@starci/eslint-canon-fe 9.3.0 → 9.4.0

package/dist/type-safety.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The rules that hold `type-safety.md`.
+ *
+ * FOUR RULES, ONE IDEA: the compiler is told the truth or it is not told at all. The double cast, the
+ * plain assertion, the non-null assertion and `any` are the four spellings of "trust me". They live
+ * here rather than in a repository's own `eslint.config.mjs` because a repository carries no rule of
+ * its own: a rule that exists only in one repository's config is a rule the next repository forgets.
+ * The array spelling is a formatting question and stays with the formatter.
+ *
+ * THE EXEMPTION IS A SPEC, and it has to be. Proving a closed API refuses bad input means building
+ * bad input, and there is no way to construct a value the types forbid without telling the compiler
+ * to forget them. A judgement-based exemption would be argued at every call site; a spec is decided
+ * once, by its name.
+ */
+import { type Rules, type Recommended } from "./lib/rule.js";
+/** A cast through `unknown` erases what the compiler knew, at the seam where it mattered. */
+export declare const noDoubleCast: import("./lib/rule.js").Rule<"double", []>;
+/**
+ * A type assertion is a claim the compiler cannot check, made at the place it was going to check.
+ *
+ * WHAT IS LEFT ALLOWED. `as const` (it narrows), `as unknown` (it widens, and everything is assignable
+ * to it), and `satisfies` (it checks). The cast through `unknown` to a real type is refused by
+ * `no-double-cast`, so this rule leaves the outer half of that pair to it and reports each once.
+ */
+export declare const noTypeAssertion: import("./lib/rule.js").Rule<"assertion", []>;
+/** `x!` says a value is present without proving it. */
+export declare const noNonNullAssertion: import("./lib/rule.js").Rule<"bang", []>;
+/** `any` switches checking off for everything it touches. */
+export declare const noExplicitAny: import("./lib/rule.js").Rule<"any", []>;
+/** The rules this law contributes to the plugin. */
+export declare const rules: Rules;
+/**
+ * The level this law asks for, as the plugin's own opinion.
+ *
+ * Exact - it matches one syntactic shape - but a repository adopting it with history should expect
+ * each report to be real work: a double cast is usually load-bearing by the time anybody notices,
+ * and removing one means giving the value a shape it did not have.
+ *
+ * `any` and the array spelling are NOT published here. They belong to the TypeScript plugin's own
+ * rules, which a consuming repository already has: `@typescript-eslint/no-explicit-any` and
+ * `@typescript-eslint/array-type` with the generic default.
+ */
+export declare const recommended: Recommended;

package/dist/type-safety.js

@@ -0,0 +1,139 @@
+/**
+ * The rules that hold `type-safety.md`.
+ *
+ * FOUR RULES, ONE IDEA: the compiler is told the truth or it is not told at all. The double cast, the
+ * plain assertion, the non-null assertion and `any` are the four spellings of "trust me". They live
+ * here rather than in a repository's own `eslint.config.mjs` because a repository carries no rule of
+ * its own: a rule that exists only in one repository's config is a rule the next repository forgets.
+ * The array spelling is a formatting question and stays with the formatter.
+ *
+ * THE EXEMPTION IS A SPEC, and it has to be. Proving a closed API refuses bad input means building
+ * bad input, and there is no way to construct a value the types forbid without telling the compiler
+ * to forget them. A judgement-based exemption would be argued at every call site; a spec is decided
+ * once, by its name.
+ */
+import { defineRule } from "./lib/rule.js";
+import { isProductSource } from "./lib/scope.js";
+/** True when a type node is the `unknown` keyword. */
+const isUnknown = (node) => Boolean(node) && node?.type === "TSUnknownKeyword";
+// -- TYPE-SAFETY-1 ---------------------------------------------------------------------------------
+/** A cast through `unknown` erases what the compiler knew, at the seam where it mattered. */
+export const noDoubleCast = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "No cast through `unknown`; it turns checking off at the boundary." },
+        schema: [],
+        messages: {
+            double: "Casting through `unknown` tells the compiler to forget everything it knew about this value, because the two types have nothing in common. That is not a narrowing - a narrowing is a claim the compiler can still partly check - it is an erasure, and the seam it erases is the one worth checking: where a value crosses from outside the program to inside it. Narrow from `unknown` with a check the compiler can follow, or fix the shape.",
+        },
+    },
+    create(context) {
+        if (!isProductSource(context))
+            return {};
+        return {
+            TSAsExpression(node) {
+                // The outer cast of a `x as unknown as T` pair: its operand is itself a cast to `unknown`.
+                const inner = node.expression;
+                if (!inner || inner.type !== "TSAsExpression")
+                    return;
+                if (!isUnknown(inner.typeAnnotation))
+                    return;
+                context.report({ node, messageId: "double" });
+            },
+        };
+    },
+});
+// -- TYPE-SAFETY-2 ---------------------------------------------------------------------------------
+/** True for `as const`, the one assertion that narrows without claiming anything. */
+const isConstAssertion = (type) => type.type === "TSTypeReference" && type.typeName.type === "Identifier" && type.typeName.name === "const";
+/**
+ * A type assertion is a claim the compiler cannot check, made at the place it was going to check.
+ *
+ * WHAT IS LEFT ALLOWED. `as const` (it narrows), `as unknown` (it widens, and everything is assignable
+ * to it), and `satisfies` (it checks). The cast through `unknown` to a real type is refused by
+ * `no-double-cast`, so this rule leaves the outer half of that pair to it and reports each once.
+ */
+export const noTypeAssertion = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "No `as T` or `<T>x`; narrow with a check, a guard or a parser." },
+        schema: [],
+        messages: {
+            assertion: "`as {{type}}` tells the compiler to believe something it could not verify. When the claim is wrong the type system keeps saying it is right and the failure moves to a reader. Narrow with a check the compiler can follow (a type guard, `in`, a discriminant), parse the value where it enters, or use `satisfies` when the goal is only to check a literal.",
+        },
+    },
+    create(context) {
+        if (!isProductSource(context))
+            return {};
+        const source = context.sourceCode ?? context.getSourceCode();
+        const report = (node) => context.report({ node, messageId: "assertion", data: { type: source.getText(node.typeAnnotation) } });
+        return {
+            TSAsExpression(node) {
+                if (isConstAssertion(node.typeAnnotation) || isUnknown(node.typeAnnotation))
+                    return;
+                const inner = node.expression;
+                if (inner && inner.type === "TSAsExpression" && isUnknown(inner.typeAnnotation))
+                    return;
+                report(node);
+            },
+            TSTypeAssertion(node) {
+                if (isConstAssertion(node.typeAnnotation))
+                    return;
+                report(node);
+            },
+        };
+    },
+});
+// -- TYPE-SAFETY-3 ---------------------------------------------------------------------------------
+/** `x!` says a value is present without proving it. */
+export const noNonNullAssertion = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "No non-null assertion (`x!`); prove the value is there." },
+        schema: [],
+        messages: {
+            bang: "`!` asserts the value is not null or undefined and proves nothing: the day it is one, the failure is a TypeError in a reader's browser rather than a branch in the code. Handle the absent case (`if`, `??`, an early return) or make the type say it cannot be absent.",
+        },
+    },
+    create(context) {
+        if (!isProductSource(context))
+            return {};
+        return { TSNonNullExpression: (node) => context.report({ node, messageId: "bang" }) };
+    },
+});
+// -- TYPE-SAFETY-4 ---------------------------------------------------------------------------------
+/** `any` switches checking off for everything it touches. */
+export const noExplicitAny = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "No `any`; use a real type or `unknown` and narrow." },
+        schema: [],
+        messages: {
+            any: "`any` turns type checking off for this value and everything derived from it, silently. Use the real type, a generic, or `unknown` and narrow it where it is used.",
+        },
+    },
+    create(context) {
+        if (!isProductSource(context))
+            return {};
+        return { TSAnyKeyword: (node) => context.report({ node, messageId: "any" }) };
+    },
+});
+/** The rules this law contributes to the plugin. */
+export const rules = {
+    "no-double-cast": noDoubleCast,
+    "no-type-assertion": noTypeAssertion,
+    "no-non-null-assertion": noNonNullAssertion,
+    "no-explicit-any": noExplicitAny,
+};
+/**
+ * The level this law asks for, as the plugin's own opinion.
+ *
+ * Exact - it matches one syntactic shape - but a repository adopting it with history should expect
+ * each report to be real work: a double cast is usually load-bearing by the time anybody notices,
+ * and removing one means giving the value a shape it did not have.
+ *
+ * `any` and the array spelling are NOT published here. They belong to the TypeScript plugin's own
+ * rules, which a consuming repository already has: `@typescript-eslint/no-explicit-any` and
+ * `@typescript-eslint/array-type` with the generic default.
+ */
+export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]));

package/dist/ui-rulings.d.ts

@@ -0,0 +1,11 @@
+import { type Recommended } from "./lib/rule.js";
+/** Navigation-like single selection uses the row fill instead of a second check indicator. */
+export declare const selectionFillNoCheck: import("./lib/rule.js").Rule<"indicator", []>;
+/** Grammar internal selectors belong to Grammar, including selectors in colocated class declarations. */
+export declare const noGrammarInternalSelector: import("./lib/rule.js").Rule<"internal", []>;
+export declare const rules: {
+    "selection-fill-no-check": import("./lib/rule.js").Rule<"indicator", []>;
+    "no-grammar-internal-selector": import("./lib/rule.js").Rule<"internal", []>;
+};
+/** Both owner rulings are universal errors in the frontend canon. */
+export declare const recommended: Recommended;

package/dist/ui-rulings.js

@@ -0,0 +1,121 @@
+import { attribute, attributeValue, staticText } from "./lib/ast.js";
+import { importOf } from "./lib/bindings.js";
+import { defineRule } from "./lib/rule.js";
+import { isProductSource } from "./lib/scope.js";
+import { typedClassStrings } from "./lib/typed-class-values.js";
+/** Resolve a named or namespace import at its use, preserving lexical shadowing. */
+const grammarComponent = (context, opening, expected) => {
+    const name = opening.name;
+    const root = name.type === "JSXMemberExpression" ? name.object : name;
+    if (root.type !== "JSXIdentifier")
+        return false;
+    const binding = importOf(context, root);
+    if (!binding ||
+        !/^@starci\/grammar(?:\/(?:common|core|offset-pop))?$/.test(binding.source))
+        return false;
+    return name.type === "JSXMemberExpression"
+        ? binding.imported === null && name.property.name === expected
+        : binding.imported === expected;
+};
+/** Only a final explicit attribute is proof when an opaque spread could override a value. */
+/** True when `text` is one of `values`; a missing text never is. */
+const oneOf = (values, text) => text !== null && values.includes(text);
+/** The plain tag name of a JSX element (`nav`), or null for a member or namespaced name. */
+const plainTag = (name) => (name.type === "JSXIdentifier" ? name.name : null);
+const propText = (opening, key) => {
+    let value = null;
+    for (const entry of opening.attributes) {
+        if (entry.type === "JSXSpreadAttribute")
+            value = null;
+        else if (entry.name.name === key)
+            value = staticText(entry.value);
+    }
+    return value;
+};
+/** Navigation and rail/list placement are structurally identifiable without guessing from product names. */
+const navigationList = (context, opening) => {
+    for (let node = opening.parent; node; node = node.parent) {
+        if (node.type !== "JSXElement")
+            continue;
+        const parent = node.openingElement;
+        if (oneOf(["nav", "ul", "ol"], plainTag(parent.name)) ||
+            oneOf(["navigation", "list"], propText(parent, "role")))
+            return true;
+        if (["Rail", "Sidebar"].some((role) => grammarComponent(context, parent, role)))
+            return true;
+    }
+    return false;
+};
+/** Navigation-like single selection uses the row fill instead of a second check indicator. */
+export const selectionFillNoCheck = defineRule({
+    meta: {
+        type: "problem",
+        docs: {
+            description: "Navigation-like single-select ListBox rows use selectionIndicator=none.",
+        },
+        schema: [],
+        messages: {
+            indicator: 'Use selectionIndicator="none" on this navigation-like single-select ListBox; the row fill carries selection.',
+        },
+    },
+    create(context) {
+        return {
+            JSXOpeningElement(node) {
+                if (!grammarComponent(context, node, "ListBox") ||
+                    !navigationList(context, node))
+                    return;
+                if (oneOf(["none", "multiple"], propText(node, "selectionMode")))
+                    return;
+                if (propText(node, "selectionIndicator") !== "none")
+                    context.report({ node, messageId: "indicator" });
+            },
+        };
+    },
+});
+/** Grammar internal selectors belong to Grammar, including selectors in colocated class declarations. */
+export const noGrammarInternalSelector = defineRule({
+    meta: {
+        type: "problem",
+        docs: {
+            description: "Application styles cannot target starci-core internals.",
+        },
+        schema: [],
+        messages: {
+            internal: "Remove this starci-core- selector. Compose the Grammar public API; message actions belong in the ChatBubble floating toolbar.",
+        },
+    },
+    create(context) {
+        if (!isProductSource(context))
+            return {};
+        const selector = /(?:\.|_|\[class[^\]]*)starci-core-/;
+        const report = (node, text) => {
+            if (text && selector.test(text))
+                context.report({ node, messageId: "internal" });
+        };
+        return {
+            Literal(node) {
+                if (typeof node.value === "string")
+                    report(node, node.value);
+            },
+            TemplateElement(node) {
+                report(node, node.value.cooked);
+            },
+            JSXAttribute(node) {
+                if (node.name.name !== "className")
+                    return;
+                const value = attributeValue(attribute(node.parent, "className"));
+                if (value?.type !== "Identifier" && value?.type !== "MemberExpression")
+                    return;
+                const strings = typedClassStrings(context, value, "classes");
+                if (strings.some((entry) => selector.test(entry.text)))
+                    context.report({ node, messageId: "internal" });
+            },
+        };
+    },
+});
+export const rules = {
+    "selection-fill-no-check": selectionFillNoCheck,
+    "no-grammar-internal-selector": noGrammarInternalSelector,
+};
+/** Both owner rulings are universal errors in the frontend canon. */
+export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.3.0",
+  "version": "9.4.0",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",
@@ -16,18 +16,34 @@
   },
   "private": false,
   "exports": {
-    ".": "./index.mjs",
-    "./lib/*": "./lib/*"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./lib/*.mjs": {
+      "types": "./dist/lib/*.d.ts",
+      "default": "./dist/lib/*.js"
+    },
+    "./lib/*.js": {
+      "types": "./dist/lib/*.d.ts",
+      "default": "./dist/lib/*.js"
+    },
+    "./package.json": "./package.json"
   },
-  "main": "./index.mjs",
+  "imports": {
+    "#runtime/*": {
+      "types": "./src/types/runtime/*",
+      "default": "./runtime/*"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "files": [
     "LICENSE",
-    "*.mjs",
-    "lib/*.mjs",
+    "dist/**/*.js",
+    "dist/**/*.d.ts",
     "runtime/**",
     "docs/*.md",
-    "*.ts",
-    "!*.spec.mjs",
     "CHANGELOG.md",
     "README.md"
   ],
@@ -43,7 +59,10 @@
     "access": "public"
   },
   "scripts": {
-    "test": "node --test \"*.spec.mjs\""
+    "build": "node -e \"require('node:fs').rmSync('dist', {recursive: true, force: true})\" && tsc -p tsconfig.build.json && node -e \"const fs = require('node:fs'); for (const f of fs.readdirSync('dist', {recursive: true}).filter((n) => n.endsWith('.d.ts'))) fs.writeFileSync('dist/' + f, fs.readFileSync('dist/' + f, 'utf8').replace(/((?:from |import\\()['\\x22]\\.\\.?\\/[^'\\x22]+)\\.ts(['\\x22])/g, (all, head, quote) => head + '.js' + quote))\"",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "node --test \"src/**/*.spec.ts\"",
+    "prepack": "npm run typecheck && npm run build && npm test"
   },
   "keywords": [
     "eslint",
@@ -54,10 +73,13 @@
   "dependencies": {
     "@typescript-eslint/eslint-plugin": "^8.70.0",
     "@typescript-eslint/parser": "^8.70.0",
+    "@typescript-eslint/utils": "^8.72.1",
     "eslint-plugin-sonarjs": "4.2.1",
     "eslint-plugin-unicorn": "65.0.0"
   },
   "devDependencies": {
+    "@starci/tsconfig": "file:../tsconfig",
+    "@types/node": "^24.19.2",
     "eslint": "^9.18.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "typescript": "^6.0.3"

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -30,61 +30,61 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.14.0
+    version: 0.15.0
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.5.0
+    version: 3.6.0
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.3.0
+    version: 9.4.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.14.0
+    version: 0.15.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.14.0
+    version: 0.15.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-offset-pop/package.json
     why: 'the Offset Pop Grammar component API lint, versioned with @starci/grammar; its shared component contract comes from the StarCi family lint without copying rules.'
   '@starci/stylelint-canon':
-    version: 2.1.0
+    version: 2.2.1
     group: starci
     install: registry
     side: fe
     source: packages/stylelint-canon/package.json
     why: 'the front-end stylelint canon: no-class-selector refuses a compound class selector (`div.card`); the brand layer accepts `--font-sans` and `--font-mono`; status-contrast measures the HeroUI soft pairs per theme; brand-layer-shape reads the shared :root,.light,.dark block and the info soft pair; appTokens come from loadAppTokens(import.meta.url) for the managed one-line stylelint.config.mjs.'
   '@starci/tsconfig':
-    version: 2.0.8
+    version: 2.1.0
     group: starci
     install: registry
     side: both
     source: packages/tsconfig/package.json
   '@starci/prettier-config':
-    version: 1.0.5
+    version: 1.1.0
     group: starci
     install: registry
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.3.7
+    version: 2.4.1
     group: starci
     install: registry
     side: be
@@ -97,6 +97,13 @@ pins:
     side: be
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
+  '@starci/ai-router':
+    version: 0.2.1
+    group: starci
+    install: registry
+    side: be
+    source: packages/ai-router/package.json
+    why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   'starci-harness':
     version: 1.1.0-alpha.1
     group: starci
@@ -105,7 +112,7 @@ pins:
     source: cli/package.json
     why: 'the one StarCi command line (bins starci and starci-harness): a product repository installs it for starci app, which it runs in-process through its exact @starci/hfs dependency, and its codegen loads starci-harness/input-bounds.'
   '@starci/hfs':
-    version: 4.9.0
+    version: 4.9.1
     group: starci
     install: registry
     side: both

package/brand-values.mjs

@@ -1,172 +0,0 @@
-/**
- * The rule that holds `brand-values.md` (HFS R61 `FE_STYLE_TOKEN_ONLY`, the TypeScript half; the CSS
- * half belongs to `@starci/stylelint-canon`).
- *
- * ONE PLACE FOR A COLOUR. Colour values exist in `modules/brand/brand.css`, set only on the tokens
- * the grammar declares, with a light and a dark value, and checked against the brand record. A hex
- * in a component is a colour that has no dark value, cannot be re-branded, and drifts from the
- * record: one repository carried three different ways to override the brand, and another 4.3k lines
- * of hand-made CSS with a private token namespace.
- *
- * LENGTHS FOLLOW. A pixel length in TypeScript (`"12px"`, `{ width: 12 }` in a `style` prop) is a
- * spacing decision that skipped the grammar's scale, so it does not move with density, zoom or a
- * breakpoint. Spacing and sizing come from the grammar's utility tokens.
- *
- * WHAT IT DELIBERATELY LEAVES ALONE: a fragment identifier (`href="#top"`, `id`, `htmlFor`), a
- * `data:` URI, a component's semantic appearance prop (a named role rather than a raw colour), and
- * Tailwind arbitrary values (`w-[12px]`), which `no-arbitrary-value` already reports - two rules
- * for one span would be two findings for one fix.
- */
-
-import { isContentFile } from "./comments.mjs"
-
-/** A hex colour: 3, 4, 6 or 8 digits, not a longer word and not part of an identifier. */
-const HEX_COLOR = /(?<![\w&])#(?:[0-9a-fA-F]{8}|[0-9a-fA-F]{6}|[0-9a-fA-F]{3,4})(?![\w-])/
-
-/** A functional colour notation. */
-const COLOR_FUNCTION = /\b(?:rgba?|hsla?|hwb|lab|lch|oklab|oklch|color-mix)\(/i
-
-/** A pixel length, not inside an arbitrary-value bracket and not part of a longer number or word. */
-const PIXEL_LENGTH = /(?<![\w.#[-])-?(?:\d+\.?\d*|\.\d+)px\b/
-
-/** Attributes whose value is a fragment or an id, where a `#abc` is not a colour. */
-const NON_COLOR_ATTRS = new Set(["href", "id", "htmlFor", "to", "name", "aria-controls", "aria-labelledby", "aria-describedby"])
-
-/** SVG paint attributes: a named colour here is a raw brand value. */
-const PAINT_ATTRS = new Set(["fill", "stroke", "stopColor", "floodColor", "lightingColor"])
-
-/** Style properties that take a colour. */
-const COLOR_KEYS = new Set([
-  "color",
-  "background",
-  "backgroundColor",
-  "borderColor",
-  "outlineColor",
-  "fill",
-  "stroke",
-  "caretColor",
-  "accentColor",
-  "textDecorationColor",
-])
-
-/** Style properties that take a length. */
-const LENGTH_KEYS = new Set([
-  "width",
-  "height",
-  "minWidth",
-  "maxWidth",
-  "minHeight",
-  "maxHeight",
-  "top",
-  "right",
-  "bottom",
-  "left",
-  "gap",
-  "margin",
-  "marginTop",
-  "marginRight",
-  "marginBottom",
-  "marginLeft",
-  "padding",
-  "paddingTop",
-  "paddingRight",
-  "paddingBottom",
-  "paddingLeft",
-  "fontSize",
-  "borderRadius",
-  "letterSpacing",
-])
-
-/** Values that carry no raw colour: a token reference or a keyword. */
-const NEUTRAL_COLOR = /^(?:var\(|inherit$|initial$|unset$|revert$|currentcolor$|transparent$|none$)/i
-
-/** Static string of a literal or an expression-free template, else null. */
-const staticString = (node) => {
-  if (!node) return null
-  if (node.type === "Literal" && typeof node.value === "string") return node.value
-  if (node.type === "TemplateLiteral" && node.expressions.length === 0) return node.quasis[0]?.value.cooked ?? ""
-  return null
-}
-
-/** No raw colour, hex or pixel value outside `brand.css`. */
-export const noRawBrandValue = {
-  meta: {
-    type: "problem",
-    docs: { description: "No hex, colour function, named paint colour or px length in TypeScript; tokens only." },
-    schema: [],
-    messages: {
-      color:
-        "A raw colour value (`{{value}}`). Colour values exist only in `modules/brand/brand.css`, on the tokens the grammar declares, with a light and a dark value. Here it has no dark value, cannot be re-branded and drifts from the brand record. Use a grammar token class or variable.",
-      length:
-        "A raw pixel length (`{{value}}`). Spacing and size come from the grammar's scale so they move with density, zoom and breakpoint. Use a grammar utility token.",
-      named:
-        "`{{key}}: {{value}}` puts a named colour in a style. Colour is a token, not a word: use a grammar token (`var(--...)` or a token class).",
-    },
-  },
-  create(context) {
-    if (isContentFile(context)) return {}
-    const source = context.sourceCode || context.getSourceCode()
-    /** Values already reported through an owner, so a string reports once. */
-    const claimed = new WeakSet()
-
-    /** True when a node sits inside a JSX `style={...}` attribute. */
-    const inStyleAttribute = (node) =>
-      source
-        .getAncestors(node)
-        .some((ancestor) => ancestor.type === "JSXAttribute" && ancestor.name.type === "JSXIdentifier" && ancestor.name.name === "style")
-
-    /** Reports the first raw value in a string, once. */
-    const scan = (node, text) => {
-      if (claimed.has(node) || typeof text !== "string" || text.startsWith("data:")) return
-      const parent = node.parent
-      if (parent && parent.type === "JSXAttribute" && NON_COLOR_ATTRS.has(parent.name.name)) return
-      if (parent && parent.type === "JSXExpressionContainer" && parent.parent.type === "JSXAttribute") {
-        if (NON_COLOR_ATTRS.has(parent.parent.name.name)) return
-      }
-      if (parent && (parent.type === "ImportDeclaration" || parent.type === "ExportAllDeclaration" || parent.type === "ExportNamedDeclaration")) return
-      const color = HEX_COLOR.exec(text) || COLOR_FUNCTION.exec(text)
-      if (color) return context.report({ node, messageId: "color", data: { value: color[0].replace(/\($/, "(...)") } })
-      const length = PIXEL_LENGTH.exec(text)
-      if (length) context.report({ node, messageId: "length", data: { value: length[0] } })
-    }
-
-    return {
-      Literal(node) {
-        scan(node, node.value)
-      },
-      TemplateElement(node) {
-        scan(node, node.value && node.value.cooked)
-      },
-      JSXAttribute(node) {
-        if (node.name.type !== "JSXIdentifier" || !PAINT_ATTRS.has(node.name.name)) return
-        const value = node.value && node.value.type === "JSXExpressionContainer" ? node.value.expression : node.value
-        const text = staticString(value)
-        if (text === null || NEUTRAL_COLOR.test(text) || HEX_COLOR.test(text) || COLOR_FUNCTION.test(text)) return
-        claimed.add(value)
-        context.report({ node, messageId: "named", data: { key: node.name.name, value: text } })
-      },
-      Property(node) {
-        if (node.computed || node.key.type !== "Identifier" || !inStyleAttribute(node)) return
-        const key = node.key.name
-        if (COLOR_KEYS.has(key)) {
-          const text = staticString(node.value)
-          if (text === null || NEUTRAL_COLOR.test(text) || HEX_COLOR.test(text) || COLOR_FUNCTION.test(text)) return
-          claimed.add(node.value)
-          context.report({ node, messageId: "named", data: { key, value: text } })
-        } else if (LENGTH_KEYS.has(key) && node.value.type === "Literal" && typeof node.value.value === "number") {
-          if (node.value.value === 0) return
-          claimed.add(node.value)
-          context.report({ node: node.value, messageId: "length", data: { value: `${key}: ${node.value.value}` } })
-        }
-      },
-    }
-  },
-}
-
-/** The rules this law contributes to the plugin. */
-export const rules = {
-  "no-raw-brand-value": noRawBrandValue,
-}
-
-/** Every rule is an error. */
-export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]))