no-mistakes 0.86.3 → 0.87.3

package/README.md

@@ -193,6 +193,8 @@ npx no-mistakes rust-no-inline-tests crates/*/src
 npx no-mistakes rust-max-lines-per-file crates/*/src crates/*/tests
 ```
 
+The optional [Vitest timeout policy](../../docs/test-timeout-policy.md) provides public configuration and registration guards.
+
 See the full documentation in [docs/](../../docs/README.md), the
 [CLI command index](../../docs/cli/README.md), and the
 [Node/N-API guide](../../docs/node-api.md). Agents can use the compact

package/executed-postgres-sql-types.d.ts

@@ -0,0 +1,39 @@
+export interface ExecutedPostgresSource {
+  fileName: string;
+  source: string;
+}
+
+export interface ExecutedPostgresTrustedSqlTag {
+  module: string;
+  name: string;
+}
+
+export interface ExecutedPostgresSqlOptions {
+  sources: ExecutedPostgresSource[];
+  /** Module whose named imports provide the configured executors. */
+  importSpecifier: string;
+  /** Defaults to query, read, write when importSpecifier is nonempty. */
+  executorNames?: string[];
+  executorFactoryNames?: string[];
+  executorTypeNames?: string[];
+  trustedSqlTags?: ExecutedPostgresTrustedSqlTag[];
+}
+
+export type ExecutedPostgresSqlKind = "inline" | "immutableLocal" | "composed" | "dynamic";
+
+export interface ExecutedPostgresSql {
+  fileName: string;
+  /** One-based line of the executor call. */
+  line: number;
+  annotation: string | null;
+  /** Interpolations are represented by sql_placeholder_N markers. */
+  sqlText: string | null;
+  /** False when full SQL could not be proven, including interpolation. */
+  complete: boolean;
+  kind: ExecutedPostgresSqlKind;
+}
+
+/** Extract configured PostgreSQL executor calls from supplied TS/JS source. */
+export function extractExecutedPostgresSql(
+  options: ExecutedPostgresSqlOptions,
+): Promise<ExecutedPostgresSql[]>;

package/index.d.ts

@@ -5,7 +5,7 @@ export function analyzeTypeScriptModules(
   options: WithInvocationOptions<TypeScriptModulesOptions>,
 ): Promise<TypeScriptModulesReport>;
 import type { PostgresSqlSource, PostgresSqlFacts } from "./postgres-source-types";
-export type * from "./postgres-source-types";
+export * from "./postgres-source-types";
 /** Parse SQL on the native async worker without repository I/O or a database. */
 export function parsePostgresSql(source: PostgresSqlSource): Promise<PostgresSqlFacts>;
 export function parsePostgresSql(sources: PostgresSqlSource[]): Promise<PostgresSqlFacts[]>;

package/index.js

@@ -26,6 +26,7 @@ function createJsonApis(descriptors) {
 const jsonApis = createJsonApis({
   analyzeTypeScriptModules: "analyzeTypeScriptModulesJson",
   parsePostgresSql: "parsePostgresSqlJson",
+  extractExecutedPostgresSql: "extractExecutedPostgresSqlJson",
   generatePostgresCatalog: "generatePostgresCatalogJson",
   analyzeProject: "analyzeProjectJson",
   callSites: "callSitesJson",
@@ -120,6 +121,7 @@ module.exports.createWorkflowTopologyIndex = createWorkflowTopologyIndex;
 module.exports.version = version;
 module.exports.analyzeProject = analyzeProject;
 module.exports.analyzeTypeScriptModules = jsonApis.analyzeTypeScriptModules;
+module.exports.extractExecutedPostgresSql = jsonApis.extractExecutedPostgresSql;
 module.exports.writePlanningImpactArtifacts = writePlanningImpactArtifacts;
 module.exports.callSites = jsonApis.callSites;
 module.exports.check = jsonApis.check;

package/index.mjs

@@ -6,6 +6,7 @@ const cjs = require("./index.js");
 export const {
   analyzeProject,
   analyzeTypeScriptModules,
+  extractExecutedPostgresSql,
   callSites,
   check,
   ciEnv,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "no-mistakes",
-  "version": "0.86.3",
+  "version": "0.87.3",
   "description": "Deterministic impact maps, test plans, Playwright coverage, and repository checks for coding agents",
   "license": "MIT",
   "repository": {
@@ -29,7 +29,10 @@
     "workflow-topology-index-helpers.js",
     "scripts/native-package.js",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "test-timeout-policy/*.mjs",
+    "test-timeout-policy/*.d.mts",
+    "!test-timeout-policy/*.test.mjs"
   ],
   "main": "index.js",
   "types": "index.d.ts",
@@ -40,15 +43,31 @@
       "require": "./index.js"
     },
     "./planning.js": "./planning.js",
-    "./workflow-topology-index.js": "./workflow-topology-index.js"
+    "./workflow-topology-index.js": "./workflow-topology-index.js",
+    "./test-timeout-policy": {
+      "types": "./test-timeout-policy/index.d.mts",
+      "import": "./test-timeout-policy/index.mjs"
+    },
+    "./test-timeout-policy/plugin": {
+      "types": "./test-timeout-policy/plugin.d.mts",
+      "import": "./test-timeout-policy/plugin.mjs"
+    }
   },
   "publishConfig": {
     "access": "public"
   },
+  "peerDependencies": {
+    "vitest": "^5.0.3"
+  },
+  "peerDependenciesMeta": {
+    "vitest": {
+      "optional": true
+    }
+  },
   "optionalDependencies": {
-    "no-mistakes-darwin-arm64": "0.86.3",
-    "no-mistakes-linux-arm64-gnu": "0.86.3",
-    "no-mistakes-linux-x64-gnu": "0.86.3",
-    "no-mistakes-win32-x64-msvc": "0.86.3"
+    "no-mistakes-darwin-arm64": "0.87.3",
+    "no-mistakes-linux-arm64-gnu": "0.87.3",
+    "no-mistakes-linux-x64-gnu": "0.87.3",
+    "no-mistakes-win32-x64-msvc": "0.87.3"
   }
 }

package/postgres-expression-types.d.ts

@@ -29,9 +29,10 @@ export type PostgresSqlExpressionRoot =
   | { kind: "literal"; sql: string; value: PostgresSqlLiteralValue }
   | { kind: "binary"; operator: string }
   | { kind: "unary"; operator: string; expression: PostgresSqlExpressionRoot }
-  | { kind: "case" | "subquery" | "other" };
+  | { kind: "array" | "case" | "subquery" | "other" };
 export type PostgresSqlExpressionChildRole =
   | "argument"
+  | "arrayElement"
   | "binaryLeft"
   | "binaryRight"
   | "caseOperand"
@@ -63,7 +64,7 @@ export type PostgresSqlExpressionChildRoot =
   | { kind: "typedLiteral"; dataType: string; value: string; sql: string }
   | { kind: "literal"; sql: string; value: PostgresSqlLiteralValue }
   | { kind: "binary" | "unary"; operator: string }
-  | { kind: "case" | "subquery" | "other" };
+  | { kind: "array" | "case" | "subquery" | "other" };
 export interface PostgresSqlExpressionChild {
   role: PostgresSqlExpressionChildRole;
   index: number | null;

package/postgres-procedural-types.d.ts

@@ -17,6 +17,10 @@ export interface PostgresSqlProceduralBlock {
   /** Classified source occurrences in source order. Visibility is not execution. */
   occurrences: PostgresSqlProceduralOccurrence[];
   diagnostics: PostgresSqlDiagnostic[];
+  /** True only when supported static SQL is reachable through typed statements.
+   * Unprojected loop utilities produce diagnostics and keep this false.
+   * Recognized utilities represented as `other` statements retain coverage.
+   * Occurrence classification is additive and never proves typed coverage. */
   complete: boolean;
 }
 

package/postgres-query-types.d.ts

@@ -1,6 +1,7 @@
 import type { PostgresSqlQueryStatement } from "./postgres-query-statement-types";
 export type * from "./postgres-query-statement-types";
 import type {
+  PostgresSqlExpression,
   PostgresSqlIdentifier,
   PostgresSqlName,
   PostgresSqlSpan,
@@ -13,6 +14,7 @@ export interface PostgresSqlQuery {
   columns: PostgresSqlQueryColumn[];
   equalities: PostgresSqlQueryEquality[];
   exists: PostgresSqlQueryExists[];
+  quantifiedComparisons: PostgresSqlQueryQuantifiedComparison[];
   ctes: PostgresSqlQueryCte[];
   /** Data-modifying query bodies in original source order; SELECT CTEs are excluded. */
   nestedStatements: PostgresSqlQueryStatement[];
@@ -145,3 +147,18 @@ export interface PostgresSqlQueryUnsupported {
   reason: string;
   span: PostgresSqlSpan | null;
 }
+
+export type PostgresSqlQuantifier = "any" | "all";
+/** Scalar array comparisons in traversal order; unsupported operands remain incomplete. */
+export interface PostgresSqlQueryQuantifiedComparison {
+  scopeId: number;
+  clause: PostgresSqlQueryClause;
+  joinId: number | null;
+  operator: string;
+  quantifier: PostgresSqlQuantifier;
+  left: PostgresSqlExpression;
+  right: PostgresSqlExpression;
+  context: PostgresSqlPredicateContext;
+  span: PostgresSqlSpan | null;
+  complete: boolean;
+}

package/postgres-source-types.d.ts

@@ -1,4 +1,5 @@
 import type { PostgresSqlTrigger } from "./postgres-trigger-types";
+export * from "./executed-postgres-sql-types";
 export type * from "./postgres-trigger-types";
 import type { PostgresSqlWrapper } from "./postgres-wrapper-types";
 export type * from "./postgres-wrapper-types";

package/test-timeout-policy/config.d.mts

@@ -0,0 +1,11 @@
+export declare function assertTestTimeout(value: unknown, label: string, maximum?: number): number;
+export declare function assertTimeoutConfig(config: object, maximum?: number): void;
+/** Preserve SDK option/property semantics while capturing one validated deadline. */
+export declare function snapshotTimeoutOptions<T extends object>(
+  options: T,
+  label: string,
+  maximum?: number,
+  nullInherits?: boolean,
+): T;
+/** Install before collection, composing with the existing runner's config object. */
+export declare function protectTimeoutConfig(config: object, maximum?: number): void;

package/test-timeout-policy/config.mjs

@@ -0,0 +1,52 @@
+/** Positive, finite configured deadlines; this does not cap aggregate run duration. */
+const installedConfigs = new WeakMap();
+export function assertTestTimeout(value, label, maximum = 30_000) {
+  if (typeof maximum !== "number" || !Number.isFinite(maximum) || maximum <= 0)
+    throw new RangeError("Timeout maximum must be positive and finite");
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > maximum)
+    throw new RangeError(`${label} must be positive, finite and at most ${maximum} ms`);
+  return value;
+}
+export function assertTimeoutConfig(config, maximum = 30_000) {
+  for (const key of ["testTimeout", "hookTimeout"]) {
+    if (Reflect.has(config, key)) assertTestTimeout(Reflect.get(config, key), key, maximum);
+  }
+}
+/** Preserve SDK option/property semantics while capturing one validated deadline. */
+export function snapshotTimeoutOptions(options, label, maximum = 30_000, nullInherits = false) {
+  // Vitest copies registration options with object spread, ignoring inherited/hidden keys.
+  if (!Object.prototype.propertyIsEnumerable.call(options, "timeout")) return options;
+  const timeout = Reflect.get(options, "timeout");
+  if (timeout !== undefined && (timeout !== null || !nullInherits))
+    assertTestTimeout(timeout, label, maximum);
+  return new Proxy(options, {
+    get(target, key) {
+      return key === "timeout" ? timeout : Reflect.get(target, key, target);
+    },
+  });
+}
+/** Install before collection, composing with the existing runner's config object. */
+export function protectTimeoutConfig(config, maximum = 30_000) {
+  const existing = installedConfigs.get(config);
+  if (existing !== undefined) {
+    if (existing !== maximum) throw new Error("Timeout configuration policy maximum cannot change");
+    return;
+  }
+  const values = ["testTimeout", "hookTimeout"].map((key) => ({
+    key,
+    value: assertTestTimeout(Reflect.get(config, key), key, maximum),
+  }));
+  for (const entry of values) {
+    const key = entry.key;
+    let value = entry.value;
+    Object.defineProperty(config, key, {
+      enumerable: true,
+      configurable: false,
+      get: () => value,
+      set: (next) => {
+        value = assertTestTimeout(next, key, maximum);
+      },
+    });
+  }
+  installedConfigs.set(config, maximum);
+}

package/test-timeout-policy/index.d.mts

@@ -0,0 +1,19 @@
+export { guardRegistration, type Registration, type Kind } from "./registration.mjs";
+export { guardPublicRunner, type RunnerConstructor, type Protector } from "./public-runner.mjs";
+export {
+  assertTestTimeout,
+  assertTimeoutConfig,
+  snapshotTimeoutOptions,
+  protectTimeoutConfig,
+} from "./config.mjs";
+/** Aliased/destructured setters retain validation because the returned method is guarded. */
+export declare function guardRuntimeConfig<T extends object>(api: T, maximum?: number): T;
+/** A single current Vitest API facade. Adoption must route every test import through it. */
+export declare function guardVitestExports<T extends object>(api: T, maximum?: number): T;
+/** Compose at runner construction, without replacing existing collection/database guards. */
+export declare function protectRunnerTimeouts(
+  runner: {
+    config: object;
+  },
+  maximum?: number,
+): void;

package/test-timeout-policy/index.mjs

@@ -0,0 +1,129 @@
+import { guardRegistration } from "./registration.mjs";
+export { guardRegistration } from "./registration.mjs";
+import { guardCollectionRunner } from "./public-runner.mjs";
+export { guardPublicRunner } from "./public-runner.mjs";
+import { assertTestTimeout, assertTimeoutConfig, protectTimeoutConfig } from "./config.mjs";
+export {
+  assertTestTimeout,
+  assertTimeoutConfig,
+  snapshotTimeoutOptions,
+  protectTimeoutConfig,
+} from "./config.mjs";
+const installedRunners = new WeakMap();
+const installedContexts = new WeakMap();
+function protectContextHooks(context, maximum) {
+  const installed = installedContexts.get(context) ?? { maximum, methods: new Set() };
+  if (installed.maximum !== maximum)
+    throw new Error("Context timeout policy maximum cannot change");
+  for (const name of ["onTestFailed", "onTestFinished"]) {
+    // Extensions may add a missing hook to the same context between scans.
+    if (installed.methods.has(name)) continue;
+    const original = Reflect.get(context, name);
+    if (typeof original === "function") {
+      let guarded = guardRegistration(original, "hook", maximum);
+      Object.defineProperty(context, name, {
+        // Vitest temporarily replaces/restores these methods while executing completion hooks.
+        get: () => guarded,
+        set(next) {
+          if (typeof next !== "function") throw new TypeError("Expected a completion hook method");
+          guarded = guardRegistration(next, "hook", maximum);
+        },
+        configurable: false,
+      });
+      installed.methods.add(name);
+    }
+  }
+  installedContexts.set(context, installed);
+}
+/** Aliased/destructured setters retain validation because the returned method is guarded. */
+export function guardRuntimeConfig(api, maximum = 30_000) {
+  const original = Reflect.get(api, "setConfig");
+  if (typeof original !== "function") throw new TypeError("Expected a Vitest setConfig method");
+  const setter = (config) => {
+    const snapshot = { ...config };
+    assertTimeoutConfig(snapshot, maximum);
+    return Reflect.apply(original, api, [snapshot]);
+  };
+  return new Proxy(api, {
+    get(target, key, receiver) {
+      return key === "setConfig" ? setter : Reflect.get(target, key, receiver);
+    },
+  });
+}
+/** A single current Vitest API facade. Adoption must route every test import through it. */
+export function guardVitestExports(api, maximum = 30_000) {
+  const cache = new Map();
+  const kinds = new Map([
+    ["test", "test"],
+    ["it", "test"],
+    ["describe", "suite"],
+    ["suite", "suite"],
+    ["beforeAll", "hook"],
+    ["beforeEach", "hook"],
+    ["afterAll", "hook"],
+    ["afterEach", "hook"],
+    ["aroundAll", "hook"],
+    ["aroundEach", "hook"],
+    ["onTestFailed", "hook"],
+    ["onTestFinished", "hook"],
+  ]);
+  return new Proxy(api, {
+    get(target, key, receiver) {
+      const value = Reflect.get(target, key, receiver);
+      const kind = kinds.get(String(key));
+      const role = kind ?? (key === "vitest" ? "vi" : key);
+      const values = cache.get(value) ?? new Map();
+      if (values.has(role)) return values.get(role);
+      const guarded =
+        key === "TestRunner" && typeof value === "function"
+          ? guardCollectionRunner(value, maximum, protectRunnerTimeouts)
+          : (key === "vi" || key === "vitest") && value !== null && typeof value === "object"
+            ? guardRuntimeConfig(value, maximum)
+            : kind && typeof value === "function"
+              ? guardRegistration(value, kind, maximum)
+              : value;
+      values.set(role, guarded);
+      cache.set(value, values);
+      return guarded;
+    },
+  });
+}
+/** Compose at runner construction, without replacing existing collection/database guards. */
+export function protectRunnerTimeouts(runner, maximum = 30_000) {
+  const existing = installedRunners.get(runner);
+  if (existing) {
+    if (existing.maximum !== maximum || existing.config !== runner.config)
+      throw new Error("Installed runner timeout policy cannot be replaced");
+    return;
+  }
+  if (Reflect.get(runner.config, "globals") === true)
+    throw new Error("Timeout policy requires guarded public imports with globals disabled");
+  protectTimeoutConfig(runner.config, maximum);
+  const config = runner.config;
+  const extend = Reflect.get(runner, "extendTaskContext");
+  const extendTaskContext = (context) => {
+    if (runner.config !== config)
+      throw new Error("Runner timeout configuration identity changed after construction");
+    // Vitest 5 creates the context after resolving task.timeout, before withTimeout.
+    // withTimeout uses a pre-context local timeout; extensions must not mask invalid tasks.
+    const task = Reflect.get(context, "task");
+    if (task === null || typeof task !== "object")
+      throw new TypeError("Expected Vitest task context");
+    assertTestTimeout(Reflect.get(task, "timeout"), "Vitest resolved test timeout", maximum);
+    protectContextHooks(context, maximum);
+    const result =
+      typeof extend === "function" ? Reflect.apply(extend, runner, [context]) : context;
+    if (runner.config !== config)
+      throw new Error("Runner timeout configuration identity changed during context extension");
+    // Recheck the original task, even if the extension returns a replacement context.
+    assertTestTimeout(Reflect.get(task, "timeout"), "Vitest resolved test timeout", maximum);
+    protectContextHooks(result, maximum);
+    return result;
+  };
+  Object.defineProperty(runner, "extendTaskContext", {
+    value: extendTaskContext,
+    writable: false,
+    configurable: false,
+  });
+  installedRunners.set(runner, { maximum, config: runner.config });
+}

package/test-timeout-policy/plugin.d.mts

@@ -0,0 +1,19 @@
+import type { Plugin } from "vitest/config";
+
+export interface NodeRunnerPolicy {
+  /** Absolute final custom runner module, or null for Vitest's native runner. */
+  runner: string | null;
+}
+
+/** Route Node registration imports and protect the final native or custom runner. */
+export declare function testTimeoutPolicyPlugin(
+  maximum?: number,
+  registrationPackages?: readonly string[],
+  nodeRunner?: NodeRunnerPolicy,
+): Plugin;
+
+/** Route the native Vitest Browser Mode runner and registrar dependency closure. */
+export declare function browserTestTimeoutPolicyPlugin(
+  maximum?: number,
+  registrationPackages?: readonly string[],
+): Plugin;

package/test-timeout-policy/plugin.mjs

@@ -0,0 +1,146 @@
+import { configDefaults } from "vitest/config";
+import { isAbsolute } from "node:path";
+import { fileURLToPath } from "node:url";
+const virtualId = "\0test-timeout-policy:vitest";
+/** Vite resolves the public imports; no source parser or SDK-private patch is involved. */
+export function testTimeoutPolicyPlugin(
+  maximum = 30_000,
+  registrationPackages = [],
+  nodeRunner = { runner: null },
+) {
+  return createPolicyPlugin(maximum, registrationPackages, nodeRunner);
+}
+function createPolicyPlugin(maximum, registrationPackages, nodeRunner) {
+  if (!Number.isFinite(maximum) || maximum <= 0)
+    throw new RangeError("Timeout maximum must be positive and finite");
+  const policy = fileURLToPath(new URL("./index.mjs", import.meta.url));
+  const runnerId = fileURLToPath(new URL("./timeout-policy-virtual-runner.mjs", import.meta.url));
+  const originalRunner = nodeRunner?.runner;
+  if (originalRunner && !isAbsolute(originalRunner))
+    throw new TypeError("Supply the absolute resolved final runner module");
+  return {
+    name: "test-timeout-policy",
+    enforce: "pre",
+    // Externalized modules bypass Vite resolution entirely; registration helpers must be inlined.
+    config(config = {}) {
+      if (nodeRunner && config.test?.runner && config.test.runner !== originalRunner)
+        throw new Error("Configured runner differs from the supplied final runner");
+      return {
+        test: {
+          ...(nodeRunner ? { runner: runnerId } : {}),
+          server: {
+            deps: {
+              inline: config.test?.server?.deps?.inline === true ? true : [...registrationPackages],
+            },
+          },
+        },
+      };
+    },
+    configResolved(config) {
+      if (config.test?.browser?.enabled)
+        throw new Error("Node final-runner composition cannot be used for browser projects");
+      if (config.test?.runner !== runnerId)
+        throw new Error("Final runner policy was replaced during configuration merge");
+    },
+    resolveId(source, importer) {
+      if (nodeRunner && source === runnerId) return runnerId;
+      if (source === "vitest" && importer === runnerId) return null;
+      if (source !== "vitest" || !importer || importer === virtualId) return null;
+      return virtualId;
+    },
+    load(id) {
+      if (nodeRunner && id === runnerId)
+        return `
+        ${
+          originalRunner
+            ? `import FinalRunner from ${JSON.stringify(originalRunner)}`
+            : "import { TestRunner as FinalRunner } from 'vitest'"
+        }
+        import { guardPublicRunner, protectRunnerTimeouts } from ${JSON.stringify(policy)}
+        export default guardPublicRunner(FinalRunner, ${JSON.stringify(maximum)}, protectRunnerTimeouts)
+      `;
+      if (id !== virtualId) return null;
+      return `
+        import * as native from 'vitest'
+        import { guardVitestExports } from ${JSON.stringify(policy)}
+        ${
+          nodeRunner
+            ? `import { guardRunnerStatics } from ${JSON.stringify(fileURLToPath(new URL("./public-runner.mjs", import.meta.url)))}
+        import { protectRunnerTimeouts } from ${JSON.stringify(policy)}`
+            : ""
+        }
+        export * from 'vitest'
+        const guarded = guardVitestExports(native, ${JSON.stringify(maximum)})
+        ${nodeRunner ? `export const TestRunner = guardRunnerStatics(native.TestRunner, ${JSON.stringify(maximum)}, protectRunnerTimeouts)` : "export const TestRunner = guarded.TestRunner"}
+        export const { test, it, describe, suite, beforeAll, beforeEach, afterAll, afterEach,
+          aroundAll, aroundEach, onTestFailed, onTestFinished, vi, vitest } = guarded
+      `;
+    },
+  };
+}
+/** Browser-only candidate: keep public constructor/registrars out of dependency bundles. */
+export function browserTestTimeoutPolicyPlugin(maximum = 30_000, registrationPackages = []) {
+  const base = createPolicyPlugin(maximum, registrationPackages);
+  const excluded = ["vitest", "@vitest/browser", ...registrationPackages];
+  const filterIncludes = (include) =>
+    include.filter(
+      (entry) =>
+        !entry.split(">").some((part) => {
+          const token = part.trim();
+          return excluded.some((id) => token === id || token.startsWith(`${id}/`));
+        }),
+    );
+  return {
+    ...base,
+    name: "browser-test-timeout-policy",
+    configEnvironment: {
+      order: "post",
+      handler(name, config) {
+        if (name !== "client" && config.consumer !== "client") return;
+        return {
+          optimizeDeps: {
+            ...config.optimizeDeps,
+            include: filterIncludes(config.optimizeDeps?.include ?? []),
+            exclude: [...new Set([...(config.optimizeDeps?.exclude ?? []), ...excluded])],
+          },
+        };
+      },
+    },
+    config(config = {}) {
+      const existing = config.test?.reporters;
+      const reporters = existing === undefined ? [...configDefaults.reporters] : [];
+      const lifecycle = {
+        onBrowserInit(project) {
+          // Public reporter lifecycle runs before the provider starts browser pages.
+          const configs = [project.viteConfig, project.vite.config];
+          for (const resolved of configs) {
+            for (const optimizer of [
+              resolved.optimizeDeps,
+              resolved.environments?.client?.optimizeDeps,
+            ]) {
+              if (optimizer?.include) optimizer.include = filterIncludes(optimizer.include);
+            }
+          }
+          const optimizer = project.vite.environments.client?.config.optimizeDeps;
+          if (optimizer?.include) optimizer.include = filterIncludes(optimizer.include);
+        },
+      };
+      return {
+        ...base.config(config),
+        test: { ...base.config(config).test, reporters: [...reporters, lifecycle] },
+        optimizeDeps: { exclude: excluded },
+      };
+    },
+    configResolved(config) {
+      if (!config.test?.browser?.enabled)
+        throw new Error("Browser timeout policy requires an enabled browser project");
+      for (const id of excluded) {
+        if (!config.optimizeDeps?.exclude?.includes(id))
+          throw new Error(`Missing browser timeout routing exclusion: ${id}`);
+      }
+      for (const optimizer of [config.optimizeDeps, config.environments?.client?.optimizeDeps]) {
+        if (optimizer?.include) optimizer.include = filterIncludes(optimizer.include);
+      }
+    },
+  };
+}

package/test-timeout-policy/public-runner.d.mts

@@ -0,0 +1,13 @@
+export type Protector<T extends { config: object } = { config: object }> = (
+  runner: T,
+  maximum: number,
+) => void;
+export type RunnerConstructor = new (...args: never[]) => {
+  config: object;
+};
+/** Compose a final public constructor while retaining direct and derived new.target contracts. */
+export declare function guardPublicRunner<T extends RunnerConstructor>(
+  original: T,
+  maximum: number,
+  protect: Protector<InstanceType<T>>,
+): T;

package/test-timeout-policy/public-runner.mjs

@@ -0,0 +1,118 @@
+import { guardRegistration, protectSuiteCollector } from "./registration.mjs";
+const constructors = new WeakMap();
+/** Compose a final public constructor while retaining direct and derived new.target contracts. */
+export function guardPublicRunner(original, maximum, protect) {
+  return guardRunner(original, maximum, protect, false);
+}
+
+/** Internal adapter for the native SDK browser subclass, whose collection lifecycle is public. */
+export function guardCollectionRunner(original, maximum, protect) {
+  return guardRunner(original, maximum, protect, true);
+}
+
+/** Node final-runner composition owns instance protection; public statics still need guards. */
+export function guardRunnerStatics(original, maximum, protect) {
+  return guardRunner(original, maximum, protect, null);
+}
+
+function guardRunner(original, maximum, protect, defer) {
+  let policies = constructors.get(original);
+  if (!policies) {
+    policies = new WeakMap();
+    constructors.set(original, policies);
+  }
+  let deadlines = policies.get(protect);
+  if (!deadlines) {
+    deadlines = new Map();
+    policies.set(protect, deadlines);
+  }
+  let adapters = deadlines.get(maximum);
+  if (!adapters) {
+    adapters = new Map();
+    deadlines.set(maximum, adapters);
+  }
+  const existing = adapters.get(defer);
+  if (existing) return existing;
+  const methods = new WeakMap();
+  const statics = new Map();
+  const guarded = new Proxy(original, {
+    get(target, key, receiver) {
+      const direct = receiver === guarded;
+      const value = Reflect.get(target, key, direct ? target : receiver);
+      if (
+        typeof value === "function" &&
+        ["getCurrentSuite", "createTaskCollector", "getSuiteHooks", "setSuiteHooks"].includes(key)
+      ) {
+        if (!statics.has(value)) {
+          statics.set(
+            value,
+            new Proxy(value, {
+              apply(callable, owner, args) {
+                if (key === "getSuiteHooks" || key === "setSuiteHooks")
+                  throw new Error(
+                    "TestRunner raw suite hooks bypass native hook deadlines; register guarded public hooks instead",
+                  );
+                const result = Reflect.apply(callable, owner === guarded ? target : owner, args);
+                return key === "getCurrentSuite"
+                  ? protectSuiteCollector(result, maximum)
+                  : guardRegistration(result, "test", maximum);
+              },
+            }),
+          );
+        }
+        return statics.get(value);
+      }
+      if (!direct || typeof value !== "function") return value;
+      const descriptor = staticDescriptor(target, key);
+      // Callable-valued fields are public values, including Vitest's exported static aliases.
+      if (
+        !descriptor ||
+        typeof descriptor.value !== "function" ||
+        descriptor.enumerable === true ||
+        (descriptor?.configurable === false && descriptor.writable === false)
+      )
+        return value;
+      const existing = methods.get(value);
+      if (existing) return existing;
+      const method = new Proxy(value, {
+        apply(callable, owner, args) {
+          return Reflect.apply(callable, owner === guarded ? target : owner, args);
+        },
+      });
+      methods.set(value, method);
+      return method;
+    },
+    construct(target, args, newTarget) {
+      const runner = Reflect.construct(target, args, newTarget === guarded ? target : newTarget);
+      if (newTarget === guarded && defer !== null) protect(runner, maximum);
+      else if (defer) {
+        // super() returns before derived fields initialize. Vitest's public
+        // collection lifecycle runs after construction, before registration.
+        const beforeCollect = Reflect.get(runner, "onBeforeCollect");
+        Object.defineProperty(runner, "onBeforeCollect", {
+          configurable: false,
+          writable: false,
+          value(...paths) {
+            protect(runner, maximum);
+            return typeof beforeCollect === "function"
+              ? Reflect.apply(beforeCollect, runner, paths)
+              : undefined;
+          },
+        });
+      }
+      return runner;
+    },
+  });
+  adapters.set(defer, guarded);
+  return guarded;
+}
+/** Class-owned descriptors distinguish methods from fields without changing Function APIs. */
+function staticDescriptor(target, key) {
+  let owner = target;
+  while (owner && owner !== Function.prototype) {
+    const descriptor = Reflect.getOwnPropertyDescriptor(owner, key);
+    if (descriptor) return descriptor;
+    owner = Reflect.getPrototypeOf(owner);
+  }
+  return undefined;
+}

package/test-timeout-policy/registration.d.mts

@@ -0,0 +1,8 @@
+export type Registration = (...args: never[]) => unknown;
+export type Kind = "test" | "suite" | "hook";
+/** Validate before Vitest's registration creates its captured timeout wrapper. */
+export declare function guardRegistration<T extends Registration>(
+  original: T,
+  kind: Kind,
+  maximum?: number,
+): T;

package/test-timeout-policy/registration.mjs

@@ -0,0 +1,124 @@
+import { assertTestTimeout, snapshotTimeoutOptions } from "./config.mjs";
+const registrations = new WeakMap();
+const curriedMethods = new Set(["each", "for", "extend", "override", "scoped", "skipIf", "runIf"]);
+const chainedMethods = new Set(["concurrent", "shuffle", "skip", "only", "todo", "fails"]);
+const suiteMethods = new Set(["describe", "suite"]);
+const hookMethods = new Set([
+  "beforeAll",
+  "beforeEach",
+  "afterAll",
+  "afterEach",
+  "aroundAll",
+  "aroundEach",
+]);
+/** Validate before Vitest's registration creates its captured timeout wrapper. */
+export function guardRegistration(original, kind, maximum = 30_000) {
+  return createRegistration(original, kind, maximum, true);
+}
+function createRegistration(original, kind, maximum, injectFactory) {
+  const deadlines = registrations.get(original) ?? new Map();
+  const roles = deadlines.get(maximum) ?? new Map();
+  const role = `${kind}:${injectFactory}`;
+  const existing = roles.get(role);
+  if (existing) return existing;
+  const cache = new Map();
+  const guarded = new Proxy(original, {
+    apply(target, receiver, args) {
+      if (kind === "hook") {
+        if (args[1] !== undefined) assertTestTimeout(args[1], "hook timeout", maximum);
+      } else {
+        for (let index = 1; index < Math.min(args.length, 3); index++) {
+          const value = args[index];
+          if (kind === "suite" && injectFactory && typeof value === "function") {
+            args[index] = protectSuiteFactory(value, maximum);
+          } else if (typeof value === "number")
+            assertTestTimeout(value, `${kind} timeout`, maximum);
+          else if (value !== null && typeof value === "object") {
+            args[index] = snapshotTimeoutOptions(value, `${kind} timeout`, maximum, true);
+          }
+        }
+      }
+      const result = Reflect.apply(target, receiver, args);
+      return kind === "suite" &&
+        result !== null &&
+        typeof result === "object" &&
+        Reflect.get(result, "type") === "collector"
+        ? protectSuiteCollector(result, maximum)
+        : result;
+    },
+    get(target, key, receiver) {
+      if (cache.has(key)) return cache.get(key);
+      const value = Reflect.get(target, key, receiver);
+      if (typeof value !== "function") return value;
+      const name = String(key);
+      if (
+        !curriedMethods.has(name) &&
+        !chainedMethods.has(name) &&
+        !hookMethods.has(name) &&
+        !suiteMethods.has(name)
+      )
+        return value;
+      const guarded = curriedMethods.has(name)
+        ? new Proxy(value, {
+            apply(method, owner, args) {
+              const result = Reflect.apply(method, owner, args);
+              return typeof result === "function"
+                ? createRegistration(
+                    result,
+                    kind,
+                    maximum,
+                    injectFactory && name !== "each" && name !== "for",
+                  )
+                : result;
+            },
+          })
+        : guardRegistration(
+            value,
+            hookMethods.has(name) ? "hook" : suiteMethods.has(name) ? "suite" : kind,
+            maximum,
+          );
+      cache.set(key, guarded);
+      return guarded;
+    },
+  });
+  roles.set(role, guarded);
+  deadlines.set(maximum, roles);
+  registrations.set(original, deadlines);
+  // Native completion-hook execution saves and restores a method that is already guarded.
+  registrations.set(guarded, new Map([[maximum, new Map([[role, guarded]])]]));
+  return guarded;
+}
+function protectSuiteFactory(factory, maximum) {
+  return new Proxy(factory, {
+    apply(target, owner, values) {
+      // The known direct suite-factory route always receives Vitest's public TestAPI.
+      values[0] = guardRegistration(values[0], "test", maximum);
+      return Reflect.apply(target, owner, values);
+    },
+  });
+}
+const collectors = new WeakMap();
+/** Native collector.on stores raw callbacks, bypassing Vitest's public hook timeout capture. */
+export function protectSuiteCollector(original, maximum) {
+  const deadlines = collectors.get(original) ?? new Map();
+  const existing = deadlines.get(maximum);
+  if (existing) return existing;
+  const tests = new Map();
+  const rejectRawHook = () => {
+    throw new Error(
+      "SuiteCollector.on bypasses native hook deadlines; register guarded public hooks inside the suite factory",
+    );
+  };
+  const guarded = new Proxy(original, {
+    get(target, key, receiver) {
+      if (key === "on") return rejectRawHook;
+      const value = Reflect.get(target, key, receiver);
+      if (key !== "test" || typeof value !== "function") return value;
+      if (!tests.has(value)) tests.set(value, guardRegistration(value, "test", maximum));
+      return tests.get(value);
+    },
+  });
+  deadlines.set(maximum, guarded);
+  collectors.set(original, deadlines);
+  return guarded;
+}