@gspothq/cli 0.1.1 → 0.2.0

package/configurations/framework/fastapi/rules/FASTAPI.md

@@ -1,13 +1,14 @@
 # FastAPI
 
-Structure, parameters, schemas, responses, errors, and the runtime of a Python project on FastAPI
-and Pydantic v2.
+Read this rule when you change a FastAPI application.
+
+These rules target FastAPI with Pydantic v2.
 
 ## Structure
 
 <!-- level: all -->
 
-Path operations adapt HTTP input to application calls and results to HTTP output; business logic
+Path operations turn HTTP input into application calls and results into responses. Business logic
 lives outside them. One main module creates the `FastAPI` object and wires routers, global
 dependencies, middleware, exception handlers, and startup. Routers group related operations under
 a prefix that does not end in `/`, and imports use their domain, `items.router` and `users.router`.
@@ -46,16 +47,16 @@ app.include_router(router)
 
 ## Parameters
 
-`Annotated[..., Query(...)]`, `Path`, `Body`, `Header`, `Cookie`, `Form`, `File`, or `Depends`;
-a plain scalar supplies a query parameter. A parameter without a default requires a value, even when it
+Declare each parameter with `Annotated[..., Query(...)]`, `Path`, `Body`, `Header`, `Cookie`, `Form`, `File`, or
+`Depends`. A plain scalar supplies a query parameter. A parameter without a default requires a value, even when it
 accepts `None`. Constraints such as `max_length` or `ge` belong at the boundary when the public interface requires them. Use a dependency for a check that needs a database or authorization state, not
 a validator. Declare fixed routes such as `/users/me` before `/users/{user_id}`, and group
 pagination or filter parameters into a query model with `extra="forbid"`.
 
-Forms need `python-multipart`, and one operation never mixes JSON body fields with form fields
+Forms need `python-multipart`, and one operation never mixes JSON body fields with form data
 or files. Uploads arrive as `UploadFile`, bounded in count and size; `bytes` holds only small
-values. Never use a filename as a filesystem path, a content type never proves safety, and never log uploaded
-contents.
+values. Never use a filename as a filesystem path or log uploaded contents. A content type proves nothing
+about safety.
 
 ## Schemas and responses
 
@@ -63,32 +64,32 @@ Pydantic models define the schemas where data enters or leaves. Use separate cla
 their fields differ. Never return an input with passwords or tokens as the response. Known JSON
 shapes use nested models with typed containers. Use `UUID` for identifiers, timezone-aware instants across a
 boundary, and `Decimal` for money. A partial update reads
-`model_dump(exclude_unset=True)`, merges with the stored value, and validates the complete model,
-because `model_copy(update=...)` validates nothing.
+`model_dump(exclude_unset=True)`, merges with the stored value, and validates the whole model;
+`model_copy(update=...)` skips validation.
 
 The return type defines the public schema; `response_model` serves a returned object of another
 shape. A dedicated output model filters fields, never `response_model_exclude`, which still
-documents the full model. A response validation failure shows a server bug. Fix the data or
+documents the whole schema. A response validation failure shows a server bug. Fix the data or
 the schema.
 
 ## Status codes and errors
 
 Non-default success codes go in the decorator with `fastapi.status` constants: 201 for creation,
 202 for accepted work, and 204 for a deliberate empty body. Raise `HTTPException` rather than returning it. Its `detail` supplies a public error message. Existence and
-authorization checks answer alike, so responses do not reveal a private resource. Global exception
-handlers return the standard error shape and never echo a validation error's body.
+authorization checks fail the same way, so responses do not reveal a private resource. Global exception
+handlers return the standard error shape and never echo the request body from a validation failure.
 
 ## Runtime
 
-- Declare a path operation or dependency `async def` when it awaits async libraries and `def` when it
-  calls blocking code; a blocking call inside `async def` stalls the event loop. Run CPU-heavy work in a worker process, not in `async def`.
+- Declare a path operation or dependency `async def` when it awaits async libraries, and `def` when it
+  calls blocking code. A blocking call inside `async def` stalls the event loop. Run CPU-heavy work in a worker process, not in `async def`.
 - Dependencies carry request-scoped concerns: authentication, sessions, pagination, and
   reusable validation. A `yield` dependency owns one resource, cleans up in `finally`, and
   re-raises what it catches.
 - Authentication that appears in OpenAPI uses the security utilities. A JSON Web Token (JWT) verifier allows an
   explicit algorithm list and requires `exp` and `sub`.
-- `BackgroundTasks` runs small follow-up work after the response; durable or heavy work goes to
-  a queue. Middleware holds cross-cutting HTTP behavior only, and the last middleware added runs
+- `BackgroundTasks` runs small follow-up jobs after the response; durable or heavy work goes to
+  a queue. Middleware holds cross-cutting HTTP behavior only, and the one added last runs
   outermost.
 - Turn OpenAPI and the interactive docs off unless a typed setting turns them on, and the schema
   exposes no internal or admin routes.
@@ -97,4 +98,4 @@ handlers return the standard error shape and never echo a validation error's bod
 
 Tests cover the HTTP contract through the test client: status codes, bodies, headers, and
 authentication. Replace external systems with dependency overrides at the application
-boundary. Tests cover the application rather than FastAPI's routing implementation.
+boundary. Tests cover the application, not the routing implementation of FastAPI.

package/configurations/framework/nestjs/manifest.toml

@@ -1,11 +1,8 @@
-[prefix_collisions]
-kinds = ["controller", "service", "module", "guard", "pipe", "filter", "interceptor", "middleware", "decorator", "gateway", "resolver", "repository", "entity", "dto", "strategy", "provider"]
-
 [configuration]
-title = "NestJS"
+description = "A NestJS service: the compiler options that decorators need, plugin rules for providers, routes, and DTOs, and no circular modules."
 requires = ["typescript"]
 suggests = []
-description = "A NestJS service: the compiler options decorators need, the NestJS plugin rules for providers, routes, and DTOs, and no circular modules."
+title = "NestJS"
 
 [detect]
 dependencies = ["@nestjs/core"]
@@ -14,12 +11,15 @@ filenames = ["nest-cli.json"]
 [files]
 filenames = ["nest-cli.json"]
 
+[shared_prefixes]
+kinds = ["controller", "service", "module", "guard", "pipe", "filter", "interceptor", "middleware", "decorator", "gateway", "resolver", "repository", "entity", "dto", "strategy", "provider"]
+
 [[tool]]
+kind = "library"
 name = "@darraghor/eslint-plugin-nestjs-typed"
+npm = "@darraghor/eslint-plugin-nestjs-typed"
 rule_prefix = "@darraghor/nestjs-typed"
-kind = "library"
 version = "7.5.5"
-npm = "@darraghor/eslint-plugin-nestjs-typed"
 
 [eslint]
 all_level_rules = ["@darraghor/nestjs-typed/api-operation-summary-description-capitalized"]
@@ -33,20 +33,20 @@ package = "@darraghor/eslint-plugin-nestjs-typed"
 source = "configs.flatNoSwagger"
 
 [[eslint.rules_off]]
-rules = ["gspot/no-trivial-files", "gspot/no-trivial-functions"]
 files = ["**/*.module.ts"]
 reason = "A Nest module is an empty decorated class that registers providers and controllers, which is the shape Nest asks for."
+rules = ["gspot/no-trivial-files", "gspot/no-trivial-functions"]
 
 [[eslint.selectors]]
-selector = "CallExpression[callee.name='forwardRef']"
 message = "forwardRef papers over two modules that import each other. Move what both need into a third module."
+selector = "CallExpression[callee.name='forwardRef']"
 
 [[eslint.selectors]]
-selector = "Decorator[expression.callee.name=/^(Res|Response)$/]:not(:has(Property[key.name='passthrough'][value.value=true]))"
 message = "Taking the response object turns off interceptors and the return value. Return the value, or pass { passthrough: true }."
+selector = "Decorator[expression.callee.name=/^(Res|Response)$/]:not(:has(Property[key.name='passthrough'][value.value=true]))"
 
 [[tool_file]]
-target = ".gspot/config/eslint.config.mjs"
-tool = "eslint"
 fragment = true
 required_tools = ["@darraghor/eslint-plugin-nestjs-typed"]
+target = ".gspot/config/eslint.config.mjs"
+tool = "eslint"

package/configurations/framework/nestjs/rules/NESTJS.md

@@ -1,6 +1,6 @@
 # NestJS
 
-These rules cover NestJS modules, controllers, providers, validation, configuration, and tests.
+Read this rule when you change NestJS modules, controllers, providers, or their tests.
 
 ## Request handling
 
@@ -11,25 +11,25 @@ These rules cover NestJS modules, controllers, providers, validation, configurat
 
 ## Providers and lifecycle
 
-- Register each provider with its intended owner. Repeated registration can create distinct instances.
+- Register each provider in the module that owns it. Repeated registration can create distinct instances.
 - Request-scoped dependencies propagate request scope to their consumers. Check lifetime and
-  resource costs before selecting that scope.
+  resource costs before choosing that scope.
 - Close connections and timers through the application lifecycle, such as `OnModuleDestroy`.
 
 ## Configuration and security
 
 - Fail startup when required configuration has missing or malformed values.
-- Use guards for route authorization. Enforce additional permissions at each protected operation
-  when one request performs several operations or the service has non-HTTP callers.
-- Guards run before pipes. Do not assume guard inputs have passed DTO transformation or validation.
+- Use guards for route authorization. Enforce extra permissions inside each protected operation
+  when one request runs several, or the service has non-HTTP callers.
+- Guards run before pipes. Do not assume guard inputs have passed data transfer object (DTO) transformation or validation.
 - Set request-size limits, security headers, and rate limits for the exposed application.
 
 ## Feature organization
 
 <!-- level: all -->
 
-- Give each feature one module and export only providers consumed by other features.
-- Inject dependencies through constructors instead of constructing them inside consumers.
+- Give each feature one module, and export only the providers that other modules consume.
+- Inject dependencies through constructors instead of creating them inside consumers.
 - Define the versioning contract before publishing a public API.
 - Keep request DTOs distinct from persistence entities and map between them explicitly.
 
@@ -40,5 +40,5 @@ These rules cover NestJS modules, controllers, providers, validation, configurat
 - Do not mock the class under test or assert on private methods.
 - Close test applications in teardown.
 
-See Nest's [response handling](https://docs.nestjs.com/controllers) and
+See the NestJS [response handling](https://docs.nestjs.com/controllers) and
 [authorization guidance](https://docs.nestjs.com/security/authorization).

package/configurations/framework/nextjs/manifest.toml

@@ -1,25 +1,11 @@
-route_files = ["page", "layout", "template", "default", "loading", "error", "not-found", "global-error", "route", "middleware", "proxy"]
 allowed_words = ["Next.js"]
 generated = ["next-env.d.ts"]
 
-[[naming.override]]
-paths = ["**/app/**", "**/pages/**"]
-categories = ["files"]
-allowed_names = ["instrumentation", "sitemap", "robots", "manifest", "opengraph-image", "icon", "apple-icon", "_app", "_document", "_error", "404", "500"]
-reason = "Next.js names these files."
-
-[[naming.override]]
-paths = ["**"]
-languages = ["typescript", "javascript"]
-categories = ["functions", "methods", "variables"]
-allowed_names = ["getStaticProps", "getServerSideProps", "generateMetadata", "generateStaticParams", "generateViewport"]
-reason = "Next.js discovers these data and metadata exports by name."
-
 [configuration]
-title = "Next.js"
+description = "A Next.js app: ESLint rules for the framework and hooks, and server code marked server-only. The configuration leaves every build check on."
 requires = ["typescript", "react", "react-dom"]
 suggests = ["css"]
-description = "A Next.js app: the framework and hooks rules of ESLint, and server code marked as server only. Route segments serve one thing, and the configuration turns no build check off."
+title = "Next.js"
 
 [detect]
 dependencies = ["next"]
@@ -27,75 +13,31 @@ dependencies = ["next"]
 [files]
 paths = ["**/next.config.js", "**/next.config.mjs", "**/next.config.ts"]
 
+[[naming.override]]
+allowed_names = ["page", "layout", "template", "default", "loading", "error", "not-found", "global-error", "route", "middleware", "proxy", "instrumentation", "sitemap", "robots", "manifest", "opengraph-image", "icon", "apple-icon", "_app", "_document", "_error", "404", "500"]
+categories = ["files"]
+paths = ["**/app/**", "**/pages/**"]
+reason = "Next.js names these files."
+
+[[naming.override]]
+allowed_names = ["getStaticProps", "getServerSideProps", "generateMetadata", "generateStaticParams", "generateViewport"]
+categories = ["functions", "methods", "variables"]
+languages = ["typescript", "javascript"]
+paths = ["**"]
+reason = "Next.js discovers these data and metadata exports by name."
+
 [[tool]]
+min_version = "15.5.0"
 name = "next"
 system = true
-min_version = "15.5.0"
 version_command = ["--version"]
 
 [[tool]]
+kind = "library"
 name = "@next/eslint-plugin-next"
+npm = "@next/eslint-plugin-next"
 rule_prefix = "@next/next"
-kind = "library"
 version = "16.3.8"
-npm = "@next/eslint-plugin-next"
-
-[[check]]
-name = "tsc"
-tool = "next"
-example = "The TypeScript declaration `const count: number = \"one\";` reports an incompatible assignment. Correct it to `const count: number = 1;` when the contract requires a number."
-level = "recommended"
-stage = "push"
-runs = "scope"
-instead_of = "typescript/tsc"
-summary = "Has Next.js write its types, then type-checks the app with the strict compiler options."
-why = "A fresh clone holds no next-env.d.ts and no route types, so a plain tsc run fails on imports the framework resolves."
-help = "Read the first error tsc prints and fix that file; later errors are often the same mistake."
-
-[[check]]
-name = "build"
-tool = "next"
-example = "A Next.js page importing a nonexistent component fails the project build. Restore the component or correct the import path and rerun the configured build."
-level = "all"
-stage = "push"
-runs = "scope"
-needs = ["build"]
-summary = "Builds the app with next build at all when its scope contains an app or pages tree."
-why = "Some mistakes show only at build time: a server import in a client file, or a page that cannot be prerendered."
-help = "Run next build and read the first error it prints."
-
-[check.files]
-paths = ["**/app/**", "**/pages/**"]
-
-[[check]]
-name = "route-segments"
-example = "A Next.js segment containing both `page.tsx` and `route.ts` reports conflicting route ownership. Move the route handler into a separate segment, such as `api`, and update its callers."
-level = "recommended"
-stage = "commit"
-runs = "once"
-summary = "Checks that no route segment holds both a page and a route handler."
-why = "This commit check finds route conflicts before next build and also runs at recommended, where the build check does not."
-help = "Move the route handler into a segment of its own, such as an api folder."
-
-[[check]]
-name = "next-config"
-example = "Setting `typescript.ignoreBuildErrors` to `true` in Next.js configuration reports a disabled type gate. Remove the switch and correct the type errors before building."
-level = "recommended"
-stage = "commit"
-runs = "once"
-summary = "Checks that the framework configuration turns no build check off and puts no secret into the client environment."
-why = "A build that ignores lint and type errors ships them, and a key under env is readable by every visitor."
-help = "Remove the switch, and read the secret on the server."
-
-[[check]]
-name = "version-pairs"
-example = "Different installed versions of `next` and its lint package report an alignment finding. Install the same version of both and update the lockfile with the package manager."
-level = "recommended"
-stage = "commit"
-runs = "once"
-summary = "Checks that Next.js and its lint packages use the same installed version."
-why = "A lint package a version behind flags what the framework allows and allows what it removed."
-help = "Move both packages to the same version."
 
 [eslint]
 all_level_rules = ["@next/next/next-script-for-ga", "@next/next/no-html-link-for-pages", "@next/next/no-img-element", "@next/next/no-page-custom-font"]
@@ -109,11 +51,29 @@ package = "eslint-plugin-react-refresh"
 source = "configs.next"
 
 [[eslint.rules_off]]
-rules = ["gspot/no-trivial-files"]
+files = ["**/{page,layout,template,default,loading,error,not-found,global-error,route,middleware,proxy}.{js,jsx,ts,tsx}"]
 reason = "Next.js discovers route files by name, so each file can hold one export in its own folder."
+rules = ["gspot/no-trivial-files"]
 
 [[tool_file]]
-target = ".gspot/config/eslint.config.mjs"
-tool = "eslint"
 fragment = true
 required_tools = ["@next/eslint-plugin-next"]
+target = ".gspot/config/eslint.config.mjs"
+tool = "eslint"
+
+[[tool_file]]
+per_scope = true
+target = ".gspot/config/semgrep/nextjs.yml"
+tool = "semgrep"
+
+[[check]]
+example = "`const count: number = \"one\";` reports an incompatible assignment. Assign a number, such as `const count: number = 1;`."
+help = "Fix the first error tsc prints; later errors often come from the same mistake."
+instead_of = "typescript/tsc"
+level = "recommended"
+name = "tsc"
+runs = "scope"
+stage = "push"
+summary = "Has Next.js write its types, then type-checks the app with the strict compiler options."
+tool = "next"
+why = "A fresh clone holds no next-env.d.ts and no route types, so a plain tsc run fails on imports the framework resolves."

package/configurations/framework/nextjs/rules/NEXTJS.md

@@ -1,17 +1,19 @@
 # Next.js
 
+Read this rule when you change a Next.js application.
+
 Preserve the project's router, installed Next.js and React versions, runtime, and deployment
 adapter. App Router guidance applies only to App Router routes.
 
 ## Server and client ownership
 
 Keep privileged operations and credentials on the server. Send only authorized fields to the
-browser. That includes query hydration and Server Component props. A hidden control, type, or filename
-does not control access. A client entry includes its imports in the client graph; keep it small
+browser; that covers query hydration and Server Component props too. A hidden control, type, or filename
+does not restrict access. A client boundary pulls its imports into the browser bundle; keep it small
 and compose server-rendered children into it.
 
-Validate and authorize every mutation at its server entry. Routes, actions, and RPC procedures
-share the same domain operation. Initial server reads do not HTTP-fetch the application's own
+Validate and authorize every mutation at its server entry point. Routes, actions, and RPC procedures
+share one domain operation. Initial server reads do not HTTP-fetch the application's own
 Route Handler. Rendering, `GET` requests, and prefetching perform no writes.
 
 See [Server and Client Components](https://nextjs.org/docs/app/getting-started/server-and-client-components).
@@ -19,12 +21,12 @@ See [Server and Client Components](https://nextjs.org/docs/app/getting-started/s
 ## Loading and failures
 
 Put a loading boundary around the section that waits. Keep useful content mounted during refresh,
-and reset pending state when the selected resource changes. Start independent work early without
+and reset pending state when the user switches resources. Start independent work early without
 moving protected reads before authorization.
 
 Decide status, headers, cookies, redirects, and not-found behavior before streaming commits the
 response. Preserve framework control-flow exceptions. Check direct load, client navigation,
-refresh, Back, and failed prefetch; those paths need not share the same state.
+refresh, Back, and failed prefetch; those paths may differ in state.
 
 See [streaming](https://nextjs.org/docs/app/guides/streaming).
 
@@ -36,7 +38,7 @@ filters, and permissions where they affect results; session tokens stay out of k
 
 Default private data to uncached until an isolation design exists. Never let a cached decision
 retain revoked access. Clear private browser caches on logout. Invalidate after the write commits
-and before a terminating redirect; a failed refresh must not retry the committed write.
+and before a terminating redirect; a failed refresh must not retry it.
 Next.js and a client query cache need separate reconciliation.
 
 See [caching](https://nextjs.org/docs/app/getting-started/caching)

package/configurations/framework/nextjs/tool-files/semgrep/nextjs.yml

@@ -0,0 +1,35 @@
+rules:
+    - id: nextjs.checks-off
+      languages: [typescript, javascript]
+      severity: ERROR
+      message: $KEY true lets next build pass with errors. Remove it.
+      paths:
+          include: ['**/next.config.*']
+      patterns:
+          - pattern-either:
+                - pattern: |
+                      {..., $KEY: true, ...}
+                - pattern: |
+                      {..., $KEY: (true as $T), ...}
+                - pattern: |
+                      {..., $KEY: true satisfies $T, ...}
+          - metavariable-regex:
+                metavariable: $KEY
+                regex: ^["']?(ignoreBuildErrors|ignoreDuringBuilds)["']?$
+          - focus-metavariable: $KEY
+    - id: nextjs.env-secret
+      languages: [typescript, javascript]
+      severity: ERROR
+      message: $KEY under env is written into the client bundle. Read it on the server.
+      paths:
+          include: ['**/next.config.*']
+      patterns:
+          - pattern-either:
+                - pattern: |
+                      {..., env: {..., $KEY: $V, ...}, ...}
+                - pattern: |
+                      {..., env: {..., $KEY, ...}, ...}
+          - metavariable-regex:
+                metavariable: $KEY
+                regex: ^["']?(?=[A-Z\d_]*(?:SECRET|TOKEN|PASSWORD|PRIVATE_KEY|API_KEY))[A-Z][A-Z\d_]*["']?$
+          - focus-metavariable: $KEY

package/configurations/framework/react/manifest.toml

@@ -1,63 +1,56 @@
 allowed_words = ["React"]
 
 [configuration]
-title = "React"
+description = "React components: the recommended React and hooks rules as errors, and component files that keep their state on a reload."
 requires = ["javascript"]
 suggests = ["typescript", "css", "react-dom"]
-description = "React components: the recommended React and hooks rules as errors, component files that keep their state on a reload."
+title = "React"
 
 [detect]
 dependencies = ["react"]
 
+[defaults]
+"tools.eslint.import_extension" = "extensionless"
+
+[[naming.override]]
+cases = ["pascal", "kebab"]
+categories = ["files"]
+paths = ["**/*.tsx", "**/*.jsx"]
+reason = "A component file takes the component's name."
+
+[[naming.override]]
+cases = ["pascal", "camel"]
+categories = ["functions"]
+paths = ["**/*.tsx", "**/*.jsx"]
+reason = "A function that returns JSX is a component and takes a capital."
+
+[[naming.override]]
+allowed_names = ["useSyncExternalStore", "getSnapshot", "getServerSnapshot"]
+categories = ["functions", "methods", "variables"]
+languages = ["typescript", "javascript"]
+paths = ["**"]
+reason = "React defines these subscription and snapshot callback names."
+
 [[tool]]
+kind = "library"
 name = "eslint-plugin-react-hooks"
+npm = "eslint-plugin-react-hooks"
 rule_prefix = "react-hooks"
-kind = "library"
 version = "7.1.1"
-npm = "eslint-plugin-react-hooks"
 
 [[tool]]
+kind = "library"
 name = "eslint-plugin-react"
+npm = "eslint-plugin-react"
 rule_prefix = "react"
-kind = "library"
 version = "7.37.5"
-npm = "eslint-plugin-react"
 
 [[tool]]
+kind = "library"
 name = "eslint-plugin-react-refresh"
+npm = "eslint-plugin-react-refresh"
 rule_prefix = "react-refresh"
-kind = "library"
 version = "0.5.7"
-npm = "eslint-plugin-react-refresh"
-
-[[check]]
-name = "version-pairs"
-example = "Different installed versions of react and react-dom report an alignment finding. Install the same version of both and update the lockfile with the package manager."
-level = "recommended"
-stage = "commit"
-runs = "once"
-summary = "Checks that react and react-dom use the same installed version."
-why = "React and its DOM renderer ship together and expect matching versions."
-help = "Install the same version of react and react-dom."
-
-[[naming.override]]
-paths = ["**/*.tsx", "**/*.jsx"]
-categories = ["files"]
-cases = ["pascal", "kebab"]
-reason = "A component file takes the component's name."
-
-[[naming.override]]
-paths = ["**/*.tsx", "**/*.jsx"]
-categories = ["functions"]
-cases = ["pascal", "camel"]
-reason = "A function that returns JSX is a component and takes a capital."
-
-[[naming.override]]
-paths = ["**"]
-languages = ["typescript", "javascript"]
-categories = ["functions", "methods", "variables"]
-allowed_names = ["useSyncExternalStore", "getSnapshot", "getServerSnapshot"]
-reason = "React defines these subscription and snapshot callback names."
 
 [eslint]
 all_level_rules = ["react/self-closing-comp", "react/display-name", "react/no-array-index-key", "react/prop-types"]
@@ -79,15 +72,12 @@ package = "eslint-plugin-react-refresh"
 source = "configs.recommended"
 
 [[eslint.rules_off]]
-rules = ["gspot/no-trivial-files", "gspot/no-trivial-functions"]
 files = ["**/*.tsx", "**/*.jsx"]
 reason = "React renders a component by its name, so a component of one statement, alone in its file, is the shape React asks for."
-
-[defaults]
-"tools.eslint.import_extension" = "extensionless"
+rules = ["gspot/no-trivial-files", "gspot/no-trivial-functions"]
 
 [[tool_file]]
-target = ".gspot/config/eslint.config.mjs"
-tool = "eslint"
 fragment = true
 required_tools = ["eslint-plugin-react-hooks", "eslint-plugin-react", "eslint-plugin-react-refresh"]
+target = ".gspot/config/eslint.config.mjs"
+tool = "eslint"

package/configurations/framework/react/rules/REACT.md

@@ -1,7 +1,6 @@
 # React
 
-Rules that hold for any React application: Next.js, Vite, Expo, or a library. The framework file
-adds routing, server components, and caching on top of these.
+Read this rule when you change React components, hooks, or state.
 
 ## Components
 
@@ -15,7 +14,7 @@ adds routing, server components, and caching on top of these.
 
 - Compose downward: a component imports children and shared primitives, never its parent, its
   section, or its route.
-- Domain-neutral primitives such as button, input, dialog, popover, and tooltip live in the shared UI owner
+- Domain-neutral primitives such as button, input, dialog, popover, and tooltip live in the shared UI folder
   and take values and callbacks. They never fetch or import a feature.
 - Keep a component small enough that its JSX reads as one screen region. Extract by visual
   responsibility, not by line count.
@@ -26,18 +25,18 @@ adds routing, server components, and caching on top of these.
 ## Hooks
 
 - Every custom hook starts with `use` and owns one concern.
-- Memoize such as `useMemo`, `useCallback`, `memo` when a measurement shows expensive work or a
-  consumer needs a stable reference, not by default.
+- Memoize with `useMemo`, `useCallback`, or `memo` only when a measurement shows expensive work or a consumer
+  needs a stable reference.
 
 ## Effects and state
 
 - Keep renders pure. Effects synchronize external systems; handlers own user-triggered work. Derive
   ordinary values during render rather than synchronizing duplicate state with effects. Clean up
   timers, observers, subscriptions, animation frames, and requests.
-- Use refs for mutable controller values and state for values displayed in the UI.
+- Use refs for mutable controller values and state for what the UI displays.
 
-- Give each state value one owner: URL state for navigation, query cache for server snapshots, form/local
-  state for editing, and client store for truly shared client state.
+- Give each state value one place. Navigation goes in the URL, server snapshots in the query cache, edits in
+  form or local state, and shared data in a client store.
 
 - Reset private state across identity and tenant changes; give each request its own server stores.
 
@@ -47,23 +46,23 @@ adds routing, server components, and caching on top of these.
 
 ## Read states and writes
 
-- Keep the first pending request, an empty result, and a failed request distinct. Show a stable
+- Keep the first pending load, an empty result, and a failed request distinct. Show a stable
   fallback, an explanation of the empty result, or safe error and retry UI for the matching state.
 - Keep existing content during a background refresh or a pending next page. A failed refresh does
   not erase a successful result. Revoked access removes stale private content.
 - Capture the resource identity when work starts. A superseded request must not overwrite the
-  currently selected resource.
+  resource now in view.
 - An optimistic update defines how to confirm or undo the operation.
-- Present the result of a save separately from the result of a refresh.
+- Show the result of a save apart from that of a refresh.
 
 ## URL state
 
-- The URL owns filters, sorting, and other shareable navigation values. It carries a selected,
+- The URL owns filters, sorting, and other shareable navigation values. It carries a minimal,
   versioned representation, never credentials, private drafts, or the whole store.
 - Validate parsed values, and handle missing or malformed input without assertions or an unchecked
   `JSON.parse`.
 - Define the precedence among URL values, stored preferences, and defaults. When the URL owns a
-  value, back and forward navigation reach the state owner.
+  value, back and forward navigation reach the code that holds it.
 - One synchronization path compares values before writing, so store-to-URL and URL-to-store updates
   never loop.
 - Keep unrelated query parameters and fragments. Use the installed router or the History API to replace history for transient edits and to push an entry when back navigation restores the previous state.
@@ -83,7 +82,7 @@ UI updates after hydration. Fix the mismatch instead of hiding warnings globally
 - Give date/time formatting the same initial locale, time zone, and reference time where relative output otherwise differs.
 - Do not branch rendered markup on `typeof window` as a routine hydration fix. Server and first
   browser output agree on the visible tree.
-- Theme initialization may need the theme library's documented early script and a narrow hydration
+- Theme initialization may need the documented early script of its library and a narrow hydration
   exception. Keep that exception local to the affected node.
 - Do not mutate React-owned DOM to coordinate application state. Controlled state, refs, and
   third-party imperative APIs have explicit ownership boundaries.
@@ -98,11 +97,6 @@ UI updates after hydration. Fix the mismatch instead of hiding warnings globally
 ## Forms and inputs
 
 - Keep each input controlled or uncontrolled, never both. Choose per form and keep it.
-- Validate input against the declared contract and expose its errors to the user. When the application uses a form
+- Validate input against the declared contract and expose its errors to the user. When the application has a form
   library, use its supported validation and state APIs.
 - A form awaits the save and reports its result.
-
-## Accessibility
-
-- Use native interactive elements such as `button`, `a`, and `input`, or give each element the matching role,
-  keyboard handling, and focus management.