@jameswyse/oxc-config 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 James Wyse
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,213 @@
+# @jameswyse/oxc-config
+
+Opinionated [Oxlint](https://oxc.rs/docs/guide/usage/linter.html) and [Oxfmt](https://oxc.rs/docs/guide/usage/formatter.html) configs for TypeScript and JavaScript projects. They combine Oxlint's native rules with custom rules for type and data safety, comment-free code, configuration ownership, import boundaries, server-action guards, test reliability and statement spacing.
+
+The rules aim to keep both people and coding agents on the same standards: parse external data at the seam, use named exports, never ship console logging, and let names, types and tests carry intent instead of comments. [The reference](REFERENCE.md) maps each standard to its rules and states what lint cannot check.
+
+Requires Node.js 22.23 or later. Supports Oxlint 1.86 or later, Oxfmt 0.71 or later and oxlint-tsgolint 7.0.2003 or later, within their current major versions.
+
+## Install
+
+```sh
+pnpm add -D @jameswyse/oxc-config oxlint oxfmt oxlint-tsgolint
+```
+
+The React profile uses `eslint-plugin-react-you-might-not-need-an-effect`, which declares an ESLint peer even though it runs under Oxlint. To skip installing ESLint with pnpm, add this to the project's `pnpm-workspace.yaml` before installing:
+
+```yaml
+autoInstallPeers: false
+peerDependencyRules:
+  ignoreMissing:
+    - eslint
+```
+
+`autoInstallPeers` affects every dependency in the workspace. No ESLint configuration is needed either way.
+
+## Configure
+
+Create `oxlint.config.ts` in the project root:
+
+```ts
+import { createLintConfig } from "@jameswyse/oxc-config/oxlint";
+
+export default createLintConfig();
+```
+
+Type-aware checking is on by default. It needs the project's `tsconfig.json` and `oxlint-tsgolint`, which uses TypeScript 7. Configurations that rely on removed options such as `baseUrl` need migrating first. For plain JavaScript or a TypeScript project that is not yet compatible, pass `typeAware: false`. Syntax and scope rules still run, and explicit `any` is still rejected.
+
+Create `oxfmt.config.ts` beside it:
+
+```ts
+import { formatConfig } from "@jameswyse/oxc-config/oxfmt";
+
+export default formatConfig;
+```
+
+Add the scripts:
+
+```json
+{
+  "scripts": {
+    "lint": "oxlint .",
+    "lint:fix": "oxlint --fix . && oxfmt . && oxlint .",
+    "format": "oxfmt .",
+    "format:check": "oxfmt --check ."
+  }
+}
+```
+
+Errors fail the run. Warnings mark patterns worth reviewing that have legitimate uses, so they report without blocking: dependency cycles, barrel and forwarding modules, `typeof` outside type guards, swallowed errors, boolean parameters on exported functions, pass-through functions, tests without a matching owner file and test timeout overrides. `lint:fix` formats after applying lint fixes, then lints again to confirm the result.
+
+## Select framework and runtime profiles
+
+Enable only the tools the project uses. Each profile accepts `true` for its default scope or an array of project-relative globs. `nextjs` takes application root directories instead of globs.
+
+```ts
+import { createLintConfig } from "@jameswyse/oxc-config/oxlint";
+
+export default createLintConfig({ react: true, vitest: true });
+```
+
+For a monorepo with separate server and browser packages:
+
+```ts
+import { createLintConfig } from "@jameswyse/oxc-config/oxlint";
+
+export default createLintConfig({
+  nextjs: ["apps/web"],
+  react: ["packages/ui/**/*.{ts,tsx}"],
+  node: ["packages/server/**/*.ts"],
+  vitest: ["**/*.{test,spec}.{ts,tsx}"],
+});
+```
+
+| Option     | Adds                                                                                                                                                                    |
+| ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `react`    | React and React Compiler rules, accessibility rules, effect-misuse rules, and e18e performance rules outside tests                                                      |
+| `nextjs`   | The React profile plus Next.js rules, with default exports allowed for `app` and `pages` entrypoints under each root                                                    |
+| `node`     | Node.js environment and rules                                                                                                                                           |
+| `vitest`   | Vitest rules; its globs join the shared test scope                                                                                                                      |
+| `jest`     | Jest rules; keep its scope separate from Vitest when both exist                                                                                                         |
+| `effect`   | Effect error-tag and service-import rules, for modules that use [Effect](https://effect.website)                                                                        |
+| `tests`    | Extra test globs, such as Playwright or Node tests, for the custom test rules                                                                                           |
+| `electron` | Electron security rules everywhere, and an import boundary keeping `electron` and `node:*` out of the renderer (`src/renderer/**` by default, or `{ renderer: [...] }`) |
+
+Default exports are also accepted where a tool loads them: config files, Storybook stories and `.storybook`, `sanity.cli`, GraphQL Codegen entrypoints and declaration files.
+
+In a monorepo, run Oxlint from each package with a `tsconfig.json`, or pass an existing lint tsconfig with `--tsconfig`.
+
+## Enforce project boundaries
+
+These options need the project to name its owners, so each is off until configured. Globs are relative to the directory Oxlint runs from.
+
+```ts
+import { createLintConfig } from "@jameswyse/oxc-config/oxlint";
+
+export default createLintConfig({
+  react: ["src/renderer/**"],
+  env: ["src/main/config.ts", "src/renderer/env.ts"],
+  boundaries: [
+    {
+      files: ["src/renderer/**"],
+      deny: ["electron", "node:*", "@main/**", "src/main/**"],
+      message: "Use the typed contextBridge API exposed by the preload process.",
+    },
+  ],
+  serverActionGuards: ["requireStaffPermission", "requireMember"],
+  clock: ["src/platform/clock.ts"],
+  random: ["src/platform/ids.ts"],
+});
+```
+
+- `env` lists the modules that may read `process.env` or `import.meta.env`. Other source files must receive parsed configuration. Config files and scripts are entrypoints and remain allowed.
+- `boundaries` rejects imports from `files` that match a `deny` glob. Bare specifiers match as written. Relative specifiers resolve to a project path first, so `../main/ipc` matches `src/main/**`. Type-only imports are allowed because they are erased. Use `ignore` to exclude files from a boundary's scope.
+- `serverActionGuards` requires every exported function in a `"use server"` module, and every inline `"use server"` function, to start by awaiting one of the named guards. Server-action modules must export each action where it is declared. A guard's name cannot prove it authorises the operation, so review the guard itself.
+- `clock` and `random` list the modules that may read the current time (`Date.now()`, argument-less `new Date()`) or generate random values and IDs (`Math.random()`, `crypto.randomUUID()`, `randomUUID`/`randomInt` from `node:crypto`). Other production code must receive them, so tests can control them without faking globals. Test files, parameter defaults such as `now = new Date()` and passing `Date.now` uncalled are allowed. Durations from `performance.now()` and secret generation are out of scope.
+
+## Share strict compiler settings
+
+The package exports `strict`, `noUncheckedIndexedAccess`, `exactOptionalPropertyTypes`, `noImplicitOverride` and `noFallthroughCasesInSwitch` as a base config. Extend it from the project's `tsconfig.json` and keep target, module and path settings local:
+
+```json
+{
+  "extends": "@jameswyse/oxc-config/tsconfig"
+}
+```
+
+In an existing project, `noUncheckedIndexedAccess` and `exactOptionalPropertyTypes` usually surface many type errors, so adopt them as a separate migration.
+
+## Add project-specific exceptions
+
+Append overrides to the returned config so its framework and test overrides stay active. Oxlint applies file overrides after top-level `rules`, so type-aware and framework rules can only be changed by a later override.
+
+```ts
+import { createLintConfig } from "@jameswyse/oxc-config/oxlint";
+
+const base = createLintConfig({ react: true, vitest: true });
+
+export default {
+  ...base,
+  ignorePatterns: [...base.ignorePatterns, "src/routeTree.gen.ts"],
+  overrides: [
+    ...base.overrides,
+    {
+      files: ["src/validation/**/*.ts"],
+      rules: {
+        "wyse/no-runtime-typeof": "off",
+        "wyse/no-unsafe-dictionary-type": "off",
+      },
+    },
+  ],
+};
+```
+
+Use this for validated input seams, real timer tests, external module mocks, framework-required default exports and generated files. Keep each exception to the smallest scope. Suppression comments that no longer suppress anything are errors.
+
+## Adjust the formatter
+
+The formatter uses 100 columns, two spaces, double quotes, semicolons and trailing commas. It sorts imports into value and type groups and sorts `package.json` scripts. To use single quotes or add a workspace import prefix:
+
+```ts
+import { formatConfig } from "@jameswyse/oxc-config/oxfmt";
+
+export default {
+  ...formatConfig,
+  singleQuote: true,
+  sortImports: {
+    ...formatConfig.sortImports,
+    internalPattern: ["@/", "#", "@my-workspace/"],
+  },
+};
+```
+
+Tailwind class sorting depends on the project's Tailwind version and stylesheet, so configure Oxfmt's `sortTailwindcss` option in the project.
+
+## Develop
+
+```sh
+pnpm install --frozen-lockfile
+pnpm check
+```
+
+`pnpm check` runs the rule tests, lints real consumer configs in temporary projects, checks type-aware diagnostics and formatter convergence, then lints, typechecks, checks formatting and builds `dist`.
+
+## Release
+
+Add a changeset to any pull request that should ship:
+
+```sh
+pnpm changeset
+```
+
+On `main`, the release workflow keeps a "chore(release): version packages" pull request up to date with the pending changesets. Merging it publishes the new version to npm with provenance, tags it and creates a GitHub release.
+
+## Vendored code
+
+Some code is adapted from other MIT-licensed projects. Each project's licence sits beside its code in `src/vendor`.
+
+- [anti-slop](https://github.com/dmmulroy/anti-slop): 17 rules and their shared helpers, in `src/vendor/anti-slop`.
+- [ESLint Stylistic](https://github.com/eslint-stylistic/eslint-stylistic): the `padding-line-between-statements` engine behind `statement-spacing`, in `src/vendor/eslint-stylistic`.
+
+## Licence
+
+[MIT](LICENSE).

package/REFERENCE.md

@@ -0,0 +1,134 @@
+# Rule reference
+
+## Defaults
+
+The base config enables Oxlint's correctness and suspicious categories as errors. It also enables strict equality, mandatory braces, `prefer-const`, no parameter reassignment, unused-variable checks that ignore `_`-prefixed bindings, import ordering and duplicate checks, the accumulating-spread check, named exports and no console logging. Unused suppression comments are errors. `no-underscore-dangle` is off so schema-owned fields such as `_id` and `__typename` remain valid.
+
+Warnings do not fail the run. The warning-level rules mark patterns that are usually worth changing but have legitimate uses that no syntax separates; each was measured on real codebases before it was added.
+
+## Standards and rules
+
+| Standard                                              | Implemented automation                                                                                                                                             | Limit                                                                                                                                                           |
+| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| No `any`; keep unknown external values at a seam      | `typescript/no-explicit-any`; type-aware `no-unsafe-*`; `no-unsafe-dictionary-type`, `no-known-value-widening`, `no-unknown-returns` and `no-unknown-type-aliases` | Legitimate parsers may need narrow exceptions; imported domain types require type-aware analysis                                                                |
+| Parse external data at a seam instead of probing it   | `wyse/no-runtime-typeof` warns about `typeof` outside type guards; `typeof x === "undefined"` probes are allowed                                                   | Narrowing a known primitive union with `typeof` is legitimate; the warning prompts a schema without blocking                                                    |
+| Prefer validated narrowing and `satisfies`            | Native `no-non-null-assertion`; type-aware `no-unsafe-type-assertion`, `no-unnecessary-type-assertion`; `no-chained-type-assertions` and `no-widen-then-assert`    | No syntactic rule proves a runtime schema or invariant correct                                                                                                  |
+| Guards have truthful, recognisable names              | Custom `wyse/type-guard-name`                                                                                                                                      | Names do not prove predicate correctness                                                                                                                        |
+| Handle every union case                               | Type-aware `typescript/switch-exhaustiveness-check`                                                                                                                | The compiler still owns `never` assignments and valid-state modelling                                                                                           |
+| Remove redundant guards and dead code                 | Correctness/suspicious categories; unused variables/private members; type-aware `no-unnecessary-condition`                                                         | Whether validation belongs at another seam needs review                                                                                                         |
+| Keep branches readable                                | Custom `wyse/no-deep-ternary`; native `curly`                                                                                                                      | Complexity, line count and parameter count are not used as design proxies                                                                                       |
+| Handle asynchronous work and errors                   | Native correctness/promise checks, `no-empty`, `no-useless-catch`; typed floating/misused promises, `await-thenable`, `return-await`, `only-throw-error`           | Meaningful recovery, domain results, retry policy and error context need review                                                                                 |
+| Represent expected failures instead of silencing them | Custom `wyse/no-swallowed-errors` (warning)                                                                                                                        | Parser, filesystem-probe and existing-promise catches are allowed; other expected failures need a suppression with a reason                                     |
+| Avoid boolean control parameters                      | Custom `wyse/explicit-api-states` (warning)                                                                                                                        | Final boolean parameters of `set*`/`update*` functions are allowed; a boolean that is domain data still warns                                                   |
+| Named exports and imports from an owner               | `import/no-default-export`, `first`, `no-duplicates`, `no-self-import`, `no-unassigned-import`; warnings from `import/no-cycle` and `oxc/no-barrel-file`           | Internal barrel ownership and public package entrypoints need architectural context; the barrel rule counts only `export *` fan-out above its default threshold |
+| Name files after their concept                        | Custom `wyse/no-generic-file-suffix`                                                                                                                               | Files named after a domain export, such as `agentPolicy.ts` exporting `AgentPolicy`, and standard header policies are allowed                                   |
+| Import from the authoritative module                  | Custom `wyse/no-forwarding-module` (warning)                                                                                                                       | Package entrypoints and framework route files are allowed; other frameworks' mandated re-export files may need an exception                                     |
+| Remove middle men                                     | Custom `wyse/no-pass-through-function` (warning)                                                                                                                   | Only identifier callees are checked, because method facades usually hide an instance                                                                            |
+| No shipped console logging                            | `eslint/no-console`; narrow config/script exceptions                                                                                                               | Redaction, sensitive fields and sufficient structured context need review                                                                                       |
+| Never add code comments                               | Custom `wyse/no-comments`; tool directives and JavaScript type JSDoc remain allowed                                                                                | Projects can allow further directive patterns; the rule cannot tell whether the removed intent reached a name, type, test or commit                             |
+| Parse configuration at startup                        | Custom `wyse/no-env-access` with the project's `env` owners                                                                                                        | Owners must be named by the project; the rule does not check that the owner validates what it reads                                                             |
+| Keep privileged modules out of other runtimes         | Custom `wyse/import-boundaries` from the project's `boundaries`                                                                                                    | Only static, dynamic-literal and re-export specifiers are checked; `require` and computed imports are not                                                       |
+| Enforce authorisation at the protected operation      | Custom `wyse/server-action-guard` with the project's `serverActionGuards`                                                                                          | A guard's name cannot prove it authorises the operation or checks the right resource                                                                            |
+| Control time and randomness                           | Custom `wyse/no-ambient-clock` and `wyse/no-ambient-random` with the project's `clock` and `random` owners                                                         | Production code only; owners must be named by the project                                                                                                       |
+| Harden Electron apps                                  | Custom `wyse/electron-*` rules and a renderer import boundary in the `electron` profile                                                                            | Checks literal `webPreferences`, `remote` usage and raw `ipcRenderer` exposure through `contextBridge`                                                          |
+| Prefer local state and avoid accidental mutation      | `prefer-const`, `no-param-reassign`; React immutability checks; typed `prefer-readonly`                                                                            | Local accumulator mutation is allowed; ownership is not inferred from a variable name                                                                           |
+| Avoid repeated growing copies                         | Native `oxc/no-accumulating-spread`; `no-array-filter-map` and `no-reduce-accumulator-copy`; optional e18e profile                                                 | No performance improvement is claimed without measurement                                                                                                       |
+| Avoid duplicate React state and effect chains         | React and React Compiler native rules; `react-you-might-not-need-an-effect` rules                                                                                  | Product interactions still need runtime verification                                                                                                            |
+| Basic accessible JSX                                  | Native `jsx-a11y` correctness/suspicious rules in the React profile                                                                                                | Keyboard behaviour, accessible names through custom components and visual contrast require application evidence                                                 |
+| Tests execute assertions and are not silently skipped | Native Jest/Vitest focused/disabled/conditional/standalone/valid expectation checks                                                                                | Valid helper-based assertions are allowed; assertion-count rules are not enabled blindly                                                                        |
+| Tests wait for observable outcomes                    | Custom `wyse/no-fixed-test-delay`                                                                                                                                  | Genuine timer tests need a scoped exception; unknown wait helpers are not guessed                                                                               |
+| Tests have a non-vacuous oracle                       | Custom `wyse/no-vacuous-test-assertions`                                                                                                                           | Independent expected results and meaningful behavioural coverage still need review                                                                              |
+| Tests protect behaviour, not edits                    | Custom `wyse/no-edit-proof-assertions`                                                                                                                             | Only existence checks of imports and `typeof … "function"` checks are recognised                                                                                |
+| Tests do not hide slow or flaky work                  | Custom `wyse/no-test-timeout-overrides` (warning, unit tests only)                                                                                                 | End-to-end suites legitimately need longer timeouts and are excluded                                                                                            |
+| Tests sit beside the module they cover                | Custom `wyse/companion-has-owner` (warning)                                                                                                                        | Cross-module tests should be named `<behaviour>.integration.test` or live under `tests/`                                                                        |
+| Avoid module mocking of runnable dependencies         | `wyse/no-module-mocking`                                                                                                                                           | External systems can justify a file-scoped exception                                                                                                            |
+| Consistent layout and imports                         | Oxfmt; custom `wyse/statement-spacing`                                                                                                                             | Blank lines are only required around imports, multiline blocks, multiline declarations and returns, so deliberate groups of one-line statements stay together   |
+
+`no-unnecessary-condition` is a nursery rule in Oxlint 1.86.0. It is enabled only with `typeAware`. The usual native nested-ternary rule conflicts with Oxfmt 0.71.0 because one tool adds parentheses and the other removes them. The custom depth rule allows one nested level and reports the third ternary level, without prescribing parentheses.
+
+## Custom rules
+
+All rules use Oxlint's supported AST and lexical scopes and their tests sit beside their source, in `src/rules` or, for rules adapted from anti-slop, `src/vendor/anti-slop`. Only `statement-spacing` has an autofix, which inserts blank lines; its engine is adapted from ESLint Stylistic's `padding-line-between-statements`. `companion-has-owner` and `no-forwarding-module` read sibling files and the nearest `package.json`. The others are dependency-free.
+
+| Rule                                    | Rejected pattern                                                                                                                                                                                                                                 | Allowed or outside scope                                                                                                                                                                                                                                                                  |
+| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `type-guard-name`                       | A named predicate such as `checkUser(value): value is User`                                                                                                                                                                                      | `isUser`, `hasId`, assertion functions, anonymous callbacks and computed method names                                                                                                                                                                                                     |
+| `no-deep-ternary`                       | A conditional expression nested inside two conditional expressions                                                                                                                                                                               | One nested level; a separate function's expressions start a new depth                                                                                                                                                                                                                     |
+| `no-fixed-test-delay`                   | Awaited literal timer delays and known Playwright fixture `waitForTimeout` calls in recognised tests                                                                                                                                             | Local functions that shadow timer/test names, nonliteral delays, and unknown custom helpers                                                                                                                                                                                               |
+| `no-vacuous-test-assertions`            | Literal-to-literal equality expectations or the same identifier on both sides of `toBe`, `toEqual`, `toStrictEqual`                                                                                                                              | Computed values, property getters, reversed meaningful expectations and promise resolution matchers                                                                                                                                                                                       |
+| `no-comments`                           | Line, block and JSDoc comments, including JSDoc in TypeScript files                                                                                                                                                                              | Shebangs, JSDoc with type tags in JavaScript files, and tool directives: lint suppressions, `@ts-expect-error`, triple-slash references, `#__PURE__`, formatter and coverage ignores, bundler magic comments, test-environment and JSX pragmas; extra patterns through the `allow` option |
+| `no-env-access`                         | `process.env`, `import.meta.env` and destructuring `env` from either, outside `env` owners, config files and scripts                                                                                                                             | Local bindings named `process` and unrelated `env` properties                                                                                                                                                                                                                             |
+| `import-boundaries`                     | A value import, re-export or literal dynamic import from a configured scope whose specifier or resolved relative path matches a `deny` glob                                                                                                      | Type-only imports and files outside the boundary's scope                                                                                                                                                                                                                                  |
+| `server-action-guard`                   | An exported action in a `"use server"` module, or an inline `"use server"` function, whose first statement does not await a configured guard; indirect or default exports from server-action modules                                             | Non-exported helpers in server-action modules and test files                                                                                                                                                                                                                              |
+| `statement-spacing`                     | A missing blank line after the imports, around a multiline block or a multiline declaration, including exported ones, or before `return`                                                                                                         | Consecutive imports, consecutive one-line statements, and a type alias directly after the multiline declaration it derives from                                                                                                                                                           |
+| `no-edit-proof-assertions`              | `toBeDefined`, `toBeTruthy` and similar on an imported binding or namespace member; `typeof X` or `toBeTypeOf` against a string on imports; `toBeTypeOf("function")` on anything; `toHaveProperty` on a namespace                                | Assertions on values produced by running code                                                                                                                                                                                                                                             |
+| `no-test-timeout-overrides`             | Per-test or per-suite timeout and retry options, `test.setTimeout`, `test.slow()`, `describe.configure`, `vi.setConfig` and `jest.setTimeout` in unit tests                                                                                      | End-to-end files under `e2e/` or named `*.e2e.*`                                                                                                                                                                                                                                          |
+| `companion-has-owner`                   | A `.test`, `.spec` or `.bench` file whose name prefix matches no sibling module or directory, nor its own directory                                                                                                                              | Files with an `integration` or `e2e` segment and files under `tests/`, `test/`, `__tests__/` or `e2e/`                                                                                                                                                                                    |
+| `no-generic-file-suffix`                | A file named `*Contract`, `*Policy`, `policy` or `contract` in camel, kebab, snake or dot form                                                                                                                                                   | Test and story files, standard header policies such as content security policy, and files exporting a binding with the file's name                                                                                                                                                        |
+| `no-forwarding-module`                  | A module made only of re-exports, or imports re-exported unchanged                                                                                                                                                                               | Package entrypoints in the nearest `package.json`, Next.js `app` special files and `pages`, root `middleware`/`proxy`/`instrumentation`, modules with directives or side-effect imports                                                                                                   |
+| `no-pass-through-function`              | A named function whose body only calls an identifier with exactly its own parameters, in order                                                                                                                                                   | Zero-parameter functions, method callees, type predicates and `useEffectEvent` callees                                                                                                                                                                                                    |
+| `explicit-api-states`                   | A `boolean`, optional `boolean`, or boolean-defaulted parameter on an exported function, exported class constructor or public method                                                                                                             | Destructured parameters, accessors, private members, overloads and the final boolean of a `set*`/`update*` function                                                                                                                                                                       |
+| `no-swallowed-errors`                   | A `catch` whose body only returns a fallback literal, and a `.catch` callback that is empty or returns one                                                                                                                                       | Built-in parser and filesystem-probe try blocks, `response.json()`, and `.catch` on a promise another caller also receives                                                                                                                                                                |
+| `no-ambient-clock`                      | `Date.now()` and argument-less `new Date()`, including through `globalThis`/`window`                                                                                                                                                             | Parameter defaults, uncalled `Date.now` and provider functions that only return the read                                                                                                                                                                                                  |
+| `no-ambient-random`                     | `Math.random()`, `crypto.randomUUID()`, and `randomUUID`/`randomInt` from `node:crypto`                                                                                                                                                          | The same injection seams; `randomBytes` and `getRandomValues`, which generate secrets                                                                                                                                                                                                     |
+| `electron-no-remote-module`             | `remote` from `electron`, and `@electron/remote` by import, `require`, dynamic import or re-export                                                                                                                                               | Other Electron APIs                                                                                                                                                                                                                                                                       |
+| `electron-secure-web-preferences`       | `webPreferences` without literal `contextIsolation: true`, `sandbox: true` and `nodeIntegration: false`, or with insecure web security, insecure content, experimental or Blink features; overrides through later keys, spreads or computed keys | Preferences passed from a variable the rule cannot resolve                                                                                                                                                                                                                                |
+| `electron-no-raw-ipc-renderer-exposure` | Exposing `ipcRenderer` or its methods through `contextBridge`, forwarding renderer-chosen channels or arguments, or passing renderer callbacks straight to `on`/`once`                                                                           | Narrow, named preload functions with fixed channels                                                                                                                                                                                                                                       |
+
+Test-specific custom rules run on the default test globs, `tests` paths and any explicit Jest or Vitest profile scopes. Their import and binding recognition is deliberately narrower than unrestricted text matching. The tests are the executable reference for supported aliases, shadowing and callback forms.
+
+## Type, data and test-double rules
+
+The base config also enables these rules as errors:
+
+```text
+no-array-filter-map
+no-reduce-accumulator-copy
+no-chained-type-assertions
+no-conditional-empty-object-spread
+no-known-value-widening
+no-module-mocking
+no-object-parameters
+no-reflect-apply
+no-reflect-get
+no-shape-in-symbol-names
+no-unknown-returns
+no-unknown-type-aliases
+no-unsafe-dictionary-type
+no-widen-then-assert
+```
+
+`no-runtime-typeof` is a warning with `allowInTypeGuards` enabled. Banning `typeof` outright blocks legitimate narrowing of known unions, while the warning still points towards parsing external data with a schema. Projects can turn it off at a validated input seam.
+
+The optional `effect` profile enables `no-manual-effect-error-tag` and `no-service-constructor-imports`.
+
+These rules do not have cross-file type knowledge. Their [source files](src/vendor/anti-slop/rules) and tests define the supported same-file alias, scope and inference cases. There is no blanket ban on legitimate `unknown` values or invariant-preserving `as const` expressions.
+
+## Project-specific automation
+
+These policies are enforced once a project names the actual owners. They are intentionally not universal defaults:
+
+| Policy                                        | Mechanism                                                        | Required project information                                                      |
+| --------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------------------------- |
+| Parse configuration at startup                | `env` option                                                     | Modules that own configuration parsing                                            |
+| Keep privileged modules out of other runtimes | `boundaries` option                                              | Each runtime's file scope, and the packages, aliases and paths it must not import |
+| Require access checks before server actions   | `serverActionGuards` option                                      | The guard functions that perform authorisation                                    |
+| Control time and randomness                   | `clock` and `random` options                                     | Modules that own the clock and ID or random generation                            |
+| Harden Electron apps                          | `electron` option                                                | Renderer globs when they are not `src/renderer/**`                                |
+| Generated assets and style imports            | Shared ignores plus local patterns; Oxfmt Tailwind configuration | Actual generators, CSS preprocessors, Tailwind config or stylesheet               |
+
+## Compiler settings and review work
+
+For new TypeScript projects, use `strict`, `noUncheckedIndexedAccess`, `exactOptionalPropertyTypes`, `noImplicitOverride` and `noFallthroughCasesInSwitch`. The package exports them as `@jameswyse/oxc-config/tsconfig` for a project's `tsconfig.json` to extend. Lint configuration never applies them, because changing them in an existing project is a deliberate migration.
+
+Lint cannot establish correct authorisation, tenant isolation, schema validation, secret redaction, transaction boundaries, idempotency, crash recovery, concurrency ownership, dependency justification, useful module depth, constructive domain modelling or independent test oracles. These remain review and verification work. File naming, positional parameters, boolean inputs, `Partial<T>`, wrappers and abstraction counts have legitimate domain/framework exceptions and are not rejected through universal heuristics.
+
+## Oxc API references
+
+The implementation follows the current [Oxlint configuration API](https://oxc.rs/docs/guide/usage/linter/config.html), [JS plugin API](https://oxc.rs/docs/guide/usage/linter/writing-js-plugins.html), [type-aware setup](https://oxc.rs/docs/guide/usage/linter/type-aware.html), and [Oxfmt options](https://oxc.rs/docs/guide/usage/formatter/config-file-reference.html). Absolute plugin specifiers keep imported configs independent of the consumer's working directory. Side-effect import sorting is explicitly disabled.
+
+## Rules considered and dropped
+
+`no-call-count-assertions` would have rejected `toHaveBeenCalledTimes`, `toHaveBeenNthCalledWith` and `mock.calls` counting. On three codebases, 36 of 40 sampled findings were legitimate: the count was the behaviour under test, such as caching, retry, deduplication or firing once. No syntax separated them from incidental counts, so it was dropped.
+
+Rules for safety comments on type assertions, a blank line between every top-level statement, and rejecting `unknown` parameters are not included. The first conflicts with `no-comments`, the second split deliberate groups of related declarations, and the third rejected legitimate unparsed input seams. Effect rules that reject `_tag` comparisons, prefer `Match` or reject literal tagged construction are not included either, because discriminant checks are the preferred way to narrow a union and TypeScript already checks literal variants.

package/dist/format.d.ts

@@ -0,0 +1,5 @@
+import type { OxfmtConfig, SortImportsConfig } from "oxfmt";
+export declare const formatConfig: OxfmtConfig & {
+    ignorePatterns: string[];
+    sortImports: SortImportsConfig;
+};

package/dist/format.js

@@ -0,0 +1,47 @@
+import { defaultIgnores } from "./lint.js";
+export const formatConfig = {
+    printWidth: 100,
+    tabWidth: 2,
+    useTabs: false,
+    semi: true,
+    singleQuote: false,
+    jsxSingleQuote: false,
+    trailingComma: "all",
+    bracketSpacing: true,
+    arrowParens: "always",
+    endOfLine: "lf",
+    ignorePatterns: defaultIgnores,
+    sortImports: {
+        internalPattern: ["@/", "~/", "#"],
+        sortSideEffects: false,
+        groups: [
+            "value-builtin",
+            "next-libs",
+            "react-libs",
+            "value-external",
+            "value-internal",
+            ["value-parent", "value-sibling", "value-index"],
+            "type-builtin",
+            "type-external",
+            "type-internal",
+            ["type-parent", "type-sibling", "type-index"],
+            "unknown",
+            "style",
+        ],
+        customGroups: [
+            {
+                groupName: "next-libs",
+                elementNamePattern: ["next", "next/*"],
+                modifiers: ["value"],
+                selector: "external",
+            },
+            {
+                groupName: "react-libs",
+                elementNamePattern: ["react", "react-dom", "react-dom/*"],
+                modifiers: ["value"],
+                selector: "external",
+            },
+        ],
+    },
+    sortPackageJson: { sortScripts: true },
+};

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+declare const wyse: import("@oxlint/plugins").Plugin;
+export default wyse;

package/dist/index.js

@@ -0,0 +1,97 @@
+import { readFileSync } from "node:fs";
+import { definePlugin } from "@oxlint/plugins";
+import { companionHasOwner } from "./rules/companion-has-owner.js";
+import { electronNoRawIpcRendererExposure } from "./rules/electron-no-raw-ipc-renderer-exposure.js";
+import { electronNoRemoteModule } from "./rules/electron-no-remote-module.js";
+import { electronSecureWebPreferences } from "./rules/electron-secure-web-preferences.js";
+import { explicitApiStates } from "./rules/explicit-api-states.js";
+import { importBoundaries } from "./rules/import-boundaries.js";
+import { noAmbientClock } from "./rules/no-ambient-clock.js";
+import { noAmbientRandom } from "./rules/no-ambient-random.js";
+import { noComments } from "./rules/no-comments.js";
+import { noDeepTernary } from "./rules/no-deep-ternary.js";
+import { noEditProofAssertions } from "./rules/no-edit-proof-assertions.js";
+import { noEnvAccess } from "./rules/no-env-access.js";
+import { noFixedTestDelay } from "./rules/no-fixed-test-delay.js";
+import { noForwardingModule } from "./rules/no-forwarding-module.js";
+import { noGenericFileSuffix } from "./rules/no-generic-file-suffix.js";
+import { noPassThroughFunction } from "./rules/no-pass-through-function.js";
+import { noSwallowedErrors } from "./rules/no-swallowed-errors.js";
+import { noTestTimeoutOverrides } from "./rules/no-test-timeout-overrides.js";
+import { noVacuousTestAssertions } from "./rules/no-vacuous-test-assertions.js";
+import { serverActionGuard } from "./rules/server-action-guard.js";
+import { statementSpacing } from "./rules/statement-spacing.js";
+import { typeGuardName } from "./rules/type-guard-name.js";
+import { noManualEffectErrorTag } from "./vendor/anti-slop/effect/rules/no-manual-effect-error-tag.js";
+import { noServiceConstructorImports } from "./vendor/anti-slop/effect/rules/no-service-constructor-imports.js";
+import { noArrayFilterMap } from "./vendor/anti-slop/rules/no-array-filter-map.js";
+import { noChainedTypeAssertions } from "./vendor/anti-slop/rules/no-chained-type-assertions.js";
+import { noConditionalEmptyObjectSpread } from "./vendor/anti-slop/rules/no-conditional-empty-object-spread.js";
+import { noKnownValueWidening } from "./vendor/anti-slop/rules/no-known-value-widening.js";
+import { noModuleMocking } from "./vendor/anti-slop/rules/no-module-mocking.js";
+import { noObjectParameters } from "./vendor/anti-slop/rules/no-object-parameters.js";
+import { noReduceAccumulatorCopy } from "./vendor/anti-slop/rules/no-reduce-accumulator-copy.js";
+import { noReflectApply } from "./vendor/anti-slop/rules/no-reflect-apply.js";
+import { noReflectGet } from "./vendor/anti-slop/rules/no-reflect-get.js";
+import { noRuntimeTypeof } from "./vendor/anti-slop/rules/no-runtime-typeof.js";
+import { noForbiddenTermInSymbolNames } from "./vendor/anti-slop/rules/no-shape-in-symbol-names.js";
+import { noUnknownReturns } from "./vendor/anti-slop/rules/no-unknown-returns.js";
+import { noUnknownTypeAliases } from "./vendor/anti-slop/rules/no-unknown-type-aliases.js";
+import { noUnsafeDictionaryType } from "./vendor/anti-slop/rules/no-unsafe-dictionary-type.js";
+import { noWidenThenAssert } from "./vendor/anti-slop/rules/no-widen-then-assert.js";
+function packageVersion() {
+    const manifest = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    if (typeof manifest === "object" &&
+        manifest !== null &&
+        "version" in manifest &&
+        typeof manifest.version === "string") {
+        return manifest.version;
+    }
+    throw new TypeError("The package manifest has no version.");
+}
+const meta = { name: "wyse", version: packageVersion() };
+const wyse = definePlugin({
+    meta,
+    rules: {
+        "companion-has-owner": companionHasOwner,
+        "electron-no-raw-ipc-renderer-exposure": electronNoRawIpcRendererExposure,
+        "electron-no-remote-module": electronNoRemoteModule,
+        "electron-secure-web-preferences": electronSecureWebPreferences,
+        "explicit-api-states": explicitApiStates,
+        "import-boundaries": importBoundaries,
+        "no-ambient-clock": noAmbientClock,
+        "no-ambient-random": noAmbientRandom,
+        "no-array-filter-map": noArrayFilterMap,
+        "no-chained-type-assertions": noChainedTypeAssertions,
+        "no-comments": noComments,
+        "no-conditional-empty-object-spread": noConditionalEmptyObjectSpread,
+        "no-deep-ternary": noDeepTernary,
+        "no-edit-proof-assertions": noEditProofAssertions,
+        "no-env-access": noEnvAccess,
+        "no-fixed-test-delay": noFixedTestDelay,
+        "no-forwarding-module": noForwardingModule,
+        "no-generic-file-suffix": noGenericFileSuffix,
+        "no-known-value-widening": noKnownValueWidening,
+        "no-manual-effect-error-tag": noManualEffectErrorTag,
+        "no-module-mocking": noModuleMocking,
+        "no-object-parameters": noObjectParameters,
+        "no-pass-through-function": noPassThroughFunction,
+        "no-reduce-accumulator-copy": noReduceAccumulatorCopy,
+        "no-reflect-apply": noReflectApply,
+        "no-reflect-get": noReflectGet,
+        "no-runtime-typeof": noRuntimeTypeof,
+        "no-service-constructor-imports": noServiceConstructorImports,
+        "no-shape-in-symbol-names": noForbiddenTermInSymbolNames,
+        "no-swallowed-errors": noSwallowedErrors,
+        "no-test-timeout-overrides": noTestTimeoutOverrides,
+        "no-unknown-returns": noUnknownReturns,
+        "no-unknown-type-aliases": noUnknownTypeAliases,
+        "no-unsafe-dictionary-type": noUnsafeDictionaryType,
+        "no-vacuous-test-assertions": noVacuousTestAssertions,
+        "no-widen-then-assert": noWidenThenAssert,
+        "server-action-guard": serverActionGuard,
+        "statement-spacing": statementSpacing,
+        "type-guard-name": typeGuardName,
+    },
+});
+export default wyse;

package/dist/lint.d.ts

@@ -0,0 +1,33 @@
+import type { DummyRuleMap, OxlintConfig, OxlintOverride } from "oxlint";
+export type FileScope = boolean | string[];
+export interface LintOptions {
+    typeAware?: boolean;
+    node?: FileScope;
+    react?: FileScope;
+    nextjs?: FileScope;
+    vitest?: FileScope;
+    jest?: FileScope;
+    effect?: FileScope;
+    tests?: string[];
+    env?: [string, ...string[]];
+    boundaries?: ImportBoundary[];
+    serverActionGuards?: [string, ...string[]];
+    clock?: [string, ...string[]];
+    random?: [string, ...string[]];
+    electron?: boolean | {
+        renderer?: string[];
+    };
+}
+export interface ImportBoundary {
+    files: string[];
+    ignore?: string[];
+    deny: string[];
+    message: string;
+}
+export type SharedLintConfig = OxlintConfig & {
+    ignorePatterns: string[];
+    overrides: OxlintOverride[];
+    rules: DummyRuleMap;
+};
+export declare const defaultIgnores: string[];
+export declare function createLintConfig({ typeAware, node, react, nextjs, vitest, jest, effect, tests, env, boundaries, serverActionGuards, clock, random, electron, }?: LintOptions): SharedLintConfig;