pr-checkmate 1.22.3 → 1.22.5

package/.eslintrc.js

@@ -81,7 +81,7 @@ module.exports = {
       { blankLine: 'always', prev: '*', next: 'return' },
     ],
     // Complexity analysis (#61)
-    complexity: ['warn', 15],
+    complexity: ['warn', 30],
     // Import ordering (#65)
     'import-x/order': [
       'warn',

package/README.md

@@ -219,15 +219,15 @@ jobs:
 |---|---|---|
 | ESLint + SonarJS + JSDoc | blocking | Lint with complexity, import order, and doc coverage rules |
 | TypeScript | blocking | `tsc --noEmit` type check |
-| Dependency Check | blocking | Unused / missing deps via depcheck |
+| Dependency Check | blocking | Unused / missing deps via depcheck; silence CLI-only false positives with `dependency.ignore` |
 | NPM Audit | blocking | Vulnerability scan (`moderate`+) |
 | Circular Deps | blocking | Circular dependency detection |
 | License Check | blocking | Blocks GPL / AGPL / LGPL packages |
 | Ruff Lint | informational | Python linting via WASM |
 | SwiftLint | informational | Swift linting |
 | ktlint | informational | Kotlin linting |
-| Dead Code | informational | Unused exports (`ts-unused-exports`) |
-| Duplicate Code | informational | `jscpd` — 5 lines / 50 tokens threshold |
+| Dead Code | informational | Unused exports (`ts-unused-exports`); test and mock files are excluded from the report by default — override with `deadCode.ignoreFiles` (regex) |
+| Duplicate Code | informational | `jscpd` — 5 lines / 50 tokens threshold; test files ignored by default (set `duplicate.ignore`); only source-code formats are scanned, so YAML/JSON/Markdown are skipped unless you override `duplicate.formats` |
 | Diff Smell | informational | `console.*`, `debugger`, `TODO/FIXME` in added lines |
 | Diff Security | informational | XSS, `eval`, SQLi, weak crypto in added lines |
 | Sensitive Files | informational | `.env`, private keys, CI configs touched in PR |
@@ -259,8 +259,20 @@ All checks can be tuned or disabled per-repo via `pr-checkmate.json`:
   "swift": { "enabled": true },
   "kotlin": { "enabled": true },
   "cpp": { "enabled": true, "clangFormat": { "style": "Google" } },
-  "duplicate": { "enabled": true, "minLines": 10 },
-  "deadCode": { "enabled": false },
+  "duplicate": {
+    "enabled": true,
+    "minLines": 10,
+    "formats": ["javascript", "typescript", "jsx", "tsx", "python", "kotlin", "swift", "c", "cpp"],
+    "ignore": ["**/__tests__/**", "**/*.test.*", "**/*.spec.*", "**/test/**", "**/tests/**"]
+  },
+  "deadCode": {
+    "enabled": true,
+    "ignoreFiles": ["src/index\\.ts", "handler"]
+  },
+  "dependency": {
+    "enabled": true,
+    "ignore": ["@types/*", "some-cli-tool"]
+  },
   "commitlint": {
     "enabled": true,
     "types": ["feat", "fix", "docs", "chore", "ci", "refactor", "test"]
@@ -273,6 +285,25 @@ All checks can be tuned or disabled per-repo via `pr-checkmate.json`:
 }
 ```
 
+A note on `duplicate.ignore`:
+
+- Setting it replaces the default test-file list rather than merging with it. If you add your own patterns, include any test globs you still want excluded.
+- `node_modules/**`, `dist/**`, and `.git/**` are always excluded, regardless of config.
+- `duplicate.formats` defaults to source-code formats only, so data files like YAML, JSON, and Markdown are not scanned. Setting it replaces the default list, so add `"yaml"` if you want duplication flagged in those files too.
+
+A note on `dependency.ignore`:
+
+- List dependency names or globs (such as `"@types/*"`) to exclude from the unused/missing check. The values are passed straight to depcheck's `--ignores`.
+- Use it for packages that only run as CLI binaries or are referenced from config files. depcheck sees no `import` for them and would otherwise flag them as unused.
+- When set, `dependency.ignore` takes precedence over any `.depcheckrc` file. Leave it empty or unset and your existing `.depcheckrc` still applies.
+
+A note on `deadCode.ignoreFiles`:
+
+- The values are regex sources, not globs, and each one is matched against the file path. So `\.test\.` matches any file with `.test.` in its name.
+- It defaults to test and mock files: `/__tests__/`, `/__mocks__/`, `/__mock__/`, `/tests?/`, `\.test\.`, `\.spec\.`. Their exports are consumed only by the test runner, so they showed up as false-positive "unused" before.
+- Setting it replaces the default list rather than merging with it. Reach for it to exempt entry points or barrels like `src/index.ts` or a lambda `handler` whose exports are the public surface.
+- It applies to the report only and never drops files from analysis, so a match here cannot cascade into missed dead code elsewhere.
+
 ---
 
 ## Delta Mode

package/dist/config/constants.d.ts

@@ -2,7 +2,31 @@
  * Common patterns to ignore in all checks
  */
 export declare const IGNORE_PATTERNS: string[];
+/**
+ * Test files/folders excluded from duplicate-code detection by default.
+ * Test suites legitimately repeat setup/arrange/assert boilerplate, so counting
+ * them as clones is noise that drowns out real production duplication. Clients can
+ * override this list via `duplicate.ignore` in pr-checkmate.json.
+ */
+export declare const DUPLICATE_IGNORE_DEFAULTS: string[];
+/**
+ * Files excluded from the dead-code (unused-exports) report by default. These are
+ * REGEX sources (matched against each reported file path), not globs — dead-code's
+ * `ignoreFiles` is regex-based. Test and mock files legitimately export helpers and
+ * mocks consumed only by the test runner (jest.mock, dynamic imports), which
+ * ts-unused-exports cannot see as usage, so flagging them is noise. Clients can
+ * override via `deadCode.ignoreFiles` in pr-checkmate.json (setting it replaces
+ * this list).
+ */
+export declare const DEAD_CODE_IGNORE_DEFAULTS: string[];
 export declare const CONFIG_FILE_PATTERNS: string[];
+/**
+ * jscpd formats the duplicate-CODE check scans. Restricting to code formats keeps
+ * config/CI YAML and JSON out of the report — they are data, not code, and their
+ * repetition is not meaningful duplication. This mirrors the code-only file set the
+ * check already uses when scanning a git diff, so full-tree and diff scans agree.
+ */
+export declare const DUPLICATE_CODE_FORMATS: string[];
 /**
  * File extensions to check
  */

package/dist/config/constants.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONFIG_FILE = exports.documentation = exports.DEFAULT_ALLOW_PACKAGES = exports.DEFAULT_COMMANDS = exports.SOURCE_EXTENSIONS = exports.CONFIG_FILE_PATTERNS = exports.IGNORE_PATTERNS = void 0;
+exports.CONFIG_FILE = exports.documentation = exports.DEFAULT_ALLOW_PACKAGES = exports.DEFAULT_COMMANDS = exports.SOURCE_EXTENSIONS = exports.DUPLICATE_CODE_FORMATS = exports.CONFIG_FILE_PATTERNS = exports.DEAD_CODE_IGNORE_DEFAULTS = exports.DUPLICATE_IGNORE_DEFAULTS = exports.IGNORE_PATTERNS = void 0;
 const node_path_1 = __importDefault(require("node:path"));
 /**
  * Common patterns to ignore in all checks
@@ -57,14 +57,66 @@ exports.IGNORE_PATTERNS = [
     '**/lint-report/**',
     '**/audit-report/**',
 ];
+/**
+ * Test files/folders excluded from duplicate-code detection by default.
+ * Test suites legitimately repeat setup/arrange/assert boilerplate, so counting
+ * them as clones is noise that drowns out real production duplication. Clients can
+ * override this list via `duplicate.ignore` in pr-checkmate.json.
+ */
+exports.DUPLICATE_IGNORE_DEFAULTS = [
+    '**/__tests__/**',
+    '**/__mocks__/**',
+    '**/*.test.*',
+    '**/*.spec.*',
+    '**/test/**',
+    '**/tests/**',
+];
+/**
+ * Files excluded from the dead-code (unused-exports) report by default. These are
+ * REGEX sources (matched against each reported file path), not globs — dead-code's
+ * `ignoreFiles` is regex-based. Test and mock files legitimately export helpers and
+ * mocks consumed only by the test runner (jest.mock, dynamic imports), which
+ * ts-unused-exports cannot see as usage, so flagging them is noise. Clients can
+ * override via `deadCode.ignoreFiles` in pr-checkmate.json (setting it replaces
+ * this list).
+ */
+exports.DEAD_CODE_IGNORE_DEFAULTS = [
+    '/__tests__/',
+    '/__mocks__/',
+    '/__mock__/',
+    '/tests?/',
+    '\\.test\\.',
+    '\\.spec\\.',
+];
 exports.CONFIG_FILE_PATTERNS = [
     '**/*.config.js',
+    '**/*.config.cjs',
+    '**/*.config.mjs',
     '**/*.config.ts',
+    '**/.eslintrc.*',
+    '**/eslint.config.*',
     '**/jest.config.*',
     '**/wdio.config.*',
     '**/playwright.config.*',
     '**/cypress.config.*',
 ];
+/**
+ * jscpd formats the duplicate-CODE check scans. Restricting to code formats keeps
+ * config/CI YAML and JSON out of the report — they are data, not code, and their
+ * repetition is not meaningful duplication. This mirrors the code-only file set the
+ * check already uses when scanning a git diff, so full-tree and diff scans agree.
+ */
+exports.DUPLICATE_CODE_FORMATS = [
+    'javascript',
+    'typescript',
+    'jsx',
+    'tsx',
+    'python',
+    'kotlin',
+    'swift',
+    'c',
+    'cpp',
+];
 /**
  * File extensions to check
  */

package/dist/config/index.d.ts

@@ -13,11 +13,3 @@ export declare function getPackageConfigPath(fileName: string): string;
  * Check if project has local config
  */
 export declare function hasLocalConfig(configNames: string[]): boolean;
-/**
- * For backward compatibility, also export as constant
- * But this will be evaluated at module load time
- */
-export declare const config: {
-    sourcePath: string;
-};
-export declare const SOURCE_PATH: string;

package/dist/config/index.js

@@ -17,7 +17,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SOURCE_PATH = exports.config = exports.loadProjectConfig = void 0;
+exports.loadProjectConfig = void 0;
 exports.getSourcePath = getSourcePath;
 exports.getPackageConfigPath = getPackageConfigPath;
 exports.hasLocalConfig = hasLocalConfig;
@@ -65,9 +65,3 @@ function hasLocalConfig(configNames) {
     const projectRoot = process.cwd();
     return configNames.some(name => node_fs_1.default.existsSync(node_path_1.default.join(projectRoot, name)));
 }
-/**
- * For backward compatibility, also export as constant
- * But this will be evaluated at module load time
- */
-exports.config = loadConfig();
-exports.SOURCE_PATH = exports.config.sourcePath;

package/dist/config/loader.d.ts

@@ -4,11 +4,3 @@ import { PRCheckMateConfig } from '../interfaces';
  * Falls back to defaults if not found
  */
 export declare function loadProjectConfig(): PRCheckMateConfig;
-/**
- * Get default configuration
- */
-export declare function getDefaultConfig(): PRCheckMateConfig;
-/**
- * Export config for external use
- */
-export declare const DEFAULT_CONFIG: PRCheckMateConfig;

package/dist/config/loader.js

@@ -3,9 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_CONFIG = void 0;
 exports.loadProjectConfig = loadProjectConfig;
-exports.getDefaultConfig = getDefaultConfig;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../utils");
@@ -71,6 +69,8 @@ function mergeWithDefaults(userConfig) {
         diffSmell: { ...defaults.diffSmell, ...userConfig.diffSmell },
         prBody: { ...defaults.prBody, ...userConfig.prBody },
         duplicate: { ...defaults.duplicate, ...userConfig.duplicate },
+        dependency: { ...defaults.dependency, ...userConfig.dependency },
+        outdatedDeps: { ...defaults.outdatedDeps, ...userConfig.outdatedDeps },
         commitlint: { ...defaults.commitlint, ...userConfig.commitlint },
         deadCode: { ...defaults.deadCode, ...userConfig.deadCode },
         licenseCheck: {
@@ -146,8 +146,16 @@ function getDefaultConfig() {
         kotlin: { enabled: true },
         diffSmell: { enabled: true },
         prBody: { enabled: true, minLength: 20, requireTicket: true },
-        duplicate: { enabled: true, minLines: 5, minTokens: 50 },
-        deadCode: { enabled: true },
+        duplicate: {
+            enabled: true,
+            minLines: 5,
+            minTokens: 50,
+            ignore: constants_1.DUPLICATE_IGNORE_DEFAULTS,
+            formats: constants_1.DUPLICATE_CODE_FORMATS,
+        },
+        dependency: { enabled: true, ignore: [] },
+        outdatedDeps: { enabled: true, ignore: [] },
+        deadCode: { enabled: true, ignoreFiles: constants_1.DEAD_CODE_IGNORE_DEFAULTS },
         commitlint: {
             enabled: true,
             types: [
@@ -174,7 +182,3 @@ function getDefaultConfig() {
         },
     };
 }
-/**
- * Export config for external use
- */
-exports.DEFAULT_CONFIG = getDefaultConfig();

package/dist/core/checks/circular-deps.js

@@ -5,9 +5,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.circularDepsCheck = void 0;
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
 const config_1 = require("../../config");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 exports.circularDepsCheck = {
     name: 'Circular Deps',

package/dist/core/checks/commitlint.js

@@ -7,9 +7,9 @@ exports.commitlintCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
 const config_1 = require("../../config");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 const LOCAL_CONFIG_FILES = [
     'commitlint.config.cjs',

package/dist/core/checks/cpp-format.js

@@ -6,8 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.cppFormatCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 /**
  * C/C++ source & header extensions clang-format understands. `.h` is intentionally

package/dist/core/checks/dead-code.js

@@ -6,8 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.deadCodeCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
+const constants_1 = require("../../config/constants");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 exports.deadCodeCheck = {
     name: 'Dead Code',
@@ -24,6 +25,12 @@ exports.deadCodeCheck = {
         }
         const bin = (0, utils_1.resolvePackageBin)('ts-unused-exports', 'bin/ts-unused-exports');
         try {
+            // Run the full analysis unfiltered: ignore patterns are applied to the
+            // *report* below, not passed to ts-unused-exports' own `--ignoreFiles`.
+            // That flag drops files from analysis entirely, so a file's imports stop
+            // counting as usage — ignoring a barrel or entry point would then cascade
+            // and flag everything it re-exports. Filtering the output instead keeps
+            // every usage edge intact and only hides the exempted files' own reports.
             const result = await (0, execa_1.execa)(process.execPath, [bin, tsConfigPath], {
                 cwd: ctx.cwd,
                 reject: false,
@@ -33,14 +40,31 @@ exports.deadCodeCheck = {
                 utils_1.logger.info('[Dead Code]: ✅ No unused exports found');
                 return (0, types_1.pass)();
             }
-            const lines = output.split('\n').filter(l => l.trim());
-            const fileCount = lines.length;
-            const exportCount = lines.reduce((sum, line) => {
-                const match = line.match(/\[(\d+)\]:/);
-                return sum + (match ? parseInt(match[1], 10) : 1);
-            }, 0);
+            const ignore = compileIgnorePatterns(ctx.config.deadCode?.ignoreFiles ?? constants_1.DEAD_CODE_IGNORE_DEFAULTS);
+            // ts-unused-exports prints one `path: sym1, sym2` line per file, preceded
+            // by a `N modules with unused exports` summary line we skip.
+            const entries = output
+                .split('\n')
+                .map(line => line.trim().match(/^(.+\.[cm]?tsx?): (.+)$/))
+                .filter((match) => match !== null)
+                .map(match => ({
+                file: match[1],
+                symbols: match[2]
+                    .split(',')
+                    .map(sym => sym.trim())
+                    .filter(Boolean),
+            }))
+                .filter(entry => !ignore.some(re => re.test(entry.file)));
+            if (entries.length === 0) {
+                utils_1.logger.info('[Dead Code]: ✅ No unused exports found');
+                return (0, types_1.pass)();
+            }
+            const fileCount = entries.length;
+            const exportCount = entries.reduce((sum, entry) => sum + entry.symbols.length, 0);
             utils_1.logger.warn(`[Dead Code]: ⚠️ ${exportCount} unused export(s) across ${fileCount} file(s):`);
-            utils_1.logger.warn(output);
+            for (const entry of entries) {
+                utils_1.logger.warn(`${entry.file}: ${entry.symbols.join(', ')}`);
+            }
             return (0, types_1.warn)(`${exportCount} unused export(s) in ${fileCount} file(s)`);
         }
         catch (err) {
@@ -49,3 +73,18 @@ exports.deadCodeCheck = {
         }
     },
 };
+/**
+ * Compile `deadCode.ignoreFiles` regex sources, skipping any that fail to parse
+ * (a bad pattern warns rather than aborting the whole check).
+ */
+function compileIgnorePatterns(patterns) {
+    return (patterns ?? []).filter(Boolean).flatMap(pattern => {
+        try {
+            return [new RegExp(pattern)];
+        }
+        catch {
+            utils_1.logger.warn(`[Dead Code]: ⚠️ Ignoring invalid ignoreFiles pattern: ${pattern}`);
+            return [];
+        }
+    });
+}

package/dist/core/checks/dependency-check.js

@@ -6,13 +6,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.dependencyCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 exports.dependencyCheck = {
     name: 'Dependencies',
     phase: 'blocking',
     applies(ctx) {
+        if (ctx.config.dependency?.enabled === false)
+            return false;
         return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
     },
     async run(ctx) {
@@ -25,8 +27,16 @@ exports.dependencyCheck = {
         catch {
             return (0, types_1.skip)('depcheck unavailable');
         }
+        // Dependency names/globs to skip, configured in pr-checkmate.json. Passed via
+        // --ignores so a single pr-checkmate.json is the source of truth; depcheck's
+        // CLI --ignores overrides any .depcheckrc, so we only pass it when non-empty
+        // (letting a client's own .depcheckrc still apply when nothing is configured).
+        const ignore = ctx.config.dependency?.ignore ?? [];
+        const args = [depcheckBin, '--json'];
+        if (ignore.length > 0)
+            args.push(`--ignores=${ignore.join(',')}`);
         // reject:false — depcheck exits non-zero when it finds issues but still emits JSON on stdout.
-        const { stdout } = await (0, execa_1.execa)(process.execPath, [depcheckBin, '--json'], {
+        const { stdout } = await (0, execa_1.execa)(process.execPath, args, {
             cwd: ctx.cwd,
             reject: false,
         });

package/dist/core/checks/duplicate-check.js

@@ -6,10 +6,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.duplicateCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
+const constants_1 = require("../../config/constants");
 const utils_1 = require("../../utils");
 const delta_1 = require("../../utils/delta");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
+// Always excluded regardless of client config — scanning these never yields
+// meaningful production duplication. Config files (eslint/*.config.*) are data,
+// not logic, and are commonly shipped in two formats (e.g. .eslintrc + flat
+// config), so their repetition is expected rather than a code smell.
+const BASE_IGNORE = ['node_modules/**', 'dist/**', '.git/**', ...constants_1.CONFIG_FILE_PATTERNS];
 // jscpd v5 appends promotional/funding lines after its report. Strip them so
 // they never reach the client's terminal when running our package.
 const JSCPD_PROMO_MARKERS = [
@@ -44,6 +50,14 @@ exports.duplicateCheck = {
         const srcPath = node_path_1.default.join(ctx.cwd, 'src');
         const targetPaths = changedFiles ?? (node_fs_1.default.existsSync(srcPath) ? [srcPath] : [ctx.cwd]);
         const jscpdBin = (0, utils_1.resolvePackageBin)('jscpd', 'run-jscpd.js');
+        // Client-configurable exclusions (pr-checkmate.json `duplicate.ignore`),
+        // defaulting to test files/folders, appended to the always-on base ignores.
+        const configuredIgnore = ctx.config.duplicate?.ignore ?? constants_1.DUPLICATE_IGNORE_DEFAULTS;
+        const ignore = [...BASE_IGNORE, ...configuredIgnore].join(',');
+        // Client-configurable formats (pr-checkmate.json `duplicate.formats`),
+        // defaulting to source-code formats so data files (yaml/json/markdown) are
+        // not scanned. Clients can add them back explicitly.
+        const formats = (ctx.config.duplicate?.formats ?? constants_1.DUPLICATE_CODE_FORMATS).join(',');
         try {
             const result = await (0, execa_1.execa)(process.execPath, [
                 jscpdBin,
@@ -53,8 +67,10 @@ exports.duplicateCheck = {
                 String(minTokens),
                 '--reporters',
                 'console',
+                '--format',
+                formats,
                 '--ignore',
-                'node_modules/**,dist/**,.git/**',
+                ignore,
                 ...targetPaths,
             ], { cwd: ctx.cwd, reject: false });
             const output = stripJscpdPromo([result.stdout, result.stderr].filter(Boolean).join('\n'));

package/dist/core/checks/findings.js

@@ -4,8 +4,8 @@ exports.diffAddedLines = diffAddedLines;
 exports.bucketTotal = bucketTotal;
 exports.logFindings = logFindings;
 exports.reportSeverityBuckets = reportSeverityBuckets;
-const execa_1 = require("execa");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 /**
  * Run `git diff` over the given file globs, returning the raw unified diff

package/dist/core/checks/kotlin-lint.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.kotlinLintCheck = void 0;
-const execa_1 = require("execa");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const targets_1 = require("../targets");
 const types_1 = require("../types");
 const KOTLIN_GLOBS = ['*.kt', '*.kts'];

package/dist/core/checks/license-check.js

@@ -6,8 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.licenseCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 const FORBIDDEN_LICENSES = ['GPL-2.0', 'GPL-3.0', 'AGPL-3.0', 'LGPL-2.0', 'LGPL-2.1', 'LGPL-3.0'];
 /** Strip the trailing "@version" to get the bare package name (scoped-safe). */

package/dist/core/checks/lint.js

@@ -5,10 +5,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.lintCheck = void 0;
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
 const config_1 = require("../../config");
 const utils_1 = require("../../utils");
 const delta_1 = require("../../utils/delta");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 async function getESLintMajorVersion(eslintBin) {
     try {

package/dist/core/checks/markdown-lint.js

@@ -7,10 +7,10 @@ exports.markdownLintCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
 const config_1 = require("../../config");
 const utils_1 = require("../../utils");
 const delta_1 = require("../../utils/delta");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 function loadUserMarkdownConfig(cwd) {
     const configPath = node_path_1.default.join(cwd, 'pr-checkmate.json');

package/dist/core/checks/npm-audit.js

@@ -6,8 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.npmAuditCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
 function isSeverityAtLeast(severity, level) {

package/dist/core/checks/outdated-deps.js

@@ -6,13 +6,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.outdatedDepsCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 exports.outdatedDepsCheck = {
     name: 'Outdated Deps',
     phase: 'informational',
     applies(ctx) {
+        if (ctx.config.outdatedDeps?.enabled === false)
+            return false;
         return node_fs_1.default.existsSync(node_path_1.default.join(ctx.cwd, 'package.json'));
     },
     async run(ctx) {
@@ -27,7 +29,10 @@ exports.outdatedDepsCheck = {
         catch {
             return (0, types_1.pass)();
         }
-        const entries = Object.entries(outdated);
+        // Packages deliberately pinned behind their latest major (see outdatedDeps.ignore
+        // in pr-checkmate.json) are dropped before counting, so they never warn.
+        const ignore = new Set(ctx.config.outdatedDeps?.ignore ?? []);
+        const entries = Object.entries(outdated).filter(([pkg]) => !ignore.has(pkg));
         if (entries.length === 0)
             return (0, types_1.pass)();
         const majorBehind = entries.filter(([, info]) => {

package/dist/core/checks/pr-size-check.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.prSizeCheck = void 0;
-const execa_1 = require("execa");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 const WARN_FILES = 50;
 const WARN_LINES = 1000;

package/dist/core/checks/prettier.js

@@ -6,10 +6,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.prettierCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
 const config_1 = require("../../config");
 const utils_1 = require("../../utils");
 const delta_1 = require("../../utils/delta");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 function loadUserPrettierConfig(cwd) {
     const configPath = node_path_1.default.join(cwd, 'pr-checkmate.json');

package/dist/core/checks/python-format.js

@@ -9,7 +9,7 @@ const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../utils");
 const targets_1 = require("../targets");
 const types_1 = require("../types");
-const PY_GLOBS = ['*.py'];
+const ruff_shared_1 = require("./ruff-shared");
 /**
  * Formats changed Python files with Ruff's formatter (WASM, no Python/pip needed).
  * Read-only in check mode (`warn` when files differ from formatted output); rewrites
@@ -24,13 +24,12 @@ exports.pythonFormatCheck = {
             ctx.languages.includes('python'));
     },
     async run(ctx) {
-        const targets = await (0, targets_1.resolveTargetFiles)(ctx, PY_GLOBS);
+        const targets = await (0, targets_1.resolveTargetFiles)(ctx, ruff_shared_1.PY_GLOBS);
         if (targets === null)
             return (0, types_1.skip)('git unavailable');
         if (targets.length === 0)
             return (0, types_1.pass)('no Python files changed');
-        const { Workspace, PositionEncoding } = require('@astral-sh/ruff-wasm-nodejs');
-        const workspace = new Workspace(Workspace.defaultSettings(), PositionEncoding.Utf16);
+        const workspace = (0, ruff_shared_1.createRuffWorkspace)();
         let unformatted = 0;
         for (const rel of targets) {
             const abs = node_path_1.default.join(ctx.cwd, rel);

package/dist/core/checks/python-lint.js

@@ -9,7 +9,7 @@ const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../../utils");
 const targets_1 = require("../targets");
 const types_1 = require("../types");
-const PY_GLOBS = ['*.py'];
+const ruff_shared_1 = require("./ruff-shared");
 /**
  * Lints changed Python files with Ruff, bundled as a self-contained WASM module
  * (`@astral-sh/ruff-wasm-nodejs`) so it runs on a bare Node image with no Python
@@ -26,13 +26,12 @@ exports.pythonLintCheck = {
             ctx.languages.includes('python'));
     },
     async run(ctx) {
-        const targets = await (0, targets_1.resolveTargetFiles)(ctx, PY_GLOBS);
+        const targets = await (0, targets_1.resolveTargetFiles)(ctx, ruff_shared_1.PY_GLOBS);
         if (targets === null)
             return (0, types_1.skip)('git unavailable');
         if (targets.length === 0)
             return (0, types_1.pass)('no Python files changed');
-        const { Workspace, PositionEncoding } = require('@astral-sh/ruff-wasm-nodejs');
-        const workspace = new Workspace(Workspace.defaultSettings(), PositionEncoding.Utf16);
+        const workspace = (0, ruff_shared_1.createRuffWorkspace)();
         let totalIssues = 0;
         let filesWithIssues = 0;
         for (const rel of targets) {

package/dist/core/checks/ruff-shared.d.ts

@@ -0,0 +1,10 @@
+type RuffModule = typeof import('@astral-sh/ruff-wasm-nodejs');
+type RuffWorkspace = InstanceType<RuffModule['Workspace']>;
+export declare const PY_GLOBS: string[];
+/**
+ * Instantiate a Ruff WASM workspace with default settings. Shared by the Ruff
+ * lint and format checks so their setup stays identical, and kept as a function
+ * (not a module-level singleton) so the WASM module loads only when a check runs.
+ */
+export declare function createRuffWorkspace(): RuffWorkspace;
+export {};

package/dist/core/checks/ruff-shared.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PY_GLOBS = void 0;
+exports.createRuffWorkspace = createRuffWorkspace;
+exports.PY_GLOBS = ['*.py'];
+/**
+ * Instantiate a Ruff WASM workspace with default settings. Shared by the Ruff
+ * lint and format checks so their setup stays identical, and kept as a function
+ * (not a module-level singleton) so the WASM module loads only when a check runs.
+ */
+function createRuffWorkspace() {
+    const { Workspace, PositionEncoding } = require('@astral-sh/ruff-wasm-nodejs');
+    return new Workspace(Workspace.defaultSettings(), PositionEncoding.Utf16);
+}

package/dist/core/checks/security.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.securityCheck = void 0;
-const execa_1 = require("execa");
 const config_1 = require("../../config");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 /**
  * Secret scanning via the bundled gitleaks package. Language-agnostic — runs on

package/dist/core/checks/sensitive-file-guard.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sensitiveFileGuardCheck = void 0;
-const execa_1 = require("execa");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 const findings_1 = require("./findings");
 const SENSITIVE_CATEGORIES = [

package/dist/core/checks/spellcheck.js

@@ -6,10 +6,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.spellcheckCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
 const config_1 = require("../../config");
 const utils_1 = require("../../utils");
 const delta_1 = require("../../utils/delta");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 function loadUserCspellConfig(cwd) {
     const configPath = node_path_1.default.join(cwd, 'pr-checkmate.json');

package/dist/core/checks/swift-lint.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.swiftLintCheck = void 0;
-const execa_1 = require("execa");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const targets_1 = require("../targets");
 const types_1 = require("../types");
 const SWIFT_GLOBS = ['*.swift'];

package/dist/core/checks/typecheck.js

@@ -6,8 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.typecheckCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
 const utils_1 = require("../../utils");
+const execa_1 = require("../../utils/execa");
 const types_1 = require("../types");
 /**
  * Prefer the consumer project's own TypeScript so its tsconfig is compiled by the

package/dist/core/context.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildContext = buildContext;
-const execa_1 = require("execa");
 const loader_1 = require("../config/loader");
 const utils_1 = require("../utils");
 const detect_language_1 = require("../utils/detect-language");
+const execa_1 = require("../utils/execa");
 /**
  * Resolve the diff range for delta-aware checks.
  * Prefers explicit opts, then GitHub PR event, then Bitbucket PR env, then git HEAD^.

package/dist/core/reporters.d.ts

@@ -1,7 +1,6 @@
-import type { CheckReport, CheckResult } from './types';
+import type { CheckReport } from './types';
 /**
  * Emit the report through the selected channel.
  * none: nothing · stdout: console table · github: table + upsert PR comment.
  */
 export declare function report(kind: 'none' | 'stdout' | 'github', result: CheckReport): Promise<void>;
-export type { CheckResult };

package/dist/core/run-checks.js

@@ -54,7 +54,12 @@ function errMessage(err) {
 async function runOne(check, ctx, collector) {
     try {
         if (!(await check.applies(ctx))) {
-            collector.register(check.name, 'skip', 'not applicable');
+            // A check that doesn't apply is irrelevant to this project/run — e.g. a
+            // language-specific check (SwiftLint, ktlint, Ruff, C++) in a repo of a
+            // different language, or a check disabled in config. Omit it from the report
+            // entirely rather than listing it as "not applicable": in a single-language
+            // repo those rows are pure noise and inflate the skipped count. Runtime skips
+            // from run() (e.g. "no relevant files changed") are still reported.
             return;
         }
         const outcome = await check.run(ctx);

package/dist/core/targets.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveTargetFiles = resolveTargetFiles;
-const execa_1 = require("execa");
 const utils_1 = require("../utils");
+const execa_1 = require("../utils/execa");
 /**
  * Lists the files a language check should operate on, matched by pathspec `globs`
  * (e.g. `['*.py']`). Uses the PR diff range when available (delta mode), else

package/dist/init.d.ts

@@ -1,4 +1,3 @@
-export declare const CONFIG_FILE: string;
 /**
  * Initialize (or refresh) pr-checkmate configuration in the current project.
  */

package/dist/init.js

@@ -3,14 +3,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONFIG_FILE = void 0;
 exports.init = init;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const inquirer_1 = __importDefault(require("inquirer"));
 const config_1 = require("./config");
 const utils_1 = require("./utils");
-exports.CONFIG_FILE = path_1.default.resolve(process.cwd(), 'pr-checkmate.json');
+const CONFIG_FILE = path_1.default.resolve(process.cwd(), 'pr-checkmate.json');
 /**
  * Default configuration structure with customization options
  */
@@ -60,6 +59,26 @@ const DEFAULT_CONFIG = {
         enabled: true,
         minLines: 5,
         minTokens: 50,
+        // Test files/folders are excluded by default; edit to customise.
+        ignore: config_1.DUPLICATE_IGNORE_DEFAULTS,
+        // Only source-code formats are scanned. Data formats (yaml, json, markdown)
+        // are intentionally absent — add them here to detect duplication in them too.
+        formats: config_1.DUPLICATE_CODE_FORMATS,
+    },
+    // Dependency usage check (depcheck)
+    dependency: {
+        enabled: true,
+        // Dependency names/globs to skip (e.g. CLI-only tools invoked as binaries,
+        // which depcheck can't see as imports and would report as unused).
+        ignore: [],
+    },
+    // Unused-exports check (ts-unused-exports)
+    deadCode: {
+        enabled: true,
+        // Regex sources matched against file paths; matching files are dropped from
+        // the report. Defaults to test/mock files, whose exports are used only by the
+        // test runner. Add barrels/entry points here to exempt intentional exports.
+        ignoreFiles: config_1.DEAD_CODE_IGNORE_DEFAULTS,
     },
     documentation: config_1.documentation,
 };
@@ -135,7 +154,7 @@ async function createConfig(root) {
         sourcePath,
         languages,
     };
-    fs_1.default.writeFileSync(exports.CONFIG_FILE, JSON.stringify(config, null, 2));
+    fs_1.default.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
     utils_1.logger.info(`[init]: ✅ Created pr-checkmate.json with sourcePath: ${sourcePath}`);
     utils_1.logger.info(`[init]: 💡 You can now customize ESLint rules, Prettier settings,
       and cspell words in pr-checkmate.json`);
@@ -146,7 +165,7 @@ async function createConfig(root) {
 async function updateConfig(root) {
     utils_1.logger.info('[init]: pr-checkmate.json already exists — updating it.');
     try {
-        const raw = fs_1.default.readFileSync(exports.CONFIG_FILE, 'utf-8');
+        const raw = fs_1.default.readFileSync(CONFIG_FILE, 'utf-8');
         const json = JSON.parse(raw);
         const languages = await (0, utils_1.detectLanguages)(root);
         utils_1.logger.info(`[init]: 🔍 Detected languages: ${languages.length ? languages.join(', ') : 'none'}`);
@@ -164,7 +183,7 @@ async function updateConfig(root) {
             prBody: { ...DEFAULT_CONFIG.prBody, ...(json.prBody || {}) },
             duplicate: { ...DEFAULT_CONFIG.duplicate, ...(json.duplicate || {}) },
         };
-        fs_1.default.writeFileSync(exports.CONFIG_FILE, JSON.stringify(updated, null, 2));
+        fs_1.default.writeFileSync(CONFIG_FILE, JSON.stringify(updated, null, 2));
         utils_1.logger.info('[init]: 🔧 Updated pr-checkmate.json with customization options.');
         utils_1.logger.info('[init]: 💡 You can now add custom ESLint rules, cspell words, and more!');
     }
@@ -177,7 +196,7 @@ async function updateConfig(root) {
  */
 async function init() {
     const root = process.cwd();
-    if (fs_1.default.existsSync(exports.CONFIG_FILE)) {
+    if (fs_1.default.existsSync(CONFIG_FILE)) {
         await updateConfig(root);
     }
     else {

package/dist/interfaces/index.d.ts

@@ -72,6 +72,42 @@ export interface PRCheckMateConfig {
         enabled?: boolean;
         minLines?: number;
         minTokens?: number;
+        /**
+         * Glob patterns excluded from duplicate detection, in addition to the always-on
+         * node_modules/dist/.git ignores. Defaults to test files/folders
+         * (see DUPLICATE_IGNORE_DEFAULTS). Setting this replaces the default list.
+         */
+        ignore?: string[];
+        /**
+         * jscpd formats to scan. Defaults to source-code formats only
+         * (see DUPLICATE_CODE_FORMATS) — data formats like `yaml`, `json` and
+         * `markdown` are intentionally NOT scanned, since their repetition is rarely
+         * meaningful duplication. Add them back (e.g. `["typescript", "yaml"]`) if you
+         * do want to detect duplication in those files. Setting this replaces the list.
+         */
+        formats?: string[];
+    };
+    dependency?: {
+        enabled?: boolean;
+        /**
+         * Dependency names to exclude from the unused/missing check (depcheck).
+         * Supports globs, e.g. "@types/*". Use for packages that are invoked only as
+         * CLI binaries or referenced from config — depcheck sees no `import` for them
+         * and would otherwise report them as unused. Passed to depcheck's `--ignores`,
+         * which takes precedence over any `.depcheckrc` file.
+         */
+        ignore?: string[];
+    };
+    outdatedDeps?: {
+        enabled?: boolean;
+        /**
+         * Exact package names to exclude from the outdated-deps warning, e.g.
+         * "commander". Use for dependencies deliberately pinned behind their latest
+         * major (a breaking upgrade you have chosen not to take, or one held back by
+         * an `overrides` entry) so `npm outdated` no longer flags them as major-behind.
+         * Matched by exact name — no globs or version ranges.
+         */
+        ignore?: string[];
     };
     commitlint?: {
         enabled?: boolean;
@@ -97,33 +133,23 @@ export interface PRCheckMateConfig {
     };
     deadCode?: {
         enabled?: boolean;
+        /**
+         * Regex sources matched against reported file paths; matching files are
+         * dropped from the dead-code report. Use to exempt intentional public
+         * surface — a package entry point (`src/index.ts`) or re-export barrels
+         * whose exports are consumed by external installers, not within the repo.
+         * Applied to the report (not ts-unused-exports' own `--ignoreFiles`), so it
+         * never removes a file from analysis and cannot cascade onto other files.
+         * Defaults to test/mock files (see DEAD_CODE_IGNORE_DEFAULTS), whose exports
+         * are consumed only by the test runner and would otherwise show as unused.
+         * Setting this replaces the default list.
+         */
+        ignoreFiles?: string[];
     };
     licenseCheck?: {
         allowPackages?: string[];
         allowLicenses?: string[];
     };
 }
-export interface CheckmateConfig {
-    skipLint?: boolean;
-    skipDeps?: boolean;
-    skipFormat?: boolean;
-    skipSpell?: boolean;
-    skipSecurity?: boolean;
-    skipNpmAudit?: boolean;
-    skipCircularDeps?: boolean;
-    skipLicense?: boolean;
-    skipPrSize?: boolean;
-    skipPrTitle?: boolean;
-    skipOutdated?: boolean;
-    skipMarkdown?: boolean;
-    skipTypecheck?: boolean;
-    skipDiffSmell?: boolean;
-    skipPrBody?: boolean;
-    skipDuplicate?: boolean;
-    skipDiffSecurity?: boolean;
-    skipSensitiveFiles?: boolean;
-    skipDeadCode?: boolean;
-    autoCommit?: boolean;
-}
 export type { CheckStatus, CheckResult } from '../utils/result-collector';
 export type { Language } from '../utils/detect-language';

package/dist/scripts/copy-configs.d.ts

@@ -1,5 +1 @@
-/**
- *
- */
-declare function copyConfigs(): void;
-export { copyConfigs };
+export {};

package/dist/scripts/copy-configs.js

@@ -3,7 +3,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.copyConfigs = copyConfigs;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const utils_1 = require("../utils");

package/dist/utils/delta.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getChangedFiles = getChangedFiles;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
+const execa_1 = require("./execa");
 const logger_1 = require("./logger");
 /**
  * Returns list of changed files in the current PR filtered by extension.

package/dist/utils/detect-language.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectLanguages = detectLanguages;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("execa");
+const execa_1 = require("./execa");
 const logger_1 = require("./logger");
 /**
  * Marker files that unambiguously indicate a language's presence, independent of

package/dist/utils/execa.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Lazy loader for {@link https://github.com/sindresorhus/execa | execa}.
+ *
+ * execa v9 is ESM-only. Because this package compiles to CommonJS, importing
+ * execa at module scope forces every consumer to resolve execa's full
+ * dependency graph the moment they import pr-checkmate — even consumers that
+ * only need the types or a config helper and never run a check. That graph
+ * pulls in transitive packages (e.g. `unicorn-magic`) whose `exports` maps some
+ * loaders such as `tsx` fail to resolve, which crashes the import for those
+ * consumers before any check runs.
+ *
+ * Loading execa on first use keeps the library entry point cheap and avoids
+ * dragging the subprocess toolchain into consumers that never spawn a process.
+ */
+import type { Options, Result } from 'execa';
+/**
+ * Run a command via execa, loading the module lazily on first call.
+ *
+ * Drop-in replacement for `execa(file, args, options)` at every call site in
+ * this package — all of which await the result and read it synchronously.
+ */
+export declare function execa<OptionsType extends Options = {}>(file: string, args?: readonly string[], options?: OptionsType): Promise<Result<OptionsType>>;

package/dist/utils/execa.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.execa = execa;
+/**
+ * Run a command via execa, loading the module lazily on first call.
+ *
+ * Drop-in replacement for `execa(file, args, options)` at every call site in
+ * this package — all of which await the result and read it synchronously.
+ */
+async function execa(file, args, options) {
+    const { execa: run } = await import('execa');
+    return (await run(file, args, options));
+}

package/dist/utils/own-deps.js

@@ -19,15 +19,19 @@ function readDependencyNames(pkgDir) {
         return [];
     }
 }
-/** Walk up from this module until we find pr-checkmate's own package root. */
-function findOwnPackageRoot() {
-    let dir = __dirname;
+/**
+ * Walk up from `startDir` (inclusive) toward the filesystem root, returning the
+ * first directory whose package.json declares `name === expectedName`, or null.
+ * Broken/missing package.json files are skipped rather than thrown.
+ */
+function findPackageRootByName(startDir, expectedName) {
+    let dir = startDir;
     while (dir !== node_path_1.default.dirname(dir)) {
         const pkgJsonPath = node_path_1.default.join(dir, PACKAGE_JSON);
         if (node_fs_1.default.existsSync(pkgJsonPath)) {
             try {
                 const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));
-                if (pkg.name === OWN_PACKAGE_NAME)
+                if (pkg.name === expectedName)
                     return dir;
             }
             catch { }
@@ -36,6 +40,10 @@ function findOwnPackageRoot() {
     }
     return null;
 }
+/** Walk up from this module until we find pr-checkmate's own package root. */
+function findOwnPackageRoot() {
+    return findPackageRootByName(__dirname, OWN_PACKAGE_NAME);
+}
 /**
  * Resolve a dependency's install directory by name, starting the search from
  * `fromDir`. Relies on Node's upward node_modules walk so hoisted packages are
@@ -50,19 +58,8 @@ function resolvePackageDir(name, fromDir) {
     // Fallback for packages whose exports map hides ./package.json: resolve the
     // entry point and walk up to the package's own root.
     try {
-        let dir = node_path_1.default.dirname(require.resolve(name, { paths: [fromDir] }));
-        while (dir !== node_path_1.default.dirname(dir)) {
-            const pkgJsonPath = node_path_1.default.join(dir, PACKAGE_JSON);
-            if (node_fs_1.default.existsSync(pkgJsonPath)) {
-                try {
-                    const pkg = JSON.parse(node_fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));
-                    if (pkg.name === name)
-                        return dir;
-                }
-                catch { }
-            }
-            dir = node_path_1.default.dirname(dir);
-        }
+        const entryDir = node_path_1.default.dirname(require.resolve(name, { paths: [fromDir] }));
+        return findPackageRootByName(entryDir, name);
     }
     catch { }
     return null;

package/eslint.config.mjs

@@ -36,7 +36,7 @@ export const defaultRules = {
     { blankLine: 'always', prev: '*', next: 'return' },
   ],
   // Complexity analysis (#61)
-  'sonarjs/cognitive-complexity': ['warn', 15],
+  'sonarjs/cognitive-complexity': ['warn', 30],
   'sonarjs/no-duplicate-string': ['warn', { threshold: 3 }],
   'sonarjs/no-identical-functions': 'warn',
   // Import ordering (#65)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pr-checkmate",
-    "version": "1.22.3",
+    "version": "1.22.5",
     "description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
     "keywords": [
         "github-actions",

package/src/config/.eslintrc.js

@@ -81,7 +81,7 @@ module.exports = {
       { blankLine: 'always', prev: '*', next: 'return' },
     ],
     // Complexity analysis (#61)
-    complexity: ['warn', 15],
+    complexity: ['warn', 30],
     // Import ordering (#65)
     'import-x/order': [
       'warn',

package/src/config/eslint.config.mjs

@@ -36,7 +36,7 @@ export const defaultRules = {
     { blankLine: 'always', prev: '*', next: 'return' },
   ],
   // Complexity analysis (#61)
-  'sonarjs/cognitive-complexity': ['warn', 15],
+  'sonarjs/cognitive-complexity': ['warn', 30],
   'sonarjs/no-duplicate-string': ['warn', { threshold: 3 }],
   'sonarjs/no-identical-functions': 'warn',
   // Import ordering (#65)

package/dist/config/config.d.ts

@@ -1,2 +0,0 @@
-export declare const config: any;
-export declare const SOURCE_PATH: any;

package/dist/config/config.js

@@ -1,12 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SOURCE_PATH = exports.config = void 0;
-const node_fs_1 = __importDefault(require("node:fs"));
-const constants_1 = require("./constants");
-exports.config = node_fs_1.default.existsSync(constants_1.CONFIG_FILE)
-    ? JSON.parse(node_fs_1.default.readFileSync(constants_1.CONFIG_FILE, 'utf-8'))
-    : { sourcePath: 'src' };
-exports.SOURCE_PATH = exports.config.sourcePath;