@useinsider/eslint-config 3.0.2 → 4.0.0-beta.1

package/dist/main.js

@@ -1,10 +1,11 @@
+import { a as isVueUnsafeRule, i as isRuleDisabled, n as VUE_LIKE_GLOBS, o as toOxlintPluginName, r as isOxlintOwned, s as toOxlintRuleName, t as OXLINT_CATEGORIES } from "./oxlintOwnership-Cx0hgA_J.js";
 import { t as merge } from "./merge-R5ZHqMsV.js";
 import { t as mergeAll } from "./mergeAllConfig-B2rSXCdn.js";
 import { defineConfig } from "eslint/config";
 import globals from "globals";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { createRequire } from "node:module";
-import { dirname, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { AST_NODE_TYPES } from "@typescript-eslint/types";
 import { installPackage } from "@antfu/install-pkg";
@@ -29,6 +30,33 @@ var configFileRules = {
 	"import-x/no-extraneous-dependencies": "off",
 	"import-x/prefer-default-export": "off"
 };
+var LINT_TOPOLOGY_NAME = "insider/lint-topology";
+/**
+* The three files `useInsider()` requires a consumer to own. They are always linted with
+* {@link buildLintTopologyBlocks}, independently of the `configFiles` option.
+*/
+var LINT_TOPOLOGY_GLOBS = [
+	"**/insider.lint.{ts,mts,cts,js,mjs,cjs}",
+	"**/eslint.config.{ts,mts,cts,js,mjs,cjs}",
+	"**/oxlint.config.{ts,mts,cts,js,mjs,cjs}"
+];
+var lintTopologyRules = {
+	...configFileRules,
+	"import-x/extensions": "off"
+};
+/**
+* Relaxations the mandated three-file layout needs in order to lint clean. Emitted unconditionally
+* because the layout exists whether or not the consumer passes `configFiles`.
+* @example
+* buildLintTopologyBlocks()[0].rules['import-x/extensions']; // 'off'
+*/
+function buildLintTopologyBlocks() {
+	return [{
+		name: LINT_TOPOLOGY_NAME,
+		files: [...LINT_TOPOLOGY_GLOBS],
+		rules: { ...lintTopologyRules }
+	}];
+}
 function mergeGlobs(userGlobs) {
 	const seen = /* @__PURE__ */ new Set();
 	const merged = [];
@@ -58,17 +86,148 @@ function buildConfigFilesBlocks(value) {
 function buildJqueryBlocks(entries) {
 	if (!entries || entries.length === 0) return [];
 	return entries.map((entry) => ({
-		files: entry.files,
+		files: [...entry.files],
 		languageOptions: { globals: { ...globals.jquery } }
 	}));
 }
 //#endregion
+//#region src/builders/oxlint.ts
+var OXLINT_SUPPRESSION_NAME = "insider/oxlint-suppression";
+var OXLINT_SFC_EXCEPTION_NAME = "insider/oxlint-suppression-sfc-exception";
+var UNUSED_DIRECTIVE_BLOCK_NAME = "insider/unused-disable-directives";
+var UNUSED_DIRECTIVE_SEVERITY = "warn";
+var OXLINT_DIRECTIVE_OPTIONS = {
+	respectEslintDisableDirectives: false,
+	reportUnusedDisableDirectives: UNUSED_DIRECTIVE_SEVERITY
+};
+/**
+* The always-on ESLint block that makes a stale `eslint-disable` visible. ESLint 9 defaults this to
+* `warn`, but the split relies on it, so it is pinned rather than inherited.
+* @example
+* buildUnusedDirectiveBlocks()[0].linterOptions; // { reportUnusedDisableDirectives: 'warn' }
+*/
+function buildUnusedDirectiveBlocks() {
+	return [{
+		name: UNUSED_DIRECTIVE_BLOCK_NAME,
+		linterOptions: { reportUnusedDisableDirectives: UNUSED_DIRECTIVE_SEVERITY }
+	}];
+}
+function ownedRuleNames(rules) {
+	return Object.keys(rules).filter((name) => isOxlintOwned(name) && !isRuleDisabled(rules[name]));
+}
+function translatableRuleNames(rules) {
+	return Object.keys(rules).filter(isOxlintOwned);
+}
+function toOffRecord(ruleNames) {
+	return Object.fromEntries(ruleNames.map((name) => [name, "off"]));
+}
+function suppressionFor(block) {
+	if (!block.rules) return [];
+	const owned = ownedRuleNames(block.rules);
+	if (owned.length === 0) return [];
+	const files = block.files ? { files: [...block.files] } : {};
+	const blockIgnores = block.ignores ? [...block.ignores] : [];
+	const vueSafe = owned.filter((name) => !isVueUnsafeRule(name));
+	const vueUnsafe = owned.filter((name) => isVueUnsafeRule(name));
+	const suppressions = [];
+	if (vueSafe.length > 0) suppressions.push({
+		name: OXLINT_SUPPRESSION_NAME,
+		...files,
+		...blockIgnores.length > 0 ? { ignores: blockIgnores } : {},
+		rules: toOffRecord(vueSafe)
+	});
+	if (vueUnsafe.length > 0) suppressions.push({
+		name: OXLINT_SFC_EXCEPTION_NAME,
+		...files,
+		ignores: [...blockIgnores, ...VUE_LIKE_GLOBS],
+		rules: toOffRecord(vueUnsafe)
+	});
+	return suppressions;
+}
+/**
+* ESLint blocks that turn off every rule the emitted oxlint config takes over. Rules oxlint cannot
+* check inside an SFC are suppressed everywhere except `.vue`/`.svelte`/`.astro`, so a Vue consumer
+* keeps them.
+* @example
+* buildOxlintSuppressionBlocks([{ files: ['src/**\/*.ts'], rules: { 'no-var': 'error' } }]);
+* // [{ files: ['src/**\/*.ts'], rules: { 'no-var': 'off' } }]
+*/
+function buildOxlintSuppressionBlocks(blocks) {
+	return blocks.flatMap(suppressionFor);
+}
+function translateRules(rules, plugins) {
+	return translatableRuleNames(rules).reduce((accumulator, name) => {
+		plugins.add(toOxlintPluginName(name));
+		accumulator[toOxlintRuleName(name)] = rules[name];
+		return accumulator;
+	}, {});
+}
+function anchorOxlintGlob(glob) {
+	return glob.startsWith("**") || glob.startsWith("./") || glob.startsWith("/") ? glob : `./${glob}`;
+}
+function anchorGlobs(globs) {
+	return globs.map(anchorOxlintGlob);
+}
+function anchorOxlintIgnorePattern(pattern) {
+	const negated = pattern.startsWith("!");
+	const body = negated ? pattern.slice(1) : pattern;
+	const anchored = body.startsWith("/") || body.startsWith("**") ? body : `/${body}`;
+	return negated ? `!${anchored}` : anchored;
+}
+function overrideFor(block, plugins) {
+	if (!block.files || !block.rules) return [];
+	const translated = translateRules(block.rules, plugins);
+	if (Object.keys(translated).length === 0) return [];
+	return [{
+		files: anchorGlobs(block.files),
+		...block.ignores && block.ignores.length > 0 ? { excludeFiles: anchorGlobs(block.ignores) } : {},
+		rules: translated
+	}];
+}
+/**
+* The oxlint half of the split, derived from the same emitted ESLint blocks the suppression layer
+* reads. Every oxlint category is pinned off so the config enables exactly the preset's own rules
+* and nothing oxlint would otherwise turn on by default.
+* @example
+* buildOxlintConfig([{ files: ['src/**\/*.ts'], rules: { 'no-var': 'error' } }], ['dist']);
+* // { plugins: ['eslint'], categories: { correctness: 'off', ... }, ignorePatterns: ['/dist'], ... }
+*/
+function buildOxlintConfig(blocks, ignores) {
+	const plugins = /* @__PURE__ */ new Set(["eslint"]);
+	const overrides = blocks.flatMap((block) => overrideFor(block, plugins));
+	const globalRules = blocks.filter((block) => !block.files && block.rules).reduce((accumulator, block) => ({
+		...accumulator,
+		...translateRules(block.rules, plugins)
+	}), {});
+	return {
+		plugins: [...plugins].sort((left, right) => left.localeCompare(right)),
+		categories: Object.fromEntries(OXLINT_CATEGORIES.map((name) => [name, "off"])),
+		...ignores && ignores.length > 0 ? { ignorePatterns: ignores.map(anchorOxlintIgnorePattern) } : {},
+		options: { ...OXLINT_DIRECTIVE_OPTIONS },
+		rules: globalRules,
+		overrides
+	};
+}
+//#endregion
 //#region src/utils/ensureConfigStructure.ts
-var CONFIG_FILE_REGEX = /eslint\.config\.[mc]?[jt]s(?:$|\?)/;
-var OPT_OUT_ENV = "INSIDER_SKIP_CONFIG_VALIDATION";
+var ANCHOR_FILE_REGEX = /(?:insider\.lint|eslint\.config)\.[mc]?[jt]s(?:$|\?)/;
+var OPT_OUT_ENV$1 = "INSIDER_SKIP_CONFIG_VALIDATION";
 var FILE_URL_PREFIX = "file://";
 var TARGET_CALLEE_NAME = "useInsider";
+var ESLINT_RENDERER_NAME = "useInsiderESLint";
+var OXC_RENDERER_NAME = "useInsiderOXC";
 var INSIDER_IMPORT_SOURCE = "@useinsider/eslint-config";
+var MODULE_EXTENSIONS = [
+	"ts",
+	"mts",
+	"cts",
+	"js",
+	"mjs",
+	"cjs"
+];
+var RENDERER_EXPORT = `export const ${`{ ${ESLINT_RENDERER_NAME}, ${OXC_RENDERER_NAME} }`} = ${TARGET_CALLEE_NAME}({ ... })`;
+var LINT_MODULE_FILENAMES = MODULE_EXTENSIONS.map((ext) => `insider.lint.${ext}`);
+var ESLINT_CONFIG_FILENAMES = MODULE_EXTENSIONS.map((ext) => `eslint.config.${ext}`);
 var bypassWarnEmitted = false;
 function computeSelfModulePath() {
 	const raw = fileURLToPath(import.meta.url);
@@ -98,24 +257,24 @@ function locOf(node) {
 		column: node.loc.start.column
 	};
 }
-function validateCallExpression(callExpr) {
+function validateCallExpression(callExpr, expectedCallee) {
 	const { callee } = callExpr;
-	if (callee.type !== AST_NODE_TYPES.Identifier || callee.name !== TARGET_CALLEE_NAME) return [{
+	if (callee.type !== AST_NODE_TYPES.Identifier || callee.name !== expectedCallee) return [{
 		...locOf(callExpr),
-		reason: "Default export must call `useInsider(...)` directly."
+		reason: `Default export must call \`${expectedCallee}(...)\` directly.`
 	}];
 	return [];
 }
-function validateExportedCall(callee, fallbackLoc) {
+function validateExportedCall(callee, fallbackLoc, expectedCallee) {
 	let target = callee;
 	if (target.type === AST_NODE_TYPES.AwaitExpression) target = target.argument;
-	if (target.type === AST_NODE_TYPES.CallExpression) return validateCallExpression(target);
+	if (target.type === AST_NODE_TYPES.CallExpression) return validateCallExpression(target, expectedCallee);
 	if (target.type === AST_NODE_TYPES.ArrayExpression) return [{
 		...locOf(target),
-		reason: "Default export must not wrap `useInsider(...)` in an array. Use the typed options object instead."
+		reason: `Default export must not wrap \`${expectedCallee}(...)\` in an array.`
 	}];
 	if (target.type === AST_NODE_TYPES.LogicalExpression || target.type === AST_NODE_TYPES.ConditionalExpression) {
-		const reason = ["Default export must not gate `useInsider(...)` behind a logical/conditional expression.", "Use the typed options object instead."].join(" ");
+		const reason = [`Default export must not gate \`${expectedCallee}(...)\` behind a logical/conditional expression.`, "Use the typed options object instead."].join(" ");
 		return [{
 			...locOf(target),
 			reason
@@ -123,7 +282,7 @@ function validateExportedCall(callee, fallbackLoc) {
 	}
 	return [{
 		...fallbackLoc,
-		reason: "Default export must be a direct call to `useInsider(...)`."
+		reason: `Default export must be a direct call to \`${expectedCallee}(...)\`.`
 	}];
 }
 function collectInsiderBindings(node, bindings, isInsiderSource) {
@@ -144,7 +303,7 @@ function classifyExpressionStatement(node, insiderBindings) {
 		}
 	};
 }
-function classifyStatement(node, exportSeen, insiderBindings) {
+function classifyStatement(node, exportSeen, insiderBindings, expectedCallee) {
 	if (node.type === AST_NODE_TYPES.ImportDeclaration || node.type === AST_NODE_TYPES.VariableDeclaration) return { type: "ignore" };
 	if (node.type === AST_NODE_TYPES.ExpressionStatement) return classifyExpressionStatement(node, insiderBindings);
 	if (node.type === AST_NODE_TYPES.ExportDefaultDeclaration) {
@@ -158,13 +317,13 @@ function classifyStatement(node, exportSeen, insiderBindings) {
 		const declaration = node.declaration;
 		return {
 			type: "export",
-			violations: validateExportedCall(declaration, locOf(node))
+			violations: validateExportedCall(declaration, locOf(node), expectedCallee)
 		};
 	}
 	const reason = [
 		`Disallowed top-level statement \`${node.type}\`.`,
 		"Only imports, variable declarations, helper calls from `@useinsider/eslint-config`,",
-		"and one `export default useInsider(...)` are allowed."
+		`and one \`export default ${expectedCallee}()\` are allowed.`
 	].join(" ");
 	return {
 		type: "disallowed",
@@ -179,18 +338,112 @@ function validateProgramStructure(program, configPath = "", options = {}) {
 	const insiderBindings = /* @__PURE__ */ new Set();
 	const resolver = options.isInsiderImportSource ?? defaultIsInsiderImportSource;
 	const isInsiderSource = (source) => resolver(source, configPath);
+	const expectedCallee = options.expectedCallee ?? ESLINT_RENDERER_NAME;
 	let exportSeen = false;
 	program.body.forEach((node) => {
 		if (node.type === AST_NODE_TYPES.ImportDeclaration) collectInsiderBindings(node, insiderBindings, isInsiderSource);
-		const result = classifyStatement(node, exportSeen, insiderBindings);
+		const result = classifyStatement(node, exportSeen, insiderBindings, expectedCallee);
 		if (result.type === "ignore") return;
 		if (result.type === "export") {
 			exportSeen = true;
 			violations.push(...result.violations);
 			return;
 		}
-		if (result.type === "duplicateExport") {
-			violations.push(result.violation);
+		violations.push(result.violation);
+	});
+	if (!exportSeen) violations.push({
+		line: 1,
+		column: 0,
+		reason: `Missing \`export default ${options.expectedCallee ?? ESLINT_RENDERER_NAME}()\`.`
+	});
+	return violations;
+}
+function validateRendererPattern(pattern) {
+	const bound = /* @__PURE__ */ new Set();
+	const violations = [];
+	pattern.properties.forEach((property) => {
+		if (property.type !== AST_NODE_TYPES.Property || property.computed || !property.shorthand) {
+			violations.push({
+				...locOf(property),
+				reason: `Destructure \`${ESLINT_RENDERER_NAME}\` and \`${OXC_RENDERER_NAME}\` by name, without renaming or spreading.`
+			});
+			return;
+		}
+		bound.add(property.key.name);
+	});
+	[ESLINT_RENDERER_NAME, OXC_RENDERER_NAME].forEach((name) => {
+		if (!bound.has(name)) violations.push({
+			...locOf(pattern),
+			reason: `Missing \`${name}\` in the destructured \`${TARGET_CALLEE_NAME}(...)\` result.`
+		});
+	});
+	return violations;
+}
+function validateRendererExport(node) {
+	const { declaration } = node;
+	if (!declaration || declaration.type !== AST_NODE_TYPES.VariableDeclaration || declaration.kind !== "const") return [{
+		...locOf(node),
+		reason: `Renderer export must be \`${RENDERER_EXPORT};\`.`
+	}];
+	if (declaration.declarations.length !== 1) return [{
+		...locOf(declaration),
+		reason: "Renderer export must declare exactly one binding."
+	}];
+	const [declarator] = declaration.declarations;
+	if (declarator.id.type !== AST_NODE_TYPES.ObjectPattern) return [{
+		...locOf(declarator.id),
+		reason: `Renderer export must destructure \`${ESLINT_RENDERER_NAME}\` and \`${OXC_RENDERER_NAME}\`.`
+	}];
+	const patternViolations = validateRendererPattern(declarator.id);
+	const { init } = declarator;
+	if (!init) return [...patternViolations, {
+		...locOf(declarator),
+		reason: `Renderer export must be initialized by a direct \`${TARGET_CALLEE_NAME}(...)\` call.`
+	}];
+	return [...patternViolations, ...validateExportedCall(init, locOf(declarator), TARGET_CALLEE_NAME)];
+}
+function classifyLintModuleStatement(node, exportSeen, insiderBindings) {
+	if (node.type === AST_NODE_TYPES.ImportDeclaration || node.type === AST_NODE_TYPES.VariableDeclaration) return { type: "ignore" };
+	if (node.type === AST_NODE_TYPES.ExpressionStatement) return classifyExpressionStatement(node, insiderBindings);
+	if (node.type === AST_NODE_TYPES.ExportNamedDeclaration) {
+		if (exportSeen) return {
+			type: "duplicateExport",
+			violation: {
+				...locOf(node),
+				reason: "Only one export is allowed."
+			}
+		};
+		return {
+			type: "export",
+			violations: validateRendererExport(node)
+		};
+	}
+	const reason = [
+		`Disallowed top-level statement \`${node.type}\`.`,
+		"Only imports, variable declarations, helper calls from `@useinsider/eslint-config`,",
+		`and one \`${RENDERER_EXPORT}\` are allowed.`
+	].join(" ");
+	return {
+		type: "disallowed",
+		violation: {
+			...locOf(node),
+			reason
+		}
+	};
+}
+function validateLintModuleStructure(program, configPath = "", options = {}) {
+	const violations = [];
+	const insiderBindings = /* @__PURE__ */ new Set();
+	const resolver = options.isInsiderImportSource ?? defaultIsInsiderImportSource;
+	const isInsiderSource = (source) => resolver(source, configPath);
+	let exportSeen = false;
+	program.body.forEach((node) => {
+		if (node.type === AST_NODE_TYPES.ImportDeclaration) collectInsiderBindings(node, insiderBindings, isInsiderSource);
+		const result = classifyLintModuleStatement(node, exportSeen, insiderBindings);
+		if (result.type === "ignore") return;
+		if (result.type === "export") {
+			exportSeen = true;
+			violations.push(...result.violations);
 			return;
 		}
 		violations.push(result.violation);
@@ -198,7 +451,7 @@ function validateProgramStructure(program, configPath = "", options = {}) {
 	if (!exportSeen) violations.push({
 		line: 1,
 		column: 0,
-		reason: "Missing `export default useInsider(...)`."
+		reason: `Missing \`${RENDERER_EXPORT};\`.`
 	});
 	return violations;
 }
@@ -222,7 +475,7 @@ function extractMatchesFromStack(frames) {
 	const matches = /* @__PURE__ */ new Set();
 	frames.forEach((frame) => {
 		const name = normalizeFrameFilename(frame.getFileName());
-		if (name && CONFIG_FILE_REGEX.test(name)) matches.add(name);
+		if (name && ANCHOR_FILE_REGEX.test(name)) matches.add(name);
 	});
 	return Array.from(matches);
 }
@@ -235,13 +488,16 @@ function argvCandidateAt(argv, index) {
 function extractConfigFromArgv(argv) {
 	for (let i = 0; i < argv.length; i += 1) {
 		const candidate = argvCandidateAt(argv, i);
-		if (candidate && CONFIG_FILE_REGEX.test(candidate)) return candidate;
+		if (candidate && ANCHOR_FILE_REGEX.test(candidate)) return candidate;
 	}
 	return null;
 }
+var LINT_MODULE_REGEX = /insider\.lint\.[mc]?[jt]s(?:$|\?)/;
 function getConsumerConfigPath(frames = readStackFrames(), argv = process.argv) {
 	const stackMatches = extractMatchesFromStack(frames);
 	if (stackMatches.length === 1) return stackMatches[0];
+	const lintModules = stackMatches.filter((match) => LINT_MODULE_REGEX.test(match));
+	if (lintModules.length === 1) return lintModules[0];
 	const fromArgv = extractConfigFromArgv(argv);
 	if (fromArgv) return fromArgv;
 	return null;
@@ -251,27 +507,46 @@ function captureConsumerConfigDir(configPath) {
 	consumerConfigDir = configPath === null ? null : dirname(resolve(configPath));
 }
 /**
-* Directory holding the consumer's `eslint.config.*`, captured by {@link ensureConfigStructure}.
-* This is the anchor `tsconfigPaths` entries are written against; it falls back to `process.cwd()`
-* when the config file could not be located.
+* Directory holding the consumer's `insider.lint.*` module and its sibling linter configs, captured
+* by {@link ensureConfigStructure}. This is the anchor `tsconfigPaths` entries are written against,
+* and where {@link import('./ensureOxlintConfig').ensureOxlintConfig} looks for the oxlint config;
+* it falls back to `process.cwd()` when the module could not be located.
 * @example
-* // consumer config at /repo/eslint.config.mjs, `eslint` launched from /repo/app
+* // consumer module at /repo/insider.lint.ts, `eslint` launched from /repo/app
 * getConsumerConfigDir(); // '/repo'
 */
 function getConsumerConfigDir() {
 	return consumerConfigDir ?? process.cwd();
 }
+var EXPECTED_LAYOUT = [
+	"Expected layout (three sibling files):",
+	"",
+	"  // insider.lint.ts",
+	"  import { useInsider } from '@useinsider/eslint-config';",
+	"",
+	`  ${RENDERER_EXPORT};`,
+	"",
+	"  // eslint.config.ts",
+	`  import { ${ESLINT_RENDERER_NAME} } from './insider.lint.ts';`,
+	"",
+	`  export default ${ESLINT_RENDERER_NAME}();`,
+	"",
+	"  // oxlint.config.ts",
+	`  import { ${OXC_RENDERER_NAME} } from './insider.lint.ts';`,
+	"",
+	`  export default await ${OXC_RENDERER_NAME}();`
+].join("\n");
 function formatReport(configPath, violations) {
 	const header = ["@useinsider/eslint-config: protected configuration structure violated in:", `  ${configPath}`].join("\n");
 	const lines = violations.map((violation) => `  - [${violation.line}:${violation.column}] ${violation.reason}`);
 	const footer = [
 		"",
-		"Allowed structure:",
-		"  - import statements",
-		"  - const/let/var declarations",
-		"  - exactly one `export default useInsider({ ... })`",
+		"Alongside the export, only import statements, const/let/var declarations and helper calls",
+		"imported from `@useinsider/eslint-config` are allowed.",
 		"",
-		"Emergency bypass: set INSIDER_SKIP_CONFIG_VALIDATION=true (do not commit)."
+		EXPECTED_LAYOUT,
+		"",
+		`Emergency bypass: set ${OPT_OUT_ENV$1}=true (do not commit).`
 	].join("\n");
 	return `${header}\n${lines.join("\n")}\n${footer}`;
 }
@@ -312,16 +587,50 @@ function parseConsumerSource(configPath, source) {
 		return fail(`@useinsider/eslint-config: failed to parse consumer config at ${configPath}: ${message}`);
 	}
 }
-function runValidation(configPath) {
-	if (!configPath) fail(["@useinsider/eslint-config: unable to locate consumer `eslint.config.*` file for structure validation.", "If this is an unexpected environment, set INSIDER_SKIP_CONFIG_VALIDATION=true (do not commit)."].join("\n"));
-	const violations = validateProgramStructure(parseConsumerSource(configPath, readConsumerSource(configPath)), configPath);
+function resolveSibling(directory, filenames) {
+	const found = filenames.find((filename) => existsSync(resolve(directory, filename)));
+	return found ? resolve(directory, found) : null;
+}
+function validateFile(filePath, validator, options) {
+	const violations = validator(parseConsumerSource(filePath, readConsumerSource(filePath)), filePath, options);
 	if (violations.length === 0) return;
-	fail(formatReport(configPath, violations));
+	fail(formatReport(filePath, violations));
+}
+function runValidation(anchorPath) {
+	if (!anchorPath) fail([
+		"@useinsider/eslint-config: unable to locate the consumer `insider.lint.*` module for structure validation.",
+		"",
+		EXPECTED_LAYOUT,
+		"",
+		`If this is an unexpected environment, set ${OPT_OUT_ENV$1}=true (do not commit).`
+	].join("\n"));
+	const directory = dirname(resolve(anchorPath));
+	const lintModulePath = resolveSibling(directory, LINT_MODULE_FILENAMES);
+	if (!lintModulePath) fail([
+		`@useinsider/eslint-config: no \`insider.lint.*\` module found in ${directory}.`,
+		"",
+		`\`${TARGET_CALLEE_NAME}()\` now returns the two renderers instead of a flat-config array,`,
+		"so the config it is called from must be a module both linters can import.",
+		"",
+		EXPECTED_LAYOUT,
+		"",
+		`Emergency bypass: set ${OPT_OUT_ENV$1}=true (do not commit).`
+	].join("\n"));
+	validateFile(lintModulePath, validateLintModuleStructure, {});
+	const eslintConfigPath = resolveSibling(directory, ESLINT_CONFIG_FILENAMES);
+	if (!eslintConfigPath) fail([
+		`@useinsider/eslint-config: no \`eslint.config.*\` file found in ${directory}.`,
+		"",
+		EXPECTED_LAYOUT,
+		"",
+		`Emergency bypass: set ${OPT_OUT_ENV$1}=true (do not commit).`
+	].join("\n"));
+	validateFile(eslintConfigPath, validateProgramStructure, { expectedCallee: ESLINT_RENDERER_NAME });
 }
 function ensureConfigStructure(overridePath) {
 	const configPath = overridePath === void 0 ? getConsumerConfigPath() : overridePath;
 	captureConsumerConfigDir(configPath);
-	if (process.env[OPT_OUT_ENV] === "true") {
+	if (process.env[OPT_OUT_ENV$1] === "true") {
 		emitBypassWarning();
 		return;
 	}
@@ -465,7 +774,7 @@ async function buildScopeBlocks(scope, entries) {
 	const preset = (await scopeMap[scope]()).default;
 	return entries.map((entry) => {
 		const block = clonePreset(preset);
-		block.files = entry.files;
+		block.files = [...entry.files];
 		if (tsScopes.has(scope)) {
 			const { tsconfigPaths } = entry;
 			if (tsconfigPaths) applyTypescriptOverrides(block, { tsconfigPaths });
@@ -499,7 +808,7 @@ async function buildStrictBlocks(value) {
 	const { default: strictConfig } = await import("./strict-BHw_cKrv.js");
 	const clone = { ...strictConfig };
 	if (clone.rules) clone.rules = { ...clone.rules };
-	if (isFileScoped) clone.files = value;
+	if (isFileScoped) clone.files = [...value];
 	else delete clone.files;
 	return [clone];
 }
@@ -508,7 +817,11 @@ async function buildStrictBlocks(value) {
 var turnOff = false;
 var scanned = false;
 var silencedDependencies = /* @__PURE__ */ new Set();
-var fixedDependencies = ["eslint", "globals"];
+var fixedDependencies = [
+	"eslint",
+	"globals",
+	"oxlint"
+];
 var require = createRequire(import.meta.url);
 function getPackageJSONPath(currentDir) {
 	const fileLocation = resolve(currentDir, "package.json");
@@ -564,6 +877,46 @@ function silenceDependencyWarning(input) {
 	input.forEach((dependency) => silencedDependencies.add(String(dependency)));
 }
 //#endregion
+//#region src/utils/ensureOxlintConfig.ts
+var OPT_OUT_ENV = "INSIDER_SKIP_CONFIG_VALIDATION";
+var OXLINT_CONFIG_FILENAMES = ["oxlint.config.ts", "oxlint.config.mts"];
+function lintModuleSpecifier(directory) {
+	return `./${LINT_MODULE_FILENAMES.find((filename) => existsSync(join(directory, filename))) ?? "insider.lint.ts"}`;
+}
+function formatMessage(directory) {
+	return [
+		"@useinsider/eslint-config: no oxlint config found in",
+		`  ${directory}`,
+		"",
+		"useInsiderESLint() turns off every rule oxlint owns, so running ESLint alone would silently",
+		"drop those checks. Create the sibling oxlint config:",
+		"",
+		"  // oxlint.config.ts",
+		`  import { useInsiderOXC } from '${lintModuleSpecifier(directory)}';`,
+		"",
+		"  export default await useInsiderOXC();",
+		"",
+		"and run both linters:",
+		"",
+		"  \"lint\": \"oxlint --disable-nested-config && eslint .\"",
+		"",
+		`Expected one of: ${OXLINT_CONFIG_FILENAMES.join(", ")}.`,
+		`Emergency bypass: set ${OPT_OUT_ENV}=true (do not commit).`
+	].join("\n");
+}
+/**
+* Fails when the consumer enabled the ESLint-side oxlint suppression without a sibling oxlint
+* config to run the suppressed rules. Resolved against the directory
+* {@link getConsumerConfigDir} captured during `useInsider()`.
+* @example
+* ensureOxlintConfig(); // throws unless oxlint.config.{ts,mts} sits beside insider.lint.*
+*/
+function ensureOxlintConfig(directory = getConsumerConfigDir()) {
+	if (process.env[OPT_OUT_ENV] === "true") return;
+	if (OXLINT_CONFIG_FILENAMES.some((filename) => existsSync(join(directory, filename)))) return;
+	throw new Error(formatMessage(directory));
+}
+//#endregion
 //#region src/utils/silenceRules.ts
 var globallySilencedRules = /* @__PURE__ */ new Set();
 /**
@@ -583,14 +936,25 @@ function silenceRule(config) {
 	const [, ...restConfig] = Array.isArray(config) ? config : [];
 	return ["warn", ...restConfig];
 }
+/**
+* Reports a silenced rule name that no emitted block declares, which is how a typo in
+* `silenceRules` stays visible. The caller passes the union of every block's rule keys: a single
+* block is not evidence, because the emission is many narrow blocks and a correctly spelled rule is
+* absent from nearly all of them.
+* @example
+* warnUnknownSilencedRules(['no-console'], ['no-unknown-rule']); // warns once
+*/
+function warnUnknownSilencedRules(knownRules, silencedRules) {
+	const known = new Set(knownRules);
+	new Set(silencedRules).forEach((rule) => {
+		if (known.has(rule)) return;
+		warn(`Unknown rule "${rule}". Please remove it from the silenced rules list.`);
+	});
+}
 function filterSilencedRules(rules, silencedRules) {
 	let targetSilencedRules = silencedRules || globallySilencedRules;
 	if (Array.isArray(targetSilencedRules)) targetSilencedRules = new Set(targetSilencedRules);
 	if (!rules || !targetSilencedRules.size) return rules;
-	if (silencedRules) targetSilencedRules.forEach((rule) => {
-		if (rules[rule]) return;
-		warn(`Unknown rule "${rule}". Please remove it from the silenced rules list.`);
-	});
 	return Object.entries(rules).reduce((newRules, [key, value]) => {
 		if (value) newRules[key] = targetSilencedRules.has(key) && !isDisabled(value) ? silenceRule(value) : value;
 		return newRules;
@@ -626,6 +990,7 @@ async function collectScopeBlocks(config) {
 	}, Promise.resolve([]));
 }
 function applySilenceRules(blocks, perCallSilence) {
+	if (perCallSilence) warnUnknownSilencedRules(blocks.flatMap((block) => Object.keys(block.rules ?? {})), perCallSilence);
 	blocks.forEach((block) => {
 		if (!block.rules) return;
 		block.rules = perCallSilence ? filterSilencedRules(block.rules, perCallSilence) : filterSilencedRules(block.rules);
@@ -635,28 +1000,42 @@ function buildIgnoresBlocks(ignores) {
 	if (!ignores || ignores.length === 0) return [];
 	return [{ ignores: [...ignores] }];
 }
-async function useInsider(config) {
-	assertNoRemovedKeys(config);
-	ensureConfigStructure();
-	await ensureDependencies();
-	const ignoresBlocks = buildIgnoresBlocks(config.ignores);
+async function buildBaseBlocks(config) {
 	const scopeBlocks = await collectScopeBlocks(config);
-	const jqueryBlocks = buildJqueryBlocks(config.jquery);
-	const configFilesBlocks = buildConfigFilesBlocks(config.configFiles);
 	const strictBlocks = await buildStrictBlocks(config.strict);
-	const spellCheckerBlocks = buildSpellCheckerBlocks(config.spellChecker);
-	const blocks = [
-		...ignoresBlocks,
+	return [
+		...buildIgnoresBlocks(config.ignores),
+		...buildUnusedDirectiveBlocks(),
 		...scopeBlocks,
-		...jqueryBlocks,
-		...configFilesBlocks,
+		...buildJqueryBlocks(config.jquery),
+		...buildConfigFilesBlocks(config.configFiles),
 		...strictBlocks,
-		...spellCheckerBlocks
+		...buildLintTopologyBlocks(),
+		...buildSpellCheckerBlocks(config.spellChecker)
 	];
+}
+async function renderEslint(config) {
+	await ensureDependencies();
+	ensureOxlintConfig();
+	const baseBlocks = await buildBaseBlocks(config);
+	const blocks = [...baseBlocks, ...buildOxlintSuppressionBlocks(baseBlocks)];
 	applySilenceRules(blocks, config.silenceRules);
 	return defineConfig(blocks);
 }
+async function renderOxlint(config) {
+	const baseBlocks = await buildBaseBlocks(config);
+	applySilenceRules(baseBlocks, config.silenceRules);
+	return buildOxlintConfig(baseBlocks, config.ignores);
+}
+function useInsider(config) {
+	assertNoRemovedKeys(config);
+	ensureConfigStructure();
+	return {
+		useInsiderESLint: () => renderEslint(config),
+		useInsiderOXC: () => renderOxlint(config)
+	};
+}
 //#endregion
-export { ensureConfigStructure, merge, mergeAll, silenceDependencyWarning, silenceRules, useInsider };
+export { ensureConfigStructure, ensureOxlintConfig, merge, mergeAll, silenceDependencyWarning, silenceRules, useInsider };
 
 //# sourceMappingURL=main.js.map