@rigour-labs/core 6.2.5 → 6.3.1

package/dist/gates/deprecated-apis.js

@@ -22,6 +22,7 @@ import { Gate } from './base.js';
 import { FileScanner } from '../utils/scanner.js';
 import { Logger } from '../utils/logger.js';
 import { languageAdapters } from './language-adapters/index.js';
+import { findWithStatements } from './deprecated-apis-ast.js';
 import fs from 'fs-extra';
 import path from 'path';
 import { NODE_DEPRECATED_RULES, WEB_DEPRECATED_RULES, PYTHON_DEPRECATED_RULES, GO_DEPRECATED_RULES, CSHARP_DEPRECATED_RULES, JAVA_DEPRECATED_RULES } from './deprecated-apis-rules.js';
@@ -81,8 +82,11 @@ export class DeprecatedApisGate extends Gate {
                     case 'js':
                         if (this.config.check_node)
                             this.checkNodeDeprecated(content, file, deprecated);
-                        if (this.config.check_web)
+                        if (this.config.check_web) {
                             this.checkWebDeprecated(content, file, deprecated);
+                            for (const w of findWithStatements(content, file))
+                                deprecated.push({ file, ...w });
+                        }
                         break;
                     case 'python':
                         this.checkPythonDeprecated(content, file, deprecated);

package/dist/gates/deprecated-apis.test.js

@@ -286,3 +286,33 @@ class Resource {
         expect(failures[0].details).toContain('finalize');
     });
 });
+describe('DeprecatedApisGate — word fragments and non-code text', () => {
+    let gate;
+    beforeEach(() => {
+        gate = new DeprecatedApisGate();
+        vi.clearAllMocks();
+    });
+    async function apisFor(file, source) {
+        mockFindFiles.mockResolvedValue([file]);
+        mockReadFile.mockResolvedValue(source);
+        const failures = await gate.run({ cwd: '/project' });
+        return failures.map(f => f.details).join('\n');
+    }
+    it('does not flag ArrayBuffer or SharedArrayBuffer as the Buffer() constructor', async () => {
+        const details = await apisFor('src/lib/ingestion-proxy.ts', 'const empty = new ArrayBuffer(0);\nconst shared = new SharedArrayBuffer(8);\n');
+        expect(details).not.toContain('Buffer() constructor');
+    });
+    it('still flags a bare Buffer() constructor call', async () => {
+        expect(await apisFor('src/handler.js', "const b = Buffer(10);\n")).toContain('Buffer() constructor');
+    });
+    it('does not flag "with (" inside a trailing comment or a string', async () => {
+        const details = await apisFor('src/lib/aliases.ts', [
+            "const pattern = compile(source); // match with (optional) prefix",
+            "const label = 'works with (legacy) clients';",
+        ].join('\n'));
+        expect(details).not.toContain('with statement');
+    });
+    it('still flags a real with statement', async () => {
+        expect(await apisFor('src/legacy.js', 'with (obj) {\n  x = 1;\n}\n')).toContain('with statement');
+    });
+});

package/dist/gates/frontend-secret-exposure.js

@@ -62,8 +62,12 @@ export class FrontendSecretExposureGate extends Gate {
                 '(^|/)e2e/',
                 '(^|/)tests/',
                 '(^|/)server/',
-                '(^|/)(?:playwright|vitest|vite|jest|next|webpack|eslint|prettier|tailwind|postcss|babel|tsup|rollup)\\.config\\.[cm]?[jt]s$',
+                '(^|/)(?:playwright|vitest|vite|jest|next|webpack|eslint|prettier|tailwind|postcss|babel|tsup|rollup|drizzle|svelte|astro|nuxt|remix|wrangler|knip|commitlint|esbuild|turbo)\\.config\\.[cm]?[jt]s$',
+                // Any tool config at the repository root runs in Node, never in a browser bundle.
+                '^[^/]+\\.config\\.[cm]?[jt]s$',
                 '\\.server\\.(?:ts|tsx|js|jsx|mjs|cjs)$',
+                // SvelteKit endpoints (`+server.ts`) are server-only.
+                '(^|/)\\+server\\.[cm]?[jt]s$',
                 ...(config.server_path_patterns ?? []),
             ],
             allowlist_env_names: config.allowlist_env_names ?? [],

package/dist/gates/frontend-secret-exposure.test.js

@@ -108,4 +108,24 @@ describe('FrontendSecretExposureGate', () => {
         const failures = await gate.run({ cwd: testDir });
         expect(failures).toHaveLength(0);
     });
+    it('treats SvelteKit endpoints and root tool configs as server code', async () => {
+        const files = {
+            'src/routes/api/sync/+server.ts': 'export const GET = () => fetch(url, { headers: { key: process.env.STRIPE_SECRET_KEY } });\n',
+            'drizzle.config.ts': 'export default { dbCredentials: { url: process.env.DATABASE_SECRET_URL } };\n',
+            'apps/web/drizzle.config.ts': 'export default { dbCredentials: { url: process.env.DATABASE_SECRET_URL } };\n',
+        };
+        for (const [rel, body] of Object.entries(files)) {
+            fs.mkdirSync(path.dirname(path.join(testDir, rel)), { recursive: true });
+            fs.writeFileSync(path.join(testDir, rel), body);
+        }
+        const failures = await new FrontendSecretExposureGate().run({ cwd: testDir });
+        expect(failures).toHaveLength(0);
+    });
+    it('still flags a secret in a config module inside the client source tree', async () => {
+        const filePath = path.join(testDir, 'src/components/site.config.ts');
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        fs.writeFileSync(filePath, 'export const key = process.env.STRIPE_SECRET_KEY;\n');
+        const failures = await new FrontendSecretExposureGate().run({ cwd: testDir });
+        expect(failures.length).toBeGreaterThan(0);
+    });
 });

package/dist/gates/hallucinated-imports/framework-modules.d.ts

@@ -0,0 +1,14 @@
+/** SvelteKit project root for a file (nearest package.json depending on the kit), cached per directory. */
+export declare class SvelteKitRoots {
+    private readonly cwd;
+    private cache;
+    constructor(cwd: string);
+    rootFor(file: string): Promise<string | null>;
+}
+/** `$app/*`, `$env/*`, `$service-worker`, or a route's generated `./$types`. */
+export declare function isSvelteKitProvided(importPath: string): boolean;
+/**
+ * Resolve `$lib` / `$lib/...` to the kit's default `src/lib` folder.
+ * Returns null when the import is not a `$lib` import.
+ */
+export declare function resolveSvelteKitLib(importPath: string, kitRoot: string, cwd: string, projectFiles: Set<string>): Promise<boolean | null>;

package/dist/gates/hallucinated-imports/framework-modules.js

@@ -0,0 +1,75 @@
+/**
+ * Framework-provided modules that no package.json or tsconfig declares.
+ *
+ * SvelteKit supplies `$app/*`, `$env/*` and `$service-worker` as virtual
+ * modules and generates each route's `./$types`. Its `$lib` alias lives in
+ * `.svelte-kit/tsconfig.json`, which `svelte-kit sync` generates and git
+ * ignores, so on a fresh clone or in CI the tsconfig mapping is missing and
+ * `$lib/...` would be read as an uninstalled package.
+ */
+import fs from 'fs-extra';
+import path from 'path';
+import { resolveTsPathTarget } from './ts-path-target.js';
+const SVELTEKIT_PACKAGE = '@sveltejs/kit';
+const SVELTEKIT_VIRTUAL = /^(?:\$app|\$env)\/|^\$service-worker$/;
+const GENERATED_TYPES = /^\.{1,2}\/(?:.*\/)?\$types(?:\.d\.ts|\.js)?$/;
+const LIB_ALIAS = /^\$lib(?:\/(.*))?$/;
+/** SvelteKit project root for a file (nearest package.json depending on the kit), cached per directory. */
+export class SvelteKitRoots {
+    cwd;
+    cache = new Map();
+    constructor(cwd) {
+        this.cwd = cwd;
+    }
+    async rootFor(file) {
+        const top = path.resolve(this.cwd);
+        const visited = [];
+        let dir = path.dirname(path.resolve(this.cwd, file));
+        let found = null;
+        while (dir.startsWith(top)) {
+            if (this.cache.has(dir)) {
+                found = this.cache.get(dir) ?? null;
+                break;
+            }
+            visited.push(dir);
+            if (await declaresKit(path.join(dir, 'package.json'))) {
+                found = dir;
+                break;
+            }
+            const parent = path.dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
+        }
+        for (const d of visited)
+            this.cache.set(d, found);
+        return found;
+    }
+}
+async function declaresKit(packageJsonPath) {
+    if (!(await fs.pathExists(packageJsonPath)))
+        return false;
+    try {
+        const pkg = await fs.readJson(packageJsonPath);
+        return [pkg?.dependencies, pkg?.devDependencies, pkg?.peerDependencies]
+            .some(deps => !!deps && Object.prototype.hasOwnProperty.call(deps, SVELTEKIT_PACKAGE));
+    }
+    catch {
+        return false;
+    }
+}
+/** `$app/*`, `$env/*`, `$service-worker`, or a route's generated `./$types`. */
+export function isSvelteKitProvided(importPath) {
+    return SVELTEKIT_VIRTUAL.test(importPath) || GENERATED_TYPES.test(importPath);
+}
+/**
+ * Resolve `$lib` / `$lib/...` to the kit's default `src/lib` folder.
+ * Returns null when the import is not a `$lib` import.
+ */
+export async function resolveSvelteKitLib(importPath, kitRoot, cwd, projectFiles) {
+    const match = importPath.match(LIB_ALIAS);
+    if (!match)
+        return null;
+    const target = match[1] ? path.join('src/lib', match[1]) : 'src/lib';
+    return resolveTsPathTarget(kitRoot, target, cwd, projectFiles);
+}

package/dist/gates/hallucinated-imports/index.js

@@ -24,6 +24,7 @@ import fs from 'fs-extra';
 import path from 'path';
 import { checkGoImports, checkRubyImports, checkCSharpImports, checkRustImports, checkJavaKotlinImports } from '../hallucinated-imports-lang.js';
 import { checkJSImports } from './js-resolver.js';
+import { SvelteKitRoots } from './framework-modules.js';
 import { checkPyImports } from './python-resolver.js';
 import { discoverWorkspacePackages, loadPackageJson } from './manifest-discovery.js';
 export class HallucinatedImportsGate extends Gate {
@@ -47,6 +48,8 @@ export class HallucinatedImportsGate extends Gate {
         const failures = [];
         const hallucinated = [];
         const defaultPatterns = ['**/*.{ts,js,tsx,jsx,py,go,rb,cs,rs,java,kt}'];
+        // Imports can target component files that are not scanned themselves.
+        const resolutionPatterns = ['**/*.{ts,js,tsx,jsx,mjs,cjs,py,go,rb,cs,rs,java,kt,svelte,vue,astro}'];
         const scanPatterns = context.patterns || defaultPatterns;
         const ignore = [...(context.ignore || []), '**/node_modules/**', '**/dist/**', '**/build/**',
             '**/examples/**', '**/studio-dist/**', '**/.next/**', '**/coverage/**',
@@ -60,11 +63,9 @@ export class HallucinatedImportsGate extends Gate {
         });
         const analyzableFiles = files.filter(file => !this.shouldSkipFile(file));
         Logger.info(`Hallucinated Imports: Scanning ${analyzableFiles.length} files`);
-        // A scoped review scans changed files, but relative imports may point
-        // to unchanged files. Resolve against the project, not the edit set.
-        const resolutionFiles = context.patterns
-            ? await FileScanner.findFiles({ cwd: context.cwd, patterns: defaultPatterns, ignore })
-            : files;
+        // Resolve against the whole project, not the scanned set: a scoped
+        // review scans changed files only, and imports may target components.
+        const resolutionFiles = await FileScanner.findFiles({ cwd: context.cwd, patterns: resolutionPatterns, ignore });
         const projectFiles = new Set(resolutionFiles.map(f => f.replace(/\\/g, '/')));
         const allProjectFiles = projectFiles;
         const packageJson = await loadPackageJson(context.cwd);
@@ -80,6 +81,13 @@ export class HallucinatedImportsGate extends Gate {
         const depCacheByDir = new Map();
         const tsPathCacheByDir = new Map();
         const hasNodeModules = await fs.pathExists(path.join(context.cwd, 'node_modules'));
+        const jsContext = {
+            cwd: context.cwd, projectFiles, rootDeps, depCacheByDir, hasNodeModules, hallucinated, tsPathCacheByDir,
+            kitRoots: new SvelteKitRoots(context.cwd),
+            shouldIgnore: (importPath) => this.shouldIgnore(importPath),
+            resolveRelativeImport: (fromFile, importPath, files) => this.resolveRelativeImport(fromFile, importPath, files),
+            extractPackageName: (importPath) => this.extractPackageName(importPath),
+        };
         for (const file of analyzableFiles) {
             try {
                 const fullPath = path.join(context.cwd, file);
@@ -90,7 +98,7 @@ export class HallucinatedImportsGate extends Gate {
                     continue;
                 switch (adapter.id) {
                     case 'js':
-                        await checkJSImports(content, file, context.cwd, projectFiles, rootDeps, depCacheByDir, hasNodeModules, hallucinated, tsPathCacheByDir, (importPath) => this.shouldIgnore(importPath), (resolvedPath) => this.buildImportCandidates(resolvedPath), (fromFile, importPath, files) => this.resolveRelativeImport(fromFile, importPath, files), (importPath) => this.extractPackageName(importPath));
+                        await checkJSImports(content, file, jsContext);
                         break;
                     case 'python':
                         await checkPyImports(content, file, context.cwd, projectFiles, hallucinated);

package/dist/gates/hallucinated-imports/js-resolver.d.ts

@@ -9,21 +9,26 @@
  * - node_modules dependency verification
  */
 import { HallucinatedImport } from './index.js';
-interface TsPathRule {
-    key: string;
-    hasWildcard: boolean;
-    prefix: string;
-    suffix: string;
-    targets: string[];
-}
-interface TsPathConfig {
-    baseDir: string;
-    rules: TsPathRule[];
+import { type SvelteKitRoots } from './framework-modules.js';
+import { type TsPathConfig } from './tsconfig-paths.js';
+/** Everything a JS/TS import check needs besides the file itself. */
+export interface JsImportContext {
+    cwd: string;
+    projectFiles: Set<string>;
+    rootDeps: Set<string>;
+    depCacheByDir: Map<string, Set<string>>;
+    hasNodeModules: boolean;
+    hallucinated: HallucinatedImport[];
+    tsPathCacheByDir: Map<string, TsPathConfig | null>;
+    kitRoots: SvelteKitRoots;
+    shouldIgnore: (importPath: string) => boolean;
+    resolveRelativeImport: (fromFile: string, importPath: string, projectFiles: Set<string>) => boolean;
+    extractPackageName: (importPath: string) => string;
 }
 /**
  * Check JavaScript/TypeScript imports in a source file and add hallucinated findings.
  */
-export declare function checkJSImports(content: string, file: string, cwd: string, projectFiles: Set<string>, rootDeps: Set<string>, depCacheByDir: Map<string, Set<string>>, hasNodeModules: boolean, hallucinated: HallucinatedImport[], tsPathCacheByDir: Map<string, TsPathConfig | null>, shouldIgnore: (importPath: string) => boolean, buildImportCandidates: (resolvedPath: string) => string[], resolveRelativeImport: (fromFile: string, importPath: string, projectFiles: Set<string>) => boolean, extractPackageName: (importPath: string) => string): Promise<void>;
+export declare function checkJSImports(content: string, file: string, ctx: JsImportContext): Promise<void>;
 /**
  * Collect all import statements from JavaScript/TypeScript file content.
  * Handles import, export, require(), and dynamic import() statements.
@@ -42,4 +47,3 @@ export declare function resolveJSDepsForFile(file: string, cwd: string, rootDeps
  * Returns true if resolved, false if alias exists but doesn't resolve, null if no alias found.
  */
 export declare function resolveTsPathAlias(file: string, importPath: string, cwd: string, projectFiles: Set<string>, tsPathCacheByDir: Map<string, TsPathConfig | null>): Promise<boolean | null>;
-export {};

package/dist/gates/hallucinated-imports/js-resolver.js

@@ -13,51 +13,78 @@ import path from 'path';
 import ts from 'typescript';
 import { isNodeBuiltin } from '../hallucinated-imports-stdlib.js';
 import { resolveTsPathTarget } from './ts-path-target.js';
+import { isSvelteKitProvided, resolveSvelteKitLib } from './framework-modules.js';
+import { loadTsPathConfig } from './tsconfig-paths.js';
 /**
  * Check JavaScript/TypeScript imports in a source file and add hallucinated findings.
  */
-export async function checkJSImports(content, file, cwd, projectFiles, rootDeps, depCacheByDir, hasNodeModules, hallucinated, tsPathCacheByDir, shouldIgnore, buildImportCandidates, resolveRelativeImport, extractPackageName) {
-    const depsForFile = await resolveJSDepsForFile(file, cwd, rootDeps, depCacheByDir);
-    for (const spec of collectJSImportSpecs(content, file)) {
-        const { importPath, line } = spec;
-        if (!importPath || shouldIgnore(importPath))
+export async function checkJSImports(content, file, ctx) {
+    const depsForFile = await resolveJSDepsForFile(file, ctx.cwd, ctx.rootDeps, ctx.depCacheByDir);
+    const kitRoot = await ctx.kitRoots.rootFor(file);
+    for (const { importPath, line } of collectJSImportSpecs(content, file)) {
+        if (!importPath || ctx.shouldIgnore(importPath))
             continue;
-        if (importPath.startsWith('.')) {
-            const resolved = resolveRelativeImport(file, importPath, projectFiles);
-            if (!resolved) {
-                hallucinated.push({
-                    file, line, importPath, type: 'relative',
-                    reason: `File not found: ${importPath}`,
-                });
-            }
+        if (kitRoot && isSvelteKitProvided(importPath))
+            continue;
+        const reason = importPath.startsWith('.')
+            ? await checkRelativeImport(file, importPath, ctx)
+            : await checkBareImport(file, importPath, depsForFile, kitRoot, ctx);
+        if (reason) {
+            ctx.hallucinated.push({
+                file, line, importPath,
+                type: importPath.startsWith('.') ? 'relative' : 'package',
+                reason,
+            });
         }
-        else {
-            const aliasResolution = await resolveTsPathAlias(file, importPath, cwd, projectFiles, tsPathCacheByDir);
-            if (aliasResolution === true)
-                continue;
-            if (aliasResolution === false) {
-                hallucinated.push({
-                    file, line, importPath, type: 'package',
-                    reason: `Path alias '${importPath}' does not resolve to a project file`,
-                });
-                continue;
-            }
-            const pkgName = extractPackageName(importPath);
-            if (isNodeBuiltin(pkgName))
-                continue;
-            if (!depsForFile.has(pkgName)) {
-                if (hasNodeModules) {
-                    const pkgPath = path.join(cwd, 'node_modules', pkgName);
-                    if (await fs.pathExists(pkgPath))
-                        continue;
-                }
-                hallucinated.push({
-                    file, line, importPath, type: 'package',
-                    reason: `Package '${pkgName}' not in package.json dependencies`,
-                });
-            }
+    }
+}
+async function checkRelativeImport(file, importPath, ctx) {
+    if (ctx.resolveRelativeImport(file, importPath, ctx.projectFiles))
+        return null;
+    const config = await resolveTsPathConfigForFile(file, ctx.cwd, ctx.tsPathCacheByDir);
+    if (config?.rootDirs.length && await resolveThroughRootDirs(file, importPath, config.rootDirs, ctx))
+        return null;
+    return `File not found: ${importPath}`;
+}
+/**
+ * tsconfig `rootDirs`: directories merged into one virtual root, so
+ * `./$types` next to `src/routes/+page.ts` can live in
+ * `.svelte-kit/types/src/routes/$types.d.ts`. Generated folders are often
+ * git-ignored and absent from the file list, so resolution checks the disk.
+ */
+async function resolveThroughRootDirs(file, importPath, rootDirs, ctx) {
+    const target = path.resolve(path.dirname(path.resolve(ctx.cwd, file)), importPath);
+    for (const root of rootDirs) {
+        const relative = path.relative(root, target);
+        if (relative.startsWith('..') || path.isAbsolute(relative))
+            continue;
+        for (const other of rootDirs) {
+            if (other !== root && await resolveTsPathTarget(other, relative, ctx.cwd, ctx.projectFiles))
+                return true;
         }
     }
+    return false;
+}
+/** Reason the bare import is hallucinated, or null when it resolves. */
+async function checkBareImport(file, importPath, depsForFile, kitRoot, ctx) {
+    const aliasResolution = await resolveTsPathAlias(file, importPath, ctx.cwd, ctx.projectFiles, ctx.tsPathCacheByDir);
+    if (aliasResolution === true)
+        return null;
+    if (aliasResolution === false)
+        return `Path alias '${importPath}' does not resolve to a project file`;
+    if (kitRoot) {
+        const lib = await resolveSvelteKitLib(importPath, kitRoot, ctx.cwd, ctx.projectFiles);
+        if (lib === true)
+            return null;
+        if (lib === false)
+            return `Path alias '${importPath}' does not resolve to a file under src/lib`;
+    }
+    const pkgName = ctx.extractPackageName(importPath);
+    if (isNodeBuiltin(pkgName) || depsForFile.has(pkgName))
+        return null;
+    if (ctx.hasNodeModules && await fs.pathExists(path.join(ctx.cwd, 'node_modules', pkgName)))
+        return null;
+    return `Package '${pkgName}' not in package.json dependencies`;
 }
 /**
  * Collect all import statements from JavaScript/TypeScript file content.
@@ -196,118 +223,3 @@ async function resolveTsPathConfigForFile(file, cwd, tsPathCacheByDir) {
     }
     return null;
 }
-/**
- * Load TypeScript path aliases from tsconfig.json, jsconfig.json, or tsconfig.base.json.
- * Follows the extends chain to merge path mappings.
- */
-async function loadTsPathConfig(searchDir) {
-    const candidates = ['tsconfig.json', 'jsconfig.json', 'tsconfig.base.json'];
-    for (const configName of candidates) {
-        const configPath = path.join(searchDir, configName);
-        if (!(await fs.pathExists(configPath)))
-            continue;
-        const mergedPaths = {};
-        let baseUrl = '.';
-        let resolvedBaseDir = searchDir;
-        await resolveExtendsChain(configPath, mergedPaths, (bu) => { baseUrl = bu; }, new Set());
-        const parsed = await readLooseJson(configPath);
-        const compilerOptions = parsed?.compilerOptions || {};
-        if (compilerOptions.paths) {
-            for (const [key, value] of Object.entries(compilerOptions.paths)) {
-                if (typeof key === 'string' && Array.isArray(value)) {
-                    mergedPaths[key] = value;
-                }
-            }
-        }
-        if (compilerOptions.baseUrl)
-            baseUrl = compilerOptions.baseUrl;
-        if (Object.keys(mergedPaths).length === 0)
-            continue;
-        resolvedBaseDir = path.resolve(searchDir, baseUrl);
-        const rules = [];
-        for (const [key, value] of Object.entries(mergedPaths)) {
-            if (typeof key !== 'string' || !Array.isArray(value) || value.length === 0)
-                continue;
-            const hasWildcard = key.includes('*');
-            const [prefix, suffix = ''] = key.split('*');
-            const targets = value.filter(v => typeof v === 'string');
-            if (targets.length === 0)
-                continue;
-            rules.push({ key, hasWildcard, prefix, suffix, targets });
-        }
-        rules.sort((left, right) => {
-            if (left.hasWildcard !== right.hasWildcard)
-                return left.hasWildcard ? 1 : -1;
-            return (right.prefix.length + right.suffix.length)
-                - (left.prefix.length + left.suffix.length);
-        });
-        if (rules.length === 0)
-            continue;
-        return { baseDir: resolvedBaseDir, rules };
-    }
-    return null;
-}
-/**
- * Recursively follow tsconfig `extends` chain to collect path mappings.
- */
-async function resolveExtendsChain(configPath, mergedPaths, setBaseUrl, visited) {
-    const resolved = path.resolve(configPath);
-    if (visited.has(resolved))
-        return;
-    visited.add(resolved);
-    const parsed = await readLooseJson(configPath);
-    if (!parsed)
-        return;
-    if (parsed.extends) {
-        const extendsPath = typeof parsed.extends === 'string' ? parsed.extends : null;
-        if (extendsPath) {
-            let resolvedExtends;
-            if (extendsPath.startsWith('.')) {
-                resolvedExtends = path.resolve(path.dirname(configPath), extendsPath);
-            }
-            else {
-                resolvedExtends = path.resolve(path.dirname(configPath), 'node_modules', extendsPath);
-            }
-            if (!resolvedExtends.endsWith('.json')) {
-                const withJson = resolvedExtends + '.json';
-                if (await fs.pathExists(withJson)) {
-                    resolvedExtends = withJson;
-                }
-            }
-            if (await fs.pathExists(resolvedExtends)) {
-                await resolveExtendsChain(resolvedExtends, mergedPaths, setBaseUrl, visited);
-            }
-        }
-    }
-    const compilerOptions = parsed.compilerOptions || {};
-    if (compilerOptions.baseUrl) {
-        setBaseUrl(compilerOptions.baseUrl);
-    }
-    if (compilerOptions.paths) {
-        for (const [key, value] of Object.entries(compilerOptions.paths)) {
-            if (typeof key === 'string' && Array.isArray(value)) {
-                mergedPaths[key] = value;
-            }
-        }
-    }
-}
-/**
- * Read JSON file with support for comments and trailing commas.
- */
-async function readLooseJson(filePath) {
-    try {
-        const text = await fs.readFile(filePath, 'utf-8');
-        try {
-            return JSON.parse(text);
-        }
-        catch {
-            const noBlockComments = text.replace(/\/\*[\s\S]*?\*\//g, '');
-            const noLineComments = noBlockComments.replace(/(^|\s)\/\/.*$/gm, '$1');
-            const noTrailingCommas = noLineComments.replace(/,\s*([}\]])/g, '$1');
-            return JSON.parse(noTrailingCommas);
-        }
-    }
-    catch {
-        return null;
-    }
-}

package/dist/gates/hallucinated-imports/ts-path-target.js

@@ -1,6 +1,21 @@
 import fs from 'fs-extra';
 import path from 'path';
 const sourceExtensions = ['', '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.d.ts'];
+/** TypeScript ESM imports name the emitted file: `utils.js` for `utils.ts`. */
+const RUNTIME_TO_SOURCE = {
+    '.js': ['.ts', '.tsx', '.d.ts'],
+    '.jsx': ['.tsx'],
+    '.mjs': ['.mts', '.d.mts'],
+    '.cjs': ['.cts', '.d.cts'],
+};
+function sourceSiblings(target) {
+    const extension = path.extname(target);
+    const sources = RUNTIME_TO_SOURCE[extension];
+    if (!sources)
+        return [];
+    const base = target.slice(0, -extension.length);
+    return sources.map(source => base + source);
+}
 export async function resolveTsPathTarget(baseDir, candidatePattern, cwd, projectFiles) {
     const absolute = path.resolve(baseDir, candidatePattern);
     const relative = path.relative(cwd, absolute).replace(/\\/g, '/');
@@ -10,6 +25,7 @@ export async function resolveTsPathTarget(baseDir, candidatePattern, cwd, projec
     const candidates = [
         ...sourceExtensions.map(extension => normalized + extension),
         ...sourceExtensions.map(extension => `${normalized}/index${extension}`),
+        ...sourceSiblings(normalized),
     ];
     if (candidates.some(candidate => projectFiles.has(candidate)))
         return true;

package/dist/gates/hallucinated-imports/tsconfig-paths.d.ts

@@ -0,0 +1,16 @@
+export interface TsPathRule {
+    key: string;
+    hasWildcard: boolean;
+    prefix: string;
+    suffix: string;
+    targets: string[];
+}
+export interface TsPathConfig {
+    /** Directory `paths` targets are relative to: the effective baseUrl, else the declaring config's folder. */
+    baseDir: string;
+    rules: TsPathRule[];
+    /** Absolute `rootDirs`, each resolved against its declaring config. */
+    rootDirs: string[];
+}
+/** The first config in `searchDir` that defines `paths` or `rootDirs` (directly or inherited). */
+export declare function loadTsPathConfig(searchDir: string): Promise<TsPathConfig | null>;