@lanelint/plugin-boundaries 0.0.0-stage → 0.0.2

package/dist/index.mjs

@@ -0,0 +1,795 @@
+import { AstUtil, GlobUtil, definePlugin, defineRule } from "@lanelint/core";
+import { toStandardJsonSchema } from "@valibot/to-json-schema";
+import * as v from "valibot";
+//#region src/utils/edgeUtil.ts
+const VALID_PACKAGE = /^(?:@[a-z0-9~][\w.~-]*\/)?[a-z0-9~][\w.~-]*$/i;
+const isBare = (specifier) => !specifier.startsWith(".") && !specifier.startsWith("/") && !specifier.startsWith("#") && !/^[A-Za-z]:[\\/]/.test(specifier);
+/** The npm package name of a bare specifier, or `undefined` for relative paths and aliases. */
+const packageNameOf = (specifier) => {
+	if (!isBare(specifier)) return;
+	const parts = specifier.split("/");
+	const name = specifier.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+	return name && VALID_PACKAGE.test(name) ? name : void 0;
+};
+/** The internal file an edge points to, if any. */
+const internalTarget = (edge) => edge.target.type === "internal" ? edge.target.file : void 0;
+/** Skips edges from test files and type-only edges unless the options include them. */
+const skip = (edge, options) => edge.from.isTest && !options.includeTests || edge.typeOnly && !!options.ignoreTypeImports;
+/** `the feature src/features/a`, or the file path for files outside elements. */
+/** How a file is named in a message: its element, or its path. `start` begins a sentence. */
+const nameOf = (file, start = false) => file.element ? `${start ? "The" : "the"} ${file.element.type} ${file.element.root}` : file.path;
+const EdgeUtil = {
+	internalTarget,
+	isBare,
+	nameOf,
+	packageNameOf,
+	skip
+};
+//#endregion
+//#region src/models/optionSchemas.ts
+const SelectorSchema = v.pipe(v.union([v.pipe(v.string(), v.minLength(1)), v.pipe(v.strictObject({
+	type: v.optional(v.pipe(v.string(), v.description("Element type."))),
+	captures: v.optional(v.pipe(v.record(v.string(), v.union([v.string(), v.array(v.string())])), v.description("Allowed values per capture of the element pattern, such as `{ name: \"auth\" }`."))),
+	files: v.optional(v.pipe(v.union([v.string(), v.array(v.string())]), v.description("Globs matched against file paths.")))
+}), v.check((selector) => !!(selector.type || selector.captures || selector.files), "A selector needs type, captures, or files."))]), v.title("Selector"), v.description("An element type, or an object that matches elements by type and captures, or files by glob. All given fields must match."));
+/** One selector or a list, normalized to a list. Arrays are tried first, since objects accept them. */
+const SelectorListSchema = v.pipe(v.union([v.array(SelectorSchema), SelectorSchema]), v.transform((value) => Array.isArray(value) ? value : [value]));
+const GlobListSchema = v.pipe(v.union([v.string(), v.array(v.string())]), v.transform((value) => typeof value === "string" ? [value] : value));
+const MessageSchema = v.pipe(v.string(), v.description("Replaces the finding message, for example to explain the rule."));
+const ReasonSchema = v.pipe(v.string(), v.description("Added to the finding message, for example the reason for the restriction."));
+const HintSchema = v.pipe(v.string(), v.description("Shown under the finding as the next step."));
+const IncludeTestsSchema = v.optional(v.pipe(v.boolean(), v.description("Also check imports from test files.")), false);
+const IgnoreTypeImportsSchema = v.optional(v.pipe(v.boolean(), v.description("Skip imports that only import types.")), false);
+//#endregion
+//#region src/utils/selectorUtil.ts
+const matchesOne = (selector, target) => {
+	if (typeof selector === "string") return target.element?.type === selector;
+	if (selector.type !== void 0 && target.element?.type !== selector.type) return false;
+	for (const [name, allowed] of Object.entries(selector.captures ?? {})) {
+		const value = target.element?.captures[name];
+		if (value === void 0 || !(typeof allowed === "string" ? [allowed] : allowed).includes(value)) return false;
+	}
+	return !selector.files || GlobUtil.matches(target.path, selector.files);
+};
+const matches$1 = (selectors, target) => selectors.some((selector) => matchesOne(selector, target));
+const describeOne = (selector) => {
+	if (typeof selector === "string") return selector;
+	const captures = Object.entries(selector.captures ?? {}).map(([name, value]) => `${name}=${typeof value === "string" ? value : value.join("|")}`);
+	const files = selector.files ? `files ${GlobUtil.toList(selector.files).join(", ")}` : "";
+	return [
+		selector.type ?? "",
+		captures.length ? `(${captures.join(", ")})` : "",
+		files
+	].filter(Boolean).join(" ");
+};
+const describe = (selectors) => {
+	const names = selectors.map(describeOne);
+	return names.length > 1 ? `${names.slice(0, -1).join(", ")} or ${names.at(-1)}` : names[0] ?? "";
+};
+/** Element types referenced by selectors, for config validation. */
+const typesOf = (selectors) => (selectors ?? []).flatMap((selector) => typeof selector === "string" ? [selector] : selector.type ? [selector.type] : []);
+/** True for selectors that match files by glob only, not elements. */
+const isFilesOnly = (selector) => typeof selector !== "string" && !!selector.files && selector.type === void 0 && selector.captures === void 0;
+const SelectorUtil = {
+	describe,
+	isFilesOnly,
+	matches: matches$1,
+	typesOf
+};
+//#endregion
+//#region src/rules/allowedImports.ts
+const RuleSchema = v.object({
+	from: v.pipe(SelectorListSchema, v.description("Files whose imports this rule checks.")),
+	allow: v.optional(v.pipe(SelectorListSchema, v.description("The only targets these files may import, besides their own element."))),
+	disallow: v.optional(v.pipe(SelectorListSchema, v.description("Targets these files must not import."))),
+	message: v.optional(MessageSchema),
+	hint: v.optional(HintSchema)
+});
+const DEFAULT_HINT = "Move the shared code to a place both may import, or invert the dependency.";
+const allowedImports = defineRule({
+	meta: {
+		description: "Controls which elements may import which.",
+		severity: "error",
+		docs: [
+			"Each rule matches the importing file with `from`. A target that matches `disallow` is",
+			"reported. When a matching rule has `allow`, targets that match no `allow` list are reported.",
+			"Otherwise `default` decides: `allow` (the default) or `disallow`. Imports inside one element",
+			"are allowed, except where a `disallow` selector with only `files` matches. Selectors are",
+			"element types, or `{ type, captures, files }`.",
+			"",
+			"To fix a finding, move the shared code to a place both sides may import, or invert the",
+			"dependency so the lower-level code does not know about the higher-level code."
+		].join("\n"),
+		example: ["error", { rules: [{
+			from: "feature",
+			allow: ["common", "shared"]
+		}, {
+			from: "common",
+			disallow: "feature",
+			message: "Common code must not know features.",
+			hint: "Pass what the common code needs in as an argument."
+		}] }]
+	},
+	options: toStandardJsonSchema(v.object({
+		rules: v.pipe(v.array(RuleSchema), v.description("Rules, checked in order.")),
+		default: v.optional(v.pipe(v.picklist(["allow", "disallow"]), v.description("Whether imports between elements that no rule mentions are allowed.")), "allow"),
+		includeTests: IncludeTestsSchema,
+		ignoreTypeImports: IgnoreTypeImportsSchema
+	})),
+	describe: (options) => [...options.rules.flatMap((rule) => {
+		const from = SelectorUtil.describe(rule.from);
+		return [...rule.allow ? [`${from} may import only ${SelectorUtil.describe(rule.allow)}.`] : [], ...rule.disallow ? [`${from} must not import ${SelectorUtil.describe(rule.disallow)}.`] : []];
+	}), ...options.default === "disallow" ? ["Imports between elements that no rule allows are not allowed."] : []],
+	elementTypes: (options) => options.rules.flatMap((rule) => [
+		...SelectorUtil.typesOf(rule.from),
+		...SelectorUtil.typesOf(rule.allow),
+		...SelectorUtil.typesOf(rule.disallow)
+	]),
+	create: (context) => ({ import(edge) {
+		const to = EdgeUtil.internalTarget(edge);
+		const from = edge.from;
+		if (!to || EdgeUtil.skip(edge, context.options)) return;
+		const matching = context.options.rules.filter((rule) => SelectorUtil.matches(rule.from, from));
+		if (from.element?.id === to.element?.id && (from.element || to.element)) {
+			const denied = matching.find((rule) => rule.disallow && SelectorUtil.matches(rule.disallow.filter(SelectorUtil.isFilesOnly), to));
+			if (denied) context.report({
+				at: edge,
+				message: denied.message ?? `${from.path} must not import ${to.path}.`,
+				hint: denied.hint ?? DEFAULT_HINT
+			});
+			return;
+		}
+		const denied = matching.find((rule) => rule.disallow && SelectorUtil.matches(rule.disallow, to));
+		const allowLists = matching.filter((rule) => rule.allow);
+		const allowed = allowLists.some((rule) => rule.allow && SelectorUtil.matches(rule.allow, to));
+		const violation = denied ?? (allowLists.length ? allowed ? void 0 : allowLists[0] : context.options.default === "disallow" && (from.element || to.element) ? {
+			message: void 0,
+			hint: void 0
+		} : void 0);
+		if (violation) context.report({
+			at: edge,
+			message: violation.message ?? `${EdgeUtil.nameOf(from, true)} must not import ${EdgeUtil.nameOf(to)}.`,
+			hint: violation.hint ?? DEFAULT_HINT
+		});
+	} })
+});
+//#endregion
+//#region src/rules/entryOnly.ts
+const entryOnly = defineRule({
+	meta: {
+		description: "Imports from outside an element must target its entry files.",
+		severity: "error",
+		docs: [
+			"An element exposes its public API through its entry files (`entry` in the element",
+			"definition, `index.ts` by default). Code outside the element must not reach into its",
+			"other files, so the element can change its internals freely.",
+			"",
+			"To fix a finding, export what you need from the entry file and import it from there.",
+			"Test files are skipped unless `includeTests` is set."
+		].join("\n"),
+		example: ["error", { elements: ["feature", "common"] }]
+	},
+	options: toStandardJsonSchema(v.object({
+		elements: v.pipe(SelectorListSchema, v.description("Elements that must be imported through their entry files.")),
+		includeTests: IncludeTestsSchema,
+		ignoreTypeImports: IgnoreTypeImportsSchema
+	})),
+	describe: (options) => `Code outside a ${SelectorUtil.describe(options.elements)} element imports it only through its entry files.`,
+	elementTypes: (options) => SelectorUtil.typesOf(options.elements),
+	create: (context) => ({ import(edge) {
+		const to = EdgeUtil.internalTarget(edge);
+		const element = to?.element;
+		if (!to || !element || element.isEntry || edge.from.element?.id === element.id || EdgeUtil.skip(edge, context.options) || !SelectorUtil.matches(context.options.elements, to)) return;
+		const entries = context.project.element(element.id)?.entryFiles.map((file) => file.path);
+		context.report({
+			at: edge,
+			message: `Import ${element.root} through its entry file, not ${to.path}.`,
+			hint: entries?.length ? `Export what you need from ${entries.join(" or ")} and import it from there.` : `${element.root} has no entry file yet. Create one that exports what you need.`
+		});
+	} })
+});
+//#endregion
+//#region src/rules/noCycles.ts
+/** The same cycle has the same signature no matter where it starts. */
+const signatureOf = (ids) => ids.map((_, index) => [...ids.slice(index), ...ids.slice(0, index)].join(" -> ")).sort()[0] ?? "";
+const byLocation = (a, b) => a.from.path.localeCompare(b.from.path) || a.line - b.line;
+const noCycles = defineRule({
+	meta: {
+		description: "Elements must not depend on each other in a cycle.",
+		severity: "error",
+		docs: [
+			"A cycle between elements means none of them can be understood, tested, or moved on its",
+			"own. The finding shows the import that closes the cycle and the other imports in it.",
+			"",
+			"To fix a finding, move the shared code into an element both can depend on, or invert one",
+			"of the dependencies, for example by passing a callback instead of importing."
+		].join("\n"),
+		example: ["error", { ignoreTypeImports: true }]
+	},
+	options: toStandardJsonSchema(v.optional(v.object({
+		elements: v.optional(v.pipe(SelectorListSchema, v.description("Elements to check. Defaults to every element."))),
+		includeTests: IncludeTestsSchema,
+		ignoreTypeImports: IgnoreTypeImportsSchema
+	}), {})),
+	describe: (options) => options.elements ? `${SelectorUtil.describe(options.elements)} elements do not depend on each other in a cycle.` : "Elements do not depend on each other in a cycle.",
+	elementTypes: (options) => SelectorUtil.typesOf(options.elements),
+	create: (context) => ({ async project(project) {
+		const { options } = context;
+		const graph = await project.graph();
+		const pairs = /* @__PURE__ */ new Map();
+		for (const edge of [...graph.edges].sort(byLocation)) {
+			const to = EdgeUtil.internalTarget(edge);
+			const fromId = edge.from.element?.id;
+			const toId = to?.element?.id;
+			if (!to || !fromId || !toId || fromId === toId || EdgeUtil.skip(edge, options) || options.elements && (!SelectorUtil.matches(options.elements, edge.from) || !SelectorUtil.matches(options.elements, to))) continue;
+			const outgoing = pairs.get(fromId) ?? /* @__PURE__ */ new Map();
+			const pair = outgoing.get(toId) ?? {
+				first: edge,
+				scoped: void 0
+			};
+			if (!pair.scoped && context.isInScope(edge)) pair.scoped = edge;
+			outgoing.set(toId, pair);
+			pairs.set(fromId, outgoing);
+		}
+		const pathBack = (start, goal) => {
+			const visited = /* @__PURE__ */ new Set([start]);
+			const queue = [{
+				id: start,
+				path: []
+			}];
+			for (let index = 0; index < queue.length; index++) {
+				const current = queue[index];
+				if (!current) break;
+				for (const [next, pair] of [...pairs.get(current.id) ?? []].sort(([a], [b]) => a.localeCompare(b))) {
+					const path = [...current.path, pair.first];
+					if (next === goal) return path;
+					if (!visited.has(next)) {
+						visited.add(next);
+						queue.push({
+							id: next,
+							path
+						});
+					}
+				}
+			}
+		};
+		const candidates = [...pairs].flatMap(([fromId, outgoing]) => [...outgoing].map(([toId, pair]) => ({
+			fromId,
+			toId,
+			pair
+		}))).sort((a, b) => Number(!a.pair.scoped) - Number(!b.pair.scoped) || a.fromId.localeCompare(b.fromId) || a.toId.localeCompare(b.toId));
+		const reported = /* @__PURE__ */ new Set();
+		for (const { fromId, toId, pair } of candidates) {
+			const back = pathBack(toId, fromId);
+			if (!back) continue;
+			const ids = [
+				fromId,
+				toId,
+				...back.slice(0, -1).map((edge) => EdgeUtil.internalTarget(edge)?.element?.id ?? "")
+			];
+			const signature = signatureOf(ids);
+			if (reported.has(signature)) continue;
+			reported.add(signature);
+			context.report({
+				at: pair.scoped ?? pair.first,
+				message: `Dependency cycle: ${[...ids, fromId].join(" -> ")}.`,
+				hint: "Move the shared code to an element both can depend on, or invert one dependency.",
+				key: signature,
+				related: back
+			});
+		}
+	} })
+});
+//#endregion
+//#region src/rules/noEntryImport.ts
+const noEntryImport = defineRule({
+	meta: {
+		description: "Imports must target the files they need, not entry files.",
+		severity: "error",
+		docs: [
+			"Entry files often load a whole element, including UI and hooks. Some code must import",
+			"the specific files it needs instead: code inside an element importing its own entry",
+			"(`to: \"self\"`), or elements that only need a model or helper from another element.",
+			"",
+			"To fix a finding, import the file that defines what you use."
+		].join("\n"),
+		example: ["error", { rules: [{
+			from: "feature",
+			to: "self"
+		}, {
+			from: "common",
+			to: "common",
+			message: "Import only the files you need."
+		}] }]
+	},
+	options: toStandardJsonSchema(v.object({
+		rules: v.array(v.object({
+			from: v.pipe(SelectorListSchema, v.description("Files whose imports this rule checks.")),
+			to: v.pipe(v.union([v.literal("self"), SelectorListSchema]), v.description("Elements whose entry files must not be imported, or `self` for the element of the importing file.")),
+			message: v.optional(MessageSchema)
+		})),
+		includeTests: IncludeTestsSchema
+	})),
+	describe: (options) => options.rules.map((rule) => rule.to === "self" ? `${SelectorUtil.describe(rule.from)} imports its own files directly, not its own entry file.` : `${SelectorUtil.describe(rule.from)} imports the files it needs from ${SelectorUtil.describe(rule.to)}, not their entry files.`),
+	elementTypes: (options) => options.rules.flatMap((rule) => [...SelectorUtil.typesOf(rule.from), ...rule.to === "self" ? [] : SelectorUtil.typesOf(rule.to)]),
+	create: (context) => ({ import(edge) {
+		const to = EdgeUtil.internalTarget(edge);
+		const element = to?.element;
+		if (!to || !element?.isEntry || EdgeUtil.skip(edge, context.options)) return;
+		const self = edge.from.element?.id === element.id;
+		const rule = context.options.rules.find((candidate) => SelectorUtil.matches(candidate.from, edge.from) && (candidate.to === "self" ? self : !self && SelectorUtil.matches(candidate.to, to)));
+		if (!rule) return;
+		context.report({
+			at: edge,
+			message: rule.message ?? (self ? `Import files of ${element.root} directly, not its own entry file ${to.path}.` : `Import the file you need from ${element.root}, not its entry file ${to.path}.`),
+			hint: "Import the file that defines what you use."
+		});
+	} })
+});
+//#endregion
+//#region src/rules/noOrphans.ts
+const noOrphans = defineRule({
+	meta: {
+		description: "Source files must be imported by non-test code, or be an entry point.",
+		severity: "warn",
+		docs: [
+			"A file that only tests import is usually left over from a refactor. Entry files of elements,",
+			"test files, declaration files, config files, and files matching `roots` are entry points",
+			"and are never reported. List other entry points, such as `src/main.ts` or CLI scripts, in",
+			"`roots`.",
+			"",
+			"To fix a finding, delete the file if it is unused, import it where it is needed, or add it",
+			"to `roots` if it is an entry point."
+		].join("\n"),
+		example: ["warn", { roots: ["src/main.ts", "scripts/**"] }]
+	},
+	options: toStandardJsonSchema(v.optional(v.object({ roots: v.optional(v.pipe(v.array(v.string()), v.description("Globs of entry points, such as `src/main.ts`, that nothing imports.")), []) }), {})),
+	create: (context) => ({ async project(project) {
+		const roots = [
+			"**/*.config.*",
+			"**/*.d.ts",
+			"**/*.d.mts",
+			...context.options.roots
+		];
+		const candidates = project.files.filter((file) => file.isSource && !file.isTest && !file.element?.isEntry && !GlobUtil.matches(file.path, roots) && context.isInScope(file));
+		if (!candidates.length) return;
+		const graph = await project.graph();
+		for (const file of candidates) if (!graph.importersOf(file).some((edge) => !edge.from.isTest && edge.from.path !== file.path)) context.report({
+			at: file,
+			message: `Nothing imports ${file.path}.`,
+			hint: "Delete it if it is unused, import it where it is needed, or add it to roots if it is an entry point."
+		});
+	} })
+});
+//#endregion
+//#region src/rules/noUndeclaredDependency.ts
+const typesPackageOf = (name) => `@types/${name.startsWith("@") ? name.slice(1).replace("/", "__") : name}`;
+const declares = (info, name, dev) => name in info.dependencies || name in info.peerDependencies || name in info.optionalDependencies || dev && name in info.devDependencies;
+const noUndeclaredDependency = defineRule({
+	meta: {
+		description: "Imported packages must be declared in the nearest package.json.",
+		severity: "error",
+		docs: [
+			"A package that is imported but not declared works only by accident, through hoisting or",
+			"another package. Imports of workspace packages must be declared too.",
+			"",
+			"devDependencies count for test files and for files matching `allowDev`. These files may",
+			"also use packages declared in the root package.json, where monorepos often keep shared",
+			"dev tools such as a test runner. Type-only imports also accept the matching `@types`",
+			"package.",
+			"",
+			"To fix a finding, add the package to the nearest package.json."
+		].join("\n"),
+		example: ["error", {
+			allowDev: ["**/*.config.*", "scripts/**"],
+			ignore: ["virtual:*"]
+		}]
+	},
+	options: toStandardJsonSchema(v.optional(v.object({
+		allowDev: v.optional(v.pipe(v.array(v.string()), v.description("Globs of files that may import devDependencies, besides test files.")), ["**/*.config.*", "**/scripts/**"]),
+		ignore: v.optional(v.pipe(v.array(v.string()), v.description("Package names or globs that are never reported.")), []),
+		allowRootDev: v.optional(v.pipe(v.boolean(), v.description("Let the files that may use devDependencies also use packages declared in the root package.json.")), true)
+	}), {})),
+	create: (context) => ({ import(edge) {
+		const { target } = edge;
+		if (target.type === "builtin" || target.type === "excluded") return;
+		const name = target.type === "external" ? target.package : EdgeUtil.packageNameOf(edge.specifier);
+		if (!name || GlobUtil.matches(name, context.options.ignore)) return;
+		const info = context.project.packageOf(edge.from);
+		if (!info || info.name === name) return;
+		if (target.type === "internal") {
+			if (!context.project.workspacePackage(name) || context.project.packageOf(target.file)?.directory === info.directory) return;
+		}
+		const dev = edge.from.isTest || GlobUtil.matches(edge.from.path, context.options.allowDev);
+		const root = dev && context.options.allowRootDev && info.directory ? context.project.packageOf("package.json") : void 0;
+		const declared = (manifest) => declares(manifest, name, dev) || edge.typeOnly && declares(manifest, typesPackageOf(name), true);
+		if (declared(info) || root?.directory === "" && declared(root)) return;
+		const manifest = info.directory ? `${info.directory}/package.json` : "package.json";
+		context.report({
+			at: edge,
+			message: `${name} is not declared in ${manifest}.`,
+			hint: `Add ${name} to ${dev ? "dependencies or devDependencies" : "dependencies"} in ${manifest}.`,
+			key: name
+		});
+	} })
+});
+//#endregion
+//#region src/rules/noUnresolved.ts
+const noUnresolved = defineRule({
+	meta: {
+		description: "Imports must resolve to a file or an installed package.",
+		severity: "error",
+		docs: [
+			"An import that cannot be resolved usually points at a moved or deleted file, a typo, or a",
+			"package that is not installed. Resolution follows the nearest tsconfig.json, including",
+			"`paths`. Imports of files excluded from the project are not reported.",
+			"",
+			"To fix a finding, correct the path, or install the missing package."
+		].join("\n"),
+		example: ["error", { ignore: ["virtual:*", "*.svg?react"] }]
+	},
+	options: toStandardJsonSchema(v.optional(v.object({ ignore: v.optional(v.pipe(v.array(v.string()), v.description("Globs of import specifiers that are never reported, such as `virtual:*`.")), []) }), {})),
+	create: (context) => ({ import(edge) {
+		if (edge.target.type !== "unresolved" || GlobUtil.matches(edge.specifier, context.options.ignore)) return;
+		context.report({
+			at: edge,
+			message: `Cannot resolve "${edge.specifier}".`,
+			hint: "Fix the import path, or install the package if it is missing."
+		});
+	} })
+});
+//#endregion
+//#region src/rules/publicApi.ts
+/** Files reachable from an element's entry files through re-exports. */
+const publicFilesOf = async (project, entries) => {
+	const reachable = /* @__PURE__ */ new Set();
+	const queue = [...entries];
+	while (queue.length) {
+		const file = queue.pop();
+		if (!file || reachable.has(file.path)) continue;
+		reachable.add(file.path);
+		for (const edge of await project.importsOf(file)) if (edge.reexport && edge.target.type === "internal") queue.push(edge.target.file);
+	}
+	return reachable;
+};
+const publicApi = defineRule({
+	meta: {
+		description: "Imported files of an element must be reachable from its entry files.",
+		severity: "error",
+		docs: [
+			"Some elements allow imports of individual files, as long as those files are part of the",
+			"public API: reachable from an entry file through re-exports, directly or through other",
+			"barrels. The rule checks files, not individual exported names.",
+			"",
+			"To fix a finding, export the file from the element entry (or a barrel it re-exports), or",
+			"import something that is already public."
+		].join("\n"),
+		example: ["error", {
+			elements: "common",
+			exceptions: [{
+				from: "feature",
+				to: "src/common/*/models/**"
+			}]
+		}]
+	},
+	options: toStandardJsonSchema(v.object({
+		elements: v.pipe(SelectorListSchema, v.description("Elements whose imported files must be part of their public API.")),
+		from: v.optional(v.pipe(SelectorListSchema, v.description("Files whose imports are checked. Defaults to files outside the element."))),
+		exceptions: v.optional(v.pipe(v.array(v.object({
+			from: v.optional(v.pipe(SelectorListSchema, v.description("Importing files. Defaults to any file."))),
+			to: v.pipe(GlobListSchema, v.description("Globs of files that may be imported anyway."))
+		})), v.description("Imports that are allowed even though the file is not public.")), []),
+		includeTests: IncludeTestsSchema
+	})),
+	describe: (options) => `${options.from ? `${SelectorUtil.describe(options.from)} imports files` : "Files"} in a ${SelectorUtil.describe(options.elements)} element ${options.from ? "" : "are imported from outside "}only when its entry files export them.`,
+	elementTypes: (options) => [
+		...SelectorUtil.typesOf(options.elements),
+		...SelectorUtil.typesOf(options.from),
+		...options.exceptions.flatMap((exception) => SelectorUtil.typesOf(exception.from))
+	],
+	create: (context) => {
+		const candidates = [];
+		return {
+			import(edge) {
+				const to = EdgeUtil.internalTarget(edge);
+				const element = to?.element;
+				const { options } = context;
+				if (!to || !element || element.isEntry || edge.from.element?.id === element.id || EdgeUtil.skip(edge, options) || !SelectorUtil.matches(options.elements, to) || options.from && !SelectorUtil.matches(options.from, edge.from) || options.exceptions.some((exception) => (!exception.from || SelectorUtil.matches(exception.from, edge.from)) && GlobUtil.matches(to.path, exception.to))) return;
+				candidates.push(edge);
+			},
+			async project(project) {
+				const publicFiles = /* @__PURE__ */ new Map();
+				for (const edge of candidates) {
+					const to = EdgeUtil.internalTarget(edge);
+					const element = to?.element && project.element(to.element.id);
+					if (!to || !element) continue;
+					let reachable = publicFiles.get(element.id);
+					if (!reachable) {
+						reachable = await publicFilesOf(project, element.entryFiles);
+						publicFiles.set(element.id, reachable);
+					}
+					if (!reachable.has(to.path)) context.report({
+						at: edge,
+						message: `${to.path} is not exported from the entry files of ${element.root}.`,
+						hint: `Export it from ${element.entryFiles.map((file) => file.path).join(" or ") || "an entry file"}, or import something that is.`
+					});
+				}
+			}
+		};
+	}
+});
+//#endregion
+//#region src/rules/restrictedGlobals.ts
+/** Objects whose properties are globals, as in `globalThis.fetch`. */
+const GLOBAL_OBJECTS = /* @__PURE__ */ new Set([
+	"globalThis",
+	"window",
+	"self",
+	"global"
+]);
+/** Subtrees that only describe types and never run. */
+const TYPE_ONLY = /* @__PURE__ */ new Set([
+	"TSTypeAnnotation",
+	"TSTypeAliasDeclaration",
+	"TSInterfaceDeclaration",
+	"TSTypeParameterInstantiation",
+	"TSTypeParameterDeclaration",
+	"TSTypeQuery",
+	"TSDeclareFunction",
+	"TSModuleDeclaration"
+]);
+const RestrictionSchema$1 = v.object({
+	name: v.pipe(v.string(), v.regex(/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)?$/, "Use a name such as fetch or Date.now."), v.description("A global such as `fetch` or `process`, or a member such as `Date.now`.")),
+	from: v.optional(v.pipe(SelectorListSchema, v.description("Files the restriction applies to. Defaults to every file."))),
+	message: v.optional(ReasonSchema),
+	hint: v.optional(HintSchema)
+});
+/** Whether an identifier is read as a value, rather than used as a property name or label. */
+const isReference = (parent, key) => {
+	if (!parent) return true;
+	switch (parent.type) {
+		case "MemberExpression": return key !== "property" || parent.computed;
+		case "Property":
+		case "MethodDefinition":
+		case "PropertyDefinition":
+		case "AccessorProperty": return key !== "key" || parent.computed;
+		case "LabeledStatement":
+		case "BreakStatement":
+		case "ContinueStatement": return false;
+		case "ImportSpecifier":
+		case "ExportSpecifier": return false;
+		default: return true;
+	}
+};
+const restrictedGlobals = defineRule({
+	meta: {
+		description: "Globals, or members of globals, that must not be used.",
+		severity: "error",
+		docs: [
+			"Import rules cannot see globals such as `fetch`, `process`, `Date.now`, or `Math.random`.",
+			"This rule finds them in the code, including `globalThis.fetch`. A name declared in the",
+			"file, for example a parameter called `fetch`, is not the global and is not reported.",
+			"Restrictions can apply to some elements or files only, for example to keep utils pure.",
+			"",
+			"To fix a finding, pass the value in, or move the code to a place where it is allowed."
+		].join("\n"),
+		example: ["error", { globals: [{
+			name: "fetch",
+			from: { files: "**/utils/**" },
+			message: "Utils are pure functions."
+		}, {
+			name: "Date.now",
+			from: { files: "**/utils/**" },
+			hint: "Pass the time in."
+		}] }]
+	},
+	options: toStandardJsonSchema(v.object({ globals: v.pipe(v.array(RestrictionSchema$1), v.description("The restricted globals.")) })),
+	describe: (options) => options.globals.map((restriction) => {
+		const where = restriction.from ? ` in ${SelectorUtil.describe(restriction.from)}` : "";
+		return `Do not use ${restriction.name}${where}.${restriction.message ? ` ${restriction.message}` : ""}`;
+	}),
+	elementTypes: (options) => options.globals.flatMap((restriction) => SelectorUtil.typesOf(restriction.from)),
+	create: (context) => ({ ast(file, ast) {
+		const restrictions = context.options.globals.filter((restriction) => (!restriction.from || SelectorUtil.matches(restriction.from, file)) && ast.text.includes(restriction.name.split(".").at(-1) ?? restriction.name));
+		if (!restrictions.length) return;
+		const byName = new Map(restrictions.map((restriction) => [restriction.name, restriction]));
+		const declared = AstUtil.declaredNames(ast.program);
+		const seen = /* @__PURE__ */ new Map();
+		const report = (name, start) => {
+			const restriction = byName.get(name);
+			if (!restriction || declared.has(name.split(".")[0] ?? name)) return;
+			const occurrence = (seen.get(name) ?? 0) + 1;
+			seen.set(name, occurrence);
+			context.report({
+				at: {
+					path: file.path,
+					line: ast.lineOf(start)
+				},
+				message: `Do not use ${name}.${restriction.message ? ` ${restriction.message}` : ""}`,
+				hint: restriction.hint,
+				key: `${name}#${occurrence}`
+			});
+		};
+		AstUtil.walk(ast.program, (node, parent, key) => {
+			if (TYPE_ONLY.has(node.type)) return false;
+			if (node.type === "Identifier" && isReference(parent, key)) report(node.name, node.start);
+			if (node.type === "MemberExpression" && !node.computed && node.object.type === "Identifier" && node.property.type === "Identifier") {
+				const object = node.object.name;
+				const property = node.property.name;
+				report(GLOBAL_OBJECTS.has(object) ? property : `${object}.${property}`, node.start);
+			}
+		});
+	} })
+});
+//#endregion
+//#region src/rules/restrictedPackages.ts
+const RestrictionSchema = v.object({
+	name: v.pipe(v.string(), v.description("Package name or glob, such as `@mui/material`, `lodash*`, or `node:fs`.")),
+	importNames: v.optional(v.pipe(v.array(v.string()), v.description("Only these imported names are restricted. Defaults to the whole package."))),
+	allowTypeImports: v.optional(v.pipe(v.boolean(), v.description("Allow imports that only import types.")), false),
+	from: v.optional(v.pipe(SelectorListSchema, v.description("Files the restriction applies to. Defaults to every file."))),
+	message: v.optional(ReasonSchema),
+	hint: v.optional(HintSchema)
+});
+const restrictedPackages = defineRule({
+	meta: {
+		description: "Packages, or names from packages, that must not be imported.",
+		severity: "error",
+		docs: [
+			"Restrictions keep code on the libraries the project has chosen, for example the design",
+			"system instead of a component library it wraps, or away from a library being phased out.",
+			"A restriction can cover a whole package, some names from it, or only some elements.",
+			"Node builtins are matched as `node:<name>`, for example to keep `node:fs` out of pure code.",
+			"",
+			"To fix a finding, use the alternative named in the message."
+		].join("\n"),
+		example: ["error", { packages: [{
+			name: "@mui/material",
+			importNames: ["Button"],
+			message: "Use the design system instead.",
+			hint: "Import Button from @acme/design-system."
+		}, {
+			name: "node:{fs,child_process}",
+			from: { files: "**/utils/**" }
+		}] }]
+	},
+	options: toStandardJsonSchema(v.object({ packages: v.pipe(v.array(RestrictionSchema), v.description("The restricted packages.")) })),
+	describe: (options) => options.packages.map((restriction) => {
+		return `Do not import ${restriction.importNames ? `${restriction.importNames.join(", ")} from ${restriction.name}` : restriction.name}${restriction.from ? ` in ${SelectorUtil.describe(restriction.from)}` : ""}.${restriction.message ? ` ${restriction.message}` : ""}`;
+	}),
+	elementTypes: (options) => options.packages.flatMap((restriction) => SelectorUtil.typesOf(restriction.from)),
+	create: (context) => ({ import(edge) {
+		const name = edge.target.type === "builtin" ? `node:${edge.target.module}` : edge.target.type === "external" ? edge.target.package : EdgeUtil.packageNameOf(edge.specifier);
+		if (!name) return;
+		for (const restriction of context.options.packages) {
+			if (restriction.name !== name && !GlobUtil.matches(name, restriction.name)) continue;
+			if (edge.typeOnly && restriction.allowTypeImports || restriction.from && !SelectorUtil.matches(restriction.from, edge.from)) continue;
+			const names = restriction.importNames ? edge.names.filter((imported) => restriction.importNames?.includes(imported)) : [];
+			if (restriction.importNames && !names.length) continue;
+			const what = names.length ? `${names.join(", ")} from ${name}` : name;
+			context.report({
+				at: edge,
+				message: `Do not import ${what}.${restriction.message ? ` ${restriction.message}` : ""}`,
+				hint: restriction.hint,
+				key: `${restriction.name}:${what}`
+			});
+			return;
+		}
+	} })
+});
+//#endregion
+//#region src/utils/exportsUtil.ts
+/** Exports keys with their targets, or `undefined` when the package has no `exports` field. */
+const entriesOf = (exports) => {
+	if (exports === void 0) return;
+	if (exports === null || typeof exports !== "object" || Array.isArray(exports)) return [[".", exports]];
+	const entries = Object.entries(exports);
+	return entries.some(([key]) => key.startsWith(".")) ? entries : [[".", exports]];
+};
+const matches = (key, subpath) => {
+	const star = key.indexOf("*");
+	if (star === -1) return key.endsWith("/") ? subpath.startsWith(key) : key === subpath;
+	const prefix = key.slice(0, star);
+	const suffix = key.slice(star + 1);
+	return subpath.length >= prefix.length + suffix.length && subpath.startsWith(prefix) && subpath.endsWith(suffix);
+};
+/**
+* Whether a package exports a subpath, such as `.` or `./icons`, following Node: exact keys win
+* over patterns, the longest pattern wins, and a `null` target blocks the subpath.
+*/
+const isExported = (exports, subpath) => {
+	const entries = entriesOf(exports);
+	if (!entries) return true;
+	const match = entries.find(([key]) => key === subpath) ?? entries.filter(([key]) => key !== subpath && matches(key, subpath)).sort(([a], [b]) => b.length - a.length)[0];
+	return !!match && match[1] !== null;
+};
+/** Exported subpaths, for messages. */
+const subpathsOf = (exports) => (entriesOf(exports) ?? []).filter(([, target]) => target !== null).map(([key]) => key);
+const ExportsUtil = {
+	isExported,
+	subpathsOf
+};
+//#endregion
+//#region src/rules/workspaceImports.ts
+const MAX_SUBPATHS = 5;
+/** The same package, or one package inside the other. The root package contains nothing. */
+const nested = (a, b) => a === b || !!a && !!b && (a.startsWith(`${b}/`) || b.startsWith(`${a}/`));
+const workspaceImports = defineRule({
+	meta: {
+		description: "Imports of other workspace packages must use the package name and a subpath it exports.",
+		severity: "error",
+		docs: [
+			"A workspace package exposes its public API through its name and the `exports` field of",
+			"its package.json. Code in another package must not reach past it, with a relative path",
+			"into the package or with a subpath that `exports` does not list. A package without",
+			"`exports` exports every subpath, as in Node. A package inside another package may also be",
+			"imported through the outer package. Imports inside one package, between a package and the",
+			"packages nested in it, and of the root package are not checked.",
+			"",
+			"To fix a finding, import the package by its name and an exported subpath, or add the",
+			"subpath to `exports` in the package.json of the imported package.",
+			"Test files are skipped unless `includeTests` is set."
+		].join("\n"),
+		example: ["error", { ignore: ["@acme/legacy-*"] }]
+	},
+	options: toStandardJsonSchema(v.optional(v.object({
+		ignore: v.optional(v.pipe(v.array(v.string()), v.description("Names or globs of packages whose imports are never reported.")), []),
+		includeTests: IncludeTestsSchema
+	}), {})),
+	describe: () => "Other workspace packages are imported by name, through a subpath they export.",
+	create: (context) => ({ import(edge) {
+		const to = EdgeUtil.internalTarget(edge);
+		if (!to || EdgeUtil.skip(edge, context.options)) return;
+		const target = context.project.packageOf(to);
+		if (!target?.name || !target.directory) return;
+		const from = context.project.packageOf(edge.from)?.directory ?? "";
+		if (nested(from, target.directory) || GlobUtil.matches(target.name, context.options.ignore)) return;
+		const name = target.name;
+		const manifest = `${target.directory}/package.json`;
+		const via = context.project.workspacePackage(EdgeUtil.packageNameOf(edge.specifier) ?? "");
+		if (!via?.name || !to.path.startsWith(`${via.directory}/`)) {
+			context.report({
+				at: edge,
+				message: `Import ${name} by its package name, not by the path ${edge.specifier}.`,
+				hint: `Import from "${name}", or a subpath that ${manifest} exports.`
+			});
+			return;
+		}
+		const subpath = `.${edge.specifier.slice(via.name.length)}`;
+		if (ExportsUtil.isExported(via.exports, subpath)) return;
+		const exported = ExportsUtil.subpathsOf(via.exports);
+		const shown = exported.slice(0, MAX_SUBPATHS).join(", ");
+		const viaManifest = `${via.directory}/package.json`;
+		context.report({
+			at: edge,
+			message: `${via.name} does not export ${subpath}.`,
+			hint: exported.length ? `Import from a subpath that ${viaManifest} exports (${shown}${exported.length > MAX_SUBPATHS ? ", …" : ""}), or add ${subpath} to its exports.` : `Add ${subpath} to exports in ${viaManifest}.`
+		});
+	} })
+});
+//#endregion
+//#region src/index.ts
+const boundaries = definePlugin({
+	name: "boundaries",
+	description: "Rules about dependencies between elements and on packages and globals.",
+	rules: {
+		"allowed-imports": allowedImports,
+		"entry-only": entryOnly,
+		"no-cycles": noCycles,
+		"no-entry-import": noEntryImport,
+		"no-orphans": noOrphans,
+		"no-undeclared-dependency": noUndeclaredDependency,
+		"no-unresolved": noUnresolved,
+		"public-api": publicApi,
+		"restricted-globals": restrictedGlobals,
+		"restricted-packages": restrictedPackages,
+		"workspace-imports": workspaceImports
+	},
+	configs: { recommended: { rules: {
+		"boundaries/no-cycles": "error",
+		"boundaries/no-unresolved": "error",
+		"boundaries/no-undeclared-dependency": "error"
+	} } }
+});
+//#endregion
+export { allowedImports, boundaries as default, entryOnly, noCycles, noEntryImport, noOrphans, noUndeclaredDependency, noUnresolved, publicApi, restrictedGlobals, restrictedPackages, workspaceImports };