@rdjperron/lint 0.1.0 → 0.2.0

package/docs/rules/no-unknown-type-aliases.md

@@ -0,0 +1,52 @@
+# rdj/no-unknown-type-aliases
+
+Rejects a type alias whose resolved type is `unknown`.
+
+## Why
+
+`type Payload = unknown` gives a vague type a confident name. Every signature that uses it
+reads as if it were parsed, and none of them are. A union does the same thing quietly:
+`string | unknown` is `unknown`, so the `string` half is decoration. The rule resolves through
+chains and generic instantiations, so `Identity<unknown>` and an alias of an alias are caught,
+and a chain reports at each declaration that resolves to `unknown`.
+
+## Rejected
+
+```ts
+type Alias = unknown;
+```
+
+> Type alias `Alias` hides `unknown`. Keep `unknown` explicit at the parsing boundary or on an
+> allowed `cause` field; otherwise use the parsed owner type.
+
+```ts
+type Payload = string | unknown;
+```
+
+> Type alias `Payload` hides `unknown`. Keep `unknown` explicit at the parsing boundary or on an
+> allowed `cause` field; otherwise use the parsed owner type.
+
+## Accepted
+
+```ts
+type Box<T> = { readonly value: T };
+type Payload = Box<unknown>;
+```
+
+```ts
+type User = { readonly id: string };
+```
+
+## Options
+
+None.
+
+## When it is right to turn it off
+
+Nothing needs it off. Where `unknown` is genuinely the right type, at a parsing boundary or on
+an error's `cause`, writing `unknown` at that spot is both allowed and clearer than a name that
+conceals it.
+
+## Origin
+
+Vendored from dmmulroy/anti-slop, commit `c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b`.

package/docs/rules/no-unsafe-dictionary-type.md

@@ -0,0 +1,56 @@
+# rdj/no-unsafe-dictionary-type
+
+Rejects a dictionary contract whose value type is `unknown`, `any`, `object`, `{}`, or a union,
+alias or intersection that reaches one of those.
+
+## Why
+
+`Record<string, unknown>` promises a lookup and delivers nothing: every read needs a cast, and
+the cast is written at each call site by someone guessing. The type is usually a stand-in for a
+schema nobody wrote. The rule covers `Record` with a broad key, index signatures, mapped types
+and interface index members, resolves aliases and generic defaults, and reports the outermost
+type only, so one bad dictionary produces one finding. The value name in the message is one of
+`unknown`, `any`, `object`, `empty-object` or `union`.
+
+## Rejected
+
+```ts
+type Registry = Record<string, unknown>;
+```
+
+> This dictionary's unknown value type gives callers no concrete value contract. Use an
+> owner/schema-derived value type; parse external payloads before insertion.
+
+```ts
+type Registry = { [key: string]: any };
+```
+
+> This dictionary's any value type gives callers no concrete value contract. Use an
+> owner/schema-derived value type; parse external payloads before insertion.
+
+## Accepted
+
+```ts
+type Commands = Record<string, Command>;
+```
+
+```ts
+type Allowed = Record<string, { payload: unknown }>;
+```
+
+A finite key type is a different thing and passes: `Record<Permission, number>` is exhaustive,
+and a type parameter constrained by `Record<string, unknown>` is a constraint, not a contract.
+
+## Options
+
+None.
+
+## When it is right to turn it off
+
+The one module that holds a decoded JSON object before any field is read. There is no schema
+yet to name the values by, and the readers beside it are what give each field a type. Scope it
+to that module, not to the callers.
+
+## Origin
+
+Vendored from dmmulroy/anti-slop, commit `c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b`.

package/docs/rules/no-use-effect.md

@@ -0,0 +1,55 @@
+# rdj/no-use-effect
+
+Rejects every `useEffect` and `useLayoutEffect` call, and every value import of either.
+
+## Why
+
+An effect that computes state runs after the render that needed it, so the screen paints once
+with the old value and again with the new one, and the dependency array becomes the place bugs
+hide. Almost every use has a shorter form: derive the value during render, do the work in the
+event handler that caused it, or subscribe through a reactive query. Reporting the import as
+well as the call is deliberate, since an import is how the next one arrives. The rule matches
+by name, so `React.useEffect` and an aliased import both report.
+
+## Rejected
+
+```tsx
+useEffect(() => {
+  document.title = title;
+}, [title]);
+```
+
+> Do not call useEffect. Derive the value during render, do the work in the event handler, or
+> subscribe through a reactive query.
+
+```tsx
+import { useLayoutEffect } from "react";
+```
+
+> Do not call useLayoutEffect. Derive the value during render, do the work in the event handler,
+> or subscribe through a reactive query.
+
+## Accepted
+
+```tsx
+const value = useMemo(() => compute(input), [input]);
+```
+
+```tsx
+import type { useEffect } from "react";
+```
+
+## Options
+
+`hint`, a string, no default. It is appended to every message, which is how a project names its
+own sanctioned wrapper, for example "The one sanctioned wrapper is useMountEffect."
+
+## When it is right to turn it off
+
+The single file that wraps the hook. A genuine one-time external subscription needs a real
+effect somewhere, so it lives in one named wrapper and that file carries the only override.
+Every other file then has no reason to import the hook at all.
+
+## Origin
+
+Written in this package.

package/docs/rules/no-widen-then-assert.md

@@ -0,0 +1,53 @@
+# rdj/no-widen-then-assert
+
+Rejects a local `const` that is explicitly widened and then asserted back to a narrower type
+later in the same function.
+
+## Why
+
+The round trip costs the file its one piece of real evidence. The initializer showed what the
+value was, the annotation threw that away, and the assertion re-invents it by hand, so a typo
+in the asserted type is now unreachable by the checker. A reader has to compare two type
+expressions several lines apart to see whether they agree. The rule wants one precise type from
+initialization to use. It only fires on a `const` that is never reassigned, widened by its
+annotation or by an `as unknown` initializer, and asserted after its declaration within the
+same function.
+
+## Rejected
+
+```ts
+const source = { id: "second" };
+const widened: unknown = source;
+const parsed = widened as { readonly id: string };
+```
+
+> Binding "widened" discards type evidence and later recreates it with an assertion. Keep the
+> precise type from initialization through use; parse boundary input once.
+
+## Accepted
+
+```ts
+declare const input: unknown;
+const parsed = input as { readonly id: string };
+```
+
+```ts
+const source = { id: "first" };
+const widened: unknown = source;
+```
+
+The second one is accepted here because nothing asserts the binding back. The widening itself
+is what `rdj/no-known-value-widening` reports.
+
+## Options
+
+None.
+
+## When it is right to turn it off
+
+Nothing needs it off. Where the value genuinely arrives unknown, as a parameter or an import,
+there is no local widening and the rule stays silent.
+
+## Origin
+
+Vendored from dmmulroy/anti-slop, commit `c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b`.

package/docs/rules/require-safety-comment-for-type-assertion.md

@@ -0,0 +1,59 @@
+# rdj/require-safety-comment-for-type-assertion
+
+Requires a `SAFETY:` comment before every type assertion that is not `as const`.
+
+## Why
+
+An assertion is a claim the checker cannot verify, so the only thing that makes it reviewable
+is the sentence saying which check already ran. Without it a reviewer cannot tell a justified
+narrowing from a cast that silenced an error. The comment has to sit before the assertion or
+before the statement that contains it, which also means a trailing `// SAFETY:` at the end of
+the line does not count: it is read after the claim it was supposed to support. The marker must
+be followed by a colon and at least one non-space character, so an empty `// SAFETY:` still
+reports.
+
+## Rejected
+
+```ts
+const id = value as UserId;
+```
+
+> This type assertion has no `SAFETY:` justification. State the checked invariant immediately
+> before the assertion or its containing statement.
+
+```ts
+const id = value as UserId; // SAFETY: Too late.
+```
+
+> This type assertion has no `SAFETY:` justification. State the checked invariant immediately
+> before the assertion or its containing statement.
+
+## Accepted
+
+```ts
+// SAFETY: The parser established the UserId invariant.
+const id = value as UserId;
+```
+
+```ts
+const id = /* SAFETY: Validation established the invariant. */ value as UserId;
+```
+
+`as const` and `<const>` assertions are exempt, and a comment above an `export` covers the
+declaration it exports.
+
+## Options
+
+`markers`, an array of unique non-empty strings, default `["SAFETY"]`. Any one of them
+satisfies the rule; the first fills the `{{marker}}` in the message. A project that already
+writes `// INVARIANT:` can keep its own word.
+
+## When it is right to turn it off
+
+Test files. A fixture's assertions are all the same claim, that the fixture is what the test
+just built, and repeating it on each one is noise rather than review material. One consumer
+measured 53 such findings across its tests before scoping the rule off there.
+
+## Origin
+
+Vendored from dmmulroy/anti-slop, commit `c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b`.

package/docs/rules/static-public-env.md

@@ -0,0 +1,55 @@
+# rdj/static-public-env
+
+Rejects every use of `process.env` except a static `process.env.NAME` read.
+
+## Why
+
+Expo replaces each `process.env.EXPO_PUBLIC_*` read textually at bundle time. There is no
+`process.env` object on the device, so anything the substitution cannot see becomes `undefined`
+at runtime and nothing fails at build time. Destructuring, a computed key and passing
+`process.env` around as a value all read fine and all break silently on the phone. The rule has
+three messages, one per form, so the finding names which one it found.
+
+## Rejected
+
+```ts
+const { EXPO_PUBLIC_API_URL } = process.env;
+```
+
+> Expo replaces each `process.env.EXPO_PUBLIC_*` read textually at bundle time, so there is no
+> `process.env` object to destructure on the device. Read each variable as `process.env.NAME`.
+
+```ts
+const url = process.env[name];
+```
+
+> Expo replaces each `process.env.EXPO_PUBLIC_*` read textually at bundle time, so a computed
+> key is undefined on the device. Read the variable as `process.env.NAME` with the name spelled
+> out.
+
+Everything else, including `Object.keys(process.env)`, `"A" in process.env` and a spread,
+reports the third message: `process.env` passed around as a value is empty on the device.
+
+## Accepted
+
+```ts
+const url = process.env.EXPO_PUBLIC_API_URL ?? "http://localhost";
+```
+
+```ts
+const url = process.env?.EXPO_PUBLIC_API_URL;
+```
+
+## Options
+
+None.
+
+## When it is right to turn it off
+
+Code that never enters the app bundle: a build script, a config file, anything running under
+Node where `process.env` is a real object. Scope the override to those files, since the rule's
+whole value is that it fires on the side Metro bundles.
+
+## Origin
+
+Written in this package.

package/fixtures/README.md

@@ -1,9 +1,7 @@
 # fixtures: load-bearing test data, do not delete
 
-One deliberately violating file per rule, in one directory per pack:
-`anti-slop/<rule>.fixture.ts`, `react/no-use-effect.fixture.tsx`,
-`i18n/no-hardcoded-jsx-text.fixture.tsx` and `expo/static-public-env.fixture.ts`. Each file trips
-exactly the rule it is named after, and nothing else.
+One deliberately violating file per rule, `<rule>.fixture.ts` or `.fixture.tsx`, flat. Each file
+trips exactly the rule it is named after, and nothing else.
 
 These ship in the published package (`files` in `package.json`), so a consumer proves the rules
 fire through its own linter, not ours.
@@ -18,18 +16,17 @@ pattern swallows the wrong path.
 And a dead lint rule is silent. "Rule reports nothing" looks identical to "code has no
 violations". Nothing else would notice.
 
-The source repo's `scripts/verify-lint-fixtures.mjs` (in CI and in `vp run ready`) lints each
-pack's fixtures and asserts a positive: every rule must fire, each on its own fixture. If a rule
-goes dead, the run fails loudly instead of going quietly green.
+`npx rdj-lint-verify` lints these files and asserts a positive: every rule must fire, each on its
+own fixture. If a rule goes dead, the run fails loudly instead of going quietly green.
 
 ## How it relates to the unit tests
 
 Two layers, different questions:
 
-| Layer                            | Question it answers                                                                                            | Where                                                             |
-| -------------------------------- | -------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
-| This directory + a verify script | Does each rule fire through the real pipeline: the bundled oxlint, the `jsPlugins` wiring, the actual config? | `fixtures/`, the consumer's `scripts/verify-lint-fixtures.mjs`   |
-| Unit tests (RuleTester)          | Is each rule's logic right? Valid cases stay quiet, invalid cases report, with per-case precision.             | `tests/` in the source repo (not published)                       |
+| Layer                       | Question it answers                                                                            | Where                                  |
+| --------------------------- | ------------------------------------------------------------------------------------------------ | -------------------------------------- |
+| This directory + the verify command | Does each rule fire through the real pipeline: the bundled oxlint, the `jsPlugins` wiring, the actual config? | `fixtures/`, `rdj-lint-verify`  |
+| Unit tests (RuleTester)     | Is each rule's logic right? Valid cases stay quiet, invalid cases report, with per-case precision. | `tests/` in the source repo (not published) |
 
 The unit tests catch a locally edited rule that starts over- or under-firing. This layer catches
 the rule not running at all. Both are needed.
@@ -38,26 +35,28 @@ the rule not running at all. Both are needed.
 
 - Do not delete or "clean up" these files. They are the regression proof for rules nobody
   upstream maintains for us.
-- In the source repo they are in `lint.ignorePatterns` and `fmt.ignorePatterns`, so a plain
-  `vp check` stays quiet. The verify script reaches them through a transient symlink at
-  `scripts/.lint-fixtures/<pack>`, because no `vp lint` flag re-includes a config-ignored path and
-  oxlint skips `node_modules` by default.
+- The consumer's config must carry the `fixtures()` override from `@rdjperron/lint/config`, which
+  puts every rule at `error` on the view path. No command-line flag can do it: `-A`, `-W` and `-D`
+  reach built-in rules only and leave a JS plugin rule exactly as the config left it.
+- The fixtures sit under `node_modules`, which oxlint never walks, so the check lints them through
+  a transient symlink at `scripts/.lint-fixtures/rdj`. In the source repo they are also in
+  `lint.ignorePatterns` and `fmt.ignorePatterns`, so a plain `vp check` stays quiet; no `vp lint`
+  flag re-includes a config-ignored path.
 - Never gitignore that view. oxlint honours `.gitignore`, so gitignoring anything on the
-  verification path silently disables the whole check (this happened once; the script now detects
+  verification path silently disables the whole check (this happened once; the check now detects
   it with `git check-ignore` and says so).
 - Name fixtures `*.fixture.ts` / `*.fixture.tsx`, never `*.test.ts`, or Vitest collects them and
   the deliberately broken code fails the test run.
 - One rule per file. A fixture that trips two rules makes the per-rule assertion ambiguous.
-- Expected advisory noise in the source repo: the type-aware pass also reports `typescript(TS…)`
-  on the view, because no tsconfig covers `scripts/.lint-fixtures/` (no React types, no `process`
-  types, no `jsx` setting). The script lists those as non-pack diagnostics rather than hiding
-  them; only a pack rule that did not fire fails the run.
+- Expected advisory noise: a type-aware pass also reports `typescript(TS…)` on the view, because
+  no tsconfig covers it (no React types, no `process` types, no `jsx` setting). Those are listed
+  as non-plugin diagnostics rather than hidden; only a plugin rule that did not fire fails the run.
 
 ## When a rule stops firing after a `vp` upgrade
 
 1. `vp toolchain oxlint`: did the bundled oxlint move?
 2. `vp why @oxlint/plugins`: if `vite-plus` now declares a different version, move the exact
-   pin to it and reinstall. In the source repo the parity test in `tests/` fails until you do.
-3. Re-run the verify script.
+   pin to it and reinstall. `rdj-lint-verify` fails on that skew before it reaches the rules.
+3. Re-run the check.
 4. Still dead? The rule's AST expectations may have changed under the new oxc version. Read the
-   rule in `src/<pack>/rules/`, fix it, add the case to `tests/rules/<pack>/`, and release.
+   rule in `src/rules/` or `src/anti-slop/rules/`, fix it, add the case to `tests/`, and release.

package/fixtures/{anti-slop/no-array-filter-map.fixture.ts → no-array-filter-map.fixture.ts}

@@ -1,4 +1,4 @@
-// Fixture for anti-slop/no-array-filter-map.
+// Fixture for rdj/no-array-filter-map.
 export function activeEmails(users: { active: boolean; email: string }[]): string[] {
   return users.filter((user) => user.active).map((user) => user.email);
 }

package/fixtures/{anti-slop/no-chained-type-assertions.fixture.ts → no-chained-type-assertions.fixture.ts}

@@ -1,4 +1,4 @@
-// Fixture for anti-slop/no-chained-type-assertions.
+// Fixture for rdj/no-chained-type-assertions.
 const rawCount = "12";
 
 // SAFETY: fixture file; the assertion chain is the behaviour under test.

package/fixtures/{anti-slop/no-conditional-empty-object-spread.fixture.ts → no-conditional-empty-object-spread.fixture.ts}

@@ -1,4 +1,4 @@
-// Fixture for anti-slop/no-conditional-empty-object-spread.
+// Fixture for rdj/no-conditional-empty-object-spread.
 const includeExtra = true;
 
 export const requestBody = { name: "widget", ...(includeExtra ? { extra: 1 } : {}) };

package/fixtures/{i18n/no-hardcoded-jsx-text.fixture.tsx → no-hardcoded-jsx-text.fixture.tsx}

@@ -1,4 +1,4 @@
-// Fixture for i18n/no-hardcoded-jsx-text.
+// Fixture for rdj/no-hardcoded-jsx-text.
 export function Fixture() {
   return <button type="button">Save changes</button>;
 }

package/fixtures/{anti-slop/no-known-value-widening.fixture.ts → no-known-value-widening.fixture.ts}

@@ -1,2 +1,2 @@
-// Fixture for anti-slop/no-known-value-widening.
+// Fixture for rdj/no-known-value-widening.
 export const retrySettings: unknown = { retries: 3 };

package/fixtures/{anti-slop/no-module-mocking.fixture.ts → no-module-mocking.fixture.ts}

@@ -1,4 +1,4 @@
-// Fixture for anti-slop/no-module-mocking.
+// Fixture for rdj/no-module-mocking.
 // `vi` is deliberately left undeclared: the rule's global/unresolved-reference
 // path is what recognises `vi.mock` without importing from "vitest" (which
 // `vite-plus/prefer-vite-plus-imports` forbids in this repo).

package/fixtures/{anti-slop/no-object-parameters.fixture.ts → no-object-parameters.fixture.ts}

@@ -1,4 +1,4 @@
-// Fixture for anti-slop/no-object-parameters.
+// Fixture for rdj/no-object-parameters.
 export function serialize(payload: object): string {
   return JSON.stringify(payload);
 }

package/fixtures/{anti-slop/no-reduce-accumulator-copy.fixture.ts → no-reduce-accumulator-copy.fixture.ts}

@@ -1,4 +1,4 @@
-// Fixture for anti-slop/no-reduce-accumulator-copy.
+// Fixture for rdj/no-reduce-accumulator-copy.
 export function indexById(items: { id: string }[]): Record<string, { id: string }> {
   return items.reduce((acc, item) => Object.assign({}, acc, { [item.id]: item }), {});
 }

package/fixtures/{anti-slop/no-reflect-apply.fixture.ts → no-reflect-apply.fixture.ts}

@@ -1,4 +1,4 @@
-// Fixture for anti-slop/no-reflect-apply.
+// Fixture for rdj/no-reflect-apply.
 function add(left: number, right: number): number {
   return left + right;
 }

package/fixtures/{anti-slop/no-reflect-get.fixture.ts → no-reflect-get.fixture.ts}

@@ -1,4 +1,4 @@
-// Fixture for anti-slop/no-reflect-get.
+// Fixture for rdj/no-reflect-get.
 const entry = { id: "a" };
 
 export const identifier = Reflect.get(entry, "id");

package/fixtures/{anti-slop/no-runtime-typeof.fixture.ts → no-runtime-typeof.fixture.ts}

@@ -1,4 +1,4 @@
-// Fixture for anti-slop/no-runtime-typeof.
+// Fixture for rdj/no-runtime-typeof.
 export function describeValue(value: string | number): string {
   return typeof value === "string" ? "text" : "number";
 }

package/fixtures/no-shape-in-symbol-names.fixture.ts

@@ -0,0 +1,2 @@
+// Fixture for rdj/no-shape-in-symbol-names.
+export const shapeCount = 1;

package/fixtures/{anti-slop/no-unknown-parameters.fixture.ts → no-unknown-parameters.fixture.ts}

@@ -1,4 +1,4 @@
-// Fixture for anti-slop/no-unknown-parameters.
+// Fixture for rdj/no-unknown-parameters.
 export function record(payload: unknown): string {
   return String(payload);
 }

package/fixtures/{anti-slop/no-unknown-returns.fixture.ts → no-unknown-returns.fixture.ts}

@@ -1,4 +1,4 @@
-// Fixture for anti-slop/no-unknown-returns.
+// Fixture for rdj/no-unknown-returns.
 export function load(serialized: string): unknown {
   return JSON.parse(serialized);
 }

package/fixtures/no-unknown-type-aliases.fixture.ts

@@ -0,0 +1,2 @@
+// Fixture for rdj/no-unknown-type-aliases.
+export type Payload = unknown;

package/fixtures/no-unsafe-dictionary-type.fixture.ts

@@ -0,0 +1,2 @@
+// Fixture for rdj/no-unsafe-dictionary-type.
+export type Registry = Record<string, unknown>;

package/fixtures/{react/no-use-effect.fixture.tsx → no-use-effect.fixture.tsx}

@@ -1,4 +1,4 @@
-// Fixture for react-policy/no-use-effect.
+// Fixture for rdj/no-use-effect.
 import { useEffect } from "react";
 
 export function Fixture({ title }: { title: string }) {

package/fixtures/{anti-slop/no-widen-then-assert.fixture.ts → no-widen-then-assert.fixture.ts}

@@ -1,4 +1,4 @@
-// Fixture for anti-slop/no-widen-then-assert.
+// Fixture for rdj/no-widen-then-assert.
 function project(entry: { id: string }): string {
   const widened: unknown = entry;
   // SAFETY: fixture file; the widen-then-assert flow is the behaviour under test.

package/fixtures/{anti-slop/require-safety-comment-for-type-assertion.fixture.ts → require-safety-comment-for-type-assertion.fixture.ts}

@@ -1,4 +1,4 @@
-// Fixture for anti-slop/require-safety-comment-for-type-assertion.
+// Fixture for rdj/require-safety-comment-for-type-assertion.
 export function lengthOf(entry: { id: string }): number {
   const widerEntry = entry as { id: string; extra?: number };
   return widerEntry.id.length;

package/fixtures/{expo/static-public-env.fixture.ts → static-public-env.fixture.ts}

@@ -1,4 +1,4 @@
-// Fixture for expo/static-public-env.
+// Fixture for rdj/static-public-env.
 const { EXPO_PUBLIC_API_URL } = process.env;
 
 export const apiUrl = EXPO_PUBLIC_API_URL;

package/package.json

@@ -1,50 +1,51 @@
 {
   "name": "@rdjperron/lint",
-  "version": "0.1.0",
-  "description": "Oxlint JS plugins: the anti-slop, react-policy, i18n and expo rule packs, shipped with the fixture that proves each rule fires.",
+  "version": "0.2.0",
+  "description": "One Oxlint JS plugin, `rdj`: 20 rules against low-evidence code, with the config data, the fixture that proves each rule fires, and the command that checks it.",
   "license": "MIT",
+  "bin": {
+    "rdj-lint-verify": "dist/verify.mjs"
+  },
   "files": [
     "dist",
+    "docs",
     "fixtures",
+    "LICENSE",
     "README.md"
   ],
   "type": "module",
   "exports": {
-    "./anti-slop": {
-      "types": "./dist/anti-slop.d.mts",
-      "default": "./dist/anti-slop.mjs"
-    },
-    "./react": {
-      "types": "./dist/react.d.mts",
-      "default": "./dist/react.mjs"
+    ".": {
+      "types": "./dist/index.d.mts",
+      "default": "./dist/index.mjs"
     },
-    "./i18n": {
-      "types": "./dist/i18n.d.mts",
-      "default": "./dist/i18n.mjs"
+    "./config": {
+      "types": "./dist/config.d.mts",
+      "default": "./dist/config.mjs"
     },
-    "./expo": {
-      "types": "./dist/expo.d.mts",
-      "default": "./dist/expo.mjs"
+    "./verify": {
+      "types": "./dist/verify.d.mts",
+      "default": "./dist/verify.mjs"
     },
     "./fixtures/*": "./fixtures/*",
     "./package.json": "./package.json"
   },
+  "scripts": {
+    "build": "vp pack",
+    "test": "vp test",
+    "check": "vp check"
+  },
   "devDependencies": {
-    "@oxlint/plugins": "1.79.0",
-    "@types/node": "^24",
-    "typescript": "^7.0.2",
-    "vite": "npm:@voidzero-dev/vite-plus-core@0.3.1",
-    "vite-plus": "0.3.1"
+    "@oxlint/plugins": "catalog:",
+    "@types/node": "catalog:",
+    "typescript": "catalog:",
+    "vite": "catalog:",
+    "vite-plus": "catalog:"
   },
   "peerDependencies": {
     "@oxlint/plugins": "^1.79.0"
   },
   "engines": {
     "node": ">=24"
-  },
-  "scripts": {
-    "build": "vp pack",
-    "test": "vp test",
-    "check": "vp check"
   }
-}
+}

package/dist/anti-slop.d.mts

@@ -1,6 +0,0 @@
-//#region src/anti-slop/index.d.ts
-/** Generic Oxlint rules that reject low-evidence and low-signal implementation patterns. */
-declare const antiSlopPlugin: import("@oxlint/plugins").Plugin;
-//#endregion
-export { antiSlopPlugin as default };
-//# sourceMappingURL=anti-slop.d.mts.map