pr-checkmate 3.0.4 → 3.2.0

package/dist/{core → cjs/core}/checks/quality/symlinks.js

@@ -7,10 +7,10 @@ exports.symlinksCheck = void 0;
 exports.isBrokenSymlink = isBrokenSymlink;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const utils_1 = require("../../../utils");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const index_js_1 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 /** True when `fullPath` is a symlink whose target does not exist. */
 function isBrokenSymlink(fullPath) {
     let stat;
@@ -41,7 +41,7 @@ exports.symlinksCheck = {
         return ctx.config.symlinks?.enabled !== false;
     },
     async run(ctx) {
-        const files = await (0, targets_1.resolveTargets)(ctx, ['*'], {
+        const files = await (0, targets_js_1.resolveTargets)(ctx, ['*'], {
             wholeTree: true,
             onEmpty: { skip: 'no tracked files' },
         });
@@ -50,14 +50,14 @@ exports.symlinksCheck = {
         const ignore = ctx.config.symlinks?.ignore ?? [];
         const broken = [];
         for (const file of files) {
-            if (ignore.length > 0 && (0, utils_1.matchesAnyGlob)(file, ignore))
+            if (ignore.length > 0 && (0, index_js_1.matchesAnyGlob)(file, ignore))
                 continue;
             if (isBrokenSymlink(node_path_1.default.join(ctx.cwd, file)))
                 broken.push(file);
         }
         if (broken.length === 0)
-            return (0, types_1.pass)();
-        const sev = (0, findings_1.severityEmitter)(ctx.config.symlinks?.severity, 'warn');
+            return (0, types_js_1.pass)();
+        const sev = (0, findings_js_1.severityEmitter)(ctx.config.symlinks?.severity, 'warn');
         broken.forEach(f => sev.log(`[Broken Symlinks]: ${sev.icon} ${f} — target does not exist`));
         return sev.emit(`${broken.length} broken symlink(s)`);
     },

package/dist/{core → cjs/core}/checks/quality/yaml-lint.d.ts

@@ -1,4 +1,4 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 /**
  * True when a parser problem describes something actually wrong with the file —
  * a syntax error, a duplicate key, a tab used for indentation.

package/dist/{core → cjs/core}/checks/quality/yaml-lint.js

@@ -8,10 +8,10 @@ exports.isFileDefect = isFileDefect;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const yaml_1 = require("yaml");
-const utils_1 = require("../../../utils");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const index_js_1 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 /** First line of a `yaml` error/warning message, stripped of its source excerpt. */
 function shortMessage(message) {
     return message.split('\n')[0].trim();
@@ -58,17 +58,17 @@ exports.yamlLintCheck = {
     async run(ctx) {
         // Keep the CI/workflow dirs that are globally ignored: they hold the very
         // YAML (GitHub Actions, GitLab CI, CircleCI) a YAML linter most needs to see.
-        const allTargets = await (0, targets_1.resolveTargetFiles)(ctx, ['*.yml', '*.yaml'], {
+        const allTargets = await (0, targets_js_1.resolveTargetFiles)(ctx, ['*.yml', '*.yaml'], {
             keepDirs: ['.github', '.gitlab', '.circleci'],
         });
         if (allTargets === null)
-            return (0, types_1.skip)('git unavailable');
+            return (0, types_js_1.skip)('git unavailable');
         if (allTargets.length === 0)
-            return (0, types_1.skip)('no YAML files');
+            return (0, types_js_1.skip)('no YAML files');
         const ignore = ctx.config.yamlLint?.ignore ?? [];
-        const targets = ignore.length > 0 ? allTargets.filter(f => !(0, utils_1.matchesAnyGlob)(f, ignore)) : allTargets;
+        const targets = ignore.length > 0 ? allTargets.filter(f => !(0, index_js_1.matchesAnyGlob)(f, ignore)) : allTargets;
         if (targets.length === 0)
-            return (0, types_1.skip)('all YAML files ignored');
+            return (0, types_js_1.skip)('all YAML files ignored');
         const issues = [];
         for (const file of targets) {
             let source;
@@ -76,7 +76,7 @@ exports.yamlLintCheck = {
                 source = node_fs_1.default.readFileSync(node_path_1.default.join(ctx.cwd, file), 'utf-8');
             }
             catch (err) {
-                utils_1.logger.warn(`[YAML Lint]: ⚠️ Could not read ${file}: ${err}`);
+                index_js_1.logger.warn(`[YAML Lint]: ⚠️ Could not read ${file}: ${err}`);
                 continue;
             }
             // parseAllDocuments never throws — it collects problems on each document,
@@ -100,7 +100,7 @@ exports.yamlLintCheck = {
             }
         }
         if (issues.length === 0)
-            return (0, types_1.pass)();
+            return (0, types_js_1.pass)();
         // A file that does not parse blocks; a file that parses and merely worries
         // the parser does not. Treating both as blocking is what made this check
         // feel like an obstacle rather than a gate — and a check people switch off
@@ -109,7 +109,7 @@ exports.yamlLintCheck = {
         const broken = issues.filter(i => i.blocking);
         const questionable = issues.filter(i => !i.blocking);
         const describe = (i) => `${i.file}${i.line ? `:${i.line}${i.col ? `:${i.col}` : ''}` : ''} — ${i.message}`;
-        const sev = (0, findings_1.severityEmitter)(configured, broken.length > 0 ? 'error' : 'warn');
+        const sev = (0, findings_js_1.severityEmitter)(configured, broken.length > 0 ? 'error' : 'warn');
         [...broken, ...questionable]
             .slice(0, 10)
             .forEach(i => sev.log(`[YAML Lint]: ${sev.icon} ${describe(i)}`));

package/dist/{core → cjs/core}/checks/security/diff-security.d.ts

@@ -1,2 +1,2 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 export declare const diffSecurityCheck: Check;

package/dist/{core → cjs/core}/checks/security/diff-security.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.diffSecurityCheck = void 0;
-const config_1 = require("../../../config");
-const utils_1 = require("../../../utils");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const index_js_1 = require("../../../config/index.js");
+const index_js_2 = require("../../../utils/index.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 const MD5_LABEL = 'MD5 (weak hash — use sha256 or stronger)';
 const SHA1_LABEL = 'SHA-1 (weak hash — use sha256 or stronger)';
 const SECURITY_PATTERNS = [
@@ -262,7 +262,7 @@ function compileExtraPatterns(ctx) {
             ];
         }
         catch (err) {
-            utils_1.logger.warn(`[Diff Security]: ⚠️ ignoring extraPattern "${rule.label}" — invalid regex: ${err}`);
+            index_js_2.logger.warn(`[Diff Security]: ⚠️ ignoring extraPattern "${rule.label}" — invalid regex: ${err}`);
             return [];
         }
     });
@@ -290,21 +290,21 @@ exports.diffSecurityCheck = {
     async run(ctx) {
         try {
             const cfg = ctx.config.diffSecurity ?? {};
-            const found = (0, findings_1.emptyBuckets)();
+            const found = (0, findings_js_1.emptyBuckets)();
             const scanOpts = {
                 comments: cfg.commentHandling ?? 'language',
                 // Setting `ignorePaths` REPLACES the test-path defaults rather than adding
                 // to them, matching `duplicate.ignore` and `deadCode.ignoreFiles`. A client
                 // who wants their tests scanned says so by listing something else here.
-                ignorePaths: cfg.ignorePaths ?? config_1.DIFF_SECURITY_IGNORE_DEFAULTS,
+                ignorePaths: cfg.ignorePaths ?? index_js_1.DIFF_SECURITY_IGNORE_DEFAULTS,
                 // This check owns the cross-line heuristic, so it is the one that turns it
                 // on. `0` from the client switches it off.
-                dataflowWindow: cfg.dataflowWindow ?? findings_1.DEFAULT_DATAFLOW_WINDOW,
+                dataflowWindow: cfg.dataflowWindow ?? findings_js_1.DEFAULT_DATAFLOW_WINDOW,
             };
             const extra = compileExtraPatterns(ctx);
             const disabled = cfg.disablePatterns ?? [];
             const scanInto = (stdout, patterns) => {
-                (0, findings_1.mergeSeverityBuckets)(found, (0, findings_1.scanDiffPatterns)(stdout, activePatterns(patterns, disabled), scanOpts));
+                (0, findings_js_1.mergeSeverityBuckets)(found, (0, findings_js_1.scanDiffPatterns)(stdout, activePatterns(patterns, disabled), scanOpts));
             };
             /**
              * Feed one language's sources through the patterns, from the diff when
@@ -317,7 +317,7 @@ exports.diffSecurityCheck = {
              * distinction lived in two places, one of them a blocking security check
              * (ticket 079).
              */
-            const review = (globs, patterns) => (0, findings_1.reviewLines)(ctx, globs, stdout => scanInto(stdout, patterns));
+            const review = (globs, patterns) => (0, findings_js_1.reviewLines)(ctx, globs, stdout => scanInto(stdout, patterns));
             // JS/TS patterns always run; language-specific sets scan their own globs
             // only when that language is present, so a Python repo gets Python rules.
             // Client `extraPatterns` run against every scanned language, since a
@@ -340,18 +340,18 @@ exports.diffSecurityCheck = {
                 // here: three of five language sets scanned, reported as a pass, reads
                 // as a clean repository (ticket 072).
                 if (!(await review(globs, patterns)))
-                    return (0, types_1.skip)('git unavailable');
+                    return (0, types_js_1.skip)('git unavailable');
             }
-            return (0, findings_1.reportSeverityBuckets)(found.errors, found.warnings, {
+            return (0, findings_js_1.reportSeverityBuckets)(found.errors, found.warnings, {
                 prefix: 'Diff Security',
                 errorSummary: n => `${n} issue(s)`,
                 warningSummary: n => `${n} warning(s)`,
-                ...(0, findings_1.clientFindingOptions)(ctx, cfg),
+                ...(0, findings_js_1.clientFindingOptions)(ctx, cfg),
             });
         }
         catch (err) {
-            utils_1.logger.warn(`[Diff Security]: ⚠️ Could not analyze diff\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
+            index_js_2.logger.warn(`[Diff Security]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_js_1.skip)('diff unavailable');
         }
     },
 };

package/dist/{core → cjs/core}/checks/security/dockerfile-security.d.ts

@@ -1,2 +1,2 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 export declare const dockerfileSecurityCheck: Check;

package/dist/{core → cjs/core}/checks/security/dockerfile-security.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.dockerfileSecurityCheck = void 0;
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 const DOCKERFILE_GLOBS = ['**/Dockerfile', '**/Dockerfile.*', '**/*.Dockerfile'];
 /** Common Dockerfile security smells, matched on added diff lines. */
 const DOCKER_PATTERNS = [
@@ -60,42 +60,42 @@ exports.dockerfileSecurityCheck = {
         return ctx.config.dockerfileSecurity?.enabled !== false;
     },
     async run(ctx) {
-        const files = await (0, targets_1.resolveTargetFiles)(ctx, ['*']);
+        const files = await (0, targets_js_1.resolveTargetFiles)(ctx, ['*']);
         if (files === null)
-            return (0, types_1.skip)('git unavailable');
-        const dockerfiles = files.filter(f => (0, utils_1.matchesAnyGlob)(f, DOCKERFILE_GLOBS));
+            return (0, types_js_1.skip)('git unavailable');
+        const dockerfiles = files.filter(f => (0, index_js_1.matchesAnyGlob)(f, DOCKERFILE_GLOBS));
         if (dockerfiles.length === 0)
-            return (0, types_1.pass)();
+            return (0, types_js_1.pass)();
         try {
             const cfg = ctx.config.dockerfileSecurity ?? {};
             let stdout = '';
             if (ctx.baseSha) {
-                stdout = (await (0, execa_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...dockerfiles], { cwd: ctx.cwd })).stdout;
+                stdout = (await (0, execa_js_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...dockerfiles], { cwd: ctx.cwd })).stdout;
             }
             else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
-                await (0, findings_1.scanTrackedFiles)(ctx, dockerfiles, asDiff => {
+                await (0, findings_js_1.scanTrackedFiles)(ctx, dockerfiles, asDiff => {
                     stdout += `${asDiff}\n`;
                 });
             }
             // This check runs `git diff` itself rather than going through
             // `diffAddedLines`, so the `pr-checkmate-ignore` opt-out is applied here.
-            const { errors, warnings } = (0, findings_1.scanDiffPatterns)(stdout, DOCKER_PATTERNS, {
+            const { errors, warnings } = (0, findings_js_1.scanDiffPatterns)(stdout, DOCKER_PATTERNS, {
                 skipIgnored: true,
                 // Dockerfiles have no extension to key off, and `#` is their comment
                 // marker — the `hash` reading, not the language-detected one.
                 comments: 'legacy',
                 ignorePaths: cfg.ignorePaths,
             });
-            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
+            return (0, findings_js_1.reportSeverityBuckets)(errors, warnings, {
                 prefix: 'Dockerfile Security',
                 errorSummary: n => `${n} issue(s)`,
                 warningSummary: n => `${n} warning(s)`,
-                ...(0, findings_1.clientFindingOptions)(ctx, cfg),
+                ...(0, findings_js_1.clientFindingOptions)(ctx, cfg),
             });
         }
         catch (err) {
-            utils_1.logger.warn(`[Dockerfile Security]: ⚠️ Could not analyze diff\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
+            index_js_1.logger.warn(`[Dockerfile Security]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_js_1.skip)('diff unavailable');
         }
     },
 };

package/dist/{core → cjs/core}/checks/security/migration-safety.d.ts

@@ -1,2 +1,2 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 export declare const migrationSafetyCheck: Check;

package/dist/{core → cjs/core}/checks/security/migration-safety.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.migrationSafetyCheck = void 0;
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 /**
  * Paths treated as database migrations. A client overrides via
  * `migrationSafety.paths` (REPLACES this list).
@@ -69,7 +69,7 @@ function withoutComment(line) {
     // after the `+`, where a boundary rule looking for whitespace or line-start
     // does not see it — which is exactly the shape a commented-out statement takes.
     const marker = line.startsWith('+') ? '+' : '';
-    const body = (0, findings_1.stripInlineComment)(line.slice(marker.length), 'hash').replace(/(^|\s)--.*$/, '$1');
+    const body = (0, findings_js_1.stripInlineComment)(line.slice(marker.length), 'hash').replace(/(^|\s)--.*$/, '$1');
     return marker + body;
 }
 /** Bucket dangerous added lines by risk label, honouring the opt-out directive. */
@@ -102,28 +102,28 @@ exports.migrationSafetyCheck = {
     async run(ctx) {
         // Not sourcePath-scoped: migrations commonly live outside `src` (db/, alembic/).
         // ignoreDirs still applies via resolveTargetFiles.
-        const files = await (0, targets_1.resolveTargetFiles)(ctx, ['*']);
+        const files = await (0, targets_js_1.resolveTargetFiles)(ctx, ['*']);
         if (files === null)
-            return (0, types_1.skip)('git unavailable');
+            return (0, types_js_1.skip)('git unavailable');
         const globs = ctx.config.migrationSafety?.paths ?? DEFAULT_MIGRATION_GLOBS;
-        const migrationFiles = files.filter(f => (0, utils_1.matchesAnyGlob)(f, globs));
+        const migrationFiles = files.filter(f => (0, index_js_1.matchesAnyGlob)(f, globs));
         if (migrationFiles.length === 0)
-            return (0, types_1.pass)();
+            return (0, types_js_1.pass)();
         try {
             let stdout = '';
             if (ctx.baseSha) {
-                stdout = (await (0, execa_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...migrationFiles], { cwd: ctx.cwd })).stdout;
+                stdout = (await (0, execa_js_1.execa)('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...migrationFiles], { cwd: ctx.cwd })).stdout;
             }
             else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
-                await (0, findings_1.scanTrackedFiles)(ctx, migrationFiles, asDiff => {
+                await (0, findings_js_1.scanTrackedFiles)(ctx, migrationFiles, asDiff => {
                     stdout += `${asDiff}\n`;
                 });
             }
             const findings = {};
             scan(stdout, findings);
-            if ((0, findings_1.bucketTotal)(findings) === 0)
-                return (0, types_1.pass)();
-            return (0, findings_1.reportCountedFindings)(findings, ctx, {
+            if ((0, findings_js_1.bucketTotal)(findings) === 0)
+                return (0, types_js_1.pass)();
+            return (0, findings_js_1.reportCountedFindings)(findings, ctx, {
                 prefix: 'Migration Safety',
                 severity: ctx.config.migrationSafety?.severity,
                 sampleLimit: ctx.config.log?.sampleLimit ?? 2,
@@ -133,8 +133,8 @@ exports.migrationSafetyCheck = {
             });
         }
         catch (err) {
-            utils_1.logger.warn(`[Migration Safety]: ⚠️ Could not analyze diff\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
+            index_js_1.logger.warn(`[Migration Safety]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_js_1.skip)('diff unavailable');
         }
     },
 };

package/dist/{core → cjs/core}/checks/security/security.d.ts

@@ -1,4 +1,4 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 /**
  * A HOME the scanner can actually write to.
  *

package/dist/{core → cjs/core}/checks/security/security.js

@@ -10,10 +10,10 @@ exports.looksLikeCrash = looksLikeCrash;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
-const config_1 = require("../../../config");
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const types_1 = require("../../types");
+const index_js_1 = require("../../../config/index.js");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_2 = require("../../../utils/index.js");
+const types_js_1 = require("../../types.js");
 /**
  * A HOME the scanner can actually write to.
  *
@@ -79,7 +79,7 @@ function writableHome() {
     const fallback = node_os_1.default.tmpdir();
     try {
         node_fs_1.default.accessSync(fallback, node_fs_1.default.constants.W_OK);
-        utils_1.logger.info(`[Security Scan]: HOME (${home}) is not writable — caching the scanner in ${fallback}`);
+        index_js_2.logger.info(`[Security Scan]: HOME (${home}) is not writable — caching the scanner in ${fallback}`);
         return fallback;
     }
     catch {
@@ -120,13 +120,13 @@ exports.securityCheck = {
         // tool (knip, license-checker) already skips here; this one did not.
         let gitleaksBin;
         try {
-            gitleaksBin = (0, utils_1.resolvePackageBin)('gitleaks-secret-scanner-fixed', 'dist/bin/cli.js');
+            gitleaksBin = (0, index_js_2.resolvePackageBin)('gitleaks-secret-scanner-fixed', 'dist/bin/cli.js');
         }
         catch {
-            utils_1.logger.warn('[Security Scan]: ⚠️ bundled gitleaks scanner could not be resolved — skipping');
-            return (0, types_1.skip)('gitleaks unavailable');
+            index_js_2.logger.warn('[Security Scan]: ⚠️ bundled gitleaks scanner could not be resolved — skipping');
+            return (0, types_js_1.skip)('gitleaks unavailable');
         }
-        const hasClientConfig = (0, config_1.hasLocalConfig)(['.gitleaks.toml', 'gitleaks.toml', '.gitleaks/config.toml'], ctx.cwd);
+        const hasClientConfig = (0, index_js_1.hasLocalConfig)(['.gitleaks.toml', 'gitleaks.toml', '.gitleaks/config.toml'], ctx.cwd);
         // Pin the gitleaks binary version so the scanner never reaches out to the
         // GitHub API for the "latest" version — that network call adds latency and
         // times out in locked-down/offline CI (the scanner already falls back to
@@ -145,15 +145,15 @@ exports.securityCheck = {
         // after printing `fatal: not a git repository` and "An unexpected error
         // occurred" — alarming output about the tool, for a directory it was never
         // able to review. Every other check skips when git is unusable; so does this.
-        if (!isDelta && !(await (0, utils_1.resolveGitRef)(ctx.cwd, 'HEAD'))) {
-            return (0, types_1.skip)('git history unavailable');
+        if (!isDelta && !(await (0, index_js_2.resolveGitRef)(ctx.cwd, 'HEAD'))) {
+            return (0, types_js_1.skip)('git history unavailable');
         }
         const args = isDelta
             ? ['--diff-mode', 'ci']
             : ['--diff-mode', 'history', ...(depth ? ['--depth', String(depth)] : [])];
         args.push('--gitleaks-version', gitleaksVersion);
         if (!hasClientConfig) {
-            args.push('--config', (0, config_1.getPackageConfigPath)('gitleaks.toml'));
+            args.push('--config', (0, index_js_1.getPackageConfigPath)('gitleaks.toml'));
         }
         // A machine-readable copy of the findings, purely so the outcome can carry a
         // number. Written to a temp directory, never into the repository under review:
@@ -163,10 +163,10 @@ exports.securityCheck = {
         const reportDir = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'pr-checkmate-gitleaks-'));
         const reportPath = node_path_1.default.join(reportDir, 'findings.json');
         args.push('--report-format', 'json', '--report-path', reportPath);
-        utils_1.logger.info(`[Security Scan]: scanning ${isDelta ? 'the diff range' : `full history${depth ? ` (last ${depth} commits)` : ''}`}`);
+        index_js_2.logger.info(`[Security Scan]: scanning ${isDelta ? 'the diff range' : `full history${depth ? ` (last ${depth} commits)` : ''}`}`);
         const home = writableHome();
         if (!home)
-            return (0, types_1.skip)('no writable directory for the scanner cache');
+            return (0, types_js_1.skip)('no writable directory for the scanner cache');
         const env = {
             ...process.env,
             HOME: home,
@@ -176,7 +176,7 @@ exports.securityCheck = {
         // stdout stays inherited so the scanner's own report streams to the log as it
         // always has; stderr is captured because it is the only thing that separates
         // a crash from a finding — see `crashed`.
-        const result = await (0, execa_1.execa)(process.execPath, [gitleaksBin, ...args], {
+        const result = await (0, execa_js_1.execa)(process.execPath, [gitleaksBin, ...args], {
             cwd: ctx.cwd,
             env,
             stdio: ['ignore', 'inherit', 'pipe'],
@@ -184,11 +184,11 @@ exports.securityCheck = {
         });
         const stderr = String(result.stderr ?? '');
         if (stderr.trim())
-            utils_1.logger.warn(stderr.trimEnd());
+            index_js_2.logger.warn(stderr.trimEnd());
         const found = countFindings(reportPath);
         node_fs_1.default.rmSync(reportDir, { recursive: true, force: true });
         if (result.exitCode === 0)
-            return (0, types_1.pass)();
+            return (0, types_js_1.pass)();
         // gitleaks exits 1 specifically when it finds secrets — but so does Node when
         // the wrapper around it throws. Only the second one leaves a stack trace.
         if (result.exitCode === 1 && !looksLikeCrash(stderr)) {
@@ -198,13 +198,13 @@ exports.securityCheck = {
             // nothing else, so a blocking check told the client to open something that
             // does not exist (ticket 085).
             const summary = secretsSummary(found);
-            utils_1.logger.warn(`⚠️ gitleaks found ${summary} — see the findings above`);
-            return (0, types_1.fail)(summary);
+            index_js_2.logger.warn(`⚠️ gitleaks found ${summary} — see the findings above`);
+            return (0, types_js_1.fail)(summary);
         }
         const detail = looksLikeCrash(stderr)
             ? 'scanner failed to start — nothing was scanned'
             : `scanner error (exit ${result.exitCode})`;
-        utils_1.logger.warn(`[Security Scan]: ⚠️ ${detail}`);
-        return (0, types_1.warn)(detail);
+        index_js_2.logger.warn(`[Security Scan]: ⚠️ ${detail}`);
+        return (0, types_js_1.warn)(detail);
     },
 };

package/dist/{core → cjs/core}/checks/security/sensitive-file-guard.d.ts

@@ -1,2 +1,2 @@
-import { Check } from '../../types';
+import { Check } from '../../types.js';
 export declare const sensitiveFileGuardCheck: Check;

package/dist/{core → cjs/core}/checks/security/sensitive-file-guard.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sensitiveFileGuardCheck = void 0;
-const utils_1 = require("../../../utils");
-const execa_1 = require("../../../utils/execa");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const execa_js_1 = require("../../../utils/execa.js");
+const index_js_1 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 /**
  * The committed template, in the names every ecosystem uses for it.
  *
@@ -111,15 +111,15 @@ exports.sensitiveFileGuardCheck = {
                 ? ['diff', '--name-only', '--diff-filter=ACMRD', ctx.baseSha, ctx.headSha ?? 'HEAD']
                 : ['ls-files'];
             if (!ctx.baseSha && ctx.config.run?.fullScanBehaviour === 'skip')
-                return (0, types_1.pass)();
+                return (0, types_js_1.pass)();
             // `reject: false` so a directory that is not a repository is an ordinary
             // outcome rather than a thrown error whose message carries git's raw
             // `fatal: not a git repository` into the log. The check still skips — but
             // a skip with a reason reads as a decision, while a bare `fatal:` reads as
             // a crash, and someone has to spend time proving it was not one.
-            const result = await (0, execa_1.execa)('git', args, { cwd: ctx.cwd, reject: false });
+            const result = await (0, execa_js_1.execa)('git', args, { cwd: ctx.cwd, reject: false });
             if (result.exitCode !== 0)
-                return (0, types_1.skip)('git unavailable');
+                return (0, types_js_1.skip)('git unavailable');
             const cfg = ctx.config.sensitiveFileGuard ?? {};
             // Path exclusions are applied before categorising, so one false positive —
             // a `.pem` test fixture, a committed `.env.example` — is excused by name.
@@ -137,11 +137,11 @@ exports.sensitiveFileGuardCheck = {
             // exclusion that reaches every check. It did not reach this one, which
             // meant a `.pem` test fixture failed the build and the key the docs told
             // people to reach for did nothing (ticket 080).
-            const changedFiles = (0, targets_1.excludeClientPaths)(result.stdout.split('\n').filter(Boolean), ctx.cwd).filter(file => !(0, utils_1.matchesAnyGlob)(file, cfg.ignorePaths ?? []));
+            const changedFiles = (0, targets_js_1.excludeClientPaths)(result.stdout.split('\n').filter(Boolean), ctx.cwd).filter(file => !(0, index_js_1.matchesAnyGlob)(file, cfg.ignorePaths ?? []));
             if (changedFiles.length === 0)
-                return (0, types_1.pass)();
+                return (0, types_js_1.pass)();
             const { errors, warnings } = categorizeFiles(changedFiles);
-            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
+            return (0, findings_js_1.reportSeverityBuckets)(errors, warnings, {
                 prefix: 'Sensitive Files',
                 // "changed" is only true of a diff; a full scan is answering a different
                 // question — what the repository contains — and saying otherwise would
@@ -149,15 +149,15 @@ exports.sensitiveFileGuardCheck = {
                 errorSummary: n => `${n} sensitive file(s) ${ctx.baseSha ? 'changed' : 'in the repo'}`,
                 warningSummary: n => `${n} notable file(s) ${ctx.baseSha ? 'changed' : 'in the repo'}`,
                 showCount: false,
-                ...(0, findings_1.clientFindingOptions)(ctx, cfg),
+                ...(0, findings_js_1.clientFindingOptions)(ctx, cfg),
                 // Every sensitive path is listed rather than sampled: knowing that eight
                 // files are in play but only which three is not an answer anyone can act on.
                 sampleLimit: undefined,
             });
         }
         catch (err) {
-            utils_1.logger.warn(`[Sensitive Files]: ⚠️ Could not check file changes\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
+            index_js_1.logger.warn(`[Sensitive Files]: ⚠️ Could not check file changes\n${err}`);
+            return (0, types_js_1.skip)('diff unavailable');
         }
     },
 };

package/dist/{core → cjs/core}/checks/security/workflow-security.d.ts

@@ -1,5 +1,5 @@
-import { Check } from '../../types';
-import { DiffPattern } from '../findings';
+import { Check } from '../../types.js';
+import { DiffPattern } from '../findings.js';
 /**
  * GitHub Actions workflow risks, matched on added diff lines of workflow files.
  * These are the high-frequency supply-chain / injection footguns.

package/dist/{core → cjs/core}/checks/security/workflow-security.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.workflowSecurityCheck = exports.WORKFLOW_PATTERNS = void 0;
-const utils_1 = require("../../../utils");
-const targets_1 = require("../../targets");
-const types_1 = require("../../types");
-const findings_1 = require("../findings");
+const index_js_1 = require("../../../utils/index.js");
+const targets_js_1 = require("../../targets.js");
+const types_js_1 = require("../../types.js");
+const findings_js_1 = require("../findings.js");
 /**
  * A YAML key binding — `HEAD_REF: ${{ … }}`, `ref: ${{ … }}` — rather than an
  * interpolation inside a script body.
@@ -69,35 +69,35 @@ exports.workflowSecurityCheck = {
         try {
             const globs = ['.github/workflows/*.yml', '.github/workflows/*.yaml'];
             const cfg = ctx.config.workflowSecurity ?? {};
-            const found = (0, findings_1.emptyBuckets)();
+            const found = (0, findings_js_1.emptyBuckets)();
             const scanInto = (stdout) => {
                 // `diffAddedLines` already dropped `pr-checkmate-ignore` lines, and
                 // `scanTrackedFiles` does the same for the whole-file path.
-                (0, findings_1.mergeSeverityBuckets)(found, (0, findings_1.scanDiffPatterns)(stdout, exports.WORKFLOW_PATTERNS, { ignorePaths: cfg.ignorePaths }));
+                (0, findings_js_1.mergeSeverityBuckets)(found, (0, findings_js_1.scanDiffPatterns)(stdout, exports.WORKFLOW_PATTERNS, { ignorePaths: cfg.ignorePaths }));
             };
             if (ctx.baseSha) {
-                scanInto(await (0, findings_1.diffAddedLines)(ctx, globs));
+                scanInto(await (0, findings_js_1.diffAddedLines)(ctx, globs));
             }
             else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
                 // `.github` is globally ignored and is the only place these files live,
                 // so this caller has to un-ignore it or scan nothing.
-                const files = await (0, targets_1.listTrackedFiles)(ctx, globs, ['.'], {
+                const files = await (0, targets_js_1.listTrackedFiles)(ctx, globs, ['.'], {
                     keepDirs: ['.github', '.gitlab', '.circleci'],
                 });
                 if (files === null)
-                    return (0, types_1.skip)('git unavailable');
-                await (0, findings_1.scanTrackedFiles)(ctx, files, scanInto);
+                    return (0, types_js_1.skip)('git unavailable');
+                await (0, findings_js_1.scanTrackedFiles)(ctx, files, scanInto);
             }
-            return (0, findings_1.reportSeverityBuckets)(found.errors, found.warnings, {
+            return (0, findings_js_1.reportSeverityBuckets)(found.errors, found.warnings, {
                 prefix: 'Workflow Security',
                 errorSummary: n => `${n} issue(s)`,
                 warningSummary: n => `${n} warning(s)`,
-                ...(0, findings_1.clientFindingOptions)(ctx, cfg),
+                ...(0, findings_js_1.clientFindingOptions)(ctx, cfg),
             });
         }
         catch (err) {
-            utils_1.logger.warn(`[Workflow Security]: ⚠️ Could not analyze diff\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
+            index_js_1.logger.warn(`[Workflow Security]: ⚠️ Could not analyze diff\n${err}`);
+            return (0, types_js_1.skip)('diff unavailable');
         }
     },
 };