@sasjs/lint 4.3.2 → 4.3.3

package/package.json

@@ -15,7 +15,8 @@
     "lint": "npx prettier --check \"{src,test}/**/*.{ts,tsx,js,jsx,html,css,sass,less,json,yml,md,graphql}\"",
     "mutation": "stryker run",
     "mutation:changed": "node scripts/mutation-gate.mjs pr",
-    "mutation:watch": "node scripts/mutation-gate.mjs weekly"
+    "mutation:watch": "node scripts/mutation-gate.mjs weekly",
+    "check:package": "node scripts/checkPackageContents.mjs"
   },
   "publishConfig": {
     "access": "public"
@@ -74,11 +75,29 @@
     "ts-jest": "29.4.14",
     "typescript": "6.0.3"
   },
+  "files": [
+    "index.js",
+    "index.js.map",
+    "index.d.ts",
+    "checkNodeVersion.js",
+    "formatExample.js",
+    "formatExample.js.map",
+    "formatExample.d.ts",
+    "lintExample.js",
+    "lintExample.js.map",
+    "lintExample.d.ts",
+    "format",
+    "lint",
+    "rules",
+    "types",
+    "utils",
+    "sasjslint-schema.json"
+  ],
   "dependencies": {
-    "@sasjs/utils": "4.0.0",
+    "@sasjs/utils": "^4.0.0",
     "ignore": "7.0.11"
   },
-  "version": "4.3.2",
+  "version": "4.3.3",
   "devEngines": {
     "runtime": {
       "name": "node",

package/.all-contributorsrc

@@ -1,123 +0,0 @@
-{
-  "files": [
-    "README.md"
-  ],
-  "imageSize": 100,
-  "commit": false,
-  "contributors": [
-    {
-      "login": "Carus11",
-      "name": "Carus Kyle",
-      "avatar_url": "https://avatars.githubusercontent.com/u/4925828?v=4",
-      "profile": "https://github.com/Carus11",
-      "contributions": [
-        "ideas"
-      ]
-    },
-    {
-      "login": "allanbowe",
-      "name": "Allan Bowe",
-      "avatar_url": "https://avatars.githubusercontent.com/u/4420615?v=4",
-      "profile": "https://github.com/allanbowe",
-      "contributions": [
-        "code",
-        "test",
-        "review",
-        "video",
-        "doc"
-      ]
-    },
-    {
-      "login": "YuryShkoda",
-      "name": "Yury Shkoda",
-      "avatar_url": "https://avatars.githubusercontent.com/u/25773492?v=4",
-      "profile": "https://www.erudicat.com/",
-      "contributions": [
-        "code",
-        "test",
-        "projectManagement",
-        "video",
-        "doc"
-      ]
-    },
-    {
-      "login": "krishna-acondy",
-      "name": "Krishna Acondy",
-      "avatar_url": "https://avatars.githubusercontent.com/u/2980428?v=4",
-      "profile": "https://krishna-acondy.io/",
-      "contributions": [
-        "code",
-        "test",
-        "review",
-        "infra",
-        "platform",
-        "maintenance",
-        "content"
-      ]
-    },
-    {
-      "login": "saadjutt01",
-      "name": "Muhammad Saad ",
-      "avatar_url": "https://avatars.githubusercontent.com/u/8914650?v=4",
-      "profile": "https://github.com/saadjutt01",
-      "contributions": [
-        "code",
-        "test",
-        "review",
-        "mentoring",
-        "doc"
-      ]
-    },
-    {
-      "login": "sabhas",
-      "name": "Sabir Hassan",
-      "avatar_url": "https://avatars.githubusercontent.com/u/82647447?v=4",
-      "profile": "https://github.com/sabhas",
-      "contributions": [
-        "code",
-        "test",
-        "review",
-        "ideas"
-      ]
-    },
-    {
-      "login": "medjedovicm",
-      "name": "Mihajlo Medjedovic",
-      "avatar_url": "https://avatars.githubusercontent.com/u/18329105?v=4",
-      "profile": "https://github.com/medjedovicm",
-      "contributions": [
-        "code",
-        "test",
-        "review",
-        "infra"
-      ]
-    },
-    {
-      "login": "VladislavParhomchik",
-      "name": "Vladislav Parhomchik",
-      "avatar_url": "https://avatars.githubusercontent.com/u/83717836?v=4",
-      "profile": "https://github.com/VladislavParhomchik",
-      "contributions": [
-        "test",
-        "review"
-      ]
-    },
-    {
-      "login": "McGwire-Jones",
-      "name": "McGwire-Jones",
-      "avatar_url": "https://avatars.githubusercontent.com/u/51411005?v=4",
-      "profile": "https://github.com/McGwire-Jones",
-      "contributions": [
-        "code"
-      ]
-    }
-  ],
-  "contributorsPerLine": 7,
-  "projectName": "lint",
-  "projectOwner": "sasjs",
-  "repoType": "github",
-  "repoHost": "https://github.com",
-  "skipCi": true,
-  "commitConvention": "none",
-  "commitType": "docs"
-}

package/.git-hooks/commit-msg

@@ -1,18 +0,0 @@
-#!/bin/sh
-RED="\033[1;31m"
-GREEN="\033[1;32m"
-
-# Get the commit message (the parameter we're given is just the path to the
-# temporary file which holds the message).
-commit_message=$(cat "$1")
-
-if (echo "$commit_message" | grep -Eq "^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([a-z \-]+\))?!?: .+$") then
-   echo "${GREEN} ✔ Commit message meets Conventional Commit standards"
-   exit 0
-fi
-
-echo "${RED}❌ Commit message does not meet the Conventional Commit standard!"
-echo "An example of a valid message is:"
-echo "  feat(login): add the 'remember me' button"
-echo "ℹ More details at: https://www.conventionalcommits.org/en/v1.0.0/#summary"
-exit 1

package/.git-hooks/pre-commit

@@ -1,18 +0,0 @@
-#!/bin/bash
-
-# Scan staged changes for secrets before anything else runs.
-# The binary is pinned by the @nogoo9/gitleaks devDependency and lands in
-# node_modules/.bin after `npm i` in the repo root. Commits are blocked until
-# it is installed so no clone silently skips the secrets scan.
-gitleaks_bin=node_modules/.bin/gitleaks
-
-if [ ! -x "$gitleaks_bin" ]; then
-    echo "gitleaks not found - run 'npm i' in the repo root to install it"
-    exit 1
-fi
-
-if ! "$gitleaks_bin" protect --staged --redact; then
-    echo "gitleaks detected a potential secret in your staged changes"
-    echo "Remove the secret, or add a .gitleaksignore entry if it is a false positive"
-    exit 1
-fi

package/.github/CONTRIBUTING.md

@@ -1,201 +0,0 @@
-# Contributing
-
-Contributions to `@sasjs/lint` are very welcome. This repo is a TypeScript library with no SAS dependency - it reads `.sas` files as text - so you can work on every rule, the formatter and the JSON schema with Node alone.
-
-Please fill in the pull request template and make sure your changes are covered by tests.
-
-## Quick start
-
-Node 22 or later (the `engines` field), and no lifecycle scripts:
-
-```bash
-git clone https://github.com/sasjs/lint.git
-cd lint
-npm ci                        # .npmrc sets ignore-scripts=true, so nothing runs on install
-git config core.hooksPath ./.git-hooks   # the prepare script is one of those scripts
-```
-
-Then:
-
-```bash
-npm test           # jest WITH the coverage gate - this is the one CI runs
-npm run lint       # prettier --check over src and test
-npx tsc --noEmit   # type check
-npm run build      # emit ./build, needed by anything that requires the built library
-```
-
-`npx jest` alone does not apply the coverage threshold, so a change can look green locally and fail CI. Use `npm test`.
-
-## Where things live
-
-- `src/rules/file/`, `src/rules/line/`, `src/rules/path/` - one module per rule, `<name>.ts` plus `<name>.spec.ts`, each re-exported from its folder's `index.ts`.
-- `src/lint/` - `lintText`, `lintFile`, `lintFolder`, `lintProject`, and `shared.ts` (`processText`, `processFile`, `processLine`).
-- `src/format/` - `formatText`, `formatFile`, `formatFolder`, `formatProject`, and `shared.ts`.
-- `src/types/` - `LintConfig.ts` (the rule registry and defaults), `LintRule.ts` (the File/Line/Path interfaces), `Diagnostic.ts`, `Severity.ts`, `LineEndings.ts`.
-- `src/utils/` - shared helpers: `splitText`, `splitLines`, `getHeaderLinesCount`, `parseMacros`, `parseMacroCalls`, `headerMacros`, `mergeLintConfig`, `parseLintOverride`, `sasMacros`.
-- `sasjslint-schema.json` and `README.md` - the public contract for every setting.
-
-## Architecture
-
-There are three types of rule:
-
-- File rules - run once against the whole file
-- Line rules - run once per line
-- Path rules - run against a file path or name
-
-A rule exports an object conforming to the `LintRule` interface: `type`, `name`, `description` and `message` at minimum. File, line and path rules also have `test`, a function returning `Diagnostic[]` for the consuming application to display. Rules that can repair what they find also have `fix`, which takes the original content - a line or the whole file - and returns it transformed. Path rules have no `fix`.
-
-`test` reports positions as `lineNumber`, `startColumnNumber` and `endColumnNumber`. Severity comes from `config.severityLevel[name] || Severity.Warning`, so a rule must read its own name key.
-
-## Adding a rule
-
-Moving the check into an existing rule versus adding a new one is a design call. A rule that must be separately switchable cannot be folded into another, because `severityLevel` is per rule NAME - one name means one opt-out. Check what the neighbouring rule's registration condition is first: a rule that only registers when a key is an explicit non-`off` value drags its whole remit along with any check folded in.
-
-When a new rule is the right answer:
-
-1. Add `src/rules/<type>/X.ts` and `X.spec.ts`.
-2. Export it from `src/rules/<type>/index.ts`.
-3. Register it in `src/types/LintConfig.ts`, choosing the default posture:
-   - `if (json?.X !== false)` pushes a rule that is ON by default;
-   - `if (json?.X)` pushes one that is OFF by default.
-   A rule whose `fix` must run during autoformat has to be ON, because the fix only runs for rules present in the config.
-4. Add the key to the README config block and a `### X` section in alphabetical position, with `Default:` and `Severity:`.
-5. Add the schema entries in `sasjslint-schema.json`: the `default` object, the `examples` object, a `properties.X` block, and a `severityLevel.properties.X` entry.
-6. Add specs for both the default-on and the default-off path.
-
-There is no "warn but do not fix" state. A rule with a `fix` either has both warning and repairing active, or is absent and does neither. If your `fix` rewrites files, defaulting it ON changes the output of `sasjs lint fix` and format-on-save for every existing user, so say so in the PR and mark the commit accordingly.
-
-## The three documents that must agree
-
-`DefaultLintConfiguration` (`src/utils/getLintConfig.ts`), the fenced config block in `README.md`, and the `default` object in `sasjslint-schema.json` state the same thing, and they drift. Treat them as one artifact: complete the default object first, then mirror it into both documents. `src/utils/getLintConfig.spec.ts` fails if any of the three disagree, and also enumerates the settings the constructor reads, so a setting added to `LintConfig` but not to the defaults is caught. An absent key must mean the documented default - a project with no `.sasjslint` and a project whose file omits the key must get the same rule set.
-
-## Reading a file: one split for line endings
-
-Readers must not split content on the ending CONFIGURED in `lineEndings`. That value says what the project wants, not what the file contains, and the lint path does not normalise - so a `crlf` split over an LF file returns one string holding the whole file, and column lookups then throw. Use `splitLines` (`src/utils/splitLines.ts`), which splits on `\r\n` or `\n` and drops the carriage returns. Writers still join with the configured ending.
-
-The formatter currently survives the mismatch because `lineEndings.fix` runs before the later rules, but that is not a licence for a reader to assume it: `formatFile` lints before it formats.
-
-## Formatter rules
-
-Only file and line rules that carry a `fix` run during formatting, in the order they were pushed onto the config. `hasDoxygenHeader` is pushed first, so with the default config a `fix` may assume a Doxygen header exists - but it must still return the text unchanged when there is none.
-
-A `fix` must be idempotent: format the same file twice and the second pass must change nothing. Formatting a corpus twice and comparing is the quickest way to prove it. A non-idempotent fix shows up as churn and an inflated `fixedDiagnosticsCount`.
-
-Two rules can reconcile the same header from opposite sides - `noUndeclaredMacros` adds used-but-undeclared names and `noUnusedMacros` removes declared-but-unused ones - so a removal helper must keep the `<h4> SAS Macros </h4>` heading when the list empties, or the add side loses its place to write.
-
-## Testing
-
-Most of the code is pure functions, so there is little to mock and no excuse for not testing a rule. When adding a rule, test the positive and negative scenarios in separate cases; when changing one, run the suite to prove nothing else moved.
-
-Two habits catch the failures that plain coverage does not:
-
-- **Mutation-check your assertions.** Revert the behaviour one piece at a time and confirm a test fails. An assertion that passes on the broken code is documenting nothing. Watch for vacuous cases: for example, a "does not throw" test over a mis-split file passes while the mis-split still contains the string being searched for, so the fixture has to be shaped to fail.
-- **A negative test must fail for the reason it names.** Assert on the specific message or error, never a bare `toThrow()`.
-
-### Mutation testing
-
-The habit above is automated, because the mutant you think to try is rarely the
-one that matters. Stryker rewrites the source in small ways (an operator, a
-string, a branch) and runs the tests; a mutant that survives is behaviour no
-test asserts.
-
-```bash
-npm run mutation:changed     # only the files this branch changed, vs the baseline
-MUTATION_FILES=src/utils/parseMacroCalls.ts npm run mutation:changed   # one file
-npm run mutation             # whatever stryker.conf.json selects
-npm run mutation:watch       # the whole tree; prints a refreshed baseline
-```
-
-The gate compares each file with `mutation-baseline.json` and fails when a file
-carries MORE surviving mutants than the baseline records, so it asks "did this
-branch add an untested behaviour?", not "is the repo perfect yet". A file with no
-baseline must reach 80%. `mutation-pr.yml` runs the changed-file gate on every
-pull request; `mutation-weekly.yml` runs the whole tree and fails if anything
-regressed, which is how the baseline is refreshed (the run prints the new JSON to
-paste in).
-
-Two things to know before running it:
-
-- the dev tree needs Node 22.18 or newer: `@stryker-mutator/core` pulls `@babel/*` 8,
-  whose `engines` start at 22.18. `package.json` records that in `devEngines` (dev installs
-  warn, published installs are unaffected - the tarball carries no devDependencies).
-
-
-- `jest.stryker.config.js` differs from `jest.config.js` in switching coverage
-  off, and in nothing else: a skipped spec records the mutants it covers as
-  legitimate survivors, and the weekly refresh writes them into the baseline.
-  `isIgnored` therefore derives its path with `path.relative(root, file)` and
-  returns false for a path outside the root, and `isIgnored.spec.ts` pins
-  `getProjectRoot()` with a jest mock - the `ignore` package rejects an absolute
-  or `..`-prefixed path, which is what a sandbox run produced before.
-- a run mutates the file(s) in a sandbox under `.stryker-tmp`, and `jest.config.js`
-  ignores that directory by a `<rootDir>`-anchored pattern - an unanchored one
-  makes Stryker's own dry run collect nothing.
-
-A surviving mutant is either a missing test or an EQUIVALENT mutant (a change
-that cannot alter behaviour, such as dropping a check the following regular
-expression repeats). Add the spec that fails on it, or say in the PR body why it
-is equivalent - do not lower the baseline.
-
-## Regenerating the shipped macro list
-
-The macros SAS ships are language data, owned by `@sasjs/sas-language`. Do not hand-write them here. `npm run generate:macros` reads its `macroStatements` and `macroFunctions` groups and writes `src/utils/sasMacros.generated.ts`, which is committed so the published package carries no runtime dependency. `sasMacros.spec.ts` reads the same data independently and fails when the committed list differs, which is the drift guard. Extending that vocabulary is a PR to `@sasjs/sas-language`.
-
-## Code style
-
-The repo uses `Prettier`. In VS Code, install the Prettier extension and set `editor.formatOnSave` (and `editor.formatOnPaste`) to `true`. Otherwise run `npm run lint:fix` before committing, and `npm run lint` to check.
-
-## Git hooks
-
-The repo ships its own hooks in [`.git-hooks/`](../.git-hooks):
-
-- `pre-commit` - scans staged changes for secrets with gitleaks, and requires the `@nogoo9/gitleaks` devDependency to be installed
-- `commit-msg` - verifies the commit message follows the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/#summary) standard
-
-The repo `.npmrc` sets `ignore-scripts=true`, so the `prepare` script that would normally set `core.hooksPath` during `npm i` never runs. After cloning (or if your commits are not being checked), activate the hooks with a one-time command, run from the repo root:
-
-```bash
-git config core.hooksPath ./.git-hooks
-```
-
-The pre-commit hook runs the gitleaks binary provided by the `@nogoo9/gitleaks` devDependency, so make sure `npm i` has run in the repo root before your first commit.
-
-If you use the [pre-commit](https://pre-commit.com) framework, the repo also ships a [`.pre-commit-config.yaml`](../.pre-commit-config.yaml) that pins the upstream gitleaks hook to an exact release tag. Activate it with `pre-commit install`.
-
-## Commit messages and releases
-
-Merging to `main` runs semantic-release: the commit type decides the version, and a release publishes to npm. Only `feat:`, `fix:` and `perf:` cut a release - a `chore:` or `docs:` PR publishes nothing, which is correct rather than a failure.
-
-For a squash merge the PR TITLE drives the version, so keep it conventional. Judge the type by what users see: a new diagnostic message, or a formatter that now rewrites files it used to leave alone, is new behaviour and belongs in `feat:` even when it also fixes a defect. Warnings do not move the exit code of `sasjs lint` - only `noEncodedPasswords` ships as an error - so a new warning does not break CI for consumers; a rewritten file might surprise them, and the release notes are where to say so.
-
-Mark a genuinely breaking change with `BREAKING CHANGE:` in the commit body, and name the config key that restores the old behaviour.
-
-## The audit gate
-
-`build.yml` runs `npm audit --omit=dev --audit-level=low`, scoped to production dependencies because the dev tree carries one advisory nothing here can fix (`sprintf-js` through the jest transform chain, with no patched release). A weekly `audit-watch.yml` runs the FULL audit and fails when that exemption stops matching reality - a new dev-tree advisory, the exempted one disappearing, or a watched package publishing a newer version.
-
-Do not add a dev-tree advisory to the exemption to get a build green. Prefer removing the dependency; if an exemption is genuinely unavoidable, it needs the reachability argument written down and a guard that closes it, not an allowlist.
-
-## CI is the enforcement point
-
-The [build workflow](./workflows/build.yml) scans the full history for secrets with gitleaks, runs `npm audit`, checks code style and runs the tests. The local hooks are convenience - CI is what a red finding must fail.
-
-## The release toolchain lives in the workflow
-
-semantic-release is not a project dependency. Every `@semantic-release` plugin declares a `semantic-release` peer, so adding one to `devDependencies` makes npm auto-install semantic-release along with the `npm` package it bundles - and that bundled npm carries advisories this repo cannot fix.
-
-Instead, [publish.yml](./workflows/publish.yml) installs semantic-release, `@semantic-release/exec` and `@semantic-release/git` on the fly, pinned to exact versions. When you add or remove an entry in `release.plugins` (package.json), update that command to match.
-
-## What to work on
-
-The formatter applies these fixes today: `%mend` macro names, a Doxygen header template, adding undeclared macros to the `<h4> SAS Macros </h4>` section, removing unused macros from it, trailing spaces, and line endings (including a missing final newline) when [`lineEndings`](../README.md#lineendings) is configured.
-
-Fixes not yet implemented, roughly in order of usefulness:
-
-- Change tabs to spaces
-- Remove gremlin characters
-- Convert single asterisk comments to block comments
-
-Harder, and still under investigation: automatic indentation and code layout.
-
-Rules without a fix are equally welcome - a rule that reports something real is worth more than one that silently repairs it wrong. Open an issue describing the SAS construct and what a false positive would look like before you build it, so the heuristic can be argued about cheaply.

package/.github/PULL_REQUEST_TEMPLATE.md

@@ -1,21 +0,0 @@
-## Issue
-
-Link any related issue(s) in this section.
-
-## Intent
-
-What this PR intends to achieve.
-
-## Implementation
-
-What code changes have been made to achieve the intent.
-
-## Checks
-
-- [ ] Code is formatted correctly (`npm run lint:fix`).
-- [ ] Any new functionality has been unit tested.
-- [ ] All unit tests are passing (`npm test`).
-- [ ] All CI checks are green.
-- [ ] sasjslint-schema.json is updated with any new / changed functionality
-- [ ] JSDoc comments have been added or updated.
-- [ ] Reviewer is assigned.

package/.github/dependabot.yml

@@ -1,7 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: npm
-    directory: '/'
-    schedule:
-      interval: monthly
-    open-pull-requests-limit: 3

package/.github/workflows/audit-watch.yml

@@ -1,68 +0,0 @@
-name: Audit Watch
-
-# The build gate runs `npm audit --omit=dev`, because the dev tree carries one
-# advisory that cannot be fixed from here (GHSA-hp3w-g68c-fv3c, sprintf-js - see
-# the Security Audit step in build.yml). Nothing in build.yml re-checks the dev
-# tree, so that exemption would otherwise be open-ended. This runs the full audit
-# weekly and fails when the exemption stops matching reality: a new dev-tree
-# advisory appears, an exempted one disappears, or a package named in the
-# exemption publishes a newer release. Any of those files an issue - and only
-# those, because a scheduled job that is red every week trains people to ignore
-# red.
-
-on:
-  schedule:
-    - cron: '0 8 * * 1' # Mondays, 08:00 UTC
-  workflow_dispatch:
-
-jobs:
-  watch:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      issues: write
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Use Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - name: Install Dependencies
-        run: npm ci
-
-      - name: Re-check the dev-tree audit exemption
-        id: watch
-        env:
-          AUDIT_WATCH_REPORT: ${{ runner.temp }}/audit-watch-report.md
-        run: node scripts/audit-watch.mjs
-
-      - name: File an issue
-        # `always()` because the watched step has already failed, which would
-        # otherwise skip this one.
-        if: always() && steps.watch.outcome == 'failure'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPORT: ${{ runner.temp }}/audit-watch-report.md
-        run: |
-          title='Audit watch: the dev-tree exemption needs re-evaluating'
-          existing=$(gh issue list --state open --search "\"$title\" in:title" \
-            --json number --jq '.[0].number // empty')
-
-          if [ -n "$existing" ]; then
-            echo "already tracked in #$existing"
-            exit 0
-          fi
-
-          if [ -f "$REPORT" ]; then
-            gh issue create --title "$title" --body-file "$REPORT"
-          else
-            # The script writes a report even when the watch itself breaks, so
-            # this means it never started. File the issue anyway rather than
-            # failing on a missing path and filing nothing.
-            gh issue create --title "$title" --body \
-              "The audit watch step failed before producing a report. Check the run:
-          $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
-          fi

package/.github/workflows/build.yml

@@ -1,66 +0,0 @@
-# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
-
-name: SASjs Lint Build
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        # The floor is what the manifest declares; lts/* tracks the newest LTS.
-        # Testing only lts/* would let a change that breaks node 22 ship, since
-        # lts/* already resolves to 24.
-        node-version: [22, lts/*]
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: npm
-      - name: Install Dependencies
-        run: npm ci
-      - name: Scan for secrets (gitleaks)
-        # The local pre-commit hook is suppressed entirely when .npmrc sets
-        # ignore-scripts=true (the prepare script that would activate the
-        # hooks never runs), so CI is the enforcement point: a leaked
-        # credential must fail the build, not just a commit.
-        # Uses the same @nogoo9/gitleaks binary the pre-commit hook pins - the
-        # gitleaks-action requires a license key for organization repos.
-        run: node_modules/.bin/gitleaks detect --source . --redact --no-banner -v
-      - name: Security Audit
-        # Prod-scoped on purpose: this gate covers what actually ships. The
-        # release toolchain is not a project dependency (see publish.yml), so
-        # the `npm` package bundled by @semantic-release/npm never reaches this
-        # tree - which is what made the old exemption-based audit script
-        # necessary. The dev tree carries one advisory that cannot be fixed
-        # from here: GHSA-hp3w-g68c-fv3c, sprintf-js reached through
-        # @jest/transform -> babel-plugin-istanbul ->
-        # @istanbuljs/load-nyc-config -> js-yaml 3 -> argparse. Every package in
-        # that chain is at its latest published version, and the advisory lists
-        # no patched release at all (sprintf-js 1.1.3 is the newest and is
-        # still in range), so gating on it would mean a permanently red build.
-        # `npm audit fix --force` does not fix it either - it downgrades jest
-        # 30 -> 25 and takes the tree from 21 advisories to 45.
-        #
-        # The exemption is not open-ended: audit-watch.yml runs the full audit
-        # weekly and fails when this comment stops matching the tree - a new
-        # dev-tree advisory, this one disappearing, or sprintf-js publishing a
-        # newer release. Keep the GHSA id named here and in the EXEMPTIONS list
-        # of scripts/audit-watch.mjs.
-        run: npm audit --omit=dev --audit-level=low
-      - name: Check Code Style
-        run: npm run lint
-      - name: Run Unit Tests
-        run: npm test
-      - name: Build Package
-        run: npm run package:lib
-        env:
-          CI: true

package/.github/workflows/mutation-pr.yml

@@ -1,69 +0,0 @@
-name: Mutation (changed files)
-
-# Mutation testing answers a question coverage cannot: does any test FAIL when
-# the code is wrong? Stryker flips an operator or a string in the source and runs
-# the tests; a mutant that survives is behaviour nothing asserts.
-#
-# This job mutates only the source files the PR changed, and compares them with
-# mutation-baseline.json - so it asks "did this branch add an untested
-# behaviour?", not "is the repo perfect yet". The baseline is refreshed by
-# mutation-weekly.yml.
-#
-# Cost control: Stryker runs the tests that cover the mutated file
-# (`enableFindRelatedTests`), and only the mutated file is instrumented. A
-# two-file run takes minutes, not the hours a whole-suite run per mutant would.
-
-on:
-  pull_request:
-    paths:
-      - 'src/**'
-      - 'jest.config.js'
-      - 'jest.stryker.config.js'
-      - 'stryker.conf.json'
-      - 'mutation-baseline.json'
-      - 'scripts/mutation-gate.mjs'
-      - 'package.json'
-      - 'package-lock.json'
-
-# a second push supersedes the first run rather than queueing behind it
-concurrency:
-  group: mutation-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  mutation:
-    runs-on: ubuntu-latest
-    # checkout needs read, and the job writes nothing else
-    permissions:
-      contents: read
-    # a changed-file run takes minutes; the default cap is six hours, which would
-    # hold a runner on a stuck mutation run
-    timeout-minutes: 20
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          # the diff against the base commit needs the base commit
-          fetch-depth: 0
-
-      - name: Use Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-
-      - name: Install Dependencies
-        run: npm ci
-
-      - name: Mutate the changed files
-        env:
-          MUTATION_BASE: ${{ github.event.pull_request.base.sha }}
-        run: node scripts/mutation-gate.mjs pr
-
-      - name: Keep the report
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: mutation-report
-          path: reports/mutation/mutation.json
-          if-no-files-found: ignore