create-newt-app 0.27.0 → 0.30.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (25) hide show
  1. package/dist/index.d.ts +5 -1
  2. package/dist/index.d.ts.map +1 -1
  3. package/dist/index.js +332 -128
  4. package/dist/index.js.map +1 -1
  5. package/dist/static/anti-slop/static/LICENSE +21 -0
  6. package/dist/static/anti-slop/static/index.ts +41 -0
  7. package/dist/static/anti-slop/static/rules/no-chained-type-assertions.ts +77 -0
  8. package/dist/static/anti-slop/static/rules/no-conditional-empty-object-spread.ts +49 -0
  9. package/dist/static/anti-slop/static/rules/no-known-value-widening.ts +247 -0
  10. package/dist/static/anti-slop/static/rules/no-module-mocking.ts +91 -0
  11. package/dist/static/anti-slop/static/rules/no-object-parameters.ts +126 -0
  12. package/dist/static/anti-slop/static/rules/no-reflect-apply.ts +28 -0
  13. package/dist/static/anti-slop/static/rules/no-reflect-get.ts +28 -0
  14. package/dist/static/anti-slop/static/rules/no-runtime-typeof.ts +67 -0
  15. package/dist/static/anti-slop/static/rules/no-shape-in-symbol-names.ts +39 -0
  16. package/dist/static/anti-slop/static/rules/no-unknown-parameters.ts +83 -0
  17. package/dist/static/anti-slop/static/rules/no-unknown-returns.ts +115 -0
  18. package/dist/static/anti-slop/static/rules/no-unknown-type-aliases.ts +70 -0
  19. package/dist/static/anti-slop/static/rules/no-unsafe-dictionary-type.ts +134 -0
  20. package/dist/static/anti-slop/static/rules/no-widen-then-assert.ts +366 -0
  21. package/dist/static/anti-slop/static/rules/require-safety-comment-for-type-assertion.ts +62 -0
  22. package/dist/static/anti-slop/static/shared/dictionary-types.ts +502 -0
  23. package/dist/static/anti-slop/static/shared/lexical-type-parameters.ts +61 -0
  24. package/dist/static/anti-slop/static/shared/reflect-method.ts +35 -0
  25. package/package.json +2 -1
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Dillon Mulroy
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
@@ -0,0 +1,41 @@
1
+ import { eslintCompatPlugin } from "@oxlint/plugins";
2
+
3
+ import { noChainedTypeAssertionsRule } from "./rules/no-chained-type-assertions.ts";
4
+ import { noConditionalEmptyObjectSpreadRule } from "./rules/no-conditional-empty-object-spread.ts";
5
+ import { noKnownValueWideningRule } from "./rules/no-known-value-widening.ts";
6
+ import { noModuleMockingRule } from "./rules/no-module-mocking.ts";
7
+ import { noObjectParametersRule } from "./rules/no-object-parameters.ts";
8
+ import { noReflectApplyRule } from "./rules/no-reflect-apply.ts";
9
+ import { noReflectGetRule } from "./rules/no-reflect-get.ts";
10
+ import { noRuntimeTypeofRule } from "./rules/no-runtime-typeof.ts";
11
+ import { noForbiddenTermInSymbolNamesRule } from "./rules/no-shape-in-symbol-names.ts";
12
+ import { noUnknownParametersRule } from "./rules/no-unknown-parameters.ts";
13
+ import { noUnknownReturnsRule } from "./rules/no-unknown-returns.ts";
14
+ import { noUnknownTypeAliasesRule } from "./rules/no-unknown-type-aliases.ts";
15
+ import { noUnsafeDictionaryTypeRule } from "./rules/no-unsafe-dictionary-type.ts";
16
+ import { noWidenThenAssertRule } from "./rules/no-widen-then-assert.ts";
17
+ import { requireSafetyCommentForTypeAssertionRule } from "./rules/require-safety-comment-for-type-assertion.ts";
18
+
19
+ /** Generic Oxlint rules that reject low-evidence and low-signal implementation patterns. */
20
+ const antiSlopPlugin = eslintCompatPlugin({
21
+ meta: { name: "anti-slop" },
22
+ rules: {
23
+ "no-chained-type-assertions": noChainedTypeAssertionsRule,
24
+ "no-conditional-empty-object-spread": noConditionalEmptyObjectSpreadRule,
25
+ "no-known-value-widening": noKnownValueWideningRule,
26
+ "no-module-mocking": noModuleMockingRule,
27
+ "no-object-parameters": noObjectParametersRule,
28
+ "no-reflect-apply": noReflectApplyRule,
29
+ "no-reflect-get": noReflectGetRule,
30
+ "no-runtime-typeof": noRuntimeTypeofRule,
31
+ "no-unsafe-dictionary-type": noUnsafeDictionaryTypeRule,
32
+ "no-shape-in-symbol-names": noForbiddenTermInSymbolNamesRule,
33
+ "no-unknown-parameters": noUnknownParametersRule,
34
+ "no-unknown-returns": noUnknownReturnsRule,
35
+ "no-unknown-type-aliases": noUnknownTypeAliasesRule,
36
+ "no-widen-then-assert": noWidenThenAssertRule,
37
+ "require-safety-comment-for-type-assertion": requireSafetyCommentForTypeAssertionRule,
38
+ },
39
+ });
40
+
41
+ export default antiSlopPlugin;
@@ -0,0 +1,77 @@
1
+ import { defineRule } from "@oxlint/plugins";
2
+ import type { ESTree } from "@oxlint/plugins";
3
+
4
+ type TypeAssertionExpression = ESTree.TSAsExpression | ESTree.TSTypeAssertion;
5
+
6
+ function isTypeAssertionExpression(node: ESTree.Node): node is TypeAssertionExpression {
7
+ return node.type === "TSAsExpression" || node.type === "TSTypeAssertion";
8
+ }
9
+
10
+ function unwrapParenthesizedExpression(expression: ESTree.Expression): ESTree.Expression {
11
+ let current = expression;
12
+ while (current.type === "ParenthesizedExpression") {
13
+ current = current.expression;
14
+ }
15
+ return current;
16
+ }
17
+
18
+ function isConstAssertion(node: TypeAssertionExpression): boolean {
19
+ const { typeAnnotation } = node;
20
+ return (
21
+ typeAnnotation.type === "TSTypeReference" &&
22
+ typeAnnotation.typeName.type === "Identifier" &&
23
+ typeAnnotation.typeName.name === "const"
24
+ );
25
+ }
26
+
27
+ function isOutermostAssertionInChain(node: TypeAssertionExpression): boolean {
28
+ let current: ESTree.Expression = node;
29
+ let parent = node.parent;
30
+
31
+ while (parent.type === "ParenthesizedExpression" && parent.expression === current) {
32
+ current = parent;
33
+ parent = parent.parent;
34
+ }
35
+
36
+ return !isTypeAssertionExpression(parent) || parent.expression !== current;
37
+ }
38
+
39
+ function isForbiddenAssertionChain(node: TypeAssertionExpression): boolean {
40
+ let assertionCount = 0;
41
+ let hasNonConstAssertion = false;
42
+ let current: ESTree.Expression = node;
43
+
44
+ while (isTypeAssertionExpression(current)) {
45
+ assertionCount += 1;
46
+ hasNonConstAssertion ||= !isConstAssertion(current);
47
+ current = unwrapParenthesizedExpression(current.expression);
48
+ }
49
+
50
+ return assertionCount > 1 && hasNonConstAssertion;
51
+ }
52
+
53
+ /** Disallow nested TypeScript type assertions, while permitting chains made only of const assertions. */
54
+ export const noChainedTypeAssertionsRule = defineRule({
55
+ meta: {
56
+ type: "problem",
57
+ docs: {
58
+ description:
59
+ "Disallow chained TypeScript as and angle-bracket assertions, including parenthesized chains.",
60
+ },
61
+ messages: {
62
+ chained:
63
+ "This assertion chain discards type evidence. Keep the original precise type, or parse untrusted input at its boundary before narrowing it.",
64
+ },
65
+ },
66
+ createOnce(context) {
67
+ const checkTypeAssertion = (node: TypeAssertionExpression) => {
68
+ if (!isOutermostAssertionInChain(node) || !isForbiddenAssertionChain(node)) return;
69
+ context.report({ node, messageId: "chained" });
70
+ };
71
+
72
+ return {
73
+ TSAsExpression: checkTypeAssertion,
74
+ TSTypeAssertion: checkTypeAssertion,
75
+ };
76
+ },
77
+ });
@@ -0,0 +1,49 @@
1
+ import { defineRule } from "@oxlint/plugins";
2
+ import type { ESTree } from "@oxlint/plugins";
3
+
4
+ function unwrapParentheses(node: ESTree.Expression): ESTree.Expression {
5
+ let current = node;
6
+ while (current.type === "ParenthesizedExpression") {
7
+ current = current.expression;
8
+ }
9
+ return current;
10
+ }
11
+
12
+ function isEmptyObjectExpression(node: ESTree.Expression): boolean {
13
+ return node.type === "ObjectExpression" && node.properties.length === 0;
14
+ }
15
+
16
+ function isConditionalEmptyObjectSpread(node: ESTree.Expression): boolean {
17
+ const conditional = unwrapParentheses(node);
18
+ return (
19
+ conditional.type === "ConditionalExpression" &&
20
+ (isEmptyObjectExpression(conditional.consequent) ||
21
+ isEmptyObjectExpression(conditional.alternate))
22
+ );
23
+ }
24
+
25
+ /** Ban conditional empty-object spreads without changing their omission semantics. */
26
+ export const noConditionalEmptyObjectSpreadRule = defineRule({
27
+ meta: {
28
+ type: "suggestion",
29
+ docs: {
30
+ description:
31
+ "Disallow object spreads that conditionally spread an empty object to omit fields.",
32
+ },
33
+ messages: {
34
+ avoid:
35
+ "This conditional spread hides property omission behind an empty object. Build the object in separate statements and add the property only when present.",
36
+ },
37
+ },
38
+ createOnce(context) {
39
+ return {
40
+ SpreadElement(node) {
41
+ if (node.parent.type !== "ObjectExpression") return;
42
+
43
+ if (isConditionalEmptyObjectSpread(node.argument)) {
44
+ context.report({ node, messageId: "avoid" });
45
+ }
46
+ },
47
+ };
48
+ },
49
+ });
@@ -0,0 +1,247 @@
1
+ import { defineRule } from "@oxlint/plugins";
2
+
3
+ import {
4
+ classifyWideningTarget,
5
+ createTypeEnvironment,
6
+ isKnownEvidenceExpression,
7
+ type TypeEnvironment,
8
+ type WideningTarget,
9
+ } from "../shared/dictionary-types.ts";
10
+
11
+ import type { ESTree, Scope, SourceCode, Variable } from "@oxlint/plugins";
12
+
13
+ type FunctionExpression = ESTree.ArrowFunctionExpression | ESTree.Function;
14
+
15
+ function unwrapExpression(expression: ESTree.Expression): ESTree.Expression {
16
+ let current = expression;
17
+ while (
18
+ current.type === "ParenthesizedExpression" ||
19
+ current.type === "TSAsExpression" ||
20
+ current.type === "TSSatisfiesExpression" ||
21
+ current.type === "TSTypeAssertion" ||
22
+ current.type === "TSNonNullExpression"
23
+ ) {
24
+ current = current.expression;
25
+ }
26
+ return current;
27
+ }
28
+
29
+ function resolveVariable(
30
+ sourceCode: SourceCode,
31
+ identifier: ESTree.IdentifierReference,
32
+ ): Variable | null {
33
+ let scope: Scope | null = sourceCode.getScope(identifier);
34
+ while (scope !== null) {
35
+ const variable = scope.set.get(identifier.name);
36
+ if (variable !== undefined) return variable;
37
+ scope = scope.upper;
38
+ }
39
+ return null;
40
+ }
41
+
42
+ function variableDeclarator(variable: Variable): ESTree.VariableDeclarator | null {
43
+ if (variable.defs.length !== 1) return null;
44
+ const [definition] = variable.defs;
45
+ return definition?.type === "Variable" && definition.node.type === "VariableDeclarator"
46
+ ? definition.node
47
+ : null;
48
+ }
49
+
50
+ function isStableConstVariable(variable: Variable, declarator: ESTree.VariableDeclarator): boolean {
51
+ return (
52
+ declarator.parent.type === "VariableDeclaration" &&
53
+ declarator.parent.kind === "const" &&
54
+ variable.references.every((reference) => reference.init || !reference.isWrite())
55
+ );
56
+ }
57
+
58
+ function hasKnownEvidence(
59
+ sourceCode: SourceCode,
60
+ expression: ESTree.Expression,
61
+ visitedVariables = new Set<Variable>(),
62
+ ): boolean {
63
+ if (isKnownEvidenceExpression(expression)) return true;
64
+ const unwrapped = unwrapExpression(expression);
65
+ if (unwrapped.type !== "Identifier") return false;
66
+ const variable = resolveVariable(sourceCode, unwrapped);
67
+ if (variable === null || visitedVariables.has(variable)) return false;
68
+ const declarator = variableDeclarator(variable);
69
+ if (
70
+ declarator === null ||
71
+ declarator.init === null ||
72
+ !isStableConstVariable(variable, declarator)
73
+ ) {
74
+ return false;
75
+ }
76
+ visitedVariables.add(variable);
77
+ return hasKnownEvidence(sourceCode, declarator.init, visitedVariables);
78
+ }
79
+
80
+ function annotationTarget(
81
+ annotation: ESTree.TSTypeAnnotation | null | undefined,
82
+ environment: TypeEnvironment,
83
+ ): WideningTarget | null {
84
+ return annotation === null || annotation === undefined
85
+ ? null
86
+ : classifyWideningTarget(annotation.typeAnnotation, environment);
87
+ }
88
+
89
+ function enclosingFunction(node: ESTree.Node): FunctionExpression | null {
90
+ let current: ESTree.Node | null = node.parent;
91
+ while (current !== null && current.type !== "Program") {
92
+ if (
93
+ current.type === "ArrowFunctionExpression" ||
94
+ current.type === "FunctionDeclaration" ||
95
+ current.type === "FunctionExpression"
96
+ ) {
97
+ return current;
98
+ }
99
+ current = current.parent;
100
+ }
101
+ return null;
102
+ }
103
+
104
+ function sourceKeyName(sourceCode: SourceCode, key: ESTree.PropertyKey): string {
105
+ if (key.type === "Identifier" || key.type === "PrivateIdentifier") return key.name;
106
+ if (key.type === "Literal") return String(key.value);
107
+ return sourceCode.getText(key);
108
+ }
109
+
110
+ function functionName(sourceCode: SourceCode, owner: FunctionExpression | null): string {
111
+ if (owner === null) return "anonymous function";
112
+ if (owner.id !== null) return owner.id.name;
113
+ const parent = owner.parent;
114
+ if (parent.type === "VariableDeclarator" && parent.id.type === "Identifier")
115
+ return parent.id.name;
116
+ if (parent.type === "MethodDefinition") return sourceKeyName(sourceCode, parent.key);
117
+ return "anonymous function";
118
+ }
119
+
120
+ function isEmptyObjectExpression(expression: ESTree.Expression): boolean {
121
+ const unwrapped = unwrapExpression(expression);
122
+ return unwrapped.type === "ObjectExpression" && unwrapped.properties.length === 0;
123
+ }
124
+
125
+ function isDictionaryAccumulatorTarget(destination: WideningTarget): boolean {
126
+ return destination.kind === "open dictionary" || destination.kind === "generic container";
127
+ }
128
+
129
+ function hasParentAssertion(node: ESTree.Node): boolean {
130
+ return node.parent?.type === "TSAsExpression" || node.parent?.type === "TSTypeAssertion";
131
+ }
132
+
133
+ /** Detect sound syntactic cases where a known value is explicitly widened and loses evidence. */
134
+ export const noKnownValueWideningRule = defineRule({
135
+ meta: {
136
+ type: "problem",
137
+ docs: {
138
+ description:
139
+ "Disallow syntactically established values from flowing into explicitly broad or anonymous target types that discard useful evidence.",
140
+ },
141
+ messages: {
142
+ widening:
143
+ "The explicit {{target}} type on {{subject}} discards known type evidence. Keep inference, validate with `satisfies`, or use a named owner contract.",
144
+ },
145
+ },
146
+ createOnce(context) {
147
+ let environment: TypeEnvironment | null = null;
148
+
149
+ const reportFlow = (
150
+ expression: ESTree.Expression,
151
+ destination: WideningTarget | null,
152
+ subject: string,
153
+ ) => {
154
+ if (destination === null) return;
155
+ if (
156
+ isDictionaryAccumulatorTarget(destination) &&
157
+ isEmptyObjectExpression(expression)
158
+ ) {
159
+ return;
160
+ }
161
+ if (!hasKnownEvidence(context.sourceCode, expression)) return;
162
+ context.report({
163
+ node: expression,
164
+ messageId: "widening",
165
+ data: { subject, target: destination.kind },
166
+ });
167
+ };
168
+
169
+ const targetFromAnnotation = (annotation: ESTree.TSTypeAnnotation | null | undefined) =>
170
+ environment === null ? null : annotationTarget(annotation, environment);
171
+
172
+ return {
173
+ Program(node) {
174
+ environment = createTypeEnvironment(node);
175
+ },
176
+ VariableDeclarator(node) {
177
+ if (node.init === null || node.id.type !== "Identifier") return;
178
+ reportFlow(
179
+ node.init,
180
+ targetFromAnnotation(node.id.typeAnnotation),
181
+ `binding \`${node.id.name}\``,
182
+ );
183
+ },
184
+ PropertyDefinition(node) {
185
+ if (node.value === null) return;
186
+ reportFlow(
187
+ node.value,
188
+ targetFromAnnotation(node.typeAnnotation),
189
+ `property \`${sourceKeyName(context.sourceCode, node.key)}\``,
190
+ );
191
+ },
192
+ AccessorProperty(node) {
193
+ if (node.value === null) return;
194
+ reportFlow(
195
+ node.value,
196
+ targetFromAnnotation(node.typeAnnotation),
197
+ `property \`${sourceKeyName(context.sourceCode, node.key)}\``,
198
+ );
199
+ },
200
+ AssignmentExpression(node) {
201
+ if (node.operator !== "=" || node.left.type !== "Identifier") return;
202
+ const variable = resolveVariable(context.sourceCode, node.left);
203
+ if (variable === null) return;
204
+ const declarator = variableDeclarator(variable);
205
+ if (declarator === null || declarator.id.type !== "Identifier") return;
206
+ reportFlow(
207
+ node.right,
208
+ targetFromAnnotation(declarator.id.typeAnnotation),
209
+ `binding \`${declarator.id.name}\``,
210
+ );
211
+ },
212
+ ReturnStatement(node) {
213
+ if (node.argument === null) return;
214
+ const owner = enclosingFunction(node);
215
+ reportFlow(
216
+ node.argument,
217
+ targetFromAnnotation(owner?.returnType),
218
+ `return value of \`${functionName(context.sourceCode, owner)}\``,
219
+ );
220
+ },
221
+ ArrowFunctionExpression(node) {
222
+ if (node.body.type === "BlockStatement") return;
223
+ reportFlow(
224
+ node.body,
225
+ targetFromAnnotation(node.returnType),
226
+ `return value of \`${functionName(context.sourceCode, node)}\``,
227
+ );
228
+ },
229
+ TSAsExpression(node) {
230
+ if (environment === null || hasParentAssertion(node)) return;
231
+ reportFlow(
232
+ node.expression,
233
+ classifyWideningTarget(node.typeAnnotation, environment),
234
+ "assertion",
235
+ );
236
+ },
237
+ TSTypeAssertion(node) {
238
+ if (environment === null || hasParentAssertion(node)) return;
239
+ reportFlow(
240
+ node.expression,
241
+ classifyWideningTarget(node.typeAnnotation, environment),
242
+ "assertion",
243
+ );
244
+ },
245
+ };
246
+ },
247
+ });
@@ -0,0 +1,91 @@
1
+ import { defineRule } from "@oxlint/plugins";
2
+
3
+ import type { ESTree, Scope, SourceCode, Variable } from "@oxlint/plugins";
4
+
5
+ const moduleMockMethods = new Set(["doMock", "mock", "unstable_mockModule"]);
6
+
7
+ function resolveVariable(
8
+ sourceCode: SourceCode,
9
+ identifier: ESTree.IdentifierReference,
10
+ ): Variable | null {
11
+ let scope: Scope | null = sourceCode.getScope(identifier);
12
+ while (scope !== null) {
13
+ const variable = scope.set.get(identifier.name);
14
+ if (variable !== undefined) return variable;
15
+ scope = scope.upper;
16
+ }
17
+ return null;
18
+ }
19
+
20
+ function importedName(node: ESTree.Node): string | null {
21
+ if (node.type !== "ImportSpecifier") return null;
22
+ return node.imported.type === "Identifier" ? node.imported.name : node.imported.value;
23
+ }
24
+
25
+ function isTestFrameworkObject(
26
+ sourceCode: SourceCode,
27
+ expression: ESTree.Expression,
28
+ ): expression is ESTree.IdentifierReference {
29
+ if (expression.type !== "Identifier") return false;
30
+ if (
31
+ (expression.name === "vi" || expression.name === "jest") &&
32
+ sourceCode.isGlobalReference(expression)
33
+ ) {
34
+ return true;
35
+ }
36
+
37
+ const variable = resolveVariable(sourceCode, expression);
38
+ if (variable === null || variable.defs.length === 0) {
39
+ return expression.name === "vi" || expression.name === "jest";
40
+ }
41
+ return variable.defs.some((definition) => {
42
+ if (definition.type !== "ImportBinding" || definition.parent?.type !== "ImportDeclaration") {
43
+ return false;
44
+ }
45
+ const source = definition.parent.source.value;
46
+ const name = importedName(definition.node);
47
+ return (source === "vitest" && name === "vi") || (source === "@jest/globals" && name === "jest");
48
+ });
49
+ }
50
+
51
+ function moduleMockCall(sourceCode: SourceCode, callee: ESTree.Expression): boolean {
52
+ if (!("property" in callee) || !("object" in callee) || !("computed" in callee)) return false;
53
+ if (!isTestFrameworkObject(sourceCode, callee.object)) return false;
54
+ const property = callee.property;
55
+ const method = callee.computed
56
+ ? property.type === "Literal" &&
57
+ (property.value === "doMock" ||
58
+ property.value === "mock" ||
59
+ property.value === "unstable_mockModule")
60
+ ? property.value
61
+ : null
62
+ : property.type === "Identifier"
63
+ ? property.name
64
+ : null;
65
+ return method !== null && moduleMockMethods.has(method);
66
+ }
67
+
68
+ /** Ban test framework module mocking in favor of real dependency seams. */
69
+ export const noModuleMockingRule = defineRule({
70
+ meta: {
71
+ type: "problem",
72
+ docs: {
73
+ description:
74
+ "Disallow Vitest and Jest module mocking; tests must replace dependencies through real interfaces.",
75
+ },
76
+ messages: {
77
+ moduleMock:
78
+ "Replace module mocking with dependency injection through a real interface, service layer, or faithful test implementation.",
79
+ },
80
+ },
81
+ createOnce(context) {
82
+ return {
83
+ CallExpression(node) {
84
+ if (node.callee.type === "Super" || node.callee.type === "V8IntrinsicExpression") return;
85
+ if (moduleMockCall(context.sourceCode, node.callee)) {
86
+ context.report({ node, messageId: "moduleMock" });
87
+ }
88
+ },
89
+ };
90
+ },
91
+ });
@@ -0,0 +1,126 @@
1
+ import { defineRule } from "@oxlint/plugins";
2
+
3
+ import type { ESTree, SourceCode } from "@oxlint/plugins";
4
+
5
+ import { lexicalTypeParameterNames } from "../shared/lexical-type-parameters.ts";
6
+
7
+ type Parameter = ESTree.ParamPattern;
8
+ type ParameterOwner =
9
+ | ESTree.ArrowFunctionExpression
10
+ | ESTree.Function
11
+ | ESTree.TSCallSignatureDeclaration
12
+ | ESTree.TSConstructSignatureDeclaration
13
+ | ESTree.TSConstructorType
14
+ | ESTree.TSFunctionType
15
+ | ESTree.TSMethodSignature;
16
+
17
+ function parameterAnnotation(parameter: Parameter): ESTree.TSTypeAnnotation | null | undefined {
18
+ if (parameter.type === "TSParameterProperty") {
19
+ return parameterAnnotation(parameter.parameter);
20
+ }
21
+ if (parameter.type === "RestElement") {
22
+ return parameter.typeAnnotation ?? parameterAnnotation(parameter.argument);
23
+ }
24
+ if (parameter.type === "AssignmentPattern") {
25
+ return parameter.typeAnnotation ?? parameter.left.typeAnnotation;
26
+ }
27
+ return parameter.typeAnnotation;
28
+ }
29
+
30
+ function parameterName(parameter: Parameter, sourceCode: SourceCode): string {
31
+ return parameter.type === "Identifier"
32
+ ? parameter.name
33
+ : sourceCode.getText(parameter).replace(/\s*:\s*object\s*$/u, "");
34
+ }
35
+
36
+ /** Ban the broad object type on function inputs, including local aliases to object. */
37
+ export const noObjectParametersRule = defineRule({
38
+ meta: {
39
+ type: "problem",
40
+ docs: {
41
+ description:
42
+ "Disallow object function parameters; inputs must use an owner-provided type and be parsed at their boundary.",
43
+ },
44
+ messages: {
45
+ objectParameter:
46
+ "Parameter `{{parameter}}` uses the broad `object` type. Accept a named owner type; parse external input at its boundary before calling this function.",
47
+ },
48
+ },
49
+ createOnce(context) {
50
+ const aliases = new Map<string, ESTree.TSType>();
51
+
52
+ const resolvesToObject = (
53
+ type: ESTree.TSType,
54
+ shadowedAliases: ReadonlySet<string>,
55
+ visited = new Set<string>(),
56
+ ): boolean => {
57
+ if (type.type === "TSObjectKeyword") return true;
58
+ if (type.type === "TSParenthesizedType")
59
+ return resolvesToObject(type.typeAnnotation, shadowedAliases, visited);
60
+ if (type.type === "TSUnionType") {
61
+ return type.types.some((member) =>
62
+ resolvesToObject(member, shadowedAliases, visited),
63
+ );
64
+ }
65
+ if (
66
+ type.type !== "TSTypeReference" ||
67
+ type.typeName.type !== "Identifier" ||
68
+ (type.typeArguments !== null &&
69
+ type.typeArguments !== undefined &&
70
+ type.typeArguments.params.length > 0) ||
71
+ visited.has(type.typeName.name) ||
72
+ shadowedAliases.has(type.typeName.name)
73
+ ) {
74
+ return false;
75
+ }
76
+ const alias = aliases.get(type.typeName.name);
77
+ if (alias === undefined) return false;
78
+ const nextVisited = new Set(visited);
79
+ nextVisited.add(type.typeName.name);
80
+ return resolvesToObject(alias, shadowedAliases, nextVisited);
81
+ };
82
+
83
+ const checkParameters = (node: ParameterOwner) => {
84
+ const shadowedAliases = lexicalTypeParameterNames(
85
+ node,
86
+ context.sourceCode.visitorKeys,
87
+ );
88
+ for (const parameter of node.params) {
89
+ const annotation = parameterAnnotation(parameter);
90
+ if (annotation === null || annotation === undefined) continue;
91
+ if (!resolvesToObject(annotation.typeAnnotation, shadowedAliases)) continue;
92
+ context.report({
93
+ node: annotation.typeAnnotation,
94
+ messageId: "objectParameter",
95
+ data: { parameter: parameterName(parameter, context.sourceCode) },
96
+ });
97
+ }
98
+ };
99
+
100
+ return {
101
+ Program(node) {
102
+ aliases.clear();
103
+ for (const statement of node.body) {
104
+ const declaration =
105
+ statement.type === "ExportNamedDeclaration" ? statement.declaration : statement;
106
+ if (
107
+ declaration?.type === "TSTypeAliasDeclaration" &&
108
+ (declaration.typeParameters === null || declaration.typeParameters === undefined)
109
+ ) {
110
+ aliases.set(declaration.id.name, declaration.typeAnnotation);
111
+ }
112
+ }
113
+ },
114
+ ArrowFunctionExpression: checkParameters,
115
+ FunctionDeclaration: checkParameters,
116
+ FunctionExpression: checkParameters,
117
+ TSCallSignatureDeclaration: checkParameters,
118
+ TSConstructSignatureDeclaration: checkParameters,
119
+ TSConstructorType: checkParameters,
120
+ TSDeclareFunction: checkParameters,
121
+ TSEmptyBodyFunctionExpression: checkParameters,
122
+ TSFunctionType: checkParameters,
123
+ TSMethodSignature: checkParameters,
124
+ };
125
+ },
126
+ });
@@ -0,0 +1,28 @@
1
+ import { defineRule } from "@oxlint/plugins";
2
+
3
+ import { isGlobalReflectMethodCall } from "../shared/reflect-method.ts";
4
+
5
+ /** Ban Reflect.apply, which bypasses ordinary typed function calls. */
6
+ export const noReflectApplyRule = defineRule({
7
+ meta: {
8
+ type: "problem",
9
+ docs: {
10
+ description:
11
+ "Disallow Reflect.apply; call typed functions directly or model dynamic dispatch behind an interface.",
12
+ },
13
+ messages: {
14
+ reflectApply:
15
+ "Replace `Reflect.apply` with a typed function call. Model dynamic dispatch behind a named interface.",
16
+ },
17
+ },
18
+ createOnce(context) {
19
+ return {
20
+ CallExpression(node) {
21
+ if (node.callee.type === "Super" || node.callee.type === "V8IntrinsicExpression") return;
22
+ if (isGlobalReflectMethodCall(context.sourceCode, node.callee, "apply")) {
23
+ context.report({ node, messageId: "reflectApply" });
24
+ }
25
+ },
26
+ };
27
+ },
28
+ });