@dokebi/cli 0.4.2 → 0.4.26

package/dist/check/browser-sources.js

@@ -0,0 +1,89 @@
+// Browser code for `dokebi check` (D-0120): the `<script>` and `<script setup>` blocks of the
+// project's .vue files and the .js/.mjs files under a views/ folder are not in the tsconfig
+// program (it includes src/**/*.ts), so empty-catch, missing-cause and floating-promise never saw
+// them. Each such file becomes a virtual source next to the original (`<file>.dokebi-check.ts` or
+// `.js`), which typescript.ts serves to tsgo through its virtual file system in a second project:
+// relative imports resolve from the same folder and the checker gives real types. A .vue file
+// keeps its length and its newlines, everything outside the script blocks blanked to spaces, so a
+// line and column of the virtual source are those of the .vue file and the
+// `// dokebi-check: allow …` markers in the script work as in TypeScript.
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { debug } from '../diagnostics.js';
+import { sources } from './form-rules.js';
+/** The suffix of a virtual source; never a real file and never what an import resolves to. */
+export const VIRTUAL_SUFFIX = '.dokebi-check';
+/** Files larger than this are not read (generated bundles), as in form-rules.ts. */
+const MAX_BYTES = 1024 * 1024;
+const BROWSER = /\.(?:vue|js|mjs)$/;
+const SCRIPT = /<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi;
+const LANG = /\blang\s*=\s*(["']?)([a-z]+)\1/i;
+/**
+ * The script of a .vue file as one TypeScript or JavaScript text of the same length: the
+ * template, the styles and the tags blanked (newlines kept). Undefined without a script block.
+ */
+export function vueScript(text) {
+    const out = text.replace(/[^\n]/g, ' ').split('');
+    let found = false;
+    let typescript = false;
+    for (const match of text.matchAll(SCRIPT)) {
+        const attributes = match[1] ?? '';
+        const body = match[2] ?? '';
+        // <script src="…"> loads another file; its body (if any) is not run.
+        if (/\bsrc\s*=/.test(attributes) || !body.trim())
+            continue;
+        const lang = LANG.exec(attributes)?.[2]?.toLowerCase();
+        if (lang === 'ts' || lang === 'tsx')
+            typescript = true;
+        else if (lang !== undefined && lang !== 'js' && lang !== 'jsx')
+            continue;
+        found = true;
+        const start = (match.index ?? 0) + (match[0].indexOf('>') + 1);
+        for (let index = 0; index < body.length; index++)
+            out[start + index] = body[index];
+    }
+    return found ? { text: out.join(''), typescript } : undefined;
+}
+/** The virtual source of one file (project-relative `path`), or undefined when there is none. */
+export function browserSource(root, path, text) {
+    const absolute = join(root, path);
+    if (path.endsWith('.vue')) {
+        const script = vueScript(text);
+        if (!script)
+            return undefined;
+        return {
+            path,
+            fileName: `${absolute}${VIRTUAL_SUFFIX}.${script.typescript ? 'ts' : 'js'}`,
+            text: script.text,
+        };
+    }
+    return { path, fileName: `${absolute}${VIRTUAL_SUFFIX}.js`, text };
+}
+/** Is `path` (project-relative) browser code check reads: a .vue file, or .js/.mjs in views/? */
+export function isBrowserPath(path) {
+    if (!BROWSER.test(path))
+        return false;
+    return path.endsWith('.vue') || /(?:^|\/)views\//.test(path);
+}
+/**
+ * The browser code under `directory` (default `src/`) of a project: .vue files and the .js/.mjs
+ * under views/ (node_modules, dist, .vite, .git and the .tmp scratch folder are not walked).
+ */
+export async function browserSources(root, skip = () => false, directory = 'src') {
+    const found = [];
+    let large = 0;
+    for (const path of await sources(root, directory, BROWSER)) {
+        if (!isBrowserPath(path) || skip(path))
+            continue;
+        const text = await readFile(join(root, path), 'utf8');
+        if (text.length > MAX_BYTES) {
+            large++;
+            continue;
+        }
+        const source = browserSource(root, path, text);
+        if (source)
+            found.push(source);
+    }
+    debug('check: browser sources', { files: found.length, skippedLarge: large });
+    return found;
+}

package/dist/check/console-rules.d.ts

@@ -0,0 +1,6 @@
+import { type Kinds, type TsNode, type TsSourceFile } from './typescript.js';
+export type Report = (node: TsNode, message: string, fix: string) => void;
+export declare const CONSOLE_FIX = "log through the Dokebi logger instead: context.logger.log('info', 'Fixed message', { code: 'MY_CODE', \u2026 }) in a plugin or module hook, app.logger in src/main.ts (levels, redaction and every target apply); for a command line tool that prints results, write // dokebi-check: allow console-output <reason> before its first statement";
+/** `console.x`, `globalThis.console.x`, `process.stdout.write`, `process.stderr.write`. */
+export declare function consoleTarget(file: TsSourceFile, callee: TsNode): string | undefined;
+export declare function consoleRules(file: TsSourceFile, kinds: Kinds, report: Report): void;

package/dist/check/console-rules.js

@@ -0,0 +1,40 @@
+// The console rule of `dokebi check` (D-0151 §13), over the TypeScript AST:
+//   console-output  (warning) server code under src/ (not views/, not tests/) that writes records
+//                   past the app logger: console.log/info/warn/error/debug/trace and
+//                   process.stdout.write / process.stderr.write. Those lines skip the logger's
+//                   level, redaction (password, token, cookie …), targets (rotated files) and
+//                   the JSON line `dokebi logs` and log collectors read. Use the logger the
+//                   plugin context or the app hands out instead.
+// A `// dokebi-check: allow console-output <reason>` comment on or above the line keeps a
+// deliberate one; the same comment before the first statement of a file covers the whole file
+// (a command line tool that prints its results). The framework's own sources pass the same rule
+// as a gate (scripts/testing/check-console.mjs), where it is an error.
+import { field } from './typescript.js';
+const CONSOLE_METHODS = new Set(['log', 'info', 'warn', 'error', 'debug', 'trace']);
+export const CONSOLE_FIX = "log through the Dokebi logger instead: context.logger.log('info', 'Fixed message', { code: 'MY_CODE', … }) in a plugin or module hook, app.logger in src/main.ts (levels, redaction and every target apply); for a command line tool that prints results, write // dokebi-check: allow console-output <reason> before its first statement";
+/** `console.x`, `globalThis.console.x`, `process.stdout.write`, `process.stderr.write`. */
+export function consoleTarget(file, callee) {
+    const text = file.text.slice(callee.getStart(), callee.end).replace(/\s+/g, '');
+    const match = /^(?:globalThis\.)?console\.([a-z]+)$/.exec(text);
+    if (match && CONSOLE_METHODS.has(match[1]))
+        return text;
+    return /^(?:globalThis\.)?process\.(?:stdout|stderr)\.write$/.test(text) ? text : undefined;
+}
+export function consoleRules(file, kinds, report) {
+    // Most files print nothing: skip the walk.
+    if (!/\bconsole\s*\.|\bprocess\s*\.\s*std(?:out|err)\b/.test(file.text))
+        return;
+    const visit = (node) => {
+        if (node.kind === kinds.CallExpression) {
+            const callee = field(node, 'expression');
+            if (callee?.kind === kinds.PropertyAccessExpression) {
+                const target = consoleTarget(file, callee);
+                if (target)
+                    report(node, `${target}() writes past the app logger: no level, no redaction of secrets, not in the log files or the JSON lines dokebi logs reads (D-0151)`, CONSOLE_FIX);
+            }
+        }
+        node.forEachChild(visit);
+        return undefined;
+    };
+    file.forEachChild(visit);
+}

package/dist/check/error-rules.d.ts

@@ -0,0 +1,21 @@
+import { type Kinds, type TsNode, type TsSourceFile } from './typescript.js';
+/** Where the app's error codes are declared (D-0077 D). */
+export declare const ERRORS_FILE = "src/shared/errors.ts";
+/** Codes of the framework's own answers: an app may throw or send them without listing them. */
+export declare const FRAMEWORK_CODES: ReadonlySet<string>;
+/** The declared list: the codes and the name the file exports it under. */
+export interface ErrorList {
+    readonly codes: ReadonlySet<string>;
+    /** `errors` for `export const errors = defineErrors(…)`, `default` for a default export. */
+    readonly exportName: string;
+}
+export type Report = (node: TsNode, message: string, fix: string) => void;
+/**
+ * The list declared in src/shared/errors.ts: `export const errors = defineErrors({ … })`,
+ * `export default defineErrors({ … })`, or a top-level const exported with `export { errors }`.
+ * undefined when the file exports none, or its object is not a plain literal (spread, computed).
+ */
+export declare function readErrorList(file: TsSourceFile, kinds: Kinds): ErrorList | undefined;
+/** Whether the rule reads this project file. */
+export declare function isAppCode(path: string): boolean;
+export declare function errorCodeRules(file: TsSourceFile, path: string, kinds: Kinds, list: ErrorList, report: Report): void;

package/dist/check/error-rules.js

@@ -0,0 +1,212 @@
+// The error code rule of `dokebi check` (D-0077 D), on only in a project whose
+// `src/shared/errors.ts` exports a `defineErrors({ … })` result written as an object literal:
+//   unknown-error-code  (warning) app code (src/apps, src/shared/modules, src/shared/services) that writes an error
+//                       code as a string instead of `errors.CODE()`: `new DokebiError('CODE', …)`,
+//                       `Object.assign(new Error(…), { code: 'CODE' })`, `throw { code: 'CODE' }`
+//                       and a `.send({ error: 'CODE' })` body. A code missing from the list is
+//                       reported as unknown, a listed one as written by hand (its status,
+//                       message and hint live in the list). Codes dokebi-web and the auth and
+//                       csrf plugins answer with themselves (VALIDATION_FAILED, NOT_FOUND,
+//                       UNAUTHENTICATED, FORBIDDEN, …) are fine.
+// The list is read from the file's AST, never by importing it: a spread or a computed key makes
+// the list unknowable and turns the rule off for the project.
+import { posix } from 'node:path';
+import { debug } from '../diagnostics.js';
+import { field, nodes, property, } from './typescript.js';
+/** Where the app's error codes are declared (D-0077 D). */
+export const ERRORS_FILE = 'src/shared/errors.ts';
+/** A stable error code (D-0063). */
+const CODE = /^[A-Z][A-Z0-9_]{0,63}$/;
+/** Codes of the framework's own answers: an app may throw or send them without listing them. */
+export const FRAMEWORK_CODES = new Set([
+    'VALIDATION_FAILED',
+    'NOT_FOUND',
+    'INVALID_REQUEST',
+    'INTERNAL_SERVER_ERROR',
+    'UNAUTHENTICATED',
+    'FORBIDDEN',
+    'CSRF_FAILED',
+]);
+/** Folders of app code (D-0031, D-0032): the rule reads only these. */
+const APP_CODE = /^src\/(apps|shared\/(modules|services))\//;
+const text = (node) => node === undefined ? undefined : String(property(node, 'text'));
+/** True when `node` is a `defineErrors(…)` or `x.defineErrors(…)` call. */
+function defineCall(node, kinds) {
+    if (node?.kind !== kinds.CallExpression)
+        return false;
+    const callee = field(node, 'expression');
+    if (callee?.kind === kinds.Identifier)
+        return text(callee) === 'defineErrors';
+    return (callee?.kind === kinds.PropertyAccessExpression &&
+        text(field(callee, 'name')) === 'defineErrors');
+}
+/** The codes of the object literal given to defineErrors, or undefined when not knowable. */
+function literalCodes(call, kinds) {
+    const argument = nodes(call, 'arguments')[0];
+    if (argument?.kind !== kinds.ObjectLiteralExpression)
+        return undefined;
+    const codes = new Set();
+    for (const item of nodes(argument, 'properties')) {
+        const name = field(item, 'name');
+        if (item.kind !== kinds.PropertyAssignment ||
+            !name ||
+            (name.kind !== kinds.Identifier && name.kind !== kinds.StringLiteral))
+            return undefined;
+        codes.add(text(name));
+    }
+    return codes;
+}
+/**
+ * The list declared in src/shared/errors.ts: `export const errors = defineErrors({ … })`,
+ * `export default defineErrors({ … })`, or a top-level const exported with `export { errors }`.
+ * undefined when the file exports none, or its object is not a plain literal (spread, computed).
+ */
+export function readErrorList(file, kinds) {
+    const local = new Map();
+    const exported = [];
+    const named = [];
+    for (const statement of nodes(file, 'statements')) {
+        if (statement.kind === kinds.VariableStatement) {
+            const isExported = nodes(statement, 'modifiers').some((modifier) => modifier.kind === kinds.ExportKeyword);
+            const list = field(statement, 'declarationList');
+            for (const declaration of list ? nodes(list, 'declarations') : []) {
+                const name = field(declaration, 'name');
+                const initializer = field(declaration, 'initializer');
+                if (name?.kind !== kinds.Identifier || !defineCall(initializer, kinds))
+                    continue;
+                if (isExported)
+                    exported.push({ name: text(name), call: initializer });
+                else
+                    local.set(text(name), initializer);
+            }
+        }
+        else if (statement.kind === kinds.ExportAssignment) {
+            const expression = field(statement, 'expression');
+            if (property(statement, 'isExportEquals') !== true && defineCall(expression, kinds))
+                exported.push({ name: 'default', call: expression });
+        }
+        else if (statement.kind === kinds.ExportDeclaration && !field(statement, 'moduleSpecifier')) {
+            const clause = field(statement, 'exportClause');
+            for (const element of clause ? nodes(clause, 'elements') : [])
+                named.push({
+                    local: text(field(element, 'propertyName') ?? field(element, 'name')) ?? '',
+                    name: text(field(element, 'name')) ?? '',
+                });
+        }
+    }
+    for (const item of named) {
+        const call = local.get(item.local);
+        if (call)
+            exported.push({ name: item.name, call });
+    }
+    if (exported.length === 0)
+        return undefined;
+    const codes = new Set();
+    for (const item of exported) {
+        const found = literalCodes(item.call, kinds);
+        if (!found) {
+            debug('check: error list not readable', { file: ERRORS_FILE, export: item.name });
+            return undefined;
+        }
+        for (const code of found)
+            codes.add(code);
+    }
+    const first = exported[0];
+    debug('check: error list read', { file: ERRORS_FILE, codes: codes.size, export: first.name });
+    return { codes, exportName: first.name };
+}
+/** Whether the rule reads this project file. */
+export function isAppCode(path) {
+    return APP_CODE.test(path);
+}
+export function errorCodeRules(file, path, kinds, list, report) {
+    const source = file.text;
+    const snippet = (node) => {
+        const value = source.slice(node.getStart(), node.end).replace(/\s+/g, ' ');
+        return value.length > 60 ? `${value.slice(0, 59)}…` : value;
+    };
+    const literal = (node) => node && (node.kind === kinds.StringLiteral || node.kind === kinds.NoSubstitutionTemplateLiteral)
+        ? String(property(node, 'text'))
+        : undefined;
+    /** The string value of property `key` in an object literal. */
+    const propertyValue = (object, key) => {
+        if (object?.kind !== kinds.ObjectLiteralExpression)
+            return undefined;
+        for (const item of nodes(object, 'properties')) {
+            if (item.kind !== kinds.PropertyAssignment)
+                continue;
+            const name = field(item, 'name');
+            if (name &&
+                (name.kind === kinds.Identifier || name.kind === kinds.StringLiteral) &&
+                text(name) === key) {
+                const value = field(item, 'initializer');
+                return literal(value) === undefined ? undefined : value;
+            }
+        }
+        return undefined;
+    };
+    let importPath = posix.relative(posix.dirname(path), ERRORS_FILE);
+    if (!importPath.startsWith('.'))
+        importPath = `./${importPath}`;
+    const binding = list.exportName === 'default'
+        ? `import errors from '${importPath}'`
+        : `import { ${list.exportName} } from '${importPath}'`;
+    const factory = list.exportName === 'default' ? 'errors' : list.exportName;
+    const declared = [...list.codes];
+    const some = declared.slice(0, 5).join(', ') + (declared.length > 5 ? ', …' : '');
+    /** Reports the code at `node` when it is not a framework code. */
+    const judge = (node, at) => {
+        const code = literal(node);
+        if (code === undefined || !CODE.test(code) || FRAMEWORK_CODES.has(code))
+            return;
+        if (list.codes.has(code))
+            report(at, `${snippet(at)} writes the error code ${code} by hand; the list in ${ERRORS_FILE} declares it with its status, message and hint`, `throw ${factory}.${code}() (${binding}); pass { data } for values the client needs`);
+        else
+            report(at, `${snippet(at)} uses the error code ${code}, which ${ERRORS_FILE} does not declare: clients and tools only know the codes of the list`, `add ${code}: { status, message } to defineErrors in ${ERRORS_FILE} and throw ${factory}.${code}() (${binding}), or use a declared code (${some}); refused fields use validationError() from @dokebi/web. A deliberate case takes // dokebi-check: allow unknown-error-code <reason>`);
+    };
+    const isObjectAssign = (call) => {
+        const callee = field(call, 'expression');
+        return (callee?.kind === kinds.PropertyAccessExpression &&
+            text(field(callee, 'name')) === 'assign' &&
+            field(callee, 'expression')?.kind === kinds.Identifier &&
+            text(field(callee, 'expression')) === 'Object');
+    };
+    const visit = (node) => {
+        if (node.kind === kinds.NewExpression) {
+            const callee = field(node, 'expression');
+            const name = callee?.kind === kinds.Identifier
+                ? text(callee)
+                : callee?.kind === kinds.PropertyAccessExpression
+                    ? text(field(callee, 'name'))
+                    : undefined;
+            const first = nodes(node, 'arguments')[0];
+            if (name === 'DokebiError' && first)
+                judge(first, node);
+        }
+        else if (node.kind === kinds.CallExpression) {
+            const args = nodes(node, 'arguments');
+            const callee = field(node, 'expression');
+            if (isObjectAssign(node) && args[0]?.kind === kinds.NewExpression) {
+                for (const item of args.slice(1)) {
+                    const value = propertyValue(item, 'code');
+                    if (value)
+                        judge(value, node);
+                }
+            }
+            else if (callee?.kind === kinds.PropertyAccessExpression &&
+                text(field(callee, 'name')) === 'send') {
+                const value = propertyValue(args[0], 'error');
+                if (value)
+                    judge(value, node);
+            }
+        }
+        else if (node.kind === kinds.ThrowStatement) {
+            const value = propertyValue(field(node, 'expression'), 'code');
+            if (value)
+                judge(value, node);
+        }
+        node.forEachChild(visit);
+        return undefined;
+    };
+    file.forEachChild(visit);
+}

package/dist/check/form-rules.d.ts

@@ -6,8 +6,20 @@ import type { Problem } from './problems.js';
 export declare function maskCode(text: string): string;
 /** The problems of one file's text (the path is project-relative, with `/`). */
 export declare function inertiaFormProblems(path: string, text: string): Problem[];
+/**
+ * Every source file (or file matching `pattern`) under `directory` (`.`: the whole root),
+ * root-relative with `/`.
+ */
+export declare function sources(root: string, directory?: string, pattern?: RegExp): Promise<string[]>;
 /** The form rule over the project's `src/` (D-0074). */
 export declare function formProblems(root: string, skip: (path: string) => boolean): Promise<{
     problems: Problem[];
     files: number;
 }>;
+/** The CSRF problems of one EJS file's text (the path is project-relative, with `/`). */
+export declare function csrfFormProblems(path: string, text: string): Problem[];
+/** The CSRF form rule over the EJS views under `src/` (only with @dokebi/csrf installed). */
+export declare function csrfFormsProblems(root: string): Promise<{
+    problems: Problem[];
+    files: number;
+}>;

package/dist/check/form-rules.js

@@ -16,7 +16,8 @@ import { debug } from '../diagnostics.js';
 import { readMarkers } from './source-rules.js';
 const RULE = 'inertia-form-only';
 const SOURCE = /\.(?:vue|svelte|ts|tsx|js|jsx|mjs)$/;
-const SKIP_DIRECTORIES = new Set(['node_modules', 'dist', '.vite', '.git']);
+const EJS = /\.ejs$/;
+const SKIP_DIRECTORIES = new Set(['node_modules', 'dist', '.vite', '.git', '.tmp']);
 /** Files larger than this are not read (generated bundles, data). */
 const MAX_BYTES = 1024 * 1024;
 const SUBMIT = new Set(['post', 'put', 'patch', 'delete']);
@@ -182,8 +183,11 @@ export function inertiaFormProblems(path, text) {
     }
     return problems;
 }
-/** Every source file under `src/`, project-relative with `/`. */
-async function sources(root, directory = 'src') {
+/**
+ * Every source file (or file matching `pattern`) under `directory` (`.`: the whole root),
+ * root-relative with `/`.
+ */
+export async function sources(root, directory = 'src', pattern = SOURCE) {
     let entries;
     try {
         entries = await readdir(join(root, directory), { withFileTypes: true });
@@ -196,12 +200,12 @@ async function sources(root, directory = 'src') {
     }
     const files = [];
     for (const entry of entries) {
-        const path = `${directory}/${entry.name}`;
+        const path = directory === '.' ? entry.name : `${directory}/${entry.name}`;
         if (entry.isDirectory()) {
             if (!SKIP_DIRECTORIES.has(entry.name))
-                files.push(...(await sources(root, path)));
+                files.push(...(await sources(root, path, pattern)));
         }
-        else if (entry.isFile() && SOURCE.test(entry.name) && !entry.name.endsWith('.d.ts'))
+        else if (entry.isFile() && pattern.test(entry.name) && !entry.name.endsWith('.d.ts'))
             files.push(path);
     }
     return files;
@@ -222,3 +226,62 @@ export async function formProblems(root, skip) {
     debug('check: inertia forms', { files, problems: problems.length });
     return { problems, files };
 }
+// form-without-csrf (D-0076 §6, a warning, only with @dokebi/csrf installed): an EJS
+// `<form method="post">` (any case, quoted or not) whose body up to `</form>` has neither
+// `csrf.field` (`<%- data.csrf.field %>`, also `csrf?.field`) nor a field named `_csrf`, and whose action carries no
+// `_csrf=` (a multipart form). @dokebi/csrf refuses such a post with 403 CSRF_FAILED. EJS is text:
+// a form written by script, or opened and closed in different includes, is not seen as one.
+const CSRF_RULE = 'form-without-csrf';
+const FORM = /<form\b[^>]*>/gi;
+const POST = /\bmethod\s*=\s*(["']?)post\1(?=[\s>/]|$)/i;
+// `csrf?.field` too: a layout also drawn without csrf data (an error page) reads it optionally (M51).
+const HAS_TOKEN = /csrf\??\.field|name\s*=\s*["']?_csrf\b|[?&]_csrf=/;
+/** The CSRF problems of one EJS file's text (the path is project-relative, with `/`). */
+export function csrfFormProblems(path, text) {
+    const problems = [];
+    const markers = readMarkers(text).filter((marker) => marker.rule === CSRF_RULE);
+    const lower = text.toLowerCase();
+    const lineAt = (position) => {
+        let line = 1;
+        for (let index = 0; index < position; index++)
+            if (text.charCodeAt(index) === 10)
+                line++;
+        return line;
+    };
+    for (const match of text.matchAll(FORM)) {
+        if (!POST.test(match[0]))
+            continue;
+        const start = match.index ?? 0;
+        const close = lower.indexOf('</form', start + match[0].length);
+        if (HAS_TOKEN.test(text.slice(start, close === -1 ? text.length : close)))
+            continue;
+        const line = lineAt(start);
+        // An EJS or HTML comment marker ends with `%>` or `-->`; the words before it are the reason.
+        const marker = markers.find((item) => item.line === line || item.line === line - 1);
+        if (marker?.reason.replace(/\s*[-_%]*>\s*$/, '').trim())
+            continue;
+        problems.push({
+            rule: CSRF_RULE,
+            severity: 'warning',
+            file: path,
+            line,
+            message: `A <form method="post"> without the CSRF token: @dokebi/csrf refuses its post with 403 CSRF_FAILED${marker ? ' (the dokebi-check marker has no reason, so it does not count)' : ''}`,
+            fix: 'write <%- data.csrf.field %> inside the form (a multipart form: action="…?_csrf=<%= data.csrf.token %>"); never exempt the route with csrf: false to make a form work. A deliberate case takes <%# dokebi-check: allow form-without-csrf <reason> %> on the line above',
+        });
+    }
+    return problems;
+}
+/** The CSRF form rule over the EJS views under `src/` (only with @dokebi/csrf installed). */
+export async function csrfFormsProblems(root) {
+    const problems = [];
+    let files = 0;
+    for (const path of await sources(root, 'src', EJS)) {
+        const text = await readFile(join(root, path), 'utf8');
+        if (text.length > MAX_BYTES)
+            continue;
+        files++;
+        problems.push(...csrfFormProblems(path, text));
+    }
+    debug('check: EJS forms and CSRF', { files, problems: problems.length });
+    return { problems, files };
+}

package/dist/check/formatter-rules.d.ts

@@ -0,0 +1,2 @@
+import type { Problem } from './problems.js';
+export declare function formatterProblems(root: string): Promise<Problem[]>;

package/dist/check/formatter-rules.js

@@ -0,0 +1,71 @@
+// The formatter rule of `dokebi check` (D-0145, a warning):
+//   formatter-migrations  a code formatter of the project would format the migrations folder
+//                         (`<dokebi-migrate directory>/migrations`): prettier without the folder
+//                         in .prettierignore, biome without `!<folder>` in files.includes (or the
+//                         folder in files.ignore of biome 1), ESLint with formatting rules
+//                         (eslint-plugin-prettier, @stylistic) whose config does not name it.
+// A reformatted applied migration is only a warning of @dokebi/migrate (MIGRATE_REFORMATTED, its
+// token checksum is unchanged), but its bytes should not change at all: the history records them.
+// Only for a project whose migrations folder exists.
+//   formatter-generated   the same formatters would format src/dokebi.generated.ts, which the CLI
+//                         writes and compares with its record: a reformatted copy is
+//                         MODIFIED_REGISTRATION, and doctor fails (R1 measurement: a builder's
+//                         biome over src/ rewrote 32 lines of it).
+import { stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { debug, isMissing } from '../diagnostics.js';
+import { CliError } from '../errors.js';
+import { formatterFix, formatterUses, GENERATED_FILE, migrationsFolder, } from '../formatter-ignore.js';
+const RULE = 'formatter-migrations';
+/** A file or folder that exists under the project. */
+async function present(root, path) {
+    try {
+        await stat(join(root, path));
+        return true;
+    }
+    catch (error) {
+        if (isMissing(error))
+            return false;
+        throw new CliError('READ_FAILED', `Cannot read ${path}`, { cause: error });
+    }
+}
+export async function formatterProblems(root) {
+    const problems = [];
+    if (await present(root, GENERATED_FILE))
+        for (const use of await formatterUses(root, GENERATED_FILE)) {
+            if (use.covered)
+                continue;
+            problems.push({
+                rule: 'formatter-generated',
+                severity: 'warning',
+                file: use.config,
+                line: 0,
+                message: `${use.tool} would format ${GENERATED_FILE}: the CLI writes it and refuses a project whose copy differs (MODIFIED_REGISTRATION)`,
+                fix: formatterFix(use, GENERATED_FILE),
+            });
+        }
+    const folder = await migrationsFolder(root);
+    try {
+        if (!(await stat(join(root, folder))).isDirectory())
+            return problems;
+    }
+    catch (error) {
+        if (isMissing(error))
+            return problems;
+        throw new CliError('READ_FAILED', `Cannot read ${folder}`, { cause: error });
+    }
+    for (const use of await formatterUses(root, folder)) {
+        if (use.covered)
+            continue;
+        problems.push({
+            rule: RULE,
+            severity: 'warning',
+            file: use.config,
+            line: 0,
+            message: `${use.tool} would format ${folder}/: an applied migration must keep its contents (@dokebi/migrate records them)`,
+            fix: formatterFix(use, folder),
+        });
+    }
+    debug('check: formatter rule done', { folder, problems: problems.length });
+    return problems;
+}

package/dist/check/i18n-rules.d.ts

@@ -0,0 +1,27 @@
+import type { Problem } from './problems.js';
+/** One namespace file of one layer and locale. */
+interface CatalogFile {
+    readonly path: string;
+    readonly text: string;
+    readonly keys: ReadonlySet<string>;
+    /** Its `$overrides`, as full keys (`ns.path`). */
+    readonly overrides: ReadonlySet<string>;
+}
+/** One layer: its files by locale and namespace. */
+interface Layer {
+    readonly kind: 'app' | 'module' | 'shared';
+    readonly name: string;
+    readonly folder: string;
+    readonly files: ReadonlyMap<string, ReadonlyMap<string, CatalogFile>>;
+}
+/** i18n-layer-override: a key of one language in two layers, unless the overriding file lists it. */
+export declare function overrideProblems(shared: Layer | undefined, modules: readonly Layer[], apps: readonly Layer[]): Problem[];
+/** i18n-layer-missing: keys a layer gives in one language and lacks in another of the project. */
+export declare function layerMissingProblems(layers: readonly Layer[], locales: readonly string[]): Problem[];
+/** The problems of one file's text against the catalogs (the path is project-relative). */
+export declare function missingKeyProblems(path: string, text: string, catalogs: ReadonlyMap<string, ReadonlySet<string>>, 
+/** dokebi-i18n defaultLocale: the end of every fallback chain. */
+defaultLocale?: string): Problem[];
+/** The translation rules over the catalogs and the files under `src/` (only with @dokebi/i18n). */
+export declare function missingKeysProblems(root: string, skip: (path: string) => boolean): Promise<Problem[]>;
+export {};