pr-checkmate 1.22.7 → 1.23.0

package/dist/config/constants.js

@@ -3,57 +3,109 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONFIG_FILE = exports.documentation = exports.DEFAULT_ALLOW_PACKAGES = exports.DEFAULT_COMMANDS = exports.SOURCE_EXTENSIONS = exports.DUPLICATE_CODE_FORMATS = exports.CONFIG_FILE_PATTERNS = exports.DEAD_CODE_IGNORE_DEFAULTS = exports.DUPLICATE_IGNORE_DEFAULTS = exports.IGNORE_PATTERNS = void 0;
+exports.KNOWN_CONFIG_KEYS = exports.CONFIG_FILE = exports.documentation = exports.DEFAULT_ALLOW_PACKAGES = exports.DEFAULT_COMMANDS = exports.SOURCE_EXTENSIONS = exports.DUPLICATE_CODE_FORMATS = exports.CONFIG_FILE_PATTERNS = exports.DEAD_CODE_IGNORE_DEFAULTS = exports.DUPLICATE_IGNORE_DEFAULTS = exports.IGNORE_PATTERNS = exports.IGNORED_DIRS = void 0;
 const node_path_1 = __importDefault(require("node:path"));
 /**
- * Common patterns to ignore in all checks
+ * Build output, dependency, tooling, and report directories that are never
+ * product code. Every check excludes them by directory-name segment match (see
+ * `targets.ts`): a match on any segment of a path drops the file. Untracked
+ * build dirs are already excluded because checks read git-tracked files only —
+ * this list additionally covers dirs that repos commonly *commit* (`.github`,
+ * `.vscode`, `.idea`, `.claude`) and any checked-in build artifacts.
+ *
+ * Covers the common ecosystems: Node/JS/web, Python, Java/Kotlin/Gradle/Android,
+ * Swift/iOS/Xcode, and C/C++/CMake. Add more here.
+ */
+exports.IGNORED_DIRS = [
+    // VCS, editors, and CI/tooling config
+    '.git',
+    '.github',
+    '.gitlab',
+    '.vscode',
+    '.vs',
+    '.idea',
+    '.claude',
+    '.cursor',
+    '.husky',
+    '.circleci',
+    // Node / JS / web — build output & caches
+    'node_modules',
+    'dist',
+    'build',
+    'build-release',
+    'out',
+    'coverage',
+    '.next',
+    '.nuxt',
+    '.svelte-kit',
+    '.turbo',
+    '.cache',
+    '.parcel-cache',
+    '.vercel',
+    '.wrangler',
+    '.serverless',
+    '.terraform',
+    // Python
+    '__pycache__',
+    '.pytest_cache',
+    '.mypy_cache',
+    '.ruff_cache',
+    '.tox',
+    '.venv',
+    'venv',
+    '.eggs',
+    'htmlcov',
+    // Java / Kotlin / Gradle / Android
+    '.gradle',
+    '.kotlin',
+    'target',
+    'gen',
+    'captures',
+    // Swift / iOS / Xcode
+    '.build',
+    '.swiftpm',
+    'DerivedData',
+    'Pods',
+    'Carthage',
+    // C / C++ / CMake
+    'CMakeFiles',
+    'cmake-build-debug',
+    'cmake-build-release',
+    '_deps',
+    // Test reports / results / logs / release artifacts
+    'reports',
+    'report',
+    'test-reports',
+    'test-report',
+    'test-output',
+    'test-results',
+    'results',
+    'result',
+    'logs',
+    'allure-report',
+    'allure-results',
+    'playwright-report',
+    '.wdio',
+];
+/**
+ * Glob form of the ignore list, for tools that take glob ignores directly
+ * (ESLint `--ignore-pattern`, cspell `--exclude`, the generated
+ * `.prettierignore`). Combines {@link IGNORED_DIRS} with a few tool-specific
+ * nested report globs that are not plain directory names.
  */
 exports.IGNORE_PATTERNS = [
-    '**/node_modules/**',
-    '**/dist/**',
-    '**/.git/**',
-    '**/build/**',
-    '**/coverage/**',
-    '**/.next/**',
-    '**/.nuxt/**',
-    '**/out/**',
-    '**/__pycache__/**',
-    '**/.pytest_cache/**',
-    '**/.venv/**',
-    '**/venv/**',
-    '**/allure-report/**',
-    '**/allure-results/**',
-    '**/reports/**',
-    '**/report/**',
-    '**/test-reports/**',
-    '**/test-report/**',
-    '**/test-output/**',
-    '**/test-results/**',
-    '**/results/**',
-    '**/result/**',
-    '**/logs/**',
-    // Jest
+    ...exports.IGNORED_DIRS.map(dir => `**/${dir}/**`),
+    // Tool-specific nested report dirs / files (not bare directory names)
     '**/jest-html-reporters-*/**',
     '**/jest-stare/**',
-    // Cypress
     '**/cypress/reports/**',
     '**/cypress/videos/**',
     '**/cypress/screenshots/**',
-    // Playwright
-    '**/playwright-report/**',
-    // WebdriverIO
-    '**/.wdio/**',
-    '**/wdio-logs/**',
-    // Mocha / Jasmine
     '**/mochawesome-report/**',
     '**/mochawesome-reports/**',
-    // JUnit / Surefire / Maven
     '**/target/surefire-reports/**',
     '**/target/failsafe-reports/**',
-    // Python testing
-    '**/.pytest_cache/**',
-    '**/htmlcov/**',
-    // Misc reports
+    '**/wdio-logs/**',
     '**/lint-report/**',
     '**/audit-report/**',
 ];
@@ -162,3 +214,70 @@ exports.documentation = {
     cspell: 'https://cspell.org/configuration/',
 };
 exports.CONFIG_FILE = node_path_1.default.resolve(process.cwd(), 'pr-checkmate.json');
+/**
+ * Every top-level key PR CheckMate recognises in pr-checkmate.json — the union
+ * of the `PRCheckMateConfig` interface fields and the keys the `init` generator
+ * writes (which use `eslint`/`cspell`/`markdownlint` rather than the interface's
+ * `lint`/`spellcheck`). The Config Validation check warns on any key not in this
+ * set (typos), ignoring `//`-prefixed comment keys and `$schema`. Keep in sync
+ * when adding a new configurable check.
+ */
+exports.KNOWN_CONFIG_KEYS = new Set([
+    // core
+    'sourcePath',
+    'ignoreDirs',
+    'languages',
+    'severity',
+    'customRules',
+    '$schema',
+    'commands',
+    'documentation',
+    'configValidation',
+    // linters/formatters (interface + init aliases)
+    'lint',
+    'eslint',
+    'prettier',
+    'spellcheck',
+    'cspell',
+    'markdownlint',
+    'typecheck',
+    // security
+    'security',
+    'diffSecurity',
+    'workflowSecurity',
+    'dockerfileSecurity',
+    'sensitiveFileGuard',
+    'migrationSafety',
+    // dependencies
+    'dependency',
+    'outdatedDeps',
+    'licenseCheck',
+    'vulnScan',
+    'bannedImports',
+    // git-diff / PR
+    'mergeConflict',
+    'diffSmell',
+    'leftoverDebug',
+    'todoFixme',
+    'lockfileDrift',
+    'largeFiles',
+    'missingTests',
+    'coverage',
+    'caseCollision',
+    'licenseHeader',
+    'duplicate',
+    'deadCode',
+    'prBody',
+    'prSize',
+    'commitlint',
+    // languages
+    'cpp',
+    'python',
+    'swift',
+    'kotlin',
+    'go',
+    'rust',
+    'csharp',
+    'ruby',
+    'php',
+]);

package/dist/config/index.d.ts

@@ -1,10 +1,23 @@
 export * from './constants';
 export { loadProjectConfig } from '../config/loader';
 /**
- * Get SOURCE_PATH dynamically
- * This ensures fresh config is always read
+ * Get the configured source path(s) dynamically as a normalized list.
+ * Accepts a single string or an array in pr-checkmate.json; empty/invalid
+ * values fall back to `['.']` (the whole repo). Clients narrow scanning to a
+ * subdirectory by setting `sourcePath` in their pr-checkmate.json. Always reads
+ * fresh config.
+ */
+export declare function getSourcePaths(): string[];
+/**
+ * Get a single source path (first configured entry) for callers that only
+ * support one directory. Prefer `getSourcePaths()` for scan targets.
  */
 export declare function getSourcePath(): string;
+/**
+ * Get the effective list of directory names excluded from every check
+ * (client `ignoreDirs` in pr-checkmate.json, or the curated default).
+ */
+export declare function getIgnoredDirs(): string[];
 /**
  * Get path to package config files
  */

package/dist/config/index.js

@@ -18,16 +18,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadProjectConfig = void 0;
+exports.getSourcePaths = getSourcePaths;
 exports.getSourcePath = getSourcePath;
+exports.getIgnoredDirs = getIgnoredDirs;
 exports.getPackageConfigPath = getPackageConfigPath;
 exports.hasLocalConfig = hasLocalConfig;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const loader_1 = require("../config/loader");
 const utils_1 = require("../utils");
 const constants_1 = require("./constants");
 __exportStar(require("./constants"), exports);
-var loader_1 = require("../config/loader");
-Object.defineProperty(exports, "loadProjectConfig", { enumerable: true, get: function () { return loader_1.loadProjectConfig; } });
+var loader_2 = require("../config/loader");
+Object.defineProperty(exports, "loadProjectConfig", { enumerable: true, get: function () { return loader_2.loadProjectConfig; } });
 /**
  * Load configuration dynamically (always reads fresh config)
  */
@@ -41,15 +44,33 @@ function loadConfig() {
     catch (err) {
         utils_1.logger.warn(`⚠️ Failed to read config from ${constants_1.CONFIG_FILE}, using defaults${err}`);
     }
-    return { sourcePath: 'src' };
+    return { sourcePath: '.' };
 }
 /**
- * Get SOURCE_PATH dynamically
- * This ensures fresh config is always read
+ * Get the configured source path(s) dynamically as a normalized list.
+ * Accepts a single string or an array in pr-checkmate.json; empty/invalid
+ * values fall back to `['.']` (the whole repo). Clients narrow scanning to a
+ * subdirectory by setting `sourcePath` in their pr-checkmate.json. Always reads
+ * fresh config.
+ */
+function getSourcePaths() {
+    const { sourcePath } = loadConfig();
+    const paths = (Array.isArray(sourcePath) ? sourcePath : [sourcePath]).filter((p) => typeof p === 'string' && p.trim().length > 0);
+    return paths.length > 0 ? paths : ['.'];
+}
+/**
+ * Get a single source path (first configured entry) for callers that only
+ * support one directory. Prefer `getSourcePaths()` for scan targets.
  */
 function getSourcePath() {
-    const config = loadConfig();
-    return config.sourcePath;
+    return getSourcePaths()[0];
+}
+/**
+ * Get the effective list of directory names excluded from every check
+ * (client `ignoreDirs` in pr-checkmate.json, or the curated default).
+ */
+function getIgnoredDirs() {
+    return (0, loader_1.loadProjectConfig)().ignoreDirs ?? [];
 }
 /**
  * Get path to package config files

package/dist/config/loader.js

@@ -34,6 +34,9 @@ function mergeWithDefaults(userConfig) {
     const defaults = getDefaultConfig();
     return {
         sourcePath: userConfig.sourcePath || defaults.sourcePath,
+        // Replace (not merge): the client sees the full default list in their
+        // generated config and edits it directly, so their list is authoritative.
+        ignoreDirs: userConfig.ignoreDirs ?? defaults.ignoreDirs,
         lint: {
             rules: { ...defaults.lint?.rules, ...userConfig.lint?.rules },
             ignorePatterns: [
@@ -90,7 +93,8 @@ function mergeWithDefaults(userConfig) {
  */
 function getDefaultConfig() {
     return {
-        sourcePath: 'src',
+        sourcePath: '.',
+        ignoreDirs: [...constants_1.IGNORED_DIRS],
         lint: {
             rules: {
                 'no-console': 'warn',

package/dist/core/checks/dependencies/banned-imports.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types';
+export declare const bannedImportsCheck: Check;

package/dist/core/checks/dependencies/banned-imports.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bannedImportsCheck = void 0;
+const utils_1 = require("../../../utils");
+const types_1 = require("../../types");
+const findings_1 = require("../findings");
+const PREFIX = 'Banned Imports';
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/**
+ * Compile `bannedImports` into matchers that catch a banned package via an ES
+ * import, a CommonJS require, or its addition to a manifest dependency list.
+ */
+function compileBans(ctx) {
+    const list = ctx.config.bannedImports ?? [];
+    return list
+        .filter(b => b?.name)
+        .map(b => {
+        const n = escapeRe(b.name);
+        const re = new RegExp(`from\\s+['"]${n}(?:/[^'"]*)?['"]|require\\(\\s*['"]${n}(?:/[^'"]*)?['"]|import\\s+['"]${n}['"]|["']${n}["']\\s*:`);
+        return {
+            message: b.message ?? `banned dependency: ${b.name}`,
+            re,
+            severity: b.severity === 'error' ? 'error' : 'warn',
+        };
+    });
+}
+exports.bannedImportsCheck = {
+    name: 'Banned Imports',
+    phase: 'informational',
+    applies(ctx) {
+        return (ctx.config.bannedImports?.length ?? 0) > 0 && Boolean(ctx.baseSha);
+    },
+    async run(ctx) {
+        var _a;
+        const bans = compileBans(ctx);
+        if (bans.length === 0)
+            return (0, types_1.pass)('no banned imports configured');
+        try {
+            const stdout = await (0, findings_1.diffAddedLines)(ctx, ['*']);
+            const errors = {};
+            const warnings = {};
+            for (const raw of stdout.split('\n')) {
+                if (!raw.startsWith('+') || raw.startsWith('+++'))
+                    continue;
+                const content = raw.slice(1);
+                for (const ban of bans) {
+                    if (ban.re.test(content)) {
+                        const bucket = ban.severity === 'error' ? errors : warnings;
+                        (bucket[_a = ban.message] ?? (bucket[_a] = [])).push(content.trim().substring(0, 100));
+                    }
+                }
+            }
+            const totalErrors = (0, findings_1.bucketTotal)(errors);
+            const totalWarnings = (0, findings_1.bucketTotal)(warnings);
+            if (totalErrors === 0 && totalWarnings === 0)
+                return (0, types_1.pass)();
+            (0, findings_1.logFindings)(errors, { prefix: PREFIX, isError: true, sampleLimit: 3 });
+            (0, findings_1.logFindings)(warnings, { prefix: PREFIX, sampleLimit: 3 });
+            const parts = [];
+            if (totalErrors > 0)
+                parts.push(`${totalErrors} banned (error)`);
+            if (totalWarnings > 0)
+                parts.push(`${totalWarnings} banned (warn)`);
+            return totalErrors > 0 ? (0, types_1.fail)(parts.join(', ')) : (0, types_1.warn)(parts.join(', '));
+        }
+        catch (err) {
+            utils_1.logger.warn(`[Banned Imports]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_1.skip)('diff unavailable');
+        }
+    },
+};

package/dist/core/checks/{circular-deps.d.ts → dependencies/circular-deps.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const circularDepsCheck: Check;

package/dist/core/checks/{circular-deps.js → dependencies/circular-deps.js}

@@ -1,14 +1,11 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.circularDepsCheck = void 0;
-const node_path_1 = __importDefault(require("node:path"));
-const config_1 = require("../../config");
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const config_1 = require("../../../config");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const targets_1 = require("../../targets");
+const types_1 = require("../../types");
 exports.circularDepsCheck = {
     name: 'Circular Deps',
     phase: 'blocking',
@@ -16,8 +13,10 @@ exports.circularDepsCheck = {
         return ctx.languages.includes('typescript') || ctx.languages.includes('javascript');
     },
     async run(ctx) {
-        const pattern = node_path_1.default.join(ctx.cwd, (0, config_1.getSourcePath)(), '**/*.{ts,tsx,js,jsx}');
-        const result = await (0, execa_1.execa)('npx', ['dpdm', '--no-warning', '--no-tree', '--circular', pattern], {
+        const files = await (0, targets_1.listTrackedFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], (0, config_1.getSourcePaths)());
+        if (files.length === 0)
+            return (0, types_1.pass)();
+        const result = await (0, execa_1.execa)('npx', ['dpdm', '--no-warning', '--no-tree', '--circular', ...files], {
             cwd: ctx.cwd,
             reject: false,
         });

package/dist/core/checks/{dependency-check.d.ts → dependencies/dependency-check.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const dependencyCheck: Check;

package/dist/core/checks/{dependency-check.js → dependencies/dependency-check.js}

@@ -6,9 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.dependencyCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
 exports.dependencyCheck = {
     name: 'Dependencies',
     phase: 'blocking',

package/dist/core/checks/{license-check.d.ts → dependencies/license-check.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const licenseCheck: Check;

package/dist/core/checks/{license-check.js → dependencies/license-check.js}

@@ -6,9 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.licenseCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
 const FORBIDDEN_LICENSES = ['GPL-2.0', 'GPL-3.0', 'AGPL-3.0', 'LGPL-2.0', 'LGPL-2.1', 'LGPL-3.0'];
 /** Strip the trailing "@version" to get the bare package name (scoped-safe). */
 function bareName(pkgKey) {

package/dist/core/checks/{npm-audit.d.ts → dependencies/npm-audit.d.ts}

@@ -1,4 +1,4 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 /**
  * npm audit — only direct-dependency vulnerabilities block. Transitive ones and
  * vulnerabilities in pr-checkmate itself are ignored (the client cannot fix those).

package/dist/core/checks/{npm-audit.js → dependencies/npm-audit.js}

@@ -6,9 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.npmAuditCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
 const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
 function isSeverityAtLeast(severity, level) {
     const sevIdx = SEVERITY_ORDER.indexOf(severity);

package/dist/core/checks/{outdated-deps.d.ts → dependencies/outdated-deps.d.ts}

@@ -1,2 +1,2 @@
-import { Check } from '../types';
+import { Check } from '../../types';
 export declare const outdatedDepsCheck: Check;

package/dist/core/checks/{outdated-deps.js → dependencies/outdated-deps.js}

@@ -6,9 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.outdatedDepsCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const types_1 = require("../types");
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
 exports.outdatedDepsCheck = {
     name: 'Outdated Deps',
     phase: 'informational',

package/dist/core/checks/dependencies/vuln-scan.d.ts

@@ -0,0 +1,9 @@
+import { Check } from '../../types';
+/**
+ * Cross-language dependency vulnerability scan via osv-scanner, which reads
+ * lockfiles across ecosystems (npm, PyPI, Go, crates, Maven, …) against the OSV
+ * database. Runner-dependency and opt-in (`vulnScan.enabled: true`): osv-scanner
+ * must be on the runner, and the check skips gracefully when it is absent.
+ * Complements the JS-only `npm-audit` with coverage for every other ecosystem.
+ */
+export declare const vulnScanCheck: Check;

package/dist/core/checks/dependencies/vuln-scan.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.vulnScanCheck = void 0;
+const utils_1 = require("../../../utils");
+const execa_1 = require("../../../utils/execa");
+const types_1 = require("../../types");
+/**
+ * Cross-language dependency vulnerability scan via osv-scanner, which reads
+ * lockfiles across ecosystems (npm, PyPI, Go, crates, Maven, …) against the OSV
+ * database. Runner-dependency and opt-in (`vulnScan.enabled: true`): osv-scanner
+ * must be on the runner, and the check skips gracefully when it is absent.
+ * Complements the JS-only `npm-audit` with coverage for every other ecosystem.
+ */
+exports.vulnScanCheck = {
+    name: 'Vuln Scan',
+    phase: 'informational',
+    applies(ctx) {
+        return ctx.config.vulnScan?.enabled === true;
+    },
+    async run(ctx) {
+        const result = await (0, execa_1.execa)('osv-scanner', ['-r', '.'], { cwd: ctx.cwd, reject: false });
+        // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'`
+        // when the binary is absent — detect the missing scanner on the result.
+        if (result.code === 'ENOENT')
+            return (0, types_1.skip)('osv-scanner not installed');
+        if (result.exitCode === 0) {
+            utils_1.logger.info('[Vuln Scan]: ✅ No known vulnerabilities');
+            return (0, types_1.pass)();
+        }
+        const lines = [result.stdout, result.stderr]
+            .filter(Boolean)
+            .join('\n')
+            .split('\n')
+            .filter(l => /\b(CVE-|GHSA-|vulnerab|advisor)/i.test(l));
+        utils_1.logger.warn('[Vuln Scan]: ⚠️ known vulnerabilities found:');
+        lines.slice(0, 10).forEach(l => utils_1.logger.warn(`  ${l.trim()}`));
+        if (lines.length > 10)
+            utils_1.logger.warn(`  ... and ${lines.length - 10} more`);
+        return (0, types_1.warn)(`${lines.length || 'unknown'} vulnerability finding(s) (osv-scanner)`);
+    },
+};

package/dist/core/checks/findings.d.ts

@@ -1,4 +1,26 @@
 import { CheckContext, CheckOutcome } from '../types';
+/**
+ * Client-configurable severity for a check's findings, read from that check's
+ * config block (e.g. `mergeConflict.severity`). `error` fails the run, `warn`
+ * only advises. Every check declares a natural default; the client overrides it
+ * per repo in pr-checkmate.json — promoting an advisory check to a gate, or
+ * downgrading a blocking one, with no code change.
+ */
+export type Severity = 'error' | 'warn';
+export interface SeverityEmitter {
+    /** Log at the resolved level (`logger.error` for error, `logger.warn` for warn). */
+    log: (msg: string) => void;
+    /** Prefix icon matching the level. */
+    icon: string;
+    /** Build the outcome at the resolved level (`fail` for error, `warn` for warn). */
+    emit: (details: string) => CheckOutcome;
+}
+/**
+ * Resolve a check's effective severity (`configured` from config, else its
+ * `fallback`) into a matched logger, icon, and outcome constructor — so a check
+ * logs and returns consistently at whatever level the client chose.
+ */
+export declare function severityEmitter(configured: Severity | undefined, fallback: Severity): SeverityEmitter;
 /** Findings grouped by label → matching sample strings. */
 export type FindingBucket = Record<string, string[]>;
 /**
@@ -6,6 +28,14 @@ export type FindingBucket = Record<string, string[]>;
  * (zero context, added/copied/modified/renamed files) for added-line scanning.
  */
 export declare function diffAddedLines(ctx: CheckContext, globs: string[]): Promise<string>;
+/**
+ * Strip a trailing line comment (`//` or `#`) from a line, tracking quote state
+ * so a marker inside a string literal (or a `#` in `"#fff"`, a `//` in a quoted
+ * URL) is preserved. Heuristic, not a tokenizer: block comments and regex
+ * literals aren't handled. Used by code-targeting checks so `# print(x)` or
+ * `// eval(x)` in a comment isn't flagged as real code.
+ */
+export declare function stripInlineComment(line: string): string;
 /** Total number of findings across all labels in a bucket. */
 export declare function bucketTotal(bucket: FindingBucket): number;
 interface LogOptions {
@@ -31,10 +61,16 @@ interface SeverityReportOptions {
     showCount?: boolean;
     /** Max samples printed per label; omit to print all. */
     sampleLimit?: number;
+    /**
+     * Finding labels to suppress (client `<check>.ignore`). A label is dropped
+     * when it contains any ignore entry (case-insensitive), so a repo can mute a
+     * single built-in finding without disabling the whole check.
+     */
+    ignore?: string[];
 }
 /**
  * Report error/warning finding buckets: log both, then produce the outcome.
  * Returns pass() when both buckets are empty, otherwise warn() with a summary.
  */
-export declare function reportSeverityBuckets(errors: FindingBucket, warnings: FindingBucket, opts: SeverityReportOptions): CheckOutcome;
+export declare function reportSeverityBuckets(errorsIn: FindingBucket, warningsIn: FindingBucket, opts: SeverityReportOptions): CheckOutcome;
 export {};