oxlint-architecture-rules 0.1.0-beta.0

package/src/adapters/cli/source-files.ts

@@ -0,0 +1,42 @@
+import { readdirSync, statSync } from "node:fs";
+import * as path from "node:path";
+
+// Folders no policy is written about and no linter visits.
+const SKIPPED = new Set([
+  "node_modules",
+  "build",
+  "dist",
+  ".next",
+  ".git",
+  "storybook-static",
+  "coverage",
+]);
+
+const SOURCE = /\.(ts|tsx|mts|cts)$/;
+
+// A declaration file states types, not code; no linter visits one and no policy
+// is written about one.
+const DECLARATION = /\.d\.[cm]?ts$/;
+
+export const listSourceFiles = (
+  repoRoot: string,
+  roots: ReadonlyArray<string>,
+): ReadonlyArray<string> => {
+  const found: Array<string> = [];
+  const walk = (absolute: string): void => {
+    for (const entry of readdirSync(absolute)) {
+      if (SKIPPED.has(entry)) continue;
+      const child = path.join(absolute, entry);
+      if (statSync(child).isDirectory()) walk(child);
+      else if (SOURCE.test(entry) && !DECLARATION.test(entry)) {
+        found.push(path.relative(repoRoot, child).replaceAll(path.sep, "/"));
+      }
+    }
+  };
+  for (const root of roots) {
+    const absolute = path.resolve(repoRoot, root);
+    if (statSync(absolute).isDirectory()) walk(absolute);
+    else found.push(path.relative(repoRoot, absolute).replaceAll(path.sep, "/"));
+  }
+  return found.sort();
+};

package/src/adapters/oxlint/config-loader.ts

@@ -0,0 +1,136 @@
+import { readFileSync } from "node:fs";
+import * as path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import * as Result from "effect/Result";
+
+import {
+  type BaselineFilter,
+  decodeBaseline,
+  EMPTY_BASELINE,
+  makeBaselineFilter,
+} from "../../core/baseline.js";
+import {
+  type CompiledExportRule,
+  compileExportRules,
+  exportRulesFailingTheirProbe,
+} from "../../core/exports.js";
+import {
+  type CompiledImportRule,
+  compileImportRules,
+  rulesFailingTheirProbe,
+} from "../../core/imports.js";
+import {
+  type CompiledMemberRule,
+  compileMemberRules,
+  memberRulesFailingTheirProbe,
+} from "../../core/members.js";
+import {
+  type CompiledStructure,
+  compileStructure,
+  structureRulesFailingTheirProbe,
+} from "../../core/structure.js";
+import { ConfigInvalid } from "../../domain/architecture-error.js";
+import { makeFileSystemLive } from "../../infrastructure/file-system-live.js";
+import { makeModuleResolverLive } from "../../infrastructure/module-resolver-live.js";
+import { lowerManifest } from "../../manifest/compile.js";
+import { decodeManifest, type Manifest } from "../../manifest/manifest.js";
+import type { FileSystem } from "../../ports/file-system.js";
+import type { ModuleResolver } from "../../ports/module-resolver.js";
+
+export type LoadedPolicy = {
+  readonly repoRoot: string;
+  readonly config: Manifest;
+  readonly importRules: ReadonlyArray<CompiledImportRule>;
+  readonly exportRules: ReadonlyArray<CompiledExportRule>;
+  readonly memberRules: ReadonlyArray<CompiledMemberRule>;
+  readonly structure: CompiledStructure;
+  readonly fileSystem: FileSystem;
+  // Violations this repository is carrying while it adopts the policy. Applied
+  // at report time so a baselined finding costs nothing but a line in a file.
+  readonly baseline: BaselineFilter;
+  readonly resolver: ModuleResolver;
+  readonly ignoreUnresolved: ReadonlyArray<RegExp>;
+};
+
+const readBaselineAt = (repoRoot: string, at: string) => {
+  try {
+    return decodeBaseline(JSON.parse(readFileSync(path.resolve(repoRoot, at), "utf8")) as unknown);
+  } catch {
+    // An absent or unreadable baseline carries nothing, which is the safe
+    // direction: every violation reports.
+    return EMPTY_BASELINE;
+  }
+};
+
+export const DEFAULT_CONFIG_FILENAME = "architecture.config.mjs";
+
+// Anything wrong with the policy — a missing file, a bad shape, an uncompilable
+// pattern — must stop the lint run. A plugin that loads with an empty policy
+// reports nothing and looks exactly like a clean codebase.
+export const loadPolicy = async (
+  repoRoot: string,
+  configFilename: string = DEFAULT_CONFIG_FILENAME,
+): Promise<LoadedPolicy> => {
+  const configPath = path.resolve(repoRoot, configFilename);
+
+  const module: unknown = await import(pathToFileURL(configPath).href).catch((cause: unknown) => {
+    throw new ConfigInvalid({ configPath, detail: String(cause) });
+  });
+
+  const exported =
+    typeof module === "object" && module !== null && "default" in module ? module.default : module;
+
+  const decoded = decodeManifest(configPath, exported);
+  if (Result.isFailure(decoded)) throw decoded.failure;
+  const config = decoded.success;
+
+  // The manifest is the authoring surface; these flat rules are the machine's.
+  const rules = lowerManifest(config);
+
+  const importRules = compileImportRules(rules.imports);
+  if (Result.isFailure(importRules)) throw importRules.failure;
+
+  const exportRules = compileExportRules(rules.exports);
+  if (Result.isFailure(exportRules)) throw exportRules.failure;
+
+  const memberRules = compileMemberRules(rules.members);
+  if (Result.isFailure(memberRules)) throw memberRules.failure;
+
+  const structure = compileStructure(rules.structure);
+  if (Result.isFailure(structure)) throw structure.failure;
+
+  const vacuous = [
+    ...rulesFailingTheirProbe(importRules.success),
+    ...exportRulesFailingTheirProbe(exportRules.success),
+    ...memberRulesFailingTheirProbe(memberRules.success),
+  ]
+    .map((rule) => rule.name)
+    .concat(structureRulesFailingTheirProbe(structure.success));
+  if (vacuous.length > 0) {
+    throw new ConfigInvalid({
+      configPath,
+      detail:
+        `these import rules do not report their own probe, so they enforce nothing: ` +
+        `${vacuous.join(", ")}. Fix the rule or its probe — ` +
+        `a rule that cannot flag a violation it was written for is worse than no rule.`,
+    });
+  }
+
+  return {
+    repoRoot,
+    config,
+    importRules: importRules.success,
+    exportRules: exportRules.success,
+    memberRules: memberRules.success,
+    structure: structure.success,
+    fileSystem: makeFileSystemLive(repoRoot),
+    baseline: makeBaselineFilter(
+      config.baseline === undefined ? EMPTY_BASELINE : readBaselineAt(repoRoot, config.baseline),
+    ),
+    resolver: makeModuleResolverLive(repoRoot, config.resolve),
+    ignoreUnresolved: (config.resolve.ignoreUnresolved ?? []).map(
+      (pattern: string) => new RegExp(pattern),
+    ),
+  };
+};

package/src/adapters/oxlint/exports-rule.ts

@@ -0,0 +1,144 @@
+import * as Result from "effect/Result";
+
+import {
+  type Binding,
+  evaluateSelectedBindings,
+  exportRulesSelecting,
+  type SelectedExportRule,
+} from "../../core/exports.js";
+import { formatMessage } from "../../domain/violation.js";
+import type { LoadedPolicy } from "./config-loader.js";
+import {
+  type Fixer,
+  type OxlintRule,
+  type ReportableNode,
+  type RuleContext,
+  toRepoRelative,
+} from "./oxlint-api.js";
+
+type NamedNode = ReportableNode & { readonly name?: unknown; readonly value?: unknown };
+
+type SpecifierNode = ReportableNode & {
+  readonly type: string;
+  readonly imported?: NamedNode | null;
+  readonly local?: NamedNode | null;
+};
+
+type DeclarationNode = ReportableNode & {
+  readonly source?: { readonly value?: unknown } | null;
+  readonly specifiers?: ReadonlyArray<SpecifierNode> | null;
+};
+
+const nameOf = (node: NamedNode | null | undefined): string | null => {
+  if (node === null || node === undefined) return null;
+  if (typeof node.name === "string") return node.name;
+  // `import { "a-b" as ab }` — a string-literal export name.
+  return typeof node.value === "string" ? node.value : null;
+};
+
+type Bound = Binding & { readonly node: SpecifierNode; readonly local: string };
+
+const boundOf = (specifier: SpecifierNode): Bound | null => {
+  const local = nameOf(specifier.local) ?? "";
+  switch (specifier.type) {
+    case "ImportSpecifier": {
+      const symbol = nameOf(specifier.imported);
+      return symbol === null ? null : { symbol, kind: "named", node: specifier, local };
+    }
+    case "ImportDefaultSpecifier":
+      return { symbol: "default", kind: "default", node: specifier, local };
+    case "ImportNamespaceSpecifier":
+      return { symbol: "*", kind: "namespace", node: specifier, local };
+    // `export { a } from "…"` — `local` is the name in the source module.
+    case "ExportSpecifier": {
+      const symbol = nameOf(specifier.local);
+      return symbol === null ? null : { symbol, kind: "named", node: specifier, local: symbol };
+    }
+    default:
+      return null;
+  }
+};
+
+// `import { A, B as C } from "pkg"` becomes `import * as A from "pkg/A"` and
+// `import * as C from "pkg/B"`. Only whole-declaration rewrites are offered: a
+// declaration mixing restricted named imports with a default or namespace one
+// would need comma surgery inside the braces, and a fix that is subtly wrong is
+// worse than a diagnostic the author resolves by hand.
+const subpathNamespaceImport = (specifier: string, bound: ReadonlyArray<Bound>): string =>
+  bound
+    .map((binding) => `import * as ${binding.local} from "${specifier}/${binding.symbol}";`)
+    .join("\n");
+
+export const makeExportsRule = (policy: LoadedPolicy): OxlintRule => ({
+  meta: {
+    type: "problem" as const,
+    fixable: "code" as const,
+    docs: {
+      description:
+        "which exported symbols a file may import, for rules a path alone cannot express",
+    },
+    schema: [],
+  },
+
+  createOnce(context: RuleContext) {
+    let importer = "";
+    let selected: ReadonlyArray<SelectedExportRule> = [];
+
+    const check = (node: DeclarationNode): void => {
+      const specifierValue = node.source?.value;
+      if (typeof specifierValue !== "string") return;
+
+      const bound = (node.specifiers ?? [])
+        .map(boundOf)
+        .filter((one): one is Bound => one !== null);
+      if (bound.length === 0) return;
+
+      const outcome = evaluateSelectedBindings(selected, policy.resolver, {
+        importer,
+        specifier: specifierValue,
+        bindings: bound,
+      });
+
+      if (Result.isFailure(outcome)) {
+        // `architecture/imports` reports the same unresolved edge, so staying
+        // quiet here avoids two diagnostics for one broken specifier.
+        return;
+      }
+
+      for (const { bindings, rule, violation } of outcome.success) {
+        if (policy.baseline.isBaselined(violation)) continue;
+        const offending = bound.filter((one: Bound) =>
+          bindings.some((binding) => binding.symbol === one.symbol && binding.kind === one.kind),
+        );
+        const rewritable =
+          rule.fix === "subpath-namespace-import" && offending.length === bound.length;
+
+        if (rewritable) {
+          context.report({
+            node,
+            message: formatMessage(violation),
+            fix: (fixer: Fixer) =>
+              fixer.replaceText(node, subpathNamespaceImport(specifierValue, offending)),
+          });
+          continue;
+        }
+
+        context.report({
+          node: offending[0]?.node ?? node,
+          message: formatMessage(violation),
+        });
+      }
+    };
+
+    return {
+      before() {
+        importer = toRepoRelative(policy.repoRoot, context.filename);
+        if (importer.startsWith("..")) return false;
+        selected = exportRulesSelecting(policy.exportRules, importer);
+        return selected.length > 0;
+      },
+      ImportDeclaration: check,
+      ExportNamedDeclaration: check,
+    };
+  },
+});

package/src/adapters/oxlint/imports-rule.ts

@@ -0,0 +1,67 @@
+import * as Result from "effect/Result";
+
+import { evaluateSelectedEdge, rulesSelecting, type SelectedRule } from "../../core/imports.js";
+import { formatMessage } from "../../domain/violation.js";
+import type { LoadedPolicy } from "./config-loader.js";
+import {
+  type OxlintRule,
+  type RuleContext,
+  type SourceNode,
+  specifierOf,
+  toRepoRelative,
+} from "./oxlint-api.js";
+
+const unresolvedMessage = (specifier: string, detail: string): string =>
+  `[unresolved-import] "${specifier}" could not be resolved, so every import rule about it ` +
+  `enforces nothing. Fix the resolve scope in the architecture config, or list the specifier ` +
+  `in resolve.ignoreUnresolved. (${detail})`;
+
+export const makeImportsRule = (policy: LoadedPolicy): OxlintRule => ({
+  meta: {
+    type: "problem" as const,
+    docs: {
+      description:
+        "import boundaries between folders and packages, matched against fully resolved module paths",
+    },
+    schema: [],
+  },
+
+  // `createOnce` is what makes resolution affordable: the resolver and the
+  // compiled rules are built once per lint run, and `before` decides per file
+  // whether any rule selects it at all — a file none select is skipped whole.
+  createOnce(context: RuleContext) {
+    let importer = "";
+    let selected: ReadonlyArray<SelectedRule> = [];
+
+    const check = (node: SourceNode): void => {
+      const specifier = specifierOf(node);
+      if (specifier === null) return;
+
+      const outcome = evaluateSelectedEdge(selected, policy.resolver, { importer, specifier });
+
+      if (Result.isFailure(outcome)) {
+        if (policy.config.resolve.unresolved === "off") return;
+        if (policy.ignoreUnresolved.some((pattern) => pattern.test(specifier))) return;
+        context.report({ node, message: unresolvedMessage(specifier, outcome.failure.detail) });
+        return;
+      }
+
+      for (const violation of outcome.success) {
+        if (policy.baseline.isBaselined(violation)) continue;
+        context.report({ node, message: formatMessage(violation) });
+      }
+    };
+
+    return {
+      before() {
+        importer = toRepoRelative(policy.repoRoot, context.filename);
+        if (importer.startsWith("..")) return false;
+        selected = rulesSelecting(policy.importRules, importer);
+        return selected.length > 0;
+      },
+      ImportDeclaration: check,
+      ExportNamedDeclaration: check,
+      ExportAllDeclaration: check,
+    };
+  },
+});

package/src/adapters/oxlint/members-rule.ts

@@ -0,0 +1,114 @@
+import {
+  type CompiledMemberRule,
+  evaluateMemberSite,
+  memberRulesSelecting,
+} from "../../core/members.js";
+import { formatMessage } from "../../domain/violation.js";
+import type { LoadedPolicy } from "./config-loader.js";
+import {
+  type OxlintRule,
+  type ReportableNode,
+  type RuleContext,
+  toRepoRelative,
+} from "./oxlint-api.js";
+
+type NamedNode = ReportableNode & {
+  readonly type: string;
+  readonly name?: unknown;
+  readonly value?: unknown;
+};
+
+type MemberNode = ReportableNode & {
+  readonly type: string;
+  readonly key?: NamedNode | null;
+  readonly computed?: boolean;
+};
+
+type TypeAliasNode = ReportableNode & {
+  readonly id?: NamedNode | null;
+  readonly typeAnnotation?:
+    | (ReportableNode & { readonly type: string; readonly members?: ReadonlyArray<MemberNode> })
+    | null;
+};
+
+type CallNode = ReportableNode & {
+  readonly callee?:
+    | (ReportableNode & {
+        readonly type: string;
+        readonly name?: unknown;
+        readonly property?: NamedNode | null;
+      })
+    | null;
+};
+
+const DECLARED_MEMBER_TYPES = new Set(["TSPropertySignature", "TSMethodSignature"]);
+
+const nameOf = (node: NamedNode | null | undefined): string | null => {
+  if (node === null || node === undefined) return null;
+  if (typeof node.name === "string") return node.name;
+  return typeof node.value === "string" ? node.value : null;
+};
+
+const calleeName = (node: CallNode): string | null => {
+  const callee = node.callee;
+  if (callee === null || callee === undefined) return null;
+  if (typeof callee.name === "string") return callee.name;
+  return nameOf(callee.property);
+};
+
+export const makeMembersRule = (policy: LoadedPolicy): OxlintRule => ({
+  meta: {
+    type: "problem" as const,
+    docs: {
+      description:
+        "which names a file may declare or call — a port's method vocabulary, a tier's allowed hooks",
+    },
+    schema: [],
+  },
+
+  createOnce(context: RuleContext) {
+    let file = "";
+    let selected: ReadonlyArray<CompiledMemberRule> = [];
+
+    const report = (node: ReportableNode, name: string, declaration?: string): void => {
+      const violations = evaluateMemberSite(selected, {
+        file,
+        subject: declaration === undefined ? "calls" : "type-members",
+        name,
+        ...(declaration === undefined ? {} : { in: declaration }),
+      });
+      for (const violation of violations) {
+        if (policy.baseline.isBaselined(violation)) continue;
+        context.report({ node, message: formatMessage(violation) });
+      }
+    };
+
+    return {
+      before() {
+        file = toRepoRelative(policy.repoRoot, context.filename);
+        if (file.startsWith("..")) return false;
+        selected = memberRulesSelecting(policy.memberRules, file);
+        return selected.length > 0;
+      },
+
+      TSTypeAliasDeclaration(node: TypeAliasNode) {
+        const declaration = nameOf(node.id);
+        const annotation = node.typeAnnotation;
+        if (declaration === null || annotation?.type !== "TSTypeLiteral") return;
+
+        for (const member of annotation.members ?? []) {
+          // A computed key is not a name a vocabulary rule can speak about, and
+          // no port in this codebase declares one.
+          if (member.computed === true || !DECLARED_MEMBER_TYPES.has(member.type)) continue;
+          const name = nameOf(member.key);
+          if (name !== null) report(member.key ?? member, name, declaration);
+        }
+      },
+
+      CallExpression(node: CallNode) {
+        const name = calleeName(node);
+        if (name !== null) report(node, name);
+      },
+    };
+  },
+});

package/src/adapters/oxlint/oxlint-api.ts

@@ -0,0 +1,25 @@
+import * as path from "node:path";
+
+import type { RuleTester } from "oxlint/plugins-dev";
+
+// oxlint publishes no plugin types, so the exact `Context`, node and fixer shapes
+// are recovered from `RuleTester`'s own signature — the one public surface that
+// names them. Hand-rolling them drifts silently against an alpha API.
+export type OxlintRule = Parameters<RuleTester["run"]>[1];
+export type RuleContext = Parameters<Extract<OxlintRule, { createOnce: unknown }>["createOnce"]>[0];
+
+type Diagnostic = Parameters<RuleContext["report"]>[0];
+export type ReportableNode = Extract<Diagnostic, { node: unknown }>["node"];
+export type Fixer = Parameters<NonNullable<Diagnostic["fix"]>>[0];
+
+export type SourceNode = ReportableNode & {
+  readonly source?: { readonly value?: unknown } | null;
+};
+
+export const toRepoRelative = (repoRoot: string, filename: string): string =>
+  path.relative(repoRoot, filename).replaceAll(path.sep, "/");
+
+export const specifierOf = (node: SourceNode): string | null => {
+  const value = node.source?.value;
+  return typeof value === "string" ? value : null;
+};

package/src/adapters/oxlint/plugin.ts

@@ -0,0 +1,35 @@
+import { DEFAULT_CONFIG_FILENAME, loadPolicy } from "./config-loader.js";
+import { makeExportsRule } from "./exports-rule.js";
+import { makeImportsRule } from "./imports-rule.js";
+import { makeMembersRule } from "./members-rule.js";
+import type { OxlintRule } from "./oxlint-api.js";
+import { makeStructureRule } from "./structure-rule.js";
+
+// oxlint imports this module once per lint run and reads `rules` synchronously,
+// so the policy is loaded here rather than inside a rule. A load failure throws
+// out of the import and fails the run — which is the point: a plugin that came
+// up with no policy would report nothing and be indistinguishable from a clean
+// codebase.
+const policy = await loadPolicy(
+  process.env.ARCHITECTURE_ROOT ?? process.cwd(),
+  process.env.ARCHITECTURE_CONFIG ?? DEFAULT_CONFIG_FILENAME,
+);
+
+export const rules: {
+  readonly imports: OxlintRule;
+  readonly exports: OxlintRule;
+  readonly members: OxlintRule;
+  readonly structure: OxlintRule;
+} = {
+  imports: makeImportsRule(policy),
+  exports: makeExportsRule(policy),
+  members: makeMembersRule(policy),
+  structure: makeStructureRule(policy),
+};
+
+const plugin: { readonly meta: { readonly name: string }; readonly rules: typeof rules } = {
+  meta: { name: "architecture" },
+  rules,
+};
+
+export default plugin;

package/src/adapters/oxlint/structure-rule.ts

@@ -0,0 +1,39 @@
+import { evaluateStructure } from "../../core/structure.js";
+import { formatMessage } from "../../domain/violation.js";
+import type { LoadedPolicy } from "./config-loader.js";
+import { type OxlintRule, type RuleContext, toRepoRelative } from "./oxlint-api.js";
+
+export const makeStructureRule = (policy: LoadedPolicy): OxlintRule => ({
+  meta: {
+    type: "problem" as const,
+    docs: {
+      description:
+        "the file taxonomy: which file kinds a folder admits, and which siblings a file owes",
+    },
+    schema: [],
+  },
+
+  createOnce(context: RuleContext) {
+    // The taxonomy is a property of the path, not of the syntax, so the whole
+    // check runs once in `before` and the visitor exists only because oxlint
+    // does not run hooks for a rule with no visitor keys.
+    return {
+      before() {
+        const file = toRepoRelative(policy.repoRoot, context.filename);
+        if (file.startsWith("..")) return false;
+
+        for (const violation of evaluateStructure(policy.structure, policy.fileSystem, file)) {
+          if (policy.baseline.isBaselined(violation)) continue;
+          context.report({
+            message: formatMessage(violation),
+            loc: { line: 1, column: 0 },
+          });
+        }
+        return false;
+      },
+      Program() {
+        return undefined;
+      },
+    };
+  },
+});

package/src/core/baseline.ts

@@ -0,0 +1,62 @@
+import type { Violation } from "../domain/violation.js";
+import { fingerprintOf } from "../domain/violation.js";
+
+// A baseline is the set of violations a repository is choosing to carry while it
+// adopts a policy. It exists so a rule can be turned on before the code is
+// clean — the alternative is not turning it on.
+//
+// Two properties make it a ratchet rather than a suppression list:
+//
+//   - Entries are line-independent fingerprints, so an entry survives edits to
+//     the file it names. One keyed on a position would go stale on the first
+//     reformat and silently re-admit the violation it was meant to record.
+//   - An entry that no longer fires is an error, not a shrug. Fixing a violation
+//     must remove its entry, or the floor never rises.
+export type Baseline = {
+  readonly version: 1;
+  readonly entries: ReadonlyArray<string>;
+};
+
+export const EMPTY_BASELINE: Baseline = { version: 1, entries: [] };
+
+export const baselineOf = (violations: Iterable<Violation>): Baseline => ({
+  version: 1,
+  entries: [...new Set([...violations].map(fingerprintOf))].sort(),
+});
+
+export const decodeBaseline = (raw: unknown): Baseline => {
+  if (typeof raw !== "object" || raw === null) return EMPTY_BASELINE;
+  const entries = (raw as { entries?: unknown }).entries;
+  if (!Array.isArray(entries)) return EMPTY_BASELINE;
+  return { version: 1, entries: entries.filter((one): one is string => typeof one === "string") };
+};
+
+export const serializeBaseline = (baseline: Baseline): string =>
+  `${JSON.stringify(baseline, null, 2)}\n`;
+
+export type BaselineFilter = {
+  readonly isBaselined: (violation: Violation) => boolean;
+};
+
+export const makeBaselineFilter = (baseline: Baseline): BaselineFilter => {
+  const entries = new Set(baseline.entries);
+  return { isBaselined: (violation) => entries.has(fingerprintOf(violation)) };
+};
+
+// The ratchet's teeth: entries the code no longer produces. A baseline that is
+// allowed to keep them stops being a record of debt and becomes a place to hide.
+export const staleEntriesOf = (
+  baseline: Baseline,
+  violations: Iterable<Violation>,
+): ReadonlyArray<string> => {
+  const current = new Set([...violations].map(fingerprintOf));
+  return baseline.entries.filter((entry) => !current.has(entry));
+};
+
+export const unbaselined = (
+  baseline: Baseline,
+  violations: Iterable<Violation>,
+): ReadonlyArray<Violation> => {
+  const { isBaselined } = makeBaselineFilter(baseline);
+  return [...violations].filter((violation) => !isBaselined(violation));
+};