Skip to main content

:::warning AUTO-GENERATED — do not edit This page is generated from the MCP server snapshot content/guide-mcp.json. Edit the source MCP server (not this file), then run npm run generate. :::

Guide (Frontend) — Guardrails & Non-negotiables

These rules are enforced by the MCP server and must not be bypassed.

{
  "antiHallucinationPolicy": {
    "summary": "Never invent APIs, endpoints, types, fields, tables, columns, colors, component names, or package imports. Retrieve every fact from an MCP tool, a real schema, or an existing project file. If a tool/schema/file does not confirm it, STOP and ask — do not fabricate.",
    "rules": [
      "GROUND, DON'T GUESS: Every endpoint, field, table, column, type, color, or component MUST come from an MCP discovery tool or an existing project file. If you did not see it there, it does not exist.",
      "VALIDATE BEFORE USE: Run the relevant validate_* tool before writing code that depends on a discovered fact. A failed result means STOP — do not build on it.",
      "TYPES FROM SCHEMA/SOURCE: Type and validation schemas MUST mirror the real response/DB schema or documented contract. Include ONLY fields confirmed to exist — never add plausible-looking ones.",
      "IMPORTS FROM KNOWN MODULES: Only import symbols actually exported by installed dependencies or files that exist in the project. Do not import a package that is not declared in the project's manifest.",
      "CITE YOUR SOURCE: When you write an endpoint, type, field, color, or component, state which tool call, schema, or project file it came from. Unsourced facts are not allowed.",
      "FAIL CLOSED: If discovery is inconclusive (tool errors, empty result, ambiguous mapping), ask the user a specific question rather than proceeding on an assumption.",
      "COMPILER IS THE ORACLE: Run the project's verify gate before declaring done. A hallucinated fact becomes a type/build/lint error — fix the root cause, do not suppress it.",
      "GROUND VIA API-MCP: Resolve every endpoint path/method/param/response field from `get_endpoint_details` or `get_openapi_spec` (api-mcp), then confirm it with `validate_endpoint` before writing any fetch/service function. A red result means STOP — do not write the call.",
      "COLORS FROM TOKENS: Never write hex/rgb colors. Use shadcn CSS variables only. Verify unknown colors with `validate_colors` (guide-mcp).",
      "COMPONENTS FROM CATALOG: Only use component/layout names returned by `get_component_template`, `get_layout_patterns`, or `get_shadcn_components` (guide-mcp). Do not invent component names.",
      "ALLOWED IMPORTS: Only import symbols that are actually exported by `@rystad/auth`, installed dependencies, or files that exist in the project. Do not import from packages that are not in package.json.",
      "NO INVENTED DATA: Never hardcode fake/sample/placeholder data to make a UI 'look done'. Wire real data or leave a typed loading/empty state.",
      "VERIFY GATE: Run `npm run verify` before declaring done. A hallucinated API becomes a type/build error — fix it, don't suppress it (no `any`, no `@ts-ignore`)."
    ]
  },
  "nonNegotiables": [
    "Use `request<T>()` from `@/lib/request` (or `fetchWithAuth`) for ALL network calls — never raw fetch/axios.",
    "Use `type`, never `interface`.",
    "Use TanStack Query for server state — never `useEffect` for data fetching.",
    "Use TanStack Router file-based routes under `src/routes/`.",
    "Use Zustand for client/UI state — never React Context for frequently-changing state.",
    "camelCase file names; PascalCase component names; no barrel (index.ts re-export) files.",
    "Auth only via `@rystad/auth` — never build a custom auth/token flow.",
    "No secrets in client code, .env commits, or localStorage. No `eval`/`dangerouslySetInnerHTML`.",
    "One endpoint per chart/visual — never batch multiple charts into a single response",
    "Every new component ships with a Skeleton loading state and a test; unchecked items live in COMPONENT_CHECKLIST.md"
  ],
  "enforcedBy": [
    "eslint.config.js — bans raw fetch, axios, interface, hex colors, barrel files, eval, dangerouslySetInnerHTML, and non-allowlisted imports.",
    "tsconfig strict mode — hallucinated fields/types fail to compile.",
    "`npm run verify` — typecheck + lint + build + tests must pass before 'done'.",
    "core.gateway (runtime) — CSP/nonce, anti-forgery, and role gating cannot be bypassed from the client.",
    "create-rystad-app — the ESLint heuristic (one-endpoint-per-chart) + the verify-gate check that every component has a Skeleton loading state and a co-located test (per DAS-9)."
  ]
}