ts-builds 4.4.0 → 4.5.0

package/README.md

@@ -319,6 +319,7 @@ on for everyone who runs it, so set them only where you mean to, such as your ow
 | `TS_BUILDS_TELEMETRY=1`       | Turns it on.                                                                                                               |
 | `TS_BUILDS_TELEMETRY_URL`     | Where to POST. Must be `https`, or `http` to localhost. With telemetry on and no URL, `lint` warns once and sends nothing. |
 | `TS_BUILDS_TELEMETRY_DEBUG=1` | Prints the payload to stderr and sends nothing, whether or not telemetry is on.                                            |
+| `TS_BUILDS_TELEMETRY_TRACE=1` | Adds `trace`: the repo, the commit, and each finding's file and line. See below.                                           |
 | `DO_NOT_TRACK=1`              | Turns it off, whatever else is set.                                                                                        |
 
 Each run sends one JSON object:
@@ -342,11 +343,17 @@ Each run sends one JSON object:
     "eslint-plugin-functype": "2.125.1"
   },
   "enabled": { "functype/no-let": "error", "functype/prefer-option": "warn" },
-  "rules": { "functype/prefer-option": { "errors": 0, "warnings": 3, "silenced": 2 } }
+  "rules": { "functype/prefer-option": { "errors": 0, "warnings": 3, "silenced": 2 } },
+  "messages": {
+    "functype/prefer-option": {
+      "preferOption": { "errors": 0, "warnings": 3, "silenced": 0 },
+      "preferWireForThreeStates": { "errors": 0, "warnings": 0, "silenced": 2 }
+    }
+  }
 }
 ```
 
-- **Never sent:** file paths, source code or message text.
+- **Never sent:** source code or message text. File paths only in `trace`, below.
 - **Sent as-is:** the `package.json` name, left out when there isn't one, and rule ids as your config
   names them. A plugin's declared name is used only when it looks like an npm package name, and
   otherwise is replaced by the name derived from its rule prefix, such as `eslint-plugin-<prefix>`. Its
@@ -360,9 +367,43 @@ Each run sends one JSON object:
   When the installed package can't be found, the `meta.version` is used.
 - **`enabled`:** the plugin rules that are on, with their severity, read from the first linted file's
   config. It tells a rule with no findings apart from a rule that's off. Core rules are left out.
+- **`messages`:** each rule's counts split by the message id it reported. A message id is a fixed
+  name in the rule's code, such as `preferOption`, not the message text. It shows which of a rule's
+  messages fires or gets silenced. Left out when no finding had one.
+
+#### Tracing findings to a line
+
+With `TS_BUILDS_TELEMETRY_TRACE=1` as well, the payload adds `trace`, so each finding can be opened at
+the commit that was linted:
+
+```json
+"trace": {
+  "repo": "github.com/acme/api",
+  "commit": "d53e02a1c9b4e8f7a6b5c4d3e2f1a0b9c8d7e6f5",
+  "findings": [
+    { "rule": "functype/prefer-option", "message": "preferOption", "kind": "silenced", "file": "src/user.ts", "line": 42 }
+  ],
+  "dropped": 0
+}
+```
+
+- **What it names:** the repo, from the git remote as `host/owner/repo`, the commit (`HEAD`), and
+  each finding's file relative to the repo root and line. It doesn't send code. The code is read at
+  the host, under the repo's own access rules.
+- **Turn it on only for repos whose names and file paths you're happy to send.** That's why it's a
+  separate flag.
+- **Lines match the commit.** A finding in an untracked file, or in one that differs from `HEAD`
+  because it was edited or rewritten by `--fix`, is left out and counted in `dropped`. If git can't
+  say which files are tracked or changed, every finding is left out.
+- **Size is capped.** Findings are sorted by file and line. The first 200 are kept, and fewer if
+  the payload would pass 60 KB, so a large run still sends its counts. The rest count in `dropped`.
+- **No trace** when the directory isn't in a git repo, has no `HEAD`, or its remote isn't
+  `host/owner/repo` with a domain name as the host. A local or relative path isn't traced.
+- **Message ids** that aren't plain identifiers (letters, digits, `_ . : -`, at most 64) are left
+  out of `messages` and the trace.
 
 It never changes a run's result. It sends after lint finishes and its output is printed, the send
-waits at most 2 seconds, and it ignores every error, so the exit code and output stay the same. A run that
+waits at most 2 seconds (the trace's git calls can add a few more), and it ignores every error, so the exit code and output stay the same. A run that
 fails before linting, such as one with a broken config, sends nothing.
 
 It doesn't cover `lint.useProjectEslint`, which spawns your own ESLint so ts-builds never sees the

package/dist/cli.js

@@ -3,7 +3,7 @@ import { existsSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync
 import { mkdir, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { $, Do, List, Map, Option, Set, Try } from "functype";
+import { $, Do, List, Map, Option, Set as Set$1, Try } from "functype";
 import { Fs, Process } from "functype-os";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -128,8 +128,12 @@ function loadConfig() {
 *
 * Off unless `TS_BUILDS_TELEMETRY=1` is set, and `DO_NOT_TRACK=1` always turns it off. ts-builds
 * reads these from the environment only. A committed script, workflow or config command that sets
-* them still turns it on for everyone who runs it. It never sends file paths, source or messages,
-* the send waits at most `TELEMETRY_TIMEOUT_MS`, and it never changes the run's exit code.
+* them still turns it on for everyone who runs it. It never sends source or message text, the send
+* waits at most `TELEMETRY_TIMEOUT_MS`, and it never changes the run's exit code.
+*
+* File paths and the repo's name go out only with a second flag, `TS_BUILDS_TELEMETRY_TRACE=1`. The
+* trace adds the git remote, the commit and each finding's repo-relative file and line, so a finding
+* can be opened at that commit, where the repo's own access rules still apply.
 */
 /** Bump when the payload's shape changes incompatibly, so the receiver can tell versions apart. */
 const TELEMETRY_SCHEMA_VERSION = 1;
@@ -138,6 +142,17 @@ const TELEMETRY_TIMEOUT_MS = 2e3;
 /** A fixed salt, so the repo id is a stable pseudonym. Anyone who knows the remote URL can recompute it. */
 const PROJECT_SALT = "ts-builds-telemetry-v1";
 const LOG_PREFIX = "[ts-builds telemetry]";
+/** Findings in one trace. The receiver takes up to 300. */
+const MAX_TRACE_FINDINGS = 200;
+/**
+* The largest payload, in bytes, a trace may grow to. The receiver rejects bodies over 64 KB and
+* drops the whole run, counts included, so findings that would pass this are dropped instead.
+*/
+const MAX_PAYLOAD_BYTES = 6e4;
+/** The receiver's message id pattern. Ids outside it aren't sent at all. */
+const MESSAGE_ID = /^[A-Za-z0-9_.:-]{1,64}$/;
+const messageIdOf = (message) => typeof message.messageId === "string" && MESSAGE_ID.test(message.messageId) ? Option(message.messageId) : Option.none();
+const own = (record, key) => Object.hasOwn(record, key) ? Option(record[key]) : Option.none();
 const NO_COUNTS = {
 	errors: 0,
 	warnings: 0,
@@ -173,6 +188,66 @@ function ruleStats(results) {
 		fatal: results.reduce((n, r) => n + r.messages.filter((m) => m.ruleId === null).length, 0)
 	};
 }
+/** Every message with a rule id, reported or silenced, tagged with how it counts. */
+const tagged = (result) => [...result.messages.flatMap((m) => m.ruleId === null ? [] : [{
+	message: m,
+	kind: m.severity === 2 ? "error" : "warning"
+}]), ...result.suppressedMessages.flatMap((m) => m.ruleId === null ? [] : [{
+	message: m,
+	kind: "silenced"
+}])];
+const FIELD = {
+	error: "errors",
+	warning: "warnings",
+	silenced: "silenced"
+};
+const sortKeys = (record) => Object.fromEntries(Object.entries(record).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+/**
+* Per-rule counts split by message id, for the findings that have one. A rule with several messages,
+* such as one that suggests different fixes, then shows which message fires or gets silenced.
+* Message ids are fixed identifiers in the rule, not the message text. An id that doesn't look like
+* one (letters, digits, `_ . : -`, at most 64) is left out. Pure and key-sorted.
+*/
+function messageStats(results) {
+	const nested = results.flatMap(tagged).reduce((acc, { message, kind }) => {
+		const rule = message.ruleId ?? "";
+		if (rule === "") return acc;
+		return messageIdOf(message).map((id) => {
+			const byId = own(acc, rule).orElse({});
+			const current = own(byId, id).orElse(NO_COUNTS);
+			return {
+				...acc,
+				[rule]: {
+					...byId,
+					[id]: {
+						...current,
+						[FIELD[kind]]: current[FIELD[kind]] + 1
+					}
+				}
+			};
+		}).orElse(acc);
+	}, {});
+	return sortKeys(Object.fromEntries(Object.entries(nested).map(([rule, byId]) => [rule, sortKeys(byId)])));
+}
+/**
+* Every finding as a trace entry, with its file relative to `root` and `/`-separated, sorted by file,
+* line and rule. A file outside `root` has no repo path, so its findings are left out, and not
+* counted in `dropped`.
+*/
+function traceCandidates(results, root) {
+	return results.flatMap((result) => {
+		const rel = relative(root, result.filePath);
+		if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) return [];
+		const file = rel.split(sep).join("/");
+		return tagged(result).map(({ message, kind }) => ({
+			rule: message.ruleId ?? "",
+			...messageIdOf(message).map((id) => ({ message: id })).orElse({}),
+			kind,
+			file,
+			line: Math.max(1, message.line)
+		}));
+	}).toSorted((a, b) => a.file < b.file ? -1 : a.file > b.file ? 1 : a.line - b.line || (a.rule < b.rule ? -1 : 1));
+}
 const LOCAL_HOSTS = [
 	"localhost",
 	"127.0.0.1",
@@ -224,6 +299,10 @@ function projectId(remote) {
 function detectAgent(env) {
 	return env.CLAUDECODE === "1" ? Option("claude-code") : Option.none();
 }
+/** Whether to add the trace: repo, commit, and each finding's file and line. */
+function traceOn(env) {
+	return isOn(env.TS_BUILDS_TELEMETRY_TRACE);
+}
 function isCi(env) {
 	return isOn(env.CI) || env.GITHUB_ACTIONS === "true";
 }
@@ -266,13 +345,9 @@ function tsBuildsRoot() {
 	const root = ancestors(here).find((dir) => readJson(join(dir, "package.json")).map((pkg) => pkg.name === "ts-builds").orElse(false));
 	return root === void 0 ? Option.none() : Option(root);
 }
-/** The git remote of the repo holding `dir`, if there is one. */
-function gitRemote(dir) {
-	return Try(() => execFileSync("git", [
-		"config",
-		"--get",
-		"remote.origin.url"
-	], {
+/** A git command's stdout in `dir`, or none when it fails. */
+function git(dir, args) {
+	return Try(() => execFileSync("git", [...args], {
 		cwd: dir,
 		encoding: "utf-8",
 		stdio: [
@@ -280,8 +355,101 @@ function gitRemote(dir) {
 			"pipe",
 			"ignore"
 		],
-		timeout: 2e3
-	}).trim()).toOption().filter((out) => out !== "");
+		timeout: 2e3,
+		maxBuffer: 16777216
+	})).toOption();
+}
+const trimmed = (out) => out.map((s) => s.trim()).filter((s) => s !== "");
+/** The git remote of the repo holding `dir`, if there is one. */
+function gitRemote(dir) {
+	return trimmed(git(dir, [
+		"config",
+		"--get",
+		"remote.origin.url"
+	]));
+}
+/**
+* `host/owner/repo`, where the host is a domain name. A path remote, relative or absolute, doesn't
+* match, so it isn't traced. No segment may be `.` or `..`, which a link would resolve.
+*/
+const TRACE_REPO_SHAPE = /^[a-z0-9][a-z0-9-]*(\.[a-z0-9-]+)+(\/[a-z0-9._-]{1,100}){2,5}$/;
+const isTraceRepo = (repo) => repo.length <= 300 && TRACE_REPO_SHAPE.test(repo) && repo.split("/").every((s) => s !== "." && s !== "..");
+const COMMIT = /^([0-9a-f]{40}|[0-9a-f]{64})$/;
+/** NUL-separated paths from `git ... -z`, as a set. */
+const pathSet = (out) => new Set(out.split("\0").filter((p) => p !== ""));
+/**
+* The trace for a run: the repo, `HEAD`, and findings in files that are committed as linted. A
+* finding in an untracked file, or in one that differs from `HEAD` (edited, or rewritten by
+* `--fix`), is dropped, because its line wouldn't match the commit. If git can't say which files
+* are tracked or changed, every finding is dropped rather than risk a wrong line. Paths are passed to
+* git literally, so a name like `[slug].astro` isn't read as a pattern.
+*/
+function gitTrace(results, dir) {
+	const root = trimmed(git(dir, ["rev-parse", "--show-toplevel"]));
+	const repo = gitRemote(dir).map(normalizeRemote).filter(isTraceRepo);
+	const commit = trimmed(git(dir, ["rev-parse", "HEAD"])).filter((c) => COMMIT.test(c));
+	return root.flatMap((top) => repo.flatMap((name) => commit.map((sha) => {
+		const candidates = traceCandidates(results, top);
+		const capped = candidates.slice(0, 200);
+		const files = [...new Set(capped.map((f) => f.file))];
+		const listed = (args) => files.length === 0 ? Option(/* @__PURE__ */ new Set()) : git(top, [
+			"--literal-pathspecs",
+			...args,
+			"--",
+			...files
+		]).map(pathSet);
+		const tracked = listed(["ls-files", "-z"]);
+		const changed = listed([
+			"diff",
+			"--name-only",
+			"-z",
+			"HEAD"
+		]);
+		const findings = tracked.flatMap((t) => changed.map((c) => capped.filter((f) => t.has(f.file) && !c.has(f.file)))).orElse([]);
+		return {
+			repo: name,
+			commit: sha,
+			findings,
+			dropped: candidates.length - findings.length
+		};
+	})));
+}
+const bytes = (value) => Buffer.byteLength(JSON.stringify(value));
+/**
+* Keep the trace's findings, in order, while the whole payload stays within `maxBytes`. The rest
+* are counted in `dropped`, so a large run still sends its counts rather than being rejected.
+*/
+function fitTrace(payload, trace, maxBytes = MAX_PAYLOAD_BYTES) {
+	const empty = {
+		...trace,
+		findings: [],
+		dropped: trace.dropped + trace.findings.length
+	};
+	const budget = maxBytes - bytes({
+		...payload,
+		trace: empty
+	}) - 16;
+	const kept = trace.findings.reduce((acc, f) => {
+		if (acc.full) return acc;
+		const size = bytes(f) + 1;
+		return acc.used + size > budget ? {
+			...acc,
+			full: true
+		} : {
+			used: acc.used + size,
+			n: acc.n + 1,
+			full: false
+		};
+	}, {
+		used: 0,
+		n: 0,
+		full: false
+	}).n;
+	return {
+		...trace,
+		findings: trace.findings.slice(0, kept),
+		dropped: trace.dropped + (trace.findings.length - kept)
+	};
 }
 const severityOf = (entry) => {
 	const level = Array.isArray(entry) ? entry[0] : entry;
@@ -328,12 +496,17 @@ function versionsFor(run, rules, active) {
 		...Object.fromEntries([...typescript, ...pluginVersions])
 	};
 }
-/** The payload for one lint run. Holds counts and versions only: no file paths, source or messages. */
+/**
+* The payload for one lint run. Holds counts and versions, and no source or message text. File
+* paths and the repo go in `trace`, only with `TS_BUILDS_TELEMETRY_TRACE=1`.
+*/
 function buildTelemetryPayload(run, env, active = Option.none()) {
 	const stats = ruleStats(run.results);
 	const project = gitRemote(run.dir).map(projectId);
 	const agent = detectAgent(env);
-	return {
+	const messages = messageStats(run.results);
+	const trace = traceOn(env) ? gitTrace(run.results, run.dir) : Option.none();
+	const payload = {
 		schema: 1,
 		...run.packageName.map((name) => ({ package: name })).orElse({}),
 		...project.map((id) => ({ project: id })).orElse({}),
@@ -345,8 +518,13 @@ function buildTelemetryPayload(run, env, active = Option.none()) {
 		fatal: stats.fatal,
 		versions: versionsFor(run, stats.rules, active),
 		...active.map((a) => ({ enabled: a.enabled })).orElse({}),
-		rules: stats.rules
+		rules: stats.rules,
+		...Object.keys(messages).length > 0 ? { messages } : {}
 	};
+	return trace.map((t) => ({
+		...payload,
+		trace: fitTrace(payload, t)
+	})).orElse(payload);
 }
 /**
 * POST the payload. Resolves `true` on a 2xx and `false` otherwise; never rejects. The send is
@@ -519,7 +697,7 @@ function runShellCommand(shellCmd, options = {}) {
 }
 
 // src/cli/commands/build.ts
-const TRANSIENT_RM_ERRORS = Set.of("EBUSY", "EPERM", "ENOTEMPTY", "EMFILE");
+const TRANSIENT_RM_ERRORS = Set$1.of("EBUSY", "EPERM", "ENOTEMPTY", "EMFILE");
 const RETRY_DELAYS_MS = [
 	100,
 	250,
@@ -648,6 +826,32 @@ function consumerHasPrettierConfig(startDir = targetDir) {
 function prettierConfigArg() {
 	return consumerHasPrettierConfig() ? Option.none() : bundledPrettierConfigPath();
 }
+/** True when `dir` is a workspace root: it has `pnpm-workspace.yaml`, or a package.json with `workspaces`. */
+function isWorkspaceRoot(dir) {
+	if (Fs.existsSync(join(dir, "pnpm-workspace.yaml"))) return true;
+	return Fs.readFileSync(join(dir, "package.json")).toOption().flatMap((content) => {
+		try {
+			return Option(JSON.parse(content).workspaces);
+		} catch {
+			return Option.none();
+		}
+	}).fold(() => false, () => true);
+}
+/**
+* The enclosing workspace root's `.prettierignore`, when `startDir` is a package inside a workspace
+* and that file exists. Exported for testing.
+*
+* `format` runs prettier from the package's own directory, and prettier reads `.prettierignore` only
+* from there. So an ignore rule a monorepo states once at its root (a generated file, a vendored
+* snapshot) applied when the repo was formatted from the root and NOT when each package formatted
+* itself: the per-package `format` rewrote the generated file and `format:check` failed on it. Only
+* strict ancestors are searched, because a package that is itself the root already passes its own
+* `./.prettierignore`. Patterns in an `--ignore-path` file resolve relative to that file (prettier 3),
+* so the root's patterns mean the same thing from inside a package.
+*/
+function workspacePrettierIgnorePath(startDir = targetDir) {
+	return ancestorDirs(startDir).drop(1).find((dir) => isWorkspaceRoot(dir)).map((root) => join(root, ".prettierignore")).filter((path) => Fs.existsSync(path));
+}
 /**
 * prettier CLI args for `format` / `format:check`.
 *
@@ -659,6 +863,9 @@ function prettierConfigArg() {
 * output are ignored for every consumer with no per-repo `.prettierignore` needed, while the
 * consumer's own entries still apply.
 *
+* `workspaceIgnore` adds the enclosing workspace root's `.prettierignore` the same additive way, so a
+* package ignores what its monorepo ignores (see `workspacePrettierIgnorePath`).
+*
 * `bundledConfig` is the same idea for style rather than ignores: Some only when the consumer has
 * no prettier config of their own (see `prettierConfigArg`), so we fill the gap without ever
 * overriding a config they wrote.
@@ -666,14 +873,10 @@ function prettierConfigArg() {
 * Bundled paths are quoted because `runCommand` runs one shell command line (the shell strips the
 * quotes), keeping them correct when the install path contains spaces.
 */
-function prettierFormatArgs(check, bundledIgnore = bundledPrettierIgnorePath(), bundledConfig = prettierConfigArg()) {
+function prettierFormatArgs(check, bundledIgnore = bundledPrettierIgnorePath(), bundledConfig = prettierConfigArg(), workspaceIgnore = workspacePrettierIgnorePath()) {
 	const base = List([check ? "--check" : "--write", "."]);
-	const ignoreArgs = bundledIgnore ? List([
-		"--ignore-path",
-		`"${bundledIgnore}"`,
-		"--ignore-path",
-		".prettierignore"
-	]) : List.empty();
+	const explicit = List([Option(bundledIgnore), workspaceIgnore]).flatMap((path) => path.fold(() => List.empty(), (p) => List(["--ignore-path", `"${p}"`])));
+	const ignoreArgs = explicit.isEmpty ? explicit : explicit.concat(List(["--ignore-path", ".prettierignore"]));
 	const configArgs = bundledConfig.fold(() => List.empty(), (path) => List(["--config", `"${path}"`]));
 	return base.concat(ignoreArgs).concat(configArgs).toArray();
 }
@@ -1443,7 +1646,7 @@ const LOCKFILE_PKG_PRESENCE = (name) => new RegExp(`(^|[/'"\\s])${name}@`, "m");
 * a non-whitespace char and ends with `:`).
 */
 function readAllowBuildsKeys(yaml) {
-	return Set(matchFirstGroups(blockLines(yaml, /^allowBuilds:/), /^\s{1,}([^\s:]+)\s*:/));
+	return Set$1(matchFirstGroups(blockLines(yaml, /^allowBuilds:/), /^\s{1,}([^\s:]+)\s*:/));
 }
 /**
 * The lines of the top-level block whose header matches `header`, each trimmed at
@@ -1535,7 +1738,7 @@ function hasPnpmField(pkgPath) {
 	return Boolean(pkg.pnpm && typeof pkg.pnpm === "object" && Object.keys(pkg.pnpm).length > 0);
 }
 const NPMRC_HEADER = "# Hoist CLI tool binaries from peer dependencies";
-const KNOWN_PNPM_KEYS = Set.of("overrides", "peerDependencyRules");
+const KNOWN_PNPM_KEYS = Set$1.of("overrides", "peerDependencyRules");
 function hasTopLevelKey(yaml, key) {
 	return new RegExp(`^${key}:`, "m").test(yaml);
 }
@@ -1604,7 +1807,7 @@ function renderExcludeEntry(entry) {
 * the next top-level key.
 */
 function readReleaseAgeExcludeEntries(yaml) {
-	return Set(readListBlock(yaml, /^minimumReleaseAgeExclude:/));
+	return Set$1(readListBlock(yaml, /^minimumReleaseAgeExclude:/));
 }
 const YAML_LIST_ENTRY = /^\s*-\s*(["']?)([^"'\s#]+)\1\s*(?:#.*)?$/;
 /** The unquoted items of the top-level list block whose header matches `header`. */
@@ -1747,7 +1950,7 @@ function migratePackageJsonPnpm(dir, ws) {
 	if (!pnpm || typeof pnpm !== "object") return noChange(ws);
 	const overrides = migratePnpmKey(ws, "overrides", pnpm.overrides, renderOverrides);
 	const peerRules = migratePnpmKey(overrides.ws, "peerDependencyRules", pnpm.peerDependencyRules, renderPeerDependencyRules);
-	const migratedKeys = Set([...overrides.migrated ? ["overrides"] : [], ...peerRules.migrated ? ["peerDependencyRules"] : []]);
+	const migratedKeys = Set$1([...overrides.migrated ? ["overrides"] : [], ...peerRules.migrated ? ["peerDependencyRules"] : []]);
 	const remainingPnpm = Object.fromEntries(Object.entries(pnpm).filter(([key]) => !migratedKeys.has(key)));
 	const manual = Object.keys(remainingPnpm).filter((key) => !KNOWN_PNPM_KEYS.has(key)).map((key) => ({
 		kind: "manual",
@@ -2198,12 +2401,12 @@ For cross-package orchestration in a monorepo, use Turbo, nx, or
 
 // src/cli/commands/lint-summary.ts
 /** node_modules is always skipped: huge, and never a workspace package itself. */
-const ALWAYS_SKIP = Set.of("node_modules");
+const ALWAYS_SKIP = Set$1.of("node_modules");
 /** Skipped ONLY when the dir is not itself a package — a workspace package literally
 * named `lib`/`dist`/`coverage` must still be summarized, so we check for package.json.
 * (A publish-from-dist layout with a `package.json` inside `dist/` is therefore
 * traversed — harmless: the walk still only matches `.ts-builds/lint-report.json`.) */
-const SKIP_UNLESS_PACKAGE = Set.of("dist", "lib", "coverage");
+const SKIP_UNLESS_PACKAGE = Set$1.of("dist", "lib", "coverage");
 /**
 * Recursively find every `.ts-builds/lint-report.json` under `root`.
 *
@@ -2529,7 +2732,7 @@ function getBuiltinCommands(config) {
 		compile: { run: "tsc" }
 	};
 }
-async function runChain(chainName, config, path = Set.empty()) {
+async function runChain(chainName, config, path = Set$1.empty()) {
 	if (path.has(chainName)) {
 		console.error(`Circular chain reference detected: ${chainName}`);
 		return 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ts-builds",
-  "version": "4.4.0",
+  "version": "4.5.0",
   "description": "Shared TypeScript configuration files for library templates. Provides standardized ESLint, Prettier, Vitest, TypeScript, and build configs.",
   "keywords": [
     "typescript",