@akanjs/devkit 3.0.0-alpha.71 → 3.0.0-alpha.73

package/lint/__fixtures__/no-bang-comment-in-client/good.tsx

@@ -0,0 +1,3 @@
+// FIXME: the client-reachable spelling of the same note // @ok
+export const url = "https://host//!path"; // @ok
+export const a = 1; // @ok

package/lint/__fixtures__/no-daisyui-legacy-class/bad.tsx

@@ -0,0 +1,7 @@
+export const CompoundButton = () => <button className="btn-primary" />; // @flag
+export const CompoundBadge = () => <span className="badge-success" />; // @flag
+export const DroppedBaseSurface = () => <div className="bg-base-100" />; // @flag
+export const DroppedBaseContentWithOpacity = () => <div className="text-base-content/70" />; // @flag
+export const DroppedBaseOnABorderSide = () => <div className="border-t-base-300" />; // @flag
+export const DroppedPrimaryContent = () => <div className="text-primary-content" />; // @flag
+export const DroppedErrorSlot = () => <div className="bg-error/5" />; // @flag

package/lint/__fixtures__/no-daisyui-legacy-class/good.tsx

@@ -0,0 +1,5 @@
+export const BareAmbiguousNamesCollideWithTailwind = () => <div className="card input badge btn" />; // @ok
+export const SurvivingSemanticPair = () => <div className="bg-primary text-primary-foreground" />; // @ok
+export const SurvivingStatusTokens = () => <div className="bg-neutral text-info border-warning" />; // @ok
+export const DestructiveReplacesError = () => <div className="bg-destructive/10 text-destructive" />; // @ok
+export const UnrelatedContentUtilities = () => <div className="content-center justify-content" />; // @ok

package/lint/__fixtures__/no-deep-internal-import/bad.tsx

@@ -0,0 +1,3 @@
+import { userConstant } from "@libs/shared/lib/user/user.constant"; // @flag
+import { helper } from "../../common/helper"; // @flag
+import * as cnst from "../cnst"; // @flag

package/lint/__fixtures__/no-deep-internal-import/fixture.json

@@ -0,0 +1 @@
+{ "path": "apps/demo/lib/task/Task.Zone.tsx" }

package/lint/__fixtures__/no-deep-internal-import/good.tsx

@@ -0,0 +1,3 @@
+import { cnst, st } from "@apps/demo/client"; // @ok
+import { Task } from "./task.constant"; // @ok
+import { env } from "@apps/demo/env/env.client"; // @ok

package/lint/__fixtures__/no-deprecated-log-level/bad.tsx

@@ -0,0 +1,4 @@
+export const viaLocal = () => logger.log("x"); // @flag
+export const viaStatic = () => Logger.log("x"); // @flag
+export class ViaField { run() { this.logger.log("x"); } } // @flag
+export class ViaPrivateField { run() { this.#logger.log("x"); } } // @flag

package/lint/__fixtures__/no-deprecated-log-level/good.tsx

@@ -0,0 +1,4 @@
+export const infoIsTheReplacement = () => logger.info("x"); // @ok
+export const otherLevelsAreFine = () => logger.warn("x"); // @ok
+export const anUnrelatedReceiverIsNotTheLadder = () => auditTrail.log("x"); // @ok
+export const consoleIsBiomesOwnRule = () => console.log("x"); // @ok

package/lint/__fixtures__/no-import-client-functions/bad.tsx

@@ -0,0 +1,2 @@
+import { useState } from "react"; // @flag
+import { st } from "../st"; // @flag

package/lint/__fixtures__/no-import-client-functions/good.tsx

@@ -0,0 +1,4 @@
+import type { ReactNode } from "react"; // @ok
+import { cnst } from "@libs/shared/client"; // @ok
+import { usePage } from "akanjs/client"; // @ok
+export const Card = ({ children }: { children: ReactNode }) => <div>{children}</div>; // @ok

package/lint/__fixtures__/no-import-client-in-server/bad.tsx

@@ -0,0 +1,6 @@
+import { TaskStore } from "./task.store"; // @flag
+import { Card } from "./Task.Unit"; // @flag
+import { Button } from "@libs/shared/ui"; // @flag
+import { useSpeech } from "@libs/util/webkit"; // @flag
+import { cn } from "akanjs/client"; // @flag
+import { st } from "../st"; // @flag

package/lint/__fixtures__/no-import-client-in-server/good.tsx

@@ -0,0 +1,5 @@
+import type { TaskStore } from "./task.store"; // @ok
+import * as cnst from "../cnst"; // @ok
+import * as db from "../db"; // @ok
+import { Err } from "../dict"; // @ok
+import { Admin } from "@libs/shared/srvkit"; // @ok

package/lint/__fixtures__/no-import-external-library/bad.tsx

@@ -0,0 +1,4 @@
+import dayjs from "dayjs"; // @flag
+import { z } from "zod"; // @flag
+import fs from "node:fs"; // @flag
+import { clsx } from "clsx"; // @flag

package/lint/__fixtures__/no-import-external-library/good.tsx

@@ -0,0 +1,5 @@
+import { Ticket } from "./ticket.constant"; // @ok
+import { cnst } from "@libs/shared/client"; // @ok
+import { field } from "akanjs/constant"; // @ok
+import { useState } from "react"; // @ok
+import { test } from "bun:test"; // @ok

package/lint/__fixtures__/no-import-server-in-client/bad.tsx

@@ -0,0 +1,6 @@
+import { TaskService } from "./task.service"; // @flag
+import { TaskModel } from "./task.document"; // @flag
+import { Admin } from "@libs/shared/srvkit"; // @flag
+import { AkanServer } from "akanjs/server"; // @flag
+import * as db from "../db"; // @flag
+import { Err } from "../dict"; // @flag

package/lint/__fixtures__/no-import-server-in-client/good.tsx

@@ -0,0 +1,4 @@
+import type { TaskService } from "./task.service"; // @ok
+import * as cnst from "../cnst"; // @ok
+import { st } from "../st"; // @ok
+import { Err, Task } from "@libs/shared/client"; // @ok

package/lint/__fixtures__/no-init-fetch-in-client/store-file/bad.ts

@@ -0,0 +1 @@
+export class TaskStore { async reload(orgId: string) { const snapshot = await fetch.initTaskInOrg(orgId); } } // @flag

package/lint/__fixtures__/no-init-fetch-in-client/store-file/fixture.json

@@ -0,0 +1 @@
+{ "path": "apps/demo/lib/task/task.store.ts" }

package/lint/__fixtures__/no-init-fetch-in-client/store-file/good.ts

@@ -0,0 +1 @@
+export class TaskStore { async reload() { await st.do.initTaskInOrg(); } } // @ok

package/lint/__fixtures__/no-init-fetch-in-client/use-client/bad.tsx

@@ -0,0 +1,4 @@
+"use client";
+
+export const A = () => { void fetch.initTaskInOrg(orgId); }; // @flag
+export const B = () => { void fetch.getTaskInitInOrg(orgId); }; // @flag

package/lint/__fixtures__/no-init-fetch-in-client/use-client/good.tsx

@@ -0,0 +1,5 @@
+"use client";
+
+export const C = () => { void fetch.initPayment(sessionId); }; // @ok
+export const D = () => { void st.do.initTaskInOrg(); }; // @ok
+export const E = () => { void fetch.viewTask(taskId); }; // @ok

package/lint/__fixtures__/no-inline-color/bad.tsx

@@ -0,0 +1,3 @@
+export const HexInStyleObject = () => <div style={{ color: "#fff" }} />; // @flag
+export const RgbInStyleObject = () => <div style={{ background: "rgb(0,0,0)" }} />; // @flag
+export const ColorLiteralInStyleTag = () => <style>{`.x { color: #abcdef; }`}</style>; // @flag

package/lint/__fixtures__/no-inline-color/good.tsx

@@ -0,0 +1,3 @@
+export const VarReferenceInStyleObject = () => <div style={{ color: "var(--primary)" }} />; // @ok
+export const NonColorStyleProperty = () => <div style={{ width: "100%" }} />; // @ok
+export const ComputedNonColorStyle = () => <div style={{ minHeight }} />; // @ok

package/lint/__fixtures__/no-interpolated-arbitrary-class/bad.tsx

@@ -0,0 +1,3 @@
+export const SizeFromRuntimeExpression = () => <div className={`min-h-[${minHeight}px] flex`} />; // @flag
+export const ColorFromRuntimeExpression = () => <div className={`bg-[${color}] w-full`} />; // @flag
+export const BrokenBracketSwallowsNextClass = () => <div className={`min-h-[ w-full${minHeight}px] flex`} />; // @flag

package/lint/__fixtures__/no-interpolated-arbitrary-class/good.tsx

@@ -0,0 +1,3 @@
+export const LiteralArbitraryValue = () => <div className="min-h-[300px] flex" />; // @ok
+export const InterpolationOutsideBrackets = () => <div className={`flex gap-2 ${isOpen ? "opacity-50" : ""}`} />; // @ok
+export const InterpolationInStylePropNotClass = () => <div style={{ minHeight }} className={`flex ${extra}`} />; // @ok

package/lint/__fixtures__/no-js-private-class-method/bad.tsx

@@ -0,0 +1,3 @@
+export class SyncPrivate { #compute() { return 1; } } // @flag
+export class AsyncPrivate { async #load() { return 1; } } // @flag
+export class CallsPrivate { run() { this.#compute(); } } // @flag

package/lint/__fixtures__/no-js-private-class-method/good.tsx

@@ -0,0 +1,3 @@
+export class TypescriptPrivate { private _compute() { return 1; } } // @ok
+export class CallsUnderscore { run() { this._compute(); } } // @ok
+export class PrivateField { #cache = new Map(); } // @ok

package/lint/__fixtures__/no-model-type-in-util-zone/bad.tsx

@@ -0,0 +1,3 @@
+export interface CardProps { task: cnst.Task; } // @flag
+export type RowProps = { banner: cnst.LightBanner }; // @flag
+export const View = ({ task }: { task: cnst.Task }) => <div className="flex" />; // @flag

package/lint/__fixtures__/no-model-type-in-util-zone/good.tsx

@@ -0,0 +1,6 @@
+export interface IdProps { taskId: string; } // @ok
+export interface EnumProps { role: cnst.AdminRole["value"]; } // @ok
+export interface InitProps { init: ClientInit<cnst.Task>; } // @ok
+export interface CallbackProps { onPick: (task: cnst.Task) => void; } // @ok
+export interface ModelsWrapperProps { models: ModelsProps<cnst.Task>; } // @ok
+export const localAnnotationStaysInFile = (raw: unknown) => raw as cnst.Task; // @ok

package/lint/__fixtures__/no-raw-palette-class/bad.tsx

@@ -0,0 +1,6 @@
+export const TwoInOneString = () => <div className="bg-blue-500 text-gray-700" />; // @flag
+export const VariantPrefixAndOpacity = () => <div className="hover:bg-red-500/50" />; // @flag
+export const NumericNeutral = () => <div className="bg-neutral-500" />; // @flag
+export const AlongsideAUrlString = () => <a href="https://x.io" className="bg-blue-500" />; // @flag
+export const BorderSide = () => <div className="border-t-emerald-300" />; // @flag
+export const InsideCn = () => <div className={cn("flex", "text-slate-400")} />; // @flag

package/lint/__fixtures__/no-raw-palette-class/good.tsx

@@ -0,0 +1,8 @@
+export const BareSemanticNeutral = () => <div className="bg-neutral text-neutral-foreground" />; // @ok
+export const SemanticTokens = () => <div className="bg-primary text-muted-foreground border-border" />; // @ok
+export const BlackAndWhiteStayInVocabulary = () => <div className="bg-black text-white bg-white/30 bg-black/50" />; // @ok
+export const NonColorNumericUtilities = () => <div className="gap-4 mt-2 grid-cols-3 w-500" />; // @ok
+export const OpacityOnASemanticToken = () => <div className="text-foreground/70 bg-primary/10" />; // @ok
+// iconClassName="bg-blue-500" — a class name in a line comment is not code
+/** legacy: bg-red-500 */
+export const CommentsAreNotCode = () => <div className="flex" />; // @ok

package/lint/__fixtures__/no-redeclare-predefined-endpoint/bad.ts

@@ -0,0 +1,10 @@
+export class TaskEndpoint extends endpoint(srv.task, ({ query, mutation }) => ({
+  task: query(cnst.Task).exec(() => null), // @flag
+  lightTask: query(cnst.Task).exec(() => null), // @flag
+  createTask: mutation(cnst.Task).exec(() => null), // @flag
+  updateTask: mutation(cnst.Task).exec(() => null), // @flag
+  removeTask: mutation(cnst.Task).exec(() => null), // @flag
+  viewTask: query(cnst.Task).exec(() => null), // @flag
+  editTask: query(cnst.Task).exec(() => null), // @flag
+  mergeTask: mutation(cnst.Task).exec(() => null), // @flag
+})) {}

package/lint/__fixtures__/no-redeclare-predefined-endpoint/fixture.json

@@ -0,0 +1 @@
+{ "path": "apps/demo/lib/task/task.signal.ts" }

package/lint/__fixtures__/no-redeclare-predefined-endpoint/good.ts

@@ -0,0 +1,6 @@
+export class TaskEndpoint extends endpoint(srv.task, ({ query, mutation }) => ({
+  startTask: mutation(cnst.Task).exec(() => null), // @ok
+  taskSummary: query(cnst.Task).exec(() => null), // @ok
+  viewTaskBoard: query(cnst.Task).exec(() => null), // @ok
+  createTaskComment: mutation(cnst.Task).exec(() => null), // @ok
+})) {}

package/lint/__fixtures__/no-return-in-store-action/bad.tsx

@@ -0,0 +1,2 @@
+export class AStore extends store(sig.a, () => ({})) { load() { return 1; } } // @flag
+export class BStore extends store(sig.b, () => ({})) { async save() { return true; } } // @flag

package/lint/__fixtures__/no-return-in-store-action/good.tsx

@@ -0,0 +1,6 @@
+export class CStore extends store(sig.c, () => ({})) { load() { this.set({ n: 1 }); } } // @ok
+export class DStore extends store(sig.d, () => ({})) { load() { if (!this.get()) return; this.set({ n: 1 }); } } // @ok
+export class EStore extends store(sig.e, () => ({})) { static helper() { return 1; } } // @ok
+export class FStore extends store(sig.f, () => ({})) { get total() { return 1; } } // @ok
+export class GStore extends store(sig.g, () => ({})) { load() { items.map((x) => { return x; }); } } // @ok
+export class HPlain { load() { return 1; } } // @ok

package/lint/__fixtures__/no-throw-raw-error/bad.tsx

@@ -0,0 +1,4 @@
+export const throwsNewError = () => { throw new Error("boom"); }; // @flag
+export const throwsBareError = () => { throw Error("boom"); }; // @flag
+export const throwsWithCause = () => { throw new Error("boom", { cause: reason }); }; // @flag
+export const throwsWithNoArgument = () => { throw new Error(); }; // @flag

package/lint/__fixtures__/no-throw-raw-error/good.tsx

@@ -0,0 +1,4 @@
+export const throwsErr = () => { throw new Err("ticket.error.notFound"); }; // @ok
+export const throwsASubclass = () => { throw new HttpError("boom"); }; // @ok
+export const constructsWithoutThrowing = () => new Error("boom"); // @ok
+export const rethrowsACaught = () => { try { run(); } catch (error) { throw error; } }; // @ok

package/lint/__fixtures__/no-unpublished-form-setter/bad.tsx

@@ -0,0 +1,3 @@
+export const A = () => <Field.Text onChange={(v) => st.do.setNameOnTask(v)} />; // @flag
+export const B = () => <Switch onChange={(value) => void st.do.setDoneOnTask(value)} />; // @flag
+export const C = () => <Select onChange={(v) => { st.do.setTypeOnTask(v); }} />; // @flag

package/lint/__fixtures__/no-unpublished-form-setter/good.tsx

@@ -0,0 +1,5 @@
+export const D = () => <Field.Text onChange={st.do.setNameOnTask} />; // @ok
+export const E = () => <Field.Text onChange={(v) => st.do.setNameOnTask(formatPhone(v))} />; // @ok
+export const F = () => <Field.Text onChange={(v) => { st.do.setNameOnTask(v); track(v); }} />; // @ok
+export const G = () => <Field.Text onChange={(v) => st.do.writeOnTask("rows.3.name", v)} />; // @ok
+export const H = () => <Field.Text onChange={(a, b) => st.do.setNameOnTask(a)} />; // @ok

package/lint/__fixtures__/no-use-client-in-server/bad.tsx

@@ -0,0 +1,3 @@
+"use client"; // @flag
+
+export const Card = () => <div className="flex" />;

package/lint/__fixtures__/no-use-client-in-server/good.tsx

@@ -0,0 +1,2 @@
+export const Card = () => <div className="flex" />; // @ok
+export const note = "server only"; // @ok

package/lint/__fixtures__/non-scalar-props-restricted/bad.tsx

@@ -0,0 +1,5 @@
+export const ArrowProp = () => <Button onClick={() => save()} />; // @flag
+export const ArrowWithTwoParams = () => <Button onSelect={(id, kind) => save(id, kind)} />; // @flag
+export const ArrowWithBareParam = () => <Button onChange={value => save(value)} />; // @flag
+export const FunctionExpressionProp = () => <Button onClick={function () { save(); }} />; // @flag
+export const NamedFunctionProp = () => <Button onClick={function handle() { save(); }} />; // @flag

package/lint/__fixtures__/non-scalar-props-restricted/good.tsx

@@ -0,0 +1,4 @@
+export const LoaderIsAllowed = () => <Zone loader={() => fetchThing()} />; // @ok
+export const OfIsAllowed = () => <Load of={() => fetchThing()} />; // @ok
+export const ScalarProps = () => <Button label="Save" count={3} disabled />; // @ok
+export const IdentifierProp = () => <Button onClick={handleSave} />; // @ok

package/lint/gritRules.test.ts

@@ -0,0 +1,178 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { mkdir, mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+/**
+ * Fixture tests for the GritQL plugins in this folder.
+ *
+ * These rules break the apps/libs build, and a rule that stops matching reports **zero diagnostics** rather
+ * than an error — so a biome upgrade can retire one silently. GritQL has known sharp edges here (escaped
+ * quotes, argument-position matching), which is what makes the quiet failure plausible rather than
+ * theoretical.
+ *
+ * Each rule runs alone, against a config this test writes, so a diagnostic can only have come from that
+ * plugin. The path scoping in `biome.base.json` is deliberately not exercised — what is under test is
+ * whether the pattern still matches. A rule that reads `$filename` needs a real path anyway, which is what
+ * a case's `fixture.json` supplies.
+ */
+const lintDir = import.meta.dir;
+const fixturesDir = path.join(lintDir, "__fixtures__");
+const workspaceRoot = path.resolve(lintDir, "../../../..");
+const biomeBin = path.join(workspaceRoot, "node_modules/.bin/biome");
+
+interface BiomeDiagnostic {
+  severity: string;
+  message: string;
+  category: string;
+  location?: { start?: { line?: number } };
+}
+
+/**
+ * `path` is where the source is written inside the temp workspace, for a rule that gates on `$filename`;
+ * its extension also decides whether the file may hold JSX. `expect: "file"` is for a rule whose span is
+ * the whole module (`JsModule()`), where there is no per-line diagnostic to match.
+ */
+interface FixtureMeta {
+  path?: string;
+  expect?: "lines" | "file";
+}
+
+interface FixtureCase {
+  rule: string;
+  name: string;
+  dir: string;
+  meta: FixtureMeta;
+}
+
+const tempDirs: string[] = [];
+
+afterAll(async () => {
+  await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
+});
+
+const runBiome = (args: string[], cwd: string) =>
+  new Promise<string>((resolve, reject) => {
+    const proc = spawn(biomeBin, args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    proc.stdout.on("data", (chunk: Buffer) => (stdout += chunk.toString()));
+    proc.stderr.on("data", (chunk: Buffer) => (stderr += chunk.toString()));
+    proc.on("error", reject);
+    proc.on("close", () => resolve(stdout || stderr));
+  });
+
+/** Every directory holding a `bad.*`, named `<rule>` or `<rule>/<case>`. */
+const collectCases = async (): Promise<FixtureCase[]> => {
+  const cases: FixtureCase[] = [];
+  const walk = async (dir: string, rule: string, name: string) => {
+    const entries = await readdir(dir, { withFileTypes: true });
+    if (entries.some((entry) => entry.isFile() && entry.name.startsWith("bad."))) {
+      const metaPath = path.join(dir, "fixture.json");
+      const meta = existsSync(metaPath) ? (JSON.parse(await readFile(metaPath, "utf-8")) as FixtureMeta) : {};
+      cases.push({ rule, name: name || rule, dir, meta });
+    }
+    for (const entry of entries.filter((entry) => entry.isDirectory()))
+      await walk(path.join(dir, entry.name), rule, `${rule}/${entry.name}`);
+  };
+  for (const entry of (await readdir(fixturesDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()))
+    await walk(path.join(fixturesDir, entry.name), entry.name, "");
+  return cases.sort((left, right) => left.name.localeCompare(right.name));
+};
+
+const sourceName = (fixture: FixtureCase, kind: "bad" | "good") => {
+  const target = fixture.meta.path;
+  if (!target) return { read: `${kind}.tsx`, write: `${kind}.tsx` };
+  const ext = path.extname(target);
+  return { read: `${kind}${ext}`, write: target };
+};
+
+const readFixture = async (fixture: FixtureCase, kind: "bad" | "good") =>
+  await readFile(path.join(fixture.dir, sourceName(fixture, kind).read), "utf-8");
+
+/** Diagnostics from one plugin against one fixture, keyed by the 1-based line each was reported on. */
+const lintFixture = async (fixture: FixtureCase, kind: "bad" | "good") => {
+  const dir = await mkdtemp(path.join(os.tmpdir(), `grit-${fixture.rule}-`));
+  tempDirs.push(dir);
+  // Every built-in rule off and the formatter silent, so the only thing left that can report is the plugin.
+  await writeFile(
+    path.join(dir, "biome.json"),
+    JSON.stringify({
+      linter: { enabled: true, rules: { recommended: false } },
+      formatter: { enabled: false },
+      assist: { enabled: false },
+      plugins: [path.join(lintDir, `${fixture.rule}.grit`)],
+    }),
+  );
+  const source = path.join(dir, sourceName(fixture, kind).write);
+  await mkdir(path.dirname(source), { recursive: true });
+  await writeFile(source, await readFixture(fixture, kind));
+  const output = await runBiome(
+    ["check", "--reporter=json", "--max-diagnostics=none", "--no-errors-on-unmatched", `--config-path=${dir}`, source],
+    dir,
+  );
+  const start = output.indexOf("{");
+  const end = output.lastIndexOf("}");
+  if (start === -1 || end < start)
+    throw new Error(`biome produced no JSON for ${fixture.name}/${kind}: ${output.slice(0, 400)}`);
+  const diagnostics =
+    (JSON.parse(output.slice(start, end + 1)) as { diagnostics?: BiomeDiagnostic[] }).diagnostics ?? [];
+  return {
+    diagnostics,
+    lines: [...new Set(diagnostics.map((diagnostic) => diagnostic.location?.start?.line ?? 0))].sort(
+      (left, right) => left - right,
+    ),
+  };
+};
+
+/** The 1-based line of every line carrying `marker`. One case per line is the fixture contract. */
+const markedLines = async (fixture: FixtureCase, kind: "bad" | "good", marker: string) =>
+  (await readFixture(fixture, kind))
+    .split("\n")
+    .map((line, index) => (line.includes(marker) ? index + 1 : 0))
+    .filter((line) => line > 0);
+
+const fixtures = await collectCases();
+
+describe("grit lint rules", () => {
+  test("the harness found the biome binary and at least one fixture", () => {
+    expect(existsSync(biomeBin)).toBe(true);
+    expect(fixtures.length).toBeGreaterThan(0);
+  });
+
+  test("every fixture folder names a rule that exists", () => {
+    for (const fixture of fixtures) expect(existsSync(path.join(lintDir, `${fixture.rule}.grit`))).toBe(true);
+  });
+
+  test("every rule in this folder has a fixture", async () => {
+    const ruleFiles = (await readdir(lintDir))
+      .filter((name) => name.endsWith(".grit"))
+      .map((name) => name.slice(0, -5));
+    const covered = new Set(fixtures.map((fixture) => fixture.rule));
+    expect(ruleFiles.filter((rule) => !covered.has(rule))).toEqual([]);
+  });
+
+  for (const fixture of fixtures) {
+    test(`${fixture.name} flags exactly the marked lines in bad`, async () => {
+      const { lines, diagnostics } = await lintFixture(fixture, "bad");
+      for (const diagnostic of diagnostics) expect(diagnostic.category).toBe("plugin");
+      if (fixture.meta.expect === "file") {
+        expect(diagnostics.length).toBeGreaterThan(0);
+        return;
+      }
+      const expected = await markedLines(fixture, "bad", "// @flag");
+      expect(expected.length).toBeGreaterThan(0);
+      // Set equality, not containment: a marked line nobody reported is a pattern that stopped matching,
+      // and a reported line nobody marked is the rule reaching further than the fixture claims.
+      expect(lines).toEqual(expected);
+    });
+
+    test(`${fixture.name} leaves good clean`, async () => {
+      expect((await markedLines(fixture, "good", "// @ok")).length).toBeGreaterThan(0);
+      const { diagnostics } = await lintFixture(fixture, "good");
+      expect(diagnostics.map((diagnostic) => `${diagnostic.location?.start?.line}: ${diagnostic.message}`)).toEqual([]);
+    });
+  }
+});

package/lint/no-arbitrary-color.grit

@@ -3,7 +3,7 @@ language js(typescript, jsx)
 
 // Arbitrary-value color literals (`bg-[#3b82f6]`, `text-[rgb(0,0,0)]`) bypass the semantic
 // token layer, so they ignore data-theme switching and theme contrast validation. Grit port
-// of styleGuard's `arbitrary-color` rule (frontendBuild/styleGuard.ts) — keep in sync.
+// Cases: lint/__fixtures__/no-arbitrary-color/{bad,good}.tsx
 // Variable references (`bg-[--brand]`, `text-[var(--fg)]`) do not match, by design.
 or {
   JsxString() as $s,

package/lint/no-bang-comment-in-client.grit

@@ -2,19 +2,32 @@ engine biome(1.0)
 language js(typescript, jsx)
 
 // Bun's bundler classifies `//!` and `/*!` as legal comments (the `@license` / `@preserve` class) and keeps
-// them through `minify: true`, so a `//!` marker in browser-reachable code ships verbatim to every visitor.
+// them through `minify: true`, so a bang marker in browser-reachable code ships verbatim to every visitor.
 // `legalComments` is not a Bun.build option, so the source is the only place to stop it.
-// The two alternatives anchor the marker to line start or to whitespace after code, which keeps a literal
-// like `'https://host//!path'` from tripping the rule. A marker on the file's very first line is trivia that
-// Biome does not expose to the pattern, so it is the one case this rule cannot see.
-JsModule() as $mod where {
-  or {
-    $mod <: r"(?m)(?s).*^[ \t]*//!.*",
-    $mod <: r"(?s).*[^\s/][ \t]+//!.*"
+//
+// Matched through `file($name, $body)` rather than a node: a comment is trivia, and Biome's GritQL exposes
+// it to no node pattern — `JsModule()` does not even match as a top-level pattern, which is why the earlier
+// node-based spelling of this rule reported nothing at all.
+//
+// Two consequences, both measured (`local/review-2/data/probes/grit-node-probe.sh`):
+//   1. `$body` is the module's *token* span, so interior trivia is visible but the leading and trailing
+//      trivia are not — a marker above the first statement or below the last one is unreachable from
+//      GritQL. Those two positions are the rule's blind spot.
+//   2. `$body` is the whole file, so the diagnostic lands on line 1 whatever line the marker is on, and a
+//      regex capture carries no range to report instead. Search the file for the marker to find it.
+//
+// The alternations anchor the marker to line start or to whitespace after code, which keeps a literal like
+// `'https://host//!path'` from tripping the rule.
+file($name, $body) where {
+  $body <: or {
+    r"(?ms).*^[ \t]*//!.*",
+    r"(?s).*[^\s/][ \t]+//!.*",
+    r"(?ms).*^[ \t]*/\*!.*",
+    r"(?s).*[^\s/][ \t]+/\*!.*"
   },
   register_diagnostic(
-    span = $mod,
-    message = "The `//!` marker survives minification (Bun keeps it as a legal comment) and ships to the browser. Use `// FIXME:` or `// TODO:` in client-reachable code; keep `//!` for server, srvkit, and CLI files.",
+    span = $body,
+    message = "A `//!` or `/*!` marker survives minification (Bun keeps it as a legal comment) and ships to the browser. Use `// FIXME:` or `// TODO:` in client-reachable code; keep the bang form for server, srvkit, and CLI files. This diagnostic is file-level — search the file for the marker.",
     severity = "error"
   )
 }

package/lint/no-daisyui-legacy-class.grit

@@ -3,8 +3,8 @@ language js(typescript, jsx)
 
 // daisyUI was removed from the UI system; its component classes (`btn-primary`, `card-body`,
 // `mockup-code`, ...) and its colour slots (`bg-base-100`, `text-base-content`, `bg-error`)
-// no longer have any CSS behind them and silently render unstyled. Grit port of styleGuard's
-// `daisyui-legacy` rule (frontendBuild/styleGuard.ts) — keep in sync.
+// no longer have any CSS behind them and silently render unstyled.
+// Cases: lint/__fixtures__/no-daisyui-legacy-class/{bad,good}.tsx
 // Only high-signal compound names are matched; bare ambiguous words that collide with
 // Tailwind or app classes (`card`, `input`, `badge`, `btn`, `divider`) are deliberately not
 // flagged, and colour slots that survived into the semantic vocabulary (`primary`, `info`,

package/lint/no-inline-color.grit

@@ -2,18 +2,20 @@ engine biome(1.0)
 language js(typescript, jsx)
 
 // Color literals inside `style={{ ... }}` bypass the class scanner, the semantic token layer,
-// and theme switching entirely. Grit port of styleGuard's `inline-color` rule
-// (frontendBuild/styleGuard.ts) — keep in sync. `var(--token)` references do not match.
+// and theme switching entirely. `var(--token)` references do not match.
 //
-// Known delta vs the TS guard: color literals inside a `<style>` tag's template body are not
-// matched here (template chunks are not scoped by this pattern); the build-gate styleGuard
-// still covers that case.
-JsStringLiteralExpression() as $s where {
-  $s <: within `style={$obj}`,
+// The `<style>` arm covers the same literal in a tag body, which is the other way a color reaches
+// the page without passing the vocabulary. Both arms are needed because the two sites are different
+// node kinds — a string in an object property, and a chunk of a template literal.
+// Cases: lint/__fixtures__/no-inline-color/{bad,good}.tsx
+or {
+  JsStringLiteralExpression() as $s where { $s <: within `style={$obj}` },
+  JsTemplateChunkElement() as $s where { $s <: within `<style>$body</style>` }
+} where {
   $s <: r"[\s\S]*(?:#[0-9a-fA-F]{3,8}|(?:rgb|rgba|hsl|hsla|oklch|oklab|lab|lch|hwb)\()[\s\S]*",
   register_diagnostic(
     span = $s,
-    message = "Inline color literal in a style object bypasses semantic tokens and theme switching. Use a token class, or style={{ color: 'var(--primary)' }} when a runtime value is unavoidable.",
+    message = "Inline color literal bypasses semantic tokens and theme switching. Use a token class, or style={{ color: 'var(--primary)' }} when a runtime value is unavoidable.",
     severity = "error"
   )
 }

package/lint/no-interpolated-arbitrary-class.grit

@@ -7,9 +7,9 @@ language js(typescript, jsx)
 // literal of the same shape happens to exist elsewhere in the codebase: the default value works by accident
 // while every override dies quietly (that is exactly how `Empty`'s minHeight went unnoticed).
 //
-// Grit port of styleGuard's `interpolated-arbitrary` rule (frontendBuild/styleGuard.ts) — keep the two
-// regexes in sync. Matching template *chunks* is what makes this detectable: the chunk before `${` still
-// carries the unterminated `-[`.
+// Matching template *chunks* is what makes this detectable: the chunk before `${` still carries the
+// unterminated `-[`.
+// Cases: lint/__fixtures__/no-interpolated-arbitrary-class/{bad,good}.tsx
 //
 // The fix is a style prop for the runtime value (`style={{ minHeight }}`) — dimensions are not colors, so
 // no-inline-color does not apply — or a fixed set of literal classes when the value comes from an enum.

package/lint/no-raw-palette-class.grit

@@ -3,9 +3,9 @@ language js(typescript, jsx)
 
 // Vocabulary closure (`@theme { --color-*: initial }` in akanjs/ui/styles.css) strips the raw
 // Tailwind palette, so classes like `bg-blue-500` generate NO css and silently render as
-// currentColor/transparent. This rule surfaces that silent breakage at lint time. It is the
-// grit port of styleGuard's `raw-palette` rule (frontendBuild/styleGuard.ts) — keep the two
-// regexes in sync. Matching string/template nodes (not raw text) skips comments for free.
+// currentColor/transparent. This rule surfaces that silent breakage at lint time. Matching
+// string/template nodes (not raw text) skips comments for free.
+// Cases: lint/__fixtures__/no-raw-palette-class/{bad,good}.tsx
 //
 // Bare `bg-neutral` is a semantic token and allowed; the numeric suffix (`bg-neutral-500`)
 // is what marks a raw palette class. black/white stay in the vocabulary for overlays.

package/lint/non-scalar-props-restricted.grit

@@ -1,10 +1,19 @@
-`$name={$value}` where {
-  or {
-    $value <: `($$$_) => $_`,
-    $value <: `$_ => $_`,
-    $value <: `function($$$_) { $$$_ }`,
-    $value <: `function $fnName($$$_) { $$$_ }`
-  },
+engine biome(1.0)
+language js(typescript, jsx)
+
+// A function prop cannot cross the RSC boundary: a closure has no serialized form, so a server component
+// handing one down fails at the boundary rather than at the call. `loader`, `render` and `of` are the
+// framework's own slots, which take the function on the client side of the boundary.
+//
+// The attribute is matched by node fields rather than by a `$name={$value}` snippet: Biome's GritQL does
+// not parse a bare snippet in that shape as a JsxAttribute, so the snippet form matches nothing at all.
+// Reading `expression` off the initializer is also what keeps the value anchored to this attribute — a
+// `contains` would reach into nested JSX and report `item={item}` inside `render={(item) => <Row item={item} />}`.
+JsxAttribute(
+  name = $name,
+  initializer = JsxAttributeInitializerClause(value = JsxExpressionAttributeValue(expression = $value))
+) where {
+  $value <: or { JsArrowFunctionExpression(), JsFunctionExpression() },
   not $name <: or { `loader`, `render`, `of` },
   register_diagnostic(
     span = $name,