@rdjperron/lint 0.1.0 → 0.2.0

package/dist/verify.mjs

@@ -0,0 +1,400 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+import { spawnSync } from "node:child_process";
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, rmdirSync, symlinkSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+//#region src/verify.ts
+/**
+* Proof that every lint rule still fires.
+*
+* The linter lives inside the `vp` binary, so it moves independently of any
+* lockfile, and the JS-plugin bridge it loads these rules through is alpha. A
+* rule can stop firing with no diff anywhere, and a dead lint rule is silent:
+* "reports nothing" looks exactly like "no violations". This is the thing that
+* notices.
+*
+* A suite is a directory holding one deliberately-broken `<rule>.fixture.ts(x)`
+* per rule. The check asserts a positive: every rule fired, each on the file
+* named after it.
+*
+* Run the package's own suite from a consumer's repo root:
+*
+*     npx rdj-lint-verify
+*
+* ---------------------------------------------------------------------------
+* Why the symlink dance
+* ---------------------------------------------------------------------------
+* The fixtures ship inside `node_modules`, which oxlint never walks, and a
+* consumer's own fixture directories are usually in `lint.ignorePatterns` so a
+* plain `vp check` stays quiet. Measured on Vite+ 0.2.9 / oxlint 1.77.0 and
+* again on 0.3.1 / oxlint 1.81.0: no flag re-includes an ignored path.
+* `--no-ignore`, `--ignore-pattern '!<dir>/**'`, an explicit file, an absolute
+* path, a cwd inside the directory and `-W <rule>` all answer "No files found
+* to lint." `--no-ignore` only disables `.eslintignore`, `--ignore-path` and
+* `--ignore-pattern`; it does not touch the config's own `ignorePatterns`, and
+* `vp lint` has no `--config` flag.
+*
+* What does work: oxlint matches ignore patterns against the path it walked,
+* not the realpath. Linting through a symlink outside the ignored prefix
+* reaches the fixtures normally, plugin and all. This creates that view per
+* suite, lints through it, and removes it in a `finally`.
+*
+* The severities cannot come from the command line either: `-A`, `-W` and `-D`
+* reach built-in rules only and leave every JS plugin rule exactly as the config
+* left it (measured on vite-plus 0.3.1 / oxlint 1.81.0, with `vp lint` and with
+* the bare binary). That is why the consumer's config must carry the
+* `fixtures()` override from `@rdjperron/lint/config`.
+*/
+const DEFAULT_SUFFIXES = [".fixture.ts", ".fixture.tsx"];
+/** Deterministic, locale-independent ordering for the rule and file name lists. */
+function byName(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+function basename(path) {
+	const parts = path.split(/[\\/]/u);
+	return parts[parts.length - 1] ?? path;
+}
+/**
+* Locate the `vp` binary: PATH first, then the default install locations, the
+* XDG layout used since Vite+ 0.3.0 and the pre-0.3.0 single-root layout that
+* upgraded installs keep.
+*/
+function resolveViteplusBinary() {
+	if (spawnSync("vp", ["--version"], { encoding: "utf8" }).status === 0) return "vp";
+	const home = process.env.HOME ?? "";
+	const found = [join(home, ".local", "share", "vite-plus", "bin", "vp"), join(home, ".vite-plus", "bin", "vp")].find((candidate) => existsSync(candidate));
+	if (found !== void 0) return found;
+	throw new Error("Could not find the `vp` binary. Add it to PATH: export PATH=\"$HOME/.local/share/vite-plus/bin:$PATH\" (or \"$HOME/.vite-plus/bin\" for a pre-0.3.0 install)");
+}
+/**
+* `vp lint -f json` is an outside value, so this is the one place its shape is
+* checked. Anything that does not look like a diagnostic is dropped rather than
+* guessed at.
+*/
+function decodeReport(json) {
+	const parsed = JSON.parse(json);
+	if (typeof parsed !== "object" || parsed === null) throw new Error("`vp lint -f json` did not return an object.");
+	const report = parsed;
+	const numberOfFiles = typeof report.number_of_files === "number" ? report.number_of_files : 0;
+	const rows = Array.isArray(report.diagnostics) ? report.diagnostics : [];
+	const diagnostics = [];
+	for (const row of rows) {
+		if (typeof row !== "object" || row === null) continue;
+		const entry = row;
+		diagnostics.push({
+			code: typeof entry.code === "string" ? entry.code : "",
+			filename: typeof entry.filename === "string" ? entry.filename : ""
+		});
+	}
+	return {
+		numberOfFiles,
+		diagnostics
+	};
+}
+/** Run `vp lint <target> -f json` from `root` and return the decoded report. */
+function lintAsJson(binary, root, target) {
+	const result = spawnSync(binary, [
+		"lint",
+		target,
+		"-f",
+		"json",
+		"--no-error-on-unmatched-pattern"
+	], {
+		cwd: root,
+		encoding: "utf8",
+		maxBuffer: 67108864
+	});
+	if (result.error !== void 0 && result.error !== null) throw result.error;
+	const stdout = result.stdout ?? "";
+	const start = stdout.indexOf("{");
+	if (start === -1) throw new Error(`\`vp lint ${target} -f json\` produced no JSON.\nstdout: ${stdout}\nstderr: ${result.stderr ?? ""}`);
+	try {
+		return decodeReport(stdout.slice(start));
+	} catch (cause) {
+		const reason = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`Could not read \`vp lint\` JSON output: ${reason}\nstdout: ${stdout}`, { cause });
+	}
+}
+/**
+* Why a path is gitignored, or null. oxlint honours `.gitignore`, so a
+* gitignored view yields "0 files" instead of a useful diagnostic.
+*/
+function gitIgnoreReason(root, relPath) {
+	const result = spawnSync("git", [
+		"check-ignore",
+		"-v",
+		relPath
+	], {
+		cwd: root,
+		encoding: "utf8"
+	});
+	const output = result.status === 0 ? result.stdout.trim() : "";
+	return output === "" ? null : output.split("	")[0] ?? null;
+}
+/** Rule name to fixture file name, taken from the files that exist on disk. */
+function fixtureFiles(root, suite) {
+	const dir = join(root, suite.fixtureDir);
+	if (!existsSync(dir)) throw new Error(`Fixture directory is missing: ${dir}`);
+	const suffixes = suite.suffixes ?? DEFAULT_SUFFIXES;
+	const files = /* @__PURE__ */ new Map();
+	for (const name of readdirSync(dir).toSorted(byName)) {
+		const suffix = suffixes.find((candidate) => name.endsWith(candidate));
+		if (suffix === void 0) continue;
+		files.set(name.slice(0, -suffix.length), name);
+	}
+	return files;
+}
+/** Create the un-ignored view; prefer a symlink, fall back to a copy on Windows. */
+function createFixtureView(root, suite) {
+	removeFixtureView(root, suite);
+	const viewPath = join(root, suite.viewDir);
+	mkdirSync(dirname(viewPath), { recursive: true });
+	try {
+		symlinkSync(join(root, suite.fixtureDir), viewPath, "junction");
+		return "symlink";
+	} catch {
+		cpSync(join(root, suite.fixtureDir), viewPath, { recursive: true });
+		return "copy";
+	}
+}
+function removeFixtureView(root, suite) {
+	const viewPath = join(root, suite.viewDir);
+	rmSync(viewPath, {
+		recursive: true,
+		force: true
+	});
+	const top = resolve(root);
+	for (let dir = dirname(viewPath); dir !== top; dir = dirname(dir)) {
+		if (!existsSync(dir) || readdirSync(dir).length > 0) break;
+		rmdirSync(dir);
+	}
+}
+/** `rdj(no-reflect-get)` -> `no-reflect-get` for this suite's plugin; anything else -> null. */
+function ruleIdFor(plugin, code) {
+	const match = new RegExp(`^${plugin}\\(([^)]+)\\)$`, "u").exec(code);
+	return match === null ? null : match[1] ?? null;
+}
+/** Lint one suite and print its table. Returns the number of rules that did not fire. */
+async function verifySuite(binary, root, suite) {
+	const files = fixtureFiles(root, suite);
+	const expectedRules = [...files.keys()];
+	console.log(`${suite.plugin} rule verification`);
+	console.log(`  fixtures:  ${suite.fixtureDir}`);
+	if (expectedRules.length === 0) {
+		console.error(`  No fixture files found in ${suite.fixtureDir}. Nothing to verify.\n`);
+		return 1;
+	}
+	let mechanism = "direct path";
+	let report = suite.alwaysView === true ? {
+		numberOfFiles: 0,
+		diagnostics: []
+	} : lintAsJson(binary, root, suite.fixtureDir);
+	if (report.numberOfFiles === 0) {
+		const kind = createFixtureView(root, suite);
+		try {
+			mechanism = `${kind} at ${suite.viewDir} (\`${suite.fixtureDir}\` is not walked by \`vp lint\`)`;
+			report = lintAsJson(binary, root, suite.viewDir);
+		} finally {
+			removeFixtureView(root, suite);
+		}
+	}
+	console.log(`  lint via:  ${mechanism}`);
+	console.log(`  files:     ${report.numberOfFiles}`);
+	console.log("");
+	if (report.numberOfFiles === 0) {
+		const ignoredBy = gitIgnoreReason(root, suite.viewDir);
+		console.error("FAIL: `vp lint` matched 0 files through both the direct path and the un-ignored view.\n" + (ignoredBy === null ? `Check that the config ignores the fixture directory itself and not a pattern such as
+"**/*.fixture.ts", which would also hide the view at "${suite.viewDir}".\nCheck too that the config carries the \`fixtures()\` override from @rdjperron/lint/config,
+on the view path: no command-line flag can switch a JS plugin rule on.
+` : `CAUSE: "${suite.viewDir}" is gitignored (${ignoredBy}). oxlint skips gitignored paths,\nso the view this lints through is invisible to it. Remove that ignore rule; the view is
+deleted in a \`finally\` block anyway.
+`));
+		return expectedRules.length;
+	}
+	const firedByRule = /* @__PURE__ */ new Map();
+	const foreignDiagnostics = [];
+	for (const diagnostic of report.diagnostics) {
+		const ruleId = ruleIdFor(suite.plugin, diagnostic.code);
+		if (ruleId === null) {
+			foreignDiagnostics.push(diagnostic);
+			continue;
+		}
+		const seen = firedByRule.get(ruleId) ?? /* @__PURE__ */ new Set();
+		seen.add(basename(diagnostic.filename));
+		firedByRule.set(ruleId, seen);
+	}
+	const rows = expectedRules.map((rule) => {
+		const seen = firedByRule.get(rule) ?? /* @__PURE__ */ new Set();
+		const fixture = files.get(rule) ?? rule;
+		const firedOnOwnFixture = seen.has(fixture);
+		return {
+			rule,
+			fixture,
+			firedOnOwnFixture,
+			note: firedOnOwnFixture ? "" : seen.size > 0 ? `fired only on: ${[...seen].toSorted(byName).join(", ")}` : "rule did not fire on any fixture"
+		};
+	});
+	const width = Math.max(...rows.map((row) => row.rule.length), 4);
+	console.log(`${"RULE".padEnd(width)}  RESULT  FIXTURE`);
+	console.log(`${"-".repeat(width)}  ------  -------`);
+	for (const row of rows) {
+		const verdict = row.firedOnOwnFixture ? "PASS  " : "FAIL  ";
+		const suffix = row.note === "" ? "" : `  <-- ${row.note}`;
+		console.log(`${row.rule.padEnd(width)}  ${verdict}  ${row.fixture}${suffix}`);
+	}
+	console.log("");
+	const failures = rows.filter((row) => !row.firedOnOwnFixture);
+	console.log(`${rows.length - failures.length}/${rows.length} ${suite.plugin} rules fired on their own fixture.`);
+	const registered = suite.registeredRules === void 0 ? null : await suite.registeredRules();
+	if (registered !== null) {
+		const missingFixture = registered.filter((rule) => !expectedRules.includes(rule));
+		const orphanFixture = expectedRules.filter((rule) => !registered.includes(rule));
+		if (missingFixture.length > 0) console.log(`\nWARN: registered by the ${suite.plugin} plugin but has no fixture: ${missingFixture.join(", ")}`);
+		if (orphanFixture.length > 0) console.log(`\nWARN: fixture exists but the ${suite.plugin} plugin registers no such rule: ${orphanFixture.join(", ")}`);
+	}
+	if (foreignDiagnostics.length > 0) {
+		console.log(`\nWARN: ${foreignDiagnostics.length} non-${suite.plugin} diagnostic(s) in the fixtures:`);
+		for (const diagnostic of foreignDiagnostics.slice(0, 20)) console.log(`  ${basename(diagnostic.filename)}: ${diagnostic.code}`);
+	}
+	if (failures.length > 0) {
+		const where = suite.readme === void 0 ? "" : ` See ${suite.readme}.`;
+		console.error(`\nFAIL: ${failures.length} ${suite.plugin} rule(s) did not fire.${where}\nFirst thing to check: the config's override on "${suite.viewDir}" has to put every rule\nat error. For this plugin that override is \`fixtures()\` from @rdjperron/lint/config; no
+command-line flag can switch a JS plugin rule on.`);
+	}
+	console.log("");
+	return failures.length;
+}
+/**
+* Lint every suite and print one table each. Returns the number of rules that
+* did not fire, so zero means every rule of every suite is alive.
+*/
+async function verifySuites(suites, options = {}) {
+	const root = resolve(options.root ?? process.cwd());
+	const binary = resolveViteplusBinary();
+	let failures = 0;
+	try {
+		for (const suite of suites) failures += await verifySuite(binary, root, suite);
+	} finally {
+		for (const suite of suites) removeFixtureView(root, suite);
+	}
+	if (failures > 0) {
+		console.error(`FAIL: ${failures} rule(s) did not fire across ${suites.length} suite(s).`);
+		return failures;
+	}
+	console.log(`OK: every rule of every suite (${suites.map((suite) => suite.plugin).join(", ")}) still fires.`);
+	return 0;
+}
+const PLUGINS_PACKAGE = "@oxlint/plugins";
+function readManifest(path) {
+	const parsed = JSON.parse(readFileSync(path, "utf8"));
+	if (typeof parsed !== "object" || parsed === null) throw new Error(`Not a manifest: ${path}`);
+	const entry = parsed;
+	return {
+		version: typeof entry.version === "string" ? entry.version : "",
+		declaredPlugins: entry.dependencies?.[PLUGINS_PACKAGE] ?? "",
+		peerPlugins: entry.peerDependencies?.[PLUGINS_PACKAGE] ?? ""
+	};
+}
+/** The nearest `package.json` at or above a resolved module file. */
+function manifestNear(modulePath) {
+	let dir = dirname(modulePath);
+	for (;;) {
+		const candidate = join(dir, "package.json");
+		if (existsSync(candidate)) return candidate;
+		const parent = dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+/** `^x.y.z` is satisfied by the same major, at or above the base. */
+function caretAccepts(range, version) {
+	const match = /^\^(\d+)\.(\d+)\.(\d+)$/u.exec(range);
+	if (match === null) throw new Error(`Expected a caret range, got "${range}"`);
+	const [major, minor, patch] = match.slice(1).map(Number);
+	const [candidateMajor, candidateMinor, candidatePatch] = version.split(".").map(Number);
+	if (candidateMajor !== major) return false;
+	if (candidateMinor !== minor) return (candidateMinor ?? 0) > (minor ?? 0);
+	return (candidatePatch ?? 0) >= (patch ?? 0);
+}
+/**
+* Two promises about the plugin API, held here as a failure instead.
+*
+*   - the installed `@oxlint/plugins` is the exact version `vite-plus` declares;
+*   - this package's peer range accepts that version.
+*
+* The rules import `@oxlint/plugins`, so the installed one must be the one the
+* linter was built against, or the rules compile against one plugin API and run
+* under another with no error anywhere. Returns the failures, empty when the
+* pins agree or when `vite-plus` is not installed (a consumer on another
+* toolchain has nothing to pin against).
+*/
+function verifyPluginApiPin(root = process.cwd()) {
+	const requireFromRoot = createRequire(join(resolve(root), "package.json"));
+	const requireFromHere = createRequire(import.meta.url);
+	let vitePlus;
+	try {
+		vitePlus = readManifest(requireFromRoot.resolve("vite-plus/package.json"));
+	} catch {
+		console.log("plugin API pin: skipped, `vite-plus` is not installed here.");
+		return [];
+	}
+	const declared = vitePlus.declaredPlugins.replace(/^=/u, "");
+	if (!/^\d+\.\d+\.\d+$/u.test(declared)) return [`vite-plus ${vitePlus.version} no longer declares an exact @oxlint/plugins version.`];
+	let installed;
+	try {
+		const manifest = manifestNear(requireFromRoot.resolve("@oxlint/plugins"));
+		if (manifest === null) throw new Error("no package.json above @oxlint/plugins");
+		installed = readManifest(manifest);
+	} catch {
+		return ["`@oxlint/plugins` is not installed. It is a peer dependency of @rdjperron/lint."];
+	}
+	const self = readManifest(requireFromHere.resolve("../package.json"));
+	const peer = self.peerPlugins;
+	const failures = [];
+	if (installed.version !== declared) failures.push(`@oxlint/plugins ${installed.version} is installed and vite-plus ${vitePlus.version} declares ${declared}. Move the pin: install @oxlint/plugins@${declared} exactly.`);
+	if (!caretAccepts(peer, declared)) failures.push(`@rdjperron/lint ${self.version} wants @oxlint/plugins ${peer} and vite-plus ${vitePlus.version} declares ${declared}. Move one of the two pins.`);
+	if (failures.length === 0) console.log(`plugin API pin: @oxlint/plugins ${installed.version}, what vite-plus ${vitePlus.version} declares.`);
+	return failures;
+}
+/** The suite for this package's own fixtures, as they sit in a consumer's `node_modules`. */
+function packageSuite(root = process.cwd()) {
+	const packageDir = "node_modules/@rdjperron/lint";
+	return {
+		plugin: "rdj",
+		fixtureDir: `${packageDir}/fixtures`,
+		viewDir: "scripts/.lint-fixtures/rdj",
+		alwaysView: true,
+		readme: `${packageDir}/fixtures/README.md`,
+		registeredRules: async () => {
+			try {
+				const rules = (await import(createRequire(join(resolve(root), "package.json")).resolve("@rdjperron/lint"))).default?.rules;
+				return typeof rules === "object" && rules !== null ? Object.keys(rules).toSorted(byName) : null;
+			} catch {
+				return null;
+			}
+		}
+	};
+}
+/** The bin: this package's suite, plus the plugin API pin, from the consumer's repo root. */
+async function main(root = process.cwd()) {
+	const pinFailures = verifyPluginApiPin(root);
+	for (const failure of pinFailures) console.error(`FAIL: ${failure}`);
+	console.log("");
+	const ruleFailures = await verifySuites([packageSuite(root)], { root });
+	return pinFailures.length + ruleFailures > 0 ? 1 : 0;
+}
+const invoked = process.argv[1];
+if (invoked !== void 0 && existsSync(invoked) && realpathSync(invoked) === fileURLToPath(import.meta.url)) {
+	let exitCode = 1;
+	try {
+		exitCode = await main();
+	} catch (error) {
+		console.error(`\nFAIL: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	process.exit(exitCode);
+}
+//#endregion
+export { main, packageSuite, resolveViteplusBinary, verifyPluginApiPin, verifySuites };
+
+//# sourceMappingURL=verify.mjs.map

package/dist/verify.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.mjs","names":[],"sources":["../src/verify.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * Proof that every lint rule still fires.\n *\n * The linter lives inside the `vp` binary, so it moves independently of any\n * lockfile, and the JS-plugin bridge it loads these rules through is alpha. A\n * rule can stop firing with no diff anywhere, and a dead lint rule is silent:\n * \"reports nothing\" looks exactly like \"no violations\". This is the thing that\n * notices.\n *\n * A suite is a directory holding one deliberately-broken `<rule>.fixture.ts(x)`\n * per rule. The check asserts a positive: every rule fired, each on the file\n * named after it.\n *\n * Run the package's own suite from a consumer's repo root:\n *\n *     npx rdj-lint-verify\n *\n * ---------------------------------------------------------------------------\n * Why the symlink dance\n * ---------------------------------------------------------------------------\n * The fixtures ship inside `node_modules`, which oxlint never walks, and a\n * consumer's own fixture directories are usually in `lint.ignorePatterns` so a\n * plain `vp check` stays quiet. Measured on Vite+ 0.2.9 / oxlint 1.77.0 and\n * again on 0.3.1 / oxlint 1.81.0: no flag re-includes an ignored path.\n * `--no-ignore`, `--ignore-pattern '!<dir>/**'`, an explicit file, an absolute\n * path, a cwd inside the directory and `-W <rule>` all answer \"No files found\n * to lint.\" `--no-ignore` only disables `.eslintignore`, `--ignore-path` and\n * `--ignore-pattern`; it does not touch the config's own `ignorePatterns`, and\n * `vp lint` has no `--config` flag.\n *\n * What does work: oxlint matches ignore patterns against the path it walked,\n * not the realpath. Linting through a symlink outside the ignored prefix\n * reaches the fixtures normally, plugin and all. This creates that view per\n * suite, lints through it, and removes it in a `finally`.\n *\n * The severities cannot come from the command line either: `-A`, `-W` and `-D`\n * reach built-in rules only and leave every JS plugin rule exactly as the config\n * left it (measured on vite-plus 0.3.1 / oxlint 1.81.0, with `vp lint` and with\n * the bare binary). That is why the consumer's config must carry the\n * `fixtures()` override from `@rdjperron/lint/config`.\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport {\n  cpSync,\n  existsSync,\n  mkdirSync,\n  readdirSync,\n  rmdirSync,\n  readFileSync,\n  realpathSync,\n  rmSync,\n  symlinkSync,\n} from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nexport interface Suite {\n  /** The plugin alias the diagnostics carry, e.g. `rdj` in `rdj(no-reflect-get)`. */\n  plugin: string;\n  /** The fixture directory, relative to `root`. */\n  fixtureDir: string;\n  /** Where the un-ignored view is created, relative to `root`. */\n  viewDir: string;\n  /** Fixture file endings; the part before one of them is the rule name. */\n  suffixes?: string[];\n  /** Skip the direct path and always lint through the view (fixtures under `node_modules`). */\n  alwaysView?: boolean;\n  /** Advisory: the rule names the plugin registers, so a new rule without a fixture is named. */\n  registeredRules?: () => Promise<string[] | null>;\n  /** Where the failure message sends the reader. */\n  readme?: string;\n}\n\nexport interface VerifyOptions {\n  /** The repo root the paths are relative to and `vp lint` runs from. Defaults to the cwd. */\n  root?: string;\n}\n\nconst DEFAULT_SUFFIXES = [\".fixture.ts\", \".fixture.tsx\"];\n\n/** Deterministic, locale-independent ordering for the rule and file name lists. */\nfunction byName(left: string, right: string): number {\n  return left < right ? -1 : left > right ? 1 : 0;\n}\n\nfunction basename(path: string): string {\n  const parts = path.split(/[\\\\/]/u);\n  return parts[parts.length - 1] ?? path;\n}\n\n/**\n * Locate the `vp` binary: PATH first, then the default install locations, the\n * XDG layout used since Vite+ 0.3.0 and the pre-0.3.0 single-root layout that\n * upgraded installs keep.\n */\nexport function resolveViteplusBinary(): string {\n  const probe = spawnSync(\"vp\", [\"--version\"], { encoding: \"utf8\" });\n  if (probe.status === 0) return \"vp\";\n  const home = process.env.HOME ?? \"\";\n  const fallbacks = [\n    join(home, \".local\", \"share\", \"vite-plus\", \"bin\", \"vp\"),\n    join(home, \".vite-plus\", \"bin\", \"vp\"),\n  ];\n  const found = fallbacks.find((candidate) => existsSync(candidate));\n  if (found !== undefined) return found;\n  throw new Error(\n    \"Could not find the `vp` binary. Add it to PATH: \" +\n      'export PATH=\"$HOME/.local/share/vite-plus/bin:$PATH\" (or \"$HOME/.vite-plus/bin\" for a pre-0.3.0 install)',\n  );\n}\n\ninterface LintDiagnostic {\n  code: string;\n  filename: string;\n}\n\ninterface LintReport {\n  numberOfFiles: number;\n  diagnostics: LintDiagnostic[];\n}\n\n/** The two fields of oxlint's JSON report this reads, before any of them is trusted. */\ninterface RawReport {\n  number_of_files?: unknown;\n  diagnostics?: unknown;\n}\n\n/** The two fields of one raw diagnostic, before either of them is trusted. */\ninterface RawDiagnostic {\n  code?: unknown;\n  filename?: unknown;\n}\n\n/**\n * `vp lint -f json` is an outside value, so this is the one place its shape is\n * checked. Anything that does not look like a diagnostic is dropped rather than\n * guessed at.\n */\nfunction decodeReport(json: string): LintReport {\n  const parsed: unknown = JSON.parse(json);\n  if (typeof parsed !== \"object\" || parsed === null) {\n    throw new Error(\"`vp lint -f json` did not return an object.\");\n  }\n  // SAFETY: the check above makes it a non-null object, and every field of\n  // `RawReport` is `unknown`, so nothing is claimed about its contents yet.\n  const report = parsed as RawReport;\n  const numberOfFiles = typeof report.number_of_files === \"number\" ? report.number_of_files : 0;\n  const rows = Array.isArray(report.diagnostics) ? report.diagnostics : [];\n  const diagnostics: LintDiagnostic[] = [];\n  for (const row of rows) {\n    if (typeof row !== \"object\" || row === null) continue;\n    // SAFETY: same check, one level down; both fields of `RawDiagnostic` are\n    // `unknown` and each is typed by its own test on the next lines.\n    const entry = row as RawDiagnostic;\n    diagnostics.push({\n      code: typeof entry.code === \"string\" ? entry.code : \"\",\n      filename: typeof entry.filename === \"string\" ? entry.filename : \"\",\n    });\n  }\n  return { numberOfFiles, diagnostics };\n}\n\n/** Run `vp lint <target> -f json` from `root` and return the decoded report. */\nfunction lintAsJson(binary: string, root: string, target: string): LintReport {\n  const result = spawnSync(\n    binary,\n    [\"lint\", target, \"-f\", \"json\", \"--no-error-on-unmatched-pattern\"],\n    {\n      cwd: root,\n      encoding: \"utf8\",\n      maxBuffer: 64 * 1024 * 1024,\n    },\n  );\n\n  if (result.error !== undefined && result.error !== null) throw result.error;\n\n  // `--no-error-on-unmatched-pattern` keeps the \"No files found to lint.\" banner\n  // off stdout, so stdout is pure JSON even when nothing matched.\n  const stdout = result.stdout ?? \"\";\n  const start = stdout.indexOf(\"{\");\n  if (start === -1) {\n    throw new Error(\n      `\\`vp lint ${target} -f json\\` produced no JSON.\\nstdout: ${stdout}\\nstderr: ${result.stderr ?? \"\"}`,\n    );\n  }\n\n  try {\n    return decodeReport(stdout.slice(start));\n  } catch (cause) {\n    const reason = cause instanceof Error ? cause.message : String(cause);\n    throw new Error(`Could not read \\`vp lint\\` JSON output: ${reason}\\nstdout: ${stdout}`, {\n      cause,\n    });\n  }\n}\n\n/**\n * Why a path is gitignored, or null. oxlint honours `.gitignore`, so a\n * gitignored view yields \"0 files\" instead of a useful diagnostic.\n */\nfunction gitIgnoreReason(root: string, relPath: string): string | null {\n  const result = spawnSync(\"git\", [\"check-ignore\", \"-v\", relPath], { cwd: root, encoding: \"utf8\" });\n  const output = result.status === 0 ? result.stdout.trim() : \"\";\n  return output === \"\" ? null : (output.split(\"\\t\")[0] ?? null);\n}\n\n/** Rule name to fixture file name, taken from the files that exist on disk. */\nfunction fixtureFiles(root: string, suite: Suite): Map<string, string> {\n  const dir = join(root, suite.fixtureDir);\n  if (!existsSync(dir)) throw new Error(`Fixture directory is missing: ${dir}`);\n  const suffixes = suite.suffixes ?? DEFAULT_SUFFIXES;\n  const files = new Map<string, string>();\n  for (const name of readdirSync(dir).toSorted(byName)) {\n    const suffix = suffixes.find((candidate) => name.endsWith(candidate));\n    if (suffix === undefined) continue;\n    files.set(name.slice(0, -suffix.length), name);\n  }\n  return files;\n}\n\n/** Create the un-ignored view; prefer a symlink, fall back to a copy on Windows. */\nfunction createFixtureView(root: string, suite: Suite): string {\n  removeFixtureView(root, suite);\n  const viewPath = join(root, suite.viewDir);\n  mkdirSync(dirname(viewPath), { recursive: true });\n  try {\n    symlinkSync(join(root, suite.fixtureDir), viewPath, \"junction\");\n    return \"symlink\";\n  } catch {\n    cpSync(join(root, suite.fixtureDir), viewPath, { recursive: true });\n    return \"copy\";\n  }\n}\n\nfunction removeFixtureView(root: string, suite: Suite): void {\n  const viewPath = join(root, suite.viewDir);\n  rmSync(viewPath, { recursive: true, force: true });\n  // The parents were created for the view alone when nothing else lives there, so they go too.\n  const top = resolve(root);\n  for (let dir = dirname(viewPath); dir !== top; dir = dirname(dir)) {\n    if (!existsSync(dir) || readdirSync(dir).length > 0) break;\n    rmdirSync(dir);\n  }\n}\n\n/** `rdj(no-reflect-get)` -> `no-reflect-get` for this suite's plugin; anything else -> null. */\nfunction ruleIdFor(plugin: string, code: string): string | null {\n  const match = new RegExp(`^${plugin}\\\\(([^)]+)\\\\)$`, \"u\").exec(code);\n  return match === null ? null : (match[1] ?? null);\n}\n\ninterface Row {\n  rule: string;\n  fixture: string;\n  firedOnOwnFixture: boolean;\n  note: string;\n}\n\n/** Lint one suite and print its table. Returns the number of rules that did not fire. */\nasync function verifySuite(binary: string, root: string, suite: Suite): Promise<number> {\n  const files = fixtureFiles(root, suite);\n  const expectedRules = [...files.keys()];\n\n  console.log(`${suite.plugin} rule verification`);\n  console.log(`  fixtures:  ${suite.fixtureDir}`);\n\n  if (expectedRules.length === 0) {\n    console.error(`  No fixture files found in ${suite.fixtureDir}. Nothing to verify.\\n`);\n    return 1;\n  }\n\n  // 1. Try the fixture directory directly. Works only while it is un-ignored, so\n  //    a suite under node_modules skips it: oxlint never walks in there.\n  let mechanism = \"direct path\";\n  let report: LintReport =\n    suite.alwaysView === true\n      ? { numberOfFiles: 0, diagnostics: [] }\n      : lintAsJson(binary, root, suite.fixtureDir);\n\n  // 2. Ignored by the config or under node_modules: lint through an un-ignored view.\n  if (report.numberOfFiles === 0) {\n    const kind = createFixtureView(root, suite);\n    try {\n      mechanism = `${kind} at ${suite.viewDir} (\\`${suite.fixtureDir}\\` is not walked by \\`vp lint\\`)`;\n      report = lintAsJson(binary, root, suite.viewDir);\n    } finally {\n      // Never leave the view behind: a stale one would show up in `vp check`.\n      removeFixtureView(root, suite);\n    }\n  }\n\n  console.log(`  lint via:  ${mechanism}`);\n  console.log(`  files:     ${report.numberOfFiles}`);\n  console.log(\"\");\n\n  if (report.numberOfFiles === 0) {\n    const ignoredBy = gitIgnoreReason(root, suite.viewDir);\n    console.error(\n      \"FAIL: `vp lint` matched 0 files through both the direct path and the un-ignored view.\\n\" +\n        (ignoredBy === null\n          ? \"Check that the config ignores the fixture directory itself and not a pattern such as\\n\" +\n            `\"**/*.fixture.ts\", which would also hide the view at \"${suite.viewDir}\".\\n` +\n            \"Check too that the config carries the `fixtures()` override from @rdjperron/lint/config,\\n\" +\n            \"on the view path: no command-line flag can switch a JS plugin rule on.\\n\"\n          : `CAUSE: \"${suite.viewDir}\" is gitignored (${ignoredBy}). oxlint skips gitignored paths,\\n` +\n            \"so the view this lints through is invisible to it. Remove that ignore rule; the view is\\n\" +\n            \"deleted in a `finally` block anyway.\\n\"),\n    );\n    return expectedRules.length;\n  }\n\n  const firedByRule = new Map<string, Set<string>>();\n  const foreignDiagnostics: LintDiagnostic[] = [];\n\n  for (const diagnostic of report.diagnostics) {\n    const ruleId = ruleIdFor(suite.plugin, diagnostic.code);\n    if (ruleId === null) {\n      foreignDiagnostics.push(diagnostic);\n      continue;\n    }\n    const seen = firedByRule.get(ruleId) ?? new Set<string>();\n    seen.add(basename(diagnostic.filename));\n    firedByRule.set(ruleId, seen);\n  }\n\n  const rows: Row[] = expectedRules.map((rule) => {\n    const seen = firedByRule.get(rule) ?? new Set<string>();\n    const fixture = files.get(rule) ?? rule;\n    const firedOnOwnFixture = seen.has(fixture);\n    return {\n      rule,\n      fixture,\n      firedOnOwnFixture,\n      note: firedOnOwnFixture\n        ? \"\"\n        : seen.size > 0\n          ? `fired only on: ${[...seen].toSorted(byName).join(\", \")}`\n          : \"rule did not fire on any fixture\",\n    };\n  });\n\n  const width = Math.max(...rows.map((row) => row.rule.length), 4);\n  console.log(`${\"RULE\".padEnd(width)}  RESULT  FIXTURE`);\n  console.log(`${\"-\".repeat(width)}  ------  -------`);\n  for (const row of rows) {\n    const verdict = row.firedOnOwnFixture ? \"PASS  \" : \"FAIL  \";\n    const suffix = row.note === \"\" ? \"\" : `  <-- ${row.note}`;\n    console.log(`${row.rule.padEnd(width)}  ${verdict}  ${row.fixture}${suffix}`);\n  }\n  console.log(\"\");\n\n  const failures = rows.filter((row) => !row.firedOnOwnFixture);\n  console.log(\n    `${rows.length - failures.length}/${rows.length} ${suite.plugin} rules fired on their own fixture.`,\n  );\n\n  // Advisory: a plugin bump that adds a rule should also add a fixture.\n  const registered = suite.registeredRules === undefined ? null : await suite.registeredRules();\n  if (registered !== null) {\n    const missingFixture = registered.filter((rule) => !expectedRules.includes(rule));\n    const orphanFixture = expectedRules.filter((rule) => !registered.includes(rule));\n    if (missingFixture.length > 0) {\n      console.log(\n        `\\nWARN: registered by the ${suite.plugin} plugin but has no fixture: ${missingFixture.join(\", \")}`,\n      );\n    }\n    if (orphanFixture.length > 0) {\n      console.log(\n        `\\nWARN: fixture exists but the ${suite.plugin} plugin registers no such rule: ${orphanFixture.join(\", \")}`,\n      );\n    }\n  }\n\n  // Advisory: fixtures are meant to trip exactly one rule each.\n  if (foreignDiagnostics.length > 0) {\n    console.log(\n      `\\nWARN: ${foreignDiagnostics.length} non-${suite.plugin} diagnostic(s) in the fixtures:`,\n    );\n    for (const diagnostic of foreignDiagnostics.slice(0, 20)) {\n      console.log(`  ${basename(diagnostic.filename)}: ${diagnostic.code}`);\n    }\n  }\n\n  if (failures.length > 0) {\n    const where = suite.readme === undefined ? \"\" : ` See ${suite.readme}.`;\n    console.error(\n      `\\nFAIL: ${failures.length} ${suite.plugin} rule(s) did not fire.${where}\\n` +\n        `First thing to check: the config's override on \"${suite.viewDir}\" has to put every rule\\n` +\n        \"at error. For this plugin that override is `fixtures()` from @rdjperron/lint/config; no\\n\" +\n        \"command-line flag can switch a JS plugin rule on.\",\n    );\n  }\n  console.log(\"\");\n  return failures.length;\n}\n\n/**\n * Lint every suite and print one table each. Returns the number of rules that\n * did not fire, so zero means every rule of every suite is alive.\n */\nexport async function verifySuites(suites: Suite[], options: VerifyOptions = {}): Promise<number> {\n  const root = resolve(options.root ?? process.cwd());\n  const binary = resolveViteplusBinary();\n  let failures = 0;\n  try {\n    for (const suite of suites) {\n      failures += await verifySuite(binary, root, suite);\n    }\n  } finally {\n    for (const suite of suites) removeFixtureView(root, suite);\n  }\n  if (failures > 0) {\n    console.error(`FAIL: ${failures} rule(s) did not fire across ${suites.length} suite(s).`);\n    return failures;\n  }\n  console.log(\n    `OK: every rule of every suite (${suites.map((suite) => suite.plugin).join(\", \")}) still fires.`,\n  );\n  return 0;\n}\n\nconst PLUGINS_PACKAGE = \"@oxlint/plugins\";\n\n/** What this needs from a `package.json`: its version, and what it says about the plugin API. */\ninterface Manifest {\n  version: string;\n  /** The `@oxlint/plugins` spec in `dependencies`, or \"\". */\n  declaredPlugins: string;\n  /** The `@oxlint/plugins` spec in `peerDependencies`, or \"\". */\n  peerPlugins: string;\n}\n\n/** npm's manifest schema: both tables map a package name to a version spec. */\ninterface DependencyTable {\n  [name: string]: string | undefined;\n}\n\ninterface RawManifest {\n  version?: unknown;\n  dependencies?: DependencyTable;\n  peerDependencies?: DependencyTable;\n}\n\nfunction readManifest(path: string): Manifest {\n  const parsed: unknown = JSON.parse(readFileSync(path, \"utf8\"));\n  if (typeof parsed !== \"object\" || parsed === null) throw new Error(`Not a manifest: ${path}`);\n  // SAFETY: the check above makes it a non-null object, and npm's own schema makes\n  // both dependency tables name-to-spec; a package.json that breaks that is not\n  // installable, and a non-string spec reaching here simply fails the comparisons.\n  const entry = parsed as RawManifest;\n  return {\n    version: typeof entry.version === \"string\" ? entry.version : \"\",\n    declaredPlugins: entry.dependencies?.[PLUGINS_PACKAGE] ?? \"\",\n    peerPlugins: entry.peerDependencies?.[PLUGINS_PACKAGE] ?? \"\",\n  };\n}\n\n/** The nearest `package.json` at or above a resolved module file. */\nfunction manifestNear(modulePath: string): string | null {\n  let dir = dirname(modulePath);\n  for (;;) {\n    const candidate = join(dir, \"package.json\");\n    if (existsSync(candidate)) return candidate;\n    const parent = dirname(dir);\n    if (parent === dir) return null;\n    dir = parent;\n  }\n}\n\n/** `^x.y.z` is satisfied by the same major, at or above the base. */\nfunction caretAccepts(range: string, version: string): boolean {\n  const match = /^\\^(\\d+)\\.(\\d+)\\.(\\d+)$/u.exec(range);\n  if (match === null) throw new Error(`Expected a caret range, got \"${range}\"`);\n  const [major, minor, patch] = match.slice(1).map(Number);\n  const [candidateMajor, candidateMinor, candidatePatch] = version.split(\".\").map(Number);\n  if (candidateMajor !== major) return false;\n  if (candidateMinor !== minor) return (candidateMinor ?? 0) > (minor ?? 0);\n  return (candidatePatch ?? 0) >= (patch ?? 0);\n}\n\n/**\n * Two promises about the plugin API, held here as a failure instead.\n *\n *   - the installed `@oxlint/plugins` is the exact version `vite-plus` declares;\n *   - this package's peer range accepts that version.\n *\n * The rules import `@oxlint/plugins`, so the installed one must be the one the\n * linter was built against, or the rules compile against one plugin API and run\n * under another with no error anywhere. Returns the failures, empty when the\n * pins agree or when `vite-plus` is not installed (a consumer on another\n * toolchain has nothing to pin against).\n */\nexport function verifyPluginApiPin(root = process.cwd()): string[] {\n  const requireFromRoot = createRequire(join(resolve(root), \"package.json\"));\n  const requireFromHere = createRequire(import.meta.url);\n\n  let vitePlus: Manifest;\n  try {\n    vitePlus = readManifest(requireFromRoot.resolve(\"vite-plus/package.json\"));\n  } catch {\n    console.log(\"plugin API pin: skipped, `vite-plus` is not installed here.\");\n    return [];\n  }\n\n  const declared = vitePlus.declaredPlugins.replace(/^=/u, \"\");\n  if (!/^\\d+\\.\\d+\\.\\d+$/u.test(declared)) {\n    return [`vite-plus ${vitePlus.version} no longer declares an exact @oxlint/plugins version.`];\n  }\n\n  let installed: Manifest;\n  try {\n    const entry = requireFromRoot.resolve(\"@oxlint/plugins\");\n    const manifest = manifestNear(entry);\n    if (manifest === null) throw new Error(\"no package.json above @oxlint/plugins\");\n    installed = readManifest(manifest);\n  } catch {\n    return [\"`@oxlint/plugins` is not installed. It is a peer dependency of @rdjperron/lint.\"];\n  }\n\n  const self = readManifest(requireFromHere.resolve(\"../package.json\"));\n  const peer = self.peerPlugins;\n  const failures: string[] = [];\n\n  if (installed.version !== declared) {\n    failures.push(\n      `@oxlint/plugins ${installed.version} is installed and vite-plus ${vitePlus.version} declares ` +\n        `${declared}. Move the pin: install @oxlint/plugins@${declared} exactly.`,\n    );\n  }\n  if (!caretAccepts(peer, declared)) {\n    failures.push(\n      `@rdjperron/lint ${self.version} wants @oxlint/plugins ${peer} and vite-plus ${vitePlus.version} ` +\n        `declares ${declared}. Move one of the two pins.`,\n    );\n  }\n  if (failures.length === 0) {\n    console.log(\n      `plugin API pin: @oxlint/plugins ${installed.version}, what vite-plus ${vitePlus.version} declares.`,\n    );\n  }\n  return failures;\n}\n\n/** The suite for this package's own fixtures, as they sit in a consumer's `node_modules`. */\nexport function packageSuite(root = process.cwd()): Suite {\n  const packageDir = \"node_modules/@rdjperron/lint\";\n  return {\n    plugin: \"rdj\",\n    fixtureDir: `${packageDir}/fixtures`,\n    viewDir: \"scripts/.lint-fixtures/rdj\",\n    alwaysView: true,\n    readme: `${packageDir}/fixtures/README.md`,\n    registeredRules: async () => {\n      try {\n        const requireFromRoot = createRequire(join(resolve(root), \"package.json\"));\n        const loaded: unknown = await import(requireFromRoot.resolve(\"@rdjperron/lint\"));\n        // SAFETY: the plugin's default export is the object oxlint loads; `rules` is\n        // still `unknown` here and is checked on the next line.\n        const module_ = loaded as { default?: { rules?: unknown } };\n        const rules = module_.default?.rules;\n        return typeof rules === \"object\" && rules !== null\n          ? Object.keys(rules).toSorted(byName)\n          : null;\n      } catch {\n        return null;\n      }\n    },\n  };\n}\n\n/** The bin: this package's suite, plus the plugin API pin, from the consumer's repo root. */\nexport async function main(root = process.cwd()): Promise<number> {\n  const pinFailures = verifyPluginApiPin(root);\n  for (const failure of pinFailures) console.error(`FAIL: ${failure}`);\n  console.log(\"\");\n  const ruleFailures = await verifySuites([packageSuite(root)], { root });\n  return pinFailures.length + ruleFailures > 0 ? 1 : 0;\n}\n\nconst invoked = process.argv[1];\nconst isBin =\n  invoked !== undefined &&\n  existsSync(invoked) &&\n  realpathSync(invoked) === fileURLToPath(import.meta.url);\n\nif (isBin) {\n  let exitCode = 1;\n  try {\n    exitCode = await main();\n  } catch (error) {\n    console.error(`\\nFAIL: ${error instanceof Error ? error.message : String(error)}`);\n  }\n  process.exit(exitCode);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiFA,MAAM,mBAAmB,CAAC,eAAe,cAAc;;AAGvD,SAAS,OAAO,MAAc,OAAuB;CACnD,OAAO,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAChD;AAEA,SAAS,SAAS,MAAsB;CACtC,MAAM,QAAQ,KAAK,MAAM,QAAQ;CACjC,OAAO,MAAM,MAAM,SAAS,MAAM;AACpC;;;;;;AAOA,SAAgB,wBAAgC;CAE9C,IADc,UAAU,MAAM,CAAC,WAAW,GAAG,EAAE,UAAU,OAAO,CACxD,CAAC,CAAC,WAAW,GAAG,OAAO;CAC/B,MAAM,OAAO,QAAQ,IAAI,QAAQ;CAKjC,MAAM,QAAQ,CAHZ,KAAK,MAAM,UAAU,SAAS,aAAa,OAAO,IAAI,GACtD,KAAK,MAAM,cAAc,OAAO,IAAI,CAEhB,CAAC,CAAC,MAAM,cAAc,WAAW,SAAS,CAAC;CACjE,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,MAAM,IAAI,MACR,8JAEF;AACF;;;;;;AA6BA,SAAS,aAAa,MAA0B;CAC9C,MAAM,SAAkB,KAAK,MAAM,IAAI;CACvC,IAAI,OAAO,WAAW,YAAY,WAAW,MAC3C,MAAM,IAAI,MAAM,6CAA6C;CAI/D,MAAM,SAAS;CACf,MAAM,gBAAgB,OAAO,OAAO,oBAAoB,WAAW,OAAO,kBAAkB;CAC5F,MAAM,OAAO,MAAM,QAAQ,OAAO,WAAW,IAAI,OAAO,cAAc,CAAC;CACvE,MAAM,cAAgC,CAAC;CACvC,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM;EAG7C,MAAM,QAAQ;EACd,YAAY,KAAK;GACf,MAAM,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;GACpD,UAAU,OAAO,MAAM,aAAa,WAAW,MAAM,WAAW;EAClE,CAAC;CACH;CACA,OAAO;EAAE;EAAe;CAAY;AACtC;;AAGA,SAAS,WAAW,QAAgB,MAAc,QAA4B;CAC5E,MAAM,SAAS,UACb,QACA;EAAC;EAAQ;EAAQ;EAAM;EAAQ;CAAiC,GAChE;EACE,KAAK;EACL,UAAU;EACV,WAAW;CACb,CACF;CAEA,IAAI,OAAO,UAAU,KAAA,KAAa,OAAO,UAAU,MAAM,MAAM,OAAO;CAItE,MAAM,SAAS,OAAO,UAAU;CAChC,MAAM,QAAQ,OAAO,QAAQ,GAAG;CAChC,IAAI,UAAU,IACZ,MAAM,IAAI,MACR,aAAa,OAAO,wCAAwC,OAAO,YAAY,OAAO,UAAU,IAClG;CAGF,IAAI;EACF,OAAO,aAAa,OAAO,MAAM,KAAK,CAAC;CACzC,SAAS,OAAO;EACd,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACpE,MAAM,IAAI,MAAM,2CAA2C,OAAO,YAAY,UAAU,EACtF,MACF,CAAC;CACH;AACF;;;;;AAMA,SAAS,gBAAgB,MAAc,SAAgC;CACrE,MAAM,SAAS,UAAU,OAAO;EAAC;EAAgB;EAAM;CAAO,GAAG;EAAE,KAAK;EAAM,UAAU;CAAO,CAAC;CAChG,MAAM,SAAS,OAAO,WAAW,IAAI,OAAO,OAAO,KAAK,IAAI;CAC5D,OAAO,WAAW,KAAK,OAAQ,OAAO,MAAM,GAAI,CAAC,CAAC,MAAM;AAC1D;;AAGA,SAAS,aAAa,MAAc,OAAmC;CACrE,MAAM,MAAM,KAAK,MAAM,MAAM,UAAU;CACvC,IAAI,CAAC,WAAW,GAAG,GAAG,MAAM,IAAI,MAAM,iCAAiC,KAAK;CAC5E,MAAM,WAAW,MAAM,YAAY;CACnC,MAAM,wBAAQ,IAAI,IAAoB;CACtC,KAAK,MAAM,QAAQ,YAAY,GAAG,CAAC,CAAC,SAAS,MAAM,GAAG;EACpD,MAAM,SAAS,SAAS,MAAM,cAAc,KAAK,SAAS,SAAS,CAAC;EACpE,IAAI,WAAW,KAAA,GAAW;EAC1B,MAAM,IAAI,KAAK,MAAM,GAAG,CAAC,OAAO,MAAM,GAAG,IAAI;CAC/C;CACA,OAAO;AACT;;AAGA,SAAS,kBAAkB,MAAc,OAAsB;CAC7D,kBAAkB,MAAM,KAAK;CAC7B,MAAM,WAAW,KAAK,MAAM,MAAM,OAAO;CACzC,UAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;CAChD,IAAI;EACF,YAAY,KAAK,MAAM,MAAM,UAAU,GAAG,UAAU,UAAU;EAC9D,OAAO;CACT,QAAQ;EACN,OAAO,KAAK,MAAM,MAAM,UAAU,GAAG,UAAU,EAAE,WAAW,KAAK,CAAC;EAClE,OAAO;CACT;AACF;AAEA,SAAS,kBAAkB,MAAc,OAAoB;CAC3D,MAAM,WAAW,KAAK,MAAM,MAAM,OAAO;CACzC,OAAO,UAAU;EAAE,WAAW;EAAM,OAAO;CAAK,CAAC;CAEjD,MAAM,MAAM,QAAQ,IAAI;CACxB,KAAK,IAAI,MAAM,QAAQ,QAAQ,GAAG,QAAQ,KAAK,MAAM,QAAQ,GAAG,GAAG;EACjE,IAAI,CAAC,WAAW,GAAG,KAAK,YAAY,GAAG,CAAC,CAAC,SAAS,GAAG;EACrD,UAAU,GAAG;CACf;AACF;;AAGA,SAAS,UAAU,QAAgB,MAA6B;CAC9D,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,iBAAiB,GAAG,CAAC,CAAC,KAAK,IAAI;CACnE,OAAO,UAAU,OAAO,OAAQ,MAAM,MAAM;AAC9C;;AAUA,eAAe,YAAY,QAAgB,MAAc,OAA+B;CACtF,MAAM,QAAQ,aAAa,MAAM,KAAK;CACtC,MAAM,gBAAgB,CAAC,GAAG,MAAM,KAAK,CAAC;CAEtC,QAAQ,IAAI,GAAG,MAAM,OAAO,mBAAmB;CAC/C,QAAQ,IAAI,gBAAgB,MAAM,YAAY;CAE9C,IAAI,cAAc,WAAW,GAAG;EAC9B,QAAQ,MAAM,+BAA+B,MAAM,WAAW,uBAAuB;EACrF,OAAO;CACT;CAIA,IAAI,YAAY;CAChB,IAAI,SACF,MAAM,eAAe,OACjB;EAAE,eAAe;EAAG,aAAa,CAAC;CAAE,IACpC,WAAW,QAAQ,MAAM,MAAM,UAAU;CAG/C,IAAI,OAAO,kBAAkB,GAAG;EAC9B,MAAM,OAAO,kBAAkB,MAAM,KAAK;EAC1C,IAAI;GACF,YAAY,GAAG,KAAK,MAAM,MAAM,QAAQ,MAAM,MAAM,WAAW;GAC/D,SAAS,WAAW,QAAQ,MAAM,MAAM,OAAO;EACjD,UAAU;GAER,kBAAkB,MAAM,KAAK;EAC/B;CACF;CAEA,QAAQ,IAAI,gBAAgB,WAAW;CACvC,QAAQ,IAAI,gBAAgB,OAAO,eAAe;CAClD,QAAQ,IAAI,EAAE;CAEd,IAAI,OAAO,kBAAkB,GAAG;EAC9B,MAAM,YAAY,gBAAgB,MAAM,MAAM,OAAO;EACrD,QAAQ,MACN,6FACG,cAAc,OACX;wDACyD,MAAM,QAAQ;;IAGvE,WAAW,MAAM,QAAQ,mBAAmB,UAAU;;EAG9D;EACA,OAAO,cAAc;CACvB;CAEA,MAAM,8BAAc,IAAI,IAAyB;CACjD,MAAM,qBAAuC,CAAC;CAE9C,KAAK,MAAM,cAAc,OAAO,aAAa;EAC3C,MAAM,SAAS,UAAU,MAAM,QAAQ,WAAW,IAAI;EACtD,IAAI,WAAW,MAAM;GACnB,mBAAmB,KAAK,UAAU;GAClC;EACF;EACA,MAAM,OAAO,YAAY,IAAI,MAAM,qBAAK,IAAI,IAAY;EACxD,KAAK,IAAI,SAAS,WAAW,QAAQ,CAAC;EACtC,YAAY,IAAI,QAAQ,IAAI;CAC9B;CAEA,MAAM,OAAc,cAAc,KAAK,SAAS;EAC9C,MAAM,OAAO,YAAY,IAAI,IAAI,qBAAK,IAAI,IAAY;EACtD,MAAM,UAAU,MAAM,IAAI,IAAI,KAAK;EACnC,MAAM,oBAAoB,KAAK,IAAI,OAAO;EAC1C,OAAO;GACL;GACA;GACA;GACA,MAAM,oBACF,KACA,KAAK,OAAO,IACV,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,KAAK,IAAI,MACtD;EACR;CACF,CAAC;CAED,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,IAAI,KAAK,MAAM,GAAG,CAAC;CAC/D,QAAQ,IAAI,GAAG,OAAO,OAAO,KAAK,EAAE,kBAAkB;CACtD,QAAQ,IAAI,GAAG,IAAI,OAAO,KAAK,EAAE,kBAAkB;CACnD,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,UAAU,IAAI,oBAAoB,WAAW;EACnD,MAAM,SAAS,IAAI,SAAS,KAAK,KAAK,SAAS,IAAI;EACnD,QAAQ,IAAI,GAAG,IAAI,KAAK,OAAO,KAAK,EAAE,IAAI,QAAQ,IAAI,IAAI,UAAU,QAAQ;CAC9E;CACA,QAAQ,IAAI,EAAE;CAEd,MAAM,WAAW,KAAK,QAAQ,QAAQ,CAAC,IAAI,iBAAiB;CAC5D,QAAQ,IACN,GAAG,KAAK,SAAS,SAAS,OAAO,GAAG,KAAK,OAAO,GAAG,MAAM,OAAO,mCAClE;CAGA,MAAM,aAAa,MAAM,oBAAoB,KAAA,IAAY,OAAO,MAAM,MAAM,gBAAgB;CAC5F,IAAI,eAAe,MAAM;EACvB,MAAM,iBAAiB,WAAW,QAAQ,SAAS,CAAC,cAAc,SAAS,IAAI,CAAC;EAChF,MAAM,gBAAgB,cAAc,QAAQ,SAAS,CAAC,WAAW,SAAS,IAAI,CAAC;EAC/E,IAAI,eAAe,SAAS,GAC1B,QAAQ,IACN,6BAA6B,MAAM,OAAO,8BAA8B,eAAe,KAAK,IAAI,GAClG;EAEF,IAAI,cAAc,SAAS,GACzB,QAAQ,IACN,kCAAkC,MAAM,OAAO,kCAAkC,cAAc,KAAK,IAAI,GAC1G;CAEJ;CAGA,IAAI,mBAAmB,SAAS,GAAG;EACjC,QAAQ,IACN,WAAW,mBAAmB,OAAO,OAAO,MAAM,OAAO,gCAC3D;EACA,KAAK,MAAM,cAAc,mBAAmB,MAAM,GAAG,EAAE,GACrD,QAAQ,IAAI,KAAK,SAAS,WAAW,QAAQ,EAAE,IAAI,WAAW,MAAM;CAExE;CAEA,IAAI,SAAS,SAAS,GAAG;EACvB,MAAM,QAAQ,MAAM,WAAW,KAAA,IAAY,KAAK,QAAQ,MAAM,OAAO;EACrE,QAAQ,MACN,WAAW,SAAS,OAAO,GAAG,MAAM,OAAO,wBAAwB,MAAM,oDACpB,MAAM,QAAQ;kDAGrE;CACF;CACA,QAAQ,IAAI,EAAE;CACd,OAAO,SAAS;AAClB;;;;;AAMA,eAAsB,aAAa,QAAiB,UAAyB,CAAC,GAAoB;CAChG,MAAM,OAAO,QAAQ,QAAQ,QAAQ,QAAQ,IAAI,CAAC;CAClD,MAAM,SAAS,sBAAsB;CACrC,IAAI,WAAW;CACf,IAAI;EACF,KAAK,MAAM,SAAS,QAClB,YAAY,MAAM,YAAY,QAAQ,MAAM,KAAK;CAErD,UAAU;EACR,KAAK,MAAM,SAAS,QAAQ,kBAAkB,MAAM,KAAK;CAC3D;CACA,IAAI,WAAW,GAAG;EAChB,QAAQ,MAAM,SAAS,SAAS,+BAA+B,OAAO,OAAO,WAAW;EACxF,OAAO;CACT;CACA,QAAQ,IACN,kCAAkC,OAAO,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,eACnF;CACA,OAAO;AACT;AAEA,MAAM,kBAAkB;AAsBxB,SAAS,aAAa,MAAwB;CAC5C,MAAM,SAAkB,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;CAC7D,IAAI,OAAO,WAAW,YAAY,WAAW,MAAM,MAAM,IAAI,MAAM,mBAAmB,MAAM;CAI5F,MAAM,QAAQ;CACd,OAAO;EACL,SAAS,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU;EAC7D,iBAAiB,MAAM,eAAe,oBAAoB;EAC1D,aAAa,MAAM,mBAAmB,oBAAoB;CAC5D;AACF;;AAGA,SAAS,aAAa,YAAmC;CACvD,IAAI,MAAM,QAAQ,UAAU;CAC5B,SAAS;EACP,MAAM,YAAY,KAAK,KAAK,cAAc;EAC1C,IAAI,WAAW,SAAS,GAAG,OAAO;EAClC,MAAM,SAAS,QAAQ,GAAG;EAC1B,IAAI,WAAW,KAAK,OAAO;EAC3B,MAAM;CACR;AACF;;AAGA,SAAS,aAAa,OAAe,SAA0B;CAC7D,MAAM,QAAQ,2BAA2B,KAAK,KAAK;CACnD,IAAI,UAAU,MAAM,MAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;CAC5E,MAAM,CAAC,OAAO,OAAO,SAAS,MAAM,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM;CACvD,MAAM,CAAC,gBAAgB,gBAAgB,kBAAkB,QAAQ,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;CACtF,IAAI,mBAAmB,OAAO,OAAO;CACrC,IAAI,mBAAmB,OAAO,QAAQ,kBAAkB,MAAM,SAAS;CACvE,QAAQ,kBAAkB,OAAO,SAAS;AAC5C;;;;;;;;;;;;;AAcA,SAAgB,mBAAmB,OAAO,QAAQ,IAAI,GAAa;CACjE,MAAM,kBAAkB,cAAc,KAAK,QAAQ,IAAI,GAAG,cAAc,CAAC;CACzE,MAAM,kBAAkB,cAAc,YAAY,GAAG;CAErD,IAAI;CACJ,IAAI;EACF,WAAW,aAAa,gBAAgB,QAAQ,wBAAwB,CAAC;CAC3E,QAAQ;EACN,QAAQ,IAAI,6DAA6D;EACzE,OAAO,CAAC;CACV;CAEA,MAAM,WAAW,SAAS,gBAAgB,QAAQ,OAAO,EAAE;CAC3D,IAAI,CAAC,mBAAmB,KAAK,QAAQ,GACnC,OAAO,CAAC,aAAa,SAAS,QAAQ,sDAAsD;CAG9F,IAAI;CACJ,IAAI;EAEF,MAAM,WAAW,aADH,gBAAgB,QAAQ,iBACJ,CAAC;EACnC,IAAI,aAAa,MAAM,MAAM,IAAI,MAAM,uCAAuC;EAC9E,YAAY,aAAa,QAAQ;CACnC,QAAQ;EACN,OAAO,CAAC,iFAAiF;CAC3F;CAEA,MAAM,OAAO,aAAa,gBAAgB,QAAQ,iBAAiB,CAAC;CACpE,MAAM,OAAO,KAAK;CAClB,MAAM,WAAqB,CAAC;CAE5B,IAAI,UAAU,YAAY,UACxB,SAAS,KACP,mBAAmB,UAAU,QAAQ,8BAA8B,SAAS,QAAQ,YAC/E,SAAS,0CAA0C,SAAS,UACnE;CAEF,IAAI,CAAC,aAAa,MAAM,QAAQ,GAC9B,SAAS,KACP,mBAAmB,KAAK,QAAQ,yBAAyB,KAAK,iBAAiB,SAAS,QAAQ,YAClF,SAAS,4BACzB;CAEF,IAAI,SAAS,WAAW,GACtB,QAAQ,IACN,mCAAmC,UAAU,QAAQ,mBAAmB,SAAS,QAAQ,WAC3F;CAEF,OAAO;AACT;;AAGA,SAAgB,aAAa,OAAO,QAAQ,IAAI,GAAU;CACxD,MAAM,aAAa;CACnB,OAAO;EACL,QAAQ;EACR,YAAY,GAAG,WAAW;EAC1B,SAAS;EACT,YAAY;EACZ,QAAQ,GAAG,WAAW;EACtB,iBAAiB,YAAY;GAC3B,IAAI;IAMF,MAAM,SAAQ,MAJgB,OADN,cAAc,KAAK,QAAQ,IAAI,GAAG,cAAc,CACrB,CAAC,CAAC,QAAQ,iBAAiB,GAAA,CAIxD,SAAS;IAC/B,OAAO,OAAO,UAAU,YAAY,UAAU,OAC1C,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,MAAM,IAClC;GACN,QAAQ;IACN,OAAO;GACT;EACF;CACF;AACF;;AAGA,eAAsB,KAAK,OAAO,QAAQ,IAAI,GAAoB;CAChE,MAAM,cAAc,mBAAmB,IAAI;CAC3C,KAAK,MAAM,WAAW,aAAa,QAAQ,MAAM,SAAS,SAAS;CACnE,QAAQ,IAAI,EAAE;CACd,MAAM,eAAe,MAAM,aAAa,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC;CACtE,OAAO,YAAY,SAAS,eAAe,IAAI,IAAI;AACrD;AAEA,MAAM,UAAU,QAAQ,KAAK;AAM7B,IAJE,YAAY,KAAA,KACZ,WAAW,OAAO,KAClB,aAAa,OAAO,MAAM,cAAc,YAAY,GAAG,GAE9C;CACT,IAAI,WAAW;CACf,IAAI;EACF,WAAW,MAAM,KAAK;CACxB,SAAS,OAAO;EACd,QAAQ,MAAM,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;CACnF;CACA,QAAQ,KAAK,QAAQ;AACvB"}

package/docs/rules/README.md

@@ -0,0 +1,43 @@
+# The rules
+
+One page per rule, each with the diagnostic it emits, the fix, and the cases where a scoped
+override is honest. Every rule ships in the `rdj` plugin, so a rule id is `rdj/<rule-name>`.
+
+Seventeen of them are vendored from [dmmulroy/anti-slop](https://github.com/dmmulroy/anti-slop);
+`no-use-effect`, `no-hardcoded-jsx-text` and `static-public-env` are written here. Each page
+says which.
+
+## Types and assertions
+
+| Rule                                                                                      | What it rejects                                                                            |
+| ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
+| [no-chained-type-assertions](no-chained-type-assertions.md)                               | Two or more assertions stacked on one expression, unless all are `as const`.               |
+| [no-known-value-widening](no-known-value-widening.md)                                     | A value the file already describes flowing into `unknown`, `object` or an open dictionary. |
+| [no-object-parameters](no-object-parameters.md)                                           | A parameter annotated `object`, alias included.                                            |
+| [no-runtime-typeof](no-runtime-typeof.md)                                                 | `typeof`, except when probing for an absent binding with `"undefined"`.                    |
+| [no-unknown-parameters](no-unknown-parameters.md)                                         | An `unknown` parameter, except `cause` and a type predicate's subject.                     |
+| [no-unknown-returns](no-unknown-returns.md)                                               | A return contract of `unknown` or `Promise<unknown>`.                                      |
+| [no-unknown-type-aliases](no-unknown-type-aliases.md)                                     | An alias whose resolved type is `unknown`.                                                 |
+| [no-unsafe-dictionary-type](no-unsafe-dictionary-type.md)                                 | A dictionary whose value type is `unknown`, `any`, `object` or `{}`.                       |
+| [no-widen-then-assert](no-widen-then-assert.md)                                           | A local const widened and then asserted back in the same function.                         |
+| [require-safety-comment-for-type-assertion](require-safety-comment-for-type-assertion.md) | A non-const assertion with no `SAFETY:` justification before it.                           |
+
+## Code patterns
+
+| Rule                                                                        | What it rejects                                            |
+| --------------------------------------------------------------------------- | ---------------------------------------------------------- |
+| [no-array-filter-map](no-array-filter-map.md)                               | Adjacent `.filter()` and `.map()` passes on a known array. |
+| [no-conditional-empty-object-spread](no-conditional-empty-object-spread.md) | A spread of a conditional with `{}` on one branch.         |
+| [no-module-mocking](no-module-mocking.md)                                   | `vi.mock`, `jest.mock` and their variants.                 |
+| [no-reduce-accumulator-copy](no-reduce-accumulator-copy.md)                 | A reducer that copies its accumulator on every step.       |
+| [no-reflect-apply](no-reflect-apply.md)                                     | `Reflect.apply` on the global `Reflect`.                   |
+| [no-reflect-get](no-reflect-get.md)                                         | `Reflect.get` on the global `Reflect`.                     |
+| [no-shape-in-symbol-names](no-shape-in-symbol-names.md)                     | The substring `shape` in a name you own.                   |
+
+## Framework rules
+
+| Rule                                              | What it rejects                                               |
+| ------------------------------------------------- | ------------------------------------------------------------- |
+| [no-use-effect](no-use-effect.md)                 | Every `useEffect` and `useLayoutEffect` call or value import. |
+| [no-hardcoded-jsx-text](no-hardcoded-jsx-text.md) | Words written straight into JSX children.                     |
+| [static-public-env](static-public-env.md)         | Every `process.env` use but a static `process.env.NAME` read. |

package/docs/rules/no-array-filter-map.md

@@ -0,0 +1,60 @@
+# rdj/no-array-filter-map
+
+Rejects a `.filter()` and a `.map()` pass placed back to back on a receiver the file already
+shows to be an array.
+
+## Why
+
+Two adjacent passes walk the data twice and allocate an array nobody reads. That intermediate
+array is invisible in review: the reader has to hold both callbacks in mind to see what one
+pass would have produced. The rule fires only on local array evidence, an array literal, an
+annotation of `T[]`, `readonly T[]`, `Array<T>` or `ReadonlyArray<T>`, or a `const` alias of
+one, so an unknown receiver and an iterator pipeline stay out of its way.
+
+## Rejected
+
+```ts
+const users = [];
+users.filter(active).map(email);
+```
+
+> Avoid consecutive array `filter` and `map` passes. Prefer
+> `.values().filter(...).map(...).toArray()` where iterator helpers are supported, or a single
+> `flatMap`/mutating reducer. Preserve callback ordering, indexes, and filtering semantics.
+
+```ts
+function collect(users: readonly User[]) {
+  return users.map(email).filter(present);
+}
+```
+
+> Avoid consecutive array `map` and `filter` passes. Prefer
+> `.values().map(...).filter(...).toArray()` where iterator helpers are supported, or a single
+> `flatMap`/mutating reducer. Preserve callback ordering, indexes, and filtering semantics.
+
+## Accepted
+
+```ts
+const users = [];
+users.values().filter(active).map(email).toArray();
+```
+
+```ts
+const users = [];
+users.flatMap((user) => (user.active ? [user.email] : []));
+```
+
+## Options
+
+None.
+
+## When it is right to turn it off
+
+Nothing needs an exception. On a runtime without iterator helpers, Hermes for instance, the
+message's first suggestion does not apply, but `flatMap` and a plain loop both satisfy the
+rule, so the right move is to fix the call and note the runtime beside the severity rather
+than scope the rule off.
+
+## Origin
+
+Vendored from dmmulroy/anti-slop, commit `c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b`.

package/docs/rules/no-chained-type-assertions.md

@@ -0,0 +1,52 @@
+# rdj/no-chained-type-assertions
+
+Rejects two or more type assertions stacked on one expression, unless every one of them is
+`as const`.
+
+## Why
+
+`input as unknown as User` exists to make the compiler stop objecting. The first assertion
+throws away what the value was, the second invents what it now is, and nothing checked the
+value in between. A reader sees a named type and has no way to tell whether anything ever
+validated it. Parenthesized and angle bracket spellings are the same move, so the rule counts
+through both.
+
+## Rejected
+
+```ts
+const value = input as unknown as User;
+```
+
+> This assertion chain discards type evidence. Keep the original precise type, or parse
+> untrusted input at its boundary before narrowing it.
+
+```ts
+const value = { id: 1 } as const as User;
+```
+
+> This assertion chain discards type evidence. Keep the original precise type, or parse
+> untrusted input at its boundary before narrowing it.
+
+## Accepted
+
+```ts
+const value = input as User;
+```
+
+```ts
+const value = { id: 1 } as const as const;
+```
+
+## Options
+
+None.
+
+## When it is right to turn it off
+
+Nothing legitimate needs a chain. One assertion is still allowed, so the fix is to drop the
+laundering step and let `rdj/require-safety-comment-for-type-assertion` ask what the remaining
+assertion knows.
+
+## Origin
+
+Vendored from dmmulroy/anti-slop, commit `c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b`.