@sarj/eslint-plugin 16.22.1 → 16.22.3

package/dist/index.cjs

@@ -866,7 +866,7 @@ function isSearchParamReceiver(call, services) {
 // package.json
 var package_default = {
   name: "@sarj/eslint-plugin",
-  version: "16.22.1",
+  version: "16.22.3",
   packageManager: "npm@12.2.0",
   description: "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   type: "module",
@@ -27134,8 +27134,11 @@ function classMethodCounts(body2, methods) {
 }
 
 // src/rules/source-coupled-test.ts
+var import_node_path3 = require("path");
 var import_utils143 = require("@typescript-eslint/utils");
-var GENERAL_SOURCE_SUFFIX_RE = /\.(?:bash|sh|ya?ml|jsonc|toml|py|[cm]?[jt]s)$|(?<!\.(?:tf|tftest))\.json$/iu;
+var GENERAL_SOURCE_SUFFIX_RE = /\.(?:bash|sh|ya?ml|jsonc|toml|py|css|html|[cm]?[jt]s|[jt]sx)$|(?<!\.(?:tf|tftest))\.json$/iu;
+var REPRESENTATION_DIR_RE = /(?:^|\/)(?:__fixtures__|fixtures?|goldens?|snapshots?)(?:\/|$)/iu;
+var PATH_MODULES = /* @__PURE__ */ new Set(["path", "node:path"]);
 var FS_MODULES = /* @__PURE__ */ new Set(["fs", "node:fs", "fs/promises", "node:fs/promises"]);
 var FS_READERS = /* @__PURE__ */ new Set(["readFile", "readFileSync"]);
 var TEXT_TRANSFORMS = /* @__PURE__ */ new Set([
@@ -27177,11 +27180,13 @@ var ASSERT_MODULES = /* @__PURE__ */ new Set(["assert", "assert/strict", "node:a
 var SOURCE_COUPLED_TEST_DOCUMENTATION = {
   summary: "Disallow raw repository source text as a test oracle; parse or execute the artifact instead.",
   rationale: "Substring and regex checks can pass on comments or unreachable configuration and fail after behavior-preserving formatting changes.",
-  remediation: "Parse the artifact, execute its validator, or assert on another runtime contract.",
+  remediation: "Reuse adequate existing validation; otherwise assert a distinct parsed or runtime contract. Preserve deliberate representation contracts with an exact justified suppression.",
   category: "testing",
   limitations: [
-    "The rule follows stable lexical bindings, static source paths, awaited reads, and common text operations. Reassigned bindings, dynamic paths, unknown path wrappers, iterator pipelines, and interprocedural flows remain unreported.",
+    "The rule follows stable lexical bindings, static source paths including JSX/TSX, CSS and HTML, awaited reads, and common text operations. Named imports of node:path/path join and resolve are followed when their complete trailing static path proves a source suffix. Reassigned bindings, dynamic trailing segments, namespace path wrappers, unknown path wrappers, iterator pipelines, and interprocedural flows remain unreported.",
     "Assertion roots are scope-resolved for supported test runners and Node assert imports; local or unknown helpers with assertion-like names are not inferred.",
+    "Known fixture, golden, snapshot, and generated source paths are representation contracts and remain unreported; dot segments in the known path are normalized first.",
+    "Contained static paths beneath a stable native mkdtemp/mkdtempSync result are generated artifacts. Literal replace/replaceAll nonidentity guards comparing the same raw read remain unreported; fixed-string comparisons remain candidates.",
     "When raw representation is genuinely the contract (for example a golden or compatibility sentinel), use an exact line suppression with the reason."
   ],
   examples: [
@@ -27224,6 +27229,17 @@ function stringValue(node) {
   }
   return null;
 }
+function staticPathSuffix(pathArguments, builder) {
+  const trailing = [];
+  for (const argument of pathArguments.toReversed()) {
+    if (argument.type === import_utils143.AST_NODE_TYPES.SpreadElement) return null;
+    const segment = stringValue(argument);
+    if (segment === null) break;
+    trailing.unshift(segment);
+    if (builder === "resolve" && import_node_path3.posix.isAbsolute(segment.replaceAll("\\", "/"))) break;
+  }
+  return trailing.length > 0 ? trailing.join("/") : null;
+}
 function importSource(node) {
   return typeof node.source.value === "string" ? node.source.value : null;
 }
@@ -27243,7 +27259,7 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
       type: "suggestion",
       docs: { description: documentation.summary },
       schema: [],
-      messages: { rawSourceOracle: "Raw repository source text is the oracle. Parse or execute the artifact so comments, formatting, and unreachable blocks cannot satisfy the contract." }
+      messages: { rawSourceOracle: "Raw repository source text is the oracle. Reuse adequate existing validation; otherwise assert a distinct parsed or runtime contract. Preserve a deliberate representation contract with an exact justified suppression." }
     },
     defaultOptions: [],
     create(context) {
@@ -27284,17 +27300,71 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
       const sourcePath = (node) => {
         const current = unwrap6(node);
         const value = stringValue(current);
-        if (value !== null) return sourceSuffixRe.test(value);
+        if (value !== null) return sourcePathValue(value);
         if (current.type === import_utils143.AST_NODE_TYPES.Identifier) return visible("paths", current);
-        if (current.type === import_utils143.AST_NODE_TYPES.CallExpression || current.type === import_utils143.AST_NODE_TYPES.NewExpression) {
-          const callee = unwrapExpression(current.callee);
-          const first = current.arguments[0];
-          if (first === void 0 || first.type === import_utils143.AST_NODE_TYPES.SpreadElement) return false;
-          if (current.type === import_utils143.AST_NODE_TYPES.NewExpression && callee.type === import_utils143.AST_NODE_TYPES.Identifier && callee.name === "URL" && (bindingOf(callee)?.defs.length ?? 0) === 0) return sourcePath(first);
-          if (callee.type === import_utils143.AST_NODE_TYPES.Identifier && bindingOf(callee)?.defs.some((definition) => definition.node.type === import_utils143.AST_NODE_TYPES.ImportSpecifier && definition.node.imported.type === import_utils143.AST_NODE_TYPES.Identifier && definition.node.imported.name === "fileURLToPath" && definition.node.parent.type === import_utils143.AST_NODE_TYPES.ImportDeclaration && ["node:url", "url"].includes(String(definition.node.parent.source.value)))) return sourcePath(first);
-        }
+        if (current.type !== import_utils143.AST_NODE_TYPES.CallExpression && current.type !== import_utils143.AST_NODE_TYPES.NewExpression) return false;
+        const callee = unwrapExpression(current.callee);
+        const first = current.arguments[0];
+        if (first === void 0 || first.type === import_utils143.AST_NODE_TYPES.SpreadElement) return false;
+        const pathBuilder = callee.type === import_utils143.AST_NODE_TYPES.Identifier ? nativePathBuilder(callee) : null;
+        if (current.type === import_utils143.AST_NODE_TYPES.CallExpression && pathBuilder !== null) {
+          if (temporaryDescendant(current, pathBuilder)) return false;
+          const suffix = staticPathSuffix(current.arguments, pathBuilder);
+          return suffix !== null && sourcePathValue(suffix);
+        }
+        if (current.type === import_utils143.AST_NODE_TYPES.NewExpression && callee.type === import_utils143.AST_NODE_TYPES.Identifier && callee.name === "URL" && (bindingOf(callee)?.defs.length ?? 0) === 0) return sourcePath(first);
+        if (callee.type === import_utils143.AST_NODE_TYPES.Identifier && bindingOf(callee)?.defs.some((definition) => definition.node.type === import_utils143.AST_NODE_TYPES.ImportSpecifier && definition.node.imported.type === import_utils143.AST_NODE_TYPES.Identifier && definition.node.imported.name === "fileURLToPath" && definition.node.parent.type === import_utils143.AST_NODE_TYPES.ImportDeclaration && ["node:url", "url"].includes(String(definition.node.parent.source.value)))) return sourcePath(first);
         return false;
       };
+      const nativePathBuilder = (node) => {
+        const imported = nativeImportedName(node, PATH_MODULES);
+        return imported === "join" || imported === "resolve" ? imported : null;
+      };
+      const nativeImportedName = (node, modules) => {
+        const binding = bindingOf(node);
+        if (binding === null || binding.references.some((reference) => reference.isWrite() && reference.init !== true)) return null;
+        for (const definition of binding.defs) {
+          const imported = definition.node;
+          if (imported.type === import_utils143.AST_NODE_TYPES.ImportSpecifier && imported.imported.type === import_utils143.AST_NODE_TYPES.Identifier && imported.parent.type === import_utils143.AST_NODE_TYPES.ImportDeclaration && modules.has(String(imported.parent.source.value))) {
+            return imported.imported.name;
+          }
+        }
+        return null;
+      };
+      const stableInitializer = (node) => {
+        const binding = bindingOf(node);
+        if (binding === null || binding.references.some((reference) => reference.isWrite() && reference.init !== true) || binding.defs.length !== 1) return null;
+        const definition = binding.defs[0]?.node;
+        return definition?.type === import_utils143.AST_NODE_TYPES.VariableDeclarator ? definition.init : null;
+      };
+      const temporaryDirectory = (node, depth = 0) => {
+        if (depth > 8) return false;
+        const current = unwrap6(node);
+        if (current.type === import_utils143.AST_NODE_TYPES.Identifier) {
+          const initializer = stableInitializer(current);
+          return initializer !== null && temporaryDirectory(initializer, depth + 1);
+        }
+        if (current.type !== import_utils143.AST_NODE_TYPES.CallExpression) return false;
+        const callee = unwrap6(current.callee);
+        return callee.type === import_utils143.AST_NODE_TYPES.Identifier && ["mkdtemp", "mkdtempSync"].includes(nativeImportedName(callee, FS_MODULES) ?? "");
+      };
+      const temporaryDescendant = (node, builder) => {
+        const [directory, ...segments] = node.arguments;
+        if (directory === void 0 || directory.type === import_utils143.AST_NODE_TYPES.SpreadElement || !temporaryDirectory(directory)) return false;
+        const values = [];
+        for (const segment of segments) {
+          if (segment.type === import_utils143.AST_NODE_TYPES.SpreadElement) return false;
+          const value = stringValue(segment);
+          if (value === null) return false;
+          values.push(value.replaceAll("\\", "/"));
+        }
+        const sentinel = "/__source_oracle_temporary_directory__";
+        return import_node_path3.posix[builder](sentinel, ...values).startsWith(`${sentinel}/`);
+      };
+      const sourcePathValue = (value) => {
+        const normalized = import_node_path3.posix.normalize(value.replaceAll("\\", "/"));
+        return sourceSuffixRe.test(normalized) && !REPRESENTATION_DIR_RE.test(normalized) && !isGeneratedFile(normalized);
+      };
       const rawRead = (node) => {
         const current = unwrap6(node);
         if (current.type !== import_utils143.AST_NODE_TYPES.CallExpression || current.arguments.length === 0) return false;
@@ -27336,6 +27406,26 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         if (name2 !== null && REGEXP_PREDICATES.has(name2)) return new Set(current.arguments.flatMap((argument) => argument.type === import_utils143.AST_NODE_TYPES.SpreadElement ? [] : [...rawOrigins(argument)]));
         return /* @__PURE__ */ new Set();
       };
+      const literalMutation = (node, depth = 0) => {
+        if (depth > 8) return false;
+        const current = unwrap6(node);
+        if (current.type === import_utils143.AST_NODE_TYPES.Identifier) {
+          const initializer = stableInitializer(current);
+          return initializer !== null && literalMutation(initializer, depth + 1);
+        }
+        if (current.type !== import_utils143.AST_NODE_TYPES.CallExpression || current.arguments.length !== 2) return false;
+        const callee = unwrap6(current.callee);
+        const [pattern, replacement] = current.arguments;
+        return callee.type === import_utils143.AST_NODE_TYPES.MemberExpression && ["replace", "replaceAll"].includes(import_utils143.ASTUtils.getPropertyName(callee) ?? "") && pattern !== void 0 && replacement !== void 0 && pattern.type !== import_utils143.AST_NODE_TYPES.SpreadElement && replacement.type !== import_utils143.AST_NODE_TYPES.SpreadElement && (stringValue(pattern) !== null || pattern.type === import_utils143.AST_NODE_TYPES.Literal && "regex" in pattern) && stringValue(replacement) !== null;
+      };
+      const mutationGuard = (operands) => {
+        if (operands.length !== 2) return false;
+        const [left, right] = operands;
+        if (left === void 0 || right === void 0 || left.type === import_utils143.AST_NODE_TYPES.SpreadElement || right.type === import_utils143.AST_NODE_TYPES.SpreadElement || !literalMutation(left) && !literalMutation(right)) return false;
+        const leftOrigins = rawOrigins(left);
+        const rightOrigins = rawOrigins(right);
+        return leftOrigins.size > 0 && leftOrigins.size === rightOrigins.size && [...leftOrigins].every((origin) => rightOrigins.has(origin));
+      };
       const rawAssertionOrigins = (node) => {
         const callee = unwrap6(node.callee);
         const calleeReceiver = callee.type === import_utils143.AST_NODE_TYPES.MemberExpression ? unwrapExpression(callee.object) : callee;
@@ -27350,9 +27440,11 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         const expectCallee = receiver.type === import_utils143.AST_NODE_TYPES.CallExpression ? unwrapExpression(receiver.callee) : null;
         if (receiver.type === import_utils143.AST_NODE_TYPES.CallExpression && expectCallee?.type === import_utils143.AST_NODE_TYPES.Identifier && assertionKind(expectCallee) === "expect") {
           if (!EXPECT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
+          if (["toBe", "toEqual", "toStrictEqual"].includes(matcher) && calleeReceiver.type === import_utils143.AST_NODE_TYPES.MemberExpression && import_utils143.ASTUtils.getPropertyName(calleeReceiver) === "not" && mutationGuard([...receiver.arguments, ...node.arguments])) return /* @__PURE__ */ new Set();
           return new Set([...receiver.arguments, ...node.arguments].flatMap((argument) => argument.type === import_utils143.AST_NODE_TYPES.SpreadElement ? [] : [...evidenceOrigins(argument)]));
         }
         if (receiver.type !== import_utils143.AST_NODE_TYPES.Identifier || assertionKind(receiver) !== "assert" || !ASSERT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
+        if (["notEqual", "notStrictEqual"].includes(matcher) && mutationGuard(node.arguments)) return /* @__PURE__ */ new Set();
         return new Set(node.arguments.flatMap((argument) => argument.type === import_utils143.AST_NODE_TYPES.SpreadElement ? [] : [...evidenceOrigins(argument)]));
       };
       const declare = (node, state) => {
@@ -27465,7 +27557,7 @@ var import_utils144 = require("@typescript-eslint/utils");
 
 // src/rules/_is-framework-entrypoint.ts
 var import_node_fs2 = require("fs");
-var import_node_path3 = require("path");
+var import_node_path4 = require("path");
 var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]);
 var NEXT_COMPONENT = /^(?:src\/)?app\/(?:.*\/)?(?:page|layout|loading|not-found|template|error|global-error|default|forbidden|unauthorized)\.[jt]sx?$/u;
 var NEXT_METADATA = /^(?:src\/)?app\/(?:.*\/)?(?:(?:opengraph-image|twitter-image|icon|apple-icon)\.[jt]sx?|(?:robots|sitemap|manifest)\.[jt]s)$/u;
@@ -27475,7 +27567,7 @@ function isFrameworkEntrypoint(filename, exportKey) {
   if (!/(?:^|\/)(?:app|pages)\/|(?:^|\/)(?:middleware|proxy|instrumentation)\.[jt]s$/u.test(normalized)) return false;
   const owner = packageOwner(normalized);
   if (owner === null) return false;
-  const path = (0, import_node_path3.relative)(owner.root, normalized).replaceAll("\\", "/");
+  const path = (0, import_node_path4.relative)(owner.root, normalized).replaceAll("\\", "/");
   if (declaresFramework(owner.metadata, "next") && isNextEntrypoint(path, exportKey)) return true;
   return declaresFramework(owner.metadata, "astro") && isAstroEntrypoint(path, exportKey);
 }
@@ -27497,14 +27589,14 @@ function isAstroEntrypoint(path, exportKey) {
   );
 }
 function packageOwner(filename) {
-  let root = (0, import_node_path3.dirname)(filename);
+  let root = (0, import_node_path4.dirname)(filename);
   while (true) {
     try {
-      return { root, metadata: JSON.parse((0, import_node_fs2.readFileSync)((0, import_node_path3.join)(root, "package.json"), "utf8")) };
+      return { root, metadata: JSON.parse((0, import_node_fs2.readFileSync)((0, import_node_path4.join)(root, "package.json"), "utf8")) };
     } catch (error) {
       if (typeof error !== "object" || error === null || !("code" in error) || error.code !== "ENOENT") return null;
     }
-    const parent = (0, import_node_path3.dirname)(root);
+    const parent = (0, import_node_path4.dirname)(root);
     if (parent === root) return null;
     root = parent;
   }
@@ -27593,10 +27685,11 @@ var IAC_SOURCE_SUFFIX_RE = /(?:\.tf\.json|\.tftest\.(?:hcl|json)|\.(?:hcl|tf|tfv
 var IAC_SOURCE_COUPLED_TEST_DOCUMENTATION = {
   summary: "Disallow raw IaC source text as a test oracle; inspect a rendered plan, provider state, or runtime behavior.",
   rationale: "Substring and regex checks can pass on comments, formatting, or unreachable Terraform configuration while clients fail silently.",
-  remediation: "Parse rendered plan JSON, query the provider, or exercise the deployed runtime contract.",
+  remediation: "Reuse adequate existing validation; otherwise assert a distinct rendered-plan, provider-state, or runtime contract. Preserve deliberate representation contracts with an exact justified suppression.",
   category: "testing",
   limitations: [
-    "The rule follows stable lexical bindings and static source paths. Reassigned bindings, dynamic paths, unknown path wrappers, iterator pipelines, and interprocedural flows remain unreported.",
+    "The rule follows stable lexical bindings and static source paths, including named node:path/path join and resolve imports with a complete trailing static path. Reassigned bindings, dynamic trailing paths, namespace or unknown path wrappers, iterator pipelines, and interprocedural flows remain unreported.",
+    "Known fixture, golden, snapshot, and generated source paths remain unreported after dot-segment normalization, as do contained static paths beneath stable native temporary directories and literal mutation nonidentity guards comparing the same read.",
     "When raw representation is genuinely the contract, use an exact line suppression explaining that contract."
   ],
   examples: [

package/dist/index.js

@@ -819,7 +819,7 @@ function isSearchParamReceiver(call, services) {
 // package.json
 var package_default = {
   name: "@sarj/eslint-plugin",
-  version: "16.22.1",
+  version: "16.22.3",
   packageManager: "npm@12.2.0",
   description: "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   type: "module",
@@ -27158,8 +27158,11 @@ function classMethodCounts(body2, methods) {
 }
 
 // src/rules/source-coupled-test.ts
+import { posix as posix2 } from "path";
 import { AST_NODE_TYPES as AST_NODE_TYPES122, ASTUtils as ASTUtils81 } from "@typescript-eslint/utils";
-var GENERAL_SOURCE_SUFFIX_RE = /\.(?:bash|sh|ya?ml|jsonc|toml|py|[cm]?[jt]s)$|(?<!\.(?:tf|tftest))\.json$/iu;
+var GENERAL_SOURCE_SUFFIX_RE = /\.(?:bash|sh|ya?ml|jsonc|toml|py|css|html|[cm]?[jt]s|[jt]sx)$|(?<!\.(?:tf|tftest))\.json$/iu;
+var REPRESENTATION_DIR_RE = /(?:^|\/)(?:__fixtures__|fixtures?|goldens?|snapshots?)(?:\/|$)/iu;
+var PATH_MODULES = /* @__PURE__ */ new Set(["path", "node:path"]);
 var FS_MODULES = /* @__PURE__ */ new Set(["fs", "node:fs", "fs/promises", "node:fs/promises"]);
 var FS_READERS = /* @__PURE__ */ new Set(["readFile", "readFileSync"]);
 var TEXT_TRANSFORMS = /* @__PURE__ */ new Set([
@@ -27201,11 +27204,13 @@ var ASSERT_MODULES = /* @__PURE__ */ new Set(["assert", "assert/strict", "node:a
 var SOURCE_COUPLED_TEST_DOCUMENTATION = {
   summary: "Disallow raw repository source text as a test oracle; parse or execute the artifact instead.",
   rationale: "Substring and regex checks can pass on comments or unreachable configuration and fail after behavior-preserving formatting changes.",
-  remediation: "Parse the artifact, execute its validator, or assert on another runtime contract.",
+  remediation: "Reuse adequate existing validation; otherwise assert a distinct parsed or runtime contract. Preserve deliberate representation contracts with an exact justified suppression.",
   category: "testing",
   limitations: [
-    "The rule follows stable lexical bindings, static source paths, awaited reads, and common text operations. Reassigned bindings, dynamic paths, unknown path wrappers, iterator pipelines, and interprocedural flows remain unreported.",
+    "The rule follows stable lexical bindings, static source paths including JSX/TSX, CSS and HTML, awaited reads, and common text operations. Named imports of node:path/path join and resolve are followed when their complete trailing static path proves a source suffix. Reassigned bindings, dynamic trailing segments, namespace path wrappers, unknown path wrappers, iterator pipelines, and interprocedural flows remain unreported.",
     "Assertion roots are scope-resolved for supported test runners and Node assert imports; local or unknown helpers with assertion-like names are not inferred.",
+    "Known fixture, golden, snapshot, and generated source paths are representation contracts and remain unreported; dot segments in the known path are normalized first.",
+    "Contained static paths beneath a stable native mkdtemp/mkdtempSync result are generated artifacts. Literal replace/replaceAll nonidentity guards comparing the same raw read remain unreported; fixed-string comparisons remain candidates.",
     "When raw representation is genuinely the contract (for example a golden or compatibility sentinel), use an exact line suppression with the reason."
   ],
   examples: [
@@ -27248,6 +27253,17 @@ function stringValue(node) {
   }
   return null;
 }
+function staticPathSuffix(pathArguments, builder) {
+  const trailing = [];
+  for (const argument of pathArguments.toReversed()) {
+    if (argument.type === AST_NODE_TYPES122.SpreadElement) return null;
+    const segment = stringValue(argument);
+    if (segment === null) break;
+    trailing.unshift(segment);
+    if (builder === "resolve" && posix2.isAbsolute(segment.replaceAll("\\", "/"))) break;
+  }
+  return trailing.length > 0 ? trailing.join("/") : null;
+}
 function importSource(node) {
   return typeof node.source.value === "string" ? node.source.value : null;
 }
@@ -27267,7 +27283,7 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
       type: "suggestion",
       docs: { description: documentation.summary },
       schema: [],
-      messages: { rawSourceOracle: "Raw repository source text is the oracle. Parse or execute the artifact so comments, formatting, and unreachable blocks cannot satisfy the contract." }
+      messages: { rawSourceOracle: "Raw repository source text is the oracle. Reuse adequate existing validation; otherwise assert a distinct parsed or runtime contract. Preserve a deliberate representation contract with an exact justified suppression." }
     },
     defaultOptions: [],
     create(context) {
@@ -27308,17 +27324,71 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
       const sourcePath = (node) => {
         const current = unwrap6(node);
         const value = stringValue(current);
-        if (value !== null) return sourceSuffixRe.test(value);
+        if (value !== null) return sourcePathValue(value);
         if (current.type === AST_NODE_TYPES122.Identifier) return visible("paths", current);
-        if (current.type === AST_NODE_TYPES122.CallExpression || current.type === AST_NODE_TYPES122.NewExpression) {
-          const callee = unwrapExpression(current.callee);
-          const first = current.arguments[0];
-          if (first === void 0 || first.type === AST_NODE_TYPES122.SpreadElement) return false;
-          if (current.type === AST_NODE_TYPES122.NewExpression && callee.type === AST_NODE_TYPES122.Identifier && callee.name === "URL" && (bindingOf(callee)?.defs.length ?? 0) === 0) return sourcePath(first);
-          if (callee.type === AST_NODE_TYPES122.Identifier && bindingOf(callee)?.defs.some((definition) => definition.node.type === AST_NODE_TYPES122.ImportSpecifier && definition.node.imported.type === AST_NODE_TYPES122.Identifier && definition.node.imported.name === "fileURLToPath" && definition.node.parent.type === AST_NODE_TYPES122.ImportDeclaration && ["node:url", "url"].includes(String(definition.node.parent.source.value)))) return sourcePath(first);
-        }
+        if (current.type !== AST_NODE_TYPES122.CallExpression && current.type !== AST_NODE_TYPES122.NewExpression) return false;
+        const callee = unwrapExpression(current.callee);
+        const first = current.arguments[0];
+        if (first === void 0 || first.type === AST_NODE_TYPES122.SpreadElement) return false;
+        const pathBuilder = callee.type === AST_NODE_TYPES122.Identifier ? nativePathBuilder(callee) : null;
+        if (current.type === AST_NODE_TYPES122.CallExpression && pathBuilder !== null) {
+          if (temporaryDescendant(current, pathBuilder)) return false;
+          const suffix = staticPathSuffix(current.arguments, pathBuilder);
+          return suffix !== null && sourcePathValue(suffix);
+        }
+        if (current.type === AST_NODE_TYPES122.NewExpression && callee.type === AST_NODE_TYPES122.Identifier && callee.name === "URL" && (bindingOf(callee)?.defs.length ?? 0) === 0) return sourcePath(first);
+        if (callee.type === AST_NODE_TYPES122.Identifier && bindingOf(callee)?.defs.some((definition) => definition.node.type === AST_NODE_TYPES122.ImportSpecifier && definition.node.imported.type === AST_NODE_TYPES122.Identifier && definition.node.imported.name === "fileURLToPath" && definition.node.parent.type === AST_NODE_TYPES122.ImportDeclaration && ["node:url", "url"].includes(String(definition.node.parent.source.value)))) return sourcePath(first);
         return false;
       };
+      const nativePathBuilder = (node) => {
+        const imported = nativeImportedName(node, PATH_MODULES);
+        return imported === "join" || imported === "resolve" ? imported : null;
+      };
+      const nativeImportedName = (node, modules) => {
+        const binding = bindingOf(node);
+        if (binding === null || binding.references.some((reference) => reference.isWrite() && reference.init !== true)) return null;
+        for (const definition of binding.defs) {
+          const imported = definition.node;
+          if (imported.type === AST_NODE_TYPES122.ImportSpecifier && imported.imported.type === AST_NODE_TYPES122.Identifier && imported.parent.type === AST_NODE_TYPES122.ImportDeclaration && modules.has(String(imported.parent.source.value))) {
+            return imported.imported.name;
+          }
+        }
+        return null;
+      };
+      const stableInitializer = (node) => {
+        const binding = bindingOf(node);
+        if (binding === null || binding.references.some((reference) => reference.isWrite() && reference.init !== true) || binding.defs.length !== 1) return null;
+        const definition = binding.defs[0]?.node;
+        return definition?.type === AST_NODE_TYPES122.VariableDeclarator ? definition.init : null;
+      };
+      const temporaryDirectory = (node, depth = 0) => {
+        if (depth > 8) return false;
+        const current = unwrap6(node);
+        if (current.type === AST_NODE_TYPES122.Identifier) {
+          const initializer = stableInitializer(current);
+          return initializer !== null && temporaryDirectory(initializer, depth + 1);
+        }
+        if (current.type !== AST_NODE_TYPES122.CallExpression) return false;
+        const callee = unwrap6(current.callee);
+        return callee.type === AST_NODE_TYPES122.Identifier && ["mkdtemp", "mkdtempSync"].includes(nativeImportedName(callee, FS_MODULES) ?? "");
+      };
+      const temporaryDescendant = (node, builder) => {
+        const [directory, ...segments] = node.arguments;
+        if (directory === void 0 || directory.type === AST_NODE_TYPES122.SpreadElement || !temporaryDirectory(directory)) return false;
+        const values = [];
+        for (const segment of segments) {
+          if (segment.type === AST_NODE_TYPES122.SpreadElement) return false;
+          const value = stringValue(segment);
+          if (value === null) return false;
+          values.push(value.replaceAll("\\", "/"));
+        }
+        const sentinel = "/__source_oracle_temporary_directory__";
+        return posix2[builder](sentinel, ...values).startsWith(`${sentinel}/`);
+      };
+      const sourcePathValue = (value) => {
+        const normalized = posix2.normalize(value.replaceAll("\\", "/"));
+        return sourceSuffixRe.test(normalized) && !REPRESENTATION_DIR_RE.test(normalized) && !isGeneratedFile(normalized);
+      };
       const rawRead = (node) => {
         const current = unwrap6(node);
         if (current.type !== AST_NODE_TYPES122.CallExpression || current.arguments.length === 0) return false;
@@ -27360,6 +27430,26 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         if (name2 !== null && REGEXP_PREDICATES.has(name2)) return new Set(current.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES122.SpreadElement ? [] : [...rawOrigins(argument)]));
         return /* @__PURE__ */ new Set();
       };
+      const literalMutation = (node, depth = 0) => {
+        if (depth > 8) return false;
+        const current = unwrap6(node);
+        if (current.type === AST_NODE_TYPES122.Identifier) {
+          const initializer = stableInitializer(current);
+          return initializer !== null && literalMutation(initializer, depth + 1);
+        }
+        if (current.type !== AST_NODE_TYPES122.CallExpression || current.arguments.length !== 2) return false;
+        const callee = unwrap6(current.callee);
+        const [pattern, replacement] = current.arguments;
+        return callee.type === AST_NODE_TYPES122.MemberExpression && ["replace", "replaceAll"].includes(ASTUtils81.getPropertyName(callee) ?? "") && pattern !== void 0 && replacement !== void 0 && pattern.type !== AST_NODE_TYPES122.SpreadElement && replacement.type !== AST_NODE_TYPES122.SpreadElement && (stringValue(pattern) !== null || pattern.type === AST_NODE_TYPES122.Literal && "regex" in pattern) && stringValue(replacement) !== null;
+      };
+      const mutationGuard = (operands) => {
+        if (operands.length !== 2) return false;
+        const [left, right] = operands;
+        if (left === void 0 || right === void 0 || left.type === AST_NODE_TYPES122.SpreadElement || right.type === AST_NODE_TYPES122.SpreadElement || !literalMutation(left) && !literalMutation(right)) return false;
+        const leftOrigins = rawOrigins(left);
+        const rightOrigins = rawOrigins(right);
+        return leftOrigins.size > 0 && leftOrigins.size === rightOrigins.size && [...leftOrigins].every((origin) => rightOrigins.has(origin));
+      };
       const rawAssertionOrigins = (node) => {
         const callee = unwrap6(node.callee);
         const calleeReceiver = callee.type === AST_NODE_TYPES122.MemberExpression ? unwrapExpression(callee.object) : callee;
@@ -27374,9 +27464,11 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         const expectCallee = receiver.type === AST_NODE_TYPES122.CallExpression ? unwrapExpression(receiver.callee) : null;
         if (receiver.type === AST_NODE_TYPES122.CallExpression && expectCallee?.type === AST_NODE_TYPES122.Identifier && assertionKind(expectCallee) === "expect") {
           if (!EXPECT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
+          if (["toBe", "toEqual", "toStrictEqual"].includes(matcher) && calleeReceiver.type === AST_NODE_TYPES122.MemberExpression && ASTUtils81.getPropertyName(calleeReceiver) === "not" && mutationGuard([...receiver.arguments, ...node.arguments])) return /* @__PURE__ */ new Set();
           return new Set([...receiver.arguments, ...node.arguments].flatMap((argument) => argument.type === AST_NODE_TYPES122.SpreadElement ? [] : [...evidenceOrigins(argument)]));
         }
         if (receiver.type !== AST_NODE_TYPES122.Identifier || assertionKind(receiver) !== "assert" || !ASSERT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
+        if (["notEqual", "notStrictEqual"].includes(matcher) && mutationGuard(node.arguments)) return /* @__PURE__ */ new Set();
         return new Set(node.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES122.SpreadElement ? [] : [...evidenceOrigins(argument)]));
       };
       const declare = (node, state) => {
@@ -27617,10 +27709,11 @@ var IAC_SOURCE_SUFFIX_RE = /(?:\.tf\.json|\.tftest\.(?:hcl|json)|\.(?:hcl|tf|tfv
 var IAC_SOURCE_COUPLED_TEST_DOCUMENTATION = {
   summary: "Disallow raw IaC source text as a test oracle; inspect a rendered plan, provider state, or runtime behavior.",
   rationale: "Substring and regex checks can pass on comments, formatting, or unreachable Terraform configuration while clients fail silently.",
-  remediation: "Parse rendered plan JSON, query the provider, or exercise the deployed runtime contract.",
+  remediation: "Reuse adequate existing validation; otherwise assert a distinct rendered-plan, provider-state, or runtime contract. Preserve deliberate representation contracts with an exact justified suppression.",
   category: "testing",
   limitations: [
-    "The rule follows stable lexical bindings and static source paths. Reassigned bindings, dynamic paths, unknown path wrappers, iterator pipelines, and interprocedural flows remain unreported.",
+    "The rule follows stable lexical bindings and static source paths, including named node:path/path join and resolve imports with a complete trailing static path. Reassigned bindings, dynamic trailing paths, namespace or unknown path wrappers, iterator pipelines, and interprocedural flows remain unreported.",
+    "Known fixture, golden, snapshot, and generated source paths remain unreported after dot-segment normalization, as do contained static paths beneath stable native temporary directories and literal mutation nonidentity guards comparing the same read.",
     "When raw representation is genuinely the contract, use an exact line suppression explaining that contract."
   ],
   examples: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "16.22.1",
+  "version": "16.22.3",
   "packageManager": "npm@12.2.0",
   "description": "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",