@commonplaces/oxlint-plugin 0.1.2 → 0.3.0

package/README.md

@@ -1,19 +1,23 @@
 # @commonplaces/oxlint-plugin
 
-57 custom Oxlint rules for strict Effect TypeScript, Alchemy and general code
-checks. This package supports **Oxlint 1.80.0 or 1.85.0** and **Node 22.14 or newer**.
+61 custom Oxlint rules for strict Effect TypeScript, Alchemy and general code
+checks. This package supports **Oxlint 1.80.0, 1.85.0 or 1.86.0** and **Node 22.14 or newer**.
 Oxlint's JavaScript plugin API is experimental, so upgrade it only after running
-the rule tests. The development tools use 1.80.0; consuming projects may use either supported version.
-Both exact versions are checked with independently installed archives. ESLint is not a supported host.
+the rule tests. The development tools use 1.80.0; consuming projects may use any supported version.
+All three exact versions are checked with independently installed archives. ESLint is not a supported host.
 
 ## Install
 
-Install from npm:
+Install the checked GitHub release archive:
 
 ```sh
-npm install --save-dev --save-exact @commonplaces/oxlint-plugin@0.1.2 oxlint@1.80.0
+npm install --save-dev --save-exact https://github.com/crcorbett/commonplace-lint/releases/download/v0.3.0/commonplaces-oxlint-plugin-0.3.0.tgz oxlint@1.80.0
 ```
 
+The npm registry currently provides `@commonplaces/oxlint-plugin@0.1.2` (57 rules).
+The 0.3.0 additions below require the GitHub archive until a separate npm release
+is published. GitHub archive publication does not publish a registry version.
+
 Create `oxlint.config.ts`:
 
 ```ts
@@ -96,16 +100,72 @@ package subpaths; keep your existing rule settings.
 
 | Package subpath     | Rule prefix         | Rules |
 | ------------------- | ------------------- | ----: |
-| `/strict-effect`    | `strict-effect/`    |    27 |
+| `/strict-effect`    | `strict-effect/`    |    29 |
 | `/effect`           | `effect/`           |     9 |
 | `/alchemy`          | `alchemy-secrets/`  |     3 |
 | `/bun`              | `bun/`              |     1 |
-| `/package`          | `package/`          |     1 |
+| `/package`          | `package/`          |     3 |
 | `/anti-slop`        | `anti-slop/`        |    15 |
 | `/anti-slop-effect` | `anti-slop-effect/` |     1 |
 
 ## Development
 
+### Workspace import boundaries
+
+Enable `package/workspace-import-boundaries` explicitly. Supply options derived
+from checked, current workspace manifests at configuration ingress; the rule
+does not read the filesystem or keep its own project inventory.
+
+```ts
+"package/workspace-import-boundaries": ["error", {
+  owners: [
+    { id: "root", root: "." },
+    { id: "website", root: "apps/website" },
+    { id: "orders", root: "packages/orders" },
+  ],
+  workspaces: [{
+    name: "@example/orders",
+    owner: "orders",
+    exports: { ".": false, "./service": true, "./features/*": true, "./features/private/*": false },
+  }],
+  workspacePrefixes: ["@example/"],
+  forbiddenEdges: [{ from: "website", to: "orders" }],
+  exceptions: [{ fromFile: "apps/website/src/approved.ts", toModule: "@example/orders/service" }],
+  aliases: [{ prefix: "@website/", root: "apps/website/src" }],
+}]
+```
+
+The example is illustrative; derive the actual owners, package names and export
+facts from manifests. Export booleans record reachability under the consumer's
+selected conditions. Preserve explicit `null` fences as `false`. Exact exports
+beat single-star patterns, and the most specific matching pattern wins. The
+longest anchored root identifies an owner, including root composition files.
+Cross-owner filesystem imports are rejected even when they reach a workspace
+root or a non-`src` file. Exact exceptions can permit an owner edge, but cannot
+expose a private export or permit a cross-owner filesystem path.
+
+The check covers static imports, re-exports, type imports, import-equals,
+unshadowed `require` and dynamic addresses resolvable through immutable local
+strings. Unresolved computed addresses are outside its proof. Explicit aliases
+are bounded directory prefixes; this is not a TypeScript, bundler, conditional
+export or symlink resolver. Same-owner asset queries are allowed; `file:` imports
+are unsupported and rejected. Invalid or contradictory options fail closed.
+
+### Subprocess pipe capture
+
+The `effect` group enables `strict-effect/subprocess-pipe-capture`. It follows
+native Effect process handles and rejects statically identified collection that
+can wait for a child or one pipe while another captured pipe remains undrained.
+Drain stdout, stderr and exit completion in one scope, for example with
+`Effect.all({ stdout: read(handle.stdout), stderr: read(handle.stderr),
+exitCode: handle.exitCode }, { concurrency: "unbounded" })`.
+
+The rule accounts for known job order and concurrency, and accepts known
+non-piped channels. It is bounded syntax analysis, not proof against every
+process deadlock: computed jobs, unknown wrappers and unsupported control flow
+still require review. A small-output test cannot establish safe capture. Test
+both pipes beyond pipe capacity, a nonzero exit, UTF-8 and scoped cleanup.
+
 This workspace owns the rule code. Skills provide guidance and installation
 instructions; they do not carry another copy of the rules. The package contains
 compiled JavaScript and declarations, the README and the MIT licence. It does
@@ -129,3 +189,74 @@ or infrastructure stack inside the package.
 
 The strict Effect rules were adapted from Cooper's DAW rules at `e47ecfb` and
 subsequent Commonplace rules. The package's MIT licence covers this lint code.
+
+## Keep address ownership precise
+
+`strict-effect/public-host-literals` can check test setup without replacing
+independent expected values with the implementation under test:
+
+```ts
+"strict-effect/public-host-literals": ["error", {
+  hosts: ["example.com"],
+  allowedFiles: ["packages/platform/src/site-address.ts"],
+  allowedDeclarations: [{
+    file: "packages/platform/src/site-address.ts",
+    names: ["siteHostName"],
+  }],
+  allowTestFiles: false,
+  allowTestAssertions: true,
+}]
+```
+
+The named top-level `const` declaration owns the literal hostname. Derive
+`api` and `www` hostnames from it; use native deployment outputs for actual
+stage-specific origins. Files with a declaration restriction do not gain a
+whole-file exemption. Declaration entries cannot grant ownership to a file
+absent from `allowedFiles`. Existing configurations without these optional
+settings keep their previous behaviour.
+
+The assertion exception permits recognised imported Vitest or `@effect/vitest`
+assertions' direct expected arguments, including static arrays and objects.
+It does not trace table-driven expected values through variables or callbacks;
+keep those oracles in narrowly configured declarations or use a local
+suppression explaining their role. It does
+not exempt their actual arguments, setup values, constructors, arbitrary calls
+or shadowed assertion names. A test using unrecognised assertion helpers can
+keep an explicit, narrowly scoped lint suppression with its reason. The rule
+checks written literal text; it cannot prove the value of arbitrary computed
+strings or that a configured canonical owner is semantically correct.
+
+## Separate compiler assertions from runtime tests
+
+The `effect` group enables `strict-effect/no-runtime-type-assertions`. It rejects
+calls to imported Vitest or `@effect/vitest` `expectTypeOf` and `assertType` in
+`.test.*` and `.spec.*` files. Aliases and namespace imports are recognised;
+unrelated or shadowed local functions are not treated as Vitest APIs.
+
+Move these checks into the existing TypeScript flow, for example
+`inference.typecheck.ts`, or a configured Vitest `.test-d.ts` file. Include those
+files in the compiler project and preserve negative brand/readonly assertions.
+Do not create runtime services or registries only to feed a type assertion.
+This syntax rule does not prove that the receiving compiler configuration
+includes the destination file.
+
+## Register one owner for a prohibition
+
+`package/no-redundant-rule-registrations` is opt-in. Configure pairs only after
+checking that the owner covers the redundant rule under the receiving project's
+options and file scopes:
+
+```ts
+"package/no-redundant-rule-registrations": ["error", {
+  pairs: [{ owner: "effect/no-throw", redundant: "legacy/no-throw" }],
+}]
+```
+
+Those identifiers are illustrative consumer rules, not bundled equivalences.
+The check reports when both members are statically enabled in the same Oxlint
+`rules` object. Disabled owners do not establish redundancy. Separate overrides
+are checked independently. An opaque spread or dynamic key clears preceding
+known registrations; later explicit keys can establish them again. Imported or
+spread contents still require effective-configuration review. Keep negative fixtures that
+assert the intended diagnostic once and the redundant diagnostic is absent.
+There is no automatic fix: removing a registration needs coverage evidence.

package/dist/alchemy.js

@@ -2,97 +2,8 @@ import { defineRule, eslintCompatPlugin } from "@oxlint/plugins";
 import * as Array from "effect/Array";
 import * as Option from "effect/Option";
 import * as Predicate from "effect/Predicate";
-const variableInScope = (scope, name) => Array.findFirst((variable) => variable.name === name)(scope.variables).pipe(Option.orElse(() => Option.fromNullishOr(scope.upper).pipe(Option.flatMap((upper) => variableInScope(upper, name)))));
-const constant = (variable) => Array.head(variable.defs).pipe(Option.filter(() => variable.defs.length === 1), Option.filter(() => Array.every((reference) => !reference.isWrite() || reference.init)(variable.references)), Option.flatMap((definition) => definition.node.type === "VariableDeclarator" &&
-    definition.parent?.type === "VariableDeclaration" &&
-    definition.parent.kind === "const"
-    ? Option.some(definition.node)
-    : Option.none()));
-const propertyName = (node) => {
-    if (node.type === "Identifier")
-        return Option.some(node.name);
-    if (node.type === "Literal" && Predicate.isString(node.value))
-        return Option.some(node.value);
-    return Option.none();
-};
-const member = (reference, name) => {
-    if (Option.isSome(reference.name))
-        return Option.none();
-    return reference.module === "alchemy" ||
-        reference.module === "effect" ||
-        (reference.module === "effect/process" && name === "ChildProcess")
-        ? Option.some({ module: `${reference.module}/${name}`, name: Option.none() })
-        : Option.some({ ...reference, name: Option.some(name) });
-};
-// Only real imports and immutable local aliases count. The nearest declaration
-// prevents a shadowed parameter from borrowing an outer import's identity.
-const referenceOf = (context, node, visited = []) => {
-    if (Array.some(visited, (previous) => previous === node))
-        return Option.none();
-    const next = [...visited, node];
-    if (node.type === "TSAsExpression" || node.type === "TSSatisfiesExpression") {
-        return referenceOf(context, node.expression, next);
-    }
-    if (node.type === "MemberExpression") {
-        const name = node.computed
-            ? node.property.type === "Literal"
-                ? propertyName(node.property)
-                : Option.none()
-            : propertyName(node.property);
-        return Option.all([referenceOf(context, node.object, next), name]).pipe(Option.flatMap(([reference, key]) => member(reference, key)));
-    }
-    if (node.type !== "Identifier")
-        return Option.none();
-    return variableInScope(context.sourceCode.getScope(node), node.name).pipe(Option.flatMap((variable) => Array.head(variable.defs).pipe(Option.flatMap((definition) => {
-        if (definition.type === "ImportBinding" &&
-            definition.parent?.type === "ImportDeclaration" &&
-            definition.parent.importKind !== "type") {
-            const module = definition.parent.source.value;
-            if (module !== "alchemy" &&
-                !module.startsWith("alchemy/") &&
-                module !== "effect" &&
-                !module.startsWith("effect/"))
-                return Option.none();
-            const reference = { module, name: Option.none() };
-            if (definition.node.type === "ImportNamespaceSpecifier")
-                return Option.some(reference);
-            if (definition.node.type === "ImportSpecifier" &&
-                definition.node.importKind !== "type") {
-                return propertyName(definition.node.imported).pipe(Option.flatMap((name) => member(reference, name)));
-            }
-            return Option.none();
-        }
-        return constant(variable).pipe(Option.flatMap((declaration) => Option.fromNullishOr(declaration.init).pipe(Option.flatMap((initialiser) => {
-            if (declaration.id.type === "Identifier") {
-                return referenceOf(context, initialiser, next);
-            }
-            if (declaration.id.type !== "ObjectPattern")
-                return Option.none();
-            return Array.findFirst((property) => property.type === "Property" &&
-                property.value.type === "Identifier" &&
-                property.value.name === node.name &&
-                !property.computed)(declaration.id.properties).pipe(Option.flatMap((property) => property.type === "Property"
-                ? Option.all([
-                    referenceOf(context, initialiser, next),
-                    propertyName(property.key),
-                ]).pipe(Option.flatMap(([reference, key]) => member(reference, key)))
-                : Option.none()));
-        }))));
-    }))));
-};
-const valueOf = (context, node, visited = []) => {
-    if (Array.some(visited, (previous) => previous === node))
-        return Option.none();
-    const next = [...visited, node];
-    if (node.type === "TSAsExpression" || node.type === "TSSatisfiesExpression") {
-        return valueOf(context, node.expression, next);
-    }
-    if (node.type !== "Identifier")
-        return Option.some(node);
-    return variableInScope(context.sourceCode.getScope(node), node.name).pipe(Option.flatMap(constant), Option.filter((declaration) => declaration.id.type === "Identifier"), Option.flatMap((declaration) => Option.fromNullishOr(declaration.init)), Option.flatMap((initialiser) => valueOf(context, initialiser, next)));
-};
-const operation = (context, node, module, name) => referenceOf(context, node).pipe(Option.exists((reference) => (reference.module === module && Option.contains(reference.name, name)) ||
-    (reference.module === `${module}/${name}` && Option.isNone(reference.name))));
+import { operation, valueOf } from "./native-reference.js";
+import { propertyName } from "./syntax.js";
 const providerCall = (context, node, module, name) => valueOf(context, node).pipe(Option.filter((value) => value.type === "CallExpression"), Option.filter((value) => operation(context, value.callee, module, name)));
 const field = (node, name) => node.type === "ObjectExpression" &&
     Array.every((property) => property.type === "Property" && property.kind === "init" && !property.computed)(node.properties)

package/dist/config.d.ts

@@ -0,0 +1 @@
+export declare const noRedundantRuleRegistrations: import("@oxlint/plugins").Rule;

package/dist/config.js

@@ -0,0 +1,204 @@
+import { defineRule } from "@oxlint/plugins";
+import { Array, Option, Predicate, Record, Schema } from "effect";
+import { childNodes, propertyName, variableInScope } from "./syntax.js";
+const RuleId = Schema.String.check(Schema.isPattern(/^\S+$/u));
+const Options = Schema.Struct({
+    pairs: Schema.NonEmptyArray(Schema.Struct({ owner: RuleId, redundant: RuleId })),
+});
+// Resolve only a single-use const. Another read could expose the object to a
+// mutation or an opaque function before the configuration is consumed.
+const constantValue = (variable, reference) => Array.head(variable.defs).pipe(Option.filter(() => variable.defs.length === 1), Option.filter(() => Array.every(variable.references, (entry) => (entry.init && entry.isWrite()) || entry.identifier === reference)), Option.flatMap((definition) => {
+    if (definition.node.type === "VariableDeclarator" &&
+        definition.node.id.type === "Identifier" &&
+        definition.parent?.type === "VariableDeclaration" &&
+        definition.parent.kind === "const") {
+        return Option.fromNullishOr(definition.node.init);
+    }
+    return Option.none();
+}));
+const staticValue = (context, node, visited = []) => {
+    if (Array.some(visited, (previous) => previous === node))
+        return Option.none();
+    const next = [...visited, node];
+    if (node.type === "TSAsExpression" ||
+        node.type === "TSSatisfiesExpression" ||
+        node.type === "TSNonNullExpression") {
+        return staticValue(context, node.expression, next);
+    }
+    if (node.type === "Identifier") {
+        return variableInScope(context.sourceCode.getScope(node), node.name).pipe(Option.flatMap((variable) => Array.some(variable.defs, (definition) => definition.type === "ImportBinding")
+            ? Option.some(node)
+            : constantValue(variable, node).pipe(Option.flatMap((value) => staticValue(context, value, next)))));
+    }
+    return Option.some(node);
+};
+// Spreads and dynamic keys invalidate earlier facts. Later explicit properties
+// regain certainty; spread contents and other configuration scopes stay opaque.
+const staticProperties = (context, node) => staticValue(context, node).pipe(Option.filter((value) => value.type === "ObjectExpression"), Option.flatMap((value) => {
+    if (value.type !== "ObjectExpression")
+        return Option.none();
+    const empty = {};
+    return Option.some(Array.reduce(value.properties, empty, (known, entry) => {
+        if (entry.type !== "Property")
+            return empty;
+        const key = entry.computed
+            ? entry.key.type === "Literal" && Predicate.isString(entry.key.value)
+                ? Option.some(entry.key.value)
+                : Option.none()
+            : propertyName(entry.key);
+        return Option.match(key, {
+            onNone: () => empty,
+            onSome: (name) => Record.set(known, name, entry),
+        });
+    }));
+}));
+const importedConfig = (context, node, namespace) => {
+    if (node.type !== "Identifier")
+        return false;
+    return variableInScope(context.sourceCode.getScope(node), node.name).pipe(Option.flatMap((variable) => Array.head(variable.defs)), Option.exists((definition) => {
+        if (definition.type !== "ImportBinding" ||
+            definition.parent?.type !== "ImportDeclaration" ||
+            definition.parent.source.value !== "oxlint" ||
+            definition.parent.importKind === "type") {
+            return false;
+        }
+        if (namespace)
+            return definition.node.type === "ImportNamespaceSpecifier";
+        return (definition.node.type === "ImportSpecifier" &&
+            definition.node.importKind !== "type" &&
+            Option.contains(propertyName(definition.node.imported), "defineConfig"));
+    }));
+};
+const configFunction = (context, node) => {
+    if (importedConfig(context, node, false))
+        return true;
+    return staticValue(context, node).pipe(Option.exists((value) => {
+        if (importedConfig(context, value, false))
+            return true;
+        if (value.type !== "MemberExpression")
+            return false;
+        return ((!value.computed || value.property.type === "Literal") &&
+            Option.contains(propertyName(value.property), "defineConfig") &&
+            importedConfig(context, value.object, true));
+    }));
+};
+const descendants = (context, node) => [
+    node,
+    ...Array.flatMap(childNodes(context, node), (child) => descendants(context, child)),
+];
+const enabledSeverity = (node) => node.type === "Literal" &&
+    (node.value === "error" ||
+        node.value === "deny" ||
+        node.value === "warn" ||
+        node.value === 1 ||
+        node.value === 2);
+const enabled = (context, node) => staticValue(context, node).pipe(Option.exists((value) => {
+    if (value.type === "Literal") {
+        return enabledSeverity(value);
+    }
+    if (value.type === "ArrayExpression") {
+        return Array.head(value.elements).pipe(Option.flatMap(Option.fromNullishOr), Option.flatMap((first) => staticValue(context, first)), Option.exists(enabledSeverity));
+    }
+    return false;
+}));
+export const noRedundantRuleRegistrations = defineRule({
+    meta: {
+        type: "problem",
+        docs: {
+            description: "Reject explicitly configured redundant lint registrations when their owner is also enabled.",
+        },
+        schema: [
+            {
+                type: "object",
+                properties: {
+                    pairs: {
+                        type: "array",
+                        minItems: 1,
+                        items: {
+                            type: "object",
+                            properties: {
+                                owner: { type: "string", minLength: 1 },
+                                redundant: { type: "string", minLength: 1 },
+                            },
+                            required: ["owner", "redundant"],
+                            additionalProperties: false,
+                        },
+                    },
+                },
+                required: ["pairs"],
+                additionalProperties: false,
+            },
+        ],
+        messages: {
+            options: "Configure exact owner/redundant rule pairs whose overlap this consumer has verified.",
+            redundant: "{{redundant}} is redundant while {{owner}} is enabled in this rules object. Keep the verified owner.",
+        },
+    },
+    create(context) {
+        const options = Array.head(context.options).pipe(Option.flatMap(Schema.decodeUnknownOption(Options)));
+        const canonicalFile = /(?:^|\/)oxlint\.config\.[cm]?[jt]s$/u.test(context.filename.replaceAll("\\", "/"));
+        const inspect = (node) => {
+            Option.match(Option.all([options, staticProperties(context, node)]), {
+                onNone: () => { },
+                onSome: ([configuration, properties]) => {
+                    Array.forEach(Array.dedupeWith(configuration.pairs, (left, right) => left.owner === right.owner && left.redundant === right.redundant), ({ owner, redundant }) => {
+                        if (owner === redundant)
+                            return;
+                        const pair = Option.all([
+                            Record.get(properties, owner),
+                            Record.get(properties, redundant),
+                        ]);
+                        Option.match(pair, {
+                            onNone: () => { },
+                            onSome: ([ownerProperty, redundantProperty]) => {
+                                if (enabled(context, ownerProperty.value) &&
+                                    enabled(context, redundantProperty.value)) {
+                                    context.report({
+                                        node: redundantProperty,
+                                        messageId: "redundant",
+                                        data: { owner, redundant },
+                                    });
+                                }
+                            },
+                        });
+                    });
+                },
+            });
+        };
+        const inspectConfiguration = (node) => {
+            Option.match(staticProperties(context, node), {
+                onNone: () => { },
+                onSome: (properties) => {
+                    Option.match(Record.get(properties, "rules"), {
+                        onNone: () => { },
+                        onSome: (rules) => inspect(rules.value),
+                    });
+                    Record.get(properties, "overrides").pipe(Option.flatMap((overrides) => staticValue(context, overrides.value)), Option.filter((value) => value.type === "ArrayExpression"), Option.map((value) => {
+                        if (value.type === "ArrayExpression")
+                            Array.forEach(value.elements, (entry) => {
+                                if (entry)
+                                    inspectConfiguration(entry);
+                            });
+                    }));
+                },
+            });
+        };
+        return {
+            "Program:exit"(program) {
+                if (Option.isNone(options)) {
+                    context.report({ node: program, messageId: "options" });
+                    return;
+                }
+                const roots = Array.flatMap(descendants(context, program), (node) => {
+                    if (node.type === "CallExpression" && configFunction(context, node.callee)) {
+                        return Option.toArray(Array.head(node.arguments));
+                    }
+                    if (canonicalFile && node.type === "ExportDefaultDeclaration")
+                        return [node.declaration];
+                    return [];
+                });
+                Array.forEach(Array.dedupeWith(roots, (left, right) => left === right), inspectConfiguration);
+            },
+        };
+    },
+});

package/dist/index.d.ts

@@ -31,6 +31,8 @@ export declare const effect: {
         "effect/no-manual-tag": "error";
         "effect/no-raw-fetch": "error";
         "strict-effect/static-layers": "error";
+        "strict-effect/subprocess-pipe-capture": "error";
+        "strict-effect/no-runtime-type-assertions": "error";
         "strict-effect/no-unchecked-index": "error";
         "strict-effect/no-native-at": "error";
         "strict-effect/tagged-error-name": "error";

package/dist/index.js

@@ -36,6 +36,8 @@ export const effect = {
         "effect/no-manual-tag": "error",
         "effect/no-raw-fetch": "error",
         "strict-effect/static-layers": "error",
+        "strict-effect/subprocess-pipe-capture": "error",
+        "strict-effect/no-runtime-type-assertions": "error",
         "strict-effect/no-unchecked-index": "error",
         "strict-effect/no-native-at": "error",
         "strict-effect/tagged-error-name": "error",

package/dist/native-reference.d.ts

@@ -0,0 +1,5 @@
+import type { Context, ESTree, Variable } from "@oxlint/plugins";
+import * as Option from "effect/Option";
+export declare const constant: (variable: Variable) => Option.Option<ESTree.VariableDeclarator>;
+export declare const valueOf: (context: Context, node: ESTree.Node, visited?: readonly ESTree.Node[]) => Option.Option<ESTree.Node>;
+export declare const operation: (context: Context, node: ESTree.Node, module: string, name: string) => boolean;

package/dist/native-reference.js

@@ -0,0 +1,87 @@
+import * as Array from "effect/Array";
+import * as Option from "effect/Option";
+import { propertyName, variableInScope } from "./syntax.js";
+export const constant = (variable) => Array.head(variable.defs).pipe(Option.filter(() => variable.defs.length === 1), Option.filter(() => Array.every((reference) => !reference.isWrite() || reference.init)(variable.references)), Option.flatMap((definition) => definition.node.type === "VariableDeclarator" &&
+    definition.parent?.type === "VariableDeclaration" &&
+    definition.parent.kind === "const"
+    ? Option.some(definition.node)
+    : Option.none()));
+const member = (reference, name) => {
+    if (Option.isSome(reference.name))
+        return Option.none();
+    return reference.module === "alchemy" ||
+        reference.module === "effect" ||
+        (reference.module === "effect/process" &&
+            (name === "ChildProcess" || name === "ChildProcessSpawner"))
+        ? Option.some({ module: `${reference.module}/${name}`, name: Option.none() })
+        : Option.some({ ...reference, name: Option.some(name) });
+};
+// Only real imports and immutable local aliases count. The nearest declaration
+// prevents a shadowed parameter from borrowing an outer import's identity.
+const referenceOf = (context, node, visited = []) => {
+    if (Array.some(visited, (previous) => previous === node))
+        return Option.none();
+    const next = [...visited, node];
+    if (node.type === "TSAsExpression" || node.type === "TSSatisfiesExpression") {
+        return referenceOf(context, node.expression, next);
+    }
+    if (node.type === "MemberExpression") {
+        const name = node.computed
+            ? node.property.type === "Literal"
+                ? propertyName(node.property)
+                : Option.none()
+            : propertyName(node.property);
+        return Option.all([referenceOf(context, node.object, next), name]).pipe(Option.flatMap(([reference, key]) => member(reference, key)));
+    }
+    if (node.type !== "Identifier")
+        return Option.none();
+    return variableInScope(context.sourceCode.getScope(node), node.name).pipe(Option.flatMap((variable) => Array.head(variable.defs).pipe(Option.flatMap((definition) => {
+        if (definition.type === "ImportBinding" &&
+            definition.parent?.type === "ImportDeclaration" &&
+            definition.parent.importKind !== "type") {
+            const module = definition.parent.source.value;
+            if (module !== "alchemy" &&
+                !module.startsWith("alchemy/") &&
+                module !== "effect" &&
+                !module.startsWith("effect/"))
+                return Option.none();
+            const reference = { module, name: Option.none() };
+            if (definition.node.type === "ImportNamespaceSpecifier")
+                return Option.some(reference);
+            if (definition.node.type === "ImportSpecifier" &&
+                definition.node.importKind !== "type") {
+                return propertyName(definition.node.imported).pipe(Option.flatMap((name) => member(reference, name)));
+            }
+            return Option.none();
+        }
+        return constant(variable).pipe(Option.flatMap((declaration) => Option.fromNullishOr(declaration.init).pipe(Option.flatMap((initialiser) => {
+            if (declaration.id.type === "Identifier") {
+                return referenceOf(context, initialiser, next);
+            }
+            if (declaration.id.type !== "ObjectPattern")
+                return Option.none();
+            return Array.findFirst((property) => property.type === "Property" &&
+                property.value.type === "Identifier" &&
+                property.value.name === node.name &&
+                !property.computed)(declaration.id.properties).pipe(Option.flatMap((property) => property.type === "Property"
+                ? Option.all([
+                    referenceOf(context, initialiser, next),
+                    propertyName(property.key),
+                ]).pipe(Option.flatMap(([reference, key]) => member(reference, key)))
+                : Option.none()));
+        }))));
+    }))));
+};
+export const valueOf = (context, node, visited = []) => {
+    if (Array.some(visited, (previous) => previous === node))
+        return Option.none();
+    const next = [...visited, node];
+    if (node.type === "TSAsExpression" || node.type === "TSSatisfiesExpression") {
+        return valueOf(context, node.expression, next);
+    }
+    if (node.type !== "Identifier")
+        return Option.some(node);
+    return variableInScope(context.sourceCode.getScope(node), node.name).pipe(Option.flatMap(constant), Option.filter((declaration) => declaration.id.type === "Identifier"), Option.flatMap((declaration) => Option.fromNullishOr(declaration.init)), Option.flatMap((initialiser) => valueOf(context, initialiser, next)));
+};
+export const operation = (context, node, module, name) => referenceOf(context, node).pipe(Option.exists((reference) => (reference.module === module && Option.contains(reference.name, name)) ||
+    (reference.module === `${module}/${name}` && Option.isNone(reference.name))));

package/dist/package/workspace-import-boundaries.d.ts

@@ -0,0 +1 @@
+export declare const workspaceImportBoundariesRule: import("@oxlint/plugins").Rule;