@gspothq/cli 0.1.1 → 0.2.0

package/configurations/language/sql/rules/SQL.md

@@ -1,9 +1,97 @@
 # SQL
 
+Read this rule when you write SQL.
+
 ## SQL style
 
 - Fully qualify cross-schema references.
-- Prefer explicit column lists for every `INSERT` and every grant of write
+- Prefer explicit column lists for each `INSERT` and every grant of write
   privileges.
-- Keep table constraints close to the table definition unless the migration must add them
+- Keep table constraints close to the definition unless the migration must add them
   later for dependency reasons.
+
+## Naming
+
+### SQL case rules
+
+<!-- level: all -->
+
+- SQL schemas, tables, columns, functions, parameters, indexes,
+  triggers, constraints, and policies use `lower_snake_case`.
+- Fully qualify grants and function signatures when names have more than one possible meaning.
+- Do not use quoted sentence-style identifiers for local policy names.
+- Do not use pluralization or prefixes inconsistently inside one schema.
+
+| Avoid                        | Prefer                           | Meaning                            |
+| ---------------------------- | -------------------------------- | ---------------------------------- |
+| `public.OrderItems`          | `public.order_items`             | An order-item table.               |
+| `users_can_view_order_items` | `users_can_view_own_order_items` | A policy restricted to owned rows. |
+
+The policy name must describe what its predicate checks. A name that says "own"
+does not establish ownership checks or enable Row Level Security.
+
+### Migration filenames
+
+<!-- level: all -->
+
+Follow the migration tool's file names. Name each migration for its durable database change.
+
+### SQL tables and columns
+
+<!-- level: all -->
+
+- Table names identify the domain set stored by the relation.
+- Column names identify the value, not the application layer that reads it.
+- Foreign-key columns use the referenced concept plus `_id`.
+- Timestamp columns use stable names such as `created_at`,
+  `updated_at`, `deleted_at`, or a concrete domain event time.
+- Boolean columns use concise positive assertion names without an `is_`
+  prefix.
+- Avoid generic columns that hide meaning.
+
+| Avoid     | Prefer                      | Meaning                   |
+| --------- | --------------------------- | ------------------------- |
+| `data`    | `message_delivery_attempts` | Delivery attempt table.   |
+| `payload` | `provider_response`         | Response payload column.  |
+| `flag`    | `retryable`                 | Retry eligibility column. |
+| `date`    | `attempted_at`              | Attempt timestamp column. |
+
+### SQL functions and parameters
+
+<!-- level: all -->
+
+- SQL function names use verb phrases or domain operations. These verbs apply to functions,
+  not migration filenames.
+
+- Retrieval functions use `get_` whether they return one row,
+  an optional one, a collection, or a paginated one. Do not use
+  `read_`, `find_`, `fetch_`, `load_`, or `list_` as retrieval synonyms.
+- Data-access mutation functions use `set_`, `insert_`, `update_`, or
+  `delete_` according to the operation they perform. Do not use `create_`,
+  `add_`, `save_`, `write_`, `put_`, `upsert_`, or `remove_` as synonyms.
+- Parameter names never collide with table columns.
+- `SECURITY DEFINER` functions must have names that make the privileged action
+  clear.
+- Do not name functions like arbitrary script tasks.
+
+Use `archive_expired_orders` for a transactional operation that archives
+expired orders. Name its user argument `target_user_id` when the affected tables already have a `user_id` column. A generic `run` name hides the
+operation, and an unqualified `id` can obscure column ownership.
+
+### Indexes, constraints, triggers, and policies
+
+<!-- level: all -->
+
+- Name constraints and scope them to their table or concept.
+- Name indexes by table plus their columns or purpose.
+- Name triggers by event and action.
+- Name policies by actor plus allowed action.
+- Keep names stable because they appear in migrations, errors, grants, and
+  database inspection output.
+
+| Avoid           | Prefer                            | Meaning                              |
+| --------------- | --------------------------------- | ------------------------------------ |
+| `idx1`          | `messages_user_id_created_at_idx` | Index on user and creation time.     |
+| `check_status`  | `messages_status_not_empty_check` | Nonempty status constraint.          |
+| `trigger1`      | `messages_set_updated_at`         | Update timestamp trigger.            |
+| `select_policy` | `users_can_view_own_messages`     | Policy restricted to owned messages. |

package/configurations/language/swift/manifest.toml

@@ -1,11 +1,10 @@
 allowed_words = ["Swift", "SwiftLint", "SwiftFormat", "Periphery"]
-
 ignored_folders = [".build", "DerivedData", "Pods"]
 
 [configuration]
-title = "Swift"
+description = "Swift sources: SwiftLint, including its analyzer, with stable rules for each level, SwiftFormat, a build, and Periphery for dead code."
 suggests = []
-description = "Swift sources: SwiftLint with stable rules selected by level and analyzer rules, SwiftFormat, a build, and Periphery for dead code."
+title = "Swift"
 
 [detect]
 extensions = [".swift"]
@@ -15,150 +14,140 @@ project_files = ["Package.swift"]
 extensions = [".swift"]
 filenames = ["Package.swift", "Package.resolved"]
 
+[rules]
+"SWIFTUI.md" = { tags = ["swift-import:SwiftUI"] }
+"UIKIT.md" = { tags = ["swift-import:UIKit"] }
+
 [[tool]]
+brew = "swiftlint"
+builds = ["macos", "linux"]
+github = { name = "realm/SwiftLint", version = "0.63.2" }
+min_version = "0.57.0"
+mise = "swiftlint"
 name = "swiftlint"
+replace = [".swiftlint.yml", ".swiftlint.yaml"]
 rule_url = "https://realm.github.io/SwiftLint/{rule}.html"
 suppression = { marker = "\\bswiftlint:disable\\b", reason = " - (?<reason>\\S.*)" }
-builds = ["macos", "linux"]
 version = "0.63.2"
-min_version = "0.57.0"
-mise = "swiftlint"
-brew = "swiftlint"
-github = { name = "realm/SwiftLint", version = "0.63.2" }
 version_command = ["version"]
-[[tool.replace]]
-file = ".swiftlint.yml"
-shared = false
-
-[[tool.replace]]
-file = ".swiftlint.yaml"
-shared = false
 
 [[tool]]
+builds = ["macos", "linux"]
+min_version = "0.54.0"
 name = "swiftformat"
+replace = [".swiftformat"]
 suppression = { marker = "\\bswiftformat:disable\\b", reason = " - (?<reason>\\S.*)" }
-builds = ["macos", "linux"]
 version = "0.61.1"
-min_version = "0.54.0"
 # The GitHub release ships an app bundle beside the executable, which mise skips.
-mise = { name = "swiftformat", version = "0.61.1", options = { no_app = true, rename_exe = "swiftformat" } }
 brew = "swiftformat"
 github = { name = "nicklockwood/SwiftFormat", version = "0.61.1" }
-[[tool.replace]]
-file = ".swiftformat"
-shared = false
+mise = { name = "swiftformat", version = "0.61.1", options = { no_app = true, rename_exe = "swiftformat" } }
 
 [[tool]]
-name = "periphery"
-suppression = { marker = "\\bperiphery:ignore\\b", reason = " - (?<reason>\\S.*)" }
+brew = "periphery"
 builds = ["macos"]
-version = "3.6.0"
+github = { name = "peripheryapp/periphery", version = "3.6.0" }
 min_version = "3.0.0"
 mise = "periphery"
-brew = "periphery"
-github = { name = "peripheryapp/periphery", version = "3.6.0" }
+name = "periphery"
+replace = [".periphery.yml", ".periphery.yaml"]
+suppression = { marker = "\\bperiphery:ignore\\b", reason = " - (?<reason>\\S.*)" }
+version = "3.6.0"
 version_command = ["version"]
-[[tool.replace]]
-file = ".periphery.yml"
-shared = false
-
-[[tool.replace]]
-file = ".periphery.yaml"
-shared = false
 
 [[tool]]
 name = "swift"
 system = true
 
 [[tool]]
-name = "xcodebuild"
 install_hint = "install Xcode from the App Store"
+name = "xcodebuild"
 system = true
 
 [[tool_file]]
-target = ".gspot/config/swiftlint.yml"
-tool = "swiftlint"
-rule_keys = ["opt_in_rules", "analyzer_rules", "disabled_rules"]
 per_scope = true
 pointer = { path = ".swiftlint.yml", body = "parent_config: {target_json}\n" }
+target = ".gspot/config/swiftlint.yml"
+tool = "swiftlint"
 
 [[tool_file]]
+per_scope = true
 target = ".gspot/config/swiftformat"
 tool = "swiftformat"
-rule_keys = ["enable", "disable"]
-per_scope = true
 
 [[tool_file]]
+per_scope = true
 target = ".gspot/config/periphery.yml"
 tool = "periphery"
+
+[[tool_file]]
 per_scope = true
+target = ".gspot/config/semgrep/swift.yml"
+tool = "semgrep"
+when = { configuration = "security" }
 
 [[check]]
-name = "swiftlint"
-example = "The forced cast `value as! NSString` reports `force_cast`. Use a conditional cast and handle the failed conversion, or change the input contract so no cast is required."
-level = "recommended"
-stage = "commit"
-tool = "swiftlint"
 command = ["swiftlint", "lint", "--strict", "--quiet", "--no-cache", "--reporter", "json", "{files}"]
-fix = ["swiftlint", "lint", "--fix", "--quiet", "--no-cache", "{files}"]
 cwd = "scope"
+example = "`value as! NSString` reports `force_cast`. Use `as?` and handle the failure, or change the input type so no cast remains."
 files = { extensions = [".swift"] }
+fix = ["swiftlint", "lint", "--fix", "--quiet", "--no-cache", "{files}"]
+help = "Run `gspot check --fix` for the rules that fix themselves. Turn one rule off with `gspot ignore swift/swiftlint --rule <id> --reason \"<why>\"`."
+level = "recommended"
+name = "swiftlint"
 output = { format = "json", fields = { file = "file", line = "line", column = "character", rule = "rule_id", message = "reason" } }
-summary = "Lints Swift files with the scoped and nested SwiftLint configurations, treating warnings as errors."
-why = "Forced casts and tries can crash, and a strong delegate can retain its owner. Find these before committing."
-help = "Run gspot check --fix for the rules that fix themselves. Turn one rule off with gspot ignore swift/swiftlint --rule `<id>` --reason \"`<why>`\"."
+stage = "commit"
+summary = "Lints Swift files with the SwiftLint files of each scope and nested folder, and treats warnings as errors."
+tool = "swiftlint"
+why = "Forced casts and tries can crash, and a strong delegate can keep its owner alive."
 
 [[check]]
-name = "swiftformat"
-example = "A declaration beginning `func   greeting` reports `consecutiveSpaces`. Run the configured formatter to obtain `func greeting`, inspect the diff, and rerun."
-level = "recommended"
-stage = "commit"
 command = ["swiftformat", "--lint", "--config", "{tool_file:swiftformat}", "{files}"]
+example = "`func   greeting` reports `consecutiveSpaces`. Run `gspot check --fix` to get `func greeting`."
 exit_codes = [1]
-fix = ["swiftformat", "--quiet", "--config", "{tool_file:swiftformat}", "{files}"]
 files = { extensions = [".swift"] }
+fix = ["swiftformat", "--quiet", "--config", "{tool_file:swiftformat}", "{files}"]
+help = "Run `gspot check --fix`."
+level = "recommended"
+name = "swiftformat"
 output = { format = "regex", pattern = "^(?<file>.+?):(?<line>\\d+):(?<column>\\d+): (?:error|warning): \\((?<rule>\\w+)\\) (?<message>.*)$" }
+stage = "commit"
 summary = "Checks the layout of every Swift file against the shipped SwiftFormat rules."
 why = "One layout everywhere keeps a diff about the change and not about where a brace went."
-help = "Run gspot check --fix."
 
 [[check]]
-name = "build"
-example = "A Swift assignment of a string to an `Int` variable fails compilation. Correct the value or declared type and rerun with the required compiler and project settings available."
+example = "Assigning a string to an `Int` variable fails the build. Correct the value or the type."
+help = "Fix the first compiler error; later ones often come from the same mistake."
 level = "recommended"
-stage = "push"
-runs = "scope"
+name = "build"
 needs = ["build"]
 operating_systems = ["macos", "linux"]
+runs = "scope"
+stage = "push"
 summary = "Builds the package or Xcode scheme incrementally to report compiler errors."
-why = "Swift has no type check without a build, so the build is the type check."
-help = "Fix the first compiler error; later ones are often the same mistake."
+why = "Swift checks types only during a build."
 
 [[check]]
-name = "swiftlint-analyze"
-example = "An import unused by the compiled Swift sources reports an analyzer finding. Remove the import and rerun the build-backed analysis. A missing build log does not establish a clean result."
+example = "An import that no compiled Swift source uses reports a finding. Remove the import."
+help = "Remove what the rule names. List an import that the analyzer flags in error under `tools.swiftlint.always_keep_imports`."
 level = "recommended"
-stage = "manual"
-runs = "scope"
+name = "swiftlint-analyze"
 needs = ["build"]
 operating_systems = ["macos"]
-tool = "swiftlint"
+runs = "scope"
+stage = "manual"
 summary = "Runs the SwiftLint analyzer rules over the compiler log of the build: unused imports and captured variables."
-why = "These rules need the compiler's view of the code, which a file-by-file lint does not have."
-help = "Remove what the rule names. Keep an import the analyzer misjudges under tools.swiftlint.always_keep_imports."
+tool = "swiftlint"
+why = "These rules need compiler output, which a lint of single files lacks."
 
 [[check]]
-name = "periphery"
-example = "A declaration with no references in the selected compiled project reports unused code. Delete the unused declaration and rebuild before rerunning. Runtime-only references require a specific documented exception."
+example = "A declaration that nothing references reports unused code. Delete it, and rebuild."
+help = "Delete the declaration, or mark it with a periphery:ignore comment that says who uses it."
 level = "recommended"
-stage = "push"
-runs = "scope"
+name = "periphery"
 needs = ["build"]
-tool = "periphery"
+runs = "scope"
+stage = "push"
 summary = "Scans the built project for declarations nothing uses."
-why = "Dead code is read, maintained, and migrated by people who cannot tell it is dead."
-help = "Delete the declaration, or mark it with a periphery:ignore comment that says who uses it."
-
-[rules]
-"SWIFTUI.md" = { tags = ["swift-import:SwiftUI"] }
-"UIKIT.md" = { tags = ["swift-import:UIKit"] }
+tool = "periphery"
+why = "People read, maintain, and migrate dead code without knowing that nothing uses it."

package/configurations/language/swift/rules/SWIFT.md

@@ -1,18 +1,22 @@
 # Swift
 
+Read this rule when you change Swift code.
+
 Swift source follows the Apple API Design Guidelines and the local formatting and lint
 configuration. SwiftFormat owns layout. Treat warnings as errors in the build settings.
 
 ## Files and style
 
-Every file imports exactly the top-level modules it uses, as whole modules unless a single
+Every file imports exactly the top-level modules it uses. Import whole modules unless a single
 declaration avoids a known conflict. Group imports by compiler condition, with
-`@testable import` after regular imports in tests. `// MARK: - Section` marks meaningful groups in larger files,
-and a file comment appears only when the file groups several abstractions and the grouping
-needs explanation. Type inference covers a right-hand side with a clear type; an explicit annotation
-covers empty collections, `nil` initial values, weak type information, and public API
-clarity. Enum raw values that map to an external wire or persistence contract need documentation;
-an explicit case list replaces `default` where a future case must force review. Attributes
+`@testable import` after regular ones in tests. `// MARK: - Section` marks meaningful groups in larger files.
+Write a header comment only where several abstractions share the file and their arrangement
+needs explanation.
+
+Rely on inference when the right-hand side has a clear type. Add an explicit annotation for
+empty collections, `nil` initial values, weak type information, and public API
+clarity. Document enum raw values that map to an external wire or persistence contract.
+Replace `default` with an explicit list where a future case must force review. Attributes
 with parameters go on their own line when they hurt readability inline.
 
 ### File organization
@@ -20,7 +24,7 @@ with parameters go on their own line when they hurt readability inline.
 <!-- level: all -->
 
 One primary top-level type per file, with small private helpers allowed beside it. Keep overloads adjacent. Organize extensions rather than scattering them across files. Group SwiftUI
-dynamic properties by property-wrapper type.
+dynamic properties by wrapper type.
 
 Good:
 
@@ -42,53 +46,61 @@ public func comparePositiveTotals(_ left: [Int], _ right: [Int]) -> Int {
 ## Practices
 
 Use `let` by default and `var` for required mutation. Class-constrained protocols use
-`AnyObject`. Prefer shorthand types such as `[Element]`, `[Key: Value]`, or `Wrapped?`, and use `Void` for function
-types. Optionals express valid absence rather than sentinel values, compared to
-`nil` when only presence matters and bound when the code uses the value, chained for one-off access.
+`AnyObject`. Prefer shorthand types such as `[Element]`, `[Key: Value]`, or `Wrapped?`, and `Void` in function
+signatures. Use an optional, not a sentinel, for a value that the program can omit. Compare it to `nil` when only presence
+matters, bind it when the code uses the value, and chain it for one-off access.
 
 Typed errors distinguish several meaningful failure states. A force unwrap or cast needs a
-proven invariant. At level `all`, use `// swiftlint:disable:next force_unwrapping` with the
-invariant as the reason for an unavoidable unwrap. Avoid global mutable state, with `static let` or computed `static var` over stored
-mutable statics.
+proven invariant. Avoid global mutable state: prefer `static let` or a computed `static var` to a
+stored one.
 
-`guard` handles early exits, `for ... where` a loop guarded by one condition,
-`for` over `forEach` for control flow or async work, and `map`, `compactMap`, and
+Use `guard` for early exits and `for ... where` for a loop with one condition. Prefer `for` to
+`forEach` for control flow or async work. `map`, `compactMap`, and
 `filter` express side-effect-free transformation. Pattern bindings put `let` on each element
-where that avoids ambiguity. Use weak capture only when a callback must not extend the captured
-object's lifetime. Otherwise, capture the immutable values the callback needs. `#fileID` serves production diagnostics; `#filePath`
-only tests and tooling. Overload operators only with their standard meaning, and a
-custom operator exists only as standard domain notation.
+where that avoids ambiguity.
+
+Use weak capture only when a callback must not extend the lifetime of an object it holds.
+Otherwise, capture the immutable values the callback needs. Use `#fileID` in production logs and `#filePath`
+only in tests and tools. Overload operators only with their standard meaning. Define a
+custom operator only for standard domain notation.
+
+### Force unwraps
+
+<!-- level: all -->
+
+When the code needs a force unwrap, suppress `force_unwrapping` on that line with
+`// swiftlint:disable:next force_unwrapping`. The reason states the invariant, as the suppression rules require.
 
 ### API and ownership conventions
 
 <!-- level: all -->
 
 Structs keep synthesized
-memberwise initializers where sufficient, value types hold data without identity, and classes
+memberwise initializers where sufficient. Value types hold data without identity. Classes
 serve identity, reference semantics, lifecycle, observable state, or framework requirements.
 An implicitly unwrapped optional appears only for Apple lifecycle cases such as `@IBOutlet`,
 Objective-C nullability gaps, and test data.
 
 Declare top-level access to match the public contract. An extension carries no blanket access
-modifier. Types nest when they only make sense in the parent's context, and a caseless enum
-groups truly related statics. Methods and properties beat free functions unless the function
-follows the standard library and stays symmetric.
-Logging goes through the project logging system, and
-images and colors come from named assets or explicit constructors.
+modifier. Nest a type when it makes sense only inside its parent. Use a caseless enum only for
+closely related statics. Prefer methods and properties to free functions, except a symmetric
+function that follows the standard library.
+Send logs through the project logger, and take
+images and colors from named assets or explicit constructors.
 
 ## Networking
 
-URLs come from `URLComponents` or a typed endpoint value, never concatenated query strings,
-and a production `URL(string:)!` documents its invariant. Inject base URLs and credentials
+Build URLs with `URLComponents` or a typed endpoint value, never concatenated query strings.
+A production `URL(string:)!` documents its invariant. Inject base URLs and credentials
 at composition. Use `Encodable` types for request bodies with an explicit method and
 content type, never `[String: Any]`. `URLSession` succeeds for non-2xx responses.
-Validate `HTTPURLResponse` status explicitly. Treat a non-HTTP response as a transport
+Validate `HTTPURLResponse` status explicitly, and treat a non-HTTP response as a transport
 failure.
 
-Responses decode into DTOs mapped into domain values at the boundary. Validate required fields and
+Responses decode into data transfer objects, or DTOs, mapped into domain values at the boundary. Validate required fields and
 external enum values there. Do not invent a fallback ID, date, or case.
-Clients expose typed errors distinguishing encoding, decoding, transport, invalid response,
-invalid status, and cancellation, which stays distinguishable when navigation supersedes a
+Clients expose typed errors for encoding, decoding, transport, an invalid response or status,
+and cancellation. Cancellation stays distinct when navigation supersedes a
 task. When you write tests, inject the transport and cover request construction, status validation,
 decoding failure, cancellation, and mapping without a live service.
 
@@ -113,22 +125,108 @@ Structured `async`/`await` with `async throws` APIs replaces callback pyramids a
 task trees. UI state mutates on the main actor. When the project uses view models, keep them
 `@MainActor`.
 
-Expensive work moves into use cases, repositories, actors, or background tasks. `Task` creation stays
-in the modules that need them: view models, coordinators, or views through `.task`, never in an initializer, always
-with an owner and a cancellation strategy. Store handles when a disappearing view, a
+Expensive work moves into use cases, repositories, actors, or background tasks. Create a `Task` only
+in the modules that need one: view models, coordinators, or views through `.task`, never in an initializer.
+An object always holds and cancels it. Store handles when a disappearing view, a
 retry, or a newer request must cancel older work. Check cancellation in long loops and
 before publishing stale results.
 
 Shared mutable state sits behind actors, main-actor
-isolation, or explicit synchronization, with actor isolation preferred over
-`DispatchQueue.main.async`. The compiler verifies `Sendable` designs; a module without
-concurrency annotations gets `@preconcurrency import`, and `@unchecked Sendable` or
-`nonisolated(unsafe)` appears only with a documented local invariant and no safer design.
+isolation, or explicit synchronization. Prefer actor isolation to
+`DispatchQueue.main.async`. The compiler verifies `Sendable` designs. A module without
+concurrency annotations gets `@preconcurrency import`. `@unchecked Sendable` or
+`nonisolated(unsafe)` appears only with a documented local invariant and no safer option.
 Inject clocks and scheduling interfaces where time affects logic or tests.
 
 Typed errors serve callers with different recovery paths, and untyped `Error` only generic
 boundaries where cases add nothing. Technical errors become user-facing messages at the presentation
 boundary. Failed operations throw, and UI loading and error display use explicit state enums.
 Reserve `fatalError` for an unrecoverable programmer error with a documented invariant,
-`assertionFailure` for an unexpected but recoverable state, and `precondition` for an invariant
+`assertionFailure` for an unexpected but recoverable state, and `precondition` for a condition
 that continuing requires.
+
+## Naming
+
+### Case, scope, and files
+
+<!-- level: all -->
+
+Preserve external names and domain notation that the team uses. Express privacy through access
+modifiers, not an underscore.
+
+Express a structural relationship through nesting rather than a longer
+top-level name: `Parser.Error`, not `ParseError`. A static property does not repeat its
+declaring type: `UIColor.primary`, not `UIColor.primaryColor`. Use `shared` and `default`
+only when they describe the role.
+
+### Roles
+
+<!-- level: all -->
+
+A suffix says what a type owns and means one thing across the whole codebase. If `Repository`
+owns domain-facing data access in one feature, it never means HTTP mechanics in another.
+Which suffixes a project uses depends on the pattern it picked, but these framework words have
+one meaning:
+
+| Role word        | Use when                                                                               |
+| ---------------- | -------------------------------------------------------------------------------------- |
+| `View`           | SwiftUI or UIKit view type that presents UI.                                           |
+| `ViewController` | UIKit screen controller.                                                               |
+| `ViewModel`      | Holds presentation state and user intent for one screen, flow, or cohesive surface.    |
+| `ViewState`      | Value describing screen presentation state.                                            |
+| `ViewAction`     | Typed user or lifecycle intent sent by a view.                                         |
+| `Coordinator`    | Holds navigation or flow state.                                                        |
+| `Router`         | Route mutation or destination-selection boundary, narrower than a coordinator.         |
+| `DataSource`     | UIKit list adapter that feeds rows and sections.                                       |
+| `CellModel`      | Values a reusable cell renders: strings, image references, state, and lightweight IDs. |
+
+Repository protocols use domain language, results, and operations, such as
+`TemplateRepository.getTemplate`. An implementation may name its technology, such as
+`HTTPTemplateRepository`, when several real variants exist. Client types own
+external API or SDK mechanics such as `TemplateAPIClient`. Coordinators own route state, destination
+construction, stack mutations, and presentation flow such as `TemplateCoordinator.showEditTemplate`.
+Keep route enums within their feature and name them for the flow. Give them stable domain identifiers
+such as `TemplateDestination.editTemplate`, never view models, views, repository implementations, SDK
+clients, database records, or DTOs.
+
+### Methods, labels, and delegates
+
+<!-- level: all -->
+
+When the project uses view models, name a direct UI event for what happened,
+such as `submitButtonTapped()`, `cameraPermissionDenied()`, or `selectedItemChanged(to:)`. Name domain work
+with a verb such as `enqueueFileUpload(_:)`, `refreshOrderHistory(for:)`, or
+`validateEmailAddress(_:)`. `handle`, `process`, and `didTap` describe neither. Reserve `handle...` for
+literal UIKit target-action and notification handlers marked `@objc`.
+
+Call sites read as grammatical English: omit the first label when the base
+name and argument form a phrase. Include it when it clarifies a weak type. Initializer
+arguments that set stored properties take the same names with explicit `self.`.
+Factories use `make...`, such as `makeTemplateView(for:)`. Nonmutating methods without side effects
+read as noun phrases; mutating ones as imperatives. Pairs follow `sort`/`sorted`,
+`append`/`appending`, and `formUnion`/`union`.
+
+A delegate method passes the source object first and unlabeled, and never trims its signature because
+one caller owns it. A source-only `Void` event combines the type name with a tense
+phrase: `draftStore(_:didDeleteDraft:)`. A source-only `Bool` answer uses `can`, `is`, or
+another predicate, never `should` or `may`: `draftStoreCanDeleteDraft`. Name a source-only value with a
+noun phrase and a natural preposition: `numberOfSections(in:)`. Extra arguments make the
+second label describe the event or requested value:
+`messageListDataSource(_:heightForMessageAt:)`.
+
+### Protocols and identifiers
+
+<!-- level: all -->
+
+A protocol carries no `I` prefix and no `Protocol` suffix. Name a domain role with a noun such as `TemplateRepository`. Name a capability for its behavior, often with `-ing`,
+such as `ProgressReporting`, `ThemeColorProviding`, or `LoginCoordinating`. Avoid an automatic `-able`
+name that describes no clear capability. `Provider`, `Repository`, `Client`, and
+`Coordinating` appear only when the protocol serves that role. Do not add a protocol per ViewModel or use
+case only to enable mocks.
+
+Presentation identifiers provide stable interfaces for UI identity, diffable data sources,
+navigation, persistence, and tests. Name them for what they identify, not for the framework
+that consumes them. Snapshot items use stable presentation or domain IDs, never DTO identity,
+array offsets, or index paths. `id` suffices when the enclosing type supplies the context,
+such as `MessageRow.id`. A role-qualified name such as `selectedMessageID` or `conversationID`
+serves a scope with several identifiers.

package/configurations/language/swift/rules/SWIFTUI.md

@@ -1,21 +1,23 @@
 # SwiftUI
 
+Read this rule when you change SwiftUI views or state.
+
 ## Architecture
 
 <!-- level: all -->
 
-This rule picks no presentation pattern, such as Model-View-ViewModel (MVVM) or The Composable Architecture (TCA); a project that wants one writes it
-down.
+This rule picks no presentation pattern, such as Model-View-ViewModel (MVVM) or The Composable Architecture (TCA); a project that adopts one
+documents it.
 
 ## SwiftUI views
 
-- Keep view-local state in the view when its lifetime matches the view's identity.
+- Keep state local when its lifetime matches the identity of the view.
   Use `@State`, `@FocusState`, `@GestureState`, and bindings according to their
   ownership and read contracts.
 - Keep view-owned state properties private. Inject values owned by a parent
   through the appropriate input or binding.
 - Preserve read and actor isolation when state changes.
-- Do not store derived state in `@State` when source state provides enough data to compute it.
+- Do not store derived values in `@State` when you can compute them from the source state.
 - Avoid heavy computation in `body`; SwiftUI can evaluate it repeatedly.
 - Preserve cancellation and stale-result handling for lifecycle work started with
   `.task`, `.onAppear`, or refresh actions.
@@ -24,9 +26,9 @@ down.
 
 <!-- level: all -->
 
-- Views render state and forward user intent to the project's operation or state owner.
-- Keep business workflows, network calls, database calls, and concrete infrastructure
-  construction in their existing owners.
+- Views render state and forward user intent to the project operation or the object that holds it.
+- Keep business workflows, network and database calls, and concrete infrastructure
+  construction in the types that handle them.
 - Do not add explicit `@ViewBuilder` to `body`; the compiler provides it.
 - Use `@ViewBuilder` for helper properties or functions that need conditional view branches.
 - Omit `else { EmptyView() }` when the missing branch already produces no content.
@@ -39,9 +41,9 @@ down.
 
 <!-- level: all -->
 
-Keep screen and flow state in the project's selected state owner. Use a shared owner
+Keep screen and flow state in the type the project chose for it. Use a shared store
 when multiple screens need the same state. A store owns cohesive feature or domain
-state; app-wide state belongs in app composition only for global state, such as
+state. App composition holds only global state, such as
 session, theme, or connectivity.
 
 Prefer an enum for mutually exclusive loading states instead of parallel booleans.