@sarj/eslint-plugin 16.23.2 → 16.26.0

package/dist/index.js

@@ -288,7 +288,7 @@ function isTypeOnly(node) {
 import { AST_NODE_TYPES as AST_NODE_TYPES4, ASTUtils as ASTUtils2 } from "@typescript-eslint/utils";
 
 // src/rules/_paths.ts
-import { posix } from "path";
+import { posix, win32 } from "path";
 var LINE_TERMINATOR_RE = /[\n\r\u2028\u2029]/u;
 var SCRIPT_FILE_RE = /(?:^|[\\/])scripts[\\/]|\.mjs$/;
 var STORY_FILE_RE = /\.stories\.[cm]?[jt]sx?$/i;
@@ -373,7 +373,21 @@ function isScriptFile(filename) {
   return SCRIPT_FILE_RE.test(scopedFilename(filename));
 }
 function scopedFilename(input) {
-  return (typeof input === "string" ? input : input.filename).replaceAll("\\", "/");
+  if (typeof input === "string") return input.replaceAll("\\", "/");
+  const filename = input.filename.replaceAll("\\", "/");
+  const cwd = input.cwd.replaceAll("\\", "/");
+  const fileWindows = windowsAbsolute(filename);
+  const cwdWindows = windowsAbsolute(cwd);
+  let scoped = filename;
+  if (fileWindows && cwdWindows) scoped = win32.relative(cwd, filename).replaceAll("\\", "/");
+  else if (!fileWindows && !cwdWindows && posix.isAbsolute(filename) && posix.isAbsolute(cwd)) {
+    scoped = posix.relative(cwd, filename);
+  }
+  if (windowsAbsolute(scoped) || posix.isAbsolute(scoped)) return scoped;
+  return `./${posix.normalize(scoped)}`;
+}
+function windowsAbsolute(filename) {
+  return /^[A-Za-z]:\//u.test(filename) || filename.startsWith("//");
 }
 function matchesAnyPattern(filename, patterns) {
   const normalized = filename.replaceAll("\\", "/");
@@ -822,7 +836,7 @@ function isSearchParamReceiver(call, services) {
 // package.json
 var package_default = {
   name: "@sarj/eslint-plugin",
-  version: "16.23.2",
+  version: "16.26.0",
   packageManager: "npm@12.2.0",
   description: "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   type: "module",
@@ -7261,32 +7275,39 @@ import { ASTUtils as ASTUtils21, AST_NODE_TYPES as AST_NODE_TYPES40 } from "@typ
 
 // src/rules/_sql.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES39, ASTUtils as ASTUtils20 } from "@typescript-eslint/utils";
-function stripSqlNoise(text) {
-  return scanSqlNoise(text);
+var SQL_IDENTIFIER_CONTINUATION = /[\w$\u0080-\u{10FFFF}]/u;
+var DOLLAR_DELIMITER = /\$(?:[A-Za-z_\u0080-\u{10FFFF}][A-Za-z_0-9\u0080-\u{10FFFF}]*)?\$/uy;
+var SQL_LINE_END = /[\r\n]/g;
+var CONTINUED_QUOTE = /[ \t\f\v]*(?:--[^\r\n]*)?[\r\n](?:[ \t\f\v\r\n]|--[^\r\n]*[\r\n])*'/y;
+function stripSqlNoise(text, options) {
+  return scanSqlNoise(text, void 0, options?.preserveQuotedTokens === true);
 }
 function sqlNoiseInfo(text) {
   const singleQuotedRanges = [];
   const masked = scanSqlNoise(text, (start, end) => singleQuotedRanges.push([start, end]));
   return { text: masked, singleQuotedRanges };
 }
-function scanSqlNoise(text, onSingleQuoted) {
+function scanSqlNoise(text, onSingleQuoted, preserveQuotedTokens = false) {
   const out = text.split("");
   let index = 0;
   while (index < text.length) {
     const dollarEnd = dollarQuotedSqlEnd(text, index);
     if (dollarEnd !== null) {
       maskSqlRange(text, out, index, dollarEnd);
+      if (preserveQuotedTokens) out[index] = "?";
       index = dollarEnd;
       continue;
     }
     const character = text[index];
     if (character === "'" || character === '"') {
+      const start = index;
       index = quotedSqlEnd(text, out, index, onSingleQuoted);
+      if (preserveQuotedTokens) out[start] = "?";
       continue;
     }
     if (character === "-" && text[index + 1] === "-") {
-      const newline = text.indexOf("\n", index);
-      const end = newline === -1 ? text.length : newline;
+      SQL_LINE_END.lastIndex = index;
+      const end = SQL_LINE_END.exec(text)?.index ?? text.length;
       maskSqlRange(text, out, index, end);
       index = end;
       continue;
@@ -7300,8 +7321,9 @@ function scanSqlNoise(text, onSingleQuoted) {
   return out.join("");
 }
 function dollarQuotedSqlEnd(text, start) {
-  if (text[start] !== "$" || /[\w$]/u.test(text[start - 1] ?? "")) return null;
-  const delimiter = /^\$(?:[A-Za-z_][A-Za-z_0-9]*)?\$/u.exec(text.slice(start))?.[0];
+  if (text[start] !== "$" || SQL_IDENTIFIER_CONTINUATION.test(text[start - 1] ?? "")) return null;
+  DOLLAR_DELIMITER.lastIndex = start;
+  const delimiter = DOLLAR_DELIMITER.exec(text)?.[0];
   if (delimiter === void 0) return null;
   const closing = text.indexOf(delimiter, start + delimiter.length);
   return closing < 0 ? text.length : closing + delimiter.length;
@@ -7319,17 +7341,24 @@ function blockSqlCommentEnd(text, out, start) {
       index += 2;
       continue;
     }
-    if (text[index] !== "\n") out[index] = " ";
+    if (text[index] !== "\n" && text[index] !== "\r") out[index] = " ";
     index += 1;
   }
   return index;
 }
 function quotedSqlEnd(text, out, start, onSingleQuoted) {
   const quote = text[start];
+  const escapeString = quote === "'" && /[Ee]/u.test(text[start - 1] ?? "") && !SQL_IDENTIFIER_CONTINUATION.test(text[start - 2] ?? "");
+  let segmentStart = start;
   out[start] = " ";
   let index = start + 1;
   while (index < text.length) {
     const character = text[index];
+    if (character === "\\" && index + 1 < text.length) {
+      maskSqlRange(text, out, index, index + 2);
+      index += 2;
+      continue;
+    }
     if (character === quote) {
       out[index] = " ";
       if (index + 1 < text.length && text[index + 1] === quote) {
@@ -7338,17 +7367,29 @@ function quotedSqlEnd(text, out, start, onSingleQuoted) {
         continue;
       }
       index += 1;
-      if (quote === "'") onSingleQuoted?.(start, index);
+      if (quote === "'") onSingleQuoted?.(segmentStart, index);
+      const continuation = escapedSqlContinuation(text, index, escapeString);
+      if (continuation !== null) {
+        maskSqlRange(text, out, index, continuation);
+        segmentStart = continuation - 1;
+        index = continuation;
+        continue;
+      }
       break;
     }
-    if (character !== "\n") out[index] = " ";
+    if (character !== "\n" && character !== "\r") out[index] = " ";
     index += 1;
   }
   return index;
 }
+function escapedSqlContinuation(text, start, escapeString) {
+  if (!escapeString) return null;
+  CONTINUED_QUOTE.lastIndex = start;
+  return CONTINUED_QUOTE.test(text) ? CONTINUED_QUOTE.lastIndex : null;
+}
 function maskSqlRange(text, out, start, end) {
   for (let index = start; index < end; index += 1) {
-    if (text[index] !== "\n") out[index] = " ";
+    if (text[index] !== "\n" && text[index] !== "\r") out[index] = " ";
   }
 }
 var SUBSTITUTION_MARKER = "?";
@@ -7414,7 +7455,7 @@ function markConsumed(node, consumed) {
     markConsumed(node.quasi, consumed);
   }
 }
-function createSqlListener(handler) {
+function createSqlListener(handler, options) {
   const consumed = /* @__PURE__ */ new WeakSet();
   const visit = (node) => {
     if (consumed.has(node) || isDiscardedSqlText(node)) {
@@ -7425,7 +7466,7 @@ function createSqlListener(handler) {
       return;
     }
     markConsumed(node, consumed);
-    handler(stripSqlNoise(text), node);
+    handler(stripSqlNoise(text, options), node, text);
   };
   return {
     BinaryExpression: (node) => {
@@ -8769,6 +8810,20 @@ import {
   AST_NODE_TYPES as AST_NODE_TYPES45,
   ASTUtils as ASTUtils24
 } from "@typescript-eslint/utils";
+
+// src/rules/_stable-value-binding.ts
+import "@typescript-eslint/utils";
+function stableValueBinding(variable, acceptRead) {
+  let initializer;
+  return variable.references.every((reference) => {
+    if (!reference.isWrite()) return acceptRead?.(reference) ?? true;
+    if (reference.init !== true || initializer !== void 0 && initializer !== reference.identifier) return false;
+    initializer = reference.identifier;
+    return true;
+  });
+}
+
+// src/rules/no-detached-global-fetch.ts
 var NO_DETACHED_GLOBAL_FETCH_DOCUMENTATION = {
   summary: "Keep the ambient global fetch receiver-safe when storing or explicitly rebinding it.",
   rationale: "Calling a raw ambient fetch through a class or object property supplies that object as `this`; receiver-sensitive hosts can reject that invocation only after deployment.",
@@ -8837,14 +8892,9 @@ var no_detached_global_fetch_default = createRule({
     function isGlobalReceiver(node) {
       return node.type === AST_NODE_TYPES45.Identifier && GLOBAL_RECEIVERS.has(node.name) && resolvesToGlobal(node);
     }
-    function isStableAlias(variable) {
-      return !variable.references.some(
-        (reference) => reference.isWrite() && reference.init !== true
-      );
-    }
     function recordAlias(identifier) {
       const variable = bindingOf(identifier);
-      if (variable !== null && isStableAlias(variable)) aliases.add(variable);
+      if (variable !== null && stableValueBinding(variable)) aliases.add(variable);
     }
     function staticMemberName7(node) {
       if (!node.computed) {
@@ -8857,7 +8907,7 @@ var no_detached_global_fetch_default = createRule({
       if (expression.type === AST_NODE_TYPES45.Identifier) {
         if (expression.name === "fetch" && resolvesToGlobal(expression)) return true;
         const variable = bindingOf(expression);
-        return variable !== null && aliases.has(variable) && isStableAlias(variable);
+        return variable !== null && aliases.has(variable);
       }
       if (expression.type === AST_NODE_TYPES45.MemberExpression) {
         return isGlobalFetchMember(expression);
@@ -12610,18 +12660,18 @@ var no_router_refresh_polling_default = createRule({
           if (hookCallee.type !== AST_NODE_TYPES62.Identifier) return;
           const hook = ASTUtils39.findVariable(context.sourceCode.getScope(hookCallee), hookCallee.name);
           const router = ASTUtils39.findVariable(context.sourceCode.getScope(node.id), node.id.name);
-          if (hook !== null && router !== null && routerHooks.has(hook)) routers.add(router);
+          if (hook !== null && router !== null && routerHooks.has(hook) && stableValueBinding(router)) routers.add(router);
         }
       },
       CallExpression(node) {
         const unwrappedNodeCallee = unwrapExpression(node.callee);
         const receiver = unwrappedNodeCallee.type === AST_NODE_TYPES62.MemberExpression ? unwrapExpression(unwrappedNodeCallee.object) : unwrappedNodeCallee;
-        if (unwrappedNodeCallee.type !== AST_NODE_TYPES62.MemberExpression || receiver.type !== AST_NODE_TYPES62.Identifier || ASTUtils39.getPropertyName(unwrappedNodeCallee) === null || (ASTUtils39.getPropertyName(unwrappedNodeCallee) ?? "") !== "refresh") return;
+        if (unwrappedNodeCallee.type !== AST_NODE_TYPES62.MemberExpression || receiver.type !== AST_NODE_TYPES62.Identifier || ASTUtils39.getPropertyName(unwrappedNodeCallee) !== "refresh") return;
         const router = ASTUtils39.findVariable(
           context.sourceCode.getScope(receiver),
           receiver.name
         );
-        if (router === null || !routers.has(router) || router.references.some((reference) => reference.isWrite() && reference.init !== true)) return;
+        if (router === null || !routers.has(router)) return;
         const callback = enclosingIntervalCallback(context.sourceCode, node);
         if (callback !== null && !reportedCallbacks.has(callback)) {
           reportedCallbacks.add(callback);
@@ -13580,51 +13630,138 @@ var NO_SELECT_STAR_DOCUMENTATION = {
   rationale: "Wildcard projections couple row shape and query cost to unrelated schema changes.",
   remediation: "List every required column explicitly in the projection.",
   category: "correctness",
-  limitations: ["Only statically visible embedded SQL is checked; quoted strings (including PostgreSQL dollar strings), comments, function arguments such as COUNT(*), and stars inside EXISTS are excluded. This is a bounded lexical scan, not a complete SQL parser."],
+  limitations: ["Only statically visible embedded SQL is checked; quoted strings (including PostgreSQL dollar strings), comments, function arguments such as COUNT(*), and stars inside EXISTS are excluded. Escaped ordinary strings, brackets, and backticks are handled conservatively. This is a bounded lexical scan, not a complete SQL parser."],
   examples: [
     { id: "explicit-projection", title: "Select the required columns", outcome: "no-match", files: [{ path: "src/runs.ts", source: "db.prepare(`SELECT id, status FROM runs`).all();" }], focusPath: "src/runs.ts", expectedCount: 0, public: true },
     { id: "wildcard-projection", title: "Do not select every column", outcome: "match", files: [{ path: "src/runs.ts", source: "db.prepare(`SELECT * FROM runs`).all();" }], focusPath: "src/runs.ts", expectedCount: 1, public: true },
     { id: "decoded-query", scenarioId: "native-decoded-sql", title: "Inspect native-decoded query text", outcome: "match", files: [{ path: "src/page.ts", source: 'db.query("SEL\\u0045CT * FROM runs");' }], focusPath: "src/page.ts", expectedCount: 1, public: true },
-    { id: "decoded-comment-data", scenarioId: "native-decoded-sql", title: "Ignore native-decoded comment data", outcome: "no-match", files: [{ path: "src/page.ts", source: 'db.query("SEL\\x45CT id FROM runs /* SELECT * FROM runs */");' }], focusPath: "src/page.ts", expectedCount: 0, public: true }
+    { id: "decoded-comment-data", scenarioId: "native-decoded-sql", title: "Ignore native-decoded comment data", outcome: "no-match", files: [{ path: "src/page.ts", source: 'db.query("SEL\\x45CT id FROM runs /* SELECT * FROM runs */");' }], focusPath: "src/page.ts", expectedCount: 0, public: true },
+    { "id": "wrapped-exists-outer-wildcard", "scenarioId": "projection-owner", "title": "The outer projection still selects every column", "outcome": "match", "files": [{ "path": "src/queries.ts", "source": 'db.query("SELECT EXISTS((SELECT * FROM jobs)), * FROM runs");' }], "focusPath": "src/queries.ts", "expectedCount": 1, "public": true },
+    { "id": "quoted-column-arithmetic", "scenarioId": "projection-owner", "title": "Quoted arithmetic operands are not wildcards", "outcome": "no-match", "files": [{ "path": "src/queries.ts", "source": 'db.query("SELECT \\"units\\" * \\"price\\" AS total FROM entries");' }], "focusPath": "src/queries.ts", "expectedCount": 0, "public": true }
   ]
 };
-var QUERY_SHAPE = /\bSELECT\b[\s\S]*?\bFROM\b/i;
-var SELECT_KEYWORD = /\bSELECT\b/gi;
-var FROM_KEYWORD = /^FROM\b/i;
-var EXISTS_BEFORE = /\bEXISTS\s*\(\s*$/i;
-var QUALIFIED_PREFIX = /\w\.$/;
-function hasRealSelectStar(sql) {
-  const selects = [...sql.matchAll(SELECT_KEYWORD)].map((m) => m.index);
-  for (let pos = 0; pos < sql.length; pos++) {
-    if (sql[pos] !== "*" || !isProjectionStar(sql, pos)) {
-      continue;
-    }
-    const owning = selects.filter((start) => start < pos).at(-1);
-    if (owning !== void 0 && !EXISTS_BEFORE.test(sql.slice(0, owning))) {
-      return true;
-    }
+var QUERY_SELECT = /\bSELECT\b/i;
+var QUERY_FROM = /\bFROM\b/i;
+var SQL_TOKEN = /[A-Za-z_\u0080-\u{10FFFF}][A-Za-z0-9_$\u0080-\u{10FFFF}]*|\d+(?:\.\d+)?|\.[ \t\r\n\f\v]*\[(?:[^\]]|\]\])*\]|[-+*/<>=~!@#%^&|\x60?]+|[(),.;]/gu;
+var ASCII_WORD = /^[A-Za-z_]+$/u;
+var AMBIGUOUS_QUOTING = /[\x60[\]\\]/u;
+var CONSERVATIVE_SELECT = /\bSELECT\b/gi;
+var CONSERVATIVE_FROM = /FROM\b/iy;
+var ASCII_IDENTIFIER_CHARACTER = /[A-Za-z0-9_]/u;
+var SQL_WHITESPACE = /\s/u;
+var EXISTS_KEYWORD_LENGTH = 6;
+var PROJECTION_END = /\s*(?:[,)]|FROM(?![A-Za-z0-9_$\u0080-\u{10FFFF}])|$)/iyu;
+var SELECT_PREFIX_WORDS = /* @__PURE__ */ new Set([
+  "ALL",
+  "DISTINCT",
+  "HIGH_PRIORITY",
+  "PERCENT",
+  "SQL_BIG_RESULT",
+  "SQL_BUFFER_RESULT",
+  "SQL_CACHE",
+  "SQL_CALC_FOUND_ROWS",
+  "SQL_NO_CACHE",
+  "SQL_SMALL_RESULT",
+  "STRAIGHT_JOIN",
+  "TIES",
+  "TOP",
+  "WITH"
+]);
+function hasQueryShape(sql) {
+  return QUERY_SELECT.test(sql) && QUERY_FROM.test(sql);
+}
+function hasRealSelectStar(sql, original = sql, conservativeSource = sql) {
+  const conservative = AMBIGUOUS_QUOTING.test(original) ? { source: conservativeSource, selects: [...conservativeSource.matchAll(CONSERVATIVE_SELECT)].map((match) => ({ offset: match.index, allowsStar: selectAllowsStar(conservativeSource, match.index) })) } : void 0;
+  const strictSuffix = /[\x60[\]\\?]/u.test(original);
+  const projections = /* @__PURE__ */ new Map();
+  const existsScopes = /* @__PURE__ */ new Set();
+  let depth = 0;
+  let previous = "";
+  let prior = "";
+  for (const match of sql.matchAll(SQL_TOKEN)) {
+    const raw = match[0];
+    const token = ASCII_WORD.test(raw) ? raw.toUpperCase() : raw;
+    if (token === ")") {
+      projections.delete(depth);
+      existsScopes.delete(depth);
+      depth = Math.max(0, depth - 1);
+    }
+    const projection = projections.get(depth);
+    if (isKeyword(token, previous, "SELECT")) {
+      projections.set(depth, { exists: existsScopes.size > 0, strictSuffix, conservative, prefix: [], star: false });
+    } else if (isKeyword(token, previous, "FROM")) {
+      if (projection?.star === true) return true;
+      projections.delete(depth);
+    } else if (token === ";") {
+      projections.clear();
+      existsScopes.clear();
+    } else if (projection !== void 0) {
+      observeProjection(sql, match, previous, projection);
+    }
+    if (token === "(") {
+      depth += 1;
+      if (isKeyword(previous, prior, "EXISTS")) existsScopes.add(depth);
+    }
+    prior = previous;
+    previous = token;
   }
   return false;
 }
-function isProjectionStar(sql, pos) {
-  if (QUALIFIED_PREFIX.test(sql.slice(0, pos))) {
-    return true;
-  }
-  let before = pos - 1;
-  while (before >= 0 && /\s/.test(sql[before] ?? "")) {
-    before -= 1;
-  }
-  let after = pos + 1;
-  while (after < sql.length && /\s/.test(sql[after] ?? "")) {
-    after += 1;
-  }
-  const beforeChar = before >= 0 ? sql[before] ?? "" : "";
-  const afterChar = after < sql.length ? sql[after] ?? "" : "";
-  const terminates = afterChar === "" || afterChar === "," || afterChar === ")" || FROM_KEYWORD.test(sql.slice(after));
-  if (!terminates) {
-    return false;
-  }
-  return !(beforeChar === "(" && afterChar === ")");
+function selectAllowsStar(source, offset) {
+  const opening = skipWhitespace(source, offset - 1, -1);
+  if (source[opening] !== "(") return true;
+  const wordEnd = skipWhitespace(source, opening - 1, -1);
+  const wordStart = wordEnd - EXISTS_KEYWORD_LENGTH + 1;
+  return wordStart < 0 || source.slice(wordStart, wordEnd + 1).toUpperCase() !== "EXISTS" || wordStart !== 0 && ASCII_IDENTIFIER_CHARACTER.test(source[wordStart - 1] ?? "");
+}
+function isKeyword(token, previous, keyword) {
+  return token === keyword && previous !== ".";
+}
+function observeProjection(sql, match, previous, projection) {
+  if (isProjectionStar(sql, match, previous, projection)) {
+    if (projection.conservative === void 0 || conservativeProjectionStar(projection.conservative, match.index)) {
+      projection.star = true;
+    }
+  } else if (projection.prefix.length < 2) {
+    const raw = match[0];
+    projection.prefix.push(ASCII_WORD.test(raw) ? raw.toUpperCase() : raw);
+  }
+}
+function conservativeProjectionStar(query, offset) {
+  const { source, selects } = query;
+  let low = 0;
+  let high = selects.length;
+  while (low < high) {
+    const middle = Math.floor((low + high) / 2);
+    const start = selects[middle];
+    if (start !== void 0 && start.offset < offset) low = middle + 1;
+    else high = middle;
+  }
+  const owning = selects[low - 1];
+  if (owning?.allowsStar !== true) return false;
+  if (source[offset - 1] === "." && ASCII_IDENTIFIER_CHARACTER.test(source[offset - 2] ?? "")) return true;
+  const before = skipWhitespace(source, offset - 1, -1);
+  const after = skipWhitespace(source, offset + 1, 1);
+  const afterChar = source[after] ?? "";
+  CONSERVATIVE_FROM.lastIndex = after;
+  return (afterChar === "" || afterChar === "," || afterChar === ")" || CONSERVATIVE_FROM.test(source)) && !(source[before] === "(" && afterChar === ")");
+}
+function skipWhitespace(source, offset, direction) {
+  let cursor = offset;
+  while (cursor >= 0 && cursor < source.length && SQL_WHITESPACE.test(source[cursor] ?? "")) cursor += direction;
+  return cursor;
+}
+function isProjectionStar(sql, match, previous, projection) {
+  if (match[0] !== "*" || projection.exists) return false;
+  const { prefix } = projection;
+  if (previous === ".") return true;
+  if (!projection.strictSuffix && (prefix.length === 0 || previous === ",")) return true;
+  if (!endsProjection(sql, match.index + 1)) return false;
+  return previous === "SELECT" || previous === "," || SELECT_PREFIX_WORDS.has(previous) || previous === ")" && (prefix[0] === "DISTINCT" && prefix[1] === "ON" || prefix[0] === "TOP");
+}
+function endsProjection(sql, offset) {
+  PROJECTION_END.lastIndex = offset;
+  return PROJECTION_END.test(sql);
 }
 var no_select_star_default = createRule({
   name: "no-select-star",
@@ -13644,12 +13781,12 @@ var no_select_star_default = createRule({
     if (isTestFile(context)) {
       return {};
     }
-    return createSqlListener((sql, node) => {
-      if (!QUERY_SHAPE.test(sql) || !hasRealSelectStar(sql)) {
-        return;
-      }
+    return createSqlListener((sql, node, original) => {
+      if (!hasQueryShape(sql)) return;
+      const conservativeSource = AMBIGUOUS_QUOTING.test(original) ? stripSqlNoise(original) : sql;
+      if (!hasRealSelectStar(sql, original, conservativeSource)) return;
       context.report({ node, messageId: "noSelectStar" });
-    });
+    }, { preserveQuotedTokens: true });
   }
 });
 
@@ -20652,16 +20789,42 @@ var PREFER_NODE_CRYPTO_HASH_DOCUMENTATION = {
   remediation: "On a supported Node runtime, consider hash(algorithm, value, encoding). Preserve the output encoding explicitly: digest() returns a Buffer, while hash defaults to hex. Keep createHash for streams or multiple updates.",
   category: "performance",
   limitations: [
-    "Only bindings and inline calls with statically proven provenance from crypto or node:crypto are analyzed; arbitrary assignments and dynamic module specifiers are excluded.",
+    "Only direct imports, const bindings, and inline calls with statically proven provenance from crypto or node:crypto are analyzed; arbitrary assignments and dynamic module specifiers are excluded.",
     "Only a literal algorithm with exactly one update call is reported; streaming and incremental hashes remain valid.",
+    "Namespace bindings must remain read-only: visible writes, aliases, exports, inherited mutation or alias methods, unknown computed members, and other escaping uses are excluded; type-only references and direct member calls remain eligible.",
     "Runtime support and output encoding require manual review; no autofix or guaranteed speedup is promised."
   ],
   references: ["https://nodejs.org/api/crypto.html#cryptohashalgorithm-data-options"],
   examples: [
     { id: "one-shot-hash", title: "Use Node's one-shot hash API", outcome: "no-match", files: [{ path: "case.ts", source: "import { hash } from 'node:crypto'; export const digest = hash('sha256', 'value', 'hex');" }], focusPath: "case.ts", expectedCount: 0, public: true },
-    { id: "mutable-one-shot-chain", title: "Avoid mutable state for one value", outcome: "match", files: [{ path: "case.ts", source: "import { createHash } from 'node:crypto'; export const digest = createHash('sha256').update('value').digest('hex');" }], focusPath: "case.ts", expectedCount: 1, public: true }
+    { id: "mutable-one-shot-chain", title: "Avoid mutable state for one value", outcome: "match", files: [{ path: "case.ts", source: "import { createHash } from 'node:crypto'; export const digest = createHash('sha256').update('value').digest('hex');" }], focusPath: "case.ts", expectedCount: 1, public: true },
+    { id: "native-namespace", scenarioId: "stable-native-namespace", title: "An unchanged namespace retains native provenance", outcome: "match", files: [{ path: "case.ts", source: "const crypto = require('node:crypto'); export const digest = crypto.createHash('sha256').update('value').digest('hex');" }], focusPath: "case.ts", expectedCount: 1, public: true },
+    { id: "replaced-namespace-member", scenarioId: "stable-native-namespace", title: "A replaced member has a different contract", outcome: "no-match", files: [{ path: "case.ts", source: "const crypto = require('node:crypto'); crypto.createHash = () => ({ update() { return this; }, digest() { return 'custom'; } }); export const digest = crypto.createHash('sha256').update('value').digest('hex');" }], focusPath: "case.ts", expectedCount: 0, public: true }
   ]
 };
+var UNSAFE_NAMESPACE_METHODS = /* @__PURE__ */ new Set(["__defineGetter__", "__defineSetter__", "valueOf"]);
+function stableNamespace(variable) {
+  if (variable.defs.some((definition) => definition.type === "Variable" && definition.parent.parent.type === AST_NODE_TYPES99.ExportNamedDeclaration)) return false;
+  return stableValueBinding(variable, (reference) => {
+    if (reference.isTypeReference && !reference.isValueReference) return true;
+    const receiver = outerExpression(reference.identifier);
+    if (typeQueryReference(receiver)) return true;
+    const member = receiver.parent;
+    if (member?.type !== AST_NODE_TYPES99.MemberExpression || member.object !== receiver) {
+      return member?.type === AST_NODE_TYPES99.UnaryExpression && member.operator === "typeof";
+    }
+    const use = outerExpression(member);
+    const name = ASTUtils61.getPropertyName(member);
+    return name !== null && !UNSAFE_NAMESPACE_METHODS.has(name) && use.parent?.type === AST_NODE_TYPES99.CallExpression && use.parent.callee === use;
+  });
+}
+function typeQueryReference(node) {
+  let current = node;
+  while (current.parent?.type === AST_NODE_TYPES99.TSQualifiedName && current.parent.left === current) {
+    current = current.parent;
+  }
+  return current.parent?.type === AST_NODE_TYPES99.TSTypeQuery && current.parent.exprName === current;
+}
 function isCryptoLoader(node, resolve2) {
   const unwrappedNodeCallee = node.type === "CallExpression" || node.type === "NewExpression" ? unwrapExpression(node.callee) : null;
   if (node.type !== AST_NODE_TYPES99.CallExpression || node.arguments.length !== 1) return false;
@@ -20704,7 +20867,7 @@ var prefer_node_crypto_hash_default = createRule({
     }
     function record(identifier, destination) {
       const variable = resolve2(identifier);
-      if (variable !== null) destination.add(variable);
+      if (variable !== null && (destination === namespaceBindings ? stableNamespace(variable) : stableValueBinding(variable))) destination.add(variable);
     }
     return {
       ImportDeclaration(node) {
@@ -20846,11 +21009,11 @@ var prefer_node_fs_promises_default = createRule({
     };
     const isNamespace = (node) => {
       const binding = bindingOf(node);
-      return binding !== null && namespaces.has(binding) && !binding.references.some((reference) => reference.isWrite() && reference.init !== true);
+      return binding !== null && namespaces.has(binding);
     };
     const recordNamespace = (node) => {
       const binding = bindingOf(node);
-      if (binding !== null) namespaces.add(binding);
+      if (binding !== null && stableValueBinding(binding)) namespaces.add(binding);
     };
     return {
       ImportDeclaration(node) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "16.23.2",
+  "version": "16.26.0",
   "packageManager": "npm@12.2.0",
   "description": "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",