@joshuafolkken/kit 1.872.0

package/scripts/propagate/propagate.ts

@@ -0,0 +1,216 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { repo_discovery } from '#scripts/discovery/repo-discovery'
+import { PROJECT_ROOT } from '#scripts/init/init-paths'
+import { refuse_unknown_flags } from '#scripts/lib/cli-flags'
+import { status_icons } from '#scripts/lib/status-icons'
+import { self_sync_guard } from '#scripts/self-sync-guard/self-sync-guard-logic'
+import { KIT_PACKAGE_NAME } from '#scripts/version/kit-descriptor'
+import { derive_versions_endpoint } from '#scripts/version/version-command-config'
+import { version_targets } from '#scripts/version/version-targets'
+import { propagate_git } from './propagate-git'
+import { propagate_publish } from './propagate-publish'
+import { propagate_run } from './propagate-run'
+import { propagate_steps } from './propagate-steps'
+import { propagate_targets } from './propagate-targets'
+
+// `josh propagate` — carry the release this repository just published into every consumer checked
+// out next to it (joshuafolkken/kit#863).
+
+const SUCCESS_EXIT_CODE = 0
+const FAILURE_EXIT_CODE = 1
+const ARGV_OFFSET = 2
+const SKIP_PUBLISH_FLAG = '--skip-publish-wait'
+const DRY_RUN_FLAG = '--dry-run'
+const KNOWN_FLAGS: ReadonlyArray<string> = [SKIP_PUBLISH_FLAG, DRY_RUN_FLAG]
+const DRY_RUN_REASON = 'would be propagated'
+
+interface RunOptions {
+	is_dry_run: boolean
+	is_publish_wait_skipped: boolean
+	// The usage message, when the arguments were not accepted. Carried alongside rather than returned
+	// instead, so the caller has one shape to branch on.
+	usage?: string
+}
+
+// Reject anything not on the list rather than ignoring it. `--dryrun` silently falling through to
+// the real write path is the mistake this refusal exists to prevent.
+function parse_options(argv: ReadonlyArray<string>): RunOptions {
+	const options: RunOptions = {
+		is_dry_run: argv.includes(DRY_RUN_FLAG),
+		is_publish_wait_skipped: argv.includes(SKIP_PUBLISH_FLAG),
+	}
+	const usage = refuse_unknown_flags(argv, KNOWN_FLAGS, 'propagate')
+
+	return usage === undefined ? options : { ...options, usage }
+}
+
+// Propagation runs from the supplier's own repository, and only there.
+//
+// This is also what decides who propagates when several sessions are running: in the
+// per-repository concurrency model there is one session per checkout, so the session standing in
+// the supplier repository is the one that can run this command (joshuafolkken/kit#861). It is a
+// convention enforced at the boundary, not a lock — two checkouts of the supplier would both pass,
+// which is why each consumer is additionally refused unless its working tree is clean.
+function refuse_outside_source_repository(project_root: string): string | undefined {
+	if (self_sync_guard.read_package_name(project_root) === KIT_PACKAGE_NAME) return undefined
+
+	return [
+		`Refusing to propagate: this is not ${KIT_PACKAGE_NAME}'s own repository.`,
+		'Propagation carries a published release outward, so it runs from the package that published it.',
+		`Run it from the ${KIT_PACKAGE_NAME} checkout instead.`,
+	].join('\n')
+}
+
+// The version to carry: this repository's own declared version, which is what the merge published.
+// Never "whatever is newest" — a consumer several releases behind must not be satisfied by an older
+// publish that does not contain the change being propagated.
+function resolve_target_version(project_root: string): string | undefined {
+	return version_targets.read_workspace_version(project_root)
+}
+
+// The version this run would carry, or the message saying why there is none. Both halves are
+// carried in one value so the caller has a single thing to branch on.
+interface RunVersion {
+	version?: string
+	refusal?: string
+	warning?: string
+}
+
+// The supplier's own tree is checked too: run from a checkout that is behind its remote, the version
+// read below is the *previous* release — already published, so the wait passes and every consumer is
+// told to upgrade to a version that does not contain the change.
+// What an unready supplier means for this run. A dry run writes nothing, so it is a warning there
+// rather than a refusal — refusing would make the flag useless in exactly the situation it is
+// reached for, which is checking the target list while work is still in progress.
+function unready_supplier(version: string, reason: string, is_dry_run: boolean): RunVersion {
+	if (!is_dry_run) return { refusal: `Refusing to propagate: this repository ${reason}.` }
+
+	return { version, warning: `Note: this repository ${reason}; a real run would refuse.` }
+}
+
+// The version once the supplier repository has been accepted as the place to propagate from.
+function resolve_supplier_version(project_root: string, is_dry_run: boolean): RunVersion {
+	const version = resolve_target_version(project_root)
+
+	if (version === undefined) {
+		return { refusal: 'Could not read this repository own version; nothing to propagate.' }
+	}
+
+	const state = propagate_git.tree_state(project_root)
+
+	return state.is_ready
+		? { version }
+		: unready_supplier(version, state.reason ?? 'is not ready', is_dry_run)
+}
+
+function resolve_run_version(project_root: string, is_dry_run = false): RunVersion {
+	const refusal = refuse_outside_source_repository(project_root)
+	if (refusal !== undefined) return { refusal }
+
+	return resolve_supplier_version(project_root, is_dry_run)
+}
+
+async function await_publish(target_version: string, is_skipped: boolean): Promise<boolean> {
+	if (is_skipped) return true
+	console.info(`Waiting for ${KIT_PACKAGE_NAME}@${target_version} to appear in the registry…`)
+	const endpoint = derive_versions_endpoint(KIT_PACKAGE_NAME)
+	const result = await propagate_publish.wait_for_publish(endpoint, target_version)
+
+	if (result.state === 'published') {
+		console.info(`✓ ${target_version} is published (${String(result.attempts)} probe(s)).`)
+
+		return true
+	}
+
+	console.error(
+		`${status_icons.FAIL_ICON} ${target_version} did not become available: ${result.state}.`,
+	)
+	console.error('No consumer was touched.')
+
+	return false
+}
+
+// Everything after the publish wait: resolve the consumers, run each one, print one report.
+function propagate_to_consumers(version: string, is_dry_run: boolean): number {
+	const map = repo_discovery.discover_repositories(PROJECT_ROOT)
+	const targets = propagate_targets.resolve_targets(map, KIT_PACKAGE_NAME, version)
+	const step = is_dry_run
+		? propagate_steps.describe_step
+		: propagate_steps.create_step_runner({
+				releases: [
+					{
+						package_name: KIT_PACKAGE_NAME,
+						version,
+						bin_name: propagate_steps.JOSH_BIN,
+					},
+				],
+				origin: propagate_steps.PROPAGATE_ORIGIN,
+			})
+	const results = propagate_run.run_targets(
+		targets,
+		step,
+		is_dry_run ? DRY_RUN_REASON : propagate_run.PROPAGATED_REASON,
+	)
+
+	console.info('')
+	console.info(propagate_run.format_report(results))
+
+	return propagate_run.has_failure(results) ? FAILURE_EXIT_CODE : SUCCESS_EXIT_CODE
+}
+
+// A dry run never waits: the whole reason to ask for one is to see the target list, and a wait that
+// times out would end the run before the list was ever printed.
+async function resolve_publish(version: string, options: RunOptions): Promise<boolean> {
+	return await await_publish(version, options.is_dry_run || options.is_publish_wait_skipped)
+}
+
+// Print whatever the version resolution had to say, and hand back the version when there is one.
+function announce_run_version(resolved: RunVersion): string | undefined {
+	if (resolved.version === undefined) {
+		console.error(resolved.refusal ?? 'Nothing to propagate.')
+
+		return undefined
+	}
+
+	if (resolved.warning !== undefined) console.info(resolved.warning)
+
+	return resolved.version
+}
+
+async function run(argv: ReadonlyArray<string>): Promise<number> {
+	const options = parse_options(argv)
+
+	if (options.usage !== undefined) {
+		console.error(options.usage)
+
+		return FAILURE_EXIT_CODE
+	}
+
+	const version = announce_run_version(resolve_run_version(PROJECT_ROOT, options.is_dry_run))
+	if (version === undefined) return FAILURE_EXIT_CODE
+	if (!(await resolve_publish(version, options))) return FAILURE_EXIT_CODE
+
+	return propagate_to_consumers(version, options.is_dry_run)
+}
+
+async function main(argv: ReadonlyArray<string>): Promise<void> {
+	process.exit(await run(argv))
+}
+
+const propagate = {
+	DRY_RUN_REASON,
+	KNOWN_FLAGS,
+	parse_options,
+	refuse_outside_source_repository,
+	resolve_target_version,
+	resolve_run_version,
+	announce_run_version,
+	run,
+	main,
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
+
+export type { RunOptions }
+export { propagate }

package/scripts/refactor/import-graph.ts

@@ -0,0 +1,187 @@
+import { readFileSync } from 'node:fs'
+import path from 'node:path'
+
+// The scope expansion `prompts/refactoring.md` §4.3 used to describe in prose (joshuafolkken/kit#2180):
+// from the seed files, follow imports both ways — the files a seed imports and the files that import a
+// seed — for up to three stages, stopping as soon as a stage finds nothing new. Walking the import
+// graph is exactly computable, so it is computed here rather than read and traced by hand.
+
+// `import ... from '<spec>'` and `export ... from '<spec>'` both re-export from a specifier; the group
+// captures it. `from` is matched as a word so an identifier ending in `from` is not mistaken for the
+// keyword.
+const FROM_PATTERN = /\bfrom[ \t]*['"]([^'"\n]+)['"]/gu
+// A side-effect import carries no `from`: `import './register'`.
+const BARE_IMPORT_PATTERN = /^[ \t]*import[ \t]+['"]([^'"\n]+)['"]/gmu
+// The subpath import this package uses for cross-directory `scripts/` imports; `#scripts/x` resolves
+// to `scripts/x`. Relative specifiers resolve against the importer's directory.
+const SUBPATH_PREFIX = '#scripts/'
+const SCRIPTS_DIR = 'scripts'
+const RELATIVE_PREFIX = '.'
+// A specifier omits its extension, so a resolved base is tried against the real files these suffixes
+// would produce — a sibling module or a directory's index, in the order a resolver would.
+const CANDIDATE_SUFFIXES: ReadonlyArray<string> = ['', '.ts', '.js', '/index.ts', '/index.js']
+// §4.3: at most three stages, and a stage that adds nothing ends the walk early.
+const MAX_STAGES = 3
+
+type FileGraph = ReadonlyMap<string, ReadonlySet<string>>
+
+function specifiers_of(source: string, pattern: RegExp): ReadonlyArray<string> {
+	const matches = [...source.matchAll(pattern)]
+
+	return matches.flatMap((match) => (match[1] === undefined ? [] : [match[1]]))
+}
+
+function parse_imports(source: string): ReadonlyArray<string> {
+	return [...specifiers_of(source, FROM_PATTERN), ...specifiers_of(source, BARE_IMPORT_PATTERN)]
+}
+
+// Where a local specifier points before extension resolution, or `undefined` for a package import
+// this graph does not follow.
+function specifier_base(spec: string, importer: string, root: string): string | undefined {
+	if (spec.startsWith(SUBPATH_PREFIX)) {
+		return path.resolve(root, SCRIPTS_DIR, spec.slice(SUBPATH_PREFIX.length))
+	}
+
+	if (spec.startsWith(RELATIVE_PREFIX)) return path.resolve(path.dirname(importer), spec)
+
+	return undefined
+}
+
+function resolve_base(base: string, known: ReadonlySet<string>): string | undefined {
+	return CANDIDATE_SUFFIXES.map((suffix) => `${base}${suffix}`).find((candidate) =>
+		known.has(candidate),
+	)
+}
+
+// A specifier resolved to a real file in the known set, or `undefined` when it is a package import or
+// resolves to nothing this scan holds.
+function resolve_spec(
+	spec: string,
+	importer: string,
+	root: string,
+	known: ReadonlySet<string>,
+): string | undefined {
+	const base = specifier_base(spec, importer, root)
+
+	return base === undefined ? undefined : resolve_base(base, known)
+}
+
+function read_source(file: string): string {
+	try {
+		return readFileSync(file, 'utf8')
+	} catch {
+		return ''
+	}
+}
+
+function file_imports(file: string, root: string, known: ReadonlySet<string>): ReadonlySet<string> {
+	const specifiers = parse_imports(read_source(file))
+	const resolved = specifiers.map((spec) => resolve_spec(spec, file, root, known))
+
+	return new Set(resolved.filter((target): target is string => target !== undefined))
+}
+
+// File → the files it imports, over the whole universe so a seed's importers can be found by inversion.
+function build_forward(files: ReadonlyArray<string>, root: string): FileGraph {
+	const known = new Set(files)
+	const forward = new Map<string, ReadonlySet<string>>()
+
+	for (const file of files) forward.set(file, file_imports(file, root, known))
+
+	return forward
+}
+
+function add_importer(reverse: Map<string, Set<string>>, target: string, importer: string): void {
+	const importers = reverse.get(target) ?? new Set<string>()
+
+	importers.add(importer)
+	reverse.set(target, importers)
+}
+
+// File → the files that import it, so the walk can follow edges in both directions.
+function invert(forward: FileGraph): FileGraph {
+	const reverse = new Map<string, Set<string>>()
+
+	for (const [file, targets] of forward) {
+		for (const target of targets) add_importer(reverse, target, file)
+	}
+
+	return reverse
+}
+
+function neighbors_of(file: string, forward: FileGraph, reverse: FileGraph): ReadonlyArray<string> {
+	return [...(forward.get(file) ?? []), ...(reverse.get(file) ?? [])]
+}
+
+interface Graphs {
+	forward: FileGraph
+	reverse: FileGraph
+}
+
+function fresh_neighbors(
+	file: string,
+	graphs: Graphs,
+	included: ReadonlySet<string>,
+): ReadonlyArray<string> {
+	return neighbors_of(file, graphs.forward, graphs.reverse).filter(
+		(neighbor) => !included.has(neighbor),
+	)
+}
+
+function next_frontier(
+	frontier: ReadonlyArray<string>,
+	graphs: Graphs,
+	included: ReadonlySet<string>,
+): ReadonlyArray<string> {
+	const found = new Set<string>()
+
+	for (const file of frontier) {
+		for (const neighbor of fresh_neighbors(file, graphs, included)) found.add(neighbor)
+	}
+
+	return [...found]
+}
+
+// The seed set plus every file reachable within `MAX_STAGES` import hops in either direction. A stage
+// that adds nothing leaves the next `next_frontier` empty, so the walk converges within the cap.
+function expand(
+	seed: ReadonlyArray<string>,
+	forward: FileGraph,
+	reverse: FileGraph,
+): ReadonlySet<string> {
+	const included = new Set<string>(seed)
+	let frontier: ReadonlyArray<string> = seed
+
+	for (let stage = 0; stage < MAX_STAGES; stage++) {
+		frontier = next_frontier(frontier, { forward, reverse }, included)
+
+		for (const file of frontier) included.add(file)
+	}
+
+	return included
+}
+
+// The whole §4.3 walk: build the graph over the universe, then expand the seed within it.
+function expand_scope(
+	seed: ReadonlyArray<string>,
+	universe: ReadonlyArray<string>,
+	root: string,
+): ReadonlySet<string> {
+	const forward = build_forward(universe, root)
+
+	return expand(seed, forward, invert(forward))
+}
+
+const import_graph = {
+	build_forward,
+	expand,
+	expand_scope,
+	invert,
+	neighbors_of,
+	parse_imports,
+	resolve_spec,
+	MAX_STAGES,
+}
+
+export type { FileGraph }
+export { import_graph }

package/scripts/refactor/refactor-lint.ts

@@ -0,0 +1,250 @@
+import path from 'node:path'
+import { find_local_bin_upwards } from '#scripts/build/local-bin'
+import { execa } from 'execa'
+import { z } from 'zod'
+
+// The mechanical half of `prompts/refactoring.md` (joshuafolkken/kit#2255): the refactoring
+// priorities ESLint already decides. Rather than read the checklist and grep by hand, the project's
+// own eslint is asked in JSON and its findings are bucketed into the checklist's items.
+//
+// **The count is the gate's own, not a second one.** As in `line-budget.ts`, the project's eslint is
+// spawned — its findings, its rule severities — so this can never disagree with `pnpm josh gate`
+// about what is there. `local/namespace-object-export` is now among the rules queried — the rule
+// exists, so the oracle reads it like any other rather than deferring it to the gate. Only the two
+// priorities with no rule stay prose (side-effect idempotency and "similar UI structure"), and
+// `refactor-scan-prompt-sync.test.ts` fails if this list and the prompt drift apart.
+
+const ESLINT_BIN = 'eslint'
+const PNPM = 'pnpm'
+const PNPM_EXEC = 'exec'
+// `--no-inline-config` so a `/* eslint-disable */` in a file cannot hide a candidate from the scan the
+// way it can from the gate; the scan reports what the rules say, not what a file asked to suppress.
+const FORMAT_FLAGS: ReadonlyArray<string> = ['--format', 'json', '--no-inline-config']
+const PROCESS_TIMEOUT_MS = 180_000
+
+type Priority = 'high' | 'medium' | 'low'
+const HIGH: Priority = 'high'
+const MEDIUM: Priority = 'medium'
+const LOW: Priority = 'low'
+
+interface RefactorCategory {
+	key: string
+	label: string
+	priority: Priority
+	rules: ReadonlyArray<string>
+}
+
+// The refactoring priorities ESLint decides, each with the rules that populate it — the high- and
+// medium-priority convergence items plus the one low-priority item (unused code), which is reported
+// but never counted toward convergence. `refactor-scan-prompt-sync.test.ts` pins this list against
+// the prompt, so a rule added here without the prompt (or the reverse) fails.
+const CATEGORIES: ReadonlyArray<RefactorCategory> = [
+	{
+		key: 'lines-complexity',
+		label: 'lines & complexity',
+		priority: HIGH,
+		rules: ['max-lines', 'max-lines-per-function', 'complexity', 'sonarjs/cognitive-complexity'],
+	},
+	{
+		key: 'type-safety',
+		label: 'type safety',
+		priority: HIGH,
+		rules: ['@typescript-eslint/no-explicit-any'],
+	},
+	{
+		key: 'namespace-export',
+		label: 'namespace-object export',
+		priority: HIGH,
+		rules: ['local/namespace-object-export'],
+	},
+	{
+		key: 'duplicate-code',
+		label: 'duplicate code',
+		priority: HIGH,
+		rules: ['sonarjs/no-identical-functions'],
+	},
+	{
+		key: 'duplicate-string',
+		label: 'duplicate string',
+		priority: MEDIUM,
+		rules: ['sonarjs/no-duplicate-string'],
+	},
+	{
+		key: 'magic-number',
+		label: 'magic number',
+		priority: MEDIUM,
+		rules: ['@typescript-eslint/no-magic-numbers'],
+	},
+	{
+		key: 'naming-convention',
+		label: 'variable naming',
+		priority: MEDIUM,
+		rules: ['@typescript-eslint/naming-convention'],
+	},
+	{
+		key: 'unused-code',
+		label: 'unused code',
+		priority: LOW,
+		rules: ['@typescript-eslint/no-unused-vars'],
+	},
+]
+
+const message_schema = z.object({
+	ruleId: z.string().nullish(),
+	line: z.number().nullish(),
+})
+const results_schema = z.array(
+	z.object({ filePath: z.string(), messages: z.array(message_schema) }),
+)
+type LintResult = z.infer<typeof results_schema>[number]
+
+interface Candidate {
+	location: string
+	rule: string
+}
+
+interface CategoryResult {
+	key: string
+	label: string
+	priority: Priority
+	candidates: ReadonlyArray<Candidate>
+}
+
+// Rule id → the category it belongs to, built once so `categorize` is a lookup rather than a scan of
+// every category per message.
+function rule_index(): ReadonlyMap<string, RefactorCategory> {
+	const index = new Map<string, RefactorCategory>()
+
+	for (const category of CATEGORIES) for (const rule of category.rules) index.set(rule, category)
+
+	return index
+}
+
+const RULE_INDEX = rule_index()
+
+type Message = z.infer<typeof message_schema>
+
+function message_category(rule_id: string | null | undefined): RefactorCategory | undefined {
+	return rule_id === null || rule_id === undefined ? undefined : RULE_INDEX.get(rule_id)
+}
+
+function candidate_of(message: Message, root: string, file_path: string): Candidate {
+	const location = `${path.relative(root, file_path)}:${String(message.line ?? 0)}`
+
+	return { location, rule: message.ruleId ?? '' }
+}
+
+function collect_message(
+	message: Message,
+	root: string,
+	file_path: string,
+	buckets: Map<string, Array<Candidate>>,
+): void {
+	const category = message_category(message.ruleId)
+
+	if (category === undefined) return
+
+	buckets.get(category.key)?.push(candidate_of(message, root, file_path))
+}
+
+function candidates_by_category(
+	results: LintResult,
+	root: string,
+	buckets: Map<string, Array<Candidate>>,
+): void {
+	for (const message of results.messages) collect_message(message, root, results.filePath, buckets)
+}
+
+function empty_buckets(): Map<string, Array<Candidate>> {
+	const buckets = new Map<string, Array<Candidate>>()
+
+	for (const category of CATEGORIES) buckets.set(category.key, [])
+
+	return buckets
+}
+
+// The categories with their candidates, in the fixed order above so the report reads the same every
+// run. A category with no findings is kept, printed as zero rather than dropped.
+function categorize(results: Array<LintResult>, root: string): ReadonlyArray<CategoryResult> {
+	const buckets = empty_buckets()
+
+	for (const result of results) candidates_by_category(result, root, buckets)
+
+	return CATEGORIES.map((category) => ({
+		key: category.key,
+		label: category.label,
+		priority: category.priority,
+		candidates: buckets.get(category.key) ?? [],
+	}))
+}
+
+function eslint_command(root: string, files: ReadonlyArray<string>): ReadonlyArray<string> {
+	const shim = find_local_bin_upwards(root, ESLINT_BIN)
+	const args = [...FORMAT_FLAGS, ...files]
+
+	return shim === undefined ? [PNPM, PNPM_EXEC, ESLINT_BIN, ...args] : [shim, ...args]
+}
+
+// `undefined` means the run did not produce parseable eslint JSON — a failure, kept distinct from a
+// valid empty array (a clean scope), so a scan that could not run is never reported as `clear`
+// (joshuafolkken/kit#2180).
+function parse_results(raw: string | undefined): Array<LintResult> | undefined {
+	try {
+		const parsed = results_schema.safeParse(JSON.parse(raw ?? 'null'))
+
+		return parsed.success ? parsed.data : undefined
+	} catch {
+		return undefined
+	}
+}
+
+// The project's own eslint over the scope, in JSON. `reject: false` because eslint exits non-zero when
+// it finds anything — which it will — and the JSON is on stdout regardless. An empty file list is a
+// clean answer (`[]`); a spawn error or unparseable output is a failure (`undefined`), so the caller
+// can tell "no candidates" from "the scan did not run".
+async function run_eslint_json(
+	files: ReadonlyArray<string>,
+	root: string,
+): Promise<Array<LintResult> | undefined> {
+	if (files.length === 0) return []
+
+	const [bin, ...command_arguments] = eslint_command(root, files)
+
+	try {
+		const result = await execa(bin ?? PNPM, command_arguments, {
+			cwd: root,
+			reject: false,
+			stdout: 'pipe',
+			stderr: 'ignore',
+			timeout: PROCESS_TIMEOUT_MS,
+		})
+
+		return parse_results(result.stdout)
+	} catch {
+		return undefined
+	}
+}
+
+// The categories, or `undefined` when the eslint run failed — the failure is propagated rather than
+// flattened to an empty (and therefore `clear`) result.
+async function scan_categories(
+	files: ReadonlyArray<string>,
+	root: string,
+): Promise<ReadonlyArray<CategoryResult> | undefined> {
+	const results = await run_eslint_json(files, root)
+
+	return results === undefined ? undefined : categorize(results, root)
+}
+
+const refactor_lint = {
+	categorize,
+	parse_results,
+	scan_categories,
+	CATEGORIES,
+	HIGH,
+	MEDIUM,
+	LOW,
+}
+
+export type { CategoryResult, Priority }
+export { refactor_lint }

package/scripts/refactor/refactor-scan-cli.ts

@@ -0,0 +1,10 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { refactor_scan } from './refactor-scan'
+
+// The `josh refactor:scan` entry point. It takes no arguments: the scope is the changed files, or
+// `scripts/` when nothing changed, decided the same way for every run (joshuafolkken/kit#2180).
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+	process.exitCode = await refactor_scan.run_scan()
+}