Adopt Biome lint rules

[schani]

Adopt Biome lint rules

This PR turns Biome's linter on for real, on top of the formatter-only setup from #2923, and adopts rules deliberately:

1. First commit enables the linter with the recommended preset. Of the 218 recommended rules, 30 reported diagnostics on the codebase; those were temporarily set to "off" so the commit lands with lint green and zero code changes.
2. One commit per rule then re-enables each of those 30 and fixes all of its violations — except three that misfit the codebase (see the rejected table).
3. The non-recommended rules of Biome 2.5 were then evaluated group by group (correctness, complexity, performance, security, style, suspicious): 29 more rules were adopted with fixes, and 27 already-clean guard rules were enabled in per-group batches. The nursery group was skipped as unstable, and a11y plus the framework-specific rules (React/Vue/Qwik/Solid/Next/DOM/CSS/GraphQL) don't apply to this library/CLI.

Every commit keeps npm run lint, npm run build, and the Vitest unit suite green. Lint fixes are behavior-preserving; where a fix would have been risky or wrong, a targeted biome-ignore suppression with a real explanation (or a scoped config override) is used instead. Notably, noUndeclaredDependencies caught a genuine issue: the CLI imported wordwrap without declaring it, relying on hoisting from quicktype-core — it is now a declared dependency.

Result: 270 rules active (215 recommended + 55 opted-in), 3 recommended rules off, 3 scoped overrides.

Adopted rules (with violations fixed)

Recommended preset (re-enabled one by one)

Rule	Violations fixed	Notes
correctness/noUnusedImports	1	unused lodash import
correctness/noUnusedVariables	5	unused catch bindings → optional catch
correctness/useParseIntRadix	3	single-char parses, radix 10
correctness/noSwitchDeclarations	20	case blocks scoped
complexity/noBannedTypes	13	{} → Record<string, never>
complexity/noExtraBooleanCast	2	redundant !!
complexity/noUselessConstructor	7	super-forwarding constructors removed
complexity/noUselessContinue	1
complexity/noUselessSwitchCase	1	case adjacent to identical default
complexity/noUselessTernary	1	x ? false : true → !x
complexity/noUselessUndefinedInitialization	24	= undefined initializers
complexity/useDateNow	2	+new Date() → Date.now()
complexity/useOptionalChain	1
style/noNonNullAssertion	2	replaced ! with narrowing via destructured consts
style/useConst	1
style/useExponentiationOperator	6	Math.pow → **
style/useNodejsImportProtocol	6	node: prefix; quicktype-core exempted via override (its browser field only remaps bare specifiers — enforced by core-package.test.ts)
style/useTemplate	40	concatenation → template literals, escapes hand-verified
suspicious/noExplicitAny	25	6 became unknown; deliberate anys (heterogeneous maps, vendored get-stream, untyped tree-sitter) suppressed with reasons
suspicious/noGlobalIsNan	6	all call sites already number-typed
suspicious/noImplicitAnyLet	3	explicit annotations
suspicious/noPrototypeBuiltins	2	already-safe .call sites suppressed; Object.hasOwn unavailable under core's es6 lib
suspicious/noShadowRestrictedNames	2	toString param renamed; collection-utils hasOwnProperty import suppressed
suspicious/noTsIgnore	1	→ @ts-expect-error with explanation
suspicious/noUselessEscapeInString	7	\" in template literals
suspicious/useIsArray	1	instanceof Array → Array.isArray
suspicious/useIterableCallbackReturn	19	forEach expression arrows → statement bodies

Non-recommended rules (opted in, violations fixed)

Rule	Violations fixed	Notes
correctness/noUndeclaredDependencies	2	real catch: wordwrap now declared for the CLI; vscode host module suppressed
correctness/noGlobalDirnameFilename	1	protects the ESM dual build; CJS test harness suppressed
complexity/noUselessReturn	24	trailing return;
style/useCollapsedElseIf	16	one site hand-collapsed to keep a comment
style/useCollapsedIf	5	one site hand-collapsed to keep a comment
style/useThrowNewError	15	throw Error(...) → throw new Error(...)
style/useConsistentBuiltinInstantiation	0	overlapped entirely with useThrowNewError
style/useObjectSpread	17	Object.assign({}, ...) → spread; 3 sites needed type annotations
style/noYodaExpression	7
style/noSubstr	11	substring → slice; one site got an explicit guard to preserve edge-case behavior
style/useExplicitLengthCheck	11	one numeric-fallback site suppressed (autofix would have produced a boolean)
style/noMultiAssign	9	chains split
style/useConsistentObjectDefinitions	6	shorthand
style/useForOf	2	replaced eslint-disabled index loops
style/noUnusedTemplateLiteral	2
style/useShorthandAssign	1
style/noInferrableTypes	1
style/useDefaultParameterLast	2	both sites are exported API (DartRenderer's protected dynamic-expression methods), so per review the defaults are kept with targeted suppressions — the rule now only guards new code
style/useConsistentMethodSignatures	2	property-style interface signatures
style/useUnifiedTypeSignatures	1	compose() overloads unified
style/noNamespace	1	obsolete declare namespace Math (fround is in ES2015 lib)
style/useNodeAssertStrict	1	same strict assert object
style/useReadonlyClassProperties	13	type-level only
suspicious/noEqualsToNull	1	value is Type | null, never undefined
suspicious/noUnusedExpressions	2	deliberate satisfies checks suppressed
suspicious/useArraySortCompare	3	string sorts where UTF-16 order is intended, suppressed
suspicious/noMisplacedAssertion	10	script-style test/release-version.ts exempted via override; one test helper suppressed
suspicious/noShadow	29	one real shadow renamed; CJSONRenderer.ts exempted (28 same-named nested emit-lambda params; bulk rename too risky)

Already-clean guard rules enabled (no violations)

correctness: noUnusedInstantiation, useSingleJsDocAsterisk · complexity: noDivRegex, noUselessCatchBinding, noUselessStringConcat, useArrayFind, useWhile, noRedundantDefaultExport, noExcessiveNestedTestSuites · performance: noDelete · style: useThrowOnlyError, useTrimStartEnd, useSymbolDescription, useSpreadOverApply, useNumberNamespace, useGlobalThis, useErrorCause · suspicious: noConstantBinaryExpressions, noVar, noFocusedTests, noSkippedTests, noReturnAssign, noDuplicateTestHooks, noDeprecatedImports, noDuplicateDependencies, useErrorMessage, noEmptySource

Rejected / skipped rules

Recommended rules kept off

Rule	Violations	Rationale
suspicious/noTemplateCurlyInString	48	quicktype's error messages use ${placeholder} templates in plain strings by design (Messages.ts, substituted at runtime by messageError), and the Kotlin renderers emit Kotlin's own ${} interpolation syntax. The rule flags the codebase's intended core patterns wholesale.
correctness/noVoidTypeReturn	13	rejected in review: the owner prefers return panic(...) in void functions — the return makes the control-flow termination explicit at the call site. Initially adopted, then reverted.
correctness/noConstructorReturn	6	rejected in review, same idiom objection as noVoidTypeReturn: all six violations were return panic(...) in a constructor. Reverting restored the @ts-expect-error on queryType that the fix had made obsolete.

Non-recommended rules not adopted (off by default; rationale)

Rule	Violations	Rationale
style/noUselessElse	20	rejected in review: the owner prefers explicit else blocks after returning branches over flattened straight-line code. Initially adopted, then reverted; kept explicitly "off".
suspicious/noEmptyBlockStatements	25	empty method bodies are deliberate no-op default hooks throughout the renderer class hierarchy
suspicious/useAwait	7	async methods implement async-by-contract interfaces (Input.addSource etc.) with sync bodies
suspicious/noParametersOnlyUsedInRecursion	5	the fix removes parameters from protected renderer API signatures
suspicious/noUnnecessaryConditions	97	flags defensive checks; high false-positive rate
suspicious/noConsole	71	the CLI writes to the console by design
suspicious/noBitwiseOperators	56	hashing/Markov/Mersenne-Twister code uses bitwise math deliberately
suspicious/noUndeclaredEnvVars	—	CLI/test harness read arbitrary env vars by design
complexity/noVoid	5	void promise deliberately marks fire-and-forget calls
complexity/noImplicitCoercions	11	+str / !!x are deliberate idioms
complexity/noForEach	41	forEach is used pervasively; useIterableCallbackReturn guards actual misuse
complexity/noExcessiveCognitiveComplexity, noExcessiveLinesPerFunction, useMaxParams	105/273/70	arbitrary size thresholds; language renderers are legitimately large
complexity/useSimplifiedLogicExpression	20	its De Morgan rewrites reduce readability
correctness/noUndeclaredVariables, noUnresolvedImports	0/12	redundant with the TypeScript compiler
correctness/useImportExtensions	1189	extension policy is owned by TS NodeNext resolution
correctness/noNodejsModules	38	it's a Node CLI; core's browser-compat is guarded by its own test
performance/noAwaitInLoops	14	sequential awaits are intentional (ordering, IO)
performance/noNamespaceImport, noBarrelFile, noReExportAll	39/31/35	import * and barrel index files are the package structure
performance/useTopLevelRegex	20	hoisting regexes risks shared lastIndex state and hurts locality
security/noSecrets	121	entropy heuristic false-positives on code-generation strings and fixtures
security/noDangerouslySetInnerHtml*	—	DOM/JSX only, N/A
style/noMagicNumbers	1328	absurd churn for a code generator full of structural constants
style/useConsistentMemberAccessibility	949	repo convention is explicit public; the rule's default demands the opposite
style/noTernary, useBlockStatements, noContinue, noNestedTernary, noEnum, noIncrementDecrement, noNegationElse	484/437/46/18/18/97/76	ban or churn idioms the codebase uses deliberately
style/useNamingConvention	424	underscore-prefixed privates and renderer naming clash with the rule
style/useNumericSeparators	195	churn incl. vendored PRNG constants
style/noParameterProperties	154	constructor parameter properties are a core idiom here
style/useDestructuring, useConsistentArrowReturn	99/41	mechanical churn, marginal benefit
style/noParameterAssign	75	parameter normalization (opts defaulting) is deliberate
style/useExportsLast, useFilenamingConvention, noExcessiveLinesPerFile, noExcessiveClassesPerFile	61/47/64/26	structural churn / arbitrary thresholds
style/noProcessEnv, correctness/noProcessGlobal	16/43	CLI and test harness use process/env by design
style/useConsistentArrayType, useConsistentTypeDefinitions	33/10	both forms used deliberately; pure churn
style/useAtIndex	3	.at() is not in quicktype-core's es6 lib
style/noCommonJs	5	build/test scripts legitimately use require
style/noDefaultExport	3	existing default exports are module API
style/noUselessUndefined	109	explicit undefined returns/arguments are used deliberately with strict optional typing
nursery group	—	skipped as unstable
a11y group + React/Vue/Qwik/Solid/Next/GraphQL/CSS rules	—	no DOM/JSX/framework code in this repo

Verification

• npm run lint exits 0 with zero diagnostics
• npm run build (all workspaces + CLI) succeeds
• npm run test:unit — 70/70 Vitest tests pass
• after every one of the 68 commits, all three of the above were green

🤖 Generated with Claude Code

[schani]

One API-compatibility issue found.