pr-checkmate 3.0.4 → 3.1.0

package/dist/{core → cjs/core}/checks/security/sensitive-file-guard.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sensitiveFileGuardCheck = void 0;
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 /**
  * The committed template, in the names every ecosystem uses for it.
  *
@@ -111,15 +111,15 @@ exports.sensitiveFileGuardCheck = {
                 ? ['diff', '--name-only', '--diff-filter=ACMRD', ctx.baseSha, ctx.headSha ?? 'HEAD']
                 : ['ls-files'];
             if (!ctx.baseSha && ctx.config.run?.fullScanBehaviour === 'skip')
-                return (0, types_1.pass)();
+                return (0, types_js_1.pass)();
             // `reject: false` so a directory that is not a repository is an ordinary
             // outcome rather than a thrown error whose message carries git's raw
             // `fatal: not a git repository` into the log. The check still skips — but
             // a skip with a reason reads as a decision, while a bare `fatal:` reads as
             // a crash, and someone has to spend time proving it was not one.
-            const result = await (0, execa_1.execa)('git', args, { cwd: ctx.cwd, reject: false });
+            const result = await (0, execa_js_1.execa)('git', args, { cwd: ctx.cwd, reject: false });
             if (result.exitCode !== 0)
-                return (0, types_1.skip)('git unavailable');
+                return (0, types_js_1.skip)('git unavailable');
             const cfg = ctx.config.sensitiveFileGuard ?? {};
             // Path exclusions are applied before categorising, so one false positive —
             // a `.pem` test fixture, a committed `.env.example` — is excused by name.
@@ -137,11 +137,11 @@ exports.sensitiveFileGuardCheck = {
             // exclusion that reaches every check. It did not reach this one, which
             // meant a `.pem` test fixture failed the build and the key the docs told
             // people to reach for did nothing (ticket 080).
-            const changedFiles = (0, targets_1.excludeClientPaths)(result.stdout.split('\n').filter(Boolean), ctx.cwd).filter(file => !(0, utils_1.matchesAnyGlob)(file, cfg.ignorePaths ?? []));
+            const changedFiles = (0, targets_js_1.excludeClientPaths)(result.stdout.split('\n').filter(Boolean), ctx.cwd).filter(file => !(0, index_js_1.matchesAnyGlob)(file, cfg.ignorePaths ?? []));
             if (changedFiles.length === 0)
-                return (0, types_1.pass)();
+                return (0, types_js_1.pass)();
             const { errors, warnings } = categorizeFiles(changedFiles);
-            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
+            return (0, findings_js_1.reportSeverityBuckets)(errors, warnings, {
                 prefix: 'Sensitive Files',
                 // "changed" is only true of a diff; a full scan is answering a different
                 // question — what the repository contains — and saying otherwise would
@@ -149,15 +149,15 @@ exports.sensitiveFileGuardCheck = {
                 errorSummary: n => `${n} sensitive file(s) ${ctx.baseSha ? 'changed' : 'in the repo'}`,
                 warningSummary: n => `${n} notable file(s) ${ctx.baseSha ? 'changed' : 'in the repo'}`,
                 showCount: false,
-                ...(0, findings_1.clientFindingOptions)(ctx, cfg),
+                ...(0, findings_js_1.clientFindingOptions)(ctx, cfg),
                 // Every sensitive path is listed rather than sampled: knowing that eight
                 // files are in play but only which three is not an answer anyone can act on.
                 sampleLimit: undefined,
             });
         }
         catch (err) {
-            utils_1.logger.warn(`[Sensitive Files]: ⚠️ Could not check file changes\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
+            index_js_1.logger.warn(`[Sensitive Files]: ⚠️ Could not check file changes\n${err}`);
+            return (0, types_js_1.skip)('diff unavailable');
         }
     },
 };

package/dist/{core → cjs/core}/checks/security/workflow-security.d.ts

@@ -1,5 +1,5 @@
-import { Check } from '../../types';
-import { DiffPattern } from '../findings';
+import { Check } from '../../types.js';
+import { DiffPattern } from '../findings.js';
 /**
  * GitHub Actions workflow risks, matched on added diff lines of workflow files.
  * These are the high-frequency supply-chain / injection footguns.

package/dist/{core → cjs/core}/checks/security/workflow-security.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.workflowSecurityCheck = exports.WORKFLOW_PATTERNS = void 0;
-const utils_1 = require("../../../utils");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const index_js_1 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 /**
  * A YAML key binding — `HEAD_REF: ${{ … }}`, `ref: ${{ … }}` — rather than an
  * interpolation inside a script body.
@@ -69,35 +69,35 @@ exports.workflowSecurityCheck = {
         try {
             const globs = ['.github/workflows/*.yml', '.github/workflows/*.yaml'];
             const cfg = ctx.config.workflowSecurity ?? {};
-            const found = (0, findings_1.emptyBuckets)();
+            const found = (0, findings_js_1.emptyBuckets)();
             const scanInto = (stdout) => {
                 // `diffAddedLines` already dropped `pr-checkmate-ignore` lines, and
                 // `scanTrackedFiles` does the same for the whole-file path.
-                (0, findings_1.mergeSeverityBuckets)(found, (0, findings_1.scanDiffPatterns)(stdout, exports.WORKFLOW_PATTERNS, { ignorePaths: cfg.ignorePaths }));
+                (0, findings_js_1.mergeSeverityBuckets)(found, (0, findings_js_1.scanDiffPatterns)(stdout, exports.WORKFLOW_PATTERNS, { ignorePaths: cfg.ignorePaths }));
             };
             if (ctx.baseSha) {
-                scanInto(await (0, findings_1.diffAddedLines)(ctx, globs));
+                scanInto(await (0, findings_js_1.diffAddedLines)(ctx, globs));
             }
             else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
                 // `.github` is globally ignored and is the only place these files live,
                 // so this caller has to un-ignore it or scan nothing.
-                const files = await (0, targets_1.listTrackedFiles)(ctx, globs, ['.'], {
+                const files = await (0, targets_js_1.listTrackedFiles)(ctx, globs, ['.'], {
                     keepDirs: ['.github', '.gitlab', '.circleci'],
                 });
                 if (files === null)
-                    return (0, types_1.skip)('git unavailable');
-                await (0, findings_1.scanTrackedFiles)(ctx, files, scanInto);
+                    return (0, types_js_1.skip)('git unavailable');
+                await (0, findings_js_1.scanTrackedFiles)(ctx, files, scanInto);
             }
-            return (0, findings_1.reportSeverityBuckets)(found.errors, found.warnings, {
+            return (0, findings_js_1.reportSeverityBuckets)(found.errors, found.warnings, {
                 prefix: 'Workflow Security',
                 errorSummary: n => `${n} issue(s)`,
                 warningSummary: n => `${n} warning(s)`,
-                ...(0, findings_1.clientFindingOptions)(ctx, cfg),
+                ...(0, findings_js_1.clientFindingOptions)(ctx, cfg),
             });
         }
         catch (err) {
-            utils_1.logger.warn(`[Workflow Security]: ⚠️ Could not analyze diff\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
+            index_js_1.logger.warn(`[Workflow Security]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_js_1.skip)('diff unavailable');
         }
     },
 };

package/dist/{core → cjs/core}/checks/tool-install.d.ts

@@ -1,4 +1,4 @@
-import { CheckOutcome } from '../types';
+import { CheckOutcome } from '../types.js';
 /**
  * Where to get the external runners we deliberately do not ship.
  *

package/dist/{core → cjs/core}/checks/tool-install.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.notInstalled = notInstalled;
-const types_1 = require("../types");
+const types_js_1 = require("../types.js");
 /**
  * Where to get the external runners we deliberately do not ship.
  *
@@ -65,5 +65,5 @@ const INSTALL_HINTS = {
 function notInstalled(tool, label) {
     const { command, url } = INSTALL_HINTS[tool];
     const subject = label ? `${label} not installed` : 'not installed';
-    return (0, types_1.skip)(command ? `${subject} — ${command} · ${url}` : `${subject} — ${url}`);
+    return (0, types_js_1.skip)(command ? `${subject} — ${command} · ${url}` : `${subject} — ${url}`);
 }

package/dist/{core → cjs/core}/context.d.ts

@@ -1,4 +1,4 @@
-import type { CheckContext, RunOptions } from './types';
+import type { CheckContext, RunOptions } from './types.js';
 /**
  * What a run should look at, before any git call is made. Separated from
  * {@link resolveDiffRange} so the precedence rules are a pure function of the

package/dist/{core → cjs/core}/context.js

@@ -6,10 +6,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.planDiffRange = planDiffRange;
 exports.buildContext = buildContext;
 const node_fs_1 = __importDefault(require("node:fs"));
-const loader_1 = require("../config/loader");
-const utils_1 = require("../utils");
-const detect_language_1 = require("../utils/detect-language");
-const execa_1 = require("../utils/execa");
+const loader_js_1 = require("../config/loader.js");
+const detect_language_js_1 = require("../utils/detect-language.js");
+const execa_js_1 = require("../utils/execa.js");
+const index_js_1 = require("../utils/index.js");
 /**
  * Decide what to look at. Order matters and is the contract:
  *
@@ -52,7 +52,7 @@ function planDiffRange(opts, env = process.env) {
             reason: 'PR build',
         };
     }
-    if ((0, utils_1.isCiEnvironment)(env))
+    if ((0, index_js_1.isCiEnvironment)(env))
         return { kind: 'ref', ref: 'HEAD^', reason: 'CI build, no PR context' };
     return { kind: 'branch' };
 }
@@ -83,8 +83,8 @@ async function resolveDiffRange(cwd, opts) {
     // diffs baseSha..headSha sees exactly the staged changes — no per-check code.
     if (plan.kind === 'staged') {
         try {
-            const head = (await (0, execa_1.execa)('git', ['rev-parse', 'HEAD'], { cwd })).stdout.trim();
-            const tree = (await (0, execa_1.execa)('git', ['write-tree'], { cwd })).stdout.trim();
+            const head = (await (0, execa_js_1.execa)('git', ['rev-parse', 'HEAD'], { cwd })).stdout.trim();
+            const tree = (await (0, execa_js_1.execa)('git', ['write-tree'], { cwd })).stdout.trim();
             return { baseSha: head, headSha: tree, scope: { kind: 'staged', degraded: false } };
         }
         catch {
@@ -100,7 +100,7 @@ async function resolveDiffRange(cwd, opts) {
     }
     let headSha;
     try {
-        const { stdout } = await (0, execa_1.execa)('git', ['rev-parse', 'HEAD'], { cwd });
+        const { stdout } = await (0, execa_js_1.execa)('git', ['rev-parse', 'HEAD'], { cwd });
         headSha = stdout.trim();
     }
     catch {
@@ -115,7 +115,7 @@ async function resolveDiffRange(cwd, opts) {
             const eventBase = event?.pull_request?.base?.sha;
             // Only use it if the commit is actually present in this clone; otherwise
             // fall through so a shallow clone degrades to a full scan, not 0 files.
-            const baseSha = eventBase ? await (0, utils_1.resolveGitRef)(cwd, eventBase) : undefined;
+            const baseSha = eventBase ? await (0, index_js_1.resolveGitRef)(cwd, eventBase) : undefined;
             if (baseSha) {
                 return { baseSha, headSha, scope: { kind: 'delta', reason: 'PR event', degraded: false } };
             }
@@ -127,7 +127,7 @@ async function resolveDiffRange(cwd, opts) {
     }
     if (plan.kind === 'branch')
         return resolveBranchRange(cwd, headSha);
-    const baseSha = await (0, utils_1.resolveGitRef)(cwd, plan.ref);
+    const baseSha = await (0, index_js_1.resolveGitRef)(cwd, plan.ref);
     if (!baseSha)
         return { headSha, scope: degraded(`${plan.ref} unresolvable`) };
     return {
@@ -151,11 +151,11 @@ async function findMergeBase(cwd, headSha) {
     for (const name of DEFAULT_BRANCHES)
         candidates.push(`origin/${name}`, name);
     for (const candidate of candidates) {
-        const ref = await (0, utils_1.resolveGitRef)(cwd, candidate);
+        const ref = await (0, index_js_1.resolveGitRef)(cwd, candidate);
         // A candidate that resolves to HEAD is the branch we are on, not a base.
         if (!ref || ref === headSha)
             continue;
-        const { stdout } = await (0, execa_1.execa)('git', ['merge-base', headSha, ref], { cwd, reject: false });
+        const { stdout } = await (0, execa_js_1.execa)('git', ['merge-base', headSha, ref], { cwd, reject: false });
         const base = stdout.trim();
         // An unrelated history has no merge base, and a base equal to HEAD means the
         // branch is behind rather than ahead — neither describes local changes.
@@ -187,7 +187,7 @@ async function resolveBranchRange(cwd, headSha) {
  */
 async function buildContext(opts = {}) {
     const cwd = opts.cwd ?? process.cwd();
-    const config = opts.config ?? (0, loader_1.loadProjectConfig)();
+    const config = opts.config ?? (0, loader_js_1.loadProjectConfig)();
     // Detection reads the client's `ignoreDirs` from the config already loaded here,
     // rather than calling getIgnoredDirs() — that one resolves against process.cwd(),
     // which is not necessarily the `cwd` under review.
@@ -198,13 +198,13 @@ async function buildContext(opts = {}) {
     // enough to download a toolchain — see `detectLanguageUsage`.
     const usage = opts.languages
         ? opts.languages.map(lang => ({ lang, files: 1, marker: true }))
-        : await (0, detect_language_1.detectLanguageUsage)(cwd, config.ignoreDirs, config.detect);
+        : await (0, detect_language_js_1.detectLanguageUsage)(cwd, config.ignoreDirs, config.detect);
     const languages = usage.map(u => u.lang);
     const { baseSha, headSha, scope } = await resolveDiffRange(cwd, opts);
     // `scope` is logged because it decides what the whole run looks at, and getting
     // it wrong is invisible in the results: a run that reviewed one commit and one
     // that reviewed the repository both just print passes.
-    utils_1.logger.info(`[buildContext]: cwd=${cwd} languages=[${languages.join(', ') || 'none'}] write=${opts.write ?? false} scope=${describeScope(scope)}`);
+    index_js_1.logger.info(`[buildContext]: cwd=${cwd} languages=[${languages.join(', ') || 'none'}] write=${opts.write ?? false} scope=${describeScope(scope)}`);
     return {
         cwd,
         languages,
@@ -238,7 +238,7 @@ function applyLogConfig(config) {
     const log = config.log ?? {};
     const level = process.env.PR_CHECKMATE_LOG_LEVEL ?? log.level;
     const format = process.env.PR_CHECKMATE_LOG_FORMAT ?? log.format;
-    utils_1.logger.configure({
+    index_js_1.logger.configure({
         ...(level ? { level } : {}),
         ...(format ? { format } : {}),
         ...(log.color ? { color: log.color } : {}),

package/dist/cjs/core/index.d.ts

@@ -0,0 +1,4 @@
+export { runChecks } from './run-checks.js';
+export { buildContext } from './context.js';
+export { REGISTRY } from './registry.js';
+export * from './types.js';

package/dist/{core → cjs/core}/index.js

@@ -15,10 +15,10 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.REGISTRY = exports.buildContext = exports.runChecks = void 0;
-var run_checks_1 = require("./run-checks");
-Object.defineProperty(exports, "runChecks", { enumerable: true, get: function () { return run_checks_1.runChecks; } });
-var context_1 = require("./context");
-Object.defineProperty(exports, "buildContext", { enumerable: true, get: function () { return context_1.buildContext; } });
-var registry_1 = require("./registry");
-Object.defineProperty(exports, "REGISTRY", { enumerable: true, get: function () { return registry_1.REGISTRY; } });
-__exportStar(require("./types"), exports);
+var run_checks_js_1 = require("./run-checks.js");
+Object.defineProperty(exports, "runChecks", { enumerable: true, get: function () { return run_checks_js_1.runChecks; } });
+var context_js_1 = require("./context.js");
+Object.defineProperty(exports, "buildContext", { enumerable: true, get: function () { return context_js_1.buildContext; } });
+var registry_js_1 = require("./registry.js");
+Object.defineProperty(exports, "REGISTRY", { enumerable: true, get: function () { return registry_js_1.REGISTRY; } });
+__exportStar(require("./types.js"), exports);

package/dist/{core → cjs/core}/install/cache.js

@@ -11,7 +11,7 @@ exports.stalePaths = stalePaths;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
-const logger_1 = require("../../utils/logger");
+const logger_js_1 = require("../../utils/logger.js");
 /**
  * Expand a leading `~`.
  *
@@ -88,7 +88,7 @@ function resolveCacheDir(version, configured, env = process.env) {
         const dir = node_path_1.default.join(candidate.dir, version);
         if (writable(dir)) {
             if (index > 0) {
-                logger_1.logger.warn(`[install]: ⚠️ cache directory "${candidates[0].dir}" is not writable — using ${candidate.reason} (${dir}). Fetched tooling will not survive a container rebuild.`);
+                logger_js_1.logger.warn(`[install]: ⚠️ cache directory "${candidates[0].dir}" is not writable — using ${candidate.reason} (${dir}). Fetched tooling will not survive a container rebuild.`);
             }
             return { dir, preferred: index === 0, reason: candidate.reason };
         }

package/dist/{core → cjs/core}/install/doctor.d.ts

@@ -1,7 +1,7 @@
-import { type LanguageUsage } from '../../utils/detect-language';
-import { packageVersion } from '../../utils/package-version';
-import { type EnsureResult } from './ensure';
-import { type ProfileDecision } from './profiles';
+import { type LanguageUsage } from '../../utils/detect-language.js';
+import { packageVersion } from '../../utils/package-version.js';
+import { type EnsureResult } from './ensure.js';
+import { type ProfileDecision } from './profiles.js';
 export { packageVersion };
 /**
  * Everything the install layer knows about this repository, in one shot.

package/dist/{core → cjs/core}/install/doctor.js

@@ -9,15 +9,15 @@ exports.installProfiles = installProfiles;
 exports.runDoctor = runDoctor;
 exports.pruneCache = pruneCache;
 const node_fs_1 = __importDefault(require("node:fs"));
-const loader_1 = require("../../config/loader");
-const detect_language_1 = require("../../utils/detect-language");
-const logger_1 = require("../../utils/logger");
-const package_version_1 = require("../../utils/package-version");
-Object.defineProperty(exports, "packageVersion", { enumerable: true, get: function () { return package_version_1.packageVersion; } });
-const cache_1 = require("./cache");
-const ensure_1 = require("./ensure");
-const prepare_1 = require("./prepare");
-const profiles_1 = require("./profiles");
+const loader_js_1 = require("../../config/loader.js");
+const detect_language_js_1 = require("../../utils/detect-language.js");
+const logger_js_1 = require("../../utils/logger.js");
+const package_version_js_1 = require("../../utils/package-version.js");
+Object.defineProperty(exports, "packageVersion", { enumerable: true, get: function () { return package_version_js_1.packageVersion; } });
+const cache_js_1 = require("./cache.js");
+const ensure_js_1 = require("./ensure.js");
+const prepare_js_1 = require("./prepare.js");
+const profiles_js_1 = require("./profiles.js");
 /**
  * Everything the install layer knows about this repository, in one shot.
  *
@@ -26,10 +26,10 @@ const profiles_1 = require("./profiles");
  * log two contradictory-looking detection lines for one command.
  */
 async function planInstall(cwd = process.cwd(), usage) {
-    const config = (0, loader_1.loadProjectConfig)();
-    const detected = usage ?? (await (0, detect_language_1.detectLanguageUsage)(cwd, config.ignoreDirs, config.detect));
-    const location = (0, cache_1.resolveCacheDir)((0, package_version_1.packageVersion)(), config.install?.cacheDir);
-    return { decisions: (0, profiles_1.planProfiles)(detected, config), cacheDir: location?.dir ?? null };
+    const config = (0, loader_js_1.loadProjectConfig)();
+    const detected = usage ?? (await (0, detect_language_js_1.detectLanguageUsage)(cwd, config.ignoreDirs, config.detect));
+    const location = (0, cache_js_1.resolveCacheDir)((0, package_version_js_1.packageVersion)(), config.install?.cacheDir);
+    return { decisions: (0, profiles_js_1.planProfiles)(detected, config), cacheDir: location?.dir ?? null };
 }
 /**
  * Which profiles are usable right now, and why — fetched, or shipped with us.
@@ -47,12 +47,12 @@ async function planInstall(cwd = process.cwd(), usage) {
  */
 function installedProfiles(cacheDir) {
     const present = new Map();
-    for (const profile of profiles_1.PROFILES) {
-        if ((0, prepare_1.profileSatisfiedLocally)(profile))
+    for (const profile of profiles_js_1.PROFILES) {
+        if ((0, prepare_js_1.profileSatisfiedLocally)(profile))
             present.set(profile.name, 'ships with the package');
     }
     if (cacheDir) {
-        for (const name of (0, ensure_1.cachedProfiles)(cacheDir))
+        for (const name of (0, ensure_js_1.cachedProfiles)(cacheDir))
             present.set(name, 'fetched');
     }
     return present;
@@ -66,32 +66,32 @@ function installedProfiles(cacheDir) {
  * happens to contain.
  */
 async function installProfiles(cwd = process.cwd(), all = false) {
-    const config = (0, loader_1.loadProjectConfig)();
+    const config = (0, loader_js_1.loadProjectConfig)();
     const install = config.install ?? {};
     const { decisions } = await planInstall(cwd);
     const denied = new Set(install.deny ?? []);
-    const wanted = (all ? profiles_1.PROFILES.map(p => p.name) : decisions.filter(d => d.required).map(d => d.profile)).filter(name => {
-        const profile = profiles_1.PROFILES.find(p => p.name === name);
+    const wanted = (all ? profiles_js_1.PROFILES.map(p => p.name) : decisions.filter(d => d.required).map(d => d.profile)).filter(name => {
+        const profile = profiles_js_1.PROFILES.find(p => p.name === name);
         // Nothing to fetch for a profile whose packages already ship with us, and
         // fetching it anyway is not merely wasted: `--all` downloaded a second copy
         // of every bundled profile — some 800 packages — beside the ones already in
         // `node_modules`. On a container build that lands in the image (ticket 083).
-        if (profile && (0, prepare_1.profileSatisfiedLocally)(profile)) {
-            logger_1.logger.info(`[install]: profile "${name}" already ships with the package`);
+        if (profile && (0, prepare_js_1.profileSatisfiedLocally)(profile)) {
+            logger_js_1.logger.info(`[install]: profile "${name}" already ships with the package`);
             return false;
         }
         const blocked = profile?.packages.filter(pkg => denied.has(pkg)) ?? [];
         if (blocked.length === 0)
             return true;
-        logger_1.logger.info(`[install]: profile "${name}" skipped — install.deny lists ${blocked.join(', ')}`);
+        logger_js_1.logger.info(`[install]: profile "${name}" skipped — install.deny lists ${blocked.join(', ')}`);
         return false;
     });
     // One install for the whole set. Profiles that share hundreds of packages used
     // to be fetched into a tree each, which fought over npm's cache and downloaded
     // the shared half once per profile (ticket 087).
-    const result = await (0, ensure_1.ensureTooling)(wanted, {
+    const result = await (0, ensure_js_1.ensureTooling)(wanted, {
         cwd,
-        version: (0, package_version_1.packageVersion)(),
+        version: (0, package_version_js_1.packageVersion)(),
         install,
     });
     return [result];
@@ -104,14 +104,14 @@ async function installProfiles(cwd = process.cwd(), all = false) {
  * reading of our source.
  */
 async function runDoctor(cwd = process.cwd()) {
-    const config = (0, loader_1.loadProjectConfig)();
-    const usage = await (0, detect_language_1.detectLanguageUsage)(cwd, config.ignoreDirs, config.detect);
+    const config = (0, loader_js_1.loadProjectConfig)();
+    const usage = await (0, detect_language_js_1.detectLanguageUsage)(cwd, config.ignoreDirs, config.detect);
     const { decisions, cacheDir } = await planInstall(cwd, usage);
     const present = installedProfiles(cacheDir);
     const lines = [];
     lines.push('PR CheckMate — install doctor');
     lines.push('');
-    lines.push(`  version    ${(0, package_version_1.packageVersion)()}`);
+    lines.push(`  version    ${(0, package_version_js_1.packageVersion)()}`);
     lines.push(`  repository ${cwd}`);
     lines.push(`  cache      ${cacheDir ?? 'unavailable (no writable directory)'}`);
     lines.push(`  strategy   ${config.install?.strategy ?? 'adaptive'}`);
@@ -142,30 +142,30 @@ async function runDoctor(cwd = process.cwd()) {
         lines.push(`  ${missing.length} profile(s) not installed yet. They are fetched on the next`);
         lines.push('  run, or now with: npx pr-checkmate install');
     }
-    const stale = (0, cache_1.stalePaths)((0, package_version_1.packageVersion)(), config.install?.cacheDir);
+    const stale = (0, cache_js_1.stalePaths)((0, package_version_js_1.packageVersion)(), config.install?.cacheDir);
     if (stale.length > 0) {
         lines.push('');
         lines.push(`  ${stale.length} directory(ies) from other versions: npx pr-checkmate cache-prune`);
     }
-    logger_1.logger.print(lines.join('\n'));
+    logger_js_1.logger.print(lines.join('\n'));
 }
 /** Remove cached tooling belonging to other versions of pr-checkmate. */
 function pruneCache() {
-    const config = (0, loader_1.loadProjectConfig)();
-    const stale = (0, cache_1.stalePaths)((0, package_version_1.packageVersion)(), config.install?.cacheDir);
+    const config = (0, loader_js_1.loadProjectConfig)();
+    const stale = (0, cache_js_1.stalePaths)((0, package_version_js_1.packageVersion)(), config.install?.cacheDir);
     if (stale.length === 0) {
-        logger_1.logger.print('Nothing to prune — no tooling from other versions is cached.');
+        logger_js_1.logger.print('Nothing to prune — no tooling from other versions is cached.');
         return;
     }
     for (const dir of stale) {
         try {
             node_fs_1.default.rmSync(dir, { recursive: true, force: true });
-            logger_1.logger.print(`removed ${dir}`);
+            logger_js_1.logger.print(`removed ${dir}`);
         }
         catch (err) {
             // Another version may be running right now; refusing to delete its
             // tooling is the correct outcome, not an error worth failing on.
-            logger_1.logger.warn(`[cache-prune]: could not remove ${dir}: ${err.message}`);
+            logger_js_1.logger.warn(`[cache-prune]: could not remove ${dir}: ${err.message}`);
         }
     }
 }

package/dist/{core → cjs/core}/install/ensure.d.ts

@@ -1,5 +1,5 @@
-import type { InstallConfig } from '../../interfaces';
-import type { ProfileName } from './profiles';
+import type { InstallConfig } from '../../interfaces/index.js';
+import type { ProfileName } from './profiles.js';
 /**
  * What happened to the tooling cache, in the words the report and `doctor` use.
  *

package/dist/{core → cjs/core}/install/ensure.js

@@ -9,14 +9,15 @@ exports.ensureTooling = ensureTooling;
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("../../utils/execa");
-const logger_1 = require("../../utils/logger");
-const cache_1 = require("./cache");
-const lock_1 = require("./lock");
-const merge_1 = require("./merge");
+const execa_js_1 = require("../../utils/execa.js");
+const logger_js_1 = require("../../utils/logger.js");
+const own_deps_js_1 = require("../../utils/own-deps.js");
+const cache_js_1 = require("./cache.js");
+const lock_js_1 = require("./lock.js");
+const merge_js_1 = require("./merge.js");
 /** Where the shipped manifests live inside the installed package. */
 function manifestDir(profile) {
-    return node_path_1.default.resolve(__dirname, '../../..', 'install-manifests', profile);
+    return node_path_1.default.join((0, own_deps_js_1.findOwnPackageRoot)() ?? node_path_1.default.resolve(__dirname, '../../..'), 'install-manifests', profile);
 }
 const stampPath = (dir) => node_path_1.default.join(dir, '.pr-checkmate-installed');
 const MANIFEST = 'package.json';
@@ -33,7 +34,7 @@ function manifestFor(profiles) {
     const dirs = profiles.map(name => ({ name, dir: manifestDir(name) }));
     if (dirs.some(d => !node_fs_1.default.existsSync(node_path_1.default.join(d.dir, LOCKFILE))))
         return null;
-    return (0, merge_1.mergeManifests)(dirs);
+    return (0, merge_js_1.mergeManifests)(dirs);
 }
 /**
  * A fingerprint of the manifest a tooling directory was installed from.
@@ -94,7 +95,7 @@ const normalise = (profiles) => [...new Set(profiles)].sort();
  * readable from the directory layout.
  */
 function cachedProfiles(cacheDir) {
-    const dir = (0, cache_1.toolingDir)(cacheDir);
+    const dir = (0, cache_js_1.toolingDir)(cacheDir);
     if (!node_fs_1.default.existsSync(node_path_1.default.join(dir, 'node_modules')))
         return [];
     return readStamp(dir)?.profiles ?? [];
@@ -128,7 +129,7 @@ async function ensureTooling(wanted, opts) {
     if (needed.length === 0) {
         return { status: 'cached', reason: 'nothing to fetch', profiles: [] };
     }
-    const location = (0, cache_1.resolveCacheDir)(opts.version, install.cacheDir);
+    const location = (0, cache_js_1.resolveCacheDir)(opts.version, install.cacheDir);
     if (!location) {
         return {
             status: 'failed',
@@ -136,7 +137,7 @@ async function ensureTooling(wanted, opts) {
             profiles: [],
         };
     }
-    const dir = (0, cache_1.toolingDir)(location.dir);
+    const dir = (0, cache_js_1.toolingDir)(location.dir);
     const stamp = readStamp(dir);
     if (holdsAll(dir, stamp, needed)) {
         return { status: 'cached', reason: 'already installed', dir, profiles: stamp?.profiles ?? [] };
@@ -203,7 +204,7 @@ async function ensureTooling(wanted, opts) {
             profiles: [],
         };
     }
-    const release = await (0, lock_1.withLock)(dir, install.waitTimeoutMs ?? 120000);
+    const release = await (0, lock_js_1.withLock)(dir, install.waitTimeoutMs ?? 120000);
     if (!release) {
         return { status: 'failed', reason: `cannot write to ${dir}`, dir, profiles: [] };
     }
@@ -233,7 +234,7 @@ async function ensureTooling(wanted, opts) {
  * `--ignore-scripts` is not negotiable in a supply-chain tool.
  */
 async function npmCi(dir, opts) {
-    const result = await (0, execa_1.execa)('npm', ['ci', '--prefix', dir, '--ignore-scripts', '--no-audit', '--no-fund', '--loglevel', 'error'], { cwd: opts.cwd, reject: false, timeout: opts.install.installTimeoutMs ?? 300000 });
+    const result = await (0, execa_js_1.execa)('npm', ['ci', '--prefix', dir, '--ignore-scripts', '--no-audit', '--no-fund', '--loglevel', 'error'], { cwd: opts.cwd, reject: false, timeout: opts.install.installTimeoutMs ?? 300000 });
     if (result.exitCode === 0)
         return { ok: true };
     const detail = (result.stderr || result.stdout || '').split('\n').slice(-3).join(' ').trim();
@@ -247,7 +248,7 @@ async function runInstall(profiles, manifest, dir, opts) {
     const count = Object.keys(manifest.lockfile.packages).length - 1;
     // Always logged, never behind --debug: this is a security tool downloading
     // code at run time, and that must be visible in every CI log by default.
-    logger_1.logger.info(`[install]: 📦 fetching tooling for ${named} (${count} packages) → ${dir}`);
+    logger_js_1.logger.info(`[install]: 📦 fetching tooling for ${named} (${count} packages) → ${dir}`);
     try {
         const install = opts.installer ?? ((target) => npmCi(target, opts));
         const result = await install(dir);
@@ -257,7 +258,7 @@ async function runInstall(profiles, manifest, dir, opts) {
         const stamp = { hash: hashOf(manifest), profiles };
         node_fs_1.default.writeFileSync(stampPath(dir), JSON.stringify(stamp));
         const durationMs = Date.now() - started;
-        logger_1.logger.info(`[install]: ✅ tooling ready in ${(durationMs / 1000).toFixed(1)}s (${named})`);
+        logger_js_1.logger.info(`[install]: ✅ tooling ready in ${(durationMs / 1000).toFixed(1)}s (${named})`);
         return { status: 'installed', reason: `${count} packages`, dir, profiles, durationMs };
     }
     catch (err) {

package/dist/{core → cjs/core}/install/lock.js

@@ -7,7 +7,7 @@ exports.processAlive = processAlive;
 exports.withLock = withLock;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const logger_1 = require("../../utils/logger");
+const logger_js_1 = require("../../utils/logger.js");
 const lockPath = (dir) => node_path_1.default.join(dir, '.pr-checkmate-install.lock');
 function readLock(file) {
     try {
@@ -63,7 +63,7 @@ async function withLock(dir, timeoutMs, deps = {}) {
         // would otherwise block every later run forever. Breaking it needs to be
         // loud: it is the one case where two installs could genuinely overlap.
         if (held && !alive(held.pid)) {
-            logger_1.logger.warn(`[install]: ⚠️ removing a stale lock left by process ${held.pid}, which is no longer running.`);
+            logger_js_1.logger.warn(`[install]: ⚠️ removing a stale lock left by process ${held.pid}, which is no longer running.`);
             try {
                 node_fs_1.default.unlinkSync(file);
             }
@@ -79,7 +79,7 @@ async function withLock(dir, timeoutMs, deps = {}) {
             continue;
         }
         if (now() >= deadline) {
-            logger_1.logger.warn(`[install]: ⚠️ waited ${Math.round(timeoutMs / 1000)}s for another process to finish installing — taking over.`);
+            logger_js_1.logger.warn(`[install]: ⚠️ waited ${Math.round(timeoutMs / 1000)}s for another process to finish installing — taking over.`);
             try {
                 node_fs_1.default.unlinkSync(file);
             }
@@ -91,7 +91,7 @@ async function withLock(dir, timeoutMs, deps = {}) {
         }
         if (!announced) {
             const age = held ? Math.round((now() - held.startedAt) / 1000) : 0;
-            logger_1.logger.info(`[install]: ⏳ another process is installing into ${node_path_1.default.basename(dir)} (started ${age}s ago) — waiting up to ${Math.round(timeoutMs / 1000)}s`);
+            logger_js_1.logger.info(`[install]: ⏳ another process is installing into ${node_path_1.default.basename(dir)} (started ${age}s ago) — waiting up to ${Math.round(timeoutMs / 1000)}s`);
             announced = true;
         }
         await sleep(500);