@archora/core 1.1.0 → 2.0.0

package/README.md

@@ -31,13 +31,15 @@ parsing, output formatting, and CI exit codes.
 
 ## What it computes
 
-- **Dependency graph** — parses `.ts`, `.tsx`, `.vue` files, resolves `tsconfig` path aliases
+- **Dependency graph** — parses `.ts`, `.tsx`, `.js`, `.jsx`, `.vue` (and `.svelte`, beta), resolves `tsconfig` path aliases including recursive alias→alias chains
+- **Dynamic & framework-auto edges** — `import()`, `React.lazy`, `next/dynamic`, Vue/Nuxt component and Nuxt `composables/` auto-imports
 - **Cycles** — Tarjan's SCC; classifies as direct (length ≤ 2) or indirect
 - **Per-module metrics** — fan-in, fan-out, instability, depth, coupling, hotness score
 - **Layer violations** — FSD-style rules (`shared → entities → features → widgets → pages → app`)
 - **Contract checks** — boundary rules, package budgets, API stability, bundle thresholds from `.archora.json`
-- **Bundle signals** — duplicated modules, heavy chunks (from webpack/rollup stats)
-- **Temporal coupling** — modules that change together without a static edge (from `git log`)
+- **RSC boundary leaks** — server/client runtime from directives, `server-only`/`client-only` packages and framework conventions; flags `client → server` imports, direct and transitive
+- **Bundle signals** — duplicated modules, heavy chunks, solo-hot modules, barrel tree-shaking leaks (from webpack/rollup stats)
+- **Temporal coupling** — modules that change together without a static edge (from `git log`), ranked by risk
 
 ## FileSource
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archora/core",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "type": "module",
   "description": "Framework-independent analyzer core for Archora. Builds the dependency model, detects cycles, computes metrics and recommendations from any FileSource. No Vue, Pinia or Tauri dependencies.",
   "author": "Archora <archora@archora.dev>",

package/src/README.md

@@ -1,4 +1,4 @@
 # core
 
-Фреймворк-независимое ядро: analyzer, graph, metrics, rules, report.
-Не импортирует Vue/Pinia/Tailwind/Tauri. Должно работать в чистом Node.
+Framework-independent core: analyzer, graph, metrics, rules, report.
+Does not import Vue/Pinia/Tailwind/Tauri. Must run in plain Node.

package/src/analyzer/__tests__/__snapshots__/referenceSnapshot.test.ts.snap

@@ -38,7 +38,7 @@ exports[`reference corpus snapshots > nuxt-server-routes: stable summary 1`] = `
 
 exports[`reference corpus snapshots > react-admin-basic: stable summary 1`] = `
 {
-  "archDebtGrade": "B",
+  "archDebtGrade": "A",
   "cycles": 0,
   "edges": 11,
   "modules": 11,

package/src/analyzer/__tests__/analyze.test.ts

@@ -520,3 +520,44 @@ describe('analyze: phantom type-only cycles', () => {
     expect(result.cycles.some((c) => c.modules.length === 2)).toBe(true);
   });
 });
+
+describe('analyze: robustness to broken inputs', () => {
+  it('does not crash on malformed files and still analyzes the valid ones', async () => {
+    const source = createInMemoryFileSource('/proj', {
+      'package.json': JSON.stringify({ name: 'p', version: '0.0.0', dependencies: { vue: '^3' } }),
+      'tsconfig.json': '{}',
+      'src/good.ts': `import { dep } from './dep';\nexport const good = (): number => dep();\n`,
+      'src/dep.ts': `export const dep = (): number => 1;\n`,
+      // unterminated string / garbage TS
+      'src/brokenTs.ts': `export const x = "unterminated\nconst y = {{{ <<< @@@ ;`,
+      // malformed Vue SFC (unclosed script, broken template)
+      'src/Broken.vue': `<script setup lang="ts">\nimport { z from './nowhere'\n<template><div></span></template>`,
+      // empty file
+      'src/empty.ts': ``,
+      // NUL / control bytes
+      'src/binary.ts': `
 not really code ￿`,
+    });
+
+    // Must resolve, not throw.
+    const result = await analyze(source);
+
+    // The valid pair survived and its edge was resolved despite broken neighbors.
+    expect(result.modules.some((m) => m.id === 'src/good.ts')).toBe(true);
+    expect(result.edges.some((e) => e.from === 'src/good.ts' && e.to === 'src/dep.ts')).toBe(true);
+    // Warnings are accumulated, never thrown.
+    expect(Array.isArray(result.warnings)).toBe(true);
+  });
+
+  it('survives a file that exceeds the size cap without aborting the scan', async () => {
+    const huge = `export const big = "${'x'.repeat(1_100_000)}";\n`;
+    const source = createInMemoryFileSource('/proj', {
+      'package.json': JSON.stringify({ name: 'p', version: '0.0.0' }),
+      'tsconfig.json': '{}',
+      'src/good.ts': `export const good = 1;\n`,
+      'src/huge.ts': huge,
+    });
+    const result = await analyze(source);
+    expect(result.modules.some((m) => m.id === 'src/good.ts')).toBe(true);
+    expect(result.warnings.some((w) => w.file === 'src/huge.ts')).toBe(true);
+  });
+});

package/src/analyzer/__tests__/bundle.test.ts

@@ -189,3 +189,102 @@ describe('analyzeBundle', () => {
     expect(Object.keys(report.moduleToChunks)).toHaveLength(0);
   });
 });
+
+describe('analyzeBundle: barrel-leak (graph × bundle)', () => {
+  const siblings = Array.from({ length: 8 }, (_, i) => `src/ui/C${i + 1}.ts`);
+  const barrelModules = [
+    mod('src/ui/index.ts'),
+    ...siblings.map((s) => mod(s)),
+    mod('src/app/Page.tsx'),
+  ];
+  const barrelEdges = [
+    ...siblings.map((s) => ({
+      from: 'src/ui/index.ts',
+      to: s,
+      kind: 'static' as const,
+      specifier: `./${s.slice('src/ui/'.length, -'.ts'.length)}`,
+      resolved: true,
+    })),
+    {
+      from: 'src/app/Page.tsx',
+      to: 'src/ui/index.ts',
+      kind: 'static' as const,
+      specifier: '@/ui',
+      resolved: true,
+    },
+  ];
+
+  it('flags a barrel that pulls its whole directory into one chunk', () => {
+    const stats = parseBundleStats(
+      {
+        chunks: [
+          {
+            id: 'main',
+            files: ['main.js'],
+            size: 100_000,
+            modules: [
+              { name: 'src/ui/index.ts', size: 1_000 },
+              ...siblings.map((s) => ({ name: s, size: 5_000 })),
+              { name: 'src/app/Page.tsx', size: 2_000 },
+            ],
+          },
+        ],
+      },
+      { rootPath: '/repo' },
+    );
+    const report = analyzeBundle({ modules: barrelModules, edges: barrelEdges, stats });
+    const leak = report.bloat.find((b) => b.kind === 'barrel-leak');
+    expect(leak).toBeDefined();
+    expect(leak?.modules).toEqual(['src/ui/index.ts']);
+    expect(leak?.detail?.moduleCount).toBe(8);
+    expect(leak?.detail?.sizeBytes).toBe(40_000);
+  });
+
+  it('does not flag when only a few siblings co-locate with the barrel', () => {
+    const stats = parseBundleStats(
+      {
+        chunks: [
+          {
+            id: 'main',
+            files: ['main.js'],
+            size: 30_000,
+            modules: [
+              { name: 'src/ui/index.ts', size: 1_000 },
+              ...siblings.slice(0, 3).map((s) => ({ name: s, size: 5_000 })),
+            ],
+          },
+          {
+            id: 'other',
+            files: ['other.js'],
+            size: 25_000,
+            modules: siblings.slice(3).map((s) => ({ name: s, size: 5_000 })),
+          },
+        ],
+      },
+      { rootPath: '/repo' },
+    );
+    const report = analyzeBundle({ modules: barrelModules, edges: barrelEdges, stats });
+    expect(report.bloat.some((b) => b.kind === 'barrel-leak')).toBe(false);
+  });
+
+  it('skips barrel-leak detection when no edges are supplied', () => {
+    const stats = parseBundleStats(
+      {
+        chunks: [
+          {
+            id: 'main',
+            files: ['main.js'],
+            size: 100_000,
+            modules: [
+              { name: 'src/ui/index.ts', size: 1_000 },
+              ...siblings.map((s) => ({ name: s, size: 5_000 })),
+            ],
+          },
+        ],
+      },
+      { rootPath: '/repo' },
+    );
+    const report = analyzeBundle({ modules: barrelModules, stats });
+    expect(report.bloat.some((b) => b.kind === 'barrel-leak')).toBe(false);
+  });
+});

package/src/analyzer/__tests__/hotZones.test.ts

@@ -0,0 +1,128 @@
+import { describe, expect, it } from 'vitest';
+import { markBarrelModules, rankHotZones } from '../hotZones';
+import type { ModuleMetrics, ModuleNode, ParsedFileSummary } from '../types';
+
+function module(id: string, overrides: Partial<ModuleNode> = {}): ModuleNode {
+  return {
+    id,
+    absPath: `/${id}`,
+    kind: 'unknown',
+    language: 'ts',
+    loc: 1,
+    exports: [],
+    isInfra: false,
+    ...overrides,
+  };
+}
+
+function metrics(overrides: Partial<ModuleMetrics> = {}): ModuleMetrics {
+  return {
+    fanIn: 0,
+    fanOut: 0,
+    instability: 0,
+    depth: 0,
+    inCycle: false,
+    couplingScore: 0,
+    hotnessScore: 0,
+    ...overrides,
+  };
+}
+
+function summary(relPath: string, overrides: Partial<ParsedFileSummary> = {}): ParsedFileSummary {
+  return {
+    relPath,
+    language: 'ts',
+    loc: 1,
+    imports: [],
+    exports: [],
+    runtimeFacts: [],
+    frameworkFacts: [],
+    routeFacts: [],
+    stateFacts: [],
+    assetFacts: [],
+    limitations: [],
+    ...overrides,
+  };
+}
+
+describe('markBarrelModules', () => {
+  it('flags a thin index barrel with fan-out >= 3 even when no export source is enumerated', () => {
+    // Pinia `packages/pinia/src/index.ts`: fan-out 8, 66 named re-exports the
+    // parser couldn't resolve a source for, ~70 loc — thin glue.
+    const modules = [
+      module('packages/pinia/src/index.ts', {
+        loc: 70,
+        exports: Array.from({ length: 66 }, (_, i) => `reexport${i}`),
+      }),
+    ];
+    const m = { 'packages/pinia/src/index.ts': metrics({ fanOut: 8 }) };
+    markBarrelModules({
+      modules,
+      metrics: m,
+      parserFacts: [summary('packages/pinia/src/index.ts', { loc: 70 })],
+    });
+    expect(modules[0]?.isBarrel).toBe(true);
+  });
+
+  it('flags a mid/small package barrel below the old fan-out fallback', () => {
+    // VueUse `packages/math/index.ts`: fan-out 18, ~20 loc.
+    const modules = [module('packages/math/index.ts', { loc: 20 })];
+    const m = { 'packages/math/index.ts': metrics({ fanOut: 18 }) };
+    markBarrelModules({ modules, metrics: m, parserFacts: [] });
+    expect(modules[0]?.isBarrel).toBe(true);
+  });
+
+  it('does not flag a fat module with many source lines per export', () => {
+    // VueUse `useStorage/index.ts`: loc 328, surface 7 → 46 loc/item.
+    const modules = [module('packages/core/useStorage/index.ts', { loc: 328 })];
+    const m = { 'packages/core/useStorage/index.ts': metrics({ fanOut: 5 }) };
+    markBarrelModules({
+      modules,
+      metrics: m,
+      parserFacts: [summary('packages/core/useStorage/index.ts', { loc: 328 })],
+    });
+    expect(modules[0]?.isBarrel).toBeUndefined();
+  });
+
+  it('does not flag a fan-out-0 multi-export util that re-exports nothing', () => {
+    // VueUse `shared/utils/is.ts`: fan-out 0, 13 own exports — a leaf, not glue.
+    const modules = [
+      module('packages/shared/utils/is.ts', {
+        loc: 30,
+        exports: Array.from({ length: 13 }, (_, i) => `is${i}`),
+      }),
+    ];
+    const m = { 'packages/shared/utils/is.ts': metrics({ fanOut: 0 }) };
+    markBarrelModules({ modules, metrics: m, parserFacts: [] });
+    expect(modules[0]?.isBarrel).toBeUndefined();
+  });
+
+  it('does not flag a thin module whose surface is below the floor', () => {
+    // Two imports, two re-exports: not an aggregation surface.
+    const modules = [module('src/glue.ts', { loc: 3 })];
+    const m = { 'src/glue.ts': metrics({ fanOut: 3 }) };
+    markBarrelModules({ modules, metrics: m, parserFacts: [] });
+    expect(modules[0]?.isBarrel).toBeUndefined();
+  });
+});
+
+describe('rankHotZones', () => {
+  it('drops barrels from the ranked window without backfilling lower-signal modules', () => {
+    const modules = [module('barrel/index.ts', { isBarrel: true }), module('a.ts'), module('b.ts')];
+    const m = {
+      'barrel/index.ts': metrics({ hotnessScore: 5 }),
+      'a.ts': metrics({ hotnessScore: 3 }),
+      'b.ts': metrics({ hotnessScore: 1 }),
+    };
+    expect(rankHotZones({ modules, metrics: m, topN: 2 })).toEqual(['a.ts']);
+  });
+
+  it('excludes infra modules', () => {
+    const modules = [module('infra.ts', { isInfra: true }), module('app.ts')];
+    const m = {
+      'infra.ts': metrics({ hotnessScore: 9 }),
+      'app.ts': metrics({ hotnessScore: 2 }),
+    };
+    expect(rankHotZones({ modules, metrics: m })).toEqual(['app.ts']);
+  });
+});

package/src/analyzer/__tests__/incremental.test.ts

@@ -1,7 +1,7 @@
-// Контракт: incrementalAnalyze должен либо вернуть результат, эквивалентный
-// полному `analyze()` после применения тех же изменений к источнику, либо
-// прозрачно делегировать в analyze(). В обоих случаях downstream-данные
-// (modules/edges/cycles/metrics) должны соответствовать пост-стейту источника.
+// Contract: incrementalAnalyze must either return a result equivalent to a
+// full `analyze()` after applying the same changes to the source, or
+// transparently delegate to analyze(). In both cases the downstream data
+// (modules/edges/cycles/metrics) must match the post-state of the source.
 
 import { describe, expect, it } from 'vitest';
 import { analyze } from '../index';
@@ -16,7 +16,7 @@ function project(files: Record<string, string>) {
 }
 
 describe('incrementalAnalyze', () => {
-  it('пере-парс одного файла даёт тот же результат, что и полный analyze пост-стейта', async () => {
+  it('re-parsing a single file yields the same result as a full analyze of the post-state', async () => {
     const before = {
       'src/a.ts': "import { b } from '@/b';\nexport const a = b;\n",
       'src/b.ts': 'export const b = 1;\n',
@@ -32,13 +32,13 @@ describe('incrementalAnalyze', () => {
       changedFiles: ['src/a.ts'],
     });
 
-    // структурное равенство по ключевым полям (durationMs/scannedAt отбрасываем)
+    // structural equality on the key fields (durationMs/scannedAt dropped)
     expect(sortEdges(got.edges)).toEqual(sortEdges(expected.edges));
     expect(got.modules.find((m) => m.id === 'src/a.ts')?.exports).toEqual(['a']);
     expect(got.cycles).toEqual(expected.cycles);
   });
 
-  it('изменение типа модуля (loc, exports) попадает в результат', async () => {
+  it('a change to module shape (loc, exports) lands in the result', async () => {
     const before = {
       'src/util.ts': 'export const x = 1;\n',
       'src/main.ts': "import { x } from '@/util';\nexport default x;\n",
@@ -61,7 +61,7 @@ describe('incrementalAnalyze', () => {
     expect(util?.loc).toBe(prev.modules.find((m) => m.id === 'src/util.ts')!.loc + 2);
   });
 
-  it('появление цикла после правки детектируется', async () => {
+  it('a cycle appearing after an edit is detected', async () => {
     const before = {
       'src/a.ts': "import { b } from '@/b';\nexport const a = b;\n",
       'src/b.ts': 'export const b = 1;\n',
@@ -82,7 +82,7 @@ describe('incrementalAnalyze', () => {
     expect(got.cycles[0]?.modules.sort()).toEqual(['src/a.ts', 'src/b.ts']);
   });
 
-  it('изменение конфигурационного файла → fallback на полный analyze', async () => {
+  it('a config file change → fallback to a full analyze', async () => {
     const before = {
       'src/a.ts': 'export const a = 1;\n',
     };
@@ -98,12 +98,12 @@ describe('incrementalAnalyze', () => {
       source: newSource,
       changedFiles: ['tsconfig.json', 'src/b.ts'],
     });
-    // если прошло через analyze, новый алиас и новый файл подхвачены
+    // if it went through analyze, the new alias and new file are picked up
     expect(got.modules.map((m) => m.id).sort()).toEqual(['src/a.ts', 'src/b.ts']);
     expect(got.edges.find((e) => e.from === 'src/b.ts')?.to).toBe('src/a.ts');
   });
 
-  it('новый файл (не в prev) → fallback на полный analyze', async () => {
+  it('a new file (not in prev) → fallback to a full analyze', async () => {
     const before = {
       'src/a.ts': 'export const a = 1;\n',
     };
@@ -121,7 +121,7 @@ describe('incrementalAnalyze', () => {
     expect(got.modules.map((m) => m.id).sort()).toEqual(['src/a.ts', 'src/new.ts']);
   });
 
-  it('удалённый файл → fallback на полный analyze', async () => {
+  it('a deleted file → fallback to a full analyze', async () => {
     const before = {
       'src/a.ts': "import { b } from '@/b';\nexport const a = b;\n",
       'src/b.ts': 'export const b = 1;\n',
@@ -137,7 +137,55 @@ describe('incrementalAnalyze', () => {
     expect(got.modules.map((m) => m.id)).toEqual(['src/a.ts']);
   });
 
-  it('пустой changedFiles → возвращает prev без работы', async () => {
+  it('incremental preserves runtime from the server-only package (== cold)', async () => {
+    const before = {
+      'package.json': JSON.stringify({ dependencies: { next: '^14.0.0' } }),
+      'app/Form.tsx':
+        "'use client';\nimport { getSecret } from '../lib/secret';\nexport default function F(){ return getSecret(); }\n",
+      'lib/secret.ts': "import 'server-only';\nexport const getSecret = () => 1;\n",
+    };
+    const prev = await analyze(project(before));
+    const after = {
+      ...before,
+      'lib/secret.ts': "import 'server-only';\n// touched\nexport const getSecret = () => 1;\n",
+    };
+    const expected = await analyze(project(after));
+    const got = await incrementalAnalyze({
+      prev,
+      source: project(after),
+      changedFiles: ['lib/secret.ts'],
+    });
+    expect(got.modules.find((m) => m.id === 'lib/secret.ts')?.runtime).toBe('server');
+    const rsc = (v: { kind: string }): boolean => v.kind === 'rsc-leak';
+    expect(got.contractViolations.filter(rsc).length).toBe(
+      expected.contractViolations.filter(rsc).length,
+    );
+  });
+
+  it('incremental preserves the Nuxt composable auto-import edge (== cold)', async () => {
+    const before = {
+      'package.json': JSON.stringify({ dependencies: { nuxt: '^3.0.0' } }),
+      'app.vue': '<template><NuxtPage /></template>',
+      'pages/index.vue':
+        '<script setup lang="ts">\nconst n = useCounter();\n</script>\n<template><div>{{ n }}</div></template>',
+      'composables/useCounter.ts': 'export function useCounter() { return 0; }',
+    };
+    const prev = await analyze(project(before));
+    const after = {
+      ...before,
+      'pages/index.vue':
+        '<script setup lang="ts">\n// touched\nconst n = useCounter();\n</script>\n<template><div>{{ n }}</div></template>',
+    };
+    const expected = await analyze(project(after));
+    const got = await incrementalAnalyze({
+      prev,
+      source: project(after),
+      changedFiles: ['pages/index.vue'],
+    });
+    expect(sortEdges(got.edges)).toEqual(sortEdges(expected.edges));
+  });
+
+  it('empty changedFiles → returns prev without doing work', async () => {
     const before = { 'src/a.ts': 'export const a = 1;\n' };
     const prev = await analyze(project(before));
     const got = await incrementalAnalyze({

package/src/analyzer/__tests__/layerViolationAccuracy.test.ts

@@ -0,0 +1,77 @@
+// Controlled precision/recall for layer violations (plan A3).
+//
+// Real OSS projects rarely declare FSD layers, so there is no external oracle.
+// Instead we measure on a fixture with a KNOWN ground truth: a fixed set of
+// legal (top-down / same-layer) edges and a fixed set of injected violations
+// (bottom-up imports). The detector must flag exactly the violations.
+
+import { describe, expect, it } from 'vitest';
+import { detectLayerViolations } from '../layers';
+import type { DependencyEdge, ModuleNode } from '../types';
+
+const mod = (id: string): ModuleNode => ({
+  id,
+  absPath: `/${id}`,
+  kind: 'unknown',
+  language: 'ts',
+  loc: 1,
+  exports: [],
+  isInfra: false,
+});
+const edge = (from: string, to: string): DependencyEdge => ({
+  from,
+  to,
+  kind: 'static',
+  specifier: to,
+  resolved: true,
+});
+
+// One module per FSD layer (low → high: shared < entities < features < widgets < pages < app).
+const A = 'src/app/A.ts';
+const P = 'src/pages/P.ts';
+const W = 'src/widgets/W.ts';
+const F = 'src/features/F.ts';
+const F2 = 'src/features/F2.ts';
+const E = 'src/entities/E.ts';
+const S = 'src/shared/S.ts';
+const modules = [A, P, W, F, F2, E, S].map(mod);
+
+// Legal: top-down (and same-layer) — must NOT be flagged.
+const legal: DependencyEdge[] = [
+  edge(A, P),
+  edge(A, S),
+  edge(P, W),
+  edge(W, F),
+  edge(F, E),
+  edge(E, S),
+  edge(F, F2),
+];
+
+// Injected violations: bottom-up imports — the ground-truth positives.
+const violating: DependencyEdge[] = [
+  edge(S, E),
+  edge(S, A),
+  edge(E, F),
+  edge(F, W),
+  edge(W, P),
+  edge(P, A),
+];
+
+describe('layer violations — precision/recall on injected ground truth (A3)', () => {
+  it('flags exactly the injected violations: precision = recall = 1.0', () => {
+    const known = new Set(violating.map((e) => `${e.from}->${e.to}`));
+    const detected = detectLayerViolations(modules, [...legal, ...violating]);
+    const detectedPairs = detected.map((v) => `${v.from}->${v.to}`);
+
+    const tp = detectedPairs.filter((p) => known.has(p)).length;
+    const fp = detectedPairs.filter((p) => !known.has(p)).length;
+    const fn = [...known].filter((p) => !detectedPairs.includes(p)).length;
+
+    const precision = tp / (tp + fp);
+    const recall = tp / (tp + fn);
+
+    expect(precision).toBe(1); // no legal edge mis-flagged
+    expect(recall).toBe(1); // every injected violation caught
+    expect(tp).toBe(violating.length);
+  });
+});

package/src/analyzer/__tests__/memoryRisk.test.ts

@@ -111,6 +111,100 @@ describe('memory risk analysis', () => {
     ]);
   });
 
+  it('does not flag a bare fire-and-forget setTimeout', async () => {
+    const result = await analyze(
+      createInMemoryFileSource('/p', {
+        'package.json': JSON.stringify({ dependencies: { react: '^18.0.0' } }),
+        'tsconfig.json': JSON.stringify({ compilerOptions: { jsx: 'react-jsx' } }),
+        'src/App.tsx': `
+          import { useEffect } from 'react';
+
+          export function App() {
+            useEffect(() => {
+              setTimeout(() => window.removeEventListener('x', () => {}), 100);
+            }, []);
+            return null;
+          }
+        `,
+      }),
+    );
+
+    expect((result.memoryRisks ?? []).filter((risk) => risk.kind === 'timer-cleanup')).toEqual([]);
+  });
+
+  it('flags a captured setTimeout handle without clearTimeout', async () => {
+    const result = await analyze(
+      createInMemoryFileSource('/p', {
+        'package.json': JSON.stringify({ dependencies: { react: '^18.0.0' } }),
+        'tsconfig.json': JSON.stringify({ compilerOptions: { jsx: 'react-jsx' } }),
+        'src/App.tsx': `
+          import { useEffect } from 'react';
+
+          export function App() {
+            useEffect(() => {
+              const id = setTimeout(() => {}, 100);
+              return undefined;
+            }, []);
+            return null;
+          }
+        `,
+      }),
+    );
+
+    expect(result.memoryRisks).toEqual([
+      expect.objectContaining({
+        kind: 'timer-cleanup',
+        moduleId: 'src/App.tsx',
+        framework: 'react',
+      }),
+    ]);
+  });
+
+  it('keeps a captured setTimeout with clearTimeout clean', async () => {
+    const result = await analyze(
+      createInMemoryFileSource('/p', {
+        'package.json': JSON.stringify({ dependencies: { react: '^18.0.0' } }),
+        'tsconfig.json': JSON.stringify({ compilerOptions: { jsx: 'react-jsx' } }),
+        'src/App.tsx': `
+          import { useEffect } from 'react';
+
+          export function App() {
+            useEffect(() => {
+              const id = setTimeout(() => {}, 100);
+              return () => clearTimeout(id);
+            }, []);
+            return null;
+          }
+        `,
+      }),
+    );
+
+    expect((result.memoryRisks ?? []).filter((risk) => risk.kind === 'timer-cleanup')).toEqual([]);
+  });
+
+  it('still flags setInterval without clearInterval', async () => {
+    const result = await analyze(
+      createInMemoryFileSource('/p', {
+        'package.json': JSON.stringify({ dependencies: { react: '^18.0.0' } }),
+        'tsconfig.json': JSON.stringify({ compilerOptions: { jsx: 'react-jsx' } }),
+        'src/App.tsx': `
+          import { useEffect } from 'react';
+
+          export function App() {
+            useEffect(() => {
+              setInterval(() => {}, 1000);
+            }, []);
+            return null;
+          }
+        `,
+      }),
+    );
+
+    expect(result.memoryRisks).toEqual([
+      expect.objectContaining({ kind: 'timer-cleanup', moduleId: 'src/App.tsx' }),
+    ]);
+  });
+
   it('does not flag Next server modules as browser memory risks', async () => {
     const result = await analyze(
       createInMemoryFileSource('/p', {