chore: replace Biome with oxlint, oxfmt and Knip

.git-blame-ignore-revs

@@ -0,0 +1,2 @@
+# Formatted with oxfmt when the repository moved off Biome.
+8a5c1e02656c306843248b38d42474819417f977

.github/workflows/ci.yml

@@ -28,4 +28,6 @@ jobs:
       - run: pnpm add --global @antelopejs/core
       - run: pnpm prepack
       - run: pnpm lint
+      - run: pnpm format:check
+      - run: pnpm knip
       - run: pnpm test

.github/workflows/stale.yml

@@ -1,8 +1,8 @@
-name: 'Close stale issues'
+name: "Close stale issues"
 
 on:
   schedule:
-    - cron: '30 * * * *'
+    - cron: "30 * * * *"
   workflow_dispatch:
 
 permissions:
@@ -17,8 +17,8 @@ jobs:
       - uses: actions/stale@v9
         with:
           exempt-issue-labels: pending
-          stale-issue-message: 'This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.'
-          close-issue-message: 'This issue was closed because it has been stalled for 30 days with no activity.'
+          stale-issue-message: "This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days."
+          close-issue-message: "This issue was closed because it has been stalled for 30 days with no activity."
           days-before-stale: 60
           days-before-close: 30
           operations-per-run: 200

AGENTS.md

@@ -8,7 +8,7 @@
 | --------------------- | --------------------------------------------------------------------------------------- |
 | English only          | All code must be in English: variable names, function names, comments                   |
 | PNPM only             | Always use pnpm, never npm or yarn                                                      |
-| NO COMMENTS | Code must be self-documenting through clear naming. TSDoc is allowed for public APIs              |
+| NO COMMENTS           | Code must be self-documenting through clear naming. TSDoc is allowed for public APIs    |
 | NO switch/case        | Use objects, maps, or arrays instead                                                    |
 | NO inline types       | Define proper interfaces/types, never use anonymous types like `{a: string, b: number}` |
 | Functions ≤ 40 lines  | Split into subfunctions if longer                                                       |
@@ -35,23 +35,23 @@ Never use `switch/case` or `if param === 'XXX'` chains. Instead:
 // BAD
 function getStatus(code: string) {
   switch (code) {
-    case 'A':
-      return 'Active';
-    case 'I':
-      return 'Inactive';
+    case "A":
+      return "Active";
+    case "I":
+      return "Inactive";
     default:
-      return 'Unknown';
+      return "Unknown";
   }
 }
 
 // GOOD
 const STATUS_MAP: Record<string, string> = {
-  A: 'Active',
-  I: 'Inactive',
+  A: "Active",
+  I: "Inactive",
 };
 
 function getStatus(code: string) {
-  return STATUS_MAP[code] ?? 'Unknown';
+  return STATUS_MAP[code] ?? "Unknown";
 }
 ```
 

CHANGELOG.md

@@ -1,6 +1,5 @@
 # Changelog
 
-
 ## v0.0.6
 
 [compare changes](https://github.com/AntelopeJS/interface-auth/compare/v0.0.5...v0.0.6)
@@ -64,7 +63,6 @@
 
 ## v0.0.2
 
-
 ### 🚀 Enhancements
 
 - Initial interface-auth package ([b7ec0d9](https://github.com/AntelopeJS/interface-auth/commit/b7ec0d9))
@@ -85,4 +83,3 @@
 
 - Antony Rizzitelli <upd4ting@gmail.com>
 - Glastis ([@Glastis](http://github.com/Glastis))
-

docs/2.authentication.md

@@ -15,7 +15,13 @@ A typical authentication flow consists of four steps:
 
 ```typescript
 import { SignRaw, Authentication } from "@antelopejs/interface-auth";
-import { Controller, Post, Get, JSONBody, HTTPResult } from "@antelopejs/interface-api";
+import {
+  Controller,
+  Post,
+  Get,
+  JSONBody,
+  HTTPResult,
+} from "@antelopejs/interface-api";
 
 class UserController extends Controller("/users") {
   @Post("login")
@@ -153,9 +159,7 @@ const AdminOnly = CreateAuthDecorator({
 The `AuthValidator` type signature is:
 
 ```typescript
-type AuthValidator<T = unknown, R = unknown> = (
-  data: T,
-) => Promise<R> | R;
+type AuthValidator<T = unknown, R = unknown> = (data: T) => Promise<R> | R;
 ```
 
 ## Authentication pipeline

docs/3.token-handling.md

@@ -21,21 +21,21 @@ console.log(token); // Signed token string
 
 The function accepts two arguments:
 
-| Argument  | Type                             | Description                    |
-| --------- | -------------------------------- | ------------------------------ |
-| `data`    | `string \| Buffer \| object`    | The data to sign               |
-| `options` | `SignOptions` (optional)         | Signing configuration options  |
+| Argument  | Type                         | Description                   |
+| --------- | ---------------------------- | ----------------------------- |
+| `data`    | `string \| Buffer \| object` | The data to sign              |
+| `options` | `SignOptions` (optional)     | Signing configuration options |
 
 `SignRaw` returns a `Promise<string>` that resolves to the signed token.
 
 ### `SignOptions`
 
 The `SignOptions` interface configures token generation.
 
-| Property    | Type               | Description                                                            |
-| ----------- | ------------------ | ---------------------------------------------------------------------- |
+| Property    | Type               | Description                                                                  |
+| ----------- | ------------------ | ---------------------------------------------------------------------------- |
 | `expiresIn` | `string \| number` | Token expiration time as seconds or a timespan string (e.g., `"1h"`, `"2d"`) |
-| `notBefore` | `string \| number` | Duration before which the token is not valid                           |
+| `notBefore` | `string \| number` | Duration before which the token is not valid                                 |
 
 ### `SignServerResponse`
 
@@ -59,28 +59,28 @@ async function login(res: ServerResponse) {
 
 The function accepts four arguments:
 
-| Argument        | Type                          | Description                        |
-| --------------- | ----------------------------- | ---------------------------------- |
-| `res`           | `ServerResponse`              | The HTTP response object           |
-| `data`          | `string \| Buffer \| object` | The data to sign                   |
-| `signOptions`   | `SignOptions` (optional)      | Signing configuration options      |
-| `cookieOptions` | `CookieOptions` (optional)   | Cookie configuration options       |
+| Argument        | Type                         | Description                   |
+| --------------- | ---------------------------- | ----------------------------- |
+| `res`           | `ServerResponse`             | The HTTP response object      |
+| `data`          | `string \| Buffer \| object` | The data to sign              |
+| `signOptions`   | `SignOptions` (optional)     | Signing configuration options |
+| `cookieOptions` | `CookieOptions` (optional)   | Cookie configuration options  |
 
 The cookie is set with the name `ANTELOPEJS_AUTH` and the signed token as its value. The function returns a `Promise<ServerResponse>` that resolves to the same response object once the cookie header has been set.
 
 ### `CookieOptions`
 
 The `CookieOptions` interface configures the authentication cookie.
 
-| Property   | Type      | Description                                                |
-| ---------- | --------- | ---------------------------------------------------------- |
-| `maxAge`   | `number`  | Maximum age in milliseconds                                |
-| `signed`   | `boolean` | Whether the cookie should be signed                        |
-| `expires`  | `Date`    | Specific date when the cookie expires                      |
-| `httpOnly` | `boolean` | Prevents client-side JavaScript from accessing the cookie  |
-| `path`     | `string`  | URL path for which the cookie is valid                     |
-| `domain`   | `string`  | Domain for which the cookie is valid                       |
-| `secure`   | `boolean` | Only sends the cookie over HTTPS                           |
+| Property   | Type      | Description                                               |
+| ---------- | --------- | --------------------------------------------------------- |
+| `maxAge`   | `number`  | Maximum age in milliseconds                               |
+| `signed`   | `boolean` | Whether the cookie should be signed                       |
+| `expires`  | `Date`    | Specific date when the cookie expires                     |
+| `httpOnly` | `boolean` | Prevents client-side JavaScript from accessing the cookie |
+| `path`     | `string`  | URL path for which the cookie is valid                    |
+| `domain`   | `string`  | Domain for which the cookie is valid                      |
+| `secure`   | `boolean` | Only sends the cookie over HTTPS                          |
 
 ## Token validation
 
@@ -101,9 +101,9 @@ try {
 
 The function accepts two arguments:
 
-| Argument  | Type            | Description                      |
-| --------- | --------------- | -------------------------------- |
-| `token`   | `string` (optional) | The signed token to verify   |
+| Argument  | Type                       | Description                |
+| --------- | -------------------------- | -------------------------- |
+| `token`   | `string` (optional)        | The signed token to verify |
 | `options` | `VerifyOptions` (optional) | Verification configuration |
 
 ### `VerifyOptions`
@@ -112,8 +112,8 @@ The `VerifyOptions` interface configures token validation.
 
 | Property           | Type               | Description                                          |
 | ------------------ | ------------------ | ---------------------------------------------------- |
-| `ignoreExpiration` | `boolean`          | If `true`, expired tokens are still considered valid  |
-| `ignoreNotBefore`  | `boolean`          | If `true`, tokens not yet valid are accepted          |
+| `ignoreExpiration` | `boolean`          | If `true`, expired tokens are still considered valid |
+| `ignoreNotBefore`  | `boolean`          | If `true`, tokens not yet valid are accepted         |
 | `maxAge`           | `string \| number` | Maximum allowed age of the token                     |
 
 ### Example with verify options

docs/4.parameter-decoration.md

@@ -81,12 +81,12 @@ export const ApiKeyAuth = CreateAuthDecorator({
 
 The function accepts an object with the following properties:
 
-| Property               | Type                  | Description                                              |
-| ---------------------- | --------------------- | -------------------------------------------------------- |
+| Property               | Type                  | Description                                                     |
+| ---------------------- | --------------------- | --------------------------------------------------------------- |
 | `source`               | `AuthSource`          | Extracts the token from the request (defaults to header/cookie) |
-| `authenticator`        | `AuthVerifier<T>`     | Verifies the token and returns the payload               |
-| `authenticatorOptions` | `VerifyOptions`       | Options passed to the authenticator                      |
-| `validator`            | `AuthValidator<T, R>` | Validates and transforms the authenticated data          |
+| `authenticator`        | `AuthVerifier<T>`     | Verifies the token and returns the payload                      |
+| `authenticatorOptions` | `VerifyOptions`       | Options passed to the authenticator                             |
+| `validator`            | `AuthValidator<T, R>` | Validates and transforms the authenticated data                 |
 
 All properties are optional. When omitted, the default behavior is used.
 
@@ -165,8 +165,8 @@ class UserController extends Controller("/users") {
 
 The `@Authentication` decorator (and any custom decorator created with `CreateAuthDecorator`) can be applied at three levels:
 
-| Scope       | Effect                                                              |
-| ----------- | ------------------------------------------------------------------- |
-| Parameter   | Injects the verified payload into a single handler parameter        |
-| Property    | Populates a class property with the verified payload for all handlers |
-| Class       | Requires authentication for every route in the controller           |
+| Scope     | Effect                                                                |
+| --------- | --------------------------------------------------------------------- |
+| Parameter | Injects the verified payload into a single handler parameter          |
+| Property  | Populates a class property with the verified payload for all handlers |
+| Class     | Requires authentication for every route in the controller             |

knip.config.ts

@@ -0,0 +1,14 @@
+import { antelopeKnipConfig } from "@antelopejs/tooling-configs/knip";
+
+export default antelopeKnipConfig({
+  entry: [
+    // `ajs module test` runs the compiled suites out of this tree, and reads
+    // src/antelope.test.ts (package.json antelopeJs.test) to build the test
+    // project; the preset only knows the `src/test/` spelling.
+    "src/tests/**/*.test.ts",
+    "src/antelope.test.ts",
+  ],
+  // `ajs` comes from @antelopejs/core, which CI installs globally rather than
+  // pulling the whole CLI into every module's dependency tree.
+  ignoreBinaries: ["ajs"],
+});

oxfmt.config.ts

@@ -0,0 +1,7 @@
+import { antelopeFmtPreset } from "@antelopejs/tooling-configs/oxc/fmt";
+
+export default antelopeFmtPreset({
+  // Drop once tooling-configs ships the shared ignore (AntelopeJS/tooling-configs#5):
+  // these are Markdown templates with a .yml extension, which oxfmt cannot parse.
+  ignorePatterns: [".github/ISSUE_TEMPLATE/**"],
+});

oxlint.config.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from "oxlint";
+import { antelopePreset } from "@antelopejs/tooling-configs/oxc/lint";
+
+export default defineConfig({
+  extends: [antelopePreset()],
+  options: { typeAware: true },
+});