legion-audit 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# legion-audit
+
+## 0.1.0
+
+### Minor Changes
+
+- ecc18df: Initial release: nine grade A rules with tolerance levels, the oxlint/ESLint plugin, the audit CLI with the `directives` subcommand, the Prettier and TypeScript configs, and the umbrella package.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Veracium LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,84 @@
+# legion-audit
+
+A read-only scorecard of a repo against
+[LEGION-STANDARDS](https://github.com/Kprince1101/legion-toolkit#readme). It
+runs the gates your CI already runs, counts what the
+[`legion/*` rules](https://www.npmjs.com/package/eslint-plugin-legion) find,
+lists every lint bypass, checks PR hygiene and which components and hooks
+have no test file, and writes the result as Markdown and JSON. Nothing is
+modified.
+
+```sh
+yarn add -D legion-audit
+yarn legion-audit --md AUDIT.md --json audit.json
+```
+
+## What it checks
+
+| Check              | Source of truth                                                                       |
+| ------------------ | ------------------------------------------------------------------------------------- |
+| typecheck          | `tsc --noEmit -p tsconfig.json` (skipped when there is no tsconfig or local tsc)      |
+| lint               | the repo's oxlint or ESLint, `--format json`; counts per rule, `legion/*` findings    |
+| tests              | the `test:ci` or `test` script, run through the detected package manager              |
+| format             | `prettier --check .` (skipped when prettier is not installed)                         |
+| dependency audit   | `yarn npm audit` / `npm audit` / `pnpm audit` at high severity (skipped when offline) |
+| lint bypasses      | every `eslint-disable` / `oxlint-disable` directive and `NOSONAR`, counted per rule   |
+| file-wide disables | a bare `/* eslint-disable */` or `/* oxlint-disable */`; always a hard fail           |
+| PR hygiene         | share of the last 80 commits whose subject carries a `(#123)` PR number               |
+| tests by file      | components (`components/**`, `app/**`) and `use*` hooks without a matching test file  |
+| lockfile           | exactly one lockfile at the root                                                      |
+
+A tool that is not installed reports `skipped`, never `pass`.
+
+## Output
+
+`AUDIT.md` opens with the gate table, then per-rule counts, findings with
+file and line, the bypass list, PR hygiene, tests by file, and the score
+formula. `audit.json` carries the same data (`schema: 1`).
+
+The score starts at 100 and subtracts documented penalties (see the bottom of
+any report). It is meant for comparing runs of the same repo over time, not
+for comparing repos to each other.
+
+## In CI
+
+```sh
+legion-audit --baseline audit.json --json audit.json --md AUDIT.md
+```
+
+With `--baseline`, the exit code is non-zero on any regression: a gate that
+flipped from pass to fail, more `legion/*` errors, more lint errors, more
+file-wide disables, more files without tests, or a lower score. `--fail-on
+error` fails on any failed gate or `legion/*` error regardless of baseline;
+`--fail-on never` always exits 0.
+
+## `legion-audit directives`
+
+The fast subcommand: only the file-wide disable scan, exit 1 if any. A
+file-wide disable suppresses every rule in the file including the one that
+would report it, so no lint rule can catch it. Put this in front of the
+linter:
+
+```jsonc
+{ "scripts": { "lint": "legion-audit directives && oxlint ." } }
+```
+
+## Options
+
+```
+--root <dir>       repo root (default: cwd)
+--md <file>        write the Markdown report (default: stdout)
+--json <file>      write the JSON report
+--baseline <file>  previous JSON report to diff against
+--fail-on <mode>   regression | error | never
+--ignore <path>    skip a directory for the directive scan and tests-by-file (repeatable)
+--no-deps-audit    skip the dependency audit
+--no-tests         skip the test script
+--no-typecheck     skip tsc
+--no-format        skip prettier
+--quiet, -q        no progress on stderr
+```
+
+Node 22 or newer. No runtime dependencies.
+
+MIT, Copyright (c) 2026 Veracium LLC.

package/dist/args.d.ts

@@ -0,0 +1,18 @@
+export type FailOn = 'regression' | 'error' | 'never';
+export interface CliArgs {
+    command: 'audit' | 'directives' | 'help';
+    root: string;
+    md: string | null;
+    json: string | null;
+    baseline: string | null;
+    failOn: FailOn | null;
+    depsAudit: boolean;
+    runTests: boolean;
+    runTypecheck: boolean;
+    runFormat: boolean;
+    quiet: boolean;
+    ignore: string[];
+}
+export declare const parseArgs: (argv: string[]) => CliArgs;
+export declare const HELP = "legion-audit [directives] [options]\n\nRuns a read-only scorecard of the current repo against LEGION-STANDARDS.\n\nCommands\n  (none)        full audit: gates, rule counts, bypasses, PR hygiene, tests by file\n  directives    only scan for file-wide lint disables; exit 1 if any (fast, for lint scripts)\n\nOptions\n  --root <dir>            repo root (default: cwd)\n  --md <file>             write the markdown report (default: print to stdout)\n  --json <file>           write the JSON report\n  --baseline <file>       compare against a previous JSON report\n  --fail-on <mode>        regression | error | never\n                          default: regression when --baseline is given, otherwise never\n  --ignore <path>         skip a directory for the directive scan and tests-by-file (repeatable)\n  --no-deps-audit         skip the dependency audit (needs registry access)\n  --no-tests              skip running the test script\n  --no-typecheck          skip tsc\n  --no-format             skip prettier --check\n  --quiet, -q             no progress output on stderr\n";
+//# sourceMappingURL=args.d.ts.map

package/dist/args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,MAAM,GAAG,YAAY,GAAG,OAAO,GAAG,OAAO,CAAC;AAEtD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,OAAO,GAAG,YAAY,GAAG,MAAM,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAYD,eAAO,MAAM,SAAS,GAAI,MAAM,MAAM,EAAE,KAAG,OAoD1C,CAAC;AAEF,eAAO,MAAM,IAAI,2jCAqBhB,CAAC"}

package/dist/args.js

@@ -0,0 +1,97 @@
+const FAIL_ON_VALUES = new Set(['regression', 'error', 'never']);
+const takeValue = (argv, index, flag) => {
+    const value = argv[index + 1];
+    if (value === undefined || value.startsWith('--')) {
+        throw new Error(`${flag} needs a value`);
+    }
+    return value;
+};
+export const parseArgs = (argv) => {
+    const args = {
+        command: 'audit',
+        root: process.cwd(),
+        md: null,
+        json: null,
+        baseline: null,
+        failOn: null,
+        depsAudit: true,
+        runTests: true,
+        runTypecheck: true,
+        runFormat: true,
+        quiet: false,
+        ignore: [],
+    };
+    let index = 0;
+    while (index < argv.length) {
+        const arg = argv[index] ?? '';
+        if (arg === 'directives')
+            args.command = 'directives';
+        else if (arg === 'help' || arg === '--help' || arg === '-h')
+            args.command = 'help';
+        else if (arg === '--root') {
+            args.root = takeValue(argv, index, arg);
+            index += 1;
+        }
+        else if (arg === '--md') {
+            args.md = takeValue(argv, index, arg);
+            index += 1;
+        }
+        else if (arg === '--json') {
+            args.json = takeValue(argv, index, arg);
+            index += 1;
+        }
+        else if (arg === '--baseline') {
+            args.baseline = takeValue(argv, index, arg);
+            index += 1;
+        }
+        else if (arg === '--fail-on') {
+            const value = takeValue(argv, index, arg);
+            if (!FAIL_ON_VALUES.has(value)) {
+                throw new Error(`--fail-on must be one of regression, error, never`);
+            }
+            args.failOn = value;
+            index += 1;
+        }
+        else if (arg === '--ignore') {
+            args.ignore.push(takeValue(argv, index, arg));
+            index += 1;
+        }
+        else if (arg === '--no-deps-audit')
+            args.depsAudit = false;
+        else if (arg === '--no-tests')
+            args.runTests = false;
+        else if (arg === '--no-typecheck')
+            args.runTypecheck = false;
+        else if (arg === '--no-format')
+            args.runFormat = false;
+        else if (arg === '--quiet' || arg === '-q')
+            args.quiet = true;
+        else
+            throw new Error(`unknown argument: ${arg}`);
+        index += 1;
+    }
+    return args;
+};
+export const HELP = `legion-audit [directives] [options]
+
+Runs a read-only scorecard of the current repo against LEGION-STANDARDS.
+
+Commands
+  (none)        full audit: gates, rule counts, bypasses, PR hygiene, tests by file
+  directives    only scan for file-wide lint disables; exit 1 if any (fast, for lint scripts)
+
+Options
+  --root <dir>            repo root (default: cwd)
+  --md <file>             write the markdown report (default: print to stdout)
+  --json <file>           write the JSON report
+  --baseline <file>       compare against a previous JSON report
+  --fail-on <mode>        regression | error | never
+                          default: regression when --baseline is given, otherwise never
+  --ignore <path>         skip a directory for the directive scan and tests-by-file (repeatable)
+  --no-deps-audit         skip the dependency audit (needs registry access)
+  --no-tests              skip running the test script
+  --no-typecheck          skip tsc
+  --no-format             skip prettier --check
+  --quiet, -q             no progress output on stderr
+`;
+//# sourceMappingURL=args.js.map

package/dist/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAiBA,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEzE,MAAM,SAAS,GAAG,CAAC,IAAc,EAAE,KAAa,EAAE,IAAY,EAAU,EAAE;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAc,EAAW,EAAE;IACnD,MAAM,IAAI,GAAY;QACpB,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE;QACnB,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,EAAE;KACX,CAAC;IACF,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAG,KAAK,YAAY;YAAE,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC;aACjD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YACzD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;aACnB,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACxC,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACtC,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACxC,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC5C,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAe,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,KAAe,CAAC;YAC9B,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC9C,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,GAAG,KAAK,iBAAiB;YAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;aACxD,IAAI,GAAG,KAAK,YAAY;YAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;aAChD,IAAI,GAAG,KAAK,gBAAgB;YAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;aACxD,IAAI,GAAG,KAAK,aAAa;YAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;aAClD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;;YACzD,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;QACjD,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBnB,CAAC"}

package/dist/audit.d.ts

@@ -0,0 +1,4 @@
+import type { AuditOptions, AuditResult } from './types.js';
+export declare const DEFAULT_OPTIONS: AuditOptions;
+export declare const runAudit: (partial?: Partial<AuditOptions>) => AuditResult;
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AAExE,eAAO,MAAM,eAAe,EAAE,YAS7B,CAAC;AASF,eAAO,MAAM,QAAQ,GAAI,UAAS,OAAO,CAAC,YAAY,CAAM,KAAG,WA4D9D,CAAC"}

package/dist/audit.js

@@ -0,0 +1,81 @@
+import { resolve } from 'node:path';
+import { scanDirectives } from './checks/directives.js';
+import { depsAuditGate, formatGate, testsGate, typecheckGate, } from './checks/gates.js';
+import { prHygiene } from './checks/git.js';
+import { runLint } from './checks/lint.js';
+import { lockfileCheck } from './checks/lockfile.js';
+import { testCoverage } from './checks/test-coverage.js';
+import { computeScore } from './report/score.js';
+export const DEFAULT_OPTIONS = {
+    root: process.cwd(),
+    depsAudit: true,
+    runTests: true,
+    runTypecheck: true,
+    runFormat: true,
+    quiet: false,
+    commitsToInspect: 80,
+    ignore: [],
+};
+const loggerFor = (options) => {
+    if (options.quiet)
+        return () => undefined;
+    return (message) => console.error(message);
+};
+export const runAudit = (partial = {}) => {
+    const options = { ...DEFAULT_OPTIONS, ...partial };
+    const root = resolve(options.root);
+    const log = loggerFor(options);
+    log('legion-audit: lockfile');
+    const lockfile = lockfileCheck(root);
+    const { packageManager } = lockfile;
+    const gates = [];
+    if (options.runTypecheck) {
+        log('legion-audit: typecheck');
+        gates.push(typecheckGate(root));
+    }
+    log('legion-audit: lint');
+    const lint = runLint(root);
+    const lintGate = {
+        name: 'lint',
+        status: lint.status,
+        summary: `${lint.linter}: ${lint.errors} error(s), ${lint.warnings} warning(s)`,
+    };
+    if (lint.command !== undefined)
+        lintGate.command = lint.command;
+    gates.push(lintGate);
+    if (options.runTests) {
+        log('legion-audit: tests');
+        gates.push(testsGate(root, packageManager));
+    }
+    if (options.runFormat) {
+        log('legion-audit: format');
+        gates.push(formatGate(root));
+    }
+    if (options.depsAudit) {
+        log('legion-audit: dependency audit');
+        gates.push(depsAuditGate(root, packageManager));
+    }
+    log('legion-audit: directives');
+    const directives = scanDirectives(root, options.ignore);
+    log('legion-audit: git history');
+    const hygiene = prHygiene(root, options.commitsToInspect);
+    log('legion-audit: tests by file');
+    const coverage = testCoverage(root, options.ignore);
+    const partialResult = {
+        root,
+        packageManager,
+        gates,
+        lint,
+        directives,
+        prHygiene: hygiene,
+        testCoverage: coverage,
+        lockfile,
+    };
+    return {
+        schema: 1,
+        generatedAt: new Date().toISOString(),
+        score: computeScore(partialResult),
+        ...partialResult,
+    };
+};
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,UAAU,EACV,SAAS,EACT,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,MAAM,CAAC,MAAM,eAAe,GAAiB;IAC3C,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE;IACnB,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,IAAI;IACd,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,KAAK;IACZ,gBAAgB,EAAE,EAAE;IACpB,MAAM,EAAE,EAAE;CACX,CAAC;AAIF,MAAM,SAAS,GAAG,CAAC,OAAqB,EAAU,EAAE;IAClD,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAC1C,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,UAAiC,EAAE,EAAe,EAAE;IAC3E,MAAM,OAAO,GAAiB,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAE/B,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC;IAEpC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAe;QAC3B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,cAAc,IAAI,CAAC,QAAQ,aAAa;KAChF,CAAC;IACF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAChE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,GAAG,CAAC,gCAAgC,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1D,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpD,MAAM,aAAa,GAAG;QACpB,IAAI;QACJ,cAAc;QACd,KAAK;QACL,IAAI;QACJ,UAAU;QACV,SAAS,EAAE,OAAO;QAClB,YAAY,EAAE,QAAQ;QACtB,QAAQ;KACT,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,CAAC;QACT,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,KAAK,EAAE,YAAY,CAAC,aAAa,CAAC;QAClC,GAAG,aAAa;KACjB,CAAC;AACJ,CAAC,CAAC"}

package/dist/checks/directives.d.ts

@@ -0,0 +1,8 @@
+import type { DirectiveHit, DirectivesResult, NosonarHit } from '../types.js';
+export declare const parseDirectivesInSource: (file: string, source: string) => {
+    hits: DirectiveHit[];
+    nosonar: NosonarHit[];
+};
+export declare const isFileWideDisable: (hit: DirectiveHit) => boolean;
+export declare const scanDirectives: (root: string, ignore?: string[]) => DirectivesResult;
+//# sourceMappingURL=directives.d.ts.map

package/dist/checks/directives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directives.d.ts","sourceRoot":"","sources":["../../src/checks/directives.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA+C9E,eAAO,MAAM,uBAAuB,GAClC,MAAM,MAAM,EACZ,QAAQ,MAAM,KACb;IAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAAC,OAAO,EAAE,UAAU,EAAE,CAAA;CAuB/C,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,KAAK,YAAY,KAAG,OACoB,CAAC;AAS3E,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,SAAQ,MAAM,EAAO,KACpB,gBA0BF,CAAC"}

package/dist/checks/directives.js

@@ -0,0 +1,108 @@
+import { readFileSync } from 'node:fs';
+import { listSourceFiles, toPosix } from '../files.js';
+const DIRECTIVE_PATTERN = /(?:\/\/|\/\*)\s*(eslint|oxlint)-(disable|enable)(-next-line|-line)?\b([^\n]*?)(?:\*\/|$)/g;
+const NOSONAR_PATTERN = /\bNOSONAR\b/;
+const scopeFromSuffix = (suffix) => {
+    if (suffix === '-next-line')
+        return 'next-line';
+    if (suffix === '-line')
+        return 'line';
+    return 'file';
+};
+const splitRest = (rest) => {
+    const text = rest.trim();
+    const separator = text.indexOf('--');
+    let rulesText = text;
+    let description = '';
+    if (separator !== -1) {
+        rulesText = text.slice(0, separator);
+        description = text.slice(separator + 2).trim();
+    }
+    const rules = rulesText
+        .split(',')
+        .map((rule) => rule.trim())
+        .filter((rule) => rule.length > 0);
+    return { rules, description };
+};
+const QUOTES = new Set(["'", '"', '`']);
+const isInsideString = (text, index) => {
+    let open = null;
+    let position = 0;
+    while (position < index) {
+        const char = text[position] ?? '';
+        if (char === '\\') {
+            position += 2;
+            continue;
+        }
+        if (open === null && QUOTES.has(char))
+            open = char;
+        else if (open === char)
+            open = null;
+        position += 1;
+    }
+    return open !== null;
+};
+export const parseDirectivesInSource = (file, source) => {
+    const hits = [];
+    const nosonar = [];
+    const lines = source.split('\n');
+    lines.forEach((text, index) => {
+        const line = index + 1;
+        if (NOSONAR_PATTERN.test(text))
+            nosonar.push({ file, line });
+        for (const match of text.matchAll(DIRECTIVE_PATTERN)) {
+            if (isInsideString(text, match.index))
+                continue;
+            const [, tool, kind, suffix, rest] = match;
+            const { rules, description } = splitRest(rest ?? '');
+            hits.push({
+                file,
+                line,
+                tool: tool,
+                kind: kind,
+                scope: scopeFromSuffix(suffix),
+                rules,
+                description,
+            });
+        }
+    });
+    return { hits, nosonar };
+};
+export const isFileWideDisable = (hit) => hit.kind === 'disable' && hit.scope === 'file' && hit.rules.length === 0;
+const ALL_RULES = '(all rules)';
+const namesFor = (hit) => {
+    if (hit.rules.length === 0)
+        return [ALL_RULES];
+    return hit.rules;
+};
+export const scanDirectives = (root, ignore = []) => {
+    const all = [];
+    const nosonar = [];
+    for (const file of listSourceFiles(root, ignore)) {
+        let source = '';
+        try {
+            source = readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        const relativeFile = toPosix(root, file);
+        const parsed = parseDirectivesInSource(relativeFile, source);
+        all.push(...parsed.hits);
+        nosonar.push(...parsed.nosonar);
+    }
+    const byRule = {};
+    for (const hit of all) {
+        if (hit.kind !== 'disable')
+            continue;
+        for (const name of namesFor(hit))
+            byRule[name] = (byRule[name] ?? 0) + 1;
+    }
+    return {
+        fileWide: all.filter(isFileWideDisable),
+        all,
+        nosonar,
+        byRule,
+    };
+};
+//# sourceMappingURL=directives.js.map

package/dist/checks/directives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directives.js","sourceRoot":"","sources":["../../src/checks/directives.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGvD,MAAM,iBAAiB,GACrB,2FAA2F,CAAC;AAE9F,MAAM,eAAe,GAAG,aAAa,CAAC;AAEtC,MAAM,eAAe,GAAG,CAAC,MAA0B,EAAyB,EAAE;IAC5E,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,WAAW,CAAC;IAChD,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACtC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,IAAY,EAA4C,EAAE;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACrC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,KAAK,GAAG,SAAS;SACpB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAExC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,KAAa,EAAW,EAAE;IAC9D,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,OAAO,QAAQ,GAAG,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC;aAC9C,IAAI,IAAI,KAAK,IAAI;YAAE,IAAI,GAAG,IAAI,CAAC;QACpC,QAAQ,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,KAAK,IAAI,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,IAAY,EACZ,MAAc,EACmC,EAAE;IACnD,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;QACvB,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACrD,IAAI,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;gBAAE,SAAS;YAChD,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;YAC3C,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI;gBACJ,IAAI;gBACJ,IAAI,EAAE,IAA4B;gBAClC,IAAI,EAAE,IAA4B;gBAClC,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC;gBAC9B,KAAK;gBACL,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAiB,EAAW,EAAE,CAC9D,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;AAE3E,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,MAAM,QAAQ,GAAG,CAAC,GAAiB,EAAY,EAAE;IAC/C,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC,KAAK,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,IAAY,EACZ,SAAmB,EAAE,EACH,EAAE;IACpB,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACjD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,uBAAuB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACrC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACvC,GAAG;QACH,OAAO;QACP,MAAM;KACP,CAAC;AACJ,CAAC,CAAC"}

package/dist/checks/gates.d.ts

@@ -0,0 +1,16 @@
+import type { GateResult, PackageManager } from '../types.js';
+interface PackageJson {
+    scripts?: Record<string, string>;
+    workspaces?: string[] | {
+        packages?: string[];
+    };
+}
+export declare const readPackageJson: (root: string) => PackageJson;
+export declare const countTypeErrors: (output: string) => number;
+export declare const typecheckGate: (root: string) => GateResult;
+export declare const summarizeTestOutput: (output: string) => string;
+export declare const testsGate: (root: string, manager: PackageManager) => GateResult;
+export declare const formatGate: (root: string) => GateResult;
+export declare const depsAuditGate: (root: string, manager: PackageManager) => GateResult;
+export {};
+//# sourceMappingURL=gates.d.ts.map

package/dist/checks/gates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gates.d.ts","sourceRoot":"","sources":["../../src/checks/gates.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9D,UAAU,WAAW;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CACjD;AAED,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,WAQ9C,CAAC;AASF,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,MACF,CAAC;AAEhD,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,UAoB5C,CAAC;AASF,eAAO,MAAM,mBAAmB,GAAI,QAAQ,MAAM,KAAG,MAkBpD,CAAC;AAEF,eAAO,MAAM,SAAS,GACpB,MAAM,MAAM,EACZ,SAAS,cAAc,KACtB,UAiBF,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,UAmBzC,CAAC;AA2CF,eAAO,MAAM,aAAa,GACxB,MAAM,MAAM,EACZ,SAAS,cAAc,KACtB,UAUF,CAAC"}

package/dist/checks/gates.js

@@ -0,0 +1,153 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { localBin, packageManagerRun, run } from '../exec.js';
+export const readPackageJson = (root) => {
+    try {
+        return JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+};
+const statusFromCode = (code) => {
+    if (code === 0)
+        return 'pass';
+    return 'fail';
+};
+const TS_ERROR_PATTERN = /error TS\d+/g;
+export const countTypeErrors = (output) => (output.match(TS_ERROR_PATTERN) ?? []).length;
+export const typecheckGate = (root) => {
+    const bin = localBin(root, 'tsc');
+    if (!bin || !existsSync(join(root, 'tsconfig.json'))) {
+        return {
+            name: 'typecheck',
+            status: 'skipped',
+            summary: 'no tsconfig.json or no local tsc',
+        };
+    }
+    const result = run(bin, ['--noEmit', '-p', 'tsconfig.json'], root);
+    const errors = countTypeErrors(result.stdout + result.stderr);
+    let summary = 'clean';
+    if (result.code !== 0)
+        summary = `${errors} error(s)`;
+    return {
+        name: 'typecheck',
+        status: statusFromCode(result.code),
+        summary,
+        command: result.command,
+        exitCode: result.code,
+    };
+};
+const JEST_TESTS_PATTERN = /Tests:\s+(?:(\d+) failed, )?(?:(\d+) skipped, )?(?:(\d+) passed, )?(\d+) total/;
+const JEST_SUITES_PATTERN = /Test Suites:\s+(?:(\d+) failed, )?(?:(\d+) skipped, )?(?:(\d+) passed, )?(\d+) total/;
+const VITEST_PATTERN = /Tests\s+(?:(\d+) failed \| )?(\d+) passed(?: \| (\d+) skipped)?\s*\((\d+)\)/;
+export const summarizeTestOutput = (output) => {
+    const jest = JEST_TESTS_PATTERN.exec(output);
+    if (jest) {
+        const [, failed, , passed, total] = jest;
+        const suites = JEST_SUITES_PATTERN.exec(output);
+        let suiteText = '';
+        if (suites)
+            suiteText = `, ${suites[4]} suite(s)`;
+        if (failed)
+            return `${failed} failed, ${passed ?? 0}/${total} passed${suiteText}`;
+        return `${passed ?? total}/${total} passed${suiteText}`;
+    }
+    const vitest = VITEST_PATTERN.exec(output);
+    if (vitest) {
+        const [, failed, passed, , total] = vitest;
+        if (failed)
+            return `${failed} failed, ${passed}/${total} passed`;
+        return `${passed}/${total} passed`;
+    }
+    return 'no summary parsed, exit code only';
+};
+export const testsGate = (root, manager) => {
+    const scripts = readPackageJson(root).scripts ?? {};
+    let script = null;
+    if (scripts['test:ci'])
+        script = 'test:ci';
+    else if (scripts['test'])
+        script = 'test';
+    if (!script) {
+        return { name: 'tests', status: 'skipped', summary: 'no test script' };
+    }
+    const { file, args } = packageManagerRun(manager, script);
+    const result = run(file, args, root);
+    return {
+        name: 'tests',
+        status: statusFromCode(result.code),
+        summary: summarizeTestOutput(result.stdout + result.stderr),
+        command: result.command,
+        exitCode: result.code,
+    };
+};
+export const formatGate = (root) => {
+    const bin = localBin(root, 'prettier');
+    if (!bin) {
+        return { name: 'format', status: 'skipped', summary: 'no local prettier' };
+    }
+    const result = run(bin, ['--check', '--no-color', '.'], root);
+    const unformatted = (result.stdout + result.stderr)
+        .split('\n')
+        .filter((line) => line.startsWith('[warn]') && !line.includes('Code style'))
+        .filter((line) => !line.includes('Run Prettier')).length;
+    let summary = 'clean';
+    if (result.code !== 0)
+        summary = `${unformatted} file(s) need formatting`;
+    return {
+        name: 'format',
+        status: statusFromCode(result.code),
+        summary,
+        command: result.command,
+        exitCode: result.code,
+    };
+};
+const NETWORK_FAILURE = /ENOTFOUND|ECONNREFUSED|ETIMEDOUT|EAI_AGAIN|network|offline/i;
+const depsAuditCommand = (manager) => {
+    if (manager === 'yarn') {
+        return {
+            file: 'yarn',
+            args: ['npm', 'audit', '--all', '--severity', 'high'],
+        };
+    }
+    if (manager === 'npm')
+        return { file: 'npm', args: ['audit', '--audit-level=high'] };
+    if (manager === 'pnpm')
+        return { file: 'pnpm', args: ['audit', '--audit-level=high'] };
+    return null;
+};
+const depsAuditSummary = (result) => {
+    const output = result.stdout + result.stderr;
+    if (result.code !== 0 && NETWORK_FAILURE.test(output)) {
+        return {
+            name: 'dependency audit',
+            status: 'skipped',
+            summary: 'registry unreachable',
+            command: result.command,
+            exitCode: result.code,
+        };
+    }
+    let summary = 'no high or critical advisories';
+    if (result.code !== 0)
+        summary = 'advisories at high severity or above';
+    return {
+        name: 'dependency audit',
+        status: statusFromCode(result.code),
+        summary,
+        command: result.command,
+        exitCode: result.code,
+    };
+};
+export const depsAuditGate = (root, manager) => {
+    const command = depsAuditCommand(manager);
+    if (!command) {
+        return {
+            name: 'dependency audit',
+            status: 'skipped',
+            summary: `no audit command for ${manager}`,
+        };
+    }
+    return depsAuditSummary(run(command.file, command.args, root));
+};
+//# sourceMappingURL=gates.js.map

package/dist/checks/gates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gates.js","sourceRoot":"","sources":["../../src/checks/gates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAS9D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAe,EAAE;IAC3D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CACf,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAClC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAwB,EAAE;IAC5D,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAExC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAU,EAAE,CACxD,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;AAEhD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAc,EAAE;IACxD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,kCAAkC;SAC5C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,MAAM,WAAW,CAAC;IACtD,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;QACnC,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,IAAI;KACtB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,kBAAkB,GACtB,gFAAgF,CAAC;AACnF,MAAM,mBAAmB,GACvB,sFAAsF,CAAC;AACzF,MAAM,cAAc,GAClB,6EAA6E,CAAC;AAEhF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAU,EAAE;IAC5D,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,EAAE,MAAM,EAAE,AAAD,EAAG,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC;QACzC,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,MAAM;YAAE,SAAS,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;QAClD,IAAI,MAAM;YACR,OAAO,GAAG,MAAM,YAAY,MAAM,IAAI,CAAC,IAAI,KAAK,UAAU,SAAS,EAAE,CAAC;QACxE,OAAO,GAAG,MAAM,IAAI,KAAK,IAAI,KAAK,UAAU,SAAS,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,AAAD,EAAG,KAAK,CAAC,GAAG,MAAM,CAAC;QAC3C,IAAI,MAAM;YAAE,OAAO,GAAG,MAAM,YAAY,MAAM,IAAI,KAAK,SAAS,CAAC;QACjE,OAAO,GAAG,MAAM,IAAI,KAAK,SAAS,CAAC;IACrC,CAAC;IACD,OAAO,mCAAmC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,IAAY,EACZ,OAAuB,EACX,EAAE;IACd,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;IACpD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,GAAG,SAAS,CAAC;SACtC,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;QACnC,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,IAAI;KACtB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAc,EAAE;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;SAChD,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;SAC3E,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3D,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,WAAW,0BAA0B,CAAC;IAC1E,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;QACnC,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,IAAI;KACtB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,eAAe,GACnB,6DAA6D,CAAC;AAEhE,MAAM,gBAAgB,GAAG,CACvB,OAAuB,EACkB,EAAE;IAC3C,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC;SACtD,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,KAAK;QACnB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,CAAC;IAChE,IAAI,OAAO,KAAK,MAAM;QACpB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,MAAkB,EAAc,EAAE;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,sBAAsB;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,IAAI;SACtB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,gCAAgC,CAAC;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,GAAG,sCAAsC,CAAC;IACxE,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;QACnC,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,IAAI;KACtB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,IAAY,EACZ,OAAuB,EACX,EAAE;IACd,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,wBAAwB,OAAO,EAAE;SAC3C,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACjE,CAAC,CAAC"}