@krizaka/config 0.9.0 → 0.10.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@krizaka/config",
-  "version": "0.9.0",
-  "description": "The shared configuration of every Krizaka JavaScript repository: ESLint flat configs (base, Next.js, the four UI rules, the three stack rules, no locale ternary), the dependency-cruiser boundary, tsconfig bases, Prettier, EditorConfig, and the krizaka-ratchet debt counter.",
+  "version": "0.10.0",
+  "description": "The shared configuration of every Krizaka JavaScript repository: ESLint flat configs (base, Next.js, the four UI rules, the stack rules, no locale ternary), the « Krizaka first » covered-domains map and the dependency-cruiser preset generated from it (refused imports, cycles, unresolvable imports, dev dependencies), tsconfig bases, Prettier, EditorConfig, and the krizaka-ratchet and krizaka-known-violations debt counters.",
   "keywords": [
     "krizaka",
     "eslint-config",
@@ -10,13 +10,14 @@
     "ratchet",
     "design-system",
     "dependency-cruiser",
-    "tanstack"
+    "tanstack",
+    "krizaka-first"
   ],
-  "homepage": "https://ui.krizaka.com/packages/config",
-  "bugs": "https://github.com/krizaka/krizaka-ui/issues",
+  "homepage": "https://ts.krizaka.com/config",
+  "bugs": "https://github.com/krizaka/krizaka-ts/issues",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/krizaka/krizaka-ui.git",
+    "url": "git+https://github.com/krizaka/krizaka-ts.git",
     "directory": "packages/config"
   },
   "license": "Apache-2.0",
@@ -32,6 +33,10 @@
     "./eslint/env-names": "./eslint/env-names.js",
     "./eslint/plugin": "./eslint/plugin.js",
     "./dependency-cruiser": "./dependency-cruiser.cjs",
+    "./covered-domains": "./covered-domains.cjs",
+    "./covered-domains.json": "./covered-domains.json",
+    "./known-violations": "./ratchet/known-violations.js",
+    "./server-client-boundary": "./ratchet/server-client-boundary.js",
     "./patterns": "./patterns.js",
     "./ratchet": "./ratchet/ratchet.js",
     "./prettier": "./prettier.config.js",
@@ -40,20 +45,22 @@
     "./tsconfig/next.json": "./tsconfig/next.json",
     "./tsconfig/react-native.json": "./tsconfig/react-native.json",
     "./editorconfig": "./.editorconfig",
-    "./package.json": "./package.json",
-    "./conformance/account-baseline": "./conformance/account-baseline.js"
+    "./package.json": "./package.json"
   },
   "bin": {
-    "krizaka-ratchet": "./bin/krizaka-ratchet.mjs"
+    "krizaka-ratchet": "./bin/krizaka-ratchet.mjs",
+    "krizaka-known-violations": "./bin/krizaka-known-violations.mjs",
+    "krizaka-server-client-boundary": "./bin/krizaka-server-client-boundary.mjs"
   },
   "files": [
     "bin",
-    "conformance",
     "eslint",
     "ratchet",
     "tsconfig",
     "patterns.js",
     "dependency-cruiser.cjs",
+    "covered-domains.cjs",
+    "covered-domains.json",
     "prettier.config.js",
     ".editorconfig",
     "README.md",
@@ -61,12 +68,13 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@eslint/js": "^10.0.1",
+    "@eslint/js": "^9.39.0 || ^10.0.0",
+    "dependency-cruiser": "^18.6.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "eslint-plugin-simple-import-sort": "^14.0.0",
     "globals": "^17.13.0",
     "tinyglobby": "^0.2.17",
-    "typescript-eslint": "^8.72.0"
+    "typescript-eslint": "^8.71.1"
   },
   "peerDependencies": {
     "eslint": "^9 || ^10",
@@ -86,15 +94,14 @@
     "@size-limit/file": "^14.2.0",
     "@types/estree": "^1.0.8",
     "@types/node": "^22.15.0",
-    "dependency-cruiser": "^18.7.0",
     "eslint": "^9.39.0",
-    "eslint-config-next": "^16.4.2",
-    "next": "^16.4.2",
-    "prettier": "^3.9.10",
+    "eslint-config-next": "^16.4.0",
+    "next": "^16.4.1",
+    "prettier": "^3.9.9",
     "publint": "^0.3.25",
     "size-limit": "^14.2.0",
     "typescript": "^5.9.0",
-    "vitest": "^5.0.5"
+    "vitest": "^4.1.11"
   },
   "engines": {
     "node": ">=22"
@@ -119,6 +126,7 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "size": "size-limit",
-    "publint": "publint"
+    "publint": "publint",
+    "check": "pnpm run lint && pnpm run test && pnpm run size && pnpm run publint"
   }
 }

package/patterns.js

@@ -245,20 +245,40 @@ export function balancedArguments(source, open) {
   let depth = 0;
   for (let i = open; i < source.length; i += 1) {
     const c = source[i];
-    if (c === '"' || c === "'" || c === "`") {
-      for (i += 1; i < source.length && source[i] !== c; i += 1) if (source[i] === "\\") i += 1;
-    } else if (c === "/" && source[i + 1] === "/") {
-      i = source.indexOf("\n", i);
-      if (i < 0) break;
-    } else if (c === "/" && source[i + 1] === "*") {
-      i = source.indexOf("*/", i + 2) + 1;
-      if (i <= 0) break;
-    } else if (c === "(") depth += 1;
+    const skipped = skipLiteralOrComment(source, i);
+    if (skipped === null) break;
+    if (skipped > i) i = skipped;
+    else if (c === "(") depth += 1;
     else if (c === ")" && --depth === 0) return source.slice(open + 1, i);
   }
   return source.slice(open + 1);
 }
 
+/**
+ * Where a string, template or comment that starts at `i` ends (the index of its last character), `i` itself when none starts
+ * there, null when a line comment or a block comment never ends.
+ * @param {string} source
+ * @param {number} i
+ * @returns {number | null}
+ */
+function skipLiteralOrComment(source, i) {
+  const c = source[i];
+  if (c === '"' || c === "'" || c === "`") {
+    let end = i + 1;
+    while (end < source.length && source[end] !== c) end += source[end] === "\\" ? 2 : 1;
+    return end;
+  }
+  if (c === "/" && source[i + 1] === "/") {
+    const end = source.indexOf("\n", i);
+    return end < 0 ? null : end;
+  }
+  if (c === "/" && source[i + 1] === "*") {
+    const end = source.indexOf("*/", i + 2);
+    return end < 0 ? null : end + 1;
+  }
+  return i;
+}
+
 // ── Selections live in the URL (Oussama, 2026-10-22: « changer les tabs doit changer les routes ») ──────────────────────
 // Read by the ESLint rule krizaka/route-state-selection and by the ratchet.
 
@@ -312,63 +332,3 @@ export function isLocalSelection(tag, before = "") {
   if (new RegExp(EPHEMERAL_SOURCE).test(tag) || new RegExp(EPHEMERAL_SOURCE).test(before)) return false;
   return LOCAL_SELECTION_PROPS.some((prop) => new RegExp(`\\b${prop}\\s*=`).test(tag));
 }
-
-// ── Every page declares its template (Oussama, 2026-10-22: sessions hand-built pages instead of composing Krizaka UI) ──────
-// Read by the ESLint rule krizaka/page-template and by the ratchet.
-
-/** The page templates of @krizaka/ui (ui.krizaka.com/templates): the site's, then the app's; `redirect` is an address kept for old links. */
-export const PAGE_TEMPLATES = Object.freeze([
-  "landing",
-  "product",
-  "how-it-works",
-  "gallery",
-  "docs-hub",
-  "docs-article",
-  "component",
-  "catalogue",
-  "longform",
-  "changelog",
-  "contact",
-  "legal",
-  "status",
-  "error",
-  "pricing",
-  "app-dashboard",
-  "app-list-detail",
-  "app-settings",
-  "app-onboarding",
-  "app-empty-first-run",
-  "app-wizard",
-  "redirect",
-]);
-
-/** The template that is not one: a page that really composes none, with its reason (the declaration `template: custom: a canvas editor`). */
-export const CUSTOM_TEMPLATE = "custom";
-
-/** A page of the Next.js App Router: `app/**\/page.tsx` (or `src/app/…`). */
-export const PAGE_FILE_SOURCE = String.raw`(?:^|[\\/])app[\\/](?:.*[\\/])?page\.[cm]?[jt]sx?$`;
-
-/** The declaration, alone on its line, as a line comment or a block comment (the rule's message shows its form). */
-// The reason never starts with the block comment's `*/`: `/* @template: custom: */` declares no reason.
-export const TEMPLATE_TAG_SOURCE = String.raw`^[ \t]*(?://|/\*+)[ \t]*@template:[ \t]*([a-z][a-z-]*)(?:[ \t]*:[ \t]*((?!\*\/)\S[^\n]*?)?)?[ \t]*(?:\*/)?[ \t]*$`;
-
-/**
- * What is wrong with a page's template declaration, or `null` when it is fine.
- * @param {string} source
- * @returns {{ kind: "missing" } | { kind: "unknown", name: string } | { kind: "reason" } | null}
- */
-export function pageTemplateProblem(source) {
-  const tag = new RegExp(TEMPLATE_TAG_SOURCE, "m").exec(source);
-  if (!tag) return { kind: "missing" };
-  const [, name, reason] = tag;
-  if (name === CUSTOM_TEMPLATE) return reason ? null : { kind: "reason" };
-  return PAGE_TEMPLATES.includes(name) ? null : { kind: "unknown", name };
-}
-
-/**
- * True for the file of a route's page.
- * @param {string} filename
- */
-export function isPageFile(filename) {
-  return new RegExp(PAGE_FILE_SOURCE).test(filename);
-}

package/ratchet/known-violations.js

@@ -0,0 +1,116 @@
+// The known violations of dependency-cruiser, held so that they only shrink (krizaka-ui#612). An app that adopts the
+// import rules late records what it already breaks in `.dependency-cruiser-known-violations.json` (the format of
+// `depcruise-baseline`, read by `depcruise --ignore-known`); this module compares that file with a real run:
+//   - a violation that is not recorded is new: refused (`depcruise --ignore-known` refuses it as well);
+//   - a recorded violation that is gone is a gain: `update` removes it, `check` refuses to leave it recorded, so the
+//     file cannot hide a regression later;
+//   - `update` never adds a line. `init` writes the file once, when it does not exist (the adoption pull request).
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const KNOWN_FILE = ".dependency-cruiser-known-violations.json";
+export const CONFIG_FILE = ".dependency-cruiser.cjs";
+
+/** @typedef {{ type?: string, from: string, to: string, rule: { name: string, severity?: string }, cycle?: { name: string }[] }} Violation */
+
+/** The identity of a violation, as depcruise matches it: the rule, the two ends, and the cycle's modules. @param {Violation} v */
+export const keyOf = (v) => [v.rule.name, v.from, v.to, ...(v.cycle ?? []).map((step) => step.name)].join("\u0000");
+
+/**
+ * Compare the recorded violations with the current ones.
+ * @param {Violation[]} known
+ * @param {Violation[]} current
+ */
+export function compare(known, current) {
+  const knownKeys = new Set(known.map(keyOf));
+  const currentKeys = new Set(current.map(keyOf));
+  return {
+    added: current.filter((v) => !knownKeys.has(keyOf(v))),
+    gone: known.filter((v) => !currentKeys.has(keyOf(v))),
+  };
+}
+
+/** What `update` writes: the recorded violations that still happen. Never a new one. @param {Violation[]} known @param {Violation[]} current */
+export const shrink = (known, current) => known.filter((v) => current.some((c) => keyOf(c) === keyOf(v)));
+
+/** @param {Violation} v */
+const describe = (v) => `${v.rule.name}: ${v.from} -> ${v.to}${v.cycle ? ` (cycle: ${v.cycle.map((step) => step.name).join(" -> ")})` : ""}`;
+
+/**
+ * The app's own dependency-cruiser first (its version is the one `depcruise` runs), then the one this package depends on.
+ * dependency-cruiser is ESM-only and hides its bin from `exports`: walk up `node_modules` from the app, then resolve the entry.
+ * @param {string} cwd
+ */
+function resolveDepcruise(cwd) {
+  const bin = (/** @type {string} */ root) => join(root, "bin", "dependency-cruiser.mjs");
+  for (let dir = resolve(cwd); ; dir = dirname(dir)) {
+    const candidate = bin(join(dir, "node_modules", "dependency-cruiser"));
+    if (existsSync(candidate)) return candidate;
+    if (dirname(dir) === dir) break;
+  }
+  let root = dirname(fileURLToPath(import.meta.resolve("dependency-cruiser")));
+  while (!existsSync(bin(root)) && dirname(root) !== root) root = dirname(root);
+  if (existsSync(bin(root))) return bin(root);
+  throw new Error("dependency-cruiser is not installed here: add it to the devDependencies.");
+}
+
+/**
+ * Run dependency-cruiser without the known file and read every violation (the `baseline` report).
+ * @param {{ cwd: string, config: string, targets: string[] }} options
+ * @returns {Violation[]}
+ */
+export function currentViolations({ cwd, config, targets }) {
+  const bin = resolveDepcruise(cwd);
+  const run = spawnSync(process.execPath, [bin, ...targets, "--config", config, "--output-type", "baseline"], {
+    cwd,
+    encoding: "utf8",
+    maxBuffer: 256 * 1024 * 1024,
+  });
+  try {
+    return JSON.parse(run.stdout);
+  } catch {
+    throw new Error(`dependency-cruiser failed:\n${run.stderr || run.stdout}`);
+  }
+}
+
+/** @param {string} file @returns {Violation[]} */
+const readKnown = (file) => JSON.parse(readFileSync(file, "utf8"));
+/** @param {string} file @param {Violation[]} violations */
+const writeKnown = (file, violations) => writeFileSync(file, `${JSON.stringify(violations, null, 2)}\n`);
+
+/**
+ * `check` | `update` | `init`. Returns the exit code and the lines to print.
+ * @param {"check" | "update" | "init"} command
+ * @param {{ cwd?: string, config?: string, known?: string, targets: string[] }} options
+ * @returns {{ code: number, lines: string[] }}
+ */
+export function runKnownViolations(command, { cwd = process.cwd(), config = CONFIG_FILE, known = KNOWN_FILE, targets }) {
+  const file = resolve(cwd, known);
+  const current = currentViolations({ cwd, config, targets });
+  if (command === "init") {
+    if (existsSync(file)) return { code: 1, lines: [`${known} exists: the baseline is written once. Use "update" to lower it.`] };
+    writeKnown(file, current);
+    return { code: 0, lines: [`${known}: ${current.length} known violations recorded. They only go down.`] };
+  }
+  const recorded = existsSync(file) ? readKnown(file) : [];
+  const { added, gone } = compare(recorded, current);
+  if (command === "update") {
+    writeKnown(file, shrink(recorded, current));
+    const lines = [`${known}: ${recorded.length} -> ${recorded.length - gone.length} known violations.`];
+    if (added.length > 0) {
+      lines.push(`${added.length} new violation(s) are NOT recorded (the baseline never grows). Fix them:`, ...added.map((v) => `  ${describe(v)}`));
+      return { code: 1, lines };
+    }
+    return { code: 0, lines };
+  }
+  const lines = [
+    ...added.map((v) => `new: ${describe(v)}`),
+    ...gone.map((v) => `fixed but still recorded: ${describe(v)}`),
+  ];
+  if (added.length > 0) lines.push("A new violation is never recorded: fix it (missing function? add it to the Krizaka package first).");
+  if (gone.length > 0) lines.push(`Lock the gain: krizaka-known-violations update (${gone.length} fewer).`);
+  if (lines.length === 0) lines.push(`${known}: ${recorded.length} known violations, none new, none fixed.`);
+  return { code: added.length + gone.length > 0 ? 1 : 0, lines };
+}

package/ratchet/ratchet.js

@@ -2,7 +2,7 @@
 // Same patterns as the ESLint rules (../patterns.js), applied to the source text: the counter sees every
 // occurrence (a class in a `cn()` argument or a constant too), so it can only be stricter than the rule.
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { relative, resolve } from "node:path";
+import { isAbsolute, relative, resolve } from "node:path";
 
 import { glob } from "tinyglobby";
 
@@ -16,9 +16,7 @@ import {
   FETCH_CALL_SOURCE,
   importSource,
   isLocalSelection,
-  isPageFile,
   LIGHT_VARIANT_SOURCE,
-  pageTemplateProblem,
   paletteSource,
   selectionTags,
   TABLE_OR_FORM_SOURCE,
@@ -36,7 +34,7 @@ export const DEFAULT_STACK_GLOBS = Object.freeze(
 const IGNORE = ["**/node_modules/**", "**/dist/**", "**/.next/**", "**/storybook-static/**", "**/coverage/**"];
 
 /** @typedef {"palette" | "light" | "arbitraryVar" | "classNameTemplate"} UiCounterName */
-/** @typedef {"fetchInClientEffect" | "asyncInEffect" | "derivedStateInEffect" | "directTanstackImport" | "localTableOrForm" | "retiredImport" | "routeStateSelection" | "pageTemplate"} StackCounterName */
+/** @typedef {"fetchInClientEffect" | "asyncInEffect" | "derivedStateInEffect" | "directTanstackImport" | "localTableOrForm" | "retiredImport" | "routeStateSelection"} StackCounterName */
 /** @typedef {UiCounterName | StackCounterName} CounterName */
 /** @typedef {Record<CounterName, number>} Counters */
 /**
@@ -60,7 +58,6 @@ export const STACK_COUNTERS = /** @type {const} */ ([
   "localTableOrForm",
   "retiredImport",
   "routeStateSelection",
-  "pageTemplate",
 ]);
 /** Every counter, in report order. */
 export const COUNTERS = /** @type {const} */ ([...UI_COUNTERS, ...STACK_COUNTERS]);
@@ -98,7 +95,7 @@ export function countSource(source, allow = []) {
  * `@tanstack/*`, hand-written tables and forms of more than `maxFormFields` fields, imports of the retired dependencies.
  * @param {string} source
  * @param {{ retire?: readonly string[], maxFormFields?: number }} [options]
- * @returns {Record<string, number>}
+ * @returns {Record<StackCounterName, number>}
  */
 export function countStackSource(source, { retire = [], maxFormFields = 1 } = {}) {
   let fetchInClientEffect = 0;
@@ -136,15 +133,6 @@ export function countStackSource(source, { retire = [], maxFormFields = 1 } = {}
   };
 }
 
-/**
- * 1 when `file` is a page of the app router with no valid template declaration, else 0.
- * @param {string} file
- * @param {string} source
- */
-export function countPages(file, source) {
-  return isPageFile(file) && pageTemplateProblem(source) ? 1 : 0;
-}
-
 /**
  * Counts the debts under `root`: the UI counters in the files of `globs`, the stack counters in those of `stackGlobs`.
  * @param {{ root: string, globs?: readonly string[], stackGlobs?: readonly string[], allow?: string[],
@@ -168,8 +156,7 @@ export async function countRepository({
   }
   for (const file of stackFiles) {
     const found = countStackSource(readFileSync(file, "utf8"), { retire, maxFormFields });
-    for (const name of STACK_COUNTERS) counters[name] += found[name] ?? 0;
-    counters.pageTemplate += countPages(file, readFileSync(file, "utf8"));
+    for (const name of STACK_COUNTERS) counters[name] += found[name];
   }
   return { counters, files: files.length, stackFiles: stackFiles.length };
 }
@@ -218,6 +205,25 @@ export class RatchetError extends Error {}
  * @property {boolean} written the ratchet file was created, lowered or completed
  */
 
+/**
+ * Each counter against its recorded value: the report, and the names that went up or down.
+ * @param {Counters} current
+ * @param {Counters} recorded
+ */
+function compareCounters(current, recorded) {
+  /** @type {RatchetResult["counters"]} */
+  const report = /** @type {any} */ ({});
+  /** @type {CounterName[]} */ const increased = [];
+  /** @type {CounterName[]} */ const decreased = [];
+  for (const name of COUNTERS) {
+    const delta = current[name] - recorded[name];
+    report[name] = { recorded: recorded[name], current: current[name], delta };
+    if (delta > 0) increased.push(name);
+    if (delta < 0) decreased.push(name);
+  }
+  return { report, increased, decreased };
+}
+
 /**
  * Runs the ratchet.
  * - `check` (default): fails when a counter is above its recorded value.
@@ -229,6 +235,11 @@ export class RatchetError extends Error {}
  */
 export async function runRatchet({ root, mode = "check", globs, file = RATCHET_FILE }) {
   const path = resolve(root, file);
+  // the ratchet file is read and written: it stays a .json file inside the repository root (no `../`, no absolute path elsewhere)
+  const inside = relative(resolve(root), path);
+  if (!path.endsWith(".json") || inside === "" || inside.startsWith("..") || isAbsolute(inside)) {
+    throw new RatchetError(`${file}: the ratchet file must be a .json file inside ${root}.`);
+  }
   const exists = existsSync(path);
   if (mode === "init" && exists) throw new RatchetError(`${file} already exists: use --update to lower it.`);
   if (mode !== "init" && !exists) throw new RatchetError(`${file} not found in ${root}: run krizaka-ratchet --init first.`);
@@ -250,16 +261,7 @@ export async function runRatchet({ root, mode = "check", globs, file = RATCHET_F
   /** @type {CounterName[]} */ const added = recordedFile ? COUNTERS.filter((n) => recordedFile.counters[n] === undefined) : [];
   const recorded = /** @type {Counters} */ ({ ...current, ...recordedFile?.counters });
 
-  /** @type {RatchetResult["counters"]} */
-  const report = /** @type {any} */ ({});
-  /** @type {CounterName[]} */ const increased = [];
-  /** @type {CounterName[]} */ const decreased = [];
-  for (const name of COUNTERS) {
-    const delta = current[name] - recorded[name];
-    report[name] = { recorded: recorded[name], current: current[name], delta };
-    if (delta > 0) increased.push(name);
-    if (delta < 0) decreased.push(name);
-  }
+  const { report, increased, decreased } = compareCounters(current, recorded);
 
   let written = false;
   if (mode === "init") {

package/ratchet/server-client-boundary.js

@@ -0,0 +1,187 @@
+// The server/client boundary of a Next.js app (App Router): a module the server renders must not call a function that a
+// `"use client"` module of a Krizaka package exports. Next replaces such an export with a client reference, and calling it on the
+// server crashes the page with React error #441 ("Attempted to call readFilterParams() from the server"). Unit tests never see
+// it (vitest ignores the directive) and `next build` does not either, so this walks what the server renders: the pages, layouts
+// and routes, then every local module they import, stopping at a `"use client"` file.
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+
+export const DEFAULT_SCOPE = "@krizaka";
+const ENTRY = /(?:^|[\\/])(?:page|layout|route|error|global-error|loading|not-found|default|template)\.(?:ts|tsx|js|jsx|mjs)$/;
+// `import … from "x"` / `export … from "x"`: the clause is everything up to the first quote (no nested quantifier: linear).
+const STATEMENT = /(?:^|\n)[ \t]*(import|export)\b([^"';]*)["']([^"']+)["']/g;
+const EXTENSIONS = ["", ".ts", ".tsx", ".js", ".jsx", ".mjs"];
+
+/** @param {string} dir @returns {string[]} */
+const walk = (dir) =>
+  readdirSync(dir).flatMap((name) => {
+    const path = join(dir, name);
+    if (name === "node_modules" || name === ".next") return [];
+    return statSync(path).isDirectory() ? walk(path) : [path];
+  });
+
+/** @param {string} path */
+/** Does the module start with the `"use client"` directive (comments and blank lines may come first)? Scanned, not matched: linear. @param {string} source */
+export const isClientSource = (source) => {
+  let i = 0;
+  for (;;) {
+    while (i < source.length && /\s/.test(source[i])) i++;
+    if (source.startsWith("/*", i)) {
+      const end = source.indexOf("*/", i + 2);
+      if (end < 0) return false;
+      i = end + 2;
+    } else if (source.startsWith("//", i)) {
+      const end = source.indexOf("\n", i);
+      if (end < 0) return false;
+      i = end + 1;
+    } else break;
+  }
+  const quote = source[i];
+  return (quote === '"' || quote === "'") && source.startsWith("use client", i + 1) && source[i + 11] === quote;
+};
+
+/** @param {string} path */
+const isFile = (path) => existsSync(path) && statSync(path).isFile();
+
+/** The `"@/*"` alias of tsconfig.json (read as text: comments and trailing commas are fine); `@/` means the root when there is none. */
+/** @param {string} root */
+export const readAlias = (root) => {
+  try {
+    const text = readFileSync(join(root, "tsconfig.json"), "utf8");
+    const key = text.indexOf('"@/*"');
+    const open = key < 0 ? -1 : text.indexOf('"', text.indexOf("[", key) + 1);
+    const target = open < 0 ? "" : text.slice(open + 1, text.indexOf('"', open + 1));
+    if (target) return target.replace(/\/?\*$/, "") || ".";
+  } catch {
+    // no tsconfig, or one we cannot read: the default stands
+  }
+  return ".";
+};
+
+/** The first folder of `candidates` that exists under root. */
+/** @param {string} root */
+const findApp = (root) => ["app", "src/app"].map((d) => join(root, d)).find((d) => existsSync(d));
+
+/** @param {string} root @param {string} aliasDir @param {string} from @param {string} spec @returns {string | null} */
+const resolveLocal = (root, aliasDir, from, spec) => {
+  let base = null;
+  if (spec.startsWith("@/")) base = join(root, aliasDir, spec.slice(2));
+  else if (spec.startsWith(".")) base = resolve(dirname(from), spec);
+  if (!base) return null;
+  for (const ext of EXTENSIONS) if (isFile(base + ext)) return base + ext;
+  for (const index of ["index.ts", "index.tsx", "index.js"]) if (isFile(join(base, index))) return join(base, index);
+  return null;
+};
+
+/** @param {string} from @param {string} scope @param {string} name @returns {string | null} */
+const findPackageDir = (from, scope, name) => {
+  for (let dir = from; ; dir = dirname(dir)) {
+    const candidate = join(dir, "node_modules", scope, name);
+    if (existsSync(candidate)) return candidate;
+    if (dirname(dir) === dir) return null;
+  }
+};
+
+/** @param {unknown} target @returns {string | null} */
+const pick = (target) => {
+  if (typeof target === "string") return target;
+  if (!target || typeof target !== "object") return null;
+  for (const key of ["import", "module", "default", "node", "require"]) {
+    const found = pick(/** @type {Record<string, unknown>} */ (target)[key]);
+    if (found) return found;
+  }
+  return null;
+};
+
+/** Is the module `spec` of a package a `"use client"` module? Reads the first line of the built entry its `exports` names. */
+/** @param {string} root @param {string} spec */
+export const packageIsClient = (root, spec) => {
+  const [scope, name, ...rest] = spec.split("/");
+  const dir = findPackageDir(root, scope, name);
+  if (!dir) return false;
+  let file;
+  try {
+    const manifest = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+    const key = rest.length ? `./${rest.join("/")}` : ".";
+    file = pick(manifest.exports?.[key]) ?? (rest.length ? null : manifest.module ?? manifest.main);
+  } catch {
+    return false;
+  }
+  if (!file) return false;
+  const entry = join(dir, file);
+  return isFile(entry) && isClientSource(readFileSync(entry, "utf8"));
+};
+
+/**
+ * The lowercase (function-like) names a statement's clause brings in as values; a type-only import is erased and harmless.
+ * `clause` is the text between `import`/`export` and the quote of the module, e.g. ` { a, type B } from `.
+ * @param {string} clause
+ * @returns {string[]}
+ */
+export const functionNames = (clause) => {
+  const words = clause.trim().split(/\s+/);
+  if (words.at(-1) === "from") words.pop();
+  const text = words.join(" ");
+  if (text.startsWith("type ") || text.startsWith("type{")) return [];
+  const open = text.indexOf("{");
+  const close = open < 0 ? -1 : text.indexOf("}", open);
+  const names = open < 0 ? [] : bracedNames(text.slice(open + 1, close < 0 ? text.length : close));
+  const head = defaultImportName(open < 0 ? text : `${text.slice(0, open)} ${close < 0 ? "" : text.slice(close + 1)}`);
+  if (head) names.push(head);
+  return names;
+};
+
+/** The function-like names inside the braces of an import clause (`type X` entries are erased). @param {string} braces @returns {string[]} */
+const bracedNames = (braces) =>
+  braces
+    .split(",")
+    .map((part) => part.trim().split(" "))
+    .filter((tokens) => tokens[0] && !(tokens[0] === "type" && tokens.length > 1) && /^[a-z_$]/.test(tokens[0]))
+    .map((tokens) => tokens[0]);
+
+/** The default import of what is left outside the braces, when it is function-like: `import readIt from "@krizaka/x"`. @param {string} rest @returns {string | null} */
+const defaultImportName = (rest) => {
+  const head = rest.replaceAll(",", " ").trim().split(" ")[0] ?? "";
+  return head && !head.startsWith("*") && /^[a-z_$]/.test(head) ? head : null;
+};
+
+/**
+ * Walk what the server renders. `appDirs` defaults to `app` or `src/app`.
+ * Returns the visited files and the offences (`file imports a, b from @krizaka/x ("use client")`).
+ */
+/** @param {{ root?: string, appDir?: string, alias?: string, scope?: string }} [options] @returns {{ seen: Set<string>, offences: string[] }} */
+export const checkBoundary = ({ root = process.cwd(), appDir, alias, scope = DEFAULT_SCOPE } = {}) => {
+  const app = appDir ? resolve(root, appDir) : findApp(root);
+  if (!app) throw new Error(`No app folder under ${root} (looked for app and src/app); pass --app.`);
+  const aliasDir = alias ?? readAlias(root);
+  /** @type {Set<string>} */
+  const seen = new Set();
+  /** @type {string[]} */
+  const offences = [];
+  const clientCache = new Map();
+  /** @param {string} spec */
+  const isClient = (spec) => {
+    if (!clientCache.has(spec)) clientCache.set(spec, packageIsClient(root, spec));
+    return clientCache.get(spec);
+  };
+  /** @param {string} file */
+  const visit = (file) => {
+    if (seen.has(file)) return;
+    seen.add(file);
+    const source = readFileSync(file, "utf8");
+    if (isClientSource(source)) return;
+    for (const match of source.matchAll(STATEMENT)) {
+      const [, , clause, spec] = match;
+      if (!clause.trimEnd().endsWith("from")) continue; // `import "x"`, or a string in some other statement
+      if (spec.startsWith(`${scope}/`)) {
+        const names = functionNames(clause);
+        if (names.length && isClient(spec)) offences.push(`${relative(root, file)} imports ${names.join(", ")} from ${spec} ("use client")`);
+        continue;
+      }
+      const local = resolveLocal(root, aliasDir, file, spec);
+      if (local && /\.(?:ts|tsx|js|jsx|mjs)$/.test(local)) visit(local);
+    }
+  };
+  for (const entry of walk(app).filter((f) => ENTRY.test(f) && !/\.(?:test|spec)\./.test(f))) visit(entry);
+  return { seen, offences };
+};