repo-contract 0.1.0

package/dist/.dts/policy/run-policies.d.ts

@@ -0,0 +1,38 @@
+import type { ParsedCheckEntry } from "../evidence/build-evidence.js";
+import type { Evidence, Verdict } from "../types.js";
+/**
+ * Invokes every check's `policy` against the complete, already-assembled
+ * `evidence` and aggregates the results into a `Verdict`. Each check's
+ * `PolicyResult` is stored verbatim under `checks[checkId]`; `passed` is
+ * `true` only if every check's `outcome` is `"pass"` or `"warn"` -- no
+ * check's failure is ever collapsed into another's or into one generic
+ * message.
+ *
+ * Every `policy` call is isolated: the call itself is wrapped in `try/catch`
+ * (a policy doesn't have to be `async` to misbehave), and its returned
+ * value is `await`-ed inside that same `try`, so a promise that rejects
+ * later is caught identically to a synchronous throw. The resolved value is
+ * then validated against the `PolicyResult` contract itself (`outcome` is
+ * exactly `"pass"`, `"fail"`, or `"warn"`; `rationale` is a string) before
+ * it is trusted -- a malformed result is treated exactly like a throw
+ * rather than silently coerced into a pass. Every one of these failure
+ * modes is wrapped in `PolicyThrewError`, with the original thrown value
+ * (or a descriptive validation error, for a malformed result) preserved via
+ * `cause` -- never stringified or discarded. Two specific, common mistakes
+ * get a more actionable error instead, chosen by `wrapPolicyFailure` (see
+ * its own doc comment): reading a `result.output` property on a check that
+ * never requested a format (`PolicyReadUnrequestedOutputError`), and reading
+ * `result.output.value` on a check whose requested parse actually failed
+ * (`PolicyReadFailedParseValueError`) -- both still preserve the original
+ * `TypeError` via `cause`, exactly like the plain `PolicyThrewError` case.
+ * One policy failing this way never stops any other check's policy from
+ * running. If more than one policy fails this way in the same run, this
+ * function throws a native `AggregateError` whose `errors` holds one such
+ * error per failing check, rather than surfacing only the first one found;
+ * if exactly one policy fails, it throws that single error directly.
+ * @param entries - each check's id, definition, and final (possibly parsed-output) evidence to invoke its policy against
+ * @param evidence - the complete, already-assembled evidence for the whole run, passed to every policy call
+ * @returns the aggregated `Verdict` (throws instead if one or more policies failed to produce a valid `PolicyResult`)
+ */
+export declare function runPolicies(entries: readonly ParsedCheckEntry[], evidence: Evidence): Promise<Verdict>;
+//# sourceMappingURL=run-policies.d.ts.map

package/dist/.dts/policy/run-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-policies.d.ts","sourceRoot":"","sources":["../../../src/policy/run-policies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAMrE,OAAO,KAAK,EAEV,QAAQ,EAIR,OAAO,EACR,MAAM,aAAa,CAAA;AA4HpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,OAAO,CAAC,CAsFlB"}

package/dist/.dts/presets/arethetypeswrong.d.ts

@@ -0,0 +1,39 @@
+import type { CheckDefinitionConfig, PolicyResult } from "../types.js";
+/**
+ * attw's own `--format json` contract -- not published as a TypeScript type
+ * by the tool. `problems` is a flat record keyed by problem kind (e.g.
+ * "FalseCJS", "NoResolution"), each entry carrying whichever context fields
+ * that kind of problem produces.
+ */
+export interface AttwReport {
+    readonly problems?: Record<string, readonly AttwProblem[]>;
+}
+export interface AttwProblem {
+    readonly kind: string;
+    readonly entrypoint?: string;
+    readonly resolutionKind?: string;
+    readonly typesFileName?: string;
+    readonly implementationFileName?: string;
+}
+/**
+ * Interprets an already-parsed attw JSON report -- exported (unlike this
+ * package's other internal evaluators) because a repository whose package
+ * has enough entrypoints to make attw's own `--format json` output exceed
+ * ~64KB can hit a real, reproducible upstream bug: attw truncates its own
+ * stdout when it's a pipe (confirmed independently of repo-contract, via
+ * plain shell piping) rather than a TTY or regular file. Redirecting attw's
+ * output to a file sidesteps that bug; a consumer doing so needs this same
+ * interpretation logic without re-deriving it. repo-contract's own
+ * `repo-contract.config.ts` does exactly this once it has more than one real
+ * entrypoint (see that file's `arethetypeswrong` override).
+ * Accepts `unknown` and validates the shape itself: its inputs are always
+ * untrusted parsed JSON (a tool's stdout, a report file), and valid JSON of an
+ * unexpected shape must produce a clean fail verdict here rather than a
+ * `TypeError` in the caller.
+ * @param report - the parsed attw JSON report to evaluate.
+ * @returns the pass/fail outcome and its rationale.
+ */
+export declare function evaluateAttwReport(report: unknown): PolicyResult;
+/** Published-package type-resolution correctness via `@arethetypeswrong/cli`. */
+export declare const arethetypeswrong: CheckDefinitionConfig;
+//# sourceMappingURL=arethetypeswrong.d.ts.map

package/dist/.dts/presets/arethetypeswrong.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arethetypeswrong.d.ts","sourceRoot":"","sources":["../../../src/presets/arethetypeswrong.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAItE;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC,CAAA;CAC3D;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAA;CACzC;AAkBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,CA6BhE;AAUD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,EAAE,qBAmB9B,CAAA"}

package/dist/.dts/presets/broken-links.d.ts

@@ -0,0 +1,16 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** Options accepted by {@link brokenLinks}. */
+interface BrokenLinksOptions {
+    /** File or directory passed straight through to linkinator as its positional target. Defaults to `"."`. */
+    readonly start?: string;
+}
+/**
+ * Broken-link detection via linkinator, recursing through local files and
+ * following both local and remote links. `--skip node_modules` avoids
+ * wasting the crawl on vendored files that were never authored content.
+ * @param options - configuration for this check; see {@link BrokenLinksOptions}.
+ * @returns the configured check.
+ */
+export declare function brokenLinks(options?: BrokenLinksOptions): CheckDefinitionConfig;
+export {};
+//# sourceMappingURL=broken-links.d.ts.map

package/dist/.dts/presets/broken-links.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broken-links.d.ts","sourceRoot":"","sources":["../../../src/presets/broken-links.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAgBxD,+CAA+C;AAC/C,UAAU,kBAAkB;IAC1B,2GAA2G;IAC3G,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAYD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,qBAAqB,CAuDnF"}

package/dist/.dts/presets/commitlint.d.ts

@@ -0,0 +1,22 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** Options accepted by {@link commitlint}. */
+interface CommitlintOptions {
+    /** The ref commitlint lints commits *from* (exclusive). Defaults to `"origin/main"`. */
+    readonly from?: string;
+    /** The ref commitlint lints commits *to* (inclusive). Defaults to `"HEAD"`. */
+    readonly to?: string;
+}
+/**
+ * Commit-message governance via commitlint, using whatever commitlint
+ * config the consumer's own repository already has (commitlint ships no
+ * rules of its own -- e.g. `@commitlint/config-conventional`). Exit-code
+ * based rather than `--format json`: commitlint has no broadly-documented,
+ * stable JSON CLI output, so this preset reads its plain-text report the
+ * same way the `format`/`typecheck` presets already do for their tools,
+ * rather than relying on an unconfirmed flag.
+ * @param options - configuration for this check; see {@link CommitlintOptions}.
+ * @returns the configured check.
+ */
+export declare function commitlint(options?: CommitlintOptions): CheckDefinitionConfig;
+export {};
+//# sourceMappingURL=commitlint.d.ts.map

package/dist/.dts/presets/commitlint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commitlint.d.ts","sourceRoot":"","sources":["../../../src/presets/commitlint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAKxD,8CAA8C;AAC9C,UAAU,iBAAiB;IACzB,wFAAwF;IACxF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CACrB;AA2BD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,qBAAqB,CA2BjF"}

package/dist/.dts/presets/dead-code.d.ts

@@ -0,0 +1,23 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** Options accepted by {@link deadCode}. */
+interface DeadCodeOptions {
+    /**
+     * devDependency names to exclude from the "unused devDependency" issue
+     * category -- e.g. CLI tools knip has no way to see are used, because
+     * nothing `import`s them. Round-tripped through knip's own
+     * `--reporter-options` flag (see `readReporterOptions`) rather than kept in
+     * a closure, so the exempt list this check actually ran with is visible on
+     * the recorded command line and in persisted evidence, not just in this
+     * file's source. Defaults to an empty list -- repo-contract ships no
+     * built-in exemptions; add your own repository's here.
+     */
+    readonly exemptUnusedDevDependencies?: readonly string[];
+}
+/**
+ * Dead/unused-code detection via knip.
+ * @param options - configuration for this check; see {@link DeadCodeOptions}.
+ * @returns the configured check.
+ */
+export declare function deadCode(options?: DeadCodeOptions): CheckDefinitionConfig;
+export {};
+//# sourceMappingURL=dead-code.d.ts.map

package/dist/.dts/presets/dead-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dead-code.d.ts","sourceRoot":"","sources":["../../../src/presets/dead-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AA8CxD,4CAA4C;AAC5C,UAAU,eAAe;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACzD;AA6DD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,OAAO,GAAE,eAAoB,GAAG,qBAAqB,CAiG7E"}

package/dist/.dts/presets/duplication.d.ts

@@ -0,0 +1,14 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** Options accepted by {@link duplication}. */
+interface DuplicationOptions {
+    /** Directory to scan for duplicated code, passed straight through to jscpd as its positional target. Defaults to `"."` -- narrow it (e.g. `"src"`) to scope the scan to your own source tree. */
+    readonly path?: string;
+}
+/**
+ * Duplicated-code detection via jscpd.
+ * @param options - configuration for this check; see {@link DuplicationOptions}.
+ * @returns the configured check.
+ */
+export declare function duplication(options?: DuplicationOptions): CheckDefinitionConfig;
+export {};
+//# sourceMappingURL=duplication.d.ts.map

package/dist/.dts/presets/duplication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"duplication.d.ts","sourceRoot":"","sources":["../../../src/presets/duplication.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAkCxD,+CAA+C;AAC/C,UAAU,kBAAkB;IAC1B,iMAAiM;IACjM,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAgBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,qBAAqB,CA4EnF"}

package/dist/.dts/presets/e2e.d.ts

@@ -0,0 +1,4 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** End-to-end test execution via Playwright, reading its JSON reporter output. */
+export declare const e2e: CheckDefinitionConfig;
+//# sourceMappingURL=e2e.d.ts.map

package/dist/.dts/presets/e2e.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e.d.ts","sourceRoot":"","sources":["../../../src/presets/e2e.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AA+ExD,kFAAkF;AAClF,eAAO,MAAM,GAAG,EAAE,qBA+DjB,CAAA"}

package/dist/.dts/presets/format.d.ts

@@ -0,0 +1,4 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** Code formatting via Prettier, applied in place. */
+export declare const format: CheckDefinitionConfig;
+//# sourceMappingURL=format.d.ts.map

package/dist/.dts/presets/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../../src/presets/format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAKxD,sDAAsD;AACtD,eAAO,MAAM,MAAM,EAAE,qBAkBpB,CAAA"}

package/dist/.dts/presets/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Curated, growing catalog of preset checks for tools common across
+ * TypeScript/JavaScript repositories -- each preset encodes how to execute
+ * and interpret a common tool, never a repository's definition of quality
+ * (see specs/decisions/0004-public-surface-stays-narrow-no-cli-experimental-presets.md). Import a preset,
+ * spread it into your own `checks` record, and override whatever you need
+ * -- most often `policy`; a factory preset's options are the preferred way
+ * to change what it executes, a direct `run` override is an escape hatch.
+ * Never re-exported from the package root (`src/index.ts`) -- presets are
+ * an opt-in extra, not part of the core execution/evidence/policy surface
+ * those exports describe, and this barrel never re-exports anything from
+ * there either; the two stay independent.
+ * @packageDocumentation
+ */
+export { arethetypeswrong } from "./arethetypeswrong.js";
+export { brokenLinks } from "./broken-links.js";
+export { commitlint } from "./commitlint.js";
+export { deadCode } from "./dead-code.js";
+export { duplication } from "./duplication.js";
+export { e2e } from "./e2e.js";
+export { format } from "./format.js";
+export { license } from "./license.js";
+export { lint } from "./lint.js";
+export { markdownlint } from "./markdownlint.js";
+export { publint } from "./publint.js";
+export { securityDeps } from "./security-deps.js";
+export { securitySecrets } from "./security-secrets.js";
+export { stylelint } from "./stylelint.js";
+export { test } from "./test.js";
+export { typecheck } from "./typecheck.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/.dts/presets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/presets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/.dts/presets/license.d.ts

@@ -0,0 +1,4 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** Dependency license compliance via licensee. */
+export declare const license: CheckDefinitionConfig;
+//# sourceMappingURL=license.d.ts.map

package/dist/.dts/presets/license.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../../../src/presets/license.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAuBxD,kDAAkD;AAClD,eAAO,MAAM,OAAO,EAAE,qBAiErB,CAAA"}

package/dist/.dts/presets/lint.d.ts

@@ -0,0 +1,20 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** Options accepted by {@link lint}. */
+interface LintOptions {
+    /** Path (or glob) passed straight through to ESLint as its positional target. Defaults to `"."` -- narrow it (e.g. `"src"`) to scope linting to your own source tree. */
+    readonly path?: string;
+}
+/**
+ * Static analysis via ESLint, using whatever `eslint.config.js` the
+ * consumer's own repository already has -- this preset makes no assumption
+ * about rule configuration, only about how to run the tool and interpret
+ * its JSON output. Severity `2` (error) blocks; severity `1` (warning) is
+ * reported but never blocks -- ESLint's own severities already encode that
+ * distinction, so this preset just respects it rather than treating every
+ * finding as equally blocking.
+ * @param options - configuration for this check; see {@link LintOptions}.
+ * @returns the configured check.
+ */
+export declare function lint(options?: LintOptions): CheckDefinitionConfig;
+export {};
+//# sourceMappingURL=lint.d.ts.map

package/dist/.dts/presets/lint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/presets/lint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AA0BxD,wCAAwC;AACxC,UAAU,WAAW;IACnB,yKAAyK;IACzK,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAoBD;;;;;;;;;;GAUG;AACH,wBAAgB,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,qBAAqB,CAsDrE"}

package/dist/.dts/presets/markdownlint.d.ts

@@ -0,0 +1,23 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** Options accepted by {@link markdownlint}. */
+interface MarkdownlintOptions {
+    /** Glob passed straight through to markdownlint-cli2 as its positional target. Defaults to `"**\/*.md"`. */
+    readonly glob?: string;
+}
+/**
+ * Markdown structure/style lint via markdownlint-cli2. Unlike this
+ * package's other file-based-report presets, the report path is
+ * config-driven rather than a CLI flag -- markdownlint-cli2 only writes
+ * JSON when its own config file requests it. This preset assumes the
+ * consumer's `.markdownlint-cli2.jsonc` includes:
+ * ```jsonc
+ * "outputFormatters": [["markdownlint-cli2-formatter-json", { "name": "reports/markdownlint.json" }]]
+ * ```
+ * which also requires the `markdownlint-cli2-formatter-json` package
+ * alongside `markdownlint-cli2` itself.
+ * @param options - configuration for this check; see {@link MarkdownlintOptions}.
+ * @returns the configured check.
+ */
+export declare function markdownlint(options?: MarkdownlintOptions): CheckDefinitionConfig;
+export {};
+//# sourceMappingURL=markdownlint.d.ts.map

package/dist/.dts/presets/markdownlint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdownlint.d.ts","sourceRoot":"","sources":["../../../src/presets/markdownlint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAmBxD,gDAAgD;AAChD,UAAU,mBAAmB;IAC3B,4GAA4G;IAC5G,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAeD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,qBAAqB,CAmDrF"}

package/dist/.dts/presets/publint.d.ts

@@ -0,0 +1,13 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/**
+ * publint has no machine-readable output mode -- only a plain-text CLI
+ * reporter (see its own `src/cli.js` `formatMessages`). Its process exit
+ * code reflects only 'error'-level findings; 'warning'/'suggestion'-level
+ * findings never affect it. This preset reads the same three section
+ * headers publint's own CLI writes ("Errors:", "Warnings:", "Suggestions:")
+ * to distinguish blocking findings from non-blocking ones, without
+ * depending on any per-message structure publint doesn't expose. Relevant
+ * only to repositories that publish an npm package.
+ */
+export declare const publint: CheckDefinitionConfig;
+//# sourceMappingURL=publint.d.ts.map

package/dist/.dts/presets/publint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publint.d.ts","sourceRoot":"","sources":["../../../src/presets/publint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAKxD;;;;;;;;;GASG;AACH,eAAO,MAAM,OAAO,EAAE,qBAsBrB,CAAA"}

package/dist/.dts/presets/security-deps.d.ts

@@ -0,0 +1,4 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** Dependency vulnerability scanning via `npm audit`. */
+export declare const securityDeps: CheckDefinitionConfig;
+//# sourceMappingURL=security-deps.d.ts.map

package/dist/.dts/presets/security-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-deps.d.ts","sourceRoot":"","sources":["../../../src/presets/security-deps.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AA0CxD,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,qBAkG1B,CAAA"}

package/dist/.dts/presets/security-secrets.d.ts

@@ -0,0 +1,4 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** Secret-leak scanning via secretlint. */
+export declare const securitySecrets: CheckDefinitionConfig;
+//# sourceMappingURL=security-secrets.d.ts.map

package/dist/.dts/presets/security-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-secrets.d.ts","sourceRoot":"","sources":["../../../src/presets/security-secrets.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAsBxD,2CAA2C;AAC3C,eAAO,MAAM,eAAe,EAAE,qBAoE7B,CAAA"}

package/dist/.dts/presets/shared/error-warning-pass-policy.d.ts

@@ -0,0 +1,13 @@
+import type { PolicyResult } from "../../types.js";
+/**
+ * The shared three-branch shape behind every lint-style preset's pass/warn/fail decision: fail,
+ * listing every error, if there are any; else warn, listing every warning, if there are any; else
+ * pass -- shared by `lint` (ESLint) and `stylelint`, whose only difference was the tool name
+ * substituted into each rationale string.
+ * @param toolName - the tool's own display name, substituted into every rationale (e.g. "ESLint", "stylelint").
+ * @param errorDetails - one rendered line per error-severity finding.
+ * @param warningDetails - one rendered line per warning-severity finding.
+ * @returns the fail/warn/pass `PolicyResult`.
+ */
+export declare function errorWarningPassPolicy(toolName: string, errorDetails: readonly string[], warningDetails: readonly string[]): PolicyResult;
+//# sourceMappingURL=error-warning-pass-policy.d.ts.map

package/dist/.dts/presets/shared/error-warning-pass-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-warning-pass-policy.d.ts","sourceRoot":"","sources":["../../../../src/presets/shared/error-warning-pass-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,YAAY,CAsBd"}

package/dist/.dts/presets/shared/exit-code-fail-rationale.d.ts

@@ -0,0 +1,23 @@
+import type { CheckEvidence } from "../../types.js";
+/**
+ * A check's captured stdout and stderr, trimmed and joined into one block -- either stream may be
+ * empty and is dropped rather than contributing a blank line. Shared by `exitCodeFailRationale`
+ * below and by `publint` (which needs the combined text itself, not just a rendered failure
+ * message, to detect its own "Warnings:"/"Suggestions:" section headers).
+ * @param result - the check's execution evidence (only `stdout`/`stderr` are read).
+ * @returns the combined, trimmed stdout+stderr text, or `""` if the tool produced neither.
+ */
+export declare function combinedOutput(result: CheckEvidence): string;
+/**
+ * Shared by every preset whose policy is a plain "exitCode 0 = pass, else
+ * render captured stdout/stderr (or fall back to an exit-code-only message
+ * if the tool produced neither)" -- `format`, `typecheck`, `commitlint`.
+ * Each preset still owns its own pass rationale and its own description of
+ * what failed; this only renders the shared "here's what the tool printed"
+ * half.
+ * @param result - the check's execution evidence (only `stdout`/`stderr`/`exitCode` are read).
+ * @param description - a present-tense description of the failure, e.g. "Prettier reported formatting failures".
+ * @returns `"{description}:\n{output}"` when the tool produced output, or `"{description} (exit code {N})."` otherwise.
+ */
+export declare function exitCodeFailRationale(result: CheckEvidence, description: string): string;
+//# sourceMappingURL=exit-code-fail-rationale.d.ts.map

package/dist/.dts/presets/shared/exit-code-fail-rationale.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit-code-fail-rationale.d.ts","sourceRoot":"","sources":["../../../../src/presets/shared/exit-code-fail-rationale.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEnD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAI5D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAMxF"}

package/dist/.dts/presets/shared/missing-dependency.d.ts

@@ -0,0 +1,19 @@
+import type { CheckEvidence, PolicyResult } from "../../types.js";
+/**
+ * Every preset in `src/presets/*.ts` (except `securityDeps`, which shells out
+ * to `npm` itself -- something that cannot be "missing" in any environment
+ * capable of running `npm run <script>` at all) calls this first, before its
+ * own pass/fail/warn logic. `CheckEvidence.status === "spawn_error"` already
+ * distinguishes "the OS couldn't even launch the executable" from "the tool
+ * ran and exited non-zero" -- but not every spawn failure means the package
+ * is missing (a permission error or an invalid executable format lands here
+ * too), so this checks the structured `spawnErrorCode` for `"ENOENT"`
+ * specifically rather than treating every spawn error as "not installed."
+ * A non-ENOENT spawn error falls through to the preset's normal handling,
+ * unchanged, rather than getting a misleading "not installed" message.
+ * @param result - the check's raw execution evidence to inspect.
+ * @param packageName - the npm package a consumer would install to fix this (may differ from the binary name, e.g. `tsc` comes from `typescript`).
+ * @returns an actionable, package-manager-neutral `PolicyResult` if the tool appears to be missing, or `undefined` if the caller should proceed with its own interpretation.
+ */
+export declare function checkDependencyInstalled(result: CheckEvidence, packageName: string): PolicyResult | undefined;
+//# sourceMappingURL=missing-dependency.d.ts.map

package/dist/.dts/presets/shared/missing-dependency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-dependency.d.ts","sourceRoot":"","sources":["../../../../src/presets/shared/missing-dependency.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,GAClB,YAAY,GAAG,SAAS,CAS1B"}

package/dist/.dts/presets/shared/read-json-report.d.ts

@@ -0,0 +1,33 @@
+import type { PolicyResult } from "../../types.js";
+/** The report, already JSON-parsed and narrowed to `T`, or the fail `PolicyResult` to return verbatim when reading or parsing it failed. See `readJsonReport`. */
+type ReadJsonReportResult<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly result: PolicyResult;
+};
+/**
+ * Reads and JSON-parses a report a tool wrote to disk rather than printing to stdout -- the "read,
+ * fail with one rationale if the read itself fails, fail with a different rationale if the JSON is
+ * invalid" shape shared by every preset whose tool has no stdout JSON mode (jscpd,
+ * markdownlint-cli2, secretlint). Each failure takes its own caller-supplied rationale rather than a
+ * generic shared message, since a missing report and invalid JSON usually point a consumer at a
+ * different fix (a misconfigured reporter/output flag vs. a genuinely broken tool run), and each
+ * tool's own advice differs (markdownlint's own read-failure rationale, for instance, names the
+ * specific config field to check).
+ *
+ * Takes the read itself as a thunk (`readRaw`), rather than a `path` this function reads from
+ * directly, so every call site's own `readFile(LITERAL_PATH, "utf8")` stays written as a literal
+ * argument in the caller's own file -- required by this repo's `security/detect-non-literal-fs-filename`
+ * policy, which forbids suppressing that rule outright (see policy-config.ts's `eslint.rules["security/*"]`)
+ * and would otherwise flag a `path: string` function parameter threaded into `readFile` here as
+ * non-literal.
+ * @param readRaw - reads the report's raw text (typically `() => readFile(REPORT_PATH, "utf8")`).
+ * @param onReadFailed - the rationale to fail with if `readRaw` rejects.
+ * @param onParseFailed - the rationale to fail with if the read text isn't valid JSON.
+ * @returns `{ ok: true, value }` with the parsed JSON narrowed to `T`, or `{ ok: false, result }` with the fail `PolicyResult` to return verbatim.
+ */
+export declare function readJsonReport<T>(readRaw: () => Promise<string>, onReadFailed: string, onParseFailed: string): Promise<ReadJsonReportResult<T>>;
+export {};
+//# sourceMappingURL=read-json-report.d.ts.map

package/dist/.dts/presets/shared/read-json-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-json-report.d.ts","sourceRoot":"","sources":["../../../../src/presets/shared/read-json-report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAElD,kKAAkK;AAClK,KAAK,oBAAoB,CAAC,CAAC,IACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAA;AAElG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,cAAc,CAAC,CAAC,EACpC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EAC9B,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAclC"}

package/dist/.dts/presets/shared/terminal-status.d.ts

@@ -0,0 +1,25 @@
+import type { CheckEvidence, PolicyResult } from "../../types.js";
+/**
+ * The guard every preset needs immediately after `checkDependencyInstalled`
+ * and before its own pass/fail logic: a check whose process did not run to a
+ * normal exit on its own -- it timed out, was aborted via `options.signal`,
+ * was killed by a host `SIGINT`/`SIGTERM`, received an external signal, or
+ * failed to spawn for a reason other than a missing executable -- has a
+ * `null` `exitCode` and only whatever partial output the tool managed before
+ * termination. Interpreting that with an exit-code comparison or a JSON
+ * parse would present an operational failure to the consumer as a fabricated
+ * tool-specific verdict ("TypeScript reported type errors (exit code null)",
+ * "ESLint output could not be parsed as JSON"). This reports the real
+ * terminal cause instead.
+ *
+ * `"completed"` returns `undefined` -- the process reached its own exit and
+ * the preset interprets the (possibly non-zero) exit code itself. The
+ * ENOENT `"spawn_error"` case is already handled by `checkDependencyInstalled`;
+ * this catches the remaining spawn failures (`EACCES`, `ENOEXEC`) that
+ * `missing-dependency.ts` documents as falling through.
+ * @param result - the check's raw execution evidence to inspect.
+ * @param toolName - the tool's own display name for the rationale (e.g. "ESLint", "TypeScript").
+ * @returns a fail `PolicyResult` describing the abnormal termination, or `undefined` if the process ran to its own exit and the caller should proceed.
+ */
+export declare function checkTerminatedAbnormally(result: CheckEvidence, toolName: string): PolicyResult | undefined;
+//# sourceMappingURL=terminal-status.d.ts.map

package/dist/.dts/presets/shared/terminal-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-status.d.ts","sourceRoot":"","sources":["../../../../src/presets/shared/terminal-status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAGjE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,GACf,YAAY,GAAG,SAAS,CAyC1B"}

package/dist/.dts/presets/shared/vitest-json-policy.d.ts

@@ -0,0 +1,20 @@
+import type { ParsedOutput, PolicyResult } from "../../types.js";
+/**
+ * Interprets Vitest's own `--reporter=json` output shape -- and nothing
+ * else. Shared between the `test` preset (a single, un-categorized
+ * `vitest run --reporter=json`) and this repository's own
+ * `test-unit`/`test-integration`/`test-property`/`test-e2e` checks, whose
+ * `run` splits tests into four mutually exclusive categories via
+ * scripts/run-test-category.mjs -- a repository-specific concern this
+ * function knows nothing about. Each of those four checks owns its own
+ * category-specific semantics on top of this evaluator; this function must
+ * stay narrowly scoped to "parse Vitest's JSON reporter shape," never grow
+ * into a general "testing policy" abstraction. A category's own
+ * `output.success === false` (vitest crashed / produced unparseable output)
+ * is kept distinct from a substantive test failure, exactly as every other
+ * preset in this package already does via `ParsedOutput.success`.
+ * @param output - the vitest check's parsed `--reporter=json` output to evaluate.
+ * @returns the pass/fail outcome and its rationale.
+ */
+export declare function evaluateVitestJsonPolicy(output: ParsedOutput<unknown> | undefined): PolicyResult;
+//# sourceMappingURL=vitest-json-policy.d.ts.map

package/dist/.dts/presets/shared/vitest-json-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vitest-json-policy.d.ts","sourceRoot":"","sources":["../../../../src/presets/shared/vitest-json-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAMhE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,SAAS,GAAG,YAAY,CAsEhG"}

package/dist/.dts/presets/stylelint.d.ts

@@ -0,0 +1,17 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** Options accepted by {@link stylelint}. */
+interface StylelintOptions {
+    /** Glob passed straight through to stylelint as its positional target. Defaults to `"**\/*.{css,scss}"` -- adjust it for your own stylesheet file extensions (e.g. `.less`, `.vue`, `.svelte`). */
+    readonly glob?: string;
+}
+/**
+ * CSS/SCSS lint via stylelint, using whatever stylelint config the
+ * consumer's own repository already has. `severity: "error"` blocks;
+ * `severity: "warning"` is reported but never blocks, matching how the
+ * `lint` preset treats ESLint's own severities.
+ * @param options - configuration for this check; see {@link StylelintOptions}.
+ * @returns the configured check.
+ */
+export declare function stylelint(options?: StylelintOptions): CheckDefinitionConfig;
+export {};
+//# sourceMappingURL=stylelint.d.ts.map

package/dist/.dts/presets/stylelint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stylelint.d.ts","sourceRoot":"","sources":["../../../src/presets/stylelint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAqBxD,6CAA6C;AAC7C,UAAU,gBAAgB;IACxB,mMAAmM;IACnM,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,qBAAqB,CAiE/E"}

package/dist/.dts/presets/test.d.ts

@@ -0,0 +1,4 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** Unit/integration test execution via Vitest, reading its JSON reporter output. */
+export declare const test: CheckDefinitionConfig;
+//# sourceMappingURL=test.d.ts.map

package/dist/.dts/presets/test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test.d.ts","sourceRoot":"","sources":["../../../src/presets/test.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAKxD,oFAAoF;AACpF,eAAO,MAAM,IAAI,EAAE,qBAYlB,CAAA"}

package/dist/.dts/presets/typecheck.d.ts

@@ -0,0 +1,4 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** Type checking via `tsc --noEmit`. */
+export declare const typecheck: CheckDefinitionConfig;
+//# sourceMappingURL=typecheck.d.ts.map

package/dist/.dts/presets/typecheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typecheck.d.ts","sourceRoot":"","sources":["../../../src/presets/typecheck.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAKxD,wCAAwC;AACxC,eAAO,MAAM,SAAS,EAAE,qBAkBvB,CAAA"}

package/dist/.dts/run-repo-contract.d.ts

@@ -0,0 +1,38 @@
+import type { CheckSchema, Evidence, RepoContractConfig, RunRepoContractOptions, Verdict } from "./types.js";
+/**
+ * Executes every configured check, collects its evidence, optionally parses
+ * its output, evaluates every check's repository-owned policy against the
+ * complete evidence, and aggregates a verdict. Never calls `process.exit()`
+ * -- returns data; the caller decides what to do with `verdict.passed`.
+ *
+ * Structural configuration problems throw synchronously before any process
+ * spawns. Anything only discoverable by attempting execution (a missing
+ * binary, a bad `cwd`) becomes evidence on that check (`status:
+ * "spawn_error"`), never a throw. A policy function throwing or rejecting
+ * rejects this function's own returned promise (`PolicyThrewError`, or an
+ * `AggregateError` of them if more than one policy failed this way) --
+ * distinct from a policy that ran fine and simply returned a failure
+ * string. See `src/errors.ts` for the full distinction.
+ *
+ * Execution and policy evaluation are strictly phased: every check finishes
+ * running and every check's evidence is fully assembled before any policy
+ * is invoked (see specs/architecture.md) -- a policy can safely read
+ * `ctx.evidence` for any sibling check's result.
+ *
+ * Deliberately not declared `async`: validation runs and can throw before this function returns
+ * anything at all, so a config problem is a genuine synchronous exception to the caller (as
+ * documented above and on `InvalidRepoContractConfigError`/`InvalidCheckConfigError`/
+ * `DependencyDeclaredLaterError`) -- an `async function`'s body runs to its first `await` still
+ * inside the caller's own call stack, but any throw before that point is nonetheless converted by
+ * the language into a rejected `Promise`, never surfaced as a synchronous exception. Splitting
+ * validation out into this synchronous wrapper, with the rest of the work in the `async` function
+ * below, keeps the documented synchronous-throw guarantee actually true rather than aspirational.
+ * @param config - the repo-contract configuration to run: its checks, concurrency, and their policies
+ * @param options - run options; `options.checks` restricts execution to specific check ids, `options.signal` allows cancelling the run
+ * @returns the assembled `evidence` for every check together with the aggregated `verdict`
+ */
+export declare function runRepoContract<const TChecks extends CheckSchema>(config: RepoContractConfig<TChecks>, options?: RunRepoContractOptions): Promise<{
+    evidence: Evidence<TChecks>;
+    verdict: Verdict<TChecks>;
+}>;
+//# sourceMappingURL=run-repo-contract.d.ts.map

package/dist/.dts/run-repo-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-repo-contract.d.ts","sourceRoot":"","sources":["../../src/run-repo-contract.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,WAAW,EACX,QAAQ,EACR,kBAAkB,EAClB,sBAAsB,EACtB,OAAO,EACR,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,eAAe,CAAC,KAAK,CAAC,OAAO,SAAS,WAAW,EAC/D,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,EACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAGrE"}