@shibanet0/datamitsu-config 0.2.0 → 0.4.1

package/dist/apps/cspell/ignore.d.ts

@@ -0,0 +1 @@
+export declare const ignorePaths: string[];

package/dist/apps/eslint/globs.d.ts

@@ -9,8 +9,44 @@ export declare const GLOB_CSS = "**/*.css";
 export declare const GLOB_POSTCSS = "**/*.{p,post}css";
 export declare const GLOB_LESS = "**/*.less";
 export declare const GLOB_SCSS = "**/*.scss";
+/**
+ * Where test files live, for the plugins whose rules only make sense inside one.
+ *
+ * Both of the plugins that need this were mis-scoped. The vitest block asked for `tests/**`, which
+ * matches nothing in a repository whose tests are in `__tests__/` — so its rules had never run at
+ * all. eslint-plugin-playwright's `flat/recommended` carries no `files` of its own, so its 38 rules
+ * applied to every file in any project that has playwright installed.
+ *
+ * One list rather than two per plugin, because "is this a test file" is one question. The e2e set
+ * is separate only because playwright's default `testDir` is a directory rather than a filename
+ * convention.
+ */
+export declare const GLOB_TESTS: string[];
+/**
+ * Where playwright specs live. Directory-shaped, because playwright scopes by `testDir` rather than
+ * by filename — which is also why this is a separate list from {@link GLOB_TESTS}.
+ *
+ * `**\/tests/**` is deliberately not here. It is the conventional home of _unit_ tests in plenty of
+ * projects, and matching it applied all 38 playwright rules to them: `no-conditional-in-test`,
+ * `no-conditional-expect`, `no-focused-test`, `prefer-to-have-length` on a vitest file, two of them
+ * duplicating a sonarjs finding on the same line. A project that keeps e2e specs somewhere else
+ * names the directory itself; that is a smaller cost than arming the rules everywhere.
+ */
+export declare const GLOB_E2E: string[];
+export declare const GLOB_HTML = "**/*.html";
+export declare const GLOB_SVELTE = "**/*.svelte";
+/**
+ * Svelte 5's rune modules — plain JS/TS that may use `$state` and friends, which
+ * `svelte-eslint-parser` has to see to resolve them.
+ *
+ * Kept separate from {@link GLOB_SVELTE} because these files are also matched by `GLOB_SRC`: the
+ * TypeScript block reaches them too, and the svelte parser is attached on top rather than instead.
+ */
+export declare const GLOB_SVELTE_SCRIPT: string[];
 export declare const GLOB_JSON = "**/*.json";
 export declare const GLOB_JSON5 = "**/*.json5";
 export declare const GLOB_JSONC = "**/*.jsonc";
+export declare const GLOB_TOML = "**/*.toml";
+export declare const GLOB_YAML = "**/*.{yaml,yml}";
 export declare const GLOB_ALL_SRC: string[];
-export declare const GLOB_EXCLUDE: string[];
+export { GLOB_EXCLUDE } from "../../globs/globs";

package/dist/apps/eslint/plugins/eslint-comments.d.ts

@@ -0,0 +1,13 @@
+import type { TypedFlatConfigItem } from "../types";
+/**
+ * Rules about the suppression comments themselves — the other half of
+ * `reportUnusedDisableDirectives`.
+ *
+ * That option catches a directive that suppresses nothing. These catch the shapes that suppress too
+ * much or never end: `no-unlimited-disable` (a bare `/* eslint-disable *\/` that silences every
+ * rule for the rest of the file), `disable-enable-pair`, `no-aggregating-enable`,
+ * `no-duplicate-disable`, `no-unused-enable`.
+ *
+ * The plugin was a dependency every consumer downloaded and no config ever loaded.
+ */
+export declare function eslintComments(): Promise<TypedFlatConfigItem[]>;

package/dist/apps/eslint/plugins/json-schema-validator.d.ts

@@ -1,2 +1,21 @@
 import type { TypedFlatConfigItem } from "../types";
+/**
+ * Validates a file against whatever schema schemastore maps its name to.
+ *
+ * The preset installs parsers for JSON, YAML and TOML in `files`-scoped blocks, and then puts the
+ * rule itself in an unscoped one — so `setDefaultIgnores` took it off every JSON file and left it
+ * running on TypeScript, where it has nothing to validate. 852 of the catalogue's 1364 entries
+ * match `.json`/`.jsonc`/`.json5`, which means `package.json` with `"version": 123` and
+ * `tsconfig.json` with `"strict": "yes"` were never checked.
+ *
+ * JSON only, though the preset parses YAML and TOML as well. YAML 1.1 reads a bare `on:` as the
+ * boolean `true`, so a GitHub workflow arrives at the validator with its trigger key renamed and
+ * the schema rejects the whole document — 22 findings on one release workflow here, every one an
+ * artefact of the parse rather than a fact about the file. The rule is right about JSON, where 852
+ * of the catalogue's 1364 entries apply, and wrong about YAML for a reason nothing in this config
+ * can fix.
+ *
+ * This also forecloses the plugin's other mode — validating a JS module's default export against a
+ * schema — which nothing here uses.
+ */
 export declare function jsonSchemaValidator(): Promise<TypedFlatConfigItem[]>;

package/dist/apps/eslint/plugins/jsonc.d.ts

@@ -1,2 +1,33 @@
 import type { TypedFlatConfigItem } from "../types";
+/**
+ * The JSON linter, scoped so its rules reach the files they exist for.
+ *
+ * Both upstream presets are three blocks: a plugin registration, a `files`-scoped block that
+ * installs the `jsonc/x` language, and a third that carries all the actual rules with **no `files`
+ * at all**. That third shape is exactly what `composer.setDefaultIgnores` targets, so it was being
+ * stamped with `ignores: ["**\/*.json", "**\/*.json5", "**\/*.jsonc", …]` — the four globs it
+ * exists for. The language block scoped itself and survived; the rule block did not, and 28 rules
+ * were off on JSON and on everywhere else.
+ *
+ * Measured before the fix: `{"a": 1, "a": +3}` in a `.json` file reported nothing, while the preset
+ * alone reports `no-dupe-keys`, `no-plus-sign` and `valid-json-number`. Inverted, those same rules
+ * resolved _on_ for `.ts` files, where they can never match.
+ *
+ * Scoping every rule-bearing block here rather than opting out of the default ignores: the rules
+ * are for these three extensions and nothing else, so saying so is both the fix and the
+ * documentation.
+ *
+ * **Each dialect gets its own preset, and only its own extension.** Scoping all of them to all
+ * three extensions was the same bug one level up: JSON5's preset deliberately leaves
+ * `jsonc/quote-props`, `jsonc/quotes` and `jsonc/no-hexadecimal-numeric-literals` unset, because
+ * JSON5 is the dialect where an unquoted key, a single-quoted string and `0xff` are legal — and
+ * JSONC's preset, applied to the same files, set all three at error. `{ a: "hello" }` in a `.json5`
+ * therefore failed `jsonc/quote-props` while both formatters wrote exactly that (measured: oxfmt
+ * rewrites `{ "a": "hello" }` back to `{ a: "hello" }`), so ESLint and the formatter each undid the
+ * other and `dm check` could not pass. A single `0xff` reported twice, under
+ * `no-hexadecimal-numeric-literals` and `valid-json-number`, for the same reason.
+ *
+ * `recommended-with-json` is now included as well, scoped to `.json`, where comments really are an
+ * error — the previous arrangement linted plain JSON with the dialect that permits them.
+ */
 export declare function jsonc(): Promise<TypedFlatConfigItem[]>;

package/dist/apps/eslint/plugins/n.d.ts

@@ -1,2 +1,26 @@
 import type { TypedFlatConfigItem } from "../types";
+/**
+ * Eslint-plugin-n, split along the line the upstream presets confuse: which files are modules, and
+ * which rules run.
+ *
+ * `configs["flat/recommended"]` picks between `recommended-module` and `recommended-script` by
+ * reading the nearest `package.json` at plugin-import time, and returns a single **unscoped** block
+ * carrying both the 14 rules and a `languageOptions.sourceType`. That last part is the bug: an
+ * unscoped `sourceType` applies to every file in the project, decided by one field in one
+ * manifest.
+ *
+ * In a project without `"type": "module"` it resolves to `commonjs`, and every `.js`, `.jsx` and
+ * `.mjs` file fails with `Parsing error: 'import' and 'export' may appear only with 'sourceType:
+ * module'` — including the `eslint.config.mjs` this package generates. `.ts` and `.tsx` are
+ * unaffected, which is what makes it read as random. And datamitsu deliberately omits `type` for
+ * next, expo, gatsby, electron, react-native and docusaurus, so the config manufactures the failing
+ * shape itself. The mirror case is live here: with `"type": "module"` the unscoped `sourceType` is
+ * `module`, which is wrong for any `.cjs` file in the repository.
+ *
+ * `flat/mixed-esm-and-cjs` already answers the question per extension — `.js`/`.mjs` module, `.cjs`
+ * commonjs — so its blocks provide the language settings. It also scopes its _rules_ to those three
+ * extensions, which would quietly stop all 14 from running on `.ts`, so the rules are re-emitted
+ * once, unscoped, exactly as before. Nothing changes about which rules run anywhere; only which
+ * files are parsed as what.
+ */
 export declare function n(): Promise<TypedFlatConfigItem[]>;

package/dist/apps/eslint/plugins/next.d.ts

@@ -0,0 +1,13 @@
+import type { TypedFlatConfigItem } from "../types";
+/**
+ * Next.js rules — 22 of them, and a dependency every consumer downloaded while no config loaded it.
+ *
+ * `core-web-vitals` rather than `recommended`: it is the same set with three rules raised from warn
+ * to error (`no-sync-scripts`, `no-html-link-for-pages`, `no-img-element`), which is the severity
+ * this config uses anyway — `raiseWarningsToErrors` would raise them a moment later.
+ *
+ * Gated on the `next` dependency. The oxlint half has its `nextjs` plugin on unconditionally, since
+ * a static JSON config cannot look at package.json; closing that gap is what moving oxlint to a
+ * config module was for.
+ */
+export declare function next(): Promise<TypedFlatConfigItem[]>;

package/dist/apps/eslint/plugins/oxlint.d.ts

@@ -1,5 +1,21 @@
+import type { OxlintDefineConfigOptions, OxlintPackageJson } from "../../oxlint";
 import type { TypedFlatConfigItem } from "../types";
-export declare function oxlint(options: undefined | {
-    configFilePath?: string;
-    disabled?: boolean;
-}): Promise<TypedFlatConfigItem[]>;
+/**
+ * Built from the shared config object, never from a file on disk.
+ *
+ * There used to be a `configFilePath` option, and every generated `eslint.config.mjs` passed it,
+ * pointing at the project's own `.oxlintrc.json`. That file only ever said `extends`, and
+ * `buildFromOxlintConfigFile` does not follow `extends` — so it read an empty rule set and
+ * suppressed 76 ESLint rules where the config object suppresses 304. The other 228 were rules both
+ * tools reported, on the same line, under two names.
+ *
+ * The option is also unimplementable now: the oxlint config is a TypeScript module, and
+ * `buildFromOxlintConfigFile` reads JSON.
+ *
+ * Built for the _project_, not from the package's own defaults. A suppression here is a claim that
+ * oxlint reports the rule instead — so it has to be made against the plugin set the project's
+ * oxlint run actually enables. Without the manifest, a package with no Next.js would have its
+ * `@next/next/*` rules turned off in ESLint on the strength of a `nextjs` plugin that no longer
+ * runs there, and nothing would report them.
+ */
+export declare function oxlint(packageJSON?: OxlintPackageJson, options?: OxlintDefineConfigOptions, projectConfig?: unknown): Promise<TypedFlatConfigItem[]>;

package/dist/apps/eslint/plugins/playwright.d.ts

@@ -1,2 +1,15 @@
 import type { TypedFlatConfigItem } from "../types";
+/**
+ * Scoped to {@link GLOB_E2E}.
+ *
+ * `flat/recommended` ships with no `files` of its own, so all 38 rules applied to every file in any
+ * project that has playwright installed — `no-standalone-expect` on a unit test,
+ * `no-conditional-in-test` on application code. `playwright/no-standalone-expect` is already in the
+ * shared backlog because of it.
+ *
+ * The globs follow playwright's own conventions for `testDir` rather than a filename convention,
+ * which is why they are a separate list from {@link GLOB_TESTS}. A project that keeps its e2e specs
+ * somewhere else gets no playwright rules — that is a case for detection, not for going back to
+ * linting every file with them.
+ */
 export declare function playwright(): Promise<TypedFlatConfigItem[]>;

package/dist/apps/eslint/plugins/pnpm.d.ts

@@ -1,2 +1,8 @@
 import type { TypedFlatConfigItem } from "../types";
+/**
+ * The preset only. `pnpm/json-enforce-catalog` used to be turned off here, in an unscoped block —
+ * which AGENTS.md says not to do, and which broke the moment the composer started ignoring JSON in
+ * unscoped blocks: the preset scopes itself to `package.json`, the turn-off did not, so the rule
+ * came back on for exactly the file it targets. It lives in `src/lint-rules` now.
+ */
 export declare function pnpm(): Promise<TypedFlatConfigItem[]>;

package/dist/apps/eslint/plugins/prettier.d.ts

@@ -1,2 +1,16 @@
 import type { TypedFlatConfigItem } from "../types";
+/**
+ * `eslint-config-prettier` is a config, not a plugin.
+ *
+ * Its `rules` map is rule name → `"off"`, not rule name → rule module, so registering it under
+ * `plugins.prettier` never gave anything a `prettier/` prefix to resolve. At lint time it was
+ * inert. Everything that walks `config.plugins` was not: the rule inventory read those 358 `"off"`
+ * strings as if they were rules and wrote `prettier/@babel/semi`,
+ * `prettier/@stylistic/array-bracket-newline` and 356 more into `rule-inventory.json` and
+ * `KnownRuleName` — names that do not exist, that ESLint would reject if anything ever enabled
+ * them, and that made every plugin bump's inventory diff noisier for no signal.
+ *
+ * Spreading the rules is the whole job: turn off the formatting rules prettier and oxfmt own, so
+ * two tools do not fight over the same line.
+ */
 export declare function prettier(): Promise<TypedFlatConfigItem[]>;

package/dist/apps/eslint/plugins/svelte.d.ts

@@ -0,0 +1,2 @@
+import type { TypedFlatConfigItem } from "../types";
+export declare function svelte(): Promise<TypedFlatConfigItem[]>;

package/dist/apps/eslint/plugins/vitest.d.ts

@@ -1,2 +1,9 @@
 import type { TypedFlatConfigItem } from "../types";
+/**
+ * Scoped to {@link GLOB_TESTS}, which is the point.
+ *
+ * It used to say `files: ["tests/**"]` — a directory this repository does not have, and one most
+ * projects do not either, since the convention here is `__tests__/`. The block therefore matched
+ * nothing and none of its rules had ever run.
+ */
 export declare function vitest(): Promise<TypedFlatConfigItem[]>;

package/dist/apps/eslint/types.d.ts

@@ -1,23 +1,30 @@
 import type { ConfigWithExtendsArray } from "@eslint/config-helpers";
 import type { Linter } from "eslint";
 import type { PackageJson } from "type-fest";
-export type Config = Omit<Linter.Config<Linter.RulesRecord>, "plugins"> & {
+export type { ConfigNames } from "../../lint-rules/rule-names.generated";
+export type DefineConfigFn = (packageJSON: PackageJson, config?: ConfigWithExtendsArray, options?: DefineConfigOptions) => Promise<ConfigWithExtendsArray>;
+export interface DefineConfigOptions {
     /**
-     * An object containing a name-value mapping of plugin names to plugin objects. When `files` is
-     * specified, these plugins are only available to the matching files.
+     * The project's own resolved oxlint config, when it differs from this package's.
      *
-     * @see [Using plugins in your configuration](https://eslint.org/docs/latest/user-guide/configuring/configuration-files-new#using-plugins-in-your-configuration)
+     * `eslint-plugin-oxlint` turns an ESLint rule off on the premise that oxlint reports the
+     * equivalent, so that decision has to be made against the config oxlint is actually running. By
+     * default it is made against this package's, which is right until the project customizes
+     * `oxlint.config.mts` — and then a rule the project turned off there is reported by **neither**
+     * tool: oxlint stops, and the ESLint suppression built from the untouched base keeps it off. That
+     * is the exact failure the shared list exists to prevent, relocated to the consumer's config
+     * where it is harder to see.
+     *
+     * A project that overrides anything in `oxlint.config.mts` should pass the same object here:
+     *
+     * ```js
+     * import oxlintConfig from "./oxlint.config.mts";
+     *
+     * export default await defineConfig(packageJSON, undefined, { oxlintConfig });
+     * ```
      */
-    plugins?: Record<string, any>;
-};
-export type ConfigNames = "antfu/astro/rules" | "antfu/astro/setup" | "antfu/command/rules" | "antfu/disables/bin" | "antfu/disables/cjs" | "antfu/disables/cli" | "antfu/disables/config-files" | "antfu/disables/dts" | "antfu/disables/scripts" | "antfu/eslint-comments/rules" | "antfu/formatter/astro" | "antfu/formatter/astro/disables" | "antfu/formatter/css" | "antfu/formatter/graphql" | "antfu/formatter/html" | "antfu/formatter/less" | "antfu/formatter/markdown" | "antfu/formatter/scss" | "antfu/formatter/setup" | "antfu/formatter/svg" | "antfu/formatter/xml" | "antfu/gitignore" | "antfu/ignores" | "antfu/imports/rules" | "antfu/javascript/rules" | "antfu/javascript/setup" | "antfu/jsdoc/rules" | "antfu/jsonc/rules" | "antfu/jsonc/setup" | "antfu/jsx/setup" | "antfu/markdown/disables" | "antfu/markdown/parser" | "antfu/markdown/processor" | "antfu/markdown/setup" | "antfu/nextjs/rules" | "antfu/nextjs/setup" | "antfu/node/rules" | "antfu/perfectionist/setup" | "antfu/pnpm/package-json" | "antfu/pnpm/pnpm-workspace-yaml" | "antfu/pnpm/pnpm-workspace-yaml-sort" | "antfu/react/rules" | "antfu/react/setup" | "antfu/react/type-aware-rules" | "antfu/regexp/rules" | "antfu/solid/rules" | "antfu/solid/setup" | "antfu/sort/package-json" | "antfu/sort/tsconfig-json" | "antfu/stylistic/rules" | "antfu/svelte/rules" | "antfu/svelte/setup" | "antfu/test/rules" | "antfu/test/setup" | "antfu/typescript/erasable-syntax-only" | "antfu/typescript/parser" | "antfu/typescript/rules" | "antfu/typescript/rules-type-aware" | "antfu/typescript/setup" | "antfu/typescript/type-aware-parser" | "antfu/unicorn/rules" | "antfu/unocss" | "antfu/vue/rules" | "antfu/vue/setup";
-export type DefineConfigFn = (packageJSON: PackageJson, config?: ConfigWithExtendsArray, options?: DefineConfigOptions) => Promise<ConfigWithExtendsArray>;
-export interface DefineConfigOptions {
-    globalIgnores?: string[];
+    oxlintConfig?: unknown;
     plugins?: {
-        "arrow-return-style"?: {
-            disabled?: boolean;
-        };
         boundaries?: {
             disabled?: boolean;
         };
@@ -42,6 +49,9 @@ export interface DefineConfigOptions {
         escompat?: {
             disabled?: boolean;
         };
+        "eslint-comments"?: {
+            disabled?: boolean;
+        };
         "eslint-plugin-array-func"?: {
             disabled?: boolean;
         };
@@ -60,9 +70,6 @@ export interface DefineConfigOptions {
         jsdoc?: {
             disabled?: boolean;
         };
-        json?: {
-            disabled?: boolean;
-        };
         "json-schema-validator"?: {
             disabled?: boolean;
         };
@@ -75,6 +82,9 @@ export interface DefineConfigOptions {
         n?: {
             disabled?: boolean;
         };
+        next?: {
+            disabled?: boolean;
+        };
         "no-unsanitized"?: {
             disabled?: boolean;
         };
@@ -82,7 +92,6 @@ export interface DefineConfigOptions {
             disabled?: boolean;
         };
         oxlint?: {
-            configFilePath?: string;
             disabled?: boolean;
         };
         perfectionist?: {
@@ -131,6 +140,9 @@ export interface DefineConfigOptions {
         stylistic?: {
             disabled?: boolean;
         };
+        svelte?: {
+            disabled?: boolean;
+        };
         turbo?: {
             disabled?: boolean;
         };
@@ -148,6 +160,18 @@ export interface DefineConfigOptions {
         };
     };
     react?: boolean;
+    /**
+     * Apply the shared migration backlog — the rules in `src/lint-rules/temporary` that should be on
+     * and are off only until the code is ready for them. Defaults to `true`.
+     *
+     * Set to `false` to lint against the bar the backlog is deferring. The permanently disabled rules
+     * stay off either way; those are decisions, not deferrals.
+     *
+     * Passed straight through to the oxlint half as well, so both tools answer the same question. It
+     * did not use to be: the oxlint config had no such option, so opting out raised the bar in ESLint
+     * while oxlint kept the whole backlog off.
+     */
+    temporaryRules?: boolean;
 }
 export type Rules = Record<string, Linter.RuleEntry<any> | undefined>;
 /**

package/dist/apps/knip/index.d.ts

@@ -1,3 +1,63 @@
-import type { KnipConfiguration } from "knip";
+import type { IssueType, KnipConfiguration } from "knip";
 export type * from "knip";
-export declare const defineConfig: (overrides?: ((base: KnipConfiguration) => KnipConfiguration) | KnipConfiguration) => KnipConfiguration;
+/**
+ * What a finding says:
+ *
+ * - `correctness` — real defects: an import that does not resolve, a dependency used but never
+ *   declared, a module exporting the same value twice.
+ * - `cycles` — circular imports. A real defect class, and one of the two groups off by default — not
+ *   because the findings are weak but because reaching them is expensive. knip withholds this type
+ *   from its own default set, and the only lever that brings it back, `include`, is merged with the
+ *   command line's, so a config carrying one defeats `--files`, `--exports` and `--dependencies`
+ *   for every later run. Adopt it where the trade is worth making.
+ * - `dependencies` — declared but never used. Needs `ignoreDependencies` for tools a config loads by
+ *   name.
+ * - `exports` — unused exports and types. The largest group in a library monorepo.
+ * - `files` — unreachable files. Only as true as the entry graph, so it needs the plugins right.
+ * - `namespaces` — exports reachable only through an `import * as`. Off by default, and the one group
+ *   that stays off: knip cannot tell whether these are used, so the finding is not "this is dead"
+ *   but "restructure your imports so I can see". That is a style position, not a defect.
+ *
+ * This is also every value {@link DefineConfigOptions.adopted} accepts.
+ */
+export declare const ISSUE_GROUPS: readonly ["correctness", "cycles", "dependencies", "exports", "files", "namespaces"];
+export type IssueGroup = (typeof ISSUE_GROUPS)[number];
+export type DefineConfigOptions = {
+    /**
+     * Issue groups this project reports. Everything outside the list is emitted as `off`, unless the
+     * config names that issue type in `rules` — a per-type override still wins, and is the granular
+     * escape hatch. The one exception knip does not allow is guarded: see `rulesFor`.
+     *
+     * Defaults to every group knip reports on its own terms, and exists to be **narrowed**: this
+     * package already states the bar. A project adopting knip over an existing codebase writes `{
+     * adopted: ["correctness"] }` — the one group whose findings are defects rather than debt — and
+     * widens it back as each group is cleared, until the option can go altogether.
+     *
+     * Once most of the codebase passes a group, prefer knip's `ignoreIssues` (paths × issue types)
+     * over dropping the whole group again: it keeps new code covered.
+     */
+    adopted?: readonly IssueGroup[];
+};
+/**
+ * Severities this config emits, and the only ones it accepts.
+ *
+ * Knip's own `warn` is deliberately absent. It is a real tier there — a `warn` finding is reported
+ * and excluded from the count that sets the exit code — but datamitsu reads knip through
+ * `--reporter json`, and that reporter carries no severity at all. A warned finding arrives
+ * indistinguishable from an errored one, the parser renders every finding as an error, and the run
+ * still exits zero: red diagnostics on a green tool. Better that the tier cannot be written at all
+ * than that it mean that.
+ */
+export type IssueSeverity = "error" | "off";
+/**
+ * What {@link defineConfig} accepts, which is knip's own configuration with `rules` narrowed to
+ * {@link IssueSeverity}.
+ *
+ * The narrowing is advisory rather than enforcement: the canonical config file is a plain `.js`, so
+ * nothing type-checks it. `rulesFor` therefore still raises a `warn` at runtime — this only moves
+ * the discovery earlier for the projects that do get types.
+ */
+export type KnipOverrides = Omit<KnipConfiguration, "rules"> & {
+    rules?: Partial<Record<IssueType, IssueSeverity>>;
+};
+export declare const defineConfig: (overrides?: ((base: KnipOverrides) => KnipOverrides) | KnipOverrides, options?: DefineConfigOptions) => KnipConfiguration;

package/dist/apps/knip/index.js

@@ -1,11 +1,210 @@
 //#region src/apps/knip/index.ts
-const baseConfig = {
-	entry: ["src/index.ts"],
-	project: ["src/**/*.ts"]
+const KNIP_DEFAULT_ENTRY = ["{index,cli,main}.{js,mjs,cjs,jsx,ts,tsx,mts,cts}!", "src/{index,cli,main}.{js,mjs,cjs,jsx,ts,tsx,mts,cts}!"];
+const PROJECT_SCOPED_CONFIGS = [
+	"eslint.config.mjs",
+	"oxlint.config.mts",
+	"prettier.config.mjs"
+];
+const GIT_ROOT_SCOPED_CONFIGS = [
+	".markdownlint-cli2.mjs",
+	"commitlint.config.mjs",
+	"cspell.config.mjs",
+	"datamitsu.config.{js,ts}",
+	"knip.config.js",
+	"oxfmt.config.ts"
+];
+const ROOT_WORKSPACE_NAME = ".";
+const SHARED_WORKSPACE_KEY = "**";
+/**
+* Options knip reads _only_ from the workspace config, so the root loses them the moment
+* `workspaces` exists — see {@link withRootWorkspace}.
+*
+* Deliberately shorter than the set of options that can appear in a workspace block. `ignore` and
+* `ignoreFiles` are registered globally from the top-level config as well, and
+* `ignoreExportsUsedInFile` and `includeEntryExports` are read as `workspaceConfig.x ?? topLevel.x`
+* — moving either kind under `"."` would turn a global default into a root-only one.
+*/
+const WORKSPACE_SCOPED_OPTIONS = [
+	"entry",
+	"ignoreMembers",
+	"paths",
+	"project"
+];
+/**
+* What a finding says:
+*
+* - `correctness` — real defects: an import that does not resolve, a dependency used but never
+*   declared, a module exporting the same value twice.
+* - `cycles` — circular imports. A real defect class, and one of the two groups off by default — not
+*   because the findings are weak but because reaching them is expensive. knip withholds this type
+*   from its own default set, and the only lever that brings it back, `include`, is merged with the
+*   command line's, so a config carrying one defeats `--files`, `--exports` and `--dependencies`
+*   for every later run. Adopt it where the trade is worth making.
+* - `dependencies` — declared but never used. Needs `ignoreDependencies` for tools a config loads by
+*   name.
+* - `exports` — unused exports and types. The largest group in a library monorepo.
+* - `files` — unreachable files. Only as true as the entry graph, so it needs the plugins right.
+* - `namespaces` — exports reachable only through an `import * as`. Off by default, and the one group
+*   that stays off: knip cannot tell whether these are used, so the finding is not "this is dead"
+*   but "restructure your imports so I can see". That is a style position, not a defect.
+*
+* This is also every value {@link DefineConfigOptions.adopted} accepts.
+*/
+const ISSUE_GROUPS = [
+	"correctness",
+	"cycles",
+	"dependencies",
+	"exports",
+	"files",
+	"namespaces"
+];
+/**
+* Every knip issue type, and the group that owns it.
+*
+* `satisfies Record<IssueType, IssueGroup>` is the point: a knip upgrade that adds an issue type
+* stops this file compiling until somebody decides which group it belongs to. Without it the new
+* type would simply be absent from the emitted `rules` and fall back to knip's own default — the
+* kind of residual with no author behind it that `src/lint-rules` exists to prevent.
+*/
+const ISSUE_TYPE_GROUPS = {
+	binaries: "correctness",
+	catalog: "dependencies",
+	catalogReferences: "correctness",
+	cycles: "cycles",
+	dependencies: "dependencies",
+	devDependencies: "dependencies",
+	duplicates: "correctness",
+	enumMembers: "exports",
+	exports: "exports",
+	files: "files",
+	namespaceMembers: "exports",
+	nsExports: "namespaces",
+	nsTypes: "namespaces",
+	optionalPeerDependencies: "dependencies",
+	types: "exports",
+	unlisted: "correctness",
+	unresolved: "correctness"
 };
-const defineConfig = (overrides) => typeof overrides === "function" ? overrides(baseConfig) : {
-	...baseConfig,
-	...overrides
+const ISSUE_TYPES = Object.keys(ISSUE_TYPE_GROUPS);
+const ADOPTED_BY_DEFAULT = [
+	"correctness",
+	"dependencies",
+	"exports",
+	"files"
+];
+const EXCLUDED_BY_KNIP = /* @__PURE__ */ new Set([
+	"cycles",
+	"nsExports",
+	"nsTypes"
+]);
+const DEPENDENCY_TYPES_COUPLED_TO_DEPENDENCIES = ["devDependencies", "optionalPeerDependencies"];
+const createBaseConfig = () => ({
+	entry: [
+		...KNIP_DEFAULT_ENTRY,
+		...PROJECT_SCOPED_CONFIGS,
+		...GIT_ROOT_SCOPED_CONFIGS
+	],
+	ignoreBinaries: [
+		"datamitsu",
+		"dm",
+		"s0"
+	],
+	tags: ["-knipignore"],
+	workspaces: { [SHARED_WORKSPACE_KEY]: { entry: [...KNIP_DEFAULT_ENTRY, ...PROJECT_SCOPED_CONFIGS] } }
+});
+const rulesFor = (adopted, overrides, explicit) => {
+	const reported = new Set(adopted);
+	const rules = Object.fromEntries(ISSUE_TYPES.map((issueType) => {
+		const override = overrides?.[issueType];
+		if (override !== void 0) return [issueType, override === "off" ? "off" : "error"];
+		return [issueType, reported.has(ISSUE_TYPE_GROUPS[issueType]) ? "error" : "off"];
+	}));
+	if (rules.dependencies === "off") {
+		const demanded = DEPENDENCY_TYPES_COUPLED_TO_DEPENDENCIES.filter((issueType) => explicit?.[issueType] === "error");
+		if (demanded.length > 0) throw new Error(`knip cannot report ${demanded.join(" or ")} while \`dependencies\` is off: turning \`dependencies\` off excludes them too, and an exclusion cannot be undone by an include. Drop the \`dependencies: "off"\`, or drop these.`);
+		for (const issueType of DEPENDENCY_TYPES_COUPLED_TO_DEPENDENCIES) rules[issueType] = "off";
+	}
+	return rules;
+};
+/**
+* The `include` list knip needs, or `undefined` when its own default set already covers what is
+* reported.
+*
+* Severities are not the lever for turning an issue type **on**: knip feeds the types set to `off`
+* into its `exclude` and never reads severities into its `include`, so a type it leaves out of its
+* default set stays out however loudly `rules` asks for it. Naming one in `include` then replaces
+* that default set wholesale — listing only `cycles` reports _nothing but_ cycles — so the list has
+* to be every reported type, not just the ones knip omits.
+*
+* Which is why nothing this emits is on by default. knip **unions** a config's `include` with the
+* command line's, so a config carrying one makes `--files`, `--exports`, `--dependencies` and
+* `--include <type>` stop narrowing anything: the union is still every reported type, and a run
+* meant to look at one kind of finding fails on the other fourteen. That is the whole cost of
+* adopting `cycles` or `namespaces`, and it lands on `datamitsu exec knip`, which is the only way
+* these findings are read by a person. `--exclude` still narrows; it is applied last and wins.
+*/
+const includeFor = (rules) => {
+	const reported = ISSUE_TYPES.filter((issueType) => rules?.[issueType] === "error");
+	return reported.some((issueType) => EXCLUDED_BY_KNIP.has(issueType)) ? reported : void 0;
+};
+const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const mergeValue = (current, value) => {
+	if (value === void 0) return current;
+	if (Array.isArray(current) && Array.isArray(value)) return [...current, ...value];
+	if (isPlainObject(current) && isPlainObject(value)) {
+		const merged = { ...current };
+		for (const [key, nested] of Object.entries(value)) merged[key] = mergeValue(merged[key], nested);
+		return merged;
+	}
+	return value;
+};
+const mergeConfig = (base, overrides) => mergeValue(base, overrides);
+const withSharedWorkspaceDefaults = (config) => {
+	const workspaces = config.workspaces;
+	const shared = workspaces?.[SHARED_WORKSPACE_KEY];
+	if (!workspaces || !shared) return config;
+	return {
+		...config,
+		workspaces: Object.fromEntries(Object.entries(workspaces).map(([key, value]) => key === SHARED_WORKSPACE_KEY || key === ROOT_WORKSPACE_NAME ? [key, value] : [key, mergeValue(shared, value)]))
+	};
+};
+const withRootWorkspace = (config) => {
+	const rest = { ...config };
+	const moved = {};
+	for (const option of WORKSPACE_SCOPED_OPTIONS) {
+		if (!(option in rest)) continue;
+		moved[option] = rest[option];
+		delete rest[option];
+	}
+	if (Object.keys(moved).length === 0) return config;
+	const workspaces = rest["workspaces"] ?? {};
+	return {
+		...rest,
+		workspaces: {
+			...workspaces,
+			[ROOT_WORKSPACE_NAME]: {
+				...moved,
+				...workspaces[ROOT_WORKSPACE_NAME]
+			}
+		}
+	};
+};
+const defineConfig = (overrides, options) => {
+	const adopted = options?.adopted ?? ADOPTED_BY_DEFAULT;
+	const baseRules = rulesFor(adopted);
+	const base = {
+		...createBaseConfig(),
+		rules: baseRules
+	};
+	const merged = typeof overrides === "function" ? overrides(base) : overrides ? mergeConfig(base, overrides) : base;
+	const explicitRules = typeof overrides === "function" || !overrides ? Object.fromEntries(Object.entries(merged.rules ?? {}).filter(([issueType, severity]) => severity !== baseRules[issueType])) : overrides.rules;
+	const rules = rulesFor(adopted, merged.rules, explicitRules);
+	const include = merged.include ?? includeFor(rules);
+	return withRootWorkspace(withSharedWorkspaceDefaults({
+		...merged,
+		...include && { include },
+		rules
+	}));
 };
 //#endregion
-export { defineConfig };
+export { ISSUE_GROUPS, defineConfig };

package/dist/apps/lefthook-proxy/__tests__/env.d.ts

@@ -0,0 +1,2 @@
+export { fixtureEnvironment } from "../../test-support/env";
+export declare function testUpstream(managedEnvironment: NodeJS.ProcessEnv): string | undefined;