@avi2dg/checks 0.30.0 → 0.31.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.31.0
+
+Released 2026-09-28.
+
+### Features
+
+- lint .astro files in lint coverage, unused and a thin-frontmatter rule [#108](https://github.com/avi2d/checks/pull/108)
+
 ## 0.30.0
 
 Released 2026-09-28.

package/README.md

@@ -118,9 +118,9 @@ The table groups the gates by vector, the part of a repository each one judges.
 | --- | --- | --- | --- |
 | complexity | [`checks-suppressions-ratchet`](docs/gates/checks-suppressions-ratchet.md) | the range | every repository |
 | complexity | [`checks-repetition`](docs/gates/checks-repetition.md) | the range | a repository tracking `*.ts` or `*.tsx` |
-| complexity | [`checks-unused`](docs/gates/checks-unused.md) | the working tree | a repository tracking `*.ts` or `*.tsx` |
+| complexity | [`checks-unused`](docs/gates/checks-unused.md) | the working tree | a repository tracking `*.ts` or `*.tsx` or `*.astro` |
 | complexity | [`checks-exports`](docs/gates/checks-exports.md) | the range | a repository tracking `*.ts` or `*.tsx` |
-| quality | [`checks-lint-coverage`](docs/gates/checks-lint-coverage.md) | the working tree | a repository tracking `*.ts` or `*.tsx` |
+| quality | [`checks-lint-coverage`](docs/gates/checks-lint-coverage.md) | the working tree | a repository tracking `*.ts` or `*.tsx` or `*.astro` |
 | quality | [`checks-comment-gate`](docs/gates/checks-comment-gate.md) | the range | every repository |
 | testing | [`checks-test-layout`](docs/gates/checks-test-layout.md) | the working tree | a repository tracking `*.ts` or `*.tsx` |
 | testing | [`checks-quarantine-clock`](docs/gates/checks-quarantine-clock.md) | the range | every repository |

package/dist/readability/index.js

@@ -416,11 +416,104 @@ var rule = {
 };
 var cognitive_complexity_default = rule;
 
+// src/complexity/readability/thin-astro.ts
+function unwrapped(expression) {
+  let current = expression;
+  while (current.type === "TSAsExpression" || current.type === "TSSatisfiesExpression" || current.type === "TSNonNullExpression" || current.type === "TSTypeAssertion") {
+    current = current.expression;
+  }
+  return current;
+}
+function isAstroProps(value) {
+  if (value.type !== "MemberExpression" || value.computed)
+    return false;
+  const { object, property } = value;
+  return object.type === "Identifier" && object.name === "Astro" && property.type === "Identifier" && property.name === "props";
+}
+function isPlainValue(value, bound) {
+  return value.type === "Literal" || value.type === "Identifier" && bound.has(value.name);
+}
+function readsProps(expression, bound) {
+  const value = unwrapped(expression);
+  if (value.type !== "MemberExpression")
+    return value.type === "Identifier" && bound.has(value.name);
+  if (value.computed && !isPlainValue(value.property, bound))
+    return false;
+  return isAstroProps(value) || readsProps(value.object, bound);
+}
+function isPlainPattern(pattern, bound) {
+  if (pattern === null)
+    return true;
+  if (pattern.type === "RestElement")
+    return isPlainPattern(pattern.argument, bound);
+  if (pattern.type === "AssignmentPattern")
+    return isPlainValue(pattern.right, bound) && isPlainPattern(pattern.left, bound);
+  if (pattern.type === "ArrayPattern")
+    return pattern.elements.every((element) => isPlainPattern(element, bound));
+  if (pattern.type === "Identifier")
+    return true;
+  return pattern.properties.every((property) => property.type === "RestElement" ? isPlainPattern(property.argument, bound) : (!property.computed || isPlainValue(property.key, bound)) && isPlainPattern(property.value, bound));
+}
+function isPropsRead(declarator, bound) {
+  return declarator.init !== null && readsProps(declarator.init, bound) && isPlainPattern(declarator.id, bound);
+}
+function boundName(pattern, found) {
+  if (pattern === null)
+    return;
+  if (pattern.type === "RestElement")
+    boundName(pattern.argument, found);
+  else if (pattern.type === "AssignmentPattern")
+    boundName(pattern.left, found);
+  else if (pattern.type === "ObjectPattern") {
+    for (const property of pattern.properties)
+      boundName(property.type === "Property" ? property.value : property.argument, found);
+  } else if (pattern.type === "ArrayPattern") {
+    for (const element of pattern.elements)
+      boundName(element, found);
+  } else
+    found.add(pattern.name);
+}
+function isTypeDeclaration(statement) {
+  const declaration = statement.type === "ExportNamedDeclaration" ? statement.declaration : statement;
+  return declaration?.type === "TSInterfaceDeclaration" || declaration?.type === "TSTypeAliasDeclaration";
+}
+var rule2 = {
+  meta: {
+    type: "problem",
+    docs: { description: 'Disallow logic in .astro frontmatter and script blocks: only imports, props and markup, with client code loaded by a side-effect import such as import "../client.ts"' }
+  },
+  create(context) {
+    if (!context.filename.endsWith(".astro"))
+      return {};
+    const bound = new Set;
+    return {
+      Program(node) {
+        for (const statement of node.body) {
+          if (statement.type === "ImportDeclaration" || statement.type === "EmptyStatement" || statement.type === "ExportNamedDeclaration" && statement.source !== null || isTypeDeclaration(statement)) {
+            continue;
+          }
+          if (statement.type === "VariableDeclaration" && statement.declarations.length > 0 && statement.declarations.every((declarator) => isPropsRead(declarator, bound))) {
+            for (const declarator of statement.declarations)
+              boundName(declarator.id, bound);
+            continue;
+          }
+          context.report({
+            node: statement,
+            message: 'an .astro frontmatter or script block holds more than imports and props: move this statement into a .ts file and import it, so the .astro file holds only imports, props and markup; a script block loads client code with a side-effect import such as import "../client.ts"'
+          });
+        }
+      }
+    };
+  }
+};
+var thin_astro_default = rule2;
+
 // src/complexity/readability/index.ts
 var plugin = {
   meta: { name: "readability" },
   rules: {
-    "cognitive-complexity": cognitive_complexity_default
+    "cognitive-complexity": cognitive_complexity_default,
+    "thin-astro": thin_astro_default
   }
 };
 var readability_default = plugin;

package/docs/configs/typescript-rules.md

@@ -43,6 +43,16 @@ The base loads the kit's `data-shape` plugin from `dist/` with one rule for ever
 - Derive such a type from the schema with `typeof Name.Type` instead of writing both.
 - The twin rule runs on production files only, so a test that declares its own schema as an oracle stays green.
 
+## Astro rules
+
+An override in `oxlintrc.json` turns on one rule of the kit's `readability` plugin in each `.astro` file:
+
+- `readability/thin-astro` refuses a statement in the frontmatter or a script block that is neither an import, a re-export from another module, a type or interface declaration, nor a variable read from `Astro.props`.
+- A default inside an `Astro.props` destructuring passes only when it is a literal or a name read from `Astro.props` earlier, so `const { title = "Home" } = Astro.props;` passes and a call or `await` in a default is refused.
+- Move a refused statement into a `.ts` file and import it, so the `.astro` file holds only imports, props and markup.
+- A script block loads client code with a side-effect import, as in `<script>import "../client.ts";</script>`, and the override turns off `import/no-unassigned-import` so that import passes.
+- A dynamic route re-exports `getStaticPaths` from a `.ts` file, as in `export { getStaticPaths } from "../lib/paths.ts";`.
+
 ## Rules outside tests
 
 An override in `oxlintrc.json` turns on these type-aware rules in each `.ts` and `.tsx` file outside `tests/`:

package/docs/design.md

@@ -86,7 +86,7 @@ npm adds `package.json`, `README.md` and `LICENSE` whatever `files` says.
 `bun pm pack` builds the same tarball the registry serves, and the consumer e2e test installs that tarball.
 
 Each oxlint plugin ships compiled under `dist/`, because Node refuses to strip types from a `.ts` file under `node_modules`.
-`@oxlint/plugins` ships no RuleTester, so each `effect-channel`, `readability` and `data-shape` rule is proven red and green against an installed consumer in `tests/e2e/consumer.test.ts`.
+`@oxlint/plugins` ships no RuleTester, so each `effect-channel`, `readability` and `data-shape` rule is proven red and green against an installed consumer in `tests/e2e/consumer.test.ts`, except `readability/thin-astro`, which `tests/e2e/astro-consumer.test.ts` proves against a consumer tree linked to the checkout.
 `dist/` is committed, with the doc templates in `dist/templates/`, and so is `CHANGELOG.md`, which the same build writes.
 No `prepack` or `prepublishOnly` script rebuilds them, so a publish ships the committed files.
 CI runs `git diff --exit-code` over the whole tree after `bun run build`.
@@ -109,7 +109,7 @@ So the three packages move together at one exact version.
 A gate then behaves the same alone or through `checks-lint`, and `lint-coverage.sh` can stay a shell script.
 The gates run one at a time and pass their output straight through, so each report reads whole and in the order of the gate table.
 `checks-lint` picks the gates that apply from the tracked files, and a repository cannot select gates.
-A TypeScript gate runs as soon as the repository tracks TypeScript source.
+A TypeScript gate runs as soon as the repository tracks TypeScript source, and `checks-lint-coverage` and `checks-unused` also run on tracked Astro source.
 
 GitHub authors the pull request merge commit it builds as `GitHub <noreply@github.com>`, and `checks-commit-identity` refuses that author.
 So `checks-lint` ends a pull request's range at the event's head commit, and the merge commit is never in it.

package/docs/gates/checks-lint-coverage.md

@@ -4,12 +4,13 @@ audience: consumers
 ---
 # checks-lint-coverage
 
-`checks-lint-coverage` is the gate that fails when oxlint skips a tracked TypeScript file, or when the program `tsconfig.json` builds drops the ts-reset rules, without saying so.
+`checks-lint-coverage` is the gate that fails when oxlint skips a tracked TypeScript or Astro file, or when the program `tsconfig.json` builds drops the ts-reset rules, without saying so.
 
 ## What it checks
 
-It fails when oxlint skips a tracked `.ts` or `.tsx` file, for example through a stray `.gitignore` entry.
+It fails when oxlint skips a tracked `.ts`, `.tsx` or `.astro` file, for example through a stray `.gitignore` entry.
 It compares `git ls-files` against oxlint's own file walk and names the missing files.
+It lists each tracked `.astro` file the same way, since oxlint lints the frontmatter and script blocks of an `.astro` file, where a script block loads client code with a side-effect import such as `import "../client.ts";`.
 
 It fails when the program `tsconfig.json` builds leaves out the `is-array` or the `json-parse` rule of `@total-typescript/ts-reset`, which `tsconfig.effect.json` lists.
 A `tsconfig.json` that does not extend `@avi2dg/checks/tsconfig.effect.json`, or that sets both `files` and `include`, leaves both rules out.
@@ -17,9 +18,9 @@ A `tsconfig.json` that does not extend `@avi2dg/checks/tsconfig.effect.json`, or
 
 ## What it reads
 
-It reads the working tree: the `*.ts` and `*.tsx` files `git ls-files` lists, and the files `oxlint --debug=files` walks.
+It reads the working tree: the `*.ts`, `*.tsx` and `*.astro` files `git ls-files` lists, and the files `oxlint --debug=files` walks.
 It walks without naming a path, since an explicit path bypasses the ignore files whose skips it looks for.
-It reads the program from `tsc --listFilesOnly -p tsconfig.json`, and passes over the program when the root holds no `tsconfig.json`.
+It reads the program from `tsc --listFilesOnly -p tsconfig.json`, and passes over the program when the repository tracks no `.ts` or `.tsx` file or the root holds no `tsconfig.json`.
 oxlint and tsc must be on `PATH`, as they are under a package script.
 
 ## Arguments
@@ -30,14 +31,14 @@ It takes none.
 
 | Code | When |
 | --- | --- |
-| 0 | the repository tracks no `.ts` or `.tsx` file, or oxlint walks each one and the program holds both ts-reset rules or the root holds no `tsconfig.json` |
+| 0 | the repository tracks no `.ts`, `.tsx` or `.astro` file, or oxlint walks each one and the program holds both ts-reset rules, the repository tracks no `.ts` or `.tsx` file or the root holds no `tsconfig.json` |
 | 1 | oxlint skips a tracked file, or the program drops a ts-reset rule |
 | 2 | oxlint cannot walk the tree, or tsc cannot list the program after oxlint walks every tracked file, as when either is not on `PATH` or a config does not parse |
 
 ## Sample output
 
 ```
-lint-coverage: oxlint skips 1/3 tracked .ts/.tsx files; missing:
+lint-coverage: oxlint skips 1/3 tracked .ts/.tsx/.astro files; missing:
 ignored/b.ts
 lint-coverage: the program tsconfig.json builds drops the ts-reset rules: is-array json-parse
   extend @avi2dg/checks/tsconfig.effect.json, and set files or include in tsconfig.json but not both
@@ -46,13 +47,13 @@ lint-coverage: the program tsconfig.json builds drops the ts-reset rules: is-arr
 A passing run counts the files and names the rules:
 
 ```
-lint-coverage: 71/71 tracked .ts/.tsx files
+lint-coverage: 71/71 tracked .ts/.tsx/.astro files
 lint-coverage: the program tsconfig.json builds holds the ts-reset rules is-array and json-parse
 ```
 
 ## When it runs
 
-`checks-lint` runs it when the repository tracks a `.ts` or `.tsx` file.
+`checks-lint` runs it when the repository tracks a `.ts`, `.tsx` or `.astro` file.
 
 ## Related topics
 

package/docs/gates/checks-lint.md

@@ -10,6 +10,7 @@ audience: consumers
 
 It runs the gates under [What runs](../../README.md#what-runs), each in its own process.
 Gates requiring tracked TypeScript files begin running when the repository tracks TypeScript.
+`checks-lint-coverage` and `checks-unused` also begin running when the repository tracks an `.astro` file.
 `checks-advisories` begins running when the repository tracks `bun.lock`.
 All other gates run for every repository.
 
@@ -53,7 +54,7 @@ checks-lint: 1 of 12 gate(s) failed: checks-comment-gate
 ## When it runs
 
 A repository runs it from `bun run lint` in a pull request workflow that fetches the whole git history.
-It leaves out the TypeScript gates while the repository tracks no TypeScript file.
+It leaves out the TypeScript gates while the repository tracks no TypeScript file, except that `checks-lint-coverage` and `checks-unused` run when it tracks an `.astro` file.
 
 ## Related topics
 

package/docs/gates/checks-unused.md

@@ -4,14 +4,14 @@ audience: consumers
 ---
 # checks-unused
 
-`checks-unused` is the gate that refuses a TypeScript file no entry point reaches.
+`checks-unused` is the gate that refuses a TypeScript or Astro file no entry point reaches.
 
 ## What it checks
 
-It runs Knip with the repository's own configuration and names each `.ts` or `.tsx` file no entry reaches.
+It runs Knip with the repository's own configuration and names each `.ts`, `.tsx` or `.astro` file no entry reaches.
 It reads only the files issue type, so an unused export or dependency never fails it.
 It asks Knip for that issue type itself, so a configuration that narrows `include`, excludes files or turns the files rule off still has its files judged.
-It fails when the repository tracks no TypeScript source, since an empty scan would pass without judging anything.
+It fails when the repository tracks no `.ts`, `.tsx` or `.astro` file, since an empty scan would pass without judging anything.
 It fails when the repository holds no Knip configuration, since Knip's default entries cannot tell a dead file from an entry point.
 
 ## What it reads
@@ -27,6 +27,7 @@ export default { ...base, entry: ["src/index.ts", "tests/**/*.test.ts"] };
 ```
 
 The base in `knip-base.json` reports only unreferenced files.
+In a repository that depends on `astro`, Knip reads `.astro` imports, so a file only an `.astro` entry imports counts as used and an `.astro` file no entry reaches is named.
 The gate resolves the Knip binary from the installed kit, so a consumer installs nothing beyond the kit.
 
 ## Arguments
@@ -39,7 +40,7 @@ It takes none.
 | --- | --- |
 | 0 | no tracked file is unreferenced |
 | 1 | a tracked file is unreferenced or the repository holds no Knip configuration |
-| 2 | the repository tracks no TypeScript source, Knip cannot run, or its configuration does not parse |
+| 2 | the repository tracks no TypeScript or Astro source, Knip cannot run, or its configuration does not parse |
 
 ## Sample output
 
@@ -51,12 +52,12 @@ unused: 1 unreferenced file(s):
 A passing run counts the files it judged:
 
 ```
-unused: no unreferenced files among 110 tracked .ts/.tsx file(s)
+unused: no unreferenced files among 110 tracked .ts/.tsx/.astro file(s)
 ```
 
 ## When it runs
 
-`checks-lint` runs it when the repository tracks a `.ts` or `.tsx` file.
+`checks-lint` runs it when the repository tracks a `.ts`, `.tsx` or `.astro` file.
 Such a repository names its entries in a Knip configuration.
 
 ## Related topics

package/oxlintrc.json

@@ -37,6 +37,13 @@
         "typescript/no-unsafe-return": "error",
         "typescript/no-unsafe-call": "error"
       }
+    },
+    {
+      "files": ["**/*.astro"],
+      "rules": {
+        "readability/thin-astro": "error",
+        "import/no-unassigned-import": "off"
+      }
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.30.0",
+  "version": "0.31.0",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "license": "MIT",
   "repository": {
@@ -117,7 +117,9 @@
     "build": "bun build src/quality/effect-channel/index.ts --outdir dist/effect-channel --target node --format esm && bun build src/complexity/readability/index.ts --outdir dist/readability --target node --format esm && bun build src/quality/data-shape/index.ts --outdir dist/data-shape --target node --format esm && bun scripts/doc-templates-write.ts && bun src/delivery/changelog-write.ts && bun scripts/doc-blocks-write.ts",
     "lint": "oxlint --type-aware && bun src/core/lint.ts && depcruise --config .dependency-cruiser.cjs .",
     "typecheck": "tsc --noEmit && effect-tsgo diagnostics --project tsconfig.json --format text --strict",
-    "test": "bun src/testing/test.ts"
+    "test": "bun src/testing/test.ts",
+    "mutate": "bunx stryker run",
+    "mutate:incremental": "bunx stryker run --incremental"
   },
   "peerDependencies": {
     "@swc/core": "1.16.2",
@@ -131,7 +133,9 @@
   },
   "devDependencies": {
     "@effect/tsgo": "0.45.0",
+    "@hughescr/stryker-bun-runner": "1.4.0",
     "@oxlint/plugins": "1.83.0",
+    "@stryker-mutator/core": "10.0.0",
     "@swc/core": "1.16.2",
     "@types/bun": "^1.3.0",
     "dependency-cruiser": "18.4.0",
@@ -148,5 +152,9 @@
     "@effect/platform-node-shared": "4.0.0-rc.115",
     "@total-typescript/ts-reset": "0.6.1",
     "knip": "6.38.0"
+  },
+  "overrides": {
+    "qs": "6.16.0",
+    "smol-toml": "1.9.0"
   }
 }

package/src/complexity/exports.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { TYPESCRIPT_SOURCE } from "../core/gates.ts";
 import { checkoutFiles, commitOf, git, pathsAt, rangeEnds, refArgs } from "../core/git.ts";
 import { runMain } from "../core/main.ts";
 import { knipReport, scanTree } from "./knip.ts";
@@ -127,7 +128,7 @@ export function report(head: Baseline, { unlisted, added, stale }: Drift): strin
     : `${NAME}: ${head.length} unused export(s) in ${BASELINE_FILE}, and no new ones`;
 }
 
-const scan = scanTree(NAME, INCLUDED).pipe(Effect.mapError((cause) => new ExportsError({ message: cause.message })));
+const scan = scanTree(NAME, INCLUDED, TYPESCRIPT_SOURCE).pipe(Effect.mapError((cause) => new ExportsError({ message: cause.message })));
 
 // Knip loads the configuration's imports, such as the kit's knip-base.json, from a node_modules the checkout lacks.
 const unusedAt = Effect.fn("unusedAt")(

package/src/complexity/knip.ts

@@ -1,4 +1,5 @@
 import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import type { TrackedContent } from "../core/gates.ts";
 import { collect, git } from "../core/git.ts";
 
 class KnipError extends Schema.TaggedError<KnipError>()("KnipError", {
@@ -16,8 +17,6 @@ const CONFIGS = [
   "knip.config.ts",
 ] as const;
 
-const TYPESCRIPT = ["*.ts", "*.tsx"];
-
 const hasKnipConfig = Effect.fn("hasKnipConfig")(function* (root: string) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
@@ -55,13 +54,13 @@ export const knipReport = Effect.fn("knipReport")(function* (root: string, args:
   return { kind: "reported", stdout: run.stdout } as const;
 });
 
-export const scanTree = Effect.fn("scanTree")(function* (name: string, args: readonly string[]) {
+export const scanTree = Effect.fn("scanTree")(function* (name: string, args: readonly string[], source: TrackedContent) {
   const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
-  const tracked = (yield* git(["ls-files", "--", ...TYPESCRIPT], root))
+  const tracked = (yield* git(["ls-files", "--", ...source.pathspecs], root))
     .split("\n")
     .map((line) => line.trim())
     .filter((line) => line !== "");
-  if (tracked.length === 0) return yield* new KnipError({ message: "no tracked .ts or .tsx files to scan" });
+  if (tracked.length === 0) return yield* new KnipError({ message: `no tracked ${source.content} to scan` });
   const reported = yield* knipReport(root, args);
   if (reported.kind === "unconfigured") {
     yield* Console.log(`${name}: no knip configuration names entry files, so add one extending the kit's knip-base.json`);

package/src/complexity/unused.ts

@@ -1,12 +1,13 @@
 #!/usr/bin/env bun
 import { Console, Effect, Schema } from "effect";
+import { LINTED_SOURCE } from "../core/gates.ts";
 import { runMain } from "../core/main.ts";
 import { scanTree } from "./knip.ts";
 
 export type Scan = { readonly tracked: number; readonly files: readonly string[] };
 
 const NAME = "unused";
-const JUDGED = /\.tsx?$/;
+const JUDGED = /[.]tsx?$|[.]astro$/;
 
 class UnusedError extends Schema.TaggedError<UnusedError>()("UnusedError", {
   message: Schema.String,
@@ -31,12 +32,12 @@ export const filesOf = Effect.fn("filesOf")(function* (stdout: string) {
 });
 
 export function report({ tracked, files }: Scan): string {
-  if (files.length === 0) return `${NAME}: no unreferenced files among ${tracked} tracked .ts/.tsx file(s)`;
+  if (files.length === 0) return `${NAME}: no unreferenced files among ${tracked} tracked .ts/.tsx/.astro file(s)`;
   return [`${NAME}: ${files.length} unreferenced file(s):`, ...files.map((file) => `  ${file}`)].join("\n");
 }
 
 const unused = Effect.gen(function* () {
-  const { tracked, reported } = yield* scanTree(NAME, ["--files"]).pipe(
+  const { tracked, reported } = yield* scanTree(NAME, ["--files"], LINTED_SOURCE).pipe(
     Effect.mapError((cause) => new UnusedError({ message: cause.message })),
   );
   if (reported.kind === "unconfigured") return false;

package/src/core/gates.ts

@@ -3,7 +3,7 @@ export type Program = {
   readonly script: string;
 };
 
-type TrackedContent = {
+export type TrackedContent = {
   readonly pathspecs: readonly string[];
   readonly content: string;
 };
@@ -30,12 +30,14 @@ export const TEST_ENTRY_POINT: Program = { bin: "checks-test", script: "testing/
 
 export const DEFAULT_BRANCH = "main";
 
-const TYPESCRIPT_SOURCE: TrackedContent = { pathspecs: ["*.ts", "*.tsx"], content: "TypeScript source" };
+export const TYPESCRIPT_SOURCE: TrackedContent = { pathspecs: ["*.ts", "*.tsx"], content: "TypeScript source" };
+
+export const LINTED_SOURCE: TrackedContent = { pathspecs: ["*.ts", "*.tsx", "*.astro"], content: "TypeScript or Astro source" };
 
 const BUN_LOCKFILE: TrackedContent = { pathspecs: ["bun.lock"], content: "a bun lockfile" };
 
 export const KIT_GATES = [
-  { bin: "checks-lint-coverage", vector: "quality", file: "lint-coverage.sh", reads: "tree", appliesTo: TYPESCRIPT_SOURCE },
+  { bin: "checks-lint-coverage", vector: "quality", file: "lint-coverage.sh", reads: "tree", appliesTo: LINTED_SOURCE },
   { bin: "checks-test-layout", vector: "testing", file: "test-layout.ts", reads: "tree", appliesTo: TYPESCRIPT_SOURCE },
   { bin: "checks-commit-identity", vector: "delivery", file: "commit-identity.ts", reads: "range", appliesTo: EVERY_REPOSITORY },
   { bin: "checks-comment-gate", vector: "quality", file: "comment-gate.ts", reads: "range", appliesTo: EVERY_REPOSITORY },
@@ -43,7 +45,7 @@ export const KIT_GATES = [
   { bin: "checks-ci-wiring", vector: "delivery", file: "ci-wiring.ts", reads: "tree", appliesTo: EVERY_REPOSITORY },
   { bin: "checks-docs", vector: "docs", file: "docs.ts", reads: "range", alsoReads: "every agent file at the head commit", appliesTo: EVERY_REPOSITORY },
   { bin: "checks-repetition", vector: "complexity", file: "repetition.ts", reads: "range", appliesTo: TYPESCRIPT_SOURCE },
-  { bin: "checks-unused", vector: "complexity", file: "unused.ts", reads: "tree", appliesTo: TYPESCRIPT_SOURCE },
+  { bin: "checks-unused", vector: "complexity", file: "unused.ts", reads: "tree", appliesTo: LINTED_SOURCE },
   { bin: "checks-exports", vector: "complexity", file: "exports.ts", reads: "range", appliesTo: TYPESCRIPT_SOURCE },
   { bin: "checks-quarantine-clock", vector: "testing", file: "quarantine-clock.ts", reads: "range", appliesTo: EVERY_REPOSITORY },
   { bin: "checks-advisories", vector: "dependencies", file: "advisories.ts", reads: "range", appliesTo: BUN_LOCKFILE },

package/src/delivery/commit-identity.ts

@@ -152,4 +152,4 @@ const check = Effect.gen(function* () {
   return true;
 });
 
-runMain("commit-identity", check);
+if (import.meta.main) runMain("commit-identity", check);

package/src/quality/lint-coverage.sh

@@ -1,14 +1,14 @@
 #!/bin/sh
-# lint-coverage: fail when oxlint silently skips a tracked TypeScript source,
+# lint-coverage: fail when oxlint silently skips a tracked TypeScript or Astro source,
 # or when tsconfig.json's program silently drops the ts-reset rules.
 set -eu
 
 tmp="$(mktemp -d)"
 trap 'rm -rf "$tmp"' EXIT INT TERM
 
-git ls-files -- '*.ts' '*.tsx' | LC_ALL=C sort > "$tmp/expected"
+git ls-files -- '*.ts' '*.tsx' '*.astro' | LC_ALL=C sort > "$tmp/expected"
 if ! [ -s "$tmp/expected" ]; then
-  echo "lint-coverage: no tracked .ts/.tsx files"
+  echo "lint-coverage: no tracked .ts/.tsx/.astro files"
   exit 0
 fi
 
@@ -18,7 +18,7 @@ if ! oxlint --debug=files > "$tmp/walk" 2> "$tmp/walk-error"; then
   cat "$tmp/walk" "$tmp/walk-error"
   exit 2
 fi
-grep -E '\.tsx?$' "$tmp/walk" | LC_ALL=C sort > "$tmp/walked" || true
+grep -E '[.]tsx?$|[.]astro$' "$tmp/walk" | LC_ALL=C sort > "$tmp/walked" || true
 
 expected_count="$(wc -l < "$tmp/expected" | tr -d ' ')"
 walked_count="$(grep -c . "$tmp/walked" || true)"
@@ -27,11 +27,16 @@ status=0
 comm -23 "$tmp/expected" "$tmp/walked" > "$tmp/missing"
 if [ -s "$tmp/missing" ]; then
   missing_count="$(wc -l < "$tmp/missing" | tr -d ' ')"
-  echo "lint-coverage: oxlint skips ${missing_count}/${expected_count} tracked .ts/.tsx files; missing:"
+  echo "lint-coverage: oxlint skips ${missing_count}/${expected_count} tracked .ts/.tsx/.astro files; missing:"
   cat "$tmp/missing"
   status=1
 else
-  echo "lint-coverage: ${walked_count}/${expected_count} tracked .ts/.tsx files"
+  echo "lint-coverage: ${walked_count}/${expected_count} tracked .ts/.tsx/.astro files"
+fi
+
+if ! grep -qE '[.]tsx?$' "$tmp/expected"; then
+  echo "lint-coverage: no tracked .ts/.tsx files, so no program to hold the ts-reset rules"
+  exit "$status"
 fi
 
 if ! [ -f tsconfig.json ]; then