@fast-china/eslint-config 2.0.5 → 2.0.6

package/CHANGELOG.md

@@ -6,6 +6,14 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 ## Unreleased
 
+## 2.0.6 - 2026-08-04
+
+### Changed
+
+- Standardized the bilingual README, repository ignores, editor settings, TypeScript checks, and tsdown output configuration across the Fast frontend SDK repositories.
+- Simplified the test pipeline to runtime, type-contract, and package-contract verification by removing documentation- and comment-governance tests.
+- Included contribution and security documents in the published package and refreshed the engineering guidance for the current workflow.
+
 ## 2.0.5 - 2026-08-02
 
 ### Changed

package/CONTRIBUTING.md

@@ -0,0 +1,62 @@
+# Contributing
+
+Thank you for improving `@fast-china/eslint-config`.
+
+## Prerequisites
+
+- A supported Node.js version from `package.json`
+- pnpm `11.x`
+
+## Local workflow
+
+```sh
+pnpm install
+pnpm typegen
+pnpm check
+```
+
+Use `pnpm dev` to inspect the active Flat Config interactively while changing factories or rules.
+
+Use `pnpm lint:fix` and `pnpm format` for safe mechanical fixes. `pnpm test` first rebuilds `dist`, then runs consumer type-contract, runtime integration, and package-contract suites. `pnpm check` is the same quality gate used by CI and adds source type-checking, full-repository linting, and formatting verification.
+
+`src/typegen.d.ts` is generated from ESLint rule schemas and is part of the public type API. Run `pnpm typegen` after changing ESLint or plugin versions, inspect and commit the generated diff, and use `pnpm typegen:check` to verify it. Never edit the generated declaration manually.
+
+## Changing rules or factory behavior
+
+1. Keep correctness rules separate from formatting rules.
+2. Scope every rule group with `files` unless it is intentionally global.
+3. Register each plugin in a configuration that matches the same files as its rules.
+4. Prefer upstream recommended configs before adding local overrides.
+5. Keep organization-specific dependency restrictions out of this general-purpose package; projects should own those policies.
+6. Explain the purpose, rationale, and important exception or risk immediately above every local rule override.
+7. Mark disruptive defaults with `[高影响]`; verify `meta.fixable` before using `[可自动修复]`, and keep `docs/rules-risk.md` plus `docs/rules-risk.zh.md` synchronized.
+8. Never sort a map whose key order has semantics, including conditional objects under `package.json#exports`.
+9. Regenerate `src/typegen.d.ts` whenever ESLint or a bundled plugin changes; confirm new rules and changed option schemas intentionally.
+10. Add or update an integration test for every parser, plugin, option, auto-fix, generated type, or public export change. The root API is intentionally limited to `fastConfig`, `defaultConfigOptions`, `defineRules`, and related types.
+11. Document behavior changes in `CHANGELOG.md` and both README files.
+
+## Pull requests
+
+Keep changes focused and explain user-visible compatibility effects. Do not commit credentials or publish from a pull request. Changes to the Node.js, ESLint, TypeScript, Vue, React, Angular, Prettier, or module-format contract should be treated as release-significant changes.
+
+## Releases
+
+The package is ESM-only and publication is maintainer-controlled. Update `CHANGELOG.md` and `package.json`, commit the release state, then run:
+
+```sh
+pnpm check
+pnpm pack --dry-run
+pnpm publish --access public --registry https://registry.npmjs.org/
+```
+
+`prepack` reruns the complete quality gate before pnpm creates the publish archive. Inspect the dry-run list and verify that both root and `./rules` entry points contain JavaScript and declarations, together with the generated JavaScript and declaration source maps. After publication, verify the registry result and tag the exact commit:
+
+```sh
+pnpm view @fast-china/eslint-config version --registry https://registry.npmjs.org/
+VERSION=$(node -p "require('./package.json').version")
+git tag -a "v$VERSION" -m "release: v$VERSION"
+git push origin master
+git push origin "v$VERSION"
+```
+
+npm versions are immutable; never reuse an already published version.

package/README.md

@@ -1,11 +1,16 @@
-[中文](./README.zh.md) | **English**
+<p align="left">
+	<a href="./README.zh.md">简体中文</a> | <strong>English</strong>
+</p>
+
+<p align="center">
+	<img src="./Fast.png" alt="logo" width="160" />
+</p>
 
 # @fast-china/eslint-config
 
 A practical, typed ESLint Flat Config for Vue 3, React, Angular, Vite, TypeScript, and JavaScript projects.
 
-[![npm version](https://img.shields.io/npm/v/@fast-china/eslint-config?color=orange)](https://www.npmjs.com/package/@fast-china/eslint-config)
-[![license](https://img.shields.io/npm/l/@fast-china/eslint-config)](./LICENSE)
+[![npm version](https://img.shields.io/npm/v/@fast-china/eslint-config?color=orange)](https://www.npmjs.com/package/@fast-china/eslint-config) [![node](https://img.shields.io/badge/node-%5E22.18%20%7C%7C%20%5E24.18-brightgreen)](https://nodejs.org/) [![eslint](https://img.shields.io/badge/eslint-%5E10.0-4b32c3)](https://eslint.org/) [![license](https://img.shields.io/npm/l/@fast-china/eslint-config)](./LICENSE)
 
 ## Highlights
 
@@ -334,18 +339,26 @@ pnpm exec prettier --check .
 
 Set `prettier: false` if another formatter or stylistic rule set should remain fully in control.
 
+## Documentation
+
+- [Default rules and risk guide](./docs/rules-risk.md)
+- [Engineering audit (Chinese)](./docs/engineering-audit.zh.md)
+- [Contributing guide](./CONTRIBUTING.md)
+- [Security policy](./SECURITY.md)
+- [Changelog](./CHANGELOG.md)
+
 ## Development
 
 ```sh
-pnpm install
+pnpm install --frozen-lockfile
 pnpm typegen
 pnpm check
 pnpm pack --dry-run
 ```
 
-Run `pnpm typegen` after upgrading ESLint or a plugin and commit `src/typegen.d.ts`; never edit the generated file manually. `pnpm test` rebuilds the package before running consumer type-contract, runtime integration, rule-governance, and package-contract tests. `pnpm check` adds source type-checking, full-repository linting, and formatting verification.
+Use `pnpm dev` to inspect the active Flat Config interactively while changing factories or rules.
 
-See [CONTRIBUTING.md](./CONTRIBUTING.md) for the contribution workflow, the [default-rule and risk guide](./docs/rules-risk.md) for rule maintenance, and [the engineering audit](./docs/engineering-audit.zh.md) for the current quality baseline.
+Run `pnpm typegen` after upgrading ESLint or a plugin and commit `src/typegen.d.ts`; never edit the generated file manually. `pnpm test` rebuilds the package before running consumer type-contract, runtime integration, and package-contract tests. `pnpm check` adds source type-checking, full-repository linting, and formatting verification.
 
 ## License
 

package/README.zh.md

@@ -1,11 +1,16 @@
-**中文** | [English](./README.md)
+<p align="left">
+	<strong>简体中文</strong> | <a href="./README.md">English</a>
+</p>
+
+<p align="center">
+	<img src="./Fast.png" alt="logo" width="160" />
+</p>
 
 # @fast-china/eslint-config
 
 面向 Vue 3、React、Angular、Vite、TypeScript 与 JavaScript 项目的实用型 ESLint Flat Config 规则库。
 
-[![npm version](https://img.shields.io/npm/v/@fast-china/eslint-config?color=orange)](https://www.npmjs.com/package/@fast-china/eslint-config)
-[![license](https://img.shields.io/npm/l/@fast-china/eslint-config)](./LICENSE)
+[![npm version](https://img.shields.io/npm/v/@fast-china/eslint-config?color=orange)](https://www.npmjs.com/package/@fast-china/eslint-config) [![Node.js](https://img.shields.io/badge/node-%5E22.18%20%7C%7C%20%5E24.18-brightgreen)](https://nodejs.org/) [![ESLint](https://img.shields.io/badge/eslint-%5E10.0-4b32c3)](https://eslint.org/) [![license](https://img.shields.io/npm/l/@fast-china/eslint-config)](./LICENSE)
 
 ## 特性
 
@@ -334,18 +339,26 @@ pnpm exec prettier --check .
 
 如果使用其他格式化工具，或希望保留完整的样式类 ESLint 规则，请设置 `prettier: false`。
 
+## 文档
+
+- [默认规则与风险指南](./docs/rules-risk.zh.md)
+- [工程质量审查报告](./docs/engineering-audit.zh.md)
+- [贡献指南](./CONTRIBUTING.md)
+- [安全策略](./SECURITY.md)
+- [更新日志](./CHANGELOG.md)
+
 ## 开发与贡献
 
 ```sh
-pnpm install
+pnpm install --frozen-lockfile
 pnpm typegen
 pnpm check
 pnpm pack --dry-run
 ```
 
-升级 ESLint 或插件后运行 `pnpm typegen` 并提交 `src/typegen.d.ts`；不要手工编辑生成文件。`pnpm test` 会先重新构建发布产物，再分别执行消费者类型契约、运行时集成、规则治理和发布包契约测试。`pnpm check` 在此基础上增加源码类型检查、全仓 ESLint 和格式验证。
+修改配置工厂或规则时，可使用 `pnpm dev` 交互检查实际生效的 Flat Config。
 
-贡献流程见 [CONTRIBUTING.md](./CONTRIBUTING.md)，规则维护约定见 [默认规则与风险指南](./docs/rules-risk.zh.md)，本次工程审查和质量基线见 [工程质量审查报告](./docs/engineering-audit.zh.md)。
+升级 ESLint 或插件后运行 `pnpm typegen` 并提交 `src/typegen.d.ts`；不要手工编辑生成文件。`pnpm test` 会先重新构建发布产物，再分别执行消费者类型契约、运行时集成和发布包契约测试。`pnpm check` 在此基础上增加源码类型检查、全仓 ESLint 和格式验证。
 
 ## 开源协议
 

package/SECURITY.md

@@ -0,0 +1,133 @@
+# Security Policy
+
+[中文说明](#安全策略) | **English**
+
+## Supported versions
+
+Security fixes are provided for the latest release in the current major line.
+Fixes are not backported to unsupported versions.
+
+| Version   | Supported |
+| --------- | --------- |
+| `2.0.6`   | Yes       |
+| `< 2.0.6` | No        |
+
+## Reporting a vulnerability
+
+Do not disclose a suspected vulnerability in a public Issue, Pull Request,
+Discussion, or other public channel.
+
+This project does not currently publish a dedicated security email address. To
+request a private reporting channel, create a minimal issue in the
+[Gitee issue tracker](https://gitee.com/FastDotnet/fast.eslint.config/issues/new)
+with the title `[Security] Private report request`. Include only the affected
+package version and a safe way for the maintainer to contact you. Do not include
+technical details, proof-of-concept code, logs, attachments, credentials, or
+other sensitive information in that issue.
+
+After a private channel has been established, please provide:
+
+- the affected package version and runtime environment;
+- the vulnerability type and potential impact;
+- the smallest reproducible example or proof of concept;
+- the conditions required to reproduce the issue;
+- any known workaround or suggested remediation; and
+- your preferred disclosure timeline and attribution name, if any.
+
+Never include real credentials, tokens, personal data, or third-party secrets
+in a report or reproduction.
+
+## Response and disclosure process
+
+The maintainers aim to:
+
+- acknowledge a report within 7 calendar days;
+- provide an initial assessment within 14 calendar days; and
+- send progress updates at least every 14 calendar days while remediation is in
+  progress.
+
+These are response targets rather than guaranteed service-level commitments.
+Validated reports will be handled through coordinated disclosure. Please avoid
+public disclosure until a fixed release is available or another disclosure date
+has been agreed upon. When appropriate, the fix will be accompanied by release
+notes or a security advisory. Reporter attribution is optional and will follow
+the reporter's preference.
+
+## Scope
+
+Examples of issues that may be security vulnerabilities include:
+
+- unintended code execution while installing, importing, or running the
+  package;
+- tampered or unexpected contents in a published package or release artifact;
+- exposure of credentials or sensitive local project data caused by this
+  package; and
+- a dependency or configuration weakness that is demonstrably exploitable
+  through this package.
+
+The following are normally handled as regular bug reports:
+
+- disagreements about rule defaults or formatting preferences;
+- lint false positives or false negatives without a concrete security impact;
+- issues that affect only unsupported versions; and
+- vulnerabilities that exist solely in an upstream dependency and cannot be
+  exploited through this package.
+
+When researching a potential vulnerability, act in good faith: avoid accessing
+data that is not yours, degrading services, or disrupting other users.
+
+---
+
+## 安全策略
+
+### 支持版本
+
+安全修复仅面向当前主版本线中的最新发布版本，不会向已停止支持的版本回移植。
+
+| 版本      | 是否支持 |
+| --------- | -------- |
+| `2.0.6`   | 是       |
+| `< 2.0.6` | 否       |
+
+### 报告安全漏洞
+
+请勿在公开的 Issue、Pull Request、讨论区或其他公开渠道中披露疑似漏洞的技术细节。
+
+本项目目前没有公开专用的安全邮箱。如需建立私密报告渠道，请在
+[Gitee Issue](https://gitee.com/FastDotnet/fast.eslint.config/issues/new)
+中创建一个标题为 `[Security] Private report request` 的最小化 Issue。公开内容只能包含受影响的包版本，以及维护者可用于联系你的安全联系方式。请勿在该 Issue 中提交技术细节、概念验证代码、日志、附件、凭据或其他敏感信息。
+
+建立私密渠道后，请尽量提供：
+
+- 受影响的包版本和运行环境；
+- 漏洞类型及潜在影响；
+- 最小复现示例或概念验证；
+- 复现所需的前置条件；
+- 已知的临时规避方案或修复建议；
+- 期望的披露时间，以及是否需要署名。
+
+报告和复现内容中不得包含真实凭据、令牌、个人数据或第三方秘密信息。
+
+### 响应与披露流程
+
+维护者计划在 7 个自然日内确认收到报告，在 14 个自然日内给出初步评估；修复期间至少每 14 个自然日同步一次进展。这些时间是处理目标，不构成服务等级承诺。
+
+确认有效的漏洞将采用协同披露流程。请在修复版本发布或双方约定的披露日期之前避免公开漏洞。必要时，修复版本会附带发布说明或安全公告。是否公开报告者署名，以报告者的意愿为准。
+
+### 适用范围
+
+以下问题可能属于安全漏洞：
+
+- 安装、导入或运行本包时发生未预期的代码执行；
+- npm 发布包或 Release 产物包含被篡改或未预期的内容；
+- 本包导致凭据或本地项目敏感数据泄露；
+- 依赖或配置缺陷能够通过本包被明确利用。
+
+以下问题通常按普通 Bug 处理：
+
+- 对默认规则或格式偏好的不同意见；
+- 没有明确安全影响的误报或漏报；
+- 仅影响已停止支持版本的问题；
+- 仅存在于上游依赖、且无法通过本包利用的漏洞。
+
+研究疑似漏洞时请遵循善意原则：不要访问不属于你的数据，不要降低服务可用性，也不要影响其他用户。

package/docs/engineering-audit.zh.md

@@ -2,7 +2,7 @@
 
 审查日期：2026-08-02
 
-审查对象：`@fast-china/eslint-config` 2.0.5 工作区
+审查对象：`@fast-china/eslint-config` 2.0.6 工作区
 
 ## 结论
 
@@ -84,8 +84,7 @@ pnpm pack --dry-run
 5. Prettier 格式检查。
 6. 消费者类型契约测试。
 7. 运行时配置集成测试。
-8. 规则注释与风险文档治理测试。
-9. 发布元数据、入口文件和声明文件契约测试。
+8. 发布元数据、入口文件和声明文件契约测试。
 
 发布归档必须包含根入口和 `./configs`、`./constants`、`./rules` 子入口的 JavaScript 与声明文件，以及生成的 JavaScript、声明 source map；且不得包含源码缓存、测试缓存或本地依赖目录。
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fast-china/eslint-config",
-	"version": "2.0.5",
+	"version": "2.0.6",
 	"description": "Opinionated, typed ESLint Flat Config for Vue 3, React, Angular, Vite, TypeScript, JavaScript, and Node.js.",
 	"type": "module",
 	"keywords": [
@@ -27,10 +27,12 @@
 	"author": "小方",
 	"files": [
 		"CHANGELOG.md",
+		"CONTRIBUTING.md",
 		"Fast.png",
 		"LICENSE",
 		"README.md",
 		"README.zh.md",
+		"SECURITY.md",
 		"dist",
 		"docs"
 	],
@@ -75,10 +77,9 @@
 		"lint:fix": "eslint . --fix",
 		"format": "prettier --write .",
 		"format:check": "prettier --check .",
-		"test": "pnpm run build && pnpm run test:types && pnpm run test:runtime && pnpm run test:rules && pnpm run test:package",
+		"test": "pnpm run build && pnpm run test:types && pnpm run test:runtime && pnpm run test:package",
 		"test:types": "tsc --noEmit --project tests/tsconfig.json",
 		"test:runtime": "node --test tests/config.test.mjs",
-		"test:rules": "node --test tests/rules.test.mjs",
 		"test:package": "node --test tests/package.test.mjs",
 		"check": "pnpm run typecheck && pnpm run lint && pnpm run test && pnpm run format:check",
 		"prepack": "pnpm run check"