@fabriziosalmi/slopless 1.16.0 → 1.17.1

package/package.json

@@ -1,11 +1,27 @@
 {
   "name": "@fabriziosalmi/slopless",
-  "version": "1.16.0",
+  "version": "1.17.1",
   "description": "",
-  "main": "dist/index.js",
+  "main": "dist/engine/api.js",
+  "types": "dist/engine/api.d.ts",
   "bin": {
     "slopless": "dist/index.js"
   },
+  "exports": {
+    ".": {
+      "types": "./dist/engine/api.d.ts",
+      "default": "./dist/engine/api.js"
+    },
+    "./dist/engine/api": {
+      "types": "./dist/engine/api.d.ts",
+      "default": "./dist/engine/api.js"
+    },
+    "./dist/engine/api.js": {
+      "types": "./dist/engine/api.d.ts",
+      "default": "./dist/engine/api.js"
+    },
+    "./package.json": "./package.json"
+  },
   "files": [
     "dist",
     "rules"
@@ -20,8 +36,9 @@
     "docs:build": "npm run docs:gen && vitepress build docs",
     "docs:preview": "vitepress preview docs",
     "verify:bundle": "node scripts/verify-bundle.js",
+    "verify:rules": "node scripts/check-rule-performance.js",
     "verify:action": "bash scripts/run-action-locally.sh . 'src/**/*.ts'",
-    "release:prep": "npm run docs:gen && npm run build && npm test && npm run verify:bundle",
+    "release:prep": "npm run docs:gen && npm run build && npm test && npm run verify:rules && npm run verify:bundle",
     "version": "node scripts/check-changelog.js && node scripts/sync-versions.js && npm run docs:gen && npm run build && git add dist docs README.md packages/*/package.json"
   },
   "keywords": [

package/rules/VBC-010.yaml

@@ -6,7 +6,11 @@ tags:
   - accessibility
   - html
 match:
-  regex: <div[^>]*\s(onclick|onClick)=(?!\{?\s*\(?\s*(?:e|ev|evt|event|_e)\s*\)?\s*=>\s*\{?\s*(?:e|ev|evt|event|_e)\.(?:stopPropagation|preventDefault)\(\)\s*\}?\s*\})
+  # `[^>]{0,2000}` rather than `[^>]*`: in markup with no closing `>` the
+  # unbounded form scanned to the end of the file from every `<div`, which is
+  # quadratic — 13ms at 15KB, 767ms at 120KB. An opening tag's attribute list is
+  # not 2,000 characters long, and exceeding it costs a missed finding.
+  regex: <div[^>]{0,2000}\s(onclick|onClick)=(?!\{?\s*\(?\s*(?:e|ev|evt|event|_e)\s*\)?\s*=>\s*\{?\s*(?:e|ev|evt|event|_e)\.(?:stopPropagation|preventDefault)\(\)\s*\}?\s*\})
   file_types:
     - html
     - js

package/rules/VBC-017-B.yaml

@@ -8,7 +8,10 @@ tags:
 match:
   # `.only` is the dangerous one: the suite still passes, having run one test.
   # A skipped test is at least visibly skipped.
-  regex: \b(?:describe|it|test|context|suite)\.only\s*\(|^\s*(?:fdescribe|fit)\s*\(
+  # `^[ \t]*`, not `^\s*`: with `m` every line start is a match position and
+  # `\s*` there swallows the newlines after it, which is quadratic on a file of
+  # blank lines. Indentation before `fit(` is horizontal whitespace.
+  regex: \b(?:describe|it|test|context|suite)\.only\s*\(|^[ \t]*(?:fdescribe|fit)\s*\(
   flags: m
   scan: code
   file_types:

package/rules/VBC-035.yaml

@@ -8,8 +8,14 @@ match:
   # "Icon-only" is the whole claim: a button holding an icon *and* a visible
   # label already has an accessible name, and that is how most toolbars are
   # written. The svg has to be the only thing between the tags.
+  #
+  # The `{0,2000}?` bound is what stops the scan. Unbounded, an `<svg>` with no
+  # closing tag sent the search to the end of the file, once per candidate
+  # button: 15 seconds on 32,000 unclosed tags, and quadratic. Bounded, the same
+  # input is 179ms and linear. 2,000 characters is far more than a button icon's
+  # path data, and exceeding it costs a missed finding rather than a wrong one.
   regex: >-
-    <button\b(?![^>]*(?:aria-label|aria-labelledby|title))[^>]*>\s*<svg\b[^>]*(?:/>|>(?:(?!</svg>)[\s\S])*?</svg>)\s*</button>
+    <button\b(?![^>]*(?:aria-label|aria-labelledby|title))[^>]*>\s*<svg\b[^>]*(?:/>|>(?:(?!</svg>)[\s\S]){0,2000}?</svg>)\s*</button>
   multiline: true
   file_types:
     - html

package/rules/VBC-051.yaml

@@ -6,8 +6,13 @@ tags:
   - clean-code
   - style
 match:
+  # The gap between the two spellings is bounded at 400 characters. Unbounded,
+  # `.*?` rescanned the rest of the line from every candidate, which on one long
+  # line is quadratic: 128ms at 30KB, 413ms at 60KB. The CLI skips such files as
+  # generated, but `lintText` does not, so the editor and the MCP server see
+  # them. Two names on the same line are near each other or they are unrelated.
   regex: >-
-    ((?<![.'\"])\b[a-z]+_[a-z]+\b(?!\s*[:?]).*?\b[a-z]+[A-Z][a-z]+\b)|(\b[a-z]+[A-Z][a-z]+\b.*?(?<![.'\"])\b[a-z]+_[a-z]+\b(?!\s*[:?]))
+    ((?<![.'\"])\b[a-z]+_[a-z]+\b(?!\s*[:?]).{0,400}?\b[a-z]+[A-Z][a-z]+\b)|(\b[a-z]+[A-Z][a-z]+\b.{0,400}?(?<![.'\"])\b[a-z]+_[a-z]+\b(?!\s*[:?]))
   file_types:
     - js
     - ts

package/rules/VBC-104.yaml

@@ -5,8 +5,21 @@ category: clean-code
 tags:
   - clean-code
 match:
+  # `^[ \t]*` rather than `^\s*`: with the `m` flag every line start is a match
+  # position, and `\s*` there can swallow the newlines that follow it, so a file
+  # of blank lines gave the engine an ambiguous split at every one of them. That
+  # was quadratic — 28ms at 5,000 blank lines, 44s at 200,000 — and a file of
+  # blank lines is something anyone can put in a pull request. Indentation before
+  # `import` is horizontal whitespace, which is all this ever meant to allow.
+  #
+  # The gap between the two is bounded as well. Unbounded, every `import` with
+  # no `require` after it rescanned to the end of the file, which is quadratic
+  # on a file that is mostly imports: 13ms at 28KB, 848ms at 223KB. Bounded it is
+  # linear, 20ms and 146ms. 4,000 characters is roughly a hundred lines, which is
+  # further apart than the two spellings of a module system usually sit, and
+  # being further apart than that costs a missed warning rather than a wrong one.
   regex: >-
-    ^\s*import\s[\s\S]*?^\s*(?:const|let|var)\s[^\n]*=\s*require\(|^\s*(?:const|let|var)\s[^\n]*=\s*require\([\s\S]*?^\s*import\s
+    ^[ \t]*import\s[\s\S]{0,4000}?^[ \t]*(?:const|let|var)\s[^\n]*=\s*require\(|^[ \t]*(?:const|let|var)\s[^\n]*=\s*require\([\s\S]{0,4000}?^[ \t]*import\s
   flags: m
   multiline: true
   file_types:

package/rules/VBC-936.yaml

@@ -6,8 +6,11 @@ tags:
   - docs
   - maintenance
 match:
+  # `^[ \t]*`, not `^\s*`: with `m` every line start is a match position and
+  # `\s*` there swallows the newlines after it, which is quadratic on a file of
+  # blank lines. A blockquote marker is indented by horizontal whitespace.
   regex: >-
-    \[\s*(?:EXPERIMENTAL|ALPHA|UNSTABLE|PREVIEW)\s*\]|(?:⚠️|:warning:)\s*\*{0,2}(?:experimental|alpha|unstable)\b|^\s*>\s*\*{0,2}(?:experimental|unstable)\b
+    \[\s*(?:EXPERIMENTAL|ALPHA|UNSTABLE|PREVIEW)\s*\]|(?:⚠️|:warning:)\s*\*{0,2}(?:experimental|alpha|unstable)\b|^[ \t]*>\s*\*{0,2}(?:experimental|unstable)\b
   flags: im
   file_types:
     - md