@heyramzi/lint 0.0.0-stage → 1.32.4

package/repo-rules/toolchain.js

@@ -0,0 +1,172 @@
+/** The one toolchain: no ESLint, knip, Prettier, Biome or Husky, one fallow shape, one oxlint base. */
+
+import path from "node:path";
+
+import { dirOf } from "#lint/repo-rules/tree.js";
+
+const MANIFEST = /(^|\/)package\.json$/;
+const ESLINT_DEP =
+  /^(eslint|eslint-.+|@eslint\/.+|typescript-eslint|@typescript-eslint\/.+|svelte-eslint-parser)$/;
+const KNIP_DEP = /^(knip|@knip\/.+)$/;
+const OTHER_DEP = /^(prettier|prettier-plugin-.+|@biomejs\/biome|husky)$/;
+const FILES = {
+  eslint: /(^|\/)(eslint\.config\.[cm]?[jt]s|\.eslintrc(\.[a-z]+)?|\.eslintignore)$/,
+  knip: /(^|\/)(knip(\.config)?\.(jsonc?|[cm]?[jt]s)|\.knip(rc)?(\.jsonc?)?)$/,
+  other:
+    /(^|\/)(\.prettierrc(\.[a-z]+)?|prettier\.config\.[cm]?[jt]s|\.prettierignore|biome\.jsonc?)$/,
+};
+
+const ESLINT_MESSAGE =
+  "No ESLint: Oxlint reads a .svelte file's <script>, and a second toolchain buys only eslint-plugin-svelte's template rules plus a whole extra dependency tree. Check no package script runs it, then delete the dependency and the config. svelte-doctor covers the template gap.";
+const KNIP_MESSAGE =
+  "knip is gone from every Studio repo: fallow is the one dead-code tool, and two tools answering one question is one nobody keeps tuned. Delete the knip dependency, script and config. `fallow migrate` converts a knip config.";
+const OTHER_MESSAGE =
+  "All lint and format config lives in vite.config.ts (fmt, staged, test, pack) and .oxlintrc.json: no Prettier, Biome or Husky. Hooks come from `vp config` only, with steps in .vite-hooks/pre-commit and .vite-hooks/pre-push. Delete it and run vp fmt once.";
+
+export function foreignTools(tree) {
+  const found = [];
+  const add = (file, rule, message, detail) =>
+    found.push({ file, rule, message: `${detail} ${message}` });
+  for (const file of tree.touchedMatching(MANIFEST)) {
+    const manifest = tree.json(file);
+    if (!manifest) continue;
+    const deps = Object.keys({ ...manifest.dependencies, ...manifest.devDependencies });
+    for (const name of deps) {
+      if (ESLINT_DEP.test(name)) add(file, "no-eslint", ESLINT_MESSAGE, `${name} is a dependency.`);
+      if (KNIP_DEP.test(name)) add(file, "no-knip", KNIP_MESSAGE, `${name} is a dependency.`);
+      if (OTHER_DEP.test(name))
+        add(file, "no-other-toolchain", OTHER_MESSAGE, `${name} is a dependency.`);
+    }
+    for (const [name, command] of Object.entries(manifest.scripts ?? {})) {
+      if (/\beslint\b/.test(command))
+        add(file, "no-eslint", ESLINT_MESSAGE, `Script ${name} runs eslint.`);
+      if (/\bknip\b/.test(command)) add(file, "no-knip", KNIP_MESSAGE, `Script ${name} runs knip.`);
+      if (/\.git\/hooks/.test(command)) {
+        add(
+          file,
+          "no-copied-hooks",
+          'Hooks come from `vp config` ("prepare": "vp config"), with repo steps in .vite-hooks/pre-commit and .vite-hooks/pre-push. A script copied into .git/hooks is never in a fresh clone.',
+          `Script ${name} writes into .git/hooks.`,
+        );
+      }
+    }
+    if (manifest.eslintConfig) add(file, "no-eslint", ESLINT_MESSAGE, "eslintConfig is set.");
+    if (manifest.knip) add(file, "no-knip", KNIP_MESSAGE, "A knip key is set.");
+    if (manifest.prettier) add(file, "no-other-toolchain", OTHER_MESSAGE, "A prettier key is set.");
+  }
+  for (const [kind, pattern] of Object.entries(FILES)) {
+    const rule = { eslint: "no-eslint", knip: "no-knip", other: "no-other-toolchain" }[kind];
+    const message = { eslint: ESLINT_MESSAGE, knip: KNIP_MESSAGE, other: OTHER_MESSAGE }[kind];
+    for (const file of tree.touchedMatching(pattern))
+      add(file, rule, message, "This config file is tracked.");
+  }
+  for (const file of tree.touchedMatching(/(^|\/)\.husky\//))
+    add(file, "no-other-toolchain", OTHER_MESSAGE, "Husky hook files are tracked.");
+  return found;
+}
+
+const FALLOW_SCRIPTS = [
+  "fallow",
+  "fallow:dead-code",
+  "fallow:audit",
+  "fallow:health",
+  "fallow:dupes",
+];
+const SCHEMA = "./node_modules/fallow/schema.json";
+
+/** A repo with fallow holds the dependency, the config, 5 scripts, the reference and no tracked caches. */
+export function fallowShape(tree) {
+  const found = [];
+  const fail = (file, message) => found.push({ file, rule: "fallow-shape", message });
+  for (const file of tree.touchedMatching(/(^|\/)\.fallow\/.*\.bin$/)) {
+    fail(
+      file,
+      "fallow caches are never committed. Run `git rm --cached` on every .fallow/*.bin, in every nested workspace that keeps its own .fallow/. Baselines under .fallow/baselines/ stay tracked.",
+    );
+  }
+  const rootTouched =
+    tree.touched.includes("package.json") || tree.touched.includes(".fallowrc.json");
+  const manifest = tree.json("package.json");
+  const hasConfig = tree.isTracked(".fallowrc.json");
+  const hasDep = Boolean({ ...manifest?.dependencies, ...manifest?.devDependencies }.fallow);
+  if (!rootTouched || !manifest || (!hasConfig && !hasDep)) return found;
+  if (hasConfig && !hasDep)
+    fail(
+      ".fallowrc.json",
+      'Add the devDependency "fallow": "^3.18.0" beside it, and the 5 fallow scripts.',
+    );
+  if (hasDep && !hasConfig)
+    fail(
+      "package.json",
+      'fallow is a dependency with no .fallowrc.json. Add one at the repo root with "$schema": "./node_modules/fallow/schema.json" as its first key.',
+    );
+  if (hasConfig) {
+    const config = tree.json(".fallowrc.json");
+    if (config && Object.keys(config)[0] !== "$schema") {
+      fail(".fallowrc.json", `The first key must be "$schema": "${SCHEMA}".`);
+    } else if (config && config.$schema !== SCHEMA) {
+      fail(".fallowrc.json", `"$schema" must be "${SCHEMA}".`);
+    }
+  }
+  const missing = FALLOW_SCRIPTS.filter((name) => !manifest.scripts?.[name]);
+  if (hasDep && missing.length > 0) {
+    fail(
+      "package.json",
+      `Missing fallow scripts: ${missing.join(", ")}. Every repo with fallow has all of ${FALLOW_SCRIPTS.join(", ")}.`,
+    );
+  }
+  const vibekit = tree.json("vibekit.json");
+  if (hasDep && vibekit && !vibekit.claude?.references?.includes("fallow")) {
+    fail(
+      "vibekit.json",
+      'claude.references must list "fallow", so the fallow reference reaches this repo.',
+    );
+  }
+  return found;
+}
+
+const SHARED_BASE = /lint\/config\/oxlintrc\.json$/;
+
+/** True when the config extends the shared base, directly or through another tracked config. */
+function extendsShared(file, tree, depth = 0) {
+  const config = tree.json(file);
+  if (!config || depth > 4) return false;
+  return [config.extends ?? []].flat().some((entry) => {
+    if (SHARED_BASE.test(entry)) return true;
+    const next = path.posix.join(dirOf(file), entry);
+    return tree.isTracked(next) && extendsShared(next, tree, depth + 1);
+  });
+}
+
+export function oxlintBase(tree) {
+  const found = [];
+  for (const file of tree.touchedMatching(/(^|\/)\.oxlintrc\.json$/)) {
+    if (!tree.json(file)) continue;
+    if (!extendsShared(file, tree)) {
+      found.push({
+        file,
+        rule: "oxlint-base",
+        message: `${file} must extend the shared config: "extends": ["./node_modules/@heyramzi/lint/config/oxlintrc.json"] with "jsPlugins": ["@heyramzi/lint"], plus the ignores this repo needs. Every rule lives in @heyramzi/lint, shared and project-specific alike.`,
+      });
+    }
+  }
+  return found;
+}
+
+/** A top-level `lint:` key in a Vite config, at the indent defineConfig's keys sit. */
+export function viteLintBlock(tree) {
+  const found = [];
+  for (const file of tree.touchedMatching(/(^|\/)vite\.config\.[cm]?[jt]s$/)) {
+    const line = tree
+      .text(file)
+      .split("\n")
+      .findIndex((text) => /^ {2}lint\s*:\s*[{[]/.test(text));
+    if (line === -1) continue;
+    found.push({
+      file,
+      rule: "no-vite-lint-block",
+      message: `Line ${line + 1} sets a lint block in ${dirOf(file)}vite.config. Once a lint key exists vp passes its own -c and dies with "argument -c cannot be used multiple times". The key takes no extends or jsPlugins either. Delete it, keep ignores in .oxlintrc.json and run vp lint -c .oxlintrc.json .`,
+    });
+  }
+  return found;
+}

package/repo-rules/tree.js

@@ -0,0 +1,51 @@
+/**
+ * What a repo rule reads. `touched` is the files a gate judges (staged, or every
+ * tracked file under `--all`), `tracked` is the whole index, `added` is new paths.
+ * Pure here: the caller supplies `read`.
+ */
+
+/** Drops comments and trailing commas from JSONC, leaving strings alone. */
+export function stripJsonc(text) {
+  return text
+    .replace(/("(?:[^"\\]|\\.)*")|\/\/[^\n]*|\/\*[\s\S]*?\*\//g, (_match, string) => string ?? "")
+    .replace(/,(\s*[}\]])/g, "$1");
+}
+
+/** The parsed value, or null when the file isn't JSON. */
+export function parseJsonc(text) {
+  try {
+    return JSON.parse(stripJsonc(text));
+  } catch {
+    return null;
+  }
+}
+
+export function createTree({ touched, added = [], tracked, read }) {
+  const cache = new Map();
+  const text = (file) => {
+    if (!cache.has(file)) cache.set(file, read(file) ?? "");
+    return cache.get(file);
+  };
+  return {
+    touched,
+    added,
+    tracked,
+    text,
+    json(file) {
+      return parseJsonc(text(file));
+    },
+    isTracked: (file) => tracked.includes(file),
+    touchedMatching: (pattern) => touched.filter((file) => pattern.test(file)),
+    trackedMatching: (pattern) => tracked.filter((file) => pattern.test(file)),
+  };
+}
+
+/** A workflow or compose line without its YAML comment. */
+export function yamlCode(line) {
+  return line.replace(/^\s*#.*$/, "").replace(/\s+#.*$/, "");
+}
+
+export function dirOf(file) {
+  const slash = file.lastIndexOf("/");
+  return slash === -1 ? "" : file.slice(0, slash + 1);
+}

package/repo-rules/workflows.js

@@ -0,0 +1,116 @@
+/** GitHub Actions rules: where jobs run, what triggers them, how Node and credentials are set. */
+
+import { yamlCode } from "#lint/repo-rules/tree.js";
+
+const WORKFLOW = /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/;
+const HOSTED = /(^|[^\w-])(ubuntu|windows|macos)-[\w.-]+/i;
+const INSTALL = /\b(pnpm|npm|yarn)\s+(install|i|ci)\b|\bvp\s+install\b/;
+const NPMRC_WRITES = [
+  />>?\s*["']?(~|\$HOME|\$\{HOME\}|\/home\/[\w-]+)\/\.npmrc/,
+  /\btee\s+(-a\s+)?["']?(~|\$HOME|\$\{HOME\})\/\.npmrc/,
+  /\bnpm\s+config\s+set\b.*_authToken/,
+];
+
+/** The `on:` block of a workflow as one string. */
+function triggers(lines) {
+  const start = lines.findIndex((line) => /^on\s*:/.test(line));
+  if (start === -1) return "";
+  const block = [yamlCode(lines[start])];
+  for (const line of lines.slice(start + 1)) {
+    if (/^\S/.test(line) && !/^\s*#/.test(line)) break;
+    block.push(yamlCode(line));
+  }
+  return block.join("\n");
+}
+
+/** The value after `runs-on:`, with a list or flow sequence that spans lines joined. */
+function runsOnValue(lines, index, inline) {
+  if (inline) return inline;
+  const values = [];
+  for (const line of lines.slice(index + 1)) {
+    if (!/^\s+(-|\[)/.test(yamlCode(line))) break;
+    values.push(yamlCode(line));
+  }
+  return values.join(" ");
+}
+
+function nodeVersionFindings(file, lines, tree) {
+  const found = [];
+  const fail = (message) => found.push({ file, rule: "workflow-node-24", message });
+  let pinned = false;
+  lines.forEach((raw, index) => {
+    const match = /^\s*(?:-\s*)?(node-version|node-version-file)\s*:\s*(.*)$/.exec(yamlCode(raw));
+    if (!match) return;
+    pinned = true;
+    const value = match[2].trim().replace(/^["']|["']$/g, "");
+    // An empty value is an input definition (`type:` follows), not a setup-node step.
+    if (!value || value.includes("${{")) return;
+    if (match[1] === "node-version") {
+      if (value !== "24")
+        fail(
+          `Line ${index + 1} sets node-version ${value}. Set node-version: "24" in every workflow that installs, disabled ones too. pnpm install imports node:sqlite through @voidzero-dev/vite-plus-test, so older Node crashes the install with ERR_UNKNOWN_BUILTIN_MODULE, which reads as a broken lockfile.`,
+        );
+      return;
+    }
+    const first =
+      tree
+        .text(value)
+        .split("\n")
+        .find((line) => line.trim()) ?? "";
+    if (first && !/^v?24(\.|$)/.test(first.trim())) {
+      fail(
+        `Line ${index + 1} reads Node from ${value}, which says ${first.trim()}. Workflows run Node 24: set node-version: "24" or fix that file.`,
+      );
+    }
+  });
+  const installs = lines.some((line) => INSTALL.test(yamlCode(line)));
+  if (installs && !pinned) {
+    fail(
+      `This workflow installs dependencies and never sets a Node version. Add actions/setup-node with node-version: "24". pnpm install imports node:sqlite, so older Node crashes the install with ERR_UNKNOWN_BUILTIN_MODULE.`,
+    );
+  }
+  return found;
+}
+
+export function workflows(tree) {
+  const found = [];
+  for (const file of tree.touchedMatching(WORKFLOW)) {
+    const lines = tree.text(file).split("\n");
+    const add = (rule, index, message) =>
+      found.push({
+        file,
+        rule,
+        message: index === null ? message : `Line ${index + 1}: ${message}`,
+      });
+    lines.forEach((raw, index) => {
+      const line = yamlCode(raw);
+      const runsOn = /^\s*runs-on\s*:\s*(.*)$/.exec(line);
+      if (runsOn) {
+        const value = runsOnValue(lines, index, runsOn[1].trim());
+        if (HOSTED.test(value) && !value.includes("self-hosted")) {
+          add(
+            "workflow-runs-on",
+            index,
+            `runs-on ${value} is a hosted runner, and private repos burn the billed Actions allowance on them. Every job runs on our own hardware with no hosted fallback: runs-on: [self-hosted, Linux, X64, studio-linux], or [self-hosted, macOS, ARM64, studio-mac] for Xcode work only. Public forks keep hosted runners.`,
+          );
+        }
+      }
+      if (NPMRC_WRITES.some((pattern) => pattern.test(line))) {
+        add(
+          "workflow-npmrc-write",
+          index,
+          "a workflow step writes a token to ~/.npmrc. On a self-hosted runner that file outlives the job, so each run stacks another line and the last one wins, which buried the good key under a dead one. The packages key is installed on the runner by infrastructure/scripts/runner-key.sh. Delete the step.",
+        );
+      }
+    });
+    if (/\bpull_request(_target)?\b/.test(triggers(lines))) {
+      add(
+        "workflow-dispatch-only",
+        null,
+        "a pull_request trigger runs a check on billed minutes. Check workflows are workflow_dispatch only, pull requests included. Move what the Mac doesn't already run into the repo's ci:local script, which the managed pre-push hook runs, and trigger this one with workflow_dispatch.",
+      );
+    }
+    found.push(...nodeVersionFindings(file, lines, tree));
+  }
+  return found;
+}

package/repo-rules.js

@@ -0,0 +1,54 @@
+/**
+ * The repo-rules gate: the repository, package, workflow and toolchain rules that used
+ * to live in Markdown. Pure here, git and process in `bin/heyramzi-repo-rules.js`.
+ */
+
+import { composeImages, fossilNames } from "#lint/repo-rules/paths.js";
+import {
+  heyramziLinks,
+  heyramziTarballs,
+  legacyTokenName,
+  npmrcCredentials,
+  pnpmOnly,
+  srcImportMaps,
+} from "#lint/repo-rules/packages.js";
+import {
+  fallowShape,
+  foreignTools,
+  oxlintBase,
+  viteLintBlock,
+} from "#lint/repo-rules/toolchain.js";
+import { workflows } from "#lint/repo-rules/workflows.js";
+
+export { createTree } from "#lint/repo-rules/tree.js";
+
+export const RULES = [
+  pnpmOnly,
+  heyramziLinks,
+  heyramziTarballs,
+  srcImportMaps,
+  npmrcCredentials,
+  legacyTokenName,
+  workflows,
+  foreignTools,
+  fallowShape,
+  oxlintBase,
+  viteLintBlock,
+  composeImages,
+  fossilNames,
+];
+
+/** Every violation in the files the tree says were touched. */
+export function check(tree) {
+  return RULES.flatMap((rule) => rule(tree));
+}
+
+/** The refusal, grouped by file. Each message says what to do instead. */
+export function report(violations) {
+  const byFile = Map.groupBy(violations, ({ file }) => file);
+  const blocks = [...byFile].map(
+    ([file, entries]) =>
+      `${file}\n${entries.map(({ rule, message }) => `  [${rule}] ${message}`).join("\n")}`,
+  );
+  return `repo-rules: ${violations.length} violation(s) in ${byFile.size} file(s)\n\n${blocks.join("\n\n")}`;
+}

package/rules/convex-ast.js

@@ -0,0 +1,66 @@
+/** Shared AST helpers for the convex-* rules. */
+
+export const REGISTERS = new Set([
+  "query",
+  "mutation",
+  "action",
+  "internalQuery",
+  "internalMutation",
+  "internalAction",
+]);
+
+/** The name of a `query(...)`-style call, or null. */
+export function registerName(node) {
+  if (node.callee?.type !== "Identifier") return null;
+  return REGISTERS.has(node.callee.name) ? node.callee.name : null;
+}
+
+/** Step down one link of a call or member chain, or null at the root. */
+export function stepDown(node) {
+  switch (node.type) {
+    case "CallExpression":
+      return node.callee;
+    case "MemberExpression":
+      return node.object;
+    case "ChainExpression":
+    case "TSNonNullExpression":
+    case "TSAsExpression":
+      return node.expression;
+    case "AwaitExpression":
+      return node.argument;
+    default:
+      return null;
+  }
+}
+
+/** The leftmost expression of a chain: `internal` in `internal.a.b`. */
+export function chainRoot(node) {
+  let current = node;
+  for (let next = stepDown(current); next; next = stepDown(current)) current = next;
+  return current;
+}
+
+export function propertyName(member) {
+  if (member?.type !== "MemberExpression" || member.computed) return null;
+  return member.property.type === "Identifier" ? member.property.name : null;
+}
+
+export function keyName(property) {
+  if (property.type !== "Property" || property.computed) return null;
+  if (property.key.type === "Identifier") return property.key.name;
+  return typeof property.key.value === "string" ? property.key.value : null;
+}
+
+export function findProperty(object, name) {
+  return object.properties.find((property) => keyName(property) === name);
+}
+
+/** The `"use node"` directive, read from the leading statements of a program. */
+export function hasUseNode(program) {
+  for (const statement of program.body) {
+    if (statement.type !== "ExpressionStatement") return false;
+    if (statement.expression.type !== "Literal") return false;
+    if (statement.expression.value === "use node") return true;
+  }
+  return false;
+}

package/rules/convex-index-name.js

@@ -0,0 +1,40 @@
+/**
+ * An index name lists every field: `by_channel_and_author` for `["channel", "author"]`.
+ */
+import { propertyName } from "#lint/rules/convex-ast.js";
+
+export default {
+  meta: {
+    type: "problem",
+    docs: { description: "Require index names to start with `by_` and list every field with `_and_`." },
+    messages: {
+      badName:
+        'Index "{{ name }}" covers {{ count }} field(s) but its name lists {{ listed }}. Name it `by_` plus every field joined with `_and_`, like `by_channel_and_author`, and update its `withIndex` calls.',
+      noPrefix:
+        'Index "{{ name }}" must start with `by_` and list every field joined with `_and_`, like `by_channel_and_author`.',
+    },
+    schema: [],
+  },
+  create(context) {
+    return {
+      CallExpression(node) {
+        if (propertyName(node.callee) !== "index") return;
+        const [name, fields] = node.arguments;
+        if (name?.type !== "Literal" || typeof name.value !== "string") return;
+        if (fields?.type !== "ArrayExpression") return;
+        if (!name.value.startsWith("by_")) {
+          context.report({ node: name, messageId: "noPrefix", data: { name: name.value } });
+          return;
+        }
+        const listed = name.value.slice(3).split("_and_").length;
+        if (listed !== fields.elements.length) {
+          context.report({
+            node: name,
+            messageId: "badName",
+            data: { name: name.value, count: fields.elements.length, listed },
+          });
+        }
+      },
+    };
+  },
+};

package/rules/convex-internal-only.js

@@ -0,0 +1,59 @@
+/**
+ * Crons, the scheduler and HTTP actions call `internal` functions, never `api` ones.
+ */
+import { chainRoot, propertyName } from "#lint/rules/convex-ast.js";
+
+const CRON_METHODS = new Set(["interval", "cron"]);
+const SCHEDULER_METHODS = new Set(["runAfter", "runAt"]);
+const RUN_METHODS = new Set(["runQuery", "runMutation", "runAction"]);
+
+function isPublicRef(node) {
+  if (!node || node.type === "Identifier") return false;
+  const root = chainRoot(node);
+  return root.type === "Identifier" && root.name === "api";
+}
+
+export default {
+  meta: {
+    type: "problem",
+    docs: {
+      description:
+        "Require `internal.*` references in crons, scheduler calls and HTTP actions. `api.*` is public.",
+    },
+    messages: {
+      publicRef:
+        "{{ where }} calls a public `api.*` function. Make it an `internalQuery`, `internalMutation` or `internalAction` and reference it as `internal.*`.",
+    },
+    schema: [],
+  },
+  create(context) {
+    const jobs = new Set(["crons"]);
+    let httpDepth = 0;
+    const report = (node, where) => context.report({ node, messageId: "publicRef", data: { where } });
+    return {
+      VariableDeclarator(node) {
+        const init = node.init;
+        if (node.id.type !== "Identifier" || init?.type !== "CallExpression") return;
+        if (init.callee.type === "Identifier" && init.callee.name === "cronJobs") {
+          jobs.add(node.id.name);
+        }
+      },
+      CallExpression(node) {
+        if (node.callee.type === "Identifier" && node.callee.name === "httpAction") httpDepth++;
+        const method = propertyName(node.callee);
+        if (!method) return;
+        const owner = node.callee.object;
+        if (CRON_METHODS.has(method) && owner.type === "Identifier" && jobs.has(owner.name)) {
+          if (isPublicRef(node.arguments[2])) report(node, "A cron");
+        } else if (SCHEDULER_METHODS.has(method) && propertyName(owner) === "scheduler") {
+          if (isPublicRef(node.arguments[1])) report(node, "The scheduler");
+        } else if (RUN_METHODS.has(method) && httpDepth > 0) {
+          if (isPublicRef(node.arguments[0])) report(node, "An HTTP action");
+        }
+      },
+      "CallExpression:exit"(node) {
+        if (node.callee.type === "Identifier" && node.callee.name === "httpAction") httpDepth--;
+      },
+    };
+  },
+};

package/rules/convex-no-date-now-in-query.js

@@ -0,0 +1,48 @@
+/**
+ * `Date.now()` inside a query handler defeats the query cache.
+ */
+import { findProperty } from "#lint/rules/convex-ast.js";
+
+const QUERIES = new Set(["query", "internalQuery"]);
+
+export default {
+  meta: {
+    type: "problem",
+    docs: { description: "Disallow `Date.now()` inside a `query` or `internalQuery` handler." },
+    messages: {
+      noDateNow:
+        "`Date.now()` in a query defeats the cache. Have a scheduled function flip a boolean, or pass the time in as an argument rounded to the minute.",
+    },
+    schema: [],
+  },
+  create(context) {
+    const handlers = new Set();
+    let depth = 0;
+    const enter = (node) => {
+      if (handlers.has(node)) depth++;
+    };
+    const exit = (node) => {
+      if (handlers.has(node)) depth--;
+    };
+    return {
+      CallExpression(node) {
+        if (node.callee.type === "Identifier" && QUERIES.has(node.callee.name)) {
+          const [config] = node.arguments;
+          if (config?.type !== "ObjectExpression") return;
+          const handler = findProperty(config, "handler")?.value;
+          if (handler) handlers.add(handler);
+          return;
+        }
+        if (depth === 0) return;
+        const callee = node.callee;
+        if (callee.type !== "MemberExpression" || callee.computed) return;
+        if (callee.object.type !== "Identifier" || callee.object.name !== "Date") return;
+        if (callee.property.name === "now") context.report({ node, messageId: "noDateNow" });
+      },
+      FunctionExpression: enter,
+      "FunctionExpression:exit": exit,
+      ArrowFunctionExpression: enter,
+      "ArrowFunctionExpression:exit": exit,
+    };
+  },
+};

package/rules/convex-no-deprecated-crons.js

@@ -0,0 +1,40 @@
+/**
+ * `crons.hourly` and `crons.daily` are the deprecated helpers.
+ */
+import { propertyName } from "#lint/rules/convex-ast.js";
+
+const DEPRECATED = new Set(["hourly", "daily"]);
+
+export default {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow the deprecated cron helpers. Use `crons.interval` or `crons.cron`.",
+    },
+    messages: {
+      deprecated:
+        "`crons.{{ method }}` is deprecated. Use `crons.cron(name, '30 3 * * *', internal.x.y, {})` or `crons.interval(name, { hours: 6 }, internal.x.y, {})`. Both run in UTC.",
+    },
+    schema: [],
+  },
+  create(context) {
+    const jobs = new Set(["crons"]);
+    return {
+      VariableDeclarator(node) {
+        const init = node.init;
+        if (node.id.type !== "Identifier" || init?.type !== "CallExpression") return;
+        if (init.callee.type === "Identifier" && init.callee.name === "cronJobs") {
+          jobs.add(node.id.name);
+        }
+      },
+      CallExpression(node) {
+        const method = propertyName(node.callee);
+        if (!method || !DEPRECATED.has(method)) return;
+        const owner = node.callee.object;
+        if (owner.type === "Identifier" && jobs.has(owner.name)) {
+          context.report({ node, messageId: "deprecated", data: { method } });
+        }
+      },
+    };
+  },
+};