workspace-conformance 1.0.0 → 1.1.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { dirname, join, posix, relative, resolve, sep } from "node:path";
+import { dirname, extname, join, posix, relative, resolve, sep } from "node:path";
 import { parseArgs } from "node:util";
 import { existsSync } from "node:fs";
 import { escapePath, glob, isDynamicPattern } from "tinyglobby";
@@ -8,6 +8,8 @@ import { createJitiLoader, validateStandard } from "cosmiconfig-extends";
 import { readFile, realpath } from "node:fs/promises";
 import { parse } from "yaml";
 import { execFile } from "node:child_process";
+import { findNodeAtLocation, parse as parse$1, parseTree, printParseErrorCode } from "jsonc-parser";
+import { parse as parse$2 } from "smol-toml";
 import { defineSection, layoutSection, loadSection } from "@exadev/config";
 import { z } from "zod";
 //#region src/files.ts
@@ -659,11 +661,19 @@ function isolatedGroupRules(packages, isolatedGroups) {
 	}));
 }
 /**
+* The name of {@link cycleRule}, which a check reads its findings by.
+*/
+const CYCLE_RULE_NAME = "import-cycle";
+/**
+* The name of {@link unresolvedNameImportRule}, which a check reads its findings by.
+*/
+const UNRESOLVED_NAME_IMPORT_RULE_NAME = "unresolved-name-import";
+/**
 * The rule that forbids any import cycle among the packages' files.
 */
 function cycleRule() {
 	return {
-		name: "import-cycle",
+		name: CYCLE_RULE_NAME,
 		severity: "error",
 		comment: "files may not import each other in a cycle",
 		from: {},
@@ -678,7 +688,7 @@ function cycleRule() {
 function unresolvedNameImportRule(packages) {
 	const names = packageNamesPattern(packages);
 	return names === void 0 ? void 0 : {
-		name: "unresolved-name-import",
+		name: UNRESOLVED_NAME_IMPORT_RULE_NAME,
 		severity: "error",
 		comment: "marks an import of a workspace package by a name that resolves to no file",
 		from: { path: packagesPattern(packages) },
@@ -867,15 +877,22 @@ function assertTypeScriptAvailable(transpilers) {
 	if (typescript?.available !== true) throw new ConformanceError(`dependency-cruiser cannot load TypeScript, so the import checks would find no TypeScript file and report nothing; install ${typescript === void 0 ? "a version it supports" : `a version in ${typescript.version}`} as the 'typescript' of this workspace`);
 }
 /**
-* The violations of `rules` among the files of `packages`. The graph is limited to the packages' own files, so nothing outside them is a dependant or a dependency.
-*
-* The base directory is the real path of the root: dependency-cruiser resolves symbolic links, so the path of a file behind one would otherwise not be relative to it.
+* The graph-wide options that decide what a cruise sees, with their defaults filled in. Checks whose settings are equal share a cruise; the key is the serialised form.
+*/
+function cruiseKey(cwd, options) {
+	return JSON.stringify({
+		exclude: options.exclude ?? DEFAULT_GRAPH_EXCLUDES,
+		doNotFollow: options.doNotFollow ?? DEFAULT_DO_NOT_FOLLOW,
+		tsConfig: options.tsConfig === void 0 ? null : resolve(cwd, options.tsConfig)
+	});
+}
+/**
+* One cruise of the packages' files with `rules`, whose findings are read from the cruise summary: `cruise()` reports success in its exit code whatever the summary holds, so the code is not consulted.
 *
-* The result is read from the cruise summary: `cruise()` reports success in its exit code whatever the summary holds, so the code is not consulted.
+* The graph is limited to the packages' own files, so nothing outside them is a dependant or a dependency. The base directory is the real path of the root: dependency-cruiser resolves symbolic links, so the path of a file behind one would otherwise not be relative to it.
 */
 async function cruiseViolations(input) {
 	const { cwd, root, packages, rules, options } = input;
-	if (rules.length === 0) return [];
 	const tsConfigFile = options.tsConfig === void 0 ? void 0 : resolve(cwd, options.tsConfig);
 	const { cruise, getAvailableTranspilers } = await import("dependency-cruiser");
 	assertTypeScriptAvailable(getAvailableTranspilers());
@@ -894,19 +911,64 @@ async function cruiseViolations(input) {
 	return result.output.summary.violations;
 }
 /**
-* Run one import check: generate its rules from the layout, cruise the packages and report each finding.
+* Run import checks over one read of the workspace's packages, and cruise once for each distinct combination of `exclude`, `doNotFollow` and `tsConfig` among them rather than once per check. Every check adds its rules to its group's cruise and gets back the findings of its own rules, which are the same as a cruise of that check alone would give: each rule is matched against each import independently.
+*
+* The result has an entry for every check, in the order of `entries`. A check whose layout yields no rules reports nothing and adds nothing to a cruise; a group none of whose checks has rules is not cruised.
 */
-async function runImportCheck(context, spec) {
-	const root = workspaceRoot(context.cwd, context.layout);
-	const packages = await readWorkspacePackages(context.cwd, context.layout);
-	const rules = spec.rules(packages, context);
-	return (await cruiseViolations({
-		cwd: context.cwd,
+async function runImportChecks(input) {
+	const { cwd, layout, entries } = input;
+	const root = workspaceRoot(cwd, layout);
+	const packages = await readWorkspacePackages(cwd, layout);
+	const scope = {
+		cwd,
 		root,
-		packages,
-		rules,
-		options: context.options
-	})).map((finding) => {
+		packages
+	};
+	const contributions = entries.map((entry) => ({
+		...entry,
+		rules: entry.spec.rules(packages, layout)
+	}));
+	const groups = /* @__PURE__ */ new Map();
+	for (const contribution of contributions) {
+		const key = cruiseKey(cwd, contribution.options);
+		const group = groups.get(key);
+		if (group === void 0) groups.set(key, {
+			options: contribution.options,
+			members: [contribution]
+		});
+		else group.members.push(contribution);
+	}
+	const found = /* @__PURE__ */ new Map();
+	for (const { options, members } of groups.values()) {
+		const rules = members.flatMap((member) => member.rules);
+		if (rules.length === 0) continue;
+		const owner = /* @__PURE__ */ new Map();
+		for (const member of members) for (const rule of member.rules) {
+			const existing = owner.get(rule.name);
+			if (existing !== void 0 && existing !== member.spec.name) throw new ConformanceError(`the checks ${existing} and ${member.spec.name} both generate a rule named '${rule.name}', so their findings cannot be told apart`);
+			owner.set(rule.name, member.spec.name);
+		}
+		for (const finding of await cruiseViolations({
+			cwd,
+			root,
+			packages,
+			rules,
+			options
+		})) {
+			const name = owner.get(finding.rule.name);
+			if (name === void 0) throw new ConformanceError(`dependency-cruiser reported the rule '${finding.rule.name}', which no check generated`);
+			const own = found.get(name);
+			if (own === void 0) found.set(name, [finding]);
+			else own.push(finding);
+		}
+	}
+	return new Map(contributions.map(({ spec }) => [spec.name, spec.report(found.get(spec.name) ?? [], scope)]));
+}
+/**
+* The report of a check whose every rule forbids one package importing another: one violation per finding, at the importing file, ordered by file and message.
+*/
+function edgeReport(spec) {
+	return (findings, { cwd, root, packages }) => findings.map((finding) => {
 		const from = packageOfPath(packages, finding.from);
 		const to = packageOfPath(packages, finding.to);
 		return {
@@ -917,7 +979,7 @@ async function runImportCheck(context, spec) {
 				fromFile: finding.from,
 				toFile: finding.to
 			}),
-			file: relativePosix(context.cwd, join(root, finding.from))
+			file: relativePosix(cwd, join(root, finding.from))
 		};
 	}).sort((a, b) => a.file.localeCompare(b.file) || a.message.localeCompare(b.message));
 }
@@ -937,17 +999,20 @@ function describeTarget(edge) {
 //#endregion
 //#region src/checks/import-cross-slice.ts
 /**
-* A package imports a package in a different slice.
+* How `import-cross-slice` joins a shared cruise.
 */
-const importCrossSlice = async (context) => runImportCheck(context, {
+const importCrossSliceSpec = {
 	name: "import-cross-slice",
-	reason: "other-slice",
 	rules: (packages) => {
 		if (!packages.some((member) => member.slice !== void 0)) throw new ConformanceError("the 'import-cross-slice' check is enabled but no package in the layout has a slice");
 		return crossSliceRules(packages);
 	},
-	message: (edge) => `${describePackage(edge.from)} (slice '${String(edge.from.slice)}') imports ${describeTarget(edge)} (slice '${String(edge.to.slice)}')`
-});
+	report: edgeReport({
+		name: "import-cross-slice",
+		reason: "other-slice",
+		message: (edge) => `${describePackage(edge.from)} (slice '${String(edge.from.slice)}') imports ${describeTarget(edge)} (slice '${String(edge.to.slice)}')`
+	})
+};
 //#endregion
 //#region src/checks/import-cycles.ts
 /**
@@ -1016,84 +1081,88 @@ function nameCycles(imports) {
 	return cycles;
 }
 /**
-* Files of the workspace's packages import each other in a cycle, and so do packages that import each other by a name that resolves to no file. Each cycle is reported once, at its first file (or, for packages, the file of the first import), starting from its smallest path.
-*
-* Cycles among packages are found only when every import in the ring is by a name that resolves to no file. A ring that mixes such imports with imports that do resolve to files has no complete path through either graph and is not seen.
-*/
-const importCycles = async (context) => {
-	const root = workspaceRoot(context.cwd, context.layout);
-	const packages = await readWorkspacePackages(context.cwd, context.layout);
-	const nameRule = unresolvedNameImportRule(packages);
-	const found = await cruiseViolations({
-		cwd: context.cwd,
-		root,
-		packages,
-		rules: nameRule === void 0 ? [cycleRule()] : [cycleRule(), nameRule],
-		options: context.options
-	});
-	const inFiles = fileCycles(found.filter((finding) => finding.rule.name === cycleRule().name));
-	const inPackages = nameCycles(found.filter((finding) => finding.rule.name === nameRule?.name).map((finding) => ({
-		from: packageOfPath(packages, finding.from),
-		to: packageOfPath(packages, finding.to),
-		file: finding.from
-	})));
-	return [...[...inFiles.values()].map((ordered) => {
-		const [first] = ordered;
-		if (first === void 0) throw new ConformanceError("an import cycle with no files was reported");
-		return {
-			code: "import-cycles/cycle",
-			message: `import cycle: ${[...ordered, first].join(" -> ")}`,
-			file: relativePosix(context.cwd, join(root, first))
-		};
-	}), ...[...inPackages.values()].map((ring) => {
-		const [first] = ring;
-		if (first === void 0) throw new ConformanceError("an import cycle with no packages was reported");
-		return {
-			code: "import-cycles/cycle",
-			message: `import cycle between packages that import each other by a name that resolves to no file: ${[...ring.map((edge) => describePackage(edge.from)), describePackage(first.from)].join(" -> ")}`,
-			file: relativePosix(context.cwd, join(root, first.file))
-		};
-	})].sort((a, b) => a.file.localeCompare(b.file) || a.message.localeCompare(b.message));
+* How `import-cycles` joins a shared cruise.
+*/
+const importCyclesSpec = {
+	name: "import-cycles",
+	rules: (packages) => {
+		const nameRule = unresolvedNameImportRule(packages);
+		return nameRule === void 0 ? [cycleRule()] : [cycleRule(), nameRule];
+	},
+	report: (found, { cwd, root, packages }) => {
+		const inFiles = fileCycles(found.filter((finding) => finding.rule.name === CYCLE_RULE_NAME));
+		const inPackages = nameCycles(found.filter((finding) => finding.rule.name === UNRESOLVED_NAME_IMPORT_RULE_NAME).map((finding) => ({
+			from: packageOfPath(packages, finding.from),
+			to: packageOfPath(packages, finding.to),
+			file: finding.from
+		})));
+		return [...[...inFiles.values()].map((ordered) => {
+			const [first] = ordered;
+			if (first === void 0) throw new ConformanceError("an import cycle with no files was reported");
+			return {
+				code: "import-cycles/cycle",
+				message: `import cycle: ${[...ordered, first].join(" -> ")}`,
+				file: relativePosix(cwd, join(root, first))
+			};
+		}), ...[...inPackages.values()].map((ring) => {
+			const [first] = ring;
+			if (first === void 0) throw new ConformanceError("an import cycle with no packages was reported");
+			return {
+				code: "import-cycles/cycle",
+				message: `import cycle between packages that import each other by a name that resolves to no file: ${[...ring.map((edge) => describePackage(edge.from)), describePackage(first.from)].join(" -> ")}`,
+				file: relativePosix(cwd, join(root, first.file))
+			};
+		})].sort((a, b) => a.file.localeCompare(b.file) || a.message.localeCompare(b.message));
+	}
 };
 //#endregion
 //#region src/checks/import-isolated-groups.ts
 /**
-* A package imports a package in a group the layout isolates from its own.
+* How `import-isolated-groups` joins a shared cruise.
 */
-const importIsolatedGroups = async (context) => runImportCheck(context, {
+const importIsolatedGroupsSpec = {
 	name: "import-isolated-groups",
-	reason: "isolated-group",
-	rules: (packages) => {
-		if (context.layout.isolatedGroups === void 0) throw new ConformanceError("the 'import-isolated-groups' check is enabled but the layout has no 'isolatedGroups'");
-		return isolatedGroupRules(packages, context.layout.isolatedGroups);
+	rules: (packages, layout) => {
+		if (layout.isolatedGroups === void 0) throw new ConformanceError("the 'import-isolated-groups' check is enabled but the layout has no 'isolatedGroups'");
+		return isolatedGroupRules(packages, layout.isolatedGroups);
 	},
-	message: (edge) => `${describePackage(edge.from)} (group '${edge.from.group}') imports ${describeTarget(edge)} (group '${edge.to.group}'), which the layout isolates from it`
-});
+	report: edgeReport({
+		name: "import-isolated-groups",
+		reason: "isolated-group",
+		message: (edge) => `${describePackage(edge.from)} (group '${edge.from.group}') imports ${describeTarget(edge)} (group '${edge.to.group}'), which the layout isolates from it`
+	})
+};
 //#endregion
 //#region src/checks/import-rank-skip.ts
 /**
-* A package imports a package more than `rankSkip.maxDistance` ranks below it that is not in `rankSkip.exemptRanks`.
+* How `import-rank-skip` joins a shared cruise.
 */
-const importRankSkip = async (context) => runImportCheck(context, {
+const importRankSkipSpec = {
 	name: "import-rank-skip",
-	reason: "skipped-rank",
-	rules: (packages) => {
-		if (context.layout.rankSkip === void 0) throw new ConformanceError("the 'import-rank-skip' check is enabled but the layout has no 'rankSkip'");
-		return rankSkipRules(packages, context.layout.rankSkip);
+	rules: (packages, layout) => {
+		if (layout.rankSkip === void 0) throw new ConformanceError("the 'import-rank-skip' check is enabled but the layout has no 'rankSkip'");
+		return rankSkipRules(packages, layout.rankSkip);
 	},
-	message: (edge) => `${describePackage(edge.from)} (rank ${String(edge.from.rank)}) imports ${describeTarget(edge)} (rank ${String(edge.to.rank)}), further below than the layout allows`
-});
+	report: edgeReport({
+		name: "import-rank-skip",
+		reason: "skipped-rank",
+		message: (edge) => `${describePackage(edge.from)} (rank ${String(edge.from.rank)}) imports ${describeTarget(edge)} (rank ${String(edge.to.rank)}), further below than the layout allows`
+	})
+};
 //#endregion
 //#region src/checks/import-uphill.ts
 /**
-* A package imports a package of a strictly higher rank: dependencies run downhill only.
+* How `import-uphill` joins a shared cruise.
 */
-const importUphill = async (context) => runImportCheck(context, {
+const importUphillSpec = {
 	name: "import-uphill",
-	reason: "higher-rank",
 	rules: (packages) => uphillRules(packages),
-	message: (edge) => `${describePackage(edge.from)} (rank ${String(edge.from.rank)}) imports ${describeTarget(edge)} (rank ${String(edge.to.rank)}), a higher rank`
-});
+	report: edgeReport({
+		name: "import-uphill",
+		reason: "higher-rank",
+		message: (edge) => `${describePackage(edge.from)} (rank ${String(edge.from.rank)}) imports ${describeTarget(edge)} (rank ${String(edge.to.rank)}), a higher rank`
+	})
+};
 async function git(cwd, args) {
 	return new Promise((resolve, reject) => {
 		execFile("git", [...args], {
@@ -1205,6 +1274,208 @@ const instructionSymlinks = async ({ cwd, options }) => {
 	return violations;
 };
 //#endregion
+//#region src/migrations/adapters.ts
+/**
+* The generators that have an adapter.
+*/
+const generatorNames = ["drizzle-kit"];
+/**
+* The deploy tools that have an adapter.
+*/
+const deployToolNames = ["wrangler"];
+function recordOf(config, file) {
+	if (!isRecord(config)) throw new ConformanceError(`${file}: the config must be an object for the migrations directory to be read`);
+	return config;
+}
+const DRIZZLE_DEFAULT_OUT = "drizzle";
+/**
+* drizzle-kit: `out` of `drizzle.config.{ts,js,json}`, `drizzle` when unset. An empty `out` is a configuration error, not the default. Migrations are applied with `drizzle-kit migrate`; `push` writes no migration files and is not an apply command here.
+*/
+const drizzleKit = {
+	configFiles: [
+		"drizzle.config.ts",
+		"drizzle.config.js",
+		"drizzle.config.json"
+	],
+	applyCommand: /(?:^|[\s;&|(])drizzle-kit\s+migrate(?![\w:-])/u,
+	applyCommandName: "drizzle-kit migrate",
+	outputDirectory: (config, file) => {
+		const out = recordOf(config, file)["out"];
+		if (out === void 0) return DRIZZLE_DEFAULT_OUT;
+		if (typeof out !== "string") throw new ConformanceError(`${file}: 'out' must be a string`);
+		if (out === "") throw new ConformanceError(`${file}: 'out' must not be empty: drizzle-kit reads an empty 'out' as unset in some commands, so the directory it names is ambiguous`);
+		return out;
+	}
+};
+const WRANGLER_DEFAULT_MIGRATIONS_DIR = "migrations";
+function databasesOf(scope, file) {
+	const databases = scope["d1_databases"];
+	if (databases === void 0) return [];
+	if (!Array.isArray(databases) || !databases.every(isRecord)) throw new ConformanceError(`${file}: 'd1_databases' must be an array of objects`);
+	return databases;
+}
+/**
+* wrangler: `migrations_dir` of a `d1_databases` entry of `wrangler.json`, `wrangler.jsonc` or `wrangler.toml`, `migrations` when unset, relative to the config file. D1 databases are not inherited by an environment, so a named environment is read from its own `env.<name>` table.
+*/
+const wrangler = {
+	configFiles: [
+		"wrangler.json",
+		"wrangler.jsonc",
+		"wrangler.toml"
+	],
+	migrationsDirectory: (config, file, selector) => {
+		const top = recordOf(config, file);
+		let scope = top;
+		if (selector.environment !== void 0) {
+			const environments = top["env"];
+			const environment = isRecord(environments) ? environments[selector.environment] : void 0;
+			if (!isRecord(environment)) throw new ConformanceError(`${file} has no environment '${selector.environment}' (checks.migrations-directory.environment)`);
+			scope = environment;
+		}
+		const where = selector.environment === void 0 ? file : `${file} (environment '${selector.environment}')`;
+		const databases = databasesOf(scope, file);
+		const chosen = selector.database === void 0 ? databases : databases.filter((database) => database["binding"] === selector.database);
+		if (chosen.length > 1) throw new ConformanceError(`${where} declares several D1 databases; name the one the generator writes for with checks.migrations-directory.database`);
+		const [only] = chosen;
+		if (only === void 0) return { none: selector.database === void 0 ? `${where} declares no D1 database` : `${where} declares no D1 database with the binding '${selector.database}'` };
+		const directory = only["migrations_dir"];
+		if (directory === void 0) return { directory: WRANGLER_DEFAULT_MIGRATIONS_DIR };
+		if (typeof directory !== "string") throw new ConformanceError(`${where}: 'migrations_dir' must be a string`);
+		return { directory };
+	}
+};
+const generators = { "drizzle-kit": drizzleKit };
+const deployTools = { wrangler };
+//#endregion
+//#region src/migrations/config-data.ts
+/**
+* The first of `candidates` (relative to `cwd`) that exists, or `undefined` when none does.
+*/
+function firstExisting(cwd, candidates) {
+	return candidates.find((candidate) => existsSync(resolve(cwd, candidate)));
+}
+function assertValid(errors, file) {
+	const [first] = errors;
+	if (first !== void 0) throw new ConformanceError(`${file}: not valid JSON (${printParseErrorCode(first.error)} at offset ${String(first.offset)})`);
+}
+/**
+* The data in the text of a JSON file with comments and trailing commas allowed (`.jsonc`, and the `.json` files of tools that read them that way). Throws `ConformanceError` naming `file` when it is not valid.
+*/
+function parseJsonc(text, file) {
+	const errors = [];
+	const data = parse$1(text, errors, { allowTrailingComma: true });
+	assertValid(errors, file);
+	return data;
+}
+/**
+* The syntax tree of the same text, with the offsets of its nodes. Throws `ConformanceError` naming `file` when it is not valid or holds no value.
+*/
+function parseJsoncTree(text, file) {
+	const errors = [];
+	const tree = parseTree(text, errors, { allowTrailingComma: true });
+	assertValid(errors, file);
+	if (tree === void 0) throw new ConformanceError(`${file}: holds no JSON value`);
+	return tree;
+}
+/**
+* The data of the config file at `file` (relative to `cwd`), which must exist: JSON and JSONC are parsed, TOML is parsed, and anything else is evaluated as a module and its default export taken, as {@link evaluateConfigFile} does, so a TypeScript config runs as its own tool would run it.
+*/
+async function readConfigData(cwd, file, configFiles) {
+	const extension = extname(file).toLowerCase();
+	if (extension === ".json" || extension === ".jsonc") return parseJsonc(await readFile(resolve(cwd, file), "utf8"), file);
+	if (extension === ".toml") try {
+		return parse$2(await readFile(resolve(cwd, file), "utf8"));
+	} catch (error) {
+		throw new ConformanceError(`${file}: not valid TOML (${error instanceof Error ? error.message : String(error)})`);
+	}
+	return evaluateConfigFile(cwd, file, configFiles);
+}
+//#endregion
+//#region src/checks/migrations-directory.ts
+const DEFAULT_PACKAGE_JSONS = ["**/package.json"];
+/**
+* The 1-based line and column of the character at `offset` in `text`, which is not the first character.
+*/
+function positionOf(text, offset) {
+	const lineStart = text.lastIndexOf("\n", offset - 1) + 1;
+	return {
+		line: text.slice(0, lineStart).split("\n").length,
+		column: offset - lineStart + 1
+	};
+}
+/**
+* The config file a check reads: the one the option names, else the first of the adapter's file names that exists. `undefined` when there is none.
+*/
+function locate(cwd, explicit, candidates) {
+	return explicit === void 0 ? firstExisting(cwd, candidates) : firstExisting(cwd, [explicit]);
+}
+function missingConfig(explicit, candidates) {
+	return explicit === void 0 ? {
+		code: "migrations-directory/missing-config",
+		message: `none of ${candidates.join(", ")} exists`,
+		file: candidates[0]
+	} : {
+		code: "migrations-directory/missing-config",
+		message: `${explicit} does not exist`,
+		file: explicit
+	};
+}
+/**
+* Violations for every script of the `package.json` at `file` that matches `command`.
+*/
+async function scriptViolations(cwd, file, command, describe) {
+	const text = await readFile(resolve(cwd, file), "utf8");
+	const scripts = findNodeAtLocation(parseJsoncTree(text, file), ["scripts"]);
+	const violations = [];
+	for (const entry of scripts?.children ?? []) {
+		const [key, value] = entry.children ?? [];
+		if (key?.type === "string" && value?.type === "string" && typeof value.value === "string" && command.test(value.value)) violations.push({
+			code: "migrations-directory/generator-apply-command",
+			message: describe(value.value, String(key.value)),
+			file,
+			location: positionOf(text, value.offset)
+		});
+	}
+	return violations;
+}
+/**
+* The directory a schema generator writes migrations to is the one the deploy tool applies them from, and no script applies them with the generator instead of the deploy tool. The generator and the deploy tool are named in the options and each has an adapter that knows its config file names and where in them the directory is; both directories are resolved against the directory of the file that sets them.
+*
+* The config files are read as data: JSON, JSONC and TOML are parsed, and a module (a generator's TypeScript config) is evaluated, so it must be trusted.
+*/
+const migrationsDirectory = async ({ cwd, options, configFiles }) => {
+	const generator = generators[options.generator];
+	const deployTool = deployTools[options.deployTool];
+	const violations = [];
+	const generatorFile = locate(cwd, options.generatorConfig, generator.configFiles);
+	const deployFile = locate(cwd, options.deployConfig, deployTool.configFiles);
+	if (generatorFile === void 0) violations.push(missingConfig(options.generatorConfig, generator.configFiles));
+	if (deployFile === void 0) violations.push(missingConfig(options.deployConfig, deployTool.configFiles));
+	if (generatorFile !== void 0 && deployFile !== void 0) {
+		const written = generator.outputDirectory(await readConfigData(cwd, generatorFile, configFiles), generatorFile);
+		const applied = deployTool.migrationsDirectory(await readConfigData(cwd, deployFile, configFiles), deployFile, {
+			...options.database === void 0 ? {} : { database: options.database },
+			...options.environment === void 0 ? {} : { environment: options.environment }
+		});
+		if (applied.none !== void 0) violations.push({
+			code: "migrations-directory/no-database",
+			message: applied.none,
+			file: deployFile
+		});
+		else {
+			const generated = resolve(cwd, dirname(generatorFile), written);
+			const deployed = resolve(cwd, dirname(deployFile), applied.directory);
+			if (generated !== deployed) violations.push({
+				code: "migrations-directory/mismatch",
+				message: `${generatorFile} writes migrations to ${relativePosix(cwd, generated)}, but ${deployFile} applies them from ${relativePosix(cwd, deployed)}`,
+				file: generatorFile
+			});
+		}
+	}
+	for (const file of await findFiles(cwd, options.packageJsons ?? DEFAULT_PACKAGE_JSONS)) violations.push(...await scriptViolations(cwd, file, generator.applyCommand, (script, name) => `the script '${name}' runs '${generator.applyCommandName}' (${script}) where migrations are applied by ${options.deployTool}`));
+	return violations;
+};
+//#endregion
 //#region src/checks/single-storybook.ts
 const STORYBOOK_DIRECTORY = ".storybook";
 /**
@@ -1244,21 +1515,15 @@ function plain(spec) {
 		}
 	};
 }
-function withLayout(spec) {
+function importCheck(spec) {
 	return {
 		name: spec.name,
 		description: spec.description,
 		requiresLayout: true,
 		isEnabled: (checks) => spec.select(checks) !== void 0,
-		run: async ({ cwd, checks, layout }) => {
-			const options = spec.select(checks);
-			if (options === void 0) throw new ConformanceError(`the check '${spec.name}' is not enabled`);
-			if (layout === void 0) throw new ConformanceError(`the check '${spec.name}' reads the workspace layout, which was not supplied`);
-			return spec.check({
-				cwd,
-				options,
-				layout
-			});
+		importGraph: {
+			spec: spec.importSpec,
+			optionsOf: spec.select
 		}
 	};
 }
@@ -1278,35 +1543,35 @@ const registry = {
 		select: (checks) => enabledOptions(checks["command-types"]),
 		check: commandTypes
 	}),
-	"import-uphill": withLayout({
+	"import-uphill": importCheck({
 		name: "import-uphill",
 		description: "No package imports a package of a higher rank",
 		select: (checks) => enabledOptions(checks["import-uphill"]),
-		check: importUphill
+		importSpec: importUphillSpec
 	}),
-	"import-rank-skip": withLayout({
+	"import-rank-skip": importCheck({
 		name: "import-rank-skip",
 		description: "No package imports further below itself than the layout allows",
 		select: (checks) => enabledOptions(checks["import-rank-skip"]),
-		check: importRankSkip
+		importSpec: importRankSkipSpec
 	}),
-	"import-cross-slice": withLayout({
+	"import-cross-slice": importCheck({
 		name: "import-cross-slice",
 		description: "No package imports a package in a different slice",
 		select: (checks) => enabledOptions(checks["import-cross-slice"]),
-		check: importCrossSlice
+		importSpec: importCrossSliceSpec
 	}),
-	"import-isolated-groups": withLayout({
+	"import-isolated-groups": importCheck({
 		name: "import-isolated-groups",
 		description: "No package imports a package in a group the layout isolates from its own",
 		select: (checks) => enabledOptions(checks["import-isolated-groups"]),
-		check: importIsolatedGroups
+		importSpec: importIsolatedGroupsSpec
 	}),
-	"import-cycles": withLayout({
+	"import-cycles": importCheck({
 		name: "import-cycles",
 		description: "No files of the workspace packages import each other in a cycle",
 		select: (checks) => enabledOptions(checks["import-cycles"]),
-		check: importCycles
+		importSpec: importCyclesSpec
 	}),
 	"instruction-symlinks": plain({
 		name: "instruction-symlinks",
@@ -1331,6 +1596,12 @@ const registry = {
 		description: "A package manager version pinned in a Dockerfile is the version packageManager names",
 		select: (checks) => enabledOptions(checks["dockerfile-package-manager"]),
 		check: dockerfilePackageManager
+	}),
+	"migrations-directory": plain({
+		name: "migrations-directory",
+		description: "The directory a schema generator writes migrations to is the one the deploy tool applies them from, and no script applies them with the generator",
+		select: (checks) => enabledOptions(checks["migrations-directory"]),
+		check: migrationsDirectory
 	})
 };
 /**
@@ -1410,6 +1681,15 @@ const checks = z.strictObject({
 		dockerfiles: z.exactOptional(paths),
 		exclude: z.exactOptional(paths),
 		packageJson: z.exactOptional(path)
+	}))),
+	"migrations-directory": z.exactOptional(enabled(z.strictObject({
+		generator: z.enum(generatorNames),
+		deployTool: z.enum(deployToolNames),
+		generatorConfig: z.exactOptional(path),
+		deployConfig: z.exactOptional(path),
+		database: z.exactOptional(z.string().min(1)),
+		environment: z.exactOptional(z.string().min(1)),
+		packageJsons: z.exactOptional(paths)
 	})))
 });
 /**
@@ -1460,6 +1740,35 @@ function selected(config, requested) {
 	return checkNames.filter((name) => requested.includes(name));
 }
 /**
+* Run the import checks among `names` together, so checks with the same graph options share one cruise. The result has an entry for each of them and none for the other checks.
+*/
+async function runImportGraphChecks(cwd, layout, names, checks) {
+	const entries = names.flatMap((name) => {
+		const check = registry[name];
+		if (!("importGraph" in check)) return [];
+		const options = check.importGraph.optionsOf(checks);
+		return options === void 0 ? [] : [{
+			spec: check.importGraph.spec,
+			options
+		}];
+	});
+	if (entries.length === 0) return /* @__PURE__ */ new Map();
+	if (layout === void 0) throw new ConformanceError(`${entries.map((entry) => entry.spec.name).join(", ")} read the workspace layout, which was not supplied`);
+	return runImportChecks({
+		cwd,
+		layout,
+		entries
+	});
+}
+/**
+* The findings of an import check that `runImportGraphChecks` ran. Every import check among the selected names has an entry, so a missing one is a defect.
+*/
+function readImported(imported, name) {
+	const found = imported.get(name);
+	if (found === void 0) throw new ConformanceError(`the import check '${name}' produced no result`);
+	return found;
+}
+/**
 * Run the enabled checks, or the enabled ones among `checks`, and return what they found. Sections not supplied in the options are loaded from `cwd` with `@exadev/config`.
 *
 * Violations do not throw. It throws `ConformanceError` when the checks cannot run (nothing enabled, a requested check disabled, a section missing) and `ConfigValidationError` when a section fails its schema, whether it was loaded from `cwd` or passed in.
@@ -1468,16 +1777,21 @@ async function runChecks(options) {
 	const config = await conformanceOf(options);
 	const names = selected(config, options.checks);
 	const layout = await layoutOf(options, names.filter((name) => registry[name].requiresLayout));
+	const imported = await runImportGraphChecks(options.cwd, layout, names, config.checks);
 	const results = [];
-	for (const name of names) results.push({
-		check: name,
-		violations: await registry[name].run({
+	for (const name of names) {
+		const check = registry[name];
+		const violations = "run" in check ? await check.run({
 			cwd: options.cwd,
 			checks: config.checks,
 			layout,
 			configFiles: options.configFiles
-		})
-	});
+		}) : readImported(imported, name);
+		results.push({
+			check: name,
+			violations
+		});
+	}
 	const violations = results.flatMap((result) => result.violations);
 	return {
 		results,