eslint.config.ts

import js from "@eslint/js";
import tseslint from "typescript-eslint";
import jsdoc from "eslint-plugin-jsdoc";
import { fileURLToPath } from "node:url";
import { dirname, join } from "node:path";
import { readFileSync } from "node:fs";

const __dirname = dirname(fileURLToPath(import.meta.url));

// ── Anti-SLUDGE policy note ─────────────────────────────────────────────────
// Anti-sludge patterns (as unknown as, Record<string, unknown>, unknown in
// core, *Like types, JSON.parse in core, etc.) are enforced by Semgrep with
// rule-scoped quarantines read from policy/quarantines/0025*.json. See
// scripts/lint-semgrep-with-quarantines.ts and docs/ANTI_SLUDGE_POLICY.md.
// ESLint here enforces the policy rules that ARE expressible in ESLint
// (import boundaries, existing determinism/raw-error selectors).

/**
 * Loads a quarantine manifest's file list. Returns [] if the manifest is
 * missing (bootstrap/first-run tolerance). Errors other than ENOENT throw so
 * a corrupted manifest can't silently disable enforcement.
 */
function loadQuarantineFiles(manifestId) {
  const manifestPath = join(__dirname, "policy", "quarantines", `${manifestId}.json`);
  try {
    const raw = readFileSync(manifestPath, "utf8");
    const parsed = JSON.parse(raw);
    return Array.isArray(parsed.files)
      ? parsed.files.filter((entry) => typeof entry === "string")
      : [];
  } catch (err) {
    if (err && err.code === "ENOENT") { return []; }
    throw err;
  }
}

const QUARANTINE_0025D_IMPORT_LAW = loadQuarantineFiles("0025D-import-law");
const QUARANTINE_HYGIENE_CONSISTENT_TYPE_IMPORTS = loadQuarantineFiles("HYGIENE-consistent-type-imports");
const QUARANTINE_HYGIENE_RESTRICT_TEMPLATE_EXPRESSIONS = loadQuarantineFiles("HYGIENE-restrict-template-expressions");

// ── Base: recommended + strict-type-checked + JSDoc for src/ and bin/ ────────
// Every rule is "error". Zero warnings. Zero tolerance. Maximum pain.

export default tseslint.config(
  // ── Global ignores ─────────────────────────────────────────────────────────
  {
    ignores: [
      "node_modules/**",
      "packages/**/node_modules/**",
      "coverage/**",
      "dist/**",
      "src/infrastructure/adapters/wesley/generated/**",
      "scripts/**/*",
      "!scripts/performance",
      "!scripts/performance/**",
      ".claude/**",
      ".obsidian/**",
      "test/type-check/**",
      "test/runtime/**",
      "**/*.d.ts",
    ],
  },

  // ── All JS files: recommended baseline ─────────────────────────────────────
  js.configs.recommended,

  // NOTE: strictTypeChecked and stylisticTypeChecked presets are applied
  // only to src/ and bin/ files via the parser/rules block below, not globally.
  // Global application crashes on files without type info (benchmarks, etc.).

  // Performance scripts are merge controls, so they receive their own typed
  // lint surface without inheriting domain-only error and JSDoc laws.
  {
    files: ["scripts/performance/**/*.ts"],
    languageOptions: {
      ecmaVersion: 2022,
      sourceType: "module",
      parser: tseslint.parser,
      parserOptions: {
        projectService: true,
        tsconfigRootDir: __dirname,
      },
      globals: {
        Buffer: "readonly",
        console: "readonly",
        process: "readonly",
      },
    },
    plugins: {
      "@typescript-eslint": tseslint.plugin,
    },
    rules: {
      "no-undef": "off",
      "no-duplicate-imports": "error",
      "eqeqeq": "error",
      "complexity": ["error", 15],
      "max-lines-per-function": ["error", 120],
      "@typescript-eslint/await-thenable": "error",
      "@typescript-eslint/consistent-type-imports": "error",
      "@typescript-eslint/no-explicit-any": "error",
      "@typescript-eslint/no-floating-promises": "error",
      "@typescript-eslint/no-misused-promises": "error",
      "@typescript-eslint/no-unnecessary-condition": "error",
      "@typescript-eslint/no-unnecessary-type-assertion": "error",
      "@typescript-eslint/require-await": "error",
    },
  },

  // ── Source + CLI: typed linting (the nuclear option) ────────────────────────
  {
    files: ["src/**/*.ts", "bin/**/*.ts"],
    languageOptions: {
      ecmaVersion: 2022,
      sourceType: "module",
      parser: tseslint.parser,
      parserOptions: {
        projectService: true,
        tsconfigRootDir: __dirname,
      },
      globals: {
        process: "readonly",
        Buffer: "readonly",
        console: "readonly",
        setTimeout: "readonly",
        clearTimeout: "readonly",
        setInterval: "readonly",
        clearInterval: "readonly",
        URL: "readonly",
        TextDecoder: "readonly",
        TextEncoder: "readonly",
        fetch: "readonly",
        AbortController: "readonly",
        AbortSignal: "readonly",
        performance: "readonly",
        global: "readonly",
        WebSocket: "readonly",
        Bun: "readonly",
        BunServer: "readonly",
        BunServeOptions: "readonly",
        Deno: "readonly",
        DenoServer: "readonly",
        DenoServeOptions: "readonly",
      },
    },
    plugins: {
      "@typescript-eslint": tseslint.plugin,
      jsdoc,
    },
    rules: {
      // ── THE RULES THAT WOULD HAVE CAUGHT THE BUG ────────────────────────
      "@typescript-eslint/no-floating-promises": "error",
      "@typescript-eslint/no-misused-promises": "error",
      "@typescript-eslint/await-thenable": "error",
      "@typescript-eslint/require-await": "error",

      // Turn off base rule that conflicts with TS version
      "require-await": "off",

      // ── IRONCLAD: ban explicit `any` in type annotations ────────────────
      "@typescript-eslint/no-explicit-any": "error",

      // ── TYPE-AWARE: no-unsafe-* disabled ──────────────────────────────
      // Runtime-backed classes with constructor validation ARE the type
      // system. tsc cannot follow JSDoc types across module boundaries,
      // producing false positives on correct code. See cycle 0012 retro.
      "@typescript-eslint/no-unsafe-assignment": "off",
      "@typescript-eslint/no-unsafe-member-access": "off",
      "@typescript-eslint/no-unsafe-return": "off",
      "@typescript-eslint/no-unsafe-call": "off",
      "@typescript-eslint/strict-boolean-expressions": ["error", { allowAny: true }],
      "@typescript-eslint/switch-exhaustiveness-check": "error",
      "@typescript-eslint/only-throw-error": "error",

      // ── More typed rules ─────────────────────────────────────────────────
      "@typescript-eslint/no-unnecessary-type-assertion": "error",
      "@typescript-eslint/no-redundant-type-constituents": "error",
      "@typescript-eslint/restrict-plus-operands": "error",
      "@typescript-eslint/no-base-to-string": "error",
      "@typescript-eslint/no-duplicate-type-constituents": "error",
      "@typescript-eslint/unbound-method": "error",
      "@typescript-eslint/no-for-in-array": "error",
      "@typescript-eslint/no-unnecessary-boolean-literal-compare": "error",
      "@typescript-eslint/return-await": ["error", "always"],

      // ── Hygiene rules with rule-scoped quarantines ───────────────────────
      "@typescript-eslint/consistent-type-imports": ["error", {
        prefer: "type-imports",
        fixStyle: "inline-type-imports",
      }],
      "@typescript-eslint/restrict-template-expressions": ["error", {
        allowAny: false,
        allowBoolean: false,
        allowNever: false,
        allowNullish: false,
        allowNumber: true,
        allowRegExp: false,
      }],

      // ── JSDoc BRUTALITY ─────────────────────────────────────────────────
      "jsdoc/require-jsdoc": ["error", {
        require: { FunctionDeclaration: true, MethodDefinition: true, ArrowFunctionExpression: true },
      }],
      "jsdoc/require-description": "error",
      "jsdoc/valid-types": "error",

      // ── CUSTOM ERROR TIER: no raw Errors ────────────────────────────────
      // IMPORTANT: In ESLint flat config, multiple blocks setting
      // `no-restricted-syntax` REPLACE rather than merge — the last
      // matching block wins per rule. The domain purity block below
      // (at files: src/domain/**) MUST re-list every selector from
      // this block plus its own Date/Math/timer bans, or the bans here
      // will silently disappear in domain code. See eslint.config.ts
      // lines ~385 onward.
      "no-restricted-syntax": ["error",
        {
          "selector": "NewExpression[callee.name='Error']",
          "message": "Zero-slop policy: Do not throw raw Errors. Create and instantiate a domain error class extending WarpError.",
        },
        {
          "selector": "NewExpression[callee.name='TypeError']",
          "message": "Zero-slop policy: Do not throw raw TypeErrors. Use a domain error class extending WarpError with a structured `code` field.",
        },
        {
          "selector": "MethodDefinition[kind='constructor'] > FunctionExpression > AssignmentPattern[left.type='ObjectPattern'][right.type='ObjectExpression'][right.properties.length=0]",
          "message": "Avoid `constructor({ ... } = {})`. Accept an `options` parameter and destructure inside the constructor body so optionality stays explicit in JSDoc and type checking.",
        },
        // NOTE: `as unknown as` (double-cast) is enforced by Semgrep
        // (ts-no-double-cast in semgrep/typescript-anti-sludge.yml) so the
        // quarantine-aware wrapper can apply rule-scoped exclusions from
        // policy/quarantines/0025A-casts.json. Keeping it out of ESLint
        // avoids duplicating the quarantine-reading logic in two places.
      ],

      // ── Complexity & structure (MAXIMUM PAIN) ───────────────────────────
      "complexity": ["error", 5],
      "max-depth": ["error", 3],
      "max-lines-per-function": ["error", 30],
      "max-params": ["error", 3],
      "max-nested-callbacks": ["error", 3],

      // ── Variables ────────────────────────────────────────────────────────
      "no-unused-vars": "off",
      "@typescript-eslint/no-unused-vars": ["error", { "argsIgnorePattern": "^_" }],
      // TypeScript overload declarations are checked by tsc; the base rule
      // treats valid overload sets as redeclarations.
      "no-redeclare": "off",
      "no-var": "error",
      "prefer-const": "error",
      "no-shadow": "off",
      "@typescript-eslint/no-shadow": "error",
      "no-use-before-define": "off",
      "@typescript-eslint/no-use-before-define": ["error", { "functions": false }],
      "no-undef-init": "error",
      "one-var": ["error", "never"],

      // ── Equality & types ─────────────────────────────────────────────────
      "eqeqeq": ["error", "always"],
      "no-implicit-coercion": ["error", { "allow": ["!!"] }],
      "no-new-wrappers": "error",

      // ── Control flow ─────────────────────────────────────────────────────
      "curly": ["error", "all"],
      "consistent-return": "error",
      "default-case": "error",
      "default-case-last": "error",
      "no-lonely-if": "error",
      "no-else-return": ["error", { "allowElseIf": false }],
      "no-unneeded-ternary": "error",
      "no-useless-return": "error",
      "yoda": ["error", "never"],

      // ── Functions ────────────────────────────────────────────────────────
      "no-caller": "error",
      "no-extra-bind": "error",
      "no-loop-func": "error",
      "no-param-reassign": "error",
      "prefer-arrow-callback": "error",
      "prefer-rest-params": "error",
      "prefer-spread": "error",
      "arrow-body-style": ["error", "as-needed"],

      // ── Objects & arrays ─────────────────────────────────────────────────
      "no-array-constructor": "error",
      "no-object-constructor": "error",
      "object-shorthand": ["error", "always"],
      "prefer-object-spread": "error",
      "prefer-destructuring": ["error", {
        "VariableDeclarator": { "array": false, "object": true },
        "AssignmentExpression": { "array": false, "object": false },
      }],
      "no-useless-computed-key": "error",
      "no-useless-rename": "error",
      // Base dot-notation off; type-aware version below respects noPropertyAccessFromIndexSignature
      "dot-notation": "off",
      "@typescript-eslint/dot-notation": "error",
      "grouped-accessor-pairs": ["error", "getBeforeSet"],
      "accessor-pairs": "error",

      // ── Strings & templates ──────────────────────────────────────────────
      "prefer-template": "error",
      "no-useless-concat": "error",
      "no-multi-str": "error",

      // ── Classes ──────────────────────────────────────────────────────────
      "no-constructor-return": "error",
      "no-useless-constructor": "error",

      // ── Modules ──────────────────────────────────────────────────────────
      "no-duplicate-imports": "error",

      // ── Security & dangerous patterns ────────────────────────────────────
      "no-eval": "error",
      "no-implied-eval": "error",
      "no-new-func": "error",
      "no-script-url": "error",
      "no-proto": "error",
      "no-extend-native": "error",
      "no-iterator": "error",
      "no-labels": "error",
      "no-extra-label": "error",
      "no-with": "error",
      "no-void": ["error", { "allowAsStatement": true }],
      "no-console": "error",

      // ── Catch blocks (B126: documents intent — already active via eslint:recommended) ──
      "no-empty": ["error", { "allowEmptyCatch": false }],

      // ── Correctness ──────────────────────────────────────────────────────
      "no-self-compare": "error",
      "no-template-curly-in-string": "error",
      "no-unreachable-loop": "error",
      "no-promise-executor-return": "error",
      "no-constant-binary-expression": "error",
      "no-new": "error",
      "no-return-assign": ["error", "always"],
      "no-sequences": "error",
      "no-throw-literal": "error",
      "no-multi-assign": "error",
      "no-useless-call": "error",
      "symbol-description": "error",
      "prefer-numeric-literals": "error",
      "radix": "error",
      "no-loss-of-precision": "error",
    },
  },

  // ── TypeScript source: re-enable no-unsafe-* (works in real .ts) ───────────
  {
    files: ["src/**/*.ts", "bin/**/*.ts"],
    rules: {
      "@typescript-eslint/no-unsafe-assignment": "error",
      "@typescript-eslint/no-unsafe-member-access": "error",
      "@typescript-eslint/no-unsafe-return": "error",
      "@typescript-eslint/no-unsafe-call": "error",
      "@typescript-eslint/strict-boolean-expressions": "error",

      // JSDoc rules not needed in .ts — types are in the syntax
      "jsdoc/require-jsdoc": "off",
      "jsdoc/require-description": "off",
      "jsdoc/valid-types": "off",
    },
  },

  // ── Relaxed complexity for algorithm-heavy modules ─────────────────────────
  {
    files: [
      "src/domain/services/index/BitmapNeighborProvider.ts",
      "src/domain/services/index/BitmapAccumulator.ts",
      "src/domain/services/index/BitmapIndexBuilder.ts",
      "src/domain/services/index/BitmapIndexReader.ts",
      "src/domain/services/index/LogicalBitmapIndexBuilder.ts",
      "src/domain/services/index/LogicalIndexBuildService.ts",
      "src/domain/services/MaterializedViewHelpers.ts",
      // JoinReducer-family files extracted from the original god class.
      // These inherit its algorithmic density: concerns-per-file is low,
      // but branching complexity and parameter counts are intrinsic.
      "src/domain/services/DiffCalculator.ts",
      "src/domain/services/ReceiptBuilder.ts",
      "src/domain/services/OpStrategies.ts",
      "src/domain/services/OpValidator.ts",
      "src/domain/services/JoinReducerSession.ts",
      "src/domain/services/controllers/MaterializeSessionBridge.ts",
      "src/domain/services/state/WarpState.ts",
      "src/domain/services/state/SessionVisibleGraph.ts",
      "src/domain/services/state/WarpStateSnapshotIndex.ts",
      "src/domain/orset/trie/TrieCompactor.ts",
      "src/domain/warp/RuntimeHostBoot.ts",
      "src/domain/warp/WarpCoreRuntimeProduct.ts",
      "src/domain/warp/WarpGraphRuntimeProduct.ts",
      "src/application/provenance/BtrOperations.ts",
      "src/infrastructure/adapters/BtrCodecAdapter.ts",
      "src/infrastructure/adapters/RoaringLoaderAdapter.ts",
      "src/infrastructure/adapters/TrailerCommitMessageCodecAdapter.ts",
    ],
    rules: {
      "complexity": ["error", 35],
      "max-lines-per-function": ["error", 200],
      "max-depth": ["error", 6],
      "max-params": ["error", 6],
    },
  },
  {
    files: [
      "src/domain/WarpGraph.ts",
      "src/domain/services/controllers/PatchController.ts",
      "src/domain/services/controllers/PatchDiscovery.ts",
      "src/domain/services/controllers/MaterializeController.ts",
      "src/domain/services/state/checkpointHelpers.ts",
      "src/domain/services/state/checkpointCreate.ts",
      "src/domain/services/state/checkpointLoad.ts",
      "src/domain/services/codec/WarpMessageCodec.ts",
      "src/domain/services/codec/PatchMessageCodec.ts",
      "src/domain/services/codec/CheckpointMessageCodec.ts",
      "src/domain/services/codec/AnchorMessageCodec.ts",
      "src/domain/services/codec/MessageSchemaDetector.ts",
      "src/domain/services/controllers/syncHelpers.ts",
      // Domain services — algorithm-heavy
      "src/domain/services/BisectService.ts",
      "src/domain/services/Frontier.ts",
      "src/domain/services/KeyCodec.ts",
      "src/domain/services/MaterializedViewService.ts",
      "src/domain/services/PatchBuilder.ts",
      "src/domain/services/PatchBuilderValidation.ts",
      "src/domain/services/PatchCommitter.ts",
      "src/domain/services/Worldline.ts",
      "src/domain/services/WormholeService.ts",
      // Audit
      "src/domain/services/audit/AuditReceiptService.ts",
      "src/domain/services/audit/AuditChainVerifier.ts",
      // Codec
      "src/domain/services/codec/AuditMessageCodec.ts",
      // Controllers
      "src/domain/services/controllers/CheckpointController.ts",
      "src/domain/services/controllers/ComparisonEngine.ts",
      "src/domain/services/controllers/ComparisonSelector.ts",
      "src/domain/services/controllers/ForkController.ts",
      "src/domain/services/controllers/MaterializeHelpers.ts",
      "src/domain/services/controllers/ProvenanceController.ts",
      "src/domain/services/controllers/QueryController.ts",
      "src/domain/services/controllers/SubscriptionController.ts",
      "src/domain/services/controllers/SyncServerLauncher.ts",
      "src/domain/services/controllers/SyncController.ts",
      // DAG
      "src/domain/services/dag/CommitDagTraversalService.ts",
      "src/domain/services/dag/DagPathFinding.ts",
      "src/domain/services/dag/DagTopology.ts",
      "src/domain/services/dag/DagTraversal.ts",
      "src/domain/services/dag/pathReconstruction.ts",
      // Index
      "src/domain/services/index/BitmapIndexBuilder.ts",
      "src/domain/services/index/BitmapNeighborProvider.ts",
      "src/domain/services/index/IncrementalIndexUpdater.ts",
      "src/domain/services/index/LogicalBitmapIndexBuilder.ts",
      "src/domain/services/index/LogicalIndexBuildService.ts",
      // Provenance
      "src/domain/services/provenance/btrOperations.ts",
      // Query
      "src/domain/services/query/AdjacencyNeighborProvider.ts",
      "src/domain/services/query/GraphAnalysis.ts",
      "src/domain/services/query/GraphPathFinding.ts",
      "src/domain/services/query/GraphTopology.ts",
      "src/domain/services/query/GraphTraversal.ts",
      "src/domain/services/query/LogicalTraversal.ts",
      "src/domain/services/query/Observer.ts",
      "src/domain/services/query/QueryBuilder.ts",
      "src/domain/services/query/TraversalContext.ts",
      // State
      "src/domain/services/state/CheckpointSerializer.ts",
      "src/domain/services/state/StateReader.ts",
      "src/domain/services/state/StateReaderContext.ts",
      "src/domain/services/state/StateSerializer.ts",
      // Strand
      "src/domain/services/strand/conflictCandidateAnalysis.ts",
      "src/domain/services/strand/ConflictAnalysisRequest.ts",
      "src/domain/services/strand/ConflictCandidateCollector.ts",
      "src/domain/services/strand/ConflictFrameLoader.ts",
      "src/domain/services/strand/ConflictTraceAssembler.ts",
      "src/domain/services/strand/OpRecord.ts",
      "src/domain/services/strand/StrandCoordinator.ts",
      "src/domain/services/strand/StrandIntentService.ts",
      "src/domain/services/strand/StrandMaterializer.ts",
      "src/domain/services/strand/StrandPatchService.ts",
      // Sync
      "src/domain/services/sync/SyncAuthService.ts",
      "src/domain/services/sync/syncPatchLoader.ts",
      "src/domain/services/sync/syncDelta.ts",
      "src/domain/services/sync/syncRequestResponse.ts",
      // Trust
      "src/domain/trust/TrustEvaluator.ts",
      "src/domain/trust/TrustRecord.ts",
      "src/domain/trust/TrustRecordService.ts",
      "src/domain/trust/TrustStateBuilder.ts",
      // Types + utils
      "src/domain/types/DeliveryObservation.ts",
      "src/domain/types/WorldlineSelector.ts",
      "src/domain/types/ops/propHelpers.ts",
      "src/domain/utils/EventId.ts",
      "src/domain/utils/nullLogger.ts",
      "src/domain/warp/PatchSession.ts",
      "src/domain/warp/RuntimePatchCollector.ts",
      "src/domain/warp/RuntimeStateStore.ts",
      "src/domain/stream/WarpStream.ts",
      "src/domain/artifacts/IndexShard.ts",
      // Infrastructure
      "src/infrastructure/adapters/CborCheckpointStoreAdapter.ts",
      "src/infrastructure/adapters/CborPatchJournalAdapter.ts",
      "src/infrastructure/adapters/GitGraphAdapter.ts",
      "src/infrastructure/adapters/GitTrustChainAdapter.ts",
      "src/infrastructure/adapters/IndexShardEncodeTransform.ts",
      "src/infrastructure/adapters/gitErrorClassification.ts",
      // CLI
      "bin/git-warp.ts",
      "bin/cli/infrastructure.ts",
      "bin/cli/shared.ts",
      "bin/cli/commands/info.ts",
      "bin/cli/commands/materialize.ts",
      "bin/cli/commands/verify-audit.ts",
      "bin/cli/commands/verify-index.ts",
      "bin/cli/commands/trust.ts",
      "bin/cli/commands/seek.ts",
      "bin/cli/commands/seekCursorHelpers.ts",
      "bin/cli/commands/patch.ts",
      "bin/cli/commands/tree.ts",
      "bin/cli/commands/bisect.ts",
    ],
    rules: {
      "complexity": ["error", 35],
      "max-lines-per-function": ["error", 200],
      "max-depth": ["error", 6],
      "max-params": ["error", 10],
    },
  },

  // ── SyncController: syncWith is intrinsically long due to retry/HTTP branching ──
  {
    files: ["src/domain/services/controllers/SyncController.ts"],
    rules: {
      "max-lines-per-function": ["error", 220],
    },
  },

  // ── Port contracts: async is the interface, not the implementation ──────────
  {
    files: ["src/ports/**/*.ts"],
    rules: {
      "@typescript-eslint/require-await": "off",
    },
  },

  // ── StateSession: async factory preserves the public lifecycle contract ────
  {
    files: ["src/domain/orset/session/StateSession.ts"],
    rules: {
      "@typescript-eslint/require-await": "off",
      "complexity": ["error", 35],
      "max-lines-per-function": ["error", 200],
      "max-depth": ["error", 6],
      "max-params": ["error", 6],
    },
  },

  // ── RuntimeHostBoot: composition root validation fans in all runtime ports ─
  {
    files: ["src/domain/warp/RuntimeHostBoot.ts"],
    rules: {
      "complexity": ["error", 60],
    },
  },

  // ── ANTI-SLUDGE 0025D: import-law guardrail for core ──────────────────────
  // Hexagonal wall: src/domain/** and src/ports/** must not import from
  // adapters, Node platform APIs, or framework libraries. The P6.5
  // contamination map found ZERO pre-existing violations — this block
  // installs the guardrail for the future. See docs/design/0025-anti-sludge-
  // purge/anti-sludge-purge.md and policy/quarantines/0025D-import-law.json.
  {
    files: ["src/domain/**/*.ts", "src/ports/**/*.ts"],
    rules: {
      "no-restricted-imports": ["error", {
        // `paths` matches the import specifier exactly. Use this for
        // bare module names to avoid gitignore-style segment matching
        // (e.g. bare "stream" would otherwise match any path segment
        // named "stream").
        "paths": [
          { "name": "fs",            "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "node:fs",       "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "node:fs/promises", "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "path",          "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "node:path",     "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "http",          "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "node:http",     "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "https",         "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "node:https",    "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "net",           "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "node:net",      "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "tls",           "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "node:tls",      "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "stream",        "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "node:stream",   "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "child_process", "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "node:child_process", "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "crypto",        "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "node:crypto",   "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "os",            "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          { "name": "node:os",       "message": "Anti-sludge (0025D): Node platform APIs belong in adapters. Use a port." },
          // NOTE: `buffer` / `node:buffer` already banned in src/domain/** by
          // the existing domain-purity block. Adding here extends it to ports.
          { "name": "buffer",        "message": "Anti-sludge: Use Uint8Array + helpers from domain/utils/bytes.ts. Buffer is confined to adapters." },
          { "name": "node:buffer",   "message": "Anti-sludge: Use Uint8Array + helpers from domain/utils/bytes.ts. Buffer is confined to adapters." },
          // Framework libraries (defensive)
          { "name": "express",       "message": "Anti-sludge (0025D): transport/framework concerns belong in adapters." },
          { "name": "fastify",       "message": "Anti-sludge (0025D): transport/framework concerns belong in adapters." },
          { "name": "@prisma/client", "message": "Anti-sludge (0025D): persistence concerns belong in adapters." },
          { "name": "pg",            "message": "Anti-sludge (0025D): persistence concerns belong in adapters." },
          { "name": "mysql2",        "message": "Anti-sludge (0025D): persistence concerns belong in adapters." },
          { "name": "mongodb",       "message": "Anti-sludge (0025D): persistence concerns belong in adapters." },
          { "name": "axios",         "message": "Anti-sludge (0025D): HTTP clients belong in adapters." },
          { "name": "ky",            "message": "Anti-sludge (0025D): HTTP clients belong in adapters." },
          { "name": "zod",           "message": "Anti-sludge (0025D): validation libraries belong in adapters." },
          { "name": "valibot",       "message": "Anti-sludge (0025D): validation libraries belong in adapters." },
          { "name": "io-ts",         "message": "Anti-sludge (0025D): validation libraries belong in adapters." },
        ],
        // `patterns` uses gitignore-style globs. Safe to use here because
        // infrastructure path matching needs a glob semantic.
        "patterns": [
          {
            "group": ["**/infrastructure/**"],
            "message": "Anti-sludge (0025D): core code (src/domain/** and src/ports/**) must not import adapters. Dependencies point inward only. Route the capability through a port.",
          },
        ],
      }],
    },
  },

  // ── ANTI-SLUDGE 0025D quarantine: files with pre-existing core->platform ──
  // imports. The list comes from policy/quarantines/0025D-import-law.json.
  // Touching any of these triggers the quarantine-graduate-check CI gate.
  ...(QUARANTINE_0025D_IMPORT_LAW.length === 0 ? [] : [{
    files: QUARANTINE_0025D_IMPORT_LAW,
    rules: {
      // Disable only the import-law rule for these specific files.
      // All other rules continue to apply (rule-scoped quarantine).
      "no-restricted-imports": "off",
    },
  }]),
  ...(QUARANTINE_HYGIENE_CONSISTENT_TYPE_IMPORTS.length === 0 ? [] : [{
    files: QUARANTINE_HYGIENE_CONSISTENT_TYPE_IMPORTS,
    rules: {
      "@typescript-eslint/consistent-type-imports": "off",
    },
  }]),
  ...(QUARANTINE_HYGIENE_RESTRICT_TEMPLATE_EXPRESSIONS.length === 0 ? [] : [{
    files: QUARANTINE_HYGIENE_RESTRICT_TEMPLATE_EXPRESSIONS,
    rules: {
      "@typescript-eslint/restrict-template-expressions": "off",
    },
  }]),

  // ── Domain purity: ban Buffer — use Uint8Array + helpers from domain/utils/bytes.ts ──
  {
    files: ["src/domain/**/*.ts"],
    rules: {
      "no-restricted-globals": ["error",
        { "name": "Buffer", "message": "Use Uint8Array + helpers from domain/utils/bytes.ts. Buffer is confined to infrastructure adapters." },
      ],
      "no-restricted-imports": ["error", {
        "paths": [
          {
            "name": "node:buffer",
            "message": "Use Uint8Array + helpers from domain/utils/bytes.ts. Buffer is confined to infrastructure adapters.",
          },
          {
            "name": "buffer",
            "message": "Use Uint8Array + helpers from domain/utils/bytes.ts. Buffer is confined to infrastructure adapters.",
          },
        ],
      }],
    },
  },

  // ── Domain purity: ban all non-deterministic globals ─────────────────────
  // The domain layer must be fully deterministic and reproducible.
  // All external state (time, randomness, I/O scheduling) must flow
  // through injected ports, never accessed directly.
  //
  // NOTE: This block's `no-restricted-syntax` array REPLACES the one
  // in the src/** block above (flat-config rule values don't merge).
  // It must re-list every selector from the generic src/** block
  // (raw Error, raw TypeError, constructor object-default) PLUS its
  // own Date/Math/timer bans — otherwise the generic bans silently
  // disappear in src/domain. If you add a new selector in either
  // block, add it here too. See docs/method/backlog/cool-ideas/
  // DX_domain-error-strict-lint.md for history.
  {
    files: ["src/domain/**/*.ts"],
    rules: {
      "no-restricted-syntax": ["error",
        // ── Raw Errors (inherited from generic src/** block) ──
        {
          "selector": "NewExpression[callee.name='Error']",
          "message": "Zero-slop policy: Do not throw raw Errors. Create and instantiate a domain error class extending WarpError.",
        },
        {
          "selector": "NewExpression[callee.name='TypeError']",
          "message": "Zero-slop policy: Do not throw raw TypeErrors. Use a domain error class extending WarpError with a structured `code` field.",
        },
        {
          "selector": "MethodDefinition[kind='constructor'] > FunctionExpression > AssignmentPattern[left.type='ObjectPattern'][right.type='ObjectExpression'][right.properties.length=0]",
          "message": "Avoid `constructor({ ... } = {})`. Accept an `options` parameter and destructure inside the constructor body so optionality stays explicit in JSDoc and type checking.",
        },
        // NOTE: `as unknown as` (cycle 0025A) is enforced by Semgrep so the
        // quarantine-aware wrapper has a single source of truth. See
        // semgrep/typescript-anti-sludge.yml#ts-no-double-cast.
        // ── Wall clock ──
        {
          "selector": "CallExpression[callee.object.name='Date'][callee.property.name='now']",
          "message": "Date.now() is banned in domain code. Inject timestamps via ClockPort or parameters.",
        },
        {
          "selector": "NewExpression[callee.name='Date']",
          "message": "new Date() is banned in domain code. Inject timestamps via ClockPort or parameters.",
        },
        {
          "selector": "CallExpression[callee.name='Date']",
          "message": "Date() is banned in domain code. Inject timestamps via ClockPort or parameters.",
        },
        // ── Randomness ──
        {
          "selector": "CallExpression[callee.object.name='Math'][callee.property.name='random']",
          "message": "Math.random() is banned in domain code. Use a seeded PRNG or inject randomness via a port.",
        },
        // ── Performance timing ──
        {
          "selector": "CallExpression[callee.object.name='performance'][callee.property.name='now']",
          "message": "performance.now() is banned in domain code. Inject timing via ClockPort.",
        },
        // ── Timers ──
        {
          "selector": "CallExpression[callee.name='setTimeout']",
          "message": "setTimeout is banned in domain code. Use async patterns or inject a scheduler.",
        },
        {
          "selector": "CallExpression[callee.name='setInterval']",
          "message": "setInterval is banned in domain code. Use async patterns or inject a scheduler.",
        },
      ],
    },
  },

  // ── JoinReducer: the algorithm from hell ───────────────────────────────────
  {
    files: ["src/domain/services/JoinReducer.ts"],
    rules: {
      "complexity": ["error", 35],
      "max-lines-per-function": ["error", 200],
      "max-depth": ["error", 6],
      "max-params": ["error", 6],
      "no-param-reassign": "off",
    },
  },

  // ── Test files: keep strict but relax structure rules ──────────────────────
  {
    files: ["test/**/*.ts", "test/**/*.test.ts"],
    languageOptions: {
      ecmaVersion: 2022,
      sourceType: "module",
      parser: tseslint.parser,
      parserOptions: {
        projectService: true,
        tsconfigRootDir: __dirname,
      },
      globals: {
        process: "readonly",
        Buffer: "readonly",
        console: "readonly",
        setTimeout: "readonly",
        clearTimeout: "readonly",
        AbortController: "readonly",
        AbortSignal: "readonly",
        fetch: "readonly",
        URL: "readonly",
        TextDecoder: "readonly",
        TextEncoder: "readonly",
        performance: "readonly",
        global: "readonly",
        Headers: "readonly",
        ReadableStream: "readonly",
        Request: "readonly",
        Response: "readonly",
        WebSocket: "readonly",
        queueMicrotask: "readonly",
        describe: "readonly",
        it: "readonly",
        expect: "readonly",
        beforeEach: "readonly",
        afterEach: "readonly",
        beforeAll: "readonly",
        afterAll: "readonly",
        vi: "readonly",
        bench: "readonly",
      },
    },
    rules: {
      // Structure: tests can be long and nested
      "max-lines-per-function": "off",
      "max-nested-callbacks": "off",
      "max-params": "off",
      "complexity": "off",
      "max-depth": "off",

      // Tests need console, shadow, unused setup vars
      "no-console": "off",
      "no-shadow": "off",
      "no-unused-vars": "off",

      // Tests use flexible patterns
      "prefer-template": "off",
      "curly": "off",
      "no-new": "off",
      "prefer-destructuring": "off",
      "no-param-reassign": "off",
      "no-throw-literal": "off",
      "prefer-arrow-callback": "off",
      "arrow-body-style": "off",
      "no-empty-function": "off",
    },
  },

  // ── Benchmarks ─────────────────────────────────────────────────────────────
  {
    files: ["test/benchmark/**/*.ts"],
    languageOptions: {
      globals: {
        process: "readonly",
        Buffer: "readonly",
        console: "readonly",
        setTimeout: "readonly",
        clearTimeout: "readonly",
        performance: "readonly",
        global: "readonly",
      },
    },
    rules: {
      "no-unused-vars": "off",
      "no-console": "off",
      "curly": "off",
      "max-depth": "off",
      "max-params": "off",
      "complexity": "off",
      "prefer-template": "off",
      "max-lines-per-function": "off",
    },
  },

);