@sarj/eslint-plugin 15.6.8 → 15.7.0

package/dist/index.js

@@ -4253,6 +4253,87 @@ var no_long_comment_default = createRule({
   }
 });
 
+// src/rules/no-vague-suppression-description.ts
+var DIRECTIVE_RE3 = /(?:eslint-(?:disable|disable-next-line|disable-line)|@ts-(?:expect-error|ignore))\b/iu;
+var DESCRIPTION_RE = /(?::|--)\s*(.+?)\s*$/u;
+var VAGUE_RE = /^(?:needed|required|intentional(?:ly)?|ignore(?:d)?|false positive|type error|typescript|to satisfy (?:the )?(?:linter|typescript|type checker))\.?$/iu;
+var noVagueSuppressionDescriptionDocumentation = {
+  summary: "Require suppression descriptions to name the concrete mismatch or invariant instead of a generic non-reason.",
+  rationale: "Generic phrases satisfy require-description mechanically while leaving reviewers unable to audit the risk or remove stale debt.",
+  remediation: "Name the exact type/runtime mismatch, external contract, or safety invariant that makes this suppression acceptable.",
+  category: "maintainability",
+  limitations: [
+    "Only ESLint disable comments and TypeScript expect-error/ignore directives are checked.",
+    "The rule uses a small anchored vocabulary and does not score prose quality generally.",
+    "Generated files and descriptions containing any concrete context are excluded."
+  ],
+  examples: [
+    {
+      id: "concrete-runtime-mismatch",
+      title: "Explain the concrete runtime contract",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/adapter.ts",
+          source: "// @ts-expect-error -- vendor types omit the runtime requestId field\nreturn response.requestId;"
+        }
+      ],
+      focusPath: "src/adapter.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "generic-suppression-reason",
+      title: "Reject a suppression with no auditable reason",
+      outcome: "match",
+      files: [
+        {
+          path: "src/adapter.ts",
+          source: "// @ts-expect-error -- false positive\nreturn response.requestId;"
+        }
+      ],
+      focusPath: "src/adapter.ts",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+var no_vague_suppression_description_default = createRule({
+  name: "no-vague-suppression-description",
+  documentation: noVagueSuppressionDescriptionDocumentation,
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Require suppression descriptions to name the concrete mismatch or invariant instead of a generic non-reason."
+    },
+    schema: [],
+    messages: {
+      vagueDescription: "Suppression description `{{description}}` does not explain why the suppressed diagnostic is safe here. Name the concrete type/runtime mismatch, external contract, or invariant."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    if (isGeneratedFile(context.filename, context.sourceCode.text)) {
+      return {};
+    }
+    return {
+      Program() {
+        for (const comment of context.sourceCode.getAllComments()) {
+          const text = comment.value.trim();
+          if (!DIRECTIVE_RE3.test(text)) continue;
+          const description = DESCRIPTION_RE.exec(text)?.[1]?.trim();
+          if (description === void 0 || !VAGUE_RE.test(description)) continue;
+          context.report({
+            loc: comment.loc,
+            messageId: "vagueDescription",
+            data: { description }
+          });
+        }
+      }
+    };
+  }
+});
+
 // src/rules/no-generic-single-export-module.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES16, ASTUtils as ASTUtils4 } from "@typescript-eslint/utils";
 var noGenericSingleExportModuleDocumentation = {
@@ -5392,7 +5473,7 @@ var no_repeated_string_literal_default = createRule({
 import { AST_NODE_TYPES as AST_NODE_TYPES21 } from "@typescript-eslint/utils";
 var MAX_WORDS = 8;
 var MIN_CONTENT_TOKENS = 2;
-var DIRECTIVE_RE3 = /^(eslint\b|eslint-|sarj-noqa\b|@ts-|prettier-ignore|prettier\b|biome-|c8\b|v8\b|istanbul\b|@type\b|@vite|webpack|<reference|<amd|global\b|noinspection|todo\b|fixme\b|hack\b|xxx\b)/i;
+var DIRECTIVE_RE4 = /^(eslint\b|eslint-|sarj-noqa\b|@ts-|prettier-ignore|prettier\b|biome-|c8\b|v8\b|istanbul\b|@type\b|@vite|webpack|<reference|<amd|global\b|noinspection|todo\b|fixme\b|hack\b|xxx\b)/i;
 var CODEY_RE = /^[\w.$[\]'"]+\s*[:=]\s*\S|^[\w.$]+\s*\(|^(?:return|throw|await|import|export|const|let|var)\b.*[=()[\]{}]/;
 var BANNERISH_RE = /[=\-─-╿*#~_.]{3,}|^[A-Z0-9 _:-]+$/;
 var MODALITY_RE = /\b(?:can|could|should|shall|may|might|must|will|would|cannot)\b/i;
@@ -5491,7 +5572,7 @@ var no_restated_comment_default = createRule({
           }
           const body2 = comment.value.replace(/^\/*/, "").trim();
           if (body2.length === 0 || body2.endsWith("?")) continue;
-          if (DIRECTIVE_RE3.test(body2) || CODEY_RE.test(body2) || BANNERISH_RE.test(body2)) continue;
+          if (DIRECTIVE_RE4.test(body2) || CODEY_RE.test(body2) || BANNERISH_RE.test(body2)) continue;
           if (NON_ASCII_LETTER_RE.test(body2) || isProtected(body2)) continue;
           if (MODALITY_RE.test(body2) || LEAD_IN_RE.test(body2) || EMPHASIS_RE.test(body2)) continue;
           if (NEGATION_WORD_RE.test(body2)) continue;
@@ -5539,7 +5620,7 @@ var MODELLED_TAGS = /* @__PURE__ */ new Set([
 ]);
 var PARAM_TAGS = /* @__PURE__ */ new Set(["arg", "argument", "param"]);
 var RETURN_TAGS = /* @__PURE__ */ new Set(["return", "returns"]);
-var DIRECTIVE_RE4 = /^\s*(?:eslint\b|eslint-|@ts-|prettier|biome-|c8\b|v8\b|istanbul\b|@vite|webpack|@jsx|@jest-environment|@vitest-environment|#__)/i;
+var DIRECTIVE_RE5 = /^\s*(?:eslint\b|eslint-|@ts-|prettier|biome-|c8\b|v8\b|istanbul\b|@vite|webpack|@jsx|@jest-environment|@vitest-environment|#__)/i;
 var STOPWORDS2 = new Set(
   `the a an of to for in on with and or as at by is are was be been being
    this that it its if whether when where which what will would can could should
@@ -5655,7 +5736,7 @@ var no_restated_jsdoc_default = createRule({
             description,
             ...tags.filter((tag) => tag.name === "description").map((tag) => tag.text)
           ].filter((text) => text.length > 0).join("\n");
-          if (DIRECTIVE_RE4.test(describedText)) continue;
+          if (DIRECTIVE_RE5.test(describedText)) continue;
           const tagNames = new Set(tags.map((tag) => tag.name));
           if ([...tagNames].some((name) => !MODELLED_TAGS.has(name))) continue;
           if (isProtected(describedText)) continue;
@@ -7617,10 +7698,10 @@ var STOPWORDS3 = /* @__PURE__ */ new Set([
   "we",
   "with"
 ]);
-var DIRECTIVE_RE5 = /^\s*(?:eslint\b|eslint-|sarj-noqa\b|@ts-|prettier|biome-|c8\b|v8\b|istanbul\b|todo\b|fixme\b|hack\b|xxx\b)/i;
+var DIRECTIVE_RE6 = /^\s*(?:eslint\b|eslint-|sarj-noqa\b|@ts-|prettier|biome-|c8\b|v8\b|istanbul\b|todo\b|fixme\b|hack\b|xxx\b)/i;
 var UNIT_NAME_SUFFIX_RE = /(?:_(?:NS|US|MS|S|SEC|SECS|SECOND|SECONDS|MIN|MINS|MINUTE|MINUTES|HOUR|HOURS|DAY|DAYS|BYTE|BYTES|KB|MB|GB|HZ|KHZ|MHZ|PX)|(?:Ns|Us|Ms|Sec|Secs|Second|Seconds|Min|Mins|Minute|Minutes|Hour|Hours|Day|Days|Byte|Bytes|Kb|Mb|Gb|Hz|Khz|Mhz|Px))$/u;
 function narratesValue(body2, code) {
-  if (body2.length === 0 || DIRECTIVE_RE5.test(body2) || hasExternalReference(body2)) return false;
+  if (body2.length === 0 || DIRECTIVE_RE6.test(body2) || hasExternalReference(body2)) return false;
   const codeNumbers = numbersIn(code);
   if (codeNumbers.size === 0) return false;
   const words2 = (body2.match(WORD_RE3) ?? []).map((word) => word.toLowerCase());
@@ -14764,7 +14845,7 @@ var stepdown_default = createRule({
 
 // src/rules/source-coupled-test.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES56 } from "@typescript-eslint/utils";
-var SOURCE_SUFFIX_RE = /\.(?:bash|hcl|sh|tf|tfvars|ya?ml|py|[cm]?[jt]s)$/iu;
+var GENERAL_SOURCE_SUFFIX_RE = /\.(?:bash|sh|ya?ml|py|[cm]?[jt]s)$/iu;
 var FS_MODULES = /* @__PURE__ */ new Set(["fs", "node:fs", "fs/promises", "node:fs/promises"]);
 var FS_READERS = /* @__PURE__ */ new Set(["readFile", "readFileSync"]);
 var TEXT_TRANSFORMS = /* @__PURE__ */ new Set([
@@ -14778,7 +14859,8 @@ var TEXT_TRANSFORMS = /* @__PURE__ */ new Set([
   "trimEnd",
   "trimStart",
   "replace",
-  "replaceAll"
+  "replaceAll",
+  "split"
 ]);
 var TEXT_PREDICATES = /* @__PURE__ */ new Set(["endsWith", "includes", "indexOf", "lastIndexOf", "match", "matchAll", "search", "startsWith"]);
 var REGEXP_PREDICATES = /* @__PURE__ */ new Set(["exec", "test"]);
@@ -14803,7 +14885,7 @@ var ASSERT_MATCHERS = /* @__PURE__ */ new Set(["deepEqual", "doesNotMatch", "equ
 var sourceCoupledTestDocumentation = {
   summary: "Disallow raw repository source text as a test oracle; parse or execute the artifact instead.",
   rationale: "Substring and regex checks can pass on comments or unreachable configuration and fail after behavior-preserving formatting changes.",
-  remediation: "Parse the artifact, execute its validator, or assert on Terraform plan JSON or another runtime contract.",
+  remediation: "Parse the artifact, execute its validator, or assert on another runtime contract.",
   category: "testing",
   limitations: [
     "The rule follows lexical aliases, source-path collections, awaited reads, and common text operations; interprocedural flows remain unreported.",
@@ -14820,10 +14902,10 @@ var sourceCoupledTestDocumentation = {
       public: true
     },
     {
-      id: "terraform-substring-contract",
-      title: "Do not prove Terraform behavior with a regex",
+      id: "workflow-substring-contract",
+      title: "Do not prove workflow behavior with a regex",
       outcome: "match",
-      files: [{ path: "src/policy.test.ts", source: "import { readFileSync } from 'node:fs'; test('policy', () => { const source = readFileSync('main.tf', 'utf8'); expect(source).toMatch(/prevent_destroy/); });" }],
+      files: [{ path: "src/policy.test.ts", source: "import { readFileSync } from 'node:fs'; test('policy', () => { const source = readFileSync('workflow.yml', 'utf8'); expect(source).toMatch(/permissions/); });" }],
       focusPath: "src/policy.test.ts",
       expectedCount: 1,
       public: true
@@ -14858,191 +14940,237 @@ function requireSource(node) {
 function newScope() {
   return { collections: /* @__PURE__ */ new Set(), declared: /* @__PURE__ */ new Set(), fsObjects: /* @__PURE__ */ new Set(), fsReaders: /* @__PURE__ */ new Set(), paths: /* @__PURE__ */ new Set(), rawOrigins: /* @__PURE__ */ new Map() };
 }
-var source_coupled_test_default = createRule({
-  name: "source-coupled-test",
-  documentation: sourceCoupledTestDocumentation,
-  meta: {
-    type: "suggestion",
-    docs: { description: sourceCoupledTestDocumentation.summary },
-    schema: [],
-    messages: { rawSourceOracle: "Raw repository source text is the oracle. Parse or execute the artifact so comments, formatting, and unreachable blocks cannot satisfy the contract." }
-  },
-  defaultOptions: [],
-  create(context) {
-    if (!isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) return {};
-    const scopes = [newScope()];
-    const reportedOrigins = /* @__PURE__ */ new Set();
-    const currentScope = () => scopes.at(-1) ?? scopes[0];
-    const visible = (kind, name) => {
-      for (let index = scopes.length - 1; index >= 0; index--) {
-        const scope = scopes[index];
-        if (scope.declared.has(name)) return scope[kind].has(name);
-      }
-      return false;
-    };
-    const visibleRawOrigins = (name) => {
-      for (let index = scopes.length - 1; index >= 0; index--) {
-        const scope = scopes[index];
-        if (scope.declared.has(name)) return scope.rawOrigins.get(name) ?? /* @__PURE__ */ new Set();
-      }
-      return /* @__PURE__ */ new Set();
-    };
-    const sourcePath = (node) => {
-      const current = unwrap5(node);
-      const value = stringValue(current);
-      if (value !== null) return SOURCE_SUFFIX_RE.test(value);
-      if (current.type === AST_NODE_TYPES56.Identifier) return visible("paths", current.name);
-      if (current.type === AST_NODE_TYPES56.BinaryExpression && current.operator === "+") {
-        return sourcePath(current.left) || sourcePath(current.right);
-      }
-      if (current.type === AST_NODE_TYPES56.TemplateLiteral) return current.expressions.some(sourcePath);
-      if (current.type === AST_NODE_TYPES56.CallExpression || current.type === AST_NODE_TYPES56.NewExpression) {
-        return current.arguments.some((argument) => argument.type !== AST_NODE_TYPES56.SpreadElement && sourcePath(argument));
-      }
-      if (current.type === AST_NODE_TYPES56.MemberExpression) return sourcePath(current.object);
-      return false;
-    };
-    const rawRead = (node) => {
-      const current = unwrap5(node);
-      if (current.type !== AST_NODE_TYPES56.CallExpression || current.arguments.length === 0) return false;
-      const callee = unwrap5(current.callee);
-      if (callee.type === AST_NODE_TYPES56.Identifier) {
-        return visible("fsReaders", callee.name) && sourcePath(current.arguments[0]);
-      }
-      if (callee.type !== AST_NODE_TYPES56.MemberExpression) return false;
-      const name = staticMemberName5(callee);
-      const object = unwrap5(callee.object);
-      return name !== null && FS_READERS.has(name) && object.type === AST_NODE_TYPES56.Identifier && visible("fsObjects", object.name) && sourcePath(current.arguments[0]);
-    };
-    const rawOrigins = (node) => {
-      const current = unwrap5(node);
-      if (current.type === AST_NODE_TYPES56.Identifier) return visibleRawOrigins(current.name);
-      if (rawRead(current)) return /* @__PURE__ */ new Set([`${current.range[0]}:${current.range[1]}`]);
-      if (current.type === AST_NODE_TYPES56.BinaryExpression && current.operator === "+") return /* @__PURE__ */ new Set([...rawOrigins(current.left), ...rawOrigins(current.right)]);
-      if (current.type !== AST_NODE_TYPES56.CallExpression) return /* @__PURE__ */ new Set();
-      const callee = unwrap5(current.callee);
-      if (callee.type !== AST_NODE_TYPES56.MemberExpression) return /* @__PURE__ */ new Set();
-      const name = staticMemberName5(callee);
-      return name !== null && TEXT_TRANSFORMS.has(name) ? rawOrigins(callee.object) : /* @__PURE__ */ new Set();
-    };
-    const evidenceOrigins = (node) => {
-      const current = unwrap5(node);
-      const direct = rawOrigins(current);
-      if (direct.size > 0) return direct;
-      if (current.type === AST_NODE_TYPES56.BinaryExpression || current.type === AST_NODE_TYPES56.LogicalExpression) return /* @__PURE__ */ new Set([...evidenceOrigins(current.left), ...evidenceOrigins(current.right)]);
-      if (current.type === AST_NODE_TYPES56.UnaryExpression) return evidenceOrigins(current.argument);
-      if (current.type !== AST_NODE_TYPES56.CallExpression) return /* @__PURE__ */ new Set();
-      const callee = unwrap5(current.callee);
-      if (callee.type !== AST_NODE_TYPES56.MemberExpression) return /* @__PURE__ */ new Set();
-      const name = staticMemberName5(callee);
-      if (name !== null && TEXT_PREDICATES.has(name)) return rawOrigins(callee.object);
-      if (name !== null && REGEXP_PREDICATES.has(name)) return new Set(current.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...rawOrigins(argument)]));
-      return /* @__PURE__ */ new Set();
-    };
-    const rawAssertionOrigins = (node) => {
-      const callee = unwrap5(node.callee);
-      if (callee.type === AST_NODE_TYPES56.Identifier && callee.name === "assert") {
-        return new Set(node.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...evidenceOrigins(argument)]));
-      }
-      if (callee.type !== AST_NODE_TYPES56.MemberExpression) return /* @__PURE__ */ new Set();
-      const matcher = staticMemberName5(callee);
-      if (matcher === null) return /* @__PURE__ */ new Set();
-      let receiver = unwrap5(callee.object);
-      while (receiver.type === AST_NODE_TYPES56.MemberExpression && EXPECT_MODIFIERS.has(staticMemberName5(receiver) ?? "")) receiver = unwrap5(receiver.object);
-      if (receiver.type === AST_NODE_TYPES56.CallExpression && receiver.callee.type === AST_NODE_TYPES56.Identifier && receiver.callee.name === "expect") {
-        if (!EXPECT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
-        return new Set([...receiver.arguments, ...node.arguments].flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...evidenceOrigins(argument)]));
-      }
-      if (receiver.type !== AST_NODE_TYPES56.Identifier || receiver.name !== "assert" || !ASSERT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
-      return new Set(node.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...evidenceOrigins(argument)]));
-    };
-    const declare = (name, state) => {
-      const scope = currentScope();
-      scope.declared.add(name);
-      scope.collections.delete(name);
-      scope.fsObjects.delete(name);
-      scope.fsReaders.delete(name);
-      scope.paths.delete(name);
-      scope.rawOrigins.delete(name);
-      if (state.collection === true) scope.collections.add(name);
-      if (state.fsObject === true) scope.fsObjects.add(name);
-      if (state.fsReader === true) scope.fsReaders.add(name);
-      if (state.path === true) scope.paths.add(name);
-      if (state.rawOrigins !== void 0 && state.rawOrigins.size > 0) {
-        scope.rawOrigins.set(name, state.rawOrigins);
-      }
-    };
-    const sourceCollection = (node) => {
-      const current = unwrap5(node);
-      return current.type === AST_NODE_TYPES56.ArrayExpression && current.elements.length > 0 && current.elements.every((element) => element !== null && element.type !== AST_NODE_TYPES56.SpreadElement && sourcePath(element));
-    };
-    const declaredNames2 = (node) => {
-      const current = unwrap5(node);
-      if (current.type === AST_NODE_TYPES56.Identifier) return [current.name];
-      if (current.type === AST_NODE_TYPES56.AssignmentPattern) return declaredNames2(current.left);
-      if (current.type === AST_NODE_TYPES56.RestElement) return declaredNames2(current.argument);
-      if (current.type === AST_NODE_TYPES56.ArrayPattern) return current.elements.flatMap((element) => element === null ? [] : declaredNames2(element));
-      if (current.type === AST_NODE_TYPES56.ObjectPattern) return current.properties.flatMap((property) => property.type === AST_NODE_TYPES56.RestElement ? declaredNames2(property.argument) : declaredNames2(property.value));
-      return [];
-    };
-    const enterFunction = (node) => {
-      scopes.push(newScope());
-      for (const parameter of node.params) for (const name of declaredNames2(parameter)) declare(name, {});
-    };
-    const exitFunction = () => {
-      scopes.pop();
-    };
-    return {
-      ImportDeclaration(node) {
-        const source = importSource(node);
-        if (source === null || !FS_MODULES.has(source)) return;
-        for (const specifier of node.specifiers) {
-          if (specifier.type === AST_NODE_TYPES56.ImportSpecifier) {
-            const imported = specifier.imported.type === AST_NODE_TYPES56.Identifier ? specifier.imported.name : String(specifier.imported.value);
-            if (FS_READERS.has(imported)) declare(specifier.local.name, { fsReader: true });
-          } else {
-            declare(specifier.local.name, { fsObject: true });
-          }
+function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
+  return createRule({
+    name,
+    documentation,
+    meta: {
+      type: "suggestion",
+      docs: { description: documentation.summary },
+      schema: [],
+      messages: { rawSourceOracle: "Raw repository source text is the oracle. Parse or execute the artifact so comments, formatting, and unreachable blocks cannot satisfy the contract." }
+    },
+    defaultOptions: [],
+    create(context) {
+      if (!isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) return {};
+      const scopes = [newScope()];
+      const reportedOrigins = /* @__PURE__ */ new Set();
+      const currentScope = () => scopes.at(-1) ?? scopes[0];
+      const visible = (kind, name2) => {
+        for (let index = scopes.length - 1; index >= 0; index--) {
+          const scope = scopes[index];
+          if (scope.declared.has(name2)) return scope[kind].has(name2);
         }
-      },
-      ":function": enterFunction,
-      ":function:exit": exitFunction,
-      VariableDeclarator(node) {
-        if (node.init === null) return;
-        const required = requireSource(node.init);
-        if (required !== null && FS_MODULES.has(required) && node.id.type === AST_NODE_TYPES56.Identifier) {
-          declare(node.id.name, { fsObject: true });
-          return;
+        return false;
+      };
+      const visibleRawOrigins = (name2) => {
+        for (let index = scopes.length - 1; index >= 0; index--) {
+          const scope = scopes[index];
+          if (scope.declared.has(name2)) return scope.rawOrigins.get(name2) ?? /* @__PURE__ */ new Set();
+        }
+        return /* @__PURE__ */ new Set();
+      };
+      const sourcePath = (node) => {
+        const current = unwrap5(node);
+        const value = stringValue(current);
+        if (value !== null) return sourceSuffixRe.test(value);
+        if (current.type === AST_NODE_TYPES56.Identifier) return visible("paths", current.name);
+        if (current.type === AST_NODE_TYPES56.BinaryExpression && current.operator === "+") {
+          return sourcePath(current.left) || sourcePath(current.right);
+        }
+        if (current.type === AST_NODE_TYPES56.TemplateLiteral) return current.expressions.some(sourcePath);
+        if (current.type === AST_NODE_TYPES56.CallExpression || current.type === AST_NODE_TYPES56.NewExpression) {
+          return current.arguments.some((argument) => argument.type !== AST_NODE_TYPES56.SpreadElement && sourcePath(argument));
+        }
+        if (current.type === AST_NODE_TYPES56.MemberExpression) return sourcePath(current.object);
+        return false;
+      };
+      const rawRead = (node) => {
+        const current = unwrap5(node);
+        if (current.type !== AST_NODE_TYPES56.CallExpression || current.arguments.length === 0) return false;
+        const callee = unwrap5(current.callee);
+        if (callee.type === AST_NODE_TYPES56.Identifier) {
+          return visible("fsReaders", callee.name) && sourcePath(current.arguments[0]);
+        }
+        if (callee.type !== AST_NODE_TYPES56.MemberExpression) return false;
+        const name2 = staticMemberName5(callee);
+        const object = unwrap5(callee.object);
+        return name2 !== null && FS_READERS.has(name2) && object.type === AST_NODE_TYPES56.Identifier && visible("fsObjects", object.name) && sourcePath(current.arguments[0]);
+      };
+      const rawOrigins = (node) => {
+        const current = unwrap5(node);
+        if (current.type === AST_NODE_TYPES56.Identifier) return visibleRawOrigins(current.name);
+        if (rawRead(current)) return /* @__PURE__ */ new Set([`${current.range[0]}:${current.range[1]}`]);
+        if (current.type === AST_NODE_TYPES56.BinaryExpression && current.operator === "+") return /* @__PURE__ */ new Set([...rawOrigins(current.left), ...rawOrigins(current.right)]);
+        if (current.type === AST_NODE_TYPES56.MemberExpression && staticMemberName5(current) === "length") return rawOrigins(current.object);
+        if (current.type !== AST_NODE_TYPES56.CallExpression) return /* @__PURE__ */ new Set();
+        const callee = unwrap5(current.callee);
+        if (callee.type !== AST_NODE_TYPES56.MemberExpression) return /* @__PURE__ */ new Set();
+        const name2 = staticMemberName5(callee);
+        return name2 !== null && TEXT_TRANSFORMS.has(name2) ? rawOrigins(callee.object) : /* @__PURE__ */ new Set();
+      };
+      const evidenceOrigins = (node) => {
+        const current = unwrap5(node);
+        const direct = rawOrigins(current);
+        if (direct.size > 0) return direct;
+        if (current.type === AST_NODE_TYPES56.BinaryExpression || current.type === AST_NODE_TYPES56.LogicalExpression) return /* @__PURE__ */ new Set([...evidenceOrigins(current.left), ...evidenceOrigins(current.right)]);
+        if (current.type === AST_NODE_TYPES56.UnaryExpression) return evidenceOrigins(current.argument);
+        if (current.type !== AST_NODE_TYPES56.CallExpression) return /* @__PURE__ */ new Set();
+        const callee = unwrap5(current.callee);
+        if (callee.type !== AST_NODE_TYPES56.MemberExpression) return /* @__PURE__ */ new Set();
+        const name2 = staticMemberName5(callee);
+        if (name2 !== null && TEXT_PREDICATES.has(name2)) return rawOrigins(callee.object);
+        if (name2 !== null && REGEXP_PREDICATES.has(name2)) return new Set(current.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...rawOrigins(argument)]));
+        return /* @__PURE__ */ new Set();
+      };
+      const rawAssertionOrigins = (node) => {
+        const callee = unwrap5(node.callee);
+        if (callee.type === AST_NODE_TYPES56.Identifier && callee.name === "assert") {
+          return new Set(node.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...evidenceOrigins(argument)]));
+        }
+        if (callee.type !== AST_NODE_TYPES56.MemberExpression) return /* @__PURE__ */ new Set();
+        const matcher = staticMemberName5(callee);
+        if (matcher === null) return /* @__PURE__ */ new Set();
+        let receiver = unwrap5(callee.object);
+        while (receiver.type === AST_NODE_TYPES56.MemberExpression && EXPECT_MODIFIERS.has(staticMemberName5(receiver) ?? "")) receiver = unwrap5(receiver.object);
+        if (receiver.type === AST_NODE_TYPES56.CallExpression && receiver.callee.type === AST_NODE_TYPES56.Identifier && receiver.callee.name === "expect") {
+          if (!EXPECT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
+          return new Set([...receiver.arguments, ...node.arguments].flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...evidenceOrigins(argument)]));
+        }
+        if (receiver.type !== AST_NODE_TYPES56.Identifier || receiver.name !== "assert" || !ASSERT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
+        return new Set(node.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...evidenceOrigins(argument)]));
+      };
+      const declare = (name2, state) => {
+        const scope = currentScope();
+        scope.declared.add(name2);
+        scope.collections.delete(name2);
+        scope.fsObjects.delete(name2);
+        scope.fsReaders.delete(name2);
+        scope.paths.delete(name2);
+        scope.rawOrigins.delete(name2);
+        if (state.collection === true) scope.collections.add(name2);
+        if (state.fsObject === true) scope.fsObjects.add(name2);
+        if (state.fsReader === true) scope.fsReaders.add(name2);
+        if (state.path === true) scope.paths.add(name2);
+        if (state.rawOrigins !== void 0 && state.rawOrigins.size > 0) {
+          scope.rawOrigins.set(name2, state.rawOrigins);
         }
-        if (node.id.type === AST_NODE_TYPES56.ObjectPattern && required !== null && FS_MODULES.has(required)) {
-          for (const property of node.id.properties) {
-            if (property.type !== AST_NODE_TYPES56.Property || property.value.type !== AST_NODE_TYPES56.Identifier) continue;
-            const key = property.key.type === AST_NODE_TYPES56.Identifier ? property.key.name : property.key.type === AST_NODE_TYPES56.Literal ? String(property.key.value) : "";
-            if (FS_READERS.has(key)) declare(property.value.name, { fsReader: true });
+      };
+      const sourceCollection = (node) => {
+        const current = unwrap5(node);
+        return current.type === AST_NODE_TYPES56.ArrayExpression && current.elements.length > 0 && current.elements.every((element) => element !== null && element.type !== AST_NODE_TYPES56.SpreadElement && sourcePath(element));
+      };
+      const declaredNames2 = (node) => {
+        const current = unwrap5(node);
+        if (current.type === AST_NODE_TYPES56.Identifier) return [current.name];
+        if (current.type === AST_NODE_TYPES56.AssignmentPattern) return declaredNames2(current.left);
+        if (current.type === AST_NODE_TYPES56.RestElement) return declaredNames2(current.argument);
+        if (current.type === AST_NODE_TYPES56.ArrayPattern) return current.elements.flatMap((element) => element === null ? [] : declaredNames2(element));
+        if (current.type === AST_NODE_TYPES56.ObjectPattern) return current.properties.flatMap((property) => property.type === AST_NODE_TYPES56.RestElement ? declaredNames2(property.argument) : declaredNames2(property.value));
+        return [];
+      };
+      const enterFunction = (node) => {
+        scopes.push(newScope());
+        for (const parameter of node.params) for (const name2 of declaredNames2(parameter)) declare(name2, {});
+      };
+      const exitFunction = () => {
+        scopes.pop();
+      };
+      return {
+        ImportDeclaration(node) {
+          const source = importSource(node);
+          if (source === null || !FS_MODULES.has(source)) return;
+          for (const specifier of node.specifiers) {
+            if (specifier.type === AST_NODE_TYPES56.ImportSpecifier) {
+              const imported = specifier.imported.type === AST_NODE_TYPES56.Identifier ? specifier.imported.name : String(specifier.imported.value);
+              if (FS_READERS.has(imported)) declare(specifier.local.name, { fsReader: true });
+            } else {
+              declare(specifier.local.name, { fsObject: true });
+            }
           }
-          return;
+        },
+        ":function": enterFunction,
+        ":function:exit": exitFunction,
+        VariableDeclarator(node) {
+          if (node.init === null) return;
+          const required = requireSource(node.init);
+          if (required !== null && FS_MODULES.has(required) && node.id.type === AST_NODE_TYPES56.Identifier) {
+            declare(node.id.name, { fsObject: true });
+            return;
+          }
+          if (node.id.type === AST_NODE_TYPES56.ObjectPattern && required !== null && FS_MODULES.has(required)) {
+            for (const property of node.id.properties) {
+              if (property.type !== AST_NODE_TYPES56.Property || property.value.type !== AST_NODE_TYPES56.Identifier) continue;
+              const key = property.key.type === AST_NODE_TYPES56.Identifier ? property.key.name : property.key.type === AST_NODE_TYPES56.Literal ? String(property.key.value) : "";
+              if (FS_READERS.has(key)) declare(property.value.name, { fsReader: true });
+            }
+            return;
+          }
+          if (node.id.type !== AST_NODE_TYPES56.Identifier) return;
+          declare(node.id.name, { collection: sourceCollection(node.init), path: sourcePath(node.init), rawOrigins: rawOrigins(node.init) });
+        },
+        AssignmentExpression(node) {
+          if (node.left.type === AST_NODE_TYPES56.Identifier) declare(node.left.name, { path: sourcePath(node.right), rawOrigins: rawOrigins(node.right) });
+        },
+        ForOfStatement(node) {
+          const right = unwrap5(node.right);
+          const collection = right.type === AST_NODE_TYPES56.Identifier && visible("collections", right.name);
+          const left = node.left.type === AST_NODE_TYPES56.VariableDeclaration ? node.left.declarations[0]?.id : node.left;
+          if (collection && left?.type === AST_NODE_TYPES56.Identifier) declare(left.name, { path: true });
+        },
+        CallExpression(node) {
+          const origins = rawAssertionOrigins(node);
+          if (origins.size === 0 || [...origins].every((origin) => reportedOrigins.has(origin))) return;
+          for (const origin of origins) reportedOrigins.add(origin);
+          context.report({ node, messageId: "rawSourceOracle" });
         }
-        if (node.id.type !== AST_NODE_TYPES56.Identifier) return;
-        declare(node.id.name, { collection: sourceCollection(node.init), path: sourcePath(node.init), rawOrigins: rawOrigins(node.init) });
-      },
-      AssignmentExpression(node) {
-        if (node.left.type === AST_NODE_TYPES56.Identifier) declare(node.left.name, { path: sourcePath(node.right), rawOrigins: rawOrigins(node.right) });
-      },
-      ForOfStatement(node) {
-        const right = unwrap5(node.right);
-        const collection = right.type === AST_NODE_TYPES56.Identifier && visible("collections", right.name);
-        const left = node.left.type === AST_NODE_TYPES56.VariableDeclaration ? node.left.declarations[0]?.id : node.left;
-        if (collection && left?.type === AST_NODE_TYPES56.Identifier) declare(left.name, { path: true });
-      },
-      CallExpression(node) {
-        const origins = rawAssertionOrigins(node);
-        if (origins.size === 0 || [...origins].every((origin) => reportedOrigins.has(origin))) return;
-        for (const origin of origins) reportedOrigins.add(origin);
-        context.report({ node, messageId: "rawSourceOracle" });
-      }
-    };
-  }
-});
+      };
+    }
+  });
+}
+var source_coupled_test_default = createSourceCoupledRule(
+  "source-coupled-test",
+  sourceCoupledTestDocumentation,
+  GENERAL_SOURCE_SUFFIX_RE
+);
+
+// src/rules/iac-source-coupled-test.ts
+var IAC_SOURCE_SUFFIX_RE = /(?:\.tf\.json|\.tftest\.(?:hcl|json)|\.(?:hcl|tf|tfvars))$/iu;
+var iacSourceCoupledTestDocumentation = {
+  summary: "Disallow raw IaC source text as a test oracle; inspect a rendered plan, provider state, or runtime behavior.",
+  rationale: "Substring and regex checks can pass on comments, formatting, or unreachable Terraform configuration while clients fail silently.",
+  remediation: "Parse rendered plan JSON, query the provider, or exercise the deployed runtime contract.",
+  category: "testing",
+  limitations: [
+    "The rule follows lexical aliases, source-path collections, awaited reads, and common text operations; interprocedural flows remain unreported.",
+    "The warning-stage rule remains suppressible for calibration; promotion may make the locked policy non-suppressible."
+  ],
+  examples: [
+    {
+      id: "rendered-plan-contract",
+      title: "Assert on rendered plan behavior",
+      outcome: "no-match",
+      files: [{ path: "src/policy.test.ts", source: "import { readFileSync } from 'node:fs'; test('policy', () => { const plan = JSON.parse(readFileSync('plan.json', 'utf8')); expect(validate(plan)).toEqual([]); });" }],
+      focusPath: "src/policy.test.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "terraform-substring-contract",
+      title: "Do not prove Terraform behavior with a regex",
+      outcome: "match",
+      files: [{ path: "src/policy.test.ts", source: "import { readFileSync } from 'node:fs'; test('policy', () => { const source = readFileSync('main.tf', 'utf8'); expect(source).toMatch(/prevent_destroy/); });" }],
+      focusPath: "src/policy.test.ts",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+var iac_source_coupled_test_default = createSourceCoupledRule(
+  "iac-source-coupled-test",
+  iacSourceCoupledTestDocumentation,
+  IAC_SOURCE_SUFFIX_RE
+);
 
 // src/rules/zod-naming-convention.ts
 import {
@@ -15270,6 +15398,7 @@ var retiredRules = {
 
 // src/index.ts
 var rules = {
+  "iac-source-coupled-test": iac_source_coupled_test_default,
   "duplicate-test-body": duplicate_test_body_default,
   "enforce-file-structure": enforce_file_structure_default,
   "no-client-side-data-fetching": no_client_side_data_fetching_default,
@@ -15285,6 +15414,7 @@ var rules = {
   "no-impossible-zod-literal-bounds": no_impossible_zod_literal_bounds_default,
   "no-log-only-catch": no_log_only_catch_default,
   "no-long-comment": no_long_comment_default,
+  "no-vague-suppression-description": no_vague_suppression_description_default,
   "no-generic-single-export-module": no_generic_single_export_module_default,
   "no-offset-pagination": no_offset_pagination_default,
   "no-positional-tuple-return": no_positional_tuple_return_default,
@@ -15338,15 +15468,16 @@ var rules = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.6.8"
+  version: "15.7.0"
 };
 var applicationOnlyRules = [
   "no-restricted-library-load",
   "prefer-native-random-uuid",
   "prefer-shadcn-primitives"
 ];
-var advisoryRules = ["source-coupled-test"];
+var advisoryRules = ["no-vague-suppression-description", "iac-source-coupled-test", "source-coupled-test"];
 var recommendedRules = {
+  "@sarj/iac-source-coupled-test": "warn",
   "@sarj/duplicate-test-body": "error",
   "@sarj/enforce-file-structure": "error",
   "@sarj/no-client-side-data-fetching": "error",
@@ -15361,6 +15492,7 @@ var recommendedRules = {
   "@sarj/no-impossible-zod-literal-bounds": "error",
   "@sarj/no-log-only-catch": "error",
   "@sarj/no-long-comment": "error",
+  "@sarj/no-vague-suppression-description": "warn",
   "@sarj/no-generic-single-export-module": "error",
   "@sarj/no-offset-pagination": "error",
   "@sarj/no-positional-tuple-return": "error",
@@ -15407,6 +15539,7 @@ var recommendedRules = {
   "@sarj/zod-naming-convention": "error"
 };
 var strictRules = {
+  "@sarj/iac-source-coupled-test": "warn",
   "@sarj/duplicate-test-body": "error",
   "@sarj/enforce-file-structure": "error",
   "@sarj/no-client-side-data-fetching": "error",
@@ -15422,6 +15555,7 @@ var strictRules = {
   "@sarj/no-impossible-zod-literal-bounds": "error",
   "@sarj/no-log-only-catch": "error",
   "@sarj/no-long-comment": "error",
+  "@sarj/no-vague-suppression-description": "warn",
   "@sarj/no-generic-single-export-module": "error",
   "@sarj/no-offset-pagination": "error",
   "@sarj/no-positional-tuple-return": "error",