@starci/eslint-canon-fe 9.2.0 → 9.4.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 9.4.0 - 2026-10-28
+
+- Changed: the package is TypeScript. `src/**/*.ts` (rules, the shared `lib/` readers and every spec) is strict and builds to `dist/` with the `@starci/tsconfig` `package-esm` preset; `main`, `types` and `exports` point at `dist`, keeping `@starci/eslint-canon-fe/lib/*.mjs` (also `lib/*.js`). The fixture tester is `fixtures/typed/tester.ts`. The bundled runtime is read through the package import `#runtime/*`, typed by `src/types/runtime` until the runtime is built from `@starci/hfs`. Rules are typed against typescript-eslint's rule module; `@typescript-eslint/utils` joins the dependencies. No rule changed behaviour in the conversion.
+- Changed: `base-props-atom` fixes the retired `state` key by renaming it `shape`; `no-data-status-shape` also reads an `interface XShape`, an inline `shape: { ... }` object and a boolean status member (`isOpen`, `isRenewing`) in a shape, and still the old `XState` names.
+- Changed: `presentational-purity` also refuses an import from `@/hooks` in a pure half, `import type` included.
+- Added: the shape-slot law (R92): `exhaustive-shape-switch` (a pure half's branch on `props.shape` / `shape` draws every `XShape` member; no default stands in for one), `no-data-status-prop` (no `isLoading`, `isError`, `isForbidden`, `isFailed` or `failure` prop below SlotView; a leaf takes only `isSkeleton`), `region-reads-through-slot` (a connected half that calls an `*Swr` hook folds the read into a DataSlot; a pure half that takes a DataSlot renders SlotView) and `branch-intrinsic-state` (a branch keeps interaction state only; a leaf calls no hook).
+- Fixed: the built declarations name `.js`, not the `.ts` sources (`tsc` keeps a relative `.ts` specifier in a `.d.ts`).
+- Changed: the bundled canon pins follow release C (Grammar family 0.15.0, hfs 4.9.1, canon-fe 9.4.0, canon-be 3.6.0, jest-preset 2.4.1, stylelint-canon 2.2.1, tsconfig 2.1.0, prettier-config 1.1.0, and `@starci/ai-router` 0.2.1 pinned), so an app installs the released versions without pin drift.
+
+## 9.3.0 - 2026-10-28
+
+- Changed (breaking for apps): owner ruling fe-shape-not-state. A pure half takes `{ shape?, props, on? }`; `base-props-atom` refuses the retired `state` key with a message naming the rename, and `no-data-status-shape` reads `XShape` unions (and still the old `XState` names, so a status word is caught during the rename).
+- Changed: the bundled runtime copies follow the retirement of `@starci/cli`: the bundled canon pins replace the retired `@starci/cli` with `starci-harness` 1.1.0-alpha.1 (`source: cli/package.json`), the one command line a product installs for `starci app`, and follow the harness packages (Grammar family 0.14.0, hfs 4.9.0, canon-fe 9.3.0, canon-be 3.5.0); the runtime finds an app's `starci` bin in its installed `starci-harness`.
+
 ## 9.2.0 - 2026-10-27
 
 - Changed: owner ruling two-grammars: the bundled Grammar catalog declares exactly two families, `core` (`@starci/eslint-grammar-core`, `coreGrammarConfig`) and `offset-pop`; `starci`, `starci-core` and `heritage` are refused. The Grammar entry checks (button intent, control height, surface rules, UI rulings) accept `@starci/grammar/<common|core|offset-pop>`. The bundled canon pins follow the harness packages (Grammar family 0.13.0, hfs 4.8.0, canon-fe 9.2.0, canon-be 3.4.57, stylelint-canon 2.1.0).

package/README.md

@@ -24,7 +24,11 @@ bare IDs under the `starci-grammar` namespace. This package exports shared AST,
 slot and configuration infrastructure through `@starci/eslint-canon-fe/lib/*`; family packages
 import those readers without copying them.
 
-Every universal law remains gathered by `index.mjs`; its recommendation enables every rule.
+Every universal law remains gathered by `src/index.ts`; its recommendation enables every rule.
+The package is TypeScript: `src/**/*.ts` builds to `dist/` (`npm run build`), the published entry and
+the `lib/*` readers are the built files, `npm run typecheck` holds the source and specs strict, and
+`npm test` runs the specs on the source. The bundled `runtime/` is read through the package import
+`#runtime/*`.
 The `docs/` directory carries the detailed behavior of the documented laws. `why` supplies
 failure codes and English guidance for the catalogued rules.
 

package/dist/brand-values.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The rule that holds `brand-values.md` (HFS R61 `FE_STYLE_TOKEN_ONLY`, the TypeScript half; the CSS
+ * half belongs to `@starci/stylelint-canon`).
+ *
+ * ONE PLACE FOR A COLOUR. Colour values exist in `modules/brand/brand.css`, set only on the tokens
+ * the grammar declares, with a light and a dark value, and checked against the brand record. A hex
+ * in a component is a colour that has no dark value, cannot be re-branded, and drifts from the
+ * record: one repository carried three different ways to override the brand, and another 4.3k lines
+ * of hand-made CSS with a private token namespace.
+ *
+ * LENGTHS FOLLOW. A pixel length in TypeScript (`"12px"`, `{ width: 12 }` in a `style` prop) is a
+ * spacing decision that skipped the grammar's scale, so it does not move with density, zoom or a
+ * breakpoint. Spacing and sizing come from the grammar's utility tokens.
+ *
+ * WHAT IT DELIBERATELY LEAVES ALONE: a fragment identifier (`href="#top"`, `id`, `htmlFor`), a
+ * `data:` URI, a component's semantic appearance prop (a named role rather than a raw colour), and
+ * Tailwind arbitrary values (`w-[12px]`), which `no-arbitrary-value` already reports - two rules
+ * for one span would be two findings for one fix.
+ */
+import { type Recommended } from "./lib/rule.js";
+/** No raw colour, hex or pixel value outside `brand.css`. */
+export declare const noRawBrandValue: import("./lib/rule.js").Rule<"color" | "length" | "named", []>;
+/** The rules this law contributes to the plugin. */
+export declare const rules: {
+    "no-raw-brand-value": import("./lib/rule.js").Rule<"color" | "length" | "named", []>;
+};
+/** Every rule is an error. */
+export declare const recommended: Recommended;

package/dist/brand-values.js

@@ -0,0 +1,172 @@
+/**
+ * The rule that holds `brand-values.md` (HFS R61 `FE_STYLE_TOKEN_ONLY`, the TypeScript half; the CSS
+ * half belongs to `@starci/stylelint-canon`).
+ *
+ * ONE PLACE FOR A COLOUR. Colour values exist in `modules/brand/brand.css`, set only on the tokens
+ * the grammar declares, with a light and a dark value, and checked against the brand record. A hex
+ * in a component is a colour that has no dark value, cannot be re-branded, and drifts from the
+ * record: one repository carried three different ways to override the brand, and another 4.3k lines
+ * of hand-made CSS with a private token namespace.
+ *
+ * LENGTHS FOLLOW. A pixel length in TypeScript (`"12px"`, `{ width: 12 }` in a `style` prop) is a
+ * spacing decision that skipped the grammar's scale, so it does not move with density, zoom or a
+ * breakpoint. Spacing and sizing come from the grammar's utility tokens.
+ *
+ * WHAT IT DELIBERATELY LEAVES ALONE: a fragment identifier (`href="#top"`, `id`, `htmlFor`), a
+ * `data:` URI, a component's semantic appearance prop (a named role rather than a raw colour), and
+ * Tailwind arbitrary values (`w-[12px]`), which `no-arbitrary-value` already reports - two rules
+ * for one span would be two findings for one fix.
+ */
+import { isContentFile } from "./comments.js";
+import { defineRule } from "./lib/rule.js";
+/** A hex colour: 3, 4, 6 or 8 digits, not a longer word and not part of an identifier. */
+const HEX_COLOR = /(?<![\w&])#(?:[0-9a-fA-F]{8}|[0-9a-fA-F]{6}|[0-9a-fA-F]{3,4})(?![\w-])/;
+/** A functional colour notation. */
+const COLOR_FUNCTION = /\b(?:rgba?|hsla?|hwb|lab|lch|oklab|oklch|color-mix)\(/i;
+/** A pixel length, not inside an arbitrary-value bracket and not part of a longer number or word. */
+const PIXEL_LENGTH = /(?<![\w.#[-])-?(?:\d+\.?\d*|\.\d+)px\b/;
+/** Attributes whose value is a fragment or an id, where a `#abc` is not a colour. */
+const NON_COLOR_ATTRS = new Set(["href", "id", "htmlFor", "to", "name", "aria-controls", "aria-labelledby", "aria-describedby"]);
+/** SVG paint attributes: a named colour here is a raw brand value. */
+const PAINT_ATTRS = new Set(["fill", "stroke", "stopColor", "floodColor", "lightingColor"]);
+/** Style properties that take a colour. */
+const COLOR_KEYS = new Set([
+    "color",
+    "background",
+    "backgroundColor",
+    "borderColor",
+    "outlineColor",
+    "fill",
+    "stroke",
+    "caretColor",
+    "accentColor",
+    "textDecorationColor",
+]);
+/** Style properties that take a length. */
+const LENGTH_KEYS = new Set([
+    "width",
+    "height",
+    "minWidth",
+    "maxWidth",
+    "minHeight",
+    "maxHeight",
+    "top",
+    "right",
+    "bottom",
+    "left",
+    "gap",
+    "margin",
+    "marginTop",
+    "marginRight",
+    "marginBottom",
+    "marginLeft",
+    "padding",
+    "paddingTop",
+    "paddingRight",
+    "paddingBottom",
+    "paddingLeft",
+    "fontSize",
+    "borderRadius",
+    "letterSpacing",
+]);
+/** Values that carry no raw colour: a token reference or a keyword. */
+const NEUTRAL_COLOR = /^(?:var\(|inherit$|initial$|unset$|revert$|currentcolor$|transparent$|none$)/i;
+/** True when a JSX attribute name is an identifier the set holds (a namespaced name never is). */
+const namedIn = (names, name) => name.type === "JSXIdentifier" && names.has(name.name);
+/** Static string of a literal or an expression-free template, else null. */
+const staticString = (node) => {
+    if (!node)
+        return null;
+    if (node.type === "Literal" && typeof node.value === "string")
+        return node.value;
+    if (node.type === "TemplateLiteral" && node.expressions.length === 0)
+        return node.quasis[0]?.value.cooked ?? "";
+    return null;
+};
+/** No raw colour, hex or pixel value outside `brand.css`. */
+export const noRawBrandValue = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "No hex, colour function, named paint colour or px length in TypeScript; tokens only." },
+        schema: [],
+        messages: {
+            color: "A raw colour value (`{{value}}`). Colour values exist only in `modules/brand/brand.css`, on the tokens the grammar declares, with a light and a dark value. Here it has no dark value, cannot be re-branded and drifts from the brand record. Use a grammar token class or variable.",
+            length: "A raw pixel length (`{{value}}`). Spacing and size come from the grammar's scale so they move with density, zoom and breakpoint. Use a grammar utility token.",
+            named: "`{{key}}: {{value}}` puts a named colour in a style. Colour is a token, not a word: use a grammar token (`var(--...)` or a token class).",
+        },
+    },
+    create(context) {
+        if (isContentFile(context))
+            return {};
+        const source = context.sourceCode || context.getSourceCode();
+        /** Values already reported through an owner, so a string reports once. */
+        const claimed = new WeakSet();
+        /** True when a node sits inside a JSX `style={...}` attribute. */
+        const inStyleAttribute = (node) => source
+            .getAncestors(node)
+            .some((ancestor) => ancestor.type === "JSXAttribute" && ancestor.name.type === "JSXIdentifier" && ancestor.name.name === "style");
+        /** Reports the first raw value in a string, once. */
+        const scan = (node, text) => {
+            if (claimed.has(node) || typeof text !== "string" || text.startsWith("data:"))
+                return;
+            const parent = node.parent;
+            if (parent && parent.type === "JSXAttribute" && namedIn(NON_COLOR_ATTRS, parent.name))
+                return;
+            if (parent && parent.type === "JSXExpressionContainer" && parent.parent.type === "JSXAttribute") {
+                if (namedIn(NON_COLOR_ATTRS, parent.parent.name))
+                    return;
+            }
+            if (parent && (parent.type === "ImportDeclaration" || parent.type === "ExportAllDeclaration" || parent.type === "ExportNamedDeclaration"))
+                return;
+            const color = HEX_COLOR.exec(text) || COLOR_FUNCTION.exec(text);
+            if (color)
+                return context.report({ node, messageId: "color", data: { value: color[0].replace(/\($/, "(...)") } });
+            const length = PIXEL_LENGTH.exec(text);
+            if (length)
+                context.report({ node, messageId: "length", data: { value: length[0] } });
+        };
+        return {
+            Literal(node) {
+                scan(node, node.value);
+            },
+            TemplateElement(node) {
+                scan(node, node.value && node.value.cooked);
+            },
+            JSXAttribute(node) {
+                if (node.name.type !== "JSXIdentifier" || !PAINT_ATTRS.has(node.name.name))
+                    return;
+                const value = node.value && node.value.type === "JSXExpressionContainer" ? node.value.expression : node.value;
+                const text = staticString(value);
+                if (text === null || NEUTRAL_COLOR.test(text) || HEX_COLOR.test(text) || COLOR_FUNCTION.test(text))
+                    return;
+                if (value)
+                    claimed.add(value);
+                context.report({ node, messageId: "named", data: { key: node.name.name, value: text } });
+            },
+            Property(node) {
+                if (node.computed || node.key.type !== "Identifier" || !inStyleAttribute(node))
+                    return;
+                const key = node.key.name;
+                if (COLOR_KEYS.has(key)) {
+                    const text = staticString(node.value);
+                    if (text === null || NEUTRAL_COLOR.test(text) || HEX_COLOR.test(text) || COLOR_FUNCTION.test(text))
+                        return;
+                    claimed.add(node.value);
+                    context.report({ node, messageId: "named", data: { key, value: text } });
+                }
+                else if (LENGTH_KEYS.has(key) && node.value.type === "Literal" && typeof node.value.value === "number") {
+                    if (node.value.value === 0)
+                        return;
+                    claimed.add(node.value);
+                    context.report({ node: node.value, messageId: "length", data: { value: `${key}: ${node.value.value}` } });
+                }
+            },
+        };
+    },
+});
+/** The rules this law contributes to the plugin. */
+export const rules = {
+    "no-raw-brand-value": noRawBrandValue,
+};
+/** Every rule is an error. */
+export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]));

package/dist/button-intent.d.ts

@@ -0,0 +1,11 @@
+import { type Recommended } from "./lib/rule.js";
+/** Every intent law is universal across Grammar families and app editions. */
+export declare const rules: {
+    "button-intent-required": import("./lib/rule.js").Rule<"FE_BUTTON_INTENT_REQUIRED", []>;
+    "button-no-variant": import("./lib/rule.js").Rule<"FE_BUTTON_NO_VARIANT", []>;
+    "destructive-confirm-in-dialog": import("./lib/rule.js").Rule<"FE_DESTRUCTIVE_CONFIRM_IN_DIALOG", []>;
+    "single-commit-per-render": import("./lib/rule.js").Rule<"FE_SINGLE_COMMIT_PER_RENDER", []>;
+    "no-commit-in-collection-item": import("./lib/rule.js").Rule<"FE_NO_COMMIT_IN_COLLECTION_ITEM", []>;
+};
+/** All five laws reach consumers at error. */
+export declare const recommended: Recommended;

package/dist/button-intent.js

@@ -0,0 +1,361 @@
+/** CTA-6: app buttons declare consequences; Grammar owns their visual variants. */
+import { attributeValue, stringOf, walk } from "./lib/ast.js";
+import { functionOf, importOf, isFn, patternPath, unwrap, variableOf } from "./lib/bindings.js";
+import { typedPropertyStrings } from "./lib/typed-class-values.js";
+import ts from "typescript";
+import { defineRule } from "./lib/rule.js";
+/** The same-file variable definition of an identifier, or undefined. */
+const variableDefinition = (context, node) => variableOf(context, node)?.defs.find((entry) => entry.type === "Variable");
+/** The name a member expression reads: its static computed text or its identifier. */
+const memberName = (node) => (node.computed ? stringOf(node.property) : node.property.name);
+const GRAMMAR_ENTRY = /^@starci\/grammar(?:\/(?:common|core|offset-pop))?$/;
+const BUTTONS = new Set(["Button", "IconButton"]);
+const DIALOGS = new Set(["AlertDialog", "ConfirmDialog"]);
+const ITEMS = new Set(["CollectionItem", "ItemActions", "ListItem", "ListRow", "ListBox.Item", "GridList.Item", "Table.Row", "TableRow"]);
+/** The consuming TypeScript program exposes literal intents and spread properties without executing app code. */
+const typedInfo = (context, node, key) => {
+    const services = context.sourceCode.parserServices;
+    if (!services?.program || !services.esTreeNodeToTSNodeMap || !node)
+        return null;
+    const checker = services.program.getTypeChecker();
+    const source = services.esTreeNodeToTSNodeMap.get(node);
+    const owner = checker.getTypeAtLocation(source);
+    const symbol = key === undefined ? null : owner.getProperty(key);
+    if (key !== undefined && !symbol)
+        return null;
+    const type = symbol ? checker.getTypeOfSymbolAtLocation(symbol, source) : owner;
+    const members = type.isUnion() ? type.types : [type];
+    return { values: members.filter((member) => member.isStringLiteral()).map((member) => member.value), optional: Boolean(symbol && (symbol.flags & ts.SymbolFlags.Optional) !== 0) };
+};
+/** Resolve the imported Grammar role without confusing a shadowed local component with its namesake. */
+const roleOf = (context, name) => {
+    const parts = [];
+    let root = name;
+    while (root.type === "JSXMemberExpression") {
+        parts.unshift(root.property.name);
+        root = root.object;
+    }
+    if (root.type !== "JSXIdentifier")
+        return null;
+    const imported = importOf(context, root);
+    if (!imported || !GRAMMAR_ENTRY.test(imported.source))
+        return null;
+    if (imported.imported)
+        parts.unshift(imported.imported);
+    else if (!variableOf(context, root)?.defs.some((definition) => definition.node.type === "ImportNamespaceSpecifier"))
+        return null;
+    return parts.join(".");
+};
+/** Static object properties, including aliases and spreads, retain their button obligations. */
+const objectProperty = (context, input, key, seen = new Set()) => {
+    const node = unwrap(input);
+    if (!node || seen.has(node))
+        return [];
+    const next = new Set(seen).add(node);
+    if (node.type === "ObjectExpression")
+        return node.properties.flatMap((property) => {
+            if (property.type === "SpreadElement")
+                return objectProperty(context, property.argument, key, next);
+            const name = property.computed ? stringOf(property.key) : property.key.type === "Identifier" ? property.key.name : property.key.value;
+            return name === key ? [property.value] : [];
+        });
+    if (node.type === "ConditionalExpression")
+        return [node.consequent, node.alternate].flatMap((branch) => objectProperty(context, branch, key, next));
+    if (node.type === "MemberExpression") {
+        const member = memberName(node);
+        return objectProperty(context, node.object, member, next).flatMap((value) => objectProperty(context, value, key, next));
+    }
+    if (node.type !== "Identifier")
+        return [];
+    const definition = variableDefinition(context, node);
+    if (!definition)
+        return [];
+    const path = patternPath(definition.node.id, node.name);
+    if (path === null)
+        return [];
+    const values = path.reduce((entries, name) => entries.flatMap((entry) => objectProperty(context, entry, name, next)), [definition.node.init]);
+    return values.flatMap((value) => objectProperty(context, value, key, next));
+};
+/** Possible statically authored values of an intent or step; dynamic values remain TypeScript's responsibility. */
+const valuesOf = (context, input, seen = new Set()) => {
+    const node = unwrap(input);
+    if (!node || seen.has(node))
+        return [];
+    const next = new Set(seen).add(node);
+    const text = stringOf(node);
+    if (text !== null)
+        return [text];
+    if (node.type === "ConditionalExpression")
+        return [node.consequent, node.alternate].flatMap((branch) => valuesOf(context, branch, next));
+    if (node.type === "LogicalExpression")
+        return valuesOf(context, node.right, next);
+    if (node.type === "MemberExpression") {
+        const name = memberName(node);
+        const values = objectProperty(context, node.object, name, next).flatMap((value) => valuesOf(context, value, next));
+        return values.length ? values : typedInfo(context, node)?.values ?? [];
+    }
+    if (node.type !== "Identifier")
+        return typedInfo(context, node)?.values ?? [];
+    const definition = variableDefinition(context, node);
+    if (!definition)
+        return typedInfo(context, node)?.values ?? [];
+    const path = patternPath(definition.node.id, node.name);
+    if (path === null)
+        return [];
+    const values = path.reduce((entries, name) => entries.flatMap((entry) => objectProperty(context, entry, name, next)), [definition.node.init]);
+    return values.flatMap((value) => valuesOf(context, value, next));
+};
+/** An explicit attribute or statically resolved spread exposing a prop. */
+const propsOf = (context, opening, key) => opening.attributes.flatMap((entry) => {
+    if (entry.type === "JSXAttribute")
+        return entry.name.name === key ? [{ node: entry, value: attributeValue(entry) }] : [];
+    const values = objectProperty(context, entry.argument, key);
+    if (values.length)
+        return values.map((value) => ({ node: entry, value }));
+    const authored = typedPropertyStrings(context, entry.argument, key, "variant");
+    if (authored.length)
+        return authored.map((value) => ({ node: entry, text: value.text }));
+    const typed = typedInfo(context, entry.argument, key);
+    return typed ? [{ node: entry, texts: typed.values }] : [];
+});
+const hasValue = (context, opening, key, value) => propsOf(context, opening, key).some((prop) => prop.text === value || prop.texts?.includes(value) || valuesOf(context, prop.value).includes(value));
+const isButton = (context, opening) => BUTTONS.has(roleOf(context, opening.name));
+/** A conditional props spread supplies intent only when every branch supplies it. */
+const suppliesIntent = (context, input, seen = new Set()) => {
+    const node = unwrap(input);
+    if (!node || seen.has(node))
+        return false;
+    const next = new Set(seen).add(node);
+    if (node.type === "ConditionalExpression")
+        return [node.consequent, node.alternate].every((branch) => suppliesIntent(context, branch, next));
+    if (node.type === "Identifier") {
+        const definition = variableDefinition(context, node);
+        if (definition?.node.id.type === "Identifier")
+            return suppliesIntent(context, definition.node.init, next);
+        const typed = typedInfo(context, node, "intent");
+        return Boolean(typed && !typed.optional);
+    }
+    return objectProperty(context, node, "intent").length > 0 || typedPropertyStrings(context, node, "intent", "variant").length > 0;
+};
+const hasIntent = (context, opening) => opening.attributes.some((entry) => {
+    if (entry.type === "JSXSpreadAttribute")
+        return suppliesIntent(context, entry.argument);
+    if (entry.name.name !== "intent")
+        return false;
+    const value = unwrap(attributeValue(entry));
+    return value !== null && value !== undefined && !(value.type === "Literal" && value.value === null) && !(value.type === "Identifier" && value.name === "undefined");
+});
+/** JSX child render callbacks contribute content to their enclosing component render. */
+const inlineRenderCallback = (node) => node.parent?.type === "JSXExpressionContainer" && node.parent.parent?.type !== "JSXAttribute";
+const lexicalFunction = (node) => {
+    for (let current = node.parent; current; current = current.parent)
+        if (isFn(current))
+            return current;
+    return null;
+};
+/** The nearest function owns a render; a component defined in a dialog is still its own subtree. */
+const functionOwner = (node) => {
+    for (let current = node.parent; current; current = current.parent)
+        if (isFn(current) && !inlineRenderCallback(current))
+            return current;
+    return null;
+};
+/** A trigger opens a dialog and is outside its confirmation subtree. */
+const insideDialog = (context, opening) => {
+    const triggers = new Set();
+    for (let current = opening.parent; current; current = current.parent) {
+        if (isFn(current) && !inlineRenderCallback(current))
+            return false;
+        if (current.type === "JSXAttribute" && current.name.name === "trigger")
+            triggers.add(current.parent);
+        if (current.type === "JSXElement" && !triggers.has(current.openingElement) && DIALOGS.has(roleOf(context, current.openingElement.name)))
+            return true;
+    }
+    return false;
+};
+/** Normalize a condition so `ready` and `!ready` select opposite render paths. */
+const guardOf = (context, input, positive) => {
+    const node = unwrap(input);
+    if (node.type === "UnaryExpression" && node.operator === "!")
+        return guardOf(context, node.argument, !positive);
+    if (node.type === "BinaryExpression" && ["===", "==", "!==", "!="].includes(node.operator)) {
+        const literal = node.right.type === "Literal" ? node.right : node.left.type === "Literal" ? node.left : null;
+        if (literal) {
+            const selector = context.sourceCode.getText(literal === node.right ? node.left : node.right).replace(/\s+/g, "");
+            const choice = JSON.stringify(literal.value);
+            const value = node.operator.startsWith("!") ? !positive : positive;
+            return { key: `${selector}===${choice}`, value, selector, choice };
+        }
+    }
+    return { key: context.sourceCode.getText(node).replace(/\s+/g, ""), value: positive };
+};
+const constrainPath = (context, path, test, positive) => {
+    const guard = guardOf(context, test, positive);
+    path.guards.set(guard.key, guard.value);
+    if (guard.selector && guard.value)
+        path.choices.set(guard.selector, guard.choice);
+    return path;
+};
+/** Conditional intent values retain the guards selecting commit instead of flattening both alternatives. */
+const valuePaths = (context, input, seen = new Set()) => {
+    const node = unwrap(input);
+    if (!node || seen.has(node))
+        return [];
+    const next = new Set(seen).add(node);
+    if (node.type === "ConditionalExpression")
+        return [node.consequent, node.alternate].flatMap((branch, index) => valuePaths(context, branch, next).map((path) => constrainPath(context, path, node.test, index === 0)));
+    if (node.type === "Identifier") {
+        const definition = variableDefinition(context, node);
+        if (definition?.node.id.type === "Identifier")
+            return valuePaths(context, definition.node.init, next);
+    }
+    return valuesOf(context, node).includes("commit") ? [{ guards: new Map(), choices: new Map() }] : [];
+};
+/** Branch guards and return ownership identify mutually exclusive render paths. */
+const renderPath = (context, opening, owner) => {
+    const guards = new Map();
+    const choices = new Map();
+    const path = { guards, choices };
+    let returned = null;
+    let child = opening;
+    for (let current = opening.parent; current && current !== owner; current = current.parent) {
+        if (current.type === "ReturnStatement" && lexicalFunction(current) === owner)
+            returned = current;
+        if (current.type === "ConditionalExpression" && child !== current.test)
+            constrainPath(context, path, current.test, child === current.consequent);
+        if (current.type === "IfStatement" && child !== current.test)
+            constrainPath(context, path, current.test, child === current.consequent);
+        if (current.type === "LogicalExpression" && child === current.right && current.operator !== "??")
+            constrainPath(context, path, current.left, current.operator === "&&");
+        child = current;
+    }
+    return { guards, choices, returned };
+};
+const canCoexist = (left, right) => {
+    if (left.returned && right.returned && left.returned !== right.returned)
+        return false;
+    if ([...left.choices].some(([selector, choice]) => right.choices.has(selector) && right.choices.get(selector) !== choice))
+        return false;
+    return [...left.guards].every(([condition, value]) => !right.guards.has(condition) || right.guards.get(condition) === value);
+};
+/** No explicit visual prop: any authored variant, including a known props spread, is an app bypass. */
+const buttonNoVariant = defineRule({
+    meta: { type: "problem", docs: { description: "CTA-6: app buttons never choose a variant." }, schema: [], messages: {
+            FE_BUTTON_NO_VARIANT: "FE_BUTTON_NO_VARIANT: declare Button intent instead of variant; Grammar resolves the variant from intent and placement.",
+        } },
+    create(context) {
+        return { JSXOpeningElement(opening) {
+                if (!isButton(context, opening))
+                    return;
+                for (const node of new Set(propsOf(context, opening, "variant").map((prop) => prop.node)))
+                    context.report({ node, messageId: "FE_BUTTON_NO_VARIANT" });
+            } };
+    },
+});
+/** Every app button states its command's intent explicitly. */
+const buttonIntentRequired = defineRule({
+    meta: { type: "problem", docs: { description: "CTA-6: every app Button and IconButton declares intent." }, schema: [], messages: {
+            FE_BUTTON_INTENT_REQUIRED: "FE_BUTTON_INTENT_REQUIRED: Button and IconButton require intent (commit, alternative, dismiss, neutral or destructive). Choose it from the command's consequence and rank.",
+        } },
+    create(context) {
+        return { JSXOpeningElement(opening) {
+                if (isButton(context, opening) && !hasIntent(context, opening))
+                    context.report({ node: opening, messageId: "FE_BUTTON_INTENT_REQUIRED" });
+            } };
+    },
+});
+/** A destructive final press is contained by its same-file confirmation dialog. */
+const destructiveConfirmInDialog = defineRule({
+    meta: { type: "problem", docs: { description: "CTA-6: destructive confirm buttons stay inside AlertDialog or ConfirmDialog." }, schema: [], messages: {
+            FE_DESTRUCTIVE_CONFIRM_IN_DIALOG: "FE_DESTRUCTIVE_CONFIRM_IN_DIALOG: a destructive confirm belongs inside the same-file AlertDialog or ConfirmDialog subtree. The trigger uses step=\"entry\".",
+        } },
+    create(context) {
+        return { JSXOpeningElement(opening) {
+                if (!isButton(context, opening) || !hasValue(context, opening, "intent", "destructive") || !hasValue(context, opening, "step", "confirm"))
+                    return;
+                if (!insideDialog(context, opening))
+                    context.report({ node: opening, messageId: "FE_DESTRUCTIVE_CONFIRM_IN_DIALOG" });
+            } };
+    },
+});
+/** A component render exposes one next action, with exclusive branches counted separately. */
+const singleCommitPerRender = defineRule({
+    meta: { type: "problem", docs: { description: "CTA-6: at most one commit is visible in a component render." }, schema: [], messages: {
+            FE_SINGLE_COMMIT_PER_RENDER: "FE_SINGLE_COMMIT_PER_RENDER: this render contains another commit action. Keep the one next action as commit and classify its alternatives by consequence.",
+        } },
+    create(context) {
+        const owners = new Map();
+        return { JSXOpeningElement(opening) {
+                if (!isButton(context, opening) || !hasValue(context, opening, "intent", "commit"))
+                    return;
+                const owner = functionOwner(opening) ?? context.sourceCode.ast;
+                const base = renderPath(context, opening, owner);
+                const paths = propsOf(context, opening, "intent").flatMap((prop) => prop.value ? valuePaths(context, prop.value) : prop.text === "commit" || prop.texts?.includes("commit") ? [{ guards: new Map(), choices: new Map() }] : [])
+                    .map((path) => ({ returned: base.returned, guards: new Map([...base.guards, ...path.guards]), choices: new Map([...base.choices, ...path.choices]) }));
+                const prior = owners.get(owner) ?? [];
+                if (paths.some((path) => prior.some((entry) => canCoexist(entry, path))))
+                    context.report({ node: opening, messageId: "FE_SINGLE_COMMIT_PER_RENDER" });
+                prior.push(...paths);
+                owners.set(owner, prior);
+            } };
+    },
+});
+/** A repeated row's next action is alternative; the enclosing view keeps the commit. */
+const noCommitInCollectionItem = defineRule({
+    meta: { type: "problem", docs: { description: "CTA-6: collection item renders cannot expose commit actions." }, schema: [], messages: {
+            FE_NO_COMMIT_IN_COLLECTION_ITEM: "FE_NO_COMMIT_IN_COLLECTION_ITEM: collection items cannot use commit. Use alternative for an item's next action and reserve commit for the view's decision.",
+        } },
+    create(context) {
+        const reported = new Set();
+        const report = (opening) => {
+            if (!reported.has(opening) && isButton(context, opening) && hasValue(context, opening, "intent", "commit")) {
+                reported.add(opening);
+                context.report({ node: opening, messageId: "FE_NO_COMMIT_IN_COLLECTION_ITEM" });
+            }
+        };
+        const scanCallback = (callback) => {
+            if (!callback)
+                return;
+            walk(context.sourceCode, callback.body, (node) => {
+                if (isFn(node) && !inlineRenderCallback(node))
+                    return false;
+                if (node.type === "JSXOpeningElement")
+                    report(node);
+                return undefined;
+            });
+        };
+        return {
+            JSXAttribute(attribute) {
+                if (attribute.name.name === "renderCell" && roleOf(context, attribute.parent.name) === "DataTable")
+                    scanCallback(functionOf(context, attributeValue(attribute)));
+            },
+            JSXOpeningElement(opening) {
+                for (let current = opening.parent; current; current = current.parent) {
+                    if (isFn(current) && !inlineRenderCallback(current))
+                        return;
+                    if (current.type === "JSXElement" && ITEMS.has(roleOf(context, current.openingElement.name)))
+                        return report(opening);
+                }
+            },
+            CallExpression(call) {
+                const callee = unwrap(call.callee);
+                if (callee.type !== "MemberExpression")
+                    return;
+                const name = memberName(callee);
+                if (name !== "map")
+                    return;
+                scanCallback(functionOf(context, call.arguments[0]));
+            },
+        };
+    },
+});
+/** Every intent law is universal across Grammar families and app editions. */
+export const rules = {
+    "button-intent-required": buttonIntentRequired,
+    "button-no-variant": buttonNoVariant,
+    "destructive-confirm-in-dialog": destructiveConfirmInDialog,
+    "single-commit-per-render": singleCommitPerRender,
+    "no-commit-in-collection-item": noCommitInCollectionItem,
+};
+/** All five laws reach consumers at error. */
+export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]));

package/dist/callback-shape.d.ts

@@ -0,0 +1,7 @@
+import { type Recommended, type Rules } from "./lib/rule.js";
+/** A callback stays a PKCE exchange and redirect, with every side effect owned by the auth helper. */
+export declare const callbackShape: import("./lib/rule.js").Rule<"shape", []>;
+/** The rule R287 contributes to the front-end plugin. */
+export declare const rules: Rules;
+/** Every callback shape violation is an error. */
+export declare const recommended: Recommended;