workspace-conformance 1.2.2 → 1.4.0

package/README.md

@@ -10,7 +10,7 @@ It complements the workspace architecture rules of [`@exadev/eslint-config`](htt
 pnpm add -D workspace-conformance @exadev/config cosmiconfig 'typescript@^6'
 ```
 
-`cosmiconfig` (`^9.0.0 || ^10.0.0`) is a peer dependency because `@exadev/config` loads config files through it. `typescript` (`^5.9.0 || ^6.0.0`) is a peer dependency because dependency-cruiser needs it to parse TypeScript and supports versions below 7 (the range is in the install command because an unpinned `typescript` installs a newer major, which pnpm only warns about); the import checks fail with a configuration error when dependency-cruiser cannot load it. ts-morph bundles its own compiler and does not use yours. The package supports the Node lines dependency-cruiser and its own dependencies support: 22.13 and later 22, 24, and 26 and later.
+`cosmiconfig` (`^9.0.0 || ^10.0.0`) is a peer dependency because `@exadev/config` loads config files through it. `typescript` (`^5.9.0 || ^6.0.0`) is a peer dependency because dependency-cruiser needs it to parse TypeScript and supports versions below 7 (the range is in the install command because an unpinned `typescript` installs a newer major, which pnpm only warns about); the import checks fail with a configuration error when dependency-cruiser cannot load it. ts-morph bundles its own compiler and does not use yours. `eslint` (`^9.0.0 || ^10.0.0`) is an optional peer dependency, needed only by the `eslint` check, which uses the copy installed in the repository it checks. The package supports the Node lines dependency-cruiser and its own dependencies support: 22.13 and later 22, 24, and 26 and later.
 
 Configure the checks in `exadev.config.ts`:
 
@@ -128,6 +128,17 @@ Codes: `aggregate-mappers/missing-mapper` (reported at the aggregate's declarati
 
 Codes: `command-types/hand-written-interface`, `command-types/hand-written-alias` (an alias that applies none of the generics, including a union or a plain object type) and `command-types/not-a-schema` (an inference applied to something whose type has no `~standard` member). Limits: a union of commands is a hand-written alias unless excluded; a type exported from several listed files is judged once; only interfaces and type aliases are judged, including those inside an exported namespace or a module re-exported as a namespace (under their qualified names), so a class, enum or value is not a command here; when the schema library is not installed the schema's type does not resolve and the alias reports `not-a-schema`.
 
+**`derived-types`** verifies that the types a file exports are derived from the schemas they belong with, for each configured pair of schema files and type files. It covers what `command-types` does not: a type written by hand next to the schema it should be inferred from, a table row type that should come from the table definition, an error type that should come from its error schema. An exported type is derived when somewhere in its definition a generic named in `inferences` is applied to `typeof schema` (`z.infer<typeof order>`, `InferSelectModel<typeof users>`), or a member named there is read from it (`typeof users.$inferSelect`), where `schema` is declared in one of the pair's schema files, through any imports and re-exports. The definition is followed through aliases and interfaces without type parameters, in any file, so an alias chain across files counts when it ends in an inference; through the type arguments of other generics (`Partial<Order>`); through an intersection with at least one derived member, a union whose members are all derived (`null` and `undefined` aside), arrays, type operators, indexed access and the `extends` clauses of an interface. A type literal is hand-written whatever its members are, and so is a schema passed to a generic that is not an inference (`Wrapper<typeof order>`) or an inference of a schema declared outside the pair's schema files.
+
+| Option | Meaning |
+|---|---|
+| `pairs` | A list of `{ schemas, types }`, each a list of globs: every exported interface and type alias in the `types` files must be derived from a schema declared in the `schemas` files. A type file listed by several pairs is judged against each. |
+| `exclude` | Names of exported types that are deliberately written by hand. |
+| `inferences` | Replaces the default list of last names that count as inference: those of `command-types` plus Drizzle's `InferSelectModel`, `InferInsertModel`, `$inferSelect` and `$inferInsert` (`DEFAULT_DERIVED_TYPE_INFERENCES`). |
+| `tsConfig` | See above. |
+
+Code: `derived-types/not-derived`, reported at the type's declaration. Limits: a schema is recognised by where it is declared, not by its type, so anything in a schema file passed to an inference counts; a tuple type is not followed and is hand-written; a type exported from several type files of one pair is judged once; types inside an exported namespace or a module re-exported as a namespace are judged under their qualified names, which `exclude` also matches; a glob that matches no file and a missing tsconfig are configuration errors naming the option (`checks.derived-types.pairs.0.schemas`).
+
 ### File tree and cross-config
 
 **`instruction-symlinks`** verifies that agent instruction files are symbolic links to the README beside them (written in any form that resolves there, such as `./README.md`, or through other tracked links, as `CLAUDE.md` to `AGENTS.md` to `README.md`), as git records them: mode `120000` in the index, not the working tree, so a checkout with `core.symlinks` false, which writes links out as plain files, is judged by what is committed. Options: `files` (`AGENTS.md` and `CLAUDE.md`), `directories` (globs, `.`), `target` (`README.md`). Codes: `instruction-symlinks/missing` (not tracked), `not-a-symlink`, `wrong-target` (the link does not resolve to the README, including a loop or an absolute target), `dangling` (the target is not tracked). It needs a git working tree and reads the index, so a link that is staged counts before it is committed.
@@ -161,6 +172,33 @@ False positives and blind spots:
 - Config variants: only the directory searched is looked at, whereas wrangler also finds a config in a parent directory and follows a redirected config; a repository with both `wrangler.json` and `wrangler.toml` is judged by the first, and a `migrations_pattern` that narrows which files are applied is not read. A generator config that computes `out` from the environment is judged by its value in the process running the check.
 - Scripts: a script is matched by the text of the command, so `drizzle-kit migrate` run against a local database for tests is reported, and a command assembled in a shell variable or run from a file the script calls is not seen. Narrow `packageJsons` to exempt a package.
 
+### ESLint
+
+**`eslint`** proves that the repository's own ESLint is applied. Every other lint rule runs inside ESLint, so none of them can notice a config that dropped a shared preset, switched its rules off or narrowed `ignores` until nothing is linted; the repository then looks configured and enforces nothing. This check asks ESLint itself, through its Node API, and carries no ESLint config of its own: a flat config holds plugin objects, a parser and functions, and editors and CI expect `eslint.config.*` where it already is.
+
+ESLint (`^9.0.0 || ^10.0.0`) is an optional peer dependency, needed only by this check. It is resolved from the directory the checks run in, the way a module there would find it, and not from this package, so the answer is the one the repository's own lint script gets. When `eslint` does not resolve from there the run fails with a configuration error. When ESLint finds no config file for a sample the check reports `eslint/no-config` and does not substitute one.
+
+| Option | Meaning |
+|---|---|
+| `samples` | Required. One file per kind of source the repository lints (`src/index.ts`, `package.json`, `eslint.config.ts`), as a path or `{ path, rules }`. A path need not exist: ESLint resolves a file's configuration from its path alone. |
+| `rules` | Rules required for every sample, each with the severity it must have at least: `warn` is met by `warn` or `error`, `error` only by `error`. Rule entries in the form `[severity, ...options]` and numeric severities are read as their severity. A sample's own `rules` are added to these and win. |
+| `configFile` | A config file to judge instead of the one ESLint finds from the working directory. |
+| `lint` | Also lint the workspace and report every message it produces. Off when omitted. |
+| `lintPatterns` | What `lint` lints, as file and directory patterns. `.` when omitted. |
+
+The default level lints nothing. For each sample it calls `calculateConfigForFile`, the same call the CLI's `--print-config` makes, which applies `files` and `ignores`. A file that is ignored, or that no configuration block matches, resolves to no configuration (`isPathIgnored` is that call returning nothing), and that is `eslint/not-linted`. Otherwise each required rule must be configured at the required severity: `eslint/rule-missing`, `eslint/rule-off` or `eslint/rule-too-weak`, each naming the rule and the file.
+
+With `lint` the check also lints the workspace through `lintFiles` and maps every message to a violation at its position. The code names the rule, `eslint/lint/<rule id>`, so `eslint/lint/no-console` and `eslint/lint/@scope/plugin/rule` are stable; a parsing error is `eslint/fatal` and a message with no rule, such as an unused disable directive, is `eslint/lint-message`. A pattern that matches no file, or only ignored files, is `eslint/nothing-linted`. Warnings are reported as well as errors, since a repository that fails its lint script on warnings (`--max-warnings 0`) is judged by what that script reports.
+
+Limits:
+
+- An external config is a black box. The check sees which rules are active on a file, not why, so it cannot tell a rule enabled by a shared preset from one written locally. Require the rules that matter and let the repository decide how it gets them.
+- It reads the config ESLint resolves for each sample, and a sample stands for the files like it. A rule can be off for one directory the samples do not cover, so choose a sample for each kind of source and each directory with its own override.
+- An ignored file and a file that no configuration block matches both resolve to nothing and are reported the same way.
+- Only rule severities are compared, not rule options.
+- Flat config only: the ESLint 9 and later `ESLint` class. Legacy `.eslintrc` configuration is not read.
+- A config that is a TypeScript file needs whatever ESLint itself needs to load it (`jiti`), installed where ESLint is.
+
 ### Workflows
 
 The `workflow-*` checks read GitHub Actions workflow files and run offline. Each file under `.github/workflows` is parsed into a model of its events, jobs, the transitive `needs` graph, `if` conditions, effective permissions (a job's own declaration replaces the workflow's, it is not merged with it) and effective environment (workflow, then job, then step), and the checks read that model. A file that is not YAML, or is not shaped like a workflow, fails the run with a configuration error instead of being skipped. Expressions (`${{ ... }}`) are never evaluated: a value that is an expression is treated as unknown, and a check that needs a literal ignores it.
@@ -256,7 +294,7 @@ it('conforms to the workspace layout', async () => {
 });
 ```
 
-Every check is also exported as a function taking `{ cwd, options }` (and `layout` for the import checks): `aggregateMappers`, `commandTypes`, `importUphill`, `importRankSkip`, `importCrossSlice`, `importIsolatedGroups`, `importCycles`, `instructionSymlinks`, `singleStorybook`, `commitTypes`, `dockerfilePackageManager`, `migrationsDirectory`, the workflow checks (`workflowJobOrdering`, `workflowSkippableJobs`, `workflowRunnerResolution`, `workflowVersionSingleSource`, `workflowCredentials`, `workflowRepositoryDispatch`, `workflowUpdateBotCooldown`, `workflowMergeGroup` and `workflowActionPinning`) and, taking `{ cwd, options, github }`, the settings checks (`settingsMergeMethods`, `settingsRequiredChecks` and `settingsReviewThreadResolution`). These take options and a layout as already validated and do not check them again; go through `runChecks` for validation. `parseWorkflow` and `loadWorkflows` expose the workflow model the workflow checks read. A check is a function that returns `Promise<readonly Violation[]>`, where a `Violation` is `{ code, message, file, location? }`.
+Every check is also exported as a function taking `{ cwd, options }` (and `layout` for the import checks): `aggregateMappers`, `commandTypes`, `derivedTypes`, `importUphill`, `importRankSkip`, `importCrossSlice`, `importIsolatedGroups`, `importCycles`, `instructionSymlinks`, `singleStorybook`, `commitTypes`, `dockerfilePackageManager`, `migrationsDirectory`, `eslint`, the workflow checks (`workflowJobOrdering`, `workflowSkippableJobs`, `workflowRunnerResolution`, `workflowVersionSingleSource`, `workflowCredentials`, `workflowRepositoryDispatch`, `workflowUpdateBotCooldown`, `workflowMergeGroup` and `workflowActionPinning`) and, taking `{ cwd, options, github }`, the settings checks (`settingsMergeMethods`, `settingsRequiredChecks` and `settingsReviewThreadResolution`). These take options and a layout as already validated and do not check them again; go through `runChecks` for validation. `parseWorkflow` and `loadWorkflows` expose the workflow model the workflow checks read. A check is a function that returns `Promise<readonly Violation[]>`, where a `Violation` is `{ code, message, file, location? }`.
 
 ### Proving a handler map is exhaustive
 

package/dist/cli.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
 import { dirname, extname, join, posix, relative, resolve, sep } from "node:path";
 import { parseArgs } from "node:util";
 import { z } from "zod";
 import { existsSync } from "node:fs";
 import { escapePath, glob, isDynamicPattern } from "tinyglobby";
-import { Node, Project } from "ts-morph";
+import { Node, Project, SyntaxKind } from "ts-morph";
 import { createJitiLoader, validateStandard } from "cosmiconfig-extends";
 import { readFile, realpath } from "node:fs/promises";
 import { execFile } from "node:child_process";
@@ -283,6 +284,32 @@ const aggregateMappers = async ({ cwd, options }) => {
 	return violations.sort((a, b) => a.file.localeCompare(b.file) || (a.location?.line ?? 0) - (b.location?.line ?? 0) || a.message.localeCompare(b.message));
 };
 //#endregion
+//#region src/checks/type-references.ts
+/**
+* The identifier a reference ends in: `infer` in `z.infer`, the name itself when it is not qualified.
+*/
+function lastIdentifier(reference) {
+	if (Node.isQualifiedName(reference)) return reference.getRight();
+	if (Node.isPropertyAccessExpression(reference)) return reference.getNameNode();
+	return reference;
+}
+/**
+* The declarations the identifier refers to, through any imports and re-exports.
+*/
+function declarationsOf(identifier) {
+	const symbol = identifier.getSymbol();
+	return (symbol?.getAliasedSymbol() ?? symbol)?.getDeclarations() ?? [];
+}
+/**
+* The names a reference goes by: the last name as written, and the name it was declared with when that differs, as for `Infer` in `import type { infer as Infer } from 'zod'`, which is also `infer`. A library may itself re-export a generic under another name, so both count.
+*/
+function referenceNames(reference) {
+	const identifier = lastIdentifier(reference);
+	const symbol = identifier.getSymbol();
+	const declared = (symbol?.getAliasedSymbol() ?? symbol)?.getName();
+	return declared === void 0 ? [identifier.getText()] : [.../* @__PURE__ */ new Set([identifier.getText(), declared])];
+}
+//#endregion
 //#region src/checks/command-types.ts
 /**
 * The last names of the generics that turn a schema into its type, used when the options name none: `z.infer`, `z.input`, `z.output`, `z.TypeOf` and Valibot's `InferInput` and `InferOutput`.
@@ -300,20 +327,10 @@ const DEFAULT_INFERENCES = [
 */
 const STANDARD_SCHEMA_MEMBER = "~standard";
 /**
-* The names a type reference goes by: the last name as written, and the name it was declared with when that differs, as for `Infer` in `import type { infer as Infer } from 'zod'`, which is also `infer`. A library may itself re-export a generic under another name, so both count.
-*/
-function namesOf(typeName) {
-	const identifier = Node.isQualifiedName(typeName) ? typeName.getRight() : typeName;
-	const symbol = identifier.getSymbol();
-	const declared = (symbol?.getAliasedSymbol() ?? symbol)?.getName();
-	return declared === void 0 ? [identifier.getText()] : [.../* @__PURE__ */ new Set([identifier.getText(), declared])];
-}
-/**
 * The local alias without type parameters that a type reference names, or `undefined` when it names anything else. Such an alias is a name for the type it is written as, so it is judged by that.
 */
 function aliasNamed(typeName) {
-	const symbol = typeName.getSymbol();
-	const declaration = (symbol?.getAliasedSymbol() ?? symbol)?.getDeclarations().find(Node.isTypeAliasDeclaration);
+	const declaration = declarationsOf(lastIdentifier(typeName)).find(Node.isTypeAliasDeclaration);
 	return declaration?.getTypeParameters().length === 0 ? declaration : void 0;
 }
 /**
@@ -326,7 +343,7 @@ function problem$1(declaration, name, inferences, followed = /* @__PURE__ */ new
 	};
 	const written = declaration.getTypeNode();
 	if (Node.isTypeReference(written)) {
-		const inference = namesOf(written.getTypeName()).find((candidate) => inferences.includes(candidate));
+		const inference = referenceNames(written.getTypeName()).find((candidate) => inferences.includes(candidate));
 		if (inference !== void 0) {
 			const [argument] = written.getTypeArguments();
 			if (argument !== void 0 && Node.isTypeQuery(argument) && argument.getExprName().getType().getProperty(STANDARD_SCHEMA_MEMBER) !== void 0) return;
@@ -522,6 +539,120 @@ const commitTypes = async ({ cwd, options, configFiles }) => {
 	return violations;
 };
 //#endregion
+//#region src/checks/derived-types.ts
+/**
+* The last names that count as inference when the options name none: those of `command-types`, Drizzle's `InferSelectModel` and `InferInsertModel` generics, and the `$inferSelect` and `$inferInsert` members of a Drizzle table, read as `typeof table.$inferSelect`.
+*/
+const DEFAULT_DERIVED_TYPE_INFERENCES = [
+	...DEFAULT_INFERENCES,
+	"InferSelectModel",
+	"InferInsertModel",
+	"$inferSelect",
+	"$inferInsert"
+];
+/**
+* Whether the node names something declared in one of the schema files.
+*/
+function declaredInSchema(name, derivation) {
+	const identifier = Node.isIdentifier(name) ? name : Node.isQualifiedName(name) ? name.getRight() : void 0;
+	return identifier !== void 0 && declarationsOf(identifier).some((declaration) => derivation.schemaFiles.has(relativePosix(derivation.cwd, declaration.getSourceFile().getFilePath())));
+}
+/**
+* The interface or type alias without type parameters a reference names, when it has not been followed yet. Such a declaration is a name for what it is written as, so it is judged by that.
+*/
+function followable(reference, derivation) {
+	const name = Node.isTypeReference(reference) ? reference.getTypeName() : reference.getExpression();
+	if (!Node.isIdentifier(name) && !Node.isQualifiedName(name) && !Node.isPropertyAccessExpression(name)) return;
+	const declaration = declarationsOf(lastIdentifier(name)).find((found) => Node.isTypeAliasDeclaration(found) || Node.isInterfaceDeclaration(found));
+	return declaration?.getTypeParameters().length === 0 && !derivation.followed.has(declaration) ? declaration : void 0;
+}
+function isNullish(node) {
+	return node.getKind() === SyntaxKind.UndefinedKeyword || Node.isLiteralTypeNode(node) && node.getLiteral().getKind() === SyntaxKind.NullKeyword;
+}
+/**
+* Whether a reference is derived: an inference applied to `typeof schema`, an alias or interface that is itself derived, or another generic given a derived type, as `Partial<Order>` is.
+*/
+function derivedReference(reference, derivation) {
+	const name = Node.isTypeReference(reference) ? reference.getTypeName() : reference.getExpression();
+	if ((Node.isIdentifier(name) || Node.isQualifiedName(name) || Node.isPropertyAccessExpression(name)) && referenceNames(name).some((candidate) => derivation.inferences.has(candidate))) {
+		const [argument] = reference.getTypeArguments();
+		return argument !== void 0 && Node.isTypeQuery(argument) && declaredInSchema(argument.getExprName(), derivation);
+	}
+	const declaration = followable(reference, derivation);
+	if (declaration !== void 0) return derivedDeclaration(declaration, {
+		...derivation,
+		followed: /* @__PURE__ */ new Set([...derivation.followed, declaration])
+	});
+	return reference.getTypeArguments().some((argument) => derivedType(argument, derivation));
+}
+/**
+* Whether a type, as written, is derived from a schema. A type literal is written by hand whatever its members are.
+*/
+function derivedType(node, derivation) {
+	if (Node.isTypeReference(node) || Node.isExpressionWithTypeArguments(node)) return derivedReference(node, derivation);
+	if (Node.isTypeQuery(node)) {
+		const name = node.getExprName();
+		return Node.isQualifiedName(name) && referenceNames(name).some((candidate) => derivation.inferences.has(candidate)) && declaredInSchema(name.getLeft(), derivation);
+	}
+	if (Node.isParenthesizedTypeNode(node) || Node.isTypeOperatorTypeNode(node)) return derivedType(node.getTypeNode(), derivation);
+	if (Node.isArrayTypeNode(node)) return derivedType(node.getElementTypeNode(), derivation);
+	if (Node.isIndexedAccessTypeNode(node)) return derivedType(node.getObjectTypeNode(), derivation);
+	if (Node.isIntersectionTypeNode(node)) return node.getTypeNodes().some((member) => derivedType(member, derivation));
+	if (Node.isUnionTypeNode(node)) {
+		const members = node.getTypeNodes().filter((member) => !isNullish(member));
+		return members.length > 0 && members.every((member) => derivedType(member, derivation));
+	}
+	return false;
+}
+/**
+* Whether an interface or type alias is derived: an alias by the type it is written as, an interface by whether it extends a derived type.
+*/
+function derivedDeclaration(declaration, derivation) {
+	if (Node.isInterfaceDeclaration(declaration)) return declaration.getExtends().some((heritage) => derivedReference(heritage, derivation));
+	return derivedType(declaration.getTypeNodeOrThrow(), derivation);
+}
+async function pairViolations(cwd, options, pair, index) {
+	const { project, files } = await createProject(cwd, options.tsConfig, pair.types, {
+		check: "derived-types",
+		files: `pairs.${String(index)}.types`
+	});
+	const schemaFiles = await findFiles(cwd, pair.schemas);
+	if (schemaFiles.length === 0) throw new ConformanceError(`checks.derived-types.pairs.${String(index)}.schemas: no file matches`);
+	const excluded = new Set(options.exclude);
+	const derivation = {
+		inferences: new Set(options.inferences ?? DEFAULT_DERIVED_TYPE_INFERENCES),
+		schemaFiles: new Set(schemaFiles),
+		cwd,
+		followed: /* @__PURE__ */ new Set()
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const violations = [];
+	for (const file of files) for (const [name, declaration] of exportedTypes(project.getSourceFileOrThrow(resolve(cwd, file)))) {
+		if (excluded.has(name) || seen.has(declaration)) continue;
+		seen.add(declaration);
+		if (!derivedDeclaration(declaration, {
+			...derivation,
+			followed: /* @__PURE__ */ new Set([declaration])
+		})) violations.push({
+			code: "derived-types/not-derived",
+			message: `${name} is not derived from a schema in ${pair.schemas.join(", ")}: nothing in its definition applies an inference generic to one`,
+			file: relativePosix(cwd, declaration.getSourceFile().getFilePath()),
+			location: declarationLocation(declaration)
+		});
+	}
+	return violations;
+}
+/**
+* For each pair, every exported interface and type alias of its type files is derived from a schema declared in its schema files: somewhere in its definition an inference (a generic in `inferences`, such as `z.infer` or `InferSelectModel`) is applied to `typeof schema`, or an inference member is read from it (`typeof table.$inferSelect`).
+*
+* The definition is followed through aliases and interfaces without type parameters, in any file, and through the arguments of other generics, intersections, unions whose members are all derived (`null` and `undefined` aside), arrays, type operators and indexed access. A type literal, and a schema passed to a generic that is not an inference, are written by hand.
+*/
+const derivedTypes = async ({ cwd, options }) => {
+	const violations = [];
+	for (const [index, pair] of options.pairs.entries()) violations.push(...await pairViolations(cwd, options, pair, index));
+	return violations.sort((a, b) => a.file.localeCompare(b.file) || (a.location?.line ?? 0) - (b.location?.line ?? 0) || a.message.localeCompare(b.message));
+};
+//#endregion
 //#region src/checks/dockerfile-package-manager.ts
 const DEFAULT_DOCKERFILES = [
 	"**/Dockerfile",
@@ -2498,6 +2629,179 @@ const importUphillSpec = {
 	})
 };
 //#endregion
+//#region src/checks/eslint.ts
+/**
+* The patterns the full level lints when the options name none.
+*/
+const DEFAULT_LINT_PATTERNS = ["."];
+const SEVERITY_RANK = {
+	off: 0,
+	warn: 1,
+	error: 2
+};
+function hasEslintClass(value) {
+	return isRecord(value) && typeof value["ESLint"] === "function";
+}
+/**
+* The `ESLint` class of the ESLint installed where the checks run, found the way a module in `cwd` finds it. It is not this package's own copy, so the results agree with the repository's own lint script.
+*/
+function loadEslint(cwd) {
+	const requireFromCwd = createRequire(join(cwd, "package.json"));
+	try {
+		requireFromCwd.resolve("eslint");
+	} catch (error) {
+		throw new ConformanceError(`the eslint check uses the repository's own ESLint, and 'eslint' does not resolve from ${cwd}; install it there`, { cause: error });
+	}
+	const loaded = requireFromCwd("eslint");
+	if (!hasEslintClass(loaded)) throw new ConformanceError(`the 'eslint' that resolves from ${cwd} does not export the ESLint class of the Node API`);
+	return loaded.ESLint;
+}
+/**
+* The severity a rule entry resolves to. An entry is a severity or an array whose first element is one, and a severity is `0`, `1`, `2`, `'off'`, `'warn'` or `'error'`; `calculateConfigForFile` returns whichever form the config was written in.
+*/
+function normaliseSeverity(entry) {
+	const severity = Array.isArray(entry) ? entry[0] : entry;
+	if (severity === 0 || severity === "off") return "off";
+	if (severity === 1 || severity === "warn") return "warn";
+	if (severity === 2 || severity === "error") return "error";
+	throw new ConformanceError(`ESLint resolved ${JSON.stringify(entry)} as a rule entry, which is not a severity or an array that starts with one`);
+}
+/**
+* The severity of each rule in a resolved configuration.
+*/
+function resolvedSeverities(config) {
+	if (!isRecord(config)) throw new ConformanceError("ESLint resolved a configuration that is not an object");
+	const { rules } = config;
+	if (rules !== void 0 && !isRecord(rules)) throw new ConformanceError("ESLint resolved a configuration whose 'rules' is not an object");
+	return new Map(Object.entries(rules ?? {}).map(([rule, entry]) => [rule, normaliseSeverity(entry)]));
+}
+/**
+* Whether `error` is the one `calculateConfigForFile` throws when ESLint finds no config file for the path.
+*/
+function isMissingConfig(error) {
+	return isRecord(error) && error["messageTemplate"] === "config-file-missing";
+}
+function sampleOf(sample) {
+	return typeof sample === "string" ? { path: sample } : sample;
+}
+function ruleViolations(file, required, actual) {
+	return Object.entries(required).flatMap(([rule, severity]) => {
+		const found = actual.get(rule);
+		if (found === void 0) return [{
+			code: "eslint/rule-missing",
+			message: `the rule '${rule}' is not configured for ${file} (required: ${severity})`,
+			file
+		}];
+		if (found === "off") return [{
+			code: "eslint/rule-off",
+			message: `the rule '${rule}' is off for ${file} (required: ${severity})`,
+			file
+		}];
+		if (SEVERITY_RANK[found] < SEVERITY_RANK[severity]) return [{
+			code: "eslint/rule-too-weak",
+			message: `the rule '${rule}' is '${found}' for ${file} (required: ${severity})`,
+			file
+		}];
+		return [];
+	});
+}
+async function sampleViolations(eslint, sample, shared) {
+	const file = sample.path;
+	let config;
+	try {
+		config = await eslint.calculateConfigForFile(file);
+	} catch (error) {
+		if (isMissingConfig(error)) return [{
+			code: "eslint/no-config",
+			message: `ESLint finds no config file for ${file}; the check does not fall back to a config of its own`,
+			file
+		}];
+		throw new ConformanceError(`ESLint could not resolve its configuration for ${file}`, { cause: error });
+	}
+	if (config === void 0) return [{
+		code: "eslint/not-linted",
+		message: `${file} is not linted: it is ignored, or no configuration block matches it`,
+		file
+	}];
+	return ruleViolations(file, {
+		...shared,
+		...sample.rules
+	}, resolvedSeverities(config));
+}
+/**
+* Whether `error` is ESLint refusing a pattern because it selects no file that is linted.
+*/
+function isNothingLinted(error) {
+	return error instanceof Error && isRecord(error) && (error["messageTemplate"] === "file-not-found" || error["messageTemplate"] === "all-matched-files-ignored");
+}
+function messageViolation(cwd, result, message) {
+	const file = relativePosix(cwd, result.filePath);
+	const location = {
+		line: message.line,
+		column: message.column
+	};
+	if (message.ruleId !== null) {
+		const severity = message.severity === 1 ? "warn" : "error";
+		return {
+			code: `eslint/lint/${message.ruleId}`,
+			message: `${message.ruleId} (${severity}): ${message.message}`,
+			file,
+			location
+		};
+	}
+	return message.fatal === true ? {
+		code: "eslint/fatal",
+		message: message.message,
+		file,
+		location
+	} : {
+		code: "eslint/lint-message",
+		message: message.message,
+		file,
+		location
+	};
+}
+function byPosition(left, right) {
+	return left.file.localeCompare(right.file) || (left.location?.line ?? 0) - (right.location?.line ?? 0) || (left.location?.column ?? 0) - (right.location?.column ?? 0) || left.code.localeCompare(right.code);
+}
+/**
+* Lints the workspace through the Node API, with the repository's own config, and maps every message to a violation. A pattern that selects no linted file is itself a violation, since the workspace is then not linted at all.
+*/
+async function lintViolations(cwd, eslint, patterns) {
+	const violations = [];
+	const results = /* @__PURE__ */ new Map();
+	for (const pattern of patterns) try {
+		for (const result of await eslint.lintFiles([pattern])) results.set(result.filePath, result);
+	} catch (error) {
+		if (!isNothingLinted(error)) throw new ConformanceError(`ESLint could not lint '${pattern}'`, { cause: error });
+		violations.push({
+			code: "eslint/nothing-linted",
+			message: error.message,
+			file: pattern
+		});
+	}
+	for (const result of results.values()) for (const message of result.messages) violations.push(messageViolation(cwd, result, message));
+	return violations.sort(byPosition);
+}
+/**
+* Proves the repository's own ESLint is applied, which no check that runs inside ESLint can notice: a config that dropped a shared preset, switched its rules off or narrowed `ignores` until nothing is linted still passes its own lint.
+*
+* It loads the ESLint that resolves from the directory the checks run in and resolves the repository's own config through the Node API, so the answer is the one the repository's lint script gets. By default it lints nothing: for each sample it reads the resolved configuration (the object `--print-config` prints) and reports a sample that is not linted, and each required rule that is missing, off or weaker than required. With `lint` it also lints the workspace and reports every message.
+*
+* The config is a black box: the check sees which rules are active on a file, not why. It does not embed a config, so a repository without one is reported and nothing is substituted.
+*/
+const eslint = async ({ cwd, options }) => {
+	const instance = new (loadEslint(cwd))({
+		cwd,
+		...options.configFile === void 0 ? {} : { overrideConfigFile: resolve(cwd, options.configFile) }
+	});
+	const shared = options.rules ?? {};
+	const violations = [];
+	for (const sample of options.samples.map(sampleOf)) violations.push(...await sampleViolations(instance, sample, shared));
+	if (options.lint === true) violations.push(...await lintViolations(cwd, instance, options.lintPatterns ?? DEFAULT_LINT_PATTERNS));
+	return violations;
+};
+//#endregion
 //#region src/checks/instruction-symlinks.ts
 /**
 * The instruction file names checked when the options name none.
@@ -2860,6 +3164,12 @@ const registry = {
 		select: (checks) => enabledOptions(checks["command-types"]),
 		check: commandTypes
 	}),
+	"derived-types": plain({
+		name: "derived-types",
+		description: "Every exported type in a file paired with schema files is derived from one of those schemas, not hand-written",
+		select: (checks) => enabledOptions(checks["derived-types"]),
+		check: derivedTypes
+	}),
 	"import-uphill": importCheck({
 		name: "import-uphill",
 		description: "No package imports a package of a higher rank",
@@ -2920,6 +3230,12 @@ const registry = {
 		select: (checks) => enabledOptions(checks["migrations-directory"]),
 		check: migrationsDirectory
 	}),
+	eslint: plain({
+		name: "eslint",
+		description: "The repository's own ESLint lints the sample files with the required rules enabled at the required severity",
+		select: (checks) => enabledOptions(checks.eslint),
+		check: eslint
+	}),
 	"workflow-job-ordering": plain({
 		name: "workflow-job-ordering",
 		description: "Release, deploy and junction jobs are ordered so a failure stops what follows",
@@ -3021,6 +3337,8 @@ function compiles(source) {
 */
 const pattern = z.string().min(1).refine(compiles, "not a valid regular expression");
 const patterns = z.array(pattern);
+const severity = z.enum(["warn", "error"]);
+const requiredRules = z.record(z.string().min(1), severity);
 const selection = {
 	workflows: z.exactOptional(paths),
 	exclude: z.exactOptional(paths)
@@ -3057,6 +3375,15 @@ const checks = z.strictObject({
 		inferences: z.exactOptional(paths),
 		tsConfig: z.exactOptional(path)
 	}))),
+	"derived-types": z.exactOptional(enabled(z.strictObject({
+		pairs: z.array(z.strictObject({
+			schemas: paths,
+			types: paths
+		})).min(1),
+		exclude: z.exactOptional(names),
+		inferences: z.exactOptional(paths),
+		tsConfig: z.exactOptional(path)
+	}))),
 	"import-uphill": z.exactOptional(enabled(importGraph)),
 	"import-rank-skip": z.exactOptional(enabled(importGraph)),
 	"import-cross-slice": z.exactOptional(enabled(importGraph)),
@@ -3080,6 +3407,16 @@ const checks = z.strictObject({
 		exclude: z.exactOptional(paths),
 		packageJson: z.exactOptional(path)
 	}))),
+	eslint: z.exactOptional(enabled(z.strictObject({
+		samples: z.array(z.union([path, z.strictObject({
+			path,
+			rules: z.exactOptional(requiredRules)
+		})])).min(1),
+		rules: z.exactOptional(requiredRules),
+		configFile: z.exactOptional(path),
+		lint: z.exactOptional(z.boolean()),
+		lintPatterns: z.exactOptional(paths)
+	}))),
 	"migrations-directory": z.exactOptional(enabled(z.strictObject({
 		generator: z.enum(generatorNames),
 		deployTool: z.enum(deployToolNames),