@ploaness/config 1.0.0

package/package.json

@@ -0,0 +1,117 @@
+{
+  "name": "@ploaness/config",
+  "version": "1.0.0",
+  "description": "Analyzer and tool configurations owned by ploaness: ESLint, Biome, TypeScript, Vitest, Stylelint, dependency-cruiser, knip.",
+  "license": "MIT",
+  "author": "Herman Ciechanowiec <herman@ciechanowiec.eu>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ciechanowiec/ploaness.git",
+    "directory": "packages/config"
+  },
+  "homepage": "https://github.com/ciechanowiec/ploaness#readme",
+  "bugs": {
+    "url": "https://github.com/ciechanowiec/ploaness/issues"
+  },
+  "type": "module",
+  "exports": {
+    "./eslint": {
+      "types": "./dist/eslint.d.ts",
+      "default": "./dist/eslint.js"
+    },
+    "./vitest": {
+      "types": "./dist/vitest.d.ts",
+      "default": "./dist/vitest.js"
+    },
+    "./biome": "./biome.json",
+    "./tsconfig": "./tsconfig.json",
+    "./stylelint": "./stylelint.json",
+    "./dependency-cruiser": "./dependency-cruiser.json",
+    "./knip": "./knip.json",
+    "./package.json": "./package.json",
+    "./eslint-core": {
+      "types": "./dist/eslint-core.d.ts",
+      "default": "./dist/eslint-core.js"
+    },
+    "./vitest-core": {
+      "types": "./dist/vitest-core.d.ts",
+      "default": "./dist/vitest-core.js"
+    },
+    "./playwright": {
+      "types": "./dist/playwright.d.ts",
+      "default": "./dist/playwright.js"
+    },
+    "./a11y": {
+      "types": "./dist/a11y.d.ts",
+      "default": "./dist/a11y.js"
+    },
+    "./access": {
+      "types": "./dist/access.d.ts",
+      "default": "./dist/access.js"
+    },
+    "./pins": "./pins.json",
+    "./biome-core": "./biome-core.json",
+    "./tsconfig-core": "./tsconfig-core.json",
+    "./tsconfig-core.json": "./tsconfig-core.json",
+    "./eslint-library": {
+      "types": "./dist/eslint-library.d.ts",
+      "default": "./dist/eslint-library.js"
+    },
+    "./vitest-library": {
+      "types": "./dist/vitest-library.d.ts",
+      "default": "./dist/vitest-library.js"
+    }
+  },
+  "files": [
+    "dist",
+    "biome.json",
+    "dependency-cruiser-core.json",
+    "dependency-cruiser.json",
+    "knip.json",
+    "pins.json",
+    "stylelint.json",
+    "tsconfig.json",
+    "biome-core.json",
+    "tsconfig-core.json"
+  ],
+  "dependencies": {
+    "@axe-core/playwright": "4.13.0",
+    "@eslint-community/eslint-plugin-eslint-comments": "4.7.2",
+    "@eslint/js": "10.0.1",
+    "@playwright/test": "1.62.1",
+    "@ploaness/governance": "1.0.0",
+    "@testing-library/jest-dom": "7.0.1",
+    "@testing-library/react": "16.3.3",
+    "@testing-library/user-event": "14.6.6",
+    "@vitejs/plugin-react": "6.1.1",
+    "@vitest/eslint-plugin": "1.6.27",
+    "eslint": "10.9.1",
+    "eslint-config-prettier": "10.1.8",
+    "eslint-plugin-functional": "10.0.0",
+    "eslint-plugin-jsdoc": "64.2.1",
+    "eslint-plugin-jsx-a11y": "6.10.2",
+    "eslint-plugin-regexp": "3.2.0",
+    "eslint-plugin-sonarjs": "4.2.0",
+    "eslint-plugin-testing-library": "7.16.2",
+    "eslint-plugin-unicorn": "73.0.0",
+    "fast-check": "4.9.0",
+    "globals": "17.11.0",
+    "jsdom": "30.0.1",
+    "stylelint-config-standard": "40.0.0",
+    "typescript-eslint": "8.68.0",
+    "vitest": "4.1.11"
+  },
+  "engines": {
+    "node": ">=26"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@types/node": "26.4.0",
+    "typescript": "6.0.3"
+  },
+  "scripts": {
+    "build": "tsc --build tsconfig.build.json"
+  }
+}

package/pins.json

@@ -0,0 +1,52 @@
+{
+  "$comment": "Everything ploaness pins that it cannot pin by declaring a dependency. A pinned analyzer is a real dependency of a ploaness package, so its version has exactly one source; nothing here can be, because ploaness imports none of it and declaring it would install a second Payload, Next, React, or set of type definitions into a project that already has one - and two copies of @types/react in a single tree is not merely waste, it is a class of type error that reads as the project's fault. This file is that one source instead. It is data rather than code: a group carries the rule that applies to it, so adding one needs no change anywhere else.",
+  "$required": "A group states the member KINDS that must declare it. A kind is derived from what a package declares - Payload, or Next, or neither - never from what it says about itself. The split matters because a workspace holds packages that are not all applications: requiring a shared library to declare Payload would manufacture a dependency the dead-code gate then rightly reports as unused, and requiring a Next frontend to declare Payload would make ploaness dictate an architecture rather than a version. A group required by no kind is matched when a package declares it and forced on nobody, which is how ploaness owns the version of a Postgres driver without deciding that every governed project uses Postgres.",
+  "packageManager": "pnpm@11.9.0",
+  "$engines": "Only `node` is stated here. The pnpm entry is derived from `packageManager` above, because Corepack reads one field and an installer reads the other and two literals for one version will not stay equal - these two had already stopped agreeing in meaning, an exact `pnpm@11.9.0` beside a `>=11` floor.",
+  "engines": {
+    "node": ">=26"
+  },
+  "groups": [
+    {
+      "name": "payload",
+      "requiredFor": ["payload"],
+      "why": "The Payload application itself, and the two packages Payload declares as peers. Only a member that IS a Payload application needs any of them; a frontend reading that application over HTTP needs none.",
+      "versions": {
+        "payload": "3.88.0",
+        "sharp": "0.35.4",
+        "graphql": "16.14.2"
+      }
+    },
+    {
+      "name": "web",
+      "requiredFor": ["payload", "application"],
+      "why": "What any Next application renders with, whether or not Payload is mounted inside it. A public frontend has the same build, the same client bundle and the same React version to agree about.",
+      "versions": {
+        "next": "16.3.3",
+        "react": "19.2.8",
+        "react-dom": "19.2.8",
+        "@types/react": "19.2.18",
+        "@types/react-dom": "19.2.5"
+      }
+    },
+    {
+      "name": "runtime-types",
+      "requiredFor": ["payload", "application", "library"],
+      "why": "The definitions describing the runtime every governed package compiles against. Pinned for the toolchain's reason rather than the framework's: a type package is an input to tsc, so a patch release changes what type-checks while the project stays unchanged.",
+      "versions": {
+        "@types/node": "26.4.0"
+      }
+    },
+    {
+      "name": "ecosystem",
+      "why": "Packages a Payload project commonly reaches for, none of which every project needs: a database driver and its types, a loader for .env, a cross-platform way to set a variable in a package script, and the bundler a project reaches for when it runs Storybook or a Vite build. ploaness owns the version of each so no two governed projects disagree about one, and forces none of them on a project that has no use for it. Being popular is not what earns a place here, or this list would become a catalogue of every library a project might like: a package belongs when its version can change what a gate decides, or when a second copy of it in one tree is a defect rather than waste. `vite` is the clearest case of the second. ploaness's own vitest and React plugin resolve a vite of their own, so a project declaring a different one installs two - and @vitejs/plugin-react declares vite as a PEER, which makes the mismatch a loading failure rather than mere duplication. ploaness cannot close that by declaring vite itself, because under the strict layout a project's own build cannot reach ploaness's copy; only the project can declare the instance its build loads, which is exactly what a pin is for.",
+      "versions": {
+        "pg": "8.23.0",
+        "@types/pg": "8.23.1",
+        "dotenv": "17.4.2",
+        "cross-env": "10.1.0",
+        "vite": "8.2.2"
+      }
+    }
+  ]
+}

package/stylelint.json

@@ -0,0 +1,49 @@
+{
+  "extends": ["stylelint-config-standard"],
+  "ignoreFiles": ["coverage/**", ".next/**", "node_modules/**"],
+  "defaultSeverity": "error",
+  "reportDescriptionlessDisables": true,
+  "reportNeedlessDisables": true,
+  "reportInvalidScopeDisables": true,
+  "$comment": "at-rule-no-unknown lists the Tailwind v4 at-rules because they are a CSS dialect a Payload project may legitimately be written in, not a carve-out for one repository's files. A project that uses no Tailwind never writes one, so the list costs it nothing, and a typo such as @theem still fails. The whole list is named rather than the subset one project happened to need: a missing entry sends the next project back to a config file it is not allowed to own, which is the wall this list exists to remove. import-notation follows for the same reason and is not a relaxation - Tailwind v4 mandates the string form (@import \"tailwindcss\"), so the url form the standard config wants cannot be written at all; the rule still enforces one notation, and the one it enforces is now the one that can exist. lightness-notation and hue-degree-notation are set to the NUMBER form rather than turned off, for the same reason the at-rules above are listed: ploaness admits Tailwind deliberately, and the generator most Tailwind projects theme with writes oklch(1 0 0) rather than oklch(100% 0deg). Demanding the percentage form failed every such project on CSS it never hand-wrote. One notation is still enforced; it is now the one that can actually exist. selector-id-pattern keeps kebab-case for every id a project names and admits the double-underscore roots a framework mounts into - Next renders #__next, and a stylesheet that has to reach it cannot rename it. Turning the rule off would have surrendered the ids a project does choose.",
+  "rules": {
+    "at-rule-no-unknown": [
+      true,
+      {
+        "ignoreAtRules": [
+          "apply",
+          "config",
+          "custom-variant",
+          "plugin",
+          "reference",
+          "slot",
+          "source",
+          "tailwind",
+          "theme",
+          "utility",
+          "variant"
+        ]
+      }
+    ],
+    "import-notation": "string",
+    "selector-pseudo-class-no-unknown": [
+      true,
+      {
+        "ignorePseudoClasses": ["global", "local"]
+      }
+    ],
+    "custom-property-pattern": null,
+    "selector-class-pattern": null,
+    "no-descending-specificity": null,
+    "rule-empty-line-before": null,
+    "at-rule-empty-line-before": null,
+    "comment-empty-line-before": null,
+    "declaration-empty-line-before": null,
+    "custom-property-empty-line-before": null,
+    "declaration-block-single-line-max-declarations": null,
+    "value-keyword-case": null,
+    "lightness-notation": "number",
+    "hue-degree-notation": "number",
+    "selector-id-pattern": "^(__[a-zA-Z0-9]+|[a-z][a-z0-9]*(-[a-z0-9]+)*)$"
+  }
+}

package/tsconfig-core.json

@@ -0,0 +1,34 @@
+{
+  "$comment": "Every compiler setting ploaness owns, with nothing that assumes a framework. The sibling tsconfig.json adds the Next language-service plugin and nothing else, so a member with no Next application inherits the identical strictness rather than a second copy of it that could drift.",
+  "$comment-types": "A member extending this one runs on node and nothing else - ploaness requires node 26 and ESM - so it is told so. Left unset, a tooling member could not compile `import { readFileSync } from 'node:fs'`: automatic @types discovery does not reach the package under pnpm's layout, and a Next member never noticed because next-env.d.ts pulls the node types in behind it. ploaness declares exactly this in every one of its own package tsconfigs and did not ship it.",
+  "compilerOptions": {
+    "types": ["node"],
+    "lib": ["DOM", "DOM.Iterable", "ES2022"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "incremental": true,
+    "noImplicitOverride": true,
+    "noFallthroughCasesInSwitch": true,
+    "noImplicitReturns": true,
+    "useUnknownInCatchVariables": true,
+    "allowUnreachableCode": false,
+    "allowUnusedLabels": false,
+    "forceConsistentCasingInFileNames": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noUncheckedIndexedAccess": true,
+    "exactOptionalPropertyTypes": true,
+    "noPropertyAccessFromIndexSignature": true,
+    "noUncheckedSideEffectImports": true,
+    "verbatimModuleSyntax": true,
+    "target": "ES2022"
+  }
+}

package/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "$comment": "The framework-shaped half: tsconfig-core.json carries the strictness, this adds what only a Next application needs.",
+  "extends": "./tsconfig-core.json",
+  "compilerOptions": {
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ]
+  }
+}