@goodbones/oxlint 0.1.0-beta.1 → 0.1.0-beta.11

package/src/campaigns-rule.ts

@@ -0,0 +1,242 @@
+import * as path from "node:path";
+
+import {
+  type CampaignHit,
+  type CampaignInput,
+  campaignsOf,
+  campaignsSelecting,
+  type CompiledCampaign,
+  type CompiledObjective,
+  derivePhase,
+  detectorCandidatesOf,
+  detectorOf,
+  evaluateObjectives,
+  ledgerKeyOf,
+  LEGACY_PHASE,
+  LEGACY_SECTOR,
+  membershipOf,
+  needsSyntax,
+  objectivesInWindow,
+  positionOf,
+  reconcileSector,
+  sectorEntryOf,
+  type SectorIndex,
+} from "@goodbones/campaigns";
+import { formatMessage, type LoadedPolicy, ReportUnavailable } from "@goodbones/core";
+import { sourceFactsOf } from "@goodbones/typescript";
+
+import {
+  factsOfProgram,
+  type OxlintRule,
+  type Program,
+  type RuleContext,
+  toRepoRelative,
+} from "./oxlint-api.js";
+
+// The campaigns family, one file at a time: every hit of an objective in
+// window for the file's sector that its ledger does not carry, reported at
+// the match's position with the objective's `how` as the message. The
+// facts come from oxlint's tree through the pack's reader, as the other
+// rules read them; the `syntax` term is answered by the same matcher the
+// CLI uses, over `sourceCode.text` — "one engine" is this family's parity
+// contract, rather than a corpus.
+//
+// The sector comes from the perimeter on this file (a marker or nx index
+// the host built at load, for the two forms that need the other files),
+// and the sector's phase from the ledgers — which objectives carry
+// holdouts for it, and its record's `reached` and attestations — never
+// from a walk. So the plugin's answer is the code as of the last `clear`,
+// and the CLI's is the code now; between a fix and its `clear` they
+// differ, and `check` fails on the stale holdout until they agree. A
+// `has` objective and an end state are never reported here: their holdout
+// is the sector, and they reach this file only as the phase they put it at.
+
+// The sectors a host discovered at load, per campaign, for the perimeters
+// that need the other files.
+export type SectorIndexes = ReadonlyMap<string, SectorIndex>;
+
+const unledgered = (
+  policy: LoadedPolicy,
+  rule: CompiledCampaign,
+  sector: string,
+  root: string,
+  hits: ReadonlyArray<CampaignHit>,
+): ReadonlyArray<CampaignHit> => {
+  const carried = new Set<CampaignHit>();
+  const byObjective = new Map<string, Array<CampaignHit>>();
+  for (const hit of hits) {
+    byObjective.set(hit.objective, [...(byObjective.get(hit.objective) ?? []), hit]);
+  }
+  for (const [objectiveId, own] of byObjective) {
+    const objective = rule.objectives.find((one) => one.id === objectiveId);
+    const ledger = campaignsOf(policy).ledgers.get(ledgerKeyOf(rule.id, objectiveId));
+    if (objective === undefined || ledger === undefined) continue;
+    const entries = own.map((hit) => sectorEntryOf(hit.violation, root));
+    const known = new Set(reconcileSector(ledger, sector, entries, objective.unit).ledgered);
+    own.forEach((hit, i) => {
+      if (known.has(entries[i] ?? "")) carried.add(hit);
+    });
+  }
+  return hits.filter((hit) => !carried.has(hit));
+};
+
+// The objectives in window for the sector, read off the ledgers. A sector
+// no `clear` has placed — no record of it — stands at the first phase, as
+// the legacy does, rather than deriving to the end from ledgers that
+// carry nothing for it.
+const inWindowFor = (
+  policy: LoadedPolicy,
+  rule: CompiledCampaign,
+  sector: string,
+): ReadonlyArray<CompiledObjective> => {
+  const record = campaignsOf(policy).sectorRecords.get(ledgerKeyOf(rule.id, sector));
+  const position = positionOf(rule, record);
+  const counts = (objectiveId: string): number =>
+    campaignsOf(policy).ledgers.get(ledgerKeyOf(rule.id, objectiveId))?.sectors[sector]?.holdouts.length ?? 0;
+  const phase =
+    sector === LEGACY_SECTOR || record === undefined
+      ? Math.min(LEGACY_PHASE, rule.phases.length)
+      : derivePhase(rule, counts, position);
+  return objectivesInWindow(rule, phase, position).filter((one) => one.detect !== null);
+};
+
+// A `report` a campaign names that cannot be read — a command the kernel
+// refused to spawn, a file no step wrote — is one fact about the run, not
+// one about each file the campaign selects. The live source keeps the
+// failure per spec; this keeps which failures have been said, so the first
+// selected file carries the notice and the rest stay quiet. Without it, a
+// lint of eight hundred files is eight hundred copies of oxlint's generic
+// "error running JS plugin", with the cause dropped by the terser formats.
+const aside = (cause: ReportUnavailable): string =>
+  `A report a campaign names could not be read, so no campaign naming it is judged in this ` +
+  `run: ${cause.message}`;
+
+export const makeCampaignsRule = (
+  policy: LoadedPolicy,
+  indexes: SectorIndexes = new Map(),
+): OxlintRule => {
+  // Per rule instance, which is per plugin load — one process — rather than
+  // per `createOnce`, which a host may call more often than that.
+  const said = new Set<string>();
+  const known = new Set(policy.languages.flatMap((one) => one.extensions));
+  return {
+    meta: {
+      type: "problem" as const,
+      docs: {
+        description:
+          "the campaigns: every place a pattern the repository is migrating away from still occurs, in a sector whose phase asks for it, that its ledger does not carry",
+      },
+      schema: [],
+    },
+
+    createOnce(context: RuleContext) {
+      let file = "";
+      let selected: ReadonlyArray<CompiledCampaign> = [];
+
+      return {
+        before() {
+          file = toRepoRelative(policy.repoRoot, context.filename);
+          if (file.startsWith("..")) return false;
+          // A file the packs would not walk — one oxlint lints anyway — is
+          // seen only by a campaign that widened its scope to it, so both
+          // hosts answer about the same files.
+          const extension = path.extname(file);
+          selected = campaignsSelecting(campaignsOf(policy).campaignRules, file).filter(
+            (rule) =>
+              known.size === 0 || known.has(extension) || rule.extensions.includes(extension),
+          );
+          return selected.length > 0;
+        },
+
+        Program(node: Program) {
+          const text = context.sourceCode.text;
+          const detectors = selected.flatMap((rule) => [
+            ...rule.objectives.flatMap((one) => {
+              const detect = detectorOf(one);
+              return detect === null ? [] : [detect];
+            }),
+            ...(rule.perimeter?.kind === "match" ? [rule.perimeter.detect] : []),
+          ]);
+          const input: CampaignInput = {
+            file,
+            text,
+            facts: sourceFactsOf(factsOfProgram(file, node)),
+            resolver: policy.resolver,
+            fileSystem: policy.fileSystem,
+            syntax: needsSyntax(detectors) ? policy.syntax.parse(file, text) : null,
+            functions: campaignsOf(policy).functions,
+            reports: campaignsOf(policy).reports,
+          };
+          // One campaign at a time, so a report one of them cannot read costs
+          // that campaign's answer for this file and not its neighbours'.
+          const unrecorded: Array<CampaignHit> = [];
+          for (const rule of selected) {
+            try {
+              const perimeter = rule.perimeter;
+              const anchors =
+                perimeter?.kind === "match"
+                  ? detectorCandidatesOf(perimeter.detect, perimeter.unit, input).map(
+                      (one) => one.key.split("#")[0] ?? one.key,
+                    )
+                  : [];
+              const place = membershipOf(rule, file, indexes.get(rule.id) ?? null, anchors);
+              // Hits grouped by the sector they fall in, then judged
+              // against that sector's window and ledger.
+              const bySector = new Map<string, { root: string; hits: Array<CampaignHit> }>();
+              const windows = new Map<string, ReadonlySet<string>>();
+              const placedAt = (subject: string | null) => {
+                const placement = place(subject);
+                if (placement === null) return null;
+                if (!windows.has(placement.sector)) {
+                  windows.set(
+                    placement.sector,
+                    new Set(inWindowFor(policy, rule, placement.sector).map((one) => one.id)),
+                  );
+                }
+                return placement;
+              };
+              const whole = placedAt(null);
+              const candidates =
+                whole === null
+                  ? rule.objectives.filter((one) => one.detect !== null)
+                  : rule.objectives.filter(
+                      (one) =>
+                        one.detect !== null && (windows.get(whole.sector)?.has(one.id) ?? false),
+                    );
+              if (perimeter?.kind !== "match" && whole === null) continue;
+              for (const hit of evaluateObjectives(candidates, input)) {
+                const placement = placedAt(hit.violation.subject);
+                if (placement === null) continue;
+                if (!(windows.get(placement.sector)?.has(hit.objective) ?? false)) continue;
+                const group = bySector.get(placement.sector) ?? { root: placement.root, hits: [] };
+                group.hits.push(hit);
+                bySector.set(placement.sector, group);
+              }
+              for (const [sector, group] of bySector) {
+                for (const hit of unledgered(policy, rule, sector, group.root, group.hits)) {
+                  unrecorded.push(hit);
+                }
+              }
+            } catch (cause) {
+              if (!(cause instanceof ReportUnavailable)) throw cause;
+              const message = aside(cause);
+              if (said.has(message)) continue;
+              said.add(message);
+              context.report({ message, loc: { line: 1, column: 0 } });
+            }
+          }
+
+          for (const hit of unrecorded) {
+            // A match lands where it was found; a file-unit hit, on line 1, as
+            // the structure rule places a finding about the file itself.
+            const at = hit.range ?? { start: { line: 0, column: 0 } };
+            context.report({
+              message: formatMessage(hit.violation),
+              loc: { line: at.start.line + 1, column: at.start.column },
+            });
+          }
+        },
+      };
+    },
+  };
+};

package/src/config-loader.ts

@@ -1,17 +1,78 @@
 import * as path from "node:path";
 
+import { astGrepMatcher } from "@goodbones/ast-grep";
 import {
-  DEFAULT_CONFIG_FILENAME,
+  campaignsExtension,
+  campaignsOf,
+  discoverSectors,
+  loadCampaignFunctions,
+  makeReportSourceLive,
+  reportSpecsOf,
+  type SectorIndex,
+} from "@goodbones/campaigns";
+import {
+  findManifestFile,
+  globToRegExp,
+  listSourceFiles,
+  listWorkspaceProjects,
   type LoadedPolicy,
   loadPolicy,
   makeFileSystemLive,
   readManifestFile,
+  ReportUnavailable,
 } from "@goodbones/core";
 import { typescriptLanguage } from "@goodbones/typescript";
 import * as Result from "effect/Result";
 
 export type { LoadedPolicy } from "@goodbones/core";
-export { DEFAULT_CONFIG_FILENAME } from "@goodbones/core";
+
+// A `marker` or `nx` perimeter needs the other files to say which sector a
+// file is in — the markers, or the workspace's projects — so the plugin
+// reads them once at load, from a walk of the repository that reads no
+// source text but the markers'. The other perimeters answer from the path
+// or the file itself, and need nothing here.
+export const discoverSectorIndexes = (policy: LoadedPolicy): ReadonlyMap<string, SectorIndex> => {
+  const indexes = new Map<string, SectorIndex>();
+  const needing = campaignsOf(policy).campaignRules.filter(
+    (rule) => rule.perimeter?.kind === "marker" || rule.perimeter?.kind === "nx",
+  );
+  if (needing.length === 0) return indexes;
+  const widened = [...new Set(needing.flatMap((rule) => rule.extensions))];
+  const files = listSourceFiles(policy.repoRoot, ["."], policy.languages, widened);
+  const known = new Set(policy.languages.flatMap((one) => one.extensions));
+  const projects = needing.some((rule) => rule.perimeter?.kind === "nx")
+    ? listWorkspaceProjects(policy.repoRoot, ["."])
+    : [];
+  for (const rule of needing) {
+    const scoped = files.filter(
+      (file) =>
+        rule.scope.some((pattern) => pattern.test(file)) &&
+        (known.has(path.extname(file)) || rule.extensions.includes(path.extname(file))),
+    );
+    indexes.set(
+      rule.id,
+      discoverSectors(rule, {
+        files: scoped,
+        readText: (file) => policy.fileSystem.readText(file),
+        globToRegExp,
+        projects,
+      }),
+    );
+  }
+  return indexes;
+};
+
+// The clock the campaigns are judged by; `ARCHITECTURE_NOW` pins it, as it
+// does for the CLI.
+const hostNow = (): number => {
+  const pinned = process.env.ARCHITECTURE_NOW;
+  if (pinned === undefined || pinned === "") return Date.now();
+  const parsed = /^\d+$/.test(pinned) ? Number(pinned) : Date.parse(pinned);
+  if (Number.isNaN(parsed)) {
+    throw new Error(`ARCHITECTURE_NOW is ${JSON.stringify(pinned)}, which is not a date.`);
+  }
+  return parsed;
+};
 
 // The plugin's composition root: read the manifest file, construct the
 // language packs and the live file system, and hand them to the loader. A load
@@ -20,16 +81,53 @@ export { DEFAULT_CONFIG_FILENAME } from "@goodbones/core";
 // indistinguishable from a clean codebase.
 export const loadPolicyFromFile = async (
   repoRoot: string,
-  configFilename: string = DEFAULT_CONFIG_FILENAME,
+  configFilename?: string,
 ): Promise<LoadedPolicy> => {
-  const configPath = path.resolve(repoRoot, configFilename);
+  // Named, or discovered: architecture.yaml, .yml, .json, or .config.mjs,
+  // exactly one of which may be present.
+  const configPath =
+    configFilename === undefined
+      ? findManifestFile(repoRoot)
+      : path.resolve(repoRoot, configFilename);
+  const read = await readManifestFile(configPath);
+  // The `fn` terms are imported here, before the policy loads, as the CLI
+  // does; the pack is composed with ast-grep for the campaigns family's
+  // `syntax` term, and the plugin parses with it for that family only.
+  const { functions, manifest } = await loadCampaignFunctions(configPath, read.manifest);
   const loaded = loadPolicy({
     repoRoot,
     configPath,
-    manifest: await readManifestFile(configPath),
-    languages: [typescriptLanguage()],
+    manifest,
+    locate: read.locate,
+    languages: [typescriptLanguage({ syntax: astGrepMatcher() })],
     fileSystem: makeFileSystemLive(repoRoot),
+    // A `report` command runs once per process — once per editor session
+    // for oxlint's language server, which then sees that report until it
+    // restarts. A report the build writes to a file is the predictable form.
+    extensions: [campaignsExtension({ functions, reports: makeReportSourceLive(repoRoot) })],
+    now: hostNow(),
   });
   if (Result.isFailure(loaded)) throw loaded.failure;
-  return loaded.success;
+  const policy = loaded.success;
+  // Every `report` a campaign names is read now, while oxlint has linted
+  // nothing. A `command` forks this process, and once the linter is running
+  // Linux can refuse the fork: the linter's per-thread AST buffers merge
+  // into one mapping larger than RAM and swap together, which the default
+  // overcommit heuristic refuses to duplicate. The source keeps the answer,
+  // and a failure, so the rules read what was read here — a term's several
+  // commands run at once. A report that cannot be read is not a load
+  // failure — the campaigns rule reports it once, on the first file a
+  // campaign naming it selects; one that does not parse is.
+  const campaigns = campaignsOf(policy);
+  await Promise.all(
+    reportSpecsOf(campaigns.campaignRules).map(async (spec) => {
+      if (campaigns.reports.read !== undefined) return campaigns.reports.read(spec);
+      try {
+        campaigns.reports.diagnosticsOf(spec, "");
+      } catch (cause) {
+        if (!(cause instanceof ReportUnavailable)) throw cause;
+      }
+    }),
+  );
+  return policy;
 };

package/src/exports-rule.ts

@@ -1,97 +1,29 @@
 import {
-  type Binding,
   evaluateSelectedBindings,
   exportRulesSelecting,
   formatMessage,
   type LoadedPolicy,
   type SelectedExportRule,
 } from "@goodbones/core";
+import type { ReadBinding, ReadEdge } from "@goodbones/typescript";
 import * as Result from "effect/Result";
 
 import {
-  type CallNode,
+  at,
+  factsOfProgram,
   type Fixer,
-  type ImportEqualsNode,
-  importEqualsSpecifierOf,
-  type ImportExpressionNode,
-  importExpressionSpecifierOf,
   type OxlintRule,
-  type ReportableNode,
-  requireSpecifierOf,
+  type Program,
   type RuleContext,
   toRepoRelative,
 } from "./oxlint-api.js";
 
-type NamedNode = ReportableNode & { readonly name?: unknown; readonly value?: unknown };
-
-type SpecifierNode = ReportableNode & {
-  readonly type: string;
-  readonly imported?: NamedNode | null;
-  readonly local?: NamedNode | null;
-};
-
-type DeclarationNode = ReportableNode & {
-  readonly source?: { readonly value?: unknown } | null;
-  readonly specifiers?: ReadonlyArray<SpecifierNode> | null;
-};
-
-const nameOf = (node: NamedNode | null | undefined): string | null => {
-  if (node === null || node === undefined) return null;
-  if (typeof node.name === "string") return node.name;
-  // `import { "a-b" as ab }` — a string-literal export name.
-  return typeof node.value === "string" ? node.value : null;
-};
-
-type Bound = Binding & { readonly node: ReportableNode; readonly local: string };
-
-// The whole module, as one binding. `export * from "m"`, `export * as ns from
-// "m"`, `import x = require("m")`, `import("m")` and `require("m")` all carry
-// every export of `m` at once, exactly as `import * as ns` does — and are the
-// same way around a rule about a name. A side-effect import carries nothing.
-const wholeModule = (node: ReportableNode, local = ""): Bound => ({
-  symbol: "*",
-  kind: "namespace",
-  node,
-  local,
-});
-
-type ExportAllNode = DeclarationNode & { readonly exported?: NamedNode | null };
-
-const boundOf = (specifier: SpecifierNode): Bound | null => {
-  const local = nameOf(specifier.local) ?? "";
-  switch (specifier.type) {
-    case "ImportSpecifier": {
-      const symbol = nameOf(specifier.imported);
-      return symbol === null ? null : { symbol, kind: "named", node: specifier, local };
-    }
-    case "ImportDefaultSpecifier":
-      return { symbol: "default", kind: "default", node: specifier, local };
-    case "ImportNamespaceSpecifier":
-      return { symbol: "*", kind: "namespace", node: specifier, local };
-    // `export { a } from "…"` — `local` is the name in the source module.
-    case "ExportSpecifier": {
-      const symbol = nameOf(specifier.local);
-      return symbol === null ? null : { symbol, kind: "named", node: specifier, local: symbol };
-    }
-    default:
-      return null;
-  }
-};
-
-const specifierOf = (node: DeclarationNode): string | null => {
-  const value = node.source?.value;
-  return typeof value === "string" ? value : null;
-};
-
-const boundSpecifiers = (node: DeclarationNode): ReadonlyArray<Bound> =>
-  (node.specifiers ?? []).map(boundOf).filter((one): one is Bound => one !== null);
-
 // `import { A, B as C } from "pkg"` becomes `import * as A from "pkg/A"` and
 // `import * as C from "pkg/B"`. Only whole-declaration rewrites are offered: a
 // declaration mixing restricted named imports with a default or namespace one
 // would need comma surgery inside the braces, and a fix that is subtly wrong is
 // worse than a diagnostic the author resolves by hand.
-const subpathNamespaceImport = (specifier: string, bound: ReadonlyArray<Bound>): string =>
+const subpathNamespaceImport = (specifier: string, bound: ReadonlyArray<ReadBinding>): string =>
   bound
     .map((binding) => `import * as ${binding.local} from "${specifier}/${binding.symbol}";`)
     .join("\n");
@@ -111,20 +43,16 @@ export const makeExportsRule = (policy: LoadedPolicy): OxlintRule => ({
     let importer = "";
     let selected: ReadonlyArray<SelectedExportRule> = [];
 
-    // `fixable` is whether a rewrite could apply: only an `import` declaration
-    // can be rewritten into subpath namespace imports. `export *` and the
-    // whole-module forms are reported and left for the author.
-    const check = (
-      node: ReportableNode,
-      specifierValue: string | null,
-      bound: ReadonlyArray<Bound>,
-      fixable: boolean,
-    ): void => {
-      if (specifierValue === null || bound.length === 0) return;
+    // Only an `import` declaration can be rewritten into subpath namespace
+    // imports. `export *` and the whole-module forms are reported and left
+    // for the author.
+    const check = (edge: ReadEdge): void => {
+      const { bindings: bound, node, specifier } = edge;
+      if (bound.length === 0) return;
 
       const outcome = evaluateSelectedBindings(selected, policy.resolver, {
         importer,
-        specifier: specifierValue,
+        specifier,
         bindings: bound,
       });
 
@@ -136,30 +64,30 @@ export const makeExportsRule = (policy: LoadedPolicy): OxlintRule => ({
 
       for (const { bindings, rule, violation } of outcome.success) {
         if (policy.baseline.isBaselined(violation)) continue;
-        const offending = bound.filter((one: Bound) =>
+        const offending = bound.filter((one) =>
           bindings.some((binding) => binding.symbol === one.symbol && binding.kind === one.kind),
         );
         // The rewrite is `import * as X from "pkg/<name>"`, which only means
         // something for a named binding — a namespace one has no name to put
         // in the subpath.
         const rewritable =
-          fixable &&
+          edge.form === "import" &&
           rule.fix === "subpath-namespace-import" &&
           offending.length === bound.length &&
           offending.every((one) => one.kind === "named");
 
         if (rewritable) {
           context.report({
-            node,
+            node: at(node),
             message: formatMessage(violation),
             fix: (fixer: Fixer) =>
-              fixer.replaceText(node, subpathNamespaceImport(specifierValue, offending)),
+              fixer.replaceText(at(node), subpathNamespaceImport(specifier, offending)),
           });
           continue;
         }
 
         context.report({
-          node: offending[0]?.node ?? node,
+          node: at(offending[0]?.node ?? node),
           message: formatMessage(violation),
         });
       }
@@ -172,23 +100,8 @@ export const makeExportsRule = (policy: LoadedPolicy): OxlintRule => ({
         selected = exportRulesSelecting(policy.exportRules, importer);
         return selected.length > 0;
       },
-      ImportDeclaration(node: DeclarationNode) {
-        check(node, specifierOf(node), boundSpecifiers(node), true);
-      },
-      ExportNamedDeclaration(node: DeclarationNode) {
-        check(node, specifierOf(node), boundSpecifiers(node), false);
-      },
-      ExportAllDeclaration(node: ExportAllNode) {
-        check(node, specifierOf(node), [wholeModule(node, nameOf(node.exported) ?? "")], false);
-      },
-      ImportExpression(node: ImportExpressionNode) {
-        check(node, importExpressionSpecifierOf(node), [wholeModule(node)], false);
-      },
-      CallExpression(node: CallNode) {
-        check(node, requireSpecifierOf(node), [wholeModule(node)], false);
-      },
-      TSImportEqualsDeclaration(node: ImportEqualsNode) {
-        check(node, importEqualsSpecifierOf(node), [wholeModule(node)], false);
+      Program(node: Program) {
+        for (const edge of factsOfProgram(importer, node).edges) check(edge);
       },
     };
   },

package/src/imports-rule.ts

@@ -5,20 +5,15 @@ import {
   rulesSelecting,
   type SelectedRule,
 } from "@goodbones/core";
+import type { ReadEdge } from "@goodbones/typescript";
 import * as Result from "effect/Result";
 
 import {
-  type CallNode,
-  type ImportEqualsNode,
-  importEqualsSpecifierOf,
-  type ImportExpressionNode,
-  importExpressionSpecifierOf,
+  at,
+  factsOfProgram,
   type OxlintRule,
-  type ReportableNode,
-  requireSpecifierOf,
+  type Program,
   type RuleContext,
-  type SourceNode,
-  specifierOf,
   toRepoRelative,
 } from "./oxlint-api.js";
 
@@ -44,32 +39,29 @@ export const makeImportsRule = (policy: LoadedPolicy): OxlintRule => ({
     let importer = "";
     let selected: ReadonlyArray<SelectedRule> = [];
 
-    const check = (node: ReportableNode, specifier: string | null): void => {
-      if (specifier === null) return;
-
+    const check = (edge: ReadEdge): void => {
+      const { specifier } = edge;
       const outcome = evaluateSelectedEdge(selected, policy.resolver, { importer, specifier });
 
       if (Result.isFailure(outcome)) {
         if (policy.config.resolve.unresolved === "off") return;
         if (policy.ignoreUnresolved.some((pattern) => pattern.test(specifier))) return;
-        context.report({ node, message: unresolvedMessage(specifier, outcome.failure.detail) });
+        context.report({
+          node: at(edge.node),
+          message: unresolvedMessage(specifier, outcome.failure.detail),
+        });
         return;
       }
 
       for (const violation of outcome.success) {
         if (policy.baseline.isBaselined(violation)) continue;
-        context.report({ node, message: formatMessage(violation) });
+        context.report({ node: at(edge.node), message: formatMessage(violation) });
       }
     };
 
-    const checkSource = (node: SourceNode): void => {
-      check(node, specifierOf(node));
-    };
-
-    // Every form that names a module is an edge. The CLI adapter reads the same
-    // five out of TypeScript's tree, and the parity suite holds the two to it: a
-    // `require` the plugin skipped would be a rule that enforces nothing under
-    // `oxlint` while failing under `architecture check`.
+    // Every form that names a module is an edge, and the pack's reader is
+    // what says which forms those are — the same reader the CLI reads a file
+    // through, so a form one host sees the other sees too.
     return {
       before() {
         importer = toRepoRelative(policy.repoRoot, context.filename);
@@ -77,19 +69,8 @@ export const makeImportsRule = (policy: LoadedPolicy): OxlintRule => ({
         selected = rulesSelecting(policy.importRules, importer);
         return selected.length > 0;
       },
-      ImportDeclaration: checkSource,
-      ExportNamedDeclaration: checkSource,
-      ExportAllDeclaration: checkSource,
-      // `import("m")` with a literal argument. A computed one is not a fact a
-      // static policy can speak about, in either adapter.
-      ImportExpression(node: ImportExpressionNode) {
-        check(node, importExpressionSpecifierOf(node));
-      },
-      CallExpression(node: CallNode) {
-        check(node, requireSpecifierOf(node));
-      },
-      TSImportEqualsDeclaration(node: ImportEqualsNode) {
-        check(node, importEqualsSpecifierOf(node));
+      Program(node: Program) {
+        for (const edge of factsOfProgram(importer, node).edges) check(edge);
       },
     };
   },