@starci/eslint-canon-fe 9.2.0 → 9.4.0

package/dist/lib/hfs-view.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The shapes of the HFS view a rule reads from `settings.starci.hfs` (runtime/scripts/hfs/view.mjs builds it): the slot that
+ * owns a file, the slot definitions of the manifest and the rule parameters of the side. Only the fields the canon reads are
+ * named; the runtime objects carry more.
+ */
+/** A slot definition of the manifest (knowledge/hfs/slots.yaml), the fields the canon reads. */
+export interface HfsSlot {
+    readonly id: string;
+    readonly path: string;
+    readonly tier?: string;
+    readonly kinds?: readonly string[];
+    readonly layers?: readonly string[];
+    readonly roles?: Readonly<Record<string, string>>;
+    readonly budget?: Readonly<Record<string, number>>;
+    readonly allows?: readonly string[];
+    readonly outcomeHome?: boolean;
+}
+/** The slot that owns a path, or why none does (`status`). */
+export interface HfsClassification {
+    readonly path: string;
+    readonly status: "owned" | "forbidden" | "not-enabled" | "ambiguous" | "no-slot";
+    readonly slot?: string;
+    readonly root?: string;
+    readonly bindings?: Readonly<Record<string, string>>;
+    readonly kind?: string;
+    readonly role?: string;
+    readonly nearest?: {
+        readonly slot: string;
+        readonly matchedPrefix: string;
+    } | null;
+}
+/** What the slot that owns a file says about it under its `allows`. */
+export interface HfsAllowance {
+    readonly slot: string;
+    readonly root: string;
+    readonly relative: string;
+    readonly allowed: boolean;
+    readonly allows: readonly string[];
+}
+/** The line budget of a file: the soft limit and whether growth past it is refused. */
+export interface HfsFileLines {
+    readonly soft: number;
+    readonly hardGrowth?: boolean;
+}
+/** The rule parameters of the side (ruleParams of the manifest, merged for the profile and edition). */
+export interface HfsRuleParams {
+    readonly fileLines: HfsFileLines;
+    readonly functionLines?: number;
+    readonly [name: string]: unknown;
+}
+/** An app of the side (hfs.json sides.<side>.apps). */
+export interface HfsApp {
+    readonly name: string;
+    readonly kind: string;
+}
+/** The frozen view of one side of an app the lint factories hand their rules. */
+export interface HfsView {
+    readonly repoRoot: string;
+    readonly profile: string;
+    readonly side: string | null;
+    readonly edition: string;
+    readonly grammar?: string;
+    readonly apps: readonly HfsApp[];
+    readonly connections: readonly unknown[];
+    readonly patterns: readonly string[];
+    readonly ruleParams: HfsRuleParams;
+    relative(file: string): string;
+    classify(file: string): HfsClassification;
+    slotOf(file: string): string | null;
+    tierOf(file: string): string | null;
+    ownerOf(file: string): string | null;
+    allows(file: string): HfsAllowance | null;
+    slot(id: string): HfsSlot | null;
+}

package/dist/lib/hfs-view.js

@@ -0,0 +1,6 @@
+/**
+ * The shapes of the HFS view a rule reads from `settings.starci.hfs` (runtime/scripts/hfs/view.mjs builds it): the slot that
+ * owns a file, the slot definitions of the manifest and the rule parameters of the side. Only the fields the canon reads are
+ * named; the runtime objects carry more.
+ */
+export {};

package/dist/lib/hfs.d.ts

@@ -0,0 +1,34 @@
+import type { HfsClassification, HfsSlot, HfsView } from "./hfs-view.js";
+import type { AnyContext } from "./rule.js";
+export type { HfsAllowance, HfsApp, HfsClassification, HfsRuleParams, HfsSlot, HfsView } from "./hfs-view.js";
+/**
+ * The HFS view of the side whose `eslint.config.mjs` (in fe/) calls this.
+ *
+ * @param configUrl - `import.meta.url` of the repository's `eslint.config.mjs`.
+ * @returns The frozen HFS view.
+ */
+export declare const loadHfs: (configUrl: string | URL) => HfsView;
+/**
+ * The HFS view of the fe side of an in-memory app declaration, for rule tests.
+ *
+ * @param declaration - An app `hfs.json` object.
+ * @param repoRoot - The absolute fe side folder the linted filenames live under.
+ * @returns The frozen HFS view.
+ */
+export declare const hfsFromDeclaration: (declaration: unknown, repoRoot: string) => HfsView;
+/** True for a value that carries the view's resolver (`slotOf`), the test the canon has always made of `settings.starci.hfs`. */
+export declare const isHfsView: (value: unknown) => value is HfsView;
+/**
+ * The HFS view a rule runs under; a rule that needs it and gets none refuses to guess.
+ *
+ * @param context - The ESLint rule context.
+ * @returns The HFS view from `settings.starci.hfs`.
+ */
+export declare const hfsOf: (context: AnyContext) => HfsView;
+/**
+ * The root of a classification the caller already knows is owned: a rule asks for it only after its scope test placed the
+ * file in a slot, so a missing root is a broken manifest and stops the run, as reading it always has.
+ */
+export declare const requiredRoot: (found: HfsClassification) => string;
+/** A slot the manifest always declares (`fe.app.next`, `fe.package.ui`, ...): a missing one is a broken manifest and stops the run. */
+export declare const requiredSlot: (slot: HfsSlot | null, id: string) => HfsSlot;

package/dist/lib/hfs.js

@@ -0,0 +1,72 @@
+/**
+ * The one door between the front-end lint rules and the HFS slot manifest of the repository being linted.
+ *
+ * A consuming `eslint.config.mjs` is the managed one-liner `export default starciFeConfig({ hfs: loadHfs(import.meta.url) })`.
+ * The config lives in the fe/ side folder of an app; `loadHfs` finds the app-root `hfs.json` one level up and gives every file
+ * linted under that folder the view of the fe side (paths relative to fe/), with the slot manifest this package ships in
+ * `runtime/` (a byte copy of the runtime's `knowledge/hfs/slots.yaml`, `scripts/hfs/slots.mjs` and
+ * `scripts/hfs/view.mjs`, refreshed by `scripts/hfs/sync-runtime.mjs`), and returns the view the factory puts
+ * in `settings.starci.hfs`.
+ *
+ * Every path-scoped rule asks `slotOf` / `tierOf` here instead of testing a path with a regular expression. A rule that
+ * needs the view and finds none stops the lint run with an error naming the fix: a rule must not guess.
+ */
+import { dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { declaredHfsView, openHfsView } from "#runtime/scripts/hfs/view.mjs";
+import { RUNTIME_ROOT } from "./package-root.js";
+const RUNTIME = RUNTIME_ROOT;
+/**
+ * The HFS view of the side whose `eslint.config.mjs` (in fe/) calls this.
+ *
+ * @param configUrl - `import.meta.url` of the repository's `eslint.config.mjs`.
+ * @returns The frozen HFS view.
+ */
+export const loadHfs = (configUrl) => openHfsView({ runtimeRoot: RUNTIME, repoRoot: dirname(fileURLToPath(configUrl)) });
+/**
+ * The HFS view of the fe side of an in-memory app declaration, for rule tests.
+ *
+ * @param declaration - An app `hfs.json` object.
+ * @param repoRoot - The absolute fe side folder the linted filenames live under.
+ * @returns The frozen HFS view.
+ */
+export const hfsFromDeclaration = (declaration, repoRoot) => declaredHfsView({ runtimeRoot: RUNTIME, declaration, repoRoot, side: "fe" });
+/** True for a value that carries the view's resolver (`slotOf`), the test the canon has always made of `settings.starci.hfs`. */
+export const isHfsView = (value) => typeof value === "object" && value !== null && "slotOf" in value && typeof value.slotOf === "function";
+/** The `starci.hfs` entry of a settings object, read without trusting its shape. */
+const settingsHfs = (settings) => {
+    if (typeof settings !== "object" || settings === null || !("starci" in settings))
+        return undefined;
+    const starci = settings.starci;
+    if (typeof starci !== "object" || starci === null || !("hfs" in starci))
+        return undefined;
+    return starci.hfs;
+};
+/**
+ * The HFS view a rule runs under; a rule that needs it and gets none refuses to guess.
+ *
+ * @param context - The ESLint rule context.
+ * @returns The HFS view from `settings.starci.hfs`.
+ */
+export const hfsOf = (context) => {
+    const hfs = settingsHfs(context.settings);
+    if (!isHfsView(hfs)) {
+        throw new Error(`${context.id ?? "a starci-fe rule"} needs settings.starci.hfs: lint through starciFeConfig({ hfs: loadHfs(import.meta.url) })`);
+    }
+    return hfs;
+};
+/**
+ * The root of a classification the caller already knows is owned: a rule asks for it only after its scope test placed the
+ * file in a slot, so a missing root is a broken manifest and stops the run, as reading it always has.
+ */
+export const requiredRoot = (found) => {
+    if (found.root === undefined)
+        throw new TypeError(`no slot root for ${found.path} (${found.status})`);
+    return found.root;
+};
+/** A slot the manifest always declares (`fe.app.next`, `fe.package.ui`, ...): a missing one is a broken manifest and stops the run. */
+export const requiredSlot = (slot, id) => {
+    if (slot === null)
+        throw new TypeError(`the slot manifest declares no ${id}`);
+    return slot;
+};

package/dist/lib/next.d.ts

@@ -0,0 +1,4 @@
+/** The exports Next.js reserves in a route segment file. */
+export declare const NEXT_RESERVED_EXPORTS: ReadonlySet<string>;
+/** The stems of Next.js route segment files. */
+export declare const NEXT_ROUTE_SEGMENT_STEMS: ReadonlySet<string>;

package/dist/lib/next.js

@@ -0,0 +1,10 @@
+/**
+ * Next.js's own contract for route segment files, read from the runtime's one statement of it
+ * (`scripts/lib/next-contract.mjs`, shipped in `runtime/` by `scripts/hfs/sync-runtime.mjs`), so every law
+ * holds the same list by construction.
+ */
+import { NEXT_RESERVED_EXPORTS as RESERVED, NEXT_ROUTE_SEGMENT_STEMS as STEMS } from "#runtime/scripts/lib/next-contract.mjs";
+/** The exports Next.js reserves in a route segment file. */
+export const NEXT_RESERVED_EXPORTS = RESERVED;
+/** The stems of Next.js route segment files. */
+export const NEXT_ROUTE_SEGMENT_STEMS = STEMS;

package/dist/lib/own-hook-origin.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Resolve a `use*` import that comes from the app's own hooks folders (`hooks/swr`, `hooks/<domain>`, `hooks/zustand/<store>`...) by
+ * TypeScript symbol resolution, never by the spelling of the name (R56 `FE_HOOKS_ARE_HOOKS`, owner ruling 2026-10-16 "Theo y tro").
+ *
+ * A composite product hook is built from the hooks beneath it: `hooks/<domain>/use<Name>.ts` composes the `use{Query,Mutate}<X>Swr`
+ * wrappers of `hooks/swr`. The import is followed through barrels and re-exports to the declaration, and counts only when that declaration
+ * is a `use*` value that lives in a `hooks/` folder of the app (never in `node_modules`). The hook's own file is judged by this same
+ * rule when it is linted, so a fake one is refused where it is written.
+ */
+import type { TSESLint } from "@typescript-eslint/utils";
+import ts from "typescript";
+import type { AnyContext } from "./rule.js";
+/** The definition of an import binding. */
+export type ImportBindingDefinition = TSESLint.Scope.Definitions.ImportBindingDefinition;
+export declare function reaching(program: ts.Program, filename: string, targetFile: string): ts.Program;
+/** True when the import binding is a runtime `use*` import that resolves to a hook declared in a `hooks/` folder of the app. */
+export declare function importedOwnHook(context: AnyContext, definition: ImportBindingDefinition): boolean;

package/dist/lib/own-hook-origin.js

@@ -0,0 +1,52 @@
+import ts from "typescript";
+import { programFor } from "./program-for.js";
+const HOOKS_FOLDER = /(^|\/)hooks\//;
+const isHookName = (name) => /^use[A-Z0-9]/.test(name);
+/** The program that holds the import target: the project program has it; a program rooted at the linted file alone (its disk text may differ from the linted text) is widened with it. */
+const widened = new WeakMap();
+export function reaching(program, filename, targetFile) {
+    if (program.getSourceFile(targetFile))
+        return program;
+    const key = `${filename}\0${targetFile}`;
+    const cache = widened.get(program) ?? new Map();
+    widened.set(program, cache);
+    const known = cache.get(key);
+    if (known !== undefined)
+        return known;
+    const created = ts.createProgram([filename, targetFile], program.getCompilerOptions());
+    cache.set(key, created);
+    return created;
+}
+/** A declaration of a hook value: a function or a variable, not a type, interface, class or enum. */
+const hookValue = (declaration) => ts.isFunctionDeclaration(declaration) || ts.isVariableDeclaration(declaration);
+const inAppHooksFolder = (file) => {
+    const fileName = file.fileName.replaceAll("\\", "/");
+    return !fileName.includes("/node_modules/") && !file.isDeclarationFile && HOOKS_FOLDER.test(fileName);
+};
+/** True when the import binding is a runtime `use*` import that resolves to a hook declared in a `hooks/` folder of the app. */
+export function importedOwnHook(context, definition) {
+    const specifier = definition.node;
+    const parent = definition.parent;
+    if (specifier.type !== "ImportSpecifier" || parent.importKind === "type" || specifier.importKind === "type")
+        return false;
+    // an import specifier always sits in an import declaration
+    if (parent.type !== "ImportDeclaration")
+        return false;
+    const name = specifier.imported.type === "Identifier" ? specifier.imported.name : specifier.imported.value;
+    if (!isHookName(name))
+        return false;
+    const source = String(parent.source.value);
+    const base = programFor(context);
+    const target = ts.resolveModuleName(source, context.filename, base.getCompilerOptions(), ts.sys).resolvedModule;
+    if (!target || target.isExternalLibraryImport)
+        return false;
+    const program = reaching(base, context.filename, target.resolvedFileName);
+    const file = program.getSourceFile(target.resolvedFileName);
+    const checker = program.getTypeChecker();
+    const moduleSymbol = file && checker.getSymbolAtLocation(file);
+    const exported = moduleSymbol ? checker.getExportsOfModule(moduleSymbol).find((symbol) => symbol.name === name) : undefined;
+    if (!exported)
+        return false;
+    const symbol = (exported.flags & ts.SymbolFlags.Alias) !== 0 ? checker.getAliasedSymbol(exported) : exported;
+    return (symbol.declarations ?? []).some((declaration) => hookValue(declaration) && inAppHooksFolder(declaration.getSourceFile()));
+}

package/dist/lib/package-root.d.ts

@@ -0,0 +1,4 @@
+/** The folder holding this package's package.json. */
+export declare const PACKAGE_ROOT: string;
+/** The bundled runtime the canon reads the slot manifest, the architecture machine and its catalogs from. */
+export declare const RUNTIME_ROOT: string;

package/dist/lib/package-root.js

@@ -0,0 +1,10 @@
+/**
+ * The package's own root, the same from the TypeScript source (`src/lib`) and from the build (`dist/lib`): both sit two
+ * levels below it, so every file the package reads beside its code (the bundled `runtime/`, the fixtures) resolves here.
+ */
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+/** The folder holding this package's package.json. */
+export const PACKAGE_ROOT = fileURLToPath(new URL("../..", import.meta.url));
+/** The bundled runtime the canon reads the slot manifest, the architecture machine and its catalogs from. */
+export const RUNTIME_ROOT = join(PACKAGE_ROOT, "runtime");

package/dist/lib/path.d.ts

@@ -0,0 +1,2 @@
+/** Forward-slash form of a filename, so Windows paths compare like every other path. */
+export declare const normalizePath: (filename: unknown) => string;

package/{lib/path.mjs → dist/lib/path.js}

@@ -1,2 +1,2 @@
 /** Forward-slash form of a filename, so Windows paths compare like every other path. */
-export const normalizePath = (filename) => String(filename || "").replace(/\\/g, "/")
+export const normalizePath = (filename) => String(filename || "").replace(/\\/g, "/");

package/dist/lib/platform.d.ts

@@ -0,0 +1,26 @@
+import type { TSESTree } from "@typescript-eslint/utils";
+import type { AnyContext, Node } from "./rule.js";
+/**
+ * True when the symbol at a node (an identifier, or the property of a member access) is declared by the platform.
+ *
+ * @param {object} context - The ESLint rule context.
+ * @param {object} node - An ESTree identifier, or a member expression (its property is asked).
+ * @returns {boolean} Whether every declaration of the symbol is a platform (global, ambient) declaration.
+ */
+export declare const isPlatform: (context: AnyContext, node: TSESTree.Identifier | TSESTree.MemberExpression | TSESTree.JSXIdentifier) => boolean;
+/**
+ * True when the type of an expression carries no information (`any`, `unknown` or an error type).
+ *
+ * @param {object} context - The ESLint rule context.
+ * @param {object} node - An ESTree expression.
+ * @returns {boolean} Whether the checker could not decide what the expression is.
+ */
+export declare const isUnresolvedType: (context: AnyContext, node: Node) => boolean;
+/**
+ * The property names of the type of an expression, after union members are read.
+ *
+ * @param {object} context - The ESLint rule context.
+ * @param {object} node - An ESTree expression.
+ * @returns {Set<string>} The names of the properties every member of the type could carry.
+ */
+export declare const propertyNamesOf: (context: AnyContext, node: Node) => Set<string>;

package/{lib/platform.mjs → dist/lib/platform.js}

@@ -3,19 +3,19 @@
  * TypeScript symbol it binds to is declared in a default library file or in an ambient global declaration, so a local
  * function that happens to be called `setTimeout` or `fetch` is not mistaken for the browser's.
  */
-import ts from "typescript"
-import { typed } from "./types.mjs"
-
+import ts from "typescript";
+import { typed } from "./types.js";
 /** True when a declaration sits in the default lib, in a global script declaration file, or in a `declare global` block. */
 const isGlobalDeclaration = (program, declaration) => {
-  const file = declaration.getSourceFile()
-  if (program.isSourceFileDefaultLibrary(file)) return true
-  for (let current = declaration.parent; current; current = current.parent) {
-    if (ts.isModuleDeclaration(current) && current.flags & ts.NodeFlags.GlobalAugmentation) return true
-  }
-  return file.isDeclarationFile && !ts.isExternalModule(file)
-}
-
+    const file = declaration.getSourceFile();
+    if (program.isSourceFileDefaultLibrary(file))
+        return true;
+    for (let current = declaration.parent; current; current = current.parent) {
+        if (ts.isModuleDeclaration(current) && (current.flags & ts.NodeFlags.GlobalAugmentation) !== 0)
+            return true;
+    }
+    return file.isDeclarationFile && !ts.isExternalModule(file);
+};
 /**
  * True when the symbol at a node (an identifier, or the property of a member access) is declared by the platform.
  *
@@ -24,15 +24,15 @@ const isGlobalDeclaration = (program, declaration) => {
  * @returns {boolean} Whether every declaration of the symbol is a platform (global, ambient) declaration.
  */
 export const isPlatform = (context, node) => {
-  const { program, checker, toTs } = typed(context)
-  const target = node.type === "MemberExpression" ? node.property : node
-  const tsNode = toTs(target)
-  if (!tsNode) return false
-  const symbol = checker.getSymbolAtLocation(tsNode)
-  const declarations = symbol?.getDeclarations?.() ?? []
-  return declarations.length > 0 && declarations.every((declaration) => isGlobalDeclaration(program, declaration))
-}
-
+    const { program, checker, toTs } = typed(context);
+    const target = node.type === "MemberExpression" ? node.property : node;
+    const tsNode = toTs(target);
+    if (!tsNode)
+        return false;
+    const symbol = checker.getSymbolAtLocation(tsNode);
+    const declarations = symbol?.getDeclarations() ?? [];
+    return declarations.length > 0 && declarations.every((declaration) => isGlobalDeclaration(program, declaration));
+};
 /**
  * True when the type of an expression carries no information (`any`, `unknown` or an error type).
  *
@@ -41,13 +41,13 @@ export const isPlatform = (context, node) => {
  * @returns {boolean} Whether the checker could not decide what the expression is.
  */
 export const isUnresolvedType = (context, node) => {
-  const { checker, toTs } = typed(context)
-  const tsNode = toTs(node)
-  if (!tsNode) return true
-  const type = checker.getTypeAtLocation(tsNode)
-  return Boolean(type.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown))
-}
-
+    const { checker, toTs } = typed(context);
+    const tsNode = toTs(node);
+    if (!tsNode)
+        return true;
+    const type = checker.getTypeAtLocation(tsNode);
+    return Boolean(type.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown));
+};
 /**
  * The property names of the type of an expression, after union members are read.
  *
@@ -56,11 +56,14 @@ export const isUnresolvedType = (context, node) => {
  * @returns {Set<string>} The names of the properties every member of the type could carry.
  */
 export const propertyNamesOf = (context, node) => {
-  const { checker, toTs } = typed(context)
-  const tsNode = toTs(node)
-  const names = new Set()
-  if (!tsNode) return names
-  const type = checker.getTypeAtLocation(tsNode)
-  for (const part of type.isUnion?.() ? type.types : [type]) for (const property of part.getProperties?.() ?? []) names.add(property.getName())
-  return names
-}
+    const { checker, toTs } = typed(context);
+    const tsNode = toTs(node);
+    const names = new Set();
+    if (!tsNode)
+        return names;
+    const type = checker.getTypeAtLocation(tsNode);
+    for (const part of type.isUnion() ? type.types : [type])
+        for (const property of part.getProperties())
+            names.add(property.getName());
+    return names;
+};

package/dist/lib/program-for.d.ts

@@ -0,0 +1,5 @@
+/** The TypeScript program a rule resolves symbols through: the lint run's own when typed linting is on, else one rooted at the linted file. */
+import ts from "typescript";
+import type { AnyContext } from "./rule.js";
+/** The program for a rule context; a program built here is remembered per context. */
+export declare function programFor(context: AnyContext): ts.Program;

package/dist/lib/program-for.js

@@ -0,0 +1,23 @@
+/** The TypeScript program a rule resolves symbols through: the lint run's own when typed linting is on, else one rooted at the linted file. */
+import ts from "typescript";
+import path from "node:path";
+const programs = new WeakMap();
+/** The program for a rule context; a program built here is remembered per context. */
+export function programFor(context) {
+    const remembered = programs.get(context);
+    if (remembered !== undefined)
+        return remembered;
+    const services = context.sourceCode?.parserServices;
+    if (services?.program)
+        return services.program;
+    const filename = context.filename;
+    const configPath = ts.findConfigFile(path.dirname(filename), ts.sys.fileExists);
+    let options = { moduleResolution: ts.ModuleResolutionKind.Bundler, module: ts.ModuleKind.ESNext };
+    if (configPath) {
+        const config = ts.readConfigFile(configPath, ts.sys.readFile);
+        options = { ...options, ...ts.parseJsonConfigFileContent(config.config, ts.sys, path.dirname(configPath)).options };
+    }
+    const program = ts.createProgram([filename], options);
+    programs.set(context, program);
+    return program;
+}

package/dist/lib/pure-owner-helper.d.ts

@@ -0,0 +1,10 @@
+import type { AnyContext } from "./rule.js";
+/**
+ * What an import of the callback's owner modules is: `"pure"` (a pure text-returning helper), `"routes"` (a static route table) or null.
+ *
+ * @param context - The ESLint rule context.
+ * @param source - The import specifier.
+ * @param name - The imported name.
+ * @returns The kind.
+ */
+export declare function ownerExportKind(context: AnyContext, source: string, name: string): "pure" | "routes" | null;

package/dist/lib/pure-owner-helper.js

@@ -0,0 +1,156 @@
+/**
+ * The owner exports an auth callback may use besides the exchange (R287 `FE_CALLBACK_SHAPE`, owner ruling `auth-callback-pure-helpers`,
+ * 2026-10-17 "Theo y tro"): a PURE helper of the app's `modules/routes` or `modules/auth` that computes the redirect target or validates
+ * `next`, and a static route table. Both are found by TypeScript symbol resolution to the declaration, never by the spelling of the name.
+ *
+ * A pure helper is a synchronous function that returns text (or null), holds no `await` or `yield`, reaches no I/O global (network, storage,
+ * DOM, `process`, `require`, `console`) and calls only locals, language built-ins and other pure helpers of `modules/routes` or
+ * `modules/auth` (followed through barrels). `modules/config` is the environment owner: a call to its readers is a configuration read, not I/O.
+ * Anything else it imports, a library value included, makes it impure.
+ */
+import ts from "typescript";
+import { reaching } from "./own-hook-origin.js";
+import { programFor } from "./program-for.js";
+import { resolveImport } from "./scope.js";
+/** Globals that reach the network, storage, the page, the process or the console. */
+const IO_GLOBALS = new Set(["fetch", "XMLHttpRequest", "WebSocket", "EventSource", "Request", "navigator", "localStorage", "sessionStorage", "indexedDB", "document", "window", "self", "globalThis", "process", "require", "console", "setTimeout", "setInterval", "queueMicrotask", "Worker", "BroadcastChannel"]);
+const OWNER_FILE = /\/modules\/(?:routes|auth)(?:\/|\.tsx?$)/;
+const CONFIG_FILE = /\/modules\/config(?:\/|\.tsx?$)/;
+const EXTENSIONS = ["", ".ts", ".tsx", "/index.ts", "/index.tsx"];
+const normal = (file) => file.fileName.replaceAll("\\", "/");
+/** The module file an import specifier names, or null when none exists on disk. */
+const moduleFile = (context, source) => {
+    const target = resolveImport(context, source);
+    if (target === null)
+        return null;
+    return EXTENSIONS.map((extension) => `${target}${extension}`).find((candidate) => ts.sys.fileExists(candidate)) ?? null;
+};
+/** The declaration an export of the module resolves to, after barrels and re-exports. */
+const exportedDeclaration = (context, source, name) => {
+    const file = moduleFile(context, source);
+    if (file === null)
+        return null;
+    const program = reaching(programFor(context), context.filename, file);
+    const checker = program.getTypeChecker();
+    const sourceFile = program.getSourceFile(file);
+    const moduleSymbol = sourceFile ? checker.getSymbolAtLocation(sourceFile) : undefined;
+    const exported = moduleSymbol ? checker.getExportsOfModule(moduleSymbol).find((symbol) => symbol.name === name) : undefined;
+    if (!exported)
+        return null;
+    const symbol = (exported.flags & ts.SymbolFlags.Alias) !== 0 ? checker.getAliasedSymbol(exported) : exported;
+    return { checker, declaration: symbol.declarations?.[0] ?? null };
+};
+/** Strip `as`, `satisfies` and parentheses. */
+const bare = (node) => {
+    let current = node;
+    while (current && (ts.isAsExpression(current) || ts.isSatisfiesExpression(current) || ts.isParenthesizedExpression(current)))
+        current = current.expression;
+    return current;
+};
+/** The function-like node of a function declaration or of a variable initialised with an arrow or function expression. */
+const functionOf = (declaration) => {
+    if (ts.isFunctionDeclaration(declaration))
+        return declaration;
+    const init = ts.isVariableDeclaration(declaration) ? bare(declaration.initializer) : undefined;
+    return init !== undefined && (ts.isArrowFunction(init) || ts.isFunctionExpression(init)) ? init : null;
+};
+const isInside = (node, root) => node.getSourceFile() === root.getSourceFile() && node.pos >= root.pos && node.end <= root.end;
+/** Whether an identifier names a declaration, a property or a member rather than referring to a binding. */
+const isNameOnly = (node) => {
+    const parent = node.parent;
+    if (ts.isPropertyAccessExpression(parent))
+        return parent.name === node;
+    if (ts.isPropertyAssignment(parent) || ts.isMethodDeclaration(parent) || ts.isPropertySignature(parent))
+        return parent.name === node;
+    return (ts.isParameter(parent) || ts.isVariableDeclaration(parent) || ts.isFunctionDeclaration(parent) || ts.isBindingElement(parent)) && parent.name === node;
+};
+/** A declaration of another file: an owner helper is followed, the environment owner is a leaf, everything else is impure. */
+const foreignPure = (env, declaration, root) => {
+    const file = normal(declaration.getSourceFile());
+    if (CONFIG_FILE.test(file))
+        return true;
+    if (!OWNER_FILE.test(file) || declaration.getSourceFile().isDeclarationFile)
+        return false;
+    return declarationPure(env, declaration, root);
+};
+/** A global of the language or of the lib files is pure unless it reaches I/O. */
+const globalPure = (symbol) => !IO_GLOBALS.has(symbol.getName());
+/** Whether one identifier reference stays inside the pure surface. */
+const referencePure = (env, node, root) => {
+    const symbol = env.checker.getSymbolAtLocation(node);
+    if (!symbol)
+        return node.text === "undefined";
+    const target = (symbol.flags & ts.SymbolFlags.Alias) !== 0 ? env.checker.getAliasedSymbol(symbol) : symbol;
+    const declarations = target.declarations ?? [];
+    if (declarations.length === 0)
+        return node.text === "undefined";
+    return declarations.every((declaration) => {
+        const file = declaration.getSourceFile();
+        if (isInside(declaration, root))
+            return true;
+        if (!ts.isExternalModule(file))
+            return globalPure(target);
+        return foreignPure(env, declaration, root);
+    });
+};
+/** Walk a node: no await or yield, no impure reference; type positions are not behaviour. */
+const nodePure = (env, node, root) => {
+    if (ts.isAwaitExpression(node) || ts.isYieldExpression(node))
+        return false;
+    if (ts.isTypeNode(node) && !ts.isExpressionWithTypeArguments(node))
+        return true;
+    if (ts.isIdentifier(node) && !isNameOnly(node) && !referencePure(env, node, root))
+        return false;
+    return ts.forEachChild(node, (child) => (nodePure(env, child, root) ? undefined : true)) !== true;
+};
+/** A declaration is pure when its function (or its constant initialiser) is. */
+function declarationPure(env, declaration, _root) {
+    if (env.seen.has(declaration))
+        return true;
+    env.seen.add(declaration);
+    const fn = functionOf(declaration);
+    if (fn)
+        return !("asteriskToken" in fn && fn.asteriskToken) && !fn.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) && (fn.body ? nodePure(env, fn.body, fn) : false);
+    if (ts.isVariableDeclaration(declaration) && declaration.initializer)
+        return nodePure(env, declaration.initializer, declaration.initializer);
+    return false;
+}
+/** Whether a function's declared or inferred return type is text, null or undefined. */
+const returnsText = (checker, declaration) => {
+    const signature = checker.getSignaturesOfType(checker.getTypeAtLocation(declaration), ts.SignatureKind.Call)[0];
+    if (!signature)
+        return false;
+    const type = checker.getReturnTypeOfSignature(signature);
+    const parts = type.isUnion() ? type.types : [type];
+    return parts.every((part) => (part.flags & (ts.TypeFlags.StringLike | ts.TypeFlags.Null | ts.TypeFlags.Undefined)) !== 0);
+};
+/** A static table: a constant object whose leaves are string literals or plain templates. */
+const isStaticTable = (node) => {
+    const value = bare(node);
+    if (!value)
+        return false;
+    if (ts.isStringLiteralLike(value))
+        return true;
+    if (ts.isObjectLiteralExpression(value))
+        return value.properties.every((property) => ts.isPropertyAssignment(property) && isStaticTable(property.initializer));
+    return false;
+};
+/**
+ * What an import of the callback's owner modules is: `"pure"` (a pure text-returning helper), `"routes"` (a static route table) or null.
+ *
+ * @param context - The ESLint rule context.
+ * @param source - The import specifier.
+ * @param name - The imported name.
+ * @returns The kind.
+ */
+export function ownerExportKind(context, source, name) {
+    const found = exportedDeclaration(context, source, name);
+    if (!found?.declaration)
+        return null;
+    const { checker, declaration } = found;
+    if (ts.isVariableDeclaration(declaration) && !functionOf(declaration))
+        return (declaration.parent.flags & ts.NodeFlags.Const) !== 0 && isStaticTable(declaration.initializer) ? "routes" : null;
+    const fn = functionOf(declaration);
+    const env = { checker, seen: new Set() };
+    return fn !== null && returnsText(checker, fn) && declarationPure(env, declaration, fn) ? "pure" : null;
+}