Mechanical Enforcement

// Biome config extending Ultracite presets.
// Ultracite bundles opinionated Biome rules for core/react/next — use it
// instead of hand-rolling a Biome config. Override only with a comment
// explaining *what would break* if the override were removed.
{
  "$schema": "https://biomejs.dev/schemas/2.4.9/schema.json",
  "extends": [
    "ultracite/biome/core",
    "ultracite/biome/react",
    "ultracite/biome/next"
  ],
  "files": {
    "includes": [
      "!.next/",
      "!.open-next/",
      "!node_modules/",
      "!**/*.generated.*",
      "!pnpm-lock.yaml",
      "!.wrangler/",
      "!storybook-static/"
    ]
  },
  "linter": {
    "rules": {
      "correctness": {
        // Tailwind's `theme()` function in CSS is legal but Biome doesn't know.
        "noUnknownFunction": {
          "level": "error",
          "options": { "ignore": ["theme"] }
        }
      },
      "a11y": {
        // tabIndex={0} on scrollable regions is the axe-mandated pattern
        // (scrollable-region-focusable). Conflicts with this rule; keep it off.
        "noNoninteractiveTabindex": "off"
      },
      "style": {
        // Allow filenames that don't match strict kebab-case — Next.js app router
        // uses `[slug]`, `(group)` etc. that fail camelCase convention checks.
        "useFilenamingConvention": "off",
        // Barrel re-exports are a legitimate pattern.
        "noExportedImports": "off"
      },
      "security": {
        // JSON-LD structured data requires static dangerouslySetInnerHTML blocks.
        // Keep the override narrow — review any new use sites by hand.
        "noDangerouslySetInnerHtml": "off"
      }
    }
  }
}

# deny.toml — cargo-deny template
# Copy to project root as `deny.toml`
# Docs: https://embarkstudios.github.io/cargo-deny/

[graph]
all-features = true

# --- Security advisories (RustSec DB) ---
[advisories]
severity = "low"  # flag everything, not just critical

# --- Licence compliance ---
[licenses]
unlicensed = "deny"
confidence-threshold = 0.8
copyleft = "deny"
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "BSL-1.0",
    "ISC",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "Zlib",
]

# For deps with missing/ambiguous licence metadata:
# [[licenses.clarify]]
# crate = "some-crate"
# expression = "MIT"
# license-files = [{ path = "LICENSE", hash = 0xDEADBEEF }]

# --- Crate bans ---
[bans]
multiple-versions = "warn"  # flag duplicate versions in the dep tree

# Ban specific crates (uncomment/extend as needed):
# deny = [
#     { crate = "openssl", use-instead = "rustls" },
# ]

# --- Source restrictions ---
[sources]
unknown-registry = "deny"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# allow-git = ["https://github.com/org/repo"]

# clippy.toml — drop-in complexity thresholds
# Copy to project root as `clippy.toml`
# Docs: https://doc.rust-lang.org/clippy/lint_configuration.html

# Function complexity
too-many-lines-threshold = 100        # pedantic: too_many_lines
too-many-arguments-threshold = 7      # too_many_arguments
cognitive-complexity-threshold = 25   # cognitive_complexity
type-complexity-threshold = 250       # type_complexity_limit

# Struct/param quality
max-fn-params-bools = 3               # fn_params_excessive_bools
max-struct-bools = 3                  # struct_excessive_bools

# Naming
disallowed-names = ["foo", "bar", "baz", "quux"]  # disallowed_names

// Conventional commits — nothing to configure.
// Wire via hk's commit-msg hook: see references/hk-steps.pkl.
export default { extends: ["@commitlint/config-conventional"] };

// ESLint flat config — boundary rules only.
// Biome (via Ultracite) owns formatting and general TS linting.
// ESLint's job here is to enforce *architectural* rules Biome can't express:
//   1. Layered `no-restricted-imports` (pure layer ← side-effectful layer)
//   2. `no-restricted-syntax` (raw SQL, raw JSX primitives, dynamic imports outside wrappers)
//   3. Type-assertion bans
//   4. Framework plugins (next, storybook, jsx-a11y)
//
// Paths below (`src/utilities/`, `src/components/`, `src/db/`, etc.) are
// illustrative — adapt to the project's layout. The *pattern* is what matters.

import { dirname } from "node:path";
import { fileURLToPath } from "node:url";
import { FlatCompat } from "@eslint/eslintrc";

const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);
const compat = new FlatCompat({ baseDirectory: __dirname });

export default [
  ...compat.extends(
    "next/core-web-vitals",
    "next/typescript",
    "plugin:jsx-a11y/recommended",
  ),

  // -------- Type safety --------
  {
    rules: {
      // Ban `as Type` entirely. Use `satisfies`, inference, or runtime validation.
      // Allowed exceptions (add `eslint-disable-next-line` with a reason comment):
      //   - `as const` for literal preservation
      //   - DOM APIs after null checks (e.g. `el as HTMLCanvasElement`)
      //   - Interop boundaries with untyped libraries
      //   - Tests intentionally creating invalid data
      "@typescript-eslint/consistent-type-assertions": [
        "error",
        { assertionStyle: "never" },
      ],
      // Ban `!` non-null assertions — use proper null checks.
      "@typescript-eslint/no-non-null-assertion": "error",

      // Allow `_foo` unused vars as an intentional opt-out.
      "@typescript-eslint/no-unused-vars": [
        "warn",
        {
          argsIgnorePattern: "^_",
          varsIgnorePattern: "^_",
          destructuredArrayIgnorePattern: "^_",
          caughtErrorsIgnorePattern: "^(_|ignore)",
        },
      ],

      // axe-mandated scrollable-region-focusable pattern conflicts with this rule.
      "jsx-a11y/no-noninteractive-tabindex": "off",
    },
  },

  // -------- Layer boundary: pure utilities must stay pure --------
  // Utilities are meant to be unit-testable with no server/framework coupling.
  // If a utility needs server-only APIs, it isn't a utility — move it to
  // the intentionally server-coupled layer (e.g. a `queries.ts` barrel).
  // Exempt specific files via `ignores` when you need to opt *in* to coupling.
  {
    files: ["src/utilities/**/*.ts"],
    ignores: ["src/utilities/queries.ts", "src/utilities/revalidate.ts"],
    rules: {
      "no-restricted-imports": [
        "error",
        {
          paths: [
            {
              name: "next/cache",
              message:
                "Utilities must not import server/framework modules — move to the query layer or the calling layer.",
            },
            {
              name: "next/headers",
              message:
                "Utilities must not import server/framework modules — move to the query layer or the calling layer.",
            },
            {
              name: "next/navigation",
              message:
                "Utilities must not import server/framework modules — move to the query layer or the calling layer.",
            },
            // Example: ban direct runtime import of an ORM/CMS SDK from pure code,
            // but still allow type imports so shared shapes remain visible.
            // {
            //   name: "<your-orm-or-cms>",
            //   message: "Move runtime usage to the query layer. Types are allowed.",
            //   allowTypeImports: true,
            // },
          ],
        },
      ],
    },
  },

  // -------- Layer boundary: UI must not import schema source --------
  // Components depend on *generated types*, not *schema definitions*.
  // If the UI imports from the schema source, a UI tweak can drag in a DB
  // migration and vice-versa. Point UI at the generated types file instead.
  {
    files: ["src/components/**/*.{ts,tsx}"],
    rules: {
      "no-restricted-imports": [
        "error",
        {
          patterns: [
            {
              group: [
                "@/collections/*",
                "../collections/*",
                "../../collections/*",
              ],
              message:
                "Components must not import schema source — use generated types instead.",
            },
          ],
        },
      ],
    },
  },

  // -------- Pattern bans via no-restricted-syntax --------
  {
    files: ["src/**/*.{ts,tsx}"],
    ignores: ["src/db/**", "src/migrations/**"],
    rules: {
      "no-restricted-syntax": [
        "error",
        {
          // Raw SQL template literals outside the query layer.
          // If you need a query, add a function in src/db/ that returns typed rows.
          selector: "TaggedTemplateExpression[tag.name='sql']",
          message:
            "Raw SQL is only allowed in src/db/** — go through the query layer.",
        },
        {
          // The postgres driver itself is off-limits outside src/db/.
          selector: "ImportDeclaration[source.value='postgres']",
          message:
            "The raw postgres driver is only allowed in src/db/**.",
        },
        {
          // Dynamic import() outside a named wrapper. The approved pattern is
          // `dynamic(() => import(...), { ssr: false })` via next/dynamic.
          // Inline `import()` in arbitrary locations makes chunking hard to reason about.
          selector:
            "ImportExpression:not([parent.type='ArrowFunctionExpression'])",
          message:
            "Dynamic import() is only allowed inside next/dynamic or React.lazy wrappers.",
        },
      ],
    },
  },

  // -------- UI hygiene: no raw JSX primitives outside the component library --------
  // The design system lives in src/components/ui/. App-level code should import
  // from there, not reach for raw <input> / <button> / <a>.
  {
    files: ["src/app/**/*.{ts,tsx}", "src/components/blocks/**/*.{ts,tsx}"],
    rules: {
      "no-restricted-syntax": [
        "error",
        {
          selector: "JSXOpeningElement[name.name='input']",
          message: "Use <Input /> from src/components/ui/input instead.",
        },
        {
          selector: "JSXOpeningElement[name.name='button']",
          message: "Use <Button /> from src/components/ui/button instead.",
        },
        {
          selector: "JSXOpeningElement[name.name='a']",
          message: "Use <Link /> from src/components/ui/link instead.",
        },
      ],
    },
  },
];

# Workspace lint configuration — paste into root Cargo.toml
# Requires Rust 1.74+ (workspace-level lints)
# Each crate needs: [lints]\nworkspace = true

[workspace.lints.clippy]
# Enable pedantic at warn; promote to deny once clean
pedantic = { level = "warn", priority = -1 }

# --- Common allows (adjust per-project) ---

# Numeric code (casts) — allow in emulator/embedded/math-heavy projects
cast-possible-lossless    = "allow"  # u8 as u16 etc.
cast-possible-truncation  = "allow"  # intentional width narrowing
cast-precision-loss       = "allow"  # f64 as f32
cast-sign-loss            = "allow"  # i32 as u32

# Naming
module-name-repetitions   = "allow"  # idiomatic Rust (error::Error)
similar-names             = "allow"  # register names, coordinate pairs
unreadable-literal        = "allow"  # hex addresses (0x3CD70)

# Documentation (non-library crates only)
missing-errors-doc        = "allow"
missing-panics-doc        = "allow"

# Low signal-to-noise
must-use-candidate        = "allow"
wildcard-imports          = "allow"  # common in tests and enum re-exports
struct-excessive-bools    = "allow"  # state/config structs

[workspace.lints.rust]
unsafe_code = "warn"  # visible, not denied — FFI crates need escape hatch

// Strict TypeScript compilerOptions — drop this into tsconfig.json
// and keep the comments so future-you knows *why* each flag is set.
{
  "compilerOptions": {
    // Core: the "strict" family — null checks, no implicit any, etc.
    // Non-negotiable. If you find yourself turning sub-flags off, fix the code instead.
    "strict": true,
    "strictNullChecks": true,

    // Indexed access returns T | undefined.
    // Prevents `arr[0].foo` crashing on empty arrays; forces explicit checks.
    "noUncheckedIndexedAccess": true,

    // Fail the build on dead code. Zombie imports and unused vars drift otherwise.
    // Prefix with `_` to intentionally keep an unused parameter.
    "noUnusedLocals": true,
    "noUnusedParameters": true,

    // Only allow syntax that can be erased by a pure type-stripper (TS 5.8+).
    // Bans `enum`, `namespace`, parameter properties (`constructor(private x)`),
    // and other constructs that would require runtime codegen.
    // Rationale: interop with deno/bun/swc/esbuild runtimes that strip types
    // without a full TS compiler. Migrate enums to `as const` unions.
    "erasableSyntaxOnly": true,

    // Type-check only — emit is done by bundler / swc / tsgo.
    "noEmit": true,

    // Catch missed breakage when switching editors or build tools.
    "isolatedModules": true,
    "skipLibCheck": true,

    // Module resolution appropriate for bundler-based projects (Next, Vite, etc.).
    "module": "esnext",
    "moduleResolution": "bundler",
    "esModuleInterop": true,
    "resolveJsonModule": true,

    "target": "ES2022",
    "lib": ["DOM", "DOM.Iterable", "ES2022"],
    "jsx": "preserve",
    "incremental": true
  },
  "exclude": ["node_modules"]
}