pi-harness-runtime 1.1.440 → 1.1.442

package/packages/token-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/token-optimizer",
-  "version": "1.1.440",
+  "version": "1.1.442",
   "description": "Token Budget Optimizer — maximize prompt value within token limits (RFC-0011)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/tooling-preference/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/tooling-preference",
-  "version": "1.1.440",
+  "version": "1.1.442",
   "description": "pi-harness-runtime — JS/TS tooling preference (Biome vs ESLint/Prettier) proposal",
   "type": "module",
   "main": "./dist/index.js",

package/packages/trajectory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/trajectory",
-  "version": "1.1.440",
+  "version": "1.1.442",
   "description": "Trajectory capture for the write-review loop — persists cycle records for learning",
   "type": "module",
   "main": "./dist/src/index.js",

package/packages/tui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/tui",
-  "version": "1.1.440",
+  "version": "1.1.442",
   "description": "pi-harness-runtime — tui",
   "type": "module",
   "main": "./dist/index.js",

package/packages/two-phase-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/two-phase-review",
-  "version": "1.1.440",
+  "version": "1.1.442",
   "description": "pi-harness-runtime — two-phase implementation and review workflow (queue review signals, gate the phase, scope the diff)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/types",
-  "version": "1.1.440",
+  "version": "1.1.442",
   "description": "Shared TypeScript types for pi-harness-runtime packages",
   "type": "module",
   "main": "./dist/index.js",

package/packages/voice-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/voice-api",
-  "version": "1.1.440",
+  "version": "1.1.442",
   "type": "module",
   "description": "Voice-to-text API using Whisper for Telegram and LINE integration",
   "main": "./dist/index.js",

package/packages/webmcp-tester/dist/index.js

@@ -29,12 +29,10 @@
  * ```
  */
 import { spawn } from "child_process";
-import { promisify } from "util";
 import { readFile, mkdir } from "fs/promises";
 import { existsSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
-const exec = promisify(require("child_process").exec);
 // ---------------------------------------------------------------------------
 // WebMCP Test Runner
 // ---------------------------------------------------------------------------

package/packages/webmcp-tester/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/webmcp-tester",
-  "version": "1.1.440",
+  "version": "1.1.442",
   "description": "WebMCP-powered E2E testing for pi-harness - natural language test scenarios",
   "type": "module",
   "main": "./dist/index.js",

package/packages/webmcp-tester/src/index.ts

@@ -30,14 +30,11 @@
  */
 
 import { spawn, ChildProcess } from "child_process";
-import { promisify } from "util";
 import { readFile, writeFile, mkdir } from "fs/promises";
 import { existsSync } from "fs";
 import { join, dirname } from "path";
 import { homedir } from "os";
 
-const exec = promisify(require("child_process").exec);
-
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------

package/packages/wiki/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/wiki",
-  "version": "1.1.440",
+  "version": "1.1.442",
   "description": "LLM Wiki integration for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/workflow-events/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/workflow-events",
-  "version": "1.1.440",
+  "version": "1.1.442",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/workspace-scanner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/workspace-scanner",
-  "version": "1.1.440",
+  "version": "1.1.442",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/worktree/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/worktree",
-  "version": "1.1.440",
+  "version": "1.1.442",
   "description": "pi-harness-runtime — worktree",
   "type": "module",
   "main": "./dist/index.js",

package/packages/write-review/dist/trigger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trigger.d.ts","sourceRoot":"","sources":["../src/trigger.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAIvD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAS3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC9B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GACjB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAiB/C;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC7B,WAAW,EAAE,MAAM,GACjB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,CAqCxD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CACnC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,WAAW,GAAE,oBAAoB,CAAC,aAAa,CAAe,GAC5D,oBAAoB,GAAG,IAAI,CAc7B;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAG3D;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEtD"}
+{"version":3,"file":"trigger.d.ts","sourceRoot":"","sources":["../src/trigger.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAIvD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAS3E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC9B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GACjB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAiB/C;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC7B,WAAW,EAAE,MAAM,GACjB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,CAoCxD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CACnC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,WAAW,GAAE,oBAAoB,CAAC,aAAa,CAAe,GAC5D,oBAAoB,GAAG,IAAI,CAc7B;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAG3D;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEtD"}

package/packages/write-review/dist/trigger.js

@@ -4,7 +4,7 @@
  * Detects when an agent reads a prompt from {project}/wiki/*
  * This triggers the write-review loop.
  */
-import { existsSync } from "fs";
+import { existsSync, readdirSync, statSync } from "fs";
 import { join, relative } from "path";
 const DEFAULT_WIKI_DIR = "wiki";
 /**
@@ -47,7 +47,6 @@ export function getWikiPrompts(projectPath) {
     }
     const prompts = [];
     function scanDir(dir) {
-        const { readdirSync, statSync } = require("fs");
         try {
             for (const entry of readdirSync(dir)) {
                 const fullPath = join(dir, entry);

package/packages/write-review/dist/trigger.js.map

@@ -1 +1 @@
-{"version":3,"file":"trigger.js","sourceRoot":"","sources":["../src/trigger.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAGtC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,WAAmB;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEnD,OAAO,CACN,cAAc,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC;QAC/C,cAAc,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,CAChD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC9B,QAAgB,EAChB,WAAmB;IAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE5D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO;YACN,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YAClB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SAClC,CAAC;IACH,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;KAClB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC7B,WAAmB;IAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAEpD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAA2D,EAAE,CAAC;IAE3E,SAAS,OAAO,CAAC,GAAW;QAC3B,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC;YACJ,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAChC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACnB,CAAC;qBAAM,IACN,IAAI,CAAC,MAAM,EAAE;oBACb,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAChD,CAAC;oBACF,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAChE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACjC,OAAO,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;wBAClB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;qBAClC,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,2BAA2B;QAC5B,CAAC;IACF,CAAC;IAED,OAAO,CAAC,OAAO,CAAC,CAAC;IACjB,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CACnC,QAAgB,EAChB,WAAmB,EACnB,WAAW,GAAwC,WAAW;IAE9D,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,OAAO;QACN,WAAW;QACX,UAAU,EAAE,QAAQ;QACpB,aAAa,EAAE,EAAE,EAAE,2BAA2B;QAC9C,WAAW;KACX,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC7C,OAAO,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"trigger.js","sourceRoot":"","sources":["../src/trigger.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAGtC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,WAAmB;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEnD,OAAO,CACN,cAAc,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC;QAC/C,cAAc,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,CAChD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC9B,QAAgB,EAChB,WAAmB;IAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE5D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO;YACN,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YAClB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SAClC,CAAC;IACH,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;KAClB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC7B,WAAmB;IAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAEpD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAA2D,EAAE,CAAC;IAE3E,SAAS,OAAO,CAAC,GAAW;QAC3B,IAAI,CAAC;YACJ,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAChC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACnB,CAAC;qBAAM,IACN,IAAI,CAAC,MAAM,EAAE;oBACb,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAChD,CAAC;oBACF,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAChE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACjC,OAAO,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;wBAClB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;qBAClC,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,2BAA2B;QAC5B,CAAC;IACF,CAAC;IAED,OAAO,CAAC,OAAO,CAAC,CAAC;IACjB,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CACnC,QAAgB,EAChB,WAAmB,EACnB,WAAW,GAAwC,WAAW;IAE9D,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,OAAO;QACN,WAAW;QACX,UAAU,EAAE,QAAQ;QACpB,aAAa,EAAE,EAAE,EAAE,2BAA2B;QAC9C,WAAW;KACX,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC7C,OAAO,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAC5C,CAAC"}

package/packages/write-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/write-review",
-  "version": "1.1.440",
+  "version": "1.1.442",
   "description": "Two-agent write-review loop with blackboard coordination",
   "type": "module",
   "main": "src/index.ts",

package/packages/write-review/src/trigger.ts

@@ -5,7 +5,7 @@
  * This triggers the write-review loop.
  */
 
-import { existsSync } from "fs";
+import { existsSync, readdirSync, statSync } from "fs";
 import { join, relative } from "path";
 import type { ReviewTriggerContext } from "./types.js";
 
@@ -65,7 +65,6 @@ export function getWikiPrompts(
 	const prompts: { path: string; category: string; filename: string }[] = [];
 
 	function scanDir(dir: string): void {
-		const { readdirSync, statSync } = require("fs");
 		try {
 			for (const entry of readdirSync(dir)) {
 				const fullPath = join(dir, entry);

package/scripts/lib/runtime-imports.ts

@@ -130,16 +130,26 @@ export function stripComments(source: string): string {
 	return scanSource(source).code;
 }
 
-/** The import forms that carry a specifier. */
-const IMPORT_PATTERNS: RegExp[] = [
+/** The STATIC import forms that carry a specifier. */
+const STATIC_IMPORT_PATTERNS: RegExp[] = [
 	// import ... from "..." / export ... from "..."
 	/(?:^|[\n;])[ \t]*(import|export)\s+(type\s+)?[^;\n]*?from\s*["']([^"']+)["']/g,
 	// import "..." (side effect)
 	/(?:^|[\n;])[ \t]*import\s*["']([^"']+)["']/g,
+];
+
+/** The DYNAMIC import form that carries a specifier. */
+const DYNAMIC_IMPORT_PATTERNS: RegExp[] = [
 	// import("...") (dynamic)
 	/import\s*\(\s*["']([^"']+)["']\s*\)/g,
 ];
 
+/** The import forms that carry a specifier. */
+const IMPORT_PATTERNS: RegExp[] = [
+	...STATIC_IMPORT_PATTERNS,
+	...DYNAMIC_IMPORT_PATTERNS,
+];
+
 /**
  * Every VALUE import of a source file.
  *
@@ -149,10 +159,27 @@ const IMPORT_PATTERNS: RegExp[] = [
  * is documentation, not an import.
  */
 export function extractValueImports(source: string): string[] {
+	return collectSpecifiers(source, IMPORT_PATTERNS);
+}
+
+/**
+ * Every STATIC value import of a source file.
+ *
+ * A dynamic import is a different thing: it is resolved when the code
+ * reaches it, so a module that loads one at run time may be an optional
+ * dependency. A static import is resolved when the module is loaded, so
+ * the package must carry it.
+ */
+export function extractStaticValueImports(source: string): string[] {
+	return collectSpecifiers(source, STATIC_IMPORT_PATTERNS);
+}
+
+/** The specifiers of the given import forms. */
+function collectSpecifiers(source: string, patterns: RegExp[]): string[] {
 	const { code, isCodeAt } = scanSource(source);
 	const specifiers: string[] = [];
 
-	for (const pattern of IMPORT_PATTERNS) {
+	for (const pattern of patterns) {
 		for (const match of code.matchAll(pattern)) {
 			// The match must start in code, not inside a literal.
 			if (match.index === undefined || !isCodeAt(match.index)) continue;
@@ -183,6 +210,19 @@ export function extractBareImports(source: string): string[] {
 	return extractValueImports(source).filter((specifier) => !specifier.startsWith("."));
 }
 
+/**
+ * Every STATIC bare value import of a source file.
+ *
+ * A static bare import is a package the module needs when it is loaded.
+ * The published package must declare it, or the consumer cannot import
+ * the module at all.
+ */
+export function extractStaticBareImports(source: string): string[] {
+	return extractStaticValueImports(source).filter(
+		(specifier) => !specifier.startsWith("."),
+	);
+}
+
 /**
  * The package a specifier names.
  *
@@ -194,6 +234,152 @@ export function packageNameOf(specifier: string): string {
 	return specifier.split("/")[0];
 }
 
+/** Is the character part of an identifier? */
+function isWordChar(char: string | undefined): boolean {
+	return char !== undefined && /[A-Za-z0-9_$]/.test(char);
+}
+
+/**
+ * Every `require(...)` call that runs when the module is loaded.
+ *
+ * The published package is an ES module (`"type": "module"`), and Node has
+ * no `require` in an ES module. A `require` in the body of a function is
+ * harmless as long as nobody calls that function - but a `require` at the
+ * top level of the module throws the moment the module is imported.
+ *
+ * The scanner walks the code and counts the braces, so it knows whether a
+ * call sits inside a function body. The content of a string or a template
+ * literal is not code and is skipped.
+ */
+/**
+ * The blocks that are not a function body.
+ *
+ * A `require` inside one of them still runs when the module is loaded:
+ * `if (cond) { require("x") }` is a load time call, not a call that waits
+ * for a function to run.
+ */
+const LOAD_TIME_BLOCK_KEYWORDS =
+	/^(?:if|for|while|switch|try|catch|finally|do|else|class|enum)\b/;
+
+/**
+ * A `require` call in a source file.
+ */
+export interface RequireCall {
+	/** The module the call names. */
+	specifier: string;
+	/** Whether the call runs when the module is loaded. */
+	moduleScope: boolean;
+}
+
+/**
+ * Every `require` call of a source file.
+ *
+ * The scope analysis is textual: a block opens a function scope unless it
+ * belongs to a statement that runs at load time, and an arrow function
+ * with an expression body ends with its statement.
+ */
+export function findRequireCalls(source: string): RequireCall[] {
+	const { code, isCodeAt } = scanSource(source);
+	const calls: RequireCall[] = [];
+	let functionDepth = 0;
+	let arrowDepth = 0;
+
+	for (let i = 0; i < code.length; i += 1) {
+		if (!isCodeAt(i)) continue;
+		const char = code[i];
+		if (char === "{") {
+			if (!opensLoadTimeBlock(code, i)) functionDepth += 1;
+			continue;
+		}
+		if (char === "}") {
+			functionDepth -= 1;
+			continue;
+		}
+		if (char === ";" && functionDepth === 0) {
+			// The end of a statement ends an arrow function whose body is
+			// an expression: `const load = () => require("x");`.
+			arrowDepth = 0;
+			continue;
+		}
+		if (char === "=" && code[i + 1] === ">") {
+			if (functionDepth === 0) arrowDepth += 1;
+			i += 1;
+			continue;
+		}
+		if (!code.startsWith("require", i)) continue;
+		if (isWordChar(code[i - 1]) || isWordChar(code[i + 7])) continue;
+		let j = i + 7;
+		while (j < code.length && /\s/.test(code[j])) j += 1;
+		if (code[j] !== "(") continue;
+		const end = code.indexOf(")", j);
+		const argument = code.slice(j + 1, end === -1 ? j + 1 : end).trim();
+		// A call inside a call at the top level still runs at load time.
+		const moduleScope = functionDepth === 0 && arrowDepth === 0;
+		calls.push({ specifier: unquoteSpecifier(argument), moduleScope });
+		i = j;
+	}
+
+	return calls;
+}
+
+/**
+ * Every `require` that runs when the module is loaded.
+ *
+ * The published package is an ES module and Node has no `require` there:
+ * a call at the top level of a module throws the moment the module is
+ * imported. A `require` inside a function body only runs when that
+ * function runs, so it is not a problem for the import itself.
+ */
+export function findModuleScopeRequires(source: string): string[] {
+	return findRequireCalls(source)
+		.filter((call) => call.moduleScope)
+		.map((call) => call.specifier);
+}
+
+/**
+ * Whether the file creates its own `require`.
+ *
+ * An ES module has no `require`, but a module that builds one with
+ * `createRequire` owns a working `require`. Such a file is not broken by
+ * a `require` call.
+ */
+export function hasLocalRequire(source: string): boolean {
+	return /(?:const|let|var)\s+require\s*=\s*createRequire\s*\(/.test(source);
+}
+
+/**
+ * Whether the block that starts at the given position runs at load time.
+ *
+ * The text between the block and the statement before it names the kind of
+ * the block: `try {` is a load time block, `function read() {` is a
+ * function scope.
+ */
+function opensLoadTimeBlock(code: string, braceIndex: number): boolean {
+	let start = braceIndex - 1;
+	while (start >= 0) {
+		const char = code[start];
+		if (char === ";" || char === "{" || char === "}") {
+			start += 1;
+			break;
+		}
+		start -= 1;
+	}
+	if (start < 0) start = 0;
+	const statement = code.slice(start, braceIndex).trim();
+	return LOAD_TIME_BLOCK_KEYWORDS.test(statement);
+}
+
+/** Remove the quotes of a module specifier. */
+function unquoteSpecifier(specifier: string): string {
+	if (specifier.length < 2) return specifier;
+	const first = specifier[0];
+	const last = specifier[specifier.length - 1];
+	if ((first === '"' || first === "'") && first === last) {
+		return specifier.slice(1, -1);
+	}
+	return specifier;
+}
+
 /**
  * The files a relative specifier may point at.
  *

package/scripts/telegram-webhook-server.ts

@@ -14,6 +14,8 @@
 import { existsSync, writeFileSync, appendFileSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { createServer } from "node:http";
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
 
 // --- Configuration ---
 const BOT_TOKEN = process.env.TELEGRAM_BOT_TOKEN;

package/scripts/verify-package-contents.ts

@@ -28,11 +28,15 @@
 
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { execFile, spawnSync } from "node:child_process";
+import { builtinModules } from "node:module";
 import { join, resolve, dirname, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 import {
 	extractBareImports,
 	extractRelativeValueImports,
+	extractStaticBareImports,
+	findRequireCalls,
+	hasLocalRequire,
 	packageNameOf,
 	resolveRelativeImport,
 } from "./lib/runtime-imports.js";
@@ -55,7 +59,9 @@ interface Problem {
 		| "missing-package"
 		| "forbidden-path"
 		| "missing-plugin"
-		| "sensitive-content";
+		| "sensitive-content"
+		| "undeclared-dependency"
+		| "esm-require";
 	detail: string;
 }
 
@@ -571,6 +577,7 @@ function workspacePackageNames(): Set<string> {
 function checkRelativeImports(files: string[]): void {
 	const published = new Set(files);
 	const workspaceNames = workspacePackageNames();
+
 	for (const path of files) {
 		if (!/\.(ts|mts|cts|mjs|js|cjs)$/.test(path)) continue;
 		if (path.endsWith(".d.ts") || path.endsWith(".d.mts")) continue;
@@ -605,6 +612,144 @@ function checkRelativeImports(files: string[]): void {
 	}
 }
 
+/**
+ * Every package that the published package declares.
+ *
+ * The consumer installs one package, so that one package has to carry the
+ * dependencies of every module it ships. A module that imports a package
+ * the manifest does not name cannot be imported by the consumer: the
+ * dependency is missing from the install.
+ *
+ * A dynamic import is a different case: it is resolved when the code
+ * reaches it, so a module that loads one at run time may treat it as an
+ * optional dependency. Only a static import is checked here.
+ */
+function declaredDependencyNames(): Set<string> {
+	const names = new Set<string>();
+	let manifest: {
+		dependencies?: Record<string, string>;
+		optionalDependencies?: Record<string, string>;
+		peerDependencies?: Record<string, string>;
+	};
+	try {
+		manifest = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));
+	} catch {
+		return names;
+	}
+	for (const group of [
+		manifest.dependencies,
+		manifest.optionalDependencies,
+		manifest.peerDependencies,
+	]) {
+		for (const name of Object.keys(group ?? {})) names.add(name);
+	}
+	return names;
+}
+
+/**
+ * The names that a published module may import without a declaration.
+ *
+ * A Node builtin is always there. A test runner is only there when the
+ * tests run, and a published module never imports one at run time.
+ */
+const ALWAYS_AVAILABLE_NAMES = new Set([
+	...builtinModules,
+	...builtinModules.map((name) => `node:${name}`),
+	"bun:test",
+	"node:test",
+]);
+
+/**
+ * Every static import of a published file must name a declared package.
+ *
+ * The check runs on the file list that npm itself produced, so it covers
+ * exactly what a consumer receives - the compiled output included.
+ */
+function checkDeclaredDependencies(files: string[]): void {
+	const declared = declaredDependencyNames();
+	const workspaces = workspacePackageNames();
+	for (const path of files) {
+		if (!/\.(ts|mts|cts|mjs|js|cjs)$/.test(path)) continue;
+		if (path.endsWith(".d.ts") || path.endsWith(".d.mts")) continue;
+		const full = join(ROOT, path);
+		if (!existsSync(full)) continue;
+		const content = readFileSync(full, "utf8");
+		for (const specifier of extractStaticBareImports(content)) {
+			const name = packageNameOf(specifier);
+			if (!name) continue;
+			if (ALWAYS_AVAILABLE_NAMES.has(name)) continue;
+			if (declared.has(name) || workspaces.has(name)) continue;
+			problems.push({
+				kind: "undeclared-dependency",
+				detail: `${path} imports ${name}, which the published package does not declare - a consumer cannot import this module`,
+			});
+		}
+	}
+}
+
+/**
+ * A published module must not call `require` when it is loaded.
+ *
+ * The published package is an ES module (`"type": "module"`), and Node
+ * has no `require` there: a call at the top level of a module throws the
+ * moment the module is imported. A `require` inside a function is only a
+ * problem when that function runs, so only the module scope is checked.
+ */
+/**
+ * The module system of a published file.
+ *
+ * A file that belongs to a CommonJS package may call `require`. A file
+ * that belongs to an ES module may not: Node has no `require` there.
+ */
+function moduleTypeOf(path: string): "module" | "commonjs" {
+	let dir = dirname(resolve(ROOT, path));
+	for (;;) {
+		const manifestPath = join(dir, "package.json");
+		if (existsSync(manifestPath)) {
+			try {
+				const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as {
+					type?: string;
+				};
+				return manifest.type === "commonjs" ? "commonjs" : "module";
+			} catch {
+				return "module";
+			}
+		}
+		const parent = dirname(dir);
+		if (parent === dir) return "module";
+		dir = parent;
+	}
+}
+
+/**
+ * A published module must not call the global `require`.
+ *
+ * The published package is an ES module, and Node has no `require` there:
+ * a call at the top level of a module throws the moment the module is
+ * imported, and a call inside a function throws when that function runs.
+ *
+ * A module that builds its own `require` with `createRequire` owns a
+ * working `require` and is not affected.
+ */
+function checkModuleScopeRequires(files: string[]): void {
+	for (const path of files) {
+		if (!path.endsWith(".js")) continue;
+		if (moduleTypeOf(path) !== "module") continue;
+		const full = join(ROOT, path);
+		if (!existsSync(full)) continue;
+		const content = readFileSync(full, "utf8");
+		if (hasLocalRequire(content)) continue;
+		for (const call of findRequireCalls(content)) {
+			problems.push({
+				kind: "esm-require",
+				detail: call.moduleScope
+					? `${path} calls require(${call.specifier}) when the module is loaded, but the published package is an ES module`
+					: `${path} calls require(${call.specifier}), but the published package is an ES module and has no require`,
+			});
+		}
+	}
+}
+
 /** The tarball npm would publish must contain the built output. */
 function inspectTarball(files: string[]): void {
 	for (const file of files) {
@@ -675,6 +820,8 @@ if (publishedFiles.length === 0) {
 	});
 } else {
 	checkRelativeImports(publishedFiles);
+	checkDeclaredDependencies(publishedFiles);
+	checkModuleScopeRequires(publishedFiles);
 	checkSensitiveContent(publishedFiles);
 	if (verifyTarball) inspectTarball(publishedFiles);
 }