@sarj/eslint-plugin 16.36.1 → 16.36.5

package/dist/index.cjs

@@ -1928,7 +1928,7 @@ var NO_TEST_COMMENTS_DOCUMENTATION = {
   autofix: "safe",
   limitations: [
     "Checks actual line and block comment tokens in recognized maintained test files, including test fixtures; strings and template text remain unchanged. Generated/vendor files are excluded.",
-    "Legal notices, shebangs, TypeScript triple-slash references, coverage/build annotations and explicit lint/type/test/formatter directives remain allowed. Ordinary prose embedded in a directive remains the owning tool's responsibility.",
+    "Legal notices, shebangs, TypeScript triple-slash references, coverage/build annotations and explicit lint/type/test/formatter directives remain allowed. Executable detect-secrets 1.5.0 allowlist/whitelist pragmas retain its case-sensitive delimiter, spacing, physical-line and next-line grammar; arbitrary pragma prose remains ordinary commentary. Rationale on an executable directive remains the owning tool's responsibility.",
     "The automatic fix removes comments and adjacent padding while retaining every line ending and necessary token boundary; it does not rename tests or remove executable statements. Bare integration/e2e directories and ambiguous hyphen/underscore test basenames require another concrete test-path signal or a runtime testing-framework import; ordinary production integration modules and rule implementations ending in -test are preserved."
   ],
   examples: [
@@ -1939,6 +1939,52 @@ var NO_TEST_COMMENTS_DOCUMENTATION = {
 var DIRECTIVE = /^(?:eslint(?:-\S+)?\b|(?:biome|oxlint|jshint|jslint|c8|v8|istanbul|vitest|prettier|dprint)\b|@(?:ts-(?:check|nocheck|expect-error|ignore)|vitest-environment|jest-environment|jsx\w*|license|preserve)\b|[#!]\s*__(?:PURE|NO_SIDE_EFFECTS)__|\/\s*<(?:reference|amd-module|amd-dependency)\b)/u;
 var LEGAL = /(?:^|\n)\s*\*?\s*(?:Copyright\b|SPDX-License-Identifier:|Licensed under\b|@license\b|@preserve\b)/iu;
 var TYPE_CONTRACT = /@(?:type|typedef|template|param|returns?|satisfies|callback|overload|implements|extends|augments|enum|this|import)\b/u;
+var DETECT_SECRETS_COMMENT_MARKERS = [
+  { start: "#", end: "" },
+  { start: "//", end: "" },
+  { start: "/\\*", end: " *\\*/" },
+  { start: "'", end: "" },
+  { start: "--", end: "" },
+  { start: "<!--[# \\t]*?", end: " *?-->" }
+];
+var DETECT_SECRETS_PRAGMAS = DETECT_SECRETS_COMMENT_MARKERS.flatMap(({ start, end }) => [
+  { nextLine: false, pattern: new RegExp(`[ \\t]*${start} *pragma: ?(?:allow|white)list[ -]secret[^\\n]*?${end}[ \\t]*(?![\\s\\S])`, "u") },
+  { nextLine: true, pattern: new RegExp(`^[ \\t]*${start} *pragma: ?allowlist[ -]nextline[ -]secret[^\\n]*?${end}[ \\t]*(?![\\s\\S])`, "u") }
+]);
+var PYTHON_WHITESPACE = new RegExp("\\p{White_Space}", "u");
+var PYTHON_EXTRA_WHITESPACE = /* @__PURE__ */ new Set(["", "", "", ""]);
+function hasDetectSecretsPragma(comment, text) {
+  if (!comment.value.includes("pragma:")) return false;
+  let lineStart = Math.max(text.lastIndexOf("\r", comment.range[0] - 1), text.lastIndexOf("\n", comment.range[0] - 1)) + 1;
+  while (lineStart < comment.range[1]) {
+    const nextCr = text.indexOf("\r", lineStart);
+    const nextLf = text.indexOf("\n", lineStart);
+    const lineEnd = Math.min(nextCr < 0 ? text.length : nextCr, nextLf < 0 ? text.length : nextLf);
+    if (hasPragmaInReaderLine(comment, text.slice(lineStart, lineEnd), lineStart)) return true;
+    lineStart = lineEnd + (text[lineEnd] === "\r" && text[lineEnd + 1] === "\n" ? 2 : 1);
+  }
+  return false;
+}
+function hasPragmaInReaderLine(comment, rawLine, lineStart) {
+  const sameLine = stripPythonTrailingWhitespace(rawLine);
+  for (const { nextLine, pattern } of DETECT_SECRETS_PRAGMAS) {
+    const column = nextLine ? 0 : Math.max(0, comment.range[0] - lineStart);
+    const match = pattern.exec((nextLine ? rawLine : sameLine).slice(column));
+    if (match === null) continue;
+    const pragmaStart = lineStart + column + match.index + match[0].indexOf("pragma:");
+    if (pragmaStart >= comment.range[0] && pragmaStart < comment.range[1]) return true;
+  }
+  return false;
+}
+function stripPythonTrailingWhitespace(value) {
+  let end = value.length;
+  while (end > 0) {
+    const character = value.charAt(end - 1);
+    if (!PYTHON_WHITESPACE.test(character) && !PYTHON_EXTRA_WHITESPACE.has(character)) break;
+    end--;
+  }
+  return value.slice(0, end);
+}
 var no_test_comments_default = createRule({
   name: "no-test-comments",
   documentation: NO_TEST_COMMENTS_DOCUMENTATION,
@@ -1975,7 +2021,7 @@ var no_test_comments_default = createRule({
         }
         for (const [index, comment] of comments.entries()) {
           const body3 = comment.value.trim().replace(/^\*\s*/u, "");
-          if (DIRECTIVE.test(body3) || LEGAL.test(comment.value) || legalLines.has(index) || TYPE_CONTRACT.test(comment.value)) continue;
+          if (DIRECTIVE.test(body3) || LEGAL.test(comment.value) || legalLines.has(index) || TYPE_CONTRACT.test(comment.value) || hasDetectSecretsPragma(comment, context.sourceCode.text)) continue;
           context.report({
             node: comment,
             messageId: "testComment",
@@ -2773,6 +2819,7 @@ var import_typescript8 = __toESM(require("typescript"), 1);
 var CONFIG2 = { path: "tsconfig.json", source: '{"compilerOptions":{"strict":true,"target":"ESNext","module":"ESNext","moduleResolution":"Bundler"}}' };
 var EXAMPLE2 = 'export {}; const account = {name: "Ada", email: "a"}; function label(user: {readonly email: string; readonly name: string}): string {return user.name;} label(account);';
 var HELPER_EXAMPLE = 'export {}; const account = {name: "Ada", email: "a"}; function formatName(name: string): string {return name.toUpperCase();} function label(user: {email: string; name: string}): string {return formatName(user.name);} label(account);';
+var NULLABLE_EXAMPLE = 'export {}; const account = {name: "Ada", email: null}; function label(user: {email: string | null; name: string}): string {return user.name;} label(account);';
 var PREFER_MINIMAL_PARAMETER_CONTRACT_DOCUMENTATION = {
   defaultLevel: "warning",
   summary: "Prefer the proven read-only subset for a private consumer parameter.",
@@ -2783,26 +2830,32 @@ var PREFER_MINIMAL_PARAMETER_CONTRACT_DOCUMENTATION = {
   limitations: [
     "Automatic fixes additionally require every existing identifier caller to be natively assignable to the original contract, without Any, unknown, error or unresolved types on the relevant surface. Comments inside the annotation and TypeScript suppression directives keep the finding manual. Only unread required property signatures are removed; every read or optional member, modifier and terminator token is preserved. Edits that would merge distinct CR and LF terminators remain manual.",
     "Requires parser-owned TypeScript information and a strict external module. Only top-level private function declarations and raw const arrows with exactly one explicit parameter and an independent broad primitive return annotation are supported. Every callable reference must be a direct call with one identifier argument; exports including type-only exports, typeof queries, callbacks, storage, constructors, contextual signatures, overloads, generics, decorators, async functions and direct eval prevent findings.",
-    "Only anonymous inline contracts made of broad string, number, boolean or bigint property types are supported. Fields may be plain or readonly; the consumer body must still prove read-only usage. Retained field modifiers and optional members are preserved. Named domain contracts, brands, literal discriminants, classes, methods, callbacks, indexes, mapped types and imported parameter contracts are excluded. At least one read required field and one unread required field must be established; all-optional reduced contracts can reject existing callers through weak-type checks.",
+    "Only anonymous inline contracts made of broad string, number, boolean or bigint property types are supported. An unread required field may additionally have exactly one such keyword and null or undefined in a direct two-part union; read or optional nullable fields and more complex unions remain excluded. Fields may be plain or readonly; the consumer body must still prove read-only usage. Retained field modifiers and optional members are preserved. Named domain contracts, brands, literal discriminants, classes, methods, callbacks, indexes, mapped types and imported parameter contracts are excluded. At least one read required field and one unread required field must be established; all-optional reduced contracts can reject existing callers through weak-type checks.",
     "The single return expression may use only fixed scalar field reads, flat destructuring, literals, operators, templates and scalar calls to same-file implemented top-level functions or raw const arrows with an explicit return annotation. These calls require one native resolved declaration, no generic or predicate signature, scalar arguments/result and complete active native checking of the local implementation file. Their helper bodies need not be pure because only scalar values cross the call and only an erased parameter annotation changes. Imported, aliased, ambient, overloaded, optional, spread and member calls remain unsupported. Bound destructured fields count as reads even when their local aliases are unused. Whole-object escape, identity, mutation, closures, reflection, serialization, dynamic keys, implicit Object capabilities and JSX are unsupported. Unknown semantic information causes abstention. Findings outside the fix proof remain manual; this is not a requirement to minimize every object or discard useful producer fields."
   ],
   examples: [
     { id: "unused-required-field", title: "A private name consumer unnecessarily requires email", outcome: "match", files: [{ path: "src/case.ts", source: EXAMPLE2 }, CONFIG2], focusPath: "src/case.ts", expectedCount: 1, public: true, fixedFiles: [{ path: "src/case.ts", source: EXAMPLE2.replace("readonly email: string;", "") }] },
     { id: "used-fields", title: "Every required dependency is read", outcome: "no-match", files: [{ path: "src/case.ts", source: EXAMPLE2.replace("return user.name;", "return user.name + user.email;") }, CONFIG2], focusPath: "src/case.ts", expectedCount: 0, public: true },
     { id: "scalar-helper", scenarioId: "local-scalar-helper", title: "Only the name crosses a local scalar helper call", outcome: "match", files: [{ path: "src/case.ts", source: HELPER_EXAMPLE }, CONFIG2], focusPath: "src/case.ts", expectedCount: 1, public: true, fixedFiles: [{ path: "src/case.ts", source: HELPER_EXAMPLE.replace("email: string;", "") }] },
-    { id: "helper-and-other-field", scenarioId: "local-scalar-helper", title: "The consumer still requires a separately read field", outcome: "no-match", files: [{ path: "src/case.ts", source: HELPER_EXAMPLE.replace("return formatName(user.name);", "return formatName(user.name) + user.email;") }, CONFIG2], focusPath: "src/case.ts", expectedCount: 0, public: true }
+    { id: "helper-and-other-field", scenarioId: "local-scalar-helper", title: "The consumer still requires a separately read field", outcome: "no-match", files: [{ path: "src/case.ts", source: HELPER_EXAMPLE.replace("return formatName(user.name);", "return formatName(user.name) + user.email;") }, CONFIG2], focusPath: "src/case.ts", expectedCount: 0, public: true },
+    { id: "unread-nullable-field", scenarioId: "nullable-private-field", title: "A required nullable field is never inspected", outcome: "match", files: [{ path: "src/case.ts", source: NULLABLE_EXAMPLE }, CONFIG2], focusPath: "src/case.ts", expectedCount: 1, public: true, fixedFiles: [{ path: "src/case.ts", source: NULLABLE_EXAMPLE.replace("email: string | null;", "") }] },
+    { id: "read-nullable-field", scenarioId: "nullable-private-field", title: "An inspected nullable field keeps its contract", outcome: "no-match", files: [{ path: "src/case.ts", source: NULLABLE_EXAMPLE.replace("return user.name;", "return user.email ?? user.name;") }, CONFIG2], focusPath: "src/case.ts", expectedCount: 0, public: true }
   ]
 };
-function inlineFields(node) {
+function inlineFields(node, reads) {
   const fields2 = /* @__PURE__ */ new Map();
   for (const member3 of node.members) {
-    if (!import_typescript8.default.isPropertySignature(member3) || !member3.name || !import_typescript8.default.isIdentifier(member3.name) && !import_typescript8.default.isStringLiteralLike(member3.name) || (member3.modifiers?.length ?? 0) > 1 || member3.modifiers?.some((modifier) => modifier.kind !== import_typescript8.default.SyntaxKind.ReadonlyKeyword) || !primitiveKeyword(member3.type)) return null;
+    if (!import_typescript8.default.isPropertySignature(member3) || !member3.name || !import_typescript8.default.isIdentifier(member3.name) && !import_typescript8.default.isStringLiteralLike(member3.name) || (member3.modifiers?.length ?? 0) > 1 || member3.modifiers?.some((modifier) => modifier.kind !== import_typescript8.default.SyntaxKind.ReadonlyKeyword)) return null;
     const key = member3.name.text;
+    if (!primitiveKeyword(member3.type) && (member3.questionToken || reads.has(key) || !nullishPrimitiveUnion(member3.type))) return null;
     if (fields2.has(key)) return null;
     fields2.set(key, !member3.questionToken);
   }
   return fields2;
 }
+function nullishPrimitiveUnion(node) {
+  return node !== void 0 && import_typescript8.default.isUnionTypeNode(node) && node.types.length === 2 && node.types.some(primitiveKeyword) && node.types.some((part) => part.kind === import_typescript8.default.SyntaxKind.UndefinedKeyword || import_typescript8.default.isLiteralTypeNode(part) && part.literal.kind === import_typescript8.default.SyntaxKind.NullKeyword);
+}
 var prefer_minimal_parameter_contract_default = createRule({
   name: "prefer-minimal-parameter-contract",
   documentation: PREFER_MINIMAL_PARAMETER_CONTRACT_DOCUMENTATION,
@@ -2834,7 +2887,7 @@ var prefer_minimal_parameter_contract_default = createRule({
           const consumer = privateScalarConsumer(candidate2, context.sourceCode, services, exports2, true);
           const annotation = consumer?.parameter.type;
           if (!consumer || !annotation || !import_typescript8.default.isTypeLiteralNode(annotation)) continue;
-          const fields2 = inlineFields(annotation);
+          const fields2 = inlineFields(annotation, consumer.reads);
           if (!fields2 || [...consumer.reads].some((key) => !fields2.has(key)) || ![...consumer.reads].some((key) => fields2.get(key))) continue;
           const unused = [...fields2].filter(([key, required]) => required && !consumer.reads.has(key)).map(([key]) => key).sort();
           if (!unused.length) continue;
@@ -3954,7 +4007,7 @@ function isSearchParamReceiver(call, services) {
 // package.json
 var package_default = {
   name: "@sarj/eslint-plugin",
-  version: "16.36.1",
+  version: "16.36.5",
   packageManager: "npm@12.2.1",
   description: "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   type: "module",

package/dist/index.js

@@ -1877,7 +1877,7 @@ var NO_TEST_COMMENTS_DOCUMENTATION = {
   autofix: "safe",
   limitations: [
     "Checks actual line and block comment tokens in recognized maintained test files, including test fixtures; strings and template text remain unchanged. Generated/vendor files are excluded.",
-    "Legal notices, shebangs, TypeScript triple-slash references, coverage/build annotations and explicit lint/type/test/formatter directives remain allowed. Ordinary prose embedded in a directive remains the owning tool's responsibility.",
+    "Legal notices, shebangs, TypeScript triple-slash references, coverage/build annotations and explicit lint/type/test/formatter directives remain allowed. Executable detect-secrets 1.5.0 allowlist/whitelist pragmas retain its case-sensitive delimiter, spacing, physical-line and next-line grammar; arbitrary pragma prose remains ordinary commentary. Rationale on an executable directive remains the owning tool's responsibility.",
     "The automatic fix removes comments and adjacent padding while retaining every line ending and necessary token boundary; it does not rename tests or remove executable statements. Bare integration/e2e directories and ambiguous hyphen/underscore test basenames require another concrete test-path signal or a runtime testing-framework import; ordinary production integration modules and rule implementations ending in -test are preserved."
   ],
   examples: [
@@ -1888,6 +1888,52 @@ var NO_TEST_COMMENTS_DOCUMENTATION = {
 var DIRECTIVE = /^(?:eslint(?:-\S+)?\b|(?:biome|oxlint|jshint|jslint|c8|v8|istanbul|vitest|prettier|dprint)\b|@(?:ts-(?:check|nocheck|expect-error|ignore)|vitest-environment|jest-environment|jsx\w*|license|preserve)\b|[#!]\s*__(?:PURE|NO_SIDE_EFFECTS)__|\/\s*<(?:reference|amd-module|amd-dependency)\b)/u;
 var LEGAL = /(?:^|\n)\s*\*?\s*(?:Copyright\b|SPDX-License-Identifier:|Licensed under\b|@license\b|@preserve\b)/iu;
 var TYPE_CONTRACT = /@(?:type|typedef|template|param|returns?|satisfies|callback|overload|implements|extends|augments|enum|this|import)\b/u;
+var DETECT_SECRETS_COMMENT_MARKERS = [
+  { start: "#", end: "" },
+  { start: "//", end: "" },
+  { start: "/\\*", end: " *\\*/" },
+  { start: "'", end: "" },
+  { start: "--", end: "" },
+  { start: "<!--[# \\t]*?", end: " *?-->" }
+];
+var DETECT_SECRETS_PRAGMAS = DETECT_SECRETS_COMMENT_MARKERS.flatMap(({ start, end }) => [
+  { nextLine: false, pattern: new RegExp(`[ \\t]*${start} *pragma: ?(?:allow|white)list[ -]secret[^\\n]*?${end}[ \\t]*(?![\\s\\S])`, "u") },
+  { nextLine: true, pattern: new RegExp(`^[ \\t]*${start} *pragma: ?allowlist[ -]nextline[ -]secret[^\\n]*?${end}[ \\t]*(?![\\s\\S])`, "u") }
+]);
+var PYTHON_WHITESPACE = new RegExp("\\p{White_Space}", "u");
+var PYTHON_EXTRA_WHITESPACE = /* @__PURE__ */ new Set(["", "", "", ""]);
+function hasDetectSecretsPragma(comment, text) {
+  if (!comment.value.includes("pragma:")) return false;
+  let lineStart = Math.max(text.lastIndexOf("\r", comment.range[0] - 1), text.lastIndexOf("\n", comment.range[0] - 1)) + 1;
+  while (lineStart < comment.range[1]) {
+    const nextCr = text.indexOf("\r", lineStart);
+    const nextLf = text.indexOf("\n", lineStart);
+    const lineEnd = Math.min(nextCr < 0 ? text.length : nextCr, nextLf < 0 ? text.length : nextLf);
+    if (hasPragmaInReaderLine(comment, text.slice(lineStart, lineEnd), lineStart)) return true;
+    lineStart = lineEnd + (text[lineEnd] === "\r" && text[lineEnd + 1] === "\n" ? 2 : 1);
+  }
+  return false;
+}
+function hasPragmaInReaderLine(comment, rawLine, lineStart) {
+  const sameLine = stripPythonTrailingWhitespace(rawLine);
+  for (const { nextLine, pattern } of DETECT_SECRETS_PRAGMAS) {
+    const column = nextLine ? 0 : Math.max(0, comment.range[0] - lineStart);
+    const match = pattern.exec((nextLine ? rawLine : sameLine).slice(column));
+    if (match === null) continue;
+    const pragmaStart = lineStart + column + match.index + match[0].indexOf("pragma:");
+    if (pragmaStart >= comment.range[0] && pragmaStart < comment.range[1]) return true;
+  }
+  return false;
+}
+function stripPythonTrailingWhitespace(value) {
+  let end = value.length;
+  while (end > 0) {
+    const character = value.charAt(end - 1);
+    if (!PYTHON_WHITESPACE.test(character) && !PYTHON_EXTRA_WHITESPACE.has(character)) break;
+    end--;
+  }
+  return value.slice(0, end);
+}
 var no_test_comments_default = createRule({
   name: "no-test-comments",
   documentation: NO_TEST_COMMENTS_DOCUMENTATION,
@@ -1924,7 +1970,7 @@ var no_test_comments_default = createRule({
         }
         for (const [index, comment] of comments.entries()) {
           const body3 = comment.value.trim().replace(/^\*\s*/u, "");
-          if (DIRECTIVE.test(body3) || LEGAL.test(comment.value) || legalLines.has(index) || TYPE_CONTRACT.test(comment.value)) continue;
+          if (DIRECTIVE.test(body3) || LEGAL.test(comment.value) || legalLines.has(index) || TYPE_CONTRACT.test(comment.value) || hasDetectSecretsPragma(comment, context.sourceCode.text)) continue;
           context.report({
             node: comment,
             messageId: "testComment",
@@ -2722,6 +2768,7 @@ import ts8 from "typescript";
 var CONFIG2 = { path: "tsconfig.json", source: '{"compilerOptions":{"strict":true,"target":"ESNext","module":"ESNext","moduleResolution":"Bundler"}}' };
 var EXAMPLE2 = 'export {}; const account = {name: "Ada", email: "a"}; function label(user: {readonly email: string; readonly name: string}): string {return user.name;} label(account);';
 var HELPER_EXAMPLE = 'export {}; const account = {name: "Ada", email: "a"}; function formatName(name: string): string {return name.toUpperCase();} function label(user: {email: string; name: string}): string {return formatName(user.name);} label(account);';
+var NULLABLE_EXAMPLE = 'export {}; const account = {name: "Ada", email: null}; function label(user: {email: string | null; name: string}): string {return user.name;} label(account);';
 var PREFER_MINIMAL_PARAMETER_CONTRACT_DOCUMENTATION = {
   defaultLevel: "warning",
   summary: "Prefer the proven read-only subset for a private consumer parameter.",
@@ -2732,26 +2779,32 @@ var PREFER_MINIMAL_PARAMETER_CONTRACT_DOCUMENTATION = {
   limitations: [
     "Automatic fixes additionally require every existing identifier caller to be natively assignable to the original contract, without Any, unknown, error or unresolved types on the relevant surface. Comments inside the annotation and TypeScript suppression directives keep the finding manual. Only unread required property signatures are removed; every read or optional member, modifier and terminator token is preserved. Edits that would merge distinct CR and LF terminators remain manual.",
     "Requires parser-owned TypeScript information and a strict external module. Only top-level private function declarations and raw const arrows with exactly one explicit parameter and an independent broad primitive return annotation are supported. Every callable reference must be a direct call with one identifier argument; exports including type-only exports, typeof queries, callbacks, storage, constructors, contextual signatures, overloads, generics, decorators, async functions and direct eval prevent findings.",
-    "Only anonymous inline contracts made of broad string, number, boolean or bigint property types are supported. Fields may be plain or readonly; the consumer body must still prove read-only usage. Retained field modifiers and optional members are preserved. Named domain contracts, brands, literal discriminants, classes, methods, callbacks, indexes, mapped types and imported parameter contracts are excluded. At least one read required field and one unread required field must be established; all-optional reduced contracts can reject existing callers through weak-type checks.",
+    "Only anonymous inline contracts made of broad string, number, boolean or bigint property types are supported. An unread required field may additionally have exactly one such keyword and null or undefined in a direct two-part union; read or optional nullable fields and more complex unions remain excluded. Fields may be plain or readonly; the consumer body must still prove read-only usage. Retained field modifiers and optional members are preserved. Named domain contracts, brands, literal discriminants, classes, methods, callbacks, indexes, mapped types and imported parameter contracts are excluded. At least one read required field and one unread required field must be established; all-optional reduced contracts can reject existing callers through weak-type checks.",
     "The single return expression may use only fixed scalar field reads, flat destructuring, literals, operators, templates and scalar calls to same-file implemented top-level functions or raw const arrows with an explicit return annotation. These calls require one native resolved declaration, no generic or predicate signature, scalar arguments/result and complete active native checking of the local implementation file. Their helper bodies need not be pure because only scalar values cross the call and only an erased parameter annotation changes. Imported, aliased, ambient, overloaded, optional, spread and member calls remain unsupported. Bound destructured fields count as reads even when their local aliases are unused. Whole-object escape, identity, mutation, closures, reflection, serialization, dynamic keys, implicit Object capabilities and JSX are unsupported. Unknown semantic information causes abstention. Findings outside the fix proof remain manual; this is not a requirement to minimize every object or discard useful producer fields."
   ],
   examples: [
     { id: "unused-required-field", title: "A private name consumer unnecessarily requires email", outcome: "match", files: [{ path: "src/case.ts", source: EXAMPLE2 }, CONFIG2], focusPath: "src/case.ts", expectedCount: 1, public: true, fixedFiles: [{ path: "src/case.ts", source: EXAMPLE2.replace("readonly email: string;", "") }] },
     { id: "used-fields", title: "Every required dependency is read", outcome: "no-match", files: [{ path: "src/case.ts", source: EXAMPLE2.replace("return user.name;", "return user.name + user.email;") }, CONFIG2], focusPath: "src/case.ts", expectedCount: 0, public: true },
     { id: "scalar-helper", scenarioId: "local-scalar-helper", title: "Only the name crosses a local scalar helper call", outcome: "match", files: [{ path: "src/case.ts", source: HELPER_EXAMPLE }, CONFIG2], focusPath: "src/case.ts", expectedCount: 1, public: true, fixedFiles: [{ path: "src/case.ts", source: HELPER_EXAMPLE.replace("email: string;", "") }] },
-    { id: "helper-and-other-field", scenarioId: "local-scalar-helper", title: "The consumer still requires a separately read field", outcome: "no-match", files: [{ path: "src/case.ts", source: HELPER_EXAMPLE.replace("return formatName(user.name);", "return formatName(user.name) + user.email;") }, CONFIG2], focusPath: "src/case.ts", expectedCount: 0, public: true }
+    { id: "helper-and-other-field", scenarioId: "local-scalar-helper", title: "The consumer still requires a separately read field", outcome: "no-match", files: [{ path: "src/case.ts", source: HELPER_EXAMPLE.replace("return formatName(user.name);", "return formatName(user.name) + user.email;") }, CONFIG2], focusPath: "src/case.ts", expectedCount: 0, public: true },
+    { id: "unread-nullable-field", scenarioId: "nullable-private-field", title: "A required nullable field is never inspected", outcome: "match", files: [{ path: "src/case.ts", source: NULLABLE_EXAMPLE }, CONFIG2], focusPath: "src/case.ts", expectedCount: 1, public: true, fixedFiles: [{ path: "src/case.ts", source: NULLABLE_EXAMPLE.replace("email: string | null;", "") }] },
+    { id: "read-nullable-field", scenarioId: "nullable-private-field", title: "An inspected nullable field keeps its contract", outcome: "no-match", files: [{ path: "src/case.ts", source: NULLABLE_EXAMPLE.replace("return user.name;", "return user.email ?? user.name;") }, CONFIG2], focusPath: "src/case.ts", expectedCount: 0, public: true }
   ]
 };
-function inlineFields(node) {
+function inlineFields(node, reads) {
   const fields2 = /* @__PURE__ */ new Map();
   for (const member3 of node.members) {
-    if (!ts8.isPropertySignature(member3) || !member3.name || !ts8.isIdentifier(member3.name) && !ts8.isStringLiteralLike(member3.name) || (member3.modifiers?.length ?? 0) > 1 || member3.modifiers?.some((modifier) => modifier.kind !== ts8.SyntaxKind.ReadonlyKeyword) || !primitiveKeyword(member3.type)) return null;
+    if (!ts8.isPropertySignature(member3) || !member3.name || !ts8.isIdentifier(member3.name) && !ts8.isStringLiteralLike(member3.name) || (member3.modifiers?.length ?? 0) > 1 || member3.modifiers?.some((modifier) => modifier.kind !== ts8.SyntaxKind.ReadonlyKeyword)) return null;
     const key = member3.name.text;
+    if (!primitiveKeyword(member3.type) && (member3.questionToken || reads.has(key) || !nullishPrimitiveUnion(member3.type))) return null;
     if (fields2.has(key)) return null;
     fields2.set(key, !member3.questionToken);
   }
   return fields2;
 }
+function nullishPrimitiveUnion(node) {
+  return node !== void 0 && ts8.isUnionTypeNode(node) && node.types.length === 2 && node.types.some(primitiveKeyword) && node.types.some((part) => part.kind === ts8.SyntaxKind.UndefinedKeyword || ts8.isLiteralTypeNode(part) && part.literal.kind === ts8.SyntaxKind.NullKeyword);
+}
 var prefer_minimal_parameter_contract_default = createRule({
   name: "prefer-minimal-parameter-contract",
   documentation: PREFER_MINIMAL_PARAMETER_CONTRACT_DOCUMENTATION,
@@ -2783,7 +2836,7 @@ var prefer_minimal_parameter_contract_default = createRule({
           const consumer = privateScalarConsumer(candidate2, context.sourceCode, services, exports, true);
           const annotation = consumer?.parameter.type;
           if (!consumer || !annotation || !ts8.isTypeLiteralNode(annotation)) continue;
-          const fields2 = inlineFields(annotation);
+          const fields2 = inlineFields(annotation, consumer.reads);
           if (!fields2 || [...consumer.reads].some((key) => !fields2.has(key)) || ![...consumer.reads].some((key) => fields2.get(key))) continue;
           const unused = [...fields2].filter(([key, required]) => required && !consumer.reads.has(key)).map(([key]) => key).sort();
           if (!unused.length) continue;
@@ -3907,7 +3960,7 @@ function isSearchParamReceiver(call, services) {
 // package.json
 var package_default = {
   name: "@sarj/eslint-plugin",
-  version: "16.36.1",
+  version: "16.36.5",
   packageManager: "npm@12.2.1",
   description: "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   type: "module",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "16.36.1",
+  "version": "16.36.5",
   "packageManager": "npm@12.2.1",
   "description": "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",