pbiplint 0.2.3 → 0.2.4

package/README.md

@@ -4,8 +4,10 @@ Best-practice linter for Power BI projects. Point it at a PBIP folder, a `.pbip`
 `.SemanticModel` folder, a `.Report` folder, a `definition` folder, or one `.tmdl` file and get
 ranked findings with a link to a fix page for each rule, and, when the input has a report, a
 "Report at a glance" block that says what the report will do when someone opens it. Nothing is
-uploaded: it reads the files you name and writes to your terminal. Node 20.19 or later (or 22.12
-or later).
+uploaded: it reads the files you name and writes to your terminal, and
+[the pbiplint Privacy Promise](https://pbiplint.com/privacy/) says what that covers. Node 20.19 or a
+later 20 release, or 22.12 or later. [The pbiplint CLI](https://pbiplint.com/cli/) page on the site has more:
+where to get it, what it reads, and how to check that it sends nothing.
 
 ```bash
 npx pbiplint path/to/Model.SemanticModel
@@ -18,10 +20,19 @@ npx pbiplint --version
 ```
 
 Formats: `text` (default), `json`, `sarif` (for GitHub code scanning and editors), `markdown`.
+The Markdown export writes an email address, an `@name`, a `#123` or `GH-123`, and text
+holding two or more `$` as code, so pasted into a GitHub issue or comment it links no one,
+notifies no one, and renders no math.
 
 Exit codes: `0` no findings at or above `--fail-on`, `1` findings, `2` usage or input error.
 `--fail-on error` is the default; `--fail-on warning` and `--fail-on info` tighten the gate;
-`--fail-on none` always exits 0.
+`--fail-on none` exits 0 on any run that lints something. A run that can read nothing in the input,
+such as a report saved as a single `report.json` (PBIR-Legacy) with no model beside it, exits `2`
+and says why, rather than passing with no findings.
+
+Pointed at a folder that is not a project but holds one in a folder below it, as a repository
+often does, pbiplint lints that project and names it in a notice. A folder that holds several exits
+`2` and lists them, each with the command that lints it.
 
 ## Configuration
 

package/dist/pbiplint.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // ../core/src/version.ts
-var VERSION = "0.2.3";
+var VERSION = "0.2.4";
 
 // ../core/src/engine/config.ts
 var ConfigError = class extends Error {
@@ -2675,13 +2675,13 @@ function buildFacts(project, indexes, knownRules, ruleOptions = /* @__PURE__ */
     const columns2 = shown2.reduce((s, t) => s + t.columns.length, 0);
     const measures = shown2.reduce((s, t) => s + t.measures.length, 0);
     const partly = modelPartlyRead(model);
-    const count = (k, noun) => k === 0 && partly ? `${noun}s: unknown` : n(k, noun);
+    const count2 = (k, noun) => k === 0 && partly ? `${noun}s: unknown` : n(k, noun);
     const countUnknown = partly && [shown2.length, columns2, measures].includes(0);
     const functions = model.functions.length > 0 ? `, ${n(model.functions.length, "function")}` : "";
     const fact = {
       layer: "model",
       label: "Model",
-      value: `${count(shown2.length, "table")}, ${count(columns2, "column")}, ${count(measures, "measure")}${functions}`
+      value: `${count2(shown2.length, "table")}, ${count2(columns2, "column")}, ${count2(measures, "measure")}${functions}`
     };
     const reach = indexes.reachability;
     const unreadModel = "a model file could not be fully read";
@@ -4226,8 +4226,8 @@ var AVOID_EXCESSIVE_BIDIRECTIONAL_OR_MANY_TO_MANY_RELATIONSHIPS = bpaRule(
   { skipWhenModelUnread: modelPartlyRead },
   (m) => {
     const rels = m.relationships;
-    const count = rels.filter(isBidirectional).length + rels.filter(isManyToMany).length;
-    return count / Math.max(rels.length, 1) > 0.3 ? [finding.model(m)] : [];
+    const count2 = rels.filter(isBidirectional).length + rels.filter(isManyToMany).length;
+    return count2 / Math.max(rels.length, 1) > 0.3 ? [finding.model(m)] : [];
   }
 );
 var AVOID_USING_MANY_TO_MANY_RELATIONSHIPS_ON_TABLES_USED_FOR_DYNAMIC_ROW_LEVEL_SECURITY = bpaRule(
@@ -6410,13 +6410,13 @@ function lint(files, options = {}) {
     rules.filter((r) => ran.has(r.id)).map((r) => [r.id, optionsFor(r, config)])
   );
   const facts = buildFacts(project, indexes, ran, ranOptions);
-  const count = (severity) => groups.filter((g) => g.rule.severity === severity).reduce((n2, g) => n2 + g.findings.length, 0);
+  const count2 = (severity) => groups.filter((g) => g.rule.severity === severity).reduce((n2, g) => n2 + g.findings.length, 0);
   const summary = {
     files: routed.model.length + routed.report.length,
     findings: run.findings.length,
-    errors: count(3),
-    warnings: count(2),
-    infos: count(1),
+    errors: count2(3),
+    warnings: count2(2),
+    infos: count2(1),
     rulesRun: run.rulesRun.length,
     rulesSkipped: run.rulesSkipped,
     ruleErrors: run.ruleErrors,
@@ -6464,13 +6464,47 @@ function formatJson(result, options = {}) {
 
 // ../core/src/format/markdown.ts
 var oneLine = (s) => s.replace(/\r\n?|\n/g, " ");
-var text = (s) => showControls(s.replace(/\\/g, "\\\\")).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/[`[\]*_~|@$]/g, "\\$&").replace(/:(?=\/\/)/g, "\\:").replace(/(www)\./gi, "$1\\.");
-var cell = (s) => text(oneLine(s));
-function code(name) {
-  const shown2 = showControls(oneLine(name)).replace(
+var escaped2 = (s) => showControls(s.replace(/\\/g, "\\\\")).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/[`[\]*_~|]/g, "\\$&").replace(/:(?=\/\/)/g, "\\:").replace(/(www)\./gi, "$1\\.");
+function text(s, table) {
+  const math = (s.match(/\$/g) ?? []).length > 1;
+  return s.split(/( +)/).map(
+    (w, i) => i % 2 === 0 && (/@|#\d|\bGH-\d/i.test(w) || math && w.includes("$")) ? spanned(w, table) : escaped2(w)
+  ).join("");
+}
+var ENCLOSING = [
+  ["(", ")"],
+  ['"', '"'],
+  ["'", "'"]
+];
+var count = (s, ch) => s.split(ch).length - 1;
+function spanned(w, table) {
+  let after = /[.,;:!?]+$/.exec(w)?.[0] ?? "";
+  let core = w.slice(0, w.length - after.length);
+  let before = "";
+  if (core.endsWith(")") && count(core, ")") > count(core, "(")) {
+    after = `)${after}`;
+    core = core.slice(0, -1);
+  }
+  if (core.startsWith("(") && count(core, "(") > count(core, ")")) {
+    before = "(";
+    core = core.slice(1);
+  }
+  const pair = ENCLOSING.find(
+    ([o, c]) => core.length > 2 && core.startsWith(o) && core.endsWith(c)
+  );
+  if (before === "" && pair) {
+    before = pair[0];
+    after = pair[1] + after;
+    core = core.slice(1, -1);
+  }
+  return `${escaped2(before)}${code(core, table)}${escaped2(after)}`;
+}
+var cell = (s) => text(oneLine(s), true);
+function code(name, table) {
+  const shown2 = table ? showControls(oneLine(name)).replace(
     /(\\*)\|/g,
     (_, run) => `${run}${run.length % 2 ? "\\" : ""}\\|`
-  );
+  ) : showControls(name);
   const fence = "`".repeat(Math.max(0, ...(shown2.match(/`+/g) ?? []).map((r) => r.length)) + 1);
   const spaced = shown2.startsWith(" ") && shown2.endsWith(" ") && /[^ ]/.test(shown2);
   const pad = shown2.startsWith("`") || shown2.endsWith("`") || spaced ? " " : "";
@@ -6480,10 +6514,10 @@ function formatMarkdown(result, _options = {}) {
   const out = [
     "# pbiplint report",
     "",
-    `${summaryLine(result)}. ${text([layersLine(result), skippedLine(result)].filter(Boolean).join(" "))}.`,
+    `${summaryLine(result)}. ${text([layersLine(result), skippedLine(result)].filter(Boolean).join(" "), false)}.`,
     ""
   ];
-  for (const d of result.diagnostics) out.push(`> Notice: ${text(d.message)}`, "");
+  for (const d of result.diagnostics) out.push(`> Notice: ${text(d.message, false)}`, "");
   if (result.facts.length) {
     out.push("## Report at a glance", "", "| Fact | Value | Rule |", "|---|---|---|");
     for (const f of result.facts)
@@ -6512,7 +6546,7 @@ function formatMarkdown(result, _options = {}) {
     out.push("| Object | Type | Location | Detail |", "|---|---|---|---|");
     for (const f of g.findings)
       out.push(
-        `| ${code(f.objectName)} | ${f.objectType} | ${cell(locationOf(f))} | ${cell(f.detail ?? "")} |`
+        `| ${code(f.objectName, true)} | ${f.objectType} | ${cell(locationOf(f))} | ${cell(f.detail ?? "")} |`
       );
     out.push("");
   }
@@ -6585,11 +6619,15 @@ Read more: ${url}`
   const incomplete = result.diagnostics.filter(
     (d) => d.kind === "depth-cap" || d.kind === "unread-file"
   );
+  const version = options.toolVersion ?? VERSION;
   const run = {
     tool: {
       driver: {
         name: "pbiplint",
-        version: options.toolVersion ?? VERSION,
+        // The name with its version, as SARIF defines fullName. GitHub Advanced Security for Azure
+        // DevOps requires it (rule GHAzDO1018 of Microsoft's SARIF validator).
+        fullName: `pbiplint ${version}`,
+        version,
         informationUri: "https://pbiplint.com",
         rules
       }
@@ -6633,12 +6671,99 @@ function formatResult(name, result, options = {}) {
   }
 }
 
+// ../core/src/project/below.ts
+var isRecord8 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function reportsNamed(text2) {
+  const json = readJson(".pbip", text2).json;
+  if (!isRecord8(json) || !Array.isArray(json.artifacts)) return [];
+  return json.artifacts.flatMap(
+    (a) => isRecord8(a) && isRecord8(a.report) && typeof a.report.path === "string" ? [a.report.path] : []
+  );
+}
+var parentOf = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "";
+function resolveIn(from, to) {
+  const out = from === "" ? [] : from.split("/");
+  for (const segment of to.split(/[\\/]/)) {
+    if (segment === "" || segment === ".") continue;
+    if (segment !== "..") out.push(segment);
+    else if (out.pop() === void 0) return void 0;
+  }
+  return out.join("/");
+}
+function projectsBelow(found) {
+  const parts = [...found.reports.map((r) => r.path), ...found.models];
+  const all = [...found.pbips.map((p) => p.path), ...parts];
+  const at2 = (items, path, written) => written === void 0 ? void 0 : items.find((t) => path(t) === written) ?? items.find((t) => path(t).toLowerCase() === written.toLowerCase());
+  const reportAt = (written) => at2(found.reports, (r) => r.path, written);
+  const modelAt = (written) => at2(found.models, (m) => m, written);
+  const refOf = (report) => report.pbir === void 0 ? { kind: "none" } : datasetReference(report.pbir);
+  const folderOf = (members) => {
+    const dir = parentOf(members[0]);
+    const own = new Set(members);
+    return dir !== "" && dir.split("/").pop() !== "definition" && own.size > 1 && members.every((m) => parentOf(m) === dir) && all.every((p) => parentOf(p) !== dir || own.has(p)) ? dir : void 0;
+  };
+  const taken = /* @__PURE__ */ new Set();
+  const paths = [];
+  for (const pbip of found.pbips) {
+    const dir = parentOf(pbip.path);
+    const named2 = pbip.text === void 0 ? [] : reportsNamed(pbip.text);
+    const members = [pbip.path];
+    if (named2.length === 0) members.push(...parts.filter((p) => parentOf(p) === dir));
+    let beyond = false;
+    for (const written of named2) {
+      const report = reportAt(resolveIn(dir, written));
+      if (!report) continue;
+      const ref = refOf(report);
+      const model = ref.kind === "byPath" ? modelAt(resolveIn(report.path, ref.path)) : void 0;
+      if (ref.kind === "byPath" && model === void 0) beyond = true;
+      members.push(report.path, ...model === void 0 ? [] : [model]);
+    }
+    for (const m of members) taken.add(m);
+    paths.push((beyond ? void 0 : folderOf(members)) ?? pbip.path);
+  }
+  for (const report of found.reports) {
+    if (taken.has(report.path)) continue;
+    const ref = refOf(report);
+    const beside = found.models.filter((m) => parentOf(m) === parentOf(report.path));
+    const model = ref.kind === "byPath" ? modelAt(resolveIn(report.path, ref.path)) : ref.kind === "none" && beside.length === 1 ? beside[0] : void 0;
+    const folder = model === void 0 ? void 0 : folderOf([report.path, model]);
+    if (folder !== void 0) taken.add(model);
+    paths.push(folder ?? report.path);
+  }
+  for (const model of found.models) if (!taken.has(model)) paths.push(model);
+  return paths.sort((a, b) => a.localeCompare(b, "en"));
+}
+function projectBelowNotice(path) {
+  return {
+    kind: "project-below-input",
+    path,
+    message: `${path} is the only project found below the folder given, so it was linted as if given directly`
+  };
+}
+
+// src/log-safe.ts
+var logSafe = (text2) => text2.replace(/(?<=#)#(?=\w*\[)/g, "\\u0023").replace(/^((?:[^\S\n]|\u0085)*):(?=:)/gm, "$1\\u003a");
+
 // src/main.ts
 import { mkdirSync, writeFileSync } from "node:fs";
 import { basename as basename2, dirname as dirname4, relative as relative2, resolve as resolve3 } from "node:path";
 
 // src/args.ts
 var UsageError = class extends Error {
+  #lines;
+  constructor(message, lines = []) {
+    super(message);
+    this.#lines = lines;
+  }
+  /**
+   * What the message introduces, such as a list, one line each. main prints each on a line of its
+   * own, its control characters shown, so nothing in one can write a line that reads as the CLI's.
+   * A getter, so a usage error still compares equal to an Error with its message, as tests compare
+   * them.
+   */
+  get lines() {
+    return this.#lines;
+  }
 };
 var FAIL_ON = ["error", "warning", "info", "none"];
 function parseArgs(argv) {
@@ -6722,6 +6847,7 @@ violations. Either part alone is fine. Nothing is uploaded.
 
 Exit codes: 0 no findings at or above --fail-on, 1 findings, 2 usage or input error.
 Rule pages: https://pbiplint.com/rules/
+The pbiplint Privacy Promise: https://pbiplint.com/privacy/
 `;
 
 // src/config.ts
@@ -14577,7 +14703,6 @@ var statOf = (p) => statSync(p, { throwIfNoEntry: false });
 var isDir = (p) => statOf(p)?.isDirectory() ?? false;
 var isFile = (p) => statOf(p)?.isFile() ?? false;
 var byName = (a, b) => a.localeCompare(b, "en");
-var isRecord8 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function folderAt(p) {
   try {
     const stat = statOf(p);
@@ -14639,6 +14764,13 @@ function attempt(w, p, call, part, folder = false) {
     return void 0;
   }
 }
+var LEGACY_NOTICE = { model: legacyModelNotice, report: legacyReportNotice };
+function legacyPart(w, layer, folder) {
+  const path = toPosix(relative(w.base, folder));
+  w.project.diagnostics.push(LEGACY_NOTICE[layer](path === "" ? basename(folder) : path));
+  w.project.absent[layer] = layer === "model" ? LEGACY_MODEL_REASON : LEGACY_REPORT_REASON;
+  w.legacy.push({ layer, path });
+}
 var emptyPart = (root) => ({ root, files: [], unread: [] });
 function readTree(w, part, dir, keep, passed) {
   for (const entry of readdirSync2(dir, { withFileTypes: true }).sort(
@@ -14701,11 +14833,10 @@ function readPart(w, layer, folder, read) {
   if (!part && layer && refused) w.project.absent[layer] = UNREAD_PART[layer];
   return part;
 }
+var isPbipEntry = (folder, e) => e.name.endsWith(".pbip") && (e.isFile() || e.isSymbolicLink() && folderAt(join3(folder, e.name)) !== true);
 function pbipIn(input, folder, preferred) {
   if (preferred !== void 0) return preferred;
-  const found = readdirSync2(folder, { withFileTypes: true }).filter(
-    (e) => e.name.endsWith(".pbip") && (e.isFile() || e.isSymbolicLink() && folderAt(join3(folder, e.name)) !== true)
-  ).map((e) => e.name).sort(byName);
+  const found = readdirSync2(folder, { withFileTypes: true }).filter((e) => isPbipEntry(folder, e)).map((e) => e.name).sort(byName);
   if (found.length > 1)
     throw new UsageError(
       `${input} contains ${found.length} .pbip files; point at one of them: ${found.join(", ")}`
@@ -14753,27 +14884,23 @@ function resolveFolder(input, path, preferred) {
   return walked(input, path, (w) => readFolder(w, input, path, preferred));
 }
 function walked(input, base, read) {
-  const w = { base, project: { root: base, absent: {}, diagnostics: [] } };
+  const w = { base, project: { root: base, absent: {}, diagnostics: [] }, legacy: [] };
   const project = read(w);
-  if (!project.model && !project.report && w.refusal) {
-    const { path: below, reason } = w.refusal;
-    const named2 = below === "" ? input : toPosix(join3(input, below));
-    throw new UsageError(`Could not read ${named2}: ${reason}`);
-  }
-  return project;
-}
-function reportsNamed(name, text2) {
-  const json = readJson(name, text2).json;
-  if (!isRecord8(json) || !Array.isArray(json.artifacts)) return [];
-  return json.artifacts.flatMap(
-    (a) => isRecord8(a) && isRecord8(a.report) && typeof a.report.path === "string" ? [a.report.path] : []
+  if (project.model || project.report) return project;
+  const named2 = (below) => below === "" ? input : toPosix(join3(input, below));
+  if (w.refusal)
+    throw new UsageError(`Could not read ${named2(w.refusal.path)}: ${w.refusal.reason}`);
+  const [first, ...rest] = w.legacy.map((l) => LEGACY_NOTICE[l.layer](named2(l.path)).message);
+  if (first !== void 0) throw new UsageError(first, rest);
+  throw new UsageError(
+    `No semantic model or report found at ${input} (expected ${EXPECTED_INPUT})`
   );
 }
 function resolvePbip(input, path) {
   const folder = dirname3(path);
   const text2 = readFileSync2(path, "utf8");
   const named2 = /* @__PURE__ */ new Map();
-  for (const written2 of reportsNamed(basename(path), text2)) {
+  for (const written2 of reportsNamed(text2)) {
     const at2 = resolve2(folder, toPosix(written2));
     if (!named2.has(at2)) named2.set(at2, written2);
   }
@@ -14805,10 +14932,8 @@ function readNamed(w, input, pbip, text2, reportFolder, written) {
   const out = w.project;
   const at2 = (p) => toPosix(relative(w.base, p));
   const report = readPart(w, "report", reportFolder, reportPart);
-  if (!report && !out.absent.report && isFile(join3(reportFolder, "report.json"))) {
-    out.diagnostics.push(legacyReportNotice(at2(reportFolder)));
-    out.absent.report = LEGACY_REPORT_REASON;
-  }
+  if (!report && !out.absent.report && isFile(join3(reportFolder, "report.json")))
+    legacyPart(w, "report", reportFolder);
   if (report) report.files.push({ path: toPosix(relative(report.root, pbip)), text: text2 });
   const pbir = pbirOf(w, report, reportFolder);
   const ref = pbir === void 0 ? { kind: "none" } : datasetReference(pbir);
@@ -14819,10 +14944,8 @@ function readNamed(w, input, pbip, text2, reportFolder, written) {
     const modelFolder = resolve2(reportFolder, toPosix(ref.path));
     if (folderAt(modelFolder)) {
       model = readPart(w, "model", modelFolder, modelPart);
-      if (!model && !out.absent.model && isFile(join3(modelFolder, "model.bim"))) {
-        out.diagnostics.push(legacyModelNotice(at2(modelFolder)));
-        out.absent.model = LEGACY_MODEL_REASON;
-      }
+      if (!model && !out.absent.model && isFile(join3(modelFolder, "model.bim")))
+        legacyPart(w, "model", modelFolder);
       if (!model && !out.absent.model) {
         const { reason } = pairingDecision(ref, void 0, basename(reportFolder));
         if (reason) out.absent.model = reason;
@@ -14871,16 +14994,15 @@ function readFolder(w, input, path, preferred) {
       };
   }
   if (name.endsWith(".Report") && isFile(join3(path, "report.json"))) {
-    out.diagnostics.push(legacyReportNotice(name));
-    out.absent.report = LEGACY_REPORT_REASON;
+    legacyPart(w, "report", path);
     return out;
   }
   if (name.endsWith(".SemanticModel") && isFile(join3(path, "model.bim"))) {
-    out.diagnostics.push(legacyModelNotice(name));
-    out.absent.model = LEGACY_MODEL_REASON;
+    legacyPart(w, "model", path);
     return out;
   }
-  const dirs = readdirSync2(path, { withFileTypes: true }).filter((e) => e.isDirectory() || e.isSymbolicLink() && folderAt(join3(path, e.name)) === true).map((e) => e.name);
+  const listed = readdirSync2(path, { withFileTypes: true });
+  const dirs = listed.filter((e) => e.isDirectory() || e.isSymbolicLink() && folderAt(join3(path, e.name)) === true).map((e) => e.name);
   const models = dirs.filter((d) => d.endsWith(".SemanticModel")).sort(byName);
   const reports = dirs.filter((d) => d.endsWith(".Report")).sort(byName);
   if (models.length > 1)
@@ -14892,15 +15014,11 @@ function readFolder(w, input, path, preferred) {
       `${input} contains ${reports.length} reports; point at one of them: ${reports.join(", ")}`
     );
   let model = models[0] ? readPart(w, "model", join3(path, models[0]), modelPart) : void 0;
-  if (models[0] && !model && !out.absent.model && isFile(join3(path, models[0], "model.bim"))) {
-    out.diagnostics.push(legacyModelNotice(models[0]));
-    out.absent.model = LEGACY_MODEL_REASON;
-  }
+  if (models[0] && !model && !out.absent.model && isFile(join3(path, models[0], "model.bim")))
+    legacyPart(w, "model", join3(path, models[0]));
   const report = reports[0] ? readPart(w, "report", join3(path, reports[0]), reportPart) : void 0;
-  if (reports[0] && !report && !out.absent.report && isFile(join3(path, reports[0], "report.json"))) {
-    out.diagnostics.push(legacyReportNotice(reports[0]));
-    out.absent.report = LEGACY_REPORT_REASON;
-  }
+  if (reports[0] && !report && !out.absent.report && isFile(join3(path, reports[0], "report.json")))
+    legacyPart(w, "report", join3(path, reports[0]));
   if (report) {
     const pbip = pbipIn(input, path, preferred);
     if (pbip !== void 0) {
@@ -14921,6 +15039,20 @@ function readFolder(w, input, path, preferred) {
   if (model) out.model = model;
   if (report) out.report = report;
   if (model || report) return out;
+  if (!namedPart && name !== "definition" && !models.length && !reports.length && !listed.some((e) => isPbipEntry(path, e))) {
+    const below = projectsBelow(foundBelow(w, path));
+    const at2 = (p) => toPosix(join3(input, p));
+    if (below.length === 1) {
+      const project = resolveProject(at2(below[0]));
+      w.refusal = void 0;
+      return { ...project, diagnostics: [projectBelowNotice(below[0]), ...project.diagnostics] };
+    }
+    if (below.length > 1)
+      throw new UsageError(
+        `${input} contains ${below.length} projects; point at one of them:`,
+        below.map((p) => `  ${p}: pbiplint ${shellWord(at2(p))}`)
+      );
+  }
   const direct = emptyPart(path);
   const passed = { pbix: [], models: [] };
   readTree(w, direct, path, (n2) => n2.endsWith(".tmdl"), passed);
@@ -14938,16 +15070,50 @@ function readFolder(w, input, path, preferred) {
     `No semantic model or report found at ${input} (expected ${EXPECTED_INPUT})`
   );
 }
+function textAt(p) {
+  try {
+    return isLink(p) || !isFile(p) ? void 0 : readFileSync2(p, "utf8");
+  } catch (e) {
+    if (isSystemError(e)) return void 0;
+    throw e;
+  }
+}
+function foundBelow(w, dir, found = { pbips: [], reports: [], models: [] }) {
+  let entries;
+  try {
+    entries = readdirSync2(dir, { withFileTypes: true });
+  } catch (e) {
+    if (isSystemError(e)) return found;
+    throw e;
+  }
+  for (const entry of entries) {
+    const p = join3(dir, entry.name);
+    const path = toPosix(relative(w.base, p));
+    if (entry.isFile() && entry.name.endsWith(".pbip")) found.pbips.push({ path, text: textAt(p) });
+    else if (!entry.isDirectory() || SKIP_DIRS.has(entry.name)) continue;
+    else if (entry.name.endsWith(".Report"))
+      found.reports.push({ path, pbir: textAt(join3(p, "definition.pbir")) });
+    else if (entry.name.endsWith(".SemanticModel")) found.models.push(path);
+    else foundBelow(w, p, found);
+  }
+  return found;
+}
+var shellWord = (p) => /^[\w./:@+-]+$/.test(p) ? p : `"${p}"`;
 
 // src/main.ts
-var VERSION2 = true ? "0.2.3" : "0.0.0-dev";
+var VERSION2 = true ? "0.2.4" : "0.0.0-dev";
 function listRules() {
   const width = Math.max(...defaultRules.map((r) => r.id.length));
   return defaultRules.map(
     (r) => `${r.id.padEnd(width)}  ${r.layer.padEnd(7)}  ${(r.status === "needsLiveModel" ? "needs live model" : r.status).padEnd(16)}  ${SEVERITY_LABEL[r.severity].padEnd(7)}  ${r.category.padEnd(18)}  ${r.name}`
   ).join("\n");
 }
-async function main(argv, io) {
+async function main(argv, given) {
+  const io = {
+    stdout: (text2) => given.stdout(logSafe(text2)),
+    stderr: (text2) => given.stderr(logSafe(text2)),
+    cwd: () => given.cwd()
+  };
   const stderrLine = (line) => io.stderr(`${showControls(line)}
 `);
   try {
@@ -15013,7 +15179,10 @@ async function main(argv, io) {
   } catch (e) {
     if (e instanceof UsageError || e instanceof ConfigError) {
       stderrLine(`pbiplint: ${e.message}`);
-      if (e instanceof UsageError) stderrLine(`Run pbiplint --help for usage.`);
+      if (e instanceof UsageError) {
+        for (const line of e.lines) stderrLine(line);
+        stderrLine(`Run pbiplint --help for usage.`);
+      }
       return 2;
     }
     for (const [i, line] of unexpectedLines(e).entries())
@@ -15046,8 +15215,8 @@ main(process.argv.slice(2), {
   process.exitCode = code2;
 }).catch((e) => {
   process.stderr.write(
-    `${showControls(`pbiplint: ${e instanceof Error ? e.message : String(e)}`)}
-`
+    logSafe(`${showControls(`pbiplint: ${e instanceof Error ? e.message : String(e)}`)}
+`)
   );
   process.exitCode = 2;
 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pbiplint",
-  "version": "0.2.3",
-  "description": "Lint Power BI projects, the semantic model (TMDL) and the report (PBIR), for best-practice violations, with text, JSON, SARIF, and Markdown output. Nothing is uploaded.",
+  "version": "0.2.4",
+  "description": "Lint Power BI projects, the semantic model (TMDL) and the report (PBIR), for best-practice violations, with text, JSON, SARIF, and Markdown output. Nothing is uploaded: the pbiplint Privacy Promise, https://pbiplint.com/privacy/",
   "keywords": [
     "power-bi",
     "tmdl",