@shivaedev/quality 0.18.0 → 0.20.0

package/src/imports/browserGlobals.ts

@@ -0,0 +1,142 @@
+import ts from "typescript";
+import type { Finding, SourceFile } from "#rule.ts";
+import { parse } from "#rules/syntax.ts";
+import { browserNames } from "./browserNames.ts";
+
+function checkerOf(source: ts.SourceFile): ts.TypeChecker {
+	const options: ts.CompilerOptions = { allowJs: true, noLib: true, noResolve: true };
+	const host = ts.createCompilerHost(options);
+	host.getSourceFile = (path) => (path === source.fileName ? source : undefined);
+	return ts.createProgram([source.fileName], options, host).getTypeChecker();
+}
+
+function unbound(checker: ts.TypeChecker, node: ts.Identifier): boolean {
+	return (checker.getSymbolAtLocation(node)?.declarations ?? []).length === 0;
+}
+
+function globalThisRoot(expression: ts.Expression, checker: ts.TypeChecker): boolean {
+	let root = expression;
+	while (
+		ts.isParenthesizedExpression(root)
+		|| ts.isAsExpression(root)
+		|| ts.isTypeAssertionExpression(root)
+		|| ts.isNonNullExpression(root)
+		|| ts.isSatisfiesExpression(root)
+	) {
+		root = root.expression;
+	}
+	return ts.isIdentifier(root) && root.text === "globalThis" && unbound(checker, root);
+}
+
+function qualifiedName(node: ts.PropertyAccessExpression | ts.ElementAccessExpression, checker: ts.TypeChecker): string | undefined {
+	const root = node.expression;
+	if (!globalThisRoot(root, checker)) {
+		return undefined;
+	}
+	if (ts.isPropertyAccessExpression(node)) {
+		return node.name.text;
+	}
+	return ts.isStringLiteral(node.argumentExpression) ? node.argumentExpression.text : undefined;
+}
+
+function bindingName(node: ts.Identifier): boolean {
+	const parent = node.parent;
+	return ts.isBindingElement(parent) && (parent.name === node || parent.propertyName === node);
+}
+
+function globalName(node: ts.Node, checker: ts.TypeChecker): string | undefined {
+	if (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) {
+		return qualifiedName(node, checker);
+	}
+	if (!ts.isIdentifier(node)) {
+		return undefined;
+	}
+	const parent = node.parent;
+	if (bindingName(node) || ts.isLabeledStatement(parent) || ts.isBreakStatement(parent) || ts.isContinueStatement(parent)) {
+		return undefined;
+	}
+	if ((ts.isPropertyAccessExpression(parent) && parent.name === node) || (ts.isPropertyAssignment(parent) && parent.name === node)) {
+		return undefined;
+	}
+	if (ts.isShorthandPropertyAssignment(parent)) {
+		return checker.getShorthandAssignmentValueSymbol(parent) === undefined ? node.text : undefined;
+	}
+	return unbound(checker, node) ? node.text : undefined;
+}
+
+function propertyName(node: ts.Node): readonly string[] {
+	if (ts.isComputedPropertyName(node) && ts.isStringLiteral(node.expression)) {
+		return [node.expression.text];
+	}
+	return ts.isIdentifier(node) || ts.isStringLiteral(node) ? [node.text] : [];
+}
+
+function destructuringOf(
+	node: ts.Node,
+): { readonly pattern: ts.ObjectBindingPattern | ts.ObjectLiteralExpression; readonly root: ts.Expression } | undefined {
+	if ((ts.isVariableDeclaration(node) || ts.isParameter(node)) && ts.isObjectBindingPattern(node.name) && node.initializer !== undefined) {
+		return { pattern: node.name, root: node.initializer };
+	}
+	if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.EqualsToken && ts.isObjectLiteralExpression(node.left)) {
+		return { pattern: node.left, root: node.right };
+	}
+	return undefined;
+}
+
+function destructuredNames(node: ts.Node, checker: ts.TypeChecker): readonly string[] {
+	const destructuring = destructuringOf(node);
+	if (destructuring === undefined) {
+		return [];
+	}
+	const { pattern, root } = destructuring;
+	if (!globalThisRoot(root, checker)) {
+		return [];
+	}
+	if (ts.isObjectBindingPattern(pattern)) {
+		return pattern.elements.flatMap((element) => (element.dotDotDotToken === undefined ? propertyName(element.propertyName ?? element.name) : []));
+	}
+	return pattern.properties.flatMap((property) =>
+		ts.isShorthandPropertyAssignment(property) || ts.isPropertyAssignment(property) ? propertyName(property.name) : [],
+	);
+}
+
+function superclassesOf(node: ts.HeritageClause): readonly ts.Expression[] {
+	if (node.token !== ts.SyntaxKind.ExtendsKeyword || !(ts.isClassDeclaration(node.parent) || ts.isClassExpression(node.parent))) {
+		return [];
+	}
+	return node.types.map((base) => base.expression);
+}
+
+export function browserGlobals(file: SourceFile): readonly Finding[] {
+	const parsed = parse(file);
+	if (parsed === undefined) {
+		return [];
+	}
+	const source = parsed;
+	const checker = checkerOf(source);
+	const findings: Finding[] = [];
+	function visit(node: ts.Node): void {
+		if (ts.isHeritageClause(node)) {
+			for (const expression of superclassesOf(node)) {
+				visit(expression);
+			}
+			return;
+		}
+		if (ts.isTypeNode(node) || ts.isImportDeclaration(node) || ts.isExportSpecifier(node)) {
+			return;
+		}
+		const direct = globalName(node, checker);
+		const names = [...destructuredNames(node, checker), ...(direct === undefined ? [] : [direct])];
+		for (const name of names.filter((candidate) => browserNames.has(candidate))) {
+			findings.push({
+				file: file.path,
+				line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+				message: `Shared code uses browser global "${name}". Move browser-dependent code into src/client/ or pass the value into shared code.`,
+				subject: name,
+			});
+		}
+		ts.forEachChild(node, visit);
+	}
+	visit(source);
+	return findings;
+}

package/src/imports/browserNames.ts

@@ -0,0 +1,80 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import ts from "typescript";
+
+const portable = new Set([
+	"AbortController",
+	"AbortSignal",
+	"Blob",
+	"BroadcastChannel",
+	"ByteLengthQueuingStrategy",
+	"CompressionStream",
+	"CountQueuingStrategy",
+	"Crypto",
+	"CryptoKey",
+	"CustomEvent",
+	"DOMException",
+	"DecompressionStream",
+	"Event",
+	"EventTarget",
+	"File",
+	"FormData",
+	"Headers",
+	"MessageChannel",
+	"MessageEvent",
+	"MessagePort",
+	"Performance",
+	"PerformanceEntry",
+	"PerformanceMark",
+	"PerformanceMeasure",
+	"PerformanceObserver",
+	"PerformanceObserverEntryList",
+	"PerformanceResourceTiming",
+	"ReadableByteStreamController",
+	"ReadableStream",
+	"ReadableStreamBYOBReader",
+	"ReadableStreamBYOBRequest",
+	"ReadableStreamDefaultController",
+	"ReadableStreamDefaultReader",
+	"Request",
+	"Response",
+	"SubtleCrypto",
+	"TextDecoder",
+	"TextDecoderStream",
+	"TextEncoder",
+	"TextEncoderStream",
+	"TransformStream",
+	"TransformStreamDefaultController",
+	"URL",
+	"URLPattern",
+	"URLSearchParams",
+	"WebSocket",
+	"WritableStream",
+	"WritableStreamDefaultController",
+	"WritableStreamDefaultWriter",
+	"atob",
+	"btoa",
+	"clearInterval",
+	"clearTimeout",
+	"console",
+	"crypto",
+	"fetch",
+	"performance",
+	"queueMicrotask",
+	"setInterval",
+	"setTimeout",
+	"structuredClone",
+]);
+
+function namesInDom(): readonly string[] {
+	const path = join(dirname(ts.getDefaultLibFilePath({})), "lib.dom.d.ts");
+	const source = ts.createSourceFile(path, readFileSync(path, "utf8"), ts.ScriptTarget.Latest, true);
+	return source.statements.flatMap((statement) => {
+		if (ts.isVariableStatement(statement)) {
+			return statement.declarationList.declarations.flatMap(({ name }) => (ts.isIdentifier(name) ? [name.text] : []));
+		}
+		return ts.isFunctionDeclaration(statement) && statement.name !== undefined ? [statement.name.text] : [];
+	});
+}
+
+export const browserNames: ReadonlySet<string> = new Set(namesInDom().filter((name) => !portable.has(name)));

package/src/imports/fences/check.ts

@@ -0,0 +1,12 @@
+import { importGraph } from "#imports/graph.ts";
+import type { Findings, RuleInputs } from "#rule.ts";
+import { discoverFences } from "./discover.ts";
+import type { Fence } from "./model.ts";
+import { compilePolicy } from "./policy.ts";
+
+export async function checkFences(inputs: RuleInputs, configured: readonly Fence[]): Promise<Findings> {
+	const graph = await importGraph(inputs);
+	const fences = [...configured, ...(await discoverFences(inputs, graph.packages))];
+	const policy = compilePolicy(fences, { files: inputs.files, packages: graph.packages });
+	return policy.flatMap((compiled) => compiled.evaluate(graph));
+}

package/src/imports/fences/declarations.ts

@@ -0,0 +1,38 @@
+import { Schema } from "effect";
+import { decodeWith } from "#decoded.ts";
+import type { Fence, Selector } from "./model.ts";
+
+const SelectorInput: Schema.Codec<Selector> = Schema.suspend(() =>
+	Schema.Union([
+		Schema.Struct({ kind: Schema.Literal("anything") }),
+		Schema.Struct({ kind: Schema.Literal("workspace") }),
+		Schema.Struct({ kind: Schema.Literal("anyOf"), members: Schema.Array(SelectorInput) }),
+		Schema.Struct({ base: SelectorInput, excluded: Schema.Array(SelectorInput), kind: Schema.Literal("except") }),
+		Schema.Struct({ kind: Schema.Literals(["files", "folders"]), paths: Schema.Array(Schema.String) }),
+		Schema.Struct({ kind: Schema.Literals(["modules", "packages", "scopes"]), names: Schema.Array(Schema.String) }),
+	]),
+);
+
+const ExampleStep = Schema.Union([Schema.String, Schema.Struct({ external: Schema.String })]);
+
+const Chain = Schema.TupleWithRest(Schema.Tuple([Schema.String, ExampleStep]), [ExampleStep]);
+
+const FenceInput: Schema.Codec<Fence> = Schema.Struct({
+	_tag: Schema.Literal("Fence"),
+	examples: Schema.Struct({ illegal: Chain, legal: Chain }),
+	from: SelectorInput,
+	name: Schema.String,
+	prohibition: Schema.Union([
+		Schema.Struct({ kind: Schema.Literals(["import", "reach"]), to: SelectorInput }),
+		Schema.Struct({ kind: Schema.Literal("vocabulary"), subjects: Schema.Array(Schema.String), unit: SelectorInput }),
+	]),
+	rationale: Schema.String,
+});
+
+export const Declarations = Schema.Array(FenceInput);
+
+const standard = Schema.toStandardSchemaV1(Declarations, { parseOptions: { errors: "all", onExcessProperty: "error" } });
+
+export function decodeDeclarations(value: unknown) {
+	return decodeWith(standard, value);
+}

package/src/imports/fences/discover.ts

@@ -0,0 +1,37 @@
+import { createHash } from "node:crypto";
+import { posix, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import type { WorkspacePackage } from "#imports/workspace.ts";
+import type { RuleInputs } from "#rule.ts";
+import { decodeDeclarations } from "./declarations.ts";
+import type { Fence } from "./model.ts";
+
+const BOUNDARY_FILE = "quality.fences.config.ts";
+
+async function loadBoundary(inputs: RuleInputs, directory: string): Promise<readonly Fence[]> {
+	const file = posix.join(directory, BOUNDARY_FILE);
+	try {
+		const text = await inputs.readText(file);
+		if (text === undefined) {
+			return [];
+		}
+		const url = pathToFileURL(resolve(inputs.root, file));
+		url.searchParams.set("content", createHash("sha256").update(text).digest("hex"));
+		const loaded: unknown = await import(url.href);
+		if (typeof loaded !== "object" || loaded === null || !("default" in loaded)) {
+			throw new Error("export an array of fence() declarations as the default export");
+		}
+		const decoded = await decodeDeclarations(loaded.default);
+		if (decoded._tag === "Invalid") {
+			throw new Error(`export an array of fence() declarations:\n${decoded.issues.join("\n")}`);
+		}
+		return decoded.value;
+	} catch (cause) {
+		throw new Error(`cannot load boundary at ${file}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+	}
+}
+
+export async function discoverFences(inputs: RuleInputs, packages: readonly WorkspacePackage[]): Promise<readonly Fence[]> {
+	const boundaries = await Promise.all([".", ...packages.map((owner) => owner.directory)].map((directory) => loadBoundary(inputs, directory)));
+	return boundaries.flat();
+}

package/src/imports/graph.ts

@@ -29,7 +29,7 @@ export interface ImportGraph {
 const QUERY = /\?.*$/u;
 
 const NO_MODULES =
-	"the import graph covers no modules: the sources hold no TypeScript or JavaScript module. Point `sources` at the code, or turn the imports rules off.";
+	"the import graph covers no modules: the sources hold no TypeScript or JavaScript module. Point `sources` at the TypeScript or JavaScript code.";
 
 function relativeTarget(from: string, request: ImportRequest): string | undefined {
 	const relative = request.kind === "path-reference" || request.specifier.startsWith("./") || request.specifier.startsWith("../");
@@ -77,7 +77,7 @@ async function build(inputs: RuleInputs): Promise<ImportGraph> {
 
 const graphs = new WeakMap<readonly SourceFile[], Promise<ImportGraph>>();
 
-// The three imports rules run on one scan, so they share the graph built from its sources.
+// Import rules run on one scan, so they share the graph built from its sources.
 export function importGraph(inputs: RuleInputs): Promise<ImportGraph> {
 	const known = graphs.get(inputs.sources) ?? build(inputs);
 	graphs.set(inputs.sources, known);

package/src/imports/isTooling.ts

@@ -0,0 +1,11 @@
+import { posix } from "node:path";
+
+const TOOL_FOLDERS = new Set(["script", "scripts", "tooling"]);
+
+const CONFIG_FILE = /(?:^|\.)config\.[cm]?[jt]sx?$/u;
+
+export function isTooling(directory: string, path: string): boolean {
+	const local = posix.relative(directory, path);
+	const [folder = ""] = local.split("/");
+	return TOOL_FOLDERS.has(folder) || (!local.includes("/") && CONFIG_FILE.test(local));
+}

package/src/imports/projects.ts

@@ -73,8 +73,8 @@ function nearestConfig(root: string, file: string): string | undefined {
 	return undefined;
 }
 
-function memo<Value>(compute: (key: string) => Value): (key: string) => Value {
-	const known = new Map<string, Value>();
+function memo<TValue>(compute: (key: string) => TValue): (key: string) => TValue {
+	const known = new Map<string, TValue>();
 	return (key) => {
 		const value = known.get(key) ?? compute(key);
 		known.set(key, value);

package/src/imports/runtime.ts

@@ -0,0 +1,63 @@
+import { readFileSync, statSync } from "node:fs";
+import { join, posix } from "node:path";
+import type { RuleInputs } from "#rule.ts";
+import { isTooling } from "./isTooling.ts";
+import { packageOf, type WorkspacePackage } from "./workspace.ts";
+
+export type Runtime = "client" | "server" | "shared";
+
+function executablePath(value: unknown): boolean {
+	return typeof value === "string" && value.trim().length > 0;
+}
+
+function hasExecutable(root: string, directory: string): boolean {
+	const path = join(root, directory, "package.json");
+	try {
+		const manifest: unknown = JSON.parse(readFileSync(path, "utf8"));
+		if (typeof manifest !== "object" || manifest === null || Array.isArray(manifest)) {
+			throw new Error("the manifest must be an object");
+		}
+		const bin: unknown = Reflect.get(manifest, "bin");
+		return executablePath(bin) || (typeof bin === "object" && bin !== null && !Array.isArray(bin) && Object.values(bin).some(executablePath));
+	} catch (cause) {
+		if (cause instanceof Error && "code" in cause && cause.code === "ENOENT") {
+			return false;
+		}
+		throw new Error(`cannot read runtime policy at ${path}`, { cause });
+	}
+}
+
+function directoryExists(path: string): boolean {
+	try {
+		return statSync(path).isDirectory();
+	} catch (cause) {
+		if (cause instanceof Error && "code" in cause && (cause.code === "ENOENT" || cause.code === "ENOTDIR")) {
+			return false;
+		}
+		throw cause;
+	}
+}
+
+export function runtimeOf(inputs: RuleInputs, packages: readonly WorkspacePackage[]): (path: string) => Runtime | undefined {
+	const owners = [...packages, { directory: ".", name: "." }];
+	const adopted = new Set(
+		owners
+			.filter((owner) => ["client", "server"].some((folder) => directoryExists(join(inputs.root, owner.directory, "src", folder))))
+			.map((owner) => owner.directory),
+	);
+	const executable = new Set(owners.filter((owner) => hasExecutable(inputs.root, owner.directory)).map((owner) => owner.directory));
+	return (path) => {
+		const owner = packageOf(packages, path)?.directory ?? ".";
+		if (isTooling(owner, path)) {
+			return "server";
+		}
+		if (!adopted.has(owner)) {
+			return executable.has(owner) ? "server" : undefined;
+		}
+		const local = posix.relative(owner, path);
+		if (local.startsWith("src/client/")) {
+			return "client";
+		}
+		return local.startsWith("src/server/") ? "server" : "shared";
+	};
+}

package/src/imports/workspace.ts

@@ -1,4 +1,7 @@
 import { posix } from "node:path";
+import * as NodeFileSystem from "@effect/platform-node/NodeFileSystem";
+import { Effect } from "effect";
+import { manifestsIn } from "#manifests/sorted.ts";
 import type { RuleInputs } from "#rule.ts";
 import { globMatcher } from "./glob.ts";
 import { pnpmWorkspacePatterns } from "./pnpm-workspace.ts";
@@ -8,7 +11,7 @@ export interface WorkspacePackage {
 	readonly name: string;
 }
 
-type Reader = Pick<RuleInputs, "files" | "readText">;
+type Reader = Pick<RuleInputs, "files" | "readText"> & Partial<Pick<RuleInputs, "root">>;
 
 const MANIFEST = "package.json";
 
@@ -60,7 +63,9 @@ async function memberOf(inputs: Reader): Promise<(directory: string) => boolean>
 
 export async function workspacePackages(inputs: Reader): Promise<readonly WorkspacePackage[]> {
 	const member = await memberOf(inputs);
-	const directories = inputs.files
+	const manifests =
+		inputs.root === undefined ? inputs.files : await Effect.runPromise(manifestsIn(inputs.root).pipe(Effect.provide(NodeFileSystem.layer)));
+	const directories = manifests
 		.filter((file) => posix.basename(file) === MANIFEST && file !== MANIFEST)
 		.map((manifest) => posix.dirname(manifest))
 		.filter(member);

package/src/inventory/collect.ts

@@ -46,7 +46,14 @@ export const collectInventory = (root: string, scope: InventoryScope): Effect.Ef
 		const excluded = ignore().add([...scope.exclude]);
 		const zones = yield* Effect.forEach(scope.sources, (zone) => zoneFiles(root, zone), { concurrency: READ_CONCURRENCY });
 		const relativePaths = zones.flat().map((absolute) => posix(relative(root, absolute)));
-		const files = [...new Set(relativePaths)].filter((path) => !excluded.ignores(path)).sort();
+		const files = [...new Set(relativePaths)]
+			.filter((path) => !excluded.ignores(path))
+			.sort((left, right) => {
+				if (left === right) {
+					return 0;
+				}
+				return left < right ? -1 : 1;
+			});
 		const sourcePaths = files.filter((path) => scope.extensions.some((extension) => path.endsWith(extension)));
 		const sources = yield* Effect.forEach(sourcePaths, (path) => readSource(root, path), { concurrency: READ_CONCURRENCY });
 		return { files, sources };

package/src/inventory/trackedPaths.ts

@@ -0,0 +1,28 @@
+import { execFile } from "node:child_process";
+import { join } from "node:path";
+import { promisify } from "node:util";
+
+const run = promisify(execFile);
+
+async function listedPaths(directory: string, options: readonly string[]): Promise<readonly string[]> {
+	try {
+		const { stdout } = await run("git", ["ls-files", "-z", ...options, "--", "."], { cwd: directory, maxBuffer: 2 ** 30 });
+		return stdout
+			.split("\0")
+			.filter(Boolean)
+			.map((path) => join(directory, path));
+	} catch (error) {
+		if (error instanceof Error && "stderr" in error && String(error.stderr).includes("not a git repository")) {
+			return [];
+		}
+		throw error;
+	}
+}
+
+export function trackedPaths(directory: string): Promise<readonly string[]> {
+	return listedPaths(directory, []);
+}
+
+export function ignoredTrackedPaths(directory: string): Promise<readonly string[]> {
+	return listedPaths(directory, ["--cached", "--ignored", "--exclude-standard"]);
+}

package/src/inventory/walk.ts

@@ -1,20 +1,22 @@
-import { join, relative, sep } from "node:path";
+import { dirname, join, relative, sep } from "node:path";
 import { Effect, FileSystem } from "effect";
-import { type FilesystemFailure, orWhenAbsent, readOptionalText } from "./filesystem.ts";
+import { FilesystemFailure, orWhenAbsent, readOptionalText } from "./filesystem.ts";
 import { emptyScope, type IgnoreScope, insideKept, verdictFor, withIgnoreFile } from "./ignore-scope.ts";
+import { trackedPaths } from "./trackedPaths.ts";
 
 const SKIPPED = new Set([".git", "node_modules"]);
 
-export const ignoreScopeAt = (
+export function ignoreScopeAt(
 	dir: string,
 	inherited: IgnoreScope = emptyScope,
-): Effect.Effect<IgnoreScope, FilesystemFailure, FileSystem.FileSystem> =>
-	Effect.map(readOptionalText(join(dir, ".gitignore")), (contents) =>
+): Effect.Effect<IgnoreScope, FilesystemFailure, FileSystem.FileSystem> {
+	return Effect.map(readOptionalText(join(dir, ".gitignore")), (contents) =>
 		contents === undefined || contents === "" ? inherited : withIgnoreFile(inherited, dir, contents),
 	);
+}
 
 // The walk itself never visits the directories between the root and a source, so their ignore files are read here.
-export const scopeAbove = (root: string, dir: string): Effect.Effect<IgnoreScope, FilesystemFailure, FileSystem.FileSystem> => {
+export function scopeAbove(root: string, dir: string): Effect.Effect<IgnoreScope, FilesystemFailure, FileSystem.FileSystem> {
 	const parts = relative(root, dir)
 		.split(sep)
 		.filter((part) => part !== "");
@@ -22,37 +24,64 @@ export const scopeAbove = (root: string, dir: string): Effect.Effect<IgnoreScope
 	return Effect.reduce(
 		ancestors,
 		() => emptyScope,
-		(scope, ancestor) => ignoreScopeAt(ancestor, scope),
+		(scope, ancestor) => (verdictFor(scope, ancestor, true) === "ignored" ? Effect.succeed(scope) : ignoreScopeAt(ancestor, scope)),
 	);
-};
+}
 
-export const walk = (dir: string, inherited: IgnoreScope = emptyScope): Effect.Effect<readonly string[], FilesystemFailure, FileSystem.FileSystem> =>
-	Effect.gen(function* () {
-		const fs = yield* FileSystem.FileSystem;
-		const scope = yield* ignoreScopeAt(dir, inherited);
-		const entries = yield* orWhenAbsent<readonly string[]>(dir, fs.readDirectory(dir), []);
-		const nested = yield* Effect.forEach(
-			entries.filter((entry) => !SKIPPED.has(entry)),
-			(entry) => walkEntry(join(dir, entry), scope),
-			{ concurrency: 1 },
-		);
-		return nested.flat();
+export const walk = Effect.fnUntraced(function* (
+	dir: string,
+	inherited: IgnoreScope = emptyScope,
+): Effect.fn.Return<readonly string[], FilesystemFailure, FileSystem.FileSystem> {
+	const fs = yield* FileSystem.FileSystem;
+	if ((yield* orWhenAbsent<FileSystem.File.Info | undefined>(dir, fs.stat(dir), undefined)) === undefined) {
+		return [];
+	}
+	const paths = yield* Effect.tryPromise({
+		catch: (cause) => new FilesystemFailure({ message: `cannot list tracked files in ${dir}: ${String(cause)}`, path: dir }),
+		try: () => trackedPaths(dir),
 	});
-
-const walkEntry = (path: string, scope: IgnoreScope): Effect.Effect<readonly string[], FilesystemFailure, FileSystem.FileSystem> =>
-	Effect.gen(function* () {
-		const fs = yield* FileSystem.FileSystem;
-		const info = yield* orWhenAbsent<FileSystem.File.Info | undefined>(path, fs.stat(path), undefined);
-		if (info === undefined) {
-			return [];
-		}
-		const directory = info.type === "Directory";
-		const verdict = verdictFor(scope, path, directory);
-		if (verdict === "ignored") {
-			return [];
-		}
-		if (!directory) {
-			return [path];
+	const tracked = new Set(paths);
+	for (const path of paths) {
+		for (let folder = dirname(path); folder !== dir && folder !== dirname(folder); folder = dirname(folder)) {
+			tracked.add(folder);
 		}
-		return yield* walk(path, verdict === "kept" ? insideKept(scope, path) : scope);
-	});
+	}
+	return yield* walkDirectory(dir, inherited, tracked);
+});
+
+const walkDirectory = Effect.fnUntraced(function* (
+	dir: string,
+	inherited: IgnoreScope,
+	tracked: ReadonlySet<string>,
+): Effect.fn.Return<readonly string[], FilesystemFailure, FileSystem.FileSystem> {
+	const fs = yield* FileSystem.FileSystem;
+	const scope = verdictFor(inherited, dir, true) === "ignored" ? inherited : yield* ignoreScopeAt(dir, inherited);
+	const entries = yield* orWhenAbsent<readonly string[]>(dir, fs.readDirectory(dir), []);
+	const nested = yield* Effect.forEach(
+		entries.filter((entry) => !SKIPPED.has(entry)),
+		(entry) => walkEntry(join(dir, entry), scope, tracked),
+		{ concurrency: 1 },
+	);
+	return nested.flat();
+});
+
+const walkEntry = Effect.fnUntraced(function* (
+	path: string,
+	scope: IgnoreScope,
+	tracked: ReadonlySet<string>,
+): Effect.fn.Return<readonly string[], FilesystemFailure, FileSystem.FileSystem> {
+	const fs = yield* FileSystem.FileSystem;
+	const info = yield* orWhenAbsent<FileSystem.File.Info | undefined>(path, fs.stat(path), undefined);
+	if (info === undefined) {
+		return [];
+	}
+	const directory = info.type === "Directory";
+	const verdict = verdictFor(scope, path, directory);
+	if (verdict === "ignored" && !tracked.has(path)) {
+		return [];
+	}
+	if (!directory) {
+		return [path];
+	}
+	return yield* walkDirectory(path, verdict === "kept" ? insideKept(scope, path) : scope, tracked);
+});

package/src/rules/built-in.ts

@@ -11,7 +11,10 @@ import { otherNames } from "#rules/files/otherNames.ts";
 import { importsAliased } from "#rules/imports/aliased.ts";
 import { importCycles } from "#rules/imports/cycles.ts";
 import { importFences } from "#rules/imports/fences.ts";
+import { importsManifest } from "#rules/imports/manifest.ts";
+import { noTestCode } from "#rules/imports/noTestCode.ts";
 import { importsResolvable } from "#rules/imports/resolvable.ts";
+import { importsRuntime } from "#rules/imports/runtime.ts";
 import { storySetup } from "#rules/stories/setup.ts";
 import { biomeOverrides } from "#rules/suppressions/biome-overrides.ts";
 import { biomeRecommended } from "#rules/suppressions/biomeRecommended.ts";
@@ -41,8 +44,11 @@ export const builtInRules = [
 	biome,
 	importCycles,
 	importFences,
+	importsRuntime,
 	importsResolvable,
+	importsManifest,
 	importsAliased,
+	noTestCode,
 	manifestsSorted,
 	namedAfterExport,
 	folderNames,

package/src/rules/comments/max-per-file.ts

@@ -6,7 +6,7 @@ import { commentsOf, type SourceComment } from "./scan.ts";
 
 const MaxPerFileOptions = Schema.Struct({
 	allow: Pragmas,
-	max: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)).pipe(Schema.withDecodingDefaultKey(Effect.succeed(2))),
+	max: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(2)).pipe(Schema.withDecodingDefaultKey(Effect.succeed(2))),
 });
 
 const continues = (previous: SourceComment | undefined, comment: SourceComment): boolean =>

package/src/rules/comments/no-environment-pragma.ts

@@ -2,7 +2,7 @@ import { definePatternRule } from "./pattern-rule.ts";
 
 export const noEnvironmentPragma = definePatternRule({
 	description:
-		"A test file gets its environment from its name, not from a pragma: `*.dom.test.ts` runs in a DOM, every other test in Node. `@shivaedev/quality/vitest.ts` sets up the Vitest projects that read the name.",
+		"A test file gets its environment from its name, not from a pragma: `*.dom.test.ts` runs in a DOM, every other test in Node. `@shivaedev/quality/testProjects.ts` sets up the Vitest projects that read the name.",
 	id: "comments/no-environment-pragma",
 	message: (match) => `Sets the test environment with "${match}". Name the file *.dom.test.ts or *.dom.test.tsx instead.`,
 	patterns: [/^@(?:vitest|jest)-environment(?:-options)?(?=\s|$)/mu],