@gspothq/cli 0.1.1 → 0.2.0

package/configurations/library/translations/manifest.toml

@@ -1,40 +1,40 @@
 [configuration]
-title = "Translations"
-requires = ["javascript"]
 description = "Translated interfaces: no literal text in components, and message files that parse and stay complete in every locale."
+requires = ["javascript"]
+title = "Translations"
 
 [detect]
 dependencies = ["next-intl", "react-i18next", "i18next", "react-intl", "@lingui/core"]
 
+[rules."NEXT-INTL.md"]
+dependencies = ["next-intl"]
+
 [[tool]]
+kind = "library"
 name = "eslint-plugin-i18next"
+npm = "eslint-plugin-i18next"
 rule_prefix = "i18next"
-kind = "library"
 version = "6.1.5"
-npm = "eslint-plugin-i18next"
+
+[eslint]
+all_level_rules = ["i18next/no-literal-string"]
+
+[[tool_file]]
+fragment = true
+required_tools = ["eslint-plugin-i18next"]
+target = ".gspot/config/eslint.config.mjs"
+tool = "eslint"
 
 [[check]]
-name = "messages"
-example = "If the base locale defines `welcome` but another required locale does not, the check reports the missing key. Add the translated message with matching interpolation arguments."
+example = "When the base locale defines `welcome` and another lacks it, the check reports the missing key. Add the translation with the same placeholders."
+help = "Correct the message, or add the missing key to the locale."
 level = "recommended"
-stage = "push"
+name = "messages"
 runs = "scope"
-summary = "Checks next-intl JSON/ICU message files under translations.messages_folder: each message parses, none is empty, no key holds a dot, and every locale holds every key of the base."
-why = "This check compares every locale with the base locale, so missing keys and different interpolation arguments are found across files."
-help = "Correct the message, or add the missing key to the locale."
+stage = "push"
+summary = "Checks the next-intl JSON/ICU files under `translations.messages_folder`: each message parses, none stays empty, and each locale holds all keys of the base."
+why = "next-intl loads one locale at a time, so only a comparison with the base finds a missing key."
 
 [check.when]
 dependencies = ["next-intl"]
 setting = "translations.messages_folder"
-
-[rules."NEXT-INTL.md"]
-dependencies = ["next-intl"]
-
-[eslint]
-all_level_rules = ["i18next/no-literal-string"]
-
-[[tool_file]]
-target = ".gspot/config/eslint.config.mjs"
-tool = "eslint"
-fragment = true
-required_tools = ["eslint-plugin-i18next"]

package/configurations/library/translations/rules/NEXT-INTL.md

@@ -1,24 +1,22 @@
 # next-intl
 
-Rules for `next-intl` in a Next.js App Router application. The locale, catalog, and right-to-left (RTL) rules that
-hold for any framework appear in the shared translation rules; these add what the library dictates.
+Read this rule when you change next-intl configuration or messages.
 
 ## Configuration
 
 - One request configuration module owns locale resolution, message loading, time zone, and the
-  `now` reference. It validates the candidate locale against the supported list before building a
-  catalog import path. Nothing else resolves a locale.
+  `now` reference. Nothing else resolves a locale.
 - Define routing in one module: locales, default locale, prefix strategy, and pathnames
   that both the proxy and the navigation helpers import.
-- Use the library's navigation helpers such as `Link`, `redirect`, `usePathname`, `useRouter` for every
-  internal link so locale prefixes and alternate metadata stay correct. Never `next/link` directly
+- Use the library's navigation helpers such as `Link`, `redirect`, `usePathname`, and `useRouter` for every
+  internal link so locale prefixes and alternate metadata stay correct. Never use `next/link` directly
   in a localized route.
 
 ## Server and client boundaries
 
 - Use `getTranslations` in async Server Components. Non-async components can use
-  `useTranslations`; the library selects its server or client implementation from the render context.
-- Keep `now` and `timeZone` identical between the server render and the first browser render so
+  `useTranslations`; the library picks its server or client implementation from the render context.
+- Keep `now` and `timeZone` identical between the server and the first browser render, so
   formatted dates and relative times hydrate without mismatch.
 - Generate `alternates` and `canonical` metadata from the routing definition. Do not hand-write
   locale URLs in metadata.

package/configurations/library/translations/rules/TRANSLATIONS.md

@@ -1,24 +1,26 @@
 # Translations
 
+Read this rule when you change translated text, locales, or language switching.
+
 Internationalization, or i18n, lets an application support different languages and regional formats.
 A locale names the language and formatting conventions, message catalogs hold the translated text,
 and International Components for Unicode (ICU) MessageFormat adds placeholders, plurals, and selection to messages.
 
 ## Locales and routing
 
-- Define the supported locales, the default locale, and locale selection in one place, with Best Current Practice (BCP) 47
+- Define the supported locales, the default, and the selection logic in one place, with Best Current Practice (BCP) 47
   tags such as `en-GB`.
 - Check a locale from a URL, cookie, or header against the supported list before loading messages,
-  and build catalog import paths from checked values only. Unsupported input gets the documented
+  and build catalog import paths from validated values only. Unsupported input gets the documented
   default or not-found behavior, not a failed dynamic import.
 - Choose the routing deliberately. A public site with locale-prefixed URLs needs locale-aware links,
   redirects, canonical URLs, alternate-language metadata, and sitemap entries. An application
-  without indexed locale URLs can select the language by cookie or saved preference.
+  without indexed locale URLs can pick the language by cookie or saved preference.
 - Define the precedence among the URL, the saved preference, the negotiated header, and the
   default, without redirect loops.
-- A request-local i18n configuration owns resolution, and request handling and displayed content
-  use the same locale. Never keep a user's locale in mutable server module state, and partition
-  localized data in server, browser, and content delivery network (CDN) caches.
+- A request-local i18n configuration owns resolution; handlers and displayed content use the
+  same locale. Never keep a user's locale in mutable server module state. Partition localized
+  data in server, browser, and content delivery network (CDN) caches.
 
 ## Messages and catalogs
 
@@ -39,23 +41,22 @@ arbitrary server string, a display name, or an English source sentence.
 - User-generated content, proper names, identifiers, and developer logs supply interpolation data,
   not message keys, and stay untranslated.
 
-Translate every application-authored string the application displays to the user. That covers headings, buttons,
+Translate every string the application authors and displays to the user. That covers headings, buttons,
 placeholders, toasts, validation errors, accessible names, image alternatives, navigation,
 metadata, list status controls, and the empty, error, and loading states.
 
-Plural categories can differ by locale while every locale takes the same input value. Configure
+Plural categories can differ by locale for the same input value. Configure
 the catalog loader for the application's format and namespace layout.
 
 Translations land in the same change as their call sites; an incomplete locale leaves the
 supported list instead. Checks validate catalog structure. List the locales and screens for the
-user to check for linguistic accuracy, dynamic keys, and untranslated UI text. Missing
-show keys during development, and make a production fallback intentional and observable, never
+user to check for linguistic accuracy, dynamic keys, and untranslated UI text. Show missing keys during development. Make the production fallback deliberate and visible in the logs, never
 a silent `catch` that hides a missing catalog.
 
 ## Rendering and formatting
 
-- Use the framework's established i18n library. Translate on the server where rendering happens
-  there, and give each client provider the scoped messages its interactive children need, never
+- Use the framework's established i18n library. Translate on the server where it renders,
+  and give each client provider the scoped messages its interactive children need, never
   every locale or the whole catalog.
 - Format numbers, currencies, dates, relative times, and time zones through locale-aware APIs.
   Never infer currency or time zone from language alone.
@@ -66,24 +67,22 @@ a silent `catch` that hides a missing catalog.
 
 ## Changing the language
 
-1. Keep the current resource, relevant search parameters, and hash where the routing supports them.
-2. Persist the preference through the validated write owner when the product promises persistence.
-3. Navigate through the locale-aware routing, so server-rendered content, client labels, and
-   metadata agree.
-4.
-
-Refresh locale-dependent query keys and results instead of keeping translated data under an
-identity without the locale. 5. Keep focus and scroll position sensible. 6. Report a failed preference write; never show a completed selection that reverts on refresh.
+1. Keep the current resource, the relevant search parameters, and the hash where the routing supports them.
+2. Save the preference through the code that validates and stores it, when the product promises to keep it.
+3. Navigate through the locale-aware routing, so that server-rendered content, client labels, and metadata agree.
+4. Refresh locale-dependent query keys and results. Do not keep translated data under a key without the locale.
+5. Keep the focus and the scroll position.
+6. Report a failed preference write. Never show a selection that reverts on refresh.
 
-A language menu names each language with a clear label, commonly its native name, not a flag.
+A language menu names each language as its speakers write it, not with a flag.
 Treat region and currency as separate choices when the product offers them.
 
 ## Right-to-left layout
 
-Set the document's `lang` and `dir` for the selected locale. List supported right-to-left (RTL)
+Set the document's `lang` and `dir` for the active locale. List supported right-to-left (RTL)
 locales and affected screens for the user to check. Use logical spacing and alignment properties, and mirror an icon or image only when
 its meaning requires it. Focus order and horizontal scrolling follow the direction, and record data
-never reverses to display RTL text. Include identifiers and URLs inside translated sentences in that list because their directions mix.
+never reverses to display RTL text. Add translated sentences that hold identifiers or URLs to that list, because their text directions mix.
 
 ## Verification
 

package/configurations/library/trpc/manifest.toml

@@ -1,14 +1,14 @@
 allowed_words = ["tRPC"]
 
 [configuration]
-title = "tRPC"
+description = "tRPC routers: every procedure validates its input, and client code imports the server module as a type only. Name that module `server` in `[[architecture.module]]`."
 requires = ["javascript"]
-description = "tRPC routers: every procedure validates its input, and client code imports the declared server module as a type only. Name your server module `server` in `[[architecture.module]]`."
+title = "tRPC"
 
 [detect]
 dependencies = ["@trpc/server"]
 
 [[eslint.selectors]]
-selector = "CallExpression[callee.property.name=/^(query|mutation|subscription)$/]:not(:has(CallExpression[callee.property.name='input']))"
 message = "Give the procedure an input schema before its resolver, even when the input is nothing."
 role = "routers"
+selector = "CallExpression[callee.property.name=/^(query|mutation|subscription)$/]:not(:has(CallExpression[callee.property.name='input']))"

package/configurations/library/trpc/rules/TRPC.md

@@ -1,18 +1,20 @@
 # tRPC
 
-Use the client integration the project has. Do not mix the classic and TanStack-native clients.
+Read this rule when you change tRPC procedures or their client.
+
+Use the client integration the project has. Do not mix the classic client with the TanStack one.
 Check the installed release before using a version-specific API.
 
 ## Request ownership
 
 Create context from verified identity for each request. Context creation can run during prefetching,
 so it performs no writes. Each operation in a batch authorizes itself; a batch does not create a transaction.
-Authentication proves identity, and resource authorization proves access to the named resource.
+Authentication proves identity, and authorization proves access to the named resource.
 Neither a valid input nor a procedure named public proves permission.
 
 Direct callers receive verified context explicitly. Never store a session in a process-wide
 variable or cast a direct caller into an HTTP request. Procedures that share logic call the same
-authorized domain operation rather than calling each other.
+authorized domain operation rather than each other.
 
 See [authorization](https://trpc.io/docs/server/authorization)
 and [server callers](https://trpc.io/docs/server/server-side-calls).
@@ -22,18 +24,18 @@ and [server callers](https://trpc.io/docs/server/server-side-calls).
 Use generated query options and keys. A mutation key identifies a write, not the queries to
 invalidate. Server rendering and browser consumption use the same QueryClient and serialization
 contract; private results stay out of dehydration. A rendered server total and client-query rows
-need one data owner or coordinated refresh.
+need one source of the data or coordinated refresh.
 
 Cookie-setting operations use a transport that can finish headers before streaming. Configure
 serialization at both ends and preserve transformer metadata. Bound batch sizes and expensive
-work. One layer owns retries, and retries of a write require an idempotency contract.
+work. One layer owns retries, and a retried write requires an idempotency contract.
 
 See [TanStack integration](https://trpc.io/docs/client/tanstack-react-query/setup)
 and [links](https://trpc.io/docs/client/links).
 
 ## Cancellation and events
 
-Forward cancellation to the work owner and release listeners and streams. A disconnected client
+Forward cancellation to the code that does the work and release listeners and streams. A disconnected client
 does not prove that a write failed; recover its state by operation identity before retrying.
 Late responses must not update another resource or session.
 

package/configurations/library/zod/manifest.toml

@@ -1,25 +1,25 @@
 allowed_words = ["Zod"]
 
 [configuration]
-title = "Zod"
+description = "Zod: ESLint rules reject unsafe schema APIs and name the replacement for each deprecated one."
 requires = ["javascript"]
-description = "Zod schemas: ESLint rules reject unsafe schema APIs and recommend replacements for deprecated APIs."
+title = "Zod"
 
 [detect]
 dependencies = ["zod"]
 
 [[tool]]
+kind = "library"
 name = "eslint-plugin-zod"
+npm = "eslint-plugin-zod"
 rule_prefix = "zod"
-kind = "library"
 version = "4.12.0"
-npm = "eslint-plugin-zod"
 
 [eslint]
 all_level_rules = ["zod/no-any-schema", "zod/no-native-enum", "zod/prefer-meta-last", "zod/prefer-strict-object"]
 
 [[tool_file]]
-target = ".gspot/config/eslint.config.mjs"
-tool = "eslint"
 fragment = true
 required_tools = ["eslint-plugin-zod"]
+target = ".gspot/config/eslint.config.mjs"
+tool = "eslint"

package/configurations/library/zod/rules/ZOD.md

@@ -1,5 +1,7 @@
 # Zod
 
+Read this rule when you write or change a Zod schema.
+
 Check the installed release and its consumers before choosing an API. Put a runtime schema with
 the feature that owns the contract. Infer input and output types from it rather than keeping a
 second handwritten contract.
@@ -8,7 +10,7 @@ second handwritten contract.
 
 Parse values at the boundary that receives them and pass the parsed result inward. Static types,
 a constructed validator, and successful client validation do not validate a server request.
-An invalid provider response shows an integration failure, not invalid user input. A valid identifier
+An invalid provider response shows an integration failure, not bad user input. A valid identifier
 proves no access.
 
 Choose thrown or returned validation issues to match the boundary. Async checks need async parsing;
@@ -37,7 +39,7 @@ boundary without mutating global locale state for one request.
 
 A JSON Schema projection cannot represent every runtime contract. Keep runtime validation and
 verify the exported dialect against meaningful examples. Use an explicit transport schema for
-non-JSON values instead of allowing every value in the projection. Regenerate consumers when the
+non-JSON values instead of allowing anything in the projection. Regenerate consumers when the
 contract changes, and check omitted fields, defaults, patches, and date handling after an upgrade.
 
 See [error customization](https://zod.dev/error-customization)

package/configurations/library/zustand/manifest.toml

@@ -1,18 +1,18 @@
 allowed_words = ["Zustand"]
 
 [configuration]
-title = "Zustand"
+description = "Zustand: state lives in store files, and components read it through a selector."
 requires = ["javascript"]
-description = "Zustand stores: a store is created in a store file, and a component reads it through a selector."
+title = "Zustand"
 
 [detect]
 dependencies = ["zustand"]
 
 [[eslint.selectors]]
-selector = "CallExpression[callee.name=/^use[A-Z]\\w*Store$/][arguments.length=0]"
 message = "Pass a selector to the store hook, so the component renders when its slice changes and at no other time."
+selector = "CallExpression[callee.name=/^use[A-Z]\\w*Store$/][arguments.length=0]"
 
 [[tool_file]]
+fragment = true
 target = ".gspot/config/eslint.config.mjs"
 tool = "eslint"
-fragment = true

package/configurations/library/zustand/rules/ZUSTAND.md

@@ -1,5 +1,7 @@
 # Zustand
 
+Read this rule when you change a Zustand store.
+
 Zustand holds client state that several components share when local or form state cannot serve them.
 Fetched server data stays in the query cache.
 
@@ -13,20 +15,20 @@ Fetched server data stays in the query cache.
 - In a server-rendered app, create request-dependent stores per request. Never share a store
   initialized with one user's identity across requests.
 - An action called outside React uses the intended store instance, passed in, never a hidden
-  global store that bypasses request or provider scope.
+  global one that bypasses request or provider scope.
 - In a server-rendered app, the provider takes an initial snapshot that matches the first browser
   render. Browser storage, random values, and current timestamps stay out of that snapshot.
-- In a Next.js App Router project, Server Components read authorized server data rather than using
-  the client store to pass data between requests.
+- In a Next.js App Router project, Server Components read authorized server data rather than passing
+  it between requests through the client store.
 - Place the provider where the state lives: a shared layout keeps state across navigation, and a
   page or keyed resource provider resets it.
-- New initialization props do not reinitialize an existing store. Define a reconciliation action or
+- New initial props do not reinitialize an existing store. Define a reconciliation action or
   remount at a changed resource boundary, keeping drafts when the interaction needs them.
 
 ## Select narrowly and keep results stable
 
 - Components select the specific values and actions they read. A large layout or every list row
-  never subscribes to the whole store through an unselected hook.
+  never subscribes to the whole store through a hook without a selector.
 - Select a primitive, stored entity, or stable action directly when the consumer needs only that value.
   A selector that returns a tuple, array, or object of several values uses `useShallow` from a
   supported entry point such as `zustand/react/shallow`.
@@ -35,17 +37,17 @@ Fetched server data stays in the query cache.
   fresh empty callback.
 - Custom equality goes through `zustand/traditional` and its peer dependency; the standard `create`
   takes no equality argument.
-- Subscribe rows by entity ID. The list owner subscribes to ordering and paging instead of every
+- Subscribe rows by entity ID. The list component subscribes to ordering and paging instead of every
   record's content.
 - Derive values through selectors or computations over authoritative state, never synchronized counts,
-  array copies, or flags that disagree after a deletion, rollback, or reset.
+  array copies, or flags that diverge after a deletion, rollback, or reset.
 - `getState()` reads an imperative snapshot without a subscription, so rendered values come from
   selectors. Release manual subscriptions with their owning component or service.
 
 ## Update without losing fields
 
 - Use a functional `set` when the result depends on current state. Zustand merges the returned
-  object at the top level only, so a nested change copies each changed ancestor and keeps unchanged
+  object at the top level only, so a nested update copies each changed ancestor and keeps the other
   siblings and references.
 - Shallow comparison does not inspect nested values: replace a changed object, Map, Set, or array instead of mutating
   it. Copy an edited record inside a Map too, because a new Map holding the same mutated record
@@ -54,7 +56,7 @@ Fetched server data stays in the query cache.
   assertion. New stores and resets create fresh collections.
 - Use `replace: true` only for a complete replacement that keeps the store's shape, actions
   included. A reset changes the domain state and leaves a usable store.
-- A store that already uses Immer changes only the provided draft. It configures Map and Set
+- A store that already uses Immer changes only the draft it receives. It configures Map and Set
   support where the installed Immer requires it and keeps non-draftable external objects out of
   drafts.
 - One store uses one update method, and an immutable-update library joins only when it saves real
@@ -66,8 +68,8 @@ Fetched server data stays in the query cache.
   confirmed save. They live beside their state and keep its validation and related field changes.
 - Changes that form one invariant go in one `set` call. Two actions in sequence make two store
   transitions, and React render batching does not merge them.
-- Slices organize one cohesive store, with one owner for each field and action, so spreading slices
-  cannot silently overwrite names. Middleware wraps the completed store, not each slice, and slice
+- Slices organize one cohesive store, and each field and action lives in exactly one, so spreading
+  them cannot silently overwrite names. Middleware wraps the whole store, not each slice, and slice
   creator types stay compatible with it.
 - Asynchronous actions keep request identity and cancellation explicit. A delayed action never
   updates the next resource after the reader moves on.
@@ -77,13 +79,13 @@ Fetched server data stays in the query cache.
 - `persist` takes a unique storage name and a `partialize` allowlist of durable fields. Actions,
   request flags, live handles, access tokens, and credentials stay out.
 - Maps, Sets, and other values that JSON loses get explicit serialization.
-- Persist the current shape. When it changes, reset disposable cached state instead of migrating old
-  shapes, and move required user-authored records to the current shape. Missing, malformed, or
+- Persist the current shape. When it changes, reset disposable cached state instead of migrating
+  it, and move required user-authored records to the new shape. Missing, malformed, or
   unavailable storage yields the initial state.
 - In a server-rendered app, browser restoration stays apart from the first snapshot. Use
   `skipHydration` and an explicit `rehydrate()` when automatic restoration changes it.
 - Track hydration through the supported callbacks or subscriptions, not one read of
-  `hasHydrated()`, and release the listeners when their owner unmounts.
+  `hasHydrated()`, and release the listeners when the component that added them unmounts.
 - Sign-out and identity or tenant changes reset live private state and clear or partition its
   persisted copy. Clearing storage alone leaves the in-memory store unchanged.
 - A pending restoration never reapplies the previous identity's data.

package/configurations/platform/cloudflare/manifest.toml

@@ -2,93 +2,74 @@ allowed_words = ["Cloudflare"]
 generated = ["worker-configuration.d.ts"]
 
 [configuration]
-title = "Cloudflare"
+description = "Cloudflare Pages and Workers: valid headers and redirects files, current binding types, and Semgrep rules for worker code."
 requires = ["javascript"]
 suggests = []
-description = "Cloudflare Pages and Workers: a wrangler configuration that parses and pins its date, headers and redirects files Cloudflare can read, fresh binding types, and the Semgrep rules for workers."
+title = "Cloudflare"
 
 [detect]
+dependencies = ["wrangler", "@opennextjs/cloudflare"]
 filenames = ["wrangler.toml", "wrangler.json", "wrangler.jsonc", "_worker.js"]
 paths = ["**/functions/_middleware.{js,ts}"]
-dependencies = ["wrangler", "@opennextjs/cloudflare"]
 
 [files]
 extensions = [".d.ts"]
 filenames = ["wrangler.toml", "wrangler.json", "wrangler.jsonc", "_headers", "_redirects"]
 
 [[tool]]
-name = "wrangler"
 install_hint = "Run: npm install --save-dev wrangler"
-system = true
-version_command = ["--version"]
 min_version = "3.78.3"
+name = "wrangler"
 npm = "wrangler"
-
-[[tool]]
-name = "v8r"
+system = true
+version_command = ["--version"]
 
 [[tool_file]]
-source = "semgrep/cloudflare.yml"
+level = "all"
+per_scope = true
 target = ".gspot/config/semgrep/cloudflare.yml"
 tool = "semgrep"
-rule_keys = ["rules"]
-per_scope = true
 when = { configuration = "security" }
-level = "all"
 
 [[check]]
-name = "wrangler"
-tool = ["wrangler", "v8r"]
-command = ["v8r", "--schema", "{wrangler_schema}", "--ignore-errors", "--output-format", "text", "{files}"]
-output = { format = "regex", pattern = "^(?<file>[^#\\s]+)#(?<message>.+)$" }
-files = { filenames = ["wrangler.toml", "wrangler.json", "wrangler.jsonc"] }
-example = "A Wrangler configuration without `compatibility_date` reports the missing date. Add a reviewed date in `YYYY-MM-DD` form, such as `2025-01-31`, and test the Worker against that runtime behavior."
+example = "An indented `X-Frame-Options: DENY` at the top of `_headers` reports a header with no path. Put a path such as `/*` on an unindented line above it."
+help = "Write each block as a path, then indented lines of a name, a colon, and a value."
 level = "recommended"
-stage = "commit"
-runs = "scope"
-summary = "Checks that every wrangler configuration parses, names the worker, and pins a compatibility date."
-why = "Without a pinned date the runtime changes behavior under a deployed worker."
-help = "Add the name and a compatibility_date in the form 2025-01-31."
-
-[[check]]
 name = "headers"
-example = "An indented `X-Frame-Options: DENY` line before any path in `_headers` reports that the header sits under no path. Put the intended path, such as `/*`, on the preceding unindented line."
-level = "recommended"
-stage = "commit"
 runs = "scope"
-summary = "Checks that the headers file is blocks of a path line and indented header lines."
+stage = "commit"
+summary = "Checks that `_headers` holds only blocks of a path followed by indented name-value lines."
 why = "Cloudflare skips a line it cannot read, so a typo silently drops a security header."
-help = "Write each block as a path, then indented lines of a name, a colon, and a value."
 
 [[check]]
-name = "redirects"
-example = "The `_redirects` line `/old /new 999` reports an unsupported redirect status. For an intended permanent redirect, change it to `/old /new 301`."
+example = "The `_redirects` line `/old /new 999` reports an unsupported redirect status. For a permanent redirect, change it to `/old /new 301`."
+help = "Write the rule as source, destination, and status."
 level = "recommended"
-stage = "commit"
+name = "redirects"
 runs = "scope"
+stage = "commit"
 summary = "Checks each redirect source, destination, and optional status: 200, 301, 302, 303, 307, or 308, without a force suffix."
-why = "A redirect Cloudflare cannot read is dropped, and the old address starts to answer 404."
-help = "Write the rule as source, destination, status."
+why = "Cloudflare drops a redirect it cannot parse, and the old address starts to answer 404."
 
 [[check]]
-name = "stale-types"
 command = ["wrangler", "types", "{file}", "--env-interface", "{setting:cloudflare.types_interface}"]
-generated_paths = [{ pattern = "**/{setting:cloudflare.types_file}" }]
-example = "A generated Worker environment type file that differs from `wrangler types` output reports drift. Regenerate it using the configured Wrangler project, inspect the changes, and rerun."
+example = "A Worker types file that differs from the output of `wrangler types` reports drift. Run `wrangler types`, and commit the new file."
+generator_outputs = [{ pattern = "**/{setting:cloudflare.types_file}" }]
+help = "Run `wrangler types` and commit the file."
 level = "recommended"
-stage = "push"
+name = "stale-types"
 runs = "scope"
-tool = "wrangler"
+stage = "push"
 summary = "Checks that a tracked environment types file matches what wrangler writes."
+tool = "wrangler"
 why = "Stale binding types let code compile against a binding the configuration dropped."
-help = "Run wrangler types and commit the file."
 
 [[check]]
-name = "security-headers"
-example = "A configured response-header block without a required security header reports the missing header. Add that header to every governed path block using the value required by settings."
+example = "A path block without a required security header reports it as missing. Add the header, with the value from the settings, to every path block."
+help = "Add the header to the block for every path."
 level = "recommended"
-stage = "commit"
+name = "security-headers"
 runs = "scope"
+stage = "commit"
 summary = "Checks that the headers file sets the content type, referrer, and framing headers for every path."
-why = "A site of files has no server code, so the headers file is the only place these protections can live."
-help = "Add the header to the block for every path."
+why = "A static site has no server code, so these protections can live only in the headers file."

package/configurations/platform/cloudflare/rules/CLOUDFLARE.md

@@ -1,6 +1,6 @@
-# Workers
+# Cloudflare Workers
 
-Rules that hold because the code runs on a V8 isolate runtime such as Cloudflare Workers.
+Read this rule when code runs on Cloudflare Workers.
 
 ## Global variables
 
@@ -9,15 +9,20 @@ Rules that hold because the code runs on a V8 isolate runtime such as Cloudflare
   runtime before using `node:` imports or `process.env`.
 - Bindings can come from handler arguments, supported entrypoint properties, or `env` imported
   from `cloudflare:workers`. Build a client from `env` inside the request.
-- Module-scope binding access does not permit request-only I/O outside a request context.
+- Code at module scope can read a binding from `env`, but it cannot do I/O with it, such as a KV read. Do I/O inside a request handler.
 
 ## Lifetime
 
-- The runtime can reuse or discard isolates. Module state provides neither durable storage nor a safe place
+- The runtime can reuse or discard isolates. Module state offers neither durable storage nor a safe place
   for request-specific user data.
-- Share immutable configuration. Keep mutable request state isolated and persist durable
-  state through the application's storage contract.
+- Share immutable configuration. Keep mutable request state isolated, and persist durable
+  data through the application's storage contract.
 - Use `ctx.waitUntil()` for work after the response. Use a Queue or Workflow for work that must finish.
 
+## Repository
+
+- Keep `.wrangler/` and `.dev.vars*` out of Git.
+- Deploy through a task. When CI deploys, its job runs the same task.
+
 See the Cloudflare [Node process support](https://developers.cloudflare.com/workers/runtime-apis/nodejs/process/)
 and [binding access](https://developers.cloudflare.com/workers/runtime-apis/bindings/).