@krizaka/config 0.9.1 → 0.11.0

package/README.md

@@ -54,6 +54,7 @@ the package.
 | `@krizaka/config/dependency-cruiser` | The shared dependency-cruiser config, generated from the covered-domains map: one `krizaka-first-<domain>` rule per domain (dates, i18n, query, icons, ui), `no-circular`, `not-to-unresolvable`, `not-to-dev-dep`. `.withOptions({ exemptFrom })` for a monorepo whose own packages are the facades. |
 | `@krizaka/config/covered-domains` · `/covered-domains.json` | The covered-domains map (one data file) and its helpers: the message, the patterns, the Markdown table of « Use Krizaka first ». |
 | `krizaka-known-violations` (bin) · `@krizaka/config/known-violations` | The known violations of dependency-cruiser, which only shrink, see below. |
+| `krizaka-server-client-boundary` (bin) · `@krizaka/config/server-client-boundary` | Fails when a server-rendered module imports a function from a `"use client"` `@krizaka/*` module (React #441), see below. |
 | `@krizaka/config/tsconfig/*.json` | `base` (strict, ES2022, bundler resolution), `react-library` (+ DOM, `react-jsx`), `next` (+ the Next plugin, `noEmit`, `incremental`), `react-native` (`jsx: react-native`, `customConditions`; with Expo: `"extends": ["expo/tsconfig.base", "@krizaka/config/tsconfig/react-native.json"]`). |
 | `@krizaka/config/prettier` · `.editorconfig` | The formatting. |
 | `krizaka-ratchet` (bin) | The debt counter, see below. |
@@ -96,6 +97,15 @@ read any file (a Vite/Tauri app has no `"use client"`).
 2. **`krizaka/no-derived-state-in-effect`** — an effect whose only statements are `setX(…)` calls: compute the value
    during render, or reset the component with a `key`.
 
+### Cognitive complexity (Sonar S3776)
+
+On 2026-10-27 every failed quality gate came from Sonar's S3776 (krizaka/.github#319), and only Sonar checked it.
+`krizakaStack()` now carries **`sonarjs/cognitive-complexity` at 15** (`eslint-plugin-sonarjs`; the threshold is never
+raised, the rule never disabled): split the function (early returns, extracted helpers, a lookup table instead of a
+chain of `if`). **Error by default** (`complexity: "error"`); a repository with debt passes `complexity: "warn"` while
+`krizaka-ratchet` (`cognitiveComplexity`) freezes the count of functions over 15 at `--update` time and fails any
+increase. Test files (`*.test.*`, `*.spec.*`, `__tests__/`) are not counted, as Sonar does not scan them.
+
 ### The three stack rules
 
 From [ADR-001](https://github.com/krizaka/krizaka-ui/blob/main/docs/adr/ADR-001-tanstack-under-krizaka-facades.md) — the TanStack engines run headless, behind
@@ -170,6 +180,21 @@ stays only for repositories that have not moved yet.
 `noLocaleTernary({ files, routing })`: `routing` lists the files allowed to compare locales (default: `proxy.ts`,
 `middleware.ts`, `i18n.ts`, `seo.ts`, `app/[locale]/layout.tsx`, `I18nProvider.tsx`).
 
+### Server/client boundary (`krizaka-server-client-boundary`)
+
+A Next.js server module that calls a function exported by a `"use client"` module (`readFilterParams()` of
+`@krizaka/ui/filter-bar`) crashes the page with React error #441. Unit tests ignore the directive and `next build` does not
+see it. Every Next.js App Router app runs the guard in its lint:
+
+```sh
+krizaka-server-client-boundary                 # from the app's folder: reads app/ or src/app/ and the "@/*" alias of tsconfig.json
+krizaka-server-client-boundary --root apps/web --app app --scope @krizaka
+```
+
+It walks the pages, layouts and routes, then every local module they import, and stops at a `"use client"` file. A lowercase
+value import (a function, a hook, a constant) from a client module of the scope is an offence; components and `import type`
+are fine. Render a component, or move the function to a plain module. `checkBoundary()` is also exported for a test.
+
 ### Environment variable names (`krizaka/env-name`)
 
 Environment variables are named by bounded context (krizaka/.github#46): `<CONTEXT>_<THING>` with CONTEXT one of
@@ -213,6 +238,7 @@ npx krizaka-ratchet --json      # in CI: the same check, machine-readable
 | `directTanstackImport` | `from` / `import` / `import(` / `require(` of `"@tanstack/…"` |
 | `localTableOrForm` | `<table`, and `<form` … `</form>` holding more fields than `maxFormFields` (default 1) |
 | `retiredImport` | an import of a dependency listed in `retire` (e.g. `["framer-motion"]`): the way out of a dependency |
+| `cognitiveComplexity` | functions whose `sonarjs/cognitive-complexity` is above 15 (Sonar S3776), counted by running the rule on each source file of `stackGlobs`, tests excluded; the KPI of the cognitive debt, it only goes down |
 | `routeStateSelection` | a Tabs / chip group / choice grid / segmented switch (incl. `RadioGroup.Root variant="segmented"`) / toggle group of a view driven by local state (`value`, `defaultValue`, `onValueChange`) without `routeKey`, and without `// @ephemeral: <reason>`: the URL is the state |
 
 The UI counters scan `app/**/*.tsx`, `components/**/*.tsx` and `src/**/*.tsx` by default (`node_modules`, `dist`,

package/bin/krizaka-ratchet.mjs

@@ -8,7 +8,7 @@ const USAGE = `Usage: krizaka-ratchet [globs…] [--init | --update] [--json] [-
 
 Counts the UI debts — raw palette colours, light: variants, [var(--…)] utilities, className template strings — in the
 source files (default: app/**/*.tsx components/**/*.tsx src/**/*.tsx), and the stack debts — fetch in a client effect,
-data loaded in an effect, state derived in an effect, direct @tanstack/* imports, hand-written tables and forms, imports of the dependencies listed in "retire" — in every
+data loaded in an effect, state derived in an effect, direct @tanstack/* imports, hand-written tables and forms, functions above Sonar's cognitive complexity of 15 (S3776), imports of the dependencies listed in "retire" — in every
 source file of app, components, src, lib, hooks and features; compares them with lint-ratchet.json.
 
   (no flag)  fail (exit 1) when a counter is above its recorded value
@@ -30,6 +30,7 @@ const LABELS = {
   localTableOrForm: "hand-written tables / forms",
   retiredImport: "imports of retired deps",
   routeStateSelection: "selections in local state (not the URL)",
+  cognitiveComplexity: "functions over complexity 15 (S3776)",
 };
 
 let args;

package/bin/krizaka-server-client-boundary.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+// krizaka-server-client-boundary: no server-rendered module calls a function exported by a "use client" Krizaka module (React #441).
+import { checkBoundary, DEFAULT_SCOPE } from "../ratchet/server-client-boundary.js";
+
+const USAGE = `Usage: krizaka-server-client-boundary [--root <app folder>] [--app <app router folder>] [--alias <folder of "@/">] [--scope ${DEFAULT_SCOPE}]
+
+Walks what the server renders (pages, layouts, routes and the local modules they import, down to a "use client" file) and fails
+when one imports a function (a lowercase export) from a "use client" module of the scope: the server would call a client
+reference and the page would crash (React error #441). Render a component, or move the function to a plain module.`;
+
+const options = {};
+const args = process.argv.slice(2);
+for (let i = 0; i < args.length; i++) {
+  const arg = args[i];
+  if (arg === "--root") options.root = args[++i];
+  else if (arg === "--app") options.appDir = args[++i];
+  else if (arg === "--alias") options.alias = args[++i];
+  else if (arg === "--scope") options.scope = args[++i];
+  else {
+    console.error(USAGE);
+    process.exit(2);
+  }
+}
+try {
+  const { seen, offences } = checkBoundary(options);
+  if (offences.length === 0) {
+    console.log(`krizaka-server-client-boundary: ${seen.size} server modules checked, no client function called from the server.`);
+  } else {
+    console.error(`krizaka-server-client-boundary: ${offences.length} server module(s) import a function from a "use client" module (React #441):`);
+    for (const line of offences) console.error(`  ${line}`);
+    process.exit(1);
+  }
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(2);
+}

package/eslint/stack.js

@@ -2,8 +2,13 @@
 // @krizaka/ui. The import of TanStack (S11) is a dependency-cruiser rule now, `krizaka-first-query`: one tool, one rule.
 // Warnings: krizaka-ratchet counts the same patterns, so an app adopts them now and brings each count to 0 by the end
 // of its adoption.
+import sonarjs from "eslint-plugin-sonarjs";
+
 import { krizakaPlugin } from "./plugin.js";
 
+/** Sonar S3776 threshold: a function above it is a quality-gate failure. Never raised. */
+export const COGNITIVE_COMPLEXITY_MAX = 15;
+
 /** The rule names, as configured. */
 export const STACK_RULES = Object.freeze([
   "krizaka/no-fetch-in-client-effect",
@@ -12,13 +17,16 @@ export const STACK_RULES = Object.freeze([
   "krizaka/no-local-table-or-form",
   "krizaka/no-family-switcher",
   "krizaka/route-state-selection",
+  "sonarjs/cognitive-complexity",
 ]);
 
 /**
  * Flat config: the stack rules on an app's sources.
- * @param {{ files?: string[], ignores?: string[], severity?: "warn" | "error", effects?: "warn" | "error" | "off", maxFormFields?: number }} [options]
+ * @param {{ files?: string[], ignores?: string[], severity?: "warn" | "error", effects?: "warn" | "error" | "off", complexity?: "warn" | "error", maxFormFields?: number }} [options]
  *   `effects`: severity of the two effect rules (react-effects standard): `"error"` by default; a repository with debt
  *   passes `"warn"` while `krizaka-ratchet` (asyncInEffect, derivedStateInEffect) brings the count to 0.
+ *   `complexity`: severity of `sonarjs/cognitive-complexity` (Sonar S3776, threshold 15): `"error"` by default; a
+ *   repository with debt passes `"warn"` while `krizaka-ratchet` (`cognitiveComplexity`) freezes the count and fails any increase.
  *   `maxFormFields`: a form with at most this many fields is allowed (default 1 — a search box, a newsletter).
  * @returns {import("eslint").Linter.Config[]}
  */
@@ -27,6 +35,7 @@ export function krizakaStack({
   ignores = [],
   severity = "warn",
   effects = "error",
+  complexity = "error",
   maxFormFields = 1,
 } = {}) {
   return [
@@ -34,7 +43,7 @@ export function krizakaStack({
       name: "krizaka/stack",
       files,
       ...(ignores.length > 0 ? { ignores } : {}),
-      plugins: { krizaka: krizakaPlugin },
+      plugins: { krizaka: krizakaPlugin, sonarjs },
       rules: {
         "krizaka/no-fetch-in-client-effect": severity,
         // useEffect is for the outside world: data is useQuery/useMutation, derived state is computed in render.
@@ -45,6 +54,8 @@ export function krizakaStack({
         "krizaka/no-family-switcher": "error",
         // A selection of a view (tabs, segmented, toggles, chip groups) lives in the URL, not in local state.
         "krizaka/route-state-selection": severity,
+        // Sonar S3776 at lint time (krizaka/.github#319): split the function, never raise the threshold.
+        "sonarjs/cognitive-complexity": [complexity, COGNITIVE_COMPLEXITY_MAX],
       },
     },
   ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@krizaka/config",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "description": "The shared configuration of every Krizaka JavaScript repository: ESLint flat configs (base, Next.js, the four UI rules, the stack rules, no locale ternary), the « Krizaka first » covered-domains map and the dependency-cruiser preset generated from it (refused imports, cycles, unresolvable imports, dev dependencies), tsconfig bases, Prettier, EditorConfig, and the krizaka-ratchet and krizaka-known-violations debt counters.",
   "keywords": [
     "krizaka",
@@ -36,6 +36,7 @@
     "./covered-domains": "./covered-domains.cjs",
     "./covered-domains.json": "./covered-domains.json",
     "./known-violations": "./ratchet/known-violations.js",
+    "./server-client-boundary": "./ratchet/server-client-boundary.js",
     "./patterns": "./patterns.js",
     "./ratchet": "./ratchet/ratchet.js",
     "./prettier": "./prettier.config.js",
@@ -48,7 +49,8 @@
   },
   "bin": {
     "krizaka-ratchet": "./bin/krizaka-ratchet.mjs",
-    "krizaka-known-violations": "./bin/krizaka-known-violations.mjs"
+    "krizaka-known-violations": "./bin/krizaka-known-violations.mjs",
+    "krizaka-server-client-boundary": "./bin/krizaka-server-client-boundary.mjs"
   },
   "files": [
     "bin",
@@ -70,6 +72,7 @@
     "dependency-cruiser": "^18.6.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "eslint-plugin-simple-import-sort": "^14.0.0",
+    "eslint-plugin-sonarjs": "^4.2.2",
     "globals": "^17.13.0",
     "tinyglobby": "^0.2.17",
     "typescript-eslint": "^8.71.1"

package/ratchet/ratchet.js

@@ -2,9 +2,12 @@
 // Same patterns as the ESLint rules (../patterns.js), applied to the source text: the counter sees every
 // occurrence (a class in a `cn()` argument or a constant too), so it can only be stricter than the rule.
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { isAbsolute, relative, resolve } from "node:path";
+import { extname, isAbsolute, relative, resolve } from "node:path";
 
+import { Linter } from "eslint";
+import sonarjs from "eslint-plugin-sonarjs";
 import { glob } from "tinyglobby";
+import tseslint from "typescript-eslint";
 
 import {
   ARBITRARY_VAR_SOURCE,
@@ -34,7 +37,7 @@ export const DEFAULT_STACK_GLOBS = Object.freeze(
 const IGNORE = ["**/node_modules/**", "**/dist/**", "**/.next/**", "**/storybook-static/**", "**/coverage/**"];
 
 /** @typedef {"palette" | "light" | "arbitraryVar" | "classNameTemplate"} UiCounterName */
-/** @typedef {"fetchInClientEffect" | "asyncInEffect" | "derivedStateInEffect" | "directTanstackImport" | "localTableOrForm" | "retiredImport" | "routeStateSelection"} StackCounterName */
+/** @typedef {"fetchInClientEffect" | "asyncInEffect" | "derivedStateInEffect" | "directTanstackImport" | "localTableOrForm" | "retiredImport" | "routeStateSelection" | "cognitiveComplexity"} StackCounterName */
 /** @typedef {UiCounterName | StackCounterName} CounterName */
 /** @typedef {Record<CounterName, number>} Counters */
 /**
@@ -58,9 +61,13 @@ export const STACK_COUNTERS = /** @type {const} */ ([
   "localTableOrForm",
   "retiredImport",
   "routeStateSelection",
+  "cognitiveComplexity",
 ]);
 /** Every counter, in report order. */
 export const COUNTERS = /** @type {const} */ ([...UI_COUNTERS, ...STACK_COUNTERS]);
+/** Sonar S3776's threshold (same value as eslint/stack.js COGNITIVE_COMPLEXITY_MAX). Never raised. */
+const COMPLEXITY_MAX = 15;
+const TEST_FILE = /(\.(test|spec)\.[cm]?[jt]sx?$)|(\/__tests__\/)/;
 const zero = () => /** @type {Counters} */ (Object.fromEntries(COUNTERS.map((name) => [name, 0])));
 
 /**
@@ -95,7 +102,7 @@ export function countSource(source, allow = []) {
  * `@tanstack/*`, hand-written tables and forms of more than `maxFormFields` fields, imports of the retired dependencies.
  * @param {string} source
  * @param {{ retire?: readonly string[], maxFormFields?: number }} [options]
- * @returns {Record<StackCounterName, number>}
+ * @returns {Record<Exclude<StackCounterName, "cognitiveComplexity">, number>} (cognitiveComplexity: countCognitiveComplexity, it needs the file name)
  */
 export function countStackSource(source, { retire = [], maxFormFields = 1 } = {}) {
   let fetchInClientEffect = 0;
@@ -133,6 +140,32 @@ export function countStackSource(source, { retire = [], maxFormFields = 1 } = {}
   };
 }
 
+/**
+ * Counts the functions above Sonar's cognitive-complexity threshold (S3776) in one source text, with the same
+ * `sonarjs/cognitive-complexity` rule the ESLint preset uses. A file that does not parse counts for 0 (ESLint reports it).
+ * @param {string} source
+ * @param {string} [filename]
+ * @returns {number}
+ */
+export function countCognitiveComplexity(source, filename = "file.tsx") {
+  const messages = complexityLinter().verify(source, COMPLEXITY_CONFIG, { filename: `file${extname(filename)}` });
+  return messages.filter((/** @type {{ ruleId: string | null }} */ m) => m.ruleId === "sonarjs/cognitive-complexity").length;
+}
+
+/** One Linter for the whole run: building it (and the parser) per file made the CLI 10x slower in CI. */
+/** @type {Linter | undefined} */
+let sharedLinter;
+const complexityLinter = () => (sharedLinter ??= new Linter());
+/** @type {any} */
+const COMPLEXITY_CONFIG = [
+  {
+    files: ["**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}"],
+    languageOptions: { parser: /** @type {any} */ (tseslint.parser) },
+    plugins: { sonarjs },
+    rules: { "sonarjs/cognitive-complexity": ["error", COMPLEXITY_MAX] },
+  },
+];
+
 /**
  * Counts the debts under `root`: the UI counters in the files of `globs`, the stack counters in those of `stackGlobs`.
  * @param {{ root: string, globs?: readonly string[], stackGlobs?: readonly string[], allow?: string[],
@@ -155,8 +188,10 @@ export async function countRepository({
     for (const name of UI_COUNTERS) counters[name] += found[name];
   }
   for (const file of stackFiles) {
-    const found = countStackSource(readFileSync(file, "utf8"), { retire, maxFormFields });
-    for (const name of STACK_COUNTERS) counters[name] += found[name];
+    const found = /** @type {Partial<Counters>} */ (countStackSource(readFileSync(file, "utf8"), { retire, maxFormFields }));
+    for (const name of STACK_COUNTERS) counters[name] += found[name] ?? 0;
+    // Sonar scans the product code, not its tests
+    if (!TEST_FILE.test(file)) counters.cognitiveComplexity += countCognitiveComplexity(readFileSync(file, "utf8"), file);
   }
   return { counters, files: files.length, stackFiles: stackFiles.length };
 }

package/ratchet/server-client-boundary.js

@@ -0,0 +1,187 @@
+// The server/client boundary of a Next.js app (App Router): a module the server renders must not call a function that a
+// `"use client"` module of a Krizaka package exports. Next replaces such an export with a client reference, and calling it on the
+// server crashes the page with React error #441 ("Attempted to call readFilterParams() from the server"). Unit tests never see
+// it (vitest ignores the directive) and `next build` does not either, so this walks what the server renders: the pages, layouts
+// and routes, then every local module they import, stopping at a `"use client"` file.
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+
+export const DEFAULT_SCOPE = "@krizaka";
+const ENTRY = /(?:^|[\\/])(?:page|layout|route|error|global-error|loading|not-found|default|template)\.(?:ts|tsx|js|jsx|mjs)$/;
+// `import … from "x"` / `export … from "x"`: the clause is everything up to the first quote (no nested quantifier: linear).
+const STATEMENT = /(?:^|\n)[ \t]*(import|export)\b([^"';]*)["']([^"']+)["']/g;
+const EXTENSIONS = ["", ".ts", ".tsx", ".js", ".jsx", ".mjs"];
+
+/** @param {string} dir @returns {string[]} */
+const walk = (dir) =>
+  readdirSync(dir).flatMap((name) => {
+    const path = join(dir, name);
+    if (name === "node_modules" || name === ".next") return [];
+    return statSync(path).isDirectory() ? walk(path) : [path];
+  });
+
+/** @param {string} path */
+/** Does the module start with the `"use client"` directive (comments and blank lines may come first)? Scanned, not matched: linear. @param {string} source */
+export const isClientSource = (source) => {
+  let i = 0;
+  for (;;) {
+    while (i < source.length && /\s/.test(source[i])) i++;
+    if (source.startsWith("/*", i)) {
+      const end = source.indexOf("*/", i + 2);
+      if (end < 0) return false;
+      i = end + 2;
+    } else if (source.startsWith("//", i)) {
+      const end = source.indexOf("\n", i);
+      if (end < 0) return false;
+      i = end + 1;
+    } else break;
+  }
+  const quote = source[i];
+  return (quote === '"' || quote === "'") && source.startsWith("use client", i + 1) && source[i + 11] === quote;
+};
+
+/** @param {string} path */
+const isFile = (path) => existsSync(path) && statSync(path).isFile();
+
+/** The `"@/*"` alias of tsconfig.json (read as text: comments and trailing commas are fine); `@/` means the root when there is none. */
+/** @param {string} root */
+export const readAlias = (root) => {
+  try {
+    const text = readFileSync(join(root, "tsconfig.json"), "utf8");
+    const key = text.indexOf('"@/*"');
+    const open = key < 0 ? -1 : text.indexOf('"', text.indexOf("[", key) + 1);
+    const target = open < 0 ? "" : text.slice(open + 1, text.indexOf('"', open + 1));
+    if (target) return target.replace(/\/?\*$/, "") || ".";
+  } catch {
+    // no tsconfig, or one we cannot read: the default stands
+  }
+  return ".";
+};
+
+/** The first folder of `candidates` that exists under root. */
+/** @param {string} root */
+const findApp = (root) => ["app", "src/app"].map((d) => join(root, d)).find((d) => existsSync(d));
+
+/** @param {string} root @param {string} aliasDir @param {string} from @param {string} spec @returns {string | null} */
+const resolveLocal = (root, aliasDir, from, spec) => {
+  let base = null;
+  if (spec.startsWith("@/")) base = join(root, aliasDir, spec.slice(2));
+  else if (spec.startsWith(".")) base = resolve(dirname(from), spec);
+  if (!base) return null;
+  for (const ext of EXTENSIONS) if (isFile(base + ext)) return base + ext;
+  for (const index of ["index.ts", "index.tsx", "index.js"]) if (isFile(join(base, index))) return join(base, index);
+  return null;
+};
+
+/** @param {string} from @param {string} scope @param {string} name @returns {string | null} */
+const findPackageDir = (from, scope, name) => {
+  for (let dir = from; ; dir = dirname(dir)) {
+    const candidate = join(dir, "node_modules", scope, name);
+    if (existsSync(candidate)) return candidate;
+    if (dirname(dir) === dir) return null;
+  }
+};
+
+/** @param {unknown} target @returns {string | null} */
+const pick = (target) => {
+  if (typeof target === "string") return target;
+  if (!target || typeof target !== "object") return null;
+  for (const key of ["import", "module", "default", "node", "require"]) {
+    const found = pick(/** @type {Record<string, unknown>} */ (target)[key]);
+    if (found) return found;
+  }
+  return null;
+};
+
+/** Is the module `spec` of a package a `"use client"` module? Reads the first line of the built entry its `exports` names. */
+/** @param {string} root @param {string} spec */
+export const packageIsClient = (root, spec) => {
+  const [scope, name, ...rest] = spec.split("/");
+  const dir = findPackageDir(root, scope, name);
+  if (!dir) return false;
+  let file;
+  try {
+    const manifest = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+    const key = rest.length ? `./${rest.join("/")}` : ".";
+    file = pick(manifest.exports?.[key]) ?? (rest.length ? null : manifest.module ?? manifest.main);
+  } catch {
+    return false;
+  }
+  if (!file) return false;
+  const entry = join(dir, file);
+  return isFile(entry) && isClientSource(readFileSync(entry, "utf8"));
+};
+
+/**
+ * The lowercase (function-like) names a statement's clause brings in as values; a type-only import is erased and harmless.
+ * `clause` is the text between `import`/`export` and the quote of the module, e.g. ` { a, type B } from `.
+ * @param {string} clause
+ * @returns {string[]}
+ */
+export const functionNames = (clause) => {
+  const words = clause.trim().split(/\s+/);
+  if (words.at(-1) === "from") words.pop();
+  const text = words.join(" ");
+  if (text.startsWith("type ") || text.startsWith("type{")) return [];
+  const open = text.indexOf("{");
+  const close = open < 0 ? -1 : text.indexOf("}", open);
+  const names = open < 0 ? [] : bracedNames(text.slice(open + 1, close < 0 ? text.length : close));
+  const head = defaultImportName(open < 0 ? text : `${text.slice(0, open)} ${close < 0 ? "" : text.slice(close + 1)}`);
+  if (head) names.push(head);
+  return names;
+};
+
+/** The function-like names inside the braces of an import clause (`type X` entries are erased). @param {string} braces @returns {string[]} */
+const bracedNames = (braces) =>
+  braces
+    .split(",")
+    .map((part) => part.trim().split(" "))
+    .filter((tokens) => tokens[0] && !(tokens[0] === "type" && tokens.length > 1) && /^[a-z_$]/.test(tokens[0]))
+    .map((tokens) => tokens[0]);
+
+/** The default import of what is left outside the braces, when it is function-like: `import readIt from "@krizaka/x"`. @param {string} rest @returns {string | null} */
+const defaultImportName = (rest) => {
+  const head = rest.replaceAll(",", " ").trim().split(" ")[0] ?? "";
+  return head && !head.startsWith("*") && /^[a-z_$]/.test(head) ? head : null;
+};
+
+/**
+ * Walk what the server renders. `appDirs` defaults to `app` or `src/app`.
+ * Returns the visited files and the offences (`file imports a, b from @krizaka/x ("use client")`).
+ */
+/** @param {{ root?: string, appDir?: string, alias?: string, scope?: string }} [options] @returns {{ seen: Set<string>, offences: string[] }} */
+export const checkBoundary = ({ root = process.cwd(), appDir, alias, scope = DEFAULT_SCOPE } = {}) => {
+  const app = appDir ? resolve(root, appDir) : findApp(root);
+  if (!app) throw new Error(`No app folder under ${root} (looked for app and src/app); pass --app.`);
+  const aliasDir = alias ?? readAlias(root);
+  /** @type {Set<string>} */
+  const seen = new Set();
+  /** @type {string[]} */
+  const offences = [];
+  const clientCache = new Map();
+  /** @param {string} spec */
+  const isClient = (spec) => {
+    if (!clientCache.has(spec)) clientCache.set(spec, packageIsClient(root, spec));
+    return clientCache.get(spec);
+  };
+  /** @param {string} file */
+  const visit = (file) => {
+    if (seen.has(file)) return;
+    seen.add(file);
+    const source = readFileSync(file, "utf8");
+    if (isClientSource(source)) return;
+    for (const match of source.matchAll(STATEMENT)) {
+      const [, , clause, spec] = match;
+      if (!clause.trimEnd().endsWith("from")) continue; // `import "x"`, or a string in some other statement
+      if (spec.startsWith(`${scope}/`)) {
+        const names = functionNames(clause);
+        if (names.length && isClient(spec)) offences.push(`${relative(root, file)} imports ${names.join(", ")} from ${spec} ("use client")`);
+        continue;
+      }
+      const local = resolveLocal(root, aliasDir, file, spec);
+      if (local && /\.(?:ts|tsx|js|jsx|mjs)$/.test(local)) visit(local);
+    }
+  };
+  for (const entry of walk(app).filter((f) => ENTRY.test(f) && !/\.(?:test|spec)\./.test(f))) visit(entry);
+  return { seen, offences };
+};