@0xcraft/powershot 1.0.0

package/dist/verifiers/phantom-config.js

@@ -0,0 +1,93 @@
+import { Node, SyntaxKind } from 'ts-morph';
+import { locate, relPath } from '#app/ground.js';
+/** `process.env.FOO` and `process.env['FOO']` */
+function envReads(sf) {
+    const out = [];
+    for (const access of sf.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression)) {
+        if (access.getExpression().getText() !== 'process.env')
+            continue;
+        const id = access.getNameNode();
+        out.push({ name: id.getText(), line: access.getStartLineNumber(), start: id.getStart(), width: id.getWidth() });
+    }
+    for (const access of sf.getDescendantsOfKind(SyntaxKind.ElementAccessExpression)) {
+        if (access.getExpression().getText() !== 'process.env')
+            continue;
+        const arg = access.getArgumentExpression();
+        if (!arg || !Node.isStringLiteral(arg))
+            continue;
+        out.push({
+            name: arg.getLiteralValue(),
+            line: access.getStartLineNumber(),
+            start: arg.getStart(),
+            width: arg.getWidth(),
+        });
+    }
+    return out;
+}
+/**
+ * Variables the platform sets, not the application.
+ *
+ * A terminal supplies COLUMNS, a CI runner supplies CI, the shell supplies HOME.
+ * None of them belong in an application's env manifest, and reporting them made the
+ * check accuse correct code of inventing configuration — measured on a whole-repo
+ * scan, every one of these was a false positive.
+ */
+const PLATFORM = new Set([
+    'CI', 'HOME', 'PATH', 'PWD', 'USER', 'SHELL', 'TERM', 'TMPDIR', 'TZ', 'LANG', 'LC_ALL',
+    'COLUMNS', 'LINES', 'FORCE_COLOR', 'NO_COLOR', 'CLICOLOR', 'CLICOLOR_FORCE', 'DEBUG',
+    'NODE_ENV', 'NODE_OPTIONS', 'NODE_DEBUG', 'NODE_EXTRA_CA_CERTS', 'npm_lifecycle_event',
+    'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'http_proxy', 'https_proxy', 'no_proxy',
+    'GITHUB_ACTIONS', 'GITHUB_TOKEN', 'GITHUB_OUTPUT', 'GITHUB_STEP_SUMMARY', 'RUNNER_OS',
+]);
+/** An environment variable the change reads that is declared nowhere. */
+export const phantomConfig = {
+    name: 'phantom-config',
+    needs: ['syntax'],
+    run(g) {
+        const manifest = g.envManifest;
+        if (!manifest)
+            return [];
+        // a key used elsewhere in the codebase is a documentation gap, not an invention
+        const usedElsewhere = new Set();
+        const changedPaths = new Set(g.changed.map((c) => c.path));
+        for (const sf of g.project.getSourceFiles()) {
+            const path = relPath(sf, g.root);
+            if (changedPaths.has(path) || path.includes('node_modules'))
+                continue;
+            for (const read of envReads(sf))
+                usedElsewhere.add(read.name);
+        }
+        const findings = [];
+        for (const { sf, changed } of g.files) {
+            for (const read of envReads(sf)) {
+                if (!changed.added.has(read.line))
+                    continue;
+                if (manifest.keys.has(read.name) || usedElsewhere.has(read.name))
+                    continue;
+                if (PLATFORM.has(read.name))
+                    continue;
+                findings.push({
+                    id: '',
+                    class: 'verified',
+                    check: 'phantom-config',
+                    severity: 'medium',
+                    // The manifest is not the process environment. What the oracle settles is
+                    // that nothing in the repository declares or uses this key — a deployment
+                    // can still set it, so "will be undefined" is an inference, not a fact.
+                    confidence: 'firm',
+                    file: relPath(sf, g.root),
+                    line: read.line,
+                    span: locate(sf, read.start, read.width).span,
+                    title: 'Reads process.env.' + read.name + ', which is not declared in ' + manifest.file + ' or used anywhere else',
+                    evidence: {
+                        oracle: manifest.file,
+                        detail: 'the key appears in no manifest entry and in no other source file',
+                    },
+                    fix: 'Add ' + read.name + ' to ' + manifest.file + ', or drop the reference if it was invented',
+                });
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=phantom-config.js.map

package/dist/verifiers/phantom-dep.js

@@ -0,0 +1,110 @@
+import { builtinModules } from 'node:module';
+import { SyntaxKind } from 'ts-morph';
+import { locate, relPath } from '#app/ground.js';
+const BUILTIN = new Set(builtinModules);
+/** `@scope/name/sub` -> `@scope/name`, `name/sub` -> `name` */
+function packageOf(specifier) {
+    const parts = specifier.split('/');
+    return specifier.startsWith('@') ? parts.slice(0, 2).join('/') : (parts[0] ?? specifier);
+}
+/**
+ * A URL-scheme specifier is not an npm manifest entry at all — Deno and Bun resolve
+ * `jsr:`, `npm:` and http imports themselves, so package.json can never declare them.
+ */
+const SCHEME = /^[a-z][a-z0-9+.-]*:/;
+/**
+ * `@/i18n` is not an npm package and never can be: a scoped name requires a scope,
+ * so an empty one (`@/`) is structurally invalid. Every repo that writes it means a
+ * local path alias, whichever tsconfig happens to declare it.
+ * A `#name` specifier is a private package import resolved through `package.json`.
+ */
+function isBare(specifier) {
+    if (specifier.startsWith('@/') || specifier.startsWith('#'))
+        return false;
+    return !specifier.startsWith('.') && !specifier.startsWith('/') && !SCHEME.test(specifier);
+}
+/**
+ * An import of a package that is not declared anywhere in the manifest.
+ * The manifest is the oracle, so this is proven — but only when we managed to
+ * read one, otherwise every import would look phantom.
+ */
+export const phantomDep = {
+    name: 'phantom-dep',
+    needs: ['syntax'],
+    run(g) {
+        const findings = [];
+        for (const { sf, changed } of g.files) {
+            const deps = g.depsFor(sf.getFilePath());
+            if (deps.size === 0)
+                continue; // no manifest governs this file — nothing to claim
+            // a specifier the compiler resolves to repo source is internal, whatever it
+            // looks like: a tsconfig alias, a workspace package, a path mapping
+            const internal = new Set();
+            for (const imp of sf.getImportDeclarations()) {
+                const resolved = imp.getModuleSpecifierSourceFile();
+                if (resolved && !resolved.getFilePath().includes('/node_modules/')) {
+                    internal.add(imp.getModuleSpecifierValue());
+                }
+            }
+            const specifiers = [];
+            for (const imp of sf.getImportDeclarations()) {
+                const node = imp.getModuleSpecifier();
+                specifiers.push({
+                    text: imp.getModuleSpecifierValue(),
+                    line: imp.getStartLineNumber(),
+                    span: locate(sf, node.getStart(), node.getWidth()).span,
+                });
+            }
+            for (const exp of sf.getExportDeclarations()) {
+                const value = exp.getModuleSpecifierValue();
+                const node = exp.getModuleSpecifier();
+                if (value && node) {
+                    specifiers.push({ text: value, line: exp.getStartLineNumber(), span: locate(sf, node.getStart(), node.getWidth()).span });
+                }
+            }
+            // require('x') and import('x')
+            for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+                const callee = call.getExpression().getText();
+                if (callee !== 'require' && callee !== 'import')
+                    continue;
+                const arg = call.getArguments()[0];
+                if (arg?.isKind(SyntaxKind.StringLiteral)) {
+                    specifiers.push({
+                        text: arg.getLiteralValue(),
+                        line: call.getStartLineNumber(),
+                        span: locate(sf, arg.getStart(), arg.getWidth()).span,
+                    });
+                }
+            }
+            for (const { text, line, span } of specifiers) {
+                if (!changed.added.has(line))
+                    continue;
+                if (!isBare(text))
+                    continue;
+                // a tsconfig path alias looks like a package and resolves to local source
+                if (g.internalPrefixes.some((prefix) => text.startsWith(prefix)))
+                    continue;
+                if (internal.has(text))
+                    continue;
+                const pkg = packageOf(text);
+                if (BUILTIN.has(pkg) || deps.has(pkg))
+                    continue;
+                findings.push({
+                    id: '',
+                    class: 'verified',
+                    check: 'phantom-dep',
+                    severity: 'high',
+                    confidence: 'proven',
+                    file: relPath(sf, g.root),
+                    line,
+                    span,
+                    title: 'Imports "' + pkg + '", which is not a declared dependency',
+                    evidence: { oracle: 'package.json', detail: 'not found in dependencies, devDependencies, peerDependencies, or optionalDependencies' },
+                    fix: 'npm install ' + pkg + ' — or remove the import if it was invented',
+                });
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=phantom-dep.js.map

package/dist/verifiers/reinvented.js

@@ -0,0 +1,74 @@
+import { SyntaxKind } from 'ts-morph';
+import { locate, normalizeName, relPath } from '#app/ground.js';
+/**
+ * Names too generic to mean anything across files — two `render`s are usually
+ * two different things, not a duplication.
+ */
+const TEST_FILE = /(^|\/)(tests?|spec|__tests__)\/|\.(test|spec)\.[cm]?[jt]sx?$/;
+const GENERIC = new Set([
+    'render', 'index', 'main', 'run', 'get', 'set', 'init', 'setup', 'start', 'stop',
+    'handler', 'handle', 'create', 'update', 'remove', 'delete', 'list', 'find',
+    'parse', 'format', 'load', 'save', 'toString', 'default', 'config', 'options',
+]);
+function declaredNames(sf) {
+    const out = [];
+    for (const fn of sf.getFunctions()) {
+        const name = fn.getName();
+        const id = fn.getNameNode();
+        if (name && id)
+            out.push({ name, line: fn.getStartLineNumber(), span: locate(sf, id.getStart(), id.getWidth()).span });
+    }
+    for (const v of sf.getVariableDeclarations()) {
+        const init = v.getInitializer();
+        if (!init)
+            continue;
+        if (init.isKind(SyntaxKind.ArrowFunction) || init.isKind(SyntaxKind.FunctionExpression)) {
+            const id = v.getNameNode();
+            out.push({ name: v.getName(), line: v.getStartLineNumber(), span: locate(sf, id.getStart(), id.getWidth()).span });
+        }
+    }
+    return out;
+}
+/** A helper the change introduces that already exists elsewhere in the repo. */
+export const reinvented = {
+    name: 'reinvented',
+    needs: ['syntax'],
+    run(g) {
+        const findings = [];
+        for (const { sf, changed } of g.files) {
+            const file = relPath(sf, g.root);
+            // a fixture builder repeated across test files is a deliberate trade, and two
+            // tests describing the same scenario naturally share a name
+            if (TEST_FILE.test(file))
+                continue;
+            for (const { name, line, span } of declaredNames(sf)) {
+                if (!changed.added.has(line))
+                    continue;
+                if (name.length < 6 || GENERIC.has(name) || GENERIC.has(name.toLowerCase()))
+                    continue;
+                const existing = (g.symbolIndex.get(normalizeName(name)) ?? []).filter((s) => s.file !== file);
+                const match = existing[0];
+                if (!match)
+                    continue;
+                findings.push({
+                    id: '',
+                    class: 'verified',
+                    check: 'reinvented',
+                    severity: 'medium',
+                    confidence: 'firm',
+                    file,
+                    line,
+                    span,
+                    title: name + '() duplicates an existing export ' + match.file + ':' + match.name,
+                    evidence: { oracle: 'repo symbol index', detail: 'already exported from ' + match.file + ':' + match.line },
+                    // Deliberately not an import statement: the correct specifier depends on the
+                    // repo's module resolution, and a wrong one would be exactly the kind of
+                    // confidently-wrong output this tool exists to catch.
+                    fix: 'Reuse ' + match.name + ' from ' + match.file + ' instead of redeclaring it',
+                });
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=reinvented.js.map

package/dist/verifiers/scope-creep.js

@@ -0,0 +1,77 @@
+import { ts } from 'ts-morph';
+import { relPath } from '#app/ground.js';
+/**
+ * The token stream a compiler would see: whitespace and comments dropped, everything
+ * that changes behaviour kept. Two files with the same stream are the same program.
+ */
+function tokens(code) {
+    const scanner = ts.createScanner(ts.ScriptTarget.Latest, /* skipTrivia */ true, ts.LanguageVariant.Standard, code);
+    const out = [];
+    let token = scanner.scan();
+    for (let i = 0; token !== ts.SyntaxKind.EndOfFileToken && i < 200_000; i++) {
+        out.push(token + ':' + scanner.getTokenText());
+        token = scanner.scan();
+    }
+    return out;
+}
+/** Comment text only, to tell a comment-only edit from pure reformatting. */
+function comments(code) {
+    const scanner = ts.createScanner(ts.ScriptTarget.Latest, /* skipTrivia */ false, ts.LanguageVariant.Standard, code);
+    const out = [];
+    let token = scanner.scan();
+    for (let i = 0; token !== ts.SyntaxKind.EndOfFileToken && i < 200_000; i++) {
+        if (token === ts.SyntaxKind.SingleLineCommentTrivia || token === ts.SyntaxKind.MultiLineCommentTrivia) {
+            out.push(scanner.getTokenText().trim());
+        }
+        token = scanner.scan();
+    }
+    return out;
+}
+function same(a, b) {
+    return a.length === b.length && a.every((v, i) => v === b[i]);
+}
+/** A file the change touches without changing the program. */
+export const scopeCreep = {
+    name: 'scope-creep',
+    needs: ['syntax', 'base'],
+    run(g) {
+        const findings = [];
+        for (const { sf, before } of g.files) {
+            if (!before)
+                continue; // a new file always adds something
+            const afterText = sf.getFullText();
+            const beforeText = before.getFullText();
+            if (afterText === beforeText)
+                continue; // not actually touched
+            if (!same(tokens(beforeText), tokens(afterText)))
+                continue; // the program did change
+            const commentsChanged = !same(comments(beforeText), comments(afterText));
+            // Documentation is content. A change to JSDoc is API documentation someone
+            // meant to write, and telling them to drop it from the change is wrong advice,
+            // so only incidental comments and pure layout churn are reported. The same rule
+            // applies in the tree-sitter implementation — one idea, one behaviour.
+            if (commentsChanged && comments(afterText).some((c) => c.startsWith('/**')))
+                continue;
+            const what = commentsChanged ? 'only comments' : 'only formatting';
+            findings.push({
+                id: '',
+                class: 'verified',
+                check: 'scope-creep',
+                severity: 'low',
+                confidence: 'proven',
+                file: relPath(sf, g.root),
+                line: 1,
+                title: 'This file changes ' + what + ' — the program it produces is identical',
+                evidence: {
+                    oracle: 'token stream',
+                    detail: 'before and after tokenize identically once whitespace and comments are dropped',
+                },
+                fix: commentsChanged
+                    ? 'Keep it if the comments are the point; otherwise drop the file from the change'
+                    : 'Revert the reformatting so the diff shows the actual change',
+            });
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=scope-creep.js.map

package/dist/verifiers/swallowed-error.js

@@ -0,0 +1,110 @@
+import { Node, SyntaxKind } from 'ts-morph';
+import { locate, relPath } from '#app/ground.js';
+/** console.error / logger.warn / log.info — a call that records and returns */
+const LOGGER = /^(console|logger|log)\s*\./;
+/** A catch body that only logs has recorded the failure and carried on regardless. */
+function isLogOnly(statements) {
+    if (statements.length === 0)
+        return false;
+    return statements.every((s) => {
+        if (!Node.isExpressionStatement(s))
+            return false;
+        let expr = s.getExpression();
+        if (Node.isAwaitExpression(expr))
+            expr = expr.getExpression();
+        if (!Node.isCallExpression(expr))
+            return false;
+        return LOGGER.test(expr.getExpression().getText());
+    });
+}
+/**
+ * A comment inside an otherwise empty block is the author saying "I meant this".
+ * Deliberate silence is not a defect, so respect the signal.
+ */
+function hasComment(text) {
+    return /\/\/|\/\*/.test(text);
+}
+/** Error handling that looks defensive and defends nothing. */
+export const swallowedError = {
+    name: 'swallowed-error',
+    needs: ['syntax'],
+    run(g) {
+        const findings = [];
+        for (const { sf, changed } of g.files) {
+            const file = relPath(sf, g.root);
+            for (const clause of sf.getDescendantsOfKind(SyntaxKind.CatchClause)) {
+                const line = clause.getStartLineNumber();
+                if (!changed.added.has(line))
+                    continue;
+                const block = clause.getBlock();
+                const statements = block.getStatements();
+                const span = locate(sf, block.getStart(), block.getWidth()).span;
+                if (statements.length === 0) {
+                    if (hasComment(block.getFullText()))
+                        continue;
+                    findings.push({
+                        id: '',
+                        class: 'verified',
+                        check: 'swallowed-error',
+                        severity: 'high',
+                        confidence: 'proven',
+                        file,
+                        line,
+                        span,
+                        title: 'Empty catch block — the failure is discarded and the caller is told it succeeded',
+                        evidence: { oracle: 'AST', detail: 'catch body contains no statements' },
+                        fix: 'Rethrow, return a typed failure, or add a comment saying why it is safe to ignore',
+                    });
+                    continue;
+                }
+                if (isLogOnly(statements)) {
+                    findings.push({
+                        id: '',
+                        class: 'verified',
+                        check: 'swallowed-error',
+                        severity: 'medium',
+                        confidence: 'firm',
+                        file,
+                        line,
+                        span,
+                        title: 'Catch only logs — execution continues as if the operation had succeeded',
+                        evidence: { oracle: 'AST', detail: 'catch body contains logging calls and nothing else: no rethrow, no return, no recovery' },
+                        fix: 'Rethrow after logging, or return a value that tells the caller it failed',
+                    });
+                }
+            }
+            // .catch(() => {}) — the promise-chain spelling of the same defect
+            for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+                const callee = call.getExpression();
+                if (!Node.isPropertyAccessExpression(callee) || callee.getName() !== 'catch')
+                    continue;
+                const line = call.getStartLineNumber();
+                if (!changed.added.has(line))
+                    continue;
+                const handler = call.getArguments()[0];
+                if (!handler || !(Node.isArrowFunction(handler) || Node.isFunctionExpression(handler)))
+                    continue;
+                const body = handler.getBody();
+                if (!Node.isBlock(body) || body.getStatements().length > 0)
+                    continue;
+                if (hasComment(body.getFullText()))
+                    continue;
+                findings.push({
+                    id: '',
+                    class: 'verified',
+                    check: 'swallowed-error',
+                    severity: 'high',
+                    confidence: 'proven',
+                    file,
+                    line,
+                    span: locate(sf, handler.getStart(), handler.getWidth()).span,
+                    title: 'Empty .catch() — the rejection is discarded and the chain resolves as success',
+                    evidence: { oracle: 'AST', detail: 'catch handler body contains no statements' },
+                    fix: 'Handle the rejection, or drop the .catch() so it propagates',
+                });
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=swallowed-error.js.map

package/dist/verifiers/vacuous-test.js

@@ -0,0 +1,138 @@
+import { SyntaxKind } from 'ts-morph';
+import { locate, relPath } from '#app/ground.js';
+const TEST_FILE = /(\.(test|spec)\.[cm]?[jt]sx?$)|(__tests__\/)/;
+const TEST_FN = /^(it|test)(\.(only|each|concurrent))?$/;
+/** assertion styles across jest / vitest / node:test / chai / ava */
+const ASSERTION = /^(expect|assert|assert\.\w+|t\.\w+|chai\.\w+|should)/;
+/**
+ * End-to-end suites put their assertions in page objects, so the test body calls
+ * `page.verifySomething()` and contains no `expect` of its own. A method named for
+ * checking is an assertion by intent, and treating it otherwise reported four
+ * perfectly good Playwright tests on a real repository.
+ */
+const DELEGATED_ASSERTION = /(^|\.)(verify|assert|expect|should|check|confirm)[A-Z_]/;
+function isTestFile(path) {
+    return TEST_FILE.test(path);
+}
+/** `src/a/useThing.test.ts` -> `useThing`: what this file claims to be testing. */
+function subjectOf(testPath) {
+    const base = testPath.split('/').pop() ?? '';
+    const match = /^(.+?)\.(test|spec)\.[cm]?[jt]sx?$/.exec(base);
+    return match?.[1];
+}
+/** `../../services/itsmScraper` -> `itsmScraper` */
+function moduleBase(specifier) {
+    return (specifier.split('/').pop() ?? specifier).replace(/\.[cm]?[jt]sx?$/, '');
+}
+function assertsSomething(body) {
+    for (const call of body.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+        const text = call.getExpression().getText();
+        if (ASSERTION.test(text) || DELEGATED_ASSERTION.test(text))
+            return true;
+        // fluent styles: expect(x).toBe(y) is caught above; value.should.equal(y) is not
+        if (/\.should\b/.test(text))
+            return true;
+    }
+    return false;
+}
+/**
+ * Module specifiers passed to jest.mock / vi.mock, with where each one sits so the
+ * caret can mark the string itself.
+ */
+function mockedModules(sf) {
+    const out = new Map();
+    for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+        const callee = call.getExpression().getText();
+        if (callee !== 'jest.mock' && callee !== 'vi.mock' && callee !== 'mock.module')
+            continue;
+        const arg = call.getArguments()[0];
+        if (arg?.isKind(SyntaxKind.StringLiteral)) {
+            out.set(arg.getLiteralValue(), {
+                line: call.getStartLineNumber(),
+                span: locate(sf, arg.getStart(), arg.getWidth()).span,
+            });
+        }
+    }
+    return out;
+}
+/**
+ * Two ways a test can look like proof and be none:
+ * 1. it runs code and asserts nothing
+ * 2. it mocks the very module it imports its subject from, so it asserts on the mock
+ */
+export const vacuousTest = {
+    name: 'vacuous-test',
+    needs: ['syntax'],
+    run(g) {
+        const findings = [];
+        for (const { sf, changed } of g.files) {
+            const file = relPath(sf, g.root);
+            if (!isTestFile(file))
+                continue;
+            for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+                if (!TEST_FN.test(call.getExpression().getText()))
+                    continue;
+                const line = call.getStartLineNumber();
+                if (!changed.added.has(line))
+                    continue;
+                const body = call.getArguments()[1];
+                if (!body)
+                    continue; // it('todo') with no callback is a placeholder, not a lie
+                const block = body.getFirstDescendantByKind(SyntaxKind.Block) ?? body;
+                if (block.getDescendantsOfKind(SyntaxKind.CallExpression).length === 0)
+                    continue; // empty body
+                if (!assertsSomething(block)) {
+                    const title = call.getArguments()[0]?.getText() ?? 'test';
+                    findings.push({
+                        id: '',
+                        class: 'verified',
+                        check: 'vacuous-test',
+                        severity: 'high',
+                        confidence: 'proven',
+                        file,
+                        line,
+                        span: locate(sf, call.getExpression().getStart(), call.getExpression().getWidth()).span,
+                        title: 'Test ' + title + ' runs code but asserts nothing',
+                        evidence: { oracle: 'test AST', detail: 'no expect/assert call anywhere in the test body' },
+                    });
+                }
+            }
+            // Mocking the unit under test — not merely mocking a dependency, which is
+            // ordinary practice. The subject is the module the test file is named after:
+            // useItsmScraping.test.ts tests useItsmScraping, so mocking @lakeside/ui-sdk
+            // there is a stubbed collaborator, not a self-mocking test.
+            const subjectName = subjectOf(file);
+            if (!subjectName)
+                continue;
+            const mocked = mockedModules(sf);
+            if (mocked.size === 0)
+                continue;
+            for (const imp of sf.getImportDeclarations()) {
+                const spec = imp.getModuleSpecifierValue();
+                const mock = mocked.get(spec);
+                if (mock === undefined)
+                    continue;
+                if (moduleBase(spec) !== subjectName)
+                    continue;
+                const names = imp.getNamedImports().map((n) => n.getName());
+                const subject = names[0] ?? imp.getDefaultImport()?.getText();
+                if (!subject)
+                    continue;
+                findings.push({
+                    id: '',
+                    class: 'verified',
+                    check: 'vacuous-test',
+                    severity: 'high',
+                    confidence: 'proven',
+                    file,
+                    line: mock.line,
+                    span: mock.span,
+                    title: 'Test mocks "' + spec + '", the module it imports ' + subject + ' from — it asserts on the mock',
+                    evidence: { oracle: 'test AST', detail: 'the mocked specifier is also the import source of the unit under test' },
+                });
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=vacuous-test.js.map