@sarj/eslint-plugin 16.22.0 → 16.22.2

package/dist/index.cjs

@@ -866,7 +866,7 @@ function isSearchParamReceiver(call, services) {
 // package.json
 var package_default = {
   name: "@sarj/eslint-plugin",
-  version: "16.22.0",
+  version: "16.22.2",
   packageManager: "npm@12.2.0",
   description: "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   type: "module",
@@ -7294,10 +7294,10 @@ var import_utils44 = require("@typescript-eslint/utils");
 function stripSqlNoise(text) {
   return scanSqlNoise(text);
 }
-function sqlSingleQuotedRanges(text) {
-  const ranges = [];
-  scanSqlNoise(text, (start, end) => ranges.push([start, end]));
-  return ranges;
+function sqlNoiseInfo(text) {
+  const singleQuotedRanges = [];
+  const masked = scanSqlNoise(text, (start, end) => singleQuotedRanges.push([start, end]));
+  return { text: masked, singleQuotedRanges };
 }
 function scanSqlNoise(text, onSingleQuoted) {
   const out = text.split("");
@@ -7383,6 +7383,7 @@ function maskSqlRange(text, out, start, end) {
 }
 var SUBSTITUTION_MARKER = "?";
 function sqlTextOf(node) {
+  node = unwrapExpression(node);
   switch (node.type) {
     case import_utils44.AST_NODE_TYPES.Literal:
       return typeof node.value === "string" ? node.value : null;
@@ -7410,7 +7411,7 @@ function fragmentArrayText(node) {
   if (separator === null) return null;
   const parts = [];
   for (const element of node.elements) {
-    if (element === null || join4 !== null && element.type === import_utils44.AST_NODE_TYPES.ArrayExpression) {
+    if (element === null || join4 !== null && unwrapExpression(element).type === import_utils44.AST_NODE_TYPES.ArrayExpression) {
       return null;
     }
     const part = sqlTextOf(element);
@@ -7422,8 +7423,10 @@ function fragmentArrayText(node) {
   return parts.length > 0 ? parts.join(separator) : null;
 }
 function joinedFragmentCall(node) {
-  const parent = node.parent;
-  return parent?.type === import_utils44.AST_NODE_TYPES.MemberExpression && parent.object === node && !parent.computed && parent.property.type === import_utils44.AST_NODE_TYPES.Identifier && parent.property.name === "join" && parent.parent?.type === import_utils44.AST_NODE_TYPES.CallExpression && parent.parent.callee === parent ? parent.parent : null;
+  const value = outerExpression(node);
+  const parent = value.parent;
+  const callee = parent?.type === import_utils44.AST_NODE_TYPES.MemberExpression ? outerExpression(parent) : null;
+  return parent?.type === import_utils44.AST_NODE_TYPES.MemberExpression && parent.object === value && import_utils44.ASTUtils.getPropertyName(parent) === "join" && callee?.parent?.type === import_utils44.AST_NODE_TYPES.CallExpression && callee.parent.callee === callee ? callee.parent : null;
 }
 function markConsumed(node, consumed) {
   consumed.add(node);
@@ -7465,6 +7468,8 @@ function createSqlListener(handler) {
       markConsumed(node, consumed);
       const separator = join4.arguments[0];
       if (separator !== void 0 && staticString(separator) !== null) markConsumed(separator, consumed);
+      const member = unwrapExpression(join4.callee);
+      if (member.type === import_utils44.AST_NODE_TYPES.MemberExpression && member.computed) markConsumed(member.property, consumed);
     },
     TemplateLiteral: (node) => {
       visit(node);
@@ -7475,11 +7480,11 @@ function createSqlListener(handler) {
   };
 }
 function isDiscardedSqlText(node) {
-  let current = node;
+  let current = outerExpression(node);
   let parent = current.parent;
   while (parent !== void 0 && parent !== null) {
-    if (unwrapExpression(parent) === current || parent.type === import_utils44.AST_NODE_TYPES.BinaryExpression && parent.operator === "+") {
-      current = parent;
+    if (parent.type === import_utils44.AST_NODE_TYPES.BinaryExpression && parent.operator === "+") {
+      current = outerExpression(parent);
       parent = current.parent;
       continue;
     }
@@ -7561,8 +7566,7 @@ function isStaticFragment(expression) {
 function runtimeInterpolations(template) {
   const parts = template.quasis.map((quasi) => quasi.value.cooked ?? quasi.value.raw);
   const statement = parts.join(RUNTIME_MARKER);
-  const ranges = sqlSingleQuotedRanges(statement);
-  const visible = stripSqlNoise(statement);
+  const { singleQuotedRanges: ranges, text: visible } = sqlNoiseInfo(statement);
   let offset = 0;
   return template.expressions.flatMap(
     (expression, index) => {
@@ -7583,16 +7587,13 @@ function runtimeConcatOperands(node) {
     return [];
   }
   const operands = concatOperands(node);
-  const hasStringLiteral = operands.some(
-    (operand) => operand.type === import_utils45.AST_NODE_TYPES.Literal && typeof operand.value === "string" || operand.type === import_utils45.AST_NODE_TYPES.TemplateLiteral && operand.expressions.length === 0
-  );
+  const hasStringLiteral = operands.some((operand) => staticString(operand) !== null);
   if (!hasStringLiteral) {
     return [];
   }
   const parts = operands.map((operand) => staticString(operand) ?? RUNTIME_MARKER);
   const statement = parts.join("");
-  const ranges = sqlSingleQuotedRanges(statement);
-  const visible = stripSqlNoise(statement);
+  const { singleQuotedRanges: ranges, text: visible } = sqlNoiseInfo(statement);
   let offset = 0;
   return operands.flatMap((operand, index) => {
     const inValue = ranges.some(([start, end]) => start < offset && offset < end);
@@ -7606,10 +7607,17 @@ function runtimeConcatOperands(node) {
   });
 }
 function concatOperands(node) {
-  if (node.type === import_utils45.AST_NODE_TYPES.BinaryExpression && node.operator === "+") {
-    return [...concatOperands(node.left), ...concatOperands(node.right)];
+  const operands = [];
+  const pending = [node];
+  while (pending.length > 0) {
+    const next = pending.pop();
+    if (next === void 0) continue;
+    const value = unwrapExpression(next);
+    if (value.type === import_utils45.AST_NODE_TYPES.BinaryExpression && value.operator === "+") {
+      pending.push(value.right, value.left);
+    } else operands.push(value);
   }
-  return [node];
+  return operands;
 }
 var SQL_STATEMENT_RE = /\b(?:select\s|insert\s+into\b|insert\s+or\b|update\s+\w|delete\s+from\b|replace\s+into\b|merge\s+into\b|upsert\s+into\b|create\s+(?:temp(?:orary)?\s+)?(?:table|index|view|trigger|schema|database)\b|alter\s+table\b|drop\s+(?:table|index|view|trigger)\b|truncate\s+table\b|pragma\s+\w|with\s+\w+\s+as\s*\(|from\s+\w+\s+where\b)/i;
 var RUNTIME_MARKER = " ? ";
@@ -7617,6 +7625,7 @@ function looksLikeSql(node) {
   return SQL_STATEMENT_RE.test(stripSqlNoise(staticStatementText(node)));
 }
 function staticStatementText(node) {
+  node = unwrapExpression(node);
   if (node.type === import_utils45.AST_NODE_TYPES.TemplateLiteral) {
     return node.quasis.map((quasi) => quasi.value.cooked ?? quasi.value.raw).join(RUNTIME_MARKER);
   }
@@ -8686,46 +8695,15 @@ var STRONG_SECURITY_WORDS = /* @__PURE__ */ new Set([
   "uuid",
   "verificationcode"
 ]);
-var NON_SECURITY_ID_WORDS = /* @__PURE__ */ new Set([
-  "aria",
-  "cache",
-  "component",
-  "correlation",
-  "dev",
-  "dialog",
-  "dom",
-  "element",
-  "execution",
-  "field",
-  "form",
-  "hmr",
-  "input",
-  "marker",
-  "menu",
-  "mock",
-  "perf",
-  "req",
-  "request",
-  "select",
-  "tab",
-  "temp",
-  "test",
-  "tmp",
-  "trace"
-]);
-function nameWords(name) {
-  return name.replaceAll(/([a-z0-9])([A-Z])/gu, "$1 $2").split(/[^A-Za-z0-9]+/u).filter(Boolean).map((word) => word.toLowerCase());
-}
 function isStrongSecurityName(name) {
   const words2 = nameWords(name);
   return words2.some((word) => STRONG_SECURITY_WORDS.has(word)) || words2.some(
     (word, index) => word === "api" && words2[index + 1] === "key" || word === "auth" && words2[index + 1] === "id" || word === "verification" && words2[index + 1] === "code"
   );
 }
-function isNonSecurityName(name) {
-  return nameWords(name).some((word) => NON_SECURITY_ID_WORDS.has(word));
+function nameWords(name) {
+  return name.replaceAll(/([a-z0-9])([A-Z])/gu, "$1 $2").split(/[^A-Za-z0-9]+/u).filter(Boolean).map((word) => word.toLowerCase());
 }
-var PATH_OR_DOM_MARKER = /[\\/#]|\.[A-Za-z0-9]/;
 function isMathRandomCall(node) {
   if (node.type !== "CallExpression") {
     return false;
@@ -8769,67 +8747,6 @@ function findEnclosingNames(node) {
   }
   return names;
 }
-function isConcatenatedIntoPathOrDomId(node) {
-  const valueNode = climbValueChain(node);
-  let current = valueNode;
-  let parent = current.parent;
-  let top;
-  while (parent) {
-    if (parent.type === "BinaryExpression" && parent.operator === "+" && (parent.left === current || parent.right === current)) {
-      top = parent;
-      current = parent;
-      parent = current.parent;
-      continue;
-    }
-    if (parent.type === "TemplateLiteral") {
-      top = parent;
-      current = parent;
-      parent = current.parent;
-      continue;
-    }
-    break;
-  }
-  if (!top) {
-    return false;
-  }
-  const parts = [];
-  collectStaticStringParts(top, parts);
-  return parts.some((part) => PATH_OR_DOM_MARKER.test(part));
-}
-function climbValueChain(node) {
-  let current = node;
-  let parent = current.parent;
-  while (parent) {
-    if (parent.type === "MemberExpression" && parent.object === current && import_utils51.ASTUtils.getPropertyName(parent) !== null) {
-      current = parent;
-      parent = current.parent;
-      continue;
-    }
-    if (parent.type === "CallExpression" && parent.callee === current) {
-      current = parent;
-      parent = current.parent;
-      continue;
-    }
-    break;
-  }
-  return current;
-}
-function collectStaticStringParts(node, out) {
-  if (node.type === "Literal" && typeof node.value === "string") {
-    out.push(node.value);
-    return;
-  }
-  if (node.type === "TemplateLiteral") {
-    for (const quasi of node.quasis) {
-      out.push(quasi.value.cooked ?? quasi.value.raw);
-    }
-    return;
-  }
-  if (node.type === "BinaryExpression" && node.operator === "+") {
-    collectStaticStringParts(node.left, out);
-    collectStaticStringParts(node.right, out);
-  }
-}
 var no_insecure_random_id_default = createRule({
   name: "no-insecure-random-id",
   documentation: NO_INSECURE_RANDOM_ID_DOCUMENTATION,
@@ -8857,13 +8774,6 @@ var no_insecure_random_id_default = createRule({
         const names = findEnclosingNames(node);
         if (names.some(isStrongSecurityName)) {
           context.report({ node, messageId: "insecureRandomId" });
-          return;
-        }
-        if (names.some(isNonSecurityName)) {
-          return;
-        }
-        if (isConcatenatedIntoPathOrDomId(node)) {
-          return;
         }
       }
     };
@@ -9795,15 +9705,24 @@ function typeMayContainObject(type, checker) {
 function syntaxMayContainObject(node) {
   const expression = unwrapComparisonExpression(node);
   if (expression.type === import_utils55.AST_NODE_TYPES.ObjectExpression) return true;
+  if (expression.type === import_utils55.AST_NODE_TYPES.Literal) return "regex" in expression;
+  if (expression.type === import_utils55.AST_NODE_TYPES.TemplateLiteral || expression.type === import_utils55.AST_NODE_TYPES.UnaryExpression) return false;
   if (expression.type !== import_utils55.AST_NODE_TYPES.ArrayExpression) return null;
+  let unknown = false;
   for (const element of expression.elements) {
     if (element === null) continue;
-    if (element.type === import_utils55.AST_NODE_TYPES.SpreadElement) return null;
-    if (element.type !== import_utils55.AST_NODE_TYPES.Literal && !(element.type === import_utils55.AST_NODE_TYPES.TemplateLiteral && element.expressions.length === 0)) {
-      return true;
-    }
+    const result = element.type === import_utils55.AST_NODE_TYPES.SpreadElement ? null : syntaxMayContainObject(element);
+    if (result === true) return true;
+    if (result === null) unknown = true;
   }
-  return false;
+  return unknown ? null : false;
+}
+function untypedArrayMayContainObject(node) {
+  return node.elements.some((element) => {
+    if (element === null || element.type === import_utils55.AST_NODE_TYPES.SpreadElement) return false;
+    const value = unwrapComparisonExpression(element);
+    return value.type === import_utils55.AST_NODE_TYPES.ArrayExpression ? untypedArrayMayContainObject(value) : syntaxMayContainObject(value) !== false;
+  });
 }
 var no_json_stringify_object_equality_default = createRule({
   name: "no-json-stringify-object-equality",
@@ -9832,7 +9751,10 @@ var no_json_stringify_object_equality_default = createRule({
     function mayContainObject(node) {
       const syntax = syntaxMayContainObject(node);
       if (syntax !== null) return syntax;
-      if (services === null || checker === void 0) return false;
+      if (services === null || checker === void 0) {
+        const expression = unwrapComparisonExpression(node);
+        return expression.type === import_utils55.AST_NODE_TYPES.ArrayExpression && untypedArrayMayContainObject(expression);
+      }
       const type = checker.getTypeAtLocation(
         services.esTreeNodeToTSNodeMap.get(node)
       );
@@ -27212,8 +27134,11 @@ function classMethodCounts(body2, methods) {
 }
 
 // src/rules/source-coupled-test.ts
+var import_node_path3 = require("path");
 var import_utils143 = require("@typescript-eslint/utils");
-var GENERAL_SOURCE_SUFFIX_RE = /\.(?:bash|sh|ya?ml|jsonc|toml|py|[cm]?[jt]s)$|(?<!\.(?:tf|tftest))\.json$/iu;
+var GENERAL_SOURCE_SUFFIX_RE = /\.(?:bash|sh|ya?ml|jsonc|toml|py|css|html|[cm]?[jt]s|[jt]sx)$|(?<!\.(?:tf|tftest))\.json$/iu;
+var REPRESENTATION_DIR_RE = /(?:^|\/)(?:__fixtures__|fixtures?|goldens?|snapshots?)(?:\/|$)/iu;
+var PATH_MODULES = /* @__PURE__ */ new Set(["path", "node:path"]);
 var FS_MODULES = /* @__PURE__ */ new Set(["fs", "node:fs", "fs/promises", "node:fs/promises"]);
 var FS_READERS = /* @__PURE__ */ new Set(["readFile", "readFileSync"]);
 var TEXT_TRANSFORMS = /* @__PURE__ */ new Set([
@@ -27255,11 +27180,13 @@ var ASSERT_MODULES = /* @__PURE__ */ new Set(["assert", "assert/strict", "node:a
 var SOURCE_COUPLED_TEST_DOCUMENTATION = {
   summary: "Disallow raw repository source text as a test oracle; parse or execute the artifact instead.",
   rationale: "Substring and regex checks can pass on comments or unreachable configuration and fail after behavior-preserving formatting changes.",
-  remediation: "Parse the artifact, execute its validator, or assert on another runtime contract.",
+  remediation: "Reuse adequate existing validation; otherwise assert a distinct parsed or runtime contract. Preserve deliberate representation contracts with an exact justified suppression.",
   category: "testing",
   limitations: [
-    "The rule follows stable lexical bindings, static source paths, awaited reads, and common text operations. Reassigned bindings, dynamic paths, unknown path wrappers, iterator pipelines, and interprocedural flows remain unreported.",
+    "The rule follows stable lexical bindings, static source paths including JSX/TSX, CSS and HTML, awaited reads, and common text operations. Named imports of node:path/path join and resolve are followed when their complete trailing static path proves a source suffix. Reassigned bindings, dynamic trailing segments, namespace path wrappers, unknown path wrappers, iterator pipelines, and interprocedural flows remain unreported.",
     "Assertion roots are scope-resolved for supported test runners and Node assert imports; local or unknown helpers with assertion-like names are not inferred.",
+    "Known fixture, golden, snapshot, and generated source paths are representation contracts and remain unreported; dot segments in the known path are normalized first.",
+    "Contained static paths beneath a stable native mkdtemp/mkdtempSync result are generated artifacts. Literal replace/replaceAll nonidentity guards comparing the same raw read remain unreported; fixed-string comparisons remain candidates.",
     "When raw representation is genuinely the contract (for example a golden or compatibility sentinel), use an exact line suppression with the reason."
   ],
   examples: [
@@ -27321,7 +27248,7 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
       type: "suggestion",
       docs: { description: documentation.summary },
       schema: [],
-      messages: { rawSourceOracle: "Raw repository source text is the oracle. Parse or execute the artifact so comments, formatting, and unreachable blocks cannot satisfy the contract." }
+      messages: { rawSourceOracle: "Raw repository source text is the oracle. Reuse adequate existing validation; otherwise assert a distinct parsed or runtime contract. Preserve a deliberate representation contract with an exact justified suppression." }
     },
     defaultOptions: [],
     create(context) {
@@ -27362,17 +27289,79 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
       const sourcePath = (node) => {
         const current = unwrap6(node);
         const value = stringValue(current);
-        if (value !== null) return sourceSuffixRe.test(value);
+        if (value !== null) return sourcePathValue(value);
         if (current.type === import_utils143.AST_NODE_TYPES.Identifier) return visible("paths", current);
         if (current.type === import_utils143.AST_NODE_TYPES.CallExpression || current.type === import_utils143.AST_NODE_TYPES.NewExpression) {
           const callee = unwrapExpression(current.callee);
           const first = current.arguments[0];
           if (first === void 0 || first.type === import_utils143.AST_NODE_TYPES.SpreadElement) return false;
+          const pathBuilder = callee.type === import_utils143.AST_NODE_TYPES.Identifier ? nativePathBuilder(callee) : null;
+          if (current.type === import_utils143.AST_NODE_TYPES.CallExpression && pathBuilder !== null) {
+            if (temporaryDescendant(current, pathBuilder)) return false;
+            const trailing = [];
+            for (const argument of current.arguments.toReversed()) {
+              if (argument.type === import_utils143.AST_NODE_TYPES.SpreadElement) return false;
+              const segment = stringValue(argument);
+              if (segment === null) break;
+              trailing.unshift(segment);
+              if (pathBuilder === "resolve" && import_node_path3.posix.isAbsolute(segment.replaceAll("\\", "/"))) break;
+            }
+            return trailing.length > 0 && sourcePathValue(trailing.join("/"));
+          }
           if (current.type === import_utils143.AST_NODE_TYPES.NewExpression && callee.type === import_utils143.AST_NODE_TYPES.Identifier && callee.name === "URL" && (bindingOf(callee)?.defs.length ?? 0) === 0) return sourcePath(first);
           if (callee.type === import_utils143.AST_NODE_TYPES.Identifier && bindingOf(callee)?.defs.some((definition) => definition.node.type === import_utils143.AST_NODE_TYPES.ImportSpecifier && definition.node.imported.type === import_utils143.AST_NODE_TYPES.Identifier && definition.node.imported.name === "fileURLToPath" && definition.node.parent.type === import_utils143.AST_NODE_TYPES.ImportDeclaration && ["node:url", "url"].includes(String(definition.node.parent.source.value)))) return sourcePath(first);
         }
         return false;
       };
+      const nativePathBuilder = (node) => {
+        const imported = nativeImportedName(node, PATH_MODULES);
+        return imported === "join" || imported === "resolve" ? imported : null;
+      };
+      const nativeImportedName = (node, modules) => {
+        const binding = bindingOf(node);
+        if (binding === null || binding.references.some((reference) => reference.isWrite() && reference.init !== true)) return null;
+        for (const definition of binding.defs) {
+          const imported = definition.node;
+          if (imported.type === import_utils143.AST_NODE_TYPES.ImportSpecifier && imported.imported.type === import_utils143.AST_NODE_TYPES.Identifier && imported.parent.type === import_utils143.AST_NODE_TYPES.ImportDeclaration && modules.has(String(imported.parent.source.value))) {
+            return imported.imported.name;
+          }
+        }
+        return null;
+      };
+      const stableInitializer = (node) => {
+        const binding = bindingOf(node);
+        if (binding === null || binding.references.some((reference) => reference.isWrite() && reference.init !== true) || binding.defs.length !== 1) return null;
+        const definition = binding.defs[0]?.node;
+        return definition?.type === import_utils143.AST_NODE_TYPES.VariableDeclarator ? definition.init : null;
+      };
+      const temporaryDirectory = (node, depth = 0) => {
+        if (depth > 8) return false;
+        const current = unwrap6(node);
+        if (current.type === import_utils143.AST_NODE_TYPES.Identifier) {
+          const initializer = stableInitializer(current);
+          return initializer !== null && temporaryDirectory(initializer, depth + 1);
+        }
+        if (current.type !== import_utils143.AST_NODE_TYPES.CallExpression) return false;
+        const callee = unwrap6(current.callee);
+        return callee.type === import_utils143.AST_NODE_TYPES.Identifier && ["mkdtemp", "mkdtempSync"].includes(nativeImportedName(callee, FS_MODULES) ?? "");
+      };
+      const temporaryDescendant = (node, builder) => {
+        const [directory, ...segments] = node.arguments;
+        if (directory === void 0 || directory.type === import_utils143.AST_NODE_TYPES.SpreadElement || !temporaryDirectory(directory)) return false;
+        const values = [];
+        for (const segment of segments) {
+          if (segment.type === import_utils143.AST_NODE_TYPES.SpreadElement) return false;
+          const value = stringValue(segment);
+          if (value === null) return false;
+          values.push(value.replaceAll("\\", "/"));
+        }
+        const sentinel = "/__source_oracle_temporary_directory__";
+        return import_node_path3.posix[builder](sentinel, ...values).startsWith(`${sentinel}/`);
+      };
+      const sourcePathValue = (value) => {
+        const normalized = import_node_path3.posix.normalize(value.replaceAll("\\", "/"));
+        return sourceSuffixRe.test(normalized) && !REPRESENTATION_DIR_RE.test(normalized) && !isGeneratedFile(normalized);
+      };
       const rawRead = (node) => {
         const current = unwrap6(node);
         if (current.type !== import_utils143.AST_NODE_TYPES.CallExpression || current.arguments.length === 0) return false;
@@ -27414,6 +27403,26 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         if (name2 !== null && REGEXP_PREDICATES.has(name2)) return new Set(current.arguments.flatMap((argument) => argument.type === import_utils143.AST_NODE_TYPES.SpreadElement ? [] : [...rawOrigins(argument)]));
         return /* @__PURE__ */ new Set();
       };
+      const literalMutation = (node, depth = 0) => {
+        if (depth > 8) return false;
+        const current = unwrap6(node);
+        if (current.type === import_utils143.AST_NODE_TYPES.Identifier) {
+          const initializer = stableInitializer(current);
+          return initializer !== null && literalMutation(initializer, depth + 1);
+        }
+        if (current.type !== import_utils143.AST_NODE_TYPES.CallExpression || current.arguments.length !== 2) return false;
+        const callee = unwrap6(current.callee);
+        const [pattern, replacement] = current.arguments;
+        return callee.type === import_utils143.AST_NODE_TYPES.MemberExpression && ["replace", "replaceAll"].includes(import_utils143.ASTUtils.getPropertyName(callee) ?? "") && pattern !== void 0 && replacement !== void 0 && pattern.type !== import_utils143.AST_NODE_TYPES.SpreadElement && replacement.type !== import_utils143.AST_NODE_TYPES.SpreadElement && (stringValue(pattern) !== null || pattern.type === import_utils143.AST_NODE_TYPES.Literal && "regex" in pattern) && stringValue(replacement) !== null;
+      };
+      const mutationGuard = (operands) => {
+        if (operands.length !== 2) return false;
+        const [left, right] = operands;
+        if (left === void 0 || right === void 0 || left.type === import_utils143.AST_NODE_TYPES.SpreadElement || right.type === import_utils143.AST_NODE_TYPES.SpreadElement || !literalMutation(left) && !literalMutation(right)) return false;
+        const leftOrigins = rawOrigins(left);
+        const rightOrigins = rawOrigins(right);
+        return leftOrigins.size > 0 && leftOrigins.size === rightOrigins.size && [...leftOrigins].every((origin) => rightOrigins.has(origin));
+      };
       const rawAssertionOrigins = (node) => {
         const callee = unwrap6(node.callee);
         const calleeReceiver = callee.type === import_utils143.AST_NODE_TYPES.MemberExpression ? unwrapExpression(callee.object) : callee;
@@ -27428,9 +27437,11 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         const expectCallee = receiver.type === import_utils143.AST_NODE_TYPES.CallExpression ? unwrapExpression(receiver.callee) : null;
         if (receiver.type === import_utils143.AST_NODE_TYPES.CallExpression && expectCallee?.type === import_utils143.AST_NODE_TYPES.Identifier && assertionKind(expectCallee) === "expect") {
           if (!EXPECT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
+          if (["toBe", "toEqual", "toStrictEqual"].includes(matcher) && calleeReceiver.type === import_utils143.AST_NODE_TYPES.MemberExpression && import_utils143.ASTUtils.getPropertyName(calleeReceiver) === "not" && mutationGuard([...receiver.arguments, ...node.arguments])) return /* @__PURE__ */ new Set();
           return new Set([...receiver.arguments, ...node.arguments].flatMap((argument) => argument.type === import_utils143.AST_NODE_TYPES.SpreadElement ? [] : [...evidenceOrigins(argument)]));
         }
         if (receiver.type !== import_utils143.AST_NODE_TYPES.Identifier || assertionKind(receiver) !== "assert" || !ASSERT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
+        if (["notEqual", "notStrictEqual"].includes(matcher) && mutationGuard(node.arguments)) return /* @__PURE__ */ new Set();
         return new Set(node.arguments.flatMap((argument) => argument.type === import_utils143.AST_NODE_TYPES.SpreadElement ? [] : [...evidenceOrigins(argument)]));
       };
       const declare = (node, state) => {
@@ -27543,7 +27554,7 @@ var import_utils144 = require("@typescript-eslint/utils");
 
 // src/rules/_is-framework-entrypoint.ts
 var import_node_fs2 = require("fs");
-var import_node_path3 = require("path");
+var import_node_path4 = require("path");
 var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]);
 var NEXT_COMPONENT = /^(?:src\/)?app\/(?:.*\/)?(?:page|layout|loading|not-found|template|error|global-error|default|forbidden|unauthorized)\.[jt]sx?$/u;
 var NEXT_METADATA = /^(?:src\/)?app\/(?:.*\/)?(?:(?:opengraph-image|twitter-image|icon|apple-icon)\.[jt]sx?|(?:robots|sitemap|manifest)\.[jt]s)$/u;
@@ -27553,7 +27564,7 @@ function isFrameworkEntrypoint(filename, exportKey) {
   if (!/(?:^|\/)(?:app|pages)\/|(?:^|\/)(?:middleware|proxy|instrumentation)\.[jt]s$/u.test(normalized)) return false;
   const owner = packageOwner(normalized);
   if (owner === null) return false;
-  const path = (0, import_node_path3.relative)(owner.root, normalized).replaceAll("\\", "/");
+  const path = (0, import_node_path4.relative)(owner.root, normalized).replaceAll("\\", "/");
   if (declaresFramework(owner.metadata, "next") && isNextEntrypoint(path, exportKey)) return true;
   return declaresFramework(owner.metadata, "astro") && isAstroEntrypoint(path, exportKey);
 }
@@ -27575,14 +27586,14 @@ function isAstroEntrypoint(path, exportKey) {
   );
 }
 function packageOwner(filename) {
-  let root = (0, import_node_path3.dirname)(filename);
+  let root = (0, import_node_path4.dirname)(filename);
   while (true) {
     try {
-      return { root, metadata: JSON.parse((0, import_node_fs2.readFileSync)((0, import_node_path3.join)(root, "package.json"), "utf8")) };
+      return { root, metadata: JSON.parse((0, import_node_fs2.readFileSync)((0, import_node_path4.join)(root, "package.json"), "utf8")) };
     } catch (error) {
       if (typeof error !== "object" || error === null || !("code" in error) || error.code !== "ENOENT") return null;
     }
-    const parent = (0, import_node_path3.dirname)(root);
+    const parent = (0, import_node_path4.dirname)(root);
     if (parent === root) return null;
     root = parent;
   }
@@ -27671,10 +27682,11 @@ var IAC_SOURCE_SUFFIX_RE = /(?:\.tf\.json|\.tftest\.(?:hcl|json)|\.(?:hcl|tf|tfv
 var IAC_SOURCE_COUPLED_TEST_DOCUMENTATION = {
   summary: "Disallow raw IaC source text as a test oracle; inspect a rendered plan, provider state, or runtime behavior.",
   rationale: "Substring and regex checks can pass on comments, formatting, or unreachable Terraform configuration while clients fail silently.",
-  remediation: "Parse rendered plan JSON, query the provider, or exercise the deployed runtime contract.",
+  remediation: "Reuse adequate existing validation; otherwise assert a distinct rendered-plan, provider-state, or runtime contract. Preserve deliberate representation contracts with an exact justified suppression.",
   category: "testing",
   limitations: [
-    "The rule follows stable lexical bindings and static source paths. Reassigned bindings, dynamic paths, unknown path wrappers, iterator pipelines, and interprocedural flows remain unreported.",
+    "The rule follows stable lexical bindings and static source paths, including named node:path/path join and resolve imports with a complete trailing static path. Reassigned bindings, dynamic trailing paths, namespace or unknown path wrappers, iterator pipelines, and interprocedural flows remain unreported.",
+    "Known fixture, golden, snapshot, and generated source paths remain unreported after dot-segment normalization, as do contained static paths beneath stable native temporary directories and literal mutation nonidentity guards comparing the same read.",
     "When raw representation is genuinely the contract, use an exact line suppression explaining that contract."
   ],
   examples: [