@gspothq/cli 0.0.0-stage → 0.1.1

package/configurations/language/javascript/manifest.toml

@@ -0,0 +1,393 @@
+allowed_words = ["JavaScript", "ESLint"]
+ignored_folders = ["node_modules", "bower_components"]
+
+[prefix_collisions]
+prefixes = ["jsconfig", "eslint", "playwright"]
+
+[configuration]
+title = "JavaScript"
+suggests = []
+description = "ESLint with the shipped rule set over every JavaScript file, type checking through JSDoc, and knip for dead code."
+
+[detect]
+project_files = ["package.json"]
+extensions = [".js", ".jsx", ".mjs", ".cjs"]
+shebangs = ["node"]
+
+[files]
+extensions = [".js", ".jsx", ".mjs", ".cjs"]
+tags = ["shebang:node"]
+eslint_plugins = true
+
+[[tool]]
+name = "eslint"
+rule_url = "https://eslint.org/docs/latest/rules/{rule}"
+crash_pattern = "^(?:Oops! Something went wrong|Error: Cannot find module|ERR_MODULE_NOT_FOUND|ConfigError:)"
+diagnostic_header_pattern = "^(?:Oops!|ESLint: )"
+version = "9.39.5"
+npm = "eslint"
+[[tool.replace]]
+file = "eslint.config.js"
+shared = false
+
+[[tool.replace]]
+file = "eslint.config.mjs"
+shared = false
+
+[[tool.replace]]
+file = "eslint.config.cjs"
+shared = false
+
+[[tool.replace]]
+file = "eslint.config.ts"
+shared = false
+
+[[tool.replace]]
+file = "eslint.config.mts"
+shared = false
+
+[[tool.replace]]
+file = "eslint.config.cts"
+shared = false
+
+[[tool.replace]]
+file = ".eslintrc"
+shared = false
+
+[[tool.replace]]
+file = ".eslintrc.js"
+shared = false
+
+[[tool.replace]]
+file = ".eslintrc.cjs"
+shared = false
+
+[[tool.replace]]
+file = ".eslintrc.json"
+shared = false
+
+[[tool.replace]]
+file = ".eslintrc.yml"
+shared = false
+
+[[tool.replace]]
+file = ".eslintrc.yaml"
+shared = false
+
+[[tool.replace]]
+file = ".eslintignore"
+shared = false
+
+[[tool.refused_options]]
+paths = ["rules", "overrides", "extends"]
+message = "ESLint rule selection comes from level recommended or all. Use tools.eslint.rules and tools.eslint.override for native options, or gspot ignore javascript/eslint --rule <rule> --reason <why> to accept a finding."
+
+[tool.suppression]
+marker = "^(?:/\\*\\s*eslint-disable(?:-next-line|-line)?|//\\s*eslint-disable-(?:next-)?line)(?=\\s|$)"
+reason = " -- (?<reason>\\S.*)"
+
+[[tool.replace]]
+file = "package.json"
+key = "eslintConfig"
+shared = true
+
+[[tool]]
+name = "@eslint/js"
+kind = "library"
+version = "9.39.5"
+npm = "@eslint/js"
+
+[[tool]]
+name = "@gspothq/eslint-plugin"
+rule_prefix = "gspot"
+kind = "library"
+npm = "@gspothq/eslint-plugin"
+rule_url = "https://generativespotting.com/reference/eslint-plugin/{rule}/"
+
+[[tool]]
+name = "eslint-plugin-sonarjs"
+rule_prefix = "sonarjs"
+kind = "library"
+version = "4.2.0"
+npm = "eslint-plugin-sonarjs"
+
+[[tool]]
+name = "eslint-plugin-unicorn"
+rule_prefix = "unicorn"
+rule_url = "https://github.com/sindresorhus/eslint-plugin-unicorn/blob/main/docs/rules/{rule}.md"
+kind = "library"
+version = "65.0.1"
+npm = "eslint-plugin-unicorn"
+
+[[tool]]
+name = "eslint-plugin-security"
+rule_prefix = "security"
+kind = "library"
+version = "4.0.1"
+npm = "eslint-plugin-security"
+
+[[tool]]
+name = "eslint-plugin-barrel-files"
+rule_prefix = "barrel-files"
+kind = "library"
+version = "3.0.1"
+npm = "eslint-plugin-barrel-files"
+
+[[tool]]
+name = "eslint-plugin-perfectionist"
+rule_prefix = "perfectionist"
+kind = "library"
+npm = "eslint-plugin-perfectionist"
+version = "5.12.1"
+
+[[tool]]
+name = "eslint-plugin-n"
+rule_prefix = "n"
+kind = "library"
+version = "18.3.0"
+npm = "eslint-plugin-n"
+
+[[tool]]
+name = "eslint-plugin-jsdoc"
+rule_prefix = "jsdoc"
+kind = "library"
+version = "64.3.9"
+npm = "eslint-plugin-jsdoc"
+
+[[tool]]
+name = "eslint-plugin-regexp"
+rule_prefix = "regexp"
+kind = "library"
+version = "3.3.0"
+npm = "eslint-plugin-regexp"
+
+[[tool]]
+name = "eslint-plugin-import-x"
+rule_prefix = "import-x"
+kind = "library"
+version = "4.17.1"
+npm = "eslint-plugin-import-x"
+
+[[tool]]
+name = "picomatch"
+kind = "library"
+version = "4.0.7"
+npm = "picomatch"
+
+[[tool]]
+name = "eslint-import-resolver-typescript"
+kind = "library"
+version = "4.4.5"
+npm = "eslint-import-resolver-typescript"
+
+[[tool]]
+name = "eslint-plugin-boundaries"
+rule_prefix = "boundaries"
+kind = "library"
+version = "7.2.0"
+npm = "eslint-plugin-boundaries"
+
+[[tool.when]]
+setting = "architecture.module"
+
+[[tool.when]]
+level = "all"
+
+[[tool]]
+name = "eslint-plugin-package-json"
+rule_prefix = "package-json"
+kind = "library"
+version = "1.8.0"
+npm = "eslint-plugin-package-json"
+
+[[tool]]
+name = "eslint-config-prettier"
+kind = "library"
+version = "10.1.8"
+npm = "eslint-config-prettier"
+
+[[tool]]
+name = "globals"
+kind = "library"
+version = "17.12.0"
+npm = "globals"
+
+[[tool]]
+name = "knip"
+version = "6.35.1"
+npm = "knip"
+[[tool.replace]]
+file = "knip.json"
+shared = false
+
+[[tool.replace]]
+file = "knip.jsonc"
+shared = false
+
+[[tool.replace]]
+file = ".knip.json"
+shared = false
+
+[[tool.replace]]
+file = ".knip.jsonc"
+shared = false
+
+[[tool.replace]]
+file = "knip.ts"
+shared = false
+
+[[tool.replace]]
+file = "knip.js"
+shared = false
+
+[[tool.replace]]
+file = "knip.config.js"
+shared = false
+
+[[tool.replace]]
+file = "knip.config.ts"
+shared = false
+
+[[tool]]
+name = "tsc"
+install_hint = "Run: npm install --save-dev typescript"
+system = true
+version = "5.9.3"
+npm = "typescript"
+version_command = ["--version"]
+
+[tool.suppression]
+marker = "@ts-(?:ignore|expect-error|nocheck)\\b"
+reason = "@ts-(?:ignore|expect-error|nocheck):?\\s+(?<reason>\\S.*)"
+
+[[tool_file]]
+target = ".gspot/config/eslint.config.mjs"
+required_tools = ["@eslint/js", "@gspothq/eslint-plugin", "eslint-plugin-sonarjs", "eslint-plugin-unicorn", "eslint-plugin-security", "eslint-plugin-barrel-files", "eslint-plugin-perfectionist", "eslint-plugin-n", "eslint-plugin-jsdoc", "eslint-plugin-regexp", "eslint-plugin-import-x", "eslint-import-resolver-typescript", "eslint-plugin-boundaries", "eslint-plugin-package-json", "eslint-config-prettier", "globals", "picomatch"]
+scope_fragments = true
+tool = "eslint"
+rule_keys = ["rules"]
+
+[tool_file.pointer]
+path = "eslint.config.mjs"
+body = "export { default } from {target_module};"
+
+[[tool_file]]
+target = ".gspot/config/jsconfig.json"
+tool = "tsc"
+check = "javascript/tsc"
+per_scope = true
+
+[[tool_file]]
+target = ".gspot/config/knip.json"
+tool = "knip"
+
+[[check]]
+name = "eslint"
+tool = ["eslint", "node"]
+example = "The declaration `const unused = 1;` reports no-unused-vars. Delete the variable."
+level = "recommended"
+stage = "commit"
+command = ["eslint", "--max-warnings", "0", "--no-warn-ignored", "--config", "{tool_file:eslint}", "--format", "json", "{files}"]
+fix = ["eslint", "--fix", "--config", "{tool_file:eslint}", "{files}"]
+exit_codes = [1]
+summary = "Runs the shipped ESLint rules on JavaScript, TypeScript, component files, and package.json."
+why = "ESLint catches mistakes and dead code the runtime accepts: unused code, unsafe patterns, functions that only forward."
+help = "Run gspot check --fix for the rules that fix themselves, then read each remaining line; gspot explain <rule> links the rule documentation."
+
+[check.files]
+extensions = [".js", ".jsx", ".mjs", ".cjs"]
+filenames = ["package.json"]
+tags = ["shebang:node"]
+eslint_plugins = true
+
+[check.output]
+format = "json"
+children = "messages"
+
+[check.output.fields]
+file = "filePath"
+line = "line"
+column = "column"
+rule = "ruleId"
+message = "message"
+fixable = "fix"
+
+[[check]]
+name = "tsc"
+example = "With JavaScript type checking enabled, passing a number to a JSDoc parameter declared as `string` reports a type error. Pass the intended string value or correct the documented parameter contract."
+level = "recommended"
+stage = "push"
+runs = "scope"
+cwd = "scope"
+tool = "tsc"
+summary = "Type-checks plain JavaScript through its JSDoc comments."
+why = "A JavaScript file with a wrong call crashes at run time; the checker sees it first when the types are written down."
+help = "Add or fix the JSDoc type that the error names."
+
+[check.files]
+extensions = [".js", ".mjs", ".cjs", ".jsx"]
+
+[check.output]
+format = "regex"
+pattern = "^(?<file>[^(]+)\\((?<line>\\d+),(?<column>\\d+)\\): error (?<rule>TS\\d+): (?<message>.*)$"
+
+[[check]]
+name = "knip"
+example = "An exported declaration that no selected entry point uses reports an unused export. Remove the export or declaration and update consumers. If the file is dynamically loaded, add its entry point in tools.knip.extra with a reason."
+level = "recommended"
+stage = "push"
+runs = "scope"
+command = ["knip", "--config", "{tool_file:knip}", "--no-progress", "--reporter", "json", "{workspace:--workspace}"]
+cwd = "root"
+summary = "Finds files, exports, and dependencies nothing uses."
+why = "Dead code is read, maintained, and shipped for nobody."
+help = "Delete what knip names, or add a knip entry point in tools.knip.extra with a reason if the file is loaded in a way knip cannot see."
+
+[check.output]
+format = "knip"
+
+[[naming.override]]
+paths = ["**"]
+languages = ["typescript", "javascript"]
+categories = ["functions", "methods"]
+ignored_prefix = "^handle(?=[A-Z])"
+reason = "A handler starts with handle and then names the event."
+
+[rules."PLAYWRIGHT.md"]
+dependencies = ["@playwright/test", "playwright"]
+
+[rules."NODE.md"]
+runtimes = ["node"]
+absent_dependencies = ["react-native", "expo"]
+
+[rules."DENO.md"]
+runtimes = ["deno"]
+
+[rules."COMPONENTS.md"]
+dependencies = ["astro", "svelte", "vue", "react"]
+
+[rules."BUN.md"]
+filenames = ["bun.lock", "bun.lockb", "bunfig.toml"]
+
+[eslint]
+all_level_rules = ["import-x/first", "import-x/newline-after-import", "barrel-files/avoid-barrel-files", "perfectionist/sort-imports", "perfectionist/sort-named-imports", "perfectionist/sort-exports", "perfectionist/sort-named-exports", "complexity", "import-x/exports-last", "jsdoc/no-types", "jsdoc/require-description", "jsdoc/require-jsdoc", "jsdoc/require-param", "jsdoc/require-param-description", "jsdoc/require-returns", "jsdoc/require-returns-description", "max-depth", "max-lines", "max-lines-per-function", "max-nested-callbacks", "max-params", "max-statements", "n/no-process-exit", "n/prefer-global/buffer", "n/prefer-global/console", "n/prefer-global/process", "n/prefer-global/url", "n/prefer-global/url-search-params", "n/prefer-promises/dns", "n/prefer-promises/fs", "no-console", "no-param-reassign", "package-json/repository-shorthand", "package-json/require-attribution", "package-json/require-description", "package-json/require-exports", "package-json/require-files", "package-json/require-name", "package-json/require-repository", "package-json/require-sideEffects", "package-json/require-type", "package-json/require-version", "package-json/sort-collections", "security/detect-child-process", "security/detect-possible-timing-attacks", "sonarjs/bitwise-operators", "sonarjs/class-name", "sonarjs/cognitive-complexity", "sonarjs/constructor-for-side-effects", "sonarjs/fixme-tag", "sonarjs/hooks-before-test-cases", "sonarjs/max-switch-cases", "sonarjs/no-clear-text-protocols", "sonarjs/no-commented-code", "sonarjs/no-default-utility-imports", "sonarjs/no-fixed-wait-in-tests", "sonarjs/no-global-this", "sonarjs/no-hardcoded-ip", "sonarjs/no-identical-functions", "sonarjs/no-inverted-boolean-check", "sonarjs/no-labels", "sonarjs/no-nested-assignment", "sonarjs/no-nested-conditional", "sonarjs/no-nested-functions", "sonarjs/no-nested-switch", "sonarjs/no-nested-template-literals", "sonarjs/no-os-command-from-path", "sonarjs/no-same-line-conditional", "sonarjs/no-selector-parameter", "sonarjs/no-small-switch", "sonarjs/no-undefined-argument", "sonarjs/parameterized-tests", "sonarjs/prefer-default-last", "sonarjs/prefer-immediate-return", "sonarjs/prefer-native-lodash-alternative", "sonarjs/prefer-object-literal", "sonarjs/prefer-promise-shorthand", "sonarjs/prefer-read-only-props", "sonarjs/prefer-regexp-exec", "sonarjs/prefer-single-boolean-return", "sonarjs/prefer-specific-assertions", "sonarjs/prefer-type-guard", "sonarjs/prefer-while", "sonarjs/pseudo-random", "sonarjs/public-static-readonly", "sonarjs/publicly-writable-directories", "sonarjs/regex-complexity", "sonarjs/todo-tag", "sonarjs/use-type-alias", "unicorn/better-dom-traversing", "unicorn/catch-error-name", "unicorn/consistent-assert", "unicorn/consistent-compound-words", "unicorn/consistent-date-clone", "unicorn/consistent-empty-array-spread", "unicorn/consistent-function-scoping", "unicorn/consistent-json-file-read", "unicorn/consistent-template-literal-escape", "unicorn/dom-node-dataset", "unicorn/expiring-todo-comments", "unicorn/explicit-length-check", "unicorn/isolated-functions", "unicorn/no-anonymous-default-export", "unicorn/no-array-for-each", "unicorn/no-array-from-fill", "unicorn/no-array-method-this-argument", "unicorn/no-array-reduce", "unicorn/no-array-reverse", "unicorn/no-array-sort", "unicorn/no-await-expression-member", "unicorn/no-blob-to-file", "unicorn/no-canvas-to-image", "unicorn/no-confusing-array-splice", "unicorn/no-document-cookie", "unicorn/no-empty-file", "unicorn/no-exports-in-scripts", "unicorn/no-for-loop", "unicorn/no-hex-escape", "unicorn/no-immediate-mutation", "unicorn/no-magic-array-flat-depth", "unicorn/no-named-default", "unicorn/no-negated-condition", "unicorn/no-negation-in-equality-check", "unicorn/no-nested-ternary", "unicorn/no-new-array", "unicorn/no-process-exit", "unicorn/no-single-promise-in-promise-methods", "unicorn/no-static-only-class", "unicorn/no-this-assignment", "unicorn/no-typeof-undefined", "unicorn/no-unnecessary-array-flat-depth", "unicorn/no-unnecessary-array-splice-count", "unicorn/no-unnecessary-nested-ternary", "unicorn/no-unnecessary-slice-end", "unicorn/no-unreadable-array-destructuring", "unicorn/no-unreadable-iife", "unicorn/no-useless-switch-case", "unicorn/prefer-add-event-listener", "unicorn/prefer-array-find", "unicorn/prefer-array-flat", "unicorn/prefer-array-flat-map", "unicorn/prefer-array-index-of", "unicorn/prefer-array-last-methods", "unicorn/prefer-array-some", "unicorn/prefer-at", "unicorn/prefer-bigint-literals", "unicorn/prefer-blob-reading-methods", "unicorn/prefer-class-fields", "unicorn/prefer-classlist-toggle", "unicorn/prefer-date-now", "unicorn/prefer-default-parameters", "unicorn/prefer-dom-node-append", "unicorn/prefer-dom-node-remove", "unicorn/prefer-dom-node-text-content", "unicorn/prefer-event-target", "unicorn/prefer-get-or-insert-computed", "unicorn/prefer-global-this", "unicorn/prefer-includes", "unicorn/prefer-includes-over-repeated-comparisons", "unicorn/prefer-iterator-to-array-at-end", "unicorn/prefer-keyboard-event-key", "unicorn/prefer-logical-operator-over-ternary", "unicorn/prefer-math-abs", "unicorn/prefer-math-min-max", "unicorn/prefer-math-trunc", "unicorn/prefer-modern-dom-apis", "unicorn/prefer-modern-math-apis", "unicorn/prefer-module", "unicorn/prefer-native-coercion-functions", "unicorn/prefer-negative-index", "unicorn/prefer-number-properties", "unicorn/prefer-object-from-entries", "unicorn/prefer-optional-catch-binding", "unicorn/prefer-prototype-methods", "unicorn/prefer-query-selector", "unicorn/prefer-queue-microtask", "unicorn/prefer-reflect-apply", "unicorn/prefer-regexp-test", "unicorn/prefer-response-static-json", "unicorn/prefer-set-has", "unicorn/prefer-set-size", "unicorn/prefer-simple-condition-first", "unicorn/prefer-single-call", "unicorn/prefer-split-limit", "unicorn/prefer-spread", "unicorn/prefer-string-match-all", "unicorn/prefer-string-pad-start-end", "unicorn/prefer-string-raw", "unicorn/prefer-string-repeat", "unicorn/prefer-string-replace-all", "unicorn/prefer-string-slice", "unicorn/prefer-string-starts-ends-with", "unicorn/prefer-string-trim-start-end", "unicorn/prefer-structured-clone", "unicorn/prefer-switch", "unicorn/prefer-ternary", "unicorn/prefer-top-level-await", "unicorn/prefer-type-error", "unicorn/relative-url-style", "unicorn/require-passive-events"]
+
+[eslint.presets.eslint]
+package = "@eslint/js"
+source = "configs.recommended"
+
+[eslint.presets.sonar]
+package = "eslint-plugin-sonarjs"
+source = "configs.recommended"
+
+[eslint.presets.unicorn]
+package = "eslint-plugin-unicorn"
+source = "configs.recommended"
+
+[eslint.presets.packageJson]
+package = "eslint-plugin-package-json"
+source = "configs.recommended"
+
+[eslint.presets.prettier]
+package = "eslint-config-prettier"
+source = ""

package/configurations/language/javascript/rules/BUN.md

@@ -0,0 +1,13 @@
+# Bun
+
+Rules that hold because the code runs on Bun.
+
+## Module resolution
+
+- Match internal imports to the project entry point and TypeScript configuration. Bun
+  [resolves TypeScript directly](https://bun.sh/docs/runtime/module-resolution), including
+  explicit `.ts` imports and extensionless paths. Do not assume the project emits `.js` files.
+
+## APIs
+
+- Use a `Bun.*` API only where the project runs on Bun alone, and say so in the file header.

package/configurations/language/javascript/rules/COMPONENTS.md

@@ -0,0 +1,18 @@
+# Components
+
+These rules cover components in Astro, Svelte, Vue, and React.
+
+## Props and tests
+
+- Keep markup declarative. Move an expression longer than one operator into a derived value.
+- Do not reach into a child to change its state.
+- Do not copy a prop into local state and keep the copy updated by hand.
+- Pass the fields a child reads. Avoid passing a whole store or parent object.
+- Test a component through what the application shows to the user and how the user acts, rather than its internal state.
+
+## Component conventions
+
+<!-- level: all -->
+
+- One component has one job. Split a component when its markup holds two unrelated regions.
+- Name a component in PascalCase and name the file the same.

package/configurations/language/javascript/rules/DENO.md

@@ -0,0 +1,15 @@
+# Deno
+
+Rules that hold because the code runs on Deno.
+
+## Module resolution
+
+- Relative imports use the real file extension, such as `.ts` or `.js`. Preserve aliases
+  resolved by the declared import map.
+
+## Permissions and APIs
+
+- Deno grants permissions explicitly. Request the narrowest set the code needs. Write the reason
+  in a comment beside the permission flag.
+- Use `Deno.*` and the web platform APIs. Node built-ins use the compatibility layer.
+  Write the reason for using one in a comment beside its import.

package/configurations/language/javascript/rules/JAVASCRIPT.md

@@ -0,0 +1,60 @@
+# JavaScript
+
+Keep development tooling out of production runtime imports. Keep inputs and side effects explicit.
+Validate external values where the program receives them, before sending them to a database or another service.
+These values include HTTP bodies, query strings, route params, headers, environment variables, and database rows.
+Also validate remote procedure call results, provider responses, file input, generated data sources, webhooks, and scheduled-job payloads.
+If a check and this file disagree, tell the user.
+
+## Runtime
+
+Use APIs supported by the runtime and version the project declares. Browser code targets the
+browsers and build pipeline the project declares. Before adding a build step that needs another
+runtime, update the declared runtime configuration and documentation.
+
+## Modules
+
+Keep existing CommonJS modules CommonJS unless the task includes migrating them. Keep side-effect
+imports rare and explain their required effect. Browser code imports no server implementation.
+
+### Module conventions
+
+<!-- level: all -->
+
+- Prefer named imports and named exports.
+- Avoid mutable exports and default exports in application modules. Preserve a default export
+  when a tool or framework requires it.
+- Do not create container classes or exported objects only to simulate a namespace.
+- Keep JSDoc `@typedef` declarations with their behavioral owner, following the project's folder
+  arrangement. Share them through type imports when another module needs the contract.
+- Import the module that declares a symbol. A library can explicitly select index-only re-exports.
+
+## Values
+
+- Use frozen objects or plain constant objects for fixed value sets.
+- Avoid truthiness checks when `0`, `''`, `false`, `null`, and `undefined` mean different things.
+- Use `null` for a meaningful domain value and `undefined` for missing object properties.
+- Use `??` when only `null` and `undefined` require a fallback. Do not use `||` when an empty
+  string, zero, or false has a valid meaning.
+- Name regular expressions after the value or contract they validate.
+- Check indexed reads when a value can have no result.
+
+## Objects and functions
+
+Use object literals for grouped arguments and destructure fields when it makes their use clearer.
+A function that mutates its input names and documents that effect.
+
+### Function conventions
+
+<!-- level: all -->
+
+- Use an options object for several related arguments.
+- Do not add optional parameters to hide a broken caller contract.
+- Use early returns when they make missing-value and error handling clearer.
+- Keep constructors small. Add inheritance only for a real runtime relationship.
+- Use decorators only where a framework requires them.
+
+## Asynchronous work
+
+Await a promise that must finish before the next step. Release child processes, subscriptions,
+and other resources in `finally` or the API's cleanup mechanism.

package/configurations/language/javascript/rules/NAMING.md

@@ -0,0 +1,31 @@
+# JavaScript Naming
+
+JavaScript naming follows the same role, responsibility, and boundary principles
+as TypeScript. Use the JavaScript rules when editing `.js`, `.mjs`, `.cjs`, and
+plain JavaScript tooling files.
+
+## JavaScript imports and exports
+
+<!-- level: all -->
+
+- Namespace import aliases derive from the imported filename or
+  clear package name.
+- Named imports keep their exported name unless a collision forces an alias.
+- If the module requires a named import alias, use a domain or path component that
+  explains the collision.
+- Default import names follow the imported identifier type, but use default
+  imports only for ecosystem modules that require them.
+
+Use `fileOne` for a namespace import from `file-one.js`. If two modules export
+`Cat`, use an alias such as `DomesticatedCat` that identifies the owning domain.
+
+## JavaScript and TypeScript files
+
+<!-- level: all -->
+
+| Avoid            | Prefer                        | Meaning                        |
+| ---------------- | ----------------------------- | ------------------------------ |
+| `Helpers.js`     | `session-token-verifier.js`   | Session token verification.    |
+| `UserService.ts` | `user-repository.ts`          | User persistence.              |
+| `sharedUtils.ts` | `email-template-formatter.ts` | Email template formatting.     |
+| `data.cjs`       | `database-connection.cjs`     | Database connection lifecycle. |

package/configurations/language/javascript/rules/NODE.md

@@ -0,0 +1,21 @@
+# Node
+
+Rules that hold because the code runs on Node, whatever language the project uses.
+
+## Module resolution
+
+- Unbundled compiled TypeScript follows Node module resolution. Runtime imports must resolve
+  in the emitted output; a `.js` import can identify the corresponding TypeScript source.
+- Preserve the declared bundler or direct TypeScript execution contract when the project uses one.
+- Do not rely on CommonJS and ES module interop working by accident. A file declares its module format,
+  through the package type field or its extension.
+
+## Global variables
+
+- Use `process`, `Buffer`, and Node built-ins. Node also provides version-specific
+  [web-compatible globals](https://nodejs.org/api/globals.html), including `fetch`.
+  DOM globals such as `window` and `document` require a browser environment.
+
+## Processes
+
+- Give a directly invoked script a shebang and executable permissions.

package/configurations/language/javascript/rules/PLAYWRIGHT.md

@@ -0,0 +1,34 @@
+# Playwright
+
+## Tests
+
+- Give each test a coherent user journey with independent setup and observable assertions.
+- Query by role and accessible name such as `getByRole('button', { name: 'Submit' })`, then by label,
+  placeholder, or text.
+- Do not use fixed waits such as `waitForTimeout`. Wait for the visible state, response, or URL that proves
+  the operation completed. Network inactivity alone does not establish readiness.
+- Every test starts from a known state it creates through the application's real setup (API or
+  UI), not from shared seed data or another test's leftovers.
+- Assertions use the auto-retrying `expect(locator)` matchers. No manual polling loops.
+- A test never reads or writes production data. The base URL and credentials come from the
+  project configuration for each environment.
+
+## Test data and page objects
+
+- Keep shared setup in the test support folder. Introduce page objects only when
+  several tests repeat the same interactions.
+- Reuse isolated authentication state for tests that do not exercise login. Login tests verify
+  the actual authentication journey. Keep account state isolated between concurrent workers.
+
+## Configuration
+
+- Use the configuration files declared by the repository. Name projects so failures identify
+  their browser, viewport, or other relevant execution context.
+- Declare the retry policy in the project configuration. Report retried passes separately from
+  first-attempt passes.
+- Configure trace, screenshot, and video retention for the required diagnostics. Upload failure
+  artifacts, restrict access, and avoid capturing credentials or unrelated private data.
+- Enable parallel execution only when each test has its own accounts and mutable resources.
+  Document any scenario that requires serial execution.
+- Test the production build for release acceptance. Use a development server only when development
+  the test covers that behavior.