@thethracian/oxlint-config 0.1.0 → 0.2.1

package/dist/rules/effect-strict.js

@@ -0,0 +1,727 @@
+import { hasRunForkWithoutObserver } from './effect-default-helpers.js';
+import { isConfiguredPath, isEffectTestPath, isUnitTestPath, strictPathOptionsSchema, } from './effect-path-options.js';
+import { effectApiAliases, effectFunctionAliases, effectImportAliases, hasEffectSignal, hasRuntimeCall, makeRules, } from './effect-rule-core.js';
+import { exportedDeclarationTexts, findBalancedCallEnd, findMatchingBrace, findStatementEnd, stripComments, stripCommentsAndStrings, } from './effect-source-helpers.js';
+import { hasBoundaryDataWithoutSchema, hasCommandHandlerWithoutSchema, hasDuplicateLayerInstance, hasAsyncPushWithoutBuffer, hasEnsuringCleanupWithoutOnExit, hasExternalEffectWithoutSpan, hasExternalEffectWithoutTimeout, hasHttpClientResponseWithoutSchema, hasHttpServerRequestWithoutSchema, hasIdempotentExternalEffectWithoutRetry, hasLayerFactory, hasLiveTestService, hasNPlusOneWithoutBatchedResolver, hasOutputBoundaryWithoutSchema, hasPersistenceReadWithoutSchema, hasRealTestService, hasSharedResourceForEachWithoutSemaphore, hasSharedMutableStateWithoutRef, hasTimeCodeWithoutTestClock, hasUnbatchedResolver, hasUnprovidedServiceInEffectTest, hasUnscopedResourceLayer, hasUnscopedResourceLoop, hasUnsafeResourceStream, hasUnterminatedLongRunningStream, } from './effect-strict-helpers.js';
+function reportAst(context, message, node) {
+    context.report({ message, node });
+}
+function nodeType(node) {
+    return typeof node === 'object' && node !== null ? node.type : undefined;
+}
+function identifierName(node) {
+    return nodeType(node) === 'Identifier' ? node.name : undefined;
+}
+function literalValue(node) {
+    return nodeType(node) === 'Literal' ? node.value : undefined;
+}
+function isVoidZero(node) {
+    if (nodeType(node) !== 'UnaryExpression') {
+        return false;
+    }
+    const unary = node;
+    return unary.operator === 'void' && literalValue(unary.argument) === 0;
+}
+function memberParts(node) {
+    if (nodeType(node) !== 'MemberExpression') {
+        return {};
+    }
+    const member = node;
+    return {
+        objectName: identifierName(member.object),
+        propertyName: identifierName(member.property),
+    };
+}
+function isMember(node, objectName, propertyName) {
+    const parts = memberParts(node);
+    return parts.objectName === objectName && parts.propertyName === propertyName;
+}
+function isSchemaMember(node, source, propertyName) {
+    const parts = memberParts(node);
+    return Boolean(parts.objectName &&
+        parts.propertyName === propertyName &&
+        effectApiAliases(source, 'Schema').includes(parts.objectName));
+}
+function effectCallPredicate(source, names) {
+    const memberNames = new Set(names);
+    const importAliases = new Set(effectImportAliases(source));
+    const functionAliases = new Set(names.flatMap((name) => effectFunctionAliases(source, 'Effect', name)));
+    return (callee) => {
+        const { objectName, propertyName } = memberParts(callee);
+        if (objectName && propertyName) {
+            return importAliases.has(objectName) && memberNames.has(propertyName);
+        }
+        const calleeName = identifierName(callee);
+        return Boolean(calleeName && functionAliases.has(calleeName));
+    };
+}
+function serviceKeyFromClass(node, source) {
+    const { id, superClass } = node;
+    const className = identifierName(id);
+    if (nodeType(superClass) !== 'CallExpression') {
+        return { className };
+    }
+    const outer = superClass;
+    const inner = outer.callee;
+    if (!inner || nodeType(inner) !== 'CallExpression') {
+        return { className };
+    }
+    const innerCall = inner;
+    const { objectName, propertyName } = memberParts(innerCall.callee);
+    if (objectName === 'Context' && (propertyName === 'Tag' || propertyName === 'GenericTag')) {
+        return { className, key: literalValue(innerCall.arguments?.[0]) };
+    }
+    if (objectName &&
+        effectImportAliases(source).includes(objectName) &&
+        propertyName === 'Service') {
+        return { className, key: literalValue(outer.arguments?.[0]) };
+    }
+    return { className };
+}
+function hasRetryScheduleWithoutJitter(source) {
+    for (const match of source.matchAll(/\bEffect\.retry\s*\(/g)) {
+        const openParenIndex = source.indexOf('(', match.index);
+        const callBody = source.slice(openParenIndex + 1, findBalancedCallEnd(source, openParenIndex));
+        if (/\bSchedule\./.test(callBody) && !/\bjitter(?:ed)?\b/.test(callBody)) {
+            return true;
+        }
+    }
+    return false;
+}
+function publicApiDeclarationSignature(declaration) {
+    if (/^\s*(?:export\s+)?(?:async\s+)?function\b/.test(declaration)) {
+        const bodyStart = declaration.indexOf('{');
+        return bodyStart === -1 ? declaration : declaration.slice(0, bodyStart);
+    }
+    if (/^\s*(?:export\s+)?(?:const|let|var)\b/.test(declaration)) {
+        const bodyStart = declaration.indexOf('{');
+        return bodyStart === -1 ? declaration : declaration.slice(0, bodyStart);
+    }
+    return declaration;
+}
+function hasClassPromiseReturningPublicMember(declaration) {
+    if (!/^\s*(?:export\s+)?(?:default\s+)?(?:abstract\s+)?class\b/.test(declaration)) {
+        return false;
+    }
+    const signatureSource = stripCommentsAndStrings(declaration);
+    const publicMemberPrefix = '(?!private\\b|protected\\b)(?:(?:public|static|abstract|override|declare|readonly)\\s+)*';
+    const memberName = '[A-Za-z_$][\\w$]*';
+    const memberStart = `(?:^|[{\\n;]\\s*)${publicMemberPrefix}${memberName}`;
+    const accessorStart = `(?:^|[{\\n;]\\s*)${publicMemberPrefix}`;
+    return (new RegExp(`${memberStart}\\s*\\([^)]*\\)\\s*:\\s*Promise\\s*<`).test(signatureSource) ||
+        new RegExp(`(?:^|[{\\n;]\\s*)${publicMemberPrefix}async\\s+${memberName}\\s*\\([^)]*\\)`).test(signatureSource) ||
+        new RegExp(`${memberStart}\\s*=\\s*async\\b`).test(signatureSource) ||
+        new RegExp(`${memberStart}\\s*=\\s*\\([^)]*\\)\\s*:\\s*Promise\\s*<`).test(signatureSource) ||
+        new RegExp(`${memberStart}\\s*:\\s*[^;\\n=]*Promise\\s*<`).test(signatureSource) ||
+        new RegExp(`${accessorStart}get\\s+${memberName}\\s*\\([^)]*\\)\\s*:\\s*Promise\\s*<`).test(signatureSource) ||
+        new RegExp(`${accessorStart}accessor\\s+${memberName}\\s*:\\s*[^;\\n=]*Promise\\s*<`).test(signatureSource));
+}
+function hasPromiseReturningPublicApi(source) {
+    return exportedDeclarationTexts(source).some((declaration) => {
+        if (/^\s*(?:export\s+)?(?:default\s+)?(?:abstract\s+)?class\b/.test(declaration)) {
+            return hasClassPromiseReturningPublicMember(declaration);
+        }
+        const signature = stripCommentsAndStrings(publicApiDeclarationSignature(declaration));
+        return (/\bPromise\s*</.test(signature) ||
+            /^\s*(?:export\s+)?async\s+function\b/.test(signature) ||
+            /=\s*async\b/.test(signature));
+    });
+}
+function hasExportedRunPromiseApi(source) {
+    return exportedDeclarationTexts(source).some((declaration) => /\bEffect\.runPromise\s*\(/.test(stripCommentsAndStrings(declaration)));
+}
+function hasRunSyncInServerRequestHandler(source) {
+    const code = stripCommentsAndStrings(source);
+    for (const match of code.matchAll(/\b(?:handler|route|loader|action)\s*=/g)) {
+        const segment = code.slice(match.index, findStatementEnd(code, match.index) + 1);
+        if (/\bEffect\.runSync\s*\(/.test(segment)) {
+            return true;
+        }
+    }
+    for (const match of code.matchAll(/\bfunction\s+(?:handler|route|loader|action)\s*\(/g)) {
+        const bodyStart = code.indexOf('{', match.index);
+        if (bodyStart === -1) {
+            continue;
+        }
+        const bodyEnd = findMatchingBrace(code, bodyStart);
+        if (bodyEnd !== -1 && /\bEffect\.runSync\s*\(/.test(code.slice(bodyStart, bodyEnd + 1))) {
+            return true;
+        }
+    }
+    return false;
+}
+function hasCryptoRandomUuid(source) {
+    const match = /\bcrypto\.randomUUID\s*\(/.exec(stripCommentsAndStrings(source));
+    return match?.index ?? false;
+}
+function hasSchemaInstanceof(source) {
+    const code = stripCommentsAndStrings(source);
+    const match = /\binstanceof\s+[A-Z][\w$]*(?:Schema|Request)\b/.exec(code);
+    return match?.index ?? false;
+}
+function hasSchemaStructWithTag(source) {
+    const match = /\bSchema\.Struct\s*\(\s*{[\s\S]*?_tag\s*:\s*Schema\.Literal\s*\(/.exec(stripCommentsAndStrings(source));
+    return match?.index ?? false;
+}
+function hasSchemaUnionOfLiterals(source) {
+    const match = /\bSchema\.Union\s*\(\s*Schema\.Literal\s*\([^)]*\)\s*,\s*Schema\.Literal\s*\(/.exec(stripCommentsAndStrings(source));
+    return match?.index ?? false;
+}
+function hasNonDeterministicServiceKey(source) {
+    const code = stripComments(source);
+    const legacyPattern = /\bclass\s+([A-Z][\w$]*)\s+extends\s+(?:Context\.Tag|Effect\.Service|Effect\.Tag)\s*\(\s*['"`]([^'"`]+)['"`]\s*\)/g;
+    for (const match of code.matchAll(legacyPattern)) {
+        const [, className, key] = match;
+        if (className !== key && !key.endsWith(`/${className}`)) {
+            return match.index;
+        }
+    }
+    const servicePattern = /\bclass\s+([A-Z][\w$]*)\s+extends\s+Effect\.Service\s*<\s*[A-Z][\w$]*\s*>\s*\(\s*\)\s*\(\s*['"`]([^'"`]+)['"`]/g;
+    for (const match of code.matchAll(servicePattern)) {
+        const [, className, key] = match;
+        if (className !== key && !key.endsWith(`/${className}`)) {
+            return match.index;
+        }
+    }
+    return false;
+}
+function hasMultipleProvideChain(source) {
+    const code = stripCommentsAndStrings(source);
+    const match = /\.pipe\s*\([\s\S]*?Effect\.provide\s*\([\s\S]*?Effect\.provide\s*\(/.exec(code);
+    return match?.index ?? false;
+}
+function hasLayerEffectWithScope(source) {
+    const code = stripCommentsAndStrings(source);
+    const match = /\bLayer\.effect\s*\([\s\S]*?\b(?:Scope\.Scope|Scope)\b/.exec(code);
+    return match?.index ?? false;
+}
+function hasNodeBuiltinImport(source) {
+    const match = /\bfrom\s+['"]node:(?:fs|fs\/promises|path|child_process|crypto|stream|http|https)['"]/.exec(stripComments(source));
+    return match?.index ?? false;
+}
+function hasGlobalFetch(source, context) {
+    const code = stripCommentsAndStrings(source);
+    if (isConfiguredPath(context, 'adapterLayers')) {
+        return false;
+    }
+    for (const match of code.matchAll(/\bfetch\s*\(/g)) {
+        const wrappedFetch = Boolean(effectWrapperStatement(code, match.index));
+        if (wrappedFetch) {
+            return match.index;
+        }
+    }
+    return false;
+}
+function hasEffectSucceedWithVoid(source) {
+    const match = /\bEffect\.succeed\s*\(\s*(?:undefined|void\s+0)?\s*\)/.exec(stripCommentsAndStrings(source));
+    return match?.index ?? false;
+}
+function hasMapToVoid(source) {
+    const match = /\bEffect\.map\s*\(\s*\(\s*\)\s*=>\s*(?:undefined|void\s+0|\{\s*\})\s*\)/.exec(stripCommentsAndStrings(source));
+    return match?.index ?? false;
+}
+function hasMapFlatten(source) {
+    const match = /\bEffect\.map\s*\([\s\S]*?\)\s*,\s*Effect\.flatten\b|\bEffect\.map\s*\([\s\S]*?\)\.pipe\s*\(\s*Effect\.flatten\b/.exec(stripCommentsAndStrings(source));
+    return match?.index ?? false;
+}
+function effectWrapperStatement(source, targetIndex) {
+    const statementStart = Math.max(source.lastIndexOf(';', targetIndex) + 1, source.lastIndexOf('\n', targetIndex) + 1);
+    const statementEnd = findStatementEnd(source, statementStart);
+    const statement = source.slice(statementStart, statementEnd + 1);
+    return /\bEffect\.(?:promise|tryPromise)\s*\(/.test(statement) ? statement : undefined;
+}
+function hasDirectPlatformAccess(source, context) {
+    if (isConfiguredPath(context, 'adapterLayers')) {
+        return false;
+    }
+    const code = stripCommentsAndStrings(source);
+    for (const match of code.matchAll(/\b(?:fetch|readFileSync|writeFileSync|createReadStream)\s*\(/g)) {
+        if (!match[0].startsWith('fetch')) {
+            return true;
+        }
+        if (!effectWrapperStatement(code, match.index)) {
+            return true;
+        }
+    }
+    return false;
+}
+const effectStrictSpecs = [
+    {
+        name: 'effect-no-run-outside-entrypoints',
+        message: 'Run Effect programs only from configured entrypoints.',
+        tokens: ['Effect', 'effect', 'runMain'],
+        check: (source, context) => hasRuntimeCall(source) &&
+            !hasExportedRunPromiseApi(source) &&
+            !hasRunForkWithoutObserver(source) &&
+            !isEffectTestPath(context) &&
+            !isConfiguredPath(context, 'entrypoints'),
+    },
+    {
+        name: 'effect-require-platform-runmain-at-entrypoints',
+        message: 'Entrypoints should use the platform runMain boundary instead of raw Effect runners.',
+        tokens: ['Effect.run', 'effect/Effect', 'runPromise', 'runSync', 'runFork'],
+        check: (source, context) => isConfiguredPath(context, 'entrypoints') &&
+            /Effect\.run(?:Promise|Sync|Fork)/.test(stripCommentsAndStrings(source)),
+    },
+    {
+        name: 'effect-no-runSync-in-server-request-handlers',
+        message: 'Server handlers must not synchronously run Effects.',
+        tokens: ['Effect.runSync'],
+        check: hasRunSyncInServerRequestHandler,
+    },
+    {
+        name: 'effect-no-promise-returning-public-api',
+        message: 'Public APIs should expose Effect return types instead of Promise.',
+        tokens: ['Promise', 'async'],
+        check: hasPromiseReturningPublicApi,
+    },
+    {
+        name: 'effect-no-direct-process-env-outside-config-layer',
+        message: 'Read process.env only inside the configured Effect Config layer.',
+        tokens: ['process'],
+        check: (source, context) => /\bprocess\s*\.\s*env\b/.test(stripCommentsAndStrings(source)) &&
+            !hasEffectSignal(source) &&
+            !isConfiguredPath(context, 'configLayers'),
+    },
+    {
+        name: 'effect-no-direct-clock-random-outside-adapters',
+        message: 'Use Clock and Random services outside configured adapter modules.',
+        tokens: ['Date', 'Math'],
+        check: (source, context) => /\b(?:Date\s*\.\s*now|Math\s*\.\s*random)\s*\(/.test(stripCommentsAndStrings(source)) &&
+            !hasEffectSignal(source) &&
+            !isConfiguredPath(context, 'adapterLayers'),
+    },
+    {
+        name: 'effect-no-direct-http-fs-outside-platform-services',
+        message: 'Use Effect platform services for HTTP and filesystem access outside adapters.',
+        tokens: ['fetch', 'readFileSync', 'writeFileSync', 'createReadStream'],
+        check: hasDirectPlatformAccess,
+    },
+    {
+        name: 'effect-require-service-class-pattern',
+        message: 'Services must use the configured class-based Effect service pattern.',
+        tokens: ['Context.GenericTag'],
+        patterns: [/Context\.GenericTag(?:<[^>]+>)?\s*\(\s*['"`]/],
+    },
+    {
+        name: 'effect-require-tag-identifier',
+        message: 'Service tags require stable identifiers.',
+        tokens: ['Context.Tag', 'Context.GenericTag'],
+        patterns: [
+            /Context\.Tag(?:<[^>]+>)?\s*\(\s*\)/,
+            /Context\.GenericTag(?:<[^>]+>)?\s*\(\s*\)/,
+            /class\s+[A-Z][\w$]*\s+extends\s+Context\.Tag\s*\(\s*\)/,
+        ],
+    },
+    {
+        name: 'effect-no-leaked-service-dependencies',
+        message: 'Domain exports must not leak raw service implementation dependencies.',
+        tokens: ['Layer', 'Live'],
+        check: (source, context) => isConfiguredPath(context, 'domain') && /Layer\.|Live\b/.test(stripCommentsAndStrings(source)),
+    },
+    {
+        name: 'effect-no-duplicate-layer-instances',
+        message: 'Do not construct the same Layer multiple times in one module.',
+        tokens: ['Layer'],
+        check: hasDuplicateLayerInstance,
+    },
+    {
+        name: 'effect-require-centralized-provision',
+        message: 'Provide layers only from configured composition roots.',
+        tokens: ['Effect.provide', 'Layer.provide'],
+        check: (source, context) => /Effect\.provide|Layer\.provide/.test(stripCommentsAndStrings(source)) &&
+            !isConfiguredPath(context, 'compositionRoots'),
+    },
+    {
+        name: 'effect-no-provide-in-domain-modules',
+        message: 'Domain modules should declare requirements, not provide concrete layers.',
+        tokens: ['Effect.provide', 'Layer.provide'],
+        check: (source, context) => isConfiguredPath(context, 'domain') &&
+            /Effect\.provide|Layer\.provide/.test(stripCommentsAndStrings(source)),
+    },
+    {
+        name: 'effect-require-layer-memoization-constant',
+        message: 'Shared layers should be memoized constants instead of functions that recreate resources.',
+        tokens: ['Layer'],
+        check: hasLayerFactory,
+    },
+    {
+        name: 'effect-require-suspend-for-circular-deps',
+        message: 'Circular layer dependencies must be suspended.',
+        tokens: ['Layer'],
+        patterns: [
+            /Layer\.(?:effect|scoped)\s*\([\s\S]*?Layer\.(?:effect|scoped)\s*\((?![\s\S]*Effect\.suspend)/,
+        ],
+    },
+    {
+        name: 'effect-avoid-layer-explosion',
+        message: 'Avoid tiny one-off Layer declarations that fragment dependency wiring.',
+        tokens: ['Layer'],
+        patterns: [
+            /const\s+[A-Za-z_$][\w$]*Layer\s*=\s*Layer\.[\s\S]*const\s+[A-Za-z_$][\w$]*Layer\s*=\s*Layer\./,
+        ],
+    },
+    {
+        name: 'effect-prefer-succeed-for-static-layers',
+        message: 'Use Layer.succeed for static pure services.',
+        tokens: ['Layer.effect', 'Effect.succeed'],
+        patterns: [/Layer\.effect\s*\([^,]+,\s*Effect\.succeed\s*\(/],
+    },
+    {
+        name: 'effect-require-scoped-for-resource-layers',
+        message: 'Layers that allocate resources must be scoped.',
+        tokens: ['Layer'],
+        check: hasUnscopedResourceLayer,
+    },
+    {
+        name: 'effect-no-service-construction-outside-layer',
+        message: 'Construct services inside Layers, not directly in domain or application logic.',
+        tokens: ['Service', 'Repo', 'Client'],
+        check: (source, context) => !isConfiguredPath(context, 'adapterLayers') &&
+            !isConfiguredPath(context, 'configLayers') &&
+            !/Layer\./.test(stripCommentsAndStrings(source)) &&
+            /new\s+[A-Z][\w$]*(?:Service|Repo|Client)\s*\(/.test(stripCommentsAndStrings(source)),
+    },
+    {
+        name: 'effect-schema-require-validation-at-input-boundaries',
+        message: 'Input boundaries must decode request, command, or message data with Schema.',
+        tokens: ['.body', '.params', '.query', '.payload'],
+        check: hasBoundaryDataWithoutSchema,
+    },
+    {
+        name: 'effect-schema-require-validation-at-output-boundaries',
+        message: 'Output boundaries should encode or validate public response data.',
+        tokens: ['Response.json', 'return json'],
+        check: hasOutputBoundaryWithoutSchema,
+    },
+    {
+        name: 'effect-schema-require-http-client-response-schema',
+        message: 'HTTP client responses must be decoded with Schema.',
+        tokens: ['HttpClient.', 'response.json'],
+        check: hasHttpClientResponseWithoutSchema,
+    },
+    {
+        name: 'effect-schema-require-http-server-request-schema',
+        message: 'HTTP server requests must be decoded with Schema.',
+        tokens: ['HttpRouter.', 'HttpServerRequest'],
+        check: hasHttpServerRequestWithoutSchema,
+    },
+    {
+        name: 'effect-schema-require-config-schema',
+        message: 'Configuration modules must decode configuration with Schema.',
+        tokens: ['Config'],
+        check: (source, context) => isConfiguredPath(context, 'configLayers') &&
+            /Config\./.test(stripCommentsAndStrings(source)) &&
+            !/Schema\./.test(stripCommentsAndStrings(source)),
+    },
+    {
+        name: 'effect-schema-require-persistence-schema',
+        message: 'Persistence boundaries must validate loaded records with Schema.',
+        tokens: ['db.', 'database.', 'collection.', 'repository.'],
+        check: hasPersistenceReadWithoutSchema,
+    },
+    {
+        name: 'effect-schema-require-public-command-schema',
+        message: 'Public command handlers must declare and use input schemas.',
+        tokens: ['handler'],
+        check: hasCommandHandlerWithoutSchema,
+    },
+    {
+        name: 'effect-schema-no-unknown-crossing-boundary',
+        message: 'unknown values must be decoded before crossing configured boundaries.',
+        tokens: ['unknown'],
+        check: (source) => exportedDeclarationTexts(source).some((declaration) => /\bunknown\b/.test(stripCommentsAndStrings(publicApiDeclarationSignature(declaration)))),
+    },
+    {
+        name: 'effect-require-timeout-on-external-effects',
+        message: 'External effects must declare a timeout.',
+        tokens: ['HttpClient.', 'fetch', 'FileSystem.', 'SqlClient.'],
+        check: (source) => hasExternalEffectWithoutTimeout(source),
+    },
+    {
+        name: 'effect-require-retry-policy-for-idempotent-external-effects',
+        message: 'Idempotent external effects must declare retry policy deliberately.',
+        tokens: ['HttpClient.', 'fetch', 'find', 'lookup', 'read'],
+        check: (source) => hasIdempotentExternalEffectWithoutRetry(source),
+    },
+    {
+        name: 'effect-require-schedule-jitter-for-retries',
+        message: 'Retry schedules must include jitter.',
+        tokenGroups: [['Effect.retry'], ['Schedule.']],
+        check: hasRetryScheduleWithoutJitter,
+    },
+    {
+        name: 'effect-require-span-external',
+        message: 'External effects must declare an observability span.',
+        tokens: ['HttpClient.', 'fetch', 'FileSystem.', 'SqlClient.'],
+        check: (source) => hasExternalEffectWithoutSpan(source),
+    },
+    {
+        name: 'effect-require-semaphore-for-shared-resources',
+        message: 'Shared scarce resources must be guarded by Semaphore.',
+        tokens: ['Effect.forEach'],
+        check: hasSharedResourceForEachWithoutSemaphore,
+    },
+    {
+        name: 'effect-require-ref-for-shared-mutable-state',
+        message: 'Shared mutable state must use Ref, SynchronizedRef, or scoped services.',
+        tokens: ['let '],
+        check: hasSharedMutableStateWithoutRef,
+    },
+    {
+        name: 'effect-require-scoped-in-loops',
+        message: 'Loops that acquire resources must scope each acquisition.',
+        tokens: ['open', 'connect', 'subscribe', 'listen'],
+        check: hasUnscopedResourceLoop,
+    },
+    {
+        name: 'effect-require-onExit-for-cleanup',
+        message: 'Cleanup logic should use onExit so success, failure, and interruption are handled.',
+        tokens: ['Effect.ensuring', 'cleanup'],
+        check: hasEnsuringCleanupWithoutOnExit,
+    },
+    {
+        name: 'effect-require-stream-resource-safety',
+        message: 'Streams over resources must be scoped or bracketed.',
+        tokens: ['Stream'],
+        check: hasUnsafeResourceStream,
+    },
+    {
+        name: 'effect-require-stream-termination',
+        message: 'Long-running streams must declare termination or shutdown behavior.',
+        tokens: ['Stream'],
+        check: hasUnterminatedLongRunningStream,
+    },
+    {
+        name: 'effect-require-explicit-asyncPush-buffer',
+        message: 'Stream.asyncPush must declare an explicit buffer/backpressure policy.',
+        tokens: ['Stream.asyncPush'],
+        check: hasAsyncPushWithoutBuffer,
+    },
+    {
+        name: 'effect-require-batching-for-resolver',
+        message: 'RequestResolver implementations should batch requests.',
+        tokens: ['RequestResolver'],
+        check: hasUnbatchedResolver,
+    },
+    {
+        name: 'effect-use-batched-resolver-for-n-plus-one',
+        message: 'Potential N+1 data access should use a batched RequestResolver.',
+        tokens: ['Effect.forEach'],
+        check: hasNPlusOneWithoutBatchedResolver,
+    },
+    {
+        name: 'effect-prefer-pubsub-for-broadcast',
+        message: 'Use PubSub for broadcast semantics instead of manually fanning out queues.',
+        tokens: ['Queue', 'broadcast', 'subscribers'],
+        patterns: [/Queue\.[\s\S]*?\bsubscribers\b|broadcast\s*\([\s\S]*?Queue\./],
+    },
+    {
+        name: 'effect-require-provided-services-in-tests',
+        message: 'Effect tests must provide required services explicitly.',
+        tokens: ['Service', 'Repo', 'Client'],
+        check: (source, context) => isEffectTestPath(context) && hasUnprovidedServiceInEffectTest(source),
+    },
+    {
+        name: 'effect-prefer-in-memory-implementations',
+        message: 'Unit tests should use in-memory service implementations.',
+        tokens: ['real'],
+        check: (source, context) => isUnitTestPath(context) && hasRealTestService(source),
+    },
+    {
+        name: 'effect-no-live-services-in-unit-tests',
+        message: 'Live services belong in integration tests, not unit tests.',
+        tokens: ['Live', 'Layer.live'],
+        check: (source, context) => isUnitTestPath(context) && hasLiveTestService(source),
+    },
+    {
+        name: 'effect-require-testclock-for-time-code',
+        message: 'Tests for time-dependent Effect code should use TestClock.',
+        tokens: ['Effect.timeout', 'Effect.delay', 'Clock.'],
+        check: (source, context) => isEffectTestPath(context) && hasTimeCodeWithoutTestClock(source),
+    },
+    {
+        name: 'effect-no-test-runtime-leakage',
+        message: 'Do not share mutable runtime, layer, or service state across Effect tests.',
+        tokens: ['Runtime', 'Layer', 'Service'],
+        check: (source, context) => isEffectTestPath(context) &&
+            /const\s+[A-Za-z_$][\w$]*(?:Runtime|Layer|Service)\s*=/.test(source),
+    },
+    {
+        name: 'effect-no-ad-hoc-effect-wrapper-abstractions',
+        message: 'Do not hide Effect semantics behind local wrapper DSLs.',
+        tokens: ['runEffect', 'makeEffect', 'effectify', 'toEffect'],
+        patterns: [/function\s+(?:runEffect|makeEffect|effectify|toEffect)\s*\(/],
+    },
+    {
+        name: 'effect-require-effect-suppression-reason-and-ticket',
+        message: 'Effect rule suppressions must name a rule, a reason, and a tracking ticket.',
+        tokens: ['disable', 'effect-'],
+        check: (source) => source.split('\n').some((line) => {
+            if (!/(?:eslint|oxlint)-disable[^\n]*effect-/.test(line)) {
+                return false;
+            }
+            return !/(?:reason|because)[^\n]*(?:[A-Z]+-\d+|#\d+)/.test(line);
+        }),
+    },
+    {
+        name: 'effect-no-crypto-randomUUID',
+        message: 'Use Effect Random or an injected UUID service instead of crypto.randomUUID.',
+        tokens: ['crypto.randomUUID'],
+        check: hasCryptoRandomUuid,
+        ast: (context) => ({
+            CallExpression(node) {
+                if (isMember(node.callee, 'crypto', 'randomUUID')) {
+                    reportAst(context, 'Use Effect Random or an injected UUID service instead of crypto.randomUUID.', node);
+                }
+            },
+        }),
+    },
+    {
+        name: 'effect-require-schema-is-over-instanceof',
+        message: 'Use Schema.is for schema-modeled domain checks instead of instanceof.',
+        tokens: ['instanceof'],
+        check: hasSchemaInstanceof,
+        ast: (context) => ({
+            BinaryExpression(node) {
+                const binary = node;
+                const rightName = identifierName(binary.right);
+                if (binary.operator === 'instanceof' &&
+                    rightName &&
+                    /(?:Schema|Request)$/.test(rightName)) {
+                    reportAst(context, 'Use Schema.is for schema-modeled domain checks instead of instanceof.', node);
+                }
+            },
+        }),
+    },
+    {
+        name: 'effect-prefer-schema-tagged-struct',
+        message: 'Use Schema.TaggedStruct or Schema.TaggedClass instead of Struct with _tag.',
+        tokens: ['Schema', '_tag'],
+        check: hasSchemaStructWithTag,
+        ast: (context, source) => ({
+            CallExpression(node) {
+                const call = node;
+                const firstArg = call.arguments?.[0];
+                if (!isSchemaMember(call.callee, source, 'Struct') ||
+                    nodeType(firstArg) !== 'ObjectExpression') {
+                    return;
+                }
+                const objectArg = firstArg;
+                if (objectArg.properties?.some((property) => {
+                    const prop = property;
+                    return (identifierName(prop.key) === '_tag' &&
+                        isSchemaMember(prop.value.callee, source, 'Literal'));
+                })) {
+                    reportAst(context, 'Use Schema.TaggedStruct or Schema.TaggedClass instead of Struct with _tag.', node);
+                }
+            },
+        }),
+    },
+    {
+        name: 'effect-prefer-single-schema-literal-union',
+        message: 'Combine literal alternatives into one Schema.Literal call.',
+        tokens: ['Schema.Union', 'Schema.Literal', 'effect'],
+        check: hasSchemaUnionOfLiterals,
+        ast: (context, source) => ({
+            CallExpression(node) {
+                const call = node;
+                const literalArgCount = call.arguments?.filter((argument) => isSchemaMember(argument.callee, source, 'Literal')).length ?? 0;
+                if (isSchemaMember(call.callee, source, 'Union') && literalArgCount > 1) {
+                    reportAst(context, 'Combine literal alternatives into one Schema.Literal call.', node);
+                }
+            },
+        }),
+    },
+    {
+        name: 'effect-require-deterministic-service-keys',
+        message: 'Service/tag identifiers must deterministically match the service class.',
+        tokens: ['Context.Tag', 'Effect.Service', 'Effect.Tag'],
+        check: hasNonDeterministicServiceKey,
+        ast: (context, source) => ({
+            ClassDeclaration(node) {
+                const { className, key } = serviceKeyFromClass(node, source);
+                if (className && key && className !== key && !key.endsWith(`/${className}`)) {
+                    reportAst(context, 'Service/tag identifiers must deterministically match the service class.', node);
+                }
+            },
+        }),
+    },
+    {
+        name: 'effect-no-multiple-provide-chain',
+        message: 'Avoid chaining Effect.provide calls; compose layers deliberately at the root.',
+        tokens: ['Effect.provide'],
+        check: hasMultipleProvideChain,
+    },
+    {
+        name: 'effect-require-layer-scoped-when-scope-required',
+        message: 'Use Layer.scoped when a Layer effect requires Scope.',
+        tokens: ['Layer.effect', 'Scope'],
+        check: hasLayerEffectWithScope,
+    },
+    {
+        name: 'effect-no-node-builtins-when-effect-platform-exists',
+        message: 'Use Effect platform services instead of direct Node built-in imports.',
+        tokens: ['node:'],
+        check: hasNodeBuiltinImport,
+        ast: (context) => ({
+            ImportDeclaration(node) {
+                const sourceValue = literalValue(node.source);
+                if (!isConfiguredPath(context, 'adapterLayers') &&
+                    typeof sourceValue === 'string' &&
+                    /^node:(?:fs|fs\/promises|path|child_process|crypto|stream|http|https)$/.test(sourceValue)) {
+                    reportAst(context, 'Use Effect platform services instead of direct Node built-in imports.', node);
+                }
+            },
+        }),
+    },
+    {
+        name: 'effect-no-global-fetch',
+        message: 'Use the Effect HTTP client or an adapter service instead of global fetch.',
+        tokens: ['fetch'],
+        check: hasGlobalFetch,
+        ast: (context, source) => ({
+            CallExpression(node) {
+                const calleeName = identifierName(node.callee);
+                const wrappedFetch = effectWrapperStatement(stripCommentsAndStrings(source), node.start ?? 0);
+                if (calleeName === 'fetch' && !isConfiguredPath(context, 'adapterLayers') && wrappedFetch) {
+                    reportAst(context, 'Use the Effect HTTP client or an adapter service instead of global fetch.', node);
+                }
+            },
+        }),
+    },
+    {
+        name: 'effect-prefer-effect-void',
+        message: 'Use Effect.void instead of Effect.succeed(undefined).',
+        tokens: ['succeed'],
+        check: hasEffectSucceedWithVoid,
+        ast: (context, source) => {
+            const isEffectSucceed = effectCallPredicate(source, ['succeed']);
+            return {
+                CallExpression(node) {
+                    const call = node;
+                    const firstArg = call.arguments?.[0];
+                    if (isEffectSucceed(call.callee) &&
+                        (!firstArg || identifierName(firstArg) === 'undefined' || isVoidZero(firstArg))) {
+                        reportAst(context, 'Use Effect.void instead of Effect.succeed(undefined).', node);
+                    }
+                },
+            };
+        },
+    },
+    {
+        name: 'effect-prefer-asVoid',
+        message: 'Use Effect.asVoid instead of mapping to undefined or an empty block.',
+        tokens: ['Effect', 'effect'],
+        check: hasMapToVoid,
+    },
+    {
+        name: 'effect-prefer-flatMap-over-map-flatten',
+        message: 'Use Effect.flatMap instead of Effect.map followed by Effect.flatten.',
+        tokens: ['Effect', 'effect'],
+        check: hasMapFlatten,
+    },
+];
+const effectStrictRules = makeRules(effectStrictSpecs, { schema: strictPathOptionsSchema });
+export default effectStrictRules;
+//# sourceMappingURL=effect-strict.js.map