@heyramzi/lint 0.0.0-stage → 1.32.4

package/rules/no-conditional-empty-object-spread.js

@@ -0,0 +1,64 @@
+/**
+ * Disallow conditional empty-object spreads (`...(cond ? { a } : {})`).
+ */
+
+/*
+ * The empty branch hides property omission inside an expression, so the object type becomes a union nobody reads.
+ */
+
+/*
+ * Build the object in statements and add the property only when it exists.
+ */
+
+/*
+ * Ported from dmmulroy/anti-slop (MIT).
+ */
+
+function unwrapParens(node) {
+  let current = node;
+  while (current?.type === "ParenthesizedExpression") current = current.expression;
+  return current;
+}
+
+function isEmptyObject(node) {
+  return node?.type === "ObjectExpression" && node.properties.length === 0;
+}
+
+function isConditionalEmptyObject(node) {
+  const conditional = unwrapParens(node);
+
+  if (conditional?.type === "ConditionalExpression") {
+    return isEmptyObject(conditional.consequent) || isEmptyObject(conditional.alternate);
+  }
+
+  // `...(cond && { a })` omits by spreading `false`, same trick with a shorter spelling.
+  if (conditional?.type === "LogicalExpression" && conditional.operator === "&&") {
+    return unwrapParens(conditional.right)?.type === "ObjectExpression";
+  }
+
+  return false;
+}
+
+export default {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description:
+        "Disallow object spreads that conditionally spread an empty object to omit fields.",
+    },
+    messages: {
+      avoid:
+        "This conditional spread hides property omission behind an empty object. Build the object in separate statements and add the property only when present.",
+    },
+    schema: [],
+  },
+  create(context) {
+    return {
+      SpreadElement(node) {
+        if (node.parent?.type !== "ObjectExpression") return;
+        if (!isConditionalEmptyObject(node.argument)) return;
+        context.report({ node, messageId: "avoid" });
+      },
+    };
+  },
+};

package/rules/no-deep-phosphor-imports.js

@@ -0,0 +1,29 @@
+export default {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description:
+        'Disallow deep imports from "phosphor-svelte/lib/*". Use barrel import from "phosphor-svelte" instead.',
+    },
+    messages: {
+      deepImport:
+        'Import from "{{ source }}" is forbidden. Use \'import { {{ name }} } from "phosphor-svelte"\' instead.',
+    },
+    schema: [],
+  },
+  create(context) {
+    return {
+      ImportDeclaration(node) {
+        const source = node.source.value;
+        if (source.startsWith("phosphor-svelte/lib/")) {
+          const name = source.split("/").pop();
+          context.report({
+            node: node.source,
+            messageId: "deepImport",
+            data: { source, name },
+          });
+        }
+      },
+    };
+  },
+};

package/rules/no-default-export.js

@@ -0,0 +1,70 @@
+/**
+ * Ban default exports for grep-ability and refactoring safety.
+ */
+
+/*
+ * Named exports are easier to find, rename, and re-export. Exceptions: Next.js route files (page, layout, route, etc.) and config files (*.config.*) which require default exports.
+ */
+
+const ALLOWED_PATTERNS = [
+  // Next.js App Router conventions (files directly in app/ or nested)
+  /[/\\]app[/\\](.*[/\\])?page\.[jt]sx?$/,
+  /[/\\]app[/\\](.*[/\\])?layout\.[jt]sx?$/,
+  /[/\\]app[/\\](.*[/\\])?loading\.[jt]sx?$/,
+  /[/\\]app[/\\](.*[/\\])?error\.[jt]sx?$/,
+  /[/\\]app[/\\](.*[/\\])?not-found\.[jt]sx?$/,
+  /[/\\]app[/\\](.*[/\\])?template\.[jt]sx?$/,
+  /[/\\]app[/\\](.*[/\\])?default\.[jt]sx?$/,
+  /[/\\]app[/\\](.*[/\\])?route\.[jt]s$/,
+  // Next.js Metadata API conventions
+  /[/\\]app[/\\](.*[/\\])?icon\.[jt]sx?$/,
+  /[/\\]app[/\\](.*[/\\])?apple-icon\.[jt]sx?$/,
+  /[/\\]app[/\\](.*[/\\])?opengraph-image\.[jt]sx?$/,
+  /[/\\]app[/\\](.*[/\\])?twitter-image\.[jt]sx?$/,
+  /[/\\]app[/\\](.*[/\\])?manifest\.[jt]s$/,
+  /[/\\]app[/\\](.*[/\\])?robots\.[jt]s$/,
+  /[/\\]app[/\\](.*[/\\])?sitemap\.[jt]s$/,
+  // Root middleware
+  /[/\\]middleware\.[jt]s$/,
+  // Config files
+  /\.config\.[jt]sx?$/,
+  /\.config\.m[jt]s$/,
+];
+
+export default {
+  meta: {
+    type: "problem",
+    docs: {
+      description:
+        "Disallow default exports. Use named exports for grep-ability and refactoring safety.",
+    },
+    messages: {
+      noDefault:
+        "Use named exports instead of default exports. Default exports break grep-ability and refactoring.",
+    },
+    schema: [],
+  },
+  create(context) {
+    const filename = context.filename || context.getFilename();
+
+    // Skip files that require default exports
+    if (ALLOWED_PATTERNS.some((pattern) => pattern.test(filename))) {
+      return {};
+    }
+
+    return {
+      ExportDefaultDeclaration(node) {
+        context.report({ node, messageId: "noDefault" });
+      },
+      // Catch: export { foo as default }
+      ExportNamedDeclaration(node) {
+        if (!node.specifiers) return;
+        for (const specifier of node.specifiers) {
+          if (specifier.exported && specifier.exported.name === "default") {
+            context.report({ node: specifier, messageId: "noDefault" });
+          }
+        }
+      },
+    };
+  },
+};

package/rules/no-em-dash.js

@@ -0,0 +1,198 @@
+/**
+ * Ban em dashes, en dashes, and spaced hyphens in string literals.
+ * These are a structural tell of AI-generated prose.
+ */
+
+import { isTestFile } from "#lint/rules/test-file.js";
+
+const SPACED_HYPHEN = / - /;
+
+const EM_DASH = String.fromCharCode(0x2014);
+const EN_DASH = String.fromCharCode(0x2013);
+const SPACED_HYPHEN_TEXT = String.fromCharCode(0x20, 0x2d, 0x20);
+
+const PATTERNS = [
+  { regex: /\u2014/, name: `em dash (${EM_DASH})` },
+  { regex: /\u2013/, name: `en dash (${EN_DASH})` },
+  { regex: SPACED_HYPHEN, name: `spaced hyphen (${SPACED_HYPHEN_TEXT}) used as dash` },
+];
+
+/**
+ * CSS is not prose.
+ */
+
+/*
+ * `calc()` arithmetic needs spaces around its minus operator, the spec requires them, so a `<style>` block reported a spaced hyphen on every Svelte component doing arithmetic and
+ */
+
+/*
+ * no rewording could clear it. Text inside `<style>` is skipped for that reason.
+ */
+function isInsideStyleBlock(node) {
+  for (let current = node.parent; current; current = current.parent) {
+    if (current.type === "SvelteStyleElement") return true;
+    if (current.type === "SvelteElement" && current.name?.name === "style") return true;
+  }
+  return false;
+}
+
+/**
+ * SQL is not prose either, and for the same reason CSS is not: date subtraction in a query needs spaces around its minus operator,
+ */
+
+/*
+ * so a `sql` tagged template reported a spaced hyphen on every date subtraction in the app's query layer and no rewording could clear it without breaking the query.
+ */
+
+/*
+ * Five files were live in that state; one of them, `queries/crm.ts`, had already had a comment bullet blindly rewritten to `*;` by someone clearing the rule.
+ */
+const CODE_TAGS = new Set(["sql", "css", "gql", "graphql", "html", "raw"]);
+
+function taggedWithCode(node) {
+  const tagged = node.parent;
+  if (tagged?.type !== "TaggedTemplateExpression" || tagged.quasi !== node) return false;
+  const tag = tagged.tag;
+  const name =
+    tag?.type === "Identifier"
+      ? tag.name
+      : tag?.type === "MemberExpression" && tag.property?.type === "Identifier"
+        ? tag.property.name
+        : null;
+  return Boolean(name && CODE_TAGS.has(name));
+}
+
+/**
+ * A markdown bullet is not punctuation. a hyphen then a space at the head of a comment or template line is a list, and rewording it deletes the list.
+ */
+
+/*
+ * The pattern only ever meant a hyphen standing in for an em dash mid-sentence.
+ */
+function stripBullets(value, { startsLine = true } = {}) {
+  return value
+    .split("\n")
+    .map((line, i) => (i === 0 && !startsLine ? line : line.replace(/^(\s*\*?\s*)-\s/, "$1")))
+    .join("\n");
+}
+
+/**
+ * A bare dash is an empty-value placeholder, like a table cell with no data, and rewording it means inventing a word for "no value".
+ */
+const PLACEHOLDER = /^[\u2014\u2013]$/;
+
+/**
+ * Code in a string is judged on content: SQL, CSS `calc()`, GLSL and JS all need a spaced hyphen as an operator.
+ */
+
+/*
+ * The signs are narrow on purpose. `function` alone would clear prose that mentions one, so it has to open a parameter list.
+ */
+const CODE_SIGNS = [
+  /\bSELECT\b[\s\S]*\bFROM\b/,
+  /\bUPDATE\b[\s\S]*\bSET\b/,
+  /\bINSERT\s+INTO\b/,
+  /\bDELETE\s+FROM\b/,
+  /\bWHERE\b/,
+  /\b(?:ORDER|GROUP)\s+BY\b/,
+  /\b(?:LEFT|RIGHT|INNER|OUTER|CROSS)\s+JOIN\b/,
+  /\b(?:CREATE|ALTER)\s+TABLE\b/,
+  /\bcalc\(/,
+  /\bvar\(--/,
+  /\bgl_\w/,
+  /\bvec[234]\b/,
+  /\bfunction\s*\w*\s*\(/,
+  /=>/,
+  /\bconst\s+\w+\s*=/,
+];
+
+function looksLikeCode(value) {
+  return CODE_SIGNS.some((sign) => sign.test(value));
+}
+
+function isUserFacingString(node) {
+  if (node.parent?.type === "ImportDeclaration") return false;
+  if (node.parent?.type === "ImportExpression") return false;
+  if (node.parent?.type === "CallExpression" && node.parent.callee?.name === "require")
+    return false;
+  if (node.parent?.type === "Property" && node.parent.key === node) return false;
+  return true;
+}
+
+export default {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Disallow em dashes, en dashes, and spaced hyphens in strings. Reword instead.",
+    },
+    messages: {
+      noDash: "Avoid {{ name }} in text. Reword the sentence or use a comma/period instead.",
+    },
+    schema: [],
+  },
+  create(context) {
+    const filename = context.filename || context.getFilename?.() || "";
+    const inTestFile = isTestFile(filename);
+
+    // `spacedHyphenOk` covers places where a spaced hyphen is an operator, and it never excuses a real dash.
+    function checkValue(value, node, { spacedHyphenOk = false } = {}) {
+      if (typeof value !== "string") return;
+      for (const { regex, name } of PATTERNS) {
+        if (regex === SPACED_HYPHEN && (spacedHyphenOk || inTestFile)) continue;
+        if (regex.test(value)) {
+          context.report({ node, messageId: "noDash", data: { name } });
+        }
+      }
+    }
+
+    function checkString(value, node) {
+      if (typeof value !== "string") return;
+      if (PLACEHOLDER.test(value.trim())) return;
+      checkValue(value, node, { spacedHyphenOk: looksLikeCode(value) });
+    }
+
+    return {
+      Program() {
+        // WHY: also catch em/en dashes in line and block comments, since the brand rule
+        // forbids them in comments and documentation, not just user-facing strings.
+        const sourceCode = context.sourceCode || context.getSourceCode();
+        for (const comment of sourceCode.getAllComments()) {
+          checkValue(stripBullets(comment.value), comment);
+        }
+      },
+      Literal(node) {
+        if (!isUserFacingString(node)) return;
+        checkString(node.value, node);
+      },
+      TemplateLiteral(node) {
+        if (taggedWithCode(node)) return;
+        if (!isUserFacingString(node)) return;
+        const cooked = node.quasis.map((quasi) => quasi.value.cooked ?? "");
+        const code = looksLikeCode(cooked.join(" "));
+        // The first quasi opens the template; a later one opens after `${...}`, mid-line.
+        cooked.forEach((text, i) => {
+          if (PLACEHOLDER.test(text.trim()) && cooked.length === 1) return;
+          checkValue(stripBullets(text, { startsLine: i === 0 }), node, { spacedHyphenOk: code });
+        });
+      },
+      // JSON support
+      JSONLiteral(node) {
+        checkString(node.value, node);
+      },
+      // Svelte template body text, e.g. <p>Some prose with a dash</p>.
+      // Without this, em/en dashes inside .svelte HTML text slip through
+      // because the rule otherwise only inspects JS string nodes.
+      SvelteText(node) {
+        if (isInsideStyleBlock(node)) return;
+        if (PLACEHOLDER.test(node.value.trim())) return;
+        checkValue(node.value, node);
+      },
+      // Svelte attribute literal values, e.g. title="Heads up important".
+      SvelteLiteral(node) {
+        if (isInsideStyleBlock(node)) return;
+        if (PLACEHOLDER.test(String(node.value).trim())) return;
+        checkValue(node.value, node);
+      },
+    };
+  },
+};

package/rules/no-emoji.js

@@ -0,0 +1,56 @@
+/**
+ * Ban emoji characters in string literals.
+ * Use Phosphor icons instead for visual indicators in UI content.
+ */
+
+import { isTestFile } from "#lint/rules/test-file.js";
+
+// Emoji presentation, a text pictograph forced by U+FE0F, or a keycap. A dingbat range also caught text marks like U+2713.
+const EMOJI_REGEX = /\p{Emoji_Presentation}|\p{Extended_Pictographic}\u{FE0F}|\u{20E3}/u;
+
+function isUserFacingString(node) {
+  if (node.parent?.type === "ImportDeclaration") return false;
+  if (node.parent?.type === "ImportExpression") return false;
+  if (node.parent?.type === "CallExpression" && node.parent.callee?.name === "require")
+    return false;
+  return true;
+}
+
+export default {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Disallow emoji characters in strings. Use Phosphor icons instead.",
+    },
+    messages: {
+      noEmoji: "Avoid emoji in content strings. Use a Phosphor icon component instead.",
+    },
+    schema: [],
+  },
+  create(context) {
+    if (isTestFile(context.filename || context.getFilename?.())) return {};
+
+    function checkValue(value, node) {
+      if (typeof value !== "string") return;
+      if (EMOJI_REGEX.test(value)) {
+        context.report({ node, messageId: "noEmoji" });
+      }
+    }
+
+    return {
+      Literal(node) {
+        if (!isUserFacingString(node)) return;
+        checkValue(node.value, node);
+      },
+      TemplateLiteral(node) {
+        if (!isUserFacingString(node)) return;
+        for (const quasi of node.quasis) {
+          checkValue(quasi.value.cooked, node);
+        }
+      },
+      JSONLiteral(node) {
+        checkValue(node.value, node);
+      },
+    };
+  },
+};

package/rules/no-hardcoded-models.js

@@ -0,0 +1,63 @@
+/**
+ * Ban hardcoded AI model identifiers in source code.
+ * Model versions should come from @heyramzi/ai tier system (MODEL_IDS / MODEL_CATALOG).
+ */
+
+import { isTestFile } from "#lint/rules/test-file.js";
+
+const MODEL_PATTERNS = [
+  /\bgemini-\d+\.\d+[\w-]*/,
+  /\bclaude-(?:opus|sonnet|haiku)-[\d.-]+/,
+  /\bgrok-\d+\.\d+/,
+  /\bgpt-\d+[\w.-]*/,
+];
+
+const COMBINED = new RegExp(MODEL_PATTERNS.map((r) => r.source).join("|"));
+
+// WHY: files inside @heyramzi/ai define the canonical model catalog, so they must use literal IDs.
+function isModelCatalogFile(filename) {
+  return /packages\/ai\//.test(filename);
+}
+
+// WHY: a `ladder.ts` is where an app lists its model ids, so naming them there is the job.
+function isLadderFile(filename) {
+  return /(?:^|[\\/])ladder\.[cm]?[jt]s$/.test(filename);
+}
+
+export default {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description:
+        "Disallow hardcoded AI model identifiers. Use @heyramzi/ai MODEL_IDS or MODEL_CATALOG instead.",
+    },
+    messages: {
+      noHardcodedModel:
+        'Hardcoded model "{{ model }}". Import MODEL_IDS or MODEL_CATALOG from @heyramzi/ai instead.',
+    },
+    schema: [],
+  },
+  create(context) {
+    const filename = context.filename || context.getFilename();
+    if (isModelCatalogFile(filename) || isLadderFile(filename) || isTestFile(filename)) return {};
+
+    function check(value, node) {
+      if (typeof value !== "string") return;
+      const match = value.match(COMBINED);
+      if (match) {
+        context.report({ node, messageId: "noHardcodedModel", data: { model: match[0] } });
+      }
+    }
+
+    return {
+      Literal(node) {
+        check(node.value, node);
+      },
+      TemplateLiteral(node) {
+        for (const quasi of node.quasis) {
+          check(quasi.value.cooked, node);
+        }
+      },
+    };
+  },
+};

package/rules/no-inline-path.js

@@ -0,0 +1,46 @@
+/**
+ * Disallow inline SVG <path> in components. SVGs must be separate .svg files
+ * and imported. Contract in packages/lint/README.md.
+ */
+import { readFileSync } from "node:fs";
+import { findInlinePaths } from "#lint/inline-path.js";
+
+export default {
+  meta: {
+    type: "problem",
+    docs: {
+      description:
+        "Disallow inline SVG <path> elements in component templates. SVGs must be separate files and imported.",
+    },
+    messages: {
+      noInlinePath:
+        "Inline SVG <path> found at line {{ line }}. SVGs must be separate files (.svg) and imported (e.g. import icon from './icon.svg'). Do not embed inline paths.",
+    },
+    schema: [],
+  },
+  create(context) {
+    const filename = context.filename;
+
+    if (filename.endsWith(".svg")) return {};
+    if (!/\.(svelte|vue|jsx|tsx|html|astro)$/.test(filename)) return {};
+
+    return {
+      Program() {
+        let source;
+        try {
+          source = readFileSync(filename, "utf8");
+        } catch {
+          return;
+        }
+
+        for (const match of findInlinePaths(source)) {
+          context.report({
+            loc: { line: 1, column: 0 },
+            messageId: "noInlinePath",
+            data: { line: String(match.line) },
+          });
+        }
+      },
+    };
+  },
+};

package/rules/no-inline-svg.js

@@ -0,0 +1,67 @@
+/**
+ * Disallow inline <svg> elements in Svelte template markup. Use icon components (e.g. phosphor-svelte) instead.
+ */
+
+/*
+ * OXLint only exposes the <script> block as sourceCode.text for .svelte files, so this rule reads the full file from disk to inspect the template markup.
+ */
+
+/*
+ * Skips files in allowed directories (ui/, icons/, logos/, svg/, diagrams/).
+ */
+import { readFileSync } from "node:fs";
+
+const ALLOW_PATH_RE =
+  /[\\/](?:components[\\/]ui|components[\\/]icons|logos|components[\\/]shared[\\/]svg|diagrams|svibe|slides[\\/]layouts|embed|brand-pdf|og[\\/])[\\/]/;
+
+export default {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Disallow inline <svg> elements in Svelte files. Use icon components instead.",
+    },
+    messages: {
+      noInlineSvg:
+        "Inline <svg> at line {{ line }}. Use an icon component (e.g. phosphor-svelte) or extract to a dedicated SVG component file.",
+    },
+    schema: [],
+  },
+  create(context) {
+    const filename = context.filename;
+
+    if (!filename.endsWith(".svelte")) return {};
+    if (ALLOW_PATH_RE.test(filename)) return {};
+
+    return {
+      Program() {
+        let source;
+        try {
+          source = readFileSync(filename, "utf8");
+        } catch {
+          return;
+        }
+
+        // Only scan the template portion (after the last </script>)
+        const scriptCloseIdx = source.lastIndexOf("</script>");
+        const template = scriptCloseIdx !== -1 ? source.slice(scriptCloseIdx) : source;
+        const templateStartLine =
+          scriptCloseIdx !== -1 ? source.slice(0, scriptCloseIdx).split("\n").length : 1;
+
+        const lines = template.split("\n");
+
+        for (let i = 0; i < lines.length; i++) {
+          if (!lines[i].includes("<svg")) continue;
+
+          // OXLint only sees the script block, so report at line 1
+          // and include the actual file line number in the message
+          const actualLine = templateStartLine + i;
+          context.report({
+            loc: { line: 1, column: 0 },
+            messageId: "noInlineSvg",
+            data: { line: String(actualLine) },
+          });
+        }
+      },
+    };
+  },
+};