PoC: Stop importing bare stylelint in rule files

[bartveneman]

Summary

• Every rule only used the bare stylelint default export (import stylelint from 'stylelint') to reach createPlugin and three utils functions (report, ruleMessages, validateOptions). That default export resolves to stylelint's main entry point, which statically pulls in standalone.mjs and everything behind it (globby, cosmiconfig, write-file-atomic, ...) — fine for stylelint's own CLI, but dead weight for anyone deep-importing these rule modules.
• This came up while getting stylelint's linting core running in the browser (PoC: Move CSS linting from server to client-side projectwallace.com#367): none of those Node-only deps bundle for the browser, so the app had to alias the bare stylelint specifier to a hand-rolled shim just to work around this package. With this change that shim is no longer necessary — the plugin is browser-safe by construction.
• createPlugin is a two-line function, and the three utils functions actually used live under stylelint's public ./lib/utils/* export. src/utils/stylelint.ts now re-implements/re-exports just those directly, and every rule imports from there instead of stylelint.
• Verified the deep-imported lib/utils/* paths exist in both stylelint 16 and 17 (the peer range).

Test plan

• npx vitest run — 921 tests pass, unchanged
• npx tsc --noEmit — clean (added src/utils/stylelint-internals.d.ts for the deep lib/utils/* imports, same reasoning as stylelint's own .d.ts pinning)
• npx oxlint -D perf / npx oxfmt --check — clean
• npx tsdown + publint — clean build; confirmed dist/**/*.mjs no longer contains any from "stylelint" bare import
• Smoke-ran the built package through the real stylelint.lint() against known-bad CSS — same warnings as before

---

Generated by Claude Code

[github-actions]

⚠️ Package Size Increase

📦 Package	📏 Base Size	📏 Source Size	📈 Size Change
@projectwallace/stylelint-plugin	28.6 kB	28.7 kB	+142 B

[bartveneman]

The Security Audit check is failing on 3 pre-existing high-severity advisories, all transitive through stylelint/vitest devDependencies, unrelated to this diff:

• fast-uri via stylelint>table>ajv>fast-uri (GHSA-7p8r-x3mc-p8w7)
• js-yaml via stylelint>cosmiconfig>js-yaml (GHSA-5p4m-2wfm-xmqj)
• nanoid via postcss/vite/@vitest/coverage-v8 chains (GHSA-2v37-7h3g-55p8)

Checked out main's package.json/pnpm-lock.yaml and ran pnpm audit --audit-level=high directly — identical 3 failures, same root cause. Not introduced by this change. No action taken here.

(The package-size bot comment above — +142 B — is expected: this trades a one-line stylelint import for a couple of direct stylelint/lib/utils/* imports plus a 2-line createPlugin reimplementation.)

---

Generated by Claude Code