@hublo/sentinel 1.1.0-alpha.1 → 1.1.0-alpha.2

package/dist/bin/sentinel.js

@@ -14,7 +14,7 @@ import {
   registerAdapters,
   resolve,
   resolveBin
-} from "../chunk-RLMXN2ZJ.js";
+} from "../chunk-EZCRU6XE.js";
 
 // bin/sentinel.ts
 import { program } from "commander";

package/dist/{chunk-RLMXN2ZJ.js → chunk-EZCRU6XE.js}

@@ -187,8 +187,204 @@ var NEST_DISABLED = [
     reason: "the single occurrence is a regex whose whole purpose is stripping ASCII control characters before XML output, which the rule cannot distinguish from an accident"
   }
 ];
+var REACT_DISABLED = [
+  // The jest suite is the single largest group: enabling it turned 135 errors into a
+  // wall nobody would read on day one. Adoption has to be a lateral move first.
+  {
+    rule: "jest/expect-expect",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-alias-methods",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-commented-out-tests",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-conditional-expect",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-deprecated-functions",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-disabled-tests",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-done-callback",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-export",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-focused-tests",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-identical-title",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-interpolation-in-snapshots",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-jasmine-globals",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-mocks-import",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-standalone-expect",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/no-test-prefixes",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/prefer-to-be",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/prefer-to-contain",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/prefer-to-have-length",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/valid-describe-callback",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/valid-expect",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/valid-expect-in-promise",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  {
+    rule: "jest/valid-title",
+    reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+  },
+  // TanStack Query rules the codebase has never satisfied.
+  {
+    rule: "@tanstack/query/exhaustive-deps",
+    reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+  },
+  {
+    rule: "@tanstack/query/infinite-query-property-order",
+    reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+  },
+  {
+    rule: "@tanstack/query/mutation-property-order",
+    reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+  },
+  {
+    rule: "@tanstack/query/no-rest-destructuring",
+    reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+  },
+  {
+    rule: "@tanstack/query/no-unstable-deps",
+    reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+  },
+  {
+    rule: "@tanstack/query/no-void-query-fn",
+    reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+  },
+  {
+    rule: "@tanstack/query/stable-query-client",
+    reason: "the codebase predates these rules and has never satisfied them; enabling them is its own piece of work, not part of swapping linters"
+  },
+  // typescript-eslint rules carrying real, pre-existing debt.
+  {
+    rule: "typescript/no-empty-function",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-explicit-any",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unnecessary-type-assertion",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unsafe-argument",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unsafe-assignment",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unsafe-call",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unsafe-enum-comparison",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unsafe-member-access",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unsafe-return",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/no-unused-vars",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/only-throw-error",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "typescript/require-await",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  // One-offs, each for its own reason.
+  {
+    rule: "no-console",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "no-unsafe-optional-chaining",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "react/jsx-curly-brace-presence",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "styled-components-a11y/label-has-for",
+    reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+  },
+  {
+    rule: "jsx-a11y/img-redundant-alt",
+    reason: 'one real finding, a decorative image whose title is already rendered as a heading beside it, so the fix is alt="". A genuine accessibility issue rather than a false positive: parked only so swapping linters stays a lateral move, and worth switching back on as soon as it is fixed'
+  },
+  {
+    rule: "hublo/no-palette-common",
+    reason: "the house rule finds 3 real violations; they are fixed as their own change rather than inside a linter swap, so the rule ships visible-but-off and can be switched on once they are"
+  }
+];
 var BY_FLAVOUR = {
-  nest: NEST_DISABLED
+  nest: NEST_DISABLED,
+  react: REACT_DISABLED
 };
 function disabledRulesFor(flavour) {
   return BY_FLAVOUR[flavour] ?? [];
@@ -393,6 +589,261 @@ var nestLayer = {
 };
 var nestRules = { ...lintBase, ...nestLayer };
 
+// src/roles/lint/flavours/react.ts
+var reactLayer = {
+  // ESLint core (42)
+  curly: ["error", "all"],
+  "for-direction": "error",
+  "no-async-promise-executor": "error",
+  "no-case-declarations": "error",
+  "no-compare-neg-zero": "error",
+  "no-cond-assign": ["error", "except-parens"],
+  "no-constant-binary-expression": "error",
+  "no-constant-condition": ["error", { checkLoops: "allExceptWhileTrue" }],
+  "no-control-regex": "error",
+  "no-debugger": "error",
+  "no-delete-var": "error",
+  "no-dupe-else-if": "error",
+  "no-duplicate-case": "error",
+  "no-empty": ["error", { allowEmptyCatch: false }],
+  "no-empty-character-class": "error",
+  "no-empty-pattern": ["error", { allowObjectPatternsAsParameters: false }],
+  "no-empty-static-block": "error",
+  "no-ex-assign": "error",
+  "no-extra-boolean-cast": ["error", {}],
+  "no-fallthrough": ["error", { allowEmptyCase: false, reportUnusedFallthroughComment: false }],
+  "no-global-assign": ["error", { exceptions: [] }],
+  "no-invalid-regexp": ["error", {}],
+  "no-irregular-whitespace": [
+    "error",
+    {
+      skipComments: false,
+      skipJSXText: false,
+      skipRegExps: false,
+      skipStrings: true,
+      skipTemplates: false
+    }
+  ],
+  "no-loss-of-precision": "error",
+  "no-misleading-character-class": "error",
+  "no-nonoctal-decimal-escape": "error",
+  "no-prototype-builtins": "error",
+  "no-regex-spaces": "error",
+  "no-restricted-imports": [
+    "error",
+    {
+      patterns: [
+        {
+          group: ["next/*"],
+          message: "Importing from next/* is not allowed in the admin project."
+        },
+        {
+          group: ["storybook/*"],
+          message: "Importing from storybook/* is not allowed in the admin project."
+        },
+        {
+          group: ["@nestjs/*"],
+          message: "Importing from @nestjs/* is not allowed in the admin project."
+        },
+        {
+          group: ["next-i18next"],
+          message: "Importing from next-i18next is not allowed in the admin project."
+        },
+        {
+          group: ["@hublo/style/colors", "@hublo/style/colors/*"],
+          message: "Importing runtime colors directly is not allowed. Use the MUI theme, theme-derived CSS variables, or an explicit product-specific mapping."
+        }
+      ]
+    }
+  ],
+  "no-self-assign": ["error", { props: true }],
+  "no-shadow-restricted-names": ["error", { reportGlobalThis: false }],
+  "no-sparse-arrays": "error",
+  "no-unexpected-multiline": "error",
+  "no-unsafe-finally": "error",
+  "no-unused-labels": "error",
+  "no-unused-private-class-members": "error",
+  "no-useless-backreference": "error",
+  "no-useless-catch": "error",
+  "no-useless-escape": ["error", { allowRegexCharacters: [] }],
+  "require-yield": "error",
+  "use-isnan": ["error", { enforceForIndexOf: false, enforceForSwitchCase: true }],
+  "valid-typeof": ["error", { requireStringLiterals: false }],
+  // eslint-plugin-styled-components-a11y (hosted) (32)
+  "styled-components-a11y/alt-text": "error",
+  "styled-components-a11y/anchor-has-content": "error",
+  "styled-components-a11y/anchor-is-valid": "error",
+  "styled-components-a11y/aria-activedescendant-has-tabindex": "error",
+  "styled-components-a11y/aria-props": "error",
+  "styled-components-a11y/aria-proptypes": "error",
+  "styled-components-a11y/aria-role": "error",
+  "styled-components-a11y/aria-unsupported-elements": "error",
+  "styled-components-a11y/autocomplete-valid": "error",
+  "styled-components-a11y/click-events-have-key-events": "error",
+  "styled-components-a11y/control-has-associated-label": [
+    "off",
+    {
+      ignoreElements: ["audio", "canvas", "embed", "input", "textarea", "tr", "video"],
+      ignoreRoles: [
+        "grid",
+        "listbox",
+        "menu",
+        "menubar",
+        "radiogroup",
+        "row",
+        "tablist",
+        "toolbar",
+        "tree",
+        "treegrid"
+      ],
+      includeRoles: ["alert", "dialog"]
+    }
+  ],
+  "styled-components-a11y/heading-has-content": "error",
+  "styled-components-a11y/html-has-lang": "error",
+  "styled-components-a11y/iframe-has-title": "error",
+  "styled-components-a11y/img-redundant-alt": "error",
+  "styled-components-a11y/interactive-supports-focus": [
+    "error",
+    {
+      tabbable: [
+        "button",
+        "checkbox",
+        "link",
+        "progressbar",
+        "searchbox",
+        "slider",
+        "spinbutton",
+        "switch",
+        "textbox"
+      ]
+    }
+  ],
+  "styled-components-a11y/label-has-associated-control": "error",
+  "styled-components-a11y/media-has-caption": "error",
+  "styled-components-a11y/mouse-events-have-key-events": "error",
+  "styled-components-a11y/no-access-key": "error",
+  "styled-components-a11y/no-autofocus": "error",
+  "styled-components-a11y/no-distracting-elements": "error",
+  "styled-components-a11y/no-interactive-element-to-noninteractive-role": "error",
+  "styled-components-a11y/no-noninteractive-element-interactions": [
+    "error",
+    { body: ["onError", "onLoad"], iframe: ["onError", "onLoad"], img: ["onError", "onLoad"] }
+  ],
+  "styled-components-a11y/no-noninteractive-element-to-interactive-role": "error",
+  "styled-components-a11y/no-noninteractive-tabindex": "error",
+  "styled-components-a11y/no-redundant-roles": "error",
+  "styled-components-a11y/no-static-element-interactions": "error",
+  "styled-components-a11y/role-has-required-aria-props": "error",
+  "styled-components-a11y/role-supports-aria-props": "error",
+  "styled-components-a11y/scope": "error",
+  "styled-components-a11y/tabindex-no-positive": "error",
+  // eslint-plugin-jsx-a11y (31)
+  "jsx-a11y/alt-text": "error",
+  "jsx-a11y/anchor-has-content": "error",
+  "jsx-a11y/anchor-is-valid": "error",
+  "jsx-a11y/aria-activedescendant-has-tabindex": "error",
+  "jsx-a11y/aria-props": "error",
+  "jsx-a11y/aria-proptypes": "error",
+  "jsx-a11y/aria-role": "error",
+  "jsx-a11y/aria-unsupported-elements": "error",
+  "jsx-a11y/autocomplete-valid": "error",
+  "jsx-a11y/click-events-have-key-events": "error",
+  "jsx-a11y/heading-has-content": "error",
+  "jsx-a11y/html-has-lang": "error",
+  "jsx-a11y/iframe-has-title": "error",
+  "jsx-a11y/img-redundant-alt": "error",
+  "jsx-a11y/interactive-supports-focus": [
+    "error",
+    {
+      tabbable: [
+        "button",
+        "checkbox",
+        "link",
+        "progressbar",
+        "searchbox",
+        "slider",
+        "spinbutton",
+        "switch",
+        "textbox"
+      ]
+    }
+  ],
+  "jsx-a11y/label-has-associated-control": "error",
+  "jsx-a11y/media-has-caption": "error",
+  "jsx-a11y/mouse-events-have-key-events": "error",
+  "jsx-a11y/no-access-key": "error",
+  "jsx-a11y/no-autofocus": "error",
+  "jsx-a11y/no-distracting-elements": "error",
+  "jsx-a11y/no-interactive-element-to-noninteractive-role": "error",
+  "jsx-a11y/no-noninteractive-element-interactions": [
+    "error",
+    { body: ["onError", "onLoad"], iframe: ["onError", "onLoad"], img: ["onError", "onLoad"] }
+  ],
+  "jsx-a11y/no-noninteractive-element-to-interactive-role": "error",
+  "jsx-a11y/no-noninteractive-tabindex": "error",
+  "jsx-a11y/no-redundant-roles": "error",
+  "jsx-a11y/no-static-element-interactions": "error",
+  "jsx-a11y/role-has-required-aria-props": "error",
+  "jsx-a11y/role-supports-aria-props": "error",
+  "jsx-a11y/scope": "error",
+  "jsx-a11y/tabindex-no-positive": "error",
+  // typescript-eslint (18)
+  "typescript/await-thenable": "error",
+  "typescript/no-array-delete": "error",
+  "typescript/no-base-to-string": "error",
+  "typescript/no-duplicate-type-constituents": "error",
+  "typescript/no-floating-promises": ["error", { ignoreVoid: true }],
+  "typescript/no-for-in-array": "error",
+  "typescript/no-implied-eval": "error",
+  "typescript/no-inferrable-types": "error",
+  "typescript/no-misused-promises": ["error", { checksVoidReturn: { attributes: false } }],
+  "typescript/no-non-null-assertion": "warn",
+  "typescript/no-redundant-type-constituents": "error",
+  "typescript/no-require-imports": "error",
+  "typescript/no-unsafe-unary-minus": "error",
+  "typescript/prefer-promise-reject-errors": "error",
+  "typescript/restrict-plus-operands": "error",
+  "typescript/restrict-template-expressions": "error",
+  "typescript/switch-exhaustiveness-check": "warn",
+  "typescript/unbound-method": "error",
+  // eslint-plugin-react-hooks (2)
+  "react-hooks/exhaustive-deps": "warn",
+  "react-hooks/rules-of-hooks": "error",
+  // eslint-plugin-no-barrel-files (hosted) (1)
+  "no-barrel-files/no-barrel-files": "warn",
+  // @nx/eslint-plugin (hosted) (1)
+  "nx/enforce-module-boundaries": [
+    "error",
+    {
+      enforceBuildableLibDependency: true,
+      allow: [],
+      depConstraints: [{ sourceTag: "*", onlyDependOnLibsWithTags: ["*"] }]
+    }
+  ],
+  // eslint-plugin-import — aliased, oxlint reserves `import` (1)
+  "import-js/order": [
+    "error",
+    {
+      "newlines-between": "always",
+      groups: ["builtin", "external", "internal", ["parent", "index"], "sibling"],
+      alphabetize: { order: "asc" },
+      pathGroups: [
+        { pattern: "@nestjs/**", group: "external" },
+        {
+          pattern: "{@admin/**,@authentication/**,@featureToggles/**,@institution/**,@hublo/**,@network/**,@mission/**,@notification/**,@shared/**,@talent/**,@worker/**,@contract/**,@config/**,@front/**}",
+          group: "internal",
+          position: "before"
+        }
+      ],
+      pathGroupsExcludedImportTypes: ["builtin"]
+    }
+  ],
+  // eslint-plugin-react-refresh (hosted) (1)
+  "react-refresh/only-export-components": ["warn", { allowConstantExport: true }]
+};
+var reactRules = { ...lintBase, ...reactLayer };
+
 // src/roles/lint/presets.ts
 var TS_EXTENSIONS = [".ts", ".cts", ".mts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
 var IMPORT_SETTINGS = {
@@ -418,8 +869,26 @@ var BASE_PRESET = {
   env: { es2022: true },
   rules: lintBase
 };
+var REACT_PRESET = {
+  plugins: ["typescript", "react", "jsx-a11y", "jest", "import", "unicorn", "oxc"],
+  jsPlugins: [
+    "eslint-plugin-no-barrel-files",
+    { name: "nx", specifier: "@nx/eslint-plugin" },
+    { name: "import-js", specifier: "eslint-plugin-import" },
+    { name: "@tanstack/query", specifier: "@tanstack/eslint-plugin-query" },
+    { name: "styled-components-a11y", specifier: "eslint-plugin-styled-components-a11y" },
+    { name: "react-refresh", specifier: "eslint-plugin-react-refresh" },
+    // Ships inside sentinel, resolved relative to THIS preset file. Oxlint has no
+    // `no-restricted-syntax`, so the Hublo house rules are a real rule instead.
+    "../plugins/hublo.js"
+  ],
+  env: { browser: true, es2022: true, node: true, jest: true },
+  settings: IMPORT_SETTINGS,
+  rules: reactRules
+};
 var BY_FLAVOUR2 = {
   nest: NEST_PRESET,
+  react: REACT_PRESET,
   // `node` ships the base alone, deliberately. It is the honest answer for a module that
   // belongs to no stack, and it keeps `--init` with no named target working everywhere
   // rather than blocking a whole workspace sweep on one unshipped flavour. It is thin (21
@@ -437,17 +906,43 @@ function lintPresetFor(flavour) {
 // src/roles/lint/rename-suppressions.ts
 import { readdirSync, readFileSync as readFileSync2, statSync } from "fs";
 import { join as join2, relative } from "path";
-var SOURCE_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"];
+var SOURCE_EXTENSIONS = [
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".mts",
+  ".cts",
+  ".svelte",
+  ".vue"
+];
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "coverage", ".git", ".nx"]);
 var SUPPRESSION = /(eslint-disable(?:-next-line|-line)?)\s+([^\n*]+?)(?:\s*--.*)?(?:\s*\*\/)?\s*$/;
-function renamedPrefixes(jsPlugins) {
+function renamedPrefixes(jsPlugins, declared = {}) {
   const renames = /* @__PURE__ */ new Map();
   for (const plugin of jsPlugins) {
     if (typeof plugin === "string") continue;
     const original = plugin.specifier.replace(/^eslint-plugin-/, "").replace(/\/eslint-plugin$/, "");
     if (original !== plugin.name) renames.set(`${original}/`, `${plugin.name}/`);
   }
-  return renames;
+  const slash = (value) => value.endsWith("/") ? value : `${value}/`;
+  for (const [from, to] of Object.entries(declared)) renames.set(slash(from), slash(to));
+  return collapseChains(renames);
+}
+function collapseChains(renames) {
+  const collapsed = /* @__PURE__ */ new Map();
+  for (const [from, to] of renames) {
+    let target = to;
+    for (let hop = 0; hop < renames.size; hop += 1) {
+      const next = renames.get(target);
+      if (next === void 0 || next === target) break;
+      target = next;
+    }
+    collapsed.set(from, target);
+  }
+  return collapsed;
 }
 function* sourceFiles(dir) {
   let entries;
@@ -684,6 +1179,14 @@ function oxlintSearchPath(cwd) {
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
 var MAX_FIX_PASSES = 3;
+function summariseByPlugin(rules) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const name of deferredRuleNames(rules)) {
+    const plugin = name.includes("/") ? name.split("/")[0] ?? name : "core";
+    counts.set(plugin, (counts.get(plugin) ?? 0) + 1);
+  }
+  return [...counts.entries()].sort((left, right) => right[1] - left[1]).map(([plugin, count]) => `${count} ${plugin}`).join(", ");
+}
 var OxlintAdapter = class extends BaseAdapter {
   target = "lint";
   runner = "oxlint";
@@ -735,10 +1238,15 @@ var OxlintAdapter = class extends BaseAdapter {
     }
     const renames = findSuppressionRenames(
       context.cwd,
-      renamedPrefixes(lintPresetFor(context.flavour).jsPlugins)
+      renamedPrefixes(
+        lintPresetFor(context.flavour).jsPlugins,
+        lintPresetFor(context.flavour).renames
+      )
     );
+    const deleting = new Set(eslintConfigs);
+    const rewritten = renames.filter((entry) => !deleting.has(entry.file));
     const byFile = /* @__PURE__ */ new Map();
-    for (const entry of renames) {
+    for (const entry of rewritten) {
       const list = byFile.get(entry.file) ?? [];
       list.push({ from: entry.from, to: entry.to });
       byFile.set(entry.file, list);
@@ -751,15 +1259,15 @@ var OxlintAdapter = class extends BaseAdapter {
     ];
     if (disabled.length > 0) {
       notes.push(
-        `${disabled.length} rule(s) not enforced by this preset: ${deferredRuleNames(disabled).join(", ")}. Run --inspect --lint for the reasons.`
+        `${disabled.length} rule(s) not enforced by this preset (${summariseByPlugin(disabled)}). Run --inspect --lint for each rule and why.`
       );
     }
     if (eslintConfigs.length > 0) {
       notes.push(`removed ${eslintConfigs.join(", ")} and pointed the nx lint target at oxlint`);
     }
-    if (renames.length > 0) {
+    if (rewritten.length > 0) {
       notes.push(
-        `renamed ${renames.length} suppression comment(s) whose plugin oxlint registers under a different name (${[...new Set(renames.map((entry) => entry.rule))].join(", ")}); left alone they would stop suppressing anything, silently`
+        `renamed ${rewritten.length} suppression comment(s) whose plugin oxlint registers under a different name (${[...new Set(rewritten.map((entry) => entry.rule))].join(", ")}); left alone they would stop suppressing anything, silently`
       );
     }
     notes.push("run `pnpm install`, then `pnpm run lint`");
@@ -816,35 +1324,35 @@ var OxlintAdapter = class extends BaseAdapter {
       return { ok: false, code: 1 };
     }
     this.announceDisabled(ctx.flavour);
-    const args = ["-c", LINT_CONFIG_FILE];
-    if (canRunTypeAware(ctx.cwd)) {
-      args.push("--type-aware");
-    } else {
+    const typeAware = canRunTypeAware(ctx.cwd);
+    if (!typeAware) {
       process.stderr.write(
         `${palette(process.stderr).warn("sentinel lint(oxlint): oxlint-tsgolint is not installed, so type-aware rules will NOT run")}
 `
       );
     }
-    if (ctx.fix) args.push("--fix");
-    args.push(".");
-    const passes = ctx.fix ? MAX_FIX_PASSES : 1;
-    let code = 1;
-    for (let pass = 0; pass < passes; pass += 1) {
-      const result = spawnSync(oxlint, args, {
+    const env = { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) };
+    const lint = (extra) => {
+      const result = spawnSync(oxlint, ["-c", LINT_CONFIG_FILE, ...extra, "."], {
         cwd: ctx.cwd,
         stdio: "inherit",
-        env: { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) }
+        env
       });
       if (result.error) {
         process.stderr.write(
           `sentinel lint(oxlint): could not run oxlint (${result.error.message})
 `
         );
-        return { ok: false, code: 1 };
+        return 1;
+      }
+      return result.status ?? 1;
+    };
+    if (ctx.fix) {
+      for (let pass = 0; pass < MAX_FIX_PASSES; pass += 1) {
+        if (lint(["--fix"]) === 0) break;
       }
-      code = result.status ?? 1;
-      if (code === 0) break;
     }
+    const code = lint(typeAware ? ["--type-aware"] : []);
     return { ok: code === 0, code };
   }
   /** The module's resolved lint configuration, and what it deliberately does not enforce. */
@@ -915,7 +1423,7 @@ var OxlintAdapter = class extends BaseAdapter {
     if (disabled.length === 0) return;
     process.stderr.write(
       `${palette(process.stderr).warn(
-        `sentinel lint(oxlint): ${disabled.length} rule(s) not enforced by default (${deferredRuleNames(disabled).join(", ")}); run --inspect --lint for the reasons`
+        `sentinel lint(oxlint): ${disabled.length} rule(s) not enforced by default (${summariseByPlugin(disabled)}); run --inspect --lint for each rule and why`
       )}
 `
     );
@@ -1551,4 +2059,4 @@ export {
   detectFramework,
   dispatch
 };
-//# sourceMappingURL=chunk-RLMXN2ZJ.js.map
+//# sourceMappingURL=chunk-EZCRU6XE.js.map

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-RLMXN2ZJ.js";
+} from "./chunk-EZCRU6XE.js";
 export {
   BaseAdapter,
   all,

package/oxlint/react.json

@@ -0,0 +1,570 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": [
+    "typescript",
+    "react",
+    "jsx-a11y",
+    "jest",
+    "import",
+    "unicorn",
+    "oxc"
+  ],
+  "env": {
+    "browser": true,
+    "es2022": true,
+    "node": true,
+    "jest": true
+  },
+  "categories": {
+    "correctness": "off",
+    "suspicious": "off",
+    "pedantic": "off",
+    "perf": "off",
+    "style": "off",
+    "restriction": "off",
+    "nursery": "off"
+  },
+  "ignorePatterns": [
+    "**/dist/**",
+    "**/node_modules/**",
+    "**/coverage/**",
+    "**/*.mock.ts"
+  ],
+  "rules": {
+    "typescript/ban-ts-comment": "warn",
+    "typescript/no-array-constructor": "warn",
+    "typescript/no-duplicate-enum-values": "warn",
+    "typescript/no-empty-object-type": "warn",
+    "typescript/no-extra-non-null-assertion": "warn",
+    "typescript/no-misused-new": "warn",
+    "typescript/no-namespace": "warn",
+    "typescript/no-non-null-asserted-optional-chain": "warn",
+    "typescript/no-this-alias": "warn",
+    "typescript/no-unnecessary-type-constraint": "warn",
+    "typescript/no-unsafe-declaration-merging": "warn",
+    "typescript/no-unsafe-function-type": "warn",
+    "typescript/no-unused-expressions": [
+      "warn",
+      {
+        "allowShortCircuit": false,
+        "allowTaggedTemplates": false,
+        "allowTernary": false
+      }
+    ],
+    "typescript/no-wrapper-object-types": "warn",
+    "typescript/prefer-as-const": "warn",
+    "typescript/prefer-namespace-keyword": "warn",
+    "typescript/triple-slash-reference": "warn",
+    "no-var": "warn",
+    "prefer-const": [
+      "warn",
+      {
+        "destructuring": "any",
+        "ignoreReadBeforeAssign": false
+      }
+    ],
+    "prefer-rest-params": "warn",
+    "prefer-spread": "warn",
+    "curly": [
+      "error",
+      "all"
+    ],
+    "for-direction": "error",
+    "no-async-promise-executor": "error",
+    "no-case-declarations": "error",
+    "no-compare-neg-zero": "error",
+    "no-cond-assign": [
+      "error",
+      "except-parens"
+    ],
+    "no-constant-binary-expression": "error",
+    "no-constant-condition": [
+      "error",
+      {
+        "checkLoops": "allExceptWhileTrue"
+      }
+    ],
+    "no-control-regex": "error",
+    "no-debugger": "error",
+    "no-delete-var": "error",
+    "no-dupe-else-if": "error",
+    "no-duplicate-case": "error",
+    "no-empty": [
+      "error",
+      {
+        "allowEmptyCatch": false
+      }
+    ],
+    "no-empty-character-class": "error",
+    "no-empty-pattern": [
+      "error",
+      {
+        "allowObjectPatternsAsParameters": false
+      }
+    ],
+    "no-empty-static-block": "error",
+    "no-ex-assign": "error",
+    "no-extra-boolean-cast": [
+      "error",
+      {}
+    ],
+    "no-fallthrough": [
+      "error",
+      {
+        "allowEmptyCase": false,
+        "reportUnusedFallthroughComment": false
+      }
+    ],
+    "no-global-assign": [
+      "error",
+      {
+        "exceptions": []
+      }
+    ],
+    "no-invalid-regexp": [
+      "error",
+      {}
+    ],
+    "no-irregular-whitespace": [
+      "error",
+      {
+        "skipComments": false,
+        "skipJSXText": false,
+        "skipRegExps": false,
+        "skipStrings": true,
+        "skipTemplates": false
+      }
+    ],
+    "no-loss-of-precision": "error",
+    "no-misleading-character-class": "error",
+    "no-nonoctal-decimal-escape": "error",
+    "no-prototype-builtins": "error",
+    "no-regex-spaces": "error",
+    "no-restricted-imports": [
+      "error",
+      {
+        "patterns": [
+          {
+            "group": [
+              "next/*"
+            ],
+            "message": "Importing from next/* is not allowed in the admin project."
+          },
+          {
+            "group": [
+              "storybook/*"
+            ],
+            "message": "Importing from storybook/* is not allowed in the admin project."
+          },
+          {
+            "group": [
+              "@nestjs/*"
+            ],
+            "message": "Importing from @nestjs/* is not allowed in the admin project."
+          },
+          {
+            "group": [
+              "next-i18next"
+            ],
+            "message": "Importing from next-i18next is not allowed in the admin project."
+          },
+          {
+            "group": [
+              "@hublo/style/colors",
+              "@hublo/style/colors/*"
+            ],
+            "message": "Importing runtime colors directly is not allowed. Use the MUI theme, theme-derived CSS variables, or an explicit product-specific mapping."
+          }
+        ]
+      }
+    ],
+    "no-self-assign": [
+      "error",
+      {
+        "props": true
+      }
+    ],
+    "no-shadow-restricted-names": [
+      "error",
+      {
+        "reportGlobalThis": false
+      }
+    ],
+    "no-sparse-arrays": "error",
+    "no-unexpected-multiline": "error",
+    "no-unsafe-finally": "error",
+    "no-unused-labels": "error",
+    "no-unused-private-class-members": "error",
+    "no-useless-backreference": "error",
+    "no-useless-catch": "error",
+    "no-useless-escape": [
+      "error",
+      {
+        "allowRegexCharacters": []
+      }
+    ],
+    "require-yield": "error",
+    "use-isnan": [
+      "error",
+      {
+        "enforceForIndexOf": false,
+        "enforceForSwitchCase": true
+      }
+    ],
+    "valid-typeof": [
+      "error",
+      {
+        "requireStringLiterals": false
+      }
+    ],
+    "styled-components-a11y/alt-text": "error",
+    "styled-components-a11y/anchor-has-content": "error",
+    "styled-components-a11y/anchor-is-valid": "error",
+    "styled-components-a11y/aria-activedescendant-has-tabindex": "error",
+    "styled-components-a11y/aria-props": "error",
+    "styled-components-a11y/aria-proptypes": "error",
+    "styled-components-a11y/aria-role": "error",
+    "styled-components-a11y/aria-unsupported-elements": "error",
+    "styled-components-a11y/autocomplete-valid": "error",
+    "styled-components-a11y/click-events-have-key-events": "error",
+    "styled-components-a11y/control-has-associated-label": [
+      "off",
+      {
+        "ignoreElements": [
+          "audio",
+          "canvas",
+          "embed",
+          "input",
+          "textarea",
+          "tr",
+          "video"
+        ],
+        "ignoreRoles": [
+          "grid",
+          "listbox",
+          "menu",
+          "menubar",
+          "radiogroup",
+          "row",
+          "tablist",
+          "toolbar",
+          "tree",
+          "treegrid"
+        ],
+        "includeRoles": [
+          "alert",
+          "dialog"
+        ]
+      }
+    ],
+    "styled-components-a11y/heading-has-content": "error",
+    "styled-components-a11y/html-has-lang": "error",
+    "styled-components-a11y/iframe-has-title": "error",
+    "styled-components-a11y/img-redundant-alt": "error",
+    "styled-components-a11y/interactive-supports-focus": [
+      "error",
+      {
+        "tabbable": [
+          "button",
+          "checkbox",
+          "link",
+          "progressbar",
+          "searchbox",
+          "slider",
+          "spinbutton",
+          "switch",
+          "textbox"
+        ]
+      }
+    ],
+    "styled-components-a11y/label-has-associated-control": "error",
+    "styled-components-a11y/media-has-caption": "error",
+    "styled-components-a11y/mouse-events-have-key-events": "error",
+    "styled-components-a11y/no-access-key": "error",
+    "styled-components-a11y/no-autofocus": "error",
+    "styled-components-a11y/no-distracting-elements": "error",
+    "styled-components-a11y/no-interactive-element-to-noninteractive-role": "error",
+    "styled-components-a11y/no-noninteractive-element-interactions": [
+      "error",
+      {
+        "body": [
+          "onError",
+          "onLoad"
+        ],
+        "iframe": [
+          "onError",
+          "onLoad"
+        ],
+        "img": [
+          "onError",
+          "onLoad"
+        ]
+      }
+    ],
+    "styled-components-a11y/no-noninteractive-element-to-interactive-role": "error",
+    "styled-components-a11y/no-noninteractive-tabindex": "error",
+    "styled-components-a11y/no-redundant-roles": "error",
+    "styled-components-a11y/no-static-element-interactions": "error",
+    "styled-components-a11y/role-has-required-aria-props": "error",
+    "styled-components-a11y/role-supports-aria-props": "error",
+    "styled-components-a11y/scope": "error",
+    "styled-components-a11y/tabindex-no-positive": "error",
+    "jsx-a11y/alt-text": "error",
+    "jsx-a11y/anchor-has-content": "error",
+    "jsx-a11y/anchor-is-valid": "error",
+    "jsx-a11y/aria-activedescendant-has-tabindex": "error",
+    "jsx-a11y/aria-props": "error",
+    "jsx-a11y/aria-proptypes": "error",
+    "jsx-a11y/aria-role": "error",
+    "jsx-a11y/aria-unsupported-elements": "error",
+    "jsx-a11y/autocomplete-valid": "error",
+    "jsx-a11y/click-events-have-key-events": "error",
+    "jsx-a11y/heading-has-content": "error",
+    "jsx-a11y/html-has-lang": "error",
+    "jsx-a11y/iframe-has-title": "error",
+    "jsx-a11y/img-redundant-alt": "off",
+    "jsx-a11y/interactive-supports-focus": [
+      "error",
+      {
+        "tabbable": [
+          "button",
+          "checkbox",
+          "link",
+          "progressbar",
+          "searchbox",
+          "slider",
+          "spinbutton",
+          "switch",
+          "textbox"
+        ]
+      }
+    ],
+    "jsx-a11y/label-has-associated-control": "error",
+    "jsx-a11y/media-has-caption": "error",
+    "jsx-a11y/mouse-events-have-key-events": "error",
+    "jsx-a11y/no-access-key": "error",
+    "jsx-a11y/no-autofocus": "error",
+    "jsx-a11y/no-distracting-elements": "error",
+    "jsx-a11y/no-interactive-element-to-noninteractive-role": "error",
+    "jsx-a11y/no-noninteractive-element-interactions": [
+      "error",
+      {
+        "body": [
+          "onError",
+          "onLoad"
+        ],
+        "iframe": [
+          "onError",
+          "onLoad"
+        ],
+        "img": [
+          "onError",
+          "onLoad"
+        ]
+      }
+    ],
+    "jsx-a11y/no-noninteractive-element-to-interactive-role": "error",
+    "jsx-a11y/no-noninteractive-tabindex": "error",
+    "jsx-a11y/no-redundant-roles": "error",
+    "jsx-a11y/no-static-element-interactions": "error",
+    "jsx-a11y/role-has-required-aria-props": "error",
+    "jsx-a11y/role-supports-aria-props": "error",
+    "jsx-a11y/scope": "error",
+    "jsx-a11y/tabindex-no-positive": "error",
+    "typescript/await-thenable": "error",
+    "typescript/no-array-delete": "error",
+    "typescript/no-base-to-string": "error",
+    "typescript/no-duplicate-type-constituents": "error",
+    "typescript/no-floating-promises": [
+      "error",
+      {
+        "ignoreVoid": true
+      }
+    ],
+    "typescript/no-for-in-array": "error",
+    "typescript/no-implied-eval": "error",
+    "typescript/no-inferrable-types": "error",
+    "typescript/no-misused-promises": [
+      "error",
+      {
+        "checksVoidReturn": {
+          "attributes": false
+        }
+      }
+    ],
+    "typescript/no-non-null-assertion": "warn",
+    "typescript/no-redundant-type-constituents": "error",
+    "typescript/no-require-imports": "error",
+    "typescript/no-unsafe-unary-minus": "error",
+    "typescript/prefer-promise-reject-errors": "error",
+    "typescript/restrict-plus-operands": "error",
+    "typescript/restrict-template-expressions": "error",
+    "typescript/switch-exhaustiveness-check": "warn",
+    "typescript/unbound-method": "error",
+    "react-hooks/exhaustive-deps": "warn",
+    "react-hooks/rules-of-hooks": "error",
+    "no-barrel-files/no-barrel-files": "warn",
+    "nx/enforce-module-boundaries": [
+      "error",
+      {
+        "enforceBuildableLibDependency": true,
+        "allow": [],
+        "depConstraints": [
+          {
+            "sourceTag": "*",
+            "onlyDependOnLibsWithTags": [
+              "*"
+            ]
+          }
+        ]
+      }
+    ],
+    "import-js/order": [
+      "error",
+      {
+        "newlines-between": "always",
+        "groups": [
+          "builtin",
+          "external",
+          "internal",
+          [
+            "parent",
+            "index"
+          ],
+          "sibling"
+        ],
+        "alphabetize": {
+          "order": "asc"
+        },
+        "pathGroups": [
+          {
+            "pattern": "@nestjs/**",
+            "group": "external"
+          },
+          {
+            "pattern": "{@admin/**,@authentication/**,@featureToggles/**,@institution/**,@hublo/**,@network/**,@mission/**,@notification/**,@shared/**,@talent/**,@worker/**,@contract/**,@config/**,@front/**}",
+            "group": "internal",
+            "position": "before"
+          }
+        ],
+        "pathGroupsExcludedImportTypes": [
+          "builtin"
+        ]
+      }
+    ],
+    "react-refresh/only-export-components": [
+      "warn",
+      {
+        "allowConstantExport": true
+      }
+    ],
+    "jest/expect-expect": "off",
+    "jest/no-alias-methods": "off",
+    "jest/no-commented-out-tests": "off",
+    "jest/no-conditional-expect": "off",
+    "jest/no-deprecated-functions": "off",
+    "jest/no-disabled-tests": "off",
+    "jest/no-done-callback": "off",
+    "jest/no-export": "off",
+    "jest/no-focused-tests": "off",
+    "jest/no-identical-title": "off",
+    "jest/no-interpolation-in-snapshots": "off",
+    "jest/no-jasmine-globals": "off",
+    "jest/no-mocks-import": "off",
+    "jest/no-standalone-expect": "off",
+    "jest/no-test-prefixes": "off",
+    "jest/prefer-to-be": "off",
+    "jest/prefer-to-contain": "off",
+    "jest/prefer-to-have-length": "off",
+    "jest/valid-describe-callback": "off",
+    "jest/valid-expect": "off",
+    "jest/valid-expect-in-promise": "off",
+    "jest/valid-title": "off",
+    "@tanstack/query/exhaustive-deps": "off",
+    "@tanstack/query/infinite-query-property-order": "off",
+    "@tanstack/query/mutation-property-order": "off",
+    "@tanstack/query/no-rest-destructuring": "off",
+    "@tanstack/query/no-unstable-deps": "off",
+    "@tanstack/query/no-void-query-fn": "off",
+    "@tanstack/query/stable-query-client": "off",
+    "typescript/no-empty-function": "off",
+    "typescript/no-explicit-any": "off",
+    "typescript/no-unnecessary-type-assertion": "off",
+    "typescript/no-unsafe-argument": "off",
+    "typescript/no-unsafe-assignment": "off",
+    "typescript/no-unsafe-call": "off",
+    "typescript/no-unsafe-enum-comparison": "off",
+    "typescript/no-unsafe-member-access": "off",
+    "typescript/no-unsafe-return": "off",
+    "typescript/no-unused-vars": "off",
+    "typescript/only-throw-error": "off",
+    "typescript/require-await": "off",
+    "no-console": "off",
+    "no-unsafe-optional-chaining": "off",
+    "react/jsx-curly-brace-presence": "off",
+    "styled-components-a11y/label-has-for": "off",
+    "hublo/no-palette-common": "off"
+  },
+  "jsPlugins": [
+    "eslint-plugin-no-barrel-files",
+    {
+      "name": "nx",
+      "specifier": "@nx/eslint-plugin"
+    },
+    {
+      "name": "import-js",
+      "specifier": "eslint-plugin-import"
+    },
+    {
+      "name": "@tanstack/query",
+      "specifier": "@tanstack/eslint-plugin-query"
+    },
+    {
+      "name": "styled-components-a11y",
+      "specifier": "eslint-plugin-styled-components-a11y"
+    },
+    {
+      "name": "react-refresh",
+      "specifier": "eslint-plugin-react-refresh"
+    },
+    "../plugins/hublo.js"
+  ],
+  "settings": {
+    "import/extensions": [
+      ".ts",
+      ".cts",
+      ".mts",
+      ".tsx",
+      ".js",
+      ".jsx",
+      ".mjs",
+      ".cjs"
+    ],
+    "import/external-module-folders": [
+      "node_modules",
+      "node_modules/@types"
+    ],
+    "import/parsers": {
+      "@typescript-eslint/parser": [
+        ".ts",
+        ".cts",
+        ".mts",
+        ".tsx"
+      ]
+    },
+    "import/resolver": {
+      "node": {
+        "extensions": [
+          ".ts",
+          ".cts",
+          ".mts",
+          ".tsx",
+          ".js",
+          ".jsx",
+          ".mjs",
+          ".cjs"
+        ]
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.1.0-alpha.1",
+  "version": "1.1.0-alpha.2",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",
@@ -36,6 +36,7 @@
   "files": [
     "dist",
     "oxlint",
+    "plugins",
     "!dist/**/*.map"
   ],
   "dependencies": {

package/plugins/hublo.js

@@ -0,0 +1,88 @@
+/**
+ * Local oxlint plugin: Hublo house rules that have no equivalent anywhere else.
+ *
+ * oxlint has no `no-restricted-syntax`, so the eight AST selectors that used to live in
+ * `restricted-syntax.cjs` cannot be carried across as configuration. They are expressed
+ * here as a real rule instead, which is what oxlint's JS plugin API is for.
+ *
+ * It ships INSIDE sentinel rather than being copied into each module. A house rule is code,
+ * not configuration: a per-module copy drifts, and drifting house rules are the problem
+ * sentinel exists to remove. The cost is that `@hublo/sentinel` carries a rule about Hublo's
+ * colour palette, which is honest for a package named after the company.
+ *
+ * The original selectors, and where each is handled below:
+ *   1-2  MemberExpression[object.property.name='palette'][property.name='common']       theme.palette.common
+ *        …[computed=true][property.value='common']                                      theme.palette['common']
+ *   3-4  MemberExpression[object.name='palette']…                                        palette.common
+ *   5-6  Property[key.name|key.value=/<colour props>/] > Literal[value=/^common\./]      { color: 'common.white' }
+ *   7-8  JSXAttribute[name.name=/<colour props>/] > Literal | JSXExpressionContainer     color="common.white"
+ */
+
+const MESSAGE =
+  'Do not use palette.common or common.* color paths in product code. Use semantic palette tokens instead.'
+
+/** The MUI props that take a colour path, so `common.*` in them is the same mistake. */
+const COLOUR_PROPS =
+  /^(color|bgcolor|background|backgroundColor|borderColor|borderTopColor|borderRightColor|borderBottomColor|borderLeftColor|outlineColor|fill|stroke|textDecorationColor|caretColor|accentColor)$/
+
+/** `common.something` as a string value, e.g. `{ color: 'common.white' }`. */
+const isCommonPath = (node) =>
+  node?.type === 'Literal' && typeof node.value === 'string' && /^common\./.test(node.value)
+
+const plugin = {
+  meta: { name: 'hublo' },
+  rules: {
+    'no-palette-common': {
+      meta: {
+        docs: {
+          description: 'Ban palette.common and common.* colour paths in product code.',
+        },
+      },
+      create(context) {
+        const report = (node) => context.report({ node, message: MESSAGE })
+
+        return {
+          // 1-4: reaching `common` off a palette, by property or by computed key.
+          MemberExpression(node) {
+            const onPalette =
+              node.object?.property?.name === 'palette' || node.object?.name === 'palette'
+            if (!onPalette) {
+              return
+            }
+            const reachesCommon =
+              node.property?.name === 'common' ||
+              (node.computed && node.property?.value === 'common')
+            if (reachesCommon) {
+              report(node)
+            }
+          },
+
+          // 5-6: `{ color: 'common.white' }` in an object literal, key written either way.
+          Property(node) {
+            const key = node.key?.name ?? node.key?.value
+            if (typeof key === 'string' && COLOUR_PROPS.test(key) && isCommonPath(node.value)) {
+              report(node.value)
+            }
+          },
+
+          // 7-8: `color="common.white"` and `color={'common.white'}` on a JSX element.
+          JSXAttribute(node) {
+            const name = node.name?.name
+            if (typeof name !== 'string' || !COLOUR_PROPS.test(name)) {
+              return
+            }
+            const value = node.value
+            if (isCommonPath(value)) {
+              return report(value)
+            }
+            if (value?.type === 'JSXExpressionContainer' && isCommonPath(value.expression)) {
+              report(value.expression)
+            }
+          },
+        }
+      },
+    },
+  },
+}
+
+export default plugin