@joshuafolkken/kit 1.872.0

package/scripts/lib/bounded-pool.ts

@@ -0,0 +1,109 @@
+// One definition of "run these at most N at a time".
+//
+// Three callers need it and had it three times: `eval-run.ts` runs one real Claude session per
+// scenario and must not fan out to as many as the suite happens to hold, and `epic-bundle-cli.ts`
+// and `epic-bundle-referenced.ts` each read one issue per reference and must not turn a rate limit
+// into a wrong answer. The reads were written as waves — slice, `Promise.all`, next slice — which
+// idles the whole batch behind its slowest member, so the three were neither the same code nor the
+// same behavior (joshuafolkken/kit#1144).
+//
+// A worker pool instead: `limit` consumers pull from one queue, so a slot is refilled the moment its
+// task ends rather than when its neighbors do.
+
+interface IndexedResult<Result> {
+	index: number
+	value: Result
+}
+
+// The queue and what has come out of it, shared by every consumer. Carried as one object rather than
+// three captured variables so a consumer can live outside the function that built them.
+interface Pool<Item, Result> {
+	queue: Array<[number, Item]>
+	results: Array<IndexedResult<Result>>
+	failures: Array<unknown>
+}
+
+// At least one consumer, never more than there is work for. A limit above the item count would spawn
+// consumers that find an empty queue and exit; a limit below one would spawn none and return an empty
+// result for a non-empty input, which reads as "nothing to do" rather than as the misconfiguration it
+// is.
+//
+// **`NaN` is that same hole, and `Math.max` does not close it**: every comparison with `NaN` is false,
+// so the clamp passes it straight through and `Array.from({ length: NaN })` builds no consumer at all
+// — an empty result for a non-empty input, which is precisely what the paragraph above promises
+// cannot happen. A caller reading that promise is entitled not to validate first, so it is closed
+// here (joshuafolkken/kit#1144). A fractional limit is floored for the same reason: `Array.from`
+// truncates it silently, and a width that is not the number asked for should be a decision rather
+// than a side effect.
+function pool_width(limit: number, total: number): number {
+	if (!Number.isFinite(limit)) return 1
+
+	return Math.max(1, Math.min(Math.floor(limit), total))
+}
+
+// The first failure, once the pool has emptied. `undefined` is a legitimate thing for a worker to
+// throw, so the count decides whether there was one rather than the value.
+function throw_first_failure(failures: ReadonlyArray<unknown>): void {
+	if (failures.length === 0) return
+
+	const [first] = failures
+
+	throw first
+}
+
+// One consumer: take the next item, run it, take the next. **A failure recorded by any consumer ends
+// every consumer's loop**, so none picks up new work — the serial loop this replaces stopped at the
+// first throw, and a pool that kept draining would spawn real Claude sessions after the run had
+// already failed. It is recorded rather than thrown because a rejection propagates while the siblings
+// are still mid-task, which in the eval suite reaches `eval-run.ts`'s top-level await and ends the
+// process before their `finally { remove_sandbox() }` runs — leaking exactly the tree the sandbox
+// promises to clean up.
+async function drain<Item, Result>(
+	pool: Pool<Item, Result>,
+	worker: (item: Item, index: number) => Promise<Result>,
+): Promise<void> {
+	for (
+		let entry = pool.queue.shift();
+		entry !== undefined && pool.failures.length === 0;
+		entry = pool.queue.shift()
+	) {
+		const [index, item] = entry
+
+		try {
+			pool.results.push({ index, value: await worker(item, index) })
+		} catch (error) {
+			pool.failures.push(error)
+		}
+	}
+}
+
+// Results come back in input order however they finished. Callers pair them with their inputs by
+// position — an epic's children are reported in the order its body lists them — so completion order
+// must not leak into the array. A failure is raised only after the last consumer has returned, for
+// the reason `drain` gives above.
+async function bounded_map<Item, Result>(
+	items: ReadonlyArray<Item>,
+	limit: number,
+	worker: (item: Item, index: number) => Promise<Result>,
+): Promise<Array<Result>> {
+	const pool: Pool<Item, Result> = {
+		failures: [],
+		queue: items.map((item, index): [number, Item] => [index, item]),
+		results: [],
+	}
+	const consumers = Array.from({ length: pool_width(limit, items.length) }, async () => {
+		await drain(pool, worker)
+	})
+
+	await Promise.all(consumers)
+
+	throw_first_failure(pool.failures)
+
+	return pool.results
+		.toSorted((left, right) => left.index - right.index)
+		.map((result) => result.value)
+}
+
+const bounded_pool = { bounded_map, pool_width }
+
+export { bounded_pool }

package/scripts/lib/buffered-process.ts

@@ -0,0 +1,82 @@
+import { execa } from 'execa'
+
+// One definition of "run a check, keep its output, never throw".
+//
+// `lint-parallel.ts` and `verification-gate.ts` both fan out to concurrent child processes and both
+// need the same three things: the output buffered until the child finishes (concurrent writers
+// otherwise interleave into an unreadable transcript), a non-zero exit reported rather than thrown
+// (so one failing check does not abort its siblings), and a bound on how long a child may hang.
+// They had the same code twice, which is how a fix to one of them missed the other
+// (joshuafolkken/kit#914).
+
+const PNPM = 'pnpm'
+const FORCE_COLOR = '1'
+const FAIL_EXIT_CODE = 1
+// Long enough for a cold unit suite on a large consumer, short enough that a check which never
+// exits ends the run instead of holding it open with nothing printed — the same hazard
+// `propagate-steps.ts` bounds with its own step timeout. Because output is buffered until the
+// child finishes, a hung child shows nothing at all until this fires.
+const PROCESS_TIMEOUT_MS = 1_800_000
+
+interface BufferedProcessResult {
+	output: string
+	// execa reports `undefined` when a process is terminated by a signal; treat
+	// that as a failure (it is never strictly equal to 0).
+	exit_code: number | undefined
+	// How long the child ran, in milliseconds. Measured here rather than at each call site because
+	// this function owns the child's lifetime — a caller timing it from outside would have to repeat
+	// the same two readings, and every fan-out caller would repeat them once per branch
+	// (joshuafolkken/kit#1248).
+	elapsed_ms: number
+}
+
+// The two things a caller outside the fan-out needs to vary, and the only two
+// (joshuafolkken/kit#1554). `lane:open` runs its install in the work tree it just created rather
+// than in the directory `josh` was typed in, and bounds it well under the fan-out's half hour
+// because an install that never answers has to end the command rather than hold a parallel run
+// open. Everything else — the buffering, the non-throwing exit, and the color policy that respects
+// `NO_COLOR` — is the same contract, so it is inherited rather than restated.
+interface BufferedProcessOptions {
+	cwd?: string
+	timeout_ms?: number
+}
+
+async function run_buffered_process(
+	command_args: ReadonlyArray<string>,
+	options: BufferedProcessOptions = {},
+): Promise<BufferedProcessResult> {
+	// `performance.now()` rather than `Date.now()`: it is monotonic, so a system clock adjusted
+	// mid-check cannot produce a negative or wildly inflated duration.
+	const started_at = performance.now()
+	const environment = { ...process.env }
+	if (environment['NO_COLOR'] === undefined) environment['FORCE_COLOR'] = FORCE_COLOR
+	else delete environment['FORCE_COLOR']
+	// `cwd` is spread in rather than assigned: `exactOptionalPropertyTypes` refuses an explicit
+	// `undefined` for an optional `string`, and passing one anyway breaks execa's overload
+	// resolution — which silently widens `result.all` back to `string | undefined`.
+	const result = await execa(PNPM, [...command_args], {
+		env: environment,
+		extendEnv: false,
+		all: true,
+		reject: false,
+		...(options.cwd !== undefined && { cwd: options.cwd }),
+		timeout: options.timeout_ms ?? PROCESS_TIMEOUT_MS,
+	})
+
+	return {
+		output: result.all,
+		exit_code: result.exitCode,
+		elapsed_ms: performance.now() - started_at,
+	}
+}
+
+// Narrowed to the one field it reads, so a caller asking "did this fail" never has to invent the
+// two it does not — a duration fabricated to satisfy a parameter is a number nobody measured.
+function is_process_failed(result: Pick<BufferedProcessResult, 'exit_code'>): boolean {
+	return result.exit_code !== 0
+}
+
+const buffered_process = { is_process_failed, run_buffered_process }
+
+export type { BufferedProcessResult }
+export { buffered_process, FAIL_EXIT_CODE, PROCESS_TIMEOUT_MS }

package/scripts/lib/caddy-logs.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+# Caddy のアクセスログを見やすく表示するスクリプト
+# 使用方法: ./scripts/lib/caddy-logs.sh
+# chmod +x scripts/lib/caddy-logs.sh
+#
+# scp scripts/lib/caddy-logs.sh deploy-joshuastudio:/var/www/talk-svelte/scripts/ && \
+# ssh deploy-joshuastudio "chmod +x /var/www/talk-svelte/scripts/lib/caddy-logs.sh && echo '✅ File uploaded and permissions set'"
+
+sudo tail -n 100 -f /var/log/caddy/access.log | jq -r '
+  def status_symbol(status):
+    if status >= 200 and status < 300 then "✓"
+    elif status >= 300 and status < 400 then "→"
+    elif status >= 400 then "✗"
+    else "?" end;
+  def extract_os(ua):
+    if ua == null or ua == "-" then "Unknown"
+    elif (ua | contains("Windows NT")) then "Windows"
+    elif (ua | contains("Macintosh")) then "macOS"
+    elif (ua | contains("iPhone")) then "iOS"
+    elif (ua | contains("iPad")) then "iPadOS"
+    elif (ua | contains("Android")) then "Android"
+    elif (ua | contains("Linux")) then "Linux"
+    else "Unknown" end;
+  def extract_browser(ua):
+    if ua == null or ua == "-" then "Unknown"
+    elif (ua | contains("Chrome")) and (ua | contains("Edg") | not) then "Chrome"
+    elif (ua | contains("Edg")) then "Edge"
+    elif (ua | contains("Safari")) and (ua | contains("Chrome") | not) then "Safari"
+    elif (ua | contains("Firefox")) then "Firefox"
+    elif (ua | contains("Opera")) then "Opera"
+    else "Other" end;
+  def host_label:
+    (.request.host // (.request.headers.Host[0] // "-"))
+    | gsub("\\.joshuafolkken\\.com$"; "")
+    | gsub("^joshuafolkken\\.com$"; "");
+  "[\(.ts | . + 32400 | strftime("%H:%M:%S"))] " +
+  status_symbol(.status) + " " +
+  "\(.status) " +
+  "\(.request.method) " +
+  "\(.duration * 1000 | floor)ms " +
+  "\(.request.remote_ip // "-") " +
+  host_label + "\(.request.uri) " +
+  "(\(.size)) " +
+  "[\(extract_os(.request.headers."User-Agent"[0]))/\(extract_browser(.request.headers."User-Agent"[0]))]"
+'

package/scripts/lib/cli-flags.ts

@@ -0,0 +1,19 @@
+// Argument refusal for the small flag-only commands.
+//
+// Reject anything not on the list rather than ignoring it: a misspelled `--dryrun` that fell through
+// would run the real write path. `josh propagate` and `josh adopt` both write into working trees, so
+// the refusal is single-sourced here rather than described once per command (`CLAUDE.md` → "No
+// clones").
+function refuse_unknown_flags(
+	argv: ReadonlyArray<string>,
+	known_flags: ReadonlyArray<string>,
+	command: string,
+): string | undefined {
+	const unknown = argv.filter((argument) => !known_flags.includes(argument))
+	if (unknown.length === 0) return undefined
+	const usage = `Usage: josh ${command} [${known_flags.join('] [')}]`
+
+	return `Unknown argument(s): ${unknown.join(' ')}\n${usage}`
+}
+
+export { refuse_unknown_flags }

package/scripts/lib/json-value.ts

@@ -0,0 +1,24 @@
+// Reading JSON that may not be JSON (joshuafolkken/kit#1151).
+//
+// Four readers under `scripts/` parse text that a defect, a truncated write or an older format can
+// make unparseable — a transcript line, a settings file, an MCP declaration — and every one of them
+// answers "could not read this" rather than throwing, because a single bad line must not fail a
+// whole report. They had begun to carry a copy of the same try/catch each; this is the one copy.
+
+function parse_or_undefined(text: string): unknown {
+	try {
+		return JSON.parse(text)
+	} catch {
+		return undefined
+	}
+}
+
+// A plain object, as opposed to an array or a primitive. `typeof null` is `'object'`, and an array
+// answers `'object'` too, so both have to be excluded by hand before a key lookup means anything.
+function is_record(value: unknown): value is Record<string, unknown> {
+	return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+const json_value = { parse_or_undefined, is_record }
+
+export { json_value }

package/scripts/lib/poll.ts

@@ -0,0 +1,57 @@
+// One bounded polling loop and one sleep, in one place.
+//
+// **Three modules had already written the same three-line `sleep`** — `git/git-pr-checks.ts`,
+// `eval/eval-run.ts` and `propagate/propagate-publish.ts` — and the release command's tag watch
+// (joshuafolkken/kit#1169) would have been the fourth. `CLAUDE.md` → "No clones — single-source"
+// reads an existing duplication as the signal to single-source it rather than as a license to add to
+// it, so the definition moved here and those three import it.
+//
+// **The loop is here for the same reason the sleep is.** A caller that only needs "ask again until
+// this is true, then give up" would otherwise write its own `for` with its own off-by-one; the one
+// existing loop that is *not* folded in is `wait_for_pr_success`, whose body carries the merge
+// gate's stable-read counting and failure classification and is therefore not this shape at all.
+
+async function sleep(duration_ms: number): Promise<void> {
+	await new Promise<void>((resolve) => {
+		setTimeout(resolve, duration_ms)
+	})
+}
+
+interface PollOptions {
+	attempts: number
+	interval_ms: number
+	// Injected by the tests so a poll costs no wall clock. Production callers leave it out.
+	sleeper?: (duration_ms: number) => Promise<void>
+}
+
+// **True as soon as `is_done` answers true, false when the attempts run out.** The first attempt runs
+// before any wait, so a condition already met costs nothing — which is the common case for a tag that
+// was created while the command was doing something else.
+// **The wait goes between attempts, never after the last one**, so the budget a caller computes from
+// `attempts × interval_ms` is the budget it actually spends. The pre-existing merge-gate loop in
+// `git-pr-checks.ts` guards its sleep the same way; extracted here so the loop keeps one branch.
+async function wait_between(
+	wait: (duration_ms: number) => Promise<void>,
+	interval_ms: number,
+	attempt: number,
+	attempts: number,
+): Promise<void> {
+	if (attempt < attempts - 1) await wait(interval_ms)
+}
+
+async function poll_until(is_done: () => Promise<boolean>, options: PollOptions): Promise<boolean> {
+	const wait = options.sleeper ?? sleep
+
+	for (let attempt = 0; attempt < options.attempts; attempt += 1) {
+		if (await is_done()) return true
+
+		await wait_between(wait, options.interval_ms, attempt, options.attempts)
+	}
+
+	return false
+}
+
+const poll = { poll_until, sleep }
+
+export { poll }
+export type { PollOptions }

package/scripts/lib/read-file.ts

@@ -0,0 +1,16 @@
+import { readFileSync } from 'node:fs'
+
+// Several readers treat an absent file as "nothing declared" rather than an error: a project may
+// carry no lockfile yet, and either overrides location may be missing entirely. Empty content is
+// the shared stand-in, so the callers do not each re-implement the try/catch.
+function read_file_or_empty(path: string): string {
+	try {
+		return readFileSync(path, 'utf8')
+	} catch {
+		return ''
+	}
+}
+
+const file_reader = { read_file_or_empty }
+
+export { file_reader }

package/scripts/lib/schemas.ts

@@ -0,0 +1,67 @@
+import { z } from 'zod'
+
+const overrides_snapshot_schema = z.record(z.string(), z.string())
+
+const package_version_schema = z.object({ version: z.string() })
+
+// A package.json identified by both its `name` and `version` — used to confirm a walk-up landed on
+// the intended package root (matching by name) before trusting its version.
+const package_named_version_schema = z.looseObject({ name: z.string(), version: z.string() })
+
+const package_with_version_schema = z.looseObject({ version: z.string() })
+
+// Shape of `pnpm ls -g --json <pkg>`: an array whose first entry lists the matched
+// global dependency under `dependencies[<pkg>].version`. Empty/absent when not installed.
+const ls_global_dependency_schema = z.looseObject({ version: z.string() })
+const ls_global_dependencies_schema = z.record(z.string(), ls_global_dependency_schema).optional()
+const pnpm_ls_global_schema = z.array(
+	z.looseObject({
+		dependencies: ls_global_dependencies_schema,
+	}),
+)
+
+const vscode_settings_schema = z.record(z.string(), z.unknown())
+
+const with_scripts_schema = z.looseObject({
+	scripts: z.record(z.string(), z.string()).optional(),
+})
+
+const with_development_deps_schema = z.looseObject({
+	devDependencies: z.record(z.string(), z.string()).optional(),
+})
+
+const with_package_manager_schema = z.looseObject({
+	packageManager: z.string().optional(),
+})
+
+const with_development_engine_schema = z.looseObject({
+	devEngines: z.record(z.string(), z.unknown()).optional(),
+})
+
+// `bin` in a package manifest is either a single path or a name→path record. Used to locate
+// tsx's CLI entry from its own manifest instead of trusting a generated `.bin` shim.
+const bin_entry_schema = z.union([z.string(), z.record(z.string(), z.string())]).optional()
+const package_bin_schema = z.looseObject({ bin: bin_entry_schema })
+
+const json_object_schema = z.record(z.string(), z.unknown())
+
+const string_array_schema = z.array(z.string())
+
+const string_record_schema = z.record(z.string(), z.string())
+
+export {
+	overrides_snapshot_schema,
+	package_version_schema,
+	package_named_version_schema,
+	package_with_version_schema,
+	package_bin_schema,
+	pnpm_ls_global_schema,
+	vscode_settings_schema,
+	with_scripts_schema,
+	with_development_deps_schema,
+	with_package_manager_schema,
+	with_development_engine_schema,
+	json_object_schema,
+	string_array_schema,
+	string_record_schema,
+}

package/scripts/lib/spawn-exit.ts

@@ -0,0 +1,45 @@
+const SPAWN_ERROR_EXIT_CODE = 2
+const SIGNAL_KILL_EXIT_CODE = 1
+
+interface SpawnResult {
+	exitCode?: number | undefined
+	isTerminated?: boolean
+	shortMessage?: string | undefined
+}
+
+// A numeric exit code — zero or not — means the command ran; return it verbatim.
+// `exitCode: undefined` means it never produced one: either a true spawn failure
+// (the replacement for spawnSync's `result.error`) or a signal kill. Only the
+// former is reported as a spawn error; a signal kill falls back to 1, matching the
+// previous `result.status ?? 1`.
+function resolve_spawn_exit(executable: string, result: SpawnResult): number {
+	if (result.exitCode !== undefined) return result.exitCode
+	if (result.isTerminated === true) return SIGNAL_KILL_EXIT_CODE
+
+	console.error(`Failed to execute ${executable}: ${result.shortMessage ?? 'spawn failed'}`)
+
+	return SPAWN_ERROR_EXIT_CODE
+}
+
+// execa's types declare `stdout` as `string`, but a spawn failure (the executable missing from
+// PATH) leaves it `undefined` at runtime — the same declared-vs-actual gap `resolve_spawn_exit`
+// covers for `exitCode`. Reading it through a signature that admits the real shape keeps the guard
+// honest: a plain `result.stdout ?? ''` is reported as an unnecessary condition against the lying
+// type, and dereferencing it unguarded crashes the caller.
+function read_spawn_stdout(result: { stdout?: string }): string {
+	return result.stdout ?? ''
+}
+
+// Same declared-vs-actual gap as `read_spawn_stdout`, for the stream that carries git's and gh's
+// failure messages.
+function read_spawn_stderr(result: { stderr?: string }): string {
+	return result.stderr ?? ''
+}
+
+export {
+	read_spawn_stderr,
+	read_spawn_stdout,
+	resolve_spawn_exit,
+	SIGNAL_KILL_EXIT_CODE,
+	SPAWN_ERROR_EXIT_CODE,
+}

package/scripts/lib/status-icons.ts

@@ -0,0 +1,24 @@
+// The icons josh prints in front of a result line (joshuafolkken/kit#1361).
+//
+// They were one character each, declared beside whichever command printed them — the verification
+// gate, the health check, the propagation run — and that was harmless while nothing ever *read*
+// them. `time-reported-failure.ts` now does: a josh check that ran inside a pipeline exits with the
+// pipe's status rather than its own, so the only evidence left that it failed is the line it printed.
+// A detector matching a character the emitter is free to change on its own is a detector that goes
+// quiet without failing, so the character is declared once here and both ends import it.
+//
+// **`josh propagate`'s `✓` is still its own.** It opens its success line with `✓` where the gate and
+// the health check use `✔`, and unifying those would change what a command prints in order to tidy a
+// constant — a decision about output, not about single-sourcing.
+//
+// **The success icon is read too since joshuafolkken/kit#1374.** `josh-verdict.ts` reads the gate's
+// `✔ verification gate passed` line to tell a green gate from the third-party warning bodies it
+// forwards, so the pass icon is now under the same rule the failure icon has been under: declared
+// once, imported by the printer and the reader alike.
+
+const FAIL_ICON = '✗'
+const PASS_ICON = '✔'
+
+const status_icons = { FAIL_ICON, PASS_ICON }
+
+export { status_icons }

package/scripts/lines/effective-limit.ts

@@ -0,0 +1,156 @@
+import { createRequire } from 'node:module'
+import path from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { z } from 'zod'
+
+// joshuafolkken/kit#1454: `pnpm josh lines` asked the project's own eslint how many code lines a file
+// has, and then explained that answer against **kit's** `max-lines` entry. In kit the two are the same
+// object, so nothing showed; in a consumer whose `eslint.config.js` overrides the rule after
+// `create_base_config`, the report and the gate described different limits — and the report was the one
+// that was wrong, while `line-budget.ts` opens by declaring that agreeing with the gate is the whole of
+// its purpose.
+//
+// **The limit is therefore asked of the configuration the gate actually applies, per file.** A flat
+// config block can key an override on a `files` pattern, so "the project's limit" is not one number: a
+// consumer that raises `max-lines` for generated code and leaves it alone elsewhere enforces two, and a
+// report that picked either would be wrong about the other set.
+//
+// **The counting options travel with it, and that is not a widening of the subject.** `skipBlankLines`
+// and `skipComments` decide what a code line *is*, and taking them from kit while taking the count from
+// the consumer's eslint is the same defect wearing a different number. Both now come from the same
+// resolved entry, so there is one source rather than two that can disagree.
+//
+// **This is the resolution `eslint --print-config` performs, not a second linter.** `line-budget.ts`
+// refuses eslint's in-process linting API because it counts a file beginning with `#!` one line lower
+// than the CLI does — and that objection is about *counting*, which nothing here does. Keeping the CLI
+// for this would cost one process per path, because `--print-config` takes a single file, and one
+// process per path is the one cost `line-budget.ts` is written to avoid.
+//
+// **The eslint that is loaded is the project's own**, resolved upward from the project root exactly as
+// the CLI shim is — so a consumer's report is calculated by the consumer's eslint against the
+// consumer's config, never by whichever copy happens to sit beside this file.
+
+const ESLINT_MODULE = 'eslint'
+const PACKAGE_JSON = 'package.json'
+const MAX_LINES_RULE = 'max-lines'
+// A rule turned off enforces nothing, so there is no limit to report and no headroom to subtract from.
+// Both spellings occur: `calculateConfigForFile` normalizes severity to a number, but a config read by
+// some other route can still carry the word.
+const SEVERITY_OFF = 0
+const SEVERITY_OFF_NAME = 'off'
+
+interface ConfigResolver {
+	calculateConfigForFile: (file_path: string) => Promise<unknown>
+}
+
+type ResolverConstructor = new (options: { cwd: string }) => ConfigResolver
+
+// The module is imported from a path computed at runtime, so its shape is checked rather than assumed:
+// a build that no longer exports `ESLint` must answer "no limit" instead of throwing past the caller.
+const module_schema = z.object({
+	ESLint: z.custom<ResolverConstructor>((value) => typeof value === 'function'),
+})
+
+// Exactly the object `line-budget.ts` hands back to eslint as `--rule`, `max` apart. Read through a
+// schema for the same reason the probe's own entry is: the options are forwarded to eslint, so a shape
+// that drifted would otherwise arrive at the probe as a silently different counting method.
+const options_schema = z.looseObject({ max: z.number().int().positive() })
+// **The rule takes a bare integer too, and refusing that spelling is the same defect wearing a third
+// face.** eslint's own schema for `max-lines` is `oneOf: [integer, object]`, so a consumer may write
+// `['error', 200]`; and because the rule declares `defaultOptions: [300]`, a bare `'max-lines': 'error'`
+// resolves to `[2, 300]` before it reaches here — eslint fills its own default in, which is why no
+// number is written into this file. Read only the object form and both of those report "no limit" for a
+// file the gate fails at 200 or 301 lines.
+const max_schema = z.number().int().positive()
+const severity_schema = z.union([z.number(), z.string()])
+const entry_schema = z.tuple([severity_schema, z.union([max_schema, options_schema])])
+const config_schema = z.object({ rules: z.record(z.string(), z.unknown()).optional() })
+
+// The integer spelling carries no skip options, and `max-lines` reads them as `option && option.skip…`
+// — so it counts every physical line. Filling in kit's `skipBlankLines` / `skipComments` here instead
+// would forward this package's counting method to a project that asked for none of it.
+const INTEGER_SKIPS = { skipBlankLines: false, skipComments: false }
+
+type LineRuleOptions = z.infer<typeof options_schema>
+type LimitEntry = [string, LineRuleOptions]
+
+function is_off(severity: number | string): boolean {
+	return severity === SEVERITY_OFF || severity === SEVERITY_OFF_NAME
+}
+
+function normalized(option: number | LineRuleOptions): LineRuleOptions {
+	return typeof option === 'number' ? { max: option, ...INTEGER_SKIPS } : option
+}
+
+// A configuration that names no `max-lines`, one that names it with no options, and one that turns it
+// off are all the same answer here — this project enforces no line limit on this path — and the caller
+// reports the count without a budget rather than inventing a number to subtract it from.
+function options_in(config: unknown): LineRuleOptions | undefined {
+	const rules = config_schema.safeParse(config).data?.rules ?? {}
+	const entry = entry_schema.safeParse(rules[MAX_LINES_RULE])
+
+	if (!entry.success) return undefined
+
+	const [severity, option] = entry.data
+
+	return is_off(severity) ? undefined : normalized(option)
+}
+
+// Resolved from the project root rather than from this file, so a consumer's config is calculated by
+// the consumer's own eslint. Every failure — no eslint there, a build without the export, a config that
+// throws while loading — is the same answer, and it is "no limit" rather than kit's number: falling
+// back to kit's is precisely the defect this file exists to remove, and it would be silent.
+async function resolver_for(project_root: string): Promise<ConfigResolver | undefined> {
+	try {
+		const require_from = createRequire(path.join(project_root, PACKAGE_JSON))
+		const loaded: unknown = await import(pathToFileURL(require_from.resolve(ESLINT_MODULE)).href)
+		const eslint_module = module_schema.parse(loaded)
+
+		return new eslint_module.ESLint({ cwd: project_root })
+	} catch {
+		return undefined
+	}
+}
+
+async function entry_for(
+	resolver: ConfigResolver,
+	file_path: string,
+): Promise<LimitEntry | undefined> {
+	try {
+		const options = options_in(await resolver.calculateConfigForFile(file_path))
+
+		return options === undefined ? undefined : [path.resolve(file_path), options]
+	} catch {
+		return undefined
+	}
+}
+
+// One resolver for the whole call: the configuration is loaded and cached once, and every path after
+// the first is a lookup rather than a load. That is what makes a per-file limit affordable at all.
+// Keyed by the absolute path, so the caller's spelling of a path does not have to match.
+async function options_for(
+	file_paths: ReadonlyArray<string>,
+	project_root: string,
+): Promise<ReadonlyMap<string, LineRuleOptions>> {
+	const found = new Map<string, LineRuleOptions>()
+	const resolver = file_paths.length === 0 ? undefined : await resolver_for(project_root)
+
+	if (resolver === undefined) return found
+
+	const entries = await Promise.all(
+		file_paths.map(async (file_path) => await entry_for(resolver, file_path)),
+	)
+	const resolved = entries.filter((entry) => entry !== undefined)
+
+	for (const [file_path, options] of resolved) found.set(file_path, options)
+
+	return found
+}
+
+const effective_limit = {
+	options_for,
+	options_in,
+}
+
+export { effective_limit }
+export type { LineRuleOptions }