@craft-ts/dev-tools 0.7.0-beta.13 → 0.7.0-beta.15

package/src/eslint-rules/index.cjs

@@ -7,6 +7,11 @@ const craftSignalSourceNameMatch = require('./craft-signal-source-name-match.cjs
 const noCraftComputedSideEffects = require('./no-craft-computed-side-effects.cjs');
 const provideHostNameMatchComponent = require('./provide-host-name-match-component.cjs');
 const preferCraftHttpTransport = require('./prefer-craft-http-transport.cjs');
+const noCraftServiceComponentSameFile = require('./no-craft-service-component-same-file.cjs');
+const noRawCssValue = require('./no-raw-css-value.cjs');
+const noRawClass = require('./no-raw-class.cjs');
+const noFreeHas = require('./no-free-has.cjs');
+const styleFileBoundary = require('./style-file-boundary.cjs');
 const preferBrowserBoundaries = require('./prefer-browser-boundaries.cjs');
 const requireComponentMonitoring = require('./require-component-monitoring.cjs');
 const requirePrimitiveGeneratorUnwrap = require('./require-primitive-generator-unwrap.cjs');
@@ -67,15 +72,28 @@ const targetBlankNoopener = require('./target-blank-noopener.cjs');
 const requireFocusVisible = require('./require-focus-visible.cjs');
 const requireReducedMotion = require('./require-reduced-motion.cjs');
 const requireEffectAdapters = require('./require-effect-adapters.cjs');
+const syncEffectBody = require('./sync-effect-body.cjs');
 const serverFunctionClientMatch = require('./server-function-client-match.cjs');
 const noInvalidInsertionPipe = require('./no-invalid-insertion-pipe.cjs');
 const noRedundantPrimitiveInsertion = require('./no-redundant-primitive-insertion.cjs');
 const noEffectOutsideLoaders = require('./no-effect-outside-loaders.cjs');
+const noExplicitEffectType = require('./no-explicit-effect-type.cjs');
+const preferInlineEffectInsertion = require('./prefer-inline-effect-insertion.cjs');
+const preferInlineRouteProviders = require('./prefer-inline-route-providers.cjs');
 const preferQueryMethodOverStateTrigger = require('./prefer-query-method-over-state-trigger.cjs');
 const noInjectionToken = require('./no-injection-token.cjs');
 const noManualRouteProviderList = require('./no-manual-route-provider-list.cjs');
 const noWidenedRouteProviderContext = require('./no-widened-route-provider-context.cjs');
+const requireRouteSecurityPolicy = require('./require-route-security-policy.cjs');
+const requireServerFunctionTimeout = require('./require-server-function-timeout.cjs');
+const noAuthTokenInLocalStorage = require('./no-auth-token-in-local-storage.cjs');
+const noRawUserUrl = require('./no-raw-user-url.cjs');
+const noUnsafeTransferState = require('./no-unsafe-transfer-state.cjs');
+const noUnsafeHtml = require('./no-unsafe-html.cjs');
+const noTrustForwardedHeaders = require('./no-trust-forwarded-headers.cjs');
+const noEffectImportInFrontend = require('./no-effect-import-in-frontend.cjs');
 const recommendedRules = require('./recommended-config.cjs');
+const securityRules = require('./security-config.cjs');
 
 const plugin = {
   rules: {
@@ -88,6 +106,11 @@ const plugin = {
     'no-craft-computed-side-effects': noCraftComputedSideEffects,
     'provide-host-name-match-component': provideHostNameMatchComponent,
     'prefer-craft-http-transport': preferCraftHttpTransport,
+    'no-craft-service-component-same-file': noCraftServiceComponentSameFile,
+    'no-raw-css-value': noRawCssValue,
+    'no-raw-class': noRawClass,
+    'no-free-has': noFreeHas,
+    'style-file-boundary': styleFileBoundary,
     'prefer-browser-boundaries': preferBrowserBoundaries,
     'require-component-monitoring': requireComponentMonitoring,
     'require-primitive-generator-unwrap': requirePrimitiveGeneratorUnwrap,
@@ -151,16 +174,28 @@ const plugin = {
     'require-focus-visible': requireFocusVisible,
     'require-reduced-motion': requireReducedMotion,
     'require-effect-adapters': requireEffectAdapters,
+    'sync-effect-body': syncEffectBody,
     'server-function-client-match': serverFunctionClientMatch,
     'no-invalid-insertion-pipe': noInvalidInsertionPipe,
     'no-redundant-primitive-insertion': noRedundantPrimitiveInsertion,
     'no-effect-outside-loaders': noEffectOutsideLoaders,
+    'no-explicit-effect-type': noExplicitEffectType,
+    'prefer-inline-effect-insertion': preferInlineEffectInsertion,
+    'prefer-inline-route-providers': preferInlineRouteProviders,
     // Backwards-compatible alias; use no-effect-outside-loaders in new configs.
     'no-effect-in-params': noEffectOutsideLoaders,
     'prefer-query-method-over-state-trigger': preferQueryMethodOverStateTrigger,
     'no-injection-token': noInjectionToken,
     'no-manual-route-provider-list': noManualRouteProviderList,
     'no-widened-route-provider-context': noWidenedRouteProviderContext,
+    'require-route-security-policy': requireRouteSecurityPolicy,
+    'require-server-function-timeout': requireServerFunctionTimeout,
+    'no-auth-token-in-local-storage': noAuthTokenInLocalStorage,
+    'no-raw-user-url': noRawUserUrl,
+    'no-unsafe-transfer-state': noUnsafeTransferState,
+    'no-unsafe-html': noUnsafeHtml,
+    'no-trust-forwarded-headers': noTrustForwardedHeaders,
+    'no-effect-import-in-frontend': noEffectImportInFrontend,
   },
 };
 
@@ -190,20 +225,30 @@ const a11yRuleSeverity = {
 plugin.configs = {
   recommended: {
     plugins: { 'craft-ts': plugin },
-    rules: recommendedRules,
+    rules: { ...recommendedRules, ...securityRules },
   },
   effect: {
     plugins: { 'craft-ts': plugin },
     rules: {
       ...recommendedRules,
+      ...securityRules,
       'craft-ts/require-effect-adapters': 'error',
+      'craft-ts/sync-effect-body': 'error',
       'craft-ts/no-effect-outside-loaders': 'error',
+      'craft-ts/no-explicit-effect-type': 'error',
+      'craft-ts/prefer-inline-effect-insertion': 'error',
     },
   },
   a11y: {
     plugins: { 'craft-ts': plugin },
     rules: a11yRuleSeverity,
   },
+  // Conservé pour activer le préréglage seul, sur un projet qui ne prend pas
+  // `recommended` (une lib partagée, un dossier d'outillage).
+  security: {
+    plugins: { 'craft-ts': plugin },
+    rules: securityRules,
+  },
 };
 
 module.exports = plugin;

package/src/eslint-rules/no-auth-token-in-local-storage.cjs

@@ -0,0 +1,17 @@
+const { report } = require('./security-rule-utils.cjs');
+
+module.exports = {
+  meta: { type: 'problem', schema: [], docs: { description: 'Do not persist authentication material in browser storage.' } },
+  create(context) {
+    return { CallExpression(node) {
+      const callee = node.callee;
+      if (callee.type !== 'MemberExpression' || callee.property.type !== 'Identifier' || callee.property.name !== 'setItem') return;
+      const owner = callee.object && callee.object.type === 'Identifier' ? callee.object.name : '';
+      if (!/^(?:localStorage|sessionStorage)$/.test(owner)) return;
+      const key = node.arguments[0];
+      if (key && key.type === 'Literal' && /token|auth|jwt|session|refresh|password/i.test(String(key.value))) {
+        report(context, node, 'Authentication tokens must not be stored in localStorage or sessionStorage.');
+      }
+    } };
+  },
+};

package/src/eslint-rules/no-craft-computed-side-effects.cjs

@@ -22,17 +22,24 @@ const WRITE_METHODS = new Set([
   'update',
 ]);
 
+// `settled(...)` reads an already-resolved async source; `syncEffect(...)` runs
+// an Effect whose `R` carries `SyncOp`, so the type already proved it cannot
+// suspend. Both are reads, not asynchronous work.
+// Module scope on purpose: the visitors below run before any `const` declared
+// inside `create()` past its `return` would be initialised.
+const ALLOWED_COMPUTED_CALLS = new Set(['settled', 'syncEffect']);
+
 module.exports = {
   meta: {
     type: 'problem',
     docs: {
       description:
-        'Disallow writes and asynchronous work inside craftComputed callbacks; only reactive reads and settled(...) are allowed.',
+        'Disallow writes and asynchronous work inside craftComputed callbacks; only reactive reads, settled(...) and syncEffect(...) are allowed.',
     },
     schema: [],
     messages: {
       forbidden:
-        'Craft computed callbacks may only read reactive Craft values or use `settled(...)`; `{{call}}` is not allowed because it can write or perform asynchronous work.',
+        'Craft computed callbacks may only read reactive Craft values or use `settled(...)` / `syncEffect(...)`; `{{call}}` is not allowed because it can write or perform asynchronous work.',
       missingTypeInfo:
         'This rule requires TypeScript type information to identify reactive reads and asynchronous Craft calls.',
     },
@@ -124,10 +131,10 @@ module.exports = {
     }
 
     function isAllowedSettledCall(node) {
+      if (node.callee.type !== 'Identifier') return false;
       return (
-        node.callee.type === 'Identifier' &&
-        (node.callee.name === 'settled' ||
-          importedNames.get(node.callee.name) === 'settled')
+        ALLOWED_COMPUTED_CALLS.has(node.callee.name) ||
+        ALLOWED_COMPUTED_CALLS.has(importedNames.get(node.callee.name))
       );
     }
 

package/src/eslint-rules/no-craft-service-component-same-file.cjs

@@ -0,0 +1,138 @@
+const CORE_MODULE = '@craft-ts/core';
+const COMPONENT_MODULE = '@craft-ts/component';
+
+module.exports = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        'Disallow declaring craftService and craftComponent in the same file so route-level providers do not break lazy loading.',
+    },
+    schema: [],
+    messages: {
+      separateFiles:
+        'Do not declare craftService and craftComponent in the same file. If the service is provided at route level while the component is lazy-loaded, co-location breaks lazy loading; keep them in separate files.',
+    },
+  },
+  create(context) {
+    const sourceCode = context.sourceCode ?? context.getSourceCode();
+    const calls = [];
+
+    return {
+      CallExpression(node) {
+        const kind = getCraftHostKind(node.callee, sourceCode);
+        if (kind) {
+          calls.push({ kind, node });
+        }
+      },
+      'Program:exit'() {
+        const hasService = calls.some(({ kind }) => kind === 'service');
+        const hasComponent = calls.some(({ kind }) => kind === 'component');
+
+        if (!hasService || !hasComponent) {
+          return;
+        }
+
+        for (const { node } of calls) {
+          context.report({
+            node,
+            messageId: 'separateFiles',
+          });
+        }
+      },
+    };
+  },
+};
+
+function getCraftHostKind(callee, sourceCode) {
+  if (callee.type === 'Identifier') {
+    if (
+      resolvesToImportedName(callee, sourceCode, 'craftService', CORE_MODULE)
+    ) {
+      return 'service';
+    }
+
+    if (
+      resolvesToImportedName(
+        callee,
+        sourceCode,
+        'craftComponent',
+        COMPONENT_MODULE,
+      )
+    ) {
+      return 'component';
+    }
+
+    return undefined;
+  }
+
+  if (
+    callee.type !== 'MemberExpression' ||
+    callee.computed ||
+    callee.object.type !== 'Identifier' ||
+    callee.property.type !== 'Identifier'
+  ) {
+    return undefined;
+  }
+
+  if (
+    callee.property.name === 'craftService' &&
+    resolvesToNamespaceImport(callee.object, sourceCode, CORE_MODULE)
+  ) {
+    return 'service';
+  }
+
+  if (
+    callee.property.name === 'craftComponent' &&
+    resolvesToNamespaceImport(callee.object, sourceCode, COMPONENT_MODULE)
+  ) {
+    return 'component';
+  }
+
+  return undefined;
+}
+
+function resolvesToImportedName(identifier, sourceCode, importedName, module) {
+  const variable = findVariable(identifier, sourceCode);
+  return variable?.defs.some(
+    (definition) =>
+      definition.type === 'ImportBinding' &&
+      definition.node?.type === 'ImportSpecifier' &&
+      getImportedName(definition.node) === importedName &&
+      definition.parent?.source?.value === module,
+  );
+}
+
+function resolvesToNamespaceImport(identifier, sourceCode, module) {
+  const variable = findVariable(identifier, sourceCode);
+  return variable?.defs.some(
+    (definition) =>
+      definition.type === 'ImportBinding' &&
+      definition.node?.type === 'ImportNamespaceSpecifier' &&
+      definition.parent?.source?.value === module,
+  );
+}
+
+function findVariable(identifier, sourceCode) {
+  let scope = sourceCode.getScope(identifier);
+
+  while (scope) {
+    const variable = scope.variables.find(
+      (candidate) => candidate.name === identifier.name,
+    );
+    if (variable) {
+      return variable;
+    }
+    scope = scope.upper;
+  }
+
+  return undefined;
+}
+
+function getImportedName(specifier) {
+  if (specifier.imported.type === 'Identifier') {
+    return specifier.imported.name;
+  }
+
+  return specifier.imported.value;
+}

package/src/eslint-rules/no-effect-import-in-frontend.cjs

@@ -0,0 +1,52 @@
+'use strict';
+
+const EFFECT_IMPORT_PREFIXES = [
+  'effect',
+  '@effect/',
+  '@craft-ts/effect',
+  '@craft-ts/i18n-effect',
+];
+
+function isEffectImport(source) {
+  return EFFECT_IMPORT_PREFIXES.some(
+    (prefix) => prefix.endsWith('/')
+      ? source.startsWith(prefix)
+      : source === prefix || source.startsWith(prefix + '/'),
+  );
+}
+
+module.exports = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        'Prevent EffectTS imports from crossing into a plain frontend boundary.',
+    },
+    schema: [],
+    messages: {
+      forbidden:
+        'EffectTS imports are not allowed in the plain frontend. Keep EffectTS in server files or choose the Effect frontend runtime.',
+    },
+  },
+
+  create(context) {
+    const reportIfEffectImport = (node) => {
+      const source = node.source?.value;
+      if (typeof source === 'string' && isEffectImport(source)) {
+        context.report({ node: node.source, messageId: 'forbidden' });
+      }
+    };
+
+    return {
+      ImportDeclaration: reportIfEffectImport,
+      ExportAllDeclaration: reportIfEffectImport,
+      ExportNamedDeclaration: reportIfEffectImport,
+      ImportExpression(node) {
+        const source = node.source;
+        if (source?.type === 'Literal' && typeof source.value === 'string' && isEffectImport(source.value)) {
+          context.report({ node: source, messageId: 'forbidden' });
+        }
+      },
+    };
+  },
+};

package/src/eslint-rules/no-effect-in-params.cjs

@@ -22,7 +22,7 @@ module.exports = {
     schema: [],
     messages: {
       effect:
-        'Effect values and Effect service reads are only allowed in an Effect loader. Keep params, methods, craftComputed(...) and craftEffect(...) synchronous.',
+        'Effect values and Effect service reads are only allowed in an Effect loader. Keep params, methods, craftComputed(...) and craftEffect(...) synchronous, or run a declared-synchronous Effect (SyncOp) through syncEffect(...).',
     },
   },
 
@@ -35,6 +35,11 @@ module.exports = {
     const reportedNodes = new WeakSet();
     const primitiveBindings = new Map();
     const effectBindings = new Set();
+    // `syncEffect(...)` is the one sanctioned way through: its argument is an
+    // Effect whose `R` carries `SyncOp`, so the type already proved someone
+    // declared it synchronous. Reporting it would ban the very API that makes
+    // a business calculation reusable from a computation.
+    const syncEffectBindings = new Set();
 
     return {
       ImportDeclaration(node) {
@@ -61,6 +66,10 @@ module.exports = {
           if (source === EFFECT_RUNTIME_PACKAGE && imported === 'Effect') {
             effectBindings.add(specifier.local.name);
           }
+
+          if (source === EFFECT_PACKAGE && imported === 'syncEffect') {
+            syncEffectBindings.add(specifier.local.name);
+          }
         }
 
         for (const specifier of node.specifiers) {
@@ -213,8 +222,29 @@ module.exports = {
       return tsNode ? checker.getTypeAtLocation(tsNode) : undefined;
     }
 
+    function isInsideSyncEffectCall(node) {
+      // Starts at the node itself: `syncEffect(...)` is exempt, and so is
+      // everything it wraps.
+      for (let current = node; current; current = current.parent) {
+        if (
+          current.type === 'CallExpression' &&
+          current.callee.type === 'Identifier' &&
+          syncEffectBindings.has(current.callee.name)
+        ) {
+          return true;
+        }
+        if (
+          ['FunctionDeclaration', 'Program'].includes(current.type)
+        ) {
+          return false;
+        }
+      }
+      return false;
+    }
+
     function report(node) {
       if (!node || reportedNodes.has(node)) return;
+      if (isInsideSyncEffectCall(node)) return;
       reportedNodes.add(node);
       context.report({ node, messageId: 'effect' });
     }

package/src/eslint-rules/no-explicit-effect-type.cjs

@@ -0,0 +1,137 @@
+'use strict';
+
+const EFFECT_PACKAGE = 'effect';
+
+module.exports = {
+  meta: {
+    type: 'suggestion',
+    docs: {
+      description:
+        'Prefer the type inferred by Effect.gen over an explicit Effect return annotation.',
+    },
+    fixable: 'code',
+    schema: [],
+    messages: {
+      explicit:
+        'Effect.gen infers the complete Effect type. Remove this explicit type annotation.',
+    },
+  },
+
+  create(context) {
+    const effectBindings = new Set();
+
+    return {
+      ImportDeclaration(node) {
+        if (node.source.value !== EFFECT_PACKAGE) return;
+
+        for (const specifier of node.specifiers) {
+          if (specifier.type === 'ImportNamespaceSpecifier') {
+            effectBindings.add(specifier.local.name);
+          } else if (
+            specifier.type === 'ImportSpecifier' &&
+            getIdentifierName(specifier.imported) === 'Effect'
+          ) {
+            effectBindings.add(specifier.local.name);
+          }
+        }
+      },
+
+      VariableDeclarator(node) {
+        if (!node.id.typeAnnotation || !isEffectGenExpression(node.init)) {
+          return;
+        }
+
+        report(node.id.typeAnnotation);
+      },
+
+      FunctionDeclaration(node) {
+        if (node.returnType && hasDirectEffectGenReturn(node.body)) {
+          report(node.returnType);
+        }
+      },
+
+      ArrowFunctionExpression(node) {
+        if (node.returnType && hasEffectGenBody(node.body)) {
+          report(node.returnType);
+        }
+      },
+
+      FunctionExpression(node) {
+        if (node.returnType && hasEffectGenBody(node.body)) {
+          report(node.returnType);
+        }
+      },
+    };
+
+    function report(annotation) {
+      context.report({
+        node: annotation,
+        messageId: 'explicit',
+        fix(fixer) {
+          return fixer.remove(annotation);
+        },
+      });
+    }
+
+    function hasEffectGenBody(body) {
+      if (isEffectGenExpression(body)) return true;
+      return body?.type === 'BlockStatement' && hasDirectEffectGenReturn(body);
+    }
+
+    function hasDirectEffectGenReturn(body) {
+      return Boolean(
+        body?.body?.some(
+          (statement) =>
+            statement.type === 'ReturnStatement' &&
+            isEffectGenExpression(statement.argument),
+        ),
+      );
+    }
+
+    function isEffectGenExpression(node) {
+      let current = unwrap(node);
+      while (current?.type === 'CallExpression') {
+        if (isEffectGenMember(current.callee)) return true;
+
+        if (
+          current.callee.type === 'MemberExpression' &&
+          !current.callee.computed
+        ) {
+          current = unwrap(current.callee.object);
+          continue;
+        }
+
+        return false;
+      }
+      return false;
+    }
+
+    function isEffectGenMember(node) {
+      return (
+        node?.type === 'MemberExpression' &&
+        !node.computed &&
+        node.property.type === 'Identifier' &&
+        node.property.name === 'gen' &&
+        node.object.type === 'Identifier' &&
+        effectBindings.has(node.object.name)
+      );
+    }
+  },
+};
+
+function getIdentifierName(node) {
+  return node.type === 'Identifier' ? node.name : undefined;
+}
+
+function unwrap(node) {
+  let current = node;
+  while (
+    current &&
+    ['TSAsExpression', 'TSSatisfiesExpression', 'TSNonNullExpression'].includes(
+      current.type,
+    )
+  ) {
+    current = current.expression;
+  }
+  return current;
+}

package/src/eslint-rules/no-free-has.cjs

@@ -0,0 +1,47 @@
+const HAS = /:has\(/;
+
+/**
+ * `:has()` in hand-written CSS reaches across a component boundary.
+ *
+ * A component whose appearance depends on markup it does not own has visual
+ * states nobody can enumerate — the matrix would have to know what every caller
+ * puts inside it. `descendant.userInvalid` and its siblings are the closed set
+ * that can be enumerated, and each one carries the driver that reaches it.
+ *
+ * The combinators that stay inside a component — `+`, `~`, `:nth-child` — are
+ * deliberately not restricted: they cannot see past the subtree the component
+ * renders itself.
+ *
+ * This is the net under raw CSS, not the mechanism: the generated property
+ * table has no way to spell a selector at all.
+ */
+module.exports = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        'Disallow free-form :has() in styles; use the descendant.* axis instead.',
+    },
+    schema: [],
+    messages: {
+      freeHas:
+        ':has() here reaches across the component boundary, so what this component looks like depends on markup it does not own — a state the visual matrix cannot enumerate. Use the descendant axis instead: when(descendant.userInvalid, [...]), which is a closed set and carries its own test driver.',
+    },
+  },
+  create(context) {
+    const check = (node, text) => {
+      if (typeof text === 'string' && HAS.test(text)) {
+        context.report({ node, messageId: 'freeHas' });
+      }
+    };
+
+    return {
+      Literal(node) {
+        if (typeof node.value === 'string') check(node, node.value);
+      },
+      TemplateElement(node) {
+        check(node, node.value.cooked ?? node.value.raw);
+      },
+    };
+  },
+};

package/src/eslint-rules/no-heading-level-skip.cjs

@@ -3,12 +3,12 @@
 const { parseHyperscriptCall } = require('./hyperscript-walk.cjs');
 
 const TRANSPARENT = new Set([
-  'ifBlock',
-  'each',
-  'matchBlock',
-  'catchBlock',
-  'pendingBlock',
-  'defer',
+  'ifNode',
+  'forNode',
+  'matchNode',
+  'catchNode',
+  'pendingNode',
+  'deferNode',
   'craftTemplate',
 ]);