@commonplaces/oxlint-plugin 0.3.1 → 0.4.0

package/README.md

@@ -1,6 +1,6 @@
 # @commonplaces/oxlint-plugin
 
-61 custom Oxlint rules for strict Effect TypeScript, Alchemy and general code
+106 custom Oxlint rules for strict Effect TypeScript, Alchemy and general code
 checks. This package supports **Oxlint 1.80.0, 1.85.0 or 1.86.0** and **Node 22.14 or newer**.
 Oxlint's JavaScript plugin API is experimental, so upgrade it only after running
 the rule tests. The development tools use 1.80.0; consuming projects may use any supported version.
@@ -35,7 +35,18 @@ checks native Alchemy settings and secret sources. Each group turns its checks
 on as errors. They do not depend on one another. Override individual rules in
 your own `rules` or `overrides` settings.
 
-The root export contains these three configurations. Individual plugins use
+The root also exports `conventions`, `web` and `typescript`. `conventions` enables
+strict Effect coding conventions; `web` adds React/TanStack, MDX and typography
+checks; `typescript` enables native type-aware safety checks and correctness
+errors. Run the latter with `oxlint --type-aware --deny-warnings .`. These groups
+contain no application paths. Codec and runtime permissions remain explicit
+project facts.
+
+`strict` composes all six groups for applications that use the complete stack:
+`defineConfig({ extends: [strict, projectPolicy] })`. It adds no project paths
+or source ignores. Keep exact ownership settings in the consuming project.
+
+The root exports these six groups and the `strict` composition. Individual plugins use
 the subpaths below. For example, a JSON configuration can enable one rule:
 
 ```json
@@ -47,8 +58,8 @@ the subpaths below. For example, a JSON configuration can enable one rule:
 
 ## Project settings
 
-Rules that refer to project files, services, schemas or routes are available
-but excluded from the groups. Configure them explicitly, for example:
+Rules that refer to project files, schemas or routes are available but excluded
+from the groups. Configure them explicitly, for example:
 
 ```ts
 import { defineConfig } from "oxlint";
@@ -86,8 +97,35 @@ export default defineConfig({
 ```
 
 Use repository-relative paths with `/` separators. Runtime execution is denied
-everywhere unless `allowedFiles` grants an entry file. The service tracing rule
-requires `serviceNames` and checks names such as `Effect.fn("Orders.create")`.
+everywhere unless `allowedFiles` grants an entry file. Service tracing is enabled
+by `effect` without a service-name inventory. It checks native local
+`Context.Service` constructors and imported capitalised service `.of` calls,
+plus supplied operations in native `Layer.mock` replacements,
+preserving canonical names through named imports, namespace imports and immutable
+aliases. Shadowed names cannot borrow import identity. Every explicit operation
+requires its exact `Effect.fn("Orders.create")` or `Effect.withSpan` name.
+Legacy `serviceNames` selection remains available for existing consumers.
+An empty selector is rejected.
+
+Local contract types identify checked data and Stream members; native Stream
+expressions also retain their role in imported mixed contracts. Opaque members
+fail closed rather than gaining a name-based exemption. Instrumentation must
+wrap the operation or its returned Effect; an unrelated nested span is
+insufficient. The rule examines syntax, not a cross-file TypeScript type graph;
+an imported capitalised non-service `.of` API may require a distinct API shape.
+Empty partial mocks contain no supplied operation to instrument. The rule does
+not infer contracts for arbitrary Layer factories or raw `Layer.succeed` data
+objects; retain typed composition and review those boundaries.
+
+For a canonical operation adapter that preserves an overloaded service API,
+`operationAdapters` can name its public `module`, exact source `file`, `exports`
+and canonical `operation`. The adapter owns the returned operation's span.
+Prove that guarantee directly against the real adapter, with an uninstrumented
+callback and observed current span. Only that operation and those imported
+exports gain this role; shadowed functions, neighbouring modules and other
+service operations still require their own spans. This is an explicit contract
+owner where cross-file type analysis is unavailable, not a general wrapper
+permission.
 Invalid settings stop linting. Each rule's exported `meta.schema` describes its
 accepted options; no marketplace plugin is needed to read or run them.
 
@@ -98,15 +136,42 @@ package subpaths; keep your existing rule settings.
 
 ## Rule exports
 
-| Package subpath     | Rule prefix         | Rules |
-| ------------------- | ------------------- | ----: |
-| `/strict-effect`    | `strict-effect/`    |    29 |
-| `/effect`           | `effect/`           |     9 |
-| `/alchemy`          | `alchemy-secrets/`  |     3 |
-| `/bun`              | `bun/`              |     1 |
-| `/package`          | `package/`          |     3 |
-| `/anti-slop`        | `anti-slop/`        |    15 |
-| `/anti-slop-effect` | `anti-slop-effect/` |     1 |
+| Package subpath     | Rule prefix           | Rules |
+| ------------------- | --------------------- | ----: |
+| `/strict-effect`    | `strict-effect/`      |    29 |
+| `/effect`           | `effect/`             |     9 |
+| `/alchemy`          | `alchemy-secrets/`    |     3 |
+| `/bun`              | `bun/`                |     1 |
+| `/package`          | `package/`            |     3 |
+| `/anti-slop`        | `anti-slop/`          |    15 |
+| `/anti-slop-effect` | `anti-slop-effect/`   |     1 |
+| `/conventions`      | `effect-conventions/` |    33 |
+| `/web`              | `web/`                |    12 |
+
+### Explicit codec and runtime roles
+
+The three optional codec-placement checks in `/conventions` follow real Schema
+imports, named aliases, destructured exports and immutable aliases, respecting
+local shadowing. Add them through positive scopes that exclude exact ingress,
+egress or synchronous consumer owners. A filename ending in `.ingress.ts` or
+`.egress.ts` grants no permission on its own. `Schema.decodeTo` and `encodeTo`
+declarations remain transformations rather than codec execution.
+
+`effect-conventions/scoped-managed-runtime` requires acquisition and the
+matching runtime disposer through `Effect.acquireRelease`. For a host that owns
+an isolate/process lifetime and offers no termination callback, `hostLifetimes`
+may identify its exact top-level `const` by repository-relative `file` and
+`declaration`. Another declaration, nested construction or neighbouring file
+still fails. This role does not permit additional runtime execution files.
+Use the separate runtime execution owner rule as well.
+
+`browser-runtime-ownership` takes `runtimeOwners` and `registryOwners`.
+`native-http-client-ownership` takes `browserOwners` and `serverOwners`.
+`bounded-build-memo` takes exact `targets` with `file` and `declaration`.
+These are optional rules in `/conventions`; malformed allowances fail closed.
+The memo check requires immutable bounded includes and `lockfile: true`, and
+rejects excluded dependencies, opaque or overwritten settings and broad parent
+recursion outside `src`. There are no application path defaults.
 
 ## Development
 
@@ -179,7 +244,7 @@ integration checks and `bun run test` for the archive installation
 and public contract checks.
 
 Oxlint owns synchronous rule callbacks and reporting. Pure checks use immutable
-Effect collections. The two synchronous option decoders in `effect.ts` are
+Effect collections. The synchronous option decoders in `effect.ts` and `service-instrumentation.ts` are
 required by Oxlint's `create` callback and throw only for invalid configuration.
 The `syntax.ts` child adapter selects nodes from Oxlint's already parsed tree
 using its visitor keys; it is not a decoder for external JSON. Traversal cycle

package/dist/conventions/bounded-build-memo.d.ts

@@ -0,0 +1 @@
+export declare const boundedBuildMemo: import("@oxlint/plugins").Rule;

package/dist/conventions/bounded-build-memo.js

@@ -0,0 +1,147 @@
+import { defineRule } from "@oxlint/plugins";
+import * as Array from "effect/Array";
+import * as Function from "effect/Function";
+import * as Option from "effect/Option";
+import * as Predicate from "effect/Predicate";
+import * as Schema from "effect/Schema";
+import { constant as constantDeclaration } from "../native-reference.js";
+import { variableInScope as scopedVariable } from "../syntax.js";
+import { propertyName } from "../syntax.js";
+const FilePath = Schema.NonEmptyString.check(Schema.isPattern(/^(?!\/)(?!.*(?:\*|\\|(?:^|\/)\.\.?\/)).+\.tsx?$/u));
+const Identifier = Schema.NonEmptyString.check(Schema.isPattern(/^[A-Za-z_$][\w$]*$/u));
+const Options = Schema.Struct({
+    targets: Schema.NonEmptyArray(Schema.Struct({ file: FilePath, declaration: Identifier })),
+});
+// Only immutable local syntax is inspectable. Imported values and cyclic aliases
+// cannot silently replace the checked memo with an opaque value.
+const localValue = (context, node, visited = []) => {
+    if (Array.some((previous) => previous === node)(visited)) {
+        return Option.none();
+    }
+    const next = [...visited, node];
+    if (node.type === "TSSatisfiesExpression" || node.type === "TSAsExpression") {
+        return localValue(context, node.expression, next);
+    }
+    if (node.type !== "Identifier") {
+        return Option.some(node);
+    }
+    const scope = context.sourceCode.getScope(node);
+    return scopedVariable(scope, node.name).pipe(Option.flatMap(constantDeclaration), Option.flatMap((declaration) => Option.fromNullishOr(declaration.init)), Option.flatMap((initialiser) => localValue(context, initialiser, next)));
+};
+const field = (object, name) => Array.findFirst((property) => property.type === "Property" &&
+    !property.computed &&
+    Option.contains(propertyName(property.key), name))(object.properties).pipe(Option.filter((property) => property.type === "Property"), Option.map((property) => property.value));
+const boundedPattern = (pattern) => {
+    if (pattern.length === 0 ||
+        /^(?:\/|!)/u.test(pattern) ||
+        /[\\{}[\]]/u.test(pattern) ||
+        /(?:^|\/)(?:node_modules|\.git|dist)(?:\/|$)/u.test(pattern)) {
+        return false;
+    }
+    if (!pattern.startsWith("../")) {
+        return !pattern.includes("/../");
+    }
+    const external = pattern.replace(/^(?:\.\.\/)+/u, "");
+    const segments = external.split("/");
+    if (Array.contains("..")(segments)) {
+        return false;
+    }
+    const recursive = Array.findFirstIndex((segment) => segment.includes("**"))(segments);
+    return Option.match(recursive, {
+        onNone: () => /\.[A-Za-z0-9]+$/u.test(external),
+        onSome: (index) => Function.pipe(segments, Array.take(index), Array.contains("src")),
+    });
+};
+const safeMemo = (context, expression) => localValue(context, expression).pipe(Option.exists((memo) => {
+    if (memo.type !== "ObjectExpression" ||
+        Array.some((property) => property.type !== "Property" || property.computed || property.kind !== "init")(memo.properties)) {
+        return false;
+    }
+    const names = Function.pipe(memo.properties, Array.map((property) => {
+        if (property.type === "Property") {
+            return propertyName(property.key);
+        }
+        return Option.none();
+    }), Array.getSomes);
+    if (Array.dedupe(names).length !== names.length || Array.contains("exclude")(names)) {
+        return false;
+    }
+    const locked = field(memo, "lockfile").pipe(Option.flatMap((value) => localValue(context, value)), Option.exists((value) => value.type === "Literal" && value.value === true));
+    const included = field(memo, "include").pipe(Option.flatMap((value) => localValue(context, value)), Option.exists((value) => value.type === "ArrayExpression" &&
+        value.elements.length > 0 &&
+        Array.every((element) => Option.fromNullishOr(element).pipe(Option.flatMap((item) => localValue(context, item)), Option.exists((item) => item.type === "Literal" &&
+            Predicate.isString(item.value) &&
+            boundedPattern(item.value))))(value.elements)));
+    return locked && included;
+}));
+export const boundedBuildMemo = defineRule({
+    meta: {
+        type: "problem",
+        schema: [
+            {
+                type: "object",
+                properties: {
+                    targets: {
+                        type: "array",
+                        minItems: 1,
+                        items: {
+                            type: "object",
+                            properties: { file: { type: "string" }, declaration: { type: "string" } },
+                            required: ["file", "declaration"],
+                            additionalProperties: false,
+                        },
+                    },
+                },
+                required: ["targets"],
+                additionalProperties: false,
+            },
+        ],
+        messages: {
+            options: "Configure exact build-props files and declaration names.",
+            memo: "Keep an inspectable memo with bounded source/file globs, lockfile: true and no exclude override. Parent-directory recursive globs must stay inside src; dependency and build-output trees are forbidden.",
+        },
+    },
+    create(context) {
+        const options = Array.head(context.options).pipe(Option.flatMap(Schema.decodeUnknownOption(Options)));
+        return {
+            Program(program) {
+                Option.match(options, {
+                    onNone: () => {
+                        context.report({ node: program, messageId: "options" });
+                    },
+                    onSome: ({ targets }) => {
+                        Function.pipe(targets, Array.forEach((target) => {
+                            if (context.filename.replaceAll("\\", "/") !== `${context.cwd}/${target.file}`) {
+                                return;
+                            }
+                            const declaration = Function.pipe(program.body, Array.flatMap((statement) => {
+                                if (statement.type === "VariableDeclaration" && statement.kind === "const") {
+                                    return statement.declarations;
+                                }
+                                if (statement.type === "ExportNamedDeclaration" &&
+                                    statement.declaration?.type === "VariableDeclaration" &&
+                                    statement.declaration.kind === "const") {
+                                    return statement.declaration.declarations;
+                                }
+                                return [];
+                            }), Array.findFirst((value) => value.id.type === "Identifier" && value.id.name === target.declaration));
+                            const valid = declaration.pipe(Option.flatMap((value) => Option.fromNullishOr(value.init)), Option.flatMap((value) => localValue(context, value)), Option.exists((value) => value.type === "ObjectExpression" &&
+                                // Hosting spreads before memo are safe; later spreads or computed keys could override it.
+                                Array.findFirstIndex((property) => property.type === "Property" &&
+                                    Option.contains(propertyName(property.key), "memo"))(value.properties).pipe(Option.exists((index) => Function.pipe(value.properties, Array.drop(index), Array.every((property) => property.type === "Property" && !property.computed)) &&
+                                    Array.filter((property) => property.type === "Property" &&
+                                        Option.contains(propertyName(property.key), "memo"))(value.properties).length === 1)) &&
+                                field(value, "memo").pipe(Option.exists((memo) => safeMemo(context, memo)))));
+                            if (!valid) {
+                                context.report({
+                                    node: Option.getOrElse(declaration, () => program),
+                                    messageId: "memo",
+                                });
+                            }
+                        }));
+                    },
+                });
+            },
+        };
+    },
+});

package/dist/conventions/codecs.d.ts

@@ -0,0 +1,6 @@
+export declare const codecRules: {
+    "no-schema-decoder-outside-ingress": import("@oxlint/plugins").Rule;
+    "no-schema-encoder-outside-egress": import("@oxlint/plugins").Rule;
+    "no-sync-decoder-outside-consumer": import("@oxlint/plugins").Rule;
+    "no-throwing-schema-codec": import("@oxlint/plugins").Rule;
+};

package/dist/conventions/codecs.js

@@ -0,0 +1,31 @@
+import { Option } from "effect";
+import { memberName, report, rule } from "./shared.js";
+const decoder = /^decode(?:Unknown)?(?:Effect|Promise|Sync|Option|Result|Exit|Either|Unknown)?$/u;
+const encoder = /^encode(?:Unknown)?(?:Effect|Promise|Sync|Option|Result|Exit|Either|Unknown)?$/u;
+const synchronous = /(?:Option|Result|Exit|Either)$/u;
+export const codecRules = {
+    "no-schema-decoder-outside-ingress": rule("Decode raw input once at an explicitly configured ingress owner.", (context) => ({
+        CallExpression(node) {
+            if (memberName(context, node.callee, "effect/Schema").pipe(Option.exists((name) => decoder.test(name))))
+                report(context, node);
+        },
+    })),
+    "no-schema-encoder-outside-egress": rule("Encode checked values only at an explicitly configured outward boundary.", (context) => ({
+        CallExpression(node) {
+            if (memberName(context, node.callee, "effect/Schema").pipe(Option.exists((name) => encoder.test(name))))
+                report(context, node);
+        },
+    })),
+    "no-sync-decoder-outside-consumer": rule("Non-throwing synchronous decoding belongs to an explicit synchronous host consumer.", (context) => ({
+        CallExpression(node) {
+            if (memberName(context, node.callee, "effect/Schema").pipe(Option.exists((name) => decoder.test(name) && synchronous.test(name))))
+                report(context, node);
+        },
+    })),
+    "no-throwing-schema-codec": rule("Use Effect codecs and typed errors instead of throwing synchronous Schema codecs.", (context) => ({
+        CallExpression(node) {
+            if (memberName(context, node.callee, "effect/Schema").pipe(Option.exists((name) => name.endsWith("Sync") && !synchronous.test(name))))
+                report(context, node);
+        },
+    })),
+};

package/dist/conventions/contracts.d.ts

@@ -0,0 +1,11 @@
+export declare const contractRules: {
+    "branded-identifier-schema": import("@oxlint/plugins").Rule;
+    "no-raw-semantic-identifier": import("@oxlint/plugins").Rule;
+    "no-generic-client-escape": import("@oxlint/plugins").Rule;
+    "no-unknown-service-contract": import("@oxlint/plugins").Rule;
+    "no-unknown-tagged-error-payload": import("@oxlint/plugins").Rule;
+    "no-host-api-in-contract": import("@oxlint/plugins").Rule;
+    "no-layer-export-in-service": import("@oxlint/plugins").Rule;
+    "no-defecting-web-crypto": import("@oxlint/plugins").Rule;
+    "no-mixed-test-globals": import("@oxlint/plugins").Rule;
+};

package/dist/conventions/contracts.js

@@ -0,0 +1,105 @@
+import { Array, Option } from "effect";
+import { operation } from "../native-reference.js";
+import { propertyName } from "../syntax.js";
+import { contains, memberName, plainStringSchema, report, rule } from "./shared.js";
+const identityNames = [
+    "canonicalPath",
+    "contentPath",
+    "cursor",
+    "id",
+    "mimeType",
+    "operation",
+    "slug",
+    "uri",
+    "uriTemplate",
+    "url",
+];
+const ancestor = (node, accepts) => node.parent !== null && (accepts(node.parent) || ancestor(node.parent, accepts));
+export const contractRules = {
+    "branded-identifier-schema": rule("Use the owning branded or literal Schema for identifier fields.", (context) => ({
+        Property(node) {
+            if (Option.exists(propertyName(node.key), (name) => Array.contains(identityNames, name)) &&
+                plainStringSchema(context, node.value))
+                report(context, node.value);
+        },
+    })),
+    "no-raw-semantic-identifier": rule("Use the owning branded identifier type instead of string.", (context) => ({
+        TSPropertySignature(node) {
+            if (Option.exists(propertyName(node.key), (name) => Array.contains(["id", "identifier", "slug"], name.toLowerCase())) &&
+                node.typeAnnotation?.typeAnnotation.type === "TSStringKeyword")
+                report(context, node);
+        },
+    })),
+    "no-generic-client-escape": rule("Expose named semantic operations instead of a generic client callback.", (context) => {
+        const check = (node) => {
+            if (Option.exists(propertyName(node.key), (name) => Array.contains(["use", "useClient", "withClient"], name)))
+                report(context, node);
+        };
+        return { TSPropertySignature: check, TSMethodSignature: check };
+    }),
+    "no-unknown-service-contract": rule("Service inputs and Effect error channels use Schema-derived types and closed tagged failures.", (context) => ({
+        TSUnknownKeyword(node) {
+            const parent = node.parent;
+            if ((parent.type === "TSTypeAnnotation" &&
+                ancestor(parent, (value) => value.type === "TSFunctionType" || value.type === "TSMethodSignature")) ||
+                (parent.type === "TSTypeParameterInstantiation" &&
+                    Array.get(parent.params, 1).pipe(Option.exists((value) => value === node)) &&
+                    parent.parent.type === "TSTypeReference" &&
+                    parent.parent.typeName.type === "TSQualifiedName" &&
+                    Option.contains(propertyName(parent.parent.typeName.right), "Effect")))
+                report(context, node);
+        },
+    })),
+    "no-unknown-tagged-error-payload": rule("Tagged errors expose safe checked fields rather than Schema.Unknown.", (context) => ({
+        Property(node) {
+            if (operation(context, node.value, "effect/Schema", "Unknown") &&
+                ancestor(node, (value) => {
+                    const factory = (call) => call.type === "CallExpression" &&
+                        (Option.exists(memberName(context, call.callee, "effect/Schema"), (name) => name === "TaggedError" || name === "TaggedErrorClass") ||
+                            factory(call.callee));
+                    return factory(value);
+                }))
+                report(context, node.value);
+        },
+    })),
+    "no-host-api-in-contract": rule("Keep service, Schema, error and config contracts portable; acquire host APIs in private adapters.", (context) => ({
+        ImportDeclaration(node) {
+            if (/(?:^|\/)(?:services?|schemas?|errors|config)\.ts$/u.test(context.filename) &&
+                /^(?:node:|bun$|playwright$|lighthouse$|chrome-launcher$|alchemy(?:\/|$)|@cloudflare(?:\/|$)|cloudflare$|@octokit(?:\/|$)|@actions(?:\/|$)|@sentry(?:\/|$)|stripe$|resend$|@aws(?:\/|$)|aws-sdk$)/u.test(node.source.value))
+                report(context, node.source);
+        },
+    })),
+    "no-layer-export-in-service": rule("Keep service contracts separate from live and test Layer wiring.", (context) => ({
+        ExportNamedDeclaration(node) {
+            if (!/(?:^|\/)services?\.ts$/u.test(context.filename) ||
+                node.declaration?.type !== "VariableDeclaration")
+                return;
+            Array.forEach(node.declaration.declarations, (declaration) => {
+                if (declaration.id.type === "Identifier" &&
+                    /(?:Live|Mock|Test|TestLive)$/u.test(declaration.id.name))
+                    report(context, declaration.id);
+            });
+        },
+    })),
+    "no-defecting-web-crypto": rule("Map crypto.subtle.digest rejection to a typed error at its adapter boundary.", (context) => ({
+        CallExpression(node) {
+            if (operation(context, node.callee, "effect/Effect", "promise") &&
+                contains(context, node, (value) => value.type === "MemberExpression" &&
+                    Option.contains(propertyName(value.property), "digest") &&
+                    value.object.type === "MemberExpression" &&
+                    Option.contains(propertyName(value.object.property), "subtle")))
+                report(context, node);
+        },
+    })),
+    "no-mixed-test-globals": rule("Alias Effect's it helper when mixing it with native Vitest globals.", (context) => ({
+        Program(node) {
+            const imports = Array.filter(node.body, (statement) => statement.type === "ImportDeclaration");
+            const imported = (source, names) => Array.some(imports, (statement) => statement.type === "ImportDeclaration" &&
+                statement.source.value === source &&
+                Array.some(statement.specifiers, (specifier) => specifier.type === "ImportSpecifier" &&
+                    Option.exists(propertyName(specifier.imported), (name) => Array.contains(names, name) && specifier.local.name === name)));
+            if (imported("@effect/vitest", ["it"]) && imported("vitest", ["it", "describe"]))
+                report(context, node);
+        },
+    })),
+};

package/dist/conventions/lifetimes.d.ts

@@ -0,0 +1,7 @@
+export declare const lifetimeRules: {
+    "scoped-managed-runtime": import("@oxlint/plugins").Rule;
+    "scoped-web-handler": import("@oxlint/plugins").Rule;
+    "no-live-alchemy-lifecycle": import("@oxlint/plugins").Rule;
+    "no-node-runtime": import("@oxlint/plugins").Rule;
+    "effect-script-entry": import("@oxlint/plugins").Rule;
+};

package/dist/conventions/lifetimes.js

@@ -0,0 +1,179 @@
+import { defineRule } from "@oxlint/plugins";
+import { Array, Option, Predicate, Schema } from "effect";
+import { operation, valueOf } from "../native-reference.js";
+import { propertyName } from "../syntax.js";
+import { contains, report, returns, rule, testFile } from "./shared.js";
+const releaseMatches = (context, release, handler) => {
+    if (release.type !== "ArrowFunctionExpression" && release.type !== "FunctionExpression")
+        return false;
+    const parameter = Array.head(release.params);
+    const body = Array.head(returns(release));
+    if (Option.isNone(parameter) || Option.isNone(body))
+        return false;
+    if (!handler)
+        return (parameter.value.type === "Identifier" &&
+            body.value.type === "MemberExpression" &&
+            body.value.object.type === "Identifier" &&
+            body.value.object.name === parameter.value.name &&
+            Option.contains(propertyName(body.value.property), "disposeEffect"));
+    if (parameter.value.type !== "ObjectPattern" ||
+        body.value.type !== "CallExpression" ||
+        !operation(context, body.value.callee, "effect/Effect", "promise"))
+        return false;
+    const callback = Array.head(body.value.arguments);
+    return callback.pipe(Option.exists((argument) => argument.type === "Identifier" &&
+        parameter.value.type === "ObjectPattern" &&
+        Array.some(parameter.value.properties, (property) => property.type === "Property" &&
+            Option.contains(propertyName(property.key), "dispose") &&
+            property.value.type === "Identifier" &&
+            property.value.name === argument.name)));
+};
+const acquired = (context, node, handler) => {
+    const search = (parent) => {
+        if (parent === null)
+            return false;
+        if (parent.type === "CallExpression" &&
+            operation(context, parent.callee, "effect/Effect", "acquireRelease")) {
+            const acquire = Array.get(parent.arguments, 0).pipe(Option.flatMap((value) => valueOf(context, value)));
+            const release = Array.get(parent.arguments, 1).pipe(Option.flatMap((value) => valueOf(context, value)));
+            return (acquire.pipe(Option.exists((value) => value.type === "CallExpression" &&
+                operation(context, value.callee, "effect/Effect", "sync") &&
+                Array.head(value.arguments).pipe(Option.exists((callback) => Array.contains(returns(callback), node))))) && release.pipe(Option.exists((value) => releaseMatches(context, value, handler))));
+        }
+        return search(parent.parent);
+    };
+    return search(node.parent);
+};
+const HostLifetimes = Schema.Struct({
+    hostLifetimes: Schema.optionalKey(Schema.Array(Schema.Struct({ file: Schema.NonEmptyString, declaration: Schema.NonEmptyString }))),
+});
+const scopedManagedRuntime = defineRule({
+    meta: {
+        type: "problem",
+        schema: [
+            {
+                type: "object",
+                properties: {
+                    hostLifetimes: {
+                        type: "array",
+                        items: {
+                            type: "object",
+                            properties: {
+                                file: { type: "string", minLength: 1 },
+                                declaration: { type: "string", minLength: 1 },
+                            },
+                            required: ["file", "declaration"],
+                            additionalProperties: false,
+                        },
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+        messages: {
+            policy: "Acquire ManagedRuntime with its own disposer, or declare the exact top-level runtime whose lifetime the host owns.",
+        },
+    },
+    create(context) {
+        const options = Array.head(context.options).pipe(Option.flatMap(Schema.decodeUnknownOption(HostLifetimes)), Option.getOrElse(() => ({ hostLifetimes: [] })));
+        return {
+            CallExpression(node) {
+                if (!operation(context, node.callee, "effect/ManagedRuntime", "make"))
+                    return;
+                const declaration = node.parent;
+                const hosted = declaration.type === "VariableDeclarator" &&
+                    declaration.init === node &&
+                    declaration.id.type === "Identifier" &&
+                    declaration.parent.type === "VariableDeclaration" &&
+                    declaration.parent.kind === "const" &&
+                    (declaration.parent.parent.type === "Program" ||
+                        (declaration.parent.parent.type === "ExportNamedDeclaration" &&
+                            declaration.parent.parent.parent.type === "Program")) &&
+                    Array.some(options.hostLifetimes ?? [], (owner) => declaration.id.type === "Identifier" &&
+                        owner.declaration === declaration.id.name &&
+                        context.filename.replaceAll("\\", "/") ===
+                            `${context.cwd.replaceAll("\\", "/")}/${owner.file}`);
+                if (!hosted && !acquired(context, node, false))
+                    report(context, node);
+            },
+        };
+    },
+});
+export const lifetimeRules = {
+    "scoped-managed-runtime": scopedManagedRuntime,
+    "scoped-web-handler": rule("Acquire the web handler with Effect.acquireRelease and register its own dispose callback through Effect.promise.", (context) => ({
+        CallExpression(node) {
+            if ((operation(context, node.callee, "effect/http/HttpRouter", "toWebHandler") ||
+                operation(context, node.callee, "effect/unstable/http/HttpRouter", "toWebHandler")) &&
+                !acquired(context, node, true))
+                report(context, node);
+        },
+    })),
+    "no-live-alchemy-lifecycle": rule("Use the native Alchemy CLI for live lifecycle operations; Plan.make/apply and Test/Core are test-only.", (context) => testFile(context.filename)
+        ? {}
+        : {
+            ImportDeclaration(node) {
+                if (node.source.value === "alchemy/Test/Core")
+                    report(context, node);
+            },
+            CallExpression(node) {
+                if (operation(context, node.callee, "alchemy", "apply") ||
+                    operation(context, node.callee, "alchemy/Plan", "make"))
+                    report(context, node);
+            },
+        }),
+    "no-node-runtime": rule("Use the application's configured Bun runtime owner rather than NodeRuntime.", (context) => ({
+        ImportDeclaration(node) {
+            if (/^(?:@effect|effect)\/platform-node(?:\/NodeRuntime)?$/u.test(node.source.value) &&
+                (node.source.value.endsWith("/NodeRuntime") ||
+                    Array.some(node.specifiers, (specifier) => specifier.type === "ImportSpecifier" &&
+                        Option.contains(propertyName(specifier.imported), "NodeRuntime"))))
+                report(context, node);
+        },
+        CallExpression(node) {
+            if (operation(context, node.callee, "effect/platform-node/NodeRuntime", "runMain"))
+                report(context, node);
+        },
+    })),
+    "effect-script-entry": rule("Repository scripts use TypeScript and the native Bun Effect runtime; Effect tests own test execution.", (context) => ({
+        Literal(node) {
+            if (/(?:^|\/)scripts\//u.test(context.filename) &&
+                Predicate.isString(node.value) &&
+                /(?:^|\s)node\s+(?:--test\b|scripts\/)/u.test(node.value))
+                report(context, node);
+        },
+        Program(node) {
+            if (!/(?:^|\/)scripts\//u.test(context.filename))
+                return;
+            if (context.filename.endsWith(".mjs")) {
+                report(context, node);
+                return;
+            }
+            if (!context.filename.endsWith(".ts"))
+                return;
+            const imports = Array.filter(node.body, (statement) => statement.type === "ImportDeclaration");
+            const effect = Array.some(imports, (statement) => statement.type === "ImportDeclaration" &&
+                /^effect(?:\/|$)/u.test(statement.source.value));
+            const test = Array.some(imports, (statement) => statement.type === "ImportDeclaration" &&
+                (statement.source.value === "@effect/vitest" || statement.source.value === "bun:test"));
+            const runtime = Array.some(imports, (statement) => statement.type === "ImportDeclaration" &&
+                statement.source.value === "@effect/platform-bun/BunRuntime");
+            const launches = contains(context, node, (value) => value.type === "CallExpression" &&
+                operation(context, value.callee, "@effect/platform-bun/BunRuntime", "runMain"));
+            if (!effect || (testFile(context.filename) ? !test : !runtime || !launches))
+                report(context, node);
+        },
+        ImportDeclaration(node) {
+            if (/(?:^|\/)scripts\//u.test(context.filename) &&
+                node.source.value === "node:child_process")
+                report(context, node);
+        },
+        MemberExpression(node) {
+            if (/(?:^|\/)scripts\//u.test(context.filename) &&
+                node.object.type === "Identifier" &&
+                node.object.name === "process" &&
+                Option.contains(propertyName(node.property), "execPath"))
+                report(context, node);
+        },
+    })),
+};

package/dist/conventions/ownership.d.ts

@@ -0,0 +1,2 @@
+export declare const browserRuntimeOwnership: import("@oxlint/plugins").Rule;
+export declare const nativeHttpClientOwnership: import("@oxlint/plugins").Rule;