@astrale-os/sdk 0.4.12 → 0.4.13

package/src/linter/index.ts

@@ -0,0 +1,14 @@
+export { ruleCatalog, ruleId, ruleInfo } from './rules/catalog.js'
+export type { ImplementedRuleSlug, RuleInfo, RuleOwner } from './rules/catalog.js'
+export type {
+  DiagnosticLocation,
+  DiagnosticSeverity,
+  LintDiagnostic,
+  LintResult,
+} from './diagnostic.js'
+export { LinterToolError } from './diagnostic.js'
+export { lintDomain } from './lint.js'
+export type { LintDomainOptions } from './lint.js'
+export { domainOxlintConfig } from './oxlint/config.js'
+export { formatLintResult } from './report.js'
+export type { LintReportFormat } from './report.js'

package/src/linter/lint.ts

@@ -0,0 +1,32 @@
+import { resolve } from 'node:path'
+import { performance } from 'node:perf_hooks'
+
+import { analyzeProject } from './analyze.js'
+import { dedupeDiagnostics, type LintResult } from './diagnostic.js'
+import { runOxlint } from './oxlint/run.js'
+import { assertSingleTypeUniverse } from './preflight.js'
+import { discoverProject } from './project.js'
+
+export type LintDomainOptions = {
+  root?: string
+  fix?: boolean
+  preflight?: boolean
+}
+
+export async function lintDomain(options: LintDomainOptions = {}): Promise<LintResult> {
+  const started = performance.now()
+  const root = resolve(options.root ?? process.cwd())
+  if (options.preflight !== false) await assertSingleTypeUniverse(root)
+  const [project, oxlint] = await Promise.all([
+    discoverProject(root),
+    runOxlint(root, options.fix ?? false),
+  ])
+  const diagnostics = dedupeDiagnostics([...oxlint.diagnostics, ...analyzeProject(project)])
+  return {
+    root: project.root,
+    diagnostics,
+    files: Math.max(project.files.length, oxlint.files),
+    durationMs: Math.max(0, Math.round(performance.now() - started)),
+    exitCode: diagnostics.some((diagnostic) => diagnostic.severity === 'error') ? 1 : 0,
+  }
+}

package/src/linter/oxlint/astrale-ox.d.ts

@@ -0,0 +1,5 @@
+declare module '@astrale-os/ox/lint' {
+  // oxlint-disable-next-line consistent-type-imports -- ambient modules cannot import this type
+  const config: import('oxlint').OxlintConfig
+  export default config
+}

package/src/linter/oxlint/config.ts

@@ -0,0 +1,19 @@
+import base from '@astrale-os/ox/lint'
+import { defineConfig } from 'oxlint'
+
+export const domainOxlintConfig = defineConfig({
+  extends: [base],
+  jsPlugins: [
+    {
+      name: 'astrale',
+      specifier: '@astrale-os/sdk/linter/oxlint-plugin',
+    },
+  ],
+  rules: {
+    'astrale/core-has-no-async': 'error',
+    'astrale/no-nested-steps': 'error',
+    'astrale/no-read-inside-mutate': 'error',
+  },
+})
+
+export default domainOxlintConfig

package/src/linter/oxlint/plugin.js

@@ -0,0 +1,16 @@
+// @ts-check
+
+import { coreHasNoAsync } from '../rules/core-has-no-async.js'
+import { noNestedSteps } from '../rules/no-nested-steps.js'
+import { noReadInsideMutate } from '../rules/no-read-inside-mutate.js'
+
+const astraleOxlintPlugin = {
+  meta: { name: 'astrale', version: '0.1.0' },
+  rules: {
+    'core-has-no-async': coreHasNoAsync,
+    'no-nested-steps': noNestedSteps,
+    'no-read-inside-mutate': noReadInsideMutate,
+  },
+}
+
+export default astraleOxlintPlugin

package/src/linter/oxlint/run.ts

@@ -0,0 +1,162 @@
+import { spawn } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { dirname, join, relative, resolve, sep } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { LinterToolError, type DiagnosticSeverity, type LintDiagnostic } from '../diagnostic.js'
+import { ruleInfo } from '../rules/catalog.js'
+
+type OxlintOutput = {
+  diagnostics?: OxlintDiagnostic[]
+  number_of_files?: number
+}
+
+type OxlintDiagnostic = {
+  message?: string
+  code?: string
+  severity?: string
+  url?: string
+  help?: string
+  filename?: string
+  labels?: Array<{
+    span?: { offset?: number; length?: number; line?: number; column?: number }
+  }>
+}
+
+export type OxlintResult = {
+  diagnostics: LintDiagnostic[]
+  files: number
+}
+
+export async function runOxlint(root: string, fix: boolean): Promise<OxlintResult> {
+  const packageJson = join(root, 'package.json')
+  const projectRequire = createRequire(packageJson)
+  const sdkRequire = createRequire(import.meta.url)
+  const oxlintPackage = resolvePackage('oxlint/package.json', projectRequire, sdkRequire)
+  const bin = join(dirname(oxlintPackage), 'bin', 'oxlint')
+  const config = projectConfig(root) ?? internalConfigPath()
+  const args = [bin, '.', '--format=json', '--no-error-on-unmatched-pattern', '--config', config]
+  if (fix) args.push('--fix')
+
+  const child = spawn(process.execPath, args, {
+    cwd: root,
+    env: process.env,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+  let stdout = ''
+  let stderr = ''
+  child.stdout.setEncoding('utf8')
+  child.stderr.setEncoding('utf8')
+  child.stdout.on('data', (chunk: string) => (stdout += chunk))
+  child.stderr.on('data', (chunk: string) => (stderr += chunk))
+  const status = await new Promise<number | null>((resolveStatus, reject) => {
+    child.once('error', reject)
+    child.once('close', resolveStatus)
+  }).catch((error: unknown) => {
+    throw new LinterToolError(`Could not start Oxlint at ${bin}.`, { cause: error })
+  })
+
+  let output: OxlintOutput
+  try {
+    output = JSON.parse(stdout) as OxlintOutput
+  } catch (error) {
+    const detail =
+      stderr.trim() || stdout.trim() || `Oxlint exited with status ${status ?? 'unknown'}`
+    throw new LinterToolError(`Oxlint did not produce a diagnostic report.\n${detail}`, {
+      cause: error,
+    })
+  }
+  if (status !== 0 && status !== 1) {
+    throw new LinterToolError(
+      `Oxlint failed with status ${status ?? 'unknown'}.${stderr.trim() ? `\n${stderr.trim()}` : ''}`,
+    )
+  }
+
+  return {
+    diagnostics: (output.diagnostics ?? []).map((diagnostic) =>
+      normalizeDiagnostic(root, diagnostic),
+    ),
+    files: output.number_of_files ?? 0,
+  }
+}
+
+function resolvePackage(
+  id: string,
+  projectRequire: NodeJS.Require,
+  sdkRequire: NodeJS.Require,
+): string {
+  try {
+    return projectRequire.resolve(id)
+  } catch (projectError) {
+    try {
+      return sdkRequire.resolve(id)
+    } catch {
+      throw new LinterToolError(
+        'Oxlint is not installed. Add the scaffolded Oxlint dev dependency and run your package manager install.',
+        { cause: projectError },
+      )
+    }
+  }
+}
+
+function projectConfig(root: string): string | undefined {
+  for (const name of [
+    'oxlint.config.ts',
+    'oxlint.config.js',
+    'oxlint.config.mjs',
+    'oxlint.config.cjs',
+    '.oxlintrc.json',
+    '.oxlintrc.jsonc',
+  ]) {
+    const path = join(root, name)
+    if (existsSync(path)) return path
+  }
+  return undefined
+}
+
+function internalConfigPath(): string {
+  const current = fileURLToPath(import.meta.url)
+  const extension = current.endsWith('.ts') ? '.ts' : '.js'
+  return join(dirname(current), `config${extension}`)
+}
+
+function normalizeDiagnostic(root: string, diagnostic: OxlintDiagnostic): LintDiagnostic {
+  const id = normalizeCode(diagnostic.code ?? 'oxlint/unknown')
+  const info = ruleInfo(id)
+  const span = diagnostic.labels?.[0]?.span
+  return {
+    id,
+    severity: normalizeSeverity(diagnostic.severity),
+    message: diagnostic.message ?? info?.message ?? 'Oxlint reported a violation.',
+    ...(diagnostic.help || info?.help ? { help: diagnostic.help ?? info?.help } : {}),
+    ...(diagnostic.url || info?.url ? { url: diagnostic.url ?? info?.url } : {}),
+    owner: info?.owner ?? 'generic',
+    ...(diagnostic.filename
+      ? {
+          location: {
+            path: relativePath(root, diagnostic.filename),
+            line: span?.line ?? 1,
+            column: span?.column ?? 1,
+            ...(span?.offset !== undefined ? { offset: span.offset } : {}),
+            ...(span?.length !== undefined ? { length: span.length } : {}),
+          },
+        }
+      : {}),
+  }
+}
+
+function normalizeCode(code: string): string {
+  const match = /^([^()]+)\(([^()]+)\)$/.exec(code)
+  return match ? `${match[1]}/${match[2]}` : code
+}
+
+function normalizeSeverity(severity: string | undefined): DiagnosticSeverity {
+  return severity === 'error' ? 'error' : 'warning'
+}
+
+function relativePath(root: string, filename: string): string {
+  const absolute = resolve(root, filename)
+  const path = relative(root, absolute)
+  return sep === '/' ? path : path.split(sep).join('/')
+}

package/src/linter/preflight.ts

@@ -0,0 +1,181 @@
+import { existsSync } from 'node:fs'
+import { readFile, realpath } from 'node:fs/promises'
+import { createRequire } from 'node:module'
+import { dirname, join, relative, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { LinterToolError } from './diagnostic.js'
+
+const brandedPackages = [
+  '@astrale-os/kernel-client',
+  '@astrale-os/kernel-core',
+  '@astrale-os/kernel-dsl',
+] as const
+
+const conventionalMembers = ['client', 'frontend', 'schema', 'worker'] as const
+
+type Resolution = {
+  consumer: string
+  path: string
+}
+
+type ConsumerPackageJson = {
+  name?: string
+  dependencies?: Record<string, string>
+  optionalDependencies?: Record<string, string>
+  workspaces?: string[] | { packages?: string[] }
+}
+
+export async function assertSingleTypeUniverse(root: string): Promise<void> {
+  const manifests = await collectConsumerManifests(root)
+  const consumers = [
+    ...manifests.map((path) => ({ label: relative(root, dirname(path)) || '.', path })),
+    { label: '@astrale-os/sdk/linter', path: fileURLPackageJson() },
+  ]
+
+  for (const packageName of brandedPackages) {
+    const resolutions: Resolution[] = []
+    for (const consumer of consumers) {
+      const resolved = await resolvePackageRoot(packageName, consumer.path)
+      if (resolved) resolutions.push({ consumer: consumer.label, path: resolved })
+    }
+    const paths = new Set(resolutions.map((resolution) => resolution.path))
+    if (paths.size <= 1) continue
+    const detail = formatResolutions(resolutions)
+    throw new LinterToolError(
+      `Multiple physical installations of ${packageName} would create incompatible Astrale types.\n` +
+        `${detail}\nReinstall the workspace so every member resolves one compatible package instance.`,
+    )
+  }
+}
+
+function formatResolutions(resolutions: readonly Resolution[]): string {
+  const byPath = new Map<string, string[]>()
+  for (const resolution of resolutions) {
+    const consumers = byPath.get(resolution.path) ?? []
+    consumers.push(resolution.consumer)
+    byPath.set(resolution.path, consumers)
+  }
+  return [...byPath]
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([path, consumers]) => {
+      const sorted = [...new Set(consumers)].sort()
+      const shown = sorted.slice(0, 4).join(', ')
+      const omitted = sorted.length > 4 ? ` (+${sorted.length - 4} more)` : ''
+      return `  ${path}\n    from: ${shown}${omitted}`
+    })
+    .join('\n')
+}
+
+async function collectConsumerManifests(root: string): Promise<string[]> {
+  const rootManifest = join(root, 'package.json')
+  if (!existsSync(rootManifest)) return []
+
+  const manifests = new Set([rootManifest])
+  const packageJson = await readPackageJson(rootManifest)
+  const workspaces = Array.isArray(packageJson?.workspaces)
+    ? packageJson.workspaces
+    : packageJson?.workspaces?.packages
+
+  for (const workspace of workspaces ?? []) {
+    if (typeof workspace !== 'string' || hasGlob(workspace)) continue
+    addManifestWithinRoot(manifests, root, workspace)
+  }
+
+  for (const member of conventionalMembers) addManifestWithinRoot(manifests, root, member)
+  await addDomainContractDependencyManifests(manifests)
+  return [...manifests].sort()
+}
+
+async function readPackageJson(manifest: string): Promise<ConsumerPackageJson | undefined> {
+  try {
+    return JSON.parse(await readFile(manifest, 'utf8'))
+  } catch {
+    return undefined
+  }
+}
+
+async function addDomainContractDependencyManifests(manifests: Set<string>): Promise<void> {
+  const pending = [...manifests]
+  for (let index = 0; index < pending.length; index++) {
+    const consumer = pending[index]!
+    const packageJson = await readPackageJson(consumer)
+    const dependencies = {
+      ...packageJson?.optionalDependencies,
+      ...packageJson?.dependencies,
+    }
+    for (const packageName of Object.keys(dependencies).sort()) {
+      if (!isDomainContractPackage(packageName)) continue
+      const manifest = await resolveDependencyManifest(packageName, consumer)
+      if (!manifest || manifests.has(manifest)) continue
+      manifests.add(manifest)
+      pending.push(manifest)
+    }
+  }
+}
+
+async function resolveDependencyManifest(
+  packageName: string,
+  consumerManifest: string,
+): Promise<string | undefined> {
+  const require = createRequire(consumerManifest)
+  try {
+    return await realpath(require.resolve(`${packageName}/package.json`))
+  } catch {
+    try {
+      let directory = dirname(await realpath(require.resolve(packageName)))
+      for (;;) {
+        const manifest = join(directory, 'package.json')
+        if (existsSync(manifest)) {
+          const packageJson = await readPackageJson(manifest)
+          if (packageJson?.name === packageName) return await realpath(manifest)
+        }
+        const parent = dirname(directory)
+        if (parent === directory) return undefined
+        directory = parent
+      }
+    } catch {
+      return undefined
+    }
+  }
+}
+
+function addManifestWithinRoot(manifests: Set<string>, root: string, member: string): void {
+  const manifest = resolve(root, member, 'package.json')
+  const parent = relative(root, manifest)
+  if (parent.startsWith('..') || parent === '') return
+  if (existsSync(manifest)) manifests.add(manifest)
+}
+
+function hasGlob(path: string): boolean {
+  return /[*?[\]{}!]/u.test(path)
+}
+
+function isDomainContractPackage(packageName: string): boolean {
+  return packageName.startsWith('@astrale-domains/')
+}
+
+async function resolvePackageRoot(
+  packageName: (typeof brandedPackages)[number],
+  manifest: string,
+): Promise<string | undefined> {
+  if (!existsSync(manifest)) return undefined
+  try {
+    const resolved = createRequire(manifest).resolve(`${packageName}/package.json`)
+    return await realpath(dirname(resolved))
+  } catch {
+    return undefined
+  }
+}
+
+function fileURLPackageJson(): string {
+  let directory = dirname(fileURLToPath(import.meta.url))
+  for (;;) {
+    const candidate = join(directory, 'package.json')
+    if (existsSync(candidate)) return candidate
+    const parent = dirname(directory)
+    if (parent === directory) break
+    directory = parent
+  }
+  return join(directory, 'package.json')
+}

package/src/linter/project.ts

@@ -0,0 +1,108 @@
+import { readdir, readFile, realpath } from 'node:fs/promises'
+import { dirname, extname, isAbsolute, join, relative, resolve, sep } from 'node:path'
+
+import { scanSource, type SourceFile } from './source.js'
+
+const ignoredDirectories = new Set([
+  '.astrale',
+  '.dist',
+  '.domain-studio',
+  '.git',
+  '.output',
+  '.turbo',
+  '.wrangler',
+  'coverage',
+  'dist',
+  'dist-client',
+  'node_modules',
+])
+
+const sourceExtensions = new Set(['.cjs', '.cts', '.js', '.jsx', '.mjs', '.mts', '.ts', '.tsx'])
+
+export type DomainProject = {
+  root: string
+  files: readonly SourceFile[]
+  filesByPath: ReadonlyMap<string, SourceFile>
+}
+
+export async function discoverProject(root: string): Promise<DomainProject> {
+  const projectRoot = await realpath(resolve(root))
+  const paths: string[] = []
+  await collectSourcePaths(projectRoot, paths)
+  paths.sort()
+
+  const files = await Promise.all(
+    paths.map(async (path) => {
+      const text = await readFile(path, 'utf8')
+      return scanSource(path, normalizePath(relative(projectRoot, path)), text)
+    }),
+  )
+  return {
+    root: projectRoot,
+    files,
+    filesByPath: new Map(files.map((file) => [file.path, file])),
+  }
+}
+
+async function collectSourcePaths(directory: string, result: string[]): Promise<void> {
+  const entries = await readdir(directory, { withFileTypes: true })
+  await Promise.all(
+    entries.map(async (entry) => {
+      if (entry.isSymbolicLink()) return
+      const path = join(directory, entry.name)
+      if (entry.isDirectory()) {
+        if (!ignoredDirectories.has(entry.name)) await collectSourcePaths(path, result)
+        return
+      }
+      if (!entry.isFile() || !sourceExtensions.has(extname(entry.name))) return
+      if (entry.name.endsWith('.d.ts') || entry.name.includes('.gen.')) return
+      result.push(path)
+    }),
+  )
+}
+
+export function normalizePath(path: string): string {
+  return sep === '/' ? path : path.split(sep).join('/')
+}
+
+export function isProductionSource(relativePath: string): boolean {
+  const normalized = normalizePath(relativePath)
+  return (
+    !normalized.split('/').includes('__tests__') &&
+    !/\.(?:test|spec|bench|perf)\.[cm]?[jt]sx?$/.test(normalized) &&
+    !normalized.includes('.gen.')
+  )
+}
+
+export function isProductionCore(relativePath: string): boolean {
+  const normalized = normalizePath(relativePath)
+  return (normalized === 'core' || normalized.startsWith('core/')) && isProductionSource(normalized)
+}
+
+export function resolveProjectImport(
+  project: DomainProject,
+  importer: SourceFile,
+  specifier: string,
+): SourceFile | undefined {
+  if (!specifier.startsWith('.')) return undefined
+  const unresolved = resolve(dirname(importer.path), specifier)
+  for (const candidate of importCandidates(unresolved)) {
+    const file = project.filesByPath.get(candidate)
+    if (file) return file
+  }
+  return undefined
+}
+
+function importCandidates(path: string): string[] {
+  const extension = extname(path)
+  const candidates = [path]
+  if (extension === '.js' || extension === '.jsx' || extension === '.mjs' || extension === '.cjs') {
+    const stem = path.slice(0, -extension.length)
+    candidates.push(`${stem}.ts`, `${stem}.tsx`, `${stem}.mts`, `${stem}.cts`)
+  }
+  if (!extension) {
+    candidates.push(`${path}.ts`, `${path}.tsx`, `${path}.mts`, `${path}.cts`)
+    candidates.push(join(path, 'index.ts'), join(path, 'index.tsx'))
+  }
+  return candidates.map((candidate) => (isAbsolute(candidate) ? candidate : resolve(candidate)))
+}

package/src/linter/report.ts

@@ -0,0 +1,25 @@
+import type { LintResult } from './diagnostic.js'
+
+export type LintReportFormat = 'json' | 'stylish'
+
+export function formatLintResult(result: LintResult, format: LintReportFormat = 'stylish'): string {
+  if (format === 'json') return `${JSON.stringify(result, null, 2)}\n`
+  const lines: string[] = []
+  for (const diagnostic of result.diagnostics) {
+    const location = diagnostic.location
+      ? `${diagnostic.location.path}:${diagnostic.location.line}:${diagnostic.location.column}`
+      : result.root
+    lines.push(`${location}  ${diagnostic.severity} ${diagnostic.id}  ${diagnostic.message}`)
+    if (diagnostic.help) lines.push(`  ${diagnostic.help}`)
+  }
+
+  const errors = result.diagnostics.filter((diagnostic) => diagnostic.severity === 'error').length
+  const warnings = result.diagnostics.length - errors
+  if (lines.length > 0) lines.push('')
+  lines.push(
+    errors === 0
+      ? `\u2713 ${result.files} files linted in ${result.durationMs}ms${warnings ? ` (${warnings} warnings)` : ''}`
+      : `\u2717 ${errors} ${errors === 1 ? 'error' : 'errors'}, ${warnings} ${warnings === 1 ? 'warning' : 'warnings'} in ${result.durationMs}ms`,
+  )
+  return `${lines.join('\n')}\n`
+}

package/src/linter/rules/catalog.ts

@@ -0,0 +1,67 @@
+export type RuleOwner = 'analyzer' | 'oxlint' | 'sdk'
+
+export type RuleInfo = {
+  slug: string
+  owner: RuleOwner
+  message: string
+  help: string
+  url: string
+}
+
+const ruleDocsUrl = (slug: string) => `https://docs.astrale.ai/linter/rules/${slug}`
+
+export const ruleCatalog = {
+  'thin-schema-composition-root': {
+    slug: 'thin-schema-composition-root',
+    owner: 'analyzer',
+    message: 'The schema composition root defines a schema member inline.',
+    help: 'Move this member definition to its bounded-context module and import it here.',
+    url: ruleDocsUrl('thin-schema-composition-root'),
+  },
+  'one-remote-definition-per-file': {
+    slug: 'one-remote-definition-per-file',
+    owner: 'analyzer',
+    message: 'This file defines more than one Astrale remote callable.',
+    help: 'Keep one remoteMethod or defineRemoteFunction definition per implementation file.',
+    url: ruleDocsUrl('one-remote-definition-per-file'),
+  },
+  'core-is-pure': {
+    slug: 'core-is-pure',
+    owner: 'analyzer',
+    message: 'Pure core code depends on an effectful or runtime-only module.',
+    help: 'Move I/O orchestration to runtime or integrations and pass pure data into core.',
+    url: ruleDocsUrl('core-is-pure'),
+  },
+  'core-has-no-async': {
+    slug: 'core-has-no-async',
+    owner: 'oxlint',
+    message: 'Production core code contains asynchronous syntax.',
+    help: 'Keep core deterministic and synchronous; perform asynchronous work in runtime or integrations.',
+    url: ruleDocsUrl('core-has-no-async'),
+  },
+  'no-nested-steps': {
+    slug: 'no-nested-steps',
+    owner: 'oxlint',
+    message: 'A durable step directly contains another durable step.',
+    help: 'Give each stage one step boundary and call helper-owned steps outside another step callback.',
+    url: ruleDocsUrl('no-nested-steps'),
+  },
+  'no-read-inside-mutate': {
+    slug: 'no-read-inside-mutate',
+    owner: 'oxlint',
+    message: 'A graph mutation builder performs a read or is asynchronous.',
+    help: 'Read before mutate, then keep the mutation callback synchronous and limited to patch construction.',
+    url: ruleDocsUrl('no-read-inside-mutate'),
+  },
+} as const satisfies Record<string, RuleInfo>
+
+export type ImplementedRuleSlug = keyof typeof ruleCatalog
+
+export function ruleId(slug: ImplementedRuleSlug): `astrale/${ImplementedRuleSlug}` {
+  return `astrale/${slug}`
+}
+
+export function ruleInfo(id: string): RuleInfo | undefined {
+  const slug = id.startsWith('astrale/') ? id.slice('astrale/'.length) : id
+  return ruleCatalog[slug as ImplementedRuleSlug]
+}

package/src/linter/rules/core-has-no-async.js

@@ -0,0 +1,43 @@
+// @ts-check
+
+import { isProductionCoreFile, nearestFunction, reportUnlessSuppressed } from './oxlint-ast.js'
+
+const id = 'astrale/core-has-no-async'
+
+/** @type {import('./oxlint-rule.js').OxlintRule} */
+export const coreHasNoAsync = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description: 'Production core code contains asynchronous syntax.',
+      url: 'https://docs.astrale.ai/linter/rules/core-has-no-async',
+    },
+    messages: {
+      asyncFunction: 'Production core functions must be synchronous.',
+      topLevelAwait: 'Production core modules must not use top-level await.',
+    },
+    schema: [],
+  },
+  create(context) {
+    if (!isProductionCoreFile(context)) return {}
+    /** @param {import('./oxlint-rule.js').AstNode} node */
+    const reportFunction = (node) => {
+      if (node.async) reportUnlessSuppressed(context, node, id, 'asyncFunction')
+    }
+    return {
+      FunctionDeclaration: reportFunction,
+      FunctionExpression: reportFunction,
+      ArrowFunctionExpression: reportFunction,
+      AwaitExpression(node) {
+        if (!nearestFunction(node.parent)) {
+          reportUnlessSuppressed(context, node, id, 'topLevelAwait')
+        }
+      },
+      ForOfStatement(node) {
+        if (node.await && !nearestFunction(node.parent)) {
+          reportUnlessSuppressed(context, node, id, 'topLevelAwait')
+        }
+      },
+    }
+  },
+}