chore(lint): make it harder for me to accidentally product ai slop code

[cameronapak]

Adds oxlint anti-slop to the Expo SDK. Generated slop fails lint.

Replaces jest.mock with hookOverrides and component impls. Tests do not hoist mocks or mount use dom.

Keeps #146. Provider locale still reaches every DOM WebView (YPE-5118).

Inspiration: https://x.com/dillon_mulroy/status/2087531327000117630

Greptile Summary

The PR replaces application-module Jest mocks with explicit hook and component test seams while moving lint enforcement to type-aware Oxlint.

• Adds custom anti-slop and native-localization Oxlint rules and integrates them into CI.
• Introduces hookOverrides and native component implementations for tests without mounting Expo DOM components.
• Makes overridden highlight hooks inert across fetch, refresh, persistence, queue, and write paths.
• Refactors tests and supporting fixtures to use the new seams.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported live-work and live-write paths are now gated before their observable side effects.

Important Files Changed

Filename	Overview
packages/core/src/highlights/use-highlights.ts	The override fix consistently gates reads, subscriptions, persistence, and both public write paths before any external or persisted side effect.
packages/core/src/highlights/use-highlight-permission-flow.ts	The real hook remains mounted for stable hook ordering, but its nested highlight behavior is inert and the returned override controls all user-triggered flow actions.
packages/core/src/hook-overrides.ts	Adds a typed, documented test seam for auth and highlight hooks while keeping production providers unchanged.
oxlint.config.ts	Configures type-aware Oxlint, Expo DOM checks, native localization enforcement, and the new anti-slop plugin.
packages/ui/src/native/component-impls.ts	Provides component substitution seams used to avoid mounting Expo DOM and sheet implementations in native unit tests.

_{Reviews (5): Last reviewed commit: "fix(test): type the outside-native-scope..." | Re-trigger Greptile}

[cameronapak]

@greptile-apps, please review this PR

[cameronapak]

@greptile-apps, updates have been made, so please re-review

[cameronapak]

@greptile-apps, please re-review. You don't have to re-review every single file, because I just did some small fixes, but honestly, you do whatever's best for you.

[cameronapak]

@greptile-apps, review this and rip it to shreds to make sure the PR is bulletproof

[camrun91]

Marking as requesting changes as there are a few things that at least should be discussed. There are a few other things that claude called out but I do not think are big enough right now. if they show back up when these are closed I may surface them.

[cameronapak]

@greptile-apps, it's time for a re-review. Scrutinize this PR to make it as good as it can be.

[camrun91]

Re-reviewed after the latest push. The five fixes all check out. I traced 765ef28 against main's old per-field semantics across every edge case (numeric chapter, 3.7, 0, -1, NaN, Infinity, "abc", "", booleans, string versionId, arrays, non-object JSON) and they all match. 6cbda01's guard is the first statement in startWrite, before any state touch, and live is always true without overrides, so production is untouched. The number_of_files > 0 guard in 9a72036 is better than what I suggested — it makes that test fail closed.

Three items are inline. Two more are below, because their lines fall outside this PR's diff.

---

Orphaned ESLint script now points at a deleted fixture (new)

9a72036 deleted scripts/eslint-fixtures/native-i18n/outside-native-scope.tsx, but scripts/test-native-i18n-eslint.mjs:115 still reads that exact path. That file is already unreachable — nothing invokes it since lint:native-i18n moved to the oxlint version, and eslint / eslint-config-expo were dropped from devDependencies — so it can't even run to fail. scripts/eslint-native-i18n-config.mjs (its only import target) is equally orphaned. Anyone opening either file to understand the i18n scoping rules reads instructions for a linter this repo no longer has.

Suggest: delete both files. (Not inline — neither is in this PR's diff.)

---

web-yv-provider.test.tsx:114 locale assertion fails open (inherited from #146, not this PR)

Flagging for a follow-up on main rather than as a blocker here — I confirmed both this assertion and the two-branch reader already exist on main.

expect(source).toMatch(/locale=\{locale\}/) with a non-global regex is a single "appears anywhere" check, but dom/bible-reader.tsx has two YouVersionProvider return branches (includeAuth true / false). Delete locale={locale} from the includeAuth branch at line 321 and every test stays green — the regex matches the surviving occurrence at line 338, and the runtime tests stub BibleReaderDom through setImpl so they never reach the web provider. Authenticated readers (the branch consumers hit whenever auth is configured) would render English inside the WebView with nothing red. The version-filter assertion above it has the same weakness, for the same reason.

Suggest: assert an occurrence count, or one match per <YouVersionProvider block.

---

Deliberately not filed

oxlint.config.ts:51 still excludes **/scripts/**, **/*.config.*, **/*.d.ts, and **/jest.setup.js from lint, where the old ESLint config covered scripts/. This push is itself evidence of the cost — 9a72036 had to relocate the i18n fixture out of scripts/ precisely because oxlint never inspects it. Still open, just not blocking.

[camrun91]

Went ahead and had my robo friend Claude look into it the fixes look good I had it post the other high ones and two new ones that I also validated.

[greptile-apps]

Too many files changed for review (190 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.

[cursor]

Orphaned ESLint scripts: deleted. Nothing invoked them after oxlint.

Locale source-regex fail-open: inherited from #146. Follow-up on main.

oxlint scripts ignore: left alone. You said not blocking.

Code Implementor, sent on behalf of Cam. I am AI.

[camrun91]

This PR now has no changeset, but it still adds public API

Merging 73f41cd (chore: version packages, #147) consumed provider-locale-dom-bridge.md, so .changeset/ is down to just README.md. Both packages are sitting at 1.3.1 from that release.

That leaves the branch adding public API with nothing to version it:

• HookOverrides — new type export from packages/core/src/index.ts:2
• AuthContextValue — new type export from packages/core/src/index.ts:9
• hookOverrides — new prop on the UI YouVersionProvider, whose YouVersionProviderProps is exported at packages/ui/src/index.ts:29

changeset version bumps nothing without an entry, so these ship silently on whatever unrelated release lands next — no version bump, no CHANGELOG line. And nothing catches it: the Lint / Typecheck / Build / Test / Locale-parity jobs in ci.yml never mention changesets, so it merges green.

Suggest: a minor changeset for the two packages (they're a fixed group in .changeset/config.json, so one entry versions both).

---

Scoping note, since I overstated this in earlier review notes: I checked whether the sanitizeAvatarUrl (unknown → string) and IdTokenPayload (index signature dropped) narrowings are breaking for consumers. They are not. Neither symbol is re-exported from packages/core/src/index.ts, and the package exports map only exposes ., so deep imports are blocked — both are effectively internal. Same for the new named AuthProvider / HighlightQueueDrainHost exports, which are module-level only. So this is an additive minor, not a breaking change.

[camrun91]

One thing to call out but It may not be blocking.