@rigour-labs/core 6.4.0 → 6.4.1

package/dist/semantic/rules/ecosystem/deps-codegen-undeclared-import.js

@@ -0,0 +1,71 @@
+/**
+ * deps/codegen-undeclared-import: generated code imports a package the
+ * generating package does not declare.
+ *
+ * Plugins and compilers emit source into their users' builds. An emitted
+ * `import … from 'pkg'` resolves in the user's project, so `pkg` must be a
+ * dependency or peer dependency of the plugin; otherwise builds fail wherever
+ * the user has not happened to install it. TanStack's Rsbuild plugin emitted
+ * `react-refresh/runtime` and broke apps without it.
+ *
+ * Only text that is emitted as code counts: a template given to a code builder
+ * (`template.statement\`…\`` or `template.statement(\`…\`)`), the `code` a
+ * bundler hook returns, or text given to a MagicString edit. Strings that merely mention imports (docs, lint rule
+ * data, demos) do not.
+ */
+import { builtinModules } from 'module';
+import ts from 'typescript';
+import { forEachNode, propertyNameText } from '../../ast.js';
+import { finding, packageOf } from './shared.js';
+const EMITTED_IMPORT = /(?:^|[\s;{}])import\s+(?:[\w*{}\s,$]+\s+from\s+)?['"]([^'"]+)['"]/g;
+const BUILTINS = new Set(builtinModules);
+const CODE_TAG = /(?:^|\.)(?:template|statement|statements|expression|smart|program|ast|js|ts|jsx|tsx|code)$/;
+const EMIT_METHODS = new Set(['prepend', 'append', 'appendLeft', 'appendRight', 'prependLeft', 'prependRight', 'overwrite']);
+export const depsCodegenUndeclaredImport = {
+    id: 'deps/codegen-undeclared-import',
+    check(ctx) {
+        const { sourceFile, project } = ctx;
+        const declared = project.dependencies(sourceFile.fileName);
+        if (declared.size === 0)
+            return [];
+        const self = project.packageName(sourceFile.fileName);
+        const findings = [];
+        forEachNode(sourceFile, (node) => {
+            const text = templateText(node);
+            if (!text || !isEmittedCode(node))
+                return;
+            for (const match of text.matchAll(EMITTED_IMPORT)) {
+                const pkg = packageOf(match[1]);
+                if (!pkg || pkg.includes('${') || BUILTINS.has(pkg) || declared.has(pkg) || pkg === self)
+                    continue;
+                findings.push(finding(ctx, 'deps/codegen-undeclared-import', node, 'high', `Generated code imports \`${match[1]}\`, but \`${pkg}\` is not a dependency or peer dependency of this package; builds without it fail.`, `Declare \`${pkg}\` as a (peer) dependency, or emit code that does not import it.`));
+            }
+        });
+        return findings;
+    },
+};
+/** Text of a string or template that is code: it must contain an import statement, not just a path. */
+function templateText(node) {
+    if (ts.isNoSubstitutionTemplateLiteral(node) || ts.isStringLiteral(node))
+        return node.text.includes('import') ? node.text : undefined;
+    if (ts.isTemplateExpression(node)) {
+        const text = [node.head.text, ...node.templateSpans.map(s => s.literal.text)].join('${}');
+        return text.includes('import') ? text : undefined;
+    }
+    return undefined;
+}
+/** The string is emitted as module code, not merely text that mentions an import. */
+function isEmittedCode(node) {
+    const parent = node.parent;
+    if (ts.isTaggedTemplateExpression(parent))
+        return CODE_TAG.test(parent.tag.getText());
+    if (ts.isPropertyAssignment(parent) && propertyNameText(parent.name) === 'code')
+        return true;
+    if (!ts.isCallExpression(parent) || !parent.arguments.includes(node))
+        return false;
+    const callee = parent.expression;
+    // template.statement(`import …`), a code builder called rather than tagged
+    if (CODE_TAG.test(callee.getText()))
+        return true;
+    return ts.isPropertyAccessExpression(callee) && EMIT_METHODS.has(callee.name.text);
+}

package/dist/semantic/rules/ecosystem/deps-internal-symbol.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const depsInternalSymbol: SemanticRule;

package/dist/semantic/rules/ecosystem/deps-internal-symbol.js

@@ -0,0 +1,36 @@
+/**
+ * deps/internal-symbol: reading a library's internal `Symbol.for('<lib>.internal…')`
+ * with the type error silenced.
+ *
+ * Internal symbols change without notice between releases, and the
+ * `@ts-expect-error` hides exactly the signal that the value is not public API.
+ * TanStack Start read h3's internal response symbol and replaced it with the
+ * public `event.res`.
+ */
+import ts from 'typescript';
+import { forEachNode } from '../../ast.js';
+import { finding, leadingCommentText } from './shared.js';
+const INTERNAL_KEY = /(?:^|[.:/])(?:internal|private)(?:[.:/]|$)/i;
+const SILENCED = /@ts-(?:expect-error|ignore)/;
+export const depsInternalSymbol = {
+    id: 'deps/internal-symbol',
+    check(ctx) {
+        const findings = [];
+        forEachNode(ctx.sourceFile, (node) => {
+            if (!ts.isCallExpression(node) || !isSymbolFor(node))
+                return;
+            const key = node.arguments[0];
+            if (!key || !ts.isStringLiteralLike(key) || !INTERNAL_KEY.test(key.text))
+                return;
+            if (!SILENCED.test(leadingCommentText(ctx.sourceFile, node)))
+                return;
+            findings.push(finding(ctx, 'deps/internal-symbol', node, 'medium', `\`Symbol.for('${key.text}')\` reads a library internal with the type error silenced; it can break on any release.`, 'Use the library\'s public API for this value, or pin the version and cover it with a test.'));
+        });
+        return findings;
+    },
+};
+function isSymbolFor(call) {
+    const callee = call.expression;
+    return ts.isPropertyAccessExpression(callee) && callee.name.text === 'for'
+        && ts.isIdentifier(callee.expression) && callee.expression.text === 'Symbol';
+}

package/dist/semantic/rules/ecosystem/dom-self-query-in-component.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const domSelfQueryInComponent: SemanticRule;

package/dist/semantic/rules/ecosystem/dom-self-query-in-component.js

@@ -0,0 +1,60 @@
+/**
+ * dom/self-query-in-component: a component scans the whole document to find
+ * its own element.
+ *
+ * `document.querySelectorAll(...)` inside a component's mount or effect, looping
+ * to find the node whose attribute equals this instance's id, costs O(n) per
+ * instance and O(n²) per page. A ref gives the element directly. TanStack's
+ * Solid hydration did this for every boundary.
+ */
+import ts from 'typescript';
+import { forEachNode } from '../../ast.js';
+import { finding, isJsxFile } from './shared.js';
+const LIFECYCLE = new Set(['onMount', 'createEffect', 'createRenderEffect', 'useEffect', 'useLayoutEffect', 'onMounted', 'watchEffect']);
+export const domSelfQueryInComponent = {
+    id: 'dom/self-query-in-component',
+    check(ctx) {
+        if (!isJsxFile(ctx.sourceFile) && !ctx.sourceFile.fileName.endsWith('.vue.ts'))
+            return [];
+        const findings = [];
+        forEachNode(ctx.sourceFile, (node) => {
+            if (!ts.isCallExpression(node) || !isDocumentQueryAll(node) || !insideLifecycle(node))
+                return;
+            if (!matchesOwnIdentity(node))
+                return;
+            findings.push(finding(ctx, 'dom/self-query-in-component', node, 'medium', 'Each instance scans the whole document to find its own element: O(n) per instance, O(n²) per page.', 'Attach a ref to the element and use it directly.'));
+        });
+        return findings;
+    },
+};
+function isDocumentQueryAll(call) {
+    const callee = call.expression;
+    return ts.isPropertyAccessExpression(callee) && callee.name.text === 'querySelectorAll'
+        && ts.isIdentifier(callee.expression) && callee.expression.text === 'document';
+}
+function insideLifecycle(node) {
+    for (let current = node.parent; current; current = current.parent) {
+        if (!ts.isCallExpression(current))
+            continue;
+        const callee = current.expression;
+        const name = ts.isIdentifier(callee) ? callee.text : ts.isPropertyAccessExpression(callee) ? callee.name.text : '';
+        if (LIFECYCLE.has(name))
+            return true; // onMount(...) or Solid.onMount(...)
+    }
+    return false;
+}
+/** The query's results are filtered by comparing an attribute to something (the instance's own id). */
+function matchesOwnIdentity(query) {
+    let scope = query;
+    while (scope.parent && !ts.isBlock(scope.parent))
+        scope = scope.parent;
+    const block = scope.parent ?? scope;
+    let matches = false;
+    forEachNode(block, (node) => {
+        if (matches || !ts.isBinaryExpression(node) || node.operatorToken.kind !== ts.SyntaxKind.EqualsEqualsEqualsToken)
+            return;
+        matches = [node.left, node.right].some(side => ts.isCallExpression(side) && ts.isPropertyAccessExpression(side.expression)
+            && side.expression.name.text === 'getAttribute');
+    });
+    return matches;
+}

package/dist/semantic/rules/ecosystem/env-bare-browser-global.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const envBareBrowserGlobal: SemanticRule;

package/dist/semantic/rules/ecosystem/env-bare-browser-global.js

@@ -0,0 +1,57 @@
+/**
+ * env/bare-browser-global: a browser global used bare (`addEventListener(...)`,
+ * `history.x`) in a file that knows it may run outside a browser.
+ *
+ * The file qualifies the global as `window.x` elsewhere, compares against
+ * `window`, or checks `isServer` / `typeof window`: it runs where the global is
+ * absent or is not the window (SSR, Node with a jsdom window, workers). A bare
+ * use there throws or reaches the wrong object. TanStack Router's core crashed
+ * router creation under Node + jsdom this way.
+ */
+import ts from 'typescript';
+import { forEachNode } from '../../ast.js';
+import { finding } from './shared.js';
+const BARE_CALLS = new Set(['addEventListener', 'removeEventListener', 'dispatchEvent']);
+const BARE_OBJECTS = new Set(['history', 'location', 'localStorage', 'sessionStorage']);
+/** The file guards for non-browser runtimes: `isServer`, `typeof window`/`document`, or compares against `window`. */
+const ENV_AWARE = /\bisServer\b|typeof\s+(?:window|document)\b|[=!]==?\s*window\b|\bwindow\s*[=!]==?/;
+export const envBareBrowserGlobal = {
+    id: 'env/bare-browser-global',
+    check(ctx) {
+        const { sourceFile, checker } = ctx;
+        const qualified = windowQualified(sourceFile);
+        const aware = qualified.size > 0 || ENV_AWARE.test(sourceFile.text);
+        if (!aware)
+            return [];
+        const findings = [];
+        forEachNode(sourceFile, (node) => {
+            const bare = bareGlobal(node);
+            if (!bare || isLocal(checker, bare))
+                return;
+            findings.push(finding(ctx, 'env/bare-browser-global', node, 'medium', `Bare \`${bare.text}\` in a file that also runs outside the browser; where the global is not the window (SSR, jsdom, workers) it throws or hits the wrong object.`, `Use \`window.${bare.text}\` as the rest of the file does.`));
+        });
+        return findings;
+    },
+};
+/** Names the file reads as `window.<name>`. */
+function windowQualified(sourceFile) {
+    const names = new Set();
+    forEachNode(sourceFile, (node) => {
+        if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === 'window'
+            && (BARE_CALLS.has(node.name.text) || BARE_OBJECTS.has(node.name.text)))
+            names.add(node.name.text);
+    });
+    return names;
+}
+function bareGlobal(node) {
+    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && BARE_CALLS.has(node.expression.text))
+        return node.expression;
+    if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.expression) && BARE_OBJECTS.has(node.expression.text))
+        return node.expression;
+    return undefined;
+}
+/** Declared in the project (an import, a parameter, a local): not the browser global. */
+function isLocal(checker, id) {
+    const declarations = checker.getSymbolAtLocation(id)?.declarations ?? [];
+    return declarations.some(d => !d.getSourceFile().isDeclarationFile);
+}

package/dist/semantic/rules/ecosystem/exports-condition-parity.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const exportsConditionParity: SemanticRule;

package/dist/semantic/rules/ecosystem/exports-condition-parity.js

@@ -0,0 +1,57 @@
+/**
+ * exports/condition-parity: a conditional entry (`index.react-server.ts`,
+ * `index.rsc.ts`, `index.browser.ts`, …) exports fewer names than the package's
+ * default `index.ts` beside it.
+ *
+ * Bundlers pick the conditional entry for that environment, so every name it
+ * lacks is an import that works in one environment and fails in another.
+ * TanStack Start's `react-server` entry dropped `useServerFn` and broke RSC apps.
+ */
+import fs from 'fs';
+import path from 'path';
+import ts from 'typescript';
+import { finding } from './shared.js';
+const VARIANT = /^index\.([a-z][\w-]*)\.[cm]?[jt]sx?$/i;
+const DECLARATION = /\.d\.[cm]?ts$/i;
+export const exportsConditionParity = {
+    id: 'exports/condition-parity',
+    check(ctx) {
+        const { sourceFile } = ctx;
+        const base = path.basename(sourceFile.fileName);
+        const variant = base.match(VARIANT);
+        if (!variant || DECLARATION.test(base))
+            return [];
+        const defaultEntry = siblingIndex(path.dirname(sourceFile.fileName));
+        if (!defaultEntry)
+            return [];
+        const { checker, entry, variant: own } = entries(ctx, defaultEntry);
+        if (!entry || !own)
+            return [];
+        const ownNames = exportNames(checker, own);
+        const missing = [...exportNames(checker, entry)].filter(name => !ownNames.has(name));
+        if (missing.length === 0)
+            return [];
+        const anchor = sourceFile.statements.find(s => ts.isExportDeclaration(s)) ?? sourceFile.statements[0] ?? sourceFile;
+        const shown = missing.slice(0, 5).map(n => `\`${n}\``).join(', ');
+        return [finding(ctx, 'exports/condition-parity', anchor, 'medium', `The \`${variant[1]}\` entry lacks ${missing.length} export(s) of ${path.basename(defaultEntry)}: ${shown}${missing.length > 5 ? ', …' : ''}. Imports of them fail only in that environment.`, `Re-export them from ${base}, or point the \`${variant[1]}\` condition at the default entry.`)];
+    },
+};
+function siblingIndex(dir) {
+    return ['index.ts', 'index.tsx', 'index.js', 'index.mts'].map(f => path.join(dir, f)).find(f => fs.existsSync(f));
+}
+/**
+ * Both entries in one program: the analysis program when it loaded the default
+ * entry (a full check), otherwise a two-file program (a review of the variant alone).
+ */
+function entries(ctx, defaultEntry) {
+    const entry = ctx.program.getSourceFile(defaultEntry);
+    if (entry)
+        return { checker: ctx.checker, entry, variant: ctx.sourceFile };
+    const options = { ...ctx.project.compilerOptions(ctx.sourceFile.fileName), noEmit: true, skipLibCheck: true, types: [] };
+    const pair = ts.createProgram([defaultEntry, ctx.sourceFile.fileName], options);
+    return { checker: pair.getTypeChecker(), entry: pair.getSourceFile(defaultEntry), variant: pair.getSourceFile(ctx.sourceFile.fileName) };
+}
+function exportNames(checker, sourceFile) {
+    const moduleSymbol = checker.getSymbolAtLocation(sourceFile);
+    return new Set(moduleSymbol ? checker.getExportsOfModule(moduleSymbol).map(s => s.name) : []);
+}

package/dist/semantic/rules/ecosystem/exports-forgotten-type.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const exportsForgottenType: SemanticRule;

package/dist/semantic/rules/ecosystem/exports-forgotten-type.js

@@ -0,0 +1,128 @@
+/**
+ * exports/forgotten-type: a package entry exports a function whose signature
+ * names a type the entry does not export (api-extractor's "forgotten export").
+ *
+ * Consumers can call the function but cannot name its parameter or return
+ * types, so they cannot annotate, wrap or store the values. TanStack Start's
+ * RSC entry exported `renderServerComponent` without the Renderable* types it
+ * returns.
+ */
+import fs from 'fs';
+import path from 'path';
+import ts from 'typescript';
+import { finding } from './shared.js';
+const ENTRY = /^index\.[cm]?tsx?$/;
+export const exportsForgottenType = {
+    id: 'exports/forgotten-type',
+    check(ctx) {
+        const { sourceFile, checker } = ctx;
+        if (!ENTRY.test(path.basename(sourceFile.fileName)) || !isPackageEntry(ctx))
+            return [];
+        const moduleSymbol = checker.getSymbolAtLocation(sourceFile);
+        if (!moduleSymbol)
+            return [];
+        const exported = checker.getExportsOfModule(moduleSymbol);
+        const exportedTargets = new Set(exported.map(s => resolve(checker, s)));
+        // One finding per export statement: the engine keeps one finding per line.
+        const missing = new Map();
+        for (const symbol of exported) {
+            for (const declaration of resolve(checker, symbol).declarations ?? []) {
+                const fn = functionOf(declaration);
+                if (!fn)
+                    continue;
+                for (const type of signatureTypes(checker, fn)) {
+                    if (exportedTargets.has(type) || subpathExports(ctx, type))
+                        continue;
+                    const anchor = exportStatementFor(checker, sourceFile, symbol.name) ?? sourceFile.statements[0] ?? sourceFile;
+                    const entry = missing.get(anchor) ?? { names: [], types: new Set() };
+                    if (!entry.names.includes(symbol.name))
+                        entry.names.push(symbol.name);
+                    entry.types.add(type.name);
+                    missing.set(anchor, entry);
+                }
+            }
+        }
+        const findings = [];
+        for (const [anchor, { names, types }] of missing) {
+            const typeList = [...types].map(t => `\`${t}\``).join(', ');
+            findings.push(finding(ctx, 'exports/forgotten-type', anchor, 'medium', `${names.map(n => `\`${n}\``).join(', ')} ${names.length > 1 ? 'are' : 'is'} exported, but ${types.size > 1 ? 'their signatures use' : 'the signature uses'} ${typeList}, which this entry does not export; consumers cannot name ${types.size > 1 ? 'them' : 'it'}.`, `Export ${typeList} (a type-only export is enough) from ${path.basename(sourceFile.fileName)}.`));
+        }
+        return findings;
+    },
+};
+/** The entry of its package: `index.ts` beside package.json or in its `src/`. */
+function isPackageEntry(ctx) {
+    // TypeScript names files with '/', path.resolve with the OS separator: compare resolved paths.
+    const dir = path.resolve(path.dirname(ctx.sourceFile.fileName));
+    const owner = ctx.project.packageDir(ctx.sourceFile.fileName);
+    return !!owner && (dir === owner || dir === path.join(owner, 'src'));
+}
+/**
+ * Exported by a subpath entry instead: an `index` file between the type's
+ * declaration and the package root that exports it (`pkg/sub` entries).
+ */
+function subpathExports(ctx, type) {
+    const owner = ctx.project.packageDir(ctx.sourceFile.fileName);
+    const declared = type.declarations?.[0]?.getSourceFile().fileName;
+    const self = path.resolve(ctx.sourceFile.fileName);
+    if (!owner || !declared)
+        return false;
+    for (let dir = path.resolve(path.dirname(declared)); dir.startsWith(owner) && dir !== owner; dir = path.dirname(dir)) {
+        const index = ['index.ts', 'index.tsx', 'index.mts'].map(f => path.join(dir, f)).find(f => fs.existsSync(f));
+        if (!index || index === self)
+            continue;
+        const loaded = ctx.program.getSourceFile(index);
+        const moduleSymbol = loaded && ctx.checker.getSymbolAtLocation(loaded);
+        if (moduleSymbol ? ctx.checker.getExportsOfModule(moduleSymbol).some(s => s.name === type.name)
+            : new RegExp(`\\b${type.name}\\b|export \\*`).test(fs.readFileSync(index, 'utf8')))
+            return true;
+    }
+    return false;
+}
+function resolve(checker, symbol) {
+    return symbol.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol;
+}
+/** `function f()` or `const f = () => …` / `const f = function () {…}`. */
+function functionOf(declaration) {
+    if (ts.isFunctionDeclaration(declaration))
+        return declaration;
+    const init = ts.isVariableDeclaration(declaration) ? declaration.initializer : undefined;
+    return init && (ts.isArrowFunction(init) || ts.isFunctionExpression(init)) ? init : undefined;
+}
+/** Project-declared interfaces, type aliases, classes and enums named in parameter and return annotations. */
+function signatureTypes(checker, fn) {
+    const types = [];
+    const visit = (node) => {
+        if (ts.isTypeReferenceNode(node)) {
+            const symbol = checker.getSymbolAtLocation(node.typeName);
+            const target = symbol && resolve(checker, symbol);
+            if (target && isProjectType(target))
+                types.push(target);
+        }
+        ts.forEachChild(node, visit);
+    };
+    for (const param of fn.parameters)
+        if (param.type)
+            visit(param.type);
+    if (fn.type)
+        visit(fn.type);
+    return types;
+}
+function isProjectType(symbol) {
+    const kinds = ts.SymbolFlags.Interface | ts.SymbolFlags.TypeAlias | ts.SymbolFlags.Class | ts.SymbolFlags.Enum;
+    return (symbol.flags & kinds) !== 0
+        && (symbol.declarations ?? []).some(d => !d.getSourceFile().isDeclarationFile && !d.getSourceFile().fileName.includes('/node_modules/'));
+}
+/** The statement that exports `name`: a named export, or the `export *` whose module provides it. */
+function exportStatementFor(checker, sourceFile, name) {
+    const declarations = sourceFile.statements.filter(ts.isExportDeclaration);
+    const named = declarations.find(s => s.exportClause && ts.isNamedExports(s.exportClause)
+        && s.exportClause.elements.some(e => e.name.text === name));
+    if (named)
+        return named;
+    return declarations.find(s => !s.exportClause && s.moduleSpecifier && providesName(checker, s.moduleSpecifier, name));
+}
+function providesName(checker, specifier, name) {
+    const moduleSymbol = checker.getSymbolAtLocation(specifier);
+    return !!moduleSymbol && checker.getExportsOfModule(moduleSymbol).some(s => s.name === name);
+}

package/dist/semantic/rules/ecosystem/imports-barrel-cycle.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const importsBarrelCycle: SemanticRule;

package/dist/semantic/rules/ecosystem/imports-barrel-cycle.js

@@ -0,0 +1,78 @@
+/**
+ * imports/barrel-cycle: a runtime re-export (`export … from './x'`) whose target
+ * imports this file back, directly or through other project modules.
+ *
+ * A barrel in an import cycle evaluates before the modules it re-exports have
+ * run: exports are undefined at first use, and HMR updates loop through the
+ * cycle. TanStack Start's `Hydrate` re-export pulled the app's router into a
+ * cycle and caused circular HMR updates. Type-only edges are erased, so they
+ * are ignored.
+ */
+import ts from 'typescript';
+import { finding } from './shared.js';
+const MAX_VISITED = 2000;
+const edgesByChecker = new WeakMap();
+export const importsBarrelCycle = {
+    id: 'imports/barrel-cycle',
+    check(ctx) {
+        const { sourceFile, checker } = ctx;
+        const findings = [];
+        for (const statement of sourceFile.statements) {
+            if (!ts.isExportDeclaration(statement) || statement.isTypeOnly || !statement.moduleSpecifier)
+                continue;
+            const target = moduleFile(checker, statement.moduleSpecifier);
+            if (!target || !reaches(checker, target, sourceFile))
+                continue;
+            findings.push(finding(ctx, 'imports/barrel-cycle', statement, 'medium', `This re-export of \`${statement.moduleSpecifier.text}\` closes an import cycle back to this file; its exports can be undefined at first use and HMR updates loop.`, 'Re-export from a module outside the cycle (a dedicated subpath entry), or break the back-import.'));
+        }
+        return findings;
+    },
+};
+function reaches(checker, from, to) {
+    const seen = new Set([from]);
+    const queue = [from];
+    while (queue.length && seen.size < MAX_VISITED) {
+        for (const next of edges(checker, queue.shift())) {
+            if (next === to)
+                return true;
+            if (!seen.has(next)) {
+                seen.add(next);
+                queue.push(next);
+            }
+        }
+    }
+    return false;
+}
+/** Runtime imports and re-exports of a project file, to other project files. */
+function edges(checker, file) {
+    let cache = edgesByChecker.get(checker);
+    if (!cache)
+        edgesByChecker.set(checker, cache = new Map());
+    const cached = cache.get(file);
+    if (cached)
+        return cached;
+    const targets = [];
+    for (const statement of file.statements) {
+        const specifier = runtimeSpecifier(statement);
+        const target = specifier && moduleFile(checker, specifier);
+        if (target)
+            targets.push(target);
+    }
+    cache.set(file, targets);
+    return targets;
+}
+function runtimeSpecifier(statement) {
+    if (ts.isImportDeclaration(statement)) {
+        const clause = statement.importClause;
+        return clause?.isTypeOnly ? undefined : statement.moduleSpecifier;
+    }
+    if (ts.isExportDeclaration(statement) && !statement.isTypeOnly)
+        return statement.moduleSpecifier;
+    return undefined;
+}
+function moduleFile(checker, specifier) {
+    const declaration = checker.getSymbolAtLocation(specifier)?.valueDeclaration;
+    if (!declaration || !ts.isSourceFile(declaration) || declaration.isDeclarationFile)
+        return undefined;
+    return declaration.fileName.includes('/node_modules/') ? undefined : declaration;
+}

package/dist/semantic/rules/ecosystem/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Ecosystem rules: framework, library and packaging knowledge, each gated on the
+ * file's own dependencies or shape.
+ *
+ * A rule runs by default only once it passes validation on repositories it was
+ * not designed from (driftbench rlaif/rules): it catches real fixes, is quiet on
+ * code as it stands, and its hits are right. Candidates run when named in
+ * `gates.semantic_bugs.rules` or `rigour scan-rules --rules`, until their hits
+ * are labelled.
+ */
+import type { SemanticRule } from '../../types.js';
+/** Validated: catch a documented upstream fix, silent on eight unrelated repositories. */
+export declare const ECOSYSTEM_RULES: SemanticRule[];
+/** Candidates: they fire on code as it stands, and those hits are not yet labelled. Opt-in. */
+export declare const CANDIDATE_RULES: SemanticRule[];

package/dist/semantic/rules/ecosystem/index.js

@@ -0,0 +1,22 @@
+import { depsCodegenUndeclaredImport } from './deps-codegen-undeclared-import.js';
+import { depsInternalSymbol } from './deps-internal-symbol.js';
+import { domSelfQueryInComponent } from './dom-self-query-in-component.js';
+import { envBareBrowserGlobal } from './env-bare-browser-global.js';
+import { exportsConditionParity } from './exports-condition-parity.js';
+import { exportsForgottenType } from './exports-forgotten-type.js';
+import { importsBarrelCycle } from './imports-barrel-cycle.js';
+import { pathsUnnormalizedModuleKey } from './paths-unnormalized-module-key.js';
+import { reactInlineHtmlObject } from './react-inline-html-object.js';
+import { solidJsxAndConditional } from './solid-jsx-and-conditional.js';
+import { tsInternalInPublicSignature } from './ts-internal-in-public-signature.js';
+import { viteRollupOnlyHookField } from './vite-rollup-only-hook-field.js';
+import { vueStaticComputed } from './vue-static-computed.js';
+/** Validated: catch a documented upstream fix, silent on eight unrelated repositories. */
+export const ECOSYSTEM_RULES = [
+    vueStaticComputed, reactInlineHtmlObject, tsInternalInPublicSignature, depsInternalSymbol,
+    depsCodegenUndeclaredImport, viteRollupOnlyHookField, domSelfQueryInComponent, exportsConditionParity,
+];
+/** Candidates: they fire on code as it stands, and those hits are not yet labelled. Opt-in. */
+export const CANDIDATE_RULES = [
+    solidJsxAndConditional, pathsUnnormalizedModuleKey, envBareBrowserGlobal, exportsForgottenType, importsBarrelCycle,
+];

package/dist/semantic/rules/ecosystem/paths-unnormalized-module-key.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const pathsUnnormalizedModuleKey: SemanticRule;

package/dist/semantic/rules/ecosystem/paths-unnormalized-module-key.js

@@ -0,0 +1,87 @@
+/**
+ * paths/unnormalized-module-key: a bundler module's file path is used as a map
+ * key or compared with another path without POSIX normalization.
+ *
+ * Rspack and webpack report modules by OS path (`nameForCondition()`,
+ * `.resource`, `.userRequest`), which on Windows uses backslashes, while route
+ * generators and Vite ids use forward slashes. The lookup silently misses on
+ * Windows only. TanStack Start lost every route's CSS on Windows this way.
+ */
+import ts from 'typescript';
+import { enclosingFunction, forEachNode, forEachOwnNode, symbolOf, unwrap } from '../../ast.js';
+import { finding } from './shared.js';
+const BUNDLERS = ['@rspack/core', 'webpack', '@rsbuild/core'];
+const OS_PATH_PROPERTIES = new Set(['resource', 'userRequest', 'rawRequest']);
+const OS_PATH_METHODS = new Set(['nameForCondition']);
+const NORMALIZER = /normali[sz]e|posix|slash|toUnix|replace(?:All)?$/i;
+export const pathsUnnormalizedModuleKey = {
+    id: 'paths/unnormalized-module-key',
+    check(ctx) {
+        const { sourceFile, checker, project } = ctx;
+        if (!project.declares(sourceFile.fileName, ...BUNDLERS))
+            return [];
+        const findings = [];
+        const tainted = new Set();
+        forEachNode(sourceFile, (node) => {
+            if (!ts.isVariableDeclaration(node) || !ts.isIdentifier(node.name) || !node.initializer)
+                return;
+            if (!readsOsPath(checker, node.initializer, tainted))
+                return;
+            const symbol = checker.getSymbolAtLocation(node.name);
+            const fn = enclosingFunction(node);
+            if (!symbol || !fn)
+                return;
+            tainted.add(symbol); // a later variable built from this one carries the OS path too
+            const use = keyUse(checker, fn, symbol);
+            if (use) {
+                findings.push(finding(ctx, 'paths/unnormalized-module-key', node, 'medium', `\`${node.name.text}\` holds a bundler module path in OS form and is used as a lookup key; on Windows it has backslashes and never matches.`, 'Normalize it to POSIX separators first (e.g. `.replace(/\\\\/g, \'/\')` or a normalizePath helper).'));
+            }
+        });
+        return findings;
+    },
+};
+/**
+ * The expression reads an OS path (from a bundler module, or from a variable that
+ * holds one) and is not normalized on the way.
+ */
+function readsOsPath(checker, expr, tainted) {
+    let reads = false;
+    let normalized = false;
+    const walk = (node) => {
+        if (ts.isCallExpression(node)) {
+            const callee = node.expression;
+            const name = ts.isPropertyAccessExpression(callee) ? callee.name.text : ts.isIdentifier(callee) ? callee.text : '';
+            if (NORMALIZER.test(name))
+                normalized = true;
+            if (OS_PATH_METHODS.has(name))
+                reads = true;
+        }
+        if (ts.isPropertyAccessExpression(node) && OS_PATH_PROPERTIES.has(node.name.text))
+            reads = true;
+        if (ts.isIdentifier(node) && tainted.size > 0) {
+            const symbol = symbolOf(checker, node);
+            if (symbol && tainted.has(symbol))
+                reads = true;
+        }
+        ts.forEachChild(node, walk);
+    };
+    walk(unwrap(expr));
+    return reads && !normalized;
+}
+/** A use of the variable as a Map key, an object key, or one side of an equality. */
+function keyUse(checker, fn, symbol) {
+    let use;
+    forEachOwnNode(fn, (node) => {
+        if (use || !ts.isIdentifier(node) || symbolOf(checker, node) !== symbol)
+            return;
+        const parent = node.parent;
+        if (ts.isCallExpression(parent) && parent.arguments[0] === node && ts.isPropertyAccessExpression(parent.expression)
+            && ['get', 'set', 'has'].includes(parent.expression.name.text))
+            use = parent;
+        else if (ts.isElementAccessExpression(parent) && parent.argumentExpression === node)
+            use = parent;
+        else if (ts.isBinaryExpression(parent) && [ts.SyntaxKind.EqualsEqualsEqualsToken, ts.SyntaxKind.EqualsEqualsToken].includes(parent.operatorToken.kind))
+            use = parent;
+    });
+    return use;
+}

package/dist/semantic/rules/ecosystem/react-inline-html-object.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../../types.js';
+export declare const reactInlineHtmlObject: SemanticRule;