@gspothq/cli 0.0.0-stage → 0.1.0

package/configurations/library/translations/manifest.toml

@@ -0,0 +1,40 @@
+[configuration]
+title = "Translations"
+requires = ["javascript"]
+description = "Translated interfaces: no literal text in components, and message files that parse and stay complete in every locale."
+
+[detect]
+dependencies = ["next-intl", "react-i18next", "i18next", "react-intl", "@lingui/core"]
+
+[[tool]]
+name = "eslint-plugin-i18next"
+rule_prefix = "i18next"
+kind = "library"
+version = "6.1.5"
+npm = "eslint-plugin-i18next"
+
+[[check]]
+name = "messages"
+example = "If the base locale defines `welcome` but another required locale does not, the check reports the missing key. Add the translated message with matching interpolation arguments."
+level = "recommended"
+stage = "push"
+runs = "scope"
+summary = "Checks next-intl JSON/ICU message files under translations.messages_folder: each message parses, none is empty, no key holds a dot, and every locale holds every key of the base."
+why = "This check compares every locale with the base locale, so missing keys and different interpolation arguments are found across files."
+help = "Correct the message, or add the missing key to the locale."
+
+[check.when]
+dependencies = ["next-intl"]
+setting = "translations.messages_folder"
+
+[rules."NEXT-INTL.md"]
+dependencies = ["next-intl"]
+
+[eslint]
+all_level_rules = ["i18next/no-literal-string"]
+
+[[tool_file]]
+target = ".gspot/config/eslint.config.mjs"
+tool = "eslint"
+fragment = true
+required_tools = ["eslint-plugin-i18next"]

package/configurations/library/translations/rules/NEXT-INTL.md

@@ -0,0 +1,33 @@
+# next-intl
+
+Rules for `next-intl` in a Next.js App Router application. The locale, catalog, and right-to-left (RTL) rules that
+hold for any framework appear in the shared translation rules; these add what the library dictates.
+
+## Configuration
+
+- One request configuration module owns locale resolution, message loading, time zone, and the
+  `now` reference. It validates the candidate locale against the supported list before building a
+  catalog import path. Nothing else resolves a locale.
+- Define routing in one module: locales, default locale, prefix strategy, and pathnames
+  that both the proxy and the navigation helpers import.
+- Use the library's navigation helpers such as `Link`, `redirect`, `usePathname`, `useRouter` for every
+  internal link so locale prefixes and alternate metadata stay correct. Never `next/link` directly
+  in a localized route.
+
+## Server and client boundaries
+
+- Use `getTranslations` in async Server Components. Non-async components can use
+  `useTranslations`; the library selects its server or client implementation from the render context.
+- Keep `now` and `timeZone` identical between the server render and the first browser render so
+  formatted dates and relative times hydrate without mismatch.
+- Generate `alternates` and `canonical` metadata from the routing definition. Do not hand-write
+  locale URLs in metadata.
+
+## Messages
+
+- Handle missing messages through `onError` and choose the visible error text through
+  `getMessageFallback`. The default reports an error and returns a key-based fallback.
+  Configure client callbacks in a Client Component because functions cannot cross the server boundary.
+
+See [request configuration](https://next-intl.dev/docs/usage/configuration) and
+[Server and Client Components](https://next-intl.dev/docs/environments/server-client-components).

package/configurations/library/translations/rules/TRANSLATIONS.md

@@ -0,0 +1,102 @@
+# Translations
+
+Internationalization, or i18n, lets an application support different languages and regional formats.
+A locale names the language and formatting conventions, message catalogs hold the translated text,
+and International Components for Unicode (ICU) MessageFormat adds placeholders, plurals, and selection to messages.
+
+## Locales and routing
+
+- Define the supported locales, the default locale, and locale selection in one place, with Best Current Practice (BCP) 47
+  tags such as `en-GB`.
+- Check a locale from a URL, cookie, or header against the supported list before loading messages,
+  and build catalog import paths from checked values only. Unsupported input gets the documented
+  default or not-found behavior, not a failed dynamic import.
+- Choose the routing deliberately. A public site with locale-prefixed URLs needs locale-aware links,
+  redirects, canonical URLs, alternate-language metadata, and sitemap entries. An application
+  without indexed locale URLs can select the language by cookie or saved preference.
+- Define the precedence among the URL, the saved preference, the negotiated header, and the
+  default, without redirect loops.
+- A request-local i18n configuration owns resolution, and request handling and displayed content
+  use the same locale. Never keep a user's locale in mutable server module state, and partition
+  localized data in server, browser, and content delivery network (CDN) caches.
+
+## Messages and catalogs
+
+Keys name stable product concepts, so a reader finds the owning feature. Never build a key from an
+arbitrary server string, a display name, or an English source sentence.
+
+- Group related messages under one namespace per feature. Share a message only when its meaning
+  and grammatical role match everywhere.
+- Translators get complete sentences or clauses. Never concatenate translated fragments or
+  pluralize by appending an English suffix; use ICU arguments, plurals, selects, and rich text
+  through the library's rendering API.
+- Placeholder names belong to the message contract, so a change to one updates every caller and
+  catalog together.
+- Rich tags stay stable and map to trusted components. Never accept executable markup from a
+  translator or a provider response.
+- Translate safe validation and error codes where the application presents them. A raw schema exception, SQL
+  message, or provider error does not supply a translation key.
+- User-generated content, proper names, identifiers, and developer logs supply interpolation data,
+  not message keys, and stay untranslated.
+
+Translate every application-authored string the application displays to the user. That covers headings, buttons,
+placeholders, toasts, validation errors, accessible names, image alternatives, navigation,
+metadata, list status controls, and the empty, error, and loading states.
+
+Plural categories can differ by locale while every locale takes the same input value. Configure
+the catalog loader for the application's format and namespace layout.
+
+Translations land in the same change as their call sites; an incomplete locale leaves the
+supported list instead. Checks validate catalog structure. List the locales and screens for the
+user to check for linguistic accuracy, dynamic keys, and untranslated UI text. Missing
+show keys during development, and make a production fallback intentional and observable, never
+a silent `catch` that hides a missing catalog.
+
+## Rendering and formatting
+
+- Use the framework's established i18n library. Translate on the server where rendering happens
+  there, and give each client provider the scoped messages its interactive children need, never
+  every locale or the whole catalog.
+- Format numbers, currencies, dates, relative times, and time zones through locale-aware APIs.
+  Never infer currency or time zone from language alone.
+- Use an explicit product time-zone policy. Define when relative timestamps refresh.
+- Localized public routes get localized metadata, and each alternate link points to the matching
+  resource in that locale, including a resource missing in some languages. Never generate an
+  alternate URL that redirects forever or describes missing content.
+
+## Changing the language
+
+1. Keep the current resource, relevant search parameters, and hash where the routing supports them.
+2. Persist the preference through the validated write owner when the product promises persistence.
+3. Navigate through the locale-aware routing, so server-rendered content, client labels, and
+   metadata agree.
+4.
+
+Refresh locale-dependent query keys and results instead of keeping translated data under an
+identity without the locale. 5. Keep focus and scroll position sensible. 6. Report a failed preference write; never show a completed selection that reverts on refresh.
+
+A language menu names each language with a clear label, commonly its native name, not a flag.
+Treat region and currency as separate choices when the product offers them.
+
+## Right-to-left layout
+
+Set the document's `lang` and `dir` for the selected locale. List supported right-to-left (RTL)
+locales and affected screens for the user to check. Use logical spacing and alignment properties, and mirror an icon or image only when
+its meaning requires it. Focus order and horizontal scrolling follow the direction, and record data
+never reverses to display RTL text. Include identifiers and URLs inside translated sentences in that list because their directions mix.
+
+## Verification
+
+List the default locale, another supported locale, and affected screens for the user to check.
+Include long translations, other writing systems, plural cases, rich text, form errors, locale
+selection after refresh, localized navigation, and screen-reader labels. A new RTL locale adds its
+layout and mixed-direction text to that list.
+
+## References
+
+Use documentation matching the installed release and enabled features.
+
+| Topic                | Primary source                                                                          |
+| -------------------- | --------------------------------------------------------------------------------------- |
+| ICU MessageFormat    | [ICU MessageFormat](https://unicode-org.github.io/icu/userguide/format_parse/messages/) |
+| BCP 47 language tags | [Request for Comments (RFC) 5646](https://www.rfc-editor.org/rfc/rfc5646)               |

package/configurations/library/trpc/manifest.toml

@@ -0,0 +1,14 @@
+allowed_words = ["tRPC"]
+
+[configuration]
+title = "tRPC"
+requires = ["javascript"]
+description = "tRPC routers: every procedure validates its input, and client code imports the declared server module as a type only. Name your server module `server` in `[[architecture.module]]`."
+
+[detect]
+dependencies = ["@trpc/server"]
+
+[[eslint.selectors]]
+selector = "CallExpression[callee.property.name=/^(query|mutation|subscription)$/]:not(:has(CallExpression[callee.property.name='input']))"
+message = "Give the procedure an input schema before its resolver, even when the input is nothing."
+role = "routers"

package/configurations/library/trpc/rules/TRPC.md

@@ -0,0 +1,43 @@
+# tRPC
+
+Use the client integration the project has. Do not mix the classic and TanStack-native clients.
+Check the installed release before using a version-specific API.
+
+## Request ownership
+
+Create context from verified identity for each request. Context creation can run during prefetching,
+so it performs no writes. Each operation in a batch authorizes itself; a batch does not create a transaction.
+Authentication proves identity, and resource authorization proves access to the named resource.
+Neither a valid input nor a procedure named public proves permission.
+
+Direct callers receive verified context explicitly. Never store a session in a process-wide
+variable or cast a direct caller into an HTTP request. Procedures that share logic call the same
+authorized domain operation rather than calling each other.
+
+See [authorization](https://trpc.io/docs/server/authorization)
+and [server callers](https://trpc.io/docs/server/server-side-calls).
+
+## Client state and transport
+
+Use generated query options and keys. A mutation key identifies a write, not the queries to
+invalidate. Server rendering and browser consumption use the same QueryClient and serialization
+contract; private results stay out of dehydration. A rendered server total and client-query rows
+need one data owner or coordinated refresh.
+
+Cookie-setting operations use a transport that can finish headers before streaming. Configure
+serialization at both ends and preserve transformer metadata. Bound batch sizes and expensive
+work. One layer owns retries, and retries of a write require an idempotency contract.
+
+See [TanStack integration](https://trpc.io/docs/client/tanstack-react-query/setup)
+and [links](https://trpc.io/docs/client/links).
+
+## Cancellation and events
+
+Forward cancellation to the work owner and release listeners and streams. A disconnected client
+does not prove that a write failed; recover its state by operation identity before retrying.
+Late responses must not update another resource or session.
+
+Subscriptions reauthorize after identity changes. Resumable events use stable identifiers,
+deduplicate replay, and restore a fresh snapshot when retention has expired.
+
+See [subscriptions](https://trpc.io/docs/server/subscriptions).

package/configurations/library/zod/manifest.toml

@@ -0,0 +1,25 @@
+allowed_words = ["Zod"]
+
+[configuration]
+title = "Zod"
+requires = ["javascript"]
+description = "Zod schemas: ESLint rules reject unsafe schema APIs and recommend replacements for deprecated APIs."
+
+[detect]
+dependencies = ["zod"]
+
+[[tool]]
+name = "eslint-plugin-zod"
+rule_prefix = "zod"
+kind = "library"
+version = "4.12.0"
+npm = "eslint-plugin-zod"
+
+[eslint]
+all_level_rules = ["zod/no-any-schema", "zod/no-native-enum", "zod/prefer-meta-last", "zod/prefer-strict-object"]
+
+[[tool_file]]
+target = ".gspot/config/eslint.config.mjs"
+tool = "eslint"
+fragment = true
+required_tools = ["eslint-plugin-zod"]

package/configurations/library/zod/rules/ZOD.md

@@ -0,0 +1,44 @@
+# Zod
+
+Check the installed release and its consumers before choosing an API. Put a runtime schema with
+the feature that owns the contract. Infer input and output types from it rather than keeping a
+second handwritten contract.
+
+## Validate boundaries
+
+Parse values at the boundary that receives them and pass the parsed result inward. Static types,
+a constructed validator, and successful client validation do not validate a server request.
+An invalid provider response shows an integration failure, not invalid user input. A valid identifier
+proves no access.
+
+Choose thrown or returned validation issues to match the boundary. Async checks need async parsing;
+a safe parse does not catch exceptions thrown by custom code or transport decoding. Keep resource
+limits on collections and nesting. Preserve original bytes when signatures depend on them.
+
+See [parsing and inferred types](https://zod.dev/basics).
+
+## Patches and normalization
+
+Derive a patch from fields the caller may edit, not the whole persistence row. Keep omission,
+undefined, null, and empty input distinct. Defaults do not silently turn absence into a write.
+Normalize only where the contract permits it; never trim signed values, passwords, or exact-byte
+identifiers. Coercion must not turn an empty required number into zero.
+
+Select response fields before returning them. A loose object schema does not protect private data.
+Pass request-specific state to validation. Do not capture it in a process-wide schema.
+
+See [schema APIs](https://zod.dev/api).
+
+## Errors and published contracts
+
+Return safe field paths and stable codes. Keep private values out of issues and error messages;
+do not enable raw input reporting for private payloads. Translate at the request or presentation
+boundary without mutating global locale state for one request.
+
+A JSON Schema projection cannot represent every runtime contract. Keep runtime validation and
+verify the exported dialect against meaningful examples. Use an explicit transport schema for
+non-JSON values instead of allowing every value in the projection. Regenerate consumers when the
+contract changes, and check omitted fields, defaults, patches, and date handling after an upgrade.
+
+See [error customization](https://zod.dev/error-customization)
+and [JSON Schema](https://zod.dev/json-schema).

package/configurations/library/zustand/manifest.toml

@@ -0,0 +1,18 @@
+allowed_words = ["Zustand"]
+
+[configuration]
+title = "Zustand"
+requires = ["javascript"]
+description = "Zustand stores: a store is created in a store file, and a component reads it through a selector."
+
+[detect]
+dependencies = ["zustand"]
+
+[[eslint.selectors]]
+selector = "CallExpression[callee.name=/^use[A-Z]\\w*Store$/][arguments.length=0]"
+message = "Pass a selector to the store hook, so the component renders when its slice changes and at no other time."
+
+[[tool_file]]
+target = ".gspot/config/eslint.config.mjs"
+tool = "eslint"
+fragment = true

package/configurations/library/zustand/rules/ZUSTAND.md

@@ -0,0 +1,106 @@
+# Zustand
+
+Zustand holds client state that several components share when local or form state cannot serve them.
+Fetched server data stays in the query cache.
+
+## Scope and initialize the store
+
+- Create a store through a factory, with `createStore` from `zustand/vanilla` when a context
+  provider owns the instance. Report an explicit error for a missing required provider.
+- The provider keeps one instance for its mounted lifetime and exposes it through React context.
+  Consumers call `useStore(store, selector)`. In a Next.js App Router project, declare this provider as a
+  Client Component.
+- In a server-rendered app, create request-dependent stores per request. Never share a store
+  initialized with one user's identity across requests.
+- An action called outside React uses the intended store instance, passed in, never a hidden
+  global store that bypasses request or provider scope.
+- In a server-rendered app, the provider takes an initial snapshot that matches the first browser
+  render. Browser storage, random values, and current timestamps stay out of that snapshot.
+- In a Next.js App Router project, Server Components read authorized server data rather than using
+  the client store to pass data between requests.
+- Place the provider where the state lives: a shared layout keeps state across navigation, and a
+  page or keyed resource provider resets it.
+- New initialization props do not reinitialize an existing store. Define a reconciliation action or
+  remount at a changed resource boundary, keeping drafts when the interaction needs them.
+
+## Select narrowly and keep results stable
+
+- Components select the specific values and actions they read. A large layout or every list row
+  never subscribes to the whole store through an unselected hook.
+- Select a primitive, stored entity, or stable action directly when the consumer needs only that value.
+  A selector that returns a tuple, array, or object of several values uses `useShallow` from a
+  supported entry point such as `zustand/react/shallow`.
+- In Zustand 5, a selector that allocates a new result on every read can cause an update loop.
+  Fallback arrays, objects, and functions stay stable too, and an absent action never becomes a
+  fresh empty callback.
+- Custom equality goes through `zustand/traditional` and its peer dependency; the standard `create`
+  takes no equality argument.
+- Subscribe rows by entity ID. The list owner subscribes to ordering and paging instead of every
+  record's content.
+- Derive values through selectors or computations over authoritative state, never synchronized counts,
+  array copies, or flags that disagree after a deletion, rollback, or reset.
+- `getState()` reads an imperative snapshot without a subscription, so rendered values come from
+  selectors. Release manual subscriptions with their owning component or service.
+
+## Update without losing fields
+
+- Use a functional `set` when the result depends on current state. Zustand merges the returned
+  object at the top level only, so a nested change copies each changed ancestor and keeps unchanged
+  siblings and references.
+- Shallow comparison does not inspect nested values: replace a changed object, Map, Set, or array instead of mutating
+  it. Copy an edited record inside a Map too, because a new Map holding the same mutated record
+  leaves entity selectors on the old reference.
+- Type an empty collection where the code builds it, such as `new Map<string, Entity>()`, without an
+  assertion. New stores and resets create fresh collections.
+- Use `replace: true` only for a complete replacement that keeps the store's shape, actions
+  included. A reset changes the domain state and leaves a usable store.
+- A store that already uses Immer changes only the provided draft. It configures Map and Set
+  support where the installed Immer requires it and keeps non-draftable external objects out of
+  drafts.
+- One store uses one update method, and an immutable-update library joins only when it saves real
+  complexity.
+
+## Actions and slices
+
+- Actions carry domain meaning, such as adding a record, switching a resource, or applying a
+  confirmed save. They live beside their state and keep its validation and related field changes.
+- Changes that form one invariant go in one `set` call. Two actions in sequence make two store
+  transitions, and React render batching does not merge them.
+- Slices organize one cohesive store, with one owner for each field and action, so spreading slices
+  cannot silently overwrite names. Middleware wraps the completed store, not each slice, and slice
+  creator types stay compatible with it.
+- Asynchronous actions keep request identity and cancellation explicit. A delayed action never
+  updates the next resource after the reader moves on.
+
+## Persisted state
+
+- `persist` takes a unique storage name and a `partialize` allowlist of durable fields. Actions,
+  request flags, live handles, access tokens, and credentials stay out.
+- Maps, Sets, and other values that JSON loses get explicit serialization.
+- Persist the current shape. When it changes, reset disposable cached state instead of migrating old
+  shapes, and move required user-authored records to the current shape. Missing, malformed, or
+  unavailable storage yields the initial state.
+- In a server-rendered app, browser restoration stays apart from the first snapshot. Use
+  `skipHydration` and an explicit `rehydrate()` when automatic restoration changes it.
+- Track hydration through the supported callbacks or subscriptions, not one read of
+  `hasHydrated()`, and release the listeners when their owner unmounts.
+- Sign-out and identity or tenant changes reset live private state and clear or partition its
+  persisted copy. Clearing storage alone leaves the in-memory store unchanged.
+- A pending restoration never reapplies the previous identity's data.
+
+## Verification
+
+Check independent provider instances, nested updates, resets, and malformed stored state. A delayed
+update must not change another resource or restore a previous identity's private state.
+
+## References
+
+| Topic             | Primary source                                                                                     |
+| ----------------- | -------------------------------------------------------------------------------------------------- |
+| Next.js setup     | [Next.js guide](https://zustand.docs.pmnd.rs/learn/guides/nextjs)                                  |
+| Immutable updates | [Immutable state](https://zustand.docs.pmnd.rs/learn/guides/immutable-state-and-merging)           |
+| Maps and Sets     | [Maps and Sets](https://zustand.docs.pmnd.rs/learn/guides/maps-and-sets-usage)                     |
+| Immer             | [Immer middleware](https://zustand.docs.pmnd.rs/reference/integrations/immer-middleware)           |
+| Slices            | [Slices pattern](https://zustand.docs.pmnd.rs/learn/guides/slices-pattern)                         |
+| Zustand 5         | [Migrating to v5](https://zustand.docs.pmnd.rs/reference/migrations/migrating-to-v5)               |
+| Persistence       | [Persisting store data](https://zustand.docs.pmnd.rs/reference/integrations/persisting-store-data) |

package/configurations/platform/cloudflare/manifest.toml

@@ -0,0 +1,94 @@
+allowed_words = ["Cloudflare"]
+generated = ["worker-configuration.d.ts"]
+
+[configuration]
+title = "Cloudflare"
+requires = ["javascript"]
+suggests = []
+description = "Cloudflare Pages and Workers: a wrangler configuration that parses and pins its date, headers and redirects files Cloudflare can read, fresh binding types, and the Semgrep rules for workers."
+
+[detect]
+filenames = ["wrangler.toml", "wrangler.json", "wrangler.jsonc", "_worker.js"]
+paths = ["**/functions/_middleware.{js,ts}"]
+dependencies = ["wrangler", "@opennextjs/cloudflare"]
+
+[files]
+extensions = [".d.ts"]
+filenames = ["wrangler.toml", "wrangler.json", "wrangler.jsonc", "_headers", "_redirects"]
+
+[[tool]]
+name = "wrangler"
+install_hint = "Run: npm install --save-dev wrangler"
+system = true
+version_command = ["--version"]
+min_version = "3.78.3"
+npm = "wrangler"
+
+[[tool]]
+name = "v8r"
+
+[[tool_file]]
+source = "semgrep/cloudflare.yml"
+target = ".gspot/config/semgrep/cloudflare.yml"
+tool = "semgrep"
+rule_keys = ["rules"]
+per_scope = true
+when = { configuration = "security" }
+level = "all"
+
+[[check]]
+name = "wrangler"
+tool = ["wrangler", "v8r"]
+command = ["v8r", "--schema", "{wrangler_schema}", "--ignore-errors", "--output-format", "text", "{files}"]
+output = { format = "regex", pattern = "^(?<file>[^#\\s]+)#(?<message>.+)$" }
+files = { filenames = ["wrangler.toml", "wrangler.json", "wrangler.jsonc"] }
+example = "A Wrangler configuration without `compatibility_date` reports the missing date. Add a reviewed date in `YYYY-MM-DD` form, such as `2025-01-31`, and test the Worker against that runtime behavior."
+level = "recommended"
+stage = "commit"
+runs = "scope"
+summary = "Checks that every wrangler configuration parses, names the worker, and pins a compatibility date."
+why = "Without a pinned date the runtime changes behavior under a deployed worker."
+help = "Add the name and a compatibility_date in the form 2025-01-31."
+
+[[check]]
+name = "headers"
+example = "An indented `X-Frame-Options: DENY` line before any path in `_headers` reports that the header sits under no path. Put the intended path, such as `/*`, on the preceding unindented line."
+level = "recommended"
+stage = "commit"
+runs = "scope"
+summary = "Checks that the headers file is blocks of a path line and indented header lines."
+why = "Cloudflare skips a line it cannot read, so a typo silently drops a security header."
+help = "Write each block as a path, then indented lines of a name, a colon, and a value."
+
+[[check]]
+name = "redirects"
+example = "The `_redirects` line `/old /new 999` reports an unsupported redirect status. For an intended permanent redirect, change it to `/old /new 301`."
+level = "recommended"
+stage = "commit"
+runs = "scope"
+summary = "Checks each redirect source, destination, and optional status: 200, 301, 302, 303, 307, or 308, without a force suffix."
+why = "A redirect Cloudflare cannot read is dropped, and the old address starts to answer 404."
+help = "Write the rule as source, destination, status."
+
+[[check]]
+name = "stale-types"
+command = ["wrangler", "types", "{file}", "--env-interface", "{setting:cloudflare.types_interface}"]
+generated_paths = [{ pattern = "**/{setting:cloudflare.types_file}" }]
+example = "A generated Worker environment type file that differs from `wrangler types` output reports drift. Regenerate it using the configured Wrangler project, inspect the changes, and rerun."
+level = "recommended"
+stage = "push"
+runs = "scope"
+tool = "wrangler"
+summary = "Checks that a tracked environment types file matches what wrangler writes."
+why = "Stale binding types let code compile against a binding the configuration dropped."
+help = "Run wrangler types and commit the file."
+
+[[check]]
+name = "security-headers"
+example = "A configured response-header block without a required security header reports the missing header. Add that header to every governed path block using the value required by settings."
+level = "recommended"
+stage = "commit"
+runs = "scope"
+summary = "Checks that the headers file sets the content type, referrer, and framing headers for every path."
+why = "A site of files has no server code, so the headers file is the only place these protections can live."
+help = "Add the header to the block for every path."

package/configurations/platform/cloudflare/rules/CLOUDFLARE.md

@@ -0,0 +1,23 @@
+# Workers
+
+Rules that hold because the code runs on a V8 isolate runtime such as Cloudflare Workers.
+
+## Global variables
+
+- Web APIs such as `Request`, `Response`, `fetch`, `URL`, `crypto`, and `caches` work in this runtime.
+- Node API availability depends on the compatibility date and flags. Check the configured
+  runtime before using `node:` imports or `process.env`.
+- Bindings can come from handler arguments, supported entrypoint properties, or `env` imported
+  from `cloudflare:workers`. Build a client from `env` inside the request.
+- Module-scope binding access does not permit request-only I/O outside a request context.
+
+## Lifetime
+
+- The runtime can reuse or discard isolates. Module state provides neither durable storage nor a safe place
+  for request-specific user data.
+- Share immutable configuration. Keep mutable request state isolated and persist durable
+  state through the application's storage contract.
+- Use `ctx.waitUntil()` for work after the response. Use a Queue or Workflow for work that must finish.
+
+See the Cloudflare [Node process support](https://developers.cloudflare.com/workers/runtime-apis/nodejs/process/)
+and [binding access](https://developers.cloudflare.com/workers/runtime-apis/bindings/).

package/configurations/platform/cloudflare/semgrep/cloudflare.yml

@@ -0,0 +1,12 @@
+rules:
+    - id: gspot.cloudflare.no-wildcard-cors-origin
+      pattern-either:
+          - pattern: '"Access-Control-Allow-Origin": "*"'
+          - pattern: "'Access-Control-Allow-Origin': '*'"
+          - pattern: $HEADERS.set("Access-Control-Allow-Origin", "*")
+          - pattern: $HEADERS.append("Access-Control-Allow-Origin", "*")
+      message: Cloudflare middleware must not send wildcard CORS origins.
+      languages:
+          - javascript
+          - typescript
+      severity: ERROR