) [--aggregate <Name>]` | `<use-case>.command.ts` sur `AuthorizedCommand` (simple `Command` quand elle est publique), `<use-case>.handler.ts` (il construit l'agrégat, le sauvegarde et répond : les événements partent avec la sauvegarde), une *spec* par le bus avec le refus d'un acteur à qui manque la permission, l'enregistrement avec `.requires(...)` ou `.public()` (et le *repository* s'il manque). Une commande générée répond `void` ou l'identifiant de son agrégat, si bien qu'aucun `<use-case>.result.ts` n'est écrit |
-| `query` | `<context> <UseCaseName> (--permission <aggregate>.<action> \| --public) [--search]` | `<use-case>.query.ts` sur `AuthorizedQuery` (simple `Query` quand elle est publique), `<use-case>.result.ts`, `<use-case>.handler.ts`, le port de lecture `application/ports/<use-case>-reader.port.ts` (une classe abstraite), son adaptateur en mémoire, un *fake*, une *spec*, l'enregistrement sur le bus de requêtes. Avec `--search` (demande `--permission`) : une `PageRequest` du kernel dans la requête, l'élément, le tri et `Page<Item>` dans le fichier de résultat, un gestionnaire qui demande `Access.scope` et remet le périmètre au port de lecture, un lecteur en mémoire qui pagine par décalage ou par curseur |
+| `command` | `<context> <UseCaseName> (--permission <aggregate>.<action> [--grant <role>] \| --public) [--aggregate <Name>]` | `<use-case>.command.ts` sur `AuthorizedCommand` (simple `Command` quand elle est publique), `<use-case>.handler.ts` (il construit l'agrégat, le sauvegarde et répond : les événements partent avec la sauvegarde), une *spec* par le bus avec le refus d'un acteur à qui manque la permission, l'enregistrement avec `.requires(...)` ou `.public()` (et le *repository* s'il manque). Une commande générée répond `void` ou l'identifiant de son agrégat, si bien qu'aucun `<use-case>.result.ts` n'est écrit |
+| `query` | `<context> <UseCaseName> (--permission <aggregate>.<action> [--grant <role>] \| --public) [--search]` | `<use-case>.query.ts` sur `AuthorizedQuery` (simple `Query` quand elle est publique), `<use-case>.result.ts`, `<use-case>.handler.ts`, le port de lecture `application/ports/<use-case>-reader.port.ts` (une classe abstraite), son adaptateur en mémoire, un *fake*, une *spec*, l'enregistrement sur le bus de requêtes. Avec `--search` (demande `--permission`) : une `PageRequest` du kernel dans la requête, l'élément, le tri et `Page<Item>` dans le fichier de résultat, un gestionnaire qui demande `Access.scope` et remet le périmètre au port de lecture, un lecteur en mémoire qui pagine par décalage ou par curseur |
 | `port` | `<context> <Name>` | `application/ports/<name>.port.ts`, une classe abstraite, et son *fake* |
 | `route` | `<context> <UseCaseName> --method <GET\|POST\|PUT\|PATCH\|DELETE> --path <p> [--command\|--query] [--group <Name>] [--mapper] [--serializer] [--cache public\|private\|no-store]` | sous `"stack.routes": "controllers"` : une classe contrôleur dans `presentation/http/<resource>/<use-case>/` (la ressource est le premier segment du chemin), qui dépend de `CommandBus` ou de `QueryBus`, derrière le groupe de routes de sa ressource, écrit avec elle quand il est nouveau (`<resource>.routes.ts` : préfixe, étiquette, `Authenticated`) ; un cas d'usage public ne se tient dans aucun groupe et dit `guards: [Public]` ; avec class-validator, une classe par fichier (`<use-case>.params.ts`, `.body.ts`, `.answer.ts`, `.accepted.ts`, `.line.ts`) ; `--mapper` et `--serializer` ajoutent un *mapper* de requête HTTP et un sérialiseur que reçoit le contrôleur ; une *spec* ; aucun enregistrement dans un projet déclaré, un contrôleur construit à la main dans `<context>.routes.ts` (le fichier de module en câblage manuel) dans un projet explicite. Sous `"functions"` : une fonction `defineRoute`, sa *spec*, son enregistrement dans `<context>.routes.ts`, et des classes `<use-case>-<role>.dto.ts` |
 | `controller` | les mêmes arguments que `route` | la classe contrôleur, quoi que dise `stack.routes` : pour un projet de routes en fonctions qui écrit sa prochaine route comme une classe. `--cache` écrit sa politique de cache : `private` (un `GET` d'un appelant, `max-age=0`, `must-revalidate`, `ETag` fort), `public` (un `GET` d'un cas d'usage public, `max-age` 1m, `s-maxage` 5m, étiqueté avec les ressources de son chemin), `no-store` ; refusé sur une écriture, et `public` derrière un groupe de routes |
-| `file-upload` | `<context> <UseCaseName> --path <p> (--permission <aggregate>.<action> \| --public) [--method POST\|PUT] [--group <Name>]` | un téléversement : un contrôleur qui déclare le fichier qu'il reçoit (sa taille et ses types de média dans le contrat, vérifiés au fil du flux), la commande qui le porte comme un `FileUpload`, mis en attente par le bus de commandes avant la transaction, le gestionnaire qui l'enregistre et le promeut avec la validation (commit), et leurs *specs*. Refusé sans `stack.storage` ou sans *stack* HTTP, avec le `init --force --storage local` à lancer |
+| `file-upload` | `<context> <UseCaseName> --path <p> (--permission <aggregate>.<action> [--grant <role>] \| --public) [--method POST\|PUT] [--group <Name>]` | un téléversement : un contrôleur qui déclare le fichier qu'il reçoit (sa taille et ses types de média dans le contrat, vérifiés au fil du flux), la commande qui le porte comme un `FileUpload`, mis en attente par le bus de commandes avant la transaction, le gestionnaire qui l'enregistre et le promeut avec la validation (commit), et leurs *specs*. Refusé sans `stack.storage` ou sans *stack* HTTP, avec le `init --force --storage local` à lancer |
 | `route-group` (`group`) | `<context> <Name> [--prefix <path>] [--group <ParentName>] [--public \| --role <role>]` | `presentation/http/<name>.routes.ts` : une classe vide qui porte `@RouteGroup`, derrière `Authenticated` sauf si `--public` ou `--role` dit autre chose (`HasRole(Role.Admin)`, le rôle lu dans le vocabulaire de la plateforme, `<platformDir>/auth/role.ts`, qui le reçoit s'il ne le contient pas) ; avec `--group`, il affine ce groupe et en hérite |
 | `guard` | `<context> <Name>` | `presentation/http/guards/<name>.guard.ts` : une classe de garde déclarée à remplir, et sa *spec* |
 | `representation` | `<context> <UseCase> <xml\|csv\|media/type>[,...]` | ajoute `produces` au `@Controller` du cas d'usage, et `consumes: ['application/xml']` à celui qui reçoit un corps quand XML est demandé ; dit quand CSV a besoin d'une page ou d'une liste en flux, et quand `stack.representations` n'est pas `negotiated` |
@@ -739,7 +739,10 @@ Next, in this order: the language of the context first, then the business decisi
 - **Refus par défaut.** `command` et `query` sont refusés sans `--permission` ou `--public`. Une
   nouvelle permission rejoint `<context>.permissions.ts` ; ses mots sont vérifiés dans le
   glossaire comme tout autre nom. Avec `--authz rebac`, l'exigence nomme le contexte comme sa
-  ressource, un point de départ à remplacer par l'élément sur lequel porte le droit.
+  ressource, un point de départ à remplacer par l'élément sur lequel porte le droit. Avec
+  `--authz rbac`, `--grant <role>` accorde la permission au rôle dans `platform/auth/roles.ts`
+  (le rôle rejoint `role.ts` s'il est nouveau) ; sans lui, une étape `next` dit que
+  l'attribution reste à faire (`authz/granted`).
 - `route` remet `actorOf(context.principal)` à un cas d'usage protégé et pose `security` (le
   schéma de `--authn`, ou `false` pour un cas d'usage public). `integration-handler` porte
   `systemActor('<context>.<name>')` pour la commande qu'il construit ; derrière un *broker*, il
@@ -1082,16 +1085,25 @@ un contexte ; `--json` affiche `{ count, remaining: [{ kind, context, file, line
 ## worker-scope
 
 ```
-ddd-ts-kit worker-scope <context> [--worktree <path>] [--branch <name>] [--dry-run]
+ddd-ts-kit worker-scope <context> [--base <ref>] [--rows <id,...>] [--worktree <path>] [--branch <name>] [--dry-run]
 ```
 
 Prépare la place d'un *worker* d'un build réparti par contexte : crée un *worktree* git du projet
-(`../<project>-<context>` par défaut) sur la branche `build/<context>`, y écrit
+(`../<project>-<context>` par défaut) sur la branche `build/<context>`, à partir de `--base` (une
+branche, une étiquette ou un *commit* : `origin/main` ; par défaut la branche courante), y écrit
 `.ddd-ts-kit/worker.json` (`{ "context": "<context>" }` ; `init` ignore `.ddd-ts-kit/`), et
 affiche la consigne du *worker* : son périmètre, les générateurs qu'il peut lancer, ses tranches
-encore à faire d'après `docs/architecture/slices.md`, les langages publiés qu'il consomme. Un
-*worktree* existant est gardé et seul le fichier est réécrit ; `--dry-run` ne crée et n'écrit
-rien. Il faut un dépôt git avec au moins un *commit*. Le *worker* génère ensuite avec
+encore à faire d'après `docs/architecture/slices.md`, les langages publiés qu'il consomme, et la
+base comme tronc de ses vérifications (`check --changed-since <base>`). `--rows 4.15,4.16` ne
+donne que ces lignes, dans cet ordre : un identifiant est lu tel qu'il est écrit, et une ligne
+absente du fichier, présente deux fois ou confiée à un autre propriétaire est refusée. Chaque
+ligne porte ses règles, lues sur une ligne `- #<id>: <règles>` sous les tableaux ; au-delà de
+deux lignes, une note le signale, car un agent en tient une ou deux. Un *worktree* existant, ou
+une branche existante, est gardé quand il contient la base et refusé sinon, pour qu'aucun
+*worker* ne construise sur un tronc périmé ; seul le fichier est réécrit. Sans `--base`, lancé
+depuis le *worktree* d'un *worker* (son `.ddd-ts-kit/worker.json`, ou une branche
+`build/<context>`), il refuse : cette branche deviendrait le tronc. `--dry-run` ne crée et
+n'écrit rien. Il faut un dépôt git avec au moins un *commit*. Le *worker* génère ensuite avec
 `--local-only`.
 
 ## affected
@@ -1291,6 +1303,7 @@ règle.
 | `config/valid` | un amont, une classification, une relation, un identifiant de règle, un mode de `guard` ou un `importExtension` inconnu ; un contexte absent du disque ou de la configuration ; une limite de `commit` qui n'est pas un entier positif |
 | `config/suppression-needs-reason` | une désactivation sans identifiant de règle ou sans raison (gardée comme alias à côté de `governance/recorded-deviation`, qui juge la raison) |
 | `authz/declared` | dans un fichier de module, `builder.command(X)` ou `builder.query(X)` sans `.requires(` ni `.public(` dans sa chaîne, sauf si la classe du message porte `@Requires` ou `@Public` de `@ddd-ts-kit/kernel/declarations` ; en câblage manuel ou nest, une classe de commande ou de requête absente de tous les `requires(X, ...)` et `publicUseCase(X)` du fichier de module et de `application/authorization/` ; un `defineRoute` sans `security` (le type de la route le refuse déjà, et une liste vide aussi : c'est le filet au niveau du texte pour une définition construite de façon lâche) ; dans le style déclaré, la classe exportée d'un fichier `*.command.ts` ou `*.query.ts` qui ne porte ni `@Requires` ni `@Public` |
+| `authz/granted` | avec `stack.authz` `rbac`, une permission du `definePermissions` d'un contexte que ni `platform/auth/roles.ts` ni `platform/auth/signed-in-grants.ts` n'accorde par son nom (par l'entrée de son ensemble, son identifiant ou `<contexte>:*`) ; le `*` du super-administrateur ne compte pas (un avertissement) |
 | `authz/in-application` | `presentation/` : un test sur les rôles, `isAdmin`, l'import d'un autorisateur ou de `Access` ; `infrastructure/` : `authorize(` ou `check(` sur un autorisateur ou un accès, `ForbiddenError` ; `domain/` : tout import de `@ddd-ts-kit/auth`, des types d'acteur du kernel (`Actor`, `ActorContext`, `Session`, `ExecutionContext`, les messages autorisés), une lecture de `.roles` ou `.permissions` sur un acteur. La glu de requête HTTP de `@ddd-ts-kit/auth` (`actorOf`, `sessionOf`, `resolveSession`, `SessionAuthenticator`) est libre dans `presentation/`. `presentation/` et `infrastructure/` : l'import de `Requires`, `Public` ou `Policy` depuis `@ddd-ts-kit/kernel/declarations`, ou des ports `Access` et `PolicyAccess` depuis `@ddd-ts-kit/auth` ; ils sont libres dans `application/` |
 | `authz/actor-explicit` | dans `domain/` et `application/` : `ActorContext`, `ExecutionScope` (comme type ou comme valeur : la classe est le jeton d'une liste de dépendances), `AsyncLocalStorageExecutionScope`, `ScopedActorContext`, `AsyncLocalStorage` ; `.current()` ou `.require()` sur un contexte d'acteur ou sur quelque chose nommé `scope`, `scopes` ou `...executionScope` ; un import de `stampCreation`, `stampUpdate` ou `tenantScopeOf` |
 | `authz/fields-by-schema` | sous `application/queries/` : `roles.includes(`, `.some(`, `.every(`, `.find(`, `.indexOf(`, une comparaison avec un `role`, `isAdmin` |

package/README.md

@@ -28,7 +28,7 @@ No runtime dependency. Node 22.12 or later.
 npx ddd-ts-kit init
 npx ddd-ts-kit generate context billing --classification core --term "Invoice=A request for payment"
 npx ddd-ts-kit generate aggregate billing Invoice
-npx ddd-ts-kit generate command billing IssueInvoice --aggregate Invoice --permission invoice.issue --term "Issue=To make an invoice final"
+npx ddd-ts-kit generate command billing IssueInvoice --aggregate Invoice --permission invoice.issue --grant accountant --term "Issue=To make an invoice final"
 npx ddd-ts-kit generate route billing IssueInvoice --method POST --path /invoices
 npx ddd-ts-kit check
 ```
@@ -622,12 +622,12 @@ Next, in this order: the language of the context first, then the business decisi
 | `domain-service` | `<context> <Name>` | service, spec |
 | `state-machine` | `<context> <Aggregate> [--value <state>]... [--transition "<intention>:<from>[,<from>]...[><to>]"]...` | the vocabulary `<Aggregate>Status` (created from `--value`, two states at least, or given the values it misses), `domain/state-machines/<aggregate>.state-machine.ts` (`<aggregate>Lifecycle`: every value a state, the first one initial, the transitions asked, a `TODO(domain)` for the refusal of the concept error) and `test/unit/<aggregate>.state-machine.spec.ts` (each transition where it leads, a refusal from a state it does not leave); the aggregate is left to use it |
 | `repository` | `<context> <Aggregate> [--tenant-scoped]` | the port `domain/repositories/<name>.repository.ts` (`abstract class <Name>Repository extends Repository<<Name>>`), the adapter of the project's ORM (`implements` the port) with its mapper and table (or model), a fake, one `repositoryContract` spec run on both, registration |
-| `command` | `<context> <UseCaseName> (--permission <aggregate>.<action> \| --public) [--aggregate <Name>]` | `<use-case>.command.ts` on `AuthorizedCommand` (plain `Command` when public), `<use-case>.handler.ts` (it builds the aggregate, saves it and answers: the events leave with the save), spec through the bus with the refusal of an actor who lacks the permission, registration with `.requires(...)` or `.public()` (and the repository when missing). A generated command answers `void` or the identifier of its aggregate, so no `<use-case>.result.ts` is written |
-| `query` | `<context> <UseCaseName> (--permission <aggregate>.<action> \| --public) [--search]` | `<use-case>.query.ts` on `AuthorizedQuery` (plain `Query` when public), `<use-case>.result.ts`, `<use-case>.handler.ts`, the read port `application/ports/<use-case>-reader.port.ts` (an abstract class), its in-memory adapter, fake, spec, registration on the query bus. With `--search` (needs `--permission`): a kernel `PageRequest` in the query, the item, the sort and `Page<Item>` in the result file, a handler that asks `Access.scope` and hands the scope to the read port, an in-memory reader paging by offset or cursor |
+| `command` | `<context> <UseCaseName> (--permission <aggregate>.<action> [--grant <role>] \| --public) [--aggregate <Name>]` | `<use-case>.command.ts` on `AuthorizedCommand` (plain `Command` when public), `<use-case>.handler.ts` (it builds the aggregate, saves it and answers: the events leave with the save), spec through the bus with the refusal of an actor who lacks the permission, registration with `.requires(...)` or `.public()` (and the repository when missing). A generated command answers `void` or the identifier of its aggregate, so no `<use-case>.result.ts` is written |
+| `query` | `<context> <UseCaseName> (--permission <aggregate>.<action> [--grant <role>] \| --public) [--search]` | `<use-case>.query.ts` on `AuthorizedQuery` (plain `Query` when public), `<use-case>.result.ts`, `<use-case>.handler.ts`, the read port `application/ports/<use-case>-reader.port.ts` (an abstract class), its in-memory adapter, fake, spec, registration on the query bus. With `--search` (needs `--permission`): a kernel `PageRequest` in the query, the item, the sort and `Page<Item>` in the result file, a handler that asks `Access.scope` and hands the scope to the read port, an in-memory reader paging by offset or cursor |
 | `port` | `<context> <Name>` | `application/ports/<name>.port.ts`, one abstract class, and its fake |
 | `route` | `<context> <UseCaseName> --method <GET\|POST\|PUT\|PATCH\|DELETE> --path <p> [--command\|--query] [--group <Name>] [--mapper] [--serializer] [--cache public\|private\|no-store]` | under `"stack.routes": "controllers"`: a controller class in `presentation/http/<resource>/<use-case>/` (the resource is the first segment of the path), depending on `CommandBus` or `QueryBus`, behind the route group of its resource, written with it when it is new (`<resource>.routes.ts`: prefix, tag, `Authenticated`); a public use case stands in no group and says `guards: [Public]`; with class-validator one class per file (`<use-case>.params.ts`, `.body.ts`, `.answer.ts`, `.accepted.ts`, `.line.ts`); `--mapper` and `--serializer` add a request mapper and a serializer the controller is given; a spec; no registration in a declared project, a controller built by hand in `<context>.routes.ts` (the module file with hand wiring) in an explicit one. Under `"functions"`: a `defineRoute` function, its spec, its registration in `<context>.routes.ts`, and `<use-case>-<role>.dto.ts` classes |
 | `controller` | the same arguments as `route` | the controller class, whatever `stack.routes` says: for a project of function routes that writes its next route as a class. `--cache` writes its cache policy: `private` (a `GET` of a caller, `max-age=0`, `must-revalidate`, strong `ETag`), `public` (a `GET` of a public use case, `max-age` 1m, `s-maxage` 5m, tagged with the resources of its path), `no-store`; refused on a write, and `public` behind a route group |
-| `file-upload` | `<context> <UseCaseName> --path <p> (--permission <aggregate>.<action> \| --public) [--method POST\|PUT] [--group <Name>]` | an upload: a controller that declares the file it receives (its size and media types in the contract, checked as it streams), the command that carries it as a `FileUpload`, staged by the command bus before the transaction, the handler that records it and promotes it with the commit, and their specs. Refused without `stack.storage` or without an HTTP stack, with the `init --force --storage local` to run |
+| `file-upload` | `<context> <UseCaseName> --path <p> (--permission <aggregate>.<action> [--grant <role>] \| --public) [--method POST\|PUT] [--group <Name>]` | an upload: a controller that declares the file it receives (its size and media types in the contract, checked as it streams), the command that carries it as a `FileUpload`, staged by the command bus before the transaction, the handler that records it and promotes it with the commit, and their specs. Refused without `stack.storage` or without an HTTP stack, with the `init --force --storage local` to run |
 | `route-group` (`group`) | `<context> <Name> [--prefix <path>] [--group <ParentName>] [--public \| --role <role>]` | `presentation/http/<name>.routes.ts`: an empty class carrying `@RouteGroup`, behind `Authenticated` unless `--public` or `--role` says otherwise (`HasRole(Role.Admin)`, the role read from the vocabulary of the platform, `<platformDir>/auth/role.ts`, which gets it when it does not hold it); with `--group` it refines that group and inherits from it |
 | `guard` | `<context> <Name>` | `presentation/http/guards/<name>.guard.ts`: a declared guard class to fill, and its spec |
 | `representation` | `<context> <UseCase> <xml\|csv\|media/type>[,...]` | adds `produces` to the `@Controller` of the use case, and `consumes: ['application/xml']` to one that receives a body when XML is asked; says when CSV needs a page or a streamed list, and when `stack.representations` is not `negotiated` |
@@ -713,7 +713,9 @@ Next, in this order: the language of the context first, then the business decisi
 - **Deny by default.** `command` and `query` are refused without `--permission` or `--public`. A new
   permission joins `<context>.permissions.ts`; its words are checked against the glossary like any
   other name. With `--authz rebac` the requirement names the context as its resource, a starting
-  point to replace by the element the right bears on.
+  point to replace by the element the right bears on. With `--authz rbac`, `--grant <role>` gives
+  the permission to the role in `platform/auth/roles.ts` (the role joins `role.ts` when it is
+  new); without it, a `next` step says the grant is left to do (`authz/granted`).
 - `route` hands `actorOf(context.principal)` to a protected use case and sets `security` (the scheme
   of `--authn`, or `false` for a public one). `integration-handler` carries `systemActor('<context>.<name>')`
   for the command it builds; behind a broker it listens on the subscriber of its context
@@ -1032,15 +1034,23 @@ context; `--json` prints `{ count, remaining: [{ kind, context, file, line, text
 ## worker-scope
 
 ```
-ddd-ts-kit worker-scope <context> [--worktree <path>] [--branch <name>] [--dry-run]
+ddd-ts-kit worker-scope <context> [--base <ref>] [--rows <id,...>] [--worktree <path>] [--branch <name>] [--dry-run]
 ```
 
 Prepares the place of one worker of a build split by context: creates a git worktree of the
-project (`../<project>-<context>` by default) on the branch `build/<context>`, writes
+project (`../<project>-<context>` by default) on the branch `build/<context>`, cut from
+`--base` (a branch, a tag or a commit: `origin/main`; by default the current branch), writes
 `.ddd-ts-kit/worker.json` in it (`{ "context": "<context>" }`; `init` ignores `.ddd-ts-kit/`), and
 prints the briefing of the worker: its scope, the generators it may run, its slices still to do
-from `docs/architecture/slices.md`, the published languages it consumes. An existing worktree is
-kept and only the file is written again; `--dry-run` creates and writes nothing. It needs a git
+from `docs/architecture/slices.md`, the published languages it consumes, and the base as the
+trunk of its checks (`check --changed-since <base>`). `--rows 4.15,4.16` briefs those rows only,
+in that order: an id is read as written, and a row the file does not have, has twice or gives to
+another owner is refused. Each row carries its rules, from a line `- #<id>: <rules>` under the
+tables; more than two rows get a note, since an agent holds one or two. An existing worktree, or
+an existing branch, is kept when it contains the base and refused when it does not, so that no
+worker builds on a stale trunk; only the file is written again. Without `--base`, run from a
+worker's worktree (its `.ddd-ts-kit/worker.json`, or a branch `build/<context>`), it refuses:
+that branch would become the trunk. `--dry-run` creates and writes nothing. It needs a git
 repository with one commit at least. The worker then generates with `--local-only`.
 
 ## affected
@@ -1234,6 +1244,7 @@ const due = handler.isDueNow(new Reminder(new Date('2026-03-01T09:00:00Z'))); //
 | `config/valid` | unknown upstream, classification, relationship, rule id, `guard` mode or `importExtension`; a context missing on disk or in the config; a `commit` limit that is not a positive integer |
 | `config/suppression-needs-reason` | a suppression without a rule id or a reason (kept as an alias next to `governance/recorded-deviation`, which judges the reason) |
 | `authz/declared` | in a module file, `builder.command(X)` or `builder.query(X)` without `.requires(` or `.public(` in its chain, unless the message class carries `@Requires` or `@Public` of `@ddd-ts-kit/kernel/declarations`; with manual or nest wiring, a command or query class absent from every `requires(X, ...)` and `publicUseCase(X)` of the module file and of `application/authorization/`; a `defineRoute` without `security` (the route type refuses it already, and an empty list too: this is the text-level net for a definition built loosely); in the declared style, the exported class of a `*.command.ts` or `*.query.ts` file carrying neither `@Requires` nor `@Public` |
+| `authz/granted` | with `stack.authz` `rbac`, a permission of a context's `definePermissions` that neither `platform/auth/roles.ts` nor `platform/auth/signed-in-grants.ts` grants by name (by the entry of its set, its id or `<context>:*`); the super-admin `*` does not count (a warning) |
 | `authz/in-application` | `presentation/`: a test on roles, `isAdmin`, the import of an authorizer or of `Access`; `infrastructure/`: `authorize(` or `check(` on an authorizer or access, `ForbiddenError`; `domain/`: any import of `@ddd-ts-kit/auth`, of the actor types of the kernel (`Actor`, `ActorContext`, `Session`, `ExecutionContext`, the authorized messages), a read of `.roles` or `.permissions` on an actor. The request glue of `@ddd-ts-kit/auth` (`actorOf`, `sessionOf`, `resolveSession`, `SessionAuthenticator`) is free in `presentation/`. `presentation/` and `infrastructure/`: the import of `Requires`, `Public` or `Policy` from `@ddd-ts-kit/kernel/declarations`, or of the ports `Access` and `PolicyAccess` from `@ddd-ts-kit/auth`; they are free in `application/` |
 | `authz/actor-explicit` | in `domain/` and `application/`: `ActorContext`, `ExecutionScope` (as a type or as a value: the class is the token of a dependency list), `AsyncLocalStorageExecutionScope`, `ScopedActorContext`, `AsyncLocalStorage`; `.current()` or `.require()` on an actor context or on something named `scope`, `scopes` or `...executionScope`; an import of `stampCreation`, `stampUpdate` or `tenantScopeOf` |
 | `authz/fields-by-schema` | under `application/queries/`: `roles.includes(`, `.some(`, `.every(`, `.find(`, `.indexOf(`, a comparison with a `role`, `isAdmin` |

package/dist/check/authz/is-granted.d.ts

@@ -0,0 +1,8 @@
+import type { Scan } from '../scan/scan.js';
+import type { PermissionSet } from './permission-sets.js';
+/**
+ * Whether code grants a permission by name: by the entry of its set, `billingPermissions['invoice.issue']`;
+ * by its id, `'billing:invoice.issue'`; or by the wildcard of its context, `'billing:*'`. A comment grants nothing.
+ */
+export declare function isGranted({ code, strings }: Scan, { set, context }: Omit<PermissionSet, 'keys'>, key: string): boolean;
+//# sourceMappingURL=is-granted.d.ts.map

package/dist/check/authz/is-granted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-granted.d.ts","sourceRoot":"","sources":["../../../src/check/authz/is-granted.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;GAGG;AACH,wBAAgB,SAAS,CACvB,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EACvB,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,EAC7C,GAAG,EAAE,MAAM,GACV,OAAO,CAST"}

package/dist/check/authz/is-granted.js

@@ -0,0 +1,11 @@
+import { escapeRegExp } from '../text/escape-reg-exp.js';
+/**
+ * Whether code grants a permission by name: by the entry of its set, `billingPermissions['invoice.issue']`;
+ * by its id, `'billing:invoice.issue'`; or by the wildcard of its context, `'billing:*'`. A comment grants nothing.
+ */
+export function isGranted({ code, strings }, { set, context }, key) {
+    const ids = new Set([`${context}:${key}`, `${context}:*`]);
+    const entries = [...code.matchAll(new RegExp(`(?<![\\w$.])${escapeRegExp(set)}\\s*\\[\\s*`, 'g'))];
+    return (entries.some((entry) => strings.some(({ start, value }) => start === entry.index + entry[0].length && value === key)) || strings.some(({ value }) => ids.has(value)));
+}
+//# sourceMappingURL=is-granted.js.map

package/dist/check/authz/is-granted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-granted.js","sourceRoot":"","sources":["../../../src/check/authz/is-granted.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGzD;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,EAAE,IAAI,EAAE,OAAO,EAAQ,EACvB,EAAE,GAAG,EAAE,OAAO,EAA+B,EAC7C,GAAW;IAEX,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,IAAI,GAAG,EAAE,EAAE,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,eAAe,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAEnG,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC,CAC7F,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACjD,CAAC;AACJ,CAAC"}

package/dist/check/authz/permission-sets.d.ts

@@ -0,0 +1,13 @@
+import type { SourceFile } from '../model/source-file.js';
+import type { StringRecord } from '../scan/string-record.js';
+/** `export const billingPermissions = definePermissions('billing', { 'invoice.issue': .. })`, as the checker reads it. */
+export interface PermissionSet {
+    /** The name code reads the set by: `billingPermissions`. */
+    readonly set: string;
+    readonly context: string;
+    /** The key of each permission, where it is written. */
+    readonly keys: readonly StringRecord[];
+}
+/** The permission sets a file declares, each with the keys of its first level. */
+export declare function permissionSets(file: SourceFile): PermissionSet[];
+//# sourceMappingURL=permission-sets.d.ts.map

package/dist/check/authz/permission-sets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-sets.d.ts","sourceRoot":"","sources":["../../../src/check/authz/permission-sets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAM7D,0HAA0H;AAC1H,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,CAAC;CACxC;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,EAAE,CAqBhE"}

package/dist/check/authz/permission-sets.js

@@ -0,0 +1,19 @@
+import { depthAt } from '../text/depth-at.js';
+import { matchingBracket } from '../text/matching-bracket.js';
+const PERMISSION_SET = /export\s+const\s+([a-z][\w$]*)\s*=\s*definePermissions\(\s*/g;
+/** The permission sets a file declares, each with the keys of its first level. */
+export function permissionSets(file) {
+    const { code, strings } = file.scan;
+    return [...code.matchAll(PERMISSION_SET)].flatMap((found) => {
+        const at = found.index + found[0].length;
+        const context = strings.find(({ start }) => start === at)?.value;
+        const open = code.indexOf('{', at);
+        if (context === undefined || open === -1) {
+            return [];
+        }
+        const close = matchingBracket(code, open);
+        const keys = strings.filter(({ start, end }) => start > open && end < close && /^\s*:/.test(code.slice(end)) && depthAt(code, open, start) === 1);
+        return [{ set: found[1] ?? '', context, keys }];
+    });
+}
+//# sourceMappingURL=permission-sets.js.map

package/dist/check/authz/permission-sets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-sets.js","sourceRoot":"","sources":["../../../src/check/authz/permission-sets.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,cAAc,GAAG,8DAA8D,CAAC;AAWtF,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,IAAgB;IAC7C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;IAEpC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEnC,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE1C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CACzB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CACjB,KAAK,GAAG,IAAI,IAAI,GAAG,GAAG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CACnG,CAAC;QAEF,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/check/catalogue/architecture-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"architecture-rules.d.ts","sourceRoot":"","sources":["../../../src/check/catalogue/architecture-rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAoF7C,gHAAgH;AAChH,eAAO,MAAM,kBAAkB,EAAE,SAAS,IAAI,EAmF7C,CAAC"}
+{"version":3,"file":"architecture-rules.d.ts","sourceRoot":"","sources":["../../../src/check/catalogue/architecture-rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAsF7C,gHAAgH;AAChH,eAAO,MAAM,kBAAkB,EAAE,SAAS,IAAI,EAqF7C,CAAC"}

package/dist/check/catalogue/architecture-rules.js

@@ -2,6 +2,7 @@ import { aspectsOutsideIn } from '../rules/aspects-outside-in.js';
 import { authzActorExplicit } from '../rules/authz-actor-explicit.js';
 import { authzFieldsBySchema } from '../rules/authz-fields-by-schema.js';
 import { authzDeclared } from '../rules/authz-declared.js';
+import { authzGranted } from '../rules/authz-granted.js';
 import { authzInApplication } from '../rules/authz-in-application.js';
 import { authzPolicyAsked } from '../rules/authz-policy-asked.js';
 import { cleanBlankLines } from '../rules/clean-blank-lines.js';
@@ -16,6 +17,7 @@ import { cleanNoNoiseComment } from '../rules/clean-no-noise-comment.js';
 import { cleanOneExportPerFile } from '../rules/clean-one-export-per-file.js';
 import { cleanStepdown } from '../rules/clean-stepdown.js';
 import { compositionOnlyInModule } from '../rules/composition-only-in-module.js';
+import { configRuleOffEverywhere } from '../rules/config-rule-off-everywhere.js';
 import { contextDeclaredRelationship } from '../rules/context-declared-relationship.js';
 import { contextExtractable } from '../rules/context-extractable.js';
 import { contextNoCycle } from '../rules/context-no-cycle.js';
@@ -138,11 +140,13 @@ export const ARCHITECTURE_RULES = [
     authzActorExplicit,
     authzFieldsBySchema,
     authzPolicyAsked,
+    authzGranted,
     aspectsOutsideIn,
     tracingPlatformOnly,
     tenancyScopedStatement,
     standardNoParallelInterface,
     governanceRecordedDeviation,
+    configRuleOffEverywhere,
     compositionOnlyInModule,
     declarationsRoleDeclared,
     declarationsBarrelCurrent,

package/dist/check/catalogue/architecture-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"architecture-rules.js","sourceRoot":"","sources":["../../../src/check/catalogue/architecture-rules.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,mCAAmC,EAAE,MAAM,sDAAsD,CAAC;AAC3G,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,gDAAgD,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAC9G,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,mCAAmC,EAAE,MAAM,qDAAqD,CAAC;AAC1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,kCAAkC,EAAE,MAAM,oDAAoD,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,gHAAgH;AAChH,MAAM,CAAC,MAAM,kBAAkB,GAAoB;IACjD,iBAAiB;IACjB,sBAAsB;IACtB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,2BAA2B;IAC3B,mCAAmC;IACnC,cAAc;IACd,UAAU;IACV,cAAc;IACd,YAAY;IACZ,uBAAuB;IACvB,mBAAmB;IACnB,kBAAkB;IAClB,sBAAsB;IACtB,sBAAsB;IACtB,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,gCAAgC;IAChC,WAAW;IACX,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,yBAAyB;IACzB,mBAAmB;IACnB,aAAa;IACb,iBAAiB;IACjB,uBAAuB;IACvB,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;IAClB,eAAe;IACf,WAAW;IACX,qBAAqB;IACrB,aAAa;IACb,sBAAsB;IACtB,oBAAoB;IACpB,wBAAwB;IACxB,4BAA4B;IAC5B,qCAAqC;IACrC,yBAAyB;IACzB,sBAAsB;IACtB,kCAAkC;IAClC,mCAAmC;IACnC,6BAA6B;IAC7B,kBAAkB;IAClB,aAAa;IACb,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,sBAAsB;IACtB,2BAA2B;IAC3B,2BAA2B;IAC3B,uBAAuB;IACvB,wBAAwB;IACxB,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,oBAAoB;IACpB,yBAAyB;IACzB,gBAAgB;IAChB,4BAA4B;IAC5B,6BAA6B;IAC7B,wBAAwB;IACxB,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,oBAAoB;IACpB,gBAAgB;IAChB,eAAe;IACf,2BAA2B;IAC3B,wBAAwB;IACxB,qBAAqB;CACtB,CAAC"}
+{"version":3,"file":"architecture-rules.js","sourceRoot":"","sources":["../../../src/check/catalogue/architecture-rules.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,mCAAmC,EAAE,MAAM,sDAAsD,CAAC;AAC3G,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,gDAAgD,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,qCAAqC,EAAE,MAAM,uDAAuD,CAAC;AAC9G,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,mCAAmC,EAAE,MAAM,qDAAqD,CAAC;AAC1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,kCAAkC,EAAE,MAAM,oDAAoD,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,gHAAgH;AAChH,MAAM,CAAC,MAAM,kBAAkB,GAAoB;IACjD,iBAAiB;IACjB,sBAAsB;IACtB,iCAAiC;IACjC,iCAAiC;IACjC,4BAA4B;IAC5B,2BAA2B;IAC3B,mCAAmC;IACnC,cAAc;IACd,UAAU;IACV,cAAc;IACd,YAAY;IACZ,uBAAuB;IACvB,mBAAmB;IACnB,kBAAkB;IAClB,sBAAsB;IACtB,sBAAsB;IACtB,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,gCAAgC;IAChC,WAAW;IACX,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,yBAAyB;IACzB,mBAAmB;IACnB,aAAa;IACb,iBAAiB;IACjB,uBAAuB;IACvB,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;IAClB,eAAe;IACf,WAAW;IACX,qBAAqB;IACrB,aAAa;IACb,sBAAsB;IACtB,oBAAoB;IACpB,wBAAwB;IACxB,4BAA4B;IAC5B,qCAAqC;IACrC,yBAAyB;IACzB,sBAAsB;IACtB,kCAAkC;IAClC,mCAAmC;IACnC,6BAA6B;IAC7B,kBAAkB;IAClB,aAAa;IACb,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,YAAY;IACZ,gBAAgB;IAChB,mBAAmB;IACnB,sBAAsB;IACtB,2BAA2B;IAC3B,2BAA2B;IAC3B,uBAAuB;IACvB,uBAAuB;IACvB,wBAAwB;IACxB,yBAAyB;IACzB,gCAAgC;IAChC,kBAAkB;IAClB,2BAA2B;IAC3B,oBAAoB;IACpB,yBAAyB;IACzB,gBAAgB;IAChB,4BAA4B;IAC5B,6BAA6B;IAC7B,wBAAwB;IACxB,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,oBAAoB;IACpB,gBAAgB;IAChB,eAAe;IACf,2BAA2B;IAC3B,wBAAwB;IACxB,qBAAqB;CACtB,CAAC"}

package/dist/check/catalogue/default-severities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-severities.d.ts","sourceRoot":"","sources":["../../../src/check/catalogue/default-severities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD,0GAA0G;AAC1G,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAQjE,CAAC"}
+{"version":3,"file":"default-severities.d.ts","sourceRoot":"","sources":["../../../src/check/catalogue/default-severities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD,0GAA0G;AAC1G,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAUjE,CAAC"}

package/dist/check/catalogue/default-severities.js

@@ -1,5 +1,6 @@
 /** Rules that advise instead of blocking unless the config says otherwise (ARCHITECTURE.md section 3). */
 export const DEFAULT_SEVERITIES = {
+    'authz/granted': 'warn',
     'test/no-mocks': 'warn',
     'test/builder-required': 'warn',
     'clean/function-size': 'warn',
@@ -7,5 +8,6 @@ export const DEFAULT_SEVERITIES = {
     'clean/no-flag-argument': 'warn',
     'application/command-query-separation': 'warn',
     'standard/no-parallel-interface': 'warn',
+    'config/rule-off-everywhere': 'warn',
 };
 //# sourceMappingURL=default-severities.js.map

package/dist/check/catalogue/default-severities.js.map

@@ -1 +1 @@
-{"version":3,"file":"default-severities.js","sourceRoot":"","sources":["../../../src/check/catalogue/default-severities.ts"],"names":[],"mappings":"AAEA,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kBAAkB,GAAuC;IACpE,eAAe,EAAE,MAAM;IACvB,uBAAuB,EAAE,MAAM;IAC/B,qBAAqB,EAAE,MAAM;IAC7B,wBAAwB,EAAE,MAAM;IAChC,wBAAwB,EAAE,MAAM;IAChC,sCAAsC,EAAE,MAAM;IAC9C,gCAAgC,EAAE,MAAM;CACzC,CAAC"}
+{"version":3,"file":"default-severities.js","sourceRoot":"","sources":["../../../src/check/catalogue/default-severities.ts"],"names":[],"mappings":"AAEA,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kBAAkB,GAAuC;IACpE,eAAe,EAAE,MAAM;IACvB,eAAe,EAAE,MAAM;IACvB,uBAAuB,EAAE,MAAM;IAC/B,qBAAqB,EAAE,MAAM;IAC7B,wBAAwB,EAAE,MAAM;IAChC,wBAAwB,EAAE,MAAM;IAChC,sCAAsC,EAAE,MAAM;IAC9C,gCAAgC,EAAE,MAAM;IACxC,4BAA4B,EAAE,MAAM;CACrC,CAAC"}

package/dist/check/commands/rules-command.js

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { Arguments } from '../../commands/arguments.js';
 import {} from '../../commands/command.js';
-import { CONFIG_FILE, isOneOf, readConfig, SEVERITIES } from '../../config/index.js';
+import { CONFIG_FILE, isOneOf, projectSeverity, readConfig, SEVERITIES } from '../../config/index.js';
 import { DEFAULT_SEVERITIES } from '../catalogue/default-severities.js';
 import { DELEGATED_RULES } from '../catalogue/delegated-rules.js';
 import { RULES } from '../catalogue/rules.js';
@@ -18,7 +18,7 @@ export const rulesCommand = (argv, io) => {
 function listedRules(root) {
     const configured = fs.existsSync(path.join(root, CONFIG_FILE)) ? readConfig(root).config.rules : {};
     const severityOf = (id) => {
-        const severity = configured[id];
+        const severity = projectSeverity(configured[id]);
         return isOneOf(SEVERITIES, severity) ? severity : (DEFAULT_SEVERITIES[id] ?? 'error');
     };
     const own = [...RULES, SUPPRESSION_RULE].map((rule) => ({

package/dist/check/commands/rules-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules-command.js","sourceRoot":"","sources":["../../../src/check/commands/rules-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAgB,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAUpE,MAAM,CAAC,MAAM,YAAY,GAAY,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;IAChD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAE/G,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtE,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpG,MAAM,UAAU,GAAG,CAAC,EAAU,EAAU,EAAE;QACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAEhC,OAAO,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC;IACxF,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtD,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,kBAAkB;KAC9B,CAAC,CAAC,CAAC;IAEJ,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,WAAW,EAAE,GAAG,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,SAAS,GAAG;QACtD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC,CAAC;IAEJ,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"rules-command.js","sourceRoot":"","sources":["../../../src/check/commands/rules-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAgB,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAUpE,MAAM,CAAC,MAAM,YAAY,GAAY,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;IAChD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAE/G,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtE,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpG,MAAM,UAAU,GAAG,CAAC,EAAU,EAAU,EAAE;QACxC,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAEjD,OAAO,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC;IACxF,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtD,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,kBAAkB;KAC9B,CAAC,CAAC,CAAC;IAEJ,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/C,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,WAAW,EAAE,GAAG,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,SAAS,GAAG;QACtD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC,CAAC;IAEJ,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;AAChC,CAAC"}

package/dist/check/configuration/config-inspection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-inspection.d.ts","sourceRoot":"","sources":["../../../src/check/configuration/config-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAcL,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMvD,qGAAqG;AACrG,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFzB,YACmB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EAC7B;IAEJ,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,CAMjE;IAED,qBAAqB,IAAI,SAAS,EAAE,CAanC;IAED,YAAY,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,CAoBlD;IAED,SAAS,IAAI,SAAS,EAAE,CAcvB;IAED,6EAA6E;IAC7E,eAAe,IAAI,SAAS,EAAE,CAc7B;IAED,2GAA2G;IAC3G,kBAAkB,IAAI,SAAS,EAAE,CAiBhC;IAED,oHAAoH;IACpH,YAAY,IAAI,SAAS,EAAE,CAI1B;IAED,mHAAmH;IACnH,QAAQ,IAAI,SAAS,EAAE,CAItB;IAED,0EAA0E;IAC1E,eAAe,IAAI,SAAS,EAAE,CAM7B;IAED,0EAA0E;IAC1E,WAAW,IAAI,SAAS,EAAE,CAEzB;IAED,gHAAgH;IAChH,kBAAkB,IAAI,SAAS,EAAE,CAIhC;IAED,qGAAqG;IACrG,oBAAoB,IAAI,SAAS,EAAE,CA4BlC;IAED,OAAO,CAAC,cAAc;IActB,OAAO,CAAC,QAAQ;IAgChB,OAAO,CAAC,QAAQ;IAiBhB,qFAAqF;IACrF,OAAO,CAAC,QAAQ;CAGjB"}
+{"version":3,"file":"config-inspection.d.ts","sourceRoot":"","sources":["../../../src/check/configuration/config-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAcL,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMvD,qGAAqG;AACrG,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFzB,YACmB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EAC7B;IAEJ,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,CAMjE;IAED,qBAAqB,IAAI,SAAS,EAAE,CAanC;IAED,YAAY,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,CAgClD;IAED,SAAS,IAAI,SAAS,EAAE,CAcvB;IAED,6EAA6E;IAC7E,eAAe,IAAI,SAAS,EAAE,CAc7B;IAED,2GAA2G;IAC3G,kBAAkB,IAAI,SAAS,EAAE,CAiBhC;IAED,oHAAoH;IACpH,YAAY,IAAI,SAAS,EAAE,CAI1B;IAED,mHAAmH;IACnH,QAAQ,IAAI,SAAS,EAAE,CAItB;IAED,0EAA0E;IAC1E,eAAe,IAAI,SAAS,EAAE,CAM7B;IAED,0EAA0E;IAC1E,WAAW,IAAI,SAAS,EAAE,CAEzB;IAED,gHAAgH;IAChH,kBAAkB,IAAI,SAAS,EAAE,CAIhC;IAED,qGAAqG;IACrG,oBAAoB,IAAI,SAAS,EAAE,CA4BlC;IAED,OAAO,CAAC,cAAc;IActB,OAAO,CAAC,QAAQ;IAgChB,OAAO,CAAC,QAAQ;IAiBhB,qFAAqF;IACrF,OAAO,CAAC,QAAQ;CAGjB"}

package/dist/check/configuration/config-inspection.js

@@ -26,17 +26,23 @@ export class ConfigInspection {
             .map((name) => this.report({ file: `${contextsDir}/${name}`, line: 1 }, `The directory ${contextsDir}/${name} is not a declared context.`, fix));
     }
     ruleSettings(known) {
-        return Object.entries(this.project.config.rules).flatMap(([id, severity]) => {
+        return Object.entries(this.project.config.rules).flatMap(([id, setting]) => {
             if (!known.includes(id)) {
                 return [
                     this.inConfig(id, `The rule "${id}" does not exist.`, 'Fix the id; `ddd-ts-kit rules` lists the valid ones.'),
                 ];
             }
+            const severity = typeof setting === 'string' ? setting : setting.severity;
             if (!isOneOf(SEVERITIES, severity)) {
                 return [
                     this.inConfig(id, `The rule "${id}" has the severity "${severity}".`, `Use one of: ${SEVERITIES.join(', ')}.`),
                 ];
             }
+            if (typeof setting !== 'string' && setting.files.length === 0) {
+                return [
+                    this.inConfig(id, `The rule "${id}" is set for some files, but "files" names none.`, 'List the files it is for in "files", as globs relative to the project root (`src/contexts/*/*.declarations.ts`), or write the severity alone for the whole project.'),
+                ];
+            }
             return [];
         });
     }

package/dist/check/configuration/config-inspection.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-inspection.js","sourceRoot":"","sources":["../../../src/check/configuration/config-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,eAAe,EACf,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,OAAO,EACP,aAAa,EACb,UAAU,GAGX,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,qGAAqG;AACrG,MAAM,OAAO,gBAAgB;IAER,OAAO;IACP,MAAM;IAFzB,YACmB,OAAgB,EAChB,MAAc;uBADd,OAAO;sBACP,MAAM;IACtB,CAAC;IAEJ,eAAe,CAAC,IAAY,EAAE,OAAsB;QAClD,OAAO;YACL,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;YACrC,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACzE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,qBAAqB;QACnB,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACtD,MAAM,GAAG,GAAG,kCAAkC,WAAW,yCAAyC,CAAC;QAEnG,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc;aAC/B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;aAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,IAAI,CAAC,MAAM,CACT,EAAE,IAAI,EAAE,GAAG,WAAW,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAC3C,iBAAiB,WAAW,IAAI,IAAI,6BAA6B,EACjE,GAAG,CACJ,CACF,CAAC;IACN,CAAC;IAED,YAAY,CAAC,KAAwB;QACnC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;YAC1E,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxB,OAAO;oBACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,EAAE,mBAAmB,EAAE,sDAAsD,CAAC;iBAC9G,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACnC,OAAO;oBACL,IAAI,CAAC,QAAQ,CACX,EAAE,EACF,aAAa,EAAE,uBAAuB,QAAQ,IAAI,EAClD,eAAe,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxC;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEtC,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,IAAI,CAAC,QAAQ,CACX,OAAO,EACP,eAAe,KAAK,IAAI,EACxB,eAAe,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,iGAAiG,CACvI;SACF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,eAAe;QACb,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEhD,IAAI,OAAO,CAAC,iBAAiB,EAAE,eAAe,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,IAAI,CAAC,QAAQ,CACX,iBAAiB,EACjB,yBAAyB,eAAe,IAAI,EAC5C,eAAe,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,4KAA4K,CACxN;SACF,CAAC;IACJ,CAAC;IAED,2GAA2G;IAC3G,kBAAkB;QAChB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,sBAAsB,EAAE,CAAC;YACrE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,GAAG,GAAG,oCAAoC,sBAAsB,wCAAwC,sBAAsB,mCAAmC,CAAC;QAExK,OAAO;YACL,IAAI,CAAC,QAAQ,CACX,kBAAkB,EAClB,gCAAgC,OAAO,0BAA0B,sBAAsB,mBAAmB,sBAAsB,GAAG,EACnI,GAAG,CACJ;SACF,CAAC;IACJ,CAAC;IAED,oHAAoH;IACpH,YAAY;QACV,OAAO,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAC1F,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CACjC,CAAC;IACJ,CAAC;IAED,mHAAmH;IACnH,QAAQ;QACN,OAAO,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAClF,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CACjC,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,eAAe;QACb,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE3D,OAAO,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CACjG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CACjC,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,WAAW;QACT,OAAO,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACtH,CAAC;IAED,gHAAgH;IAChH,kBAAkB;QAChB,OAAO,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAC3F,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CACvG,CAAC;IACJ,CAAC;IAED,qGAAqG;IACrG,oBAAoB;QAClB,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,OAAO,GAAc,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEjH,MAAM,GAAG,GACP,sIAAsI,CAAC;QAEzI,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAEjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE;gBACnD,cAAc;gBACd,SAAS;gBACT,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC;aAChD,CAAC,CAAC;YAEH,OAAO;gBACL,IAAI,CAAC,MAAM,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAC3B,SAAS,KAAK,GAAG,CAAC,iCAAiC,OAAO,kBAAkB,EAC5E,GAAG,CACJ;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,IAAY,EAAE,OAAsB;QACzD,IAAI,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,IAAI,CAAC,QAAQ,CACX,IAAI,EACJ,gBAAgB,IAAI,6BAA6B,OAAO,CAAC,cAAc,IAAI,EAC3E,gBAAgB,IAAI,8BAA8B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChF;SACF,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,QAAkB;QAC/C,MAAM,UAAU,GAAgB,EAAE,CAAC;QAEnC,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9B,UAAU,CAAC,IAAI,CACb,IAAI,CAAC,QAAQ,CACX,IAAI,EACJ,gBAAgB,IAAI,gCAAgC,EACpD,wDAAwD,CACzD,CACF,CAAC;QACJ,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,MAAM,GAAG,iCAAiC,QAAQ,CAAC,OAAO,+CAA+C,CAAC;YAEhH,UAAU,CAAC,IAAI,CACb,IAAI,CAAC,QAAQ,CACX,QAAQ,CAAC,OAAO,EAChB,gBAAgB,IAAI,oCAAoC,QAAQ,CAAC,OAAO,IAAI,EAC5E,4CAA4C,MAAM,GAAG,CACtD,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,qBAAqB,QAAQ,CAAC,YAAY,cAAc,IAAI,UAAU,QAAQ,CAAC,OAAO,eAAe,CAAC;YAEtH,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,EAAE,eAAe,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7G,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,OAAsB;QACnD,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5C,MAAM,MAAM,GAAG,iCAAiC,IAAI,qBAAqB,OAAO,CAAC,cAAc,IAAI,MAAM,IAAI,CAAC;QAE9G,OAAO;YACL,IAAI,CAAC,QAAQ,CACX,IAAI,EACJ,gBAAgB,IAAI,qBAAqB,WAAW,IAAI,IAAI,kBAAkB,EAC9E,kBAAkB,MAAM,iCAAiC,CAC1D;SACF,CAAC;IACJ,CAAC;IAED,qFAAqF;IAC7E,QAAQ,CAAC,MAAc,EAAE,OAAe,EAAE,GAAW;QAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,MAAM,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAChH,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5C,MAAM,GAAG,GAAG,CAAC,GAAW,EAAW,EAAE;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAE1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1D,CAAC,CAAC;IAEF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjB,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACvD,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"config-inspection.js","sourceRoot":"","sources":["../../../src/check/configuration/config-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,eAAe,EACf,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,OAAO,EACP,aAAa,EACb,UAAU,GAGX,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,qGAAqG;AACrG,MAAM,OAAO,gBAAgB;IAER,OAAO;IACP,MAAM;IAFzB,YACmB,OAAgB,EAChB,MAAc;uBADd,OAAO;sBACP,MAAM;IACtB,CAAC;IAEJ,eAAe,CAAC,IAAY,EAAE,OAAsB;QAClD,OAAO;YACL,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;YACrC,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACzE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,qBAAqB;QACnB,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACtD,MAAM,GAAG,GAAG,kCAAkC,WAAW,yCAAyC,CAAC;QAEnG,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc;aAC/B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;aAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,IAAI,CAAC,MAAM,CACT,EAAE,IAAI,EAAE,GAAG,WAAW,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAC3C,iBAAiB,WAAW,IAAI,IAAI,6BAA6B,EACjE,GAAG,CACJ,CACF,CAAC;IACN,CAAC;IAED,YAAY,CAAC,KAAwB;QACnC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE;YACzE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxB,OAAO;oBACL,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,EAAE,mBAAmB,EAAE,sDAAsD,CAAC;iBAC9G,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YAE1E,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACnC,OAAO;oBACL,IAAI,CAAC,QAAQ,CACX,EAAE,EACF,aAAa,EAAE,uBAAuB,QAAQ,IAAI,EAClD,eAAe,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxC;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9D,OAAO;oBACL,IAAI,CAAC,QAAQ,CACX,EAAE,EACF,aAAa,EAAE,kDAAkD,EACjE,qKAAqK,CACtK;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEtC,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,IAAI,CAAC,QAAQ,CACX,OAAO,EACP,eAAe,KAAK,IAAI,EACxB,eAAe,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,iGAAiG,CACvI;SACF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,eAAe;QACb,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEhD,IAAI,OAAO,CAAC,iBAAiB,EAAE,eAAe,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,IAAI,CAAC,QAAQ,CACX,iBAAiB,EACjB,yBAAyB,eAAe,IAAI,EAC5C,eAAe,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,4KAA4K,CACxN;SACF,CAAC;IACJ,CAAC;IAED,2GAA2G;IAC3G,kBAAkB;QAChB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,sBAAsB,EAAE,CAAC;YACrE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,GAAG,GAAG,oCAAoC,sBAAsB,wCAAwC,sBAAsB,mCAAmC,CAAC;QAExK,OAAO;YACL,IAAI,CAAC,QAAQ,CACX,kBAAkB,EAClB,gCAAgC,OAAO,0BAA0B,sBAAsB,mBAAmB,sBAAsB,GAAG,EACnI,GAAG,CACJ;SACF,CAAC;IACJ,CAAC;IAED,oHAAoH;IACpH,YAAY;QACV,OAAO,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAC1F,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CACjC,CAAC;IACJ,CAAC;IAED,mHAAmH;IACnH,QAAQ;QACN,OAAO,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAClF,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CACjC,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,eAAe;QACb,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE3D,OAAO,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CACjG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CACjC,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,WAAW;QACT,OAAO,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACtH,CAAC;IAED,gHAAgH;IAChH,kBAAkB;QAChB,OAAO,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAC3F,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CACvG,CAAC;IACJ,CAAC;IAED,qGAAqG;IACrG,oBAAoB;QAClB,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,OAAO,GAAc,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEjH,MAAM,GAAG,GACP,sIAAsI,CAAC;QAEzI,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAEjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE;gBACnD,cAAc;gBACd,SAAS;gBACT,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC;aAChD,CAAC,CAAC;YAEH,OAAO;gBACL,IAAI,CAAC,MAAM,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAC3B,SAAS,KAAK,GAAG,CAAC,iCAAiC,OAAO,kBAAkB,EAC5E,GAAG,CACJ;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,IAAY,EAAE,OAAsB;QACzD,IAAI,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,IAAI,CAAC,QAAQ,CACX,IAAI,EACJ,gBAAgB,IAAI,6BAA6B,OAAO,CAAC,cAAc,IAAI,EAC3E,gBAAgB,IAAI,8BAA8B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChF;SACF,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,QAAkB;QAC/C,MAAM,UAAU,GAAgB,EAAE,CAAC;QAEnC,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9B,UAAU,CAAC,IAAI,CACb,IAAI,CAAC,QAAQ,CACX,IAAI,EACJ,gBAAgB,IAAI,gCAAgC,EACpD,wDAAwD,CACzD,CACF,CAAC;QACJ,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,MAAM,GAAG,iCAAiC,QAAQ,CAAC,OAAO,+CAA+C,CAAC;YAEhH,UAAU,CAAC,IAAI,CACb,IAAI,CAAC,QAAQ,CACX,QAAQ,CAAC,OAAO,EAChB,gBAAgB,IAAI,oCAAoC,QAAQ,CAAC,OAAO,IAAI,EAC5E,4CAA4C,MAAM,GAAG,CACtD,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,qBAAqB,QAAQ,CAAC,YAAY,cAAc,IAAI,UAAU,QAAQ,CAAC,OAAO,eAAe,CAAC;YAEtH,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,EAAE,eAAe,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7G,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,OAAsB;QACnD,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5C,MAAM,MAAM,GAAG,iCAAiC,IAAI,qBAAqB,OAAO,CAAC,cAAc,IAAI,MAAM,IAAI,CAAC;QAE9G,OAAO;YACL,IAAI,CAAC,QAAQ,CACX,IAAI,EACJ,gBAAgB,IAAI,qBAAqB,WAAW,IAAI,IAAI,kBAAkB,EAC9E,kBAAkB,MAAM,iCAAiC,CAC1D;SACF,CAAC;IACJ,CAAC;IAED,qFAAqF;IAC7E,QAAQ,CAAC,MAAc,EAAE,OAAe,EAAE,GAAW;QAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,MAAM,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAChH,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5C,MAAM,GAAG,GAAG,CAAC,GAAW,EAAW,EAAE;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAE1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1D,CAAC,CAAC;IAEF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjB,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACvD,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9C,CAAC"}

package/dist/check/engine/run-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-check.d.ts","sourceRoot":"","sources":["../../../src/check/engine/run-check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAOnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,YAAiB,GAAG,WAAW,CAiBlF"}
+{"version":3,"file":"run-check.d.ts","sourceRoot":"","sources":["../../../src/check/engine/run-check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAOnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,YAAiB,GAAG,WAAW,CAqBlF"}

package/dist/check/engine/run-check.js

@@ -8,7 +8,9 @@ export function runCheck(project, options = {}) {
     const selected = (id) => options.rules === undefined || options.rules.length === 0 || options.rules.includes(id);
     const suppressions = project.files.flatMap(findSuppressions);
     const active = RULES.filter((rule) => selected(rule.id) && project.severity(rule.id) !== 'off');
-    const raw = active.flatMap((rule) => violationsOf(rule, project, options.fileScopeOnly === true));
+    const raw = active
+        .flatMap((rule) => violationsOf(rule, project, options.fileScopeOnly === true))
+        .flatMap((violation) => placed(violation, project));
     const kept = raw.filter((violation) => !isSuppressed(violation, suppressions));
     const suppressedCount = raw.length - kept.length;
     if (selected(SUPPRESSION_RULE_ID)) {
@@ -17,6 +19,20 @@ export function runCheck(project, options = {}) {
     kept.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.ruleId.localeCompare(b.ruleId));
     return summarize(kept, { suppressedCount, suppressionCount: suppressions.length, fileCount: project.files.length });
 }
+/**
+ * A finding on a file a setting names takes its severity, or is dropped where the rule is off. A
+ * finding a rule raises above the severity of the project (the ceiling of clean/function-size) keeps it.
+ */
+function placed(violation, project) {
+    const severity = project.fileSeverity(violation.ruleId, violation.file);
+    if (severity === undefined) {
+        return [violation];
+    }
+    if (severity === 'off') {
+        return [];
+    }
+    return [violation.severity === project.severity(violation.ruleId) ? { ...violation, severity } : violation];
+}
 function violationsOf(rule, project, oneFileOnly) {
     if (!oneFileOnly) {
         return [...rule.run(project), ...(rule.acrossProject?.(project) ?? [])];