@sarj/eslint-plugin 13.0.0 → 14.0.0

package/README.md

@@ -4,99 +4,8 @@
 
 Custom ESLint rules for hypermodern TypeScript / React / Next.js projects
 
-## Package metadata
+```bash
+npm install --save-dev @sarj/eslint-plugin
+```
 
-| Field | Value |
-| --- | --- |
-| Version | `13.0.0` |
-| Registry | npm |
-| License | MIT |
-| Runtime | `node >=22.13.0` |
-
-## Command-line reference
-
-| Command |
-| --- |
-| `npm run build` |
-| `npm run dogfood` |
-| `npm run lint` |
-| `npm run prepack` |
-| `npm run test` |
-| `npm run typecheck` |
-| `npm run verify-package` |
-
-## Rule catalog
-
-| Rule | Summary | Default | Autofix |
-| --- | --- | --- | --- |
-| `eslint:duplicate-test-body` | Disallow substantial sibling tests with the same body shape; express their differing inputs as a parameterized case table. | `error` | `none` |
-| `eslint:enforce-file-structure` | Require imports before body statements and require `use server` to be the first statement. | `error` | `none` |
-| `eslint:no-async-callback-in-wait-for` | Disallow async callbacks in `waitFor` to prevent swallowed promise rejections. | `error` | `none` |
-| `eslint:no-client-side-data-fetching` | Disallow direct data fetching inside `useEffect` or `useLayoutEffect`. | `error` | `none` |
-| `eslint:no-comment-cruft` | Flag commented-out code, section-banner comments, and leading file-header comment preambles. | `error` | `none` |
-| `eslint:no-conditional-in-test` | Disallow test conditionals that can skip a runtime assertion or exit the test before one runs. | `error` | `none` |
-| `eslint:no-cors-wildcard-with-credentials` | Disallow wildcard CORS origins when credentials are enabled. | `error` | `none` |
-| `eslint:no-declaration-comment-wall` | Flag an enum body or class body whose member comments mostly re-spell the members' own names. | `error` | `none` |
-| `eslint:no-dynamic-sql` | Disallow runtime interpolation or concatenation in SQL passed to statement-execution methods. | `error` | `none` |
-| `eslint:no-enum` | Disallow TypeScript `enum`; use string-literal unions or `as const` objects instead. | `error` | `none` |
-| `eslint:no-fat-try-blocks` | Disallow `try` blocks containing more than three top-level operations that can throw. | `error` | `none` |
-| `eslint:no-generic-single-export-module` | Disallow generic module stems when one runtime export already names the responsibility. | `error` | `none` |
-| `eslint:no-hand-rolled-sleep` | Disallow uncancellable promisified timers and timeout arms. | `error` | `none` |
-| `eslint:no-hand-rolled-spinner` | Disallow intrinsic elements styled as Tailwind border-ring spinners outside the design-system implementation. | `error` | `none` |
-| `eslint:no-impossible-zod-literal-bounds` | Disallow same-chain literal Zod bounds whose accepted set is mathematically empty. | `error` | `none` |
-| `eslint:no-insecure-random-id` | Disallow using `Math.random()` to generate identifiers, tokens, or secrets; use `crypto.randomUUID()` or `crypto.getRandomValues(...)` instead. | `error` | `none` |
-| `eslint:no-json-stringify-error` | Disallow `JSON.stringify` on an Error value; it yields `{}` because `message`/`stack` are non-enumerable. | `error` | `none` |
-| `eslint:no-log-only-catch` | Disallow `catch` clauses that only log (or silently do nothing) and then swallow the error; rethrow or handle it instead. | `error` | `none` |
-| `eslint:no-long-comment` | Flag unusually large unstructured prose blocks in implementation code. | `error` | `none` |
-| `eslint:no-offset-pagination` | Disallow OFFSET pagination in embedded SQL; it is O(N) per page and drops or repeats rows under concurrent writes. Use a keyset cursor. | `error` | `none` |
-| `eslint:no-positional-tuple-return` | Disallow returning a multi-field tuple from an exported function; return a named object so call sites cannot mismatch slots. | `error` | `none` |
-| `eslint:no-raw-env` | Disallow direct `process.env` and `import.meta.env` reads outside validated boundaries. | `error` | `none` |
-| `eslint:no-raw-fetch-outside-clients` | Disallow calling the global `fetch` outside the client layer; route outbound HTTP through a client module that owns retry, timeout and status handling. | `error` | `none` |
-| `eslint:no-repeated-string-literal` | Disallow a long structured string literal repeated across functions; the copies drift when one is edited. Extract a module-level constant. | `error` | `none` |
-| `eslint:no-restated-comment` | Flag a single-line comment whose every word already appears on the statement below it. | `error` | `none` |
-| `eslint:no-restated-jsdoc` | Flag a JSDoc block whose description and tags only re-spell the signature they document. | `error` | `suggestion` |
-| `eslint:no-restricted-library-load` | Apply a configured library-replacement policy to literal dynamic imports, CommonJS loads, and TypeScript import-equals declarations. | `error` | `none` |
-| `eslint:no-secret-in-log` | Disallow passing a secret-named value or a raw request/response blob to a logging call; both leak to log sinks. Redact or omit. | `error` | `none` |
-| `eslint:no-select-star` | Disallow SELECT * in embedded SQL; it over-fetches and leaves the row contract implicit, so a schema change breaks row parsing silently. | `error` | `none` |
-| `eslint:no-sentinel-return-on-catch` | Disallow swallowing a caught error by returning an empty sentinel unless the error is handled or the sentinel is part of the function contract. | `error` | `none` |
-| `eslint:no-silent-promise-catch` | Disallow `.catch()` and second-argument `.then()` handlers that silently swallow a rejection; log, rethrow, or handle the error. | `error` | `none` |
-| `eslint:no-sleep-in-test-body` | Disallow a fixed timed sleep directly in a test body; it flakes under CI load. Synchronize on the signal or use fake timers. | `error` | `none` |
-| `eslint:no-storage-in-stateless-modules` | Disallow SQL or key/value access inside configured stateless modules; derive state from a system of record instead. | `error` | `none` |
-| `eslint:no-string-concat-in-loop` | Disallow O(n^2) string building via `+=` on a string variable inside a loop; push parts to an array and `join` instead. | `error` | `none` |
-| `eslint:no-tautological-expect` | Disallow an assertion whose operands are all literals; its outcome is fixed before the code runs, so it can never fail. | `error` | `none` |
-| `eslint:no-trailing-value-narration` | Flag a trailing comment that repeats the line's numeric value only to name its unit. | `error` | `none` |
-| `eslint:no-type-member-comment-wall` | Flag an object type whose member comments mostly re-spell the members' own names and types. | `error` | `none` |
-| `eslint:no-typed-doc-sections` | Reject typed-signature repetition while preserving behavior that types cannot express. | `error` | `none` |
-| `eslint:no-union-in-comment` | Flag a comment that lists a `string` field's allowed values instead of the type listing them. | `error` | `none` |
-| `eslint:no-unnecessary-use-client` | Flag `'use client'` files with no hooks or event handlers — they could be RSC. | `error` | `none` |
-| `eslint:no-unsafe-mock-casting` | Disallow casting to mock types like `jest.Mock` or `vi.Mock`. Use `vi.mocked()` or `jest.mocked()` instead. | `error` | `none` |
-| `eslint:no-zod-native-enum` | Disallow `z.nativeEnum()` (and `z.enum()` over a TypeScript enum); use `z.enum(["a", "b"])` with a string-literal union instead. | `error` | `safe` |
-| `eslint:prefer-constant-time-secret-compare` | Disallow `===`/`!==` on a secret-like value; short-circuiting comparison leaks the secret through timing. Use a constant-time compare. | `error` | `none` |
-| `eslint:prefer-discriminated-union` | Flag flat result objects with a required positive boolean status and optional success/failure payloads. | `error` | `none` |
-| `eslint:prefer-immutable-module-constant` | Require module-level constant collections to expose readonly state. | `error` | `none` |
-| `eslint:prefer-input-group-search` | Require search icons and shared Input controls in the same visual wrapper to use InputGroup. | `error` | `none` |
-| `eslint:prefer-module-level-constant` | Hoist literal-only constant collections and regexes out of function bodies to module scope so they are allocated once. | `error` | `none` |
-| `eslint:prefer-module-level-schema` | Declare a Zod schema at module scope when it closes over nothing in the enclosing function | `error` | `none` |
-| `eslint:prefer-native-random-uuid` | Prefer `globalThis.crypto.randomUUID()` over resolved zero-argument UUID v4 bindings from the `uuid` package. | `error` | `suggestion` |
-| `eslint:prefer-non-nullable-collection` | Suggest non-null arrays only when local control flow proves the nullish state is equivalent to an empty collection. | `error` | `none` |
-| `eslint:prefer-schema-for-api-payload` | Require Zod (or similar) schema validation on `response.json()` / `JSON.parse()` results before property access. | `error` | `none` |
-| `eslint:prefer-semantic-colors` | Enforce semantic color tokens over raw Tailwind palette classes, arbitrary color values, and inline color literals. | `error` | `none` |
-| `eslint:prefer-server-actions` | Prefer Next.js Server Actions over /api/* mutations. | `error` | `none` |
-| `eslint:prefer-shadcn-primitives` | Require visible raw JSX controls to use the corresponding shared shadcn primitive. | `error` | `none` |
-| `eslint:prefer-whole-object-assertion` | Collapse consecutive assertions on one object into a whole-object assertion so related mismatches are reported together. | `error` | `safe` |
-| `eslint:prefer-zod-infer` | Derive a type from its Zod schema with `z.infer` instead of hand-writing a twin declaration beside it. | `error` | `none` |
-| `eslint:require-assert-never` | Require an empty switch default to call `assertNever` so discriminated unions remain exhaustive at compile time. | `error` | `none` |
-| `eslint:require-fetch-timeout` | Require an abort `signal` (e.g. `AbortSignal.timeout(ms)`) on global `fetch()` calls so stalled upstreams cannot hang the caller forever. | `error` | `none` |
-| `eslint:require-port-for-service` | Advise when an exported service with injected collaborators has public methods not covered by its declared ports. | `error` | `none` |
-| `eslint:require-static-next-matcher` | Require Next.js middleware and proxy matcher configuration to contain only build-time literals. | `error` | `none` |
-| `eslint:require-zod-form-validation` | Require Zod validation (`Schema.parse(...)` / `Schema.safeParse(...)`) when reading values out of a `FormData` object. | `error` | `none` |
-| `eslint:stepdown` | Place a private helper below its sole direct same-scope caller. | `error` | `none` |
-| `eslint:store-insert-requires-on-conflict` | Require an embedded SQL INSERT to carry ON CONFLICT; store writes replay under cron re-runs and queue redelivery and must be idempotent upserts. | `error` | `none` |
-| `eslint:test-loops-over-literal-cases` | Disallow assertions over an inline literal case loop in a test; parameterization reports and names every case independently. | `error` | `none` |
-| `eslint:zod-naming-convention` | Enforce a consistent Zod schema naming convention — a `Z` prefix (`ZUser`) or a `Schema` suffix (`userSchema`); both are accepted by default. | `error` | `none` |
-
-## Project links
-
-- [Homepage](https://code-standards.sarj.ai/rules/eslint/)
-
-Package metadata is generated from [`package.json`](package.json).
+[Documentation](https://code-standards.sarj.ai/rules/eslint/) · [Source](https://github.com/sarj-ai/standards)