paperlint 3.1.3 → 4.0.0

package/scripts/coverage-config.test.ts

@@ -23,24 +23,26 @@ import { spawnSync } from "node:child_process";
 import { globSync, readFileSync } from "node:fs";
 import { dirname, join, matchesGlob, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-// @ts-expect-error — js-yaml ships no types, and the package does not depend on @types/js-yaml
 import yaml from "js-yaml";
 import ts from "typescript";
 import { test } from "vitest";
+import { z } from "zod";
 
 const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
-const CONFIG = JSON.parse(readFileSync(join(ROOT, ".c8rc.json"), "utf8")) as {
-  lines: number;
-  statements: number;
-  functions: number;
-  branches: number;
-  excludeAfterRemap: boolean;
-  include: string[];
-  exclude: string[];
-  extension: string[];
-  typeOnly: string[];
-  evalOnly: string[];
-};
+const CONFIG = z
+  .object({
+    lines: z.number(),
+    statements: z.number(),
+    functions: z.number(),
+    branches: z.number(),
+    excludeAfterRemap: z.boolean(),
+    include: z.array(z.string()),
+    exclude: z.array(z.string()),
+    extension: z.array(z.string()),
+    typeOnly: z.array(z.string()),
+    evalOnly: z.array(z.string()),
+  })
+  .parse(JSON.parse(readFileSync(join(ROOT, ".c8rc.json"), "utf8")));
 
 const expand = (patterns: readonly string[]): string[] =>
   patterns.flatMap((p) => globSync(p, { cwd: ROOT })).sort();
@@ -53,13 +55,45 @@ export function runtimeStatements(fileName: string, source: string): string[] {
       (s) =>
         !ts.isInterfaceDeclaration(s) &&
         !ts.isTypeAliasDeclaration(s) &&
-        !(ts.isImportDeclaration(s) && s.importClause?.isTypeOnly) &&
+        !(
+          ts.isImportDeclaration(s) &&
+          s.importClause?.phaseModifier === ts.SyntaxKind.TypeKeyword
+        ) &&
         !(ts.isExportDeclaration(s) && s.isTypeOnly),
     )
     .map((s) => ts.SyntaxKind[s.kind]);
 }
 
 /** Every relative module specifier a source imports, statically or with `import("…")`. */
+/**
+ * The package's subpath imports (`#lib/*`, `#eslint-rules/*`), each as its prefix and the source
+ * file pattern its `paperlint-source` condition names — so an import written `#lib/x` is followed
+ * to `lib/x.ts` like a relative one, instead of being skipped as a bare package name.
+ */
+const SUBPATHS = Object.entries(
+  z
+    .object({
+      imports: z.record(
+        z.string().endsWith("/*"),
+        z.object({ "paperlint-source": z.string() }),
+      ),
+    })
+    .parse(JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")))
+    .imports,
+).map(([key, t]) => ({
+  prefix: key.slice(0, -"*".length),
+  target: t["paperlint-source"],
+}));
+
+/** Where a specifier points inside the repository: a relative path, or a subpath import's source. */
+function resolvedSpecifier(fileName: string, spec: string): string[] {
+  if (spec.startsWith(".")) return [resolve(dirname(fileName), spec)];
+  return SUBPATHS.filter(({ prefix }) => spec.startsWith(prefix)).map(
+    ({ prefix, target }) =>
+      resolve(ROOT, target.replace("*", spec.slice(prefix.length))),
+  );
+}
+
 export function importedPaths(fileName: string, source: string): string[] {
   const sf = ts.createSourceFile(fileName, source, ts.ScriptTarget.Latest);
   const found: string[] = [];
@@ -70,8 +104,8 @@ export function importedPaths(fileName: string, source: string): string[] {
           node.expression.kind === ts.SyntaxKind.ImportKeyword
         ? node.arguments[0]
         : undefined;
-    if (spec && ts.isStringLiteral(spec) && spec.text.startsWith("."))
-      found.push(resolve(dirname(fileName), spec.text));
+    if (spec && ts.isStringLiteral(spec))
+      found.push(...resolvedSpecifier(fileName, spec.text));
     ts.forEachChild(node, visit);
   };
   visit(sf);
@@ -179,7 +213,10 @@ export function comments(fileName: string, source: string): string[] {
   const visit = (node: ts.Node): void => {
     if (ts.isJSDoc(node)) return; // its text is the comment already collected before its node
     const kids = node.getChildren(sf);
-    if (kids.length > 0) return kids.forEach(visit);
+    if (kids.length > 0) {
+      kids.forEach(visit);
+      return;
+    }
     for (const r of [
       ...(ts.getLeadingCommentRanges(source, node.pos) ?? []),
       ...(ts.getTrailingCommentRanges(source, node.end) ?? []),
@@ -234,32 +271,36 @@ test("the floor is 100 on all four measures, and the script that checks it canno
     [CONFIG.lines, CONFIG.statements, CONFIG.functions, CONFIG.branches],
     [100, 100, 100, 100],
   );
-  const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")) as {
-    scripts: Record<string, string>;
-  };
+  const pkg = z
+    .object({ scripts: z.record(z.string(), z.string()) })
+    .parse(JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")));
   // Pinned whole: c8's command-line flags override .c8rc.json, so `--lines 50` or `--exclude "**"`
   // added here would bypass every threshold and the pinned exclude list below.
   assert.equal(
     pkg.scripts["coverage"],
-    'NODE_OPTIONS="--import=./test/coverage-src.mjs $NODE_OPTIONS" c8 --check-coverage npm test --',
+    'NODE_OPTIONS="--import=./test/coverage-src.ts $NODE_OPTIONS" c8 --check-coverage npm test --',
   );
 });
 
 /** The gates job and the one step of it that runs coverage, read from the parsed workflow. */
-interface Step {
-  readonly run?: string;
-  readonly if?: unknown;
-  readonly "continue-on-error"?: unknown;
-}
-interface Job {
-  readonly if?: unknown;
-  readonly "continue-on-error"?: unknown;
-  readonly steps?: readonly Step[];
-}
+const StepSchema = z.looseObject({
+  run: z.string().optional(),
+  if: z.unknown().optional(),
+  "continue-on-error": z.unknown().optional(),
+});
+const JobSchema = z.looseObject({
+  if: z.unknown().optional(),
+  "continue-on-error": z.unknown().optional(),
+  steps: z.array(StepSchema).optional(),
+});
+type Step = z.infer<typeof StepSchema>;
+type Job = z.infer<typeof JobSchema>;
 export function coverageSteps(
   workflow: string,
 ): { job: string; definition: Job; step: Step }[] {
-  const ci = yaml.load(workflow) as { jobs: Record<string, Job> };
+  const ci = z
+    .looseObject({ jobs: z.record(z.string(), JobSchema) })
+    .parse(yaml.load(workflow));
   return Object.entries(ci.jobs).flatMap(([job, definition]) =>
     (definition.steps ?? [])
       .filter((step) => (step.run ?? "").trim().startsWith("npm run coverage"))
@@ -273,11 +314,12 @@ const DRAFT_GATE =
 /** Why CI's coverage step would not fail the run on a coverage drop — empty when it would. */
 export function coverageStepHoles(workflow: string): string[] {
   const found = coverageSteps(workflow);
-  if (found.length !== 1)
+  const [only, ...more] = found;
+  if (only === undefined || more.length > 0)
     return [
       `expected one step running \`npm run coverage\`, found ${String(found.length)}`,
     ];
-  const [{ job, definition, step }] = found as [(typeof found)[number]];
+  const { job, definition, step } = only;
   return [
     ...(job === "gates" ? [] : [`the step is in job ${job}, not gates`]),
     ...(definition.if === DRAFT_GATE
@@ -345,7 +387,7 @@ test("dist/ is excluded BEFORE source maps: a direct load is not a second copy o
 test("the exclude list is exactly the justified set", () => {
   assert.deepEqual(CONFIG.exclude, [
     // tests themselves
-    "**/*.harness.mjs",
+    "**/*.harness.*",
     "**/*.test.*",
     // PAID LLM evaluations, never run by `npm test`
     "**/*.eval.mjs",
@@ -356,7 +398,7 @@ test("the exclude list is exactly the justified set", () => {
     "**/*.d.mts",
     // inputs the tests read
     "**/fixtures/**",
-    // build output (the coverage run resolves it to src/ — test/coverage-src.mjs)
+    // build output (the coverage run resolves it to src/ — test/coverage-src.ts)
     "dist/**",
     // test support
     "test/**",
@@ -388,11 +430,11 @@ test("the exclude list is exactly the justified set", () => {
     "src/types.ts",
     "src/ports/*.ts",
     "src/domain/page-layout.ts",
-    "src/domain/paths.ts",
+    "eslint-rules/rule-context.ts",
   ]);
   assert.deepEqual(CONFIG.evalOnly, [
     "lib/skill-eval-kit.mjs",
-    "lib/skill-eval-fixture.mjs",
+    "lib/skill-eval-fixture.ts",
     "lib/trigger-ledger.mjs",
   ]);
 });

package/scripts/eslint-report-guard.test.mjs

@@ -7,7 +7,7 @@ import assert from "node:assert/strict";
 import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { test } from "vitest";
-import { useTempDir } from "../test/support.mjs";
+import { useTempDir } from "../test/support.ts";
 import { guard } from "./eslint-report-guard.mjs";
 
 test("warnings and rule-less messages are listed; a file with no messages counts as linted", () => {

package/scripts/harness-api.frozen.json

@@ -11,12 +11,11 @@
     "eslint-rules/pdf-last-page-balance.harness.mjs",
     "eslint-rules/temp-root-realpath.harness.mjs",
     "eslint-rules/tex-build.harness.mjs",
-    "fixtures/real-markdown-paper/real-markdown-paper.harness.mjs",
+    "fixtures/real-markdown-paper/real-markdown-paper.harness.ts",
     "lib/agent-cli-version.harness.mjs",
     "lib/paper-config.harness.mjs",
     "lib/skill-trigger-cases.harness.mjs",
-    "scripts/check.harness.mjs",
-    "scripts/rules-are-content-only.harness.mjs",
+    "scripts/check.harness.ts",
     "scripts/rules-see-files.harness.mjs",
     "skills/analyze-sibling-paper/analyze-sibling-paper.harness.mjs",
     "skills/argument-arc/argument-arc.harness.mjs",
@@ -29,21 +28,20 @@
     "skills/grade-paper-writing/grade-paper-writing.harness.mjs",
     "skills/harden-paper/harden-paper.harness.mjs",
     "skills/map-prior-work/map-prior-work.harness.mjs",
-    "skills/osf-artifact-upload/osf-artifact-upload.harness.mjs",
+    "skills/osf-artifact-upload/osf-artifact-upload.harness.ts",
     "skills/paper-adversarial-review/paper-adversarial-review.harness.mjs",
     "skills/paper-pipeline/paper-pipeline.harness.mjs",
     "skills/paper-pipeline/scripts/artifact-coverage.harness.mjs",
     "skills/paper-pipeline/scripts/consumer.harness.mjs",
     "skills/paper-pipeline/scripts/extract-ref-facts.harness.mjs",
     "skills/paper-pipeline/scripts/generated-code.harness.mjs",
-    "skills/paper-pipeline/scripts/pipeline-check.harness.mjs",
     "skills/paper-pipeline/scripts/population-map.harness.mjs",
     "skills/paper-pipeline/scripts/provenance.harness.mjs",
-    "skills/paper-pipeline/scripts/round-diff.harness.mjs",
+    "skills/paper-pipeline/scripts/round-diff.harness.ts",
     "skills/paper-status/paper-status.harness.mjs",
     "skills/pc-panel-review/pc-panel-review.harness.mjs",
     "skills/plan-paper-timeline/plan-paper-timeline.harness.mjs",
-    "skills/render-paper/extract-pdf-facts.harness.mjs",
+    "skills/render-paper/extract-pdf-facts.harness.ts",
     "skills/render-paper/render-paper.harness.mjs",
     "skills/research-ideate/research-ideate.harness.mjs",
     "skills/study-accepted-papers/study-accepted-papers.harness.mjs",
@@ -56,16 +54,16 @@
     "src/cli.harness.mjs",
     "src/doctor.harness.mjs",
     "src/engine.harness.mjs",
-    "src/hooks-settings.harness.mjs",
-    "src/latex-log.harness.mjs",
-    "src/latex-loop.harness.mjs",
-    "src/link-skills.harness.mjs",
+    "src/hooks-settings.harness.ts",
+    "src/latex-log.harness.ts",
+    "src/latex-loop.harness.ts",
+    "src/link-skills.harness.ts",
     "src/new-paper.harness.mjs",
-    "src/pdf-facts.harness.mjs",
-    "src/pdf-geometry.harness.mjs",
-    "src/rules-config.harness.mjs",
-    "src/structure.harness.mjs",
-    "src/tex-requirements.harness.mjs",
+    "src/pdf-facts.harness.ts",
+    "src/pdf-geometry.harness.ts",
+    "src/rules-config.harness.ts",
+    "src/structure.harness.ts",
+    "src/tex-requirements.harness.ts",
     "src/toolchain.harness.mjs"
   ]
 }

package/scripts/harness-api.test.ts

@@ -18,13 +18,16 @@ import { basename, dirname, join } from "node:path";
 import { test } from "vitest";
 import { fileURLToPath } from "node:url";
 import ts from "typescript";
+import { z } from "zod";
 
 const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
-const FROZEN: readonly string[] = (
-  JSON.parse(
-    readFileSync(join(ROOT, "scripts", "harness-api.frozen.json"), "utf8"),
-  ) as { harnesses: string[] }
-).harnesses;
+const FROZEN: readonly string[] = z
+  .object({ harnesses: z.array(z.string()) })
+  .parse(
+    JSON.parse(
+      readFileSync(join(ROOT, "scripts", "harness-api.frozen.json"), "utf8"),
+    ),
+  ).harnesses;
 
 /** vigiles' agent-testing API — what a harness exists to call. */
 export const AGENT_API = new Set(["runHook", "runHarnessTest", "runEval"]);

package/scripts/layer-legacy-frozen.test.ts

@@ -1,5 +1,5 @@
 /**
- * The legacy-exemption ratchet (`layer-legacy-frozen.mjs`): each of its refusals fires on a planted
+ * The legacy-exemption ratchet (`layer-legacy-frozen.ts`): each of its refusals fires on a planted
  * case and stays silent on the matching clean one. The inputs are ESLint's own result shape, so the
  * tally is tested on what the linter reports, not on source text.
  */
@@ -14,8 +14,8 @@ import {
   main,
   tally,
   type Suppressed,
-} from "./layer-legacy-frozen.mjs";
-import { useTempDir, writeTree } from "../test/support.mjs";
+} from "./layer-legacy-frozen.ts";
+import { useTempDir, writeTree } from "../test/support.ts";
 
 const IO = "legacy I/O, moves behind a port in #76";
 const LAYER = "legacy layer, moves behind a port in #76";
@@ -131,7 +131,7 @@ test("main: problems are listed and fail; a clean count passes", async () => {
   }) => {
     const out: string[] = [];
     const code = await main({
-      check: async () => ({ ...r, frozen: {} }),
+      check: () => Promise.resolve({ ...r, frozen: {} }),
       log: (s: string) => out.push(s),
       err: (s: string) => out.push(`E ${s}`),
     });
@@ -191,11 +191,14 @@ test("checkFrozen: a lint that returns no result reports that nothing was counte
   writeTree(root, {
     [FROZEN_FILE]: JSON.stringify({ files: { "src/a.ts": { x: 1 } } }),
   });
-  assert.deepEqual(await checkFrozen(root, { lint: async () => [] }), {
-    problems: ["src/**/*.ts matched no file — nothing was counted."],
-    frozen: { "src/a.ts": { x: 1 } },
-    counts: {},
-  });
+  assert.deepEqual(
+    await checkFrozen(root, { lint: () => Promise.resolve([]) }),
+    {
+      problems: ["src/**/*.ts matched no file — nothing was counted."],
+      frozen: { "src/a.ts": { x: 1 } },
+      counts: {},
+    },
+  );
 });
 
 test("tally: optional parts of ESLint's result shape are read as absent", () => {
@@ -221,9 +224,10 @@ test("checkFrozen: a frozen file with no `files` freezes nothing", async () => {
   const root = useTempDir("layer-frozen-nofiles-");
   writeTree(root, { [FROZEN_FILE]: "{}\n" });
   const r = await checkFrozen(root, {
-    lint: async () => [
-      { filePath: `${root}/src/a.ts`, suppressedMessages: [] },
-    ],
+    lint: () =>
+      Promise.resolve([
+        { filePath: `${root}/src/a.ts`, suppressedMessages: [] },
+      ]),
   });
   assert.deepEqual(r, { problems: [], frozen: {}, counts: {} });
 });
@@ -245,7 +249,7 @@ test("run as a program: the gate's verdict is the exit code", () => {
     [
       "--import",
       preload,
-      fileURLToPath(new URL("./layer-legacy-frozen.mjs", import.meta.url)),
+      fileURLToPath(new URL("./layer-legacy-frozen.ts", import.meta.url)),
     ],
     { encoding: "utf8" },
   );

package/scripts/{layer-legacy-frozen.mjs → layer-legacy-frozen.ts}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * layer-legacy-frozen.mjs — the legacy exemptions from `src/`'s layer rules may only SHRINK.
+ * layer-legacy-frozen.ts — the legacy exemptions from `src/`'s layer rules may only SHRINK.
  *
  * `src/` is hexagonal on two axes (src/CLAUDE.md): who may know whom, and where effects may be
  * written. The flat `src/*.ts` files predate both. Each site in them that still breaks a rule
@@ -32,22 +32,55 @@
  * counted by construction — and a range directive (`/* eslint-disable … *\/` around a multi-line
  * import) counts exactly what it silences.
  *
- * Run: `node scripts/layer-legacy-frozen.mjs` (also part of `npm run check`)
+ * Run: `node scripts/layer-legacy-frozen.ts` (also part of `npm run check`)
  */
 import { isMain } from "../skills/paper-pipeline/scripts/consumer.mjs";
 import { readFileSync } from "node:fs";
 import { dirname, join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { ESLint } from "eslint";
+import { z } from "zod";
+
+/** One file's result, in the shape ESLint's `LintResult` reports suppressions. */
+export interface Suppressed {
+  readonly filePath: string;
+  readonly suppressedMessages?: readonly {
+    readonly ruleId: string | null;
+    readonly line: number;
+    readonly suppressions?: readonly { readonly justification?: string }[];
+  }[];
+}
+
+/** Per file, per rule: a count of suppressed findings. */
+export type Counts = Record<string, Record<string, number>>;
+
+/** What `checkFrozen` reports: the problems, and both sides of the comparison. */
+export interface FrozenCheck {
+  problems: string[];
+  frozen: Counts;
+  counts: Counts;
+}
+
+/** The frozen list on disk. A file with no `files` key freezes nothing. */
+const FrozenFile = z.object({
+  files: z.record(z.string(), z.record(z.string(), z.number())).optional(),
+});
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 export const FROZEN_FILE = join("scripts", "layer-legacy.frozen.json");
 
 /** The rules that enforce the layers. A suppression of any other rule is not this check's business. */
-export const LAYER_RULES = ["boundaries/dependencies", "no-restricted-globals"];
+export const LAYER_RULES: readonly string[] = [
+  "boundaries/dependencies",
+  "no-restricted-globals",
+];
 
 /** Where a legacy suppression may never appear: the folders written under the rules. */
-export const NO_LEGACY_UNDER = ["src/domain/", "src/ports/", "src/adapters/"];
+export const NO_LEGACY_UNDER: readonly string[] = [
+  "src/domain/",
+  "src/ports/",
+  "src/adapters/",
+];
 
 /** The justification every legacy directive carries — `I/O` or `layer`, then the issue. */
 export const LEGACY = /^legacy (I\/O|layer), moves behind a port in #76$/;
@@ -57,12 +90,16 @@ export const LEGACY = /^legacy (I\/O|layer), moves behind a port in #76$/;
  * results (`filePath` relative to the repository, POSIX separators) and returns the tally plus
  * every layer suppression that is not a legacy one.
  */
-export function tally(results) {
-  const counts = {};
-  const unexplained = [];
+export function tally(results: readonly Suppressed[]): {
+  counts: Counts;
+  unexplained: string[];
+} {
+  const counts: Counts = {};
+  const unexplained: string[] = [];
   for (const r of results)
     for (const m of r.suppressedMessages ?? []) {
-      if (!LAYER_RULES.includes(m.ruleId ?? "")) continue;
+      const rule = m.ruleId ?? "";
+      if (!LAYER_RULES.includes(rule)) continue;
       const why = (m.suppressions ?? []).map((s) => s.justification ?? "");
       if (!why.some((j) => LEGACY.test(j.trim()))) {
         unexplained.push(
@@ -71,39 +108,64 @@ export function tally(results) {
         continue;
       }
       const file = (counts[r.filePath] ??= {});
-      file[m.ruleId] = (file[m.ruleId] ?? 0) + 1;
+      file[rule] = (file[rule] ?? 0) + 1;
     }
   return { counts, unexplained };
 }
 
+/** A file carrying a legacy exemption where none may be, or one the list does not know. */
+function misplaced(f: string, frozen: Counts): string[] {
+  if (NO_LEGACY_UNDER.some((d) => f.startsWith(d)))
+    return [
+      `${f}: carries a legacy layer exemption, and nothing under ${NO_LEGACY_UNDER.join(", ")} may — those folders are written under the rules. Fix the site (src/CLAUDE.md).`,
+    ];
+  if (!(f in frozen))
+    return [
+      `${f}: a new legacy layer exemption is not accepted (#76). A module that needs the world is a new *.io.ts in the adapter of the program it talks to; an app file takes a port.`,
+    ];
+  return [];
+}
+
+/** One rule's count in one file against its frozen number: grown, new, or shrunk without a record. */
+function compareCount(
+  f: string,
+  rule: string,
+  got: number,
+  frozen: Counts,
+): string[] {
+  const want = frozen[f]?.[rule];
+  if (want === undefined)
+    return f in frozen
+      ? [
+          `${f}: ${String(got)} legacy ${rule} suppression(s), frozen at 0 — no new exemptions in existing files (#76).`,
+        ]
+      : [];
+  if (got > want)
+    return [
+      `${f}: ${String(got)} legacy ${rule} suppressions, frozen at ${String(want)} — no new exemptions in existing files (#76).`,
+    ];
+  if (got < want)
+    return [
+      `${f}: ${String(got)} legacy ${rule} suppressions, frozen at ${String(want)} — lower it to ${String(got)} in ${FROZEN_FILE} (the list must shrink with the code).`,
+    ];
+  return [];
+}
+
 /** Compare the tally with the frozen list. Pure. `frozen` is `{ path: { rule: count } }`. */
-export function judge({ counts, unexplained, frozen }) {
+export function judge({
+  counts,
+  unexplained,
+  frozen,
+}: {
+  counts: Counts;
+  unexplained: readonly string[];
+  frozen: Counts;
+}): string[] {
   const problems = [...unexplained];
   for (const [f, rules] of Object.entries(counts)) {
-    if (NO_LEGACY_UNDER.some((d) => f.startsWith(d)))
-      problems.push(
-        `${f}: carries a legacy layer exemption, and nothing under ${NO_LEGACY_UNDER.join(", ")} may — those folders are written under the rules. Fix the site (src/CLAUDE.md).`,
-      );
-    else if (!(f in frozen))
-      problems.push(
-        `${f}: a new legacy layer exemption is not accepted (#76). A module that needs the world is a new *.io.ts in the adapter of the program it talks to; an app file takes a port.`,
-      );
-    for (const [rule, got] of Object.entries(rules)) {
-      const want = frozen[f]?.[rule];
-      if (want === undefined) {
-        if (f in frozen)
-          problems.push(
-            `${f}: ${String(got)} legacy ${rule} suppression(s), frozen at 0 — no new exemptions in existing files (#76).`,
-          );
-      } else if (got > want)
-        problems.push(
-          `${f}: ${String(got)} legacy ${rule} suppressions, frozen at ${String(want)} — no new exemptions in existing files (#76).`,
-        );
-      else if (got < want)
-        problems.push(
-          `${f}: ${String(got)} legacy ${rule} suppressions, frozen at ${String(want)} — lower it to ${String(got)} in ${FROZEN_FILE} (the list must shrink with the code).`,
-        );
-    }
+    problems.push(...misplaced(f, frozen));
+    for (const [rule, got] of Object.entries(rules))
+      problems.push(...compareCount(f, rule, got, frozen));
   }
   for (const [f, rules] of Object.entries(frozen))
     for (const [rule, want] of Object.entries(rules))
@@ -114,12 +176,35 @@ export function judge({ counts, unexplained, frozen }) {
   return problems;
 }
 
+/**
+ * The repository's configuration, narrowed to what this check counts: `LAYER_RULES` and their
+ * suppressions, with no type information. The configuration is
+ * type-aware, and a type-aware lint builds the whole TypeScript program first — 33 s on a CI runner
+ * under coverage, for rules that read only import paths. Suppressions of the filtered rules are
+ * still reported, which is what `tally` reads.
+ */
+function layerLint(cwd: string): ESLint {
+  return new ESLint({
+    cwd,
+    ruleFilter: ({ ruleId }) => LAYER_RULES.includes(ruleId),
+    overrideConfig: {
+      languageOptions: {
+        parserOptions: { project: false, projectService: false },
+      },
+    },
+  });
+}
+
 /** Lint `src/` with the repository's configuration and run the whole check. */
 export async function checkFrozen(
-  root = ROOT,
-  { lint = (cwd) => new ESLint({ cwd }).lintFiles(["src/**/*.ts"]) } = {},
-) {
-  const data = JSON.parse(readFileSync(join(root, FROZEN_FILE), "utf8"));
+  root: string = ROOT,
+  {
+    lint = (cwd: string) => layerLint(cwd).lintFiles(["src/**/*.ts"]),
+  }: { lint?: (cwd: string) => Promise<readonly Suppressed[]> } = {},
+): Promise<FrozenCheck> {
+  const data = FrozenFile.parse(
+    JSON.parse(readFileSync(join(root, FROZEN_FILE), "utf8")),
+  );
   const frozen = data.files ?? {};
   // ESLint itself THROWS when the glob matches nothing ("No files matching 'src/**/*.ts' were
   // found") or only ignored files — measured. An empty result from any other linter (or a
@@ -147,7 +232,11 @@ export async function main({
   check = () => checkFrozen(ROOT),
   log = console.log,
   err = console.error,
-} = {}) {
+}: {
+  check?: () => Promise<FrozenCheck>;
+  log?: (line: string) => void;
+  err?: (line: string) => void;
+} = {}): Promise<number> {
   const { problems, counts } = await check();
   if (problems.length) {
     err(

package/scripts/release-config.test.ts

@@ -15,11 +15,19 @@ import { describe, expect, test } from "vitest";
 import { readFileSync } from "node:fs";
 import { analyzeCommits } from "@semantic-release/commit-analyzer";
 import { generateNotes } from "@semantic-release/release-notes-generator";
+import { z } from "zod";
 
-type PluginEntry = string | [string, Record<string, unknown>];
-const releaserc = JSON.parse(
-  readFileSync(new URL("../.releaserc.json", import.meta.url), "utf8"),
-) as { plugins: PluginEntry[] };
+const PluginEntry = z.union([
+  z.string(),
+  z.tuple([z.string(), z.record(z.string(), z.unknown())]),
+]);
+const releaserc = z
+  .object({ plugins: z.array(PluginEntry) })
+  .parse(
+    JSON.parse(
+      readFileSync(new URL("../.releaserc.json", import.meta.url), "utf8"),
+    ),
+  );
 
 /** The options `.releaserc.json` gives one plugin, exactly as semantic-release would pass them. */
 function optionsFor(name: string): Record<string, unknown> {

package/scripts/rules-see-files.test.mjs

@@ -5,7 +5,7 @@ import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { test } from "vitest";
-import { useTempDir, writeTree } from "../test/support.mjs";
+import { useTempDir, writeTree } from "../test/support.ts";
 import { main as seeMain } from "./rules-see-files.mjs";
 
 const capture = () => {