@fast-china/eslint-config 2.0.9 → 2.1.0

package/docs/engineering-audit.zh.md

@@ -1,104 +1,80 @@
 # 工程质量审查报告
 
-审查日期：2026-08-02
+审查日期：2026-08-26
 
-审查对象：`@fast-china/eslint-config` 2.0.6 工作区
+审查对象：`@fast-china/eslint-config` 2.1.0 工作区
 
 ## 结论
 
-当前仓库已经具备完整 ESLint Flat Config 开源库所需的核心能力：稳定且精简的公共 API、明确的语言作用域、可选类型感知检查、精确规则类型、可重复构建、集成测试、CI、发布归档检查和中英文文档。
+仓库继续使用 ESLint 10 Flat Config、精确规则类型、可重复构建和发布包契约，并将根入口收敛为固定的 Vue 3 + TypeScript + UniApp 配置。SDK、React、Angular、Node.js 等其他项目通过不绑定框架的基础组合和对应框架片段接入，不继承 Vue 或 UniApp globals。
 
-默认场景面向普通 Vue 3 + Vite + TypeScript 浏览器后台管理项目；React、Angular、Markdown 和清单排序按需启用，Lodash 策略通过 `configs` 子路径独立组合。配置仍支持 JavaScript、Node.js 工程文件、JSON 方言、正则表达式和模块导入检查，项目覆写始终位于内置配置之后。
+## 当前规则模型
 
-## 审查范围
+- JavaScript、TypeScript、Import 和 RegExp 只有一套共享规则。
+- TypeScript、Vue 和 React TypeScript 始终使用 `recommendedTypeChecked` 与 Project Service。
+- Vue 使用 `flat/recommended`，并叠加事件声明、kebab-case 属性、闭合标签和排序规则。
+- RegExp 使用显式审查过的正确性与安全规则，不继承完整偏好型推荐集合。
+- React 使用 `@eslint-react` 推荐预置和 React 官方 Hooks Recommended，并关闭重复实现。
+- Angular 与官方 TypeScript、模板和无障碍推荐规则保持一致。
+- 规则源码注释只说明当前意图；历史版本差异由更新日志维护。
 
-- npm 包元数据、ESM 入口、公开子路径与发布文件
-- TypeScript 6、tsdown、类型生成与声明文件
-- ESLint Flat Config 顺序、文件作用域、解析器和插件注册
-- JavaScript、TypeScript、Vue、React、Angular、JSON 方言、Markdown、RegExp 与 import 集成
-- 浏览器、Node.js、通用环境和项目自定义全局变量
-- Lodash 静态导入策略、清单排序与 Prettier 职责边界
-- README、规则风险说明、贡献流程、CI、测试和发布前检查
+## 公共 API
 
-## 当前工程基线
+根入口公开：
 
-| 领域           | 状态 | 质量保障                                                               |
-| -------------- | ---- | ---------------------------------------------------------------------- |
-| 公共 API       | 通过 | 根入口保持精简，配置片段、glob 常量和原始规则由独立子路径提供          |
-| Flat Config    | 通过 | 所有语言和插件配置限定到明确文件范围，项目覆写最后应用                 |
-| Vue 3          | 通过 | `vue-eslint-parser` 处理 SFC，TypeScript 解析器正确嵌套                |
-| React          | 通过 | 按需覆盖 JSX/TSX、组件、官方 Hooks、Compiler 诊断与 DOM 安全           |
-| Angular        | 通过 | 按需覆盖框架 TypeScript、外部 HTML、内联模板与模板无障碍               |
-| TypeScript     | 通过 | 默认使用推荐规则，可选 Project Service 类型感知模式                    |
-| JavaScript     | 通过 | 应用 `@eslint/js` 推荐规则并区分应用环境与 Node.js 工程文件            |
-| 数据与文档文件 | 通过 | JSON、JSONC、JSON5 和 Markdown 分别使用对应语言配置                    |
-| 规则自动补全   | 通过 | 从 ESLint 核心和随包插件 schema 生成精确 `RuleOptions`                 |
-| Lodash 策略    | 通过 | 可选统一 `lodash` 或 `lodash-unified`，默认不限制项目依赖选择          |
-| 清单排序       | 通过 | 默认关闭；启用后不会重排 `package.json#exports` 条件键                 |
-| Prettier       | 通过 | 只关闭冲突规则，格式化由 Prettier CLI 或编辑器负责                     |
-| 构建与发布     | 通过 | tsdown 生成 `.mjs`、`.d.mts` 和 source map，`prepack` 执行完整质量门禁 |
-| 自动化验证     | 通过 | 运行时测试、消费者类型测试、格式检查、静态检查和 Node.js 多版本 CI     |
+- 默认 Vue 3 + TypeScript + UniApp Flat Config。
+- 只接收 `environment` 的 `fastConfig()`。
+- `defineRules()`、`FastConfigOptions` 和 `RuleOptions`。
 
-## 配置组合模型
+`defaultConfigOptions`、语言和插件布尔开关、`typeChecked`、`tsconfigRootDir`、工厂级 rules/globals/ignores 已删除。项目覆写使用原生后置 Flat Config。
 
-`fastConfig()` 按以下顺序生成配置：
+根入口新增固定 `createBaseConfigs()`，供 React、Angular、Node.js 和 SDK 组合。框架、Markdown、Lodash 及其他低层片段仍从 `./configs` 显式引用。
 
-1. 内置忽略项、项目附加忽略项和可选 `.gitignore`。
-2. 应用运行环境、项目全局变量和 Node.js 工程文件全局变量。
-3. JavaScript、import-x、RegExp、TypeScript、JSON 方言、Vue、React、Angular 和 Markdown 配置。
-4. 可选 `package.json`、`tsconfig*.json` 排序配置。
-5. Prettier 冲突关闭配置。
-6. 工厂级 `rules` 与调用方传入的文件级覆写。
+## 工程能力
 
-这一顺序保证调用方可以覆盖任何内置规则，同时避免语言规则进入不支持的文件类型。
+| 领域          | 状态 | 质量保障                                           |
+| ------------- | ---- | -------------------------------------------------- |
+| 公共 API      | 通过 | 根入口固定、其他能力由独立子路径组合               |
+| JavaScript    | 通过 | 核心 recommended + 统一现代语法规则                |
+| TypeScript    | 通过 | 固定 `recommendedTypeChecked` 与 Project Service   |
+| Vue 3         | 通过 | `vue-eslint-parser` + `flat/recommended`           |
+| UniApp        | 通过 | 默认 `.nvue`、globals、清单注释和 `unpackage` 忽略 |
+| React         | 通过 | 显式组合 JSX/TSX、Hooks Recommended 与 DOM 安全    |
+| Angular       | 通过 | 显式组合源码、外部/内联模板和无障碍规则            |
+| Import        | 通过 | 正确性和排序为 error，副作用导入参与检查           |
+| RegExp        | 通过 | 显式正确性、安全和超线性回溯规则                   |
+| JSON          | 通过 | 三种方言、VS Code 与 UniApp 注释例外               |
+| 清单排序      | 通过 | 默认启用并保留 `exports` 条件顺序                  |
+| Markdown      | 通过 | 作为独立片段显式组合                               |
+| Node 工具文件 | 通过 | Node globals、console 和 CommonJS 末尾覆写         |
+| 类型生成      | 通过 | 插件 schema 生成精确 `RuleOptions`                 |
+| 构建发布      | 通过 | TypeScript 6、tsdown、ESM 和根目录 `dist/`         |
 
-## 规则与类型维护
+## 根入口配置顺序
 
-- 每条本地规则旁必须说明作用、启用理由和重要风险。
-- 高影响、可自动修复、安全相关和按需启用规则使用统一标签。
-- 默认高影响规则同步记录在中英文风险指南中。
-- `src/typegen.d.ts` 由规则 schema 生成，不允许手工编辑。
-- React、Angular 插件也参与类型生成，因此框架规则名与选项可获得同样的精确自动补全。
-- ESLint 或插件升级后必须运行 `pnpm typegen` 并审查类型差异。
-- `@fast-china/eslint-config/configs` 提供全部配置创建函数及其选项类型，支持高级调用方自行组合。
-- `@fast-china/eslint-config/constants` 集中提供配置片段使用的文件 glob，避免调用方复制字符串。
-- `@fast-china/eslint-config/rules` 提供有完整注释的原始规则记录，便于高级组合。
+1. 内置忽略项和 `.gitignore`。
+2. 应用运行环境与 Node.js 工程文件 globals。
+3. Common、JavaScript、Import、RegExp、TypeScript 与 JSON。
+4. `package.json` 和 `tsconfig*.json` 排序。
+5. Vue、UniApp globals 与清单适配。
+6. Prettier 冲突关闭层。
+7. Node.js 工程文件末尾规则覆写。
+8. 调用方后置 Flat Config。
 
-`createLodashConfigs()` 使用 ESLint 核心 `no-restricted-imports`，因此无需增加插件依赖。它通过 `configs` 子路径按需组合，负责防止静态 import/export 混用包入口，不负责安装目标包，也不检查动态 `import()` 或 CommonJS `require()`。
-
-## 质量门禁
-
-发布前必须全部通过：
+## 发布前验证
 
 ```sh
+pnpm typegen
 pnpm check
 pnpm pack --dry-run
 ```
 
-`pnpm check` 包含：
-
-1. 生成类型漂移检查。
-2. 正式 ESM 与声明文件构建。
-3. TypeScript 源码类型检查。
-4. ESLint 全仓检查。
-5. Prettier 格式检查。
-6. 消费者类型契约测试。
-7. 运行时配置集成测试。
-8. 发布元数据、入口文件和声明文件契约测试。
-
-发布归档必须包含根入口和 `./configs`、`./constants`、`./rules` 子入口的 JavaScript 与声明文件，以及生成的 JavaScript、声明 source map；且不得包含源码缓存、测试缓存或本地依赖目录。
-
-## CI 与发布边界
-
-GitHub Actions 在 `master`、`main` 推送和 Pull Request 上运行，覆盖 Node.js 22.18 和 24.18。CI 使用 pnpm 11.x、冻结锁文件安装、完整质量门禁和发布归档预览。
-
-CI 只验证代码和发布包，不自动发布 npm。正式发布仍由维护者确认版本、Changelog、归档内容和 npm 身份后执行。
+发布归档必须包含根入口和 `./configs`、`./constants`、`./rules` 子入口，不得包含源码缓存或本地依赖目录。CI 只负责验证，不自动发布 npm。
 
 ## 剩余风险
 
-- ESLint 和插件推荐预置会随依赖升级变化，每次升级都要检查实际生效配置和生成类型差异。
-- React 与 Angular 默认关闭；启用 Angular 时必须同时启用 TypeScript，并把现代组件、变更检测、控制流和无障碍规则作为框架接入成本审查。
-- 类型感知模式依赖项目 `tsconfig.json` 覆盖被检查文件，复杂 monorepo 应显式设置 `tsconfigRootDir`。
-- 自动修复可能调整 import、模板属性、正则表达式和清单字段，应在独立提交中审查结果。
-- Lodash 策略只覆盖静态模块语法；需要限制 CommonJS 或动态导入的项目应追加自己的文件级规则或代码审查约定。
-- npm 发布自动化尚未启用，后续应在可信发布、分支保护和维护者审批策略确定后单独设计。
+- 上游 recommended 会随依赖升级变化，升级 ESLint 或插件后必须检查实际生效配置。
+- 类型感知依赖 tsconfig 覆盖和 Project Service，复杂 monorepo 需要维护清晰的项目边界。
+- Import、类型导入、Vue 属性和清单排序可能被 `eslint --fix` 修改，需要审查副作用顺序和纯排序差异。
+- 根入口默认声明 UniApp 条件编译 globals，不能验证平台分支；普通 Vue 项目如需避免 globals 扩散应改用片段组合。
+- `.uvue` 与 `.uts` 仍不在支持范围。

package/docs/rules-risk.md

@@ -1,105 +1,108 @@
-# Default Rules, Risk Levels, and Maintenance
-
-This document records what the default config inherits, which rules can have a large adoption or review cost, and what maintainers must update when changing rules.
-
-## Risk labels
-
-- `[High impact]`: the rule can create a large diff, block existing patterns, or require a review of runtime or public API behavior.
-- `[Auto-fixable]`: the currently locked ESLint or plugin version declares the rule fixable by `eslint --fix`. It does not remove the need for review.
-- `[Security]`: the rule primarily protects a trust or injection boundary.
-- `[Disabled by default]` and `[Opt-in]`: the rule record exists but is not loaded by the default config.
-
-High impact does not mean inherently unsafe. It means adoption or fix review is relatively expensive. Module side effects, getters and proxies, build-tool conventions, and public component APIs deserve particular attention.
-
-## Bundled preset sources
-
-`fastConfig()` defaults to a conventional Vue 3 browser administration project with TypeScript, JavaScript, import, RegExp, JSON, and the Prettier compatibility layer. React, Angular, Markdown, type-aware TypeScript linting, and manifest sorting are opt-in. Lodash policies are separate fragments from the `configs` subpath.
-
-| Scope                  | Inherited preset                                                                                   | Notes                                                                                                   |
-| ---------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
-| JavaScript             | `@eslint/js` `recommended`                                                                         | Core syntax and runtime correctness, including `no-undef` and `no-unused-vars`.                         |
-| TypeScript             | typescript-eslint `recommended` + `stylistic`                                                      | Does not read type information by default; local overrides are applied afterward.                       |
-| Vue 3                  | `@eslint/js`, non-type-aware typescript-eslint presets, and `eslint-plugin-vue` `flat/recommended` | Handles Vue 3 SFCs and applies TypeScript rules to `<script lang="ts">` correctly.                      |
-| React (opt-in)         | `@eslint-react/recommended*` and `eslint-plugin-react-hooks` `flat/recommended`                    | Checks components, JSX/TSX, DOM APIs, Hooks, and stable React Compiler diagnostics.                     |
-| Angular (opt-in)       | angular-eslint 22.x TypeScript, template recommended, and template accessibility rule sets         | Checks Angular TypeScript plus external and extracted inline templates; requires TypeScript support.    |
-| Imports                | `eslint-plugin-import-x` `recommended`                                                             | Local rules add import placement, deduplication, and ordering. Resolver-dependent checks stay disabled. |
-| RegExp                 | `eslint-plugin-regexp` `flat/recommended`                                                          | Some rules can rewrite regular expressions; run tests after bulk fixes.                                 |
-| JSON dialects          | The matching `eslint-plugin-jsonc` `flat/recommended-*` preset                                     | JSON, JSONC, and JSON5 are scoped separately.                                                           |
-| Markdown (opt-in)      | `@eslint/markdown` `recommended`                                                                   | Checks Markdown structure and syntax.                                                                   |
-| Prettier compatibility | `eslint-config-prettier/flat`                                                                      | Disables conflicting rules only; it does not run Prettier through ESLint.                               |
-
-The exact upstream rule set is defined by the dependency versions in `pnpm-lock.yaml`. Review the effective config with the config inspector whenever ESLint or a plugin is upgraded instead of copying an upstream list that will become stale.
-
-## High-impact defaults
-
-| Rule                                                    | Severity         | Auto-fix                 | Main impact                                                                                                                       | Recommended review                                                             |
-| ------------------------------------------------------- | ---------------- | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
-| `import-x/order`                                        | error            | Yes                      | Groups and reorders imports. Unassigned side-effect imports are reported but cannot be safely moved automatically.                | Check entrypoints, polyfills, styles, and registration imports.                |
-| `@typescript-eslint/no-unused-vars`                     | error            | Yes in the locked plugin | Can remove unused imports, variables, or declarations. An underscore prefix is the explicit escape hatch.                         | Run type checking, builds, and tests after an isolated cleanup.                |
-| `@typescript-eslint/consistent-type-imports`            | error            | Yes                      | Converts type-only dependencies to inline `type` imports; an import used only for side effects could disappear from emitted code. | Express side effects as a separate `import "module"` and inspect build output. |
-| `@typescript-eslint/no-require-imports`                 | error            | No                       | Blocks CommonJS, conditional loading, and some toolchain interop patterns.                                                        | Disable only for configuration files that genuinely require it.                |
-| `no-var`                                                | error            | Yes                      | Moves `var` declarations to block scope; hoisting and loop closures need attention.                                               | Run behavior tests, especially around callbacks created in loops.              |
-| `prefer-arrow-callback`                                 | error            | Yes                      | Rewrites callbacks; code relying on `this`, `arguments`, or named stack frames needs review.                                      | Check event handlers, library callbacks, and stack traces.                     |
-| `logical-assignment-operators`                          | error            | Yes                      | Rewrites conditional assignment; getter and Proxy access counts deserve review.                                                   | Test state containers and reactive objects.                                    |
-| `no-restricted-syntax` (`LabeledStatement`)             | error            | No                       | Requires control-flow refactoring for labeled break or continue.                                                                  | Downgrade only in affected files and restore after refactoring.                |
-| `sort-imports`                                          | warn             | Yes                      | Sorts members inside one import declaration and usually creates text-only diffs.                                                  | Keep it in an isolated cleanup with `import-x/order`.                          |
-| `vue/require-explicit-emits`                            | error            | No                       | Makes emitted events an explicit component API and can surface undeclared events.                                                 | Model the real event list instead of disabling it blindly.                     |
-| `vue/no-mutating-props`                                 | error            | No                       | Enforces one-way data flow and may require local state or event changes.                                                          | Review the fix as a component-design change.                                   |
-| `vue/attributes-order`                                  | error            | Yes                      | Can reorder many template attributes on first use.                                                                                | Keep template sorting separate from business changes.                          |
-| `no-unused-vars`, `no-undef` from the JavaScript preset | error            | No                       | Can report many existing issues and expose missing runtime-global declarations.                                                   | Select the correct `environment` before cleanup.                               |
-| RegExp recommended preset                               | Upstream-defined | Some rules               | May rewrite character classes, quantifiers, or assertions.                                                                        | Exercise representative real-world inputs after fixing.                        |
-
-`vue/no-v-html` is also enabled as a warning. It is a security signal rather than an automatic rewrite: HTML must be trusted or reliably sanitized.
-
-## High-impact features not enabled by default
-
-- Type-aware TypeScript and Vue presets require `typeChecked: true`. They add project-service cost and rules such as `no-floating-promises`. `prefer-promise-reject-errors` permits transparent forwarding of `unknown` rejection reasons while still reporting statically known non-`Error` values such as strings and numbers.
-- React requires `react: true`. Its upstream recommended and official Hooks presets include blocking component, Hooks, and React Compiler rules; review existing custom hook and memoization patterns when adopting it.
-- Angular requires `angular: true`. The framework bundle enables `prefer-inject`, OnPush change detection, standalone components, modern template control flow, and template accessibility. These policies are intentionally not active in the default Vue configuration.
-- The `jsonc/sort-keys` and `jsonc/sort-array-values` manifest rules require `sortPackageJson: true` or `sortTsconfig: true`. Isolate the first fix and verify the publish manifest.
-- Lodash import restrictions require `createLodashConfigs("lodash")` or `createLodashConfigs("lodash-unified")` from the `configs` subpath. They use `no-restricted-imports` to prevent mixed static package entry points but do not inspect dynamic `import()` or CommonJS `require()`.
-- Resolver-dependent import checks such as `import-x/no-unresolved` and `import-x/named` stay disabled.
-- Keys inside `package.json#exports` are never sorted. Node conditional exports use key order during matching, so reordering can change the loaded file.
-
-When Angular is enabled, the highest-adoption-cost rules are `@angular-eslint/prefer-inject`, `@angular-eslint/prefer-on-push-component-change-detection`, `@angular-eslint/prefer-standalone`, and `@angular-eslint/template/prefer-control-flow`. Treat their fixes as framework migrations rather than formatting cleanup. Set `angular: { templateAccessibility: false }` only when accessibility is enforced by another equivalent tool; individual exceptions should normally use file-scoped trailing overrides.
-
-## Scoped overrides
-
-Overrides must follow the shared config and should target only the affected files:
-
-```js
-import fastChina, { defineRules } from "@fast-china/eslint-config";
-
-export default fastChina(
-	{},
-	{
-		name: "project/typescript-exceptions",
-		files: ["**/*.{ts,tsx,mts,cts,vue}"],
-		rules: defineRules({
-			"@typescript-eslint/consistent-type-imports": "warn",
-			"@typescript-eslint/no-require-imports": "off",
-			"@typescript-eslint/no-unused-vars": "warn",
-		}),
-	},
-	{
-		name: "project/vue-exceptions",
-		files: ["**/*.vue"],
-		rules: defineRules({
-			"vue/attributes-order": "warn",
-			"vue/require-explicit-emits": "warn",
-		}),
-	}
-);
+# Default Rules and Risk Guide
+
+This document describes the current 2.1.0 configuration model, major rules, and migration risks. Source comments explain current intent only; historical changes belong in `CHANGELOG.md`.
+
+## Configuration model
+
+SDKs, OA systems, administration apps, Vue web apps, and UniApp clients share one JavaScript, TypeScript, Import, and RegExp rule set. There are no strictness tiers.
+
+The root entry is a fixed Vue 3 + TypeScript + UniApp preset:
+
+- `environment: "browser"`
+- `.gitignore`
+- JavaScript and type-aware TypeScript
+- Vue 3, `.nvue`, UniApp globals, and manifest handling
+- Import, RegExp, JSON, JSONC, and JSON5
+- `package.json` and `tsconfig*.json` sorting
+- Prettier conflict handling
+- Node.js tooling globals and trailing rule overrides
+
+`fastConfig()` retains only `environment`. React, Angular, Markdown, and Lodash compose from `./configs`; rules, globals, ignores, and special parser settings use trailing Flat Config objects.
+
+## Preset sources
+
+| Domain     | Preset or implementation                                                   |
+| ---------- | -------------------------------------------------------------------------- |
+| JavaScript | `@eslint/js` recommended plus local rules                                  |
+| TypeScript | typescript-eslint `recommendedTypeChecked` plus Project Service            |
+| Vue        | `eslint-plugin-vue` `flat/recommended` plus type-aware TypeScript          |
+| React      | `@eslint-react` recommended/type-checked plus React Hooks Flat Recommended |
+| Angular    | Angular ESLint TypeScript, template, and accessibility recommended presets |
+| JSON       | `eslint-plugin-jsonc` recommended presets for three dialects               |
+| Import     | `eslint-plugin-import-x` recommended plus a fixed ordering policy          |
+| RegExp     | Explicit correctness, safety, and super-linear backtracking rules          |
+| Prettier   | `eslint-config-prettier` conflict disabling                                |
+
+## Major rules
+
+### JavaScript
+
+- `camelcase: ["error", { properties: "never" }]`
+- `no-debugger: "error"`
+- `no-use-before-define` warns; classes and variables must be declared first while function declarations may be hoisted.
+- `prefer-arrow-callback`, `logical-assignment-operators`, and `prefer-object-spread` are errors.
+- `prefer-exponentiation-operator` and `prefer-object-has-own` are errors.
+- `sort-imports` warns and only sorts members within one import.
+- `import-x/order` is an error with `warnOnUnassignedImports: true`.
+
+### TypeScript
+
+- `recommendedTypeChecked` and `projectService: true` are always enabled.
+- `explicit-module-boundary-types` is an error and does not allow explicitly typed `any` arguments as an escape hatch.
+- `explicit-function-return-type` is not additionally enabled, so internal functions and callbacks can rely on inference.
+- `no-explicit-any` warns.
+- `no-unused-vars` is an error; an `_` prefix marks intentional omissions and rest siblings are ignored.
+- `no-empty-function` only allows empty constructors and override methods.
+- `consistent-type-imports` uses inline `type` fixes.
+- `no-non-null-assertion` is an error.
+
+### Vue
+
+- Uses `flat/recommended`.
+- `attribute-hyphenation: ["error", "always"]`.
+- `no-v-html` warns.
+- `no-v-text-v-html-on-component` is an error.
+- `require-explicit-emits`, `attributes-order`, and `no-mutating-props` are errors.
+- `.vue` and `.nvue` share the TypeScript parser and Project Service.
+
+## Type-aware requirements
+
+TypeScript, Vue, and React TSX always require type information. Linted files must belong to a discoverable `tsconfig.json`, or Project Service reports a configuration error.
+
+The `typeChecked` and `tsconfigRootDir` wrapper options no longer exist. Complex monorepos can override `languageOptions.parserOptions` in trailing Flat Config, but should not disable type checking to hide project-boundary problems.
+
+## UniApp boundary
+
+The root entry declares `uni`, `uniCloud`, page APIs, and conditional-platform objects, and permits comments in `pages.json` and `manifest.json`.
+
+ESLint does not execute conditional compilation, so `wx`, `plus`, and similar objects are visible in every code file handled by the root entry. This prevents `no-undef` inside platform branches but cannot verify that objects occur under the correct `#ifdef`. Plain Vue projects that do not want these globals should compose focused fragments instead of using the root entry.
+
+## Auto-fix risks
+
+Review these fixes carefully:
+
+- Import groups, member order, and side-effect import placement.
+- Inline TypeScript `type` imports.
+- Vue attribute naming and ordering.
+- `package.json` and `tsconfig*.json` key order.
+
+`package.json` sorting does not enter conditional `exports` objects whose order has runtime meaning.
+
+Run a check first:
+
+```sh
+pnpm exec eslint .
 ```
 
-Run a read-only lint first, then apply `eslint --fix` on a separate branch or commit. Review imports, side-effect entrypoints, package exports, component events, and manifests before running the project's type checks, build, and tests.
+Then apply fixes after reviewing the scope:
+
+```sh
+pnpm exec eslint . --fix
+```
 
-## Rule-change checklist
+## Maintenance policy
 
-1. Every local rule in `src/rules/` must explain its purpose, rationale, and important exception or risk; translating the rule name is not enough.
-2. Add `[High impact]` when appropriate. For fixable rules, verify `meta.fixable` in the installed version instead of relying on memory.
-3. Update this file, `rules-risk.zh.md`, both READMEs, and `CHANGELOG.md` for default behavior changes.
-4. Never sort maps whose key order has semantics, including conditional objects under `package.json#exports`.
-5. Run `pnpm typegen` after changing ESLint or any bundled plugin; inspect and commit `src/typegen.d.ts` instead of editing it manually.
-6. Add integration coverage for parser, plugin, scope, auto-fix, generated-type, and public-export changes.
-7. Run `pnpm check` and `pnpm pack --dry-run`, then inspect the real fix diff.
+1. Rule comments explain current behavior, risk, and exceptions without referring to historical versions.
+2. After upgrading recommended presets, inspect the final effective rules to prevent silent severity changes.
+3. New frameworks add parsers, file scopes, and framework semantics without creating another language-rule tier.
+4. New public factories, parsers, or auto-fix behavior require type and runtime tests.