pr-checkmate 3.0.4 → 3.1.0

package/dist/{core → cjs/core}/checks/dependencies/grype-scan.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.grypeScanCheck = void 0;
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const types_1 = require("../../types");
-const tool_install_1 = require("../tool-install");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const types_js_1 = require("../../types.js");
+const tool_install_js_1 = require("../tool-install.js");
 const SEVERITY_ORDER = ['negligible', 'low', 'medium', 'high', 'critical'];
 /** grype artifact `type` → the ecosystem we can resolve direct deps for. */
 const TYPE_TO_ECOSYSTEM = {
@@ -62,7 +62,7 @@ exports.grypeScanCheck = {
         // third-party code is not something the client could fix anyway (see below).
         const excludes = (ctx.config.ignoreDirs ?? []).flatMap(dir => ['--exclude', `**/${dir}/**`]);
         const timeout = ctx.config.grypeScan?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-        const result = await (0, execa_1.execa)('grype', ['dir:.', '-o', 'json', '-q', ...excludes], {
+        const result = await (0, execa_js_1.execa)('grype', ['dir:.', '-o', 'json', '-q', ...excludes], {
             cwd: ctx.cwd,
             reject: false,
             timeout,
@@ -70,27 +70,27 @@ exports.grypeScanCheck = {
         // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'`
         // when the binary is absent — detect the missing scanner on the result.
         if (result.code === 'ENOENT')
-            return (0, tool_install_1.notInstalled)('grype');
+            return (0, tool_install_js_1.notInstalled)('grype');
         if (result.timedOut) {
-            utils_1.logger.warn(`[Grype Scan]: ⚠️ grype timed out after ${timeout}ms — skipping`);
-            return (0, types_1.skip)('grype timed out');
+            index_js_1.logger.warn(`[Grype Scan]: ⚠️ grype timed out after ${timeout}ms — skipping`);
+            return (0, types_js_1.skip)('grype timed out');
         }
         let report;
         try {
             report = JSON.parse(result.stdout);
         }
         catch {
-            return (0, types_1.warn)('grype produced no parseable output');
+            return (0, types_js_1.warn)('grype produced no parseable output');
         }
         const matches = report.matches ?? [];
-        const direct = (0, utils_1.collectDirectDeps)(ctx.cwd);
+        const direct = (0, index_js_1.collectDirectDeps)(ctx.cwd);
         // Keep only: severity >= threshold, a direct dependency, and not ignored.
         const isDirect = (m) => {
             const ecosystem = TYPE_TO_ECOSYSTEM[m.artifact?.type ?? ''];
             const names = ecosystem && direct.get(ecosystem);
             if (!names)
                 return false; // unknown/unparseable ecosystem → not our concern
-            return names.has((0, utils_1.normalizeName)(ecosystem, m.artifact?.name ?? ''));
+            return names.has((0, index_js_1.normalizeName)(ecosystem, m.artifact?.name ?? ''));
         };
         const isIgnored = (m) => ignore.includes((m.vulnerability?.id ?? '').toLowerCase()) ||
             ignore.includes((m.artifact?.name ?? '').toLowerCase());
@@ -98,18 +98,18 @@ exports.grypeScanCheck = {
         const findings = atSeverity.filter(m => isDirect(m) && !isIgnored(m));
         const suppressed = atSeverity.length - findings.length;
         if (suppressed > 0) {
-            utils_1.logger.info(`[Grype Scan]: suppressed ${suppressed} finding(s) — transitive/third-party (not directly fixable) or ignored`);
+            index_js_1.logger.info(`[Grype Scan]: suppressed ${suppressed} finding(s) — transitive/third-party (not directly fixable) or ignored`);
         }
         if (findings.length === 0) {
-            utils_1.logger.info('[Grype Scan]: ✅ No known vulnerabilities in direct dependencies');
-            return (0, types_1.pass)();
+            index_js_1.logger.info('[Grype Scan]: ✅ No known vulnerabilities in direct dependencies');
+            return (0, types_js_1.pass)();
         }
-        utils_1.logger.warn(`[Grype Scan]: ⚠️ vulnerabilities in direct dependencies (>= ${minSeverity}):`);
+        index_js_1.logger.warn(`[Grype Scan]: ⚠️ vulnerabilities in direct dependencies (>= ${minSeverity}):`);
         findings
             .slice(0, 10)
-            .forEach(m => utils_1.logger.warn(`  ${m.vulnerability?.id ?? 'unknown'} — ${m.artifact?.name ?? '?'}@${m.artifact?.version ?? '?'} (${m.vulnerability?.severity ?? '?'})`));
+            .forEach(m => index_js_1.logger.warn(`  ${m.vulnerability?.id ?? 'unknown'} — ${m.artifact?.name ?? '?'}@${m.artifact?.version ?? '?'} (${m.vulnerability?.severity ?? '?'})`));
         if (findings.length > 10)
-            utils_1.logger.warn(`  ... and ${findings.length - 10} more`);
-        return (0, types_1.warn)(`${findings.length} direct-dependency vulnerability(ies) at "${minSeverity}"+ (grype)`);
+            index_js_1.logger.warn(`  ... and ${findings.length - 10} more`);
+        return (0, types_js_1.warn)(`${findings.length} direct-dependency vulnerability(ies) at "${minSeverity}"+ (grype)`);
     },
 };

package/dist/{core → cjs/core}/checks/dependencies/license-check.d.ts

@@ -1,2 +1,2 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 export declare const licenseCheck: Check;

package/dist/{core → cjs/core}/checks/dependencies/license-check.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.licenseCheck = void 0;
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const types_1 = require("../../types");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const types_js_1 = require("../../types.js");
 const FORBIDDEN_LICENSES = ['GPL-2.0', 'GPL-3.0', 'AGPL-3.0', 'LGPL-2.0', 'LGPL-2.1', 'LGPL-3.0'];
 /** Strip the trailing "@version" to get the bare package name (scoped-safe). */
 function bareName(pkgKey) {
@@ -14,7 +14,7 @@ exports.licenseCheck = {
     name: 'License Check',
     phase: 'blocking',
     applies(ctx) {
-        return (0, types_1.isNpmProject)(ctx);
+        return (0, types_js_1.isNpmProject)(ctx);
     },
     async run(ctx) {
         const allowPackages = new Set(ctx.config.licenseCheck?.allowPackages ?? []);
@@ -23,24 +23,24 @@ exports.licenseCheck = {
         // deps (eslint plugins, cspell dictionaries, …) leak into the client's
         // production tree. Those are our dependencies, not the client's — never fail
         // a client's PR because of a license we ourselves pulled in.
-        const ownDeps = (0, utils_1.getOwnDependencyClosure)();
+        const ownDeps = (0, index_js_1.getOwnDependencyClosure)();
         // Resolve the bundled license-checker binary and run it via the current node — never
         // shell out to `npx`, which fails (exit 127) when license-checker isn't on the path.
         let licenseCheckerBin;
         try {
-            licenseCheckerBin = (0, utils_1.resolvePackageBin)('license-checker-rseidelsohn', 'bin/license-checker-rseidelsohn.js');
+            licenseCheckerBin = (0, index_js_1.resolvePackageBin)('license-checker-rseidelsohn', 'bin/license-checker-rseidelsohn.js');
         }
         catch {
-            return (0, types_1.skip)('license-checker unavailable');
+            return (0, types_js_1.skip)('license-checker unavailable');
         }
-        const { stdout, failed } = await (0, execa_1.execa)(process.execPath, [licenseCheckerBin, '--json', '--production'], { cwd: ctx.cwd, reject: false });
+        const { stdout, failed } = await (0, execa_js_1.execa)(process.execPath, [licenseCheckerBin, '--json', '--production'], { cwd: ctx.cwd, reject: false });
         let licenses;
         try {
             licenses = JSON.parse(stdout);
         }
         catch {
             // Tool couldn't produce parseable output; skip rather than fail the client's PR.
-            return (0, types_1.skip)(failed ? 'license-checker failed to run' : 'license-checker produced invalid JSON');
+            return (0, types_js_1.skip)(failed ? 'license-checker failed to run' : 'license-checker produced invalid JSON');
         }
         const violations = [];
         for (const [pkg, info] of Object.entries(licenses)) {
@@ -56,9 +56,9 @@ exports.licenseCheck = {
             }
         }
         if (violations.length > 0) {
-            violations.forEach(v => utils_1.logger.error(`[License Check]: ❌ ${v}`));
-            return (0, types_1.fail)(`${violations.length} forbidden license(s)`);
+            violations.forEach(v => index_js_1.logger.error(`[License Check]: ❌ ${v}`));
+            return (0, types_js_1.fail)(`${violations.length} forbidden license(s)`);
         }
-        return (0, types_1.pass)();
+        return (0, types_js_1.pass)();
     },
 };

package/dist/{core → cjs/core}/checks/dependencies/npm-audit.d.ts

@@ -1,4 +1,4 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 /**
  * npm audit — only direct-dependency vulnerabilities block. Transitive ones and
  * vulnerabilities in pr-checkmate itself are ignored (the client cannot fix those).

package/dist/{core → cjs/core}/checks/dependencies/npm-audit.js

@@ -6,9 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.npmAuditCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const types_1 = require("../../types");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const types_js_1 = require("../../types.js");
 const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
 function isSeverityAtLeast(severity, level) {
     const sevIdx = SEVERITY_ORDER.indexOf(severity);
@@ -17,7 +17,7 @@ function isSeverityAtLeast(severity, level) {
 }
 function getOwnPackageName() {
     try {
-        const ownPkg = node_path_1.default.resolve(__dirname, '../../../../package.json');
+        const ownPkg = node_path_1.default.join((0, index_js_1.findOwnPackageRoot)() ?? node_path_1.default.resolve(__dirname, '../../../..'), 'package.json');
         return JSON.parse(node_fs_1.default.readFileSync(ownPkg, 'utf-8')).name ?? null;
     }
     catch {
@@ -34,7 +34,7 @@ exports.npmAuditCheck = {
     applies(ctx) {
         if (ctx.config.security?.['npm-audit']?.enabled === false)
             return false;
-        return (0, types_1.isNpmProject)(ctx);
+        return (0, types_js_1.isNpmProject)(ctx);
     },
     async run(ctx) {
         // `high`, not `moderate`. A moderate CVE in a direct dependency often has no
@@ -45,7 +45,7 @@ exports.npmAuditCheck = {
         const auditLevel = ctx.config.security?.['npm-audit']?.auditLevel ?? 'high';
         const ignore = new Set((ctx.config.security?.['npm-audit']?.ignore ?? []).map(name => name.toLowerCase()));
         const ownName = getOwnPackageName();
-        const { stdout } = await (0, execa_1.execa)('npm', ['audit', '--json'], { cwd: ctx.cwd, reject: false });
+        const { stdout } = await (0, execa_js_1.execa)('npm', ['audit', '--json'], { cwd: ctx.cwd, reject: false });
         // `npm audit` reports registry/lockfile problems as JSON on stdout, but not
         // always: an absent npm (execa resolves with `code: 'ENOENT'`), a killed
         // process or a proxy that answers with HTML all leave stdout unparseable.
@@ -57,16 +57,16 @@ exports.npmAuditCheck = {
             report = JSON.parse(stdout);
         }
         catch {
-            utils_1.logger.warn('[NPM Audit]: ⚠️ npm audit produced no parseable report — skipping');
-            return (0, types_1.skip)('npm audit produced no parseable report');
+            index_js_1.logger.warn('[NPM Audit]: ⚠️ npm audit produced no parseable report — skipping');
+            return (0, types_js_1.skip)('npm audit produced no parseable report');
         }
         // A repo with no lockfile, or a registry npm cannot reach, yields
         // `{"error":{"code":"ENOLOCK",…}}` — no `vulnerabilities` key at all. Passing
         // on that reads as "no vulnerabilities" when nothing was actually audited.
         if (report.error) {
             const detail = report.error.summary ?? report.error.code ?? 'unknown error';
-            utils_1.logger.warn(`[NPM Audit]: ⚠️ npm could not audit this project — ${detail}`);
-            return (0, types_1.skip)(`npm audit unavailable: ${report.error.code ?? 'error'}`);
+            index_js_1.logger.warn(`[NPM Audit]: ⚠️ npm could not audit this project — ${detail}`);
+            return (0, types_js_1.skip)(`npm audit unavailable: ${report.error.code ?? 'error'}`);
         }
         const relevant = Object.values(report.vulnerabilities ?? {}).filter(v => v.isDirect && v.name !== ownName && isSeverityAtLeast(v.severity, auditLevel));
         const [ignored, directVulns] = relevant.reduce(([skip, block], v) => {
@@ -74,10 +74,10 @@ exports.npmAuditCheck = {
             return [skip, block];
         }, [[], []]);
         // Ignored advisories stay visible as warnings — an exception is not a silent drop.
-        ignored.forEach(v => utils_1.logger.warn(`[NPM Audit]: ⚠ ${v.name} — severity: ${v.severity} (ignored via config)`));
+        ignored.forEach(v => index_js_1.logger.warn(`[NPM Audit]: ⚠ ${v.name} — severity: ${v.severity} (ignored via config)`));
         if (directVulns.length === 0)
-            return (0, types_1.pass)();
-        directVulns.forEach(v => utils_1.logger.error(`[NPM Audit]: ❌ ${v.name} — severity: ${v.severity}`));
-        return (0, types_1.fail)(`${directVulns.length} direct vulnerability(ies) at "${auditLevel}"+`);
+            return (0, types_js_1.pass)();
+        directVulns.forEach(v => index_js_1.logger.error(`[NPM Audit]: ❌ ${v.name} — severity: ${v.severity}`));
+        return (0, types_js_1.fail)(`${directVulns.length} direct vulnerability(ies) at "${auditLevel}"+`);
     },
 };

package/dist/{core → cjs/core}/checks/dependencies/outdated-deps.d.ts

@@ -1,2 +1,2 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 export declare const outdatedDepsCheck: Check;

package/dist/{core → cjs/core}/checks/dependencies/outdated-deps.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.outdatedDepsCheck = void 0;
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const types_1 = require("../../types");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const types_js_1 = require("../../types.js");
 const DEFAULT_TIMEOUT_MS = 30000;
 exports.outdatedDepsCheck = {
     name: 'Outdated Deps',
@@ -11,7 +11,7 @@ exports.outdatedDepsCheck = {
     applies(ctx) {
         if (ctx.config.outdatedDeps?.enabled === false)
             return false;
-        return (0, types_1.isNpmProject)(ctx);
+        return (0, types_js_1.isNpmProject)(ctx);
     },
     async run(ctx) {
         // `npm outdated` queries the registry for every dependency and can take a
@@ -19,30 +19,30 @@ exports.outdatedDepsCheck = {
         // holds up CI. On timeout, skip rather than fail.
         const timeout = ctx.config.outdatedDeps?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
         // npm outdated exits 1 when outdated packages exist — use reject:false.
-        const result = await (0, execa_1.execa)('npm', ['outdated', '--json'], {
+        const result = await (0, execa_js_1.execa)('npm', ['outdated', '--json'], {
             cwd: ctx.cwd,
             reject: false,
             timeout,
         });
         if (result.timedOut) {
-            utils_1.logger.warn(`[Outdated Deps]: ⚠️ npm outdated timed out after ${timeout}ms — skipping`);
-            return (0, types_1.skip)('npm outdated timed out');
+            index_js_1.logger.warn(`[Outdated Deps]: ⚠️ npm outdated timed out after ${timeout}ms — skipping`);
+            return (0, types_js_1.skip)('npm outdated timed out');
         }
         if (!result.stdout?.trim())
-            return (0, types_1.pass)();
+            return (0, types_js_1.pass)();
         let outdated;
         try {
             outdated = JSON.parse(result.stdout);
         }
         catch {
-            return (0, types_1.pass)();
+            return (0, types_js_1.pass)();
         }
         // Packages deliberately pinned behind their latest major (see outdatedDeps.ignore
         // in pr-checkmate.json) are dropped before counting, so they never warn.
         const ignore = new Set(ctx.config.outdatedDeps?.ignore ?? []);
         const entries = Object.entries(outdated).filter(([pkg]) => !ignore.has(pkg));
         if (entries.length === 0)
-            return (0, types_1.pass)();
+            return (0, types_js_1.pass)();
         // `current` is only populated when the package is installed in node_modules.
         // In CI (npx-invoked validator, no `npm ci` for the target repo) it's absent,
         // so fall back to `wanted` — the version the package.json range resolves to,
@@ -57,13 +57,13 @@ exports.outdatedDepsCheck = {
             return parseInt(latest?.split('.')[0] ?? '0', 10) > parseInt(baseline.split('.')[0], 10);
         });
         if (majorBehind.length > 0) {
-            majorBehind.forEach(({ pkg, baseline, latest }) => utils_1.logger.warn(`[Outdated Deps]: ⚠️ ${pkg}: ${baseline} → ${latest}`));
-            return (0, types_1.warn)(`${majorBehind.length} package(s) major versions behind`);
+            majorBehind.forEach(({ pkg, baseline, latest }) => index_js_1.logger.warn(`[Outdated Deps]: ⚠️ ${pkg}: ${baseline} → ${latest}`));
+            return (0, types_js_1.warn)(`${majorBehind.length} package(s) major versions behind`);
         }
         const minorBehind = entries.length - majorBehind.length;
         if (minorBehind > 0) {
-            utils_1.logger.info(`[Outdated Deps]: ${minorBehind} package(s) have minor/patch updates`);
+            index_js_1.logger.info(`[Outdated Deps]: ${minorBehind} package(s) have minor/patch updates`);
         }
-        return (0, types_1.pass)();
+        return (0, types_js_1.pass)();
     },
 };

package/dist/{core → cjs/core}/checks/dependencies/vuln-scan.d.ts

@@ -1,2 +1,2 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 export declare const vulnScanCheck: Check;

package/dist/{core → cjs/core}/checks/dependencies/vuln-scan.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.vulnScanCheck = void 0;
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const types_1 = require("../../types");
-const tool_install_1 = require("../tool-install");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const types_js_1 = require("../../types.js");
+const tool_install_js_1 = require("../tool-install.js");
 /**
  * Cross-language dependency vulnerability scan via osv-scanner, which reads
  * lockfiles across ecosystems (npm, PyPI, Go, crates, Maven, …) against the OSV
@@ -26,7 +26,7 @@ exports.vulnScanCheck = {
     },
     async run(ctx) {
         const timeout = ctx.config.vulnScan?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-        const result = await (0, execa_1.execa)('osv-scanner', ['-r', '.'], {
+        const result = await (0, execa_js_1.execa)('osv-scanner', ['-r', '.'], {
             cwd: ctx.cwd,
             reject: false,
             timeout,
@@ -34,24 +34,24 @@ exports.vulnScanCheck = {
         // execa v9 with reject:false resolves (not throws) with `code: 'ENOENT'`
         // when the binary is absent — detect the missing scanner on the result.
         if (result.code === 'ENOENT')
-            return (0, tool_install_1.notInstalled)('osv-scanner');
+            return (0, tool_install_js_1.notInstalled)('osv-scanner');
         if (result.timedOut) {
-            utils_1.logger.warn(`[Vuln Scan]: ⚠️ osv-scanner timed out after ${timeout}ms — skipping`);
-            return (0, types_1.skip)('osv-scanner timed out');
+            index_js_1.logger.warn(`[Vuln Scan]: ⚠️ osv-scanner timed out after ${timeout}ms — skipping`);
+            return (0, types_js_1.skip)('osv-scanner timed out');
         }
         if (result.exitCode === 0) {
-            utils_1.logger.info('[Vuln Scan]: ✅ No known vulnerabilities');
-            return (0, types_1.pass)();
+            index_js_1.logger.info('[Vuln Scan]: ✅ No known vulnerabilities');
+            return (0, types_js_1.pass)();
         }
         const lines = [result.stdout, result.stderr]
             .filter(Boolean)
             .join('\n')
             .split('\n')
             .filter(l => /\b(CVE-|GHSA-|vulnerab|advisor)/i.test(l));
-        utils_1.logger.warn('[Vuln Scan]: ⚠️ known vulnerabilities found:');
-        lines.slice(0, 10).forEach(l => utils_1.logger.warn(`  ${l.trim()}`));
+        index_js_1.logger.warn('[Vuln Scan]: ⚠️ known vulnerabilities found:');
+        lines.slice(0, 10).forEach(l => index_js_1.logger.warn(`  ${l.trim()}`));
         if (lines.length > 10)
-            utils_1.logger.warn(`  ... and ${lines.length - 10} more`);
-        return (0, types_1.warn)(`${lines.length || 'unknown'} vulnerability finding(s) (osv-scanner)`);
+            index_js_1.logger.warn(`  ... and ${lines.length - 10} more`);
+        return (0, types_js_1.warn)(`${lines.length || 'unknown'} vulnerability finding(s) (osv-scanner)`);
     },
 };

package/dist/{core → cjs/core}/checks/findings.d.ts

@@ -1,4 +1,4 @@
-import { CheckContext, CheckOutcome } from '../types';
+import { CheckContext, CheckOutcome } from '../types.js';
 /**
  * Client-configurable severity for a check's findings, read from that check's
  * config block (e.g. `mergeConflict.severity`). `error` fails the run, `warn`

package/dist/{core → cjs/core}/checks/findings.js

@@ -21,10 +21,10 @@ exports.clientFindingOptions = clientFindingOptions;
 exports.reportSeverityBuckets = reportSeverityBuckets;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../utils");
-const execa_1 = require("../../utils/execa");
-const targets_1 = require("../targets");
-const types_1 = require("../types");
+const execa_js_1 = require("../../utils/execa.js");
+const index_js_1 = require("../../utils/index.js");
+const targets_js_1 = require("../targets.js");
+const types_js_1 = require("../types.js");
 /**
  * Resolve a check's effective severity (`configured` from config, else its
  * `fallback`) into a matched logger, icon, and outcome constructor — so a check
@@ -33,9 +33,9 @@ const types_1 = require("../types");
 function severityEmitter(configured, fallback) {
     const isError = (configured ?? fallback) === 'error';
     return {
-        log: (isError ? utils_1.logger.error : utils_1.logger.warn).bind(utils_1.logger),
+        log: (isError ? index_js_1.logger.error : index_js_1.logger.warn).bind(index_js_1.logger),
         icon: isError ? '❌' : '⚠️',
-        emit: (details) => (isError ? (0, types_1.fail)(details) : (0, types_1.warn)(details)),
+        emit: (details) => (isError ? (0, types_js_1.fail)(details) : (0, types_js_1.warn)(details)),
     };
 }
 /** Append `from`'s samples to `into`, merging labels both sides produced. */
@@ -80,7 +80,7 @@ async function diffAddedLines(ctx, globs) {
     const cacheKey = `d:${args.join('')}`;
     let stdout = ctx.cache?.get(cacheKey);
     if (stdout === undefined) {
-        stdout = (await (0, execa_1.execa)('git', args, { cwd: ctx.cwd })).stdout;
+        stdout = (await (0, execa_js_1.execa)('git', args, { cwd: ctx.cwd })).stdout;
         ctx.cache?.set(cacheKey, stdout);
     }
     // Universal inline suppression: strip added lines opted out with the
@@ -159,7 +159,7 @@ async function reviewLines(ctx, globs, onChunk) {
     }
     if (ctx.config.run?.fullScanBehaviour === 'skip')
         return true;
-    const files = await (0, targets_1.listTrackedFiles)(ctx, globs, ['.']);
+    const files = await (0, targets_js_1.listTrackedFiles)(ctx, globs, ['.']);
     if (files === null)
         return false;
     await scanTrackedFiles(ctx, files, onChunk);
@@ -476,7 +476,7 @@ function scanDiffPatterns(stdout, patterns, opts = {}) {
         if (header) {
             syntax = mode === 'language' ? commentSyntaxFor(header[1]) : 'both';
             inBlockComment = false;
-            skippingFile = ignorePaths.length > 0 && (0, utils_1.matchesAnyGlob)(header[1], ignorePaths);
+            skippingFile = ignorePaths.length > 0 && (0, index_js_1.matchesAnyGlob)(header[1], ignorePaths);
             taint.reset();
             continue;
         }
@@ -578,10 +578,10 @@ const MAX_LOGGED = 10;
  * shape (ticket 079).
  */
 function logSample(name, summary, lines) {
-    utils_1.logger.warn(`[${name}]: ⚠️ ${summary}`);
-    lines.slice(0, MAX_LOGGED).forEach(line => utils_1.logger.warn(`  ${line}`));
+    index_js_1.logger.warn(`[${name}]: ⚠️ ${summary}`);
+    lines.slice(0, MAX_LOGGED).forEach(line => index_js_1.logger.warn(`  ${line}`));
     if (lines.length > MAX_LOGGED)
-        utils_1.logger.warn(`  ... and ${lines.length - MAX_LOGGED} more`);
+        index_js_1.logger.warn(`  ... and ${lines.length - MAX_LOGGED} more`);
 }
 function bucketTotal(bucket) {
     return Object.values(bucket).reduce((sum, arr) => sum + arr.length, 0);
@@ -617,7 +617,7 @@ function reportCountedFindings(findings, ctx, opts) {
  * two cannot report different levels.
  */
 function logFindings(bucket, opts) {
-    const emit = opts.isError ? utils_1.logger.error.bind(utils_1.logger) : utils_1.logger.warn.bind(utils_1.logger);
+    const emit = opts.isError ? index_js_1.logger.error.bind(index_js_1.logger) : index_js_1.logger.warn.bind(index_js_1.logger);
     const icon = opts.isError ? '❌' : '⚠️';
     const showCount = opts.showCount ?? true;
     const { sampleLimit } = opts;
@@ -705,18 +705,18 @@ function reportSeverityBuckets(errorsIn, warningsIn, opts) {
     const totalErrors = bucketTotal(errors);
     const totalWarnings = bucketTotal(warnings);
     if (totalErrors === 0 && totalWarnings === 0)
-        return (0, types_1.pass)();
+        return (0, types_js_1.pass)();
     const logOpts = { prefix: opts.prefix, showCount: opts.showCount, sampleLimit: opts.sampleLimit };
     logFindings(errors, { ...logOpts, isError: true });
     logFindings(warnings, { ...logOpts, isError: false });
     const failOn = opts.failOn ?? opts.defaults?.failOn ?? 'error';
     if (failOn === 'never')
-        return (0, types_1.pass)();
+        return (0, types_js_1.pass)();
     const parts = [];
     if (totalErrors > 0)
         parts.push(opts.errorSummary(totalErrors));
     if (totalWarnings > 0)
         parts.push(opts.warningSummary(totalWarnings));
     const summary = parts.join(', ');
-    return failOn === 'error' && totalErrors > 0 ? (0, types_1.fail)(summary) : (0, types_1.warn)(summary);
+    return failOn === 'error' && totalErrors > 0 ? (0, types_js_1.fail)(summary) : (0, types_js_1.warn)(summary);
 }

package/dist/{core → cjs/core}/checks/git/custom-rules.d.ts

@@ -1,2 +1,2 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 export declare const customRulesCheck: Check;

package/dist/{core → cjs/core}/checks/git/custom-rules.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.customRulesCheck = void 0;
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 /**
  * Compile the user's `customRules` into ready-to-run matchers. A rule with an
  * invalid regex is skipped with a warning rather than crashing the run. `g`/`y`
@@ -23,7 +23,7 @@ function compileRules(ctx) {
             re = new RegExp(r.pattern, (r.flags ?? '').replace(/[gy]/g, ''));
         }
         catch (err) {
-            utils_1.logger.warn(`[Custom Rules]: ⚠️ invalid regex in rule "${r.name}" — skipped\n${err}`);
+            index_js_1.logger.warn(`[Custom Rules]: ⚠️ invalid regex in rule "${r.name}" — skipped\n${err}`);
             continue;
         }
         compiled.push({
@@ -55,9 +55,9 @@ function scanDiff(stdout, rules) {
             continue;
         const content = raw.slice(1);
         for (const rule of rules) {
-            if (rule.include && !(0, utils_1.matchesAnyGlob)(file, rule.include))
+            if (rule.include && !(0, index_js_1.matchesAnyGlob)(file, rule.include))
                 continue;
-            if (rule.exclude && (0, utils_1.matchesAnyGlob)(file, rule.exclude))
+            if (rule.exclude && (0, index_js_1.matchesAnyGlob)(file, rule.exclude))
                 continue;
             if (rule.re.test(content)) {
                 const bucket = rule.severity === 'error' ? errors : warnings;
@@ -79,31 +79,31 @@ exports.customRulesCheck = {
     async run(ctx) {
         const rules = compileRules(ctx);
         if (rules.length === 0)
-            return (0, types_1.pass)('no valid custom rules');
+            return (0, types_js_1.pass)('no valid custom rules');
         try {
-            const found = (0, findings_1.emptyBuckets)();
-            const collect = (stdout) => (0, findings_1.mergeSeverityBuckets)(found, scanDiff(stdout, rules));
+            const found = (0, findings_js_1.emptyBuckets)();
+            const collect = (stdout) => (0, findings_js_1.mergeSeverityBuckets)(found, scanDiff(stdout, rules));
             if (ctx.baseSha) {
-                const { stdout } = await (0, execa_1.execa)('git', ['diff', '--unified=0', '--diff-filter=ACMR', ctx.baseSha, ctx.headSha ?? 'HEAD'], { cwd: ctx.cwd });
+                const { stdout } = await (0, execa_js_1.execa)('git', ['diff', '--unified=0', '--diff-filter=ACMR', ctx.baseSha, ctx.headSha ?? 'HEAD'], { cwd: ctx.cwd });
                 collect(stdout);
             }
             else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
-                const files = await (0, targets_1.listTrackedFiles)(ctx, ['*'], ['.']);
+                const files = await (0, targets_js_1.listTrackedFiles)(ctx, ['*'], ['.']);
                 if (files === null)
-                    return (0, types_1.skip)('git unavailable');
-                await (0, findings_1.scanTrackedFiles)(ctx, files, collect);
+                    return (0, types_js_1.skip)('git unavailable');
+                await (0, findings_js_1.scanTrackedFiles)(ctx, files, collect);
             }
             // A rule with severity "error" blocks the run (fail), regardless of phase.
-            return (0, findings_1.reportSeverityBuckets)(found.errors, found.warnings, {
+            return (0, findings_js_1.reportSeverityBuckets)(found.errors, found.warnings, {
                 prefix: PREFIX,
                 errorSummary: n => `${n} error(s)`,
                 warningSummary: n => `${n} warning(s)`,
-                ...(0, findings_1.clientFindingOptions)(ctx),
+                ...(0, findings_js_1.clientFindingOptions)(ctx),
             });
         }
         catch (err) {
-            utils_1.logger.warn(`[Custom Rules]: ⚠️ Could not analyze diff\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
+            index_js_1.logger.warn(`[Custom Rules]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_js_1.skip)('diff unavailable');
         }
     },
 };

package/dist/{core → cjs/core}/checks/git/diff-smell.d.ts

@@ -1,5 +1,5 @@
-import { Check } from '../../types';
-import { DiffPattern } from '../findings';
+import { Check } from '../../types.js';
+import { DiffPattern } from '../findings.js';
 /**
  * Smells that are only smells in live code.
  *

package/dist/{core → cjs/core}/checks/git/diff-smell.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.diffSmellCheck = exports.COMMENT_SMELLS = exports.CODE_SMELLS = void 0;
-const utils_1 = require("../../../utils");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const index_js_1 = require("../../../utils/index.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 /**
  * Smells that are only smells in live code.
  *
@@ -49,24 +49,24 @@ exports.diffSmellCheck = {
     async run(ctx) {
         try {
             const { ignorePaths } = ctx.config.diffSmell ?? {};
-            const found = (0, findings_1.emptyBuckets)();
-            const reviewed = await (0, findings_1.reviewLines)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], stdout => {
-                (0, findings_1.mergeSeverityBuckets)(found, (0, findings_1.scanDiffPatterns)(stdout, exports.CODE_SMELLS, { ignorePaths }));
-                (0, findings_1.mergeSeverityBuckets)(found, (0, findings_1.scanDiffPatterns)(stdout, exports.COMMENT_SMELLS, { comments: 'off', ignorePaths }));
+            const found = (0, findings_js_1.emptyBuckets)();
+            const reviewed = await (0, findings_js_1.reviewLines)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx'], stdout => {
+                (0, findings_js_1.mergeSeverityBuckets)(found, (0, findings_js_1.scanDiffPatterns)(stdout, exports.CODE_SMELLS, { ignorePaths }));
+                (0, findings_js_1.mergeSeverityBuckets)(found, (0, findings_js_1.scanDiffPatterns)(stdout, exports.COMMENT_SMELLS, { comments: 'off', ignorePaths }));
             });
             // An unreadable file list is not "no smells" (ticket 072). Checked before
             // the empty-bucket branch below, because that branch is what turned it into
             // a green row.
             if (!reviewed)
-                return (0, types_1.skip)('git unavailable');
+                return (0, types_js_1.skip)('git unavailable');
             // Every smell here is declared `warn`, so nothing reaches the error bucket.
-            if ((0, findings_1.bucketTotal)(found.warnings) === 0)
-                return (0, types_1.pass)();
-            return (0, findings_1.reportCountedFindings)(found.warnings, ctx, { prefix: 'Diff Smells' });
+            if ((0, findings_js_1.bucketTotal)(found.warnings) === 0)
+                return (0, types_js_1.pass)();
+            return (0, findings_js_1.reportCountedFindings)(found.warnings, ctx, { prefix: 'Diff Smells' });
         }
         catch (err) {
-            utils_1.logger.warn(`[Diff Smells]: ⚠️ Could not analyze diff\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
+            index_js_1.logger.warn(`[Diff Smells]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_js_1.skip)('diff unavailable');
         }
     },
 };