onsystem 0.7.0 → 0.9.0

package/dist/cli.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
-import { C as pruneBaseline, Ct as relativePath, D as updateBaseline, E as unrecordedRules, H as CONFIG_FILES, J as LEGACY_CONFIG_FILES, N as toDesignMd, O as writeBaseline, P as toDtcg, S as countBaseline, St as matchesGlob, T as rulesRun, U as ConfigError, W as DEFAULT_DOCS, Y as RULE_IDS, _ as NAME, b as LEGACY_BASELINE_FILE, bt as unique, c as silentLogger, ct as PACKAGE_FIELD, dt as detectProject, g as formatDiagnostics, h as escapeData, i as componentFiles, l as stderrLogger, m as uncheckedNotice, o as loadDesignSystem, ot as libraryTitle, pt as isDesignSystemName, s as tokenFiles, st as notReadYet, tt as rulesFor, ut as declaredConfig, v as VERSION, vt as plural, w as readBaseline, wt as toPosix, x as applyBaseline, xt as isInside, y as BASELINE_FILE } from "./design-system-C4bhqLLw.js";
-import { a as notReadNotices, i as missingDependencies, o as explainProject, s as librariesLeftOut, t as serveStdio } from "./stdio-BojAQ6JP.js";
-import { r as loadTarget } from "./workspace-Z0tZf_Dv.js";
+import { $ as LEGACY_CONFIG_FILES, A as unrecordedRules, At as relativePath, B as statusKinds, C as countBaseline, D as pruneBaseline, Dt as SCRIPT_FILE, E as onLines, Et as unique, J as ConfigError, L as toDesignMd, M as writeBaseline, Nt as readProjectConfig, O as readBaseline, Ot as isInside, R as toDtcg, S as applyBaseline, T as goneFiles, Y as DEFAULT_DOCS, _ as formatDiagnostics, _t as detectProject, b as BASELINE_FILE, c as silentLogger, et as RULE_IDS, ft as libraryTitle, g as escapeData, gt as declaredConfig, h as uncheckedNotice, i as componentFiles, j as updateBaseline, jt as toPosix, k as rulesRun, kt as matchesGlob, l as stderrLogger, mt as PACKAGE_FIELD, o as loadDesignSystem, pt as notReadYet, q as CONFIG_FILES, rt as excludedBy, s as tokenFiles, st as rulesFor, v as NAME, w as findMoves, wt as plural, x as LEGACY_BASELINE_FILE, y as VERSION, yt as isDesignSystemName } from "./design-system-Bykei5W0.js";
+import { a as notReadNotices, i as missingDependencies, o as explainProject, s as librariesLeftOut, t as serveStdio } from "./stdio-B7u6dqLd.js";
+import { r as loadTarget } from "./workspace-Dp1q8qZ8.js";
 import fs from "node:fs";
 import path from "node:path";
 import { escapePath, glob } from "tinyglobby";
+import ts from "typescript";
 import fsp from "node:fs/promises";
 import { spawnSync } from "node:child_process";
 import readline from "node:readline/promises";
@@ -26,6 +27,9 @@ const GUIDE_FILE = "ONSYSTEM.md";
 * every app that depends on the package reads it, and writes ONSYSTEM.md, which tells those
 * apps' teams how to add the agent tools and the CI check. In an app that takes on such a
 * package's config, it writes no config of its own unless --force says to.
+*
+* In a terminal, it offers to add a short section on onsystem to the project's AGENTS.md or
+* CLAUDE.md, for coding agents.
 */
 async function init(configOptions, options, io, runCheck) {
 	const { config, workspace } = await loadTarget({
@@ -49,6 +53,7 @@ async function init(configOptions, options, io, runCheck) {
 	const relative = (abs) => relativePath(root, abs);
 	const inherited = options.force ? void 0 : config.designSystemPackage;
 	const replaced = options.force ? config.designSystemPackage : void 0;
+	let found = false;
 	if (inherited) notes.push(`This project takes on the config ${inherited.name} declares in its package.json (${relativePath(io.cwd, inherited.config) || inherited.config}), so it needs none of its own; nothing was written. Pass --force to write one, which is read instead.`);
 	else if (configOptions.components?.length) {
 		file.components = configOptions.components;
@@ -63,6 +68,7 @@ async function init(configOptions, options, io, runCheck) {
 		else if (config.components.length > MAX_GLOBS) notes.push(`"components" is left to zero config: it found ${config.components.length} files through the package's exports, which it keeps following as the package changes.`);
 		else {
 			file.components = config.components;
+			found = true;
 			const [specifier] = specifiers;
 			if (specifier && !specifier.includes("*")) file.importPath = specifier;
 			const docs = config.docs.filter((d) => !DEFAULT_DOCS.includes(d));
@@ -78,6 +84,7 @@ async function init(configOptions, options, io, runCheck) {
 		})).length) matching.push(glob);
 		notes.push(declared ? `Found the design system through the config ${replaced.name} declares: ${matching.join(", ")}.` : `Found the design system in the default folders: ${matching.join(", ")}.`);
 		file.components = matching;
+		found = true;
 		if (declared && config.importPath) file.importPath = config.importPath;
 		const tokens = (await tokenFiles(config)).map(relative);
 		if (tokens.length) file.tokens = tokens;
@@ -110,6 +117,7 @@ async function init(configOptions, options, io, runCheck) {
 		const importPath = (await ask("How do apps import them? A package name such as @acme/ui, or leave it empty for tsconfig paths: ")).trim();
 		if (importPath) file.importPath = importPath;
 	}
+	if (!inherited && !workspace) notes.push(...await registryCode(config, file, found));
 	const written = [];
 	if (!inherited) {
 		const out = path.join(root, CONFIG_FILE);
@@ -161,6 +169,14 @@ async function init(configOptions, options, io, runCheck) {
 	const total = errors + warnings;
 	io.stdout(total ? `Dry run of \`${NAME} check .\`: ${count$1(errors, "error")} and ${count$1(warnings, "warning")} in ${flagged} of ${count$1(results.length, "file")}. By rule: ${[...byRule].sort((a, b) => b[1] - a[1]).map(([rule, n]) => `${rule} ${n.toLocaleString("en-US")}`).join(", ")}.` : `Dry run of \`${NAME} check .\`: no problems in ${count$1(results.length, "file")}.`);
 	for (const line of dry.stderr.split("\n").filter(Boolean)) io.stdout(line);
+	if (!workspace) {
+		const own = (await loadTarget({
+			...configOptions,
+			config: void 0
+		})).config;
+		const note = statusNote(await loadDesignSystem(own, { cache: options.cache }));
+		if (note) io.stdout(note);
+	}
 	const hasBaseline = [BASELINE_FILE, LEGACY_BASELINE_FILE].some((name) => fs.existsSync(path.join(root, name)));
 	let baselineWritten = false;
 	if (total && !hasBaseline) {
@@ -177,12 +193,115 @@ async function init(configOptions, options, io, runCheck) {
 			baselineWritten = fs.existsSync(path.join(root, BASELINE_FILE));
 		} else io.stdout(`No baseline written; \`${NAME} check . --update-baseline\` records one later.`);
 	}
-	const commit = [...written, ...baselineWritten ? [BASELINE_FILE] : []];
+	const instructed = await agentRules(root, ask, io);
+	const commit = [
+		...written,
+		...baselineWritten ? [BASELINE_FILE] : [],
+		...instructed
+	];
 	const files = commit.length > 1 ? `${commit.slice(0, -1).join(", ")} and ${commit.at(-1) ?? ""}` : commit[0];
 	io.stdout(designSystem && name ? registry ? `Next: commit ${files}. A workspace app that depends on ${name} now finds it with no config of its own: run \`npx ${NAME} inspect\` in one to see it, and give its team ${GUIDE_FILE}. An app that installs ${name} from a registry ${registry.next}.` : `Next: commit ${files}. An app that depends on ${name} now finds it with no config of its own: run \`npx ${NAME} inspect\` in one to see it, and give its team ${GUIDE_FILE}.` : `Next: ${files ? `commit ${files}, and ` : ""}run \`npx ${NAME} check . --format github --require-design-system\` in CI.`);
 	return 0;
 }
 const CONFIG_FILE = "onsystem.config.json";
+/** The status colors docs/tokens.md#status-colors adds, and the hue each one is. */
+const RECIPE = [
+	["success", "green"],
+	["warning", "yellow"],
+	["info", "blue"]
+];
+/**
+* Says which of success, warning and info the theme has no color for, and where the CSS that adds
+* them is: without one, an agent asked for a green "Active" label tends to reach for a chart or a
+* gray token, which loses what the color says. Nothing when the theme has no colors, or all three.
+*/
+function statusNote(ds) {
+	if (!ds.tokens.some((token) => token.category === "color")) return void 0;
+	const has = statusKinds(ds.tokens);
+	const missing = RECIPE.filter(([kind]) => !has.has(kind));
+	if (!missing.length) return void 0;
+	return `The theme has no ${orList(missing.map(([kind]) => kind))} token, so a ${orList(missing.map(([, hue]) => hue))} status color has no token to use, and agents tend to reach for a chart or gray token instead. To add ${missing.length === 1 ? "it" : "them"}: https://onsystem.vercel.app/docs/tokens#status-colors.`;
+}
+/** `success, warning or info`. */
+function orList(items) {
+	return items.length > 1 ? `${items.slice(0, -1).join(", ")} or ${items.at(-1) ?? ""}` : items[0] ?? "";
+}
+/** The instruction files agents read, which `init` offers to add onsystem's section to. */
+const AGENT_FILES = ["AGENTS.md", "CLAUDE.md"];
+const RULES_BEGIN = "<!-- BEGIN:onsystem-agent-rules -->";
+const RULES_END = "<!-- END:onsystem-agent-rules -->";
+/** onsystem's section of AGENTS.md or CLAUDE.md: the MCP tools, and the CLI for agents without them. */
+const AGENT_RULES = [
+	RULES_BEGIN,
+	"# Design system",
+	"",
+	`This project's UI is checked against its design system by ${NAME}.`,
+	"",
+	`- Before writing UI, look up its components, props, variants and tokens with the ${NAME} tools (\`list_components\`, \`get_component\`, \`get_tokens\`).`,
+	`- After changing a \`.tsx\` or \`.jsx\` file, run \`check_ui\` on it and fix every error. Without the ${NAME} tools, run \`npx -y ${NAME} check <file>\` instead.`,
+	RULES_END
+].join("\n");
+/**
+* Offers to add onsystem's section to the AGENTS.md and CLAUDE.md in the root, between markers a
+* later run updates in place, so agents that read them check the UI they write, through the CLI
+* when they have no MCP config. A CLAUDE.md that imports AGENTS.md (an `@AGENTS.md` line) is left
+* alone: Claude Code reads the section there. Asked only in a terminal, never with --yes; nothing
+* is asked when neither file exists or the section is current. Returns the files it wrote.
+*/
+async function agentRules(root, ask, io) {
+	if (!ask) return [];
+	const found = AGENT_FILES.flatMap((name) => {
+		const file = path.join(root, name);
+		try {
+			return [{
+				name,
+				file,
+				text: fs.readFileSync(file, "utf8")
+			}];
+		} catch {
+			return [];
+		}
+	});
+	const imports = (text) => /^\s*@(?:\.\/)?AGENTS\.md\s*$/m.test(text);
+	const changes = found.filter((f) => !(f.name === "CLAUDE.md" && imports(f.text) && found.length > 1)).map((f) => ({
+		...f,
+		next: withAgentRules(f.text)
+	})).filter((f) => f.next !== f.text);
+	if (!changes.length) return [];
+	const names = andList(changes.map((f) => f.name));
+	const update = changes.every((f) => rulesSection(f.text) !== void 0);
+	const answer = (await ask(update ? `Update the onsystem section in ${names}? [Y/n] ` : `Add a short onsystem section to ${names}, so coding agents check the UI they write? [Y/n] `)).trim().toLowerCase();
+	if (answer !== "" && !answer.startsWith("y")) {
+		io.stdout(`${names} ${changes.length === 1 ? "was" : "were"} left as ${changes.length === 1 ? "it is" : "they are"}.`);
+		return [];
+	}
+	for (const f of changes) fs.writeFileSync(f.file, f.next);
+	io.stdout(update ? `Updated the onsystem section in ${names}.` : `Added an onsystem section to ${names}: it tells agents to run check_ui, or \`npx -y ${NAME} check <file>\` without the ${NAME} tools, on the UI files they change.`);
+	return changes.map((f) => f.name);
+}
+/** `text` with onsystem's section: replaced between its markers, or added at the end. */
+function withAgentRules(text) {
+	const eol = text.includes("\r\n") ? "\r\n" : "\n";
+	const rules = AGENT_RULES.replaceAll("\n", eol);
+	const found = rulesSection(text);
+	if (found) return `${text.slice(0, found.start)}${rules}${text.slice(found.end)}`;
+	if (!text.trim()) return `${rules}${eol}`;
+	return `${text.endsWith("\n") ? text : `${text}${eol}`}${eol}${rules}${eol}`;
+}
+/**
+* Where onsystem's section is in `text`, from its BEGIN marker to the end of its END marker: the
+* first END with a BEGIN before it, and the BEGIN nearest that END. A BEGIN whose END was deleted
+* is then not a section, so the text after it, which may be the user's, is never replaced.
+*/
+function rulesSection(text) {
+	for (let end = text.indexOf(RULES_END); end !== -1; end = text.indexOf(RULES_END, end + 1)) {
+		const start = text.lastIndexOf(RULES_BEGIN, end);
+		if (start !== -1) return {
+			start,
+			end: end + 33
+		};
+	}
+}
 function readManifest(root) {
 	const file = path.join(root, "package.json");
 	try {
@@ -309,6 +428,113 @@ async function replacedNote(pkg, taken, own, cwd) {
 	];
 	return `${replaced} It ${effects}: ${(!components || taken.configured === true) && (!tokens || taken.tokensDetected !== true) ? `copy ${andList(fields)} from ${declared} into ${CONFIG_FILE}, or ` : ""}delete ${CONFIG_FILE} to take on ${pkg.name}'s config again.`;
 }
+const REGISTRY_DOCS = "https://onsystem.vercel.app/docs/configuration#code-from-shadcn-registries";
+/**
+* Sets apart the code `npx shadcn add` copies from the registries components.json names
+* (`"registries": { "@signoff-ui": … }`) into a folder of its own under the components alias
+* (`components/signoff-ui`). When `found` says "components" holds what zero config found, and
+* no `importPath` names a package for them, each such folder joins it: `check` and the hook skip
+* that code, as they skip components/ui, and the app's code is checked against its components.
+* A folder with no .tsx or .jsx file yet joins it too, and so does one that does not exist yet:
+* a registry is often named in components.json before its first `shadcn add`, and an item of
+* only .ts files (signoff-ui's ag-ui) makes the folder before a component comes. Otherwise the
+* notes name the folders `check` reads as the app's own code, and what to add to set them apart.
+* Folders the components already take in are left alone. Returns what to tell the user.
+*/
+async function registryCode(config, file, found) {
+	const root = config.root;
+	const folders = registryFolders(root, config.tsconfig);
+	if (!folders.length) return [];
+	const globs = Array.isArray(file.components) ? file.components : config.components;
+	const taken = new Set(await componentFiles({
+		...config,
+		components: globs
+	}));
+	const copied = [];
+	const pending = [];
+	const added = [];
+	for (const { namespace, dir } of folders) {
+		const glob = `${escapePath(dir)}/**/*.{tsx,jsx}`;
+		const files = await componentFiles({
+			...config,
+			components: [glob]
+		});
+		const folder = {
+			namespace,
+			dir,
+			glob,
+			files: files.length
+		};
+		if (files.some((f) => !taken.has(f))) copied.push(folder);
+		else if (files.length || globs.some((g) => matchesGlob(`${dir}/index.tsx`, g))) continue;
+		else pending.push(folder);
+		added.push(glob);
+	}
+	const add = found && file.importPath === void 0;
+	if (add && added.length) file.components = [...globs, ...added];
+	const listed = Array.isArray(file.components) && file.importPath === void 0;
+	const how = (list) => listed ? `add ${andList(list.map((f) => `"${f.glob}"`))} to "components" (${REGISTRY_DOCS})` : `turn the rules off for ${andList(list.map((f) => `"${escapePath(f.dir)}/**"`))} in "overrides" (${REGISTRY_DOCS})`;
+	const notes = [];
+	if (copied.length) {
+		const one = copied.length === 1;
+		notes.push(add ? `Added ${andList(copied.map((f) => `${f.dir} (${f.namespace}, ${count$1(f.files, "file")})`))} to "components": ${one ? "it holds" : "they hold"} the code \`shadcn add\` copied from ${one ? "that registry" : "those registries"} in components.json. \`check\` and the hook skip it as design-system code, and your code is checked against every component its files export, helpers included, so a native element such as <img> can be told to use one of them. To leave the helpers out, see ${REGISTRY_DOCS}; to check that code as your own, take ${one ? "the folder" : "the folders"} out of "components".` : `components.json names the ${one ? "registry" : "registries"} ${andList(copied.map((f) => f.namespace))}, which \`shadcn add\` copies into ${andList(copied.map((f) => f.dir))}: \`check\` reads ${one ? "its" : "their"} code as your own. To set it apart, ${how(copied)}.`);
+	}
+	if (pending.length) {
+		const one = pending.length === 1;
+		const state = pending.some((f) => isDirectory(path.join(root, f.dir))) ? `${one ? "holds" : "hold"} no .tsx or .jsx file yet` : `${one ? "does" : "do"} not exist yet`;
+		notes.push(add ? `${copied.length ? "Also added" : "Added"} ${andList(pending.map((f) => `${f.dir} (${f.namespace})`))} to "components", though ${one ? "it" : "they"} ${state}: \`check\` and the hook skip the code \`shadcn add\` copies there from ${one ? "that registry" : "those registries"} in components.json. Code a registry copies somewhere else, such as loose into ${path.posix.dirname(pending[0]?.dir ?? "")}/, is checked as your own (${REGISTRY_DOCS}).` : `components.json ${copied.length ? "also " : ""}names ${andList(pending.map((f) => f.namespace))}, and ${andList(pending.map((f) => f.dir))} ${state}: once \`shadcn add\` copies a .tsx or .jsx file there, \`check\` reads it as your own. To set it apart, ${how(pending)}.`);
+	}
+	return notes;
+}
+function isDirectory(dir) {
+	try {
+		return fs.statSync(dir).isDirectory();
+	} catch {
+		return false;
+	}
+}
+/**
+* The folders, relative to the root, that `npx shadcn add` copies the code of the registries
+* components.json names into: the components alias, resolved through tsconfig `paths`, and the
+* namespace without its `@` (`@/components` and `@signoff-ui` → `components/signoff-ui`).
+*/
+function registryFolders(root, tsconfig) {
+	let json;
+	try {
+		json = JSON.parse(fs.readFileSync(path.join(root, "components.json"), "utf8"));
+	} catch {
+		return [];
+	}
+	const alias = json?.aliases?.components;
+	const registries = json?.registries;
+	if (typeof alias !== "string" || !registries || typeof registries !== "object") return [];
+	const namespaces = Object.keys(registries).filter((n) => /^@[a-z0-9][\w-]*$/i.test(n)).sort();
+	const base = namespaces.length ? aliasFolder(alias, readProjectConfig(root, tsconfig)) : void 0;
+	if (!base || !isInside(root, base)) return [];
+	return namespaces.map((namespace) => ({
+		namespace,
+		dir: relativePath(root, path.join(base, namespace.slice(1)))
+	}));
+}
+/**
+* A components.json alias (`@/components`) through tsconfig `paths` (`"@/*": ["./*"]`), as zero
+* config resolves the ui alias, when the folder exists.
+*/
+function aliasFolder(alias, project) {
+	for (const [pattern, targets] of Object.entries(project.paths)) {
+		const star = pattern.indexOf("*");
+		const prefix = star === -1 ? pattern : pattern.slice(0, star);
+		const suffix = star === -1 ? "" : pattern.slice(star + 1);
+		if (!(star === -1 ? alias === pattern : alias.startsWith(prefix) && alias.endsWith(suffix) && alias.length >= prefix.length + suffix.length)) continue;
+		const middle = star === -1 ? "" : alias.slice(prefix.length, alias.length - suffix.length);
+		for (const target of targets) {
+			const dir = path.resolve(project.pathsBase, target.replace("*", middle));
+			try {
+				if (fs.statSync(dir).isDirectory()) return dir;
+			} catch {}
+		}
+	}
+}
 /** Whether npm's `files` list publishes `file`, a path relative to the package. */
 function ships(files, file) {
 	return files.some((entry) => {
@@ -419,6 +645,9 @@ Options
                           files, which are skipped by default
   --include-tests         check: also lint tests and stories (*.test.tsx,
                           *.spec.tsx, *.stories.tsx) in folders and globs
+  --skip-excluded         check: leave out files named outright that the config's
+                          exclude covers, as folders and globs leave them out
+                          (the Claude Code hook passes it)
   --quiet-without-design-system
                           check: print nothing and exit 0 when the project has no
                           design-system components and no config (tokens alone
@@ -426,7 +655,8 @@ Options
                           many projects
   --require-design-system
                           check: exit 2 when no components or no color tokens
-                          are found, so CI cannot pass by checking nothing
+                          are found, or when the folders and globs given leave
+                          no file to check, so CI cannot pass by checking nothing
   --explain               inspect: every candidate zero config looked at and why
                           it was taken or not, the resolved config, unresolved
                           tokens, and components whose props did not resolve
@@ -519,6 +749,10 @@ async function main(argv, io = defaultIo) {
 					type: "boolean",
 					default: false
 				},
+				"skip-excluded": {
+					type: "boolean",
+					default: false
+				},
 				"require-design-system": {
 					type: "boolean",
 					default: false
@@ -656,12 +890,30 @@ async function check(patterns, configOptions, values, io) {
 	warnDeprecated(configWarnings(target), format, io);
 	const selection = target.workspace ? await selectInWorkspace(target.workspace, patterns, values, format, io) : await selectInProject(target.config, patterns, values, format, io);
 	if (typeof selection === "number") return selection;
+	const command = (flag) => checkCommand(patterns, configOptions, values, flag);
+	if ("noMatch" in selection) {
+		const jsx = jsxNotice(selection, io.cwd, command);
+		io.stderr(jsx ? `check: nothing to check in ${patterns.join(" ")}. ${jsx}` : `check: no files match ${patterns.join(" ")}`);
+		return 2;
+	}
 	const { files, notes } = selection;
+	const notify = (text) => {
+		if (format === "pretty") io.stdout(text);
+		else if (format === "github") io.stdout(`::warning title=${NAME}::${text}`);
+		else io.stderr(text);
+	};
+	const jsx = jsxNotice(selection, io.cwd, command);
 	if (!files.length) {
-		if (format === "pretty") {
-			const hints = [selection.skipped ? `Pass --include-design-system to check ${selection.skipped === 1 ? "it" : "them"}.` : "", selection.testsLeftOut ? "Pass --include-tests to check tests and stories." : ""].filter(Boolean);
-			io.stdout(`Nothing to check: ${notes.join("; ")}. ${hints.join(" ")}`.trimEnd());
-		} else printNoResults(format, io);
+		const hints = jsx ? [jsx] : [selection.skipped ? `Pass --include-design-system to check ${selection.skipped === 1 ? "it" : "them"}.` : "", selection.testsLeftOut ? "Pass --include-tests to check tests and stories." : ""].filter(Boolean);
+		if (values["require-design-system"] && selection.searched) {
+			io.stderr(`check --require-design-system: nothing was checked${notes.length ? ` (${notes.join("; ")})` : ""}. ${hints.join(" ")}`.trimEnd());
+			return 2;
+		}
+		if (format === "pretty") io.stdout(`Nothing to check${notes.length ? `: ${notes.join("; ")}` : ""}. ${hints.join(" ")}`.trimEnd());
+		else {
+			printNoResults(format, io);
+			if (jsx) notify(jsx);
+		}
 		return 0;
 	}
 	const update = values["update-baseline"];
@@ -684,17 +936,20 @@ async function check(patterns, configOptions, values, io) {
 	};
 	const disabledByKey = /* @__PURE__ */ new Map();
 	const realRoot = fs.realpathSync.native(selection.root);
-	const baselineKey = (file) => relativePath(realRoot, fs.realpathSync.native(file)).normalize("NFC");
+	const folders = patterns.map((pattern) => path.resolve(io.cwd, pattern)).filter((dir) => fs.statSync(dir, { throwIfNoEntry: false })?.isDirectory()).map(realPath);
+	const changedLines = baseline && !update ? readChangedLines(io.env ?? process.env, io.cwd) : void 0;
 	const results = [];
 	const checked = /* @__PURE__ */ new Map();
 	const ran = /* @__PURE__ */ new Set();
 	let baselined = 0;
 	let fixed = 0;
+	const unrecorded = [];
 	for (const file of files) {
 		const code = await fsp.readFile(file, "utf8");
 		const ds = selection.designSystemOf(file);
 		let result = ds.check(code, relativePath(ds.root, file));
-		const key = baselineKey(file);
+		const real = fs.realpathSync.native(file);
+		const key = relativePath(realRoot, real).normalize("NFC");
 		const disabled = disabledFor(file);
 		disabledByKey.set(key, disabled);
 		if (update || prune) checked.set(key, result.diagnostics);
@@ -702,28 +957,59 @@ async function check(patterns, configOptions, values, io) {
 			for (const rule of RULE_IDS) if (!disabled.has(rule) && canRun(ds, rule)) ran.add(rule);
 		}
 		if (baseline && !update) {
-			const match = applyBaseline(baseline.entries, key, result, disabled);
-			result = {
-				...match.result,
-				baselined: match.baselined
-			};
-			baselined += match.baselined;
-			fixed += match.fixed;
+			const changed = changedLines?.get(real);
+			if (baseline.entries.has(key)) {
+				const match = applyBaseline(baseline.entries, key, result, disabled, changed);
+				result = {
+					...match.result,
+					baselined: match.baselined
+				};
+				baselined += match.baselined;
+				fixed += match.fixed;
+			} else unrecorded.push({
+				index: results.length,
+				key,
+				result,
+				disabled,
+				changed
+			});
 		}
 		results.push({
 			...result,
 			file: relativePath(io.cwd, file)
 		});
 	}
+	let moves = /* @__PURE__ */ new Map();
+	if (baseline && !update) {
+		const covered = (key) => folders.some((dir) => isInside(dir, path.join(realRoot, key)));
+		const matching = unrecorded.some((u) => u.result.diagnostics.length);
+		const gone = goneFiles(baseline.entries, realRoot, new Set(disabledByKey.keys()), (key) => matching || covered(key));
+		const changedIn = new Map(unrecorded.map((u) => [u.key, u.changed]));
+		moves = findMoves(baseline.entries, new Map(unrecorded.map((u) => [u.key, u.result.diagnostics])), gone, (key) => disabledByKey.get(key) ?? /* @__PURE__ */ new Set(), (key, diagnostic) => onLines(changedIn.get(key), diagnostic));
+		for (const { index, key, result, disabled, changed } of unrecorded) {
+			const from = moves.get(key) ?? key;
+			const match = applyBaseline(baseline.entries, from, result, disabled, changed);
+			const file = results[index]?.file ?? result.file;
+			results[index] = {
+				...match.result,
+				baselined: match.baselined,
+				file
+			};
+			baselined += match.baselined;
+			fixed += match.fixed;
+		}
+		const moved = new Set(moves.values());
+		for (const key of gone) {
+			const rules = baseline.entries.get(key);
+			if (rules && !moved.has(key) && covered(key)) fixed += countBaseline(/* @__PURE__ */ new Map([[key, rules]])).findings;
+		}
+	}
 	const elsewhere = results.filter((r) => r.skipped).length;
 	if (elsewhere) notes.push(`${plural(elsewhere, "image or email file")} not checked`);
 	const unchecked = uncheckedNotice(results);
 	if (update) {
 		const next = updateBaseline(baseline?.entries, checked, realRoot, (key) => disabledByKey.get(key) ?? /* @__PURE__ */ new Set());
-		const wholeRoot = patterns.some((pattern) => {
-			const dir = path.resolve(io.cwd, pattern);
-			return Boolean(fs.statSync(dir, { throwIfNoEntry: false })?.isDirectory() && isInside(realPath(dir), realRoot));
-		});
+		const wholeRoot = folders.some((dir) => isInside(dir, realRoot));
 		writeBaseline(baselineFile, next, {
 			onsystem: VERSION,
 			rules: rulesRun(baseline, next, checked, ran, wholeRoot)
@@ -734,9 +1020,9 @@ async function check(patterns, configOptions, values, io) {
 		else io.stderr(summary);
 		for (const text of selection.notices) io.stderr(text);
 		if (unchecked) io.stderr(unchecked);
+		if (jsx) io.stderr(jsx);
 		return 0;
 	}
-	const command = (flag) => checkCommand(patterns, configOptions, values, flag);
 	const baselineNotes = [];
 	if (baseline) {
 		const fresh = results.flatMap((r) => r.diagnostics);
@@ -744,15 +1030,16 @@ async function check(patterns, configOptions, values, io) {
 		if (unrecorded.size) baselineNotes.push(unrecordedNote(unrecorded, fresh.length, baseline.onsystem, command("--update-baseline")));
 	}
 	if (prune && baseline) {
-		const next = pruneBaseline(baseline.entries, checked, realRoot, (key) => disabledByKey.get(key) ?? /* @__PURE__ */ new Set());
+		const next = pruneBaseline(baseline.entries, checked, realRoot, (key) => disabledByKey.get(key) ?? /* @__PURE__ */ new Set(), moves);
 		const left = countBaseline(next);
 		const dropped = countBaseline(baseline.entries).findings - left.findings;
-		if (dropped) writeBaseline(baselineFile, next, {
+		if (dropped || moves.size) writeBaseline(baselineFile, next, {
 			onsystem: baseline.onsystem,
 			rules: baseline.rules
 		});
-		baselineNotes.push(`Baseline: ${dropped ? `dropped ${count(dropped, "finding")} that no longer ${dropped === 1 ? "occurs" : "occur"}` : "nothing to drop"}; ${count(left.findings, "finding")} in ${count(left.files, "file")} → ${displayPath(io.cwd, baselineFile)}`);
-	}
+		const done = [moves.size ? `moved the findings of ${count(moves.size, "file")} to ${moves.size === 1 ? "its new path" : "their new paths"}` : "", dropped ? `dropped ${count(dropped, "finding")} that no longer ${dropped === 1 ? "occurs" : "occur"}` : ""].filter(Boolean);
+		baselineNotes.push(`Baseline: ${done.join("; ") || "nothing to drop"}; ${count(left.findings, "finding")} in ${count(left.files, "file")} → ${displayPath(io.cwd, baselineFile)}`);
+	} else if (moves.size) baselineNotes.push(movedNote(moves, command("--prune-baseline")));
 	const output = formatDiagnostics(format === "json" ? results : results.filter((r) => !r.skipped), format, {
 		color: io.color,
 		uri: format === "sarif" || format === "github" ? repositoryPath(io.cwd, io.env ?? process.env) : void 0,
@@ -764,12 +1051,11 @@ async function check(patterns, configOptions, values, io) {
 	for (const text of baselineNotes) if (format === "pretty") io.stdout(text);
 	else if (format === "github") io.stdout(`::notice title=${NAME} baseline::${escapeData(text)}`);
 	else io.stderr(text);
-	for (const text of [...selection.notices, unchecked]) {
-		if (!text) continue;
-		if (format === "pretty") io.stdout(text);
-		else if (format === "github") io.stdout(`::warning title=${NAME}::${text}`);
-		else io.stderr(text);
-	}
+	for (const text of [
+		...selection.notices,
+		unchecked,
+		jsx
+	]) if (text) notify(text);
 	const errors = results.reduce((n, r) => n + r.errorCount, 0);
 	const warnings = results.reduce((n, r) => n + r.warningCount, 0);
 	if (errors > 0) return 1;
@@ -808,10 +1094,15 @@ function repositoryPath(cwd, env) {
 		return root ? relativePath(root, absolute) : toPosix(file);
 	};
 }
-/** Splits the patterns into files named outright and globs (a folder: every TSX/JSX file under it). */
+/**
+* Splits the patterns into files named outright and globs (a folder: every TSX/JSX file under
+* it). `scripts` globs the `.js` files under the folders, which are not checked, to say which
+* of them have JSX.
+*/
 function expandPatterns(patterns, cwd) {
 	const named = [];
 	const globs = [];
+	const scripts = [];
 	for (const pattern of patterns) {
 		const stat = fs.statSync(path.resolve(cwd, pattern), { throwIfNoEntry: false });
 		if (stat && !stat.isDirectory()) {
@@ -819,47 +1110,131 @@ function expandPatterns(patterns, cwd) {
 			continue;
 		}
 		const literal = stat ? escapePath(toPosix(path.join(pattern, "."))) : toPosix(pattern);
-		globs.push(!stat ? literal : literal === "." ? "**/*.{tsx,jsx}" : `${literal}/**/*.{tsx,jsx}`);
+		if (!stat) {
+			globs.push(literal);
+			continue;
+		}
+		const under = literal === "." ? "**/*" : `${literal}/**/*`;
+		globs.push(`${under}.{tsx,jsx}`);
+		scripts.push(`${under}.js`);
 	}
 	return {
 		named,
-		globs
+		globs,
+		scripts
 	};
 }
+/** A `.js` file larger than this is a bundle or generated, not a page: not read for JSX. */
+const MAX_PAGE_BYTES = 524288;
+/**
+* `.js` files the folders hold that have JSX, which are not checked: folders expand to TSX and
+* JSX files, and a JavaScript app writes its pages as `.js` (Next.js's JavaScript template has
+* `app/page.js`). Files the run checks anyway (a glob names them), what git ignores and what
+* `leftOut` says (the config's `exclude`, the design system's own files) are not counted, nor
+* are minified files and files over 512 KB, which are bundles rather than pages.
+*/
+async function jsxLeftOut(scripts, taken, cwd, leftOut) {
+	if (!scripts.length) return [];
+	const checked = new Set(taken.map(realPath));
+	const found = oncePerFile((await findFiles(scripts, {
+		cwd,
+		absolute: true,
+		expandDirectories: false,
+		ignore: ["**/node_modules/**", "**/*.min.js"]
+	})).filter((file) => !checked.has(realPath(file)))).sort();
+	const ignored = gitIgnored(cwd, found);
+	const files = [];
+	for (const file of found) {
+		if (ignored.has(file) || await leftOut(file)) continue;
+		let code;
+		try {
+			if (fs.statSync(file).size > MAX_PAGE_BYTES) continue;
+			code = fs.readFileSync(file, "utf8");
+		} catch {
+			continue;
+		}
+		if (hasJsx(code)) files.push(file);
+	}
+	return files;
+}
+/**
+* Where a JSX element can start: after `(`, `,`, `=`, `=>`, `?` (not a regex's `(?<name>`), `:`,
+* `[`, `{`, `&`, `|`, `return`, `yield`, `await` or `default`, with spaces and short comments
+* between. Plain JavaScript has a `<` and a name there only in strings and comments.
+*/
+const JSX_START = /(?:(?<!\()\?|=>|[(,=:[{&|]|\b(?:return|yield|await|default))(?:\s|\/\/[^\n]{0,200}\n|\/\*(?:[^*]|\*(?!\/)){0,500}\*\/)*<([A-Za-z][\w.:-]*|>(?=[\s<{]))/g;
+/**
+* Whether the code may have JSX: an element starts where only JSX can start one, and it is a
+* fragment, its closing tag is there, or a `/>` follows it. A library bundle whose strings hold
+* HTML rarely passes, so most `.js` files are never parsed.
+*/
+function mayHaveJsx(code) {
+	for (const match of code.matchAll(JSX_START)) {
+		const name = match[1] ?? "";
+		if (name === ">" || code.includes(`</${name}>`)) return true;
+		const from = match.index + match[0].length;
+		const close = code.indexOf("/>", from);
+		if (close >= 0 && close - from < 2e3) return true;
+	}
+	return false;
+}
+/** Whether the code has a JSX element or fragment. */
+function hasJsx(code) {
+	if (!code.includes("/>") && !code.includes("</")) return false;
+	if (!mayHaveJsx(code)) return false;
+	const source = ts.createSourceFile("file.js", code, ts.ScriptTarget.Latest, false, ts.ScriptKind.JSX);
+	const visit = (node) => ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node) || ts.forEachChild(node, visit) === true;
+	try {
+		return visit(source);
+	} catch {
+		return false;
+	}
+}
+/** Which `.js` files with JSX the folders left out, and the command that checks them. */
+function jsxNotice(selection, cwd, command) {
+	const files = selection.jsx.map((file) => relativePath(cwd, file));
+	if (!files.length) return void 0;
+	const check = command(selection.jsxGlobs.map(shellQuote).join(" "));
+	return files.length === 1 ? `${files[0] ?? ""} has JSX, but folders are checked for .tsx and .jsx files, so it was not checked. Name it to check it: \`${check}\`.` : `${files.length.toLocaleString("en-US")} .js files have JSX (${listOf(files)}), but folders are checked for .tsx and .jsx files, so they were not checked. Name them to check them: \`${check}\`.`;
+}
 /** One project: the root's config and design system for every file. */
 async function selectInProject(config, patterns, values, format, io) {
 	const ds = await loadDesignSystem(config, {
 		cache: values.cache,
 		logger: silentLogger
 	});
-	const { named, globs } = expandPatterns(patterns, io.cwd);
+	const { named: given, globs, scripts } = expandPatterns(patterns, io.cwd);
 	const options = {
 		cwd: io.cwd,
 		absolute: true,
 		expandDirectories: false
 	};
-	const all = globs.length ? await findFiles(globs, {
+	const globbed = globs.length ? await findFiles(globs, {
 		...options,
 		ignore: ["**/node_modules/**"]
 	}) : [];
-	const excludes = config.exclude.filter((e) => !(values["include-tests"] && isTestPattern(e))).map((e) => excludeFromCwd(e, config.root, io.cwd)).filter((e) => e !== void 0);
-	const kept = globs.length ? await findFiles(globs, {
-		...options,
-		ignore: unique(["**/node_modules/**", ...excludes])
-	}) : [];
+	const named = given.filter((file) => SCRIPT_FILE.test(file));
+	const all = globbed.filter((file) => SCRIPT_FILE.test(file));
+	const excluded = (file) => excludedBy(config, relativePath(config.root, file), { includeTests: values["include-tests"] }) !== void 0;
+	const ownFiles = async () => new Set(config.includeDesignSystem ? [] : (await componentFiles(config)).map(realPath));
+	const jsxIn = (taken, own) => jsxLeftOut(scripts, taken, io.cwd, (file) => excluded(file) || own.has(realPath(file)));
+	const skip = values["skip-excluded"];
+	const leftOut = unique([...skip ? named : [], ...all]).filter(excluded);
+	const leftOutSet = new Set(leftOut);
+	const kept = all.filter((file) => !leftOutSet.has(file));
 	const ignored = gitIgnored(io.cwd, kept);
-	const keptSet = new Set(kept);
-	const leftOut = all.filter((file) => !keptSet.has(file));
 	const left = {
 		tests: leftOut.filter((file) => TEST_FILE.test(file)).length,
 		excluded: leftOut.filter((file) => !TEST_FILE.test(file)).length,
-		gitignored: ignored.size
+		gitignored: ignored.size,
+		notScripts: notScripts(given, globbed)
+	};
+	let files = oncePerFile([...skip ? named.filter((file) => !leftOutSet.has(file)) : named, ...kept.filter((file) => !ignored.has(file))]).sort();
+	if (!files.length && !all.length && !leftOut.length && !left.notScripts) return {
+		noMatch: true,
+		jsx: scripts.length ? await jsxIn([], await ownFiles()) : [],
+		jsxGlobs: scripts
 	};
-	let files = oncePerFile([...named, ...kept.filter((file) => !ignored.has(file))]).sort();
-	if (!files.length && !all.length) {
-		io.stderr(`check: no files match ${patterns.join(" ")}`);
-		return 2;
-	}
 	if (values["quiet-without-design-system"] && !config.configFile && !ds.components.length) {
 		printNoResults(format, io);
 		return 0;
@@ -871,12 +1246,13 @@ async function selectInProject(config, patterns, values, format, io) {
 		return 2;
 	}
 	let skipped = 0;
-	if (!config.includeDesignSystem) {
-		const own = new Set((await componentFiles(config)).map(realPath));
+	const own = await ownFiles();
+	if (own.size) {
 		const rest = files.filter((file) => !own.has(realPath(file)));
 		skipped = files.length - rest.length;
 		files = rest;
 	}
+	const jsx = await jsxIn([...named, ...all], own);
 	return {
 		files,
 		designSystemOf: () => ds,
@@ -884,7 +1260,10 @@ async function selectInProject(config, patterns, values, format, io) {
 		notes: scopeNotes(skipped, left),
 		notices: [...notice ? [notice] : [], ...notReadNotices([{ ds }])],
 		skipped,
-		testsLeftOut: left.tests
+		testsLeftOut: left.tests,
+		jsx,
+		jsxGlobs: scripts,
+		searched: globs.length > 0
 	};
 }
 /**
@@ -893,13 +1272,15 @@ async function selectInProject(config, patterns, values, format, io) {
 * config, exactly as `check` from that folder (and the Claude Code hook) would check it.
 */
 async function selectInWorkspace(workspace, patterns, values, format, io) {
-	const { named, globs } = expandPatterns(patterns, io.cwd);
-	const all = globs.length ? await findFiles(globs, {
+	const { named: given, globs, scripts } = expandPatterns(patterns, io.cwd);
+	const globbed = globs.length ? await findFiles(globs, {
 		cwd: io.cwd,
 		absolute: true,
 		expandDirectories: false,
 		ignore: ["**/node_modules/**"]
 	}) : [];
+	const named = given.filter((file) => SCRIPT_FILE.test(file));
+	const all = globbed.filter((file) => SCRIPT_FILE.test(file));
 	const projectOf = /* @__PURE__ */ new Map();
 	for (const file of unique([...named, ...all])) projectOf.set(file, await workspace.projectFor(file));
 	const project = (file) => {
@@ -919,24 +1300,42 @@ async function selectInWorkspace(workspace, patterns, values, format, io) {
 		}
 		return ds;
 	};
-	const leftOut = all.filter((file) => {
+	const excluded = (file) => {
 		const { root, config } = project(file);
 		const relative = relativePath(root, file);
-		return config.exclude.some((e) => !(values["include-tests"] && isTestPattern(e)) && matchesGlob(relative, e));
-	});
+		return excludedBy(config, relative, { includeTests: values["include-tests"] }) !== void 0;
+	};
+	const skip = values["skip-excluded"];
+	const leftOut = unique([...skip ? named : [], ...all]).filter(excluded);
 	const leftOutSet = new Set(leftOut);
 	const kept = all.filter((file) => !leftOutSet.has(file));
 	const ignored = gitIgnored(io.cwd, kept);
 	const left = {
 		tests: leftOut.filter((file) => TEST_FILE.test(file)).length,
 		excluded: leftOut.filter((file) => !TEST_FILE.test(file)).length,
-		gitignored: ignored.size
+		gitignored: ignored.size,
+		notScripts: notScripts(given, globbed)
+	};
+	let files = oncePerFile([...skip ? named.filter((file) => !leftOutSet.has(file)) : named, ...kept.filter((file) => !ignored.has(file))]).sort();
+	const own = /* @__PURE__ */ new Map();
+	const ownFiles = async (p) => {
+		let mine = own.get(p.root);
+		if (!mine) {
+			mine = new Set(p.config.includeDesignSystem ? [] : (await componentFiles(p.config)).map(realPath));
+			own.set(p.root, mine);
+		}
+		return mine;
+	};
+	const jsxIn = (taken) => jsxLeftOut(scripts, taken, io.cwd, async (file) => {
+		const p = await workspace.projectFor(file);
+		projectOf.set(file, p);
+		return excluded(file) || (await ownFiles(p)).has(realPath(file));
+	});
+	if (!files.length && !all.length && !leftOut.length && !left.notScripts) return {
+		noMatch: true,
+		jsx: await jsxIn([]),
+		jsxGlobs: scripts
 	};
-	let files = oncePerFile([...named, ...kept.filter((file) => !ignored.has(file))]).sort();
-	if (!files.length && !all.length) {
-		io.stderr(`check: no files match ${patterns.join(" ")}`);
-		return 2;
-	}
 	const loaded = /* @__PURE__ */ new Map();
 	for (const p of unique(files.map(project))) loaded.set(p.root, await load(p));
 	const designSystemOf = (file) => {
@@ -963,14 +1362,11 @@ async function selectInWorkspace(workspace, patterns, values, format, io) {
 			return 2;
 		}
 	}
-	const own = /* @__PURE__ */ new Map();
-	for (const p of unique(files.map(project))) {
-		if (p.config.includeDesignSystem) continue;
-		own.set(p.root, new Set((await componentFiles(p.config)).map(realPath)));
-	}
+	for (const p of unique(files.map(project))) await ownFiles(p);
 	const rest = files.filter((file) => !own.get(project(file).root)?.has(realPath(file)));
 	const skipped = files.length - rest.length;
 	files = rest;
+	const jsx = await jsxIn([...named, ...all]);
 	const gaps = /* @__PURE__ */ new Map();
 	for (const p of unique(files.map(project))) {
 		const ds = loaded.get(p.root);
@@ -1000,7 +1396,10 @@ async function selectInWorkspace(workspace, patterns, values, format, io) {
 		notes: [...used > 1 ? [plural(used, "project")] : [], ...scopeNotes(skipped, left)],
 		notices: notices.filter(Boolean),
 		skipped,
-		testsLeftOut: left.tests
+		testsLeftOut: left.tests,
+		jsx,
+		jsxGlobs: scripts,
+		searched: globs.length > 0
 	};
 }
 /** `apps/web`, `apps/web and packages/ui`, `a, b, c and 4 more`. */
@@ -1226,9 +1625,12 @@ function defaultBaseline(root, warn) {
 }
 /** Tests and stories, which `check` leaves out of folders and globs unless asked. */
 const TEST_FILE = /\.(?:test|spec|stories)\.[cm]?[jt]sx?$|[\\/]__(?:tests|stories|mocks)__[\\/]/;
-/** The default patterns `--include-tests` lifts. */
-function isTestPattern(pattern) {
-	return pattern === "**/*.{test,spec,stories}.{ts,tsx,js,jsx}" || pattern === "**/__{tests,stories,mocks}__/**";
+/**
+* How many of the files named outright or matched by a glob are not JS or TS (styles, docs,
+* JSON), which are not checked.
+*/
+function notScripts(named, globbed) {
+	return oncePerFile([...named, ...globbed].filter((file) => !SCRIPT_FILE.test(file))).length;
 }
 /** What a run left out, for the summary line: `5 design-system files skipped`. */
 function scopeNotes(skipped, left) {
@@ -1236,22 +1638,11 @@ function scopeNotes(skipped, left) {
 		skipped ? `${plural(skipped, "design-system file")} skipped` : "",
 		left.tests ? `${left.tests.toLocaleString("en-US")} ${left.tests === 1 ? "test or story" : "tests and stories"} left out` : "",
 		left.excluded ? `${plural(left.excluded, "excluded file")} left out` : "",
-		left.gitignored ? `${plural(left.gitignored, "file")} git ignores left out` : ""
+		left.gitignored ? `${plural(left.gitignored, "file")} git ignores left out` : "",
+		left.notScripts ? `${plural(left.notScripts, "file")} that ${left.notScripts === 1 ? "is" : "are"} not JS or TS skipped` : ""
 	].filter(Boolean);
 }
 /**
-* A config `exclude` pattern, relative to the root, as a pattern relative to the
-* working directory the globs run from; undefined when it only covers files
-* outside that directory. `**\/` patterns hold anywhere.
-*/
-function excludeFromCwd(pattern, root, cwd) {
-	if (pattern.startsWith("**/")) return pattern;
-	const fromRoot = toPosix(path.relative(root, cwd));
-	if (!fromRoot) return pattern;
-	if (fromRoot.startsWith("..")) return toPosix(path.join(path.relative(cwd, root), pattern));
-	return pattern.startsWith(`${fromRoot}/`) ? pattern.slice(fromRoot.length + 1) : void 0;
-}
-/**
 * Files a glob matches, as Node spells absolute paths (with backslashes on Windows, where
 * tinyglobby gives forward slashes), so they compare equal to `path.resolve` and git's.
 */
@@ -1302,6 +1693,7 @@ function checkCommand(patterns, configOptions, values, flag) {
 	option("baseline", values.baseline);
 	if (configOptions.includeDesignSystem !== void 0) args.push(`--${configOptions.includeDesignSystem ? "" : "no-"}include-design-system`);
 	if (values["include-tests"]) args.push("--include-tests");
+	if (values["skip-excluded"]) args.push("--skip-excluded");
 	return `check ${args.map(shellQuote).join(" ")} ${flag}`;
 }
 /**
@@ -1320,6 +1712,40 @@ function canRun(ds, rule) {
 		default: return ds.model.components.length > 0;
 	}
 }
+/** Says which files the baseline takes for moved, and how to record their new paths. */
+function movedNote(moves, prune) {
+	const pairs = [...moves].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	const [first] = pairs;
+	if (pairs.length === 1 && first) return `Baseline: ${first[0]} has the findings recorded for ${first[1]}, which no longer exists, so they are accepted as moved. Run \`${prune}\` to record the new path.`;
+	const list = listOf(pairs.map(([to, from]) => `${from} → ${to}`));
+	return `Baseline: ${pairs.length} files have the findings recorded for files that no longer exist, so they are accepted as moved (${list}). Run \`${prune}\` to record the new paths.`;
+}
+/** The variable the GitHub Action names the pull request's changed lines in. */
+const CHANGED_LINES = "ONSYSTEM_CHANGED_LINES";
+/**
+* The lines a pull request changed, by the real path of each file: the JSON file that
+* ONSYSTEM_CHANGED_LINES names maps paths to 1-based ranges, `{ "/repo/app/page.tsx": [[4, 4]] }`.
+* The GitHub Action writes it. Undefined when the variable is not set.
+*/
+function readChangedLines(env, cwd) {
+	const file = env[CHANGED_LINES]?.trim();
+	if (!file) return void 0;
+	const fail = (why) => new ConfigError(`${CHANGED_LINES}: ${why}. The GitHub Action sets this variable to a file of the lines a pull request changed; unset it when you run check yourself.`);
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(path.resolve(cwd, file), "utf8"));
+	} catch (error) {
+		throw fail(`could not read ${file}: ${error.message}`);
+	}
+	const range = (value) => Array.isArray(value) && value.length === 2 && value.every((n) => Number.isInteger(n));
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw fail(`${file} must map files to line ranges`);
+	const lines = /* @__PURE__ */ new Map();
+	for (const [name, ranges] of Object.entries(parsed)) {
+		if (!Array.isArray(ranges) || !ranges.every(range)) throw fail(`${file} › "${name}" must be a list of [start, end] lines`);
+		lines.set(realPath(path.resolve(cwd, name)), ranges);
+	}
+	return lines;
+}
 /** Why findings of rules that did not run when the baseline was recorded are new to it. */
 function unrecordedNote(byRule, total, version, update) {
 	const rules = [...byRule.keys()].sort();