@avi2dg/checks 0.17.0 → 0.19.0

package/scripts/repetition.ts

@@ -4,22 +4,22 @@ import { changedPaths, checkoutFiles, collect, git, pathsAt, rangeFromArgs } fro
 import { runMain } from "./main.ts";
 import { readQuality } from "./quality-file.ts";
 
-type Fragment = {
+export type Fragment = {
   readonly file: string;
   readonly start: number;
   readonly end: number;
 };
 
-type Clone = readonly [Fragment, Fragment];
+export type Clone = readonly [Fragment, Fragment];
 
-type Rise = {
+export type Rise = {
   readonly file: string;
   readonly before: number;
   readonly after: number;
   readonly clones: readonly Clone[];
 };
 
-type Held = {
+export type Held = {
   readonly measured: number;
   readonly rises: readonly Rise[];
   readonly advisory: ReadonlyMap<string, number>;
@@ -86,7 +86,7 @@ const scan = Effect.fn("scan")(
   Effect.scoped,
 );
 
-function clonesOf(file: string, clones: readonly Clone[]): readonly Clone[] {
+export function clonesOf(file: string, clones: readonly Clone[]): readonly Clone[] {
   return clones
     .flatMap(([first, second]): Clone[] => {
       if (first.file === file) return [[first, second]];
@@ -95,6 +95,36 @@ function clonesOf(file: string, clones: readonly Clone[]): readonly Clone[] {
     .toSorted(([a], [b]) => a.start - b.start);
 }
 
+// Decides which held file repeats more lines than the same path, or the path it was renamed
+// from, repeated at the base.
+export function risesOf(
+  held: readonly string[],
+  before: ReadonlyMap<string, number>,
+  after: ReadonlyMap<string, number>,
+  formerPath: ReadonlyMap<string, string>,
+  clones: readonly Clone[],
+): readonly Rise[] {
+  return held
+    .flatMap((file): Rise[] => {
+      const was = before.get(formerPath.get(file) ?? file) ?? 0;
+      const is = after.get(file) ?? 0;
+      return is > was ? [{ file, before: was, after: is, clones: clonesOf(file, clones) }] : [];
+    })
+    .toSorted((a, b) => a.file.localeCompare(b.file));
+}
+
+// Tallies every held file that did not rise, plus every file outside the held set, as advisory.
+export function heldOf(
+  measured: number,
+  rises: readonly Rise[],
+  after: ReadonlyMap<string, number>,
+  othersRepeated: ReadonlyMap<string, number>,
+): Held {
+  const risen = new Set(rises.map((rise) => rise.file));
+  const advisory = [...after].filter(([file]) => !risen.has(file)).concat([...othersRepeated]);
+  return { measured, rises, advisory: new Map(advisory.toSorted(([a], [b]) => a.localeCompare(b))) };
+}
+
 const runHold = Effect.fn("runHold")(function* (root: string, production: readonly string[], base: string, head: string) {
   const pathspecs = [...production.map((glob) => `:(glob)${glob}`), DECLARATIONS];
   const held = yield* pathsAt(head, pathspecs, root);
@@ -107,28 +137,19 @@ const runHold = Effect.fn("runHold")(function* (root: string, production: readon
   const before = repeatedLines(yield* scan(root, base, yield* pathsAt(base, pathspecs, root)));
   const clones = yield* scan(root, head, held);
   const after = repeatedLines(clones);
-  const rises = held.flatMap((file): Rise[] => {
-    const was = before.get(formerPath.get(file) ?? file) ?? 0;
-    const is = after.get(file) ?? 0;
-    return is > was ? [{ file, before: was, after: is, clones: clonesOf(file, clones) }] : [];
-  });
-  const risen = new Set(rises.map((rise) => rise.file));
-  const advisory = [...after].filter(([file]) => !risen.has(file)).concat([...repeatedLines(yield* scan(root, head, others))]);
-  return {
-    measured: held.length,
-    rises: rises.toSorted((a, b) => a.file.localeCompare(b.file)),
-    advisory: new Map(advisory.toSorted(([a], [b]) => a.localeCompare(b))),
-  } satisfies Held;
+  const rises = risesOf(held, before, after, formerPath, clones);
+  const othersRepeated = repeatedLines(yield* scan(root, head, others));
+  return heldOf(held.length, rises, after, othersRepeated) satisfies Held;
 });
 
-function describe({ file, before, after, clones }: Rise): readonly string[] {
+export function describe({ file, before, after, clones }: Rise): readonly string[] {
   return [
     `  ${file}: ${after} repeated line(s), up from ${before}`,
     ...clones.map(([own, other]) => `    ${own.file}:${own.start}-${own.end} repeats ${other.file}:${other.start}-${other.end}`),
   ];
 }
 
-function report({ measured, rises, advisory }: Held): string {
+export function report({ measured, rises, advisory }: Held): string {
   const verdict =
     rises.length === 0
       ? [`${NAME}: ${measured} production file(s) repeat no more lines than where the range starts, ${MEASURE}`]

package/scripts/shell-command.ts

@@ -0,0 +1,74 @@
+export type Command = readonly string[];
+
+type Span = {
+  readonly text: string;
+  readonly end: number;
+};
+
+const VARIABLE = /^\$(?:[A-Za-z_][A-Za-z0-9_]*|\{[A-Za-z_][A-Za-z0-9_]*\})/;
+const UNPLAIN = new Set(["|", "&", ";", "<", ">", "(", ")", "`", "\\", "#", "\n"]);
+
+function variable(line: string, from: number): Span | undefined {
+  const match = VARIABLE.exec(line.slice(from));
+  return match === null ? undefined : { text: match[0], end: from + match[0].length };
+}
+
+function singleQuoted(line: string, open: number): Span | undefined {
+  const close = line.indexOf("'", open + 1);
+  return close === -1 ? undefined : { text: line.slice(open + 1, close), end: close + 1 };
+}
+
+function doubleQuoted(line: string, open: number): Span | undefined {
+  let text = "";
+  let index = open + 1;
+  while (line.charAt(index) !== '"') {
+    const inner = line.charAt(index);
+    if (inner === "" || inner === "\\" || inner === "`") return undefined;
+    const part = inner === "$" ? variable(line, index) : { text: inner, end: index + 1 };
+    if (part === undefined) return undefined;
+    text += part.text;
+    index = part.end;
+  }
+  return { text, end: index + 1 };
+}
+
+function wordPart(line: string, index: number): Span | undefined {
+  const char = line.charAt(index);
+  if (char === "'") return singleQuoted(line, index);
+  if (char === '"') return doubleQuoted(line, index);
+  if (char === "$") return variable(line, index);
+  return UNPLAIN.has(char) ? undefined : { text: char, end: index + 1 };
+}
+
+// A script counts only when it is one line of plain words: any shell control, redirection or
+// substitution can run the gate without its failure failing the step.
+export function plainCommand(script: string): Command | undefined {
+  const line = script.trim();
+  const words: string[] = [];
+  let word: string | undefined;
+  let index = 0;
+  while (index < line.length) {
+    const char = line.charAt(index);
+    if (char === " " || char === "\t") {
+      if (word !== undefined) words.push(word);
+      word = undefined;
+      index += 1;
+    } else {
+      const part = wordPart(line, index);
+      if (part === undefined) return undefined;
+      word = (word ?? "") + part.text;
+      index = part.end;
+    }
+  }
+  if (word !== undefined) words.push(word);
+  return words.length === 0 ? undefined : words;
+}
+
+export function invokes(command: Command | undefined, gate: Command): boolean {
+  return command !== undefined && gate.length <= command.length && gate.every((word, index) => command[index] === word);
+}
+
+export function mentions(script: string, gate: Command): boolean {
+  const tokens = script.split(/[\s|&;<>()`]+/);
+  return tokens.some((_, start) => invokes(tokens.slice(start), gate));
+}

package/scripts/size-budget.ts

@@ -1,8 +1,9 @@
 #!/usr/bin/env bun
 import { Console, Effect, FileSystem, Path, Schema } from "effect";
 import { changedPaths, collect, git, pathsAt, rangeEnds, type Change } from "./git.ts";
-import { runMain, Usage } from "./main.ts";
-import { readQuality, renderJson } from "./quality-file.ts";
+import { runMain } from "./main.ts";
+import { renderJson } from "./quality-file.ts";
+import { rangeGateInputs } from "./range-gate.ts";
 import {
   budgetOf,
   budgetsOf,
@@ -19,9 +20,9 @@ import {
   type SizeRule,
 } from "./size-rules.ts";
 
-type Held = { readonly path: string; readonly from: string };
+export type Held = { readonly path: string; readonly from: string };
 
-type Site = {
+export type Site = {
   readonly file: string;
   readonly line: number | undefined;
   readonly rule: SizeRule["rule"];
@@ -29,7 +30,7 @@ type Site = {
   readonly message: string;
 };
 
-type Growth = {
+export type Growth = {
   readonly file: string;
   readonly rule: SizeRule["rule"];
   readonly base: number;
@@ -37,7 +38,7 @@ type Growth = {
   readonly sites: readonly Site[];
 };
 
-type Verdict =
+export type Verdict =
   | { readonly applies: "all"; readonly held: number; readonly overruns: readonly Site[]; readonly advisory: readonly Site[] }
   | { readonly applies: "ratchet"; readonly held: number; readonly growths: readonly Growth[]; readonly advisory: readonly Site[] };
 
@@ -68,7 +69,17 @@ const Diagnostic = Schema.Struct({
 
 const decodeReport = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ diagnostics: Schema.Array(Diagnostic) })));
 
-function rulesOf(budget: Budget): Record<string, unknown> {
+type Rules = Readonly<Record<string, unknown>>;
+
+export type SizeConfig = {
+  readonly plugins: readonly string[];
+  readonly jsPlugins: readonly string[];
+  readonly categories: Readonly<Record<string, string>>;
+  readonly rules: Rules;
+  readonly overrides: readonly { readonly files: readonly string[]; readonly rules: Rules }[];
+};
+
+function rulesOf(budget: Budget): Rules {
   return Object.fromEntries(
     SIZE_RULES.map((entry) => {
       const max = budget[entry.key];
@@ -77,7 +88,7 @@ function rulesOf(budget: Budget): Record<string, unknown> {
   );
 }
 
-function sizeConfig({ production, tests }: Budgets, plugin: string): unknown {
+export function sizeConfig({ production, tests }: Budgets, plugin: string): SizeConfig {
   return {
     plugins: [],
     jsPlugins: [plugin],
@@ -87,7 +98,7 @@ function sizeConfig({ production, tests }: Budgets, plugin: string): unknown {
   };
 }
 
-function heldByChange(changes: readonly Change[]): readonly Held[] {
+export function heldByChange(changes: readonly Change[]): readonly Held[] {
   return changes.flatMap((change) => {
     if (change.kind === "written") return [{ path: change.path, from: change.path }];
     if (change.kind === "renamed" && change.edited) return [{ path: change.path, from: change.from }];
@@ -117,7 +128,9 @@ const materializeBase = Effect.fn("materializeBase")(function* (root: string, ba
   yield* git(["checkout-index", "--all", `--prefix=${tree}/`], root, { env });
 });
 
-const siteOf = (budgets: Budgets) =>
+export const siteOf = (
+  budgets: Budgets,
+): ((diagnostic: typeof Diagnostic.Type) => Effect.Effect<readonly Site[], OxlintUnreadable>) =>
   Effect.fn("siteOf")(function* ({ code, message, filename, labels }: typeof Diagnostic.Type) {
     const rule = SIZE_RULES.find((candidate) => code === diagnosticCode(candidate));
     if (rule === undefined) return [];
@@ -165,7 +178,8 @@ function total(sites: readonly Site[]): number {
   return sites.reduce((sum, { overrun }) => sum + overrun, 0);
 }
 
-function growthsOf(head: readonly Site[], base: readonly Site[]): readonly Growth[] {
+// Sums each rule per file separately, so a shrink in one rule or file never offsets a growth in another.
+export function growthsOf(head: readonly Site[], base: readonly Site[]): readonly Growth[] {
   const before = byFileAndRule(base);
   return [...byFileAndRule(head).entries()].flatMap(([group, sites]) => {
     const [first] = sites;
@@ -174,6 +188,24 @@ function growthsOf(head: readonly Site[], base: readonly Site[]): readonly Growt
   });
 }
 
+// Decides the verdict from sites oxlint already measured: which are held to the range or the
+// whole tree, and, under ratchet, which grew past what the base measured for the same file and rule.
+export function verdictOf(
+  applies: Applies,
+  held: number,
+  holds: ReadonlySet<string>,
+  sites: readonly Site[],
+  baseSites: readonly Site[],
+): Verdict {
+  const heldSites = sites.filter((site) => holds.has(site.file));
+  if (applies !== "ratchet") {
+    return { applies, held, overruns: heldSites, advisory: sites.filter((site) => !holds.has(site.file)) };
+  }
+  const growths = growthsOf(heldSites, baseSites);
+  const failing = new Set(growths.flatMap((growth) => growth.sites));
+  return { applies, held, growths, advisory: sites.filter((site) => !failing.has(site)) };
+}
+
 const heldFiles = Effect.fn("heldFiles")(function* (root: string, applies: Applies, pathspecs: readonly string[], base: string, head: string) {
   if (applies === "all") return (yield* pathsAt(head, pathspecs, root)).map((path): Held => ({ path, from: path }));
   return heldByChange(yield* changedPaths(base, head, pathspecs, root));
@@ -195,25 +227,20 @@ const runBudget = Effect.fn("runBudget")(
     if (held.length + others.length > 0) yield* materializeHead(root, head, [...holds, ...others], headTree);
     const plugin = path.join(import.meta.dir, "..", "dist", "index.js");
     const sites = yield* measure(headTree, budgets, plugin);
-    const heldSites = sites.filter((site) => holds.has(site.file));
-    if (applies !== "ratchet") {
-      return { applies, held: held.length, overruns: heldSites, advisory: sites.filter((site) => !holds.has(site.file)) } satisfies Verdict;
-    }
+    if (applies !== "ratchet") return verdictOf(applies, held.length, holds, sites, []);
 
     const baseTree = path.join(scratch, "base");
     if (held.length > 0) yield* materializeBase(root, base, held, baseTree);
-    const growths = growthsOf(heldSites, yield* measure(baseTree, budgets, plugin));
-    const failing = new Set(growths.flatMap((growth) => growth.sites));
-    return { applies, held: held.length, growths, advisory: sites.filter((site) => !failing.has(site)) } satisfies Verdict;
+    return verdictOf(applies, held.length, holds, sites, yield* measure(baseTree, budgets, plugin));
   },
   Effect.scoped,
 );
 
-function describe({ file, line, message }: Site, indent = "  "): string {
+export function describe({ file, line, message }: Site, indent = "  "): string {
   return `${indent}${file}${line === undefined ? "" : `:${line}`}: ${message}`;
 }
 
-function verdictLines(verdict: Verdict): readonly string[] {
+export function verdictLines(verdict: Verdict): readonly string[] {
   const scope = SCOPE[verdict.applies];
   if (verdict.applies === "ratchet") {
     if (verdict.growths.length === 0) return [`${NAME}: ${verdict.held} file(s), ${scope}, raise no overrun past the base`];
@@ -229,7 +256,7 @@ function verdictLines(verdict: Verdict): readonly string[] {
   return [`${NAME}: ${verdict.overruns.length} overrun(s) of the budget in ${scope}:`, ...verdict.overruns.map((site) => describe(site))];
 }
 
-function report(verdict: Verdict): string {
+export function report(verdict: Verdict): string {
   const { advisory } = verdict;
   const notice =
     advisory.length === 0
@@ -238,21 +265,17 @@ function report(verdict: Verdict): string {
   return [...verdictLines(verdict), ...notice].join("\n");
 }
 
-function passes(verdict: Verdict): boolean {
+export function passes(verdict: Verdict): boolean {
   return verdict.applies === "ratchet" ? verdict.growths.length === 0 : verdict.overruns.length === 0;
 }
 
 const budget = Effect.gen(function* () {
-  const [first, second, ...extra] = process.argv.slice(2);
-  if (first === undefined || extra.length > 0) return yield* new Usage({ message: USAGE });
-
-  const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
-  const { source, quality } = yield* readQuality(root);
+  const { refs, root, source, quality } = yield* rangeGateInputs(USAGE);
   if (quality.size === undefined) {
     yield* Console.log(`${NAME}: ${source} declares no size budget`);
     return true;
   }
-  const { base, head } = yield* rangeEnds(first, second, root);
+  const { base, head } = yield* rangeEnds(refs.first, refs.second, root);
   const verdict = yield* runBudget(root, quality.size, quality.sources?.production ?? [], base, head);
 
   yield* Console.log(report(verdict));

package/scripts/suppressions-ratchet.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
 import { Console, Effect, Schema } from "effect";
-import { git, parentOrEmptyTree } from "./git.ts";
-import { runMain, Usage } from "./main.ts";
+import { git, commitOf, parentOrEmptyTree, refArgs } from "./git.ts";
+import { runMain } from "./main.ts";
 
 export const SUPPRESSIONS = "oxlint-suppressions.json";
 
@@ -49,28 +49,27 @@ export const parseSuppressions = Effect.fn("parseSuppressions")(function* (
   return suppressions;
 });
 
+type Count = {
+  readonly file: string;
+  readonly rule: string;
+  readonly count: number;
+};
+
+function countsOf(suppressions: Suppressions): readonly Count[] {
+  return [...suppressions].flatMap(([file, rules]) => [...rules].map(([rule, count]) => ({ file, rule, count })));
+}
+
+function riseOf({ file, rule, count }: Count, before: number | undefined): readonly Rise[] {
+  if (before === undefined) return count > 0 ? [{ kind: "appeared", file, rule, head: count }] : [];
+  return count > before ? [{ kind: "rose", file, rule, base: before, head: count }] : [];
+}
+
 export function compareSuppressions(base: Suppressions, head: Suppressions): Ratchet {
-  const rises: Rise[] = [];
-  let counted = 0;
-  for (const [file, rules] of head) {
-    for (const [rule, count] of rules) {
-      counted += 1;
-      const before = base.get(file)?.get(rule);
-      if (before === undefined) {
-        if (count > 0) rises.push({ kind: "appeared", file, rule, head: count });
-      } else if (count > before) {
-        rises.push({ kind: "rose", file, rule, base: before, head: count });
-      }
-    }
-  }
-  let lowered = 0;
-  for (const [file, rules] of base) {
-    for (const [rule, count] of rules) {
-      if ((head.get(file)?.get(rule) ?? 0) < count) lowered += 1;
-    }
-  }
+  const counts = countsOf(head);
+  const rises = counts.flatMap((counted) => riseOf(counted, base.get(counted.file)?.get(counted.rule)));
+  const lowered = countsOf(base).filter(({ file, rule, count }) => (head.get(file)?.get(rule) ?? 0) < count).length;
   rises.sort((a, b) => a.file.localeCompare(b.file) || a.rule.localeCompare(b.rule));
-  return { counted, lowered, rises };
+  return { counted: counts.length, lowered, rises };
 }
 
 function describeRise(rise: Rise): string {
@@ -88,10 +87,6 @@ export function report({ counted, lowered, rises }: Ratchet): string {
   ].join("\n");
 }
 
-const commitOf = Effect.fn("commitOf")(function* (rev: string) {
-  return (yield* git(["rev-parse", "--verify", `${rev}^{commit}`])).trim();
-});
-
 const mergeBase = Effect.fn("mergeBase")(function* (base: string, head: string) {
   const commit = yield* git(["merge-base", base, head]).pipe(
     Effect.mapError(() => new SuppressionsError({ message: `${base} and ${head} share no commit` })),
@@ -118,8 +113,7 @@ export const runTip = Effect.fn("runTip")(function* (tip: string) {
 });
 
 const ratchet = Effect.gen(function* () {
-  const [first, second, ...extra] = process.argv.slice(2);
-  if (first === undefined || extra.length > 0) return yield* new Usage({ message: USAGE });
+  const { first, second } = yield* refArgs(process.argv.slice(2), USAGE);
 
   const result = second !== undefined ? yield* runRange(first, second) : yield* runTip(first);
 

package/scripts/test-layout.ts

@@ -3,7 +3,8 @@ import { parse } from "@swc/core";
 import { Console, Effect, FileSystem, Path, Schema } from "effect";
 import { git } from "./git.ts";
 import { runMain } from "./main.ts";
-import { ENTRY_POINT, TEST_ENTRY_POINT } from "./gates.ts";
+import { ENTRY_POINT, QUALITY_FILE, TEST_ENTRY_POINT } from "./gates.ts";
+import { readQuality } from "./quality-file.ts";
 
 export type Violation = {
   readonly file: string;
@@ -16,7 +17,7 @@ const E2E = "tests/e2e/";
 const HELPER_DIRS = ["tests/lib/", "tests/fixtures/"] as const;
 const DATA_DIR = "tests/fixtures/";
 
-const TEST_FILE = /(?:[.](?:test|spec)|_test)[.](tsx?)$/;
+export const TEST_FILE = /(?:[.](?:test|spec)|_test)[.](tsx?)$/;
 const TARGET_FILE = /^tests\/(?:[^/]+\/)*[^/]+[.]test[.]tsx?$/;
 const TYPESCRIPT = /[.]tsx?$/;
 
@@ -39,9 +40,14 @@ const BANNED_BUN_NAMES: readonly string[] = [
 ];
 const BANNED_GLOBAL_CALLS: readonly string[] = ["fetch"];
 
-const REQUIRED_TEST_TABLE: Record<string, unknown> = {
-  pathIgnorePatterns: ["**/tests/quarantine/**"],
-};
+const IGNORES_KEY = "pathIgnorePatterns";
+const QUARANTINE = "**/tests/quarantine/**";
+const VENDORED = "repos/**";
+const PRESET_IGNORES: readonly string[] = [QUARANTINE, VENDORED];
+
+function acceptedIgnores(vendors: boolean): readonly (readonly string[])[] {
+  return vendors ? [PRESET_IGNORES] : [PRESET_IGNORES, [QUARANTINE]];
+}
 export const LAYOUT_CHECK_MARK = "scripts/test-layout.ts";
 export const LAYOUT_CHECK_BIN = "checks-test-layout";
 const OWN_ENTRY_POINT = `scripts/${ENTRY_POINT.script}`;
@@ -147,45 +153,47 @@ function importedNames(node: Record<string, unknown>): readonly string[] {
   return names;
 }
 
-function outOfProcessUse(node: Record<string, unknown>): string | undefined {
-  const type = node["type"];
+type UseCheck = (node: Record<string, unknown>) => string | undefined;
 
-  if (type === "ImportDeclaration" || type === "ExportNamedDeclaration" || type === "ExportAllDeclaration") {
-    const source = stringValue(node["source"]);
-    if (source === undefined) return undefined;
-    const banned = bannedModule(source);
-    if (banned !== undefined) return `imports node:${banned}`;
-    if (source === "bun") {
-      const name = importedNames(node).find((candidate) => BANNED_BUN_NAMES.includes(candidate));
-      if (name !== undefined) return `imports ${name} from bun`;
-    }
-    return undefined;
-  }
+function moduleUse(node: Record<string, unknown>): string | undefined {
+  const source = stringValue(node["source"]);
+  if (source === undefined) return undefined;
+  const banned = bannedModule(source);
+  if (banned !== undefined) return `imports node:${banned}`;
+  if (source !== "bun") return undefined;
+  const name = importedNames(node).find((candidate) => BANNED_BUN_NAMES.includes(candidate));
+  return name === undefined ? undefined : `imports ${name} from bun`;
+}
 
-  if (type === "MemberExpression") {
-    if (identifierName(node["object"]) !== "Bun") return undefined;
-    const property = identifierName(node["property"]);
-    if (property !== undefined && BANNED_BUN_NAMES.includes(property)) return `uses Bun.${property}`;
-    return undefined;
-  }
+function bunMemberUse(node: Record<string, unknown>): string | undefined {
+  if (identifierName(node["object"]) !== "Bun") return undefined;
+  const property = identifierName(node["property"]);
+  return property !== undefined && BANNED_BUN_NAMES.includes(property) ? `uses Bun.${property}` : undefined;
+}
 
-  if (type === "CallExpression") {
-    const callee = node["callee"];
-    const calleeName = identifierName(callee);
-    if (calleeName !== undefined && BANNED_GLOBAL_CALLS.includes(calleeName)) {
-      return `calls ${calleeName}`;
-    }
-    const argument = Array.isArray(node["arguments"]) ? node["arguments"][0] : undefined;
-    const specifier = isRecord(argument) ? stringValue(argument["expression"]) : undefined;
-    if (specifier === undefined) return undefined;
-    const banned = bannedModule(specifier);
-    if (banned === undefined) return undefined;
-    if (isRecord(callee) && callee["type"] === "Import") return `imports node:${banned}`;
-    if (calleeName === "require") return `requires node:${banned}`;
-    return undefined;
-  }
+function callUse(node: Record<string, unknown>): string | undefined {
+  const callee = node["callee"];
+  const calleeName = identifierName(callee);
+  if (calleeName !== undefined && BANNED_GLOBAL_CALLS.includes(calleeName)) return `calls ${calleeName}`;
+  const argument = Array.isArray(node["arguments"]) ? node["arguments"][0] : undefined;
+  const specifier = isRecord(argument) ? stringValue(argument["expression"]) : undefined;
+  const banned = specifier === undefined ? undefined : bannedModule(specifier);
+  if (banned === undefined) return undefined;
+  if (isRecord(callee) && callee["type"] === "Import") return `imports node:${banned}`;
+  return calleeName === "require" ? `requires node:${banned}` : undefined;
+}
+
+const USE_CHECKS = new Map<string, UseCheck>([
+  ["ImportDeclaration", moduleUse],
+  ["ExportNamedDeclaration", moduleUse],
+  ["ExportAllDeclaration", moduleUse],
+  ["MemberExpression", bunMemberUse],
+  ["CallExpression", callUse],
+]);
 
-  return undefined;
+function outOfProcessUse(node: Record<string, unknown>): string | undefined {
+  const type = node["type"];
+  return typeof type === "string" ? USE_CHECKS.get(type)?.(node) : undefined;
 }
 
 export const isolationViolations = Effect.fn("isolationViolations")(function* (file: string, source: string) {
@@ -243,7 +251,7 @@ export function scriptViolations(manifest: unknown): readonly Violation[] {
   return violations;
 }
 
-export function bunfigViolations(consumer: unknown, preset: unknown): readonly Violation[] {
+export function bunfigViolations(consumer: unknown, preset: unknown, vendors: boolean): readonly Violation[] {
   const file = "bunfig.toml";
   const copy = "bun has no bunfig extends, so copy node_modules/@avi2dg/checks/bunfig.toml";
   if (consumer === undefined) {
@@ -253,18 +261,21 @@ export function bunfigViolations(consumer: unknown, preset: unknown): readonly V
   if (!isRecord(presetTest)) {
     return [{ file, line: undefined, message: "the shipped bunfig preset has no [test] table" }];
   }
-  const expected = { ...presetTest, ...REQUIRED_TEST_TABLE };
   const consumerTest = isRecord(consumer) ? consumer["test"] : undefined;
+  const found = (key: string): unknown => (isRecord(consumerTest) ? consumerTest[key] : undefined);
+  const drifted = (key: string, wanted: string, fix: string): Violation => ({
+    file,
+    line: undefined,
+    message: `[test].${key} must be ${wanted}, found ${JSON.stringify(found(key) ?? null)}; ${fix}`,
+  });
   const violations: Violation[] = [];
-  for (const [key, value] of Object.entries(expected)) {
-    const found = isRecord(consumerTest) ? consumerTest[key] : undefined;
-    if (!Bun.deepEquals(found, value)) {
-      violations.push({
-        file,
-        line: undefined,
-        message: `[test].${key} must be ${JSON.stringify(value)}, found ${JSON.stringify(found ?? null)}; ${copy}`,
-      });
-    }
+  for (const [key, value] of Object.entries(presetTest)) {
+    if (key !== IGNORES_KEY && !Bun.deepEquals(found(key), value)) violations.push(drifted(key, JSON.stringify(value), copy));
+  }
+  const accepted = acceptedIgnores(vendors);
+  if (!accepted.some((ignores) => Bun.deepEquals(found(IGNORES_KEY), ignores))) {
+    const wanted = accepted.map((ignores) => JSON.stringify(ignores)).join(" or ");
+    violations.push(drifted(IGNORES_KEY, wanted, `the check pins it, requiring ${VENDORED} where ${QUALITY_FILE} declares sources.libraries`));
   }
   return violations;
 }
@@ -319,7 +330,9 @@ export const run = Effect.fn("run")(function* (root: string, presetPath: string)
 
   const bunfig = path.join(root, "bunfig.toml");
   const consumerBunfig = (yield* fs.exists(bunfig)) ? yield* parsedToml(bunfig) : undefined;
-  violations.push(...bunfigViolations(consumerBunfig, yield* parsedToml(presetPath)));
+  const { quality } = yield* readQuality(root);
+  const vendors = (quality.sources?.libraries ?? []).length > 0;
+  violations.push(...bunfigViolations(consumerBunfig, yield* parsedToml(presetPath), vendors));
 
   return { files: files.length, violations };
 });

package/scripts/test-report.ts

@@ -52,26 +52,31 @@ function attributesOf(source: string): Readonly<Record<string, string>> {
   return attributes;
 }
 
+const malformed = (reason: string) => new ReportError({ message: `the junit report is malformed: ${reason}` });
+
+const takeTag = Effect.fnUntraced(function* (open: Element[], match: RegExpExecArray): Effect.fn.Return<void, ReportError> {
+  const [, closing, tag, attributes, selfClosing] = match;
+  if (tag === undefined) return;
+  const parent = open.at(-1);
+  if (parent === undefined) return yield* malformed(`<${tag}> after the root closed`);
+  if (closing === "/") {
+    if (parent.tag !== tag) return yield* malformed(`</${tag}> closes <${parent.tag}>`);
+    open.pop();
+    return;
+  }
+  const element: Element = { tag, attributes: attributesOf(attributes ?? ""), children: [] };
+  parent.children.push(element);
+  if (selfClosing !== "/") open.push(element);
+});
+
 const parseElements = Effect.fnUntraced(function* (xml: string): Effect.fn.Return<Element, ReportError> {
-  const malformed = (reason: string) => new ReportError({ message: `the junit report is malformed: ${reason}` });
   const document: Element = { tag: "", attributes: {}, children: [] };
   const open: Element[] = [document];
   let consumed = 0;
   for (const match of xml.matchAll(MARKUP)) {
     if (xml.slice(consumed, match.index).includes("<")) return yield* malformed(`stray < before offset ${match.index}`);
     consumed = match.index + match[0].length;
-    const [, closing, tag, attributes, selfClosing] = match;
-    if (tag === undefined) continue;
-    const parent = open.at(-1);
-    if (parent === undefined) return yield* malformed(`<${tag}> after the root closed`);
-    if (closing === "/") {
-      if (parent.tag !== tag) return yield* malformed(`</${tag}> closes <${parent.tag}>`);
-      open.pop();
-      continue;
-    }
-    const element: Element = { tag, attributes: attributesOf(attributes ?? ""), children: [] };
-    parent.children.push(element);
-    if (selfClosing !== "/") open.push(element);
+    yield* takeTag(open, match);
   }
   if (xml.slice(consumed).includes("<")) return yield* malformed("stray < after the last element");
   if (open.length !== 1) return yield* malformed(`<${open.at(-1)?.tag}> never closes`);