@pyreon/lint 0.14.0 → 0.15.0

package/lib/cli.js

@@ -527,9 +527,34 @@ const devGuardWarnings = {
 			}
 			return false;
 		}
+		function isProcessEnvNodeEnv(node) {
+			let n = node;
+			if (n?.type === "ChainExpression") n = n.expression;
+			if (n?.type !== "MemberExpression") return false;
+			if (n.property?.type !== "Identifier" || n.property.name !== "NODE_ENV") return false;
+			let envObj = n.object;
+			if (envObj?.type === "ChainExpression") envObj = envObj.expression;
+			if (envObj?.type !== "MemberExpression") return false;
+			if (envObj.property?.type !== "Identifier" || envObj.property.name !== "env") return false;
+			const procObj = envObj.object;
+			return procObj?.type === "Identifier" && procObj.name === "process";
+		}
+		function isDevelopmentCheck(node) {
+			if (node?.type !== "BinaryExpression") return false;
+			if (node.operator !== "!==" && node.operator !== "!=") return false;
+			const matches = (a, b) => isProcessEnvNodeEnv(a) && (b?.type === "Literal" || b?.type === "StringLiteral") && b.value === "production";
+			return matches(node.left, node.right) || matches(node.right, node.left);
+		}
+		function isProductionCheck(node) {
+			if (node?.type !== "BinaryExpression") return false;
+			if (node.operator !== "===" && node.operator !== "==") return false;
+			const matches = (a, b) => isProcessEnvNodeEnv(a) && (b?.type === "Literal" || b?.type === "StringLiteral") && b.value === "production";
+			return matches(node.left, node.right) || matches(node.right, node.left);
+		}
 		function containsDevGuard(test) {
 			if (!test) return false;
 			if (isDevFlag(test)) return true;
+			if (isDevelopmentCheck(test)) return true;
 			if (test.type === "LogicalExpression" && test.operator === "&&") return containsDevGuard(test.left) || containsDevGuard(test.right);
 			if (test.type === "BinaryExpression" && (test.operator === "===" || test.operator === "==")) return isDevFlag(test.left) || isDevFlag(test.right);
 			return false;
@@ -537,13 +562,12 @@ const devGuardWarnings = {
 		function isEarlyReturnDevGuard(node) {
 			if (!node || node.type !== "IfStatement") return false;
 			const t = node.test;
+			const c = node.consequent;
+			if (!(c?.type === "ReturnStatement" || c?.type === "BlockStatement" && c.body.length === 1 && c.body[0]?.type === "ReturnStatement")) return false;
+			if (isProductionCheck(t)) return true;
 			const arg = t?.type === "UnaryExpression" && t.operator === "!" ? t.argument : null;
 			if (!arg) return false;
-			if (!isDevFlag(arg)) return false;
-			const c = node.consequent;
-			if (c?.type === "ReturnStatement") return true;
-			if (c?.type === "BlockStatement" && c.body.length === 1 && c.body[0]?.type === "ReturnStatement") return true;
-			return false;
+			return isDevFlag(arg);
 		}
 		let devGuardDepth = 0;
 		let catchDepth = 0;
@@ -803,40 +827,48 @@ const noErrorWithoutPrefix = {
 //#endregion
 //#region src/rules/architecture/no-process-dev-gate.ts
 /**
-* `pyreon/no-process-dev-gate` — flag the broken `typeof process` dev-mode gate
-* pattern that is dead code in real Vite browser bundles.
+* `pyreon/no-process-dev-gate` — flag bundler-coupled dev-gate patterns
+* that are dead code or unsupported in some bundlers Pyreon ships to.
 *
-* The pattern this rule catches:
+* Pyreon publishes libraries to npm. Consumers compile those libraries
+* with whatever bundler they use — Vite, Webpack (Next.js), Rolldown,
+* esbuild, Rollup, Parcel, Bun. The framework should not ship dev gates
+* that only fire in one bundler.
 *
-* ```ts
-* const __DEV__ = typeof process !== 'undefined' && process.env.NODE_ENV !== 'production'
-* ```
+* **Two broken patterns this rule catches:**
+*
+* 1. `typeof process !== 'undefined' && process.env.NODE_ENV !== 'production'`
+*    The `typeof process` guard isn't replaced by Vite, evaluates to
+*    `false` in the browser, and the whole expression is dead. Wrapped
+*    dev warnings never fire for users running Vite browser builds.
 *
-* This works in vitest (Node, `process` is defined) but is **silently dead
-* code in real Vite browser bundles** because Vite does not polyfill
-* `process` for the client. Every dev warning gated on this constant never
-* fires for real users in dev mode.
+* 2. `import.meta.env.DEV` (and the `(import.meta as ViteMeta).env?.DEV`
+*    cast variant). Vite/Rolldown literal-replace this at build time, but
+*    Webpack/esbuild/Rollup/Parcel/Bun/Node-direct don't. In a Pyreon
+*    library shipped to a Next.js (Webpack) app, dev warnings never fire
+*    — even in development. PR #200 introduced this pattern as the
+*    "correct" replacement for the typeof-process compound; that
+*    direction was wrong for library code.
 *
-* The fix is to use `import.meta.env.DEV`, which Vite/Rolldown literal-replace
-* at build time:
+* **The bundler-agnostic standard** (used by React, Vue, Preact, Solid,
+* MobX, Redux):
 *
 * ```ts
-* // No const needed — read directly at the use site so the bundler can fold:
-* if (!import.meta.env?.DEV) return
+* if (process.env.NODE_ENV !== 'production') console.warn('...')
 * ```
 *
-* Vitest sets `import.meta.env.DEV === true` automatically (because it is
-* Vite-based), so existing tests continue to pass.
+* Every modern bundler auto-replaces `process.env.NODE_ENV` at consumer
+* build time. No `typeof process` guard needed — bundlers replace the
+* literal regardless of whether `process` is otherwise defined.
 *
 * Reference implementation: `packages/fundamentals/flow/src/layout.ts:warnIgnoredOptions`.
 *
-* **Auto-fix**: replaces the assignment with `import.meta.env?.DEV === true`.
-* Does NOT delete the const declaration — that has to happen by hand because
-* the variable name and downstream usages may need updating in callers.
+* **Auto-fix**: replaces the broken expression with
+* `process.env.NODE_ENV !== 'production'`.
 *
-* **Server-only exemption**: projects configure `exemptPaths` per-file for
-* server-only code (Node environments where `process` is always defined and
-* the pattern is correct). Configure in `.pyreonlintrc.json`:
+* **Server-only exemption**: projects configure `exemptPaths` per-file
+* for server-only code (Node environments where the typeof-process
+* compound is harmless). Configure in `.pyreonlintrc.json`:
 *
 *     {
 *       "rules": {
@@ -851,25 +883,16 @@ const noProcessDevGate = {
 	meta: {
 		id: "pyreon/no-process-dev-gate",
 		category: "architecture",
-		description: "Forbid `typeof process !== \"undefined\" && process.env.NODE_ENV !== \"production\"` as a dev-mode gate. Use `import.meta.env.DEV` instead — `typeof process` is dead code in real Vite browser bundles because Vite does not polyfill `process` for the client.",
+		description: "Forbid bundler-coupled dev gates: `typeof process !== \"undefined\" && process.env.NODE_ENV !== \"production\"` is dead in Vite browser bundles, and `import.meta.env.DEV` is Vite/Rolldown-only (dead in Webpack/Next.js, esbuild, Rollup, Parcel, Bun). Use bundler-agnostic `process.env.NODE_ENV !== \"production\"` — every modern bundler auto-replaces it at consumer build time.",
 		severity: "error",
 		fixable: true
 	},
 	create(context) {
 		if (isTestFile(context.getFilePath())) return {};
 		if (isPathExempt(context)) return {};
+		const REPLACEMENT = `process.env.NODE_ENV !== 'production'`;
 		/**
-		* Match the broken pattern at the AST level. We're looking for any
-		* `LogicalExpression` whose two sides are:
-		*
-		*   1. `typeof process !== 'undefined'` (a UnaryExpression on the LHS
-		*      of a BinaryExpression with operator `!==`)
-		*   2. `process.env.NODE_ENV !== 'production'` (a MemberExpression on
-		*      the LHS of a BinaryExpression with operator `!==`)
-		*
-		* The order can be either way (process check first or NODE_ENV check
-		* first), and the operator can be `&&` or `||` (we only flag `&&`
-		* because `||` doesn't make sense as a dev gate).
+		* Pattern 1: `typeof process !== 'undefined'`
 		*/
 		function isTypeofProcessCheck(node) {
 			if (node?.type !== "BinaryExpression") return false;
@@ -878,39 +901,116 @@ const noProcessDevGate = {
 			const right = node.right;
 			if (left?.type !== "UnaryExpression" || left.operator !== "typeof") return false;
 			if (left.argument?.type !== "Identifier" || left.argument.name !== "process") return false;
-			if ((right?.type === "Literal" || right?.type === "StringLiteral") && right.value === "undefined") return true;
-			return false;
+			return (right?.type === "Literal" || right?.type === "StringLiteral") && right.value === "undefined";
 		}
+		/**
+		* Pattern 1: `process.env.NODE_ENV !== 'production'` — also matches
+		* optional-chaining variants (`process?.env?.NODE_ENV`,
+		* `process.env?.NODE_ENV`). ESTree wraps optional access in a
+		* `ChainExpression` whose `.expression` is the underlying
+		* `MemberExpression` chain.
+		*/
 		function isNodeEnvCheck(node) {
 			if (node?.type !== "BinaryExpression") return false;
 			if (node.operator !== "!==" && node.operator !== "!=") return false;
-			const left = node.left;
+			let left = node.left;
 			const right = node.right;
+			if (left?.type === "ChainExpression") left = left.expression;
 			if (left?.type !== "MemberExpression") return false;
 			if (left.object?.type !== "MemberExpression") return false;
 			if (left.object.object?.type !== "Identifier" || left.object.object.name !== "process") return false;
 			if (left.object.property?.type !== "Identifier" || left.object.property.name !== "env") return false;
 			if (left.property?.type !== "Identifier" || left.property.name !== "NODE_ENV") return false;
-			if ((right?.type === "Literal" || right?.type === "StringLiteral") && right.value === "production") return true;
-			return false;
+			return (right?.type === "Literal" || right?.type === "StringLiteral") && right.value === "production";
 		}
-		function isBrokenDevGate(node) {
+		/**
+		* Match the typeof-process compound: a `LogicalExpression` whose
+		* sides are a typeof-process check + a NODE_ENV check, in either
+		* order, joined with `&&`.
+		*/
+		function isTypeofCompound(node) {
 			if (node?.type !== "LogicalExpression") return false;
 			if (node.operator !== "&&") return false;
 			return isTypeofProcessCheck(node.left) && isNodeEnvCheck(node.right) || isNodeEnvCheck(node.left) && isTypeofProcessCheck(node.right);
 		}
-		return { LogicalExpression(node) {
-			if (!isBrokenDevGate(node)) return;
-			const span = getSpan(node);
-			context.report({
-				message: "`typeof process !== \"undefined\" && process.env.NODE_ENV !== \"production\"` is dead code in real Vite browser bundles — Vite does not polyfill `process`, so this guard is `false` and any wrapped dev warnings never fire for real users. Use `import.meta.env.DEV` instead, which Vite literal-replaces at build time and tree-shakes correctly in prod. Reference implementation: `packages/fundamentals/flow/src/layout.ts:warnIgnoredOptions`.",
-				span,
-				fix: {
+		/**
+		* Strip layers an `import.meta.env.DEV` access can hide behind:
+		* - `ChainExpression` (optional chaining)
+		* - `TSAsExpression` / `TSTypeAssertion` (`(import.meta as ViteMeta)`)
+		* - `ParenthesizedExpression` (just parens)
+		*/
+		function unwrap(node) {
+			let n = node;
+			while (n) if (n.type === "ChainExpression") n = n.expression;
+			else if (n.type === "TSAsExpression" || n.type === "TSTypeAssertion") n = n.expression;
+			else if (n.type === "ParenthesizedExpression") n = n.expression;
+			else break;
+			return n;
+		}
+		function isImportMeta(node) {
+			const n = unwrap(node);
+			if (n?.type !== "MetaProperty") return false;
+			const meta = n.meta;
+			const prop = n.property;
+			return meta?.type === "Identifier" && meta.name === "import" && prop?.type === "Identifier" && prop.name === "meta";
+		}
+		/**
+		* Pattern 2: `import.meta.env.DEV` access (any optional/cast variant).
+		* Returns the outermost expression node so the autofix replaces the
+		* full `import.meta.env.DEV` access (not just the `.DEV` property).
+		*/
+		function isImportMetaEnvDev(node) {
+			const outer = unwrap(node);
+			if (outer?.type !== "MemberExpression") return false;
+			if (outer.property?.type !== "Identifier" || outer.property.name !== "DEV") return false;
+			const envAccess = unwrap(outer.object);
+			if (envAccess?.type !== "MemberExpression") return false;
+			if (envAccess.property?.type !== "Identifier" || envAccess.property.name !== "env") return false;
+			return isImportMeta(envAccess.object);
+		}
+		const handledNodes = /* @__PURE__ */ new WeakSet();
+		return {
+			LogicalExpression(node) {
+				if (!isTypeofCompound(node)) return;
+				const span = getSpan(node);
+				context.report({
+					message: "`typeof process !== \"undefined\" && process.env.NODE_ENV !== \"production\"` is dead code in real Vite browser bundles — Vite does not polyfill `process`, so the guard is `false` and any wrapped dev warnings never fire. Use the bundler-agnostic `process.env.NODE_ENV !== \"production\"` (no typeof guard) — every modern bundler replaces it at consumer build time. Reference: `packages/fundamentals/flow/src/layout.ts`.",
 					span,
-					replacement: "import.meta.env?.DEV === true"
-				}
-			});
-		} };
+					fix: {
+						span,
+						replacement: REPLACEMENT
+					}
+				});
+			},
+			ChainExpression(node) {
+				if (!isImportMetaEnvDev(node)) return;
+				const inner = unwrap(node);
+				if (inner) handledNodes.add(inner);
+				const span = getSpan(node);
+				context.report({
+					message: "`import.meta.env.DEV` is Vite/Rolldown-specific. In a Pyreon library shipped to consumers using Webpack (Next.js), esbuild, Rollup, Parcel, or Bun, `import.meta.env.DEV` is undefined and dev warnings never fire — even in development. Use bundler-agnostic `process.env.NODE_ENV !== \"production\"` instead. Reference: `packages/fundamentals/flow/src/layout.ts`.",
+					span,
+					fix: {
+						span,
+						replacement: REPLACEMENT
+					}
+				});
+			},
+			MemberExpression(node) {
+				if (handledNodes.has(node)) return;
+				if (!isImportMetaEnvDev(node)) return;
+				if (node.property?.name !== "DEV") return;
+				const span = getSpan(node);
+				context.report({
+					message: "`import.meta.env.DEV` is Vite/Rolldown-specific. In a Pyreon library shipped to consumers using Webpack (Next.js), esbuild, Rollup, Parcel, or Bun, `import.meta.env.DEV` is undefined and dev warnings never fire — even in development. Use bundler-agnostic `process.env.NODE_ENV !== \"production\"` instead. Reference: `packages/fundamentals/flow/src/layout.ts`.",
+					span,
+					fix: {
+						span,
+						replacement: REPLACEMENT
+					}
+				});
+			}
+		};
 	}
 };
 
@@ -1612,20 +1712,51 @@ function getDestructuredNames(pattern) {
 	for (const prop of pattern.properties ?? []) if (prop.type === "ObjectProperty" && prop.key?.type === "Identifier") names.push(prop.key.name);
 	return names;
 }
+/**
+* Names of HOC / factory call expressions whose first-argument render
+* function takes Pyreon component props. Destructuring inside these IS
+* a real reactivity bug — same as destructuring at the component
+* signature directly. Do NOT add this exemption for these.
+*
+* The `callArgFns` exemption is intentionally narrow: it only fires for
+* generic call arguments where the parent call is NOT one of these
+* known component-shaped factories.
+*/
+const COMPONENT_FACTORY_NAMES = new Set([
+	"createComponent",
+	"defineComponent",
+	"lazy",
+	"memo",
+	"observer",
+	"forwardRef",
+	"rocketstyle",
+	"styled",
+	"attrs",
+	"kinetic"
+]);
+function isComponentFactoryCall(call) {
+	if (!call || call.type !== "CallExpression") return false;
+	const callee = call.callee;
+	if (!callee) return false;
+	if (callee.type === "Identifier" && COMPONENT_FACTORY_NAMES.has(callee.name)) return true;
+	return false;
+}
 const noPropsDestructure = {
 	meta: {
 		id: "pyreon/no-props-destructure",
 		category: "jsx",
 		description: "Disallow destructuring props in component functions — breaks reactive prop tracking. Use props.x or splitProps().",
 		severity: "error",
-		fixable: false
+		fixable: false,
+		schema: { exemptPaths: "string[]" }
 	},
 	create(context) {
+		if (isPathExempt(context)) return {};
 		let functionDepth = 0;
-		const callArgFns = /* @__PURE__ */ new WeakSet();
+		const callArgFns = /* @__PURE__ */ new WeakMap();
 		return {
 			CallExpression(node) {
-				for (const arg of node.arguments ?? []) if (arg?.type === "ArrowFunctionExpression" || arg?.type === "FunctionExpression" || arg?.type === "FunctionDeclaration") callArgFns.add(arg);
+				for (const arg of node.arguments ?? []) if (arg?.type === "ArrowFunctionExpression" || arg?.type === "FunctionExpression" || arg?.type === "FunctionDeclaration") callArgFns.set(arg, node);
 			},
 			ArrowFunctionExpression(node) {
 				functionDepth++;
@@ -1657,7 +1788,8 @@ function checkFunction(node, context, depth, callArgFns) {
 	const firstParam = params[0];
 	if (!isDestructuring(firstParam)) return;
 	if (depth > 1) return;
-	if (callArgFns.has(node)) return;
+	const parentCall = callArgFns.get(node);
+	if (parentCall && !isComponentFactoryCall(parentCall)) return;
 	const body = node.body;
 	if (!body) return;
 	if (containsJSXReturn(body)) {
@@ -1836,6 +1968,228 @@ const noEffectInMount = {
 	}
 };
 
+//#endregion
+//#region src/rules/lifecycle/no-imperative-effect-on-create.ts
+/**
+* Imperative APIs whose presence inside an `effect(() => { ... })`
+* callback signals that the effect is doing setup work that belongs
+* in `onMount` — not reactive signal tracking. Calls to these inside
+* an effect at component body level cause the work to run
+* synchronously during component setup, which is the bug shape #268
+* surfaced (per-instance effect allocation under load).
+*
+* The list is intentionally narrow: each entry is a pattern that
+* cannot be a pure reactive read. `fetch(...)` triggers IO,
+* `setTimeout(fn)` schedules a deferred callback, `addEventListener`
+* mutates a global. None of these track signals; using `effect()` to
+* run them per-instance is the bug.
+*
+* Do NOT add: signal reads (`.value`, `()`), `console.log`, `Math.X`,
+* `JSON.X` — those are the legitimate reactive-tracking uses of
+* `effect()`.
+*/
+const IMPERATIVE_GLOBAL_CALLS = new Set([
+	"fetch",
+	"setTimeout",
+	"setInterval",
+	"requestAnimationFrame",
+	"requestIdleCallback",
+	"queueMicrotask"
+]);
+const IMPERATIVE_MEMBER_METHODS = new Set([
+	"addEventListener",
+	"removeEventListener",
+	"querySelector",
+	"querySelectorAll",
+	"getElementById",
+	"getElementsByClassName",
+	"getElementsByTagName",
+	"getBoundingClientRect",
+	"getComputedStyle",
+	"focus",
+	"blur",
+	"scrollIntoView",
+	"scrollTo",
+	"scrollBy",
+	"requestFullscreen",
+	"play",
+	"pause"
+]);
+const IMPERATIVE_BROWSER_OBJECTS = new Set([
+	"document",
+	"window",
+	"navigator",
+	"localStorage",
+	"sessionStorage"
+]);
+/**
+* Constructor names whose presence inside an `effect()` body signals
+* imperative API setup (observers, workers, network sockets) that
+* should run from `onMount` — not synchronously per-instance at
+* component setup time. Observer registration and socket allocation
+* are unambiguously imperative and never tracked as reactive reads.
+*/
+const IMPERATIVE_CONSTRUCTORS = new Set([
+	"IntersectionObserver",
+	"ResizeObserver",
+	"MutationObserver",
+	"PerformanceObserver",
+	"Worker",
+	"SharedWorker",
+	"WebSocket",
+	"EventSource",
+	"BroadcastChannel"
+]);
+/**
+* Returns true when `node` is an immediately-invoked function
+* expression — i.e. a `CallExpression` whose callee is a function
+* literal: `(() => { ... })()` or `(function () { ... })()`. The body
+* runs synchronously at the call site, so for our purposes it should
+* be walked even though it's structurally a "nested function".
+*
+* Parenthesized callees (`(arrow)()`) come through as
+* `ParenthesizedExpression` wrapping the function — unwrap one level.
+*/
+function isIIFE(node) {
+	if (!node || node.type !== "CallExpression") return false;
+	let callee = node.callee;
+	if (callee?.type === "ParenthesizedExpression") callee = callee.expression;
+	return callee?.type === "ArrowFunctionExpression" || callee?.type === "FunctionExpression";
+}
+/**
+* Walk the effect callback body and look for imperative patterns.
+* Returns the first matching node + a short label describing what was
+* found, or null when the body is pure reactive tracking.
+*
+* Stops at nested function boundaries — code inside a nested function
+* (e.g. an event handler the effect attaches) is deferred-execution
+* and doesn't run synchronously at effect setup. The exception is
+* IIFE callees: those run at the call site, so we descend into them.
+*/
+function findImperativePattern(node, insideIIFE = false) {
+	if (!node || typeof node !== "object") return null;
+	if (!insideIIFE && (node.type === "FunctionExpression" || node.type === "FunctionDeclaration" || node.type === "ArrowFunctionExpression")) return null;
+	if (node.type === "AwaitExpression") return {
+		node,
+		label: "`await` (async work)"
+	};
+	if (node.type === "NewExpression") {
+		const callee = node.callee;
+		if (callee?.type === "Identifier" && IMPERATIVE_CONSTRUCTORS.has(callee.name)) return {
+			node,
+			label: `\`new ${callee.name}(...)\``
+		};
+	}
+	if (node.type === "CallExpression") {
+		const callee = node.callee;
+		if (callee?.type === "Identifier" && IMPERATIVE_GLOBAL_CALLS.has(callee.name)) return {
+			node,
+			label: `\`${callee.name}(...)\``
+		};
+		if (callee?.type === "MemberExpression" && callee.property?.type === "Identifier") {
+			const method = callee.property.name;
+			if (IMPERATIVE_MEMBER_METHODS.has(method)) return {
+				node,
+				label: `\`.${method}(...)\``
+			};
+			if (method === "then" || method === "catch" || method === "finally") return {
+				node,
+				label: `\`.${method}(...)\` (Promise chain)`
+			};
+			const obj = callee.object;
+			if (obj?.type === "Identifier" && IMPERATIVE_BROWSER_OBJECTS.has(obj.name)) return {
+				node,
+				label: `\`${obj.name}.${method}(...)\``
+			};
+		}
+		if (isIIFE(node)) {
+			let calleeFn = callee;
+			if (calleeFn?.type === "ParenthesizedExpression") calleeFn = calleeFn.expression;
+			const body = calleeFn?.body;
+			if (body) {
+				const found = findImperativePattern(body, true);
+				if (found) return found;
+			}
+		}
+	}
+	if (node.type === "MemberExpression" && node.object?.type === "Identifier" && IMPERATIVE_BROWSER_OBJECTS.has(node.object.name) && node.property?.type === "Identifier") return {
+		node,
+		label: `\`${node.object.name}.${node.property.name}\``
+	};
+	for (const key in node) {
+		if (key === "parent" || key === "loc" || key === "range" || key === "type") continue;
+		const value = node[key];
+		if (Array.isArray(value)) for (const child of value) {
+			const found = findImperativePattern(child, false);
+			if (found) return found;
+		}
+		else if (value && typeof value === "object") {
+			const found = findImperativePattern(value, false);
+			if (found) return found;
+		}
+	}
+	return null;
+}
+/**
+* Safe wrapper names — `effect()` calls inside these don't fire
+* synchronously at component setup, so imperative work in their
+* callbacks is fine.
+*
+* `onMount` / `onUnmount` / `onCleanup` — explicit lifecycle hooks.
+* `renderEffect` — runs after mount, similar lifecycle.
+*
+* `effect` is intentionally NOT in this set — the rule's whole purpose
+* is to walk an effect's body. A nested effect inside another effect
+* is a separate problem (`no-nested-effect`), not this rule's concern.
+*/
+const SAFE_WRAPPER_NAMES = new Set([
+	"onMount",
+	"onUnmount",
+	"onCleanup",
+	"renderEffect"
+]);
+const noImperativeEffectOnCreate = {
+	meta: {
+		id: "pyreon/no-imperative-effect-on-create",
+		category: "lifecycle",
+		description: "Flag `effect()` calls at component body level whose callback does imperative work (DOM access, async/IO, addEventListener, setTimeout) — that work belongs in `onMount`, not in a per-instance reactive effect.",
+		severity: "warn",
+		fixable: false,
+		schema: { exemptPaths: "string[]" }
+	},
+	create(context) {
+		if (isPathExempt(context)) return {};
+		let safeWrapperDepth = 0;
+		return {
+			CallExpression(node) {
+				const callee = node.callee;
+				if (callee?.type === "Identifier") {
+					if (SAFE_WRAPPER_NAMES.has(callee.name)) safeWrapperDepth++;
+				}
+				if (safeWrapperDepth > 0) return;
+				if (!isCallTo(node, "effect")) return;
+				const args = node.arguments;
+				if (!args || args.length === 0) return;
+				const fn = args[0];
+				if (!fn) return;
+				let body = null;
+				if (fn.type === "ArrowFunctionExpression" || fn.type === "FunctionExpression") body = fn.body;
+				if (!body) return;
+				const found = findImperativePattern(body);
+				if (!found) return;
+				context.report({
+					message: `\`effect()\` at component body level contains ${found.label} — imperative work belongs in \`onMount\`. Pyreon's \`effect()\` runs synchronously per instance during component setup; per-instance imperative work (DOM access, IO, scheduling) accumulates O(N) at mount under load (cf. PR #268). Wrap the imperative call in \`onMount(() => { ... })\` and keep \`effect()\` for pure signal-tracking subscriptions.`,
+					span: getSpan(node)
+				});
+			},
+			"CallExpression:exit"(node) {
+				const callee = node.callee;
+				if (callee?.type === "Identifier" && SAFE_WRAPPER_NAMES.has(callee.name)) safeWrapperDepth--;
+			}
+		};
+	}
+};
+
 //#endregion
 //#region src/rules/lifecycle/no-missing-cleanup.ts
 const NEEDS_CLEANUP = new Set(["setInterval", "addEventListener"]);
@@ -2023,6 +2377,75 @@ const preferShowOverDisplay = {
 	}
 };
 
+//#endregion
+//#region src/rules/reactivity/no-async-effect.ts
+/**
+* Disallow async functions passed to `effect()` / `renderEffect()` /
+* `computed()` (audit bug #1).
+*
+* The reactivity tracking context is the SYNCHRONOUS frame around the
+* callback's top half. Anything after the first `await` runs detached,
+* so signal reads on the back side aren't tracked and the
+* effect/computed won't re-run when those signals change. Common
+* foot-gun:
+*
+*   effect(async () => {
+*     const id = userId()           // tracked ✓
+*     const data = await fetch(...) // boundary
+*     const name = profile()        // NOT tracked ✗ — runs once, never again
+*     setName(name)
+*   })
+*
+* `computed(async () => …)` is even worse: the computed's value type
+* becomes `Computed<Promise<T>>`, which silently breaks every consumer
+* that expects `Computed<T>`. There's no scenario where async makes
+* sense for a computed.
+*
+* The runtime emits a matching dev-mode console.warn for each call
+* shape (see `packages/core/reactivity/src/effect.ts` and
+* `computed.ts`); this lint rule surfaces the warning earlier in the
+* editor / CI loop, before the code even runs.
+*
+* Mitigation patterns:
+*   - Read all tracked signals BEFORE any await, then `await` last.
+*   - Use `watch(source, async (val) => …)` — the source is tracked
+*     synchronously; the async callback runs on changes without
+*     needing tracking continuity.
+*   - Split into two effects: one synchronous (track + dispatch), one
+*     async via the dispatch.
+*   - For async derived state, use `createResource` or a
+*     `signal<Promise<T>>` + `effect` pattern, NOT `computed`.
+*/
+const REACTIVE_PRIMITIVES = [
+	"effect",
+	"renderEffect",
+	"computed"
+];
+const noAsyncEffect = {
+	meta: {
+		id: "pyreon/no-async-effect",
+		category: "reactivity",
+		description: "Disallow async functions in `effect()` / `renderEffect()` / `computed()` — signal reads after the first await are not tracked.",
+		severity: "error",
+		fixable: false
+	},
+	create(context) {
+		return { CallExpression(node) {
+			const calleeName = REACTIVE_PRIMITIVES.find((n) => isCallTo(node, n));
+			if (!calleeName) return;
+			const arg = node.arguments?.[0];
+			if (!arg) return;
+			if ((arg.type === "ArrowFunctionExpression" || arg.type === "FunctionExpression") && arg.async === true) {
+				const remediation = calleeName === "computed" ? "Use `createResource` for async-derived state, or compute synchronously over a signal that holds the awaited value." : "Read all tracked signals before any await, or use `watch(source, asyncCb)` for async-in-callback patterns.";
+				context.report({
+					message: `${calleeName}() callback is async — signal reads after the first \`await\` are NOT tracked. ${remediation}`,
+					span: getSpan(arg)
+				});
+			}
+		} };
+	}
+};
+
 //#endregion
 //#region src/rules/reactivity/no-bare-signal-in-jsx.ts
 const SKIP_NAMES = new Set([
@@ -2209,6 +2632,60 @@ const noPeekInTracked = {
 	}
 };
 
+//#endregion
+//#region src/rules/reactivity/no-signal-call-write.ts
+/**
+* Mirrors the D1 MCP detector (`signal-write-as-call`) at lint time so
+* editors flag `sig(value)` write attempts as the user types them.
+*
+* Bindings are collected in a single top-down pass: oxc visits
+* VariableDeclaration top-down before nested function bodies, and `const`
+* is in the TDZ before declaration — so a use site never precedes its
+* binding's visitor. Scope-blind on purpose: shadowing a signal name
+* with a non-signal in a nested scope is itself unusual, and the
+* diagnostic points at the exact call so a human can dismiss the rare
+* false positive.
+*
+* Only `const` declarations qualify — `let`/`var` may be reassigned to a
+* non-signal value, so a use-site call wouldn't be a reliable
+* signal-write.
+*/
+const noSignalCallWrite = {
+	meta: {
+		id: "pyreon/no-signal-call-write",
+		category: "reactivity",
+		description: "Disallow `sig(value)` write attempts on signal/computed bindings — `signal()` is the read-only callable. Use `sig.set(value)` or `sig.update(fn)`.",
+		severity: "error",
+		fixable: false
+	},
+	create(context) {
+		const bindings = /* @__PURE__ */ new Set();
+		return {
+			VariableDeclaration(node) {
+				if (node.kind !== "const") return;
+				for (const decl of node.declarations ?? []) {
+					if (decl?.type !== "VariableDeclarator") continue;
+					if (decl.id?.type !== "Identifier") continue;
+					const init = decl.init;
+					if (!init) continue;
+					if (!isCallTo(init, "signal") && !isCallTo(init, "computed")) continue;
+					bindings.add(decl.id.name);
+				}
+			},
+			CallExpression(node) {
+				const callee = node.callee;
+				if (!callee || callee.type !== "Identifier") return;
+				if (!bindings.has(callee.name)) return;
+				if (!node.arguments || node.arguments.length === 0) return;
+				context.report({
+					message: `\`${callee.name}(value)\` does NOT write the signal — \`signal()\` is the read-only callable surface and ignores its arguments. Use \`${callee.name}.set(value)\` or \`${callee.name}.update((prev) => …)\`.`,
+					span: getSpan(node)
+				});
+			}
+		};
+	}
+};
+
 //#endregion
 //#region src/rules/reactivity/no-signal-in-loop.ts
 const noSignalInLoop = {
@@ -3291,6 +3768,7 @@ const preferCx = {
 //#endregion
 //#region src/rules/index.ts
 const allRules = [
+	noAsyncEffect,
 	noBareSignalInJsx,
 	noContextDestructure,
 	noSignalInLoop,
@@ -3301,6 +3779,7 @@ const allRules = [
 	preferComputed,
 	noEffectAssignment,
 	noSignalLeak,
+	noSignalCallWrite,
 	noMapInJsx,
 	useByNotKey,
 	noClassName,
@@ -3316,6 +3795,7 @@ const allRules = [
 	noMountInEffect,
 	noEffectInMount,
 	noDomInSetup,
+	noImperativeEffectOnCreate,
 	noLargeForWithoutBy,
 	noEffectInFor,
 	noEagerImport,