pr-checkmate 3.0.4 → 3.1.0

package/dist/cjs/utils/execa.js

@@ -0,0 +1,46 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.execa = execa;
+/**
+ * Run a command via execa, loading the module lazily on first call.
+ *
+ * Drop-in replacement for `execa(file, args, options)` at every call site in
+ * this package — all of which await the result and read it synchronously.
+ */
+async function execa(file, args, options) {
+    const { execa: run } = await Promise.resolve().then(() => __importStar(require('execa')));
+    return (await run(file, args, options));
+}

package/dist/{utils → cjs/utils}/git.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveGitRef = resolveGitRef;
-const execa_1 = require("./execa");
+const execa_js_1 = require("./execa.js");
 /**
  * Resolve a git ref to a concrete commit SHA, or `undefined` when this clone
  * cannot resolve it.
@@ -16,7 +16,7 @@ const execa_1 = require("./execa");
  * missing base means "review everything", never "review nothing".
  */
 async function resolveGitRef(cwd, ref) {
-    const { stdout } = await (0, execa_1.execa)('git', ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`], {
+    const { stdout } = await (0, execa_js_1.execa)('git', ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`], {
         cwd,
         reject: false,
     });

package/dist/{utils → cjs/utils}/http.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.request = request;
 exports.paginate = paginate;
-const logger_1 = require("./logger");
+const logger_js_1 = require("./logger.js");
 const DEFAULT_TIMEOUT_MS = 10000;
 const DEFAULT_RETRIES = 3;
 /** 5xx and 429 are worth another attempt; a 4xx will fail identically forever. */
@@ -60,7 +60,7 @@ async function request(url, init = {}, opts = {}) {
         if (attempt < attempts) {
             // Exponential backoff, capped so three attempts stay well inside a CI step.
             const waitMs = Math.min(2000, 250 * 2 ** (attempt - 1));
-            logger_1.logger.warn(`${label}retrying after ${last.error} (attempt ${attempt}/${attempts})`);
+            logger_js_1.logger.warn(`${label}retrying after ${last.error} (attempt ${attempt}/${attempts})`);
             await new Promise(resolve => setTimeout(resolve, waitMs));
         }
     }

package/dist/cjs/utils/index.d.ts

@@ -0,0 +1,15 @@
+export * from './logger.js';
+export * from './result-collector.js';
+export * from './resolve-bin.js';
+export * from './own-deps.js';
+export * from './direct-deps.js';
+export * from './detect-language.js';
+export * from './glob.js';
+export * from './update-notifier.js';
+export * from './package-version.js';
+export * from './ci.js';
+export * from './git.js';
+/**
+ *
+ */
+export declare function cleanupTempFile(filePath: string): void;

package/dist/{utils → cjs/utils}/index.js

@@ -19,18 +19,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.cleanupTempFile = cleanupTempFile;
 const node_fs_1 = __importDefault(require("node:fs"));
-const logger_1 = require("./logger");
-__exportStar(require("./logger"), exports);
-__exportStar(require("./result-collector"), exports);
-__exportStar(require("./resolve-bin"), exports);
-__exportStar(require("./own-deps"), exports);
-__exportStar(require("./direct-deps"), exports);
-__exportStar(require("./detect-language"), exports);
-__exportStar(require("./glob"), exports);
-__exportStar(require("./update-notifier"), exports);
-__exportStar(require("./package-version"), exports);
-__exportStar(require("./ci"), exports);
-__exportStar(require("./git"), exports);
+const logger_js_1 = require("./logger.js");
+__exportStar(require("./logger.js"), exports);
+__exportStar(require("./result-collector.js"), exports);
+__exportStar(require("./resolve-bin.js"), exports);
+__exportStar(require("./own-deps.js"), exports);
+__exportStar(require("./direct-deps.js"), exports);
+__exportStar(require("./detect-language.js"), exports);
+__exportStar(require("./glob.js"), exports);
+__exportStar(require("./update-notifier.js"), exports);
+__exportStar(require("./package-version.js"), exports);
+__exportStar(require("./ci.js"), exports);
+__exportStar(require("./git.js"), exports);
 /**
  *
  */
@@ -41,6 +41,6 @@ function cleanupTempFile(filePath) {
         }
     }
     catch (err) {
-        logger_1.logger.warn(`[cleanupTempFile]: ⚠️ Failed cleanup: ${filePath}\n${err}`);
+        logger_js_1.logger.warn(`[cleanupTempFile]: ⚠️ Failed cleanup: ${filePath}\n${err}`);
     }
 }

package/dist/{utils → cjs/utils}/own-deps.d.ts

@@ -1,3 +1,5 @@
+/** Walk up from this module until we find pr-checkmate's own package root. */
+export declare function findOwnPackageRoot(): string | null;
 /**
  * Compute the full set of package names in pr-checkmate's own dependency
  * closure (direct + transitive runtime dependencies), plus pr-checkmate itself.

package/dist/{utils → cjs/utils}/own-deps.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.findOwnPackageRoot = findOwnPackageRoot;
 exports.getOwnDependencyClosure = getOwnDependencyClosure;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));

package/dist/{utils → cjs/utils}/package-version.js

@@ -7,6 +7,7 @@ exports.packageVersion = packageVersion;
 exports.packageName = packageName;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const own_deps_js_1 = require("./own-deps.js");
 /**
  * Our own name and version, read from the manifest that ships inside the package.
  *
@@ -23,7 +24,7 @@ const node_path_1 = __importDefault(require("node:path"));
  */
 function readManifest() {
     try {
-        const manifest = node_path_1.default.resolve(__dirname, '../..', 'package.json');
+        const manifest = node_path_1.default.join((0, own_deps_js_1.findOwnPackageRoot)() ?? node_path_1.default.resolve(__dirname, '../../..'), 'package.json');
         const parsed = JSON.parse(node_fs_1.default.readFileSync(manifest, 'utf-8'));
         return { name: parsed.name ?? 'pr-checkmate', version: parsed.version ?? '0.0.0' };
     }

package/dist/{utils → cjs/utils}/resolve-bin.js

@@ -11,6 +11,7 @@ exports.resolveTool = resolveTool;
 exports.resolvePackageBin = resolvePackageBin;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const own_deps_js_1 = require("./own-deps.js");
 /**
  * Extra roots to search, registered once per run by the install layer.
  *
@@ -38,7 +39,7 @@ function clearToolPaths() {
 }
 /** The root of the installed pr-checkmate package — where our own tooling lives. */
 function ownPackageRoot() {
-    return node_path_1.default.resolve(__dirname, '../..');
+    return (0, own_deps_js_1.findOwnPackageRoot)() ?? node_path_1.default.resolve(__dirname, '../../..');
 }
 /**
  * Whether a package is physically present in our own dependency tree.

package/dist/{utils → cjs/utils}/update-notifier.js

@@ -5,8 +5,8 @@ exports.getUpdateNotice = getUpdateNotice;
 // Imported from the module rather than the `../config` barrel on purpose:
 // `config/index.ts` imports `../utils`, so going through the barrel would make
 // utils ⇄ config circular. `constants.ts` itself pulls in nothing from utils.
-const constants_1 = require("../config/constants");
-const package_version_1 = require("./package-version");
+const constants_js_1 = require("../config/constants.js");
+const package_version_js_1 = require("./package-version.js");
 // Same widths as the run summary in `reporters.ts`, so the two boxes line up
 // when both are printed at the end of a run.
 const NOTICE_BORDER = '═'.repeat(63);
@@ -71,7 +71,7 @@ async function getUpdateNotice(timeoutMs = 2500) {
         // The *running* copy's identity, not the project's declared dependency. A
         // stale global install shadows the local one on `PATH`, and it is the stale
         // copy that must own the notice it prints.
-        const pkg = { name: (0, package_version_1.packageName)(), version: (0, package_version_1.packageVersion)() };
+        const pkg = { name: (0, package_version_js_1.packageName)(), version: (0, package_version_js_1.packageVersion)() };
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), timeoutMs);
         let latest;
@@ -98,7 +98,7 @@ async function getUpdateNotice(timeoutMs = 2500) {
                 '  own — your pr-checkmate.json holds only what you changed, and nothing',
                 '  in it needs topping up.',
                 NOTICE_RULE,
-                `  📚 Docs:    ${constants_1.DOCS_URL}`,
+                `  📚 Docs:    ${constants_js_1.DOCS_URL}`,
                 `  📦 Release: https://www.npmjs.com/package/${pkg.name}`,
                 NOTICE_BORDER,
             ];

package/dist/esm/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/esm/cli.js

@@ -0,0 +1,137 @@
+#!/usr/bin/env node
+import { COMMAND_TO_CHECK, FLAGS, STANDALONE_COMMANDS, TOOLING_COMMANDS } from './core/commands.js';
+import { runChecks } from './core/index.js';
+import { installProfiles, pruneCache, runDoctor } from './core/install/doctor.js';
+import { init } from './init.js';
+import { logger, getUpdateNotice } from './utils/index.js';
+const argv = process.argv.slice(2);
+/**
+ * Flags are separated from positional arguments so they compose with every command
+ * — scope is orthogonal to which checks run, hence `pr-checkmate lint --full` as
+ * well as `pr-checkmate all --full`.
+ */
+const flags = argv.filter(arg => arg.startsWith('-'));
+const args = argv.filter(arg => !arg.startsWith('-'));
+const cmd = args[0];
+/**
+ * An unrecognised flag aborts the run. Ignoring it would report success for a scope
+ * the user did not ask for: a misspelling of `--full` must not quietly review the
+ * diff and print a green summary.
+ */
+function rejectUnknownFlags() {
+    const unknown = flags.filter(flag => !FLAGS[flag]);
+    if (unknown.length === 0)
+        return;
+    const known = Object.entries(FLAGS)
+        .map(([flag, help]) => `${flag} (${help})`)
+        .join(', ');
+    logger.error(`[cli]: Unknown flag(s) "${unknown.join('", "')}". Available: ${known}`);
+    process.exit(1);
+}
+/**
+ * `--full` and `precommit` ask for different things — every tracked file versus the
+ * staged changes only. `planDiffRange` resolves the conflict in favour of `--full`,
+ * which would silently turn a pre-commit hook into a whole-repo scan, so the
+ * contradiction is refused here instead.
+ */
+function rejectConflictingScope() {
+    if (cmd === 'precommit' && flags.includes('--full')) {
+        logger.error('[cli]: "precommit --full" is contradictory — precommit reviews the staged changes. Run "pr-checkmate all --full" for a whole-repo review.');
+        process.exit(1);
+    }
+    if (cmd === 'init' && flags.length > 0) {
+        logger.error(`[cli]: "init" takes no flags, got: ${flags.join(', ')}.`);
+        process.exit(1);
+    }
+    // `--all` belongs to `install` alone. Accepting it elsewhere would look like a
+    // scope flag and quietly do nothing, which is the failure mode
+    // `rejectUnknownFlags` exists to prevent.
+    if (flags.includes('--all') && cmd !== 'install') {
+        logger.error('[cli]: "--all" applies only to "install". Did you mean "--full"?');
+        process.exit(1);
+    }
+    if (flags.includes('--full') && TOOLING_COMMANDS.includes(cmd ?? '')) {
+        logger.error(`[cli]: "${cmd}" manages tooling and reviews nothing, so "--full" has no meaning.`);
+        process.exit(1);
+    }
+}
+const full = flags.includes('--full');
+/**
+ * Reject extra arguments after a standalone command. Silently ignoring them would
+ * report success for work that never ran — `pr-checkmate init lint` must not look
+ * like it linted anything.
+ *
+ * Driven by {@link STANDALONE_COMMANDS} so the list stays the single source of truth:
+ * a per-branch guard would leave the next standalone command unguarded the day it is
+ * added to the list but not to the branch.
+ */
+function rejectExtraArgs() {
+    if (!cmd || !STANDALONE_COMMANDS.includes(cmd) || args.length <= 1)
+        return;
+    logger.error(`[cli]: "${cmd}" takes no other arguments, got: ${args.slice(1).join(', ')}. Run them as a separate command.`);
+    process.exit(1);
+}
+void (async () => {
+    try {
+        rejectUnknownFlags();
+        rejectConflictingScope();
+        rejectExtraArgs();
+        if (cmd === 'init') {
+            await init();
+            process.exit(0);
+        }
+        // Tooling management. These run no checks — they prepare, inspect or clean
+        // up what the checks need, so they never touch the diff or the reporter.
+        if (cmd === 'install') {
+            const results = await installProfiles(process.cwd(), flags.includes('--all'));
+            const failed = results.filter(r => r.status === 'failed');
+            for (const result of failed) {
+                logger.error(`[install]: ❌ ${result.profiles.join(', ') || 'tooling'}: ${result.reason}`);
+            }
+            process.exit(failed.length > 0 ? 1 : 0);
+        }
+        if (cmd === 'doctor') {
+            await runDoctor();
+            process.exit(0);
+        }
+        if (cmd === 'cache-prune') {
+            pruneCache();
+            process.exit(0);
+        }
+        // Full run: auto-detect the CI platform (GitHub/GitLab/Bitbucket), post the
+        // summary to its PR/MR, and allow formatters to write.
+        if (!cmd || cmd === 'all') {
+            // Fetch the update notice concurrently (best-effort, never blocks/affects
+            // the exit code), but print it LAST — after the summary — so it's noticeable.
+            const noticePromise = getUpdateNotice();
+            const report = await runChecks({ reporter: 'auto', write: true, full });
+            const notice = await noticePromise.catch(() => null);
+            if (notice) {
+                logger.info('');
+                notice.forEach(line => logger.info(line));
+            }
+            process.exit(report.ok ? 0 : 1);
+        }
+        // Local pre-commit: check the staged changes (index vs HEAD), print to
+        // stdout, never modify files. Exits non-zero on failure to block the commit.
+        if (cmd === 'precommit') {
+            const report = await runChecks({ staged: true, reporter: 'stdout', write: false });
+            process.exit(report.ok ? 0 : 1);
+        }
+        // Every remaining argument is a check name, so `pr-checkmate lint spellcheck`
+        // runs both in one pass. Unknown names abort the whole run — a typo must never
+        // shrink the requested check set silently.
+        const unknown = args.filter(arg => !COMMAND_TO_CHECK[arg]);
+        if (unknown.length > 0) {
+            logger.error(`[cli]: Unknown command(s) "${unknown.join('", "')}". Available: ${STANDALONE_COMMANDS.join(', ')}, ${Object.keys(COMMAND_TO_CHECK).join(', ')}`);
+            process.exit(1);
+        }
+        const checkNames = [...new Set(args.map(arg => COMMAND_TO_CHECK[arg]))];
+        const report = await runChecks({ only: checkNames, reporter: 'stdout', write: true, full });
+        process.exit(report.ok ? 0 : 1);
+    }
+    catch (err) {
+        logger.error(`❌ CLI failed: ${err}`);
+        process.exit(1);
+    }
+})();

package/dist/esm/config/constants.d.ts

@@ -0,0 +1,153 @@
+/**
+ * Build output, dependency, tooling, and report directories that are never
+ * product code. Every check excludes them by directory-name segment match (see
+ * `targets.ts`): a match on any segment of a path drops the file. Untracked
+ * build dirs are already excluded because checks read git-tracked files only —
+ * this list additionally covers dirs that repos commonly *commit* (`.github`,
+ * `.vscode`, `.idea`, `.claude`) and any checked-in build artifacts.
+ *
+ * Covers the common ecosystems: Node/JS/web, Python, Java/Kotlin/Gradle/Android,
+ * Swift/iOS/Xcode, and C/C++/CMake. Add more here.
+ */
+export declare const IGNORED_DIRS: string[];
+/**
+ * Glob form of the ignore list, for tools that take glob ignores directly
+ * (ESLint `--ignore-pattern`, cspell `--exclude`, the generated
+ * `.prettierignore`). Combines {@link IGNORED_DIRS} with a few tool-specific
+ * nested report globs that are not plain directory names.
+ */
+export declare const IGNORE_PATTERNS: string[];
+/**
+ * Where test code lives, as globs.
+ *
+ * Deliberately NOT part of {@link IGNORED_DIRS}: that list hides a directory from
+ * every check, and test code still wants linting, type-checking and formatting.
+ * What test code does not want is the handful of checks whose findings are noise
+ * on it — duplication (setup boilerplate repeats by design), unused exports (the
+ * runner consumes them), spelling (fixture identifiers) and the diff security
+ * scan (a test's whole job may be to call the dangerous thing). Each of those
+ * defaults to this list, and each lets a client replace it.
+ */
+export declare const TEST_PATH_GLOBS: string[];
+/**
+ * Test files/folders excluded from duplicate-code detection by default.
+ * Test suites legitimately repeat setup/arrange/assert boilerplate, so counting
+ * them as clones is noise that drowns out real production duplication. Clients can
+ * override this list via `duplicate.ignore` in pr-checkmate.json.
+ */
+export declare const DUPLICATE_IGNORE_DEFAULTS: string[];
+/**
+ * Paths the diff security scan skips by default.
+ *
+ * A security test corpus is built out of the exact constructs the scan hunts for
+ * — `eval()`, `document.write()`, `__proto__` — so scanning it turns every added
+ * test case into a finding, and under `severity: error` into a blocked merge.
+ * Clients can override via `diffSecurity.ignorePaths` (which REPLACES this list).
+ */
+export declare const DIFF_SECURITY_IGNORE_DEFAULTS: string[];
+/**
+ * Files written by a release tool rather than by a person.
+ *
+ * `CHANGELOG.md` is assembled from commit subjects, so every typo anyone has ever
+ * committed reappears in it — 39 of 42 spellcheck findings in one real repository
+ * came from that one file, none of them actionable: the text cannot be corrected
+ * without rewriting git history, and the next release regenerates it anyway.
+ *
+ * Matched at ANY depth, not just at the repository root. The root-only form was
+ * the original, and it left every nested changelog unhandled: a component-config
+ * repository with one per component produced 157 of 157 spelling findings and 240
+ * of 246 markdown findings from files nobody writes by hand. A generated file is
+ * generated wherever it sits.
+ */
+export declare const GENERATED_DOC_FILES: string[];
+/**
+ * Files excluded from the dead-code (unused-exports) report by default. These are
+ * REGEX sources (matched against each reported file path), not globs — dead-code's
+ * `ignoreFiles` is regex-based. Test and mock files legitimately export helpers and
+ * mocks consumed only by the test runner (jest.mock, dynamic imports), which
+ * ts-unused-exports cannot see as usage, so flagging them is noise. Clients can
+ * override via `deadCode.ignoreFiles` in pr-checkmate.json (setting it replaces
+ * this list).
+ */
+export declare const DEAD_CODE_IGNORE_DEFAULTS: string[];
+export declare const CONFIG_FILE_PATTERNS: string[];
+/**
+ * jscpd formats the duplicate-CODE check scans. Restricting to code formats keeps
+ * config/CI YAML and JSON out of the report — they are data, not code, and their
+ * repetition is not meaningful duplication. This mirrors the code-only file set the
+ * check already uses when scanning a git diff, so full-tree and diff scans agree.
+ *
+ * One entry per language pr-checkmate detects, all of them verified against the
+ * jscpd binary rather than assumed: the list used to stop at C++ while the check
+ * only ever handed jscpd `.ts`/`.js` files, so the Go, Rust, C#, Ruby and PHP
+ * halves were unreachable and the Python one was decoration. Copy-paste is a
+ * language-independent smell, and the tokenizer behind this check has always been
+ * able to see it — the file list was the only thing in the way.
+ */
+export declare const DUPLICATE_CODE_FORMATS: string[];
+/**
+ * File extensions to check
+ */
+export declare const SOURCE_EXTENSIONS: {
+    typescript: string[];
+    javascript: string[];
+    markdown: string[];
+    json: string[];
+    all: string[];
+};
+export declare const DEFAULT_COMMANDS: {
+    'npx pr-checkmate init': string;
+    'npx pr-checkmate all': string;
+    'npx pr-checkmate all --full': string;
+    'npx pr-checkmate lint': string;
+    'npx pr-checkmate prettier': string;
+    'npx pr-checkmate deps': string;
+    'npx pr-checkmate npm-audit': string;
+    'npx pr-checkmate security': string;
+    'npx pr-checkmate spellcheck': string;
+    'npx pr-checkmate typecheck': string;
+    'npx pr-checkmate diff-smell': string;
+    'npx pr-checkmate pr-body': string;
+    'npx pr-checkmate duplicate': string;
+};
+/**
+ * Packages allow-listed for the license check by default.
+ *
+ * These are the optional cspell language dictionaries. Some ship under copyleft
+ * licenses (GPL/LGPL), and a client who installs one to spellcheck their own
+ * language should not have that turn into a licence finding: the dictionary is
+ * data for our check, not code they ship.
+ */
+export declare const DEFAULT_ALLOW_PACKAGES: string[];
+/**
+ * Canonical entry point to the PR CheckMate docs. Single source of truth: it is
+ * written into every generated `pr-checkmate.json` (via {@link documentation})
+ * and printed in the "new version available" notice, so the two can never drift.
+ */
+export declare const DOCS_URL = "https://github.com/Mybono/pr_checkmate_public/tree/main/documentation";
+/**
+ * The fully annotated configuration, with every option at its default value.
+ *
+ * A URL rather than a file inside the package on purpose: half the audience runs
+ * pr-checkmate through `npx` on a pipeline and has no `node_modules` at all, so
+ * a path into the installed package is a dead end for them. The release workflow
+ * publishes `src/config/pr-checkmate.template.json` to the public mirror under
+ * this name, which keeps one copy for everyone.
+ */
+export declare const FULL_CONFIG_URL = "https://github.com/Mybono/pr_checkmate_public/blob/main/pr-checkmate.json";
+export declare const documentation: {
+    pr_checkmate: string;
+    eslint: string;
+    typescriptEslint: string;
+    prettier: string;
+    cspell: string;
+};
+/**
+ * Every top-level key PR CheckMate recognises in pr-checkmate.json — the union
+ * of the `PRCheckMateConfig` interface fields and the keys the `init` generator
+ * writes (which use `eslint`/`cspell`/`markdownlint` rather than the interface's
+ * `lint`/`spellcheck`). The Config Validation check warns on any key not in this
+ * set (typos), ignoring `//`-prefixed comment keys and `$schema`. Keep in sync
+ * when adding a new configurable check.
+ */
+export declare const KNOWN_CONFIG_KEYS: Set<string>;