@endora-commerce/cli 0.100.0

package/dist/lib/release-index.js

@@ -0,0 +1,162 @@
+/**
+ * The release index — what this CLI's release published, written at build
+ * (`specs/080-f4-real-scope/rulings.md` D-271 clause 2).
+ *
+ * ## Why the CLI carries it
+ *
+ * `endora install` run where nothing of ours is installed — the `npx` front
+ * door, from an empty directory — has no module manifest to read: the platform,
+ * the admin packages and every module are what the module set is derived from,
+ * and none of them can be read without installing them. The install verb
+ * therefore provisions a temporary host from this index (`install/host.ts`).
+ * It is a fact the CLI publishes **about its own release**, so it is
+ * `cli-product.md` R2.3's *"the CLI's own manifest"* class rather than a
+ * registry query or a list.
+ *
+ * ## Derived, and never written by hand
+ *
+ * {@link publishablePackages} is the one rule: every workspace package under
+ * `packages/` whose manifest is not `private` and has a name. The instance
+ * acceptance criterion packs exactly that population and imports this function
+ * rather than restating it; the index is the same population narrowed to the
+ * CLI's own scope, each at the `version` its manifest declares at build time.
+ * It lives in `dist` and is never committed, so nothing in the tree can go
+ * stale: the publish job builds the versioned tree immediately before it
+ * publishes, and a release that is not uniform is recorded as it is. A paid
+ * package is in no index because it is not in this workspace (D-265).
+ */
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/** The file's name under the CLI's `dist`. */
+export const RELEASE_INDEX_FILE = 'release-index.json';
+/**
+ * Every publishable workspace package under `packagesRoot`, with its directory.
+ *
+ * A directory holding a `package.json` is a package and is not descended
+ * into; one without is a grouping directory (`packages/modules/`) and is. A
+ * manifest declaring `private: true`, or no `name`, is not publishable.
+ */
+export function publishablePackages(packagesRoot) {
+    const found = [];
+    const walk = (root) => {
+        if (!existsSync(root))
+            return;
+        for (const entry of readdirSync(root, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            const dir = join(root, entry.name);
+            const manifestPath = join(dir, 'package.json');
+            if (!existsSync(manifestPath)) {
+                walk(dir);
+                continue;
+            }
+            const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+            if (manifest.private === true || typeof manifest.name !== 'string')
+                continue;
+            found.push({
+                name: manifest.name,
+                dir,
+                version: typeof manifest.version === 'string' ? manifest.version : undefined,
+            });
+        }
+    };
+    walk(packagesRoot);
+    return found;
+}
+/**
+ * The index over `packagesRoot`, narrowed to `scope` (`@endora-commerce/`).
+ *
+ * A publishable package that declares no version is a throw rather than a
+ * skip: an index short by a package is a host short by a module, and the
+ * module set derived from it would be silently smaller than the release.
+ */
+export function releaseIndexOf(packagesRoot, scope) {
+    const packages = [];
+    for (const pkg of publishablePackages(packagesRoot)) {
+        if (!pkg.name.startsWith(scope))
+            continue;
+        if (pkg.version === undefined) {
+            throw new Error(`${join(pkg.dir, 'package.json')} is publishable and declares no \`version\`, so the ` +
+                'release index cannot say which version of it this release carries.');
+        }
+        packages.push({ name: pkg.name, version: pkg.version });
+    }
+    packages.sort((a, b) => a.name.localeCompare(b.name));
+    return { packages };
+}
+/** Read an index back, refusing anything that is not one. `source` names the file. */
+export function parseReleaseIndex(text, source) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (error) {
+        throw new Error(`${source} is not JSON (${error instanceof Error ? error.message : String(error)}).`);
+    }
+    const packages = parsed?.packages;
+    if (!Array.isArray(packages)) {
+        throw new Error(`${source} holds no \`packages\` list.`);
+    }
+    const entries = [];
+    for (const entry of packages) {
+        const name = entry?.name;
+        const version = entry?.version;
+        if (typeof name !== 'string' || typeof version !== 'string') {
+            throw new Error(`${source} holds an entry with no string \`name\` or \`version\`.`);
+        }
+        entries.push({ name, version });
+    }
+    if (entries.length === 0) {
+        throw new Error(`${source} names no package, so there is nothing to install from it.`);
+    }
+    return { packages: entries };
+}
+/**
+ * Where this CLI's own index is: `dist/` of the nearest package root above
+ * this module — the same file from `src/` in a checkout and from `dist/` in an
+ * installed tarball.
+ */
+export function ownReleaseIndexPath(moduleUrl = import.meta.url) {
+    let current = dirname(fileURLToPath(moduleUrl));
+    for (;;) {
+        if (existsSync(join(current, 'package.json')))
+            return join(current, 'dist', RELEASE_INDEX_FILE);
+        const parent = dirname(current);
+        if (parent === current)
+            return join(dirname(fileURLToPath(moduleUrl)), RELEASE_INDEX_FILE);
+        current = parent;
+    }
+}
+/**
+ * The build step: derive the index for the CLI package at `cliDir` and write
+ * it into its `dist`.
+ *
+ * The workspace is found by walking up to `pnpm-workspace.yaml`, and the
+ * scope comes off the CLI's own name — nothing here is written down. Called by
+ * `scripts/write-release-index.mjs`, which the package's `build` runs after
+ * `tsc`; a failure fails the build rather than shipping a CLI with no index.
+ */
+export function writeReleaseIndex(cliDir) {
+    const own = JSON.parse(readFileSync(join(cliDir, 'package.json'), 'utf8'));
+    const scope = typeof own.name === 'string' ? /^(@[^/]+\/)/.exec(own.name)?.[1] : undefined;
+    if (scope === undefined) {
+        throw new Error(`${join(cliDir, 'package.json')} declares no scoped name to derive a scope from.`);
+    }
+    let root = cliDir;
+    while (!existsSync(join(root, 'pnpm-workspace.yaml'))) {
+        const parent = dirname(root);
+        if (parent === root) {
+            throw new Error(`no pnpm-workspace.yaml above ${cliDir}: the release index is derived from a checkout.`);
+        }
+        root = parent;
+    }
+    const index = releaseIndexOf(join(root, 'packages'), scope);
+    const platform = `${scope}platform`;
+    if (!index.packages.some((entry) => entry.name === platform)) {
+        throw new Error(`${platform} is not among the publishable packages under ${join(root, 'packages')}.`);
+    }
+    writeFileSync(join(cliDir, 'dist', RELEASE_INDEX_FILE), `${JSON.stringify(index, null, 2)}\n`, 'utf8');
+    return index;
+}
+//# sourceMappingURL=release-index.js.map

package/dist/lib/release-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-index.js","sourceRoot":"","sources":["../../src/lib/release-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,8CAA8C;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAqBvD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAQ,EAAE;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAC/C,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;gBACV,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAI7D,CAAC;YACF,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAC7E,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,GAAG;gBACH,OAAO,EAAE,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aAC7E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,KAAa;IAChE,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QAC1C,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,sDAAsD;gBACpF,oEAAoE,CACvE,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAc;IAC5D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAI,MAAwC,EAAE,QAAQ,CAAC;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,8BAA8B,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAC;QACxD,MAAM,OAAO,GAAI,KAAsC,EAAE,OAAO,CAAC;QACjE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,yDAAyD,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,4DAA4D,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB,MAAM,CAAC,IAAI,CAAC,GAAG;IACrE,IAAI,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IAChD,SAAS,CAAC;QACR,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAC3F,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAuB,CAAC;IACjG,MAAM,KAAK,GACT,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,kDAAkD,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,IAAI,GAAG,MAAM,CAAC;IAClB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,iDAAiD,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,GAAG,KAAK,UAAU,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,gDAAgD,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;IACxG,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvG,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/repeating-timers.d.ts

@@ -0,0 +1,79 @@
+/**
+ * The one recognizer for "this file starts a repeating execution of its own"
+ * (issue #128).
+ *
+ * Two checks ask that question and used to answer it separately.
+ * `check-entry-presence.ts` reads the callback and knows a repeating timer is
+ * not only a `setInterval`: a `setTimeout` whose callback re-arms a timer is the
+ * same entry point wearing a different constructor. `check-entry-scope.ts`
+ * grepped for `setInterval(` — so `search`'s reindex loop, which is exactly that
+ * `setTimeout`, was never in its population, and the `interval=4` it printed
+ * every run read as a settled count rather than as one spelling's worth of
+ * coverage.
+ *
+ * The fix is a shared recognizer rather than a second one. Lending only the last
+ * predicate (`isSelfRescheduling`) would have left the caller to re-implement the
+ * parse, the callback binding and the enclosing-function name — most of the
+ * recognizer — and those are precisely the parts that drift. So the whole shape
+ * lives here and both checks consume it; neither owns it.
+ *
+ * What this deliberately does **not** decide: what to do about a site it finds.
+ * `check-entry-presence` asks whether the callback decides presence,
+ * `check-entry-scope` whether the file opens a scope. The shapes are shared, the
+ * rules are not.
+ *
+ * ## Limits, and why they are the same for both callers
+ *
+ *   - A one-shot `setTimeout` — an `AbortController` deadline, a sleep between
+ *     retries — is not a repeating entry point and is not reported.
+ *   - A callback that is an identifier bound in another file cannot be read, so
+ *     a `setTimeout` reached that way is invisible. A `setInterval` is reported
+ *     anyway, with a null callback: it repeats whatever its callback turns out to
+ *     be, and what a check cannot see it must not vouch for.
+ *   - A scheduler hidden behind an imported helper is invisible. The analysis is
+ *     single-file and syntactic; if that shape arrives, this module has to grow.
+ */
+import ts from 'typescript';
+/** The scheduling call a site was built from. */
+export type RepeatingTimerConstruct = 'setInterval' | 'setTimeout';
+export interface RepeatingTimerSite {
+    readonly construct: RepeatingTimerConstruct;
+    /** The scheduling call itself, for reporting a position. */
+    readonly call: ts.CallExpression;
+    /**
+     * The callback body, or `null` when the argument could not be bound to a
+     * function in this file. Only a `setInterval` site can carry `null`.
+     */
+    readonly callback: ts.Node | null;
+    /** 1-based line of the scheduling call. */
+    readonly line: number;
+    /** The nearest enclosing named function, or `<module scope>`. */
+    readonly scheduler: string;
+}
+export declare const MODULE_SCOPE = "<module scope>";
+/** Parse with parent pointers — every predicate below walks upwards. */
+export declare function parseScript(file: string, source: string): ts.SourceFile;
+/** The trailing identifier of a callee: `globalThis.setInterval` → `setInterval`. */
+export declare function calleeName(node: ts.CallExpression): string | null;
+/** The receiver of a call, as its trailing identifier: `process.on` → `process`. */
+export declare function receiverName(node: ts.CallExpression): string | null;
+export declare function stringLiteralOf(node: ts.Node): string | null;
+export type FunctionLike = ts.ArrowFunction | ts.FunctionExpression | ts.FunctionDeclaration;
+export declare function isFunctionLike(node: ts.Node): node is FunctionLike;
+/** File-local `function f(){}` / `const f = () => {}` bindings, by name. */
+export declare function localFunctions(sf: ts.SourceFile): Map<string, FunctionLike>;
+/** The nearest named function around `node`, for the ledger key. */
+export declare function enclosingName(node: ts.Node): string | null;
+/** True when the subtree contains a call to one of `names` (as identifier or tail). */
+export declare function callsAnyOf(root: ts.Node, names: ReadonlySet<string>): boolean;
+/**
+ * A `setTimeout` repeats only when its callback re-arms a timer itself, or calls
+ * back into the function that armed this one. That is the single shape a one-shot
+ * deadline cannot accidentally match.
+ */
+export declare function isSelfRescheduling(callback: ts.Node, armedBy: string | null): boolean;
+/** Resolve a callback argument to a function body in this file, if we can read one. */
+export declare function callbackOf(argument: ts.Node | undefined, bindings: ReadonlyMap<string, FunctionLike>): ts.Node | null;
+/** Every repeating-timer entry point in one parsed file, in source order. */
+export declare function findRepeatingTimerSites(sf: ts.SourceFile): RepeatingTimerSite[];
+//# sourceMappingURL=repeating-timers.d.ts.map

package/dist/lib/repeating-timers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repeating-timers.d.ts","sourceRoot":"","sources":["../../src/lib/repeating-timers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,iDAAiD;AACjD,MAAM,MAAM,uBAAuB,GAAG,aAAa,GAAG,YAAY,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAC5C,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC;IAClC,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,YAAY,mBAAmB,CAAC;AAE7C,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,UAAU,CAEvE;AAED,qFAAqF;AACrF,wBAAgB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,GAAG,MAAM,GAAG,IAAI,CAKjE;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,GAAG,MAAM,GAAG,IAAI,CAOnE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,MAAM,GAAG,IAAI,CAU5D;AAED,MAAM,MAAM,YAAY,GAAG,EAAE,CAAC,aAAa,GAAG,EAAE,CAAC,kBAAkB,GAAG,EAAE,CAAC,mBAAmB,CAAC;AAE7F,wBAAgB,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,IAAI,IAAI,YAAY,CAElE;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAiB3E;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,MAAM,GAAG,IAAI,CAuB1D;AAED,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAe7E;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAIrF;AAED,uFAAuF;AACvF,wBAAgB,UAAU,CACxB,QAAQ,EAAE,EAAE,CAAC,IAAI,GAAG,SAAS,EAC7B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,GAC1C,EAAE,CAAC,IAAI,GAAG,IAAI,CAKhB;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,GAAG,kBAAkB,EAAE,CAkC/E"}

package/dist/lib/repeating-timers.js

@@ -0,0 +1,189 @@
+/**
+ * The one recognizer for "this file starts a repeating execution of its own"
+ * (issue #128).
+ *
+ * Two checks ask that question and used to answer it separately.
+ * `check-entry-presence.ts` reads the callback and knows a repeating timer is
+ * not only a `setInterval`: a `setTimeout` whose callback re-arms a timer is the
+ * same entry point wearing a different constructor. `check-entry-scope.ts`
+ * grepped for `setInterval(` — so `search`'s reindex loop, which is exactly that
+ * `setTimeout`, was never in its population, and the `interval=4` it printed
+ * every run read as a settled count rather than as one spelling's worth of
+ * coverage.
+ *
+ * The fix is a shared recognizer rather than a second one. Lending only the last
+ * predicate (`isSelfRescheduling`) would have left the caller to re-implement the
+ * parse, the callback binding and the enclosing-function name — most of the
+ * recognizer — and those are precisely the parts that drift. So the whole shape
+ * lives here and both checks consume it; neither owns it.
+ *
+ * What this deliberately does **not** decide: what to do about a site it finds.
+ * `check-entry-presence` asks whether the callback decides presence,
+ * `check-entry-scope` whether the file opens a scope. The shapes are shared, the
+ * rules are not.
+ *
+ * ## Limits, and why they are the same for both callers
+ *
+ *   - A one-shot `setTimeout` — an `AbortController` deadline, a sleep between
+ *     retries — is not a repeating entry point and is not reported.
+ *   - A callback that is an identifier bound in another file cannot be read, so
+ *     a `setTimeout` reached that way is invisible. A `setInterval` is reported
+ *     anyway, with a null callback: it repeats whatever its callback turns out to
+ *     be, and what a check cannot see it must not vouch for.
+ *   - A scheduler hidden behind an imported helper is invisible. The analysis is
+ *     single-file and syntactic; if that shape arrives, this module has to grow.
+ */
+import ts from 'typescript';
+export const MODULE_SCOPE = '<module scope>';
+/** Parse with parent pointers — every predicate below walks upwards. */
+export function parseScript(file, source) {
+    return ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true);
+}
+/** The trailing identifier of a callee: `globalThis.setInterval` → `setInterval`. */
+export function calleeName(node) {
+    const expression = node.expression;
+    if (ts.isIdentifier(expression))
+        return expression.text;
+    if (ts.isPropertyAccessExpression(expression))
+        return expression.name.text;
+    return null;
+}
+/** The receiver of a call, as its trailing identifier: `process.on` → `process`. */
+export function receiverName(node) {
+    const expression = node.expression;
+    if (!ts.isPropertyAccessExpression(expression))
+        return null;
+    const receiver = expression.expression;
+    if (ts.isIdentifier(receiver))
+        return receiver.text;
+    if (ts.isPropertyAccessExpression(receiver))
+        return receiver.name.text;
+    return null;
+}
+export function stringLiteralOf(node) {
+    if (ts.isStringLiteralLike(node))
+        return node.text;
+    if (ts.isAsExpression(node) ||
+        ts.isNonNullExpression(node) ||
+        ts.isParenthesizedExpression(node)) {
+        return stringLiteralOf(node.expression);
+    }
+    return null;
+}
+export function isFunctionLike(node) {
+    return ts.isArrowFunction(node) || ts.isFunctionExpression(node) || ts.isFunctionDeclaration(node);
+}
+/** File-local `function f(){}` / `const f = () => {}` bindings, by name. */
+export function localFunctions(sf) {
+    const bindings = new Map();
+    const visit = (node) => {
+        if (ts.isFunctionDeclaration(node) && node.name) {
+            bindings.set(node.name.text, node);
+        }
+        else if (ts.isVariableDeclaration(node) &&
+            ts.isIdentifier(node.name) &&
+            node.initializer &&
+            isFunctionLike(node.initializer)) {
+            bindings.set(node.name.text, node.initializer);
+        }
+        node.forEachChild(visit);
+    };
+    sf.forEachChild(visit);
+    return bindings;
+}
+/** The nearest named function around `node`, for the ledger key. */
+export function enclosingName(node) {
+    for (let cursor = node.parent; cursor; cursor = cursor.parent) {
+        if (ts.isFunctionDeclaration(cursor) && cursor.name)
+            return cursor.name.text;
+        if (ts.isMethodDeclaration(cursor) && ts.isIdentifier(cursor.name))
+            return cursor.name.text;
+        // `{ plugin: async (app) => { … } }` — the shape every module's plugin body
+        // has, and the name a reader would use for it.
+        if (ts.isPropertyAssignment(cursor) &&
+            ts.isIdentifier(cursor.name) &&
+            isFunctionLike(cursor.initializer)) {
+            return cursor.name.text;
+        }
+        if (ts.isVariableDeclaration(cursor) &&
+            ts.isIdentifier(cursor.name) &&
+            cursor.initializer &&
+            isFunctionLike(cursor.initializer)) {
+            return cursor.name.text;
+        }
+    }
+    return null;
+}
+/** True when the subtree contains a call to one of `names` (as identifier or tail). */
+export function callsAnyOf(root, names) {
+    let found = false;
+    const visit = (node) => {
+        if (found)
+            return;
+        if (ts.isCallExpression(node)) {
+            const name = calleeName(node);
+            if (name !== null && names.has(name)) {
+                found = true;
+                return;
+            }
+        }
+        node.forEachChild(visit);
+    };
+    root.forEachChild(visit);
+    return found;
+}
+const TIMER_CALLS = new Set(['setInterval', 'setTimeout']);
+/**
+ * A `setTimeout` repeats only when its callback re-arms a timer itself, or calls
+ * back into the function that armed this one. That is the single shape a one-shot
+ * deadline cannot accidentally match.
+ */
+export function isSelfRescheduling(callback, armedBy) {
+    if (callsAnyOf(callback, TIMER_CALLS))
+        return true;
+    if (armedBy === null)
+        return false;
+    return callsAnyOf(callback, new Set([armedBy]));
+}
+/** Resolve a callback argument to a function body in this file, if we can read one. */
+export function callbackOf(argument, bindings) {
+    if (argument === undefined)
+        return null;
+    if (isFunctionLike(argument))
+        return argument;
+    if (ts.isIdentifier(argument))
+        return bindings.get(argument.text) ?? null;
+    return null;
+}
+/** Every repeating-timer entry point in one parsed file, in source order. */
+export function findRepeatingTimerSites(sf) {
+    const bindings = localFunctions(sf);
+    const sites = [];
+    const record = (call, construct, callback) => {
+        sites.push({
+            construct,
+            call,
+            callback,
+            line: sf.getLineAndCharacterOfPosition(call.getStart(sf)).line + 1,
+            scheduler: enclosingName(call) ?? MODULE_SCOPE,
+        });
+    };
+    const visit = (node) => {
+        if (ts.isCallExpression(node)) {
+            const name = calleeName(node);
+            if (name === 'setInterval' || name === 'setTimeout') {
+                const callback = callbackOf(node.arguments[0], bindings);
+                if (name === 'setInterval') {
+                    record(node, 'setInterval', callback);
+                }
+                else if (callback !== null && isSelfRescheduling(callback, enclosingName(node))) {
+                    record(node, 'setTimeout', callback);
+                }
+            }
+        }
+        node.forEachChild(visit);
+    };
+    sf.forEachChild(visit);
+    return sites;
+}
+//# sourceMappingURL=repeating-timers.js.map

package/dist/lib/repeating-timers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repeating-timers.js","sourceRoot":"","sources":["../../src/lib/repeating-timers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,MAAM,YAAY,CAAC;AAoB5B,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAE7C,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,OAAO,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC;IACxD,IAAI,EAAE,CAAC,0BAA0B,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAAC,IAAuB;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC;IACvC,IAAI,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;IACpD,IAAI,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACnD,IACE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC;QACvB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAC5B,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAClC,CAAC;QACD,OAAO,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAID,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,OAAO,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACrG,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,EAAiB;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAChD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;aAAM,IACL,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;YAC9B,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,WAAW;YAChB,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAChC,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC;IACF,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,KAAK,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7E,IAAI,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5F,4EAA4E;QAC5E,+CAA+C;QAC/C,IACE,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;YAC/B,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;YAC5B,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,EAClC,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,CAAC;QACD,IACE,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC;YAChC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;YAC5B,MAAM,CAAC,WAAW;YAClB,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,EAClC,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,IAAa,EAAE,KAA0B;IAClE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,KAAK;YAAE,OAAO;QAClB,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,KAAK,GAAG,IAAI,CAAC;gBACb,OAAO;YACT,CAAC;QACH,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAiB,EAAE,OAAsB;IAC1E,IAAI,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CACxB,QAA6B,EAC7B,QAA2C;IAE3C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CAAC,EAAiB;IACvD,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,KAAK,GAAyB,EAAE,CAAC;IAEvC,MAAM,MAAM,GAAG,CACb,IAAuB,EACvB,SAAkC,EAClC,QAAwB,EAClB,EAAE;QACR,KAAK,CAAC,IAAI,CAAC;YACT,SAAS;YACT,IAAI;YACJ,QAAQ;YACR,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;YAClE,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,YAAY;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;gBACpD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACzD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;oBAC3B,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;gBACxC,CAAC;qBAAM,IAAI,QAAQ,KAAK,IAAI,IAAI,kBAAkB,CAAC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBAClF,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC;IACF,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/source-text.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The tree's one comment stripper (issue #241).
+ *
+ * ## Why this is not two regexes
+ *
+ * "Remove the comments before matching" was written three times in this
+ * repository, independently, and each copy was a pair of regexes — one for
+ * `/* … *\/`, one for `//` — whose **order** decided whether it was correct.
+ * There is no correct order. Run the block pass first and a `//` line ending in
+ * a route glob opens a block comment: `harness-parity.test.ts` did exactly that
+ * over `test/helpers/test-server.ts`, whose line 1544 ends
+ * `… under /api/v1/admin/assets/` plus a star, and the pass ran on to the next
+ * real terminator — **1135 of 2767 lines, 41% of the file**. Every
+ * `expect(harnessCode).not.toContain(…)` inside that window was green because
+ * the text was gone, `runBootHooks(`, `errorEnvelope` and
+ * `resolvePreferredLanguage` among them. Run the line pass first and the
+ * symmetric hole opens: a `//` inside a block comment truncates it. And in
+ * either order a string literal holding a comment token — `'/*'` in
+ * `assets_library`'s wildcard-MIME test, `'image/*, *\/*;q=0.5'` in
+ * `pim_ergonode`'s Accept header — opens or closes a comment that is not there.
+ *
+ * So this asks the parser instead. `ts` is already a backend dependency and
+ * already the input to nineteen checks; a scanner that knows what a string
+ * literal is has no order to get wrong.
+ *
+ * ## Blanked, not deleted
+ *
+ * Every comment character becomes a space and every newline survives, so a line
+ * number in the result is a line number in the source. A stripper that deletes
+ * shifts every finding below the first comment onto a line the reader cannot
+ * open, and the three copies this replaces all did.
+ */
+export declare function codeOnly(source: string, fileName?: string): string;
+//# sourceMappingURL=source-text.d.ts.map

package/dist/lib/source-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-text.d.ts","sourceRoot":"","sources":["../../src/lib/source-text.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,SAAc,GAAG,MAAM,CAiBvE"}

package/dist/lib/source-text.js

@@ -0,0 +1,80 @@
+import ts from 'typescript';
+/**
+ * The tree's one comment stripper (issue #241).
+ *
+ * ## Why this is not two regexes
+ *
+ * "Remove the comments before matching" was written three times in this
+ * repository, independently, and each copy was a pair of regexes — one for
+ * `/* … *\/`, one for `//` — whose **order** decided whether it was correct.
+ * There is no correct order. Run the block pass first and a `//` line ending in
+ * a route glob opens a block comment: `harness-parity.test.ts` did exactly that
+ * over `test/helpers/test-server.ts`, whose line 1544 ends
+ * `… under /api/v1/admin/assets/` plus a star, and the pass ran on to the next
+ * real terminator — **1135 of 2767 lines, 41% of the file**. Every
+ * `expect(harnessCode).not.toContain(…)` inside that window was green because
+ * the text was gone, `runBootHooks(`, `errorEnvelope` and
+ * `resolvePreferredLanguage` among them. Run the line pass first and the
+ * symmetric hole opens: a `//` inside a block comment truncates it. And in
+ * either order a string literal holding a comment token — `'/*'` in
+ * `assets_library`'s wildcard-MIME test, `'image/*, *\/*;q=0.5'` in
+ * `pim_ergonode`'s Accept header — opens or closes a comment that is not there.
+ *
+ * So this asks the parser instead. `ts` is already a backend dependency and
+ * already the input to nineteen checks; a scanner that knows what a string
+ * literal is has no order to get wrong.
+ *
+ * ## Blanked, not deleted
+ *
+ * Every comment character becomes a space and every newline survives, so a line
+ * number in the result is a line number in the source. A stripper that deletes
+ * shifts every finding below the first comment onto a line the reader cannot
+ * open, and the three copies this replaces all did.
+ */
+export function codeOnly(source, fileName = 'source.ts') {
+    const scriptKind = fileName.endsWith('.tsx') ? ts.ScriptKind.TSX : ts.ScriptKind.TS;
+    const sourceFile = ts.createSourceFile(fileName, source, ts.ScriptTarget.ES2022, true, scriptKind);
+    const characters = [...source];
+    for (const range of commentRanges(sourceFile, source)) {
+        for (let index = range.pos; index < range.end; index += 1) {
+            if (characters[index] !== '\n')
+                characters[index] = ' ';
+        }
+    }
+    return characters.join('');
+}
+/**
+ * Every comment span the parser saw, sorted.
+ *
+ * Trivia hangs off token positions rather than off nodes of its own, so the
+ * walk asks at both ends of every node: a comment is leading trivia for the
+ * token after it and trailing trivia for the token before it, and the file's
+ * last comment is leading trivia of the end-of-file token. Ranges repeat under
+ * that walk, which is what the `seen` set is for.
+ */
+function commentRanges(sourceFile, source) {
+    const found = [];
+    const seen = new Set();
+    const collect = (position) => {
+        const ranges = [
+            ...(ts.getLeadingCommentRanges(source, position) ?? []),
+            ...(ts.getTrailingCommentRanges(source, position) ?? []),
+        ];
+        for (const range of ranges) {
+            const key = `${range.pos}:${range.end}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            found.push(range);
+        }
+    };
+    const visit = (node) => {
+        collect(node.getFullStart());
+        collect(node.getEnd());
+        for (const child of node.getChildren(sourceFile))
+            visit(child);
+    };
+    visit(sourceFile);
+    return found.sort((a, b) => a.pos - b.pos);
+}
+//# sourceMappingURL=source-text.js.map

package/dist/lib/source-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-text.js","sourceRoot":"","sources":["../../src/lib/source-text.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,QAAQ,GAAG,WAAW;IAC7D,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IACpF,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CACpC,QAAQ,EACR,MAAM,EACN,EAAE,CAAC,YAAY,CAAC,MAAM,EACtB,IAAI,EACJ,UAAU,CACX,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;QACtD,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1D,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,IAAI;gBAAE,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,UAAyB,EAAE,MAAc;IAC9D,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAQ,EAAE;QACzC,MAAM,MAAM,GAAG;YACb,GAAG,CAAC,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;YACvD,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;SACzD,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC,CAAC;IACF,KAAK,CAAC,UAAU,CAAC,CAAC;IAElB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC"}

package/dist/lib/specifiers.d.ts

@@ -0,0 +1,20 @@
+/** The shape a specifier was written in. See the header for why each is listed. */
+export type SpecifierKind = 'value-import' | 'type-only-import' | 'mixed-type-specifier' | 're-export' | 'side-effect-import' | 'dynamic-import' | 'require-call' | 'import-type-node';
+/** One specifier as it was written, with everything a boundary rule needs of it. */
+export interface NamedSpecifier {
+    /** The specifier exactly as written, extension and all. */
+    readonly text: string;
+    readonly kind: SpecifierKind;
+    /** What the import takes: a reviewer's first question is shape or behaviour. */
+    readonly bindings: readonly string[];
+    readonly line: number;
+}
+/**
+ * Every module specifier `source` names, in source order.
+ *
+ * `file` is used only for the source-file name the compiler API wants and for
+ * line numbers; nothing here touches disk, so a caller may pass a path that does
+ * not exist — which is what lets both checks' fixtures enter at the top.
+ */
+export declare function namedSpecifiers(source: string, file: string): NamedSpecifier[];
+//# sourceMappingURL=specifiers.d.ts.map

package/dist/lib/specifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"specifiers.d.ts","sourceRoot":"","sources":["../../src/lib/specifiers.ts"],"names":[],"mappings":"AAsCA,mFAAmF;AACnF,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,kBAAkB,GAClB,sBAAsB,GACtB,WAAW,GACX,oBAAoB,GACpB,gBAAgB,GAChB,cAAc,GACd,kBAAkB,CAAC;AAEvB,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AA2CD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CAqD9E"}