@sarj/eslint-plugin 15.6.9 → 15.7.0

package/dist/index.cjs

@@ -14868,7 +14868,7 @@ var stepdown_default = createRule({
 
 // src/rules/source-coupled-test.ts
 var import_utils70 = require("@typescript-eslint/utils");
-var SOURCE_SUFFIX_RE = /\.(?:bash|hcl|sh|tf|tfvars|ya?ml|py|[cm]?[jt]s)$/iu;
+var GENERAL_SOURCE_SUFFIX_RE = /\.(?:bash|sh|ya?ml|py|[cm]?[jt]s)$/iu;
 var FS_MODULES = /* @__PURE__ */ new Set(["fs", "node:fs", "fs/promises", "node:fs/promises"]);
 var FS_READERS = /* @__PURE__ */ new Set(["readFile", "readFileSync"]);
 var TEXT_TRANSFORMS = /* @__PURE__ */ new Set([
@@ -14882,7 +14882,8 @@ var TEXT_TRANSFORMS = /* @__PURE__ */ new Set([
   "trimEnd",
   "trimStart",
   "replace",
-  "replaceAll"
+  "replaceAll",
+  "split"
 ]);
 var TEXT_PREDICATES = /* @__PURE__ */ new Set(["endsWith", "includes", "indexOf", "lastIndexOf", "match", "matchAll", "search", "startsWith"]);
 var REGEXP_PREDICATES = /* @__PURE__ */ new Set(["exec", "test"]);
@@ -14907,7 +14908,7 @@ var ASSERT_MATCHERS = /* @__PURE__ */ new Set(["deepEqual", "doesNotMatch", "equ
 var sourceCoupledTestDocumentation = {
   summary: "Disallow raw repository source text as a test oracle; parse or execute the artifact instead.",
   rationale: "Substring and regex checks can pass on comments or unreachable configuration and fail after behavior-preserving formatting changes.",
-  remediation: "Parse the artifact, execute its validator, or assert on Terraform plan JSON or another runtime contract.",
+  remediation: "Parse the artifact, execute its validator, or assert on another runtime contract.",
   category: "testing",
   limitations: [
     "The rule follows lexical aliases, source-path collections, awaited reads, and common text operations; interprocedural flows remain unreported.",
@@ -14924,10 +14925,10 @@ var sourceCoupledTestDocumentation = {
       public: true
     },
     {
-      id: "terraform-substring-contract",
-      title: "Do not prove Terraform behavior with a regex",
+      id: "workflow-substring-contract",
+      title: "Do not prove workflow behavior with a regex",
       outcome: "match",
-      files: [{ path: "src/policy.test.ts", source: "import { readFileSync } from 'node:fs'; test('policy', () => { const source = readFileSync('main.tf', 'utf8'); expect(source).toMatch(/prevent_destroy/); });" }],
+      files: [{ path: "src/policy.test.ts", source: "import { readFileSync } from 'node:fs'; test('policy', () => { const source = readFileSync('workflow.yml', 'utf8'); expect(source).toMatch(/permissions/); });" }],
       focusPath: "src/policy.test.ts",
       expectedCount: 1,
       public: true
@@ -14962,191 +14963,237 @@ function requireSource(node) {
 function newScope() {
   return { collections: /* @__PURE__ */ new Set(), declared: /* @__PURE__ */ new Set(), fsObjects: /* @__PURE__ */ new Set(), fsReaders: /* @__PURE__ */ new Set(), paths: /* @__PURE__ */ new Set(), rawOrigins: /* @__PURE__ */ new Map() };
 }
-var source_coupled_test_default = createRule({
-  name: "source-coupled-test",
-  documentation: sourceCoupledTestDocumentation,
-  meta: {
-    type: "suggestion",
-    docs: { description: sourceCoupledTestDocumentation.summary },
-    schema: [],
-    messages: { rawSourceOracle: "Raw repository source text is the oracle. Parse or execute the artifact so comments, formatting, and unreachable blocks cannot satisfy the contract." }
-  },
-  defaultOptions: [],
-  create(context) {
-    if (!isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) return {};
-    const scopes = [newScope()];
-    const reportedOrigins = /* @__PURE__ */ new Set();
-    const currentScope = () => scopes.at(-1) ?? scopes[0];
-    const visible = (kind, name) => {
-      for (let index = scopes.length - 1; index >= 0; index--) {
-        const scope = scopes[index];
-        if (scope.declared.has(name)) return scope[kind].has(name);
-      }
-      return false;
-    };
-    const visibleRawOrigins = (name) => {
-      for (let index = scopes.length - 1; index >= 0; index--) {
-        const scope = scopes[index];
-        if (scope.declared.has(name)) return scope.rawOrigins.get(name) ?? /* @__PURE__ */ new Set();
-      }
-      return /* @__PURE__ */ new Set();
-    };
-    const sourcePath = (node) => {
-      const current = unwrap5(node);
-      const value = stringValue(current);
-      if (value !== null) return SOURCE_SUFFIX_RE.test(value);
-      if (current.type === import_utils70.AST_NODE_TYPES.Identifier) return visible("paths", current.name);
-      if (current.type === import_utils70.AST_NODE_TYPES.BinaryExpression && current.operator === "+") {
-        return sourcePath(current.left) || sourcePath(current.right);
-      }
-      if (current.type === import_utils70.AST_NODE_TYPES.TemplateLiteral) return current.expressions.some(sourcePath);
-      if (current.type === import_utils70.AST_NODE_TYPES.CallExpression || current.type === import_utils70.AST_NODE_TYPES.NewExpression) {
-        return current.arguments.some((argument) => argument.type !== import_utils70.AST_NODE_TYPES.SpreadElement && sourcePath(argument));
-      }
-      if (current.type === import_utils70.AST_NODE_TYPES.MemberExpression) return sourcePath(current.object);
-      return false;
-    };
-    const rawRead = (node) => {
-      const current = unwrap5(node);
-      if (current.type !== import_utils70.AST_NODE_TYPES.CallExpression || current.arguments.length === 0) return false;
-      const callee = unwrap5(current.callee);
-      if (callee.type === import_utils70.AST_NODE_TYPES.Identifier) {
-        return visible("fsReaders", callee.name) && sourcePath(current.arguments[0]);
-      }
-      if (callee.type !== import_utils70.AST_NODE_TYPES.MemberExpression) return false;
-      const name = staticMemberName5(callee);
-      const object = unwrap5(callee.object);
-      return name !== null && FS_READERS.has(name) && object.type === import_utils70.AST_NODE_TYPES.Identifier && visible("fsObjects", object.name) && sourcePath(current.arguments[0]);
-    };
-    const rawOrigins = (node) => {
-      const current = unwrap5(node);
-      if (current.type === import_utils70.AST_NODE_TYPES.Identifier) return visibleRawOrigins(current.name);
-      if (rawRead(current)) return /* @__PURE__ */ new Set([`${current.range[0]}:${current.range[1]}`]);
-      if (current.type === import_utils70.AST_NODE_TYPES.BinaryExpression && current.operator === "+") return /* @__PURE__ */ new Set([...rawOrigins(current.left), ...rawOrigins(current.right)]);
-      if (current.type !== import_utils70.AST_NODE_TYPES.CallExpression) return /* @__PURE__ */ new Set();
-      const callee = unwrap5(current.callee);
-      if (callee.type !== import_utils70.AST_NODE_TYPES.MemberExpression) return /* @__PURE__ */ new Set();
-      const name = staticMemberName5(callee);
-      return name !== null && TEXT_TRANSFORMS.has(name) ? rawOrigins(callee.object) : /* @__PURE__ */ new Set();
-    };
-    const evidenceOrigins = (node) => {
-      const current = unwrap5(node);
-      const direct = rawOrigins(current);
-      if (direct.size > 0) return direct;
-      if (current.type === import_utils70.AST_NODE_TYPES.BinaryExpression || current.type === import_utils70.AST_NODE_TYPES.LogicalExpression) return /* @__PURE__ */ new Set([...evidenceOrigins(current.left), ...evidenceOrigins(current.right)]);
-      if (current.type === import_utils70.AST_NODE_TYPES.UnaryExpression) return evidenceOrigins(current.argument);
-      if (current.type !== import_utils70.AST_NODE_TYPES.CallExpression) return /* @__PURE__ */ new Set();
-      const callee = unwrap5(current.callee);
-      if (callee.type !== import_utils70.AST_NODE_TYPES.MemberExpression) return /* @__PURE__ */ new Set();
-      const name = staticMemberName5(callee);
-      if (name !== null && TEXT_PREDICATES.has(name)) return rawOrigins(callee.object);
-      if (name !== null && REGEXP_PREDICATES.has(name)) return new Set(current.arguments.flatMap((argument) => argument.type === import_utils70.AST_NODE_TYPES.SpreadElement ? [] : [...rawOrigins(argument)]));
-      return /* @__PURE__ */ new Set();
-    };
-    const rawAssertionOrigins = (node) => {
-      const callee = unwrap5(node.callee);
-      if (callee.type === import_utils70.AST_NODE_TYPES.Identifier && callee.name === "assert") {
-        return new Set(node.arguments.flatMap((argument) => argument.type === import_utils70.AST_NODE_TYPES.SpreadElement ? [] : [...evidenceOrigins(argument)]));
-      }
-      if (callee.type !== import_utils70.AST_NODE_TYPES.MemberExpression) return /* @__PURE__ */ new Set();
-      const matcher = staticMemberName5(callee);
-      if (matcher === null) return /* @__PURE__ */ new Set();
-      let receiver = unwrap5(callee.object);
-      while (receiver.type === import_utils70.AST_NODE_TYPES.MemberExpression && EXPECT_MODIFIERS.has(staticMemberName5(receiver) ?? "")) receiver = unwrap5(receiver.object);
-      if (receiver.type === import_utils70.AST_NODE_TYPES.CallExpression && receiver.callee.type === import_utils70.AST_NODE_TYPES.Identifier && receiver.callee.name === "expect") {
-        if (!EXPECT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
-        return new Set([...receiver.arguments, ...node.arguments].flatMap((argument) => argument.type === import_utils70.AST_NODE_TYPES.SpreadElement ? [] : [...evidenceOrigins(argument)]));
-      }
-      if (receiver.type !== import_utils70.AST_NODE_TYPES.Identifier || receiver.name !== "assert" || !ASSERT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
-      return new Set(node.arguments.flatMap((argument) => argument.type === import_utils70.AST_NODE_TYPES.SpreadElement ? [] : [...evidenceOrigins(argument)]));
-    };
-    const declare = (name, state) => {
-      const scope = currentScope();
-      scope.declared.add(name);
-      scope.collections.delete(name);
-      scope.fsObjects.delete(name);
-      scope.fsReaders.delete(name);
-      scope.paths.delete(name);
-      scope.rawOrigins.delete(name);
-      if (state.collection === true) scope.collections.add(name);
-      if (state.fsObject === true) scope.fsObjects.add(name);
-      if (state.fsReader === true) scope.fsReaders.add(name);
-      if (state.path === true) scope.paths.add(name);
-      if (state.rawOrigins !== void 0 && state.rawOrigins.size > 0) {
-        scope.rawOrigins.set(name, state.rawOrigins);
-      }
-    };
-    const sourceCollection = (node) => {
-      const current = unwrap5(node);
-      return current.type === import_utils70.AST_NODE_TYPES.ArrayExpression && current.elements.length > 0 && current.elements.every((element) => element !== null && element.type !== import_utils70.AST_NODE_TYPES.SpreadElement && sourcePath(element));
-    };
-    const declaredNames2 = (node) => {
-      const current = unwrap5(node);
-      if (current.type === import_utils70.AST_NODE_TYPES.Identifier) return [current.name];
-      if (current.type === import_utils70.AST_NODE_TYPES.AssignmentPattern) return declaredNames2(current.left);
-      if (current.type === import_utils70.AST_NODE_TYPES.RestElement) return declaredNames2(current.argument);
-      if (current.type === import_utils70.AST_NODE_TYPES.ArrayPattern) return current.elements.flatMap((element) => element === null ? [] : declaredNames2(element));
-      if (current.type === import_utils70.AST_NODE_TYPES.ObjectPattern) return current.properties.flatMap((property) => property.type === import_utils70.AST_NODE_TYPES.RestElement ? declaredNames2(property.argument) : declaredNames2(property.value));
-      return [];
-    };
-    const enterFunction = (node) => {
-      scopes.push(newScope());
-      for (const parameter of node.params) for (const name of declaredNames2(parameter)) declare(name, {});
-    };
-    const exitFunction = () => {
-      scopes.pop();
-    };
-    return {
-      ImportDeclaration(node) {
-        const source = importSource(node);
-        if (source === null || !FS_MODULES.has(source)) return;
-        for (const specifier of node.specifiers) {
-          if (specifier.type === import_utils70.AST_NODE_TYPES.ImportSpecifier) {
-            const imported = specifier.imported.type === import_utils70.AST_NODE_TYPES.Identifier ? specifier.imported.name : String(specifier.imported.value);
-            if (FS_READERS.has(imported)) declare(specifier.local.name, { fsReader: true });
-          } else {
-            declare(specifier.local.name, { fsObject: true });
-          }
+function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
+  return createRule({
+    name,
+    documentation,
+    meta: {
+      type: "suggestion",
+      docs: { description: documentation.summary },
+      schema: [],
+      messages: { rawSourceOracle: "Raw repository source text is the oracle. Parse or execute the artifact so comments, formatting, and unreachable blocks cannot satisfy the contract." }
+    },
+    defaultOptions: [],
+    create(context) {
+      if (!isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) return {};
+      const scopes = [newScope()];
+      const reportedOrigins = /* @__PURE__ */ new Set();
+      const currentScope = () => scopes.at(-1) ?? scopes[0];
+      const visible = (kind, name2) => {
+        for (let index = scopes.length - 1; index >= 0; index--) {
+          const scope = scopes[index];
+          if (scope.declared.has(name2)) return scope[kind].has(name2);
         }
-      },
-      ":function": enterFunction,
-      ":function:exit": exitFunction,
-      VariableDeclarator(node) {
-        if (node.init === null) return;
-        const required = requireSource(node.init);
-        if (required !== null && FS_MODULES.has(required) && node.id.type === import_utils70.AST_NODE_TYPES.Identifier) {
-          declare(node.id.name, { fsObject: true });
-          return;
+        return false;
+      };
+      const visibleRawOrigins = (name2) => {
+        for (let index = scopes.length - 1; index >= 0; index--) {
+          const scope = scopes[index];
+          if (scope.declared.has(name2)) return scope.rawOrigins.get(name2) ?? /* @__PURE__ */ new Set();
         }
-        if (node.id.type === import_utils70.AST_NODE_TYPES.ObjectPattern && required !== null && FS_MODULES.has(required)) {
-          for (const property of node.id.properties) {
-            if (property.type !== import_utils70.AST_NODE_TYPES.Property || property.value.type !== import_utils70.AST_NODE_TYPES.Identifier) continue;
-            const key = property.key.type === import_utils70.AST_NODE_TYPES.Identifier ? property.key.name : property.key.type === import_utils70.AST_NODE_TYPES.Literal ? String(property.key.value) : "";
-            if (FS_READERS.has(key)) declare(property.value.name, { fsReader: true });
+        return /* @__PURE__ */ new Set();
+      };
+      const sourcePath = (node) => {
+        const current = unwrap5(node);
+        const value = stringValue(current);
+        if (value !== null) return sourceSuffixRe.test(value);
+        if (current.type === import_utils70.AST_NODE_TYPES.Identifier) return visible("paths", current.name);
+        if (current.type === import_utils70.AST_NODE_TYPES.BinaryExpression && current.operator === "+") {
+          return sourcePath(current.left) || sourcePath(current.right);
+        }
+        if (current.type === import_utils70.AST_NODE_TYPES.TemplateLiteral) return current.expressions.some(sourcePath);
+        if (current.type === import_utils70.AST_NODE_TYPES.CallExpression || current.type === import_utils70.AST_NODE_TYPES.NewExpression) {
+          return current.arguments.some((argument) => argument.type !== import_utils70.AST_NODE_TYPES.SpreadElement && sourcePath(argument));
+        }
+        if (current.type === import_utils70.AST_NODE_TYPES.MemberExpression) return sourcePath(current.object);
+        return false;
+      };
+      const rawRead = (node) => {
+        const current = unwrap5(node);
+        if (current.type !== import_utils70.AST_NODE_TYPES.CallExpression || current.arguments.length === 0) return false;
+        const callee = unwrap5(current.callee);
+        if (callee.type === import_utils70.AST_NODE_TYPES.Identifier) {
+          return visible("fsReaders", callee.name) && sourcePath(current.arguments[0]);
+        }
+        if (callee.type !== import_utils70.AST_NODE_TYPES.MemberExpression) return false;
+        const name2 = staticMemberName5(callee);
+        const object = unwrap5(callee.object);
+        return name2 !== null && FS_READERS.has(name2) && object.type === import_utils70.AST_NODE_TYPES.Identifier && visible("fsObjects", object.name) && sourcePath(current.arguments[0]);
+      };
+      const rawOrigins = (node) => {
+        const current = unwrap5(node);
+        if (current.type === import_utils70.AST_NODE_TYPES.Identifier) return visibleRawOrigins(current.name);
+        if (rawRead(current)) return /* @__PURE__ */ new Set([`${current.range[0]}:${current.range[1]}`]);
+        if (current.type === import_utils70.AST_NODE_TYPES.BinaryExpression && current.operator === "+") return /* @__PURE__ */ new Set([...rawOrigins(current.left), ...rawOrigins(current.right)]);
+        if (current.type === import_utils70.AST_NODE_TYPES.MemberExpression && staticMemberName5(current) === "length") return rawOrigins(current.object);
+        if (current.type !== import_utils70.AST_NODE_TYPES.CallExpression) return /* @__PURE__ */ new Set();
+        const callee = unwrap5(current.callee);
+        if (callee.type !== import_utils70.AST_NODE_TYPES.MemberExpression) return /* @__PURE__ */ new Set();
+        const name2 = staticMemberName5(callee);
+        return name2 !== null && TEXT_TRANSFORMS.has(name2) ? rawOrigins(callee.object) : /* @__PURE__ */ new Set();
+      };
+      const evidenceOrigins = (node) => {
+        const current = unwrap5(node);
+        const direct = rawOrigins(current);
+        if (direct.size > 0) return direct;
+        if (current.type === import_utils70.AST_NODE_TYPES.BinaryExpression || current.type === import_utils70.AST_NODE_TYPES.LogicalExpression) return /* @__PURE__ */ new Set([...evidenceOrigins(current.left), ...evidenceOrigins(current.right)]);
+        if (current.type === import_utils70.AST_NODE_TYPES.UnaryExpression) return evidenceOrigins(current.argument);
+        if (current.type !== import_utils70.AST_NODE_TYPES.CallExpression) return /* @__PURE__ */ new Set();
+        const callee = unwrap5(current.callee);
+        if (callee.type !== import_utils70.AST_NODE_TYPES.MemberExpression) return /* @__PURE__ */ new Set();
+        const name2 = staticMemberName5(callee);
+        if (name2 !== null && TEXT_PREDICATES.has(name2)) return rawOrigins(callee.object);
+        if (name2 !== null && REGEXP_PREDICATES.has(name2)) return new Set(current.arguments.flatMap((argument) => argument.type === import_utils70.AST_NODE_TYPES.SpreadElement ? [] : [...rawOrigins(argument)]));
+        return /* @__PURE__ */ new Set();
+      };
+      const rawAssertionOrigins = (node) => {
+        const callee = unwrap5(node.callee);
+        if (callee.type === import_utils70.AST_NODE_TYPES.Identifier && callee.name === "assert") {
+          return new Set(node.arguments.flatMap((argument) => argument.type === import_utils70.AST_NODE_TYPES.SpreadElement ? [] : [...evidenceOrigins(argument)]));
+        }
+        if (callee.type !== import_utils70.AST_NODE_TYPES.MemberExpression) return /* @__PURE__ */ new Set();
+        const matcher = staticMemberName5(callee);
+        if (matcher === null) return /* @__PURE__ */ new Set();
+        let receiver = unwrap5(callee.object);
+        while (receiver.type === import_utils70.AST_NODE_TYPES.MemberExpression && EXPECT_MODIFIERS.has(staticMemberName5(receiver) ?? "")) receiver = unwrap5(receiver.object);
+        if (receiver.type === import_utils70.AST_NODE_TYPES.CallExpression && receiver.callee.type === import_utils70.AST_NODE_TYPES.Identifier && receiver.callee.name === "expect") {
+          if (!EXPECT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
+          return new Set([...receiver.arguments, ...node.arguments].flatMap((argument) => argument.type === import_utils70.AST_NODE_TYPES.SpreadElement ? [] : [...evidenceOrigins(argument)]));
+        }
+        if (receiver.type !== import_utils70.AST_NODE_TYPES.Identifier || receiver.name !== "assert" || !ASSERT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
+        return new Set(node.arguments.flatMap((argument) => argument.type === import_utils70.AST_NODE_TYPES.SpreadElement ? [] : [...evidenceOrigins(argument)]));
+      };
+      const declare = (name2, state) => {
+        const scope = currentScope();
+        scope.declared.add(name2);
+        scope.collections.delete(name2);
+        scope.fsObjects.delete(name2);
+        scope.fsReaders.delete(name2);
+        scope.paths.delete(name2);
+        scope.rawOrigins.delete(name2);
+        if (state.collection === true) scope.collections.add(name2);
+        if (state.fsObject === true) scope.fsObjects.add(name2);
+        if (state.fsReader === true) scope.fsReaders.add(name2);
+        if (state.path === true) scope.paths.add(name2);
+        if (state.rawOrigins !== void 0 && state.rawOrigins.size > 0) {
+          scope.rawOrigins.set(name2, state.rawOrigins);
+        }
+      };
+      const sourceCollection = (node) => {
+        const current = unwrap5(node);
+        return current.type === import_utils70.AST_NODE_TYPES.ArrayExpression && current.elements.length > 0 && current.elements.every((element) => element !== null && element.type !== import_utils70.AST_NODE_TYPES.SpreadElement && sourcePath(element));
+      };
+      const declaredNames2 = (node) => {
+        const current = unwrap5(node);
+        if (current.type === import_utils70.AST_NODE_TYPES.Identifier) return [current.name];
+        if (current.type === import_utils70.AST_NODE_TYPES.AssignmentPattern) return declaredNames2(current.left);
+        if (current.type === import_utils70.AST_NODE_TYPES.RestElement) return declaredNames2(current.argument);
+        if (current.type === import_utils70.AST_NODE_TYPES.ArrayPattern) return current.elements.flatMap((element) => element === null ? [] : declaredNames2(element));
+        if (current.type === import_utils70.AST_NODE_TYPES.ObjectPattern) return current.properties.flatMap((property) => property.type === import_utils70.AST_NODE_TYPES.RestElement ? declaredNames2(property.argument) : declaredNames2(property.value));
+        return [];
+      };
+      const enterFunction = (node) => {
+        scopes.push(newScope());
+        for (const parameter of node.params) for (const name2 of declaredNames2(parameter)) declare(name2, {});
+      };
+      const exitFunction = () => {
+        scopes.pop();
+      };
+      return {
+        ImportDeclaration(node) {
+          const source = importSource(node);
+          if (source === null || !FS_MODULES.has(source)) return;
+          for (const specifier of node.specifiers) {
+            if (specifier.type === import_utils70.AST_NODE_TYPES.ImportSpecifier) {
+              const imported = specifier.imported.type === import_utils70.AST_NODE_TYPES.Identifier ? specifier.imported.name : String(specifier.imported.value);
+              if (FS_READERS.has(imported)) declare(specifier.local.name, { fsReader: true });
+            } else {
+              declare(specifier.local.name, { fsObject: true });
+            }
           }
-          return;
+        },
+        ":function": enterFunction,
+        ":function:exit": exitFunction,
+        VariableDeclarator(node) {
+          if (node.init === null) return;
+          const required = requireSource(node.init);
+          if (required !== null && FS_MODULES.has(required) && node.id.type === import_utils70.AST_NODE_TYPES.Identifier) {
+            declare(node.id.name, { fsObject: true });
+            return;
+          }
+          if (node.id.type === import_utils70.AST_NODE_TYPES.ObjectPattern && required !== null && FS_MODULES.has(required)) {
+            for (const property of node.id.properties) {
+              if (property.type !== import_utils70.AST_NODE_TYPES.Property || property.value.type !== import_utils70.AST_NODE_TYPES.Identifier) continue;
+              const key = property.key.type === import_utils70.AST_NODE_TYPES.Identifier ? property.key.name : property.key.type === import_utils70.AST_NODE_TYPES.Literal ? String(property.key.value) : "";
+              if (FS_READERS.has(key)) declare(property.value.name, { fsReader: true });
+            }
+            return;
+          }
+          if (node.id.type !== import_utils70.AST_NODE_TYPES.Identifier) return;
+          declare(node.id.name, { collection: sourceCollection(node.init), path: sourcePath(node.init), rawOrigins: rawOrigins(node.init) });
+        },
+        AssignmentExpression(node) {
+          if (node.left.type === import_utils70.AST_NODE_TYPES.Identifier) declare(node.left.name, { path: sourcePath(node.right), rawOrigins: rawOrigins(node.right) });
+        },
+        ForOfStatement(node) {
+          const right = unwrap5(node.right);
+          const collection = right.type === import_utils70.AST_NODE_TYPES.Identifier && visible("collections", right.name);
+          const left = node.left.type === import_utils70.AST_NODE_TYPES.VariableDeclaration ? node.left.declarations[0]?.id : node.left;
+          if (collection && left?.type === import_utils70.AST_NODE_TYPES.Identifier) declare(left.name, { path: true });
+        },
+        CallExpression(node) {
+          const origins = rawAssertionOrigins(node);
+          if (origins.size === 0 || [...origins].every((origin) => reportedOrigins.has(origin))) return;
+          for (const origin of origins) reportedOrigins.add(origin);
+          context.report({ node, messageId: "rawSourceOracle" });
         }
-        if (node.id.type !== import_utils70.AST_NODE_TYPES.Identifier) return;
-        declare(node.id.name, { collection: sourceCollection(node.init), path: sourcePath(node.init), rawOrigins: rawOrigins(node.init) });
-      },
-      AssignmentExpression(node) {
-        if (node.left.type === import_utils70.AST_NODE_TYPES.Identifier) declare(node.left.name, { path: sourcePath(node.right), rawOrigins: rawOrigins(node.right) });
-      },
-      ForOfStatement(node) {
-        const right = unwrap5(node.right);
-        const collection = right.type === import_utils70.AST_NODE_TYPES.Identifier && visible("collections", right.name);
-        const left = node.left.type === import_utils70.AST_NODE_TYPES.VariableDeclaration ? node.left.declarations[0]?.id : node.left;
-        if (collection && left?.type === import_utils70.AST_NODE_TYPES.Identifier) declare(left.name, { path: true });
-      },
-      CallExpression(node) {
-        const origins = rawAssertionOrigins(node);
-        if (origins.size === 0 || [...origins].every((origin) => reportedOrigins.has(origin))) return;
-        for (const origin of origins) reportedOrigins.add(origin);
-        context.report({ node, messageId: "rawSourceOracle" });
-      }
-    };
-  }
-});
+      };
+    }
+  });
+}
+var source_coupled_test_default = createSourceCoupledRule(
+  "source-coupled-test",
+  sourceCoupledTestDocumentation,
+  GENERAL_SOURCE_SUFFIX_RE
+);
+
+// src/rules/iac-source-coupled-test.ts
+var IAC_SOURCE_SUFFIX_RE = /(?:\.tf\.json|\.tftest\.(?:hcl|json)|\.(?:hcl|tf|tfvars))$/iu;
+var iacSourceCoupledTestDocumentation = {
+  summary: "Disallow raw IaC source text as a test oracle; inspect a rendered plan, provider state, or runtime behavior.",
+  rationale: "Substring and regex checks can pass on comments, formatting, or unreachable Terraform configuration while clients fail silently.",
+  remediation: "Parse rendered plan JSON, query the provider, or exercise the deployed runtime contract.",
+  category: "testing",
+  limitations: [
+    "The rule follows lexical aliases, source-path collections, awaited reads, and common text operations; interprocedural flows remain unreported.",
+    "The warning-stage rule remains suppressible for calibration; promotion may make the locked policy non-suppressible."
+  ],
+  examples: [
+    {
+      id: "rendered-plan-contract",
+      title: "Assert on rendered plan behavior",
+      outcome: "no-match",
+      files: [{ path: "src/policy.test.ts", source: "import { readFileSync } from 'node:fs'; test('policy', () => { const plan = JSON.parse(readFileSync('plan.json', 'utf8')); expect(validate(plan)).toEqual([]); });" }],
+      focusPath: "src/policy.test.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "terraform-substring-contract",
+      title: "Do not prove Terraform behavior with a regex",
+      outcome: "match",
+      files: [{ path: "src/policy.test.ts", source: "import { readFileSync } from 'node:fs'; test('policy', () => { const source = readFileSync('main.tf', 'utf8'); expect(source).toMatch(/prevent_destroy/); });" }],
+      focusPath: "src/policy.test.ts",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+var iac_source_coupled_test_default = createSourceCoupledRule(
+  "iac-source-coupled-test",
+  iacSourceCoupledTestDocumentation,
+  IAC_SOURCE_SUFFIX_RE
+);
 
 // src/rules/zod-naming-convention.ts
 var import_utils71 = require("@typescript-eslint/utils");
@@ -15371,6 +15418,7 @@ var retiredRules = {
 
 // src/index.ts
 var rules = {
+  "iac-source-coupled-test": iac_source_coupled_test_default,
   "duplicate-test-body": duplicate_test_body_default,
   "enforce-file-structure": enforce_file_structure_default,
   "no-client-side-data-fetching": no_client_side_data_fetching_default,
@@ -15440,15 +15488,16 @@ var rules = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.6.9"
+  version: "15.7.0"
 };
 var applicationOnlyRules = [
   "no-restricted-library-load",
   "prefer-native-random-uuid",
   "prefer-shadcn-primitives"
 ];
-var advisoryRules = ["no-vague-suppression-description", "source-coupled-test"];
+var advisoryRules = ["no-vague-suppression-description", "iac-source-coupled-test", "source-coupled-test"];
 var recommendedRules = {
+  "@sarj/iac-source-coupled-test": "warn",
   "@sarj/duplicate-test-body": "error",
   "@sarj/enforce-file-structure": "error",
   "@sarj/no-client-side-data-fetching": "error",
@@ -15510,6 +15559,7 @@ var recommendedRules = {
   "@sarj/zod-naming-convention": "error"
 };
 var strictRules = {
+  "@sarj/iac-source-coupled-test": "warn",
   "@sarj/duplicate-test-body": "error",
   "@sarj/enforce-file-structure": "error",
   "@sarj/no-client-side-data-fetching": "error",

package/dist/index.d.cts

@@ -188,6 +188,7 @@ declare const renamedRules: {
 };
 
 declare const rules: {
+    readonly "iac-source-coupled-test": DocumentedRule<readonly [], "rawSourceOracle">;
     readonly "duplicate-test-body": DocumentedRule<readonly [], "duplicateTestBody">;
     readonly "enforce-file-structure": DocumentedRule<readonly [], "importsFirst" | "useServerDirective">;
     readonly "no-client-side-data-fetching": DocumentedRule<readonly [], "noClientFetch">;
@@ -283,8 +284,9 @@ declare const rules: {
 /** Rules registered for application-profile configs but intentionally absent from general presets. */
 declare const applicationOnlyRules: readonly ["no-restricted-library-load", "prefer-native-random-uuid", "prefer-shadcn-primitives"];
 /** Calibrated rules that intentionally remain warnings until consumer-corpus precision is proven. */
-declare const advisoryRules: readonly ["no-vague-suppression-description", "source-coupled-test"];
+declare const advisoryRules: readonly ["no-vague-suppression-description", "iac-source-coupled-test", "source-coupled-test"];
 declare const recommendedRules: {
+    readonly "@sarj/iac-source-coupled-test": "warn";
     readonly "@sarj/duplicate-test-body": "error";
     readonly "@sarj/enforce-file-structure": "error";
     readonly "@sarj/no-client-side-data-fetching": "error";
@@ -350,6 +352,7 @@ declare const recommendedRules: {
     readonly "@sarj/zod-naming-convention": "error";
 };
 declare const strictRules: {
+    readonly "@sarj/iac-source-coupled-test": "warn";
     readonly "@sarj/duplicate-test-body": "error";
     readonly "@sarj/enforce-file-structure": "error";
     readonly "@sarj/no-client-side-data-fetching": "error";
@@ -426,9 +429,10 @@ type FlatPreset = {
 declare const plugin: {
     readonly meta: {
         readonly name: "@sarj/eslint-plugin";
-        readonly version: "15.6.9";
+        readonly version: "15.7.0";
     };
     readonly rules: {
+        readonly "iac-source-coupled-test": DocumentedRule<readonly [], "rawSourceOracle">;
         readonly "duplicate-test-body": DocumentedRule<readonly [], "duplicateTestBody">;
         readonly "enforce-file-structure": DocumentedRule<readonly [], "importsFirst" | "useServerDirective">;
         readonly "no-client-side-data-fetching": DocumentedRule<readonly [], "noClientFetch">;

package/dist/index.d.ts

@@ -188,6 +188,7 @@ declare const renamedRules: {
 };
 
 declare const rules: {
+    readonly "iac-source-coupled-test": DocumentedRule<readonly [], "rawSourceOracle">;
     readonly "duplicate-test-body": DocumentedRule<readonly [], "duplicateTestBody">;
     readonly "enforce-file-structure": DocumentedRule<readonly [], "importsFirst" | "useServerDirective">;
     readonly "no-client-side-data-fetching": DocumentedRule<readonly [], "noClientFetch">;
@@ -283,8 +284,9 @@ declare const rules: {
 /** Rules registered for application-profile configs but intentionally absent from general presets. */
 declare const applicationOnlyRules: readonly ["no-restricted-library-load", "prefer-native-random-uuid", "prefer-shadcn-primitives"];
 /** Calibrated rules that intentionally remain warnings until consumer-corpus precision is proven. */
-declare const advisoryRules: readonly ["no-vague-suppression-description", "source-coupled-test"];
+declare const advisoryRules: readonly ["no-vague-suppression-description", "iac-source-coupled-test", "source-coupled-test"];
 declare const recommendedRules: {
+    readonly "@sarj/iac-source-coupled-test": "warn";
     readonly "@sarj/duplicate-test-body": "error";
     readonly "@sarj/enforce-file-structure": "error";
     readonly "@sarj/no-client-side-data-fetching": "error";
@@ -350,6 +352,7 @@ declare const recommendedRules: {
     readonly "@sarj/zod-naming-convention": "error";
 };
 declare const strictRules: {
+    readonly "@sarj/iac-source-coupled-test": "warn";
     readonly "@sarj/duplicate-test-body": "error";
     readonly "@sarj/enforce-file-structure": "error";
     readonly "@sarj/no-client-side-data-fetching": "error";
@@ -426,9 +429,10 @@ type FlatPreset = {
 declare const plugin: {
     readonly meta: {
         readonly name: "@sarj/eslint-plugin";
-        readonly version: "15.6.9";
+        readonly version: "15.7.0";
     };
     readonly rules: {
+        readonly "iac-source-coupled-test": DocumentedRule<readonly [], "rawSourceOracle">;
         readonly "duplicate-test-body": DocumentedRule<readonly [], "duplicateTestBody">;
         readonly "enforce-file-structure": DocumentedRule<readonly [], "importsFirst" | "useServerDirective">;
         readonly "no-client-side-data-fetching": DocumentedRule<readonly [], "noClientFetch">;

package/dist/index.js

@@ -14845,7 +14845,7 @@ var stepdown_default = createRule({
 
 // src/rules/source-coupled-test.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES56 } from "@typescript-eslint/utils";
-var SOURCE_SUFFIX_RE = /\.(?:bash|hcl|sh|tf|tfvars|ya?ml|py|[cm]?[jt]s)$/iu;
+var GENERAL_SOURCE_SUFFIX_RE = /\.(?:bash|sh|ya?ml|py|[cm]?[jt]s)$/iu;
 var FS_MODULES = /* @__PURE__ */ new Set(["fs", "node:fs", "fs/promises", "node:fs/promises"]);
 var FS_READERS = /* @__PURE__ */ new Set(["readFile", "readFileSync"]);
 var TEXT_TRANSFORMS = /* @__PURE__ */ new Set([
@@ -14859,7 +14859,8 @@ var TEXT_TRANSFORMS = /* @__PURE__ */ new Set([
   "trimEnd",
   "trimStart",
   "replace",
-  "replaceAll"
+  "replaceAll",
+  "split"
 ]);
 var TEXT_PREDICATES = /* @__PURE__ */ new Set(["endsWith", "includes", "indexOf", "lastIndexOf", "match", "matchAll", "search", "startsWith"]);
 var REGEXP_PREDICATES = /* @__PURE__ */ new Set(["exec", "test"]);
@@ -14884,7 +14885,7 @@ var ASSERT_MATCHERS = /* @__PURE__ */ new Set(["deepEqual", "doesNotMatch", "equ
 var sourceCoupledTestDocumentation = {
   summary: "Disallow raw repository source text as a test oracle; parse or execute the artifact instead.",
   rationale: "Substring and regex checks can pass on comments or unreachable configuration and fail after behavior-preserving formatting changes.",
-  remediation: "Parse the artifact, execute its validator, or assert on Terraform plan JSON or another runtime contract.",
+  remediation: "Parse the artifact, execute its validator, or assert on another runtime contract.",
   category: "testing",
   limitations: [
     "The rule follows lexical aliases, source-path collections, awaited reads, and common text operations; interprocedural flows remain unreported.",
@@ -14901,10 +14902,10 @@ var sourceCoupledTestDocumentation = {
       public: true
     },
     {
-      id: "terraform-substring-contract",
-      title: "Do not prove Terraform behavior with a regex",
+      id: "workflow-substring-contract",
+      title: "Do not prove workflow behavior with a regex",
       outcome: "match",
-      files: [{ path: "src/policy.test.ts", source: "import { readFileSync } from 'node:fs'; test('policy', () => { const source = readFileSync('main.tf', 'utf8'); expect(source).toMatch(/prevent_destroy/); });" }],
+      files: [{ path: "src/policy.test.ts", source: "import { readFileSync } from 'node:fs'; test('policy', () => { const source = readFileSync('workflow.yml', 'utf8'); expect(source).toMatch(/permissions/); });" }],
       focusPath: "src/policy.test.ts",
       expectedCount: 1,
       public: true
@@ -14939,191 +14940,237 @@ function requireSource(node) {
 function newScope() {
   return { collections: /* @__PURE__ */ new Set(), declared: /* @__PURE__ */ new Set(), fsObjects: /* @__PURE__ */ new Set(), fsReaders: /* @__PURE__ */ new Set(), paths: /* @__PURE__ */ new Set(), rawOrigins: /* @__PURE__ */ new Map() };
 }
-var source_coupled_test_default = createRule({
-  name: "source-coupled-test",
-  documentation: sourceCoupledTestDocumentation,
-  meta: {
-    type: "suggestion",
-    docs: { description: sourceCoupledTestDocumentation.summary },
-    schema: [],
-    messages: { rawSourceOracle: "Raw repository source text is the oracle. Parse or execute the artifact so comments, formatting, and unreachable blocks cannot satisfy the contract." }
-  },
-  defaultOptions: [],
-  create(context) {
-    if (!isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) return {};
-    const scopes = [newScope()];
-    const reportedOrigins = /* @__PURE__ */ new Set();
-    const currentScope = () => scopes.at(-1) ?? scopes[0];
-    const visible = (kind, name) => {
-      for (let index = scopes.length - 1; index >= 0; index--) {
-        const scope = scopes[index];
-        if (scope.declared.has(name)) return scope[kind].has(name);
-      }
-      return false;
-    };
-    const visibleRawOrigins = (name) => {
-      for (let index = scopes.length - 1; index >= 0; index--) {
-        const scope = scopes[index];
-        if (scope.declared.has(name)) return scope.rawOrigins.get(name) ?? /* @__PURE__ */ new Set();
-      }
-      return /* @__PURE__ */ new Set();
-    };
-    const sourcePath = (node) => {
-      const current = unwrap5(node);
-      const value = stringValue(current);
-      if (value !== null) return SOURCE_SUFFIX_RE.test(value);
-      if (current.type === AST_NODE_TYPES56.Identifier) return visible("paths", current.name);
-      if (current.type === AST_NODE_TYPES56.BinaryExpression && current.operator === "+") {
-        return sourcePath(current.left) || sourcePath(current.right);
-      }
-      if (current.type === AST_NODE_TYPES56.TemplateLiteral) return current.expressions.some(sourcePath);
-      if (current.type === AST_NODE_TYPES56.CallExpression || current.type === AST_NODE_TYPES56.NewExpression) {
-        return current.arguments.some((argument) => argument.type !== AST_NODE_TYPES56.SpreadElement && sourcePath(argument));
-      }
-      if (current.type === AST_NODE_TYPES56.MemberExpression) return sourcePath(current.object);
-      return false;
-    };
-    const rawRead = (node) => {
-      const current = unwrap5(node);
-      if (current.type !== AST_NODE_TYPES56.CallExpression || current.arguments.length === 0) return false;
-      const callee = unwrap5(current.callee);
-      if (callee.type === AST_NODE_TYPES56.Identifier) {
-        return visible("fsReaders", callee.name) && sourcePath(current.arguments[0]);
-      }
-      if (callee.type !== AST_NODE_TYPES56.MemberExpression) return false;
-      const name = staticMemberName5(callee);
-      const object = unwrap5(callee.object);
-      return name !== null && FS_READERS.has(name) && object.type === AST_NODE_TYPES56.Identifier && visible("fsObjects", object.name) && sourcePath(current.arguments[0]);
-    };
-    const rawOrigins = (node) => {
-      const current = unwrap5(node);
-      if (current.type === AST_NODE_TYPES56.Identifier) return visibleRawOrigins(current.name);
-      if (rawRead(current)) return /* @__PURE__ */ new Set([`${current.range[0]}:${current.range[1]}`]);
-      if (current.type === AST_NODE_TYPES56.BinaryExpression && current.operator === "+") return /* @__PURE__ */ new Set([...rawOrigins(current.left), ...rawOrigins(current.right)]);
-      if (current.type !== AST_NODE_TYPES56.CallExpression) return /* @__PURE__ */ new Set();
-      const callee = unwrap5(current.callee);
-      if (callee.type !== AST_NODE_TYPES56.MemberExpression) return /* @__PURE__ */ new Set();
-      const name = staticMemberName5(callee);
-      return name !== null && TEXT_TRANSFORMS.has(name) ? rawOrigins(callee.object) : /* @__PURE__ */ new Set();
-    };
-    const evidenceOrigins = (node) => {
-      const current = unwrap5(node);
-      const direct = rawOrigins(current);
-      if (direct.size > 0) return direct;
-      if (current.type === AST_NODE_TYPES56.BinaryExpression || current.type === AST_NODE_TYPES56.LogicalExpression) return /* @__PURE__ */ new Set([...evidenceOrigins(current.left), ...evidenceOrigins(current.right)]);
-      if (current.type === AST_NODE_TYPES56.UnaryExpression) return evidenceOrigins(current.argument);
-      if (current.type !== AST_NODE_TYPES56.CallExpression) return /* @__PURE__ */ new Set();
-      const callee = unwrap5(current.callee);
-      if (callee.type !== AST_NODE_TYPES56.MemberExpression) return /* @__PURE__ */ new Set();
-      const name = staticMemberName5(callee);
-      if (name !== null && TEXT_PREDICATES.has(name)) return rawOrigins(callee.object);
-      if (name !== null && REGEXP_PREDICATES.has(name)) return new Set(current.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...rawOrigins(argument)]));
-      return /* @__PURE__ */ new Set();
-    };
-    const rawAssertionOrigins = (node) => {
-      const callee = unwrap5(node.callee);
-      if (callee.type === AST_NODE_TYPES56.Identifier && callee.name === "assert") {
-        return new Set(node.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...evidenceOrigins(argument)]));
-      }
-      if (callee.type !== AST_NODE_TYPES56.MemberExpression) return /* @__PURE__ */ new Set();
-      const matcher = staticMemberName5(callee);
-      if (matcher === null) return /* @__PURE__ */ new Set();
-      let receiver = unwrap5(callee.object);
-      while (receiver.type === AST_NODE_TYPES56.MemberExpression && EXPECT_MODIFIERS.has(staticMemberName5(receiver) ?? "")) receiver = unwrap5(receiver.object);
-      if (receiver.type === AST_NODE_TYPES56.CallExpression && receiver.callee.type === AST_NODE_TYPES56.Identifier && receiver.callee.name === "expect") {
-        if (!EXPECT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
-        return new Set([...receiver.arguments, ...node.arguments].flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...evidenceOrigins(argument)]));
-      }
-      if (receiver.type !== AST_NODE_TYPES56.Identifier || receiver.name !== "assert" || !ASSERT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
-      return new Set(node.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...evidenceOrigins(argument)]));
-    };
-    const declare = (name, state) => {
-      const scope = currentScope();
-      scope.declared.add(name);
-      scope.collections.delete(name);
-      scope.fsObjects.delete(name);
-      scope.fsReaders.delete(name);
-      scope.paths.delete(name);
-      scope.rawOrigins.delete(name);
-      if (state.collection === true) scope.collections.add(name);
-      if (state.fsObject === true) scope.fsObjects.add(name);
-      if (state.fsReader === true) scope.fsReaders.add(name);
-      if (state.path === true) scope.paths.add(name);
-      if (state.rawOrigins !== void 0 && state.rawOrigins.size > 0) {
-        scope.rawOrigins.set(name, state.rawOrigins);
-      }
-    };
-    const sourceCollection = (node) => {
-      const current = unwrap5(node);
-      return current.type === AST_NODE_TYPES56.ArrayExpression && current.elements.length > 0 && current.elements.every((element) => element !== null && element.type !== AST_NODE_TYPES56.SpreadElement && sourcePath(element));
-    };
-    const declaredNames2 = (node) => {
-      const current = unwrap5(node);
-      if (current.type === AST_NODE_TYPES56.Identifier) return [current.name];
-      if (current.type === AST_NODE_TYPES56.AssignmentPattern) return declaredNames2(current.left);
-      if (current.type === AST_NODE_TYPES56.RestElement) return declaredNames2(current.argument);
-      if (current.type === AST_NODE_TYPES56.ArrayPattern) return current.elements.flatMap((element) => element === null ? [] : declaredNames2(element));
-      if (current.type === AST_NODE_TYPES56.ObjectPattern) return current.properties.flatMap((property) => property.type === AST_NODE_TYPES56.RestElement ? declaredNames2(property.argument) : declaredNames2(property.value));
-      return [];
-    };
-    const enterFunction = (node) => {
-      scopes.push(newScope());
-      for (const parameter of node.params) for (const name of declaredNames2(parameter)) declare(name, {});
-    };
-    const exitFunction = () => {
-      scopes.pop();
-    };
-    return {
-      ImportDeclaration(node) {
-        const source = importSource(node);
-        if (source === null || !FS_MODULES.has(source)) return;
-        for (const specifier of node.specifiers) {
-          if (specifier.type === AST_NODE_TYPES56.ImportSpecifier) {
-            const imported = specifier.imported.type === AST_NODE_TYPES56.Identifier ? specifier.imported.name : String(specifier.imported.value);
-            if (FS_READERS.has(imported)) declare(specifier.local.name, { fsReader: true });
-          } else {
-            declare(specifier.local.name, { fsObject: true });
-          }
+function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
+  return createRule({
+    name,
+    documentation,
+    meta: {
+      type: "suggestion",
+      docs: { description: documentation.summary },
+      schema: [],
+      messages: { rawSourceOracle: "Raw repository source text is the oracle. Parse or execute the artifact so comments, formatting, and unreachable blocks cannot satisfy the contract." }
+    },
+    defaultOptions: [],
+    create(context) {
+      if (!isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) return {};
+      const scopes = [newScope()];
+      const reportedOrigins = /* @__PURE__ */ new Set();
+      const currentScope = () => scopes.at(-1) ?? scopes[0];
+      const visible = (kind, name2) => {
+        for (let index = scopes.length - 1; index >= 0; index--) {
+          const scope = scopes[index];
+          if (scope.declared.has(name2)) return scope[kind].has(name2);
         }
-      },
-      ":function": enterFunction,
-      ":function:exit": exitFunction,
-      VariableDeclarator(node) {
-        if (node.init === null) return;
-        const required = requireSource(node.init);
-        if (required !== null && FS_MODULES.has(required) && node.id.type === AST_NODE_TYPES56.Identifier) {
-          declare(node.id.name, { fsObject: true });
-          return;
+        return false;
+      };
+      const visibleRawOrigins = (name2) => {
+        for (let index = scopes.length - 1; index >= 0; index--) {
+          const scope = scopes[index];
+          if (scope.declared.has(name2)) return scope.rawOrigins.get(name2) ?? /* @__PURE__ */ new Set();
         }
-        if (node.id.type === AST_NODE_TYPES56.ObjectPattern && required !== null && FS_MODULES.has(required)) {
-          for (const property of node.id.properties) {
-            if (property.type !== AST_NODE_TYPES56.Property || property.value.type !== AST_NODE_TYPES56.Identifier) continue;
-            const key = property.key.type === AST_NODE_TYPES56.Identifier ? property.key.name : property.key.type === AST_NODE_TYPES56.Literal ? String(property.key.value) : "";
-            if (FS_READERS.has(key)) declare(property.value.name, { fsReader: true });
+        return /* @__PURE__ */ new Set();
+      };
+      const sourcePath = (node) => {
+        const current = unwrap5(node);
+        const value = stringValue(current);
+        if (value !== null) return sourceSuffixRe.test(value);
+        if (current.type === AST_NODE_TYPES56.Identifier) return visible("paths", current.name);
+        if (current.type === AST_NODE_TYPES56.BinaryExpression && current.operator === "+") {
+          return sourcePath(current.left) || sourcePath(current.right);
+        }
+        if (current.type === AST_NODE_TYPES56.TemplateLiteral) return current.expressions.some(sourcePath);
+        if (current.type === AST_NODE_TYPES56.CallExpression || current.type === AST_NODE_TYPES56.NewExpression) {
+          return current.arguments.some((argument) => argument.type !== AST_NODE_TYPES56.SpreadElement && sourcePath(argument));
+        }
+        if (current.type === AST_NODE_TYPES56.MemberExpression) return sourcePath(current.object);
+        return false;
+      };
+      const rawRead = (node) => {
+        const current = unwrap5(node);
+        if (current.type !== AST_NODE_TYPES56.CallExpression || current.arguments.length === 0) return false;
+        const callee = unwrap5(current.callee);
+        if (callee.type === AST_NODE_TYPES56.Identifier) {
+          return visible("fsReaders", callee.name) && sourcePath(current.arguments[0]);
+        }
+        if (callee.type !== AST_NODE_TYPES56.MemberExpression) return false;
+        const name2 = staticMemberName5(callee);
+        const object = unwrap5(callee.object);
+        return name2 !== null && FS_READERS.has(name2) && object.type === AST_NODE_TYPES56.Identifier && visible("fsObjects", object.name) && sourcePath(current.arguments[0]);
+      };
+      const rawOrigins = (node) => {
+        const current = unwrap5(node);
+        if (current.type === AST_NODE_TYPES56.Identifier) return visibleRawOrigins(current.name);
+        if (rawRead(current)) return /* @__PURE__ */ new Set([`${current.range[0]}:${current.range[1]}`]);
+        if (current.type === AST_NODE_TYPES56.BinaryExpression && current.operator === "+") return /* @__PURE__ */ new Set([...rawOrigins(current.left), ...rawOrigins(current.right)]);
+        if (current.type === AST_NODE_TYPES56.MemberExpression && staticMemberName5(current) === "length") return rawOrigins(current.object);
+        if (current.type !== AST_NODE_TYPES56.CallExpression) return /* @__PURE__ */ new Set();
+        const callee = unwrap5(current.callee);
+        if (callee.type !== AST_NODE_TYPES56.MemberExpression) return /* @__PURE__ */ new Set();
+        const name2 = staticMemberName5(callee);
+        return name2 !== null && TEXT_TRANSFORMS.has(name2) ? rawOrigins(callee.object) : /* @__PURE__ */ new Set();
+      };
+      const evidenceOrigins = (node) => {
+        const current = unwrap5(node);
+        const direct = rawOrigins(current);
+        if (direct.size > 0) return direct;
+        if (current.type === AST_NODE_TYPES56.BinaryExpression || current.type === AST_NODE_TYPES56.LogicalExpression) return /* @__PURE__ */ new Set([...evidenceOrigins(current.left), ...evidenceOrigins(current.right)]);
+        if (current.type === AST_NODE_TYPES56.UnaryExpression) return evidenceOrigins(current.argument);
+        if (current.type !== AST_NODE_TYPES56.CallExpression) return /* @__PURE__ */ new Set();
+        const callee = unwrap5(current.callee);
+        if (callee.type !== AST_NODE_TYPES56.MemberExpression) return /* @__PURE__ */ new Set();
+        const name2 = staticMemberName5(callee);
+        if (name2 !== null && TEXT_PREDICATES.has(name2)) return rawOrigins(callee.object);
+        if (name2 !== null && REGEXP_PREDICATES.has(name2)) return new Set(current.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...rawOrigins(argument)]));
+        return /* @__PURE__ */ new Set();
+      };
+      const rawAssertionOrigins = (node) => {
+        const callee = unwrap5(node.callee);
+        if (callee.type === AST_NODE_TYPES56.Identifier && callee.name === "assert") {
+          return new Set(node.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...evidenceOrigins(argument)]));
+        }
+        if (callee.type !== AST_NODE_TYPES56.MemberExpression) return /* @__PURE__ */ new Set();
+        const matcher = staticMemberName5(callee);
+        if (matcher === null) return /* @__PURE__ */ new Set();
+        let receiver = unwrap5(callee.object);
+        while (receiver.type === AST_NODE_TYPES56.MemberExpression && EXPECT_MODIFIERS.has(staticMemberName5(receiver) ?? "")) receiver = unwrap5(receiver.object);
+        if (receiver.type === AST_NODE_TYPES56.CallExpression && receiver.callee.type === AST_NODE_TYPES56.Identifier && receiver.callee.name === "expect") {
+          if (!EXPECT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
+          return new Set([...receiver.arguments, ...node.arguments].flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...evidenceOrigins(argument)]));
+        }
+        if (receiver.type !== AST_NODE_TYPES56.Identifier || receiver.name !== "assert" || !ASSERT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
+        return new Set(node.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES56.SpreadElement ? [] : [...evidenceOrigins(argument)]));
+      };
+      const declare = (name2, state) => {
+        const scope = currentScope();
+        scope.declared.add(name2);
+        scope.collections.delete(name2);
+        scope.fsObjects.delete(name2);
+        scope.fsReaders.delete(name2);
+        scope.paths.delete(name2);
+        scope.rawOrigins.delete(name2);
+        if (state.collection === true) scope.collections.add(name2);
+        if (state.fsObject === true) scope.fsObjects.add(name2);
+        if (state.fsReader === true) scope.fsReaders.add(name2);
+        if (state.path === true) scope.paths.add(name2);
+        if (state.rawOrigins !== void 0 && state.rawOrigins.size > 0) {
+          scope.rawOrigins.set(name2, state.rawOrigins);
+        }
+      };
+      const sourceCollection = (node) => {
+        const current = unwrap5(node);
+        return current.type === AST_NODE_TYPES56.ArrayExpression && current.elements.length > 0 && current.elements.every((element) => element !== null && element.type !== AST_NODE_TYPES56.SpreadElement && sourcePath(element));
+      };
+      const declaredNames2 = (node) => {
+        const current = unwrap5(node);
+        if (current.type === AST_NODE_TYPES56.Identifier) return [current.name];
+        if (current.type === AST_NODE_TYPES56.AssignmentPattern) return declaredNames2(current.left);
+        if (current.type === AST_NODE_TYPES56.RestElement) return declaredNames2(current.argument);
+        if (current.type === AST_NODE_TYPES56.ArrayPattern) return current.elements.flatMap((element) => element === null ? [] : declaredNames2(element));
+        if (current.type === AST_NODE_TYPES56.ObjectPattern) return current.properties.flatMap((property) => property.type === AST_NODE_TYPES56.RestElement ? declaredNames2(property.argument) : declaredNames2(property.value));
+        return [];
+      };
+      const enterFunction = (node) => {
+        scopes.push(newScope());
+        for (const parameter of node.params) for (const name2 of declaredNames2(parameter)) declare(name2, {});
+      };
+      const exitFunction = () => {
+        scopes.pop();
+      };
+      return {
+        ImportDeclaration(node) {
+          const source = importSource(node);
+          if (source === null || !FS_MODULES.has(source)) return;
+          for (const specifier of node.specifiers) {
+            if (specifier.type === AST_NODE_TYPES56.ImportSpecifier) {
+              const imported = specifier.imported.type === AST_NODE_TYPES56.Identifier ? specifier.imported.name : String(specifier.imported.value);
+              if (FS_READERS.has(imported)) declare(specifier.local.name, { fsReader: true });
+            } else {
+              declare(specifier.local.name, { fsObject: true });
+            }
           }
-          return;
+        },
+        ":function": enterFunction,
+        ":function:exit": exitFunction,
+        VariableDeclarator(node) {
+          if (node.init === null) return;
+          const required = requireSource(node.init);
+          if (required !== null && FS_MODULES.has(required) && node.id.type === AST_NODE_TYPES56.Identifier) {
+            declare(node.id.name, { fsObject: true });
+            return;
+          }
+          if (node.id.type === AST_NODE_TYPES56.ObjectPattern && required !== null && FS_MODULES.has(required)) {
+            for (const property of node.id.properties) {
+              if (property.type !== AST_NODE_TYPES56.Property || property.value.type !== AST_NODE_TYPES56.Identifier) continue;
+              const key = property.key.type === AST_NODE_TYPES56.Identifier ? property.key.name : property.key.type === AST_NODE_TYPES56.Literal ? String(property.key.value) : "";
+              if (FS_READERS.has(key)) declare(property.value.name, { fsReader: true });
+            }
+            return;
+          }
+          if (node.id.type !== AST_NODE_TYPES56.Identifier) return;
+          declare(node.id.name, { collection: sourceCollection(node.init), path: sourcePath(node.init), rawOrigins: rawOrigins(node.init) });
+        },
+        AssignmentExpression(node) {
+          if (node.left.type === AST_NODE_TYPES56.Identifier) declare(node.left.name, { path: sourcePath(node.right), rawOrigins: rawOrigins(node.right) });
+        },
+        ForOfStatement(node) {
+          const right = unwrap5(node.right);
+          const collection = right.type === AST_NODE_TYPES56.Identifier && visible("collections", right.name);
+          const left = node.left.type === AST_NODE_TYPES56.VariableDeclaration ? node.left.declarations[0]?.id : node.left;
+          if (collection && left?.type === AST_NODE_TYPES56.Identifier) declare(left.name, { path: true });
+        },
+        CallExpression(node) {
+          const origins = rawAssertionOrigins(node);
+          if (origins.size === 0 || [...origins].every((origin) => reportedOrigins.has(origin))) return;
+          for (const origin of origins) reportedOrigins.add(origin);
+          context.report({ node, messageId: "rawSourceOracle" });
         }
-        if (node.id.type !== AST_NODE_TYPES56.Identifier) return;
-        declare(node.id.name, { collection: sourceCollection(node.init), path: sourcePath(node.init), rawOrigins: rawOrigins(node.init) });
-      },
-      AssignmentExpression(node) {
-        if (node.left.type === AST_NODE_TYPES56.Identifier) declare(node.left.name, { path: sourcePath(node.right), rawOrigins: rawOrigins(node.right) });
-      },
-      ForOfStatement(node) {
-        const right = unwrap5(node.right);
-        const collection = right.type === AST_NODE_TYPES56.Identifier && visible("collections", right.name);
-        const left = node.left.type === AST_NODE_TYPES56.VariableDeclaration ? node.left.declarations[0]?.id : node.left;
-        if (collection && left?.type === AST_NODE_TYPES56.Identifier) declare(left.name, { path: true });
-      },
-      CallExpression(node) {
-        const origins = rawAssertionOrigins(node);
-        if (origins.size === 0 || [...origins].every((origin) => reportedOrigins.has(origin))) return;
-        for (const origin of origins) reportedOrigins.add(origin);
-        context.report({ node, messageId: "rawSourceOracle" });
-      }
-    };
-  }
-});
+      };
+    }
+  });
+}
+var source_coupled_test_default = createSourceCoupledRule(
+  "source-coupled-test",
+  sourceCoupledTestDocumentation,
+  GENERAL_SOURCE_SUFFIX_RE
+);
+
+// src/rules/iac-source-coupled-test.ts
+var IAC_SOURCE_SUFFIX_RE = /(?:\.tf\.json|\.tftest\.(?:hcl|json)|\.(?:hcl|tf|tfvars))$/iu;
+var iacSourceCoupledTestDocumentation = {
+  summary: "Disallow raw IaC source text as a test oracle; inspect a rendered plan, provider state, or runtime behavior.",
+  rationale: "Substring and regex checks can pass on comments, formatting, or unreachable Terraform configuration while clients fail silently.",
+  remediation: "Parse rendered plan JSON, query the provider, or exercise the deployed runtime contract.",
+  category: "testing",
+  limitations: [
+    "The rule follows lexical aliases, source-path collections, awaited reads, and common text operations; interprocedural flows remain unreported.",
+    "The warning-stage rule remains suppressible for calibration; promotion may make the locked policy non-suppressible."
+  ],
+  examples: [
+    {
+      id: "rendered-plan-contract",
+      title: "Assert on rendered plan behavior",
+      outcome: "no-match",
+      files: [{ path: "src/policy.test.ts", source: "import { readFileSync } from 'node:fs'; test('policy', () => { const plan = JSON.parse(readFileSync('plan.json', 'utf8')); expect(validate(plan)).toEqual([]); });" }],
+      focusPath: "src/policy.test.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "terraform-substring-contract",
+      title: "Do not prove Terraform behavior with a regex",
+      outcome: "match",
+      files: [{ path: "src/policy.test.ts", source: "import { readFileSync } from 'node:fs'; test('policy', () => { const source = readFileSync('main.tf', 'utf8'); expect(source).toMatch(/prevent_destroy/); });" }],
+      focusPath: "src/policy.test.ts",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+var iac_source_coupled_test_default = createSourceCoupledRule(
+  "iac-source-coupled-test",
+  iacSourceCoupledTestDocumentation,
+  IAC_SOURCE_SUFFIX_RE
+);
 
 // src/rules/zod-naming-convention.ts
 import {
@@ -15351,6 +15398,7 @@ var retiredRules = {
 
 // src/index.ts
 var rules = {
+  "iac-source-coupled-test": iac_source_coupled_test_default,
   "duplicate-test-body": duplicate_test_body_default,
   "enforce-file-structure": enforce_file_structure_default,
   "no-client-side-data-fetching": no_client_side_data_fetching_default,
@@ -15420,15 +15468,16 @@ var rules = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.6.9"
+  version: "15.7.0"
 };
 var applicationOnlyRules = [
   "no-restricted-library-load",
   "prefer-native-random-uuid",
   "prefer-shadcn-primitives"
 ];
-var advisoryRules = ["no-vague-suppression-description", "source-coupled-test"];
+var advisoryRules = ["no-vague-suppression-description", "iac-source-coupled-test", "source-coupled-test"];
 var recommendedRules = {
+  "@sarj/iac-source-coupled-test": "warn",
   "@sarj/duplicate-test-body": "error",
   "@sarj/enforce-file-structure": "error",
   "@sarj/no-client-side-data-fetching": "error",
@@ -15490,6 +15539,7 @@ var recommendedRules = {
   "@sarj/zod-naming-convention": "error"
 };
 var strictRules = {
+  "@sarj/iac-source-coupled-test": "warn",
   "@sarj/duplicate-test-body": "error",
   "@sarj/enforce-file-structure": "error",
   "@sarj/no-client-side-data-fetching": "error",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "15.6.9",
+  "version": "15.7.0",
   "packageManager": "npm@12.0.2",
   "description": "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",