@ztd-me/eslint 0.1.1 → 0.1.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Zeithrold
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -45,6 +45,13 @@ Type-aware checking is on by default, using `tsconfig.json`. Supply an existing
 
 The parser uses the explicit TS project, with `.vue` as an extra file extension and `vue-eslint-parser` as the SFC outer parser. Typed rules cover Vue scripts as well as TS and TSX. Vue template expressions use Vue rules and the custom array visitor; TypeScript rules do not type-check template expressions.
 
+Since 0.1.2, the explicit project settings apply only to actual type-aware source files. Markdown TS/TSX
+code fences and Astro's virtual TS snippets use the existing upstream syntax scope, without asking the
+application TS config to include generated files such as `README.md/0_0.tsx`. Markdown markup,
+TypeScript syntax, React semantics, array formatting and other applicable checks remain enabled.
+Actual application files still require the selected strict project; files outside it fail rather than
+receiving a syntax-only fallback. The same virtual-file boundary applies to typed Vitest rules.
+
 For a JavaScript-only scope, use `typescript: false`. This turns off TypeScript parsing and rules; it does not lower JS complexity, length, or correctness standards. There is no syntax-only TypeScript or `strictTypes: false` mode. Run `tsc --noEmit` as a separate compiler gate; `exactOptionalPropertyTypes`, `noPropertyAccessFromIndexSignature`, and `useUnknownInCatchVariables` are also recommended compiler settings.
 
 ## Framework options
@@ -134,6 +141,6 @@ pnpm run check
 
 The checks build JS/declarations, type-check the public API, self-lint source/tests/scripts, exercise real TS/React/Vue fixtures, check all numeric boundaries and all selected catalog options, and install/import/type-check an independently packed artifact with pnpm. Negative fixtures are checked by the test harness, not included in ordinary self-lint. The test modules have reasoned local exceptions for Node's asynchronous ESM setup and imports of the distribution being tested; safety and size limits remain active.
 
-[Publishing instructions](docs/publishing.md) describe the stage-only GitHub workflow and the user-controlled promotion. Staging is not a public release. After promotion, run `node scripts/registry-smoke.mjs 0.1.1` to install the exact public version in a fresh pnpm project and verify imports, declarations and lint behavior. Registry installation follows pnpm's supply-chain policies; a policy rejection is a blocker, not permission to disable the policy.
+[Publishing instructions](docs/publishing.md) describe the stage-only GitHub workflow and the user-controlled promotion. Version `0.1.3` prepares the MIT metadata and full license notice for a new npm release. Staging is not a public release. After promotion, run `node scripts/registry-smoke.mjs 0.1.3` to install the exact public version in a fresh pnpm project and verify imports, declarations and lint behavior. Registry installation follows pnpm's supply-chain policies; a policy rejection is a blocker, not permission to disable the policy.
 
-The repository has not granted an open-source license; package metadata is `UNLICENSED` pending that separate decision.
+First-party code and documentation are [MIT licensed](LICENSE). Installed ESLint, antfu and plugin dependencies retain their own licenses and notices; the package does not relicense them. Existing published versions keep their original artifacts and metadata.

package/dist/index.js

@@ -12,6 +12,7 @@ import { typedRules } from './rules/typed.js';
 import { vueA11yRules } from './rules/vue-a11y.js';
 import { vueRules } from './rules/vue.js';
 import { resolveTypeScript } from './typescript.js';
+const typeAwareIgnores = ['**/*.md/**', '**/*.astro/*.ts'];
 function shared(sfcFiles) {
     return {
         name: 'ztd/shared',
@@ -40,7 +41,7 @@ function shared(sfcFiles) {
         },
     };
 }
-function typed(files) {
+function typed(files, parserOptions) {
     return [
         {
             name: 'ztd/typescript-syntax',
@@ -59,7 +60,9 @@ function typed(files) {
         {
             name: 'ztd/typescript-typed',
             files,
-            ignores: ['**/*.md/**', '**/*.astro/*.ts'],
+            ignores: typeAwareIgnores,
+            // antfu applies its general parserOptions to both parsers; keep project settings in this typed scope.
+            languageOptions: { parserOptions },
             rules: {
                 ...typedRules,
                 'require-await': 'off',
@@ -133,6 +136,7 @@ function vitest(enabled, tsFiles) {
         configs.push({
             name: 'ztd/vitest-typed',
             files: tsFiles.flatMap(file => GLOB_TESTS.map(testFile => [file, testFile])),
+            ignores: typeAwareIgnores,
             rules: { 'ts/unbound-method': 'off', 'test/unbound-method': [
                     'error',
                     { ignoreStatic: false },
@@ -198,12 +202,18 @@ export async function createConfig(options = {}, ...localConfigs) {
         shared(sfcFiles),
         ...react(enableReact),
         ...vue(enableVue),
-        ...(typescript === false ? [] : typed(tsFiles)),
+        ...(tsOptions === false ? [] : typed(tsFiles, tsOptions.parserOptions)),
         ...vitest(test, typescript === false ? [] : tsFiles),
     ];
     return await antfu({
         ...base,
-        typescript: tsOptions === false ? false : { ...tsOptions, filesTypeAware: tsFiles },
+        typescript: tsOptions === false
+            ? false
+            : {
+                tsconfigPath: tsOptions.tsconfigPath,
+                filesTypeAware: tsFiles,
+                ignoresTypeAware: typeAwareIgnores,
+            },
         react: antfuReact(enableReact, tsFiles),
         vue: antfuVue(sfcFiles),
         test,

package/docs/pnpm-policy.md

@@ -10,6 +10,8 @@ trustPolicy: no-downgrade
 
 These inherited checks are separate from the 198-entry research catalog. They are intentional upstream defaults; this package does not silently disable them when a consumer fails lint. Changing a consumer's dependency policy requires that project's approval and native installation/build checks.
 
+The user now approves tools verification and the three consumer projects to use `minimumReleaseAgeExclude: ['@ztd-me/*']` for frequent scope releases. Add this age-only selector to the existing list without removing unrelated gates or approved entries. `trustPolicy: no-downgrade`, package integrity and dependency-build restrictions remain active; there is no scope trust exclusion. The existing exact `semver@6.3.1` trust exception remains separate.
+
 [`minimumReleaseAgeExcludePrune`](https://pnpm.io/settings/dependency-resolution#minimumreleaseageexcludeprune) was added in pnpm 11.22.0. It removes release-age exception entries that no longer match packages/versions in the lockfile. It retains an active package-wide exception, including `@ztd-me/eslint`, while that package remains installed; this does not automatically expire the exception after the age cutoff. Wildcard entries are retained. Older pnpm versions do not provide the pruning behavior merely because the YAML key is present.
 
 [`trustPolicy: no-downgrade`](https://pnpm.io/settings/dependency-resolution#trustpolicy) was added in pnpm 10.21.0 and rejects a package release whose publishing trust drops below earlier releases. Trusted publishing ranks above provenance-only publishing, which ranks above publication without either. Release-age exceptions do not bypass this independent policy. Installation must check the actual dependency graph; switching a package from token publication to trusted publication can make a later token-only release a downgrade.
@@ -18,10 +20,10 @@ These inherited checks are separate from the 198-entry research catalog. They ar
 
 Consumers using pnpm 10 must review a pnpm upgrade before relying on the pruning requirement. A pnpm 11 migration must preserve explicitly allowed dependency builds when converting `onlyBuiltDependencies` to `allowBuilds`; it must not broaden build permissions. Do not disable release-age/trust checks or add broad trust exclusions to get an installation through. A lint pass alone does not prove that the pinned package manager implements every setting.
 
-## Current dependency integration blocker
+## Existing exact semver trust exception
 
 On 2026-10-02, enabling `no-downgrade` on the selected package graph rejected `semver@6.3.1`. Both 0.1.0 and the 0.1.1 framework patch depend on stable `eslint-plugin-react-hooks@7.1.1`, which requires `@babel/core:^7.24.4`. Resolved Babel core 7.29.7 and its compilation-target helper require `semver:^6.3.1`. Registry inspection found 27 eligible stable Babel 7 versions, all requiring that same semver range; 6.3.1 remains the latest 6.x version.
 
 Semver 6.3.1 was published on 2023-07-10 without provenance, after provenance-bearing 7.5.4 on 2023-07-07. This meets pnpm's publication-date policy even though the major versions differ; the age exception for this ESLint package does not fix it. A policy failure is not proof of a compromised release, but it remains an installation blocker.
 
-Babel 8 is outside the Hooks plugin's supported dependency range. Forcing Babel 8 or semver 7 through a cross-major override is not a supported package upgrade. A coherent upstream remedy is a compatible Babel 7 release using an accepted semver dependency, or stable React Hooks support for Babel 8, followed by a tested ESLint package release. No trust exclusion or policy weakening is included in this patch.
+Babel 8 is outside the Hooks plugin's supported dependency range. Forcing Babel 8 or semver 7 through a cross-major override is not a supported package upgrade. The user-approved integration retains only `semver@6.3.1` as an exact trust exception. A coherent upstream remedy is a compatible Babel 7 release using an accepted semver dependency, or stable React Hooks support for Babel 8, followed by a tested ESLint package release. The `@ztd-me/*` age selector does not expand that trust exception.

package/docs/publishing.md

@@ -2,7 +2,7 @@
 
 `.github/workflows/publish-eslint.yml` verifies and stages `@ztd-me/eslint`. Every upload uses `pnpm stage publish`; the workflow never directly publishes or approves a stage. `NPM_TOKEN` has Read and write (stage only) rights, with Bypass 2FA disabled. The token is bound to `https://registry.npmjs.org` in the stage step only, kept in memory, and never printed. Installation/build/test/pack steps have no token.
 
-The only trigger is a push to `main` affecting `packages/eslint-config/**` or `.github/workflows/publish-eslint.yml`. There is no manual trigger, temporary release branch, or authentication selector. Package versions are independent of the Go CLI's `v*` tags: review and merge an ESLint package version bump to request a release. Source changes without a version bump still run verification, but the existing version is skipped.
+The only trigger is a push to `main` affecting `packages/eslint-config/**`, `.github/workflows/publish-eslint.yml` or the shared `scripts/npm-staging.mjs` guard. There is no manual trigger, temporary release branch, or authentication selector. Package versions are independent of the Go CLI's `v*` tags: review and merge an ESLint package version bump to request a release. Source changes without a version bump still run verification, but the existing version is skipped.
 
 The verification jobs use a frozen pnpm lockfile on Node 22 and 24. The Node 24 job packs the tested package. A single staging job consumes that exact artifact and saves the npm stage response as a workflow artifact. Runs share one concurrency group without cancellation. Before upload, the script checks public registry metadata and the authenticated pending-stage list. Published or already-staged versions produce a skip receipt, preserving an existing stage ID. Registry/authentication errors and malformed responses fail before upload. The Actions run, source SHA, tarball checksum and stage ID are review evidence. Do not resubmit after an ambiguous timeout; inspect the existing stage before retrying.
 
@@ -38,4 +38,4 @@ After promotion, inspect the exact public registry version, then run:
 node scripts/registry-smoke.mjs <promoted-version>
 ```
 
-This creates a fresh consumer, installs the exact registry version using pnpm, checks default/named ESM exports and declarations, and runs JS/TS/framework smoke checks. The temporary store/cache settings are inherited by pnpm's pre-run install checks, including in cloud sandboxes without a writable home directory. Supply-chain settings are left unchanged. pnpm 11's default non-strict release-age policy can automatically record a version-specific exception for a fresh explicit dependency; projects with strict release-age policies must wait until their cutoff. If an active policy rejects installation, wait for eligibility and retry; do not manually set exceptions or lower the policy. A stage response, registry metadata alone, or a local tarball install is insufficient proof of public installation.
+This creates a fresh consumer, installs the exact registry version using pnpm 11.22.0, checks default/named ESM exports and declarations, and runs JS/TS/framework smoke checks. The temporary store/cache settings are inherited by pnpm's pre-run install checks, including in cloud sandboxes without a writable home directory. The user-authorized age selector is `@ztd-me/*`; other packages keep a strict 1440-minute age gate. No-downgrade and the existing exact `semver@6.3.1` trust exception remain active, with no scope trust exclusion. A stage response, registry metadata alone, or a local tarball install is insufficient proof of public installation.

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@ztd-me/eslint",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "description": "Strict typed ESLint flat configs for TypeScript, React and Vue, built on antfu",
-  "license": "UNLICENSED",
+  "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/zeithrold/tools.git",
@@ -21,7 +21,8 @@
   "files": [
     "dist",
     "docs",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "publishConfig": {
     "access": "public",