mikoshi-construct 0.1.3 → 0.2.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mikoshi-construct",
   "type": "module",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "Bootstrap for AI-native software projects. Start with a proven engineering workflow instead of an empty repository.",
   "author": "Eli Tabrisov",
   "license": "MIT",
@@ -60,9 +60,10 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
-    "quality": "pnpm composition:check && pnpm lint && pnpm typecheck && pnpm test",
+    "quality": "pnpm composition:check && pnpm privacy:check && pnpm lint && pnpm typecheck && pnpm test",
     "composition:render": "tsx scripts/composition/sync-docs.ts",
     "composition:check": "tsx scripts/composition/check.ts",
+    "privacy:check": "tsx scripts/privacy/check.ts",
     "ci": "pnpm run quality",
     "changeset": "changeset",
     "version-packages": "changeset version",

package/templates/ai/claude/_claude/agents/architect.md

@@ -24,15 +24,11 @@ Work through, in this order, and write nothing down until you have:
 5. The explicit constraints the implementer must respect, and the acceptance criteria that make
    the task statable.
 
-Your final message is data, not prose. Return exactly one JSON object:
+Return these fields; the runtime validates the shape against the schema it gives you.
 
-```json
-{
-  "decision": "the design in a few sentences, including what stays unchanged and why",
-  "contractChanges": "operations or schemas to add or change in the API contract, or empty",
-  "compositionChanges": "composition model nodes or edges to change, or empty",
-  "constraints": ["one constraint per entry"],
-  "acceptance": ["one verifiable criterion per entry"],
-  "files": ["files to create or change"]
-}
-```
+- `decision` — the design in a few sentences, including what stays unchanged and why.
+- `contractChanges` — operations or schemas to add or change in the API contract, empty when none.
+- `compositionChanges` — composition model nodes or edges to change, empty when none.
+- `constraints` — one constraint per entry, each one the implementer must respect.
+- `acceptance` — one verifiable criterion per entry.
+- `files` — the files to create or change.

package/templates/ai/claude/_claude/agents/harness.md

@@ -26,15 +26,11 @@ When git is usable, also inspect `git diff` (staged and unstaged) for:
 Report the security leg separately from the rest when a failure comes from a security lint rule,
 a contract security test or the secret scan, so the reader sees the invariant, not just the tool.
 
-Your final message is data, not prose. Return exactly one JSON object:
+Return these fields; the runtime validates the shape against the schema it gives you.
 
-```json
-{
-  "passed": true,
-  "failureExcerpt": "the failing command and its last relevant lines, empty when passed",
-  "securityFinding": "the invariant that failed, empty when none",
-  "diffStat": "output of git diff --stat",
-  "testsWeakened": false,
-  "contractChanged": false
-}
-```
+- `passed` — whether every harness command succeeded.
+- `failureExcerpt` — the failing command and its last relevant lines, empty when passed.
+- `securityFinding` — the invariant that failed, empty when none.
+- `diffStat` — the output of `git diff --stat`, or why git could not be used.
+- `testsWeakened` — whether a test was deleted, renamed away, skipped or narrowed.
+- `contractChanged` — whether a file under `contracts/` changed.

package/templates/ai/claude/_claude/agents/implementer.md

@@ -27,14 +27,10 @@ Constraints at this effort level:
 If the task is ambiguous about a contract, a boundary or which of two designs is meant, stop and
 report `blocked` with one precise question. Do not pick one.
 
-Your final message is data, not prose. Return exactly one JSON object:
+Return these fields; the runtime validates the shape against the schema it gives you.
 
-```json
-{
-  "status": "done | failed | blocked",
-  "summary": "one or two sentences on what changed",
-  "files": ["paths you changed"],
-  "harnessTail": "last lines of the harness output, empty when blocked",
-  "question": "the single question when blocked, otherwise empty"
-}
-```
+- `status` — `done`, `failed` or `blocked`.
+- `summary` — one or two sentences on what changed.
+- `files` — the paths you changed.
+- `harnessTail` — the last lines of the harness output, empty when blocked.
+- `question` — the single question when blocked, otherwise empty.

package/templates/ai/claude/_claude/skills/implement/SKILL.md

@@ -23,14 +23,35 @@ repository's CLAUDE.md and `construct.json`.
    a JSON object:
    `{ "task": ..., "acceptance": [...], "effort": "low|medium|high", "harness": { "command": ..., "extra": [...] } }`
    where `harness.command` comes from `construct.json` and `harness.extra` lists any area-specific
-   commands CLAUDE.md names for the files the task touches (usually empty).
-   The user's `/implement` invocation is the opt-in the tool requires.
+   commands CLAUDE.md names for the files the task touches (usually empty). `retryLimit` is optional
+   and defaults to `0`: a rejected response is not re-asked, and the run stops with the validator's
+   error so a person reads it. Each retry is a whole new agent call that repeats the agent's
+   exploration from scratch — measured at roughly three million billable tokens for an architect —
+   and it cannot fix a contradiction in the task, because the agent may not change the task. Raise it
+   only when a rejected response is expected to be a transient shape error rather than a bad brief.
+   The user's `/implement` invocation is the opt-in the tool requires. Note the run identifier the
+   Workflow tool reports when it launches the run and again when it completes; step 4 records it.
 4. Record the run: append one JSON line to `.construct/runs.jsonl` (create the directory if needed)
-   with `at` (ISO time), `task` (first 120 characters), `effort` (the class you chose), `status`,
-   the rung that finished (`effort` from the result), `attempts` from the result, and the Workflow
-   tool's own accounting for the run — `agents`, `tokens`, `toolUses`, `seconds` — exactly as it
-   reported them. This log is what tunes the ladder later; workflow scripts have no filesystem
-   access, so it is written here, not by the script. `.construct/` is gitignored.
+   with exactly these fields and no others:
+   - `run` — the Workflow run identifier from step 3. It is the key `construct cost` joins the entry
+     to the runtime's session data on. Never invent one: an entry without it is reported as
+     unjoinable, which is the truth about it.
+   - `at` — the ISO timestamp.
+   - `task` — the task text, first 120 characters.
+   - `effort` — the class you chose in step 1.
+   - `status` — `done`, `failed` or `blocked`, from the result.
+   - `rung` — the effort of the rung that finished: `effort` from the result when it is `done`,
+     otherwise the `effort` of the last entry in `attempts`.
+   - `attempts` — the result's `attempts` array verbatim; each entry carries its `rung`, `effort`,
+     `outcome` and the `reason` that separates an invalid response shape from a red harness from a
+     blocked report.
+   - `agents`, `tokens`, `toolUses`, `seconds` — the Workflow tool's own accounting for the run,
+     exactly as it reported it. Write `"unknown"` for a token figure it did not report, never `0`.
+   The ledger carries counts and reasons only — never a prompt, a response or any other message
+   content. This log is what tunes the ladder later; workflow scripts have no filesystem access, so
+   it is written here, not by the script. Nothing enforces this step: the ledger is L0, and
+   `construct cost` reconciles it against the runtime instead of trusting it. `.construct/` is
+   gitignored.
 5. Relay the result: status, the effort rung that succeeded and how many attempts it took, the
    files changed, and the harness tail. When the status is `blocked`, put the architect's or
    implementer's question to the user verbatim. When `failed`, give the last failure excerpt.

package/templates/ai/claude/scripts/construct/implement.workflow.mjs

@@ -52,10 +52,46 @@ const SPEC = {
   },
 }
 
+const DEFAULT_RETRY_LIMIT = 0
+
 const task = args.task
 const acceptance = args.acceptance ?? []
 const harness = { command: 'pnpm run quality', extra: [], ...(args.harness ?? {}) }
 const rungs = LADDERS[args.effort] ?? LADDERS.low
+const retryLimit = Number.isInteger(args.retryLimit) && args.retryLimit >= 0 ? args.retryLimit : DEFAULT_RETRY_LIMIT
+
+let lastValidationError = null
+
+function retryPrompt(prompt, validationError) {
+  return `${prompt}\n\nThe previous response did not match the shape the runtime validates. The validator reported:\n${validationError}\n\nReturn the same fields again with that corrected.`
+}
+
+async function askOnce(prompt, options) {
+  try {
+    const value = await agent(prompt, options)
+    return value == null
+      ? { value: null, validationError: 'the agent returned no object the schema could validate' }
+      : { value, validationError: null }
+  }
+  catch (error) {
+    return { value: null, validationError: String(error?.message ?? error) }
+  }
+}
+
+async function ask(prompt, options) {
+  let validationError = null
+  for (let attempt = 0; attempt <= retryLimit; attempt++) {
+    const answer = await askOnce(validationError == null ? prompt : retryPrompt(prompt, validationError), options)
+    if (answer.value != null) {
+      lastValidationError = null
+      return answer.value
+    }
+    validationError = answer.validationError
+    log(`${options.label}: response rejected by the schema — ${validationError}`)
+  }
+  lastValidationError = validationError
+  return null
+}
 
 function harnessPrompt() {
   return [
@@ -94,7 +130,7 @@ const attempts = []
 
 if (args.effort === 'high') {
   phase('Design')
-  spec = await agent(architectPrompt('The task is classified as high effort; design it before any implementation.'), {
+  spec = await ask(architectPrompt('The task is classified as high effort; design it before any implementation.'), {
     agentType: 'architect',
     effort: 'xhigh',
     phase: 'Design',
@@ -107,7 +143,7 @@ for (const [index, effort] of rungs.entries()) {
   const rung = index + 1
   phase('Implement')
   log(`rung ${rung}/${rungs.length} @ ${effort}: implementing`)
-  const report = await agent(implementerPrompt(spec, feedback), {
+  const report = await ask(implementerPrompt(spec, feedback), {
     agentType: 'implementer',
     effort,
     phase: 'Implement',
@@ -115,15 +151,15 @@ for (const [index, effort] of rungs.entries()) {
     schema: REPORT,
   })
   if (report == null) {
-    attempts.push({ rung, effort, outcome: 'no report' })
+    attempts.push({ rung, effort, outcome: 'schema invalid', reason: lastValidationError })
     continue
   }
 
   if (report.status === 'blocked') {
-    attempts.push({ rung, effort, outcome: 'blocked', question: report.question })
+    attempts.push({ rung, effort, outcome: 'blocked', reason: report.question, question: report.question })
     if (rung === rungs.length)
       return { status: 'blocked', question: report.question, attempts }
-    spec = await agent(architectPrompt(`The implementer stopped on this question:\n${report.question}`), {
+    spec = await ask(architectPrompt(`The implementer stopped on this question:\n${report.question}`), {
       agentType: 'architect',
       effort: 'xhigh',
       phase: 'Design',
@@ -137,7 +173,7 @@ for (const [index, effort] of rungs.entries()) {
 
   phase('Verify')
   log(`rung ${rung}/${rungs.length} @ ${effort}: running ${harness.command}`)
-  const verdict = await agent(harnessPrompt(), {
+  const verdict = await ask(harnessPrompt(), {
     agentType: 'harness',
     effort: 'low',
     phase: 'Verify',
@@ -145,7 +181,15 @@ for (const [index, effort] of rungs.entries()) {
     schema: VERDICT,
   })
   const passed = verdict?.passed === true && verdict.testsWeakened === false
-  attempts.push({ rung, effort, outcome: passed ? 'passed' : 'failed', securityFinding: verdict?.securityFinding ?? '' })
+  attempts.push(verdict == null
+    ? { rung, effort, outcome: 'schema invalid', reason: lastValidationError, securityFinding: '' }
+    : {
+        rung,
+        effort,
+        outcome: passed ? 'passed' : 'harness failed',
+        reason: passed ? '' : (verdict.testsWeakened ? 'a test was deleted, skipped or narrowed' : verdict.failureExcerpt),
+        securityFinding: verdict.securityFinding ?? '',
+      })
   log(`rung ${rung} @ ${effort}: ${passed ? 'harness passed' : 'harness failed'}`)
 
   if (passed) {
@@ -162,7 +206,7 @@ for (const [index, effort] of rungs.entries()) {
   }
 
   feedback = verdict == null
-    ? 'The harness produced no verdict.'
+    ? `The harness produced no verdict the schema could validate: ${lastValidationError}`
     : verdict.testsWeakened
       ? `A test was deleted, skipped or narrowed. Restore it and make the implementation pass it.\n${verdict.failureExcerpt}`
       : verdict.failureExcerpt
@@ -172,7 +216,7 @@ for (const [index, effort] of rungs.entries()) {
   if (rung === rungs.length - 1) {
     phase('Design')
     log(`rung ${rung}/${rungs.length} failed twice: architect redesigns before the last rung`)
-    spec = await agent(architectPrompt(`Two rungs have failed the harness. Latest failure:\n${feedback}\n\nDecide whether the approach, the contract or the boundary is wrong before the last attempt.`), {
+    spec = await ask(architectPrompt(`Two rungs have failed the harness. Latest failure:\n${feedback}\n\nDecide whether the approach, the contract or the boundary is wrong before the last attempt.`), {
       agentType: 'architect',
       effort: 'xhigh',
       phase: 'Design',

package/templates/ai/cursor/_cursor/rules/construct.mdc

@@ -11,7 +11,7 @@ areas, defects vs accepted variance), `architecture/security-invariants.md`.
 The harness command is in `construct.json` (`harness.command`). A change is done only when it passes.
 API changes start from the contract file named in `construct.json` (`contracts.path`); regenerate the
 types with `pnpm contracts:types` before implementing. Composition models in the directory
-`construct.json` names as `discovery.composition` are the source of the diagrams; edit the model and run
+`construct.json` names as `discovery.markers.composition.file` are the source of the diagrams; edit the model and run
 `pnpm composition:render`, never the rendered block.
 
 Discovery: when asked to "run construct discovery", follow the `construct-discover` rule in this

package/templates/ai/shared/_claude/commands/construct-discover.md

@@ -9,8 +9,8 @@ not verify by reading code; where the codebase is inconsistent, record an open q
 inventing a rule.
 
 Scope: `$ARGUMENTS` (empty means every marker). The markers, and the file each one lives in, are
-listed under `discovery` in `construct.json` (the text markers in `AGENTS.md`, the composition models
-in the directory `discovery.composition` names). Every marker is a block between
+listed under `discovery.markers` in `construct.json` (the text markers in `AGENTS.md`, the composition
+models in the directory `discovery.markers.composition.file` names). Every marker is a block between
 `<!-- construct:discover:<name> -->` and `<!-- /construct:discover:<name> -->`; replace the placeholder
 line inside the block and nothing outside it. `construct doctor` reports any marker still holding the
 placeholder.
@@ -37,7 +37,9 @@ Work in this order:
 2. **Inventory.** Read `construct.json`, `package.json`, the directory tree two levels deep, the entry
    points (servers, app factories, `main.ts`, CLI scripts, workers), the API contract if there is
    one, and every `*.config.ts` / `config.ts`. Note the package manager, runtime, database and clients, CI, deployment
-   and existing conventions. Do not write yet.
+   and existing conventions. Do not write yet. Record the commit this run starts from: set
+   `discovery.baseSha` in `construct.json` to the output of `git rev-parse HEAD`, or `null` where the
+   repository has no commit yet.
 3. **`product`** (AGENTS.md): what the system does, in one paragraph, and the one flow where a
    defect costs the most (money, identity, data). If the repository is empty apart from the baseline,
    say so in one line.
@@ -54,7 +56,7 @@ Work in this order:
 8. **`high-effort-areas`** (AGENTS.md): the paths where a wrong low-effort guess is expensive —
    attribution, authentication, money, schema, anything a shipped client depends on. This list is what
    `/implement` uses to classify a task as `high`.
-9. **`composition`** (`<discovery.composition>/*.yaml` from `construct.json`): one model per real flow the code has today
+9. **`composition`** (`<discovery.markers.composition.file>/*.yaml` from `construct.json`): one model per real flow the code has today
    (the HTTP app, a worker, a sync, a CLI, the browser bootstrap) — small, one per flow, every `path`
    must exist. A baseline model, when the construct shipped one, is updated, not duplicated; a
    repository that had code before the construct starts with no model and needs at least one for its
@@ -71,5 +73,24 @@ Work in this order:
     `npx mikoshi-construct doctor` when the CLI is not installed; it names every marker that still
     holds the placeholder.
 
+13. **Record what you wrote, in the manifest and nowhere else.** Provenance belongs in
+    `construct.json`; never add a byline, an authorship note or a hash to a marker body. Set
+    `discovery.filledAt` to the time you finished, and for each marker you filled set
+    `discovery.markers.<name>` to `{"file": "<the file it lives in>", "authoredBy": "construct",
+    "sha": "<sha256 of the body you wrote>"}`. A marker you did not fill keeps the entry it had.
+    The body is the text between `<!-- construct:discover:<name> -->` and
+    `<!-- /construct:discover:<name> -->` with leading and trailing whitespace stripped; for
+    `composition` it is every `*.yaml` in the directory, sorted by name, each as its filename, a
+    newline and its contents, joined by newlines. Compute it, never estimate it:
+
+    ```bash
+    node -e 'const{createHash}=require("node:crypto"),{readFileSync}=require("node:fs");const[f,m]=process.argv.slice(1);const d=readFileSync(f,"utf8"),o=`<!-- construct:discover:${m} -->`,c=`<!-- /construct:discover:${m} -->`;console.log(createHash("sha256").update(d.slice(d.indexOf(o)+o.length,d.indexOf(c)).trim()).digest("hex"))' AGENTS.md product
+    node -e 'const{createHash}=require("node:crypto"),{readFileSync,readdirSync}=require("node:fs"),p=require("node:path");const d=process.argv[1],b=readdirSync(d).filter(n=>n.endsWith(".yaml")).sort().map(n=>`${n}\n${readFileSync(p.join(d,n),"utf8")}`).join("\n");console.log(createHash("sha256").update(b).digest("hex"))' architecture/composition
+    ```
+
+    This is what keeps a statement the tool wrote from later reading as one the repository stands
+    behind. The moment the owner edits a marker its body stops matching the recorded sha and
+    `construct doctor` reads it as theirs — the edit is the evidence, and there is no command to run.
+
 Report: which markers you filled, which you left as open questions and why, and the harness result.
 Do not commit.

package/templates/presets/monorepo/baseline/eslint.config.mjs.eta

@@ -4,11 +4,27 @@ const WORKSPACE_PACKAGES = {{workspacePackages}}
 
 const ALLOWED_WORKSPACE_IMPORTS = {{allowedWorkspaceImports}}
 
-const PROCESS_ENV = 'MemberExpression[object.name="process"][property.name="env"]'
+const PROCESS_ENV_MEMBER = 'MemberExpression[object.name="process"][property.name="env"]'
+const PROCESS_ENV_VIA_GLOBAL_THIS = 'MemberExpression[object.object.name="globalThis"][object.property.name="process"][property.name="env"]'
+const PROCESS_ENV_DESTRUCTURED = 'VariableDeclarator[init.name="process"] > ObjectPattern > Property[key.name="env"]'
+const PROCESS_ENV = `:matches(${PROCESS_ENV_MEMBER}, ${PROCESS_ENV_VIA_GLOBAL_THIS}, ${PROCESS_ENV_DESTRUCTURED})`
+
 const PROCESS_MEMBER = 'MemberExpression[object.name="process"]'
-const RAW_REQUEST_DATA = 'MemberExpression[object.name="req"][property.name=/^(body|query|params)$/]'
-const RAW_SQL = 'CallExpression[callee.object.name="sql"][callee.property.name="raw"]'
-const SHARED_IMPORT = ':matches(ImportDeclaration, ExportNamedDeclaration, ExportAllDeclaration)[source.value=/^{{scope}}\\/shared(\\/|$)/]'
+const PROCESS_VIA_GLOBAL_THIS = 'MemberExpression[object.name="globalThis"]:matches([property.name="process"], [property.value="process"])'
+const PROCESS_BINDING = 'VariableDeclarator[init.name="process"]'
+const PROCESS = `:matches(${PROCESS_MEMBER}, ${PROCESS_VIA_GLOBAL_THIS}, ${PROCESS_BINDING})`
+
+const RAW_REQUEST_MEMBER = 'MemberExpression[object.name="req"][property.name=/^(body|query|params)$/]'
+const RAW_REQUEST_DESTRUCTURED = 'VariableDeclarator[init.name="req"] > ObjectPattern > Property[key.name=/^(body|query|params)$/]'
+const RAW_REQUEST_ALIASED = 'VariableDeclarator[id.type="Identifier"][init.name="req"]'
+const RAW_REQUEST_DATA = `:matches(${RAW_REQUEST_MEMBER}, ${RAW_REQUEST_DESTRUCTURED}, ${RAW_REQUEST_ALIASED})`
+
+const RAW_SQL = 'MemberExpression[object.name="sql"]:matches([property.name="raw"], [property.value="raw"])'
+
+const SHARED_SPECIFIER = '/^{{scope}}\\/shared(\\/|$)/'
+const SHARED_IMPORT = `:matches(ImportDeclaration, ExportNamedDeclaration, ExportAllDeclaration, ImportExpression)[source.value=${SHARED_SPECIFIER}]`
+const SHARED_REQUIRE = `CallExpression[callee.name="require"][arguments.0.value=${SHARED_SPECIFIER}]`
+const SHARED_MODULE = `:matches(${SHARED_IMPORT}, ${SHARED_REQUIRE})`
 
 function dependencyBoundary([directory, allowed]) {
   const forbidden = WORKSPACE_PACKAGES.filter(name => !allowed.includes(name))
@@ -32,7 +48,7 @@ const dependencyBoundaries = Object.entries(ALLOWED_WORKSPACE_IMPORTS)
   .map(dependencyBoundary)
 
 const NO_PROCESS_OUTSIDE_CONFIG = {
-  selector: PROCESS_MEMBER,
+  selector: PROCESS,
   message: 'An app touches process only in config.ts: read configuration through readConfig() and pass the value on',
 }
 const NO_PROCESS_ENV_IN_PACKAGE = {
@@ -48,7 +64,7 @@ const NO_RAW_SQL = {
   message: 'SQL is never built from raw strings: interpolate tables and columns into the sql template instead of sql.raw',
 }
 const NO_SHARED_OUTSIDE_CONTRACTS = {
-  selector: SHARED_IMPORT,
+  selector: SHARED_MODULE,
   message: 'Contract types enter an app only through src/contracts/types.ts: import them from there',
 }
 

package/templates/presets/monorepo/baseline/scripts/tests/lint/syntax-policy.test.ts.eta

@@ -0,0 +1,110 @@
+import { ESLint } from 'eslint'
+import { describe, expect, it } from 'vitest'
+import { REPO_ROOT } from '../../composition/files.js'
+
+const SAMPLES = {
+  plainModule: 'export function label(name: string): string {\n  return name.trim()\n}\n',
+  processMember: 'export const level = process.env.LOG_LEVEL\n',
+  processDestructured: 'const { env } = process\n\nexport const level = env.LOG_LEVEL\n',
+  processViaGlobalThis: 'export const level = globalThis.process.env.LOG_LEVEL\n',
+  processAliased: 'const runtime = process\n\nexport const level = runtime.env.LOG_LEVEL\n',
+  processArgv: 'export const args = process.argv.slice(2)\n',
+  rawRequestMember: 'export function name(req: { body: { name: string } }): string {\n  return req.body.name\n}\n',
+  rawRequestDestructured: 'export function name(req: { body: { name: string } }): string {\n  const { body } = req\n  return body.name\n}\n',
+  rawRequestAliased: 'export function name(req: { body: { name: string } }): string {\n  const request = req\n  return request.body.name\n}\n',
+  rawSqlCall: 'export const rows = sql.raw(\'select 1\')\n',
+  rawSqlTagged: 'export const rows = sql.raw`select 1`\n',
+  rawSqlComputed: 'export const rows = sql[\'raw\'](\'select 1\')\n',
+  sharedStaticImport: 'import type { components } from \'{{scope}}/shared\'\n\nexport type Contract = components\n',
+  sharedDynamicImport: 'export async function load(): Promise<unknown> {\n  return import(\'{{scope}}/shared\')\n}\n',
+  sharedRequire: 'export const shared: unknown = require(\'{{scope}}/shared\')\n',
+} as const
+
+type SampleName = keyof typeof SAMPLES
+
+const PROCESS_FORMS: SampleName[] = ['processMember', 'processDestructured', 'processViaGlobalThis', 'processAliased', 'processArgv']
+const PROCESS_ENV_FORMS: SampleName[] = ['processMember', 'processDestructured', 'processViaGlobalThis']
+const RAW_REQUEST_FORMS: SampleName[] = ['rawRequestMember', 'rawRequestDestructured', 'rawRequestAliased']
+const RAW_SQL_FORMS: SampleName[] = ['rawSqlCall', 'rawSqlTagged', 'rawSqlComputed']
+const SHARED_FORMS: SampleName[] = ['sharedStaticImport', 'sharedDynamicImport', 'sharedRequire']
+
+const ROLES: Array<{ role: string, file: string, reported: SampleName[], exempt: SampleName[] }> = [
+  {
+    role: 'a service',
+    file: 'apps/api/src/things/things.service.ts',
+    reported: [...RAW_SQL_FORMS, ...PROCESS_FORMS, ...RAW_REQUEST_FORMS, ...SHARED_FORMS],
+    exempt: [],
+  },
+  {
+    role: 'a controller',
+    file: 'apps/api/src/things/things.controller.ts',
+    reported: [...RAW_SQL_FORMS, ...PROCESS_FORMS, ...SHARED_FORMS],
+    exempt: RAW_REQUEST_FORMS,
+  },
+  {
+    role: 'a middleware',
+    file: 'apps/api/src/http/error-handler.middleware.ts',
+    reported: [...RAW_SQL_FORMS, ...PROCESS_FORMS, ...SHARED_FORMS],
+    exempt: RAW_REQUEST_FORMS,
+  },
+  {
+    role: 'the contract types gateway',
+    file: 'apps/api/src/contracts/types.ts',
+    reported: [...RAW_SQL_FORMS, ...PROCESS_FORMS, ...RAW_REQUEST_FORMS],
+    exempt: SHARED_FORMS,
+  },
+  {
+    role: 'the app config',
+    file: 'apps/api/src/config.ts',
+    reported: [...RAW_SQL_FORMS, ...SHARED_FORMS],
+    exempt: [...PROCESS_FORMS, ...RAW_REQUEST_FORMS],
+  },
+  {
+    role: 'the process entry',
+    file: 'apps/api/src/server.ts',
+    reported: [...RAW_SQL_FORMS, ...SHARED_FORMS],
+    exempt: [...PROCESS_FORMS, ...RAW_REQUEST_FORMS],
+  },
+  {
+    role: 'a package module',
+    file: 'packages/shared/src/index.ts',
+    reported: [...RAW_SQL_FORMS, ...PROCESS_ENV_FORMS],
+    exempt: ['processArgv', ...RAW_REQUEST_FORMS, ...SHARED_FORMS],
+  },
+  {
+    role: 'a package config',
+    file: 'packages/shared/src/shared.config.ts',
+    reported: RAW_SQL_FORMS,
+    exempt: [...PROCESS_FORMS, ...RAW_REQUEST_FORMS, ...SHARED_FORMS],
+  },
+]
+
+const eslint = new ESLint({
+  cwd: REPO_ROOT,
+  ruleFilter: ({ ruleId }) => ruleId === 'no-restricted-syntax',
+  overrideConfig: { languageOptions: { parserOptions: { projectService: false } } },
+})
+
+async function restrictionReports(file: string, sample: SampleName): Promise<string[]> {
+  const [result] = await eslint.lintText(SAMPLES[sample], { filePath: file })
+  const fatal = result.messages.find(message => message.fatal)
+  if (fatal)
+    throw new Error(`${file} (${sample}): ${fatal.message}`)
+  return result.messages
+    .filter(message => message.ruleId === 'no-restricted-syntax')
+    .map(message => message.message)
+}
+
+describe('syntax policy by file role', () => {
+  for (const { role, file, reported, exempt } of ROLES) {
+    it(`reports every restricted form in ${role}`, async () => {
+      for (const sample of reported)
+        expect(await restrictionReports(file, sample), sample).not.toEqual([])
+    })
+
+    it(`reports nothing ${role} may legitimately write`, async () => {
+      for (const sample of ['plainModule' as SampleName, ...exempt])
+        expect(await restrictionReports(file, sample), sample).toEqual([])
+    })
+  }
+})

package/templates/presets/node-backend/baseline/eslint.config.mjs

@@ -1,11 +1,19 @@
 import antfu from '@antfu/eslint-config'
 
 const PROCESS_MEMBER = 'MemberExpression[object.name="process"]'
-const RAW_REQUEST_DATA = 'MemberExpression[object.name="req"][property.name=/^(body|query|params)$/]'
-const RAW_SQL = 'CallExpression[callee.object.name="sql"][callee.property.name="raw"]'
+const PROCESS_VIA_GLOBAL_THIS = 'MemberExpression[object.name="globalThis"]:matches([property.name="process"], [property.value="process"])'
+const PROCESS_BINDING = 'VariableDeclarator[init.name="process"]'
+const PROCESS = `:matches(${PROCESS_MEMBER}, ${PROCESS_VIA_GLOBAL_THIS}, ${PROCESS_BINDING})`
+
+const RAW_REQUEST_MEMBER = 'MemberExpression[object.name="req"][property.name=/^(body|query|params)$/]'
+const RAW_REQUEST_DESTRUCTURED = 'VariableDeclarator[init.name="req"] > ObjectPattern > Property[key.name=/^(body|query|params)$/]'
+const RAW_REQUEST_ALIASED = 'VariableDeclarator[id.type="Identifier"][init.name="req"]'
+const RAW_REQUEST_DATA = `:matches(${RAW_REQUEST_MEMBER}, ${RAW_REQUEST_DESTRUCTURED}, ${RAW_REQUEST_ALIASED})`
+
+const RAW_SQL = 'MemberExpression[object.name="sql"]:matches([property.name="raw"], [property.value="raw"])'
 
 const NO_PROCESS_OUTSIDE_CONFIG = {
-  selector: PROCESS_MEMBER,
+  selector: PROCESS,
   message: 'src touches process only in config.ts: read configuration through readConfig() and pass the value on',
 }
 const NO_RAW_REQUEST_DATA = {

package/templates/presets/node-backend/baseline/scripts/tests/lint/syntax-policy.test.ts

@@ -0,0 +1,86 @@
+import { ESLint } from 'eslint'
+import { describe, expect, it } from 'vitest'
+import { REPO_ROOT } from '../../composition/files.js'
+
+const SAMPLES = {
+  plainModule: 'export function label(name: string): string {\n  return name.trim()\n}\n',
+  processMember: 'export const level = process.env.LOG_LEVEL\n',
+  processDestructured: 'const { env } = process\n\nexport const level = env.LOG_LEVEL\n',
+  processViaGlobalThis: 'export const level = globalThis.process.env.LOG_LEVEL\n',
+  processAliased: 'const runtime = process\n\nexport const level = runtime.env.LOG_LEVEL\n',
+  rawRequestMember: 'export function name(req: { body: { name: string } }): string {\n  return req.body.name\n}\n',
+  rawRequestDestructured: 'export function name(req: { body: { name: string } }): string {\n  const { body } = req\n  return body.name\n}\n',
+  rawRequestAliased: 'export function name(req: { body: { name: string } }): string {\n  const request = req\n  return request.body.name\n}\n',
+  rawSqlCall: 'export const rows = sql.raw(\'select 1\')\n',
+  rawSqlTagged: 'export const rows = sql.raw`select 1`\n',
+  rawSqlComputed: 'export const rows = sql[\'raw\'](\'select 1\')\n',
+} as const
+
+type SampleName = keyof typeof SAMPLES
+
+const PROCESS_FORMS: SampleName[] = ['processMember', 'processDestructured', 'processViaGlobalThis', 'processAliased']
+const RAW_REQUEST_FORMS: SampleName[] = ['rawRequestMember', 'rawRequestDestructured', 'rawRequestAliased']
+const RAW_SQL_FORMS: SampleName[] = ['rawSqlCall', 'rawSqlTagged', 'rawSqlComputed']
+
+const ROLES: Array<{ role: string, file: string, reported: SampleName[], exempt: SampleName[] }> = [
+  {
+    role: 'a service',
+    file: 'src/things/things.service.ts',
+    reported: [...RAW_SQL_FORMS, ...PROCESS_FORMS, ...RAW_REQUEST_FORMS],
+    exempt: [],
+  },
+  {
+    role: 'a controller',
+    file: 'src/things/things.controller.ts',
+    reported: [...RAW_SQL_FORMS, ...PROCESS_FORMS],
+    exempt: RAW_REQUEST_FORMS,
+  },
+  {
+    role: 'a middleware',
+    file: 'src/http/error-handler.middleware.ts',
+    reported: [...RAW_SQL_FORMS, ...PROCESS_FORMS],
+    exempt: RAW_REQUEST_FORMS,
+  },
+  {
+    role: 'the app config',
+    file: 'src/config.ts',
+    reported: RAW_SQL_FORMS,
+    exempt: [...PROCESS_FORMS, ...RAW_REQUEST_FORMS],
+  },
+  {
+    role: 'the process entry',
+    file: 'src/server.ts',
+    reported: RAW_SQL_FORMS,
+    exempt: [...PROCESS_FORMS, ...RAW_REQUEST_FORMS],
+  },
+]
+
+const eslint = new ESLint({
+  cwd: REPO_ROOT,
+  ruleFilter: ({ ruleId }) => ruleId === 'no-restricted-syntax',
+  overrideConfig: { languageOptions: { parserOptions: { projectService: false } } },
+})
+
+async function restrictionReports(file: string, sample: SampleName): Promise<string[]> {
+  const [result] = await eslint.lintText(SAMPLES[sample], { filePath: file })
+  const fatal = result.messages.find(message => message.fatal)
+  if (fatal)
+    throw new Error(`${file} (${sample}): ${fatal.message}`)
+  return result.messages
+    .filter(message => message.ruleId === 'no-restricted-syntax')
+    .map(message => message.message)
+}
+
+describe('syntax policy by file role', () => {
+  for (const { role, file, reported, exempt } of ROLES) {
+    it(`reports every restricted form in ${role}`, async () => {
+      for (const sample of reported)
+        expect(await restrictionReports(file, sample), sample).not.toEqual([])
+    })
+
+    it(`reports nothing ${role} may legitimately write`, async () => {
+      for (const sample of ['plainModule' as SampleName, ...exempt])
+        expect(await restrictionReports(file, sample), sample).toEqual([])
+    })
+  }
+})

package/templates/presets/node-frontend/baseline/eslint.config.mjs

@@ -1,8 +1,17 @@
 import antfu from '@antfu/eslint-config'
 
-const CLASS_LIST_MUTATION = 'CallExpression[callee.object.property.name="classList"][callee.property.name=/^(add|remove|toggle|replace)$/]'
-const INLINE_STYLE_WRITE = 'AssignmentExpression[left.object.property.name="style"]'
-const INLINE_STYLE_PROPERTY = 'CallExpression[callee.object.property.name="style"][callee.property.name=/^(setProperty|removeProperty)$/]'
+const CLASS_LIST_ACCESS = ':matches([callee.object.property.name="classList"], [callee.object.property.value="classList"])'
+const CLASS_LIST_METHOD = ':matches([callee.property.name=/^(add|remove|toggle|replace)$/], [callee.property.value=/^(add|remove|toggle|replace)$/])'
+const CLASS_LIST_CALL = `CallExpression${CLASS_LIST_ACCESS}${CLASS_LIST_METHOD}`
+const CLASS_LIST_BINDING = 'VariableDeclarator:matches([init.property.name="classList"], [init.property.value="classList"])'
+const CLASS_LIST_MUTATION = `:matches(${CLASS_LIST_CALL}, ${CLASS_LIST_BINDING})`
+
+const STYLE_ACCESS = ':matches([left.object.property.name="style"], [left.object.property.value="style"])'
+const INLINE_STYLE_WRITE = `AssignmentExpression${STYLE_ACCESS}`
+const STYLE_METHOD = ':matches([callee.property.name=/^(setProperty|removeProperty)$/], [callee.property.value=/^(setProperty|removeProperty)$/])'
+const INLINE_STYLE_CALL = `CallExpression:matches([callee.object.property.name="style"], [callee.object.property.value="style"])${STYLE_METHOD}`
+const STYLE_BINDING = 'VariableDeclarator:matches([init.property.name="style"], [init.property.value="style"])'
+const INLINE_STYLE_PROPERTY = `:matches(${INLINE_STYLE_CALL}, ${STYLE_BINDING})`
 
 const NO_STATE_CLASSES = {
   selector: CLASS_LIST_MUTATION,