workspace-conformance 1.2.2 → 1.4.0

package/dist/index.d.ts

@@ -397,6 +397,40 @@ interface CommandTypesOptions {
    */
   readonly tsConfig?: string;
 }
+/**
+ * A set of schema files and the files whose exported types must be derived from those schemas.
+ */
+interface DerivedTypesPair {
+  /**
+   * Globs of the files that declare the schemas, relative to the directory the checks run in.
+   */
+  readonly schemas: readonly string[];
+  /**
+   * Globs of the files whose exported interfaces and type aliases must be derived from a schema declared in `schemas`.
+   */
+  readonly types: readonly string[];
+}
+/**
+ * Options of the `derived-types` check: every type a file exports is derived from a schema of its pair.
+ */
+interface DerivedTypesOptions {
+  /**
+   * The schema files and the type files that must derive from them. Each type file is judged against the schemas of every pair that lists it.
+   */
+  readonly pairs: readonly DerivedTypesPair[];
+  /**
+   * Names of exported types that are deliberately written by hand.
+   */
+  readonly exclude?: readonly string[];
+  /**
+   * The last names of the generics that turn a schema into its type, and of the members that hold it, such as `infer` in `z.infer<typeof schema>` and `$inferSelect` in `typeof table.$inferSelect`. `infer`, `input`, `output`, `TypeOf`, `InferInput`, `InferOutput`, `InferSelectModel`, `InferInsertModel`, `$inferSelect` and `$inferInsert` when omitted.
+   */
+  readonly inferences?: readonly string[];
+  /**
+   * The tsconfig that supplies compiler options and module resolution; `tsconfig.json` when omitted.
+   */
+  readonly tsConfig?: string;
+}
 /**
  * Options shared by the checks that cruise the workspace's import graph.
  */
@@ -474,6 +508,48 @@ interface DockerfilePackageManagerOptions {
    */
   readonly packageJson?: string;
 }
+/**
+ * The severity a rule must have at least: `warn` is met by `warn` or `error`, `error` only by `error`.
+ */
+type EslintRequiredSeverity = "warn" | "error";
+/**
+ * A file whose resolved ESLint configuration is checked.
+ */
+interface EslintSample {
+  /**
+   * The file ESLint would lint, relative to the directory the checks run in. It need not exist: ESLint resolves a file's configuration from its path alone.
+   */
+  readonly path: string;
+  /**
+   * Rules required for this file on top of the check's `rules`, which this file's entries override.
+   */
+  readonly rules?: Readonly<Record<string, EslintRequiredSeverity>>;
+}
+/**
+ * Options of the `eslint` check: the repository's own ESLint, resolved from the directory the checks run in, lints the sample files with the required rules.
+ */
+interface EslintOptions {
+  /**
+   * One file per kind of source the repository lints (`src/index.ts`, `package.json`, `eslint.config.ts`). A bare string is `{ path }`. Each must be linted: not ignored, and matched by a configuration block.
+   */
+  readonly samples: readonly (string | EslintSample)[];
+  /**
+   * Rules required for every sample, with the severity each must have at least.
+   */
+  readonly rules?: Readonly<Record<string, EslintRequiredSeverity>>;
+  /**
+   * The config file under test, relative to the directory the checks run in, instead of the one ESLint finds from there.
+   */
+  readonly configFile?: string;
+  /**
+   * Also lint the workspace and report every message ESLint produces. Off when omitted: the default level lints nothing and only reads resolved configuration.
+   */
+  readonly lint?: boolean;
+  /**
+   * What the full level lints, as file and directory patterns relative to the directory the checks run in. `.` when omitted. Used only with `lint`.
+   */
+  readonly lintPatterns?: readonly string[];
+}
 /**
  * Options of the `migrations-directory` check: the directory a schema generator writes migrations to is the one the deploy tool applies them from, and no script applies them with the generator.
  */
@@ -662,6 +738,7 @@ type SettingsReviewThreadResolutionOptions = SettingsOptions;
 interface CheckOptionsByName {
   readonly "aggregate-mappers": AggregateMappersOptions;
   readonly "command-types": CommandTypesOptions;
+  readonly "derived-types": DerivedTypesOptions;
   readonly "import-uphill": ImportGraphOptions;
   readonly "import-rank-skip": ImportGraphOptions;
   readonly "import-cross-slice": ImportGraphOptions;
@@ -672,6 +749,7 @@ interface CheckOptionsByName {
   readonly "commit-types": CommitTypesOptions;
   readonly "dockerfile-package-manager": DockerfilePackageManagerOptions;
   readonly "migrations-directory": MigrationsDirectoryOptions;
+  readonly eslint: EslintOptions;
   readonly "workflow-job-ordering": WorkflowJobOrderingOptions;
   readonly "workflow-skippable-jobs": WorkflowSkippableJobsOptions;
   readonly "workflow-runner-resolution": WorkflowRunnerResolutionOptions;
@@ -722,6 +800,18 @@ export declare const PRESET_COMMIT_TYPES: readonly string[];
  */
 export declare const commitTypes: CheckFunction<CommitTypesOptions>;
 //#endregion
+//#region src/checks/derived-types.d.ts
+/**
+ * The last names that count as inference when the options name none: those of `command-types`, Drizzle's `InferSelectModel` and `InferInsertModel` generics, and the `$inferSelect` and `$inferInsert` members of a Drizzle table, read as `typeof table.$inferSelect`.
+ */
+export declare const DEFAULT_DERIVED_TYPE_INFERENCES: readonly string[];
+/**
+ * For each pair, every exported interface and type alias of its type files is derived from a schema declared in its schema files: somewhere in its definition an inference (a generic in `inferences`, such as `z.infer` or `InferSelectModel`) is applied to `typeof schema`, or an inference member is read from it (`typeof table.$inferSelect`).
+ *
+ * The definition is followed through aliases and interfaces without type parameters, in any file, and through the arguments of other generics, intersections, unions whose members are all derived (`null` and `undefined` aside), arrays, type operators and indexed access. A type literal, and a schema passed to a generic that is not an inference, are written by hand.
+ */
+export declare const derivedTypes: CheckFunction<DerivedTypesOptions>;
+//#endregion
 //#region src/checks/dockerfile-package-manager.d.ts
 /**
  * Every pin of the package manager that `packageManager` names, in each Dockerfile, is the version `packageManager` names, with any `+sha` integrity suffix ignored on both sides. Pins of other package managers are not the workspace's package manager and are left alone.
@@ -730,6 +820,16 @@ export declare const commitTypes: CheckFunction<CommitTypesOptions>;
  */
 export declare const dockerfilePackageManager: CheckFunction<DockerfilePackageManagerOptions>;
 //#endregion
+//#region src/checks/eslint.d.ts
+/**
+ * Proves the repository's own ESLint is applied, which no check that runs inside ESLint can notice: a config that dropped a shared preset, switched its rules off or narrowed `ignores` until nothing is linted still passes its own lint.
+ *
+ * It loads the ESLint that resolves from the directory the checks run in and resolves the repository's own config through the Node API, so the answer is the one the repository's lint script gets. By default it lints nothing: for each sample it reads the resolved configuration (the object `--print-config` prints) and reports a sample that is not linted, and each required rule that is missing, off or weaker than required. With `lint` it also lints the workspace and reports every message.
+ *
+ * The config is a black box: the check sees which rules are active on a file, not why. It does not embed a config, so a repository without one is reported and nothing is substituted.
+ */
+export declare const eslint: CheckFunction<EslintOptions>;
+//#endregion
 //#region src/workspace/packages.d.ts
 /**
  * A package directory found under the workspace root, before the layout classifies it.
@@ -1222,4 +1322,4 @@ export declare function proveExhaustive(input: {
   readonly compilerOptions?: CompilerOptions;
 }): ExhaustivenessProof;
 //#endregion
-export type { AggregateMappersOptions, BranchRules, CaseRemoval, CheckContext, CheckFunction, CheckName, CheckOptionsByName, CheckResult, ChecksConfig, CommandTypesOptions, CommitTypesOptions, ConformanceConfig, DeployDirectory, DeploySelector, DeployToolAdapter, DeployToolName, DiscoveredPackage, DockerfilePackageManagerOptions, ExhaustivenessProof, GeneratorAdapter, GeneratorName, GitHubCheckContext, GitHubCheckFunction, GitHubClient, GitHubClientOptions, ImportGraphOptions, InstructionSymlinksOptions, Job, LayoutCheckContext, LayoutCheckFunction, MigrationsDirectoryOptions, PermissionAccess, Permissions, PinningLevel, RegisteredCheck, RepositorySettings, RepositorySlug, RunChecksOptions, RunResult, RunsOn, SettingsMergeMethodsOptions, SettingsOptions, SettingsRequiredChecksOptions, SettingsReviewThreadResolutionOptions, SingleStorybookOptions, SourceLocation, Step, TypeErrorReport, UsesReference, Violation, Workflow, WorkflowActionPinningOptions, WorkflowCredentialsOptions, WorkflowJobOrderingOptions, WorkflowMergeGroupOptions, WorkflowRepositoryDispatchOptions, WorkflowRunnerResolutionOptions, WorkflowSelection, WorkflowSkippableJobsOptions, WorkflowUpdateBotCooldownOptions, WorkflowVersionSingleSourceOptions, WorkspacePackage };
+export type { AggregateMappersOptions, BranchRules, CaseRemoval, CheckContext, CheckFunction, CheckName, CheckOptionsByName, CheckResult, ChecksConfig, CommandTypesOptions, CommitTypesOptions, ConformanceConfig, DeployDirectory, DeploySelector, DeployToolAdapter, DeployToolName, DerivedTypesOptions, DerivedTypesPair, DiscoveredPackage, DockerfilePackageManagerOptions, EslintOptions, EslintRequiredSeverity, EslintSample, ExhaustivenessProof, GeneratorAdapter, GeneratorName, GitHubCheckContext, GitHubCheckFunction, GitHubClient, GitHubClientOptions, ImportGraphOptions, InstructionSymlinksOptions, Job, LayoutCheckContext, LayoutCheckFunction, MigrationsDirectoryOptions, PermissionAccess, Permissions, PinningLevel, RegisteredCheck, RepositorySettings, RepositorySlug, RunChecksOptions, RunResult, RunsOn, SettingsMergeMethodsOptions, SettingsOptions, SettingsRequiredChecksOptions, SettingsReviewThreadResolutionOptions, SingleStorybookOptions, SourceLocation, Step, TypeErrorReport, UsesReference, Violation, Workflow, WorkflowActionPinningOptions, WorkflowCredentialsOptions, WorkflowJobOrderingOptions, WorkflowMergeGroupOptions, WorkflowRepositoryDispatchOptions, WorkflowRunnerResolutionOptions, WorkflowSelection, WorkflowSkippableJobsOptions, WorkflowUpdateBotCooldownOptions, WorkflowVersionSingleSourceOptions, WorkspacePackage };

package/dist/index.js

@@ -1,7 +1,8 @@
+import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import { dirname, extname, join, posix, relative, resolve, sep } from "node:path";
 import { escapePath, glob, isDynamicPattern } from "tinyglobby";
-import { ModuleKind, ModuleResolutionKind, Node, Project, ScriptTarget, ts } from "ts-morph";
+import { ModuleKind, ModuleResolutionKind, Node, Project, ScriptTarget, SyntaxKind, ts } from "ts-morph";
 import { createJitiLoader, validateStandard } from "cosmiconfig-extends";
 import { readFile, realpath } from "node:fs/promises";
 import { LineCounter, isMap, isNode, isScalar, isSeq, parse, parseDocument } from "yaml";
@@ -211,6 +212,32 @@ const aggregateMappers = async ({ cwd, options }) => {
 	return violations.sort((a, b) => a.file.localeCompare(b.file) || (a.location?.line ?? 0) - (b.location?.line ?? 0) || a.message.localeCompare(b.message));
 };
 //#endregion
+//#region src/checks/type-references.ts
+/**
+* The identifier a reference ends in: `infer` in `z.infer`, the name itself when it is not qualified.
+*/
+function lastIdentifier(reference) {
+	if (Node.isQualifiedName(reference)) return reference.getRight();
+	if (Node.isPropertyAccessExpression(reference)) return reference.getNameNode();
+	return reference;
+}
+/**
+* The declarations the identifier refers to, through any imports and re-exports.
+*/
+function declarationsOf(identifier) {
+	const symbol = identifier.getSymbol();
+	return (symbol?.getAliasedSymbol() ?? symbol)?.getDeclarations() ?? [];
+}
+/**
+* The names a reference goes by: the last name as written, and the name it was declared with when that differs, as for `Infer` in `import type { infer as Infer } from 'zod'`, which is also `infer`. A library may itself re-export a generic under another name, so both count.
+*/
+function referenceNames(reference) {
+	const identifier = lastIdentifier(reference);
+	const symbol = identifier.getSymbol();
+	const declared = (symbol?.getAliasedSymbol() ?? symbol)?.getName();
+	return declared === void 0 ? [identifier.getText()] : [.../* @__PURE__ */ new Set([identifier.getText(), declared])];
+}
+//#endregion
 //#region src/checks/command-types.ts
 /**
 * The last names of the generics that turn a schema into its type, used when the options name none: `z.infer`, `z.input`, `z.output`, `z.TypeOf` and Valibot's `InferInput` and `InferOutput`.
@@ -228,20 +255,10 @@ const DEFAULT_INFERENCES = [
 */
 const STANDARD_SCHEMA_MEMBER = "~standard";
 /**
-* The names a type reference goes by: the last name as written, and the name it was declared with when that differs, as for `Infer` in `import type { infer as Infer } from 'zod'`, which is also `infer`. A library may itself re-export a generic under another name, so both count.
-*/
-function namesOf(typeName) {
-	const identifier = Node.isQualifiedName(typeName) ? typeName.getRight() : typeName;
-	const symbol = identifier.getSymbol();
-	const declared = (symbol?.getAliasedSymbol() ?? symbol)?.getName();
-	return declared === void 0 ? [identifier.getText()] : [.../* @__PURE__ */ new Set([identifier.getText(), declared])];
-}
-/**
 * The local alias without type parameters that a type reference names, or `undefined` when it names anything else. Such an alias is a name for the type it is written as, so it is judged by that.
 */
 function aliasNamed(typeName) {
-	const symbol = typeName.getSymbol();
-	const declaration = (symbol?.getAliasedSymbol() ?? symbol)?.getDeclarations().find(Node.isTypeAliasDeclaration);
+	const declaration = declarationsOf(lastIdentifier(typeName)).find(Node.isTypeAliasDeclaration);
 	return declaration?.getTypeParameters().length === 0 ? declaration : void 0;
 }
 /**
@@ -254,7 +271,7 @@ function problem$1(declaration, name, inferences, followed = /* @__PURE__ */ new
 	};
 	const written = declaration.getTypeNode();
 	if (Node.isTypeReference(written)) {
-		const inference = namesOf(written.getTypeName()).find((candidate) => inferences.includes(candidate));
+		const inference = referenceNames(written.getTypeName()).find((candidate) => inferences.includes(candidate));
 		if (inference !== void 0) {
 			const [argument] = written.getTypeArguments();
 			if (argument !== void 0 && Node.isTypeQuery(argument) && argument.getExprName().getType().getProperty(STANDARD_SCHEMA_MEMBER) !== void 0) return;
@@ -450,6 +467,120 @@ const commitTypes = async ({ cwd, options, configFiles }) => {
 	return violations;
 };
 //#endregion
+//#region src/checks/derived-types.ts
+/**
+* The last names that count as inference when the options name none: those of `command-types`, Drizzle's `InferSelectModel` and `InferInsertModel` generics, and the `$inferSelect` and `$inferInsert` members of a Drizzle table, read as `typeof table.$inferSelect`.
+*/
+const DEFAULT_DERIVED_TYPE_INFERENCES = [
+	...DEFAULT_INFERENCES,
+	"InferSelectModel",
+	"InferInsertModel",
+	"$inferSelect",
+	"$inferInsert"
+];
+/**
+* Whether the node names something declared in one of the schema files.
+*/
+function declaredInSchema(name, derivation) {
+	const identifier = Node.isIdentifier(name) ? name : Node.isQualifiedName(name) ? name.getRight() : void 0;
+	return identifier !== void 0 && declarationsOf(identifier).some((declaration) => derivation.schemaFiles.has(relativePosix(derivation.cwd, declaration.getSourceFile().getFilePath())));
+}
+/**
+* The interface or type alias without type parameters a reference names, when it has not been followed yet. Such a declaration is a name for what it is written as, so it is judged by that.
+*/
+function followable(reference, derivation) {
+	const name = Node.isTypeReference(reference) ? reference.getTypeName() : reference.getExpression();
+	if (!Node.isIdentifier(name) && !Node.isQualifiedName(name) && !Node.isPropertyAccessExpression(name)) return;
+	const declaration = declarationsOf(lastIdentifier(name)).find((found) => Node.isTypeAliasDeclaration(found) || Node.isInterfaceDeclaration(found));
+	return declaration?.getTypeParameters().length === 0 && !derivation.followed.has(declaration) ? declaration : void 0;
+}
+function isNullish(node) {
+	return node.getKind() === SyntaxKind.UndefinedKeyword || Node.isLiteralTypeNode(node) && node.getLiteral().getKind() === SyntaxKind.NullKeyword;
+}
+/**
+* Whether a reference is derived: an inference applied to `typeof schema`, an alias or interface that is itself derived, or another generic given a derived type, as `Partial<Order>` is.
+*/
+function derivedReference(reference, derivation) {
+	const name = Node.isTypeReference(reference) ? reference.getTypeName() : reference.getExpression();
+	if ((Node.isIdentifier(name) || Node.isQualifiedName(name) || Node.isPropertyAccessExpression(name)) && referenceNames(name).some((candidate) => derivation.inferences.has(candidate))) {
+		const [argument] = reference.getTypeArguments();
+		return argument !== void 0 && Node.isTypeQuery(argument) && declaredInSchema(argument.getExprName(), derivation);
+	}
+	const declaration = followable(reference, derivation);
+	if (declaration !== void 0) return derivedDeclaration(declaration, {
+		...derivation,
+		followed: /* @__PURE__ */ new Set([...derivation.followed, declaration])
+	});
+	return reference.getTypeArguments().some((argument) => derivedType(argument, derivation));
+}
+/**
+* Whether a type, as written, is derived from a schema. A type literal is written by hand whatever its members are.
+*/
+function derivedType(node, derivation) {
+	if (Node.isTypeReference(node) || Node.isExpressionWithTypeArguments(node)) return derivedReference(node, derivation);
+	if (Node.isTypeQuery(node)) {
+		const name = node.getExprName();
+		return Node.isQualifiedName(name) && referenceNames(name).some((candidate) => derivation.inferences.has(candidate)) && declaredInSchema(name.getLeft(), derivation);
+	}
+	if (Node.isParenthesizedTypeNode(node) || Node.isTypeOperatorTypeNode(node)) return derivedType(node.getTypeNode(), derivation);
+	if (Node.isArrayTypeNode(node)) return derivedType(node.getElementTypeNode(), derivation);
+	if (Node.isIndexedAccessTypeNode(node)) return derivedType(node.getObjectTypeNode(), derivation);
+	if (Node.isIntersectionTypeNode(node)) return node.getTypeNodes().some((member) => derivedType(member, derivation));
+	if (Node.isUnionTypeNode(node)) {
+		const members = node.getTypeNodes().filter((member) => !isNullish(member));
+		return members.length > 0 && members.every((member) => derivedType(member, derivation));
+	}
+	return false;
+}
+/**
+* Whether an interface or type alias is derived: an alias by the type it is written as, an interface by whether it extends a derived type.
+*/
+function derivedDeclaration(declaration, derivation) {
+	if (Node.isInterfaceDeclaration(declaration)) return declaration.getExtends().some((heritage) => derivedReference(heritage, derivation));
+	return derivedType(declaration.getTypeNodeOrThrow(), derivation);
+}
+async function pairViolations(cwd, options, pair, index) {
+	const { project, files } = await createProject(cwd, options.tsConfig, pair.types, {
+		check: "derived-types",
+		files: `pairs.${String(index)}.types`
+	});
+	const schemaFiles = await findFiles(cwd, pair.schemas);
+	if (schemaFiles.length === 0) throw new ConformanceError(`checks.derived-types.pairs.${String(index)}.schemas: no file matches`);
+	const excluded = new Set(options.exclude);
+	const derivation = {
+		inferences: new Set(options.inferences ?? DEFAULT_DERIVED_TYPE_INFERENCES),
+		schemaFiles: new Set(schemaFiles),
+		cwd,
+		followed: /* @__PURE__ */ new Set()
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const violations = [];
+	for (const file of files) for (const [name, declaration] of exportedTypes(project.getSourceFileOrThrow(resolve(cwd, file)))) {
+		if (excluded.has(name) || seen.has(declaration)) continue;
+		seen.add(declaration);
+		if (!derivedDeclaration(declaration, {
+			...derivation,
+			followed: /* @__PURE__ */ new Set([declaration])
+		})) violations.push({
+			code: "derived-types/not-derived",
+			message: `${name} is not derived from a schema in ${pair.schemas.join(", ")}: nothing in its definition applies an inference generic to one`,
+			file: relativePosix(cwd, declaration.getSourceFile().getFilePath()),
+			location: declarationLocation(declaration)
+		});
+	}
+	return violations;
+}
+/**
+* For each pair, every exported interface and type alias of its type files is derived from a schema declared in its schema files: somewhere in its definition an inference (a generic in `inferences`, such as `z.infer` or `InferSelectModel`) is applied to `typeof schema`, or an inference member is read from it (`typeof table.$inferSelect`).
+*
+* The definition is followed through aliases and interfaces without type parameters, in any file, and through the arguments of other generics, intersections, unions whose members are all derived (`null` and `undefined` aside), arrays, type operators and indexed access. A type literal, and a schema passed to a generic that is not an inference, are written by hand.
+*/
+const derivedTypes = async ({ cwd, options }) => {
+	const violations = [];
+	for (const [index, pair] of options.pairs.entries()) violations.push(...await pairViolations(cwd, options, pair, index));
+	return violations.sort((a, b) => a.file.localeCompare(b.file) || (a.location?.line ?? 0) - (b.location?.line ?? 0) || a.message.localeCompare(b.message));
+};
+//#endregion
 //#region src/checks/dockerfile-package-manager.ts
 const DEFAULT_DOCKERFILES = [
 	"**/Dockerfile",
@@ -542,6 +673,179 @@ const dockerfilePackageManager = async ({ cwd, options }) => {
 	return violations;
 };
 //#endregion
+//#region src/checks/eslint.ts
+/**
+* The patterns the full level lints when the options name none.
+*/
+const DEFAULT_LINT_PATTERNS = ["."];
+const SEVERITY_RANK = {
+	off: 0,
+	warn: 1,
+	error: 2
+};
+function hasEslintClass(value) {
+	return isRecord(value) && typeof value["ESLint"] === "function";
+}
+/**
+* The `ESLint` class of the ESLint installed where the checks run, found the way a module in `cwd` finds it. It is not this package's own copy, so the results agree with the repository's own lint script.
+*/
+function loadEslint(cwd) {
+	const requireFromCwd = createRequire(join(cwd, "package.json"));
+	try {
+		requireFromCwd.resolve("eslint");
+	} catch (error) {
+		throw new ConformanceError(`the eslint check uses the repository's own ESLint, and 'eslint' does not resolve from ${cwd}; install it there`, { cause: error });
+	}
+	const loaded = requireFromCwd("eslint");
+	if (!hasEslintClass(loaded)) throw new ConformanceError(`the 'eslint' that resolves from ${cwd} does not export the ESLint class of the Node API`);
+	return loaded.ESLint;
+}
+/**
+* The severity a rule entry resolves to. An entry is a severity or an array whose first element is one, and a severity is `0`, `1`, `2`, `'off'`, `'warn'` or `'error'`; `calculateConfigForFile` returns whichever form the config was written in.
+*/
+function normaliseSeverity(entry) {
+	const severity = Array.isArray(entry) ? entry[0] : entry;
+	if (severity === 0 || severity === "off") return "off";
+	if (severity === 1 || severity === "warn") return "warn";
+	if (severity === 2 || severity === "error") return "error";
+	throw new ConformanceError(`ESLint resolved ${JSON.stringify(entry)} as a rule entry, which is not a severity or an array that starts with one`);
+}
+/**
+* The severity of each rule in a resolved configuration.
+*/
+function resolvedSeverities(config) {
+	if (!isRecord(config)) throw new ConformanceError("ESLint resolved a configuration that is not an object");
+	const { rules } = config;
+	if (rules !== void 0 && !isRecord(rules)) throw new ConformanceError("ESLint resolved a configuration whose 'rules' is not an object");
+	return new Map(Object.entries(rules ?? {}).map(([rule, entry]) => [rule, normaliseSeverity(entry)]));
+}
+/**
+* Whether `error` is the one `calculateConfigForFile` throws when ESLint finds no config file for the path.
+*/
+function isMissingConfig(error) {
+	return isRecord(error) && error["messageTemplate"] === "config-file-missing";
+}
+function sampleOf(sample) {
+	return typeof sample === "string" ? { path: sample } : sample;
+}
+function ruleViolations(file, required, actual) {
+	return Object.entries(required).flatMap(([rule, severity]) => {
+		const found = actual.get(rule);
+		if (found === void 0) return [{
+			code: "eslint/rule-missing",
+			message: `the rule '${rule}' is not configured for ${file} (required: ${severity})`,
+			file
+		}];
+		if (found === "off") return [{
+			code: "eslint/rule-off",
+			message: `the rule '${rule}' is off for ${file} (required: ${severity})`,
+			file
+		}];
+		if (SEVERITY_RANK[found] < SEVERITY_RANK[severity]) return [{
+			code: "eslint/rule-too-weak",
+			message: `the rule '${rule}' is '${found}' for ${file} (required: ${severity})`,
+			file
+		}];
+		return [];
+	});
+}
+async function sampleViolations(eslint, sample, shared) {
+	const file = sample.path;
+	let config;
+	try {
+		config = await eslint.calculateConfigForFile(file);
+	} catch (error) {
+		if (isMissingConfig(error)) return [{
+			code: "eslint/no-config",
+			message: `ESLint finds no config file for ${file}; the check does not fall back to a config of its own`,
+			file
+		}];
+		throw new ConformanceError(`ESLint could not resolve its configuration for ${file}`, { cause: error });
+	}
+	if (config === void 0) return [{
+		code: "eslint/not-linted",
+		message: `${file} is not linted: it is ignored, or no configuration block matches it`,
+		file
+	}];
+	return ruleViolations(file, {
+		...shared,
+		...sample.rules
+	}, resolvedSeverities(config));
+}
+/**
+* Whether `error` is ESLint refusing a pattern because it selects no file that is linted.
+*/
+function isNothingLinted(error) {
+	return error instanceof Error && isRecord(error) && (error["messageTemplate"] === "file-not-found" || error["messageTemplate"] === "all-matched-files-ignored");
+}
+function messageViolation(cwd, result, message) {
+	const file = relativePosix(cwd, result.filePath);
+	const location = {
+		line: message.line,
+		column: message.column
+	};
+	if (message.ruleId !== null) {
+		const severity = message.severity === 1 ? "warn" : "error";
+		return {
+			code: `eslint/lint/${message.ruleId}`,
+			message: `${message.ruleId} (${severity}): ${message.message}`,
+			file,
+			location
+		};
+	}
+	return message.fatal === true ? {
+		code: "eslint/fatal",
+		message: message.message,
+		file,
+		location
+	} : {
+		code: "eslint/lint-message",
+		message: message.message,
+		file,
+		location
+	};
+}
+function byPosition(left, right) {
+	return left.file.localeCompare(right.file) || (left.location?.line ?? 0) - (right.location?.line ?? 0) || (left.location?.column ?? 0) - (right.location?.column ?? 0) || left.code.localeCompare(right.code);
+}
+/**
+* Lints the workspace through the Node API, with the repository's own config, and maps every message to a violation. A pattern that selects no linted file is itself a violation, since the workspace is then not linted at all.
+*/
+async function lintViolations(cwd, eslint, patterns) {
+	const violations = [];
+	const results = /* @__PURE__ */ new Map();
+	for (const pattern of patterns) try {
+		for (const result of await eslint.lintFiles([pattern])) results.set(result.filePath, result);
+	} catch (error) {
+		if (!isNothingLinted(error)) throw new ConformanceError(`ESLint could not lint '${pattern}'`, { cause: error });
+		violations.push({
+			code: "eslint/nothing-linted",
+			message: error.message,
+			file: pattern
+		});
+	}
+	for (const result of results.values()) for (const message of result.messages) violations.push(messageViolation(cwd, result, message));
+	return violations.sort(byPosition);
+}
+/**
+* Proves the repository's own ESLint is applied, which no check that runs inside ESLint can notice: a config that dropped a shared preset, switched its rules off or narrowed `ignores` until nothing is linted still passes its own lint.
+*
+* It loads the ESLint that resolves from the directory the checks run in and resolves the repository's own config through the Node API, so the answer is the one the repository's lint script gets. By default it lints nothing: for each sample it reads the resolved configuration (the object `--print-config` prints) and reports a sample that is not linted, and each required rule that is missing, off or weaker than required. With `lint` it also lints the workspace and reports every message.
+*
+* The config is a black box: the check sees which rules are active on a file, not why. It does not embed a config, so a repository without one is reported and nothing is substituted.
+*/
+const eslint = async ({ cwd, options }) => {
+	const instance = new (loadEslint(cwd))({
+		cwd,
+		...options.configFile === void 0 ? {} : { overrideConfigFile: resolve(cwd, options.configFile) }
+	});
+	const shared = options.rules ?? {};
+	const violations = [];
+	for (const sample of options.samples.map(sampleOf)) violations.push(...await sampleViolations(instance, sample, shared));
+	if (options.lint === true) violations.push(...await lintViolations(cwd, instance, options.lintPatterns ?? DEFAULT_LINT_PATTERNS));
+	return violations;
+};
+//#endregion
 //#region src/workspace/rules.ts
 const REGEXP_SPECIAL = /[.*+?^${}()|[\]\\]/gu;
 function escapeRegExp(text) {
@@ -2766,6 +3070,8 @@ function compiles(source) {
 */
 const pattern = z.string().min(1).refine(compiles, "not a valid regular expression");
 const patterns = z.array(pattern);
+const severity = z.enum(["warn", "error"]);
+const requiredRules = z.record(z.string().min(1), severity);
 const selection = {
 	workflows: z.exactOptional(paths),
 	exclude: z.exactOptional(paths)
@@ -2802,6 +3108,15 @@ const checks = z.strictObject({
 		inferences: z.exactOptional(paths),
 		tsConfig: z.exactOptional(path)
 	}))),
+	"derived-types": z.exactOptional(enabled(z.strictObject({
+		pairs: z.array(z.strictObject({
+			schemas: paths,
+			types: paths
+		})).min(1),
+		exclude: z.exactOptional(names),
+		inferences: z.exactOptional(paths),
+		tsConfig: z.exactOptional(path)
+	}))),
 	"import-uphill": z.exactOptional(enabled(importGraph)),
 	"import-rank-skip": z.exactOptional(enabled(importGraph)),
 	"import-cross-slice": z.exactOptional(enabled(importGraph)),
@@ -2825,6 +3140,16 @@ const checks = z.strictObject({
 		exclude: z.exactOptional(paths),
 		packageJson: z.exactOptional(path)
 	}))),
+	eslint: z.exactOptional(enabled(z.strictObject({
+		samples: z.array(z.union([path, z.strictObject({
+			path,
+			rules: z.exactOptional(requiredRules)
+		})])).min(1),
+		rules: z.exactOptional(requiredRules),
+		configFile: z.exactOptional(path),
+		lint: z.exactOptional(z.boolean()),
+		lintPatterns: z.exactOptional(paths)
+	}))),
 	"migrations-directory": z.exactOptional(enabled(z.strictObject({
 		generator: z.enum(generatorNames),
 		deployTool: z.enum(deployToolNames),
@@ -3039,6 +3364,12 @@ const registry = {
 		select: (checks) => enabledOptions(checks["command-types"]),
 		check: commandTypes
 	}),
+	"derived-types": plain({
+		name: "derived-types",
+		description: "Every exported type in a file paired with schema files is derived from one of those schemas, not hand-written",
+		select: (checks) => enabledOptions(checks["derived-types"]),
+		check: derivedTypes
+	}),
 	"import-uphill": importCheck({
 		name: "import-uphill",
 		description: "No package imports a package of a higher rank",
@@ -3099,6 +3430,12 @@ const registry = {
 		select: (checks) => enabledOptions(checks["migrations-directory"]),
 		check: migrationsDirectory
 	}),
+	eslint: plain({
+		name: "eslint",
+		description: "The repository's own ESLint lints the sample files with the required rules enabled at the required severity",
+		select: (checks) => enabledOptions(checks.eslint),
+		check: eslint
+	}),
 	"workflow-job-ordering": plain({
 		name: "workflow-job-ordering",
 		description: "Release, deploy and junction jobs are ordered so a failure stops what follows",
@@ -3380,4 +3717,4 @@ function proveExhaustive(input) {
 	}) };
 }
 //#endregion
-export { ConformanceError, DEFAULT_INFERENCES, DEFAULT_WORKFLOWS, EXIT_CODES, ExhaustivenessError, PRESET_COMMIT_TYPES, accessOf, aggregateMappers, checkNames, classifyPackages, commandTypes, commitTypes, conformanceSchema, conformanceSection, createGitHubClient, crossSliceRules, cycleRule, deployTools, dockerfilePackageManager, effectiveEnv, effectivePermissions, generators, handlerCases, importCrossSlice, importCycles, importIsolatedGroups, importRankSkip, importUphill, instructionSymlinks, isCheckName, isolatedGroupRules, loadWorkflows, migrationsDirectory, packagesPattern, parseUses, parseWorkflow, proveExhaustive, rankSkipRules, registry, removeCase, runChecks, settingsMergeMethods, settingsRequiredChecks, settingsReviewThreadResolution, singleStorybook, transitiveNeeds, typeErrors, uphillRules, workflowActionPinning, workflowCredentials, workflowJobOrdering, workflowMergeGroup, workflowRepositoryDispatch, workflowRunnerResolution, workflowSkippableJobs, workflowUpdateBotCooldown, workflowVersionSingleSource };
+export { ConformanceError, DEFAULT_DERIVED_TYPE_INFERENCES, DEFAULT_INFERENCES, DEFAULT_WORKFLOWS, EXIT_CODES, ExhaustivenessError, PRESET_COMMIT_TYPES, accessOf, aggregateMappers, checkNames, classifyPackages, commandTypes, commitTypes, conformanceSchema, conformanceSection, createGitHubClient, crossSliceRules, cycleRule, deployTools, derivedTypes, dockerfilePackageManager, effectiveEnv, effectivePermissions, eslint, generators, handlerCases, importCrossSlice, importCycles, importIsolatedGroups, importRankSkip, importUphill, instructionSymlinks, isCheckName, isolatedGroupRules, loadWorkflows, migrationsDirectory, packagesPattern, parseUses, parseWorkflow, proveExhaustive, rankSkipRules, registry, removeCase, runChecks, settingsMergeMethods, settingsRequiredChecks, settingsReviewThreadResolution, singleStorybook, transitiveNeeds, typeErrors, uphillRules, workflowActionPinning, workflowCredentials, workflowJobOrdering, workflowMergeGroup, workflowRepositoryDispatch, workflowRunnerResolution, workflowSkippableJobs, workflowUpdateBotCooldown, workflowVersionSingleSource };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "workspace-conformance",
   "description": "Conformance checks for a pnpm workspace that ESLint cannot express: type-graph, import-graph and cross-file checks driven by the shared layout section of @exadev/config",
-  "version": "1.2.2",
+  "version": "1.4.0",
   "bin": {
     "workspace-conformance": "./dist/cli.js"
   },
@@ -72,8 +72,14 @@
   "packageManager": "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
   "peerDependencies": {
     "cosmiconfig": "^9.0.0 || ^10.0.0",
+    "eslint": "^9.0.0 || ^10.0.0",
     "typescript": "^5.9.0 || ^6.0.0"
   },
+  "peerDependenciesMeta": {
+    "eslint": {
+      "optional": true
+    }
+  },
   "publishConfig": {
     "access": "public",
     "provenance": true