@adamaho/nopeus-oxlint-plugin 0.7.0

package/README.md

@@ -0,0 +1,822 @@
+# @adamaho/nopeus-oxlint-plugin
+
+Custom Oxlint rules for AI-assisted TypeScript codebases. The `base` preset
+enables general TypeScript rules; `effect` adds Effect-specific syntax rules.
+Both apply to production and test code.
+
+## Usage
+
+Install Nopeus and its Oxlint peer:
+
+```bash
+pnpm add --save-dev @adamaho/nopeus-oxlint-plugin oxlint
+```
+
+Neither preset requires `effect`, `@effect/tsgo`, `@effect/language-service`,
+`@effect/vitest`, or `oxlint-tsgolint` to be installed. Effect packages listed in
+this repository's devDependencies are for developing and testing Nopeus; they
+are not installed with the published plugin.
+
+### General TypeScript rules
+
+Use `@adamaho/nopeus-oxlint-plugin/base` in `oxlint.config.ts`:
+
+```ts
+import base from "@adamaho/nopeus-oxlint-plugin/base";
+import { defineConfig } from "oxlint";
+
+export default defineConfig({ extends: [base] });
+```
+
+This enables the general rules for type assertions, type widening, dictionaries,
+parameters, reflection, module mocking, conditional spreads, and public JSDoc.
+It does not enable Effect service, runtime, state-lifetime, or v4 migration rules.
+No compiler patch or Effect-specific tsconfig is needed.
+
+The separate `@adamaho/nopeus-oxlint-config` package selects built-in Oxlint rules.
+It does not contain the custom rule implementations in this plugin. To combine
+both, install that package too and use `extends: [builtins, base]`, importing
+`builtins` from `@adamaho/nopeus-oxlint-config`.
+
+### Effect syntax rules
+
+The `effect` preset includes the general preset, so choose it when the project
+uses Effect; there is no need to extend both plugin presets.
+
+Extend the canonical policy from an oxlint.config.ts file:
+
+```ts
+import packageJson from "./package.json" with { type: "json" };
+import effect from "@adamaho/nopeus-oxlint-plugin/effect";
+import { defineConfig } from "oxlint";
+
+export default defineConfig({
+  extends: [
+    effect({
+      packageName: packageJson.name,
+      runtimeEntryPoints: ["src/main.ts"],
+    }),
+  ],
+});
+```
+
+The root package name defines the owned Effect service namespace. Both goho and
+@adamaho/goho require trace names and service keys beginning with @goho/.
+
+The package publishes compiled ESM and requires Node.js 22.18 or newer, or
+Node.js 24 or newer.
+
+## Rules
+
+### nopeus/no-export-assignment
+
+Rejects TypeScript's CommonJS `export = value` syntax; use named ESM exports or
+`export default` instead. Enabled in both `/base` and `/effect`. The built-in
+config supplies `typescript/no-require-imports` and `import/no-commonjs` for
+CommonJS imports and JavaScript exports. The policy requires ESM source, not
+ESM-only dependencies.
+
+### nopeus/require-test-location
+
+Test files belong under the nearest package's `test/` directory, alongside
+`src/`, and use `.test` rather than `.spec` before their source extension.
+The same policy applies to libraries and executable programs, regardless of
+whether Oxlint runs from the repository root or a package directory.
+
+Bad: `src/users/service.test.ts`, `tests/users.test.ts`, `test/users.spec.ts`.
+
+Good: `test/users/service.test.ts`, `test/integration/users.test.ts`,
+`test/e2e/server.test.ts`, `test/package/installation.test.ts`.
+
+Module tests should mirror source paths, but the rule does not require a test
+for each source file or prescribe feature folders. It recognizes `.test` and
+`.spec` filenames with JS, JSX, TS, TSX, MJS, CJS, MTS, and CTS extensions;
+it does not infer tests from arbitrary function calls. Files without a package
+owner are skipped. Test helpers need no `.test` suffix.
+
+### nopeus/no-test-imports
+
+Files under a package's `src/` cannot import its `test/` resources, another
+package's test resources, or legacy `tests/`, `__tests__`, and test/spec files.
+This includes type-only imports, re-exports, literal dynamic imports, and
+unshadowed `require` calls. Tests and root-level runner configs may use helpers.
+
+Bad, in `src/users/service.ts`:
+
+```ts
+import { usersLayer } from "../../test/helpers/users-test-layer.ts";
+```
+
+Good, in `test/users/service.test.ts`:
+
+```ts
+import { make } from "../../src/users/service.ts";
+import { usersLayer } from "../helpers/users-test-layer.ts";
+```
+
+Keep helpers under `test/helpers/` and inputs under `test/fixtures/` when they
+need to be shared. Create those directories only when needed.
+
+### nopeus/no-cross-package-internals
+
+Cross-package imports must use the destination package's own name and public
+entrypoints. Relative/absolute filesystem imports and TypeScript aliases cannot
+reach into another package, even when the destination file is itself exported.
+Tests retain access to their own package's private implementation.
+
+Bad:
+
+```ts
+import { authenticate } from "../../auth/src/internal/authenticate.ts";
+```
+
+Good:
+
+```ts
+import { authenticate } from "@example/auth";
+import { session } from "@example/auth/session";
+```
+
+Resolution uses `oxc-resolver`, including package export maps, conditional and
+wildcard exports, symlinked workspaces, and automatically discovered tsconfig
+paths. A cross-package alias is accepted only when it spells the destination's
+public package entrypoint and resolves to the same file as that entrypoint.
+Legacy packages without export maps may be imported through their root name;
+deep imports require an explicit export map.
+
+Manifests containing only `{"type":"module"}` or `{"type":"commonjs"}`
+select a module format, not a separate package owner. Public exports into these
+directories remain valid; other manifests still establish package boundaries.
+
+The import rules inspect static imports/re-exports (including type-only forms),
+TypeScript import types/import-equals, literal dynamic imports, and unshadowed
+`require`. Computed module names, custom bundler-only aliases, and otherwise
+unresolved bare imports remain outside this check; the compiler still owns
+resolution errors. Resolution currently uses `types`, `import`, `node`, and
+`default` conditions. It does not model arbitrary bundler custom conditions.
+CommonJS syntax is rejected separately by the syntax policy; these boundary
+checks do not attempt to resolve `require`-specific export conditions.
+
+All three structure rules are errors in both `/base` and `/effect`. Include
+both `src` and `test` in the consuming project's lint command. Narrowly exclude
+deliberately invalid fixture projects, not ordinary test code. The built-in
+config package supplies filename casing separately.
+
+### nopeus/no-module-level-mutable-state
+
+Rejects module-level `let`/`var` and direct construction of writable global
+`Map`, `Set`, `WeakMap`, or `WeakSet` values. Service state belongs to construction.
+
+Bad:
+
+```ts
+const cache = new Map<UserId, User>();
+export const make = Effect.sync(() => buildUsers(cache));
+```
+
+Good:
+
+```ts
+export const make = Effect.sync(() => {
+  const cache = new Map<UserId, User>();
+  return buildUsers(cache);
+});
+```
+
+Immutable lookup tables can use an explicit readonly contract:
+
+```ts
+const statusCodes: ReadonlyMap<string, number> = new Map([["ok", 200]]);
+```
+
+`satisfies ReadonlyMap` alone does not remove the mutable methods from an inferred
+Map type and is not an exception. Imported persistent collection constructors
+and function-local state remain allowed. This syntax-level rule does not infer
+arbitrary factories, nested object state, clients, or mutation through aliases.
+Explicitly owned process-wide mutable infrastructure needs a local exception.
+
+In v4, separate `Effect.provide` calls can share memoized Layers. Construction
+owns state per acquired service instance, not per provide call. Use `Layer.fresh`
+or `Effect.provide(layer, { local: true })` only where isolation is intentional;
+this rule does not require either mechanism.
+
+### nopeus/require-fetch-abort-signal
+
+Requires global `fetch` calls directly inside an `Effect.tryPromise` callback to
+forward that callback's AbortSignal in a visible options object.
+
+Bad:
+
+```ts
+Effect.tryPromise({
+  try: () => fetch(url),
+  catch: toRequestFailed,
+});
+```
+
+Good:
+
+```ts
+Effect.tryPromise({
+  try: (signal) => fetch(url, { ...requestOptions, signal }),
+  catch: toRequestFailed,
+});
+```
+
+Put `signal` after spreads and computed properties that could overwrite it.
+`globalThis.fetch`, aliased Effect imports, renamed callback parameters, and
+shadowed globals are handled. SDK methods and deferred nested callbacks are
+outside this narrow rule. Prebuilt Request/options objects, combined signals,
+and indirect signal aliases require an explicit local exception or forwarding
+the callback parameter directly at the adapter boundary.
+
+### nopeus/no-type-assertions
+
+Rejects every non-const TypeScript assertion. A comment cannot prove a runtime
+invariant, so the policy has no assertion escape hatch.
+
+Bad:
+
+```ts
+const user = input as User;
+```
+
+Good:
+
+```ts
+const decodeUser = Schema.decodeUnknownSync(User);
+const user = decodeUser(input);
+```
+
+Effect SQL, Drizzle, and other typed data APIs should carry their result types
+without assertions. Const assertions remain allowed.
+
+### nopeus/no-conditional-empty-object-spread
+
+Rejects object spreads that use an empty object as one side of a conditional.
+The omission is easier to review when it is expressed as an explicit mutation
+of an owned object.
+
+Bad:
+
+```ts
+const request = {
+  url,
+  ...(token === undefined ? {} : { token }),
+};
+```
+
+Good:
+
+```ts
+const request: RequestOptions = { url };
+if (token !== undefined) {
+  request.token = token;
+}
+```
+
+### nopeus/no-known-value-widening
+
+Rejects explicit broad annotations that discard evidence already present in a
+literal, constructor, function, or stable const binding.
+
+Bad:
+
+```ts
+const request: object = {
+  method: "GET",
+  url,
+};
+```
+
+Good:
+
+```ts
+const request = {
+  method: "GET",
+  url,
+} satisfies RequestOptions;
+```
+
+Prefer inference or satisfies when the value is already known.
+
+### nopeus/no-module-mocking
+
+Rejects Vitest and Jest module mocking. Tests should replace dependencies
+through the same interfaces and Effect Layers used by production code.
+
+Bad:
+
+```ts
+vi.mock("./users.ts", () => ({
+  findById: vi.fn(),
+}));
+```
+
+Good:
+
+```ts
+const UsersTest = Layer.succeed(Users)({
+  findById: () => Effect.succeed(testUser),
+});
+
+const program = loadUser("user-1").pipe(Effect.provide(UsersTest));
+```
+
+### nopeus/no-object-parameters
+
+Rejects the broad object type on function parameters, including aliases that
+resolve to object. Inputs need a named owner contract.
+
+Bad:
+
+```ts
+function saveUser(user: object) {
+  return repository.save(user);
+}
+```
+
+Good:
+
+```ts
+interface SaveUserInput {
+  readonly id: UserId;
+  readonly name: string;
+}
+
+function saveUser(user: SaveUserInput) {
+  return repository.save(user);
+}
+```
+
+### nopeus/no-reflect-apply
+
+Rejects Reflect.apply because it bypasses an ordinary typed function call.
+
+Bad:
+
+```ts
+const result = Reflect.apply(handler, receiver, argumentsList);
+```
+
+Good:
+
+```ts
+const result = handler.call(receiver, request);
+```
+
+When dispatch is genuinely dynamic, put it behind a named typed interface.
+
+### nopeus/no-reflect-get
+
+Rejects Reflect.get because it turns property access into unchecked dynamic
+lookup.
+
+Bad:
+
+```ts
+const userId = Reflect.get(payload, "userId");
+```
+
+Good:
+
+```ts
+const payload = Schema.decodeUnknownSync(UserPayload)(input);
+const userId = payload.userId;
+```
+
+### nopeus/no-runtime-typeof
+
+Rejects runtime typeof checks. Primitive narrowing proves only a JavaScript
+representation, not the domain contract expected by the application.
+
+Bad:
+
+```ts
+if (typeof input === "string") {
+  return input;
+}
+```
+
+Good:
+
+```ts
+const decodeName = Schema.decodeUnknownEffect(Name);
+const name = yield * decodeName(input);
+```
+
+Decode external input at its boundary, then branch on the decoded domain value.
+Explicit type-guard and assertion-function bodies may use typeof because their
+contract makes the narrowing boundary visible.
+
+### nopeus/no-unknown-returns
+
+Rejects explicit unknown, Promise of unknown, and local aliases that resolve to
+unknown in function return contracts. Parsing responsibility belongs inside the
+boundary function rather than with every caller.
+
+Bad:
+
+```ts
+function parseUser(text: string): unknown {
+  return JSON.parse(text);
+}
+```
+
+Good:
+
+```ts
+function parseUser(text: string): User {
+  return Schema.decodeUnknownSync(User)(JSON.parse(text));
+}
+```
+
+### nopeus/no-unknown-type-aliases
+
+Rejects aliases that merely hide unknown behind a domain-looking name.
+
+Bad:
+
+```ts
+type UserPayload = unknown;
+```
+
+Good:
+
+```ts
+const UserPayload = Schema.Struct({
+  id: UserId,
+  name: Schema.String,
+});
+
+type UserPayload = typeof UserPayload.Type;
+```
+
+Unknown should remain visible at the parsing boundary.
+
+### nopeus/no-unsafe-dictionary-type
+
+Rejects dictionaries whose direct value type is unknown, any, object, an empty
+object type, or an alias or union containing one of those escape hatches.
+
+Bad:
+
+```ts
+type UsersById = Record<string, unknown>;
+```
+
+Good:
+
+```ts
+type UsersById = Readonly<Record<UserId, User>>;
+```
+
+Use a concrete owner type for dictionary values.
+
+### nopeus/no-effect-runners-in-library
+
+Rejects Effect runtime runners outside the files listed in
+`runtimeEntryPoints`. Library modules should return Effects so callers retain
+control of runtime configuration, interruption, and observability. Entrypoints
+are exact repository-relative paths; `src/main.ts` does not allow a nested
+`packages/example/src/main.ts`.
+
+Bad outside an entrypoint:
+
+```ts
+export const loadUsers = () => Effect.runPromise(Users.all);
+```
+
+Good:
+
+```ts
+export const loadUsers = Users.all;
+
+// src/main.ts, configured as a runtime entrypoint
+Effect.runPromise(loadUsers);
+```
+
+### nopeus/no-fallible-effect-promise
+
+Rejects Effect.promise. The canonical policy treats every external Promise as
+potentially rejecting; Effect.tryPromise keeps rejection in the typed error
+channel instead of turning it into a defect.
+
+Bad:
+
+```ts
+const response = Effect.promise(() => fetch(url));
+```
+
+Good:
+
+```ts
+const response = Effect.tryPromise({
+  try: () => fetch(url),
+  catch: (cause) => new RequestFailed({ cause }),
+});
+```
+
+### nopeus/no-inline-live-layer
+
+Rejects live Layer constructors inside Effect.provide, including effectful and
+context constructors nested in Layer composition. Build stable live Layers at
+module scope and provide them at a composition boundary.
+
+Bad:
+
+```ts
+const program = load.pipe(Effect.provide(Layer.effect(Users, makeUsers)));
+```
+
+Good:
+
+```ts
+export const usersLayer = Layer.effect(Users, makeUsers);
+
+const program = load.pipe(Effect.provide(usersLayer));
+```
+
+### nopeus/no-unscoped-fork
+
+Rejects Effect.forkDetach. Background work needs an explicit lifetime so
+shutdown and interruption remain structured.
+
+Bad:
+
+```ts
+yield * Effect.forkDetach(refreshCache);
+```
+
+Good:
+
+```ts
+yield * Effect.forkScoped(refreshCache);
+```
+
+Use Effect.forkIn when an existing Scope should own the fiber.
+
+### nopeus/no-untyped-effect-errors
+
+Rejects primitive values, object literals, and built-in error classes in
+Effect.fail. This is a syntax-level rule: identifiers and custom error classes
+remain valid, while the common ways of erasing domain error information are
+rejected.
+
+Bad:
+
+```ts
+yield * Effect.fail("user not found");
+yield * Effect.fail(new Error("user not found"));
+```
+
+Good:
+
+```ts
+class UserNotFound extends Schema.TaggedError<UserNotFound>()("UserNotFound", {
+  id: UserId,
+}) {}
+
+yield * new UserNotFound({ id });
+```
+
+### nopeus/prefer-effect-platform-services
+
+Rejects direct Node platform APIs only when Effect v4 provides a semantic replacement. Diagnostics
+name both the Effect API and the Node provider (or the runtime-provided service) needed to use it.
+Both `node:x` and bare `x` specifiers are recognized.
+
+| Node import                 | Checked value(s)                                                                                                                                                                          | Effect replacement                                                      | Provider                                                       |
+| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | -------------------------------------------------------------- |
+| `fs`, `fs/promises`         | Every value import (existing behavior)                                                                                                                                                    | `FileSystem.FileSystem`                                                 | `NodeFileSystem.layer` or `NodeServices.layer`                 |
+| `path`                      | Every value import (existing behavior)                                                                                                                                                    | `Path.Path`                                                             | `NodePath.layer` or `NodeServices.layer`                       |
+| `child_process`             | Every value import (existing behavior)                                                                                                                                                    | `ChildProcess` commands and `ChildProcessSpawner.ChildProcessSpawner`   | `NodeChildProcessSpawner.layer` or `NodeServices.layer`        |
+| `crypto`                    | `randomUUID`                                                                                                                                                                              | `Crypto.Crypto.randomUUIDv4`                                            | `NodeCrypto.layer` or `NodeServices.layer`                     |
+| `crypto`                    | `randomUUIDv7`                                                                                                                                                                            | `Crypto.Crypto.randomUUIDv7`                                            | `NodeCrypto.layer` or `NodeServices.layer`                     |
+| `crypto`                    | `randomBytes`                                                                                                                                                                             | `Crypto.Crypto.randomBytes`                                             | `NodeCrypto.layer` or `NodeServices.layer`                     |
+| `crypto`                    | `randomInt`                                                                                                                                                                               | `Crypto.Crypto.randomIntBetween`                                        | `NodeCrypto.layer` or `NodeServices.layer`                     |
+| `crypto`                    | `createHash`, `hash`, `subtle.digest`, `webcrypto.subtle.digest`                                                                                                                          | `Crypto.Crypto.digest`                                                  | `NodeCrypto.layer` or `NodeServices.layer`                     |
+| `url`                       | `fileURLToPath`                                                                                                                                                                           | `Path.Path.fromFileUrl`                                                 | `NodePath.layer` or `NodeServices.layer`                       |
+| `url`                       | `pathToFileURL`                                                                                                                                                                           | `Path.Path.toFileUrl`                                                   | `NodePath.layer` or `NodeServices.layer`                       |
+| `console`                   | `assert`, `clear`, `count`, `countReset`, `debug`, `dir`, `dirxml`, `error`, `group`, `groupCollapsed`, `groupEnd`, `info`, `log`, `table`, `time`, `timeEnd`, `timeLog`, `trace`, `warn` | The matching method on `Console.Console`                                | The runtime-provided `Console.Console` service                 |
+| `process`                   | `argv`, `stdin`, `stdout`, `stderr`                                                                                                                                                       | `Stdio.Stdio`                                                           | `NodeStdio.layer` or `NodeServices.layer`                      |
+| `process`                   | `hrtime`                                                                                                                                                                                  | `Clock.Clock.monotonicTimeNanos`                                        | The runtime-provided `Clock.Clock` service                     |
+| `timers`, `timers/promises` | `setTimeout`                                                                                                                                                                              | `Effect.sleep`                                                          | The runtime-provided `Clock.Clock` service                     |
+| `timers`, `timers/promises` | `setInterval`                                                                                                                                                                             | `Effect.repeat` or `Stream.fromEffectSchedule`                          | The runtime-provided `Clock.Clock` service                     |
+| `perf_hooks`                | `performance.now`                                                                                                                                                                         | `Clock.Clock.monotonicTimeNanos`                                        | The runtime-provided `Clock.Clock` service                     |
+| `http`, `https`             | `get`, `request`                                                                                                                                                                          | `HttpClient.get` / `HttpClient.execute` through `HttpClient.HttpClient` | `NodeHttpClient.layerUndici` or `NodeHttpClient.layerNodeHttp` |
+| `http`, `https`             | Direct `createServer` use                                                                                                                                                                 | `HttpServer.HttpServer` for server behavior                             | `NodeHttpServer.layer` or `NodeHttpServer.layerConfig`         |
+| `net`                       | `connect`, `createConnection`                                                                                                                                                             | `Socket.Socket`                                                         | `NodeSocket.makeNet` or `NodeSocket.layerNet`                  |
+| `net`                       | `createServer`                                                                                                                                                                            | `SocketServer.SocketServer`                                             | `NodeSocketServer.layer`                                       |
+
+Named and aliased imports are checked at the imported symbol. Namespace and default imports are
+checked when a mapped member is accessed, including computed string properties. Type-only imports
+remain allowed because they perform no platform I/O.
+
+`node:http` and `node:https` still require a Node server factory at the application boundary. Passing
+`createServer` directly, or calling it inside the lazy factory, as the first argument of
+`NodeHttpServer.layer` or `NodeHttpServer.layerConfig` is allowed. Using it to implement server
+behavior directly is reported.
+
+The audit intentionally leaves Node streams, `EventEmitter`, `Buffer`, OS metadata, `util`, TLS,
+DNS, datagrams, HTTP/2, readline/TTY primitives, compression, and worker threads unrestricted.
+Effect exposes adapters or higher-level abstractions for some of these, but not a semantic
+replacement for every use of the imported Node value. The same is true for the remaining process,
+crypto, console, timer, URL, HTTP, and net exports. In particular, `Worker` remains necessary when
+constructing `NodeWorker.layer`, and Node streams remain necessary at `NodeStream` interop
+boundaries.
+
+No autofix is offered. These migrations introduce service requirements, Layers, scoped resources,
+or effectful control flow and need application-specific placement.
+
+```ts
+import { Crypto, Effect } from "effect";
+
+const id = Effect.gen(function* () {
+  const crypto = yield* Crypto.Crypto;
+  return yield* crypto.randomUUIDv4;
+});
+```
+
+### nopeus/prefer-effect-void
+
+Rejects Effect.succeed(undefined) and Effect.succeed(void 0). Effect.void is the
+canonical shared value and makes intent immediate.
+
+Bad:
+
+```ts
+const done = Effect.succeed(undefined);
+```
+
+Good:
+
+```ts
+const done = Effect.void;
+```
+
+### nopeus/require-effect-fn-name
+
+Requires every Effect.fn call to begin with a static string name. When the
+function has an owning binding or property, the trace name must equal that
+symbol or end with a dot followed by that symbol. This permits both loadUser and
+Users.loadUser while rejecting unrelated names. A variable containing a name is
+not accepted because the trace boundary should be visible at the call.
+
+Bad:
+
+```ts
+import * as Effect from "effect/Effect";
+
+const loadUser = Effect.fn(function* (id: UserId) {
+  return yield* Users.findById(id);
+});
+```
+
+Good:
+
+```ts
+import * as Effect from "effect/Effect";
+
+const loadUser = Effect.fn("@goho/Users.loadUser")(function* (id: UserId) {
+  return yield* Users.findById(id);
+});
+```
+
+Effect.fnUntraced remains valid when tracing would not add value, particularly
+in library implementations and hot paths.
+
+### nopeus/require-effect-namespace
+
+Enforces readable trace names in `@project/Domain.operation` form. The repository
+prefix comes from the root package name: both `goho` and `@adamaho/goho` use
+`@goho/`. Domain segments use PascalCase; the final operation uses camelCase.
+Nested domains are allowed, for example `@goho/Database.Migrations.run`.
+
+| APIs                                                                                                            | Checked name                                                             |
+| --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
+| `Effect.fn`                                                                                                     | Traced operation; `require-effect-fn-name` also checks the owning symbol |
+| `Effect.makeSpan`, `makeSpanScoped`, `useSpan`; `Layer.span`                                                    | Span name                                                                |
+| `Effect.withSpan`, `withSpanScoped`, `withLogSpan`; `Layer`, `Stream`, `Channel`, `RequestResolver` `.withSpan` | Span name in data-first and data-last calls                              |
+
+```ts
+import { Context, Effect, Schema } from "effect";
+
+class Users extends Context.Service<Users, Users.Service>()("@goho/Users") {}
+class ReadFailed extends Schema.TaggedError<ReadFailed>()("ReadFailed", {}) {}
+const Outcome = Schema.TaggedStruct("Processed", {});
+const load = Effect.fn("@goho/Users.load")(function* () {
+  /* ... */
+});
+```
+
+A trace name must be static and include both a domain and an operation.
+`@goho/load`, `@goho/Users`, whitespace, empty segments, and dynamic interpolation
+are rejected. `Effect.fn` names must end in the owning function or property name:
+`load` can use `@goho/Users.load`, but cannot use `@goho/Users.save`.
+Choose domains that identify the work, such as `Receipts.process` or
+`GoogleDrive.listFiles`; avoid repeating the repository name inside the domain.
+Lint checks structure and owner matching; choosing a meaningful domain still
+requires review. `Effect.fnUntraced` remains available for internal helpers.
+
+The rule resolves imports from `effect` and direct `effect/Module` paths, including
+aliases and `import * as E from "effect"`. Shadowed local bindings are ignored.
+String literals and templates without interpolation are accepted, including
+`satisfies` and type assertion wrappers. Re-exports and locally assigned aliases
+are not followed. Unstable subpackages are outside the supported API catalogue.
+
+Schema identifiers, data/error/request tags, metric names, ordinary values, and
+log messages are not trace names and are not checked by this rule. In particular,
+a trace-policy upgrade must not require changing serialized `_tag` values.
+Existing API schemas and matching code can keep their established tags.
+
+When upgrading from 0.5.0, keep or restore your original data/error tags and metric
+names. Add domain/operation structure to trace names that previously had only a
+prefix. Trace renames may require updating trace queries. No automatic fix is
+provided because lint cannot choose meaningful operation names.
+
+### nopeus/require-service-key-prefix
+
+Separately enforces static, nonempty repository-prefixed identity keys for
+`Context.Service` and `Context.Reference`, including curried service declarations.
+Both this rule and the trace rule are enabled by the Effect preset using the same
+repository prefix. Service keys need no `.operation` suffix: `@goho/Users` is valid.
+Import aliases and namespace imports are resolved by scope, so local bindings with
+the same name are ignored.
+
+### nopeus/require-service-constructor-names
+
+Name exported Layers and Layer factories `layer` or `layerX`, and service
+constructors `make` or `makeX`. The suffix starts with an uppercase letter:
+`layerConfig`, `layerMemory`, and `makeServiceAccount` are valid;
+`authLayer`, `defaultLayer`, `createAuth`, and `make_client` are not.
+Use lowercase `layer` and `make`; uppercase `Layer` names the imported Effect
+module.
+
+Neither export requires the other, and suffixes do not need to match. A service
+may expose only a Layer, only a constructor, or both. Constructors may remain
+private. Layer values, parameterized factories, inline construction, config
+wrappers, and composed layers are supported.
+
+Bad:
+
+```ts
+export const createAuth = (options: Options) => Service.of(options);
+export const authLayer = (options: Options) => Layer.succeed(Service, createAuth(options));
+```
+
+Good, with a reusable constructor:
+
+```ts
+export const make = (options: Options) => Service.of(options);
+export const layer = (options: Options) => Layer.succeed(Service, make(options));
+```
+
+Good, with inline construction and no separate `make`:
+
+```ts
+export const layer = (options: Options) =>
+  Layer.effect(
+    Service,
+    Effect.gen(function* () {
+      const database = yield* Database;
+      return Service.of({ find: (id) => database.find(id, options) });
+    }),
+  );
+```
+
+Good, resolving configuration through the existing constructor:
+
+```ts
+export const make = (options: Options) => Effect.succeed(Service.of(options));
+export const layerConfig = (options: Config.Wrap<Options>) =>
+  Layer.effect(Service, Config.unwrap(options).pipe(Effect.flatMap(make)));
+```
+
+Good, composing existing Layers without creating another service:
+
+```ts
+export const layer = (options: Options) =>
+  Layer.merge(Auth.layer(options.auth), Database.layer(options.database));
+```
+
+This syntax rule recognizes imported Effect Layer constructors/composition,
+local service `.of` construction, constructors passed to `Layer.effect`,
+`Layer.succeed`, or `Layer.sync`, and explicit Layer/service return types.
+It follows local aliases and returned expressions, including Effect generators
+and functions. Local export aliases are checked by their public name; recognized
+constructors must use named exports rather than a default export.
+
+Private helpers and unrelated functions are not subject to this naming rule.
+Opaque imported factories, cross-file re-exports, and arbitrary type inference
+are outside the syntax check. An explicit `Layer.Layer<...>` return annotation
+makes an otherwise opaque Layer factory recognizable. The rule does not verify
+construction behavior or require particular files, interfaces, or export pairs.
+
+This replaces `require-service-make-layer`; the old rule is removed, not retained
+as an optional policy. The naming rule is always enabled in the Effect preset.
+
+## Credits
+
+The initial policy and rule set were inspired by
+[anti-slop](https://github.com/dmmulroy/anti-slop).