@thedecipherist/claude-packs 0.0.0-stage → 1.0.0

package/packs/http-api/rules/handlers-own-the-work.md

@@ -0,0 +1,17 @@
+---
+# concepts: handlers
+paths:
+  - "placeholder"
+---
+
+# A handler does the work through adapters and answers in the one error contract
+
+<constraints>
+Always do:
+- Take parsed, typed input (the route validated it), and return a typed result or throw an error of the one error contract.
+- Reach a database or another service only through an adapter, so a handler can be tested with the adapters faked.
+
+Never do:
+- Import a database driver or an HTTP client in a handler.
+- Build an error reply by hand: throw the contract's error, and let the one error handler answer.
+</constraints>

package/packs/http-api/rules/health-and-correlation.md

@@ -0,0 +1,17 @@
+---
+# concepts: api
+paths:
+  - "placeholder"
+---
+
+# Health, a correlation id and the remote ip on every log line; security on behind one switch
+
+<constraints>
+Always do:
+- Serve `GET /health` (no auth, no database work beyond a ping) for the orchestrator, with the build's version and commit.
+- Give every request a correlation id (taken from `x-request-id` or made), return it in the response header, and put it and `remote_ip` (the client's address, from the trusted proxy) in every log line of that request.
+- Turn on security headers and rate limits behind one flag read from the env module.
+
+Never do:
+- Log a secret or a whole request body, or turn security on and off in more than one place.
+</constraints>

package/packs/http-api/rules/one-error-contract.md

@@ -0,0 +1,17 @@
+---
+# concepts: api
+paths:
+  - "placeholder"
+---
+
+# One error contract for every failure the API returns
+
+<constraints>
+Always do:
+- Define the error shape once (a code, a message, the correlation id, optional details), and the error classes that carry it.
+- Answer every failure through the framework's one error handler, which maps the contract's errors and validation errors to that shape and the right status, and logs the rest as 500 without their internals.
+
+Never do:
+- Answer an empty 200 when a dependency is down: that is a 503. A failure and nothing to report never look the same.
+- Send an error body by hand from a route or handler, or return a stack trace or a driver message to the client.
+</constraints>

package/packs/http-api/rules/routes-are-thin.md

@@ -0,0 +1,17 @@
+---
+# concepts: routes
+paths:
+  - "placeholder"
+---
+
+# A route is thin: it names the path, its schemas and its handler, nothing else
+
+<constraints>
+Always do:
+- Give every route its method, its path, the request and response schemas it imports, and one handler call.
+- Put the route's work (rules, decisions, calls to adapters) in its handler.
+
+Never do:
+- Query a database, call another service or hold business rules in a route file.
+- Write a schema in a route: import it.
+</constraints>

package/packs/http-api/rules/routes-scope-to-the-caller.md

@@ -0,0 +1,26 @@
+---
+paths:
+  - "placeholder"
+---
+
+# Every route ties a record to its caller, and every guard fails closed
+
+<constraints>
+Always do:
+- Put the owner in the query filter: `findSegment (id, session.user.id)`. A check after the read is one forgotten line from a leak.
+- Treat authentication and authorization as two steps: who is calling, then may they touch this record.
+- Write a guard so that an empty list, a missing secret and an unset variable all deny.
+- Decide a role in one guard module, used by every route.
+- Keep one table of actions and the roles that may run them, enforced where the action runs.
+- Prove each control through the real app: a test that goes through the composition root and sees it refuse.
+
+Never do:
+- Load a record by a client-supplied id with no tie to the caller.
+- Write `if (ids.length > 0 && !ids.includes(x))`: an empty list lets everyone through.
+- Read a role, an owner or a tenant from the request body.
+- Ship a debug route, or leave a security off-switch in code.
+- Leave a `TODO` where a gate belongs.
+</constraints>
+
+## Check
+`route-scopes-to-the-caller`, `guard-fails-open`, `role-checked-in-one-guard`, `gate-is-not-a-todo`, `no-security-off-switch`, `debug-route-not-shipped`, `middleware-skips-without-user`, `cors-needs-origin`, `authz-from-request-body`, `queue-action-from-client`.

package/packs/http-api/rules/routes-validate-and-answer.md

@@ -0,0 +1,25 @@
+---
+paths:
+  - "placeholder"
+---
+
+# Input is validated at the edge, and what goes back gives nothing away
+
+<constraints>
+Always do:
+- Parse every body, query and param with a schema at the route. A cast is a promise to the compiler that nobody checked.
+- Send a stable error code and log the detail on the server.
+- Compare secrets in constant time.
+- Fetch a user-given URL through one function that refuses private, link-local and metadata addresses, on every redirect.
+- Keep one rate limiter module, with a per-account limit on anything guessable.
+- Read the client IP from the proxy you trust, counted from the right of `x-forwarded-for`.
+- Verify a webhook signature over the raw bytes, and record the event id so a retry does nothing.
+
+Never do:
+- Send `err.message` to the client.
+- Switch the Content Security Policy off. Start strict, and allow what the page needs by name.
+- Use the leftmost `x-forwarded-for` value.
+</constraints>
+
+## Check
+`route-body-needs-schema`, `query-cast-is-not-validation`, `secret-compared-constant-time-any`, `user-url-through-safe-fetch`, `rate-limit-one-module`, `client-ip-not-leftmost-xff`, `err-text-stays-server-side`, `webhook-dedupes-event-id`, `server-fetches-tenant-url`, `hmac-over-reserialised-body`, `csp-not-switched-off`.

package/packs/http-api/skills/change-an-api/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: change-an-api
+description: Use when changing what a route accepts or returns, when removing or renaming a field, or when a client needs something a published version does not give.
+---
+
+# Change an API (one job: no client that works today breaks)
+
+<constraints>
+Always do:
+1. Decide if the change is additive: a new optional field, a new route, a new optional parameter. Additive goes in the current version.
+2. Treat these as breaking: a field removed, renamed or changed in type; a new required input; tighter validation; another status code; another default.
+3. For a breaking change, add `/api/v<N+1>/` beside the old version. Freeze the old schema, and copy nothing you can share through a handler.
+4. Mark the old version with `Deprecation` and `Sunset` headers, and say when it goes in the changelog.
+5. Update the contract test for the new version only. A failing old-version test means the change broke it.
+6. Move the clients you own, then watch the old version's traffic before removing it.
+
+Never do:
+- Edit an old version's contract test to make it pass.
+- Remove a version that still has traffic.
+</constraints>

package/packs/http-api/skills/secure-a-route/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: secure-a-route
+description: Use when adding or changing an HTTP route, a webhook, or anything that reads a record by an id from a request.
+---
+
+# Secure a route (one job: this route refuses what it should, and a test saw it refuse)
+
+<constraints>
+Always do:
+1. Name who may call it, and which records they own.
+2. Parse the body, query and params with a schema before using them.
+3. Put the owner in the query filter.
+4. Write the tests through the real app, not a hand-built one: no credentials gets 401; a second account's id gets 404; bad input gets 400.
+5. See each test fail with the guard removed.
+6. Return a stable error code. Log the detail.
+7. Add a rate limit if the route takes a code, a password or a guess.
+
+Never do:
+- Mock the guard in the test that proves the guard.
+- Return a different answer for "not yours" and "not there".
+</constraints>

package/packs/instrument-shell/checks/no-raw-struct-blob.json

@@ -0,0 +1,23 @@
+{
+  "id": "no-raw-struct-blob",
+  "why": "A raw struct in a blob ties a session to one layout: change a field, and every saved session loads as defaults.",
+  "rule": ".claude/rules/session-blob-append-only.md",
+  "globs": [
+    "**/*.cpp",
+    "**/*.cc",
+    "**/*.h",
+    "**/*.hpp",
+    "**/*.mm"
+  ],
+  "exclude": [
+    "**/build/**",
+    "**/out/**",
+    "**/_deps/**",
+    "**/JUCE/**",
+    "**/node_modules/**"
+  ],
+  "pattern": "\\.append\\s*\\(\\s*&\\w+\\s*,\\s*sizeof\\b",
+  "bad": "sm.append (&s, sizeof (State));",
+  "good": "writeBlob (sm, s);",
+  "code": true
+}

package/packs/instrument-shell/pack.json

@@ -0,0 +1,22 @@
+{
+  "name": "instrument-shell",
+  "version": "1.0.0",
+  "description": "Instruments built on a shared shell: quiet states explain themselves, sessions stay loadable, a collapsed panel keeps every route, and what is painted is what is hit.",
+  "type": "stock",
+  "author": "claude-packs",
+  "license": "MIT",
+  "homepage": "https://github.com/TheDecipherist/claude-packs",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/TheDecipherist/claude-packs.git",
+    "directory": "packs/instrument-shell"
+  },
+  "keywords": [
+    "ui",
+    "juce",
+    "instrument"
+  ],
+  "engines": {
+    "claude-packs": ">=0.28.0"
+  }
+}

package/packs/instrument-shell/rules/fold-keeps-every-route.md

@@ -0,0 +1,24 @@
+---
+paths:
+  - "**/*.cpp"
+  - "**/*.cc"
+  - "**/*.h"
+  - "**/*.hpp"
+  - "**/*.mm"
+  - "**/*.py"
+  - "**/*.ts"
+  - "**/*.js"
+  - "**/*.mjs"
+---
+
+# A collapse never hides a route
+
+<constraints>
+Always do:
+- Ask what else was reachable only through the half that folds.
+- Keep every control a pack contributes reachable.
+- Read a control's real rectangle after layout.
+
+Never do:
+- Trust the flags: a headline control once came out zero pixels tall, with every flag correct.
+</constraints>

package/packs/instrument-shell/rules/quiet-announces-itself.md

@@ -0,0 +1,22 @@
+---
+paths:
+  - "**/*.cpp"
+  - "**/*.cc"
+  - "**/*.h"
+  - "**/*.hpp"
+  - "**/*.mm"
+  - "**/*.py"
+  - "**/*.ts"
+  - "**/*.js"
+  - "**/*.mjs"
+---
+
+# Deliberate silence says why
+
+<constraints>
+Always do:
+- Show why an instrument is quiet: a muted part, no MIDI, a closed gate. Derive it on every paint.
+
+Never do:
+- Leave a user with silence and a clean panel.
+</constraints>

package/packs/instrument-shell/rules/render-the-extremes.md

@@ -0,0 +1,25 @@
+---
+paths:
+  - "**/*.cpp"
+  - "**/*.cc"
+  - "**/*.h"
+  - "**/*.hpp"
+  - "**/*.mm"
+  - "**/*.py"
+  - "**/*.ts"
+  - "**/*.js"
+  - "**/*.mjs"
+---
+
+# Render the widest and narrowest machine, at opening size
+
+<constraints>
+Always do:
+- Render the widest and narrowest machine, at opening width, on both axes, against a declared minimum display.
+- Give each parameter exactly one page.
+- Build a reproduction with its own sections, fractional positions, control types and labels, drawn your own way.
+- Use pages only on machines designed with them.
+
+Never do:
+- Copy the artwork.
+</constraints>

package/packs/instrument-shell/rules/seams-are-declared.md

@@ -0,0 +1,27 @@
+---
+paths:
+  - "**/*.cpp"
+  - "**/*.cc"
+  - "**/*.h"
+  - "**/*.hpp"
+  - "**/*.mm"
+  - "**/*.py"
+  - "**/*.ts"
+  - "**/*.js"
+  - "**/*.mjs"
+---
+
+# The seams of a shared shell are declared, and proved
+
+<constraints>
+Always do:
+- Keep tab and division indexes append-only.
+- Prove an opt-out with a byte-identical render.
+- Build both sides of a seam together.
+- Prefix every test, target and output with the unit's name, so a family of units can build as one.
+- Take a copy of shared code only with a proof: every line traced to its source, what was cut listed, and a bit-for-bit comparison.
+
+Never do:
+- Change the shared shell for one unit.
+- Let a connection that type-checks mean different things at each end.
+</constraints>

package/packs/instrument-shell/rules/session-blob-append-only.md

@@ -0,0 +1,25 @@
+---
+paths:
+  - "**/*.cpp"
+  - "**/*.cc"
+  - "**/*.h"
+  - "**/*.hpp"
+  - "**/*.mm"
+  - "**/*.py"
+  - "**/*.ts"
+  - "**/*.js"
+  - "**/*.mjs"
+---
+
+# A saved session is append-only: every old one still loads
+
+<constraints>
+Always do:
+- Save a header and a prefix-compatible payload.
+- Add fields at the end only, and assert padding.
+- Test that a session from the last release loads.
+
+Never do:
+- Insert or retype a field: every saved session once loaded as defaults.
+- Write a raw struct to a blob.
+</constraints>

package/packs/instrument-shell/skills/gates-from-commit-one/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: gates-from-commit-one
+description: Use when starting a new instrument, or when asked what gates a unit needs.
+---
+
+# Gates from the first commit (one job: a unit is proved from the day it exists)
+
+<constraints>
+Always do:
+1. Start from the skeleton, with its gates wired into ctest.
+2. Give each gate an in-process fault injection, and see it red.
+3. Write to the state you inject: an injection that passes means dead code or a missing check.
+4. Gate: clock, render reproduces, byte-exact round trip, spread, panel hit test.
+5. Audit for dead bindings, and for fields decoded but never read.
+6. Test the gate itself, against a known-good unit and a known-bad one.
+7. Name in a verdict which half of an AND failed.
+
+Never do:
+- Add gates after the bugs: nine units shipped deaf that way.
+</constraints>

package/packs/instrument-shell/skills/hit-the-painted-control/SKILL.md

@@ -0,0 +1,18 @@
+---
+name: hit-the-painted-control
+description: Use when a control seems not to respond, or when proving a panel works.
+---
+
+# Hit what is painted (one job: every drawn control answers at its own centre)
+
+<constraints>
+Always do:
+1. Walk each drawn rectangle, and hit-test its centre.
+2. Require its own id back.
+3. Bound the hit box.
+4. Read lit state off the render.
+5. Walk one control of each template, and read the rest (`test-the-template-once`).
+
+Never do:
+- Call a binding proved because a value changed in the model.
+</constraints>

package/packs/js-ts/checks/async-callback-unguarded.json

@@ -0,0 +1,26 @@
+{
+  "id": "async-callback-unguarded",
+  "why": "An async function passed to a timer, an event handler or forEach is never awaited: its rejection is unhandled, and since Node 15 an unhandled rejection kills the process. Wrap it in guarded(fn, log, what) from lib/guarded.ts.",
+  "rule": ".claude/rules/await-handled-at-a-boundary.md",
+  "concepts": [
+    "js"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/tests/**",
+    "**/test/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/lib/guarded.*"
+  ],
+  "code": true,
+  "pattern": "\\b(setTimeout|setInterval|setImmediate|queueMicrotask|forEach|addEventListener|on|once|prependListener)\\s*\\(\\s*(?:'[^'\\n]*'\\s*,\\s*|\\\"[^\\\"\\n]*\\\"\\s*,\\s*)?async\\b",
+  "bad": "setInterval(async () => { await sweepExpired(db); }, 60_000);\nemitter.on('message', async (m) => { await handle(m); });\nusers.forEach(async (u) => await notify(u));",
+  "good": "setInterval(guarded(() => sweepExpired(db), log, 'sweep'), 60_000);\nemitter.on('message', guarded(handle, log, 'message'));\nawait Promise.all(users.map((u) => notify(u)));\nconst f = async () => { await x(); };"
+}

package/packs/js-ts/checks/background-loop-needs-stop.json

@@ -0,0 +1,28 @@
+{
+  "id": "background-loop-needs-stop",
+  "why": "A for(;;)/while(true) loop with no stop handle can never be shut down: tests cannot end it and shutdown cannot drain it. Take an AbortSignal and return a stop function.",
+  "rule": ".claude/rules/process-lifecycle.md",
+  "concepts": [
+    "js"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**"
+  ],
+  "code": true,
+  "mode": "needs",
+  "pattern": "\\bfor\\s*\\(\\s*;\\s*;\\s*\\)|\\bwhile\\s*\\(\\s*true\\s*\\)",
+  "needs": [
+    "\\b(AbortSignal|AbortController|signal\\.aborted|stop\\b|stopped\\b)"
+  ],
+  "bad": "export function startHoldReleaser() {\n  void (async () => { for (;;) { await tick(); await sleep(2000); } })();\n}",
+  "good": "export function startHoldReleaser(signal: AbortSignal) {\n  for (;;) { if (signal.aborted) return; await tick(); await sleep(2000, undefined, { signal }); }\n}"
+}

package/packs/js-ts/checks/child-process-error-handler.json

@@ -0,0 +1,28 @@
+{
+  "id": "child-process-error-handler",
+  "why": "A spawned child with a 'close' handler but no 'error' handler: when the binary cannot start, Node emits 'error' with no listener (crash) and the wrapping promise never resolves.",
+  "rule": ".claude/rules/await-handled-at-a-boundary.md",
+  "concepts": [
+    "js"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**"
+  ],
+  "code": false,
+  "mode": "needs",
+  "pattern": "(?:(?<![\\w.])|(?<=child_process\\.)|(?<=\\bcp\\.))(?:spawn|fork)\\s*\\(",
+  "needs": [
+    "\\.on\\s*\\(\\s*['\\\"]error['\\\"]"
+  ],
+  "bad": "const child = spawn('bash', ['-c', command]);\nchild.on('close', (code) => resolve(code));",
+  "good": "const child = spawn('bash', ['-c', command]);\nchild.on('error', reject);\nchild.on('close', (code) => resolve(code));\nconst m = re.exec(line);"
+}

package/packs/js-ts/checks/entry-registers-shutdown.json

@@ -0,0 +1,31 @@
+{
+  "id": "entry-registers-shutdown",
+  "why": "An entry file that listens or connects must shut down on purpose: SIGTERM and SIGINT close the server then the database; uncaughtException and unhandledRejection do the same and exit non-zero. Missing any one of the four leaves the pool open on that path.",
+  "rule": ".claude/rules/process-lifecycle.md",
+  "concepts": [
+    "entry"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**"
+  ],
+  "mode": "needs",
+  "pattern": "\\.listen\\s*\\(|\\bcreateServer\\s*\\(|\\bconnectGateway\\s*\\(|\\bconnectDb\\s*\\(|\\bmongoClient\\s*\\(\\s*\\)\\s*\\.connect",
+  "needs": [
+    "(\\bSIGTERM\\b|\\binstallLifecycle\\s*\\()",
+    "(\\bSIGINT\\b|\\binstallLifecycle\\s*\\()",
+    "(\\buncaughtException\\b|\\binstallLifecycle\\s*\\()",
+    "(\\bunhandledRejection\\b|\\binstallLifecycle\\s*\\()"
+  ],
+  "bad": "const app = Fastify();\nawait app.listen({ port: env.PORT, host: '0.0.0.0' });",
+  "good": "import { installLifecycle } from './lifecycle.js';\ninstallLifecycle(app);\nawait app.listen({ port: env.PORT, host: '0.0.0.0' });",
+  "strings": true
+}

package/packs/js-ts/checks/fetch-needs-timeout.json

@@ -0,0 +1,30 @@
+{
+  "id": "fetch-needs-timeout",
+  "why": "One hung customer endpoint then holds a worker slot forever, and the outage looks like your bug.",
+  "rule": ".claude/rules/outbound-calls-have-a-limit.md",
+  "concepts": [
+    "js"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/*.tsx",
+    "**/*.jsx",
+    "**/dashboard/**",
+    "**/client/**",
+    "**/public/**",
+    "**/scripts/**"
+  ],
+  "code": true,
+  "pattern": "\\bfetch\\((?![\\s\\S]{0,500}?\\bsignal\\b)",
+  "bad": "await fetch(url, { method: 'POST' });",
+  "good": "await fetch(url, { signal: AbortSignal.timeout(5000) });"
+}

package/packs/js-ts/checks/job-only-in-memory.json

@@ -0,0 +1,28 @@
+{
+  "id": "job-only-in-memory",
+  "why": "The process restarts and replicates, and its memory does not: work that must finish goes on a queue.",
+  "rule": ".claude/rules/process-lifecycle.md",
+  "globs": [],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/dashboard/**",
+    "**/client/**",
+    "**/public/**",
+    "**/web/**",
+    "**/scripts/**"
+  ],
+  "pattern": "\\bvoid\\s+(?:process|run|execute|perform|deploy|sync)\\w*\\(",
+  "bad": "void processJob(job);",
+  "good": "await enqueue(job); // a worker claims it with findOneAndUpdate",
+  "concepts": [
+    "js"
+  ]
+}

package/packs/js-ts/checks/json-only-through-helper.json

@@ -0,0 +1,29 @@
+{
+  "id": "json-only-through-helper",
+  "why": "JSON.stringify throws on circular references, BigInt and throwing toJSON, and turns Error into {}; JSON.parse throws on any bad input. One helper (lib/json.ts: toJson / parseJson) handles all of it once; a logger uses pino. A raw call is a crash waiting for the one value that triggers it.",
+  "rule": ".claude/rules/json-only-through-one-helper.md",
+  "concepts": [
+    "js"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/lib/json.*",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/tests/**",
+    "**/test/**",
+    "**/*.config.*",
+    ".claude/**",
+    "**/.claude/**",
+    "**/scripts/**",
+    "**/hooks/**"
+  ],
+  "code": true,
+  "pattern": "\\bJSON\\s*\\.\\s*parse\\s*\\(|\\bJSON\\s*\\.\\s*stringify\\s*\\((?!\\s*\\{)",
+  "bad": "const data = JSON.parse(raw);\nconst text = JSON.stringify(row);",
+  "good": "import { toJson, parseJson } from '../lib/json';\nrequest.log.warn({ jobId, err }, 'job retry');\nconst body = toJson(payload);\nconst cfg = parseJson(text, ConfigSchema);\n// JSON.stringify is only called in lib/json.ts\nconst s = 'JSON.parse(x) in a string is not a call';"
+}

package/packs/js-ts/checks/line-under-200-chars.json

@@ -0,0 +1,34 @@
+{
+  "id": "line-under-200-chars",
+  "why": "A 200+ character line hides awaits inside ternaries inside object literals, or holds a 1,100-character description string. Split it, or move the text to a descriptions table.",
+  "rule": ".claude/rules/stack-is-fastify-and-nextjs.md",
+  "concepts": [
+    "js"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.min.*",
+    "**/*.d.ts",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/test/**",
+    "**/tests/**",
+    "**/scripts/**",
+    "**/templates/**",
+    "**/views/**",
+    "**/ui/**",
+    "**/*.view.ts",
+    "**/*generated*",
+    "**/data/**"
+  ],
+  "code": false,
+  "flags": "m",
+  "pattern": "^(?!\\s*(?:import\\b|export \\{|export \\*)).{201,}$",
+  "bad": "const x = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';",
+  "good": "const x = 'short';"
+}