fix(cli): the advisories reported findings inside build output

`meta verify` named `public/main.js:243 — <EntityFetcherProvider> is mounted with no
baseUrl` on an estate whose source, client/src/main.tsx:26, passes baseUrl="/api"
correctly. A 711KB bundle: a file nobody edits, a fix that belongs elsewhere, and the
FIRST line of the advisory on a project that had already done the right thing.

No ignore list would have caught it — they name dist/build/out/.next/.output and this
project builds to `public/`. So the rule is a property of the artifact: looksBundled()
calls a file with any line of 5,000+ characters build output, an order of magnitude
above the longest line a human writes and an order below what minification produces.

Applied at BOTH doors, because both had the hole in different shapes: the base-URL
advisory had no size guard at all, and the anti-pattern pass's 512KB gate is about
scan cost, so a 300KB minified bundle sails through it while being exactly as
unfixable. The walkers stay separate — they diverge on purpose — and share only this
judgment. Verified against the estate: the false positive is gone, its 26 real
findings in client/src are not.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NTcEKXTQMYt84fAjuw5A2M

Author: dmealing

CHANGELOG.md

@@ -7,6 +7,27 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+### Fixed — both advisory scanners reported findings inside BUILD OUTPUT
+
+`meta verify` on an adopter estate reported
+`public/main.js:243 — <EntityFetcherProvider> is mounted with no baseUrl` while the source
+it was built from, `client/src/main.tsx:26`, passes `baseUrl="/api"` correctly. The finding
+named a 711KB bundle: a file nobody edits, pointing away from the fix, on a project that had
+already done the right thing — and it was the FIRST line of the advisory, spending the
+scanner's whole false-positive budget on a project doing nothing wrong.
+
+The ignore lists could not have caught it. They name `dist`, `build`, `out`, `.next`,
+`.output` — and this project builds to `public/`. So the rule is a property of the ARTIFACT
+instead: `looksBundled()` (new, `lib/authored-source.ts`) treats a file with any line of
+5,000+ characters as build output, an order of magnitude above the longest line a human
+writes and an order below what minification produces. Both scanners apply it — the base-URL
+advisory, which had no size guard at all, and the anti-pattern pass, whose existing 512KB
+gate is about scan COST and lets a 300KB minified bundle straight through.
+
+The two scanners keep their own walkers (they diverge deliberately); what they now share is
+the one judgment about what counts as authored source.
+
+
 ### Fixed — `meta upgrade` printed one retirement's rationale once per OCCURRENCE
 
 An adopter estate carrying 24 `@forge*` attributes got ~96 lines of output for one

server/typescript/packages/cli/src/lib/anti-patterns.ts

@@ -18,6 +18,7 @@
 import { readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { relPosix } from "./rel-posix.js";
+import { looksBundled } from "./authored-source.js";
 
 export interface AntiPatternFinding {
   file: string; // path relative to the scan root (posix-ish, sep-normalized)
@@ -259,6 +260,10 @@ function walk(dir: string, root: string, ignore: readonly RegExp[], acc: AntiPat
     }
     // Skip MetaObjects-generated output — it legitimately contains AVG/CHECK etc.
     if (text.slice(0, 600).includes(GENERATED_MARKER)) continue;
+    // …and skip a BUNDLE, which is nobody's source. The 512KB gate above is about cost, not
+    // authorship: a 300KB minified file passes it while being just as unfixable. Same rule
+    // the base-URL advisory applies, from the same module. See lib/authored-source.ts.
+    if (looksBundled(text)) continue;
     const isSql = e.name.endsWith(".sql");
     const lines = text.split("\n");
     for (let i = 0; i < lines.length; i++) {

server/typescript/packages/cli/src/lib/authored-source.ts

@@ -0,0 +1,45 @@
+/**
+ * Is this file text a HUMAN wrote, or a bundler's output?
+ *
+ * Both advisory scanners — the base-URL one and the anti-pattern one — exist to teach the
+ * author of a file something about the file. A bundle is not authored: nobody can act on a
+ * finding in it, the fix belongs in the source it was built from, and naming a generated
+ * artifact spends the scanners' whole false-positive budget in one line.
+ *
+ * The rule is a property of the ARTIFACT, not of a directory name. An estate proved why:
+ * its build output is `public/`, which no ignore list would have guessed (the lists cover
+ * `dist`, `build`, `.next`, `.output`, `out`), so `meta verify` reported
+ * `public/main.js:243 — <EntityFetcherProvider> is mounted with no baseUrl` while
+ * `client/src/main.tsx:26` — the source, the file a person edits — passes `baseUrl="/api"`
+ * correctly. Adding `public` to a list would have fixed that estate and nobody else.
+ *
+ * The two scanners keep their own walkers, deliberately (they diverge on eight axes and
+ * unifying them needs ~6 options for two callers). What they share is this judgment, so it
+ * lives here once rather than being decided twice.
+ */
+
+/**
+ * Bundlers emit lines in the thousands-to-hundreds-of-thousands of characters; the estate
+ * bundle that produced the false positive has a longest line of 266,226. Authored source
+ * does not reach 5,000 — the threshold sits an order of magnitude above the longest line
+ * any human writes and an order of magnitude below what minification produces, so it is a
+ * wide gap rather than a tuned one.
+ *
+ * NOT `>= 512KB`, which `anti-patterns.ts` already applies for a different reason (cost):
+ * that gate is about how much work a scan does, and a 300KB bundle sails through it while
+ * being exactly as unauthored as a 700KB one.
+ */
+const BUNDLED_LINE_LENGTH = 5000;
+
+/** True when `text` looks like build output rather than source someone edits. */
+export function looksBundled(text: string): boolean {
+  // Scan for a long line without splitting the whole file: a 700KB bundle would otherwise
+  // allocate an array of it, and this runs per file on every `meta verify` / `meta gen`.
+  let lineStart = 0;
+  for (let i = 0; i < text.length; i++) {
+    if (text.charCodeAt(i) !== 10 /* \n */) continue;
+    if (i - lineStart >= BUNDLED_LINE_LENGTH) return true;
+    lineStart = i + 1;
+  }
+  return text.length - lineStart >= BUNDLED_LINE_LENGTH;
+}

server/typescript/packages/cli/src/lib/base-url-advisory.ts

@@ -1,6 +1,7 @@
 import { readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { relPosix } from "./rel-posix.js";
+import { looksBundled } from "./authored-source.js";
 
 /**
  * F52 — a provider mounted with no `baseUrl` on a project whose `apiPrefix` is not empty.
@@ -155,6 +156,10 @@ function walk(dir: string, root: string, acc: BaseUrlFinding[], apiPrefix: strin
     let src: string;
     try { src = readFileSync(abs, "utf8"); } catch { continue; }
     if (!src.includes("EntityFetcher")) continue;
+    // A bundle is not authored source: the fix belongs in the file it was built FROM, and
+    // an estate whose output directory is `public/` proved that no ignore list guesses the
+    // name. See lib/authored-source.ts.
+    if (looksBundled(src)) continue;
     acc.push(...scanFile(relPosix(root, abs), src, apiPrefix));
   }
 }

server/typescript/packages/cli/test/anti-patterns.test.ts

@@ -367,3 +367,30 @@ describe("scanSourceForAntiPatterns — project-declared ignore globs", () => {
     }
   });
 });
+
+describe("build output is not authored source", () => {
+  const REDUCE = "const avg = ratings.reduce((acc, r) => acc + r.value, 0) / ratings.length;";
+
+  test("a bundle is not scanned, however small", () => {
+    // The existing 512KB gate is about COST — a 300KB minified file passes it and is just
+    // as unfixable, because the fix belongs in the source it was built from. Same rule the
+    // base-URL advisory applies, from the same module. Found on an estate whose build
+    // output is `public/`, a directory name no ignore list guesses.
+    const root = scaffold({ "public/main.js": `var a=1;${"b".repeat(6000)}\n${REDUCE}\n` });
+    try {
+      expect(scanSourceForAntiPatterns(root)).toEqual([]);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test("…and the same line in real source still IS reported", () => {
+    // Non-vacuous: identical content, minus the bundling.
+    const root = scaffold({ "public/main.js": `var a=1;\n${REDUCE}\n` });
+    try {
+      expect(scanSourceForAntiPatterns(root).length).toBeGreaterThan(0);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+});

server/typescript/packages/cli/test/base-url-advisory.test.ts

@@ -158,3 +158,25 @@ describe("scanForMissingBaseUrl — what is code and what is not", () => {
     expect(scanForMissingBaseUrl(root, "/api")).toHaveLength(1);
   });
 });
+
+describe("build output is not authored source", () => {
+  test("a bundle carrying the provider is not reported", async () => {
+    // Found on an estate whose build output is `public/` — a directory no ignore list
+    // guesses. `meta verify` named `public/main.js:243` while the SOURCE,
+    // `client/src/main.tsx`, passes baseUrl correctly: a finding in a file nobody edits,
+    // pointing away from the fix, on a project that had already done the right thing.
+    const root = await project({
+      "client/src/main.tsx": `<EntityFetcherProvider fetcher={fetcher} baseUrl="/api">`,
+      "public/main.js": `var a=1;${"b".repeat(6000)}\n<EntityFetcherProvider fetcher={f}>\n`,
+    });
+    expect(scanForMissingBaseUrl(root, "/api")).toEqual([]);
+  });
+
+  test("…and the same provider in real source still IS reported", async () => {
+    // The gate has to stay non-vacuous: it is the same file content, minus the bundling.
+    const root = await project({
+      "public/main.js": `var a=1;\n<EntityFetcherProvider fetcher={f}>\n`,
+    });
+    expect(scanForMissingBaseUrl(root, "/api")).toHaveLength(1);
+  });
+});

server/typescript/packages/cli/test/unit/authored-source.test.ts

@@ -0,0 +1,29 @@
+import { describe, test, expect } from "bun:test";
+import { looksBundled } from "../../src/lib/authored-source.js";
+
+describe("looksBundled", () => {
+  test("ordinary source is not bundled", () => {
+    expect(looksBundled(`export function f() {\n  return 1;\n}\n`)).toBe(false);
+  });
+
+  test("a long-but-human line is not bundled", () => {
+    // A 900-char line is unpleasant and entirely possible in hand-written code.
+    expect(looksBundled(`const x = "${"a".repeat(900)}";\n`)).toBe(false);
+  });
+
+  test("a minified line is bundled", () => {
+    expect(looksBundled(`var a=1;${"b".repeat(6000)}\n`)).toBe(true);
+  });
+
+  test("the long line is found anywhere in the file, not just first", () => {
+    expect(looksBundled(`// header\nconst a = 1;\n${"z".repeat(6000)}\nconst b = 2;\n`)).toBe(true);
+  });
+
+  test("a final line with no trailing newline still counts", () => {
+    expect(looksBundled(`// header\n${"z".repeat(6000)}`)).toBe(true);
+  });
+
+  test("an empty file is not bundled", () => {
+    expect(looksBundled("")).toBe(false);
+  });
+});