@timmo001/oxlint-rules 0.3.5 → 0.3.6

package/README.md

@@ -5,12 +5,21 @@ Shared Oxlint plugins and configs built around the unchanged
 locally owned generic rules under `timmo` and Effect rules under
 `timmo-effect`.
 
-Oxlint's JavaScript plugin API is alpha. Consumers must keep `oxlint` and
-`@oxlint/plugins` on the exact peer versions declared by this package.
+This package targets the latest stable Oxlint toolchain. Oxlint's
+[JavaScript plugin API is alpha](https://oxc.rs/docs/guide/usage/linter/config.html)
+and is outside its semver guarantees, so each rules release declares the exact
+`oxlint` and `@oxlint/plugins` versions it has validated. Older toolchains and
+untested future versions are not part of the support contract.
 
 ## Install
 
-Install from npm with the package manager already used by the repository:
+Check the published rules package's `peerDependencies` against the official npm
+`latest` versions of `oxlint` and `@oxlint/plugins`. If they differ, a validated
+rules release is needed before upgrading. Do not bypass peer checks or override
+Vite Plus's bundled dependencies to make an unsupported version fit.
+
+Once the versions match, install from npm with the package manager already used
+by the repository:
 
 ```sh
 bun add --dev --exact @timmo001/oxlint-rules oxlint @oxlint/plugins
@@ -42,6 +51,11 @@ Both configs can be installed from JSR with its npm compatibility support.
 npmjs.org remains the default for package managers that resolve ordinary
 package names from `node_modules`.
 
+For type-aware linting, also pin the latest `oxlint-tsgolint` version that meets
+Oxlint's declared peer requirement and has passed the package check. Enable
+`options: { typeAware: true }` in the consumer's config. The shared configs do
+not enable type-aware linting themselves.
+
 ## Copy rules
 
 Copy a reviewed snapshot when a repository should own the rule source:
@@ -83,8 +97,9 @@ Initialise the upstream source and run the package checks:
 git submodule update --init --recursive
 mise run check
 mise run build
+mise run test:package
 npm pack --dry-run
-bunx jsr publish --dry-run
+bunx jsr@0.14.3 publish --dry-run --allow-dirty
 ```
 
 `bun run lint` builds the local plugins before linting all maintained code,
@@ -98,6 +113,29 @@ the root exclusions. Generated output, vendored source and agent directories
 remain excluded. RuleTester fixture strings retain their intentional violations;
 the surrounding test code is linted with the full rule set.
 
+`mise run test:package` builds and packs once, then installs the tarball in an
+isolated consumer using the exact toolchain pins from `package.json` and strict
+peer checks. It verifies both recommended configs, diagnostics from all four
+shared namespaces, and valid and invalid type-aware examples. CI runs this
+through the existing package workflow's build step. It also requires matching,
+exact Oxlint development and peer versions.
+
+### Toolchain updates and releases
+
+Renovate's shared preset groups Oxlint, `@oxlint/plugins` and `oxlint-tsgolint`.
+The local rule keeps both development and peer dependencies pinned instead of
+widening peer ranges. For each update:
+
+1. Verify the official npm `latest` versions and Oxlint's tsgolint peer
+   requirement. Keep Oxlint and plugins on the same latest version and regenerate
+   the lockfile with the selected tsgolint version.
+2. Run the checks and package dry-runs above. Fix any API incompatibility before
+   accepting the new pins; do not disable rules or bypass peer failures.
+3. Review and merge the validated update. Consumers need a separately approved
+   version bump and release to receive the new peer contract. Publishing a
+   GitHub release triggers the existing npm and JSR workflows; both must succeed
+   before the update is available to consumers.
+
 Advance `vendor/anti-slop` only by updating its Git submodule commit. Keep its
 source and MIT licence unchanged, then run the full package checks so both
 upstream exports and composed configs are verified.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timmo001/oxlint-rules",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "Shared Oxlint plugins and configs with optional Effect rules.",
   "type": "module",
   "license": "Apache-2.0",
@@ -42,16 +42,18 @@
     "lint": "bun run build && oxlint --disable-nested-config .",
     "skills:validate": "bunx skills-ref validate skills/install-timmo-oxlint-rules && bunx skills-ref validate skills/add-oxlint-rule && bunx skills-ref validate skills/release-oxlint-rules",
     "test": "node --experimental-strip-types scripts/test.ts",
+    "test:package": "node --experimental-strip-types scripts/test-package.ts",
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@oxlint/plugins": "1.83.0",
-    "oxlint": "1.83.0"
+    "@oxlint/plugins": "1.85.0",
+    "oxlint": "1.85.0"
   },
   "devDependencies": {
-    "@oxlint/plugins": "1.83.0",
+    "@oxlint/plugins": "1.85.0",
     "@types/bun": "^1.3.14",
-    "oxlint": "1.83.0",
+    "oxlint": "1.85.0",
+    "oxlint-tsgolint": "7.0.2002",
     "prettier": "^3.9.5",
     "skills-ref": "0.1.5",
     "typescript": "^7.0.0"

package/skills/install-timmo-oxlint-rules/SKILL.md

@@ -14,8 +14,12 @@ description: >-
    instructions, and normal checks. Use the current working directory unless
    the user names another target.
 3. Preserve existing ignores, overrides, plugins, and repository-owned rules.
-   Confirm `oxlint` and `@oxlint/plugins` use the same exact version supported
-   by the selected package version.
+   Verify the official npm `latest` versions of `oxlint` and `@oxlint/plugins`.
+   They must match each other and the exact peers of the selected rules release.
+   Support is latest-only: if the published peer contract has not caught up,
+   report the pending rules release instead of widening peers or bypassing
+   package-manager failures. Do not force upgrades of Vite Plus's transitive
+   dependencies or assume its bundled plugins satisfy this contract.
 
 ## Package
 
@@ -28,6 +32,10 @@ description: >-
    instead only when `effect` is a direct dependency or the user explicitly
    requests it.
 4. Keep dependency and config edits visible. Do not delegate them to a script.
+5. For type-aware linting, explicitly pin the latest `oxlint-tsgolint` that
+   satisfies Oxlint's peer requirement and was validated with the rules release.
+   Enable `options.typeAware` in the target config and verify type-aware linting
+   alongside the shared rules.
 
 ## Copy rules
 

package/skills/release-oxlint-rules/SKILL.md

@@ -17,22 +17,34 @@ description: >-
    its release exists. Resolve the next version from the requested major,
    minor, patch, or exact version. Ask only when the release level is missing.
    Do not add a `v` prefix when the repository's existing tags omit it.
-3. Update the version in `package.json` and `jsr.json`. Before committing, run
-   `mise run check`, `mise run build`, `npm pack --dry-run`, and
+3. Verify official npm `latest` metadata for `oxlint`, `@oxlint/plugins` and
+   `oxlint-tsgolint`. Support is latest-only: keep Oxlint and plugins on the same
+   latest version, pin their development and peer dependencies exactly, and
+   select the latest tsgolint satisfying Oxlint's peer requirement. Regenerate
+   `bun.lock`. The shared Renovate preset groups this toolchain; the local rule
+   keeps peers pinned. Resolve compatibility failures before releasing, without
+   widening peers, disabling rules or forcing transitive dependency upgrades.
+4. Update the version in `package.json` and `jsr.json` only when a version bump
+   is requested. Before committing, run `mise run check`, `mise run build`,
+   `mise run test:package`, `npm pack --dry-run`, and
    `bunx jsr@0.14.3 publish --dry-run --allow-dirty`. The dirty-tree flag is
-   required because the intended version bump is not committed yet.
-4. Treat a direct request to create or publish the release as authorisation for
+   required because the intended changes are not committed yet. The package
+   check installs packed output with strict peers and verifies both recommended
+   configs, actual shared-rule diagnostics and type-aware linting.
+5. Treat a direct request to create or publish the release as authorisation for
    its version commit, push, and GitHub release. Follow the active environment's
    guarded commit and push workflow, committing only the release metadata with
    `Release Oxlint rules <version>`. A request to prepare or plan a release does
    not authorise publication.
-5. Resolve the target only after the push with `git rev-parse HEAD`. Pass the
+6. Resolve the target only after the push with `git rev-parse HEAD`. Pass the
    resulting full 40-character SHA as the `--target` value when running
    `gh release create`. Never pass an abbreviated SHA as `target_commitish`.
-6. Create the release before resolving workflow targets because publication is
+7. Create the release before resolving workflow targets because publication is
    triggered by the `release.published` event. Watch only the release commit's
    exact workflow runs and require both `Publish to npm` and `Publish to JSR` to
    succeed.
-7. Report the release URL, version commit, validation results, and npm and JSR
+8. Report the release URL, version commit, validation results, and npm and JSR
    publication conclusions. Do not report the release as complete while either
-   publication job is pending or failed.
+   publication job is pending or failed. A merged toolchain update alone does
+   not deliver its peer contract to consumers; preparation ends with publication
+   pending until a version bump and release are approved.