@sarj/eslint-plugin 15.11.0 → 15.12.0

package/dist/index.js

@@ -2009,6 +2009,67 @@ var no_duplicate_lifecycle_refresh_listeners_default = createRule({
   }
 });
 
+// src/rules/no-dangerously-allow-svg.ts
+import "@typescript-eslint/utils";
+var NEXT_CONFIG_RE = /(?:^|\/)next\.config\.[cm]?[jt]s$/;
+var noDangerouslyAllowSvgDocumentation = {
+  summary: "Next.js image configuration enables unsanitized SVG rendering",
+  rationale: "SVG files can contain scripts and other active content; enabling dangerouslyAllowSVG makes the image optimizer serve that content from the application origin.",
+  remediation: "Keep dangerouslyAllowSVG disabled. If SVG delivery is unavoidable, use a separately reviewed asset path with restrictive Content-Disposition and Content-Security-Policy headers.",
+  category: "security",
+  limitations: [
+    "Only a literal true assigned to dangerouslyAllowSVG in a next.config source file is reported; computed or imported configuration is intentionally not inferred."
+  ],
+  examples: [
+    {
+      id: "svg-disabled",
+      title: "Keep active SVG delivery disabled",
+      outcome: "no-match",
+      files: [{ path: "next.config.mjs", source: "export default { images: { dangerouslyAllowSVG: false } };\n" }],
+      focusPath: "next.config.mjs",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "svg-enabled",
+      title: "Do not enable active SVG delivery",
+      outcome: "match",
+      files: [{ path: "next.config.mjs", source: "export default { images: { dangerouslyAllowSVG: true } };\n" }],
+      focusPath: "next.config.mjs",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+function propertyName(node) {
+  if (!node.computed && node.key.type === "Identifier") return node.key.name;
+  if (node.key.type === "Literal" && typeof node.key.value === "string") return node.key.value;
+  return null;
+}
+var no_dangerously_allow_svg_default = createRule({
+  name: "no-dangerously-allow-svg",
+  documentation: noDangerouslyAllowSvgDocumentation,
+  meta: {
+    type: "problem",
+    docs: { description: noDangerouslyAllowSvgDocumentation.summary },
+    schema: [],
+    messages: {
+      noDangerouslyAllowSvg: "Do not enable dangerouslyAllowSVG. SVG can carry active content served from the application origin."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    if (!NEXT_CONFIG_RE.test(context.filename.replaceAll("\\", "/"))) return {};
+    return {
+      Property(node) {
+        if (propertyName(node) === "dangerouslyAllowSVG" && node.value.type === "Literal" && node.value.value === true) {
+          context.report({ node, messageId: "noDangerouslyAllowSvg" });
+        }
+      }
+    };
+  }
+});
+
 // src/rules/no-dynamic-sql.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES9 } from "@typescript-eslint/utils";
 
@@ -3004,7 +3065,7 @@ var no_hand_rolled_sleep_default = createRule({
       return {};
     }
     const checkClientModules = optionsArg?.checkClientModules ?? false;
-    function isClientModule() {
+    function isClientModule2() {
       if (/\.[cm]?[jt]sx$/.test(filename)) {
         return true;
       }
@@ -3024,7 +3085,7 @@ var no_hand_rolled_sleep_default = createRule({
       if (checkClientModules) {
         return true;
       }
-      clientModule ??= isClientModule();
+      clientModule ??= isClientModule2();
       return !clientModule;
     };
     return {
@@ -5175,6 +5236,67 @@ var no_positional_tuple_return_default = createRule({
   }
 });
 
+// src/rules/no-production-browser-source-maps.ts
+import "@typescript-eslint/utils";
+var NEXT_CONFIG_RE2 = /(?:^|\/)next\.config\.[cm]?[jt]s$/;
+var noProductionBrowserSourceMapsDocumentation = {
+  summary: "Next.js production browser source maps expose application source",
+  rationale: "Next.js production browser source maps publish original client source and implementation details to every browser that can load the deployment.",
+  remediation: "Leave productionBrowserSourceMaps disabled and upload private source maps directly to the error-monitoring service during the build.",
+  category: "security",
+  limitations: [
+    "Only a literal true assigned in a next.config source file is reported; computed or imported configuration is intentionally not inferred."
+  ],
+  examples: [
+    {
+      id: "private-source-maps",
+      title: "Keep browser source maps private",
+      outcome: "no-match",
+      files: [{ path: "next.config.mjs", source: "export default { productionBrowserSourceMaps: false };\n" }],
+      focusPath: "next.config.mjs",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "public-source-maps",
+      title: "Do not publish production browser source maps",
+      outcome: "match",
+      files: [{ path: "next.config.mjs", source: "export default { productionBrowserSourceMaps: true };\n" }],
+      focusPath: "next.config.mjs",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+function propertyName2(node) {
+  if (!node.computed && node.key.type === "Identifier") return node.key.name;
+  if (node.key.type === "Literal" && typeof node.key.value === "string") return node.key.value;
+  return null;
+}
+var no_production_browser_source_maps_default = createRule({
+  name: "no-production-browser-source-maps",
+  documentation: noProductionBrowserSourceMapsDocumentation,
+  meta: {
+    type: "problem",
+    docs: { description: noProductionBrowserSourceMapsDocumentation.summary },
+    schema: [],
+    messages: {
+      noProductionBrowserSourceMaps: "Do not publish production browser source maps. Upload private maps to your monitoring service instead."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    if (!NEXT_CONFIG_RE2.test(context.filename.replaceAll("\\", "/"))) return {};
+    return {
+      Property(node) {
+        if (propertyName2(node) === "productionBrowserSourceMaps" && node.value.type === "Literal" && node.value.value === true) {
+          context.report({ node, messageId: "noProductionBrowserSourceMaps" });
+        }
+      }
+    };
+  }
+});
+
 // src/rules/no-raw-env.ts
 import "@typescript-eslint/utils";
 var noRawEnvDocumentation = {
@@ -6568,6 +6690,85 @@ var no_secret_in_log_default = createRule({
   }
 });
 
+// src/rules/no-server-env-in-client-component.ts
+import "@typescript-eslint/utils";
+var SERVER_ENV_MODULE_RE = /(?:^|\/)(?:server-env|server-settings)(?:\.[cm]?[jt]sx?)?$/;
+var noServerEnvInClientComponentDocumentation = {
+  summary: "server-only environment settings imported by a client component",
+  rationale: "Next.js client modules run in the browser, where server-only environment values are unavailable; importing a server settings module can produce undefined configuration or bundle a secret-bearing module into the client graph.",
+  remediation: "Pass an explicitly public value from a Server Component, or import it from a separately validated client-settings module backed only by NEXT_PUBLIC_* values.",
+  category: "correctness",
+  limitations: [
+    "Only static value imports in files with a top-level 'use client' directive and conventionally named server-env/server-settings modules are checked."
+  ],
+  examples: [
+    {
+      id: "public-client-settings",
+      title: "Import a browser-safe settings boundary",
+      outcome: "no-match",
+      files: [
+        {
+          path: "status-card.tsx",
+          source: "'use client';\nimport { CLIENT_SETTINGS } from '@/client-settings';\nexport const StatusCard = () => <p>{CLIENT_SETTINGS.apiOrigin}</p>;\n"
+        }
+      ],
+      focusPath: "status-card.tsx",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "server-settings-client-import",
+      title: "Do not pull server settings into a client bundle",
+      outcome: "match",
+      files: [
+        {
+          path: "status-card.tsx",
+          source: "'use client';\nimport { SERVER_SETTINGS } from '@/server-settings';\nexport const StatusCard = () => <p>{SERVER_SETTINGS.apiOrigin}</p>;\n"
+        }
+      ],
+      focusPath: "status-card.tsx",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+function isClientModule(program) {
+  return program.body.some(
+    (statement) => statement.type === "ExpressionStatement" && statement.directive === "use client"
+  );
+}
+function isTypeOnlyImport(node) {
+  return node.importKind === "type" || node.specifiers.length > 0 && node.specifiers.every(
+    (specifier) => specifier.type === "ImportSpecifier" && specifier.importKind === "type"
+  );
+}
+var no_server_env_in_client_component_default = createRule({
+  name: "no-server-env-in-client-component",
+  documentation: noServerEnvInClientComponentDocumentation,
+  meta: {
+    type: "problem",
+    docs: { description: noServerEnvInClientComponentDocumentation.summary },
+    schema: [],
+    messages: {
+      noServerEnvInClientComponent: "A 'use client' module cannot import server-only settings. Pass public data from a Server Component or use a validated client-settings module."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    let clientModule = false;
+    return {
+      Program(node) {
+        clientModule = isClientModule(node);
+      },
+      ImportDeclaration(node) {
+        if (clientModule && !isTypeOnlyImport(node) && typeof node.source.value === "string" && SERVER_ENV_MODULE_RE.test(node.source.value)) {
+          context.report({ node, messageId: "noServerEnvInClientComponent" });
+        }
+      }
+    };
+  }
+});
+
 // src/rules/no-select-star.ts
 import "@typescript-eslint/utils";
 var noSelectStarDocumentation = {
@@ -11250,7 +11451,7 @@ var preferNonNullableCollectionDocumentation = {
   ]
 };
 var ARRAY_TYPE_NAMES = /* @__PURE__ */ new Set(["Array", "ReadonlyArray"]);
-function propertyName(node) {
+function propertyName3(node) {
   const key = node.key;
   if (node.computed) return null;
   if (key.type === AST_NODE_TYPES48.Identifier) return key.name;
@@ -11263,7 +11464,7 @@ function isArrayType(node) {
 }
 function nullableProperty(node) {
   if (node.optional) return null;
-  const name = propertyName(node);
+  const name = propertyName3(node);
   const annotation = node.typeAnnotation?.typeAnnotation;
   if (name === null || annotation?.type !== AST_NODE_TYPES48.TSUnionType) return null;
   const concrete = annotation.types.filter(
@@ -11473,7 +11674,7 @@ var prefer_non_nullable_collection_default = createRule({
           context.report({
             node,
             messageId: "preferNonNullableCollection",
-            data: { name: propertyName(node) ?? "collection" }
+            data: { name: propertyName3(node) ?? "collection" }
           });
         }
       }
@@ -13653,11 +13854,11 @@ var prefer_zod_infer_default = createRule({
           continue;
         }
         const key = member.key;
-        const propertyName3 = key.type === AST_NODE_TYPES54.Identifier ? key.name : key.type === AST_NODE_TYPES54.Literal && typeof key.value === "string" ? key.value : null;
-        if (propertyName3 === null) {
+        const propertyName5 = key.type === AST_NODE_TYPES54.Identifier ? key.name : key.type === AST_NODE_TYPES54.Literal && typeof key.value === "string" ? key.value : null;
+        if (propertyName5 === null) {
           continue;
         }
-        const propertyTokens = nameTokens(propertyName3);
+        const propertyTokens = nameTokens(propertyName5);
         if (propertyTokens.length < 2) {
           continue;
         }
@@ -13672,7 +13873,7 @@ var prefer_zod_infer_default = createRule({
           node: annotation,
           owner,
           ownerName,
-          propertyName: propertyName3,
+          propertyName: propertyName5,
           propertyTokens
         });
       }
@@ -14787,7 +14988,7 @@ function isStaticValue(node) {
   }
   return false;
 }
-function propertyName2(property) {
+function propertyName4(property) {
   if (property.computed) return null;
   if (property.key.type === AST_NODE_TYPES58.Identifier) return property.key.name;
   return typeof property.key.value === "string" ? property.key.value : null;
@@ -14824,7 +15025,7 @@ var require_static_next_matcher_default = createRule({
             continue;
           }
           for (const property of config.properties) {
-            if (property.type !== AST_NODE_TYPES58.Property || propertyName2(property) !== "matcher" || property.value.type === AST_NODE_TYPES58.AssignmentPattern) {
+            if (property.type !== AST_NODE_TYPES58.Property || propertyName4(property) !== "matcher" || property.value.type === AST_NODE_TYPES58.AssignmentPattern) {
               continue;
             }
             if (!isStaticValue(property.value)) {
@@ -14837,10 +15038,146 @@ var require_static_next_matcher_default = createRule({
   }
 });
 
+// src/rules/require-use-form-default-values.ts
+import { ASTUtils as ASTUtils19 } from "@typescript-eslint/utils";
+var requireUseFormDefaultValuesDocumentation = {
+  summary: "react-hook-form useForm call without defaultValues",
+  rationale: "Without an explicit initial value, fields can change from uncontrolled to controlled as data arrives, reset behavior becomes ambiguous, and the form's initial shape no longer documents the values users can edit.",
+  remediation: "Pass an object with a defaultValues property to useForm; use empty strings, nulls, or schema-appropriate values deliberately for every controlled field.",
+  category: "correctness",
+  limitations: [
+    "Only direct calls to a scope-resolved useForm value imported from react-hook-form are checked; wrapper hooks and computed option objects are intentionally not inferred."
+  ],
+  examples: [
+    {
+      id: "form-with-initial-values",
+      title: "Give the form an explicit initial shape",
+      outcome: "no-match",
+      files: [{ path: "profile-form.tsx", source: "import { useForm } from 'react-hook-form';\nconst form = useForm({ defaultValues: { name: '' } });\n" }],
+      focusPath: "profile-form.tsx",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "form-without-initial-values",
+      title: "Do not leave form initialization implicit",
+      outcome: "match",
+      files: [{ path: "profile-form.tsx", source: "import { useForm } from 'react-hook-form';\nconst form = useForm({ mode: 'onChange' });\n" }],
+      focusPath: "profile-form.tsx",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+function hasDefaultValues(options) {
+  return options?.type === "ObjectExpression" && options.properties.some(
+    (property) => property.type === "Property" && !property.computed && (property.key.type === "Identifier" && property.key.name === "defaultValues" || property.key.type === "Literal" && property.key.value === "defaultValues")
+  );
+}
+var require_use_form_default_values_default = createRule({
+  name: "require-use-form-default-values",
+  documentation: requireUseFormDefaultValuesDocumentation,
+  meta: {
+    type: "problem",
+    docs: { description: requireUseFormDefaultValuesDocumentation.summary },
+    schema: [],
+    messages: {
+      requireUseFormDefaultValues: "Pass explicit defaultValues to useForm so fields have a stable initial shape and reset behavior."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const importedHooks = /* @__PURE__ */ new Set();
+    return {
+      ImportDeclaration(node) {
+        if (node.source.value !== "react-hook-form") return;
+        for (const specifier of node.specifiers) {
+          if (specifier.type !== "ImportSpecifier" || (specifier.imported.type === "Identifier" ? specifier.imported.name : specifier.imported.value) !== "useForm") continue;
+          const variable = ASTUtils19.findVariable(context.sourceCode.getScope(specifier.local), specifier.local.name);
+          if (variable) importedHooks.add(variable);
+        }
+      },
+      CallExpression(node) {
+        if (node.callee.type !== "Identifier") return;
+        const variable = ASTUtils19.findVariable(context.sourceCode.getScope(node.callee), node.callee.name);
+        const options = node.arguments[0];
+        if (!variable || !importedHooks.has(variable) || options !== void 0 && options.type !== "ObjectExpression" || hasDefaultValues(options)) return;
+        context.report({ node, messageId: "requireUseFormDefaultValues" });
+      }
+    };
+  }
+});
+
+// src/rules/require-use-server-in-actions-file.ts
+import "@typescript-eslint/utils";
+var ACTION_MODULE_RE = /(?:^|\/)app\/.*\/(?:actions|[^/]+-actions)\.[cm]?[jt]s$/u;
+var requireUseServerInActionsFileDocumentation = {
+  summary: "route action module missing the use server directive",
+  rationale: "An exported async function is not callable as a Server Action merely because its file is named actions.ts. Without the module directive, a client import can fail or pull server-only implementation details across the client boundary.",
+  remediation: "Put 'use server' at the start of the route action module.",
+  category: "correctness",
+  limitations: [
+    "Only exported async functions in actions.ts or *-actions.ts below an app directory are checked; other naming schemes and inline Server Actions are intentionally outside the rule."
+  ],
+  examples: [
+    {
+      id: "server-action-module",
+      title: "Mark the action module as server-only",
+      outcome: "no-match",
+      files: [{ path: "app/orders/actions.ts", source: "'use server';\nexport async function cancelOrder() {}\n" }],
+      focusPath: "app/orders/actions.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "unmarked-action-module",
+      title: "Do not rely on the filename to create a Server Action",
+      outcome: "match",
+      files: [{ path: "app/orders/actions.ts", source: "export async function cancelOrder() {}\n" }],
+      focusPath: "app/orders/actions.ts",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+function isExportedAsyncFunction(node) {
+  const declaration = node.declaration;
+  if (declaration?.type === "FunctionDeclaration") return declaration.async;
+  return declaration?.type === "VariableDeclaration" && declaration.declarations.some(
+    (item) => item.init?.type === "ArrowFunctionExpression" || item.init?.type === "FunctionExpression" ? item.init.async : false
+  );
+}
+var require_use_server_in_actions_file_default = createRule({
+  name: "require-use-server-in-actions-file",
+  documentation: requireUseServerInActionsFileDocumentation,
+  meta: {
+    type: "problem",
+    docs: { description: requireUseServerInActionsFileDocumentation.summary },
+    schema: [],
+    messages: {
+      requireUseServerInActionsFile: "This route action module exports an async function but is missing a leading 'use server' directive."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      Program(node) {
+        const filename = context.filename.replaceAll("\\", "/");
+        if (!ACTION_MODULE_RE.test(filename)) return;
+        if (node.body.some((statement) => statement.type === "ExpressionStatement" && statement.directive === "use server")) return;
+        const exportedAction = node.body.find(
+          (statement) => statement.type === "ExportNamedDeclaration" && isExportedAsyncFunction(statement)
+        );
+        if (exportedAction) context.report({ node: exportedAction, messageId: "requireUseServerInActionsFile" });
+      }
+    };
+  }
+});
+
 // src/rules/require-zod-form-validation.ts
 import {
   AST_NODE_TYPES as AST_NODE_TYPES59,
-  ASTUtils as ASTUtils19
+  ASTUtils as ASTUtils20
 } from "@typescript-eslint/utils";
 var requireZodFormValidationDocumentation = {
   summary: "Require Zod validation (`Schema.parse(...)` / `Schema.safeParse(...)`) when reading values out of a `FormData` object.",
@@ -14908,7 +15245,7 @@ var require_zod_form_validation_default = createRule({
       return {};
     }
     const zodBindings = /* @__PURE__ */ new Set();
-    const resolvedBinding = (identifier) => ASTUtils19.findVariable(
+    const resolvedBinding = (identifier) => ASTUtils20.findVariable(
       context.sourceCode.getScope(identifier),
       identifier.name
     );
@@ -15205,7 +15542,7 @@ var store_insert_requires_on_conflict_default = createRule({
 });
 
 // src/rules/stepdown.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES60, ASTUtils as ASTUtils20 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES60, ASTUtils as ASTUtils21 } from "@typescript-eslint/utils";
 var stepdownDocumentation = {
   summary: "Place a private helper below its sole direct same-scope caller.",
   rationale: "Caller-first ordering lets a reader follow the main flow before descending into implementation details.",
@@ -15405,7 +15742,7 @@ function methodName(node) {
   return !node.computed && node.key.type === AST_NODE_TYPES60.Identifier ? node.key.name : null;
 }
 function referencedMethod(context, node, classVariables) {
-  const objectVariable = node.object.type === AST_NODE_TYPES60.Identifier ? ASTUtils20.findVariable(context.sourceCode.getScope(node.object), node.object.name) : null;
+  const objectVariable = node.object.type === AST_NODE_TYPES60.Identifier ? ASTUtils21.findVariable(context.sourceCode.getScope(node.object), node.object.name) : null;
   const isClassReference = objectVariable !== null && classVariables.has(objectVariable);
   if (node.object.type !== AST_NODE_TYPES60.ThisExpression && !isClassReference) return null;
   if (node.property.type === AST_NODE_TYPES60.PrivateIdentifier) return `#${node.property.name}`;
@@ -15458,11 +15795,11 @@ function classScope(context, node, computedReferenceNames) {
   const pinned = /* @__PURE__ */ new Set();
   const classVariables = /* @__PURE__ */ new Set();
   if (node.id !== null) {
-    const internal = ASTUtils20.findVariable(context.sourceCode.getScope(node), node.id.name);
+    const internal = ASTUtils21.findVariable(context.sourceCode.getScope(node), node.id.name);
     if (internal !== null) classVariables.add(internal);
   }
   if (node.type === AST_NODE_TYPES60.ClassExpression && node.parent.type === AST_NODE_TYPES60.VariableDeclarator && node.parent.id.type === AST_NODE_TYPES60.Identifier) {
-    const outer = ASTUtils20.findVariable(context.sourceCode.getScope(node.parent), node.parent.id.name);
+    const outer = ASTUtils21.findVariable(context.sourceCode.getScope(node.parent), node.parent.id.name);
     if (outer !== null) classVariables.add(outer);
   }
   for (const method of methods) {
@@ -15498,7 +15835,7 @@ function classScope(context, node, computedReferenceNames) {
         return;
       }
       if (binding.type !== AST_NODE_TYPES60.Identifier) return;
-      const variable = ASTUtils20.findVariable(context.sourceCode.getScope(binding), binding.name);
+      const variable = ASTUtils21.findVariable(context.sourceCode.getScope(binding), binding.name);
       if (variable !== null) {
         methodClassVariables.add(variable);
         methodAliases.add(variable);
@@ -15528,7 +15865,7 @@ function classScope(context, node, computedReferenceNames) {
         return;
       }
       if (!privateNames.has(target)) return;
-      const objectVariable = current.object.type === AST_NODE_TYPES60.Identifier ? ASTUtils20.findVariable(context.sourceCode.getScope(current.object), current.object.name) : null;
+      const objectVariable = current.object.type === AST_NODE_TYPES60.Identifier ? ASTUtils21.findVariable(context.sourceCode.getScope(current.object), current.object.name) : null;
       if (objectVariable !== null && methodAliases.has(objectVariable)) {
         pinned.add(target);
         return;
@@ -15976,7 +16313,7 @@ var iac_source_coupled_test_default = createSourceCoupledRule(
 // src/rules/zod-naming-convention.ts
 import {
   AST_NODE_TYPES as AST_NODE_TYPES62,
-  ASTUtils as ASTUtils21
+  ASTUtils as ASTUtils22
 } from "@typescript-eslint/utils";
 var zodNamingConventionDocumentation = {
   summary: "Enforce a consistent Zod schema naming convention \u2014 a `Z` prefix (`ZUser`) or a `Schema` suffix (`userSchema`); both are accepted by default.",
@@ -16069,7 +16406,7 @@ var zod_naming_convention_default = createRule({
     const acceptsSchemaWord = convention !== "prefix";
     const zodBindings = /* @__PURE__ */ new Set();
     function resolvedBinding(identifier) {
-      return ASTUtils21.findVariable(
+      return ASTUtils22.findVariable(
         context.sourceCode.getScope(identifier),
         identifier.name
       );
@@ -16206,6 +16543,7 @@ var rules = {
   "no-comment-cruft": no_comment_cruft_default,
   "no-cors-wildcard-with-credentials": no_cors_wildcard_with_credentials_default,
   "no-duplicate-lifecycle-refresh-listeners": no_duplicate_lifecycle_refresh_listeners_default,
+  "no-dangerously-allow-svg": no_dangerously_allow_svg_default,
   "no-dynamic-sql": no_dynamic_sql_default,
   "no-enum": no_enum_default,
   "no-fat-try-blocks": no_fat_try_blocks_default,
@@ -16221,6 +16559,7 @@ var rules = {
   "no-generic-single-export-module": no_generic_single_export_module_default,
   "no-offset-pagination": no_offset_pagination_default,
   "no-positional-tuple-return": no_positional_tuple_return_default,
+  "no-production-browser-source-maps": no_production_browser_source_maps_default,
   "no-raw-env": no_raw_env_default,
   "no-raw-fetch-outside-clients": no_raw_fetch_outside_clients_default,
   "no-restricted-library-load": no_restricted_library_load_default,
@@ -16229,6 +16568,7 @@ var rules = {
   "no-restated-comment": no_restated_comment_default,
   "no-restated-jsdoc": no_restated_jsdoc_default,
   "no-secret-in-log": no_secret_in_log_default,
+  "no-server-env-in-client-component": no_server_env_in_client_component_default,
   "no-select-star": no_select_star_default,
   "no-sentinel-return-on-catch": no_sentinel_return_on_catch_default,
   "no-silent-promise-catch": no_silent_promise_catch_default,
@@ -16244,6 +16584,8 @@ var rules = {
   "no-unnecessary-use-client": no_unnecessary_use_client_default,
   "no-unsafe-mock-casting": no_unsafe_mock_casting_default,
   "no-zod-native-enum": no_zod_native_enum_default,
+  "require-use-form-default-values": require_use_form_default_values_default,
+  "require-use-server-in-actions-file": require_use_server_in_actions_file_default,
   "test-loops-over-literal-cases": test_loops_over_literal_cases_default,
   "test-phase-label-comment": test_phase_label_comment_default,
   "prefer-constant-time-secret-compare": prefer_constant_time_secret_compare_default,
@@ -16274,7 +16616,7 @@ var rules = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.11.0"
+  version: "15.12.0"
 };
 var applicationOnlyRules = [
   "no-restricted-library-load",
@@ -16283,10 +16625,15 @@ var applicationOnlyRules = [
 ];
 var advisoryRules = [
   "no-bare-return-from-test-catch",
+  "no-dangerously-allow-svg",
   "no-duplicate-lifecycle-refresh-listeners",
+  "no-production-browser-source-maps",
   "no-router-refresh-polling",
+  "no-server-env-in-client-component",
   "iac-source-coupled-test",
   "repeated-static-call-cases",
+  "require-use-form-default-values",
+  "require-use-server-in-actions-file",
   "source-coupled-test",
   "test-phase-label-comment"
 ];
@@ -16306,17 +16653,20 @@ var recommendedRules = {
   "@sarj/no-impossible-zod-literal-bounds": "error",
   "@sarj/no-log-only-catch": "error",
   "@sarj/no-bare-return-from-test-catch": "warn",
+  "@sarj/no-dangerously-allow-svg": "warn",
   "@sarj/no-duplicate-lifecycle-refresh-listeners": "warn",
   "@sarj/no-long-comment": "error",
   "@sarj/no-vague-suppression-description": "error",
   "@sarj/no-generic-single-export-module": "error",
   "@sarj/no-offset-pagination": "error",
   "@sarj/no-positional-tuple-return": "error",
+  "@sarj/no-production-browser-source-maps": "warn",
   "@sarj/no-repeated-string-literal": "error",
   "@sarj/no-router-refresh-polling": "warn",
   "@sarj/no-restated-comment": "error",
   "@sarj/no-restated-jsdoc": "error",
   "@sarj/no-secret-in-log": "error",
+  "@sarj/no-server-env-in-client-component": "warn",
   "@sarj/no-select-star": "error",
   "@sarj/no-sentinel-return-on-catch": "error",
   "@sarj/no-silent-promise-catch": "error",
@@ -16350,6 +16700,8 @@ var recommendedRules = {
   "@sarj/require-fetch-timeout": "error",
   "@sarj/require-port-for-service": "error",
   "@sarj/require-static-next-matcher": "error",
+  "@sarj/require-use-form-default-values": "warn",
+  "@sarj/require-use-server-in-actions-file": "warn",
   "@sarj/require-zod-form-validation": "error",
   "@sarj/store-insert-requires-on-conflict": "error",
   "@sarj/stepdown": "error",
@@ -16374,12 +16726,14 @@ var strictRules = {
   "@sarj/no-impossible-zod-literal-bounds": "error",
   "@sarj/no-log-only-catch": "error",
   "@sarj/no-bare-return-from-test-catch": "warn",
+  "@sarj/no-dangerously-allow-svg": "warn",
   "@sarj/no-duplicate-lifecycle-refresh-listeners": "warn",
   "@sarj/no-long-comment": "error",
   "@sarj/no-vague-suppression-description": "error",
   "@sarj/no-generic-single-export-module": "error",
   "@sarj/no-offset-pagination": "error",
   "@sarj/no-positional-tuple-return": "error",
+  "@sarj/no-production-browser-source-maps": "warn",
   "@sarj/no-raw-env": "error",
   "@sarj/no-raw-fetch-outside-clients": "error",
   "@sarj/no-repeated-string-literal": "error",
@@ -16387,6 +16741,7 @@ var strictRules = {
   "@sarj/no-restated-comment": "error",
   "@sarj/no-restated-jsdoc": "error",
   "@sarj/no-secret-in-log": "error",
+  "@sarj/no-server-env-in-client-component": "warn",
   "@sarj/no-select-star": "error",
   "@sarj/no-sentinel-return-on-catch": "error",
   "@sarj/no-silent-promise-catch": "error",
@@ -16421,6 +16776,8 @@ var strictRules = {
   "@sarj/require-fetch-timeout": "error",
   "@sarj/require-port-for-service": "error",
   "@sarj/require-static-next-matcher": "error",
+  "@sarj/require-use-form-default-values": "warn",
+  "@sarj/require-use-server-in-actions-file": "warn",
   "@sarj/require-zod-form-validation": "error",
   "@sarj/store-insert-requires-on-conflict": "error",
   "@sarj/stepdown": "error",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "15.11.0",
+  "version": "15.12.0",
   "packageManager": "npm@12.0.2",
   "description": "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",