@warlock.js/core 5.29.0 → 5.31.0

package/esm/tooling/check/conventions-step.mjs

@@ -0,0 +1,184 @@
+import { createProblem } from "../problem.mjs";
+import { positionOf } from "./source-ast.mjs";
+import { codeStyleFindings } from "./code-style-conventions.mjs";
+import { securityFindings } from "./security-conventions.mjs";
+import path from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import ts from "typescript";
+
+//#region ../../packages/core/src/tooling/check/conventions-step.ts
+/** Extensions tried when resolving an extension-less import. */
+const RESOLVE_EXTENSIONS = [
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	"/index.ts",
+	"/index.tsx"
+];
+/** Test files may import anything on purpose. */
+const TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]sx?$/i;
+/** Matches a project-relative path of a file the framework loads by itself. */
+function isAutoLoadedFile(relativePath) {
+	return /^src\/app\/main\.tsx?$/.test(relativePath) || /^src\/app\/[^/]+\/(?:routes|main|worker)\.tsx?$/.test(relativePath) || /^src\/app\/.+\/events\/[^/]+\.tsx?$/.test(relativePath);
+}
+/** The module folder (`src/app/<module>`) a project-relative path lives in, if any. */
+function moduleOf(relativePath) {
+	return /^src\/app\/([^/]+)\//.exec(relativePath)?.[1];
+}
+function toPosix(file) {
+	return file.split(path.sep).join("/");
+}
+/** Resolve a relative or `app/...` specifier to a project-relative file, if it exists. */
+function resolveSpecifier(specifier, importer, cwd) {
+	let base;
+	if (specifier.startsWith(".")) base = path.resolve(path.dirname(path.join(cwd, importer)), specifier);
+	else if (specifier.startsWith("app/")) base = path.join(cwd, "src", specifier);
+	else return;
+	const candidates = [base, ...RESOLVE_EXTENSIONS.map((extension) => `${base}${extension}`)];
+	const withoutJs = base.replace(/\.jsx?$/, "");
+	if (withoutJs !== base) candidates.push(...RESOLVE_EXTENSIONS.map((extension) => `${withoutJs}${extension}`));
+	const found = candidates.find((candidate) => existsSync(candidate) && path.extname(candidate) !== "");
+	return found ? toPosix(path.relative(cwd, found)) : void 0;
+}
+/** Every module specifier a source file imports, with its position. */
+function importsOf(sourceFile) {
+	const found = [];
+	const visit = (node) => {
+		if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) found.push({
+			specifier: node.moduleSpecifier.text,
+			node: node.moduleSpecifier
+		});
+		else if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword && node.arguments[0] && ts.isStringLiteral(node.arguments[0])) found.push({
+			specifier: node.arguments[0].text,
+			node: node.arguments[0]
+		});
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return found;
+}
+/** `// warlock-check-ignore [WLxxxx …]` on a problem's line or the line above it. */
+const IGNORE_COMMENT = /\/[/*]\s*warlock-check-ignore\b(.*)/;
+/** Whether an ignore comment on `line` (1-based) or the line before covers `code`. */
+function isIgnored(lines, line, code) {
+	for (const text of [lines[line - 1], lines[line - 2]]) {
+		const match = text === void 0 ? null : IGNORE_COMMENT.exec(text);
+		if (!match) continue;
+		const codes = match[1]?.match(/WL\d{4}/g);
+		if (!codes || codes.includes(code)) return true;
+	}
+	return false;
+}
+/** The import conventions (`WL9001`–`WL9003`) of one parsed file. */
+function importProblems(sourceFile, relativePath, cwd) {
+	const problems = [];
+	const importerModule = moduleOf(relativePath);
+	for (const { specifier, node } of importsOf(sourceFile)) {
+		const at = {
+			file: relativePath,
+			...positionOf(sourceFile, node)
+		};
+		if (specifier.startsWith(".") && /\.jsx?$/.test(specifier)) problems.push(createProblem({
+			code: "WL9002",
+			source: "convention",
+			message: `Import "${specifier}" ends in a .js extension.`,
+			...at
+		}));
+		const target = resolveSpecifier(specifier, relativePath, cwd);
+		if (!target) continue;
+		if (!TEST_FILE.test(relativePath) && isAutoLoadedFile(target)) problems.push(createProblem({
+			code: "WL9001",
+			source: "convention",
+			message: `"${specifier}" imports ${target}, which the framework loads by itself.`,
+			...at
+		}));
+		const targetModule = moduleOf(target);
+		if (specifier.startsWith(".") && importerModule !== void 0 && targetModule !== void 0 && importerModule !== targetModule) {
+			const alias = `app/${target.replace(/^src\/app\//, "").replace(/\.[cm]?[jt]sx?$/, "")}`;
+			problems.push(createProblem({
+				code: "WL9003",
+				source: "convention",
+				message: `"${specifier}" reaches from module "${importerModule}" into "${targetModule}"; import "${alias}" instead.`,
+				...at
+			}));
+		}
+	}
+	return problems;
+}
+function findingProblem(sourceFile, relativePath, finding) {
+	return createProblem({
+		code: finding.code,
+		source: "convention",
+		severity: finding.severity ?? "error",
+		message: finding.message,
+		file: relativePath,
+		...positionOf(sourceFile, finding.node)
+	});
+}
+/**
+* The convention problems in one source file, in source order:
+*
+* - `WL9001` an import of a file the framework loads by itself (`routes.ts`,
+*   `main.ts`, `worker.ts`, `events/*`) — importing it registers it twice;
+* - `WL9002` a relative import ending in `.js`;
+* - `WL9003` a relative import from one `src/app/<module>` into another, which
+*   should use the `app/<module>/...` alias;
+* - `WL9005`–`WL9009` the security conventions (see `securityFindings`):
+*   `request.all()` into a query or service, a mutating route with no guard
+*   and no `public: true`, a redirect target from request input, sensitive
+*   values in logs, unbounded regexes on request input;
+* - `WL9010`–`WL9012` warnings: `await log.*()`, a second controller in one
+*   file, a `kind` discriminator.
+*
+* A `// warlock-check-ignore WL9006` comment on the problem's line or the line
+* above silences that code there; without codes it silences every one.
+*/
+function checkFileConventions(relativePath, source, cwd) {
+	const sourceFile = ts.createSourceFile(relativePath, source, ts.ScriptTarget.Latest, true);
+	const problems = [...importProblems(sourceFile, relativePath, cwd), ...[...securityFindings(sourceFile), ...codeStyleFindings(sourceFile)].map((finding) => findingProblem(sourceFile, relativePath, finding))];
+	const lines = source.split(/\r?\n/);
+	return problems.filter((problem) => problem.line === null || !isIgnored(lines, problem.line, problem.code)).sort((first, second) => (first.line ?? 0) - (second.line ?? 0) || (first.column ?? 0) - (second.column ?? 0));
+}
+/** `WL9004` when the project tsconfig turns on legacy decorators. */
+function checkTsconfigConventions(cwd, project = "tsconfig.json") {
+	const file = path.join(cwd, project);
+	if (!existsSync(file)) return [];
+	const text = readFileSync(file, "utf8");
+	const read = ts.parseConfigFileTextToJson(file, text);
+	const options = typeof read.config === "object" && read.config !== null ? Reflect.get(read.config, "compilerOptions") : void 0;
+	if (typeof options !== "object" || options === null || Reflect.get(options, "experimentalDecorators") !== true) return [];
+	const index = text.indexOf("experimentalDecorators");
+	const before = index === -1 ? "" : text.slice(0, index);
+	const line = index === -1 ? null : before.split("\n").length;
+	const column = index === -1 ? null : index - before.lastIndexOf("\n");
+	return [createProblem({
+		code: "WL9004",
+		source: "convention",
+		message: "\"experimentalDecorators\": true switches TypeScript to legacy decorators.",
+		file: toPosix(project),
+		line,
+		column
+	})];
+}
+/**
+* Run every convention check over `files` (project-relative) plus the
+* project tsconfig.
+*/
+function runConventions(cwd, files, project) {
+	const problems = checkTsconfigConventions(cwd, project);
+	for (const file of files) {
+		let source;
+		try {
+			source = readFileSync(path.join(cwd, file), "utf8");
+		} catch {
+			continue;
+		}
+		problems.push(...checkFileConventions(file, source, cwd));
+	}
+	return problems;
+}
+
+//#endregion
+export { checkFileConventions, checkTsconfigConventions, isAutoLoadedFile, runConventions };
+//# sourceMappingURL=conventions-step.mjs.map

package/esm/tooling/check/conventions-step.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"conventions-step.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/conventions-step.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport ts from \"typescript\";\nimport { createProblem, type ToolingProblem } from \"../problem\";\nimport { codeStyleFindings } from \"./code-style-conventions\";\nimport { securityFindings } from \"./security-conventions\";\nimport { positionOf, type SourceFinding } from \"./source-ast\";\n\n/** Extensions tried when resolving an extension-less import. */\nconst RESOLVE_EXTENSIONS = [\".ts\", \".tsx\", \".js\", \".jsx\", \"/index.ts\", \"/index.tsx\"];\n\n/** Test files may import anything on purpose. */\nconst TEST_FILE = /\\.(?:test|spec)\\.[cm]?[jt]sx?$/i;\n\n/** Matches a project-relative path of a file the framework loads by itself. */\nexport function isAutoLoadedFile(relativePath: string): boolean {\n  return (\n    /^src\\/app\\/main\\.tsx?$/.test(relativePath) ||\n    /^src\\/app\\/[^/]+\\/(?:routes|main|worker)\\.tsx?$/.test(relativePath) ||\n    /^src\\/app\\/.+\\/events\\/[^/]+\\.tsx?$/.test(relativePath)\n  );\n}\n\n/** The module folder (`src/app/<module>`) a project-relative path lives in, if any. */\nfunction moduleOf(relativePath: string): string | undefined {\n  return /^src\\/app\\/([^/]+)\\//.exec(relativePath)?.[1];\n}\n\nfunction toPosix(file: string): string {\n  return file.split(path.sep).join(\"/\");\n}\n\n/** Resolve a relative or `app/...` specifier to a project-relative file, if it exists. */\nfunction resolveSpecifier(specifier: string, importer: string, cwd: string): string | undefined {\n  let base: string;\n\n  if (specifier.startsWith(\".\")) {\n    base = path.resolve(path.dirname(path.join(cwd, importer)), specifier);\n  } else if (specifier.startsWith(\"app/\")) {\n    base = path.join(cwd, \"src\", specifier);\n  } else {\n    return undefined;\n  }\n\n  const candidates = [base, ...RESOLVE_EXTENSIONS.map((extension) => `${base}${extension}`)];\n  const withoutJs = base.replace(/\\.jsx?$/, \"\");\n\n  if (withoutJs !== base) {\n    candidates.push(...RESOLVE_EXTENSIONS.map((extension) => `${withoutJs}${extension}`));\n  }\n\n  const found = candidates.find(\n    (candidate) => existsSync(candidate) && path.extname(candidate) !== \"\",\n  );\n\n  return found ? toPosix(path.relative(cwd, found)) : undefined;\n}\n\n/** Every module specifier a source file imports, with its position. */\nfunction importsOf(sourceFile: ts.SourceFile): { specifier: string; node: ts.Node }[] {\n  const found: { specifier: string; node: ts.Node }[] = [];\n\n  const visit = (node: ts.Node) => {\n    if (\n      (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) &&\n      node.moduleSpecifier &&\n      ts.isStringLiteral(node.moduleSpecifier)\n    ) {\n      found.push({ specifier: node.moduleSpecifier.text, node: node.moduleSpecifier });\n    } else if (\n      ts.isCallExpression(node) &&\n      node.expression.kind === ts.SyntaxKind.ImportKeyword &&\n      node.arguments[0] &&\n      ts.isStringLiteral(node.arguments[0])\n    ) {\n      found.push({ specifier: node.arguments[0].text, node: node.arguments[0] });\n    }\n\n    ts.forEachChild(node, visit);\n  };\n\n  visit(sourceFile);\n\n  return found;\n}\n\n/** `// warlock-check-ignore [WLxxxx …]` on a problem's line or the line above it. */\nconst IGNORE_COMMENT = /\\/[/*]\\s*warlock-check-ignore\\b(.*)/;\n\n/** Whether an ignore comment on `line` (1-based) or the line before covers `code`. */\nfunction isIgnored(lines: readonly string[], line: number, code: string): boolean {\n  for (const text of [lines[line - 1], lines[line - 2]]) {\n    const match = text === undefined ? null : IGNORE_COMMENT.exec(text);\n\n    if (!match) continue;\n\n    const codes = match[1]?.match(/WL\\d{4}/g);\n\n    if (!codes || codes.includes(code)) return true;\n  }\n\n  return false;\n}\n\n/** The import conventions (`WL9001`–`WL9003`) of one parsed file. */\nfunction importProblems(\n  sourceFile: ts.SourceFile,\n  relativePath: string,\n  cwd: string,\n): ToolingProblem[] {\n  const problems: ToolingProblem[] = [];\n  const importerModule = moduleOf(relativePath);\n\n  for (const { specifier, node } of importsOf(sourceFile)) {\n    const at = { file: relativePath, ...positionOf(sourceFile, node) };\n\n    if (specifier.startsWith(\".\") && /\\.jsx?$/.test(specifier)) {\n      problems.push(\n        createProblem({\n          code: \"WL9002\",\n          source: \"convention\",\n          message: `Import \"${specifier}\" ends in a .js extension.`,\n          ...at,\n        }),\n      );\n    }\n\n    const target = resolveSpecifier(specifier, relativePath, cwd);\n\n    if (!target) continue;\n\n    if (!TEST_FILE.test(relativePath) && isAutoLoadedFile(target)) {\n      problems.push(\n        createProblem({\n          code: \"WL9001\",\n          source: \"convention\",\n          message: `\"${specifier}\" imports ${target}, which the framework loads by itself.`,\n          ...at,\n        }),\n      );\n    }\n\n    const targetModule = moduleOf(target);\n\n    if (\n      specifier.startsWith(\".\") &&\n      importerModule !== undefined &&\n      targetModule !== undefined &&\n      importerModule !== targetModule\n    ) {\n      const alias = `app/${target.replace(/^src\\/app\\//, \"\").replace(/\\.[cm]?[jt]sx?$/, \"\")}`;\n\n      problems.push(\n        createProblem({\n          code: \"WL9003\",\n          source: \"convention\",\n          message: `\"${specifier}\" reaches from module \"${importerModule}\" into \"${targetModule}\"; import \"${alias}\" instead.`,\n          ...at,\n        }),\n      );\n    }\n  }\n\n  return problems;\n}\n\nfunction findingProblem(\n  sourceFile: ts.SourceFile,\n  relativePath: string,\n  finding: SourceFinding,\n): ToolingProblem {\n  return createProblem({\n    code: finding.code,\n    source: \"convention\",\n    severity: finding.severity ?? \"error\",\n    message: finding.message,\n    file: relativePath,\n    ...positionOf(sourceFile, finding.node),\n  });\n}\n\n/**\n * The convention problems in one source file, in source order:\n *\n * - `WL9001` an import of a file the framework loads by itself (`routes.ts`,\n *   `main.ts`, `worker.ts`, `events/*`) — importing it registers it twice;\n * - `WL9002` a relative import ending in `.js`;\n * - `WL9003` a relative import from one `src/app/<module>` into another, which\n *   should use the `app/<module>/...` alias;\n * - `WL9005`–`WL9009` the security conventions (see `securityFindings`):\n *   `request.all()` into a query or service, a mutating route with no guard\n *   and no `public: true`, a redirect target from request input, sensitive\n *   values in logs, unbounded regexes on request input;\n * - `WL9010`–`WL9012` warnings: `await log.*()`, a second controller in one\n *   file, a `kind` discriminator.\n *\n * A `// warlock-check-ignore WL9006` comment on the problem's line or the line\n * above silences that code there; without codes it silences every one.\n */\nexport function checkFileConventions(\n  relativePath: string,\n  source: string,\n  cwd: string,\n): ToolingProblem[] {\n  const sourceFile = ts.createSourceFile(relativePath, source, ts.ScriptTarget.Latest, true);\n  const problems = [\n    ...importProblems(sourceFile, relativePath, cwd),\n    ...[...securityFindings(sourceFile), ...codeStyleFindings(sourceFile)].map((finding) =>\n      findingProblem(sourceFile, relativePath, finding),\n    ),\n  ];\n  const lines = source.split(/\\r?\\n/);\n\n  return problems\n    .filter((problem) => problem.line === null || !isIgnored(lines, problem.line, problem.code))\n    .sort(\n      (first, second) =>\n        (first.line ?? 0) - (second.line ?? 0) || (first.column ?? 0) - (second.column ?? 0),\n    );\n}\n\n/** `WL9004` when the project tsconfig turns on legacy decorators. */\nexport function checkTsconfigConventions(cwd: string, project = \"tsconfig.json\"): ToolingProblem[] {\n  const file = path.join(cwd, project);\n\n  if (!existsSync(file)) return [];\n\n  const text = readFileSync(file, \"utf8\");\n  const read = ts.parseConfigFileTextToJson(file, text);\n  const options: unknown =\n    typeof read.config === \"object\" && read.config !== null\n      ? Reflect.get(read.config, \"compilerOptions\")\n      : undefined;\n\n  if (\n    typeof options !== \"object\" ||\n    options === null ||\n    Reflect.get(options, \"experimentalDecorators\") !== true\n  ) {\n    return [];\n  }\n\n  const index = text.indexOf(\"experimentalDecorators\");\n  const before = index === -1 ? \"\" : text.slice(0, index);\n  const line = index === -1 ? null : before.split(\"\\n\").length;\n  const column = index === -1 ? null : index - before.lastIndexOf(\"\\n\");\n\n  return [\n    createProblem({\n      code: \"WL9004\",\n      source: \"convention\",\n      message: '\"experimentalDecorators\": true switches TypeScript to legacy decorators.',\n      file: toPosix(project),\n      line,\n      column,\n    }),\n  ];\n}\n\n/**\n * Run every convention check over `files` (project-relative) plus the\n * project tsconfig.\n */\nexport function runConventions(\n  cwd: string,\n  files: readonly string[],\n  project?: string,\n): ToolingProblem[] {\n  const problems = checkTsconfigConventions(cwd, project);\n\n  for (const file of files) {\n    let source: string;\n\n    try {\n      source = readFileSync(path.join(cwd, file), \"utf8\");\n    } catch {\n      continue;\n    }\n\n    problems.push(...checkFileConventions(file, source, cwd));\n  }\n\n  return problems;\n}\n"],"mappings":";;;;;;;;;;AASA,MAAM,qBAAqB;CAAC;CAAO;CAAQ;CAAO;CAAQ;CAAa;AAAY;;AAGnF,MAAM,YAAY;;AAGlB,SAAgB,iBAAiB,cAA+B;CAC9D,OACE,yBAAyB,KAAK,YAAY,KAC1C,kDAAkD,KAAK,YAAY,KACnE,sCAAsC,KAAK,YAAY;AAE3D;;AAGA,SAAS,SAAS,cAA0C;CAC1D,OAAO,uBAAuB,KAAK,YAAY,CAAC,GAAG;AACrD;AAEA,SAAS,QAAQ,MAAsB;CACrC,OAAO,KAAK,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;AACtC;;AAGA,SAAS,iBAAiB,WAAmB,UAAkB,KAAiC;CAC9F,IAAI;CAEJ,IAAI,UAAU,WAAW,GAAG,GAC1B,OAAO,KAAK,QAAQ,KAAK,QAAQ,KAAK,KAAK,KAAK,QAAQ,CAAC,GAAG,SAAS;MAChE,IAAI,UAAU,WAAW,MAAM,GACpC,OAAO,KAAK,KAAK,KAAK,OAAO,SAAS;MAEtC;CAGF,MAAM,aAAa,CAAC,MAAM,GAAG,mBAAmB,KAAK,cAAc,GAAG,OAAO,WAAW,CAAC;CACzF,MAAM,YAAY,KAAK,QAAQ,WAAW,EAAE;CAE5C,IAAI,cAAc,MAChB,WAAW,KAAK,GAAG,mBAAmB,KAAK,cAAc,GAAG,YAAY,WAAW,CAAC;CAGtF,MAAM,QAAQ,WAAW,MACtB,cAAc,WAAW,SAAS,KAAK,KAAK,QAAQ,SAAS,MAAM,EACtE;CAEA,OAAO,QAAQ,QAAQ,KAAK,SAAS,KAAK,KAAK,CAAC,IAAI;AACtD;;AAGA,SAAS,UAAU,YAAmE;CACpF,MAAM,QAAgD,CAAC;CAEvD,MAAM,SAAS,SAAkB;EAC/B,KACG,GAAG,oBAAoB,IAAI,KAAK,GAAG,oBAAoB,IAAI,MAC5D,KAAK,mBACL,GAAG,gBAAgB,KAAK,eAAe,GAEvC,MAAM,KAAK;GAAE,WAAW,KAAK,gBAAgB;GAAM,MAAM,KAAK;EAAgB,CAAC;OAC1E,IACL,GAAG,iBAAiB,IAAI,KACxB,KAAK,WAAW,SAAS,GAAG,WAAW,iBACvC,KAAK,UAAU,MACf,GAAG,gBAAgB,KAAK,UAAU,EAAE,GAEpC,MAAM,KAAK;GAAE,WAAW,KAAK,UAAU,EAAE,CAAC;GAAM,MAAM,KAAK,UAAU;EAAG,CAAC;EAG3E,GAAG,aAAa,MAAM,KAAK;CAC7B;CAEA,MAAM,UAAU;CAEhB,OAAO;AACT;;AAGA,MAAM,iBAAiB;;AAGvB,SAAS,UAAU,OAA0B,MAAc,MAAuB;CAChF,KAAK,MAAM,QAAQ,CAAC,MAAM,OAAO,IAAI,MAAM,OAAO,EAAE,GAAG;EACrD,MAAM,QAAQ,SAAS,SAAY,OAAO,eAAe,KAAK,IAAI;EAElE,IAAI,CAAC,OAAO;EAEZ,MAAM,QAAQ,MAAM,EAAE,EAAE,MAAM,UAAU;EAExC,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC7C;CAEA,OAAO;AACT;;AAGA,SAAS,eACP,YACA,cACA,KACkB;CAClB,MAAM,WAA6B,CAAC;CACpC,MAAM,iBAAiB,SAAS,YAAY;CAE5C,KAAK,MAAM,EAAE,WAAW,UAAU,UAAU,UAAU,GAAG;EACvD,MAAM,KAAK;GAAE,MAAM;GAAc,GAAG,WAAW,YAAY,IAAI;EAAE;EAEjE,IAAI,UAAU,WAAW,GAAG,KAAK,UAAU,KAAK,SAAS,GACvD,SAAS,KACP,cAAc;GACZ,MAAM;GACN,QAAQ;GACR,SAAS,WAAW,UAAU;GAC9B,GAAG;EACL,CAAC,CACH;EAGF,MAAM,SAAS,iBAAiB,WAAW,cAAc,GAAG;EAE5D,IAAI,CAAC,QAAQ;EAEb,IAAI,CAAC,UAAU,KAAK,YAAY,KAAK,iBAAiB,MAAM,GAC1D,SAAS,KACP,cAAc;GACZ,MAAM;GACN,QAAQ;GACR,SAAS,IAAI,UAAU,YAAY,OAAO;GAC1C,GAAG;EACL,CAAC,CACH;EAGF,MAAM,eAAe,SAAS,MAAM;EAEpC,IACE,UAAU,WAAW,GAAG,KACxB,mBAAmB,UACnB,iBAAiB,UACjB,mBAAmB,cACnB;GACA,MAAM,QAAQ,OAAO,OAAO,QAAQ,eAAe,EAAE,CAAC,CAAC,QAAQ,mBAAmB,EAAE;GAEpF,SAAS,KACP,cAAc;IACZ,MAAM;IACN,QAAQ;IACR,SAAS,IAAI,UAAU,yBAAyB,eAAe,UAAU,aAAa,aAAa,MAAM;IACzG,GAAG;GACL,CAAC,CACH;EACF;CACF;CAEA,OAAO;AACT;AAEA,SAAS,eACP,YACA,cACA,SACgB;CAChB,OAAO,cAAc;EACnB,MAAM,QAAQ;EACd,QAAQ;EACR,UAAU,QAAQ,YAAY;EAC9B,SAAS,QAAQ;EACjB,MAAM;EACN,GAAG,WAAW,YAAY,QAAQ,IAAI;CACxC,CAAC;AACH;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,qBACd,cACA,QACA,KACkB;CAClB,MAAM,aAAa,GAAG,iBAAiB,cAAc,QAAQ,GAAG,aAAa,QAAQ,IAAI;CACzF,MAAM,WAAW,CACf,GAAG,eAAe,YAAY,cAAc,GAAG,GAC/C,GAAG,CAAC,GAAG,iBAAiB,UAAU,GAAG,GAAG,kBAAkB,UAAU,CAAC,CAAC,CAAC,KAAK,YAC1E,eAAe,YAAY,cAAc,OAAO,CAClD,CACF;CACA,MAAM,QAAQ,OAAO,MAAM,OAAO;CAElC,OAAO,SACJ,QAAQ,YAAY,QAAQ,SAAS,QAAQ,CAAC,UAAU,OAAO,QAAQ,MAAM,QAAQ,IAAI,CAAC,CAAC,CAC3F,MACE,OAAO,YACL,MAAM,QAAQ,MAAM,OAAO,QAAQ,OAAO,MAAM,UAAU,MAAM,OAAO,UAAU,EACtF;AACJ;;AAGA,SAAgB,yBAAyB,KAAa,UAAU,iBAAmC;CACjG,MAAM,OAAO,KAAK,KAAK,KAAK,OAAO;CAEnC,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO,CAAC;CAE/B,MAAM,OAAO,aAAa,MAAM,MAAM;CACtC,MAAM,OAAO,GAAG,0BAA0B,MAAM,IAAI;CACpD,MAAM,UACJ,OAAO,KAAK,WAAW,YAAY,KAAK,WAAW,OAC/C,QAAQ,IAAI,KAAK,QAAQ,iBAAiB,IAC1C;CAEN,IACE,OAAO,YAAY,YACnB,YAAY,QACZ,QAAQ,IAAI,SAAS,wBAAwB,MAAM,MAEnD,OAAO,CAAC;CAGV,MAAM,QAAQ,KAAK,QAAQ,wBAAwB;CACnD,MAAM,SAAS,UAAU,KAAK,KAAK,KAAK,MAAM,GAAG,KAAK;CACtD,MAAM,OAAO,UAAU,KAAK,OAAO,OAAO,MAAM,IAAI,CAAC,CAAC;CACtD,MAAM,SAAS,UAAU,KAAK,OAAO,QAAQ,OAAO,YAAY,IAAI;CAEpE,OAAO,CACL,cAAc;EACZ,MAAM;EACN,QAAQ;EACR,SAAS;EACT,MAAM,QAAQ,OAAO;EACrB;EACA;CACF,CAAC,CACH;AACF;;;;;AAMA,SAAgB,eACd,KACA,OACA,SACkB;CAClB,MAAM,WAAW,yBAAyB,KAAK,OAAO;CAEtD,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI;EAEJ,IAAI;GACF,SAAS,aAAa,KAAK,KAAK,KAAK,IAAI,GAAG,MAAM;EACpD,QAAQ;GACN;EACF;EAEA,SAAS,KAAK,GAAG,qBAAqB,MAAM,QAAQ,GAAG,CAAC;CAC1D;CAEA,OAAO;AACT"}

package/esm/tooling/check/environment-step.d.mts

@@ -0,0 +1,18 @@
+import { ToolingProblem } from "../problem.mjs";
+
+//#region ../../packages/core/src/tooling/check/environment-step.d.ts
+/**
+ * The oldest Node.js release core supports — `engines.node` in core's
+ * package.json (`>=22.15`). `bin/warlock.js` refuses older versions before
+ * the CLI loads; this check covers programmatic `runCheck()` calls too.
+ */
+declare const MIN_NODE_VERSION = "22.15.0";
+/**
+ * Check the running Node.js against core's minimum and the app's own
+ * `engines.node` (when it is a plain `>=` range). A mismatch is a `WL8001`
+ * environment problem.
+ */
+declare function checkNodeVersion(cwd: string, running?: string): ToolingProblem[];
+//#endregion
+export { MIN_NODE_VERSION, checkNodeVersion };
+//# sourceMappingURL=environment-step.d.mts.map

package/esm/tooling/check/environment-step.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-step.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/environment-step.ts"],"mappings":";;;;;AASA;;;cAAa,gBAAA;;;;AAoDiF;;iBAA9E,gBAAA,CAAiB,GAAA,UAAa,OAAA,YAAkC,cAAc"}

package/esm/tooling/check/environment-step.mjs

@@ -0,0 +1,78 @@
+import { createProblem } from "../problem.mjs";
+import path from "node:path";
+import { readFileSync } from "node:fs";
+
+//#region ../../packages/core/src/tooling/check/environment-step.ts
+/**
+* The oldest Node.js release core supports — `engines.node` in core's
+* package.json (`>=22.15`). `bin/warlock.js` refuses older versions before
+* the CLI loads; this check covers programmatic `runCheck()` calls too.
+*/
+const MIN_NODE_VERSION = "22.15.0";
+function parseVersion(version) {
+	const match = /^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?/.exec(version.trim());
+	if (!match) return void 0;
+	return [
+		Number(match[1]),
+		Number(match[2] ?? 0),
+		Number(match[3] ?? 0)
+	];
+}
+function compareVersions(left, right) {
+	for (let index = 0; index < 3; index++) {
+		const difference = (left[index] ?? 0) - (right[index] ?? 0);
+		if (difference !== 0) return difference;
+	}
+	return 0;
+}
+/**
+* The minimum version of a `>=x.y.z` engines range, or `undefined` for any
+* other form (`^22`, `22.x || 24.x`): those are not interpreted rather than
+* guessed at.
+*/
+function minimumOfRange(range) {
+	return /^\s*>=\s*v?(\d+(?:\.\d+){0,2})\s*$/.exec(range)?.[1];
+}
+function appEnginesRange(cwd) {
+	try {
+		const manifest = JSON.parse(readFileSync(path.join(cwd, "package.json"), "utf8"));
+		const engines = typeof manifest === "object" && manifest !== null ? Reflect.get(manifest, "engines") : void 0;
+		const node = typeof engines === "object" && engines !== null ? Reflect.get(engines, "node") : void 0;
+		return typeof node === "string" ? node : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Check the running Node.js against core's minimum and the app's own
+* `engines.node` (when it is a plain `>=` range). A mismatch is a `WL8001`
+* environment problem.
+*/
+function checkNodeVersion(cwd, running = process.versions.node) {
+	const current = parseVersion(running);
+	if (!current) return [];
+	const requirements = [{
+		minimum: MIN_NODE_VERSION,
+		source: "@warlock.js/core (engines.node >=22.15)"
+	}];
+	const appRange = appEnginesRange(cwd);
+	const appMinimum = appRange ? minimumOfRange(appRange) : void 0;
+	if (appMinimum) requirements.push({
+		minimum: appMinimum,
+		source: `package.json engines.node ${appRange}`
+	});
+	const problems = [];
+	for (const requirement of requirements) {
+		const minimum = parseVersion(requirement.minimum);
+		if (minimum && compareVersions(current, minimum) < 0) problems.push(createProblem({
+			code: "WL8001",
+			source: "environment",
+			message: `Node.js ${running} is older than ${requirement.minimum}, required by ${requirement.source}.`
+		}));
+	}
+	return problems;
+}
+
+//#endregion
+export { MIN_NODE_VERSION, checkNodeVersion };
+//# sourceMappingURL=environment-step.mjs.map

package/esm/tooling/check/environment-step.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-step.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/environment-step.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { createProblem, type ToolingProblem } from \"../problem\";\n\n/**\n * The oldest Node.js release core supports — `engines.node` in core's\n * package.json (`>=22.15`). `bin/warlock.js` refuses older versions before\n * the CLI loads; this check covers programmatic `runCheck()` calls too.\n */\nexport const MIN_NODE_VERSION = \"22.15.0\";\n\nfunction parseVersion(version: string): [number, number, number] | undefined {\n  const match = /^v?(\\d+)(?:\\.(\\d+))?(?:\\.(\\d+))?/.exec(version.trim());\n\n  if (!match) return undefined;\n\n  return [Number(match[1]), Number(match[2] ?? 0), Number(match[3] ?? 0)];\n}\n\nfunction compareVersions(left: [number, number, number], right: [number, number, number]): number {\n  for (let index = 0; index < 3; index++) {\n    const difference = (left[index] ?? 0) - (right[index] ?? 0);\n\n    if (difference !== 0) return difference;\n  }\n\n  return 0;\n}\n\n/**\n * The minimum version of a `>=x.y.z` engines range, or `undefined` for any\n * other form (`^22`, `22.x || 24.x`): those are not interpreted rather than\n * guessed at.\n */\nexport function minimumOfRange(range: string): string | undefined {\n  const match = /^\\s*>=\\s*v?(\\d+(?:\\.\\d+){0,2})\\s*$/.exec(range);\n\n  return match?.[1];\n}\n\nfunction appEnginesRange(cwd: string): string | undefined {\n  try {\n    const manifest: unknown = JSON.parse(readFileSync(path.join(cwd, \"package.json\"), \"utf8\"));\n    const engines =\n      typeof manifest === \"object\" && manifest !== null\n        ? Reflect.get(manifest, \"engines\")\n        : undefined;\n    const node =\n      typeof engines === \"object\" && engines !== null ? Reflect.get(engines, \"node\") : undefined;\n\n    return typeof node === \"string\" ? node : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Check the running Node.js against core's minimum and the app's own\n * `engines.node` (when it is a plain `>=` range). A mismatch is a `WL8001`\n * environment problem.\n */\nexport function checkNodeVersion(cwd: string, running = process.versions.node): ToolingProblem[] {\n  const current = parseVersion(running);\n\n  if (!current) return [];\n\n  const requirements: { minimum: string; source: string }[] = [\n    { minimum: MIN_NODE_VERSION, source: \"@warlock.js/core (engines.node >=22.15)\" },\n  ];\n  const appRange = appEnginesRange(cwd);\n  const appMinimum = appRange ? minimumOfRange(appRange) : undefined;\n\n  if (appMinimum) {\n    requirements.push({ minimum: appMinimum, source: `package.json engines.node ${appRange}` });\n  }\n\n  const problems: ToolingProblem[] = [];\n\n  for (const requirement of requirements) {\n    const minimum = parseVersion(requirement.minimum);\n\n    if (minimum && compareVersions(current, minimum) < 0) {\n      problems.push(\n        createProblem({\n          code: \"WL8001\",\n          source: \"environment\",\n          message: `Node.js ${running} is older than ${requirement.minimum}, required by ${requirement.source}.`,\n        }),\n      );\n    }\n  }\n\n  return problems;\n}\n"],"mappings":";;;;;;;;;;AASA,MAAa,mBAAmB;AAEhC,SAAS,aAAa,SAAuD;CAC3E,MAAM,QAAQ,mCAAmC,KAAK,QAAQ,KAAK,CAAC;CAEpE,IAAI,CAAC,OAAO,OAAO;CAEnB,OAAO;EAAC,OAAO,MAAM,EAAE;EAAG,OAAO,MAAM,MAAM,CAAC;EAAG,OAAO,MAAM,MAAM,CAAC;CAAC;AACxE;AAEA,SAAS,gBAAgB,MAAgC,OAAyC;CAChG,KAAK,IAAI,QAAQ,GAAG,QAAQ,GAAG,SAAS;EACtC,MAAM,cAAc,KAAK,UAAU,MAAM,MAAM,UAAU;EAEzD,IAAI,eAAe,GAAG,OAAO;CAC/B;CAEA,OAAO;AACT;;;;;;AAOA,SAAgB,eAAe,OAAmC;CAGhE,OAFc,qCAAqC,KAAK,KAE7C,CAAC,GAAG;AACjB;AAEA,SAAS,gBAAgB,KAAiC;CACxD,IAAI;EACF,MAAM,WAAoB,KAAK,MAAM,aAAa,KAAK,KAAK,KAAK,cAAc,GAAG,MAAM,CAAC;EACzF,MAAM,UACJ,OAAO,aAAa,YAAY,aAAa,OACzC,QAAQ,IAAI,UAAU,SAAS,IAC/B;EACN,MAAM,OACJ,OAAO,YAAY,YAAY,YAAY,OAAO,QAAQ,IAAI,SAAS,MAAM,IAAI;EAEnF,OAAO,OAAO,SAAS,WAAW,OAAO;CAC3C,QAAQ;EACN;CACF;AACF;;;;;;AAOA,SAAgB,iBAAiB,KAAa,UAAU,QAAQ,SAAS,MAAwB;CAC/F,MAAM,UAAU,aAAa,OAAO;CAEpC,IAAI,CAAC,SAAS,OAAO,CAAC;CAEtB,MAAM,eAAsD,CAC1D;EAAE,SAAS;EAAkB,QAAQ;CAA0C,CACjF;CACA,MAAM,WAAW,gBAAgB,GAAG;CACpC,MAAM,aAAa,WAAW,eAAe,QAAQ,IAAI;CAEzD,IAAI,YACF,aAAa,KAAK;EAAE,SAAS;EAAY,QAAQ,6BAA6B;CAAW,CAAC;CAG5F,MAAM,WAA6B,CAAC;CAEpC,KAAK,MAAM,eAAe,cAAc;EACtC,MAAM,UAAU,aAAa,YAAY,OAAO;EAEhD,IAAI,WAAW,gBAAgB,SAAS,OAAO,IAAI,GACjD,SAAS,KACP,cAAc;GACZ,MAAM;GACN,QAAQ;GACR,SAAS,WAAW,QAAQ,iBAAiB,YAAY,QAAQ,gBAAgB,YAAY,OAAO;EACtG,CAAC,CACH;CAEJ;CAEA,OAAO;AACT"}

package/esm/tooling/check/index.d.mts

@@ -0,0 +1,8 @@
+import { GitResult, GitRunner, listChangedFiles, runGit } from "./changed-files.mjs";
+import { CHECK_EXIT_CODES, CHECK_STEPS, CheckExitCode, CheckReport, CheckStep, CheckStepName, CheckStepStatus, checkExitCode } from "./check-report.types.mjs";
+import { checkFileConventions, checkTsconfigConventions, isAutoLoadedFile, runConventions } from "./conventions-step.mjs";
+import { MIN_NODE_VERSION, checkNodeVersion } from "./environment-step.mjs";
+import { LintOutcome, runLint } from "./lint-step.mjs";
+import { VitestRun, VitestRunner, findVitest, parseVitestReport, runVitest } from "./tests-step.mjs";
+import { CheckOptions, TypecheckRunner, runCheck } from "./run-check.mjs";
+import { RunTestsOptions, TestRunReport, runTests, testRunArguments } from "./run-tests.mjs";

package/esm/tooling/check/index.mjs

@@ -0,0 +1,10 @@
+import { CHECK_EXIT_CODES, CHECK_STEPS, checkExitCode } from "./check-report.types.mjs";
+import { listChangedFiles, runGit } from "./changed-files.mjs";
+import { checkFileConventions, checkTsconfigConventions, isAutoLoadedFile, runConventions } from "./conventions-step.mjs";
+import { MIN_NODE_VERSION, checkNodeVersion } from "./environment-step.mjs";
+import { runLint } from "./lint-step.mjs";
+import { findVitest, parseVitestReport, runVitest } from "./tests-step.mjs";
+import { runCheck } from "./run-check.mjs";
+import { runTests, testRunArguments } from "./run-tests.mjs";
+
+export {  };

package/esm/tooling/check/lint-step.d.mts

@@ -0,0 +1,19 @@
+import { ToolingProblem } from "../problem.mjs";
+
+//#region ../../packages/core/src/tooling/check/lint-step.d.ts
+/** What the lint step found, and which linters ran. */
+type LintOutcome = {
+  problems: ToolingProblem[]; /** The linters that ran (`eslint`, `oxlint`); empty when the app configures none. */
+  linters: string[];
+};
+/**
+ * Lint `files` (project-relative) with the linters the app configures, the
+ * same ones `warlock dev` runs in the background: ESLint when an
+ * `eslint.config.*` exists, oxlint when an oxlint config exists and the app
+ * has the `oxlint` package. A config without its tool is a `WL8002`
+ * environment problem.
+ */
+declare function runLint(cwd: string, files: readonly string[]): Promise<LintOutcome>;
+//#endregion
+export { LintOutcome, runLint };
+//# sourceMappingURL=lint-step.d.mts.map

package/esm/tooling/check/lint-step.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint-step.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/lint-step.ts"],"mappings":";;;;KAWY,WAAA;EACV,QAAA,EAAU,cAAc,IADH;EAGrB,OAAA;AAAA;;;;;AAAO;AAuFT;;iBAAsB,OAAA,CAAQ,GAAA,UAAa,KAAA,sBAA2B,OAAO,CAAC,WAAA"}

package/esm/tooling/check/lint-step.mjs

@@ -0,0 +1,111 @@
+import { OxlintRunner, findOxlint, hasOxlintConfig } from "../../dev-server/health-checker/oxlint-runner.mjs";
+import { hasEslint } from "../../dev-server/health-checker/default-health-checkers.mjs";
+import { createProblem } from "../problem.mjs";
+import path from "node:path";
+import { ESLint } from "eslint";
+
+//#region ../../packages/core/src/tooling/check/lint-step.ts
+const LINTABLE = /\.[cm]?[jt]sx?$/i;
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** A missing package/plugin is the machine's install; anything else is the tool crashing. */
+function toolFailure(tool, error) {
+	const message = errorMessage(error);
+	return createProblem({
+		code: /cannot find (?:module|package)|ERR_MODULE_NOT_FOUND/i.test(message) ? "WL8002" : "WL8007",
+		source: "environment",
+		message: `${tool} could not run: ${message.split("\n")[0]}`
+	});
+}
+async function runEslint(cwd, files) {
+	const results = await new ESLint({
+		cwd,
+		errorOnUnmatchedPattern: false,
+		warnIgnored: false
+	}).lintFiles([...files]);
+	const problems = [];
+	for (const result of results) {
+		const file = path.relative(cwd, result.filePath).split(path.sep).join("/");
+		for (const message of result.messages) {
+			const error = message.severity === 2 || message.fatal === true;
+			problems.push(createProblem({
+				code: error ? "WL7201" : "WL7202",
+				source: "eslint",
+				severity: error ? "error" : "warning",
+				message: message.message,
+				file,
+				line: message.line || null,
+				column: message.column || null,
+				rule: message.ruleId ?? null
+			}));
+		}
+	}
+	return problems;
+}
+async function runOxlint(cwd, files) {
+	const runner = new OxlintRunner();
+	runner.initialize(cwd);
+	try {
+		return (await runner.checkFiles(files.map((file) => ({
+			path: path.join(cwd, file),
+			relativePath: file
+		})))).flatMap((result) => [...result.errors, ...result.warnings].map((message) => createProblem({
+			code: message.type === "error" ? "WL7201" : "WL7202",
+			source: "oxlint",
+			severity: message.type,
+			message: message.message,
+			file: message.relativePath,
+			line: message.lineNumber,
+			column: message.columnNumber,
+			rule: message.ruleId ?? null
+		})));
+	} finally {
+		await runner.shutdown();
+	}
+}
+/**
+* Lint `files` (project-relative) with the linters the app configures, the
+* same ones `warlock dev` runs in the background: ESLint when an
+* `eslint.config.*` exists, oxlint when an oxlint config exists and the app
+* has the `oxlint` package. A config without its tool is a `WL8002`
+* environment problem.
+*/
+async function runLint(cwd, files) {
+	const lintable = files.filter((file) => LINTABLE.test(file));
+	const problems = [];
+	const linters = [];
+	if (lintable.length === 0) return {
+		problems,
+		linters
+	};
+	if (hasEslint(cwd)) {
+		linters.push("eslint");
+		try {
+			problems.push(...await runEslint(cwd, lintable));
+		} catch (error) {
+			problems.push(toolFailure("ESLint", error));
+		}
+	}
+	if (hasOxlintConfig(cwd)) {
+		linters.push("oxlint");
+		if (!findOxlint(cwd)) problems.push(createProblem({
+			code: "WL8002",
+			source: "environment",
+			message: "An oxlint config exists but the oxlint package is not installed in the app."
+		}));
+		else try {
+			problems.push(...await runOxlint(cwd, lintable));
+		} catch (error) {
+			problems.push(toolFailure("oxlint", error));
+		}
+	}
+	return {
+		problems,
+		linters
+	};
+}
+
+//#endregion
+export { runLint };
+//# sourceMappingURL=lint-step.mjs.map

package/esm/tooling/check/lint-step.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint-step.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/lint-step.ts"],"sourcesContent":["import { ESLint } from \"eslint\";\nimport path from \"node:path\";\nimport { hasEslint } from \"../../dev-server/health-checker/default-health-checkers\";\nimport {\n  findOxlint,\n  hasOxlintConfig,\n  OxlintRunner,\n} from \"../../dev-server/health-checker/oxlint-runner\";\nimport { createProblem, type ToolingProblem } from \"../problem\";\n\n/** What the lint step found, and which linters ran. */\nexport type LintOutcome = {\n  problems: ToolingProblem[];\n  /** The linters that ran (`eslint`, `oxlint`); empty when the app configures none. */\n  linters: string[];\n};\n\nconst LINTABLE = /\\.[cm]?[jt]sx?$/i;\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** A missing package/plugin is the machine's install; anything else is the tool crashing. */\nfunction toolFailure(tool: string, error: unknown): ToolingProblem {\n  const message = errorMessage(error);\n  const missing = /cannot find (?:module|package)|ERR_MODULE_NOT_FOUND/i.test(message);\n\n  return createProblem({\n    code: missing ? \"WL8002\" : \"WL8007\",\n    source: \"environment\",\n    message: `${tool} could not run: ${message.split(\"\\n\")[0]}`,\n  });\n}\n\nasync function runEslint(cwd: string, files: readonly string[]): Promise<ToolingProblem[]> {\n  // The same flat-config lookup the dev server's ESLint checker uses.\n  const eslint = new ESLint({ cwd, errorOnUnmatchedPattern: false, warnIgnored: false });\n  const results = await eslint.lintFiles([...files]);\n  const problems: ToolingProblem[] = [];\n\n  for (const result of results) {\n    const file = path.relative(cwd, result.filePath).split(path.sep).join(\"/\");\n\n    for (const message of result.messages) {\n      const error = message.severity === 2 || message.fatal === true;\n\n      problems.push(\n        createProblem({\n          code: error ? \"WL7201\" : \"WL7202\",\n          source: \"eslint\",\n          severity: error ? \"error\" : \"warning\",\n          message: message.message,\n          file,\n          line: message.line || null,\n          column: message.column || null,\n          rule: message.ruleId ?? null,\n        }),\n      );\n    }\n  }\n\n  return problems;\n}\n\nasync function runOxlint(cwd: string, files: readonly string[]): Promise<ToolingProblem[]> {\n  const runner = new OxlintRunner();\n\n  runner.initialize(cwd);\n\n  try {\n    const results = await runner.checkFiles(\n      files.map((file) => ({ path: path.join(cwd, file), relativePath: file })),\n    );\n\n    return results.flatMap((result) =>\n      [...result.errors, ...result.warnings].map((message) =>\n        createProblem({\n          code: message.type === \"error\" ? \"WL7201\" : \"WL7202\",\n          source: \"oxlint\",\n          severity: message.type,\n          message: message.message,\n          file: message.relativePath,\n          line: message.lineNumber,\n          column: message.columnNumber,\n          rule: message.ruleId ?? null,\n        }),\n      ),\n    );\n  } finally {\n    await runner.shutdown();\n  }\n}\n\n/**\n * Lint `files` (project-relative) with the linters the app configures, the\n * same ones `warlock dev` runs in the background: ESLint when an\n * `eslint.config.*` exists, oxlint when an oxlint config exists and the app\n * has the `oxlint` package. A config without its tool is a `WL8002`\n * environment problem.\n */\nexport async function runLint(cwd: string, files: readonly string[]): Promise<LintOutcome> {\n  const lintable = files.filter((file) => LINTABLE.test(file));\n  const problems: ToolingProblem[] = [];\n  const linters: string[] = [];\n\n  // ESLint lints the whole directory when handed no pattern; nothing to lint\n  // means nothing to run.\n  if (lintable.length === 0) return { problems, linters };\n\n  if (hasEslint(cwd)) {\n    linters.push(\"eslint\");\n\n    try {\n      problems.push(...(await runEslint(cwd, lintable)));\n    } catch (error) {\n      problems.push(toolFailure(\"ESLint\", error));\n    }\n  }\n\n  if (hasOxlintConfig(cwd)) {\n    linters.push(\"oxlint\");\n\n    if (!findOxlint(cwd)) {\n      problems.push(\n        createProblem({\n          code: \"WL8002\",\n          source: \"environment\",\n          message: \"An oxlint config exists but the oxlint package is not installed in the app.\",\n        }),\n      );\n    } else {\n      try {\n        problems.push(...(await runOxlint(cwd, lintable)));\n      } catch (error) {\n        problems.push(toolFailure(\"oxlint\", error));\n      }\n    }\n  }\n\n  return { problems, linters };\n}\n"],"mappings":";;;;;;;AAiBA,MAAM,WAAW;AAEjB,SAAS,aAAa,OAAwB;CAC5C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;AAGA,SAAS,YAAY,MAAc,OAAgC;CACjE,MAAM,UAAU,aAAa,KAAK;CAGlC,OAAO,cAAc;EACnB,MAHc,uDAAuD,KAAK,OAG9D,IAAI,WAAW;EAC3B,QAAQ;EACR,SAAS,GAAG,KAAK,kBAAkB,QAAQ,MAAM,IAAI,CAAC,CAAC;CACzD,CAAC;AACH;AAEA,eAAe,UAAU,KAAa,OAAqD;CAGzF,MAAM,UAAU,MAAM,IADH,OAAO;EAAE;EAAK,yBAAyB;EAAO,aAAa;CAAM,CACzD,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;CACjD,MAAM,WAA6B,CAAC;CAEpC,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,OAAO,KAAK,SAAS,KAAK,OAAO,QAAQ,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;EAEzE,KAAK,MAAM,WAAW,OAAO,UAAU;GACrC,MAAM,QAAQ,QAAQ,aAAa,KAAK,QAAQ,UAAU;GAE1D,SAAS,KACP,cAAc;IACZ,MAAM,QAAQ,WAAW;IACzB,QAAQ;IACR,UAAU,QAAQ,UAAU;IAC5B,SAAS,QAAQ;IACjB;IACA,MAAM,QAAQ,QAAQ;IACtB,QAAQ,QAAQ,UAAU;IAC1B,MAAM,QAAQ,UAAU;GAC1B,CAAC,CACH;EACF;CACF;CAEA,OAAO;AACT;AAEA,eAAe,UAAU,KAAa,OAAqD;CACzF,MAAM,SAAS,IAAI,aAAa;CAEhC,OAAO,WAAW,GAAG;CAErB,IAAI;EAKF,QAAO,MAJe,OAAO,WAC3B,MAAM,KAAK,UAAU;GAAE,MAAM,KAAK,KAAK,KAAK,IAAI;GAAG,cAAc;EAAK,EAAE,CAC1E,EAEc,CAAC,SAAS,WACtB,CAAC,GAAG,OAAO,QAAQ,GAAG,OAAO,QAAQ,CAAC,CAAC,KAAK,YAC1C,cAAc;GACZ,MAAM,QAAQ,SAAS,UAAU,WAAW;GAC5C,QAAQ;GACR,UAAU,QAAQ;GAClB,SAAS,QAAQ;GACjB,MAAM,QAAQ;GACd,MAAM,QAAQ;GACd,QAAQ,QAAQ;GAChB,MAAM,QAAQ,UAAU;EAC1B,CAAC,CACH,CACF;CACF,UAAU;EACR,MAAM,OAAO,SAAS;CACxB;AACF;;;;;;;;AASA,eAAsB,QAAQ,KAAa,OAAgD;CACzF,MAAM,WAAW,MAAM,QAAQ,SAAS,SAAS,KAAK,IAAI,CAAC;CAC3D,MAAM,WAA6B,CAAC;CACpC,MAAM,UAAoB,CAAC;CAI3B,IAAI,SAAS,WAAW,GAAG,OAAO;EAAE;EAAU;CAAQ;CAEtD,IAAI,UAAU,GAAG,GAAG;EAClB,QAAQ,KAAK,QAAQ;EAErB,IAAI;GACF,SAAS,KAAK,GAAI,MAAM,UAAU,KAAK,QAAQ,CAAE;EACnD,SAAS,OAAO;GACd,SAAS,KAAK,YAAY,UAAU,KAAK,CAAC;EAC5C;CACF;CAEA,IAAI,gBAAgB,GAAG,GAAG;EACxB,QAAQ,KAAK,QAAQ;EAErB,IAAI,CAAC,WAAW,GAAG,GACjB,SAAS,KACP,cAAc;GACZ,MAAM;GACN,QAAQ;GACR,SAAS;EACX,CAAC,CACH;OAEA,IAAI;GACF,SAAS,KAAK,GAAI,MAAM,UAAU,KAAK,QAAQ,CAAE;EACnD,SAAS,OAAO;GACd,SAAS,KAAK,YAAY,UAAU,KAAK,CAAC;EAC5C;CAEJ;CAEA,OAAO;EAAE;EAAU;CAAQ;AAC7B"}

package/esm/tooling/check/request-input.mjs

@@ -0,0 +1,132 @@
+import { isMemberAccess, isValueReference, memberName, resolveInitializer, unwrap, walk } from "./source-ast.mjs";
+import ts from "typescript";
+
+//#region ../../packages/core/src/tooling/check/request-input.ts
+/** Identifiers the source checks treat as the incoming request. */
+const REQUEST_NAMES = new Set(["request", "req"]);
+/**
+* Request members that return client-controlled input. Reading any of them
+* (as a property or a call) yields data the client chose.
+*/
+const REQUEST_INPUT_MEMBERS = new Set([
+	"all",
+	"allExceptParams",
+	"heavy",
+	"heavyExceptParams",
+	"only",
+	"pluck",
+	"except",
+	"input",
+	"get",
+	"email",
+	"string",
+	"int",
+	"bool",
+	"float",
+	"number",
+	"body",
+	"bodyInputs",
+	"params",
+	"query",
+	"validated",
+	"validatedExcept",
+	"idParam",
+	"headers",
+	"header",
+	"cookie",
+	"cookies",
+	"referer",
+	"referrer"
+]);
+/** Request members that return the whole (or most of the) request body. */
+const REQUEST_BODY_MEMBERS = new Set([
+	"all",
+	"allExceptParams",
+	"heavy",
+	"heavyExceptParams",
+	"body",
+	"bodyInputs",
+	"validated",
+	"validatedExcept",
+	"only",
+	"except",
+	"pluck",
+	"headers",
+	"cookies"
+]);
+/**
+* When `node` is `<request>.<member>` or `<request>.<member>(…)` (also through
+* `request.query.next`-style chains), the `<member>`.
+*/
+function requestMemberAccess(node) {
+	let current = unwrap(node);
+	if (ts.isCallExpression(current)) current = unwrap(current.expression);
+	if (!isMemberAccess(current)) return void 0;
+	let member = current;
+	for (;;) {
+		const object = unwrap(member.expression);
+		if (ts.isIdentifier(object)) return REQUEST_NAMES.has(object.text) ? memberName(member) : void 0;
+		if (isMemberAccess(object)) {
+			member = object;
+			continue;
+		}
+		if (ts.isCallExpression(object)) {
+			const callee = unwrap(object.expression);
+			if (!isMemberAccess(callee)) return void 0;
+			member = callee;
+			continue;
+		}
+		return;
+	}
+}
+/** Whether `node` reads client-controlled input from the request. */
+function isRequestInputExpression(node) {
+	const member = requestMemberAccess(node);
+	return member !== void 0 && REQUEST_INPUT_MEMBERS.has(member);
+}
+function isSanitizerCall(call, sanitizers) {
+	const callee = unwrap(call.expression);
+	if (ts.isIdentifier(callee)) return sanitizers.has(callee.text);
+	if (isMemberAccess(callee)) {
+		const name = memberName(callee);
+		return name !== void 0 && sanitizers.has(name);
+	}
+	return false;
+}
+/**
+* Whether an expression carries request input: it reads the request directly,
+* or names a local constant initialised from request input. A call to a
+* sanitizer launders its arguments.
+*/
+function containsRequestInput(node, options = {}, seen = /* @__PURE__ */ new Set()) {
+	let found = false;
+	const sanitizers = options.sanitizers ?? /* @__PURE__ */ new Set();
+	walk(node, (child) => {
+		if (found) return false;
+		if (ts.isCallExpression(child) && isSanitizerCall(child, sanitizers)) return false;
+		if (isMemberAccess(child) || ts.isCallExpression(child)) {
+			if (isRequestInputExpression(child) || options.isSource?.(child) === true) {
+				found = true;
+				return false;
+			}
+		}
+		if (ts.isIdentifier(child) && !seen.has(child)) {
+			seen.add(child);
+			if (isValueReference(child)) {
+				const initializer = resolveInitializer(child);
+				if (initializer && !seen.has(initializer)) {
+					seen.add(initializer);
+					if (containsRequestInput(initializer, options, seen)) {
+						found = true;
+						return false;
+					}
+				}
+			}
+		}
+	});
+	return found;
+}
+
+//#endregion
+export { REQUEST_BODY_MEMBERS, REQUEST_NAMES, containsRequestInput, requestMemberAccess };
+//# sourceMappingURL=request-input.mjs.map

package/esm/tooling/check/request-input.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-input.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/request-input.ts"],"sourcesContent":["import ts from \"typescript\";\nimport {\n  isMemberAccess,\n  isValueReference,\n  memberName,\n  resolveInitializer,\n  unwrap,\n  walk,\n} from \"./source-ast\";\n\n/** Identifiers the source checks treat as the incoming request. */\nexport const REQUEST_NAMES: ReadonlySet<string> = new Set([\"request\", \"req\"]);\n\n/**\n * Request members that return client-controlled input. Reading any of them\n * (as a property or a call) yields data the client chose.\n */\nconst REQUEST_INPUT_MEMBERS: ReadonlySet<string> = new Set([\n  \"all\",\n  \"allExceptParams\",\n  \"heavy\",\n  \"heavyExceptParams\",\n  \"only\",\n  \"pluck\",\n  \"except\",\n  \"input\",\n  \"get\",\n  \"email\",\n  \"string\",\n  \"int\",\n  \"bool\",\n  \"float\",\n  \"number\",\n  \"body\",\n  \"bodyInputs\",\n  \"params\",\n  \"query\",\n  \"validated\",\n  \"validatedExcept\",\n  \"idParam\",\n  \"headers\",\n  \"header\",\n  \"cookie\",\n  \"cookies\",\n  \"referer\",\n  \"referrer\",\n]);\n\n/** Request members that return the whole (or most of the) request body. */\nexport const REQUEST_BODY_MEMBERS: ReadonlySet<string> = new Set([\n  \"all\",\n  \"allExceptParams\",\n  \"heavy\",\n  \"heavyExceptParams\",\n  \"body\",\n  \"bodyInputs\",\n  \"validated\",\n  \"validatedExcept\",\n  \"only\",\n  \"except\",\n  \"pluck\",\n  \"headers\",\n  \"cookies\",\n]);\n\n/**\n * When `node` is `<request>.<member>` or `<request>.<member>(…)` (also through\n * `request.query.next`-style chains), the `<member>`.\n */\nexport function requestMemberAccess(node: ts.Node): string | undefined {\n  let current = unwrap(node);\n\n  if (ts.isCallExpression(current)) current = unwrap(current.expression);\n  if (!isMemberAccess(current)) return undefined;\n\n  // Walk down to the member read directly off the request: `request.query.next` → `query`.\n  let member = current;\n\n  for (;;) {\n    const object = unwrap(member.expression);\n\n    if (ts.isIdentifier(object)) {\n      return REQUEST_NAMES.has(object.text) ? memberName(member) : undefined;\n    }\n\n    if (isMemberAccess(object)) {\n      member = object;\n      continue;\n    }\n\n    if (ts.isCallExpression(object)) {\n      const callee = unwrap(object.expression);\n      if (!isMemberAccess(callee)) return undefined;\n      member = callee;\n      continue;\n    }\n\n    return undefined;\n  }\n}\n\n/** Whether `node` reads client-controlled input from the request. */\nexport function isRequestInputExpression(node: ts.Node): boolean {\n  const member = requestMemberAccess(node);\n\n  return member !== undefined && REQUEST_INPUT_MEMBERS.has(member);\n}\n\nexport type TaintOptions = {\n  /** Calls whose result is clean, whatever their arguments (matched by name). */\n  sanitizers?: ReadonlySet<string>;\n  /** Input sources besides the request (client query-string hooks, `location.search`). */\n  isSource?: (node: ts.Node) => boolean;\n};\n\nfunction isSanitizerCall(call: ts.CallExpression, sanitizers: ReadonlySet<string>): boolean {\n  const callee = unwrap(call.expression);\n\n  if (ts.isIdentifier(callee)) return sanitizers.has(callee.text);\n\n  if (isMemberAccess(callee)) {\n    const name = memberName(callee);\n    return name !== undefined && sanitizers.has(name);\n  }\n\n  return false;\n}\n\n/**\n * Whether an expression carries request input: it reads the request directly,\n * or names a local constant initialised from request input. A call to a\n * sanitizer launders its arguments.\n */\nexport function containsRequestInput(\n  node: ts.Node,\n  options: TaintOptions = {},\n  seen: Set<ts.Node> = new Set(),\n): boolean {\n  let found = false;\n  const sanitizers = options.sanitizers ?? new Set<string>();\n\n  walk(node, (child) => {\n    if (found) return false;\n\n    if (ts.isCallExpression(child) && isSanitizerCall(child, sanitizers)) return false;\n\n    if (isMemberAccess(child) || ts.isCallExpression(child)) {\n      if (isRequestInputExpression(child) || options.isSource?.(child) === true) {\n        found = true;\n        return false;\n      }\n    }\n\n    if (ts.isIdentifier(child) && !seen.has(child)) {\n      seen.add(child);\n\n      if (isValueReference(child)) {\n        const initializer = resolveInitializer(child);\n\n        if (initializer && !seen.has(initializer)) {\n          seen.add(initializer);\n\n          if (containsRequestInput(initializer, options, seen)) {\n            found = true;\n            return false;\n          }\n        }\n      }\n    }\n\n    return undefined;\n  });\n\n  return found;\n}\n"],"mappings":";;;;;AAWA,MAAa,gBAAqC,IAAI,IAAI,CAAC,WAAW,KAAK,CAAC;;;;;AAM5E,MAAM,wBAA6C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAa,uBAA4C,IAAI,IAAI;CAC/D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;AAMD,SAAgB,oBAAoB,MAAmC;CACrE,IAAI,UAAU,OAAO,IAAI;CAEzB,IAAI,GAAG,iBAAiB,OAAO,GAAG,UAAU,OAAO,QAAQ,UAAU;CACrE,IAAI,CAAC,eAAe,OAAO,GAAG,OAAO;CAGrC,IAAI,SAAS;CAEb,SAAS;EACP,MAAM,SAAS,OAAO,OAAO,UAAU;EAEvC,IAAI,GAAG,aAAa,MAAM,GACxB,OAAO,cAAc,IAAI,OAAO,IAAI,IAAI,WAAW,MAAM,IAAI;EAG/D,IAAI,eAAe,MAAM,GAAG;GAC1B,SAAS;GACT;EACF;EAEA,IAAI,GAAG,iBAAiB,MAAM,GAAG;GAC/B,MAAM,SAAS,OAAO,OAAO,UAAU;GACvC,IAAI,CAAC,eAAe,MAAM,GAAG,OAAO;GACpC,SAAS;GACT;EACF;EAEA;CACF;AACF;;AAGA,SAAgB,yBAAyB,MAAwB;CAC/D,MAAM,SAAS,oBAAoB,IAAI;CAEvC,OAAO,WAAW,UAAa,sBAAsB,IAAI,MAAM;AACjE;AASA,SAAS,gBAAgB,MAAyB,YAA0C;CAC1F,MAAM,SAAS,OAAO,KAAK,UAAU;CAErC,IAAI,GAAG,aAAa,MAAM,GAAG,OAAO,WAAW,IAAI,OAAO,IAAI;CAE9D,IAAI,eAAe,MAAM,GAAG;EAC1B,MAAM,OAAO,WAAW,MAAM;EAC9B,OAAO,SAAS,UAAa,WAAW,IAAI,IAAI;CAClD;CAEA,OAAO;AACT;;;;;;AAOA,SAAgB,qBACd,MACA,UAAwB,CAAC,GACzB,uBAAqB,IAAI,IAAI,GACpB;CACT,IAAI,QAAQ;CACZ,MAAM,aAAa,QAAQ,8BAAc,IAAI,IAAY;CAEzD,KAAK,OAAO,UAAU;EACpB,IAAI,OAAO,OAAO;EAElB,IAAI,GAAG,iBAAiB,KAAK,KAAK,gBAAgB,OAAO,UAAU,GAAG,OAAO;EAE7E,IAAI,eAAe,KAAK,KAAK,GAAG,iBAAiB,KAAK,GACpD;OAAI,yBAAyB,KAAK,KAAK,QAAQ,WAAW,KAAK,MAAM,MAAM;IACzE,QAAQ;IACR,OAAO;GACT;;EAGF,IAAI,GAAG,aAAa,KAAK,KAAK,CAAC,KAAK,IAAI,KAAK,GAAG;GAC9C,KAAK,IAAI,KAAK;GAEd,IAAI,iBAAiB,KAAK,GAAG;IAC3B,MAAM,cAAc,mBAAmB,KAAK;IAE5C,IAAI,eAAe,CAAC,KAAK,IAAI,WAAW,GAAG;KACzC,KAAK,IAAI,WAAW;KAEpB,IAAI,qBAAqB,aAAa,SAAS,IAAI,GAAG;MACpD,QAAQ;MACR,OAAO;KACT;IACF;GACF;EACF;CAGF,CAAC;CAED,OAAO;AACT"}