@futdevpro/dynamo-eslint 1.20.29 → 1.20.51

package/README.md

@@ -169,6 +169,64 @@ This package includes custom ESLint rules for Dynamo conventions:
 ### Type Rules
 - **`@futdevpro/dynamo/explicit-types`**: Enforces explicit type annotations on all TypeScript declarations (functions, variables, parameters, class properties, destructuring)
 
+### Security Rules
+- **`@futdevpro/dynamo/no-unlisted-inner-html`** (BFR-QA-005): XSS-surface guard — reports every `[innerHTML]`
+  binding (`.html` and inline `.ts` templates) and every `bypassSecurityTrust…(…)` call, EXCEPT in reviewed files on
+  the `allow` list and up to the committed per-file **baseline**. So today's surfaces pass and every NEW one fails.
+  Options: `allow: string[]` (path suffixes) · `baselineFile` (default `.dynamo/xss-surface-baseline.json`) ·
+  `escapePipe` (path suffix of your escaping pipe — it must escape `& < > "` BEFORE producing HTML). Comments and
+  `*.spec.ts` files are ignored.
+
+  **Adopt it in a project** (run in the folder ESLint runs in, e.g. `client/`):
+  ```bash
+  npx dynamo-xss-surface-baseline          # writes .dynamo/xss-surface-baseline.json — commit it
+  npx dynamo-xss-surface-baseline --check  # exit 1 if the surface grew beyond the committed baseline
+  ```
+  The `ngx` preset switches the rule on (`error`) **only when that baseline file exists** — without it nothing
+  changes, so a dependency bump never breaks an existing lint step. Regenerate the baseline only after a reviewed
+  change. ⚠️ A rule-level baseline on purpose: ESLint's own `--suppress-rule` is applied only by the ESLint CLI, not
+  by the `ESLint` API that `ng lint` uses (measured on eslint 9.39.5).
+
+### UI Building-Block Rules
+- **`@futdevpro/dynamo/scroll-container-min-h-0`** (BFR-QA-004 ①): a scroll container (`overflow-(y-)auto|scroll`, or
+  a component tag you list as a scroller) that will NOT scroll — between it and the element giving the chain its
+  height (`h-full`, a fixed height) a column-flex item lacks `min-h-0`, so the chain grows to the content height.
+  Not reported: a scroll container with its own fixed height, an outer scroll container on the way, an
+  `absolute`/`fixed` ancestor, a component host without classes in the template (its `host`/`:host` styles are not
+  visible), or no height source in the template at all. The chain is followed inside one template.
+- **`@futdevpro/dynamo/module-load-failed-branch`** (BFR-QA-004 ②): a module (`…/_modules/<name>/`) whose templates
+  show a loading state (`…Loading…`, `inProgress_$`, `loading-skeleton`) but none of which shows a failed state
+  (`@if (…error|…failed…)`, a `…load-failed` / `…error-state` component, a `load…error|failed` test id). A list OF
+  errors (`errors`) is not a failed state.
+
+  **Adopt them in a project** (run in the folder ESLint runs in, e.g. `client/`):
+  ```bash
+  npx dynamo-ui-building-blocks-baseline                                   # writes .dynamo/ui-building-blocks-baseline.json — commit it
+  npx dynamo-ui-building-blocks-baseline --scroller-tag app-pull-to-refresh # a component that IS a scroll container
+  npx dynamo-ui-building-blocks-baseline --check                           # exit 1 on a new case
+  ```
+  Exactly like the XSS guard: the `ngx` preset switches both rules on (`error`) **only when that baseline file
+  exists**, so a dependency bump never breaks a `--max-warnings=0` lint step. The listed scroller tags live in the
+  baseline's `settings`, so the rules and the generator always agree. Lower the baseline when you fix a case.
+
+### Unused Component Rule
+- **`@futdevpro/dynamo/no-unused-component`** (BFR-QA-006, project-wide): an Angular `@Component` that is built but
+  used NOWHERE in the folder ESLint runs in — its selector is in no comment-free template (`.html`, or an inline
+  `template:` in backticks or quotes) and nothing references its class in a usage position (route, lazy route,
+  `dialog.open(…)`, bootstrap, `createComponent(…)`, an assignment…). NOT usages: `import … from` lines (a route can
+  disappear while its import stays), `imports` / `declarations` / `exports` entries, the component's own file, specs
+  and stories. When a reference exists only in a comment (`// X_Component,`, `<!-- <app-x> -->`) the message says a
+  finished feature may be switched off. Meant for **apps** — in a library every public component is "unused" inside
+  the package.
+
+  **Adopt it in a project** (run in the folder ESLint runs in, e.g. `client/`):
+  ```bash
+  npx dynamo-unused-components-baseline          # writes .dynamo/unused-components-baseline.json — commit it
+  npx dynamo-unused-components-baseline --check  # exit 1 on a new unused component
+  ```
+  Same gate as the other baseline guards: the `ngx` preset switches it on (`error`) **only when that file exists**.
+  The project scan is cached per process and re-stamped every 3 s (editor lint-on-save).
+
 ## 🛠️ CLI Validation Tools
 
 Use these commands to validate your codebase:

package/build/configs/ngx.d.ts

@@ -1,3 +1,26 @@
 declare const ngxBaseConfig: any;
 declare const angularEslint: any;
+declare const fs: any;
+declare const path: any;
+/**
+ * BFR-QA-005 — the XSS-surface guard is switched on in a project by COMMITTING its baseline
+ * (`npx dynamo-xss-surface-baseline` in the folder ESLint runs in). Without the file the rule stays off: measured
+ * 2026-09-23, 60 `[innerHTML]` + 43 `bypassSecurityTrust` exist in 13 repos, and fatal lint steps (one with
+ * `--max-warnings=0`) would break on the bump. With the file: today's surfaces pass, every NEW one is an error.
+ */
+declare const xssSurfaceGuard: Record<string, string>;
+/**
+ * BFR-QA-004 — the UI-building-blocks guard (scroll container without a `min-h-0` chain, module with a loading state
+ * but no load-failed state) is switched on the same way: by COMMITTING its baseline
+ * (`npx dynamo-ui-building-blocks-baseline`). Measured 2026-09-24 on 29 Angular projects: 1 scroll finding in 290
+ * scroll containers and 19 of 94 loading modules without a failed state in 11 projects — without the file nothing
+ * changes, so `--max-warnings=0` lint steps do not break on the bump.
+ */
+declare const uiBuildingBlocksGuard: Record<string, string>;
+/**
+ * BFR-QA-006 — the built-but-unused component guard (project-wide) is switched on the same way, by COMMITTING its
+ * baseline (`npx dynamo-unused-components-baseline`). Measured 2026-09-24 on 35 Angular apps: 81 of 1209 components
+ * used nowhere (18 with a commented-out reference). Only for `.ts` (a component is declared there). Apps only.
+ */
+declare const unusedComponentGuard: Record<string, string>;
 //# sourceMappingURL=ngx.d.ts.map

package/build/configs/ngx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ngx.d.ts","sourceRoot":"","sources":["../../src/configs/ngx.ts"],"names":[],"mappings":"AAAA,QAAA,MAAM,aAAa,KAAoB,CAAC;AACxC,QAAA,MAAM,aAAa,KAA4B,CAAC"}
+{"version":3,"file":"ngx.d.ts","sourceRoot":"","sources":["../../src/configs/ngx.ts"],"names":[],"mappings":"AAAA,QAAA,MAAM,aAAa,KAAoB,CAAC;AACxC,QAAA,MAAM,aAAa,KAA4B,CAAC;AAChD,QAAA,MAAM,EAAE,KAAgB,CAAC;AACzB,QAAA,MAAM,IAAI,KAAkB,CAAC;AAE7B;;;;;GAKG;AACH,QAAA,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEtC,CAAC;AAEP;;;;;;GAMG;AACH,QAAA,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAM1C,CAAC;AAET;;;;GAIG;AACH,QAAA,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGzC,CAAC"}

package/build/configs/ngx.js

@@ -1,5 +1,37 @@
 const ngxBaseConfig = require('./base');
 const angularEslint = require('angular-eslint');
+const fs = require('fs');
+const path = require('path');
+/**
+ * BFR-QA-005 — the XSS-surface guard is switched on in a project by COMMITTING its baseline
+ * (`npx dynamo-xss-surface-baseline` in the folder ESLint runs in). Without the file the rule stays off: measured
+ * 2026-09-23, 60 `[innerHTML]` + 43 `bypassSecurityTrust` exist in 13 repos, and fatal lint steps (one with
+ * `--max-warnings=0`) would break on the bump. With the file: today's surfaces pass, every NEW one is an error.
+ */
+const xssSurfaceGuard = fs.existsSync(path.join(process.cwd(), '.dynamo', 'xss-surface-baseline.json'))
+    ? { '@futdevpro/dynamo/no-unlisted-inner-html': 'error' }
+    : {};
+/**
+ * BFR-QA-004 — the UI-building-blocks guard (scroll container without a `min-h-0` chain, module with a loading state
+ * but no load-failed state) is switched on the same way: by COMMITTING its baseline
+ * (`npx dynamo-ui-building-blocks-baseline`). Measured 2026-09-24 on 29 Angular projects: 1 scroll finding in 290
+ * scroll containers and 19 of 94 loading modules without a failed state in 11 projects — without the file nothing
+ * changes, so `--max-warnings=0` lint steps do not break on the bump.
+ */
+const uiBuildingBlocksGuard = fs.existsSync(path.join(process.cwd(), '.dynamo', 'ui-building-blocks-baseline.json'))
+    ? {
+        '@futdevpro/dynamo/scroll-container-min-h-0': 'error',
+        '@futdevpro/dynamo/module-load-failed-branch': 'error',
+    }
+    : {};
+/**
+ * BFR-QA-006 — the built-but-unused component guard (project-wide) is switched on the same way, by COMMITTING its
+ * baseline (`npx dynamo-unused-components-baseline`). Measured 2026-09-24 on 35 Angular apps: 81 of 1209 components
+ * used nowhere (18 with a commented-out reference). Only for `.ts` (a component is declared there). Apps only.
+ */
+const unusedComponentGuard = fs.existsSync(path.join(process.cwd(), '.dynamo', 'unused-components-baseline.json'))
+    ? { '@futdevpro/dynamo/no-unused-component': 'error' }
+    : {};
 /**
  * Rulesets For Dynamo Based Systems
  * NGX: Angular Projects
@@ -45,6 +77,9 @@ module.exports = [
             '@futdevpro/dynamo/no-async-ngoninit': 'warn',
             '@futdevpro/dynamo/no-component-direct-api': 'warn',
             '@futdevpro/dynamo/effect-signal-loop': 'warn',
+            ...xssSurfaceGuard,
+            ...uiBuildingBlocksGuard,
+            ...unusedComponentGuard,
         },
     },
     {
@@ -83,6 +118,8 @@ module.exports = [
             '@futdevpro/dynamo/angular-for-track-logic': 'warn',
             '@futdevpro/dynamo/no-ngif-directive': 'warn',
             '@futdevpro/dynamo/no-ngfor-directive': 'warn',
+            ...xssSurfaceGuard,
+            ...uiBuildingBlocksGuard,
         },
     },
 ];

package/build/configs/ngx.js.map

@@ -1 +1 @@
-{"version":3,"file":"ngx.js","sourceRoot":"","sources":["../../src/configs/ngx.ts"],"names":[],"mappings":"AAAA,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AACxC,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,OAAO,GAAG;IACf,GAAG,aAAa;IAChB;QACE,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;QAC9B,eAAe,EAAE;YACf,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe;YACnC,OAAO,EAAE;gBACP,kBAAkB;gBAClB,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,UAAU;gBACnB,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,UAAU;gBAClB,SAAS,EAAE,UAAU;gBACrB,UAAU,EAAE,UAAU;gBACtB,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,UAAU;gBACnB,OAAO,EAAE,UAAU;aACpB;SACF;QACD,OAAO,EAAE;YACP,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO;YAC3B,iBAAiB,EAAE,aAAa,CAAC,QAAQ;SAC1C;QACD,KAAK,EAAE;YACL,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK;YACzB,yBAAyB;YACzB,oCAAoC,EAAE,OAAO;YAC7C,oCAAoC,EAAE,OAAO;YAC7C,0CAA0C,EAAE,OAAO;YACnD,iCAAiC,EAAE,OAAO;YAC1C,kCAAkC,EAAE,OAAO;YAC3C,8CAA8C,EAAE,OAAO;YACvD,yCAAyC,EAAE,OAAO;YAClD,8CAA8C,EAAE,OAAO;YAEvD,4CAA4C;YAC5C,qCAAqC,EAAE,MAAM;YAC7C,2CAA2C,EAAE,MAAM;YACnD,sCAAsC,EAAE,MAAM;SAC/C;KACF;IACD;QACE,KAAK,EAAE,CAAC,WAAW,CAAC;QACpB,eAAe,EAAE;YACf,MAAM,EAAE,aAAa,CAAC,cAAc;YACpC,aAAa,EAAE;gBACb,WAAW,EAAE,QAAQ;gBACrB,UAAU,EAAE,QAAQ;aACrB;SACF;QACD,OAAO,EAAE;YACP,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO;YAC3B,0BAA0B,EAAE,aAAa,CAAC,cAAc;SACzD;QACD,KAAK,EAAE;YACL,wCAAwC,EAAE,OAAO;YACjD,gDAAgD,EAAE,CAAE,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;YAClF,iCAAiC,EAAE,OAAO;YAC1C,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,6DAA6D;YAC7D,4EAA4E;YAC5E,gEAAgE;YAChE,8DAA8D;YAC9D,oFAAoF;YACpF,2FAA2F;YAC3F,4EAA4E;YAC5E,6CAA6C,EAAE,CAAE,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YAC/E,kDAAkD,EAAE,OAAO;YAC3D,2CAA2C,EAAE,OAAO;YACpD,gDAAgD,EAAE,MAAM;YAExD,kEAAkE;YAClE,8CAA8C,EAAE,MAAM;YACtD,2CAA2C,EAAE,MAAM;YACnD,qCAAqC,EAAE,MAAM;YAC7C,sCAAsC,EAAE,MAAM;SAC/C;KACF;CACF,CAAC"}
+{"version":3,"file":"ngx.js","sourceRoot":"","sources":["../../src/configs/ngx.ts"],"names":[],"mappings":"AAAA,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AACxC,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAChD,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AACzB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,eAAe,GAA2B,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC;IAC7H,CAAC,CAAC,EAAE,0CAA0C,EAAE,OAAO,EAAE;IACzD,CAAC,CAAC,EAAE,CAAC;AAEP;;;;;;GAMG;AACH,MAAM,qBAAqB,GACzB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,kCAAkC,CAAC,CAAC;IACpF,CAAC,CAAC;QACA,4CAA4C,EAAE,OAAO;QACrD,6CAA6C,EAAE,OAAO;KACvD;IACD,CAAC,CAAC,EAAE,CAAC;AAET;;;;GAIG;AACH,MAAM,oBAAoB,GACxB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,iCAAiC,CAAC,CAAC;IACnF,CAAC,CAAC,EAAE,uCAAuC,EAAE,OAAO,EAAE;IACtD,CAAC,CAAC,EAAE,CAAC;AAET;;;;GAIG;AACH,MAAM,CAAC,OAAO,GAAG;IACf,GAAG,aAAa;IAChB;QACE,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;QAC9B,eAAe,EAAE;YACf,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe;YACnC,OAAO,EAAE;gBACP,kBAAkB;gBAClB,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,UAAU;gBACnB,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,UAAU;gBAClB,SAAS,EAAE,UAAU;gBACrB,UAAU,EAAE,UAAU;gBACtB,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,UAAU;gBACnB,OAAO,EAAE,UAAU;aACpB;SACF;QACD,OAAO,EAAE;YACP,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO;YAC3B,iBAAiB,EAAE,aAAa,CAAC,QAAQ;SAC1C;QACD,KAAK,EAAE;YACL,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK;YACzB,yBAAyB;YACzB,oCAAoC,EAAE,OAAO;YAC7C,oCAAoC,EAAE,OAAO;YAC7C,0CAA0C,EAAE,OAAO;YACnD,iCAAiC,EAAE,OAAO;YAC1C,kCAAkC,EAAE,OAAO;YAC3C,8CAA8C,EAAE,OAAO;YACvD,yCAAyC,EAAE,OAAO;YAClD,8CAA8C,EAAE,OAAO;YAEvD,4CAA4C;YAC5C,qCAAqC,EAAE,MAAM;YAC7C,2CAA2C,EAAE,MAAM;YACnD,sCAAsC,EAAE,MAAM;YAC9C,GAAG,eAAe;YAClB,GAAG,qBAAqB;YACxB,GAAG,oBAAoB;SACxB;KACF;IACD;QACE,KAAK,EAAE,CAAC,WAAW,CAAC;QACpB,eAAe,EAAE;YACf,MAAM,EAAE,aAAa,CAAC,cAAc;YACpC,aAAa,EAAE;gBACb,WAAW,EAAE,QAAQ;gBACrB,UAAU,EAAE,QAAQ;aACrB;SACF;QACD,OAAO,EAAE;YACP,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO;YAC3B,0BAA0B,EAAE,aAAa,CAAC,cAAc;SACzD;QACD,KAAK,EAAE;YACL,wCAAwC,EAAE,OAAO;YACjD,gDAAgD,EAAE,CAAE,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;YAClF,iCAAiC,EAAE,OAAO;YAC1C,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,6DAA6D;YAC7D,4EAA4E;YAC5E,gEAAgE;YAChE,8DAA8D;YAC9D,oFAAoF;YACpF,2FAA2F;YAC3F,4EAA4E;YAC5E,6CAA6C,EAAE,CAAE,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YAC/E,kDAAkD,EAAE,OAAO;YAC3D,2CAA2C,EAAE,OAAO;YACpD,gDAAgD,EAAE,MAAM;YAExD,kEAAkE;YAClE,8CAA8C,EAAE,MAAM;YACtD,2CAA2C,EAAE,MAAM;YACnD,qCAAqC,EAAE,MAAM;YAC7C,sCAAsC,EAAE,MAAM;YAC9C,GAAG,eAAe;YAClB,GAAG,qBAAqB;SACzB;KACF;CACF,CAAC"}

package/build/plugin/index.d.ts

@@ -24,6 +24,10 @@ declare const _default: {
         'angular-for-track-logic': import("eslint").Rule.RuleModule;
         'no-ngif-directive': import("eslint").Rule.RuleModule;
         'no-ngfor-directive': import("eslint").Rule.RuleModule;
+        'no-unlisted-inner-html': import("eslint").Rule.RuleModule;
+        'scroll-container-min-h-0': import("eslint").Rule.RuleModule;
+        'module-load-failed-branch': import("eslint").Rule.RuleModule;
+        'no-unused-component': import("eslint").Rule.RuleModule;
     };
     configs: {
         recommended: {

package/build/plugin/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,kBA0DE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,kBAiEE"}

package/build/plugin/index.js

@@ -24,6 +24,10 @@ const no_method_call_in_template_1 = tslib_1.__importDefault(require("./rules/an
 const angular_for_track_logic_1 = tslib_1.__importDefault(require("./rules/angular/angular-for-track-logic"));
 const no_ngif_directive_1 = tslib_1.__importDefault(require("./rules/angular/no-ngif-directive"));
 const no_ngfor_directive_1 = tslib_1.__importDefault(require("./rules/angular/no-ngfor-directive"));
+const no_unlisted_inner_html_1 = tslib_1.__importDefault(require("./rules/angular/no-unlisted-inner-html"));
+const scroll_container_min_h_0_1 = tslib_1.__importDefault(require("./rules/angular/scroll-container-min-h-0"));
+const module_load_failed_branch_1 = tslib_1.__importDefault(require("./rules/angular/module-load-failed-branch"));
+const no_unused_component_1 = tslib_1.__importDefault(require("./rules/angular/no-unused-component"));
 module.exports = {
     rules: {
         'explicit-types': explicit_types_1.default,
@@ -52,6 +56,13 @@ module.exports = {
         'angular-for-track-logic': angular_for_track_logic_1.default,
         'no-ngif-directive': no_ngif_directive_1.default,
         'no-ngfor-directive': no_ngfor_directive_1.default,
+        // BFR-QA-005 — XSS-surface guard (baseline-aware)
+        'no-unlisted-inner-html': no_unlisted_inner_html_1.default,
+        // BFR-QA-004 — UI building blocks guard (baseline-aware)
+        'scroll-container-min-h-0': scroll_container_min_h_0_1.default,
+        'module-load-failed-branch': module_load_failed_branch_1.default,
+        // BFR-QA-006 — built-but-unused component guard (baseline-aware, project-wide)
+        'no-unused-component': no_unused_component_1.default,
     },
     configs: {
         recommended: {

package/build/plugin/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":";;AAAA,oFAAuD;AACvD,uFAA0D;AAC1D,sFAAyD;AACzD,2FAA6D;AAC7D,uFAA4D;AAC5D,kIAAgF;AAChF,0GAAiE;AACjE,kHAAmE;AACnE,sHAA4E;AAC5E,sFAAwD;AAExD,+EAAiD;AACjD,iFAAmD;AACnD,+FAAiE;AACjE,iGAAkE;AAClE,2GAA4E;AAC5E,+FAAiE;AACjE,6GAA8E;AAE9E,kGAAoE;AACpE,8GAA+E;AAC/E,oGAAsE;AACtE,oHAAoF;AACpF,8GAA+E;AAC/E,kGAAoE;AACpE,oGAAsE;AAEtE,iBAAS;IACP,KAAK,EAAE;QACL,gBAAgB,EAAE,wBAAiB;QACnC,cAAc,EAAE,sBAAe;QAC/B,gBAAgB,EAAE,wBAAgB;QAClC,cAAc,EAAE,sBAAiB;QACjC,uCAAuC,EAAE,+CAAmB;QAC5D,2BAA2B,EAAE,mCAAgB;QAC7C,+BAA+B,EAAE,uCAAc;QAC/C,iCAAiC,EAAE,yCAAqB;QACxD,iBAAiB,EAAE,yBAAiB;QAEpC,iBAAiB,EAAE,yBAAkB;QAErC,gDAAgD;QAChD,YAAY,EAAE,oBAAY;QAC1B,aAAa,EAAE,qBAAa;QAC5B,oBAAoB,EAAE,4BAAoB;QAC1C,qBAAqB,EAAE,6BAAoB;QAC3C,0BAA0B,EAAE,kCAAyB;QACrD,oBAAoB,EAAE,4BAAoB;QAC1C,2BAA2B,EAAE,mCAA0B;QAEvD,kEAAkE;QAClE,mBAAmB,EAAE,2BAAmB;QACxC,yBAAyB,EAAE,iCAAwB;QACnD,oBAAoB,EAAE,4BAAoB;QAC1C,4BAA4B,EAAE,oCAA0B;QACxD,yBAAyB,EAAE,iCAAwB;QACnD,mBAAmB,EAAE,2BAAmB;QACxC,oBAAoB,EAAE,4BAAoB;KAC3C;IACD,OAAO,EAAE;QACP,WAAW,EAAE;YACX,KAAK,EAAE;gBACL,kCAAkC,EAAE,MAAM;gBAC1C,gCAAgC,EAAE,MAAM;gBACxC,kCAAkC,EAAE,MAAM;gBAC1C,gCAAgC,EAAE,MAAM;gBACxC,yDAAyD,EAAE,MAAM;gBACjE,6CAA6C,EAAE,MAAM;gBACrD,iDAAiD,EAAE,MAAM;gBACzD,mDAAmD,EAAE,MAAM;gBAC3D,mCAAmC,EAAE,MAAM;gBAE3C,mCAAmC,EAAE,MAAM;gBAE3C,gDAAgD;gBAChD,8BAA8B,EAAE,MAAM;gBACtC,+BAA+B,EAAE,MAAM;gBACvC,sCAAsC,EAAE,MAAM;gBAC9C,uCAAuC,EAAE,MAAM;gBAC/C,4CAA4C,EAAE,MAAM;gBACpD,sCAAsC,EAAE,MAAM;gBAC9C,6CAA6C,EAAE,MAAM;aACtD;SACF;KACF;CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":";;AAAA,oFAAuD;AACvD,uFAA0D;AAC1D,sFAAyD;AACzD,2FAA6D;AAC7D,uFAA4D;AAC5D,kIAAgF;AAChF,0GAAiE;AACjE,kHAAmE;AACnE,sHAA4E;AAC5E,sFAAwD;AAExD,+EAAiD;AACjD,iFAAmD;AACnD,+FAAiE;AACjE,iGAAkE;AAClE,2GAA4E;AAC5E,+FAAiE;AACjE,6GAA8E;AAE9E,kGAAoE;AACpE,8GAA+E;AAC/E,oGAAsE;AACtE,oHAAoF;AACpF,8GAA+E;AAC/E,kGAAoE;AACpE,oGAAsE;AACtE,4GAA6E;AAC7E,gHAAgF;AAChF,kHAAmF;AACnF,sGAAwE;AAExE,iBAAS;IACP,KAAK,EAAE;QACL,gBAAgB,EAAE,wBAAiB;QACnC,cAAc,EAAE,sBAAe;QAC/B,gBAAgB,EAAE,wBAAgB;QAClC,cAAc,EAAE,sBAAiB;QACjC,uCAAuC,EAAE,+CAAmB;QAC5D,2BAA2B,EAAE,mCAAgB;QAC7C,+BAA+B,EAAE,uCAAc;QAC/C,iCAAiC,EAAE,yCAAqB;QACxD,iBAAiB,EAAE,yBAAiB;QAEpC,iBAAiB,EAAE,yBAAkB;QAErC,gDAAgD;QAChD,YAAY,EAAE,oBAAY;QAC1B,aAAa,EAAE,qBAAa;QAC5B,oBAAoB,EAAE,4BAAoB;QAC1C,qBAAqB,EAAE,6BAAoB;QAC3C,0BAA0B,EAAE,kCAAyB;QACrD,oBAAoB,EAAE,4BAAoB;QAC1C,2BAA2B,EAAE,mCAA0B;QAEvD,kEAAkE;QAClE,mBAAmB,EAAE,2BAAmB;QACxC,yBAAyB,EAAE,iCAAwB;QACnD,oBAAoB,EAAE,4BAAoB;QAC1C,4BAA4B,EAAE,oCAA0B;QACxD,yBAAyB,EAAE,iCAAwB;QACnD,mBAAmB,EAAE,2BAAmB;QACxC,oBAAoB,EAAE,4BAAoB;QAC1C,kDAAkD;QAClD,wBAAwB,EAAE,gCAAuB;QACjD,yDAAyD;QACzD,0BAA0B,EAAE,kCAAwB;QACpD,2BAA2B,EAAE,mCAA0B;QACvD,+EAA+E;QAC/E,qBAAqB,EAAE,6BAAqB;KAC7C;IACD,OAAO,EAAE;QACP,WAAW,EAAE;YACX,KAAK,EAAE;gBACL,kCAAkC,EAAE,MAAM;gBAC1C,gCAAgC,EAAE,MAAM;gBACxC,kCAAkC,EAAE,MAAM;gBAC1C,gCAAgC,EAAE,MAAM;gBACxC,yDAAyD,EAAE,MAAM;gBACjE,6CAA6C,EAAE,MAAM;gBACrD,iDAAiD,EAAE,MAAM;gBACzD,mDAAmD,EAAE,MAAM;gBAC3D,mCAAmC,EAAE,MAAM;gBAE3C,mCAAmC,EAAE,MAAM;gBAE3C,gDAAgD;gBAChD,8BAA8B,EAAE,MAAM;gBACtC,+BAA+B,EAAE,MAAM;gBACvC,sCAAsC,EAAE,MAAM;gBAC9C,uCAAuC,EAAE,MAAM;gBAC/C,4CAA4C,EAAE,MAAM;gBACpD,sCAAsC,EAAE,MAAM;gBAC9C,6CAA6C,EAAE,MAAM;aACtD;SACF;KACF;CACF,CAAC"}

package/build/plugin/rules/angular/module-load-failed-branch.d.ts

@@ -0,0 +1,11 @@
+import { Rule } from 'eslint';
+/**
+ * BFR-QA-004 ② — a module (`…/_modules/<name>/`) whose templates show a LOADING state (`…Loading…`, `inProgress_$`,
+ * `loading-skeleton`) must also show a FAILED state somewhere (`@if (…error|…failed…)`, a `…load-failed` /
+ * `…error-state` component, a `load…error|failed` test id) — "empty", "loading" and "failed" are three states; without
+ * the third a failed load looks like an empty screen (organizer BUG-QA-ORG-032/-034).
+ * Reported on each loading state of such a module, unless the module is in the committed baseline.
+ */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=module-load-failed-branch.d.ts.map

package/build/plugin/rules/angular/module-load-failed-branch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-load-failed-branch.d.ts","sourceRoot":"","sources":["../../../../src/plugin/rules/angular/module-load-failed-branch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAM9B;;;;;;GAMG;AACH,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAgDhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/build/plugin/rules/angular/module-load-failed-branch.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const ui_building_blocks_rule_context_util_1 = require("./ui-building-blocks-rule-context.util");
+const ui_building_blocks_util_1 = require("./ui-building-blocks.util");
+/**
+ * BFR-QA-004 ② — a module (`…/_modules/<name>/`) whose templates show a LOADING state (`…Loading…`, `inProgress_$`,
+ * `loading-skeleton`) must also show a FAILED state somewhere (`@if (…error|…failed…)`, a `…load-failed` /
+ * `…error-state` component, a `load…error|failed` test id) — "empty", "loading" and "failed" are three states; without
+ * the third a failed load looks like an empty screen (organizer BUG-QA-ORG-032/-034).
+ * Reported on each loading state of such a module, unless the module is in the committed baseline.
+ */
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'A module that shows a loading state must also show a load-failed state.',
+            recommended: true,
+        },
+        schema: ui_building_blocks_rule_context_util_1.UiBuildingBlocks_RuleContext_Util.schema,
+        messages: {
+            noFailedBranch: 'Module {{module}} shows a loading state but no template of it shows a load-FAILED state — a '
+                + 'failed load will look like an empty screen. Add an error branch (e.g. `@if (failed_$()) { … }` with a '
+                + 'retry). (BFR-QA-004)',
+            baselineUnreadable: ui_building_blocks_rule_context_util_1.UiBuildingBlocks_RuleContext_Util.baselineUnreadableMessage,
+        },
+    },
+    create(context) {
+        const filename = context.filename ?? '';
+        const moduleDir = ui_building_blocks_util_1.UiBuildingBlocks_Util.moduleDir(filename);
+        if (!moduleDir || !ui_building_blocks_util_1.UiBuildingBlocks_Util.isInScope(filename)) {
+            return {};
+        }
+        return {
+            Program() {
+                const text = context.sourceCode.text ?? '';
+                const loading = ui_building_blocks_util_1.UiBuildingBlocks_Util.loadingOffsets(text, filename);
+                if (!loading.length) {
+                    return;
+                }
+                const baseline = ui_building_blocks_rule_context_util_1.UiBuildingBlocks_RuleContext_Util.baseline(context);
+                const moduleKey = ui_building_blocks_util_1.UiBuildingBlocks_Util.relativeKey(moduleDir, context.cwd ?? process.cwd());
+                if (baseline.modulesWithoutLoadFailedBranch.includes(moduleKey)
+                    || ui_building_blocks_util_1.UiBuildingBlocks_Util.moduleHasFailedBranch(moduleDir, { filename: filename, text: text })) {
+                    return;
+                }
+                loading.forEach((offset) => {
+                    context.report({
+                        loc: ui_building_blocks_rule_context_util_1.UiBuildingBlocks_RuleContext_Util.loc(text, offset),
+                        messageId: 'noFailedBranch',
+                        data: { module: moduleKey },
+                    });
+                });
+            },
+        };
+    },
+};
+exports.default = rule;
+//# sourceMappingURL=module-load-failed-branch.js.map

package/build/plugin/rules/angular/module-load-failed-branch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-load-failed-branch.js","sourceRoot":"","sources":["../../../../src/plugin/rules/angular/module-load-failed-branch.ts"],"names":[],"mappings":";;AAGA,iGAA2F;AAC3F,uEAAkE;AAElE;;;;;;GAMG;AACH,MAAM,IAAI,GAAoB;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,yEAAyE;YACtF,WAAW,EAAE,IAAI;SAClB;QACD,MAAM,EAAE,wEAAiC,CAAC,MAAM;QAChD,QAAQ,EAAE;YACR,cAAc,EAAE,8FAA8F;kBAC1G,wGAAwG;kBACxG,sBAAsB;YAC1B,kBAAkB,EAAE,wEAAiC,CAAC,yBAAyB;SAChF;KACF;IACD,MAAM,CAAC,OAAyB;QAC9B,MAAM,QAAQ,GAAW,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QAChD,MAAM,SAAS,GAAuB,+CAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEhF,IAAI,CAAC,SAAS,IAAI,CAAC,+CAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,OAAO;gBACL,MAAM,IAAI,GAAW,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;gBACnD,MAAM,OAAO,GAAa,+CAAqB,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAE/E,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBACpB,OAAO;gBACT,CAAC;gBACD,MAAM,QAAQ,GAAwC,wEAAiC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC1G,MAAM,SAAS,GAAW,+CAAqB,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAErG,IAAI,QAAQ,CAAC,8BAA8B,CAAC,QAAQ,CAAC,SAAS,CAAC;uBAC1D,+CAAqB,CAAC,qBAAqB,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;oBAChG,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,OAAO,CAAC,CAAC,MAAc,EAAQ,EAAE;oBACvC,OAAO,CAAC,MAAM,CAAC;wBACb,GAAG,EAAE,wEAAiC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC;wBACxD,SAAS,EAAE,gBAAgB;wBAC3B,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;qBAC5B,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,kBAAe,IAAI,CAAC"}

package/build/plugin/rules/angular/no-unlisted-inner-html.d.ts

@@ -0,0 +1,15 @@
+import { Rule } from 'eslint';
+/**
+ * BFR-QA-005 — XSS-surface guard: every `[innerHTML]` binding and every `DomSanitizer.bypassSecurityTrust…(…)` call is
+ * reported, EXCEPT
+ *  - in a reviewed, allow-listed file (`allow`), and
+ *  - up to the committed per-file BASELINE count (`.dynamo/xss-surface-baseline.json`, written by
+ *    `npx dynamo-xss-surface-baseline`) — so the surfaces that exist today do not fail, only NEW ones do.
+ * Optional `escapePipe`: the project's escaping pipe must escape `& < > "` before it produces HTML.
+ *
+ * Why a rule-level baseline and not ESLint's `--suppress-rule`: the native suppressions are applied only by the ESLint
+ * CLI, NOT by the `ESLint` API that `ng lint` uses (measured on eslint 9.39.5) — Angular consumers would never see it.
+ */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-unlisted-inner-html.d.ts.map

package/build/plugin/rules/angular/no-unlisted-inner-html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unlisted-inner-html.d.ts","sourceRoot":"","sources":["../../../../src/plugin/rules/angular/no-unlisted-inner-html.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAgC9B;;;;;;;;;;GAUG;AACH,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAsFhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/build/plugin/rules/angular/no-unlisted-inner-html.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+const path = tslib_1.__importStar(require("path"));
+const xss_surface_util_1 = require("./xss-surface.util");
+/** Offset → { line, column } in a source text. */
+function toLoc(text, index) {
+    const before = text.slice(0, index);
+    const line = before.split('\n').length;
+    const lastNewline = before.lastIndexOf('\n');
+    return { line: line, column: lastNewline === -1 ? index : index - lastNewline - 1 };
+}
+/**
+ * BFR-QA-005 — XSS-surface guard: every `[innerHTML]` binding and every `DomSanitizer.bypassSecurityTrust…(…)` call is
+ * reported, EXCEPT
+ *  - in a reviewed, allow-listed file (`allow`), and
+ *  - up to the committed per-file BASELINE count (`.dynamo/xss-surface-baseline.json`, written by
+ *    `npx dynamo-xss-surface-baseline`) — so the surfaces that exist today do not fail, only NEW ones do.
+ * Optional `escapePipe`: the project's escaping pipe must escape `& < > "` before it produces HTML.
+ *
+ * Why a rule-level baseline and not ESLint's `--suppress-rule`: the native suppressions are applied only by the ESLint
+ * CLI, NOT by the `ESLint` API that `ng lint` uses (measured on eslint 9.39.5) — Angular consumers would never see it.
+ */
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Forbid new `[innerHTML]` bindings and `bypassSecurityTrust*` calls outside the reviewed allow-list '
+                + 'and the committed baseline (XSS surface).',
+            recommended: true,
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allow: { type: 'array', items: { type: 'string' } },
+                    baselineFile: { type: 'string' },
+                    escapePipe: { type: 'string' },
+                },
+                additionalProperties: false,
+            },
+        ],
+        messages: {
+            innerHtml: 'New `[innerHTML]` binding ({{count}} in this file, baseline {{baseline}}): a string reaches the DOM '
+                + 'as HTML. Bind text instead, or pipe it through the escaping pipe and add the file to the reviewed `allow` '
+                + 'list (BFR-QA-005).',
+            bypass: 'New `bypassSecurityTrust…` call ({{count}} in this file, baseline {{baseline}}): it switches Angular\'s '
+                + 'sanitizer off for this value. Add the file to the reviewed `allow` list only after review (BFR-QA-005).',
+            escapePipe: 'The escaping pipe is not sound: {{problem}} — user text would reach `[innerHTML]` unescaped '
+                + '(BFR-QA-005).',
+            baselineUnreadable: 'The XSS-surface baseline {{file}} cannot be read ({{reason}}) — regenerate it with '
+                + '`npx dynamo-xss-surface-baseline`.',
+        },
+    },
+    create(context) {
+        const filename = context.filename ?? '';
+        if (!xss_surface_util_1.XssSurface_Util.isInScope(filename)) {
+            return {};
+        }
+        const options = context.options[0] ?? {};
+        const cwd = context.cwd ?? process.cwd();
+        const key = xss_surface_util_1.XssSurface_Util.relativeKey(filename, cwd);
+        return {
+            Program() {
+                const text = context.sourceCode.text ?? '';
+                const first = { line: 1, column: 0 };
+                if (options.escapePipe && key.endsWith(xss_surface_util_1.XssSurface_Util.normalize(options.escapePipe))) {
+                    xss_surface_util_1.XssSurface_Util.checkEscapePipe(text).forEach((problem) => {
+                        context.report({ loc: { start: first, end: first }, messageId: 'escapePipe', data: { problem: problem } });
+                    });
+                }
+                if ((options.allow ?? []).some((suffix) => key.endsWith(xss_surface_util_1.XssSurface_Util.normalize(suffix)))) {
+                    return;
+                }
+                const baselinePath = path.resolve(cwd, options.baselineFile ?? xss_surface_util_1.XssSurface_Util.defaultBaselineFile);
+                let baseline;
+                try {
+                    baseline = xss_surface_util_1.XssSurface_Util.readBaseline(baselinePath);
+                }
+                catch (error) {
+                    context.report({
+                        loc: { start: first, end: first },
+                        messageId: 'baselineUnreadable',
+                        data: { file: baselinePath, reason: error instanceof Error ? error.message : String(error) },
+                    });
+                    baseline = {};
+                }
+                const found = xss_surface_util_1.XssSurface_Util.scan(text, filename);
+                const accepted = baseline[key] ?? { innerHtml: 0, bypass: 0 };
+                ['innerHtml', 'bypass'].forEach((kind) => {
+                    // the occurrences BEYOND the accepted count are the new ones (the later ones in the file)
+                    found[kind].slice(accepted[kind]).forEach((offset) => {
+                        const start = toLoc(text, offset);
+                        context.report({
+                            loc: { start: start, end: { line: start.line, column: start.column + 1 } },
+                            messageId: kind,
+                            data: { count: String(found[kind].length), baseline: String(accepted[kind]) },
+                        });
+                    });
+                });
+            },
+        };
+    },
+};
+exports.default = rule;
+//# sourceMappingURL=no-unlisted-inner-html.js.map

package/build/plugin/rules/angular/no-unlisted-inner-html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unlisted-inner-html.js","sourceRoot":"","sources":["../../../../src/plugin/rules/angular/no-unlisted-inner-html.ts"],"names":[],"mappings":";;;AACA,mDAA6B;AAI7B,yDAAqD;AAkBrD,kDAAkD;AAClD,SAAS,KAAK,CAAC,IAAY,EAAE,KAAa;IACxC,MAAM,MAAM,GAAW,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAW,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,WAAW,GAAW,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAErD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,IAAI,GAAoB;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,qGAAqG;kBAC9G,2CAA2C;YAC/C,WAAW,EAAE,IAAI;SAClB;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACnD,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAChC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC/B;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;QACD,QAAQ,EAAE;YACR,SAAS,EAAE,sGAAsG;kBAC7G,4GAA4G;kBAC5G,oBAAoB;YACxB,MAAM,EAAE,0GAA0G;kBAC9G,yGAAyG;YAC7G,UAAU,EAAE,8FAA8F;kBACtG,eAAe;YACnB,kBAAkB,EAAE,qFAAqF;kBACrG,oCAAoC;SACzC;KACF;IACD,MAAM,CAAC,OAAyB;QAC9B,MAAM,QAAQ,GAAW,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QAEhD,IAAI,CAAC,kCAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAgC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,GAAG,GAAW,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,MAAM,GAAG,GAAW,kCAAe,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAE/D,OAAO;YACL,OAAO;gBACL,MAAM,IAAI,GAAW,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;gBACnD,MAAM,KAAK,GAAyB,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;gBAE3D,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,kCAAe,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;oBACtF,kCAAe,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,OAAe,EAAQ,EAAE;wBACtE,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;oBAC7G,CAAC,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,kCAAe,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7G,OAAO;gBACT,CAAC;gBACD,MAAM,YAAY,GAAW,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,IAAI,kCAAe,CAAC,mBAAmB,CAAC,CAAC;gBAC5G,IAAI,QAA4C,CAAC;gBAEjD,IAAI,CAAC;oBACH,QAAQ,GAAG,kCAAe,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;gBACxD,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACxB,OAAO,CAAC,MAAM,CAAC;wBACb,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;wBACjC,SAAS,EAAE,oBAAoB;wBAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBAC7F,CAAC,CAAC;oBACH,QAAQ,GAAG,EAAE,CAAC;gBAChB,CAAC;gBACD,MAAM,KAAK,GAAqC,kCAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACrF,MAAM,QAAQ,GAA0C,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;gBAEpG,CAAE,WAAW,EAAE,QAAQ,CAAY,CAAC,OAAO,CAAC,CAAC,IAA4B,EAAQ,EAAE;oBAClF,0FAA0F;oBAC1F,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAc,EAAQ,EAAE;wBACjE,MAAM,KAAK,GAAyB,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;wBAExD,OAAO,CAAC,MAAM,CAAC;4BACb,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE;4BAC1E,SAAS,EAAE,IAAI;4BACf,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE;yBAC9E,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,kBAAe,IAAI,CAAC"}

package/build/plugin/rules/angular/no-unused-component.d.ts

@@ -0,0 +1,11 @@
+import { Rule } from 'eslint';
+/**
+ * BFR-QA-006 — an Angular `@Component` that is built but used NOWHERE in the project (the folder ESLint runs in):
+ * its selector is in no comment-free template and its class is referenced in no other source in a usage position
+ * (an `import` line or an `imports` / `declarations` / `exports` entry is NOT a usage). Reported on the component
+ * class, unless it is in the committed baseline (`.dynamo/unused-components-baseline.json`). The scan and its rules:
+ * `UnusedComponent_Util`. Meant for APPS — in a library every public component is "unused" inside the package.
+ */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-unused-component.d.ts.map

package/build/plugin/rules/angular/no-unused-component.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unused-component.d.ts","sourceRoot":"","sources":["../../../../src/plugin/rules/angular/no-unused-component.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAO9B;;;;;;GAMG;AACH,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAqEhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/build/plugin/rules/angular/no-unused-component.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+const path = tslib_1.__importStar(require("path"));
+const ui_building_blocks_rule_context_util_1 = require("./ui-building-blocks-rule-context.util");
+const unused_component_util_1 = require("./unused-component.util");
+/**
+ * BFR-QA-006 — an Angular `@Component` that is built but used NOWHERE in the project (the folder ESLint runs in):
+ * its selector is in no comment-free template and its class is referenced in no other source in a usage position
+ * (an `import` line or an `imports` / `declarations` / `exports` entry is NOT a usage). Reported on the component
+ * class, unless it is in the committed baseline (`.dynamo/unused-components-baseline.json`). The scan and its rules:
+ * `UnusedComponent_Util`. Meant for APPS — in a library every public component is "unused" inside the package.
+ */
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'An Angular component must be used somewhere (template selector, route, dialog, …) — not only built.',
+            recommended: true,
+        },
+        schema: ui_building_blocks_rule_context_util_1.UiBuildingBlocks_RuleContext_Util.schema,
+        messages: {
+            unused: '{{className}} is built but used nowhere: its selector ({{selectors}}) is in no template and nothing '
+                + 'routes / opens / creates it (an import or an `imports`/`declarations` entry is not a usage). Wire it in, or '
+                + 'delete it. (BFR-QA-006)',
+            unusedCommented: '{{className}} is built but used nowhere — and a reference to it is COMMENTED OUT somewhere: a '
+                + 'finished feature may be switched off. Wire it back in, or delete it. (BFR-QA-006)',
+            baselineUnreadable: 'The unused-components baseline {{file}} cannot be read ({{reason}}) — regenerate it with '
+                + '`npx dynamo-unused-components-baseline`.',
+        },
+    },
+    create(context) {
+        const filename = context.filename ?? '';
+        const normalized = unused_component_util_1.UnusedComponent_Util.normalize(filename);
+        if (!normalized.endsWith('.ts') || normalized.endsWith('.spec.ts') || normalized.endsWith('.stories.ts')
+            || normalized.endsWith('.d.ts')) {
+            return {};
+        }
+        return {
+            Program() {
+                const text = context.sourceCode.text ?? '';
+                if (!unused_component_util_1.UnusedComponent_Util.componentsOf(text).length) {
+                    return;
+                }
+                const cwd = context.cwd ?? process.cwd();
+                const options = context.options[0] ?? {};
+                const baselinePath = path.resolve(cwd, options.baselineFile ?? unused_component_util_1.UnusedComponent_Util.defaultBaselineFile);
+                let accepted = [];
+                try {
+                    accepted = unused_component_util_1.UnusedComponent_Util.readBaseline(baselinePath);
+                }
+                catch (error) {
+                    context.report({
+                        loc: { start: { line: 1, column: 0 }, end: { line: 1, column: 0 } },
+                        messageId: 'baselineUnreadable',
+                        data: { file: baselinePath, reason: error instanceof Error ? error.message : String(error) },
+                    });
+                }
+                const key = unused_component_util_1.UnusedComponent_Util.normalize(path.relative(cwd, filename));
+                const findings = unused_component_util_1.UnusedComponent_Util.findUnused([{ file: key, text: text }], unused_component_util_1.UnusedComponent_Util.projectIndex(cwd).index);
+                findings
+                    .filter((finding) => !accepted.includes(unused_component_util_1.UnusedComponent_Util.key(finding)))
+                    .forEach((finding) => {
+                    context.report({
+                        loc: ui_building_blocks_rule_context_util_1.UiBuildingBlocks_RuleContext_Util.loc(text, finding.offset),
+                        messageId: finding.commentedOut ? 'unusedCommented' : 'unused',
+                        data: {
+                            className: finding.className,
+                            selectors: finding.selectors.length ? finding.selectors.join(', ') : 'none',
+                        },
+                    });
+                });
+            },
+        };
+    },
+};
+exports.default = rule;
+//# sourceMappingURL=no-unused-component.js.map

package/build/plugin/rules/angular/no-unused-component.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unused-component.js","sourceRoot":"","sources":["../../../../src/plugin/rules/angular/no-unused-component.ts"],"names":[],"mappings":";;;AACA,mDAA6B;AAE7B,iGAA2F;AAE3F,mEAA+D;AAE/D;;;;;;GAMG;AACH,MAAM,IAAI,GAAoB;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,qGAAqG;YAClH,WAAW,EAAE,IAAI;SAClB;QACD,MAAM,EAAE,wEAAiC,CAAC,MAAM;QAChD,QAAQ,EAAE;YACR,MAAM,EAAE,sGAAsG;kBAC1G,8GAA8G;kBAC9G,yBAAyB;YAC7B,eAAe,EAAE,gGAAgG;kBAC7G,mFAAmF;YACvF,kBAAkB,EAAE,2FAA2F;kBAC3G,0CAA0C;SAC/C;KACF;IACD,MAAM,CAAC,OAAyB;QAC9B,MAAM,QAAQ,GAAW,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QAChD,MAAM,UAAU,GAAW,4CAAoB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEpE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC;eACnG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,OAAO;gBACL,MAAM,IAAI,GAAW,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;gBAEnD,IAAI,CAAC,4CAAoB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;oBACpD,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAW,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBACjD,MAAM,OAAO,GAA8B,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACpE,MAAM,YAAY,GAAW,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,IAAI,4CAAoB,CAAC,mBAAmB,CAAC,CAAC;gBACjH,IAAI,QAAQ,GAAa,EAAE,CAAC;gBAE5B,IAAI,CAAC;oBACH,QAAQ,GAAG,4CAAoB,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC7D,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACxB,OAAO,CAAC,MAAM,CAAC;wBACb,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE;wBACnE,SAAS,EAAE,oBAAoB;wBAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBAC7F,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,GAAW,4CAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACjF,MAAM,QAAQ,GAAwC,4CAAoB,CAAC,UAAU,CACnF,CAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAE,EAAE,4CAAoB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,CAC5E,CAAC;gBAEF,QAAQ;qBACL,MAAM,CAAC,CAAC,OAA0C,EAAW,EAAE,CAC9D,CAAC,QAAQ,CAAC,QAAQ,CAAC,4CAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;qBACvD,OAAO,CAAC,CAAC,OAA0C,EAAQ,EAAE;oBAC5D,OAAO,CAAC,MAAM,CAAC;wBACb,GAAG,EAAE,wEAAiC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;wBAChE,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ;wBAC9D,IAAI,EAAE;4BACJ,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;yBAC5E;qBACF,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,kBAAe,IAAI,CAAC"}

package/build/plugin/rules/angular/scroll-container-min-h-0.d.ts

@@ -0,0 +1,11 @@
+import { Rule } from 'eslint';
+/**
+ * BFR-QA-004 ① — a scroll container (`overflow-(y-)auto|scroll`, or a component tag listed as a scroller in the
+ * baseline `settings.scrollerTags`) that will NOT scroll: between it and the element giving the chain its height, a
+ * column-flex item lacks `min-h-0`, so the chain grows to the content height (organizer BUG-QA-ORG-029).
+ * Reported beyond the committed per-file baseline only — today's cases pass, new ones fail.
+ * The analysis and its limits: `UiBuildingBlocks_Util.scrollFindings`.
+ */
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=scroll-container-min-h-0.d.ts.map

package/build/plugin/rules/angular/scroll-container-min-h-0.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scroll-container-min-h-0.d.ts","sourceRoot":"","sources":["../../../../src/plugin/rules/angular/scroll-container-min-h-0.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAO9B;;;;;;GAMG;AACH,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAiDhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/build/plugin/rules/angular/scroll-container-min-h-0.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const ui_building_blocks_rule_context_util_1 = require("./ui-building-blocks-rule-context.util");
+const ui_building_blocks_util_1 = require("./ui-building-blocks.util");
+/**
+ * BFR-QA-004 ① — a scroll container (`overflow-(y-)auto|scroll`, or a component tag listed as a scroller in the
+ * baseline `settings.scrollerTags`) that will NOT scroll: between it and the element giving the chain its height, a
+ * column-flex item lacks `min-h-0`, so the chain grows to the content height (organizer BUG-QA-ORG-029).
+ * Reported beyond the committed per-file baseline only — today's cases pass, new ones fail.
+ * The analysis and its limits: `UiBuildingBlocks_Util.scrollFindings`.
+ */
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'A scroll container must not sit under a column-flex item without `min-h-0` (it would never '
+                + 'scroll).',
+            recommended: true,
+        },
+        schema: ui_building_blocks_rule_context_util_1.UiBuildingBlocks_RuleContext_Util.schema,
+        messages: {
+            noMinH0: 'This <{{tag}}> scroll container will not scroll: its ancestor <{{culpritTag}}> (line {{culpritLine}}) '
+                + 'is a column-flex item without `min-h-0`, so the chain grows to the content height. Add `min-h-0` there '
+                + '(e.g. `class="flex-1 min-h-0"`). ({{count}} in this file, baseline {{baseline}}; BFR-QA-004)',
+            baselineUnreadable: ui_building_blocks_rule_context_util_1.UiBuildingBlocks_RuleContext_Util.baselineUnreadableMessage,
+        },
+    },
+    create(context) {
+        const filename = context.filename ?? '';
+        if (!ui_building_blocks_util_1.UiBuildingBlocks_Util.isInScope(filename)) {
+            return {};
+        }
+        return {
+            Program() {
+                const text = context.sourceCode.text ?? '';
+                const baseline = ui_building_blocks_rule_context_util_1.UiBuildingBlocks_RuleContext_Util.baseline(context);
+                const key = ui_building_blocks_util_1.UiBuildingBlocks_Util.relativeKey(filename, context.cwd ?? process.cwd());
+                const findings = ui_building_blocks_util_1.UiBuildingBlocks_Util.scrollFindings(text, filename, baseline.scrollerTags);
+                const accepted = baseline.scrollContainers[key] ?? 0;
+                // the findings BEYOND the accepted count are the new ones (the later ones in the file)
+                findings.slice(accepted).forEach((finding) => {
+                    context.report({
+                        loc: ui_building_blocks_rule_context_util_1.UiBuildingBlocks_RuleContext_Util.loc(text, finding.offset),
+                        messageId: 'noMinH0',
+                        data: {
+                            tag: finding.tag,
+                            culpritTag: finding.culpritTag,
+                            culpritLine: String(ui_building_blocks_rule_context_util_1.UiBuildingBlocks_RuleContext_Util.line(text, finding.culpritOffset)),
+                            count: String(findings.length),
+                            baseline: String(accepted),
+                        },
+                    });
+                });
+            },
+        };
+    },
+};
+exports.default = rule;
+//# sourceMappingURL=scroll-container-min-h-0.js.map