@commonplaces/oxlint-plugin 0.3.1 → 0.5.0

package/README.md

@@ -1,19 +1,22 @@
 # @commonplaces/oxlint-plugin
 
-61 custom Oxlint rules for strict Effect TypeScript, Alchemy and general code
-checks. This package supports **Oxlint 1.80.0, 1.85.0 or 1.86.0** and **Node 22.14 or newer**.
+106 custom Oxlint rules for strict Effect TypeScript, Alchemy and general code
+checks. This package supports **Oxlint 1.86.0 or 1.89.0** and **Node 22.14 or newer**.
 Oxlint's JavaScript plugin API is experimental, so upgrade it only after running
-the rule tests. The development tools use 1.80.0; consuming projects may use any supported version.
-All three exact versions are checked with independently installed archives. ESLint is not a supported host.
+the rule tests. The development tools use 1.89.0; consuming projects may use any supported version.
+Both exact versions are checked with independently installed archives. ESLint is not a supported host.
 
 ## Install
 
-Install the latest npm release and save its exact version:
+Install version 0.5.0 and save its exact version:
 
 ```sh
-npm install --save-dev --save-exact @commonplaces/oxlint-plugin@latest oxlint@1.80.0
+npm install --save-dev --save-exact @commonplaces/oxlint-plugin@0.5.0 oxlint@1.89.0
 ```
 
+Version 0.5.0 adds the optional style preset and the host requirements above.
+Published 0.4.0 keeps its earlier host list. Consumer adoption is a separate step.
+
 The manifest and lockfile retain the resolved version. Historical GitHub release
 archives remain separate distribution artefacts; a GitHub release does not publish
 an npm version.
@@ -35,7 +38,18 @@ checks native Alchemy settings and secret sources. Each group turns its checks
 on as errors. They do not depend on one another. Override individual rules in
 your own `rules` or `overrides` settings.
 
-The root export contains these three configurations. Individual plugins use
+The root also exports `conventions`, `web` and `typescript`. `conventions` enables
+strict Effect coding conventions; `web` adds React/TanStack, MDX and typography
+checks; `typescript` enables native type-aware safety checks and correctness
+errors. Run the latter with `oxlint --type-aware --deny-warnings .`. These groups
+contain no application paths. Codec and runtime permissions remain explicit
+project facts.
+
+`strict` composes all six groups for applications that use the complete stack:
+`defineConfig({ extends: [strict, projectPolicy] })`. It adds no project paths
+or source ignores. Keep exact ownership settings in the consuming project.
+
+The root exports these six groups, the optional `style` preset and the `strict` composition. Individual plugins use
 the subpaths below. For example, a JSON configuration can enable one rule:
 
 ```json
@@ -45,10 +59,97 @@ the subpaths below. For example, a JSON configuration can enable one rule:
 }
 ```
 
+## Optional style preset
+
+Add `style` before `strict`, then keep the project's own policy last:
+
+```ts
+import { style, strict } from "@commonplaces/oxlint-plugin";
+import { defineConfig } from "oxlint";
+import project from "./tools/oxlint/project.config.ts";
+
+export default defineConfig({ extends: [style, strict, project] });
+```
+
+Run `oxlint --type-aware --deny-warnings .`. `style` also works alone and is
+available as the default export of `@commonplaces/oxlint-plugin/style`.
+It never imports or extends `strict`; `strict` still contains only its original
+six groups. Adding this release without selecting `style` leaves strict checks
+unchanged. This preset includes more than formatting preferences: Ultracite
+also supplies accessibility, test and correctness checks, browser globals,
+shared ignores and test-file overrides. Its ignores can reduce which files are
+checked; keep the project's own file policy explicit.
+
+Ultracite **8.0.1** is an exact regular dependency, selected at the owner's
+request to use the latest releases. It requires no separate consumer install. A peer would
+make consumers choose and install a second package, and could make imports of
+the root package fail when it is missing. The dependency also installs
+Ultracite's CLI dependencies; only the three Oxlint configuration modules run
+when importing this preset. No Ultracite CLI, formatter or Effect runtime runs.
+
+### Shared overrides
+
+These eleven rules are off in both historical root configurations: Common
+Practice at `3b6beef^` and Site at `dda3820`. File-specific permissions and
+size limits remain in each consumer's project policy.
+
+| Rule set to `off`                     | Reason                                                                                                                           |
+| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
+| `unicorn/no-array-for-each`           | Allow Effect's immutable `Array.forEach`; strict collection checks cover native mutation.                                        |
+| `unicorn/no-array-sort`               | Allow Effect's immutable `Array.sort`; strict collection checks cover native mutation.                                           |
+| `unicorn/throw-new-error`             | Allow the `Schema.TaggedError` factory; `strict-effect/error-constructor-new` checks error construction when strict is selected. |
+| `no-redeclare`                        | Allow TypeScript overloads and merged declarations.                                                                              |
+| `react/function-component-definition` | Allow the project's existing component declaration forms.                                                                        |
+| `sort-keys`                           | Keep related object fields in meaningful order.                                                                                  |
+| `func-names`                          | Allow unnamed library callbacks and Effect generators.                                                                           |
+| `func-style`                          | Allow function declarations and functions stored in constants.                                                                   |
+| `no-use-before-define`                | Allow declarations to refer to later declarations.                                                                               |
+| `no-inline-comments`                  | Allow short explanations beside the code they describe.                                                                          |
+| `typescript/consistent-return`        | Leave return types and Effect generator branches to TypeScript.                                                                  |
+
+### Supported-host adjustments
+
+The imported configurations need two small adjustments; these are separate
+from the eleven shared overrides above:
+
+- React's explicit disables for `jsx-a11y/no-autofocus` and
+  `react/forward-ref-uses-ref` are omitted. This lets the host's correctness
+  settings apply: selecting `strict` keeps both at error level. Merely putting
+  `strict` last would not overcome an explicit upstream disable when strict
+  enables a rule through its correctness category.
+- Vitest's file override disabling `vitest/valid-title` is also omitted, so
+  strict's correctness setting still applies inside test files.
+
+The tests install the packed archive on both supported hosts and compare
+every resolved strict rule, including its options, with `[style, strict]`.
+They also check inherited file overrides. These adjustments import no strict
+settings and leave every other upstream setting intact.
+
+### Ultracite 8.0.1 comparison
+
+The installed npm archives were compared, including rule options and file
+patterns, rather than relying on release notes. For the three selected presets:
+
+| Preset | Rules in 7.12.0 | Rules in 8.0.1 | Change                                                        |
+| ------ | --------------: | -------------: | ------------------------------------------------------------- |
+| Core   |             536 |            537 | Adds `typescript/no-generated-empty-object-type` as an error. |
+| React  |             124 |            124 | `react/jsx-no-target-blank` adds `{ forms: true }`.           |
+| Vitest |              74 |             75 | Adds `vitest/consistent-test-it` as an error.                 |
+
+Counts include entries explicitly set to off and entries in file overrides.
+No rule is removed and no other rule severity or option changes. Core's shared
+test overrides and Vitest's test rules also start matching `.mts`, `.cts`,
+`.mjs` and `.cjs` files. Shared ignores, globals and plugin lists are unchanged.
+Both versions contain `no-unmodified-loop-condition` with
+`checkConditionalExpressions: true`; the supported hosts accept that option.
+Ultracite 8 requires Oxlint 1.86 or newer, so 1.80 and 1.85 are no longer
+supported. Its Oxfmt peer requires at least 0.71; repository tooling uses 0.74.0.
+The archive is checked on exactly 1.86.0 and the current 1.89.0.
+
 ## Project settings
 
-Rules that refer to project files, services, schemas or routes are available
-but excluded from the groups. Configure them explicitly, for example:
+Rules that refer to project files, schemas or routes are available but excluded
+from the groups. Configure them explicitly, for example:
 
 ```ts
 import { defineConfig } from "oxlint";
@@ -86,8 +187,35 @@ export default defineConfig({
 ```
 
 Use repository-relative paths with `/` separators. Runtime execution is denied
-everywhere unless `allowedFiles` grants an entry file. The service tracing rule
-requires `serviceNames` and checks names such as `Effect.fn("Orders.create")`.
+everywhere unless `allowedFiles` grants an entry file. Service tracing is enabled
+by `effect` without a service-name inventory. It checks native local
+`Context.Service` constructors and imported capitalised service `.of` calls,
+plus supplied operations in native `Layer.mock` replacements,
+preserving canonical names through named imports, namespace imports and immutable
+aliases. Shadowed names cannot borrow import identity. Every explicit operation
+requires its exact `Effect.fn("Orders.create")` or `Effect.withSpan` name.
+Legacy `serviceNames` selection remains available for existing consumers.
+An empty selector is rejected.
+
+Local contract types identify checked data and Stream members; native Stream
+expressions also retain their role in imported mixed contracts. Opaque members
+fail closed rather than gaining a name-based exemption. Instrumentation must
+wrap the operation or its returned Effect; an unrelated nested span is
+insufficient. The rule examines syntax, not a cross-file TypeScript type graph;
+an imported capitalised non-service `.of` API may require a distinct API shape.
+Empty partial mocks contain no supplied operation to instrument. The rule does
+not infer contracts for arbitrary Layer factories or raw `Layer.succeed` data
+objects; retain typed composition and review those boundaries.
+
+For a canonical operation adapter that preserves an overloaded service API,
+`operationAdapters` can name its public `module`, exact source `file`, `exports`
+and canonical `operation`. The adapter owns the returned operation's span.
+Prove that guarantee directly against the real adapter, with an uninstrumented
+callback and observed current span. Only that operation and those imported
+exports gain this role; shadowed functions, neighbouring modules and other
+service operations still require their own spans. This is an explicit contract
+owner where cross-file type analysis is unavailable, not a general wrapper
+permission.
 Invalid settings stop linting. Each rule's exported `meta.schema` describes its
 accepted options; no marketplace plugin is needed to read or run them.
 
@@ -98,15 +226,42 @@ package subpaths; keep your existing rule settings.
 
 ## Rule exports
 
-| Package subpath     | Rule prefix         | Rules |
-| ------------------- | ------------------- | ----: |
-| `/strict-effect`    | `strict-effect/`    |    29 |
-| `/effect`           | `effect/`           |     9 |
-| `/alchemy`          | `alchemy-secrets/`  |     3 |
-| `/bun`              | `bun/`              |     1 |
-| `/package`          | `package/`          |     3 |
-| `/anti-slop`        | `anti-slop/`        |    15 |
-| `/anti-slop-effect` | `anti-slop-effect/` |     1 |
+| Package subpath     | Rule prefix           | Rules |
+| ------------------- | --------------------- | ----: |
+| `/strict-effect`    | `strict-effect/`      |    29 |
+| `/effect`           | `effect/`             |     9 |
+| `/alchemy`          | `alchemy-secrets/`    |     3 |
+| `/bun`              | `bun/`                |     1 |
+| `/package`          | `package/`            |     3 |
+| `/anti-slop`        | `anti-slop/`          |    15 |
+| `/anti-slop-effect` | `anti-slop-effect/`   |     1 |
+| `/conventions`      | `effect-conventions/` |    33 |
+| `/web`              | `web/`                |    12 |
+
+### Explicit codec and runtime roles
+
+The three optional codec-placement checks in `/conventions` follow real Schema
+imports, named aliases, destructured exports and immutable aliases, respecting
+local shadowing. Add them through positive scopes that exclude exact ingress,
+egress or synchronous consumer owners. A filename ending in `.ingress.ts` or
+`.egress.ts` grants no permission on its own. `Schema.decodeTo` and `encodeTo`
+declarations remain transformations rather than codec execution.
+
+`effect-conventions/scoped-managed-runtime` requires acquisition and the
+matching runtime disposer through `Effect.acquireRelease`. For a host that owns
+an isolate/process lifetime and offers no termination callback, `hostLifetimes`
+may identify its exact top-level `const` by repository-relative `file` and
+`declaration`. Another declaration, nested construction or neighbouring file
+still fails. This role does not permit additional runtime execution files.
+Use the separate runtime execution owner rule as well.
+
+`browser-runtime-ownership` takes `runtimeOwners` and `registryOwners`.
+`native-http-client-ownership` takes `browserOwners` and `serverOwners`.
+`bounded-build-memo` takes exact `targets` with `file` and `declaration`.
+These are optional rules in `/conventions`; malformed allowances fail closed.
+The memo check requires immutable bounded includes and `lockfile: true`, and
+rejects excluded dependencies, opaque or overwritten settings and broad parent
+recursion outside `src`. There are no application path defaults.
 
 ## Development
 
@@ -179,7 +334,7 @@ integration checks and `bun run test` for the archive installation
 and public contract checks.
 
 Oxlint owns synchronous rule callbacks and reporting. Pure checks use immutable
-Effect collections. The two synchronous option decoders in `effect.ts` are
+Effect collections. The synchronous option decoders in `effect.ts` and `service-instrumentation.ts` are
 required by Oxlint's `create` callback and throw only for invalid configuration.
 The `syntax.ts` child adapter selects nodes from Oxlint's already parsed tree
 using its visitor keys; it is not a decoder for external JSON. Traversal cycle

package/dist/conventions/bounded-build-memo.d.ts

@@ -0,0 +1 @@
+export declare const boundedBuildMemo: import("@oxlint/plugins").Rule;

package/dist/conventions/bounded-build-memo.js

@@ -0,0 +1,147 @@
+import { defineRule } from "@oxlint/plugins";
+import * as Array from "effect/Array";
+import * as Function from "effect/Function";
+import * as Option from "effect/Option";
+import * as Predicate from "effect/Predicate";
+import * as Schema from "effect/Schema";
+import { constant as constantDeclaration } from "../native-reference.js";
+import { variableInScope as scopedVariable } from "../syntax.js";
+import { propertyName } from "../syntax.js";
+const FilePath = Schema.NonEmptyString.check(Schema.isPattern(/^(?!\/)(?!.*(?:\*|\\|(?:^|\/)\.\.?\/)).+\.tsx?$/u));
+const Identifier = Schema.NonEmptyString.check(Schema.isPattern(/^[A-Za-z_$][\w$]*$/u));
+const Options = Schema.Struct({
+    targets: Schema.NonEmptyArray(Schema.Struct({ file: FilePath, declaration: Identifier })),
+});
+// Only immutable local syntax is inspectable. Imported values and cyclic aliases
+// cannot silently replace the checked memo with an opaque value.
+const localValue = (context, node, visited = []) => {
+    if (Array.some((previous) => previous === node)(visited)) {
+        return Option.none();
+    }
+    const next = [...visited, node];
+    if (node.type === "TSSatisfiesExpression" || node.type === "TSAsExpression") {
+        return localValue(context, node.expression, next);
+    }
+    if (node.type !== "Identifier") {
+        return Option.some(node);
+    }
+    const scope = context.sourceCode.getScope(node);
+    return scopedVariable(scope, node.name).pipe(Option.flatMap(constantDeclaration), Option.flatMap((declaration) => Option.fromNullishOr(declaration.init)), Option.flatMap((initialiser) => localValue(context, initialiser, next)));
+};
+const field = (object, name) => Array.findFirst((property) => property.type === "Property" &&
+    !property.computed &&
+    Option.contains(propertyName(property.key), name))(object.properties).pipe(Option.filter((property) => property.type === "Property"), Option.map((property) => property.value));
+const boundedPattern = (pattern) => {
+    if (pattern.length === 0 ||
+        /^(?:\/|!)/u.test(pattern) ||
+        /[\\{}[\]]/u.test(pattern) ||
+        /(?:^|\/)(?:node_modules|\.git|dist)(?:\/|$)/u.test(pattern)) {
+        return false;
+    }
+    if (!pattern.startsWith("../")) {
+        return !pattern.includes("/../");
+    }
+    const external = pattern.replace(/^(?:\.\.\/)+/u, "");
+    const segments = external.split("/");
+    if (Array.contains("..")(segments)) {
+        return false;
+    }
+    const recursive = Array.findFirstIndex((segment) => segment.includes("**"))(segments);
+    return Option.match(recursive, {
+        onNone: () => /\.[A-Za-z0-9]+$/u.test(external),
+        onSome: (index) => Function.pipe(segments, Array.take(index), Array.contains("src")),
+    });
+};
+const safeMemo = (context, expression) => localValue(context, expression).pipe(Option.exists((memo) => {
+    if (memo.type !== "ObjectExpression" ||
+        Array.some((property) => property.type !== "Property" || property.computed || property.kind !== "init")(memo.properties)) {
+        return false;
+    }
+    const names = Function.pipe(memo.properties, Array.map((property) => {
+        if (property.type === "Property") {
+            return propertyName(property.key);
+        }
+        return Option.none();
+    }), Array.getSomes);
+    if (Array.dedupe(names).length !== names.length || Array.contains("exclude")(names)) {
+        return false;
+    }
+    const locked = field(memo, "lockfile").pipe(Option.flatMap((value) => localValue(context, value)), Option.exists((value) => value.type === "Literal" && value.value === true));
+    const included = field(memo, "include").pipe(Option.flatMap((value) => localValue(context, value)), Option.exists((value) => value.type === "ArrayExpression" &&
+        value.elements.length > 0 &&
+        Array.every((element) => Option.fromNullishOr(element).pipe(Option.flatMap((item) => localValue(context, item)), Option.exists((item) => item.type === "Literal" &&
+            Predicate.isString(item.value) &&
+            boundedPattern(item.value))))(value.elements)));
+    return locked && included;
+}));
+export const boundedBuildMemo = defineRule({
+    meta: {
+        type: "problem",
+        schema: [
+            {
+                type: "object",
+                properties: {
+                    targets: {
+                        type: "array",
+                        minItems: 1,
+                        items: {
+                            type: "object",
+                            properties: { file: { type: "string" }, declaration: { type: "string" } },
+                            required: ["file", "declaration"],
+                            additionalProperties: false,
+                        },
+                    },
+                },
+                required: ["targets"],
+                additionalProperties: false,
+            },
+        ],
+        messages: {
+            options: "Configure exact build-props files and declaration names.",
+            memo: "Keep an inspectable memo with bounded source/file globs, lockfile: true and no exclude override. Parent-directory recursive globs must stay inside src; dependency and build-output trees are forbidden.",
+        },
+    },
+    create(context) {
+        const options = Array.head(context.options).pipe(Option.flatMap(Schema.decodeUnknownOption(Options)));
+        return {
+            Program(program) {
+                Option.match(options, {
+                    onNone: () => {
+                        context.report({ node: program, messageId: "options" });
+                    },
+                    onSome: ({ targets }) => {
+                        Function.pipe(targets, Array.forEach((target) => {
+                            if (context.filename.replaceAll("\\", "/") !== `${context.cwd}/${target.file}`) {
+                                return;
+                            }
+                            const declaration = Function.pipe(program.body, Array.flatMap((statement) => {
+                                if (statement.type === "VariableDeclaration" && statement.kind === "const") {
+                                    return statement.declarations;
+                                }
+                                if (statement.type === "ExportNamedDeclaration" &&
+                                    statement.declaration?.type === "VariableDeclaration" &&
+                                    statement.declaration.kind === "const") {
+                                    return statement.declaration.declarations;
+                                }
+                                return [];
+                            }), Array.findFirst((value) => value.id.type === "Identifier" && value.id.name === target.declaration));
+                            const valid = declaration.pipe(Option.flatMap((value) => Option.fromNullishOr(value.init)), Option.flatMap((value) => localValue(context, value)), Option.exists((value) => value.type === "ObjectExpression" &&
+                                // Hosting spreads before memo are safe; later spreads or computed keys could override it.
+                                Array.findFirstIndex((property) => property.type === "Property" &&
+                                    Option.contains(propertyName(property.key), "memo"))(value.properties).pipe(Option.exists((index) => Function.pipe(value.properties, Array.drop(index), Array.every((property) => property.type === "Property" && !property.computed)) &&
+                                    Array.filter((property) => property.type === "Property" &&
+                                        Option.contains(propertyName(property.key), "memo"))(value.properties).length === 1)) &&
+                                field(value, "memo").pipe(Option.exists((memo) => safeMemo(context, memo)))));
+                            if (!valid) {
+                                context.report({
+                                    node: Option.getOrElse(declaration, () => program),
+                                    messageId: "memo",
+                                });
+                            }
+                        }));
+                    },
+                });
+            },
+        };
+    },
+});

package/dist/conventions/codecs.d.ts

@@ -0,0 +1,6 @@
+export declare const codecRules: {
+    "no-schema-decoder-outside-ingress": import("@oxlint/plugins").Rule;
+    "no-schema-encoder-outside-egress": import("@oxlint/plugins").Rule;
+    "no-sync-decoder-outside-consumer": import("@oxlint/plugins").Rule;
+    "no-throwing-schema-codec": import("@oxlint/plugins").Rule;
+};

package/dist/conventions/codecs.js

@@ -0,0 +1,31 @@
+import { Option } from "effect";
+import { memberName, report, rule } from "./shared.js";
+const decoder = /^decode(?:Unknown)?(?:Effect|Promise|Sync|Option|Result|Exit|Either|Unknown)?$/u;
+const encoder = /^encode(?:Unknown)?(?:Effect|Promise|Sync|Option|Result|Exit|Either|Unknown)?$/u;
+const synchronous = /(?:Option|Result|Exit|Either)$/u;
+export const codecRules = {
+    "no-schema-decoder-outside-ingress": rule("Decode raw input once at an explicitly configured ingress owner.", (context) => ({
+        CallExpression(node) {
+            if (memberName(context, node.callee, "effect/Schema").pipe(Option.exists((name) => decoder.test(name))))
+                report(context, node);
+        },
+    })),
+    "no-schema-encoder-outside-egress": rule("Encode checked values only at an explicitly configured outward boundary.", (context) => ({
+        CallExpression(node) {
+            if (memberName(context, node.callee, "effect/Schema").pipe(Option.exists((name) => encoder.test(name))))
+                report(context, node);
+        },
+    })),
+    "no-sync-decoder-outside-consumer": rule("Non-throwing synchronous decoding belongs to an explicit synchronous host consumer.", (context) => ({
+        CallExpression(node) {
+            if (memberName(context, node.callee, "effect/Schema").pipe(Option.exists((name) => decoder.test(name) && synchronous.test(name))))
+                report(context, node);
+        },
+    })),
+    "no-throwing-schema-codec": rule("Use Effect codecs and typed errors instead of throwing synchronous Schema codecs.", (context) => ({
+        CallExpression(node) {
+            if (memberName(context, node.callee, "effect/Schema").pipe(Option.exists((name) => name.endsWith("Sync") && !synchronous.test(name))))
+                report(context, node);
+        },
+    })),
+};

package/dist/conventions/contracts.d.ts

@@ -0,0 +1,11 @@
+export declare const contractRules: {
+    "branded-identifier-schema": import("@oxlint/plugins").Rule;
+    "no-raw-semantic-identifier": import("@oxlint/plugins").Rule;
+    "no-generic-client-escape": import("@oxlint/plugins").Rule;
+    "no-unknown-service-contract": import("@oxlint/plugins").Rule;
+    "no-unknown-tagged-error-payload": import("@oxlint/plugins").Rule;
+    "no-host-api-in-contract": import("@oxlint/plugins").Rule;
+    "no-layer-export-in-service": import("@oxlint/plugins").Rule;
+    "no-defecting-web-crypto": import("@oxlint/plugins").Rule;
+    "no-mixed-test-globals": import("@oxlint/plugins").Rule;
+};

package/dist/conventions/contracts.js

@@ -0,0 +1,105 @@
+import { Array, Option } from "effect";
+import { operation } from "../native-reference.js";
+import { propertyName } from "../syntax.js";
+import { contains, memberName, plainStringSchema, report, rule } from "./shared.js";
+const identityNames = [
+    "canonicalPath",
+    "contentPath",
+    "cursor",
+    "id",
+    "mimeType",
+    "operation",
+    "slug",
+    "uri",
+    "uriTemplate",
+    "url",
+];
+const ancestor = (node, accepts) => node.parent !== null && (accepts(node.parent) || ancestor(node.parent, accepts));
+export const contractRules = {
+    "branded-identifier-schema": rule("Use the owning branded or literal Schema for identifier fields.", (context) => ({
+        Property(node) {
+            if (Option.exists(propertyName(node.key), (name) => Array.contains(identityNames, name)) &&
+                plainStringSchema(context, node.value))
+                report(context, node.value);
+        },
+    })),
+    "no-raw-semantic-identifier": rule("Use the owning branded identifier type instead of string.", (context) => ({
+        TSPropertySignature(node) {
+            if (Option.exists(propertyName(node.key), (name) => Array.contains(["id", "identifier", "slug"], name.toLowerCase())) &&
+                node.typeAnnotation?.typeAnnotation.type === "TSStringKeyword")
+                report(context, node);
+        },
+    })),
+    "no-generic-client-escape": rule("Expose named semantic operations instead of a generic client callback.", (context) => {
+        const check = (node) => {
+            if (Option.exists(propertyName(node.key), (name) => Array.contains(["use", "useClient", "withClient"], name)))
+                report(context, node);
+        };
+        return { TSPropertySignature: check, TSMethodSignature: check };
+    }),
+    "no-unknown-service-contract": rule("Service inputs and Effect error channels use Schema-derived types and closed tagged failures.", (context) => ({
+        TSUnknownKeyword(node) {
+            const parent = node.parent;
+            if ((parent.type === "TSTypeAnnotation" &&
+                ancestor(parent, (value) => value.type === "TSFunctionType" || value.type === "TSMethodSignature")) ||
+                (parent.type === "TSTypeParameterInstantiation" &&
+                    Array.get(parent.params, 1).pipe(Option.exists((value) => value === node)) &&
+                    parent.parent.type === "TSTypeReference" &&
+                    parent.parent.typeName.type === "TSQualifiedName" &&
+                    Option.contains(propertyName(parent.parent.typeName.right), "Effect")))
+                report(context, node);
+        },
+    })),
+    "no-unknown-tagged-error-payload": rule("Tagged errors expose safe checked fields rather than Schema.Unknown.", (context) => ({
+        Property(node) {
+            if (operation(context, node.value, "effect/Schema", "Unknown") &&
+                ancestor(node, (value) => {
+                    const factory = (call) => call.type === "CallExpression" &&
+                        (Option.exists(memberName(context, call.callee, "effect/Schema"), (name) => name === "TaggedError" || name === "TaggedErrorClass") ||
+                            factory(call.callee));
+                    return factory(value);
+                }))
+                report(context, node.value);
+        },
+    })),
+    "no-host-api-in-contract": rule("Keep service, Schema, error and config contracts portable; acquire host APIs in private adapters.", (context) => ({
+        ImportDeclaration(node) {
+            if (/(?:^|\/)(?:services?|schemas?|errors|config)\.ts$/u.test(context.filename) &&
+                /^(?:node:|bun$|playwright$|lighthouse$|chrome-launcher$|alchemy(?:\/|$)|@cloudflare(?:\/|$)|cloudflare$|@octokit(?:\/|$)|@actions(?:\/|$)|@sentry(?:\/|$)|stripe$|resend$|@aws(?:\/|$)|aws-sdk$)/u.test(node.source.value))
+                report(context, node.source);
+        },
+    })),
+    "no-layer-export-in-service": rule("Keep service contracts separate from live and test Layer wiring.", (context) => ({
+        ExportNamedDeclaration(node) {
+            if (!/(?:^|\/)services?\.ts$/u.test(context.filename) ||
+                node.declaration?.type !== "VariableDeclaration")
+                return;
+            Array.forEach(node.declaration.declarations, (declaration) => {
+                if (declaration.id.type === "Identifier" &&
+                    /(?:Live|Mock|Test|TestLive)$/u.test(declaration.id.name))
+                    report(context, declaration.id);
+            });
+        },
+    })),
+    "no-defecting-web-crypto": rule("Map crypto.subtle.digest rejection to a typed error at its adapter boundary.", (context) => ({
+        CallExpression(node) {
+            if (operation(context, node.callee, "effect/Effect", "promise") &&
+                contains(context, node, (value) => value.type === "MemberExpression" &&
+                    Option.contains(propertyName(value.property), "digest") &&
+                    value.object.type === "MemberExpression" &&
+                    Option.contains(propertyName(value.object.property), "subtle")))
+                report(context, node);
+        },
+    })),
+    "no-mixed-test-globals": rule("Alias Effect's it helper when mixing it with native Vitest globals.", (context) => ({
+        Program(node) {
+            const imports = Array.filter(node.body, (statement) => statement.type === "ImportDeclaration");
+            const imported = (source, names) => Array.some(imports, (statement) => statement.type === "ImportDeclaration" &&
+                statement.source.value === source &&
+                Array.some(statement.specifiers, (specifier) => specifier.type === "ImportSpecifier" &&
+                    Option.exists(propertyName(specifier.imported), (name) => Array.contains(names, name) && specifier.local.name === name)));
+            if (imported("@effect/vitest", ["it"]) && imported("vitest", ["it", "describe"]))
+                report(context, node);
+        },
+    })),
+};

package/dist/conventions/lifetimes.d.ts

@@ -0,0 +1,7 @@
+export declare const lifetimeRules: {
+    "scoped-managed-runtime": import("@oxlint/plugins").Rule;
+    "scoped-web-handler": import("@oxlint/plugins").Rule;
+    "no-live-alchemy-lifecycle": import("@oxlint/plugins").Rule;
+    "no-node-runtime": import("@oxlint/plugins").Rule;
+    "effect-script-entry": import("@oxlint/plugins").Rule;
+};