@t09tanaka/test-gates 0.0.0-stage → 0.1.0

package/dist/cli.js

@@ -0,0 +1,1607 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { createRequire } from "module";
+
+// src/core/args.ts
+var COMMANDS = ["check", "mutation", "mutation-result", "selfcheck", "lcov"];
+var UsageError = class extends Error {
+};
+var VALUE_OPTIONS = ["--dir", "--report", "--file"];
+var OPTIONS_BY_COMMAND = {
+  check: ["--dir"],
+  mutation: ["--dir"],
+  "mutation-result": ["--dir", "--report"],
+  selfcheck: ["--dir", "--all", "--first"],
+  lcov: ["--dir", "--file"]
+};
+function parseArgs(argv) {
+  const parsed = {
+    command: null,
+    help: false,
+    version: false,
+    dir: ".",
+    report: null,
+    file: null,
+    mode: null,
+    rest: []
+  };
+  let index = 0;
+  const first = argv[0];
+  if (first !== void 0 && !first.startsWith("-")) {
+    if (!COMMANDS.includes(first)) {
+      throw new UsageError(`unknown command: ${first}`);
+    }
+    parsed.command = first;
+    index = 1;
+  }
+  const allowed = parsed.command ? OPTIONS_BY_COMMAND[parsed.command] : void 0;
+  while (index < argv.length) {
+    const arg = argv[index];
+    index += 1;
+    if (arg === "--") {
+      if (parsed.command !== "mutation" && parsed.command !== "selfcheck") {
+        throw new UsageError('"--" is only accepted by the mutation and selfcheck commands');
+      }
+      parsed.rest.push(...argv.slice(index));
+      break;
+    }
+    if (arg === "--help" || arg === "-h") {
+      parsed.help = true;
+      continue;
+    }
+    if (arg === "--version" || arg === "-v") {
+      parsed.version = true;
+      continue;
+    }
+    const equals = arg.indexOf("=");
+    const name = equals !== -1 ? arg.slice(0, equals) : arg;
+    if (allowed?.includes(name)) {
+      if (VALUE_OPTIONS.includes(name)) {
+        let value;
+        if (equals !== -1) {
+          value = arg.slice(equals + 1);
+        } else {
+          value = argv[index];
+          index += 1;
+        }
+        if (value === void 0 || value === "") {
+          throw new UsageError(`${name} needs a value`);
+        }
+        const key = name.slice(2);
+        parsed[key] = value;
+        continue;
+      }
+      if (equals !== -1) {
+        throw new UsageError(`${name} does not take a value`);
+      }
+      const mode = name === "--all" ? "all" : "first";
+      if (parsed.mode !== null && parsed.mode !== mode) {
+        throw new UsageError("--all and --first cannot be combined");
+      }
+      parsed.mode = mode;
+      continue;
+    }
+    if (parsed.command === "mutation") {
+      parsed.rest.push(arg);
+      continue;
+    }
+    throw new UsageError(
+      parsed.command ? `unknown argument for ${parsed.command}: ${arg}` : `unknown argument: ${arg}`
+    );
+  }
+  if (parsed.command === "selfcheck" && parsed.rest.length === 0 && argv.includes("--")) {
+    throw new UsageError('"--" must be followed by the gate command');
+  }
+  return parsed;
+}
+
+// src/core/manifest.ts
+var MANIFEST_FILE = "test-gates.json";
+var ManifestError = class extends Error {
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isFilled(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function allowanceProblems(entry) {
+  if (!isRecord(entry)) {
+    return [" must be an object"];
+  }
+  const problems = [];
+  if (!isFilled(entry.mutator)) {
+    problems.push(': "mutator" is missing');
+  }
+  if (!isFilled(entry.original)) {
+    problems.push(': "original" is missing');
+  }
+  if (typeof entry.replacement !== "string") {
+    problems.push(': "replacement" is missing');
+  }
+  if (!isFilled(entry.reason)) {
+    problems.push(': "reason" is missing (say why the mutant cannot be observed)');
+  }
+  if (entry.occurrence !== void 0 && !(Number.isInteger(entry.occurrence) && entry.occurrence >= 1)) {
+    problems.push(': "occurrence" must be an integer >= 1');
+  }
+  return problems;
+}
+function validateEquivalentMutants(gatePath, value) {
+  if (value === void 0) {
+    return [];
+  }
+  if (!Array.isArray(value)) {
+    return [{ file: MANIFEST_FILE, message: `${gatePath}: equivalentMutants must be an array` }];
+  }
+  return value.flatMap(
+    (entry, index) => allowanceProblems(entry).map((problem) => ({
+      file: MANIFEST_FILE,
+      message: `${gatePath}: equivalentMutants[${index}]${problem}`
+    }))
+  );
+}
+function isUsableEquivalentMutant(entry) {
+  return allowanceProblems(entry).length === 0;
+}
+function parseEntries(kind, entries, fields, violations) {
+  const usable = [];
+  const seen = /* @__PURE__ */ new Set();
+  entries.forEach((entry, index) => {
+    const at = `${kind}[${index}]`;
+    if (!isRecord(entry)) {
+      violations.push({ file: MANIFEST_FILE, message: `${at} must be an object` });
+      return;
+    }
+    if (!isFilled(entry.path)) {
+      violations.push({ file: MANIFEST_FILE, message: `${at}: "path" is missing` });
+      return;
+    }
+    for (const field of fields) {
+      if (!isFilled(entry[field])) {
+        violations.push({
+          file: MANIFEST_FILE,
+          message: `${entry.path}: "${field}" is missing in ${kind}`
+        });
+      }
+    }
+    if (seen.has(entry.path)) {
+      violations.push({ file: MANIFEST_FILE, message: `${entry.path}: listed twice in ${kind}` });
+      return;
+    }
+    seen.add(entry.path);
+    usable.push(entry);
+  });
+  return usable;
+}
+function parseManifest(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (error) {
+    throw new ManifestError(`${MANIFEST_FILE} is not valid JSON: ${error.message}`);
+  }
+  if (!isRecord(raw)) {
+    throw new ManifestError(`${MANIFEST_FILE} must be a JSON object`);
+  }
+  if (!Array.isArray(raw.gates)) {
+    throw new ManifestError(`${MANIFEST_FILE}: "gates" must be an array`);
+  }
+  if (raw.candidates !== void 0 && !Array.isArray(raw.candidates)) {
+    throw new ManifestError(`${MANIFEST_FILE}: "candidates" must be an array`);
+  }
+  for (const key of Object.keys(raw)) {
+    if (!["$schema", "gates", "candidates", "settings"].includes(key)) {
+      throw new ManifestError(`${MANIFEST_FILE}: unknown top-level key ${JSON.stringify(key)}`);
+    }
+  }
+  const violations = [];
+  if (raw.gates.length === 0) {
+    violations.push({
+      file: MANIFEST_FILE,
+      message: "gates is empty. A project with nothing to gate should not have this file"
+    });
+  }
+  const gates = parseEntries("gates", raw.gates, ["decides", "impact"], violations);
+  const candidates = parseEntries(
+    "candidates",
+    raw.candidates ?? [],
+    ["decides", "blocker"],
+    violations
+  );
+  const gatePaths = new Set(gates.map((gate) => gate.path));
+  for (const candidate of candidates) {
+    if (gatePaths.has(candidate.path)) {
+      violations.push({
+        file: MANIFEST_FILE,
+        message: `${candidate.path}: listed in both gates and candidates`
+      });
+    }
+  }
+  for (const gate of gates) {
+    violations.push(...validateEquivalentMutants(gate.path, gate.equivalentMutants));
+  }
+  return { gates, candidates, settings: raw.settings, violations };
+}
+
+// src/commands/check.ts
+import fs3 from "fs";
+import path3 from "path";
+
+// src/core/imports.ts
+var FROM_STATEMENT = /(?:^|[\n;])[ \t]*(import|export)\s+(type\s+)?([\w$\s,{}*]*?)\s*\bfrom\s*(['"])([^'"\n]+)\4/g;
+var SIDE_EFFECT_IMPORT = /(?:^|[\n;])[ \t]*import\s*(['"])([^'"\n]+)\1/g;
+var CALL_IMPORT = /\b(?:require|import)\s*\(\s*(['"`])([^'"`\n]+)\1\s*\)/g;
+function lineAt(source, index) {
+  let line = 1;
+  for (let i = 0; i < index; i += 1) {
+    if (source[i] === "\n") {
+      line += 1;
+    }
+  }
+  return line;
+}
+function parseImports(source) {
+  const found = [];
+  for (const match of source.matchAll(FROM_STATEMENT)) {
+    const clause = match[3];
+    const module = match[5];
+    const braces = /\{([^}]*)\}/.exec(clause);
+    const names = braces ? braces[1].split(",").map((part) => part.trim()).filter((part) => part !== "" && !/^type\s/.test(part)).map((part) => part.split(/\s+as\s+/)[0].trim()) : [];
+    const outsideBraces = clause.replace(/\{[^}]*\}/, "").replace(/,/g, "").trim();
+    found.push({
+      module,
+      line: lineAt(source, match.index + match[0].lastIndexOf(module)),
+      typeOnly: match[2] !== void 0,
+      names,
+      whole: outsideBraces !== ""
+    });
+  }
+  for (const match of source.matchAll(SIDE_EFFECT_IMPORT)) {
+    const module = match[2];
+    found.push({
+      module,
+      line: lineAt(source, match.index + match[0].lastIndexOf(module)),
+      typeOnly: false,
+      names: [],
+      whole: false
+    });
+  }
+  for (const match of source.matchAll(CALL_IMPORT)) {
+    const module = match[2];
+    found.push({
+      module,
+      line: lineAt(source, match.index + match[0].lastIndexOf(module)),
+      typeOnly: false,
+      names: [],
+      whole: true
+    });
+  }
+  return found.sort((a, b) => a.line - b.line);
+}
+
+// src/core/scan.ts
+var IGNORE_DIRECTIVE = /\b(istanbul|c8|v8)\s+ignore\b/;
+var DECORATOR = /^\s*@[A-Za-z_$][\w$.]*\s*\(/;
+var STRYKER_COMMENT = /Stryker\s+(disable|restore)\b/;
+var DISABLED_TESTS = [
+  { regex: /\.\s*(skip|only|todo)\b/, label: ".skip / .only / .todo" },
+  {
+    regex: /\b(?:describe|it|test|suite)(?:\s*\.\s*\w+)*\s*\.\s*(?:skipIf|runIf|fails)\b/,
+    label: ".skipIf / .runIf / .fails"
+  },
+  {
+    regex: /\b(xit|xtest|xdescribe|fit|fdescribe)\s*[.(]/,
+    label: "xit / xtest / xdescribe / fit / fdescribe"
+  }
+];
+var MODULE_MOCK = /\b(?:jest|vi)\s*\.\s*(?:mock|doMock|unstable_mockModule|setMock)\s*\(\s*(?:import\s*\(\s*)?(['"`])([^'"`\n]+)\1/g;
+var SCRIPT_EXTENSION = /\.[cm]?[jt]sx?$/;
+function eachLine(source, visit) {
+  source.split("\n").forEach((line, index) => visit(line, index + 1));
+}
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function scanGateSource(gatePath, source, settings) {
+  const violations = [];
+  eachLine(source, (line, lineNumber) => {
+    if (DECORATOR.test(line)) {
+      violations.push({
+        file: gatePath,
+        line: lineNumber,
+        message: "decorator found (not a pure module). Move the file to candidates"
+      });
+    }
+    if (IGNORE_DIRECTIVE.test(line)) {
+      violations.push({ file: gatePath, line: lineNumber, message: "coverage ignore directive" });
+    }
+    if (STRYKER_COMMENT.test(line)) {
+      violations.push({
+        file: gatePath,
+        line: lineNumber,
+        message: "Stryker comment (disable / restore). Allow an equivalent mutant in test-gates.json (equivalentMutants) instead"
+      });
+    }
+    for (const rule of settings.forbiddenSource) {
+      if (rule.regex.test(line)) {
+        violations.push({ file: gatePath, line: lineNumber, message: rule.reason });
+      }
+    }
+  });
+  for (const imported of parseImports(source)) {
+    if (imported.typeOnly) {
+      continue;
+    }
+    if (!settings.allowedImports.some((regex) => regex.test(imported.module))) {
+      for (const rule of settings.impureImports) {
+        if (rule.regex.test(imported.module)) {
+          violations.push({
+            file: gatePath,
+            line: imported.line,
+            message: `runtime import of "${imported.module}" (${rule.reason})`
+          });
+        }
+      }
+    }
+    for (const rule of settings.impureNamedImports) {
+      if (imported.module !== rule.module) {
+        continue;
+      }
+      const hit = rule.names.filter(
+        (name) => imported.names.includes(name) || imported.whole && new RegExp(`\\b${escapeRegExp(name)}\\b`).test(source)
+      );
+      if (hit.length > 0) {
+        violations.push({
+          file: gatePath,
+          line: imported.line,
+          message: `runtime use of ${hit.join(", ")} from "${rule.module}" (${rule.reason})`
+        });
+      }
+    }
+  }
+  return violations.sort((a, b) => a.line - b.line);
+}
+function resolveSpecifier(specifier, fromFile, aliases) {
+  let joined = null;
+  if (specifier.startsWith(".")) {
+    const directory = fromFile.includes("/") ? fromFile.slice(0, fromFile.lastIndexOf("/")) : "";
+    joined = directory === "" ? specifier : `${directory}/${specifier}`;
+  } else {
+    for (const alias of aliases) {
+      if (specifier.startsWith(alias.prefix)) {
+        joined = alias.target + specifier.slice(alias.prefix.length);
+        break;
+      }
+    }
+  }
+  if (joined === null) {
+    return null;
+  }
+  const segments = [];
+  for (const segment of joined.split("/")) {
+    if (segment === "..") {
+      segments.pop();
+    } else if (segment !== "." && segment !== "") {
+      segments.push(segment);
+    }
+  }
+  return segments.join("/").replace(SCRIPT_EXTENSION, "");
+}
+function scanSpecSource(gatePath, specPath, source, settings) {
+  const violations = [];
+  eachLine(source, (line, lineNumber) => {
+    if (IGNORE_DIRECTIVE.test(line)) {
+      violations.push({ file: specPath, line: lineNumber, message: "coverage ignore directive" });
+    }
+    for (const { regex, label } of DISABLED_TESTS) {
+      if (regex.test(line)) {
+        violations.push({
+          file: specPath,
+          line: lineNumber,
+          message: `${label} (a skipped or focused test)`
+        });
+      }
+    }
+  });
+  const gateModule = gatePath.replace(SCRIPT_EXTENSION, "");
+  const gateDirectory = gateModule.replace(/\/index$/, "");
+  for (const match of source.matchAll(MODULE_MOCK)) {
+    const specifier = match[2];
+    const resolved = resolveSpecifier(specifier, specPath, settings.importAliases);
+    if (resolved === gateModule || resolved === gateDirectory) {
+      let line = 1;
+      for (let i = 0; i < match.index; i += 1) {
+        if (source[i] === "\n") {
+          line += 1;
+        }
+      }
+      violations.push({
+        file: specPath,
+        line,
+        message: `mocks the module under test ("${specifier}")`
+      });
+    }
+  }
+  return violations.sort((a, b) => a.line - b.line);
+}
+var STRYKER_WEAKENING = /\b(excludedMutations|ignoreStatic|ignorers)\b/;
+function scanStrykerConfig(configPath, source) {
+  const violations = [];
+  eachLine(source, (line, lineNumber) => {
+    const match = STRYKER_WEAKENING.exec(line);
+    if (match) {
+      violations.push({
+        file: configPath,
+        line: lineNumber,
+        message: `${match[1]} takes mutants out of the evaluation. Allow equivalent mutants one by one in test-gates.json instead`
+      });
+    }
+  });
+  return violations;
+}
+
+// src/core/spec-path.ts
+function gateExtensionOf(gatePath, gateExtensions) {
+  const matching = gateExtensions.filter((extension) => gatePath.endsWith(extension)).sort((a, b) => b.length - a.length);
+  return matching[0] ?? null;
+}
+function suffixesFor(extension, settings) {
+  return settings.specSuffixes ?? [`.spec${extension}`, `.test${extension}`];
+}
+function specCandidatesFor(gatePath, settings) {
+  const extension = gateExtensionOf(gatePath, settings.gateExtensions);
+  if (extension === null) {
+    return [];
+  }
+  let base = gatePath.slice(0, -extension.length);
+  for (const { regex, to } of settings.specRewrite) {
+    base = base.replace(regex, to);
+  }
+  return suffixesFor(extension, settings).map((suffix) => base + suffix);
+}
+function looksLikeSpec(gatePath, settings) {
+  const extension = gateExtensionOf(gatePath, settings.gateExtensions);
+  return extension !== null && suffixesFor(extension, settings).some((suffix) => gatePath.endsWith(suffix));
+}
+
+// src/fs.ts
+import fs from "fs";
+import path from "path";
+function existsExact(rootDir, relativePath, kind = "file") {
+  let current = rootDir;
+  for (const segment of relativePath.split("/")) {
+    if (segment === "" || segment === ".") {
+      continue;
+    }
+    let entries;
+    try {
+      entries = fs.readdirSync(current);
+    } catch {
+      return false;
+    }
+    if (!entries.includes(segment)) {
+      return false;
+    }
+    current = path.join(current, segment);
+  }
+  try {
+    return kind === "any" || fs.statSync(current).isFile();
+  } catch {
+    return false;
+  }
+}
+function readText(rootDir, relativePath) {
+  return fs.readFileSync(path.join(rootDir, relativePath), "utf8");
+}
+function findLocalBin(startDir, name) {
+  const file = process.platform === "win32" ? `${name}.cmd` : name;
+  let current = path.resolve(startDir);
+  for (; ; ) {
+    const candidate = path.join(current, "node_modules", ".bin", file);
+    if (fs.existsSync(candidate)) {
+      return candidate;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return null;
+    }
+    current = parent;
+  }
+}
+
+// src/load.ts
+import fs2 from "fs";
+import path2 from "path";
+
+// src/core/settings.ts
+var DEFAULT_REPORT_FILE = "reports/mutation/mutation.json";
+var DEFAULT_GATE_EXTENSIONS = [".ts", ".mts", ".cts", ".js", ".mjs", ".cjs"];
+var DEFAULT_IMPURE_IMPORTS = [
+  { pattern: "^@nestjs/", reason: "NestJS runtime (DI, decorators)" },
+  { pattern: "^class-(validator|transformer)$", reason: "decorator-based DTO library" },
+  {
+    pattern: "^(typeorm|sequelize|mongoose|knex|pg|mysql|mysql2|ioredis|redis)(/|$)",
+    reason: "database client"
+  },
+  { pattern: "^@prisma/adapter-", reason: "database client" },
+  { pattern: "^(react|react-dom)(/|$)", reason: "React runtime" },
+  { pattern: "^next(/|$)", reason: "Next.js runtime" },
+  { pattern: "^(server-only|client-only)$", reason: "Next.js execution environment" },
+  { pattern: "^(vue|vue-router|vue-i18n|pinia)(/|$)", reason: "Vue runtime" },
+  { pattern: "^nuxt(/|$)", reason: "Nuxt runtime" },
+  { pattern: "^#(app|imports)(/|$)", reason: "Nuxt runtime" },
+  { pattern: "\\.vue$", reason: "component" },
+  {
+    pattern: "^(express|express-jwt|fastify|koa|rxjs|passport)(/|$)",
+    reason: "HTTP framework runtime"
+  },
+  { pattern: "^passport-", reason: "HTTP framework runtime" },
+  {
+    pattern: "^(axios|openapi-fetch|stripe|nodemailer|firebase-admin)(/|$)",
+    reason: "HTTP client / external service SDK"
+  },
+  { pattern: "^@(aws-sdk|sentry|slack|stripe)/", reason: "external service SDK" },
+  {
+    pattern: "^(node:)?(fs|http|https|http2|net|tls|dgram|dns|child_process|worker_threads)(/|$)",
+    reason: "file system / network / process access"
+  }
+];
+var DEFAULT_IMPURE_NAMED_IMPORTS = [
+  { module: "@prisma/client", names: ["PrismaClient"], reason: "connects to the database" }
+];
+var DEFAULT_IMPURE_PATHS = [
+  { pattern: "\\.(vue|jsx|tsx)$", reason: "component file" },
+  { pattern: "\\.d\\.[cm]?ts$", reason: "type declaration file" }
+];
+var DEFAULT_FORBIDDEN_SOURCE = [
+  {
+    pattern: `^\\s*(['"])use (client|server)\\1`,
+    reason: "'use client' / 'use server' directive (not a pure module)"
+  }
+];
+var SettingsError = class extends Error {
+};
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function compile(pattern, flags, where) {
+  try {
+    return new RegExp(pattern, flags);
+  } catch (error) {
+    throw new SettingsError(
+      `${where}: invalid regular expression ${JSON.stringify(pattern)} (${error.message})`
+    );
+  }
+}
+function stringArray(value, where) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || item === "")) {
+    throw new SettingsError(`${where}: must be an array of non-empty strings`);
+  }
+  return value;
+}
+function optionalString(value, where) {
+  if (value === void 0) {
+    return null;
+  }
+  if (typeof value !== "string" || value === "") {
+    throw new SettingsError(`${where}: must be a non-empty string`);
+  }
+  return value;
+}
+function rejectUnknownKeys(value, known, where) {
+  for (const key of Object.keys(value)) {
+    if (!known.includes(key)) {
+      throw new SettingsError(`${where}: unknown key ${JSON.stringify(key)}`);
+    }
+  }
+}
+function section(value, known, where) {
+  if (value === void 0) {
+    return {};
+  }
+  if (!isRecord2(value)) {
+    throw new SettingsError(`${where}: must be an object`);
+  }
+  rejectUnknownKeys(value, known, where);
+  return value;
+}
+function compileRules(defaults, raw, where, extraKeys = []) {
+  const config = section(raw, ["defaults", "add", ...extraKeys], where);
+  if (config.defaults !== void 0 && typeof config.defaults !== "boolean") {
+    throw new SettingsError(`${where}.defaults: must be a boolean`);
+  }
+  const added = config.add ?? [];
+  if (!Array.isArray(added)) {
+    throw new SettingsError(`${where}.add: must be an array`);
+  }
+  const all = [];
+  if (config.defaults !== false) {
+    defaults.forEach((rule) => all.push({ rule, where: `${where} (default)` }));
+  }
+  added.forEach((item, index) => {
+    const at = `${where}.add[${index}]`;
+    if (typeof item === "string" && item !== "") {
+      all.push({ rule: { pattern: item }, where: at });
+      return;
+    }
+    if (!isRecord2(item) || typeof item.pattern !== "string" || item.pattern === "") {
+      throw new SettingsError(`${at}: must be a pattern string or { pattern, flags?, reason? }`);
+    }
+    rejectUnknownKeys(item, ["pattern", "flags", "reason"], at);
+    if (item.flags !== void 0 && typeof item.flags !== "string") {
+      throw new SettingsError(`${at}.flags: must be a string`);
+    }
+    if (item.reason !== void 0 && typeof item.reason !== "string") {
+      throw new SettingsError(`${at}.reason: must be a string`);
+    }
+    all.push({ rule: item, where: at });
+  });
+  return {
+    rules: all.map(({ rule, where: at }) => ({
+      regex: compile(rule.pattern, rule.flags, at),
+      reason: rule.reason ?? `matches ${rule.pattern}`
+    })),
+    section: config
+  };
+}
+function resolveSettings(raw) {
+  const settings = section(
+    raw,
+    [
+      "gateExtensions",
+      "spec",
+      "impureImports",
+      "impureNamedImports",
+      "impurePaths",
+      "forbiddenSource",
+      "importAliases",
+      "gateCommand",
+      "selfcheck",
+      "stryker",
+      "lcov"
+    ],
+    "settings"
+  );
+  const gateExtensions = settings.gateExtensions === void 0 ? DEFAULT_GATE_EXTENSIONS : stringArray(settings.gateExtensions, "settings.gateExtensions");
+  if (gateExtensions.length === 0 || gateExtensions.some((ext) => !ext.startsWith("."))) {
+    throw new SettingsError(
+      'settings.gateExtensions: must list at least one extension starting with "."'
+    );
+  }
+  const spec = section(settings.spec, ["suffixes", "rewrite"], "settings.spec");
+  const specSuffixes = spec.suffixes === void 0 ? null : stringArray(spec.suffixes, "settings.spec.suffixes");
+  const rewriteRaw = spec.rewrite ?? [];
+  if (!Array.isArray(rewriteRaw)) {
+    throw new SettingsError("settings.spec.rewrite: must be an array");
+  }
+  const specRewrite = rewriteRaw.map((item, index) => {
+    const at = `settings.spec.rewrite[${index}]`;
+    if (!isRecord2(item) || typeof item.from !== "string" || typeof item.to !== "string") {
+      throw new SettingsError(`${at}: must be { from, to }`);
+    }
+    rejectUnknownKeys(item, ["from", "to"], at);
+    return { regex: compile(item.from, void 0, at), to: item.to };
+  });
+  const imports = compileRules(
+    DEFAULT_IMPURE_IMPORTS,
+    settings.impureImports,
+    "settings.impureImports",
+    ["allow"]
+  );
+  const allowedImports = imports.section.allow === void 0 ? [] : stringArray(imports.section.allow, "settings.impureImports.allow").map(
+    (pattern, index) => compile(pattern, void 0, `settings.impureImports.allow[${index}]`)
+  );
+  const named = section(
+    settings.impureNamedImports,
+    ["defaults", "add"],
+    "settings.impureNamedImports"
+  );
+  if (named.defaults !== void 0 && typeof named.defaults !== "boolean") {
+    throw new SettingsError("settings.impureNamedImports.defaults: must be a boolean");
+  }
+  const namedAdd = named.add ?? [];
+  if (!Array.isArray(namedAdd)) {
+    throw new SettingsError("settings.impureNamedImports.add: must be an array");
+  }
+  const impureNamedImports = [
+    ...named.defaults === false ? [] : DEFAULT_IMPURE_NAMED_IMPORTS,
+    ...namedAdd.map((item, index) => {
+      const at = `settings.impureNamedImports.add[${index}]`;
+      if (!isRecord2(item) || typeof item.module !== "string" || item.module === "") {
+        throw new SettingsError(`${at}: must be { module, names, reason? }`);
+      }
+      rejectUnknownKeys(item, ["module", "names", "reason"], at);
+      const names = stringArray(item.names, `${at}.names`);
+      if (names.length === 0) {
+        throw new SettingsError(`${at}.names: must list at least one name`);
+      }
+      if (item.reason !== void 0 && typeof item.reason !== "string") {
+        throw new SettingsError(`${at}.reason: must be a string`);
+      }
+      return {
+        module: item.module,
+        names,
+        reason: item.reason ?? "not allowed in a pure module"
+      };
+    })
+  ];
+  const aliasesRaw = settings.importAliases ?? [];
+  if (!Array.isArray(aliasesRaw)) {
+    throw new SettingsError("settings.importAliases: must be an array");
+  }
+  const importAliases = aliasesRaw.map((item, index) => {
+    const at = `settings.importAliases[${index}]`;
+    if (!isRecord2(item) || typeof item.prefix !== "string" || item.prefix === "" || typeof item.target !== "string") {
+      throw new SettingsError(`${at}: must be { prefix, target }`);
+    }
+    rejectUnknownKeys(item, ["prefix", "target"], at);
+    return { prefix: item.prefix, target: item.target };
+  });
+  let gateCommand = null;
+  if (settings.gateCommand !== void 0) {
+    gateCommand = stringArray(settings.gateCommand, "settings.gateCommand");
+    if (gateCommand.length === 0) {
+      throw new SettingsError("settings.gateCommand: must not be empty");
+    }
+  }
+  const selfcheck = section(settings.selfcheck, ["mode", "failurePattern"], "settings.selfcheck");
+  if (selfcheck.mode !== void 0 && selfcheck.mode !== "all" && selfcheck.mode !== "first") {
+    throw new SettingsError('settings.selfcheck.mode: must be "all" or "first"');
+  }
+  const selfcheckFailurePattern = optionalString(
+    selfcheck.failurePattern,
+    "settings.selfcheck.failurePattern"
+  );
+  if (selfcheckFailurePattern !== null) {
+    compile(
+      selfcheckFailurePattern.split("{gate}").join("x"),
+      void 0,
+      "settings.selfcheck.failurePattern"
+    );
+  }
+  const stryker = section(settings.stryker, ["configFile", "reportFile"], "settings.stryker");
+  const lcov = section(settings.lcov, ["file", "summaryExclude"], "settings.lcov");
+  return {
+    gateExtensions,
+    specSuffixes,
+    specRewrite,
+    impureImports: imports.rules,
+    allowedImports,
+    impureNamedImports,
+    impurePaths: compileRules(DEFAULT_IMPURE_PATHS, settings.impurePaths, "settings.impurePaths").rules,
+    forbiddenSource: compileRules(
+      DEFAULT_FORBIDDEN_SOURCE,
+      settings.forbiddenSource,
+      "settings.forbiddenSource"
+    ).rules,
+    importAliases,
+    gateCommand,
+    selfcheckMode: selfcheck.mode ?? "all",
+    selfcheckFailurePattern,
+    strykerConfigFile: optionalString(stryker.configFile, "settings.stryker.configFile"),
+    strykerReportFile: optionalString(stryker.reportFile, "settings.stryker.reportFile") ?? DEFAULT_REPORT_FILE,
+    lcovFile: optionalString(lcov.file, "settings.lcov.file"),
+    lcovSummaryExclude: lcov.summaryExclude === void 0 ? [] : stringArray(lcov.summaryExclude, "settings.lcov.summaryExclude").map(
+      (pattern, index) => compile(pattern, void 0, `settings.lcov.summaryExclude[${index}]`)
+    )
+  };
+}
+
+// src/core/selfcheck.ts
+var EXCLUDE_ENV = "TEST_GATES_EXCLUDE_SPEC";
+var THRESHOLD_MESSAGE = /threshold|coverage data for/i;
+function escapeRegExp2(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function judgeSelfcheck(input) {
+  const { status, output, gatePath } = input;
+  if (status === null) {
+    return "the gate command did not run to completion";
+  }
+  if (status === 0) {
+    return `the gate passed although the spec of ${gatePath} was left out. The gate does not measure this file (does the gate config honor ${EXCLUDE_ENV}?)`;
+  }
+  if (input.failurePattern) {
+    const pattern = input.failurePattern.split("{gate}").join(escapeRegExp2(gatePath));
+    return new RegExp(pattern).test(output) ? null : `the gate failed (exit ${status}) but the output does not match settings.selfcheck.failurePattern`;
+  }
+  const reported = output.split("\n").some((line) => line.includes(gatePath) && THRESHOLD_MESSAGE.test(line));
+  return reported ? null : `the gate failed (exit ${status}) but not on the coverage threshold of ${gatePath}. It may be failing for another reason`;
+}
+
+// src/load.ts
+function readManifest(dir) {
+  const absoluteDir = path2.resolve(dir);
+  const manifestPath = path2.join(absoluteDir, MANIFEST_FILE);
+  let text;
+  try {
+    text = fs2.readFileSync(manifestPath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      throw new ManifestError(`${MANIFEST_FILE} not found in ${absoluteDir}`);
+    }
+    throw new ManifestError(`cannot read ${manifestPath}: ${error.message}`);
+  }
+  const parsed = parseManifest(text);
+  let settings;
+  try {
+    settings = resolveSettings(parsed.settings);
+  } catch (error) {
+    if (error instanceof SettingsError) {
+      throw new ManifestError(`${MANIFEST_FILE}: ${error.message}`);
+    }
+    throw error;
+  }
+  const gates = parsed.gates.map((gate) => {
+    const specCandidates = specCandidatesFor(gate.path, settings);
+    const existingSpecs = specCandidates.filter((candidate) => existsExact(absoluteDir, candidate));
+    return {
+      ...gate,
+      specCandidates,
+      existingSpecs,
+      spec: existingSpecs[0] ?? specCandidates[0] ?? null
+    };
+  });
+  return {
+    dir: absoluteDir,
+    gates,
+    candidates: parsed.candidates,
+    settings,
+    violations: parsed.violations
+  };
+}
+
+// src/commands/output.ts
+function formatViolation(violation) {
+  const where = violation.line === void 0 ? violation.file : `${violation.file}:${violation.line}`;
+  return `${where}: ${violation.message}`;
+}
+function printViolations(io2, title, violations) {
+  io2.err(`test-gates ${title}: ${violations.length} violation(s)`);
+  for (const violation of violations) {
+    io2.err(`  - ${formatViolation(violation)}`);
+  }
+}
+
+// src/commands/check.ts
+var STRYKER_CONFIG_NAMES = [
+  "stryker.gates.config.mjs",
+  "stryker.gates.config.js",
+  "stryker.gates.config.cjs",
+  "stryker.gates.config.json"
+];
+function findStrykerConfig(manifest) {
+  if (manifest.settings.strykerConfigFile !== null) {
+    return manifest.settings.strykerConfigFile;
+  }
+  return STRYKER_CONFIG_NAMES.find((name) => fs3.existsSync(path3.join(manifest.dir, name))) ?? null;
+}
+function isPlainRelativePath(file) {
+  return !path3.isAbsolute(file) && !/^[A-Za-z]:/.test(file) && !file.includes("\\") && !file.split("/").some((segment) => segment === ".." || segment === "." || segment === "");
+}
+function checkGates(manifest) {
+  const { dir, settings } = manifest;
+  const violations = [...manifest.violations];
+  for (const gate of manifest.gates) {
+    if (!isPlainRelativePath(gate.path)) {
+      violations.push({
+        file: MANIFEST_FILE,
+        message: `${gate.path}: write the path relative to the subproject, with "/" and without ".."`
+      });
+      continue;
+    }
+    if (gateExtensionOf(gate.path, settings.gateExtensions) === null) {
+      violations.push({
+        file: gate.path,
+        message: `a gate must be one of ${settings.gateExtensions.join(" / ")} (settings.gateExtensions)`
+      });
+      continue;
+    }
+    if (looksLikeSpec(gate.path, settings)) {
+      violations.push({ file: gate.path, message: "a spec cannot be a gate" });
+      continue;
+    }
+    for (const rule of settings.impurePaths) {
+      if (rule.regex.test(gate.path)) {
+        violations.push({
+          file: gate.path,
+          message: `cannot be a gate (${rule.reason}). Move it to candidates`
+        });
+      }
+    }
+    if (!existsExact(dir, gate.path)) {
+      violations.push({
+        file: gate.path,
+        message: "file not found (the check is case-sensitive)"
+      });
+      continue;
+    }
+    violations.push(...scanGateSource(gate.path, readText(dir, gate.path), settings));
+    if (gate.specCandidates.length === 0) {
+      continue;
+    }
+    if (gate.existingSpecs.length === 0) {
+      violations.push({
+        file: gate.path,
+        message: `spec not found (looked for ${gate.specCandidates.join(", ")}; the check is case-sensitive)`
+      });
+      continue;
+    }
+    if (gate.existingSpecs.length > 1) {
+      violations.push({
+        file: gate.path,
+        message: `more than one spec (${gate.existingSpecs.join(", ")}). Keep one, or narrow settings.spec.suffixes`
+      });
+      continue;
+    }
+    const specPath = gate.existingSpecs[0];
+    violations.push(...scanSpecSource(gate.path, specPath, readText(dir, specPath), settings));
+  }
+  for (const candidate of manifest.candidates) {
+    if (!isPlainRelativePath(candidate.path) || !existsExact(dir, candidate.path, "any")) {
+      violations.push({
+        file: MANIFEST_FILE,
+        message: `${candidate.path}: candidate not found. Remove it, or fix the path`
+      });
+    }
+  }
+  const strykerConfig = findStrykerConfig(manifest);
+  if (strykerConfig !== null) {
+    if (!fs3.existsSync(path3.join(dir, strykerConfig))) {
+      violations.push({ file: strykerConfig, message: "Stryker config not found" });
+    } else {
+      violations.push(...scanStrykerConfig(strykerConfig, readText(dir, strykerConfig)));
+    }
+  }
+  return violations;
+}
+function runCheck(dir, io2) {
+  const manifest = readManifest(dir);
+  const violations = checkGates(manifest);
+  if (violations.length > 0) {
+    printViolations(io2, "check", violations);
+    return 1;
+  }
+  io2.out(
+    `test-gates check: OK (${manifest.gates.length} gate(s), ${manifest.candidates.length} candidate(s))`
+  );
+  return 0;
+}
+
+// src/commands/lcov.ts
+import fs4 from "fs";
+import path4 from "path";
+
+// src/core/lcov.ts
+function normalizePath(file, rootDir) {
+  let normalized = file.replace(/\\/g, "/");
+  if (rootDir !== void 0) {
+    const root = rootDir.replace(/\\/g, "/").replace(/\/+$/, "");
+    if (normalized.startsWith(`${root}/`)) {
+      normalized = normalized.slice(root.length + 1);
+    }
+  }
+  return normalized.replace(/^\.\//, "");
+}
+function parseLcov(text, rootDir) {
+  const files = /* @__PURE__ */ new Map();
+  let record = null;
+  const closeRecord = () => {
+    if (record && !record.hasDa) {
+      record.file.found += record.found;
+      record.file.hit += record.hit;
+    }
+    record = null;
+  };
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (line.startsWith("SF:")) {
+      closeRecord();
+      const path7 = normalizePath(line.slice(3), rootDir);
+      const file = files.get(path7) ?? { lines: /* @__PURE__ */ new Map(), found: 0, hit: 0 };
+      files.set(path7, file);
+      record = { file, hasDa: false, found: 0, hit: 0 };
+    } else if (line === "end_of_record") {
+      closeRecord();
+    } else if (record) {
+      const open = record;
+      if (line.startsWith("DA:")) {
+        const [lineNumber, hits] = line.slice(3).split(",");
+        const number = Number(lineNumber);
+        const count = Number(hits);
+        if (Number.isInteger(number) && Number.isFinite(count)) {
+          open.hasDa = true;
+          open.file.lines.set(number, Math.max(open.file.lines.get(number) ?? 0, count));
+        }
+      } else if (line.startsWith("LF:")) {
+        open.found = Number(line.slice(3)) || 0;
+      } else if (line.startsWith("LH:")) {
+        open.hit = Number(line.slice(3)) || 0;
+      }
+    }
+  }
+  closeRecord();
+  const result = /* @__PURE__ */ new Map();
+  for (const [file, accumulator] of files) {
+    const uncovered = [...accumulator.lines.entries()].filter(([, hits]) => hits <= 0).map(([lineNumber]) => lineNumber).sort((a, b) => a - b);
+    result.set(file, {
+      found: accumulator.lines.size + accumulator.found,
+      hit: accumulator.lines.size - uncovered.length + accumulator.hit,
+      uncovered
+    });
+  }
+  return result;
+}
+function judgeLcov(gatePaths, coverage) {
+  const violations = [];
+  const results = [];
+  for (const gatePath of gatePaths) {
+    const file = coverage.get(normalizePath(gatePath));
+    if (!file) {
+      violations.push({ file: gatePath, message: "no record in the lcov file" });
+      results.push({ path: gatePath, found: 0, hit: 0, ok: false });
+      continue;
+    }
+    if (file.found === 0) {
+      violations.push({ file: gatePath, message: "no instrumented lines in the lcov record" });
+      results.push({ path: gatePath, found: 0, hit: 0, ok: false });
+      continue;
+    }
+    const ok = file.hit === file.found;
+    if (!ok) {
+      const shown = file.uncovered.slice(0, 20).join(", ");
+      const more = file.uncovered.length > 20 ? ", \u2026" : "";
+      violations.push({
+        file: gatePath,
+        ...file.uncovered[0] === void 0 ? {} : { line: file.uncovered[0] },
+        message: `${file.hit}/${file.found} lines covered` + (shown === "" ? "" : ` (uncovered: ${shown}${more})`)
+      });
+    }
+    results.push({ path: gatePath, found: file.found, hit: file.hit, ok });
+  }
+  return { violations, results };
+}
+function summarizeLcov(coverage, exclude) {
+  let found = 0;
+  let hit = 0;
+  for (const [file, lines] of coverage) {
+    if (exclude.some((regex) => regex.test(file))) {
+      continue;
+    }
+    found += lines.found;
+    hit += lines.hit;
+  }
+  return { found, hit };
+}
+
+// src/commands/lcov.ts
+function runLcov(dir, fileOption, io2) {
+  const manifest = readManifest(dir);
+  const file = fileOption ?? manifest.settings.lcovFile;
+  if (file === null) {
+    throw new ManifestError(
+      "no lcov file given. Pass --file <lcov.info> or set settings.lcov.file"
+    );
+  }
+  const lcovPath = path4.resolve(manifest.dir, file);
+  let text;
+  try {
+    text = fs4.readFileSync(lcovPath, "utf8");
+  } catch (error) {
+    io2.err(
+      `test-gates lcov: cannot read ${file} (${error.message}). Run the tests with coverage first`
+    );
+    return 1;
+  }
+  const violations = [...manifest.violations];
+  const existing = manifest.gates.filter((gate) => {
+    const exists = existsExact(manifest.dir, gate.path);
+    if (!exists) {
+      violations.push({
+        file: gate.path,
+        message: "file not found (the check is case-sensitive). Update test-gates.json if it moved"
+      });
+    }
+    return exists;
+  });
+  const coverage = parseLcov(text, manifest.dir);
+  const total = summarizeLcov(coverage, manifest.settings.lcovSummaryExclude);
+  io2.out(
+    total.found === 0 ? "reference: no instrumented lines in the lcov file" : `reference: overall line coverage ${(total.hit / total.found * 100).toFixed(2)}% (${total.hit}/${total.found}, not gated)`
+  );
+  const verdict = judgeLcov(
+    existing.map((gate) => gate.path),
+    coverage
+  );
+  for (const result of verdict.results) {
+    if (result.ok) {
+      io2.out(`  \u2713 ${result.path}: ${result.hit}/${result.found} lines`);
+    }
+  }
+  violations.push(...verdict.violations);
+  if (violations.length > 0) {
+    printViolations(io2, "lcov", violations);
+    return 1;
+  }
+  io2.out(`test-gates lcov: OK (${verdict.results.length} gate(s) at 100% line coverage)`);
+  return 0;
+}
+
+// src/commands/mutation.ts
+import { spawnSync } from "child_process";
+import fs6 from "fs";
+
+// src/commands/mutation-result.ts
+import fs5 from "fs";
+import path5 from "path";
+
+// src/core/mutation-result.ts
+var DETECTED = /* @__PURE__ */ new Set(["Killed", "Timeout"]);
+var SURVIVED = /* @__PURE__ */ new Set(["Survived", "NoCoverage"]);
+var NOT_EVALUABLE = /* @__PURE__ */ new Set(["RuntimeError", "CompileError"]);
+function normalizeCode(text) {
+  return text.replace(/\s+/g, " ").trim();
+}
+function normalizePath2(file) {
+  return file.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function normalizeNewlines(text) {
+  return text.replace(/\r\n/g, "\n");
+}
+function sliceByLocation(source, location) {
+  const lines = source.split("\n");
+  const { start, end } = location;
+  const first = lines[start.line - 1];
+  const last = lines[end.line - 1];
+  if (first === void 0 || last === void 0 || start.column < 1 || end.column < 1 || end.line < start.line || end.line === start.line && end.column < start.column) {
+    return null;
+  }
+  if (start.line === end.line) {
+    return first.slice(start.column - 1, end.column - 1);
+  }
+  return [
+    first.slice(start.column - 1),
+    ...lines.slice(start.line, end.line - 1),
+    last.slice(0, end.column - 1)
+  ].join("\n");
+}
+function keyOf(mutator, original, replacement) {
+  return JSON.stringify([mutator, normalizeCode(original), normalizeCode(replacement)]);
+}
+function describeAllowance(entry) {
+  const occurrence = entry.occurrence === void 0 ? "" : ` / occurrence ${entry.occurrence}`;
+  return `${entry.mutator} / ${normalizeCode(entry.original)} \u2192 ${normalizeCode(entry.replacement)}${occurrence}`;
+}
+function judgeMutationReport(input) {
+  const violations = [];
+  const survivors = [];
+  const summary = {
+    total: 0,
+    detected: 0,
+    timeout: 0,
+    allowed: 0,
+    notEvaluable: 0,
+    unallowed: 0
+  };
+  const files = /* @__PURE__ */ new Map();
+  for (const [file, result] of Object.entries(input.report.files ?? {})) {
+    files.set(normalizePath2(file), result);
+  }
+  for (const gate of input.gates) {
+    const gatePath = normalizePath2(gate.path);
+    const shapeViolations = validateEquivalentMutants(gate.path, gate.equivalentMutants);
+    violations.push(...shapeViolations);
+    const allowances = Array.isArray(gate.equivalentMutants) ? gate.equivalentMutants : [];
+    const result = files.get(gatePath);
+    if (!result || !Array.isArray(result.mutants) || result.mutants.length === 0) {
+      violations.push({
+        file: gate.path,
+        message: "no mutants in the report (the gate was not mutation tested)"
+      });
+      continue;
+    }
+    const diskSource = input.readSource(gate.path);
+    const source = result.source ?? diskSource;
+    if (source === void 0) {
+      violations.push({
+        file: gate.path,
+        message: "source is neither in the report nor readable on disk"
+      });
+      continue;
+    }
+    if (result.source !== void 0 && diskSource !== void 0 && normalizeNewlines(result.source) !== normalizeNewlines(diskSource)) {
+      violations.push({
+        file: gate.path,
+        message: "the report was made from a different version of this file. Run Stryker again"
+      });
+      continue;
+    }
+    const located = [];
+    const byKey = /* @__PURE__ */ new Map();
+    const sorted = [...result.mutants].sort(
+      (a, b) => a.location.start.line - b.location.start.line || a.location.start.column - b.location.start.column
+    );
+    let locationsValid = true;
+    for (const mutant of sorted) {
+      const original = sliceByLocation(normalizeNewlines(source), mutant.location);
+      if (original === null) {
+        violations.push({
+          file: gate.path,
+          line: mutant.location.start.line,
+          message: `the report location of a ${mutant.mutatorName} mutant is outside the source`
+        });
+        locationsValid = false;
+        continue;
+      }
+      const replacement = mutant.replacement ?? "";
+      const key = keyOf(mutant.mutatorName, original, replacement);
+      const group = byKey.get(key) ?? [];
+      const entry = {
+        mutant,
+        original,
+        replacement,
+        occurrence: group.length + 1,
+        sameKeyCount: 0
+      };
+      group.push(entry);
+      byKey.set(key, group);
+      located.push(entry);
+    }
+    for (const group of byKey.values()) {
+      for (const entry of group) {
+        entry.sameKeyCount = group.length;
+      }
+    }
+    if (!locationsValid) {
+      continue;
+    }
+    const allowed = /* @__PURE__ */ new Set();
+    allowances.forEach((allowance, index) => {
+      if (!isUsableEquivalentMutant(allowance)) {
+        return;
+      }
+      const at = `${gate.path}: equivalentMutants[${index}] (${describeAllowance(allowance)})`;
+      const group = byKey.get(keyOf(allowance.mutator, allowance.original, allowance.replacement)) ?? [];
+      if (allowance.occurrence === void 0 && group.length > 1) {
+        violations.push({
+          file: MANIFEST_FILE,
+          message: `${at}: matches ${group.length} mutants in the file. Add "occurrence" (1-based) to pick one`
+        });
+        return;
+      }
+      const target = group[(allowance.occurrence ?? 1) - 1];
+      if (!target || !SURVIVED.has(target.mutant.status)) {
+        const why = target ? `the mutant is now ${target.mutant.status}` : "no such mutant in this run";
+        violations.push({
+          file: MANIFEST_FILE,
+          message: `${at}: stale allowance (${why}). Remove it`
+        });
+        return;
+      }
+      if (allowed.has(target)) {
+        violations.push({
+          file: MANIFEST_FILE,
+          message: `${at}: another allowance already covers this mutant`
+        });
+        return;
+      }
+      allowed.add(target);
+    });
+    for (const entry of located) {
+      const { mutant } = entry;
+      summary.total += 1;
+      if (DETECTED.has(mutant.status)) {
+        summary.detected += 1;
+        if (mutant.status === "Timeout") {
+          summary.timeout += 1;
+        }
+      } else if (NOT_EVALUABLE.has(mutant.status)) {
+        summary.notEvaluable += 1;
+      } else if (SURVIVED.has(mutant.status)) {
+        if (allowed.has(entry)) {
+          summary.allowed += 1;
+          continue;
+        }
+        summary.unallowed += 1;
+        survivors.push({
+          file: gate.path,
+          line: mutant.location.start.line,
+          column: mutant.location.start.column,
+          status: mutant.status,
+          mutator: mutant.mutatorName,
+          original: normalizeCode(entry.original),
+          replacement: normalizeCode(entry.replacement),
+          occurrence: entry.occurrence,
+          sameKeyCount: entry.sameKeyCount,
+          allowance: {
+            mutator: mutant.mutatorName,
+            original: normalizeCode(entry.original),
+            replacement: normalizeCode(entry.replacement),
+            ...entry.sameKeyCount > 1 ? { occurrence: entry.occurrence } : {},
+            reason: ""
+          }
+        });
+      } else {
+        violations.push({
+          file: gate.path,
+          line: mutant.location.start.line,
+          message: mutant.status === "Ignored" ? `a ${mutant.mutatorName} mutant was ignored. Taking mutants out with Stryker comments or mutator exclusions is not allowed` : `a ${mutant.mutatorName} mutant was not evaluated (status: ${mutant.status})`
+        });
+      }
+    }
+  }
+  if (summary.total === 0) {
+    violations.push({
+      file: MANIFEST_FILE,
+      message: "no mutants were evaluated (the mutation test ran on nothing)"
+    });
+  }
+  return { violations, survivors, summary };
+}
+function formatSurvivor(survivor) {
+  const occurrence = survivor.sameKeyCount > 1 ? ` / occurrence ${survivor.occurrence} of ${survivor.sameKeyCount}` : "";
+  return `${survivor.file}:${survivor.line}:${survivor.column} / ${survivor.mutator} / ${survivor.original} \u2192 ${survivor.replacement}${occurrence} (${survivor.status})`;
+}
+function formatSummary(summary) {
+  return `mutants ${summary.total} / detected ${summary.detected} (timeout ${summary.timeout}) / allowed equivalent ${summary.allowed} / not evaluable ${summary.notEvaluable} / unallowed survivors ${summary.unallowed}`;
+}
+
+// src/commands/mutation-result.ts
+function reportPathOf(manifest, override) {
+  return path5.resolve(manifest.dir, override ?? manifest.settings.strykerReportFile);
+}
+function runMutationResult(dir, reportOverride, io2) {
+  const manifest = readManifest(dir);
+  const reportPath = reportPathOf(manifest, reportOverride);
+  const shown = path5.relative(manifest.dir, reportPath) || reportPath;
+  let report;
+  try {
+    report = JSON.parse(fs5.readFileSync(reportPath, "utf8"));
+  } catch (error) {
+    io2.err(
+      `test-gates mutation: cannot read the Stryker JSON report ${shown} (${error.message}). Did Stryker finish, with the "json" reporter writing to this path?`
+    );
+    return 1;
+  }
+  if (typeof report !== "object" || report === null) {
+    io2.err(`test-gates mutation: ${shown} is not a Stryker JSON report`);
+    return 1;
+  }
+  const verdict = judgeMutationReport({
+    gates: manifest.gates,
+    report,
+    readSource: (gatePath) => {
+      try {
+        return fs5.readFileSync(path5.join(manifest.dir, gatePath), "utf8");
+      } catch {
+        return void 0;
+      }
+    }
+  });
+  const summary = formatSummary(verdict.summary);
+  if (verdict.violations.length === 0 && verdict.survivors.length === 0) {
+    io2.out(`test-gates mutation: OK (${summary})`);
+    return 0;
+  }
+  if (verdict.survivors.length > 0) {
+    io2.err(
+      `test-gates mutation: ${verdict.survivors.length} surviving mutant(s) not in the allow list`
+    );
+    for (const survivor of verdict.survivors) {
+      io2.err(`  - ${formatSurvivor(survivor)}`);
+    }
+    io2.err("");
+    io2.err(
+      "Fix the test so that it detects the mutant. Only when the mutant cannot be observed from"
+    );
+    io2.err("outside (same return value, exception and side effects for every input), add it to");
+    io2.err('"equivalentMutants" of the gate in test-gates.json and fill in "reason":');
+    const byFile = /* @__PURE__ */ new Map();
+    for (const survivor of verdict.survivors) {
+      byFile.set(survivor.file, [...byFile.get(survivor.file) ?? [], survivor]);
+    }
+    for (const [file, survivors] of byFile) {
+      io2.err("");
+      io2.err(`  ${file}`);
+      survivors.forEach((survivor, index) => {
+        const comma = index === survivors.length - 1 ? "" : ",";
+        io2.err(`    ${JSON.stringify(survivor.allowance)}${comma}`);
+      });
+    }
+    io2.err("");
+  }
+  if (verdict.violations.length > 0) {
+    printViolations(io2, "mutation", verdict.violations);
+  }
+  io2.err(`test-gates mutation: FAILED (${summary})`);
+  return 1;
+}
+
+// src/commands/mutation.ts
+function runMutation(dir, strykerArgs, io2) {
+  const manifest = readManifest(dir);
+  const config = findStrykerConfig(manifest);
+  if (config === null) {
+    throw new ManifestError(
+      "no Stryker config found (stryker.gates.config.mjs). Create one, or set settings.stryker.configFile"
+    );
+  }
+  const stryker = findLocalBin(manifest.dir, "stryker");
+  if (stryker === null) {
+    throw new ManifestError(
+      "stryker is not installed in this project (node_modules/.bin/stryker). Add @stryker-mutator/core as a devDependency"
+    );
+  }
+  fs6.rmSync(reportPathOf(manifest, null), { force: true });
+  const result = spawnSync(stryker, ["run", config, ...strykerArgs], {
+    cwd: manifest.dir,
+    stdio: "inherit",
+    shell: process.platform === "win32"
+  });
+  if (result.error) {
+    io2.err(`test-gates mutation: cannot start Stryker (${result.error.message})`);
+    return 1;
+  }
+  if (result.status !== 0) {
+    io2.err(
+      `test-gates mutation: Stryker failed (${result.signal ? `signal ${result.signal}` : `exit ${result.status}`}). The result was not judged`
+    );
+    return 1;
+  }
+  return runMutationResult(dir, null, io2);
+}
+
+// src/commands/selfcheck.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import fs7 from "fs";
+import path6 from "path";
+var JEST_CONFIGS = ["js", "cjs", "mjs", "ts", "cts", "mts"].map(
+  (extension) => `jest.gates.config.${extension}`
+);
+var VITEST_CONFIGS = ["ts", "mts", "cts", "js", "mjs", "cjs"].map(
+  (extension) => `vitest.gates.config.${extension}`
+);
+function resolveGateCommand(manifest) {
+  if (manifest.settings.gateCommand !== null) {
+    return manifest.settings.gateCommand;
+  }
+  const exists = (name) => fs7.existsSync(path6.join(manifest.dir, name));
+  const jest = JEST_CONFIGS.find(exists);
+  const vitest = VITEST_CONFIGS.find(exists);
+  if (jest && vitest) {
+    throw new ManifestError(
+      `both ${jest} and ${vitest} exist. Set settings.gateCommand to say which one runs the gate`
+    );
+  }
+  if (jest) {
+    return ["jest", "--config", jest];
+  }
+  if (vitest) {
+    return ["vitest", "run", "--config", vitest];
+  }
+  throw new ManifestError(
+    "no gate config found (jest.gates.config.* / vitest.gates.config.*). Set settings.gateCommand"
+  );
+}
+function runSelfcheck(dir, mode, commandOverride, io2) {
+  const manifest = readManifest(dir);
+  if (manifest.violations.length > 0 || manifest.gates.length === 0) {
+    io2.err('test-gates selfcheck: test-gates.json has problems. Run "test-gates check" first');
+    return 1;
+  }
+  const command = commandOverride.length > 0 ? commandOverride : resolveGateCommand(manifest);
+  const [program, ...args] = command;
+  const executable = findLocalBin(manifest.dir, program) ?? program;
+  const targets = (mode ?? manifest.settings.selfcheckMode) === "first" ? manifest.gates.slice(0, 1) : manifest.gates;
+  let failed = 0;
+  for (const gate of targets) {
+    if (gate.spec === null || gate.existingSpecs.length !== 1) {
+      io2.err(`  \u2717 ${gate.path}: no single spec to leave out. Run "test-gates check"`);
+      failed += 1;
+      continue;
+    }
+    const result = spawnSync2(executable, args, {
+      cwd: manifest.dir,
+      env: { ...process.env, [EXCLUDE_ENV]: gate.spec },
+      encoding: "utf8",
+      maxBuffer: 256 * 1024 * 1024,
+      shell: process.platform === "win32"
+    });
+    const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
+    const reason = result.error ? `cannot start "${command.join(" ")}" (${result.error.message})` : judgeSelfcheck({
+      status: result.status,
+      output,
+      gatePath: gate.path,
+      failurePattern: manifest.settings.selfcheckFailurePattern
+    });
+    if (reason === null) {
+      io2.out(`  \u2713 without ${gate.spec} the gate fails (exit ${result.status})`);
+    } else {
+      failed += 1;
+      io2.err(`  \u2717 ${gate.path}: ${reason}`);
+      const tail = output.trimEnd().split("\n").slice(-25).join("\n");
+      if (tail !== "") {
+        io2.err(tail.replace(/^/gm, "      "));
+      }
+    }
+  }
+  if (failed > 0) {
+    io2.err(`test-gates selfcheck: FAILED (${failed} of ${targets.length} negative control(s))`);
+    return 1;
+  }
+  io2.out(`test-gates selfcheck: OK (${targets.length} negative control(s) failed as they should)`);
+  return 0;
+}
+
+// src/cli.ts
+var HELP = `test-gates \u2014 test gates for the code that must not be wrong
+
+Usage: test-gates <command> [options]
+
+Commands:
+  check                       Static checks of test-gates.json, the gates and their specs
+  mutation [-- <args>]        Run the project's Stryker, then judge the result.
+                              Unknown arguments and everything after "--" go to Stryker
+  mutation-result             Judge an existing Stryker JSON report
+  selfcheck [-- <command>]    Negative control: leave one spec out, the gate must fail
+  lcov --file <lcov.info>     Per-file 100% line coverage from an lcov tracefile
+
+Options:
+  --dir <subproject>          Directory that holds test-gates.json (default: .)
+  --report <path>             mutation-result: report to judge (default: settings.stryker.reportFile)
+  --all | --first             selfcheck: every gate in turn (default) or only the first
+  --file <path>               lcov: tracefile (default: settings.lcov.file)
+  -h, --help                  Show this help
+  -v, --version               Show the version
+
+Exit codes: 0 passed, 1 violations found, 2 wrong usage or unusable test-gates.json
+`;
+var io = {
+  out: (line) => process.stdout.write(`${line}
+`),
+  err: (line) => process.stderr.write(`${line}
+`)
+};
+function main(argv) {
+  const args = parseArgs(argv);
+  if (args.version) {
+    const { version } = createRequire(import.meta.url)("../package.json");
+    io.out(version);
+    return 0;
+  }
+  if (args.help) {
+    io.out(HELP);
+    return 0;
+  }
+  switch (args.command) {
+    case "check":
+      return runCheck(args.dir, io);
+    case "mutation":
+      return runMutation(args.dir, args.rest, io);
+    case "mutation-result":
+      return runMutationResult(args.dir, args.report, io);
+    case "selfcheck":
+      return runSelfcheck(args.dir, args.mode, args.rest, io);
+    case "lcov":
+      return runLcov(args.dir, args.file, io);
+    case null:
+      throw new UsageError("no command given");
+  }
+}
+try {
+  process.exitCode = main(process.argv.slice(2));
+} catch (error) {
+  if (error instanceof UsageError) {
+    io.err(`test-gates: ${error.message}
+`);
+    io.err(HELP);
+    process.exitCode = 2;
+  } else if (error instanceof ManifestError) {
+    io.err(`test-gates: ${error.message}`);
+    process.exitCode = 2;
+  } else {
+    throw error;
+  }
+}