@noctcore/lint-meta-rules 0.3.0 → 0.4.0

package/dist/prisma.js

@@ -0,0 +1,356 @@
+import {
+  globFiles
+} from "./chunk-Z7TXSZR4.js";
+import {
+  firstOptionOf,
+  resolveRules,
+  severityOf
+} from "./chunk-VFCX3QKZ.js";
+
+// src/prisma/prisma-method-surface.ts
+import { PRISMA_READ_METHODS, PRISMA_WRITE_METHODS } from "@noctcore/eslint-plugin-prisma";
+var DEFAULT_ID = "prisma-method-surface";
+var DEFAULT_CLIENT_GLOBS = [
+  "generated/prisma/models/*.ts",
+  "node_modules/.prisma/client/index.d.ts"
+];
+function blankComments(source) {
+  return source.replace(/\/\*[\s\S]*?\*\//gu, (comment) => comment.replace(/[^\n]/gu, " ")).replace(/(^|[^:])\/\/.*$/gmu, "$1");
+}
+function parseDelegateSurfaces(source, file = "") {
+  const lines = blankComments(source).split("\n");
+  const surfaces = [];
+  for (let i = 0; i < lines.length; i += 1) {
+    const open = /^(\s*)(?:export\s+)?interface\s+([A-Za-z_]\w*)Delegate\b.*\{\s*$/u.exec(
+      lines[i] ?? ""
+    );
+    if (open?.[2] === void 0) continue;
+    const indent = open[1] ?? "";
+    let memberIndent = null;
+    const methods = /* @__PURE__ */ new Set();
+    let j = i + 1;
+    for (; j < lines.length; j += 1) {
+      const line = lines[j] ?? "";
+      if (line.startsWith(`${indent}}`)) break;
+      if (line.trim() === "") continue;
+      const leading = /^\s*/u.exec(line)?.[0] ?? "";
+      memberIndent ??= leading;
+      if (leading !== memberIndent) continue;
+      const member = /^\s*([A-Za-z_]\w*)\s*</u.exec(line);
+      if (member?.[1] !== void 0) methods.add(member[1]);
+    }
+    surfaces.push({ file, model: open[2], methods: [...methods].sort() });
+    i = j;
+  }
+  return surfaces;
+}
+var sorted = (values) => [...values].sort();
+function createPrismaMethodSurfaceRule(options = {}) {
+  const id = options.id ?? DEFAULT_ID;
+  const clientGlobs = options.clientGlobs ?? DEFAULT_CLIENT_GLOBS;
+  const writeMethods = options.writeMethods ?? PRISMA_WRITE_METHODS;
+  const readMethods = options.readMethods ?? PRISMA_READ_METHODS;
+  return {
+    id,
+    category: "config",
+    ciCritical: options.ciCritical ?? true,
+    description: "The Prisma reads and writes the rules police partition the generated client's <Model>Delegate method surface exactly, so a Prisma upgrade cannot add an unguarded method.",
+    run(ctx) {
+      const violations = [];
+      const report = (file, message) => {
+        violations.push({ file, rule: id, message });
+      };
+      const listFile = clientGlobs[0] ?? "<clientGlobs>";
+      const writes = new Set(writeMethods);
+      for (const method of readMethods) {
+        if (writes.has(method)) {
+          report(listFile, `"${method}" is configured as both a read and a write. Each delegate method belongs to exactly one.`);
+        }
+      }
+      const surfaces = globFiles((pattern) => ctx.glob(pattern), clientGlobs).flatMap(
+        (file) => parseDelegateSurfaces(ctx.read(file) ?? "", file)
+      ).filter((surface) => surface.methods.length > 0);
+      const [reference] = surfaces;
+      if (reference === void 0) {
+        report(
+          listFile,
+          `No generated Prisma client found under ${clientGlobs.map((glob) => `"${glob}"`).join(", ")}, so the method surface cannot be checked. Run \`prisma generate\` before lint-meta, or point \`clientGlobs\` at the generator's output.`
+        );
+        return violations;
+      }
+      const referenceKey = reference.methods.join(",");
+      for (const surface of surfaces) {
+        if (surface.methods.join(",") !== referenceKey) {
+          report(
+            surface.file,
+            `${surface.model}Delegate exposes [${surface.methods.join(", ")}], which differs from ${reference.model}Delegate's [${reference.methods.join(", ")}]. The method lists are model-agnostic, so they cannot describe both.`
+          );
+        }
+      }
+      const configured = /* @__PURE__ */ new Set([...writeMethods, ...readMethods]);
+      const actual = new Set(reference.methods);
+      const unguarded = sorted(reference.methods.filter((method) => !configured.has(method)));
+      const phantom = sorted([...configured].filter((method) => !actual.has(method)));
+      if (unguarded.length > 0) {
+        report(
+          reference.file,
+          `The generated client exposes ${unguarded.map((m) => `"${m}"`).join(", ")}, which is neither a configured read nor a configured write, so every rule guarding Prisma calls by method name misses it. Classify it in \`writeMethods\` or \`readMethods\` (and in the rules that read those lists).`
+        );
+      }
+      if (phantom.length > 0) {
+        report(
+          reference.file,
+          `${phantom.map((m) => `"${m}"`).join(", ")} is configured but the generated client no longer exposes it. Drop it from the lists, or check the client was regenerated for this Prisma version.`
+        );
+      }
+      return violations;
+    }
+  };
+}
+
+// src/prisma/tenant-model-registry-parity.ts
+import {
+  parsePrismaSchema,
+  reconcileTenantRegistry
+} from "@noctcore/eslint-plugin-prisma";
+var DEFAULT_ID2 = "tenant-model-registry-parity";
+var DEFAULT_SCHEMA_PATH = "prisma/schema.prisma";
+var DEFAULT_TENANT_FIELDS = ["tenantId"];
+var DEFAULT_PROBE = "src/__lint_meta_probe__.ts";
+var DEFAULT_MODEL_RULES = [
+  "noctcore-prisma/no-cross-tenant-id-in-where",
+  "noctcore-prisma/tenant-scoped-tables-require-where",
+  "noctcore-prisma/tenant-write-must-carry-tenant-id"
+];
+var DEFAULT_HAND_SCOPED_RULE = "noctcore-prisma/tenant-scoped-tables-require-where";
+function blankCommentsAndStrings(source) {
+  const out = source.split("");
+  let i = 0;
+  while (i < source.length) {
+    const two = source.slice(i, i + 2);
+    if (two === "//") {
+      while (i < source.length && source[i] !== "\n") out[i++] = " ";
+      continue;
+    }
+    if (two === "/*") {
+      const end = source.indexOf("*/", i + 2);
+      const stop = end === -1 ? source.length : end + 2;
+      for (; i < stop; i += 1) if (source[i] !== "\n") out[i] = " ";
+      continue;
+    }
+    const quote = source[i];
+    if (quote === "'" || quote === '"' || quote === "`") {
+      i += 1;
+      while (i < source.length && source[i] !== quote) {
+        if (source[i] === "\\") out[i++] = " ";
+        if (i < source.length && source[i] !== "\n") out[i] = " ";
+        i += 1;
+      }
+      i += 1;
+      continue;
+    }
+    i += 1;
+  }
+  return out.join("");
+}
+var OPENERS = /* @__PURE__ */ new Set(["{", "[", "("]);
+var CLOSERS = /* @__PURE__ */ new Set(["}", "]", ")"]);
+function parseObjectLiteralKeys(source, exportName) {
+  const blanked = blankCommentsAndStrings(source);
+  const escaped = exportName.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+  const declaration = new RegExp(`\\b${escaped}\\s*(?::[^=]+)?=\\s*\\{`, "u").exec(blanked);
+  if (declaration === null) return null;
+  const open = declaration.index + declaration[0].length - 1;
+  const keys = [];
+  let depth = 0;
+  let token = "";
+  for (let i = open; i < blanked.length; i += 1) {
+    const char = blanked[i] ?? "";
+    if (OPENERS.has(char)) {
+      depth += 1;
+      token = "";
+    } else if (CLOSERS.has(char)) {
+      depth -= 1;
+      token = "";
+      if (depth === 0) return keys;
+    } else if (depth === 1 && char === ":") {
+      const key = token.trim();
+      if (/^[A-Za-z_$][\w$]*$/u.test(key)) keys.push(key);
+      token = "";
+    } else if (depth === 1 && char === ",") {
+      token = "";
+    } else if (depth === 1) {
+      token += char;
+    }
+  }
+  return null;
+}
+function readSchema(ctx, schemaPath) {
+  const base = schemaPath.replace(/\/+$/u, "");
+  const files = ctx.glob(`${base}/**/*.prisma`).sort();
+  const texts = files.length > 0 ? files.map((file) => ctx.read(file) ?? "") : [ctx.read(base)];
+  if (texts.some((text) => text === null)) return null;
+  const parsed = parsePrismaSchema(texts.join("\n"));
+  return parsed.models.length > 0 ? parsed : null;
+}
+function fingerprint(models) {
+  return Object.keys(models).sort().map((model) => `${model}:${[...models[model] ?? []].sort().join("+")}`).join(",");
+}
+function handScopeMessages(registry) {
+  const unscoped = registry.unscopedByDesign;
+  const handScoped = registry.handScopedModels ?? {};
+  const pending = registry.handScopePending ?? {};
+  const messages = [];
+  for (const model of Object.keys(unscoped)) {
+    if (Object.hasOwn(handScoped, model) || Object.hasOwn(pending, model)) continue;
+    messages.push(
+      `\`${model}\` is exempt from the tenant-scope extension but has no \`handScopedModels\` entry, so "scoped by hand" is enforced by nothing. List the column(s) every query on it must filter by, or record why it cannot have one in \`handScopePending\`.`
+    );
+  }
+  for (const model of Object.keys(handScoped)) {
+    if (!Object.hasOwn(unscoped, model)) {
+      messages.push(
+        `\`${model}\` has a \`handScopedModels\` entry but is not exempt from the extension, so the static guard polices a model the runtime boundary already scopes. Drop the entry, or add the exemption it belongs to.`
+      );
+    }
+  }
+  for (const model of Object.keys(pending)) {
+    if (!Object.hasOwn(unscoped, model)) {
+      messages.push(
+        `\`${model}\` is recorded in \`handScopePending\` but is not exempt from the extension any more. The note is stale: delete it.`
+      );
+    }
+  }
+  return messages;
+}
+function createTenantModelRegistryParityRule(options = {}) {
+  const id = options.id ?? DEFAULT_ID2;
+  const schemaPath = options.schemaPath ?? DEFAULT_SCHEMA_PATH;
+  const tenantFields = options.tenantFields ?? DEFAULT_TENANT_FIELDS;
+  const registry = options.registry ?? { scopedModels: [], unscopedByDesign: {} };
+  const source = options.scopedModelsSource;
+  const registryFile = options.registryFile ?? source?.file ?? schemaPath;
+  const requireHandScope = options.requireHandScope ?? true;
+  const eslint = options.eslint === false ? null : options.eslint ?? {};
+  return {
+    id,
+    category: "config",
+    ciCritical: options.ciCritical ?? true,
+    description: "Every tenant-bearing Prisma model is scoped by the runtime extension or exempt with a reason, and the tenant lint rules resolve with exactly that registry.",
+    async runAsync(ctx) {
+      const violations = [];
+      const report = (file, message) => {
+        violations.push({ file, rule: id, message });
+      };
+      let scopedModels = registry.scopedModels;
+      if (source !== void 0) {
+        const text = ctx.read(source.file);
+        const keys = text === null ? null : parseObjectLiteralKeys(text, source.exportName);
+        if (keys === null || keys.length === 0) {
+          report(
+            source.file,
+            `Could not read the \`${source.exportName}\` object literal in ${source.file}, so the runtime scope map cannot be checked. The rule expects \`const ${source.exportName} = { model: ..., ... }\`; if the declaration moved or changed shape, update \`scopedModelsSource\` rather than dropping the check.`
+          );
+          return violations;
+        }
+        scopedModels = keys;
+      }
+      if (requireHandScope) {
+        for (const message of handScopeMessages(registry)) report(registryFile, message);
+      }
+      const parsed = readSchema(ctx, schemaPath);
+      if (parsed === null) {
+        report(
+          schemaPath,
+          `Could not read a Prisma schema with any model at "${schemaPath}", so tenant-bearing models cannot be derived. Point \`schemaPath\` at the schema file or folder rather than dropping the check.`
+        );
+      } else {
+        for (const message of reconcileTenantRegistry({
+          parsed,
+          tenantFields,
+          scopedModels,
+          unscopedByDesign: registry.unscopedByDesign
+        }).messages) {
+          report(source?.file ?? registryFile, message);
+        }
+      }
+      if (eslint === null) return violations;
+      const cwd = eslint.cwd ?? ".";
+      const configFile = eslint.configFile ?? cwd;
+      const modelsOption = eslint.modelsOption ?? "tenantModels";
+      const handScopedOption = eslint.handScopedOption ?? "handScopedModels";
+      const handScopedRule = eslint.handScopedRule === void 0 ? DEFAULT_HAND_SCOPED_RULE : eslint.handScopedRule;
+      const outcome = await resolveRules(ctx.root, cwd, [eslint.probe ?? DEFAULT_PROBE]);
+      if (!outcome.ok) {
+        report(
+          configFile,
+          `Could not resolve the effective ESLint config for "${cwd}", so the tenant rules' registry cannot be checked (if it imports a workspace package, build that first): ${outcome.error}`
+        );
+        return violations;
+      }
+      const rules = outcome.rules[0] ?? {};
+      const scopedSet = new Set(scopedModels);
+      for (const ruleId of eslint.modelRules ?? DEFAULT_MODEL_RULES) {
+        const entry = rules[ruleId];
+        const raw = firstOptionOf(entry)?.[modelsOption];
+        if (severityOf(entry) === 0) {
+          report(
+            configFile,
+            `"${ruleId}" is off (or not configured) for "${cwd}", so nothing statically polices the ${String(scopedModels.length)} tenant-scoped model(s). Enable it with \`${modelsOption}\` set to the scoped models.`
+          );
+          continue;
+        }
+        if (!Array.isArray(raw) || !raw.every((model) => typeof model === "string")) {
+          report(
+            configFile,
+            `"${ruleId}" resolves with no \`${modelsOption}\` option for "${cwd}", so it falls back to its default and does not police the ${String(scopedModels.length)} tenant-scoped model(s). Pass the scoped models to it.`
+          );
+          continue;
+        }
+        const configured = new Set(raw);
+        for (const model of scopedModels) {
+          if (!configured.has(model)) {
+            report(
+              configFile,
+              `\`${model}\` is tenant-scoped at runtime but is MISSING from the \`${modelsOption}\` option of "${ruleId}", so no static rule polices it. Add it to the list the config passes.`
+            );
+          }
+        }
+        for (const model of configured) {
+          if (!scopedSet.has(model)) {
+            report(
+              configFile,
+              `\`${model}\` is in the \`${modelsOption}\` option of "${ruleId}" but is not tenant-scoped at runtime, so lint guards a model the runtime boundary does not isolate. Scope it at runtime, or drop it from the list the config passes.`
+            );
+          }
+        }
+      }
+      const expectedHandScoped = registry.handScopedModels ?? {};
+      if (handScopedRule !== null && Object.keys(expectedHandScoped).length > 0) {
+        const raw = firstOptionOf(rules[handScopedRule])?.[handScopedOption];
+        if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+          report(
+            configFile,
+            `"${handScopedRule}" resolves with no \`${handScopedOption}\` option for "${cwd}", so the models the extension does NOT scope (${Object.keys(expectedHandScoped).sort().join(", ")}) are policed by nothing. Pass the registry's hand-scope map to it.`
+          );
+        } else {
+          const resolved = fingerprint(raw);
+          const expected = fingerprint(expectedHandScoped);
+          if (resolved !== expected) {
+            report(
+              configFile,
+              `The \`${handScopedOption}\` option "${handScopedRule}" resolves to does not match the registry (resolved: ${resolved}; expected: ${expected}). Pass the registry map itself rather than a hand-written copy.`
+            );
+          }
+        }
+      }
+      return violations;
+    }
+  };
+}
+export {
+  createPrismaMethodSurfaceRule,
+  createTenantModelRegistryParityRule,
+  parseDelegateSurfaces,
+  parseObjectLiteralKeys
+};

package/dist/resolved-config.cjs

@@ -0,0 +1,144 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/resolved-config.ts
+var resolved_config_exports = {};
+__export(resolved_config_exports, {
+  createEslintConfigNoWarnRule: () => createEslintConfigNoWarnRule
+});
+module.exports = __toCommonJS(resolved_config_exports);
+
+// src/resolved-config/resolve.ts
+var import_node_fs = require("fs");
+var import_node_path = __toESM(require("path"), 1);
+var import_eslint = require("eslint");
+function severityOf(entry) {
+  const raw = Array.isArray(entry) ? entry[0] : entry;
+  if (raw === 1 || raw === "warn") return 1;
+  if (raw === 2 || raw === "error") return 2;
+  return 0;
+}
+async function resolveRules(root, packageDir, probes) {
+  let cwd = import_node_path.default.resolve(root, packageDir);
+  try {
+    cwd = (0, import_node_fs.realpathSync)(cwd);
+  } catch (error) {
+    return { ok: false, error: String(error) };
+  }
+  const eslint = new import_eslint.ESLint({ cwd, errorOnUnmatchedPattern: false });
+  const rules = [];
+  const ignored = [];
+  for (const probe of probes) {
+    let config;
+    try {
+      config = await eslint.calculateConfigForFile(import_node_path.default.join(cwd, probe));
+    } catch (error) {
+      return { ok: false, error: `resolving "${probe}": ${String(error)}` };
+    }
+    if (config === void 0) ignored.push(probe);
+    else rules.push(config.rules ?? {});
+  }
+  if (rules.length > 0) return { ok: true, rules };
+  return {
+    ok: false,
+    error: probes.length === 0 ? "no probe files are configured" : `every probe (${ignored.map((probe) => `"${probe}"`).join(", ")}) is ignored by the config or matched by no block`
+  };
+}
+
+// src/resolved-config/eslint-config-no-warn.ts
+var DEFAULT_ID = "eslint-config-no-warn";
+var DEFAULT_PACKAGES = [".", "apps/*", "packages/*"];
+var DEFAULT_CONFIG_FILES = ["eslint.config.js", "eslint.config.mjs", "eslint.config.cjs"];
+var DEFAULT_PROBES = [
+  "src/__lint_meta_probe__.ts",
+  "src/__lint_meta_probe__.tsx",
+  "src/__lint_meta_probe__.test.ts",
+  "src/__lint_meta_probe__.test.tsx"
+];
+function findConfigDirs(ctx, packages, configFiles) {
+  const byDir = /* @__PURE__ */ new Map();
+  for (const pattern of packages) {
+    const base = pattern.replace(/\/+$/u, "");
+    for (const name of configFiles) {
+      const matches = base === "." || base === "" ? ctx.exists(name) ? [name] : [] : ctx.glob(`${base}/${name}`);
+      for (const configFile of matches) {
+        const slash = configFile.lastIndexOf("/");
+        const dir = slash === -1 ? "." : configFile.slice(0, slash);
+        if (!byDir.has(dir)) byDir.set(dir, configFile);
+      }
+    }
+  }
+  return [...byDir].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([dir, configFile]) => ({ dir, configFile }));
+}
+function createEslintConfigNoWarnRule(options = {}) {
+  const id = options.id ?? DEFAULT_ID;
+  const packages = options.packages ?? DEFAULT_PACKAGES;
+  const configFiles = options.configFiles ?? DEFAULT_CONFIG_FILES;
+  const probes = options.probes ?? DEFAULT_PROBES;
+  return {
+    id,
+    category: "config",
+    ciCritical: options.ciCritical ?? true,
+    description: 'Every rule in the RESOLVED ESLint config is "error" or "off", never "warn", including severities a spread preset injects.',
+    async runAsync(ctx) {
+      const results = await Promise.all(
+        findConfigDirs(ctx, packages, configFiles).map(async ({ dir, configFile }) => {
+          const outcome = await resolveRules(ctx.root, dir, probes);
+          if (!outcome.ok) {
+            return [
+              {
+                file: configFile,
+                rule: id,
+                message: `Could not resolve the effective ESLint config for "${dir}", so its severities cannot be checked (if it imports a workspace package, build that first): ${outcome.error}`
+              }
+            ];
+          }
+          const warned = /* @__PURE__ */ new Set();
+          for (const rules of outcome.rules) {
+            for (const [ruleId, entry] of Object.entries(rules)) {
+              if (severityOf(entry) === 1) warned.add(ruleId);
+            }
+          }
+          return [...warned].sort().map(
+            (ruleId) => ({
+              file: configFile,
+              rule: id,
+              message: `Rule "${ruleId}" resolves to "warn" in "${dir}". ESLint severities must be "error" or "off", never "warn" (this is the RESOLVED severity, so it may come from a spread preset rather than a literal in the config file). Override it explicitly.`
+            })
+          );
+        })
+      );
+      return results.flat();
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createEslintConfigNoWarnRule
+});

package/dist/resolved-config.d.cts

@@ -0,0 +1,46 @@
+import { IMetaRule } from '@noctcore/harness';
+
+/**
+ * Options for {@link createEslintConfigNoWarnRule}.
+ *
+ * Every path is relative to the repo root the harness runs in.
+ */
+interface EslintConfigNoWarnOptions {
+    /** Rule id, for running more than one instance. Default `eslint-config-no-warn`. */
+    readonly id?: string;
+    /**
+     * Directories whose ESLint config is resolved, as globs (`apps/*`) or plain
+     * paths (`.` for the repo root). A match is checked only when it holds one of
+     * `configFiles`. Default `['.', 'apps/*', 'packages/*']`.
+     */
+    readonly packages?: readonly string[];
+    /**
+     * The file names that mark a directory as owning a flat config. Default
+     * `eslint.config.js`, `eslint.config.mjs`, `eslint.config.cjs`.
+     */
+    readonly configFiles?: readonly string[];
+    /**
+     * Files, relative to each package, the config is resolved FOR. Resolution is
+     * glob matching, so they need not exist; pick one per file shape the config
+     * scopes blocks to. Default: a `.ts`, `.tsx`, `.test.ts` and `.test.tsx` file
+     * under `src/`.
+     */
+    readonly probes?: readonly string[];
+    /** Whether a violation fails CI. Default `true`. */
+    readonly ciCritical?: boolean;
+}
+/**
+ * ESLint severities must be `error` or `off`, never `warn`, as RESOLVED.
+ *
+ * Resolves each package's effective flat config through ESLint's
+ * `calculateConfigForFile` and reports every rule that ends up at `warn`. That is
+ * the point of the rule: a preset spread into the config (a `recommended` block
+ * that ships rules at `warn`) injects the severity without a `"warn"` literal in
+ * any file the project owns, so a text scan such as `no-warn-severity` passes it.
+ *
+ * Fails closed: a config that cannot be resolved at all is a violation, never a
+ * silent pass. Needs the optional `eslint` peer.
+ */
+declare function createEslintConfigNoWarnRule(options?: EslintConfigNoWarnOptions): IMetaRule;
+
+export { type EslintConfigNoWarnOptions, createEslintConfigNoWarnRule };

package/dist/resolved-config.d.ts

@@ -0,0 +1,46 @@
+import { IMetaRule } from '@noctcore/harness';
+
+/**
+ * Options for {@link createEslintConfigNoWarnRule}.
+ *
+ * Every path is relative to the repo root the harness runs in.
+ */
+interface EslintConfigNoWarnOptions {
+    /** Rule id, for running more than one instance. Default `eslint-config-no-warn`. */
+    readonly id?: string;
+    /**
+     * Directories whose ESLint config is resolved, as globs (`apps/*`) or plain
+     * paths (`.` for the repo root). A match is checked only when it holds one of
+     * `configFiles`. Default `['.', 'apps/*', 'packages/*']`.
+     */
+    readonly packages?: readonly string[];
+    /**
+     * The file names that mark a directory as owning a flat config. Default
+     * `eslint.config.js`, `eslint.config.mjs`, `eslint.config.cjs`.
+     */
+    readonly configFiles?: readonly string[];
+    /**
+     * Files, relative to each package, the config is resolved FOR. Resolution is
+     * glob matching, so they need not exist; pick one per file shape the config
+     * scopes blocks to. Default: a `.ts`, `.tsx`, `.test.ts` and `.test.tsx` file
+     * under `src/`.
+     */
+    readonly probes?: readonly string[];
+    /** Whether a violation fails CI. Default `true`. */
+    readonly ciCritical?: boolean;
+}
+/**
+ * ESLint severities must be `error` or `off`, never `warn`, as RESOLVED.
+ *
+ * Resolves each package's effective flat config through ESLint's
+ * `calculateConfigForFile` and reports every rule that ends up at `warn`. That is
+ * the point of the rule: a preset spread into the config (a `recommended` block
+ * that ships rules at `warn`) injects the severity without a `"warn"` literal in
+ * any file the project owns, so a text scan such as `no-warn-severity` passes it.
+ *
+ * Fails closed: a config that cannot be resolved at all is a violation, never a
+ * silent pass. Needs the optional `eslint` peer.
+ */
+declare function createEslintConfigNoWarnRule(options?: EslintConfigNoWarnOptions): IMetaRule;
+
+export { type EslintConfigNoWarnOptions, createEslintConfigNoWarnRule };

package/dist/resolved-config.js

@@ -0,0 +1,75 @@
+import {
+  resolveRules,
+  severityOf
+} from "./chunk-VFCX3QKZ.js";
+
+// src/resolved-config/eslint-config-no-warn.ts
+var DEFAULT_ID = "eslint-config-no-warn";
+var DEFAULT_PACKAGES = [".", "apps/*", "packages/*"];
+var DEFAULT_CONFIG_FILES = ["eslint.config.js", "eslint.config.mjs", "eslint.config.cjs"];
+var DEFAULT_PROBES = [
+  "src/__lint_meta_probe__.ts",
+  "src/__lint_meta_probe__.tsx",
+  "src/__lint_meta_probe__.test.ts",
+  "src/__lint_meta_probe__.test.tsx"
+];
+function findConfigDirs(ctx, packages, configFiles) {
+  const byDir = /* @__PURE__ */ new Map();
+  for (const pattern of packages) {
+    const base = pattern.replace(/\/+$/u, "");
+    for (const name of configFiles) {
+      const matches = base === "." || base === "" ? ctx.exists(name) ? [name] : [] : ctx.glob(`${base}/${name}`);
+      for (const configFile of matches) {
+        const slash = configFile.lastIndexOf("/");
+        const dir = slash === -1 ? "." : configFile.slice(0, slash);
+        if (!byDir.has(dir)) byDir.set(dir, configFile);
+      }
+    }
+  }
+  return [...byDir].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([dir, configFile]) => ({ dir, configFile }));
+}
+function createEslintConfigNoWarnRule(options = {}) {
+  const id = options.id ?? DEFAULT_ID;
+  const packages = options.packages ?? DEFAULT_PACKAGES;
+  const configFiles = options.configFiles ?? DEFAULT_CONFIG_FILES;
+  const probes = options.probes ?? DEFAULT_PROBES;
+  return {
+    id,
+    category: "config",
+    ciCritical: options.ciCritical ?? true,
+    description: 'Every rule in the RESOLVED ESLint config is "error" or "off", never "warn", including severities a spread preset injects.',
+    async runAsync(ctx) {
+      const results = await Promise.all(
+        findConfigDirs(ctx, packages, configFiles).map(async ({ dir, configFile }) => {
+          const outcome = await resolveRules(ctx.root, dir, probes);
+          if (!outcome.ok) {
+            return [
+              {
+                file: configFile,
+                rule: id,
+                message: `Could not resolve the effective ESLint config for "${dir}", so its severities cannot be checked (if it imports a workspace package, build that first): ${outcome.error}`
+              }
+            ];
+          }
+          const warned = /* @__PURE__ */ new Set();
+          for (const rules of outcome.rules) {
+            for (const [ruleId, entry] of Object.entries(rules)) {
+              if (severityOf(entry) === 1) warned.add(ruleId);
+            }
+          }
+          return [...warned].sort().map(
+            (ruleId) => ({
+              file: configFile,
+              rule: id,
+              message: `Rule "${ruleId}" resolves to "warn" in "${dir}". ESLint severities must be "error" or "off", never "warn" (this is the RESOLVED severity, so it may come from a spread preset rather than a literal in the config file). Override it explicitly.`
+            })
+          );
+        })
+      );
+      return results.flat();
+    }
+  };
+}
+export {
+  createEslintConfigNoWarnRule
+};