@rigour-labs/core 6.4.4 → 6.5.1

package/dist/deep/self-check.d.ts

@@ -1,12 +1,17 @@
 /**
- * Self-check: the model re-reads each finding against the code and confirms
- * or withdraws it.
+ * Self-check: the model re-reads its findings against the code and confirms
+ * or withdraws each one.
  *
  * Two review passes with the reference material in different orders raise
- * recall (a finding one ordering misses, the other catches); asking again,
- * finding by finding, whether it would misbehave at runtime keeps that extra
- * recall from arriving as noise. A check that cannot run keeps the finding:
- * an unavailable model is not evidence against it.
+ * recall (a finding one ordering misses, the other catches); asking again
+ * whether each finding would misbehave at runtime keeps that extra recall
+ * from arriving as noise.
+ *
+ * All of a file's findings are checked in one call: the source and reference
+ * dominate the prompt, so checking finding by finding paid for them up to
+ * eight times per file. A check that cannot run, or a finding the reply does
+ * not mention, keeps the finding: an unavailable or vague model is not
+ * evidence against it.
  */
 import type { DeepFinding, InferenceOptions, InferenceProvider } from '../inference/types.js';
 import type { CodeContext } from './code-context.js';
@@ -16,6 +21,6 @@ export interface SelfCheckResult {
     failed: number;
 }
 export declare function selfCheck(provider: InferenceProvider, context: CodeContext, reference: string, findings: DeepFinding[], inference: InferenceOptions): Promise<SelfCheckResult>;
-export declare function checkPrompt(context: CodeContext, reference: string, finding: DeepFinding): string;
-/** true, false, or undefined when the reply is not a verdict. */
-export declare function parseVerdict(reply: string): boolean | undefined;
+export declare function checkPrompt(context: CodeContext, reference: string, findings: DeepFinding[]): string;
+/** Finding number → verdict; numbers the reply does not settle are absent. */
+export declare function parseVerdicts(reply: string): Map<number, boolean>;

package/dist/deep/self-check.js

@@ -1,49 +1,58 @@
-const MAX_CHECKED = 8;
-const VERDICT_SCHEMA = {
+const MAX_CHECKED = 12;
+const VERDICTS_SCHEMA = {
     type: 'object',
-    properties: { real: { type: 'boolean' }, reason: { type: 'string' } },
-    required: ['real'],
+    properties: {
+        verdicts: {
+            type: 'array',
+            items: {
+                type: 'object',
+                properties: { n: { type: 'integer' }, real: { type: 'boolean' }, reason: { type: 'string' } },
+                required: ['n', 'real'],
+            },
+        },
+    },
+    required: ['verdicts'],
 };
 export async function selfCheck(provider, context, reference, findings, inference) {
-    const result = { kept: [], withdrawn: 0, failed: 0 };
-    for (const [index, finding] of findings.entries()) {
-        if (index >= MAX_CHECKED) {
-            result.kept.push(finding);
-            continue;
-        }
-        try {
-            const reply = await provider.analyze(checkPrompt(context, reference, finding), { ...inference, jsonSchema: VERDICT_SCHEMA });
-            if (parseVerdict(reply) === false)
-                result.withdrawn++;
-            else
-                result.kept.push(finding);
-        }
-        catch {
-            result.failed++;
-            result.kept.push(finding);
-        }
+    const checked = findings.slice(0, MAX_CHECKED);
+    const unchecked = findings.slice(MAX_CHECKED);
+    let verdicts;
+    try {
+        verdicts = parseVerdicts(await provider.analyze(checkPrompt(context, reference, checked), { ...inference, jsonSchema: VERDICTS_SCHEMA }));
     }
-    return result;
+    catch {
+        return { kept: findings, withdrawn: 0, failed: checked.length };
+    }
+    const kept = checked.filter((_, index) => verdicts.get(index + 1) !== false);
+    return { kept: [...kept, ...unchecked], withdrawn: checked.length - kept.length, failed: 0 };
 }
-export function checkPrompt(context, reference, finding) {
+export function checkPrompt(context, reference, findings) {
+    const listed = findings.map((f, index) => `${index + 1}. ${context.file}:${f.line}: ${f.description}`).join('\n');
     return [
-        'You reported a defect in a code review. Check it against the code before it is posted.',
+        `You reported ${findings.length} defect(s) in a code review. Check each against the code before it is posted.`,
         `SOURCE (line numbers on the left):\n${context.text}`,
         reference ? `REFERENCE (not under review):\n${reference}` : '',
-        `REPORTED at ${context.file}:${finding.line}: ${finding.description}`,
-        'Is this a real defect: would this code misbehave at runtime or in production as described? '
+        `REPORTED:\n${listed}`,
+        'For each one: is it a real defect, would this code misbehave at runtime or in production as described? '
             + 'Answer false if it is style, speculation about unseen callers, or already handled in the code shown. '
-            + 'Respond ONLY with JSON: {"real": true|false, "reason": "..."}.',
+            + 'Respond ONLY with JSON: {"verdicts": [{"n": 1, "real": true|false, "reason": "..."}, ...]}.',
     ].filter(Boolean).join('\n\n');
 }
-/** true, false, or undefined when the reply is not a verdict. */
-export function parseVerdict(reply) {
+/** Finding number → verdict; numbers the reply does not settle are absent. */
+export function parseVerdicts(reply) {
+    const verdicts = new Map();
     const json = reply.slice(reply.indexOf('{'), reply.lastIndexOf('}') + 1);
     try {
-        const value = JSON.parse(json).real;
-        return typeof value === 'boolean' ? value : undefined;
+        const list = JSON.parse(json).verdicts;
+        if (!Array.isArray(list))
+            return verdicts;
+        for (const item of list) {
+            if (Number.isInteger(item?.n) && typeof item?.real === 'boolean')
+                verdicts.set(item.n, item.real);
+        }
     }
     catch {
-        return undefined;
+        // Not a verdict list: nothing is withdrawn.
     }
+    return verdicts;
 }

package/dist/deep/tool-loop.d.ts

@@ -0,0 +1,19 @@
+/**
+ * A bounded tool-using conversation: the model reads the repository through
+ * ReviewToolbox until it answers, runs out of tool calls, or runs out of
+ * turns. After the budget, tools stay defined (a history with tool calls
+ * needs them) but calls are forbidden, and the model is asked to answer.
+ */
+import type { InferenceOptions, InferenceProvider } from '../inference/types.js';
+import { ReviewToolbox } from './review-tools.js';
+export interface ToolLoopBudget {
+    maxToolCalls: number;
+    maxTurns: number;
+}
+export interface ToolLoopResult {
+    /** The model's final answer. */
+    text: string;
+    toolbox: ReviewToolbox;
+    toolCalls: number;
+}
+export declare function runToolLoop(provider: InferenceProvider, prompt: string, cwd: string, inference: InferenceOptions, budget: ToolLoopBudget): Promise<ToolLoopResult>;

package/dist/deep/tool-loop.js

@@ -0,0 +1,23 @@
+import { REVIEW_TOOLS, ReviewToolbox } from './review-tools.js';
+export async function runToolLoop(provider, prompt, cwd, inference, budget) {
+    if (!provider.chat)
+        throw new Error(`${provider.name} cannot call tools`);
+    const toolbox = new ReviewToolbox(cwd);
+    const messages = [{ role: 'user', content: prompt }];
+    let toolCalls = 0;
+    for (let turn = 0; turn < budget.maxTurns; turn++) {
+        const exhausted = toolCalls >= budget.maxToolCalls;
+        const reply = await provider.chat(messages, REVIEW_TOOLS, { ...inference, jsonMode: false, toolChoice: exhausted ? 'none' : 'auto' });
+        if (reply.toolCalls.length === 0 || exhausted)
+            return { text: reply.text, toolbox, toolCalls };
+        messages.push({ role: 'assistant', content: reply.text, toolCalls: reply.toolCalls });
+        for (const call of reply.toolCalls) {
+            toolCalls++;
+            const result = toolCalls <= budget.maxToolCalls ? toolbox.run(call) : 'Tool budget used up; answer now.';
+            messages.push({ role: 'tool', toolCallId: call.id, content: result });
+        }
+    }
+    messages.push({ role: 'user', content: 'Answer now with the JSON findings only.' });
+    const final = await provider.chat(messages, REVIEW_TOOLS, { ...inference, jsonMode: false, toolChoice: 'none' });
+    return { text: final.text, toolbox, toolCalls };
+}

package/dist/gates/deep-analysis.d.ts

@@ -13,6 +13,9 @@
  */
 import { Gate, GateContext } from './base.js';
 import { Failure, Provenance, DeepOptions } from '../types/index.js';
+import type { InferenceUsage } from '../inference/types.js';
+import { type RouterPolicy, type RouterStats } from '../deep/router.js';
+import { type LessonMode } from '../review-learning/team-lessons.js';
 export interface DeepGateConfig {
     options: DeepOptions;
     checks?: Record<string, boolean>;
@@ -20,6 +23,16 @@ export interface DeepGateConfig {
     maxTokens?: number;
     temperature?: number;
     timeoutMs?: number;
+    /** Cloud tier: let the model read the repository while it reviews (default on). */
+    agentic?: boolean;
+    /** Cloud tier: review only the riskiest changed functions. */
+    router?: RouterPolicy;
+    /** Which of the team's review lessons the reviewer is told about. */
+    reviewLessons?: LessonMode;
+    /** Show the reviewer the repository's own rules (AGENTS.md, …) that name what the change touches. */
+    repoRules?: boolean;
+    /** Whole-run budget: files not started in time are skipped and counted, never an error. */
+    budgetMs?: number;
     /** Ask intent questions at engine-proven sites in scoped reviews (deep-intent.ts). */
     intentChecks?: boolean;
     onProgress?: (message: string) => void;
@@ -34,6 +47,15 @@ export interface DeepRunOutcome {
     /** Code mode: findings the model proposed, and how many the self-check withdrew. */
     findingsProposed?: number;
     findingsWithdrawn?: number;
+    /** Findings the grounding check dropped, by reason. */
+    findingsRejected?: Record<string, number>;
+    /** Files the run budget left unreviewed. */
+    filesSkipped?: number;
+    /** Repository lookups the model made (agentic review). */
+    toolCalls?: number;
+    router?: RouterStats;
+    /** Tokens and cost, for cloud providers. */
+    usage?: InferenceUsage;
     /** Model actually used (the stock fallback is named as such). */
     model?: string;
     modelFallback?: boolean;
@@ -50,6 +72,11 @@ export declare class DeepAnalysisGate extends Gate {
     run(context: GateContext): Promise<Failure[]>;
     private setupProvider;
     private reviewCode;
+    /** A cloud model that can call tools reviews a change as one PR: it sees how files relate. */
+    private reviewsWholePr;
+    private reviewPr;
+    /** Cloud only: a paid model reviews the riskiest changed functions; local tiers cost nothing to run. */
+    private route;
     /** The max and cloud tiers read reference material and review twice; the small models do not. */
     private referenceOptions;
     private analyzeFacts;

package/dist/gates/deep-analysis.js

@@ -17,6 +17,14 @@ import { SidecarProvider } from '../inference/sidecar-provider.js';
 import { extractFacts, verifyFindings } from '../deep/index.js';
 import { runFactsPass } from '../deep/facts-pass.js';
 import { runCodePass } from '../deep/code-pass.js';
+import { routeFiles } from '../deep/router.js';
+import { reviewedKeys } from '../review/ledger.js';
+import { buildReviewTask } from '../review/review-task.js';
+import { reviewPullRequest } from '../deep/pr-review.js';
+import { relatedChanges } from '../deep/related-changes.js';
+import { rankChangedFunctions } from '../deep/risk.js';
+import { lessonsForDiff, lessonsSection } from '../review-learning/team-lessons.js';
+import { rulesForDiff, rulesSection } from '../review-learning/repo-rules.js';
 import { verifyCodeFindings } from '../deep/code-verifier.js';
 import { runIntentChecks } from './deep-intent.js';
 import { checkLocalPatterns } from '../storage/local-memory.js';
@@ -35,6 +43,8 @@ const CLOUD_SOURCE_CHARS = 60_000;
 /** Reference material (removed lines, callees, callers, PR intent) for the max and cloud tiers. */
 const LOCAL_REFERENCE_CHARS = 12_000;
 const CLOUD_REFERENCE_CHARS = 24_000;
+/** Files reviewed at once on a cloud provider; a local sidecar serves one request at a time. */
+const CLOUD_CONCURRENCY = 4;
 export class DeepAnalysisGate extends Gate {
     config;
     provider = null;
@@ -80,6 +90,7 @@ export class DeepAnalysisGate extends Gate {
             return [];
         }
         finally {
+            this.outcome.usage = this.provider?.usage?.();
             this.provider?.dispose();
         }
     }
@@ -100,7 +111,10 @@ export class DeepAnalysisGate extends Gate {
         this.outcome.modelFallback = active?.fallback;
         onProgress?.('\n  🔒 Local sidecar/model execution. Code remains on this machine.\n');
     }
-    async reviewCode(cwd, facts) {
+    async reviewCode(cwd, scoped) {
+        if (this.reviewsWholePr())
+            return this.reviewPr(cwd, scoped);
+        const facts = this.route(cwd, scoped);
         this.config.onProgress?.(`  Reviewing ${facts.length} scoped file(s) with source...`);
         const result = await runCodePass(this.provider, facts, {
             cwd,
@@ -109,11 +123,68 @@ export class DeepAnalysisGate extends Gate {
             focusLines: this.config.options.focusLines,
             reference: this.referenceOptions(),
             onProgress: this.config.onProgress,
+            deadline: this.config.budgetMs ? Date.now() + this.config.budgetMs : undefined,
+            concurrency: isCloud(this.config.options) ? CLOUD_CONCURRENCY : 1,
+            agentic: isCloud(this.config.options) && this.config.agentic !== false,
         });
         this.recordPass(result);
         this.outcome.findingsProposed = result.proposed;
         this.outcome.findingsWithdrawn = result.withdrawn;
-        return verifyCodeFindings(result.findings, result.contexts);
+        this.outcome.filesSkipped = result.skipped;
+        this.outcome.toolCalls = result.toolCalls;
+        if (result.skipped > 0) {
+            if (this.outcome.status === 'ok')
+                this.outcome.status = 'partial';
+            this.config.onProgress?.(`  ⚠ Run budget reached: ${result.skipped} file(s) not reviewed.`);
+        }
+        const rejected = {};
+        const verified = verifyCodeFindings(result.findings, result.contexts, rejected);
+        this.outcome.findingsRejected = rejected;
+        return verified;
+    }
+    /** A cloud model that can call tools reviews a change as one PR: it sees how files relate. */
+    reviewsWholePr() {
+        const { options } = this.config;
+        return isCloud(options) && this.config.agentic !== false && !!this.provider?.chat && !!options.diff;
+    }
+    async reviewPr(cwd, scoped) {
+        const { options } = this.config;
+        if (this.route(cwd, scoped).length === 0) {
+            this.config.onProgress?.('  Router: no risky change for the model; the gates cover this PR.');
+            return [];
+        }
+        const focus = buildReviewTask(cwd, options.diff, this.config.router).items;
+        const changedFiles = Object.keys(options.focusLines ?? {});
+        const related = relatedChanges(cwd, changedFiles, rankChangedFunctions(cwd, options.focusLines ?? {}, options.removedLines));
+        this.config.onProgress?.(`  Reviewing the PR as a whole (${focus.length} risky function(s) first)...`);
+        try {
+            const result = await reviewPullRequest(this.provider, { cwd, diff: options.diff, focus, related, lessons: lessonsSection(lessonsForDiff(cwd, options.diff, this.config.reviewLessons)),
+                rules: rulesSection(rulesForDiff(cwd, options.diff, this.config.repoRules)), prBody: options.prBody }, inferenceOptions(this.config));
+            this.recordPass({ findings: [], chunksTotal: 1, chunksFailed: 0 });
+            this.outcome.findingsProposed = result.findings.length;
+            this.outcome.findingsWithdrawn = 0;
+            this.outcome.toolCalls = result.toolCalls;
+            const rejected = {};
+            const verified = verifyCodeFindings(result.findings, result.contexts, rejected);
+            this.outcome.findingsRejected = rejected;
+            return verified;
+        }
+        catch (error) {
+            this.recordPass({ findings: [], chunksTotal: 1, chunksFailed: 1, firstError: error?.message ?? String(error) });
+            return [];
+        }
+    }
+    /** Cloud only: a paid model reviews the riskiest changed functions; local tiers cost nothing to run. */
+    route(cwd, facts) {
+        const { options } = this.config;
+        if (!isCloud(options) || this.config.router?.enabled === false || !options.focusLines)
+            return facts;
+        const routed = routeFiles(cwd, facts.map(f => f.path), options.focusLines, options.removedLines, this.config.router, reviewedKeys(cwd));
+        this.outcome.router = routed.stats;
+        if (routed.stats.files_skipped > 0) {
+            this.config.onProgress?.(`  Router: ${routed.stats.routed} of ${routed.stats.functions} changed function(s) to the model; ${routed.stats.files_skipped} file(s) left to the gates.`);
+        }
+        return facts.filter(f => routed.files.has(f.path));
     }
     /** The max and cloud tiers read reference material and review twice; the small models do not. */
     referenceOptions() {

package/dist/gates/deep-runner.js

@@ -5,6 +5,7 @@
 import { DeepAnalysisGate } from './deep-analysis.js';
 import { localTier } from '../inference/types.js';
 import { Logger } from '../utils/logger.js';
+import { appendDeepRun } from '../review/deep-runs.js';
 /**
  * Run the deep gate and turn its outcome into summary, stats and failures.
  * A deep run that could not analyze anything is ERROR with a visible
@@ -19,6 +20,11 @@ export async function runDeepAnalysis(config, context, deepOptions) {
         maxTokens: config.gates.deep?.max_tokens,
         temperature: config.gates.deep?.temperature,
         timeoutMs: config.gates.deep?.timeout_ms,
+        budgetMs: config.gates.deep?.budget_ms,
+        agentic: config.gates.deep?.agentic,
+        router: config.gates.deep?.router,
+        reviewLessons: config.gates.deep?.review_lessons,
+        repoRules: config.gates.deep?.repo_rules,
         intentChecks: config.gates.deep?.intent_checks,
         onProgress: deepOptions.onProgress,
     });
@@ -48,9 +54,17 @@ export async function runDeepAnalysis(config, context, deepOptions) {
         error: outcome.error,
         findings_proposed: outcome.findingsProposed,
         findings_withdrawn: outcome.findingsWithdrawn,
+        findings_rejected: outcome.findingsRejected,
+        files_skipped: outcome.filesSkipped,
+        tool_calls: outcome.toolCalls,
+        router: outcome.router,
+        input_tokens: outcome.usage?.inputTokens,
+        output_tokens: outcome.usage?.outputTokens,
+        cost_usd: outcome.usage?.costUsd,
         findings_count: findings.length,
         findings_verified: findings.filter(f => f.verified).length,
     };
+    appendDeepRun(context.cwd, stats);
     if (outcome.status === 'error') {
         return {
             failures: [{

package/dist/gates/frontend-secret-exposure.d.ts

@@ -54,3 +54,5 @@ export declare class FrontendSecretExposureGate extends Gate {
     private isDummyValue;
     private toFailures;
 }
+/** Imports a Node-only module: server code, whatever its path. */
+export declare function importsNodeBuiltins(content: string): boolean;

package/dist/gates/frontend-secret-exposure.js

@@ -106,6 +106,9 @@ export class FrontendSecretExposureGate extends Gate {
                 // Skip files guarded by Next.js server-only import
                 if (/import\s+['"]server-only['"]/.test(content))
                     continue;
+                // A file outside any frontend path that imports Node built-ins cannot be bundled for a browser.
+                if (fileContext === 'ambiguous' && importsNodeBuiltins(content))
+                    continue;
                 this.scanFile(content, file, fileContext, exposures);
             }
             catch {
@@ -251,3 +254,8 @@ export class FrontendSecretExposureGate extends Gate {
         return failures;
     }
 }
+const NODE_BUILTINS = /(?:from\s+|require\(\s*|import\(\s*)['"](?:node:[\w/]+|fs|fs\/promises|fs-extra|child_process|os|net|tls|worker_threads|cluster|module)['"]/;
+/** Imports a Node-only module: server code, whatever its path. */
+export function importsNodeBuiltins(content) {
+    return NODE_BUILTINS.test(content);
+}

package/dist/gates/frontend-secret-exposure.test.js

@@ -38,6 +38,20 @@ describe('FrontendSecretExposureGate', () => {
         const failures = await gate.run({ cwd: testDir });
         expect(failures.length).toBeGreaterThan(0);
     });
+    it('treats a file outside frontend paths that imports Node built-ins as server code', async () => {
+        const cli = path.join(testDir, 'packages/cli/src/commands/post.ts');
+        const shared = path.join(testDir, 'packages/shared/src/config.ts');
+        const component = path.join(testDir, 'src/components/Admin.tsx');
+        for (const file of [cli, shared, component])
+            fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(cli, "import { execFileSync } from 'child_process';\nexport const token = process.env.GITHUB_TOKEN;\n");
+        fs.writeFileSync(shared, 'export const token = process.env.GITHUB_TOKEN;\n');
+        fs.writeFileSync(component, "import fs from 'node:fs';\nexport const key = process.env.STRIPE_SECRET_KEY;\n");
+        const files = (await new FrontendSecretExposureGate().run({ cwd: testDir })).flatMap(f => f.files ?? []);
+        expect(files).not.toContain('packages/cli/src/commands/post.ts'); // Node-only: never bundled
+        expect(files).toContain('packages/shared/src/config.ts'); // could be bundled: still flagged
+        expect(files).toContain('src/components/Admin.tsx'); // a frontend path stays frontend
+    });
     it('does not flag public env prefixes in client files', async () => {
         const filePath = path.join(testDir, 'components/Header.tsx');
         fs.mkdirSync(path.dirname(filePath), { recursive: true });

package/dist/gates/hallucinated-imports/framework-modules-nuxt.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/hallucinated-imports/framework-modules-nuxt.test.js

@@ -0,0 +1,27 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { isNuxtProvided, NuxtRoots } from './framework-modules.js';
+let dir;
+beforeEach(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'nuxt-'));
+    fs.mkdirSync(path.join(dir, 'docs/server/api'), { recursive: true });
+    fs.writeFileSync(path.join(dir, 'docs/package.json'), JSON.stringify({ devDependencies: { nuxt: '^4.0.0' } }));
+    fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ dependencies: { vue: '^3.0.0' } }));
+});
+afterEach(() => { fs.rmSync(dir, { recursive: true, force: true }); });
+describe('Nuxt-provided modules', () => {
+    it('recognises aliases, virtual modules, the generated .nuxt dir and packages Nuxt supplies', () => {
+        for (const [spec, pkg] of [['~~/server/api/ai.post', '~~'], ['~/utils/x', '~'], ['@/components/A.vue', '@'], ['#imports', '#imports'], ['../../.nuxt/ui', '..'], ['h3', 'h3'], ['@vue/shared', '@vue/shared']]) {
+            expect(isNuxtProvided(spec, pkg)).toBe(true);
+        }
+        expect(isNuxtProvided('left-pad', 'left-pad')).toBe(false);
+        expect(isNuxtProvided('@scope/pkg', '@scope/pkg')).toBe(false);
+    });
+    it('applies only inside a project that depends on nuxt', async () => {
+        const roots = new NuxtRoots(dir);
+        expect(await roots.rootFor('docs/server/api/ai.post.ts')).toBe(path.join(dir, 'docs'));
+        expect(await roots.rootFor('src/index.ts')).toBeNull();
+    });
+});

package/dist/gates/hallucinated-imports/framework-modules.d.ts

@@ -1,10 +1,19 @@
-/** SvelteKit project root for a file (nearest package.json depending on the kit), cached per directory. */
-export declare class SvelteKitRoots {
+/** A framework's project root for a file (nearest package.json depending on it), cached per directory. */
+export declare class FrameworkRoots {
     private readonly cwd;
+    private readonly frameworkPackage;
     private cache;
-    constructor(cwd: string);
+    constructor(cwd: string, frameworkPackage: string);
     rootFor(file: string): Promise<string | null>;
 }
+export declare class SvelteKitRoots extends FrameworkRoots {
+    constructor(cwd: string);
+}
+export declare class NuxtRoots extends FrameworkRoots {
+    constructor(cwd: string);
+}
+/** In a Nuxt app: an alias, a virtual `#` module, the generated `.nuxt/`, or a package Nuxt supplies. */
+export declare function isNuxtProvided(importPath: string, packageName: string): boolean;
 /** `$app/*`, `$env/*`, `$service-worker`, or a route's generated `./$types`. */
 export declare function isSvelteKitProvided(importPath: string): boolean;
 /**

package/dist/gates/hallucinated-imports/framework-modules.js

@@ -14,12 +14,24 @@ const SVELTEKIT_PACKAGE = '@sveltejs/kit';
 const SVELTEKIT_VIRTUAL = /^(?:\$app|\$env)\/|^\$service-worker$/;
 const GENERATED_TYPES = /^\.{1,2}\/(?:.*\/)?\$types(?:\.d\.ts|\.js)?$/;
 const LIB_ALIAS = /^\$lib(?:\/(.*))?$/;
-/** SvelteKit project root for a file (nearest package.json depending on the kit), cached per directory. */
-export class SvelteKitRoots {
+const NUXT_PACKAGE = 'nuxt';
+/** Nuxt's aliases (`~`/`@` = srcDir, `~~`/`@@` = rootDir) and virtual `#imports`, `#app`, `#build`, …. */
+const NUXT_ALIAS = /^(?:~~?|@@?)(?:\/|$)|^#/;
+/** Nuxt's generated build directory, imported relatively. */
+const NUXT_GENERATED = /(?:^|\/)\.nuxt(?:\/|$)/;
+/** Packages Nuxt and Nitro supply to every app, imported without being declared. */
+const NUXT_SUPPLIED = new Set([
+    'h3', 'ofetch', 'ufo', 'defu', 'destr', 'ohash', 'pathe', 'scule', 'consola', 'hookable', 'unstorage', 'unctx',
+    'cookie-es', 'radix3', 'knitwork', 'nitropack', 'vue', 'vue-router', 'unhead', '@unhead/vue', '@nuxt/schema', '@nuxt/kit',
+]);
+/** A framework's project root for a file (nearest package.json depending on it), cached per directory. */
+export class FrameworkRoots {
     cwd;
+    frameworkPackage;
     cache = new Map();
-    constructor(cwd) {
+    constructor(cwd, frameworkPackage) {
         this.cwd = cwd;
+        this.frameworkPackage = frameworkPackage;
     }
     async rootFor(file) {
         const top = path.resolve(this.cwd);
@@ -32,7 +44,7 @@ export class SvelteKitRoots {
                 break;
             }
             visited.push(dir);
-            if (await declaresKit(path.join(dir, 'package.json'))) {
+            if (await declares(path.join(dir, 'package.json'), this.frameworkPackage)) {
                 found = dir;
                 break;
             }
@@ -46,13 +58,27 @@ export class SvelteKitRoots {
         return found;
     }
 }
-async function declaresKit(packageJsonPath) {
+export class SvelteKitRoots extends FrameworkRoots {
+    constructor(cwd) {
+        super(cwd, SVELTEKIT_PACKAGE);
+    }
+}
+export class NuxtRoots extends FrameworkRoots {
+    constructor(cwd) {
+        super(cwd, NUXT_PACKAGE);
+    }
+}
+/** In a Nuxt app: an alias, a virtual `#` module, the generated `.nuxt/`, or a package Nuxt supplies. */
+export function isNuxtProvided(importPath, packageName) {
+    return NUXT_ALIAS.test(importPath) || NUXT_GENERATED.test(importPath) || NUXT_SUPPLIED.has(packageName) || packageName.startsWith('@vue/');
+}
+async function declares(packageJsonPath, frameworkPackage) {
     if (!(await fs.pathExists(packageJsonPath)))
         return false;
     try {
         const pkg = await fs.readJson(packageJsonPath);
         return [pkg?.dependencies, pkg?.devDependencies, pkg?.peerDependencies]
-            .some(deps => !!deps && Object.prototype.hasOwnProperty.call(deps, SVELTEKIT_PACKAGE));
+            .some(deps => !!deps && Object.prototype.hasOwnProperty.call(deps, frameworkPackage));
     }
     catch {
         return false;

package/dist/gates/hallucinated-imports/index.js

@@ -24,7 +24,7 @@ import fs from 'fs-extra';
 import path from 'path';
 import { checkGoImports, checkRubyImports, checkCSharpImports, checkRustImports, checkJavaKotlinImports } from '../hallucinated-imports-lang.js';
 import { checkJSImports } from './js-resolver.js';
-import { SvelteKitRoots } from './framework-modules.js';
+import { NuxtRoots, SvelteKitRoots } from './framework-modules.js';
 import { checkPyImports } from './python-resolver.js';
 import { discoverWorkspacePackages, loadPackageJson } from './manifest-discovery.js';
 export class HallucinatedImportsGate extends Gate {
@@ -84,6 +84,7 @@ export class HallucinatedImportsGate extends Gate {
         const jsContext = {
             cwd: context.cwd, projectFiles, rootDeps, depCacheByDir, hasNodeModules, hallucinated, tsPathCacheByDir,
             kitRoots: new SvelteKitRoots(context.cwd),
+            nuxtRoots: new NuxtRoots(context.cwd),
             shouldIgnore: (importPath) => this.shouldIgnore(importPath),
             resolveRelativeImport: (fromFile, importPath, files) => this.resolveRelativeImport(fromFile, importPath, files),
             extractPackageName: (importPath) => this.extractPackageName(importPath),

package/dist/gates/hallucinated-imports/js-resolver-types.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/hallucinated-imports/js-resolver-types.test.js

@@ -0,0 +1,14 @@
+import { describe, expect, it } from 'vitest';
+import { typeOnlySpecifiers, typesPackageFor } from './js-resolver.js';
+describe('type-only imports', () => {
+    it('finds specifiers imported only for types, and everything in a .d.ts file', () => {
+        const ts = "import type { Context } from 'aws-lambda';\nimport { handler } from 'aws-lambda';\nexport type { Ev } from 'events-lib';\n";
+        expect([...typeOnlySpecifiers(ts, 'src/a.ts')]).toEqual(['aws-lambda', 'events-lib']);
+        const dts = "import type { Writable } from 'node:stream';\nimport { Context } from 'aws-lambda';\ntype X = import('express').Request;\n";
+        expect([...typeOnlySpecifiers(dts, 'src/global.d.ts')]).toEqual(['node:stream', 'aws-lambda', 'express']);
+    });
+    it('names the DefinitelyTyped package, scoped ones included', () => {
+        expect(typesPackageFor('aws-lambda')).toBe('@types/aws-lambda');
+        expect(typesPackageFor('@babel/core')).toBe('@types/babel__core');
+    });
+});

package/dist/gates/hallucinated-imports/js-resolver.d.ts

@@ -9,7 +9,7 @@
  * - node_modules dependency verification
  */
 import { HallucinatedImport } from './index.js';
-import { type SvelteKitRoots } from './framework-modules.js';
+import { type NuxtRoots, type SvelteKitRoots } from './framework-modules.js';
 import { type TsPathConfig } from './tsconfig-paths.js';
 /** Everything a JS/TS import check needs besides the file itself. */
 export interface JsImportContext {
@@ -21,6 +21,7 @@ export interface JsImportContext {
     hallucinated: HallucinatedImport[];
     tsPathCacheByDir: Map<string, TsPathConfig | null>;
     kitRoots: SvelteKitRoots;
+    nuxtRoots?: NuxtRoots;
     shouldIgnore: (importPath: string) => boolean;
     resolveRelativeImport: (fromFile: string, importPath: string, projectFiles: Set<string>) => boolean;
     extractPackageName: (importPath: string) => string;
@@ -29,6 +30,10 @@ export interface JsImportContext {
  * Check JavaScript/TypeScript imports in a source file and add hallucinated findings.
  */
 export declare function checkJSImports(content: string, file: string, ctx: JsImportContext): Promise<void>;
+/** Specifiers imported only for types: `import type`, `export type … from`, or anything in a .d.ts file. */
+export declare function typeOnlySpecifiers(content: string, file: string): Set<string>;
+/** `@types/x` for `x`; `@types/scope__x` for `@scope/x`. */
+export declare function typesPackageFor(pkgName: string): string;
 /**
  * Bundler conventions: a query on a relative import (`./logo.svg?raw`, `./worker.ts?worker`)
  * names a transform of that file, so the file is what must exist; a `virtual:` module or a