@sarj/eslint-plugin 16.36.3 → 16.36.5

package/dist/index.cjs

@@ -1928,7 +1928,7 @@ var NO_TEST_COMMENTS_DOCUMENTATION = {
   autofix: "safe",
   limitations: [
     "Checks actual line and block comment tokens in recognized maintained test files, including test fixtures; strings and template text remain unchanged. Generated/vendor files are excluded.",
-    "Legal notices, shebangs, TypeScript triple-slash references, coverage/build annotations and explicit lint/type/test/formatter directives remain allowed. Ordinary prose embedded in a directive remains the owning tool's responsibility.",
+    "Legal notices, shebangs, TypeScript triple-slash references, coverage/build annotations and explicit lint/type/test/formatter directives remain allowed. Executable detect-secrets 1.5.0 allowlist/whitelist pragmas retain its case-sensitive delimiter, spacing, physical-line and next-line grammar; arbitrary pragma prose remains ordinary commentary. Rationale on an executable directive remains the owning tool's responsibility.",
     "The automatic fix removes comments and adjacent padding while retaining every line ending and necessary token boundary; it does not rename tests or remove executable statements. Bare integration/e2e directories and ambiguous hyphen/underscore test basenames require another concrete test-path signal or a runtime testing-framework import; ordinary production integration modules and rule implementations ending in -test are preserved."
   ],
   examples: [
@@ -1939,6 +1939,52 @@ var NO_TEST_COMMENTS_DOCUMENTATION = {
 var DIRECTIVE = /^(?:eslint(?:-\S+)?\b|(?:biome|oxlint|jshint|jslint|c8|v8|istanbul|vitest|prettier|dprint)\b|@(?:ts-(?:check|nocheck|expect-error|ignore)|vitest-environment|jest-environment|jsx\w*|license|preserve)\b|[#!]\s*__(?:PURE|NO_SIDE_EFFECTS)__|\/\s*<(?:reference|amd-module|amd-dependency)\b)/u;
 var LEGAL = /(?:^|\n)\s*\*?\s*(?:Copyright\b|SPDX-License-Identifier:|Licensed under\b|@license\b|@preserve\b)/iu;
 var TYPE_CONTRACT = /@(?:type|typedef|template|param|returns?|satisfies|callback|overload|implements|extends|augments|enum|this|import)\b/u;
+var DETECT_SECRETS_COMMENT_MARKERS = [
+  { start: "#", end: "" },
+  { start: "//", end: "" },
+  { start: "/\\*", end: " *\\*/" },
+  { start: "'", end: "" },
+  { start: "--", end: "" },
+  { start: "<!--[# \\t]*?", end: " *?-->" }
+];
+var DETECT_SECRETS_PRAGMAS = DETECT_SECRETS_COMMENT_MARKERS.flatMap(({ start, end }) => [
+  { nextLine: false, pattern: new RegExp(`[ \\t]*${start} *pragma: ?(?:allow|white)list[ -]secret[^\\n]*?${end}[ \\t]*(?![\\s\\S])`, "u") },
+  { nextLine: true, pattern: new RegExp(`^[ \\t]*${start} *pragma: ?allowlist[ -]nextline[ -]secret[^\\n]*?${end}[ \\t]*(?![\\s\\S])`, "u") }
+]);
+var PYTHON_WHITESPACE = new RegExp("\\p{White_Space}", "u");
+var PYTHON_EXTRA_WHITESPACE = /* @__PURE__ */ new Set(["", "", "", ""]);
+function hasDetectSecretsPragma(comment, text) {
+  if (!comment.value.includes("pragma:")) return false;
+  let lineStart = Math.max(text.lastIndexOf("\r", comment.range[0] - 1), text.lastIndexOf("\n", comment.range[0] - 1)) + 1;
+  while (lineStart < comment.range[1]) {
+    const nextCr = text.indexOf("\r", lineStart);
+    const nextLf = text.indexOf("\n", lineStart);
+    const lineEnd = Math.min(nextCr < 0 ? text.length : nextCr, nextLf < 0 ? text.length : nextLf);
+    if (hasPragmaInReaderLine(comment, text.slice(lineStart, lineEnd), lineStart)) return true;
+    lineStart = lineEnd + (text[lineEnd] === "\r" && text[lineEnd + 1] === "\n" ? 2 : 1);
+  }
+  return false;
+}
+function hasPragmaInReaderLine(comment, rawLine, lineStart) {
+  const sameLine = stripPythonTrailingWhitespace(rawLine);
+  for (const { nextLine, pattern } of DETECT_SECRETS_PRAGMAS) {
+    const column = nextLine ? 0 : Math.max(0, comment.range[0] - lineStart);
+    const match = pattern.exec((nextLine ? rawLine : sameLine).slice(column));
+    if (match === null) continue;
+    const pragmaStart = lineStart + column + match.index + match[0].indexOf("pragma:");
+    if (pragmaStart >= comment.range[0] && pragmaStart < comment.range[1]) return true;
+  }
+  return false;
+}
+function stripPythonTrailingWhitespace(value) {
+  let end = value.length;
+  while (end > 0) {
+    const character = value.charAt(end - 1);
+    if (!PYTHON_WHITESPACE.test(character) && !PYTHON_EXTRA_WHITESPACE.has(character)) break;
+    end--;
+  }
+  return value.slice(0, end);
+}
 var no_test_comments_default = createRule({
   name: "no-test-comments",
   documentation: NO_TEST_COMMENTS_DOCUMENTATION,
@@ -1975,7 +2021,7 @@ var no_test_comments_default = createRule({
         }
         for (const [index, comment] of comments.entries()) {
           const body3 = comment.value.trim().replace(/^\*\s*/u, "");
-          if (DIRECTIVE.test(body3) || LEGAL.test(comment.value) || legalLines.has(index) || TYPE_CONTRACT.test(comment.value)) continue;
+          if (DIRECTIVE.test(body3) || LEGAL.test(comment.value) || legalLines.has(index) || TYPE_CONTRACT.test(comment.value) || hasDetectSecretsPragma(comment, context.sourceCode.text)) continue;
           context.report({
             node: comment,
             messageId: "testComment",
@@ -3961,7 +4007,7 @@ function isSearchParamReceiver(call, services) {
 // package.json
 var package_default = {
   name: "@sarj/eslint-plugin",
-  version: "16.36.3",
+  version: "16.36.5",
   packageManager: "npm@12.2.1",
   description: "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   type: "module",

package/dist/index.js

@@ -1877,7 +1877,7 @@ var NO_TEST_COMMENTS_DOCUMENTATION = {
   autofix: "safe",
   limitations: [
     "Checks actual line and block comment tokens in recognized maintained test files, including test fixtures; strings and template text remain unchanged. Generated/vendor files are excluded.",
-    "Legal notices, shebangs, TypeScript triple-slash references, coverage/build annotations and explicit lint/type/test/formatter directives remain allowed. Ordinary prose embedded in a directive remains the owning tool's responsibility.",
+    "Legal notices, shebangs, TypeScript triple-slash references, coverage/build annotations and explicit lint/type/test/formatter directives remain allowed. Executable detect-secrets 1.5.0 allowlist/whitelist pragmas retain its case-sensitive delimiter, spacing, physical-line and next-line grammar; arbitrary pragma prose remains ordinary commentary. Rationale on an executable directive remains the owning tool's responsibility.",
     "The automatic fix removes comments and adjacent padding while retaining every line ending and necessary token boundary; it does not rename tests or remove executable statements. Bare integration/e2e directories and ambiguous hyphen/underscore test basenames require another concrete test-path signal or a runtime testing-framework import; ordinary production integration modules and rule implementations ending in -test are preserved."
   ],
   examples: [
@@ -1888,6 +1888,52 @@ var NO_TEST_COMMENTS_DOCUMENTATION = {
 var DIRECTIVE = /^(?:eslint(?:-\S+)?\b|(?:biome|oxlint|jshint|jslint|c8|v8|istanbul|vitest|prettier|dprint)\b|@(?:ts-(?:check|nocheck|expect-error|ignore)|vitest-environment|jest-environment|jsx\w*|license|preserve)\b|[#!]\s*__(?:PURE|NO_SIDE_EFFECTS)__|\/\s*<(?:reference|amd-module|amd-dependency)\b)/u;
 var LEGAL = /(?:^|\n)\s*\*?\s*(?:Copyright\b|SPDX-License-Identifier:|Licensed under\b|@license\b|@preserve\b)/iu;
 var TYPE_CONTRACT = /@(?:type|typedef|template|param|returns?|satisfies|callback|overload|implements|extends|augments|enum|this|import)\b/u;
+var DETECT_SECRETS_COMMENT_MARKERS = [
+  { start: "#", end: "" },
+  { start: "//", end: "" },
+  { start: "/\\*", end: " *\\*/" },
+  { start: "'", end: "" },
+  { start: "--", end: "" },
+  { start: "<!--[# \\t]*?", end: " *?-->" }
+];
+var DETECT_SECRETS_PRAGMAS = DETECT_SECRETS_COMMENT_MARKERS.flatMap(({ start, end }) => [
+  { nextLine: false, pattern: new RegExp(`[ \\t]*${start} *pragma: ?(?:allow|white)list[ -]secret[^\\n]*?${end}[ \\t]*(?![\\s\\S])`, "u") },
+  { nextLine: true, pattern: new RegExp(`^[ \\t]*${start} *pragma: ?allowlist[ -]nextline[ -]secret[^\\n]*?${end}[ \\t]*(?![\\s\\S])`, "u") }
+]);
+var PYTHON_WHITESPACE = new RegExp("\\p{White_Space}", "u");
+var PYTHON_EXTRA_WHITESPACE = /* @__PURE__ */ new Set(["", "", "", ""]);
+function hasDetectSecretsPragma(comment, text) {
+  if (!comment.value.includes("pragma:")) return false;
+  let lineStart = Math.max(text.lastIndexOf("\r", comment.range[0] - 1), text.lastIndexOf("\n", comment.range[0] - 1)) + 1;
+  while (lineStart < comment.range[1]) {
+    const nextCr = text.indexOf("\r", lineStart);
+    const nextLf = text.indexOf("\n", lineStart);
+    const lineEnd = Math.min(nextCr < 0 ? text.length : nextCr, nextLf < 0 ? text.length : nextLf);
+    if (hasPragmaInReaderLine(comment, text.slice(lineStart, lineEnd), lineStart)) return true;
+    lineStart = lineEnd + (text[lineEnd] === "\r" && text[lineEnd + 1] === "\n" ? 2 : 1);
+  }
+  return false;
+}
+function hasPragmaInReaderLine(comment, rawLine, lineStart) {
+  const sameLine = stripPythonTrailingWhitespace(rawLine);
+  for (const { nextLine, pattern } of DETECT_SECRETS_PRAGMAS) {
+    const column = nextLine ? 0 : Math.max(0, comment.range[0] - lineStart);
+    const match = pattern.exec((nextLine ? rawLine : sameLine).slice(column));
+    if (match === null) continue;
+    const pragmaStart = lineStart + column + match.index + match[0].indexOf("pragma:");
+    if (pragmaStart >= comment.range[0] && pragmaStart < comment.range[1]) return true;
+  }
+  return false;
+}
+function stripPythonTrailingWhitespace(value) {
+  let end = value.length;
+  while (end > 0) {
+    const character = value.charAt(end - 1);
+    if (!PYTHON_WHITESPACE.test(character) && !PYTHON_EXTRA_WHITESPACE.has(character)) break;
+    end--;
+  }
+  return value.slice(0, end);
+}
 var no_test_comments_default = createRule({
   name: "no-test-comments",
   documentation: NO_TEST_COMMENTS_DOCUMENTATION,
@@ -1924,7 +1970,7 @@ var no_test_comments_default = createRule({
         }
         for (const [index, comment] of comments.entries()) {
           const body3 = comment.value.trim().replace(/^\*\s*/u, "");
-          if (DIRECTIVE.test(body3) || LEGAL.test(comment.value) || legalLines.has(index) || TYPE_CONTRACT.test(comment.value)) continue;
+          if (DIRECTIVE.test(body3) || LEGAL.test(comment.value) || legalLines.has(index) || TYPE_CONTRACT.test(comment.value) || hasDetectSecretsPragma(comment, context.sourceCode.text)) continue;
           context.report({
             node: comment,
             messageId: "testComment",
@@ -3914,7 +3960,7 @@ function isSearchParamReceiver(call, services) {
 // package.json
 var package_default = {
   name: "@sarj/eslint-plugin",
-  version: "16.36.3",
+  version: "16.36.5",
   packageManager: "npm@12.2.1",
   description: "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   type: "module",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "16.36.3",
+  "version": "16.36.5",
   "packageManager": "npm@12.2.1",
   "description": "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",