pr-checkmate 3.0.3 → 3.1.0

package/dist/esm/utils/git.js

@@ -0,0 +1,21 @@
+import { execa } from './execa.js';
+/**
+ * Resolve a git ref to a concrete commit SHA, or `undefined` when this clone
+ * cannot resolve it.
+ *
+ * `--verify --quiet` emits nothing (rather than echoing the literal ref) and exits
+ * non-zero for a missing ref, so the caller gets a clear "not here" instead of a
+ * string that looks like a ref but resolves to nothing. Refs go missing more often
+ * than it seems: `HEAD^` on a repository's first commit, and any ancestor in a
+ * shallow CI clone — `actions/checkout` fetches depth 1 by default.
+ *
+ * Every caller must degrade rather than fail when this returns `undefined`: a
+ * missing base means "review everything", never "review nothing".
+ */
+export async function resolveGitRef(cwd, ref) {
+    const { stdout } = await execa('git', ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`], {
+        cwd,
+        reject: false,
+    });
+    return stdout.trim() || undefined;
+}

package/dist/esm/utils/glob.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Minimal glob → RegExp for path matching against config patterns. Supports `*`
+ * (matches within a path segment), `**` (across segments), and a leading `** /`
+ * that also matches the repo root (zero segments). Anchored to the whole path.
+ * Not a full glob implementation — enough for the allow/ignore lists in
+ * pr-checkmate.json (e.g. "assets/**", "*.png", "** / *.d.ts").
+ */
+export declare function globToRegExp(glob: string): RegExp;
+/** True when `file` matches any of the glob `patterns`. */
+export declare function matchesAnyGlob(file: string, patterns: string[]): boolean;
+/**
+ * True when any segment of a repo-relative path names an excluded directory —
+ * `node_modules/x/y.py` for `node_modules`, at any nesting depth.
+ *
+ * Shared so the two consumers cannot drift: the file list every check operates on
+ * (`excludeIgnoredDirs` in core/targets.ts) and language detection, which counts
+ * tracked source files. They disagreed once — detection counted a repository that
+ * commits its dependencies as a Python/Go/PHP project and switched on the checks
+ * for languages nobody had written a line of.
+ *
+ * @param file Repo-relative path, forward slashes.
+ * @param ignoredDirs Directory NAMES (not globs) to exclude.
+ */
+export declare function isUnderIgnoredDir(file: string, ignoredDirs: Iterable<string>): boolean;

package/dist/esm/utils/glob.js

@@ -0,0 +1,40 @@
+/**
+ * Minimal glob → RegExp for path matching against config patterns. Supports `*`
+ * (matches within a path segment), `**` (across segments), and a leading `** /`
+ * that also matches the repo root (zero segments). Anchored to the whole path.
+ * Not a full glob implementation — enough for the allow/ignore lists in
+ * pr-checkmate.json (e.g. "assets/**", "*.png", "** / *.d.ts").
+ */
+export function globToRegExp(glob) {
+    const re = glob
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&') // escape regex specials (not * or /)
+        .replace(/\*\*\//g, ' dir ') // `**/` → optional leading dirs (matches root too)
+        .replace(/\*\*/g, ' any ') // bare `**` → across segments
+        .replace(/\*/g, '[^/]*') // `*` → within a segment
+        .replace(/ dir /g, '(?:.*/)?')
+        .replace(/ any /g, '.*');
+    return new RegExp(`^${re}$`);
+}
+/** True when `file` matches any of the glob `patterns`. */
+export function matchesAnyGlob(file, patterns) {
+    return patterns.some(p => globToRegExp(p).test(file));
+}
+/**
+ * True when any segment of a repo-relative path names an excluded directory —
+ * `node_modules/x/y.py` for `node_modules`, at any nesting depth.
+ *
+ * Shared so the two consumers cannot drift: the file list every check operates on
+ * (`excludeIgnoredDirs` in core/targets.ts) and language detection, which counts
+ * tracked source files. They disagreed once — detection counted a repository that
+ * commits its dependencies as a Python/Go/PHP project and switched on the checks
+ * for languages nobody had written a line of.
+ *
+ * @param file Repo-relative path, forward slashes.
+ * @param ignoredDirs Directory NAMES (not globs) to exclude.
+ */
+export function isUnderIgnoredDir(file, ignoredDirs) {
+    const ignored = ignoredDirs instanceof Set ? ignoredDirs : new Set(ignoredDirs);
+    if (ignored.size === 0)
+        return false;
+    return file.split('/').some(segment => ignored.has(segment));
+}

package/dist/esm/utils/http.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Outcome of one request: never throws, so a reporting hiccup cannot kill a run.
+ *
+ * Internal to this module — `utils/index.ts` does not re-export `http`, and the
+ * reporters consume the result inline rather than naming the type.
+ */
+interface HttpResult<T = unknown> {
+    ok: boolean;
+    /** 0 when the request never reached a server (timeout, DNS, offline). */
+    status: number;
+    body?: T;
+    /** Human-readable reason, present whenever `ok` is false. */
+    error?: string;
+}
+export interface HttpOptions {
+    /** Per-attempt timeout. A hung API must not hold the process open. */
+    timeoutMs?: number;
+    /** Attempts for retryable failures (5xx, 429, network). 1 disables retrying. */
+    retries?: number;
+    /** Label used in log lines, e.g. `GitHub`. */
+    label?: string;
+}
+/**
+ * One HTTP request with a timeout and bounded retries, returning a result rather
+ * than throwing.
+ *
+ * The reason this exists: every write in the reporter used to be a bare `await
+ * fetch(...)` whose result was discarded, followed by a log line claiming
+ * success. A 403 from a workflow missing `pull-requests: write` produced
+ * "✅ Posted PR CheckMate summary" and no comment — the user had nothing to
+ * debug from.
+ */
+export declare function request<T = unknown>(url: string, init?: RequestInit, opts?: HttpOptions): Promise<HttpResult<T>>;
+/**
+ * Walk a paginated collection until `nextUrl` returns nothing or `maxPages` is
+ * reached, returning every item found.
+ *
+ * Without this the reporter read only the first page — 30 comments on GitHub, 20
+ * on GitLab — so on any PR with more discussion than that its own marker fell off
+ * the end, the upsert became an insert, and every push added another comment.
+ *
+ * Stopping at `maxPages` is logged rather than silent: a truncated search can
+ * only produce a duplicate comment, and that should be explainable.
+ */
+export declare function paginate<T>(firstUrl: string, init: RequestInit, extract: (body: unknown) => T[], 
+/**
+ * URL of the page after this one, or null when the collection is exhausted.
+ * Receives the page's item count so page-number APIs (GitHub, GitLab) can stop
+ * on a short page, while cursor APIs (Bitbucket) read a link out of the body.
+ */
+nextUrl: (body: unknown, page: number, count: number) => string | null, opts?: HttpOptions & {
+    maxPages?: number;
+}): Promise<{
+    items: T[];
+    ok: boolean;
+    truncated: boolean;
+    error?: string;
+}>;
+export {};

package/dist/esm/utils/http.js

@@ -0,0 +1,115 @@
+import { logger } from './logger.js';
+const DEFAULT_TIMEOUT_MS = 10000;
+const DEFAULT_RETRIES = 3;
+/** 5xx and 429 are worth another attempt; a 4xx will fail identically forever. */
+function isRetryable(status) {
+    return status === 0 || status === 429 || status >= 500;
+}
+/**
+ * Turn a response into a diagnosis a person can act on.
+ *
+ * "Could not post comment: 403" sends someone hunting through Actions docs;
+ * naming the likely cause is the difference between a fixable message and a
+ * shrug. These three account for nearly every real failure.
+ */
+function explain(status, body) {
+    if (status === 401 || status === 403) {
+        return `${status} — token missing, expired, or lacking write scope (GitHub needs \`permissions: pull-requests: write\` AND \`env: GITHUB_TOKEN\`)`;
+    }
+    if (status === 404)
+        return `${status} — repository or PR not found, or the token cannot see it`;
+    if (status === 429)
+        return `${status} — rate limited`;
+    return `${status}${body ? ` — ${body.slice(0, 200)}` : ''}`;
+}
+/**
+ * Never let a token reach a log line, whatever an API decides to echo back.
+ *
+ * `pousr` and `glpat` below are not words: the first is the character class of
+ * GitHub's token prefixes (`ghp_`/`gho_`/`ghu_`/`ghs_`/`ghr_`), the second is
+ * GitLab's literal `glpat-`. Muted here rather than in the dictionary, which
+ * ships to every client and should not carry our regex fragments.
+ * cspell:ignore pousr glpat
+ */
+function redact(text) {
+    return text.replace(/\b(gh[pousr]_|glpat-|xox[baprs]-)[A-Za-z0-9_-]{8,}/g, '$1***');
+}
+/**
+ * One HTTP request with a timeout and bounded retries, returning a result rather
+ * than throwing.
+ *
+ * The reason this exists: every write in the reporter used to be a bare `await
+ * fetch(...)` whose result was discarded, followed by a log line claiming
+ * success. A 403 from a workflow missing `pull-requests: write` produced
+ * "✅ Posted PR CheckMate summary" and no comment — the user had nothing to
+ * debug from.
+ */
+export async function request(url, init = {}, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const attempts = Math.max(1, opts.retries ?? DEFAULT_RETRIES);
+    const label = opts.label ? `[${opts.label}] ` : '';
+    let last = { ok: false, status: 0, error: 'no attempt made' };
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        last = await attempt_(url, init, timeoutMs);
+        if (last.ok || !isRetryable(last.status))
+            return last;
+        if (attempt < attempts) {
+            // Exponential backoff, capped so three attempts stay well inside a CI step.
+            const waitMs = Math.min(2000, 250 * 2 ** (attempt - 1));
+            logger.warn(`${label}retrying after ${last.error} (attempt ${attempt}/${attempts})`);
+            await new Promise(resolve => setTimeout(resolve, waitMs));
+        }
+    }
+    return last;
+}
+/** A single attempt, with every failure mode flattened into an HttpResult. */
+async function attempt_(url, init, timeoutMs) {
+    try {
+        const res = await fetch(url, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+        if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            return { ok: false, status: res.status, error: redact(explain(res.status, text)) };
+        }
+        // A successful response with an unreadable body is still a successful write;
+        // only callers that need the body care, and they check for `undefined`.
+        const body = (await res.json().catch(() => undefined));
+        return { ok: true, status: res.status, body };
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        return { ok: false, status: 0, error: redact(`request failed — ${reason}`) };
+    }
+}
+/**
+ * Walk a paginated collection until `nextUrl` returns nothing or `maxPages` is
+ * reached, returning every item found.
+ *
+ * Without this the reporter read only the first page — 30 comments on GitHub, 20
+ * on GitLab — so on any PR with more discussion than that its own marker fell off
+ * the end, the upsert became an insert, and every push added another comment.
+ *
+ * Stopping at `maxPages` is logged rather than silent: a truncated search can
+ * only produce a duplicate comment, and that should be explainable.
+ */
+export async function paginate(firstUrl, init, extract, 
+/**
+ * URL of the page after this one, or null when the collection is exhausted.
+ * Receives the page's item count so page-number APIs (GitHub, GitLab) can stop
+ * on a short page, while cursor APIs (Bitbucket) read a link out of the body.
+ */
+nextUrl, opts = {}) {
+    const maxPages = Math.max(1, opts.maxPages ?? 10);
+    const items = [];
+    let url = firstUrl;
+    for (let page = 1; page <= maxPages; page++) {
+        const res = await request(url, init, opts);
+        if (!res.ok)
+            return { items, ok: false, truncated: false, error: res.error };
+        const pageItems = extract(res.body);
+        items.push(...pageItems);
+        url = nextUrl(res.body, page, pageItems.length);
+        if (!url)
+            return { items, ok: true, truncated: false };
+    }
+    return { items, ok: true, truncated: true };
+}

package/dist/esm/utils/index.d.ts

@@ -0,0 +1,15 @@
+export * from './logger.js';
+export * from './result-collector.js';
+export * from './resolve-bin.js';
+export * from './own-deps.js';
+export * from './direct-deps.js';
+export * from './detect-language.js';
+export * from './glob.js';
+export * from './update-notifier.js';
+export * from './package-version.js';
+export * from './ci.js';
+export * from './git.js';
+/**
+ *
+ */
+export declare function cleanupTempFile(filePath: string): void;

package/dist/esm/utils/index.js

@@ -0,0 +1,26 @@
+import fs from 'node:fs';
+import { logger } from './logger.js';
+export * from './logger.js';
+export * from './result-collector.js';
+export * from './resolve-bin.js';
+export * from './own-deps.js';
+export * from './direct-deps.js';
+export * from './detect-language.js';
+export * from './glob.js';
+export * from './update-notifier.js';
+export * from './package-version.js';
+export * from './ci.js';
+export * from './git.js';
+/**
+ *
+ */
+export function cleanupTempFile(filePath) {
+    try {
+        if (fs.existsSync(filePath)) {
+            fs.unlinkSync(filePath);
+        }
+    }
+    catch (err) {
+        logger.warn(`[cleanupTempFile]: ⚠️ Failed cleanup: ${filePath}\n${err}`);
+    }
+}

package/dist/esm/utils/logger.d.ts

@@ -0,0 +1,65 @@
+/** Destination for log lines; see {@link Logger.setSink}. */
+export interface LogSink {
+    out(chunk: string): void;
+    err(chunk: string): void;
+}
+export type LogLevel = 'log' | 'info' | 'warn' | 'error' | 'debug';
+/** How a line is rendered. */
+export type LogFormat = 'pretty' | 'ci' | 'json';
+export interface LoggerOptions {
+    level?: LogLevel;
+    format?: LogFormat;
+    color?: 'auto' | 'always' | 'never';
+    timestamps?: boolean;
+    /** Levels routed to stderr rather than stdout. */
+    stderrLevels?: LogLevel[];
+}
+export declare class Logger {
+    private currentLevel;
+    private format;
+    private color;
+    private timestamps;
+    private stderrLevels;
+    constructor(options?: LoggerOptions);
+    /** Apply options; unset fields keep their current value. */
+    configure(options: LoggerOptions): void;
+    private shouldLog;
+    private streamFor;
+    /**
+     * Where lines actually go. Swappable so tests can capture output without
+     * touching `process.stdout`.
+     *
+     * That distinction is not stylistic. Node's test runner reports each file's
+     * results to the parent process over stdout, so a test that replaces
+     * `process.stdout.write` and swallows what it receives also swallows those
+     * frames: the parent then waits forever for a file that already finished. It
+     * only shows up under load — on a two-core CI runner the frames land inside
+     * the capture window, on a developer's machine they usually do not — which
+     * made it a three-hour hang that never reproduced locally.
+     */
+    private sink;
+    /**
+     * Redirect output, returning the previous sink so the caller can restore it.
+     * Passing `null` restores the real streams.
+     */
+    setSink(sink: LogSink | null): LogSink | null;
+    private emit;
+    private render;
+    private logMessage;
+    log(msg: string): void;
+    info(msg: string): void;
+    warn(msg: string): void;
+    error(msg: string, err?: unknown): void;
+    debug(msg: string): void;
+    /**
+     * Product output: the run summary, printed verbatim.
+     *
+     * Distinct from `info` because the summary is the thing the run exists to
+     * produce, not a note about producing it. Routing it through the log formatter
+     * prefixed every line with a timestamp and a level, which pushed the box
+     * borders out of alignment and made the headline artefact look broken.
+     */
+    print(msg: string): void;
+    setLevel(level: LogLevel): void;
+}
+export declare const logger: Logger;

package/dist/esm/utils/logger.js

@@ -0,0 +1,157 @@
+const LEVEL_ORDER = {
+    error: 0,
+    warn: 1,
+    info: 2,
+    log: 2,
+    debug: 3,
+};
+const COLORS = {
+    error: '\x1b[31m', // red
+    warn: '\x1b[33m', // yellow
+    info: '\x1b[32m', // green
+    log: '\x1b[37m', // white
+    debug: '\x1b[36m', // cyan
+};
+const RESET = '\x1b[0m';
+/**
+ * Whether ANSI colour is wanted on `stream`.
+ *
+ * Colour used to be emitted unconditionally, so a piped or redirected run — and
+ * every CI log — was littered with escape sequences. `NO_COLOR` is the de-facto
+ * standard (no-color.org) and `FORCE_COLOR` the usual override; both are honoured
+ * here, and the TTY test asks about the stream actually being written to.
+ */
+function wantsColor(mode, stream) {
+    if (mode === 'never')
+        return false;
+    if (mode === 'always')
+        return true;
+    if (process.env.FORCE_COLOR)
+        return process.env.FORCE_COLOR !== '0';
+    if (process.env.NO_COLOR !== undefined)
+        return false;
+    return Boolean(stream.isTTY);
+}
+export class Logger {
+    constructor(options = {}) {
+        this.currentLevel = 'info';
+        this.color = 'auto';
+        this.stderrLevels = new Set(['error', 'warn']);
+        /**
+         * Where lines actually go. Swappable so tests can capture output without
+         * touching `process.stdout`.
+         *
+         * That distinction is not stylistic. Node's test runner reports each file's
+         * results to the parent process over stdout, so a test that replaces
+         * `process.stdout.write` and swallows what it receives also swallows those
+         * frames: the parent then waits forever for a file that already finished. It
+         * only shows up under load — on a two-core CI runner the frames land inside
+         * the capture window, on a developer's machine they usually do not — which
+         * made it a three-hour hang that never reproduced locally.
+         */
+        this.sink = null;
+        // CI logs are read long after the fact and benefit from timestamps; a
+        // terminal is read as it scrolls, where they are noise that also breaks the
+        // alignment of the summary box.
+        const inCi = Boolean(process.env.CI);
+        this.format = options.format ?? (inCi ? 'ci' : 'pretty');
+        this.timestamps = options.timestamps ?? this.format === 'ci';
+        this.configure(options);
+    }
+    /** Apply options; unset fields keep their current value. */
+    configure(options) {
+        if (options.level)
+            this.currentLevel = options.level;
+        if (options.format) {
+            this.format = options.format;
+            if (options.timestamps === undefined)
+                this.timestamps = options.format === 'ci';
+        }
+        if (options.color)
+            this.color = options.color;
+        if (options.timestamps !== undefined)
+            this.timestamps = options.timestamps;
+        if (options.stderrLevels)
+            this.stderrLevels = new Set(options.stderrLevels);
+    }
+    shouldLog(level) {
+        return LEVEL_ORDER[level] <= LEVEL_ORDER[this.currentLevel];
+    }
+    streamFor(level) {
+        return this.stderrLevels.has(level) ? process.stderr : process.stdout;
+    }
+    /**
+     * Redirect output, returning the previous sink so the caller can restore it.
+     * Passing `null` restores the real streams.
+     */
+    setSink(sink) {
+        const previous = this.sink;
+        this.sink = sink;
+        return previous;
+    }
+    emit(stream, text) {
+        if (!this.sink) {
+            stream.write(text);
+            return;
+        }
+        if (stream === process.stderr)
+            this.sink.err(text);
+        else
+            this.sink.out(text);
+    }
+    render(level, message, error) {
+        const stack = error instanceof Error ? `\n${error.stack}` : '';
+        if (this.format === 'json') {
+            return JSON.stringify({
+                level,
+                message,
+                ...(stack ? { stack: stack.trim() } : {}),
+                time: new Date().toISOString(),
+            });
+        }
+        const time = this.timestamps ? `[${new Date().toISOString()}] ` : '';
+        const tag = this.format === 'ci' ? `[${level.toUpperCase()}] ` : '';
+        return `${time}${tag}${message}${stack}`;
+    }
+    logMessage(level, message, error) {
+        if (!this.shouldLog(level))
+            return;
+        const stream = this.streamFor(level);
+        const line = this.render(level, message, error);
+        // JSON output is meant to be parsed; coloring it would corrupt the payload.
+        const colored = this.format !== 'json' && wantsColor(this.color, stream)
+            ? `${COLORS[level]}${line}${RESET}`
+            : line;
+        this.emit(stream, `${colored}\n`);
+    }
+    log(msg) {
+        this.logMessage('log', msg);
+    }
+    info(msg) {
+        this.logMessage('info', msg);
+    }
+    warn(msg) {
+        this.logMessage('warn', msg);
+    }
+    error(msg, err) {
+        this.logMessage('error', msg, err);
+    }
+    debug(msg) {
+        this.logMessage('debug', msg);
+    }
+    /**
+     * Product output: the run summary, printed verbatim.
+     *
+     * Distinct from `info` because the summary is the thing the run exists to
+     * produce, not a note about producing it. Routing it through the log formatter
+     * prefixed every line with a timestamp and a level, which pushed the box
+     * borders out of alignment and made the headline artefact look broken.
+     */
+    print(msg) {
+        this.emit(process.stdout, `${msg}\n`);
+    }
+    setLevel(level) {
+        this.currentLevel = level;
+    }
+}
+export const logger = new Logger();

package/dist/esm/utils/own-deps.d.ts

@@ -0,0 +1,16 @@
+/** Walk up from this module until we find pr-checkmate's own package root. */
+export declare function findOwnPackageRoot(): string | null;
+/**
+ * Compute the full set of package names in pr-checkmate's own dependency
+ * closure (direct + transitive runtime dependencies), plus pr-checkmate itself.
+ *
+ * pr-checkmate installs into the consumer's node_modules, so its own runtime
+ * deps (eslint plugins, cspell dictionaries, …) become part of the consumer's
+ * production dependency tree. Some carry copyleft licenses that would otherwise
+ * trip pr-checkmate's own license check against an innocent client. These are
+ * pr-checkmate's dependencies, not the client's, so they must be exempt.
+ *
+ * Result is cached for the process. Returns a set containing only pr-checkmate
+ * itself if the package root cannot be located (defensive; never throws).
+ */
+export declare function getOwnDependencyClosure(): Set<string>;

package/dist/esm/utils/own-deps.js

@@ -0,0 +1,107 @@
+import { fileURLToPath as __fileURLToPath } from 'node:url';
+import { dirname as __dirnameFn } from 'node:path';
+const __dirname = __dirnameFn(__fileURLToPath(import.meta.url));
+import fs from 'node:fs';
+import path from 'node:path';
+const OWN_PACKAGE_NAME = 'pr-checkmate';
+const PACKAGE_JSON = 'package.json';
+let cachedClosure;
+/** Read a package.json's `dependencies` keys, tolerating missing/broken files. */
+function readDependencyNames(pkgDir) {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(pkgDir, PACKAGE_JSON), 'utf-8'));
+        return Object.keys(pkg.dependencies ?? {});
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Walk up from `startDir` (inclusive) toward the filesystem root, returning the
+ * first directory whose package.json declares `name === expectedName`, or null.
+ * Broken/missing package.json files are skipped rather than thrown.
+ */
+function findPackageRootByName(startDir, expectedName) {
+    let dir = startDir;
+    while (dir !== path.dirname(dir)) {
+        const pkgJsonPath = path.join(dir, PACKAGE_JSON);
+        if (fs.existsSync(pkgJsonPath)) {
+            try {
+                const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
+                if (pkg.name === expectedName)
+                    return dir;
+            }
+            catch { }
+        }
+        dir = path.dirname(dir);
+    }
+    return null;
+}
+/** Walk up from this module until we find pr-checkmate's own package root. */
+export function findOwnPackageRoot() {
+    return findPackageRootByName(__dirname, OWN_PACKAGE_NAME);
+}
+/**
+ * Resolve a dependency's install directory by name, starting the search from
+ * `fromDir`. Relies on Node's upward node_modules walk so hoisted packages are
+ * found regardless of physical layout.
+ */
+function resolvePackageDir(name, fromDir) {
+    // Prefer the explicit package.json subpath.
+    try {
+        return path.dirname(require.resolve(`${name}/package.json`, { paths: [fromDir] }));
+    }
+    catch { }
+    // Fallback for packages whose exports map hides ./package.json: resolve the
+    // entry point and walk up to the package's own root.
+    try {
+        const entryDir = path.dirname(require.resolve(name, { paths: [fromDir] }));
+        return findPackageRootByName(entryDir, name);
+    }
+    catch { }
+    return null;
+}
+/**
+ * Compute the full set of package names in pr-checkmate's own dependency
+ * closure (direct + transitive runtime dependencies), plus pr-checkmate itself.
+ *
+ * pr-checkmate installs into the consumer's node_modules, so its own runtime
+ * deps (eslint plugins, cspell dictionaries, …) become part of the consumer's
+ * production dependency tree. Some carry copyleft licenses that would otherwise
+ * trip pr-checkmate's own license check against an innocent client. These are
+ * pr-checkmate's dependencies, not the client's, so they must be exempt.
+ *
+ * Result is cached for the process. Returns a set containing only pr-checkmate
+ * itself if the package root cannot be located (defensive; never throws).
+ */
+export function getOwnDependencyClosure() {
+    if (cachedClosure)
+        return cachedClosure;
+    const closure = new Set([OWN_PACKAGE_NAME]);
+    const root = findOwnPackageRoot();
+    if (!root) {
+        cachedClosure = closure;
+        return closure;
+    }
+    // BFS over the dependency graph, resolving each package relative to the parent
+    // that declared it so nested (non-hoisted) installs resolve correctly.
+    const queue = readDependencyNames(root).map(name => ({
+        name,
+        fromDir: root,
+    }));
+    while (queue.length > 0) {
+        const { name, fromDir } = queue.shift();
+        if (closure.has(name))
+            continue;
+        closure.add(name);
+        const depDir = resolvePackageDir(name, fromDir);
+        if (!depDir)
+            continue;
+        for (const child of readDependencyNames(depDir)) {
+            if (!closure.has(child))
+                queue.push({ name: child, fromDir: depDir });
+        }
+    }
+    cachedClosure = closure;
+    return closure;
+}

package/dist/esm/utils/package-version.d.ts

@@ -0,0 +1,4 @@
+/** The version of pr-checkmate that is executing right now. */
+export declare function packageVersion(): string;
+/** The package name that is executing right now — the one to query npm for. */
+export declare function packageName(): string;