pr-checkmate 3.0.4 → 3.1.0

package/dist/{core → cjs/core}/checks/quality/spellcheck.js

@@ -11,11 +11,11 @@ exports.resolveImports = resolveImports;
 exports.dropMissingLanguages = dropMissingLanguages;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const config_1 = require("../../../config");
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
+const index_js_1 = require("../../../config/index.js");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_2 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
 function loadUserCspellConfig(cwd) {
     const configPath = node_path_1.default.join(cwd, 'pr-checkmate.json');
     if (!node_fs_1.default.existsSync(configPath))
@@ -24,7 +24,7 @@ function loadUserCspellConfig(cwd) {
         return JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8')).cspell || {};
     }
     catch (err) {
-        utils_1.logger.warn(`[Spellcheck]: ⚠️ Failed to read cspell config: ${err}`);
+        index_js_2.logger.warn(`[Spellcheck]: ⚠️ Failed to read cspell config: ${err}`);
         return {};
     }
 }
@@ -213,7 +213,7 @@ function resolveFrom(cwd) {
     };
 }
 function createTempCspellConfig(cwd) {
-    const packageConfigPath = (0, config_1.getPackageConfigPath)('cspell.json');
+    const packageConfigPath = (0, index_js_1.getPackageConfigPath)('cspell.json');
     const packageConfigDir = node_path_1.default.dirname(packageConfigPath);
     const defaultConfig = JSON.parse(node_fs_1.default.readFileSync(packageConfigPath, 'utf-8'));
     const userConfig = loadUserCspellConfig(cwd);
@@ -222,14 +222,14 @@ function createTempCspellConfig(cwd) {
     const { resolved, missing } = resolveImports(merged.import ?? [], packageConfigDir, resolve);
     const available = availableDictionaries(resolve);
     for (const { pkg } of missing) {
-        utils_1.logger.info(`[Spellcheck]: dictionary ${pkg} is not installed and was skipped. Add it with \`npm i -D ${pkg}\`.`);
+        index_js_2.logger.info(`[Spellcheck]: dictionary ${pkg} is not installed and was skipped. Add it with \`npm i -D ${pkg}\`.`);
     }
     if (available.absent.length > 0) {
         // `info`, not `debug`. A client who installed a dictionary and saw no change
         // had nothing to read: the one line that would have explained it was behind a
         // flag. Which dictionaries are in play decides which findings appear, so it
         // belongs in the ordinary log (ticket 081).
-        utils_1.logger.info(`[Spellcheck]: optional dictionaries not installed: ${available.absent.join(', ')}. ` +
+        index_js_2.logger.info(`[Spellcheck]: optional dictionaries not installed: ${available.absent.join(', ')}. ` +
             `Install any of them to spellcheck that language (\`npm i -D ${available.absent[0]}\`).`);
     }
     // A language the client asked for whose dictionary is absent is dropped rather
@@ -259,9 +259,9 @@ exports.spellcheckCheck = {
         return ctx.config.cspell?.enabled !== false && ctx.config.spellcheck?.enabled !== false;
     },
     async run(ctx) {
-        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx', '*.md', '*.mdx', '*.json'], (0, config_1.getSourcePaths)(ctx.cwd));
+        const targets = await (0, targets_js_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx', '*.md', '*.mdx', '*.json'], (0, index_js_1.getSourcePaths)(ctx.cwd));
         if (targets === null)
-            return (0, types_1.skip)('git unavailable');
+            return (0, types_js_1.skip)('git unavailable');
         // Committed build output and test reports are dropped here, in JS, against
         // repo-RELATIVE paths — a client cannot fix a typo in a generated file, so
         // reporting one is noise that buries the real findings. Neither cspell
@@ -272,12 +272,12 @@ exports.spellcheckCheck = {
         // rule for every repo. `ignoreDirs` already covers plain directory names via
         // `resolveTargetFiles`; this adds the composite globs it cannot express
         // (`**/cypress/videos/**`, `**/jest-html-reporters-*/**`).
-        const files = targets.filter(f => !(0, utils_1.matchesAnyGlob)(f, config_1.IGNORE_PATTERNS));
+        const files = targets.filter(f => !(0, index_js_2.matchesAnyGlob)(f, index_js_1.IGNORE_PATTERNS));
         if (files.length === 0)
-            return (0, types_1.pass)('no files to spellcheck');
-        const hasLocal = (0, config_1.hasLocalConfig)(['cspell.json', '.cspell.json', 'cspell.config.json'], ctx.cwd);
+            return (0, types_js_1.pass)('no files to spellcheck');
+        const hasLocal = (0, index_js_1.hasLocalConfig)(['cspell.json', '.cspell.json', 'cspell.config.json'], ctx.cwd);
         let tempConfigPath = null;
-        const cspellBin = (0, utils_1.resolvePackageBin)('cspell', 'bin.mjs');
+        const cspellBin = (0, index_js_2.resolvePackageBin)('cspell', 'bin.mjs');
         // `--no-must-find-files`: cspell exits 1 when it checked nothing, which the
         // exit-code mapping below would report as "spelling issues found" — a warning
         // about problems that do not exist. Every file being excluded is a pass, not a
@@ -292,16 +292,16 @@ exports.spellcheckCheck = {
             args = [...baseArgs, '--config', tempConfigPath];
         }
         try {
-            const result = await (0, execa_1.execa)(process.execPath, [cspellBin, ...args], {
+            const result = await (0, execa_js_1.execa)(process.execPath, [cspellBin, ...args], {
                 cwd: ctx.cwd,
                 reject: false,
                 stdio: 'inherit',
             });
-            return result.exitCode === 0 ? (0, types_1.pass)() : (0, types_1.warn)('spelling issues found');
+            return result.exitCode === 0 ? (0, types_js_1.pass)() : (0, types_js_1.warn)('spelling issues found');
         }
         finally {
             if (tempConfigPath)
-                (0, utils_1.cleanupTempFile)(tempConfigPath);
+                (0, index_js_2.cleanupTempFile)(tempConfigPath);
         }
     },
 };

package/dist/{core → cjs/core}/checks/quality/symlinks.d.ts

@@ -1,4 +1,4 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 /** True when `fullPath` is a symlink whose target does not exist. */
 export declare function isBrokenSymlink(fullPath: string): boolean;
 /**

package/dist/{core → cjs/core}/checks/quality/symlinks.js

@@ -7,10 +7,10 @@ exports.symlinksCheck = void 0;
 exports.isBrokenSymlink = isBrokenSymlink;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../../utils");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const index_js_1 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 /** True when `fullPath` is a symlink whose target does not exist. */
 function isBrokenSymlink(fullPath) {
     let stat;
@@ -41,7 +41,7 @@ exports.symlinksCheck = {
         return ctx.config.symlinks?.enabled !== false;
     },
     async run(ctx) {
-        const files = await (0, targets_1.resolveTargets)(ctx, ['*'], {
+        const files = await (0, targets_js_1.resolveTargets)(ctx, ['*'], {
             wholeTree: true,
             onEmpty: { skip: 'no tracked files' },
         });
@@ -50,14 +50,14 @@ exports.symlinksCheck = {
         const ignore = ctx.config.symlinks?.ignore ?? [];
         const broken = [];
         for (const file of files) {
-            if (ignore.length > 0 && (0, utils_1.matchesAnyGlob)(file, ignore))
+            if (ignore.length > 0 && (0, index_js_1.matchesAnyGlob)(file, ignore))
                 continue;
             if (isBrokenSymlink(node_path_1.default.join(ctx.cwd, file)))
                 broken.push(file);
         }
         if (broken.length === 0)
-            return (0, types_1.pass)();
-        const sev = (0, findings_1.severityEmitter)(ctx.config.symlinks?.severity, 'warn');
+            return (0, types_js_1.pass)();
+        const sev = (0, findings_js_1.severityEmitter)(ctx.config.symlinks?.severity, 'warn');
         broken.forEach(f => sev.log(`[Broken Symlinks]: ${sev.icon} ${f} — target does not exist`));
         return sev.emit(`${broken.length} broken symlink(s)`);
     },

package/dist/{core → cjs/core}/checks/quality/yaml-lint.d.ts

@@ -1,4 +1,4 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 /**
  * True when a parser problem describes something actually wrong with the file —
  * a syntax error, a duplicate key, a tab used for indentation.

package/dist/{core → cjs/core}/checks/quality/yaml-lint.js

@@ -8,10 +8,10 @@ exports.isFileDefect = isFileDefect;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const yaml_1 = require("yaml");
-const utils_1 = require("../../../utils");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const index_js_1 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 /** First line of a `yaml` error/warning message, stripped of its source excerpt. */
 function shortMessage(message) {
     return message.split('\n')[0].trim();
@@ -58,17 +58,17 @@ exports.yamlLintCheck = {
     async run(ctx) {
         // Keep the CI/workflow dirs that are globally ignored: they hold the very
         // YAML (GitHub Actions, GitLab CI, CircleCI) a YAML linter most needs to see.
-        const allTargets = await (0, targets_1.resolveTargetFiles)(ctx, ['*.yml', '*.yaml'], {
+        const allTargets = await (0, targets_js_1.resolveTargetFiles)(ctx, ['*.yml', '*.yaml'], {
             keepDirs: ['.github', '.gitlab', '.circleci'],
         });
         if (allTargets === null)
-            return (0, types_1.skip)('git unavailable');
+            return (0, types_js_1.skip)('git unavailable');
         if (allTargets.length === 0)
-            return (0, types_1.skip)('no YAML files');
+            return (0, types_js_1.skip)('no YAML files');
         const ignore = ctx.config.yamlLint?.ignore ?? [];
-        const targets = ignore.length > 0 ? allTargets.filter(f => !(0, utils_1.matchesAnyGlob)(f, ignore)) : allTargets;
+        const targets = ignore.length > 0 ? allTargets.filter(f => !(0, index_js_1.matchesAnyGlob)(f, ignore)) : allTargets;
         if (targets.length === 0)
-            return (0, types_1.skip)('all YAML files ignored');
+            return (0, types_js_1.skip)('all YAML files ignored');
         const issues = [];
         for (const file of targets) {
             let source;
@@ -76,7 +76,7 @@ exports.yamlLintCheck = {
                 source = node_fs_1.default.readFileSync(node_path_1.default.join(ctx.cwd, file), 'utf-8');
             }
             catch (err) {
-                utils_1.logger.warn(`[YAML Lint]: ⚠️ Could not read ${file}: ${err}`);
+                index_js_1.logger.warn(`[YAML Lint]: ⚠️ Could not read ${file}: ${err}`);
                 continue;
             }
             // parseAllDocuments never throws — it collects problems on each document,
@@ -100,7 +100,7 @@ exports.yamlLintCheck = {
             }
         }
         if (issues.length === 0)
-            return (0, types_1.pass)();
+            return (0, types_js_1.pass)();
         // A file that does not parse blocks; a file that parses and merely worries
         // the parser does not. Treating both as blocking is what made this check
         // feel like an obstacle rather than a gate — and a check people switch off
@@ -109,7 +109,7 @@ exports.yamlLintCheck = {
         const broken = issues.filter(i => i.blocking);
         const questionable = issues.filter(i => !i.blocking);
         const describe = (i) => `${i.file}${i.line ? `:${i.line}${i.col ? `:${i.col}` : ''}` : ''} — ${i.message}`;
-        const sev = (0, findings_1.severityEmitter)(configured, broken.length > 0 ? 'error' : 'warn');
+        const sev = (0, findings_js_1.severityEmitter)(configured, broken.length > 0 ? 'error' : 'warn');
         [...broken, ...questionable]
             .slice(0, 10)
             .forEach(i => sev.log(`[YAML Lint]: ${sev.icon} ${describe(i)}`));

package/dist/{core → cjs/core}/checks/security/diff-security.d.ts

@@ -1,2 +1,2 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 export declare const diffSecurityCheck: Check;

package/dist/{core → cjs/core}/checks/security/diff-security.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.diffSecurityCheck = void 0;
-const config_1 = require("../../../config");
-const utils_1 = require("../../../utils");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const index_js_1 = require("../../../config/index.js");
+const index_js_2 = require("../../../utils/index.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 const MD5_LABEL = 'MD5 (weak hash — use sha256 or stronger)';
 const SHA1_LABEL = 'SHA-1 (weak hash — use sha256 or stronger)';
 const SECURITY_PATTERNS = [
@@ -262,7 +262,7 @@ function compileExtraPatterns(ctx) {
             ];
         }
         catch (err) {
-            utils_1.logger.warn(`[Diff Security]: ⚠️ ignoring extraPattern "${rule.label}" — invalid regex: ${err}`);
+            index_js_2.logger.warn(`[Diff Security]: ⚠️ ignoring extraPattern "${rule.label}" — invalid regex: ${err}`);
             return [];
         }
     });
@@ -290,21 +290,21 @@ exports.diffSecurityCheck = {
     async run(ctx) {
         try {
             const cfg = ctx.config.diffSecurity ?? {};
-            const found = (0, findings_1.emptyBuckets)();
+            const found = (0, findings_js_1.emptyBuckets)();
             const scanOpts = {
                 comments: cfg.commentHandling ?? 'language',
                 // Setting `ignorePaths` REPLACES the test-path defaults rather than adding
                 // to them, matching `duplicate.ignore` and `deadCode.ignoreFiles`. A client
                 // who wants their tests scanned says so by listing something else here.
-                ignorePaths: cfg.ignorePaths ?? config_1.DIFF_SECURITY_IGNORE_DEFAULTS,
+                ignorePaths: cfg.ignorePaths ?? index_js_1.DIFF_SECURITY_IGNORE_DEFAULTS,
                 // This check owns the cross-line heuristic, so it is the one that turns it
                 // on. `0` from the client switches it off.
-                dataflowWindow: cfg.dataflowWindow ?? findings_1.DEFAULT_DATAFLOW_WINDOW,
+                dataflowWindow: cfg.dataflowWindow ?? findings_js_1.DEFAULT_DATAFLOW_WINDOW,
             };
             const extra = compileExtraPatterns(ctx);
             const disabled = cfg.disablePatterns ?? [];
             const scanInto = (stdout, patterns) => {
-                (0, findings_1.mergeSeverityBuckets)(found, (0, findings_1.scanDiffPatterns)(stdout, activePatterns(patterns, disabled), scanOpts));
+                (0, findings_js_1.mergeSeverityBuckets)(found, (0, findings_js_1.scanDiffPatterns)(stdout, activePatterns(patterns, disabled), scanOpts));
             };
             /**
              * Feed one language's sources through the patterns, from the diff when
@@ -317,7 +317,7 @@ exports.diffSecurityCheck = {
              * distinction lived in two places, one of them a blocking security check
              * (ticket 079).
              */
-            const review = (globs, patterns) => (0, findings_1.reviewLines)(ctx, globs, stdout => scanInto(stdout, patterns));
+            const review = (globs, patterns) => (0, findings_js_1.reviewLines)(ctx, globs, stdout => scanInto(stdout, patterns));
             // JS/TS patterns always run; language-specific sets scan their own globs
             // only when that language is present, so a Python repo gets Python rules.
             // Client `extraPatterns` run against every scanned language, since a
@@ -340,18 +340,18 @@ exports.diffSecurityCheck = {
                 // here: three of five language sets scanned, reported as a pass, reads
                 // as a clean repository (ticket 072).
                 if (!(await review(globs, patterns)))
-                    return (0, types_1.skip)('git unavailable');
+                    return (0, types_js_1.skip)('git unavailable');
             }
-            return (0, findings_1.reportSeverityBuckets)(found.errors, found.warnings, {
+            return (0, findings_js_1.reportSeverityBuckets)(found.errors, found.warnings, {
                 prefix: 'Diff Security',
                 errorSummary: n => `${n} issue(s)`,
                 warningSummary: n => `${n} warning(s)`,
-                ...(0, findings_1.clientFindingOptions)(ctx, cfg),
+                ...(0, findings_js_1.clientFindingOptions)(ctx, cfg),
             });
         }
         catch (err) {
-            utils_1.logger.warn(`[Diff Security]: ⚠️ Could not analyze diff\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
+            index_js_2.logger.warn(`[Diff Security]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_js_1.skip)('diff unavailable');
         }
     },
 };

package/dist/{core → cjs/core}/checks/security/dockerfile-security.d.ts

@@ -1,2 +1,2 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 export declare const dockerfileSecurityCheck: Check;

package/dist/{core → cjs/core}/checks/security/dockerfile-security.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.dockerfileSecurityCheck = void 0;
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 const DOCKERFILE_GLOBS = ['**/Dockerfile', '**/Dockerfile.*', '**/*.Dockerfile'];
 /** Common Dockerfile security smells, matched on added diff lines. */
 const DOCKER_PATTERNS = [
@@ -60,42 +60,42 @@ exports.dockerfileSecurityCheck = {
         return ctx.config.dockerfileSecurity?.enabled !== false;
     },
     async run(ctx) {
-        const files = await (0, targets_1.resolveTargetFiles)(ctx, ['*']);
+        const files = await (0, targets_js_1.resolveTargetFiles)(ctx, ['*']);
         if (files === null)
-            return (0, types_1.skip)('git unavailable');
-        const dockerfiles = files.filter(f => (0, utils_1.matchesAnyGlob)(f, DOCKERFILE_GLOBS));
+            return (0, types_js_1.skip)('git unavailable');
+        const dockerfiles = files.filter(f => (0, index_js_1.matchesAnyGlob)(f, DOCKERFILE_GLOBS));
         if (dockerfiles.length === 0)
-            return (0, types_1.pass)();
+            return (0, types_js_1.pass)();
         try {
             const cfg = ctx.config.dockerfileSecurity ?? {};
             let stdout = '';
             if (ctx.baseSha) {
-                stdout = (await (0, execa_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...dockerfiles], { cwd: ctx.cwd })).stdout;
+                stdout = (await (0, execa_js_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...dockerfiles], { cwd: ctx.cwd })).stdout;
             }
             else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
-                await (0, findings_1.scanTrackedFiles)(ctx, dockerfiles, asDiff => {
+                await (0, findings_js_1.scanTrackedFiles)(ctx, dockerfiles, asDiff => {
                     stdout += `${asDiff}\n`;
                 });
             }
             // This check runs `git diff` itself rather than going through
             // `diffAddedLines`, so the `pr-checkmate-ignore` opt-out is applied here.
-            const { errors, warnings } = (0, findings_1.scanDiffPatterns)(stdout, DOCKER_PATTERNS, {
+            const { errors, warnings } = (0, findings_js_1.scanDiffPatterns)(stdout, DOCKER_PATTERNS, {
                 skipIgnored: true,
                 // Dockerfiles have no extension to key off, and `#` is their comment
                 // marker — the `hash` reading, not the language-detected one.
                 comments: 'legacy',
                 ignorePaths: cfg.ignorePaths,
             });
-            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
+            return (0, findings_js_1.reportSeverityBuckets)(errors, warnings, {
                 prefix: 'Dockerfile Security',
                 errorSummary: n => `${n} issue(s)`,
                 warningSummary: n => `${n} warning(s)`,
-                ...(0, findings_1.clientFindingOptions)(ctx, cfg),
+                ...(0, findings_js_1.clientFindingOptions)(ctx, cfg),
             });
         }
         catch (err) {
-            utils_1.logger.warn(`[Dockerfile Security]: ⚠️ Could not analyze diff\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
+            index_js_1.logger.warn(`[Dockerfile Security]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_js_1.skip)('diff unavailable');
         }
     },
 };

package/dist/{core → cjs/core}/checks/security/migration-safety.d.ts

@@ -1,2 +1,2 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 export declare const migrationSafetyCheck: Check;

package/dist/{core → cjs/core}/checks/security/migration-safety.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.migrationSafetyCheck = void 0;
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 /**
  * Paths treated as database migrations. A client overrides via
  * `migrationSafety.paths` (REPLACES this list).
@@ -69,7 +69,7 @@ function withoutComment(line) {
     // after the `+`, where a boundary rule looking for whitespace or line-start
     // does not see it — which is exactly the shape a commented-out statement takes.
     const marker = line.startsWith('+') ? '+' : '';
-    const body = (0, findings_1.stripInlineComment)(line.slice(marker.length), 'hash').replace(/(^|\s)--.*$/, '$1');
+    const body = (0, findings_js_1.stripInlineComment)(line.slice(marker.length), 'hash').replace(/(^|\s)--.*$/, '$1');
     return marker + body;
 }
 /** Bucket dangerous added lines by risk label, honouring the opt-out directive. */
@@ -102,28 +102,28 @@ exports.migrationSafetyCheck = {
     async run(ctx) {
         // Not sourcePath-scoped: migrations commonly live outside `src` (db/, alembic/).
         // ignoreDirs still applies via resolveTargetFiles.
-        const files = await (0, targets_1.resolveTargetFiles)(ctx, ['*']);
+        const files = await (0, targets_js_1.resolveTargetFiles)(ctx, ['*']);
         if (files === null)
-            return (0, types_1.skip)('git unavailable');
+            return (0, types_js_1.skip)('git unavailable');
         const globs = ctx.config.migrationSafety?.paths ?? DEFAULT_MIGRATION_GLOBS;
-        const migrationFiles = files.filter(f => (0, utils_1.matchesAnyGlob)(f, globs));
+        const migrationFiles = files.filter(f => (0, index_js_1.matchesAnyGlob)(f, globs));
         if (migrationFiles.length === 0)
-            return (0, types_1.pass)();
+            return (0, types_js_1.pass)();
         try {
             let stdout = '';
             if (ctx.baseSha) {
-                stdout = (await (0, execa_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...migrationFiles], { cwd: ctx.cwd })).stdout;
+                stdout = (await (0, execa_js_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...migrationFiles], { cwd: ctx.cwd })).stdout;
             }
             else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
-                await (0, findings_1.scanTrackedFiles)(ctx, migrationFiles, asDiff => {
+                await (0, findings_js_1.scanTrackedFiles)(ctx, migrationFiles, asDiff => {
                     stdout += `${asDiff}\n`;
                 });
             }
             const findings = {};
             scan(stdout, findings);
-            if ((0, findings_1.bucketTotal)(findings) === 0)
-                return (0, types_1.pass)();
-            return (0, findings_1.reportCountedFindings)(findings, ctx, {
+            if ((0, findings_js_1.bucketTotal)(findings) === 0)
+                return (0, types_js_1.pass)();
+            return (0, findings_js_1.reportCountedFindings)(findings, ctx, {
                 prefix: 'Migration Safety',
                 severity: ctx.config.migrationSafety?.severity,
                 sampleLimit: ctx.config.log?.sampleLimit ?? 2,
@@ -133,8 +133,8 @@ exports.migrationSafetyCheck = {
             });
         }
         catch (err) {
-            utils_1.logger.warn(`[Migration Safety]: ⚠️ Could not analyze diff\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
+            index_js_1.logger.warn(`[Migration Safety]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_js_1.skip)('diff unavailable');
         }
     },
 };

package/dist/{core → cjs/core}/checks/security/security.d.ts

@@ -1,4 +1,4 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 /**
  * A HOME the scanner can actually write to.
  *

package/dist/{core → cjs/core}/checks/security/security.js

@@ -10,10 +10,10 @@ exports.looksLikeCrash = looksLikeCrash;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
-const config_1 = require("../../../config");
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const types_1 = require("../../types");
+const index_js_1 = require("../../../config/index.js");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_2 = require("../../../utils/index.js");
+const types_js_1 = require("../../types.js");
 /**
  * A HOME the scanner can actually write to.
  *
@@ -79,7 +79,7 @@ function writableHome() {
     const fallback = node_os_1.default.tmpdir();
     try {
         node_fs_1.default.accessSync(fallback, node_fs_1.default.constants.W_OK);
-        utils_1.logger.info(`[Security Scan]: HOME (${home}) is not writable — caching the scanner in ${fallback}`);
+        index_js_2.logger.info(`[Security Scan]: HOME (${home}) is not writable — caching the scanner in ${fallback}`);
         return fallback;
     }
     catch {
@@ -120,13 +120,13 @@ exports.securityCheck = {
         // tool (knip, license-checker) already skips here; this one did not.
         let gitleaksBin;
         try {
-            gitleaksBin = (0, utils_1.resolvePackageBin)('gitleaks-secret-scanner-fixed', 'dist/bin/cli.js');
+            gitleaksBin = (0, index_js_2.resolvePackageBin)('gitleaks-secret-scanner-fixed', 'dist/bin/cli.js');
         }
         catch {
-            utils_1.logger.warn('[Security Scan]: ⚠️ bundled gitleaks scanner could not be resolved — skipping');
-            return (0, types_1.skip)('gitleaks unavailable');
+            index_js_2.logger.warn('[Security Scan]: ⚠️ bundled gitleaks scanner could not be resolved — skipping');
+            return (0, types_js_1.skip)('gitleaks unavailable');
         }
-        const hasClientConfig = (0, config_1.hasLocalConfig)(['.gitleaks.toml', 'gitleaks.toml', '.gitleaks/config.toml'], ctx.cwd);
+        const hasClientConfig = (0, index_js_1.hasLocalConfig)(['.gitleaks.toml', 'gitleaks.toml', '.gitleaks/config.toml'], ctx.cwd);
         // Pin the gitleaks binary version so the scanner never reaches out to the
         // GitHub API for the "latest" version — that network call adds latency and
         // times out in locked-down/offline CI (the scanner already falls back to
@@ -145,15 +145,15 @@ exports.securityCheck = {
         // after printing `fatal: not a git repository` and "An unexpected error
         // occurred" — alarming output about the tool, for a directory it was never
         // able to review. Every other check skips when git is unusable; so does this.
-        if (!isDelta && !(await (0, utils_1.resolveGitRef)(ctx.cwd, 'HEAD'))) {
-            return (0, types_1.skip)('git history unavailable');
+        if (!isDelta && !(await (0, index_js_2.resolveGitRef)(ctx.cwd, 'HEAD'))) {
+            return (0, types_js_1.skip)('git history unavailable');
         }
         const args = isDelta
             ? ['--diff-mode', 'ci']
             : ['--diff-mode', 'history', ...(depth ? ['--depth', String(depth)] : [])];
         args.push('--gitleaks-version', gitleaksVersion);
         if (!hasClientConfig) {
-            args.push('--config', (0, config_1.getPackageConfigPath)('gitleaks.toml'));
+            args.push('--config', (0, index_js_1.getPackageConfigPath)('gitleaks.toml'));
         }
         // A machine-readable copy of the findings, purely so the outcome can carry a
         // number. Written to a temp directory, never into the repository under review:
@@ -163,10 +163,10 @@ exports.securityCheck = {
         const reportDir = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'pr-checkmate-gitleaks-'));
         const reportPath = node_path_1.default.join(reportDir, 'findings.json');
         args.push('--report-format', 'json', '--report-path', reportPath);
-        utils_1.logger.info(`[Security Scan]: scanning ${isDelta ? 'the diff range' : `full history${depth ? ` (last ${depth} commits)` : ''}`}`);
+        index_js_2.logger.info(`[Security Scan]: scanning ${isDelta ? 'the diff range' : `full history${depth ? ` (last ${depth} commits)` : ''}`}`);
         const home = writableHome();
         if (!home)
-            return (0, types_1.skip)('no writable directory for the scanner cache');
+            return (0, types_js_1.skip)('no writable directory for the scanner cache');
         const env = {
             ...process.env,
             HOME: home,
@@ -176,7 +176,7 @@ exports.securityCheck = {
         // stdout stays inherited so the scanner's own report streams to the log as it
         // always has; stderr is captured because it is the only thing that separates
         // a crash from a finding — see `crashed`.
-        const result = await (0, execa_1.execa)(process.execPath, [gitleaksBin, ...args], {
+        const result = await (0, execa_js_1.execa)(process.execPath, [gitleaksBin, ...args], {
             cwd: ctx.cwd,
             env,
             stdio: ['ignore', 'inherit', 'pipe'],
@@ -184,11 +184,11 @@ exports.securityCheck = {
         });
         const stderr = String(result.stderr ?? '');
         if (stderr.trim())
-            utils_1.logger.warn(stderr.trimEnd());
+            index_js_2.logger.warn(stderr.trimEnd());
         const found = countFindings(reportPath);
         node_fs_1.default.rmSync(reportDir, { recursive: true, force: true });
         if (result.exitCode === 0)
-            return (0, types_1.pass)();
+            return (0, types_js_1.pass)();
         // gitleaks exits 1 specifically when it finds secrets — but so does Node when
         // the wrapper around it throws. Only the second one leaves a stack trace.
         if (result.exitCode === 1 && !looksLikeCrash(stderr)) {
@@ -198,13 +198,13 @@ exports.securityCheck = {
             // nothing else, so a blocking check told the client to open something that
             // does not exist (ticket 085).
             const summary = secretsSummary(found);
-            utils_1.logger.warn(`⚠️ gitleaks found ${summary} — see the findings above`);
-            return (0, types_1.fail)(summary);
+            index_js_2.logger.warn(`⚠️ gitleaks found ${summary} — see the findings above`);
+            return (0, types_js_1.fail)(summary);
         }
         const detail = looksLikeCrash(stderr)
             ? 'scanner failed to start — nothing was scanned'
             : `scanner error (exit ${result.exitCode})`;
-        utils_1.logger.warn(`[Security Scan]: ⚠️ ${detail}`);
-        return (0, types_1.warn)(detail);
+        index_js_2.logger.warn(`[Security Scan]: ⚠️ ${detail}`);
+        return (0, types_js_1.warn)(detail);
     },
 };

package/dist/{core → cjs/core}/checks/security/sensitive-file-guard.d.ts

@@ -1,2 +1,2 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 export declare const sensitiveFileGuardCheck: Check;