pr-checkmate 3.2.2 → 3.3.0

package/dist/esm/core/checks/quality/duplicate-check.js

@@ -6,7 +6,7 @@ import { getSourcePaths } from '../../../config/index.js';
 import { execa } from '../../../utils/execa.js';
 import { logger, resolvePackageBin } from '../../../utils/index.js';
 import { resolveScopedTargetFiles } from '../../targets.js';
-import { pass, warn, skip } from '../../types.js';
+import { pass, skip, warn } from '../../types.js';
 import { logSample } from '../findings.js';
 /**
  * The files to hand jscpd, per language.

package/dist/esm/core/checks/quality/markdown-lint.js

@@ -4,7 +4,7 @@ import { pathToFileURL } from 'node:url';
 import { GENERATED_DOC_FILES, getPackageConfigPath, hasLocalConfig, } from '../../../config/index.js';
 import { logger, resolvePackageBin } from '../../../utils/index.js';
 import { resolveTargetFiles } from '../../targets.js';
-import { pass, warn, skip } from '../../types.js';
+import { pass, skip, warn } from '../../types.js';
 function loadUserMarkdownConfig(cwd) {
     const configPath = path.join(cwd, 'pr-checkmate.json');
     if (!fs.existsSync(configPath))

package/dist/esm/core/checks/quality/package-size.d.ts

@@ -1,6 +1,27 @@
 import { Check } from '../../types.js';
+/** The slice of `npm pack --dry-run --json` this check reads. */
+interface PackedFile {
+    path: string;
+    size: number;
+}
+interface PackManifest {
+    name: string;
+    version: string;
+    size: number;
+    unpackedSize: number;
+    entryCount: number;
+    files: PackedFile[];
+}
+/**
+ * The manifest out of whatever `npm pack --json` printed.
+ *
+ * npm 10 prints `[ {manifest} ]`; npm 11 prints `{ "<name>": {manifest} }`. Reading
+ * only the first form turned every npm 11 runner into "could not describe this
+ * package" and the check into a permanent skip.
+ */
+export declare function pickManifest(parsed: unknown): PackManifest | null;
 /** Why we could not read a published version. */
-export type QueryFailure = 'absent' | 'unauthenticated' | 'unreadable';
+type QueryFailure = 'absent' | 'unauthenticated' | 'unreadable';
 /**
  * Tell "never published" apart from "we were not let in".
  *
@@ -34,3 +55,4 @@ export declare function classifyQueryFailure(stderr: string): QueryFailure;
  * { "Package Size": "error" }` makes it a gate for a repository that wants one.
  */
 export declare const packageSizeCheck: Check;
+export {};

package/dist/esm/core/checks/quality/package-size.js

@@ -8,6 +8,22 @@ import { logSample } from '../findings.js';
 const DEFAULT_MAX_GROWTH = 20;
 /** How many of the files behind the growth are named. */
 const NAMED_FILES = 5;
+/**
+ * The manifest out of whatever `npm pack --json` printed.
+ *
+ * npm 10 prints `[ {manifest} ]`; npm 11 prints `{ "<name>": {manifest} }`. Reading
+ * only the first form turned every npm 11 runner into "could not describe this
+ * package" and the check into a permanent skip.
+ */
+export function pickManifest(parsed) {
+    const entries = Array.isArray(parsed)
+        ? parsed
+        : parsed !== null && typeof parsed === 'object'
+            ? Object.values(parsed)
+            : [];
+    const first = entries[0];
+    return first !== null && typeof first === 'object' ? first : null;
+}
 /**
  * Ask npm what a tarball would contain, without producing one.
  *
@@ -41,10 +57,9 @@ async function packManifest(cwd, spec, registry) {
     if (result.exitCode !== 0)
         return { failure: classifyQueryFailure(result.stderr ?? '') };
     try {
-        const parsed = JSON.parse(result.stdout);
-        if (Array.isArray(parsed) && parsed.length > 0) {
-            return { manifest: parsed[0] };
-        }
+        const manifest = pickManifest(JSON.parse(result.stdout));
+        if (manifest)
+            return { manifest };
     }
     catch {
         // Fall through: npm answered with something that is not a manifest.

package/dist/esm/core/checks/quality/spellcheck.js

@@ -1,10 +1,10 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { getPackageConfigPath, hasLocalConfig, IGNORE_PATTERNS, getSourcePaths, } from '../../../config/index.js';
+import { getPackageConfigPath, getSourcePaths, hasLocalConfig, IGNORE_PATTERNS, } from '../../../config/index.js';
 import { execa } from '../../../utils/execa.js';
-import { logger, cleanupTempFile, matchesAnyGlob, resolvePackageBin, } from '../../../utils/index.js';
+import { cleanupTempFile, logger, matchesAnyGlob, registeredToolPaths, resolvePackageBin, } from '../../../utils/index.js';
 import { resolveScopedTargetFiles } from '../../targets.js';
-import { pass, warn, skip } from '../../types.js';
+import { pass, skip, warn } from '../../types.js';
 function loadUserCspellConfig(cwd) {
     const configPath = path.join(cwd, 'pr-checkmate.json');
     if (!fs.existsSync(configPath))
@@ -193,12 +193,15 @@ export function dropMissingLanguages(language, missing) {
  */
 function resolveFrom(cwd) {
     return id => {
-        try {
-            return require.resolve(id, { paths: [cwd] });
-        }
-        catch {
-            return require.resolve(id);
+        // The client's copy first, then the fetched `spellcheck` profile (cspell's own
+        // dictionaries live there), then our tree.
+        for (const root of [cwd, ...registeredToolPaths()]) {
+            try {
+                return require.resolve(id, { paths: [root] });
+            }
+            catch { }
         }
+        return require.resolve(id);
     };
 }
 function createTempCspellConfig(cwd) {

package/dist/esm/core/checks/security/diff-security.js

@@ -1,7 +1,7 @@
 import { DIFF_SECURITY_IGNORE_DEFAULTS } from '../../../config/index.js';
 import { logger } from '../../../utils/index.js';
 import { skip } from '../../types.js';
-import { clientFindingOptions, emptyBuckets, mergeSeverityBuckets, reportSeverityBuckets, scanDiffPatterns, reviewLines, DEFAULT_DATAFLOW_WINDOW, } from '../findings.js';
+import { clientFindingOptions, DEFAULT_DATAFLOW_WINDOW, emptyBuckets, mergeSeverityBuckets, reportSeverityBuckets, reviewLines, scanDiffPatterns, } from '../findings.js';
 const MD5_LABEL = 'MD5 (weak hash — use sha256 or stronger)';
 const SHA1_LABEL = 'SHA-1 (weak hash — use sha256 or stronger)';
 const SECURITY_PATTERNS = [

package/dist/esm/core/checks/security/security.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { getPackageConfigPath, hasLocalConfig } from '../../../config/index.js';
 import { execa } from '../../../utils/execa.js';
 import { logger, resolveGitRef, resolvePackageBin } from '../../../utils/index.js';
-import { pass, fail, warn, skip } from '../../types.js';
+import { fail, pass, skip, warn } from '../../types.js';
 /**
  * A HOME the scanner can actually write to.
  *

package/dist/esm/core/install/doctor.js

@@ -5,6 +5,7 @@ import { logger } from '../../utils/logger.js';
 import { packageVersion } from '../../utils/package-version.js';
 import { resolveCacheDir, stalePaths } from './cache.js';
 import { cachedProfiles, ensureTooling } from './ensure.js';
+import { grypeDbState } from './grype-db.js';
 import { profileSatisfiedLocally } from './prepare.js';
 import { planProfiles, PROFILES } from './profiles.js';
 // Re-exported: `doctor` has been the home of this since ticket 064, and the
@@ -135,6 +136,17 @@ export async function runDoctor(cwd = process.cwd()) {
         lines.push(`  ${missing.length} profile(s) not installed yet. They are fetched on the next`);
         lines.push('  run, or now with: npx pr-checkmate install');
     }
+    if (config.grypeScan?.enabled !== false) {
+        const db = await grypeDbState(cwd);
+        lines.push('');
+        lines.push('  Grype database (shared by all projects on this machine)');
+        if (db.state === 'missing-tool')
+            lines.push('    — grype is not installed (brew install grype)');
+        else if (db.state === 'ready')
+            lines.push(`    ✅ up to date${db.built ? ` (built ${db.built})` : ''}`);
+        else
+            lines.push(`    ⬇️  stale${db.built ? ` (built ${db.built})` : ''} — refresh: npx pr-checkmate install`);
+    }
     const stale = stalePaths(packageVersion(), config.install?.cacheDir);
     if (stale.length > 0) {
         lines.push('');

package/dist/esm/core/install/grype-db.d.ts

@@ -0,0 +1,25 @@
+type GrypeDbState = {
+    state: 'missing-tool';
+} | {
+    state: 'ready';
+    built?: string;
+} | {
+    state: 'stale';
+    built?: string;
+};
+/**
+ * Is grype's vulnerability database usable right now? grype refuses one older than
+ * 5 days (exit code 1 from `db status`). The database lives in grype's own cache,
+ * shared by every project on the machine, so one refresh serves them all.
+ */
+export declare function grypeDbState(cwd: string): Promise<GrypeDbState>;
+/**
+ * Download a fresh database when the current one is missing or stale.
+ *
+ * `timeoutMs` bounds the download: a check inside a run passes one so it can never
+ * look like a hung commit, `install` passes none because a person asked for exactly
+ * this and the download is the whole job. Returns why it is still unusable, or
+ * `null` when it is ready.
+ */
+export declare function ensureGrypeDb(cwd: string, timeoutMs?: number): Promise<string | null>;
+export {};

package/dist/esm/core/install/grype-db.js

@@ -0,0 +1,41 @@
+import { execa } from '../../utils/execa.js';
+import { logger } from '../../utils/logger.js';
+/** `Built:` line of `grype db status`, so `doctor` can say how old the data is. */
+const builtOf = (stdout) => typeof stdout === 'string' ? /^Built:\s*(.+)$/m.exec(stdout)?.[1]?.trim() : undefined;
+/**
+ * Is grype's vulnerability database usable right now? grype refuses one older than
+ * 5 days (exit code 1 from `db status`). The database lives in grype's own cache,
+ * shared by every project on the machine, so one refresh serves them all.
+ */
+export async function grypeDbState(cwd) {
+    const status = await execa('grype', ['db', 'status'], { cwd, reject: false, timeout: 30000 });
+    if (status.code === 'ENOENT')
+        return { state: 'missing-tool' };
+    const built = builtOf(status.stdout);
+    return status.exitCode === 0 ? { state: 'ready', built } : { state: 'stale', built };
+}
+/**
+ * Download a fresh database when the current one is missing or stale.
+ *
+ * `timeoutMs` bounds the download: a check inside a run passes one so it can never
+ * look like a hung commit, `install` passes none because a person asked for exactly
+ * this and the download is the whole job. Returns why it is still unusable, or
+ * `null` when it is ready.
+ */
+export async function ensureGrypeDb(cwd, timeoutMs) {
+    const current = await grypeDbState(cwd);
+    if (current.state === 'missing-tool')
+        return 'ENOENT';
+    if (current.state === 'ready')
+        return null;
+    logger.info('[Grype Scan]: vulnerability database missing or stale — updating it');
+    const update = await execa('grype', ['db', 'update'], {
+        cwd,
+        reject: false,
+        ...(timeoutMs ? { timeout: timeoutMs } : {}),
+    });
+    if (update.timedOut) {
+        return `database update exceeded ${timeoutMs}ms — run "grype db update" once, then retry`;
+    }
+    return update.exitCode === 0 ? null : 'database update failed (offline?) — run "grype db update"';
+}

package/dist/esm/core/install/prepare.js

@@ -1,7 +1,7 @@
 import { logger } from '../../utils/logger.js';
 import { clearToolPaths, packagePresent, registerToolPaths } from '../../utils/resolve-bin.js';
 import { ensureTooling } from './ensure.js';
-import { PROFILES, planProfiles } from './profiles.js';
+import { planProfiles, PROFILES } from './profiles.js';
 /**
  * Whether a profile needs fetching at all, or already ships inside the package.
  *

package/dist/esm/core/install/profiles.d.ts

@@ -3,7 +3,7 @@ import type { Language, LanguageUsage } from '../../utils/detect-language.js';
 /**
  * A named bundle of tooling, and the checks that stop working without it.
  *
- * The package ships ~233 MB of tooling, and no repository needs all of it: a
+ * The tooling totals ~233 MB, and no repository needs all of it: a
  * Python service pays for the whole JavaScript toolchain, a repository with
  * Spellcheck switched off still pays for cspell. Profiles are how that stops —
  * they name which slice of the tooling a given repository actually needs.

package/dist/esm/core/install/profiles.js

@@ -20,9 +20,9 @@ export const PROFILES = [
             'typescript',
             'eslint',
             'eslint-config-prettier',
-            'eslint-plugin-import-x',
             'eslint-plugin-jsdoc',
             'eslint-plugin-prettier',
+            'eslint-plugin-simple-import-sort',
             'eslint-plugin-sonarjs',
             '@typescript-eslint/eslint-plugin',
             '@typescript-eslint/parser',

package/dist/esm/core/install/reuse.js

@@ -5,15 +5,18 @@ import { ownPackageRoot } from '../../utils/resolve-bin.js';
 /**
  * The major version we declare for a tool, from our own manifest.
  *
- * Read from `dependencies` rather than from the installed tree: what matters is
+ * Read from the manifest rather than from the installed tree: what matters is
  * the version our configuration was written against, and a hoisted install can
  * resolve to something else entirely.
  */
 function ownMajor(pkgName) {
     try {
         const manifest = path.join(ownPackageRoot(), 'package.json');
-        const deps = JSON.parse(fs.readFileSync(manifest, 'utf-8')).dependencies;
-        const range = deps?.[pkgName];
+        const parsed = JSON.parse(fs.readFileSync(manifest, 'utf-8'));
+        // Profile tooling is declared in `devDependencies` — it is fetched on demand
+        // rather than installed with us — but it is still the version our config was
+        // written against, and the manifest keeps both.
+        const range = parsed.dependencies?.[pkgName] ?? parsed.devDependencies?.[pkgName];
         if (!range)
             return null;
         // `^10.6.0`, `>=3.0.0`, `~5.1` — the leading number is the major in every

package/dist/esm/core/run-checks.js

@@ -1,10 +1,10 @@
 import { isCiEnvironment, logger } from '../utils/index.js';
 import { packageVersion } from '../utils/package-version.js';
-import { Semaphore, resolveConcurrency, runPool, withTimeout } from '../utils/pool.js';
+import { resolveConcurrency, runPool, Semaphore, withTimeout } from '../utils/pool.js';
 import { clearToolPaths } from '../utils/resolve-bin.js';
 import { ResultCollector } from '../utils/result-collector.js';
 import { buildContext } from './context.js';
-import { prepareTooling, noTooling } from './install/prepare.js';
+import { noTooling, prepareTooling } from './install/prepare.js';
 import { REGISTRY } from './registry.js';
 import { report } from './reporters.js';
 import { PHASES, } from './types.js';

package/dist/esm/init.js

@@ -2,11 +2,11 @@ import { fileURLToPath as __fileURLToPath } from 'node:url';
 import { dirname as __dirnameFn } from 'node:path';
 const __dirname = __dirnameFn(__fileURLToPath(import.meta.url));
 import fs from 'fs';
-import path from 'path';
 import inquirer from 'inquirer';
-import { DEAD_CODE_IGNORE_DEFAULTS, DEFAULT_COMMANDS, DIFF_SECURITY_IGNORE_DEFAULTS, documentation, DOCS_URL, DUPLICATE_IGNORE_DEFAULTS, FULL_CONFIG_URL, GENERATED_DOC_FILES, IGNORED_DIRS, } from './config/index.js';
+import path from 'path';
+import { DEAD_CODE_IGNORE_DEFAULTS, DEFAULT_COMMANDS, DIFF_SECURITY_IGNORE_DEFAULTS, DOCS_URL, documentation, DUPLICATE_IGNORE_DEFAULTS, FULL_CONFIG_URL, GENERATED_DOC_FILES, IGNORED_DIRS, } from './config/index.js';
 import { DEFAULT_DATAFLOW_WINDOW } from './core/checks/findings.js';
-import { logger, detectLanguages, findOwnPackageRoot } from './utils/index.js';
+import { detectLanguages, findOwnPackageRoot, logger } from './utils/index.js';
 const CONFIG_FILE = path.resolve(process.cwd(), 'pr-checkmate.json');
 /**
  * Points editors at the bundled JSON schema. With the generated config reduced
@@ -264,8 +264,46 @@ const HOW_TO = [
     `Every option, annotated, with its default: ${FULL_CONFIG_URL}`,
     `Docs: ${DOCS_URL}`,
 ].join(' ');
+// Written out at its defaults so the options are visible and editable in the file
+// instead of having to be looked up. Same trade as `max-len`: the values stop
+// tracking the package, which is the price of being able to see them.
+const GRYPE_SCAN_SEED = {
+    '//': 'Anchore grype, cross-ecosystem. ON by default but skips when grype is absent from the runner. Only direct dependencies are reported.',
+    enabled: true,
+    minSeverity: 'medium',
+    '//ignore': 'Suppress by CVE/GHSA id or by package name.',
+    ignore: [],
+    '//timeoutMs': 'Cap on the scan. On timeout the check skips rather than fails.',
+    timeoutMs: 120000,
+    '//ci': 'Per-environment overrides (enabled, minSeverity, ignore, timeoutMs): "ci" applies on CI builds, "local" elsewhere. Example: "local": { "enabled": false }',
+    ci: {},
+    local: {},
+};
+/**
+ * Every option the template documents that the file does not already carry, at
+ * its default. Without this, options such as `vulnScan` (off by default) or
+ * `licenseCheck` exist only in the docs, and nobody edits what they cannot see.
+ * Comment keys travel with the option they describe, section headers with the
+ * first option after them.
+ */
+function templateExtras(existing) {
+    const templatePath = path.join(__dirname, 'config', 'pr-checkmate.template.json');
+    if (!fs.existsSync(templatePath)) {
+        return {};
+    }
+    const template = JSON.parse(fs.readFileSync(templatePath, 'utf-8'));
+    const extras = {};
+    for (const [key, value] of Object.entries(template)) {
+        const option = key.startsWith('//') ? key.slice(2) : key;
+        if (key in existing || option in existing) {
+            continue;
+        }
+        extras[key] = value;
+    }
+    return extras;
+}
 export function buildInitialConfig(sourcePath, languages) {
-    return {
+    const base = {
         $schema: SCHEMA_PATH,
         '// how-to': HOW_TO,
         commands: DEFAULT_COMMANDS,
@@ -346,9 +384,13 @@ export function buildInitialConfig(sourcePath, languages) {
             dataflowWindow: DEFAULT_DATAFLOW_WINDOW,
             ignorePaths: [...DIFF_SECURITY_IGNORE_DEFAULTS],
         },
+        grypeScan: structuredClone(GRYPE_SCAN_SEED),
         documentation,
         languages,
     };
+    const extras = templateExtras(base);
+    const { documentation: docs, languages: langs, ...rest } = base;
+    return { ...rest, ...extras, documentation: docs, languages: langs };
 }
 /** First-run setup: prompt, write config, and scaffold workflow + tsconfig. */
 async function createConfig(root) {
@@ -397,6 +439,10 @@ async function updateConfig(root) {
             $schema: json.$schema ?? SCHEMA_PATH,
             '// how-to': json['// how-to'] ?? HOW_TO,
             ...json,
+            // An existing file predates this option, so nobody has seen it. Added only
+            // when missing; a client's own block is never touched.
+            grypeScan: json.grypeScan ?? structuredClone(GRYPE_SCAN_SEED),
+            ...templateExtras({ ...json, grypeScan: true }),
             languages,
         };
         fs.writeFileSync(CONFIG_FILE, `${JSON.stringify(updated, null, 2)}\n`);

package/dist/esm/scripts/copy-configs.js

@@ -34,6 +34,15 @@ const configFiles = [
         source: 'src/config/pr-checkmate-workflow-docker.yml',
         dest: 'dist/esm/config/pr-checkmate-workflow-docker.yml',
     },
+    // Read by `init` to seed every option into a new pr-checkmate.json.
+    {
+        source: 'src/config/pr-checkmate.template.json',
+        dest: 'dist/cjs/config/pr-checkmate.template.json',
+    },
+    {
+        source: 'src/config/pr-checkmate.template.json',
+        dest: 'dist/esm/config/pr-checkmate.template.json',
+    },
     { source: 'src/config/pr-checkmate.schema.json', dest: 'pr-checkmate.schema.json' },
 ];
 /**

package/dist/esm/utils/own-deps.js

@@ -3,6 +3,7 @@ import { dirname as __dirnameFn } from 'node:path';
 const __dirname = __dirnameFn(__fileURLToPath(import.meta.url));
 import fs from 'node:fs';
 import path from 'node:path';
+import { PROFILES } from '../core/install/profiles.js';
 const OWN_PACKAGE_NAME = 'pr-checkmate';
 const PACKAGE_JSON = 'package.json';
 let cachedClosure;
@@ -85,7 +86,13 @@ export function getOwnDependencyClosure() {
     }
     // BFS over the dependency graph, resolving each package relative to the parent
     // that declared it so nested (non-hoisted) installs resolve correctly.
-    const queue = readDependencyNames(root).map(name => ({
+    //
+    // Profile tooling is ours even though it no longer sits in `dependencies`: it is
+    // fetched on demand, so the roots are what we declare plus what the profiles
+    // name. Without the second half every fetched tool is "the client's" and its
+    // licence blocks the client for a dependency they cannot remove.
+    const roots = new Set([...readDependencyNames(root), ...PROFILES.flatMap(p => p.packages)]);
+    const queue = [...roots].map(name => ({
         name,
         fromDir: root,
     }));

package/dist/esm/utils/resolve-bin.d.ts

@@ -16,6 +16,8 @@ export interface ResolvedTool {
  * to a run from before there was anything to fetch.
  */
 export declare function registerToolPaths(dirs: string[]): void;
+/** The roots registered for this run, for tools that load plugins by themselves. */
+export declare function registeredToolPaths(): string[];
 /** Drop every registered profile root. For tests, and for a second run in-process. */
 export declare function clearToolPaths(): void;
 /** The root of the installed pr-checkmate package — where our own tooling lives. */

package/dist/esm/utils/resolve-bin.js

@@ -25,6 +25,10 @@ let profileRoots = [];
 export function registerToolPaths(dirs) {
     profileRoots = [...dirs];
 }
+/** The roots registered for this run, for tools that load plugins by themselves. */
+export function registeredToolPaths() {
+    return [...profileRoots];
+}
 /** Drop every registered profile root. For tests, and for a second run in-process. */
 export function clearToolPaths() {
     profileRoots = [];

package/eslint-default-rules.json

@@ -26,14 +26,8 @@
   "sonarjs/cognitive-complexity": ["warn", 30],
   "sonarjs/no-duplicate-string": ["warn", { "threshold": 3 }],
   "sonarjs/no-identical-functions": "warn",
-  "import/order": [
-    "warn",
-    {
-      "groups": ["builtin", "external", "internal", "parent", "sibling", "index"],
-      "alphabetize": { "order": "asc", "caseInsensitive": true }
-    }
-  ],
-  "import/no-duplicates": "error",
+  "simple-import-sort/imports": "warn",
+  "no-duplicate-imports": ["error", { "allowSeparateTypeImports": true }],
   "jsdoc/check-param-names": "warn",
   "jsdoc/check-tag-names": "warn",
   "jsdoc/check-types": "warn",

package/eslint.config.mjs

@@ -1,12 +1,41 @@
 import fs from 'fs';
 import { createRequire } from 'module';
 import path from 'path';
-import tsPlugin from '@typescript-eslint/eslint-plugin';
-import tsParser from '@typescript-eslint/parser';
-import prettierPlugin from 'eslint-plugin-prettier';
-import sonarjsPlugin from 'eslint-plugin-sonarjs';
-import importPlugin from 'eslint-plugin-import-x';
-import jsdocPlugin from 'eslint-plugin-jsdoc';
+import { pathToFileURL } from 'url';
+
+/**
+ * Plugins are loaded through the roots pr-checkmate registered for this run
+ * (`PR_CHECKMATE_TOOL_ROOTS`), because the `js` profile is fetched into a cache
+ * directory when a repository needs it and a bare `import` only searches the tree
+ * this file sits in. With no roots — development, or tooling that shipped beside
+ * the package — it is the plain import it always was.
+ */
+const toolRoots = (process.env.PR_CHECKMATE_TOOL_ROOTS ?? '').split(path.delimiter).filter(Boolean);
+const resolveFrom = createRequire(import.meta.url);
+
+async function loadPlugin(name) {
+  for (const root of toolRoots) {
+    try {
+      const entry = resolveFrom.resolve(name, { paths: [root] });
+      const mod = await import(pathToFileURL(entry).href);
+
+      return mod.default ?? mod;
+    } catch {}
+  }
+  const mod = await import(name);
+
+  return mod.default ?? mod;
+}
+
+const [tsPlugin, tsParser, prettierPlugin, sonarjsPlugin, jsdocPlugin, simpleImportSort] =
+  await Promise.all([
+    loadPlugin('@typescript-eslint/eslint-plugin'),
+    loadPlugin('@typescript-eslint/parser'),
+    loadPlugin('eslint-plugin-prettier'),
+    loadPlugin('eslint-plugin-sonarjs'),
+    loadPlugin('eslint-plugin-jsdoc'),
+    loadPlugin('eslint-plugin-simple-import-sort'),
+  ]);
 
 /**
  * Default ESLint rules — single source of truth, shared with init.ts so the
@@ -15,7 +44,7 @@ import jsdocPlugin from 'eslint-plugin-jsdoc';
  *
  * SEVERITY POLICY: `error` is reserved for defects a human has to resolve —
  * `no-debugger`, `eqeqeq`, `prefer-const`, `@typescript-eslint/no-unused-vars`,
- * `@typescript-eslint/no-floating-promises`, `import/no-duplicates`. Everything
+ * `@typescript-eslint/no-floating-promises`, `no-duplicate-imports`. Everything
  * that is purely formatting is `warn`, even
  * though it is auto-fixable, precisely BECAUSE it is auto-fixable: ESLint exits 1
  * on errors only, and the ESLint check maps exit 1 to a blocking failure, so an
@@ -179,7 +208,7 @@ export default [
       '@typescript-eslint': tsPlugin,
       prettier: prettierPlugin,
       sonarjs: sonarjsPlugin,
-      import: importPlugin,
+      'simple-import-sort': simpleImportSort,
       jsdoc: jsdocPlugin,
     },
 

package/install-manifests/commitlint/package-lock.json

@@ -421,6 +421,7 @@
       "version": "26.6.2",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
       "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "undici-types": "~8.9.0"
@@ -481,7 +482,6 @@
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/conventional-commits-filter/-/conventional-commits-filter-6.0.1.tgz",
       "integrity": "sha512-cs+LadpH7Kpw0M3k8wurk+sOVVDAENA0iK4OBOrkL94j5lEVYRJ4j3zd2bhY9qgzyrPqthdcYT3axzRN7AliMg==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=22"
@@ -616,9 +616,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.8",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
-      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
+      "version": "3.1.9",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz",
+      "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==",
       "funding": [
         {
           "type": "github",
@@ -874,6 +874,7 @@
       "version": "8.9.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
       "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/wrap-ansi": {

package/install-manifests/core/package-lock.json

@@ -376,6 +376,7 @@
       "version": "26.6.2",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
       "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "undici-types": "~8.9.0"
@@ -906,9 +907,9 @@
       }
     },
     "node_modules/toml": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/toml/-/toml-5.0.0.tgz",
-      "integrity": "sha512-bsqEd+g7fzlrw7LEynQ6W6aOK/lTOlepz5x1sJyIV9fTZVJS2Q76nuju6FK+gZhW5bUpvB7mCEqdR0u4WziMFw==",
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/toml/-/toml-5.0.1.tgz",
+      "integrity": "sha512-EqYNA/YvUNndrA2B3O2ojzLQoTQrBxeZ9UIjQwk8t10oe6n7dwclBwd9IdZQTOKwe6vWX+AXtl6IntXRbepdxQ==",
       "license": "MIT",
       "engines": {
         "node": ">=20"
@@ -918,6 +919,7 @@
       "version": "8.9.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
       "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/unicorn-magic": {