@sarj/eslint-plugin 15.26.0 → 15.26.2

package/dist/index.cjs

@@ -96,6 +96,7 @@ ${missing.join("\n")}`);
       rationale: spec.rationale,
       remediation: spec.remediation,
       category: spec.category,
+      defaultLevel: spec.defaultLevel,
       languages: spec.languages,
       autofix: spec.autofix,
       aliases: spec.aliases,
@@ -177,6 +178,7 @@ function nativeSpec(config, documentation) {
     rationale: documentation.rationale,
     remediation: documentation.remediation,
     category: documentation.category,
+    defaultLevel: documentation.defaultLevel ?? "error",
     languages: [...documentation.languages ?? ["typescript"]],
     autofix: documentation.autofix ?? "none",
     aliases,
@@ -1020,6 +1022,7 @@ var require_button_accessible_name_default = createRule({
 // src/rules/require-camelcase-properties.ts
 var import_utils9 = require("@typescript-eslint/utils");
 var REQUIRE_CAMELCASE_PROPERTIES_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Require unquoted lower snake_case TypeScript properties and dot access to use camelCase.",
   rationale: "Unquoted snake_case property syntax makes external wire naming indistinguishable from application-domain naming and lets inconsistent contracts spread through typed code.",
   remediation: "Rename application properties to camelCase. At an external wire boundary, make the exception explicit with a quoted key and bracket access.",
@@ -2348,6 +2351,7 @@ var FILE_SELF_REFERENCE_RE = /\bthis (?:file|module)\b/iu;
 var CHANGE_HISTORY_RE = /\b(?:used to|previously|histor(?:y|ical)|keep moving|models? (?:move|moved|change|changed)|still under review)\b/iu;
 var IMPLEMENTATION_MAP_RE = /\b(?:everything (?:above|below)|nothing else|only thing|write half|maps? between|seam between)\b/iu;
 var EXCESSIVE_COMMENTARY_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Flag long standalone implementation commentary that should be expressed by code.",
   rationale: "Narrative implementation paragraphs compete with the code and can drift independently from behavior.",
   remediation: "Delete narration and clarify names, types, or structure; retain only durable constraints and external contracts.",
@@ -4145,12 +4149,12 @@ function createSqlListener(handler) {
 
 // src/rules/no-dynamic-sql.ts
 var NO_DYNAMIC_SQL_DOCUMENTATION = {
-  summary: "Disallow runtime values embedded inside quoted SQL values passed to statement-execution methods.",
-  rationale: "Embedding runtime values in SQL bypasses driver parameterization and can introduce injection defects or unstable query plans.",
-  remediation: "Use SQL placeholders and pass runtime values through the driver's binding API.",
+  summary: "Disallow runtime values and fragments interpolated into SQL passed to statement-execution methods.",
+  rationale: "Embedding runtime values or fragments in SQL bypasses driver parameterization or an explicit allowlist and can introduce injection defects or unstable query plans.",
+  remediation: "Bind data values through SQL placeholders. Select non-bindable identifiers or clauses from fixed, reviewed fragments instead of interpolating runtime text.",
   category: "security",
   limitations: [
-    "Only single-quoted SQL values are inspected. Double-quoted identifiers, comments, dollar strings, and unquoted fragments are excluded; this is not a general SQL injection detector.",
+    "Template and concatenation fragments are inspected at recognized execution calls. Double-quoted identifiers, comments, and dollar strings are excluded; this is not a general SQL injection detector.",
     "Literal fragments, legacy uppercase fragment names, and parameterizing tagged templates are exempt; uppercase spelling does not prove a value is static.",
     "The bounded lexer recognizes doubled quotes, comments, and PostgreSQL dollar strings; dialect-specific escape modes and SQL generated through other APIs require separate security review."
   ],
@@ -4172,6 +4176,26 @@ var NO_DYNAMIC_SQL_DOCUMENTATION = {
       focusPath: "src/users.ts",
       expectedCount: 1,
       public: true
+    },
+    {
+      id: "bound-unquoted-value",
+      scenarioId: "unquoted",
+      title: "An unquoted runtime value is bound separately",
+      outcome: "no-match",
+      files: [{ path: "src/users.ts", source: "db.prepare('select id from users where id = ?').bind(userId);" }],
+      focusPath: "src/users.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "unquoted-runtime-fragment",
+      scenarioId: "unquoted",
+      title: "A runtime fragment is interpolated into SQL",
+      outcome: "match",
+      files: [{ path: "src/users.ts", source: "db.prepare(`select id from users where id = ${userId}`);" }],
+      focusPath: "src/users.ts",
+      expectedCount: 1,
+      public: true
     }
   ]
 };
@@ -4194,14 +4218,21 @@ function isStaticFragment(expression) {
 }
 function runtimeInterpolations(template) {
   const parts = template.quasis.map((quasi) => quasi.value.cooked ?? quasi.value.raw);
-  const ranges = sqlSingleQuotedRanges(parts.join(RUNTIME_MARKER));
+  const statement = parts.join(RUNTIME_MARKER);
+  const ranges = sqlSingleQuotedRanges(statement);
+  const visible = stripSqlNoise(statement);
   let offset = 0;
-  return template.expressions.filter(
+  return template.expressions.flatMap(
     (expression, index) => {
       offset += parts[index]?.length ?? 0;
       const inValue = ranges.some(([start, end]) => start < offset && offset < end);
+      const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
       offset += RUNTIME_MARKER.length;
-      return inValue && !isStaticFragment(expression) && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "");
+      if (isStaticFragment(expression)) return [];
+      if (inValue && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "")) {
+        return [{ expression, messageId: "dynamicSql" }];
+      }
+      return unquoted ? [{ expression, messageId: "dynamicFragment" }] : [];
     }
   );
 }
@@ -4232,16 +4263,21 @@ function runtimeConcatOperands(node) {
     return [];
   }
   const parts = operands.map((operand) => staticLiteralText(operand) ?? RUNTIME_MARKER);
-  const ranges = sqlSingleQuotedRanges(parts.join(""));
+  const statement = parts.join("");
+  const ranges = sqlSingleQuotedRanges(statement);
+  const visible = stripSqlNoise(statement);
   let offset = 0;
-  return operands.filter((operand, index) => {
+  return operands.flatMap((operand, index) => {
     const inValue = ranges.some(([start, end]) => start < offset && offset < end);
+    const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
     offset += parts[index]?.length ?? 0;
-    if (!inValue) return false;
-    if (isStaticFragment(operand)) return false;
+    if (isStaticFragment(operand)) return [];
     const before = operands[index - 1];
     const after = operands[index + 1];
-    return before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "");
+    if (inValue && before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "")) {
+      return [{ expression: operand, messageId: "dynamicSql" }];
+    }
+    return unquoted ? [{ expression: operand, messageId: "dynamicFragment" }] : [];
   });
 }
 function concatOperands(node) {
@@ -4297,7 +4333,8 @@ var no_dynamic_sql_default = createRule({
       }
     ],
     messages: {
-      dynamicSql: "Runtime value embedded inside a quoted SQL value passed to `{{method}}()`. Replace the quoted interpolation with a placeholder and bind the value separately."
+      dynamicSql: "Runtime value embedded inside a quoted SQL value passed to `{{method}}()`. Replace the quoted interpolation with a placeholder and bind the value separately.",
+      dynamicFragment: "Runtime fragment interpolated into SQL passed to `{{method}}()`. Bind data values; select non-bindable SQL fragments from fixed, reviewed alternatives."
     }
   },
   defaultOptions: [{}],
@@ -4316,8 +4353,8 @@ var no_dynamic_sql_default = createRule({
         const offenders = statement.type === import_utils27.AST_NODE_TYPES.TemplateLiteral ? runtimeInterpolations(statement) : runtimeConcatOperands(statement);
         for (const offender of offenders) {
           context.report({
-            node: offender,
-            messageId: "dynamicSql",
+            node: offender.expression,
+            messageId: offender.messageId,
             data: { method }
           });
         }
@@ -5950,6 +5987,7 @@ function branchTerminates(branch) {
 var import_utils36 = require("@typescript-eslint/utils");
 var import_typescript5 = __toESM(require("typescript"), 1);
 var NO_JSON_STRINGIFY_OBJECT_EQUALITY_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Do not use JSON serialization as structural object equality.",
   rationale: "JSON text equality depends on property insertion order and serialization behavior, so semantically equal objects can compare unequal and distinct values can collapse together.",
   remediation: "Compare an explicit domain projection structurally, or use a reviewed canonical serializer when JSON semantics are required.",
@@ -7209,6 +7247,7 @@ var no_bare_return_from_test_catch_default = createRule({
 // src/rules/no-bespoke-api-case-conversion.ts
 var import_utils45 = require("@typescript-eslint/utils");
 var NO_BESPOKE_API_CASE_CONVERSION_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Review direct snake_case/camelCase mirror mappings on explicitly API-typed adapter values.",
   rationale: "Duplicating wire-name translation can drift from an API client contract. When the SDK owns application-facing names, centralizing conversion avoids maintaining another mirror by hand.",
   remediation: "Move wire-name ownership and case conversion into the generated SDK/model layer; keep application adapters on the generated typed surface.",
@@ -8955,6 +8994,7 @@ var WALL_NARRATION_RE2 = /^(?:(?:\d+[.)]|(?:phase|step)\s+\d+\s*:?)\s*)?(?:add|b
 var WALL_CLUSTER_MAX_LINE_GAP = 8;
 var WALL_CLUSTER_MIN_COMMENTS = 3;
 var NO_RESTATED_COMMENT_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Flag short standalone comments that repeat the adjacent statement's identifiers.",
   rationale: "A comment that only repeats code adds no context and can become stale independently.",
   remediation: "Remove a genuine restatement; retain conditions, constraints, rationale, and information absent from the statement.",
@@ -9104,6 +9144,7 @@ function isRestatableLabel(body2) {
 // src/rules/no-restated-jsdoc.ts
 var import_utils57 = require("@typescript-eslint/utils");
 var NO_RESTATED_JSDOC_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Flag JSDoc prose that appears to repeat declaration names without adding behavioral information.",
   rationale: "Signature-only JSDoc duplicates type information and drifts without helping callers.",
   remediation: "Delete the block or document behavior, constraints, failures, or context the signature cannot express.",
@@ -13663,6 +13704,7 @@ var prefer_input_group_search_default = createRule({
 // src/rules/prefer-millisecond-control-duration-schema.ts
 var import_utils84 = require("@typescript-eslint/utils");
 var PREFER_MILLISECOND_CONTROL_DURATION_SCHEMA_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Require application-owned Zod control-duration fields to use millisecond granularity.",
   rationale: "Second-granularity timeout and scheduling controls lose precision and invite implicit unit conversion at API boundaries. Encoding milliseconds in the schema keeps the unit explicit and composes with platform timing APIs.",
   remediation: "Rename the field with an `Ms`/`_ms` suffix and express its bounds and default in milliseconds; update the owning API contract rather than converting in application code.",
@@ -15282,6 +15324,7 @@ var FUNCTION_TYPES9 = /* @__PURE__ */ new Set([
   import_utils89.AST_NODE_TYPES.FunctionExpression
 ]);
 var PREFER_MODULE_LEVEL_REFINED_SCHEMA_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Declare closed Zod scalar, format, and wrapper schemas at module scope.",
   rationale: "A closed validation pipeline created inside a function is rebuilt on every invocation and obscures a reusable constraint.",
   remediation: "Move the validation schema to module scope, name it with a PascalCase Schema suffix, and call parse on the shared schema.",
@@ -15555,6 +15598,7 @@ var prefer_module_level_refined_schema_default = createRule({
 // src/rules/prefer-multi-value-zod-literal.ts
 var import_utils90 = require("@typescript-eslint/utils");
 var PREFER_MULTI_VALUE_ZOD_LITERAL_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Use the Zod 4 multi-value literal API instead of a union of literal schemas.",
   rationale: "One multi-value literal expresses the same closed value domain without repeated schema wrappers.",
   remediation: "Replace the union with z.literal([value1, value2, ...]).",
@@ -15741,6 +15785,7 @@ var prefer_named_callback_domain_default = createRule({
 // src/rules/prefer-named-complex-return-type.ts
 var import_utils92 = require("@typescript-eslint/utils");
 var PREFER_NAMED_COMPLEX_RETURN_TYPE_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Prefer a named contract for structurally complex function return types.",
   rationale: "A large inline return annotation hides a reusable domain concept and makes signatures difficult to scan.",
   remediation: "Name the complex nested shape while preserving its generic wrappers and type parameters; reference the named contract from the return annotation.",
@@ -15901,6 +15946,7 @@ var prefer_native_random_uuid_default = createRule({
 // src/rules/prefer-node-crypto-hash.ts
 var import_utils94 = require("@typescript-eslint/utils");
 var PREFER_NODE_CRYPTO_HASH_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Prefer the modern one-shot node:crypto hash API when streaming state is unnecessary.",
   rationale: "A createHash-update-digest chain allocates mutable streaming state for a single in-memory value; Node's built-in hash function expresses the one-shot operation directly and can use its optimized fast path.",
   remediation: "On a supported Node runtime, consider hash(algorithm, value, encoding). Preserve the output encoding explicitly: digest() returns a Buffer, while hash defaults to hex. Keep createHash for streams or multiple updates.",
@@ -16033,6 +16079,7 @@ function isCreateHashCall(node, directBindings, namespaceBindings, resolve2) {
 // src/rules/prefer-node-fs-promises.ts
 var import_utils95 = require("@typescript-eslint/utils");
 var PREFER_NODE_FS_PROMISES_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Prefer promise-based Node.js filesystem APIs over synchronous calls in production modules.",
   rationale: "Synchronous filesystem work blocks the event loop and can stall unrelated daemon, server, and worker tasks.",
   remediation: "Import the promise API from node:fs/promises and await it; use FileHandle.sync only where a documented durability boundary requires it.",
@@ -17299,6 +17346,7 @@ function ifGuardDominates(use, branch, positive) {
 // src/rules/prefer-shared-zod-enum.ts
 var import_utils100 = require("@typescript-eslint/utils");
 var PREFER_SHARED_ZOD_ENUM_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Give repeated literal Zod enum domains one reusable module-level schema.",
   rationale: "Repeated literal domains hide a shared contract and allow equivalent fields to drift independently.",
   remediation: "Declare a module-level named Zod enum schema and reuse it at each field or contract site.",
@@ -17386,6 +17434,7 @@ var prefer_shared_zod_enum_default = createRule({
 // src/rules/prefer-switch-for-repeated-equality.ts
 var import_utils101 = require("@typescript-eslint/utils");
 var PREFER_SWITCH_FOR_REPEATED_EQUALITY_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Prefer switch over long if/else-if chains that compare one value for strict equality.",
   rationale: "A switch makes finite dispatch cases visually uniform and easier to extend without duplicating the discriminant.",
   remediation: "Replace three or more strict-equality branches over the same discriminant with a switch; keep if statements for ranges, guards, and heterogeneous predicates.",
@@ -18244,6 +18293,7 @@ var LITERAL_KEY_HAZARDS = /* @__PURE__ */ new Set(["__proto__"]);
 var NUMERIC_SIGNS2 = /* @__PURE__ */ new Set(["-", "+"]);
 var MIN_RUN_LENGTH = 2;
 var PREFER_WHOLE_OBJECT_ASSERTION_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Collapse consecutive assertions on one object into a whole-object assertion so related mismatches are reported together.",
   rationale: "One whole-object assertion presents related expectations together and produces a complete structural diff.",
   remediation: "Consider one `toMatchObject` assertion for ordinary data objects. Preserve missing-property checks, identity, and getter or proxy behavior when deciding whether to combine assertions.",
@@ -20071,6 +20121,7 @@ var require_fetch_timeout_default = createRule({
 // src/rules/require-interface-for-exported-class.ts
 var import_utils110 = require("@typescript-eslint/utils");
 var REQUIRE_INTERFACE_FOR_EXPORTED_CLASS_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Require exported concrete classes with public behavior to declare a contract.",
   rationale: "An explicit contract names the intended public capability separately from implementation details. TypeScript already supports structural compatibility; this is an architecture policy, not a prerequisite for substitution.",
   remediation: "Declare a focused interface and add an implements clause, or inherit from an intentional base contract.",
@@ -20850,6 +20901,7 @@ var MODEL_EXECUTION_METHODS = /* @__PURE__ */ new Set([
 ]);
 var DATABASE_NAMES = /^(?:db|database|connection|pool|prisma|query|transaction|tx)$/iu;
 var REQUIRE_SQL_ACCESS_CLASS_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Keep SQL reads and writes inside a class that receives its database dependency.",
   rationale: "An injected repository class is the preferred ownership boundary for database access under this architectural policy; free functions can also express explicit dependencies.",
   remediation: "Move the query into a repository or store class and inject the pool, connection, transaction, or typed database binding through its constructor.",
@@ -22565,6 +22617,7 @@ function importedAssertionKind(specifier) {
 // src/rules/sole-export-matches-filename.ts
 var import_utils120 = require("@typescript-eslint/utils");
 var SOLE_EXPORT_MATCHES_FILENAME_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Make a module filename reflect its sole named public runtime export.",
   rationale: "When a module owns one runtime responsibility, matching names make that responsibility directly discoverable.",
   remediation: "Name the module for the exported responsibility, using either the full export name or a clear leading or trailing domain phrase; otherwise colocate genuinely related exports.",
@@ -23232,7 +23285,7 @@ var RULES = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.26.0"
+  version: "15.26.2"
 };
 var APPLICATION_ONLY_RULES = [];
 var LIBRARY_IMPORT_POLICY = ["error", {

package/dist/index.d.cts

@@ -17,6 +17,7 @@ declare const RETIRED_RULES: Readonly<Record<string, RetiredRule>>;
 
 type RuleCategory = "architecture" | "correctness" | "maintainability" | "performance" | "security" | "style" | "testing";
 type AutofixPolicy = "none" | "safe" | "suggestion";
+type DefaultLevel = "error" | "warning";
 type ExampleOutcome = "match" | "no-match";
 interface ExampleFile {
     readonly path: string;
@@ -40,6 +41,7 @@ interface RuleDocumentation {
     readonly rationale: string;
     readonly remediation: string;
     readonly category: RuleCategory;
+    readonly defaultLevel?: DefaultLevel;
     readonly languages?: readonly "typescript"[];
     readonly autofix?: AutofixPolicy;
     readonly aliases?: readonly string[];
@@ -69,6 +71,7 @@ interface PublicRuleSpec {
     readonly rationale: string;
     readonly remediation: string;
     readonly category: RuleCategory;
+    readonly defaultLevel: DefaultLevel;
     readonly languages: readonly "typescript"[];
     readonly autofix: AutofixPolicy;
     readonly aliases: readonly string[];
@@ -172,11 +175,6 @@ interface RuleOptions$1 {
     readonly max?: number;
 }
 
-/**
- * @fileoverview no-dynamic-sql — bind runtime values separately from SQL string literals.
- *
- * Examples: https://github.com/sarj-ai/code-standards/blob/main/packages/typescript/tests/rules/no-dynamic-sql.test.ts
- */
 interface RuleOptions {
     readonly methods?: readonly string[];
 }
@@ -244,7 +242,7 @@ declare const RULES: {
     readonly "no-cors-wildcard-with-credentials": DocumentedRule<readonly [], "corsWildcardWithCredentials">;
     readonly "no-duplicate-lifecycle-refresh-listeners": DocumentedRule<readonly [], "duplicateLifecycleRefresh">;
     readonly "no-dangerously-allow-svg": DocumentedRule<readonly [], "noDangerouslyAllowSvg">;
-    readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql">;
+    readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql" | "dynamicFragment">;
     readonly "no-enum": DocumentedRule<readonly [{
         ignoreFiles?: readonly string[];
     }?], "noEnum">;
@@ -998,7 +996,7 @@ type FlatPreset = {
 declare const PLUGIN: {
     readonly meta: {
         readonly name: "@sarj/eslint-plugin";
-        readonly version: "15.26.0";
+        readonly version: "15.26.2";
     };
     readonly rules: {
         readonly "no-conditional-empty-object-spread": DocumentedRule<[], "avoid">;
@@ -1034,7 +1032,7 @@ declare const PLUGIN: {
         readonly "no-cors-wildcard-with-credentials": DocumentedRule<readonly [], "corsWildcardWithCredentials">;
         readonly "no-duplicate-lifecycle-refresh-listeners": DocumentedRule<readonly [], "duplicateLifecycleRefresh">;
         readonly "no-dangerously-allow-svg": DocumentedRule<readonly [], "noDangerouslyAllowSvg">;
-        readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql">;
+        readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql" | "dynamicFragment">;
         readonly "no-enum": DocumentedRule<readonly [{
             ignoreFiles?: readonly string[];
         }?], "noEnum">;

package/dist/index.d.ts

@@ -17,6 +17,7 @@ declare const RETIRED_RULES: Readonly<Record<string, RetiredRule>>;
 
 type RuleCategory = "architecture" | "correctness" | "maintainability" | "performance" | "security" | "style" | "testing";
 type AutofixPolicy = "none" | "safe" | "suggestion";
+type DefaultLevel = "error" | "warning";
 type ExampleOutcome = "match" | "no-match";
 interface ExampleFile {
     readonly path: string;
@@ -40,6 +41,7 @@ interface RuleDocumentation {
     readonly rationale: string;
     readonly remediation: string;
     readonly category: RuleCategory;
+    readonly defaultLevel?: DefaultLevel;
     readonly languages?: readonly "typescript"[];
     readonly autofix?: AutofixPolicy;
     readonly aliases?: readonly string[];
@@ -69,6 +71,7 @@ interface PublicRuleSpec {
     readonly rationale: string;
     readonly remediation: string;
     readonly category: RuleCategory;
+    readonly defaultLevel: DefaultLevel;
     readonly languages: readonly "typescript"[];
     readonly autofix: AutofixPolicy;
     readonly aliases: readonly string[];
@@ -172,11 +175,6 @@ interface RuleOptions$1 {
     readonly max?: number;
 }
 
-/**
- * @fileoverview no-dynamic-sql — bind runtime values separately from SQL string literals.
- *
- * Examples: https://github.com/sarj-ai/code-standards/blob/main/packages/typescript/tests/rules/no-dynamic-sql.test.ts
- */
 interface RuleOptions {
     readonly methods?: readonly string[];
 }
@@ -244,7 +242,7 @@ declare const RULES: {
     readonly "no-cors-wildcard-with-credentials": DocumentedRule<readonly [], "corsWildcardWithCredentials">;
     readonly "no-duplicate-lifecycle-refresh-listeners": DocumentedRule<readonly [], "duplicateLifecycleRefresh">;
     readonly "no-dangerously-allow-svg": DocumentedRule<readonly [], "noDangerouslyAllowSvg">;
-    readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql">;
+    readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql" | "dynamicFragment">;
     readonly "no-enum": DocumentedRule<readonly [{
         ignoreFiles?: readonly string[];
     }?], "noEnum">;
@@ -998,7 +996,7 @@ type FlatPreset = {
 declare const PLUGIN: {
     readonly meta: {
         readonly name: "@sarj/eslint-plugin";
-        readonly version: "15.26.0";
+        readonly version: "15.26.2";
     };
     readonly rules: {
         readonly "no-conditional-empty-object-spread": DocumentedRule<[], "avoid">;
@@ -1034,7 +1032,7 @@ declare const PLUGIN: {
         readonly "no-cors-wildcard-with-credentials": DocumentedRule<readonly [], "corsWildcardWithCredentials">;
         readonly "no-duplicate-lifecycle-refresh-listeners": DocumentedRule<readonly [], "duplicateLifecycleRefresh">;
         readonly "no-dangerously-allow-svg": DocumentedRule<readonly [], "noDangerouslyAllowSvg">;
-        readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql">;
+        readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql" | "dynamicFragment">;
         readonly "no-enum": DocumentedRule<readonly [{
             ignoreFiles?: readonly string[];
         }?], "noEnum">;

package/dist/index.js

@@ -45,6 +45,7 @@ ${missing.join("\n")}`);
       rationale: spec.rationale,
       remediation: spec.remediation,
       category: spec.category,
+      defaultLevel: spec.defaultLevel,
       languages: spec.languages,
       autofix: spec.autofix,
       aliases: spec.aliases,
@@ -126,6 +127,7 @@ function nativeSpec(config, documentation) {
     rationale: documentation.rationale,
     remediation: documentation.remediation,
     category: documentation.category,
+    defaultLevel: documentation.defaultLevel ?? "error",
     languages: [...documentation.languages ?? ["typescript"]],
     autofix: documentation.autofix ?? "none",
     aliases,
@@ -979,6 +981,7 @@ var require_button_accessible_name_default = createRule({
 // src/rules/require-camelcase-properties.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES8 } from "@typescript-eslint/utils";
 var REQUIRE_CAMELCASE_PROPERTIES_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Require unquoted lower snake_case TypeScript properties and dot access to use camelCase.",
   rationale: "Unquoted snake_case property syntax makes external wire naming indistinguishable from application-domain naming and lets inconsistent contracts spread through typed code.",
   remediation: "Rename application properties to camelCase. At an external wire boundary, make the exception explicit with a quoted key and bracket access.",
@@ -2309,6 +2312,7 @@ var FILE_SELF_REFERENCE_RE = /\bthis (?:file|module)\b/iu;
 var CHANGE_HISTORY_RE = /\b(?:used to|previously|histor(?:y|ical)|keep moving|models? (?:move|moved|change|changed)|still under review)\b/iu;
 var IMPLEMENTATION_MAP_RE = /\b(?:everything (?:above|below)|nothing else|only thing|write half|maps? between|seam between)\b/iu;
 var EXCESSIVE_COMMENTARY_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Flag long standalone implementation commentary that should be expressed by code.",
   rationale: "Narrative implementation paragraphs compete with the code and can drift independently from behavior.",
   remediation: "Delete narration and clarify names, types, or structure; retain only durable constraints and external contracts.",
@@ -4109,12 +4113,12 @@ function createSqlListener(handler) {
 
 // src/rules/no-dynamic-sql.ts
 var NO_DYNAMIC_SQL_DOCUMENTATION = {
-  summary: "Disallow runtime values embedded inside quoted SQL values passed to statement-execution methods.",
-  rationale: "Embedding runtime values in SQL bypasses driver parameterization and can introduce injection defects or unstable query plans.",
-  remediation: "Use SQL placeholders and pass runtime values through the driver's binding API.",
+  summary: "Disallow runtime values and fragments interpolated into SQL passed to statement-execution methods.",
+  rationale: "Embedding runtime values or fragments in SQL bypasses driver parameterization or an explicit allowlist and can introduce injection defects or unstable query plans.",
+  remediation: "Bind data values through SQL placeholders. Select non-bindable identifiers or clauses from fixed, reviewed fragments instead of interpolating runtime text.",
   category: "security",
   limitations: [
-    "Only single-quoted SQL values are inspected. Double-quoted identifiers, comments, dollar strings, and unquoted fragments are excluded; this is not a general SQL injection detector.",
+    "Template and concatenation fragments are inspected at recognized execution calls. Double-quoted identifiers, comments, and dollar strings are excluded; this is not a general SQL injection detector.",
     "Literal fragments, legacy uppercase fragment names, and parameterizing tagged templates are exempt; uppercase spelling does not prove a value is static.",
     "The bounded lexer recognizes doubled quotes, comments, and PostgreSQL dollar strings; dialect-specific escape modes and SQL generated through other APIs require separate security review."
   ],
@@ -4136,6 +4140,26 @@ var NO_DYNAMIC_SQL_DOCUMENTATION = {
       focusPath: "src/users.ts",
       expectedCount: 1,
       public: true
+    },
+    {
+      id: "bound-unquoted-value",
+      scenarioId: "unquoted",
+      title: "An unquoted runtime value is bound separately",
+      outcome: "no-match",
+      files: [{ path: "src/users.ts", source: "db.prepare('select id from users where id = ?').bind(userId);" }],
+      focusPath: "src/users.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "unquoted-runtime-fragment",
+      scenarioId: "unquoted",
+      title: "A runtime fragment is interpolated into SQL",
+      outcome: "match",
+      files: [{ path: "src/users.ts", source: "db.prepare(`select id from users where id = ${userId}`);" }],
+      focusPath: "src/users.ts",
+      expectedCount: 1,
+      public: true
     }
   ]
 };
@@ -4158,14 +4182,21 @@ function isStaticFragment(expression) {
 }
 function runtimeInterpolations(template) {
   const parts = template.quasis.map((quasi) => quasi.value.cooked ?? quasi.value.raw);
-  const ranges = sqlSingleQuotedRanges(parts.join(RUNTIME_MARKER));
+  const statement = parts.join(RUNTIME_MARKER);
+  const ranges = sqlSingleQuotedRanges(statement);
+  const visible = stripSqlNoise(statement);
   let offset = 0;
-  return template.expressions.filter(
+  return template.expressions.flatMap(
     (expression, index) => {
       offset += parts[index]?.length ?? 0;
       const inValue = ranges.some(([start, end]) => start < offset && offset < end);
+      const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
       offset += RUNTIME_MARKER.length;
-      return inValue && !isStaticFragment(expression) && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "");
+      if (isStaticFragment(expression)) return [];
+      if (inValue && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "")) {
+        return [{ expression, messageId: "dynamicSql" }];
+      }
+      return unquoted ? [{ expression, messageId: "dynamicFragment" }] : [];
     }
   );
 }
@@ -4196,16 +4227,21 @@ function runtimeConcatOperands(node) {
     return [];
   }
   const parts = operands.map((operand) => staticLiteralText(operand) ?? RUNTIME_MARKER);
-  const ranges = sqlSingleQuotedRanges(parts.join(""));
+  const statement = parts.join("");
+  const ranges = sqlSingleQuotedRanges(statement);
+  const visible = stripSqlNoise(statement);
   let offset = 0;
-  return operands.filter((operand, index) => {
+  return operands.flatMap((operand, index) => {
     const inValue = ranges.some(([start, end]) => start < offset && offset < end);
+    const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
     offset += parts[index]?.length ?? 0;
-    if (!inValue) return false;
-    if (isStaticFragment(operand)) return false;
+    if (isStaticFragment(operand)) return [];
     const before = operands[index - 1];
     const after = operands[index + 1];
-    return before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "");
+    if (inValue && before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "")) {
+      return [{ expression: operand, messageId: "dynamicSql" }];
+    }
+    return unquoted ? [{ expression: operand, messageId: "dynamicFragment" }] : [];
   });
 }
 function concatOperands(node) {
@@ -4261,7 +4297,8 @@ var no_dynamic_sql_default = createRule({
       }
     ],
     messages: {
-      dynamicSql: "Runtime value embedded inside a quoted SQL value passed to `{{method}}()`. Replace the quoted interpolation with a placeholder and bind the value separately."
+      dynamicSql: "Runtime value embedded inside a quoted SQL value passed to `{{method}}()`. Replace the quoted interpolation with a placeholder and bind the value separately.",
+      dynamicFragment: "Runtime fragment interpolated into SQL passed to `{{method}}()`. Bind data values; select non-bindable SQL fragments from fixed, reviewed alternatives."
     }
   },
   defaultOptions: [{}],
@@ -4280,8 +4317,8 @@ var no_dynamic_sql_default = createRule({
         const offenders = statement.type === AST_NODE_TYPES25.TemplateLiteral ? runtimeInterpolations(statement) : runtimeConcatOperands(statement);
         for (const offender of offenders) {
           context.report({
-            node: offender,
-            messageId: "dynamicSql",
+            node: offender.expression,
+            messageId: offender.messageId,
             data: { method }
           });
         }
@@ -5921,6 +5958,7 @@ import {
 } from "@typescript-eslint/utils";
 import ts5 from "typescript";
 var NO_JSON_STRINGIFY_OBJECT_EQUALITY_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Do not use JSON serialization as structural object equality.",
   rationale: "JSON text equality depends on property insertion order and serialization behavior, so semantically equal objects can compare unequal and distinct values can collapse together.",
   remediation: "Compare an explicit domain projection structurally, or use a reviewed canonical serializer when JSON semantics are required.",
@@ -7191,6 +7229,7 @@ var no_bare_return_from_test_catch_default = createRule({
 // src/rules/no-bespoke-api-case-conversion.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES38, ASTUtils as ASTUtils15 } from "@typescript-eslint/utils";
 var NO_BESPOKE_API_CASE_CONVERSION_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Review direct snake_case/camelCase mirror mappings on explicitly API-typed adapter values.",
   rationale: "Duplicating wire-name translation can drift from an API client contract. When the SDK owns application-facing names, centralizing conversion avoids maintaining another mirror by hand.",
   remediation: "Move wire-name ownership and case conversion into the generated SDK/model layer; keep application adapters on the generated typed surface.",
@@ -8937,6 +8976,7 @@ var WALL_NARRATION_RE2 = /^(?:(?:\d+[.)]|(?:phase|step)\s+\d+\s*:?)\s*)?(?:add|b
 var WALL_CLUSTER_MAX_LINE_GAP = 8;
 var WALL_CLUSTER_MIN_COMMENTS = 3;
 var NO_RESTATED_COMMENT_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Flag short standalone comments that repeat the adjacent statement's identifiers.",
   rationale: "A comment that only repeats code adds no context and can become stale independently.",
   remediation: "Remove a genuine restatement; retain conditions, constraints, rationale, and information absent from the statement.",
@@ -9086,6 +9126,7 @@ function isRestatableLabel(body2) {
 // src/rules/no-restated-jsdoc.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES47 } from "@typescript-eslint/utils";
 var NO_RESTATED_JSDOC_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Flag JSDoc prose that appears to repeat declaration names without adding behavioral information.",
   rationale: "Signature-only JSDoc duplicates type information and drifts without helping callers.",
   remediation: "Delete the block or document behavior, constraints, failures, or context the signature cannot express.",
@@ -13658,6 +13699,7 @@ import {
   AST_NODE_TYPES as AST_NODE_TYPES68
 } from "@typescript-eslint/utils";
 var PREFER_MILLISECOND_CONTROL_DURATION_SCHEMA_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Require application-owned Zod control-duration fields to use millisecond granularity.",
   rationale: "Second-granularity timeout and scheduling controls lose precision and invite implicit unit conversion at API boundaries. Encoding milliseconds in the schema keeps the unit explicit and composes with platform timing APIs.",
   remediation: "Rename the field with an `Ms`/`_ms` suffix and express its bounds and default in milliseconds; update the owning API contract rather than converting in application code.",
@@ -15280,6 +15322,7 @@ var FUNCTION_TYPES9 = /* @__PURE__ */ new Set([
   AST_NODE_TYPES73.FunctionExpression
 ]);
 var PREFER_MODULE_LEVEL_REFINED_SCHEMA_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Declare closed Zod scalar, format, and wrapper schemas at module scope.",
   rationale: "A closed validation pipeline created inside a function is rebuilt on every invocation and obscures a reusable constraint.",
   remediation: "Move the validation schema to module scope, name it with a PascalCase Schema suffix, and call parse on the shared schema.",
@@ -15556,6 +15599,7 @@ import {
   ASTUtils as ASTUtils34
 } from "@typescript-eslint/utils";
 var PREFER_MULTI_VALUE_ZOD_LITERAL_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Use the Zod 4 multi-value literal API instead of a union of literal schemas.",
   rationale: "One multi-value literal expresses the same closed value domain without repeated schema wrappers.",
   remediation: "Replace the union with z.literal([value1, value2, ...]).",
@@ -15742,6 +15786,7 @@ var prefer_named_callback_domain_default = createRule({
 // src/rules/prefer-named-complex-return-type.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES76 } from "@typescript-eslint/utils";
 var PREFER_NAMED_COMPLEX_RETURN_TYPE_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Prefer a named contract for structurally complex function return types.",
   rationale: "A large inline return annotation hides a reusable domain concept and makes signatures difficult to scan.",
   remediation: "Name the complex nested shape while preserving its generic wrappers and type parameters; reference the named contract from the return annotation.",
@@ -15902,6 +15947,7 @@ var prefer_native_random_uuid_default = createRule({
 // src/rules/prefer-node-crypto-hash.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES78, ASTUtils as ASTUtils36 } from "@typescript-eslint/utils";
 var PREFER_NODE_CRYPTO_HASH_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Prefer the modern one-shot node:crypto hash API when streaming state is unnecessary.",
   rationale: "A createHash-update-digest chain allocates mutable streaming state for a single in-memory value; Node's built-in hash function expresses the one-shot operation directly and can use its optimized fast path.",
   remediation: "On a supported Node runtime, consider hash(algorithm, value, encoding). Preserve the output encoding explicitly: digest() returns a Buffer, while hash defaults to hex. Keep createHash for streams or multiple updates.",
@@ -16034,6 +16080,7 @@ function isCreateHashCall(node, directBindings, namespaceBindings, resolve2) {
 // src/rules/prefer-node-fs-promises.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES79, ASTUtils as ASTUtils37 } from "@typescript-eslint/utils";
 var PREFER_NODE_FS_PROMISES_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Prefer promise-based Node.js filesystem APIs over synchronous calls in production modules.",
   rationale: "Synchronous filesystem work blocks the event loop and can stall unrelated daemon, server, and worker tasks.",
   remediation: "Import the promise API from node:fs/promises and await it; use FileHandle.sync only where a documented durability boundary requires it.",
@@ -17308,6 +17355,7 @@ function ifGuardDominates(use, branch, positive) {
 // src/rules/prefer-shared-zod-enum.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES84, ASTUtils as ASTUtils42 } from "@typescript-eslint/utils";
 var PREFER_SHARED_ZOD_ENUM_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Give repeated literal Zod enum domains one reusable module-level schema.",
   rationale: "Repeated literal domains hide a shared contract and allow equivalent fields to drift independently.",
   remediation: "Declare a module-level named Zod enum schema and reuse it at each field or contract site.",
@@ -17395,6 +17443,7 @@ var prefer_shared_zod_enum_default = createRule({
 // src/rules/prefer-switch-for-repeated-equality.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES85 } from "@typescript-eslint/utils";
 var PREFER_SWITCH_FOR_REPEATED_EQUALITY_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Prefer switch over long if/else-if chains that compare one value for strict equality.",
   rationale: "A switch makes finite dispatch cases visually uniform and easier to extend without duplicating the discriminant.",
   remediation: "Replace three or more strict-equality branches over the same discriminant with a switch; keep if statements for ranges, guards, and heterogeneous predicates.",
@@ -18253,6 +18302,7 @@ var LITERAL_KEY_HAZARDS = /* @__PURE__ */ new Set(["__proto__"]);
 var NUMERIC_SIGNS2 = /* @__PURE__ */ new Set(["-", "+"]);
 var MIN_RUN_LENGTH = 2;
 var PREFER_WHOLE_OBJECT_ASSERTION_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Collapse consecutive assertions on one object into a whole-object assertion so related mismatches are reported together.",
   rationale: "One whole-object assertion presents related expectations together and produces a complete structural diff.",
   remediation: "Consider one `toMatchObject` assertion for ordinary data objects. Preserve missing-property checks, identity, and getter or proxy behavior when deciding whether to combine assertions.",
@@ -20086,6 +20136,7 @@ var require_fetch_timeout_default = createRule({
 // src/rules/require-interface-for-exported-class.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES93 } from "@typescript-eslint/utils";
 var REQUIRE_INTERFACE_FOR_EXPORTED_CLASS_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Require exported concrete classes with public behavior to declare a contract.",
   rationale: "An explicit contract names the intended public capability separately from implementation details. TypeScript already supports structural compatibility; this is an architecture policy, not a prerequisite for substitution.",
   remediation: "Declare a focused interface and add an implements clause, or inherit from an intentional base contract.",
@@ -20865,6 +20916,7 @@ var MODEL_EXECUTION_METHODS = /* @__PURE__ */ new Set([
 ]);
 var DATABASE_NAMES = /^(?:db|database|connection|pool|prisma|query|transaction|tx)$/iu;
 var REQUIRE_SQL_ACCESS_CLASS_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Keep SQL reads and writes inside a class that receives its database dependency.",
   rationale: "An injected repository class is the preferred ownership boundary for database access under this architectural policy; free functions can also express explicit dependencies.",
   remediation: "Move the query into a repository or store class and inject the pool, connection, transaction, or typed database binding through its constructor.",
@@ -22583,6 +22635,7 @@ function importedAssertionKind(specifier) {
 // src/rules/sole-export-matches-filename.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES101 } from "@typescript-eslint/utils";
 var SOLE_EXPORT_MATCHES_FILENAME_DOCUMENTATION = {
+  defaultLevel: "warning",
   summary: "Make a module filename reflect its sole named public runtime export.",
   rationale: "When a module owns one runtime responsibility, matching names make that responsibility directly discoverable.",
   remediation: "Name the module for the exported responsibility, using either the full export name or a clear leading or trailing domain phrase; otherwise colocate genuinely related exports.",
@@ -23253,7 +23306,7 @@ var RULES = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.26.0"
+  version: "15.26.2"
 };
 var APPLICATION_ONLY_RULES = [];
 var LIBRARY_IMPORT_POLICY = ["error", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "15.26.0",
+  "version": "15.26.2",
   "packageManager": "npm@12.0.2",
   "description": "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",