eslint-plugin-kerfjs 5.0.0-beta.57 → 5.0.0-beta.59

package/README.md

@@ -13,15 +13,17 @@ This plugin sits alongside two other defense layers shipped by [`kerfjs`](https:
 | Opt-in dev-warns (`KERF_DEV_WARN_*`) | Hard Rules 4 (rebuilt listeners), 7 (untracked signals), 8 (narrow set)                                                                                          | Runtime       |
 | **This plugin**                      | Hard Rules 2, 5, 6, 10, 12 — AST-shaped antipatterns; plus rename-safety / `raw()`-audit nudges and a project-hygiene check for the bundled AI-assistant configs | **Edit time** |
 
-All but one rule are AST-only — no `@typescript-eslint/parser` _service_ dependency is required by the plugin (consumers configure their own parser). The exception, `ai-assistant-configs`, reads the filesystem instead of the AST and runs once per lint pass.
+The core syntax rules analyze the AST without TypeScript parser services. `ai-assistant-configs` reads the filesystem, and the optional UI rules also resolve catalog and profile artifacts. Consumers configure their own parser; no `@typescript-eslint/parser` _service_ is required.
 
 ## Install
 
 ```bash
 npm install --save-dev eslint-plugin-kerfjs
-npm install @kerfjs/ui
 ```
 
+Install `@kerfjs/ui` as well when using `recommended-ui` or `strict-ui`; the
+core `recommended` preset does not require it.
+
 ### Supported ESLint versions
 
 `peerDependencies` declares `^9.0.0 || ^10.0.0`, and that is a **tested** range rather than an optimistic one: the rule suite runs against the latest release of each of those majors in CI on every push. A major is added to the range only after the suite has passed on it.
@@ -129,6 +131,7 @@ When a real bug ships that the existing defense stack misses AND a new lint rule
 ```bash
 npm install
 npm test
+npm run test:eslint-matrix # real packed-plugin loading on every supported ESLint major
 ```
 
 The AST rules' test suites use ESLint's `RuleTester` with `@typescript-eslint/parser`. The `ai-assistant-configs` tests are filesystem-driven — they build temp project roots with fixture `node_modules/kerfjs/ai/` bundles, drive the classifier directly, and use the real ESLint API to prove plain lint is read-only while explicit `--fix` performs the external write.

package/docs/rules/ui-composition.md

@@ -30,7 +30,9 @@ cataloged roots, or nothing) is checked as those roots:
 
 - **Zones (`KUI-L202`):** the zone must accept every declared root.
 - **Parents (`KUI-L201`):** each root's listed parents apply where the wrapper
-  is placed, and a wrapper used as a parent counts as each of its roots.
+  is placed, and a wrapper used as a parent counts as each of its roots. A
+  placement reports once, using the first violated root requirement before a
+  separate wrapper requirement if both apply.
 - **Cardinality (`KUI-L203`):** the wrapper counts as zero or one child, since
   it may render nothing.
 

package/index.js

@@ -14,7 +14,7 @@ import uiPublicBoundaries from './lib/rules/ui-public-boundaries.js';
 import uiWiring from './lib/rules/ui-wiring.js';
 
 const plugin = {
-  meta: { name: 'eslint-plugin-kerfjs', version: '5.0.0-beta.57' },
+  meta: { name: 'eslint-plugin-kerfjs', version: '5.0.0-beta.59' },
   rules: {
     'no-inline-jsx-event-handlers': noInlineJsxEventHandlers,
     'no-raw-with-dynamic-arg': noRawWithDynamicArg,

package/lib/rules/ui-composition.js

@@ -167,34 +167,37 @@ export default {
         const entry = contract.entries.get(key);
         if (!entry) return;
         // A wrapper answers to its own parent contract and to each root's.
+        // Report one violated requirement per placement, with roots first.
         const placed = [
-          { entry, child: key },
           ...(entry.rendersAs ?? []).flatMap((root) => {
             const rootEntry = contract.entries.get(root);
             return rootEntry
               ? [{ entry: rootEntry, child: `${key} (renders ${root})` }]
               : [];
           }),
+          { entry, child: key },
         ].filter(
           ({ entry: placedEntry }) => placedEntry.parents?.mode === 'listed',
         );
         if (placed.length && !isExcepted(contract, PARENT_CODE, filename)) {
           const parent = directParentKey(node, registry, contract);
-          if (parent)
-            for (const { entry: placedEntry, child } of placed)
-              if (
+          if (parent) {
+            const violation = placed.find(
+              ({ entry: placedEntry }) =>
                 !rootsOf(parent.key, contract).every((root) =>
                   placedEntry.parents.entries.includes(root),
-                )
-              )
-                context.report({
-                  node: node.name,
-                  messageId: 'parent',
-                  data: {
-                    child,
-                    parents: placedEntry.parents.entries.join(', '),
-                  },
-                });
+                ),
+            );
+            if (violation)
+              context.report({
+                node: node.name,
+                messageId: 'parent',
+                data: {
+                  child: violation.child,
+                  parents: violation.entry.parents.entries.join(', '),
+                },
+              });
+          }
         }
         for (const zone of entry.zones ?? []) {
           const bound = boundZone(node, zone, registry, contract);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-kerfjs",
-  "version": "5.0.0-beta.57",
+  "version": "5.0.0-beta.59",
   "description": "ESLint rules that enforce kerf's hard rules — catches AI-shaped bugs at edit time.",
   "type": "module",
   "license": "MIT",