@sarj/eslint-plugin 19.14.0 → 19.15.0

package/dist/catalog.js

@@ -2,7 +2,7 @@ import {
   publicDocumentation,
   ruleSpec,
   src_default
-} from "./chunk-YWEV6GQM.js";
+} from "./chunk-SIHWYU24.js";
 
 // src/docs/directive-disable-enable-pair.ts
 var DIRECTIVE_DISABLE_ENABLE_PAIR_DOCUMENTATION = {
@@ -2523,8 +2523,13 @@ var NO_RAW_ENV_DOCUMENTATION = {
   remediation: "Define a Zod settings schema, call SettingsSchema.parse(process.env) once at startup, and export or inject that single parsed settings object. Use Pydantic/Pydantic Settings for the equivalent Python boundary. Required values must fail before remote effects; preserve independent security policy and existing optional defaults.",
   category: "correctness",
   limitations: [
-    "Host markers, assignment targets, tests, ordinary scripts and build config retain their policy exemptions. Boundary-named modules, including env.mjs and settings.ts, are checked. A boundary filename or schema declaration alone does not exempt raw reads: each read must flow through a parse/safeParse/createEnv argument, directly or through stable nonexported const aliases whose every use reaches validation. Only unshadowed Number/String/Boolean/BigInt calls are traversed as scalar coercions; arbitrary calls cannot consume raw settings before the parser.",
-    "This is bounded same-file syntax analysis (24 flow steps, 128 reads per alias and 512 total expression visits per raw read); flows exceeding these budgets are unreported. It does not prove a parser's implementation, cross-file schemas, schema completeness, safeParse failure handling or a project-wide singleton. Handle safeParse failure before exposing result.data; prefer throwing parse at startup. Nested component settings and separate server/client runtime boundaries remain valid.",
+    "Host markers, assignment targets, tests, ordinary scripts and build config retain their policy exemptions. Boundary-named modules, including env.mjs and settings.ts, are checked. Native named process env imports and simple const { env } = process aliases follow the same read policy; foreign, type-only, shadowed and mutable sources are not inferred.",
+    "Each raw value must reach a parse/safeParse argument or supported environment loader, directly or through stable nonexported const aliases whose every use reaches validation. Directly awaited parseAsync/safeParseAsync calls also count; unawaited promises or later await-through-alias flows do not. Conditional tests and logical-and conditions are control inputs, not the parsed result; value arms and existing nullish/logical-or defaults remain supported.",
+    "Simple nonexported const object patterns may select static keys into plain identifier bindings when every ordinary read of each selected field reaches validation. Type-only references are ignored. Native whole-environment host marker keys retain their exemptions, including through stable aliases; an arbitrary raw field with a marker-shaped property does not. Unused, unparsed, escaping or later-written ordinary fields fail the proof. Opaque computed keys, defaults, rest and nested patterns remain unsupported.",
+    "Renamed value imports of createEnv from @t3-oss/env-core or @t3-oss/env-nextjs retain loader ownership. Existing unresolved project parse/safeParse and legacy createEnv protocols remain accepted; this is not a proof of their implementation. A narrowly proven private identity adapter only forwards its input: that input must still reach an actual parser.",
+    "Identity-adapter detection is limited to an explicit module, no namespace or runtime eval reference, one stable nonexported binding and a synchronous function whose sole plain identifier parameter is returned unchanged. An object may contain only one or two unique own parse/safeParse identity methods, with every ordinary receiver reference a direct method call. Exported/mutable/escaped receivers, spreads, getters, duplicate/opaque keys, extra methods, imported loaders, real Zod wrappers and optional/awaited adapter-result ambiguity retain the existing protocol. The proof stops after 128 binding references, 512 module references or 32 enclosing AST parents; it adds no whole-program library-provenance requirement.",
+    "Only unshadowed Number/String/Boolean/BigInt calls and one-argument native JSON decoding are traversed as preprocessing. JSON.parse alone does not validate settings: its decoded result must itself reach the parser. JSON revivers and arbitrary calls cannot consume raw settings under this preprocessing exemption.",
+    "This is bounded same-file syntax analysis (24 flow steps, 128 selected fields per pattern, 128 reads per binding and 512 total expression/field visits per raw read; whole-environment host-marker provenance follows at most 16 aliases); flows exceeding these budgets are unreported. It does not prove a parser's implementation, cross-file schemas, schema completeness, safeParse failure handling or a project-wide singleton. Handle safeParse failure before exposing result.data; prefer throwing parse at startup. Nested component settings and separate server/client runtime boundaries remain valid.",
     "Assignment-target exemptions also include compound writes that read the previous value. Whole-environment spreads outside boundary modules retain the existing forwarding exemption; a spread inside a boundary must also reach its parser. No automatic rewrite."
   ],
   examples: [
@@ -2559,6 +2564,190 @@ var NO_RAW_ENV_DOCUMENTATION = {
       focusPath: "src/env.ts",
       expectedCount: 1,
       public: true
+    },
+    {
+      id: "native-env-import-read",
+      scenarioId: "native-env-import",
+      title: "Native env import aliases still need validation",
+      outcome: "match",
+      files: [
+        {
+          path: "src/database.ts",
+          source: 'import { env as raw } from "node:process";\nexport const databaseUrl = raw.DATABASE_URL;'
+        }
+      ],
+      focusPath: "src/database.ts",
+      expectedCount: 1,
+      public: true
+    },
+    {
+      id: "native-env-import-validated",
+      scenarioId: "native-env-import",
+      title: "Parse the imported environment once and share settings",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/database.ts",
+          source: 'import { settings } from "./env.js";\nexport const databaseUrl = settings.DATABASE_URL;'
+        },
+        {
+          path: "src/env.ts",
+          source: 'import { env as raw } from "node:process";\nimport { z } from "zod";\nconst SettingsSchema = z.object({ DATABASE_URL: z.url() });\nexport const settings = SettingsSchema.parse(raw);'
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "json-decoding-without-validation",
+      scenarioId: "json-settings",
+      title: "JSON decoding does not validate the settings contract",
+      outcome: "match",
+      files: [
+        {
+          path: "src/env.ts",
+          source: "export const settings = JSON.parse(process.env.SETTINGS_JSON);"
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 1,
+      public: true
+    },
+    {
+      id: "json-decoding-then-validation",
+      scenarioId: "json-settings",
+      title: "Validate decoded environment JSON with the actual schema",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/env.ts",
+          source: 'import { z } from "zod";\nconst SettingsSchema = z.object({ API_ORIGIN: z.url() });\nexport const settings = SettingsSchema.parse(JSON.parse(process.env.SETTINGS_JSON));'
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "raw-input-controls-effects",
+      scenarioId: "conditional-settings",
+      title: "A raw conditional input is not the value reaching the parser",
+      outcome: "match",
+      files: [
+        {
+          path: "src/env.ts",
+          source: 'import { z } from "zod";\nconst SettingsSchema = z.object({ API_ORIGIN: z.url() });\nexport const settings = SettingsSchema.parse(process.env.LOAD_REMOTE ? fetch("https://example.test/config") : {});'
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 1,
+      public: true
+    },
+    {
+      id: "validated-input-controls-effects",
+      scenarioId: "conditional-settings",
+      title: "Parse the control setting before remote effects",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/env.ts",
+          source: 'import { z } from "zod";\nconst SettingsSchema = z.object({ LOAD_REMOTE: z.enum(["0", "1"]).transform(value => value === "1") });\nexport const settings = SettingsSchema.parse(process.env);\nif (settings.LOAD_REMOTE) await fetch("https://example.test/config");'
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "async-settings-promise",
+      scenarioId: "async-settings",
+      title: "An unfinished parser promise is not startup settings",
+      outcome: "match",
+      files: [
+        {
+          path: "src/env.ts",
+          source: 'import { z } from "zod";\nconst SettingsSchema = z.object({ API_KEY: z.string().min(1) });\nexport const settings = SettingsSchema.parseAsync(process.env);'
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 1,
+      public: true
+    },
+    {
+      id: "async-settings-awaited",
+      scenarioId: "async-settings",
+      title: "Await parsing before exporting the shared settings object",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/env.ts",
+          source: 'import { z } from "zod";\nconst SettingsSchema = z.object({ API_KEY: z.string().min(1) });\nexport const settings = await SettingsSchema.parseAsync(process.env);'
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "selected-fields-raw-escape",
+      scenarioId: "selected-settings-fields",
+      title: "Parsing one selected field does not validate another raw export",
+      outcome: "match",
+      files: [
+        {
+          path: "src/env.ts",
+          source: 'import { env as raw } from "node:process";\nimport { z } from "zod";\nconst SettingsSchema = z.object({ API_KEY: z.string().min(1) });\nconst { API_KEY, API_ORIGIN } = raw;\nexport const settings = SettingsSchema.parse({ API_KEY });\nexport const unparsedOrigin = API_ORIGIN;'
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 1,
+      public: true
+    },
+    {
+      id: "selected-fields-validated",
+      scenarioId: "selected-settings-fields",
+      title: "Validate every selected ordinary field and reuse the parsed result",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/env.ts",
+          source: 'import { env as raw } from "node:process";\nimport { z } from "zod";\nconst SettingsSchema = z.object({ API_KEY: z.string().min(1), API_ORIGIN: z.url() });\nconst { API_KEY, API_ORIGIN } = raw;\nexport const settings = SettingsSchema.parse({ API_KEY, API_ORIGIN });'
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "identity-loader-without-parser",
+      scenarioId: "closed-identity-adapter",
+      title: "A local identity adapter does not validate environment input",
+      outcome: "match",
+      files: [
+        {
+          path: "src/env.ts",
+          source: "const createEnv = input => input;\nexport const settings = createEnv(process.env);"
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 1,
+      public: true
+    },
+    {
+      id: "identity-loader-before-real-parser",
+      scenarioId: "closed-identity-adapter",
+      title: "An identity adapter can forward into the actual Zod parser",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/env.ts",
+          source: 'import { z } from "zod";\nconst SettingsSchema = z.object({ API_KEY: z.string().min(1) });\nconst createEnv = input => input;\nexport const settings = SettingsSchema.parse(createEnv(process.env));'
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 0,
+      public: true
     }
   ]
 };
@@ -3205,12 +3394,13 @@ var NO_SENTINEL_RETURN_ON_CATCH_DOCUMENTATION = {
 
 // src/docs/no-server-env-in-client-component.ts
 var NO_SERVER_ENV_IN_CLIENT_COMPONENT_DOCUMENTATION = {
-  summary: "server-only environment settings imported by a client component",
-  rationale: "Next.js client modules run in the browser, where server-only environment values are unavailable; importing a server settings module can produce undefined configuration or bundle a secret-bearing module into the client graph.",
-  remediation: "Pass an explicitly public value from a Server Component, or import it from a separately validated client-settings module backed only by NEXT_PUBLIC_* values.",
+  summary: "server-only environment settings imported or re-exported by a client module",
+  rationale: "Next.js client modules run in the browser, where server-only environment values are unavailable; importing or re-exporting a server settings module can produce undefined configuration or bundle a secret-bearing module into the client graph.",
+  remediation: "Pass an explicitly public value from a Server Component, or import/re-export it from a separately validated client-settings module backed only by NEXT_PUBLIC_* values.",
   category: "correctness",
   limitations: [
-    "Only static value imports in files with a top-level 'use client' directive and conventionally named server-env/server-settings modules are checked."
+    "Only direct static runtime imports and re-exports in files with a top-level 'use client' directive targeting the existing server-env/server-settings module protocol are checked. Type-only declarations/specifiers, local exports without a source and ordinary server modules are excluded.",
+    "Dynamic imports, require calls and transitive barrel graphs are not followed. Public client-settings modules and unrelated module paths are not classified as server-only."
   ],
   examples: [
     {
@@ -3240,6 +3430,44 @@ var NO_SERVER_ENV_IN_CLIENT_COMPONENT_DOCUMENTATION = {
       focusPath: "status-card.tsx",
       expectedCount: 1,
       public: true
+    },
+    {
+      id: "public-client-settings-re-export",
+      scenarioId: "client-re-export",
+      title: "Forward public settings from the client boundary",
+      outcome: "no-match",
+      files: [
+        {
+          path: "client-barrel.tsx",
+          source: "'use client';\nexport { CLIENT_SETTINGS } from './client-settings.js';\n"
+        },
+        {
+          path: "client-settings.ts",
+          source: "import { z } from 'zod';\nconst SettingsSchema = z.object({ apiOrigin: z.url() });\nexport const CLIENT_SETTINGS = SettingsSchema.parse({ apiOrigin: process.env.NEXT_PUBLIC_API_ORIGIN });\n"
+        }
+      ],
+      focusPath: "client-barrel.tsx",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "server-settings-client-re-export",
+      scenarioId: "client-re-export",
+      title: "A client barrel cannot forward server settings",
+      outcome: "match",
+      files: [
+        {
+          path: "client-barrel.tsx",
+          source: "'use client';\nexport { SERVER_SETTINGS } from './server-settings.js';\n"
+        },
+        {
+          path: "server-settings.ts",
+          source: "import { z } from 'zod';\nconst SettingsSchema = z.object({ apiOrigin: z.url() });\nexport const SERVER_SETTINGS = SettingsSchema.parse({ apiOrigin: process.env.API_ORIGIN });\n"
+        }
+      ],
+      focusPath: "client-barrel.tsx",
+      expectedCount: 1,
+      public: true
     }
   ]
 };
@@ -4545,7 +4773,8 @@ var PREFER_CONFIGURED_CLOUD_SCOPE_DOCUMENTATION = {
   requiresTypeInformation: false,
   limitations: [
     "Initial coverage is canonical HTTPS Cloudflare v4 account-management URLs with a 32-character hexadecimal account segment sent to an unshadowed fetch, stable const alias, or fetch-default parameter. Other providers, SDKs, arbitrary endpoints, Worker names and resource IDs require separate evidence.",
-    "Follows bounded same-file const aliases, concatenations and template strings; an unknown account, mutable binding, function return, object property, fallback expression, URL/Request object or cross-file value is not inferred. Direct writes to the ambient fetch or its global receivers veto findings; indirect runtime monkeypatches are not modeled.",
+    "Follows bounded same-file const aliases, concatenations and template strings. One-argument native URL wrappers are supported only for fully known absolute account URLs whose native normalization leaves the text unchanged. Local/imported constructors, dynamic constructor arguments, relative-base URLs, Request objects, unknown accounts, fallback expressions, function returns and cross-file values remain unreported.",
+    "Native URL constructor/prototype mutation or capability capture outside new/typeof vetoes wrapper folding. Escaping/dynamic global receiver access and ambient eval/Function also leave URL semantics unknown. A stored URL must be nonexported, have at most 128 references, and every runtime read must be a direct native fetch argument; mutable instances, aliases, injected transports and other escapes remain unknown. These URL limits do not hide independent direct string fetch findings. Direct writes to ambient fetch or its global receivers retain their existing veto; indirect runtime monkeypatches are not modeled.",
     "Analysis stops at 16 nested expressions or fetch aliases, 256 URL-expression visits per request, 128 string fragments or 8,192 UTF-16 code units of assembled URL text. These limits deliberately leave more complex expressions unreported.",
     "Scripts remain covered. Test/fixture and generated files are excluded. Comparisons, schemas, allowlists and unused URL strings do not produce findings. Each originating account literal is reported at most once per file.",
     "This is a warning without an automatic fix: the deployment configuration boundary and independent authorization policy require review. Application code should import validated configuration as required by no-raw-env; browser-exposed variables must never contain secrets."
@@ -4586,6 +4815,40 @@ var PREFER_CONFIGURED_CLOUD_SCOPE_DOCUMENTATION = {
       focusPath: ".github/scripts/publish.mjs",
       expectedCount: 0,
       public: true
+    },
+    {
+      id: "native-url-literal-account",
+      scenarioId: "native-url-account",
+      title: "A native URL wrapper still fixes the outgoing account in source",
+      outcome: "match",
+      files: [
+        {
+          path: "src/cloud-client.ts",
+          source: 'export function list() { return fetch(new URL("https://api.cloudflare.com/client/v4/accounts/0123456789abcdef0123456789abcdef/workers/scripts")); }'
+        }
+      ],
+      focusPath: "src/cloud-client.ts",
+      expectedCount: 1,
+      public: true
+    },
+    {
+      id: "native-url-configured-account",
+      scenarioId: "native-url-account",
+      title: "Supply the account from shared Zod-validated settings",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/cloud-client.ts",
+          source: 'import { settings } from "./env.js";\nexport function list() { return fetch(new URL(`https://api.cloudflare.com/client/v4/accounts/${settings.CLOUDFLARE_ACCOUNT_ID}/workers/scripts`)); }'
+        },
+        {
+          path: "src/env.ts",
+          source: 'import { z } from "zod";\nconst SettingsSchema = z.object({ CLOUDFLARE_ACCOUNT_ID: z.string().length(32).regex(/^[a-fA-F0-9]+$/u) });\nexport const settings = SettingsSchema.parse(process.env);'
+        }
+      ],
+      focusPath: "src/cloud-client.ts",
+      expectedCount: 0,
+      public: true
     }
   ]
 };

package/dist/{chunk-YWEV6GQM.js → chunk-SIHWYU24.js}

@@ -15576,9 +15576,9 @@ var PLATFORM_MARKERS = /* @__PURE__ */ new Set([
   "VERCEL_ENV",
   "CI"
 ]);
-function isProcessEnv(node, sourceCode2) {
-  const receiver = unwrapExpression(node.object);
-  if (receiver.type !== "Identifier" || getPropertyName(node) !== "env") return false;
+function isNativeProcess(node, sourceCode2) {
+  const receiver = unwrapExpression(node);
+  if (receiver.type !== "Identifier") return false;
   const binding3 = findVariable(sourceCode2.getScope(receiver), receiver.name);
   if (binding3 === null || binding3.defs.length === 0) return receiver.name === "process";
   return binding3.defs.every((definition) => {
@@ -15586,6 +15586,9 @@ function isProcessEnv(node, sourceCode2) {
     return definition.type === "ImportBinding" && parent?.type === "ImportDeclaration" && parent.importKind !== "type" && PROCESS_MODULES.includes(parent.source.value) && PROCESS_IMPORT_SPECIFIERS.includes(definition.node.type);
   });
 }
+function isProcessEnv(node, sourceCode2) {
+  return getPropertyName(node) === "env" && isNativeProcess(node.object, sourceCode2);
+}
 function isImportMetaEnv(node) {
   return getPropertyName(node) === "env" && node.object.type === "MetaProperty" && node.object.meta.name === "import" && node.object.property.name === "meta";
 }
@@ -15611,37 +15614,170 @@ function isWholeEnvSpread(node) {
   const parent = parentOf(node);
   return parent?.type === "SpreadElement" && parent.argument === node;
 }
-function reachesValidation(node, sourceCode2, seen = /* @__PURE__ */ new Set(), depth = 0, budget = { remaining: 512 }) {
-  if (depth >= 24 || budget.remaining-- <= 0) return true;
+function createValidationBudget() {
+  let remaining = 512;
+  return () => remaining--;
+}
+function reachesValidation(node, sourceCode2, seen = /* @__PURE__ */ new Set(), depth = 0, budget = createValidationBudget()) {
+  if (depth >= 24 || budget() <= 0) return true;
   const parent = parentOf(node);
   if (parent === null) return false;
   switch (parent.type) {
-    case "CallExpression":
-      return parent.arguments.some((argument) => argument === node) && (isValidationCall(parent) || isScalarCoercion(parent, sourceCode2) && reachesValidation(parent, sourceCode2, seen, depth + 1, budget));
+    case "CallExpression": {
+      const identity2 = isClosedIdentityAdapter(parent, sourceCode2);
+      return parent.arguments.some((argument) => argument === node) && (!identity2 && isValidationCall(parent, sourceCode2) || (identity2 || isScalarCoercion(parent, sourceCode2) || isNativeJsonParse(parent, sourceCode2) && parent.arguments.length === 1) && reachesValidation(parent, sourceCode2, seen, depth + 1, budget));
+    }
     case "VariableDeclarator":
       return parent.init === node && validatedAlias(parent, sourceCode2, seen, depth, budget);
     case "MemberExpression":
       return parent.object === node && reachesValidation(parent, sourceCode2, seen, depth + 1, budget);
     case "Property":
       return parent.value === node && parent.kind === "init" && !parent.method && reachesValidation(parent, sourceCode2, seen, depth + 1, budget);
+    case "ConditionalExpression":
+      return parent.test !== node && reachesValidation(parent, sourceCode2, seen, depth + 1, budget);
+    case "LogicalExpression":
+      return !(parent.operator === "&&" && parent.left === node) && reachesValidation(parent, sourceCode2, seen, depth + 1, budget);
     case "ObjectExpression":
     case "ArrayExpression":
     case "SpreadElement":
-    case "LogicalExpression":
     case "BinaryExpression":
-    case "ConditionalExpression":
     case "TemplateLiteral":
     case "TSAsExpression":
     case "TSNonNullExpression":
     case "TSSatisfiesExpression":
+    case "TSTypeAssertion":
       return reachesValidation(parent, sourceCode2, seen, depth + 1, budget);
     default:
       return false;
   }
 }
-function isValidationCall(node) {
+function identityFunction(node) {
+  const value = unwrapExpression(node);
+  if (value.type !== "ArrowFunctionExpression" && value.type !== "FunctionExpression" && value.type !== "FunctionDeclaration")
+    return false;
+  if (value.async || value.type !== "ArrowFunctionExpression" && value.generator || value.params.length !== 1)
+    return false;
+  const [parameter] = value.params;
+  if (parameter?.type !== "Identifier" || value.body === null) return false;
+  let returned2 = value.body;
+  if (returned2.type === "BlockStatement") {
+    const [statement] = returned2.body;
+    if (returned2.body.length !== 1 || statement?.type !== "ReturnStatement" || statement.argument === null)
+      return false;
+    returned2 = statement.argument;
+  }
+  const result = unwrapExpression(returned2);
+  return result.type === "Identifier" && result.name === parameter.name;
+}
+function isClosedIdentityAdapter(node, sourceCode2) {
+  const callee = unwrapExpression(node.callee);
+  const member3 = callee.type === "MemberExpression" ? callee : null;
+  const receiver = member3 === null ? callee : unwrapExpression(member3.object);
+  const method = member3 === null ? null : getPropertyName(member3);
+  const output = parentOf(outerExpression(node));
+  if (node.arguments.length !== 1 || node.arguments[0]?.type === "SpreadElement" || node.optional || member3?.optional || output?.type === "AwaitExpression" || output?.type === "ChainExpression")
+    return false;
+  if (receiver.type !== "Identifier" || (member3 === null ? receiver.name !== "createEnv" : method !== "parse" && method !== "safeParse"))
+    return false;
+  const variable = findVariable(sourceCode2.getScope(receiver), receiver.name);
+  if (variable?.defs.length !== 1 || variable.references.length > 128 || !stableValueBinding(variable))
+    return false;
+  const value = privateIdentityValue(variable);
+  if (value === null) return false;
+  const methods = member3 === null ? null : identityMethods(value);
+  if (member3 !== null && (methods === null || !methods.has(method ?? ""))) return false;
+  if (member3 === null && !identityFunction(value)) return false;
+  return identityReferences(variable, methods) && closedIdentityModule(sourceCode2);
+}
+function privateIdentityValue(variable) {
+  const definition = variable.defs[0]?.node;
+  if (definition === void 0) return null;
+  let value = definition;
+  let declaration = parentOf(definition);
+  if (definition.type === "VariableDeclarator") {
+    if (definition.id.type !== "Identifier" || definition.init === null || declaration?.type !== "VariableDeclaration" || declaration.kind !== "const")
+      return null;
+    value = unwrapExpression(definition.init);
+    declaration = parentOf(declaration);
+  } else if (definition.type !== "FunctionDeclaration") return null;
+  if (declaration?.type === "ExportNamedDeclaration" || declaration?.type === "ExportDefaultDeclaration")
+    return null;
+  let ancestor = declaration;
+  let ancestors2 = 32;
+  while (ancestor !== null && ancestor.type !== "Program") {
+    if (ancestors2-- <= 0 || ancestor.type === "TSModuleBlock" || ancestor.type === "TSModuleDeclaration")
+      return null;
+    ancestor = parentOf(ancestor);
+  }
+  return value;
+}
+function closedIdentityModule(sourceCode2) {
+  if (!sourceCode2.ast.body.some(
+    (statement) => statement.type === "ImportDeclaration" || statement.type === "ExportNamedDeclaration" || statement.type === "ExportDefaultDeclaration" || statement.type === "ExportAllDeclaration"
+  ))
+    return false;
+  let remaining = 512;
+  for (const scope of sourceCode2.scopeManager.scopes) {
+    for (const reference of scope.references) {
+      if (remaining-- <= 0) return false;
+      if (reference.identifier.name === "eval" && !typeOnlyReference(tsReference(reference)))
+        return false;
+    }
+  }
+  return true;
+}
+function identityMethods(value) {
+  if (value.type !== "ObjectExpression" || value.properties.length === 0 || value.properties.length > 2)
+    return null;
+  const methods = /* @__PURE__ */ new Set();
+  for (const property of value.properties) {
+    if (property.type !== "Property" || property.kind !== "init" || !identityFunction(property.value))
+      return null;
+    const name = getPropertyName(property);
+    if (name !== "parse" && name !== "safeParse" || methods.has(name)) return null;
+    methods.add(name);
+  }
+  return methods;
+}
+function identityReferences(variable, methods) {
+  return variable.references.every((reference) => {
+    if (reference.init === true || typeOnlyReference(reference)) return true;
+    let target = outerExpression(reference.identifier);
+    if (methods !== null) {
+      const property = parentOf(target);
+      if (property?.type !== "MemberExpression" || property.object !== target || property.optional || !methods.has(getPropertyName(property) ?? ""))
+        return false;
+      target = outerExpression(property);
+    }
+    const use = parentOf(target);
+    return use?.type === "CallExpression" && use.callee === target && !use.optional && parentOf(use)?.type !== "ChainExpression";
+  });
+}
+function isValidationCall(node, sourceCode2) {
+  const callee = unwrapExpression(node.callee);
+  if (callee.type === "Identifier") {
+    if (callee.name === "createEnv") return true;
+    const binding3 = findVariable(sourceCode2.getScope(callee), callee.name);
+    const definition = binding3?.defs.length === 1 ? binding3.defs[0] : void 0;
+    const declaration = definition?.parent;
+    const specifier = definition?.node;
+    return definition?.type === "ImportBinding" && declaration?.type === "ImportDeclaration" && declaration.importKind !== "type" && ["@t3-oss/env-core", "@t3-oss/env-nextjs"].includes(declaration.source.value) && specifier?.type === "ImportSpecifier" && specifier.importKind !== "type" && importSpecifierName(specifier) === "createEnv" && binding3 !== null && stableValueBinding(binding3);
+  }
+  if (callee.type !== "MemberExpression" || isNativeJsonParse(node, sourceCode2)) return false;
+  const method = getPropertyName(callee);
+  if (method === "parse" || method === "safeParse") return true;
+  if (method !== "parseAsync" && method !== "safeParseAsync") return false;
+  const value = outerExpression(node);
+  const parent = parentOf(value);
+  return parent?.type === "AwaitExpression" && parent.argument === value;
+}
+function isNativeJsonParse(node, sourceCode2) {
   const callee = unwrapExpression(node.callee);
-  return callee.type === "Identifier" ? callee.name === "createEnv" : callee.type === "MemberExpression" && ["parse", "safeParse"].includes(getPropertyName(callee) ?? "");
+  if (callee.type !== "MemberExpression" || getPropertyName(callee) !== "parse") return false;
+  const receiver = unwrapExpression(callee.object);
+  if (receiver.type !== "Identifier" || receiver.name !== "JSON") return false;
+  const binding3 = findVariable(sourceCode2.getScope(receiver), receiver.name);
+  return binding3 === null || binding3.defs.length === 0;
 }
 function isScalarCoercion(node, sourceCode2) {
   const callee = unwrapExpression(node.callee);
@@ -15650,19 +15786,73 @@ function isScalarCoercion(node, sourceCode2) {
   const binding3 = findVariable(sourceCode2.getScope(callee), callee.name);
   return binding3 === null || binding3.defs.length === 0;
 }
+function isWholeEnvironment(node, sourceCode2, seen = /* @__PURE__ */ new Set()) {
+  const value = unwrapExpression(node);
+  if (value.type === "MemberExpression")
+    return isProcessEnv(value, sourceCode2) || isImportMetaEnv(value);
+  if (value.type !== "Identifier" || seen.size >= 16) return false;
+  const variable = stableAliasBinding(value, sourceCode2, seen);
+  const definition = variable?.defs[0];
+  if (variable === null || definition === void 0) return false;
+  const declaration = definition.parent;
+  const binding3 = definition.node;
+  if (definition.type === "ImportBinding") {
+    return declaration?.type === "ImportDeclaration" && declaration.importKind !== "type" && PROCESS_MODULES.includes(declaration.source.value) && binding3.type === "ImportSpecifier" && binding3.importKind !== "type" && importSpecifierName(binding3) === "env";
+  }
+  if (binding3.type !== "VariableDeclarator" || binding3.init === null || declaration?.type !== "VariableDeclaration" || declaration.kind !== "const")
+    return false;
+  if (binding3.id.type === "Identifier")
+    return isWholeEnvironment(binding3.init, sourceCode2, /* @__PURE__ */ new Set([...seen, variable]));
+  return binding3.id.type === "ObjectPattern" && isNativeProcess(binding3.init, sourceCode2) && binding3.id.properties.some(
+    (property) => property.type === "Property" && getPropertyName(property) === "env" && property.value.type === "Identifier" && property.value.name === value.name
+  );
+}
+function stableAliasBinding(node, sourceCode2, seen) {
+  const variable = findVariable(sourceCode2.getScope(node), node.name);
+  return variable !== null && variable.defs.length === 1 && !seen.has(variable) && stableValueBinding(variable) ? variable : null;
+}
 function validatedAlias(node, sourceCode2, seen, depth, budget) {
   const declaration = parentOf(node);
-  if (node.id.type !== "Identifier" || declaration?.type !== "VariableDeclaration" || declaration.kind !== "const")
+  if (declaration?.type !== "VariableDeclaration" || declaration.kind !== "const" || parentOf(declaration)?.type === "ExportNamedDeclaration")
     return false;
-  if (parentOf(declaration)?.type === "ExportNamedDeclaration") return false;
-  const variable = findVariable(sourceCode2.getScope(node.id), node.id.name);
-  if (variable === null || seen.has(variable) || variable.references.some((ref) => ref.isWrite() && ref.init !== true))
+  if (node.id.type === "Identifier") {
+    const variable = stableAliasBinding(node.id, sourceCode2, seen);
+    return variable !== null && validatedBinding(variable, sourceCode2, seen, depth, budget);
+  }
+  if (node.id.type !== "ObjectPattern" || node.id.properties.length === 0 || node.init === null)
     return false;
-  const reads = variable.references.filter((ref) => ref.isRead());
+  if (node.id.properties.length > 128) return true;
+  return validatedFields(node.id, node.init, sourceCode2, seen, depth, budget);
+}
+function validatedFields(pattern, input, sourceCode2, seen, depth, budget) {
+  const wholeEnvironment = isWholeEnvironment(input, sourceCode2);
+  for (const property of pattern.properties) {
+    if (budget() <= 0) return true;
+    if (property.type !== "Property" || property.value.type !== "Identifier") return false;
+    const name = getPropertyName(property);
+    if (name === null) return false;
+    const variable = stableAliasBinding(property.value, sourceCode2, seen);
+    if (variable === null) return false;
+    if (wholeEnvironment && (BUILD_TIME_CONSTANTS.has(name) || PLATFORM_MARKERS.has(name)))
+      continue;
+    if (!validatedBinding(variable, sourceCode2, seen, depth, budget)) return false;
+  }
+  return true;
+}
+function validatedBinding(variable, sourceCode2, seen, depth, budget) {
+  const reads = variable.references.filter((ref) => ref.isRead() && !typeOnlyReference(ref));
   const next = /* @__PURE__ */ new Set([...seen, variable]);
   if (reads.length > 128) return true;
   return reads.length > 0 && reads.every((ref) => reachesValidation(ref.identifier, sourceCode2, next, depth + 1, budget));
 }
+function isPlatformExtraction(node, sourceCode2) {
+  const declaration = parentOf(node);
+  return declaration?.type === "VariableDeclarator" && declaration.init === node && declaration.id.type === "ObjectPattern" && declaration.id.properties.length > 0 && declaration.id.properties.length <= 128 && declaration.id.properties.every((property) => {
+    if (property.type !== "Property" || property.value.type !== "Identifier") return false;
+    const name = getPropertyName(property);
+    return name !== null && (BUILD_TIME_CONSTANTS.has(name) || PLATFORM_MARKERS.has(name));
+  }) && isWholeEnvironment(node, sourceCode2) && validatedAlias(declaration, sourceCode2, /* @__PURE__ */ new Set(), 0, createValidationBudget());
+}
 var no_raw_env_default = defineRule({
   meta: {
     type: "problem",
@@ -15679,6 +15869,17 @@ var no_raw_env_default = defineRule({
     let sourceCode2;
     let reads = [];
     let boundaryFile = false;
+    function recordRead(node) {
+      if (!isExemptVariableAccess(node) && !isWriteTarget(node) && !isPlatformExtraction(node, sourceCode2) && !(isWholeEnvSpread(node) && !boundaryFile))
+        reads.push(node);
+    }
+    function recordAlias(node) {
+      const variable = findVariable(sourceCode2.getScope(node), node.name);
+      if (variable?.defs.length !== 1 || !stableValueBinding(variable)) return;
+      for (const reference of variable.references) {
+        if (reference.isRead() && !typeOnlyReference(reference)) recordRead(reference.identifier);
+      }
+    }
     return {
       before() {
         const filename = context.filename;
@@ -15691,11 +15892,25 @@ var no_raw_env_default = defineRule({
         reads = [];
         return void 0;
       },
-      MemberExpression(node) {
-        if ((isProcessEnv(node, sourceCode2) || isImportMetaEnv(node)) && !isExemptVariableAccess(node) && !isWriteTarget(node) && !(isWholeEnvSpread(node) && !boundaryFile)) {
-          reads.push(node);
+      ImportDeclaration(node) {
+        if (node.importKind === "type" || !PROCESS_MODULES.includes(node.source.value)) return;
+        for (const specifier of node.specifiers) {
+          if (specifier.type === "ImportSpecifier" && specifier.importKind !== "type" && importSpecifierName(specifier) === "env")
+            recordAlias(specifier.local);
+        }
+      },
+      VariableDeclarator(node) {
+        const declaration = parentOf(node);
+        if (node.id.type !== "ObjectPattern" || node.init === null || declaration?.type !== "VariableDeclaration" || declaration.kind !== "const" || !isNativeProcess(node.init, sourceCode2))
+          return;
+        for (const property of node.id.properties) {
+          if (property.type === "Property" && getPropertyName(property) === "env" && property.value.type === "Identifier")
+            recordAlias(property.value);
         }
       },
+      MemberExpression(node) {
+        if (isProcessEnv(node, sourceCode2) || isImportMetaEnv(node)) recordRead(node);
+      },
       "Program:exit"() {
         for (const node of reads) {
           if (!boundaryFile || !reachesValidation(node, sourceCode2))
@@ -18559,29 +18774,37 @@ function isTypeOnlyImport(node) {
     (specifier) => specifier.type === "ImportSpecifier" && specifier.importKind === "type"
   );
 }
+function isTypeOnlyExport(node) {
+  return node.exportKind === "type" || node.type === "ExportNamedDeclaration" && node.specifiers.length > 0 && node.specifiers.every((specifier) => specifier.exportKind === "type");
+}
 var no_server_env_in_client_component_default = defineRule({
   meta: {
     type: "problem",
     docs: {
-      description: "server-only environment settings imported by a client component",
+      description: "server-only environment settings imported or re-exported by a client module",
       url: docsUrl("no-server-env-in-client-component")
     },
     schema: [],
     messages: {
-      noServerEnvInClientComponent: "A 'use client' module cannot import server-only settings. Pass public data from a Server Component or use a validated client-settings module."
+      noServerEnvInClientComponent: "Do not import or re-export server-only settings from a 'use client' module; use validated client settings."
     }
   },
   createOnce(context) {
     let clientModule = false;
+    function checkDependency(node) {
+      if (!clientModule || node.source === null) return;
+      const typeOnly = node.type === "ImportDeclaration" ? isTypeOnlyImport(node) : isTypeOnlyExport(node);
+      if (!typeOnly && SERVER_ENV_MODULE_RE.test(node.source.value)) {
+        context.report({ node, messageId: "noServerEnvInClientComponent" });
+      }
+    }
     return {
       Program(node) {
         clientModule = isClientModule(node);
       },
-      ImportDeclaration(node) {
-        if (clientModule && !isTypeOnlyImport(node) && SERVER_ENV_MODULE_RE.test(node.source.value)) {
-          context.report({ node, messageId: "noServerEnvInClientComponent" });
-        }
-      }
+      ImportDeclaration: checkDependency,
+      ExportNamedDeclaration: checkDependency,
+      ExportAllDeclaration: checkDependency
     };
   }
 });
@@ -22094,6 +22317,7 @@ var prefer_coded_error_result_default = defineRule({
 });
 
 // src/rules/prefer-configured-cloud-scope.ts
+import { URL as NativeURL } from "url";
 var NAME92 = "prefer-configured-cloud-scope";
 var ACCOUNT_PREFIX = "https://api.cloudflare.com/client/v4/accounts/";
 var ACCOUNT_URL = /^https:\/\/api\.cloudflare\.com\/client\/v4\/accounts\/[a-fA-F\d]{32}(?=\/|[?#]|$)/u;
@@ -22129,6 +22353,7 @@ var prefer_configured_cloud_scope_default = defineRule({
     const requests = [];
     let fetchOverridden = false;
     let nodesRemaining = 0;
+    let nativeUrlSafe;
     function bindingOf(node) {
       return findVariable(sourceCode2.getScope(node), node.name);
     }
@@ -22137,7 +22362,8 @@ var prefer_configured_cloud_scope_default = defineRule({
       return binding3 === null || binding3.defs.length === 0;
     }
     function globalReceiver2(node) {
-      return node.type === "Identifier" && GLOBAL_RECEIVERS5.has(node.name) && unshadowed(node);
+      const value = unwrapExpression(node);
+      return value.type === "Identifier" && GLOBAL_RECEIVERS5.has(value.name) && unshadowed(value);
     }
     function outgoingFetch(node, seen = /* @__PURE__ */ new Set()) {
       const callee = unwrapExpression(node);
@@ -22160,6 +22386,11 @@ var prefer_configured_cloud_scope_default = defineRule({
       const declarator = definition.node;
       return declarator.id.type === "Identifier" && declarator.init !== null && outgoingFetch(declarator.init, next);
     }
+    function nativeUrlReference(node) {
+      const value = unwrapExpression(node);
+      if (value.type === "Identifier") return value.name === "URL" && unshadowed(value);
+      return value.type === "MemberExpression" && globalReceiver2(value.object) && staticPropertyName(value, sourceCode2) === "URL";
+    }
     function checkWrite(target, depth = 0) {
       if (depth >= 16) {
         fetchOverridden = true;
@@ -22201,17 +22432,7 @@ var prefer_configured_cloud_scope_default = defineRule({
       if (value.type === "Literal" && typeof value.value === "string") {
         return boundedParts([{ text: value.value, source: value }]);
       }
-      if (value.type === "Identifier") {
-        const binding3 = bindingOf(value);
-        if (binding3 === null || seen.has(binding3) || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true))
-          return UNKNOWN;
-        const [definition] = binding3.defs;
-        if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const")
-          return UNKNOWN;
-        const declarator = definition.node;
-        if (declarator.id.type !== "Identifier" || declarator.init === null) return UNKNOWN;
-        return urlParts(declarator.init, /* @__PURE__ */ new Set([...seen, binding3]), depth + 1);
-      }
+      if (value.type === "Identifier") return identifierUrlParts(value, seen, depth);
       if (value.type === "BinaryExpression" && value.operator === "+") {
         return boundedParts([
           ...urlParts(value.left, seen, depth + 1),
@@ -22219,8 +22440,78 @@ var prefer_configured_cloud_scope_default = defineRule({
         ]);
       }
       if (value.type === "TemplateLiteral") return templateParts(value, seen, depth);
+      if (value.type === "NewExpression") return nativeUrlParts(value, seen, depth);
       return UNKNOWN;
     }
+    function identifierUrlParts(identifier, seen, depth) {
+      const binding3 = bindingOf(identifier);
+      if (binding3 === null || seen.has(binding3) || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true))
+        return UNKNOWN;
+      const [definition] = binding3.defs;
+      if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const")
+        return UNKNOWN;
+      const declarator = definition.node;
+      if (declarator.id.type !== "Identifier" || declarator.init === null) return UNKNOWN;
+      const initializer = unwrapExpression(declarator.init);
+      if (initializer.type === "NewExpression" && nativeUrlReference(initializer.callee) && !onlyUrlRequests(binding3, declarator))
+        return UNKNOWN;
+      return urlParts(declarator.init, /* @__PURE__ */ new Set([...seen, binding3]), depth + 1);
+    }
+    function onlyUrlRequests(variable, declarator) {
+      if (variable.references.length > 128) return false;
+      const declaration = parentOf(declarator);
+      if (declaration !== null && parentOf(declaration)?.type === "ExportNamedDeclaration")
+        return false;
+      return variable.references.every((reference) => {
+        if (reference.init === true || typeOnlyReference(reference)) return true;
+        const value = outerExpression(reference.identifier);
+        const use = parentOf(value);
+        if (use?.type !== "CallExpression" || use.arguments[0] !== value) return false;
+        const callee = unwrapExpression(use.callee);
+        return callee.type === "Identifier" && callee.name === "fetch" && unshadowed(callee) || callee.type === "MemberExpression" && globalReceiver2(callee.object) && staticPropertyName(callee, sourceCode2) === "fetch";
+      });
+    }
+    function nativeUrlParts(value, seen, depth) {
+      if (value.arguments.length !== 1 || !nativeUrlReference(value.callee) || !nativeUrlUnchanged())
+        return UNKNOWN;
+      const [argument] = value.arguments;
+      if (argument === void 0 || argument.type === "SpreadElement") return UNKNOWN;
+      const parts = urlParts(argument, seen, depth + 1);
+      if (parts.some((part) => part.source === null)) return UNKNOWN;
+      const text = parts.map((part) => part.text).join("");
+      if (!ACCOUNT_URL.test(text)) return UNKNOWN;
+      try {
+        return new NativeURL(text).href === text ? parts : UNKNOWN;
+      } catch {
+        return UNKNOWN;
+      }
+    }
+    function nativeUrlUnchanged() {
+      if (nativeUrlSafe !== void 0) return nativeUrlSafe;
+      nativeUrlSafe = sourceCode2.scopeManager.scopes.every(
+        (scope) => scope.references.every((reference) => {
+          if (typeOnlyReference(tsReference(reference))) return true;
+          const identifier = reference.identifier;
+          if (["eval", "Function"].includes(identifier.name) && unshadowed(identifier))
+            return false;
+          let value = outerExpression(identifier);
+          if (!nativeUrlReference(value)) {
+            const member3 = parentOf(value);
+            if (globalReceiver2(value)) {
+              if (member3?.type !== "MemberExpression" || member3.object !== value) return false;
+              const key = staticPropertyName(member3, sourceCode2);
+              if (key === null || GLOBAL_RECEIVERS5.has(key)) return false;
+            }
+            if (member3?.type !== "MemberExpression" || member3.object !== value || !nativeUrlReference(member3))
+              return true;
+            value = outerExpression(member3);
+          }
+          const use = parentOf(value);
+          return use?.type === "NewExpression" && use.callee === value || use?.type === "UnaryExpression" && use.operator === "typeof";
+        })
+      );
+      return nativeUrlSafe;
+    }
     function templateParts(value, seen, depth) {
       const parts = [];
       for (let index = 0; index < value.quasis.length; index++) {
@@ -22239,6 +22530,7 @@ var prefer_configured_cloud_scope_default = defineRule({
         reported.clear();
         requests.length = 0;
         fetchOverridden = false;
+        nativeUrlSafe = void 0;
         const file = { filename: context.filename, cwd: context.cwd };
         return !isTestFile(file) && !isGeneratedFile(file, sourceCode2.text);
       },

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   src_default
-} from "./chunk-YWEV6GQM.js";
+} from "./chunk-SIHWYU24.js";
 export {
   src_default as default
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "19.14.0",
+  "version": "19.15.0",
   "packageManager": "npm@12.2.1",
   "description": "Custom Oxlint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",