@agentvibes/guardrails 0.1.0

package/rules/store-no-runinaction.yml

@@ -0,0 +1,60 @@
+# ── wave 1, store rule 1 of 7 ──────────────────────────────────────────
+#
+# The report's gap number 1: the most-repeated store rule in the corpus had no
+# mechanical check at all, and the one script that did grep for it
+# (mobx-models/scripts/lint-mobx.sh) was wired to nothing and has since been
+# deleted.
+#
+# Scoped by the CLASS, not by the path. `**/stores/**` would have been the
+# obvious glob and it is the wrong one twice over: it misses a store that lives
+# beside its feature, and it catches plain helper classes that happen to sit in
+# the folder. "Has a make(Auto)Observable call in it" is the actual definition
+# of the thing the rule is about.
+#
+# Note the callee is matched as an identifier rather than with
+# `pattern: makeAutoObservable($$$)`. A pattern does not match a call carrying
+# explicit type arguments, and SiteCraft writes
+# `makeAutoObservable<this, '_buildTimer' | 'buildManager'>(this, {…})` — which
+# silently cost the whole of project.store.ts, 7 real call sites, until the
+# count came up short against the grep.
+id: store-no-runinaction
+language: typescript
+severity: error
+ignores:
+  # A test may drive a store's state directly to set up a scenario; that is the
+  # sanctioned way to test a store without a render. All 6 of tg-gallery's
+  # runInAction sites are tests, which is why the report counts it as 0.
+  - '**/*.test.ts'
+  - '**/*.spec.ts'
+  - '**/__tests__/**'
+utils:
+  store-class:
+    kind: class_declaration
+    has:
+      stopBy: end
+      kind: call_expression
+      has:
+        field: function
+        kind: identifier
+        regex: '^make(Auto)?Observable$'
+message: |
+  `runInAction` inside a store class. Every method is already an action —
+  `makeAutoObservable` made it one — so this wraps an action in an action and
+  buys nothing. Where it appears is the tell: after an `await`, because the
+  continuation of an async method is NOT covered by the method's action, and
+  each `runInAction` is a hand-patched hole in that coverage.
+  Convert the method to a `flow`, which resumes inside an action at every yield
+  and needs no patching:
+    async load() { const x = await f(); runInAction(() => { this.x = x }) }
+    → load = flow(function* (this: Store) { this.x = yield f() })
+  See the mobx-models skill.
+rule:
+  all:
+    - kind: call_expression
+    - has:
+        field: function
+        kind: identifier
+        regex: '^runInAction$'
+    - inside:
+        stopBy: end
+        matches: store-class

package/rules/store-no-setinterval-poll-tsx.yml

@@ -0,0 +1,62 @@
+# ── the .tsx half of `store-no-setinterval-poll` ──
+#
+# ast-grep's `typescript` and `tsx` languages are DISJOINT: a `language:
+# typescript` rule reads .ts and never .tsx. `demo-mode-by-default-ts.yml`
+# records this repo learning that the hard way, so it is measured here rather
+# than assumed — 30 .tsx files in the park call make(Auto)Observable, and the
+# five twins with hits add 29 findings the .ts halves cannot see.
+#
+# Keep this file's `rule:` block IDENTICAL to `store-no-setinterval-poll.yml`.
+# Suppressing needs THIS id: `ast-grep-ignore: store-no-setinterval-poll-tsx`.
+#
+# ── wave 1, store rule 7 of 7 ──────────────────────────────────────────
+#
+# `setInterval` inside a store class: a hand-rolled poll. Report §14 counts three
+# independent sites rebuilding the same thing, and the failure mode is uniform —
+# the interval outlives what it was polling for, keeps firing while the tab is
+# hidden, and its disposer is either missing or forgotten (ObservableQuery, the
+# reference implementation, shipped with exactly that leak: `dispose()` not
+# removing its `visibilitychange` listener).
+#
+# Matches the CALL, not the identifier, so the common
+# `private timer: ReturnType<typeof setInterval>` field annotation — a type
+# position — stays silent.
+id: store-no-setinterval-poll-tsx
+language: tsx
+severity: warning
+ignores:
+  - '**/*.test.tsx'
+  - '**/*.spec.tsx'
+  - '**/__tests__/**'
+utils:
+  store-class:
+    kind: class_declaration
+    has:
+      stopBy: end
+      kind: call_expression
+      has:
+        field: function
+        kind: identifier
+        regex: '^make(Auto)?Observable$'
+message: |
+  A hand-rolled poll inside a store. An interval has to be cancelled on every
+  path that ends the thing it polls for, paused when the tab is hidden, and kept
+  from overlapping a request still in flight — and the copies in this codebase
+  each solve a different two of those three.
+  Use the Query object's `refetchInterval`, which owns the disposer, the
+  in-flight dedup and the focus/visibility handling in one place.
+  CARVE-OUT — process-shaped work (a render, an export, a git sync: something
+  with progress and no notion of revalidation) legitimately ticks on a timer.
+  There is no manifest glob for that yet, so mark those with a reason:
+    // ast-grep-ignore: store-no-setinterval-poll -- progress tick for a render job
+  See report §14 and the mobx-models skill.
+rule:
+  all:
+    - kind: call_expression
+    - has:
+        field: function
+        kind: identifier
+        regex: '^setInterval$'
+    - inside:
+        stopBy: end
+        matches: store-class

package/rules/store-no-setinterval-poll.yml

@@ -0,0 +1,51 @@
+# ── wave 1, store rule 7 of 7 ──────────────────────────────────────────
+#
+# `setInterval` inside a store class: a hand-rolled poll. Report §14 counts three
+# independent sites rebuilding the same thing, and the failure mode is uniform —
+# the interval outlives what it was polling for, keeps firing while the tab is
+# hidden, and its disposer is either missing or forgotten (ObservableQuery, the
+# reference implementation, shipped with exactly that leak: `dispose()` not
+# removing its `visibilitychange` listener).
+#
+# Matches the CALL, not the identifier, so the common
+# `private timer: ReturnType<typeof setInterval>` field annotation — a type
+# position — stays silent.
+id: store-no-setinterval-poll
+language: typescript
+severity: warning
+ignores:
+  - '**/*.test.ts'
+  - '**/*.spec.ts'
+  - '**/__tests__/**'
+utils:
+  store-class:
+    kind: class_declaration
+    has:
+      stopBy: end
+      kind: call_expression
+      has:
+        field: function
+        kind: identifier
+        regex: '^make(Auto)?Observable$'
+message: |
+  A hand-rolled poll inside a store. An interval has to be cancelled on every
+  path that ends the thing it polls for, paused when the tab is hidden, and kept
+  from overlapping a request still in flight — and the copies in this codebase
+  each solve a different two of those three.
+  Use the Query object's `refetchInterval`, which owns the disposer, the
+  in-flight dedup and the focus/visibility handling in one place.
+  CARVE-OUT — process-shaped work (a render, an export, a git sync: something
+  with progress and no notion of revalidation) legitimately ticks on a timer.
+  There is no manifest glob for that yet, so mark those with a reason:
+    // ast-grep-ignore: store-no-setinterval-poll -- progress tick for a render job
+  See report §14 and the mobx-models skill.
+rule:
+  all:
+    - kind: call_expression
+    - has:
+        field: function
+        kind: identifier
+        regex: '^setInterval$'
+    - inside:
+        stopBy: end
+        matches: store-class

package/rules/ts-pattern-dangling-match-tsx.yml

@@ -0,0 +1,41 @@
+# PROMOTED to canon in wave 2 from faceless-photo-lib/.ast-grep (rule-triage).
+# No canon equivalent existed: `non-exhaustive-match` is about PREFERRING
+# `.exhaustive()` over `.otherwise()`, which is a style call the owner has
+# explicitly deferred (decision #4). This is the different, non-negotiable
+# half — a chain with NO terminator evaluates to a builder object, so every
+# arm body is dead code and the truthy builder keeps the caller compiling.
+# Verified on real code: took a terminated chain out of observatory, deleted
+# `.exhaustive()` -> fires; left it -> silent; a dangling chain nested in a
+# callback of an OUTER terminated chain -> fires on the inner one only;
+# `"abc".match(/b/)` -> silent.
+#
+# TSX twin of ts-pattern-dangling-match (ast-grep rules are single-language, so
+# .tsx components get their own rule). Same policy — see
+# ts-pattern-dangling-match.yml for the full rationale. This twin carries most of
+# the repo's JSX-embedded `{match(state)...}` render branches.
+id: ts-pattern-dangling-match-tsx
+language: tsx
+severity: error
+message: "ts-pattern `match()` chain has no terminator — it evaluates to a builder, not a value. Add `.exhaustive()` (project.md §4)."
+note: "`.otherwise()` and `.run()` also terminate a chain; preferring `.exhaustive()` over `.otherwise()` is the separate ts-pattern-prefer-exhaustive rule."
+rule:
+  all:
+    - kind: call_expression
+      has:
+        field: function
+        kind: identifier
+        regex: "^match$"
+    - not:
+        inside:
+          stopBy:
+            not:
+              any:
+                - kind: member_expression
+                - kind: call_expression
+          kind: call_expression
+          has:
+            field: function
+            kind: member_expression
+            has:
+              field: property
+              regex: "^(exhaustive|otherwise|run)$"

package/rules/ts-pattern-dangling-match.yml

@@ -0,0 +1,63 @@
+# PROMOTED to canon in wave 2 from faceless-photo-lib/.ast-grep (rule-triage).
+# No canon equivalent existed: `non-exhaustive-match` is about PREFERRING
+# `.exhaustive()` over `.otherwise()`, which is a style call the owner has
+# explicitly deferred (decision #4). This is the different, non-negotiable
+# half — a chain with NO terminator evaluates to a builder object, so every
+# arm body is dead code and the truthy builder keeps the caller compiling.
+# Verified on real code: took a terminated chain out of observatory, deleted
+# `.exhaustive()` -> fires; left it -> silent; a dangling chain nested in a
+# callback of an OUTER terminated chain -> fires on the inner one only;
+# `"abc".match(/b/)` -> silent.
+#
+# ts-pattern-dangling-match (convention-rules-ci task 2.4; project.md §3 and §4
+# "`match().exhaustive()` everywhere").
+#
+# A `match(...)` chain that is never terminated does not evaluate anything — it
+# leaves a ts-pattern *builder object* where the caller expects a value. That is
+# always a bug, and a silent one: the builder is truthy, so `if`/JSX/`return`
+# paths keep working while every branch body is dead code.
+#
+# This rule is the hard gate: it fires only when a chain has NO terminator at
+# all (`.exhaustive()`, `.otherwise()`, or `.run()`). Preferring `.exhaustive()`
+# over `.otherwise()` is the separate, advisory `ts-pattern-prefer-exhaustive`
+# rule, because `.otherwise()` is legitimate when matching an OPEN domain (an
+# external boundary string, say) that no union can enumerate.
+#
+# Implementation notes:
+#   - The target is a call_expression whose callee is the bare identifier
+#     `match`, so `someString.match(re)` (the RegExp method) is never confused
+#     for ts-pattern.
+#   - The terminator search walks ONLY the member/call spine of this chain — the
+#     `stopBy` halts at the first ancestor that is neither, so an enclosing
+#     terminated chain cannot mask a dangling chain nested in one of its
+#     callbacks.
+#   - Terminators are matched structurally (`kind` + `regex`) rather than with a
+#     surface `pattern:`, because ast-grep's default `smart` strictness also
+#     compares interleaved `comment` nodes — and these chains carry per-arm
+#     comments constantly, which would produce false positives.
+id: ts-pattern-dangling-match
+language: typescript
+severity: error
+message: "ts-pattern `match()` chain has no terminator — it evaluates to a builder, not a value. Add `.exhaustive()` (project.md §4)."
+note: "`.otherwise()` and `.run()` also terminate a chain; preferring `.exhaustive()` over `.otherwise()` is the separate ts-pattern-prefer-exhaustive rule."
+rule:
+  all:
+    - kind: call_expression
+      has:
+        field: function
+        kind: identifier
+        regex: "^match$"
+    - not:
+        inside:
+          stopBy:
+            not:
+              any:
+                - kind: member_expression
+                - kind: call_expression
+          kind: call_expression
+          has:
+            field: function
+            kind: member_expression
+            has:
+              field: property
+              regex: "^(exhaustive|otherwise|run)$"

package/rules/ui-imports-app-store.yml

@@ -0,0 +1,49 @@
+id: ui-imports-app-store
+language: tsx
+severity: error
+message: |
+  A reusable UI component importing an app store. The moment it knows where the
+  data comes from it stops being reusable — and the boundary is the whole point:
+  a UI component consumes an interface (props, or a view-model interface the
+  store implements), never the store itself.
+  Take the values as props and let the app component do the reading. See the
+  ui-components skill.
+files:
+  - '**/packages/ui/**'
+  - '**/components/ui/**'
+  - '**/src/ui/**'
+utils:
+  # A type-only import: erased at build time, so it creates no dependency on the
+  # store — only on its shape. Covers all four spellings TypeScript allows.
+  type-only-import:
+    any:
+      - pattern: import type { $$$S } from $SRC
+      - pattern: import type $D from $SRC
+      - pattern: import type * as $NS from $SRC
+      # `import { type A, type B }` — every named specifier inline-typed.
+      - all:
+          - kind: import_statement
+          - has:
+              stopBy: end
+              kind: named_imports
+          - not:
+              has:
+                stopBy: end
+                all:
+                  - kind: import_specifier
+                  - not:
+                      regex: '^type\s'
+rule:
+  all:
+    - kind: import_statement
+    - has:
+        stopBy: end
+        kind: string_fragment
+        regex: '(^|/)stores?(/|$)'
+    # X7 (report §2): the view-model pattern this rule exists to protect tells a
+    # UI component to type itself against `IXxxModel` — which lives in the store
+    # module. Firing at `error` on that import made the rule contradict the
+    # pattern it enforces, so a compliant component could not be written without
+    # a suppression comment. A type import is the compliant shape, not a breach.
+    - not:
+        matches: type-only-import

package/rules/view-file-logic.yml

@@ -0,0 +1,53 @@
+# ── simple-components, rule 3 of 4 ─────────────────────────────────────
+#
+# The view half of the two-tier split (decision D8, report §9): a `*.view.tsx`
+# is props in, JSX out. No hooks, no `match`, no ternary, no data transformation.
+# That contract is what makes a view the file a cheap model writes without
+# getting it wrong, and what lets its test mount it with nothing around it.
+#
+# WARNING TIER ON PURPOSE. D8 ships the split as a recommendation first, with a
+# ratchet on the share of view files — not as a hard gate. Raising this to error
+# would decide a question the owner deliberately parked. The store half of the
+# same contract is the canon's `view-imports-store` (error), which is a narrower
+# claim: no store access anywhere in the app's view files.
+#
+# `useTheme` / `useTokens` / `useStyles` / `useColorScheme` are exempt: the house
+# styling idiom is RN inline objects read from a theme hook (report §10), so
+# banning that hook would ban styling from the file that owns styling.
+id: view-file-logic
+language: tsx
+severity: warning
+files:
+  - '**/*.view.tsx'
+message: |
+  Logic in a `*.view.tsx`. A view renders the props it was handed and decides
+  nothing: no hooks, no `match`, no ternary, no formatting, no icon-picking.
+  Move the decision up to the logic component or the model, and hand the view
+  the ANSWER — `tone="danger"`, `formattedDate`, `icon` — not the input it would
+  have to branch on. Passing `status` and mapping it to colours inside the view
+  is the same branch, laundered.
+  Exempt: `useTheme` / `useTokens` / `useStyles` / `useColorScheme` — styling is
+  what a view owns.
+  See the simple-components skill (§two-tier) and report §9.
+rule:
+  any:
+    # Any hook call that is not a styling hook.
+    - all:
+        - kind: call_expression
+        - has:
+            field: function
+            kind: identifier
+            regex: '^use[A-Z]'
+        - not:
+            has:
+              field: function
+              kind: identifier
+              regex: '^use(Theme|Tokens|Styles|ColorScheme|Colors)$'
+    # Branching that belongs to the logic tier.
+    - all:
+        - kind: call_expression
+        - has:
+            field: function
+            kind: identifier
+            regex: '^match$'
+    - kind: ternary_expression

package/rules/view-imports-store.yml

@@ -0,0 +1,64 @@
+# ── G1, rule 3 of 3 (second half): stores are banned outright in views ─
+#
+# Split from `direct-store-import.yml` for one mechanical reason: ast-grep scopes
+# `files:` per rule file, and the two halves need different globs. This is not a
+# fourth rule so much as the `*.view.tsx` arm of the third.
+#
+# Report §9 fixes the view contract as props → JSX and nothing else: no hooks, no
+# `match`, no data transformation, no store. That is stricter than the rest of
+# `.tsx`, where decision D1 makes a `rootStore` import legal at screen level — a
+# view is never a screen, so `rootStore` is banned here too, and so is `useStore`.
+#
+# The only store-path import a view may keep is a type: C40 has the view take
+# `model={store}` typed by `IXxxModel`, which lives in the store module and
+# erases at build time.
+#
+# Expected hit count today: zero. `*.view.tsx` does not exist anywhere in the
+# park yet (the two-tier split ships as a recommendation first, report §9 /
+# decision #8). This is a guardrail waiting at the convention's door, not a
+# finding about current code.
+id: view-imports-store
+language: tsx
+severity: error
+files:
+  - '**/*.view.tsx'
+utils:
+  type-only-import:
+    any:
+      - pattern: import type { $$$S } from $SRC
+      - pattern: import type $D from $SRC
+      - pattern: import type * as $NS from $SRC
+      - all:
+          - kind: import_statement
+          - has:
+              stopBy: end
+              kind: named_imports
+          - not:
+              has:
+                stopBy: end
+                all:
+                  - kind: import_specifier
+                  - not:
+                      regex: '^type\s'
+message: |
+  A `*.view.tsx` importing from a stores directory. A view is props in, JSX out
+  — it has no hooks, no branching and no data access, which is exactly what
+  makes it the file a cheap model writes without getting it wrong, and what
+  lets its test mount it with nothing around it.
+  Move the read up to the logic component and hand the view what it renders.
+  Unlike the rest of the app, the global `rootStore` is not an exception here:
+  a view is never a screen.
+  `import type { IXxxModel }` IS allowed — typing the view against the model
+  interface it renders is the prescribed shape (C40). See report §9 and the
+  mobx-components skill.
+rule:
+  all:
+    - kind: import_statement
+    - has:
+        field: source
+        has:
+          stopBy: end
+          kind: string_fragment
+          regex: '(^|/)stores?(/|$)'
+    - not:
+        matches: type-only-import

package/rules/zod-optional-nullable-tsx.yml

@@ -0,0 +1,56 @@
+# ── rule body adopted from faceless-photo-lib `zod-no-optional-nullable` (wave 2 triage) ──
+# The two rules were duplicates; the faceless implementation is strictly better,
+# so the canon id keeps its message and takes that body. Why it is better here:
+# `z.$T().optional()` only matched a DIRECT call on `z` — it missed both
+# `UserSchema.optional()` and any chained builder (`z.string().min(1).optional()`).
+# The receiver anchor keeps it to real zod schemas. Measured: +14 findings, 0 lost.
+#
+# The .tsx half of `zod-optional-nullable`.
+#
+# ast-grep's `typescript` and `tsx` languages are DISJOINT, not nested: a rule
+# at `language: typescript` matches `.ts` and NEVER `.tsx`, so
+# `zod-optional-nullable` was blind to every React component file — exactly
+# where a form's validation schema often lives, right next to the component
+# that uses it. Verified by effect — byte-identical content in `p.ts` and
+# `p.tsx`, the first flagged and the second silent.
+#
+# Three ways to cover both were tried and two were rejected on measurement:
+#   - `language: [typescript, tsx]` — ast-grep refuses to parse the rule.
+#   - `languageGlobs: {tsx: ["*.ts"]}` — reassigns `.ts` to the tsx language, so
+#     EVERY remaining `language: typescript` rule goes dark. Measured corpus-wide:
+#     5 rules blinded, 6,094 findings lost against 334 gained. It would have
+#     looked like a coverage win.
+#   - two files with the SAME id — "Error: Duplicate rule id".
+# So: a separate id per language. The trailing `-tsx` is what you suppress with
+# in a .tsx file, and the finding prints the id, so copying from the output is
+# always right.
+#
+# Keep this file's `rule:` block IDENTICAL to `zod-optional-nullable.yml`. They
+# are one rule wearing two ids because the tool has no way to say "both
+# languages".
+id: zod-optional-nullable-tsx
+language: tsx
+severity: warning
+message: |
+  `z.X().optional()` / `z.X().nullable()` makes invalid states representable.
+  Prefer a discriminated union with explicit states so the absent case is a named variant.
+  See zod-schemas skill and defensive-errors philosophy.
+  Suppressing this one needs the id you see above — `ast-grep-ignore: zod-optional-nullable-tsx`.
+  `zod-optional-nullable` is a DIFFERENT rule (the .ts arm) and does not cover it; ast-grep
+  matches suppression ids exactly. A bare `// ast-grep-ignore` suppresses every
+  rule on the line, and a wrong id is reported back as `unused-suppression`.
+rule:
+  all:
+    - kind: call_expression
+      has:
+        field: function
+        kind: member_expression
+        has:
+          field: property
+          regex: "^(optional|nullable|nullish)$"
+    # Anchor: the receiver chain mentions `z` or a `*Schema` binding, i.e. this
+    # really is a zod schema and not an unrelated builder with the same method.
+    - has:
+        stopBy: end
+        kind: identifier
+        regex: "^(z|.*Schema)$"

package/rules/zod-optional-nullable.yml

@@ -0,0 +1,29 @@
+# ── rule body adopted from faceless-photo-lib `zod-no-optional-nullable` (wave 2 triage) ──
+# The two rules were duplicates; the faceless implementation is strictly better,
+# so the canon id keeps its message and takes that body. Why it is better here:
+# `z.$T().optional()` only matched a DIRECT call on `z` — it missed both
+# `UserSchema.optional()` and any chained builder (`z.string().min(1).optional()`).
+# The receiver anchor keeps it to real zod schemas. Measured: +14 findings, 0 lost.
+#
+id: zod-optional-nullable
+language: typescript
+severity: warning
+message: |
+  `z.X().optional()` / `z.X().nullable()` makes invalid states representable.
+  Prefer a discriminated union with explicit states so the absent case is a named variant.
+  See zod-schemas skill and defensive-errors philosophy.
+rule:
+  all:
+    - kind: call_expression
+      has:
+        field: function
+        kind: member_expression
+        has:
+          field: property
+          regex: "^(optional|nullable|nullish)$"
+    # Anchor: the receiver chain mentions `z` or a `*Schema` binding, i.e. this
+    # really is a zod schema and not an unrelated builder with the same method.
+    - has:
+        stopBy: end
+        kind: identifier
+        regex: "^(z|.*Schema)$"

package/sgconfig.yml

@@ -0,0 +1,8 @@
+# ast-grep config for the @agentvibes/guardrails rule canon.
+# Invoke directly: ast-grep scan -c <abs path to this file> <target>
+# Or via the CLI:  guardrails verify [paths]
+#
+# candidates/ is deliberately NOT listed: those rules are un-triaged imports
+# (see candidates/README.md) and load nowhere until promoted into rules/.
+ruleDirs:
+  - rules

package/structure/rules/component-decl.yml

@@ -0,0 +1,48 @@
+id: component-decl
+language: tsx
+severity: info
+# Same out-of-scope surface every canon rule declares: tests, stories, and
+# showcase files are legitimate multi-component / oversized territory (a
+# showcase screen IS a bundle of demo components). Found by the first real
+# adoption (observatory): without this, a reformat touching a showcase file's
+# declaration lines turned the verify-diff ratchet red on fixture code.
+# Metrics already excluded these paths on its own; now the structure findings
+# agree with it.
+ignores:
+  - '**/*.test.tsx'
+  - '**/*.spec.tsx'
+  - '**/__tests__/**'
+  - '**/showcase/**'
+  - '**/*.stories.tsx'
+message: |
+  Marker rule — matches every top-level React component declaration so
+  check-structure.sh can count them per file and measure their spans.
+  Never reported directly (severity info is invisible to the post-edit hook
+  and to the CI diff gate, both of which only look at error/warning tiers).
+rule:
+  all:
+    # `const Foo = <anything>` or `function Foo(...) { ... }`
+    - any:
+        - pattern: const $N = $INIT
+        - pattern: |
+            function $N($$$) { $$$ }
+    # ...that renders JSX somewhere inside. Excludes `const StoreContext =
+    # createContext(...)`, capitalised constant maps, class instances, etc.
+    - has:
+        stopBy: end
+        any:
+          - kind: jsx_element
+          - kind: jsx_self_closing_element
+  # Only top-level declarations count. A component defined inside another
+  # function is a different (worse) problem — see noNestedComponentDefinitions.
+  not:
+    inside:
+      stopBy: end
+      any:
+        - kind: arrow_function
+        - kind: function_declaration
+        - kind: function_expression
+        - kind: method_definition
+constraints:
+  N:
+    regex: '^[A-Z][A-Za-z0-9]*$'

package/structure/sgconfig.yml

@@ -0,0 +1,7 @@
+# ast-grep config for the React structure check (guardrails verify / verify-diff).
+# Separate from ../sgconfig.yml on purpose: this dir holds a marker rule, not
+# a reportable finding — the reportable findings (react-multi-component,
+# react-component-too-long, react-component-needs-folder) are synthesised by
+# the CLI from the marker's per-file counts and line spans.
+ruleDirs:
+  - rules