@warlock.js/core 5.30.0 → 5.32.0

package/esm/tooling/check/environment-step.mjs

@@ -0,0 +1,78 @@
+import { createProblem } from "../problem.mjs";
+import path from "node:path";
+import { readFileSync } from "node:fs";
+
+//#region ../../packages/core/src/tooling/check/environment-step.ts
+/**
+* The oldest Node.js release core supports — `engines.node` in core's
+* package.json (`>=22.15`). `bin/warlock.js` refuses older versions before
+* the CLI loads; this check covers programmatic `runCheck()` calls too.
+*/
+const MIN_NODE_VERSION = "22.15.0";
+function parseVersion(version) {
+	const match = /^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?/.exec(version.trim());
+	if (!match) return void 0;
+	return [
+		Number(match[1]),
+		Number(match[2] ?? 0),
+		Number(match[3] ?? 0)
+	];
+}
+function compareVersions(left, right) {
+	for (let index = 0; index < 3; index++) {
+		const difference = (left[index] ?? 0) - (right[index] ?? 0);
+		if (difference !== 0) return difference;
+	}
+	return 0;
+}
+/**
+* The minimum version of a `>=x.y.z` engines range, or `undefined` for any
+* other form (`^22`, `22.x || 24.x`): those are not interpreted rather than
+* guessed at.
+*/
+function minimumOfRange(range) {
+	return /^\s*>=\s*v?(\d+(?:\.\d+){0,2})\s*$/.exec(range)?.[1];
+}
+function appEnginesRange(cwd) {
+	try {
+		const manifest = JSON.parse(readFileSync(path.join(cwd, "package.json"), "utf8"));
+		const engines = typeof manifest === "object" && manifest !== null ? Reflect.get(manifest, "engines") : void 0;
+		const node = typeof engines === "object" && engines !== null ? Reflect.get(engines, "node") : void 0;
+		return typeof node === "string" ? node : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Check the running Node.js against core's minimum and the app's own
+* `engines.node` (when it is a plain `>=` range). A mismatch is a `WL8001`
+* environment problem.
+*/
+function checkNodeVersion(cwd, running = process.versions.node) {
+	const current = parseVersion(running);
+	if (!current) return [];
+	const requirements = [{
+		minimum: MIN_NODE_VERSION,
+		source: "@warlock.js/core (engines.node >=22.15)"
+	}];
+	const appRange = appEnginesRange(cwd);
+	const appMinimum = appRange ? minimumOfRange(appRange) : void 0;
+	if (appMinimum) requirements.push({
+		minimum: appMinimum,
+		source: `package.json engines.node ${appRange}`
+	});
+	const problems = [];
+	for (const requirement of requirements) {
+		const minimum = parseVersion(requirement.minimum);
+		if (minimum && compareVersions(current, minimum) < 0) problems.push(createProblem({
+			code: "WL8001",
+			source: "environment",
+			message: `Node.js ${running} is older than ${requirement.minimum}, required by ${requirement.source}.`
+		}));
+	}
+	return problems;
+}
+
+//#endregion
+export { MIN_NODE_VERSION, checkNodeVersion, minimumOfRange };
+//# sourceMappingURL=environment-step.mjs.map

package/esm/tooling/check/environment-step.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-step.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/environment-step.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { createProblem, type ToolingProblem } from \"../problem\";\n\n/**\n * The oldest Node.js release core supports — `engines.node` in core's\n * package.json (`>=22.15`). `bin/warlock.js` refuses older versions before\n * the CLI loads; this check covers programmatic `runCheck()` calls too.\n */\nexport const MIN_NODE_VERSION = \"22.15.0\";\n\nfunction parseVersion(version: string): [number, number, number] | undefined {\n  const match = /^v?(\\d+)(?:\\.(\\d+))?(?:\\.(\\d+))?/.exec(version.trim());\n\n  if (!match) return undefined;\n\n  return [Number(match[1]), Number(match[2] ?? 0), Number(match[3] ?? 0)];\n}\n\nfunction compareVersions(left: [number, number, number], right: [number, number, number]): number {\n  for (let index = 0; index < 3; index++) {\n    const difference = (left[index] ?? 0) - (right[index] ?? 0);\n\n    if (difference !== 0) return difference;\n  }\n\n  return 0;\n}\n\n/**\n * The minimum version of a `>=x.y.z` engines range, or `undefined` for any\n * other form (`^22`, `22.x || 24.x`): those are not interpreted rather than\n * guessed at.\n */\nexport function minimumOfRange(range: string): string | undefined {\n  const match = /^\\s*>=\\s*v?(\\d+(?:\\.\\d+){0,2})\\s*$/.exec(range);\n\n  return match?.[1];\n}\n\nfunction appEnginesRange(cwd: string): string | undefined {\n  try {\n    const manifest: unknown = JSON.parse(readFileSync(path.join(cwd, \"package.json\"), \"utf8\"));\n    const engines =\n      typeof manifest === \"object\" && manifest !== null\n        ? Reflect.get(manifest, \"engines\")\n        : undefined;\n    const node =\n      typeof engines === \"object\" && engines !== null ? Reflect.get(engines, \"node\") : undefined;\n\n    return typeof node === \"string\" ? node : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Check the running Node.js against core's minimum and the app's own\n * `engines.node` (when it is a plain `>=` range). A mismatch is a `WL8001`\n * environment problem.\n */\nexport function checkNodeVersion(cwd: string, running = process.versions.node): ToolingProblem[] {\n  const current = parseVersion(running);\n\n  if (!current) return [];\n\n  const requirements: { minimum: string; source: string }[] = [\n    { minimum: MIN_NODE_VERSION, source: \"@warlock.js/core (engines.node >=22.15)\" },\n  ];\n  const appRange = appEnginesRange(cwd);\n  const appMinimum = appRange ? minimumOfRange(appRange) : undefined;\n\n  if (appMinimum) {\n    requirements.push({ minimum: appMinimum, source: `package.json engines.node ${appRange}` });\n  }\n\n  const problems: ToolingProblem[] = [];\n\n  for (const requirement of requirements) {\n    const minimum = parseVersion(requirement.minimum);\n\n    if (minimum && compareVersions(current, minimum) < 0) {\n      problems.push(\n        createProblem({\n          code: \"WL8001\",\n          source: \"environment\",\n          message: `Node.js ${running} is older than ${requirement.minimum}, required by ${requirement.source}.`,\n        }),\n      );\n    }\n  }\n\n  return problems;\n}\n"],"mappings":";;;;;;;;;;AASA,MAAa,mBAAmB;AAEhC,SAAS,aAAa,SAAuD;CAC3E,MAAM,QAAQ,mCAAmC,KAAK,QAAQ,KAAK,CAAC;CAEpE,IAAI,CAAC,OAAO,OAAO;CAEnB,OAAO;EAAC,OAAO,MAAM,EAAE;EAAG,OAAO,MAAM,MAAM,CAAC;EAAG,OAAO,MAAM,MAAM,CAAC;CAAC;AACxE;AAEA,SAAS,gBAAgB,MAAgC,OAAyC;CAChG,KAAK,IAAI,QAAQ,GAAG,QAAQ,GAAG,SAAS;EACtC,MAAM,cAAc,KAAK,UAAU,MAAM,MAAM,UAAU;EAEzD,IAAI,eAAe,GAAG,OAAO;CAC/B;CAEA,OAAO;AACT;;;;;;AAOA,SAAgB,eAAe,OAAmC;CAGhE,OAFc,qCAAqC,KAAK,KAE7C,CAAC,GAAG;AACjB;AAEA,SAAS,gBAAgB,KAAiC;CACxD,IAAI;EACF,MAAM,WAAoB,KAAK,MAAM,aAAa,KAAK,KAAK,KAAK,cAAc,GAAG,MAAM,CAAC;EACzF,MAAM,UACJ,OAAO,aAAa,YAAY,aAAa,OACzC,QAAQ,IAAI,UAAU,SAAS,IAC/B;EACN,MAAM,OACJ,OAAO,YAAY,YAAY,YAAY,OAAO,QAAQ,IAAI,SAAS,MAAM,IAAI;EAEnF,OAAO,OAAO,SAAS,WAAW,OAAO;CAC3C,QAAQ;EACN;CACF;AACF;;;;;;AAOA,SAAgB,iBAAiB,KAAa,UAAU,QAAQ,SAAS,MAAwB;CAC/F,MAAM,UAAU,aAAa,OAAO;CAEpC,IAAI,CAAC,SAAS,OAAO,CAAC;CAEtB,MAAM,eAAsD,CAC1D;EAAE,SAAS;EAAkB,QAAQ;CAA0C,CACjF;CACA,MAAM,WAAW,gBAAgB,GAAG;CACpC,MAAM,aAAa,WAAW,eAAe,QAAQ,IAAI;CAEzD,IAAI,YACF,aAAa,KAAK;EAAE,SAAS;EAAY,QAAQ,6BAA6B;CAAW,CAAC;CAG5F,MAAM,WAA6B,CAAC;CAEpC,KAAK,MAAM,eAAe,cAAc;EACtC,MAAM,UAAU,aAAa,YAAY,OAAO;EAEhD,IAAI,WAAW,gBAAgB,SAAS,OAAO,IAAI,GACjD,SAAS,KACP,cAAc;GACZ,MAAM;GACN,QAAQ;GACR,SAAS,WAAW,QAAQ,iBAAiB,YAAY,QAAQ,gBAAgB,YAAY,OAAO;EACtG,CAAC,CACH;CAEJ;CAEA,OAAO;AACT"}

package/esm/tooling/check/index.mjs

@@ -0,0 +1,10 @@
+import { CHECK_EXIT_CODES, CHECK_STEPS, checkExitCode } from "./check-report.types.mjs";
+import { listChangedFiles, runGit } from "./changed-files.mjs";
+import { checkFileConventions, checkTsconfigConventions, isAutoLoadedFile, runConventions } from "./conventions-step.mjs";
+import { MIN_NODE_VERSION, checkNodeVersion } from "./environment-step.mjs";
+import { runLint } from "./lint-step.mjs";
+import { findVitest, parseVitestReport, runVitest } from "./tests-step.mjs";
+import { runCheck } from "./run-check.mjs";
+import { runTests, testRunArguments } from "./run-tests.mjs";
+
+export { CHECK_EXIT_CODES, CHECK_STEPS, MIN_NODE_VERSION, checkExitCode, checkFileConventions, checkNodeVersion, checkTsconfigConventions, findVitest, isAutoLoadedFile, listChangedFiles, parseVitestReport, runCheck, runConventions, runGit, runLint, runTests, runVitest, testRunArguments };

package/esm/tooling/check/lint-step.d.mts

@@ -0,0 +1,18 @@
+import { ToolingProblem } from "../problem.mjs";
+//#region ../../packages/core/src/tooling/check/lint-step.d.ts
+/** What the lint step found, and which linters ran. */
+export type LintOutcome = {
+  problems: ToolingProblem[];
+  /** The linters that ran (`eslint`, `oxlint`); empty when the app configures none. */
+  linters: string[];
+};
+/**
+ * Lint `files` (project-relative) with the linters the app configures, the
+ * same ones `warlock dev` runs in the background: ESLint when an
+ * `eslint.config.*` exists, oxlint when an oxlint config exists and the app
+ * has the `oxlint` package. A config without its tool is a `WL8002`
+ * environment problem.
+ */
+export declare function runLint(cwd: string, files: readonly string[]): Promise<LintOutcome>;
+//#endregion
+//# sourceMappingURL=lint-step.d.mts.map

package/esm/tooling/check/lint-step.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint-step.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/lint-step.ts"],"mappings":";;;YAWY;EACV,UAAU;;EAEV;;;;;;;;;wBAuFoB,QAAQ,aAAa,2BAA2B,QAAQ"}

package/esm/tooling/check/lint-step.mjs

@@ -0,0 +1,112 @@
+import { OxlintRunner, findOxlint, hasOxlintConfig } from "../../dev-server/health-checker/oxlint-runner.mjs";
+import { hasEslint } from "../../dev-server/health-checker/default-health-checkers.mjs";
+import { createProblem } from "../problem.mjs";
+import path from "node:path";
+import { ESLint } from "eslint";
+
+//#region ../../packages/core/src/tooling/check/lint-step.ts
+const LINTABLE = /\.[cm]?[jt]sx?$/i;
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** A missing package/plugin is the machine's install; anything else is the tool crashing. */
+function toolFailure(tool, error) {
+	const message = errorMessage(error);
+	const missing = /cannot find (?:module|package)|ERR_MODULE_NOT_FOUND/i.test(message);
+	return createProblem({
+		code: missing ? "WL8002" : "WL8007",
+		source: "environment",
+		message: `${tool} could not run: ${message.split("\n")[0]}`
+	});
+}
+async function runEslint(cwd, files) {
+	const results = await new ESLint({
+		cwd,
+		errorOnUnmatchedPattern: false,
+		warnIgnored: false
+	}).lintFiles([...files]);
+	const problems = [];
+	for (const result of results) {
+		const file = path.relative(cwd, result.filePath).split(path.sep).join("/");
+		for (const message of result.messages) {
+			const error = message.severity === 2 || message.fatal === true;
+			problems.push(createProblem({
+				code: error ? "WL7201" : "WL7202",
+				source: "eslint",
+				severity: error ? "error" : "warning",
+				message: message.message,
+				file,
+				line: message.line || null,
+				column: message.column || null,
+				rule: message.ruleId ?? null
+			}));
+		}
+	}
+	return problems;
+}
+async function runOxlint(cwd, files) {
+	const runner = new OxlintRunner();
+	runner.initialize(cwd);
+	try {
+		return (await runner.checkFiles(files.map((file) => ({
+			path: path.join(cwd, file),
+			relativePath: file
+		})))).flatMap((result) => [...result.errors, ...result.warnings].map((message) => createProblem({
+			code: message.type === "error" ? "WL7201" : "WL7202",
+			source: "oxlint",
+			severity: message.type,
+			message: message.message,
+			file: message.relativePath,
+			line: message.lineNumber,
+			column: message.columnNumber,
+			rule: message.ruleId ?? null
+		})));
+	} finally {
+		await runner.shutdown();
+	}
+}
+/**
+* Lint `files` (project-relative) with the linters the app configures, the
+* same ones `warlock dev` runs in the background: ESLint when an
+* `eslint.config.*` exists, oxlint when an oxlint config exists and the app
+* has the `oxlint` package. A config without its tool is a `WL8002`
+* environment problem.
+*/
+async function runLint(cwd, files) {
+	const lintable = files.filter((file) => LINTABLE.test(file));
+	const problems = [];
+	const linters = [];
+	if (lintable.length === 0) return {
+		problems,
+		linters
+	};
+	if (hasEslint(cwd)) {
+		linters.push("eslint");
+		try {
+			problems.push(...await runEslint(cwd, lintable));
+		} catch (error) {
+			problems.push(toolFailure("ESLint", error));
+		}
+	}
+	if (hasOxlintConfig(cwd)) {
+		linters.push("oxlint");
+		if (!findOxlint(cwd)) problems.push(createProblem({
+			code: "WL8002",
+			source: "environment",
+			message: "An oxlint config exists but the oxlint package is not installed in the app."
+		}));
+		else try {
+			problems.push(...await runOxlint(cwd, lintable));
+		} catch (error) {
+			problems.push(toolFailure("oxlint", error));
+		}
+	}
+	return {
+		problems,
+		linters
+	};
+}
+
+//#endregion
+export { runLint };
+//# sourceMappingURL=lint-step.mjs.map

package/esm/tooling/check/lint-step.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint-step.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/lint-step.ts"],"sourcesContent":["import { ESLint } from \"eslint\";\nimport path from \"node:path\";\nimport { hasEslint } from \"../../dev-server/health-checker/default-health-checkers\";\nimport {\n  findOxlint,\n  hasOxlintConfig,\n  OxlintRunner,\n} from \"../../dev-server/health-checker/oxlint-runner\";\nimport { createProblem, type ToolingProblem } from \"../problem\";\n\n/** What the lint step found, and which linters ran. */\nexport type LintOutcome = {\n  problems: ToolingProblem[];\n  /** The linters that ran (`eslint`, `oxlint`); empty when the app configures none. */\n  linters: string[];\n};\n\nconst LINTABLE = /\\.[cm]?[jt]sx?$/i;\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** A missing package/plugin is the machine's install; anything else is the tool crashing. */\nfunction toolFailure(tool: string, error: unknown): ToolingProblem {\n  const message = errorMessage(error);\n  const missing = /cannot find (?:module|package)|ERR_MODULE_NOT_FOUND/i.test(message);\n\n  return createProblem({\n    code: missing ? \"WL8002\" : \"WL8007\",\n    source: \"environment\",\n    message: `${tool} could not run: ${message.split(\"\\n\")[0]}`,\n  });\n}\n\nasync function runEslint(cwd: string, files: readonly string[]): Promise<ToolingProblem[]> {\n  // The same flat-config lookup the dev server's ESLint checker uses.\n  const eslint = new ESLint({ cwd, errorOnUnmatchedPattern: false, warnIgnored: false });\n  const results = await eslint.lintFiles([...files]);\n  const problems: ToolingProblem[] = [];\n\n  for (const result of results) {\n    const file = path.relative(cwd, result.filePath).split(path.sep).join(\"/\");\n\n    for (const message of result.messages) {\n      const error = message.severity === 2 || message.fatal === true;\n\n      problems.push(\n        createProblem({\n          code: error ? \"WL7201\" : \"WL7202\",\n          source: \"eslint\",\n          severity: error ? \"error\" : \"warning\",\n          message: message.message,\n          file,\n          line: message.line || null,\n          column: message.column || null,\n          rule: message.ruleId ?? null,\n        }),\n      );\n    }\n  }\n\n  return problems;\n}\n\nasync function runOxlint(cwd: string, files: readonly string[]): Promise<ToolingProblem[]> {\n  const runner = new OxlintRunner();\n\n  runner.initialize(cwd);\n\n  try {\n    const results = await runner.checkFiles(\n      files.map((file) => ({ path: path.join(cwd, file), relativePath: file })),\n    );\n\n    return results.flatMap((result) =>\n      [...result.errors, ...result.warnings].map((message) =>\n        createProblem({\n          code: message.type === \"error\" ? \"WL7201\" : \"WL7202\",\n          source: \"oxlint\",\n          severity: message.type,\n          message: message.message,\n          file: message.relativePath,\n          line: message.lineNumber,\n          column: message.columnNumber,\n          rule: message.ruleId ?? null,\n        }),\n      ),\n    );\n  } finally {\n    await runner.shutdown();\n  }\n}\n\n/**\n * Lint `files` (project-relative) with the linters the app configures, the\n * same ones `warlock dev` runs in the background: ESLint when an\n * `eslint.config.*` exists, oxlint when an oxlint config exists and the app\n * has the `oxlint` package. A config without its tool is a `WL8002`\n * environment problem.\n */\nexport async function runLint(cwd: string, files: readonly string[]): Promise<LintOutcome> {\n  const lintable = files.filter((file) => LINTABLE.test(file));\n  const problems: ToolingProblem[] = [];\n  const linters: string[] = [];\n\n  // ESLint lints the whole directory when handed no pattern; nothing to lint\n  // means nothing to run.\n  if (lintable.length === 0) return { problems, linters };\n\n  if (hasEslint(cwd)) {\n    linters.push(\"eslint\");\n\n    try {\n      problems.push(...(await runEslint(cwd, lintable)));\n    } catch (error) {\n      problems.push(toolFailure(\"ESLint\", error));\n    }\n  }\n\n  if (hasOxlintConfig(cwd)) {\n    linters.push(\"oxlint\");\n\n    if (!findOxlint(cwd)) {\n      problems.push(\n        createProblem({\n          code: \"WL8002\",\n          source: \"environment\",\n          message: \"An oxlint config exists but the oxlint package is not installed in the app.\",\n        }),\n      );\n    } else {\n      try {\n        problems.push(...(await runOxlint(cwd, lintable)));\n      } catch (error) {\n        problems.push(toolFailure(\"oxlint\", error));\n      }\n    }\n  }\n\n  return { problems, linters };\n}\n"],"mappings":";;;;;;;AAiBA,MAAM,WAAW;AAEjB,SAAS,aAAa,OAAwB;CAC5C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;AAGA,SAAS,YAAY,MAAc,OAAgC;CACjE,MAAM,UAAU,aAAa,KAAK;CAClC,MAAM,UAAU,uDAAuD,KAAK,OAAO;CAEnF,OAAO,cAAc;EACnB,MAAM,UAAU,WAAW;EAC3B,QAAQ;EACR,SAAS,GAAG,KAAK,kBAAkB,QAAQ,MAAM,IAAI,CAAC,CAAC;CACzD,CAAC;AACH;AAEA,eAAe,UAAU,KAAa,OAAqD;CAGzF,MAAM,UAAU,MAAM,IADH,OAAO;EAAE;EAAK,yBAAyB;EAAO,aAAa;CAAM,CACzD,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;CACjD,MAAM,WAA6B,CAAC;CAEpC,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,OAAO,KAAK,SAAS,KAAK,OAAO,QAAQ,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;EAEzE,KAAK,MAAM,WAAW,OAAO,UAAU;GACrC,MAAM,QAAQ,QAAQ,aAAa,KAAK,QAAQ,UAAU;GAE1D,SAAS,KACP,cAAc;IACZ,MAAM,QAAQ,WAAW;IACzB,QAAQ;IACR,UAAU,QAAQ,UAAU;IAC5B,SAAS,QAAQ;IACjB;IACA,MAAM,QAAQ,QAAQ;IACtB,QAAQ,QAAQ,UAAU;IAC1B,MAAM,QAAQ,UAAU;GAC1B,CAAC,CACH;EACF;CACF;CAEA,OAAO;AACT;AAEA,eAAe,UAAU,KAAa,OAAqD;CACzF,MAAM,SAAS,IAAI,aAAa;CAEhC,OAAO,WAAW,GAAG;CAErB,IAAI;EAKF,QAAO,MAJe,OAAO,WAC3B,MAAM,KAAK,UAAU;GAAE,MAAM,KAAK,KAAK,KAAK,IAAI;GAAG,cAAc;EAAK,EAAE,CAC1E,EAEc,CAAC,SAAS,WACtB,CAAC,GAAG,OAAO,QAAQ,GAAG,OAAO,QAAQ,CAAC,CAAC,KAAK,YAC1C,cAAc;GACZ,MAAM,QAAQ,SAAS,UAAU,WAAW;GAC5C,QAAQ;GACR,UAAU,QAAQ;GAClB,SAAS,QAAQ;GACjB,MAAM,QAAQ;GACd,MAAM,QAAQ;GACd,QAAQ,QAAQ;GAChB,MAAM,QAAQ,UAAU;EAC1B,CAAC,CACH,CACF;CACF,UAAU;EACR,MAAM,OAAO,SAAS;CACxB;AACF;;;;;;;;AASA,eAAsB,QAAQ,KAAa,OAAgD;CACzF,MAAM,WAAW,MAAM,QAAQ,SAAS,SAAS,KAAK,IAAI,CAAC;CAC3D,MAAM,WAA6B,CAAC;CACpC,MAAM,UAAoB,CAAC;CAI3B,IAAI,SAAS,WAAW,GAAG,OAAO;EAAE;EAAU;CAAQ;CAEtD,IAAI,UAAU,GAAG,GAAG;EAClB,QAAQ,KAAK,QAAQ;EAErB,IAAI;GACF,SAAS,KAAK,GAAI,MAAM,UAAU,KAAK,QAAQ,CAAE;EACnD,SAAS,OAAO;GACd,SAAS,KAAK,YAAY,UAAU,KAAK,CAAC;EAC5C;CACF;CAEA,IAAI,gBAAgB,GAAG,GAAG;EACxB,QAAQ,KAAK,QAAQ;EAErB,IAAI,CAAC,WAAW,GAAG,GACjB,SAAS,KACP,cAAc;GACZ,MAAM;GACN,QAAQ;GACR,SAAS;EACX,CAAC,CACH;OAEA,IAAI;GACF,SAAS,KAAK,GAAI,MAAM,UAAU,KAAK,QAAQ,CAAE;EACnD,SAAS,OAAO;GACd,SAAS,KAAK,YAAY,UAAU,KAAK,CAAC;EAC5C;CAEJ;CAEA,OAAO;EAAE;EAAU;CAAQ;AAC7B"}

package/esm/tooling/check/request-input.mjs

@@ -0,0 +1,132 @@
+import { expressionOf, isCallExpression, isIdentifier, valueText } from "../syntax/ast.mjs";
+import { isMemberAccess, isValueReference, memberName, resolveInitializer, unwrap, walk } from "./source-ast.mjs";
+
+//#region ../../packages/core/src/tooling/check/request-input.ts
+/** Identifiers the source checks treat as the incoming request. */
+const REQUEST_NAMES = /* @__PURE__ */ new Set(["request", "req"]);
+/**
+* Request members that return client-controlled input. Reading any of them
+* (as a property or a call) yields data the client chose.
+*/
+const REQUEST_INPUT_MEMBERS = /* @__PURE__ */ new Set([
+	"all",
+	"allExceptParams",
+	"heavy",
+	"heavyExceptParams",
+	"only",
+	"pluck",
+	"except",
+	"input",
+	"get",
+	"email",
+	"string",
+	"int",
+	"bool",
+	"float",
+	"number",
+	"body",
+	"bodyInputs",
+	"params",
+	"query",
+	"validated",
+	"validatedExcept",
+	"idParam",
+	"headers",
+	"header",
+	"cookie",
+	"cookies",
+	"referer",
+	"referrer"
+]);
+/** Request members that return the whole (or most of the) request body. */
+const REQUEST_BODY_MEMBERS = /* @__PURE__ */ new Set([
+	"all",
+	"allExceptParams",
+	"heavy",
+	"heavyExceptParams",
+	"body",
+	"bodyInputs",
+	"validated",
+	"validatedExcept",
+	"only",
+	"except",
+	"pluck",
+	"headers",
+	"cookies"
+]);
+/**
+* When `node` is `<request>.<member>` or `<request>.<member>(…)` (also through
+* `request.query.next`-style chains), the `<member>`.
+*/
+function requestMemberAccess(node) {
+	let current = unwrap(node);
+	if (isCallExpression(current)) current = unwrap(expressionOf(current));
+	if (!isMemberAccess(current)) return void 0;
+	let member = current;
+	for (;;) {
+		const object = unwrap(expressionOf(member));
+		if (isIdentifier(object)) return REQUEST_NAMES.has(valueText(object)) ? memberName(member) : void 0;
+		if (isMemberAccess(object)) {
+			member = object;
+			continue;
+		}
+		if (isCallExpression(object)) {
+			const callee = unwrap(expressionOf(object));
+			if (!isMemberAccess(callee)) return void 0;
+			member = callee;
+			continue;
+		}
+		return;
+	}
+}
+/** Whether `node` reads client-controlled input from the request. */
+function isRequestInputExpression(node) {
+	const member = requestMemberAccess(node);
+	return member !== void 0 && REQUEST_INPUT_MEMBERS.has(member);
+}
+function isSanitizerCall(call, sanitizers) {
+	const callee = unwrap(expressionOf(call));
+	if (isIdentifier(callee)) return sanitizers.has(valueText(callee));
+	if (isMemberAccess(callee)) {
+		const name = memberName(callee);
+		return name !== void 0 && sanitizers.has(name);
+	}
+	return false;
+}
+/**
+* Whether an expression carries request input: it reads the request directly,
+* or names a local constant initialised from request input. A call to a
+* sanitizer launders its arguments.
+*/
+function containsRequestInput(node, options = {}, seen = /* @__PURE__ */ new Set()) {
+	let found = false;
+	const sanitizers = options.sanitizers ?? /* @__PURE__ */ new Set();
+	walk(node, (child) => {
+		if (found) return false;
+		if (isCallExpression(child) && isSanitizerCall(child, sanitizers)) return false;
+		if (isMemberAccess(child) || isCallExpression(child)) {
+			if (isRequestInputExpression(child) || options.isSource?.(child) === true) {
+				found = true;
+				return false;
+			}
+		}
+		if (isIdentifier(child) && !seen.has(child)) {
+			seen.add(child);
+			if (isValueReference(child)) {
+				const initializer = resolveInitializer(child);
+				if (initializer && !seen.has(initializer)) {
+					seen.add(initializer);
+					if (containsRequestInput(initializer, options, seen)) {
+						found = true;
+						return false;
+					}
+				}
+			}
+		}
+	});
+	return found;
+}
+
+//#endregion
+export { REQUEST_BODY_MEMBERS, REQUEST_NAMES, containsRequestInput, isRequestInputExpression, requestMemberAccess };
+//# sourceMappingURL=request-input.mjs.map

package/esm/tooling/check/request-input.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-input.mjs","names":["ast.isCallExpression","ast.expressionOf","ast.isIdentifier","ast.valueText"],"sources":["../../../../../../../../../packages/core/src/tooling/check/request-input.ts"],"sourcesContent":["import * as ast from \"../syntax/ast\";\nimport {\n  isMemberAccess,\n  isValueReference,\n  memberName,\n  resolveInitializer,\n  unwrap,\n  walk,\n} from \"./source-ast\";\n\n/** Identifiers the source checks treat as the incoming request. */\nexport const REQUEST_NAMES: ReadonlySet<string> = new Set([\"request\", \"req\"]);\n\n/**\n * Request members that return client-controlled input. Reading any of them\n * (as a property or a call) yields data the client chose.\n */\nconst REQUEST_INPUT_MEMBERS: ReadonlySet<string> = new Set([\n  \"all\",\n  \"allExceptParams\",\n  \"heavy\",\n  \"heavyExceptParams\",\n  \"only\",\n  \"pluck\",\n  \"except\",\n  \"input\",\n  \"get\",\n  \"email\",\n  \"string\",\n  \"int\",\n  \"bool\",\n  \"float\",\n  \"number\",\n  \"body\",\n  \"bodyInputs\",\n  \"params\",\n  \"query\",\n  \"validated\",\n  \"validatedExcept\",\n  \"idParam\",\n  \"headers\",\n  \"header\",\n  \"cookie\",\n  \"cookies\",\n  \"referer\",\n  \"referrer\",\n]);\n\n/** Request members that return the whole (or most of the) request body. */\nexport const REQUEST_BODY_MEMBERS: ReadonlySet<string> = new Set([\n  \"all\",\n  \"allExceptParams\",\n  \"heavy\",\n  \"heavyExceptParams\",\n  \"body\",\n  \"bodyInputs\",\n  \"validated\",\n  \"validatedExcept\",\n  \"only\",\n  \"except\",\n  \"pluck\",\n  \"headers\",\n  \"cookies\",\n]);\n\n/**\n * When `node` is `<request>.<member>` or `<request>.<member>(…)` (also through\n * `request.query.next`-style chains), the `<member>`.\n */\nexport function requestMemberAccess(node: ast.Node): string | undefined {\n  let current = unwrap(node);\n\n  if (ast.isCallExpression(current)) current = unwrap(ast.expressionOf(current));\n  if (!isMemberAccess(current)) return undefined;\n\n  // Walk down to the member read directly off the request: `request.query.next` → `query`.\n  let member = current;\n\n  for (;;) {\n    const object = unwrap(ast.expressionOf(member));\n\n    if (ast.isIdentifier(object)) {\n      return REQUEST_NAMES.has(ast.valueText(object)) ? memberName(member) : undefined;\n    }\n\n    if (isMemberAccess(object)) {\n      member = object;\n      continue;\n    }\n\n    if (ast.isCallExpression(object)) {\n      const callee = unwrap(ast.expressionOf(object));\n      if (!isMemberAccess(callee)) return undefined;\n      member = callee;\n      continue;\n    }\n\n    return undefined;\n  }\n}\n\n/** Whether `node` reads client-controlled input from the request. */\nexport function isRequestInputExpression(node: ast.Node): boolean {\n  const member = requestMemberAccess(node);\n\n  return member !== undefined && REQUEST_INPUT_MEMBERS.has(member);\n}\n\nexport type TaintOptions = {\n  /** Calls whose result is clean, whatever their arguments (matched by name). */\n  sanitizers?: ReadonlySet<string>;\n  /** Input sources besides the request (client query-string hooks, `location.search`). */\n  isSource?: (node: ast.Node) => boolean;\n};\n\nfunction isSanitizerCall(call: ast.CallExpression, sanitizers: ReadonlySet<string>): boolean {\n  const callee = unwrap(ast.expressionOf(call));\n\n  if (ast.isIdentifier(callee)) return sanitizers.has(ast.valueText(callee));\n\n  if (isMemberAccess(callee)) {\n    const name = memberName(callee);\n    return name !== undefined && sanitizers.has(name);\n  }\n\n  return false;\n}\n\n/**\n * Whether an expression carries request input: it reads the request directly,\n * or names a local constant initialised from request input. A call to a\n * sanitizer launders its arguments.\n */\nexport function containsRequestInput(\n  node: ast.Node,\n  options: TaintOptions = {},\n  seen: Set<ast.Node> = new Set(),\n): boolean {\n  let found = false;\n  const sanitizers = options.sanitizers ?? new Set<string>();\n\n  walk(node, (child) => {\n    if (found) return false;\n\n    if (ast.isCallExpression(child) && isSanitizerCall(child, sanitizers)) return false;\n\n    if (isMemberAccess(child) || ast.isCallExpression(child)) {\n      if (isRequestInputExpression(child) || options.isSource?.(child) === true) {\n        found = true;\n        return false;\n      }\n    }\n\n    if (ast.isIdentifier(child) && !seen.has(child)) {\n      seen.add(child);\n\n      if (isValueReference(child)) {\n        const initializer = resolveInitializer(child);\n\n        if (initializer && !seen.has(initializer)) {\n          seen.add(initializer);\n\n          if (containsRequestInput(initializer, options, seen)) {\n            found = true;\n            return false;\n          }\n        }\n      }\n    }\n\n    return undefined;\n  });\n\n  return found;\n}\n"],"mappings":";;;;;AAWA,MAAa,gCAAqC,IAAI,IAAI,CAAC,WAAW,KAAK,CAAC;;;;;AAM5E,MAAM,wCAA6C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAa,uCAA4C,IAAI,IAAI;CAC/D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;AAMD,SAAgB,oBAAoB,MAAoC;CACtE,IAAI,UAAU,OAAO,IAAI;CAEzB,IAAIA,iBAAqB,OAAO,GAAG,UAAU,OAAOC,aAAiB,OAAO,CAAC;CAC7E,IAAI,CAAC,eAAe,OAAO,GAAG,OAAO;CAGrC,IAAI,SAAS;CAEb,SAAS;EACP,MAAM,SAAS,OAAOA,aAAiB,MAAM,CAAC;EAE9C,IAAIC,aAAiB,MAAM,GACzB,OAAO,cAAc,IAAIC,UAAc,MAAM,CAAC,IAAI,WAAW,MAAM,IAAI;EAGzE,IAAI,eAAe,MAAM,GAAG;GAC1B,SAAS;GACT;EACF;EAEA,IAAIH,iBAAqB,MAAM,GAAG;GAChC,MAAM,SAAS,OAAOC,aAAiB,MAAM,CAAC;GAC9C,IAAI,CAAC,eAAe,MAAM,GAAG,OAAO;GACpC,SAAS;GACT;EACF;EAEA;CACF;AACF;;AAGA,SAAgB,yBAAyB,MAAyB;CAChE,MAAM,SAAS,oBAAoB,IAAI;CAEvC,OAAO,WAAW,UAAa,sBAAsB,IAAI,MAAM;AACjE;AASA,SAAS,gBAAgB,MAA0B,YAA0C;CAC3F,MAAM,SAAS,OAAOA,aAAiB,IAAI,CAAC;CAE5C,IAAIC,aAAiB,MAAM,GAAG,OAAO,WAAW,IAAIC,UAAc,MAAM,CAAC;CAEzE,IAAI,eAAe,MAAM,GAAG;EAC1B,MAAM,OAAO,WAAW,MAAM;EAC9B,OAAO,SAAS,UAAa,WAAW,IAAI,IAAI;CAClD;CAEA,OAAO;AACT;;;;;;AAOA,SAAgB,qBACd,MACA,UAAwB,CAAC,GACzB,uBAAsB,IAAI,IAAI,GACrB;CACT,IAAI,QAAQ;CACZ,MAAM,aAAa,QAAQ,8BAAc,IAAI,IAAY;CAEzD,KAAK,OAAO,UAAU;EACpB,IAAI,OAAO,OAAO;EAElB,IAAIH,iBAAqB,KAAK,KAAK,gBAAgB,OAAO,UAAU,GAAG,OAAO;EAE9E,IAAI,eAAe,KAAK,KAAKA,iBAAqB,KAAK,GACrD;OAAI,yBAAyB,KAAK,KAAK,QAAQ,WAAW,KAAK,MAAM,MAAM;IACzE,QAAQ;IACR,OAAO;GACT;;EAGF,IAAIE,aAAiB,KAAK,KAAK,CAAC,KAAK,IAAI,KAAK,GAAG;GAC/C,KAAK,IAAI,KAAK;GAEd,IAAI,iBAAiB,KAAK,GAAG;IAC3B,MAAM,cAAc,mBAAmB,KAAK;IAE5C,IAAI,eAAe,CAAC,KAAK,IAAI,WAAW,GAAG;KACzC,KAAK,IAAI,WAAW;KAEpB,IAAI,qBAAqB,aAAa,SAAS,IAAI,GAAG;MACpD,QAAQ;MACR,OAAO;KACT;IACF;GACF;EACF;CAGF,CAAC;CAED,OAAO;AACT"}

package/esm/tooling/check/run-check.d.mts

@@ -0,0 +1,43 @@
+import { GitRunner } from "./changed-files.mjs";
+import { CheckReport, CheckStepName } from "./check-report.types.mjs";
+import { TypecheckOptions, TypecheckResult } from "../typecheck/run-typecheck.mjs";
+import { VitestRunner } from "./tests-step.mjs";
+//#region ../../packages/core/src/tooling/check/run-check.d.ts
+/** Runs the typecheck step. The CLI swaps in a child process so a heap overflow cannot end `check`. */
+export type TypecheckRunner = (options: TypecheckOptions) => Promise<TypecheckResult> | TypecheckResult;
+/** Inputs of {@link runCheck}. */
+export type CheckOptions = {
+  /** Project root. Default: `process.cwd()`. */
+  cwd?: string;
+  /** Limit every step to the files changed against `base` (default HEAD) plus untracked files. */
+  changed?: boolean;
+  /** Compare with `git merge-base <base> HEAD` instead of HEAD. Implies `changed`. */
+  base?: string;
+  /** Steps not to run. */
+  skip?: readonly CheckStepName[];
+  /** tsconfig path, relative to `cwd`. Default: `tsconfig.json`. */
+  project?: string;
+  /** How git is run. */
+  git?: GitRunner;
+  /** How the typecheck runs. Default: in this process. */
+  typecheck?: TypecheckRunner;
+  /** How vitest runs. */
+  vitest?: VitestRunner;
+  /** Where the app's vitest CLI is. Default: resolved from the app root. */
+  vitestBinary?: string | null;
+  /** The Node.js version to check. Default: the running one. */
+  nodeVersion?: string;
+};
+/**
+ * The single verify command: typecheck, lint, the tests affected by the
+ * change, and the framework's convention checks, as one report with one entry
+ * per problem and an exit code that tells "your code" (1) from "this machine"
+ * (2).
+ *
+ * Every step runs even when an earlier one failed, so one run lists every
+ * problem. The only exception: with `changed`, a git failure leaves no file
+ * list, and every step after `environment` is `blocked`.
+ */
+export declare function runCheck(options?: CheckOptions): Promise<CheckReport>;
+//#endregion
+//# sourceMappingURL=run-check.d.mts.map

package/esm/tooling/check/run-check.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-check.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/run-check.ts"],"mappings":";;;;;;YA8BY,mBACV,SAAS,qBACN,QAAQ,mBAAmB;;YAGpB;;EAEV;;EAEA;;EAEA;;EAEA,gBAAgB;;EAEhB;;EAEA,MAAM;;EAEN,YAAY;;EAEZ,SAAS;;EAET;;EAEA;;;;;;;;;;;;wBA4BoB,SAAS,UAAS,eAAoB,QAAQ"}

package/esm/tooling/check/run-check.mjs

@@ -0,0 +1,192 @@
+import { CHECK_STEPS, checkExitCode } from "./check-report.types.mjs";
+import { createProblem } from "../problem.mjs";
+import { runTypecheck } from "../typecheck/run-typecheck.mjs";
+import { listChangedFiles } from "./changed-files.mjs";
+import { runConventions } from "./conventions-step.mjs";
+import { checkNodeVersion } from "./environment-step.mjs";
+import { runLint } from "./lint-step.mjs";
+import { listSourceFiles, listTestFiles } from "./source-files.mjs";
+import { findVitest, parseVitestReport, runVitest, vitestArguments, vitestRunFailure } from "./tests-step.mjs";
+import path from "node:path";
+
+//#region ../../packages/core/src/tooling/check/run-check.ts
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function statusOf(problems) {
+	const errors = problems.filter((problem) => problem.severity === "error");
+	if (errors.some((problem) => problem.category === "environment")) return "blocked";
+	return errors.length > 0 ? "failed" : "passed";
+}
+/**
+* The single verify command: typecheck, lint, the tests affected by the
+* change, and the framework's convention checks, as one report with one entry
+* per problem and an exit code that tells "your code" (1) from "this machine"
+* (2).
+*
+* Every step runs even when an earlier one failed, so one run lists every
+* problem. The only exception: with `changed`, a git failure leaves no file
+* list, and every step after `environment` is `blocked`.
+*/
+async function runCheck(options = {}) {
+	const cwd = path.resolve(options.cwd ?? process.cwd());
+	const changed = options.changed === true || options.base !== void 0;
+	const skip = new Set(options.skip ?? []);
+	const steps = [];
+	const problems = [];
+	let files = null;
+	let filesBlocked = false;
+	const run = async (name, body) => {
+		const startedAt = Date.now();
+		if (skip.has(name)) {
+			steps.push({
+				name,
+				status: "skipped",
+				durationMs: 0,
+				detail: "skipped with --skip"
+			});
+			return;
+		}
+		if (filesBlocked && name !== "environment") {
+			steps.push({
+				name,
+				status: "blocked",
+				durationMs: 0,
+				detail: "the changed files could not be listed"
+			});
+			return;
+		}
+		let outcome;
+		try {
+			outcome = await body();
+		} catch (error) {
+			outcome = {
+				detail: null,
+				problems: [createProblem({
+					code: "WL8007",
+					source: "environment",
+					message: `The ${name} step crashed: ${errorMessage(error)}`
+				})]
+			};
+		}
+		problems.push(...outcome.problems);
+		steps.push({
+			name,
+			status: outcome.status ?? statusOf(outcome.problems),
+			durationMs: Date.now() - startedAt,
+			detail: outcome.detail
+		});
+	};
+	await run("environment", async () => {
+		const found = checkNodeVersion(cwd, options.nodeVersion);
+		if (changed) {
+			const listed = await listChangedFiles({
+				cwd,
+				base: options.base,
+				git: options.git
+			});
+			if ("problem" in listed) {
+				filesBlocked = true;
+				found.push(listed.problem);
+			} else files = listed.files;
+		}
+		return {
+			detail: `Node ${options.nodeVersion ?? process.versions.node}${files ? `, ${files.length} changed file(s)` : ""}`,
+			problems: found
+		};
+	});
+	const targets = async () => files ?? await listSourceFiles(cwd);
+	await run("typecheck", async () => {
+		if (files !== null && files.length === 0) return {
+			status: "skipped",
+			detail: "no changed files",
+			problems: []
+		};
+		const result = await (options.typecheck ?? runTypecheck)({
+			cwd,
+			project: options.project,
+			...files !== null ? { files } : {}
+		});
+		return {
+			detail: `${result.checkedFiles} file(s) checked in ${result.durationMs}ms`,
+			problems: result.problems
+		};
+	});
+	await run("lint", async () => {
+		const lintFiles = await targets();
+		if (lintFiles.length === 0) return {
+			status: "skipped",
+			detail: "no files to lint",
+			problems: []
+		};
+		const { linters, problems: found } = await runLint(cwd, lintFiles);
+		if (linters.length === 0) return {
+			status: "skipped",
+			detail: "no ESLint or oxlint config",
+			problems: []
+		};
+		return {
+			detail: `${linters.join(" + ")} over ${lintFiles.length} file(s)`,
+			problems: found
+		};
+	});
+	await run("tests", async () => {
+		if (files !== null && files.length === 0) return {
+			status: "skipped",
+			detail: "no changed files",
+			problems: []
+		};
+		const binary = options.vitestBinary === void 0 ? findVitest(cwd) : options.vitestBinary;
+		if (!binary) {
+			if ((await listTestFiles(cwd)).length === 0) return {
+				status: "skipped",
+				detail: "no test files",
+				problems: []
+			};
+			return {
+				detail: null,
+				problems: [createProblem({
+					code: "WL8002",
+					source: "environment",
+					message: "The project has test files but vitest is not installed in the app."
+				})]
+			};
+		}
+		const outcome = await (options.vitest ?? runVitest)(binary, vitestArguments(files), cwd);
+		const found = outcome.report === void 0 ? vitestRunFailure(outcome) : parseVitestReport(outcome.report, cwd);
+		const total = typeof outcome.report === "object" && outcome.report !== null ? Reflect.get(outcome.report, "numTotalTests") : void 0;
+		return {
+			detail: typeof total === "number" ? `${total} test(s) ran` : null,
+			problems: found
+		};
+	});
+	await run("conventions", async () => {
+		const conventionFiles = await targets();
+		return {
+			detail: `${conventionFiles.length} file(s) checked`,
+			problems: runConventions(cwd, conventionFiles, options.project)
+		};
+	});
+	steps.sort((first, second) => CHECK_STEPS.indexOf(first.name) - CHECK_STEPS.indexOf(second.name));
+	const exitCode = checkExitCode(problems);
+	const errors = problems.filter((problem) => problem.severity === "error");
+	return {
+		schemaVersion: 1,
+		ok: exitCode === 0,
+		exitCode,
+		changed,
+		files,
+		steps,
+		problems,
+		summary: {
+			errors: errors.length,
+			warnings: problems.length - errors.length,
+			code: errors.filter((problem) => problem.category === "code").length,
+			environment: errors.filter((problem) => problem.category === "environment").length
+		}
+	};
+}
+
+//#endregion
+export { runCheck };
+//# sourceMappingURL=run-check.mjs.map