flagrm 0.1.0

package/dist/core/scan.js

@@ -0,0 +1,201 @@
+import path from "node:path";
+import fg from "fast-glob";
+export const BACKEND_GLOBS = [
+    "**/*.cs",
+    "**/*.cshtml",
+    "**/*.razor",
+    "**/appsettings*.json",
+    // Generated EF Core migration metadata: often most of a solution's C# by size, and never flag logic.
+    "!**/Migrations/*.Designer.cs",
+    "!**/Migrations/*ModelSnapshot.cs",
+];
+export const FRONTEND_GLOBS = ["**/*.ts", "**/*.html"];
+export const IGNORE_GLOBS = [
+    "**/node_modules/**",
+    "**/bin/**",
+    "**/obj/**",
+    "**/dist/**",
+    "**/coverage/**",
+    "**/.angular/**",
+    "**/.git/**",
+];
+/** Absolute paths with the platform's separators (fast-glob returns `/` on Windows too), so they match `path.join`. */
+export function listProjectFiles(root, globs, overrides) {
+    const patterns = [...globs, ...(overrides?.include ?? [])];
+    const ignore = [...IGNORE_GLOBS, ...(overrides?.exclude ?? [])];
+    return fg.sync(patterns, { cwd: root, ignore, absolute: true, dot: false }).map((file) => path.normalize(file));
+}
+export function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Build the regex fragment for a configured method-name entry. An entry may
+ * pin a specific generic argument (`"GetValue<bool>"`, matching only that
+ * exact instantiation) or be a bare name (`"IsEnabled"`, matching an optional
+ * generic argument list of any shape — `Foo(...)` or `Foo<T>(...)`).
+ */
+export function methodNamePattern(entry) {
+    const m = /^([\w.]+)\s*<\s*([^>]+)\s*>$/.exec(entry.trim());
+    if (m) {
+        const [, name, generic] = m;
+        return `${escapeRegExp(name)}\\s*<\\s*${escapeRegExp(generic.trim())}\\s*>`;
+    }
+    return `${escapeRegExp(entry)}\\s*(?:<[^>]*>\\s*)?`;
+}
+/**
+ * Whether a file (relative to its project root) is test code: `*.spec.ts`/
+ * `*.test.ts`, `*Tests.cs`, `*_test.go`, `test_*.py`/`*_test.py`,
+ * `*Test.java`/`*Tests.kt`, `*_spec.rb`, or anything under a `test`/`tests`
+ * directory or a `*.Tests`/`*-tests` project directory.
+ */
+export function isTestPath(relativePath) {
+    return (/\.(?:spec|test)\.[cm]?[jt]sx?$/.test(relativePath) ||
+        /Tests?\.(?:cs|java|kt)$/.test(relativePath) ||
+        /_test\.(?:go|py)$/.test(relativePath) ||
+        /(?:^|[\\/])test_[^\\/]*\.py$/.test(relativePath) ||
+        /_spec\.rb$/.test(relativePath) ||
+        /(?:^|[\\/])(?:[^\\/]*[.\-_])?tests?[\\/]/i.test(relativePath));
+}
+const SLASH_COMMENT_EXTENSIONS = new Set([
+    ".cs",
+    ".ts",
+    ".tsx",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".cjs",
+    ".go",
+    ".java",
+    ".kt",
+    ".kts",
+    ".scala",
+    ".swift",
+    ".rs",
+    ".c",
+    ".h",
+    ".cc",
+    ".cpp",
+    ".hpp",
+    ".dart",
+    ".php",
+]);
+const HASH_COMMENT_EXTENSIONS = new Set([
+    ".py",
+    ".rb",
+    ".sh",
+    ".bash",
+    ".yaml",
+    ".yml",
+    ".toml",
+    ".properties",
+    ".ini",
+    ".cfg",
+    ".conf",
+    ".tf",
+    ".ex",
+    ".exs",
+]);
+/** Key/value config formats: their `key:` / `key=` lines configure things rather than run code. */
+const KEY_VALUE_EXTENSIONS = new Set([".yaml", ".yml", ".toml", ".properties", ".ini", ".cfg", ".conf"]);
+/** A file's lowercased base name and extension, and whether it is a `.env` file. */
+function fileName(file) {
+    const base = file.slice(Math.max(file.lastIndexOf("/"), file.lastIndexOf("\\")) + 1).toLowerCase();
+    const dot = base.lastIndexOf(".");
+    return { ext: dot === -1 ? "" : base.slice(dot), isEnv: base === ".env" || base.startsWith(".env.") };
+}
+/** The comment syntax of a file, by extension (or `.env` name); undefined when flagrm doesn't know it (HTML, JSON, ...). */
+export function commentSyntax(file) {
+    const { ext, isEnv } = fileName(file);
+    if (isEnv)
+        return "hash";
+    if (SLASH_COMMENT_EXTENSIONS.has(ext))
+        return "slash";
+    if (HASH_COMMENT_EXTENSIONS.has(ext))
+        return "hash";
+    return undefined;
+}
+/** YAML, TOML, properties, ini/cfg/conf and `.env` files: key/value config that the code scan reads as plain text. */
+export function isKeyValueConfig(file) {
+    const { ext, isEnv } = fileName(file);
+    return isEnv || KEY_VALUE_EXTENSIONS.has(ext);
+}
+/** Character classes of {@link computeLexicalMask}. */
+export const LEX_CODE = 0;
+export const LEX_COMMENT = 1;
+export const LEX_STRING = 2;
+/**
+ * Classify every character as code, comment or string (quotes included), for
+ * `//`-style or `#`-style languages. `'`, `"` and `` ` `` open strings that end
+ * at the line's end (only backtick strings span lines), so a quote the lexer
+ * misreads (a regex literal such as `/"/`) mislabels one line, not the rest of
+ * the file. Multi-line strings: in `#` languages `"""` and `'''` (Python); in
+ * `//` languages C# raw `"""` strings and verbatim `@"..."` strings, where
+ * `""` is an escaped quote.
+ */
+export function computeLexicalMask(text, syntax) {
+    const mask = new Uint8Array(text.length);
+    const fill = (from, to, cls) => mask.fill(cls, from, Math.min(to, text.length));
+    let i = 0;
+    while (i < text.length) {
+        const c = text[i];
+        const next = text[i + 1];
+        if ((syntax === "slash" && c === "/" && next === "/") || (syntax === "hash" && c === "#")) {
+            const end = text.indexOf("\n", i);
+            const stop = end === -1 ? text.length : end;
+            fill(i, stop, LEX_COMMENT);
+            i = stop;
+        }
+        else if (syntax === "slash" && c === "/" && next === "*") {
+            const end = text.indexOf("*/", i + 2);
+            const stop = end === -1 ? text.length : end + 2;
+            fill(i, stop, LEX_COMMENT);
+            i = stop;
+        }
+        else if (text.startsWith('"""', i) || (syntax === "hash" && text.startsWith("'''", i))) {
+            const end = text.indexOf(text.slice(i, i + 3), i + 3);
+            const stop = end === -1 ? text.length : end + 3;
+            fill(i, stop, LEX_STRING);
+            i = stop;
+        }
+        else if (syntax === "slash" &&
+            (text.startsWith('@"', i) || text.startsWith('$@"', i) || text.startsWith('@$"', i))) {
+            const start = i;
+            i = text.indexOf('"', i) + 1;
+            while (i < text.length && !(text[i] === '"' && text[i + 1] !== '"'))
+                i += text[i] === '"' ? 2 : 1;
+            fill(start, i + 1, LEX_STRING);
+            i++;
+        }
+        else if (c === '"' || c === "'" || c === "`") {
+            mask[i++] = LEX_STRING;
+            while (i < text.length && text[i] !== c && (c === "`" || text[i] !== "\n")) {
+                if (text[i] === "\\")
+                    mask[i++] = LEX_STRING;
+                if (i < text.length)
+                    mask[i++] = LEX_STRING;
+            }
+            if (i < text.length && text[i] === c)
+                mask[i++] = LEX_STRING;
+        }
+        else {
+            i++;
+        }
+    }
+    return mask;
+}
+/** 1 where {@link computeLexicalMask} finds code, 0 in comments and strings. */
+export function computeCodeMask(text, syntax = "slash") {
+    return computeLexicalMask(text, syntax).map((c) => (c === LEX_CODE ? 1 : 0));
+}
+/**
+ * Comment mask (0 = inside a comment, 1 = anything else, strings included) for
+ * a file whose comment syntax flagrm knows, otherwise null.
+ */
+export function commentMaskFor(file, text) {
+    const syntax = commentSyntax(file);
+    return syntax ? computeCommentMask(text, syntax) : null;
+}
+/** 0 where {@link computeLexicalMask} finds a comment, 1 elsewhere. */
+export function computeCommentMask(text, syntax = "slash") {
+    return computeLexicalMask(text, syntax).map((c) => (c === LEX_COMMENT ? 0 : 1));
+}

package/dist/core/source-text.js

@@ -0,0 +1,36 @@
+/** A file's LF-normalized text with offset → line mapping. */
+export class SourceText {
+    file;
+    text;
+    lineStarts = [0];
+    constructor(file, text) {
+        this.file = file;
+        this.text = text;
+        for (let i = 0; i < text.length; i++)
+            if (text[i] === "\n")
+                this.lineStarts.push(i + 1);
+    }
+    /** 1-based line and column of an offset. */
+    position(offset) {
+        let lo = 0;
+        let hi = this.lineStarts.length - 1;
+        while (lo < hi) {
+            const mid = (lo + hi + 1) >> 1;
+            if (this.lineStarts[mid] <= offset)
+                lo = mid;
+            else
+                hi = mid - 1;
+        }
+        return { line: lo + 1, column: offset - this.lineStarts[lo] + 1 };
+    }
+    /** Trimmed text of the line containing `offset`, capped at 160 characters. */
+    snippet(offset) {
+        const { line } = this.position(offset);
+        const start = this.lineStarts[line - 1];
+        const next = this.lineStarts[line];
+        return this.text
+            .slice(start, next === undefined ? this.text.length : next - 1)
+            .trim()
+            .slice(0, 160);
+    }
+}

package/dist/core/text-utils.js

@@ -0,0 +1,27 @@
+/**
+ * Text utilities shared by discovery and scanning: line endings and bracket
+ * matching. Masks are in scan.ts, offset-to-line lookup in source-text.ts.
+ */
+/** Strip `\r` before `\n` so downstream logic can assume bare `\n`. */
+export function toLf(text) {
+    return text.includes("\r\n") ? text.replace(/\r\n/g, "\n") : text;
+}
+/**
+ * Find the index of the bracket matching the one at `openIndex`.
+ * Only characters where mask[i] === 1 are considered. Returns -1 when unbalanced.
+ */
+export function matchBracket(text, mask, openIndex, open, close) {
+    let depth = 0;
+    for (let i = openIndex; i < text.length; i++) {
+        if (!mask[i])
+            continue;
+        if (text[i] === open)
+            depth++;
+        else if (text[i] === close) {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}

package/dist/core/types.js

@@ -0,0 +1,22 @@
+/**
+ * Bumped whenever a `--json` payload shape changes in a way that could break
+ * a consumer (field renamed/removed, meaning of an existing field changed).
+ * Purely additive fields don't require a bump.
+ *
+ * - 2: `project` on every candidate and result is the configured project name.
+ * - 3: agent-first release. `inspect`, `scan`, `fold` and `report` are gone;
+ *   the baseline is written by `flagrm baseline` and holds only the git state and
+ *   build/test runs; `verify` runs the `dead-code`, `build` and `tests` checks,
+ *   and tests that no longer run are listed as `removed`.
+ * - 4: the baseline records the flag's `names`; `verify` adds the `leftovers`
+ *   check and reports `fingerprint` and `changedFiles`.
+ * - 5: `verify` reports `runs[].results` as counts only (no `names` or
+ *   `failedNames`: the comparison is in `tests`, failed tests in the findings),
+ *   and one `tests` warning for all tests that no longer run.
+ * - 6: `verify` reports `skipped`, the checks `--skip` left out.
+ */
+export const JSON_SCHEMA_VERSION = 6;
+// ---------------------------------------------------------------------------
+// verify
+// ---------------------------------------------------------------------------
+export const CHECK_IDS = ["leftovers", "dead-code", "build", "tests"];

package/dist/core/util.js

@@ -0,0 +1,18 @@
+/** Small helpers shared across flagrm's modules. */
+import fs from "node:fs";
+import path from "node:path";
+/** `1 flag`, `2 flags`; `many` for irregular plurals. */
+export const plural = (n, word, many = `${word}s`) => `${n} ${n === 1 ? word : many}`;
+/** `file` relative to `from`, with `/` separators on every platform. */
+export function relativePath(from, file) {
+    return path.relative(from, file).split(path.sep).join("/");
+}
+/** A JSON file's parsed content, or undefined when it is missing or not valid JSON. */
+export function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/core/verify/commands.js

@@ -0,0 +1,166 @@
+/**
+ * The `build` and `tests` checks: the configured commands must exit 0. Tests
+ * that no longer run are listed for the agent to account for: deleting the
+ * tests of the OFF path is part of removing a flag, losing any other test is not.
+ * A changed test file none of whose tests ran is a warning too: the test
+ * command doesn't cover it, so verify didn't check the edit.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { errorExcerpt, templateCheckGap } from "../baseline.js";
+import { escapeRegExp, isTestPath } from "../scan.js";
+import { relativePath } from "../util.js";
+import { checkResult, plural, skippedResult } from "./context.js";
+import { diffTestNames } from "./test-results.js";
+function failedRunFindings(run) {
+    const findings = [
+        {
+            severity: "fail",
+            message: `\`${run.command}\` exited with ${run.exitCode} (log: ${run.log})`,
+            project: run.project,
+            file: run.log,
+        },
+    ];
+    for (const line of errorExcerpt(run.log))
+        findings.push({ severity: "info", message: line, project: run.project });
+    return findings;
+}
+export function buildCheck(v) {
+    const runs = v.runs.filter((r) => r.check === "build");
+    if (runs.length === 0)
+        return skippedResult("build", "no build command configured");
+    const findings = runs.flatMap((r) => (r.exitCode === 0 ? [] : failedRunFindings(r)));
+    for (const run of runs) {
+        const project = v.projects.find(({ ctx }) => ctx.name === run.project);
+        const gap = project && templateCheckGap(project.adapter, run.command);
+        if (!gap)
+            continue;
+        const templates = (v.changedFiles ?? [])
+            .filter((rel) => rel.endsWith(".html"))
+            .filter((rel) => !path.relative(project.ctx.root, path.join(v.root, rel)).startsWith(".."));
+        if (templates.length)
+            findings.push({ severity: "warn", message: gap, project: run.project });
+    }
+    const failed = runs.filter((r) => r.exitCode !== 0).length;
+    const summary = failed
+        ? `${plural(failed, "build")} failed`
+        : `${runs.map((r) => r.project).join(", ")} built successfully`;
+    return checkResult("build", summary, findings);
+}
+export function compareTests(v) {
+    const out = [];
+    for (const run of v.runs.filter((r) => r.check === "test")) {
+        const before = v.baseline.checks?.find((c) => c.project === run.project && c.check === "test")?.results;
+        const after = run.results;
+        const comparison = {
+            project: run.project,
+            before: before?.total,
+            after: after?.total,
+            removed: [],
+            added: [],
+        };
+        if (before && after)
+            Object.assign(comparison, diffTestNames(before.names, after.names));
+        out.push(comparison);
+    }
+    return out;
+}
+export function testsCheck(v, comparisons) {
+    const runs = v.runs.filter((r) => r.check === "test");
+    if (runs.length === 0)
+        return skippedResult("tests", "no test command configured");
+    const findings = [];
+    for (const run of runs) {
+        if (run.exitCode !== 0) {
+            findings.push(...failedRunFindings(run).slice(0, 1));
+            for (const name of run.results?.failedNames.slice(0, 20) ?? []) {
+                findings.push({ severity: "info", message: `failed: ${name}`, project: run.project });
+            }
+        }
+        const ctx = v.projects.find(({ ctx }) => ctx.name === run.project)?.ctx;
+        const project = ctx?.project;
+        const comparison = comparisons.find((c) => c.project === run.project);
+        if (project?.testResults && !run.results) {
+            findings.push({
+                severity: "warn",
+                message: `no test results found at ${project.testResults}, so the test count was not compared`,
+                project: run.project,
+            });
+        }
+        else if (run.results && comparison?.before === undefined) {
+            findings.push({
+                severity: "info",
+                message: "the baseline has no test results to compare with (run `flagrm baseline` before the removal)",
+                project: run.project,
+            });
+        }
+        const removed = comparison?.removed.length ?? 0;
+        if (removed) {
+            findings.push({
+                severity: "warn",
+                message: `${plural(removed, "test no longer runs", "tests no longer run")} (fine if they only covered the OFF path or were renamed; say so in the PR)`,
+                project: run.project,
+            });
+        }
+        if (run.results && ctx) {
+            for (const file of changedTestFiles(v, ctx.root)) {
+                if (testFileRan(file, ctx.root, run.results.names))
+                    continue;
+                findings.push({
+                    severity: "warn",
+                    message: "changed, but none of its tests ran, so verify didn't check it: run them yourself or widen the project's `test` command",
+                    project: run.project,
+                    file,
+                });
+            }
+        }
+    }
+    const counts = comparisons
+        .filter((c) => c.after !== undefined)
+        .map((c) => (c.before === undefined ? `${c.project} ${c.after}` : `${c.project} ${c.before} → ${c.after}`));
+    const failed = runs.filter((r) => r.exitCode !== 0).length;
+    const summary = [
+        failed ? `${plural(failed, "test run")} failed` : "tests passed",
+        counts.length ? `(${counts.join(", ")})` : undefined,
+    ]
+        .filter(Boolean)
+        .join(" ");
+    return checkResult("tests", summary, findings);
+}
+/** Absolute paths of test files under `root` changed since the baseline that still exist. */
+function changedTestFiles(v, root) {
+    return (v.changedFiles ?? [])
+        .map((rel) => path.join(v.root, rel))
+        .filter((file) => !path.relative(root, file).startsWith(".."))
+        .filter((file) => isTestPath(path.relative(root, file)) && fs.existsSync(file));
+}
+/**
+ * Whether any of a test file's tests are among the names in the test results.
+ * Result formats don't reliably record the source file, so this matches what
+ * the names do carry: the file path (Vitest), the class named after the file
+ * (xUnit/NUnit/JUnit, qualified by the file's namespace or package when it
+ * declares one, so a unit and an integration test class of the same name
+ * aren't confused), the first `describe` title (Jest, Karma), or a
+ * `TestX`/`test_x` function name (Go, pytest).
+ */
+export function testFileRan(file, root, names) {
+    const rel = relativePath(root, file);
+    const base = path.basename(file).replace(/\.[^.]+$/, "");
+    let text;
+    try {
+        text = fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return true;
+    }
+    const keys = [rel];
+    const describe = /\b(?:describe|suite|context)(?:\.\w+)?\s*\(\s*(["'`])((?:(?!\1).)+)\1/.exec(text)?.[2];
+    if (describe)
+        keys.push(describe);
+    for (const m of text.matchAll(/\bfunc (Test\w+)|\bdef (test_\w+)/g))
+        keys.push(m[1] ?? m[2]);
+    const ns = /^\s*(?:namespace|package)\s+([\w.]+)/m.exec(text)?.[1];
+    const qualified = ns ? `${ns}.${base}` : base;
+    const className = new RegExp(`(?:^|[./\\\\ ])${escapeRegExp(qualified)}(?:[./\\\\ ]|$)`);
+    return names.some((name) => className.test(name) || keys.some((key) => name.includes(key)));
+}

package/dist/core/verify/context.js

@@ -0,0 +1,13 @@
+/** A check's status is the worst severity among its findings. */
+export function checkResult(id, summary, findings) {
+    const status = findings.some((f) => f.severity === "fail")
+        ? "fail"
+        : findings.some((f) => f.severity === "warn")
+            ? "warn"
+            : "pass";
+    return { id, status, summary, findings };
+}
+export function skippedResult(id, summary, findings = []) {
+    return { id, status: "skipped", summary, findings };
+}
+export { plural } from "../util.js";

package/dist/core/verify/dead-code.js

@@ -0,0 +1,92 @@
+/**
+ * The `dead-code` check: compiler unused-code diagnostics in the changed
+ * files that the baseline did not have (fail; warn when the adapter cannot
+ * tell which ones are new).
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileAt } from "../git.js";
+import { checkResult, plural, skippedResult } from "./context.js";
+export function deadCodeCheck(v) {
+    const { findings, summary, analyzed } = compilerFindings(v);
+    // A check that did not look at every changed file must not read as a pass (a found diagnostic still fails it).
+    if (!analyzed && !findings.some((f) => f.severity === "fail" || f.severity === "warn")) {
+        return skippedResult("dead-code", summary, findings);
+    }
+    return checkResult("dead-code", summary, findings);
+}
+function compilerFindings(v) {
+    const sha = v.baseline.git.sha;
+    if (!sha || !v.changedFiles) {
+        const reason = sha
+            ? "the baseline commit is no longer reachable (amended, rebased or garbage-collected)"
+            : "the baseline has no git commit to diff against";
+        return {
+            findings: [{ severity: "info", message: `compiler diagnostics skipped: ${reason}` }],
+            summary: "compiler diagnostics skipped",
+            analyzed: false,
+        };
+    }
+    const findings = [];
+    let count = 0;
+    let supported = false;
+    const unread = [];
+    for (const { adapter, ctx } of v.projects) {
+        if (!adapter.unusedDiagnostics)
+            continue;
+        supported = true;
+        const inProject = new Set(ctx.files);
+        const changedFiles = v.changedFiles
+            .map((rel) => path.join(v.root, rel))
+            .filter((file) => inProject.has(file) && fs.existsSync(file));
+        if (changedFiles.length === 0)
+            continue;
+        const readLog = (log) => {
+            try {
+                return log ? fs.readFileSync(log, "utf8") : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        };
+        const buildLog = readLog(v.runs.find((r) => r.project === ctx.name && r.check === "build")?.log);
+        const baselineBuildLog = readLog(v.baseline.checks?.find((r) => r.project === ctx.name && r.check === "build")?.log);
+        const result = adapter.unusedDiagnostics(ctx, {
+            changedFiles,
+            baselineText: (file) => fileAt(v.root, sha, path.relative(v.root, file)),
+            buildLog,
+            baselineBuildLog,
+        });
+        if (!result) {
+            unread.push(ctx.name);
+            findings.push({
+                severity: "info",
+                message: "compiler diagnostics skipped: no build output to read (the build check did not run)",
+                project: ctx.name,
+            });
+            continue;
+        }
+        for (const d of result.diagnostics) {
+            count++;
+            findings.push({
+                severity: result.compared ? "fail" : "warn",
+                message: `${d.code} ${d.message}${result.compared ? "" : " (the baseline has no build log, so it may predate the removal)"}`,
+                project: ctx.name,
+                file: d.file,
+                line: d.line,
+            });
+        }
+    }
+    if (!supported) {
+        return { findings, summary: "compiler diagnostics skipped: no adapter reports unused code here", analyzed: false };
+    }
+    const found = count ? plural(count, "new unused-code diagnostic") : "no new unused-code diagnostics";
+    if (unread.length) {
+        return {
+            findings,
+            summary: `${count ? `${found}; ` : ""}compiler diagnostics skipped for ${unread.join(", ")}: no build output`,
+            analyzed: false,
+        };
+    }
+    return { findings, summary: found, analyzed: true };
+}

package/dist/core/verify/index.js

@@ -0,0 +1,84 @@
+/**
+ * `flagrm verify <flag>`: the pass/fail gate for a removal. It compares the
+ * current tree with the flag's baseline (`flagrm baseline`), runs the checks
+ * and writes `.flagrm/<flag>/verify.json`.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { flagDir, readBaseline, runChecks, verifyPath } from "../baseline.js";
+import { changedFilesSince, gitState, treeFingerprint } from "../git.js";
+import { CHECK_IDS, JSON_SCHEMA_VERSION, } from "../types.js";
+import { buildCheck, compareTests, testsCheck } from "./commands.js";
+import { skippedResult } from "./context.js";
+import { deadCodeCheck } from "./dead-code.js";
+import { leftoversCheck } from "./leftovers.js";
+export async function verifyFlag(root, projects, flag, options = {}) {
+    const { baseline, file: baselineFile } = readBaseline(root, flag);
+    const skip = new Set(options.skip ?? []);
+    // Take the git state before running commands: their output (bin/, test
+    // results) is not part of the change under review.
+    const git = gitState(root);
+    const changedFiles = baseline.git.sha ? changedFilesSince(root, baseline.git.sha) : undefined;
+    const only = [...(skip.has("build") ? [] : ["build"]), ...(skip.has("tests") ? [] : ["test"])];
+    const runs = only.length ? await runChecks(projects, path.join(flagDir(root, flag), "verify"), only) : [];
+    // The fingerprint, though, is the tree the Stop hook will see next, so take it
+    // after the commands: a test report they write outside .gitignore is part of it.
+    const fingerprint = treeFingerprint(root);
+    const v = { root, flag, projects, baseline, changedFiles, runs };
+    const tests = compareTests(v);
+    const run = {
+        "dead-code": () => deadCodeCheck(v),
+        build: () => buildCheck(v),
+        tests: () => testsCheck(v, tests),
+    };
+    const checks = [];
+    for (const id of CHECK_IDS) {
+        if (skip.has(id))
+            checks.push(skippedResult(id, "skipped (--skip)"));
+        else
+            checks.push(id === "leftovers" ? await leftoversCheck(v) : run[id]());
+    }
+    const strict = Boolean(options.strict);
+    const failed = checks.some((c) => c.status === "fail" || (strict && c.status === "warn"));
+    const report = {
+        schemaVersion: JSON_SCHEMA_VERSION,
+        flag,
+        status: failed ? "fail" : "pass",
+        strict,
+        createdAt: new Date().toISOString(),
+        baseline: { file: baselineFile, createdAt: baseline.createdAt, git: baseline.git },
+        git,
+        fingerprint,
+        changedFiles,
+        checks,
+        skipped: CHECK_IDS.filter((id) => skip.has(id)),
+        runs: runs.map(countsOnly),
+        tests,
+    };
+    const file = verifyPath(root, flag);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify(report, null, 2)}\n`, "utf8");
+    return { report, file };
+}
+/** Drop the per-test name lists: thousands of names in a large suite, and `tests` already has the comparison. */
+function countsOnly(run) {
+    if (!run.results)
+        return run;
+    const { names: _names, failedNames: _failed, ...counts } = run.results;
+    return { ...run, results: counts };
+}
+/** Parse `--skip build,tests`; throws on an unknown check name. */
+export function parseSkip(value) {
+    if (!value)
+        return [];
+    const ids = value
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+    for (const id of ids) {
+        if (!CHECK_IDS.includes(id)) {
+            throw new Error(`Unknown check "${id}" in --skip. Checks: ${CHECK_IDS.join(", ")}.`);
+        }
+    }
+    return ids;
+}