@critiq/rules 0.3.0 → 0.4.0

package/rules/typescript/ts.correctness.duplicate-export.rule.yaml

@@ -0,0 +1,37 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.correctness.duplicate-export
+  title: Avoid duplicate named exports
+  summary: Module should not export the same name more than once.
+  rationale: Duplicate exports are confusing and may cause unexpected behavior. The last duplicate wins at runtime, but the redundancy makes the module contract unclear and can hide real export conflicts.
+  aliases:
+    - JS-E1004
+  tags:
+    - correctness
+    - language
+    - rules-catalog
+    - public-directory-parity
+  stability: experimental
+  appliesTo: file
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: language.duplicate-export
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.95
+    tags:
+      - correctness
+      - language
+  message:
+    title: Remove duplicate export
+    summary: "`${captures.issue.text}` is exported more than once."
+  remediation:
+    summary: Remove the duplicate export declaration, keeping only one definition of the name.

package/rules/typescript/ts.correctness.duplicate-function-parameter.rule.yaml

@@ -4,6 +4,8 @@ metadata:
   id: ts.correctness.duplicate-function-parameter
   title: Duplicate function parameter names
   summary: A function declares the same parameter name more than once.
+  aliases:
+    - JS-0006
   rationale: Duplicate parameters are confusing and usually indicate a copy-paste or merge mistake.
   tags:
     - correctness

package/rules/typescript/ts.correctness.duplicate-if-else-condition.rule.yaml

@@ -5,6 +5,8 @@ metadata:
   title: Duplicate if-else-if condition
   summary: Do not repeat the same test in an if-else-if chain.
   rationale: Duplicate conditions create unreachable branches and usually indicate a copy-paste defect.
+  aliases:
+    - JS-0034
   tags:
     - correctness
     - language

package/rules/typescript/ts.correctness.duplicate-import-source.rule.yaml

@@ -4,6 +4,8 @@ metadata:
   id: ts.correctness.duplicate-import-source
   title: Duplicate imports from the same module
   summary: The file imports from the same module path more than once.
+  aliases:
+    - JS-0232
   rationale: Multiple import declarations for one module increase bundle noise and can diverge over time.
   tags:
     - correctness

package/rules/typescript/ts.correctness.duplicate-object-key.rule.yaml

@@ -4,6 +4,8 @@ metadata:
   id: ts.correctness.duplicate-object-key
   title: Duplicate keys in object literal
   summary: An object literal repeats the same static property name.
+  aliases:
+    - JS-0007
   rationale: Later entries silently override earlier ones, hiding bugs during refactors.
   tags:
     - correctness

package/rules/typescript/ts.correctness.duplicate-switch-case.rule.yaml

@@ -4,6 +4,8 @@ metadata:
   id: ts.correctness.duplicate-switch-case
   title: Duplicate switch case labels
   summary: A switch repeats the same case discriminant.
+  aliases:
+    - JS-0008
   rationale: Unreachable duplicate cases usually mean a merge error or incomplete refactor.
   tags:
     - correctness

package/rules/typescript/ts.correctness.empty-block-statement.rule.yaml

@@ -5,6 +5,8 @@ metadata:
   title: Empty block statement
   summary: A control-flow or try/catch branch uses an empty `{}` block.
   rationale: Empty blocks hide missing logic, swallowed errors, or incomplete refactors and often mask bugs.
+  aliases:
+    - JS-0009
   tags:
     - correctness
     - language

package/rules/typescript/ts.correctness.empty-destructuring-pattern.rule.yaml

@@ -0,0 +1,37 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.correctness.empty-destructuring-pattern
+  title: Empty destructuring pattern
+  summary: Detects empty destructuring pattern issues in JavaScript and TypeScript source.
+  rationale: Empty destructuring pattern patterns are a common source of bugs and confusing runtime behavior.
+  aliases:
+    - JS-0058
+  tags:
+    - correctness
+    - language
+    - rules-catalog
+    - public-directory-parity
+  stability: stable
+  appliesTo: file
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: language.empty-destructuring-pattern
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: medium
+    confidence: 0.85
+    tags:
+      - correctness
+      - language
+  message:
+    title: Fix empty destructuring pattern
+    summary: "`${captures.issue.text}` matches ts.correctness.empty-destructuring-pattern."
+  remediation:
+    summary: Refactor the code to remove the empty destructuring pattern pattern.

package/rules/typescript/ts.correctness.extraneous-import.rule.yaml

@@ -0,0 +1,38 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.correctness.extraneous-import
+  title: Extraneous import
+  summary: Detected import declarations which import extraneous modules.
+  rationale: Importing modules whose bindings are never used makes the module graph larger and can confuse readers about actual dependencies.
+  aliases:
+    - JS-0257
+  tags:
+    - correctness
+    - modules
+    - rules-catalog
+    - crq-cor-050
+    - public-directory-parity
+  stability: stable
+  appliesTo: file
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: language.extraneous-import
+    bind: issue
+emit:
+  finding:
+    category: correctness.modules
+    severity: medium
+    confidence: 0.85
+    tags:
+      - correctness
+      - modules
+  message:
+    title: Remove unused import
+    summary: "`${captures.issue.text}` imports bindings that are never used."
+  remediation:
+    summary: Remove the unused import declaration or use the imported bindings in the file.

package/rules/typescript/ts.correctness.flawed-string-comparison.rule.yaml

@@ -0,0 +1,38 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.correctness.flawed-string-comparison
+  title: Flawed string comparison
+  summary: String comparison using identical operands or locale-sensitive operators may indicate a bug.
+  rationale: Comparing two identical string literals always yields the same result and suggests a copy-paste error. Relational operators on strings produce locale-sensitive results and may behave unexpectedly.
+  aliases:
+    - JS-W1040
+  tags:
+    - correctness
+    - language
+    - string
+    - rules-catalog
+    - public-directory-parity
+  stability: stable
+  appliesTo: file
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: language.flawed-string-comparison
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.85
+    tags:
+      - correctness
+      - language
+  message:
+    title: Flawed string comparison
+    summary: "`${captures.issue.text}` is a string comparison that may indicate a bug."
+  remediation:
+    summary: Review the comparison operands. Use `.localeCompare()` for locale-aware string ordering, and verify identical string literal comparisons are intentional.

package/rules/typescript/ts.correctness.global-object-called-as-function.rule.yaml

@@ -0,0 +1,38 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.correctness.global-object-called-as-function
+  title: Global object invoked as a function
+  summary: A built-in namespace object such as `Math` or `JSON` is called like a function.
+  rationale: Global namespace objects are not constructors or callables; calling them throws or returns unexpected results.
+  aliases:
+    - JS-0020
+  tags:
+    - correctness
+    - language
+    - rules-catalog
+    - crq-cor-043
+    - public-directory-parity
+  stability: stable
+  appliesTo: file
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: language.global-object-called-as-function
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: medium
+    confidence: 0.95
+    tags:
+      - correctness
+      - language
+  message:
+    title: Do not call global namespace objects
+    summary: "`${captures.issue.text}` invokes a global namespace object as a function."
+  remediation:
+    summary: Call the intended static method on the namespace object instead of invoking the object itself.

package/rules/typescript/ts.correctness.identical-comparison-operands.rule.yaml

@@ -4,6 +4,8 @@ metadata:
   id: ts.correctness.identical-comparison-operands
   title: Identical comparison operands
   summary: Both sides of a comparison use the same source text.
+  aliases:
+    - JS-0089
   rationale: Comparing an expression to itself is either always true or always false and usually indicates a copy-paste defect.
   tags:
     - correctness

package/rules/typescript/ts.correctness.implicit-undefined-return.rule.yaml

@@ -5,6 +5,8 @@ metadata:
   title: Implicit undefined return in function
   summary: Functions that return a value on some paths must not fall through implicitly.
   rationale: Mixed value-return and implicit-fallthrough paths are a common source of undefined behavior.
+  aliases:
+    - JS-0030
   tags:
     - correctness
     - control-flow

package/rules/typescript/ts.correctness.infinite-loop.rule.yaml

@@ -2,9 +2,11 @@ apiVersion: critiq.dev/v1alpha1
 kind: Rule
 metadata:
   id: ts.correctness.infinite-loop
-  title: Infinite Loop
-  summary: Detect obvious infinite loops
-  rationale: Detect obvious infinite loops:while (true) and for(;;) without break, return, or throw in the loop body.
+  title: Loop has no exit condition — add a break, return, or exit condition
+  summary: Detect obvious infinite loops that have no exit path via break, return, throw, or yield.
+  rationale: Loops with no exit condition (while(true), for(;;), do{}while(true)) without a break, return, throw, or yield in the body will run forever, freezing the event loop or exhausting resources. Even loops with a yield are considered potentially unbounded in non-generator contexts.
+  aliases:
+    - JS-0092
   tags:
     - correctness
     - rules-catalog
@@ -14,6 +16,13 @@ scope:
   languages:
     - typescript
     - javascript
+  paths:
+    exclude:
+      - "**/tests/fixtures/code-path-analysis/**"
+      - "**/types/**/*-tests.*"
+      - "**/types/**/*-tests.ts"
+      - "**/types/**/*-tests.tsx"
+      - "**/tests/fixtures/**"
 match:
   fact:
     kind: async.infinite-loop
@@ -21,12 +30,12 @@ match:
 emit:
   finding:
     category: correctness
-    severity: high
+    severity: medium
     confidence: 0.85
     tags:
       - correctness
   message:
-    title: Infinite Loop
-    summary: "`${captures.issue.text}` matches ts.correctness.infinite-loop."
+    title: Loop has no exit condition
+    summary: "`${captures.issue.text}` has no exit condition — the loop will run forever unless the body contains a break, return, throw, or yield statement."
   remediation:
-    summary: Detect obvious infinite loops:while (true) and for(;;) without break, return, or throw in the loop body.
+    summary: Add an exit condition — break, return, throw, or yield — to the loop body so it does not run forever.

package/rules/typescript/ts.correctness.invalid-async-await-call.rule.yaml

@@ -0,0 +1,37 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.correctness.invalid-async-await-call
+  title: Await or for-await outside async function
+  summary: The `await` keyword and `for await...of` are only valid inside an `async` function.
+  rationale: Using await outside an async function causes a syntax error at runtime or parse time, making the program invalid.
+  aliases:
+    - JS-0294
+  tags:
+    - correctness
+    - language
+    - rules-catalog
+    - public-directory-parity
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: language.invalid-async-await
+    bind: issue
+emit:
+  finding:
+    category: correctness.control-flow
+    severity: high
+    confidence: 0.95
+    tags:
+      - correctness
+      - language
+  message:
+    title: Move await inside async function
+    summary: "`${captures.issue.text}` is only valid inside an async function."
+  remediation:
+    summary: Wrap the enclosing function with the `async` keyword, or move the await expression into an async context. Top-level await is supported in ESM modules.

package/rules/typescript/ts.correctness.invalid-shebang.rule.yaml

@@ -0,0 +1,37 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.correctness.invalid-shebang
+  title: Invalid shebang placement
+  summary: Shebang `#!` must appear on line 1 at column 0.
+  rationale: Shebangs on later lines or indented positions are ignored by the OS loader and indicate a misplaced or malformed hashbang.
+  aliases:
+    - JS-0271
+  tags:
+    - correctness
+    - language
+    - rules-catalog
+    - public-directory-parity
+  stability: stable
+  appliesTo: file
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: language.invalid-shebang
+    bind: issue
+emit:
+  finding:
+    category: correctness.control-flow
+    severity: medium
+    confidence: 0.95
+    tags:
+      - correctness
+      - language
+  message:
+    title: Move shebang to line 1 column 0
+    summary: "`${captures.issue.text}` is not at the required position — shebang must be the very first characters of the file."
+  remediation:
+    summary: Place `#!` on line 1 at column 0. Remove any leading whitespace or preceding statements.

package/rules/typescript/ts.correctness.invalid-typeof-comparison.rule.yaml

@@ -5,6 +5,8 @@ metadata:
   title: Invalid typeof comparison string
   summary: Compare typeof results only to known typeof strings.
   rationale: typeof returns a fixed set of strings; other comparisons are always false.
+  aliases:
+    - JS-0028
   tags:
     - correctness
     - language

package/rules/typescript/ts.correctness.invalid-variable-usage.rule.yaml

@@ -0,0 +1,37 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.correctness.invalid-variable-usage
+  title: Invalid variable usage
+  summary: Detects invalid variable usage issues in JavaScript and TypeScript source.
+  rationale: Invalid variable usage patterns are a common source of bugs and confusing runtime behavior.
+  aliases:
+    - JS-0043
+  tags:
+    - correctness
+    - language
+    - rules-catalog
+    - public-directory-parity
+  stability: stable
+  appliesTo: file
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: language.invalid-variable-usage
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.85
+    tags:
+      - correctness
+      - language
+  message:
+    title: Fix invalid variable usage
+    summary: "`${captures.issue.text}` matches ts.correctness.invalid-variable-usage."
+  remediation:
+    summary: Refactor the code to remove the invalid variable usage pattern.

package/rules/typescript/ts.correctness.missing-async-on-promise-method.rule.yaml

@@ -5,6 +5,8 @@ metadata:
   title: Missing Async On Promise Method
   summary: Mark promise callbacks async when using await
   rationale: Mark promise callbacks async when using await:then/catch handlers that use await must be declared async.
+  aliases:
+    - JS-0373
   tags:
     - correctness
     - rules-catalog

package/rules/typescript/ts.correctness.missing-super-call.rule.yaml

@@ -5,6 +5,8 @@ metadata:
   title: Missing super() in subclass constructor
   summary: Subclass constructors must call super() before using this.
   rationale: Derived classes must initialize the base class; omitting super() is a runtime error when this is accessed.
+  aliases:
+    - JS-0226
   tags:
     - correctness
     - language

package/rules/typescript/ts.correctness.missing-timeout-on-external-call.rule.yaml

@@ -2,9 +2,16 @@ apiVersion: critiq.dev/v1alpha1
 kind: Rule
 metadata:
   id: ts.correctness.missing-timeout-on-external-call
-  title: Missing timeout on external call
-  summary: External HTTP calls should declare timeout or cancellation behavior.
-  rationale: Network calls without explicit timeouts can hang indefinitely and make retry or fallback behavior unreliable.
+  title: Missing timeout or retry on external call
+  summary: External calls should declare timeout, cancellation, or retry behavior.
+  rationale: Network calls without explicit timeouts can hang indefinitely and make retry or fallback behavior unreliable. Adding retry protection further improves resilience against transient failures.
+  references:
+    - kind: cwe
+      id: CWE-16
+      title: Configuration
+    - kind: owasp
+      title: Secure Configuration Cheat Sheet
+      url: https://cheatsheetseries.owasp.org/cheatsheets/Secure_Configuration_Cheat_Sheet.html
   tags:
     - correctness
     - resilience
@@ -29,7 +36,7 @@ emit:
       - correctness
       - resilience
   message:
-    title: Configure timeouts on external calls
-    summary: "`${captures.issue.text}` performs an external call without explicit timeout or cancellation settings."
+    title: Configure timeouts and retry protection on external calls
+    summary: "`${captures.issue.text}` performs an external call without explicit timeout, cancellation, or retry settings."
   remediation:
-    summary: Add a timeout-bearing config object, such as `signal` for `fetch` or `timeout` for axios.
+    summary: Add a timeout-bearing config object (e.g., `signal` for `fetch` or `timeout` for axios) and consider wrapping with a retry library (e.g., `p-retry` or `retry`) to handle transient failures.

package/rules/typescript/ts.correctness.missing-type-annotation.rule.yaml

@@ -0,0 +1,37 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.correctness.missing-type-annotation
+  title: Missing type annotation
+  summary: Add explicit type annotations where TypeScript cannot infer the type.
+  rationale: Explicit type annotations improve readability and catch type errors at declaration sites.
+  aliases:
+    - JS-0386
+  tags:
+    - correctness
+    - language
+    - rules-catalog
+    - public-directory-parity
+  stability: experimental
+  appliesTo: block
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: typescript.missing-type-annotation
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: medium
+    confidence: 0.70
+    tags:
+      - correctness
+      - language
+  message:
+    title: Add explicit type annotation
+    summary: "`${captures.issue.text}` is missing an explicit type annotation."
+  remediation:
+    summary: Add an explicit type annotation to improve clarity and enable better type checking.

package/rules/typescript/ts.correctness.namespace-import-unexported-name.rule.yaml

@@ -0,0 +1,37 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.correctness.namespace-import-unexported-name
+  title: Avoid accessing unexported names through namespace imports
+  summary: Namespace import member access should reference names exported by the target module.
+  rationale: Accessing a name through a namespace import (import * as ns) that is not exported by the target module indicates a typo, a missing export, or a refactoring oversight. The expression will resolve to undefined at runtime without a compile error.
+  aliases:
+    - JS-E1007
+  tags:
+    - correctness
+    - language
+    - rules-catalog
+    - public-directory-parity
+  stability: experimental
+  appliesTo: file
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: language.namespace-import-unexported-name
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.8
+    tags:
+      - correctness
+      - language
+  message:
+    title: Namespace import references unexported name
+    summary: "`${captures.issue.text}` accesses a name not exported by the imported module."
+  remediation:
+    summary: Verify the spelling of the accessed name and ensure the target module exports it.

package/rules/typescript/ts.correctness.negative-zero-comparison.rule.yaml

@@ -0,0 +1,37 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.correctness.negative-zero-comparison
+  title: Comparison with negative zero
+  summary: Detects comparison with negative zero issues in JavaScript and TypeScript source.
+  rationale: Comparison with negative zero patterns are a common source of bugs and confusing runtime behavior.
+  aliases:
+    - JS-0033
+  tags:
+    - correctness
+    - language
+    - rules-catalog
+    - public-directory-parity
+  stability: stable
+  appliesTo: file
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: language.negative-zero-comparison
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: medium
+    confidence: 0.85
+    tags:
+      - correctness
+      - language
+  message:
+    title: Fix comparison with negative zero
+    summary: "`${captures.issue.text}` matches ts.correctness.negative-zero-comparison."
+  remediation:
+    summary: Refactor the code to remove the comparison with negative zero pattern.

package/rules/typescript/ts.correctness.new-expression-with-require.rule.yaml

@@ -0,0 +1,39 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ts.correctness.new-expression-with-require
+  title: Avoid `new` operator on `require()` calls
+  summary: Do not use `new` with the result of `require()`. The `require()` return value is not a constructor and this pattern is almost always a bug.
+  rationale: Using `new` on the return value of `require()` indicates confusion about module exports. Most modules export an object or function, not a constructor, making this pattern bug-prone.
+  detection:
+    kind: pattern
+  aliases:
+    - JS-0261
+  tags:
+    - correctness
+    - modules
+    - rules-catalog
+    - public-directory-parity
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - typescript
+    - javascript
+match:
+  fact:
+    kind: language.new-expression-with-require
+    bind: issue
+emit:
+  finding:
+    category: correctness.modules
+    severity: high
+    confidence: 0.95
+    tags:
+      - correctness
+      - modules
+  message:
+    title: Avoid `new` operator on `require()` calls
+    summary: "${captures.issue.text} applies `new` to a `require()` call. The return value of `require()` is typically not a constructor."
+  remediation:
+    summary: Call the required module directly, or assign the result of `require()` to a variable first if the module exports a constructor.