@commonplaces/oxlint-plugin 0.1.2 → 0.3.0

package/dist/package/workspace-import-boundaries.js

@@ -0,0 +1,277 @@
+import { defineRule } from "@oxlint/plugins";
+import { Array, Number, Option, Predicate, Record, Schema } from "effect";
+import { variableInScope } from "../syntax.js";
+// A checked manifest consumer selects export conditions before configuring this
+// pure rule. A false entry preserves a manifest's explicit null export fence.
+const Options = Schema.Struct({
+    owners: Schema.Array(Schema.Struct({ id: Schema.String, root: Schema.String })),
+    workspaces: Schema.Array(Schema.Struct({
+        name: Schema.String,
+        owner: Schema.String,
+        exports: Schema.Record(Schema.String, Schema.Boolean),
+    })),
+    workspacePrefixes: Schema.Array(Schema.String),
+    forbiddenEdges: Schema.Array(Schema.Struct({ from: Schema.String, to: Schema.String })),
+    exceptions: Schema.Array(Schema.Struct({ fromFile: Schema.String, toModule: Schema.String })),
+    aliases: Schema.Array(Schema.Struct({ prefix: Schema.String, root: Schema.String })),
+});
+const normalise = (path) => path.replaceAll("\\", "/");
+const inside = (path, root) => root === "." || path === root || path.startsWith(`${root}/`);
+const cleanPath = (path) => path.length > 0 &&
+    !/[\\:*?#%]/u.test(path) &&
+    !path.includes("\u0000") &&
+    !path.startsWith("/") &&
+    Array.every(path.split("/"), (part) => part.length > 0 && part !== "." && part !== "..");
+const rootPath = (path) => path === "." || cleanPath(path);
+const packageName = (name) => /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u.test(name);
+const unique = (values) => Array.dedupe(values).length === values.length;
+const ownerAt = (options, path) => Array.head(Array.sort(Array.filter(options.owners, ({ root }) => inside(path, root)), (left, right) => Number.Order(right.root === "." ? 0 : right.root.length, left.root === "." ? 0 : left.root.length)));
+const exportKey = (key) => key === "." ||
+    (key.startsWith("./") &&
+        key.split("*").length <= 2 &&
+        cleanPath(key.slice(2).replace("*", "pattern")));
+const validSubpath = (key) => key === "." ||
+    (key.startsWith("./") &&
+        cleanPath(key.slice(2)) &&
+        !Array.contains(key.slice(2).split("/"), "node_modules"));
+const patternMatch = (pattern, key) => {
+    const star = pattern.indexOf("*");
+    return (star >= 0 &&
+        key.startsWith(pattern.slice(0, star)) &&
+        key.endsWith(pattern.slice(star + 1)) &&
+        key.length >= pattern.length - 1);
+};
+const exported = (exports, key) => {
+    if (!validSubpath(key))
+        return false;
+    return Record.get(exports, key).pipe(Option.orElse(() => Array.head(Array.sort(Array.filter(Record.keys(exports), (pattern) => patternMatch(pattern, key)), (left, right) => Number.Order(right.indexOf("*"), left.indexOf("*")) ||
+        Number.Order(right.length, left.length))).pipe(Option.flatMap((pattern) => Record.get(exports, pattern)))), Option.getOrElse(() => false));
+};
+const workspaceAt = (options, address) => Array.findFirst(options.workspaces, ({ name }) => address === name || address.startsWith(`${name}/`));
+const publicAddress = (options, address) => Option.exists(workspaceAt(options, address), (workspace) => exported(workspace.exports, address === workspace.name ? "." : `.${address.slice(workspace.name.length)}`));
+const validOptions = (options) => Array.some(options.owners, ({ root }) => root === ".") &&
+    unique(Array.map(options.owners, ({ id }) => id)) &&
+    unique(Array.map(options.owners, ({ root }) => root)) &&
+    Array.every(options.owners, ({ id, root }) => id.length > 0 && rootPath(root)) &&
+    unique(Array.map(options.workspaces, ({ name }) => name)) &&
+    unique(Array.map(options.workspaces, ({ owner }) => owner)) &&
+    Array.every(options.workspaces, (workspace) => packageName(workspace.name) &&
+        Array.some(options.owners, ({ id }) => id === workspace.owner) &&
+        Array.every(Record.keys(workspace.exports), exportKey)) &&
+    unique(options.workspacePrefixes) &&
+    Array.every(options.workspacePrefixes, (prefix) => /^@[a-z0-9][a-z0-9._-]*\/$/u.test(prefix) || packageName(prefix)) &&
+    unique(Array.map(options.forbiddenEdges, ({ from, to }) => `${from}\u0000${to}`)) &&
+    Array.every(options.forbiddenEdges, ({ from, to }) => from !== to &&
+        Array.every([from, to], (endpoint) => Array.some(options.owners, ({ id }) => id === endpoint))) &&
+    unique(Array.map(options.aliases, ({ prefix }) => prefix)) &&
+    Array.every(options.aliases, ({ prefix, root }) => prefix.endsWith("/") &&
+        (prefix === "#/" || cleanPath(prefix.slice(0, -1))) &&
+        rootPath(root) &&
+        !Array.some(options.workspaces, ({ name }) => name.startsWith(prefix) || prefix.startsWith(`${name}/`))) &&
+    unique(Array.map(options.exceptions, ({ fromFile, toModule }) => `${fromFile}\u0000${toModule}`)) &&
+    Array.every(options.exceptions, ({ fromFile, toModule }) => cleanPath(fromFile) &&
+        publicAddress(options, toModule) &&
+        Option.exists(Option.all([ownerAt(options, fromFile), workspaceAt(options, toModule)]), ([from, to]) => Array.some(options.forbiddenEdges, (edge) => edge.from === from.id && edge.to === to.owner)));
+// Scope-aware immutable string aliases only; no evaluation or type resolution.
+const moduleAddress = (context, node, visited = []) => {
+    if (visited.length >= 64 || Array.some(visited, (previous) => previous === node))
+        return Option.none();
+    const next = [...visited, node];
+    if (node.type === "Literal" && Predicate.isString(node.value))
+        return Option.some(node.value);
+    if (node.type === "TemplateLiteral") {
+        return Option.all(Array.map(node.quasis, (quasi, index) => Option.all([
+            Option.fromNullishOr(quasi.value.cooked),
+            Array.get(node.expressions, index).pipe(Option.match({
+                onNone: () => Option.some(""),
+                onSome: (expression) => moduleAddress(context, expression, next),
+            })),
+        ]).pipe(Option.map(([text, expression]) => text + expression)))).pipe(Option.map(Array.join("")));
+    }
+    if (node.type === "BinaryExpression" && node.operator === "+") {
+        return Option.all([
+            moduleAddress(context, node.left, next),
+            moduleAddress(context, node.right, next),
+        ]).pipe(Option.map(([left, right]) => left + right));
+    }
+    if (node.type !== "Identifier")
+        return Option.none();
+    return variableInScope(context.sourceCode.getScope(node), node.name).pipe(Option.filter((variable) => variable.defs.length === 1 &&
+        Array.every(variable.references, (reference) => !reference.isWrite() || reference.init)), Option.flatMap((variable) => Array.head(variable.defs)), Option.flatMap((definition) => definition.node.type === "VariableDeclarator" &&
+        definition.node.id.type === "Identifier" &&
+        definition.parent?.type === "VariableDeclaration" &&
+        definition.parent.kind === "const"
+        ? Option.fromNullishOr(definition.node.init)
+        : Option.none()), Option.flatMap((initialiser) => moduleAddress(context, initialiser, next)));
+};
+const resolvePath = (base, address) => Array.join(Array.reduce(address.split("/"), base === "." || base === "" ? [] : base.split("/"), (parts, part) => part === ".."
+    ? parts.length === 0 || Option.contains(Array.last(parts), "..")
+        ? [...parts, ".."]
+        : Array.dropRight(parts, 1)
+    : part === "." || part === ""
+        ? parts
+        : [...parts, part]), "/");
+const relativeFile = (filename, cwd) => {
+    const file = normalise(filename);
+    const root = normalise(cwd).replace(/\/$/u, "");
+    return file.startsWith(`${root}/`) ? Option.some(file.slice(root.length + 1)) : Option.none();
+};
+const fileAddress = (address) => address.replace(/[?#].*$/u, "");
+const forbidden = (options, file, rawAddress, cwd) => {
+    const address = normalise(rawAddress);
+    const from = ownerAt(options, file);
+    const alias = Array.head(Array.sort(Array.filter(options.aliases, ({ prefix }) => address.startsWith(prefix)), (left, right) => Number.Order(right.prefix.length, left.prefix.length)));
+    if (Option.isSome(alias)) {
+        const target = resolvePath(alias.value.root, fileAddress(address.slice(alias.value.prefix.length)));
+        return (!cleanPath(target) ||
+            !inside(target, alias.value.root) ||
+            !Option.exists(Option.all([from, ownerAt(options, target)]), ([a, b]) => a.id === b.id));
+    }
+    if (address.startsWith(".") ||
+        address.startsWith("/") ||
+        /^[a-z]:\//iu.test(address) ||
+        address.startsWith("file:")) {
+        const target = address.startsWith(".")
+            ? Option.some(resolvePath(Array.join(Array.dropRight(file.split("/"), 1), "/"), fileAddress(address)))
+            : relativeFile(fileAddress(address), cwd).pipe(Option.map((path) => resolvePath(".", path)));
+        return !Option.exists(target, (path) => cleanPath(path) &&
+            Option.exists(Option.all([from, ownerAt(options, path)]), ([a, b]) => a.id === b.id));
+    }
+    return Option.match(workspaceAt(options, address), {
+        onNone: () => Array.some(options.workspacePrefixes, (prefix) => prefix.endsWith("/")
+            ? address.startsWith(prefix)
+            : address === prefix || address.startsWith(`${prefix}/`)),
+        onSome: (workspace) => !publicAddress(options, address) ||
+            (Option.exists(from, (owner) => Array.some(options.forbiddenEdges, (edge) => edge.from === owner.id && edge.to === workspace.owner)) &&
+                !Array.some(options.exceptions, (exception) => exception.fromFile === file && exception.toModule === address)),
+    });
+};
+export const workspaceImportBoundariesRule = defineRule({
+    meta: {
+        type: "problem",
+        docs: {
+            description: "Enforce checked workspace exports, owner edges and exact public-import exceptions.",
+        },
+        schema: [
+            {
+                type: "object",
+                additionalProperties: false,
+                required: [
+                    "owners",
+                    "workspaces",
+                    "workspacePrefixes",
+                    "forbiddenEdges",
+                    "exceptions",
+                    "aliases",
+                ],
+                properties: {
+                    owners: {
+                        type: "array",
+                        items: {
+                            type: "object",
+                            additionalProperties: false,
+                            required: ["id", "root"],
+                            properties: { id: { type: "string" }, root: { type: "string" } },
+                        },
+                    },
+                    workspaces: {
+                        type: "array",
+                        items: {
+                            type: "object",
+                            additionalProperties: false,
+                            required: ["name", "owner", "exports"],
+                            properties: {
+                                name: { type: "string" },
+                                owner: { type: "string" },
+                                exports: { type: "object", additionalProperties: { type: "boolean" } },
+                            },
+                        },
+                    },
+                    workspacePrefixes: { type: "array", items: { type: "string" } },
+                    forbiddenEdges: {
+                        type: "array",
+                        items: {
+                            type: "object",
+                            additionalProperties: false,
+                            required: ["from", "to"],
+                            properties: { from: { type: "string" }, to: { type: "string" } },
+                        },
+                    },
+                    exceptions: {
+                        type: "array",
+                        items: {
+                            type: "object",
+                            additionalProperties: false,
+                            required: ["fromFile", "toModule"],
+                            properties: { fromFile: { type: "string" }, toModule: { type: "string" } },
+                        },
+                    },
+                    aliases: {
+                        type: "array",
+                        items: {
+                            type: "object",
+                            additionalProperties: false,
+                            required: ["prefix", "root"],
+                            properties: { prefix: { type: "string" }, root: { type: "string" } },
+                        },
+                    },
+                },
+            },
+        ],
+        messages: {
+            options: "Supply valid checked workspace contracts, anchored owners and exact exceptions; boundary configuration is missing or inconsistent.",
+            boundary: "Use an allowed public workspace export. Direct owner crossings, private exports and forbidden owner edges are denied.",
+        },
+    },
+    create(context) {
+        const options = Array.head(context.options).pipe(Option.flatMap(Schema.decodeUnknownOption(Options, { onExcessProperty: "error" })), Option.filter(validOptions));
+        const file = relativeFile(context.filename, context.cwd);
+        const inspect = (node, source) => {
+            if (Option.isNone(options) || Option.isNone(file))
+                return;
+            Option.match(moduleAddress(context, source), {
+                onNone: () => undefined,
+                onSome: (address) => {
+                    if (forbidden(options.value, file.value, address, context.cwd))
+                        context.report({ node, messageId: "boundary" });
+                },
+            });
+        };
+        return {
+            Program(node) {
+                if (context.options.length !== 1 || Option.isNone(options) || Option.isNone(file))
+                    context.report({ node, messageId: "options" });
+            },
+            ImportDeclaration(node) {
+                inspect(node, node.source);
+            },
+            ImportExpression(node) {
+                inspect(node, node.source);
+            },
+            ExportNamedDeclaration(node) {
+                if (node.source)
+                    inspect(node, node.source);
+            },
+            ExportAllDeclaration(node) {
+                inspect(node, node.source);
+            },
+            TSImportType(node) {
+                inspect(node, node.source);
+            },
+            TSImportEqualsDeclaration(node) {
+                if (node.moduleReference.type === "TSExternalModuleReference")
+                    inspect(node, node.moduleReference.expression);
+            },
+            CallExpression(node) {
+                if (node.callee.type === "Identifier" &&
+                    node.callee.name === "require" &&
+                    Option.isNone(variableInScope(context.sourceCode.getScope(node), "require"))) {
+                    Option.match(Array.head(node.arguments), {
+                        onNone: () => undefined,
+                        onSome: (source) => inspect(node, source),
+                    });
+                }
+            },
+        };
+    },
+});

package/dist/package.d.ts

@@ -4,6 +4,8 @@ declare const _default: {
     };
     rules: {
         "no-cross-package-source-imports": import("@oxlint/plugins").Rule;
+        "workspace-import-boundaries": import("@oxlint/plugins").Rule;
+        "no-redundant-rule-registrations": import("@oxlint/plugins").Rule;
     };
 };
 export default _default;

package/dist/package.js

@@ -1,5 +1,7 @@
 import { defineRule } from "@oxlint/plugins";
 import { Array, Option, Predicate } from "effect";
+import { workspaceImportBoundariesRule } from "./package/workspace-import-boundaries.js";
+import { noRedundantRuleRegistrations } from "./config.js";
 const resolveRelative = (fileName, specifier) => Array.join(Array.reduce(specifier.split("/"), Array.dropRight(fileName.split("/"), 1), (segments, segment) => segment === ".."
     ? Array.dropRight(segments, 1)
     : segment === "." || segment.length === 0
@@ -46,5 +48,7 @@ export default {
     meta: { name: "package" },
     rules: {
         "no-cross-package-source-imports": noCrossPackageSourceImports,
+        "workspace-import-boundaries": workspaceImportBoundariesRule,
+        "no-redundant-rule-registrations": noRedundantRuleRegistrations,
     },
 };

package/dist/strict-effect.js

@@ -1,3 +1,4 @@
+import { subprocessPipeCapture } from "./subprocess-pipe-capture.js";
 import { defineRule, eslintCompatPlugin } from "@oxlint/plugins";
 import * as Array from "effect/Array";
 import * as Function from "effect/Function";
@@ -720,6 +721,7 @@ const scopedImportedReference = (context, expression, visited = [], acceptsModul
             }
             if (declaration.id.type === "ObjectPattern") {
                 return Array.findFirst((property) => property.type === "Property" &&
+                    (!property.computed || property.key.type === "Literal") &&
                     property.value.type === "Identifier" &&
                     property.value.name === name)(declaration.id.properties).pipe(Option.flatMap((property) => {
                     if (property.type === "Property") {
@@ -1797,6 +1799,61 @@ const websiteDataProxy = defineRule({
 // Structure ownership: facts with one owner may be written only in that owner.
 // Owner paths are exact and relative to Oxlint's working directory.
 const testFile = (filename) => /\.(?:test|spec)\.[cm]?[jt]sx?$/u.test(filename);
+const vitestModule = (source) => source === "vitest" || source === "@effect/vitest";
+// Keep lexical import provenance through immutable aliases, including static
+// assertion members. Unknown, shadowed and reassigned bindings are not trusted.
+const testReference = (context, node, visited = []) => {
+    if (Array.some(visited, (previous) => previous === node))
+        return Option.none();
+    const next = [...visited, node];
+    const imported = scopedImportedReference(context, node, [], vitestModule);
+    if (Option.isSome(imported)) {
+        return Option.some({ path: Option.toArray(imported.value.name) });
+    }
+    if (node.type === "MemberExpression" && (!node.computed || node.property.type === "Literal")) {
+        return Option.all([
+            testReference(context, node.object, next),
+            propertyName(node.property),
+        ]).pipe(Option.map(([reference, name]) => ({ path: [...reference.path, name] })));
+    }
+    if (node.type !== "Identifier")
+        return Option.none();
+    return scopedVariable(context.sourceCode.getScope(node), node.name).pipe(Option.flatMap(constantDeclaration), Option.flatMap((declaration) => Option.fromNullishOr(declaration.init).pipe(Option.flatMap((initialiser) => testReference(context, initialiser, next)), Option.flatMap((reference) => {
+        if (declaration.id.type === "Identifier")
+            return Option.some(reference);
+        if (declaration.id.type !== "ObjectPattern")
+            return Option.none();
+        return Array.findFirst(declaration.id.properties, (property) => property.type === "Property" &&
+            (!property.computed || property.key.type === "Literal") &&
+            property.value.type === "Identifier" &&
+            property.value.name === node.name).pipe(Option.flatMap((property) => {
+            if (property.type === "Property")
+                return propertyName(property.key);
+            return Option.none();
+        }), Option.map((name) => ({ path: [...reference.path, name] })));
+    }))));
+};
+const noRuntimeTypeAssertions = defineRule({
+    meta: {
+        type: "problem",
+        schema: [],
+        messages: {
+            typeAssertion: "Move compile-only type assertions to a .typecheck.ts or .test-d.ts file checked by TypeScript; runtime tests must exercise behaviour.",
+        },
+    },
+    create(context) {
+        if (!testFile(context.filename))
+            return {};
+        return {
+            CallExpression(node) {
+                if (Option.exists(testReference(context, node.callee), ({ path }) => path.length === 1 &&
+                    Array.some(path, (name) => name === "expectTypeOf" || name === "assertType"))) {
+                    context.report({ node, messageId: "typeAssertion" });
+                }
+            },
+        };
+    },
+});
 const ownedBy = (context, files) => Array.some(files, (file) => exactOwnedFile(context.filename, context.cwd, file));
 const ownerFilesSchema = { type: "array", items: { type: "string", minLength: 1 } };
 const escapePattern = (text) => text.replaceAll(/[.*+?^${}()|[\]\\/]/gu, "\\$&");
@@ -1832,7 +1889,98 @@ const PublicHostOptions = Schema.Struct({
     hosts: Schema.Array(Schema.String),
     allowedFiles: Schema.Array(Schema.String),
     allowTestFiles: Schema.Boolean,
+    allowTestAssertions: Schema.optionalKey(Schema.Boolean),
+    allowedDeclarations: Schema.optionalKey(Schema.Array(Schema.Struct({ file: Schema.String, names: Schema.Array(Schema.String) }))),
 });
+const topLevelConstant = (node) => {
+    const parent = node.parent;
+    if (!parent)
+        return Option.none();
+    if (parent.type === "ArrowFunctionExpression" ||
+        parent.type === "FunctionExpression" ||
+        parent.type === "FunctionDeclaration")
+        return Option.none();
+    if (parent.type !== "VariableDeclarator")
+        return topLevelConstant(parent);
+    if (parent.init !== node || parent.id.type !== "Identifier")
+        return Option.none();
+    const declaration = parent.parent;
+    if (declaration?.type !== "VariableDeclaration" || declaration.kind !== "const") {
+        return Option.none();
+    }
+    const statement = declaration.parent;
+    if (statement?.type === "Program" ||
+        (statement?.type === "ExportNamedDeclaration" && statement.parent.type === "Program"))
+        return Option.some(parent.id.name);
+    return Option.none();
+};
+const expectedMatchers = [
+    "toBe",
+    "toEqual",
+    "toStrictEqual",
+    "toMatchObject",
+    "toContain",
+    "toContainEqual",
+    "toMatch",
+];
+const expectedAssertions = [
+    "equal",
+    "notEqual",
+    "strictEqual",
+    "notStrictEqual",
+    "deepEqual",
+    "notDeepEqual",
+    "deepStrictEqual",
+    "notDeepStrictEqual",
+    "include",
+    "notInclude",
+    "deepInclude",
+    "notDeepInclude",
+    "match",
+    "notMatch",
+];
+const importedExpectation = (context, node) => {
+    if (node.type === "CallExpression") {
+        return Option.exists(testReference(context, node.callee), ({ path }) => (path.length === 1 && Array.contains(path, "expect")) ||
+            (path.length === 2 &&
+                Option.contains(Array.head(path), "expect") &&
+                Option.contains(Array.get(path, 1), "soft")));
+    }
+    return (node.type === "MemberExpression" &&
+        (!node.computed || node.property.type === "Literal") &&
+        Option.exists(propertyName(node.property), (name) => Array.contains(["not", "resolves", "rejects"], name)) &&
+        importedExpectation(context, node.object));
+};
+// Only static expected-value data is exempt. A call or constructor between a
+// literal and the assertion is setup/computation, even inside an expected arg.
+const assertionExpectedValue = (context, node) => {
+    const parent = node.parent;
+    if (!parent)
+        return false;
+    if (parent.type === "CallExpression") {
+        const expected = Array.get(parent.arguments, 1);
+        if (Option.exists(expected, (argument) => argument === node) &&
+            Option.exists(testReference(context, parent.callee), ({ path }) => path.length === 2 &&
+                Option.contains(Array.head(path), "assert") &&
+                Option.exists(Array.get(path, 1), (name) => Array.contains(expectedAssertions, name))))
+            return true;
+        return (parent.callee.type === "MemberExpression" &&
+            (!parent.callee.computed || parent.callee.property.type === "Literal") &&
+            Option.exists(Array.head(parent.arguments), (argument) => argument === node) &&
+            Option.exists(propertyName(parent.callee.property), (name) => Array.contains(expectedMatchers, name)) &&
+            importedExpectation(context, parent.callee.object));
+    }
+    if (parent.type === "ArrayExpression" ||
+        parent.type === "ObjectExpression" ||
+        parent.type === "TemplateLiteral" ||
+        (parent.type === "Property" &&
+            parent.kind === "init" &&
+            !parent.method &&
+            (parent.value === node ||
+                (parent.key === node && (!parent.computed || node.type === "Literal")))))
+        return assertionExpectedValue(context, parent);
+    return false;
+};
 // A configured host or any subdomain of it, as a whole hostname.
 const hostPattern = (host) => new RegExp(`(?:^|[^a-z0-9-])(?:[a-z0-9-]+\\.)*${escapePattern(host)}(?![a-z0-9-])`, "iu");
 const publicHostLiterals = defineRule({
@@ -1849,6 +1997,16 @@ const publicHostLiterals = defineRule({
                     },
                     allowedFiles: ownerFilesSchema,
                     allowTestFiles: { type: "boolean" },
+                    allowTestAssertions: { type: "boolean" },
+                    allowedDeclarations: {
+                        type: "array",
+                        items: {
+                            type: "object",
+                            properties: { file: { type: "string", minLength: 1 }, names: ownerFilesSchema },
+                            required: ["file", "names"],
+                            additionalProperties: false,
+                        },
+                    },
                 },
                 required: ["hosts", "allowedFiles", "allowTestFiles"],
                 additionalProperties: false,
@@ -1860,16 +2018,24 @@ const publicHostLiterals = defineRule({
     },
     create(context) {
         const options = Array.head(context.options).pipe(Option.flatMap(Schema.decodeUnknownOption(PublicHostOptions)));
-        if (Option.isNone(options) ||
-            ownedBy(context, options.value.allowedFiles) ||
-            (options.value.allowTestFiles && testFile(context.filename))) {
+        if (Option.isNone(options) || (options.value.allowTestFiles && testFile(context.filename))) {
             return {};
         }
+        const declarationOwner = Array.findFirst(options.value.allowedDeclarations ?? [], ({ file }) => ownedBy(context, [file]));
+        const fileOwner = ownedBy(context, options.value.allowedFiles);
+        if (fileOwner && Option.isNone(declarationOwner))
+            return {};
         const patterns = Array.map(options.value.hosts, (host) => [
             host,
             hostPattern(host),
         ]);
         return textVisitors((node, text) => {
+            if ((fileOwner &&
+                Option.exists(declarationOwner, ({ names }) => Option.exists(topLevelConstant(node), (name) => Array.contains(names, name)))) ||
+                (options.value.allowTestAssertions === true &&
+                    testFile(context.filename) &&
+                    assertionExpectedValue(context, node)))
+                return;
             Option.match(Array.findFirst(patterns, ([, pattern]) => pattern.test(text)), {
                 onNone: Function.constVoid,
                 onSome: ([host]) => {
@@ -2357,6 +2523,7 @@ export default eslintCompatPlugin({
         "no-native-client-replica": noNativeClientReplica,
         "website-rpc-boundary": websiteRpcBoundary,
         "static-layers": staticLayers,
+        "subprocess-pipe-capture": subprocessPipeCapture,
         "no-unchecked-index": noUncheckedIndex,
         "no-native-at": noNativeAt,
         "runtime-file-convention": runtimeFileConvention,
@@ -2368,6 +2535,7 @@ export default eslintCompatPlugin({
         "no-unchecked-json": noUncheckedJson,
         "no-runtime-outside-boundary": noRuntimeOutsideBoundary,
         "no-native-work": noNativeWork,
+        "no-runtime-type-assertions": noRuntimeTypeAssertions,
         "no-imperative-collections": noImperativeCollections,
         "public-host-literals": publicHostLiterals,
         "route-literal-ownership": routeLiteralOwnership,

package/dist/subprocess-capture-dataflow.d.ts

@@ -0,0 +1,10 @@
+import type { Context, ESTree } from "@oxlint/plugins";
+import { Option } from "effect";
+export type Channel = "exitCode" | "stdout" | "stderr";
+export interface Capture {
+    readonly handle: ESTree.Node;
+    readonly channel: Channel;
+}
+export declare const memberName: (node: ESTree.MemberExpression) => Option.None<string> | Option.Some<string>;
+export declare const nonPipe: (context: Context, handle: ESTree.Node, channel: Channel) => boolean;
+export declare const channelMember: (context: Context, expression: ESTree.Node, visited?: readonly ESTree.Node[]) => Option.Option<Capture>;

package/dist/subprocess-capture-dataflow.js

@@ -0,0 +1,56 @@
+import { Array, Option } from "effect";
+import { constant, operation, valueOf } from "./native-reference.js";
+import { propertyName, variableInScope } from "./syntax.js";
+export const memberName = (node) => node.computed && node.property.type !== "Literal" ? Option.none() : propertyName(node.property);
+// A type annotation or a lookalike spawn method never establishes provider identity.
+const processHandle = (context, expression) => valueOf(context, expression).pipe(Option.filter((node) => node.type === "YieldExpression"), Option.filter((node) => node.delegate), Option.flatMap((node) => Option.fromNullishOr(node.argument)), Option.filter((node) => node.type === "CallExpression"), Option.filter((node) => node.callee.type === "MemberExpression" &&
+    Option.contains(memberName(node.callee), "spawn")), Option.filter((node) => node.callee.type === "MemberExpression" &&
+    valueOf(context, node.callee.object).pipe(Option.filter((value) => value.type === "YieldExpression"), Option.filter((value) => value.delegate), Option.flatMap((value) => Option.fromNullishOr(value.argument)), Option.exists((service) => operation(context, service, "effect/process/ChildProcessSpawner", "ChildProcessSpawner")))));
+const field = (context, expression, name) => valueOf(context, expression).pipe(Option.filter((node) => node.type === "ObjectExpression"), Option.filter((node) => Array.every(node.properties, (property) => property.type === "Property" &&
+    property.kind === "init" &&
+    !property.computed &&
+    !Option.contains(propertyName(property.key), "__proto__"))), Option.flatMap((node) => Array.findLast(node.properties, (property) => property.type === "Property" && Option.contains(propertyName(property.key), name))), Option.filter((property) => property.type === "Property"), Option.flatMap((property) => valueOf(context, property.value)));
+export const nonPipe = (context, handle, channel) => {
+    if (channel === "exitCode" || handle.type !== "CallExpression")
+        return false;
+    const command = Array.head(handle.arguments).pipe(Option.flatMap((node) => valueOf(context, node)));
+    const options = command.pipe(Option.flatMap((node) => {
+        if (node.type === "TaggedTemplateExpression" &&
+            node.tag.type === "CallExpression" &&
+            operation(context, node.tag.callee, "effect/process/ChildProcess", "make"))
+            return Array.head(node.tag.arguments);
+        if (node.type !== "CallExpression" ||
+            !operation(context, node.callee, "effect/process/ChildProcess", "make"))
+            return Option.none();
+        return Array.get(node.arguments, 1).pipe(Option.flatMap((second) => valueOf(context, second)), Option.flatMap((second) => second.type === "ObjectExpression"
+            ? Option.some(second)
+            : second.type === "ArrayExpression"
+                ? Array.get(node.arguments, 2)
+                : Option.none()));
+    }));
+    return options.pipe(Option.flatMap((node) => field(context, node, channel)), Option.flatMap((node) => node.type === "ObjectExpression" ? field(context, node, "stream") : Option.some(node)), Option.exists((node) => node.type === "Literal" && (node.value === "inherit" || node.value === "ignore")));
+};
+export const channelMember = (context, expression, visited = []) => {
+    if (Array.some(visited, (node) => node === expression))
+        return Option.none();
+    const next = [...visited, expression];
+    if (expression.type === "Identifier") {
+        const declaration = variableInScope(context.sourceCode.getScope(expression), expression.name).pipe(Option.flatMap(constant));
+        return declaration.pipe(Option.flatMap((node) => {
+            if (node.id.type === "Identifier")
+                return Option.fromNullishOr(node.init).pipe(Option.flatMap((initialiser) => channelMember(context, initialiser, next)));
+            if (node.id.type !== "ObjectPattern" || !node.init)
+                return Option.none();
+            const handle = processHandle(context, node.init);
+            return Array.findFirst(node.id.properties, (property) => property.type === "Property" &&
+                !property.computed &&
+                property.value.type === "Identifier" &&
+                property.value.name === expression.name).pipe(Option.filter((property) => property.type === "Property"), Option.flatMap((property) => propertyName(property.key)), Option.filter((name) => name === "exitCode" || name === "stdout" || name === "stderr"), Option.flatMap((channel) => Option.map(handle, (process) => ({ handle: process, channel }))));
+        }));
+    }
+    if (expression.type === "TSAsExpression" || expression.type === "TSSatisfiesExpression")
+        return channelMember(context, expression.expression, next);
+    if (expression.type !== "MemberExpression")
+        return Option.none();
+    return memberName(expression).pipe(Option.filter((name) => name === "exitCode" || name === "stdout" || name === "stderr"), Option.flatMap((channel) => Option.map(processHandle(context, expression.object), (handle) => ({ handle, channel }))));
+};

package/dist/subprocess-pipe-capture.d.ts

@@ -0,0 +1 @@
+export declare const subprocessPipeCapture: import("@oxlint/plugins").Rule;