@sarj/eslint-plugin 15.0.0 → 15.1.0

package/dist/index.cjs

@@ -2062,12 +2062,13 @@ function createSqlListener(handler) {
 
 // src/rules/no-dynamic-sql.ts
 var noDynamicSqlDocumentation = {
-  summary: "Disallow runtime interpolation or concatenation in SQL passed to statement-execution methods.",
+  summary: "Disallow runtime values embedded inside quoted SQL values passed to statement-execution methods.",
   rationale: "Embedding runtime values in SQL bypasses driver parameterization and can introduce injection defects or unstable query plans.",
   remediation: "Use SQL placeholders and pass runtime values through the driver's binding API.",
   category: "security",
   limitations: [
-    "The rule recognizes SQL by syntax and configured method names; static fragments and parameterizing tagged templates are exempt."
+    "The rule reports only visibly quoted runtime values; dynamic identifiers and unquoted fragments require provenance that syntax-only linting cannot prove.",
+    "Static fragments and parameterizing tagged templates are exempt."
   ],
   examples: [
     {
@@ -2102,27 +2103,48 @@ function isStaticFragment(expression) {
   if (expression.type === import_utils9.AST_NODE_TYPES.Literal) {
     return typeof expression.value === "string";
   }
+  if (expression.type === import_utils9.AST_NODE_TYPES.TemplateLiteral) {
+    return expression.expressions.length === 0;
+  }
   return false;
 }
 function runtimeInterpolations(template) {
   return template.expressions.filter(
-    (expression) => !isStaticFragment(expression)
+    (expression, index) => !isStaticFragment(expression) && endsWithSqlQuote(template.quasis[index]?.value.raw ?? "") && startsWithSqlQuote(template.quasis[index + 1]?.value.raw ?? "")
   );
 }
+function endsWithSqlQuote(text) {
+  return /['"]\s*$/u.test(text);
+}
+function startsWithSqlQuote(text) {
+  return /^\s*['"]/u.test(text);
+}
+function staticLiteralText(node) {
+  if (node.type === import_utils9.AST_NODE_TYPES.Literal && typeof node.value === "string") {
+    return node.value;
+  }
+  if (node.type === import_utils9.AST_NODE_TYPES.TemplateLiteral && node.expressions.length === 0) {
+    return node.quasis[0]?.value.raw;
+  }
+  return void 0;
+}
 function runtimeConcatOperands(node) {
   if (node.type !== import_utils9.AST_NODE_TYPES.BinaryExpression || node.operator !== "+") {
     return [];
   }
   const operands = concatOperands(node);
   const hasStringLiteral = operands.some(
-    (operand) => operand.type === import_utils9.AST_NODE_TYPES.Literal && typeof operand.value === "string"
+    (operand) => operand.type === import_utils9.AST_NODE_TYPES.Literal && typeof operand.value === "string" || operand.type === import_utils9.AST_NODE_TYPES.TemplateLiteral && operand.expressions.length === 0
   );
   if (!hasStringLiteral) {
     return [];
   }
-  return operands.filter(
-    (operand) => operand.type !== import_utils9.AST_NODE_TYPES.Literal && !isStaticFragment(operand)
-  );
+  return operands.filter((operand, index) => {
+    if (isStaticFragment(operand)) return false;
+    const before = operands[index - 1];
+    const after = operands[index + 1];
+    return before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "");
+  });
 }
 function concatOperands(node) {
   if (node.type === import_utils9.AST_NODE_TYPES.BinaryExpression && node.operator === "+") {
@@ -2161,7 +2183,7 @@ var no_dynamic_sql_default = createRule({
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow runtime interpolation or concatenation in SQL passed to statement-execution methods."
+      description: noDynamicSqlDocumentation.summary
     },
     schema: [
       {
@@ -2177,7 +2199,7 @@ var no_dynamic_sql_default = createRule({
       }
     ],
     messages: {
-      dynamicSql: "Runtime value built into a SQL statement passed to `{{method}}()`. Use a `?` placeholder and pass the value through `.bind(...)` so the driver parameterises it."
+      dynamicSql: "Runtime value embedded inside a quoted SQL value passed to `{{method}}()`. Replace the quoted interpolation with a placeholder and bind the value separately."
     }
   },
   defaultOptions: [{}],
@@ -3001,8 +3023,59 @@ var noInsecureRandomIdDocumentation = {
     { id: "predictable-token", title: "Do not derive a token from Math.random", outcome: "match", files: [{ path: "src/session.ts", source: "const sessionToken = Math.random();" }], focusPath: "src/session.ts", expectedCount: 1, public: true }
   ]
 };
-var STRONG_SECURITY_PATTERN = /token|secret|csrf|password|passwd|apikey|api[-_]?key|nonce|salt|uuid|authid/i;
-var NON_SECURITY_ID_PATTERN = /temp|tmp|cache|correlation|request|req|trace|execution|dev|hmr|mock|test|perf|marker|dialog|select|menu|tab|field|input|form|element|dom|aria|component/i;
+var STRONG_SECURITY_WORDS = /* @__PURE__ */ new Set([
+  "apikey",
+  "csrf",
+  "nonce",
+  "otp",
+  "password",
+  "passwd",
+  "pin",
+  "salt",
+  "secret",
+  "token",
+  "uuid",
+  "verificationcode"
+]);
+var NON_SECURITY_ID_WORDS = /* @__PURE__ */ new Set([
+  "aria",
+  "cache",
+  "component",
+  "correlation",
+  "dev",
+  "dialog",
+  "dom",
+  "element",
+  "execution",
+  "field",
+  "form",
+  "hmr",
+  "input",
+  "marker",
+  "menu",
+  "mock",
+  "perf",
+  "req",
+  "request",
+  "select",
+  "tab",
+  "temp",
+  "test",
+  "tmp",
+  "trace"
+]);
+function nameWords(name) {
+  return name.replaceAll(/([a-z0-9])([A-Z])/gu, "$1 $2").split(/[^A-Za-z0-9]+/u).filter(Boolean).map((word) => word.toLowerCase());
+}
+function isStrongSecurityName(name) {
+  const words = nameWords(name);
+  return words.some((word) => STRONG_SECURITY_WORDS.has(word)) || words.some(
+    (word, index) => word === "api" && words[index + 1] === "key" || word === "auth" && words[index + 1] === "id" || word === "verification" && words[index + 1] === "code"
+  );
+}
+function isNonSecurityName(name) {
+  return nameWords(name).some((word) => NON_SECURITY_ID_WORDS.has(word));
+}
 var PATH_OR_DOM_MARKER = /[\\/#]|\.[A-Za-z0-9]/;
 function isMathRandomCall(node) {
   if (node.type !== "CallExpression") {
@@ -3015,70 +3088,57 @@ function isMathRandomCall(node) {
   const { object, property } = callee;
   return object.type === "Identifier" && object.name === "Math" && property.type === "Identifier" && property.name === "random";
 }
-function isPartOfToString36Chain(node) {
-  let current = node;
-  let parent = current.parent;
-  while (parent) {
-    if (parent.type === "MemberExpression" && parent.object === current && !parent.computed && parent.property.type === "Identifier" && parent.property.name === "toString") {
-      const grandparent = parent.parent;
-      if (grandparent && grandparent.type === "CallExpression" && grandparent.callee === parent) {
-        const firstArg = grandparent.arguments[0];
-        if (firstArg && firstArg.type === "Literal" && firstArg.value === 36) {
-          return true;
-        }
-      }
-    }
-    if (parent.type === "MemberExpression" && parent.object === current) {
-      current = parent;
-      parent = current.parent;
-      continue;
-    }
-    if (parent.type === "CallExpression" && parent.callee === current) {
-      current = parent;
-      parent = current.parent;
-      continue;
-    }
-    break;
-  }
-  return false;
-}
-function findEnclosingName(node) {
+function findEnclosingNames(node) {
+  const names = [];
+  let directBinding = true;
   let current = node;
   let parent = current.parent;
   while (parent) {
     if (parent.type === "VariableDeclarator" && parent.init === current) {
-      if (parent.id.type === "Identifier") {
-        return parent.id.name;
+      if (directBinding && parent.id.type === "Identifier") {
+        names.push(parent.id.name);
       }
-      return void 0;
     }
     if (parent.type === "Property" && parent.value === current) {
       const key = parent.key;
       if (!parent.computed && key.type === "Identifier") {
-        return key.name;
+        names.push(key.name);
       }
       if (key.type === "Literal" && typeof key.value === "string") {
-        return key.value;
+        names.push(key.value);
       }
-      return void 0;
+      directBinding = false;
     }
     if (parent.type === "PropertyDefinition" && parent.value === current) {
       const key = parent.key;
       if (!parent.computed && key.type === "Identifier") {
-        return key.name;
+        names.push(key.name);
       }
       if (key.type === "Literal" && typeof key.value === "string") {
-        return key.value;
+        names.push(key.value);
       }
-      return void 0;
+      directBinding = false;
     }
-    if (parent.type === "FunctionDeclaration" || parent.type === "FunctionExpression" || parent.type === "ArrowFunctionExpression" || parent.type === "BlockStatement" || parent.type === "ReturnStatement" || parent.type === "ExpressionStatement") {
-      return void 0;
+    if (parent.type === "AssignmentExpression" && parent.right === current) {
+      if (directBinding && parent.left.type === "Identifier") names.push(parent.left.name);
+      if (directBinding && parent.left.type === "MemberExpression" && !parent.left.computed && parent.left.property.type === "Identifier") {
+        names.push(parent.left.property.name);
+      }
+    }
+    if (parent.type === "ObjectExpression" || parent.type === "ArrayExpression") {
+      directBinding = false;
+    }
+    if (parent.type === "FunctionDeclaration") {
+      if (directBinding && parent.id !== null) names.push(parent.id.name);
+      return names;
+    }
+    if (parent.type === "ExpressionStatement") {
+      return names;
     }
     current = parent;
     parent = current.parent;
   }
-  return void 0;
+  return names;
 }
 function isConcatenatedIntoPathOrDomId(node) {
   const valueNode = climbValueChain(node);
@@ -3164,20 +3224,17 @@ var no_insecure_random_id_default = createRule({
         if (!isMathRandomCall(node)) {
           return;
         }
-        const name = findEnclosingName(node);
-        if (name !== void 0 && STRONG_SECURITY_PATTERN.test(name)) {
+        const names = findEnclosingNames(node);
+        if (names.some(isStrongSecurityName)) {
           context.report({ node, messageId: "insecureRandomId" });
           return;
         }
-        if (name !== void 0 && NON_SECURITY_ID_PATTERN.test(name)) {
+        if (names.some(isNonSecurityName)) {
           return;
         }
         if (isConcatenatedIntoPathOrDomId(node)) {
           return;
         }
-        if (isPartOfToString36Chain(node)) {
-          context.report({ node, messageId: "insecureRandomId" });
-        }
       }
     };
   }
@@ -4839,7 +4896,8 @@ var DEFAULT_ALLOW = [
   "[\\\\/](connectors|providers|integrations|adapters|fetchers)[\\\\/]",
   "[\\\\/]notifications[\\\\/]",
   "[Ss]ervice\\.[cm]?[jt]sx?$",
-  "-(service|connector|adapter|sdk|fetcher)\\.[cm]?[jt]sx?$"
+  "-(service|connector|adapter|sdk|fetcher)\\.[cm]?[jt]sx?$",
+  "[\\\\/][^\\\\/]*(?:Client|client)\\.[cm]?[jt]sx?$"
 ];
 var NON_PRODUCTION_TREE_RE = /[\\/](playwright|cypress|__testfixtures__)[\\/]/;
 var GLOBAL_RECEIVERS = /* @__PURE__ */ new Set([
@@ -4973,7 +5031,7 @@ var no_raw_fetch_outside_clients_default = createRule({
   defaultOptions: [{}],
   create(context, [options]) {
     const filename = context.filename;
-    if (isTestFile(filename) || NON_PRODUCTION_TREE_RE.test(filename)) {
+    if (isTestFile(filename) || isScriptFile(filename) || NON_PRODUCTION_TREE_RE.test(filename)) {
       return {};
     }
     const patterns = options?.allow ?? DEFAULT_ALLOW;
@@ -5013,10 +5071,15 @@ var no_raw_fetch_outside_clients_default = createRule({
     function isInternalApiUrl(node) {
       const resolved = resolveNode2(node ?? void 0);
       if (resolved?.type === import_utils25.AST_NODE_TYPES.Literal) {
-        return typeof resolved.value === "string" && resolved.value.startsWith("/api/");
+        return typeof resolved.value === "string" && /^\/(?!\/)(?:[^/]+\/)*api(?:\/|$)/.test(resolved.value);
       }
       if (resolved?.type === import_utils25.AST_NODE_TYPES.TemplateLiteral) {
-        return resolved.quasis[0]?.value.cooked?.startsWith("/api/") === true;
+        const prefix = resolved.quasis[0]?.value.cooked;
+        return typeof prefix === "string" && /^\/(?!\/)(?:[^/]+\/)*api(?:\/|$)/.test(prefix);
+      }
+      if (resolved?.type === import_utils25.AST_NODE_TYPES.CallExpression && resolved.callee.type === import_utils25.AST_NODE_TYPES.Identifier && resolved.callee.name === "withBase") {
+        const first = resolved.arguments[0];
+        return first !== void 0 && first.type !== import_utils25.AST_NODE_TYPES.SpreadElement ? isInternalApiUrl(first) : false;
       }
       return resolved?.type === import_utils25.AST_NODE_TYPES.BinaryExpression && resolved.operator === "+" && isInternalApiUrl(resolved.left);
     }
@@ -5860,12 +5923,17 @@ var BLOB_REDACTION_TOKENS = /* @__PURE__ */ new Set([
   "public"
 ]);
 function rawBlobValueName(value) {
+  if (value.type === "AwaitExpression") return rawBlobValueName(value.argument);
+  if (value.type === "ChainExpression") return rawBlobValueName(value.expression);
   if (value.type === "Identifier") {
     return isRawBlobName(value.name) ? value.name : null;
   }
   if (value.type === "MemberExpression" && !value.computed && value.property.type === "Identifier") {
     return isRawBlobName(value.property.name) ? value.property.name : null;
   }
+  if (value.type === "CallExpression" && value.arguments.length === 0 && value.callee.type === "MemberExpression" && !value.callee.computed && value.callee.object.type === "Identifier" && /^(?:res|response|\w+Response)$/.test(value.callee.object.name) && value.callee.property.type === "Identifier" && (value.callee.property.name === "json" || value.callee.property.name === "text")) {
+    return `${value.callee.object.name}.${value.callee.property.name}()`;
+  }
   return null;
 }
 function isRawBlobName(name) {
@@ -6530,6 +6598,9 @@ var isExplanatory = (comment) => !DIRECTIVE_COMMENT_RE.test(comment.value);
 function isTeardownCall(node) {
   return node.type === import_utils33.AST_NODE_TYPES.CallExpression && node.callee.type === import_utils33.AST_NODE_TYPES.MemberExpression && !node.callee.computed && node.callee.property.type === import_utils33.AST_NODE_TYPES.Identifier && TEARDOWN_METHODS.has(node.callee.property.name);
 }
+function isCancelledWebShare(node) {
+  return node.type === import_utils33.AST_NODE_TYPES.CallExpression && node.callee.type === import_utils33.AST_NODE_TYPES.MemberExpression && !node.callee.computed && node.callee.object.type === import_utils33.AST_NODE_TYPES.Identifier && node.callee.object.name === "navigator" && node.callee.property.type === import_utils33.AST_NODE_TYPES.Identifier && node.callee.property.name === "share";
+}
 function isSilentHandler(handler) {
   const body2 = handler.body;
   if (body2.type !== import_utils33.AST_NODE_TYPES.BlockStatement) {
@@ -6579,7 +6650,7 @@ var no_silent_promise_catch_default = createRule({
   },
   defaultOptions: [],
   create(context) {
-    if (isTestFile(context.filename)) {
+    if (isTestFile(context.filename) || isScriptFile(context.filename)) {
       return {};
     }
     const hasExplanatoryComment = (call, handler) => {
@@ -6612,7 +6683,10 @@ var no_silent_promise_catch_default = createRule({
         if (isTeardownCall(node.callee.object)) {
           return;
         }
-        if (node.parent.type === import_utils33.AST_NODE_TYPES.MemberExpression && node.parent.object === node) {
+        if (isCancelledWebShare(node.callee.object)) {
+          return;
+        }
+        if (node.parent.type === import_utils33.AST_NODE_TYPES.MemberExpression && node.parent.object === node && !node.parent.computed && node.parent.property.type === import_utils33.AST_NODE_TYPES.Identifier && node.parent.property.name === "then") {
           return;
         }
         const expectedArguments = method === "catch" ? 1 : 2;
@@ -6924,7 +6998,20 @@ function isStringInitializedVariable(variable) {
   if (declarator.type !== "VariableDeclarator") {
     return false;
   }
-  return isStringLiteralInit(declarator.init);
+  if (isStringLiteralInit(declarator.init)) return true;
+  if (declarator.id.type === "Identifier" && declarator.id.typeAnnotation?.typeAnnotation.type === "TSStringKeyword") {
+    return true;
+  }
+  return isTemplateStringsArrayElement(declarator.init, variable.scope);
+}
+function isTemplateStringsArrayElement(node, scope) {
+  if (node?.type !== "MemberExpression" || !node.computed || node.object.type !== "Identifier") {
+    return false;
+  }
+  const source = findVariable(scope, node.object.name);
+  if (source?.defs.length !== 1) return false;
+  const name = source.defs[0]?.name;
+  return name?.type === "Identifier" && name.typeAnnotation?.typeAnnotation.type === "TSTypeReference" && name.typeAnnotation.typeAnnotation.typeName.type === "Identifier" && name.typeAnnotation.typeAnnotation.typeName.name === "TemplateStringsArray";
 }
 function isStringLiteralInit(node) {
   if (node === null) {
@@ -6958,12 +7045,13 @@ function isConcatOperand(node, target) {
   }
   return false;
 }
-function isDeclaredInsideLoop(variable, loop) {
+function isDeclaredInsideLoop(variable, repetition) {
   const def = variable.defs[0];
   if (def === void 0) {
     return false;
   }
-  const body2 = loop.body;
+  const body2 = repetition.type === "CallExpression" ? repetition.arguments[0] : repetition.body;
+  if (body2 === void 0 || body2.type === "SpreadElement") return false;
   const [declStart, declEnd] = def.node.range;
   const [bodyStart, bodyEnd] = body2.range;
   return declStart >= bodyStart && declEnd <= bodyEnd;
@@ -6972,6 +7060,9 @@ function enclosingLoop(node) {
   let child = node;
   let parent = node.parent;
   while (parent !== void 0 && parent !== null) {
+    if ((parent.type === "ArrowFunctionExpression" || parent.type === "FunctionExpression") && parent.parent.type === "CallExpression" && parent.parent.arguments[0] === parent && parent.parent.callee.type === "MemberExpression" && !parent.parent.callee.computed && parent.parent.callee.property.type === "Identifier" && parent.parent.callee.property.name === "forEach") {
+      return parent.parent;
+    }
     if (LOOP_NODE_TYPES.has(parent.type)) {
       const loop = parent;
       if (loop.body === child) {
@@ -6983,6 +7074,17 @@ function enclosingLoop(node) {
   }
   return null;
 }
+function isSmallStaticForLoop(node) {
+  if (node.type !== "ForStatement" || node.init?.type !== "VariableDeclaration" || node.init.declarations.length !== 1 || node.test?.type !== "BinaryExpression" || node.test.operator !== "<" && node.test.operator !== "<=" || node.update?.type !== "UpdateExpression" || node.update.operator !== "++") {
+    return false;
+  }
+  const declaration = node.init.declarations[0];
+  if (declaration?.id.type !== "Identifier" || declaration.init?.type !== "Literal" || typeof declaration.init.value !== "number" || !Number.isInteger(declaration.init.value) || node.test.left.type !== "Identifier" || node.test.left.name !== declaration.id.name || node.test.right.type !== "Literal" || typeof node.test.right.value !== "number" || !Number.isInteger(node.test.right.value) || node.update.argument.type !== "Identifier" || node.update.argument.name !== declaration.id.name) {
+    return false;
+  }
+  const iterations = node.test.right.value - declaration.init.value + (node.test.operator === "<=" ? 1 : 0);
+  return iterations >= 0 && iterations <= 8;
+}
 var no_string_concat_in_loop_default = createRule({
   name: "no-string-concat-in-loop",
   documentation: noStringConcatInLoopDocumentation,
@@ -7015,6 +7117,9 @@ var no_string_concat_in_loop_default = createRule({
         if (loop === null) {
           return;
         }
+        if (isSmallStaticForLoop(loop)) {
+          return;
+        }
         const scope = context.sourceCode.getScope(node);
         const variable = findVariable(scope, node.left.name);
         if (variable === void 0) {
@@ -8862,8 +8967,10 @@ function looksLikeMutuallyExclusiveState(typeLiteral) {
   let statusMemberCount = 0;
   let hasFailurePayload = false;
   let hasSuccessPayload = false;
+  let hasUnrecognizedMember = false;
   for (const member of typeLiteral.members) {
     if (member.type !== import_utils49.AST_NODE_TYPES.TSPropertySignature) {
+      hasUnrecognizedMember = true;
       continue;
     }
     const name = getMemberName(member);
@@ -8872,15 +8979,18 @@ function looksLikeMutuallyExclusiveState(typeLiteral) {
       continue;
     }
     if (!member.optional || isBooleanTyped(member) || name === null) {
+      hasUnrecognizedMember = true;
       continue;
     }
     if (FAILURE_MEMBER_NAMES.has(name)) {
       hasFailurePayload = true;
     } else if (SUCCESS_PAYLOAD_MEMBER_NAMES.has(name)) {
       hasSuccessPayload = true;
+    } else {
+      hasUnrecognizedMember = true;
     }
   }
-  return statusMemberCount === REQUIRED_STATUS_MEMBER_COUNT && hasFailurePayload && hasSuccessPayload;
+  return statusMemberCount === REQUIRED_STATUS_MEMBER_COUNT && hasFailurePayload && (hasSuccessPayload || !hasUnrecognizedMember);
 }
 function getMemberName(member) {
   if (member.type !== import_utils49.AST_NODE_TYPES.TSPropertySignature) {
@@ -10781,7 +10891,7 @@ var prefer_schema_for_api_payload_default = createRule({
   },
   defaultOptions: [],
   create(context) {
-    if (isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) {
+    if (isTestFile(context.filename) || isScriptFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) {
       return {};
     }
     const unvalidatedVariables = /* @__PURE__ */ new Set();
@@ -12433,6 +12543,26 @@ var require_fetch_timeout_default = createRule({
       }
       return callee.type === import_utils63.AST_NODE_TYPES.MemberExpression && !callee.computed && callee.property.type === import_utils63.AST_NODE_TYPES.Identifier && callee.property.name === "fetch" && callee.object.type === import_utils63.AST_NODE_TYPES.Identifier && GLOBAL_OBJECTS2.has(callee.object.name) && resolvesToGlobal(callee.object);
     }
+    function localConstInitProvablyLacksSignal(identifier) {
+      const variable = import_utils63.ASTUtils.findVariable(
+        context.sourceCode.getScope(identifier),
+        identifier.name
+      );
+      if (variable?.defs.length !== 1) return false;
+      const definition = variable.defs[0];
+      if (definition?.type !== "Variable" || definition.parent.kind !== "const" || definition.node.init?.type !== import_utils63.AST_NODE_TYPES.ObjectExpression || !initProvablyLacksSignal(definition.node.init)) {
+        return false;
+      }
+      for (const reference of variable.references) {
+        const ref = reference.identifier;
+        if (ref === identifier || ref === definition.name) continue;
+        const member = ref.parent;
+        if (member.type !== import_utils63.AST_NODE_TYPES.MemberExpression || member.object !== ref || member.computed || member.property.type !== import_utils63.AST_NODE_TYPES.Identifier || member.property.name === "signal" || member.parent.type !== import_utils63.AST_NODE_TYPES.AssignmentExpression || member.parent.left !== member) {
+          return false;
+        }
+      }
+      return true;
+    }
     return {
       CallExpression(node) {
         if (!isGlobalFetchCall2(node.callee)) {
@@ -12442,7 +12572,7 @@ var require_fetch_timeout_default = createRule({
         if (node.arguments.length === 1 && first !== void 0 && !isInlineUrl(first, resolvesToGlobal)) {
           return;
         }
-        if (init === void 0 || initProvablyLacksSignal(init)) {
+        if (init === void 0 || initProvablyLacksSignal(init) || init.type === import_utils63.AST_NODE_TYPES.Identifier && localConstInitProvablyLacksSignal(init)) {
           context.report({ node, messageId: "missingSignal" });
         }
       }
@@ -13197,8 +13327,8 @@ var require_zod_form_validation_default = createRule({
 // src/rules/store-insert-requires-on-conflict.ts
 var import_utils67 = require("@typescript-eslint/utils");
 var storeInsertRequiresOnConflictDocumentation = {
-  summary: "Require an embedded SQL INSERT to carry ON CONFLICT; store writes replay under cron re-runs and queue redelivery and must be idempotent upserts.",
-  rationale: "A replayed bare insert can duplicate data or fail on a uniqueness constraint.",
+  summary: "Require embedded inserts in explicitly replayable callables to carry conflict handling.",
+  rationale: "A callable named as an enqueue, seed, migration, schedule, ensure, or upsert promises replay safety.",
   remediation: "Add an appropriate `ON CONFLICT` action or supported replay-safe insert form.",
   category: "correctness",
   examples: [
@@ -13207,7 +13337,25 @@ var storeInsertRequiresOnConflictDocumentation = {
   ]
 };
 var INSERT_WRITE = /\bINSERT\s+(?:OR\s+\w+\s+)?INTO\s+[\w."'`?$:@-]+\s*(?:\([^)]*\)\s*)?(?:VALUES|SELECT|DEFAULT\s+VALUES)\b/i;
-var CONFLICT_HANDLED = /\bON\s+CONFLICT\b|\bON\s+DUPLICATE\s+KEY\b|\bINSERT\s+OR\s+(?:IGNORE|REPLACE)\b/i;
+var CONFLICT_HANDLED = /\bON\s+CONFLICT\b|\bON\s+DUPLICATE\s+KEY\b|\bINSERT\s+OR\s+(?:IGNORE|REPLACE)\b|\bINSERT\b[\s\S]*?\bSELECT\b[\s\S]*?\bWHERE\s+NOT\s+EXISTS\b/i;
+var REPLAY_CONTRACT_NAME = /(?:enqueue|ensure|migrate|recordOnce|schedule|seed|upsert|getOrCreate|createIfAbsent|insertIfAbsent)/i;
+function owningCallableName(node) {
+  for (let current = node.parent; current !== null && current !== void 0; current = current.parent) {
+    if (current.type === "FunctionDeclaration") {
+      return current.id?.name ?? null;
+    }
+    if (current.type === "MethodDefinition") {
+      return current.key.type === "Identifier" ? current.key.name : null;
+    }
+    if ((current.type === "ArrowFunctionExpression" || current.type === "FunctionExpression") && current.parent.type === "VariableDeclarator" && current.parent.id.type === "Identifier") {
+      return current.parent.id.name;
+    }
+    if ((current.type === "ArrowFunctionExpression" || current.type === "FunctionExpression") && current.parent.type === "Property" && current.parent.key.type === "Identifier") {
+      return current.parent.key.name;
+    }
+  }
+  return null;
+}
 var INSERT_GATE = /insert/i;
 var store_insert_requires_on_conflict_default = createRule({
   name: "store-insert-requires-on-conflict",
@@ -13215,7 +13363,7 @@ var store_insert_requires_on_conflict_default = createRule({
   meta: {
     type: "problem",
     docs: {
-      description: "Require an embedded SQL INSERT to carry ON CONFLICT; store writes replay under cron re-runs and queue redelivery and must be idempotent upserts."
+      description: "Require embedded inserts in explicitly replayable callables to carry conflict handling."
     },
     schema: [],
     messages: {
@@ -13231,6 +13379,10 @@ var store_insert_requires_on_conflict_default = createRule({
       if (!INSERT_WRITE.test(sql) || CONFLICT_HANDLED.test(sql)) {
         return;
       }
+      const owner = owningCallableName(node);
+      if (owner !== null && !REPLAY_CONTRACT_NAME.test(owner)) {
+        return;
+      }
       context.report({ node, messageId: "storeInsertRequiresOnConflict" });
     });
   }
@@ -13917,7 +14069,7 @@ var rules = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.0.0"
+  version: "15.1.0"
 };
 var applicationOnlyRules = [
   "no-restricted-library-load",

package/dist/index.d.cts

@@ -414,7 +414,7 @@ type FlatPreset = {
 declare const plugin: {
     readonly meta: {
         readonly name: "@sarj/eslint-plugin";
-        readonly version: "15.0.0";
+        readonly version: "15.1.0";
     };
     readonly rules: {
         readonly "duplicate-test-body": DocumentedRule<readonly [], "duplicateTestBody">;

package/dist/index.d.ts

@@ -414,7 +414,7 @@ type FlatPreset = {
 declare const plugin: {
     readonly meta: {
         readonly name: "@sarj/eslint-plugin";
-        readonly version: "15.0.0";
+        readonly version: "15.1.0";
     };
     readonly rules: {
         readonly "duplicate-test-body": DocumentedRule<readonly [], "duplicateTestBody">;

package/dist/index.js

@@ -2022,12 +2022,13 @@ function createSqlListener(handler) {
 
 // src/rules/no-dynamic-sql.ts
 var noDynamicSqlDocumentation = {
-  summary: "Disallow runtime interpolation or concatenation in SQL passed to statement-execution methods.",
+  summary: "Disallow runtime values embedded inside quoted SQL values passed to statement-execution methods.",
   rationale: "Embedding runtime values in SQL bypasses driver parameterization and can introduce injection defects or unstable query plans.",
   remediation: "Use SQL placeholders and pass runtime values through the driver's binding API.",
   category: "security",
   limitations: [
-    "The rule recognizes SQL by syntax and configured method names; static fragments and parameterizing tagged templates are exempt."
+    "The rule reports only visibly quoted runtime values; dynamic identifiers and unquoted fragments require provenance that syntax-only linting cannot prove.",
+    "Static fragments and parameterizing tagged templates are exempt."
   ],
   examples: [
     {
@@ -2062,27 +2063,48 @@ function isStaticFragment(expression) {
   if (expression.type === AST_NODE_TYPES8.Literal) {
     return typeof expression.value === "string";
   }
+  if (expression.type === AST_NODE_TYPES8.TemplateLiteral) {
+    return expression.expressions.length === 0;
+  }
   return false;
 }
 function runtimeInterpolations(template) {
   return template.expressions.filter(
-    (expression) => !isStaticFragment(expression)
+    (expression, index) => !isStaticFragment(expression) && endsWithSqlQuote(template.quasis[index]?.value.raw ?? "") && startsWithSqlQuote(template.quasis[index + 1]?.value.raw ?? "")
   );
 }
+function endsWithSqlQuote(text) {
+  return /['"]\s*$/u.test(text);
+}
+function startsWithSqlQuote(text) {
+  return /^\s*['"]/u.test(text);
+}
+function staticLiteralText(node) {
+  if (node.type === AST_NODE_TYPES8.Literal && typeof node.value === "string") {
+    return node.value;
+  }
+  if (node.type === AST_NODE_TYPES8.TemplateLiteral && node.expressions.length === 0) {
+    return node.quasis[0]?.value.raw;
+  }
+  return void 0;
+}
 function runtimeConcatOperands(node) {
   if (node.type !== AST_NODE_TYPES8.BinaryExpression || node.operator !== "+") {
     return [];
   }
   const operands = concatOperands(node);
   const hasStringLiteral = operands.some(
-    (operand) => operand.type === AST_NODE_TYPES8.Literal && typeof operand.value === "string"
+    (operand) => operand.type === AST_NODE_TYPES8.Literal && typeof operand.value === "string" || operand.type === AST_NODE_TYPES8.TemplateLiteral && operand.expressions.length === 0
   );
   if (!hasStringLiteral) {
     return [];
   }
-  return operands.filter(
-    (operand) => operand.type !== AST_NODE_TYPES8.Literal && !isStaticFragment(operand)
-  );
+  return operands.filter((operand, index) => {
+    if (isStaticFragment(operand)) return false;
+    const before = operands[index - 1];
+    const after = operands[index + 1];
+    return before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "");
+  });
 }
 function concatOperands(node) {
   if (node.type === AST_NODE_TYPES8.BinaryExpression && node.operator === "+") {
@@ -2121,7 +2143,7 @@ var no_dynamic_sql_default = createRule({
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow runtime interpolation or concatenation in SQL passed to statement-execution methods."
+      description: noDynamicSqlDocumentation.summary
     },
     schema: [
       {
@@ -2137,7 +2159,7 @@ var no_dynamic_sql_default = createRule({
       }
     ],
     messages: {
-      dynamicSql: "Runtime value built into a SQL statement passed to `{{method}}()`. Use a `?` placeholder and pass the value through `.bind(...)` so the driver parameterises it."
+      dynamicSql: "Runtime value embedded inside a quoted SQL value passed to `{{method}}()`. Replace the quoted interpolation with a placeholder and bind the value separately."
     }
   },
   defaultOptions: [{}],
@@ -2961,8 +2983,59 @@ var noInsecureRandomIdDocumentation = {
     { id: "predictable-token", title: "Do not derive a token from Math.random", outcome: "match", files: [{ path: "src/session.ts", source: "const sessionToken = Math.random();" }], focusPath: "src/session.ts", expectedCount: 1, public: true }
   ]
 };
-var STRONG_SECURITY_PATTERN = /token|secret|csrf|password|passwd|apikey|api[-_]?key|nonce|salt|uuid|authid/i;
-var NON_SECURITY_ID_PATTERN = /temp|tmp|cache|correlation|request|req|trace|execution|dev|hmr|mock|test|perf|marker|dialog|select|menu|tab|field|input|form|element|dom|aria|component/i;
+var STRONG_SECURITY_WORDS = /* @__PURE__ */ new Set([
+  "apikey",
+  "csrf",
+  "nonce",
+  "otp",
+  "password",
+  "passwd",
+  "pin",
+  "salt",
+  "secret",
+  "token",
+  "uuid",
+  "verificationcode"
+]);
+var NON_SECURITY_ID_WORDS = /* @__PURE__ */ new Set([
+  "aria",
+  "cache",
+  "component",
+  "correlation",
+  "dev",
+  "dialog",
+  "dom",
+  "element",
+  "execution",
+  "field",
+  "form",
+  "hmr",
+  "input",
+  "marker",
+  "menu",
+  "mock",
+  "perf",
+  "req",
+  "request",
+  "select",
+  "tab",
+  "temp",
+  "test",
+  "tmp",
+  "trace"
+]);
+function nameWords(name) {
+  return name.replaceAll(/([a-z0-9])([A-Z])/gu, "$1 $2").split(/[^A-Za-z0-9]+/u).filter(Boolean).map((word) => word.toLowerCase());
+}
+function isStrongSecurityName(name) {
+  const words = nameWords(name);
+  return words.some((word) => STRONG_SECURITY_WORDS.has(word)) || words.some(
+    (word, index) => word === "api" && words[index + 1] === "key" || word === "auth" && words[index + 1] === "id" || word === "verification" && words[index + 1] === "code"
+  );
+}
+function isNonSecurityName(name) {
+  return nameWords(name).some((word) => NON_SECURITY_ID_WORDS.has(word));
+}
 var PATH_OR_DOM_MARKER = /[\\/#]|\.[A-Za-z0-9]/;
 function isMathRandomCall(node) {
   if (node.type !== "CallExpression") {
@@ -2975,70 +3048,57 @@ function isMathRandomCall(node) {
   const { object, property } = callee;
   return object.type === "Identifier" && object.name === "Math" && property.type === "Identifier" && property.name === "random";
 }
-function isPartOfToString36Chain(node) {
-  let current = node;
-  let parent = current.parent;
-  while (parent) {
-    if (parent.type === "MemberExpression" && parent.object === current && !parent.computed && parent.property.type === "Identifier" && parent.property.name === "toString") {
-      const grandparent = parent.parent;
-      if (grandparent && grandparent.type === "CallExpression" && grandparent.callee === parent) {
-        const firstArg = grandparent.arguments[0];
-        if (firstArg && firstArg.type === "Literal" && firstArg.value === 36) {
-          return true;
-        }
-      }
-    }
-    if (parent.type === "MemberExpression" && parent.object === current) {
-      current = parent;
-      parent = current.parent;
-      continue;
-    }
-    if (parent.type === "CallExpression" && parent.callee === current) {
-      current = parent;
-      parent = current.parent;
-      continue;
-    }
-    break;
-  }
-  return false;
-}
-function findEnclosingName(node) {
+function findEnclosingNames(node) {
+  const names = [];
+  let directBinding = true;
   let current = node;
   let parent = current.parent;
   while (parent) {
     if (parent.type === "VariableDeclarator" && parent.init === current) {
-      if (parent.id.type === "Identifier") {
-        return parent.id.name;
+      if (directBinding && parent.id.type === "Identifier") {
+        names.push(parent.id.name);
       }
-      return void 0;
     }
     if (parent.type === "Property" && parent.value === current) {
       const key = parent.key;
       if (!parent.computed && key.type === "Identifier") {
-        return key.name;
+        names.push(key.name);
       }
       if (key.type === "Literal" && typeof key.value === "string") {
-        return key.value;
+        names.push(key.value);
       }
-      return void 0;
+      directBinding = false;
     }
     if (parent.type === "PropertyDefinition" && parent.value === current) {
       const key = parent.key;
       if (!parent.computed && key.type === "Identifier") {
-        return key.name;
+        names.push(key.name);
       }
       if (key.type === "Literal" && typeof key.value === "string") {
-        return key.value;
+        names.push(key.value);
       }
-      return void 0;
+      directBinding = false;
     }
-    if (parent.type === "FunctionDeclaration" || parent.type === "FunctionExpression" || parent.type === "ArrowFunctionExpression" || parent.type === "BlockStatement" || parent.type === "ReturnStatement" || parent.type === "ExpressionStatement") {
-      return void 0;
+    if (parent.type === "AssignmentExpression" && parent.right === current) {
+      if (directBinding && parent.left.type === "Identifier") names.push(parent.left.name);
+      if (directBinding && parent.left.type === "MemberExpression" && !parent.left.computed && parent.left.property.type === "Identifier") {
+        names.push(parent.left.property.name);
+      }
+    }
+    if (parent.type === "ObjectExpression" || parent.type === "ArrayExpression") {
+      directBinding = false;
+    }
+    if (parent.type === "FunctionDeclaration") {
+      if (directBinding && parent.id !== null) names.push(parent.id.name);
+      return names;
+    }
+    if (parent.type === "ExpressionStatement") {
+      return names;
     }
     current = parent;
     parent = current.parent;
   }
-  return void 0;
+  return names;
 }
 function isConcatenatedIntoPathOrDomId(node) {
   const valueNode = climbValueChain(node);
@@ -3124,20 +3184,17 @@ var no_insecure_random_id_default = createRule({
         if (!isMathRandomCall(node)) {
           return;
         }
-        const name = findEnclosingName(node);
-        if (name !== void 0 && STRONG_SECURITY_PATTERN.test(name)) {
+        const names = findEnclosingNames(node);
+        if (names.some(isStrongSecurityName)) {
           context.report({ node, messageId: "insecureRandomId" });
           return;
         }
-        if (name !== void 0 && NON_SECURITY_ID_PATTERN.test(name)) {
+        if (names.some(isNonSecurityName)) {
           return;
         }
         if (isConcatenatedIntoPathOrDomId(node)) {
           return;
         }
-        if (isPartOfToString36Chain(node)) {
-          context.report({ node, messageId: "insecureRandomId" });
-        }
       }
     };
   }
@@ -4801,7 +4858,8 @@ var DEFAULT_ALLOW = [
   "[\\\\/](connectors|providers|integrations|adapters|fetchers)[\\\\/]",
   "[\\\\/]notifications[\\\\/]",
   "[Ss]ervice\\.[cm]?[jt]sx?$",
-  "-(service|connector|adapter|sdk|fetcher)\\.[cm]?[jt]sx?$"
+  "-(service|connector|adapter|sdk|fetcher)\\.[cm]?[jt]sx?$",
+  "[\\\\/][^\\\\/]*(?:Client|client)\\.[cm]?[jt]sx?$"
 ];
 var NON_PRODUCTION_TREE_RE = /[\\/](playwright|cypress|__testfixtures__)[\\/]/;
 var GLOBAL_RECEIVERS = /* @__PURE__ */ new Set([
@@ -4935,7 +4993,7 @@ var no_raw_fetch_outside_clients_default = createRule({
   defaultOptions: [{}],
   create(context, [options]) {
     const filename = context.filename;
-    if (isTestFile(filename) || NON_PRODUCTION_TREE_RE.test(filename)) {
+    if (isTestFile(filename) || isScriptFile(filename) || NON_PRODUCTION_TREE_RE.test(filename)) {
       return {};
     }
     const patterns = options?.allow ?? DEFAULT_ALLOW;
@@ -4975,10 +5033,15 @@ var no_raw_fetch_outside_clients_default = createRule({
     function isInternalApiUrl(node) {
       const resolved = resolveNode2(node ?? void 0);
       if (resolved?.type === AST_NODE_TYPES18.Literal) {
-        return typeof resolved.value === "string" && resolved.value.startsWith("/api/");
+        return typeof resolved.value === "string" && /^\/(?!\/)(?:[^/]+\/)*api(?:\/|$)/.test(resolved.value);
       }
       if (resolved?.type === AST_NODE_TYPES18.TemplateLiteral) {
-        return resolved.quasis[0]?.value.cooked?.startsWith("/api/") === true;
+        const prefix = resolved.quasis[0]?.value.cooked;
+        return typeof prefix === "string" && /^\/(?!\/)(?:[^/]+\/)*api(?:\/|$)/.test(prefix);
+      }
+      if (resolved?.type === AST_NODE_TYPES18.CallExpression && resolved.callee.type === AST_NODE_TYPES18.Identifier && resolved.callee.name === "withBase") {
+        const first = resolved.arguments[0];
+        return first !== void 0 && first.type !== AST_NODE_TYPES18.SpreadElement ? isInternalApiUrl(first) : false;
       }
       return resolved?.type === AST_NODE_TYPES18.BinaryExpression && resolved.operator === "+" && isInternalApiUrl(resolved.left);
     }
@@ -5822,12 +5885,17 @@ var BLOB_REDACTION_TOKENS = /* @__PURE__ */ new Set([
   "public"
 ]);
 function rawBlobValueName(value) {
+  if (value.type === "AwaitExpression") return rawBlobValueName(value.argument);
+  if (value.type === "ChainExpression") return rawBlobValueName(value.expression);
   if (value.type === "Identifier") {
     return isRawBlobName(value.name) ? value.name : null;
   }
   if (value.type === "MemberExpression" && !value.computed && value.property.type === "Identifier") {
     return isRawBlobName(value.property.name) ? value.property.name : null;
   }
+  if (value.type === "CallExpression" && value.arguments.length === 0 && value.callee.type === "MemberExpression" && !value.callee.computed && value.callee.object.type === "Identifier" && /^(?:res|response|\w+Response)$/.test(value.callee.object.name) && value.callee.property.type === "Identifier" && (value.callee.property.name === "json" || value.callee.property.name === "text")) {
+    return `${value.callee.object.name}.${value.callee.property.name}()`;
+  }
   return null;
 }
 function isRawBlobName(name) {
@@ -6492,6 +6560,9 @@ var isExplanatory = (comment) => !DIRECTIVE_COMMENT_RE.test(comment.value);
 function isTeardownCall(node) {
   return node.type === AST_NODE_TYPES24.CallExpression && node.callee.type === AST_NODE_TYPES24.MemberExpression && !node.callee.computed && node.callee.property.type === AST_NODE_TYPES24.Identifier && TEARDOWN_METHODS.has(node.callee.property.name);
 }
+function isCancelledWebShare(node) {
+  return node.type === AST_NODE_TYPES24.CallExpression && node.callee.type === AST_NODE_TYPES24.MemberExpression && !node.callee.computed && node.callee.object.type === AST_NODE_TYPES24.Identifier && node.callee.object.name === "navigator" && node.callee.property.type === AST_NODE_TYPES24.Identifier && node.callee.property.name === "share";
+}
 function isSilentHandler(handler) {
   const body2 = handler.body;
   if (body2.type !== AST_NODE_TYPES24.BlockStatement) {
@@ -6541,7 +6612,7 @@ var no_silent_promise_catch_default = createRule({
   },
   defaultOptions: [],
   create(context) {
-    if (isTestFile(context.filename)) {
+    if (isTestFile(context.filename) || isScriptFile(context.filename)) {
       return {};
     }
     const hasExplanatoryComment = (call, handler) => {
@@ -6574,7 +6645,10 @@ var no_silent_promise_catch_default = createRule({
         if (isTeardownCall(node.callee.object)) {
           return;
         }
-        if (node.parent.type === AST_NODE_TYPES24.MemberExpression && node.parent.object === node) {
+        if (isCancelledWebShare(node.callee.object)) {
+          return;
+        }
+        if (node.parent.type === AST_NODE_TYPES24.MemberExpression && node.parent.object === node && !node.parent.computed && node.parent.property.type === AST_NODE_TYPES24.Identifier && node.parent.property.name === "then") {
           return;
         }
         const expectedArguments = method === "catch" ? 1 : 2;
@@ -6886,7 +6960,20 @@ function isStringInitializedVariable(variable) {
   if (declarator.type !== "VariableDeclarator") {
     return false;
   }
-  return isStringLiteralInit(declarator.init);
+  if (isStringLiteralInit(declarator.init)) return true;
+  if (declarator.id.type === "Identifier" && declarator.id.typeAnnotation?.typeAnnotation.type === "TSStringKeyword") {
+    return true;
+  }
+  return isTemplateStringsArrayElement(declarator.init, variable.scope);
+}
+function isTemplateStringsArrayElement(node, scope) {
+  if (node?.type !== "MemberExpression" || !node.computed || node.object.type !== "Identifier") {
+    return false;
+  }
+  const source = findVariable(scope, node.object.name);
+  if (source?.defs.length !== 1) return false;
+  const name = source.defs[0]?.name;
+  return name?.type === "Identifier" && name.typeAnnotation?.typeAnnotation.type === "TSTypeReference" && name.typeAnnotation.typeAnnotation.typeName.type === "Identifier" && name.typeAnnotation.typeAnnotation.typeName.name === "TemplateStringsArray";
 }
 function isStringLiteralInit(node) {
   if (node === null) {
@@ -6920,12 +7007,13 @@ function isConcatOperand(node, target) {
   }
   return false;
 }
-function isDeclaredInsideLoop(variable, loop) {
+function isDeclaredInsideLoop(variable, repetition) {
   const def = variable.defs[0];
   if (def === void 0) {
     return false;
   }
-  const body2 = loop.body;
+  const body2 = repetition.type === "CallExpression" ? repetition.arguments[0] : repetition.body;
+  if (body2 === void 0 || body2.type === "SpreadElement") return false;
   const [declStart, declEnd] = def.node.range;
   const [bodyStart, bodyEnd] = body2.range;
   return declStart >= bodyStart && declEnd <= bodyEnd;
@@ -6934,6 +7022,9 @@ function enclosingLoop(node) {
   let child = node;
   let parent = node.parent;
   while (parent !== void 0 && parent !== null) {
+    if ((parent.type === "ArrowFunctionExpression" || parent.type === "FunctionExpression") && parent.parent.type === "CallExpression" && parent.parent.arguments[0] === parent && parent.parent.callee.type === "MemberExpression" && !parent.parent.callee.computed && parent.parent.callee.property.type === "Identifier" && parent.parent.callee.property.name === "forEach") {
+      return parent.parent;
+    }
     if (LOOP_NODE_TYPES.has(parent.type)) {
       const loop = parent;
       if (loop.body === child) {
@@ -6945,6 +7036,17 @@ function enclosingLoop(node) {
   }
   return null;
 }
+function isSmallStaticForLoop(node) {
+  if (node.type !== "ForStatement" || node.init?.type !== "VariableDeclaration" || node.init.declarations.length !== 1 || node.test?.type !== "BinaryExpression" || node.test.operator !== "<" && node.test.operator !== "<=" || node.update?.type !== "UpdateExpression" || node.update.operator !== "++") {
+    return false;
+  }
+  const declaration = node.init.declarations[0];
+  if (declaration?.id.type !== "Identifier" || declaration.init?.type !== "Literal" || typeof declaration.init.value !== "number" || !Number.isInteger(declaration.init.value) || node.test.left.type !== "Identifier" || node.test.left.name !== declaration.id.name || node.test.right.type !== "Literal" || typeof node.test.right.value !== "number" || !Number.isInteger(node.test.right.value) || node.update.argument.type !== "Identifier" || node.update.argument.name !== declaration.id.name) {
+    return false;
+  }
+  const iterations = node.test.right.value - declaration.init.value + (node.test.operator === "<=" ? 1 : 0);
+  return iterations >= 0 && iterations <= 8;
+}
 var no_string_concat_in_loop_default = createRule({
   name: "no-string-concat-in-loop",
   documentation: noStringConcatInLoopDocumentation,
@@ -6977,6 +7079,9 @@ var no_string_concat_in_loop_default = createRule({
         if (loop === null) {
           return;
         }
+        if (isSmallStaticForLoop(loop)) {
+          return;
+        }
         const scope = context.sourceCode.getScope(node);
         const variable = findVariable(scope, node.left.name);
         if (variable === void 0) {
@@ -8830,8 +8935,10 @@ function looksLikeMutuallyExclusiveState(typeLiteral) {
   let statusMemberCount = 0;
   let hasFailurePayload = false;
   let hasSuccessPayload = false;
+  let hasUnrecognizedMember = false;
   for (const member of typeLiteral.members) {
     if (member.type !== AST_NODE_TYPES37.TSPropertySignature) {
+      hasUnrecognizedMember = true;
       continue;
     }
     const name = getMemberName(member);
@@ -8840,15 +8947,18 @@ function looksLikeMutuallyExclusiveState(typeLiteral) {
       continue;
     }
     if (!member.optional || isBooleanTyped(member) || name === null) {
+      hasUnrecognizedMember = true;
       continue;
     }
     if (FAILURE_MEMBER_NAMES.has(name)) {
       hasFailurePayload = true;
     } else if (SUCCESS_PAYLOAD_MEMBER_NAMES.has(name)) {
       hasSuccessPayload = true;
+    } else {
+      hasUnrecognizedMember = true;
     }
   }
-  return statusMemberCount === REQUIRED_STATUS_MEMBER_COUNT && hasFailurePayload && hasSuccessPayload;
+  return statusMemberCount === REQUIRED_STATUS_MEMBER_COUNT && hasFailurePayload && (hasSuccessPayload || !hasUnrecognizedMember);
 }
 function getMemberName(member) {
   if (member.type !== AST_NODE_TYPES37.TSPropertySignature) {
@@ -10749,7 +10859,7 @@ var prefer_schema_for_api_payload_default = createRule({
   },
   defaultOptions: [],
   create(context) {
-    if (isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) {
+    if (isTestFile(context.filename) || isScriptFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) {
       return {};
     }
     const unvalidatedVariables = /* @__PURE__ */ new Set();
@@ -12404,6 +12514,26 @@ var require_fetch_timeout_default = createRule({
       }
       return callee.type === AST_NODE_TYPES50.MemberExpression && !callee.computed && callee.property.type === AST_NODE_TYPES50.Identifier && callee.property.name === "fetch" && callee.object.type === AST_NODE_TYPES50.Identifier && GLOBAL_OBJECTS2.has(callee.object.name) && resolvesToGlobal(callee.object);
     }
+    function localConstInitProvablyLacksSignal(identifier) {
+      const variable = ASTUtils12.findVariable(
+        context.sourceCode.getScope(identifier),
+        identifier.name
+      );
+      if (variable?.defs.length !== 1) return false;
+      const definition = variable.defs[0];
+      if (definition?.type !== "Variable" || definition.parent.kind !== "const" || definition.node.init?.type !== AST_NODE_TYPES50.ObjectExpression || !initProvablyLacksSignal(definition.node.init)) {
+        return false;
+      }
+      for (const reference of variable.references) {
+        const ref = reference.identifier;
+        if (ref === identifier || ref === definition.name) continue;
+        const member = ref.parent;
+        if (member.type !== AST_NODE_TYPES50.MemberExpression || member.object !== ref || member.computed || member.property.type !== AST_NODE_TYPES50.Identifier || member.property.name === "signal" || member.parent.type !== AST_NODE_TYPES50.AssignmentExpression || member.parent.left !== member) {
+          return false;
+        }
+      }
+      return true;
+    }
     return {
       CallExpression(node) {
         if (!isGlobalFetchCall2(node.callee)) {
@@ -12413,7 +12543,7 @@ var require_fetch_timeout_default = createRule({
         if (node.arguments.length === 1 && first !== void 0 && !isInlineUrl(first, resolvesToGlobal)) {
           return;
         }
-        if (init === void 0 || initProvablyLacksSignal(init)) {
+        if (init === void 0 || initProvablyLacksSignal(init) || init.type === AST_NODE_TYPES50.Identifier && localConstInitProvablyLacksSignal(init)) {
           context.report({ node, messageId: "missingSignal" });
         }
       }
@@ -13168,8 +13298,8 @@ var require_zod_form_validation_default = createRule({
 // src/rules/store-insert-requires-on-conflict.ts
 import "@typescript-eslint/utils";
 var storeInsertRequiresOnConflictDocumentation = {
-  summary: "Require an embedded SQL INSERT to carry ON CONFLICT; store writes replay under cron re-runs and queue redelivery and must be idempotent upserts.",
-  rationale: "A replayed bare insert can duplicate data or fail on a uniqueness constraint.",
+  summary: "Require embedded inserts in explicitly replayable callables to carry conflict handling.",
+  rationale: "A callable named as an enqueue, seed, migration, schedule, ensure, or upsert promises replay safety.",
   remediation: "Add an appropriate `ON CONFLICT` action or supported replay-safe insert form.",
   category: "correctness",
   examples: [
@@ -13178,7 +13308,25 @@ var storeInsertRequiresOnConflictDocumentation = {
   ]
 };
 var INSERT_WRITE = /\bINSERT\s+(?:OR\s+\w+\s+)?INTO\s+[\w."'`?$:@-]+\s*(?:\([^)]*\)\s*)?(?:VALUES|SELECT|DEFAULT\s+VALUES)\b/i;
-var CONFLICT_HANDLED = /\bON\s+CONFLICT\b|\bON\s+DUPLICATE\s+KEY\b|\bINSERT\s+OR\s+(?:IGNORE|REPLACE)\b/i;
+var CONFLICT_HANDLED = /\bON\s+CONFLICT\b|\bON\s+DUPLICATE\s+KEY\b|\bINSERT\s+OR\s+(?:IGNORE|REPLACE)\b|\bINSERT\b[\s\S]*?\bSELECT\b[\s\S]*?\bWHERE\s+NOT\s+EXISTS\b/i;
+var REPLAY_CONTRACT_NAME = /(?:enqueue|ensure|migrate|recordOnce|schedule|seed|upsert|getOrCreate|createIfAbsent|insertIfAbsent)/i;
+function owningCallableName(node) {
+  for (let current = node.parent; current !== null && current !== void 0; current = current.parent) {
+    if (current.type === "FunctionDeclaration") {
+      return current.id?.name ?? null;
+    }
+    if (current.type === "MethodDefinition") {
+      return current.key.type === "Identifier" ? current.key.name : null;
+    }
+    if ((current.type === "ArrowFunctionExpression" || current.type === "FunctionExpression") && current.parent.type === "VariableDeclarator" && current.parent.id.type === "Identifier") {
+      return current.parent.id.name;
+    }
+    if ((current.type === "ArrowFunctionExpression" || current.type === "FunctionExpression") && current.parent.type === "Property" && current.parent.key.type === "Identifier") {
+      return current.parent.key.name;
+    }
+  }
+  return null;
+}
 var INSERT_GATE = /insert/i;
 var store_insert_requires_on_conflict_default = createRule({
   name: "store-insert-requires-on-conflict",
@@ -13186,7 +13334,7 @@ var store_insert_requires_on_conflict_default = createRule({
   meta: {
     type: "problem",
     docs: {
-      description: "Require an embedded SQL INSERT to carry ON CONFLICT; store writes replay under cron re-runs and queue redelivery and must be idempotent upserts."
+      description: "Require embedded inserts in explicitly replayable callables to carry conflict handling."
     },
     schema: [],
     messages: {
@@ -13202,6 +13350,10 @@ var store_insert_requires_on_conflict_default = createRule({
       if (!INSERT_WRITE.test(sql) || CONFLICT_HANDLED.test(sql)) {
         return;
       }
+      const owner = owningCallableName(node);
+      if (owner !== null && !REPLAY_CONTRACT_NAME.test(owner)) {
+        return;
+      }
       context.report({ node, messageId: "storeInsertRequiresOnConflict" });
     });
   }
@@ -13891,7 +14043,7 @@ var rules = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.0.0"
+  version: "15.1.0"
 };
 var applicationOnlyRules = [
   "no-restricted-library-load",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "15.0.0",
+  "version": "15.1.0",
   "packageManager": "npm@11.19.0",
   "description": "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",