@starci/eslint-canon-fe 9.2.0 → 9.4.0

package/drawing.mjs

@@ -1,315 +0,0 @@
-/**
- * The rules that hold the drawing law (the `drawing` slot role: a surface's pure `component.tsx`).
- *
- * TWO AXES, AND ONLY ONE IS DRAWN. A surface's `state` is its SHAPE: a layout the owner approves as
- * one drawing. A slot's data status (loading, forbidden, error, empty) is not a shape; it is a
- * status recipe applied per resource, and it is never a drawn shape. Mixing the two is what made
- * every block ship four hand-drawn variants that disagreed with each other.
- *
- * THE PURE HALF TAKES ATOMS. `component.tsx` receives `{ state, props, on }`: `props` is data
- * (strings, numbers, booleans, arrays, plain objects), `on` is actions whose arguments are data,
- * and feature composition may also take named `render` callbacks inside `props` to render supplied
- * blocks. A layout alone also takes `children`, because the router puts the page there.
- *
- * ONLY ITS OWN INDEX MAY IMPORT IT. Other tiers use the connected export, so the pure half stays a
- * private drawing surface that audit can render from a fixture.
- *
- * Every rule reads one file. Types imported from elsewhere are trusted as data; only names this
- * file declares are followed, which is exact for the tree the convention produces and silent,
- * never wrong, beyond it.
- */
-
-import { classifyImport, roleOfFile } from "./lib/scope.mjs"
-
-import { inSplitTier, pureHalf } from "./lib/drawing-scope.mjs"
-
-/** Type names that carry a rendered tree rather than data. */
-const NON_ATOM_TYPE = /^(?:ReactNode|ReactElement|ReactPortal|JSX\.Element|Element|ComponentType|FC|FunctionComponent|ElementType|ComponentProps|RenderFunction)$/
-
-/** Feature composition's render callbacks return a rendered value and take only data. */
-const RENDER_RESULT_TYPE = /^(?:ReactNode|ReactElement|JSX\.Element)$/
-const RENDER_PROP_NAME = /^render(?:[A-Z][A-Za-z0-9]*)?$/
-
-/** The printed name of a type reference, qualified names included. */
-const typeNameOf = (node) => {
-  const name = node?.typeName
-  if (!name) return ""
-  if (name.type === "Identifier") return name.name
-  if (name.type === "TSQualifiedName") return `${typeNameOf({ typeName: name.left })}.${name.right.name}`
-  return ""
-}
-
-/** Every type this file declares, by name, so references can be followed locally. */
-const collectLocalTypes = (program) => {
-  const types = new Map()
-  const visit = (statement) => {
-    const declaration = statement?.type === "ExportNamedDeclaration" ? statement.declaration : statement
-    if (declaration?.type === "TSTypeAliasDeclaration") types.set(declaration.id.name, declaration.typeAnnotation)
-    if (declaration?.type === "TSInterfaceDeclaration") types.set(declaration.id.name, declaration.body)
-  }
-  for (const statement of program.body) visit(statement)
-  return types
-}
-
-/** The members of an object-shaped type node, following local names and intersections. */
-const membersOf = (node, types, seen = new Set()) => {
-  if (!node) return []
-  if (node.type === "TSTypeLiteral") return node.members
-  if (node.type === "TSInterfaceBody") return node.body
-  if (node.type === "TSIntersectionType") return node.types.flatMap((part) => membersOf(part, types, seen))
-  if (node.type === "TSTypeReference") {
-    const name = typeNameOf(node)
-    if (seen.has(name) || !types.has(name)) return []
-    seen.add(name)
-    return membersOf(types.get(name), types, seen)
-  }
-  return []
-}
-
-/** The key a property signature declares. */
-const keyOf = (member) => (member.key?.type === "Identifier" ? member.key.name : member.key?.value)
-
-// -- DRAWING-1 ----------------------------------------------------------------------------------
-
-/** The pure half takes atom data and actions; feature composition may receive named render callbacks. */
-export const basePropsAtom = {
-  meta: {
-    type: "problem",
-    docs: { description: "A pure `XBase` takes `state`, atom `props` and `on` actions; feature composition may receive named render callbacks in `props`." },
-    schema: [],
-    messages: {
-      tree:
-        "`{{path}}` hands a rendered tree (`{{type}}`) into the pure half. Write the child inside `component.tsx` and pass it atoms (ids, strings, flags); a tree handed in cannot be drawn, audited or reused.",
-      action:
-        "`{{path}}` is a function inside `props`. Actions live in `on`; feature composition may receive named `render` callbacks that take atoms and return rendered blocks.",
-      onData:
-        "`on.{{key}}` is not an action. `on` holds functions only; data belongs in `props`.",
-      member:
-        "`{{key}}` is not part of the pure contract. A pure half takes `state`, `props` and `on`{{children}}.",
-    },
-  },
-  create(context) {
-    const tier = pureHalf(context)
-    if (!tier) return {}
-    let types = new Map()
-
-    /** Resolve render results locally; an optional empty result does not make data a render prop. */
-    const isRenderResult = (node, seen = new Set()) => {
-      if (!node) return false
-      if (node.type === "TSUnionType") {
-        const empty = (part) => ["TSNullKeyword", "TSUndefinedKeyword"].includes(part.type)
-          || part.type === "TSLiteralType" && part.literal.value === null
-        return node.types.some((part) => isRenderResult(part, new Set(seen)))
-          && node.types.every((part) => empty(part) || isRenderResult(part, new Set(seen)))
-      }
-      if (node.type !== "TSTypeReference") return false
-      const name = typeNameOf(node)
-      if (RENDER_RESULT_TYPE.test(name.replace(/^React\./, ""))) return true
-      if (!types.has(name) || seen.has(name)) return false
-      return isRenderResult(types.get(name), new Set(seen).add(name))
-    }
-
-    const checkRenderCallback = (node, path, allowed) => {
-      if (!allowed || !isRenderResult(node.returnType?.typeAnnotation)) return false
-      for (const parameter of node.params ?? node.parameters ?? []) {
-        checkData(parameter.typeAnnotation?.typeAnnotation, `${path}(${parameter.name ?? "arg"})`, new Set(), false, true)
-      }
-      return true
-    }
-
-    const checkDataReference = (node, path, seen, renderProp, renderParameter) => {
-      const name = typeNameOf(node)
-      if (NON_ATOM_TYPE.test(renderParameter ? name.replace(/^React\./, "") : name)) {
-        context.report({ node, messageId: "tree", data: { path, type: name } })
-        return
-      }
-      for (const argument of node.typeArguments?.params ?? node.typeParameters?.params ?? []) checkData(argument, path, seen, false, renderParameter)
-      if (types.has(name) && !seen.has(name)) {
-        const nextSeen = renderProp || renderParameter ? new Set(seen) : seen
-        nextSeen.add(name)
-        checkData(types.get(name), path, nextSeen, renderProp, renderParameter)
-      }
-    }
-
-    const checkDataMember = (member, path, seen, renderParameter) => {
-      const memberPath = `${path}.${keyOf(member)}`
-      const allowsRender = tier !== "blocks" && path === "props" && RENDER_PROP_NAME.test(keyOf(member))
-      if (member.type === "TSMethodSignature") {
-        if (!checkRenderCallback(member, memberPath, allowsRender)) context.report({ node: member, messageId: "action", data: { path: memberPath } })
-      } else if (member.type === "TSPropertySignature") {
-        checkData(member.typeAnnotation?.typeAnnotation, memberPath, seen, allowsRender, renderParameter)
-      }
-    }
-
-    /** Walk a data type: report trees and functions anywhere inside it. */
-    const checkData = (node, path, seen, renderProp = false, renderParameter = false) => {
-      if (!node) return
-      switch (node.type) {
-        case "TSFunctionType":
-          if (checkRenderCallback(node, path, renderProp)) return
-          context.report({ node, messageId: "action", data: { path } })
-          return
-        case "TSTypeReference":
-          checkDataReference(node, path, seen, renderProp, renderParameter)
-          return
-        case "TSUnionType":
-        case "TSIntersectionType":
-          for (const part of node.types) checkData(part, path, seen, renderProp, renderParameter)
-          return
-        case "TSArrayType":
-          checkData(node.elementType, path, seen, false, renderParameter)
-          return
-        case "TSTypeOperator":
-          checkData(node.typeAnnotation, path, seen, false, renderParameter)
-          return
-        case "TSTypeLiteral":
-        case "TSInterfaceBody":
-          for (const member of node.members ?? node.body) checkDataMember(member, path, seen, renderParameter)
-          return
-        default:
-      }
-    }
-
-    /** Walk `on`: every member is a function whose parameters are data. */
-    const checkActions = (node) => {
-      for (const member of membersOf(node, types)) {
-        const key = keyOf(member)
-        const type = member.type === "TSMethodSignature" ? member : member.typeAnnotation?.typeAnnotation
-        if (type?.type !== "TSFunctionType" && type?.type !== "TSMethodSignature") {
-          context.report({ node: member, messageId: "onData", data: { key } })
-          continue
-        }
-        for (const parameter of type.params ?? type.parameters ?? []) {
-          checkData(parameter.typeAnnotation?.typeAnnotation, `on.${key}(${parameter.name ?? "arg"})`, new Set())
-        }
-      }
-    }
-
-    return {
-      Program(node) {
-        types = collectLocalTypes(node)
-      },
-      VariableDeclarator(node) {
-        if (node.id?.type !== "Identifier" || !/^[A-Z][A-Za-z0-9]*Base$/.test(node.id.name)) return
-        const fn = node.init
-        if (fn?.type !== "ArrowFunctionExpression" && fn?.type !== "FunctionExpression") return
-        const annotation = fn.params?.[0]?.typeAnnotation?.typeAnnotation
-        for (const member of membersOf(annotation, types)) {
-          const key = keyOf(member)
-          const type = member.typeAnnotation?.typeAnnotation
-          if (key === "state") continue
-          if (key === "props") checkData(type, "props", new Set())
-          else if (key === "on") checkActions(type)
-          else if (key === "children" && tier === "layouts") continue
-          else {
-            context.report({
-              node: member,
-              messageId: "member",
-              data: { key, children: tier === "layouts" ? ", plus the router's `children`" : "" },
-            })
-          }
-        }
-      },
-    }
-  },
-}
-
-// -- DRAWING-2 ----------------------------------------------------------------------------------
-
-/** Only the sibling `index.tsx` (and its specs) may reach `component.tsx`; only `X` leaves the folder. */
-export const baseImportPair = {
-  meta: {
-    type: "problem",
-    docs: { description: "A pure `component.tsx` is imported only by its sibling `index.tsx`, which never re-exports `XBase`." },
-    schema: [],
-    messages: {
-      reach:
-        "`{{source}}` reaches into another surface's pure half. Import that surface's connected export from its folder; the pure half is a private drawing surface.",
-      reexport:
-        "`index.tsx` re-exports `{{name}}`. The folder exports only its connected `X`; the pure `XBase` stays behind it so no other tier can bypass the owner.",
-    },
-  },
-  create(context) {
-    const isOwnIndex = roleOfFile(context) === "entry"
-    const inTier = inSplitTier(context)
-    // An import reaches a pure half when the file it resolves to has the `drawing` role of its slot.
-    const reachesPure = (source) => classifyImport(context, source)?.role === "drawing"
-
-    const check = (node, source) => {
-      if (typeof source !== "string" || !reachesPure(source)) return
-      const isSibling = /^\.\/[^/]+$/.test(source)
-      if (isSibling && isOwnIndex) return
-      if (isSibling && !inTier) return
-      context.report({ node, messageId: "reach", data: { source } })
-    }
-
-    return {
-      ImportDeclaration(node) {
-        check(node, node.source?.value)
-      },
-      ExportAllDeclaration(node) {
-        check(node, node.source?.value)
-      },
-      ExportNamedDeclaration(node) {
-        const source = node.source?.value
-        if (!source) return
-        check(node, source)
-        if (!isOwnIndex || !inTier || node.exportKind === "type") return
-        for (const specifier of node.specifiers ?? []) {
-          const name = specifier.exported?.name ?? specifier.local?.name
-          if (specifier.exportKind !== "type" && /^[A-Z][A-Za-z0-9]*Base$/.test(name)) {
-            context.report({ node: specifier, messageId: "reexport", data: { name } })
-          }
-        }
-      },
-    }
-  },
-}
-
-// -- DRAWING-3 ----------------------------------------------------------------------------------
-
-/** Words that name a data status or an open/closed lifecycle, never a drawn shape. */
-const DATA_STATUS = new Set([
-  "pending", "loading", "failed", "error", "errored", "empty", "forbidden", "unavailable",
-  "skeleton", "closed", "idle", "refreshing", "retrying",
-])
-
-/** A surface's `XState` names shapes only. */
-export const noDataStatusShape = {
-  meta: {
-    type: "problem",
-    docs: { description: "`XState` of a pure half names drawn shapes, never a data status or open/closed." },
-    schema: [],
-    messages: {
-      status:
-        "`{{name}}` lists \"{{value}}\" as a shape. Loading, forbidden, error and empty describe resource status: pass them as data to the owned status renderer. Open/closed is a boolean atom. A shape is a layout the owner approves as one drawing.",
-    },
-  },
-  create(context) {
-    if (!pureHalf(context)) return {}
-    const check = (name, node) => {
-      const members = node?.type === "TSUnionType" ? node.types : [node]
-      for (const member of members) {
-        const value = member?.type === "TSLiteralType" ? member.literal?.value : undefined
-        if (typeof value === "string" && DATA_STATUS.has(value)) {
-          context.report({ node: member, messageId: "status", data: { name, value } })
-        }
-      }
-    }
-    return {
-      TSTypeAliasDeclaration(node) {
-        if (/^[A-Z][A-Za-z0-9]*State$/.test(node.id.name)) check(node.id.name, node.typeAnnotation)
-      },
-    }
-  },
-}
-
-/** The rules this law contributes to the plugin. */
-export const rules = {
-  "base-props-atom": basePropsAtom,
-  "base-import-pair": baseImportPair,
-  "no-data-status-shape": noDataStatusShape,
-}
-
-/** Every FE canon rule is an error; existing debt is fixed before adoption. */
-export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]))

package/env-owner.mjs

@@ -1,244 +0,0 @@
-/**
- * The rules that hold `env-owner.md` (HFS R49, `FE_ENV_OWNER`).
- *
- * TWO FACTS, ONE OWNER. The environment is read in exactly one place, `modules/config`, and what it
- * reads has no default that stands in for a real deployment value. They are one law because they
- * fail together: an app with nine copies of `process.env.API_URL ?? "http://localhost:3068"` had
- * nine readers and nine silent defaults, so a production build with the variable missing talked to
- * a developer's laptop and looked healthy.
- *
- * The rules cannot see whether `modules/config` throws when a variable is missing in production -
- * that is a behaviour, and the module's own spec is where it is proven. What they hold is the
- * shape that makes it provable: one reader, and no literal fallback next to it.
- */
-
-import { isConfigModule } from "./lib/scope.mjs"
-
-/** `process.env`, or `import.meta.env`. */
-const isEnvObject = (node) => {
-  if (!node || node.type !== "MemberExpression" || node.computed) return false
-  const name = node.property && node.property.name
-  if (name !== "env") return false
-  const object = node.object
-  if (object.type === "Identifier" && object.name === "process") return true
-  return (
-    object.type === "MetaProperty" && object.meta.name === "import" && object.property.name === "meta"
-  )
-}
-
-/** The variable name of `process.env.NAME` / `process.env["NAME"]`, or null. */
-const envVariableName = (node) => {
-  if (!node || node.type !== "MemberExpression" || !isEnvObject(node.object)) return null
-  if (!node.computed && node.property.type === "Identifier") return node.property.name
-  if (node.computed && node.property.type === "Literal" && typeof node.property.value === "string") {
-    return node.property.value
-  }
-  return null
-}
-
-/** Static text of a literal or an expression-free template, else null. */
-const staticText = (node) => {
-  if (!node) return null
-  if (node.type === "Literal" && typeof node.value === "string") return node.value
-  if (node.type === "TemplateLiteral") {
-    return node.quasis.map((quasi) => quasi.value.cooked ?? "").join("")
-  }
-  return null
-}
-
-/** An absolute or protocol-relative URL: what a fallback must never carry. */
-const URL_TEXT = /^(?:https?:)?\/\/\S+/i
-
-/** Variable names whose value is a secret or an address: a default for one is a hole in a deployment. */
-const SENSITIVE_NAME = /(?:SECRET|TOKEN|PASSWORD|PASSWD|API_?KEY|PRIVATE_?KEY|URL|URI|HOST|ENDPOINT|ORIGIN)$/i
-
-/** Type assertions and optional chains preserve the identity of the wrapped value. */
-const unwrapped = (node) => {
-  while (node && ["TSAsExpression", "TSTypeAssertion", "TSNonNullExpression", "TSSatisfiesExpression", "ChainExpression"].includes(node.type)) node = node.expression
-  return node
-}
-
-/** The binding of this identifier, rather than every variable with the same spelling. */
-const bindingOf = (sourceCode, identifier) => {
-  for (let scope = sourceCode.getScope(identifier); scope; scope = scope.upper) {
-    const variable = scope.set.get(identifier.name)
-    if (variable) return variable
-  }
-  return null
-}
-
-/** Prior writes in the use's execution scope or its parents; a closure can capture a later initializer. */
-const writeBefore = (sourceCode, variable, node) => {
-  const scopes = new Set()
-  for (let scope = sourceCode.getScope(node); scope; scope = scope.upper) scopes.add(scope.variableScope)
-  const writes = variable.references.filter((reference) => reference.isWrite()
-    && scopes.has(reference.from.variableScope)
-    && !(reference.writeExpr && reference.writeExpr.range[0] <= node.range[0] && node.range[1] <= reference.writeExpr.range[1]))
-  return writes
-    .filter((reference) => reference.identifier.range[0] < node.range[0])
-    .sort((left, right) => right.identifier.range[0] - left.identifier.range[0])[0]
-    ?? writes.find((reference) => reference.init)
-}
-
-/** Property extraction between a write's source and its destructured binding. */
-const propertyPath = (identifier) => {
-  const properties = []
-  for (let node = identifier; node.parent; node = node.parent) {
-    const parent = node.parent
-    if (parent.type === "Property" && parent.value === node) properties.unshift(parent)
-    else if (parent.type !== "ObjectPattern" && !(parent.type === "AssignmentPattern" && parent.left === node)) break
-  }
-  return properties
-}
-
-/** Known environment containers and constant computed keys, followed through local aliases. */
-const environmentIdentity = (sourceCode) => {
-  const textOf = (node, seen = new Set()) => {
-    node = unwrapped(node)
-    if (!node || seen.has(node)) return null
-    if (node.type === "Literal" && typeof node.value === "string") return node.value
-    if (node.type === "TemplateLiteral" && node.expressions.length === 0) return node.quasis[0].value.cooked
-    if (node.type !== "Identifier") return null
-    const variable = bindingOf(sourceCode, node)
-    if (!variable) return null
-    const write = writeBefore(sourceCode, variable, node)
-    if (!write?.writeExpr || propertyPath(write.identifier).length > 0) return null
-    return textOf(write.writeExpr, new Set([...seen, node]))
-  }
-  const keyOf = (node) => node.computed ? textOf(node.key ?? node.property) : (node.key ?? node.property).name ?? (node.key ?? node.property).value
-  const propertyKind = (kind, key) => {
-    if (kind === "global" && key === "process") return "process"
-    if ((kind === "process" || kind === "meta") && key === "env") return "env"
-    return null
-  }
-  const kindOf = (node, seen = new Set()) => {
-    node = unwrapped(node)
-    if (!node || seen.has(node)) return null
-    if (node.type === "MetaProperty" && node.meta.name === "import" && node.property.name === "meta") return "meta"
-    if (node.type === "MemberExpression") return propertyKind(kindOf(node.object, new Set([...seen, node])), keyOf(node))
-    if (node.type !== "Identifier") return null
-    const variable = bindingOf(sourceCode, node)
-    if (!variable || variable.defs.length === 0) {
-      if (node.name === "process") return "process"
-      return ["globalThis", "global"].includes(node.name) ? "global" : null
-    }
-    const imported = variable.defs.find((definition) => definition.type === "ImportBinding" && ["process", "node:process"].includes(definition.parent.source.value))
-    if (imported) {
-      if (imported.parent.importKind === "type" || imported.node.importKind === "type") return null
-      if (imported.node.type !== "ImportSpecifier") return "process"
-      const name = imported.node.imported.name ?? imported.node.imported.value
-      return name === "default" ? "process" : name === "env" ? "env" : null
-    }
-    const write = writeBefore(sourceCode, variable, node)
-    if (!write?.writeExpr) return null
-    let kind = kindOf(write.writeExpr, new Set([...seen, node]))
-    for (const property of propertyPath(write.identifier)) kind = propertyKind(kind, keyOf(property))
-    return kind
-  }
-  const readsEnv = (pattern, kind) => {
-    if (pattern.type === "AssignmentPattern") return readsEnv(pattern.left, kind)
-    if (pattern.type !== "ObjectPattern") return false
-    return pattern.properties.some((property) => {
-      if (property.type !== "Property") return false
-      const valueKind = propertyKind(kind, keyOf(property))
-      return valueKind === "env" || readsEnv(property.value, valueKind)
-    })
-  }
-  return { kindOf, readsEnv }
-}
-
-// -- FE-ENV-1 --------------------------------------------------------------------------------------
-
-/** Only `modules/config` reads the environment. */
-export const noEnvOutsideConfig = {
-  meta: {
-    type: "problem",
-    docs: { description: "`process.env` and `import.meta.env` are read only in `modules/config`." },
-    schema: [],
-    messages: {
-      env:
-        "This file reads the environment. Only `modules/config` may: it is the one place that can fail loudly when a production variable is missing. Read the value from the config module's typed export instead.",
-    },
-  },
-  create(context) {
-    if (isConfigModule(context)) return {}
-    const members = []
-    const destructures = []
-    return {
-      ImportDeclaration(node) {
-        if (node.importKind === "type" || !["process", "node:process"].includes(node.source.value)) return
-        for (const specifier of node.specifiers) {
-          if (specifier.type === "ImportSpecifier" && specifier.importKind !== "type" && (specifier.imported.name ?? specifier.imported.value) === "env") context.report({ node: specifier, messageId: "env" })
-        }
-      },
-      MemberExpression(node) {
-        members.push(node)
-      },
-      VariableDeclarator(node) {
-        if (node.id.type === "ObjectPattern" && node.init) destructures.push({ node, pattern: node.id, value: node.init })
-      },
-      AssignmentExpression(node) {
-        if (node.operator === "=" && node.left.type === "ObjectPattern") destructures.push({ node, pattern: node.left, value: node.right })
-      },
-      AssignmentPattern(node) {
-        if (node.left.type === "ObjectPattern") destructures.push({ node, pattern: node.left, value: node.right })
-      },
-      "Program:exit"() {
-        const { kindOf, readsEnv } = environmentIdentity(context.sourceCode ?? context.getSourceCode())
-        for (const node of members) {
-          if (kindOf(node) === "env") context.report({ node, messageId: "env" })
-        }
-        for (const { node, pattern, value } of destructures) {
-          if (readsEnv(pattern, kindOf(value))) context.report({ node, messageId: "env" })
-        }
-      },
-    }
-  },
-}
-
-// -- FE-ENV-2 --------------------------------------------------------------------------------------
-
-/** A fallback never stands in for a deployment address or secret. */
-export const noHardcodedEndpointFallback = {
-  meta: {
-    type: "problem",
-    docs: { description: "No URL literal as a fallback, and no literal default for an address or secret variable." },
-    schema: [],
-    messages: {
-      url:
-        "A URL literal used as a fallback (`?? \"http://...\"`, `|| \"http://...\"` or a parameter default). A missing variable then silently points production at a developer's machine. Read the address from `modules/config`, which throws when it is absent.",
-      variable:
-        "`{{name}}` is an address or secret variable with a literal default. A default here makes a misconfigured deployment look healthy. Remove the default and let `modules/config` fail loudly when it is missing.",
-    },
-  },
-  create(context) {
-    return {
-      LogicalExpression(node) {
-        if (node.operator !== "??" && node.operator !== "||") return
-        const text = staticText(node.right)
-        if (text === null) return
-        if (URL_TEXT.test(text)) {
-          context.report({ node: node.right, messageId: "url" })
-          return
-        }
-        const name = envVariableName(node.left)
-        if (name && text !== "" && SENSITIVE_NAME.test(name)) {
-          context.report({ node: node.right, messageId: "variable", data: { name } })
-        }
-      },
-      AssignmentPattern(node) {
-        const text = staticText(node.right)
-        if (text !== null && URL_TEXT.test(text)) context.report({ node: node.right, messageId: "url" })
-      },
-    }
-  },
-}
-
-/** The rules this law contributes to the plugin. */
-export const rules = {
-  "no-env-outside-config": noEnvOutsideConfig,
-  "no-hardcoded-endpoint-fallback": noHardcodedEndpointFallback,
-}
-
-/** Both are exact syntactic shapes, and both are errors. */
-export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]))

package/fe-stack.mjs

@@ -1,86 +0,0 @@
-/**
- * The rule that holds the front-end stack (`knowledge/hfs/fe-stack.yaml`, failure code `FE_STACK_FORBIDDEN`).
- *
- * ONE LIBRARY PER CONCERN. Every common front-end concern - GraphQL, REST, data hooks, toast, forms, state, realtime, i18n, UI,
- * icons, motion, dates, numbers, storage, charts, markdown, code - has one canonical library, the same for the lite and the full
- * edition (owner ruling 2026-10-13). A second library for a concern is a second set of conventions a reader has to know and a
- * second dependency a release has to keep current, and it always arrives one import at a time. The catalog names, per concern,
- * the alternatives a front end never imports; this rule refuses exactly those, read from the catalog, so the list lives once.
- *
- * SUPABASE IS AUTH ONLY. With a Supabase connection the front end holds the Supabase Auth client and nothing else of Supabase
- * (the data path is GraphQL to the back end): `@supabase/*` is imported only by `modules/auth` (slot `fe.modules.auth`).
- *
- * WHAT IS LEFT TO SIBLINGS. A canonical library imported in the wrong place (Apollo outside `modules/api`, axios outside its REST
- * calls, socket.io-client outside `hooks/socketio`) and `fetch` outside the API layer are `fetch-only-in-api-client`'s findings;
- * a glyph library outside the icon leaf is the icon law's. Each import is judged by one rule.
- */
-import { forbiddingConcern, packageNameOf } from "./lib/fe-stack.mjs"
-import { globalReferences, inSlot, isProductSource } from "./lib/scope.mjs"
-
-/** The package scope only the identity-provider client may import. */
-const SUPABASE_SCOPE = "@supabase/"
-
-/**
- * No import (static, re-export, dynamic or `require`) of a package the fe-stack catalog forbids, and no `@supabase/*` outside
- * `modules/auth`. Type-only imports count: a type import still makes the package a dependency of the front end.
- */
-export const feStackImport = {
-  meta: {
-    type: "problem",
-    docs: { description: "A front end imports no library the fe-stack catalog forbids, and `@supabase/*` only in `modules/auth`." },
-    schema: [],
-    messages: {
-      forbidden:
-        "`{{name}}` is a forbidden alternative for the {{concern}} concern of the front-end stack. The stack has one library per concern, the same in every app and both editions: use {{canonical}} ({{pattern}}). {{why}}",
-      supabase:
-        "`{{name}}` is imported outside `modules/auth`. Supabase on the front end is the auth client only, held by `modules/auth` (the session, the access token the Apollo link attaches, sign-in and sign-out); data is read and written through the GraphQL operations of `modules/api`, never through Supabase from the browser.",
-    },
-  },
-  create(context) {
-    if (!isProductSource(context)) return {}
-    const authOwner = inSlot(context, "fe.modules.auth")
-    const judge = (node, source) => {
-      const name = packageNameOf(source)
-      if (name === null) return
-      const concern = forbiddingConcern(source)
-      if (concern) {
-        const named = concern.packages?.length > 0 ? concern.packages : concern.home ?? []
-        const canonical = named.map((entry) => `\`${entry}\``).join(", ")
-        context.report({ node, messageId: "forbidden", data: { name, concern: concern.id, canonical, pattern: concern.pattern ?? "", why: concern.why ?? "" } })
-        return
-      }
-      if (name.startsWith(SUPABASE_SCOPE) && !authOwner) context.report({ node, messageId: "supabase", data: { name } })
-    }
-    return {
-      ImportDeclaration(node) {
-        judge(node, node.source.value)
-      },
-      ExportNamedDeclaration(node) {
-        if (node.source) judge(node, node.source.value)
-      },
-      ExportAllDeclaration(node) {
-        judge(node, node.source.value)
-      },
-      ImportExpression(node) {
-        if (node.source.type === "Literal") judge(node, node.source.value)
-      },
-      TSImportEqualsDeclaration(node) {
-        // `import x = require("moment")`
-        if (node.moduleReference?.type === "TSExternalModuleReference" && node.moduleReference.expression?.type === "Literal") judge(node, node.moduleReference.expression.value)
-      },
-      CallExpression(node) {
-        // `require("moment")` where `require` is the CommonJS global.
-        if (node.callee.type !== "Identifier" || node.callee.name !== "require" || node.arguments[0]?.type !== "Literal") return
-        if (globalReferences(context, new Set(["require"])).includes(node.callee)) judge(node, node.arguments[0].value)
-      },
-    }
-  },
-}
-
-/** The rules this law contributes to the plugin. */
-export const rules = {
-  "fe-stack-import": feStackImport,
-}
-
-/** Every rule is an error: a second library for a concern is the defect, not a style. */
-export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]))