@pyreon/lint 0.11.0

package/src/rules/reactivity/no-unbatched-updates.ts

@@ -0,0 +1,77 @@
+import type { Rule, VisitorCallbacks } from "../../types"
+import { getSpan, isCallTo, isSetCall } from "../../utils/ast"
+
+interface ScopeInfo {
+  setCalls: Array<{ span: { start: number; end: number } }>
+  hasBatch: boolean
+  insideBatch: boolean
+  node: any
+}
+
+export const noUnbatchedUpdates: Rule = {
+  meta: {
+    id: "pyreon/no-unbatched-updates",
+    category: "reactivity",
+    description: "Warn when 3+ .set() calls occur in the same function without batch().",
+    severity: "warn",
+    fixable: false,
+  },
+  create(context) {
+    const scopeStack: ScopeInfo[] = []
+    let batchDepth = 0
+
+    function enterScope(node: any) {
+      scopeStack.push({ setCalls: [], hasBatch: false, insideBatch: batchDepth > 0, node })
+    }
+
+    function exitScope() {
+      const scope = scopeStack.pop()
+      if (!scope) return
+      if (!scope.hasBatch && !scope.insideBatch && scope.setCalls.length >= 3) {
+        context.report({
+          message: `${scope.setCalls.length} signal \`.set()\` calls without \`batch()\` — wrap in \`batch(() => { ... })\` to avoid unnecessary re-renders.`,
+          span: getSpan(scope.node),
+        })
+      }
+    }
+
+    const callbacks: VisitorCallbacks = {
+      FunctionDeclaration(node: any) {
+        enterScope(node)
+      },
+      "FunctionDeclaration:exit"() {
+        exitScope()
+      },
+      FunctionExpression(node: any) {
+        enterScope(node)
+      },
+      "FunctionExpression:exit"() {
+        exitScope()
+      },
+      ArrowFunctionExpression(node: any) {
+        enterScope(node)
+      },
+      "ArrowFunctionExpression:exit"() {
+        exitScope()
+      },
+      CallExpression(node: any) {
+        const currentScope = scopeStack.length > 0 ? scopeStack[scopeStack.length - 1] : undefined
+        if (isCallTo(node, "batch")) {
+          batchDepth++
+          if (currentScope) {
+            currentScope.hasBatch = true
+          }
+        }
+        if (currentScope && isSetCall(node)) {
+          currentScope.setCalls.push({ span: getSpan(node) })
+        }
+      },
+      "CallExpression:exit"(node: any) {
+        if (isCallTo(node, "batch")) {
+          batchDepth--
+        }
+      },
+    }
+    return callbacks
+  },
+}

package/src/rules/reactivity/prefer-computed.ts

@@ -0,0 +1,56 @@
+import type { Rule, VisitorCallbacks } from "../../types"
+import { getSpan, isCallTo, isSetCall } from "../../utils/ast"
+
+export const preferComputed: Rule = {
+  meta: {
+    id: "pyreon/prefer-computed",
+    category: "reactivity",
+    description: "Suggest computed() when an effect only contains a single .set() call.",
+    severity: "warn",
+    fixable: false,
+  },
+  create(context) {
+    const callbacks: VisitorCallbacks = {
+      CallExpression(node: any) {
+        if (!isCallTo(node, "effect")) return
+        const args = node.arguments
+        if (!args || args.length === 0) return
+
+        const fn = args[0]
+        if (!fn) return
+
+        let body: any = null
+        if (fn.type === "ArrowFunctionExpression" || fn.type === "FunctionExpression") {
+          body = fn.body
+        }
+        if (!body) return
+
+        // Arrow with expression body: effect(() => x.set(y))
+        if (body.type === "CallExpression" && isSetCall(body)) {
+          context.report({
+            message:
+              "Effect contains a single `.set()` — consider using `computed()` instead for derived values.",
+            span: getSpan(node),
+          })
+          return
+        }
+
+        // Block body with single statement: effect(() => { x.set(y) })
+        if (body.type === "BlockStatement") {
+          const stmts = body.body
+          if (stmts && stmts.length === 1) {
+            const stmt = stmts[0]
+            if (stmt.type === "ExpressionStatement" && isSetCall(stmt.expression)) {
+              context.report({
+                message:
+                  "Effect contains a single `.set()` — consider using `computed()` instead for derived values.",
+                span: getSpan(node),
+              })
+            }
+          }
+        }
+      },
+    }
+    return callbacks
+  },
+}

package/src/rules/router/index.ts

@@ -0,0 +1,4 @@
+export { noHrefNavigation } from "./no-href-navigation"
+export { noImperativeNavigateInRender } from "./no-imperative-navigate-in-render"
+export { noMissingFallback } from "./no-missing-fallback"
+export { preferUseIsActive } from "./prefer-use-is-active"

package/src/rules/router/no-href-navigation.ts

@@ -0,0 +1,51 @@
+import type { Rule, VisitorCallbacks } from "../../types"
+import { getJSXAttribute, getSpan } from "../../utils/ast"
+import { extractImportInfo } from "../../utils/imports"
+
+const EXTERNAL_PREFIXES = ["http://", "https://", "mailto:", "tel:"]
+
+export const noHrefNavigation: Rule = {
+  meta: {
+    id: "pyreon/no-href-navigation",
+    category: "router",
+    description:
+      "Warn when `<a href>` is used in files that import @pyreon/router — use `<Link>` instead.",
+    severity: "warn",
+    fixable: false,
+  },
+  create(context) {
+    let importsRouter = false
+
+    const callbacks: VisitorCallbacks = {
+      ImportDeclaration(node: any) {
+        const info = extractImportInfo(node)
+        if (info && info.source === "@pyreon/router") {
+          importsRouter = true
+        }
+      },
+      JSXOpeningElement(node: any) {
+        if (!importsRouter) return
+        const name = node.name
+        if (!name || name.type !== "JSXIdentifier" || name.name !== "a") return
+
+        const hrefAttr = getJSXAttribute(node, "href")
+        if (!hrefAttr) return
+
+        // Get the href value
+        const value = hrefAttr.value
+        if (value?.type === "Literal" && typeof value.value === "string") {
+          const href: string = value.value
+          // Skip external URLs and anchor links
+          if (href.startsWith("#") || EXTERNAL_PREFIXES.some((p) => href.startsWith(p))) return
+        }
+
+        context.report({
+          message:
+            "`<a href>` in a router file — use `<Link>` or `<RouterLink>` for client-side navigation.",
+          span: getSpan(node),
+        })
+      },
+    }
+    return callbacks
+  },
+}

package/src/rules/router/no-imperative-navigate-in-render.ts

@@ -0,0 +1,83 @@
+import type { Rule, VisitorCallbacks } from "../../types"
+import { getSpan, isCallTo, isMemberCallTo } from "../../utils/ast"
+
+export const noImperativeNavigateInRender: Rule = {
+  meta: {
+    id: "pyreon/no-imperative-navigate-in-render",
+    category: "router",
+    description:
+      "Error when navigate() or router.push() is called at the top level of a component — causes infinite render loops.",
+    severity: "error",
+    fixable: false,
+  },
+  create(context) {
+    // Track depth of component functions and safe callback wrappers
+    // We detect components via VariableDeclarator with PascalCase name + ArrowFunctionExpression init,
+    // or FunctionDeclaration with PascalCase name.
+    // "Safe" = onMount/effect/onUnmount callbacks or JSX event handlers.
+    let componentBodyDepth = 0
+    let safeDepth = 0
+
+    const callbacks: VisitorCallbacks = {
+      FunctionDeclaration(node: any) {
+        const name: string = node.id?.name ?? ""
+        if (/^[A-Z]/.test(name)) {
+          componentBodyDepth++
+        }
+      },
+      "FunctionDeclaration:exit"(node: any) {
+        const name: string = node.id?.name ?? ""
+        if (/^[A-Z]/.test(name)) {
+          componentBodyDepth--
+        }
+      },
+      // For arrow functions, we use VariableDeclarator to detect component assignment
+      VariableDeclarator(node: any) {
+        const name: string = node.id?.name ?? ""
+        if (/^[A-Z]/.test(name) && node.init?.type === "ArrowFunctionExpression") {
+          componentBodyDepth++
+        }
+      },
+      "VariableDeclarator:exit"(node: any) {
+        const name: string = node.id?.name ?? ""
+        if (/^[A-Z]/.test(name) && node.init?.type === "ArrowFunctionExpression") {
+          componentBodyDepth--
+        }
+      },
+      // Track safe callback boundaries: onMount(() => ...), effect(() => ...), etc.
+      CallExpression(node: any) {
+        if (componentBodyDepth <= 0) return
+
+        // Check if this is a safe wrapper entering
+        if (isSafeWrapperCall(node)) {
+          safeDepth++
+        }
+
+        // Only report if we're in a component body and NOT inside a safe callback
+        if (safeDepth > 0) return
+
+        if (isCallTo(node, "navigate") || isMemberCallTo(node, "router", "push")) {
+          context.report({
+            message:
+              "Imperative navigation at the top level of a component — this runs on every render and causes infinite loops. Move inside `onMount`, `effect`, or an event handler.",
+            span: getSpan(node),
+          })
+        }
+      },
+      "CallExpression:exit"(node: any) {
+        if (componentBodyDepth <= 0) return
+        if (isSafeWrapperCall(node)) {
+          safeDepth--
+        }
+      },
+    }
+    return callbacks
+  },
+}
+
+function isSafeWrapperCall(node: any): boolean {
+  const callee = node.callee
+  if (!callee || callee.type !== "Identifier") return false
+  const name: string = callee.name
+  return name === "onMount" || name === "effect" || name === "onUnmount"
+}

package/src/rules/router/no-missing-fallback.ts

@@ -0,0 +1,87 @@
+import type { Rule, VisitorCallbacks } from "../../types"
+import { getSpan } from "../../utils/ast"
+import { extractImportInfo } from "../../utils/imports"
+
+function isCatchAllPath(value: string): boolean {
+  return value === "*" || value.endsWith("*")
+}
+
+function getPathValue(prop: any): string | null {
+  const key = prop.key
+  if (!key) return null
+  const keyName = key.type === "Identifier" ? key.name : null
+  if (keyName !== "path") return null
+  const val = prop.value
+  if (val?.type === "Literal" && typeof val.value === "string") {
+    return val.value
+  }
+  return null
+}
+
+function hasPathProperty(obj: any): boolean {
+  if (!obj || obj.type !== "ObjectExpression") return false
+  for (const prop of obj.properties ?? []) {
+    if (prop.type !== "Property") continue
+    if (getPathValue(prop) !== null) return true
+  }
+  return false
+}
+
+function hasCatchAllRoute(elements: any[]): boolean {
+  for (const elem of elements) {
+    if (!elem || elem.type !== "ObjectExpression") continue
+    for (const prop of elem.properties ?? []) {
+      if (prop.type !== "Property") continue
+      const pathVal = getPathValue(prop)
+      if (pathVal !== null && isCatchAllPath(pathVal)) return true
+    }
+  }
+  return false
+}
+
+export const noMissingFallback: Rule = {
+  meta: {
+    id: "pyreon/no-missing-fallback",
+    category: "router",
+    description:
+      'Warn when route config has no catch-all route (`path: "*"` or `path: "/:rest*"`).',
+    severity: "warn",
+    fixable: false,
+  },
+  create(context) {
+    let importsRouter = false
+    let routeArraySpan: { start: number; end: number } | null = null
+    let foundCatchAll = false
+
+    const callbacks: VisitorCallbacks = {
+      ImportDeclaration(node: any) {
+        const info = extractImportInfo(node)
+        if (info && info.source === "@pyreon/router") {
+          importsRouter = true
+        }
+      },
+      ArrayExpression(node: any) {
+        if (!importsRouter) return
+        const elements = node.elements ?? []
+        const isRouteArray = elements.some((e: any) => hasPathProperty(e))
+        if (!isRouteArray) return
+
+        if (!routeArraySpan) {
+          routeArraySpan = getSpan(node)
+        }
+        if (hasCatchAllRoute(elements)) {
+          foundCatchAll = true
+        }
+      },
+      "Program:exit"() {
+        if (!importsRouter || !routeArraySpan || foundCatchAll) return
+        context.report({
+          message:
+            'Route config has no catch-all route — add a `{ path: "*", component: NotFound }` for unmatched URLs.',
+          span: routeArraySpan,
+        })
+      },
+    }
+    return callbacks
+  },
+}

package/src/rules/router/prefer-use-is-active.ts

@@ -0,0 +1,45 @@
+import type { Rule, VisitorCallbacks } from "../../types"
+import { getSpan } from "../../utils/ast"
+
+export const preferUseIsActive: Rule = {
+  meta: {
+    id: "pyreon/prefer-use-is-active",
+    category: "router",
+    description:
+      'Suggest useIsActive() instead of `location.pathname === "/foo"` or `route.path === "/foo"` patterns.',
+    severity: "info",
+    fixable: false,
+  },
+  create(context) {
+    const callbacks: VisitorCallbacks = {
+      BinaryExpression(node: any) {
+        if (node.operator !== "===" && node.operator !== "==") return
+
+        // Check both sides for location.pathname or route.path
+        if (isPathComparison(node.left) || isPathComparison(node.right)) {
+          context.report({
+            message:
+              "Manual path comparison — use `useIsActive()` for reactive route matching with segment-aware prefix matching.",
+            span: getSpan(node),
+          })
+        }
+      },
+    }
+    return callbacks
+  },
+}
+
+function isPathComparison(node: any): boolean {
+  if (!node || node.type !== "MemberExpression") return false
+  const obj = node.object
+  const prop = node.property
+  if (!obj || !prop || prop.type !== "Identifier") return false
+
+  // location.pathname
+  if (obj.type === "Identifier" && obj.name === "location" && prop.name === "pathname") return true
+
+  // route.path
+  if (obj.type === "Identifier" && obj.name === "route" && prop.name === "path") return true
+
+  return false
+}

package/src/rules/ssr/no-mismatch-risk.ts

@@ -0,0 +1,47 @@
+import type { Rule, VisitorCallbacks } from "../../types"
+import { getSpan, isMemberCallTo } from "../../utils/ast"
+
+export const noMismatchRisk: Rule = {
+  meta: {
+    id: "pyreon/no-mismatch-risk",
+    category: "ssr",
+    description:
+      "Warn about non-deterministic calls (Date.now, Math.random, crypto.randomUUID) in JSX context that cause hydration mismatches.",
+    severity: "warn",
+    fixable: false,
+  },
+  create(context) {
+    let jsxDepth = 0
+    const callbacks: VisitorCallbacks = {
+      JSXElement() {
+        jsxDepth++
+      },
+      "JSXElement:exit"() {
+        jsxDepth--
+      },
+      JSXFragment() {
+        jsxDepth++
+      },
+      "JSXFragment:exit"() {
+        jsxDepth--
+      },
+      CallExpression(node: any) {
+        if (jsxDepth === 0) return
+
+        if (
+          isMemberCallTo(node, "Date", "now") ||
+          isMemberCallTo(node, "Math", "random") ||
+          isMemberCallTo(node, "crypto", "randomUUID")
+        ) {
+          const callee = node.callee
+          const name = `${callee.object.name}.${callee.property.name}`
+          context.report({
+            message: `\`${name}()\` in JSX context — this produces different values on server and client, causing hydration mismatches.`,
+            span: getSpan(node),
+          })
+        }
+      },
+    }
+    return callbacks
+  },
+}

package/src/rules/ssr/no-window-in-ssr.ts

@@ -0,0 +1,76 @@
+import type { Rule, VisitorCallbacks } from "../../types"
+import { getSpan, isCallTo } from "../../utils/ast"
+import { BROWSER_GLOBALS } from "../../utils/imports"
+
+export const noWindowInSsr: Rule = {
+  meta: {
+    id: "pyreon/no-window-in-ssr",
+    category: "ssr",
+    description: "Disallow browser globals outside onMount/effect/typeof guards — they break SSR.",
+    severity: "error",
+    fixable: false,
+  },
+  create(context) {
+    let safeDepth = 0
+    let typeofGuardDepth = 0
+
+    const callbacks: VisitorCallbacks = {
+      CallExpression(node: any) {
+        if (isCallTo(node, "onMount") || isCallTo(node, "effect")) {
+          safeDepth++
+        }
+      },
+      "CallExpression:exit"(node: any) {
+        if (isCallTo(node, "onMount") || isCallTo(node, "effect")) {
+          safeDepth--
+        }
+      },
+      IfStatement(node: any) {
+        // typeof window !== "undefined"
+        const test = node.test
+        if (
+          test?.type === "BinaryExpression" &&
+          test.left?.type === "UnaryExpression" &&
+          test.left.operator === "typeof"
+        ) {
+          typeofGuardDepth++
+        }
+      },
+      "IfStatement:exit"(node: any) {
+        const test = node.test
+        if (
+          test?.type === "BinaryExpression" &&
+          test.left?.type === "UnaryExpression" &&
+          test.left.operator === "typeof"
+        ) {
+          typeofGuardDepth--
+        }
+      },
+      Identifier(node: any, parent: any) {
+        if (safeDepth > 0 || typeofGuardDepth > 0) return
+        if (!BROWSER_GLOBALS.has(node.name)) return
+
+        // Skip typeof expressions: typeof window
+        if (parent?.type === "UnaryExpression" && parent.operator === "typeof") return
+
+        // Skip import specifiers
+        if (
+          parent?.type === "ImportSpecifier" ||
+          parent?.type === "ImportDefaultSpecifier" ||
+          parent?.type === "ImportNamespaceSpecifier"
+        )
+          return
+
+        // Skip property access on member expressions (only flag when used as the object)
+        if (parent?.type === "MemberExpression" && parent.property === node && !parent.computed)
+          return
+
+        context.report({
+          message: `Browser global \`${node.name}\` used outside \`onMount\`/\`effect\`/typeof guard — this will fail during SSR. Wrap in \`onMount(() => { ... })\`.`,
+          span: getSpan(node),
+        })
+      },
+    }
+    return callbacks
+  },
+}

package/src/rules/ssr/prefer-request-context.ts

@@ -0,0 +1,56 @@
+import type { Rule, VisitorCallbacks } from "../../types"
+import { getSpan, isCallTo } from "../../utils/ast"
+
+export const preferRequestContext: Rule = {
+  meta: {
+    id: "pyreon/prefer-request-context",
+    category: "ssr",
+    description:
+      "Warn about module-level signal()/createStore() in server files — use request context instead.",
+    severity: "warn",
+    fixable: false,
+  },
+  create(context) {
+    const filePath = context.getFilePath()
+    const isServerFile =
+      filePath.includes("server") ||
+      filePath.includes(".server.") ||
+      filePath.endsWith("server.ts") ||
+      filePath.endsWith("server.tsx")
+
+    if (!isServerFile) return {}
+
+    let functionDepth = 0
+    const callbacks: VisitorCallbacks = {
+      FunctionDeclaration() {
+        functionDepth++
+      },
+      "FunctionDeclaration:exit"() {
+        functionDepth--
+      },
+      FunctionExpression() {
+        functionDepth++
+      },
+      "FunctionExpression:exit"() {
+        functionDepth--
+      },
+      ArrowFunctionExpression() {
+        functionDepth++
+      },
+      "ArrowFunctionExpression:exit"() {
+        functionDepth--
+      },
+      CallExpression(node: any) {
+        if (functionDepth > 0) return // only flag module-level calls
+        if (isCallTo(node, "signal") || isCallTo(node, "createStore")) {
+          const name = node.callee.name
+          context.report({
+            message: `Module-level \`${name}()\` in a server file — this state is shared across all requests. Use \`runWithRequestContext()\` for per-request isolation.`,
+            span: getSpan(node),
+          })
+        }
+      },
+    }
+    return callbacks
+  },
+}

package/src/rules/store/no-duplicate-store-id.ts

@@ -0,0 +1,43 @@
+import type { Rule, VisitorCallbacks } from "../../types"
+import { getSpan, isCallTo } from "../../utils/ast"
+
+export const noDuplicateStoreId: Rule = {
+  meta: {
+    id: "pyreon/no-duplicate-store-id",
+    category: "store",
+    description: "Disallow duplicate defineStore() IDs in the same file.",
+    severity: "error",
+    fixable: false,
+  },
+  create(context) {
+    const storeIds = new Map<string, { start: number; end: number }>()
+
+    const callbacks: VisitorCallbacks = {
+      CallExpression(node: any) {
+        if (!isCallTo(node, "defineStore")) return
+        const args = node.arguments
+        if (!args || args.length === 0) return
+
+        const firstArg = args[0]
+        if (!firstArg) return
+
+        let id: string | null = null
+        if (firstArg.type === "Literal" || firstArg.type === "StringLiteral") {
+          id = firstArg.value as string
+        }
+
+        if (typeof id !== "string") return
+
+        if (storeIds.has(id)) {
+          context.report({
+            message: `Duplicate store ID \`"${id}"\` — each \`defineStore()\` must have a unique ID.`,
+            span: getSpan(node),
+          })
+        } else {
+          storeIds.set(id, getSpan(node))
+        }
+      },
+    }
+    return callbacks
+  },
+}

package/src/rules/store/no-mutate-store-state.ts

@@ -0,0 +1,37 @@
+import type { Rule, VisitorCallbacks } from "../../types"
+import { getSpan } from "../../utils/ast"
+
+export const noMutateStoreState: Rule = {
+  meta: {
+    id: "pyreon/no-mutate-store-state",
+    category: "store",
+    description: "Warn when directly calling .set() on store signals — use store actions instead.",
+    severity: "warn",
+    fixable: false,
+  },
+  create(context) {
+    const callbacks: VisitorCallbacks = {
+      CallExpression(node: any) {
+        const callee = node.callee
+        if (!callee || callee.type !== "MemberExpression") return
+        if (callee.property?.type !== "Identifier" || callee.property.name !== "set") return
+
+        // Check for store.signal.set() pattern — member.member.set()
+        const obj = callee.object
+        if (!obj || obj.type !== "MemberExpression") return
+        const outerObj = obj.object
+        if (!outerObj || outerObj.type !== "Identifier") return
+
+        const name: string = outerObj.name
+        // Heuristic: if the outer object name contains "store" (case-insensitive)
+        if (name.toLowerCase().includes("store")) {
+          context.report({
+            message: `Direct \`.set()\` on store state \`${name}\` — use store actions to mutate state for better traceability.`,
+            span: getSpan(node),
+          })
+        }
+      },
+    }
+    return callbacks
+  },
+}