chore(lint): check Svelte components with svelte-policy

[chhoumann]

Summary

npm run lint now checks every Svelte component with svelte-policy. The package also replaces QuickAdd's tooling/ checker, so both plugins share one copy of each rule. Before this, oxlint ignored .svelte files entirely.

• Component checker. After oxlint, svelte-policy checks each component. It requires each-block keys that reference the item or index, and it reports the following:
  • {@html}
  • console methods other than warn and error
  • string timers and new Function
  • Svelte internals imports
  • duplicate on:/use: directives
  • unused or empty svelte-ignore comments
  • object or function literals in text mustaches
  • raw special elements
  • non-function event handlers
  • duplicate else-if branches
  • DOM changes on bind:this elements
• Config. svelte-policy.json makes {@debug} and $inspect errors, to match lint's --deny-warnings. The runes requirement and the store ban stay off, their defaults. 20 components still use legacy syntax, and the UI redesign will turn runes-only on once they are migrated.
• Oxlint. .oxlintrc.json loads svelte-policy/oxlint and runs svelte-policy/no-svelte-internal on src/**/*.ts.
• Fix. The one existing violation was a keyless each block in ChapterList.svelte. It is now keyed by its index. Svelte compiles an index-keyed each block to the same code as an unkeyed one, so main.js is byte-identical.

The package is svelte-policy 0.1.0 on npm, installed as "svelte-policy": "^0.1.0".

Verification

Commands, on Node v22.23.2:

• These all pass on the merge with origin/master 33e0e62, which includes build: make native Svelte checks fast and fail closed #416's scripts and the svelte-check patch:

  • npm run lint
  • npm run format:check
  • npm run typecheck
  • npm run build
  • npm run size: 284,862 raw bytes and 90,640 gzip bytes.
  • npm run test: 1,712 tests.
  • npm run test:tooling: 10 tests.
  • npm run docs:build

• main.js is byte-identical to origin/master's build at 33e0e62, sha256 7f6eb5a2ee8c7e4ddf474082d2594b74314b8b1e0b0af6ad015e8f838bfcf005. It was also identical to each earlier master this branch merged: beda5be, 3980111 and 2cd9974.

• npm run test:e2e passed once on this branch, before the later master merges: 11 files and 68 tests in the isolated Obsidian instance (Linux, headless). The bundle is unchanged since then.

• With the npm-installed 0.1.0, lint catches planted violations. A planted onclick={42} and a keyless {#each} give no-not-function-handler and require-each-key, and the checker exits 1. Earlier, with the vendored build, a planted svelte/internal import in a .ts file gave svelte-policy(no-svelte-internal) from oxlint, and a planted {@debug} gave no-at-debug-tags.

• package-lock.json changes only what this needs, compared with master:

  • the svelte-policy devDependency, resolved from the registry with integrity sha512-3BP+Gm91..., which matches the published tarball;
  • esquery 1.6.0 to 1.7.0;
  • zimmerframe 1.1.4 to 1.1.5.

  There is no libc or devOptional churn.

No Obsidian runtime behavior changes, so there is no runtime evidence beyond the e2e run.

Release impact

None. This adds dev tooling only, and the bundle is unchanged.

Docs at release

None.

Note

Add svelte-policy lint checks for Svelte components

• Adds the svelte-policy package and loads its oxlint plugin with the no-svelte-internal rule at error severity in .oxlintrc.json
• npm run lint now runs the svelte-policy checker after oxlint, using a new svelte-policy.json config that reports @debug tags and $inspect usage as errors
• Keys the chapter row each block by index in ChapterList.svelte to satisfy the new checker
• Behavioral Change: npm run lint and npm run format now fail on @debug tags, $inspect usage, and Svelte internal API references

^{Macroscope summarized 4b569de.}

[cloudflare-workers-and-pages]

Deploying podnotes with    Cloudflare Pages

Latest commit:	4b569de
Status:	✅  Deploy successful!
Preview URL:	https://aad38922.podnotes.pages.dev
Branch Preview URL:	https://chore-svelte-policy.podnotes.pages.dev

View logs