@brandlab-digital/eslint-plugin

Proprietary software © Brandlab Digital Marketing. All rights reserved. Published for Brandlab client sites.

Fast, syntax-level safeguards for Brandlab Next.js consumers. The plugin gives immediate editor and CI feedback for violations that can be established from a single source file.

It deliberately does not implement release support, migration policy, project health, rendered-output validation or portfolio scoring. Those decisions belong to @brandlab-digital/conformance.

Client preset

Every Brandlab Next.js client uses the complete preset as its whole eslint.config.mjs:

import brandlab from '@brandlab-digital/eslint-plugin'

export default brandlab.configs.next

configs.next is Next's core-web-vitals and typescript configs, then configs.recommended, then react/no-unescaped-entities off (apostrophes are ordinary copy) and the standard ignores (.next/, out/, build/, coverage/, playwright-report/, test-results/, .vercel/, public/, next-env.d.ts). It loads eslint-config-next when first used, so install eslint-config-next at the exact version of next.

Recommended flat config

For a non-Next consumer, or to compose a custom array:

import brandlab from '@brandlab-digital/eslint-plugin'

export default [brandlab.configs.recommended]

The recommended config enables every published rule as an error.

Stable rule IDs

| Rule | Purpose | Preferred implementation | |---|---|---| | brandlab/no-retired-analytics-events | Rejects retired event names such as contact_form_submission and phone_call. | Use contact_form for accepted forms and phone_link_click for telephone-link diagnostics. | | brandlab/no-raw-json-ld | Rejects raw JSON-LD <script> and createElement output in consumers. | Render typed graphs through @brandlab-digital/site-next/schema. | | brandlab/no-unsafe-rich-text-sinks | Rejects every project-owned raw HTML sink (dangerouslySetInnerHTML in JSX, props objects or assignments), whatever sanitiser it names. The conformance checker applies the same policy. | Render JSON-LD with SchemaScript and rich text with SafeRichText from @brandlab-digital/site-next. | | brandlab/no-protected-platform-reimplementation | Rejects local declarations and direct calls that bypass protected contact, SEO or analytics surfaces. | Import the shared site-core or site-next API. | | brandlab/no-analytics-pii | Rejects statically provable lead PII, message and attachment data in known analytics sinks. | Send only shared allowlisted event parameters. | | brandlab/no-unsafe-external-links | Rejects script-bearing link schemes and external new-context links with opener access when the URL is static. | Use safe schemes and rel="noopener"; keep runtime URL validation at the trust boundary. | | brandlab/no-raw-image-elements | Rejects raw website <img> and createElement('img') output. | Use next/image; the documented getImageProps art-direction pattern and email renderer files remain exempt. |

RULE_IDS is exported for tools that need the canonical IDs without duplicating strings. The 3.0 release removed brandlab/no-allow-indexing-true together with the ALLOW_INDEXING path it guarded; indexing is decided by the deployment environment.

Deliberate boundaries

• The protected-surface rule checks declarations with reserved platform API names and direct transport or analytics calls. It does not compare implementation behaviour or package versions.
• The analytics rule inspects known event sinks and source-visible payloads. It does not guess the contents of opaque dynamic objects; runtime allowlisting and conformance remain mandatory.
• The link rule acts only on statically resolvable URLs. Dynamic destinations require runtime validation and behavioural verification.
• The image rule applies to website UI. Raw image markup remains available to non-Next renderers when the file is clearly located or named as an email renderer.
• Shared implementations in site-core, site-next and installed @brandlab-digital packages are not treated as consumer reimplementations.

These constraints keep linting deterministic and editor-fast while the conformance engine owns deeper AST, behavioural and rendered-output evidence.