@interlace/eslint-config 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,12 @@
+## [0.1.0] - 2026-05-16
+
+### Features
+
+- Initial release. One-extends meta-config for the Interlace ESLint ecosystem.
+- `flagship` preset — composes the 9 flagship-hosting plugins (10 rules total) from `.agent/flagship-rules.md`.
+- `security` preset — composes the 11 security plugins (`secure-coding`, `node-security`, `browser-security`, `jwt`, `pg`, `mongodb-security`, `express-security`, `lambda-security`, `nestjs-security`, `vercel-ai-security`).
+- `quality` preset — composes the 7 code-quality plugins (`import-next`, `conventions`, `maintainability`, `reliability`, `operability`, `modularity`, `modernization`).
+- `react` preset — composes the 2 React plugins (`react-features`, `react-a11y`).
+- `recommended` preset — full default; security + quality + react.
+
+Replaces the manual 11-plugin compose previously documented in `.agent/flagship-rules.md`.

package/LICENSE

@@ -0,0 +1,23 @@
+MIT License
+
+Copyright (c) 2025 Ofri Peretz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+

package/README.md

@@ -0,0 +1,153 @@
+# `@interlace/eslint-config`
+
+> One-extends meta-config for the [Interlace ESLint ecosystem][monorepo].
+> Replaces the manual 11-plugin compose previously documented in
+> [`.agent/flagship-rules.md`][flagship-spec].
+
+ESLint 8 / 9 / 10 — **flat-config only**. If you're still on
+`.eslintrc.js`, see [ESLint's flat-config migration guide][migrate].
+
+---
+
+## Install
+
+```sh
+npm install --save-dev eslint @interlace/eslint-config
+```
+
+This package depends on every Interlace plugin. One install brings them all.
+
+---
+
+## Use
+
+```js
+// eslint.config.mjs
+import interlace from '@interlace/eslint-config';
+
+export default [
+  ...interlace.recommended,
+];
+```
+
+That's it. Nineteen plugins, hundreds of rules, one import.
+
+### Presets
+
+| Preset         | Plugins | Use when                                                                                          |
+| -------------- | ------: | ------------------------------------------------------------------------------------------------- |
+| `flagship`     |       9 | CI gate that should fail on the highest-signal 10 rules only. See [`flagship-rules.md`][flagship-spec]. |
+| `security`     |      10 | All security plugins' recommended presets.                                                        |
+| `quality`      |       7 | All code-quality plugins' recommended presets (`import-next`, `maintainability`, etc.).           |
+| `react`        |       2 | `react-features` + `react-a11y` recommended.                                                      |
+| `recommended`  |      19 | The full default. Equivalent to `[...security, ...quality, ...react]`.                            |
+
+Every preset is a `readonly FlatConfig[]` — spread it into your config array.
+
+### CI-gate (flagship only)
+
+```js
+// eslint.config.mjs
+import { flagship } from '@interlace/eslint-config';
+
+export default [
+  ...flagship,
+];
+```
+
+The flagship preset enables exactly the 10 rules in
+[`.agent/flagship-rules.md`][flagship-spec] § "The 10", all at `error`. No
+opinionated extras, no `recommended`-tier noise — drop it into a release
+gate and it'll fail closed on real bugs only.
+
+### React only on JSX/TSX
+
+The React presets bind globally by default. To scope them:
+
+```js
+import interlace from '@interlace/eslint-config';
+
+export default [
+  ...interlace.security,
+  ...interlace.quality,
+  ...interlace.react.map(c => ({ ...c, files: ['**/*.{jsx,tsx}'] })),
+];
+```
+
+### Overrides
+
+Flat config is order-sensitive — later entries win. Place your overrides
+after the preset spread:
+
+```js
+import interlace from '@interlace/eslint-config';
+
+export default [
+  ...interlace.recommended,
+  {
+    files: ['**/*.test.ts'],
+    rules: {
+      'secure-coding/no-hardcoded-credentials': 'off',
+      'maintainability/max-lines-per-function': 'off',
+    },
+  },
+];
+```
+
+---
+
+## What's inside
+
+### Security (10)
+
+`eslint-plugin-secure-coding` · `eslint-plugin-node-security` ·
+`eslint-plugin-browser-security` · `eslint-plugin-jwt` ·
+`eslint-plugin-pg` · `eslint-plugin-mongodb-security` ·
+`eslint-plugin-express-security` · `eslint-plugin-lambda-security` ·
+`eslint-plugin-nestjs-security` · `eslint-plugin-vercel-ai-security`
+
+Covers OWASP Web Top 10 2021, OWASP LLM Top 10 2025 (partial), and a
+broad MITRE CWE map. Domain-vertical depth where the generic
+`eslint-plugin-security` stops.
+
+### Code quality (7)
+
+`eslint-plugin-import-next` · `eslint-plugin-conventions` ·
+`eslint-plugin-maintainability` · `eslint-plugin-reliability` ·
+`eslint-plugin-operability` · `eslint-plugin-modularity` ·
+`eslint-plugin-modernization`
+
+### React (2)
+
+`eslint-plugin-react-features` · `eslint-plugin-react-a11y`
+
+---
+
+## ESLint version support
+
+Peer dep: `eslint@^8.0.0 || ^9.0.0 || ^10.0.0`. The ESLint 10 compat
+matrix runs on every PR in the parent monorepo — see
+[`.github/workflows/eslint-version-matrix.yml`][matrix].
+
+---
+
+## Engine portability
+
+Every rule in every preset has an oxlint manifest entry in
+[`.agent/oxlint-jsplugins-manifest.json`][oxlint-manifest] (currently
+398/398 compatible). Once oxlint flat-config consumes ESLint configs
+directly, this preset will work there unchanged. See
+[`INTEROP_PHILOSOPHY.md`][interop].
+
+---
+
+## License
+
+[MIT](./LICENSE) © Ofri Peretz.
+
+[monorepo]: https://github.com/ofri-peretz/eslint
+[flagship-spec]: https://github.com/ofri-peretz/eslint/blob/main/.agent/flagship-rules.md
+[migrate]: https://eslint.org/docs/latest/use/configure/migration-guide
+[matrix]: https://github.com/ofri-peretz/eslint/blob/main/.github/workflows/eslint-version-matrix.yml
+[oxlint-manifest]: https://github.com/ofri-peretz/eslint/blob/main/.agent/oxlint-jsplugins-manifest.json
+[interop]: https://github.com/ofri-peretz/eslint/blob/main/INTEROP_PHILOSOPHY.md

package/package.json

@@ -0,0 +1,89 @@
+{
+  "name": "@interlace/eslint-config",
+  "version": "0.1.0",
+  "description": "One-extends meta-config for the Interlace ESLint ecosystem. Composes the 9 flagship-hosting plugins (10 rules) and the full 19-plugin recommended preset (security + code-quality + React) into a single import. Replaces the manual 11-plugin compose documented in .agent/flagship-rules.md.",
+  "type": "commonjs",
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "default": "./src/index.js"
+    }
+  },
+  "author": "Ofri Peretz <ofriperetzdev@gmail.com>",
+  "license": "MIT",
+  "homepage": "https://github.com/ofri-peretz/eslint/tree/main/packages/eslint-config-interlace#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ofri-peretz/eslint",
+    "directory": "packages/eslint-config-interlace"
+  },
+  "bugs": {
+    "url": "https://github.com/ofri-peretz/eslint/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "src/",
+    "dist/",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "keywords": [
+    "eslint",
+    "eslint-config",
+    "eslintconfig",
+    "flat-config",
+    "interlace",
+    "interlace-security",
+    "security",
+    "owasp",
+    "owasp-top-10",
+    "react",
+    "import",
+    "code-quality",
+    "meta-config",
+    "shareable-config",
+    "flagship",
+    "recommended",
+    "static-analysis"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "build": "tsx ../../scripts/build-package.ts",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc -p tsconfig.lib.json --noEmit"
+  },
+  "dependencies": {
+    "tslib": "^2.3.0",
+    "@interlace/eslint-devkit": "^1.2.1",
+    "eslint-plugin-browser-security": "^1.2.3",
+    "eslint-plugin-conventions": "^4.0.7",
+    "eslint-plugin-express-security": "^1.2.3",
+    "eslint-plugin-import-next": "^2.3.6",
+    "eslint-plugin-jwt": "^2.2.3",
+    "eslint-plugin-lambda-security": "^1.2.3",
+    "eslint-plugin-maintainability": "^3.0.3",
+    "eslint-plugin-modernization": "^2.0.4",
+    "eslint-plugin-modularity": "^2.0.4",
+    "eslint-plugin-mongodb-security": "^8.2.3",
+    "eslint-plugin-nestjs-security": "^1.2.3",
+    "eslint-plugin-node-security": "^4.1.0",
+    "eslint-plugin-operability": "^3.0.5",
+    "eslint-plugin-pg": "^1.4.3",
+    "eslint-plugin-react-a11y": "^2.1.5",
+    "eslint-plugin-react-features": "^1.1.4",
+    "eslint-plugin-reliability": "^3.1.3",
+    "eslint-plugin-secure-coding": "^3.2.0",
+    "eslint-plugin-vercel-ai-security": "^1.3.5"
+  },
+  "peerDependencies": {
+    "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"
+  }
+}

package/src/index.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Copyright (c) 2026 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+import type { TSESLint } from '@interlace/eslint-devkit';
+type FlatConfig = TSESLint.FlatConfig.Config;
+/**
+ * The 10 flagship rules in `.agent/flagship-rules.md`, one preset per plugin.
+ * Order matches the spec table; spreading produces deterministic output.
+ *
+ * Each entry is a single flat-config object — wrap or spread as needed
+ * depending on whether you compose with `[...flagship, ...rest]` or with
+ * an array literal `[flagship[0], myOverride, flagship[1], ...]`.
+ */
+export declare const flagship: readonly FlatConfig[];
+/**
+ * Recommended preset for every security plugin. 10 plugins.
+ */
+export declare const security: readonly FlatConfig[];
+/**
+ * Recommended preset for every code-quality plugin. 7 plugins.
+ */
+export declare const quality: readonly FlatConfig[];
+/**
+ * Recommended preset for the React plugins. 2 plugins.
+ *
+ * Apply only to JSX/TSX files in consumer configs:
+ *
+ * ```js
+ * import { react } from '@interlace/eslint-config';
+ * export default [
+ *   ...react.map(c => ({ ...c, files: ['**\/*.{jsx,tsx}'] })),
+ * ];
+ * ```
+ */
+export declare const react: readonly FlatConfig[];
+/**
+ * Component-API preset — the mechanical R5/R6/R8/R18/R19 rules from the
+ * `interlace-component` skill. Opt-in: apply to packages that ship shared
+ * React components (design-system, `@interlace/ui`, marketing surfaces).
+ * Not included in `recommended` because the rules are too strict for
+ * application code that hasn't been migrated yet.
+ *
+ * ```js
+ * import { componentApi } from '@interlace/eslint-config';
+ * export default [
+ *   ...componentApi.map(c => ({ ...c, files: ['**\/*.{jsx,tsx}'] })),
+ * ];
+ * ```
+ */
+export declare const componentApi: readonly FlatConfig[];
+/**
+ * Full recommended preset — security + quality + react. 19 plugins.
+ *
+ * For most projects this is the right starting point:
+ *
+ * ```js
+ * import interlace from '@interlace/eslint-config';
+ * export default [
+ *   ...interlace.recommended,
+ *   { files: ['**\/*.test.ts'], rules: { 'secure-coding/no-hardcoded-credentials': 'off' } },
+ * ];
+ * ```
+ */
+export declare const recommended: readonly FlatConfig[];
+/**
+ * Default export aggregates every named preset under one namespace so
+ * consumers can `import interlace from '@interlace/eslint-config'`.
+ */
+declare const presets: {
+    readonly flagship: readonly TSESLint.FlatConfig.Config[];
+    readonly security: readonly TSESLint.FlatConfig.Config[];
+    readonly quality: readonly TSESLint.FlatConfig.Config[];
+    readonly react: readonly TSESLint.FlatConfig.Config[];
+    readonly componentApi: readonly TSESLint.FlatConfig.Config[];
+    readonly recommended: readonly TSESLint.FlatConfig.Config[];
+};
+export default presets;

package/src/index.js

@@ -0,0 +1,155 @@
+"use strict";
+/**
+ * Copyright (c) 2026 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recommended = exports.componentApi = exports.react = exports.quality = exports.security = exports.flagship = void 0;
+/**
+ * @interlace/eslint-config
+ *
+ * One-extends meta-config for the Interlace ESLint ecosystem. Replaces the
+ * manual 11-plugin compose documented in `.agent/flagship-rules.md` § "Using
+ * the flagship preset".
+ *
+ * Presets (all are flat-config arrays — drop them into ESLint 9/10 with
+ * spread, e.g. `export default [...flagship, ...myOverrides]`):
+ *
+ *   - `flagship`     — the 10 flagship rules from 9 plugins
+ *   - `security`     — recommended preset of every security plugin (10)
+ *   - `quality`      — recommended preset of every code-quality plugin (7)
+ *   - `react`        — recommended preset of `react-features` + `react-a11y`
+ *   - `recommended`  — security + quality + react (full default, 19 plugins)
+ *
+ * See README.md for usage.
+ */
+const eslint_plugin_import_next_1 = require("eslint-plugin-import-next");
+const eslint_plugin_pg_1 = require("eslint-plugin-pg");
+const eslint_plugin_secure_coding_1 = require("eslint-plugin-secure-coding");
+const eslint_plugin_mongodb_security_1 = require("eslint-plugin-mongodb-security");
+const eslint_plugin_jwt_1 = require("eslint-plugin-jwt");
+const eslint_plugin_browser_security_1 = require("eslint-plugin-browser-security");
+const eslint_plugin_react_features_1 = require("eslint-plugin-react-features");
+const eslint_plugin_react_a11y_1 = require("eslint-plugin-react-a11y");
+const eslint_plugin_vercel_ai_security_1 = require("eslint-plugin-vercel-ai-security");
+const eslint_plugin_node_security_1 = require("eslint-plugin-node-security");
+const eslint_plugin_express_security_1 = require("eslint-plugin-express-security");
+const eslint_plugin_lambda_security_1 = require("eslint-plugin-lambda-security");
+const eslint_plugin_nestjs_security_1 = require("eslint-plugin-nestjs-security");
+const eslint_plugin_conventions_1 = require("eslint-plugin-conventions");
+const eslint_plugin_maintainability_1 = require("eslint-plugin-maintainability");
+const eslint_plugin_reliability_1 = require("eslint-plugin-reliability");
+const eslint_plugin_operability_1 = require("eslint-plugin-operability");
+const eslint_plugin_modularity_1 = require("eslint-plugin-modularity");
+const eslint_plugin_modernization_1 = require("eslint-plugin-modernization");
+/**
+ * The 10 flagship rules in `.agent/flagship-rules.md`, one preset per plugin.
+ * Order matches the spec table; spreading produces deterministic output.
+ *
+ * Each entry is a single flat-config object — wrap or spread as needed
+ * depending on whether you compose with `[...flagship, ...rest]` or with
+ * an array literal `[flagship[0], myOverride, flagship[1], ...]`.
+ */
+exports.flagship = [
+    eslint_plugin_import_next_1.configs['flagship'],
+    eslint_plugin_pg_1.configs['flagship'],
+    eslint_plugin_secure_coding_1.configs['flagship'],
+    eslint_plugin_mongodb_security_1.configs['flagship'],
+    eslint_plugin_jwt_1.configs['flagship'],
+    eslint_plugin_browser_security_1.configs['flagship'],
+    eslint_plugin_react_features_1.configs['flagship'],
+    eslint_plugin_react_a11y_1.configs['flagship'],
+    eslint_plugin_vercel_ai_security_1.configs['flagship'],
+];
+/**
+ * Recommended preset for every security plugin. 10 plugins.
+ */
+exports.security = [
+    eslint_plugin_secure_coding_1.configs['recommended'],
+    eslint_plugin_node_security_1.configs['recommended'],
+    eslint_plugin_browser_security_1.configs['recommended'],
+    eslint_plugin_jwt_1.configs['recommended'],
+    eslint_plugin_pg_1.configs['recommended'],
+    eslint_plugin_mongodb_security_1.configs['recommended'],
+    eslint_plugin_express_security_1.configs['recommended'],
+    eslint_plugin_lambda_security_1.configs['recommended'],
+    eslint_plugin_nestjs_security_1.configs['recommended'],
+    eslint_plugin_vercel_ai_security_1.configs['recommended'],
+];
+/**
+ * Recommended preset for every code-quality plugin. 7 plugins.
+ */
+exports.quality = [
+    eslint_plugin_import_next_1.configs['recommended'],
+    eslint_plugin_conventions_1.configs['recommended'],
+    eslint_plugin_maintainability_1.configs['recommended'],
+    eslint_plugin_reliability_1.configs['recommended'],
+    eslint_plugin_operability_1.configs['recommended'],
+    eslint_plugin_modularity_1.configs['recommended'],
+    eslint_plugin_modernization_1.configs['recommended'],
+];
+/**
+ * Recommended preset for the React plugins. 2 plugins.
+ *
+ * Apply only to JSX/TSX files in consumer configs:
+ *
+ * ```js
+ * import { react } from '@interlace/eslint-config';
+ * export default [
+ *   ...react.map(c => ({ ...c, files: ['**\/*.{jsx,tsx}'] })),
+ * ];
+ * ```
+ */
+exports.react = [
+    eslint_plugin_react_features_1.configs['recommended'],
+    eslint_plugin_react_a11y_1.configs['recommended'],
+];
+/**
+ * Component-API preset — the mechanical R5/R6/R8/R18/R19 rules from the
+ * `interlace-component` skill. Opt-in: apply to packages that ship shared
+ * React components (design-system, `@interlace/ui`, marketing surfaces).
+ * Not included in `recommended` because the rules are too strict for
+ * application code that hasn't been migrated yet.
+ *
+ * ```js
+ * import { componentApi } from '@interlace/eslint-config';
+ * export default [
+ *   ...componentApi.map(c => ({ ...c, files: ['**\/*.{jsx,tsx}'] })),
+ * ];
+ * ```
+ */
+exports.componentApi = [
+    eslint_plugin_react_features_1.configs['componentApi'],
+];
+/**
+ * Full recommended preset — security + quality + react. 19 plugins.
+ *
+ * For most projects this is the right starting point:
+ *
+ * ```js
+ * import interlace from '@interlace/eslint-config';
+ * export default [
+ *   ...interlace.recommended,
+ *   { files: ['**\/*.test.ts'], rules: { 'secure-coding/no-hardcoded-credentials': 'off' } },
+ * ];
+ * ```
+ */
+exports.recommended = [
+    ...exports.security,
+    ...exports.quality,
+    ...exports.react,
+];
+/**
+ * Default export aggregates every named preset under one namespace so
+ * consumers can `import interlace from '@interlace/eslint-config'`.
+ */
+const presets = {
+    flagship: exports.flagship,
+    security: exports.security,
+    quality: exports.quality,
+    react: exports.react,
+    componentApi: exports.componentApi,
+    recommended: exports.recommended,
+};
+exports.default = presets;