@starci/eslint-canon-fe 9.2.0 → 9.4.0

package/lib/config.mjs

@@ -1,142 +0,0 @@
-/**
- * The one flat config of a StarCi front end.
- *
- * A repository's `eslint.config.mjs` is managed by `starci app sync` (R05/R16/R17). Its template composes this universal
- * factory with the explicitly selected Grammar family's factory, passing the same HFS view to both.
- *
- * The factory owns everything else: which files are linted (the source of every app and every workspace package), typed linting on the source (`parserOptions.projectService`, so a rule asks what a node IS rather than what
- * it is called), the ignores, the linter options that make a disable comment impossible, every canon rule at `error`,
- * the React Hooks rules at `error`, and `settings.starci.hfs` - the slot view each path-scoped rule asks instead of a path
- * pattern. It takes no rule overrides, globs or ignores: there is no parameter through which a repository could weaken
- * the canon.
- */
-import tsParser from "@typescript-eslint/parser"
-import { OUTSIDE_THE_SCAN_FILES } from "../runtime/scripts/lib/sonar-syntax-rules.mjs"
-import { sonarWayRules } from "../runtime/scripts/lib/sonar-way.mjs"
-
-/** A disable directive is a weakening of lint, and one that suppresses nothing is dead weight. */
-export const linterOptions = Object.freeze({ noInlineConfig: true, reportUnusedDisableDirectives: "error" })
-
-/** The product source of a front end: every app's `src/` and every workspace package's `src/` (slots fe.* and repo.packages). */
-export const SOURCE_FILES = Object.freeze(["apps/*/src/**/*.{ts,tsx}", "packages/*/src/**/*.{ts,tsx}"])
-
-/** Build output, installed packages, generated wire types and the harness's report directory are never linted. */
-export const IGNORED = Object.freeze(["**/node_modules/**", "**/.next/**", "**/dist/**", "**/coverage/**", "**/__generated__/**", ".starci/**"])
-
-/**
- * The type-aware typescript-eslint rules the canon borrows, all `error` and the same set the back-end canon borrows for the type-aware laws: a promise is awaited or
- * handled (`no-floating-promises`, `no-misused-promises`), a `switch` over a union names every member, nothing flows out of an `any` (the `no-unsafe-*` family),
- * and the Sonar rules that need the checker: S1874 (a deprecated API), S6551 (an object turned into text) and S7503 (an `async` function that never awaits).
- */
-export const BORROWED = Object.freeze({
-  "@typescript-eslint/no-floating-promises": "error",
-  "@typescript-eslint/no-misused-promises": "error",
-  "@typescript-eslint/switch-exhaustiveness-check": "error",
-  "@typescript-eslint/no-unsafe-assignment": "error",
-  "@typescript-eslint/no-unsafe-member-access": "error",
-  "@typescript-eslint/no-unsafe-call": "error",
-  "@typescript-eslint/no-unsafe-return": "error",
-  "@typescript-eslint/no-unsafe-argument": "error",
-  "@typescript-eslint/no-deprecated": "error",
-  "@typescript-eslint/no-base-to-string": "error",
-  "@typescript-eslint/require-await": "error",
-})
-
-const levelOf = (setting) => (Array.isArray(setting) ? setting[0] : setting)
-
-/**
- * The flat config of one front-end repository.
- *
- * @param {object} input - Attachment options.
- * @param {object} input.hfs - The HFS view of the repository (`loadHfs(import.meta.url)`).
- * @param {object} input.plugin - The canon plugin.
- * @param {Record<string, unknown>} input.source - The source-tree levels (canon rules plus the React Hooks rules).
- * @param {object} input.reactHooks - The React Hooks plugin.
- * @param {object} input.tsPlugin - The typescript-eslint plugin.
- * @param {{ sonarjs: object, unicorn: object }} input.sonar - The plugins of the Sonar way rules (scripts/lib/sonar-way.mjs).
- * @returns {Array<object>} The flat config: one ignore block, one typed source block and the Sonar way block.
- */
-export const buildFeConfig = ({ hfs, plugin, source, reactHooks, tsPlugin, sonar }) => {
-  if (!hfs || typeof hfs.slotOf !== "function" || typeof hfs.repoRoot !== "string") {
-    throw new Error("starciFeConfig needs { hfs: loadHfs(import.meta.url) } - the rules read the repository's slots through it")
-  }
-  if (hfs.profile !== "fe") throw new Error(`starciFeConfig lints the fe side of an app (its eslint.config.mjs lives in fe/); this view is ${hfs.side ? `the ${hfs.side} side` : "the app root"}`)
-  if (Object.keys(source).length === 0) throw new Error("starciFeConfig received an empty source recommendation - a config with no rules is not adoption")
-  const weak = Object.entries(source).filter(([, setting]) => levelOf(setting) !== "error").map(([name]) => name)
-  if (weak.length > 0) throw new Error(`starciFeConfig refuses source rules not at error: ${weak.join(", ")}`)
-  const settings = { starci: { hfs } }
-  return [
-    { ignores: [...IGNORED] },
-    {
-      files: [...SOURCE_FILES],
-      languageOptions: {
-        parser: tsParser,
-        ecmaVersion: "latest",
-        sourceType: "module",
-        parserOptions: { projectService: true, tsconfigRootDir: hfs.repoRoot, ecmaFeatures: { jsx: true } },
-      },
-      linterOptions: { ...linterOptions },
-      plugins: { "starci-fe": plugin, "react-hooks": reactHooks, "@typescript-eslint": tsPlugin },
-      settings,
-      rules: { ...source, ...BORROWED },
-    },
-    // Sonar way: what the scan raises is refused while the code is written; a spec is outside the scan, so outside this block.
-    { files: [...SOURCE_FILES], ignores: [...OUTSIDE_THE_SCAN_FILES], plugins: { sonarjs: sonar.sonarjs, unicorn: sonar.unicorn }, rules: sonarWayRules(sonar.sonarjs, "fe").rules },
-  ]
-}
-
-/**
- * The canon rules that need no slot view: they judge a node and its types, never where the file sits in an app. A tree that is no HFS front end (a
- * runtime package, the harness UI) is linted by exactly these plus the type-aware, React Hooks and Sonar way rules. The set is closed by
- * config.spec.mjs: every other rule of the plugin refuses to run without `settings.starci.hfs`, so a rule added to the plugin is either listed here
- * or proven slot-bound there.
- */
-export const SLOT_FREE_RULES = Object.freeze([
-  "client-no-server-import", "no-server-action", "no-dangerous-html", "response-cookie-attributes", "require-export-jsdoc", "no-vietnamese-in-source",
-  "no-hardcoded-endpoint-fallback", "no-runtime-namespace", "list-item-has-key", "no-index-key", "no-inline-literal-prop-in-list", "prefer-arrow-export",
-  "handler-on-prefix", "no-native-form-control", "no-native-img", "image-has-size", "no-second-i18n-stack", "html-lang-from-locale", "no-null-suspense-fallback",
-  "no-native-anchor", "no-inline-parameter-type", "no-hand-rolled-polling", "no-copy-in-call", "no-alert", "no-failure-collapse",
-  "outcome-kinds-exhaustive", "no-await-in-loop", "prefer-code-point", "prefer-string-raw", "no-nested-conditional", "no-void-operator", "no-unused-import",
-  "prefer-export-from", "no-unused-prop-types", "media-has-caption", "max-params",
-  "nested-control-variant", "no-list-panel-padding", "no-app-surface-paint", "divider-full-bleed", "control-height", "selection-fill-no-check", "no-grammar-shim",
-  "button-intent-required", "button-no-variant", "destructive-confirm-in-dialog", "single-commit-per-render", "no-commit-in-collection-item",
-])
-
-/** The source of a plain front-end tree: its `src/`. */
-export const PLAIN_SOURCE_FILES = Object.freeze(["src/**/*.{ts,tsx}"])
-
-/**
- * The flat config of a TypeScript front-end tree that is no HFS app: the same fences as an app (typed linting, no inline directive, every rule at
- * `error`) over the rules that need no slot view. It takes the root of the tree and nothing else.
- *
- * @param {object} input - Attachment options.
- * @param {string} input.root - The absolute directory holding the tree's `tsconfig.json` and `src/`.
- * @param {object} input.plugin - The canon plugin.
- * @param {Record<string, unknown>} input.hooks - The React Hooks rules at error.
- * @param {object} input.reactHooks - The React Hooks plugin.
- * @param {object} input.tsPlugin - The typescript-eslint plugin.
- * @param {{ sonarjs: object, unicorn: object }} input.sonar - The plugins of the Sonar way rules.
- * @returns {Array<object>} The flat config: one ignore block, one typed source block and the Sonar way block.
- */
-export const buildPlainSourceConfig = ({ root, plugin, hooks, reactHooks, tsPlugin, sonar, canon = true }) => {
-  if (typeof root !== "string" || root === "") throw new Error("starciPlainSourceConfig needs { root } - the directory of the tree's tsconfig.json and src/")
-  const canonRules = canon ? Object.fromEntries(SLOT_FREE_RULES.map((name) => [`starci-fe/${name}`, "error"])) : {}
-  const missing = SLOT_FREE_RULES.filter((name) => !(name in plugin.rules))
-  if (missing.length > 0) throw new Error(`starciPlainSourceConfig lists rules the canon plugin does not publish: ${missing.join(", ")}`)
-  return [
-    { ignores: [...IGNORED] },
-    {
-      files: [...PLAIN_SOURCE_FILES],
-      languageOptions: {
-        parser: tsParser,
-        ecmaVersion: "latest",
-        sourceType: "module",
-        parserOptions: { projectService: true, tsconfigRootDir: root, ecmaFeatures: { jsx: true } },
-      },
-      linterOptions: { ...linterOptions },
-      plugins: { "starci-fe": plugin, "react-hooks": reactHooks, "@typescript-eslint": tsPlugin },
-      rules: { ...canonRules, ...hooks, ...BORROWED },
-    },
-    { files: [...PLAIN_SOURCE_FILES], ignores: [...OUTSIDE_THE_SCAN_FILES], plugins: { sonarjs: sonar.sonarjs, unicorn: sonar.unicorn }, rules: sonarWayRules(sonar.sonarjs, "fe").rules },
-  ]
-}

package/lib/fe-stack.mjs

@@ -1,77 +0,0 @@
-/**
- * The one door between the front-end lint rules and the fe-stack catalog (`knowledge/hfs/fe-stack.yaml`): for each common
- * front-end concern the ONE canonical library, its HFS home and the alternatives a front end never imports.
- *
- * The catalog is read from this package's `runtime/` copy, the same way the slot manifest and the canon pins are (a byte copy
- * of the runtime's knowledge file, refreshed by `scripts/hfs/sync-runtime.mjs`), so a rule in a product repository judges
- * against the catalog of the canon version it installed. A rule that needs the catalog and finds none stops the lint run
- * with an error naming the fix: a rule must not guess which libraries are forbidden.
- */
-import { readFileSync } from "node:fs"
-import { dirname, join } from "node:path"
-import { fileURLToPath } from "node:url"
-import { parseYaml } from "../runtime/engine/yaml.mjs"
-import { globExpression } from "../runtime/scripts/lib/glob.mjs"
-
-const CATALOG = join(dirname(fileURLToPath(import.meta.url)), "..", "runtime", "knowledge", "hfs", "fe-stack.yaml")
-
-/** @type {{ concerns: ReadonlyArray<object>, forbidden: ReadonlyMap<string, object>, patterns: ReadonlyArray<object> } | null} */
-let loaded = null
-
-/**
- * The parsed catalog: its concerns, and every forbidden package mapped to the concern that forbids it.
- *
- * @returns {{ concerns: ReadonlyArray<object>, forbidden: ReadonlyMap<string, object>, patterns: ReadonlyArray<object> }} The catalog.
- */
-export const feStack = () => {
-  if (loaded) return loaded
-  let text
-  try {
-    text = readFileSync(CATALOG, "utf8")
-  } catch (error) {
-    throw new Error(`@starci/eslint-canon-fe reads the fe-stack catalog from runtime/knowledge/hfs/fe-stack.yaml and it is missing (${error.code ?? error.message}): regenerate the runtime copy (scripts/hfs/sync-runtime.mjs)`)
-  }
-  const concerns = parseYaml(text)?.concerns
-  if (!Array.isArray(concerns) || concerns.length === 0) throw new Error("runtime/knowledge/hfs/fe-stack.yaml declares no concerns: the fe-stack catalog is malformed")
-  const forbidden = new Map()
-  for (const concern of concerns) for (const name of concern.forbids ?? []) forbidden.set(String(name), concern)
-  const patterns = [...forbidden].filter(([name]) => name.includes("*")).map(([name, concern]) => ({ expression: globExpression(name), concern }))
-  loaded = Object.freeze({ concerns: Object.freeze(concerns), forbidden, patterns: Object.freeze(patterns) })
-  return loaded
-}
-
-/**
- * The package a module specifier names (`@scope/name` or `name`, its subpath dropped), or null for a relative, aliased,
- * node-builtin or empty specifier.
- *
- * @param {unknown} specifier - The module specifier.
- * @returns {string | null} The package name.
- */
-export const packageNameOf = (specifier) => {
-  const text = typeof specifier === "string" ? specifier : ""
-  if (text === "" || text.startsWith(".") || text.startsWith("/") || text.startsWith("@/") || text.startsWith("~/") || text.startsWith("node:")) return null
-  const parts = text.split("/")
-  if (text.startsWith("@")) return parts.length >= 2 && parts[1] !== "" ? `${parts[0]}/${parts[1]}` : null
-  return parts[0]
-}
-
-/**
- * The concern whose `forbids` lists the package a specifier names, else null.
- *
- * @param {unknown} specifier - The module specifier.
- * @returns {object | null} The concern (`{ id, packages, home, pattern, forbids, why }`).
- */
-export const forbiddingConcern = (specifier) => {
-  const name = packageNameOf(specifier)
-  if (name === null) return null
-  const { forbidden, patterns } = feStack()
-  return forbidden.get(name) ?? patterns.find(({ expression }) => expression.test(name))?.concern ?? null
-}
-
-/**
- * The canonical packages of a concern.
- *
- * @param {string} id - The concern id (`icons`, `graphql`, ...).
- * @returns {ReadonlyArray<string>} Its packages; empty for an unknown concern.
- */
-export const canonicalPackages = (id) => feStack().concerns.find((concern) => concern.id === id)?.packages ?? []

package/lib/hfs.mjs

@@ -1,49 +0,0 @@
-/**
- * The one door between the front-end lint rules and the HFS slot manifest of the repository being linted.
- *
- * A consuming `eslint.config.mjs` is the managed one-liner `export default starciFeConfig({ hfs: loadHfs(import.meta.url) })`.
- * The config lives in the fe/ side folder of an app; `loadHfs` finds the app-root `hfs.json` one level up and gives every file
- * linted under that folder the view of the fe side (paths relative to fe/), with the slot manifest this package ships in
- * `runtime/` (a byte copy of the runtime's `knowledge/hfs/slots.yaml`, `scripts/hfs/slots.mjs` and
- * `scripts/hfs/view.mjs`, refreshed by `scripts/hfs/sync-runtime.mjs`), and returns the view the factory puts
- * in `settings.starci.hfs`.
- *
- * Every path-scoped rule asks `slotOf` / `tierOf` here instead of testing a path with a regular expression. A rule that
- * needs the view and finds none stops the lint run with an error naming the fix: a rule must not guess.
- */
-import { dirname, join } from "node:path"
-import { fileURLToPath } from "node:url"
-import { declaredHfsView, openHfsView } from "../runtime/scripts/hfs/view.mjs"
-
-const RUNTIME = join(dirname(fileURLToPath(import.meta.url)), "..", "runtime")
-
-/**
- * The HFS view of the side whose `eslint.config.mjs` (in fe/) calls this.
- *
- * @param {string} configUrl - `import.meta.url` of the repository's `eslint.config.mjs`.
- * @returns {object} The frozen HFS view.
- */
-export const loadHfs = (configUrl) => openHfsView({ runtimeRoot: RUNTIME, repoRoot: dirname(fileURLToPath(configUrl)) })
-
-/**
- * The HFS view of the fe side of an in-memory app declaration, for rule tests.
- *
- * @param {object} declaration - An app `hfs.json` object.
- * @param {string} repoRoot - The absolute fe side folder the linted filenames live under.
- * @returns {object} The frozen HFS view.
- */
-export const hfsFromDeclaration = (declaration, repoRoot) => declaredHfsView({ runtimeRoot: RUNTIME, declaration, repoRoot, side: "fe" })
-
-/**
- * The HFS view a rule runs under; a rule that needs it and gets none refuses to guess.
- *
- * @param {object} context - The ESLint rule context.
- * @returns {object} The HFS view from `settings.starci.hfs`.
- */
-export const hfsOf = (context) => {
-  const hfs = context.settings?.starci?.hfs
-  if (!hfs || typeof hfs.slotOf !== "function") {
-    throw new Error(`${context.id ?? "a starci-fe rule"} needs settings.starci.hfs: lint through starciFeConfig({ hfs: loadHfs(import.meta.url) })`)
-  }
-  return hfs
-}

package/lib/next.mjs

@@ -1,6 +0,0 @@
-/**
- * Next.js's own contract for route segment files, read from the runtime's one statement of it
- * (`scripts/lib/next-contract.mjs`, shipped in `runtime/` by `scripts/hfs/sync-runtime.mjs`), so every law
- * holds the same list by construction.
- */
-export { NEXT_RESERVED_EXPORTS, NEXT_ROUTE_SEGMENT_STEMS } from "../runtime/scripts/lib/next-contract.mjs"

package/lib/own-hook-origin.mjs

@@ -1,53 +0,0 @@
-/**
- * Resolve a `use*` import that comes from the app's own hooks folders (`hooks/swr`, `hooks/<domain>`, `hooks/zustand/<store>`...) by
- * TypeScript symbol resolution, never by the spelling of the name (R56 `FE_HOOKS_ARE_HOOKS`, owner ruling 2026-10-16 "Theo y tro").
- *
- * A composite product hook is built from the hooks beneath it: `hooks/<domain>/use<Name>.ts` composes the `use{Query,Mutate}<X>Swr`
- * wrappers of `hooks/swr`. The import is followed through barrels and re-exports to the declaration, and counts only when that declaration
- * is a `use*` value that lives in a `hooks/` folder of the app (never in `node_modules`). The hook's own file is judged by this same
- * rule when it is linted, so a fake one is refused where it is written.
- */
-import ts from "typescript"
-import { programFor } from "./program-for.mjs"
-
-const HOOKS_FOLDER = /(^|\/)hooks\//
-const isHookName = (name) => /^use[A-Z0-9]/.test(name)
-
-/** The program that holds the import target: the project program has it; a program rooted at the linted file alone (its disk text may differ from the linted text) is widened with it. */
-const widened = new WeakMap()
-export function reaching(program, filename, targetFile) {
-  if (program.getSourceFile(targetFile)) return program
-  const key = `${filename}\0${targetFile}`
-  const cache = widened.get(program) ?? new Map()
-  widened.set(program, cache)
-  if (!cache.has(key)) cache.set(key, ts.createProgram([filename, targetFile], program.getCompilerOptions()))
-  return cache.get(key)
-}
-
-/** A declaration of a hook value: a function or a variable, not a type, interface, class or enum. */
-const hookValue = (declaration) => ts.isFunctionDeclaration(declaration) || ts.isVariableDeclaration(declaration)
-
-const inAppHooksFolder = (file) => {
-  const fileName = file.fileName.replaceAll("\\", "/")
-  return !fileName.includes("/node_modules/") && !file.isDeclarationFile && HOOKS_FOLDER.test(fileName)
-}
-
-/** True when the import binding is a runtime `use*` import that resolves to a hook declared in a `hooks/` folder of the app. */
-export function importedOwnHook(context, definition) {
-  const specifier = definition.node
-  if (specifier.type !== "ImportSpecifier" || definition.parent.importKind === "type" || specifier.importKind === "type") return false
-  const name = specifier.imported.name ?? specifier.imported.value
-  if (!isHookName(name)) return false
-  const source = String(definition.parent.source.value)
-  const base = programFor(context)
-  const target = ts.resolveModuleName(source, context.filename, base.getCompilerOptions(), ts.sys).resolvedModule
-  if (!target || target.isExternalLibraryImport) return false
-  const program = reaching(base, context.filename, target.resolvedFileName)
-  const file = program.getSourceFile(target.resolvedFileName)
-  const checker = program.getTypeChecker()
-  const moduleSymbol = file && checker.getSymbolAtLocation(file)
-  const exported = moduleSymbol && checker.getExportsOfModule(moduleSymbol).find((symbol) => symbol.name === name)
-  if (!exported) return false
-  const symbol = exported.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(exported) : exported
-  return (symbol.declarations ?? []).some((declaration) => hookValue(declaration) && inAppHooksFolder(declaration.getSourceFile()))
-}

package/lib/program-for.mjs

@@ -1,22 +0,0 @@
-/** The TypeScript program a rule resolves symbols through: the lint run's own when typed linting is on, else one rooted at the linted file. */
-import ts from "typescript"
-import path from "node:path"
-
-const programs = new WeakMap()
-
-/** The program for a rule context; a program built here is remembered per context. */
-export function programFor(context) {
-  if (programs.has(context)) return programs.get(context)
-  const services = context.sourceCode?.parserServices
-  if (services?.program) return services.program
-  const filename = context.filename
-  const configPath = ts.findConfigFile(path.dirname(filename), ts.sys.fileExists)
-  let options = { moduleResolution: ts.ModuleResolutionKind.Bundler, module: ts.ModuleKind.ESNext }
-  if (configPath) {
-    const config = ts.readConfigFile(configPath, ts.sys.readFile)
-    options = { ...options, ...ts.parseJsonConfigFileContent(config.config, ts.sys, path.dirname(configPath)).options }
-  }
-  const program = ts.createProgram([filename], options)
-  programs.set(context, program)
-  return program
-}

package/lib/pure-owner-helper.mjs

@@ -1,148 +0,0 @@
-/**
- * The owner exports an auth callback may use besides the exchange (R287 `FE_CALLBACK_SHAPE`, owner ruling `auth-callback-pure-helpers`,
- * 2026-10-17 "Theo y tro"): a PURE helper of the app's `modules/routes` or `modules/auth` that computes the redirect target or validates
- * `next`, and a static route table. Both are found by TypeScript symbol resolution to the declaration, never by the spelling of the name.
- *
- * A pure helper is a synchronous function that returns text (or null), holds no `await` or `yield`, reaches no I/O global (network, storage,
- * DOM, `process`, `require`, `console`) and calls only locals, language built-ins and other pure helpers of `modules/routes` or
- * `modules/auth` (followed through barrels). `modules/config` is the environment owner: a call to its readers is a configuration read, not I/O.
- * Anything else it imports, a library value included, makes it impure.
- */
-import ts from "typescript"
-import { reaching } from "./own-hook-origin.mjs"
-import { programFor } from "./program-for.mjs"
-import { resolveImport } from "./scope.mjs"
-
-/** Globals that reach the network, storage, the page, the process or the console. */
-const IO_GLOBALS = new Set(["fetch", "XMLHttpRequest", "WebSocket", "EventSource", "Request", "navigator", "localStorage", "sessionStorage", "indexedDB", "document", "window", "self", "globalThis", "process", "require", "console", "setTimeout", "setInterval", "queueMicrotask", "Worker", "BroadcastChannel"])
-
-const OWNER_FILE = /\/modules\/(?:routes|auth)(?:\/|\.tsx?$)/
-const CONFIG_FILE = /\/modules\/config(?:\/|\.tsx?$)/
-const EXTENSIONS = ["", ".ts", ".tsx", "/index.ts", "/index.tsx"]
-
-const normal = (file) => file.fileName.replaceAll("\\", "/")
-
-/** The module file an import specifier names, or null when none exists on disk. */
-const moduleFile = (context, source) => {
-  const target = resolveImport(context, source)
-  if (target === null) return null
-  return EXTENSIONS.map((extension) => `${target}${extension}`).find((candidate) => ts.sys.fileExists(candidate)) ?? null
-}
-
-/** The declaration an export of the module resolves to, after barrels and re-exports. */
-const exportedDeclaration = (context, source, name) => {
-  const file = moduleFile(context, source)
-  if (file === null) return null
-  const program = reaching(programFor(context), context.filename, file)
-  const checker = program.getTypeChecker()
-  const sourceFile = program.getSourceFile(file)
-  const moduleSymbol = sourceFile && checker.getSymbolAtLocation(sourceFile)
-  const exported = moduleSymbol && checker.getExportsOfModule(moduleSymbol).find((symbol) => symbol.name === name)
-  if (!exported) return null
-  const symbol = exported.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(exported) : exported
-  return { checker, declaration: symbol.declarations?.[0] ?? null }
-}
-
-/** Strip `as`, `satisfies` and parentheses. */
-const bare = (node) => {
-  let current = node
-  while (current && (ts.isAsExpression(current) || ts.isSatisfiesExpression(current) || ts.isParenthesizedExpression(current))) current = current.expression
-  return current
-}
-
-/** The function-like node of a function declaration or of a variable initialised with an arrow or function expression. */
-const functionOf = (declaration) => {
-  if (ts.isFunctionDeclaration(declaration)) return declaration
-  const init = ts.isVariableDeclaration(declaration) ? bare(declaration.initializer) : null
-  return init && (ts.isArrowFunction(init) || ts.isFunctionExpression(init)) ? init : null
-}
-
-const isInside = (node, root) => node.getSourceFile() === root.getSourceFile() && node.pos >= root.pos && node.end <= root.end
-
-/** Whether an identifier names a declaration, a property or a member rather than referring to a binding. */
-const isNameOnly = (node) => {
-  const parent = node.parent
-  if (ts.isPropertyAccessExpression(parent)) return parent.name === node
-  if (ts.isPropertyAssignment(parent) || ts.isMethodDeclaration(parent) || ts.isPropertySignature(parent)) return parent.name === node
-  return (ts.isParameter(parent) || ts.isVariableDeclaration(parent) || ts.isFunctionDeclaration(parent) || ts.isBindingElement(parent)) && parent.name === node
-}
-
-/** A declaration of another file: an owner helper is followed, the environment owner is a leaf, everything else is impure. */
-const foreignPure = (env, declaration, root) => {
-  const file = normal(declaration.getSourceFile())
-  if (CONFIG_FILE.test(file)) return true
-  if (!OWNER_FILE.test(file) || declaration.getSourceFile().isDeclarationFile) return false
-  return declarationPure(env, declaration, root)
-}
-
-/** A global of the language or of the lib files is pure unless it reaches I/O. */
-const globalPure = (symbol) => !IO_GLOBALS.has(symbol.getName())
-
-/** Whether one identifier reference stays inside the pure surface. */
-const referencePure = (env, node, root) => {
-  const symbol = env.checker.getSymbolAtLocation(node)
-  if (!symbol) return node.text === "undefined"
-  const target = symbol.flags & ts.SymbolFlags.Alias ? env.checker.getAliasedSymbol(symbol) : symbol
-  const declarations = target.declarations ?? []
-  if (declarations.length === 0) return node.text === "undefined"
-  return declarations.every((declaration) => {
-    const file = declaration.getSourceFile()
-    if (isInside(declaration, root)) return true
-    if (!ts.isExternalModule(file)) return globalPure(target)
-    return foreignPure(env, declaration, root)
-  })
-}
-
-/** Walk a node: no await or yield, no impure reference; type positions are not behaviour. */
-const nodePure = (env, node, root) => {
-  if (ts.isAwaitExpression(node) || ts.isYieldExpression(node)) return false
-  if (ts.isTypeNode(node) && !ts.isExpressionWithTypeArguments(node)) return true
-  if (ts.isIdentifier(node) && !isNameOnly(node) && !referencePure(env, node, root)) return false
-  return ts.forEachChild(node, (child) => (nodePure(env, child, root) ? undefined : true)) !== true
-}
-
-/** A declaration is pure when its function (or its constant initialiser) is. */
-function declarationPure(env, declaration, root) {
-  if (env.seen.has(declaration)) return true
-  env.seen.add(declaration)
-  const fn = functionOf(declaration)
-  if (fn) return !fn.asteriskToken && !fn.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) && (fn.body ? nodePure(env, fn.body, fn) : false)
-  if (ts.isVariableDeclaration(declaration) && declaration.initializer) return nodePure(env, declaration.initializer, declaration.initializer)
-  return false
-}
-
-/** Whether a function's declared or inferred return type is text, null or undefined. */
-const returnsText = (checker, declaration) => {
-  const signature = checker.getSignaturesOfType(checker.getTypeAtLocation(declaration), ts.SignatureKind.Call)[0]
-  if (!signature) return false
-  const type = checker.getReturnTypeOfSignature(signature)
-  const parts = type.isUnion() ? type.types : [type]
-  return parts.every((part) => part.flags & (ts.TypeFlags.StringLike | ts.TypeFlags.Null | ts.TypeFlags.Undefined))
-}
-
-/** A static table: a constant object whose leaves are string literals or plain templates. */
-const isStaticTable = (node) => {
-  const value = bare(node)
-  if (!value) return false
-  if (ts.isStringLiteralLike(value)) return true
-  if (ts.isObjectLiteralExpression(value)) return value.properties.every((property) => ts.isPropertyAssignment(property) && isStaticTable(property.initializer))
-  return false
-}
-
-/**
- * What an import of the callback's owner modules is: `"pure"` (a pure text-returning helper), `"routes"` (a static route table) or null.
- *
- * @param {object} context - The ESLint rule context.
- * @param {string} source - The import specifier.
- * @param {string} name - The imported name.
- * @returns {"pure" | "routes" | null} The kind.
- */
-export function ownerExportKind(context, source, name) {
-  const found = exportedDeclaration(context, source, name)
-  if (!found?.declaration) return null
-  const { checker, declaration } = found
-  if (ts.isVariableDeclaration(declaration) && !functionOf(declaration)) return declaration.parent.flags & ts.NodeFlags.Const && isStaticTable(declaration.initializer) ? "routes" : null
-  const fn = functionOf(declaration)
-  const env = { checker, seen: new Set() }
-  return fn && returnsText(checker, fn) && declarationPure(env, declaration, fn) ? "pure" : null
-}

package/lib/react.mjs

@@ -1,28 +0,0 @@
-/**
- * React hooks of the front-end canon, decided by the import: a call is `useEffect` when its callee is the `useEffect`
- * export of `react` (named import, alias, default or namespace member), not when something is spelled that way.
- */
-import { importOf, unwrap } from "./bindings.mjs"
-
-/** The hooks that run work after render and may return its cleanup. */
-export const EFFECT_HOOKS = new Set(["useEffect", "useLayoutEffect"])
-
-/**
- * The React export a call invokes, or null when the callee is not an export of `react`.
- *
- * @param {object} context - The ESLint rule context.
- * @param {object} call - An ESTree call expression.
- * @returns {string|null} The export name (`useEffect`, `useSyncExternalStore`, ...).
- */
-export const reactHookOf = (context, call) => {
-  const callee = unwrap(call.callee)
-  if (callee.type === "Identifier") {
-    const from = importOf(context, callee)
-    return from && from.source === "react" && from.imported ? from.imported : null
-  }
-  if (callee.type === "MemberExpression" && !callee.computed && callee.object.type === "Identifier" && callee.property.type === "Identifier") {
-    const from = importOf(context, callee.object)
-    return from && from.source === "react" && from.imported === null ? callee.property.name : null
-  }
-  return null
-}

package/lib/redux-hook-origin.mjs

@@ -1,44 +0,0 @@
-/** Resolve typed Redux hook factories by their import provenance, never by a local use* name. */
-import ts from "typescript"
-import { programFor } from "./program-for.mjs"
-
-const REDUX_HOOKS = new Set(["useSelector", "useDispatch", "useStore"])
-
-function reduxImport(declaration) {
-  if (!ts.isImportSpecifier(declaration) || declaration.isTypeOnly) return false
-  const clause = declaration.parent.parent
-  return !clause.isTypeOnly && clause.parent.moduleSpecifier.text === "react-redux"
-    && REDUX_HOOKS.has((declaration.propertyName ?? declaration.name).text)
-}
-
-function typedFactory(checker, declaration) {
-  if (!ts.isVariableDeclaration(declaration) || !(declaration.parent.flags & ts.NodeFlags.Const)) return false
-  const call = declaration.initializer
-  if (!call || !ts.isCallExpression(call) || call.arguments.length !== 0) return false
-  const member = call.expression
-  return ts.isPropertyAccessExpression(member) && member.name.text === "withTypes"
-    && reduxBinding(checker, member.expression)
-}
-
-function reduxBinding(checker, node) {
-  const symbol = checker.getSymbolAtLocation(node)
-  return (symbol?.declarations ?? []).some(reduxImport)
-}
-
-/** A relative/barrel import must resolve to a const initialized by a real Redux hook's withTypes(). */
-export function importedReduxHook(context, definition) {
-  const specifier = definition.node
-  if (specifier.type !== "ImportSpecifier" || definition.parent.importKind === "type" || specifier.importKind === "type") return false
-  const source = String(definition.parent.source.value)
-  const name = specifier.imported.name ?? specifier.imported.value
-  if (source === "react-redux") return REDUX_HOOKS.has(name)
-  const program = programFor(context)
-  const target = ts.resolveModuleName(source, context.filename, program.getCompilerOptions(), ts.sys).resolvedModule
-  const file = target && program.getSourceFile(target.resolvedFileName)
-  const checker = program.getTypeChecker()
-  const moduleSymbol = file && checker.getSymbolAtLocation(file)
-  const exported = moduleSymbol && checker.getExportsOfModule(moduleSymbol).find(symbol => symbol.name === name)
-  if (!exported) return false
-  const symbol = exported.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(exported) : exported
-  return (symbol.declarations ?? []).some(declaration => typedFactory(checker, declaration))
-}