$schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
# [STRICT — opt-in] HTTP-client boundaries. Absorbed from
# ts-libs/.spur/rules/typescript/external-api-boundaries.yaml. NOT in
# recommended-pre-check: Spur has no central api-client seam yet, and the
# server's Hono/Workers entrypoint legitimately exposes a `fetch` handler.
# Opt in via: spur rule run --preset strict  (or --rule <id>).
include:
  - "apps/**/src/**/*.ts"
  - "packages/**/src/**/*.ts"
# NOTE: no doc-level tests exclusion — the globalThis.fetch* rules deliberately
# include tests, and a doc-level `**/tests/**` would neuter them (verified:
# zero globalThis.fetch usage in tests today, so removing it stays green).

rules:
  - id: no-direct-fetch
    description: "Prefer a centralized HTTP client over ad-hoc fetch(...). The server's Hono/Workers fetch entrypoint is exempt."
    severity: warning
    evaluator:
      type: rg
      config:
        pattern: "(^|[^.[:alnum:]_])fetch\\("
    exclude:
      # Hono/Cloudflare Workers entrypoint — `fetch` is the platform contract
      # (worker.ts:55 `async fetch(` matches the pattern when stripped).
      - "apps/server/src/worker.ts"

  - id: no-globalthis-fetch
    description: "Avoid globalThis.fetch(...); route HTTP through a client seam when one exists."
    severity: error
    evaluator:
      type: rg
      config:
        pattern: "globalThis\\.fetch\\("
    include:
      - "apps/**/src/**/*.ts"
      - "packages/**/src/**/*.ts"
      - "apps/**/tests/**/*.ts"
      - "apps/**/tests/**/*.tsx"
      - "packages/**/tests/**/*.ts"
      - "packages/**/tests/**/*.tsx"

  - id: no-globalthis-fetch-mutation
    description: "Avoid mutating globalThis.fetch in tests; use the injectable fetch seam (rpc-client.ts setFetchForTesting / resetFetchForTesting)."
    severity: error
    evaluator:
      type: rg
      config:
        pattern: "globalThis\\.fetch\\s*="
    include:
      - "apps/**/tests/**/*.ts"
      - "apps/**/tests/**/*.tsx"
      - "packages/**/tests/**/*.ts"
      - "packages/**/tests/**/*.tsx"
  - id: no-xml-http-request
    description: "Do not use XMLHttpRequest in a Bun/Node codebase."
    severity: error
    evaluator:
      type: rg
      config:
        pattern: "new\\s+XMLHttpRequest\\("
    # Correctness rule (not a seam rule): XHR is never valid under Bun, so it
    # applies to scripts/ tooling too — override the file-level apps+packages scope.
    include:
      - "apps/**/src/**/*.ts"
      - "packages/**/src/**/*.ts"
      - "scripts/**/*.ts"

  - id: no-third-party-http-clients
    description: "Use the platform fetch / a project client instead of ad-hoc HTTP client libraries (axios/got/ky/ofetch/undici)."
    severity: error
    evaluator:
      type: forbidden-import
      config:
        forbidden:
          - specifier: "axios"
          - specifier: "got"
          - specifier: "ky"
          - specifier: "ofetch"
          - specifier: "undici"
        scope:
          include:
            - "apps/**/*.ts"
            - "packages/**/*.ts"
            - "scripts/**/*.ts"
          exclude:
            - "**/tests/**"
            - "**/*.test.ts"