@warlock.js/core 5.31.0 → 5.32.0

package/esm/tooling/check/conventions-step.d.mts

@@ -1,8 +1,7 @@
 import { ToolingProblem } from "../problem.mjs";
-
 //#region ../../packages/core/src/tooling/check/conventions-step.d.ts
 /** Matches a project-relative path of a file the framework loads by itself. */
-declare function isAutoLoadedFile(relativePath: string): boolean;
+export declare function isAutoLoadedFile(relativePath: string): boolean;
 /**
  * The convention problems in one source file, in source order:
  *
@@ -21,14 +20,13 @@ declare function isAutoLoadedFile(relativePath: string): boolean;
  * A `// warlock-check-ignore WL9006` comment on the problem's line or the line
  * above silences that code there; without codes it silences every one.
  */
-declare function checkFileConventions(relativePath: string, source: string, cwd: string): ToolingProblem[];
+export declare function checkFileConventions(relativePath: string, source: string, cwd: string): ToolingProblem[];
 /** `WL9004` when the project tsconfig turns on legacy decorators. */
-declare function checkTsconfigConventions(cwd: string, project?: string): ToolingProblem[];
+export declare function checkTsconfigConventions(cwd: string, project?: string): ToolingProblem[];
 /**
  * Run every convention check over `files` (project-relative) plus the
  * project tsconfig.
  */
-declare function runConventions(cwd: string, files: readonly string[], project?: string): ToolingProblem[];
+export declare function runConventions(cwd: string, files: readonly string[], project?: string): ToolingProblem[];
 //#endregion
-export { checkFileConventions, checkTsconfigConventions, isAutoLoadedFile, runConventions };
 //# sourceMappingURL=conventions-step.d.mts.map

package/esm/tooling/check/conventions-step.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"conventions-step.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/conventions-step.ts"],"mappings":";;;;iBAegB,gBAAA,CAAiB,YAAoB;AAArD;;;;AAAqD;AAwLrD;;;;;;;;;AAIiB;AAmBjB;;;AA/MA,iBAwLgB,oBAAA,CACd,YAAA,UACA,MAAA,UACA,GAAA,WACC,cAAc;;iBAmBD,wBAAA,CAAyB,GAAA,UAAa,OAAA,YAA4B,cAAc;;;AAAA;AAyChG;iBAAgB,cAAA,CACd,GAAA,UACA,KAAA,qBACA,OAAA,YACC,cAAc"}
+{"version":3,"file":"conventions-step.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/conventions-step.ts"],"mappings":";;;wBAiBgB,iBAAiB;;;;;;;;;;;;;;;;;;;wBAiKjB,qBACd,sBACA,gBACA,cACC;;wBAmBa,yBAAyB,aAAa,mBAA4B;;;;;wBAyClE,eACd,aACA,0BACA,mBACC"}

package/esm/tooling/check/conventions-step.mjs

@@ -1,10 +1,12 @@
+import { parseSourceFile } from "../syntax/ast.mjs";
+import { importSpecifiers } from "../syntax/imports.mjs";
 import { createProblem } from "../problem.mjs";
 import { positionOf } from "./source-ast.mjs";
 import { codeStyleFindings } from "./code-style-conventions.mjs";
 import { securityFindings } from "./security-conventions.mjs";
 import path from "node:path";
 import { existsSync, readFileSync } from "node:fs";
-import ts from "typescript";
+import { parse } from "jsonc-parser";
 
 //#region ../../packages/core/src/tooling/check/conventions-step.ts
 /** Extensions tried when resolving an extension-less import. */
@@ -43,20 +45,7 @@ function resolveSpecifier(specifier, importer, cwd) {
 }
 /** Every module specifier a source file imports, with its position. */
 function importsOf(sourceFile) {
-	const found = [];
-	const visit = (node) => {
-		if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) found.push({
-			specifier: node.moduleSpecifier.text,
-			node: node.moduleSpecifier
-		});
-		else if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword && node.arguments[0] && ts.isStringLiteral(node.arguments[0])) found.push({
-			specifier: node.arguments[0].text,
-			node: node.arguments[0]
-		});
-		ts.forEachChild(node, visit);
-	};
-	visit(sourceFile);
-	return found;
+	return importSpecifiers(sourceFile.fileName, sourceFile.text);
 }
 /** `// warlock-check-ignore [WLxxxx …]` on a problem's line or the line above it. */
 const IGNORE_COMMENT = /\/[/*]\s*warlock-check-ignore\b(.*)/;
@@ -135,7 +124,7 @@ function findingProblem(sourceFile, relativePath, finding) {
 * above silences that code there; without codes it silences every one.
 */
 function checkFileConventions(relativePath, source, cwd) {
-	const sourceFile = ts.createSourceFile(relativePath, source, ts.ScriptTarget.Latest, true);
+	const sourceFile = parseSourceFile(relativePath, source);
 	const problems = [...importProblems(sourceFile, relativePath, cwd), ...[...securityFindings(sourceFile), ...codeStyleFindings(sourceFile)].map((finding) => findingProblem(sourceFile, relativePath, finding))];
 	const lines = source.split(/\r?\n/);
 	return problems.filter((problem) => problem.line === null || !isIgnored(lines, problem.line, problem.code)).sort((first, second) => (first.line ?? 0) - (second.line ?? 0) || (first.column ?? 0) - (second.column ?? 0));
@@ -145,8 +134,8 @@ function checkTsconfigConventions(cwd, project = "tsconfig.json") {
 	const file = path.join(cwd, project);
 	if (!existsSync(file)) return [];
 	const text = readFileSync(file, "utf8");
-	const read = ts.parseConfigFileTextToJson(file, text);
-	const options = typeof read.config === "object" && read.config !== null ? Reflect.get(read.config, "compilerOptions") : void 0;
+	const config = parse(text);
+	const options = typeof config === "object" && config !== null ? Reflect.get(config, "compilerOptions") : void 0;
 	if (typeof options !== "object" || options === null || Reflect.get(options, "experimentalDecorators") !== true) return [];
 	const index = text.indexOf("experimentalDecorators");
 	const before = index === -1 ? "" : text.slice(0, index);

package/esm/tooling/check/conventions-step.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"conventions-step.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/conventions-step.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport ts from \"typescript\";\nimport { createProblem, type ToolingProblem } from \"../problem\";\nimport { codeStyleFindings } from \"./code-style-conventions\";\nimport { securityFindings } from \"./security-conventions\";\nimport { positionOf, type SourceFinding } from \"./source-ast\";\n\n/** Extensions tried when resolving an extension-less import. */\nconst RESOLVE_EXTENSIONS = [\".ts\", \".tsx\", \".js\", \".jsx\", \"/index.ts\", \"/index.tsx\"];\n\n/** Test files may import anything on purpose. */\nconst TEST_FILE = /\\.(?:test|spec)\\.[cm]?[jt]sx?$/i;\n\n/** Matches a project-relative path of a file the framework loads by itself. */\nexport function isAutoLoadedFile(relativePath: string): boolean {\n  return (\n    /^src\\/app\\/main\\.tsx?$/.test(relativePath) ||\n    /^src\\/app\\/[^/]+\\/(?:routes|main|worker)\\.tsx?$/.test(relativePath) ||\n    /^src\\/app\\/.+\\/events\\/[^/]+\\.tsx?$/.test(relativePath)\n  );\n}\n\n/** The module folder (`src/app/<module>`) a project-relative path lives in, if any. */\nfunction moduleOf(relativePath: string): string | undefined {\n  return /^src\\/app\\/([^/]+)\\//.exec(relativePath)?.[1];\n}\n\nfunction toPosix(file: string): string {\n  return file.split(path.sep).join(\"/\");\n}\n\n/** Resolve a relative or `app/...` specifier to a project-relative file, if it exists. */\nfunction resolveSpecifier(specifier: string, importer: string, cwd: string): string | undefined {\n  let base: string;\n\n  if (specifier.startsWith(\".\")) {\n    base = path.resolve(path.dirname(path.join(cwd, importer)), specifier);\n  } else if (specifier.startsWith(\"app/\")) {\n    base = path.join(cwd, \"src\", specifier);\n  } else {\n    return undefined;\n  }\n\n  const candidates = [base, ...RESOLVE_EXTENSIONS.map((extension) => `${base}${extension}`)];\n  const withoutJs = base.replace(/\\.jsx?$/, \"\");\n\n  if (withoutJs !== base) {\n    candidates.push(...RESOLVE_EXTENSIONS.map((extension) => `${withoutJs}${extension}`));\n  }\n\n  const found = candidates.find(\n    (candidate) => existsSync(candidate) && path.extname(candidate) !== \"\",\n  );\n\n  return found ? toPosix(path.relative(cwd, found)) : undefined;\n}\n\n/** Every module specifier a source file imports, with its position. */\nfunction importsOf(sourceFile: ts.SourceFile): { specifier: string; node: ts.Node }[] {\n  const found: { specifier: string; node: ts.Node }[] = [];\n\n  const visit = (node: ts.Node) => {\n    if (\n      (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) &&\n      node.moduleSpecifier &&\n      ts.isStringLiteral(node.moduleSpecifier)\n    ) {\n      found.push({ specifier: node.moduleSpecifier.text, node: node.moduleSpecifier });\n    } else if (\n      ts.isCallExpression(node) &&\n      node.expression.kind === ts.SyntaxKind.ImportKeyword &&\n      node.arguments[0] &&\n      ts.isStringLiteral(node.arguments[0])\n    ) {\n      found.push({ specifier: node.arguments[0].text, node: node.arguments[0] });\n    }\n\n    ts.forEachChild(node, visit);\n  };\n\n  visit(sourceFile);\n\n  return found;\n}\n\n/** `// warlock-check-ignore [WLxxxx …]` on a problem's line or the line above it. */\nconst IGNORE_COMMENT = /\\/[/*]\\s*warlock-check-ignore\\b(.*)/;\n\n/** Whether an ignore comment on `line` (1-based) or the line before covers `code`. */\nfunction isIgnored(lines: readonly string[], line: number, code: string): boolean {\n  for (const text of [lines[line - 1], lines[line - 2]]) {\n    const match = text === undefined ? null : IGNORE_COMMENT.exec(text);\n\n    if (!match) continue;\n\n    const codes = match[1]?.match(/WL\\d{4}/g);\n\n    if (!codes || codes.includes(code)) return true;\n  }\n\n  return false;\n}\n\n/** The import conventions (`WL9001`–`WL9003`) of one parsed file. */\nfunction importProblems(\n  sourceFile: ts.SourceFile,\n  relativePath: string,\n  cwd: string,\n): ToolingProblem[] {\n  const problems: ToolingProblem[] = [];\n  const importerModule = moduleOf(relativePath);\n\n  for (const { specifier, node } of importsOf(sourceFile)) {\n    const at = { file: relativePath, ...positionOf(sourceFile, node) };\n\n    if (specifier.startsWith(\".\") && /\\.jsx?$/.test(specifier)) {\n      problems.push(\n        createProblem({\n          code: \"WL9002\",\n          source: \"convention\",\n          message: `Import \"${specifier}\" ends in a .js extension.`,\n          ...at,\n        }),\n      );\n    }\n\n    const target = resolveSpecifier(specifier, relativePath, cwd);\n\n    if (!target) continue;\n\n    if (!TEST_FILE.test(relativePath) && isAutoLoadedFile(target)) {\n      problems.push(\n        createProblem({\n          code: \"WL9001\",\n          source: \"convention\",\n          message: `\"${specifier}\" imports ${target}, which the framework loads by itself.`,\n          ...at,\n        }),\n      );\n    }\n\n    const targetModule = moduleOf(target);\n\n    if (\n      specifier.startsWith(\".\") &&\n      importerModule !== undefined &&\n      targetModule !== undefined &&\n      importerModule !== targetModule\n    ) {\n      const alias = `app/${target.replace(/^src\\/app\\//, \"\").replace(/\\.[cm]?[jt]sx?$/, \"\")}`;\n\n      problems.push(\n        createProblem({\n          code: \"WL9003\",\n          source: \"convention\",\n          message: `\"${specifier}\" reaches from module \"${importerModule}\" into \"${targetModule}\"; import \"${alias}\" instead.`,\n          ...at,\n        }),\n      );\n    }\n  }\n\n  return problems;\n}\n\nfunction findingProblem(\n  sourceFile: ts.SourceFile,\n  relativePath: string,\n  finding: SourceFinding,\n): ToolingProblem {\n  return createProblem({\n    code: finding.code,\n    source: \"convention\",\n    severity: finding.severity ?? \"error\",\n    message: finding.message,\n    file: relativePath,\n    ...positionOf(sourceFile, finding.node),\n  });\n}\n\n/**\n * The convention problems in one source file, in source order:\n *\n * - `WL9001` an import of a file the framework loads by itself (`routes.ts`,\n *   `main.ts`, `worker.ts`, `events/*`) — importing it registers it twice;\n * - `WL9002` a relative import ending in `.js`;\n * - `WL9003` a relative import from one `src/app/<module>` into another, which\n *   should use the `app/<module>/...` alias;\n * - `WL9005`–`WL9009` the security conventions (see `securityFindings`):\n *   `request.all()` into a query or service, a mutating route with no guard\n *   and no `public: true`, a redirect target from request input, sensitive\n *   values in logs, unbounded regexes on request input;\n * - `WL9010`–`WL9012` warnings: `await log.*()`, a second controller in one\n *   file, a `kind` discriminator.\n *\n * A `// warlock-check-ignore WL9006` comment on the problem's line or the line\n * above silences that code there; without codes it silences every one.\n */\nexport function checkFileConventions(\n  relativePath: string,\n  source: string,\n  cwd: string,\n): ToolingProblem[] {\n  const sourceFile = ts.createSourceFile(relativePath, source, ts.ScriptTarget.Latest, true);\n  const problems = [\n    ...importProblems(sourceFile, relativePath, cwd),\n    ...[...securityFindings(sourceFile), ...codeStyleFindings(sourceFile)].map((finding) =>\n      findingProblem(sourceFile, relativePath, finding),\n    ),\n  ];\n  const lines = source.split(/\\r?\\n/);\n\n  return problems\n    .filter((problem) => problem.line === null || !isIgnored(lines, problem.line, problem.code))\n    .sort(\n      (first, second) =>\n        (first.line ?? 0) - (second.line ?? 0) || (first.column ?? 0) - (second.column ?? 0),\n    );\n}\n\n/** `WL9004` when the project tsconfig turns on legacy decorators. */\nexport function checkTsconfigConventions(cwd: string, project = \"tsconfig.json\"): ToolingProblem[] {\n  const file = path.join(cwd, project);\n\n  if (!existsSync(file)) return [];\n\n  const text = readFileSync(file, \"utf8\");\n  const read = ts.parseConfigFileTextToJson(file, text);\n  const options: unknown =\n    typeof read.config === \"object\" && read.config !== null\n      ? Reflect.get(read.config, \"compilerOptions\")\n      : undefined;\n\n  if (\n    typeof options !== \"object\" ||\n    options === null ||\n    Reflect.get(options, \"experimentalDecorators\") !== true\n  ) {\n    return [];\n  }\n\n  const index = text.indexOf(\"experimentalDecorators\");\n  const before = index === -1 ? \"\" : text.slice(0, index);\n  const line = index === -1 ? null : before.split(\"\\n\").length;\n  const column = index === -1 ? null : index - before.lastIndexOf(\"\\n\");\n\n  return [\n    createProblem({\n      code: \"WL9004\",\n      source: \"convention\",\n      message: '\"experimentalDecorators\": true switches TypeScript to legacy decorators.',\n      file: toPosix(project),\n      line,\n      column,\n    }),\n  ];\n}\n\n/**\n * Run every convention check over `files` (project-relative) plus the\n * project tsconfig.\n */\nexport function runConventions(\n  cwd: string,\n  files: readonly string[],\n  project?: string,\n): ToolingProblem[] {\n  const problems = checkTsconfigConventions(cwd, project);\n\n  for (const file of files) {\n    let source: string;\n\n    try {\n      source = readFileSync(path.join(cwd, file), \"utf8\");\n    } catch {\n      continue;\n    }\n\n    problems.push(...checkFileConventions(file, source, cwd));\n  }\n\n  return problems;\n}\n"],"mappings":";;;;;;;;;;AASA,MAAM,qBAAqB;CAAC;CAAO;CAAQ;CAAO;CAAQ;CAAa;AAAY;;AAGnF,MAAM,YAAY;;AAGlB,SAAgB,iBAAiB,cAA+B;CAC9D,OACE,yBAAyB,KAAK,YAAY,KAC1C,kDAAkD,KAAK,YAAY,KACnE,sCAAsC,KAAK,YAAY;AAE3D;;AAGA,SAAS,SAAS,cAA0C;CAC1D,OAAO,uBAAuB,KAAK,YAAY,CAAC,GAAG;AACrD;AAEA,SAAS,QAAQ,MAAsB;CACrC,OAAO,KAAK,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;AACtC;;AAGA,SAAS,iBAAiB,WAAmB,UAAkB,KAAiC;CAC9F,IAAI;CAEJ,IAAI,UAAU,WAAW,GAAG,GAC1B,OAAO,KAAK,QAAQ,KAAK,QAAQ,KAAK,KAAK,KAAK,QAAQ,CAAC,GAAG,SAAS;MAChE,IAAI,UAAU,WAAW,MAAM,GACpC,OAAO,KAAK,KAAK,KAAK,OAAO,SAAS;MAEtC;CAGF,MAAM,aAAa,CAAC,MAAM,GAAG,mBAAmB,KAAK,cAAc,GAAG,OAAO,WAAW,CAAC;CACzF,MAAM,YAAY,KAAK,QAAQ,WAAW,EAAE;CAE5C,IAAI,cAAc,MAChB,WAAW,KAAK,GAAG,mBAAmB,KAAK,cAAc,GAAG,YAAY,WAAW,CAAC;CAGtF,MAAM,QAAQ,WAAW,MACtB,cAAc,WAAW,SAAS,KAAK,KAAK,QAAQ,SAAS,MAAM,EACtE;CAEA,OAAO,QAAQ,QAAQ,KAAK,SAAS,KAAK,KAAK,CAAC,IAAI;AACtD;;AAGA,SAAS,UAAU,YAAmE;CACpF,MAAM,QAAgD,CAAC;CAEvD,MAAM,SAAS,SAAkB;EAC/B,KACG,GAAG,oBAAoB,IAAI,KAAK,GAAG,oBAAoB,IAAI,MAC5D,KAAK,mBACL,GAAG,gBAAgB,KAAK,eAAe,GAEvC,MAAM,KAAK;GAAE,WAAW,KAAK,gBAAgB;GAAM,MAAM,KAAK;EAAgB,CAAC;OAC1E,IACL,GAAG,iBAAiB,IAAI,KACxB,KAAK,WAAW,SAAS,GAAG,WAAW,iBACvC,KAAK,UAAU,MACf,GAAG,gBAAgB,KAAK,UAAU,EAAE,GAEpC,MAAM,KAAK;GAAE,WAAW,KAAK,UAAU,EAAE,CAAC;GAAM,MAAM,KAAK,UAAU;EAAG,CAAC;EAG3E,GAAG,aAAa,MAAM,KAAK;CAC7B;CAEA,MAAM,UAAU;CAEhB,OAAO;AACT;;AAGA,MAAM,iBAAiB;;AAGvB,SAAS,UAAU,OAA0B,MAAc,MAAuB;CAChF,KAAK,MAAM,QAAQ,CAAC,MAAM,OAAO,IAAI,MAAM,OAAO,EAAE,GAAG;EACrD,MAAM,QAAQ,SAAS,SAAY,OAAO,eAAe,KAAK,IAAI;EAElE,IAAI,CAAC,OAAO;EAEZ,MAAM,QAAQ,MAAM,EAAE,EAAE,MAAM,UAAU;EAExC,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC7C;CAEA,OAAO;AACT;;AAGA,SAAS,eACP,YACA,cACA,KACkB;CAClB,MAAM,WAA6B,CAAC;CACpC,MAAM,iBAAiB,SAAS,YAAY;CAE5C,KAAK,MAAM,EAAE,WAAW,UAAU,UAAU,UAAU,GAAG;EACvD,MAAM,KAAK;GAAE,MAAM;GAAc,GAAG,WAAW,YAAY,IAAI;EAAE;EAEjE,IAAI,UAAU,WAAW,GAAG,KAAK,UAAU,KAAK,SAAS,GACvD,SAAS,KACP,cAAc;GACZ,MAAM;GACN,QAAQ;GACR,SAAS,WAAW,UAAU;GAC9B,GAAG;EACL,CAAC,CACH;EAGF,MAAM,SAAS,iBAAiB,WAAW,cAAc,GAAG;EAE5D,IAAI,CAAC,QAAQ;EAEb,IAAI,CAAC,UAAU,KAAK,YAAY,KAAK,iBAAiB,MAAM,GAC1D,SAAS,KACP,cAAc;GACZ,MAAM;GACN,QAAQ;GACR,SAAS,IAAI,UAAU,YAAY,OAAO;GAC1C,GAAG;EACL,CAAC,CACH;EAGF,MAAM,eAAe,SAAS,MAAM;EAEpC,IACE,UAAU,WAAW,GAAG,KACxB,mBAAmB,UACnB,iBAAiB,UACjB,mBAAmB,cACnB;GACA,MAAM,QAAQ,OAAO,OAAO,QAAQ,eAAe,EAAE,CAAC,CAAC,QAAQ,mBAAmB,EAAE;GAEpF,SAAS,KACP,cAAc;IACZ,MAAM;IACN,QAAQ;IACR,SAAS,IAAI,UAAU,yBAAyB,eAAe,UAAU,aAAa,aAAa,MAAM;IACzG,GAAG;GACL,CAAC,CACH;EACF;CACF;CAEA,OAAO;AACT;AAEA,SAAS,eACP,YACA,cACA,SACgB;CAChB,OAAO,cAAc;EACnB,MAAM,QAAQ;EACd,QAAQ;EACR,UAAU,QAAQ,YAAY;EAC9B,SAAS,QAAQ;EACjB,MAAM;EACN,GAAG,WAAW,YAAY,QAAQ,IAAI;CACxC,CAAC;AACH;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,qBACd,cACA,QACA,KACkB;CAClB,MAAM,aAAa,GAAG,iBAAiB,cAAc,QAAQ,GAAG,aAAa,QAAQ,IAAI;CACzF,MAAM,WAAW,CACf,GAAG,eAAe,YAAY,cAAc,GAAG,GAC/C,GAAG,CAAC,GAAG,iBAAiB,UAAU,GAAG,GAAG,kBAAkB,UAAU,CAAC,CAAC,CAAC,KAAK,YAC1E,eAAe,YAAY,cAAc,OAAO,CAClD,CACF;CACA,MAAM,QAAQ,OAAO,MAAM,OAAO;CAElC,OAAO,SACJ,QAAQ,YAAY,QAAQ,SAAS,QAAQ,CAAC,UAAU,OAAO,QAAQ,MAAM,QAAQ,IAAI,CAAC,CAAC,CAC3F,MACE,OAAO,YACL,MAAM,QAAQ,MAAM,OAAO,QAAQ,OAAO,MAAM,UAAU,MAAM,OAAO,UAAU,EACtF;AACJ;;AAGA,SAAgB,yBAAyB,KAAa,UAAU,iBAAmC;CACjG,MAAM,OAAO,KAAK,KAAK,KAAK,OAAO;CAEnC,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO,CAAC;CAE/B,MAAM,OAAO,aAAa,MAAM,MAAM;CACtC,MAAM,OAAO,GAAG,0BAA0B,MAAM,IAAI;CACpD,MAAM,UACJ,OAAO,KAAK,WAAW,YAAY,KAAK,WAAW,OAC/C,QAAQ,IAAI,KAAK,QAAQ,iBAAiB,IAC1C;CAEN,IACE,OAAO,YAAY,YACnB,YAAY,QACZ,QAAQ,IAAI,SAAS,wBAAwB,MAAM,MAEnD,OAAO,CAAC;CAGV,MAAM,QAAQ,KAAK,QAAQ,wBAAwB;CACnD,MAAM,SAAS,UAAU,KAAK,KAAK,KAAK,MAAM,GAAG,KAAK;CACtD,MAAM,OAAO,UAAU,KAAK,OAAO,OAAO,MAAM,IAAI,CAAC,CAAC;CACtD,MAAM,SAAS,UAAU,KAAK,OAAO,QAAQ,OAAO,YAAY,IAAI;CAEpE,OAAO,CACL,cAAc;EACZ,MAAM;EACN,QAAQ;EACR,SAAS;EACT,MAAM,QAAQ,OAAO;EACrB;EACA;CACF,CAAC,CACH;AACF;;;;;AAMA,SAAgB,eACd,KACA,OACA,SACkB;CAClB,MAAM,WAAW,yBAAyB,KAAK,OAAO;CAEtD,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI;EAEJ,IAAI;GACF,SAAS,aAAa,KAAK,KAAK,KAAK,IAAI,GAAG,MAAM;EACpD,QAAQ;GACN;EACF;EAEA,SAAS,KAAK,GAAG,qBAAqB,MAAM,QAAQ,GAAG,CAAC;CAC1D;CAEA,OAAO;AACT"}
+{"version":3,"file":"conventions-step.mjs","names":["ast.parseSourceFile"],"sources":["../../../../../../../../../packages/core/src/tooling/check/conventions-step.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { parse } from \"jsonc-parser\";\nimport { importSpecifiers } from \"../syntax/imports\";\nimport * as ast from \"../syntax/ast\";\nimport { createProblem, type ToolingProblem } from \"../problem\";\nimport { codeStyleFindings } from \"./code-style-conventions\";\nimport { securityFindings } from \"./security-conventions\";\nimport { positionOf, type SourceFinding } from \"./source-ast\";\n\n/** Extensions tried when resolving an extension-less import. */\nconst RESOLVE_EXTENSIONS = [\".ts\", \".tsx\", \".js\", \".jsx\", \"/index.ts\", \"/index.tsx\"];\n\n/** Test files may import anything on purpose. */\nconst TEST_FILE = /\\.(?:test|spec)\\.[cm]?[jt]sx?$/i;\n\n/** Matches a project-relative path of a file the framework loads by itself. */\nexport function isAutoLoadedFile(relativePath: string): boolean {\n  return (\n    /^src\\/app\\/main\\.tsx?$/.test(relativePath) ||\n    /^src\\/app\\/[^/]+\\/(?:routes|main|worker)\\.tsx?$/.test(relativePath) ||\n    /^src\\/app\\/.+\\/events\\/[^/]+\\.tsx?$/.test(relativePath)\n  );\n}\n\n/** The module folder (`src/app/<module>`) a project-relative path lives in, if any. */\nfunction moduleOf(relativePath: string): string | undefined {\n  return /^src\\/app\\/([^/]+)\\//.exec(relativePath)?.[1];\n}\n\nfunction toPosix(file: string): string {\n  return file.split(path.sep).join(\"/\");\n}\n\n/** Resolve a relative or `app/...` specifier to a project-relative file, if it exists. */\nfunction resolveSpecifier(specifier: string, importer: string, cwd: string): string | undefined {\n  let base: string;\n\n  if (specifier.startsWith(\".\")) {\n    base = path.resolve(path.dirname(path.join(cwd, importer)), specifier);\n  } else if (specifier.startsWith(\"app/\")) {\n    base = path.join(cwd, \"src\", specifier);\n  } else {\n    return undefined;\n  }\n\n  const candidates = [base, ...RESOLVE_EXTENSIONS.map((extension) => `${base}${extension}`)];\n  const withoutJs = base.replace(/\\.jsx?$/, \"\");\n\n  if (withoutJs !== base) {\n    candidates.push(...RESOLVE_EXTENSIONS.map((extension) => `${withoutJs}${extension}`));\n  }\n\n  const found = candidates.find(\n    (candidate) => existsSync(candidate) && path.extname(candidate) !== \"\",\n  );\n\n  return found ? toPosix(path.relative(cwd, found)) : undefined;\n}\n\n/** Every module specifier a source file imports, with its position. */\nfunction importsOf(sourceFile: ast.SourceFile): { specifier: string; node: ast.Node }[] {\n  return importSpecifiers(sourceFile.fileName, sourceFile.text);\n}\n\n/** `// warlock-check-ignore [WLxxxx …]` on a problem's line or the line above it. */\nconst IGNORE_COMMENT = /\\/[/*]\\s*warlock-check-ignore\\b(.*)/;\n\n/** Whether an ignore comment on `line` (1-based) or the line before covers `code`. */\nfunction isIgnored(lines: readonly string[], line: number, code: string): boolean {\n  for (const text of [lines[line - 1], lines[line - 2]]) {\n    const match = text === undefined ? null : IGNORE_COMMENT.exec(text);\n\n    if (!match) continue;\n\n    const codes = match[1]?.match(/WL\\d{4}/g);\n\n    if (!codes || codes.includes(code)) return true;\n  }\n\n  return false;\n}\n\n/** The import conventions (`WL9001`–`WL9003`) of one parsed file. */\nfunction importProblems(\n  sourceFile: ast.SourceFile,\n  relativePath: string,\n  cwd: string,\n): ToolingProblem[] {\n  const problems: ToolingProblem[] = [];\n  const importerModule = moduleOf(relativePath);\n\n  for (const { specifier, node } of importsOf(sourceFile)) {\n    const at = { file: relativePath, ...positionOf(sourceFile, node) };\n\n    if (specifier.startsWith(\".\") && /\\.jsx?$/.test(specifier)) {\n      problems.push(\n        createProblem({\n          code: \"WL9002\",\n          source: \"convention\",\n          message: `Import \"${specifier}\" ends in a .js extension.`,\n          ...at,\n        }),\n      );\n    }\n\n    const target = resolveSpecifier(specifier, relativePath, cwd);\n\n    if (!target) continue;\n\n    if (!TEST_FILE.test(relativePath) && isAutoLoadedFile(target)) {\n      problems.push(\n        createProblem({\n          code: \"WL9001\",\n          source: \"convention\",\n          message: `\"${specifier}\" imports ${target}, which the framework loads by itself.`,\n          ...at,\n        }),\n      );\n    }\n\n    const targetModule = moduleOf(target);\n\n    if (\n      specifier.startsWith(\".\") &&\n      importerModule !== undefined &&\n      targetModule !== undefined &&\n      importerModule !== targetModule\n    ) {\n      const alias = `app/${target.replace(/^src\\/app\\//, \"\").replace(/\\.[cm]?[jt]sx?$/, \"\")}`;\n\n      problems.push(\n        createProblem({\n          code: \"WL9003\",\n          source: \"convention\",\n          message: `\"${specifier}\" reaches from module \"${importerModule}\" into \"${targetModule}\"; import \"${alias}\" instead.`,\n          ...at,\n        }),\n      );\n    }\n  }\n\n  return problems;\n}\n\nfunction findingProblem(\n  sourceFile: ast.SourceFile,\n  relativePath: string,\n  finding: SourceFinding,\n): ToolingProblem {\n  return createProblem({\n    code: finding.code,\n    source: \"convention\",\n    severity: finding.severity ?? \"error\",\n    message: finding.message,\n    file: relativePath,\n    ...positionOf(sourceFile, finding.node),\n  });\n}\n\n/**\n * The convention problems in one source file, in source order:\n *\n * - `WL9001` an import of a file the framework loads by itself (`routes.ts`,\n *   `main.ts`, `worker.ts`, `events/*`) — importing it registers it twice;\n * - `WL9002` a relative import ending in `.js`;\n * - `WL9003` a relative import from one `src/app/<module>` into another, which\n *   should use the `app/<module>/...` alias;\n * - `WL9005`–`WL9009` the security conventions (see `securityFindings`):\n *   `request.all()` into a query or service, a mutating route with no guard\n *   and no `public: true`, a redirect target from request input, sensitive\n *   values in logs, unbounded regexes on request input;\n * - `WL9010`–`WL9012` warnings: `await log.*()`, a second controller in one\n *   file, a `kind` discriminator.\n *\n * A `// warlock-check-ignore WL9006` comment on the problem's line or the line\n * above silences that code there; without codes it silences every one.\n */\nexport function checkFileConventions(\n  relativePath: string,\n  source: string,\n  cwd: string,\n): ToolingProblem[] {\n  const sourceFile = ast.parseSourceFile(relativePath, source);\n  const problems = [\n    ...importProblems(sourceFile, relativePath, cwd),\n    ...[...securityFindings(sourceFile), ...codeStyleFindings(sourceFile)].map((finding) =>\n      findingProblem(sourceFile, relativePath, finding),\n    ),\n  ];\n  const lines = source.split(/\\r?\\n/);\n\n  return problems\n    .filter((problem) => problem.line === null || !isIgnored(lines, problem.line, problem.code))\n    .sort(\n      (first, second) =>\n        (first.line ?? 0) - (second.line ?? 0) || (first.column ?? 0) - (second.column ?? 0),\n    );\n}\n\n/** `WL9004` when the project tsconfig turns on legacy decorators. */\nexport function checkTsconfigConventions(cwd: string, project = \"tsconfig.json\"): ToolingProblem[] {\n  const file = path.join(cwd, project);\n\n  if (!existsSync(file)) return [];\n\n  const text = readFileSync(file, \"utf8\");\n  const config: unknown = parse(text);\n  const options: unknown =\n    typeof config === \"object\" && config !== null\n      ? Reflect.get(config, \"compilerOptions\")\n      : undefined;\n\n  if (\n    typeof options !== \"object\" ||\n    options === null ||\n    Reflect.get(options, \"experimentalDecorators\") !== true\n  ) {\n    return [];\n  }\n\n  const index = text.indexOf(\"experimentalDecorators\");\n  const before = index === -1 ? \"\" : text.slice(0, index);\n  const line = index === -1 ? null : before.split(\"\\n\").length;\n  const column = index === -1 ? null : index - before.lastIndexOf(\"\\n\");\n\n  return [\n    createProblem({\n      code: \"WL9004\",\n      source: \"convention\",\n      message: '\"experimentalDecorators\": true switches TypeScript to legacy decorators.',\n      file: toPosix(project),\n      line,\n      column,\n    }),\n  ];\n}\n\n/**\n * Run every convention check over `files` (project-relative) plus the\n * project tsconfig.\n */\nexport function runConventions(\n  cwd: string,\n  files: readonly string[],\n  project?: string,\n): ToolingProblem[] {\n  const problems = checkTsconfigConventions(cwd, project);\n\n  for (const file of files) {\n    let source: string;\n\n    try {\n      source = readFileSync(path.join(cwd, file), \"utf8\");\n    } catch {\n      continue;\n    }\n\n    problems.push(...checkFileConventions(file, source, cwd));\n  }\n\n  return problems;\n}\n"],"mappings":";;;;;;;;;;;;AAWA,MAAM,qBAAqB;CAAC;CAAO;CAAQ;CAAO;CAAQ;CAAa;AAAY;;AAGnF,MAAM,YAAY;;AAGlB,SAAgB,iBAAiB,cAA+B;CAC9D,OACE,yBAAyB,KAAK,YAAY,KAC1C,kDAAkD,KAAK,YAAY,KACnE,sCAAsC,KAAK,YAAY;AAE3D;;AAGA,SAAS,SAAS,cAA0C;CAC1D,OAAO,uBAAuB,KAAK,YAAY,CAAC,GAAG;AACrD;AAEA,SAAS,QAAQ,MAAsB;CACrC,OAAO,KAAK,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;AACtC;;AAGA,SAAS,iBAAiB,WAAmB,UAAkB,KAAiC;CAC9F,IAAI;CAEJ,IAAI,UAAU,WAAW,GAAG,GAC1B,OAAO,KAAK,QAAQ,KAAK,QAAQ,KAAK,KAAK,KAAK,QAAQ,CAAC,GAAG,SAAS;MAChE,IAAI,UAAU,WAAW,MAAM,GACpC,OAAO,KAAK,KAAK,KAAK,OAAO,SAAS;MAEtC;CAGF,MAAM,aAAa,CAAC,MAAM,GAAG,mBAAmB,KAAK,cAAc,GAAG,OAAO,WAAW,CAAC;CACzF,MAAM,YAAY,KAAK,QAAQ,WAAW,EAAE;CAE5C,IAAI,cAAc,MAChB,WAAW,KAAK,GAAG,mBAAmB,KAAK,cAAc,GAAG,YAAY,WAAW,CAAC;CAGtF,MAAM,QAAQ,WAAW,MACtB,cAAc,WAAW,SAAS,KAAK,KAAK,QAAQ,SAAS,MAAM,EACtE;CAEA,OAAO,QAAQ,QAAQ,KAAK,SAAS,KAAK,KAAK,CAAC,IAAI;AACtD;;AAGA,SAAS,UAAU,YAAqE;CACtF,OAAO,iBAAiB,WAAW,UAAU,WAAW,IAAI;AAC9D;;AAGA,MAAM,iBAAiB;;AAGvB,SAAS,UAAU,OAA0B,MAAc,MAAuB;CAChF,KAAK,MAAM,QAAQ,CAAC,MAAM,OAAO,IAAI,MAAM,OAAO,EAAE,GAAG;EACrD,MAAM,QAAQ,SAAS,SAAY,OAAO,eAAe,KAAK,IAAI;EAElE,IAAI,CAAC,OAAO;EAEZ,MAAM,QAAQ,MAAM,EAAE,EAAE,MAAM,UAAU;EAExC,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC7C;CAEA,OAAO;AACT;;AAGA,SAAS,eACP,YACA,cACA,KACkB;CAClB,MAAM,WAA6B,CAAC;CACpC,MAAM,iBAAiB,SAAS,YAAY;CAE5C,KAAK,MAAM,EAAE,WAAW,UAAU,UAAU,UAAU,GAAG;EACvD,MAAM,KAAK;GAAE,MAAM;GAAc,GAAG,WAAW,YAAY,IAAI;EAAE;EAEjE,IAAI,UAAU,WAAW,GAAG,KAAK,UAAU,KAAK,SAAS,GACvD,SAAS,KACP,cAAc;GACZ,MAAM;GACN,QAAQ;GACR,SAAS,WAAW,UAAU;GAC9B,GAAG;EACL,CAAC,CACH;EAGF,MAAM,SAAS,iBAAiB,WAAW,cAAc,GAAG;EAE5D,IAAI,CAAC,QAAQ;EAEb,IAAI,CAAC,UAAU,KAAK,YAAY,KAAK,iBAAiB,MAAM,GAC1D,SAAS,KACP,cAAc;GACZ,MAAM;GACN,QAAQ;GACR,SAAS,IAAI,UAAU,YAAY,OAAO;GAC1C,GAAG;EACL,CAAC,CACH;EAGF,MAAM,eAAe,SAAS,MAAM;EAEpC,IACE,UAAU,WAAW,GAAG,KACxB,mBAAmB,UACnB,iBAAiB,UACjB,mBAAmB,cACnB;GACA,MAAM,QAAQ,OAAO,OAAO,QAAQ,eAAe,EAAE,CAAC,CAAC,QAAQ,mBAAmB,EAAE;GAEpF,SAAS,KACP,cAAc;IACZ,MAAM;IACN,QAAQ;IACR,SAAS,IAAI,UAAU,yBAAyB,eAAe,UAAU,aAAa,aAAa,MAAM;IACzG,GAAG;GACL,CAAC,CACH;EACF;CACF;CAEA,OAAO;AACT;AAEA,SAAS,eACP,YACA,cACA,SACgB;CAChB,OAAO,cAAc;EACnB,MAAM,QAAQ;EACd,QAAQ;EACR,UAAU,QAAQ,YAAY;EAC9B,SAAS,QAAQ;EACjB,MAAM;EACN,GAAG,WAAW,YAAY,QAAQ,IAAI;CACxC,CAAC;AACH;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,qBACd,cACA,QACA,KACkB;CAClB,MAAM,aAAaA,gBAAoB,cAAc,MAAM;CAC3D,MAAM,WAAW,CACf,GAAG,eAAe,YAAY,cAAc,GAAG,GAC/C,GAAG,CAAC,GAAG,iBAAiB,UAAU,GAAG,GAAG,kBAAkB,UAAU,CAAC,CAAC,CAAC,KAAK,YAC1E,eAAe,YAAY,cAAc,OAAO,CAClD,CACF;CACA,MAAM,QAAQ,OAAO,MAAM,OAAO;CAElC,OAAO,SACJ,QAAQ,YAAY,QAAQ,SAAS,QAAQ,CAAC,UAAU,OAAO,QAAQ,MAAM,QAAQ,IAAI,CAAC,CAAC,CAC3F,MACE,OAAO,YACL,MAAM,QAAQ,MAAM,OAAO,QAAQ,OAAO,MAAM,UAAU,MAAM,OAAO,UAAU,EACtF;AACJ;;AAGA,SAAgB,yBAAyB,KAAa,UAAU,iBAAmC;CACjG,MAAM,OAAO,KAAK,KAAK,KAAK,OAAO;CAEnC,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO,CAAC;CAE/B,MAAM,OAAO,aAAa,MAAM,MAAM;CACtC,MAAM,SAAkB,MAAM,IAAI;CAClC,MAAM,UACJ,OAAO,WAAW,YAAY,WAAW,OACrC,QAAQ,IAAI,QAAQ,iBAAiB,IACrC;CAEN,IACE,OAAO,YAAY,YACnB,YAAY,QACZ,QAAQ,IAAI,SAAS,wBAAwB,MAAM,MAEnD,OAAO,CAAC;CAGV,MAAM,QAAQ,KAAK,QAAQ,wBAAwB;CACnD,MAAM,SAAS,UAAU,KAAK,KAAK,KAAK,MAAM,GAAG,KAAK;CACtD,MAAM,OAAO,UAAU,KAAK,OAAO,OAAO,MAAM,IAAI,CAAC,CAAC;CACtD,MAAM,SAAS,UAAU,KAAK,OAAO,QAAQ,OAAO,YAAY,IAAI;CAEpE,OAAO,CACL,cAAc;EACZ,MAAM;EACN,QAAQ;EACR,SAAS;EACT,MAAM,QAAQ,OAAO;EACrB;EACA;CACF,CAAC,CACH;AACF;;;;;AAMA,SAAgB,eACd,KACA,OACA,SACkB;CAClB,MAAM,WAAW,yBAAyB,KAAK,OAAO;CAEtD,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI;EAEJ,IAAI;GACF,SAAS,aAAa,KAAK,KAAK,KAAK,IAAI,GAAG,MAAM;EACpD,QAAQ;GACN;EACF;EAEA,SAAS,KAAK,GAAG,qBAAqB,MAAM,QAAQ,GAAG,CAAC;CAC1D;CAEA,OAAO;AACT"}

package/esm/tooling/check/environment-step.d.mts

@@ -1,18 +1,16 @@
 import { ToolingProblem } from "../problem.mjs";
-
 //#region ../../packages/core/src/tooling/check/environment-step.d.ts
 /**
  * The oldest Node.js release core supports — `engines.node` in core's
  * package.json (`>=22.15`). `bin/warlock.js` refuses older versions before
  * the CLI loads; this check covers programmatic `runCheck()` calls too.
  */
-declare const MIN_NODE_VERSION = "22.15.0";
+export declare const MIN_NODE_VERSION = "22.15.0";
 /**
  * Check the running Node.js against core's minimum and the app's own
  * `engines.node` (when it is a plain `>=` range). A mismatch is a `WL8001`
  * environment problem.
  */
-declare function checkNodeVersion(cwd: string, running?: string): ToolingProblem[];
+export declare function checkNodeVersion(cwd: string, running?: string): ToolingProblem[];
 //#endregion
-export { MIN_NODE_VERSION, checkNodeVersion };
 //# sourceMappingURL=environment-step.d.mts.map

package/esm/tooling/check/environment-step.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"environment-step.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/environment-step.ts"],"mappings":";;;;;AASA;;;cAAa,gBAAA;;;;AAoDiF;;iBAA9E,gBAAA,CAAiB,GAAA,UAAa,OAAA,YAAkC,cAAc"}
+{"version":3,"file":"environment-step.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/environment-step.ts"],"mappings":";;;;;;;qBASa;;;;;;wBAoDG,iBAAiB,aAAa,mBAAkC"}

package/esm/tooling/check/environment-step.mjs

@@ -74,5 +74,5 @@ function checkNodeVersion(cwd, running = process.versions.node) {
 }
 
 //#endregion
-export { MIN_NODE_VERSION, checkNodeVersion };
+export { MIN_NODE_VERSION, checkNodeVersion, minimumOfRange };
 //# sourceMappingURL=environment-step.mjs.map

package/esm/tooling/check/index.mjs

@@ -7,4 +7,4 @@ import { findVitest, parseVitestReport, runVitest } from "./tests-step.mjs";
 import { runCheck } from "./run-check.mjs";
 import { runTests, testRunArguments } from "./run-tests.mjs";
 
-export {  };
+export { CHECK_EXIT_CODES, CHECK_STEPS, MIN_NODE_VERSION, checkExitCode, checkFileConventions, checkNodeVersion, checkTsconfigConventions, findVitest, isAutoLoadedFile, listChangedFiles, parseVitestReport, runCheck, runConventions, runGit, runLint, runTests, runVitest, testRunArguments };

package/esm/tooling/check/lint-step.d.mts

@@ -1,9 +1,9 @@
 import { ToolingProblem } from "../problem.mjs";
-
 //#region ../../packages/core/src/tooling/check/lint-step.d.ts
 /** What the lint step found, and which linters ran. */
-type LintOutcome = {
-  problems: ToolingProblem[]; /** The linters that ran (`eslint`, `oxlint`); empty when the app configures none. */
+export type LintOutcome = {
+  problems: ToolingProblem[];
+  /** The linters that ran (`eslint`, `oxlint`); empty when the app configures none. */
   linters: string[];
 };
 /**
@@ -13,7 +13,6 @@ type LintOutcome = {
  * has the `oxlint` package. A config without its tool is a `WL8002`
  * environment problem.
  */
-declare function runLint(cwd: string, files: readonly string[]): Promise<LintOutcome>;
+export declare function runLint(cwd: string, files: readonly string[]): Promise<LintOutcome>;
 //#endregion
-export { LintOutcome, runLint };
 //# sourceMappingURL=lint-step.d.mts.map

package/esm/tooling/check/lint-step.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"lint-step.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/lint-step.ts"],"mappings":";;;;KAWY,WAAA;EACV,QAAA,EAAU,cAAc,IADH;EAGrB,OAAA;AAAA;;;;;AAAO;AAuFT;;iBAAsB,OAAA,CAAQ,GAAA,UAAa,KAAA,sBAA2B,OAAO,CAAC,WAAA"}
+{"version":3,"file":"lint-step.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/lint-step.ts"],"mappings":";;;YAWY;EACV,UAAU;;EAEV;;;;;;;;;wBAuFoB,QAAQ,aAAa,2BAA2B,QAAQ"}

package/esm/tooling/check/lint-step.mjs

@@ -12,8 +12,9 @@ function errorMessage(error) {
 /** A missing package/plugin is the machine's install; anything else is the tool crashing. */
 function toolFailure(tool, error) {
 	const message = errorMessage(error);
+	const missing = /cannot find (?:module|package)|ERR_MODULE_NOT_FOUND/i.test(message);
 	return createProblem({
-		code: /cannot find (?:module|package)|ERR_MODULE_NOT_FOUND/i.test(message) ? "WL8002" : "WL8007",
+		code: missing ? "WL8002" : "WL8007",
 		source: "environment",
 		message: `${tool} could not run: ${message.split("\n")[0]}`
 	});

package/esm/tooling/check/lint-step.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"lint-step.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/lint-step.ts"],"sourcesContent":["import { ESLint } from \"eslint\";\nimport path from \"node:path\";\nimport { hasEslint } from \"../../dev-server/health-checker/default-health-checkers\";\nimport {\n  findOxlint,\n  hasOxlintConfig,\n  OxlintRunner,\n} from \"../../dev-server/health-checker/oxlint-runner\";\nimport { createProblem, type ToolingProblem } from \"../problem\";\n\n/** What the lint step found, and which linters ran. */\nexport type LintOutcome = {\n  problems: ToolingProblem[];\n  /** The linters that ran (`eslint`, `oxlint`); empty when the app configures none. */\n  linters: string[];\n};\n\nconst LINTABLE = /\\.[cm]?[jt]sx?$/i;\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** A missing package/plugin is the machine's install; anything else is the tool crashing. */\nfunction toolFailure(tool: string, error: unknown): ToolingProblem {\n  const message = errorMessage(error);\n  const missing = /cannot find (?:module|package)|ERR_MODULE_NOT_FOUND/i.test(message);\n\n  return createProblem({\n    code: missing ? \"WL8002\" : \"WL8007\",\n    source: \"environment\",\n    message: `${tool} could not run: ${message.split(\"\\n\")[0]}`,\n  });\n}\n\nasync function runEslint(cwd: string, files: readonly string[]): Promise<ToolingProblem[]> {\n  // The same flat-config lookup the dev server's ESLint checker uses.\n  const eslint = new ESLint({ cwd, errorOnUnmatchedPattern: false, warnIgnored: false });\n  const results = await eslint.lintFiles([...files]);\n  const problems: ToolingProblem[] = [];\n\n  for (const result of results) {\n    const file = path.relative(cwd, result.filePath).split(path.sep).join(\"/\");\n\n    for (const message of result.messages) {\n      const error = message.severity === 2 || message.fatal === true;\n\n      problems.push(\n        createProblem({\n          code: error ? \"WL7201\" : \"WL7202\",\n          source: \"eslint\",\n          severity: error ? \"error\" : \"warning\",\n          message: message.message,\n          file,\n          line: message.line || null,\n          column: message.column || null,\n          rule: message.ruleId ?? null,\n        }),\n      );\n    }\n  }\n\n  return problems;\n}\n\nasync function runOxlint(cwd: string, files: readonly string[]): Promise<ToolingProblem[]> {\n  const runner = new OxlintRunner();\n\n  runner.initialize(cwd);\n\n  try {\n    const results = await runner.checkFiles(\n      files.map((file) => ({ path: path.join(cwd, file), relativePath: file })),\n    );\n\n    return results.flatMap((result) =>\n      [...result.errors, ...result.warnings].map((message) =>\n        createProblem({\n          code: message.type === \"error\" ? \"WL7201\" : \"WL7202\",\n          source: \"oxlint\",\n          severity: message.type,\n          message: message.message,\n          file: message.relativePath,\n          line: message.lineNumber,\n          column: message.columnNumber,\n          rule: message.ruleId ?? null,\n        }),\n      ),\n    );\n  } finally {\n    await runner.shutdown();\n  }\n}\n\n/**\n * Lint `files` (project-relative) with the linters the app configures, the\n * same ones `warlock dev` runs in the background: ESLint when an\n * `eslint.config.*` exists, oxlint when an oxlint config exists and the app\n * has the `oxlint` package. A config without its tool is a `WL8002`\n * environment problem.\n */\nexport async function runLint(cwd: string, files: readonly string[]): Promise<LintOutcome> {\n  const lintable = files.filter((file) => LINTABLE.test(file));\n  const problems: ToolingProblem[] = [];\n  const linters: string[] = [];\n\n  // ESLint lints the whole directory when handed no pattern; nothing to lint\n  // means nothing to run.\n  if (lintable.length === 0) return { problems, linters };\n\n  if (hasEslint(cwd)) {\n    linters.push(\"eslint\");\n\n    try {\n      problems.push(...(await runEslint(cwd, lintable)));\n    } catch (error) {\n      problems.push(toolFailure(\"ESLint\", error));\n    }\n  }\n\n  if (hasOxlintConfig(cwd)) {\n    linters.push(\"oxlint\");\n\n    if (!findOxlint(cwd)) {\n      problems.push(\n        createProblem({\n          code: \"WL8002\",\n          source: \"environment\",\n          message: \"An oxlint config exists but the oxlint package is not installed in the app.\",\n        }),\n      );\n    } else {\n      try {\n        problems.push(...(await runOxlint(cwd, lintable)));\n      } catch (error) {\n        problems.push(toolFailure(\"oxlint\", error));\n      }\n    }\n  }\n\n  return { problems, linters };\n}\n"],"mappings":";;;;;;;AAiBA,MAAM,WAAW;AAEjB,SAAS,aAAa,OAAwB;CAC5C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;AAGA,SAAS,YAAY,MAAc,OAAgC;CACjE,MAAM,UAAU,aAAa,KAAK;CAGlC,OAAO,cAAc;EACnB,MAHc,uDAAuD,KAAK,OAG9D,IAAI,WAAW;EAC3B,QAAQ;EACR,SAAS,GAAG,KAAK,kBAAkB,QAAQ,MAAM,IAAI,CAAC,CAAC;CACzD,CAAC;AACH;AAEA,eAAe,UAAU,KAAa,OAAqD;CAGzF,MAAM,UAAU,MAAM,IADH,OAAO;EAAE;EAAK,yBAAyB;EAAO,aAAa;CAAM,CACzD,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;CACjD,MAAM,WAA6B,CAAC;CAEpC,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,OAAO,KAAK,SAAS,KAAK,OAAO,QAAQ,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;EAEzE,KAAK,MAAM,WAAW,OAAO,UAAU;GACrC,MAAM,QAAQ,QAAQ,aAAa,KAAK,QAAQ,UAAU;GAE1D,SAAS,KACP,cAAc;IACZ,MAAM,QAAQ,WAAW;IACzB,QAAQ;IACR,UAAU,QAAQ,UAAU;IAC5B,SAAS,QAAQ;IACjB;IACA,MAAM,QAAQ,QAAQ;IACtB,QAAQ,QAAQ,UAAU;IAC1B,MAAM,QAAQ,UAAU;GAC1B,CAAC,CACH;EACF;CACF;CAEA,OAAO;AACT;AAEA,eAAe,UAAU,KAAa,OAAqD;CACzF,MAAM,SAAS,IAAI,aAAa;CAEhC,OAAO,WAAW,GAAG;CAErB,IAAI;EAKF,QAAO,MAJe,OAAO,WAC3B,MAAM,KAAK,UAAU;GAAE,MAAM,KAAK,KAAK,KAAK,IAAI;GAAG,cAAc;EAAK,EAAE,CAC1E,EAEc,CAAC,SAAS,WACtB,CAAC,GAAG,OAAO,QAAQ,GAAG,OAAO,QAAQ,CAAC,CAAC,KAAK,YAC1C,cAAc;GACZ,MAAM,QAAQ,SAAS,UAAU,WAAW;GAC5C,QAAQ;GACR,UAAU,QAAQ;GAClB,SAAS,QAAQ;GACjB,MAAM,QAAQ;GACd,MAAM,QAAQ;GACd,QAAQ,QAAQ;GAChB,MAAM,QAAQ,UAAU;EAC1B,CAAC,CACH,CACF;CACF,UAAU;EACR,MAAM,OAAO,SAAS;CACxB;AACF;;;;;;;;AASA,eAAsB,QAAQ,KAAa,OAAgD;CACzF,MAAM,WAAW,MAAM,QAAQ,SAAS,SAAS,KAAK,IAAI,CAAC;CAC3D,MAAM,WAA6B,CAAC;CACpC,MAAM,UAAoB,CAAC;CAI3B,IAAI,SAAS,WAAW,GAAG,OAAO;EAAE;EAAU;CAAQ;CAEtD,IAAI,UAAU,GAAG,GAAG;EAClB,QAAQ,KAAK,QAAQ;EAErB,IAAI;GACF,SAAS,KAAK,GAAI,MAAM,UAAU,KAAK,QAAQ,CAAE;EACnD,SAAS,OAAO;GACd,SAAS,KAAK,YAAY,UAAU,KAAK,CAAC;EAC5C;CACF;CAEA,IAAI,gBAAgB,GAAG,GAAG;EACxB,QAAQ,KAAK,QAAQ;EAErB,IAAI,CAAC,WAAW,GAAG,GACjB,SAAS,KACP,cAAc;GACZ,MAAM;GACN,QAAQ;GACR,SAAS;EACX,CAAC,CACH;OAEA,IAAI;GACF,SAAS,KAAK,GAAI,MAAM,UAAU,KAAK,QAAQ,CAAE;EACnD,SAAS,OAAO;GACd,SAAS,KAAK,YAAY,UAAU,KAAK,CAAC;EAC5C;CAEJ;CAEA,OAAO;EAAE;EAAU;CAAQ;AAC7B"}
+{"version":3,"file":"lint-step.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/lint-step.ts"],"sourcesContent":["import { ESLint } from \"eslint\";\nimport path from \"node:path\";\nimport { hasEslint } from \"../../dev-server/health-checker/default-health-checkers\";\nimport {\n  findOxlint,\n  hasOxlintConfig,\n  OxlintRunner,\n} from \"../../dev-server/health-checker/oxlint-runner\";\nimport { createProblem, type ToolingProblem } from \"../problem\";\n\n/** What the lint step found, and which linters ran. */\nexport type LintOutcome = {\n  problems: ToolingProblem[];\n  /** The linters that ran (`eslint`, `oxlint`); empty when the app configures none. */\n  linters: string[];\n};\n\nconst LINTABLE = /\\.[cm]?[jt]sx?$/i;\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** A missing package/plugin is the machine's install; anything else is the tool crashing. */\nfunction toolFailure(tool: string, error: unknown): ToolingProblem {\n  const message = errorMessage(error);\n  const missing = /cannot find (?:module|package)|ERR_MODULE_NOT_FOUND/i.test(message);\n\n  return createProblem({\n    code: missing ? \"WL8002\" : \"WL8007\",\n    source: \"environment\",\n    message: `${tool} could not run: ${message.split(\"\\n\")[0]}`,\n  });\n}\n\nasync function runEslint(cwd: string, files: readonly string[]): Promise<ToolingProblem[]> {\n  // The same flat-config lookup the dev server's ESLint checker uses.\n  const eslint = new ESLint({ cwd, errorOnUnmatchedPattern: false, warnIgnored: false });\n  const results = await eslint.lintFiles([...files]);\n  const problems: ToolingProblem[] = [];\n\n  for (const result of results) {\n    const file = path.relative(cwd, result.filePath).split(path.sep).join(\"/\");\n\n    for (const message of result.messages) {\n      const error = message.severity === 2 || message.fatal === true;\n\n      problems.push(\n        createProblem({\n          code: error ? \"WL7201\" : \"WL7202\",\n          source: \"eslint\",\n          severity: error ? \"error\" : \"warning\",\n          message: message.message,\n          file,\n          line: message.line || null,\n          column: message.column || null,\n          rule: message.ruleId ?? null,\n        }),\n      );\n    }\n  }\n\n  return problems;\n}\n\nasync function runOxlint(cwd: string, files: readonly string[]): Promise<ToolingProblem[]> {\n  const runner = new OxlintRunner();\n\n  runner.initialize(cwd);\n\n  try {\n    const results = await runner.checkFiles(\n      files.map((file) => ({ path: path.join(cwd, file), relativePath: file })),\n    );\n\n    return results.flatMap((result) =>\n      [...result.errors, ...result.warnings].map((message) =>\n        createProblem({\n          code: message.type === \"error\" ? \"WL7201\" : \"WL7202\",\n          source: \"oxlint\",\n          severity: message.type,\n          message: message.message,\n          file: message.relativePath,\n          line: message.lineNumber,\n          column: message.columnNumber,\n          rule: message.ruleId ?? null,\n        }),\n      ),\n    );\n  } finally {\n    await runner.shutdown();\n  }\n}\n\n/**\n * Lint `files` (project-relative) with the linters the app configures, the\n * same ones `warlock dev` runs in the background: ESLint when an\n * `eslint.config.*` exists, oxlint when an oxlint config exists and the app\n * has the `oxlint` package. A config without its tool is a `WL8002`\n * environment problem.\n */\nexport async function runLint(cwd: string, files: readonly string[]): Promise<LintOutcome> {\n  const lintable = files.filter((file) => LINTABLE.test(file));\n  const problems: ToolingProblem[] = [];\n  const linters: string[] = [];\n\n  // ESLint lints the whole directory when handed no pattern; nothing to lint\n  // means nothing to run.\n  if (lintable.length === 0) return { problems, linters };\n\n  if (hasEslint(cwd)) {\n    linters.push(\"eslint\");\n\n    try {\n      problems.push(...(await runEslint(cwd, lintable)));\n    } catch (error) {\n      problems.push(toolFailure(\"ESLint\", error));\n    }\n  }\n\n  if (hasOxlintConfig(cwd)) {\n    linters.push(\"oxlint\");\n\n    if (!findOxlint(cwd)) {\n      problems.push(\n        createProblem({\n          code: \"WL8002\",\n          source: \"environment\",\n          message: \"An oxlint config exists but the oxlint package is not installed in the app.\",\n        }),\n      );\n    } else {\n      try {\n        problems.push(...(await runOxlint(cwd, lintable)));\n      } catch (error) {\n        problems.push(toolFailure(\"oxlint\", error));\n      }\n    }\n  }\n\n  return { problems, linters };\n}\n"],"mappings":";;;;;;;AAiBA,MAAM,WAAW;AAEjB,SAAS,aAAa,OAAwB;CAC5C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;AAGA,SAAS,YAAY,MAAc,OAAgC;CACjE,MAAM,UAAU,aAAa,KAAK;CAClC,MAAM,UAAU,uDAAuD,KAAK,OAAO;CAEnF,OAAO,cAAc;EACnB,MAAM,UAAU,WAAW;EAC3B,QAAQ;EACR,SAAS,GAAG,KAAK,kBAAkB,QAAQ,MAAM,IAAI,CAAC,CAAC;CACzD,CAAC;AACH;AAEA,eAAe,UAAU,KAAa,OAAqD;CAGzF,MAAM,UAAU,MAAM,IADH,OAAO;EAAE;EAAK,yBAAyB;EAAO,aAAa;CAAM,CACzD,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;CACjD,MAAM,WAA6B,CAAC;CAEpC,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,OAAO,KAAK,SAAS,KAAK,OAAO,QAAQ,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;EAEzE,KAAK,MAAM,WAAW,OAAO,UAAU;GACrC,MAAM,QAAQ,QAAQ,aAAa,KAAK,QAAQ,UAAU;GAE1D,SAAS,KACP,cAAc;IACZ,MAAM,QAAQ,WAAW;IACzB,QAAQ;IACR,UAAU,QAAQ,UAAU;IAC5B,SAAS,QAAQ;IACjB;IACA,MAAM,QAAQ,QAAQ;IACtB,QAAQ,QAAQ,UAAU;IAC1B,MAAM,QAAQ,UAAU;GAC1B,CAAC,CACH;EACF;CACF;CAEA,OAAO;AACT;AAEA,eAAe,UAAU,KAAa,OAAqD;CACzF,MAAM,SAAS,IAAI,aAAa;CAEhC,OAAO,WAAW,GAAG;CAErB,IAAI;EAKF,QAAO,MAJe,OAAO,WAC3B,MAAM,KAAK,UAAU;GAAE,MAAM,KAAK,KAAK,KAAK,IAAI;GAAG,cAAc;EAAK,EAAE,CAC1E,EAEc,CAAC,SAAS,WACtB,CAAC,GAAG,OAAO,QAAQ,GAAG,OAAO,QAAQ,CAAC,CAAC,KAAK,YAC1C,cAAc;GACZ,MAAM,QAAQ,SAAS,UAAU,WAAW;GAC5C,QAAQ;GACR,UAAU,QAAQ;GAClB,SAAS,QAAQ;GACjB,MAAM,QAAQ;GACd,MAAM,QAAQ;GACd,QAAQ,QAAQ;GAChB,MAAM,QAAQ,UAAU;EAC1B,CAAC,CACH,CACF;CACF,UAAU;EACR,MAAM,OAAO,SAAS;CACxB;AACF;;;;;;;;AASA,eAAsB,QAAQ,KAAa,OAAgD;CACzF,MAAM,WAAW,MAAM,QAAQ,SAAS,SAAS,KAAK,IAAI,CAAC;CAC3D,MAAM,WAA6B,CAAC;CACpC,MAAM,UAAoB,CAAC;CAI3B,IAAI,SAAS,WAAW,GAAG,OAAO;EAAE;EAAU;CAAQ;CAEtD,IAAI,UAAU,GAAG,GAAG;EAClB,QAAQ,KAAK,QAAQ;EAErB,IAAI;GACF,SAAS,KAAK,GAAI,MAAM,UAAU,KAAK,QAAQ,CAAE;EACnD,SAAS,OAAO;GACd,SAAS,KAAK,YAAY,UAAU,KAAK,CAAC;EAC5C;CACF;CAEA,IAAI,gBAAgB,GAAG,GAAG;EACxB,QAAQ,KAAK,QAAQ;EAErB,IAAI,CAAC,WAAW,GAAG,GACjB,SAAS,KACP,cAAc;GACZ,MAAM;GACN,QAAQ;GACR,SAAS;EACX,CAAC,CACH;OAEA,IAAI;GACF,SAAS,KAAK,GAAI,MAAM,UAAU,KAAK,QAAQ,CAAE;EACnD,SAAS,OAAO;GACd,SAAS,KAAK,YAAY,UAAU,KAAK,CAAC;EAC5C;CAEJ;CAEA,OAAO;EAAE;EAAU;CAAQ;AAC7B"}

package/esm/tooling/check/request-input.mjs

@@ -1,14 +1,14 @@
+import { expressionOf, isCallExpression, isIdentifier, valueText } from "../syntax/ast.mjs";
 import { isMemberAccess, isValueReference, memberName, resolveInitializer, unwrap, walk } from "./source-ast.mjs";
-import ts from "typescript";
 
 //#region ../../packages/core/src/tooling/check/request-input.ts
 /** Identifiers the source checks treat as the incoming request. */
-const REQUEST_NAMES = new Set(["request", "req"]);
+const REQUEST_NAMES = /* @__PURE__ */ new Set(["request", "req"]);
 /**
 * Request members that return client-controlled input. Reading any of them
 * (as a property or a call) yields data the client chose.
 */
-const REQUEST_INPUT_MEMBERS = new Set([
+const REQUEST_INPUT_MEMBERS = /* @__PURE__ */ new Set([
 	"all",
 	"allExceptParams",
 	"heavy",
@@ -39,7 +39,7 @@ const REQUEST_INPUT_MEMBERS = new Set([
 	"referrer"
 ]);
 /** Request members that return the whole (or most of the) request body. */
-const REQUEST_BODY_MEMBERS = new Set([
+const REQUEST_BODY_MEMBERS = /* @__PURE__ */ new Set([
 	"all",
 	"allExceptParams",
 	"heavy",
@@ -60,18 +60,18 @@ const REQUEST_BODY_MEMBERS = new Set([
 */
 function requestMemberAccess(node) {
 	let current = unwrap(node);
-	if (ts.isCallExpression(current)) current = unwrap(current.expression);
+	if (isCallExpression(current)) current = unwrap(expressionOf(current));
 	if (!isMemberAccess(current)) return void 0;
 	let member = current;
 	for (;;) {
-		const object = unwrap(member.expression);
-		if (ts.isIdentifier(object)) return REQUEST_NAMES.has(object.text) ? memberName(member) : void 0;
+		const object = unwrap(expressionOf(member));
+		if (isIdentifier(object)) return REQUEST_NAMES.has(valueText(object)) ? memberName(member) : void 0;
 		if (isMemberAccess(object)) {
 			member = object;
 			continue;
 		}
-		if (ts.isCallExpression(object)) {
-			const callee = unwrap(object.expression);
+		if (isCallExpression(object)) {
+			const callee = unwrap(expressionOf(object));
 			if (!isMemberAccess(callee)) return void 0;
 			member = callee;
 			continue;
@@ -85,8 +85,8 @@ function isRequestInputExpression(node) {
 	return member !== void 0 && REQUEST_INPUT_MEMBERS.has(member);
 }
 function isSanitizerCall(call, sanitizers) {
-	const callee = unwrap(call.expression);
-	if (ts.isIdentifier(callee)) return sanitizers.has(callee.text);
+	const callee = unwrap(expressionOf(call));
+	if (isIdentifier(callee)) return sanitizers.has(valueText(callee));
 	if (isMemberAccess(callee)) {
 		const name = memberName(callee);
 		return name !== void 0 && sanitizers.has(name);
@@ -103,14 +103,14 @@ function containsRequestInput(node, options = {}, seen = /* @__PURE__ */ new Set
 	const sanitizers = options.sanitizers ?? /* @__PURE__ */ new Set();
 	walk(node, (child) => {
 		if (found) return false;
-		if (ts.isCallExpression(child) && isSanitizerCall(child, sanitizers)) return false;
-		if (isMemberAccess(child) || ts.isCallExpression(child)) {
+		if (isCallExpression(child) && isSanitizerCall(child, sanitizers)) return false;
+		if (isMemberAccess(child) || isCallExpression(child)) {
 			if (isRequestInputExpression(child) || options.isSource?.(child) === true) {
 				found = true;
 				return false;
 			}
 		}
-		if (ts.isIdentifier(child) && !seen.has(child)) {
+		if (isIdentifier(child) && !seen.has(child)) {
 			seen.add(child);
 			if (isValueReference(child)) {
 				const initializer = resolveInitializer(child);
@@ -128,5 +128,5 @@ function containsRequestInput(node, options = {}, seen = /* @__PURE__ */ new Set
 }
 
 //#endregion
-export { REQUEST_BODY_MEMBERS, REQUEST_NAMES, containsRequestInput, requestMemberAccess };
+export { REQUEST_BODY_MEMBERS, REQUEST_NAMES, containsRequestInput, isRequestInputExpression, requestMemberAccess };
 //# sourceMappingURL=request-input.mjs.map

package/esm/tooling/check/request-input.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request-input.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/request-input.ts"],"sourcesContent":["import ts from \"typescript\";\nimport {\n  isMemberAccess,\n  isValueReference,\n  memberName,\n  resolveInitializer,\n  unwrap,\n  walk,\n} from \"./source-ast\";\n\n/** Identifiers the source checks treat as the incoming request. */\nexport const REQUEST_NAMES: ReadonlySet<string> = new Set([\"request\", \"req\"]);\n\n/**\n * Request members that return client-controlled input. Reading any of them\n * (as a property or a call) yields data the client chose.\n */\nconst REQUEST_INPUT_MEMBERS: ReadonlySet<string> = new Set([\n  \"all\",\n  \"allExceptParams\",\n  \"heavy\",\n  \"heavyExceptParams\",\n  \"only\",\n  \"pluck\",\n  \"except\",\n  \"input\",\n  \"get\",\n  \"email\",\n  \"string\",\n  \"int\",\n  \"bool\",\n  \"float\",\n  \"number\",\n  \"body\",\n  \"bodyInputs\",\n  \"params\",\n  \"query\",\n  \"validated\",\n  \"validatedExcept\",\n  \"idParam\",\n  \"headers\",\n  \"header\",\n  \"cookie\",\n  \"cookies\",\n  \"referer\",\n  \"referrer\",\n]);\n\n/** Request members that return the whole (or most of the) request body. */\nexport const REQUEST_BODY_MEMBERS: ReadonlySet<string> = new Set([\n  \"all\",\n  \"allExceptParams\",\n  \"heavy\",\n  \"heavyExceptParams\",\n  \"body\",\n  \"bodyInputs\",\n  \"validated\",\n  \"validatedExcept\",\n  \"only\",\n  \"except\",\n  \"pluck\",\n  \"headers\",\n  \"cookies\",\n]);\n\n/**\n * When `node` is `<request>.<member>` or `<request>.<member>(…)` (also through\n * `request.query.next`-style chains), the `<member>`.\n */\nexport function requestMemberAccess(node: ts.Node): string | undefined {\n  let current = unwrap(node);\n\n  if (ts.isCallExpression(current)) current = unwrap(current.expression);\n  if (!isMemberAccess(current)) return undefined;\n\n  // Walk down to the member read directly off the request: `request.query.next` → `query`.\n  let member = current;\n\n  for (;;) {\n    const object = unwrap(member.expression);\n\n    if (ts.isIdentifier(object)) {\n      return REQUEST_NAMES.has(object.text) ? memberName(member) : undefined;\n    }\n\n    if (isMemberAccess(object)) {\n      member = object;\n      continue;\n    }\n\n    if (ts.isCallExpression(object)) {\n      const callee = unwrap(object.expression);\n      if (!isMemberAccess(callee)) return undefined;\n      member = callee;\n      continue;\n    }\n\n    return undefined;\n  }\n}\n\n/** Whether `node` reads client-controlled input from the request. */\nexport function isRequestInputExpression(node: ts.Node): boolean {\n  const member = requestMemberAccess(node);\n\n  return member !== undefined && REQUEST_INPUT_MEMBERS.has(member);\n}\n\nexport type TaintOptions = {\n  /** Calls whose result is clean, whatever their arguments (matched by name). */\n  sanitizers?: ReadonlySet<string>;\n  /** Input sources besides the request (client query-string hooks, `location.search`). */\n  isSource?: (node: ts.Node) => boolean;\n};\n\nfunction isSanitizerCall(call: ts.CallExpression, sanitizers: ReadonlySet<string>): boolean {\n  const callee = unwrap(call.expression);\n\n  if (ts.isIdentifier(callee)) return sanitizers.has(callee.text);\n\n  if (isMemberAccess(callee)) {\n    const name = memberName(callee);\n    return name !== undefined && sanitizers.has(name);\n  }\n\n  return false;\n}\n\n/**\n * Whether an expression carries request input: it reads the request directly,\n * or names a local constant initialised from request input. A call to a\n * sanitizer launders its arguments.\n */\nexport function containsRequestInput(\n  node: ts.Node,\n  options: TaintOptions = {},\n  seen: Set<ts.Node> = new Set(),\n): boolean {\n  let found = false;\n  const sanitizers = options.sanitizers ?? new Set<string>();\n\n  walk(node, (child) => {\n    if (found) return false;\n\n    if (ts.isCallExpression(child) && isSanitizerCall(child, sanitizers)) return false;\n\n    if (isMemberAccess(child) || ts.isCallExpression(child)) {\n      if (isRequestInputExpression(child) || options.isSource?.(child) === true) {\n        found = true;\n        return false;\n      }\n    }\n\n    if (ts.isIdentifier(child) && !seen.has(child)) {\n      seen.add(child);\n\n      if (isValueReference(child)) {\n        const initializer = resolveInitializer(child);\n\n        if (initializer && !seen.has(initializer)) {\n          seen.add(initializer);\n\n          if (containsRequestInput(initializer, options, seen)) {\n            found = true;\n            return false;\n          }\n        }\n      }\n    }\n\n    return undefined;\n  });\n\n  return found;\n}\n"],"mappings":";;;;;AAWA,MAAa,gBAAqC,IAAI,IAAI,CAAC,WAAW,KAAK,CAAC;;;;;AAM5E,MAAM,wBAA6C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAa,uBAA4C,IAAI,IAAI;CAC/D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;AAMD,SAAgB,oBAAoB,MAAmC;CACrE,IAAI,UAAU,OAAO,IAAI;CAEzB,IAAI,GAAG,iBAAiB,OAAO,GAAG,UAAU,OAAO,QAAQ,UAAU;CACrE,IAAI,CAAC,eAAe,OAAO,GAAG,OAAO;CAGrC,IAAI,SAAS;CAEb,SAAS;EACP,MAAM,SAAS,OAAO,OAAO,UAAU;EAEvC,IAAI,GAAG,aAAa,MAAM,GACxB,OAAO,cAAc,IAAI,OAAO,IAAI,IAAI,WAAW,MAAM,IAAI;EAG/D,IAAI,eAAe,MAAM,GAAG;GAC1B,SAAS;GACT;EACF;EAEA,IAAI,GAAG,iBAAiB,MAAM,GAAG;GAC/B,MAAM,SAAS,OAAO,OAAO,UAAU;GACvC,IAAI,CAAC,eAAe,MAAM,GAAG,OAAO;GACpC,SAAS;GACT;EACF;EAEA;CACF;AACF;;AAGA,SAAgB,yBAAyB,MAAwB;CAC/D,MAAM,SAAS,oBAAoB,IAAI;CAEvC,OAAO,WAAW,UAAa,sBAAsB,IAAI,MAAM;AACjE;AASA,SAAS,gBAAgB,MAAyB,YAA0C;CAC1F,MAAM,SAAS,OAAO,KAAK,UAAU;CAErC,IAAI,GAAG,aAAa,MAAM,GAAG,OAAO,WAAW,IAAI,OAAO,IAAI;CAE9D,IAAI,eAAe,MAAM,GAAG;EAC1B,MAAM,OAAO,WAAW,MAAM;EAC9B,OAAO,SAAS,UAAa,WAAW,IAAI,IAAI;CAClD;CAEA,OAAO;AACT;;;;;;AAOA,SAAgB,qBACd,MACA,UAAwB,CAAC,GACzB,uBAAqB,IAAI,IAAI,GACpB;CACT,IAAI,QAAQ;CACZ,MAAM,aAAa,QAAQ,8BAAc,IAAI,IAAY;CAEzD,KAAK,OAAO,UAAU;EACpB,IAAI,OAAO,OAAO;EAElB,IAAI,GAAG,iBAAiB,KAAK,KAAK,gBAAgB,OAAO,UAAU,GAAG,OAAO;EAE7E,IAAI,eAAe,KAAK,KAAK,GAAG,iBAAiB,KAAK,GACpD;OAAI,yBAAyB,KAAK,KAAK,QAAQ,WAAW,KAAK,MAAM,MAAM;IACzE,QAAQ;IACR,OAAO;GACT;;EAGF,IAAI,GAAG,aAAa,KAAK,KAAK,CAAC,KAAK,IAAI,KAAK,GAAG;GAC9C,KAAK,IAAI,KAAK;GAEd,IAAI,iBAAiB,KAAK,GAAG;IAC3B,MAAM,cAAc,mBAAmB,KAAK;IAE5C,IAAI,eAAe,CAAC,KAAK,IAAI,WAAW,GAAG;KACzC,KAAK,IAAI,WAAW;KAEpB,IAAI,qBAAqB,aAAa,SAAS,IAAI,GAAG;MACpD,QAAQ;MACR,OAAO;KACT;IACF;GACF;EACF;CAGF,CAAC;CAED,OAAO;AACT"}
+{"version":3,"file":"request-input.mjs","names":["ast.isCallExpression","ast.expressionOf","ast.isIdentifier","ast.valueText"],"sources":["../../../../../../../../../packages/core/src/tooling/check/request-input.ts"],"sourcesContent":["import * as ast from \"../syntax/ast\";\nimport {\n  isMemberAccess,\n  isValueReference,\n  memberName,\n  resolveInitializer,\n  unwrap,\n  walk,\n} from \"./source-ast\";\n\n/** Identifiers the source checks treat as the incoming request. */\nexport const REQUEST_NAMES: ReadonlySet<string> = new Set([\"request\", \"req\"]);\n\n/**\n * Request members that return client-controlled input. Reading any of them\n * (as a property or a call) yields data the client chose.\n */\nconst REQUEST_INPUT_MEMBERS: ReadonlySet<string> = new Set([\n  \"all\",\n  \"allExceptParams\",\n  \"heavy\",\n  \"heavyExceptParams\",\n  \"only\",\n  \"pluck\",\n  \"except\",\n  \"input\",\n  \"get\",\n  \"email\",\n  \"string\",\n  \"int\",\n  \"bool\",\n  \"float\",\n  \"number\",\n  \"body\",\n  \"bodyInputs\",\n  \"params\",\n  \"query\",\n  \"validated\",\n  \"validatedExcept\",\n  \"idParam\",\n  \"headers\",\n  \"header\",\n  \"cookie\",\n  \"cookies\",\n  \"referer\",\n  \"referrer\",\n]);\n\n/** Request members that return the whole (or most of the) request body. */\nexport const REQUEST_BODY_MEMBERS: ReadonlySet<string> = new Set([\n  \"all\",\n  \"allExceptParams\",\n  \"heavy\",\n  \"heavyExceptParams\",\n  \"body\",\n  \"bodyInputs\",\n  \"validated\",\n  \"validatedExcept\",\n  \"only\",\n  \"except\",\n  \"pluck\",\n  \"headers\",\n  \"cookies\",\n]);\n\n/**\n * When `node` is `<request>.<member>` or `<request>.<member>(…)` (also through\n * `request.query.next`-style chains), the `<member>`.\n */\nexport function requestMemberAccess(node: ast.Node): string | undefined {\n  let current = unwrap(node);\n\n  if (ast.isCallExpression(current)) current = unwrap(ast.expressionOf(current));\n  if (!isMemberAccess(current)) return undefined;\n\n  // Walk down to the member read directly off the request: `request.query.next` → `query`.\n  let member = current;\n\n  for (;;) {\n    const object = unwrap(ast.expressionOf(member));\n\n    if (ast.isIdentifier(object)) {\n      return REQUEST_NAMES.has(ast.valueText(object)) ? memberName(member) : undefined;\n    }\n\n    if (isMemberAccess(object)) {\n      member = object;\n      continue;\n    }\n\n    if (ast.isCallExpression(object)) {\n      const callee = unwrap(ast.expressionOf(object));\n      if (!isMemberAccess(callee)) return undefined;\n      member = callee;\n      continue;\n    }\n\n    return undefined;\n  }\n}\n\n/** Whether `node` reads client-controlled input from the request. */\nexport function isRequestInputExpression(node: ast.Node): boolean {\n  const member = requestMemberAccess(node);\n\n  return member !== undefined && REQUEST_INPUT_MEMBERS.has(member);\n}\n\nexport type TaintOptions = {\n  /** Calls whose result is clean, whatever their arguments (matched by name). */\n  sanitizers?: ReadonlySet<string>;\n  /** Input sources besides the request (client query-string hooks, `location.search`). */\n  isSource?: (node: ast.Node) => boolean;\n};\n\nfunction isSanitizerCall(call: ast.CallExpression, sanitizers: ReadonlySet<string>): boolean {\n  const callee = unwrap(ast.expressionOf(call));\n\n  if (ast.isIdentifier(callee)) return sanitizers.has(ast.valueText(callee));\n\n  if (isMemberAccess(callee)) {\n    const name = memberName(callee);\n    return name !== undefined && sanitizers.has(name);\n  }\n\n  return false;\n}\n\n/**\n * Whether an expression carries request input: it reads the request directly,\n * or names a local constant initialised from request input. A call to a\n * sanitizer launders its arguments.\n */\nexport function containsRequestInput(\n  node: ast.Node,\n  options: TaintOptions = {},\n  seen: Set<ast.Node> = new Set(),\n): boolean {\n  let found = false;\n  const sanitizers = options.sanitizers ?? new Set<string>();\n\n  walk(node, (child) => {\n    if (found) return false;\n\n    if (ast.isCallExpression(child) && isSanitizerCall(child, sanitizers)) return false;\n\n    if (isMemberAccess(child) || ast.isCallExpression(child)) {\n      if (isRequestInputExpression(child) || options.isSource?.(child) === true) {\n        found = true;\n        return false;\n      }\n    }\n\n    if (ast.isIdentifier(child) && !seen.has(child)) {\n      seen.add(child);\n\n      if (isValueReference(child)) {\n        const initializer = resolveInitializer(child);\n\n        if (initializer && !seen.has(initializer)) {\n          seen.add(initializer);\n\n          if (containsRequestInput(initializer, options, seen)) {\n            found = true;\n            return false;\n          }\n        }\n      }\n    }\n\n    return undefined;\n  });\n\n  return found;\n}\n"],"mappings":";;;;;AAWA,MAAa,gCAAqC,IAAI,IAAI,CAAC,WAAW,KAAK,CAAC;;;;;AAM5E,MAAM,wCAA6C,IAAI,IAAI;CACzD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAa,uCAA4C,IAAI,IAAI;CAC/D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;AAMD,SAAgB,oBAAoB,MAAoC;CACtE,IAAI,UAAU,OAAO,IAAI;CAEzB,IAAIA,iBAAqB,OAAO,GAAG,UAAU,OAAOC,aAAiB,OAAO,CAAC;CAC7E,IAAI,CAAC,eAAe,OAAO,GAAG,OAAO;CAGrC,IAAI,SAAS;CAEb,SAAS;EACP,MAAM,SAAS,OAAOA,aAAiB,MAAM,CAAC;EAE9C,IAAIC,aAAiB,MAAM,GACzB,OAAO,cAAc,IAAIC,UAAc,MAAM,CAAC,IAAI,WAAW,MAAM,IAAI;EAGzE,IAAI,eAAe,MAAM,GAAG;GAC1B,SAAS;GACT;EACF;EAEA,IAAIH,iBAAqB,MAAM,GAAG;GAChC,MAAM,SAAS,OAAOC,aAAiB,MAAM,CAAC;GAC9C,IAAI,CAAC,eAAe,MAAM,GAAG,OAAO;GACpC,SAAS;GACT;EACF;EAEA;CACF;AACF;;AAGA,SAAgB,yBAAyB,MAAyB;CAChE,MAAM,SAAS,oBAAoB,IAAI;CAEvC,OAAO,WAAW,UAAa,sBAAsB,IAAI,MAAM;AACjE;AASA,SAAS,gBAAgB,MAA0B,YAA0C;CAC3F,MAAM,SAAS,OAAOA,aAAiB,IAAI,CAAC;CAE5C,IAAIC,aAAiB,MAAM,GAAG,OAAO,WAAW,IAAIC,UAAc,MAAM,CAAC;CAEzE,IAAI,eAAe,MAAM,GAAG;EAC1B,MAAM,OAAO,WAAW,MAAM;EAC9B,OAAO,SAAS,UAAa,WAAW,IAAI,IAAI;CAClD;CAEA,OAAO;AACT;;;;;;AAOA,SAAgB,qBACd,MACA,UAAwB,CAAC,GACzB,uBAAsB,IAAI,IAAI,GACrB;CACT,IAAI,QAAQ;CACZ,MAAM,aAAa,QAAQ,8BAAc,IAAI,IAAY;CAEzD,KAAK,OAAO,UAAU;EACpB,IAAI,OAAO,OAAO;EAElB,IAAIH,iBAAqB,KAAK,KAAK,gBAAgB,OAAO,UAAU,GAAG,OAAO;EAE9E,IAAI,eAAe,KAAK,KAAKA,iBAAqB,KAAK,GACrD;OAAI,yBAAyB,KAAK,KAAK,QAAQ,WAAW,KAAK,MAAM,MAAM;IACzE,QAAQ;IACR,OAAO;GACT;;EAGF,IAAIE,aAAiB,KAAK,KAAK,CAAC,KAAK,IAAI,KAAK,GAAG;GAC/C,KAAK,IAAI,KAAK;GAEd,IAAI,iBAAiB,KAAK,GAAG;IAC3B,MAAM,cAAc,mBAAmB,KAAK;IAE5C,IAAI,eAAe,CAAC,KAAK,IAAI,WAAW,GAAG;KACzC,KAAK,IAAI,WAAW;KAEpB,IAAI,qBAAqB,aAAa,SAAS,IAAI,GAAG;MACpD,QAAQ;MACR,OAAO;KACT;IACF;GACF;EACF;CAGF,CAAC;CAED,OAAO;AACT"}

package/esm/tooling/check/run-check.d.mts

@@ -2,21 +2,30 @@ import { GitRunner } from "./changed-files.mjs";
 import { CheckReport, CheckStepName } from "./check-report.types.mjs";
 import { TypecheckOptions, TypecheckResult } from "../typecheck/run-typecheck.mjs";
 import { VitestRunner } from "./tests-step.mjs";
-
 //#region ../../packages/core/src/tooling/check/run-check.d.ts
 /** Runs the typecheck step. The CLI swaps in a child process so a heap overflow cannot end `check`. */
-type TypecheckRunner = (options: TypecheckOptions) => Promise<TypecheckResult> | TypecheckResult;
+export type TypecheckRunner = (options: TypecheckOptions) => Promise<TypecheckResult> | TypecheckResult;
 /** Inputs of {@link runCheck}. */
-type CheckOptions = {
-  /** Project root. Default: `process.cwd()`. */cwd?: string; /** Limit every step to the files changed against `base` (default HEAD) plus untracked files. */
-  changed?: boolean; /** Compare with `git merge-base <base> HEAD` instead of HEAD. Implies `changed`. */
-  base?: string; /** Steps not to run. */
-  skip?: readonly CheckStepName[]; /** tsconfig path, relative to `cwd`. Default: `tsconfig.json`. */
-  project?: string; /** How git is run. */
-  git?: GitRunner; /** How the typecheck runs. Default: in this process. */
-  typecheck?: TypecheckRunner; /** How vitest runs. */
-  vitest?: VitestRunner; /** Where the app's vitest CLI is. Default: resolved from the app root. */
-  vitestBinary?: string | null; /** The Node.js version to check. Default: the running one. */
+export type CheckOptions = {
+  /** Project root. Default: `process.cwd()`. */
+  cwd?: string;
+  /** Limit every step to the files changed against `base` (default HEAD) plus untracked files. */
+  changed?: boolean;
+  /** Compare with `git merge-base <base> HEAD` instead of HEAD. Implies `changed`. */
+  base?: string;
+  /** Steps not to run. */
+  skip?: readonly CheckStepName[];
+  /** tsconfig path, relative to `cwd`. Default: `tsconfig.json`. */
+  project?: string;
+  /** How git is run. */
+  git?: GitRunner;
+  /** How the typecheck runs. Default: in this process. */
+  typecheck?: TypecheckRunner;
+  /** How vitest runs. */
+  vitest?: VitestRunner;
+  /** Where the app's vitest CLI is. Default: resolved from the app root. */
+  vitestBinary?: string | null;
+  /** The Node.js version to check. Default: the running one. */
   nodeVersion?: string;
 };
 /**
@@ -29,7 +38,6 @@ type CheckOptions = {
  * problem. The only exception: with `changed`, a git failure leaves no file
  * list, and every step after `environment` is `blocked`.
  */
-declare function runCheck(options?: CheckOptions): Promise<CheckReport>;
+export declare function runCheck(options?: CheckOptions): Promise<CheckReport>;
 //#endregion
-export { CheckOptions, TypecheckRunner, runCheck };
 //# sourceMappingURL=run-check.d.mts.map

package/esm/tooling/check/run-check.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"run-check.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/run-check.ts"],"mappings":";;;;;;;KA8BY,eAAA,IACV,OAAA,EAAS,gBAAA,KACN,OAAA,CAAQ,eAAA,IAAmB,eAAA;AAFhC;AAAA,KAKY,YAAA;gDAEV,GAAA,WALW;EAOX,OAAA,YAP8B;EAS9B,IAAA,WAT6C;EAW7C,IAAA,YAAgB,aAAA,IAZhB;EAcA,OAAA,WAbW;EAeX,GAAA,GAAM,SAAA,EAfuC;EAiB7C,SAAA,GAAY,eAAA,EAdF;EAgBV,MAAA,GAAS,YAAA;EAET,YAAA,kBANM;EAQN,WAAA;AAAA;;;;;;;;;;;iBA4BoB,QAAA,CAAS,OAAA,GAAS,YAAA,GAAoB,OAAA,CAAQ,WAAA"}
+{"version":3,"file":"run-check.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/run-check.ts"],"mappings":";;;;;;YA8BY,mBACV,SAAS,qBACN,QAAQ,mBAAmB;;YAGpB;;EAEV;;EAEA;;EAEA;;EAEA,gBAAgB;;EAEhB;;EAEA,MAAM;;EAEN,YAAY;;EAEZ,SAAS;;EAET;;EAEA;;;;;;;;;;;;wBA4BoB,SAAS,UAAS,eAAoB,QAAQ"}

package/esm/tooling/check/run-tests.d.mts

@@ -2,37 +2,45 @@ import { ToolingProblem } from "../problem.mjs";
 import { GitRunner } from "./changed-files.mjs";
 import { CheckExitCode } from "./check-report.types.mjs";
 import { VitestRunner } from "./tests-step.mjs";
-
 //#region ../../packages/core/src/tooling/check/run-tests.d.ts
 /** Inputs of {@link runTests}. Pass `files`, or `changed`, or neither (the whole suite). */
-type RunTestsOptions = {
-  /** Project root. Default: `process.cwd()`. */cwd?: string;
+export type RunTestsOptions = {
+  /** Project root. Default: `process.cwd()`. */
+  cwd?: string;
   /**
    * Project-relative files. Test files (`*.spec.ts`, `*.test.ts`) run as they
    * are; any other file runs the tests that import it (`vitest related`).
    */
-  files?: readonly string[]; /** Run the tests related to the files changed against `base` (default HEAD) plus untracked files. */
-  changed?: boolean; /** Compare with `git merge-base <base> HEAD`. Implies `changed`. */
+  files?: readonly string[];
+  /** Run the tests related to the files changed against `base` (default HEAD) plus untracked files. */
+  changed?: boolean;
+  /** Compare with `git merge-base <base> HEAD`. Implies `changed`. */
   base?: string;
   git?: GitRunner;
-  vitest?: VitestRunner; /** Where the app's vitest CLI is. Default: resolved from the app root. */
+  vitest?: VitestRunner;
+  /** Where the app's vitest CLI is. Default: resolved from the app root. */
   vitestBinary?: string | null;
 };
 /** What {@link runTests} returns. */
-type TestRunReport = {
+export type TestRunReport = {
   schemaVersion: 1;
-  ok: boolean; /** Same meaning as `warlock check`: 0 passed, 1 your code, 2 this machine. */
-  exitCode: CheckExitCode; /** `files` for explicit files, `changed` for a git-scoped run, `all` for the suite. */
-  mode: "files" | "changed" | "all"; /** The files the run was scoped to (project-relative), or `null` for the whole suite. */
-  files: string[] | null; /** The vitest arguments used (without the reporter flags). */
+  ok: boolean;
+  /** Same meaning as `warlock check`: 0 passed, 1 your code, 2 this machine. */
+  exitCode: CheckExitCode;
+  /** `files` for explicit files, `changed` for a git-scoped run, `all` for the suite. */
+  mode: "files" | "changed" | "all";
+  /** The files the run was scoped to (project-relative), or `null` for the whole suite. */
+  files: string[] | null;
+  /** The vitest arguments used (without the reporter flags). */
   args: string[];
   total: number;
   passed: number;
-  failed: number; /** `WL7301` / `WL7302` per failure, or an environment code. */
+  failed: number;
+  /** `WL7301` / `WL7302` per failure, or an environment code. */
   problems: ToolingProblem[];
 };
 /** The vitest arguments for a scoped run: `run <tests>` for test files, `related <files> --run` otherwise. */
-declare function testRunArguments(files: readonly string[] | null): string[];
+export declare function testRunArguments(files: readonly string[] | null): string[];
 /**
  * Run the app's tests the way `warlock check` runs its tests step, for one
  * file, a set of files, or the files changed in git — the loop an agent runs
@@ -42,7 +50,6 @@ declare function testRunArguments(files: readonly string[] | null): string[];
  * const report = await runTests({ files: ["src/app/posts/services/publish.service.ts"] });
  * report.problems.filter((problem) => problem.code === "WL7301");
  */
-declare function runTests(options?: RunTestsOptions): Promise<TestRunReport>;
+export declare function runTests(options?: RunTestsOptions): Promise<TestRunReport>;
 //#endregion
-export { RunTestsOptions, TestRunReport, runTests, testRunArguments };
 //# sourceMappingURL=run-tests.d.mts.map

package/esm/tooling/check/run-tests.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"run-tests.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/run-tests.ts"],"mappings":";;;;;;;KAeY,eAAA;EAAA,8CAEV,GAAA;;;;;EAKA,KAAA,sBAIA;EAFA,OAAA,YAGM;EADN,IAAA;EACA,GAAA,GAAM,SAAA;EACN,MAAA,GAAS,YAAY,EAET;EAAZ,YAAA;AAAA;;KAIU,aAAA;EACV,aAAA;EACA,EAAA;EAEA,QAAA,EAAU,aAAA,EAAA;EAEV,IAAA,+BAEA;EAAA,KAAA,mBAGA;EADA,IAAA;EACA,KAAA;EACA,MAAA;EACA,MAAA,UAEwB;EAAxB,QAAA,EAAU,cAAc;AAAA;;iBAMV,gBAAA,CAAiB,KAA+B;;AAAA;AA+BhE;;;;;;;iBAAsB,QAAA,CAAS,OAAA,GAAS,eAAA,GAAuB,OAAA,CAAQ,aAAA"}
+{"version":3,"file":"run-tests.d.mts","names":[],"sources":["../../../../../../../../../packages/core/src/tooling/check/run-tests.ts"],"mappings":";;;;;;YAeY;;EAEV;;;;;EAKA;;EAEA;;EAEA;EACA,MAAM;EACN,SAAS;;EAET;;;YAIU;EACV;EACA;;EAEA,UAAU;;EAEV;;EAEA;;EAEA;EACA;EACA;EACA;;EAEA,UAAU;;;wBAMI,iBAAiB;;;;;;;;;;wBA+BX,SAAS,UAAS,kBAAuB,QAAQ"}