@stll/oxlint-config 3.1.0 → 3.2.0

package/dist/toolchain-guard.mjs

@@ -13,6 +13,8 @@ import { execFileSync, spawnSync } from "node:child_process";
 import { gte, minVersion, satisfies, valid, validRange } from "semver";
 import { LineCounter, isAlias, isMap, isNode, isScalar, isSeq, parseAllDocuments, parseDocument } from "yaml";
 import { pathToFileURL } from "node:url";
+import { parse as parse$3 } from "acorn";
+import { transformSync } from "esbuild";
 //#region src/toolchain-bun.ts
 const STABLE_RELEASE = /^\d+\.\d+\.\d+$/u;
 /**
@@ -31,7 +33,7 @@ const repositoryBun = (floor, manifest) => {
 };
 //#endregion
 //#region src/toolchain-consumer-checks.ts
-const consumerRunnerVersion = "3.1.0";
+const consumerRunnerVersion = "3.2.0";
 const consumerCheckWorkflow = "stella/.github/.github/workflows/package-consumer-compat.yml";
 const record$11 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryDirectory = (value) => typeof value === "string" && value !== "" && !value.includes("\\") && !value.includes("${{") && !value.split("").some((character) => {
@@ -359,6 +361,38 @@ const engineFloorSelectorMatches = (value, floor) => {
 	return Number(value.split(".").at(0)) === floor.major && satisfies(value, floor.range);
 };
 //#endregion
+//#region src/toolchain-typescript-source-api.ts
+const readSourceApiInput = ({ root, source, tracked }) => {
+	if (!tracked.has(source)) return void 0;
+	const resolvedRoot = realpathSync(root);
+	const input = path.resolve(resolvedRoot, source);
+	try {
+		if (realpathSync(input) !== input || !lstatSync(input).isFile()) return void 0;
+		return readFileSync(input, "utf8");
+	} catch {
+		return;
+	}
+};
+const sourceApiImportProblem = ({ source, content, name }) => {
+	if (content === void 0) return "must be a tracked, readable regular source file without symlinks";
+	try {
+		const { code } = transformSync(content, {
+			sourcefile: source,
+			loader: source.endsWith("x") ? "tsx" : "ts",
+			format: "esm",
+			tsconfigRaw: { compilerOptions: { verbatimModuleSyntax: true } },
+			logLevel: "silent"
+		});
+		if (parse$3(code, {
+			ecmaVersion: "latest",
+			sourceType: "module"
+		}).body.some((node) => node.type === "ImportDeclaration" && node.source.value === name && node.specifiers.length > 0)) return void 0;
+		return `no longer has a static value import from ${name}; remove the declaration or name its current importer`;
+	} catch {
+		return "cannot parse the declared compiler API importer";
+	}
+};
+//#endregion
 //#region src/toolchain-packages.ts
 const packageRules = [
 	"bun-pins",
@@ -413,15 +447,37 @@ const parseTypescriptAllowlist = (input) => {
 		const name = text("name");
 		const spec = text("spec");
 		const dependency = text("dependency");
+		const sourceApi = record$8(entry) && entry["kind"] === "source-api";
+		const keys = sourceApi ? [
+			"workspace",
+			"name",
+			"spec",
+			"reason",
+			"kind",
+			"sources"
+		] : [...allowlistKeys, ...record$8(entry) && entry["kind"] === "dependency" ? ["kind"] : []];
 		const reason = text("reason");
-		if (!record$8(entry) || Object.keys(entry).length !== allowlistKeys.length || workspace === void 0 || name === void 0 || spec === void 0 || dependency === void 0 || reason === void 0) throw new Error(`typescriptAllowlist entry ${shown} must have exactly workspace, name, spec, dependency and reason as nonempty strings: ${allowlistFormat}`);
+		if (!record$8(entry) || Object.keys(entry).length !== keys.length || Object.keys(entry).some((key) => !keys.includes(key)) || workspace === void 0 || name === void 0 || spec === void 0 || !sourceApi && dependency === void 0 || reason === void 0) throw new Error(`typescriptAllowlist entry ${shown} must have exactly workspace, name, spec, dependency and reason as nonempty strings: ${allowlistFormat}`);
 		if (workspace !== "." && (path.posix.normalize(workspace) !== workspace || workspace.startsWith("/") || workspace.endsWith("/") || workspace === ".." || workspace.startsWith("../"))) throw new Error(`typescriptAllowlist entry ${shown}: workspace must be "." for the root or a normalized relative package directory such as "apps/web"`);
 		if (!exactTypescriptSpec(spec)) throw new Error(`typescriptAllowlist entry ${shown}: spec must be the exact spec the manifest resolves to, such as "6.0.3" or "npm:typescript@6.0.3", not a range or catalog reference`);
 		if (!isTypescriptInstall(name, spec)) throw new Error(`typescriptAllowlist entry ${shown}: name must be typescript or @typescript/native, or an alias whose spec is npm:typescript@<version> or npm:@typescript/native@<version>`);
-		if (typescriptPackages.has(dependency) || dependency === name) throw new Error(`typescriptAllowlist entry ${shown}: dependency must name the package in that workspace that needs ${name}, not a TypeScript package`);
+		if (dependency !== void 0 && (typescriptPackages.has(dependency) || dependency === name)) throw new Error(`typescriptAllowlist entry ${shown}: dependency must name the package in that workspace that needs ${name}, not a TypeScript package`);
 		const key = `${workspace}\0${name}`;
 		if (seen.has(key)) throw new Error(`typescriptAllowlist declares ${name} for ${workspace} more than once; keep one entry`);
 		seen.add(key);
+		if (sourceApi) {
+			const sources = entry["sources"];
+			if (!Array.isArray(sources) || sources.length === 0 || !sources.every((source) => typeof source === "string" && path.posix.normalize(source) === source && !source.startsWith("/") && source !== ".." && !source.startsWith("../") && !source.includes("\\") && !/[?*{}[\]]/.test(source) && /\.[cm]?[jt]sx?$/.test(source) && !/\.d\.[cm]?ts$/.test(source) && !source.split("/").some((part) => ["node_modules", "vendor"].includes(part))) || new Set(sources).size !== sources.length) throw new Error(`typescriptAllowlist source-api entry ${shown} requires unique normalized source file paths`);
+			return {
+				kind: "source-api",
+				workspace,
+				name,
+				spec,
+				reason,
+				sources
+			};
+		}
+		if (dependency === void 0) throw new Error("Missing TypeScript dependency owner");
 		return {
 			workspace,
 			name,
@@ -1173,7 +1229,7 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 			});
 			return `${name} ${shown} in ${file} is not allowed: ${typescriptGuidance}; if a dependency of this workspace needs it, add ${suggestion} to typescriptAllowlist in ${allowlistFile}`;
 		}
-		return value === entry.spec ? void 0 : `${name} in ${file} resolves to ${shown}, but typescriptAllowlist in ${allowlistFile} allows ${entry.spec} for ${entry.dependency}; declare ${entry.spec} or update the entry's spec`;
+		return value === entry.spec ? void 0 : `${name} in ${file} resolves to ${shown}, but typescriptAllowlist in ${allowlistFile} allows ${entry.spec} for ${entry.kind === "source-api" ? "source API imports" : entry.dependency}; declare ${entry.spec} or update the entry's spec`;
 	};
 	const peerRange = (value) => typeof value === "string" && validRange(value) !== null;
 	for (const [file, json] of manifests) {
@@ -1343,6 +1399,20 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 			return record$8(entries) && Object.hasOwn(entries, name);
 		});
 		if (!declares(entry.name)) return `${file} no longer declares ${entry.name} in dependencies, devDependencies or optionalDependencies; remove the entry`;
+		if (entry.kind === "source-api") {
+			for (const source of entry.sources) {
+				let owner = path.posix.dirname(source);
+				while (owner !== "." && !manifests.has(`${owner}/package.json`)) owner = path.posix.dirname(owner);
+				if (owner !== entry.workspace) return `${source} belongs to workspace ${owner}, not ${entry.workspace}`;
+				const problem = sourceApiImportProblem({
+					source,
+					content: files[source],
+					name: entry.name
+				});
+				if (problem !== void 0) return `${source}: ${problem}`;
+			}
+			return;
+		}
 		if (!declares(entry.dependency)) return `${file} no longer depends on ${entry.dependency}; remove the entry and the ${entry.name} declaration, or name the dependency that still needs it`;
 	};
 	for (const entry of typescriptAllowlist) {
@@ -1415,11 +1485,15 @@ const yamlSettings = (file, manager) => {
 	if (!record$7(settings)) throw new Error(`${manager} lifecycle configuration must be a mapping`);
 	return settings;
 };
+const pnpmLifecycleVersions = ["12.9.1", "12.15.0"];
 const pnpmHooksEnabled = (manifest, context) => {
 	const declared = declaredManager(context.packageManager ?? manifest["packageManager"]);
 	const dependency = [manifest["dependencies"], manifest["devDependencies"]].flatMap((field) => record$7(field) ? [field["pnpm"]] : []).find((value) => typeof value === "string");
-	if ((declared?.at(1) === "pnpm" ? declared.at(2) : dependency) !== "12.9.1") throw new Error("pnpm lifecycle discovery requires declared pnpm@12.9.1");
-	const enabled = yamlSettings(context.pnpmWorkspace, "pnpm")["enablePrePostScripts"];
+	const version = declared?.at(1) === "pnpm" ? declared.at(2) : dependency;
+	if (!pnpmLifecycleVersions.some((supported) => version === supported)) throw new Error(`pnpm lifecycle discovery requires declared pnpm@${pnpmLifecycleVersions.join(" or pnpm@")}`);
+	const settings = yamlSettings(context.pnpmWorkspace, "pnpm");
+	if ("include" in settings) throw new Error("Delegated pnpm settings require explicit lifecycle discovery support");
+	const enabled = settings["enablePrePostScripts"];
 	if (enabled === void 0) return true;
 	if (typeof enabled !== "boolean") throw new Error("pnpm enablePrePostScripts must be a literal boolean");
 	return enabled;
@@ -4184,6 +4258,23 @@ const checkToolchain = ({ root, policy: sharedPolicy, onDelegated, onWarning, no
 			message: error instanceof Error ? error.message : String(error)
 		});
 	}
+	for (const entry of configuration.typescriptAllowlist) {
+		if (entry.kind !== "source-api") continue;
+		for (const source of entry.sources) {
+			const content = readSourceApiInput({
+				root,
+				source,
+				tracked: trackedFiles
+			});
+			if (content !== void 0) files[source] = content;
+			else diagnostics.push({
+				rule: "configuration",
+				path: source,
+				line: 1,
+				message: "TypeScript source API evidence must be tracked, readable, regular and free of symlinks"
+			});
+		}
+	}
 	const cloud = configuration.cloud;
 	const script = files[cloudSetupPath];
 	if (cloud === void 0 && trackedFiles.has(".agents/cloud-setup.sh")) diagnostics.push({