@drkmttr/adhere 0.8.0 → 0.9.0

package/README.md

@@ -370,12 +370,33 @@ each rule worded otherwise.
 ### Presets
 
 A preset has the shape of a config without `presets`: `rules`, and optionally
-`model` and `threshold`. `effect` is the one preset: 19 Markdown rules in
-[`presets/effect/`](./presets/effect/), lifted from the
-[effect-solutions](https://github.com/kitlangton/effect-solutions) docs and the
-[effect/platform](https://effect.website/docs/platform/introduction/) docs.
-Name it in the config, or on the command line with `--preset effect`, in which
-case the config file is optional.
+`model` and `threshold`. Name one in the config, or on the command line with
+`--preset`, in which case the config file is optional. There are two:
+
+- `effect`: Markdown rules in [`presets/effect/`](./presets/effect/), lifted
+  from the [effect-solutions](https://github.com/kitlangton/effect-solutions)
+  docs and the
+  [effect/platform](https://effect.website/docs/platform/introduction/) docs.
+- `alchemy`: 43 rules in [`presets/alchemy/`](./presets/alchemy/) for code that
+  deploys with [alchemy](https://alchemy.run), lifted from its docs and blog:
+  where Config and bindings are read, which resources keep their data, how
+  secrets stay out of bundles and logs, authorization on public URLs,
+  migrations, durable workflows, and custom providers.
+
+Each preset divides into topics, its subdirectories, and a topic is a preset
+of its own: `--preset effect/basics` applies only the rules under
+`presets/effect/basics/`, and `alchemy/secrets` only alchemy's secrets rules.
+A topic's rules keep the ids they have in the whole preset, so a topic and its
+preset share cached judgments, and naming both applies each rule once.
+
+A preset rule says "must" only where its source makes a requirement, and
+"should" where the source gives advice. In `effect`, three rules are
+guidelines: network calls carry a timeout and a retry schedule, unless their
+client already applies both; test layers are in memory, outside integration
+tests; and tests provide config through a layer. Config validation accepts
+`Config.mapOrFail` as well as `Config.schema`, and the variants rule does not
+rule out a `switch`. The rule that a command handler only parses input is
+gone: the docs show that pattern but do not ask for it.
 
 The preset leaves out conventions a linter checks exactly. Effect's language
 service, [`@effect/tsgo`](https://github.com/Effect-TS/tsgo) on TypeScript 7,
@@ -405,6 +426,12 @@ options in `tsconfig.json` turn them on:
 globals, which the old platform rule also ruled out, need a lint rule of their
 own, such as `no-restricted-globals`.
 
+`leakingRequirements` sees a requirement in an operation's type, but not a
+service built by a factory function that takes its dependencies as arguments,
+whose types have no requirements to find. The preset's
+`services/dependencies-through-layers` asks for that, and
+`services/operations-have-no-requirements` for the style it goes with.
+
 ### Precedence
 
 Highest first: `--threshold` on the command line, the config file, presets in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drkmttr/adhere",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "private": false,
   "description": "Lints a repository against the rules in .adhere/, judged by Jev.",
   "license": "MIT",
@@ -68,10 +68,10 @@
     }
   },
   "optionalDependencies": {
-    "@drkmttr/adhere-darwin-arm64": "0.8.0",
-    "@drkmttr/adhere-darwin-x64": "0.8.0",
-    "@drkmttr/adhere-linux-arm64": "0.8.0",
-    "@drkmttr/adhere-linux-x64": "0.8.0",
-    "@drkmttr/adhere-win32-x64": "0.8.0"
+    "@drkmttr/adhere-darwin-arm64": "0.9.0",
+    "@drkmttr/adhere-darwin-x64": "0.9.0",
+    "@drkmttr/adhere-linux-arm64": "0.9.0",
+    "@drkmttr/adhere-linux-x64": "0.9.0",
+    "@drkmttr/adhere-win32-x64": "0.9.0"
   }
 }

package/presets/alchemy/apis/match-remote-errors-by-tag.md

@@ -0,0 +1,15 @@
+---
+description: Errors that crossed RPC or a workflow replay must be matched by their tag and data fields, never with instanceof, prototype methods, or object identity, which do not survive serialization, and RPC arguments must be serializable values, never functions or class instances.
+---
+
+```ts must
+const value = yield* stub.get(key).pipe(
+  Effect.catchTag("KeyMissing", (error) => Effect.succeed(`missing: ${error.key}`)),
+);
+```
+
+```ts never
+const value = yield* stub.get(key).pipe(
+  Effect.catchAll((error) => (error instanceof KeyMissing ? Effect.succeed("missing") : Effect.fail(error))),
+);
+```

package/presets/alchemy/apis/schemas-at-trust-boundaries.md

@@ -0,0 +1,18 @@
+---
+description: Input from outside the stack, such as browsers, partners, or public URLs, should be validated with a schema through Effect RPC or HttpApi, while calls between the stack's own runtimes should use schemaless RPC through bindings, and unvalidated payloads should not cross a trust boundary.
+---
+
+```ts should
+const Tasks = HttpApiGroup.make("tasks").add(
+  HttpApiEndpoint.post("create", "/tasks", { payload: Schema.Struct({ title: Schema.String }) }),
+);
+const greeter = yield* Cloudflare.Workers.bindWorker(Greeter); // internal call
+```
+
+```ts should not
+fetch: Effect.gen(function* () {
+  const request = yield* HttpServerRequest.HttpServerRequest;
+  const body = (yield* request.json) as { title: string; ownerId: string }; // public URL, no validation
+  return yield* store.create(body);
+}),
+```

package/presets/alchemy/data/commit-migrations-then-deploy.md

@@ -0,0 +1,15 @@
+---
+description: Migrations must be generated and reviewed ahead of time, committed with the schema, and applied from the committed files; a deploy, deploy hook, or Action must never generate migration SQL, and schema changes must never run from an HTTP route.
+---
+
+```ts must
+// package.json: "db:generate": "drizzle-kit generate" (run locally, then commit ./drizzle)
+const db = yield* Cloudflare.D1.Database("AppDb", { migrations: "./drizzle" });
+```
+
+```ts never
+// package.json: "deploy": "drizzle-kit generate && alchemy deploy"
+fetch: Effect.gen(function* () {
+  if (url.pathname === "/setup") yield* sql`CREATE TABLE users (id text primary key)`;
+}),
+```

package/presets/alchemy/data/hyperdrive-direct-origin.md

@@ -0,0 +1,14 @@
+---
+description: A Hyperdrive connection's origin should be the database's direct endpoint, and clients that connect without Hyperdrive should use the provider's pooled endpoint; Hyperdrive should not point at a provider pooler, which stacks two poolers.
+---
+
+```ts should
+const hyperdrive = yield* Cloudflare.Hyperdrive.Connection("AppHyperdrive", {
+  origin: branch.origin,
+  dev: branch.pooledOrigin,
+});
+```
+
+```ts should not
+const hyperdrive = yield* Cloudflare.Hyperdrive.Connection("AppHyperdrive", { origin: role.pooledOrigin });
+```

package/presets/alchemy/data/migrations-use-direct-url.md

@@ -0,0 +1,11 @@
+---
+description: A migration runner must connect with the database's direct URL, never Hyperdrive's runtime connection string or an Accelerate or pooled URL.
+---
+
+```ts must
+export default defineConfig({ dialect: "postgresql", dbCredentials: { url: process.env.DIRECT_DATABASE_URL! } });
+```
+
+```ts never
+export default defineConfig({ dialect: "postgresql", dbCredentials: { url: process.env.ACCELERATE_URL! } });
+```

package/presets/alchemy/data/never-disable-tls-verification.md

@@ -0,0 +1,16 @@
+---
+description: A database client or migration config must verify the server's TLS certificate, or connect inside the private network, never setting rejectUnauthorized: false or sslmode=no-verify to make a connection work.
+---
+
+```ts must
+const url = new URL(connection.connectionString);
+url.searchParams.set("sslmode", "verify-full");
+const db = yield* Drizzle.Postgres(url.toString());
+```
+
+```ts never
+export default defineConfig({
+  dialect: "postgresql",
+  dbCredentials: { url: process.env.DATABASE_URL!, ssl: { rejectUnauthorized: false } },
+});
+```

package/presets/alchemy/data/parameterized-sql.md

@@ -0,0 +1,13 @@
+---
+description: SQL must pass values as parameters, through tagged-template interpolation, sql.in, sql.insert, or prepare().bind(), never by string concatenation or a template string handed to an unsafe or raw API.
+---
+
+```ts must
+const user = yield* sql`SELECT * FROM users WHERE email = ${email}`;
+const row = yield* Effect.promise(() => d1.prepare("SELECT * FROM users WHERE id = ?").bind(id).first());
+```
+
+```ts never
+const user = yield* sql.unsafe(`SELECT * FROM users WHERE email = '${email}'`);
+const row = yield* Effect.promise(() => d1.prepare("SELECT * FROM users WHERE id = " + id).first());
+```

package/presets/alchemy/data/private-endpoint-at-runtime.md

@@ -0,0 +1,12 @@
+---
+description: Service code should reach its database through the bound private connection, and should not use the public connection URI or TCP proxy, which is meant for laptops and CI.
+---
+
+```ts should
+const conn = yield* Railway.ConnectPostgres(Db);
+const db = yield* Drizzle.Postgres(conn.connectionString);
+```
+
+```ts should not
+const db = yield* Drizzle.Postgres(Db.publicConnectionUri);
+```

package/presets/alchemy/data/single-migration-owner.md

@@ -0,0 +1,13 @@
+---
+description: Each database must have one migration owner: when a resource's migrations prop applies the directory, scripts and CI must never also run drizzle-kit migrate or prisma migrate against the same database.
+---
+
+```ts must
+const branch = yield* Neon.Branch("Main", { project, migrations: "./migrations" });
+// package.json: "deploy": "alchemy deploy"
+```
+
+```ts never
+const branch = yield* Neon.Branch("Main", { project, migrations: "./migrations" });
+// package.json: "deploy": "drizzle-kit migrate && alchemy deploy"
+```

package/presets/alchemy/durable/idempotent-event-handlers.md

@@ -0,0 +1,15 @@
+---
+description: A handler for events delivered at least once, such as Stripe webhooks, scheduled callbacks, or bucket and queue events, must be idempotent, upserting by a stable ID or deduplicating by event ID, never doing blind inserts, increments, or charges.
+---
+
+```ts must
+yield* Stripe.consumeEvents([CustomerSubscriptionUpdated], (event) =>
+  kv.put(`entitlement:${event.data.object.customer}`, JSON.stringify(entitlementOf(event))),
+);
+```
+
+```ts never
+yield* Stripe.consumeEvents([InvoicePaid], (event) =>
+  sql`UPDATE accounts SET credits = credits + 100 WHERE customer = ${event.data.object.customer}`,
+);
+```

package/presets/alchemy/durable/io-inside-steps.md

@@ -0,0 +1,17 @@
+---
+description: In a Workflow or Durable Function, every side effect, such as an HTTP call, binding call, or write, must run inside a task or step, and code outside steps must be deterministic, never doing I/O or reading the clock or randomness, because the body replays.
+---
+
+```ts must
+export default Cloudflare.Workflow("Notify", Effect.fn(function* (input: { roomId: string; message: string }) {
+  const stored = yield* Cloudflare.Workflows.task("store", kv.put(`notify:${input.roomId}`, input.message));
+  yield* Cloudflare.Workflows.sleep("cooldown", "30 seconds");
+  return stored;
+}));
+```
+
+```ts never
+export default Cloudflare.Workflow("Notify", Effect.fn(function* (input: { roomId: string; message: string }) {
+  yield* kv.put(`notify:${input.roomId}:${Date.now()}`, input.message); // repeats on every replay
+}));
+```

package/presets/alchemy/durable/no-self-triggering-bucket-writes.md

@@ -0,0 +1,15 @@
+---
+description: A bucket-event handler that writes back into the bucket it listens to should filter its subscription by prefix or suffix so its own writes do not match, and should not subscribe to every object created in that bucket.
+---
+
+```ts should
+yield* AWS.S3.consumeBucketEvents(bucket, { events: ["s3:ObjectCreated:*"], prefix: "incoming/" }, (stream) =>
+  stream.pipe(Stream.runForEach((event) => putObject({ Key: `processed/${event.key}`, Body: "..." }))),
+);
+```
+
+```ts should not
+yield* AWS.S3.consumeBucketEvents(bucket, { events: ["s3:ObjectCreated:*"] }, (stream) =>
+  stream.pipe(Stream.runForEach((event) => putObject({ Key: `processed/${event.key}`, Body: "..." }))), // triggers itself
+);
+```

package/presets/alchemy/durable/stable-step-names.md

@@ -0,0 +1,11 @@
+---
+description: Workflow task, sleep, and waitForEvent names are replay keys, so they must be stable across replays, never built from the clock, randomness, or other values that change between runs.
+---
+
+```ts must
+yield* Cloudflare.Workflows.task("charge-card", chargeCard(input.orderId));
+```
+
+```ts never
+yield* Cloudflare.Workflows.task(`charge-${Date.now()}`, chargeCard(input.orderId));
+```

package/presets/alchemy/durable/webhook-state-is-truth.md

@@ -0,0 +1,14 @@
+---
+description: Access to paid features must be gated on state recorded from Stripe webhooks in the app's own store, never granted because the user reached a success_url or return_url.
+---
+
+```ts must
+const entitlement = yield* kv.get(`entitlement:${customerId}`);
+if (entitlement === null) return HttpServerResponse.empty({ status: 402 });
+```
+
+```ts never
+if (url.pathname === "/welcome") {
+  yield* kv.put(`entitlement:${customerId}`, "active"); // reached the success URL, not paid
+}
+```

package/presets/alchemy/providers/diff-guards-unresolved-props.md

@@ -0,0 +1,16 @@
+---
+description: A custom provider's diff must check isResolved(news) and return undefined before comparing props that may still be unresolved Outputs, never comparing them directly.
+---
+
+```ts must
+diff: Effect.fn(function* ({ news, olds }) {
+  if (!isResolved(news)) return undefined;
+  if (news.region !== olds.region) return { action: "replace" } as const;
+}),
+```
+
+```ts never
+diff: Effect.fn(function* ({ news, olds }) {
+  if (news.region !== olds.region) return { action: "replace" } as const;
+}),
+```

package/presets/alchemy/providers/idempotent-delete.md

@@ -0,0 +1,14 @@
+---
+description: A custom provider's delete must treat a resource that is already gone as success, catching the not-found error, never failing when it runs again.
+---
+
+```ts must
+delete: ({ output }) =>
+  Effect.tryPromise(() => stripe.products.del(output.productId)).pipe(
+    Effect.catchIf(isNotFound, () => Effect.void),
+  ),
+```
+
+```ts never
+delete: ({ output }) => Effect.promise(() => stripe.products.del(output.productId)),
+```

package/presets/alchemy/providers/lazy-layer-construction.md

@@ -0,0 +1,14 @@
+---
+description: A custom provider, credentials, or state-store Layer must defer resolving credentials and opening connections until an operation runs, never resolving credentials, connecting, or prompting while the Layer is built, because every CLI command builds it.
+---
+
+```ts must
+export const PostgresState = Layer.effect(State, Effect.cached(makePostgresState(props)));
+```
+
+```ts never
+export const PostgresState = Layer.effect(State, Effect.gen(function* () {
+  const sql = postgres(process.env.DATABASE_URL!); // connects on every CLI command
+  return makeState(sql);
+}));
+```

package/presets/alchemy/providers/reconcile-from-observed-state.md

@@ -0,0 +1,20 @@
+---
+description: A custom provider's reconcile must read the resource's live state and converge it in one flow that serves create, update, and adoption, never branching into separate create and update bodies on output === undefined or trusting olds as proof the resource exists.
+---
+
+```ts must
+reconcile: Effect.fn(function* ({ news, output }) {
+  let live = yield* observe(output);
+  if (live === undefined) live = yield* create(news);
+  if (drifted(live, news)) live = yield* update(live.id, news);
+  return toAttributes(live);
+}),
+```
+
+```ts never
+reconcile: Effect.fn(function* ({ news, olds, output }) {
+  if (output === undefined) return yield* create(news);
+  yield* updateTags(output.id, olds.tags, news.tags);
+  return output;
+}),
+```

package/presets/alchemy/resources/anchor-paths-with-import-meta.md

@@ -0,0 +1,14 @@
+---
+description: A path prop such as main or rootDir on a resource declared outside the directory alchemy runs from must be anchored to the declaring file with import.meta, never given as a bare relative string, which resolves from the root instead.
+---
+
+```ts must
+// backend/src/api.ts
+export default Cloudflare.Worker("Api", { main: import.meta.url }, program);
+export const Site = Cloudflare.Website.Vite("Site", { rootDir: path.resolve(import.meta.dirname, "../frontend") });
+```
+
+```ts never
+// backend/src/api.ts
+export default Cloudflare.Worker("Api", { main: "src/api.ts" }, program); // resolves to <root>/src/api.ts
+```

package/presets/alchemy/resources/idempotent-actions-and-seeds.md

@@ -0,0 +1,19 @@
+---
+description: An Action body and a SQL file listed in importFiles must be safe to run again, using IF NOT EXISTS, ON CONFLICT, or upserts, never one-shot inserts or calls that duplicate data or fail when an interrupted deploy retries them.
+---
+
+```ts must
+export const Migrate = Alchemy.Action("Migrate", Effect.fn(function* () {
+  const db = yield* D1Client;
+  yield* db.exec("CREATE TABLE IF NOT EXISTS users (id TEXT PRIMARY KEY, name TEXT)");
+  yield* db.exec("INSERT INTO users (id, name) VALUES ('admin', 'Admin') ON CONFLICT (id) DO NOTHING");
+}));
+```
+
+```ts never
+export const Seed = Alchemy.Action("Seed", Effect.fn(function* () {
+  const db = yield* D1Client;
+  yield* db.exec("CREATE TABLE users (id TEXT, name TEXT)");
+  yield* db.exec("INSERT INTO users VALUES ('admin', 'Admin')"); // a second admin on every retry
+}));
+```

package/presets/alchemy/resources/previews-reference-shared-resources.md

@@ -0,0 +1,15 @@
+---
+description: Preview stages should reference a long-lived database or cluster with ref and create only cheap per-stage pieces such as a branch, and should not provision a whole project or cluster for every preview.
+---
+
+```ts should
+const project = stage.startsWith("pr-")
+  ? yield* Neon.Project.ref("AppDb", { stage: "staging" })
+  : yield* Neon.Project("AppDb", { region: "aws-us-east-1" });
+const branch = yield* Neon.Branch("Branch", { project });
+```
+
+```ts should not
+const project = yield* Neon.Project("AppDb", { region: "aws-us-east-1" }); // a new project per PR
+const branch = yield* Neon.Branch("Branch", { project });
+```

package/presets/alchemy/resources/protect-irreplaceable-data.md

@@ -0,0 +1,12 @@
+---
+description: A bucket or database holding user or business data should be retained with RemovalPolicy.retain(), at least in production, and forceDestroy should be set only on buckets whose contents are disposable; irreplaceable data should not depend on the default destroy policy.
+---
+
+```ts should
+const uploads = yield* Cloudflare.R2.Bucket("Uploads").pipe(RemovalPolicy.retain(stage === "prod"));
+const cache = yield* Cloudflare.R2.Bucket("Cache", { forceDestroy: true });
+```
+
+```ts should not
+const userUploads = yield* Cloudflare.R2.Bucket("UserUploads", { forceDestroy: true });
+```

package/presets/alchemy/resources/remote-state-for-ci.md

@@ -0,0 +1,22 @@
+---
+description: A stack deployed from CI or by more than one machine must use a shared state store such as Cloudflare.state() or AWS.state(), never Alchemy.localState(), which lives on one machine's disk where CI runners cannot see it.
+---
+
+```ts must
+export default Alchemy.Stack("App", { providers: Cloudflare.providers(), state: Cloudflare.state() },
+  Effect.gen(function* () {
+    const api = yield* Api;
+    return { url: api.url };
+  }),
+);
+```
+
+```ts never
+// deployed by .github/workflows/deploy.yml
+export default Alchemy.Stack("App", { providers: Cloudflare.providers(), state: Alchemy.localState() },
+  Effect.gen(function* () {
+    const api = yield* Api;
+    return { url: api.url };
+  }),
+);
+```

package/presets/alchemy/resources/stable-logical-ids.md

@@ -0,0 +1,13 @@
+---
+description: A resource's logical ID, its first argument, must stay the same from one deploy to the next, never built from timestamps, random values, UUIDs, or commit SHAs, because a new logical ID replaces the resource and deletes the old one with its data.
+---
+
+```ts must
+const uploads = yield* Cloudflare.R2.Bucket("Uploads");
+const jobs = yield* AWS.SQS.Queue("Jobs");
+```
+
+```ts never
+const uploads = yield* Cloudflare.R2.Bucket(`Uploads-${Date.now()}`);
+const db = yield* Neon.Project(`Db-${process.env.GITHUB_SHA}`);
+```

package/presets/alchemy/resources/stage-unique-physical-names.md

@@ -0,0 +1,15 @@
+---
+description: In a stack deployed to several stages, a resource whose physical name is global to an account or org should omit name, so alchemy derives one per stage, or derive it from the stage, and should not hardcode a single name every stage shares.
+---
+
+```ts should
+const traces = yield* Axiom.Dataset("Traces", Stack.useSync(({ stage }) => ({
+  name: `${stage}-traces`,
+  kind: "otel:traces:v1" as const,
+})));
+const branch = yield* Neon.Branch("Preview", { project });
+```
+
+```ts should not
+const traces = yield* Axiom.Dataset("Traces", { name: "app-traces", kind: "otel:traces:v1" });
+```

package/presets/alchemy/runtime/bind-tag-not-implementation.md

@@ -0,0 +1,27 @@
+---
+description: When a runtime is split into a Tag class and a make Layer, other runtimes must import and bind only the Tag, and only the Stack provides the Layer; another Worker or Function must never import or provide that implementation Layer.
+---
+
+```ts must
+// src/Admin.ts
+import { Api } from "./Api.ts";
+
+export default Cloudflare.Worker("Admin", { main: import.meta.url },
+  Effect.gen(function* () {
+    const api = yield* Cloudflare.Workers.bindWorker(Api);
+    return { fetch: Effect.gen(function* () { return yield* api.fetch(yield* HttpServerRequest.HttpServerRequest); }) };
+  }),
+);
+```
+
+```ts never
+// src/Admin.ts
+import ApiLive, { Api } from "./Api.ts";
+
+export default Cloudflare.Worker("Admin", { main: import.meta.url },
+  Effect.gen(function* () {
+    const api = yield* Cloudflare.Workers.bindWorker(Api);
+    return { fetch: forwardTo(api) };
+  }).pipe(Effect.provide(ApiLive)), // ships a second copy of Api's runtime
+);
+```

package/presets/alchemy/runtime/deterministic-config-defaults.md

@@ -0,0 +1,13 @@
+---
+description: A Config default or fallback used by a runtime must be deterministic, because it is evaluated at deploy time and at runtime, never computed from the clock, randomness, or per-process values.
+---
+
+```ts must
+const port = yield* Config.Number("PORT").pipe(Config.withDefault(3000));
+const region = yield* Config.String("REGION").pipe(Config.withDefault("us-east-1"));
+```
+
+```ts never
+const instanceId = yield* Config.String("INSTANCE_ID").pipe(Config.withDefault(crypto.randomUUID()));
+const startedAt = yield* Config.String("STARTED_AT").pipe(Config.withDefault(new Date().toISOString()));
+```

package/presets/alchemy/runtime/disposables-in-request-scope.md

@@ -0,0 +1,27 @@
+---
+description: Connections, pools, sockets, and anything else with a finalizer must be acquired inside a handler or method, where the event's scope releases them, never at module scope or in a runtime's construction Effect, whose finalizers may never run.
+---
+
+```ts must
+Effect.gen(function* () {
+  const url = yield* Config.Redacted("DATABASE_URL");
+  return {
+    fetch: Effect.gen(function* () {
+      const pool = yield* Effect.acquireRelease(
+        Effect.sync(() => new Pool({ connectionString: Redacted.value(url), max: 1 })),
+        (pool) => Effect.promise(() => pool.end()),
+      );
+      const { rows } = yield* Effect.promise(() => pool.query("select id from users"));
+      return yield* HttpServerResponse.json(rows);
+    }),
+  };
+});
+```
+
+```ts never
+Effect.gen(function* () {
+  const pool = new Pool({ connectionString: process.env.DATABASE_URL }); // one pool for the isolate
+  yield* Effect.addFinalizer(() => Effect.promise(() => pool.end())); // workerd never runs this
+  return { fetch: handlerUsing(pool) };
+});
+```

package/presets/alchemy/runtime/lambda-no-post-response-work.md

@@ -0,0 +1,19 @@
+---
+description: In a Lambda handler, anything that must not be lost must be written durably, to a queue or a table, inside the handler before it responds, never left to a dangling promise, a forked fiber, or a finalizer, because Lambda freezes the instance after the response.
+---
+
+```ts must
+fetch: Effect.gen(function* () {
+  const event = yield* HttpServerRequest.schemaBodyJson(AuditEvent);
+  yield* sendMessage({ MessageBody: JSON.stringify(event) });
+  return HttpServerResponse.empty({ status: 202 });
+}),
+```
+
+```ts never
+fetch: Effect.gen(function* () {
+  const event = yield* HttpServerRequest.schemaBodyJson(AuditEvent);
+  void fetch(AUDIT_URL, { method: "POST", body: JSON.stringify(event) }); // may never run
+  return HttpServerResponse.empty({ status: 202 });
+}),
+```

package/presets/alchemy/runtime/no-per-request-work-at-construction.md

@@ -0,0 +1,24 @@
+---
+description: A runtime's construction Effect runs at deploy time and again at cold start, so it must only build resources, bindings, layers, and handler groups, never do per-request work such as queries, writes, bound calls, or starting consumers.
+---
+
+```ts must
+Effect.gen(function* () {
+  const table = yield* AWS.DynamoDB.Table("Jobs", { partitionKey: "id", attributes: { id: "S" } });
+  const putItem = yield* AWS.DynamoDB.PutItem(table);
+  return {
+    fetch: Effect.gen(function* () {
+      yield* putItem({ Item: { id: { S: crypto.randomUUID() } } });
+      return HttpServerResponse.empty({ status: 202 });
+    }),
+  };
+});
+```
+
+```ts never
+Effect.gen(function* () {
+  const putItem = yield* AWS.DynamoDB.PutItem(table);
+  yield* putItem({ Item: { id: { S: "seed" } } }); // runs at deploy and on every cold start
+  return { fetch: handler };
+});
+```

package/presets/alchemy/runtime/resolve-config-and-bindings-at-construction.md

@@ -0,0 +1,31 @@
+---
+description: In a Worker, Function, or Service, Config values and binding factories must be yielded in the outer construction Effect and captured for the handlers, never yielded for the first time inside fetch or another request handler, which does not run at deploy time, so nothing gets bound.
+---
+
+```ts must
+export default Cloudflare.Worker("Api", { main: import.meta.url },
+  Effect.gen(function* () {
+    const apiKey = yield* Config.Redacted("API_KEY");
+    const bucket = yield* Cloudflare.R2.ReadBucket(Uploads);
+    return {
+      fetch: Effect.gen(function* () {
+        const object = yield* bucket.get("report.json");
+        return HttpServerResponse.text(Redacted.value(apiKey).slice(0, 4));
+      }),
+    };
+  }),
+);
+```
+
+```ts never
+export default Cloudflare.Worker("Api", { main: import.meta.url },
+  Effect.gen(function* () {
+    return {
+      fetch: Effect.gen(function* () {
+        const apiKey = yield* Config.Redacted("API_KEY"); // never bound: API_KEY is missing at runtime
+        return HttpServerResponse.text("ok");
+      }),
+    };
+  }),
+);
+```

package/presets/alchemy/secrets/let-alchemy-mint-infra-secrets.md

@@ -0,0 +1,13 @@
+---
+description: A token the infrastructure owns, such as a webhook secret or bearer token, should be minted once with alchemy's Random or left for alchemy to provision, and should not be a hardcoded literal or regenerated on every deploy with crypto.randomUUID().
+---
+
+```ts should
+export const WebhookSecret = Random("WebhookSecret");
+const auth = yield* BetterAuth({ basePath: "/api/auth", emailAndPassword: { enabled: true } });
+```
+
+```ts should not
+const webhookSecret = crypto.randomUUID(); // a new secret on every deploy
+const auth = yield* BetterAuth({ basePath: "/api/auth", secret: Redacted.make("dev-secret") });
+```

package/presets/alchemy/secrets/never-logged-returned-or-output.md

@@ -0,0 +1,15 @@
+---
+description: A secret, credential, connection string, token, signed URL, or private key must never be logged, returned in an HTTP response, or returned as a stack output; code must expose only names, presence, or non-secret metadata.
+---
+
+```ts must
+if (url.pathname === "/secret") {
+  return yield* HttpServerResponse.json({ name: "API_TOKEN", set: Redacted.value(token).length > 0 });
+}
+return { serial: certificate.serial, expires: certificate.notAfter }; // stack output
+```
+
+```ts never
+yield* Effect.log(`token=${Redacted.value(token)}`);
+return { databaseUrl: connection.databaseUrl, tlsKey: certificate.privateKey }; // stack output
+```

package/presets/alchemy/secrets/none-in-browser-env.md

@@ -0,0 +1,15 @@
+---
+description: A value in an env key that a framework inlines into the browser bundle, such as VITE_, NEXT_PUBLIC_, PUBLIC_, or NUXT_PUBLIC_, must be public configuration, never a secret, credential, or connection string, even wrapped in Redacted.
+---
+
+```ts must
+const site = yield* Cloudflare.Website.Vite("Site", {
+  env: { VITE_API_URL: api.url, STRIPE_SECRET_KEY: Config.Redacted("STRIPE_SECRET_KEY") },
+});
+```
+
+```ts never
+const site = yield* Cloudflare.Website.Vite("Site", {
+  env: { VITE_STRIPE_SECRET_KEY: Config.Redacted("STRIPE_SECRET_KEY"), VITE_DATABASE_URL: branch.connectionUri },
+});
+```

package/presets/alchemy/secrets/redacted-until-use.md

@@ -0,0 +1,19 @@
+---
+description: A secret should be read with Config.Redacted, passed to resources and env as Redacted, and unwrapped with Redacted.value only at the call that needs the raw string; it should not be read with Config.String or process.env, or unwrapped early into plain variables.
+---
+
+```ts should
+const apiKey = yield* Config.Redacted("OPENAI_API_KEY");
+return {
+  fetch: Effect.gen(function* () {
+    const request = HttpClientRequest.post(url).pipe(HttpClientRequest.bearerToken(Redacted.value(apiKey)));
+    return yield* client.execute(request);
+  }),
+};
+```
+
+```ts should not
+const apiKey = Redacted.value(yield* Config.Redacted("OPENAI_API_KEY"));
+const webhook = process.env.SLACK_WEBHOOK_URL!;
+return { fetch: handler(apiKey, webhook) };
+```

package/presets/alchemy/secrets/unwrap-before-compare-or-send.md

@@ -0,0 +1,17 @@
+---
+description: A Redacted value must be unwrapped with Redacted.value before it is compared, sent, or serialized, never put into a template literal, string concatenation, String(), or JSON, where it becomes the literal text <redacted> and silently fails every check.
+---
+
+```ts must
+const expected = yield* Config.Redacted("AUTH_TOKEN");
+if (request.headers.authorization !== `Bearer ${Redacted.value(expected)}`) {
+  return HttpServerResponse.empty({ status: 401 });
+}
+```
+
+```ts never
+const expected = yield* Config.Redacted("AUTH_TOKEN");
+if (request.headers.authorization !== `Bearer ${expected}`) { // compares against "Bearer <redacted>"
+  return HttpServerResponse.empty({ status: 401 });
+}
+```

package/presets/alchemy/security/authorize-public-endpoints.md

@@ -0,0 +1,20 @@
+---
+description: A handler behind a public URL, such as a Function URL, workers.dev route, or a Durable Object chosen by a client-supplied name, must authenticate the caller and check its access before doing protected work, never treating CORS, an obscure URL, or a trusted origin as authorization.
+---
+
+```ts must
+fetch: Effect.gen(function* () {
+  const request = yield* HttpServerRequest.HttpServerRequest;
+  const user = yield* verifySession(request.headers.authorization);
+  if (user === undefined) return HttpServerResponse.empty({ status: 401 });
+  return yield* counters.fetch(user.tenantId, request);
+}),
+```
+
+```ts never
+fetch: Effect.gen(function* () {
+  const request = yield* HttpServerRequest.HttpServerRequest;
+  const name = /^\/counters\/([^/]+)$/.exec(new URL(request.url).pathname)?.[1] ?? "default";
+  return yield* counters.fetch(name, request); // anyone who knows a name can read it
+}),
+```

package/presets/alchemy/security/github-secret-not-variable.md

@@ -0,0 +1,12 @@
+---
+description: A sensitive CI value, such as a token, key, password, or connection string, must be stored with GitHub.Secret, never with GitHub.Variable, which is plain text and visible in logs.
+---
+
+```ts must
+yield* GitHub.Secret("CloudflareToken", { owner, repository, name: "CLOUDFLARE_API_TOKEN", value: token.value });
+yield* GitHub.Variable("AwsRegion", { owner, repository, name: "AWS_REGION", value: "us-east-1" });
+```
+
+```ts never
+yield* GitHub.Variables({ owner, repository, variables: { CLOUDFLARE_API_TOKEN: token.value } });
+```

package/presets/alchemy/security/identity-from-verified-session.md

@@ -0,0 +1,14 @@
+---
+description: The acting user must come from the session or token verified in that request, never from an ID in the request body, query, or headers, and never from a user cached in a process-wide layer.
+---
+
+```ts must
+const session = yield* auth.getSession();
+if (session === null) return yield* Effect.fail(new Unauthorized());
+const rows = yield* sql`SELECT * FROM uploads WHERE owner_id = ${session.user.id}`;
+```
+
+```ts never
+const { ownerId } = yield* HttpServerRequest.schemaBodyJson(Schema.Struct({ ownerId: Schema.String }));
+const rows = yield* sql`SELECT * FROM uploads WHERE owner_id = ${ownerId}`;
+```

package/presets/alchemy/security/keep-auth-protections-on.md

@@ -0,0 +1,19 @@
+---
+description: Auth configuration must keep state, PKCE, origin and CSRF checks, ID-token verification, and email verification enabled, never disable them or merge accounts by email alone to work around an error or a cross-origin setup.
+---
+
+```ts must
+const auth = yield* BetterAuth({
+  trustedOrigins: [siteOrigin],
+  emailAndPassword: { enabled: true, requireEmailVerification: true },
+  account: { accountLinking: { disableImplicitLinking: true } },
+});
+```
+
+```ts never
+const auth = yield* BetterAuth({
+  trustedOrigins: ["*"],
+  advanced: { disableCSRFCheck: true },
+  account: { accountLinking: { trustedProviders: ["github", "google", "company"] } },
+});
+```

package/presets/alchemy/security/least-privilege-bindings.md

@@ -0,0 +1,13 @@
+---
+description: A runtime should bind the narrowest capability its calls need, a Read or Write binding when it only reads or only writes, and should not bind ReadWrite for one-sided use.
+---
+
+```ts should
+const bucket = yield* Cloudflare.R2.ReadBucket(Uploads);
+return { fetch: Effect.gen(function* () { return yield* bucket.get("report.json"); }) };
+```
+
+```ts should not
+const bucket = yield* Cloudflare.R2.ReadWriteBucket(Uploads); // only get is ever called
+return { fetch: Effect.gen(function* () { return yield* bucket.get("report.json"); }) };
+```

package/presets/alchemy/security/least-privilege-ci-credentials.md

@@ -0,0 +1,24 @@
+---
+description: Credentials a stack mints for CI should be scoped to what the app deploys, using a GitHub OIDC role pinned to the repository on AWS and a trimmed permission list on Cloudflare, and should not grant AdministratorAccess or unused write scopes.
+---
+
+```ts should
+const role = yield* AWS.IAM.Role("GitHubDeploy", {
+  assumeRolePolicyDocument: { Version: "2012-10-17", Statement: [{
+    Effect: "Allow", Principal: { Federated: oidc.openIDConnectProviderArn },
+    Action: ["sts:AssumeRoleWithWebIdentity"],
+    Condition: { StringLike: { "token.actions.githubusercontent.com:sub": "repo:acme/app:*" } },
+  }] },
+  policies: [deployPolicy],
+});
+```
+
+```ts should not
+const role = yield* AWS.IAM.Role("GitHubDeploy", {
+  assumeRolePolicyDocument: { Version: "2012-10-17", Statement: [{
+    Effect: "Allow", Principal: { Federated: oidc.openIDConnectProviderArn },
+    Action: ["sts:AssumeRoleWithWebIdentity"],
+  }] },
+  managedPolicyArns: ["arn:aws:iam::aws:policy/AdministratorAccess"],
+});
+```

package/presets/alchemy/security/lookup-failure-is-not-anonymous.md

@@ -0,0 +1,15 @@
+---
+description: Only a null session may be treated as anonymous; a failed session lookup must stay in the error channel or map to a server error, never be collapsed into signed out.
+---
+
+```ts must
+const session = yield* auth.getSession().pipe(
+  Effect.mapError(() => new AuthenticationUnavailable()),
+);
+if (session === null) return yield* Effect.fail(new Unauthorized());
+```
+
+```ts never
+const session = yield* auth.getSession().pipe(Effect.orElseSucceed(() => null));
+if (session === null) return yield* Effect.fail(new Unauthorized());
+```

package/presets/effect/basics/external-calls-are-resilient.md

@@ -1,8 +1,8 @@
 ---
-description: A call over the network, such as an HTTP request, a database query, or a third-party API, must be made with a timeout and a retry schedule, never bare. Calls through the platform FileSystem and Path services are local and are not in scope.
+description: A call over the network, such as an HTTP request, a database query, or a third-party API, should carry a timeout and a retry schedule, and should not go out bare. A call through a client that already applies both, such as an HttpClient built with a timeout and retryTransient or an SDK with its own retries, has them. Calls through the platform FileSystem and Path services are local and are not in scope.
 ---
 
-```ts must
+```ts should
 const retryPolicy = Schedule.exponential("100 millis").pipe(Schedule.both(Schedule.recurs(3)));
 
 const resilientCall = HttpClient.get("https://api.example.com/users").pipe(
@@ -12,6 +12,6 @@ const resilientCall = HttpClient.get("https://api.example.com/users").pipe(
 );
 ```
 
-```ts never
+```ts should not
 const response = yield* HttpClient.get(`https://api.example.com/users/${id}`);
 ```

package/presets/effect/config/tests-provide-values-directly.md

@@ -1,8 +1,8 @@
 ---
-description: A test must supply config with Layer.succeed on the config service, never by setting environment variables or a ConfigProvider.
+description: A test should supply config with Layer.succeed on the config service, and should not set environment variables or a ConfigProvider to do it.
 ---
 
-```ts must
+```ts should
 Effect.runPromise(
   program.pipe(
     Effect.provide(
@@ -15,7 +15,7 @@ Effect.runPromise(
 );
 ```
 
-```ts never
+```ts should not
 beforeAll(() => {
   process.env.DATABASE_URL = "postgres://localhost/test";
 });

package/presets/effect/config/validate-with-schema.md

@@ -1,5 +1,5 @@
 ---
-description: A config value with constraints must be read with Config.schema, never mapped and checked by hand.
+description: A config value with constraints must be validated as it is read, with Config.schema or Config.mapOrFail, never checked by hand after reading.
 ---
 
 ```ts must
@@ -12,8 +12,19 @@ const Environment = Schema.Literals(["development", "staging", "production"]);
 const program = Effect.gen(function* () {
   const port = yield* Config.schema(Port, "PORT");
   const env = yield* Config.schema(Environment, "ENV");
+  const timeoutMs = yield* Config.int("TIMEOUT_MS").pipe(
+    Config.mapOrFail((ms) =>
+      ms > 0 && ms <= 60_000
+        ? Effect.succeed(ms)
+        : Effect.fail(
+            new Config.ConfigError(
+              new ConfigProvider.SourceError({ message: "TIMEOUT_MS must be 1 to 60000" }),
+            ),
+          ),
+    ),
+  );
 
-  return { port, env };
+  return { port, env, timeoutMs };
 });
 ```
 

package/presets/effect/data/variants-are-tagged-unions.md

@@ -1,5 +1,5 @@
 ---
-description: Structured variants must be Schema.TaggedClass in a Schema.Union, matched with Match.tag and Match.exhaustive, never a plain union checked with a switch.
+description: Structured variants, alternatives that carry fields, must be Schema.TaggedClass members of a Schema.Union, never hand-written object types joined by a tag field. Simple alternatives without fields may be Schema.Literals.
 ---
 
 ```ts must

package/presets/effect/services/dependencies-through-layers.md

@@ -0,0 +1,42 @@
+---
+description: A service that depends on other services must be a Context.Service built by a Layer that yields those services as it is constructed, never a factory function or class that takes services, clients, or their implementations as arguments.
+---
+
+```ts must
+class Users extends Context.Service<
+  Users,
+  {
+    readonly find: (id: UserId) => Effect.Effect<User, UserNotFound>;
+  }
+>()("@app/Users") {}
+
+export const UsersLive = Layer.effect(
+  Users,
+  Effect.gen(function* () {
+    const database = yield* Database;
+    const logger = yield* Logger;
+    return Users.of({
+      find: (id) =>
+        Effect.gen(function* () {
+          yield* logger.log(`finding ${id}`);
+          return yield* database.findUser(id);
+        }),
+    });
+  }),
+);
+```
+
+```ts never
+export const makeUsers = (database: Database["Service"], logger: Logger["Service"]) => ({
+  find: (id: UserId) =>
+    Effect.gen(function* () {
+      yield* logger.log(`finding ${id}`);
+      return yield* database.findUser(id);
+    }),
+});
+
+export const program = Effect.gen(function* () {
+  const users = makeUsers(yield* Database, yield* Logger);
+  return yield* users.find(userId);
+});
+```

package/presets/effect/services/operations-have-no-requirements.md

@@ -0,0 +1,46 @@
+---
+description: A service's operations must have no requirements, typed Effect<A, E, never>, with their dependencies acquired when the service's Layer is built, never left in an operation's requirements type, as in Effect<A, E, Database>.
+---
+
+```ts must
+class Users extends Context.Service<
+  Users,
+  {
+    readonly find: (id: UserId) => Effect.Effect<User, UserNotFound, never>;
+  }
+>()("@app/Users") {}
+
+export const UsersLive = Layer.effect(
+  Users,
+  Effect.gen(function* () {
+    const database = yield* Database;
+    const logger = yield* Logger;
+    return Users.of({
+      find: (id) =>
+        Effect.gen(function* () {
+          yield* logger.log(`finding ${id}`);
+          return yield* database.findUser(id);
+        }),
+    });
+  }),
+);
+```
+
+```ts never
+class Users extends Context.Service<
+  Users,
+  {
+    readonly find: (id: UserId) => Effect.Effect<User, UserNotFound, Database | Logger>;
+  }
+>()("@app/Users") {}
+
+export const UsersLive = Layer.succeed(Users, {
+  find: (id) =>
+    Effect.gen(function* () {
+      const database = yield* Database;
+      const logger = yield* Logger;
+      yield* logger.log(`finding ${id}`);
+      return yield* database.findUser(id);
+    }),
+});
+```

package/presets/effect/services/test-layers-are-in-memory.md

@@ -1,8 +1,8 @@
 ---
-description: A test implementation of a service must be built with Layer.sync or Layer.succeed over in-memory state, never over a real database, network, or file.
+description: A test implementation of a service should be built with Layer.sync or Layer.succeed over in-memory state, and should not reach a real database, network, or file. Integration tests that exercise the real service are not in scope.
 ---
 
-```ts must
+```ts should
 static readonly testLayer = Layer.sync(Cache, () => {
   const store = new Map<string, string>()
 
@@ -13,7 +13,7 @@ static readonly testLayer = Layer.sync(Cache, () => {
 })
 ```
 
-```ts never
+```ts should not
 const EmailTest = Layer.effect(
   Email,
   Effect.gen(function* () {

package/src/cli.ts

@@ -63,7 +63,9 @@ class ContradictionsReported extends Schema.TaggedError<ContradictionsReported>(
 
 const preset = Flag.choice("preset", presetNames).pipe(
   Flag.optional,
-  Flag.withDescription("Add a built-in rule set. With a preset, .adhere/config.ts is optional."),
+  Flag.withDescription(
+    "Add a built-in rule set, or one of its topics, such as effect/basics. With a preset, .adhere/config.ts is optional.",
+  ),
 );
 
 const threshold = Flag.float("threshold").pipe(

package/src/config.ts

@@ -161,11 +161,21 @@ export interface Overrides {
   readonly rpm?: number;
 }
 
-/** The presets a run applies, command-line ones first. */
+/**
+ * The presets a run applies, command-line ones first, each once. A topic such
+ * as `effect/basics` is left out when its whole preset is named too, since
+ * the whole preset already holds its rules.
+ */
 export const presetsOf = (
   config: Pick<AdhereConfig, "presets">,
   overrides: Overrides,
-): ReadonlyArray<PresetName> => [...(overrides.presets ?? []), ...config.presets];
+): ReadonlyArray<PresetName> => {
+  const named = [...new Set([...(overrides.presets ?? []), ...config.presets])];
+  return named.filter((name) => {
+    const [whole] = name.split("/");
+    return whole === name || !named.some((other) => other === whole);
+  });
+};
 
 /**
  * Precedence, highest first: command line, config file, presets in order

package/src/presets.ts

@@ -13,10 +13,48 @@ const presetsRoot = isStandaloneExecutable
   ? new URL("./presets/", import.meta.url)
   : new URL("../presets/", import.meta.url);
 
-/** Built-in rule sets, each a directory of Markdown rule files in `presets/`. */
-export const presets = {
-  effect: { rules: new URL("effect/", presetsRoot) },
-} as const satisfies Record<string, Preset>;
+/**
+ * Built-in rule sets, each a directory of Markdown rule files in `presets/`,
+ * and the topics each divides into: its subdirectories.
+ */
+const topics = {
+  effect: ["basics", "config", "data", "errors", "services", "testing"],
+  alchemy: ["apis", "data", "durable", "providers", "resources", "runtime", "secrets", "security"],
+} as const;
+
+type Topics = typeof topics;
+type WholePreset = keyof Topics;
+
+/** A whole preset, `effect`, or one of its topics, `effect/basics`. */
+export type PresetName = { [P in WholePreset]: P | `${P}/${Topics[P][number]}` }[WholePreset];
+
+export const presetNames: ReadonlyArray<PresetName> = Object.entries(topics).flatMap(
+  ([preset, names]) => [preset, ...names.map((topic) => `${preset}/${topic}`)],
+) as ReadonlyArray<PresetName>;
+
+/** A built-in preset. With `topic`, only the rules under that subdirectory apply. */
+export interface BuiltInPreset extends Preset {
+  readonly rules: URL;
+  readonly topic?: string;
+}
+
+/**
+ * A topic's rules keep the ids they have in the whole preset, so
+ * `effect/basics` and `effect` judge `basics/gen-for-sequencing` alike and
+ * share its cached answers.
+ */
+export const presetOf = (name: PresetName): BuiltInPreset => {
+  const [preset = name, topic] = name.split("/");
+  return {
+    rules: new URL(`${preset}/`, presetsRoot),
+    ...(topic === undefined ? {} : { topic }),
+  };
+};
+
+export const presets: Readonly<Record<WholePreset, BuiltInPreset>> = {
+  effect: presetOf("effect"),
+  alchemy: presetOf("alchemy"),
+};
 
-export const presetNames = ["effect"] as const satisfies ReadonlyArray<keyof typeof presets>;
-export type PresetName = (typeof presetNames)[number];
+/** The directory each whole preset reads, for checking `topics` against it. */
+export const topicsOf = (preset: WholePreset): ReadonlyArray<string> => topics[preset];

package/src/services/AdhereConfig.ts

@@ -11,7 +11,7 @@ import {
   type ResolvedConfig,
   resolveConfig,
 } from "#config.ts";
-import { type PresetName, presets } from "#presets.ts";
+import { type PresetName, presetOf } from "#presets.ts";
 import {
   applicableRules,
   globalRuleSet,
@@ -43,8 +43,10 @@ const loadConfigFile = Effect.fn("AdhereConfig.load")(function* (file: string) {
 });
 
 const loadPreset = Effect.fn("AdhereConfig.loadPreset")(function* (name: PresetName, base: string) {
-  const preset: Preset = presets[name];
-  const rules = yield* materializeRules(preset.rules, base);
+  const { topic, ...preset } = presetOf(name);
+  const all = yield* materializeRules(preset.rules, base);
+  const rules =
+    topic === undefined ? all : Record.filter(all, (_, id) => id.startsWith(`${topic}/`));
   return [name, { ...preset, rules } satisfies Loaded<Preset>] as const;
 });
 

package/presets/effect/cli/handlers-delegate.md

@@ -1,24 +0,0 @@
----
-description: A command handler must only parse input and call a service. Business logic must live in the service, never in the handler.
----
-
-```ts must
-const addCommand = Command.make("add", { text }, ({ text }) =>
-  Effect.gen(function* () {
-    const repo = yield* TaskRepo;
-    const task = yield* repo.add(text);
-    yield* Console.log(`Added task #${task.id}: ${task.text}`);
-  }),
-).pipe(Command.withDescription("Add a new task"));
-```
-
-```ts never
-Command.make("rename", { from, to }, ({ from, to }) =>
-  Effect.gen(function* () {
-    const fs = yield* FileSystem.FileSystem;
-    const text = yield* fs.readFileString(from);
-    yield* fs.writeFileString(to, text.replaceAll("draft", "final"));
-    yield* fs.remove(from);
-  }),
-);
-```

package/presets/effect/data/records-are-schema-classes.md

@@ -1,23 +0,0 @@
----
-description: Domain records must be defined with Schema.Class, never with a plain interface or type alias.
----
-
-```ts must
-export class User extends Schema.Class<User>("User")({
-  id: UserId,
-  name: Schema.String,
-  email: Schema.String,
-  createdAt: Schema.Date,
-}) {
-  get displayName() {
-    return `${this.name} (${this.email})`;
-  }
-}
-```
-
-```ts never
-interface Invoice {
-  readonly id: InvoiceId;
-  readonly total: Money;
-}
-```