@starci/eslint-canon-be 1.2.2 → 1.7.0

package/schema-authority.mjs

@@ -0,0 +1,187 @@
+/**
+ * The rules that hold HFS schema authority and the persistence boundary (catalog R34, R36, R37).
+ *
+ * The schema changes by migration and by nothing else, and the SQL that touches it lives in one place:
+ *
+ *   - `no-runtime-schema` (R34 `BE_SCHEMA_AUTHORITY`) refuses everything that lets the running process decide
+ *     the schema: a `synchronize` that is not the literal `false`, a `dataSource.synchronize()` call, a
+ *     `migrationsRun` that is not the literal `false`, a `CREATE|ALTER|DROP TABLE` string outside
+ *     `persistence/migrations/`, and an entity or migration glob. Only `apps/migrate` runs migrations.
+ *   - `sql-only-in-repository` (R36 `BE_SQL_OUTSIDE_REPOSITORY`) keeps raw SQL and query builders inside a
+ *     `*.repository.ts` of a `persistence/` folder, so a use case or a service never contains SQL.
+ *   - `no-entity-in-contract` (R37 `BE_ENTITY_IN_CONTRACT`) keeps ORM entities out of the types that cross a
+ *     boundary: `*.contracts.ts`, DTOs, resolver and controller signatures. A contract returns a projection.
+ */
+import { keyName, staticText, walk } from "./lib/ast.mjs"
+import { isDeclarationFile, isMigrationFile, normalizePath } from "./lib/path.mjs"
+
+const DDL = /\b(?:CREATE|ALTER|DROP)\s+TABLE\b/i
+
+const isFalse = (node) => node?.type === "Literal" && node.value === false
+
+/** The text of every string literal and template chunk under `node`. */
+const stringsUnder = (node) => {
+    const found = []
+    walk(node, (child) => {
+        if (child.type === "Literal" && typeof child.value === "string") found.push(child.value)
+        else if (child.type === "TemplateElement") found.push(child.value.cooked ?? "")
+    })
+    return found
+}
+
+/** The schema is decided by migrations run by `apps/migrate`, never by the running process. */
+export const noRuntimeSchema = {
+    meta: {
+        type: "problem",
+        docs: { description: "No synchronize, no migrationsRun in a service, no runtime DDL, no entity or migration glob." },
+        schema: [],
+        messages: {
+            synchronize: "`synchronize` is set to something other than the literal `false`. The schema changes by migration only; a boot-time ORM diff decides it otherwise.",
+            synchronizeCall: "`.synchronize()` builds the schema at runtime. Write a migration and let `apps/migrate` run it.",
+            migrationsRun: "`migrationsRun` is not the literal `false`. Only `apps/migrate` runs migrations, once per connection, before api and worker start.",
+            ddl: "A `CREATE|ALTER|DROP TABLE` string outside `persistence/migrations/`. Schema-changing SQL belongs in a migration.",
+            glob: "`{{key}}` is found by glob. List the entities and migrations explicitly from each capability's `index.ts` so what runs is what was reviewed.",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (isDeclarationFile(filename)) return {}
+        const migration = isMigrationFile(filename)
+        return {
+            Property(node) {
+                const key = keyName(node.key)
+                if (key === "synchronize" && !isFalse(node.value)) {
+                    context.report({ node, messageId: "synchronize" })
+                } else if (key === "migrationsRun" && !isFalse(node.value)) {
+                    context.report({ node, messageId: "migrationsRun" })
+                } else if ((key === "entities" || key === "migrations") && stringsUnder(node.value).some((text) => text.includes("*"))) {
+                    context.report({ node, messageId: "glob", data: { key } })
+                }
+            },
+            CallExpression(node) {
+                if (node.callee.type !== "MemberExpression" || node.callee.computed) return
+                if (node.callee.property.type === "Identifier" && node.callee.property.name === "synchronize") {
+                    context.report({ node, messageId: "synchronizeCall" })
+                }
+            },
+            Literal(node) {
+                if (!migration && typeof node.value === "string" && DDL.test(node.value)) context.report({ node, messageId: "ddl" })
+            },
+            TemplateElement(node) {
+                if (!migration && DDL.test(node.value.cooked ?? "")) context.report({ node, messageId: "ddl" })
+            },
+        }
+    },
+}
+
+const REPOSITORY_FILE = /\/persistence\/(?:[^/]+\/)*[^/]+\.repository\.[cm]?ts$/
+
+/** Raw SQL and query builders live in a `*.repository.ts` under `persistence/`, nowhere else. */
+export const sqlOnlyInRepository = {
+    meta: {
+        type: "problem",
+        docs: { description: "`.query(<sql>)` and `createQueryBuilder` only inside a persistence `*.repository.ts`." },
+        schema: [],
+        messages: {
+            sql: "Raw SQL or a query builder outside a persistence repository. Move it into the `*.repository.ts` of the owning capability's `persistence/` and call that from the use case.",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (isDeclarationFile(filename) || isMigrationFile(filename) || REPOSITORY_FILE.test(filename)) return {}
+        return {
+            CallExpression(node) {
+                const callee = node.callee
+                if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier") return
+                const name = callee.property.name
+                if (name === "createQueryBuilder") {
+                    context.report({ node, messageId: "sql" })
+                } else if (name === "query" && staticText(node.arguments[0]) !== null) {
+                    context.report({ node, messageId: "sql" })
+                } else if (name === "query" && node.arguments[0]?.type === "TemplateLiteral") {
+                    context.report({ node, messageId: "sql" })
+                }
+            },
+        }
+    },
+}
+
+/** Files whose types cross a boundary: contracts, DTOs, resolvers, controllers. */
+const BOUNDARY_FILE = /\.contracts\.[cm]?ts$|\/dto\/|\.(?:request|response|input|type|args)\.[cm]?ts$|\.(?:resolver|controller)\.[cm]?ts$/
+
+/** An ORM entity type never appears in a contract, DTO, resolver or controller signature. */
+export const noEntityInContract = {
+    meta: {
+        type: "problem",
+        docs: { description: "No `*Entity` type in a contract, DTO, resolver or controller signature." },
+        schema: [],
+        messages: {
+            entity: "`{{name}}` is an ORM entity and leaks into a boundary type. Return a projection (a plain contract type) and pass a principal id and role instead of an entity.",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (isDeclarationFile(filename) || !BOUNDARY_FILE.test(filename) || filename.includes("/persistence/")) return {}
+        return {
+            TSTypeReference(node) {
+                if (node.typeName.type === "Identifier" && /Entity$/.test(node.typeName.name)) {
+                    context.report({ node, messageId: "entity", data: { name: node.typeName.name } })
+                }
+            },
+        }
+    },
+}
+
+// -- R74 -------------------------------------------------------------------------------------------
+
+const isMigrationPath = (filename) => /\/migrations\/[^/]+\.[cm]?ts$/.test(normalizePath(filename))
+
+const methodNamed = (klass, name) =>
+    klass.body.body.find((member) => member.type === "MethodDefinition" && !member.computed && keyName(member.key) === name)
+
+/** Whether a `down` body does nothing but refuse. */
+const onlyThrows = (body) => body.body.length > 0 && body.body.every((statement) => statement.type === "ThrowStatement")
+
+/** A migration can be undone. */
+export const migrationDownReversible = {
+    meta: {
+        type: "problem",
+        docs: { description: "A migration declares a `down()` that reverses its `up()`." },
+        schema: [],
+        messages: {
+            missing: "This migration has an `up()` and no `down()`. A release that must roll back has no way to. Write `down()` as the exact inverse of `up()`.",
+            empty: "`down()` is empty, so a rollback leaves the schema changed while the migration table says it was undone. Write the inverse of `up()`.",
+            throws: "`down()` only throws. A rollback then fails halfway through a deploy. Write the inverse of `up()`; when `up()` drops data, `down()` recreates the structure and the data loss is stated in the migration's comment.",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (isDeclarationFile(filename) || !isMigrationPath(filename) || /\.(?:spec|test)\.ts$/.test(filename)) return {}
+        const check = (node) => {
+            if (!node.body) return
+            const up = methodNamed(node, "up")
+            if (!up) return
+            const down = methodNamed(node, "down")
+            if (!down) context.report({ node: node.id ?? node, messageId: "missing" })
+            else if (down.value.body.body.length === 0) context.report({ node: down.key, messageId: "empty" })
+            else if (onlyThrows(down.value.body)) context.report({ node: down.key, messageId: "throws" })
+        }
+        return { ClassDeclaration: check }
+    },
+}
+
+/** The rules this law contributes to the plugin. */
+export const rules = {
+    "no-runtime-schema": noRuntimeSchema,
+    "sql-only-in-repository": sqlOnlyInRepository,
+    "no-entity-in-contract": noEntityInContract,
+    "migration-down-reversible": migrationDownReversible,
+}
+
+/** All three start at error: HFS keeps no baseline and the schema migration lanes clear the debt first. */
+export const recommended = {
+    "starci-be/no-runtime-schema": "error",
+    "starci-be/sql-only-in-repository": "error",
+    "starci-be/no-entity-in-contract": "error",
+    "starci-be/migration-down-reversible": "error",
+}

package/size-budget.mjs

@@ -0,0 +1,106 @@
+/**
+ * The rules that hold the file size budget (catalog R20 `HFS_SIZE_GROWTH`, the file-level half).
+ *
+ * A source file has a hard-growth budget of `fileLines.hardGrowth` lines (`ruleParams.be.fileLines` of the
+ * slot manifest, read through `lib/slots.mjs`). `file-size-growth` is the ratchet and fails only on a file that must not
+ * be this long: a NEW file over the budget, or an existing file over the budget that is longer than its recorded size.
+ * The recorded size is the file's line count at the parent commit (`git show HEAD:<file>`), or an entry of the
+ * `recorded` option. A file may stay as large as it is; it may not grow, and it may not be born large.
+ *
+ * There is no soft-limit lint rule: a warning under a zero-warning gate is an exception in disguise. Listing the
+ * files over the soft budget (`fileLines.soft`) is a report item of the hfs check, never a block.
+ * There is no baseline file and no allowlist: the record is the repository's own history. A migration is exempt
+ * (it is append-only and generated), and so is every test-lane file.
+ */
+import { execFileSync } from "node:child_process"
+import { basename, dirname } from "node:path"
+import { isDeclarationFile, isMigrationFile, isTestLane, normalizePath } from "./lib/path.mjs"
+import { hfsParams } from "./lib/slots.mjs"
+
+const lineCount = (text) => {
+    const lines = text.split(/\r?\n/)
+    return lines.at(-1) === "" ? lines.length - 1 : lines.length
+}
+
+/** Whether a file is a source file this budget governs. */
+const governed = (filename) =>
+    /\.[cm]?tsx?$/.test(filename) &&
+    !isDeclarationFile(filename) &&
+    !isMigrationFile(filename) &&
+    !isTestLane(filename) &&
+    !filename.includes("/__generated__/")
+
+/**
+ * The line count of a file at a git revision, or null when the file did not exist there or git is absent.
+ *
+ * @param {string} filename - Absolute path of the file.
+ * @param {string} ref - The revision, `HEAD` by default (the parent of the commit being made).
+ * @returns {number | null} The recorded line count.
+ */
+export const recordedLines = (filename, ref = "HEAD") => {
+    try {
+        const text = execFileSync("git", ["-C", dirname(filename), "show", `${ref}:./${basename(filename)}`], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            maxBuffer: 64 * 1024 * 1024,
+        })
+        return lineCount(text)
+    } catch {
+        // no repository, no such revision, or a new file: all mean there is no recorded size to compare with
+        return null
+    }
+}
+
+const optionSchema = [
+    {
+        type: "object",
+        properties: {
+            max: { type: "integer", minimum: 1 },
+            ref: { type: "string" },
+            recorded: { type: "object", additionalProperties: { type: "integer", minimum: 0 } },
+        },
+        additionalProperties: false,
+    },
+]
+
+/** The ratchet: a file over the budget must not be new and must not grow. */
+export const fileSizeGrowth = {
+    meta: {
+        type: "problem",
+        docs: { description: "A source file over the budget is neither new nor longer than its recorded size." },
+        schema: optionSchema,
+        messages: {
+            born: "This new file has {{lines}} lines, over the budget of {{max}}. A new file starts within the budget: split it by responsibility.",
+            grew: "This file has {{lines}} lines, over the budget of {{max}}, and it was {{recorded}} at the parent commit. A file over the budget may not grow: move the new code into its own file.",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (!governed(filename)) return {}
+        const options = context.options[0] ?? {}
+        const max = options.max ?? hfsParams.fileLines.hardGrowth
+        return {
+            "Program:exit"(node) {
+                const lines = lineCount((context.sourceCode || context.getSourceCode()).text)
+                if (lines <= max) return
+                const listed = options.recorded
+                    ? Object.entries(options.recorded).find(([path]) => filename.endsWith(`/${path}`) || filename === path)
+                    : undefined
+                const recorded = listed ? listed[1] : recordedLines(context.filename || context.getFilename(), options.ref)
+                const loc = { line: 1, column: 0 }
+                if (recorded === null) context.report({ node, loc, messageId: "born", data: { lines, max } })
+                else if (lines > recorded) context.report({ node, loc, messageId: "grew", data: { lines, max, recorded } })
+            },
+        }
+    },
+}
+
+/** The rules this law contributes to the plugin. */
+export const rules = {
+    "file-size-growth": fileSizeGrowth,
+}
+
+/** The ratchet is an error. */
+export const recommended = {
+    "starci-be/file-size-growth": "error",
+}

package/spec-quality.mjs

@@ -0,0 +1,132 @@
+/**
+ * The rules that hold spec quality (catalog R48 `BE_SPEC_QUALITY`).
+ *
+ *   - `spec-no-source-read` refuses a spec that reads source files. An architecture rule is a lint rule or a
+ *     check, not a unit test that opens `src/` with `fs` and greps it; such a spec passes and fails on text, not on
+ *     behavior, and it goes stale the day a file moves.
+ *   - `spec-typed-doubles` refuses `as never` and `as unknown as X` in a spec. A double of a dependency is
+ *     `mock<T>()` (the typed helper from `@starci/jest-preset`), which fails to compile when the dependency's
+ *     shape changes; a cast keeps compiling and lies.
+ *
+ * The e2e canon rules apply to `src/tests/e2e/**` through the repository's `lint:e2e` script (run by hand, and
+ * green before an e2e conclusion is drawn); that is a matter of which globs the config names, not of a rule.
+ */
+import { walk } from "./lib/ast.mjs"
+import { isDeclarationFile, isSpecFile, normalizePath } from "./lib/path.mjs"
+
+const FS_MODULES = new Set(["fs", "node:fs", "fs/promises", "node:fs/promises"])
+const FS_READERS = new Set(["readFile", "readFileSync", "readdir", "readdirSync", "glob", "globSync", "opendir", "opendirSync", "createReadStream"])
+
+/** A path argument that leads to the repository's own source: a location of this file, the working directory, or a source folder. */
+const SOURCE_TEXT = /(?:^|[\\/])(?:src|apps|libs)(?:[\\/]|$)|\.[cm]?tsx?$/
+const SOURCE_ANCHORS = new Set(["__dirname", "__filename"])
+
+/**
+ * Whether a path expression points at source: it names `__dirname`, `import.meta`, `process.cwd()`, or a
+ * `src`, `apps` or `libs` folder or a `.ts` file. An identifier is followed once to its `const` initializer, so
+ * `const dir = join(__dirname, "x"); readdirSync(dir)` is recognised. A spec that reads the files ITS SUBJECT
+ * wrote to a temporary directory is behavior, and stays outside this rule.
+ */
+const pointsAtSource = (expression, scope, depth = 0) => {
+    if (!expression) return false
+    let found = false
+    walk(expression, (node) => {
+        if (found) return
+        if (node.type === "Identifier" && SOURCE_ANCHORS.has(node.name)) found = true
+        else if (node.type === "MetaProperty") found = true
+        else if (node.type === "MemberExpression" && node.object.type === "MetaProperty") found = true
+        else if (node.type === "CallExpression" && node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "process" && node.callee.property.name === "cwd") found = true
+        else if (node.type === "Literal" && typeof node.value === "string" && SOURCE_TEXT.test(node.value)) found = true
+        else if (node.type === "TemplateElement" && SOURCE_TEXT.test(node.value.cooked ?? "")) found = true
+        else if (node.type === "Identifier" && depth < 2) {
+            let reference = scope
+            while (reference && !reference.set.has(node.name)) reference = reference.upper
+            const definition = reference?.set.get(node.name)?.defs[0]
+            if (definition?.node.type === "VariableDeclarator" && pointsAtSource(definition.node.init, scope, depth + 1)) found = true
+        }
+    })
+    return found
+}
+
+/** A spec never opens source files to assert on their text. */
+export const specNoSourceRead = {
+    meta: {
+        type: "problem",
+        docs: { description: "A spec does not read files with fs." },
+        schema: [],
+        messages: {
+            read: "This spec reads files with `fs`. A rule about how source is written belongs in the lint canon or an architecture check; a spec asserts behavior.",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (isDeclarationFile(filename) || !isSpecFile(filename)) return {}
+        const sourceCode = context.sourceCode || context.getSourceCode()
+        const namespaces = new Set()
+        const named = new Set()
+        return {
+            ImportDeclaration(node) {
+                if (typeof node.source.value !== "string" || !FS_MODULES.has(node.source.value)) return
+                for (const specifier of node.specifiers) {
+                    if (specifier.type === "ImportSpecifier") {
+                        const imported = specifier.imported.name ?? specifier.imported.value
+                        if (FS_READERS.has(imported)) named.add(specifier.local.name)
+                        else if (imported === "promises") namespaces.add(specifier.local.name)
+                    } else {
+                        namespaces.add(specifier.local.name)
+                    }
+                }
+            },
+            CallExpression(node) {
+                const callee = node.callee
+                let reads = false
+                if (callee.type === "Identifier" && named.has(callee.name)) {
+                    reads = true
+                } else if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" && FS_READERS.has(callee.property.name)) {
+                    const object = callee.object
+                    const base = object.type === "MemberExpression" ? object.object : object
+                    reads = base.type === "Identifier" && namespaces.has(base.name)
+                }
+                if (reads && pointsAtSource(node.arguments[0], sourceCode.getScope(node))) context.report({ node, messageId: "read" })
+            },
+        }
+    },
+}
+
+/** A double is a typed `mock<T>()`, never a cast. */
+export const specTypedDoubles = {
+    meta: {
+        type: "problem",
+        docs: { description: "A spec uses `mock<T>()` for a double, not `as never` or `as unknown as X`." },
+        schema: [],
+        messages: {
+            never: "`as never` forces a value through the type system. Build the double with `mock<T>()` so it stays checked against the real dependency.",
+            doubleCast: "`as unknown as X` forces a value through the type system. Build the double with `mock<T>()` so it stays checked against the real dependency.",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (isDeclarationFile(filename) || !(isSpecFile(filename) || filename.includes("/src/tests/"))) return {}
+        return {
+            TSAsExpression(node) {
+                if (node.typeAnnotation.type === "TSNeverKeyword") {
+                    context.report({ node, messageId: "never" })
+                } else if (node.expression.type === "TSAsExpression" && node.expression.typeAnnotation.type === "TSUnknownKeyword") {
+                    context.report({ node, messageId: "doubleCast" })
+                }
+            },
+        }
+    },
+}
+
+/** The rules this law contributes to the plugin. */
+export const rules = {
+    "spec-no-source-read": specNoSourceRead,
+    "spec-typed-doubles": specTypedDoubles,
+}
+
+/** Both start at error: the migration lanes replace the casts and the source-reading specs before adoption. */
+export const recommended = {
+    "starci-be/spec-no-source-read": "error",
+    "starci-be/spec-typed-doubles": "error",
+}

package/suppression.mjs

@@ -0,0 +1,60 @@
+/**
+ * The rule that holds "no suppression anywhere" (catalog R18 `HFS_INLINE_SUPPRESSION`).
+ *
+ * `no-inline-suppression` reports every comment that switches a check off at the place it is written:
+ * `eslint-disable` in all its forms (block, line, next-line, and the matching `eslint-enable`), an
+ * `eslint <rule>: off` configuration comment, `@ts-ignore`, `@ts-expect-error`, `@ts-nocheck`, and the
+ * `vn-ok` language marker. The factory also sets `noInlineConfig: true`, so ESLint itself ignores such a
+ * comment; this rule is what turns the ignored comment into a failure a person reads, instead of a silent
+ * no-op that looks like an exemption.
+ *
+ * It replaces `no-line-suppression`, which named only the type-safety rules and so let every other rule be
+ * silenced. There is no exit here: fix the code, or propose a change to the canon.
+ */
+
+const DISABLE = /^\s*eslint-(?:disable|enable)(?:-next-line|-line)?(?:\s|$)/
+const CONFIG = /^\s*eslint\s+[@\w/-]+\s*:\s*(?:0|1|2|off|warn|error|\[)/
+const TS_DIRECTIVE = /^\s*(?:\/\s*)?@ts-(?:ignore|expect-error|nocheck)\b/
+const LANGUAGE_MARKER = /\bvn-ok\b/
+
+const kindOf = (text) => {
+    if (DISABLE.test(text) || CONFIG.test(text)) return "eslint"
+    if (TS_DIRECTIVE.test(text)) return "typescript"
+    if (LANGUAGE_MARKER.test(text)) return "vn-ok"
+    return null
+}
+
+/** No comment switches a check off at the place it is written. */
+export const noInlineSuppression = {
+    meta: {
+        type: "problem",
+        docs: { description: "No eslint-disable, ts-ignore, ts-expect-error, ts-nocheck or vn-ok comment." },
+        schema: [],
+        messages: {
+            eslint: "An `eslint-disable`/`eslint-enable` or rule-configuration comment. HFS does not switch a rule off in place: fix the code, or propose a change to the rule in the canon.",
+            typescript: "A `@ts-` directive silences the compiler at one place. Fix the type, or narrow it with a guard.",
+            "vn-ok": "A `vn-ok` marker exempts a line from the language rule. HFS keeps no exemption marker: write the text in English, or move the data to a locale or data file.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode || context.getSourceCode()
+        return {
+            "Program:exit"() {
+                for (const comment of sourceCode.getAllComments()) {
+                    const kind = kindOf(comment.value)
+                    if (kind) context.report({ loc: comment.loc, messageId: kind })
+                }
+            },
+        }
+    },
+}
+
+/** The rules this law contributes to the plugin. */
+export const rules = {
+    "no-inline-suppression": noInlineSuppression,
+}
+
+/** Error from the start: there is no baseline and no allowlist for a suppression. */
+export const recommended = {
+    "starci-be/no-inline-suppression": "error",
+}

package/temporal.mjs

@@ -0,0 +1,71 @@
+/**
+ * The rule that holds `platform/clock` (catalog R79 `BE_AMBIENT_CLOCK`).
+ *
+ *   - `no-ambient-clock` refuses `Date.now()`, a bare `new Date()` and `performance.now()` outside
+ *     `platform/clock`. Business code asks the injected `Clock` port for the time (`clock.now()`),
+ *     because a call to the ambient clock cannot be replaced in a spec - a test then either sleeps
+ *     for real or races the wall clock, and a scheduled job cannot be driven to a chosen instant.
+ *
+ * `new Date(value)` - built from a value the caller already holds (a stored timestamp, a parsed
+ * header) - is not an ambient read and is left alone; only the zero-argument form reads "now".
+ */
+import { isDeclarationFile, isTestLane, normalizePath } from "./lib/path.mjs"
+
+const PLATFORM_CLOCK = /\/src\/modules\/platform\/clock\//
+
+/** Whether a callee is `Date.now`. */
+const isDateNow = (node) =>
+    node.type === "MemberExpression" &&
+    !node.computed &&
+    node.object.type === "Identifier" &&
+    node.object.name === "Date" &&
+    node.property.type === "Identifier" &&
+    node.property.name === "now"
+
+/** Whether a callee is `performance.now`. */
+const isPerformanceNow = (node) =>
+    node.type === "MemberExpression" &&
+    !node.computed &&
+    node.object.type === "Identifier" &&
+    node.object.name === "performance" &&
+    node.property.type === "Identifier" &&
+    node.property.name === "now"
+
+/** Only `platform/clock` reads the ambient clock. */
+export const noAmbientClock = {
+    meta: {
+        type: "problem",
+        docs: { description: "`Date.now()`, a bare `new Date()` and `performance.now()` are read only inside `platform/clock`." },
+        schema: [],
+        messages: {
+            now: "`{{call}}` reads the ambient clock directly. Inject the `Clock` port (`clock.now()`) instead: a spec then drives time with a `FakeClock` and a scheduled job can be tested at a chosen instant, neither of which a direct read allows.",
+            date: "`new Date()` with no argument reads the ambient clock. Inject the `Clock` port and build the date from `clock.now()`, or - if this really is parsing a value the caller already holds - pass that value to `new Date(value)`.",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (isDeclarationFile(filename) || isTestLane(filename) || PLATFORM_CLOCK.test(filename)) return {}
+        return {
+            CallExpression(node) {
+                const { callee } = node
+                if (isDateNow(callee)) context.report({ node, messageId: "now", data: { call: "Date.now()" } })
+                else if (isPerformanceNow(callee)) context.report({ node, messageId: "now", data: { call: "performance.now()" } })
+            },
+            NewExpression(node) {
+                if (node.callee.type === "Identifier" && node.callee.name === "Date" && node.arguments.length === 0) {
+                    context.report({ node, messageId: "date" })
+                }
+            },
+        }
+    },
+}
+
+/** The rule this law contributes to the plugin. */
+export const rules = {
+    "no-ambient-clock": noAmbientClock,
+}
+
+/** Starts at error: no baseline exists, and the repositories' fix lanes clear the debt with a Clock codemod. */
+export const recommended = {
+    "starci-be/no-ambient-clock": "error",
+}