@joshuafolkken/kit 1.1784.0 → 1.2116.0

package/scripts/lib/shell-quote.ts

@@ -0,0 +1,21 @@
+// One word for a POSIX shell, in single quotes, so a `$`, a backtick or a `"` in it is never expanded
+// or ends the word: a quote inside closes the word, adds an escaped quote and reopens it.
+
+const QUOTE = "'"
+const ESCAPED_QUOTE = String.raw`'\''`
+
+function single_quoted(text: string): string {
+	return QUOTE + text.split(QUOTE).join(ESCAPED_QUOTE) + QUOTE
+}
+
+// A token of only these characters means the same to the shell quoted or not, so it is left bare.
+const BARE_WORD = /^[\w%+,./:=@-]+$/u
+
+// `token` as one shell word: bare when quoting would change nothing, single-quoted otherwise.
+function word(token: string): string {
+	return BARE_WORD.test(token) ? token : single_quoted(token)
+}
+
+const shell_quote = { single_quoted, word }
+
+export { shell_quote }

package/scripts/lib/token-shape.ts

@@ -0,0 +1,111 @@
+// cspell:words xoxb xoxp xapp xoxa xoxo xoxr
+import { json_value } from './json-value'
+
+// The credential shapes a body kit sends out is refused for, and the run board hides. **One list, read
+// in-process**: every outbound body passes through here, so a regex costs microseconds where a
+// secretlint spawn per send would cost a second.
+//
+// Each shape with a `secretlint` rule matches what that preset rule matches — the preset bundles its
+// rules and exports none of their patterns, so each is restated here — and `token-shape.test.ts` runs
+// secretlint over every shape's sample, so a pattern that drifts from the preset fails there. A shape
+// with no rule is kit's own.
+
+interface TokenShape {
+	name: string
+	pattern: RegExp
+	// The preset rule that flags the same shape; `undefined` for one only kit knows.
+	secretlint: string | undefined
+}
+
+const REDACTED = '[REDACTED]'
+const GITHUB_RULE = '@secretlint/secretlint-rule-github'
+
+// `claude setup-token`'s output: no preset rule knows it, and `claude-token-output.ts` captures it.
+const ANTHROPIC_OAUTH_TOKEN = /sk-ant-oat\d+-[\w-]+/u
+
+const SHAPES: ReadonlyArray<TokenShape> = [
+	{
+		name: 'GitHub token',
+		pattern: /(?<!\p{L})(?:ghp|gho|ghu|ghs|ghr)_\w{36}(?!\w)/u,
+		secretlint: GITHUB_RULE,
+	},
+	{
+		name: 'GitHub App installation token',
+		pattern: /(?<!\p{L})ghs_\d{1,20}_[\w-]{1,1000}\.[\w-]{1,10000}\.[\w-]{1,1000}(?![\w-])/u,
+		secretlint: GITHUB_RULE,
+	},
+	{
+		name: 'GitHub fine-grained token',
+		pattern: /(?<!\p{L})github_pat_\w{82}(?!\w)/u,
+		secretlint: GITHUB_RULE,
+	},
+	{
+		name: 'Slack token',
+		pattern:
+			/\b(?:xoxb|xoxp|xapp|xoxa|xoxo|xoxr)-(?:\d-)?(?:[a-zA-Z0-9]{1,40}-)+[a-zA-Z0-9]{1,40}\b/u,
+		secretlint: '@secretlint/secretlint-rule-slack',
+	},
+	{
+		name: 'Anthropic API key',
+		pattern: /(?<!\p{L})sk-ant-api0\d-[\w-]{90,128}AA(?![\w-])/u,
+		secretlint: '@secretlint/secretlint-rule-anthropic',
+	},
+	{ name: 'Anthropic OAuth token', pattern: ANTHROPIC_OAUTH_TOKEN, secretlint: undefined },
+]
+
+const EVERY_SHAPE = new RegExp(SHAPES.map((shape) => shape.pattern.source).join('|'), 'gu')
+
+// The first shape `text` holds, `undefined` for none.
+function find(text: string): TokenShape | undefined {
+	return SHAPES.find((shape) => shape.pattern.test(text))
+}
+
+// Whether `text` holds any shape — `find`'s test without the shape it names.
+function holds(text: string): boolean {
+	return SHAPES.some((shape) => shape.pattern.test(text))
+}
+
+// Throws when `text` holds a credential, naming the shape and never the value: `subject` is what was
+// about to be sent, so the refusal says which send stopped.
+function refuse(text: string, subject: string): void {
+	const shape = find(text)
+	if (shape === undefined) return
+
+	throw new Error(
+		`${subject} holds a ${shape.name}-shaped string, so it was not sent. Remove the credential and send it again.`,
+	)
+}
+
+function redact(text: string): string {
+	return text.replaceAll(EVERY_SHAPE, () => REDACTED)
+}
+
+// A JSON-encoded body puts a token starting a line after the `n` of an escaped newline, and the
+// shapes' "no letter before it" guard reads that `n` as a letter. So a body is scanned as the strings
+// its JSON decodes to — what GitHub stores — and as raw text only when it is not JSON.
+function string_leaves(value: unknown): Array<string> {
+	if (typeof value === 'string') return [value]
+	if (typeof value !== 'object' || value === null) return []
+
+	return Object.values(value).flatMap((entry: unknown) => string_leaves(entry))
+}
+
+function decoded(body: string): string {
+	const value = json_value.parse_or_undefined(body)
+
+	return value === undefined ? body : string_leaves(value).join('\n')
+}
+
+const token_shape = {
+	ANTHROPIC_OAUTH_TOKEN,
+	REDACTED,
+	SHAPES,
+	decoded,
+	find,
+	holds,
+	refuse,
+	redact,
+}
+
+export { token_shape }
+export type { TokenShape }

package/scripts/lint/eslint-daemon-sources.ts

@@ -0,0 +1,79 @@
+import { createHash } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+import path from 'node:path'
+import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
+
+// **What the daemon's type program may hold an old copy of: every file whose content differs from the
+// commit checked out.** The program keeps each source it read but did not lint, and never re-reads it,
+// so a shell edit to an imported module — one the edit hook never sees — left typed rules failing on
+// the module's old exports, and the cache guard then recorded that verdict under the new closure hash,
+// so it replayed even after the daemon was stopped (joshuafolkken/kit#4867). A file equal to HEAD is
+// already covered by the HEAD in the fingerprint, so only the changed ones are hashed: one entry each,
+// `<path>\t<content digest>`, one per line, sorted.
+//
+// The edit hook lints the file it edited through the daemon, which reads it fresh, so it refreshes
+// that one entry (`refresh`); an edit it never saw leaves the entry behind, and the next run restarts.
+
+// NUL-separated, so a path git would quote and escape — any non-ASCII name — reads as the file it is.
+const CHANGED_FILES: ReadonlyArray<string> = ['diff', 'HEAD', '--name-only', '--relative', '-z']
+const NEW_FILES: ReadonlyArray<string> = ['ls-files', '--others', '--exclude-standard', '-z']
+const PATH_SEPARATOR = '\0'
+const LINE_SEPARATOR = '\n'
+const ENTRY_SEPARATOR = '\t'
+const DIGEST_ALGORITHM = 'sha256'
+const ABSENT = 'absent'
+const UNREAD = ':unread'
+
+// One order for `snapshot` and `refresh` alike, so a refreshed record compares equal to a fresh one.
+function by_text(left: string, right: string): number {
+	return left.localeCompare(right)
+}
+
+function lines_of(text: string): ReadonlyArray<string> {
+	return text.split(LINE_SEPARATOR).filter((line) => line !== '')
+}
+
+function content_digest(file: string): string {
+	try {
+		return createHash(DIGEST_ALGORITHM).update(readFileSync(file)).digest('hex')
+	} catch {
+		return ABSENT
+	}
+}
+
+// A git that could not answer lists a path no file has, so its record differs from one with no changes.
+function changed_paths(project_root: string): ReadonlyArray<string> {
+	const listed = [CHANGED_FILES, NEW_FILES].map(
+		(git_arguments) => git_spawn_sync.read(git_arguments, { cwd: project_root }) ?? UNREAD,
+	)
+
+	const paths = listed.join(PATH_SEPARATOR).split(PATH_SEPARATOR)
+
+	return [...new Set(paths.filter((relative) => relative !== ''))]
+}
+
+// The changed files' entries, sorted — nothing when no file differs from HEAD.
+function snapshot(project_root: string): string {
+	return changed_paths(project_root)
+		.map(
+			(relative) =>
+				`${relative}${ENTRY_SEPARATOR}${content_digest(path.join(project_root, relative))}`,
+		)
+		.toSorted(by_text)
+		.join(LINE_SEPARATOR)
+}
+
+// A recorded fingerprint — its first line the daemon's other inputs, the rest `snapshot`'s entries —
+// with `relative`'s entry as `current` has it now: the daemon has just read that one file fresh.
+function refresh(recorded: string, current: string, relative: string): string {
+	const prefix = `${relative}${ENTRY_SEPARATOR}`
+	const [inputs = '', ...entries] = lines_of(recorded)
+	const others = entries.filter((line) => !line.startsWith(prefix))
+	const fresh = lines_of(current).filter((line) => line.startsWith(prefix))
+
+	return [inputs, ...[...others, ...fresh].toSorted(by_text)].join(LINE_SEPARATOR)
+}
+
+const eslint_daemon_sources = { refresh, snapshot, LINE_SEPARATOR }
+
+export { eslint_daemon_sources }

package/scripts/lint/eslint-daemon.ts

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto'
 import { lstatSync, readFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import path from 'node:path'
@@ -8,6 +9,7 @@ import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
 import { atomic_write } from '#scripts/lib/atomic-write'
 import { buffered_process, type BufferedProcessResult } from '#scripts/lib/buffered-process'
 import { execa } from 'execa'
+import { eslint_daemon_sources } from './eslint-daemon-sources'
 
 // One warm eslint per checkout, reached by every eslint run that is not the gate's whole tree: the
 // `PostToolUse` edit hook, `josh lint:related` and the pre-commit hook (joshuafolkken/kit#4358).
@@ -30,6 +32,9 @@ const DAEMON_RECORD = '.eslint_d'
 const FINGERPRINT_RECORD = '.eslint_d-toolchain'
 const RECORD_SEPARATOR = '\n'
 const NO_HEAD = 'no-head'
+// Every file the type program could resolve: tracked, staged by a merge in progress, or new.
+const LIST_FILES: ReadonlyArray<string> = ['ls-files', '--cached', '--others', '--exclude-standard']
+const DIGEST_ALGORITHM = 'sha256'
 
 // Where this file sits inside the kit package. `eslint_d` is kit's dependency rather than the
 // consumer's, and pnpm writes a `node_modules/.bin` shim only for a project's *direct* dependencies,
@@ -91,16 +96,29 @@ function eslint_arguments_of(
 	return pnpm_arguments.slice(PNPM_ESLINT_PREFIX_LENGTH)
 }
 
+function digest_of(text: string): string {
+	return createHash(DIGEST_ALGORITHM).update(text).digest('hex')
+}
+
 // **What a daemon is current for: the toolchain's content and the commit checked out.** The daemon's
 // type program keeps every source it read but did not lint, so a merge that changes those types leaves
 // typed rules failing on the old ones (joshuafolkken/kit#4443); every merge, checkout, reset, pull and
 // commit moves HEAD, the commands that move sources under the daemon without an edit the hook sees.
 // A content digest rather than a time: a copy or a checkout rewrites every mtime and leaves the
 // content alone, and an edit can keep its old mtime. Outside a repository there is no HEAD.
+// **The files the program can resolve, too**: a merge whose conflicts are being resolved brings main's
+// new modules in without moving HEAD, and a daemon that had built its program before they arrived
+// reported their types as unresolvable until it was stopped (joshuafolkken/kit#4701).
+// **And the content of every file that differs from HEAD**, each on a line of its own after the rest
+// (`eslint-daemon-sources.ts`): an edit the hook lints is read fresh and refreshes its own line, and a
+// shell edit it never saw restarts the daemon (joshuafolkken/kit#4867).
 function fingerprint(project_root: string): string {
 	const head = git_spawn_sync.read(['rev-parse', 'HEAD'], { cwd: project_root }) ?? NO_HEAD
+	const files = git_spawn_sync.read(LIST_FILES, { cwd: project_root }) ?? NO_HEAD
+	const inputs = `${toolchain_inputs.digest(project_root)}:${head}:${digest_of(files)}`
+	const sources = eslint_daemon_sources.snapshot(project_root)
 
-	return `${toolchain_inputs.digest(project_root)}:${head}`
+	return sources === '' ? inputs : `${inputs}${eslint_daemon_sources.LINE_SEPARATOR}${sources}`
 }
 
 // Where the eslint the daemon resolves keeps its record, or nothing without an installed eslint.
@@ -140,7 +158,7 @@ function record_text(daemon: string, current: string): string {
 // so a toolchain input that moved since it started leaves it linting against the old rules, and a
 // HEAD move leaves it typing against the old sources. A daemon this module did not record — another
 // tool started it, or the record is from an older one — is stale too: nothing says what it loaded.
-// The edit hook records the daemons it starts and restarts (`remember_started`); this catches the rest.
+// The edit hook records the daemons it starts and restarts (`remember_after_edit`); this catches the rest.
 function is_stale(record: DaemonRecord, current: string): boolean {
 	if (record.daemon === undefined) return false
 
@@ -169,10 +187,31 @@ function remember(project_root: string, current: string): void {
 // under the inputs as they are now, and a daemon's record changes with every start — so a record that
 // changed across the hook's commands names a daemon they started. Recording it keeps the next lint run
 // from stopping and cold-starting a daemon that is already current.
-function remember_started(project_root: string, before: DaemonRecord): void {
-	if (read_record(project_root).daemon === before.daemon) return
+// A daemon that kept running has read the edited file fresh and nothing else, so only that file's
+// line of a record that is current otherwise is refreshed.
+// A borrowed install's record belongs to the lending checkout, whose files these are not.
+function remember_read(project_root: string, record: DaemonRecord, relative: string): void {
+	const { daemon, recorded } = record
+	if (daemon === undefined || recorded === undefined || is_borrowed_install(project_root)) return
+	const prefix = record_text(daemon, '')
+	if (!recorded.startsWith(prefix)) return
+	const current = eslint_daemon_sources.snapshot(project_root)
+
+	remember(
+		project_root,
+		eslint_daemon_sources.refresh(recorded.slice(prefix.length), current, relative),
+	)
+}
+
+function remember_after_edit(
+	project_root: string,
+	before: DaemonRecord,
+	edited: string | undefined,
+): void {
+	const after = read_record(project_root)
 
-	remember(project_root, fingerprint(project_root))
+	if (after.daemon !== before.daemon) remember(project_root, fingerprint(project_root))
+	else if (edited !== undefined) remember_read(project_root, after, edited)
 }
 
 // `cwd` decides which eslint installation and which flat config answer, and `ESLINT_D_MISS=fail`
@@ -254,7 +293,7 @@ const eslint_daemon = {
 	is_stale,
 	read_record,
 	record_text,
-	remember_started,
+	remember_after_edit,
 	resolve_daemon_cli,
 	run,
 	run_or_cold,

package/scripts/lint/eslint-warm-cli.ts

@@ -0,0 +1,7 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { eslint_warm } from './eslint-warm'
+
+// The detached warm-up `eslint_warm.start` spawns in the checkout to warm (joshuafolkken/kit#4720).
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) await eslint_warm.warm(process.cwd())

package/scripts/lint/eslint-warm.ts

@@ -0,0 +1,66 @@
+import { spawn } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
+import { resolve_tsx_runner } from '#scripts/josh/josh-logic'
+import { LINT_TIMEOUT_MS } from '#scripts/lib/timeouts'
+import { eslint_daemon } from './eslint-daemon'
+
+// Warms a fresh checkout's eslint daemon before its first edit (joshuafolkken/kit#4720). A cold
+// daemon took 5–8 s on the first edit hook's lint and 0.1–1.3 s once warm; `eslint_d start` alone
+// warms nothing — its first lint still took 8 s — because the cost is eslint loading the config, the
+// plugins and the type program, which only a lint of a typed source pays.
+//
+// **The lint goes through `eslint_daemon.run` rather than the bare daemon**, so the daemon it starts
+// is recorded with its fingerprint: an unrecorded one is stale to `josh lint:related` and the
+// pre-commit hook, which would stop and cold-start it on their first run.
+
+const WARM_CLI = fileURLToPath(new URL('eslint-warm-cli.ts', import.meta.url))
+// One typed source the type program covers; a declaration file can be ignored by the flat config.
+const TYPED_SOURCES: ReadonlyArray<string> = ['ls-files', '--', '*.ts', ':!*.d.ts']
+// A project with no TypeScript still loads its config and plugins through this.
+const FALLBACK_TARGET = 'eslint.config.js'
+const LINE_SEPARATOR = '\n'
+
+function warm_target(project_root: string): string {
+	const listed = git_spawn_sync.read(TYPED_SOURCES, { cwd: project_root }) ?? ''
+	const [first] = listed.split(LINE_SEPARATOR)
+
+	return first === undefined || first === '' ? FALLBACK_TARGET : first
+}
+
+// Bounded, so a daemon that never answers ends the detached warm-up instead of orphaning it
+// (joshuafolkken/kit#5047); a timed-out warm-up leaves the first edit cold, as before.
+async function warm(project_root: string): Promise<void> {
+	await eslint_daemon.run(['exec', 'eslint', warm_target(project_root)], {
+		project_root,
+		timeout_ms: LINT_TIMEOUT_MS,
+	})
+}
+
+function ignore_error(): void {
+	// A warm-up that could not start leaves the first edit cold, as it was before.
+}
+
+// Detached and unreferenced, so the caller neither waits for the lint nor keeps its process alive
+// for it. Best-effort: nothing here may fail the caller.
+//
+// **A test run starts none** (joshuafolkken/kit#5047): suites drive a real `lane open` in scratch
+// trees, and one that forgot to mock this module left a detached warm-up behind each time.
+function start(project_root: string): void {
+	if (process.env['VITEST'] !== undefined) return
+
+	try {
+		const runner = resolve_tsx_runner()
+		const options = { cwd: project_root, detached: true, stdio: 'ignore' } as const
+		const child = spawn(runner.executable, [...runner.leading_arguments, WARM_CLI], options)
+
+		child.on('error', ignore_error)
+		child.unref()
+	} catch {
+		ignore_error()
+	}
+}
+
+const eslint_warm = { start, warm }
+
+export { eslint_warm }

package/scripts/lint/import-graph.ts

@@ -2,6 +2,7 @@ import path from 'node:path'
 import { input_fingerprint } from '#scripts/gate/input-fingerprint'
 import { file_reader } from '#scripts/lib/read-file'
 import type ts from 'typescript'
+import { type_only_imports } from './type-only-imports'
 
 // What a file's lint verdict reads besides the file itself: every file its imports reach, followed
 // through the project's own files and stopped at a package's. A type-aware rule's verdict on a file
@@ -34,6 +35,7 @@ interface GraphContext extends Resolver {
 	resolution_cache: ts.ModuleResolutionCache
 	ambient: ReadonlyArray<Dependency>
 	dependencies: Map<string, ReadonlyArray<Dependency>>
+	runtime_dependencies: Map<string, ReadonlyArray<Dependency>>
 	content_hashes: Map<string, string>
 }
 
@@ -44,9 +46,20 @@ interface ProjectConfig {
 }
 
 interface ImportGraph {
+	closure: (file: string) => ReadonlyArray<string>
 	closure_hash: (file: string) => string
+	imports: (file: string, content?: string) => ReadonlyArray<string>
+	importers: (files: ReadonlyArray<string>, universe: ReadonlyArray<string>) => ReadonlySet<string>
+	runtime_importers: (
+		files: ReadonlyArray<string>,
+		universe: ReadonlyArray<string>,
+	) => ReadonlySet<string>
+	strings: (file: string) => ReadonlyArray<string>
 }
 
+// A file's direct dependencies along one kind of edge.
+type Edges = (context: GraphContext, file: string) => ReadonlyArray<Dependency>
+
 // `typescript` is an optional peer: a project without it has no type-aware rule to go stale.
 async function load_typescript(): Promise<TypeScript | undefined> {
 	try {
@@ -138,12 +151,12 @@ function resolve_type(resolver: Resolver, name: string, file: string): Dependenc
 	return as_dependency(resolved?.resolvedFileName, resolved?.isExternalLibraryImport)
 }
 
-function references_of(context: GraphContext, file: string): Array<Dependency | undefined> {
-	const processed = context.typescript.preProcessFile(
-		file_reader.read_if_readable(file) ?? '',
-		true,
-		true,
-	)
+function references_of(
+	context: GraphContext,
+	file: string,
+	content: string,
+): Array<Dependency | undefined> {
+	const processed = context.typescript.preProcessFile(content, true, true)
 
 	return [
 		...processed.importedFiles.map((reference) =>
@@ -159,13 +172,31 @@ function references_of(context: GraphContext, file: string): Array<Dependency |
 function direct_dependencies(context: GraphContext, file: string): ReadonlyArray<Dependency> {
 	const known = context.dependencies.get(file)
 	if (known !== undefined) return known
-	const found = references_of(context, file).filter((dependency) => dependency !== undefined)
+	const found = references_of(context, file, file_reader.read_if_readable(file) ?? '').filter(
+		(dependency) => dependency !== undefined,
+	)
 
 	context.dependencies.set(file, found)
 
 	return found
 }
 
+// The direct dependencies the test runner follows: the imports left once the transpiler drops the
+// type-only declarations, and no `/// <reference>` (joshuafolkken/kit#5368).
+function runtime_dependencies(context: GraphContext, file: string): ReadonlyArray<Dependency> {
+	const known = context.runtime_dependencies.get(file)
+	if (known !== undefined) return known
+	const content = file_reader.read_if_readable(file) ?? ''
+	const found = type_only_imports
+		.runtime_specifiers(context.typescript, file, content)
+		.map((specifier) => resolve_module(context, specifier, file))
+		.filter((dependency) => dependency !== undefined)
+
+	context.runtime_dependencies.set(file, found)
+
+	return found
+}
+
 // A file reaches files that never import it when it is a script or declares a global or a module —
 // SvelteKit's `src/app.d.ts` `App.Locals`, say, or a `.ts` module's `declare global` augmentation;
 // one that only exports is read through its imports like any other module.
@@ -253,6 +284,105 @@ function closure_hash(context: GraphContext, file: string): string {
 	return input_fingerprint.of_entries(tokens)
 }
 
+// The project's own files `closure_hash` reads for `file`, a package's left out.
+function closure(context: GraphContext, file: string): Array<string> {
+	return [...reachable(context, file).values()]
+		.filter((dependency) => !dependency.external)
+		.map((dependency) => dependency.file)
+}
+
+// The text of each string literal `file` holds, a template's spans included: where a file names one it
+// starts rather than imports — the CLI a test spawns.
+function strings(typescript: TypeScript, file: string): Array<string> {
+	const content = file_reader.read_if_readable(file) ?? ''
+	const source = typescript.createSourceFile(file, content, typescript.ScriptTarget.Latest)
+	const found: Array<string> = []
+
+	function visit(node: ts.Node): void {
+		if (typescript.isStringLiteralLike(node) || typescript.isTemplateLiteralToken(node)) {
+			found.push(node.text)
+		}
+
+		typescript.forEachChild(node, visit)
+	}
+
+	visit(source)
+
+	return found
+}
+
+// The project's own files `file` imports directly; a package's are left out. `content` reads another
+// text of the file in its place — its version at another revision — resolved from where it sits now.
+function imports(context: GraphContext, file: string, content?: string): Array<string> {
+	const dependencies =
+		content === undefined
+			? direct_dependencies(context, file)
+			: references_of(context, file, content).filter((dependency) => dependency !== undefined)
+
+	return dependencies
+		.filter((dependency) => !dependency.external)
+		.map((dependency) => dependency.file)
+}
+
+function append(map: Map<string, Array<string>>, key: string, value: string): void {
+	const known = map.get(key)
+
+	if (known === undefined) map.set(key, [value])
+	else known.push(value)
+}
+
+function reverse_edges(
+	context: GraphContext,
+	universe: ReadonlyArray<string>,
+	edges: Edges,
+): Map<string, Array<string>> {
+	const reverse = new Map<string, Array<string>>()
+
+	for (const file of universe) {
+		for (const dependency of edges(context, file)) {
+			append(reverse, dependency.file, file)
+		}
+	}
+
+	return reverse
+}
+
+// Every file of `universe` whose `edges` reach one of `files`, the files themselves included. Over every
+// import, the only files that can name what they export, however many re-exports and aliases stand
+// between; over the runtime imports, the graph the test runner walks, where a file read only through
+// `import type` reaches no test past it (joshuafolkken/kit#5368).
+function importers(
+	context: GraphContext,
+	files: ReadonlyArray<string>,
+	universe: ReadonlyArray<string>,
+	edges: Edges,
+): ReadonlySet<string> {
+	const reverse = reverse_edges(context, universe, edges)
+	const reached = new Set(files)
+	const pending = [...files]
+
+	for (let current = pending.pop(); current !== undefined; current = pending.pop()) {
+		const next = (reverse.get(current) ?? []).filter((file) => !reached.has(file))
+
+		for (const file of next) reached.add(file)
+		pending.push(...next)
+	}
+
+	return reached
+}
+
+function graph_of(context: GraphContext): ImportGraph {
+	return {
+		closure: (file) => closure(context, file),
+		closure_hash: (file) => closure_hash(context, file),
+		imports: (file, content) => imports(context, file, content),
+		importers: (files, universe) => importers(context, files, universe, direct_dependencies),
+		runtime_importers: (files, universe) =>
+			importers(context, files, universe, runtime_dependencies),
+		strings: (file) => strings(context.typescript, file),
+	}
+}
+
 // Undefined where nothing type-aware can run: no `typescript`, or no `tsconfig.json` at the root.
 async function create(root: string): Promise<ImportGraph | undefined> {
 	const typescript = await load_typescript()
@@ -260,17 +390,17 @@ async function create(root: string): Promise<ImportGraph | undefined> {
 	const parsed = parsed_config(typescript, root)
 	if (parsed === undefined) return undefined
 	const { options } = parsed
-	const context: GraphContext = {
+
+	return graph_of({
 		root,
 		typescript,
 		options,
 		resolution_cache: typescript.createModuleResolutionCache(root, (name) => name, options),
 		ambient: ambient_of({ typescript, options }, root, parsed),
 		dependencies: new Map(),
+		runtime_dependencies: new Map(),
 		content_hashes: new Map(),
-	}
-
-	return { closure_hash: (file) => closure_hash(context, file) }
+	})
 }
 
 const import_graph = { create }

package/scripts/lint/lint-gate-scope.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs'
 import path from 'node:path'
 import { environment_flags } from '@joshuafolkken/kit/env'
-import { gate_plan } from '#scripts/gate/gate-plan'
+import { gate_labels } from '#scripts/gate/gate-labels'
 import { verification_inputs } from '#scripts/gate/verification-inputs'
 import {
 	changed_file_scope,
@@ -60,7 +60,7 @@ function all_scope(reason: string): ChangedFileScope {
 // reads them too.
 function configures_lint(files: ReadonlyArray<string>, root: string): boolean {
 	return verification_inputs.configures(
-		gate_plan.LINT_LABEL,
+		gate_labels.LINT_LABEL,
 		files.map((file) => path.relative(root, file).split(path.sep).join('/')),
 	)
 }