pr-checkmate 3.0.3 → 3.1.0

package/dist/{core → cjs/core}/install/prepare.d.ts

@@ -1,7 +1,7 @@
-import type { PRCheckMateConfig } from '../../interfaces';
-import type { LanguageUsage } from '../../utils/detect-language';
-import { type EnsureOptions } from './ensure';
-import { type Profile } from './profiles';
+import type { PRCheckMateConfig } from '../../interfaces/index.js';
+import type { LanguageUsage } from '../../utils/detect-language.js';
+import { type EnsureOptions } from './ensure.js';
+import { type Profile } from './profiles.js';
 /**
  * Whether a profile needs fetching at all, or already ships inside the package.
  *

package/dist/{core → cjs/core}/install/prepare.js

@@ -3,10 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.profileSatisfiedLocally = profileSatisfiedLocally;
 exports.prepareTooling = prepareTooling;
 exports.noTooling = noTooling;
-const logger_1 = require("../../utils/logger");
-const resolve_bin_1 = require("../../utils/resolve-bin");
-const ensure_1 = require("./ensure");
-const profiles_1 = require("./profiles");
+const logger_js_1 = require("../../utils/logger.js");
+const resolve_bin_js_1 = require("../../utils/resolve-bin.js");
+const ensure_js_1 = require("./ensure.js");
+const profiles_js_1 = require("./profiles.js");
 /**
  * Whether a profile needs fetching at all, or already ships inside the package.
  *
@@ -23,7 +23,7 @@ const profiles_1 = require("./profiles");
  * rather than another change to this logic.
  */
 function profileSatisfiedLocally(profile) {
-    return profile.packages.every(pkg => (0, resolve_bin_1.packagePresent)(pkg));
+    return profile.packages.every(pkg => (0, resolve_bin_js_1.packagePresent)(pkg));
 }
 /** Profiles blocked outright by `install.deny`, with a line saying so. */
 function denied(profile, deny) {
@@ -50,7 +50,7 @@ async function prepareTooling(opts) {
     // than once in one process, and a directory registered by a previous run — for
     // a different repository, with a different profile set — must not still be on
     // the search path for this one.
-    (0, resolve_bin_1.clearToolPaths)();
+    (0, resolve_bin_js_1.clearToolPaths)();
     const install = opts.config.install ?? {};
     const strategy = process.env.PR_CHECKMATE_INSTALL_STRATEGY ?? install.strategy ?? 'adaptive';
     const onMissing = install.onMissingTool ?? 'auto';
@@ -58,14 +58,14 @@ async function prepareTooling(opts) {
     // Which profiles this repository needs: languages by file count, universal
     // profiles by whether their check survived config. `install.profiles` and
     // `excludeProfiles` have already had their say inside `planProfiles`.
-    const required = new Set((0, profiles_1.planProfiles)(opts.usage, opts.config)
+    const required = new Set((0, profiles_js_1.planProfiles)(opts.usage, opts.config)
         .filter(decision => decision.required)
         .map(decision => decision.profile));
     // A profile nobody in this run would use is not worth a thought, let alone a
     // download. `eager` opts out of that reasoning by definition: it exists so a
     // container build or an air-gapped mirror can hold everything up front.
     const chosen = opts.selected.length > 0 ? new Set(opts.selected) : null;
-    const wanted = (opts.profiles ?? profiles_1.PROFILES).filter(profile => {
+    const wanted = (opts.profiles ?? profiles_js_1.PROFILES).filter(profile => {
         if (strategy === 'eager')
             return true;
         if (!required.has(profile.name))
@@ -108,7 +108,7 @@ async function prepareTooling(opts) {
     // creates the directory and warns when the configured path is unwritable, and a
     // container with a read-only home would print that on every single run.
     if (toFetch.length > 0) {
-        const result = await (0, ensure_1.ensureTooling)(toFetch.map(profile => profile.name), {
+        const result = await (0, ensure_js_1.ensureTooling)(toFetch.map(profile => profile.name), {
             cwd: opts.cwd,
             version: opts.version,
             install,
@@ -126,15 +126,15 @@ async function prepareTooling(opts) {
         // Always logged, never behind --debug. A check that did not run is the
         // failure mode this whole layer exists to make loud.
         const names = [...new Set(unavailable.keys())].join(', ');
-        logger_1.logger.warn(`[install]: ⚠️ tooling unavailable — these checks cannot run: ${names}`);
+        logger_js_1.logger.warn(`[install]: ⚠️ tooling unavailable — these checks cannot run: ${names}`);
         if (onMissing === 'error') {
-            logger_1.logger.error('[install]: ❌ install.onMissingTool is "error" — the affected checks fail');
+            logger_js_1.logger.error('[install]: ❌ install.onMissingTool is "error" — the affected checks fail');
         }
         else {
-            logger_1.logger.info('[install]:    Pre-warm the cache with: npx pr-checkmate install --all');
+            logger_js_1.logger.info('[install]:    Pre-warm the cache with: npx pr-checkmate install --all');
         }
     }
-    (0, resolve_bin_1.registerToolPaths)(dirs);
+    (0, resolve_bin_js_1.registerToolPaths)(dirs);
     return { unavailable, dirs, fatal: onMissing === 'error' && unavailable.size > 0 };
 }
 /**

package/dist/{core → cjs/core}/install/profiles.d.ts

@@ -1,5 +1,5 @@
-import type { PRCheckMateConfig } from '../../interfaces';
-import type { Language, LanguageUsage } from '../../utils/detect-language';
+import type { PRCheckMateConfig } from '../../interfaces/index.js';
+import type { Language, LanguageUsage } from '../../utils/detect-language.js';
 /**
  * A named bundle of tooling, and the checks that stop working without it.
  *

package/dist/{core → cjs/core}/install/reuse.d.ts

@@ -1,4 +1,4 @@
-import type { CheckContext } from '../types';
+import type { CheckContext } from '../types.js';
 /** One reuse decision, with the sentence that explains it. */
 interface ReuseDecision {
     /** Search roots to prefer, or `undefined` to use our own copy. */

package/dist/{core → cjs/core}/install/reuse.js

@@ -7,8 +7,8 @@ exports.reuseDecision = reuseDecision;
 exports.clientToolPaths = clientToolPaths;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const logger_1 = require("../../utils/logger");
-const resolve_bin_1 = require("../../utils/resolve-bin");
+const logger_js_1 = require("../../utils/logger.js");
+const resolve_bin_js_1 = require("../../utils/resolve-bin.js");
 /**
  * The major version we declare for a tool, from our own manifest.
  *
@@ -18,7 +18,7 @@ const resolve_bin_1 = require("../../utils/resolve-bin");
  */
 function ownMajor(pkgName) {
     try {
-        const manifest = node_path_1.default.join((0, resolve_bin_1.ownPackageRoot)(), 'package.json');
+        const manifest = node_path_1.default.join((0, resolve_bin_js_1.ownPackageRoot)(), 'package.json');
         const deps = JSON.parse(node_fs_1.default.readFileSync(manifest, 'utf-8')).dependencies;
         const range = deps?.[pkgName];
         if (!range)
@@ -102,6 +102,6 @@ function reuseDecision(pkgName, ctx, opts = {}) {
  */
 function clientToolPaths(pkgName, ctx, opts = {}) {
     const decision = reuseDecision(pkgName, ctx, opts);
-    logger_1.logger.debug(`[reuseLocal]: ${decision.reason}`);
+    logger_js_1.logger.debug(`[reuseLocal]: ${decision.reason}`);
     return decision.paths;
 }

package/dist/{core → cjs/core}/registry.d.ts

@@ -1,4 +1,4 @@
-import { Check } from './types';
+import { Check } from './types.js';
 /**
  * Every check, in declaration order. The orchestrator groups them by `phase`
  * (blocking → informational → format) and runs each phase's checks in parallel.

package/dist/cjs/core/registry.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REGISTRY = void 0;
+const banned_imports_js_1 = require("./checks/dependencies/banned-imports.js");
+const circular_deps_js_1 = require("./checks/dependencies/circular-deps.js");
+const dependency_check_js_1 = require("./checks/dependencies/dependency-check.js");
+const grype_scan_js_1 = require("./checks/dependencies/grype-scan.js");
+const license_check_js_1 = require("./checks/dependencies/license-check.js");
+const npm_audit_js_1 = require("./checks/dependencies/npm-audit.js");
+const outdated_deps_js_1 = require("./checks/dependencies/outdated-deps.js");
+const vuln_scan_js_1 = require("./checks/dependencies/vuln-scan.js");
+const custom_rules_js_1 = require("./checks/git/custom-rules.js");
+const diff_smell_js_1 = require("./checks/git/diff-smell.js");
+const large_files_js_1 = require("./checks/git/large-files.js");
+const leftover_debug_js_1 = require("./checks/git/leftover-debug.js");
+const lockfile_drift_js_1 = require("./checks/git/lockfile-drift.js");
+const merge_conflict_js_1 = require("./checks/git/merge-conflict.js");
+const missing_tests_js_1 = require("./checks/git/missing-tests.js");
+const todo_fixme_js_1 = require("./checks/git/todo-fixme.js");
+const cpp_format_js_1 = require("./checks/languages/cpp-format.js");
+const external_checks_js_1 = require("./checks/languages/external-checks.js");
+const go_format_js_1 = require("./checks/languages/go-format.js");
+const lint_js_1 = require("./checks/languages/lint.js");
+const prettier_js_1 = require("./checks/languages/prettier.js");
+const python_format_js_1 = require("./checks/languages/python-format.js");
+const python_lint_js_1 = require("./checks/languages/python-lint.js");
+const python_typecheck_js_1 = require("./checks/languages/python-typecheck.js");
+const typecheck_js_1 = require("./checks/languages/typecheck.js");
+const commitlint_js_1 = require("./checks/pr/commitlint.js");
+const pr_body_js_1 = require("./checks/pr/pr-body.js");
+const pr_size_check_js_1 = require("./checks/pr/pr-size-check.js");
+const pr_title_lint_js_1 = require("./checks/pr/pr-title-lint.js");
+const case_collision_js_1 = require("./checks/quality/case-collision.js");
+const config_validation_js_1 = require("./checks/quality/config-validation.js");
+const coverage_js_1 = require("./checks/quality/coverage.js");
+const dead_code_js_1 = require("./checks/quality/dead-code.js");
+const duplicate_check_js_1 = require("./checks/quality/duplicate-check.js");
+const license_header_js_1 = require("./checks/quality/license-header.js");
+const markdown_lint_js_1 = require("./checks/quality/markdown-lint.js");
+const package_size_js_1 = require("./checks/quality/package-size.js");
+const spellcheck_js_1 = require("./checks/quality/spellcheck.js");
+const symlinks_js_1 = require("./checks/quality/symlinks.js");
+const yaml_lint_js_1 = require("./checks/quality/yaml-lint.js");
+const diff_security_js_1 = require("./checks/security/diff-security.js");
+const dockerfile_security_js_1 = require("./checks/security/dockerfile-security.js");
+const migration_safety_js_1 = require("./checks/security/migration-safety.js");
+const security_js_1 = require("./checks/security/security.js");
+const sensitive_file_guard_js_1 = require("./checks/security/sensitive-file-guard.js");
+const workflow_security_js_1 = require("./checks/security/workflow-security.js");
+/**
+ * Every check, in declaration order. The orchestrator groups them by `phase`
+ * (blocking → informational → format) and runs each phase's checks in parallel.
+ */
+exports.REGISTRY = [
+    // blocking
+    merge_conflict_js_1.mergeConflictCheck,
+    security_js_1.securityCheck,
+    typecheck_js_1.typecheckCheck,
+    lint_js_1.lintCheck,
+    dependency_check_js_1.dependencyCheck,
+    npm_audit_js_1.npmAuditCheck,
+    circular_deps_js_1.circularDepsCheck,
+    license_check_js_1.licenseCheck,
+    // informational
+    diff_smell_js_1.diffSmellCheck,
+    diff_security_js_1.diffSecurityCheck,
+    workflow_security_js_1.workflowSecurityCheck,
+    dockerfile_security_js_1.dockerfileSecurityCheck,
+    case_collision_js_1.caseCollisionCheck,
+    vuln_scan_js_1.vulnScanCheck,
+    grype_scan_js_1.grypeScanCheck,
+    custom_rules_js_1.customRulesCheck,
+    banned_imports_js_1.bannedImportsCheck,
+    license_header_js_1.licenseHeaderCheck,
+    config_validation_js_1.configValidationCheck,
+    leftover_debug_js_1.leftoverDebugCheck,
+    lockfile_drift_js_1.lockfileDriftCheck,
+    large_files_js_1.largeFilesCheck,
+    todo_fixme_js_1.todoFixmeCheck,
+    missing_tests_js_1.missingTestsCheck,
+    coverage_js_1.coverageCheck,
+    migration_safety_js_1.migrationSafetyCheck,
+    sensitive_file_guard_js_1.sensitiveFileGuardCheck,
+    pr_body_js_1.prBodyCheck,
+    duplicate_check_js_1.duplicateCheck,
+    commitlint_js_1.commitlintCheck,
+    pr_size_check_js_1.prSizeCheck,
+    pr_title_lint_js_1.prTitleLintCheck,
+    outdated_deps_js_1.outdatedDepsCheck,
+    markdown_lint_js_1.markdownLintCheck,
+    spellcheck_js_1.spellcheckCheck,
+    yaml_lint_js_1.yamlLintCheck,
+    symlinks_js_1.symlinksCheck,
+    package_size_js_1.packageSizeCheck,
+    python_lint_js_1.pythonLintCheck,
+    python_typecheck_js_1.pythonTypecheckCheck,
+    dead_code_js_1.deadCodeCheck,
+    external_checks_js_1.swiftLintCheck,
+    external_checks_js_1.kotlinLintCheck,
+    external_checks_js_1.goLintCheck,
+    external_checks_js_1.rustLintCheck,
+    external_checks_js_1.rubyLintCheck,
+    external_checks_js_1.shellcheckCheck,
+    // format
+    prettier_js_1.prettierCheck,
+    cpp_format_js_1.cppFormatCheck,
+    python_format_js_1.pythonFormatCheck,
+    go_format_js_1.goFormatCheck,
+    external_checks_js_1.rustFormatCheck,
+    external_checks_js_1.csharpFormatCheck,
+    external_checks_js_1.phpFormatCheck,
+];

package/dist/{core → cjs/core}/reporters.d.ts

@@ -1,4 +1,4 @@
-import type { CheckReport, ReporterConfig, ReporterKind } from './types';
+import type { CheckReport, ReporterConfig, ReporterKind } from './types.js';
 /** Whether the comment reached the PR, so the caller can act on a failure. */
 export interface PostOutcome {
     attempted: boolean;

package/dist/{core → cjs/core}/reporters.js

@@ -6,9 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildMarkdownReport = buildMarkdownReport;
 exports.report = report;
 const node_fs_1 = __importDefault(require("node:fs"));
-const utils_1 = require("../utils");
-const http_1 = require("../utils/http");
-const package_version_1 = require("../utils/package-version");
+const http_js_1 = require("../utils/http.js");
+const index_js_1 = require("../utils/index.js");
+const package_version_js_1 = require("../utils/package-version.js");
 const STATUS_ICON = {
     pass: '✅',
     warn: '⚠️',
@@ -75,7 +75,7 @@ function buildMarkdownReport(report, cfg = {}) {
         // Say so rather than letting the table quietly disagree with the counts above.
         ...(hidden > 0 ? ['', `_${hidden} row(s) hidden by \`reporter.include\`._`] : []),
         '',
-        `_Generated by [PR CheckMate](https://www.npmjs.com/package/pr-checkmate) v${(0, package_version_1.packageVersion)()}_`,
+        `_Generated by [PR CheckMate](https://www.npmjs.com/package/pr-checkmate) v${(0, package_version_js_1.packageVersion)()}_`,
     ].join('\n');
 }
 /**
@@ -88,25 +88,25 @@ function buildMarkdownReport(report, cfg = {}) {
  */
 function printStdout(report, cfg) {
     const { passed, warned, failed, skipped } = report.summary;
-    utils_1.logger.print('');
-    utils_1.logger.print(SUMMARY_BORDER);
+    index_js_1.logger.print('');
+    index_js_1.logger.print(SUMMARY_BORDER);
     // The version belongs in the headline, not in a footnote. Which copy of
     // pr-checkmate produced a report is the first thing to establish when the
     // report disagrees with what someone expects, and it is not otherwise
     // recoverable from the log: a stale global install answers `pr-checkmate` on
     // `PATH` ahead of the project's own, and reads the same config while doing it.
-    utils_1.logger.print(`  PR CheckMate Summary  ·  v${(0, package_version_1.packageVersion)()}`);
-    utils_1.logger.print(SUMMARY_BORDER);
+    index_js_1.logger.print(`  PR CheckMate Summary  ·  v${(0, package_version_js_1.packageVersion)()}`);
+    index_js_1.logger.print(SUMMARY_BORDER);
     for (const r of report.results) {
         const details = r.details ? `: ${r.details}` : '';
-        utils_1.logger.print(`  ${STATUS_ICON[r.status]}  ${r.name}${details}`);
+        index_js_1.logger.print(`  ${STATUS_ICON[r.status]}  ${r.name}${details}`);
     }
-    utils_1.logger.print(SUMMARY_RULE);
-    utils_1.logger.print(`  ✅ ${passed} passed  ⚠️ ${warned} warnings  ❌ ${failed} failed  ⏭️ ${skipped} skipped`);
-    utils_1.logger.print(SUMMARY_BORDER);
+    index_js_1.logger.print(SUMMARY_RULE);
+    index_js_1.logger.print(`  ✅ ${passed} passed  ⚠️ ${warned} warnings  ❌ ${failed} failed  ⏭️ ${skipped} skipped`);
+    index_js_1.logger.print(SUMMARY_BORDER);
     if (cfg.include?.docsLink !== false) {
         // The docs cover every check and config key.
-        utils_1.logger.print(' DOCUMENTATION: https://pr-checkmate-docs.pages.dev/');
+        index_js_1.logger.print(' DOCUMENTATION: https://pr-checkmate-docs.pages.dev/');
     }
 }
 /** Network settings shared by every platform call. */
@@ -121,10 +121,10 @@ function httpOptions(cfg, label) {
 /** Log and shape the result of a write. */
 function finish(platform, res, verb) {
     if (res.ok) {
-        utils_1.logger.info(`[reporter]: ✅ ${verb} PR CheckMate summary on ${platform}`);
+        index_js_1.logger.info(`[reporter]: ✅ ${verb} PR CheckMate summary on ${platform}`);
         return { attempted: true, ok: true };
     }
-    utils_1.logger.warn(`[reporter]: ⚠️ Could not ${verb.toLowerCase()} ${platform} comment: ${res.error}`);
+    index_js_1.logger.warn(`[reporter]: ⚠️ Could not ${verb.toLowerCase()} ${platform} comment: ${res.error}`);
     return { attempted: true, ok: false, error: res.error };
 }
 /** Page-number pagination: stop as soon as a page comes back short. */
@@ -134,7 +134,7 @@ function pageAfter(base, count, page) {
 async function upsertGithubComment(body, cfg) {
     const ctx = getPrContext();
     if (!ctx) {
-        utils_1.logger.info('[reporter]: Skipping GitHub comment (not in PR context or GITHUB_TOKEN missing)');
+        index_js_1.logger.info('[reporter]: Skipping GitHub comment (not in PR context or GITHUB_TOKEN missing)');
         return SKIPPED;
     }
     const { token, owner, repo, prNumber } = ctx;
@@ -149,10 +149,10 @@ async function upsertGithubComment(body, cfg) {
     const opts = httpOptions(cfg, 'GitHub');
     const existing = await findExisting(listBase, { headers }, b => (Array.isArray(b) ? b : []), c => typeof c.body === 'string' && c.body.includes(COMMENT_MARKER), opts);
     if (existing.reuse && cfg.mode !== 'append') {
-        const res = await (0, http_1.request)(`${apiBase}/issues/comments/${existing.reuse.id}`, { method: 'PATCH', headers, body: JSON.stringify({ body }) }, opts);
+        const res = await (0, http_js_1.request)(`${apiBase}/issues/comments/${existing.reuse.id}`, { method: 'PATCH', headers, body: JSON.stringify({ body }) }, opts);
         return finish('GitHub', res, 'Updated');
     }
-    const res = await (0, http_1.request)(`${apiBase}/issues/${prNumber}/comments`, { method: 'POST', headers, body: JSON.stringify({ body }) }, opts);
+    const res = await (0, http_js_1.request)(`${apiBase}/issues/${prNumber}/comments`, { method: 'POST', headers, body: JSON.stringify({ body }) }, opts);
     return finish('GitHub', res, 'Posted');
 }
 /**
@@ -166,7 +166,7 @@ async function upsertGitlabNote(body, cfg) {
     const iid = process.env.CI_MERGE_REQUEST_IID;
     const token = process.env.GITLAB_TOKEN;
     if (!base || !project || !iid || !token) {
-        utils_1.logger.info('[reporter]: Skipping GitLab note (not an MR pipeline or GITLAB_TOKEN missing)');
+        index_js_1.logger.info('[reporter]: Skipping GitLab note (not an MR pipeline or GITLAB_TOKEN missing)');
         return SKIPPED;
     }
     const notes = `${base}/projects/${project}/merge_requests/${iid}/notes`;
@@ -174,10 +174,10 @@ async function upsertGitlabNote(body, cfg) {
     const opts = httpOptions(cfg, 'GitLab');
     const existing = await findExisting(`${notes}?per_page=${PER_PAGE}`, { headers }, b => (Array.isArray(b) ? b : []), n => typeof n.body === 'string' && n.body.includes(COMMENT_MARKER), opts);
     if (existing.reuse && cfg.mode !== 'append') {
-        const res = await (0, http_1.request)(`${notes}/${existing.reuse.id}`, { method: 'PUT', headers, body: JSON.stringify({ body }) }, opts);
+        const res = await (0, http_js_1.request)(`${notes}/${existing.reuse.id}`, { method: 'PUT', headers, body: JSON.stringify({ body }) }, opts);
         return finish('GitLab', res, 'Updated');
     }
-    const res = await (0, http_1.request)(notes, { method: 'POST', headers, body: JSON.stringify({ body }) }, opts);
+    const res = await (0, http_js_1.request)(notes, { method: 'POST', headers, body: JSON.stringify({ body }) }, opts);
     return finish('GitLab', res, 'Posted');
 }
 /**
@@ -190,7 +190,7 @@ async function upsertBitbucketComment(body, cfg) {
     const prId = process.env.BITBUCKET_PR_ID;
     const token = process.env.BITBUCKET_TOKEN;
     if (!fullName || !prId || !token) {
-        utils_1.logger.info('[reporter]: Skipping Bitbucket comment (not a PR pipeline or BITBUCKET_TOKEN missing)');
+        index_js_1.logger.info('[reporter]: Skipping Bitbucket comment (not a PR pipeline or BITBUCKET_TOKEN missing)');
         return SKIPPED;
     }
     const commentsUrl = `https://api.bitbucket.org/2.0/repositories/${fullName}/pullrequests/${prId}/comments`;
@@ -200,10 +200,10 @@ async function upsertBitbucketComment(body, cfg) {
     // Bitbucket is cursor-paginated: the next page is a URL in the body.
     b => b?.next ?? null);
     if (existing.reuse && cfg.mode !== 'append') {
-        const res = await (0, http_1.request)(`${commentsUrl}/${existing.reuse.id}`, { method: 'PUT', headers, body: JSON.stringify({ content: { raw: body } }) }, opts);
+        const res = await (0, http_js_1.request)(`${commentsUrl}/${existing.reuse.id}`, { method: 'PUT', headers, body: JSON.stringify({ content: { raw: body } }) }, opts);
         return finish('Bitbucket', res, 'Updated');
     }
-    const res = await (0, http_1.request)(commentsUrl, { method: 'POST', headers, body: JSON.stringify({ content: { raw: body } }) }, opts);
+    const res = await (0, http_js_1.request)(commentsUrl, { method: 'POST', headers, body: JSON.stringify({ content: { raw: body } }) }, opts);
     return finish('Bitbucket', res, 'Posted');
 }
 /**
@@ -215,14 +215,14 @@ async function upsertBitbucketComment(body, cfg) {
  */
 async function findExisting(listUrl, init, extract, matches, opts, cursorNext) {
     const base = listUrl;
-    const result = await (0, http_1.paginate)(listUrl, init, extract, (body, page, count) => (cursorNext ? cursorNext(body) : pageAfter(base, count, page)), opts);
+    const result = await (0, http_js_1.paginate)(listUrl, init, extract, (body, page, count) => (cursorNext ? cursorNext(body) : pageAfter(base, count, page)), opts);
     if (!result.ok) {
         // A failed search is not a failed post: fall through and create a comment.
         // A duplicate is a far smaller problem than no report at all.
-        utils_1.logger.warn(`[reporter]: ⚠️ Could not read existing comments (${result.error}) — will create`);
+        index_js_1.logger.warn(`[reporter]: ⚠️ Could not read existing comments (${result.error}) — will create`);
     }
     if (result.truncated) {
-        utils_1.logger.warn('[reporter]: ⚠️ Stopped searching comments at the page limit — a duplicate summary is ' +
+        index_js_1.logger.warn('[reporter]: ⚠️ Stopped searching comments at the page limit — a duplicate summary is ' +
             'possible (raise reporter.maxPages)');
     }
     return { reuse: result.items.find(matches) ?? null };
@@ -263,7 +263,7 @@ async function report(kind, result, cfg = {}) {
         return SKIPPED;
     // Nothing to say and nothing wrong: don't notify every PR subscriber.
     if (cfg.skipWhenClean && result.summary.failed === 0 && result.summary.warned === 0) {
-        utils_1.logger.info('[reporter]: Nothing to report (skipWhenClean)');
+        index_js_1.logger.info('[reporter]: Nothing to report (skipWhenClean)');
         return SKIPPED;
     }
     const platform = kind === 'auto' ? detectPlatform() : kind === 'stdout' ? null : kind;

package/dist/{core → cjs/core}/run-checks.d.ts

@@ -1,5 +1,5 @@
-import type { RunScope } from './types';
-import { CheckContext, CheckReport, CheckStatus, RunOptions } from './types';
+import type { RunScope } from './types.js';
+import { CheckContext, CheckReport, CheckStatus, RunOptions } from './types.js';
 /**
  * Apply the universal `config.severity` override for a check. Only remaps
  * between warn↔fail (pass/skip are never changed); `off` is handled earlier by

package/dist/{core → cjs/core}/run-checks.js

@@ -3,16 +3,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.applySeverity = applySeverity;
 exports.shouldReportDiffSkip = shouldReportDiffSkip;
 exports.runChecks = runChecks;
-const utils_1 = require("../utils");
-const package_version_1 = require("../utils/package-version");
-const pool_1 = require("../utils/pool");
-const resolve_bin_1 = require("../utils/resolve-bin");
-const result_collector_1 = require("../utils/result-collector");
-const context_1 = require("./context");
-const prepare_1 = require("./install/prepare");
-const registry_1 = require("./registry");
-const reporters_1 = require("./reporters");
-const types_1 = require("./types");
+const index_js_1 = require("../utils/index.js");
+const package_version_js_1 = require("../utils/package-version.js");
+const pool_js_1 = require("../utils/pool.js");
+const resolve_bin_js_1 = require("../utils/resolve-bin.js");
+const result_collector_js_1 = require("../utils/result-collector.js");
+const context_js_1 = require("./context.js");
+const prepare_js_1 = require("./install/prepare.js");
+const registry_js_1 = require("./registry.js");
+const reporters_js_1 = require("./reporters.js");
+const types_js_1 = require("./types.js");
 /**
  * Resolve which checks to run: the built-in registry, custom `opts.checks`, or a mix.
  * - no custom checks → the built-in registry
@@ -25,9 +25,9 @@ function resolveChecks(opts) {
     if (opts.extendRegistry === false)
         return custom;
     if (custom.length === 0)
-        return registry_1.REGISTRY;
+        return registry_js_1.REGISTRY;
     const byName = new Map();
-    for (const c of registry_1.REGISTRY)
+    for (const c of registry_js_1.REGISTRY)
         byName.set(c.name, c);
     for (const c of custom)
         byName.set(c.name, c); // custom wins on name clash
@@ -45,7 +45,7 @@ async function emitReport(reporter, result, cfg) {
         await reporter(result);
         return { attempted: false, ok: true };
     }
-    return (0, reporters_1.report)(reporter ?? 'stdout', result, cfg);
+    return (0, reporters_js_1.report)(reporter ?? 'stdout', result, cfg);
 }
 /** Apply only/skip filters to the resolved check set. */
 function selectChecks(checks, opts) {
@@ -168,19 +168,19 @@ async function runOne(check, ctx, collector, heavy, tooling) {
             // client who made this check advisory does not get a hard failure out of
             // `onMissingTool: "error"`, and one who promoted it does.
             const status = applySeverity(check.name, tooling.fatal ? 'fail' : 'skip', ctx);
-            utils_1.logger.warn(`[runChecks]: ${status === 'fail' ? '❌' : '⏭️'} ${check.name}: ${missing}`);
+            index_js_1.logger.warn(`[runChecks]: ${status === 'fail' ? '❌' : '⏭️'} ${check.name}: ${missing}`);
             collector.register(check.name, status, `tooling unavailable — ${missing}`);
             return;
         }
         const started = Date.now();
         const timeoutMs = ctx.config.run?.checkTimeoutMs ?? 300000;
-        const execute = () => (0, pool_1.withTimeout)(check.run(ctx), timeoutMs, () => {
-            utils_1.logger.warn(`[runChecks]: ⏱️ ${check.name} exceeded ${timeoutMs}ms`);
+        const execute = () => (0, pool_js_1.withTimeout)(check.run(ctx), timeoutMs, () => {
+            index_js_1.logger.warn(`[runChecks]: ⏱️ ${check.name} exceeded ${timeoutMs}ms`);
             return { status: 'warn', details: `timed out after ${timeoutMs}ms` };
         });
         const outcome = check.weight === 'heavy' ? await heavy.run(execute) : await execute();
         if (ctx.config.run?.timings) {
-            utils_1.logger.info(`[runChecks]: ${check.name} took ${Date.now() - started}ms`);
+            index_js_1.logger.info(`[runChecks]: ${check.name} took ${Date.now() - started}ms`);
         }
         collector.register(check.name, applySeverity(check.name, outcome.status, ctx), outcome.details);
     }
@@ -189,7 +189,7 @@ async function runOne(check, ctx, collector, heavy, tooling) {
         // phases it only warns — those phases never block, matching the legacy pipeline.
         const base = check.phase === 'blocking' ? 'fail' : 'warn';
         const status = applySeverity(check.name, base, ctx);
-        utils_1.logger.error(`[runChecks]: ${status === 'fail' ? '❌' : '⚠️'} ${check.name} threw: ${err}`);
+        index_js_1.logger.error(`[runChecks]: ${status === 'fail' ? '❌' : '⚠️'} ${check.name} threw: ${err}`);
         collector.register(check.name, status, errMessage(err));
     }
 }
@@ -201,12 +201,12 @@ async function runOne(check, ctx, collector, heavy, tooling) {
  * within a phase run in parallel.
  */
 async function runChecks(opts = {}) {
-    const ctx = await (0, context_1.buildContext)(opts);
+    const ctx = await (0, context_js_1.buildContext)(opts);
     // `severity: { "<name>": "off" }` disables any check by name, universally —
     // a superset of the per-check `enabled: false` flags.
     const off = ctx.config.severity ?? {};
     const selected = selectChecks(resolveChecks(opts), opts).filter(c => off[c.name] !== 'off');
-    const collector = new result_collector_1.ResultCollector();
+    const collector = new result_collector_js_1.ResultCollector();
     // Config Validation verifies that `severity` keys name real checks. It reads
     // the list from here rather than importing the registry, which would make
     // registry → check → registry a cycle.
@@ -215,12 +215,12 @@ async function runChecks(opts = {}) {
     // learn which ones are not. Doing this per-check would fetch the same profile
     // from several checks at once and leave each of them guessing on failure.
     const tooling = await prepareToolingFor(ctx, selected);
-    const limit = (0, pool_1.resolveConcurrency)(ctx.config.run?.concurrency);
+    const limit = (0, pool_js_1.resolveConcurrency)(ctx.config.run?.concurrency);
     const heavyLimit = Math.max(1, ctx.config.run?.heavyConcurrency ?? 1);
-    const heavy = new pool_1.Semaphore(heavyLimit);
-    for (const phase of types_1.PHASES) {
+    const heavy = new pool_js_1.Semaphore(heavyLimit);
+    for (const phase of types_js_1.PHASES) {
         const inPhase = selected.filter(c => c.phase === phase);
-        await (0, pool_1.runPool)(inPhase.map(c => () => runOne(c, ctx, collector, heavy, tooling)), limit);
+        await (0, pool_js_1.runPool)(inPhase.map(c => () => runOne(c, ctx, collector, heavy, tooling)), limit);
     }
     reportDegradedScope(ctx, collector);
     const build = () => {
@@ -254,7 +254,7 @@ async function runChecks(opts = {}) {
  */
 async function prepareToolingFor(ctx, selected) {
     try {
-        return await (0, prepare_1.prepareTooling)({
+        return await (0, prepare_js_1.prepareTooling)({
             cwd: ctx.cwd,
             config: ctx.config,
             // A hand-built context (the SDK, a test) carries no counts. Treating its
@@ -262,15 +262,15 @@ async function prepareToolingFor(ctx, selected) {
             // that names a language is asserting it, not guessing.
             usage: ctx.usage ?? ctx.languages.map(lang => ({ lang, files: 1, marker: true })),
             selected: selected.map(c => c.name),
-            version: (0, package_version_1.packageVersion)(),
+            version: (0, package_version_js_1.packageVersion)(),
         });
     }
     catch (err) {
-        utils_1.logger.warn(`[install]: ⚠️ could not prepare tooling: ${errMessage(err)}`);
+        index_js_1.logger.warn(`[install]: ⚠️ could not prepare tooling: ${errMessage(err)}`);
         // Preparation may have registered roots before it threw. Leaving them behind
         // would point resolution at a half-installed directory for the whole run.
-        (0, resolve_bin_1.clearToolPaths)();
-        return (0, prepare_1.noTooling)();
+        (0, resolve_bin_js_1.clearToolPaths)();
+        return (0, prepare_js_1.noTooling)();
     }
 }
 /**
@@ -287,12 +287,12 @@ async function prepareToolingFor(ctx, selected) {
  */
 function reportDegradedScope(ctx, collector) {
     const mode = ctx.config.run?.onDegradedScope ?? 'warn';
-    if (mode === 'off' || !ctx.scope?.degraded || !(0, utils_1.isCiEnvironment)())
+    if (mode === 'off' || !ctx.scope?.degraded || !(0, index_js_1.isCiEnvironment)())
         return;
     const dropped = collector
         .getResults()
         .filter(r => r.status === 'skip' && isDiffSkip(r.details)).length;
     const detail = `${ctx.scope.reason}; ${dropped} diff-only check(s) did not run — set fetch-depth: 0`;
-    utils_1.logger.error(`[runChecks]: ${mode === 'error' ? '❌' : '⚠️'} Degraded scope: ${detail}`);
+    index_js_1.logger.error(`[runChecks]: ${mode === 'error' ? '❌' : '⚠️'} Degraded scope: ${detail}`);
     collector.register('Scan Scope', mode === 'error' ? 'fail' : 'warn', detail);
 }

package/dist/{core → cjs/core}/targets.d.ts

@@ -1,4 +1,4 @@
-import { type CheckContext, type CheckOutcome } from './types';
+import { type CheckContext, type CheckOutcome } from './types.js';
 /**
  * Drop files that live under any excluded directory (client `ignoreDirs` or the
  * curated default), matched on any path segment so nesting depth doesn't matter.