@sarj/eslint-plugin 15.26.1 → 15.26.3

package/dist/index.cjs

@@ -652,6 +652,25 @@ var no_broad_return_type_default = createRule({
 // src/rules/no-reduce-accumulator-copy.ts
 var import_utils5 = require("@typescript-eslint/utils");
 var import_typescript3 = __toESM(require("typescript"), 1);
+
+// src/rules/_for-each-ast-child.ts
+function forEachAstChild(node, visitorKeys, visit) {
+  for (const key of visitorKeys[node.type] ?? []) {
+    const value = node[key];
+    if (Array.isArray(value)) {
+      const children = value;
+      for (const child of children) if (isNode(child) && visit(child) === true) return true;
+    } else if (isNode(value)) {
+      if (visit(value) === true) return true;
+    }
+  }
+  return false;
+}
+function isNode(value) {
+  return typeof value === "object" && value !== null && "type" in value && typeof value.type === "string";
+}
+
+// src/rules/no-reduce-accumulator-copy.ts
 var NO_REDUCE_ACCUMULATOR_COPY_DOCUMENTATION = {
   summary: "Review copies of the accumulated collection inside a built-in reduce callback.",
   rationale: "Copying a growing accumulator at every step can make collection quadratic instead of linear in its output size.",
@@ -722,12 +741,7 @@ var no_reduce_accumulator_copy_default = createRule({
             context.report({ node: current, messageId: "copy" });
           }
           if (current.type === import_utils5.AST_NODE_TYPES.CallExpression) inspectCall(current);
-          for (const key of context.sourceCode.visitorKeys[current.type] ?? []) {
-            const child = current[key];
-            if (Array.isArray(child)) {
-              for (const item of child) if (item !== null && typeof item === "object" && "type" in item) inspect(item);
-            } else if (child !== null && typeof child === "object" && "type" in child) inspect(child);
-          }
+          forEachAstChild(current, context.sourceCode.visitorKeys, inspect);
         };
         inspect(callback.body);
       }
@@ -3546,17 +3560,17 @@ function subtreeContainsStarLiteral(node) {
     const value = node[key];
     if (Array.isArray(value)) {
       for (const child of value) {
-        if (isNode(child) && subtreeContainsStarLiteral(child)) {
+        if (isNode2(child) && subtreeContainsStarLiteral(child)) {
           return true;
         }
       }
-    } else if (isNode(value) && subtreeContainsStarLiteral(value)) {
+    } else if (isNode2(value) && subtreeContainsStarLiteral(value)) {
       return true;
     }
   }
   return false;
 }
-function isNode(value) {
+function isNode2(value) {
   return typeof value === "object" && value !== null && typeof value.type === "string";
 }
 function calleeName(node) {
@@ -4149,12 +4163,12 @@ function createSqlListener(handler) {
 
 // src/rules/no-dynamic-sql.ts
 var NO_DYNAMIC_SQL_DOCUMENTATION = {
-  summary: "Disallow runtime values embedded inside quoted SQL values passed to statement-execution methods.",
-  rationale: "Embedding runtime values in SQL bypasses driver parameterization and can introduce injection defects or unstable query plans.",
-  remediation: "Use SQL placeholders and pass runtime values through the driver's binding API.",
+  summary: "Disallow runtime values and fragments interpolated into SQL passed to statement-execution methods.",
+  rationale: "Embedding runtime values or fragments in SQL bypasses driver parameterization or an explicit allowlist and can introduce injection defects or unstable query plans.",
+  remediation: "Bind data values through SQL placeholders. Select non-bindable identifiers or clauses from fixed, reviewed fragments instead of interpolating runtime text.",
   category: "security",
   limitations: [
-    "Only single-quoted SQL values are inspected. Double-quoted identifiers, comments, dollar strings, and unquoted fragments are excluded; this is not a general SQL injection detector.",
+    "Template and concatenation fragments are inspected at recognized execution calls. Double-quoted identifiers, comments, and dollar strings are excluded; this is not a general SQL injection detector.",
     "Literal fragments, legacy uppercase fragment names, and parameterizing tagged templates are exempt; uppercase spelling does not prove a value is static.",
     "The bounded lexer recognizes doubled quotes, comments, and PostgreSQL dollar strings; dialect-specific escape modes and SQL generated through other APIs require separate security review."
   ],
@@ -4176,6 +4190,26 @@ var NO_DYNAMIC_SQL_DOCUMENTATION = {
       focusPath: "src/users.ts",
       expectedCount: 1,
       public: true
+    },
+    {
+      id: "bound-unquoted-value",
+      scenarioId: "unquoted",
+      title: "An unquoted runtime value is bound separately",
+      outcome: "no-match",
+      files: [{ path: "src/users.ts", source: "db.prepare('select id from users where id = ?').bind(userId);" }],
+      focusPath: "src/users.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "unquoted-runtime-fragment",
+      scenarioId: "unquoted",
+      title: "A runtime fragment is interpolated into SQL",
+      outcome: "match",
+      files: [{ path: "src/users.ts", source: "db.prepare(`select id from users where id = ${userId}`);" }],
+      focusPath: "src/users.ts",
+      expectedCount: 1,
+      public: true
     }
   ]
 };
@@ -4198,14 +4232,21 @@ function isStaticFragment(expression) {
 }
 function runtimeInterpolations(template) {
   const parts = template.quasis.map((quasi) => quasi.value.cooked ?? quasi.value.raw);
-  const ranges = sqlSingleQuotedRanges(parts.join(RUNTIME_MARKER));
+  const statement = parts.join(RUNTIME_MARKER);
+  const ranges = sqlSingleQuotedRanges(statement);
+  const visible = stripSqlNoise(statement);
   let offset = 0;
-  return template.expressions.filter(
+  return template.expressions.flatMap(
     (expression, index) => {
       offset += parts[index]?.length ?? 0;
       const inValue = ranges.some(([start, end]) => start < offset && offset < end);
+      const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
       offset += RUNTIME_MARKER.length;
-      return inValue && !isStaticFragment(expression) && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "");
+      if (isStaticFragment(expression)) return [];
+      if (inValue && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "")) {
+        return [{ expression, messageId: "dynamicSql" }];
+      }
+      return unquoted ? [{ expression, messageId: "dynamicFragment" }] : [];
     }
   );
 }
@@ -4236,16 +4277,21 @@ function runtimeConcatOperands(node) {
     return [];
   }
   const parts = operands.map((operand) => staticLiteralText(operand) ?? RUNTIME_MARKER);
-  const ranges = sqlSingleQuotedRanges(parts.join(""));
+  const statement = parts.join("");
+  const ranges = sqlSingleQuotedRanges(statement);
+  const visible = stripSqlNoise(statement);
   let offset = 0;
-  return operands.filter((operand, index) => {
+  return operands.flatMap((operand, index) => {
     const inValue = ranges.some(([start, end]) => start < offset && offset < end);
+    const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
     offset += parts[index]?.length ?? 0;
-    if (!inValue) return false;
-    if (isStaticFragment(operand)) return false;
+    if (isStaticFragment(operand)) return [];
     const before = operands[index - 1];
     const after = operands[index + 1];
-    return before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "");
+    if (inValue && before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "")) {
+      return [{ expression: operand, messageId: "dynamicSql" }];
+    }
+    return unquoted ? [{ expression: operand, messageId: "dynamicFragment" }] : [];
   });
 }
 function concatOperands(node) {
@@ -4301,7 +4347,8 @@ var no_dynamic_sql_default = createRule({
       }
     ],
     messages: {
-      dynamicSql: "Runtime value embedded inside a quoted SQL value passed to `{{method}}()`. Replace the quoted interpolation with a placeholder and bind the value separately."
+      dynamicSql: "Runtime value embedded inside a quoted SQL value passed to `{{method}}()`. Replace the quoted interpolation with a placeholder and bind the value separately.",
+      dynamicFragment: "Runtime fragment interpolated into SQL passed to `{{method}}()`. Bind data values; select non-bindable SQL fragments from fixed, reviewed alternatives."
     }
   },
   defaultOptions: [{}],
@@ -4320,8 +4367,8 @@ var no_dynamic_sql_default = createRule({
         const offenders = statement.type === import_utils27.AST_NODE_TYPES.TemplateLiteral ? runtimeInterpolations(statement) : runtimeConcatOperands(statement);
         for (const offender of offenders) {
           context.report({
-            node: offender,
-            messageId: "dynamicSql",
+            node: offender.expression,
+            messageId: offender.messageId,
             data: { method }
           });
         }
@@ -4537,15 +4584,7 @@ function functionComplexity(fn, visitorKeys) {
     visitChildren(node, nesting);
   }
   function visitChildren(node, nesting) {
-    for (const key of visitorKeys[node.type] ?? []) {
-      const value = node[key];
-      const candidates = Array.isArray(value) ? value : [value];
-      for (const candidate2 of candidates) {
-        if (typeof candidate2 === "object" && candidate2 !== null && "type" in candidate2) {
-          visit(candidate2, nesting);
-        }
-      }
-    }
+    forEachAstChild(node, visitorKeys, (child) => visit(child, nesting));
   }
   visit(fn.body, 0);
   return points;
@@ -4714,7 +4753,7 @@ var PURE_CONSTRUCTORS = /* @__PURE__ */ new Set([
   "Response",
   "AbortController"
 ]);
-function isNode2(value) {
+function isNode3(value) {
   return typeof value === "object" && value !== null && typeof value.type === "string";
 }
 function isPureCall(node) {
@@ -4764,11 +4803,11 @@ function subtreeMatches(stmt, predicate, descendIntoFunctions = false) {
       const value = current[key];
       if (Array.isArray(value)) {
         for (const child of value) {
-          if (isNode2(child)) {
+          if (isNode3(child)) {
             visit(child);
           }
         }
-      } else if (isNode2(value)) {
+      } else if (isNode3(value)) {
         visit(value);
       }
       if (found) {
@@ -9927,7 +9966,7 @@ function isSentinelArgument(arg) {
 function isFunctionNode(node) {
   return node.type === import_utils61.AST_NODE_TYPES.FunctionDeclaration || node.type === import_utils61.AST_NODE_TYPES.FunctionExpression || node.type === import_utils61.AST_NODE_TYPES.ArrowFunctionExpression;
 }
-function isNode3(value) {
+function isNode4(value) {
   return typeof value === "object" && value !== null && typeof value.type === "string";
 }
 function walkWithinScope(node, visit) {
@@ -9950,11 +9989,11 @@ function walkWithinScope(node, visit) {
       const value = current[key];
       if (Array.isArray(value)) {
         for (const child of value) {
-          if (isNode3(child)) {
+          if (isNode4(child)) {
             recurse(child);
           }
         }
-      } else if (isNode3(value)) {
+      } else if (isNode4(value)) {
         recurse(value);
       }
     }
@@ -10012,11 +10051,11 @@ function subtreeReadsName(node, name) {
       const value = current[key];
       if (Array.isArray(value)) {
         for (const child of value) {
-          if (isNode3(child)) {
+          if (isNode4(child)) {
             recurse(child);
           }
         }
-      } else if (isNode3(value)) {
+      } else if (isNode4(value)) {
         recurse(value);
       }
     }
@@ -10077,7 +10116,7 @@ function enclosingFunctionName(node) {
   let current = node.parent;
   while (current !== void 0 && current !== null) {
     if (isFunctionNode(current)) {
-      if ("id" in current && isNode3(current.id) && current.id.type === import_utils61.AST_NODE_TYPES.Identifier) {
+      if ("id" in current && isNode4(current.id) && current.id.type === import_utils61.AST_NODE_TYPES.Identifier) {
         return current.id.name;
       }
       const parent = current.parent;
@@ -10143,7 +10182,7 @@ function tryReturnsSafeParse(catchNode) {
       const value = current[key];
       const children = Array.isArray(value) ? value : [value];
       for (const child of children) {
-        if (isNode3(child)) recurse(child);
+        if (isNode4(child)) recurse(child);
       }
     }
   }
@@ -10182,7 +10221,7 @@ function functionReturnsSameSentinelKindElsewhere(catchNode, kind) {
 function enclosingFunctionBody(node) {
   let current = node.parent;
   while (current !== void 0 && current !== null) {
-    if (isFunctionNode(current) && "body" in current && isNode3(current.body) && current.body.type === import_utils61.AST_NODE_TYPES.BlockStatement) {
+    if (isFunctionNode(current) && "body" in current && isNode4(current.body) && current.body.type === import_utils61.AST_NODE_TYPES.BlockStatement) {
       return current.body;
     }
     current = current.parent;
@@ -16282,13 +16321,7 @@ function isEmptyGuard(node, access) {
 }
 function contains(node, visitorKeys, predicate) {
   if (predicate(node)) return true;
-  for (const key of visitorKeys[node.type] ?? []) {
-    const child = node[key];
-    for (const value of Array.isArray(child) ? child : [child]) {
-      if (value !== null && typeof value === "object" && "type" in value && contains(value, visitorKeys, predicate)) return true;
-    }
-  }
-  return false;
+  return forEachAstChild(node, visitorKeys, (child) => contains(child, visitorKeys, predicate));
 }
 function belongsToFunction(node, fn) {
   let current = node;
@@ -22052,14 +22085,7 @@ function referencedPropertyName(node) {
 function walk(node, visitorKeys, visit, nestedFunction = false) {
   visit(node, nestedFunction);
   const nested = nestedFunction || isFunction(node);
-  for (const key of visitorKeys[node.type] ?? []) {
-    const child = node[key];
-    if (Array.isArray(child)) {
-      for (const item of child) if (typeof item === "object" && item !== null && "type" in item) walk(item, visitorKeys, visit, nested);
-    } else if (typeof child === "object" && child !== null && "type" in child) {
-      walk(child, visitorKeys, visit, nested);
-    }
-  }
+  forEachAstChild(node, visitorKeys, (child) => walk(child, visitorKeys, visit, nested));
 }
 function classScope(context, node, computedReferenceNames) {
   const methods = node.body.body.filter(
@@ -23252,7 +23278,7 @@ var RULES = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.26.1"
+  version: "15.26.3"
 };
 var APPLICATION_ONLY_RULES = [];
 var LIBRARY_IMPORT_POLICY = ["error", {

package/dist/index.d.cts

@@ -175,11 +175,6 @@ interface RuleOptions$1 {
     readonly max?: number;
 }
 
-/**
- * @fileoverview no-dynamic-sql — bind runtime values separately from SQL string literals.
- *
- * Examples: https://github.com/sarj-ai/code-standards/blob/main/packages/typescript/tests/rules/no-dynamic-sql.test.ts
- */
 interface RuleOptions {
     readonly methods?: readonly string[];
 }
@@ -247,7 +242,7 @@ declare const RULES: {
     readonly "no-cors-wildcard-with-credentials": DocumentedRule<readonly [], "corsWildcardWithCredentials">;
     readonly "no-duplicate-lifecycle-refresh-listeners": DocumentedRule<readonly [], "duplicateLifecycleRefresh">;
     readonly "no-dangerously-allow-svg": DocumentedRule<readonly [], "noDangerouslyAllowSvg">;
-    readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql">;
+    readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql" | "dynamicFragment">;
     readonly "no-enum": DocumentedRule<readonly [{
         ignoreFiles?: readonly string[];
     }?], "noEnum">;
@@ -1001,7 +996,7 @@ type FlatPreset = {
 declare const PLUGIN: {
     readonly meta: {
         readonly name: "@sarj/eslint-plugin";
-        readonly version: "15.26.1";
+        readonly version: "15.26.3";
     };
     readonly rules: {
         readonly "no-conditional-empty-object-spread": DocumentedRule<[], "avoid">;
@@ -1037,7 +1032,7 @@ declare const PLUGIN: {
         readonly "no-cors-wildcard-with-credentials": DocumentedRule<readonly [], "corsWildcardWithCredentials">;
         readonly "no-duplicate-lifecycle-refresh-listeners": DocumentedRule<readonly [], "duplicateLifecycleRefresh">;
         readonly "no-dangerously-allow-svg": DocumentedRule<readonly [], "noDangerouslyAllowSvg">;
-        readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql">;
+        readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql" | "dynamicFragment">;
         readonly "no-enum": DocumentedRule<readonly [{
             ignoreFiles?: readonly string[];
         }?], "noEnum">;

package/dist/index.d.ts

@@ -175,11 +175,6 @@ interface RuleOptions$1 {
     readonly max?: number;
 }
 
-/**
- * @fileoverview no-dynamic-sql — bind runtime values separately from SQL string literals.
- *
- * Examples: https://github.com/sarj-ai/code-standards/blob/main/packages/typescript/tests/rules/no-dynamic-sql.test.ts
- */
 interface RuleOptions {
     readonly methods?: readonly string[];
 }
@@ -247,7 +242,7 @@ declare const RULES: {
     readonly "no-cors-wildcard-with-credentials": DocumentedRule<readonly [], "corsWildcardWithCredentials">;
     readonly "no-duplicate-lifecycle-refresh-listeners": DocumentedRule<readonly [], "duplicateLifecycleRefresh">;
     readonly "no-dangerously-allow-svg": DocumentedRule<readonly [], "noDangerouslyAllowSvg">;
-    readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql">;
+    readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql" | "dynamicFragment">;
     readonly "no-enum": DocumentedRule<readonly [{
         ignoreFiles?: readonly string[];
     }?], "noEnum">;
@@ -1001,7 +996,7 @@ type FlatPreset = {
 declare const PLUGIN: {
     readonly meta: {
         readonly name: "@sarj/eslint-plugin";
-        readonly version: "15.26.1";
+        readonly version: "15.26.3";
     };
     readonly rules: {
         readonly "no-conditional-empty-object-spread": DocumentedRule<[], "avoid">;
@@ -1037,7 +1032,7 @@ declare const PLUGIN: {
         readonly "no-cors-wildcard-with-credentials": DocumentedRule<readonly [], "corsWildcardWithCredentials">;
         readonly "no-duplicate-lifecycle-refresh-listeners": DocumentedRule<readonly [], "duplicateLifecycleRefresh">;
         readonly "no-dangerously-allow-svg": DocumentedRule<readonly [], "noDangerouslyAllowSvg">;
-        readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql">;
+        readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql" | "dynamicFragment">;
         readonly "no-enum": DocumentedRule<readonly [{
             ignoreFiles?: readonly string[];
         }?], "noEnum">;

package/dist/index.js

@@ -608,6 +608,25 @@ var no_broad_return_type_default = createRule({
 // src/rules/no-reduce-accumulator-copy.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES4, ASTUtils as ASTUtils2, ESLintUtils as ESLintUtils4 } from "@typescript-eslint/utils";
 import ts3 from "typescript";
+
+// src/rules/_for-each-ast-child.ts
+function forEachAstChild(node, visitorKeys, visit) {
+  for (const key of visitorKeys[node.type] ?? []) {
+    const value = node[key];
+    if (Array.isArray(value)) {
+      const children = value;
+      for (const child of children) if (isNode(child) && visit(child) === true) return true;
+    } else if (isNode(value)) {
+      if (visit(value) === true) return true;
+    }
+  }
+  return false;
+}
+function isNode(value) {
+  return typeof value === "object" && value !== null && "type" in value && typeof value.type === "string";
+}
+
+// src/rules/no-reduce-accumulator-copy.ts
 var NO_REDUCE_ACCUMULATOR_COPY_DOCUMENTATION = {
   summary: "Review copies of the accumulated collection inside a built-in reduce callback.",
   rationale: "Copying a growing accumulator at every step can make collection quadratic instead of linear in its output size.",
@@ -678,12 +697,7 @@ var no_reduce_accumulator_copy_default = createRule({
             context.report({ node: current, messageId: "copy" });
           }
           if (current.type === AST_NODE_TYPES4.CallExpression) inspectCall(current);
-          for (const key of context.sourceCode.visitorKeys[current.type] ?? []) {
-            const child = current[key];
-            if (Array.isArray(child)) {
-              for (const item of child) if (item !== null && typeof item === "object" && "type" in item) inspect(item);
-            } else if (child !== null && typeof child === "object" && "type" in child) inspect(child);
-          }
+          forEachAstChild(current, context.sourceCode.visitorKeys, inspect);
         };
         inspect(callback.body);
       }
@@ -3510,17 +3524,17 @@ function subtreeContainsStarLiteral(node) {
     const value = node[key];
     if (Array.isArray(value)) {
       for (const child of value) {
-        if (isNode(child) && subtreeContainsStarLiteral(child)) {
+        if (isNode2(child) && subtreeContainsStarLiteral(child)) {
           return true;
         }
       }
-    } else if (isNode(value) && subtreeContainsStarLiteral(value)) {
+    } else if (isNode2(value) && subtreeContainsStarLiteral(value)) {
       return true;
     }
   }
   return false;
 }
-function isNode(value) {
+function isNode2(value) {
   return typeof value === "object" && value !== null && typeof value.type === "string";
 }
 function calleeName(node) {
@@ -4113,12 +4127,12 @@ function createSqlListener(handler) {
 
 // src/rules/no-dynamic-sql.ts
 var NO_DYNAMIC_SQL_DOCUMENTATION = {
-  summary: "Disallow runtime values embedded inside quoted SQL values passed to statement-execution methods.",
-  rationale: "Embedding runtime values in SQL bypasses driver parameterization and can introduce injection defects or unstable query plans.",
-  remediation: "Use SQL placeholders and pass runtime values through the driver's binding API.",
+  summary: "Disallow runtime values and fragments interpolated into SQL passed to statement-execution methods.",
+  rationale: "Embedding runtime values or fragments in SQL bypasses driver parameterization or an explicit allowlist and can introduce injection defects or unstable query plans.",
+  remediation: "Bind data values through SQL placeholders. Select non-bindable identifiers or clauses from fixed, reviewed fragments instead of interpolating runtime text.",
   category: "security",
   limitations: [
-    "Only single-quoted SQL values are inspected. Double-quoted identifiers, comments, dollar strings, and unquoted fragments are excluded; this is not a general SQL injection detector.",
+    "Template and concatenation fragments are inspected at recognized execution calls. Double-quoted identifiers, comments, and dollar strings are excluded; this is not a general SQL injection detector.",
     "Literal fragments, legacy uppercase fragment names, and parameterizing tagged templates are exempt; uppercase spelling does not prove a value is static.",
     "The bounded lexer recognizes doubled quotes, comments, and PostgreSQL dollar strings; dialect-specific escape modes and SQL generated through other APIs require separate security review."
   ],
@@ -4140,6 +4154,26 @@ var NO_DYNAMIC_SQL_DOCUMENTATION = {
       focusPath: "src/users.ts",
       expectedCount: 1,
       public: true
+    },
+    {
+      id: "bound-unquoted-value",
+      scenarioId: "unquoted",
+      title: "An unquoted runtime value is bound separately",
+      outcome: "no-match",
+      files: [{ path: "src/users.ts", source: "db.prepare('select id from users where id = ?').bind(userId);" }],
+      focusPath: "src/users.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "unquoted-runtime-fragment",
+      scenarioId: "unquoted",
+      title: "A runtime fragment is interpolated into SQL",
+      outcome: "match",
+      files: [{ path: "src/users.ts", source: "db.prepare(`select id from users where id = ${userId}`);" }],
+      focusPath: "src/users.ts",
+      expectedCount: 1,
+      public: true
     }
   ]
 };
@@ -4162,14 +4196,21 @@ function isStaticFragment(expression) {
 }
 function runtimeInterpolations(template) {
   const parts = template.quasis.map((quasi) => quasi.value.cooked ?? quasi.value.raw);
-  const ranges = sqlSingleQuotedRanges(parts.join(RUNTIME_MARKER));
+  const statement = parts.join(RUNTIME_MARKER);
+  const ranges = sqlSingleQuotedRanges(statement);
+  const visible = stripSqlNoise(statement);
   let offset = 0;
-  return template.expressions.filter(
+  return template.expressions.flatMap(
     (expression, index) => {
       offset += parts[index]?.length ?? 0;
       const inValue = ranges.some(([start, end]) => start < offset && offset < end);
+      const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
       offset += RUNTIME_MARKER.length;
-      return inValue && !isStaticFragment(expression) && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "");
+      if (isStaticFragment(expression)) return [];
+      if (inValue && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "")) {
+        return [{ expression, messageId: "dynamicSql" }];
+      }
+      return unquoted ? [{ expression, messageId: "dynamicFragment" }] : [];
     }
   );
 }
@@ -4200,16 +4241,21 @@ function runtimeConcatOperands(node) {
     return [];
   }
   const parts = operands.map((operand) => staticLiteralText(operand) ?? RUNTIME_MARKER);
-  const ranges = sqlSingleQuotedRanges(parts.join(""));
+  const statement = parts.join("");
+  const ranges = sqlSingleQuotedRanges(statement);
+  const visible = stripSqlNoise(statement);
   let offset = 0;
-  return operands.filter((operand, index) => {
+  return operands.flatMap((operand, index) => {
     const inValue = ranges.some(([start, end]) => start < offset && offset < end);
+    const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
     offset += parts[index]?.length ?? 0;
-    if (!inValue) return false;
-    if (isStaticFragment(operand)) return false;
+    if (isStaticFragment(operand)) return [];
     const before = operands[index - 1];
     const after = operands[index + 1];
-    return before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "");
+    if (inValue && before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "")) {
+      return [{ expression: operand, messageId: "dynamicSql" }];
+    }
+    return unquoted ? [{ expression: operand, messageId: "dynamicFragment" }] : [];
   });
 }
 function concatOperands(node) {
@@ -4265,7 +4311,8 @@ var no_dynamic_sql_default = createRule({
       }
     ],
     messages: {
-      dynamicSql: "Runtime value embedded inside a quoted SQL value passed to `{{method}}()`. Replace the quoted interpolation with a placeholder and bind the value separately."
+      dynamicSql: "Runtime value embedded inside a quoted SQL value passed to `{{method}}()`. Replace the quoted interpolation with a placeholder and bind the value separately.",
+      dynamicFragment: "Runtime fragment interpolated into SQL passed to `{{method}}()`. Bind data values; select non-bindable SQL fragments from fixed, reviewed alternatives."
     }
   },
   defaultOptions: [{}],
@@ -4284,8 +4331,8 @@ var no_dynamic_sql_default = createRule({
         const offenders = statement.type === AST_NODE_TYPES25.TemplateLiteral ? runtimeInterpolations(statement) : runtimeConcatOperands(statement);
         for (const offender of offenders) {
           context.report({
-            node: offender,
-            messageId: "dynamicSql",
+            node: offender.expression,
+            messageId: offender.messageId,
             data: { method }
           });
         }
@@ -4501,15 +4548,7 @@ function functionComplexity(fn, visitorKeys) {
     visitChildren(node, nesting);
   }
   function visitChildren(node, nesting) {
-    for (const key of visitorKeys[node.type] ?? []) {
-      const value = node[key];
-      const candidates = Array.isArray(value) ? value : [value];
-      for (const candidate2 of candidates) {
-        if (typeof candidate2 === "object" && candidate2 !== null && "type" in candidate2) {
-          visit(candidate2, nesting);
-        }
-      }
-    }
+    forEachAstChild(node, visitorKeys, (child) => visit(child, nesting));
   }
   visit(fn.body, 0);
   return points;
@@ -4678,7 +4717,7 @@ var PURE_CONSTRUCTORS = /* @__PURE__ */ new Set([
   "Response",
   "AbortController"
 ]);
-function isNode2(value) {
+function isNode3(value) {
   return typeof value === "object" && value !== null && typeof value.type === "string";
 }
 function isPureCall(node) {
@@ -4728,11 +4767,11 @@ function subtreeMatches(stmt, predicate, descendIntoFunctions = false) {
       const value = current[key];
       if (Array.isArray(value)) {
         for (const child of value) {
-          if (isNode2(child)) {
+          if (isNode3(child)) {
             visit(child);
           }
         }
-      } else if (isNode2(value)) {
+      } else if (isNode3(value)) {
         visit(value);
       }
       if (found) {
@@ -9909,7 +9948,7 @@ function isSentinelArgument(arg) {
 function isFunctionNode(node) {
   return node.type === AST_NODE_TYPES48.FunctionDeclaration || node.type === AST_NODE_TYPES48.FunctionExpression || node.type === AST_NODE_TYPES48.ArrowFunctionExpression;
 }
-function isNode3(value) {
+function isNode4(value) {
   return typeof value === "object" && value !== null && typeof value.type === "string";
 }
 function walkWithinScope(node, visit) {
@@ -9932,11 +9971,11 @@ function walkWithinScope(node, visit) {
       const value = current[key];
       if (Array.isArray(value)) {
         for (const child of value) {
-          if (isNode3(child)) {
+          if (isNode4(child)) {
             recurse(child);
           }
         }
-      } else if (isNode3(value)) {
+      } else if (isNode4(value)) {
         recurse(value);
       }
     }
@@ -9994,11 +10033,11 @@ function subtreeReadsName(node, name) {
       const value = current[key];
       if (Array.isArray(value)) {
         for (const child of value) {
-          if (isNode3(child)) {
+          if (isNode4(child)) {
             recurse(child);
           }
         }
-      } else if (isNode3(value)) {
+      } else if (isNode4(value)) {
         recurse(value);
       }
     }
@@ -10059,7 +10098,7 @@ function enclosingFunctionName(node) {
   let current = node.parent;
   while (current !== void 0 && current !== null) {
     if (isFunctionNode(current)) {
-      if ("id" in current && isNode3(current.id) && current.id.type === AST_NODE_TYPES48.Identifier) {
+      if ("id" in current && isNode4(current.id) && current.id.type === AST_NODE_TYPES48.Identifier) {
         return current.id.name;
       }
       const parent = current.parent;
@@ -10125,7 +10164,7 @@ function tryReturnsSafeParse(catchNode) {
       const value = current[key];
       const children = Array.isArray(value) ? value : [value];
       for (const child of children) {
-        if (isNode3(child)) recurse(child);
+        if (isNode4(child)) recurse(child);
       }
     }
   }
@@ -10164,7 +10203,7 @@ function functionReturnsSameSentinelKindElsewhere(catchNode, kind) {
 function enclosingFunctionBody(node) {
   let current = node.parent;
   while (current !== void 0 && current !== null) {
-    if (isFunctionNode(current) && "body" in current && isNode3(current.body) && current.body.type === AST_NODE_TYPES48.BlockStatement) {
+    if (isFunctionNode(current) && "body" in current && isNode4(current.body) && current.body.type === AST_NODE_TYPES48.BlockStatement) {
       return current.body;
     }
     current = current.parent;
@@ -16283,13 +16322,7 @@ function isEmptyGuard(node, access) {
 }
 function contains(node, visitorKeys, predicate) {
   if (predicate(node)) return true;
-  for (const key of visitorKeys[node.type] ?? []) {
-    const child = node[key];
-    for (const value of Array.isArray(child) ? child : [child]) {
-      if (value !== null && typeof value === "object" && "type" in value && contains(value, visitorKeys, predicate)) return true;
-    }
-  }
-  return false;
+  return forEachAstChild(node, visitorKeys, (child) => contains(child, visitorKeys, predicate));
 }
 function belongsToFunction(node, fn) {
   let current = node;
@@ -22070,14 +22103,7 @@ function referencedPropertyName(node) {
 function walk(node, visitorKeys, visit, nestedFunction = false) {
   visit(node, nestedFunction);
   const nested = nestedFunction || isFunction(node);
-  for (const key of visitorKeys[node.type] ?? []) {
-    const child = node[key];
-    if (Array.isArray(child)) {
-      for (const item of child) if (typeof item === "object" && item !== null && "type" in item) walk(item, visitorKeys, visit, nested);
-    } else if (typeof child === "object" && child !== null && "type" in child) {
-      walk(child, visitorKeys, visit, nested);
-    }
-  }
+  forEachAstChild(node, visitorKeys, (child) => walk(child, visitorKeys, visit, nested));
 }
 function classScope(context, node, computedReferenceNames) {
   const methods = node.body.body.filter(
@@ -23273,7 +23299,7 @@ var RULES = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.26.1"
+  version: "15.26.3"
 };
 var APPLICATION_ONLY_RULES = [];
 var LIBRARY_IMPORT_POLICY = ["error", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "15.26.1",
+  "version": "15.26.3",
   "packageManager": "npm@12.0.2",
   "description": "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",