@avi2dg/checks 0.57.1 → 0.59.0

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.59.0
+
+Released 2026-10-31.
+
+### Features
+
+- **browser:** add shared screen size presets and starter declaration [#20](https://github.com/avi2d/checks/pull/20)
+
+## 0.58.1
+
+Released 2026-10-29.
+
+### Fixes
+
+- **browser:** judge where the pointer lands instead of timing the hover [#19](https://github.com/avi2d/checks/pull/19)
+
+## 0.58.0
+
+Released 2026-10-29.
+
+### Features
+
+- **delivery:** scan commit messages for secrets and pack terms [#17](https://github.com/avi2d/checks/pull/17)
+
 ## 0.57.1
 
 Released 2026-10-29.

package/docs/design.md

@@ -84,9 +84,10 @@ Nothing would then say which gate a helper serves.
 A mutation runner's default scope covers `src/`, so the kit's own Stryker run mutates its source with no `mutate` list.
 The testing directory is named `testing` rather than `tests`, because a `src/tests/` beside the root `tests/` would read as a second suite.
 
-Five `exports` keys name a path the file does not sit at, because consumers resolve them by that name.
+Six `exports` keys name a path the file does not sit at, because consumers resolve them by that name.
 `@avi2dg/checks/scripts/test-skips.ts`, `@avi2dg/checks/scripts/comment-matchers.ts` and `@avi2dg/checks/scripts/prose-matchers.ts` point at their files under `src/`.
 `@avi2dg/checks/browser-hooks.ts` points at `src/quality/browser/hooks.ts`, whose types a product's browser hooks import.
+`@avi2dg/checks/browser-checks.json` points at `src/quality/browser/browser-checks.json`, the starter a product copies.
 `@avi2dg/checks/templates/*` points at `dist/templates/`.
 A path read without the resolver, such as `node_modules/@avi2dg/checks/scripts/test-skips.ts`, does not exist.
 
@@ -323,6 +324,8 @@ A finding location prints as it stands, such as a file name or a link.
 So a term inside a file name or a repository name shows there.
 That location is already public in the scanned commit or the scanned pull request.
 
+A pushed branch has already sent each commit message to the forge.
+So `checks-secrets` scans each message in the range with the same rules and the same pack.
 A pull request's title, body and comments reach the forge without a commit, so [checks-pr-text](gates/checks-pr-text.md) scans them with the same rules and the same pack.
 
 ## The frontend checks are opt-in

package/docs/gates/checks-browser.md

@@ -121,12 +121,12 @@ It reads `browser-checks.json` in the directory it runs in:
     { "path": "/ru/", "locale": "ru" }
   ],
   "viewports": [
-    { "name": "phone", "width": 375, "height": 812, "touch": true },
-    { "name": "desktop", "width": 1280, "height": 800 }
+    { "preset": "anchor" },
+    { "name": "small laptop", "width": 1280, "height": 720, "device": "desktop" }
   ],
   "states": [
     { "name": "default" },
-    { "name": "enlarged text", "textPx": 32 },
+    { "preset": "enlarged-text" },
     { "name": "reduced motion", "reducedMotion": "reduce" }
   ],
   "targets": [
@@ -143,8 +143,8 @@ It reads `browser-checks.json` in the directory it runs in:
 | --- | --- |
 | `site` | the directory of the built site, which the runner serves on a local port, an `index.html` answering for its directory |
 | `routes` | each page to visit, as a `path` from the site root and the `locale` it renders |
-| `viewports` | each window to visit in, with a `name`, a `width` and a `height` in pixels, and `touch` for a phone that has touch and a mobile viewport |
-| `states` | each condition to visit in, with a `name`, `textPx` for the browser's default text size, and `reducedMotion` as `reduce` or `no-preference` |
+| `viewports` | each window to visit in, with a `name`, a `width` and a `height` in pixels, `touch` for a phone that has touch and a mobile viewport, and `device` as `phone`, `tablet` or `desktop`, or a `preset` that stands for a set of screen sizes |
+| `states` | each condition to visit in, with a `name`, `textPx` for the browser's default text size, and `reducedMotion` as `reduce` or `no-preference`, or the `enlarged-text` preset |
 | `targets` | each named control or text the checks judge, with a CSS `selector`, the `routes` it is on when not every route, and `focusable` when Tab must reach it |
 | `checks` | the built-in checks to run, from `layout`, `keyboard`, `motion`, `axe`, `nesting` and `assets` |
 | `hooks` | the module of product hooks, as a path from the directory the runner runs in |
@@ -153,6 +153,88 @@ It reads `browser-checks.json` in the directory it runs in:
 A declaration that names a route, viewport, state, target or check twice is refused.
 So are a `motion` check with no state whose `reducedMotion` is `reduce`, a `keyboard` check with no `focusable` target, and a target or a hook that names an undeclared route.
 
+### Screen sizes
+
+A viewport `{ "preset": "anchor" }` stands for the anchor set of screen sizes, and `{ "preset": "full" }` for the full set.
+The full set holds the anchors and eleven more sizes.
+A product runs the anchor set on every pull request and the full set at night.
+Each size in a set is a viewport named for its device and its size, with `device` set, and each phone also sets `touch`.
+A preset sits beside a product's own viewports.
+A name both declare is refused as declared twice, and so is a size that two listed presets both hold.
+
+<!-- generated screen-sizes: bun run build writes it from SCREEN_SIZES in src/quality/browser/screen-sizes.ts and scripts/doc-blocks.ts -->
+
+| Device | Width | Height | Name | Sets |
+| --- | --- | --- | --- | --- |
+| phone | 360 | 640 | `phone-360x640` | `anchor` and `full` |
+| phone | 375 | 667 | `phone-375x667` | `anchor` and `full` |
+| phone | 393 | 852 | `phone-393x852` | `anchor` and `full` |
+| phone | 412 | 915 | `phone-412x915` | `anchor` and `full` |
+| tablet | 820 | 1180 | `tablet-820x1180` | `anchor` and `full` |
+| desktop | 1366 | 768 | `desktop-1366x768` | `anchor` and `full` |
+| desktop | 1440 | 900 | `desktop-1440x900` | `anchor` and `full` |
+| desktop | 1920 | 1080 | `desktop-1920x1080` | `anchor` and `full` |
+| phone | 320 | 568 | `phone-320x568` | `full` |
+| phone | 360 | 540 | `phone-360x540` | `full` |
+| phone | 375 | 567 | `phone-375x567` | `full` |
+| phone | 375 | 812 | `phone-375x812` | `full` |
+| phone | 390 | 844 | `phone-390x844` | `full` |
+| phone | 430 | 932 | `phone-430x932` | `full` |
+| tablet | 768 | 1024 | `tablet-768x1024` | `full` |
+| tablet | 1024 | 1366 | `tablet-1024x1366` | `full` |
+| desktop | 1280 | 800 | `desktop-1280x800` | `full` |
+| desktop | 1536 | 864 | `desktop-1536x864` | `full` |
+| desktop | 2560 | 1440 | `desktop-2560x1440` | `full` |
+
+<!-- end generated screen-sizes -->
+
+The state `{ "preset": "enlarged-text" }` stands for a state named `enlarged text` whose `textPx` is 32.
+The sizes were checked on 2026-10-31 against four sources.
+They are StatCounter's screen resolution statistics, the point sizes in Apple's Human Interface Guidelines, Material Design's device metrics and the Chrome UX Report.
+They are due for a recheck against those sources once a year.
+
+### Start from the shipped declaration
+
+The kit ships a starter declaration, which a product copies and then edits to its own routes and targets:
+
+```sh
+cp node_modules/@avi2dg/checks/src/quality/browser/browser-checks.json browser-checks.json
+```
+
+A host resolves it as `@avi2dg/checks/browser-checks.json`.
+
+<!-- generated starter: bun run build writes it from src/quality/browser/browser-checks.json and scripts/doc-blocks.ts -->
+
+```json
+{
+  "site": "dist",
+  "routes": [
+    { "path": "/", "locale": "en" }
+  ],
+  "viewports": [
+    { "preset": "anchor" }
+  ],
+  "states": [
+    { "name": "default" },
+    { "preset": "enlarged-text" },
+    { "name": "reduced motion", "reducedMotion": "reduce" }
+  ],
+  "targets": [
+    { "name": "headline", "selector": "main h1" },
+    { "name": "link", "selector": "a[href]", "focusable": true }
+  ],
+  "checks": ["layout", "keyboard", "motion", "axe", "nesting", "assets"]
+}
+```
+
+<!-- end generated starter -->
+
+For the night run, a product keeps a second declaration in a directory of its own.
+Its `site` is a path from that directory, such as `../dist`, and its viewports are `{ "preset": "full" }`.
+It runs `checks-browser <directory>` on that directory.
+
+### Chrome and the peers
+
 It drives the Chrome the machine has, which `CHROME_PATH` names, or Chrome's standard install when it is unset.
 The product installs the optional peers the runner loads, at the versions the kit pins:
 
@@ -183,15 +265,15 @@ It reads the declaration in the directory it runs in, or in the directory it is
 ## Sample output
 
 ```
-browser: targets at /ru/ (ru), phone 375x812 touch, enlarged text scanned language switch 1, email contact 1, headline 1
-browser: layout at /ru/ (ru), phone 375x812 touch, enlarged text scanned language switch 1, email contact 1, headline 1
-browser: keyboard at /ru/ (ru), phone 375x812 touch, enlarged text scanned language switch 1, email contact 1
-browser: axe at /ru/ (ru), phone 375x812 touch, enlarged text scanned 11 rule(s)
+browser: targets at /ru/ (ru), phone-375x667 375x667 touch, enlarged text scanned language switch 1, email contact 1, headline 1
+browser: layout at /ru/ (ru), phone-375x667 375x667 touch, enlarged text scanned language switch 1, email contact 1, headline 1
+browser: keyboard at /ru/ (ru), phone-375x667 375x667 touch, enlarged text scanned language switch 1, email contact 1
+browser: axe at /ru/ (ru), phone-375x667 375x667 touch, enlarged text scanned 11 rule(s)
 browser: 1 contrast check(s) axe cannot measure, reported as unverified:
-  axe at /ru/ (ru), phone 375x812 touch, enlarged text: color-contrast unverified: header > p: Element's background color could not be determined due to a background image
+  axe at /ru/ (ru), phone-375x667 375x667 touch, enlarged text: color-contrast unverified: header > p: Element's background color could not be determined due to a background image
 browser: 2 failure(s) in 4 check run(s) over 1 route(s), 1 viewport(s), 1 state(s) and 3 target(s):
-  layout at /ru/ (ru), phone 375x812 touch, enlarged text: email contact "Написать письмо владельцу" clips its own text
-  axe at /ru/ (ru), phone 375x812 touch, enlarged text: nested-interactive (serious): button: Interactive controls must not be nested
+  layout at /ru/ (ru), phone-375x667 375x667 touch, enlarged text: email contact "Написать письмо владельцу" clips its own text
+  axe at /ru/ (ru), phone-375x667 375x667 touch, enlarged text: nested-interactive (serious): button: Interactive controls must not be nested
 ```
 
 ## When it runs

package/docs/gates/checks-secrets.md

@@ -12,7 +12,10 @@ A private pack adds terms no public file may carry, such as a person's name, an
 It scans the lines each commit in the range adds, in every file the commit adds or modifies, with gitleaks.
 In a merge commit it scans the lines the merge's own resolution adds, such as a key written while resolving a conflict, and not what the merge brings in from the other parent.
 It exits 2 when a commit it scans is an octopus merge, one with three or more parents, because git gives no resolution diff for one.
+It scans the message of each commit in the range with the rules and the private pack [checks-pr-text](checks-pr-text.md) runs on a pull request's text.
+A merge commit's own message is scanned too, though the file scan skips what the merge brings in from the other parent.
 It fails on each secret the scan finds, and names its file, its line, the rule that matched and the commit that added it.
+A finding in a message names `the message` and its line in place of a file, where the subject is line 1.
 A secret one commit adds and a later commit in the range removes still fails, because the first commit still holds it.
 It guards new changes only, and never scans a commit before the range, so a secret already in the history takes no part.
 
@@ -40,14 +43,15 @@ These rules do not catch:
 No setting accepts a finding.
 It ignores a repository's `.gitleaks.toml`, its `.gitleaksignore` and every `gitleaks:allow` comment.
 It skips the paths gitleaks' default config skips, such as lockfiles, images and `node_modules/`.
-It scans what a commit adds to its files, and not its message or its author, which [checks-commit-identity](checks-commit-identity.md) judges.
+It scans what a commit adds to its files and its message, and not its author, which [checks-commit-identity](checks-commit-identity.md) judges.
 
 ## The private pack
 
 The private pack is a JSON file of terms that lives outside every public repository, and `CHECKS_SECRETS_PACK` names its path.
 The kit ships no pack and no term, so a public repository can run the pack without carrying what it hides.
 With `CHECKS_SECRETS_PACK` unset the gate runs the kit's rules alone, exactly as it does without a pack, and its last line says so.
-With it set the gate adds a rule for each kind of term the pack lists, and fails a range that adds any of them.
+With it set the gate adds a rule for each kind of term the pack lists.
+It fails a range that adds any of them to a file or a commit message.
 
 Each key is optional, and each holds a list of strings:
 
@@ -78,7 +82,7 @@ An IPv6 range has no key, so a pack lists its prefix under `hosts` as its addres
 The gitleaks default allowlist skips paths such as lockfiles, go.mod and go.sum, images and documents such as PDFs.
 It also skips node_modules and some Go and Ruby vendor paths, so the pack terms are not searched there.
 A lockfile's resolved URLs can carry a private registry host, so keep such a host out of lockfiles, go.mod and go.sum by other means.
-Commit messages are not scanned by the pack, and checks-commit-identity covers only the author, the committer and Co-authored-by trailers.
+The pack scans each commit message, trailers included, and checks-commit-identity also judges the author, the committer and Co-authored-by trailers.
 
 The gate exits 2, and scans nothing, when `CHECKS_SECRETS_PACK` is set but the pack cannot serve:
 
@@ -119,11 +123,12 @@ Unlike [checks-pr-text](checks-pr-text.md), this gate has no skip: a job that wr
 
 ## What it reads
 
-It reads the commits of the range from git, not the working tree.
+It reads the commits of the range and their messages from git, not the working tree.
 It needs git 2.36 or newer, which diffs a merge against the merge git would make on its own, and it exits 2 on an older git.
 It reads its rules from `src/delivery/gitleaks.toml` in the installed package.
 It reads the path of the private pack from `CHECKS_SECRETS_PACK`.
-It writes the kit's rules and the pack's into one config in a temporary directory it deletes when the scan ends.
+It writes the kit's rules and the pack's into one config, and each commit message into a file of its own.
+Each goes in a temporary directory it deletes when the scan ends.
 
 It runs the gitleaks release `src/delivery/gitleaks.ts` pins, by the SHA-256 of each platform's archive and of the binary inside it.
 On first use it downloads the archive from the scanner's GitHub release and unpacks the binary into `~/.cache/avi2dg-checks/gitleaks/<version>/`.
@@ -146,8 +151,8 @@ With one it scans that commit alone.
 
 | Code | When |
 | --- | --- |
-| 0 | no commit in the range adds a secret |
-| 1 | a commit in the range adds a secret |
+| 0 | no commit in the range adds a secret, in its files or its message |
+| 1 | a commit in the range adds a secret, in its files or its message |
 | 2 | a ref does not resolve, or a commit it scans is an octopus merge, or no verified scanner is at hand, or git is older than 2.36, or gitleaks fails, or `CHECKS_SECRETS_PACK` is set and the pack cannot serve |
 
 ## Sample output
@@ -163,8 +168,9 @@ secrets: CHECKS_SECRETS_PACK is unset, so the kit's rules ran without a private
 With a pack set, a finding of the pack names the kind of term and never the term:
 
 ```
-secrets: the range adds 1 secret(s); put a placeholder such as <private-key> in its place in the commit that added it, and rotate any secret that left this machine:
+secrets: the range adds 2 secret(s); put a placeholder such as <private-key> in its place in the commit that added it, and rotate any secret that left this machine:
   docs/setup.md:12 private-domain in 4f1c09ab: A domain the private pack lists
+  the message:3 private-name in 4f1c09ab: A name form the private pack lists
 secrets: the kit's rules and the private pack CHECKS_SECRETS_PACK names ran
 ```
 

package/docs/shipped-files.md

@@ -21,7 +21,7 @@ Every path is relative to the installed package, `node_modules/@avi2dg/checks/`.
 | `commitlint.config.ts` | the shared commitlint config |
 | `dependency-cruiser.config.js` | the kit's dependency-cruiser rules as a base a `.dependency-cruiser.cjs` extends by path, which the build writes |
 | `knip-base.json` | the Knip `include` setting, for a configuration that spreads it |
-| `src/` | every bin, which a package script calls by its `checks-` name, the modules the bins import, and the Effect language service severities under `src/quality/presets/` |
+| `src/` | every bin, which a package script calls by its `checks-` name, the modules the bins import, the Effect language service severities under `src/quality/presets/`, and the starter `browser-checks.json` under `src/quality/browser/` |
 | `dist/` | the compiled oxlint plugins, the config builders `@avi2dg/checks/oxlint`, `@avi2dg/checks/knip`, `@avi2dg/checks/dependency-cruiser` and `@avi2dg/checks/stylelint` resolve to, and the doc templates, one template per kind of doc file |
 | `oxlintrc.json` | the oxlint `base` as a config a `.oxlintrc.json` extends by path, which the build writes |
 | `stryker.preset.js` | the Stryker mutation-testing preset, which refuses a full run outside CI |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.57.1",
+  "version": "0.59.0",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "author": {
     "name": "avi2d",
@@ -141,6 +141,7 @@
     "./templates/*": "./dist/templates/*",
     "./tsconfig.effect.json": "./tsconfig.effect.json",
     "./browser-hooks.ts": "./src/quality/browser/hooks.ts",
+    "./browser-checks.json": "./src/quality/browser/browser-checks.json",
     "./oxlint": {
       "types": "./dist/presets/oxlint.d.ts",
       "default": "./dist/presets/oxlint.js"

package/src/delivery/secrets.ts

@@ -1,9 +1,9 @@
 #!/usr/bin/env bun
-import { Console, Effect, FileSystem, Schema } from "effect";
-import { commitOf, git, refArgs } from "../core/git.ts";
+import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { GitFailure, commitOf, git, refArgs } from "../core/git.ts";
 import { runMain } from "../core/main.ts";
 import { cacheRoot } from "../dependencies/cache-root.ts";
-import { pinnedGitleaks, scanCommits, type Leak } from "./gitleaks.ts";
+import { pinnedGitleaks, scanCommits, scanDirectory, type DirectoryScan, type Leak } from "./gitleaks.ts";
 import { scanConfig } from "./secrets-pack.ts";
 
 const NAME = "secrets";
@@ -27,8 +27,7 @@ const revisionsOf = Effect.fn("revisionsOf")(function* (args: readonly string[],
 
 // Without --remerge-diff git log prints no diff for a merge, and a first-parent diff would rescan what the merge brings in.
 // git skips --remerge-diff for an octopus merge with only a warning, so the scan would pass a commit it never read.
-const logOptionsOf = Effect.fn("logOptionsOf")(function* (args: readonly string[], root: string) {
-  const revisions = yield* revisionsOf(args, root);
+const logOptionsOf = Effect.fn("logOptionsOf")(function* (revisions: readonly string[], root: string) {
   const [octopus] = (yield* git(["rev-list", `--min-parents=${OCTOPUS_PARENTS}`, ...revisions], root)).split("\n");
   if (octopus !== undefined && octopus !== "") {
     return yield* new OctopusMerge({
@@ -48,10 +47,42 @@ const atRepositoryPath = Effect.fn("atRepositoryPath")(function* (leak: Leak, ro
   return held ? leak : { ...leak, File: leak.File.slice(NEW_SIDE_PREFIX.length) };
 });
 
+type Message = { readonly commit: string; readonly text: string };
+
+// git refuses a NUL in a commit message, so the NUL -z writes after each record ends it.
+const messagesOf = Effect.fn("messagesOf")(function* (revisions: readonly string[], root: string) {
+  const records = (yield* git(["log", "--no-show-signature", "-z", "--format=%H%n%B", ...revisions], root)).split("\0").filter((record) => record !== "");
+  return yield* Effect.forEach(records, (record) => {
+    const newline = record.indexOf("\n");
+    const commit = newline === -1 ? "" : record.slice(0, newline);
+    if (!/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(commit)) {
+      return Effect.fail(new GitFailure({ message: "git log: a record does not start with a commit id" }));
+    }
+    return Effect.succeed({ commit, text: record.slice(newline + 1) } satisfies Message);
+  });
+});
+
+const messageLeaksOf = Effect.fn("messageLeaksOf")(function* (messages: readonly Message[], scanner: Omit<DirectoryScan, "dir">) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const dir = yield* fs.makeTempDirectoryScoped({ prefix: "checks-secrets-messages-" });
+  yield* Effect.forEach(messages, ({ commit, text }) => fs.writeFileString(path.join(dir, commit), text));
+  const leaks = yield* scanDirectory({ ...scanner, dir });
+  return leaks.map((leak) => ({ ...leak, Commit: path.basename(leak.File) }));
+});
+
 function leakLine({ File, StartLine, RuleID, Commit, Description }: Leak): string {
   return `  ${File}:${StartLine} ${RuleID} in ${Commit.slice(0, SHORT_SHA)}: ${Description}`;
 }
 
+function messageLine({ StartLine, RuleID, Commit, Description }: Leak): string {
+  return `  the message:${StartLine} ${RuleID} in ${Commit.slice(0, SHORT_SHA)}: ${Description}`;
+}
+
+function byMessage(left: Leak, right: Leak): number {
+  return left.Commit.localeCompare(right.Commit) || left.StartLine - right.StartLine || left.RuleID.localeCompare(right.RuleID);
+}
+
 function byPlace(left: Leak, right: Leak): number {
   return (
     left.File.localeCompare(right.File) ||
@@ -61,27 +92,31 @@ function byPlace(left: Leak, right: Leak): number {
   );
 }
 
-export function report(leaks: readonly Leak[]): string {
-  if (leaks.length === 0) return `${NAME}: the range adds no secret`;
+export function report(fileLeaks: readonly Leak[], messageLeaks: readonly Leak[]): string {
+  const count = fileLeaks.length + messageLeaks.length;
+  if (count === 0) return `${NAME}: the range adds no secret`;
   return [
-    `${NAME}: the range adds ${leaks.length} secret(s); put a placeholder such as <private-key> in its place in the commit that added it, and rotate any secret that left this machine:`,
-    ...leaks.toSorted(byPlace).map(leakLine),
+    `${NAME}: the range adds ${count} secret(s); put a placeholder such as <private-key> in its place in the commit that added it, and rotate any secret that left this machine:`,
+    ...fileLeaks.toSorted(byPlace).map(leakLine),
+    ...messageLeaks.toSorted(byMessage).map(messageLine),
   ].join("\n");
 }
 
 const secrets = Effect.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
-  const logOptions = yield* logOptionsOf(process.argv.slice(2), root);
+  const revisions = yield* revisionsOf(process.argv.slice(2), root);
+  const logOptions = yield* logOptionsOf(revisions, root);
   const ignoreDir = yield* fs.makeTempDirectoryScoped({ prefix: "checks-secrets-" });
   const { config, notice } = yield* scanConfig(NAME, yield* fs.makeTempDirectoryScoped({ prefix: "checks-secrets-pack-" }));
   const binary = yield* pinnedGitleaks(yield* cacheRoot());
   const gitDir = (yield* git(["rev-parse", "--absolute-git-dir"], root)).trim();
   const reported = yield* scanCommits({ binary, gitDir, logOptions, config, ignoreDir });
-  const leaks = yield* Effect.forEach(reported, (leak) => atRepositoryPath(leak, root));
-  yield* Console.log(report(leaks));
+  const fileLeaks = yield* Effect.forEach(reported, (leak) => atRepositoryPath(leak, root));
+  const messageLeaks = yield* messageLeaksOf(yield* messagesOf(revisions, root), { binary, config, ignoreDir });
+  yield* Console.log(report(fileLeaks, messageLeaks));
   yield* Console.log(notice);
-  return leaks.length === 0;
+  return fileLeaks.length + messageLeaks.length === 0;
 }).pipe(Effect.scoped);
 
 if (import.meta.main) runMain(NAME, secrets);

package/src/quality/browser/browser-checks.json

@@ -0,0 +1,19 @@
+{
+  "site": "dist",
+  "routes": [
+    { "path": "/", "locale": "en" }
+  ],
+  "viewports": [
+    { "preset": "anchor" }
+  ],
+  "states": [
+    { "name": "default" },
+    { "preset": "enlarged-text" },
+    { "name": "reduced motion", "reducedMotion": "reduce" }
+  ],
+  "targets": [
+    { "name": "headline", "selector": "main h1" },
+    { "name": "link", "selector": "a[href]", "focusable": true }
+  ],
+  "checks": ["layout", "keyboard", "motion", "axe", "nesting", "assets"]
+}

package/src/quality/browser/declaration.ts

@@ -1,5 +1,6 @@
-import { Effect, FileSystem, Path, Schema } from "effect";
+import { Array as Arr, Effect, FileSystem, Path, Schema } from "effect";
 import { Usage } from "../../core/main.ts";
+import { DEVICES, ENLARGED_TEXT_PX, SCREEN_SIZE_SETS, SCREEN_SIZES, screenSizeName, type ScreenSize } from "./screen-sizes.ts";
 
 const DECLARATION = "browser-checks.json";
 
@@ -15,7 +16,15 @@ const Route = Schema.Struct({
   locale: Name,
 });
 
-const Viewport = Schema.Struct({ name: Name, width: Pixels, height: Pixels, touch: Schema.optionalKey(Schema.Boolean) });
+const Viewport = Schema.Struct({
+  name: Name,
+  width: Pixels,
+  height: Pixels,
+  touch: Schema.optionalKey(Schema.Boolean),
+  device: Schema.optionalKey(Schema.Literals(DEVICES)),
+});
+
+const ScreenSizeSet = Schema.Struct({ preset: Schema.Literals(SCREEN_SIZE_SETS) });
 
 const State = Schema.Struct({
   name: Name,
@@ -23,6 +32,10 @@ const State = Schema.Struct({
   reducedMotion: Schema.optionalKey(Schema.Literals(["reduce", "no-preference"])),
 });
 
+const STATE_PRESETS = ["enlarged-text"] as const;
+
+const StatePreset = Schema.Struct({ preset: Schema.Literals(STATE_PRESETS) });
+
 const Target = Schema.Struct({
   name: Name,
   selector: Name,
@@ -40,6 +53,12 @@ const Declaration = Schema.Struct({
   hooks: Schema.optionalKey(Name),
 });
 
+const Listed = Schema.Struct({
+  ...Declaration.fields,
+  viewports: Schema.NonEmptyArray(Schema.Union([Viewport, ScreenSizeSet])),
+  states: Schema.NonEmptyArray(Schema.Union([State, StatePreset])),
+});
+
 export type Route = typeof Route.Type;
 export type Viewport = typeof Viewport.Type;
 export type State = typeof State.Type;
@@ -52,7 +71,26 @@ export type Visit = {
   readonly state: State;
 };
 
-const decodeDeclaration = Schema.decodeUnknownEffect(Schema.fromJsonString(Declaration));
+export type Listed = typeof Listed.Type;
+
+const decodeListed = Schema.decodeUnknownEffect(Schema.fromJsonString(Listed));
+
+function viewportOf(size: ScreenSize): Viewport {
+  const { device, width, height } = size;
+  return { name: screenSizeName(size), width, height, device, ...(device === "phone" ? { touch: true } : {}) };
+}
+
+const STATES: Readonly<Record<(typeof STATE_PRESETS)[number], State>> = {
+  "enlarged-text": { name: "enlarged text", textPx: ENLARGED_TEXT_PX },
+};
+
+export function expanded(listed: Listed): Declaration {
+  return {
+    ...listed,
+    viewports: Arr.flatMap(listed.viewports, (entry) => ("preset" in entry ? Arr.map(SCREEN_SIZES[entry.preset], viewportOf) : [entry])),
+    states: Arr.map(listed.states, (entry) => ("preset" in entry ? STATES[entry.preset] : entry)),
+  };
+}
 
 function repeated(names: readonly string[]): readonly string[] {
   return [...new Set(names.filter((name, index) => names.indexOf(name) !== index))];
@@ -85,9 +123,10 @@ export const readDeclaration = Effect.fn("readDeclaration")(function* (root: str
   if (!(yield* fs.exists(file))) {
     return yield* new Usage({ message: `${DECLARATION} is missing, and a product opts in to the browser checks by declaring its pages there` });
   }
-  const declaration = yield* decodeDeclaration(yield* fs.readFileString(file)).pipe(
+  const listed = yield* decodeListed(yield* fs.readFileString(file)).pipe(
     Effect.mapError(({ message }) => new Usage({ message: `${DECLARATION} does not decode: ${message}` })),
   );
+  const declaration = expanded(listed);
   const found = inconsistencies(declaration);
   if (found.length > 0) return yield* new Usage({ message: `${DECLARATION}: ${found.join("; ")}` });
   return declaration;

package/src/quality/browser/motion.ts

@@ -1,10 +1,63 @@
 import { Effect, Schema } from "effect";
 import type { BrowserContext, Page } from "playwright-core";
+import type { Rect } from "./dom.ts";
 import { attempt, BrowserFailure } from "./page.ts";
 
 const CONTROLS = "a[href], button, summary, input, select, textarea";
 
-const HOVER_TIMEOUT_MS = 2_000;
+const Landing = Schema.NullOr(Schema.Struct({ x: Schema.Finite, y: Schema.Finite }));
+
+type ScrollAlignment = "nearest" | "center" | "start" | "end";
+
+type PointerTarget = {
+  readonly ownerDocument: { readonly documentElement: { readonly clientWidth: number; readonly clientHeight: number } };
+  readonly scrollIntoView: (options: { readonly behavior: "instant"; readonly block: ScrollAlignment; readonly inline: ScrollAlignment }) => void;
+  readonly getClientRects: () => Iterable<Rect>;
+  readonly getRootNode: () => { readonly elementFromPoint: (x: number, y: number) => unknown };
+};
+
+// Playwright's hover retries until a timeout to give up on a control the pointer cannot reach, and a busy host outlasts any timeout on a control it can reach.
+// The page runs this from its source text, so it must not reach anything outside its own body.
+function pointerLanding(control: PointerTarget): typeof Landing.Type {
+  const reachesControl = (hit: unknown): boolean => {
+    let node: unknown = hit;
+    while (node !== null && node !== undefined) {
+      if (node === control) return true;
+      const candidate = node as { readonly assignedSlot?: unknown; readonly parentNode?: unknown; readonly host?: unknown };
+      if (candidate.assignedSlot !== undefined && candidate.assignedSlot !== null) {
+        node = candidate.assignedSlot;
+        continue;
+      }
+      if (candidate.parentNode !== undefined && candidate.parentNode !== null) {
+        node = candidate.parentNode;
+        continue;
+      }
+      if (candidate.host !== undefined && candidate.host !== null) {
+        node = candidate.host;
+        continue;
+      }
+      return false;
+    }
+    return false;
+  };
+  const alignments: readonly ScrollAlignment[] = ["nearest", "center", "start", "end"];
+  for (const alignment of alignments) {
+    control.scrollIntoView({ behavior: "instant", block: alignment, inline: alignment });
+    const { clientWidth, clientHeight } = control.ownerDocument.documentElement;
+    for (const rect of control.getClientRects()) {
+      const left = Math.max(rect.left, 0);
+      const right = Math.min(rect.right, clientWidth);
+      const top = Math.max(rect.top, 0);
+      const bottom = Math.min(rect.bottom, clientHeight);
+      if (right - left < 1 || bottom - top < 1) continue;
+      const x = (left + right) / 2;
+      const y = (top + bottom) / 2;
+      const hit = control.getRootNode().elementFromPoint(x, y);
+      if (hit !== null && reachesControl(hit)) return { x, y };
+    }
+  }
+  return null;
+}
 
 // A motion reset for reduced motion shortens animations to near zero rather than removing them, so one that ends within a frame never moves.
 const FRAME_MS = 1000 / 60;
@@ -33,6 +86,8 @@ const MOTION_RECORDER = `(() => {
 
 const decodeStarted = Schema.decodeUnknownEffect(Schema.Array(Schema.String));
 
+const decodeLanding = Schema.decodeUnknownEffect(Landing);
+
 export function recordMotion(context: BrowserContext): Promise<unknown> {
   return context.addInitScript(MOTION_RECORDER);
 }
@@ -67,11 +122,12 @@ export const judgeStillness = Effect.fn("judgeStillness")(function* (page: Page)
     const control = controls.nth(index);
     if (!(yield* attempt(`cannot see control ${index + 1}`, () => control.isVisible()))) continue;
     judged += 1;
-    const hovered = yield* attempt(`cannot hover control ${index + 1}`, () => control.hover({ timeout: HOVER_TIMEOUT_MS })).pipe(
-      Effect.as(true),
-      Effect.catchTag("BrowserFailure", () => Effect.succeed(false)),
+    const landing: unknown = yield* attempt(`cannot find where the pointer lands on control ${index + 1}`, () => control.evaluate(pointerLanding));
+    const point = yield* decodeLanding(landing).pipe(
+      Effect.mapError(() => new BrowserFailure({ message: `the pointer landing on control ${index + 1} gave ${JSON.stringify(landing)}` })),
     );
-    if (hovered) {
+    if (point !== null) {
+      yield* attempt(`cannot hover control ${index + 1}`, () => page.mouse.move(point.x, point.y));
       yield* animatedDuring(`on hovering control ${index + 1}`);
       yield* attempt("cannot move the pointer away", () => page.mouse.move(0, 0));
       yield* animatedDuring(`on leaving control ${index + 1}`);

package/src/quality/browser/screen-sizes.ts

@@ -0,0 +1,48 @@
+import type { NonEmptyReadonlyArray } from "effect/Array";
+
+export const DEVICES = ["phone", "tablet", "desktop"] as const;
+
+type Device = (typeof DEVICES)[number];
+
+export type ScreenSize = { readonly device: Device; readonly width: number; readonly height: number };
+
+const phone = (width: number, height: number): ScreenSize => ({ device: "phone", width, height });
+const tablet = (width: number, height: number): ScreenSize => ({ device: "tablet", width, height });
+const desktop = (width: number, height: number): ScreenSize => ({ device: "desktop", width, height });
+
+const ANCHOR = [
+  phone(360, 640),
+  phone(375, 667),
+  phone(393, 852),
+  phone(412, 915),
+  tablet(820, 1180),
+  desktop(1366, 768),
+  desktop(1440, 900),
+  desktop(1920, 1080),
+] as const;
+
+const NIGHTLY = [
+  phone(320, 568),
+  phone(360, 540),
+  phone(375, 567),
+  phone(375, 812),
+  phone(390, 844),
+  phone(430, 932),
+  tablet(768, 1024),
+  tablet(1024, 1366),
+  desktop(1280, 800),
+  desktop(1536, 864),
+  desktop(2560, 1440),
+] as const;
+
+export const SCREEN_SIZE_SETS = ["anchor", "full"] as const;
+
+export type ScreenSizeSet = (typeof SCREEN_SIZE_SETS)[number];
+
+export const SCREEN_SIZES: Readonly<Record<ScreenSizeSet, NonEmptyReadonlyArray<ScreenSize>>> = { anchor: ANCHOR, full: [...ANCHOR, ...NIGHTLY] };
+
+export function screenSizeName({ device, width, height }: ScreenSize): string {
+  return `${device}-${width}x${height}`;
+}
+
+export const ENLARGED_TEXT_PX = 32;