chore: modernize build tooling

.github/workflows/guard.yml

@@ -53,9 +53,14 @@ jobs:
 
       - name: Install dependencies
         run: npm install
+        working-directory: ${{ github.workspace }}
 
+      # Build the whole workspace so @arcjet/guard's workspace dependencies
+      # (e.g. @arcjet/analyze) have their `dist/` output for guard's
+      # source tests and type checking.
       - name: Build
         run: npm run build
+        working-directory: ${{ github.workspace }}
 
       - name: Unit tests (with coverage)
         run: npm run test-unit
@@ -84,9 +89,14 @@ jobs:
 
       - name: Install dependencies
         run: npm install
+        working-directory: ${{ github.workspace }}
 
+      # Build the whole workspace so @arcjet/guard's workspace dependencies
+      # (e.g. @arcjet/analyze) have their `dist/` output for guard's
+      # source tests and type checking.
       - name: Build
         run: npm run build
+        working-directory: ${{ github.workspace }}
 
       - name: Lint (oxlint)
         run: npm run lint
@@ -167,6 +177,13 @@ jobs:
 
       - name: Install dependencies
         run: npm install
+        working-directory: ${{ github.workspace }}
+
+      # Build the whole workspace so guard's workspace dependencies are
+      # available to the runtime tests.
+      - name: Build
+        run: npm run build
+        working-directory: ${{ github.workspace }}
 
       - name: Runtime test (${{ matrix.runtime }})
         run: npm run ${{ matrix.script }}

.github/workflows/publish.yml

@@ -54,11 +54,9 @@ jobs:
             --workspace @arcjet/cache \
             --workspace @arcjet/duration \
             --workspace @arcjet/env \
-            --workspace @arcjet/eslint-config \
             --workspace @arcjet/headers \
             --workspace @arcjet/ip \
             --workspace @arcjet/redact-wasm \
-            --workspace @arcjet/rollup-config \
             --workspace @arcjet/runtime \
             --workspace @arcjet/sprintf \
             --workspace @arcjet/stable-hash \
@@ -79,9 +77,10 @@ jobs:
             --workspace @arcjet/decorate \
             --workspace @arcjet/inspect
 
-          # Level 3: core SDK
+          # Level 3: core SDK + guards (depend on @arcjet/analyze from Level 2)
           npm publish --tag "$TAG" \
-            --workspace arcjet
+            --workspace arcjet \
+            --workspace @arcjet/guard
 
           # Level 4: public framework integrations
           npm publish --tag "$TAG" \
@@ -96,17 +95,3 @@ jobs:
             --workspace @arcjet/react-router \
             --workspace @arcjet/remix \
             --workspace @arcjet/sveltekit
-      # @arcjet/guard is excluded from npm workspaces and manages its own
-      # dependencies, so it must be installed and published separately.
-      # It depends on @arcjet/analyze (Level 2), so it runs after Level 3.
-      # TODO: This is temporary until the tooling is unified (oxlint, oxfmt,
-      # TypeScript Go, rolldown) and it can rejoin the main workspaces.
-      - name: Publish @arcjet/guard
-        env:
-          TAG: ${{ github.event.inputs.tag }}
-        working-directory: arcjet-guard
-        run: |
-          npm ci
-          npm run build
-          npm test
-          npm publish --tag "$TAG"

.github/workflows/pull-request.yml

@@ -10,6 +10,12 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  lint:
+    name: Lint
+    uses: ./.github/workflows/reusable-lint.yml
+    permissions:
+      contents: read
+
   test:
     name: Run tests
     uses: ./.github/workflows/reusable-test.yml

.github/workflows/push.yml

@@ -12,6 +12,12 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  lint:
+    name: Lint
+    uses: ./.github/workflows/reusable-lint.yml
+    permissions:
+      contents: read
+
   test:
     name: Run tests
     uses: ./.github/workflows/reusable-test.yml

.github/workflows/reusable-lint.yml

@@ -0,0 +1,42 @@
+name: Reusable lint workflow
+
+on:
+  workflow_call: {}
+
+env:
+  DO_NOT_TRACK: "1"
+
+jobs:
+  lint:
+    name: Lint & format
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        with:
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            nodejs.org:443
+            objects.githubusercontent.com:443
+            registry.npmjs.org:443
+            release-assets.githubusercontent.com:443
+          disable-sudo-and-containers: true
+          egress-policy: block
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+        with:
+          node-version: 24
+      - run: npm ci
+      - name: Lint (oxlint)
+        run: npm run lint
+      - name: Format check (oxfmt)
+        run: npm run format:check
+      # Type checking needs each package's dependencies built (for their .d.ts).
+      - name: Build
+        run: npm run build
+      - name: Type check (tsgo)
+        run: npm run typecheck

.oxfmtrc.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "ignorePatterns": [
+    "**/dist/**",
+    "examples/**",
+    "**/src/wasm/**",
+    "protocol/src/proto/**",
+    "arcjet-guard/**",
+    "**/*.md"
+  ],
+  "sortImports": {}
+}

.oxlintrc.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["typescript", "unicorn", "oxc", "import", "node", "promise"],
+  "categories": {
+    "correctness": "error",
+    "suspicious": "error"
+  },
+  "rules": {
+    "eslint/no-warning-comments": "off",
+    "eslint/no-shadow": "off",
+    "eslint/no-unused-vars": "off",
+    "unicorn/no-array-sort": "off"
+  },
+  "ignorePatterns": [
+    "**/dist/**",
+    "examples/**",
+    "dev/**",
+    "arcjet-guard/**",
+    "**/src/wasm/**",
+    "protocol/src/proto/**"
+  ]
+}

analyze-wasm/.gitignore

@@ -130,13 +130,4 @@ dist
 .pnp.*
 
 # Generated files
-edge-light.js
-edge-light.d.ts
-index.js
-index.d.ts
-types.js
-types.d.ts
-workerd.js
-workerd.d.ts
-test/*.js
-_virtual/*.js
+dist/

analyze-wasm/package.json

@@ -11,66 +11,65 @@
     "verify",
     "wasm"
   ],
-  "license": "Apache-2.0",
   "homepage": "https://arcjet.com",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/arcjet/arcjet-js.git",
-    "directory": "analyze-wasm"
-  },
   "bugs": {
     "url": "https://github.com/arcjet/arcjet-js/issues",
     "email": "support@arcjet.com"
   },
+  "license": "Apache-2.0",
   "author": {
     "name": "Arcjet",
     "email": "support@arcjet.com",
     "url": "https://arcjet.com"
   },
-  "engines": {
-    "node": ">=22.21.0 <23 || >=24.5.0"
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/arcjet/arcjet-js.git",
+    "directory": "analyze-wasm"
   },
+  "files": [
+    "dist"
+  ],
   "type": "module",
-  "main": "./index.js",
-  "types": "./index.d.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
-    "edge-light": "./edge-light.js",
-    "workerd": "./workerd.js",
-    "default": "./index.js"
+    ".": {
+      "edge-light": {
+        "types": "./dist/edge-light.d.ts",
+        "default": "./dist/edge-light.js"
+      },
+      "workerd": {
+        "types": "./dist/workerd.d.ts",
+        "default": "./dist/workerd.js"
+      },
+      "default": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
   },
-  "files": [
-    "_virtual/",
-    "wasm/",
-    "edge-light.d.ts",
-    "edge-light.js",
-    "index.d.ts",
-    "index.js",
-    "types.d.ts",
-    "types.js",
-    "workerd.d.ts",
-    "workerd.js"
-  ],
   "scripts": {
-    "build:jco": "jco transpile --instantiation async --no-wasi-shim --out-dir wasm/ -- wasm/arcjet_analyze_js_req.component.wasm",
-    "build:rollup": "rollup --config rollup.config.js",
-    "build": "npm run build:jco && npm run build:rollup",
-    "lint": "eslint .",
-    "test-api": "node --test -- test/*.test.js",
-    "test-coverage": "node --experimental-test-coverage --test -- test/*.test.js",
-    "test": "npm run build && npm run lint && npm run test-coverage"
+    "build:jco": "jco transpile --instantiation async --no-wasi-shim --out-dir src/wasm/ -- src/wasm/arcjet_analyze_js_req.component.wasm",
+    "build": "npm run build:jco && tsdown",
+    "typecheck": "tsgo --noEmit",
+    "test-api": "node --test -- test/*.test.ts",
+    "test-coverage": "node --experimental-test-coverage --test -- test/*.test.ts",
+    "test": "npm run build && npm run test-coverage"
   },
   "dependencies": {},
   "devDependencies": {
-    "@arcjet/eslint-config": "1.5.0",
-    "@arcjet/rollup-config": "1.5.0",
     "@bytecodealliance/jco": "1.5.0",
-    "@rollup/wasm-node": "4.61.0",
     "@types/node": "22.19.21",
-    "eslint": "9.39.4",
-    "typescript": "5.9.3"
+    "tsdown": "0.22.3",
+    "typescript": "6.0.3"
   },
-  "publishConfig": {
-    "access": "public",
-    "tag": "latest"
+  "engines": {
+    "node": ">=22.21.0 <23 || >=24.5.0"
   }
 }

analyze-wasm/edge-light.ts → analyze-wasm/src/edge-light.ts

@@ -1,9 +1,8 @@
-import { instantiate } from "./wasm/arcjet_analyze_js_req.component.js";
-import type { ImportObject } from "./wasm/arcjet_analyze_js_req.component.js";
-
 import componentCoreWasm from "./wasm/arcjet_analyze_js_req.component.core.wasm?module";
 import componentCore2Wasm from "./wasm/arcjet_analyze_js_req.component.core2.wasm?module";
 import componentCore3Wasm from "./wasm/arcjet_analyze_js_req.component.core3.wasm?module";
+import { instantiate } from "./wasm/arcjet_analyze_js_req.component.js";
+import type { ImportObject } from "./wasm/arcjet_analyze_js_req.component.js";
 
 async function moduleFromPath(path: string): Promise<WebAssemblyLike.Module> {
   if (path === "arcjet_analyze_js_req.component.core.wasm") {
@@ -27,7 +26,9 @@ async function moduleFromPath(path: string): Promise<WebAssemblyLike.Module> {
  * @returns
  *   Promise that resolves to the initialized component.
  */
-export async function initializeWasm(coreImports: ImportObject) {
+export async function initializeWasm(
+  coreImports: ImportObject,
+): Promise<Awaited<ReturnType<typeof instantiate>> | undefined> {
   try {
     return instantiate(moduleFromPath, coreImports);
   } catch {

analyze-wasm/index.ts → analyze-wasm/src/index.ts

@@ -2,12 +2,11 @@
 //
 /// <reference types="./wasm.js" />
 
-import { instantiate } from "./wasm/arcjet_analyze_js_req.component.js";
-import type { ImportObject } from "./wasm/arcjet_analyze_js_req.component.js";
-
 import { wasm as componentCoreWasm } from "./wasm/arcjet_analyze_js_req.component.core.wasm?js";
 import { wasm as componentCore2Wasm } from "./wasm/arcjet_analyze_js_req.component.core2.wasm?js";
 import { wasm as componentCore3Wasm } from "./wasm/arcjet_analyze_js_req.component.core3.wasm?js";
+import { instantiate } from "./wasm/arcjet_analyze_js_req.component.js";
+import type { ImportObject } from "./wasm/arcjet_analyze_js_req.component.js";
 
 const componentCoreWasmPromise = componentCoreWasm();
 const componentCore2WasmPromise = componentCore2Wasm();
@@ -36,7 +35,9 @@ async function moduleFromPath(path: string): Promise<WebAssemblyLike.Module> {
  * @returns
  *   Promise that resolves to the initialized component.
  */
-export async function initializeWasm(coreImports: ImportObject) {
+export async function initializeWasm(
+  coreImports: ImportObject,
+): Promise<Awaited<ReturnType<typeof instantiate>> | undefined> {
   try {
     // Await the instantiation to catch the failure
     return instantiate(moduleFromPath, coreImports);

analyze-wasm/types.ts → analyze-wasm/src/types.ts

@@ -38,8 +38,7 @@ export type BotResult = GeneratedBotResult;
  *   Array of `undefined` for tokens that are not sensitive or a `string` used as
  *   a label for sensitive info.
  */
-export type DetectSensitiveInfoFunction =
-  typeof ArcjetJsReqSensitiveInformationIdentifier.detect;
+export type DetectSensitiveInfoFunction = typeof ArcjetJsReqSensitiveInformationIdentifier.detect;
 
 /**
  * Span of sensitive info,
@@ -95,4 +94,5 @@ export type SensitiveInfoEntity = GeneratedSensitiveInfoEntity;
 export type SensitiveInfoResult = GeneratedSensitiveInfoResult;
 
 // Mark file as module.
+// oxlint-disable-next-line typescript/no-useless-empty-export, unicorn/require-module-specifiers
 export {};