eslint-plugin-greasemonkey 1.8.4 → 1.10.0

package/src/rules/require-matching-localized-fields.js

@@ -1,4 +1,4 @@
-import { extractMetadata } from '../utils.js'
+import metadata from '../utils/metadata.js'
 
 export default {
     meta: {
@@ -31,7 +31,7 @@ export default {
               ignoreLangs = new Set(Array.isArray(rawLangs) ? rawLangs : [rawLangs])
         return {
             Program() {
-                const metaEntries = extractMetadata(context.sourceCode),
+                const metaEntries = metadata.extract(context.sourceCode),
                       nameEntries = metaEntries.filter(entry => entry.key.startsWith('name:')),
                       descEntries = metaEntries.filter(entry => entry.key.startsWith('description:')),
                       nameLangs = new Set(nameEntries.map(entry => entry.key.split(':')[1])),

package/src/rules/require-required-fields.js

@@ -1,4 +1,4 @@
-import { extractMetadata } from '../utils.js'
+import metadata from '../utils/metadata.js'
 
 export default {
     meta: {
@@ -33,7 +33,7 @@ export default {
               requireMatchOrInclude = options.requireMatchOrInclude ?? true
         return {
             Program(node) {
-                const metaEntries = extractMetadata(context.sourceCode),
+                const metaEntries = metadata.extract(context.sourceCode),
                       keys = new Set(metaEntries.map(entry => entry.key))
                 for (const field of requiredFields)
                     if (!keys.has(field))

package/src/rules/require-space-before-meta-key.js

@@ -1,6 +1,5 @@
-import { extractMetadata } from '../utils.js'
-
-const re = { leadingWhitespace: /^\s*/ }
+import metadata from '../utils/metadata.js'
+import regex from '../data/regex.js'
 
 export default {
     meta: {
@@ -19,12 +18,12 @@ export default {
         return {
             Program() {
                 const sourceCode = context.sourceCode,
-                      metaEntries = extractMetadata(sourceCode)
+                      metaEntries = metadata.extract(sourceCode)
                 for (const entry of metaEntries) {
                     const commentText = sourceCode.getText(entry.comment),
                           afterSlashes = commentText.slice(2)
                     if (afterSlashes.startsWith(' @')) continue
-                    const rest = afterSlashes.replace(re.leadingWhitespace, ''),
+                    const rest = afterSlashes.replace(regex.whitespace.leading, ''),
                           keyIdx = commentText.indexOf(`@${entry.key}`),
                           actual = commentText.slice(0, keyIdx +1 + entry.key.length),
                           fixedText = `// ${rest}`

package/src/rules/require-sri-hashing.js

@@ -1,4 +1,4 @@
-import { extractMetadata } from '../utils.js'
+import metadata from '../utils/metadata.js'
 
 const re = {
     hashEntry: /^(sha1|sha256|sha384|sha512|md5)[=-]([a-z0-9+/]+={0,2})$/i, hashFragment: /#([^#]+)$/, hashSep: /[,;]/ }
@@ -9,7 +9,7 @@ export default {
         docs: {
             description: 'Require SRI hashes on @require and @resource URLs',
             category: 'Possible Errors',
-            recommended: false
+            security: true
         },
         schema: [{
             type: 'object',
@@ -42,7 +42,7 @@ export default {
               expected = algorithms.join(' or ')
         return {
             'Program:exit'() {
-                for (const entry of extractMetadata(context.sourceCode)) {
+                for (const entry of metadata.extract(context.sourceCode)) {
                     if (entry.key != 'require' && entry.key != 'resource') continue
                     const fragment = entry.value.trim().match(re.hashFragment)?.[1]
                     if (!fragment) {

package/src/rules/require-update-download-pair.js

@@ -1,12 +1,11 @@
-import { extractMetadata } from '../utils.js'
+import metadata from '../utils/metadata.js'
 
 export default {
     meta: {
         type: 'problem',
         docs: {
             description: 'Require @updateURL and @downloadURL to be used together',
-            category: 'Best Practices',
-            recommended: false
+            category: 'Best Practices'
         },
         schema: [],
         messages: { missingPair: 'Missing @{{missing}} (required when @{{present}} is used).' }
@@ -15,7 +14,7 @@ export default {
     create(context) {
         return {
             Program() {
-                const metaEntries = extractMetadata(context.sourceCode),
+                const metaEntries = metadata.extract(context.sourceCode),
                       updateEntry = metaEntries.find(entry => entry.key == 'updateURL'),
                       downloadEntry = metaEntries.find(entry => entry.key == 'downloadURL')
                 if (updateEntry && !downloadEntry)

package/src/rules/require-user-js-filename.js

@@ -1,4 +1,4 @@
-import { extractMetadata } from '../utils.js'
+import metadata from '../utils/metadata.js'
 
 export default {
     meta: {
@@ -15,7 +15,7 @@ export default {
     create(context) {
         return {
             Program(node) {
-                const metaEntries = extractMetadata(context.sourceCode)
+                const metaEntries = metadata.extract(context.sourceCode)
                 if (!metaEntries.length) return
                 if (!context.filename.endsWith('.user.js'))
                     context.report({ node, messageId: 'requireUserJS' })

package/src/rules/valid-field-values.js

@@ -1,10 +1,10 @@
-import { extractMetadata } from '../utils.js'
+import metadata from '../utils/metadata.js'
+import regex from '../data/regex.js'
 
-const re = { /* eslint-disable security/detect-unsafe-regex */
+const re = { // oxlint-disable security/detect-unsafe-regex
     semVer: /^\d+\.\d+\.\d+(?:-[\da-z.-]+)?(?:\+[\da-z.-]+)?$/i,
-    dateVer: /^\d{4}\.(?:0?[1-9]|1[0-2])\.(?:0?[1-9]|[12]\d|3[01])(?:\.\d+)?$/,
-    whitespace: /\s+/
-} /* eslint-enable security/detect-unsafe-regex */
+    dateVer: /^\d{4}\.(?:0?[1-9]|1[0-2])\.(?:0?[1-9]|[12]\d|3[01])(?:\.\d+)?$/
+} // oxlint-enable security/detect-unsafe-regex
 
 const urlKeys = ['homepage', 'icon', 'icon64', 'require', 'source', 'website']
 
@@ -64,12 +64,12 @@ export default {
             : { year: new Date().getUTCFullYear(), month: new Date().getUTCMonth() +1 }
         return {
             Program() {
-                const metaEntries = extractMetadata(context.sourceCode)
+                const metaEntries = metadata.extract(context.sourceCode)
                 for (const entry of metaEntries) {
                     if (entry.key == 'grant' && allowedGrants.size && !allowedGrants.has(entry.value))
                         context.report({ node: entry.comment, messageId: 'invalidGrant', data: { grant: entry.value }})
                     else if (entry.key == 'resource') {
-                        const url = entry.value.trim().split(re.whitespace)[1]
+                        const url = entry.value.trim().split(regex.whitespace.all)[1]
                         if (url) try { new URL(url) }
                         catch {
                             context.report({ node: entry.comment, messageId: 'invalidURL', data: { field: entry.key }})

package/src/rules/valid-icon-headers.js

@@ -0,0 +1,74 @@
+import regex from '../data/regex.js'
+
+const re = {
+    dataURI: /^data:([^;,]+)(;base64)?,(.*)$/i,
+    iconLine: /^[ \t]*\/\/[ \t]*@(icon|icon64|defaulticon)[ \t]+(\S.*)$/,
+    scheme: /^([a-z][a-z0-9+.-]*):/i
+}
+
+export default {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Validates `@icon`/`@icon64`/`@defaulticon` values against allowed schemes',
+            category: 'Possible Errors',
+            recommended: true
+        },
+        schema: [],
+        messages: {
+            malformedURL:     '`@{{header}}` is not a valid URL.',
+            malformedDataURI: '`@{{header}}` data URI is malformed (expected `data:<mime>[;base64],<payload>`).',
+            nonImageMIME:     '`@{{header}}` data URI MIME type `{{mime}}` is not an image.',
+            disallowedScheme: '`@{{header}}` uses unsupported scheme `{{scheme}}:`'
+                            + ' (use `http(s)`, `data:`, or a relative path).'
+        }
+    },
+
+    create(context) {
+        const sourceCode = context.sourceCode ?? context.getSourceCode()
+
+        function validate(value, header, line, col) {
+            const loc = { start: { line, column: col }, end: { line, column: col + value.length }}
+            const schemeMatch = value.match(re.scheme)
+            if (!schemeMatch) return // relative path — accepted
+            const scheme = schemeMatch[1].toLowerCase()
+            if (scheme == 'http' || scheme == 'https') {
+                try { new URL(value) }
+                catch { return context.report({ loc, messageId: 'malformedURL', data: { header }}) }
+                return
+            }
+            if (scheme == 'data') {
+                const dataMatch = value.match(re.dataURI)
+                if (!dataMatch)
+                    return context.report({ loc, messageId: 'malformedDataURI', data: { header }})
+                const mime = dataMatch[1]
+                if (!mime.toLowerCase().startsWith('image/'))
+                    return context.report({ loc, messageId: 'nonImageMIME', data: { header, mime }})
+                return
+            }
+            context.report({ loc, messageId: 'disallowedScheme', data: { header, scheme }})
+        }
+
+        return {
+            Program() {
+                const text = sourceCode.text,
+                      metaMatch = text.match(regex.meta.block)
+                if (!metaMatch) return
+                const lines = metaMatch[1].split(regex.newline),
+                      iconMatches = []
+                for (const [i, line] of lines.entries()) {
+                    const m = line.match(re.iconLine)
+                    if (m) iconMatches.push({ i, line, m })
+                }
+                if (!iconMatches.length) return
+                const baseLine = text.slice(0, metaMatch.index).split(regex.newline).length
+                for (const { i, line, m } of iconMatches) {
+                    const header = m[1],
+                          value = m[2].trim()
+                    if (!value) continue
+                    validate(value, header, baseLine + i, line.indexOf(value))
+                }
+            }
+        }
+    }
+}

package/src/rules/valid-license-header.js

@@ -0,0 +1,73 @@
+// oxlint-disable security/detect-object-injection
+
+import array from '../utils/array.js'
+import license from '../utils/license.js'
+
+import regex from '../data/regex.js'
+
+const re = { spdxExpr: /(?<=\s)(?:OR|AND)(?=\s)/i }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Validates `@license` values against the SPDX license list',
+            category: 'Possible Errors',
+            recommended: true
+        },
+        defaultOptions: [{ allowedLicenses: [] }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedLicenses: {
+                    description: 'SPDX license IDs to restrict to',
+                    oneOf: [
+                        { type: 'string', description: 'Single SPDX license ID' },
+                        { type: 'array', description: 'Array of SPDX license IDs', items: { type: 'string' }}
+                    ]
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            invalidSPDX:    'Invalid SPDX identifier `{{id}}` (see https://spdx.org/licenses/).',
+            disallowedSPDX: '`@license {{id}}` is not in allowed list: {{allowed}}.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] ?? {},
+              allowedLicenses = array.to(opts.allowedLicenses) ?? [],
+              sourceCode = context.sourceCode ?? context.getSourceCode()
+        return {
+            Program() {
+                const text = sourceCode.text,
+                      metaMatch = text.match(regex.meta.block)
+                if (!metaMatch) return
+                const lines = text.split('\n'),
+                      startLine = text.slice(0, metaMatch.index).split('\n').length -1,
+                      endLine = startLine + metaMatch[0].split('\n').length -1
+                let licenseLineIdx = -1, licenseMatch = null
+                for (let i = startLine ; i < endLine ; i++) {
+                    const match = lines[i].match(regex.meta.license)
+                    if (match) { licenseLineIdx = i ; licenseMatch = match ; break }
+                }
+                if (!licenseMatch) return
+                const id = licenseMatch[1].trim() ; if (regex.url.test(id)) return
+                const parts = id.split(re.spdxExpr).map(part => part.trim()).filter(Boolean),
+                      idCol = lines[licenseLineIdx].indexOf(id),
+                      loc = { start: { line: licenseLineIdx +1, column: idCol },
+                              end: { line: licenseLineIdx +1, column: idCol + id.length }}
+                for (const part of parts)
+                    if (!license.spdx.isValid(part))
+                        return context.report({ loc, messageId: 'invalidSPDX', data: { id: part }})
+                if (allowedLicenses.length) {
+                    for (const part of parts)
+                        if (!allowedLicenses.includes(part))
+                            return context.report({ loc, messageId: 'disallowedSPDX',
+                                data: { id: part, allowed: allowedLicenses.join(', ') }})
+                }
+            }
+        }
+    }
+}

package/src/rules/valid-url-headers.js

@@ -0,0 +1,114 @@
+import metadata from '../utils/metadata.js'
+import regex from '../data/regex.js'
+
+const re = {
+    matchPattern: /^(\*|http\*?|https?|file|ftp):\/\/([^/]*)(\/.*)$/,
+    regexForm: /^\/.+\/[a-z]*$/i
+}
+
+const urlKeys = new Set(['homepage', 'require', 'require-css', 'source', 'website']),
+      matchKeys = new Set(['match', 'exclude-match']),
+      regexOrMatchKeys = new Set(['include', 'exclude'])
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Validates URLs and match patterns in metadata headers',
+            category: 'Possible Errors',
+            recommended: true
+        },
+        defaultOptions: [{
+            checkURLfields: true,
+            checkMatchPatterns: true,
+            allowedSchemes: ['http', 'https', 'file', 'ftp', 'http*'],
+            allowBroadPatterns: false
+        }],
+        schema: [{
+            type: 'object',
+            properties: {
+                checkURLfields: {
+                    type: 'boolean',
+                    description: 'Validate URL fields (`@homepage`, `@require`, `@resource`, etc.)'
+                },
+                checkMatchPatterns: {
+                    type: 'boolean',
+                    description: 'Validate match patterns (`@match`, `@include`, `@exclude`, `@exclude-match`)'
+                },
+                allowedSchemes: {
+                    type: 'array', items: { type: 'string' },
+                    description: 'Permitted URL schemes for match patterns'
+                },
+                allowBroadPatterns: {
+                    type: 'boolean',
+                    description: 'Allow unrestricted patterns (`<all_urls>`, `*://*/*`, `http*://*/*`, `https://*/*`)'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            invalidURL:         '`@{{field}}` has an invalid URL: "{{value}}".',
+            invalidMatchPattern:'`@{{field}}` has an invalid match pattern: "{{value}}".',
+            invalidScheme:      '`@{{field}}` uses a disallowed scheme: "{{value}}".',
+            invalidFileHost:    '`@{{field}}` uses a `file://` scheme w/ a non-empty host: "{{value}}".',
+            invalidHost:        '`@{{field}}` has an invalid wildcard host: "{{value}}". Use `*.` prefix instead.',
+            allURLs:            '`@{{field}}` uses the unrestricted pattern "{{value}}".'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] ?? {},
+              checkURLfields = opts.checkURLfields !== false,
+              checkMatchPatterns = opts.checkMatchPatterns !== false,
+              allowedSchemes = new Set(opts.allowedSchemes ?? ['http', 'https', 'file', 'ftp', 'http*']),
+              allowBroadPatterns = opts.allowBroadPatterns === true
+        if (!checkURLfields && !checkMatchPatterns) return {}
+        function validateMatchPattern(value, field, node) {
+            if (value == '<all_urls>') {
+                if (!allowBroadPatterns)
+                    context.report({ node, messageId: 'allURLs', data: { field, value }})
+                return
+            }
+            const m = value.match(re.matchPattern)
+            if (!m) {
+                if (regexOrMatchKeys.has(field) && re.regexForm.test(value)) return
+                context.report({ node, messageId: 'invalidMatchPattern', data: { field, value }})
+                return
+            }
+            const [, scheme, host, path] = m
+            if (scheme != '*' && !allowedSchemes.has(scheme))
+                context.report({ node, messageId: 'invalidScheme', data: { field, value }})
+            else if (scheme == 'file' && host != '')
+                context.report({ node, messageId: 'invalidFileHost', data: { field, value }})
+            else if (host.includes('*') && host != '*' && !host.startsWith('*.'))
+                context.report({ node, messageId: 'invalidHost', data: { field, value }})
+            else if (host == '*' && path == '/*' && !allowBroadPatterns)
+                context.report({ node, messageId: 'allURLs', data: { field, value }})
+        }
+        function validateURL(url, field, node) {
+            try { new URL(url) }
+            catch { context.report({ node, messageId: 'invalidURL', data: { field, value: url }}) }
+        }
+        return {
+            Program() {
+                for (const entry of metadata.extract(context.sourceCode)) {
+                    const key = entry.key, lower = key.toLowerCase()
+                    if (checkURLfields) {
+                        if (key == 'resource') {
+                            const tokens = entry.value.trim().split(regex.whitespace.all),
+                                  url = tokens[1]
+                            if (url) validateURL(url, key, entry.comment)
+                        } else if (urlKeys.has(key) || lower.endsWith('url')) {
+                            const url = entry.value.trim()
+                            if (url) validateURL(url, key, entry.comment)
+                        }
+                    }
+                    if (checkMatchPatterns && (matchKeys.has(key) || regexOrMatchKeys.has(key))) {
+                        const value = entry.value.trim()
+                        if (value) validateMatchPattern(value, key, entry.comment)
+                    }
+                }
+            }
+        }
+    }
+}

package/src/rules/valid-version-header.js

@@ -0,0 +1,83 @@
+import metadata from '../utils/metadata.js'
+
+const re = { // oxlint-disable security/detect-unsafe-regex
+    date: /^\d{4}\.(?:0?[1-9]|1[0-2])\.(?:0?[1-9]|[12]\d|3[01])(?:\.\d+)?$/,
+    semver: /^\d+\.\d+\.\d+(?:-[\da-z.-]+)?(?:\+[\da-z.-]+)?$/i
+} // oxlint-enable security/detect-unsafe-regex
+
+const examples = { date: 'YYYY.M.D or YYYY.M.D.N', semver: '1.2.3' }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Validates the @version metadata field',
+            category: 'Possible Errors',
+            recommended: true
+        },
+        defaultOptions: [{ versionType: 'semver', allowFutureDate: false, timezone: '' }],
+        schema: [{
+            type: 'object',
+            properties: {
+                versionType: {
+                    type: 'string',
+                    enum: ['semver', 'date'],
+                    description: 'Version format to enforce'
+                },
+                allowFutureDate: {
+                    type: 'boolean',
+                    description: 'Allow `@version` dates later than the current date'
+                },
+                timezone: {
+                    type: 'string',
+                    description: 'IANA timezone for determining the current date '
+                               + '(when omitted, only year/month are checked)'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            invalidVersion: 'Invalid @version: must be a valid {{versionType}} version '
+                          + '(expected format: {{example}}).',
+            futureVersion: 'Invalid @version: date cannot be in the future.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] ?? {},
+              versionType = opts.versionType ?? 'semver',
+              allowFutureDate = opts.allowFutureDate ?? false,
+              timezone = opts.timezone ?? '',
+              example = examples[versionType] // oxlint-disable-line security/detect-object-injection
+        const now = timezone
+            ? Object.fromEntries(new Intl.DateTimeFormat('en', {
+                timeZone: timezone, year: 'numeric', month: 'numeric', day: 'numeric'
+            }).formatToParts().filter(({ type }) => ['year', 'month', 'day'].includes(type))
+                .map(({ type, value }) => [type, Number(value)]))
+            : { year: new Date().getUTCFullYear(), month: new Date().getUTCMonth() + 1 }
+        function validate(node, version) {
+            if (typeof version != 'string') return
+            if (versionType == 'semver') {
+                if (!re.semver.test(version))
+                    context.report({ node, messageId: 'invalidVersion', data: { versionType, example }})
+                return
+            }
+            if (versionType == 'date') {
+                if (!re.date.test(version))
+                    return context.report({ node, messageId: 'invalidVersion', data: { versionType, example }})
+                if (allowFutureDate) return
+                const [year, month, day] = version.split('.').map(Number)
+                if (year > now.year
+                    || year == now.year && month > now.month
+                    || timezone && year == now.year && month == now.month && day > now.day
+                ) context.report({ node, messageId: 'futureVersion' })
+            }
+        }
+        return {
+            Program() {
+                for (const entry of metadata.extract(context.sourceCode))
+                    if (entry.key == 'version') validate(entry.comment, entry.value)
+            }
+        }
+    }
+}

package/src/utils/api.js

@@ -0,0 +1,11 @@
+import apis from '../data/apis.js'
+
+export default {
+    supports({ manager, api }) {
+        return !apis.all.has(api) ? false
+            : api.startsWith('CAT') ? manager == 'scriptcat'
+            : apis.tm.has(api) ? manager == 'tampermonkey'
+            : manager == 'adguard' ? apis.ag.has(api)
+            : true
+    }
+}

package/src/utils/array.js

@@ -0,0 +1 @@
+export default { to(val) { return Array.isArray(val) ? val : val == null ? [] : [val] }}

package/src/utils/deprecations.js

@@ -0,0 +1,76 @@
+export default {
+    initAlias(plugin, [oldName, alias]) { // oxlint-disable security/detect-object-injection
+        const routes = typeof alias == 'string' ? { [alias]: null } // 'old-rule': 'new-rule'
+            : Array.isArray(alias) ? Object.fromEntries(alias.map(entry =>
+                  typeof entry == 'string' ? [entry, null] // ['new-rule-1', 'new-rule-2']
+                : Object.entries(entry)[0])) // [{ 'new-rule': { 'old-opt': 'new-opt' }}]
+            : alias // { 'new-rule': null | { 'new-opt': default } | { 'old-val': 'new-val' } | { ..., 'new-opt': default }}
+        const targetNames = Object.keys(routes),
+              isRename = !targetNames.includes(oldName),
+              originals = Object.fromEntries(targetNames.map(name => [name, plugin.rules[name]])),
+              source = originals[oldName] ?? originals[targetNames[0]]
+        plugin.rules[oldName] = {
+            meta: {
+                ...source.meta,
+                defaultOptions: [],
+                schema: [{ type: ['object', 'array', 'string', 'number', 'boolean', 'null'] }],
+                docs: { ...source.meta.docs, recommended: isRename ? false : source.meta.docs.recommended },
+                messages: {
+                    ...source.meta.messages,
+                    deprecatedOption: `'{{old}}' is deprecated. Use '{{new}}' instead.`
+                },
+                ...(isRename ? { deprecated: {
+                    message: `Use ${targetNames.map(name => `\`${name}\``).join(', ')} instead.`,
+                    replacedBy: targetNames.map(name => ({ rule: { name }}))
+                }} : {})
+            },
+            create(context) {
+                const opts = context.options[0],
+                      isObj = opts?.constructor === Object
+                return Object.assign({}, ...Object.entries(routes).map(([targetName, mapping]) => {
+                    let newOpts = opts, deprecation
+                    if (mapping) {
+                        const entries = Object.entries(mapping),
+                              namedRemap = entries.every(([, val]) => typeof val == 'string'),
+                              wrapKey = namedRemap && entries.length > 1 ? entries.at(-1)[0] : null,
+                              valMap = wrapKey ? Object.fromEntries(entries.slice(0, -1)) : mapping
+                        if (namedRemap) {
+                            if (typeof opts == 'string') { // bare old val → remap, optionally wrapped
+                                if (valMap[opts]) deprecation = { old: opts, new: valMap[opts] }
+                                const remapped = valMap[opts] ?? opts
+                                newOpts = wrapKey ? { [wrapKey]: remapped } : remapped
+                            } else if (wrapKey) { // object opts (or defaults) → remap inner val, warn if deprecated
+                                const raw = isObj ? (opts[wrapKey] ?? mapping[wrapKey]) : mapping[wrapKey],
+                                      remapped = valMap[raw]
+                                if (remapped) deprecation = { old: raw, new: remapped }
+                                newOpts = { [wrapKey]: remapped ?? raw }
+                            } else { // object opts → old key → new key
+                                newOpts = { ...opts }
+                                for (const [oldKey, newKey] of entries)
+                                    if (opts?.[oldKey] !== undefined) {
+                                        newOpts[newKey] = opts[oldKey] ; delete newOpts[oldKey] }
+                            }
+                        } else { // { new-opt: default } — positional wrap
+                            const [newKey, defaultValue] = entries[0]
+                            if (opts !== undefined && !isObj)
+                                deprecation = { old: JSON.stringify(opts), new: `{ ${newKey}: ${JSON.stringify(opts)} }` }
+                            newOpts = { [newKey]: isObj ? (opts[newKey] ?? defaultValue) : (opts ?? defaultValue) }
+                        }
+                    }
+                    const aliasContext = Object.create(context)
+                    Object.defineProperty(aliasContext, 'options',
+                        { value: [newOpts], writable: true, configurable: true, enumerable: true })
+                    const visitors = { ...originals[targetName].create(aliasContext) }
+                    if (deprecation) {
+                        const ruleProgram = visitors.Program
+                        visitors.Program = function(node) {
+                            context.report({ node, messageId: 'deprecatedOption', data: deprecation })
+                            if (ruleProgram) ruleProgram.call(this, node)
+                        }
+                    }
+                    return visitors
+                }))
+            }
+        }
+    } // oxlint-enable security/detect-object-injection
+}