pr-checkmate 1.22.7 → 1.23.0

package/README.md

@@ -9,66 +9,73 @@
 ![jscpd](https://img.shields.io/badge/jscpd-5-blue)
 [![API Docs](https://img.shields.io/badge/API_docs-TypeDoc-9600FF?logo=readthedocs&logoColor=white)](https://pr-checkmate-docs.pages.dev)
 
-> **PR CheckMate** is a universal PR quality checker that runs as a single `npm install` and works across **TypeScript, JavaScript, Python, C++, Swift, and Android/Kotlin** repositories — no per-language toolchain setup required.
-
----
-
-## Why PR CheckMate?
-
-Most teams wire up linters and formatters separately for each repository. PR CheckMate ships everything pre-bundled: you add one step to your GitHub Actions workflow and every check runs automatically, in parallel, on every PR.
-
-- **One package, any stack** — TypeScript, Python, C++, Swift, Android (Kotlin/Java). Language is auto-detected from your repo.
-- **Zero client tooling** — ESLint, Prettier, cspell, jscpd, gitleaks, clang-format (WASM), and Ruff (WASM) are bundled. Clients install nothing extra.
-- **Delta mode** — only changed files are checked in PR context. Full-project fallback for local runs.
-- **Parallel execution** — independent checks run concurrently (~4× faster than sequential CI).
-- **Non-intrusive** — every check can be disabled per-repo via `pr-checkmate.json`.
-
----
+> PR CheckMate is a universal PR quality checker: one `npm install`, 48 checks across
+> 11 languages, running in CI on every pull request. The bundled languages need no
+> per-language toolchain setup.
+
+## Why PR CheckMate
+
+Most teams wire up linters and formatters separately in every repo. PR CheckMate ships
+them pre-bundled. You add one step to a GitHub Actions workflow and the checks run on
+every PR.
+
+- One package, any stack. Language is auto-detected from the repo.
+- Bundled tooling. ESLint, Prettier, Ruff, clang-format, and gitleaks run inside the
+  package (WASM/JS), so clients install nothing for those languages.
+- Delta mode. In a PR only the changed files are checked; a full-project scan is the
+  fallback outside PR context.
+- Parallel phases. Checks run concurrently within each phase: blocking, then
+  informational, then format.
+- Reports in the PR. Results post as a single comment that updates in place, and
+  formatter fixes are committed back to the branch.
+- Tunable. Any check can be re-scoped, downgraded, or disabled in `pr-checkmate.json`.
 
 ## Language Support
 
-| Language | Detection | Lint | Format | Type Check | Notes |
-|---|---|---|---|---|---|
-| **TypeScript** | `tsconfig.json` | ESLint + SonarJS | Prettier | `tsc --noEmit` | Fully bundled |
-| **JavaScript** | `package.json` | ESLint | Prettier | — | Fully bundled |
-| **Python** | `pyproject.toml`, `requirements.txt` | Ruff (WASM) | Ruff (WASM) | — | Fully bundled, no Python install needed |
-| **C++** | `CMakeLists.txt` | — | clang-format (WASM) | — | Fully bundled, no clang install needed |
-| **Swift** | `Package.swift` | SwiftLint | — | — | Requires `swiftlint` on runner |
-| **Android/Kotlin** | `build.gradle`, `AndroidManifest.xml` | ktlint | — | — | Requires `ktlint` on runner |
+Bundled languages need nothing on the runner. Runner-dependency languages need their
+tool installed; the check skips gracefully when the tool is absent.
 
-Universal checks (all languages): secret scanning, PR size, PR title, PR body, duplicate code, dead code, license compliance, markdown lint, spellcheck, sensitive file guard, diff security scan.
-
----
+| Language | Checks | Toolchain |
+|---|---|---|
+| TypeScript / JavaScript | ESLint, Prettier, `tsc --noEmit` | Bundled |
+| Python | Ruff (lint + format), mypy/pyright (types) | Ruff bundled; types need mypy or pyright on the runner |
+| C++ | clang-format | Bundled |
+| Swift | SwiftLint | `swiftlint` on the runner |
+| Kotlin / Java | ktlint | `ktlint` on the runner |
+| Go | `go vet`, `gofmt` | Go toolchain on the runner |
+| Rust | `cargo clippy`, `cargo fmt` | Rust toolchain on the runner |
+| C# | `dotnet format` | .NET SDK on the runner |
+| Ruby | RuboCop | `rubocop` on the runner |
+| PHP | PHP-CS-Fixer | `php-cs-fixer` on the runner |
+
+Secret scanning (gitleaks) and the universal git-diff checks are bundled and run for
+every language.
 
 ## Quickstart
 
-### 1. Install
+Install:
 
 ```bash
 npm install --save-dev pr-checkmate
 ```
 
-### 2. Initialize
+Scaffold `pr-checkmate.json` and `.github/workflows/pr-checkmate.yml` for the detected
+languages:
 
 ```bash
 npx pr-checkmate init
 ```
 
-Creates `pr-checkmate.json` and `.github/workflows/pr-checkmate.yml` tailored to the detected languages in your repo.
-
-### 3. Run
+Run all checks:
 
 ```bash
 npx pr-checkmate all
 ```
 
----
-
-## GitHub Actions — Examples by Language
+## GitHub Actions
 
-All examples follow the same structure: checkout → setup runtime (if needed) → `npm install pr-checkmate` → `npx pr-checkmate all`.
-
-### TypeScript / JavaScript
+Every workflow follows the same shape: checkout, set up Node, install, run. The
+TypeScript setup is the baseline:
 
 ```yaml
 name: PR CheckMate
@@ -92,324 +99,85 @@ jobs:
       - run: npx pr-checkmate all
 ```
 
----
+For a runner-dependency language, add its toolchain setup step before the run: Go with
+`actions/setup-go`, Rust with `dtolnay/rust-toolchain`, C# with `actions/setup-dotnet`,
+Ruby with `ruby/setup-ruby` (plus `gem install rubocop`), PHP with
+`shivammathur/setup-php` (tools: `php-cs-fixer`), Kotlin by fetching the `ktlint`
+binary. Swift's `swiftlint` is pre-installed on `macos-latest`. Anything missing is
+skipped, not failed.
 
-### Python
+## Checks
 
-```yaml
-name: PR CheckMate
-on:
-  pull_request:
-    branches: [main]
+48 checks, grouped by category and run in parallel within each phase:
 
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  quality:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with: { fetch-depth: 0 }
-      - uses: actions/setup-node@v4
-        with: { node-version: 24 }
-      # No pip install needed — Ruff runs via bundled WASM
-      - run: npm install pr-checkmate
-      - run: npx pr-checkmate all
-```
-
-> Ruff (lint + format) runs via WASM — no Python or pip required on the runner.
-
----
-
-### C++
-
-```yaml
-name: PR CheckMate
-on:
-  pull_request:
-    branches: [main]
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  quality:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with: { fetch-depth: 0 }
-      - uses: actions/setup-node@v4
-        with: { node-version: 24 }
-      # No clang install needed — clang-format runs via bundled WASM
-      - run: npm install pr-checkmate
-      - run: npx pr-checkmate all
-```
-
-> clang-format runs via WASM — no system clang or LLVM install required.
-
----
-
-### Swift
-
-```yaml
-name: PR CheckMate
-on:
-  pull_request:
-    branches: [main]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  quality:
-    runs-on: macos-latest   # SwiftLint is pre-installed on macOS runners
-    steps:
-      - uses: actions/checkout@v4
-        with: { fetch-depth: 0 }
-      - uses: actions/setup-node@v4
-        with: { node-version: 24 }
-      - run: npm install pr-checkmate
-      - run: npx pr-checkmate all
-```
-
-> `swiftlint` is pre-installed on GitHub's `macos-latest` runner. If not available, the check is skipped automatically.
-
----
-
-### Android / Kotlin
-
-```yaml
-name: PR CheckMate
-on:
-  pull_request:
-    branches: [main]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  quality:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with: { fetch-depth: 0 }
-      - uses: actions/setup-node@v4
-        with: { node-version: 24 }
-      - name: Install ktlint
-        run: |
-          curl -sSLO https://github.com/pinterest/ktlint/releases/latest/download/ktlint
-          chmod +x ktlint
-          sudo mv ktlint /usr/local/bin/
-      - run: npm install pr-checkmate
-      - run: npx pr-checkmate all
-```
-
-> `ktlint` is not pre-installed on Ubuntu runners — the snippet above fetches the latest release binary. If ktlint is unavailable, the check is skipped automatically.
-
----
-
-## All Checks
-
-| Check | Phase | Description |
-|---|---|---|
-| ESLint + SonarJS + JSDoc | blocking | Lint with complexity, import order, and doc coverage rules |
-| TypeScript | blocking | `tsc --noEmit` type check |
-| Dependency Check | blocking | Unused / missing deps via depcheck; silence CLI-only false positives with `dependency.ignore` |
-| NPM Audit | blocking | Vulnerability scan (`moderate`+) |
-| Circular Deps | blocking | Circular dependency detection |
-| License Check | blocking | Blocks GPL / AGPL / LGPL packages |
-| Ruff Lint | informational | Python linting via WASM |
-| SwiftLint | informational | Swift linting |
-| ktlint | informational | Kotlin linting |
-| Dead Code | informational | Unused exports (`ts-unused-exports`); test and mock files are excluded from the report by default — override with `deadCode.ignoreFiles` (regex) |
-| Duplicate Code | informational | `jscpd` — 5 lines / 50 tokens threshold; test files ignored by default (set `duplicate.ignore`); only source-code formats are scanned, so YAML/JSON/Markdown are skipped unless you override `duplicate.formats` |
-| Diff Smell | informational | `console.*`, `debugger`, `TODO/FIXME` in added lines |
-| Diff Security | informational | XSS, `eval`, SQLi, weak crypto in added lines |
-| Sensitive Files | informational | `.env`, private keys, CI configs touched in PR |
-| PR Size | informational | Warns if PR > 50 files or 1 000 lines |
-| PR Title | informational | Conventional Commits format |
-| PR Body | informational | Min 20 chars + ticket reference |
-| Commitlint | informational | Commit message convention |
-| Outdated Deps | informational | Major-behind packages |
-| Markdown Lint | informational | `.md` / `.mdx` via markdownlint |
-| Spellcheck | informational | EN, ES, FR, RU, UK, HE dictionaries |
-| Prettier | format | Auto-format; commits fixes back to branch |
-| C++ Format | format | clang-format via WASM |
-| Python Format | format | Ruff formatter via WASM |
-
----
+- Universal git-diff (18) — language-agnostic and bundled: merge-conflict markers,
+  secret scan, diff security (JS/TS/Python/Go/Kotlin), GitHub Actions and Dockerfile
+  security, case-collision, custom rules, banned imports, license headers, leftover
+  debug lines, lockfile drift, large/binary files, TODO/FIXME, missing tests, coverage
+  presence, DB migration safety, and sensitive-file guard.
+- Dependencies (6) — unused/missing, circular, outdated, license compliance, npm audit,
+  and a cross-language vuln scan (osv-scanner, opt-in).
+- Quality (4) — duplicate code, dead code, multi-language spellcheck, markdown lint.
+- PR hygiene (4) — size, title, body, and commit-message convention.
+- Per-language (16) — lint, format, and type-check for the languages listed above.
 
 ## Configuration
 
-All checks can be tuned or disabled per-repo via `pr-checkmate.json`:
-
-```json
+Everything lives in `pr-checkmate.json`. Run `npx pr-checkmate init` to scaffold the
+full file for your detected languages.
+
+- Severity map. The one universal control. Key any check by its display name (as it
+  appears in the report) and set `"error"` to fail the run, `"warn"` for advisory, or
+  `"off"` to disable it. This works for every check, old or new.
+- Per-check options. For example `prSize.maxFiles`/`maxLines`, `largeFiles.maxSizeKb`
+  and `allow`, `prBody.minLength`, `duplicate.minLines`, `missingTests.ignore`, or
+  `<check>.ignore` to mute a single finding. Any check also takes `enabled: false`.
+- `customRules`. Your own regex rules run against the diff; a rule with
+  `severity: "error"` blocks the run. Fields: `name`, `pattern`, `message?`,
+  `severity?`, `include?`, `exclude?`.
+- `bannedImports` forbids specific dependencies or imports. `licenseHeader` requires a
+  header on newly added source files (opt-in).
+- Inline suppression. Append `// pr-checkmate-ignore` to any line to skip it.
+
+```jsonc
 {
-  "sourcePath": "src",
-  "lint": {
-    "rules": { "no-console": "error" },
-    "ignorePatterns": ["**/*.generated.ts"]
+  // Promote, downgrade, or disable ANY check by its display name.
+  "severity": {
+    "PR Size": "error",   // oversized PRs now fail the run
+    "Spellcheck": "off"   // turn a check off entirely
   },
-  "python": { "enabled": true, "ruff": { "lint": true, "format": true } },
-  "swift": { "enabled": true },
-  "kotlin": { "enabled": true },
-  "cpp": { "enabled": true, "clangFormat": { "style": "Google" } },
-  "duplicate": {
-    "enabled": true,
-    "minLines": 10,
-    "formats": ["javascript", "typescript", "jsx", "tsx", "python", "kotlin", "swift", "c", "cpp"],
-    "ignore": ["**/__tests__/**", "**/*.test.*", "**/*.spec.*", "**/test/**", "**/tests/**"]
-  },
-  "deadCode": {
-    "enabled": true,
-    "ignoreFiles": ["src/index\\.ts", "handler"]
-  },
-  "dependency": {
-    "enabled": true,
-    "ignore": ["@types/*", "some-cli-tool"]
-  },
-  "commitlint": {
-    "enabled": true,
-    "types": ["feat", "fix", "docs", "chore", "ci", "refactor", "test"]
-  },
-  "licenseCheck": {
-    "allowPackages": [],
-    "allowLicenses": ["LGPL-3.0"]
-  },
-  "prBody": { "enabled": true, "minLength": 20, "requireTicket": true }
+  "prSize": { "maxFiles": 40, "maxLines": 800 },
+  "customRules": [
+    { "name": "no-fixme", "pattern": "FIXME", "severity": "error" }
+  ]
+  // Skip a single line by appending `// pr-checkmate-ignore` to it.
 }
 ```
 
-A note on `duplicate.ignore`:
-
-- Setting it replaces the default test-file list rather than merging with it. If you add your own patterns, include any test globs you still want excluded.
-- `node_modules/**`, `dist/**`, and `.git/**` are always excluded, regardless of config.
-- `duplicate.formats` defaults to source-code formats only, so data files like YAML, JSON, and Markdown are not scanned. Setting it replaces the default list, so add `"yaml"` if you want duplication flagged in those files too.
-
-A note on `dependency.ignore`:
-
-- List dependency names or globs (such as `"@types/*"`) to exclude from the unused/missing check. The values are passed straight to depcheck's `--ignores`.
-- Use it for packages that only run as CLI binaries or are referenced from config files. depcheck sees no `import` for them and would otherwise flag them as unused.
-- When set, `dependency.ignore` takes precedence over any `.depcheckrc` file. Leave it empty or unset and your existing `.depcheckrc` still applies.
-
-A note on `deadCode.ignoreFiles`:
-
-- The values are regex sources, not globs, and each one is matched against the file path. So `\.test\.` matches any file with `.test.` in its name.
-- It defaults to test and mock files: `/__tests__/`, `/__mocks__/`, `/__mock__/`, `/tests?/`, `\.test\.`, `\.spec\.`. Their exports are consumed only by the test runner, so they showed up as false-positive "unused" before.
-- Setting it replaces the default list rather than merging with it. Reach for it to exempt entry points or barrels like `src/index.ts` or a lambda `handler` whose exports are the public surface.
-- It applies to the report only and never drops files from analysis, so a match here cannot cascade into missed dead code elsewhere.
-
----
-
-## Delta Mode
-
-In GitHub Actions PR context, language checks automatically switch to **delta mode** — only files changed in the PR are checked. Outside PR context (local, push workflows) the checks fall back to a full project scan.
+## PR Summary Comment
 
----
+After `npx pr-checkmate all`, a summary table is posted to the PR and updated in place
+on later pushes, so there are no duplicate comments. Format fixes (Prettier, Ruff,
+clang-format, and the rest) are committed straight back to the branch. Posting needs
+the `pull-requests: write` permission, which the generated workflow already includes.
 
 ## Programmatic API
 
-Besides the CLI, PR CheckMate ships a typed programmatic API. Install the package and import checks directly — useful for embedding the same quality gates inside your own tooling. The full reference is published at the [API docs site](https://pr-checkmate-docs.pages.dev).
-
-Run the built-in checks:
+Besides the CLI, PR CheckMate ships a typed API for embedding the same gates in your own
+tooling. Import `runChecks`, `defineCheck`, and the outcome helpers, then run the
+registry or your own checks. The full reference is at the
+[API docs site](https://pr-checkmate-docs.pages.dev).
 
 ```ts
 import { runChecks } from 'pr-checkmate';
-import type { CheckReport } from 'pr-checkmate';
-
-const report: CheckReport = await runChecks({
-  cwd: process.cwd(),
-  reporter: 'stdout', // 'none' | 'stdout' | 'github' | (report) => void
-});
 
+const report = await runChecks({ cwd: process.cwd(), reporter: 'github' });
 if (!report.ok) process.exit(1);
 ```
 
-`runChecks` never throws on violations and never calls `process.exit` — the caller decides. `report.ok` is `true` when nothing failed; warnings and skips do not affect it.
-
-Author a custom check:
-
-```ts
-import { runChecks, defineCheck, pass, fail } from 'pr-checkmate';
-
-const noFixmes = defineCheck({
-  name: 'no-fixmes',
-  phase: 'lint',
-  applies: () => true,
-  run: async (ctx) => {
-    // inspect ctx (config, changed files, language, sha range) and return an outcome
-    return pass();
-  },
-});
-
-await runChecks({ checks: [noFixmes] }); // appended to the built-in registry by default
-```
-
-### Key exports
-
-| Export | Purpose |
-|---|---|
-| `runChecks` | Run the check pipeline; returns a structured `CheckReport` |
-| `buildContext` | Build the `CheckContext` (language, config, sha range) checks receive |
-| `REGISTRY` | The array of built-in checks |
-| `defineCheck` | Identity helper for authoring a `Check` with full type inference |
-| `pass` / `warn` / `fail` / `skip` | Outcome constructors for check bodies |
-| `getSourcePath` / `getPackageConfigPath` / `hasLocalConfig` | Config-path helpers |
-| Types | `Check`, `CheckContext`, `CheckReport`, `CheckResult`, `CheckOutcome`, `CheckStatus`, `RunOptions`, `Language`, `Phase`, `ReporterKind`, `ReporterFn`, `PRCheckMateConfig` |
-
-Regenerate the docs locally with `npm run docs` (output in `docs/api`).
-
----
-
-## PR Summary Comment
-
-After `npx pr-checkmate all`, a summary table is posted to the PR. On repeated pushes the comment is updated in place — no duplicate comments.
-
-```text
-## PR CheckMate Summary
-
-11 passed · 3 warnings · 0 failed · 0 skipped
-
-| Check          | Result                                  |
-|----------------|-----------------------------------------|
-| ESLint         | ✅ pass                                 |
-| TypeScript     | ✅ pass                                 |
-| Ruff Lint      | ⚠️ warn — 3 issues in 2 files          |
-| Diff Smell     | ⚠️ warn — 2x console.*(), 1x TODO      |
-| PR Body        | ⚠️ warn — no ticket reference          |
-| ...            | ...                                     |
-```
-
-Requires `pull-requests: write` permission — the generated workflow includes this automatically.
-
----
-
-## Tech Stack
-
-| Tool | Role |
-|---|---|
-| ESLint + @typescript-eslint | TypeScript / JS linting |
-| eslint-plugin-sonarjs | Complexity analysis |
-| eslint-plugin-import | Import ordering |
-| eslint-plugin-jsdoc | Documentation coverage |
-| Prettier | Code formatting |
-| @astral-sh/ruff-wasm-nodejs | Python lint + format (WASM) |
-| @wasm-fmt/clang-format | C++ formatting (WASM) |
-| SwiftLint | Swift linting (system binary) |
-| ktlint | Kotlin linting (system binary) |
-| cspell | Multilingual spellcheck |
-| gitleaks | Secret scanning |
-| depcheck | Dependency analysis |
-| ts-unused-exports | Dead code detection |
-| jscpd | Duplicate code detection |
-| license-checker | License compliance |
-
----
+`runChecks` never throws on violations and never calls `process.exit`; the caller
+decides. `report.ok` is `true` when nothing failed, and warnings and skips do not
+affect it.
 
 ## License
 

package/cspell.json

@@ -693,7 +693,15 @@
     "litert",
     "SHTPB",
     "FUTX",
-    "subdirs"
+    "subdirs",
+    "clippy",
+    "mypy",
+    "pyright",
+    "jacoco",
+    "depcheckrc",
+    "gofmt",
+    "dotnet",
+    "rubocop"
   ],
   "ignorePaths": [
     "**/node_modules/**",

package/dist/cli.js

@@ -22,6 +22,21 @@ const COMMAND_TO_CHECK = {
     typecheck: 'TypeScript',
     'diff-smell': 'Diff Smells',
     'diff-security': 'Diff Security',
+    'workflow-security': 'Workflow Security',
+    'custom-rules': 'Custom Rules',
+    'banned-imports': 'Banned Imports',
+    'license-header': 'License Header',
+    'config-validation': 'Config Validation',
+    'dockerfile-security': 'Dockerfile Security',
+    'case-collision': 'Case Collision',
+    'vuln-scan': 'Vuln Scan',
+    'leftover-debug': 'Leftover Debug',
+    'lockfile-drift': 'Lockfile Drift',
+    'large-files': 'Large Files',
+    'todo-fixme': 'TODO/FIXME',
+    'missing-tests': 'Missing Tests',
+    coverage: 'Coverage',
+    'migration-safety': 'Migration Safety',
     'sensitive-files': 'Sensitive Files',
     'pr-body': 'PR Body',
     duplicate: 'Duplicate Code',
@@ -29,6 +44,14 @@ const COMMAND_TO_CHECK = {
     'cpp-format': 'C++ Format',
     'python-lint': 'Ruff Lint',
     'python-format': 'Ruff Format',
+    'python-typecheck': 'Python Types',
+    'go-lint': 'Go Vet',
+    'go-format': 'Go Format',
+    'rust-lint': 'Clippy',
+    'rust-format': 'Rustfmt',
+    'csharp-format': 'C# Format',
+    'ruby-lint': 'RuboCop',
+    'php-format': 'PHP CS Fixer',
 };
 const cmd = process.argv[2];
 void (async () => {
@@ -37,9 +60,16 @@ void (async () => {
             await (0, init_1.init)();
             process.exit(0);
         }
-        // Full run: post a GitHub summary comment and allow formatters to write.
+        // Full run: auto-detect the CI platform (GitHub/GitLab/Bitbucket), post the
+        // summary to its PR/MR, and allow formatters to write.
         if (!cmd || cmd === 'all') {
-            const report = await (0, core_1.runChecks)({ reporter: 'github', write: true });
+            const report = await (0, core_1.runChecks)({ reporter: 'auto', write: true });
+            process.exit(report.ok ? 0 : 1);
+        }
+        // Local pre-commit: check the staged changes (index vs HEAD), print to
+        // stdout, never modify files. Exits non-zero on failure to block the commit.
+        if (cmd === 'precommit') {
+            const report = await (0, core_1.runChecks)({ staged: true, reporter: 'stdout', write: false });
             process.exit(report.ok ? 0 : 1);
         }
         const checkName = COMMAND_TO_CHECK[cmd];

package/dist/config/constants.d.ts

@@ -1,5 +1,20 @@
 /**
- * Common patterns to ignore in all checks
+ * Build output, dependency, tooling, and report directories that are never
+ * product code. Every check excludes them by directory-name segment match (see
+ * `targets.ts`): a match on any segment of a path drops the file. Untracked
+ * build dirs are already excluded because checks read git-tracked files only —
+ * this list additionally covers dirs that repos commonly *commit* (`.github`,
+ * `.vscode`, `.idea`, `.claude`) and any checked-in build artifacts.
+ *
+ * Covers the common ecosystems: Node/JS/web, Python, Java/Kotlin/Gradle/Android,
+ * Swift/iOS/Xcode, and C/C++/CMake. Add more here.
+ */
+export declare const IGNORED_DIRS: string[];
+/**
+ * Glob form of the ignore list, for tools that take glob ignores directly
+ * (ESLint `--ignore-pattern`, cspell `--exclude`, the generated
+ * `.prettierignore`). Combines {@link IGNORED_DIRS} with a few tool-specific
+ * nested report globs that are not plain directory names.
  */
 export declare const IGNORE_PATTERNS: string[];
 /**
@@ -66,3 +81,12 @@ export declare const documentation: {
     cspell: string;
 };
 export declare const CONFIG_FILE: string;
+/**
+ * Every top-level key PR CheckMate recognises in pr-checkmate.json — the union
+ * of the `PRCheckMateConfig` interface fields and the keys the `init` generator
+ * writes (which use `eslint`/`cspell`/`markdownlint` rather than the interface's
+ * `lint`/`spellcheck`). The Config Validation check warns on any key not in this
+ * set (typos), ignoring `//`-prefixed comment keys and `$schema`. Keep in sync
+ * when adding a new configurable check.
+ */
+export declare const KNOWN_CONFIG_KEYS: Set<string>;