@ttsc/lint 0.13.1 → 0.14.0-dev.20260528.1

package/src/structures/rules/ITtscLintRules.ts

@@ -0,0 +1,77 @@
+import type { ITtscLintBoundariesRules } from "./ITtscLintBoundariesRules";
+import type { ITtscLintContributorRules } from "./ITtscLintContributorRules";
+import type { ITtscLintCoreRules } from "./ITtscLintCoreRules";
+import type { ITtscLintCypressRules } from "./ITtscLintCypressRules";
+import type { ITtscLintFunctionalRules } from "./ITtscLintFunctionalRules";
+import type { ITtscLintJestRules } from "./ITtscLintJestRules";
+import type { ITtscLintJsdocRules } from "./ITtscLintJsdocRules";
+import type { ITtscLintJsxA11yRules } from "./ITtscLintJsxA11yRules";
+import type { ITtscLintNextjsRules } from "./ITtscLintNextjsRules";
+import type { ITtscLintPlaywrightRules } from "./ITtscLintPlaywrightRules";
+import type { ITtscLintPromiseRules } from "./ITtscLintPromiseRules";
+import type { ITtscLintReactPerfRules } from "./ITtscLintReactPerfRules";
+import type { ITtscLintReactRules } from "./ITtscLintReactRules";
+import type { ITtscLintRegexpRules } from "./ITtscLintRegexpRules";
+import type { ITtscLintSecurityRules } from "./ITtscLintSecurityRules";
+import type { ITtscLintSolidRules } from "./ITtscLintSolidRules";
+import type { ITtscLintStorybookRules } from "./ITtscLintStorybookRules";
+import type { ITtscLintTanstackQueryRules } from "./ITtscLintTanstackQueryRules";
+import type { ITtscLintTestingLibraryRules } from "./ITtscLintTestingLibraryRules";
+import type { ITtscLintTypeScriptRules } from "./ITtscLintTypeScriptRules";
+import type { ITtscLintUnicornRules } from "./ITtscLintUnicornRules";
+import type { ITtscLintVitestRules } from "./ITtscLintVitestRules";
+
+/**
+ * Rule severity map accepted by `ITtscLintConfig.rules`.
+ *
+ * Built-in rule families are exposed as separate interfaces under this
+ * directory so users can import a narrow family type when composing configs.
+ * `ITtscLintRules` is the intersection of every built-in family plus the
+ * open-ended contributor plugin signature.
+ *
+ * Rule id conventions:
+ *
+ * - Bare kebab-case ids (`eqeqeq`, `no-console`) belong to
+ *   {@link ITtscLintCoreRules} — generic ESLint-compatible rules that apply to
+ *   both JS and TS source.
+ * - `typescript/*` ids belong to {@link ITtscLintTypeScriptRules} —
+ *   TypeScript-only and `@typescript-eslint` plugin rules. `@ttsc/lint` does
+ *   not accept legacy bare names or `@typescript-eslint/*` aliases for these
+ *   rules.
+ * - `react/*` ids in {@link ITtscLintReactRules} bundle `eslint-plugin-react`,
+ *   `eslint-plugin-react-hooks`, and `eslint-plugin-react-refresh`.
+ *   Performance-only React rules live separately in
+ *   {@link ITtscLintReactPerfRules} because they are opt-in toggles rather than
+ *   correctness checks (matching Oxlint).
+ * - Every other namespaced id (`boundaries/*`, `cypress/*`, `functional/*`, ...)
+ *   is a built-in family with a matching interface in this directory.
+ * - Formatter behavior is **not** configured here. Use the top-level `format`
+ *   block (typed as `ITtscLintFormat`); `format/*` is an internal
+ *   implementation detail of `ttsc format` and is deliberately absent from the
+ *   public rules surface.
+ * - Any other `"<namespace>/<rule>"` key is accepted via
+ *   {@link ITtscLintContributorRules} so plugin-shipped rules compose cleanly
+ *   without ambient module augmentation.
+ */
+export type ITtscLintRules = ITtscLintCoreRules &
+  ITtscLintTypeScriptRules &
+  ITtscLintBoundariesRules &
+  ITtscLintCypressRules &
+  ITtscLintFunctionalRules &
+  ITtscLintJestRules &
+  ITtscLintJsdocRules &
+  ITtscLintJsxA11yRules &
+  ITtscLintNextjsRules &
+  ITtscLintPlaywrightRules &
+  ITtscLintPromiseRules &
+  ITtscLintReactRules &
+  ITtscLintReactPerfRules &
+  ITtscLintRegexpRules &
+  ITtscLintSecurityRules &
+  ITtscLintSolidRules &
+  ITtscLintStorybookRules &
+  ITtscLintTanstackQueryRules &
+  ITtscLintTestingLibraryRules &
+  ITtscLintUnicornRules &
+  ITtscLintVitestRules &
+  ITtscLintContributorRules;

package/src/structures/rules/ITtscLintSecurityRules.ts

@@ -0,0 +1,162 @@
+import type { TtscLintRuleSetting } from "../TtscLintRuleSetting";
+
+/**
+ * Security-focused TypeScript source rules from
+ * `eslint-plugin-security`.
+ *
+ * Reports likely security smells — non-literal sinks for eval, file
+ * I/O, regex construction, child-process spawning, cryptographic
+ * primitives — that warrant human review even if no exploit is
+ * statically provable.
+ *
+ * Treat findings as *hints*, not proofs.
+ *
+ * @reference https://github.com/eslint-community/eslint-plugin-security
+ */
+export interface ITtscLintSecurityRules {
+  /**
+   * Detect Trojan-Source bidi control characters (U+202A, U+202E,
+   * ...) hidden inside source.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-bidi-characters.md
+   */
+  "security/detect-bidi-characters"?: TtscLintRuleSetting;
+
+  /**
+   * Detect Buffer reads/writes called with `noAssert = true`, which
+   * skips Node's offset/length bounds checks.
+   *
+   * The flag lets the offset slide past the buffer end and read
+   * unrelated memory, so production code should never set it.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-buffer-noassert.md
+   */
+  "security/detect-buffer-noassert"?: TtscLintRuleSetting;
+
+  /**
+   * Detect any import of `child_process` and any `exec`/`execSync`
+   * call whose command argument is not a string literal.
+   *
+   * Non-literal commands are the canonical shell-injection sink in
+   * Node services.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-child-process.md
+   */
+  "security/detect-child-process"?: TtscLintRuleSetting;
+
+  /**
+   * Detect assignments setting `escapeMarkup = false` (or the
+   * equivalent option on Handlebars/Mustache-style engines), which
+   * turns off HTML entity escaping in template output.
+   *
+   * Result: an unguarded XSS sink for caller-controlled strings.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-disable-mustache-escape.md
+   */
+  "security/detect-disable-mustache-escape"?: TtscLintRuleSetting;
+
+  /**
+   * Detect `eval(...)` calls whose argument is not a string literal.
+   *
+   * Any expression argument means caller-controlled data can reach a
+   * code-execution sink. The rule flags the call shape, not proven
+   * taint.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-eval-with-expression.md
+   */
+  "security/detect-eval-with-expression"?: TtscLintRuleSetting;
+
+  /**
+   * Detect `new Buffer(input)` constructions with non-literal
+   * input — historical source of allocation-disclosure bugs.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-new-buffer.md
+   */
+  "security/detect-new-buffer"?: TtscLintRuleSetting;
+
+  /**
+   * Detect Express applications mounting `csrf` middleware before
+   * `methodOverride`, which lets the CSRF token be bypassed.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-no-csrf-before-method-override.md
+   */
+  "security/detect-no-csrf-before-method-override"?: TtscLintRuleSetting;
+
+  /**
+   * Detect `fs` calls (`readFile`, `writeFile`, `createReadStream`,
+   * ...) whose filename argument is not a string literal.
+   *
+   * Dynamic filenames are the standard path-traversal sink; sanitise
+   * or allow-list before the call.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-non-literal-fs-filename.md
+   */
+  "security/detect-non-literal-fs-filename"?: TtscLintRuleSetting;
+
+  /**
+   * Detect `new RegExp(...)` construction whose pattern argument is
+   * not a string literal.
+   *
+   * Caller-controlled patterns can both trigger catastrophic
+   * backtracking and let an attacker reshape the matcher to bypass
+   * intended validation.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-non-literal-regexp.md
+   */
+  "security/detect-non-literal-regexp"?: TtscLintRuleSetting;
+
+  /**
+   * Detect `require(...)` calls whose specifier is computed at
+   * runtime.
+   *
+   * A dynamic specifier lets caller-controlled data choose the module
+   * to load, bypassing any module allow-list on Node.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-non-literal-require.md
+   */
+  "security/detect-non-literal-require"?: TtscLintRuleSetting;
+
+  /**
+   * Detect dynamic bracket-access such as `obj[req.body.x] = ...`,
+   * which can let caller-controlled keys overwrite prototype-shaped
+   * properties or pull out unintended fields.
+   *
+   * Fires on virtually any computed property access; expect a high
+   * false-positive rate in normal application code.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-object-injection.md
+   */
+  "security/detect-object-injection"?: TtscLintRuleSetting;
+
+  /**
+   * Detect direct equality comparisons involving secret-like
+   * identifiers (`if (token === expected)`) — use
+   * `crypto.timingSafeEqual` instead.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-possible-timing-attacks.md
+   */
+  "security/detect-possible-timing-attacks"?: TtscLintRuleSetting;
+
+  /**
+   * Detect `crypto.pseudoRandomBytes`, which produces values that
+   * are not cryptographically secure.
+   *
+   * Tokens, session ids, and key material must use
+   * `crypto.randomBytes` (or Web Crypto's `getRandomValues`) instead.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-pseudoRandomBytes.md
+   */
+  "security/detect-pseudoRandomBytes"?: TtscLintRuleSetting;
+
+  /**
+   * Detect regex literals with catastrophic backtracking potential
+   * (ReDoS) — typically nested or overlapping quantifiers over the
+   * same character set.
+   *
+   * Matching caller-controlled input against such a pattern can
+   * block the event loop for seconds.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-unsafe-regex.md
+   */
+  "security/detect-unsafe-regex"?: TtscLintRuleSetting;
+}

package/src/structures/rules/ITtscLintSolidRules.ts

@@ -0,0 +1,202 @@
+import type { TtscLintRuleSetting } from "../TtscLintRuleSetting";
+
+/**
+ * Solid TSX rules from `eslint-plugin-solid`.
+ *
+ * Solid components compile to fine-grained reactivity, so patterns
+ * that look correct in React (destructuring props, calling
+ * `useEffect`-style hooks with array deps) silently break reactivity
+ * in Solid. This family captures the common Solid-only pitfalls.
+ *
+ * @reference https://github.com/solidjs-community/eslint-plugin-solid
+ */
+export interface ITtscLintSolidRules {
+  /**
+   * Reject early and conditional `return` from a Solid component
+   * — Solid components must return exactly once at the top level.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/components-return-once.md
+   */
+  "solid/components-return-once"?: TtscLintRuleSetting;
+
+  /**
+   * Require DOM event handler props to use canonical Solid casing
+   * (`onClick`, not `onclick` / `onClIcK`) so the compiler recognizes
+   * them as events. Also flags `on*`-named props bound to non-function
+   * values, which look like handlers but are not.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/event-handlers.md
+   */
+  "solid/event-handlers"?: TtscLintRuleSetting;
+
+  /**
+   * Route each Solid export to the correct entry point (`solid-js`,
+   * `solid-js/web`, or `solid-js/store`) and merge duplicate imports
+   * from the same entry.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/imports.md
+   */
+  "solid/imports"?: TtscLintRuleSetting;
+
+  /**
+   * Reject duplicate JSX props on the same Solid element. Unlike
+   * React, Solid silently keeps the first value, so the duplicate is
+   * dead code and almost always a typo.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/jsx-no-duplicate-props.md
+   */
+  "solid/jsx-no-duplicate-props"?: TtscLintRuleSetting;
+
+  /**
+   * Reject `javascript:` URLs in Solid JSX attributes (`href`, `src`,
+   * ...) — they evaluate the suffix as code in the page context and
+   * are a long-standing XSS vector.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/jsx-no-script-url.md
+   */
+  "solid/jsx-no-script-url"?: TtscLintRuleSetting;
+
+  /**
+   * Reject Solid JSX component names that are not declared or
+   * imported in scope.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/jsx-no-undef.md
+   */
+  "solid/jsx-no-undef"?: TtscLintRuleSetting;
+
+  /**
+   * Scope-marker compatibility rule (mirrors ESLint's
+   * `react/jsx-uses-vars`).
+   *
+   * The native engine emits no diagnostics for this id.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/jsx-uses-vars.md
+   */
+  "solid/jsx-uses-vars"?: TtscLintRuleSetting;
+
+  /**
+   * Reject array values passed as Solid event handlers — Solid
+   * does not unwrap the array form React supports.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/no-array-handlers.md
+   */
+  "solid/no-array-handlers"?: TtscLintRuleSetting;
+
+  /**
+   * Reject destructured Solid component props — destructuring breaks
+   * reactivity by reading the property eagerly.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/no-destructure.md
+   */
+  "solid/no-destructure"?: TtscLintRuleSetting;
+
+  /**
+   * Reject `innerHTML` JSX attributes because they bypass sanitization
+   * and are a common XSS sink. A static string literal is still
+   * allowed by default; flip `allowStatic` off to ban that form too.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/no-innerhtml.md
+   */
+  "solid/no-innerhtml"?: TtscLintRuleSetting;
+
+  /**
+   * Reject Solid APIs that rely on ES6 `Proxy` (including `new Proxy`,
+   * `Proxy.revocable`, imports from `solid-js/store`, and dynamic
+   * spread shapes through `mergeProps`). For shipping to runtimes
+   * without `Proxy` support; off by default.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/no-proxy-apis.md
+   */
+  "solid/no-proxy-apis"?: TtscLintRuleSetting;
+
+  /**
+   * Reject React-style dependency arrays in Solid tracked scopes
+   * (`createEffect(() => ..., [deps])`).
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/no-react-deps.md
+   */
+  "solid/no-react-deps"?: TtscLintRuleSetting;
+
+  /**
+   * Reject React-specific JSX props such as `className` and
+   * `htmlFor` — Solid uses `class` and `for`.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/no-react-specific-props.md
+   */
+  "solid/no-react-specific-props"?: TtscLintRuleSetting;
+
+  /**
+   * Restrict namespaced JSX attributes (`ns:name={...}`) to the
+   * built-in Solid namespaces (`on:`, `oncapture:`, `use:`, `prop:`,
+   * `attr:`, `bool:`, `style:`, `class:`). Extra names can be allowed
+   * through the `allowedNamespaces` option.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/no-unknown-namespaces.md
+   */
+  "solid/no-unknown-namespaces"?: TtscLintRuleSetting;
+
+  /**
+   * Rewrite `class={cn({ ... })}` / `clsx(...)` / `classnames(...)`
+   * calls to the reactive `classlist={{ ... }}` prop.
+   *
+   * Deprecated and off by default upstream.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/prefer-classlist.md
+   */
+  "solid/prefer-classlist"?: TtscLintRuleSetting;
+
+  /**
+   * Replace inline `array.map(item => <JSX />)` with Solid's `<For>`
+   * component so the iteration stays keyed and reactive instead of
+   * re-creating every child on each update.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/prefer-for.md
+   */
+  "solid/prefer-for"?: TtscLintRuleSetting;
+
+  /**
+   * Rewrite `{cond && <JSX />}` short-circuits in JSX to `<Show
+   * when={cond}>...</Show>`. Stylistic only — Solid's compiler
+   * already handles the boolean form — so it is off by default.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/prefer-show.md
+   */
+  "solid/prefer-show"?: TtscLintRuleSetting;
+
+  /**
+   * Reject common Solid reactivity breakages — reading a signal
+   * outside a tracking scope, destructuring a `Store`, etc.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/reactivity.md
+   */
+  "solid/reactivity"?: TtscLintRuleSetting;
+
+  /**
+   * Collapse JSX elements with no children to the self-closing form
+   * (`<Foo></Foo>` to `<Foo />`). Configurable per component vs HTML
+   * element, including a `"void"` mode that only enforces it for void
+   * tags.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/self-closing-comp.md
+   */
+  "solid/self-closing-comp"?: TtscLintRuleSetting;
+
+  /**
+   * Require `style={{...}}` keys to be valid kebab-case CSS properties
+   * (`"font-size"`, not React's `fontSize`) and dimensioned values to
+   * be strings — Solid does not append implicit `px`.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/style-prop.md
+   */
+  "solid/style-prop"?: TtscLintRuleSetting;
+
+  /**
+   * Reject JSX nestings that the HTML parser would silently restructure
+   * at runtime — `<p>` cannot contain block-level children, `<a>` cannot
+   * contain another `<a>`, and `<button>` cannot contain other
+   * interactive elements.
+   *
+   * @reference https://github.com/solidjs-community/eslint-plugin-solid/blob/main/packages/eslint-plugin-solid/docs/validate-jsx-nesting.md
+   */
+  "solid/validate-jsx-nesting"?: TtscLintRuleSetting;
+}

package/src/structures/rules/ITtscLintStorybookRuleOptions.ts

@@ -0,0 +1,23 @@
+/**
+ * Options shape for rules in {@link ITtscLintStorybookRules} that accept
+ * configuration. Only `storybook/no-uninstalled-addons` is configurable.
+ *
+ * @reference https://github.com/storybookjs/eslint-plugin-storybook
+ */
+
+/** `storybook/no-uninstalled-addons` rule options. */
+export interface ITtscLintStorybookNoUninstalledAddonsRuleOptions {
+  /**
+   * Explicit `package.json` path used to validate configured Storybook
+   * addons. When omitted, the rule walks upward from the linted config
+   * file.
+   */
+  packageJsonLocation?: string;
+
+  /**
+   * Addon package names to skip when checking installation status.
+   *
+   * @default []
+   */
+  ignore?: readonly string[];
+}

package/src/structures/rules/ITtscLintStorybookRules.ts

@@ -0,0 +1,193 @@
+import type { ITtscLintStorybookNoUninstalledAddonsRuleOptions } from "./ITtscLintStorybookRuleOptions";
+import type {
+  TtscLintRuleOptionsSetting,
+  TtscLintRuleSetting,
+} from "../TtscLintRuleSetting";
+
+/**
+ * Storybook CSF and configuration rules from
+ * `eslint-plugin-storybook`.
+ *
+ * Checks Component Story Format conventions (default export meta,
+ * named story exports, play-function shape) and configuration
+ * pitfalls in `.storybook/main.ts`.
+ *
+ * @reference https://github.com/storybookjs/eslint-plugin-storybook
+ */
+export interface ITtscLintStorybookRules {
+  /**
+   * Require `await` on Storybook interaction helpers (`userEvent`,
+   * `expect`, `waitFor`, ...) inside a `play` function.
+   *
+   * The interactions addon intercepts the awaited promises to record
+   * steps, so a missing `await` skips that frame in the debugger and
+   * races the next assertion.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/await-interactions.md
+   */
+  "storybook/await-interactions"?: TtscLintRuleSetting;
+
+  /**
+   * Require forwarding the play-function `context` argument when
+   * invoking another story's `play` function.
+   *
+   * Storybook hangs the canvas, step tracker, and interactions addon
+   * off `context`; omitting it leaves the nested call without the
+   * runtime hooks it needs to drive the canvas.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/context-in-play-function.md
+   */
+  "storybook/context-in-play-function"?: TtscLintRuleSetting;
+
+  /**
+   * Require the CSF default meta object to declare a `component`.
+   *
+   * The reference unlocks Storybook's auto-generated controls,
+   * prop-table docs, and CSF3 default render — without it those
+   * features silently no-op.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/csf-component.md
+   */
+  "storybook/csf-component"?: TtscLintRuleSetting;
+
+  /**
+   * Require every story file to provide the CSF default export.
+   *
+   * Storybook keys all per-file configuration (title, decorators,
+   * parameters, component) off that default; files without it are
+   * skipped at indexing time.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/default-exports.md
+   */
+  "storybook/default-exports"?: TtscLintRuleSetting;
+
+  /**
+   * Reject the legacy `|` separator in Storybook story titles
+   * (`"Foo|Bar"`).
+   *
+   * Storybook 6 standardized on `/` for hierarchy and treats `|` as
+   * a literal character, so the title collapses into a single
+   * sidebar entry instead of nested folders.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/hierarchy-separator.md
+   */
+  "storybook/hierarchy-separator"?: TtscLintRuleSetting;
+
+  /**
+   * Require `title` and `args` in CSF meta to be inline literals,
+   * not references to outside variables or function calls.
+   *
+   * Storybook's indexer and upgrade codemods read these via static
+   * analysis and skip stories where the value is not literal.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/meta-inline-properties.md
+   */
+  "storybook/meta-inline-properties"?: TtscLintRuleSetting;
+
+  /**
+   * Require CSF meta objects to type-check with `satisfies Meta<…>`
+   * rather than a `: Meta<…>` annotation or `as` cast.
+   *
+   * `satisfies` preserves the narrowed literal types so dependent
+   * `StoryObj` declarations can infer the component's args
+   * precisely.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/meta-satisfies-type.md
+   */
+  "storybook/meta-satisfies-type"?: TtscLintRuleSetting;
+
+  /**
+   * Reject `name` metadata on a story when it matches Storybook's
+   * auto-derived name from the export identifier.
+   *
+   * The explicit value adds boilerplate and drifts from the export
+   * when one side is renamed without the other.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/no-redundant-story-name.md
+   */
+  "storybook/no-redundant-story-name"?: TtscLintRuleSetting;
+
+  /**
+   * Reject direct imports from Storybook renderer packages
+   * (`@storybook/react`, etc.); use the user-facing package
+   * surface.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/no-renderer-packages.md
+   */
+  "storybook/no-renderer-packages"?: TtscLintRuleSetting;
+
+  /**
+   * Reject the legacy `storiesOf(...)` builder API.
+   *
+   * Storybook 7 removed it in favour of CSF default-export metadata;
+   * remaining uses block the migration to CSF3 and the modern
+   * indexer.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/no-stories-of.md
+   */
+  "storybook/no-stories-of"?: TtscLintRuleSetting;
+
+  /**
+   * Reject the `title` property in CSF meta when the project uses
+   * Storybook's auto-title generation.
+   *
+   * CSF3 derives the title from the file path, so an explicit
+   * `title` is redundant and drifts from the on-disk layout when
+   * files are moved.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/no-title-property-in-meta.md
+   */
+  "storybook/no-title-property-in-meta"?: TtscLintRuleSetting;
+
+  /**
+   * Validate Storybook addon names against the project's
+   * dependencies, so misspelled addon ids surface at lint time.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/no-uninstalled-addons.md
+   */
+  "storybook/no-uninstalled-addons"?: TtscLintRuleOptionsSetting<ITtscLintStorybookNoUninstalledAddonsRuleOptions>;
+
+  /**
+   * Require named story exports to use PascalCase.
+   *
+   * Storybook derives the displayed story name from the export
+   * identifier and inserts spaces at case boundaries, so
+   * non-PascalCase exports render with awkward or merged labels in
+   * the sidebar.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/prefer-pascal-case.md
+   */
+  "storybook/prefer-pascal-case"?: TtscLintRuleSetting;
+
+  /**
+   * Require every story file to export at least one named story
+   * alongside the default meta.
+   *
+   * A file with only the default export contributes nothing to the
+   * sidebar and usually means a story was deleted but the file was
+   * not.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/story-exports.md
+   */
+  "storybook/story-exports"?: TtscLintRuleSetting;
+
+  /**
+   * Require `expect` to be imported from `@storybook/test` in play
+   * functions, not from Jest.
+   *
+   * The Storybook re-export is built for the browser interactions
+   * runner; Jest's `expect` ships only Node-only matchers and throws
+   * when the play function executes in a browser preview.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/use-storybook-expect.md
+   */
+  "storybook/use-storybook-expect"?: TtscLintRuleSetting;
+
+  /**
+   * Reject direct Testing Library imports inside story files;
+   * use the Storybook-bundled re-exports.
+   *
+   * @reference https://github.com/storybookjs/eslint-plugin-storybook/blob/main/docs/rules/use-storybook-testing-library.md
+   */
+  "storybook/use-storybook-testing-library"?: TtscLintRuleSetting;
+}