datagrok-tools 6.7.9 → 6.7.10

package/.devcontainer/Dockerfile.pkg_dev

@@ -1,4 +1,4 @@
-FROM node:22-bookworm-slim
+FROM node:22.23.4-bookworm-slim
 
 # System deps + Chrome stable
 RUN apt-get update && apt-get install -y --no-install-recommends \

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> datagrok-tools@6.7.9 build /home/runner/work/public/public/tools
+> datagrok-tools@6.7.10 build /home/runner/work/public/public/tools
 > node build.js
 
-Successfully compiled 52 files with Babel.
+Successfully compiled 55 files with Babel.

package/CHANGELOG.md

@@ -1,6 +1,27 @@
 # Datagrok-tools changelog
 
-## v.next
+## 6.7.10 (2026-11-06)
+
+* Added `grok src`: git recipes across the repos of the datagrok umbrella (`clone`, `add`, `sparse`, `switch`, `status`, `pull`, `at`, `bump`, `wt add`, `doctor`)
+* Kept positionals, `--url` and `--dir` verbatim (`1.10` no longer becomes 1.1), and an explicit boolean such as `--force` now reaches every command instead of being dropped
+* Added `grok s o groups list|get|add|set|rm|put|reset`, `endpoints list|rm`, `logs match '<filter>'` (with `--space`) and `logs activations [stop]`: log groups and endpoints of Settings > Logger
+* `grok publish`: A local container build that fails for the host platform on Apple Silicon is retried for linux/amd64, so a package whose base image has no arm64 variant (the Chembl ChEMBL database) builds
+* `grok test`: A package built on u2 or ems runs with u2 strict — a u2 misuse throws a `U2UsageError` naming the fix, and one the page caught and logged fails the run when it is the package's own (a stack frame in its bundle, or none to tell; another package's prints as a warning); `U2_STRICT=report` lists them instead without failing
+* `grok check`: A package built on u2 or ems fails on a problem of u2's consumer check whatever its version (a 0.x package only printed it), so a CSS rule over a new `.u2-*` class or `[data-u2…]` attribute fails the check
+* Added `grok s o problems severity <id|kind:key> <info|warning|critical|none>`: pins the severity a problem's raises use (`none` unpins it)
+* Added `grok connect-folder`: connects a local folder as a connection, served from a Docker container; the agent image tag is pulled on every connect, so a moved tag replaces a stale local agent
+* `grok connect-folder`: Runs only the Docker Hub `datagrok/proxy_storage` agent image whatever image the server names; `--image` runs another, such as a copy in a private registry
+* Added `grok s ... --log [<spec>]` on every `grok s` command (`grok s o` included): its requests share a `datlas-log-id`, every server instance keeps what they log at the spec (`verbose`, `standard`, levels, debug flags or `all`) in memory only, and at the end the command gathers it and prints it to stderr
+* Added `grok s functions run ... --debug`: a debug call (`?debug=true`) whose own log, a query's stages as the query debugger shows them, is kept and printed the same way
+* Added `grok s o logs request <logId>`: gathers what the requests of one `--log` command logged
+* `grok s status`: server build, uptime, DB pool and HTTP connections from `/info/server`; for admins also the requests in flight (`?extended=true`)
+* `grok api`: Fixed double plurals in table accessors (`categorieses` → `categories`)
+* Build: Fixed `package-api.ts` of a decorator package lagging one build behind `package.g.ts`
+* Added a `restore` arm per soft-delete table to the `<Schema>TransactionOp` that `grok api` generates, so the typed `transaction()` accepts the restore ops the server runs
+* Made `grok api` type a required column with a `default` as optional on `<Table>Insert`: the server fills it when an insert omits it
+* Fixed `grok api` emitting a choices type that does not compile, or holds a different value, when a choice contains `'` or `\`
+
+## 6.7.9 (2026-10-16)
 
 * Upgraded Puppeteer to v25, which drops the vulnerable `extract-zip` and `basic-ftp` transitive dependencies; Node.js 22.12+ is now required
 * `grok add app --domain`, `grok api --ui`: scaffold against `@datagrok-libraries/ems`

package/CLAUDE.md

@@ -33,6 +33,7 @@ The CLI uses a modular command pattern. Each command is a separate module that:
 - `claude.ts` - Launch a Dockerized dev environment with Datagrok + Claude Code
 - `migrate.ts` - Update legacy packages
 - `init.ts` - Apply configuration to existing packages
+- `src.ts` - Git recipes across the repos of the datagrok umbrella (`grok src`)
 
 The commands `api`, `check`, `link`, `publish`, and `test` support the `--all` flag to run recursively across all packages in the current directory.
 

package/GROK_S.md

@@ -36,6 +36,7 @@ browser or a logged-in session.
 | See what fields an entity type has                          | `grok s describe connections`                          |
 | Hit any undocumented endpoint                               | `grok s raw GET /users/current` / `raw POST <path> --data '{...}'` |
 | Check server + per-module health                            | `grok s healthcheck [--module <name>]`                 |
+| Server build, uptime, DB pool, requests in flight           | `grok s status`                                        |
 | Problems, alerts, problem rules, logger settings, errors, cloud logs | `grok s observe problems list --alert-status open` (alias `grok s o`) |
 | Bulk operations in one round-trip                           | `grok s batch <entity> <verb> --json items.json`       |
 | Move entities dev to prod (bundle, or instance to instance) | `grok s pull ... --out ./bundle` / `grok s migrate ... --from dev --to prod` |
@@ -217,6 +218,7 @@ grants inherited through the entity's project links (`inherited: true`).
 grok s functions run 'Chem:smilesToMw("CCO")'                  # positional args
 grok s functions run 'Pkg:fn({smiles:"CCO", radius:2})'        # named args
 grok s functions run Pkg:fn --json params.json                 # big input from a file
+grok s functions run 'MyPkg:MyQuery()' --debug                 # a debug call: the query's own log on stderr
 ```
 
 The server binds arguments by parameter name, so positional values are mapped onto the
@@ -497,6 +499,20 @@ module the server does not report exits 1. Requires a valid dev key (standard `g
 For an anonymous liveness probe — load balancer, k8s readiness — hit `/admin/health` directly;
 it's on the server's unauthenticated allowlist.
 
+### Server status
+
+```bash
+grok s status                                  # build, uptime, DB pool, HTTP connections
+grok s status --output json                    # {server, extended}
+grok s status --output quiet                   # just the version
+```
+
+Reads `GET /info/server` and `GET /info/server?extended=true`: `Version`, `Branch`, `Commit`,
+build `Date`, `Uptime`, `Requests` served, `Used Connections` / `Pool Connections` of the DB pool,
+`Isolate`, `Service network`, `webRoot`, and the `Http Server` connection counts. For an admin the
+extended call replaces the active-connection count with the requests in flight per endpoint
+(`{"GET /api/...": n}`), printed as a table; for anyone else the two responses are the same.
+
 ## Problems, logging and errors (`grok s observe`, alias `grok s o`)
 
 Thin commands over the server's routes; `grok s observe` with no command prints every verb and option.
@@ -506,6 +522,7 @@ grok s o problems list --alert-status open                 # the open alerts; --
 grok s o problems get 'health:Jupyter@<server>'            # by id or kind:key; history <id> for its records
 grok s o problems status connection:<connection id> --data '{"status": "muted", "reason": "maintenance", "until": "2026-10-04T06:00:00Z"}'
 grok s o problems ack 'health:Jupyter@<server>' --reason x  # resolve <id> --reason ... closes the alert
+grok s o problems severity dashboard:<project id> critical --reason 'board meeting'   # pin; none unpins
 grok s o rules get > rules.json                             # Settings > Alerts problem rules; rules put --json rules.json
 grok s o rules test                                         # evaluates the saved rules once, now
 grok s o logger get exportSettings                          # the logger settings, or one path of them
@@ -525,16 +542,67 @@ grok s o logs archive list --prefix cw/ --since 1d           # keys in the log a
 grok s o logs archive read <key>                             # one archived object decoded to events
 grok s o logs container                                      # docker containers and their status
 grok s o logs container scripting-python_1 --since 1h --grep 'Kernel (started|shutdown)'   # one container's log lines
+grok s o logs match 'level in (error, warning) and not text ~ ResizeObserver' --since 2h   # what a log filter matches
+grok s o logs match --level error --package Chembl --grep 'time(d )?out'   # flags add conditions joined by and; --grep is a regex
+grok s o logs match --level audit --space Chem   # audit of entities in the Chem space and its subspaces (case-sensitive)
+grok s o logs match 'space startsWith Chem: or space endsWith :Assays'   # space: the entity's space path; = ~ =~ startsWith endsWith
+grok s o groups                                             # log groups (Settings > Logger): name, kind, levels, filter, where to
+grok s o groups add --name Chembl --levels error,warning --filter 'package = Chembl' --to db,grafana:otlp
+grok s o groups set Chembl --when 'level = error and package = Chembl' --scope session --for 15m --before 60s --flags db
+grok s o groups set Chembl --enabled false                  # only the flags given change; groups rm Chembl deletes it
+grok s o groups put --json groups.json                      # replace every log group (the GROK_PARAMETERS settings.logger.logGroups shape)
+grok s o groups reset                                       # back to the default groups; the audit group can only be switched off, not removed
+grok s o endpoints                                          # where groups can send records; endpoints rm grafana
+grok s o logs activations                                   # triggered groups on now; logs activations stop <group id> <key>
 ```
 
 Problems need `ManageAlerts`, errors, another session's timeline and `logs cloud`/`logs archive` `ViewTelemetry`,
-`rules test` both, logger and rules changes and `logs capture` `EditPluginsSettings`. `capture` is an expiring
+`rules test` both, logger and rules changes, `groups`/`endpoints` changes, `logs activations stop` and `logs capture`
+`EditPluginsSettings`; `logs match` and `logs activations` need `ViewTelemetry`, and changing the audit group or an
+endpoint it sends to also needs `EditAuditLogging`. `logs match` takes the whole filter as one quoted argument; `--grep`
+is a regex and `--space` matches the space and its subspaces, both case-sensitive, as `=~` is. `groups add|set|rm`
+need a server that returns its default log groups; on an older one, replace them all with `groups put`. `capture` is an expiring
 `userGroupSettings` entry with `saveHttpRequests` on (seeded from the All Users entry, with `usage` saved); on an entry
 that already expires later it keeps that time. `capture stop` removes only an expiring entry that holds nothing but the
 capture; for any other entry use `logger set --user <login> --remove`. Read what it recorded with
 `timeline --session <id>`. `logs container` reads the container's latest `--limit` lines (20000) and only then cuts `--since`/`--from`/`--to` (UTC, matched across the container's own offset) and `--grep`, so a window older than those lines comes back empty: raise `--limit`. `logs archive list --since` filters only the page the server returned (`--limit`), so narrow
 the listing with `--prefix` first. `logs` read with the server's AWS role, or with `--connection <id>`. In durations `m` means minutes (in `grok s pull --since` it means months).
 
+### Logging one command (`--log`)
+
+`logger set --user` changes what a user logs for a while; `--log` makes the server keep what the
+requests of one command log, and prints it at the end. It works on every `grok s` command, `grok s o`
+included:
+
+```bash
+grok s functions run UsageAnalysis:Groups --log                # verbose: every level
+grok s functions run UsageAnalysis:Groups --log verbose,db     # and every SQL statement (the db debug flag)
+grok s users list --log debug,storage,credentials              # levels and flags; flags alone add debug
+grok s functions run 'MyPkg:MyQuery()' --debug                 # the query's own debug log, plus errors and warnings
+grok s users list --log --output json 2>log.jsonl              # one JSON object per record
+```
+
+Every request of the command carries one `datlas-log-id` (a new UUID per command) and the spec in
+`datlas-log`. A command is often several requests, and each can land on a different isolate and
+server instance: each keeps what its request logged at the spec in memory, in a buffer for that id.
+Those records never reach the database, the console or a sync destination, and what the server logs
+the usual way does not change. When the command ends, `GET /log/requests/<logId>` gathers the
+buffers from every isolate of every instance over the message queue, hands them over and forgets
+them; the CLI prints them to stderr, so stdout keeps the result. The gather also adds what the
+server saved the usual way for the command's session at the levels of the spec (errors, warnings, audit),
+skipping copies of records it already has, so an instance that died before it could answer still
+shows its saved errors. A buffer nobody gathers is dropped after an hour. No permission is needed; another user's id takes `ViewTelemetry`.
+`grok s o logs request <logId>` gathers one id by hand.
+
+The spec is comma-separated: `verbose`, `standard`, the levels (`error`, `warning`, `info`, `debug`,
+`audit`, `usage`) and the debug flags of the logger settings (`db`, `socket`, `storage`, `credentials`,
+`docker`, `auth`, ... or `all`).
+
+`functions run --debug` sends `?debug=true`: the call runs as a debug call (not cached), the way the
+query debugger in the UI runs it, and its own log (connection, the query's stages) is kept with the
+rest; without `--log` the spec is `error,warning`. Only what runs in Datlas is kept: a script that
+runs on a queue worker adds nothing here.
+
 ## Describing an entity type
 
 ```bash

package/README.md

@@ -151,3 +151,17 @@ For more information on configuring connections, refer to the [Connections](http
   | debug          | Sets a debug breakpoint before each test execution, allowing you to debug the test. Only works in `gui` mode                          |
 
 - `link` command is used for public plugins development to link `datagrok-api` and libraries.
+- `connect-folder` makes a local folder a Datagrok connection. A folder agent in Docker dials out to the server (no
+  inbound port) with a key of its own that can only serve this folder; your keypair (`grok login <server>` first)
+  never leaves the machine. Connecting the same folder again resumes the same connection. Requires Docker and the
+  "Connect local folders" permission.
+
+  ```shell
+  grok connect-folder <folder> [--host <alias>] [--read-only] [--foreground] [--image <ref>] [--force]
+  grok connect-folder list [--host <alias>] [--output json]
+  grok connect-folder start|stop|logs <connection> [-f]
+  grok connect-folder rm <connection>
+  ```
+
+  `<connection>` is the connection name, a connection id prefix (8+ characters), or the folder. `stop` keeps the
+  folder disconnected after a reboot; `rm` removes the container, the key and the connection.

package/bin/commands/api.js

@@ -26,18 +26,28 @@ const dbUiFile = 'db-ui.ts';
  * (u2 is a relative-path dependency without a `dg` subpath export). */
 const emsDgModule = '@datagrok-libraries/ems/src/dg';
 
-/** Naive English plural of a (snake_case) table name — `issue` → `issues`, `box` →
- * `boxes`, `category` → `categories`. */
+/** The platform's `StringUtils.toSingular` (ddt utils.dart): regular forms only; a noun already
+ * singular in `-is`/`-us`/`-ss` passes through. */
+function singularizeTableName(name) {
+  if (name.length <= 2 || !name.endsWith('s') || /(ss|is|us)$/.test(name)) return name;
+  if (name.endsWith('ies') && name.length > 3) return name.slice(0, -3) + 'y';
+  return /(xes|zzes|ches|shes|sses|tuses)$/.test(name) ? name.slice(0, -2) : name.slice(0, -1);
+}
+
+/** The platform's `StringUtils.toPlural` (ddt utils.dart) — `issue` → `issues`, `box` →
+ * `boxes`, `category` → `categories`, `analysis` → `analyses`. */
 function pluralizeTableName(name) {
+  if (name.endsWith('is')) return name.slice(0, -2) + 'es';
   if (/(s|x|z|ch|sh)$/.test(name)) return name + 'es';
-  if (/[^aeiou_]y$/.test(name)) return name.slice(0, -1) + 'ies';
+  if (/[^aeiou]y$/.test(name)) return name.slice(0, -1) + 'ies';
   return name + 's';
 }
 
 /** The camelCase plural property name a table gets on the schema client and under the
- * schema handle's `tables` (`issue_label` → `issueLabels`). */
+ * schema handle's `tables` (`issue_label` → `issueLabels`, `categories` → `categories`): the
+ * plural of the singular, as the platform derives a table's plural name. */
 function tableProp(tableName) {
-  return utils.snakeToCamelCase(pluralizeTableName(tableName), false);
+  return utils.snakeToCamelCase(pluralizeTableName(singularizeTableName(tableName)), false);
 }
 const domainSchemaPath = _path.default.join(_path.default.dirname(_path.default.dirname(__dirname)), 'domain-schema.schema.json');
 /** The platform's own schema, whose tables a qualified ref may target (`Core.users`, ...). */
@@ -277,7 +287,9 @@ function generateDomainSchemaCode(manifest, manifestPath, emittedTypes, packageD
   // different sets fall back to a `<alias><PascalTable>` name (deterministic).
   const choicesAliases = {};
   const choicesAlias = (tableName, columnName, values) => {
-    const valueSet = values.map(v => `'${v}'`).join(' | ');
+    // JSON.stringify escapes every special character; inside single quotes only ' needs one more
+    const literals = values.map(v => `'${JSON.stringify(v).slice(1, -1).replace(/'/g, `\\'`)}'`);
+    const valueSet = literals.join(' | ');
     let alias = utils.snakeToCamelCase(tableName) + utils.snakeToCamelCase(columnName);
     if (choicesAliases[alias] !== undefined && choicesAliases[alias] !== valueSet) alias += utils.snakeToCamelCase(tableName);
     if (choicesAliases[alias] !== undefined && choicesAliases[alias] !== valueSet) {
@@ -286,7 +298,7 @@ function generateDomainSchemaCode(manifest, manifestPath, emittedTypes, packageD
     }
     if (choicesAliases[alias] === undefined) {
       choicesAliases[alias] = valueSet;
-      decls.push(wrapTokens(`export type ${alias} = `, values.map(v => `'${v}'`), ' | ', ';'));
+      decls.push(wrapTokens(`export type ${alias} = `, literals, ' | ', ';'));
     }
     return alias;
   };
@@ -364,6 +376,7 @@ function generateDomainSchemaCode(manifest, manifestPath, emittedTypes, packageD
         insertType: column.type === 'datetime' ? 'Dayjs | string' : tsType,
         required: column.required === true,
         autoNumber: column.autoNumber != null,
+        hasDefault: column.default != null,
         ref: ref
       });
       return true;
@@ -380,6 +393,7 @@ function generateDomainSchemaCode(manifest, manifestPath, emittedTypes, packageD
     }
     return columns;
   }
+  const accessorTables = new Map();
   for (const tableName of tableNames) {
     const typeName = utils.snakeToCamelCase(tableName);
     if (emittedTypes.has(typeName)) {
@@ -387,6 +401,12 @@ function generateDomainSchemaCode(manifest, manifestPath, emittedTypes, packageD
       return null;
     }
     emittedTypes.add(typeName);
+    const accessor = tableProp(tableName);
+    if (accessorTables.has(accessor)) {
+      color.error(`${manifestPath}: tables '${accessorTables.get(accessor)}' and '${tableName}' ` + `both get the accessor '${accessor}' (rename one of them)`);
+      return null;
+    }
+    accessorTables.set(accessor, tableName);
     const columns = collectColumns(tableName, manifest, false);
     if (columns == null) return null;
     tableColumns[tableName] = columns;
@@ -436,7 +456,7 @@ function generateDomainSchemaCode(manifest, manifestPath, emittedTypes, packageD
     rowLines.push('}');
     decls.push(rowLines.join(sep));
     const insertLines = [`/** Insert payload for \`${manifest.name}.${tableName}\`. */`, `export interface ${typeName}Insert {`];
-    for (const c of columns) insertLines.push(`  ${c.name}${c.required ? '' : '?'}: ${c.insertType};`);
+    for (const c of columns) insertLines.push(`  ${c.name}${c.required && !c.hasDefault ? '' : '?'}: ${c.insertType};`);
     for (const r of relations) insertLines.push(`  /** Link set: \`${r.target}\` row ids. */`, `  ${r.name}?: string[];`);
     if (table.idempotency === true) insertLines.push('  idempotencyKey?: string;');
     insertLines.push('}');
@@ -476,6 +496,7 @@ function generateDomainSchemaCode(manifest, manifestPath, emittedTypes, packageD
     }
     decls.push(expandEntries.length === 0 ? `export type ${typeName}Expand = {};` : [`/** Expand keys of \`${manifest.name}.${tableName}\` → fields each adds to the row ` + `(consumed by query()/builder). */`, `export type ${typeName}Expand = {`, ...expandEntries, '};'].join(sep));
     if (!external) txArms.push(`  {op: 'insert'; table: '${tableName}'; ref?: string; values: DG.DomainTxValues<${typeName}Insert>; ` + `onDuplicate?: 'error'} |`, `  {op: 'update'; table: '${tableName}'; id: string; ` + `values: DG.DomainTxValues<${relations.length > 0 ? `${typeName}Update` : `Partial<${typeName}Row>`}>; ` + `expectedVersion?: number} |`, `  {op: 'delete'; table: '${tableName}'; id: string} |`);
+    if (!external && table.softDelete !== false) txArms.push(`  {op: 'restore'; table: '${tableName}'; id: string} |`);
 
     // No datetime config: the client resolves datetime columns from the domain
     // registry itself (the Dayjs typing in <Table>Row stays true for every client).

package/bin/commands/check.js

@@ -13,6 +13,7 @@ exports.checkImportStatements = checkImportStatements;
 exports.checkNpmIgnore = checkNpmIgnore;
 exports.checkPackageFile = checkPackageFile;
 exports.checkSourceMap = checkSourceMap;
+exports.checkU2Usage = checkU2Usage;
 exports.extractExternals = extractExternals;
 var _fs = _interopRequireDefault(require("fs"));
 var _path = _interopRequireDefault(require("path"));
@@ -20,6 +21,7 @@ var _ignoreWalk = _interopRequireDefault(require("ignore-walk"));
 var utils = _interopRequireWildcard(require("../utils/utils"));
 var color = _interopRequireWildcard(require("../utils/color-utils"));
 var _const = require("../utils/const");
+var _child_process = require("child_process");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 const warns = ['Latest package version', 'Datagrok API version should contain', 'is served by the platform'];
 const forbiddenNames = ['function', 'class', 'export'];
@@ -91,6 +93,8 @@ function runChecks(packagePath, soft = false, noExit = false) {
     if (externals) errors.push(...checkImportStatements(packagePath, jsTsFiles, externals));
   }
   errors.push(...checkDatagrokApiImports(packagePath, jsTsFiles));
+  const u2Errors = checkU2Usage(packagePath, json);
+  errors.push(...u2Errors);
   warnings.push(...checkHeavyImports(packagePath, jsTsFiles, _path.default.basename(packagePath)));
   if (!soft) errors.push(...checkSourceMap(packagePath));
   errors.push(...checkNpmIgnore(packagePath));
@@ -111,7 +115,8 @@ function runChecks(packagePath, soft = false, noExit = false) {
   if (errors.length) {
     console.log(`Checking package ${_path.default.basename(packagePath)}...`);
     showError(errors);
-    if (soft || json.version.startsWith('0') || errors.every(w => warns.some(ww => w.includes(ww)))) return true;
+    // the u2 consumer ratchet holds pre-1.0 packages too
+    if (soft || u2Errors.length === 0 && (json.version.startsWith('0') || errors.every(w => warns.some(ww => w.includes(ww))))) return true;
     if (noExit) return false;else process.exit(1);
   }
   color.log(`Checking package ${_path.default.basename(packagePath)}...\t\t\t\u2713 OK`);
@@ -213,6 +218,43 @@ function checkDatagrokApiImports(packagePath, files) {
   }
   return errors;
 }
+
+/** u2's consumer check for a package built on u2 or ems: the u2 lint rules and the shrink-only counts of
+ * `consumers-baseline.json`. Prints the ratchet line; growth and enforced rules are errors. */
+function checkU2Usage(packagePath, json) {
+  const deps = {
+    ...json.dependencies,
+    ...json.devDependencies
+  };
+  if (!('@datagrok-libraries/u2' in deps) && !('@datagrok-libraries/ems' in deps)) return [];
+  let script;
+  try {
+    script = _path.default.join(_path.default.dirname(require.resolve('@datagrok-libraries/u2/package.json', {
+      paths: [packagePath]
+    })), 'scripts', 'check-consumer.mjs');
+  } catch {
+    return [];
+  }
+  if (!_fs.default.existsSync(script)) return [];
+  const run = (0, _child_process.spawnSync)(process.execPath, [script, packagePath, '--json'], {
+    encoding: 'utf-8',
+    maxBuffer: 64 * 1024 * 1024,
+    timeout: 300000
+  });
+  let report;
+  try {
+    report = JSON.parse(run.stdout);
+  } catch {
+    return [`u2 consumer check could not run: ${(run.stderr || run.stdout || String(run.error)).trim()}`];
+  }
+  const errors = [];
+  for (const tree of report.trees) {
+    for (const line of tree.summary) console.log(line);
+    for (const note of tree.notes) color.log(`  ${note}`, 'warn');
+    errors.push(...tree.problems);
+  }
+  return errors;
+}
 function checkHeavyImports(packagePath, files, packageName = '') {
   const warnings = [];
   const isTestPackage = /tests?$/i.test(packageName);