chore: adopt oxfmt and oxlint with a pre-commit hook

[paustint]

Brings simple-xml onto the oxc toolchain already used by sf-formula-parser, soql-parser-js and simple-excel.

Changes

• Formatter: Prettier is replaced by oxfmt. .prettierrc becomes .oxfmtrc.json with the settings the other libraries share.
• Linter: oxlint is new; the repo had no linter before. It runs correctness, suspicious and perf as errors, with style and pedantic off. The only overrides are __dirname in the parse tests and the polling loop in the shared release script. It is locked at 1.85.0 to match the other three repos.
• Scripts: format, format:check, lint, lint:fix, and a prepare script that sets core.hooksPath to .githooks on npm install.
• Pre-commit hook: .githooks/pre-commit is the copy shared with the other libraries. It runs the format check and oxlint on staged files and blocks the commit if either fails.
• CI: gates on format:check and lint, since the hook can be bypassed with --no-verify.
• Parser cleanup (src/parse.ts), with no behaviour change:
  • addChild moves to module scope, so it isn't recreated on every parse() call.
  • parseAttributes drops a coerce parameter, unused since 1.1.0.
  • One .reverse() keeps an inline disable. The suggested toReversed() is ES2023, and esbuild doesn't polyfill it for the ES2022 target.
• Reformat: cosmetic only: README table padding and a few test lines.
• Docs: AGENTS.md gains formatting, linting and commit-hook sections. CHANGELOG has an entry under ### Changed, so the next release is a patch.

Verification

• format:check, lint, typecheck, build and all 117 tests pass.
• A probe commit that was both unformatted and had a lint error was blocked, and both problems were reported in the same attempt.
• All four commits on this branch went through the hook.

After merging, run npm install once in an existing checkout to turn the hook on.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	oxfmt@​0.70.0
	oxlint@​1.85.0

View full report

[Copilot]

Copilot review overview

🟡 Changes recommended

The hook checks working-tree content instead of staged content, lint exceptions are overly broad, and Claude can invoke release scripts without approval.

Review effort: Balanced
Findings: 1 · 3

Open (4)

• Avoid auto-approving commands that can trigger releases · New
• Lint staged index content instead of working-tree files · New
• Scope no-underscore-dangle override to the test fixture · New
• Scope no-await-in-loop override to the release script · New

What changed in this PR

Adopts the oxc formatting and linting toolchain with local and CI enforcement.

Changes:

• Replaces Prettier with oxfmt and adds oxlint.
• Adds CI checks and a pre-commit hook.
• Refactors parser internals and reformats existing files.

File	Description
src/​parse.ts	Applies lint-driven parser cleanup.
src/​__tests__/​parse.test.ts	Reformats parser tests.
src/​__tests__/​build.test.ts	Reformats builder tests.
README.md	Reformats option tables.
package.json	Adds tooling scripts and dependencies.
package-lock.json	Locks new tooling dependencies.
CHANGELOG.md	Documents the tooling migration.
AGENTS.md	Documents formatting, linting, and hooks.
.oxlintrc.json	Defines lint policy and overrides.
.oxfmtrc.json	Configures oxfmt.
.github/​workflows/​ci.yml	Adds formatting and linting gates.
.githooks/​pre-commit	Adds local staged-file checks.
.claude/​settings.json	Expands permitted development commands.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The hook is documented as shared verbatim but remains inconsistent with all three named repositories.

1 open finding

• Cross-repository hook copies are out of sync · New

4 resolved since last review

• Avoid auto-approving commands that can trigger releases
• Scope no-await-in-loop override to the release script
• Scope no-underscore-dangle override to the test fixture
• Lint staged index content instead of working-tree files

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

The Vitest lint override omits the existing scripts test suite.

0 open findings

1 resolved since last review

• Cross-repository hook copies are out of sync

Previously missed (1)

In code that hasn't changed since last review

Extend Vitest ESLint override to scripts test directory

.oxlintrc.json:29

This override misses scripts/__tests__/derive-increment.test.mjs, which also imports Vitest, so Vitest-specific correctness rules are not applied to that test suite. Include the scripts test directory in the override so all repository tests receive the intended plugin checks.

🧠 Review effort: Balanced