@geonosis/oxlint-plugin-biological-architecture 3.2.0 → 3.3.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @geonosis/oxlint-plugin-biological-architecture
 
+## 3.3.0
+
+### Minor Changes
+
+- 17dc880: `list-take-without-order` reads the D1 stack's three spellings of a page read in no order, and joins the `backend-d1` preset (#72): a Drizzle select chain with `.limit()` and no `.orderBy()`; a relational `findMany({ limit })` with no `orderBy`, or a `findFirst` — `LIMIT 1` — with no `orderBy`; and on the raw binding a `prepare()` SELECT with LIMIT and no ORDER BY, or a `.first()` over a SELECT with no ORDER BY (D1's `.first()` does not alter the statement). A `where` that is `eq(t.<unique>, …)`, or a SQL WHERE `<unique> = ?` with no OR, pins the row; the columns are the new `uniqueColumns` option (default `id`). An aggregate SELECT with no GROUP BY is one row. The rule now presumes no single engine. A `backend-d1` repo sees new findings where these spellings occur.
+
+### Patch Changes
+
+- fb08b28: A refusal that stands in for every file a rule did not read (a rule enabled without an option, a root import with no package resolving) is carried by the lexically first file the rule judges, not the first file oxlint happens to visit, so two runs of one tree print the same lines. The file is read off the command line, a JSON config and `git ls-files`; a run the plugin cannot read behaves as before. `unresolvedPackage` is now said once in a file, not once in a run. The varying counts reported for `ssot-no-inline-facts`, `constants-in-constants-file`, `max-comment-density` and `ssot-no-process-env` were not those rules: oxlint 1.87 on macOS drops lines of its stdout when it is a shell pipe, and a plugin with one rule that reports every string shows it. The README says so.
+- fb08b28: `GEONOSIS_LINT_TIMING=1` makes the plugin time each rule's visitor set-up and handlers and print the slowest ten to stderr when the run ends; `GEONOSIS_LINT_TIMING_TOP` lists more and `GEONOSIS_LINT_TIMING_FILE` writes every rule as JSON (#53). Without the variable nothing is measured. The timing found where one lint of this repo spent its time: the workspace and `node_modules` lookups read manifests on every import, every `directionRule` recomputed an import's landings, `no-orm-outside-db` computed them for imports of anything, and `test-no-clock-polling-for-promise-flips` walked every function of a test that names no `waitFor`. Lookups are now kept for one second, an import's landings are computed once for all direction rules, and the two rules skip what they cannot report; no rule's findings change, and the whole lint of this repo takes 29% less CPU (7.2 s to 5.1 s on average over five runs each).
+- fb08b28: `list-take-without-order` no longer judges test files by default (`__tests__/`, `.test.`, `.spec.`, `integration-tests/`): the row a fixture takes does not matter, and 72 of one tree's 198 findings were fixtures. `exempt` replaces that list and `exempt: []` judges test files again; a baseline keyed on the old count falls by the test findings. A literal `take` above 1 from the first row, whose result is iterated, counted or handed whole to another call, now gets the message `truncated` ("reads at most N rows and the code treats them as all of them") instead of "name the column", which left the dropped rows dropped. Since 3.2.1, a capped read used as if complete is reported even when it names an order, because ordering does not make the cap all the rows; the count may rise. Same rule id throughout, so no consumer's counter changes by key.
+- fb08b28: `tokens-only-colors`: since 3.2.0 the rule also reads colour literals in plain object properties, which is why a count rose without a change in the code (one Medusa storefront went from 3 to 69 findings; the 3.2.0 entry named only Tailwind variants). A theme passed to `defineTheme` (or to `compile`, `toDtcg`, `emitVariables`, `valueAt`) from `@geonosis/themekit` is the token layer and is no longer judged, whether the object is written in the call or held in a `const` of the same file. So is an object literal typed as a themekit palette type (`Theme`, `ThemeColors`, `ThemeMode` and the other types a `Theme` is made of) imported from `@geonosis/themekit`, by a `const` annotation, `satisfies` or `as`, so a brand theme defined in its own module is covered too; a local type of the same name is not. Their `exemptModules` entries can go. The new option `ignoreKeys` names property keys whose values are data that only look like colours (a shader's mask channels); it is empty by default and changes nothing until set.
+
 ## 3.2.0
 
 ### Minor Changes

package/README.md

@@ -63,7 +63,7 @@ such as an open flag is allowed there. A cell never composes another cell.
 | `backend-medusa` | 13 | Medusa steps, emits, subscribers, loaders and the store route surface |
 | `tenant-scoping` | 3 | every row placed, scoped and narrowed to one tenant |
 | `tooling` | 3 | a repo's own layers as data, no generic `utils` package, debt markers name a plan |
-| `backend-d1` | 2 | Cloudflare D1 facts — false on an engine with transactions |
+| `backend-d1` | 3 | Cloudflare D1: no transactions, scoped handles, and a page read in no order (Drizzle and the raw binding) |
 | `themekit` | 2 | colours and fonts only through the theme's tokens and roles |
 | `testbed` | 3 | integration suites run on a real database; tests await rather than poll |
 | `backend-trpc` | 1 | every router has its schema, and every schema its router |
@@ -242,6 +242,32 @@ Then find the stray copy, and mind that the answer is package-manager-specific:
   `.pnpm`. Read the links instead: `ls -l node_modules/@geonosis` in each workspace, and check the
   version in the target path.
 
+## Where the plugin spends its time
+
+`GEONOSIS_LINT_TIMING=1 oxlint …` prints, to stderr when the run ends, the rules that cost the most:
+the time each spent building its visitor (`create`, once per file) and inside its handlers
+(`visit`), and the files it was handed. `GEONOSIS_LINT_TIMING_TOP=25` lists more than the ten
+slowest, and `GEONOSIS_LINT_TIMING_FILE=timing.json` writes every rule as JSON. Without the variable
+nothing is measured and nothing is printed. A rule that pays for a shared index (the workspace and
+`node_modules` lookups, the export tables) pays on its first use, so read the numbers as where a run
+spent its time and not as what one rule costs on its own. The lookups are kept for one second, so a
+host that edits a `package.json` sees the edit within it.
+
+## A run reads the same every time
+
+Every rule's findings are a function of the tree alone. The one thing that was not is where a
+refusal lands: a rule enabled without an option reports once a run, "standing in for every file it did
+not read", and oxlint visits files in an order that changes between runs. When the plugin can read the
+run (oxlint started from the command line, a JSON config, a git checkout) the refusal is carried by the
+lexically first file the rule judges: files git ignores or `ignorePatterns` names are not candidates,
+nor is a file that switches the lint off, nor one an override for that rule matches. In any other run it
+lands on the first file visited, as before.
+
+oxlint 1.87 on macOS loses lines of its own output when its stdout is a shell pipe and the output passes
+the pipe's buffer (`oxlint … | sort`, 6,000 findings: 5,445 to 6,294 lines over six runs; a plugin with one
+rule that reports every string reproduces it). Written to a file, or read by a program that spawns it,
+the same run gives the same lines every time. Count findings from the file, not from a pipeline.
+
 ## Where to read on
 
 - `RULES.md` — in this tarball: every rule, its preset, which source tree it came from, how each

package/RULES.md

@@ -11,12 +11,12 @@ One plugin name, two rule sets, no shared code. **33 rules had the same filename
 
 The union here is **52 rules** — 54 when it was cut, less `document-sagas-are-generic` and
 `documents-share-one-table`, retired in 2.7.0 because both enforced one consumer's document kinds —
-plus thirty the kit wrote for itself: `layer-walls`, `emit-declares-attempts`,
+plus thirty-one the kit wrote for itself: `layer-walls`, `emit-declares-attempts`,
 `cell-no-cross-feature-organelles`, the `backend-medusa` ten, `no-unregistered-plugin-dir` +
 `router-schema-parity`, the `themekit` two, `no-mock-db-in-integration`, `todo-names-its-plan`,
 `boundary-time-is-primitive`, `durable-body-reads-through-steps`, `subpath-over-barrel` and the six
-of the W67 batch, `icon-control-has-name` and `tissue-no-fetch` — **82**. The two retired ids went in 3.0.0.
-Every one of the thirty is marked **written here** in the provenance table, and the counts below
+of the W67 batch, `icon-control-has-name`, `tissue-no-fetch` and `hermetic-e2e-no-wall-clock-waits` — **83**. The two retired ids went in 3.0.0.
+Every one of the thirty-one is marked **written here** in the provenance table, and the counts below
 are generated from that column and from the rules the plugin exports.
 
 <!-- GENERATED: the rules by where they came from -->
@@ -732,7 +732,7 @@ every repo's.
 | `hermetic-e2e-no-wall-clock-waits` | testbed | — | — |
 | `icon-control-has-name` | frontend | — | — |
 | `layer-walls` | tooling | `layers` | — |
-| `list-take-without-order` | backend-medusa | — | Medusa |
+| `list-take-without-order` | backend-d1 + backend-medusa | — | — |
 | `max-comment-density` | comment-ceiling | — | — |
 | `molecule-atoms-only` | frontend | — | — |
 | `molecule-must-compose` | frontend | — | — |
@@ -798,7 +798,7 @@ every repo's.
 | `worker-handles-are-scoped` | backend-d1 | `within` | — |
 | `zustand-v5-best-practices` | frontend | — | — |
 
-Preset sizes: frontend 39 · backend-workflows 15 · backend-medusa 13 · tenant-scoping 3 · testbed 3 · tooling 3 · backend-d1 2 · themekit 2 · backend-workflows-cf 1 · backend-trpc 1 · integrations 1 · package-subpaths 1 · comment-ceiling 1 · failure-paths 1.
+Preset sizes: frontend 39 · backend-workflows 15 · backend-medusa 13 · backend-d1 3 · tenant-scoping 3 · testbed 3 · tooling 3 · themekit 2 · backend-workflows-cf 1 · backend-trpc 1 · integrations 1 · package-subpaths 1 · comment-ceiling 1 · failure-paths 1.
 
 <!-- END GENERATED INVENTORY -->
 
@@ -981,7 +981,7 @@ option not named here is one no rule reads.
 | `hermetic-e2e-no-wall-clock-waits` | `clockWaits`, `listEndpoints`, `networkWaits`, `specs` |
 | `icon-control-has-name` | `controls`, `icons` |
 | `layer-walls` | `externals`, `layers`, `typeOnly` |
-| `list-take-without-order` | `callees`, `orderKeys` |
+| `list-take-without-order` | `callees`, `exempt`, `orderKeys`, `uniqueColumns` |
 | `max-comment-density` | — |
 | `molecule-atoms-only` | — |
 | `molecule-must-compose` | — |
@@ -1042,7 +1042,7 @@ option not named here is one no rule reads.
 | `tissue-no-organelles` | — |
 | `tissue-no-stores` | — |
 | `todo-names-its-plan` | `id`, `markers` |
-| `tokens-only-colors` | `allow`, `exemptModules`, `tokenPrefix` |
+| `tokens-only-colors` | `allow`, `exemptModules`, `ignoreKeys`, `tokenPrefix` |
 | `unique-query-step-name` | `queryStepCalls`, `workflowFactories` |
 | `worker-handles-are-scoped` | `within`, `wrapper` |
 | `zustand-v5-best-practices` | — |

package/corpus/medusa/queries/bad-silent-cap.ts

@@ -0,0 +1,11 @@
+// BREACH: the cap is not a page. The 101st production order is never cancelled, in any order.
+declare const service: {
+  listProductionOrders: (filters: unknown, config: unknown) => Promise<{ id: string }[]>
+}
+declare function cancelOrders(ids: string[]): Promise<void>
+
+export const cancelAll = async (orderId: string): Promise<void> => {
+  const candidates = await service.listProductionOrders({ order_id: orderId }, { take: 100 })
+
+  await cancelOrders(candidates.map((one) => one.id))
+}

package/corpus/medusa/queries/good-paged-through.ts

@@ -0,0 +1,19 @@
+// ACCEPTED: every page names its order and the loop reads pages until one comes back short.
+declare const service: {
+  listProductionOrders: (filters: unknown, config: unknown) => Promise<{ id: string }[]>
+}
+declare function cancelOrders(ids: string[]): Promise<void>
+
+const PAGE = 100
+
+export const cancelAll = async (orderId: string): Promise<void> => {
+  for (let skip = 0; ; skip += PAGE) {
+    const page = await service.listProductionOrders(
+      { order_id: orderId },
+      { order: { id: 'ASC' }, skip, take: PAGE },
+    )
+
+    await cancelOrders(page.map((one) => one.id))
+    if (page.length < PAGE) return
+  }
+}

package/corpus/medusa/queries/integration-tests/any-row.ts

@@ -0,0 +1,10 @@
+// ACCEPTED: a fixture that wants any row; which row comes back does not matter.
+declare const service: {
+  listSalesChannels: (filters: unknown, config: unknown) => Promise<{ id: string }[]>
+}
+
+export const anyChannel = async (): Promise<unknown> => {
+  const [channel] = await service.listSalesChannels({}, { take: 1 })
+
+  return channel
+}

package/dist/index.js

@@ -4,9 +4,11 @@ import { PRESETS, PRESUMED_ENGINES, TIER_RULES } from "./presets.js";
 import { registered } from "./registry.js";
 import { reportingOncePerRun } from "./rules/lib/options.js";
 import { TIERS } from "./rules/lib/tiers.js";
+import { timingRequested, withTiming } from "./timing.js";
 import { PRESETS as PRESETS2, presetSections, RENAMED_TO, rulesOfPreset } from "./presets.js";
 var presumed = new Map(PRESUMED_ENGINES.flatMap((one) => one.rules.map((name) => [name, { engine: one.engine, packages: one.packages }])));
 var reached = new Map(TIERS.flatMap((tier) => TIER_RULES[tier].map((name) => [name, tier])));
+var timed = timingRequested();
 var rules = Object.fromEntries(Object.entries(registered).map(([name, rule]) => {
   const presumes = presumed.get(name);
   const tier = reached.get(name);
@@ -16,7 +18,7 @@ var rules = Object.fromEntries(Object.entries(registered).map(([name, rule]) =>
       ...rule,
       ...presumes === undefined ? {} : { presumes },
       ...tier === undefined ? {} : { tier },
-      create: reportingOncePerRun(rule.create, name)
+      create: timed ? withTiming(reportingOncePerRun(rule.create, name), name) : reportingOncePerRun(rule.create, name)
     }
   ];
 }));

package/dist/presets.js

@@ -57,7 +57,11 @@ var BACKEND_WORKFLOWS = [
   "tables-declare-their-plane",
   "time-through-the-door"
 ];
-var BACKEND_D1 = ["no-d1-transaction", "worker-handles-are-scoped"];
+var BACKEND_D1 = [
+  "list-take-without-order",
+  "no-d1-transaction",
+  "worker-handles-are-scoped"
+];
 var BACKEND_WORKFLOWS_CF = ["step-opens-its-own-cell"];
 var RENAMED_TO = {
   "backend-sagaflow-cf": "backend-workflows-cf"
@@ -110,11 +114,12 @@ var COMMENT_CEILING = {
     "capitalized-comments": "error"
   }
 };
+var ACROSS_ENGINES = new Set(["list-take-without-order"]);
 var PRESUMED_ENGINES = [
   {
     engine: "Medusa",
     packages: ["@medusajs/framework", "@medusajs/medusa", "@medusajs/utils"],
-    rules: BACKEND_MEDUSA.filter((name) => !WORKFLOW_RULES.has(name))
+    rules: BACKEND_MEDUSA.filter((name) => !WORKFLOW_RULES.has(name) && !ACROSS_ENGINES.has(name))
   }
 ];
 var TIER_RULES = {

package/dist/rules/lib/direction-rule.d.ts

@@ -14,6 +14,7 @@ type Declaration<Options> = {
     description: string;
     fixShape: string;
     forbidden: (target: Classified, importer: Classified, options: Options) => boolean;
+    mayForbid?: (source: string) => boolean;
     messageId?: string;
     probe?: (options: readonly unknown[]) => Probe | ProbeTree;
     messages: Record<string, string>;

package/dist/rules/lib/direction-rule.js

@@ -30,7 +30,7 @@ var namespaceBoundBy = (node) => {
   return typeof local === "string" ? local : undefined;
 };
 var WHOLE = "whole";
-var targetsOf = (filename, importer, source, taken) => {
+var targetsFor = (filename, importer, source, taken) => {
   const spelled = classify(resolveRelative(importer.path, source), source);
   const door = landingsOf(filename, source, []).door;
   const landed = landingsOf(filename, source, taken === WHOLE ? door === undefined ? [] : [...exportedNamesOf(door)] : taken);
@@ -48,6 +48,16 @@ var targetsOf = (filename, importer, source, taken) => {
   targets.push(classify(judged(landed.door), source));
   return targets;
 };
+var targetsMemo = new Map;
+var targetsOf = (filename, importer, source, taken) => {
+  const key = `${filename}\x00${source}\x00${taken === WHOLE ? WHOLE : taken.join("\x00")}`;
+  const known = targetsMemo.get(key);
+  if (known !== undefined)
+    return known;
+  const found = targetsFor(filename, importer, source, taken);
+  targetsMemo.set(key, found);
+  return found;
+};
 var directionRule = (declaration) => {
   const {
     data = placeAndSource,
@@ -64,6 +74,8 @@ var directionRule = (declaration) => {
       if (!inScope(importer))
         return {};
       const judge = (source, node, taken) => {
+        if (declaration.mayForbid?.(source) === false)
+          return;
         const target = targetsOf(context.filename, importer, source, taken).find((one) => declaration.forbidden(one, importer, options));
         if (target === undefined)
           return;

package/dist/rules/lib/doors.js

@@ -1,6 +1,7 @@
 // src/rules/lib/doors.ts
 import { existsSync, lstatSync, readdirSync, realpathSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { remembered } from "./fresh.js";
 import { exportedNamesOf } from "./landing.js";
 import { conditionTargetOf, fileFor, readManifest, recordOf } from "./module-text.js";
 import { workspaceMemberNamed } from "./workspace-members.js";
@@ -78,7 +79,8 @@ var doorsOf = (manifestPath) => {
   }
   return { homes: placed, name: manifest.name };
 };
-var resolveInNodeModules = (from, name) => {
+var resolvedIn = new Map;
+var resolveInNodeModules = (from, name) => remembered(resolvedIn, `${dirname(from)}\x00${name}`, () => {
   let dir = dirname(from);
   for (;; ) {
     const packageDir = join(dir, "node_modules", name);
@@ -99,7 +101,7 @@ var resolveInNodeModules = (from, name) => {
       return;
     dir = parent;
   }
-};
+});
 var resolvePackage = (from, name) => {
   const found = resolveInNodeModules(from, name);
   if (found?.own === true)

package/dist/rules/lib/fresh.d.ts

@@ -0,0 +1,5 @@
+export declare const FRESH_MS = 1000;
+export declare const remembered: <Value>(held: Map<string, {
+    at: number;
+    value: Value;
+}>, key: string, compute: () => Value) => Value;

package/dist/rules/lib/fresh.js

@@ -0,0 +1,15 @@
+// src/rules/lib/fresh.ts
+var FRESH_MS = 1000;
+var remembered = (held, key, compute) => {
+  const now = Date.now();
+  const known = held.get(key);
+  if (known !== undefined && now - known.at < FRESH_MS)
+    return known.value;
+  const value = compute();
+  held.set(key, { at: now, value });
+  return value;
+};
+export {
+  FRESH_MS,
+  remembered
+};

package/dist/rules/lib/options.d.ts

@@ -20,5 +20,6 @@ export declare const DEFAULT_TENANT_KEY = "orgId";
 export declare const DEFAULT_TEST_EXEMPT: string[];
 export declare const requireOption: <Value>(rule: string, value: Value | null | undefined, option: string, accepts?: string) => Value;
 type Create<Context> = (context: Context) => Record<string, unknown>;
+export declare const onceFor: (key: string, file: string) => boolean;
 export declare const reportingOncePerRun: <Context>(create: Create<Context>, rule?: string) => Create<Context>;
 export {};

package/dist/rules/lib/options.js

@@ -1,4 +1,5 @@
 // src/rules/lib/options.ts
+import { designatedFile } from "./run-files.js";
 var isMissing = (value) => value === undefined || value === null || value === "" || Array.isArray(value) && value.length === 0;
 var refusalHeader = (rule, option) => `biological-architecture/${rule} requires option \`${option}\`.`;
 
@@ -36,6 +37,9 @@ var badPatternMessage = (rule, error) => `biological-architecture/${rule} threw
 var onceFor = (key, file) => {
   if (file === "")
     return true;
+  const designated = designatedFile(key.split("/")[0] ?? key);
+  if (designated !== null)
+    return file === designated;
   const first = raisedOver.get(key);
   if (first !== undefined && first !== file)
     return false;
@@ -83,6 +87,7 @@ export {
   DEFAULT_TEST_EXEMPT,
   OptionMissing,
   PATTERNS,
+  onceFor,
   patternsOf,
   refusalHeader,
   reportingOncePerRun,

package/dist/rules/lib/run-files.d.ts

@@ -0,0 +1,18 @@
+type Override = {
+    files: string[];
+    rules: Record<string, unknown>;
+};
+type Run = {
+    candidates: string[];
+    overrides: Override[];
+    prefixes: string[];
+    root: string;
+    rules: Record<string, unknown>;
+};
+export declare const runOf: ({ argv, cwd }: {
+    argv: readonly string[];
+    cwd: string;
+}) => Run | null;
+export declare const designatedIn: (run: Run, rule: string, accepts: (file: string, text: string) => boolean) => string | null;
+export declare const designatedFile: (rule: string, salt?: string, accepts?: (file: string, text: string) => boolean) => string | null;
+export {};

package/dist/rules/lib/run-files.js

@@ -0,0 +1,144 @@
+// src/rules/lib/run-files.ts
+import { spawnSync } from "node:child_process";
+import { closeSync, existsSync, openSync, readFileSync, readSync } from "node:fs";
+import { basename, dirname, join, matchesGlob, relative, resolve } from "node:path";
+import { parseLooseJson } from "./module-text.js";
+var LINTED = /\.(?:[cm]?[jt]sx?)$/;
+var HEAD_BYTES = 4096;
+var SWITCHES_OFF = /\b(?:oxlint|eslint)-disable(?!-(?:next-)?line)\b/;
+var PLUGIN_NAME = "biological-architecture";
+var FLAGS_WITH_VALUE = new Set([
+  "-c",
+  "--config",
+  "-f",
+  "--format",
+  "--threads",
+  "--tsconfig",
+  "-D",
+  "-W",
+  "-A",
+  "--deny",
+  "--warn",
+  "--allow",
+  "--max-warnings"
+]);
+var UNKNOWABLE = ["--ignore-path", "--ignore-pattern", "--no-ignore", "--lsp", "--stdin-filepath"];
+var recordOf = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : {};
+var stringsOf = (value) => Array.isArray(value) ? value.filter((one) => typeof one === "string") : [];
+var ignoredBy = (path, patterns) => patterns.some((pattern) => {
+  const bare = pattern.replace(/^\.\//, "").replace(/\/$/, "");
+  if (!bare.includes("/"))
+    return path.split("/").some((segment) => matchesGlob(segment, bare));
+  return matchesGlob(path, bare) || matchesGlob(path, `${bare}/**`);
+});
+var looselyMatches = (path, glob) => matchesGlob(path, glob) || matchesGlob(path, `**/${glob}`) || matchesGlob(basename(path), glob);
+var switchedOff = (file) => {
+  let handle;
+  try {
+    handle = openSync(file, "r");
+    const buffer = Buffer.alloc(HEAD_BYTES);
+    const read = readSync(handle, buffer, 0, HEAD_BYTES, 0);
+    return SWITCHES_OFF.test(buffer.subarray(0, read).toString("utf8"));
+  } catch {
+    return true;
+  } finally {
+    if (handle !== undefined)
+      closeSync(handle);
+  }
+};
+var prefixesOf = (jsPlugins) => {
+  const names = (Array.isArray(jsPlugins) ? jsPlugins : []).flatMap((entry) => {
+    if (typeof entry === "string") {
+      return entry.includes("oxlint-plugin-biological-architecture") ? [PLUGIN_NAME] : [];
+    }
+    const { name, specifier } = recordOf(entry);
+    return typeof name === "string" && typeof specifier === "string" && specifier.includes("oxlint-plugin-biological-architecture") ? [name] : [];
+  });
+  return names.length === 0 ? [PLUGIN_NAME] : names;
+};
+var runOf = ({ argv, cwd }) => {
+  let config;
+  const paths = [];
+  for (let at = 0;at < argv.length; at += 1) {
+    const word = argv[at] ?? "";
+    const name = word.split("=")[0] ?? word;
+    if (UNKNOWABLE.includes(name))
+      return null;
+    if (name === "-c" || name === "--config") {
+      config = word.includes("=") ? word.slice(word.indexOf("=") + 1) : argv[at += 1];
+    } else if (FLAGS_WITH_VALUE.has(word))
+      at += 1;
+    else if (!word.startsWith("-"))
+      paths.push(word);
+  }
+  const configPath = config === undefined ? join(cwd, ".oxlintrc.json") : resolve(cwd, config);
+  if (!/\.jsonc?$/.test(configPath) || !existsSync(configPath))
+    return null;
+  const declared = parseLooseJson(readFileSync(configPath, "utf8"));
+  const record = recordOf(declared);
+  const patterns = stringsOf(record["ignorePatterns"]);
+  if (patterns.some((one) => one.startsWith("!")))
+    return null;
+  const listed = spawnSync("git", ["ls-files", "-co", "--exclude-standard", "-z", "--", ...paths.length === 0 ? ["."] : paths], { cwd, encoding: "utf8", maxBuffer: 256 * 1024 * 1024 });
+  if (listed.status !== 0)
+    return null;
+  const root = dirname(configPath);
+  return {
+    candidates: listed.stdout.split("\x00").filter((path) => LINTED.test(path)).map((path) => resolve(cwd, path)).filter((path) => existsSync(path) && !ignoredBy(relative(root, path), patterns)).toSorted(),
+    overrides: (Array.isArray(record["overrides"]) ? record["overrides"] : []).map((one) => ({
+      files: stringsOf(recordOf(one)["files"]),
+      rules: recordOf(recordOf(one)["rules"])
+    })),
+    prefixes: prefixesOf(record["jsPlugins"]),
+    root,
+    rules: recordOf(record["rules"])
+  };
+};
+var isOff = (level) => {
+  const first = Array.isArray(level) ? level[0] : level;
+  return first === "off" || first === 0;
+};
+var designatedIn = (run, rule, accepts) => {
+  const keys = run.prefixes.map((prefix) => `${prefix}/${rule}`);
+  const base = keys.map((key) => run.rules[key]).find((level) => level !== undefined);
+  if (isOff(base))
+    return null;
+  const mentioning = run.overrides.filter((one) => keys.some((key) => (key in one.rules)));
+  return run.candidates.find((path) => {
+    const here = relative(run.root, path);
+    if (mentioning.some((one) => one.files.some((glob) => looselyMatches(here, glob)))) {
+      return false;
+    }
+    if (switchedOff(path))
+      return false;
+    try {
+      return accepts(path, readFileSync(path, "utf8"));
+    } catch {
+      return false;
+    }
+  }) ?? null;
+};
+var HOST = /[\\/]oxlint[\\/]bin[\\/]oxlint(?:\.\w+)?$/;
+var run;
+var designated = new Map;
+var designatedFile = (rule, salt = "", accepts = () => true) => {
+  if (run === undefined) {
+    const [, script = "", ...argv] = process.argv;
+    try {
+      run = HOST.test(script) ? runOf({ argv, cwd: process.cwd() }) : null;
+    } catch {
+      run = null;
+    }
+  }
+  if (run === null)
+    return null;
+  const key = `${rule}\x00${salt}`;
+  if (!designated.has(key))
+    designated.set(key, designatedIn(run, rule, accepts));
+  return designated.get(key) ?? null;
+};
+export {
+  designatedFile,
+  designatedIn,
+  runOf
+};

package/dist/rules/lib/token-layer.d.ts

@@ -0,0 +1,19 @@
+import { type ModuleNode } from './imports.js';
+import type { AnyNode } from './nodes.js';
+export declare const THEMEKIT = "@geonosis/themekit";
+export declare const PALETTE_TAKERS: readonly string[];
+export declare const PALETTE_TYPES: readonly string[];
+export declare const tokenLayerOf: () => {
+    covers: (chain: readonly AnyNode[]) => boolean;
+    enclosing: () => AnyNode[];
+    resolve: () => void;
+    visitor: {
+        CallExpression(node: AnyNode): void;
+        ImportDeclaration(node: ModuleNode): void;
+        TSAsExpression(node: AnyNode): void;
+        TSSatisfiesExpression(node: AnyNode): void;
+        ObjectExpression(node: AnyNode): void;
+        'ObjectExpression:exit'(): void;
+        VariableDeclaration(node: AnyNode): void;
+    };
+};