repo-contract 0.7.3 → 0.8.5

package/CHANGELOG.md

@@ -1,69 +1,142 @@
 # Changelog
 
-## [0.7.3](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.7.2...repo-contract-v0.7.3) (2026-09-27)
+## 0.8.5
+
+### Patch Changes
+
+- chore(benchmarks): refresh results.json
+- chore(benchmarks): refresh results.json
+- b07c91a: Re-pin internal-package-contract (lockfile and reusable-workflow references) to its 0.5.0 release.
+- 2000ec3: Move the repository's own benchmarks onto internal-package-contract's shared benchmark kit (documented suites, cost-first `BENCHMARKS.md`, `benchmarks/README.md`, WRITING/READING docs) and re-pin internal-package-contract to its 0.4 release.
+
+## 0.8.4
+
+### Patch Changes
+
+- 9549cf9: Accept npm 12's `npm pack --json` output (an object keyed by package name) as well as the older array form, so the consumer-install E2E suites and the `arethetypeswrong` check no longer fail under the latest npm during the release job.
+
+## 0.8.3
+
+### Patch Changes
+
+- chore(benchmarks): refresh results.json
+- 8bcc7d4: Send the publish-time contract run's report to stderr so a failing check is visible in the release job's log instead of being swallowed by the Changesets action.
+
+## 0.8.2
 
+### Patch Changes
+
+- chore(benchmarks): refresh results.json
+- e0f4cd4: Generate the gitignored `docs/api/` and `docs/benchmarks/` pages before the publish-time contract run, so the `docs` check no longer 404s on them in the release job's fresh checkout.
+
+## 0.8.1
+
+### Patch Changes
+
+- chore(sbom): regenerate for 0.8.0
+- chore(benchmarks): refresh results.json
+- chore: sync generated API baseline for release
+
+## 0.8.0
+
+### Minor Changes
+
+- feat(sbom): add a real CycloneDX SBOM generator check
+- feat: consume internal-package-contract's ApiContract/ApiDocsReport engine
+- feat(benchmarks): add repo-contract's own benchmark suite, wire into CI, add site nav
+- 4cd248d: Add the `distNoUrls({ dir?, allow? })` preset (`repo-contract/presets`). It fails when any URL
+  (any scheme followed by a colon and two slashes) appears in any file of the build output --
+  code, declarations and sourcemaps included -- so supply-chain scanners such as Socket.dev have no
+  URL strings to flag. `allow` takes `{ url, reason }` entries (`url` may be a glob); a missing
+  `reason` fails the check. repo-contract's own build output is now URL-free and the check runs in
+  its own contract.
+- 65b74f0: Remove the `minimatch` runtime dependency. Exception-policy category globs are now matched by a
+  dependency-free, environment-free matcher (`src/helpers/glob-match.ts`, ADR 0017), so the package
+  has zero runtime dependencies. **Breaking (0.x minor):** only `*`, `**`, `?`, `[...]` classes,
+  `{a,b}` alternation and `\` escapes are supported; extglobs, POSIX classes, dotfile exclusion and
+  case folding are no longer interpreted, and a malformed character class now throws.
+
+### Patch Changes
+
+- fix(checks): read the crap4ts report from a file instead of a pipe
+- fix(ci): prettier-ignore the generated release-bump file
+- fix(sbom): derive generate.test.ts's expected paths via path.join
+- fix: waive the OpenSSF-Scorecard docs-links false positive; re-pin IPC workflows to latest SHA
+- chore(benchmarks): refresh results.json
+- fix: prevent TypeDoc/marked GFM autolink from mangling bare VERSIONING.md mentions
+- fix(checks): keep the crap report where a fresh checkout can write it
+- docs: update remaining release-please mentions after the Changesets migration
+- fix(sbom): exclude docs/sbom.cdx.json from Prettier reformatting
+- chore(benchmarks): refresh results.json
+- chore(benchmarks): refresh results.json
+- fix(helpers): reject glob patterns over 1000 characters so brace expansion fails fast
+- chore(main): release repo-contract 0.7.3 (#85)
+- chore: regenerate schemas for the VERSIONING.md backtick fix
+- docs: update prose referencing the old local api-contract/api-docs engine
+- fix: generate docs/api/ before the docs check; fix a stale RELEASING.md anchor
+- fix(benchmarks): strip trailing whitespace before nested blocks in RESULTS.md
+- fix(openssf-scorecard): stop Dangerous-Workflow from misreading past its first run: block
+- fix: skip TypeDoc's own unpushed-HEAD source links in the local pre-push docs crawl
+- chore(benchmarks): refresh results.json
+- chore(benchmarks): refresh results.json
+- chore: remove iso-12207-alignment compliance-document generator
+- a52a06d: The `openssf-scorecard` self-evaluation now computes a weighted aggregate (`Σ(score × weight) / Σ(weight)`), with per-check weights fetched live from `ossf/scorecard`'s own published `docs/checks/internal/checks.yaml` risk tiers and `pkg/scorecard/scorecard_result.go` risk-weight table, rather than a simple average -- mirroring upstream's own `Result.GetAggregateScore` for closer methodology fidelity. `docs/OpenSSF-Scorecard.md` also now records provenance metadata (run date, evaluated repo + commit, and this evaluator's own version -- explicitly distinguished from the upstream `scorecard` binary's version, since this evaluation never runs that binary). Internal tooling only (`checks/`, `scripts/`); no public API change.
+
+## [0.7.3](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.7.2...repo-contract-v0.7.3) (2026-09-27)
 
 ### Bug Fixes
 
-* exclude typescript@7 and vitest@5 from this dependency-group bump ([12b9ad0](https://github.com/MaverickCER/repo-contract/commit/12b9ad03bb808006612fc79f598252633ed4fd53))
+- exclude typescript@7 and vitest@5 from this dependency-group bump ([12b9ad0](https://github.com/MaverickCER/repo-contract/commit/12b9ad03bb808006612fc79f598252633ed4fd53))
 
 ## [0.7.2](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.7.1...repo-contract-v0.7.2) (2026-09-27)
 
-
 ### Bug Fixes
 
-* badges/docs-evidence carry forward checks instead of failing every push ([#83](https://github.com/MaverickCER/repo-contract/issues/83)) ([215db16](https://github.com/MaverickCER/repo-contract/commit/215db1666ec334a2cc341a8eedba38cc343abd7c))
+- badges/docs-evidence carry forward checks instead of failing every push ([#83](https://github.com/MaverickCER/repo-contract/issues/83)) ([215db16](https://github.com/MaverickCER/repo-contract/commit/215db1666ec334a2cc341a8eedba38cc343abd7c))
 
 ## [0.7.1](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.7.0...repo-contract-v0.7.1) (2026-09-26)
 
-
 ### Bug Fixes
 
-* branch-protection-compatible CI, TS-compat check, dev-audit cleanup ([#78](https://github.com/MaverickCER/repo-contract/issues/78)) ([076461b](https://github.com/MaverickCER/repo-contract/commit/076461bb45b59a5859a3f4bef0da9828c95d10e6))
+- branch-protection-compatible CI, TS-compat check, dev-audit cleanup ([#78](https://github.com/MaverickCER/repo-contract/issues/78)) ([076461b](https://github.com/MaverickCER/repo-contract/commit/076461bb45b59a5859a3f4bef0da9828c95d10e6))
 
 ## [0.7.0](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.6.0...repo-contract-v0.7.0) (2026-09-23)
 
-
 ### ⚠ BREAKING CHANGES
 
-* OutputFormat no longer includes "yaml", and ParserDependencyMissingError (thrown only for a missing "yaml" peer dependency) is removed from the public API. A config using output.format: "yaml" will now fail config validation.
+- OutputFormat no longer includes "yaml", and ParserDependencyMissingError (thrown only for a missing "yaml" peer dependency) is removed from the public API. A config using output.format: "yaml" will now fail config validation.
 
 ### Features
 
-* drop first-class YAML output-format support ([99f7b6d](https://github.com/MaverickCER/repo-contract/commit/99f7b6db13ef60e159b2eb589317fdf0e99f0726))
-* **security-socket:** reject supplyChainRisk alerts on shipped dependencies outright ([bf7f2b3](https://github.com/MaverickCER/repo-contract/commit/bf7f2b32ed47c496aea4877b20adb474592b85ad))
-* **security-socket:** reject supplyChainRisk alerts on shipped dependencies outright ([d0a0563](https://github.com/MaverickCER/repo-contract/commit/d0a0563eb7f783577333291e94383408bb9e8c53))
-
+- drop first-class YAML output-format support ([99f7b6d](https://github.com/MaverickCER/repo-contract/commit/99f7b6db13ef60e159b2eb589317fdf0e99f0726))
+- **security-socket:** reject supplyChainRisk alerts on shipped dependencies outright ([bf7f2b3](https://github.com/MaverickCER/repo-contract/commit/bf7f2b32ed47c496aea4877b20adb474592b85ad))
+- **security-socket:** reject supplyChainRisk alerts on shipped dependencies outright ([d0a0563](https://github.com/MaverickCER/repo-contract/commit/d0a0563eb7f783577333291e94383408bb9e8c53))
 
 ### Bug Fixes
 
-* **security-socket:** peerDependencies also count as shipped for supplyChainRisk ([e5db3cd](https://github.com/MaverickCER/repo-contract/commit/e5db3cd443c46c131ab0afc076451484132edede))
+- **security-socket:** peerDependencies also count as shipped for supplyChainRisk ([e5db3cd](https://github.com/MaverickCER/repo-contract/commit/e5db3cd443c46c131ab0afc076451484132edede))
 
 ## [0.6.0](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.5.2...repo-contract-v0.6.0) (2026-09-20)
 
-
 ### Features
 
-* **docs:** waive known-good-but-flaky external links; release as 0.6.0 ([2ffdd8f](https://github.com/MaverickCER/repo-contract/commit/2ffdd8fbf9d767f537939da40cd750af2fb5d0b7))
-
+- **docs:** waive known-good-but-flaky external links; release as 0.6.0 ([2ffdd8f](https://github.com/MaverickCER/repo-contract/commit/2ffdd8fbf9d767f537939da40cd750af2fb5d0b7))
 
 ### Miscellaneous Chores
 
-* release repo-contract as 0.6.0 ([8282f70](https://github.com/MaverickCER/repo-contract/commit/8282f70f7727ee7f2c517acf7e65e93fc51388c9))
+- release repo-contract as 0.6.0 ([8282f70](https://github.com/MaverickCER/repo-contract/commit/8282f70f7727ee7f2c517acf7e65e93fc51388c9))
 
 ## [0.5.2](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.5.1...repo-contract-v0.5.2) (2026-09-18)
 
-
 ### Features
 
-* OpenSSF Scorecard + ISO 12207 alignment, mutation zero-tolerance ([#68](https://github.com/MaverickCER/repo-contract/issues/68)) ([76de4af](https://github.com/MaverickCER/repo-contract/commit/76de4af16cc681e88e3fe85439537848aad096ad))
+- OpenSSF Scorecard + ISO 12207 alignment, mutation zero-tolerance ([#68](https://github.com/MaverickCER/repo-contract/issues/68)) ([76de4af](https://github.com/MaverickCER/repo-contract/commit/76de4af16cc681e88e3fe85439537848aad096ad))
 
 ## [0.5.1](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.5.0...repo-contract-v0.5.1) (2026-09-14)
 
-
 ### Bug Fixes
 
-* correct repository/bugs URL casing to match GitHub (MaverickCER) ([55d563c](https://github.com/MaverickCER/repo-contract/commit/55d563c06ec7b9fe1b26c73239e693f189aa31c8))
+- correct repository/bugs URL casing to match GitHub (MaverickCER) ([55d563c](https://github.com/MaverickCER/repo-contract/commit/55d563c06ec7b9fe1b26c73239e693f189aa31c8))
 
 ## [0.5.0](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.4.0...repo-contract-v0.5.0) (2026-09-12)
 
@@ -71,109 +144,99 @@ Administrative republish -- 0.4.0 is already published on npm at its current con
 
 ## [0.4.0](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.3.2...repo-contract-v0.4.0) (2026-09-09)
 
-
 ### ⚠ BREAKING CHANGES
 
-* adds the new Experimental repo-contract/helpers subpath (exception-policy primitive). No existing export's shape changes; classified as minor per VERSIONING.md's "a new preset -> minor" convention for the Experimental tier, not a literal incompatibility.
+- adds the new Experimental repo-contract/helpers subpath (exception-policy primitive). No existing export's shape changes; classified as minor per VERSIONING.md's "a new preset -> minor" convention for the Experimental tier, not a literal incompatibility.
 
 ### Features
 
-* add a narrow `repo-contract init` scaffolding command ([#63](https://github.com/MaverickCER/repo-contract/issues/63)) ([a1d4e4a](https://github.com/MaverickCER/repo-contract/commit/a1d4e4a242cb0253e0a62e486e86a475a5c8ddbd))
-* add a verified-exception waiver path to security-network ([94dbf43](https://github.com/MaverickCER/repo-contract/commit/94dbf4321b9288b10c65e7efc3e2596a40f4c628))
-* add security-socket and coderabbitai checks ([cb7d3ca](https://github.com/MaverickCER/repo-contract/commit/cb7d3cad8d8015e85c82731075abe48e12371b15))
-* add security-socket and coderabbitai checks ([31374ee](https://github.com/MaverickCER/repo-contract/commit/31374eebe5c35ff54e3efd37d5ed756cc8b8cdc4))
-* add the checks/shared exception-matching and identity layer ([0d711f5](https://github.com/MaverickCER/repo-contract/commit/0d711f5f17d382af507cfafab4a441d620a8b220))
-* add the generic exception-policy core primitive ([8d8f670](https://github.com/MaverickCER/repo-contract/commit/8d8f6704c20bc2c5a4b07e68dcb8e328ee48b9c7))
-* content-bound verification for suppression-governance ([fb6a838](https://github.com/MaverickCER/repo-contract/commit/fb6a838da76247cc42ab316ad9d420ff174a4124))
-* content-bound verification for suppression-governance (disable-comments.json) ([8da651a](https://github.com/MaverickCER/repo-contract/commit/8da651a0f76ab0464ed3b22ac5113b837ea3ecc1))
-* **helpers:** add the exception-registry lifecycle primitives ([de8e855](https://github.com/MaverickCER/repo-contract/commit/de8e8558a26ca238aafc69d736e576aafddd8fa0))
-* publish the repo-contract/helpers subpath ([35f168c](https://github.com/MaverickCER/repo-contract/commit/35f168ca9fbde4f46d1a29624f112e0d4d3b296d))
-* retrofit security-network onto the exception-policy primitive ([62b8d0a](https://github.com/MaverickCER/repo-contract/commit/62b8d0afae9f3958b60666531d58a25a6f5b796e))
-
+- add a narrow `repo-contract init` scaffolding command ([#63](https://github.com/MaverickCER/repo-contract/issues/63)) ([a1d4e4a](https://github.com/MaverickCER/repo-contract/commit/a1d4e4a242cb0253e0a62e486e86a475a5c8ddbd))
+- add a verified-exception waiver path to security-network ([94dbf43](https://github.com/MaverickCER/repo-contract/commit/94dbf4321b9288b10c65e7efc3e2596a40f4c628))
+- add security-socket and coderabbitai checks ([cb7d3ca](https://github.com/MaverickCER/repo-contract/commit/cb7d3cad8d8015e85c82731075abe48e12371b15))
+- add security-socket and coderabbitai checks ([31374ee](https://github.com/MaverickCER/repo-contract/commit/31374eebe5c35ff54e3efd37d5ed756cc8b8cdc4))
+- add the checks/shared exception-matching and identity layer ([0d711f5](https://github.com/MaverickCER/repo-contract/commit/0d711f5f17d382af507cfafab4a441d620a8b220))
+- add the generic exception-policy core primitive ([8d8f670](https://github.com/MaverickCER/repo-contract/commit/8d8f6704c20bc2c5a4b07e68dcb8e328ee48b9c7))
+- content-bound verification for suppression-governance ([fb6a838](https://github.com/MaverickCER/repo-contract/commit/fb6a838da76247cc42ab316ad9d420ff174a4124))
+- content-bound verification for suppression-governance (disable-comments.json) ([8da651a](https://github.com/MaverickCER/repo-contract/commit/8da651a0f76ab0464ed3b22ac5113b837ea3ecc1))
+- **helpers:** add the exception-registry lifecycle primitives ([de8e855](https://github.com/MaverickCER/repo-contract/commit/de8e8558a26ca238aafc69d736e576aafddd8fa0))
+- publish the repo-contract/helpers subpath ([35f168c](https://github.com/MaverickCER/repo-contract/commit/35f168ca9fbde4f46d1a29624f112e0d4d3b296d))
+- retrofit security-network onto the exception-policy primitive ([62b8d0a](https://github.com/MaverickCER/repo-contract/commit/62b8d0afae9f3958b60666531d58a25a6f5b796e))
 
 ### Bug Fixes
 
-* address CodeRabbit findings on the security-network retrofit ([e53313e](https://github.com/MaverickCER/repo-contract/commit/e53313ecf2973649cc2dca045a220f27f0e205db))
-* address CodeRabbit findings on the two new checks ([255e495](https://github.com/MaverickCER/repo-contract/commit/255e49584a2b6622cee174f560221e731932d840))
-* address CodeRabbit findings on the verification retrofit ([3d91878](https://github.com/MaverickCER/repo-contract/commit/3d91878407dd006f82239d034cb319d3856a0c46))
-* address round-2 CodeRabbit findings on the helpers primitive ([fabb9df](https://github.com/MaverickCER/repo-contract/commit/fabb9df2261051cc35fbe15faf3e6df9317afdf5))
-* backfill verification baseline onto records merged in from main ([286e877](https://github.com/MaverickCER/repo-contract/commit/286e8775ad66d7d727f68c0ba269ad2cfa036d56))
-* harden exception-policy config validation and smoke/license accuracy ([e23c069](https://github.com/MaverickCER/repo-contract/commit/e23c069f422ac8967cf8c3a65605bdfb85c07abc))
-* reject impossible calendar dates in verifiedAt, sync ADR 0013 ([6df0911](https://github.com/MaverickCER/repo-contract/commit/6df0911c8bbbfe99bd97095e811b9d762aeb6438))
-* reject trailing newline in verifiedAt; PATH-aware socket probe in the integration test ([ef01ba6](https://github.com/MaverickCER/repo-contract/commit/ef01ba65950041838a3e43f8d8f440add6c4a97c))
-* remove duplicate StandardSchemaV1 re-export in src/helpers/index.ts ([a0d8ee7](https://github.com/MaverickCER/repo-contract/commit/a0d8ee7a490d05fc99d9cbb7150706f7c1494694))
-* skip the real-source drift test inside a Stryker mutation sandbox ([e9e64f6](https://github.com/MaverickCER/repo-contract/commit/e9e64f6dbe57a9e0612209bb568b584961d130cc))
-* validate exception registries on every run and tighten verification ([8d6993f](https://github.com/MaverickCER/repo-contract/commit/8d6993fb94299a50c7b2589d400e592e43767df5))
-* validate the coderabbit terminal event findings count ([a7acd09](https://github.com/MaverickCER/repo-contract/commit/a7acd0950b54f3bd2dbde3956a697d97d80daf9c))
+- address CodeRabbit findings on the security-network retrofit ([e53313e](https://github.com/MaverickCER/repo-contract/commit/e53313ecf2973649cc2dca045a220f27f0e205db))
+- address CodeRabbit findings on the two new checks ([255e495](https://github.com/MaverickCER/repo-contract/commit/255e49584a2b6622cee174f560221e731932d840))
+- address CodeRabbit findings on the verification retrofit ([3d91878](https://github.com/MaverickCER/repo-contract/commit/3d91878407dd006f82239d034cb319d3856a0c46))
+- address round-2 CodeRabbit findings on the helpers primitive ([fabb9df](https://github.com/MaverickCER/repo-contract/commit/fabb9df2261051cc35fbe15faf3e6df9317afdf5))
+- backfill verification baseline onto records merged in from main ([286e877](https://github.com/MaverickCER/repo-contract/commit/286e8775ad66d7d727f68c0ba269ad2cfa036d56))
+- harden exception-policy config validation and smoke/license accuracy ([e23c069](https://github.com/MaverickCER/repo-contract/commit/e23c069f422ac8967cf8c3a65605bdfb85c07abc))
+- reject impossible calendar dates in verifiedAt, sync ADR 0013 ([6df0911](https://github.com/MaverickCER/repo-contract/commit/6df0911c8bbbfe99bd97095e811b9d762aeb6438))
+- reject trailing newline in verifiedAt; PATH-aware socket probe in the integration test ([ef01ba6](https://github.com/MaverickCER/repo-contract/commit/ef01ba65950041838a3e43f8d8f440add6c4a97c))
+- remove duplicate StandardSchemaV1 re-export in src/helpers/index.ts ([a0d8ee7](https://github.com/MaverickCER/repo-contract/commit/a0d8ee7a490d05fc99d9cbb7150706f7c1494694))
+- skip the real-source drift test inside a Stryker mutation sandbox ([e9e64f6](https://github.com/MaverickCER/repo-contract/commit/e9e64f6dbe57a9e0612209bb568b584961d130cc))
+- validate exception registries on every run and tighten verification ([8d6993f](https://github.com/MaverickCER/repo-contract/commit/8d6993fb94299a50c7b2589d400e592e43767df5))
+- validate the coderabbit terminal event findings count ([a7acd09](https://github.com/MaverickCER/repo-contract/commit/a7acd0950b54f3bd2dbde3956a697d97d80daf9c))
 
 ## [0.3.2](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.3.1...repo-contract-v0.3.2) (2026-09-04)
 
-
 ### Features
 
-* validate and transform check output with a Standard Schema ([d53cb17](https://github.com/MaverickCER/repo-contract/commit/d53cb17a9e3a3f939cd403226ab5256be0de79ac))
-* validate and transform check output with a Standard Schema ([fbb7925](https://github.com/MaverickCER/repo-contract/commit/fbb79259f4a6cede1da64a0abd7e1f1541e1d505))
-
+- validate and transform check output with a Standard Schema ([d53cb17](https://github.com/MaverickCER/repo-contract/commit/d53cb17a9e3a3f939cd403226ab5256be0de79ac))
+- validate and transform check output with a Standard Schema ([fbb7925](https://github.com/MaverickCER/repo-contract/commit/fbb79259f4a6cede1da64a0abd7e1f1541e1d505))
 
 ### Bug Fixes
 
-* address CodeRabbit findings and close mutation-testing gaps in Standard Schema support ([53baf87](https://github.com/MaverickCER/repo-contract/commit/53baf877d367fd17dbe1ec2f312ab9ed790e6ae6))
-* **api-contract:** don't classify a required property on a brand-new container as breaking ([27ad5d5](https://github.com/MaverickCER/repo-contract/commit/27ad5d5c57811d90393b00f48ae8a8bbd413407b))
-* **test:** harden isRuntimeAvailable against spawnSync throwing under load ([60c76b6](https://github.com/MaverickCER/repo-contract/commit/60c76b642dfd6187888f02d31639e68468e77b17))
+- address CodeRabbit findings and close mutation-testing gaps in Standard Schema support ([53baf87](https://github.com/MaverickCER/repo-contract/commit/53baf877d367fd17dbe1ec2f312ab9ed790e6ae6))
+- **api-contract:** don't classify a required property on a brand-new container as breaking ([27ad5d5](https://github.com/MaverickCER/repo-contract/commit/27ad5d5c57811d90393b00f48ae8a8bbd413407b))
+- **test:** harden isRuntimeAvailable against spawnSync throwing under load ([60c76b6](https://github.com/MaverickCER/repo-contract/commit/60c76b642dfd6187888f02d31639e68468e77b17))
 
 ## [0.3.1](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.3.0...repo-contract-v0.3.1) (2026-09-03)
 
-
 ### Bug Fixes
 
-* correct the release runbook that shipped types-less tarballs ([f56ea34](https://github.com/MaverickCER/repo-contract/commit/f56ea342606cfc92a09943ea5eb787936e7b7ba9))
-* published tarball missing types; simplify CI matrix ([7ec8fd9](https://github.com/MaverickCER/repo-contract/commit/7ec8fd946bd584098255c5d2ab3f07b98b55ba1f))
+- correct the release runbook that shipped types-less tarballs ([f56ea34](https://github.com/MaverickCER/repo-contract/commit/f56ea342606cfc92a09943ea5eb787936e7b7ba9))
+- published tarball missing types; simplify CI matrix ([7ec8fd9](https://github.com/MaverickCER/repo-contract/commit/7ec8fd946bd584098255c5d2ab3f07b98b55ba1f))
 
 ## [0.3.0](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.2.1...repo-contract-v0.3.0) (2026-09-03)
 
-
 ### ⚠ BREAKING CHANGES
 
-* defineRepoContract/runRepoContract now require spawn and env on the config (e.g. spawn: child_process.spawn, env: process.env). See ADR 0011 and README's "Supplying spawn/env" section for migration.
+- defineRepoContract/runRepoContract now require spawn and env on the config (e.g. spawn: child_process.spawn, env: process.env). See ADR 0011 and README's "Supplying spawn/env" section for migration.
 
 ### Features
 
-* contract engine, self-hosting checks and CI workflows ([97ae128](https://github.com/MaverickCER/repo-contract/commit/97ae128bd96f2c631057f1150068af58cc66b224))
-* contract engine, self-hosting checks and CI workflows ([22b2a3b](https://github.com/MaverickCER/repo-contract/commit/22b2a3b03fe4e44ad7a01b82342d86583926416a))
-* make process spawning and env access consumer-supplied capabilities ([640a961](https://github.com/MaverickCER/repo-contract/commit/640a961b65fd73511586c3b4f6274284bf5172a9))
-
+- contract engine, self-hosting checks and CI workflows ([97ae128](https://github.com/MaverickCER/repo-contract/commit/97ae128bd96f2c631057f1150068af58cc66b224))
+- contract engine, self-hosting checks and CI workflows ([22b2a3b](https://github.com/MaverickCER/repo-contract/commit/22b2a3b03fe4e44ad7a01b82342d86583926416a))
+- make process spawning and env access consumer-supplied capabilities ([640a961](https://github.com/MaverickCER/repo-contract/commit/640a961b65fd73511586c3b4f6274284bf5172a9))
 
 ### Bug Fixes
 
-* clear Socket supply-chain alerts (unminified dist, no prepare script) ([71c9230](https://github.com/MaverickCER/repo-contract/commit/71c92306fcf00e3858f0596c2d56f3272199339d))
-* publish the dist bundle unminified ([266ae47](https://github.com/MaverickCER/repo-contract/commit/266ae47919753c55f10364713fe0c7c5876815b7))
-* remove the prepare install script from the published package ([9153540](https://github.com/MaverickCER/repo-contract/commit/9153540e4f0f1a069e07c12ddfee8ba62827ce5b))
+- clear Socket supply-chain alerts (unminified dist, no prepare script) ([71c9230](https://github.com/MaverickCER/repo-contract/commit/71c92306fcf00e3858f0596c2d56f3272199339d))
+- publish the dist bundle unminified ([266ae47](https://github.com/MaverickCER/repo-contract/commit/266ae47919753c55f10364713fe0c7c5876815b7))
+- remove the prepare install script from the published package ([9153540](https://github.com/MaverickCER/repo-contract/commit/9153540e4f0f1a069e07c12ddfee8ba62827ce5b))
 
 ## [0.2.1](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.2.0...repo-contract-v0.2.1) (2026-09-03)
 
-
 ### Documentation
 
-* add Socket security badge to README
+- add Socket security badge to README
 
 ## [0.2.0](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.1.1...repo-contract-v0.2.0) (2026-09-03)
 
-
 ### ⚠ BREAKING CHANGES
 
-* defineRepoContract/runRepoContract now require spawn and env on the config (e.g. spawn: child_process.spawn, env: process.env). See ADR 0011 and README's "Supplying spawn/env" section for migration.
+- defineRepoContract/runRepoContract now require spawn and env on the config (e.g. spawn: child_process.spawn, env: process.env). See ADR 0011 and README's "Supplying spawn/env" section for migration.
 
 ### Features
 
-* make process spawning and env access consumer-supplied capabilities ([640a961](https://github.com/MaverickCER/repo-contract/commit/640a961b65fd73511586c3b4f6274284bf5172a9))
+- make process spawning and env access consumer-supplied capabilities ([640a961](https://github.com/MaverickCER/repo-contract/commit/640a961b65fd73511586c3b4f6274284bf5172a9))
 
 ## [0.1.1](https://github.com/MaverickCER/repo-contract/compare/repo-contract-v0.1.0...repo-contract-v0.1.1) (2026-09-01)
 
-
 ### Bug Fixes
 
-* clear Socket supply-chain alerts (unminified dist, no prepare script) ([71c9230](https://github.com/MaverickCER/repo-contract/commit/71c92306fcf00e3858f0596c2d56f3272199339d))
-* publish the dist bundle unminified ([266ae47](https://github.com/MaverickCER/repo-contract/commit/266ae47919753c55f10364713fe0c7c5876815b7))
-* remove the prepare install script from the published package ([9153540](https://github.com/MaverickCER/repo-contract/commit/9153540e4f0f1a069e07c12ddfee8ba62827ce5b))
+- clear Socket supply-chain alerts (unminified dist, no prepare script) ([71c9230](https://github.com/MaverickCER/repo-contract/commit/71c92306fcf00e3858f0596c2d56f3272199339d))
+- publish the dist bundle unminified ([266ae47](https://github.com/MaverickCER/repo-contract/commit/266ae47919753c55f10364713fe0c7c5876815b7))
+- remove the prepare install script from the published package ([9153540](https://github.com/MaverickCER/repo-contract/commit/9153540e4f0f1a069e07c12ddfee8ba62827ce5b))
 
 ## Changelog

package/README.md

@@ -203,6 +203,10 @@ new requirements land as `warn`, become `fail` on a date
 
 AI coding agents, CI bots, and release automation consume the same contract as human contributors. An actionable rationale gives automation a concrete thing to fix rather than a bare "a check failed" — making regenerate-until-green workflows much easier to converge.
 
+## Supply-chain transparency
+
+This repository publishes its own dependency inventory: [`docs/sbom.cdx.json`](docs/sbom.cdx.json), a real [CycloneDX](https://cyclonedx.org/) 1.6 Software Bill of Materials, regenerated on every `npm run contract` run via [`@cyclonedx/cyclonedx-npm`](https://github.com/CycloneDX/cyclonedx-node-npm) (`checks/sbom.ts`). It covers every direct and transitive **npm** dependency resolved in `package-lock.json` — no other ecosystem — and is deterministic given an unchanged lockfile, so it stays a normal, diff-gated committed file rather than a special-cased exclusion.
+
 ## Status
 
 Pre-1.0. Per [VERSIONING.md](VERSIONING.md), a `0.x` minor may carry a breaking change to the Stable tier before 1.0 — pin accordingly and read the [CHANGELOG](CHANGELOG.md) on every minor upgrade.

package/bin/preset-catalog.d.mts

@@ -9,6 +9,7 @@ export type PresetName =
   | "stylelint"
   | "markdownlint"
   | "brokenLinks"
+  | "distNoUrls"
   | "securityDeps"
   | "securitySecrets"
   | "license"
@@ -16,6 +17,8 @@ export type PresetName =
   | "publint"
   | "arethetypeswrong"
 
+export declare const DIST_OUTPUT: "dist/"
+
 export declare const PRESET_DEPENDENCIES: Readonly<Record<PresetName, string | null>>
 
 export declare const FACTORY_PRESETS: ReadonlySet<PresetName>
@@ -36,4 +39,10 @@ export declare function detectPresets(packageJson: {
   // `devDependencies` (see preset-catalog.mjs's own doc comment for why).
   readonly dependencies?: Readonly<Record<string, string>>
   readonly devDependencies?: Readonly<Record<string, string>>
+  // Read only to detect a published `dist/` (the `distNoUrls` preset).
+  readonly main?: string
+  readonly module?: string
+  readonly types?: string
+  readonly files?: readonly string[]
+  readonly exports?: unknown
 }): DetectPresetsResult

package/bin/preset-catalog.mjs

@@ -9,10 +9,17 @@
 // -- it cannot prove each dependency mapping below is itself correct. That's a known, accepted
 // limit of a hand-maintained table, stated here rather than assumed away.
 //
+// `distNoUrls` maps to `DIST_OUTPUT`, a pseudo-dependency: it needs no CLI at all, only a package that
+// actually publishes a built `dist/`, so `detectPresets` detects it from package.json's own
+// `main`/`module`/`types`/`files`/`exports` instead of from `devDependencies`.
+//
 // `securityDeps` maps to `null`, not a real npm package name: it shells out to `npm` itself (see
 // GUIDE.md's preset table), which is always present because this script is already running via
 // `npx`/`npm exec`. It goes through the exact same detection loop as every other preset below,
 // with an always-true answer -- not a separate branch elsewhere.
+/** The pseudo-dependency `distNoUrls` maps to -- see the comment above. */
+export const DIST_OUTPUT = "dist/"
+
 export const PRESET_DEPENDENCIES = {
   test: "vitest",
   e2e: "@playwright/test",
@@ -24,6 +31,7 @@ export const PRESET_DEPENDENCIES = {
   stylelint: "stylelint",
   markdownlint: "markdownlint-cli2",
   brokenLinks: "linkinator",
+  distNoUrls: DIST_OUTPUT,
   securityDeps: null,
   securitySecrets: "secretlint",
   license: "licensee",
@@ -42,8 +50,38 @@ export const FACTORY_PRESETS = new Set([
   "markdownlint",
   "brokenLinks",
   "commitlint",
+  "distNoUrls",
 ])
 
+/**
+ * Every string anywhere inside `value` (an `exports` map nests arbitrarily).
+ * @param value - Any parsed JSON value.
+ * @returns the strings it contains.
+ */
+function allStrings(value) {
+  if (typeof value === "string") return [value]
+  if (Array.isArray(value)) return value.flatMap(allStrings)
+  if (value !== null && typeof value === "object") return Object.values(value).flatMap(allStrings)
+  return []
+}
+
+/**
+ * Whether package.json publishes a built `dist/` directory (its entry points or `files` allowlist
+ * name it).
+ * @param packageJson - Parsed package.json content.
+ * @returns `true` when any entry point or `files` entry is `dist` or lives under it.
+ */
+function publishesDist(packageJson) {
+  const references = allStrings([
+    packageJson.main,
+    packageJson.module,
+    packageJson.types,
+    packageJson.files,
+    packageJson.exports,
+  ])
+  return references.some((reference) => /^(\.\/)?dist(\/|$)/.test(reference))
+}
+
 /**
  * Detects which presets' underlying CLIs are already declared in a consumer's package.json.
  * Checks `devDependencies` only -- every published preset's own documentation (GUIDE.md's
@@ -60,7 +98,10 @@ export function detectPresets(packageJson) {
   const skipped = []
 
   for (const [preset, dependency] of Object.entries(PRESET_DEPENDENCIES)) {
-    if (dependency === null || declared.has(dependency)) {
+    const present =
+      dependency === null ||
+      (dependency === DIST_OUTPUT ? publishesDist(packageJson) : declared.has(dependency))
+    if (present) {
       detected.push(preset)
     } else {
       skipped.push({ preset, dependency })

package/bin/repo-contract.mjs

@@ -12,7 +12,7 @@
 
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs"
 import path from "node:path"
-import { detectPresets } from "./preset-catalog.mjs"
+import { DIST_OUTPUT, detectPresets } from "./preset-catalog.mjs"
 import { buildConfigTemplate, CONTRACT_RUNNER_TEMPLATE } from "./templates.mjs"
 import { patchContractScript } from "./package-json-patch.mjs"
 
@@ -172,7 +172,11 @@ function report({ configResult, runnerResult, scriptStatus, detected, skipped })
   if (skipped.length > 0) {
     lines.push("Not detected (install the tool to add its check):")
     for (const { preset, dependency } of skipped)
-      lines.push(`  - ${preset} (${dependency} not installed)`)
+      lines.push(
+        dependency === DIST_OUTPUT
+          ? `  - ${preset} (package.json names no dist/ build output)`
+          : `  - ${preset} (${dependency} not installed)`,
+      )
     lines.push("")
   }
 

package/dist/.dts/helpers/exception-policy.d.ts

@@ -25,7 +25,7 @@ export type ExceptionPolicy = {
  * with no exact or glob match in `rules` (see `resolveExceptionPolicy` for the full exact > glob >
  * group-default > global-default precedence). Omit `default` to fall through to the caller-supplied
  * `globalDefault` instead. Each key of `rules` is either an exact `category` string or a
- * `minimatch` glob pattern -- `resolveExceptionPolicy` tries an exact match first and only
+ * glob pattern -- `resolveExceptionPolicy` tries an exact match first and only
  * consults glob matching once no exact key exists, so a glob can never shadow a more specific
  * exact entry.
  * @beta
@@ -33,7 +33,7 @@ export type ExceptionPolicy = {
 export interface ExceptionCategoryGroup {
     /** This group's fallback policy when `category` matches neither an exact nor a glob key in `rules`. Falls through to the caller's `globalDefault` when omitted. */
     readonly default?: ExceptionPolicy;
-    /** Keyed by exact `category` string or `minimatch` glob pattern. A literal `"*"` key is rejected by `validateExceptionPolicyConfig` -- see that function's own doc comment for why. */
+    /** Keyed by exact `category` string or glob pattern. A literal `"*"` key is rejected by `validateExceptionPolicyConfig` -- see that function's own doc comment for why. */
     readonly rules?: Readonly<Record<string, ExceptionPolicy>>;
 }
 /**
@@ -110,7 +110,7 @@ export declare function stricterOf(a: ExceptionPolicy, b: ExceptionPolicy): Exce
  * 1. **Blanket category** -- `category === "*"` means every category this group could ever apply
  *    to was matched at once, not one specific category literally named `"*"`. It resolves as the
  *    strictest (`stricterOf`) policy across every entry in `group.rules` plus the group's own
- *    default (or `globalDefault`) -- never via `minimatch`: `minimatch("*", pattern)` tests the
+ *    default (or `globalDefault`) -- never via the glob matcher: `globMatch("*", pattern)` tests the
  *    literal one-character string `"*"` as a path against `pattern`, which does not glob-match a
  *    pattern like `"security/*"` (that would require the *pattern*, not the *target*, to be `"*"`),
  *    so treating this case as an ordinary pattern match would silently let a blanket match fall
@@ -118,7 +118,7 @@ export declare function stricterOf(a: ExceptionPolicy, b: ExceptionPolicy): Exce
  * 2. **Exact match** -- `group.rules[category]`, if present. A glob is never even consulted once an
  *    exact entry exists for `category`.
  * 3. **Glob match** -- the strictest (`stricterOf`) policy among every key in `group.rules` that is
- *    not itself an exact match for `category` but does match it as a `minimatch` glob (e.g.
+ *    not itself an exact match for `category` but does match it as a glob (e.g.
  *    `"security/*"` matching `"security/detect-object-injection"`).
  * 4. **Group default** -- `group.default`, if `group` itself has an entry in `config` (whether or
  *    not that entry defines its own `default`).
@@ -186,9 +186,9 @@ export declare function evaluateExceptionRecords<TRecord>(inputs: readonly Excep
  * no group's `rules` may use the literal `"*"` as a key. A literal `"*"` key is always a mistake,
  * never an intentional blanket policy: `resolveExceptionPolicy`'s own blanket-category handling is
  * triggered by the *input* `category` being `"*"`, not by a `"*"` entry in `rules` -- a `"*"` rules
- * key would instead be consulted only as an ordinary `minimatch` glob, which matches the literal
+ * key would instead be consulted only as an ordinary glob, which matches the literal
  * one-character string `"*"` as a *target*, not as a wildcard pattern matching every real category
- * name (`minimatch("*", pattern)` truthiness depends on `pattern`, not the other way around) --
+ * name (`globMatch("*", pattern)` truthiness depends on `pattern`, not the other way around) --
  * see `resolveExceptionPolicy`'s own doc comment, case 1, for the failure mode this prevents.
  * @param config - The exception policy configuration to validate.
  * @param validRequirements - The complete set of field names this consumer's policy may require, if the consumer wants that checked. Omit to skip that check entirely.

package/dist/.dts/helpers/exception-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exception-policy.d.ts","sourceRoot":"","sources":["../../../src/helpers/exception-policy.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAE5E;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC,mKAAmK;IACnK,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;IAClC,uLAAuL;IACvL,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAA;CAC3D;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAA;AAEpF;;;;;;;;;GASG;AACH,MAAM,WAAW,uBAAuB;IACtC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,CAAA;AAEzE;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB,CAAC,OAAO;IAC3C,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,mMAAmM;IACnM,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAA;IAClC,8JAA8J;IAC9J,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,GAAG,eAAe,CAclF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,uBAAuB,EACvC,MAAM,EAAE,qBAAqB,EAC7B,aAAa,EAAE,eAAe,GAC7B,eAAe,CA+BjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB,CAAC,OAAO;IAChD,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,6GAA6G;IAC7G,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,uBAAuB,EAAE,GAAG,uBAAuB,EAAE,CAAC,CAAA;IAC1F,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,uGAAuG;IACvG,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAA;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,MAAM,CAAA;CACtE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAC7C,KAAK,EAAE,yBAAyB,CAAC,OAAO,CAAC,GACxC,oBAAoB,CAAC,OAAO,CAAC,CAiB/B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAC9C,MAAM,EAAE,SAAS,yBAAyB,CAAC,OAAO,CAAC,EAAE,GACpD,SAAS,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAE1C;AA4ED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,qBAAqB,EAC7B,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GACpC,SAAS,MAAM,EAAE,CAkDnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAC3C,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,MAAM,GAC3D,MAAM,CASR"}
+{"version":3,"file":"exception-policy.d.ts","sourceRoot":"","sources":["../../../src/helpers/exception-policy.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAE5E;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC,mKAAmK;IACnK,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;IAClC,2KAA2K;IAC3K,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAA;CAC3D;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAA;AAEpF;;;;;;;;;GASG;AACH,MAAM,WAAW,uBAAuB;IACtC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,CAAA;AAEzE;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB,CAAC,OAAO;IAC3C,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,mMAAmM;IACnM,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAA;IAClC,8JAA8J;IAC9J,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,GAAG,eAAe,CAclF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,uBAAuB,EACvC,MAAM,EAAE,qBAAqB,EAC7B,aAAa,EAAE,eAAe,GAC7B,eAAe,CA+BjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB,CAAC,OAAO;IAChD,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,6GAA6G;IAC7G,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,uBAAuB,EAAE,GAAG,uBAAuB,EAAE,CAAC,CAAA;IAC1F,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,uGAAuG;IACvG,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAA;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,MAAM,CAAA;CACtE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAC7C,KAAK,EAAE,yBAAyB,CAAC,OAAO,CAAC,GACxC,oBAAoB,CAAC,OAAO,CAAC,CAiB/B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAC9C,MAAM,EAAE,SAAS,yBAAyB,CAAC,OAAO,CAAC,EAAE,GACpD,SAAS,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAE1C;AA4ED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,qBAAqB,EAC7B,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GACpC,SAAS,MAAM,EAAE,CAkDnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAC3C,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,MAAM,GAC3D,MAAM,CASR"}

package/dist/.dts/helpers/glob-match.d.ts

@@ -0,0 +1,29 @@
+/**
+ * A small, dependency-free glob matcher -- the replacement for the `minimatch` runtime dependency
+ * (see specs/decisions/0017-own-glob-matcher-replaces-minimatch.md). Pure string logic: it reads no
+ * environment variable, touches no filesystem, imports nothing, and builds no `RegExp` from its
+ * input -- a pattern is tokenized and matched by a position-set simulation that is polynomial in
+ * the sizes of the pattern and the value, so no pattern can cause catastrophic backtracking.
+ *
+ * Supported syntax (exactly what exception-policy category keys use, e.g. `"security/*"`):
+ * - `*`   any run of characters except `/`
+ * - `**`  any run of characters including `/`; a whole `**` + `/` segment also matches zero segments
+ * - `?`   exactly one character except `/`
+ * - `[abc]`, `[a-z]`, `[!abc]` / `[^abc]`  a character class (a reversed range matches nothing)
+ * - `{a,b}`  alternation (nestable)
+ * - `\x`  the literal character `x`
+ *
+ * Not supported (treated as literal text, never as a special form): extglobs (`+(a|b)`), POSIX
+ * classes (`[[:alpha:]]`), dotfile exclusion, case folding.
+ */
+/**
+ * Whether `value` matches the glob `pattern` (see this module's own doc comment for the exact
+ * syntax). Nothing is cached: compiling a category glob costs microseconds, and a cache would make a
+ * pattern's code paths run only for the first caller.
+ * @param value - the string to test (an exception category such as `"security/xss"`).
+ * @param pattern - the glob to test it against.
+ * @returns `true` when the whole of `value` matches `pattern`.
+ * @throws {Error} when `pattern` is over 1000 characters, or its brace groups expand to too many alternatives.
+ */
+export declare function globMatch(value: string, pattern: string): boolean;
+//# sourceMappingURL=glob-match.d.ts.map

package/dist/.dts/helpers/glob-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob-match.d.ts","sourceRoot":"","sources":["../../../src/helpers/glob-match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAwKH;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQjE"}

package/dist/.dts/helpers/index.d.ts

@@ -12,7 +12,7 @@
  * specs/decisions/0013-reusable-exception-policy-helper.md for the full
  * rationale and the boundary this barrel deliberately does not cross.
  *
- * Published **Experimental** (see VERSIONING.md): its TypeScript signature
+ * Published **Experimental** (see `VERSIONING.md`): its TypeScript signature
  * and runtime behavior may both change in a minor or patch release, the same
  * classification `repo-contract/presets` already carries (see
  * specs/decisions/0004-public-surface-stays-narrow-no-cli-experimental-presets.md)

package/dist/.dts/parsing/parse-output.d.ts

@@ -3,7 +3,7 @@ import type { OutputFormat, ParsedOutput } from "../types.js";
 /**
  * Dispatches to the parser for `format`, then -- only on a successful parse, and only if `schema`
  * is supplied -- runs `schema["~standard"].validate()` against the parsed value
- * (https://standardschema.dev). `parse-json.ts`/`parse-text.ts` stay entirely unaware of `schema`;
+ * (standardschema.dev). `parse-json.ts`/`parse-text.ts` stay entirely unaware of `schema`;
  * this is the sole orchestration point. `validate()` may return its `Result` synchronously or as a
  * `Promise` -- `await`ing either uniformly is a no-op for the synchronous case, but this function
  * still needs to be `async` for that awaited call. A successful `Result` (`issues === undefined`)

package/dist/.dts/presets/dist-no-urls.d.ts

@@ -0,0 +1,26 @@
+import type { CheckDefinitionConfig } from "../types.js";
+/** One allowlisted URL (glob) and the reviewable reason it may ship. */
+export interface DistNoUrlsAllowEntry {
+    /** A URL, or a glob (`*`, `**`, `?`, `[...]`, `{a,b}`; escape literals with `\`) matched against each whole URL found. */
+    readonly url: string;
+    /** Why this URL must ship in the build output. Required and non-empty -- an allowlist entry without one fails the check. */
+    readonly reason: string;
+}
+/** Options accepted by {@link distNoUrls}. */
+export interface DistNoUrlsOptions {
+    /** Build-output directory to scan, relative to the working directory. Defaults to `"dist"`. */
+    readonly dir?: string;
+    /** URLs permitted in the output, each with a reason. Empty by default: the strictest policy is the default. */
+    readonly allow?: readonly DistNoUrlsAllowEntry[];
+}
+/**
+ * Fails when any URL (any scheme followed by a colon and two slashes) appears in any file of the build output directory, so
+ * supply-chain scanners that flag shipped URLs (Socket.dev's "URL strings" alert, for one) have
+ * nothing to flag. Scans every file, sourcemaps and declaration files included. Individual URLs can
+ * be allowed with a mandatory, reviewable `reason`; there is no blanket opt-out.
+ * @param options - configuration for this check; see {@link DistNoUrlsOptions}.
+ * @returns the configured check.
+ * @beta
+ */
+export declare function distNoUrls(options?: DistNoUrlsOptions): CheckDefinitionConfig;
+//# sourceMappingURL=dist-no-urls.d.ts.map

package/dist/.dts/presets/dist-no-urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist-no-urls.d.ts","sourceRoot":"","sources":["../../../src/presets/dist-no-urls.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAGxD,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACnC,0HAA0H;IAC1H,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,4HAA4H;IAC5H,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,+FAA+F;IAC/F,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,+GAA+G;IAC/G,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAA;CACjD;AAsFD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,qBAAqB,CAiEjF"}