@heyramzi/lint 1.34.0 → 2.0.0

package/old-names-mask.js

@@ -0,0 +1,206 @@
+/**
+ * Code with comments and strings blanked to spaces at the same length, so a mask offset is a file
+ * offset. `old-names.js` reads names from what's left.
+ */
+
+import { commentSpansFor, regexEnd, regexStarts } from "#lint/comment-length.js";
+
+const JS_FAMILY = new Set(["ts", "tsx", "mts", "cts", "js", "jsx", "mjs", "cjs"]);
+
+function blanker(src) {
+  const out = src.split("");
+  const blank = (from, to) => {
+    for (let k = from; k < Math.min(to, out.length); k += 1) if (out[k] !== "\n") out[k] = " ";
+  };
+  return { out, blank, text: () => out.join("") };
+}
+
+/** Comments, quoted strings, template text and regex literals. Code inside `${}` stays. */
+export function maskJs(src) {
+  const { blank, text } = blanker(src);
+  const resume = [];
+  let depth = 0;
+  let i = 0;
+
+  const template = (start) => {
+    let j = start;
+    while (j < src.length) {
+      if (src[j] === "\\") j += 2;
+      else if (src[j] === "`") {
+        blank(start, j);
+        return j + 1;
+      } else if (src[j] === "$" && src[j + 1] === "{") {
+        blank(start, j + 2);
+        resume.push(depth);
+        depth += 1;
+        return j + 2;
+      } else j += 1;
+    }
+    blank(start, src.length);
+    return src.length;
+  };
+
+  while (i < src.length) {
+    const c = src[i];
+    const two = src.slice(i, i + 2);
+    if (two === "//") {
+      const end = src.indexOf("\n", i);
+      const stop = end === -1 ? src.length : end;
+      blank(i, stop);
+      i = stop;
+    } else if (two === "/*") {
+      const close = src.indexOf("*/", i + 2);
+      const stop = close === -1 ? src.length : close + 2;
+      blank(i, stop);
+      i = stop;
+    } else if (c === "`") {
+      i = template(i + 1);
+    } else if (c === '"' || c === "'") {
+      let j = i + 1;
+      while (j < src.length && src[j] !== c && src[j] !== "\n") j += src[j] === "\\" ? 2 : 1;
+      blank(i + 1, j);
+      i = j + 1;
+    } else if (c === "/" && src[i - 1] !== "<" && regexStarts(src, i)) {
+      const stop = regexEnd(src, i);
+      blank(i, stop);
+      i = stop;
+    } else if (c === "{") {
+      depth += 1;
+      i += 1;
+    } else if (c === "}") {
+      depth -= 1;
+      i = resume.length > 0 && depth === resume.at(-1) ? (resume.pop(), template(i + 1)) : i + 1;
+    } else {
+      i += 1;
+    }
+  }
+  return text();
+}
+
+/** Swift, Python, shell, CSS and SQL, through the comment gate's scanner. SQL double quotes name columns, so they stay. */
+export function maskSimple(src, extension) {
+  const { blank, text } = blanker(src);
+  const strings = [];
+  const comments = commentSpansFor(src, extension, strings);
+  for (const span of comments) blank(span.start, span.end);
+  for (const span of strings) {
+    if (extension === "sql" && src[span.start] === '"') continue;
+    blank(span.start, span.end);
+  }
+  return text();
+}
+
+/** JSON and JSONC: keys are names, every value and comment is data. */
+export function maskJson(src) {
+  const { blank, text } = blanker(src);
+  const token = /("(?:[^"\\\n]|\\.)*")|\/\/[^\n]*|\/\*[\s\S]*?\*\//g;
+  for (const match of src.matchAll(token)) {
+    const end = match.index + match[0].length;
+    const isKey = match[1] && /^\s*:/.test(src.slice(end, end + 40));
+    if (!isKey) blank(match.index, end);
+  }
+  return text();
+}
+
+const YAML_KEY = /^(\s*(?:-\s+)*)("[^"\n]+"|'[^'\n]+'|[\w./@$-][\w./@$ -]*?)(\s*:)(?=\s|$)/;
+const TOML_KEY = /^(\s*)("[^"\n]+"|'[^'\n]+'|[\w.-]+(?:\s*\.\s*[\w-]+)*)(\s*=)/;
+const TOML_TABLE = /^(\s*\[+\s*)([^\]\n]+)(\]+)/;
+
+/** YAML and TOML: a key (or a TOML table header) is a name, the rest of the line is data. */
+export function maskKeyed(src, extension) {
+  const keyed = extension === "toml" ? [TOML_TABLE, TOML_KEY] : [YAML_KEY];
+  return src
+    .split("\n")
+    .map((line) => {
+      for (const pattern of keyed) {
+        const match = pattern.exec(line);
+        if (!match) continue;
+        const kept = match[1].length + match[2].length;
+        const head = " ".repeat(match[1].length) + line.slice(match[1].length, kept);
+        return head.padEnd(line.length, " ");
+      }
+      return " ".repeat(line.length);
+    })
+    .join("\n");
+}
+
+const TAG_NAME = /^<\/?[A-Za-z][\w:.-]*/;
+
+/** The end of a `{...}` expression that starts at `i`, counting nested braces and skipping quoted braces. */
+function braceEnd(src, i) {
+  let depth = 0;
+  for (let j = i; j < src.length; j += 1) {
+    const c = src[j];
+    if (c === '"' || c === "'" || c === "`") {
+      const close = src.indexOf(c, j + 1);
+      if (close !== -1) j = close;
+    } else if (c === "{") depth += 1;
+    else if (c === "}" && (depth -= 1) === 0) return j + 1;
+  }
+  return src.length;
+}
+
+/** The end of a tag opened at `i`: quoted attribute values are blanked, `{...}` expressions stay. */
+function tagEnd(src, i, blank, braces) {
+  let j = i + 1;
+  while (j < src.length && src[j] !== ">") {
+    const c = src[j];
+    if (c === '"' || c === "'") {
+      const close = src.indexOf(c, j + 1);
+      const stop = close === -1 ? src.length : close;
+      blank(j + 1, stop);
+      j = stop + 1;
+    } else if (c === "{" && braces) {
+      j = braceEnd(src, j);
+    } else j += 1;
+  }
+  return j + 1;
+}
+
+/** The inside of a `<script>` or `<style>` element, masked as its own language. Returns where the element's code ends. */
+function maskBlock(src, out, from, name) {
+  const close = src.toLowerCase().indexOf(`</${name}`, from);
+  const stop = close === -1 ? src.length : close;
+  const body = src.slice(from, stop);
+  const inner = name === "style" ? maskSimple(body, "css") : maskJs(body);
+  for (let k = 0; k < inner.length; k += 1) out[from + k] = inner[k];
+  return stop;
+}
+
+/**
+ * Svelte and HTML. Tag names, attribute names and `{...}` expressions stay, and text, comments and
+ * quoted attribute values go. `<script>` is read as JS and `<style>` as CSS.
+ */
+export function maskMarkup(src, { braces }) {
+  const { out, blank, text } = blanker(src);
+  let i = 0;
+  while (i < src.length) {
+    if (src.startsWith("<!--", i)) {
+      const close = src.indexOf("-->", i + 4);
+      const stop = close === -1 ? src.length : close + 3;
+      blank(i, stop);
+      i = stop;
+    } else if (src[i] === "<" && TAG_NAME.test(src.slice(i, i + 40))) {
+      const name = /^<([A-Za-z]+)/.exec(src.slice(i, i + 12))?.[1]?.toLowerCase();
+      i = tagEnd(src, i, blank, braces);
+      if (name === "script" || name === "style") i = maskBlock(src, out, i, name);
+    } else if (src[i] === "{" && braces) {
+      i = braceEnd(src, i);
+    } else {
+      blank(i, i + 1);
+      i += 1;
+    }
+  }
+  return text();
+}
+
+/** The code of a file with comments and values blanked, or null when the language isn't one we read. */
+export function maskFor(src, extension) {
+  if (JS_FAMILY.has(extension)) return maskJs(src);
+  if (extension === "svelte") return maskMarkup(src, { braces: true });
+  if (extension === "html") return maskMarkup(src, { braces: false });
+  if (extension === "json" || extension === "jsonc") return maskJson(src);
+  if (extension === "yaml" || extension === "yml" || extension === "toml")
+    return maskKeyed(src, extension);
+  return maskSimple(src, extension === "bash" || extension === "zsh" ? "sh" : extension);
+}

package/old-names.js

@@ -0,0 +1,145 @@
+/**
+ * The old-names gate (Ramzi, 22 Oct 2026). The words sit in `vendor/old-names-words.js`, which it
+ * skips. Git and process live in `bin/heyramzi-old-names.js`.
+ */
+
+import { generatedContent, generatedPath } from "#lint/file-tokens.js";
+import { maskFor } from "#lint/old-names-mask.js";
+import { PART_WORDS, SUBSTRING_WORD } from "#lint/vendor/old-names-words.js";
+
+export const OLD_NAME_EXTENSIONS = [
+  "ts",
+  "tsx",
+  "mts",
+  "cts",
+  "js",
+  "jsx",
+  "mjs",
+  "cjs",
+  "svelte",
+  "swift",
+  "py",
+  "sql",
+  "sh",
+  "bash",
+  "zsh",
+  "css",
+  "html",
+  "json",
+  "jsonc",
+  "yaml",
+  "yml",
+  "toml",
+];
+
+/** Applied migrations are history the database already ran, and drizzle-kit writes its output folder whole. */
+const MIGRATION_TREES = new Set(["migrations", "drizzle"]);
+
+/** Which of a repo's tracked files the gate reads: its own code, not a tool's output or a migration that already ran. */
+export function selectFiles(tracked) {
+  const wanted = new Set(OLD_NAME_EXTENSIONS);
+  return tracked.filter((file) => {
+    if (!wanted.has(file.slice(file.lastIndexOf(".") + 1))) return false;
+    if (generatedPath(file) || /\.min\.(js|css)$/.test(file)) return false;
+    return !file
+      .split("/")
+      .slice(0, -1)
+      .some((part) => MIGRATION_TREES.has(part));
+  });
+}
+
+/** A name's word parts: `toCompat`, `api-shim` and `DEPRECATED_FIELD` all split where a person would. */
+function partsOf(token) {
+  return (token.match(/[A-Z]+(?![a-z])|[A-Z]?[a-z]+|\d+/g) ?? []).map((part) => part.toLowerCase());
+}
+
+function bannedWords(token) {
+  const found = [];
+  if (token.toLowerCase().includes(SUBSTRING_WORD)) found.push(SUBSTRING_WORD);
+  for (const part of partsOf(token)) {
+    const base = part.replace(/s$/, "");
+    if (PART_WORDS.includes(base) && !found.includes(base)) found.push(base);
+  }
+  return found;
+}
+
+/** The directory and file names on a path that carry a banned word. A folder shows once, at the folder. */
+export function nameHits(file) {
+  const parts = file.split("/");
+  return parts.flatMap((part, index) =>
+    bannedWords(part).map((banned) => ({
+      file: parts.slice(0, index + 1).join("/"),
+      line: 0,
+      word: banned,
+      token: part,
+      folder: index < parts.length - 1,
+    })),
+  );
+}
+
+const TOKEN = /[\w$-]+/g;
+
+/** Every banned word in a file's text, with its line. The substring word anywhere, the part words in code. */
+export function sourceHits(source, extension) {
+  const hits = [];
+  const seen = new Set();
+  const lines = source.split("\n");
+  const add = (line, banned, token) => {
+    const key = `${line}:${banned}:${token}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    hits.push({ line, word: banned, token, text: lines[line - 1].trim().slice(0, 100) });
+  };
+  if (source.toLowerCase().includes(SUBSTRING_WORD)) {
+    lines.forEach((text, index) => {
+      for (const token of text.match(TOKEN) ?? []) {
+        if (bannedWords(token).includes(SUBSTRING_WORD)) add(index + 1, SUBSTRING_WORD, token);
+      }
+    });
+  }
+  const masked = maskFor(source, extension);
+  masked.split("\n").forEach((text, index) => {
+    for (const token of text.match(TOKEN) ?? []) {
+      for (const banned of bannedWords(token)) {
+        if (banned !== SUBSTRING_WORD) add(index + 1, banned, token);
+      }
+    }
+  });
+  return hits.toSorted((a, b) => a.line - b.line);
+}
+
+/** Every hit in one file: its path first, then its text. A file a tool wrote, by its header, has none. */
+export function scanFile(file, source) {
+  if (generatedContent(Buffer.from(source.slice(0, 2048)))) return [];
+  const extension = file.slice(file.lastIndexOf(".") + 1);
+  const inText = sourceHits(source, extension);
+  for (const hit of inText) hit.file = file;
+  return [...nameHits(file), ...inText];
+}
+
+/** Hits over many files, `sources` mapping path to text. A folder is named once, however many files sit in it. */
+export function check(sources) {
+  const hits = [];
+  const named = new Set();
+  for (const [file, source] of Object.entries(sources)) {
+    for (const hit of scanFile(file, source)) {
+      const key = `${hit.file}:${hit.word}:${hit.line}:${hit.token}`;
+      if (hit.line === 0 && named.has(key)) continue;
+      named.add(key);
+      hits.push(hit);
+    }
+  }
+  return hits;
+}
+
+const ADVICE =
+  "Delete the old path and move every caller to the new one, or rename the thing to what it is now. A refactor leaves no alias export, no old field kept for a migration and no shim. There's no allowlist.";
+
+/** The refusal. Each hit names the token, and the footer says what to do instead. */
+export function report(hits) {
+  const lines = hits.map(({ file, line, word: banned, token, text, folder }) => {
+    if (line > 0) return `${file}:${line}: "${banned}" in ${token}: ${text}`;
+    return `${file}${folder ? "/" : ""}: "${banned}" in the ${folder ? "folder" : "file"} name ${token}`;
+  });
+  return [`old-names: ${hits.length} hit(s)`, ...lines, "", ADVICE].join("\n");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heyramzi/lint",
-  "version": "1.34.0",
+  "version": "2.0.0",
   "description": "Shared oxlint rules, base config and gates for Studio projects",
   "license": "MIT",
   "repository": {
@@ -9,11 +9,12 @@
     "directory": "packages/lint"
   },
   "bin": {
-    "heyramzi-commit-msg": "./bin/heyramzi-commit-msg.js",
     "heyramzi-comment-length": "./bin/heyramzi-comment-length.js",
+    "heyramzi-commit-msg": "./bin/heyramzi-commit-msg.js",
     "heyramzi-file-tokens": "./bin/heyramzi-file-tokens.js",
     "heyramzi-inline-path": "./bin/heyramzi-inline-path.js",
     "heyramzi-jev-code": "./bin/heyramzi-jev-code.js",
+    "heyramzi-old-names": "./bin/heyramzi-old-names.js",
     "heyramzi-push-diff": "./bin/heyramzi-push-diff.js",
     "heyramzi-repo-rules": "./bin/heyramzi-repo-rules.js",
     "heyramzi-slop": "./bin/heyramzi-slop.js",
@@ -32,6 +33,8 @@
     "index.js",
     "jev.js",
     "jev-code.js",
+    "old-names.js",
+    "old-names-mask.js",
     "package.json",
     "processors",
     "push-diff.js",
@@ -39,6 +42,8 @@
     "slop.js",
     "slop-views.js",
     "ui-rules.js",
+    "ui-rules-css.js",
+    "ui-rules-markup.js",
     "svelte-markup.js",
     "svelte-template.js",
     "register.js",
@@ -46,6 +51,7 @@
     "repo-rules.js",
     "repo-rules",
     "scripts",
+    "vendor",
     "rules"
   ],
   "type": "module",

package/push-diff.js

@@ -4,7 +4,6 @@
  */
 import { commentSpans } from "#lint/comment-length.js";
 
-
 /** The registry the add-ons persist under: `enum StorageKey {…}` or `const StorageKey = {…}`. */
 const REGISTRY = /(?:\benum\s+StorageKey\s*\{|\bStorageKey\s*(?::[^=\n]+)?=\s*\{)/;
 
@@ -27,7 +26,8 @@ export function storageKeysOf(source) {
     end += 1;
   }
   const body = clean.slice(open.index + open[0].length, end);
-  const entry = /(?:^|[\s,{])(["']?)([A-Za-z_$][\w$]*)\1\s*[:=]\s*(["'`])((?:\\.|(?!\3)[^\\\n])*)\3/g;
+  const entry =
+    /(?:^|[\s,{])(["']?)([A-Za-z_$][\w$]*)\1\s*[:=]\s*(["'`])((?:\\.|(?!\3)[^\\\n])*)\3/g;
   // A template that only splices string literals, `a_${"b"}`, is the same string at runtime.
   const literal = (value) => value.replace(/\$\{\s*(["'])((?:(?!\1).)*)\1\s*\}/g, "$2");
   for (const match of body.matchAll(entry)) keys.set(match[2], literal(match[4]));

package/repo-rules/packages.js

@@ -141,22 +141,22 @@ export function npmrcCredentials(tree) {
   return found;
 }
 
-const LEGACY_TOKEN = ["GITHUB", "PRIVATE", "PACKAGES", "TOKEN"].join("_");
+const DEAD_TOKEN = ["GITHUB", "PRIVATE", "PACKAGES", "TOKEN"].join("_");
 const INSTALL_FILES =
   /(^|\/)(\.npmrc|\.env[^/]*|Dockerfile[^/]*|(docker-)?compose[^/]*\.ya?ml|wrangler\.jsonc?|[^/]+\.sh|\.github\/workflows\/[^/]+\.ya?ml)$/;
 
-export function legacyTokenName(tree) {
+export function deadTokenName(tree) {
   const found = [];
   for (const file of tree.touchedMatching(INSTALL_FILES)) {
     tree
       .text(file)
       .split("\n")
       .forEach((line, index) => {
-        if (!line.includes(LEGACY_TOKEN)) return;
+        if (!line.includes(DEAD_TOKEN)) return;
         found.push({
           file,
-          rule: "legacy-token-name",
-          message: `Line ${index + 1} names ${LEGACY_TOKEN}, a dead variable that 403s against the package registry. The package-install token is GH_PRIVATE_PACKAGES_TOKEN everywhere: .npmrc, workflow env, the shell. Leave secrets.GITHUB_TOKEN alone, it's the Actions built-in that release-please, GoReleaser and gh need.`,
+          rule: "dead-token-name",
+          message: `Line ${index + 1} names ${DEAD_TOKEN}, a dead variable that 403s against the package registry. The package-install token is GH_PRIVATE_PACKAGES_TOKEN everywhere: .npmrc, workflow env, the shell. Leave secrets.GITHUB_TOKEN alone, it's the Actions built-in that release-please, GoReleaser and gh need.`,
         });
       });
   }

package/repo-rules.js

@@ -7,7 +7,7 @@ import { composeImages, fossilNames } from "#lint/repo-rules/paths.js";
 import {
   heyramziLinks,
   heyramziTarballs,
-  legacyTokenName,
+  deadTokenName,
   npmrcCredentials,
   pnpmOnly,
   srcImportMaps,
@@ -28,7 +28,7 @@ export const RULES = [
   heyramziTarballs,
   srcImportMaps,
   npmrcCredentials,
-  legacyTokenName,
+  deadTokenName,
   workflows,
   foreignTools,
   fallowShape,

package/rules/convex-index-name.js

@@ -6,7 +6,9 @@ import { propertyName } from "#lint/rules/convex-ast.js";
 export default {
   meta: {
     type: "problem",
-    docs: { description: "Require index names to start with `by_` and list every field with `_and_`." },
+    docs: {
+      description: "Require index names to start with `by_` and list every field with `_and_`.",
+    },
     messages: {
       badName:
         'Index "{{ name }}" covers {{ count }} field(s) but its name lists {{ listed }}. Name it `by_` plus every field joined with `_and_`, like `by_channel_and_author`, and update its `withIndex` calls.',

package/rules/convex-internal-only.js

@@ -29,7 +29,8 @@ export default {
   create(context) {
     const jobs = new Set(["crons"]);
     let httpDepth = 0;
-    const report = (node, where) => context.report({ node, messageId: "publicRef", data: { where } });
+    const report = (node, where) =>
+      context.report({ node, messageId: "publicRef", data: { where } });
     return {
       VariableDeclarator(node) {
         const init = node.init;

package/rules/{convex-no-deprecated-crons.js → convex-no-hourly-daily-crons.js}

@@ -1,19 +1,20 @@
 /**
- * `crons.hourly` and `crons.daily` are the deprecated helpers.
+ * `crons.hourly` and `crons.daily` are the helpers Convex replaced.
  */
 import { propertyName } from "#lint/rules/convex-ast.js";
 
-const DEPRECATED = new Set(["hourly", "daily"]);
+const REPLACED_HELPERS = new Set(["hourly", "daily"]);
 
 export default {
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow the deprecated cron helpers. Use `crons.interval` or `crons.cron`.",
+      description:
+        "Disallow `crons.hourly` and `crons.daily`. Use `crons.interval` or `crons.cron`.",
     },
     messages: {
-      deprecated:
-        "`crons.{{ method }}` is deprecated. Use `crons.cron(name, '30 3 * * *', internal.x.y, {})` or `crons.interval(name, { hours: 6 }, internal.x.y, {})`. Both run in UTC.",
+      replacedHelper:
+        "`crons.{{ method }}` is a replaced helper. Use `crons.cron(name, '30 3 * * *', internal.x.y, {})` or `crons.interval(name, { hours: 6 }, internal.x.y, {})`. Both run in UTC.",
     },
     schema: [],
   },
@@ -29,10 +30,10 @@ export default {
       },
       CallExpression(node) {
         const method = propertyName(node.callee);
-        if (!method || !DEPRECATED.has(method)) return;
+        if (!method || !REPLACED_HELPERS.has(method)) return;
         const owner = node.callee.object;
         if (owner.type === "Identifier" && jobs.has(owner.name)) {
-          context.report({ node, messageId: "deprecated", data: { method } });
+          context.report({ node, messageId: "replacedHelper", data: { method } });
         }
       },
     };

package/rules/convex-runtime-imports.js

@@ -41,7 +41,8 @@ export default {
       CallExpression(node) {
         if (!useNode) return;
         const name = registerName(node);
-        if (name && NODE_ONLY.has(name)) context.report({ node, messageId: "actionsOnly", data: { name } });
+        if (name && NODE_ONLY.has(name))
+          context.report({ node, messageId: "actionsOnly", data: { name } });
       },
     };
   },

package/rules/{no-legacy-compat.js → no-underscore-reexport.js}

@@ -1,5 +1,5 @@
 /**
- * A re-export renamed to a leading `_` keeps a dead name alive. Compat words in comments are
+ * A re-export renamed to a leading `_` keeps a dead name alive. Old-name words in comments are
  * the comment gate's job: `comment-length.js`.
  */
 export default {