@gaia-harness/lint 3.0.4 → 3.1.1

package/README.md

@@ -67,17 +67,17 @@ new source root: no per-config override blocks needed.
 | Property         | Shape                            | Includes                                                                                                                                          | Required? |
 | ---------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
 | `base`           | `Linter.Config[]`                | JS recommended, TypeScript (typescript-eslint), `import-x`, unused-disable-directive reporting at error, `eslint-comments` (every disable states a reason), `prefer-arrow-functions`, lodash/underscore guard, `no-restricted-imports` (bans bare `@conform-to/zod`) | required  |
-| `react`          | `Linter.Config[]`                | `eslint-plugin-react`, `react-hooks`, `jsx-a11y`, `react-refresh` (Fast Refresh-safe exports), `react-you-might-not-need-an-effect` (Effect misuse), nine `@eslint-react` rules (Effect cleanup, React 19 forms), GAIA-specific React rules | required for React apps |
-| `reactRouter`    | `Linter.Config[]`                | Relaxations for React Router framework mode, route-module exports allowed by `react-refresh`, plus `no-imperative-query-fetch` (custom). Spread **after** `react`. See [Router-specific rules](#router-specific-rules) | React Router only |
+| `react`          | `Linter.Config[]`                | `eslint-plugin-react`, `react-hooks`, `jsx-a11y`, `react-refresh` (Fast Refresh-safe exports), `react-you-might-not-need-an-effect` (Effect misuse), nine `@eslint-react` rules (Effect cleanup, React 19 forms), 77 curated `react-doctor` rules (SSR and hydration, HTML validity, accessibility, render and Effect correctness, performance, motion, component size and complexity), GAIA-specific React rules. See [react-doctor rules](#react-doctor-rules) | required for React apps |
+| `reactRouter`    | `Linter.Config[]`                | Relaxations for React Router framework mode, route-module exports allowed by `react-refresh`, plus a TanStack Query block (`no-imperative-query-fetch` (custom), `@tanstack/eslint-plugin-query` recommended, five `react-doctor` Query rules) and 25 curated `react-doctor` router rules with the capability settings they need. Spread **after** `react`. See [Router-specific rules](#router-specific-rules) | React Router only |
 | `styleHygiene`   | `Linter.Config[]`                | `canonical`, `perfectionist`, `unicorn`, `unused-imports`, `check-file`                                                                           | required  |
-| `guardrails`     | `Linter.Config[]`                | `regexp` (recommended, ReDoS included), `no-enum` (custom), `no-switch` (custom), `no-jsx-iife` (custom), `no-null-render` (custom), `no-zod-enum` (custom), `cn-conditional` (custom), `no-relative-import-paths`, `sonarjs`, `import-x`, `prefer-arrow-functions` | required  |
+| `guardrails`     | `Linter.Config[]`                | `regexp` (recommended, ReDoS included), `no-enum` (custom), `no-switch` (custom), `no-jsx-iife` (custom), `no-null-render` (custom), `no-zod-enum` (custom), `cn-conditional` (custom), `no-relative-import-paths`, `sonarjs`, `import-x`, `prefer-arrow-functions`, 14 curated `react-doctor` security and defensive-JS rules | required  |
 | `i18n`           | `Linter.Config[]`                | `i18next/no-literal-string` on raw JSX text under the source dir. See [i18n and Zod](#i18n-and-zod)                                              | optional  |
 | `zod`            | `Linter.Config[]`                | `eslint-plugin-zod` recommended, minus `consistent-import`. See [i18n and Zod](#i18n-and-zod)                                                    | optional  |
 | `testing`        | `Linter.Config[]`                | Vitest + jest-dom config scoped to `*.test.*`, `*.stories.*` and `test/`                                                                          | optional  |
 | `storybook`      | `Linter.Config[]`                | `eslint-plugin-storybook` scoped to `*.stories.*` and `.storybook/main.*`                                                                          | optional  |
 | `playwright`     | `Linter.Config[]`                | `eslint-plugin-playwright` scoped to `.playwright/`                                                                                                | optional  |
 | `prettier`       | `Linter.Config[]`                | `eslint-config-prettier`, must be **last** to disable formatting rules                                                                           | required if using Prettier |
-| `shadcn`         | `(opts?) => Linter.Config[]`     | `@shadcn/lint` token rules plus the vendored-ui exemption; see [shadcn factory](#shadcn-factory). Spread **last**, after `prettier`, with the full GAIA composition before it | optional  |
+| `shadcn`         | `(opts?) => Linter.Config[]`     | `@shadcn/lint` token rules, four curated `react-doctor` composition rules, plus the vendored-ui exemption; see [shadcn factory](#shadcn-factory). Spread **last**, after `prettier`, with the full GAIA composition before it | optional  |
 | `betterTailwind` | `(opts) => Linter.Config[]`      | `eslint-plugin-better-tailwindcss` factory; takes `entryPoint` (path to Tailwind entry CSS) and optional `ignore` (class names to skip)           | optional  |
 | `ignores`        | `Iterable<Linter.Config> & ((opts?) => Linter.Config[])` | `includeIgnoreFile` helper plus GAIA defaults. Spread directly for defaults (`...lint.ignores`) or call with options to override (`...lint.ignores({extra: ['.gaia/**']})`). | recommended |
 
@@ -287,6 +287,29 @@ The `/.react-router/**` glob stays in the `ignores` defaults. It names a
 directory that only exists in a React Router project, so it costs other
 projects nothing.
 
+## react-doctor rules
+
+125 rules from [`eslint-plugin-react-doctor`](https://www.react.doctor/docs/configuration/eslint-and-oxlint-plugins), chosen one by one; no preset is spread. The presets turn back on rules this config turns off on purpose and carry hundreds of rules for libraries it does not cover. The plugin is pinned to an exact version because its rule set changes between releases, and ESLint fails a config that names a rule the installed plugin no longer ships. Every curated id and severity lives in `src/configs/react-doctor.ts`, grouped with the reason for each group, and a snapshot test pins the full list.
+
+| Block | Groups |
+| --- | --- |
+| `react` (77) | SSR and hydration, HTML validity, accessibility, render and state purity, Effect lifecycle, performance (including images and scripts), motion and font, component and hook size and complexity |
+| `reactRouter` (30) | 24 framework-mode rules (loaders, actions, middleware, sessions, cookies, search params, navigation, error UI, the server entry); five Query rules in the Query block; `no-unguarded-browser-global-at-module-scope` on source files only, not tests or stories |
+| `guardrails` (14) | auth tokens in web storage, secrets in client code, dynamic `RegExp` input, path containment, `window.open` without `noopener`, throwing and NaN-producing parses, and similar |
+| `shadcn()` (4) | icon Button label, DialogContent title, InputGroup controls, TabsTrigger inside TabsList |
+
+The vendored shadcn ui files skip the four shadcn rules (they check how GAIA code composes the primitives) and the three motion and font rules (registry classes).
+
+`no-giant-component` reports a component over 300 lines. `no-high-complexity-react-function` reports a component or `use*` hook over 15 cyclomatic or cognitive complexity. Both thresholds are fixed upstream. They stand in for the sonarjs size and complexity rules, which stay off because they do not model components and hooks.
+
+`reactRouter` also sets `settings['react-doctor'].capabilities`. The react-doctor CLI detects these per project; the standalone plugin reads them from settings, and without `react-router-framework` the router rules never recognize a route module's named exports. Once the list is set, a rule runs only when every capability it requires is listed verbatim, so an override that adds a react-doctor rule may need to extend the list.
+
+### TanStack Query
+
+`reactRouter`'s Query block also enables `@tanstack/eslint-plugin-query`'s recommended rules, read from its flat preset, beside `no-imperative-query-fetch`. They match TanStack Query imports, so a project without Query sees nothing. react-doctor's `query-no-rest-destructuring`, `query-stable-query-client` and `query-no-void-query-fn` stay off because the official plugin owns them. TanStack's property-order rules need `onMutate` before `onError` and `queryFn` before the page-param getters, which alphabetical order breaks. So in the object passed straight to those calls, `perfectionist/sort-objects` keeps natural order but sorts those late-binding keys into a last group: `onError` and `onSettled` for `useMutation`; `getNextPageParam` and `getPreviousPageParam` for `useInfiniteQuery`, `useSuspenseInfiniteQuery` and `infiniteQueryOptions`. Its autofix lands on the order TanStack requires. `no-void-query-fn` needs type information.
+
+`react` also turns `react/jsx-key` back on (error, with `checkFragmentShorthand` and `warnOnDuplicates`): Airbnb's non-strict React config turns it off, and nothing else here catches a list rendered without `key`.
+
 ## i18n and Zod
 
 Both are opt-in arrays: spread them only when the project uses the library.

package/dist/configs/guardrails.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../src/configs/guardrails.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,QAAQ,CAAC;AAsRnC,eAAO,MAAM,eAAe,GAAI,WAAW,MAAM,KAAG,MAAM,CAAC,MAAM,EAWhE,CAAC"}
+{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../src/configs/guardrails.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,QAAQ,CAAC;AA0SnC,eAAO,MAAM,eAAe,GAAI,WAAW,MAAM,KAAG,MAAM,CAAC,MAAM,EAYhE,CAAC"}

package/dist/configs/react-doctor.d.ts

@@ -0,0 +1,70 @@
+import type { ESLint, Linter } from 'eslint';
+/**
+ * The one `eslint-plugin-react-doctor` registration every block that names a
+ * `react-doctor/*` rule spreads into its `plugins`. Flat config accepts the
+ * same plugin object in several blocks, so `react`, `reactRouter`, `shadcn()`
+ * and `guardrails` each stay self-contained without a redefinition error.
+ *
+ * Curated rules only, never a preset: the presets re-enable rules GAIA turns
+ * off on purpose and carry hundreds of rules for libraries GAIA does not use.
+ * The rules take no options, carry no autofix and need no type information,
+ * so the same rule ids port unchanged to Oxlint's `oxlint-plugin-react-doctor`.
+ *
+ * The package is pinned to an exact version. The rule set churns between
+ * releases, and ESLint fails a config that names a rule the installed plugin
+ * no longer ships, so a bump is a deliberate change with its tests. Every
+ * curated rule id lives in this file, grouped by the block that applies it,
+ * so a bump is checked against one list.
+ */
+export declare const REACT_DOCTOR_PLUGINS: Record<string, ESLint.Plugin>;
+/**
+ * `react`: motion that ignores reduced-motion and pixel font sizes that ignore
+ * user font scaling. Off in vendored shadcn ui (see `shadcn.ts`).
+ */
+export declare const MOTION_FONT_RULES: Linter.RulesRecord;
+export declare const REACT_DOCTOR_REACT_RULES: Linter.RulesRecord;
+/**
+ * `reactRouter`: framework-mode mistakes in loaders, actions, middleware,
+ * sessions, cookies, search params, navigation and the server entry.
+ */
+export declare const REACT_DOCTOR_REACT_ROUTER_RULES: Linter.RulesRecord;
+/**
+ * `reactRouter`, in the Query block: TanStack Query misuse the official
+ * plugin does not check. Its `no-rest-destructuring`, `stable-query-client`
+ * and `no-void-query-fn` own those cases, so react-doctor's copies stay off.
+ */
+export declare const REACT_DOCTOR_QUERY_RULES: Linter.RulesRecord;
+/** `reactRouter`: source modules only; a module-scope browser global crashes SSR. */
+export declare const REACT_DOCTOR_MODULE_SCOPE_RULES: Linter.RulesRecord;
+/** `guardrails`: security and defensive-JS classes sonarjs and regexp miss. */
+export declare const REACT_DOCTOR_GUARDRAIL_RULES: Linter.RulesRecord;
+/**
+ * `shadcn()`: composition that breaks a shadcn primitive's accessible name,
+ * keyboard model or structure. Off in vendored ui, which defines the
+ * primitives these check.
+ */
+export declare const REACT_DOCTOR_SHADCN_RULES: Linter.RulesRecord;
+/**
+ * The capabilities `reactRouter` declares in `settings['react-doctor']`.
+ * react-doctor's CLI detects them per project; the standalone plugin reads
+ * them from settings. Without `react-router-framework` the react-router rules
+ * never recognize a route module's named `loader`, `action` or
+ * `ErrorBoundary` exports and report nothing.
+ *
+ * Once the list is set, a rule runs only when every entry in its `requires`
+ * appears here verbatim. A versioned entry such as `react-router:7.9` is a
+ * minimum-version claim ("at least 7.9"), matched as a literal string, never
+ * as a range: a project on React Router 8 must still list each lower floor a
+ * rule names. So the list carries every versioned entry the plugin uses that
+ * GAIA's stack floors satisfy (React Router 8, React 19.3, Tailwind 4, Zod 4),
+ * whether or not a curated rule needs it today, so a rule added later finds
+ * its floor. A rule whose `requires` is missing from this list stays silent
+ * with no error; a test in `shadcn.test.ts` reads each enabled rule's
+ * `requires` from the plugin's metadata and fails on any gap.
+ *
+ * `shadcn`, `base-ui` and `tanstack-query` are listed too: their rules match
+ * the components and hooks they check by import, so they stay silent in a
+ * project without that library.
+ */
+export declare const REACT_DOCTOR_CAPABILITIES: string[];
+//# sourceMappingURL=react-doctor.d.ts.map

package/dist/configs/react-doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react-doctor.d.ts","sourceRoot":"","sources":["../../src/configs/react-doctor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,MAAM,EAAE,MAAM,EAAC,MAAM,QAAQ,CAAC;AAE3C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAE9D,CAAC;AA+GF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,WAItC,CAAC;AAaF,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,WAS7C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,+BAA+B,EAAE,MAAM,CAAC,WAyBpD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,WAM7C,CAAC;AAEF,qFAAqF;AACrF,eAAO,MAAM,+BAA+B,EAAE,MAAM,CAAC,WAEpD,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,WAejD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,WAK9C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,yBAAyB,UAwBrC,CAAC"}

package/dist/configs/react-router.d.ts

@@ -21,7 +21,10 @@ import type { Linter } from 'eslint';
  * (`createFileRoute(...)({component: Named})`) and never produces that shape,
  * so a TanStack project wants the rule left on.
  *
- * It also carries one ADDITIVE rule, `no-imperative-query-fetch`, on every
+ * It also carries ADDITIVE rules on every TypeScript file under the source
+ * dir: the curated react-doctor React Router and Query rules with the
+ * capability settings they need, the `@tanstack/eslint-plugin-query`
+ * recommended rules, and `no-imperative-query-fetch`. That last one sits on every
  * TypeScript file under the source dir. It bans `ensureQueryData`,
  * `fetchQuery`, `prefetchQuery` and their infinite variants, so a route has
  * one fetch idiom: `queryClient.query` awaited in a clientLoader, read with

package/dist/configs/react-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"react-router.d.ts","sourceRoot":"","sources":["../../src/configs/react-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,QAAQ,CAAC;AA0BnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,gBAAgB,GAAI,WAAW,MAAM,KAAG,MAAM,CAAC,MAAM,EA2BjE,CAAC"}
+{"version":3,"file":"react-router.d.ts","sourceRoot":"","sources":["../../src/configs/react-router.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAS,MAAM,EAAC,MAAM,QAAQ,CAAC;AA4C3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,gBAAgB,GAAI,WAAW,MAAM,KAAG,MAAM,CAAC,MAAM,EAsEjE,CAAC"}

package/dist/configs/react.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../../src/configs/react.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAS,MAAM,EAAC,MAAM,QAAQ,CAAC;AAE3C;;;;;;;;;GASG;AACH;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;CAGjC,CAAC;AAEX,eAAO,MAAM,KAAK,EAAE,MAAM,CAAC,MAAM,EA+GhC,CAAC"}
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../../src/configs/react.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAS,MAAM,EAAC,MAAM,QAAQ,CAAC;AAM3C;;;;;;;;;GASG;AACH;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;CAGjC,CAAC;AAEX,eAAO,MAAM,KAAK,EAAE,MAAM,CAAC,MAAM,EAgIhC,CAAC"}

package/dist/configs/shadcn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shadcn.d.ts","sourceRoot":"","sources":["../../src/configs/shadcn.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAS,MAAM,EAAC,MAAM,QAAQ,CAAC;AAG3C,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAoLF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,WAAW,GACtB,WAAW,MAAM,EACjB,OAAO,qBAAqB,KAC3B,MAAM,CAAC,MAAM,EA4Df,CAAC"}
+{"version":3,"file":"shadcn.d.ts","sourceRoot":"","sources":["../../src/configs/shadcn.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAS,MAAM,EAAC,MAAM,QAAQ,CAAC;AAQ3C,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAgMF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,WAAW,GACtB,WAAW,MAAM,EACjB,OAAO,qBAAqB,KAC3B,MAAM,CAAC,MAAM,EAsEf,CAAC"}

package/dist/configs/style-hygiene.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"style-hygiene.d.ts","sourceRoot":"","sources":["../../src/configs/style-hygiene.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,QAAQ,CAAC;AAmTnC,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,KAAG,MAAM,CAAC,MAAM,EAMlE,CAAC"}
+{"version":3,"file":"style-hygiene.d.ts","sourceRoot":"","sources":["../../src/configs/style-hygiene.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,QAAQ,CAAC;AAyVnC,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,KAAG,MAAM,CAAC,MAAM,EAMlE,CAAC"}

package/dist/index.js

@@ -703,6 +703,198 @@ var plugin6 = {
 };
 var no_zod_enum_default = plugin6;
 
+// src/configs/react-doctor.ts
+import reactDoctor from "eslint-plugin-react-doctor";
+var REACT_DOCTOR_PLUGINS = {
+  "react-doctor": reactDoctor
+};
+var SSR_RULES = {
+  "react-doctor/no-hydration-branch-on-browser-global": "error",
+  "react-doctor/no-locale-format-in-render": "warn",
+  "react-doctor/no-match-media-in-state-initializer": "warn",
+  "react-doctor/no-unguarded-browser-global-in-render-or-hook-init": "error"
+};
+var HTML_RULES = {
+  "react-doctor/form-control-requires-name": "warn",
+  "react-doctor/html-no-invalid-paragraph-child": "warn",
+  "react-doctor/html-no-invalid-table-nesting": "warn",
+  "react-doctor/html-no-nested-form": "warn",
+  "react-doctor/html-no-nested-interactive": "warn",
+  "react-doctor/no-inert-sticky-position": "warn"
+};
+var A11Y_RULES = {
+  "react-doctor/data-table-requires-accessible-name": "warn",
+  "react-doctor/details-requires-summary": "warn",
+  "react-doctor/dialog-has-accessible-name": "warn",
+  "react-doctor/empty-table-header": "warn",
+  "react-doctor/fieldset-requires-legend": "warn",
+  "react-doctor/html-label-has-single-control": "warn",
+  "react-doctor/no-aria-invalid-without-description": "warn",
+  "react-doctor/no-assertive-status": "warn",
+  "react-doctor/no-autoplay-without-muted": "warn",
+  "react-doctor/no-blocked-paste": "error",
+  "react-doctor/no-disabled-zoom": "error",
+  "react-doctor/no-duplicate-static-id-reference": "error",
+  "react-doctor/no-focusable-content-in-aria-hidden": "warn",
+  "react-doctor/no-hover-only-reveal": "warn",
+  "react-doctor/no-invalid-progress-range": "error",
+  "react-doctor/no-multiple-main-landmarks": "warn",
+  "react-doctor/no-multiple-unlabeled-navigation-landmarks": "warn",
+  "react-doctor/no-placeholder-only-field": "warn",
+  "react-doctor/no-presentation-role-conflict": "warn",
+  "react-doctor/no-responsive-hidden-accessible-name": "warn",
+  "react-doctor/no-skipped-heading-level": "warn",
+  "react-doctor/no-uninformative-aria-label": "warn",
+  "react-doctor/radio-input-missing-name": "warn",
+  "react-doctor/role-button-requires-complete-keyboard-activation": "warn"
+};
+var RENDER_STATE_RULES = {
+  "react-doctor/no-call-component-as-function": "warn",
+  "react-doctor/no-controlled-input-value-without-state-update": "warn",
+  "react-doctor/no-create-context-in-render": "error",
+  "react-doctor/no-create-ref-in-function-component": "warn",
+  "react-doctor/no-default-props": "warn",
+  "react-doctor/no-impure-call-at-module-scope": "warn",
+  "react-doctor/no-indeterminate-attribute": "warn",
+  "react-doctor/no-mutate-queried-dom-node-in-component": "warn",
+  "react-doctor/no-mutating-reducer-state": "error",
+  "react-doctor/no-nondeterministic-id-value-in-render-body": "warn",
+  "react-doctor/no-prop-callback-in-render": "error",
+  "react-doctor/no-side-effect-in-state-updater-function": "warn",
+  "react-doctor/no-uncontrolled-input": "warn",
+  "react-doctor/rerender-functional-setstate": "warn",
+  "react-doctor/waapi-animation-in-render": "error"
+};
+var EFFECT_RULES = {
+  "react-doctor/debounce-no-cleanup": "warn",
+  "react-doctor/effect-raf-loop-needs-cancel": "warn",
+  "react-doctor/no-create-object-url-without-revoke": "warn",
+  "react-doctor/no-fetch-in-effect": "warn",
+  "react-doctor/no-fetch-response-used-without-status-check": "warn",
+  "react-doctor/no-loading-flag-reset-outside-finally": "warn",
+  "react-doctor/no-promise-then-side-effect-in-effect-without-catch": "warn",
+  "react-doctor/no-set-state-after-await-in-effect": "warn",
+  "react-doctor/no-stale-timer-ref": "warn",
+  "react-doctor/no-unbounded-animation-frame-loop": "warn",
+  "react-doctor/no-unowned-async-error-clear": "warn",
+  "react-doctor/pointer-capture-needs-cancel-handler": "warn"
+};
+var PERFORMANCE_RULES = {
+  "react-doctor/async-parallel": "warn",
+  "react-doctor/js-hoist-intl": "warn",
+  "react-doctor/no-eager-new-in-use-state-initializer": "warn",
+  "react-doctor/no-img-lazy-with-high-fetchpriority": "warn",
+  "react-doctor/no-img-without-dimensions": "warn",
+  "react-doctor/no-mixed-srcset-descriptors": "warn",
+  "react-doctor/no-spread-accumulator-in-reduce": "warn",
+  "react-doctor/no-srcset-without-sizes": "warn",
+  "react-doctor/rendering-script-defer-async": "warn",
+  "react-doctor/rerender-lazy-ref-init": "warn",
+  "react-doctor/rerender-lazy-state-init": "warn"
+};
+var MOTION_FONT_RULES = {
+  "react-doctor/no-arbitrary-px-font-size": "warn",
+  "react-doctor/no-smooth-scroll-without-reduced-motion": "warn",
+  "react-doctor/no-ungated-tailwind-animation": "warn"
+};
+var SIZE_RULES = {
+  "react-doctor/no-giant-component": "warn",
+  "react-doctor/no-high-complexity-react-function": "warn"
+};
+var REACT_DOCTOR_REACT_RULES = {
+  ...SSR_RULES,
+  ...HTML_RULES,
+  ...A11Y_RULES,
+  ...RENDER_STATE_RULES,
+  ...EFFECT_RULES,
+  ...PERFORMANCE_RULES,
+  ...MOTION_FONT_RULES,
+  ...SIZE_RULES
+};
+var REACT_DOCTOR_REACT_ROUTER_RULES = {
+  "react-doctor/react-router-csp-nonce-consistency": "error",
+  "react-doctor/react-router-guard-aborted-handle-error": "warn",
+  "react-doctor/react-router-internal-route-anchor": "warn",
+  "react-doctor/react-router-loader-fetch-forwards-signal": "warn",
+  "react-doctor/react-router-loader-parallel-fetch": "warn",
+  "react-doctor/react-router-no-catch-middleware-next": "warn",
+  "react-doctor/react-router-no-client-module-in-server-render": "error",
+  "react-doctor/react-router-no-loader-request-body": "error",
+  "react-doctor/react-router-no-middleware-response-body-consumption": "warn",
+  "react-doctor/react-router-no-multiple-blockers": "error",
+  "react-doctor/react-router-no-multiple-middleware-next": "error",
+  "react-doctor/react-router-no-multiple-set-search-params-in-tick": "warn",
+  "react-doctor/react-router-no-navigate-in-render": "error",
+  "react-doctor/react-router-no-redirect-in-try-catch": "error",
+  "react-doctor/react-router-no-route-module-environment-suffix": "error",
+  "react-doctor/react-router-no-session-mutation-in-loader": "error",
+  "react-doctor/react-router-no-static-cookie-expires": "error",
+  "react-doctor/react-router-no-unsynchronized-search-params-mutation": "error",
+  "react-doctor/react-router-no-use-loader-data-in-error-ui": "error",
+  "react-doctor/react-router-require-root-error-boundary": "error",
+  "react-doctor/react-router-resource-link-requires-reload": "error",
+  "react-doctor/react-router-return-navigation-promise-in-transition": "warn",
+  "react-doctor/react-router-server-middleware-return-response": "error",
+  "react-doctor/react-router-session-mutation-requires-commit": "error"
+};
+var REACT_DOCTOR_QUERY_RULES = {
+  "react-doctor/query-destructure-result": "warn",
+  "react-doctor/query-mutation-missing-invalidation": "warn",
+  "react-doctor/query-no-mutation-in-effect-as-read": "warn",
+  "react-doctor/query-no-query-in-effect": "warn",
+  "react-doctor/query-no-usequery-for-mutation": "warn"
+};
+var REACT_DOCTOR_MODULE_SCOPE_RULES = {
+  "react-doctor/no-unguarded-browser-global-at-module-scope": "warn"
+};
+var REACT_DOCTOR_GUARDRAIL_RULES = {
+  "react-doctor/auth-token-in-web-storage": "warn",
+  "react-doctor/no-document-write": "warn",
+  "react-doctor/no-fill-map-element-as-key": "warn",
+  "react-doctor/no-non-literal-selector-query-without-try-catch": "warn",
+  "react-doctor/no-non-null-assertion-on-maybe-undefined-result": "warn",
+  "react-doctor/no-nullish-coalescing-arithmetic-precedence": "warn",
+  "react-doctor/no-path-prefix-containment": "warn",
+  "react-doctor/no-secrets-in-client-code": "warn",
+  "react-doctor/no-sync-xhr": "warn",
+  "react-doctor/no-unescaped-dynamic-string-in-regexp": "warn",
+  "react-doctor/no-unguarded-numeric-input-parse": "warn",
+  "react-doctor/no-unguarded-throwing-parse-call": "warn",
+  "react-doctor/no-whole-object-default-losing-per-key-defaults": "warn",
+  "react-doctor/window-open-without-noopener": "warn"
+};
+var REACT_DOCTOR_SHADCN_RULES = {
+  "react-doctor/shadcn-dialog-content-requires-title": "warn",
+  "react-doctor/shadcn-icon-button-requires-label": "warn",
+  "react-doctor/shadcn-input-group-no-raw-controls": "warn",
+  "react-doctor/shadcn-tabs-trigger-requires-list": "warn"
+};
+var REACT_DOCTOR_CAPABILITIES = [
+  "base-ui",
+  "react",
+  "react:18",
+  "react:19",
+  "react:19.2",
+  "react-router",
+  "react-router:6.4",
+  "react-router:6.7",
+  "react-router:6.9",
+  "react-router:7",
+  "react-router:7.8",
+  "react-router:7.9",
+  "react-router:7.10",
+  "react-router:8",
+  "react-router-framework",
+  "shadcn",
+  "ssr",
+  "tailwind",
+  "tailwind:3.4",
+  "tailwind:4",
+  "tanstack-query",
+  "zod",
+  "zod:4"
+];
+
 // src/configs/guardrails.ts
 var buildSonarConfig = (sourceDir) => [
   sonarjs.configs.recommended,
@@ -747,6 +939,14 @@ var buildSonarConfig = (sourceDir) => [
 var regexpConfig = [
   { ...regexp.configs["flat/recommended"], name: "regexp" }
 ];
+var reactDoctorGuardrailsConfig = [
+  {
+    files: ["**/*.ts?(x)", "**/*.js?(x)"],
+    name: "react-doctor/guardrails",
+    plugins: REACT_DOCTOR_PLUGINS,
+    rules: REACT_DOCTOR_GUARDRAIL_RULES
+  }
+];
 var cnConditionalConfig = [
   {
     files: ["**/*.ts?(x)", "**/*.js?(x)"],
@@ -900,6 +1100,7 @@ var buildNoRelativeImportPathsConfig = (sourceDir) => [
 var buildGuardrails = (sourceDir) => [
   ...buildSonarConfig(sourceDir),
   ...regexpConfig,
+  ...reactDoctorGuardrailsConfig,
   ...cnConditionalConfig,
   ...noEnumConfig,
   ...noJsxIifeConfig,
@@ -1054,6 +1255,12 @@ var react = [
       "react/jsx-curly-brace-presence": "error",
       "react/jsx-filename-extension": "off",
       "react/jsx-fragments": "error",
+      // airbnb-extended's non-strict react config turns this off, and nothing
+      // else in the bundle catches a list rendered without `key`.
+      "react/jsx-key": [
+        "error",
+        { checkFragmentShorthand: true, warnOnDuplicates: true }
+      ],
       // off by default because it doesn't handle props onXyz function names correctly
       // turn this on from time to time to check for misnamed handlers elsewhere
       "react/jsx-handler-names": ["off", { checkLocalVariables: true }],
@@ -1127,6 +1334,17 @@ var react = [
       "@eslint-react/web-api-no-leaked-timeout": "error"
     }
   },
+  // Curated react-doctor rules (see `react-doctor.ts`, which groups them with
+  // the reason for each group): SSR and hydration hazards, invalid HTML,
+  // accessibility jsx-a11y misses, side effects in render and state updates,
+  // Effect lifecycle and teardown, render-path performance, reduced motion
+  // and font scaling, and component and hook size and complexity.
+  {
+    files: ["**/*.ts?(x)", "**/*.js?(x)"],
+    name: "react-doctor/react",
+    plugins: REACT_DOCTOR_PLUGINS,
+    rules: REACT_DOCTOR_REACT_RULES
+  },
   {
     files: ["**/*.test.ts?(x)", "**/*.stories.ts?(x)"],
     name: "react/test-files",
@@ -1136,6 +1354,9 @@ var react = [
   }
 ];
 
+// src/configs/react-router.ts
+import tanstackQuery from "@tanstack/eslint-plugin-query";
+
 // src/plugins/no-imperative-query-fetch.ts
 var BANNED_METHODS = /* @__PURE__ */ new Map([
   ["ensureInfiniteQueryData", "infiniteQuery"],
@@ -1195,6 +1416,12 @@ var plugin7 = {
 var no_imperative_query_fetch_default = plugin7;
 
 // src/configs/react-router.ts
+var TANSTACK_QUERY_RECOMMENDED_RULES = Object.assign(
+  {},
+  ...tanstackQuery.configs["flat/recommended"].map(
+    (config) => config.rules
+  )
+);
 var ROUTE_MODULE_EXPORTS = [
   "action",
   "clientAction",
@@ -1230,13 +1457,56 @@ var buildReactRouter = (sourceDir) => [
       ]
     }
   },
+  // TanStack Query, one block: `no-imperative-query-fetch`, the official
+  // `@tanstack/eslint-plugin-query` recommended rules, and the react-doctor
+  // Query rules the official plugin does not cover (`react-doctor.ts`). The
+  // official and react-doctor rules match hooks and clients imported from
+  // TanStack Query, so they stay silent in a project without Query.
+  // `no-imperative-query-fetch` matches by method name.
   {
     files: [`${sourceDir}/**/*.ts?(x)`],
     name: "react-router/no-imperative-query-fetch",
-    plugins: { "no-imperative-query-fetch": no_imperative_query_fetch_default },
+    plugins: {
+      "@tanstack/query": tanstackQuery,
+      "no-imperative-query-fetch": no_imperative_query_fetch_default,
+      ...REACT_DOCTOR_PLUGINS
+    },
     rules: {
+      ...TANSTACK_QUERY_RECOMMENDED_RULES,
+      ...REACT_DOCTOR_QUERY_RULES,
       "no-imperative-query-fetch/no-imperative-query-fetch": "error"
     }
+  },
+  // react-doctor's CLI detects a project's capabilities and hands them to its
+  // rules; the standalone plugin reads them from these settings instead (see
+  // `REACT_DOCTOR_CAPABILITIES`). Route detection matches `app/routes/`,
+  // `app/root.*` and `app/entry.*`.
+  {
+    files: [`${sourceDir}/**/*.ts?(x)`],
+    name: "react-doctor/react-router-settings",
+    settings: {
+      "react-doctor": { capabilities: REACT_DOCTOR_CAPABILITIES }
+    }
+  },
+  // Curated react-doctor rules (see `react-doctor.ts`) for React Router
+  // framework-mode mistakes that throw or misbehave at runtime: loaders,
+  // actions, middleware, sessions, cookies, search params, navigation, error
+  // UI and the server entry.
+  {
+    files: [`${sourceDir}/**/*.ts?(x)`],
+    name: "react-doctor/react-router",
+    plugins: REACT_DOCTOR_PLUGINS,
+    rules: REACT_DOCTOR_REACT_ROUTER_RULES
+  },
+  // A browser global read at module scope crashes the server render. Source
+  // modules only: tests, stories and the helpers in `tests/` folders run in a
+  // browser or a DOM environment, never through SSR.
+  {
+    files: [`${sourceDir}/**/*.ts?(x)`],
+    ignores: ["**/*.test.ts?(x)", "**/*.stories.ts?(x)", "**/tests/**"],
+    name: "react-doctor/react-router-module-scope",
+    plugins: REACT_DOCTOR_PLUGINS,
+    rules: REACT_DOCTOR_MODULE_SCOPE_RULES
   }
 ];
 
@@ -1361,6 +1631,18 @@ var VENDORED_UI_RULES_OFF = {
   "react-you-might-not-need-an-effect/no-external-store-subscription": "off",
   "react-you-might-not-need-an-effect/no-initialize-state": "off",
   "react-you-might-not-need-an-effect/no-pass-data-to-parent": "off",
+  // The react-doctor shadcn rules check how GAIA code composes the primitives,
+  // not the primitives themselves. toast.tsx: ToastClose's default
+  // `render={<Button size="icon-sm" />}` reads as an unlabeled icon Button,
+  // but the aria-label sits on the ToastPrimitive.Close that renders it.
+  ...Object.fromEntries(
+    Object.keys(REACT_DOCTOR_SHADCN_RULES).map((rule) => [rule, "off"])
+  ),
+  // Registry animation, scroll and font classes are shadcn's (toast.tsx
+  // animates without a reduced-motion gate).
+  ...Object.fromEntries(
+    Object.keys(MOTION_FONT_RULES).map((rule) => [rule, "off"])
+  ),
   // sidebar.tsx: SidebarRail's <button> carries no `type`.
   "react/button-has-type": "off",
   // carousel.tsx, chart.tsx, toggle-group.tsx pass an inline object to a
@@ -1435,6 +1717,16 @@ var buildShadcn = (sourceDir, opts) => {
         "shadcn/require-static-classes": "error"
       }
     },
+    // Curated react-doctor rules (see `react-doctor.ts`) for shadcn
+    // composition that breaks a primitive: an icon-only Button with no label,
+    // a DialogContent with no title, a raw control in an InputGroup, a
+    // TabsTrigger outside TabsList.
+    {
+      files: [`${sourceDir}/**/*.${SOURCE_EXTENSIONS}`],
+      name: "react-doctor/shadcn",
+      plugins: REACT_DOCTOR_PLUGINS,
+      rules: REACT_DOCTOR_SHADCN_RULES
+    },
     {
       files: uiFiles,
       name: "shadcn/vendored-ui",
@@ -1562,6 +1854,43 @@ var perfectionistConfig = [
           type: "natural"
         }
       ],
+      // TanStack Query reads option order for type inference: the
+      // `@tanstack/query/*-property-order` rules need `onMutate` before
+      // `onError` and `onSettled`, and `queryFn` before the page-param
+      // getters. Plain natural order puts those keys first, so in the object
+      // passed straight to the TanStack call they sort into a last group
+      // instead, natural order everywhere else in it. Every other object
+      // keeps `recommended-natural`'s sort.
+      "perfectionist/sort-objects": [
+        "error",
+        {
+          customGroups: [
+            {
+              elementNamePattern: "^(onError|onSettled)$",
+              groupName: "after-on-mutate"
+            }
+          ],
+          groups: ["unknown", "after-on-mutate"],
+          order: "asc",
+          type: "natural",
+          useConfigurationIf: { callingFunctionNamePattern: "^useMutation$" }
+        },
+        {
+          customGroups: [
+            {
+              elementNamePattern: "^(getNextPageParam|getPreviousPageParam)$",
+              groupName: "after-query-fn"
+            }
+          ],
+          groups: ["unknown", "after-query-fn"],
+          order: "asc",
+          type: "natural",
+          useConfigurationIf: {
+            callingFunctionNamePattern: "^(infiniteQueryOptions|useInfiniteQuery|useSuspenseInfiniteQuery)$"
+          }
+        },
+        { order: "asc", type: "natural" }
+      ],
       "perfectionist/sort-jsx-props": [
         "error",
         {