@hublo/sentinel 1.5.0-alpha.9 → 1.5.0

package/lint/react-lib.json

@@ -5,6 +5,7 @@
     "react",
     "jsx-a11y",
     "jest",
+    "vitest",
     "unicorn",
     "oxc",
     "nextjs"
@@ -53,6 +54,14 @@
     "typescript/prefer-as-const": "error",
     "typescript/prefer-namespace-keyword": "error",
     "typescript/triple-slash-reference": "error",
+    "@tanstack/query/exhaustive-deps": "warn",
+    "@tanstack/query/infinite-query-property-order": "warn",
+    "@tanstack/query/mutation-property-order": "warn",
+    "@tanstack/query/no-rest-destructuring": "warn",
+    "@tanstack/query/no-unstable-deps": "warn",
+    "@tanstack/query/no-void-query-fn": "warn",
+    "@tanstack/query/prefer-query-options": "warn",
+    "@tanstack/query/stable-query-client": "warn",
     "curly": [
       "error",
       "all"
@@ -70,39 +79,28 @@
     "jest-dom/prefer-to-have-style": "error",
     "jest-dom/prefer-to-have-text-content": "error",
     "jest-dom/prefer-to-have-value": "error",
-    "jest/expect-expect": [
-      "error",
-      {
-        "assertFunctionNames": [
-          "expect",
-          "expect*",
-          "waitForElementToBeRemoved",
-          "screen.findBy*",
-          "result.findBy*"
-        ]
-      }
-    ],
-    "jest/no-alias-methods": "error",
-    "jest/no-commented-out-tests": "warn",
-    "jest/no-conditional-expect": "error",
+    "jest/expect-expect": "off",
+    "jest/no-alias-methods": "off",
+    "jest/no-commented-out-tests": "off",
+    "jest/no-conditional-expect": "off",
     "jest/no-deprecated-functions": "error",
-    "jest/no-disabled-tests": "warn",
+    "jest/no-disabled-tests": "off",
     "jest/no-done-callback": "error",
     "jest/no-export": "error",
-    "jest/no-focused-tests": "error",
-    "jest/no-identical-title": "error",
-    "jest/no-interpolation-in-snapshots": "error",
+    "jest/no-focused-tests": "off",
+    "jest/no-identical-title": "off",
+    "jest/no-interpolation-in-snapshots": "off",
     "jest/no-jasmine-globals": "error",
-    "jest/no-mocks-import": "error",
-    "jest/no-standalone-expect": "error",
-    "jest/no-test-prefixes": "error",
-    "jest/prefer-to-be": "error",
-    "jest/prefer-to-contain": "error",
-    "jest/prefer-to-have-length": "error",
-    "jest/valid-describe-callback": "error",
-    "jest/valid-expect": "error",
-    "jest/valid-expect-in-promise": "error",
-    "jest/valid-title": "error",
+    "jest/no-mocks-import": "off",
+    "jest/no-standalone-expect": "off",
+    "jest/no-test-prefixes": "off",
+    "jest/prefer-to-be": "off",
+    "jest/prefer-to-contain": "off",
+    "jest/prefer-to-have-length": "off",
+    "jest/valid-describe-callback": "off",
+    "jest/valid-expect": "off",
+    "jest/valid-expect-in-promise": "off",
+    "jest/valid-title": "off",
     "jsx-a11y/anchor-is-valid": [
       "error",
       {
@@ -334,7 +332,39 @@
       {
         "requireStringLiterals": false
       }
-    ]
+    ],
+    "vitest/expect-expect": [
+      "error",
+      {
+        "assertFunctionNames": [
+          "expect",
+          "expect*",
+          "waitForElementToBeRemoved",
+          "screen.findBy*",
+          "result.findBy*"
+        ]
+      }
+    ],
+    "vitest/no-alias-methods": "error",
+    "vitest/no-commented-out-tests": "warn",
+    "vitest/no-conditional-expect": "error",
+    "vitest/no-disabled-tests": "warn",
+    "vitest/no-focused-tests": "error",
+    "vitest/no-identical-title": "error",
+    "vitest/no-interpolation-in-snapshots": "error",
+    "vitest/no-mocks-import": "error",
+    "vitest/no-standalone-expect": "error",
+    "vitest/no-test-prefixes": "error",
+    "vitest/prefer-to-be": "error",
+    "vitest/prefer-to-contain": "error",
+    "vitest/prefer-to-have-length": "error",
+    "vitest/require-mock-type-parameters": "off",
+    "vitest/require-to-throw-message": "warn",
+    "vitest/valid-describe-callback": "error",
+    "vitest/valid-expect": "error",
+    "vitest/valid-expect-in-promise": "error",
+    "vitest/valid-title": "error",
+    "vitest/warn-todo": "warn"
   },
   "jsPlugins": [
     "eslint-plugin-no-barrel-files",
@@ -350,7 +380,11 @@
       "name": "storybook",
       "specifier": "eslint-plugin-storybook"
     },
-    "../plugins/hublo.js"
+    "../plugins/hublo.js",
+    {
+      "name": "@tanstack/query",
+      "specifier": "@tanstack/eslint-plugin-query"
+    }
   ],
   "overrides": [
     {
@@ -373,6 +407,62 @@
         "storybook/use-storybook-testing-library": "error",
         "react-hooks/rules-of-hooks": "off"
       }
+    },
+    {
+      "files": [
+        "**/*.test.ts",
+        "**/*.test.tsx",
+        "**/*.spec.ts",
+        "**/*.spec.tsx",
+        "**/*.integration-spec.ts",
+        "**/*.e2e-spec.ts"
+      ],
+      "rules": {
+        "no-restricted-properties": [
+          "warn",
+          {
+            "object": "Math",
+            "property": "random",
+            "message": "No Math.random() in a test: use a deterministic fixture, or stub the random source."
+          },
+          {
+            "object": "Date",
+            "property": "now",
+            "message": "No Date.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+          },
+          {
+            "object": "performance",
+            "property": "now",
+            "message": "No performance.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+          },
+          {
+            "object": "process",
+            "property": "hrtime",
+            "message": "No process.hrtime in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+          },
+          {
+            "object": "crypto",
+            "property": "randomUUID",
+            "message": "No crypto.randomUUID() in a test: use a fixed id, or stub the random source."
+          },
+          {
+            "object": "crypto",
+            "property": "getRandomValues",
+            "message": "No crypto.getRandomValues() in a test: use a fixed buffer, or stub the random source."
+          }
+        ],
+        "no-restricted-globals": [
+          "warn",
+          {
+            "name": "setTimeout",
+            "message": "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+          },
+          {
+            "name": "setInterval",
+            "message": "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+          }
+        ]
+      }
     }
   ]
 }

package/lint/react.json

@@ -5,6 +5,7 @@
     "react",
     "jsx-a11y",
     "jest",
+    "vitest",
     "import",
     "unicorn",
     "oxc"
@@ -53,6 +54,16 @@
     "typescript/prefer-as-const": "error",
     "typescript/prefer-namespace-keyword": "error",
     "typescript/triple-slash-reference": "error",
+    "@tanstack/query/exhaustive-deps": "warn",
+    "@tanstack/query/infinite-query-property-order": "warn",
+    "@tanstack/query/mutation-property-order": "warn",
+    "@tanstack/query/no-rest-destructuring": "warn",
+    "@tanstack/query/no-unstable-deps": "warn",
+    "@tanstack/query/no-void-query-fn": "warn",
+    "@tanstack/query/prefer-query-options": "warn",
+    "@tanstack/query/stable-query-client": "warn",
+    "@tanstack/router/create-route-property-order": "warn",
+    "@tanstack/router/route-param-names": "warn",
     "curly": [
       "error",
       "all"
@@ -60,6 +71,7 @@
     "for-direction": "error",
     "hublo/no-palette-common": "off",
     "hublo/no-regex-lookbehind": "error",
+    "hublo/require-reload-document": "error",
     "jest/expect-expect": "off",
     "jest/no-alias-methods": "off",
     "jest/no-commented-out-tests": "off",
@@ -456,7 +468,28 @@
       {
         "requireStringLiterals": false
       }
-    ]
+    ],
+    "vitest/expect-expect": "warn",
+    "vitest/no-alias-methods": "warn",
+    "vitest/no-commented-out-tests": "warn",
+    "vitest/no-conditional-expect": "warn",
+    "vitest/no-disabled-tests": "warn",
+    "vitest/no-focused-tests": "warn",
+    "vitest/no-identical-title": "warn",
+    "vitest/no-interpolation-in-snapshots": "warn",
+    "vitest/no-mocks-import": "warn",
+    "vitest/no-standalone-expect": "warn",
+    "vitest/no-test-prefixes": "warn",
+    "vitest/prefer-to-be": "warn",
+    "vitest/prefer-to-contain": "warn",
+    "vitest/prefer-to-have-length": "warn",
+    "vitest/require-mock-type-parameters": "off",
+    "vitest/require-to-throw-message": "warn",
+    "vitest/valid-describe-callback": "warn",
+    "vitest/valid-expect": "warn",
+    "vitest/valid-expect-in-promise": "warn",
+    "vitest/valid-title": "warn",
+    "vitest/warn-todo": "warn"
   },
   "jsPlugins": [
     "eslint-plugin-no-barrel-files",
@@ -464,6 +497,10 @@
       "name": "nx",
       "specifier": "@nx/eslint-plugin"
     },
+    {
+      "name": "@tanstack/query",
+      "specifier": "@tanstack/eslint-plugin-query"
+    },
     {
       "name": "styled-components-a11y",
       "specifier": "eslint-plugin-styled-components-a11y"
@@ -472,6 +509,68 @@
       "name": "react-refresh",
       "specifier": "eslint-plugin-react-refresh"
     },
-    "../plugins/hublo.js"
+    "../plugins/hublo.js",
+    {
+      "name": "@tanstack/router",
+      "specifier": "@tanstack/eslint-plugin-router"
+    }
+  ],
+  "overrides": [
+    {
+      "files": [
+        "**/*.test.ts",
+        "**/*.test.tsx",
+        "**/*.spec.ts",
+        "**/*.spec.tsx",
+        "**/*.integration-spec.ts",
+        "**/*.e2e-spec.ts"
+      ],
+      "rules": {
+        "no-restricted-properties": [
+          "warn",
+          {
+            "object": "Math",
+            "property": "random",
+            "message": "No Math.random() in a test: use a deterministic fixture, or stub the random source."
+          },
+          {
+            "object": "Date",
+            "property": "now",
+            "message": "No Date.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+          },
+          {
+            "object": "performance",
+            "property": "now",
+            "message": "No performance.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+          },
+          {
+            "object": "process",
+            "property": "hrtime",
+            "message": "No process.hrtime in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+          },
+          {
+            "object": "crypto",
+            "property": "randomUUID",
+            "message": "No crypto.randomUUID() in a test: use a fixed id, or stub the random source."
+          },
+          {
+            "object": "crypto",
+            "property": "getRandomValues",
+            "message": "No crypto.getRandomValues() in a test: use a fixed buffer, or stub the random source."
+          }
+        ],
+        "no-restricted-globals": [
+          "warn",
+          {
+            "name": "setTimeout",
+            "message": "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+          },
+          {
+            "name": "setInterval",
+            "message": "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+          }
+        ]
+      }
+    }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.5.0-alpha.9",
+  "version": "1.5.0",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",
@@ -10,7 +10,7 @@
     "url": "git+https://github.com/hublo/sentinel.git"
   },
   "engines": {
-    "node": ">=20.12.0"
+    "node": ">=24.15.0"
   },
   "bin": {
     "sentinel": "./dist/bin/sentinel.js"
@@ -110,6 +110,8 @@
   "dependencies": {
     "@nx/eslint-plugin": "23.0.1",
     "@tailwindcss/vite": "4.1.18",
+    "@tanstack/eslint-plugin-query": "5.104.0",
+    "@tanstack/eslint-plugin-router": "1.162.0",
     "@vitejs/plugin-react": "6.0.1",
     "@vitest/coverage-v8": "4.1.4",
     "axe-core": "^4.13.0",
@@ -118,8 +120,17 @@
     "eslint-plugin-jest-dom": "5.5.0",
     "eslint-plugin-no-barrel-files": "1.2.1",
     "eslint-plugin-react-refresh": "0.4.19",
+    "eslint-plugin-sonarjs": "4.2.2",
     "eslint-plugin-storybook": "10.3.5",
     "eslint-plugin-styled-components-a11y": "2.2.0",
+    "graphology": "0.26.0",
+    "graphology-communities-louvain": "2.0.2",
+    "graphology-components": "1.5.4",
+    "graphology-layout": "0.6.1",
+    "graphology-layout-forceatlas2": "0.10.1",
+    "graphology-metrics": "2.4.2",
+    "graphology-svg": "0.1.3",
+    "graphology-types": "0.24.8",
     "html-validate": "^11.16.0",
     "jscpd": "5.4.0",
     "jsdom": "^24.1.3",
@@ -139,11 +150,10 @@
   },
   "devDependencies": {
     "@hublo/sentinel": "link:.",
-    "@types/node": "^22.0.0",
+    "@types/node": "^24.19.2",
     "nx": "^23.1.0",
     "tsup": "^8.3.0",
-    "tsx": "^4.19.0",
-    "typescript": "^5.9.0"
+    "tsx": "^4.19.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -160,6 +170,13 @@
       },
       "format:fix": {
         "cache": false
+      },
+      "static-analysis": {
+        "cache": true,
+        "inputs": [
+          "default",
+          "{projectRoot}/static-analysis.config.mjs"
+        ]
       }
     }
   },
@@ -190,6 +207,10 @@
     "docs:traces": "pnpm build && bash scripts/gen-traces.sh",
     "docs:traces:check": "pnpm build && bash scripts/gen-traces.sh --check",
     "format:fix": "node dist/bin/sentinel.js --run --format --fix",
-    "bench": "node scripts/bench.mjs"
+    "bench": "node scripts/bench.mjs",
+    "deps:trust": "tsx scripts/check-trust-policy.ts",
+    "static-analysis": "sentinel --run --static-analysis",
+    "static-analysis:json": "sentinel --run --static-analysis --output json",
+    "static-analysis:html": "sentinel --run --static-analysis --output html"
   }
 }

package/plugins/hublo/no-palette-common.js

@@ -0,0 +1,76 @@
+/**
+ * Ban `palette.common` and `common.*` colour paths in product code.
+ *
+ * oxlint has no `no-restricted-syntax`, so the eight AST selectors that used to live in
+ * `restricted-syntax.cjs` cannot be carried across as configuration. They are expressed as a real
+ * rule instead, which is what oxlint's JS plugin API is for. The originals, and where each is
+ * handled below:
+ *
+ *   1-2  MemberExpression[object.property.name='palette'][property.name='common']       theme.palette.common
+ *        …[computed=true][property.value='common']                                      theme.palette['common']
+ *   3-4  MemberExpression[object.name='palette']…                                        palette.common
+ *   5-6  Property[key.name|key.value=/<colour props>/] > Literal[value=/^common\./]      { color: 'common.white' }
+ *   7-8  JSXAttribute[name.name=/<colour props>/] > Literal | JSXExpressionContainer     color="common.white"
+ */
+
+const MESSAGE =
+  'Do not use palette.common or common.* color paths in product code. Use semantic palette tokens instead.'
+
+/** The MUI props that take a colour path, so `common.*` in them is the same mistake. */
+const COLOUR_PROPS =
+  /^(color|bgcolor|background|backgroundColor|borderColor|borderTopColor|borderRightColor|borderBottomColor|borderLeftColor|outlineColor|fill|stroke|textDecorationColor|caretColor|accentColor)$/
+
+/** `common.something` as a string value, e.g. `{ color: 'common.white' }`. */
+const isCommonPath = (node) =>
+  node?.type === 'Literal' && typeof node.value === 'string' && /^common\./.test(node.value)
+
+/** @type {import("oxlint").Rule} */
+export const rule = {
+  meta: {
+    docs: {
+      description: 'Ban palette.common and common.* colour paths in product code.',
+    },
+  },
+  create(context) {
+    const report = (node) => context.report({ node, message: MESSAGE })
+
+    return {
+      // 1-4: reaching `common` off a palette, by property or by computed key.
+      MemberExpression(node) {
+        const onPalette =
+          node.object?.property?.name === 'palette' || node.object?.name === 'palette'
+        if (!onPalette) {
+          return
+        }
+        const reachesCommon =
+          node.property?.name === 'common' || (node.computed && node.property?.value === 'common')
+        if (reachesCommon) {
+          report(node)
+        }
+      },
+
+      // 5-6: `{ color: 'common.white' }` in an object literal, key written either way.
+      Property(node) {
+        const key = node.key?.name ?? node.key?.value
+        if (typeof key === 'string' && COLOUR_PROPS.test(key) && isCommonPath(node.value)) {
+          report(node.value)
+        }
+      },
+
+      // 7-8: `color="common.white"` and `color={'common.white'}` on a JSX element.
+      JSXAttribute(node) {
+        const name = node.name?.name
+        if (typeof name !== 'string' || !COLOUR_PROPS.test(name)) {
+          return
+        }
+        const value = node.value
+        if (isCommonPath(value)) {
+          return report(value)
+        }
+        if (value?.type === 'JSXExpressionContainer' && isCommonPath(value.expression)) {
+          report(value.expression)
+        }
+      },
+    }
+  },
+}

package/plugins/hublo/no-regex-lookbehind.js

@@ -0,0 +1,70 @@
+/**
+ * Ban regex lookbehind, which Safari below 16.4 cannot parse.
+ *
+ * ⛔ Not a style rule and not a carried-over selector: a browser-support rule. Unlike everything
+ * else a preset controls, lookbehind can be neither transpiled nor polyfilled, because no bundler
+ * rewrites the contents of a regex literal. Lint is the only layer left that can catch it.
+ */
+
+/**
+ * Lookbehind, positive or negative. NOT named groups `(?<name>)`, which Safari has had since
+ * 11.3: the class is exactly `(?<` followed by `=` or `!`.
+ */
+const LOOKBEHIND = /\(\?<[=!]/
+
+const LOOKBEHIND_MESSAGE =
+  'Regex lookbehind ((?<=) / (?<!)) is Safari 16.4+ and can be neither transpiled nor polyfilled: on older iOS the literal is a parse-time SyntaxError that takes the whole chunk with it. Rewrite the pattern. Named groups (?<name>) are fine.'
+
+/** @type {import("oxlint").Rule} */
+export const rule = {
+  meta: {
+    docs: {
+      description: 'Ban regex lookbehind, unsupported by Safari below 16.4.',
+    },
+  },
+  create(context) {
+    const report = (node) => context.report({ node, message: LOOKBEHIND_MESSAGE })
+
+    /**
+     * `new RegExp(...)` and `RegExp(...)`, when the pattern is readable statically: a
+     * string, or a template whose fixed parts carry the lookbehind.
+     *
+     * Each template chunk is tested on its own rather than joined. Joining invents a
+     * `(?<=` that the runtime string never has, across an interpolation boundary:
+     * `` `(?<${op}=x)` `` would read as one.
+     */
+    const isStaticLookbehind = (pattern) => {
+      if (pattern?.type === 'Literal') {
+        return typeof pattern.value === 'string' && LOOKBEHIND.test(pattern.value)
+      }
+      if (pattern?.type === 'TemplateLiteral') {
+        return (pattern.quasis ?? []).some((quasi) =>
+          LOOKBEHIND.test(quasi.value?.cooked ?? quasi.value?.raw ?? ''),
+        )
+      }
+      return false
+    }
+
+    const checkRegExpCall = (node) => {
+      if (node.callee?.name !== 'RegExp') {
+        return
+      }
+      const pattern = node.arguments?.[0]
+      if (isStaticLookbehind(pattern)) {
+        report(pattern)
+      }
+    }
+
+    return {
+      // The case that actually breaks a page: a literal is an EARLY error, so the whole
+      // chunk fails to parse rather than the one call site failing.
+      Literal(node) {
+        if (node.regex && LOOKBEHIND.test(node.regex.pattern)) {
+          report(node)
+        }
+      },
+      NewExpression: checkRegExpCall,
+      CallExpression: checkRegExpCall,
+    }
+  },
+}

package/plugins/hublo/require-reload-document.js

@@ -0,0 +1,70 @@
+/**
+ * Ban a TanStack Router `redirect({ href })` that does not say whether it reloads the document.
+ *
+ * Carried from an ESLint selector in monorepo #22043, for the same reason as its neighbours: a
+ * house rule is code, not configuration.
+ */
+
+/** @type {import("oxlint").Rule} */
+export const rule = {
+  meta: {
+    docs: {
+      description:
+        'Ban a TanStack Router redirect({ href }) that does not say whether it reloads the document.',
+    },
+  },
+  create(context) {
+    /**
+     * A `redirect({ href })` that declares no `reloadDocument`.
+     *
+     * ⛔ The failure this exists for ships GREEN and 404s only in production. Since the
+     * router-core bump, `redirect({ href })` no longer reloads the document for an absolute
+     * URL on the app's own origin: router-core turns it into an in-app navigation. Apps under
+     * a basepath share their origin with the app they point at, so the redirect lands on the
+     * SOURCE app's 404 instead of loading the target. Tests run on jsdom's localhost, where
+     * the same href is cross-origin and does reload, so nothing catches it before production.
+     *
+     * ⚠️ What this rule enforces is "declare the intent", NOT "do not 404". A call that says
+     * `reloadDocument: false` passes, and that is the exact in-app navigation which caused the
+     * incident; the rule cannot tell an internal path from a cross-app one, because the href is
+     * usually computed. It shrinks the target from any `redirect({ href })` to one that opted
+     * out explicitly, and that is all it does.
+     *
+     * ⚠️ An `href` arriving through a spread is invisible to it. Measured when the rule was
+     * written: zero occurrences of `redirect({ ...opts })` in the whole front end.
+     *
+     * It is application-agnostic on purpose: every app on TanStack Router under a basepath has
+     * the same exposure, so the message names no application.
+     */
+    const SPREAD_SAFE_MESSAGE =
+      'redirect({ href }) must say whether it reloads the document. Under a basepath the app ' +
+      'shares its origin with the app you are pointing at, so the router turns a same-origin ' +
+      'href into an in-app navigation and the redirect lands on this app’s 404. Use a ' +
+      'helper that sets reloadDocument: true to leave for another app, or set ' +
+      'reloadDocument: false to say you mean an in-app navigation.'
+
+    /** The call is `redirect(...)`, written bare or as a member. */
+    const isRedirect = (node) =>
+      node.callee?.name === 'redirect' || node.callee?.property?.name === 'redirect'
+
+    /** A plain `key:` property, which a spread element does not have. */
+    const named = (property, name) =>
+      property?.type === 'Property' && (property.key?.name === name || property.key?.value === name)
+
+    return {
+      CallExpression(node) {
+        if (!isRedirect(node)) return
+        const options = node.arguments?.[0]
+        if (options?.type !== 'ObjectExpression') return
+
+        const properties = options.properties ?? []
+        const hasHref = properties.some((property) => named(property, 'href'))
+        if (!hasHref) return
+        const declaresReload = properties.some((property) => named(property, 'reloadDocument'))
+        if (declaresReload) return
+
+        context.report({ node: options, message: SPREAD_SAFE_MESSAGE })
+      },
+    }
+  },
+}