pr-checkmate 3.0.4 → 3.2.0

package/dist/{core → cjs/core}/checks/quality/dead-code.js

@@ -6,11 +6,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.deadCodeCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const constants_1 = require("../../../config/constants");
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const reuse_1 = require("../../install/reuse");
-const types_1 = require("../../types");
+const constants_js_1 = require("../../../config/constants.js");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const reuse_js_1 = require("../../install/reuse.js");
+const types_js_1 = require("../../types.js");
 /**
  * Resolve ts-unused-exports, preferring the consumer project's own copy (so a
  * repo pinned to a different major keeps its own behaviour) and falling back to
@@ -27,9 +27,9 @@ function resolveTsUnusedExports(ctx) {
     // No configuration of its own — it reads the module graph via tsconfig — so
     // the version check is the right question here and `clientOwnsConfig` stays
     // off, same as dpdm.
-    for (const options of [{ paths: (0, reuse_1.clientToolPaths)('ts-unused-exports', ctx) }, undefined]) {
+    for (const options of [{ paths: (0, reuse_js_1.clientToolPaths)('ts-unused-exports', ctx) }, undefined]) {
         try {
-            return (0, utils_1.resolvePackageBin)('ts-unused-exports', 'bin/ts-unused-exports', options);
+            return (0, index_js_1.resolvePackageBin)('ts-unused-exports', 'bin/ts-unused-exports', options);
         }
         catch {
             // Try the next location; both failing is a skip, handled by the caller.
@@ -49,11 +49,11 @@ exports.deadCodeCheck = {
     async run(ctx) {
         const tsConfigPath = node_path_1.default.join(ctx.cwd, 'tsconfig.json');
         if (!node_fs_1.default.existsSync(tsConfigPath)) {
-            return (0, types_1.skip)('no tsconfig.json found');
+            return (0, types_js_1.skip)('no tsconfig.json found');
         }
         const bin = resolveTsUnusedExports(ctx);
         if (!bin) {
-            return (0, types_1.skip)('ts-unused-exports could not be resolved');
+            return (0, types_js_1.skip)('ts-unused-exports could not be resolved');
         }
         try {
             // Run the full analysis unfiltered: ignore patterns are applied to the
@@ -62,16 +62,16 @@ exports.deadCodeCheck = {
             // counting as usage — ignoring a barrel or entry point would then cascade
             // and flag everything it re-exports. Filtering the output instead keeps
             // every usage edge intact and only hides the exempted files' own reports.
-            const result = await (0, execa_1.execa)(process.execPath, [bin, tsConfigPath], {
+            const result = await (0, execa_js_1.execa)(process.execPath, [bin, tsConfigPath], {
                 cwd: ctx.cwd,
                 reject: false,
             });
             const output = [result.stdout, result.stderr].filter(Boolean).join('\n').trim();
             if (!output || result.exitCode === 0) {
-                utils_1.logger.info('[Dead Code]: ✅ No unused exports found');
-                return (0, types_1.pass)();
+                index_js_1.logger.info('[Dead Code]: ✅ No unused exports found');
+                return (0, types_js_1.pass)();
             }
-            const ignore = compileIgnorePatterns(ctx.config.deadCode?.ignoreFiles ?? constants_1.DEAD_CODE_IGNORE_DEFAULTS);
+            const ignore = compileIgnorePatterns(ctx.config.deadCode?.ignoreFiles ?? constants_js_1.DEAD_CODE_IGNORE_DEFAULTS);
             // ts-unused-exports prints one `path: sym1, sym2` line per file, preceded
             // by a `N modules with unused exports` summary line we skip.
             const parsed = output
@@ -91,25 +91,25 @@ exports.deadCodeCheck = {
             // existence while grepping for console wording that had changed. Same
             // resolution as Grype Scan: say so rather than invent a verdict.
             if (parsed.length === 0) {
-                utils_1.logger.warn(`[Dead Code]: ⚠️ ts-unused-exports produced no parseable output:\n${output}`);
-                return (0, types_1.warn)('ts-unused-exports produced no parseable output');
+                index_js_1.logger.warn(`[Dead Code]: ⚠️ ts-unused-exports produced no parseable output:\n${output}`);
+                return (0, types_js_1.warn)('ts-unused-exports produced no parseable output');
             }
             const entries = parsed.filter(entry => !ignore.some(re => re.test(entry.file)));
             if (entries.length === 0) {
-                utils_1.logger.info('[Dead Code]: ✅ No unused exports found');
-                return (0, types_1.pass)();
+                index_js_1.logger.info('[Dead Code]: ✅ No unused exports found');
+                return (0, types_js_1.pass)();
             }
             const fileCount = entries.length;
             const exportCount = entries.reduce((sum, entry) => sum + entry.symbols.length, 0);
-            utils_1.logger.warn(`[Dead Code]: ⚠️ ${exportCount} unused export(s) across ${fileCount} file(s):`);
+            index_js_1.logger.warn(`[Dead Code]: ⚠️ ${exportCount} unused export(s) across ${fileCount} file(s):`);
             for (const entry of entries) {
-                utils_1.logger.warn(`${entry.file}: ${entry.symbols.join(', ')}`);
+                index_js_1.logger.warn(`${entry.file}: ${entry.symbols.join(', ')}`);
             }
-            return (0, types_1.warn)(`${exportCount} unused export(s) in ${fileCount} file(s)`);
+            return (0, types_js_1.warn)(`${exportCount} unused export(s) in ${fileCount} file(s)`);
         }
         catch (err) {
-            utils_1.logger.warn(`[Dead Code]: ⚠️ Could not run dead code check\n${err}`);
-            return (0, types_1.skip)('ts-unused-exports unavailable');
+            index_js_1.logger.warn(`[Dead Code]: ⚠️ Could not run dead code check\n${err}`);
+            return (0, types_js_1.skip)('ts-unused-exports unavailable');
         }
     },
 };
@@ -123,7 +123,7 @@ function compileIgnorePatterns(patterns) {
             return [new RegExp(pattern)];
         }
         catch {
-            utils_1.logger.warn(`[Dead Code]: ⚠️ Ignoring invalid ignoreFiles pattern: ${pattern}`);
+            index_js_1.logger.warn(`[Dead Code]: ⚠️ Ignoring invalid ignoreFiles pattern: ${pattern}`);
             return [];
         }
     });

package/dist/{core → cjs/core}/checks/quality/duplicate-check.d.ts

@@ -1,2 +1,2 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 export declare const duplicateCheck: Check;

package/dist/{core → cjs/core}/checks/quality/duplicate-check.js

@@ -7,13 +7,13 @@ exports.duplicateCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
-const config_1 = require("../../../config");
-const constants_1 = require("../../../config/constants");
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const constants_js_1 = require("../../../config/constants.js");
+const index_js_1 = require("../../../config/index.js");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_2 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 /**
  * The files to hand jscpd, per language.
  *
@@ -49,7 +49,7 @@ function globsFor(languages) {
 // meaningful production duplication. Config files (eslint/*.config.*) are data,
 // not logic, and are commonly shipped in two formats (e.g. .eslintrc + flat
 // config), so their repetition is expected rather than a code smell.
-const BASE_IGNORE = ['node_modules/**', 'dist/**', '.git/**', ...constants_1.CONFIG_FILE_PATTERNS];
+const BASE_IGNORE = ['node_modules/**', 'dist/**', '.git/**', ...constants_js_1.CONFIG_FILE_PATTERNS];
 /** `<path>:<start>-<end>`, repo-relative, for one end of a clone. */
 function locate(cwd, at) {
     const name = at?.name ?? '';
@@ -73,20 +73,20 @@ exports.duplicateCheck = {
     async run(ctx) {
         const minLines = ctx.config.duplicate?.minLines ?? 5;
         const minTokens = ctx.config.duplicate?.minTokens ?? 50;
-        const targetPaths = await (0, targets_1.resolveScopedTargetFiles)(ctx, globsFor(ctx.languages), (0, config_1.getSourcePaths)(ctx.cwd));
+        const targetPaths = await (0, targets_js_1.resolveScopedTargetFiles)(ctx, globsFor(ctx.languages), (0, index_js_1.getSourcePaths)(ctx.cwd));
         if (targetPaths === null)
-            return (0, types_1.skip)('git unavailable');
+            return (0, types_js_1.skip)('git unavailable');
         if (targetPaths.length === 0)
-            return (0, types_1.skip)('no relevant files');
-        const jscpdBin = (0, utils_1.resolvePackageBin)('jscpd', 'run-jscpd.js');
+            return (0, types_js_1.skip)('no relevant files');
+        const jscpdBin = (0, index_js_2.resolvePackageBin)('jscpd', 'run-jscpd.js');
         // Client-configurable exclusions (pr-checkmate.json `duplicate.ignore`),
         // defaulting to test files/folders, appended to the always-on base ignores.
-        const configuredIgnore = ctx.config.duplicate?.ignore ?? constants_1.DUPLICATE_IGNORE_DEFAULTS;
+        const configuredIgnore = ctx.config.duplicate?.ignore ?? constants_js_1.DUPLICATE_IGNORE_DEFAULTS;
         const ignore = [...BASE_IGNORE, ...configuredIgnore].join(',');
         // Client-configurable formats (pr-checkmate.json `duplicate.formats`),
         // defaulting to source-code formats so data files (yaml/json/markdown) are
         // not scanned. Clients can add them back explicitly.
-        const formats = (ctx.config.duplicate?.formats ?? constants_1.DUPLICATE_CODE_FORMATS).join(',');
+        const formats = (ctx.config.duplicate?.formats ?? constants_js_1.DUPLICATE_CODE_FORMATS).join(',');
         // The JSON reporter writes a file, so it needs somewhere to write it. Outside
         // the repository deliberately: with no `--output`, jscpd creates `report/`
         // in the client's working tree, and a check that leaves a directory behind is
@@ -97,7 +97,7 @@ exports.duplicateCheck = {
             // That is what retired `stripJscpdPromo` — six string markers matching the
             // funding lines jscpd v5 prints after its report, each good until the next
             // release of somebody else's package.
-            const result = await (0, execa_1.execa)(process.execPath, [
+            const result = await (0, execa_js_1.execa)(process.execPath, [
                 jscpdBin,
                 '--min-lines',
                 String(minLines),
@@ -120,9 +120,9 @@ exports.duplicateCheck = {
                 // No report and nothing to read it from: jscpd did not get as far as
                 // writing one. Its stderr is the only thing that can say why, and a skip
                 // is the honest outcome — an empty report would read as "no duplication".
-                utils_1.logger.warn(`[Duplicate Code]: ⚠️ jscpd wrote no report (exit ${result.exitCode ?? 'killed'})` +
+                index_js_2.logger.warn(`[Duplicate Code]: ⚠️ jscpd wrote no report (exit ${result.exitCode ?? 'killed'})` +
                     `${result.stderr ? `\n${result.stderr}` : ''}`);
-                return (0, types_1.skip)('jscpd produced no report');
+                return (0, types_js_1.skip)('jscpd produced no report');
             }
             const report = JSON.parse(node_fs_1.default.readFileSync(reportPath, 'utf-8'));
             const clones = report.duplicates ?? [];
@@ -132,13 +132,13 @@ exports.duplicateCheck = {
             // reported it as a pass.
             const cloneCount = report.statistics?.total?.clones ?? clones.length;
             if (cloneCount === 0)
-                return (0, types_1.pass)();
-            (0, findings_1.logSample)('Duplicate Code', `${cloneCount} duplicate block(s):`, clones.map(clone => describe(ctx.cwd, clone)));
-            return (0, types_1.warn)(`${cloneCount} duplicate block(s)`);
+                return (0, types_js_1.pass)();
+            (0, findings_js_1.logSample)('Duplicate Code', `${cloneCount} duplicate block(s):`, clones.map(clone => describe(ctx.cwd, clone)));
+            return (0, types_js_1.warn)(`${cloneCount} duplicate block(s)`);
         }
         catch (err) {
-            utils_1.logger.warn(`[Duplicate Code]: ⚠️ Could not run duplicate check\n${err}`);
-            return (0, types_1.skip)('jscpd unavailable');
+            index_js_2.logger.warn(`[Duplicate Code]: ⚠️ Could not run duplicate check\n${err}`);
+            return (0, types_js_1.skip)('jscpd unavailable');
         }
         finally {
             node_fs_1.default.rmSync(reportDir, { recursive: true, force: true });

package/dist/{core → cjs/core}/checks/quality/license-header.d.ts

@@ -1,4 +1,4 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 /**
  * Requires a license/copyright header (a configured regex) in the first N lines
  * of newly ADDED source files. Opt-in — needs `licenseHeader.pattern`; does

package/dist/{core → cjs/core}/checks/quality/license-header.js

@@ -6,10 +6,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.licenseHeaderCheck = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
 /** Source extensions a license header is expected on. */
 const SOURCE_EXT = /\.(ts|tsx|js|jsx|mjs|cjs|py|kt|java|go|rs|cs|rb|php|swift|c|cc|cpp|h|hpp)$/i;
 const DEFAULT_HEADER_LINES = 10;
@@ -31,35 +31,35 @@ exports.licenseHeaderCheck = {
     async run(ctx) {
         const patternSrc = ctx.config.licenseHeader?.pattern;
         if (!patternSrc)
-            return (0, types_1.skip)('no licenseHeader.pattern configured');
+            return (0, types_js_1.skip)('no licenseHeader.pattern configured');
         let header;
         try {
             header = new RegExp(patternSrc);
         }
         catch (err) {
-            utils_1.logger.warn(`[License Header]: ⚠️ invalid pattern\n${err}`);
-            return (0, types_1.skip)('invalid licenseHeader.pattern');
+            index_js_1.logger.warn(`[License Header]: ⚠️ invalid pattern\n${err}`);
+            return (0, types_js_1.skip)('invalid licenseHeader.pattern');
         }
         const maxLines = ctx.config.licenseHeader?.lines ?? DEFAULT_HEADER_LINES;
         let added;
         try {
             if (!ctx.baseSha && ctx.config.run?.fullScanBehaviour === 'skip')
-                return (0, types_1.pass)();
+                return (0, types_js_1.pass)();
             // Added files in delta mode; every tracked source file in full mode.
             const args = ctx.baseSha
                 ? ['diff', '--name-only', '--diff-filter=A', ctx.baseSha, ctx.headSha ?? 'HEAD']
                 : ['ls-files'];
-            const { stdout } = await (0, execa_1.execa)('git', args, { cwd: ctx.cwd });
+            const { stdout } = await (0, execa_js_1.execa)('git', args, { cwd: ctx.cwd });
             // Its own git call rather than `resolveTargets`, and for one reason:
             // `--diff-filter=A`. This check is about files a PR ADDS, and the shared
             // resolver asks for ACMR — routing through it would start demanding a
             // header on every modified file too, which is a different check. So the
             // client's `excludePaths` is applied here explicitly instead (ticket 080).
-            added = (0, targets_1.excludeClientPaths)(stdout.split('\n').filter(Boolean), ctx.cwd).filter(f => SOURCE_EXT.test(f));
+            added = (0, targets_js_1.excludeClientPaths)(stdout.split('\n').filter(Boolean), ctx.cwd).filter(f => SOURCE_EXT.test(f));
         }
         catch (err) {
-            utils_1.logger.warn(`[License Header]: ⚠️ Could not analyze diff\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
+            index_js_1.logger.warn(`[License Header]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_js_1.skip)('diff unavailable');
         }
         const missing = [];
         for (const file of added) {
@@ -78,10 +78,10 @@ exports.licenseHeaderCheck = {
                 missing.push(file);
         }
         if (missing.length === 0)
-            return (0, types_1.pass)();
-        missing.slice(0, 10).forEach(f => utils_1.logger.warn(`[License Header]: ⚠️ missing header: ${f}`));
+            return (0, types_js_1.pass)();
+        missing.slice(0, 10).forEach(f => index_js_1.logger.warn(`[License Header]: ⚠️ missing header: ${f}`));
         if (missing.length > 10)
-            utils_1.logger.warn(`[License Header]: ⚠️ ... and ${missing.length - 10} more`);
-        return (0, types_1.warn)(`${missing.length} new source file(s) missing the license header`);
+            index_js_1.logger.warn(`[License Header]: ⚠️ ... and ${missing.length - 10} more`);
+        return (0, types_js_1.warn)(`${missing.length} new source file(s) missing the license header`);
     },
 };

package/dist/{core → cjs/core}/checks/quality/markdown-lint.d.ts

@@ -1,2 +1,2 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 export declare const markdownLintCheck: Check;

package/dist/cjs/core/checks/quality/markdown-lint.js

@@ -0,0 +1,147 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.markdownLintCheck = void 0;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_url_1 = require("node:url");
+const index_js_1 = require("../../../config/index.js");
+const index_js_2 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+function loadUserMarkdownConfig(cwd) {
+    const configPath = node_path_1.default.join(cwd, 'pr-checkmate.json');
+    if (!node_fs_1.default.existsSync(configPath))
+        return {};
+    try {
+        return JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8')).markdownlint || {};
+    }
+    catch (err) {
+        index_js_2.logger.warn(`[Markdown]: ⚠️ Failed to read markdownlint config: ${err}`);
+        return {};
+    }
+}
+/**
+ * Load the markdownlint library, or `null` when it cannot be found.
+ *
+ * The library rather than `markdownlint-cli2`: the CLI drags in globby →
+ * micromatch → braces, which carries an unpatched advisory every client's
+ * `npm audit` then reports against pr-checkmate. We already have the file list
+ * from git, so the CLI's globbing bought nothing.
+ *
+ * Resolved through `resolvePackageBin` and loaded by a dynamic `import()` for the
+ * same two reasons as the bundled gofmt: the package may live in a fetched
+ * profile directory, and it is ESM while we emit CommonJS.
+ */
+async function loadMarkdownlint() {
+    try {
+        const promiseEntry = (0, index_js_2.resolvePackageBin)('markdownlint', 'lib/exports-promise.mjs');
+        const mainEntry = node_path_1.default.join(node_path_1.default.dirname(promiseEntry), 'exports.mjs');
+        const promise = (await import((0, node_url_1.pathToFileURL)(promiseEntry).href));
+        const main = (await import((0, node_url_1.pathToFileURL)(mainEntry).href));
+        return { lint: promise.lint, readConfig: promise.readConfig, applyFixes: main.applyFixes };
+    }
+    catch (err) {
+        index_js_2.logger.warn(`[Markdown]: ⚠️ markdownlint could not be loaded\n${err}`);
+        return null;
+    }
+}
+/**
+ * The rules to lint with: the repository's own config when it has one, ours
+ * (plus the client's `markdownlint.rules`) when it does not. Someone with a
+ * `.markdownlint.json` has an opinion; merging ours into it would silently
+ * override the rules they wrote.
+ */
+async function readLintConfig(lib, cwd, userRules) {
+    const local = ['.markdownlint.json', '.markdownlint.jsonc'].find(name => (0, index_js_1.hasLocalConfig)([name], cwd));
+    if (local)
+        return lib.readConfig(node_path_1.default.join(cwd, local));
+    if ((0, index_js_1.hasLocalConfig)(['.markdownlint.yaml', '.markdownlint.yml'], cwd)) {
+        index_js_2.logger.warn('[Markdown]: ⚠️ YAML markdownlint configs are not supported, using bundled rules');
+    }
+    const bundled = await lib.readConfig((0, index_js_1.getPackageConfigPath)('.markdownlint.json'));
+    return { ...bundled, ...userRules };
+}
+/**
+ * An ignore pattern as a regular expression over a repo-relative path.
+ *
+ * A bare directory name excludes its contents; a file name matches exactly; `*`
+ * stays within a segment and `**` crosses them. `path.extname` is what tells a
+ * directory from a file, and it reads a leading dot as part of the name, so
+ * `.claude` is still the directory it is.
+ */
+function toIgnoreRegExp(pattern) {
+    const clean = pattern.replace(/\/+$/, '');
+    const escaped = clean
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*\*\//g, '\u0001')
+        .replace(/\*\*/g, '\u0000')
+        .replace(/\*/g, '[^/]*')
+        .replace(/\u0001/g, '(?:.*/)?')
+        .replace(/\u0000/g, '.*');
+    const isDir = !clean.includes('*') && !node_path_1.default.extname(clean);
+    return new RegExp(`^${escaped}${isDir ? '(/.*)?' : ''}$`);
+}
+exports.markdownLintCheck = {
+    name: 'Markdown',
+    phase: 'informational',
+    applies() {
+        return true;
+    },
+    async run(ctx) {
+        const targets = await (0, targets_js_1.resolveTargetFiles)(ctx, ['*.md', '*.mdx']);
+        if (targets === null)
+            return (0, types_js_1.skip)('git unavailable');
+        if (targets.length === 0)
+            return (0, types_js_1.skip)('no markdown files');
+        const userConfig = loadUserMarkdownConfig(ctx.cwd);
+        const userRules = userConfig.rules ?? {};
+        const lib = await loadMarkdownlint();
+        if (!lib)
+            return (0, types_js_1.warn)('markdownlint failed to run (exit 2) — check the markdownlint config');
+        const ignores = [
+            'node_modules/**',
+            'dist/**',
+            'coverage/**',
+            'graphify-out/**',
+            '.claude/**',
+            // Release-tool output, not prose anyone edits — see GENERATED_DOC_FILES.
+            ...index_js_1.GENERATED_DOC_FILES,
+            ...(userConfig.ignores ?? []),
+        ].map(toIgnoreRegExp);
+        const files = targets.filter(file => !ignores.some(re => re.test(file)));
+        if (files.length === 0)
+            return (0, types_js_1.skip)('no markdown files');
+        try {
+            const config = await readLintConfig(lib, ctx.cwd, userRules);
+            const results = await lib.lint({ files: files.map(f => node_path_1.default.resolve(ctx.cwd, f)), config });
+            let findings = 0;
+            for (const [file, errors] of Object.entries(results)) {
+                if (errors.length === 0)
+                    continue;
+                const rel = node_path_1.default.relative(ctx.cwd, file);
+                let remaining = errors;
+                if (ctx.write && errors.some(e => e.fixInfo)) {
+                    const fixed = lib.applyFixes(node_fs_1.default.readFileSync(file, 'utf-8'), errors);
+                    node_fs_1.default.writeFileSync(file, fixed);
+                    remaining = errors.filter(e => !e.fixInfo);
+                }
+                for (const e of remaining) {
+                    findings++;
+                    const col = e.errorRange?.[0] ? `:${e.errorRange[0]}` : '';
+                    index_js_2.logger.warn(`${rel}:${e.lineNumber}${col} ${e.ruleNames.join('/')} ${e.ruleDescription}` +
+                        (e.errorDetail ? ` [${e.errorDetail}]` : ''));
+                }
+            }
+            return findings === 0 ? (0, types_js_1.pass)() : (0, types_js_1.warn)('markdown lint issues found');
+        }
+        catch (err) {
+            // An unreadable config or a file that vanished: the tool could not run,
+            // which is not the same claim as "the prose has problems".
+            index_js_2.logger.warn(`[Markdown]: ⚠️ ${err}`);
+            return (0, types_js_1.warn)('markdownlint failed to run (exit 2) — check the markdownlint config');
+        }
+    },
+};

package/dist/{core → cjs/core}/checks/quality/package-size.d.ts

@@ -1,4 +1,4 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 /** Why we could not read a published version. */
 export type QueryFailure = 'absent' | 'unauthenticated' | 'unreadable';
 /**

package/dist/{core → cjs/core}/checks/quality/package-size.js

@@ -7,10 +7,10 @@ exports.packageSizeCheck = void 0;
 exports.classifyQueryFailure = classifyQueryFailure;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 /** Growth that is worth a row in the report, unless the client says otherwise. */
 const DEFAULT_MAX_GROWTH = 20;
 /** How many of the files behind the growth are named. */
@@ -44,7 +44,7 @@ async function packManifest(cwd, spec, registry) {
         '--ignore-scripts',
         ...(registry ? ['--registry', registry] : []),
     ];
-    const result = await (0, execa_1.execa)('npm', args, { cwd, reject: false });
+    const result = await (0, execa_js_1.execa)('npm', args, { cwd, reject: false });
     if (result.exitCode !== 0)
         return { failure: classifyQueryFailure(result.stderr ?? '') };
     try {
@@ -152,13 +152,13 @@ exports.packageSizeCheck = {
     async run(ctx) {
         const target = published(ctx.cwd);
         if (!target)
-            return (0, types_1.skip)('no publishable package.json');
+            return (0, types_js_1.skip)('no publishable package.json');
         const tag = ctx.config.packageSize?.compareWith ?? 'latest';
         const maxGrowth = ctx.config.packageSize?.maxGrowthPercent ?? DEFAULT_MAX_GROWTH;
         const spec = `${target.name}@${tag}`;
         const local = await packManifest(ctx.cwd);
         if (!('manifest' in local))
-            return (0, types_1.skip)('npm could not describe this package');
+            return (0, types_js_1.skip)('npm could not describe this package');
         const current = local.manifest;
         // Never a pass: a green row over a comparison that did not happen is the
         // mistake of ticket 072. And never one reason standing in for three — the
@@ -186,7 +186,7 @@ exports.packageSizeCheck = {
                 unauthenticated: `no credentials for ${host ?? 'the registry'}`,
                 unreadable: `could not read the published version${at}`,
             }[remote.failure];
-            return (0, types_1.skip)(reason);
+            return (0, types_js_1.skip)(reason);
         }
         const previous = remote.manifest;
         const delta = current.unpackedSize - previous.unpackedSize;
@@ -194,10 +194,10 @@ exports.packageSizeCheck = {
         const summary = `${mb(previous.unpackedSize)} → ${mb(current.unpackedSize)} ` +
             `(${growth >= 0 ? '+' : ''}${growth.toFixed(1)}%) vs ${previous.version}`;
         if (growth <= maxGrowth) {
-            utils_1.logger.info(`[Package Size]: ✅ ${summary}`);
-            return (0, types_1.pass)(summary);
+            index_js_1.logger.info(`[Package Size]: ✅ ${summary}`);
+            return (0, types_js_1.pass)(summary);
         }
-        (0, findings_1.logSample)('Package Size', `${summary}:`, growthByFile(previous.files, current.files));
-        return (0, types_1.warn)(summary);
+        (0, findings_js_1.logSample)('Package Size', `${summary}:`, growthByFile(previous.files, current.files));
+        return (0, types_js_1.warn)(summary);
     },
 };

package/dist/{core → cjs/core}/checks/quality/spellcheck.d.ts

@@ -1,5 +1,5 @@
-import { CspellConfig } from '../../../interfaces';
-import { Check } from '../../types';
+import { CspellConfig } from '../../../interfaces/index.js';
+import { Check } from '../../types.js';
 /**
  * Anchors an ignore glob to the repository root.
  *

package/dist/{core → cjs/core}/checks/quality/spellcheck.js

@@ -11,11 +11,11 @@ exports.resolveImports = resolveImports;
 exports.dropMissingLanguages = dropMissingLanguages;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const config_1 = require("../../../config");
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
+const index_js_1 = require("../../../config/index.js");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_2 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
 function loadUserCspellConfig(cwd) {
     const configPath = node_path_1.default.join(cwd, 'pr-checkmate.json');
     if (!node_fs_1.default.existsSync(configPath))
@@ -24,7 +24,7 @@ function loadUserCspellConfig(cwd) {
         return JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8')).cspell || {};
     }
     catch (err) {
-        utils_1.logger.warn(`[Spellcheck]: ⚠️ Failed to read cspell config: ${err}`);
+        index_js_2.logger.warn(`[Spellcheck]: ⚠️ Failed to read cspell config: ${err}`);
         return {};
     }
 }
@@ -213,7 +213,7 @@ function resolveFrom(cwd) {
     };
 }
 function createTempCspellConfig(cwd) {
-    const packageConfigPath = (0, config_1.getPackageConfigPath)('cspell.json');
+    const packageConfigPath = (0, index_js_1.getPackageConfigPath)('cspell.json');
     const packageConfigDir = node_path_1.default.dirname(packageConfigPath);
     const defaultConfig = JSON.parse(node_fs_1.default.readFileSync(packageConfigPath, 'utf-8'));
     const userConfig = loadUserCspellConfig(cwd);
@@ -222,14 +222,14 @@ function createTempCspellConfig(cwd) {
     const { resolved, missing } = resolveImports(merged.import ?? [], packageConfigDir, resolve);
     const available = availableDictionaries(resolve);
     for (const { pkg } of missing) {
-        utils_1.logger.info(`[Spellcheck]: dictionary ${pkg} is not installed and was skipped. Add it with \`npm i -D ${pkg}\`.`);
+        index_js_2.logger.info(`[Spellcheck]: dictionary ${pkg} is not installed and was skipped. Add it with \`npm i -D ${pkg}\`.`);
     }
     if (available.absent.length > 0) {
         // `info`, not `debug`. A client who installed a dictionary and saw no change
         // had nothing to read: the one line that would have explained it was behind a
         // flag. Which dictionaries are in play decides which findings appear, so it
         // belongs in the ordinary log (ticket 081).
-        utils_1.logger.info(`[Spellcheck]: optional dictionaries not installed: ${available.absent.join(', ')}. ` +
+        index_js_2.logger.info(`[Spellcheck]: optional dictionaries not installed: ${available.absent.join(', ')}. ` +
             `Install any of them to spellcheck that language (\`npm i -D ${available.absent[0]}\`).`);
     }
     // A language the client asked for whose dictionary is absent is dropped rather
@@ -259,9 +259,9 @@ exports.spellcheckCheck = {
         return ctx.config.cspell?.enabled !== false && ctx.config.spellcheck?.enabled !== false;
     },
     async run(ctx) {
-        const targets = await (0, targets_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx', '*.md', '*.mdx', '*.json'], (0, config_1.getSourcePaths)(ctx.cwd));
+        const targets = await (0, targets_js_1.resolveScopedTargetFiles)(ctx, ['*.ts', '*.tsx', '*.js', '*.jsx', '*.md', '*.mdx', '*.json'], (0, index_js_1.getSourcePaths)(ctx.cwd));
         if (targets === null)
-            return (0, types_1.skip)('git unavailable');
+            return (0, types_js_1.skip)('git unavailable');
         // Committed build output and test reports are dropped here, in JS, against
         // repo-RELATIVE paths — a client cannot fix a typo in a generated file, so
         // reporting one is noise that buries the real findings. Neither cspell
@@ -272,12 +272,12 @@ exports.spellcheckCheck = {
         // rule for every repo. `ignoreDirs` already covers plain directory names via
         // `resolveTargetFiles`; this adds the composite globs it cannot express
         // (`**/cypress/videos/**`, `**/jest-html-reporters-*/**`).
-        const files = targets.filter(f => !(0, utils_1.matchesAnyGlob)(f, config_1.IGNORE_PATTERNS));
+        const files = targets.filter(f => !(0, index_js_2.matchesAnyGlob)(f, index_js_1.IGNORE_PATTERNS));
         if (files.length === 0)
-            return (0, types_1.pass)('no files to spellcheck');
-        const hasLocal = (0, config_1.hasLocalConfig)(['cspell.json', '.cspell.json', 'cspell.config.json'], ctx.cwd);
+            return (0, types_js_1.pass)('no files to spellcheck');
+        const hasLocal = (0, index_js_1.hasLocalConfig)(['cspell.json', '.cspell.json', 'cspell.config.json'], ctx.cwd);
         let tempConfigPath = null;
-        const cspellBin = (0, utils_1.resolvePackageBin)('cspell', 'bin.mjs');
+        const cspellBin = (0, index_js_2.resolvePackageBin)('cspell', 'bin.mjs');
         // `--no-must-find-files`: cspell exits 1 when it checked nothing, which the
         // exit-code mapping below would report as "spelling issues found" — a warning
         // about problems that do not exist. Every file being excluded is a pass, not a
@@ -292,16 +292,16 @@ exports.spellcheckCheck = {
             args = [...baseArgs, '--config', tempConfigPath];
         }
         try {
-            const result = await (0, execa_1.execa)(process.execPath, [cspellBin, ...args], {
+            const result = await (0, execa_js_1.execa)(process.execPath, [cspellBin, ...args], {
                 cwd: ctx.cwd,
                 reject: false,
                 stdio: 'inherit',
             });
-            return result.exitCode === 0 ? (0, types_1.pass)() : (0, types_1.warn)('spelling issues found');
+            return result.exitCode === 0 ? (0, types_js_1.pass)() : (0, types_js_1.warn)('spelling issues found');
         }
         finally {
             if (tempConfigPath)
-                (0, utils_1.cleanupTempFile)(tempConfigPath);
+                (0, index_js_2.cleanupTempFile)(tempConfigPath);
         }
     },
 };

package/dist/{core → cjs/core}/checks/quality/symlinks.d.ts

@@ -1,4 +1,4 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 /** True when `fullPath` is a symlink whose target does not exist. */
 export declare function isBrokenSymlink(fullPath: string): boolean;
 /**