pr-checkmate 1.22.2 → 1.22.4

package/README.md

@@ -7,6 +7,7 @@
 ![TypeScript](https://img.shields.io/badge/TypeScript-6-3178C6?logo=typescript&logoColor=white)
 ![cspell](https://img.shields.io/badge/cspell-10-4285F4)
 ![jscpd](https://img.shields.io/badge/jscpd-5-blue)
+[![API Docs](https://img.shields.io/badge/API_docs-TypeDoc-9600FF?logo=readthedocs&logoColor=white)](https://pr-checkmate-docs.pages.dev)
 
 > **PR CheckMate** is a universal PR quality checker that runs as a single `npm install` and works across **TypeScript, JavaScript, Python, C++, Swift, and Android/Kotlin** repositories — no per-language toolchain setup required.
 
@@ -218,7 +219,7 @@ jobs:
 |---|---|---|
 | ESLint + SonarJS + JSDoc | blocking | Lint with complexity, import order, and doc coverage rules |
 | TypeScript | blocking | `tsc --noEmit` type check |
-| Dependency Check | blocking | Unused / missing deps via depcheck |
+| Dependency Check | blocking | Unused / missing deps via depcheck; silence CLI-only false positives with `dependency.ignore` |
 | NPM Audit | blocking | Vulnerability scan (`moderate`+) |
 | Circular Deps | blocking | Circular dependency detection |
 | License Check | blocking | Blocks GPL / AGPL / LGPL packages |
@@ -226,7 +227,7 @@ jobs:
 | SwiftLint | informational | Swift linting |
 | ktlint | informational | Kotlin linting |
 | Dead Code | informational | Unused exports (`ts-unused-exports`) |
-| Duplicate Code | informational | `jscpd` — 5 lines / 50 tokens threshold |
+| Duplicate Code | informational | `jscpd` — 5 lines / 50 tokens threshold; test files ignored by default (set `duplicate.ignore`); only source-code formats are scanned, so YAML/JSON/Markdown are skipped unless you override `duplicate.formats` |
 | Diff Smell | informational | `console.*`, `debugger`, `TODO/FIXME` in added lines |
 | Diff Security | informational | XSS, `eval`, SQLi, weak crypto in added lines |
 | Sensitive Files | informational | `.env`, private keys, CI configs touched in PR |
@@ -258,8 +259,17 @@ All checks can be tuned or disabled per-repo via `pr-checkmate.json`:
   "swift": { "enabled": true },
   "kotlin": { "enabled": true },
   "cpp": { "enabled": true, "clangFormat": { "style": "Google" } },
-  "duplicate": { "enabled": true, "minLines": 10 },
+  "duplicate": {
+    "enabled": true,
+    "minLines": 10,
+    "formats": ["javascript", "typescript", "jsx", "tsx", "python", "kotlin", "swift", "c", "cpp"],
+    "ignore": ["**/__tests__/**", "**/*.test.*", "**/*.spec.*", "**/test/**", "**/tests/**"]
+  },
   "deadCode": { "enabled": false },
+  "dependency": {
+    "enabled": true,
+    "ignore": ["@types/*", "some-cli-tool"]
+  },
   "commitlint": {
     "enabled": true,
     "types": ["feat", "fix", "docs", "chore", "ci", "refactor", "test"]
@@ -272,6 +282,18 @@ All checks can be tuned or disabled per-repo via `pr-checkmate.json`:
 }
 ```
 
+A note on `duplicate.ignore`:
+
+- Setting it replaces the default test-file list rather than merging with it. If you add your own patterns, include any test globs you still want excluded.
+- `node_modules/**`, `dist/**`, and `.git/**` are always excluded, regardless of config.
+- `duplicate.formats` defaults to source-code formats only, so data files like YAML, JSON, and Markdown are not scanned. Setting it replaces the default list, so add `"yaml"` if you want duplication flagged in those files too.
+
+A note on `dependency.ignore`:
+
+- List dependency names or globs (such as `"@types/*"`) to exclude from the unused/missing check. The values are passed straight to depcheck's `--ignores`.
+- Use it for packages that only run as CLI binaries or are referenced from config files. depcheck sees no `import` for them and would otherwise flag them as unused.
+- When set, `dependency.ignore` takes precedence over any `.depcheckrc` file. Leave it empty or unset and your existing `.depcheckrc` still applies.
+
 ---
 
 ## Delta Mode
@@ -280,6 +302,60 @@ In GitHub Actions PR context, language checks automatically switch to **delta mo
 
 ---
 
+## Programmatic API
+
+Besides the CLI, PR CheckMate ships a typed programmatic API. Install the package and import checks directly — useful for embedding the same quality gates inside your own tooling. The full reference is published at the [API docs site](https://pr-checkmate-docs.pages.dev).
+
+Run the built-in checks:
+
+```ts
+import { runChecks } from 'pr-checkmate';
+import type { CheckReport } from 'pr-checkmate';
+
+const report: CheckReport = await runChecks({
+  cwd: process.cwd(),
+  reporter: 'stdout', // 'none' | 'stdout' | 'github' | (report) => void
+});
+
+if (!report.ok) process.exit(1);
+```
+
+`runChecks` never throws on violations and never calls `process.exit` — the caller decides. `report.ok` is `true` when nothing failed; warnings and skips do not affect it.
+
+Author a custom check:
+
+```ts
+import { runChecks, defineCheck, pass, fail } from 'pr-checkmate';
+
+const noFixmes = defineCheck({
+  name: 'no-fixmes',
+  phase: 'lint',
+  applies: () => true,
+  run: async (ctx) => {
+    // inspect ctx (config, changed files, language, sha range) and return an outcome
+    return pass();
+  },
+});
+
+await runChecks({ checks: [noFixmes] }); // appended to the built-in registry by default
+```
+
+### Key exports
+
+| Export | Purpose |
+|---|---|
+| `runChecks` | Run the check pipeline; returns a structured `CheckReport` |
+| `buildContext` | Build the `CheckContext` (language, config, sha range) checks receive |
+| `REGISTRY` | The array of built-in checks |
+| `defineCheck` | Identity helper for authoring a `Check` with full type inference |
+| `pass` / `warn` / `fail` / `skip` | Outcome constructors for check bodies |
+| `getSourcePath` / `getPackageConfigPath` / `hasLocalConfig` | Config-path helpers |
+| Types | `Check`, `CheckContext`, `CheckReport`, `CheckResult`, `CheckOutcome`, `CheckStatus`, `RunOptions`, `Language`, `Phase`, `ReporterKind`, `ReporterFn`, `PRCheckMateConfig` |
+
+Regenerate the docs locally with `npm run docs` (output in `docs/api`).
+
+---
+
 ## PR Summary Comment
 
 After `npx pr-checkmate all`, a summary table is posted to the PR. On repeated pushes the comment is updated in place — no duplicate comments.

package/dist/config/constants.d.ts

@@ -2,7 +2,21 @@
  * Common patterns to ignore in all checks
  */
 export declare const IGNORE_PATTERNS: string[];
+/**
+ * Test files/folders excluded from duplicate-code detection by default.
+ * Test suites legitimately repeat setup/arrange/assert boilerplate, so counting
+ * them as clones is noise that drowns out real production duplication. Clients can
+ * override this list via `duplicate.ignore` in pr-checkmate.json.
+ */
+export declare const DUPLICATE_IGNORE_DEFAULTS: string[];
 export declare const CONFIG_FILE_PATTERNS: string[];
+/**
+ * jscpd formats the duplicate-CODE check scans. Restricting to code formats keeps
+ * config/CI YAML and JSON out of the report — they are data, not code, and their
+ * repetition is not meaningful duplication. This mirrors the code-only file set the
+ * check already uses when scanning a git diff, so full-tree and diff scans agree.
+ */
+export declare const DUPLICATE_CODE_FORMATS: string[];
 /**
  * File extensions to check
  */

package/dist/config/constants.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONFIG_FILE = exports.documentation = exports.DEFAULT_ALLOW_PACKAGES = exports.DEFAULT_COMMANDS = exports.SOURCE_EXTENSIONS = exports.CONFIG_FILE_PATTERNS = exports.IGNORE_PATTERNS = void 0;
+exports.CONFIG_FILE = exports.documentation = exports.DEFAULT_ALLOW_PACKAGES = exports.DEFAULT_COMMANDS = exports.SOURCE_EXTENSIONS = exports.DUPLICATE_CODE_FORMATS = exports.CONFIG_FILE_PATTERNS = exports.DUPLICATE_IGNORE_DEFAULTS = exports.IGNORE_PATTERNS = void 0;
 const node_path_1 = __importDefault(require("node:path"));
 /**
  * Common patterns to ignore in all checks
@@ -57,14 +57,49 @@ exports.IGNORE_PATTERNS = [
     '**/lint-report/**',
     '**/audit-report/**',
 ];
+/**
+ * Test files/folders excluded from duplicate-code detection by default.
+ * Test suites legitimately repeat setup/arrange/assert boilerplate, so counting
+ * them as clones is noise that drowns out real production duplication. Clients can
+ * override this list via `duplicate.ignore` in pr-checkmate.json.
+ */
+exports.DUPLICATE_IGNORE_DEFAULTS = [
+    '**/__tests__/**',
+    '**/__mocks__/**',
+    '**/*.test.*',
+    '**/*.spec.*',
+    '**/test/**',
+    '**/tests/**',
+];
 exports.CONFIG_FILE_PATTERNS = [
     '**/*.config.js',
+    '**/*.config.cjs',
+    '**/*.config.mjs',
     '**/*.config.ts',
+    '**/.eslintrc.*',
+    '**/eslint.config.*',
     '**/jest.config.*',
     '**/wdio.config.*',
     '**/playwright.config.*',
     '**/cypress.config.*',
 ];
+/**
+ * jscpd formats the duplicate-CODE check scans. Restricting to code formats keeps
+ * config/CI YAML and JSON out of the report — they are data, not code, and their
+ * repetition is not meaningful duplication. This mirrors the code-only file set the
+ * check already uses when scanning a git diff, so full-tree and diff scans agree.
+ */
+exports.DUPLICATE_CODE_FORMATS = [
+    'javascript',
+    'typescript',
+    'jsx',
+    'tsx',
+    'python',
+    'kotlin',
+    'swift',
+    'c',
+    'cpp',
+];
 /**
  * File extensions to check
  */

package/dist/config/index.d.ts

@@ -13,11 +13,3 @@ export declare function getPackageConfigPath(fileName: string): string;
  * Check if project has local config
  */
 export declare function hasLocalConfig(configNames: string[]): boolean;
-/**
- * For backward compatibility, also export as constant
- * But this will be evaluated at module load time
- */
-export declare const config: {
-    sourcePath: string;
-};
-export declare const SOURCE_PATH: string;

package/dist/config/index.js

@@ -17,7 +17,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SOURCE_PATH = exports.config = exports.loadProjectConfig = void 0;
+exports.loadProjectConfig = void 0;
 exports.getSourcePath = getSourcePath;
 exports.getPackageConfigPath = getPackageConfigPath;
 exports.hasLocalConfig = hasLocalConfig;
@@ -65,9 +65,3 @@ function hasLocalConfig(configNames) {
     const projectRoot = process.cwd();
     return configNames.some(name => node_fs_1.default.existsSync(node_path_1.default.join(projectRoot, name)));
 }
-/**
- * For backward compatibility, also export as constant
- * But this will be evaluated at module load time
- */
-exports.config = loadConfig();
-exports.SOURCE_PATH = exports.config.sourcePath;

package/dist/config/loader.d.ts

@@ -4,11 +4,3 @@ import { PRCheckMateConfig } from '../interfaces';
  * Falls back to defaults if not found
  */
 export declare function loadProjectConfig(): PRCheckMateConfig;
-/**
- * Get default configuration
- */
-export declare function getDefaultConfig(): PRCheckMateConfig;
-/**
- * Export config for external use
- */
-export declare const DEFAULT_CONFIG: PRCheckMateConfig;

package/dist/config/loader.js

@@ -3,9 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_CONFIG = void 0;
 exports.loadProjectConfig = loadProjectConfig;
-exports.getDefaultConfig = getDefaultConfig;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../utils");
@@ -71,6 +69,7 @@ function mergeWithDefaults(userConfig) {
         diffSmell: { ...defaults.diffSmell, ...userConfig.diffSmell },
         prBody: { ...defaults.prBody, ...userConfig.prBody },
         duplicate: { ...defaults.duplicate, ...userConfig.duplicate },
+        dependency: { ...defaults.dependency, ...userConfig.dependency },
         commitlint: { ...defaults.commitlint, ...userConfig.commitlint },
         deadCode: { ...defaults.deadCode, ...userConfig.deadCode },
         licenseCheck: {
@@ -146,8 +145,15 @@ function getDefaultConfig() {
         kotlin: { enabled: true },
         diffSmell: { enabled: true },
         prBody: { enabled: true, minLength: 20, requireTicket: true },
-        duplicate: { enabled: true, minLines: 5, minTokens: 50 },
-        deadCode: { enabled: true },
+        duplicate: {
+            enabled: true,
+            minLines: 5,
+            minTokens: 50,
+            ignore: constants_1.DUPLICATE_IGNORE_DEFAULTS,
+            formats: constants_1.DUPLICATE_CODE_FORMATS,
+        },
+        dependency: { enabled: true, ignore: [] },
+        deadCode: { enabled: true, ignoreFiles: [] },
         commitlint: {
             enabled: true,
             types: [
@@ -174,7 +180,3 @@ function getDefaultConfig() {
         },
     };
 }
-/**
- * Export config for external use
- */
-exports.DEFAULT_CONFIG = getDefaultConfig();

package/dist/core/checks/dead-code.js

@@ -24,6 +24,12 @@ exports.deadCodeCheck = {
         }
         const bin = (0, utils_1.resolvePackageBin)('ts-unused-exports', 'bin/ts-unused-exports');
         try {
+            // Run the full analysis unfiltered: ignore patterns are applied to the
+            // *report* below, not passed to ts-unused-exports' own `--ignoreFiles`.
+            // That flag drops files from analysis entirely, so a file's imports stop
+            // counting as usage — ignoring a barrel or entry point would then cascade
+            // and flag everything it re-exports. Filtering the output instead keeps
+            // every usage edge intact and only hides the exempted files' own reports.
             const result = await (0, execa_1.execa)(process.execPath, [bin, tsConfigPath], {
                 cwd: ctx.cwd,
                 reject: false,
@@ -33,14 +39,31 @@ exports.deadCodeCheck = {
                 utils_1.logger.info('[Dead Code]: ✅ No unused exports found');
                 return (0, types_1.pass)();
             }
-            const lines = output.split('\n').filter(l => l.trim());
-            const fileCount = lines.length;
-            const exportCount = lines.reduce((sum, line) => {
-                const match = line.match(/\[(\d+)\]:/);
-                return sum + (match ? parseInt(match[1], 10) : 1);
-            }, 0);
+            const ignore = compileIgnorePatterns(ctx.config.deadCode?.ignoreFiles);
+            // ts-unused-exports prints one `path: sym1, sym2` line per file, preceded
+            // by a `N modules with unused exports` summary line we skip.
+            const entries = output
+                .split('\n')
+                .map(line => line.trim().match(/^(.+\.[cm]?tsx?): (.+)$/))
+                .filter((match) => match !== null)
+                .map(match => ({
+                file: match[1],
+                symbols: match[2]
+                    .split(',')
+                    .map(sym => sym.trim())
+                    .filter(Boolean),
+            }))
+                .filter(entry => !ignore.some(re => re.test(entry.file)));
+            if (entries.length === 0) {
+                utils_1.logger.info('[Dead Code]: ✅ No unused exports found');
+                return (0, types_1.pass)();
+            }
+            const fileCount = entries.length;
+            const exportCount = entries.reduce((sum, entry) => sum + entry.symbols.length, 0);
             utils_1.logger.warn(`[Dead Code]: ⚠️ ${exportCount} unused export(s) across ${fileCount} file(s):`);
-            utils_1.logger.warn(output);
+            for (const entry of entries) {
+                utils_1.logger.warn(`${entry.file}: ${entry.symbols.join(', ')}`);
+            }
             return (0, types_1.warn)(`${exportCount} unused export(s) in ${fileCount} file(s)`);
         }
         catch (err) {
@@ -49,3 +72,18 @@ exports.deadCodeCheck = {
         }
     },
 };
+/**
+ * Compile `deadCode.ignoreFiles` regex sources, skipping any that fail to parse
+ * (a bad pattern warns rather than aborting the whole check).
+ */
+function compileIgnorePatterns(patterns) {
+    return (patterns ?? []).filter(Boolean).flatMap(pattern => {
+        try {
+            return [new RegExp(pattern)];
+        }
+        catch {
+            utils_1.logger.warn(`[Dead Code]: ⚠️ Ignoring invalid ignoreFiles pattern: ${pattern}`);
+            return [];
+        }
+    });
+}

package/dist/core/checks/dependency-check.js

@@ -13,6 +13,8 @@ exports.dependencyCheck = {
     name: 'Dependencies',
     phase: 'blocking',
     applies(ctx) {
+        if (ctx.config.dependency?.enabled === false)
+            return false;
         return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
     },
     async run(ctx) {
@@ -25,8 +27,16 @@ exports.dependencyCheck = {
         catch {
             return (0, types_1.skip)('depcheck unavailable');
         }
+        // Dependency names/globs to skip, configured in pr-checkmate.json. Passed via
+        // --ignores so a single pr-checkmate.json is the source of truth; depcheck's
+        // CLI --ignores overrides any .depcheckrc, so we only pass it when non-empty
+        // (letting a client's own .depcheckrc still apply when nothing is configured).
+        const ignore = ctx.config.dependency?.ignore ?? [];
+        const args = [depcheckBin, '--json'];
+        if (ignore.length > 0)
+            args.push(`--ignores=${ignore.join(',')}`);
         // reject:false — depcheck exits non-zero when it finds issues but still emits JSON on stdout.
-        const { stdout } = await (0, execa_1.execa)(process.execPath, [depcheckBin, '--json'], {
+        const { stdout } = await (0, execa_1.execa)(process.execPath, args, {
             cwd: ctx.cwd,
             reject: false,
         });

package/dist/core/checks/duplicate-check.js

@@ -7,9 +7,15 @@ exports.duplicateCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const execa_1 = require("execa");
+const constants_1 = require("../../config/constants");
 const utils_1 = require("../../utils");
 const delta_1 = require("../../utils/delta");
 const types_1 = require("../types");
+// Always excluded regardless of client config — scanning these never yields
+// meaningful production duplication. Config files (eslint/*.config.*) are data,
+// not logic, and are commonly shipped in two formats (e.g. .eslintrc + flat
+// config), so their repetition is expected rather than a code smell.
+const BASE_IGNORE = ['node_modules/**', 'dist/**', '.git/**', ...constants_1.CONFIG_FILE_PATTERNS];
 // jscpd v5 appends promotional/funding lines after its report. Strip them so
 // they never reach the client's terminal when running our package.
 const JSCPD_PROMO_MARKERS = [
@@ -44,6 +50,14 @@ exports.duplicateCheck = {
         const srcPath = node_path_1.default.join(ctx.cwd, 'src');
         const targetPaths = changedFiles ?? (node_fs_1.default.existsSync(srcPath) ? [srcPath] : [ctx.cwd]);
         const jscpdBin = (0, utils_1.resolvePackageBin)('jscpd', 'run-jscpd.js');
+        // Client-configurable exclusions (pr-checkmate.json `duplicate.ignore`),
+        // defaulting to test files/folders, appended to the always-on base ignores.
+        const configuredIgnore = ctx.config.duplicate?.ignore ?? constants_1.DUPLICATE_IGNORE_DEFAULTS;
+        const ignore = [...BASE_IGNORE, ...configuredIgnore].join(',');
+        // Client-configurable formats (pr-checkmate.json `duplicate.formats`),
+        // defaulting to source-code formats so data files (yaml/json/markdown) are
+        // not scanned. Clients can add them back explicitly.
+        const formats = (ctx.config.duplicate?.formats ?? constants_1.DUPLICATE_CODE_FORMATS).join(',');
         try {
             const result = await (0, execa_1.execa)(process.execPath, [
                 jscpdBin,
@@ -53,8 +67,10 @@ exports.duplicateCheck = {
                 String(minTokens),
                 '--reporters',
                 'console',
+                '--format',
+                formats,
                 '--ignore',
-                'node_modules/**,dist/**,.git/**',
+                ignore,
                 ...targetPaths,
             ], { cwd: ctx.cwd, reject: false });
             const output = stripJscpdPromo([result.stdout, result.stderr].filter(Boolean).join('\n'));

package/dist/core/checks/python-format.js

@@ -9,7 +9,7 @@ const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../utils");
 const targets_1 = require("../targets");
 const types_1 = require("../types");
-const PY_GLOBS = ['*.py'];
+const ruff_shared_1 = require("./ruff-shared");
 /**
  * Formats changed Python files with Ruff's formatter (WASM, no Python/pip needed).
  * Read-only in check mode (`warn` when files differ from formatted output); rewrites
@@ -24,13 +24,12 @@ exports.pythonFormatCheck = {
             ctx.languages.includes('python'));
     },
     async run(ctx) {
-        const targets = await (0, targets_1.resolveTargetFiles)(ctx, PY_GLOBS);
+        const targets = await (0, targets_1.resolveTargetFiles)(ctx, ruff_shared_1.PY_GLOBS);
         if (targets === null)
             return (0, types_1.skip)('git unavailable');
         if (targets.length === 0)
             return (0, types_1.pass)('no Python files changed');
-        const { Workspace, PositionEncoding } = require('@astral-sh/ruff-wasm-nodejs');
-        const workspace = new Workspace(Workspace.defaultSettings(), PositionEncoding.Utf16);
+        const workspace = (0, ruff_shared_1.createRuffWorkspace)();
         let unformatted = 0;
         for (const rel of targets) {
             const abs = node_path_1.default.join(ctx.cwd, rel);

package/dist/core/checks/python-lint.js

@@ -9,7 +9,7 @@ const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../utils");
 const targets_1 = require("../targets");
 const types_1 = require("../types");
-const PY_GLOBS = ['*.py'];
+const ruff_shared_1 = require("./ruff-shared");
 /**
  * Lints changed Python files with Ruff, bundled as a self-contained WASM module
  * (`@astral-sh/ruff-wasm-nodejs`) so it runs on a bare Node image with no Python
@@ -26,13 +26,12 @@ exports.pythonLintCheck = {
             ctx.languages.includes('python'));
     },
     async run(ctx) {
-        const targets = await (0, targets_1.resolveTargetFiles)(ctx, PY_GLOBS);
+        const targets = await (0, targets_1.resolveTargetFiles)(ctx, ruff_shared_1.PY_GLOBS);
         if (targets === null)
             return (0, types_1.skip)('git unavailable');
         if (targets.length === 0)
             return (0, types_1.pass)('no Python files changed');
-        const { Workspace, PositionEncoding } = require('@astral-sh/ruff-wasm-nodejs');
-        const workspace = new Workspace(Workspace.defaultSettings(), PositionEncoding.Utf16);
+        const workspace = (0, ruff_shared_1.createRuffWorkspace)();
         let totalIssues = 0;
         let filesWithIssues = 0;
         for (const rel of targets) {

package/dist/core/checks/ruff-shared.d.ts

@@ -0,0 +1,10 @@
+type RuffModule = typeof import('@astral-sh/ruff-wasm-nodejs');
+type RuffWorkspace = InstanceType<RuffModule['Workspace']>;
+export declare const PY_GLOBS: string[];
+/**
+ * Instantiate a Ruff WASM workspace with default settings. Shared by the Ruff
+ * lint and format checks so their setup stays identical, and kept as a function
+ * (not a module-level singleton) so the WASM module loads only when a check runs.
+ */
+export declare function createRuffWorkspace(): RuffWorkspace;
+export {};

package/dist/core/checks/ruff-shared.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PY_GLOBS = void 0;
+exports.createRuffWorkspace = createRuffWorkspace;
+exports.PY_GLOBS = ['*.py'];
+/**
+ * Instantiate a Ruff WASM workspace with default settings. Shared by the Ruff
+ * lint and format checks so their setup stays identical, and kept as a function
+ * (not a module-level singleton) so the WASM module loads only when a check runs.
+ */
+function createRuffWorkspace() {
+    const { Workspace, PositionEncoding } = require('@astral-sh/ruff-wasm-nodejs');
+    return new Workspace(Workspace.defaultSettings(), PositionEncoding.Utf16);
+}

package/dist/core/reporters.d.ts

@@ -1,7 +1,6 @@
-import type { CheckReport, CheckResult } from './types';
+import type { CheckReport } from './types';
 /**
  * Emit the report through the selected channel.
  * none: nothing · stdout: console table · github: table + upsert PR comment.
  */
 export declare function report(kind: 'none' | 'stdout' | 'github', result: CheckReport): Promise<void>;
-export type { CheckResult };

package/dist/core/run-checks.js

@@ -54,7 +54,12 @@ function errMessage(err) {
 async function runOne(check, ctx, collector) {
     try {
         if (!(await check.applies(ctx))) {
-            collector.register(check.name, 'skip', 'not applicable');
+            // A check that doesn't apply is irrelevant to this project/run — e.g. a
+            // language-specific check (SwiftLint, ktlint, Ruff, C++) in a repo of a
+            // different language, or a check disabled in config. Omit it from the report
+            // entirely rather than listing it as "not applicable": in a single-language
+            // repo those rows are pure noise and inflate the skipped count. Runtime skips
+            // from run() (e.g. "no relevant files changed") are still reported.
             return;
         }
         const outcome = await check.run(ctx);

package/dist/index.d.ts

@@ -7,3 +7,4 @@ export { runChecks, buildContext, REGISTRY } from './core';
 export { pass, warn, fail, skip, defineCheck } from './core';
 export type { Check, CheckContext, CheckOutcome, CheckReport, CheckResult, CheckStatus, Language, Phase, ReporterFn, ReporterKind, RunOptions, } from './core';
 export { getSourcePath, getPackageConfigPath, hasLocalConfig } from './config';
+export type { PRCheckMateConfig } from './interfaces';

package/dist/init.d.ts

@@ -1,4 +1,3 @@
-export declare const CONFIG_FILE: string;
 /**
  * Initialize (or refresh) pr-checkmate configuration in the current project.
  */

package/dist/init.js

@@ -3,14 +3,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONFIG_FILE = void 0;
 exports.init = init;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const inquirer_1 = __importDefault(require("inquirer"));
 const config_1 = require("./config");
 const utils_1 = require("./utils");
-exports.CONFIG_FILE = path_1.default.resolve(process.cwd(), 'pr-checkmate.json');
+const CONFIG_FILE = path_1.default.resolve(process.cwd(), 'pr-checkmate.json');
 /**
  * Default configuration structure with customization options
  */
@@ -60,6 +59,18 @@ const DEFAULT_CONFIG = {
         enabled: true,
         minLines: 5,
         minTokens: 50,
+        // Test files/folders are excluded by default; edit to customise.
+        ignore: config_1.DUPLICATE_IGNORE_DEFAULTS,
+        // Only source-code formats are scanned. Data formats (yaml, json, markdown)
+        // are intentionally absent — add them here to detect duplication in them too.
+        formats: config_1.DUPLICATE_CODE_FORMATS,
+    },
+    // Dependency usage check (depcheck)
+    dependency: {
+        enabled: true,
+        // Dependency names/globs to skip (e.g. CLI-only tools invoked as binaries,
+        // which depcheck can't see as imports and would report as unused).
+        ignore: [],
     },
     documentation: config_1.documentation,
 };
@@ -135,7 +146,7 @@ async function createConfig(root) {
         sourcePath,
         languages,
     };
-    fs_1.default.writeFileSync(exports.CONFIG_FILE, JSON.stringify(config, null, 2));
+    fs_1.default.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
     utils_1.logger.info(`[init]: ✅ Created pr-checkmate.json with sourcePath: ${sourcePath}`);
     utils_1.logger.info(`[init]: 💡 You can now customize ESLint rules, Prettier settings,
       and cspell words in pr-checkmate.json`);
@@ -146,7 +157,7 @@ async function createConfig(root) {
 async function updateConfig(root) {
     utils_1.logger.info('[init]: pr-checkmate.json already exists — updating it.');
     try {
-        const raw = fs_1.default.readFileSync(exports.CONFIG_FILE, 'utf-8');
+        const raw = fs_1.default.readFileSync(CONFIG_FILE, 'utf-8');
         const json = JSON.parse(raw);
         const languages = await (0, utils_1.detectLanguages)(root);
         utils_1.logger.info(`[init]: 🔍 Detected languages: ${languages.length ? languages.join(', ') : 'none'}`);
@@ -164,7 +175,7 @@ async function updateConfig(root) {
             prBody: { ...DEFAULT_CONFIG.prBody, ...(json.prBody || {}) },
             duplicate: { ...DEFAULT_CONFIG.duplicate, ...(json.duplicate || {}) },
         };
-        fs_1.default.writeFileSync(exports.CONFIG_FILE, JSON.stringify(updated, null, 2));
+        fs_1.default.writeFileSync(CONFIG_FILE, JSON.stringify(updated, null, 2));
         utils_1.logger.info('[init]: 🔧 Updated pr-checkmate.json with customization options.');
         utils_1.logger.info('[init]: 💡 You can now add custom ESLint rules, cspell words, and more!');
     }
@@ -177,7 +188,7 @@ async function updateConfig(root) {
  */
 async function init() {
     const root = process.cwd();
-    if (fs_1.default.existsSync(exports.CONFIG_FILE)) {
+    if (fs_1.default.existsSync(CONFIG_FILE)) {
         await updateConfig(root);
     }
     else {

package/dist/interfaces/index.d.ts

@@ -72,6 +72,31 @@ export interface PRCheckMateConfig {
         enabled?: boolean;
         minLines?: number;
         minTokens?: number;
+        /**
+         * Glob patterns excluded from duplicate detection, in addition to the always-on
+         * node_modules/dist/.git ignores. Defaults to test files/folders
+         * (see DUPLICATE_IGNORE_DEFAULTS). Setting this replaces the default list.
+         */
+        ignore?: string[];
+        /**
+         * jscpd formats to scan. Defaults to source-code formats only
+         * (see DUPLICATE_CODE_FORMATS) — data formats like `yaml`, `json` and
+         * `markdown` are intentionally NOT scanned, since their repetition is rarely
+         * meaningful duplication. Add them back (e.g. `["typescript", "yaml"]`) if you
+         * do want to detect duplication in those files. Setting this replaces the list.
+         */
+        formats?: string[];
+    };
+    dependency?: {
+        enabled?: boolean;
+        /**
+         * Dependency names to exclude from the unused/missing check (depcheck).
+         * Supports globs, e.g. "@types/*". Use for packages that are invoked only as
+         * CLI binaries or referenced from config — depcheck sees no `import` for them
+         * and would otherwise report them as unused. Passed to depcheck's `--ignores`,
+         * which takes precedence over any `.depcheckrc` file.
+         */
+        ignore?: string[];
     };
     commitlint?: {
         enabled?: boolean;
@@ -97,33 +122,20 @@ export interface PRCheckMateConfig {
     };
     deadCode?: {
         enabled?: boolean;
+        /**
+         * Regex sources matched against reported file paths; matching files are
+         * dropped from the dead-code report. Use to exempt intentional public
+         * surface — a package entry point (`src/index.ts`) or re-export barrels
+         * whose exports are consumed by external installers, not within the repo.
+         * Applied to the report (not ts-unused-exports' own `--ignoreFiles`), so it
+         * never removes a file from analysis and cannot cascade onto other files.
+         */
+        ignoreFiles?: string[];
     };
     licenseCheck?: {
         allowPackages?: string[];
         allowLicenses?: string[];
     };
 }
-export interface CheckmateConfig {
-    skipLint?: boolean;
-    skipDeps?: boolean;
-    skipFormat?: boolean;
-    skipSpell?: boolean;
-    skipSecurity?: boolean;
-    skipNpmAudit?: boolean;
-    skipCircularDeps?: boolean;
-    skipLicense?: boolean;
-    skipPrSize?: boolean;
-    skipPrTitle?: boolean;
-    skipOutdated?: boolean;
-    skipMarkdown?: boolean;
-    skipTypecheck?: boolean;
-    skipDiffSmell?: boolean;
-    skipPrBody?: boolean;
-    skipDuplicate?: boolean;
-    skipDiffSecurity?: boolean;
-    skipSensitiveFiles?: boolean;
-    skipDeadCode?: boolean;
-    autoCommit?: boolean;
-}
 export type { CheckStatus, CheckResult } from '../utils/result-collector';
 export type { Language } from '../utils/detect-language';

package/dist/scripts/copy-configs.d.ts

@@ -1,5 +1 @@
-/**
- *
- */
-declare function copyConfigs(): void;
-export { copyConfigs };
+export {};

package/dist/scripts/copy-configs.js

@@ -3,7 +3,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.copyConfigs = copyConfigs;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../utils");

package/dist/utils/own-deps.js

@@ -19,15 +19,19 @@ function readDependencyNames(pkgDir) {
         return [];
     }
 }
-/** Walk up from this module until we find pr-checkmate's own package root. */
-function findOwnPackageRoot() {
-    let dir = __dirname;
+/**
+ * Walk up from `startDir` (inclusive) toward the filesystem root, returning the
+ * first directory whose package.json declares `name === expectedName`, or null.
+ * Broken/missing package.json files are skipped rather than thrown.
+ */
+function findPackageRootByName(startDir, expectedName) {
+    let dir = startDir;
     while (dir !== node_path_1.default.dirname(dir)) {
         const pkgJsonPath = node_path_1.default.join(dir, PACKAGE_JSON);
         if (node_fs_1.default.existsSync(pkgJsonPath)) {
             try {
                 const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));
-                if (pkg.name === OWN_PACKAGE_NAME)
+                if (pkg.name === expectedName)
                     return dir;
             }
             catch { }
@@ -36,6 +40,10 @@ function findOwnPackageRoot() {
     }
     return null;
 }
+/** Walk up from this module until we find pr-checkmate's own package root. */
+function findOwnPackageRoot() {
+    return findPackageRootByName(__dirname, OWN_PACKAGE_NAME);
+}
 /**
  * Resolve a dependency's install directory by name, starting the search from
  * `fromDir`. Relies on Node's upward node_modules walk so hoisted packages are
@@ -50,19 +58,8 @@ function resolvePackageDir(name, fromDir) {
     // Fallback for packages whose exports map hides ./package.json: resolve the
     // entry point and walk up to the package's own root.
     try {
-        let dir = node_path_1.default.dirname(require.resolve(name, { paths: [fromDir] }));
-        while (dir !== node_path_1.default.dirname(dir)) {
-            const pkgJsonPath = node_path_1.default.join(dir, PACKAGE_JSON);
-            if (node_fs_1.default.existsSync(pkgJsonPath)) {
-                try {
-                    const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));
-                    if (pkg.name === name)
-                        return dir;
-                }
-                catch { }
-            }
-            dir = node_path_1.default.dirname(dir);
-        }
+        const entryDir = node_path_1.default.dirname(require.resolve(name, { paths: [fromDir] }));
+        return findPackageRootByName(entryDir, name);
     }
     catch { }
     return null;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.22.2",
+    "version": "1.22.4",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",
@@ -46,6 +46,7 @@
         "lint": "eslint \"src/**/*.{ts,tsx}\" --fix",
         "prettier": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json,md}\"",
         "spellcheck": "cspell '**/*.{ts,tsx,js,jsx,md,json}' --no-progress",
+        "docs": "typedoc",
         "scan:secrets": "gitleaks-secret-scanner --diff-mode ci --html-report gitleaks-report.html",
         "test": "echo 'Tests coming soon'",
         "security-scan": "npx pr-checkmate security",
@@ -99,6 +100,7 @@
         "typescript": "^6.0.3"
     },
     "devDependencies": {
-        "standard-version": "^9.5.0"
+        "standard-version": "^9.5.0",
+        "typedoc": "^0.28.20"
     }
 }

package/dist/config/config.d.ts

@@ -1,2 +0,0 @@
-export declare const config: any;
-export declare const SOURCE_PATH: any;

package/dist/config/config.js

@@ -1,12 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SOURCE_PATH = exports.config = void 0;
-const node_fs_1 = __importDefault(require("node:fs"));
-const constants_1 = require("./constants");
-exports.config = node_fs_1.default.existsSync(constants_1.CONFIG_FILE)
-    ? JSON.parse(node_fs_1.default.readFileSync(constants_1.CONFIG_FILE, 'utf-8'))
-    : { sourcePath: 'src' };
-exports.SOURCE_PATH = exports.config.sourcePath;