plumb-fhir 0.6.2 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.8.0 (2026-10-05)
+
+- **`plumb check`** reports every `MedplumClient` read or write of a type a
+  selected profile fully holds that goes around `readProfiled`,
+  `searchProfiled`, `createProfiled`, `updateProfiled` or `stampProfiled`,
+  by the types the compiler infers, so an inferred write is found as surely as
+  a literal one. A committed baseline lets a project adopt it with a backlog:
+  only new or grown findings fail. `// plumb-check: <reason>` marks a
+  deliberate exception. It needs the project's TypeScript 5 or 6 (design 07).
+- **`stampProfiled` returns its resource branded** (`T & Stamped`, an optional
+  unique-symbol property), which `check` reads to accept a stamped write
+  through a variable. Callers see no difference.
+- `check` in the config: `tsconfig`, `baseline` and `ignore`.
+
+## 0.7.0 (2026-10-05)
+
+- **`stampProfiled(resource, options?)`** returns the copy `createProfiled`
+  would write, routed and stamped, without writing it: for conditional
+  creates, upserts and batch or transaction entries. It takes the same
+  options, is typed the same way, and throws the same `RoutingError` (#124).
+- The README says `updateProfiled` stamps a record that was unstamped, so
+  edits of stored records that fail the profile start being refused; and to
+  commit `fsh-generated/resources/` but gitignore SUSHI's index files (#125).
+
 ## 0.6.2 (2026-10-05)
 
 `validate` and `push` from an installed Plumb, and on Medplum's `awslambda`

package/README.md

@@ -185,8 +185,11 @@ export default defineConfig({
 ✔ sushi     1 StructureDefinitions, 0 ValueSets   6.8s
 ```
 
-- **Commit `fsh-generated/`** with the FSH. It is the JSON `push` loads into
-  Medplum, and `validateProfiled` reads it without running SUSHI.
+- **Commit `fsh-generated/resources/`** with the FSH. It is the JSON `push`
+  loads into Medplum, and `validateProfiled` reads it without running SUSHI.
+  SUSHI's own `fsh-index.txt` and `data/` are bookkeeping no command reads:
+  gitignore them. Marking the generated folders `linguist-generated` in
+  `.gitattributes` collapses them in review diffs.
 - **`generate --check` in CI** rebuilds the FSH into a temporary folder and
   fails when the committed `fsh-generated/` or the types differ from it.
 - **SUSHI's errors stop `generate`**, with their FSH file and line. Its
@@ -240,6 +243,22 @@ const saved = await createProfiled(medplum, bp); // stamped, then medplum.create
 - They take any client with `createResource` and `updateResource`, such as
   a `MedplumClient`, so the generated code needs nothing from Plumb at run
   time.
+- **`stampProfiled(resource, options?)`** returns the copy `createProfiled`
+  would write, stamped and not written, for the writes it cannot make: a
+  conditional create, an upsert, a batch or transaction entry. It takes the
+  same options and throws the same `RoutingError`:
+
+  ```ts
+  await medplum.createResourceIfNoneExist(
+    stampProfiled(coverage, { profile: USCoreCoverageProfileUrl }),
+    `identifier=${system}|${value}`,
+  );
+  ```
+
+- **Moving an edit path to `updateProfiled` stamps records that were
+  unstamped**, so the server starts holding them to the profile: an edit of a
+  stored record that does not meet it is refused from then on. Run
+  `plumb validate` and fix what fails before moving edit paths.
 
 **Keys come from each profile:** every fixed or pattern value on a required
 first-level element (a pinned `code`), and every required slice's
@@ -360,6 +379,61 @@ read would refuse. History is not offered typed: an old version may predate
 its stamp, so read it with `medplum.readHistory` and `asProfiled` it if you
 must.
 
+## Find code that goes around Plumb
+
+The profiled reads and writes only help where they are called. `plumb check`
+reads your code the way the compiler does and reports every `MedplumClient`
+read or write of a profiled type that does not go through them, including a
+write whose type is only inferred:
+
+```ts
+export default defineConfig({
+  // …igs, profiles, out
+  check: {
+    tsconfig: ['apps/web/tsconfig.json'],
+    baseline: './plumb-check-baseline.json',
+    ignore: ['**/*.test.ts', '**/*.stories.tsx'],
+  },
+});
+```
+
+```bash
+npx plumb check
+```
+
+```text
+plumb check
+✖ check     2 new, 248 in the baseline, in 2767 files   6.2s
+    apps/web/src/lib/goals/goal.ts:41:10  readResource Goal  → readProfiled
+    apps/web/src/lib/coverage/save.ts:90:5  createResource Coverage  → createProfiled, updateProfiled or stampProfiled
+Failed in 6.2s
+```
+
+- **What it reports:** `readResource`, `searchResources`, `searchOne`,
+  `searchResourcePages`, `createResource`, `updateResource`, `upsertResource`
+  and `createResourceIfNoneExist` on a `MedplumClient` (or a class deriving
+  from it), for a type every resource of which a selected profile holds: one
+  with a profile that routes on no keys, or a `defaultProfile`. A type whose
+  profiles are keyed on content (one code of Observation) is not reported, and
+  neither is `string` or `ResourceType`.
+- **A stamped write passes,** through a variable too: `stampProfiled` returns
+  its resource branded, and `check` reads the brand from the type.
+- **A deliberate exception** takes a comment with a reason on the line before:
+  `// plumb-check: the backfill reads unstamped records to stamp them`.
+- **The baseline** is a committed count per file, method and type. `check`
+  fails only when a count grows or a new one appears, so new raw access is
+  refused at once while the backlog shrinks. `--update-baseline` records
+  fixes; it refuses growth unless `--allow-growth` is given.
+- **Paths** in the output, the baseline and `ignore` are relative to the
+  deepest folder holding the config and every tsconfig, so a monorepo's config
+  in one package checks code in another.
+- **TypeScript:** `check` compiles with your project's own `typescript`, which
+  needs its compiler API: TypeScript 5 or 6. TypeScript 7's native package has
+  none yet, and `check` exits 2 on it.
+
+Exit codes: 0 when nothing is new, 1 when something is (or the baseline would
+grow), 2 for usage, config and set-up errors.
+
 ## Check stored data, then load profiles
 
 Medplum validates a resource when it is written, and never again. Tightening a

package/dist/cjs/check.d.ts

@@ -0,0 +1,89 @@
+import type * as TS from 'typescript5';
+import type { PlumbConfig } from './config.js';
+import { type Route } from './emit/routes.js';
+/** A `MedplumClient` read or write of a profiled type that goes around Plumb. */
+export interface Finding {
+    /** Relative to the config's folder, with forward slashes. */
+    file: string;
+    line: number;
+    column: number;
+    method: string;
+    /** The profiled resource types the call can touch, sorted. */
+    resourceTypes: string[];
+    /** What to call instead, or why the finding stands. */
+    instead: string;
+}
+export interface FindOptions {
+    /** The project's TypeScript module, with its compiler API. */
+    ts: typeof TS;
+    /** The folder findings are relative to, and `ignore` is matched from. */
+    base: string;
+    tsconfig: string[];
+    /** Resource types a selected profile constrains. */
+    profiledTypes: ReadonlySet<string>;
+    /** The generated folder, never checked. */
+    out: string;
+    ignore?: string[];
+}
+/**
+ * Compiles each project and reports every raw `MedplumClient` read or write of
+ * a profiled type, with the type the checker infers, not the text written.
+ */
+export declare function findRawAccess(options: FindOptions): {
+    findings: Finding[];
+    files: number;
+};
+/** Accepted findings, counted per file, method and resource types. */
+export type Baseline = Record<string, number>;
+export declare function countFindings(findings: Finding[]): Baseline;
+export interface BaselineComparison {
+    /** Findings under a key that is new or grew: every one of them, since a line cannot be told apart. */
+    fresh: Finding[];
+    /** How many findings the baseline accepts that are now gone. */
+    fixed: number;
+    /** Findings the baseline accepts. */
+    accepted: number;
+}
+/** A finding fails only where its key's count exceeds the baseline's. */
+export declare function compareBaseline(findings: Finding[], baseline: Baseline): BaselineComparison;
+export interface CheckResult {
+    ok: boolean;
+    findings: Finding[];
+    comparison: BaselineComparison;
+    files: number;
+    /** Set when `updateBaseline` wrote the file. */
+    baselineWritten?: boolean;
+    errors: {
+        code: 'no-check-config' | 'no-compiler-api' | 'no-lock' | 'baseline-growth';
+        message: string;
+    }[];
+}
+export interface CheckOptions {
+    config: PlumbConfig;
+    configPath: string;
+    /** The project's TypeScript; resolved from the config's folder by default. */
+    ts?: typeof TS;
+    cacheDir?: string;
+    updateBaseline?: boolean;
+    allowGrowth?: boolean;
+}
+/**
+ * `plumb check`: loads the selected profiles for the types they constrain,
+ * compiles the configured projects, and compares what it finds with the
+ * baseline, or rewrites the baseline.
+ */
+export declare function checkProject(options: CheckOptions): Promise<CheckResult>;
+/**
+ * The folder findings and `ignore` globs are relative to: the deepest one
+ * holding the config and every tsconfig, so a monorepo's config in one package
+ * checks code in another, and baseline keys do not depend on where it runs.
+ */
+export declare function checkRoot(configPath: string, tsconfig: string[]): string;
+/**
+ * The types every resource of which a selected profile holds: one with a
+ * profile that routes on no keys, or a `defaultProfile`. A profile keyed on
+ * content (one code of Observation) holds only some, so raw access to the type
+ * is not wrong and is not reported.
+ */
+export declare function enforcedTypes(routes: Record<string, Route[]>, defaultProfile?: Record<string, string[]>): Set<string>;
+//# sourceMappingURL=check.d.ts.map

package/dist/cjs/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/check.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,KAAK,KAAK,EAAe,MAAM,kBAAkB,CAAC;AAI3D,iFAAiF;AACjF,MAAM,WAAW,OAAO;IACtB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;CACjB;AAiBD,MAAM,WAAW,WAAW;IAC1B,8DAA8D;IAC9D,EAAE,EAAE,OAAO,EAAE,CAAC;IACd,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oDAAoD;IACpD,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG;IAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAe1F;AAoHD,sEAAsE;AACtE,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAI9C,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,CAI3D;AAED,MAAM,WAAW,kBAAkB;IACjC,sGAAsG;IACtG,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,GAAG,kBAAkB,CAS3F;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE;QACN,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,SAAS,GAAG,iBAAiB,CAAC;QAC5E,OAAO,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA2D9E;AAeD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAQxE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAC/B,cAAc,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAM,GAC5C,GAAG,CAAC,MAAM,CAAC,CAKb"}

package/dist/cjs/commands.d.ts

@@ -1,3 +1,4 @@
+import type * as TS from 'typescript5';
 import { type Checked } from './conformance.js';
 import { type Step } from './generate.js';
 export interface CliIo {
@@ -9,6 +10,8 @@ export interface CliIo {
     stderr: (text: string) => void;
     cacheDir?: string;
     fetch?: typeof globalThis.fetch;
+    /** The TypeScript `check` compiles with; the project's own by default. */
+    typescript?: typeof TS;
 }
 /** What a step did, as one line: its name, its counts and its time. */
 export declare function formatStep(step: Step, out: string): string;

package/dist/cjs/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/commands.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,OAAO,EAIb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAiC,KAAK,IAAI,EAAE,MAAM,eAAe,CAAC;AAGzE,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,6DAA6D;IAC7D,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAyDD,uEAAuE;AACvE,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAe1D;AAED,2EAA2E;AAC3E,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBpE;AAqID,KAAK,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC,CAAC;AAIjD,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,EAAE,CAexD"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/commands.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAGvC,OAAO,EACL,KAAK,OAAO,EAIb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAiC,KAAK,IAAI,EAAE,MAAM,eAAe,CAAC;AAGzE,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,6DAA6D;IAC7D,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,0EAA0E;IAC1E,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;CACxB;AA+DD,uEAAuE;AACvE,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAe1D;AAED,2EAA2E;AAC3E,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBpE;AA8KD,KAAK,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC,CAAC;AAIjD,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,EAAE,CAexD"}

package/dist/cjs/config.d.ts

@@ -36,6 +36,17 @@ export interface PlumbConfig {
     defaultProfile?: Record<string, string[]>;
     /** What `push` writes to each environment's project besides its profiles. */
     project?: ProjectConfig;
+    /** What `plumb check` reads. */
+    check?: CheckConfig;
+}
+/** What `plumb check` reads: the project's code, for raw access to profiled types. */
+export interface CheckConfig {
+    /** The TypeScript projects to check, each compiled once; a path or several. */
+    tsconfig: string | string[];
+    /** The committed file of accepted findings; without one, every finding fails. */
+    baseline?: string;
+    /** Globs, relative to the config, of files not to check (tests, stories). */
+    ignore?: string[];
 }
 /**
  * A project's configuration, as a project admin can write it. Policies and
@@ -94,7 +105,7 @@ export interface ResolvedEnvironment {
     clientId: string;
     clientSecret: string;
 }
-export type ConfigErrorCode = 'config-not-found' | 'unsupported-syntax' | 'unresolved-import' | 'no-default-export' | 'unknown-key' | 'missing-out' | 'invalid-type' | 'invalid-ig' | 'unlisted-ig' | 'invalid-profile' | 'invalid-max-codes' | 'invalid-base-url' | 'unknown-environment' | 'missing-variable' | 'invalid-route' | 'unselected-route' | 'invalid-route-element' | 'invalid-default-profile' | 'versioned-url' | 'fsh-and-local' | 'no-sushi-config' | 'invalid-setting' | 'super-admin-field' | 'unknown-access-policy' | 'duplicate-key';
+export type ConfigErrorCode = 'config-not-found' | 'unsupported-syntax' | 'unresolved-import' | 'no-default-export' | 'unknown-key' | 'missing-out' | 'invalid-type' | 'invalid-ig' | 'unlisted-ig' | 'invalid-profile' | 'invalid-max-codes' | 'invalid-base-url' | 'unknown-environment' | 'missing-variable' | 'invalid-route' | 'unselected-route' | 'invalid-route-element' | 'invalid-default-profile' | 'versioned-url' | 'fsh-and-local' | 'no-sushi-config' | 'invalid-setting' | 'super-admin-field' | 'unknown-access-policy' | 'duplicate-key' | 'invalid-check';
 export interface ConfigError {
     code: ConfigErrorCode;
     message: string;

package/dist/cjs/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,YAAY,EAEZ,MAAM,EACN,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;;;OAGG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE;QACT,0FAA0F;QAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC3C;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC;IAC1C;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjD,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACpD,sEAAsE;IACtE,qBAAqB,CAAC,EAAE;QACtB,WAAW,EAAE,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5C,YAAY,EAAE,MAAM,CAAC;KACtB,EAAE,CAAC;IACJ,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC;AAEjE,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;AAEpF;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,YAAY,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,aAAa,GACb,aAAa,GACb,cAAc,GACd,YAAY,GACZ,aAAa,GACb,iBAAiB,GACjB,mBAAmB,GACnB,kBAAkB,GAClB,qBAAqB,GACrB,kBAAkB,GAClB,eAAe,GACf,kBAAkB,GAClB,uBAAuB,GACvB,yBAAyB,GACzB,eAAe,GACf,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,uBAAuB,GACvB,eAAe,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAE7D,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAE7D;AAoBD,QAAA,MAAM,aAAa,YAAI,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,CAAU,CAAC;AAOrF;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+C5B;AA+aD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAE/E;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,mBAAmB,GAAG,sBAAsB,GAAG,6BAA6B,CAAC;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE,CA+B5F;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EACnC,QAAQ,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,mBAAmB,CAAA;CAAE,EAAE,GACnD,WAAW,EAAE,CAiBf;AAUD,yEAAyE;AACzE,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAsCvF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,YAAY,EAEZ,MAAM,EACN,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;;;OAGG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE;QACT,0FAA0F;QAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC3C;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC;IAC1C;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,gCAAgC;IAChC,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,sFAAsF;AACtF,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AASD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjD,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACpD,sEAAsE;IACtE,qBAAqB,CAAC,EAAE;QACtB,WAAW,EAAE,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5C,YAAY,EAAE,MAAM,CAAC;KACtB,EAAE,CAAC;IACJ,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC;AAEjE,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;AAEpF;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,YAAY,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,aAAa,GACb,aAAa,GACb,cAAc,GACd,YAAY,GACZ,aAAa,GACb,iBAAiB,GACjB,mBAAmB,GACnB,kBAAkB,GAClB,qBAAqB,GACrB,kBAAkB,GAClB,eAAe,GACf,kBAAkB,GAClB,uBAAuB,GACvB,yBAAyB,GACzB,eAAe,GACf,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,uBAAuB,GACvB,eAAe,GACf,eAAe,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAE7D,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAE7D;AAqBD,QAAA,MAAM,aAAa,YAAI,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,CAAU,CAAC;AAOrF;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgD5B;AA6cD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAE/E;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,mBAAmB,GAAG,sBAAsB,GAAG,6BAA6B,CAAC;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE,CA+B5F;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EACnC,QAAQ,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,mBAAmB,CAAA;CAAE,EAAE,GACnD,WAAW,EAAE,CAiBf;AAUD,yEAAyE;AACzE,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAsCvF"}

package/dist/cjs/emit/print.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"print.d.ts","sourceRoot":"","sources":["../../../src/emit/print.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAS,OAAO,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAiB,YAAY,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE5E,uFAAuF;AACvF,eAAO,MAAM,MAAM,0BAA0B,CAAC;AAqG9C,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAgD7C;AA8UD,KAAK,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC,CAAC;AAkR5F,kHAAkH;AAClH,wBAAgB,UAAU,CACxB,MAAM,EAAE,YAAY,EAAE,EACtB,MAAM,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,EACvC,OAAO,GAAE,YAAiF,GACzF,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAyBrB"}
+{"version":3,"file":"print.d.ts","sourceRoot":"","sources":["../../../src/emit/print.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAS,OAAO,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAiB,YAAY,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE5E,uFAAuF;AACvF,eAAO,MAAM,MAAM,0BAA0B,CAAC;AAqG9C,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAgD7C;AA2WD,KAAK,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC,CAAC;AAkR5F,kHAAkH;AAClH,wBAAgB,UAAU,CACxB,MAAM,EAAE,YAAY,EAAE,EACtB,MAAM,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,EACvC,OAAO,GAAE,YAAiF,GACzF,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAyBrB"}

package/dist/cjs/index.cjs

@@ -44,7 +44,8 @@ var KEYS = /* @__PURE__ */ new Set([
   "environments",
   "routes",
   "defaultProfile",
-  "project"
+  "project",
+  "check"
 ]);
 var ENVIRONMENT_KEYS = ["baseUrl", "clientId", "clientSecret", "settings"];
 var PROJECT_KEYS = ["settings", "secrets", "accessPolicies", "defaultAccessPolicies", "clients"];
@@ -92,6 +93,7 @@ async function loadConfig(options) {
     config: {
       ...config,
       out: (0, import_node_path.resolve)(base2, config.out),
+      ...config.check ? { check: resolveCheck(base2, config.check) } : {},
       ...fsh ? { fsh } : {},
       ...local ? { local } : {}
     }
@@ -139,7 +141,8 @@ function check(config) {
     ...checkEnvironments(record.environments),
     ...checkRouteRows(record),
     ...checkDefaultProfile(record.defaultProfile),
-    ...checkProject(record.project)
+    ...checkProject(record.project),
+    ...checkCheck(record.check)
   );
   for (const key of ["local", "fsh"]) {
     if (record[key] !== void 0 && typeof record[key] !== "string") {
@@ -184,6 +187,32 @@ function checkWildcards(record) {
     ] : [];
   });
 }
+function checkCheck(check2) {
+  if (check2 === void 0) return [];
+  if (typeof check2 !== "object" || check2 === null || Array.isArray(check2)) {
+    return [{ code: "invalid-type", path: "check", message: '"check" must be an object.' }];
+  }
+  const errors = Object.keys(check2).filter((key) => !["tsconfig", "baseline", "ignore"].includes(key)).map((key) => ({
+    code: "unknown-key",
+    path: `check.${key}`,
+    message: `Unknown config key "check.${key}".`
+  }));
+  const { tsconfig, baseline, ignore } = check2;
+  const strings = (v) => Array.isArray(v) && v.every((x) => typeof x === "string");
+  const invalid = (key, expected) => ({
+    code: "invalid-check",
+    path: `check.${key}`,
+    message: `"check.${key}" must be ${expected}.`
+  });
+  if (!(typeof tsconfig === "string" || strings(tsconfig) && tsconfig.length > 0)) {
+    errors.push(invalid("tsconfig", "a tsconfig path, or a list of them"));
+  }
+  if (baseline !== void 0 && typeof baseline !== "string") {
+    errors.push(invalid("baseline", "a path"));
+  }
+  if (ignore !== void 0 && !strings(ignore)) errors.push(invalid("ignore", "a list of globs"));
+  return errors;
+}
 function checkBindings(bindings) {
   if (bindings === void 0) return [];
   if (typeof bindings !== "object" || bindings === null || Array.isArray(bindings)) {
@@ -453,6 +482,13 @@ function checkClients(clients, checkPolicyKey) {
     return errors;
   });
 }
+function resolveCheck(base2, check2) {
+  return {
+    tsconfig: [check2.tsconfig].flat().map((path) => (0, import_node_path.resolve)(base2, path)),
+    ...check2.baseline ? { baseline: (0, import_node_path.resolve)(base2, check2.baseline) } : {},
+    ignore: check2.ignore ?? []
+  };
+}
 
 // src/validate.ts
 var import_node_path4 = require("node:path");