@sasjs/lint 4.3.1 → 4.3.3

package/package.json

@@ -12,7 +12,11 @@
     "publishInit": "cp -r ./build/* . && rm -rf ./build && rm -rf ./src && rm tsconfig.json",
     "package:lib": "npm run build && cp ./package.json ./checkNodeVersion.js build && cp README.md build && cd build && npm version \"5.0.0\" && npm pack",
     "lint:fix": "npx prettier --write \"{src,test}/**/*.{ts,tsx,js,jsx,html,css,sass,less,json,yml,md,graphql}\"",
-    "lint": "npx prettier --check \"{src,test}/**/*.{ts,tsx,js,jsx,html,css,sass,less,json,yml,md,graphql}\""
+    "lint": "npx prettier --check \"{src,test}/**/*.{ts,tsx,js,jsx,html,css,sass,less,json,yml,md,graphql}\"",
+    "mutation": "stryker run",
+    "mutation:changed": "node scripts/mutation-gate.mjs pr",
+    "mutation:watch": "node scripts/mutation-gate.mjs weekly",
+    "check:package": "node scripts/checkPackageContents.mjs"
   },
   "publishConfig": {
     "access": "public"
@@ -62,6 +66,8 @@
   "devDependencies": {
     "@nogoo9/gitleaks": "8.30.1-post.2",
     "@sasjs/sas-language": "0.3.0",
+    "@stryker-mutator/core": "10.1.1",
+    "@stryker-mutator/jest-runner": "10.1.1",
     "@types/jest": "30.0.0",
     "@types/node": "26.6.3",
     "jest": "30.5.2",
@@ -69,9 +75,34 @@
     "ts-jest": "29.4.14",
     "typescript": "6.0.3"
   },
+  "files": [
+    "index.js",
+    "index.js.map",
+    "index.d.ts",
+    "checkNodeVersion.js",
+    "formatExample.js",
+    "formatExample.js.map",
+    "formatExample.d.ts",
+    "lintExample.js",
+    "lintExample.js.map",
+    "lintExample.d.ts",
+    "format",
+    "lint",
+    "rules",
+    "types",
+    "utils",
+    "sasjslint-schema.json"
+  ],
   "dependencies": {
-    "@sasjs/utils": "4.0.0",
+    "@sasjs/utils": "^4.0.0",
     "ignore": "7.0.11"
   },
-  "version": "4.3.1"
+  "version": "4.3.3",
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": ">=22.18",
+      "onFail": "warn"
+    }
+  }
 }

package/utils/isIgnored.js

@@ -27,9 +27,24 @@ const isIgnored = (fPath, configuration) => __awaiter(void 0, void 0, void 0, fu
     const config = configuration || (yield (0, _1.getLintConfig)());
     const projectRoot = yield (0, _1.getProjectRoot)();
     const gitIgnoreFilePath = path_1.default.join(projectRoot, '.gitignore');
-    const rootPath = projectRoot + path_1.default.sep;
-    const relativePath = fPath.replace(rootPath, '');
-    if (fPath === projectRoot)
+    // path.relative rather than stripping `projectRoot + sep` from the string: a
+    // separator or a normalisation the caller did not apply leaves the strip with
+    // nothing to remove, and the `ignore` package then receives an absolute path
+    // and rejects it with a RangeError. path.relative is lexical - a symlinked root
+    // still yields a `..`-prefixed path, which the guard below catches.
+    const relativePath = path_1.default.relative(projectRoot, fPath);
+    if (relativePath === '')
+        return false;
+    // On Windows, `path.relative` returns an absolute path when the two paths sit
+    // on different drives, which the two guards below cannot see; passing that on
+    // reaches `ignore` and throws the RangeError this function exists to avoid.
+    if (path_1.default.isAbsolute(relativePath))
+        return false;
+    // Nothing in a project's .gitignore can match a path outside it, and the
+    // `ignore` package rejects a path that escapes the root ("path should be a
+    // path.relative()d string"), so a caller passing one gets `false` rather than
+    // a RangeError.
+    if (relativePath === '..' || relativePath.startsWith(`..${path_1.default.sep}`))
         return false;
     let gitIgnoreFileContent = '';
     if (yield (0, file_1.fileExists)(gitIgnoreFilePath))

package/utils/isIgnored.js.map

@@ -1 +1 @@
-{"version":3,"file":"isIgnored.js","sourceRoot":"","sources":["../../src/utils/isIgnored.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,4CAAwD;AACxD,gDAAuB;AACvB,oDAA2B;AAC3B,wBAAiD;AAGjD;;;;;GAKG;AACI,MAAM,SAAS,GAAG,CACvB,KAAa,EACb,aAA0B,EACR,EAAE;IACpB,MAAM,MAAM,GAAG,aAAa,IAAI,CAAC,MAAM,IAAA,gBAAa,GAAE,CAAC,CAAA;IACvD,MAAM,WAAW,GAAG,MAAM,IAAA,iBAAc,GAAE,CAAA;IAC1C,MAAM,iBAAiB,GAAG,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAG,WAAW,GAAG,cAAI,CAAC,GAAG,CAAA;IACvC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAEhD,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,KAAK,CAAA;IAEvC,IAAI,oBAAoB,GAAG,EAAE,CAAA;IAE7B,IAAI,MAAM,IAAA,iBAAU,EAAC,iBAAiB,CAAC;QACrC,oBAAoB,GAAG,MAAM,IAAA,eAAQ,EAAC,iBAAiB,CAAC,CAAA;IAE1D,OAAO,IAAA,gBAAM,GAAE;SACZ,GAAG,CAAC,oBAAoB,CAAC;SACzB,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC;SACtB,OAAO,CAAC,YAAY,CAAC,CAAA;AAC1B,CAAC,CAAA,CAAA;AArBY,QAAA,SAAS,aAqBrB"}
+{"version":3,"file":"isIgnored.js","sourceRoot":"","sources":["../../src/utils/isIgnored.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,4CAAwD;AACxD,gDAAuB;AACvB,oDAA2B;AAC3B,wBAAiD;AAGjD;;;;;GAKG;AACI,MAAM,SAAS,GAAG,CACvB,KAAa,EACb,aAA0B,EACR,EAAE;IACpB,MAAM,MAAM,GAAG,aAAa,IAAI,CAAC,MAAM,IAAA,gBAAa,GAAE,CAAC,CAAA;IACvD,MAAM,WAAW,GAAG,MAAM,IAAA,iBAAc,GAAE,CAAA;IAC1C,MAAM,iBAAiB,GAAG,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAE9D,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,gFAAgF;IAChF,oEAAoE;IACpE,MAAM,YAAY,GAAG,cAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;IAEtD,IAAI,YAAY,KAAK,EAAE;QAAE,OAAO,KAAK,CAAA;IAErC,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,cAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAA;IAE/C,yEAAyE;IACzE,2EAA2E;IAC3E,8EAA8E;IAC9E,gBAAgB;IAChB,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,cAAI,CAAC,GAAG,EAAE,CAAC;QACnE,OAAO,KAAK,CAAA;IAEd,IAAI,oBAAoB,GAAG,EAAE,CAAA;IAE7B,IAAI,MAAM,IAAA,iBAAU,EAAC,iBAAiB,CAAC;QACrC,oBAAoB,GAAG,MAAM,IAAA,eAAQ,EAAC,iBAAiB,CAAC,CAAA;IAE1D,OAAO,IAAA,gBAAM,GAAE;SACZ,GAAG,CAAC,oBAAoB,CAAC;SACzB,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC;SACtB,OAAO,CAAC,YAAY,CAAC,CAAA;AAC1B,CAAC,CAAA,CAAA;AAtCY,QAAA,SAAS,aAsCrB"}

package/.all-contributorsrc

@@ -1,123 +0,0 @@
-{
-  "files": [
-    "README.md"
-  ],
-  "imageSize": 100,
-  "commit": false,
-  "contributors": [
-    {
-      "login": "Carus11",
-      "name": "Carus Kyle",
-      "avatar_url": "https://avatars.githubusercontent.com/u/4925828?v=4",
-      "profile": "https://github.com/Carus11",
-      "contributions": [
-        "ideas"
-      ]
-    },
-    {
-      "login": "allanbowe",
-      "name": "Allan Bowe",
-      "avatar_url": "https://avatars.githubusercontent.com/u/4420615?v=4",
-      "profile": "https://github.com/allanbowe",
-      "contributions": [
-        "code",
-        "test",
-        "review",
-        "video",
-        "doc"
-      ]
-    },
-    {
-      "login": "YuryShkoda",
-      "name": "Yury Shkoda",
-      "avatar_url": "https://avatars.githubusercontent.com/u/25773492?v=4",
-      "profile": "https://www.erudicat.com/",
-      "contributions": [
-        "code",
-        "test",
-        "projectManagement",
-        "video",
-        "doc"
-      ]
-    },
-    {
-      "login": "krishna-acondy",
-      "name": "Krishna Acondy",
-      "avatar_url": "https://avatars.githubusercontent.com/u/2980428?v=4",
-      "profile": "https://krishna-acondy.io/",
-      "contributions": [
-        "code",
-        "test",
-        "review",
-        "infra",
-        "platform",
-        "maintenance",
-        "content"
-      ]
-    },
-    {
-      "login": "saadjutt01",
-      "name": "Muhammad Saad ",
-      "avatar_url": "https://avatars.githubusercontent.com/u/8914650?v=4",
-      "profile": "https://github.com/saadjutt01",
-      "contributions": [
-        "code",
-        "test",
-        "review",
-        "mentoring",
-        "doc"
-      ]
-    },
-    {
-      "login": "sabhas",
-      "name": "Sabir Hassan",
-      "avatar_url": "https://avatars.githubusercontent.com/u/82647447?v=4",
-      "profile": "https://github.com/sabhas",
-      "contributions": [
-        "code",
-        "test",
-        "review",
-        "ideas"
-      ]
-    },
-    {
-      "login": "medjedovicm",
-      "name": "Mihajlo Medjedovic",
-      "avatar_url": "https://avatars.githubusercontent.com/u/18329105?v=4",
-      "profile": "https://github.com/medjedovicm",
-      "contributions": [
-        "code",
-        "test",
-        "review",
-        "infra"
-      ]
-    },
-    {
-      "login": "VladislavParhomchik",
-      "name": "Vladislav Parhomchik",
-      "avatar_url": "https://avatars.githubusercontent.com/u/83717836?v=4",
-      "profile": "https://github.com/VladislavParhomchik",
-      "contributions": [
-        "test",
-        "review"
-      ]
-    },
-    {
-      "login": "McGwire-Jones",
-      "name": "McGwire-Jones",
-      "avatar_url": "https://avatars.githubusercontent.com/u/51411005?v=4",
-      "profile": "https://github.com/McGwire-Jones",
-      "contributions": [
-        "code"
-      ]
-    }
-  ],
-  "contributorsPerLine": 7,
-  "projectName": "lint",
-  "projectOwner": "sasjs",
-  "repoType": "github",
-  "repoHost": "https://github.com",
-  "skipCi": true,
-  "commitConvention": "none",
-  "commitType": "docs"
-}

package/.git-hooks/commit-msg

@@ -1,18 +0,0 @@
-#!/bin/sh
-RED="\033[1;31m"
-GREEN="\033[1;32m"
-
-# Get the commit message (the parameter we're given is just the path to the
-# temporary file which holds the message).
-commit_message=$(cat "$1")
-
-if (echo "$commit_message" | grep -Eq "^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([a-z \-]+\))?!?: .+$") then
-   echo "${GREEN} ✔ Commit message meets Conventional Commit standards"
-   exit 0
-fi
-
-echo "${RED}❌ Commit message does not meet the Conventional Commit standard!"
-echo "An example of a valid message is:"
-echo "  feat(login): add the 'remember me' button"
-echo "ℹ More details at: https://www.conventionalcommits.org/en/v1.0.0/#summary"
-exit 1

package/.git-hooks/pre-commit

@@ -1,18 +0,0 @@
-#!/bin/bash
-
-# Scan staged changes for secrets before anything else runs.
-# The binary is pinned by the @nogoo9/gitleaks devDependency and lands in
-# node_modules/.bin after `npm i` in the repo root. Commits are blocked until
-# it is installed so no clone silently skips the secrets scan.
-gitleaks_bin=node_modules/.bin/gitleaks
-
-if [ ! -x "$gitleaks_bin" ]; then
-    echo "gitleaks not found - run 'npm i' in the repo root to install it"
-    exit 1
-fi
-
-if ! "$gitleaks_bin" protect --staged --redact; then
-    echo "gitleaks detected a potential secret in your staged changes"
-    echo "Remove the secret, or add a .gitleaksignore entry if it is a false positive"
-    exit 1
-fi

package/.github/CONTRIBUTING.md

@@ -1,156 +0,0 @@
-# Contributing
-
-Contributions to `@sasjs/lint` are very welcome. This repo is a TypeScript library with no SAS dependency - it reads `.sas` files as text - so you can work on every rule, the formatter and the JSON schema with Node alone.
-
-Please fill in the pull request template and make sure your changes are covered by tests.
-
-## Quick start
-
-Node 22 or later (the `engines` field), and no lifecycle scripts:
-
-```bash
-git clone https://github.com/sasjs/lint.git
-cd lint
-npm ci                        # .npmrc sets ignore-scripts=true, so nothing runs on install
-git config core.hooksPath ./.git-hooks   # the prepare script is one of those scripts
-```
-
-Then:
-
-```bash
-npm test           # jest WITH the coverage gate - this is the one CI runs
-npm run lint       # prettier --check over src and test
-npx tsc --noEmit   # type check
-npm run build      # emit ./build, needed by anything that requires the built library
-```
-
-`npx jest` alone does not apply the coverage threshold, so a change can look green locally and fail CI. Use `npm test`.
-
-## Where things live
-
-- `src/rules/file/`, `src/rules/line/`, `src/rules/path/` - one module per rule, `<name>.ts` plus `<name>.spec.ts`, each re-exported from its folder's `index.ts`.
-- `src/lint/` - `lintText`, `lintFile`, `lintFolder`, `lintProject`, and `shared.ts` (`processText`, `processFile`, `processLine`).
-- `src/format/` - `formatText`, `formatFile`, `formatFolder`, `formatProject`, and `shared.ts`.
-- `src/types/` - `LintConfig.ts` (the rule registry and defaults), `LintRule.ts` (the File/Line/Path interfaces), `Diagnostic.ts`, `Severity.ts`, `LineEndings.ts`.
-- `src/utils/` - shared helpers: `splitText`, `splitLines`, `getHeaderLinesCount`, `parseMacros`, `parseMacroCalls`, `headerMacros`, `mergeLintConfig`, `parseLintOverride`, `sasMacros`.
-- `sasjslint-schema.json` and `README.md` - the public contract for every setting.
-
-## Architecture
-
-There are three types of rule:
-
-- File rules - run once against the whole file
-- Line rules - run once per line
-- Path rules - run against a file path or name
-
-A rule exports an object conforming to the `LintRule` interface: `type`, `name`, `description` and `message` at minimum. File, line and path rules also have `test`, a function returning `Diagnostic[]` for the consuming application to display. Rules that can repair what they find also have `fix`, which takes the original content - a line or the whole file - and returns it transformed. Path rules have no `fix`.
-
-`test` reports positions as `lineNumber`, `startColumnNumber` and `endColumnNumber`. Severity comes from `config.severityLevel[name] || Severity.Warning`, so a rule must read its own name key.
-
-## Adding a rule
-
-Moving the check into an existing rule versus adding a new one is a design call. A rule that must be separately switchable cannot be folded into another, because `severityLevel` is per rule NAME - one name means one opt-out. Check what the neighbouring rule's registration condition is first: a rule that only registers when a key is an explicit non-`off` value drags its whole remit along with any check folded in.
-
-When a new rule is the right answer:
-
-1. Add `src/rules/<type>/X.ts` and `X.spec.ts`.
-2. Export it from `src/rules/<type>/index.ts`.
-3. Register it in `src/types/LintConfig.ts`, choosing the default posture:
-   - `if (json?.X !== false)` pushes a rule that is ON by default;
-   - `if (json?.X)` pushes one that is OFF by default.
-   A rule whose `fix` must run during autoformat has to be ON, because the fix only runs for rules present in the config.
-4. Add the key to the README config block and a `### X` section in alphabetical position, with `Default:` and `Severity:`.
-5. Add the schema entries in `sasjslint-schema.json`: the `default` object, the `examples` object, a `properties.X` block, and a `severityLevel.properties.X` entry.
-6. Add specs for both the default-on and the default-off path.
-
-There is no "warn but do not fix" state. A rule with a `fix` either has both warning and repairing active, or is absent and does neither. If your `fix` rewrites files, defaulting it ON changes the output of `sasjs lint fix` and format-on-save for every existing user, so say so in the PR and mark the commit accordingly.
-
-## The three documents that must agree
-
-`DefaultLintConfiguration` (`src/utils/getLintConfig.ts`), the fenced config block in `README.md`, and the `default` object in `sasjslint-schema.json` state the same thing, and they drift. Treat them as one artifact: complete the default object first, then mirror it into both documents. `src/utils/getLintConfig.spec.ts` fails if any of the three disagree, and also enumerates the settings the constructor reads, so a setting added to `LintConfig` but not to the defaults is caught. An absent key must mean the documented default - a project with no `.sasjslint` and a project whose file omits the key must get the same rule set.
-
-## Reading a file: one split for line endings
-
-Readers must not split content on the ending CONFIGURED in `lineEndings`. That value says what the project wants, not what the file contains, and the lint path does not normalise - so a `crlf` split over an LF file returns one string holding the whole file, and column lookups then throw. Use `splitLines` (`src/utils/splitLines.ts`), which splits on `\r\n` or `\n` and drops the carriage returns. Writers still join with the configured ending.
-
-The formatter currently survives the mismatch because `lineEndings.fix` runs before the later rules, but that is not a licence for a reader to assume it: `formatFile` lints before it formats.
-
-## Formatter rules
-
-Only file and line rules that carry a `fix` run during formatting, in the order they were pushed onto the config. `hasDoxygenHeader` is pushed first, so with the default config a `fix` may assume a Doxygen header exists - but it must still return the text unchanged when there is none.
-
-A `fix` must be idempotent: format the same file twice and the second pass must change nothing. Formatting a corpus twice and comparing is the quickest way to prove it. A non-idempotent fix shows up as churn and an inflated `fixedDiagnosticsCount`.
-
-Two rules can reconcile the same header from opposite sides - `noUndeclaredMacros` adds used-but-undeclared names and `noUnusedMacros` removes declared-but-unused ones - so a removal helper must keep the `<h4> SAS Macros </h4>` heading when the list empties, or the add side loses its place to write.
-
-## Testing
-
-Most of the code is pure functions, so there is little to mock and no excuse for not testing a rule. When adding a rule, test the positive and negative scenarios in separate cases; when changing one, run the suite to prove nothing else moved.
-
-Two habits catch the failures that plain coverage does not:
-
-- **Mutation-check your assertions.** Revert the behaviour one piece at a time and confirm a test fails. An assertion that passes on the broken code is documenting nothing. Watch for vacuous cases: for example, a "does not throw" test over a mis-split file passes while the mis-split still contains the string being searched for, so the fixture has to be shaped to fail.
-- **A negative test must fail for the reason it names.** Assert on the specific message or error, never a bare `toThrow()`.
-
-## Regenerating the shipped macro list
-
-The macros SAS ships are language data, owned by `@sasjs/sas-language`. Do not hand-write them here. `npm run generate:macros` reads its `macroStatements` and `macroFunctions` groups and writes `src/utils/sasMacros.generated.ts`, which is committed so the published package carries no runtime dependency. `sasMacros.spec.ts` reads the same data independently and fails when the committed list differs, which is the drift guard. Extending that vocabulary is a PR to `@sasjs/sas-language`.
-
-## Code style
-
-The repo uses `Prettier`. In VS Code, install the Prettier extension and set `editor.formatOnSave` (and `editor.formatOnPaste`) to `true`. Otherwise run `npm run lint:fix` before committing, and `npm run lint` to check.
-
-## Git hooks
-
-The repo ships its own hooks in [`.git-hooks/`](../.git-hooks):
-
-- `pre-commit` - scans staged changes for secrets with gitleaks, and requires the `@nogoo9/gitleaks` devDependency to be installed
-- `commit-msg` - verifies the commit message follows the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/#summary) standard
-
-The repo `.npmrc` sets `ignore-scripts=true`, so the `prepare` script that would normally set `core.hooksPath` during `npm i` never runs. After cloning (or if your commits are not being checked), activate the hooks with a one-time command, run from the repo root:
-
-```bash
-git config core.hooksPath ./.git-hooks
-```
-
-The pre-commit hook runs the gitleaks binary provided by the `@nogoo9/gitleaks` devDependency, so make sure `npm i` has run in the repo root before your first commit.
-
-If you use the [pre-commit](https://pre-commit.com) framework, the repo also ships a [`.pre-commit-config.yaml`](../.pre-commit-config.yaml) that pins the upstream gitleaks hook to an exact release tag. Activate it with `pre-commit install`.
-
-## Commit messages and releases
-
-Merging to `main` runs semantic-release: the commit type decides the version, and a release publishes to npm. Only `feat:`, `fix:` and `perf:` cut a release - a `chore:` or `docs:` PR publishes nothing, which is correct rather than a failure.
-
-For a squash merge the PR TITLE drives the version, so keep it conventional. Judge the type by what users see: a new diagnostic message, or a formatter that now rewrites files it used to leave alone, is new behaviour and belongs in `feat:` even when it also fixes a defect. Warnings do not move the exit code of `sasjs lint` - only `noEncodedPasswords` ships as an error - so a new warning does not break CI for consumers; a rewritten file might surprise them, and the release notes are where to say so.
-
-Mark a genuinely breaking change with `BREAKING CHANGE:` in the commit body, and name the config key that restores the old behaviour.
-
-## The audit gate
-
-`build.yml` runs `npm audit --omit=dev --audit-level=low`, scoped to production dependencies because the dev tree carries one advisory nothing here can fix (`sprintf-js` through the jest transform chain, with no patched release). A weekly `audit-watch.yml` runs the FULL audit and fails when that exemption stops matching reality - a new dev-tree advisory, the exempted one disappearing, or a watched package publishing a newer version.
-
-Do not add a dev-tree advisory to the exemption to get a build green. Prefer removing the dependency; if an exemption is genuinely unavoidable, it needs the reachability argument written down and a guard that closes it, not an allowlist.
-
-## CI is the enforcement point
-
-The [build workflow](./workflows/build.yml) scans the full history for secrets with gitleaks, runs `npm audit`, checks code style and runs the tests. The local hooks are convenience - CI is what a red finding must fail.
-
-## The release toolchain lives in the workflow
-
-semantic-release is not a project dependency. Every `@semantic-release` plugin declares a `semantic-release` peer, so adding one to `devDependencies` makes npm auto-install semantic-release along with the `npm` package it bundles - and that bundled npm carries advisories this repo cannot fix.
-
-Instead, [publish.yml](./workflows/publish.yml) installs semantic-release, `@semantic-release/exec` and `@semantic-release/git` on the fly, pinned to exact versions. When you add or remove an entry in `release.plugins` (package.json), update that command to match.
-
-## What to work on
-
-The formatter applies these fixes today: `%mend` macro names, a Doxygen header template, adding undeclared macros to the `<h4> SAS Macros </h4>` section, removing unused macros from it, trailing spaces, and line endings (including a missing final newline) when [`lineEndings`](../README.md#lineendings) is configured.
-
-Fixes not yet implemented, roughly in order of usefulness:
-
-- Change tabs to spaces
-- Remove gremlin characters
-- Convert single asterisk comments to block comments
-
-Harder, and still under investigation: automatic indentation and code layout.
-
-Rules without a fix are equally welcome - a rule that reports something real is worth more than one that silently repairs it wrong. Open an issue describing the SAS construct and what a false positive would look like before you build it, so the heuristic can be argued about cheaply.

package/.github/PULL_REQUEST_TEMPLATE.md

@@ -1,21 +0,0 @@
-## Issue
-
-Link any related issue(s) in this section.
-
-## Intent
-
-What this PR intends to achieve.
-
-## Implementation
-
-What code changes have been made to achieve the intent.
-
-## Checks
-
-- [ ] Code is formatted correctly (`npm run lint:fix`).
-- [ ] Any new functionality has been unit tested.
-- [ ] All unit tests are passing (`npm test`).
-- [ ] All CI checks are green.
-- [ ] sasjslint-schema.json is updated with any new / changed functionality
-- [ ] JSDoc comments have been added or updated.
-- [ ] Reviewer is assigned.

package/.github/dependabot.yml

@@ -1,7 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: npm
-    directory: '/'
-    schedule:
-      interval: monthly
-    open-pull-requests-limit: 3

package/.github/workflows/audit-watch.yml

@@ -1,68 +0,0 @@
-name: Audit Watch
-
-# The build gate runs `npm audit --omit=dev`, because the dev tree carries one
-# advisory that cannot be fixed from here (GHSA-hp3w-g68c-fv3c, sprintf-js - see
-# the Security Audit step in build.yml). Nothing in build.yml re-checks the dev
-# tree, so that exemption would otherwise be open-ended. This runs the full audit
-# weekly and fails when the exemption stops matching reality: a new dev-tree
-# advisory appears, an exempted one disappears, or a package named in the
-# exemption publishes a newer release. Any of those files an issue - and only
-# those, because a scheduled job that is red every week trains people to ignore
-# red.
-
-on:
-  schedule:
-    - cron: '0 8 * * 1' # Mondays, 08:00 UTC
-  workflow_dispatch:
-
-jobs:
-  watch:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      issues: write
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Use Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - name: Install Dependencies
-        run: npm ci
-
-      - name: Re-check the dev-tree audit exemption
-        id: watch
-        env:
-          AUDIT_WATCH_REPORT: ${{ runner.temp }}/audit-watch-report.md
-        run: node scripts/audit-watch.mjs
-
-      - name: File an issue
-        # `always()` because the watched step has already failed, which would
-        # otherwise skip this one.
-        if: always() && steps.watch.outcome == 'failure'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPORT: ${{ runner.temp }}/audit-watch-report.md
-        run: |
-          title='Audit watch: the dev-tree exemption needs re-evaluating'
-          existing=$(gh issue list --state open --search "\"$title\" in:title" \
-            --json number --jq '.[0].number // empty')
-
-          if [ -n "$existing" ]; then
-            echo "already tracked in #$existing"
-            exit 0
-          fi
-
-          if [ -f "$REPORT" ]; then
-            gh issue create --title "$title" --body-file "$REPORT"
-          else
-            # The script writes a report even when the watch itself breaks, so
-            # this means it never started. File the issue anyway rather than
-            # failing on a missing path and filing nothing.
-            gh issue create --title "$title" --body \
-              "The audit watch step failed before producing a report. Check the run:
-          $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
-          fi

package/.github/workflows/build.yml

@@ -1,66 +0,0 @@
-# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
-
-name: SASjs Lint Build
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        # The floor is what the manifest declares; lts/* tracks the newest LTS.
-        # Testing only lts/* would let a change that breaks node 22 ship, since
-        # lts/* already resolves to 24.
-        node-version: [22, lts/*]
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: npm
-      - name: Install Dependencies
-        run: npm ci
-      - name: Scan for secrets (gitleaks)
-        # The local pre-commit hook is suppressed entirely when .npmrc sets
-        # ignore-scripts=true (the prepare script that would activate the
-        # hooks never runs), so CI is the enforcement point: a leaked
-        # credential must fail the build, not just a commit.
-        # Uses the same @nogoo9/gitleaks binary the pre-commit hook pins - the
-        # gitleaks-action requires a license key for organization repos.
-        run: node_modules/.bin/gitleaks detect --source . --redact --no-banner -v
-      - name: Security Audit
-        # Prod-scoped on purpose: this gate covers what actually ships. The
-        # release toolchain is not a project dependency (see publish.yml), so
-        # the `npm` package bundled by @semantic-release/npm never reaches this
-        # tree - which is what made the old exemption-based audit script
-        # necessary. The dev tree carries one advisory that cannot be fixed
-        # from here: GHSA-hp3w-g68c-fv3c, sprintf-js reached through
-        # @jest/transform -> babel-plugin-istanbul ->
-        # @istanbuljs/load-nyc-config -> js-yaml 3 -> argparse. Every package in
-        # that chain is at its latest published version, and the advisory lists
-        # no patched release at all (sprintf-js 1.1.3 is the newest and is
-        # still in range), so gating on it would mean a permanently red build.
-        # `npm audit fix --force` does not fix it either - it downgrades jest
-        # 30 -> 25 and takes the tree from 21 advisories to 45.
-        #
-        # The exemption is not open-ended: audit-watch.yml runs the full audit
-        # weekly and fails when this comment stops matching the tree - a new
-        # dev-tree advisory, this one disappearing, or sprintf-js publishing a
-        # newer release. Keep the GHSA id named here and in the EXEMPTIONS list
-        # of scripts/audit-watch.mjs.
-        run: npm audit --omit=dev --audit-level=low
-      - name: Check Code Style
-        run: npm run lint
-      - name: Run Unit Tests
-        run: npm test
-      - name: Build Package
-        run: npm run package:lib
-        env:
-          CI: true

package/.github/workflows/publish.yml

@@ -1,169 +0,0 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
-
-name: SASjs Lint Build and Publish
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-# One release at a time. Both triggers publish, and the push trigger fires on
-# every release commit @semantic-release/git pushes back to main, so a
-# dispatched recovery run can interleave with a push-triggered one. Two
-# semantic-release processes racing the same tag and the same npm publish is a
-# new way to strand a release - the state the retry below exists to recover.
-# `cancel-in-progress: false` queues the second run rather than cancelling the
-# first, because cancelling a run midway through a release is itself a way to
-# leave a tag pushed and the release missing.
-concurrency:
-  group: publish
-  cancel-in-progress: false
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      id-token: write       # required for npm provenance (trusted publisher)
-      issues: write         # optional: lets @semantic-release/github comment on issues
-      pull-requests: write  # optional: lets @semantic-release/github comment on PRs
-
-    strategy:
-      matrix:
-        node-version: [22]
-
-    steps:
-      # Mint a short-lived GitHub App token (bypass-capable)
-      - name: Generate token
-        id: app-token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
-      # Checkout using the app token so the release commit can be pushed
-      - uses: actions/checkout@v4
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-          persist-credentials: true
-          fetch-depth: 0      # semantic-release needs full history + tags
-
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-          registry-url: https://registry.npmjs.org
-
-      # Node 22 ships npm 10.x — OIDC trusted publishing needs npm >= 11.5.1
-      - name: Update npm
-        run: npm install -g npm@latest
-
-      - name: Install Dependencies
-        run: npm ci
-
-      - name: Check Code Style
-        run: npm run lint
-
-      - name: Run Unit Tests
-        run: npm test
-
-      - name: Build Project
-        run: npm run build
-
-      - name: Clean up ready for publishing
-        run: npm run publishInit
-
-      - name: Semantic Release
-        # The release toolchain is deliberately not a project dependency: every
-        # @semantic-release plugin declares a `semantic-release` peer, which npm
-        # auto-installs together with the `npm` package semantic-release bundles
-        # - and that bundled npm carries advisories nothing here can fix.
-        # Installing it here, pinned, keeps the dependency tree clean. Keep
-        # these versions in step with `release.plugins` in package.json.
-        #
-        # semantic-release pushes twice: @semantic-release/git pushes the release
-        # commit to the branch, then core pushes the tag in a second, tags-only
-        # push. When that second push is rejected the branch keeps the release
-        # commit - package.json at the new version - with no tag: no GitHub
-        # release, no npm publish, and every later run dying in the exec plugin's
-        # `npm version` with "Version not changed", a state only a hand repair
-        # clears. sasjs/adapter hit exactly that on 2026-10-17.
-        #
-        # The tag push runs after the tag exists locally and after the branch is
-        # updated, so one more attempt has only the tag to push. Retry exactly
-        # that case: a local tag alone does not identify it, because the tag is
-        # also there when the failure came later (the GitHub release), and
-        # retrying that finds the tag restored by semantic-release's own fetch,
-        # decides there is nothing to release, exits 0 and leaves the step green
-        # with the release still missing - so require the tag to be absent from
-        # the remote as well.
-        #
-        # Only a definitive answer counts. `git ls-remote --exit-code` exits 2 for
-        # an absent ref but 128 when the query itself fails (network, auth,
-        # unreachable remote), and treating every non-zero exit as "absent" would
-        # retry on the transient GitHub-side failures that are the very class of
-        # incident this retry repairs. So 2 retries, 0 and anything else fail the
-        # step.
-        run: |
-          run_release() {
-            npx --yes \
-              --package semantic-release@25.0.9 \
-              --package @semantic-release/exec@7.1.0 \
-              --package @semantic-release/git@11.0.1 \
-              semantic-release
-          }
-
-          if run_release; then
-            exit 0
-          fi
-
-          version=$(node -p "require('./package.json').version")
-
-          if ! git rev-parse -q --verify "refs/tags/v$version" >/dev/null; then
-            echo "No local v$version tag, so the failure came before the tag was created - not retrying." >&2
-            exit 1
-          fi
-
-          ls_rc=0
-          git ls-remote --exit-code --tags origin "refs/tags/v$version" >/dev/null 2>&1 || ls_rc=$?
-
-          if [ "$ls_rc" -eq 0 ]; then
-            echo "v$version is already on the remote, so the failure came after the tag push - not retrying." >&2
-            exit 1
-          fi
-
-          if [ "$ls_rc" -ne 2 ]; then
-            echo "Could not establish whether v$version is on the remote (git ls-remote exited $ls_rc) - not retrying." >&2
-            exit 1
-          fi
-
-          echo "Retrying: v$version exists locally but not on the remote, so the tag push is what failed."
-          git tag -d "v$version"
-          run_release
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}   # <-- app token, not secrets.GITHUB_TOKEN
-
-      # semantic-release only releases when it finds a releasable commit, and the
-      # angular convention this repo is configured with does not treat `chore:` or
-      # `docs:` as one. This step ran on `if: success()` regardless, so a merge with
-      # no releasable commit published the version already in package.json, which
-      # npm rejects with "You cannot publish over the previously published
-      # versions". Compare against the registry instead, and publish only when
-      # there is something new.
-      - name: Publish to npm with trusted publisher
-        id: publish
-        if: success()
-        run: |
-          local_version=$(node -p "require('./package.json').version")
-          published_version=$(npm view @sasjs/lint version 2>/dev/null || echo "")
-
-          if [ "$local_version" = "$published_version" ]; then
-            echo "released=false" >> "$GITHUB_OUTPUT"
-            echo "Nothing to publish - $local_version is already on npm"
-            exit 0
-          fi
-
-          npm publish --access public
-          echo "released=true" >> "$GITHUB_OUTPUT"

package/.gitpod.yml

@@ -1,8 +0,0 @@
-# This configuration file was automatically generated by Gitpod.
-# Please adjust to your needs (see https://www.gitpod.io/docs/config-gitpod-file)
-# and commit this file to your remote git repository to share the goodness with others.
-
-tasks:
-  - init: npm install && npm run build
-
-

package/.pre-commit-config.yaml

@@ -1,16 +0,0 @@
-# Hooks for the pre-commit framework - https://pre-commit.com
-#
-# The repo also ships native hooks in .git-hooks/, covering the secret scan, a
-# 2MB commit size limit and Conventional Commits. But .npmrc sets
-# ignore-scripts=true, so the `prepare` script that would activate them never
-# runs on `npm i` - a fresh clone commits unchecked until the one-time command
-# in .github/CONTRIBUTING.md is run by hand.
-#
-# This file is the standard route instead: install the framework once with
-# `pre-commit install`, and the secret scan runs on every commit. The hook is
-# pinned to an exact gitleaks release tag.
-repos:
-  - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.1
-    hooks:
-      - id: gitleaks

package/.prettierrc

@@ -1,6 +0,0 @@
-{
-  "trailingComma": "none",
-  "tabWidth": 2,
-  "semi": false,
-  "singleQuote": true
-}

package/.sasjslint

@@ -1,13 +0,0 @@
-{
-    "noTrailingSpaces": true,
-    "noEncodedPasswords": true,
-    "hasDoxygenHeader": true,
-    "noSpacesInFileNames": true,
-    "maxLineLength": 80,
-    "lowerCaseFileNames": true,
-    "noTabIndentation": true,
-    "indentationMultiple": 2,
-    "hasMacroNameInMend": true,
-    "noNestedMacros": true,
-    "hasMacroParentheses": true
-}

package/jest.config.js

@@ -1,13 +0,0 @@
-module.exports = {
-  preset: 'ts-jest',
-  testEnvironment: 'node',
-  coverageThreshold: {
-    global: {
-      branches: 80,
-      functions: 80,
-      lines: 80,
-      statements: -10
-    }
-  },
-  collectCoverageFrom: ['src/**/{!(index|formatExample|lintExample),}.ts']
-}

package/scripts/audit-watch.mjs

@@ -1,249 +0,0 @@
-/**
- * Watches the dev-tree audit exemption declared in `.github/workflows/build.yml`.
- *
- * That workflow gates on `npm audit --omit=dev` because the dev tree carries one
- * advisory nothing in this repo can fix: GHSA-hp3w-g68c-fv3c (sprintf-js,
- * reached through @jest/transform -> babel-plugin-istanbul ->
- * @istanbuljs/load-nyc-config -> js-yaml 3 -> argparse). Every package in that
- * chain is at its latest published version and the advisory lists no patched
- * release, so gating on it would mean a permanently red build.
- *
- * An exemption with no expiry is how a scoped gate becomes a permanent one, so
- * this script re-checks it weekly and reports when it is out of date:
- *
- *   - a dev-tree advisory outside EXEMPTIONS appears - the exemption is too narrow
- *   - an EXEMPTIONS advisory no longer appears in the tree - the exemption is dead
- *   - a WATCHED_FOR_RELEASE package publishes a version newer than the one
- *     recorded here - a fix may now exist, so re-evaluate and drop the exemption
- *   - an EXEMPTIONS id is missing from the build.yml comment - the gate and this
- *     script disagree about what is exempt
- *
- * Any of those exits 1, failing the scheduled run and making the workflow file an
- * issue. The known advisory on its own does NOT exit 1: it is expected, and a job
- * that is red every week trains people to ignore red.
- *
- * Run with `node scripts/audit-watch.mjs`.
- */
-import { execFileSync } from 'node:child_process'
-import { appendFileSync, readFileSync, writeFileSync } from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const BUILD_WORKFLOW = path.join('.github', 'workflows', 'build.yml')
-
-/**
- * Advisories the dev-scoped gate in build.yml is allowed to leave unaddressed.
- * Each one must also be named in that workflow's comment - the check below
- * enforces it, so the gate and this list cannot drift apart.
- */
-const EXEMPTIONS = ['GHSA-hp3w-g68c-fv3c']
-
-/**
- * Packages whose published version decides whether an exemption is still
- * justified. `newestKnown` is the newest release at the time the exemption was
- * written; a newer one on the registry means a fix may exist and the exemption
- * deserves a fresh look rather than another year of silence.
- */
-const WATCHED_FOR_RELEASE = [{ name: 'sprintf-js', newestKnown: '1.1.3' }]
-
-/**
- * `npm audit --json` exits 1 whenever it reports anything, so the exit code says
- * nothing about whether the command worked - parse the report instead.
- */
-const runAudit = () => {
-  let stdout
-  try {
-    stdout = execFileSync('npm', ['audit', '--json'], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore']
-    })
-  } catch (error) {
-    stdout = error.stdout
-  }
-  if (!stdout || !stdout.trim()) {
-    throw new Error('npm audit produced no JSON - run `npm ci` first')
-  }
-  return JSON.parse(stdout)
-}
-
-/**
- * The advisories the report names, keyed by GHSA id. A `via` entry is a bare
- * package name when the advisory is inherited from a dependency, and an object
- * carrying the GHSA url when it is the root of the chain - only the latter are
- * advisories in their own right.
- */
-const collectAdvisories = (report) => {
-  const advisories = new Map()
-
-  for (const [packageName, info] of Object.entries(report?.vulnerabilities ?? {})) {
-    for (const via of info?.via ?? []) {
-      if (typeof via !== 'object' || via === null) continue
-      const id = String(via.url ?? '').split('/').pop()
-      if (!id?.startsWith('GHSA-')) continue
-
-      const entry = advisories.get(id) ?? {
-        severity: via.severity,
-        title: via.title,
-        packages: []
-      }
-      entry.packages.push(packageName)
-      advisories.set(id, entry)
-    }
-  }
-
-  return advisories
-}
-
-/** The version the registry currently resolves `latest` to, or null if offline. */
-const latestPublished = (name) => {
-  try {
-    return execFileSync('npm', ['view', name, 'version'], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore']
-    }).trim()
-  } catch {
-    return null
-  }
-}
-
-/**
- * Numeric dotted comparison, so `1.1.10` sorts above `1.1.9`. A prerelease
- * suffix is dropped from both sides first: `1.1.3-beta.1` is not newer than
- * `1.1.3`, and a prerelease that happens to be tagged `latest` must not raise
- * the alarm by itself.
- */
-const isNewer = (candidate, baseline) => {
-  const a = candidate.split('-')[0].split('.')
-  const b = baseline.split('-')[0].split('.')
-  for (let i = 0; i < Math.max(a.length, b.length); i++) {
-    const left = a[i] ?? '0'
-    const right = b[i] ?? '0'
-    if (left === right) continue
-    const leftNumber = Number(left)
-    const rightNumber = Number(right)
-    if (Number.isNaN(leftNumber) || Number.isNaN(rightNumber)) {
-      return left > right
-    }
-    return leftNumber > rightNumber
-  }
-  return false
-}
-
-/**
- * Write the report to the step summary and to the file the workflow reads.
- * Wrapped so a failure to report cannot mask the failure being reported - and
- * so the workflow's `gh issue create --body-file` always has a file, including
- * on the path below where the watch itself broke.
- */
-const writeReport = (summary) => {
-  try {
-    if (process.env.GITHUB_STEP_SUMMARY) {
-      appendFileSync(process.env.GITHUB_STEP_SUMMARY, summary)
-    }
-    if (process.env.AUDIT_WATCH_REPORT) {
-      writeFileSync(process.env.AUDIT_WATCH_REPORT, summary)
-    }
-  } catch (error) {
-    console.error(`could not write the report: ${error.message}`)
-  }
-}
-
-const main = () => {
-  const report = runAudit()
-  const advisories = collectAdvisories(report)
-  const problems = []
-
-  for (const [id, advisory] of advisories) {
-    if (EXEMPTIONS.includes(id)) continue
-    problems.push(
-      `new dev-tree advisory ${id} (${advisory.severity}): ${advisory.title} - ` +
-        `packages: ${[...new Set(advisory.packages)].sort().join(', ')}. ` +
-        'Fix it, or add it to EXEMPTIONS and name it in the build.yml comment.'
-    )
-  }
-
-  for (const id of EXEMPTIONS) {
-    if (advisories.has(id)) continue
-    problems.push(
-      `exempted advisory ${id} no longer appears in the tree - the exemption is ` +
-        'dead weight. Remove it from EXEMPTIONS and from the build.yml comment, ' +
-        'and restore the full `npm audit` gate.'
-    )
-  }
-
-  for (const { name, newestKnown } of WATCHED_FOR_RELEASE) {
-    const latest = latestPublished(name)
-    if (latest === null) {
-      console.log(`skipped the registry check for ${name} - npm view failed`)
-      continue
-    }
-    if (isNewer(latest, newestKnown)) {
-      problems.push(
-        `${name} has published ${latest}, newer than the ${newestKnown} recorded ` +
-          'with the exemption - a fix may exist. Re-evaluate the exemption, bump ' +
-          'the chain if it clears, and drop the exemption when it does.'
-      )
-    }
-  }
-
-  const buildWorkflow = readFileSync(path.join(ROOT, BUILD_WORKFLOW), 'utf8')
-  for (const id of EXEMPTIONS) {
-    if (buildWorkflow.includes(id)) continue
-    problems.push(
-      `exemption ${id} is not named in ${BUILD_WORKFLOW} - the gate and this ` +
-        'script disagree about what is exempt.'
-    )
-  }
-
-  const { moderate = 0, high = 0, critical = 0, total = 0 } =
-    report?.metadata?.vulnerabilities ?? {}
-
-  const summary = [
-    '## Dev-tree audit watch',
-    '',
-    `Full audit: ${total} advisories (${critical} critical, ${high} high, ${moderate} moderate).`,
-    '',
-    '| advisory | severity | packages | exempt |',
-    '| --- | --- | --- | --- |',
-    ...[...advisories].map(
-      ([id, advisory]) =>
-        `| ${id} | ${advisory.severity} | ${[...new Set(advisory.packages)].sort().join(', ')} | ` +
-        `${EXEMPTIONS.includes(id) ? 'yes' : '**no**'} |`
-    ),
-    '',
-    problems.length
-      ? ['### The exemption needs attention', '', ...problems.map((p) => `- ${p}`), ''].join('\n')
-      : 'The exemption still matches the tree - nothing to do.',
-    ''
-  ].join('\n')
-
-  console.log(summary)
-  writeReport(summary)
-
-  process.exitCode = problems.length ? 1 : 0
-}
-
-try {
-  main()
-} catch (error) {
-  // The watch itself broke, so the exemption went unchecked. Say so in the
-  // report rather than leaving the workflow to fail on a missing file.
-  const summary = [
-    '## Dev-tree audit watch',
-    '',
-    'The watch did not complete, so the dev-tree audit exemption was **not**',
-    'checked against the tree. Nothing is known about the advisories right now.',
-    '',
-    '```',
-    error.message,
-    '```',
-    '',
-    'Investigate the failing step, then re-run the workflow.',
-    ''
-  ].join('\n')
-
-  console.error(`audit watch failed: ${error.message}`)
-  writeReport(summary)
-  process.exit(1)
-}

package/scripts/generate-macro-names.mjs

@@ -1,101 +0,0 @@
-/**
- * Generates `src/utils/sasMacros.generated.ts` from the SAS language data.
- *
- * The list of macros that ship with SAS is not lint's to maintain: it is
- * language data, and `@sasjs/sas-language` owns it. This script reads the
- * `macroStatements` and `macroFunctions` groups and emits the names the
- * `noUndeclaredMacros` rule treats as declared.
- *
- * The output is committed so that the published package carries no dependency
- * on the data package, and `src/utils/sasMacros.spec.ts` regenerates the list
- * from the same data and fails when the two differ, so a refresh upstream
- * cannot leave the constant stale.
- *
- * Run with `npm run generate:macros`.
- */
-import { readFile, writeFile } from 'node:fs/promises'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const PACKAGE = '@sasjs/sas-language'
-const GROUPS = ['macroStatements', 'macroFunctions']
-const TARGET = path.join(ROOT, 'src', 'utils', 'sasMacros.generated.ts')
-
-const indexPath = (group) =>
-  path.join(
-    ROOT,
-    'node_modules',
-    ...PACKAGE.split('/'),
-    'data',
-    `${group}.index.json`
-  )
-
-/**
- * Every macro name a group carries, as a bare lower-case name. Compound
- * entries such as `%DO %UNTIL` are dropped: they are a spelling of the
- * `%DO` statement and no source token can match them.
- */
-const collectMacroNames = async () => {
-  const names = new Set()
-
-  for (const group of GROUPS) {
-    let parsed
-    try {
-      parsed = JSON.parse(await readFile(indexPath(group), 'utf8'))
-    } catch (error) {
-      throw new Error(
-        `cannot read ${PACKAGE}/data/${group}.index.json - run 'npm install' first (${error.message})`
-      )
-    }
-
-    if (!Array.isArray(parsed?.entries)) {
-      throw new Error(
-        `${PACKAGE}/data/${group}.index.json has an unexpected shape: expected { entries: [] }`
-      )
-    }
-
-    for (const entry of parsed.entries) {
-      const name = String(entry?.[0] ?? '')
-        .replace(/^%/, '')
-        .trim()
-        .toLowerCase()
-      if (!name || /\s/.test(name)) continue
-      names.add(name)
-    }
-  }
-
-  return [...names].sort()
-}
-
-/**
- * The generated file's text.
- */
-const render = (names) =>
-  [
-    '// Generated by scripts/generate-macro-names.mjs from @sasjs/sas-language.',
-    '// Do not edit. Regenerate with `npm run generate:macros`.',
-    '',
-    '/**',
-    ' * The macro names that ship with SAS, lower-cased and without the leading',
-    ' * `%`, as published in the macroStatements and macroFunctions groups of',
-    ' * `@sasjs/sas-language`.',
-    ' */',
-    'export const sasMacros: readonly string[] = [',
-    ...names.map((name) => `  '${name}',`),
-    ']',
-    ''
-  ].join('\n')
-
-const main = async () => {
-  const names = await collectMacroNames()
-  await writeFile(TARGET, render(names))
-  console.log(
-    `written: src/utils/sasMacros.generated.ts (${names.length} names)`
-  )
-}
-
-main().catch((error) => {
-  console.error(`generation failed: ${error.message}`)
-  process.exit(1)
-})