@sarj/eslint-plugin 19.8.0 → 19.10.0

package/dist/catalog.js

@@ -2,7 +2,7 @@ import {
   publicDocumentation,
   ruleSpec,
   src_default
-} from "./chunk-G5BIV4A4.js";
+} from "./chunk-ZWOGM4CV.js";
 
 // src/docs/directive-disable-enable-pair.ts
 var DIRECTIVE_DISABLE_ENABLE_PAIR_DOCUMENTATION = {
@@ -2519,13 +2519,47 @@ var NO_PRODUCTION_BROWSER_SOURCE_MAPS_DOCUMENTATION = {
 // src/docs/no-raw-env.ts
 var NO_RAW_ENV_DOCUMENTATION = {
   summary: "Disallow direct `process.env` and `import.meta.env` reads outside validated boundaries.",
-  rationale: "Raw environment reads are untyped and defer invalid configuration failures until use.",
-  remediation: "Validate environment values at startup and import the typed configuration object.",
+  rationale: "Raw environment reads are untyped and defer invalid configuration failures until use. One shared validated settings object gives consumers a consistent startup configuration.",
+  remediation: "Define a Zod settings schema, call SettingsSchema.parse(process.env) once at startup, and export or inject that single parsed settings object. Use Pydantic/Pydantic Settings for the equivalent Python boundary. Required values must fail before remote effects; preserve independent security policy and existing optional defaults.",
   category: "correctness",
-  limitations: ["Host markers, assignment targets, tests, scripts, build config, and recognized validation-boundary files are policy exemptions. A validation call does not prove every export is validated; assignment-target exemptions also include compound writes that read the previous value."],
+  limitations: [
+    "Host markers, assignment targets, tests, ordinary scripts and build config retain their policy exemptions. Boundary-named modules, including env.mjs and settings.ts, are checked. A boundary filename or schema declaration alone does not exempt raw reads: each read must flow through a parse/safeParse/createEnv argument, directly or through stable nonexported const aliases whose every use reaches validation. Only unshadowed Number/String/Boolean/BigInt calls are traversed as scalar coercions; arbitrary calls cannot consume raw settings before the parser.",
+    "This is bounded same-file syntax analysis (24 flow steps, 128 reads per alias and 512 total expression visits per raw read); flows exceeding these budgets are unreported. It does not prove a parser's implementation, cross-file schemas, schema completeness, safeParse failure handling or a project-wide singleton. Handle safeParse failure before exposing result.data; prefer throwing parse at startup. Nested component settings and separate server/client runtime boundaries remain valid.",
+    "Assignment-target exemptions also include compound writes that read the previous value. Whole-environment spreads outside boundary modules retain the existing forwarding exemption; a spread inside a boundary must also reach its parser. No automatic rewrite."
+  ],
   examples: [
-    { id: "validated-environment", title: "Read validated configuration", outcome: "no-match", files: [{ path: "src/database.ts", source: "import { env } from './env.js'; const url = env.DATABASE_URL;" }], focusPath: "src/database.ts", expectedCount: 0, public: true },
-    { id: "raw-environment-read", title: "Do not read raw configuration", outcome: "match", files: [{ path: "src/database.ts", source: "const url = process.env.DATABASE_URL;" }], focusPath: "src/database.ts", expectedCount: 1, public: true }
+    {
+      id: "validated-environment",
+      title: "Parse once and reuse one settings object",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/database.ts",
+          source: "import { settings } from './env.js';\nexport const primaryUrl = settings.DATABASE_URL;\nexport const replicaUrl = settings.DATABASE_URL;"
+        },
+        {
+          path: "src/env.ts",
+          source: "import { z } from 'zod';\nconst SettingsSchema = z.object({ DATABASE_URL: z.url() });\nexport const settings = SettingsSchema.parse(process.env);"
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "raw-environment-read",
+      title: "Declaring a schema does not validate a raw export",
+      outcome: "match",
+      files: [
+        {
+          path: "src/env.ts",
+          source: "import { z } from 'zod';\nconst SettingsSchema = z.object({ DATABASE_URL: z.url() });\nexport const settings = { DATABASE_URL: process.env.DATABASE_URL };"
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 1,
+      public: true
+    }
   ]
 };
 
@@ -4444,7 +4478,7 @@ var PREFER_CODED_ERROR_RESULT_DOCUMENTATION = {
 var PREFER_CONFIGURED_CLOUD_SCOPE_DOCUMENTATION = {
   summary: "Prefer validated deployment configuration for account scope in outgoing cloud management requests.",
   rationale: "A source-literal cloud account scope pins operational requests to one deployment even when the credential or environment changes.",
-  remediation: "Read the account ID from environment variables or injected configuration, validate it at startup, and pass the validated value to the request. Preserve independent security allowlists and fail closed when required configuration is missing.",
+  remediation: "Read the account ID through one shared settings object validated by a Zod schema at startup, then import or inject that parsed object into consumers. Required values must fail before remote effects. Preserve independent security allowlists; an environment read alone is not validation.",
   category: "correctness",
   defaultLevel: "warning",
   autofix: "none",
@@ -4465,22 +4499,30 @@ var PREFER_CONFIGURED_CLOUD_SCOPE_DOCUMENTATION = {
       id: "literal-account-scope",
       title: "Move outgoing account scope into deployment configuration",
       outcome: "match",
-      files: [{
-        path: ".github/scripts/publish.mjs",
-        source: "const accountId = '0123456789abcdef0123456789abcdef';\nconst base = `https://api.cloudflare.com/client/v4/accounts/${accountId}`;\nexport async function publish(path, request = fetch) { return request(`${base}/${path}`); }"
-      }],
+      files: [
+        {
+          path: ".github/scripts/publish.mjs",
+          source: "const accountId = '0123456789abcdef0123456789abcdef';\nconst base = `https://api.cloudflare.com/client/v4/accounts/${accountId}`;\nexport async function publish(path, request = fetch) { return request(`${base}/${path}`); }"
+        }
+      ],
       focusPath: ".github/scripts/publish.mjs",
       expectedCount: 1,
       public: true
     },
     {
       id: "validated-account-scope",
-      title: "Pass validated deployment configuration to the request",
+      title: "Parse one shared settings object with Zod before requests",
       outcome: "no-match",
-      files: [{
-        path: ".github/scripts/publish.mjs",
-        source: "import { env } from './env.mjs';\nconst base = `https://api.cloudflare.com/client/v4/accounts/${env.CLOUDFLARE_ACCOUNT_ID}`;\nexport async function publish(path, request = fetch) { return request(`${base}/${path}`); }"
-      }],
+      files: [
+        {
+          path: ".github/scripts/publish.mjs",
+          source: "import { settings } from '../../src/env.mjs';\nconst base = `https://api.cloudflare.com/client/v4/accounts/${settings.CLOUDFLARE_ACCOUNT_ID}`;\nexport async function publish(path, request = fetch) { return request(`${base}/${path}`); }\nexport async function list(request = fetch) { return request(`${base}/workers/scripts`); }"
+        },
+        {
+          path: "src/env.mjs",
+          source: "import { z } from 'zod';\nconst SettingsSchema = z.object({ CLOUDFLARE_ACCOUNT_ID: z.string().length(32).regex(/^[a-fA-F0-9]+$/u) });\nexport const settings = SettingsSchema.parse(process.env);"
+        }
+      ],
       focusPath: ".github/scripts/publish.mjs",
       expectedCount: 0,
       public: true
@@ -4527,11 +4569,11 @@ var PREFER_DISCRIMINATED_UNION_DOCUMENTATION = {
   category: "correctness",
   autofix: "safe",
   limitations: [
-    "Names, Boolean counts and optional-field counts never establish a finding. A producer's direct literal writes establish either tag-specific payload presence or a pair of required Boolean fields with two or three distinct combinations, with both fields varying. All four combinations, constant dimensions and expression-valued flags are excluded. At most eight Boolean fields are compared. Only one relationship is reported per contract; payload evidence takes precedence.",
-    "Producer analysis requires a finite literal tag, every declared tag syntactically witnessed, exhaustive simple return paths without literal constant conditions, plain object returns, and consistent optional-field presence for each tag. It resolves only unmerged local aliases/interfaces without inheritance or generics, and the built-in Promise around async returns. This is syntax-only evidence of field presence; explicit undefined, void and null payloads are skipped, while expression value types are not inferred. Dynamic returns, spreads, computed keys, accessors, loops and try statements are deliberately skipped.",
-    "A switch producer is supported only for a non-overloaded function declaration when its sole body statement switches on an unchanged direct string or number parameter, has unique same-kind literal labels and a default, and every nonempty case body is a sole object return or throw, optionally inside sole blocks. Empty labels may share the next terminating body; nested conditions, conditional returns, statement prefixes, breaks, other fallthrough, captured/closed inputs and switches under preceding control flow abstain. Broad parameter domains establish input witnesses for each label and the default; this does not infer branch-specific runtime effects or expression value types. Path visits, depth and returned objects are bounded conservatively.",
+    "Names, Boolean counts and optional-field counts never establish a finding. A producer's literal writes establish either tag-specific payload presence or a pair of required Boolean fields with two or three distinct combinations, with both fields varying. Boolean members may use boolean, true | false or one unmerged nongeneric local alias of either. All four combinations, constant dimensions, optional/unknown dimensions and expression-valued flags are excluded. At most eight Boolean fields are compared. Only one relationship is reported per contract; payload evidence takes precedence. Independently nullable payloads do not erase Boolean evidence.",
+    "Producer analysis requires a finite literal tag, every declared tag syntactically witnessed, exhaustive simple return paths without literal constant conditions, plain object returns, and consistent optional-field presence for each tag. It resolves only unmerged local aliases/interfaces without inheritance or generics, one local alias of a literal tag domain, and the built-in Promise around async returns. Callable or opaque own then properties abstain for async producers because Promise assimilation can replace the fulfilled value. Inherited then methods and external prototype mutation are not modeled. This is syntax-only evidence of field presence; explicit undefined, void and null payloads do not establish payload requirements, while expression value types are not inferred. Type-only assertion/satisfies/non-null wrappers, literal computed string keys and a sole-use const immediately before its return are recognized. Const alias chains, observation, mutation and dynamic eval abstain. Dynamic returns, spreads, dynamic computed keys, accessors, loops and try statements are deliberately skipped.",
+    "A switch producer is supported only for a non-overloaded function declaration when its sole body statement switches on an unchanged direct string or number parameter, has unique same-kind literal labels and a default, and every nonempty case body is a sole object return or throw, optionally inside sole blocks. Empty labels may share the next terminating body; nested conditions, conditional returns, statement prefixes, breaks, other fallthrough, captured/closed inputs, dynamic eval and switches under preceding control flow abstain. Broad parameter domains establish input witnesses for each label and the default; this does not infer branch-specific runtime effects or expression value types. Path visits, depth and returned objects are bounded conservatively.",
     "These are refactoring advisories, not proven defects or proof that other writers cannot produce more states. Historical observations, partial results, unknown states and independently completing operations may need the broader contract. Review all readers and writers before migrating a shared contract; preserve every valid combination. A union of existing literal flag pairs is the smallest type-only replacement; a named disposition is a reviewed domain migration.",
-    "Automatic fixes are limited to an unused private nongeneric synchronous function with a direct inline contract and one conditional return containing at most four literal objects. They narrow only the existing discriminator or implicated Boolean pair and preserve other member types and all runtime code, including condition evaluation, object creation, identity and exceptions. Nested conditionals are supported. Shared/observed contracts, aliases, exports, async functions, comments, expression payloads and generated/declaration/test files remain excluded. Public interfaces, serialization and cancellation are never rewritten."
+    "Automatic fixes are limited to an unused private nongeneric synchronous function with a direct inline contract and one conditional return containing at most four bare literal objects. Boolean-pair fixes narrow only the implicated pair, retaining every unrelated member's type, readonly modifier and optionality. Tag/payload fixes express the produced state-specific payload presence while preserving declared payload value types. All runtime code, condition evaluation, object creation, identity and exceptions remain unchanged. Nested conditionals are supported. Assertion/satisfies wrappers, shared/observed contracts, aliases, exports, async functions, comments, expression payloads and generated/declaration/test files remain excluded. Public interfaces, serialization and cancellation are never rewritten."
   ],
   references: ["https://functional-architecture.org/make_illegal_states_unrepresentable/", "https://www.typescriptlang.org/docs/handbook/2/narrowing.html#discriminated-unions"],
   examples: [

package/dist/{chunk-G5BIV4A4.js → chunk-ZWOGM4CV.js}

@@ -15557,11 +15557,25 @@ var no_production_browser_source_maps_default = defineRule({
 
 // src/rules/no-raw-env.ts
 var CONFIG_FILE_RE = /(^|[\\/])[\w.-]+\.config\.[cm]?[jt]sx?$/;
-var ENV_BOUNDARY_FILE_RE = /(^|[\\/])(?:env|client-env|server-env|client-settings|server-settings)\.[cm]?[jt]sx?$/;
+var ENV_BOUNDARY_FILE_RE = /(^|[\\/])(?:env|settings|client-env|server-env|client-settings|server-settings)\.[cm]?[jt]sx?$/;
 var PROCESS_MODULES = ["node:process", "process"];
-var PROCESS_IMPORT_SPECIFIERS = ["ImportDefaultSpecifier", "ImportNamespaceSpecifier"];
-var BUILD_TIME_CONSTANTS = /* @__PURE__ */ new Set(["NODE_ENV", "MODE", "DEV", "PROD", "SSR"]);
-var PLATFORM_MARKERS = /* @__PURE__ */ new Set(["NEXT_RUNTIME", "VERCEL", "VERCEL_ENV", "CI"]);
+var PROCESS_IMPORT_SPECIFIERS = [
+  "ImportDefaultSpecifier",
+  "ImportNamespaceSpecifier"
+];
+var BUILD_TIME_CONSTANTS = /* @__PURE__ */ new Set([
+  "NODE_ENV",
+  "MODE",
+  "DEV",
+  "PROD",
+  "SSR"
+]);
+var PLATFORM_MARKERS = /* @__PURE__ */ new Set([
+  "NEXT_RUNTIME",
+  "VERCEL",
+  "VERCEL_ENV",
+  "CI"
+]);
 function isProcessEnv(node, sourceCode2) {
   const receiver = unwrapExpression(node.object);
   if (receiver.type !== "Identifier" || getPropertyName(node) !== "env") return false;
@@ -15597,6 +15611,58 @@ function isWholeEnvSpread(node) {
   const parent = parentOf(node);
   return parent?.type === "SpreadElement" && parent.argument === node;
 }
+function reachesValidation(node, sourceCode2, seen = /* @__PURE__ */ new Set(), depth = 0, budget = { remaining: 512 }) {
+  if (depth >= 24 || budget.remaining-- <= 0) return true;
+  const parent = parentOf(node);
+  if (parent === null) return false;
+  switch (parent.type) {
+    case "CallExpression":
+      return parent.arguments.some((argument) => argument === node) && (isValidationCall(parent) || isScalarCoercion(parent, sourceCode2) && reachesValidation(parent, sourceCode2, seen, depth + 1, budget));
+    case "VariableDeclarator":
+      return parent.init === node && validatedAlias(parent, sourceCode2, seen, depth, budget);
+    case "MemberExpression":
+      return parent.object === node && reachesValidation(parent, sourceCode2, seen, depth + 1, budget);
+    case "Property":
+      return parent.value === node && parent.kind === "init" && !parent.method && reachesValidation(parent, sourceCode2, seen, depth + 1, budget);
+    case "ObjectExpression":
+    case "ArrayExpression":
+    case "SpreadElement":
+    case "LogicalExpression":
+    case "BinaryExpression":
+    case "ConditionalExpression":
+    case "TemplateLiteral":
+    case "TSAsExpression":
+    case "TSNonNullExpression":
+    case "TSSatisfiesExpression":
+      return reachesValidation(parent, sourceCode2, seen, depth + 1, budget);
+    default:
+      return false;
+  }
+}
+function isValidationCall(node) {
+  const callee = unwrapExpression(node.callee);
+  return callee.type === "Identifier" ? callee.name === "createEnv" : callee.type === "MemberExpression" && ["parse", "safeParse"].includes(getPropertyName(callee) ?? "");
+}
+function isScalarCoercion(node, sourceCode2) {
+  const callee = unwrapExpression(node.callee);
+  if (callee.type !== "Identifier" || !["Number", "String", "Boolean", "BigInt"].includes(callee.name) || node.arguments.length !== 1)
+    return false;
+  const binding3 = findVariable(sourceCode2.getScope(callee), callee.name);
+  return binding3 === null || binding3.defs.length === 0;
+}
+function validatedAlias(node, sourceCode2, seen, depth, budget) {
+  const declaration = parentOf(node);
+  if (node.id.type !== "Identifier" || declaration?.type !== "VariableDeclaration" || declaration.kind !== "const")
+    return false;
+  if (parentOf(declaration)?.type === "ExportNamedDeclaration") return false;
+  const variable = findVariable(sourceCode2.getScope(node.id), node.id.name);
+  if (variable === null || seen.has(variable) || variable.references.some((ref) => ref.isWrite() && ref.init !== true))
+    return false;
+  const reads = variable.references.filter((ref) => ref.isRead());
+  const next = /* @__PURE__ */ new Set([...seen, variable]);
+  if (reads.length > 128) return true;
+  return reads.length > 0 && reads.every((ref) => reachesValidation(ref.identifier, sourceCode2, next, depth + 1, budget));
+}
 var no_raw_env_default = defineRule({
   meta: {
     type: "problem",
@@ -15606,48 +15672,35 @@ var no_raw_env_default = defineRule({
     },
     schema: [],
     messages: {
-      noRawEnv: "Do not read raw environment values directly. Import the validated env module so values are typed and checked at startup."
+      noRawEnv: "Read one shared settings object validated at startup with Zod (or the existing typed settings loader). Parse required environment values once at the boundary and inject or import the validated result."
     }
   },
   createOnce(context) {
     let sourceCode2;
     let reads = [];
     let boundaryFile = false;
-    let hasValidationCall = false;
     return {
       before() {
         const filename = context.filename;
         const file = { filename, cwd: context.cwd };
-        if (isTestFile(file) || isScriptFile(file) || CONFIG_FILE_RE.test(filename)) {
+        boundaryFile = ENV_BOUNDARY_FILE_RE.test(filename);
+        if (isTestFile(file) || isScriptFile(file) && !boundaryFile || CONFIG_FILE_RE.test(filename)) {
           return false;
         }
         sourceCode2 = context.sourceCode;
         reads = [];
-        boundaryFile = ENV_BOUNDARY_FILE_RE.test(filename);
-        hasValidationCall = false;
         return void 0;
       },
-      CallExpression(node) {
-        if (!boundaryFile) return;
-        const callee = node.callee;
-        if (callee.type === "Identifier" && callee.name === "createEnv") {
-          hasValidationCall = true;
-        } else if (callee.type === "MemberExpression") {
-          const calleeReceiver = unwrapExpression(callee.object);
-          const name = getPropertyName(callee);
-          if (name === "parse" || name === "safeParse" || name === "object" && calleeReceiver.type === "Identifier" && calleeReceiver.name === "z") {
-            hasValidationCall = true;
-          }
-        }
-      },
       MemberExpression(node) {
-        if ((isProcessEnv(node, sourceCode2) || isImportMetaEnv(node)) && !isExemptVariableAccess(node) && !isWriteTarget(node) && !isWholeEnvSpread(node)) {
+        if ((isProcessEnv(node, sourceCode2) || isImportMetaEnv(node)) && !isExemptVariableAccess(node) && !isWriteTarget(node) && !(isWholeEnvSpread(node) && !boundaryFile)) {
           reads.push(node);
         }
       },
       "Program:exit"() {
-        if (boundaryFile && hasValidationCall) return;
-        for (const node of reads) context.report({ node, messageId: "noRawEnv" });
+        for (const node of reads) {
+          if (!boundaryFile || !reachesValidation(node, sourceCode2))
+            context.report({ node, messageId: "noRawEnv" });
+        }
       }
     };
   }
@@ -22035,7 +22088,7 @@ var prefer_configured_cloud_scope_default = defineRule({
     },
     schema: [],
     messages: {
-      configuredScope: "This outgoing Cloudflare management request uses a source-literal account scope. Read and validate the account ID from deployment configuration or environment variables at the boundary; keep independent security allowlists intact."
+      configuredScope: "This outgoing Cloudflare management request uses a source-literal account scope. Load the account ID into one shared Zod-validated settings object at startup, then inject or import it; keep independent security allowlists intact."
     }
   },
   createOnce(context) {
@@ -22062,14 +22115,16 @@ var prefer_configured_cloud_scope_default = defineRule({
       if (callee.type !== "Identifier") return false;
       const binding3 = bindingOf(callee);
       if (binding3 === null || binding3.defs.length === 0) return callee.name === "fetch";
-      if (seen.has(binding3) || seen.size >= 16 || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true)) return false;
+      if (seen.has(binding3) || seen.size >= 16 || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true))
+        return false;
       const next = /* @__PURE__ */ new Set([...seen, binding3]);
       const [definition] = binding3.defs;
       if (definition?.type === "Parameter") {
         const parameter = parentOf(definition.name);
         return parameter?.type === "AssignmentPattern" && parameter.left === definition.name && outgoingFetch(parameter.right, next);
       }
-      if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const") return false;
+      if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const")
+        return false;
       const declarator = definition.node;
       return declarator.id.type === "Identifier" && declarator.init !== null && outgoingFetch(declarator.init, next);
     }
@@ -22090,10 +22145,15 @@ var prefer_configured_cloud_scope_default = defineRule({
           }
           return;
         case "ObjectPattern":
-          for (const property of value.properties) checkWrite(property.type === "RestElement" ? property.argument : property.value, depth + 1);
+          for (const property of value.properties)
+            checkWrite(
+              property.type === "RestElement" ? property.argument : property.value,
+              depth + 1
+            );
           return;
         case "ArrayPattern":
-          for (const element of value.elements) if (element !== null) checkWrite(element, depth + 1);
+          for (const element of value.elements)
+            if (element !== null) checkWrite(element, depth + 1);
           return;
         case "AssignmentPattern":
           checkWrite(value.left, depth + 1);
@@ -22111,15 +22171,20 @@ var prefer_configured_cloud_scope_default = defineRule({
       }
       if (value.type === "Identifier") {
         const binding3 = bindingOf(value);
-        if (binding3 === null || seen.has(binding3) || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true)) return UNKNOWN;
+        if (binding3 === null || seen.has(binding3) || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true))
+          return UNKNOWN;
         const [definition] = binding3.defs;
-        if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const") return UNKNOWN;
+        if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const")
+          return UNKNOWN;
         const declarator = definition.node;
         if (declarator.id.type !== "Identifier" || declarator.init === null) return UNKNOWN;
         return urlParts(declarator.init, /* @__PURE__ */ new Set([...seen, binding3]), depth + 1);
       }
       if (value.type === "BinaryExpression" && value.operator === "+") {
-        return boundedParts([...urlParts(value.left, seen, depth + 1), ...urlParts(value.right, seen, depth + 1)]);
+        return boundedParts([
+          ...urlParts(value.left, seen, depth + 1),
+          ...urlParts(value.right, seen, depth + 1)
+        ]);
       }
       if (value.type === "TemplateLiteral") return templateParts(value, seen, depth);
       return UNKNOWN;
@@ -22449,14 +22514,19 @@ function discriminatedUnionReturns(node, sourceCode2) {
   if (shape === void 0) return void 0;
   const returned2 = returnedProperties(paths.objects, shape);
   if (returned2 === void 0) return void 0;
+  if (node.async && returned2.some((properties2) => {
+    const then = properties2.get("then");
+    return then !== void 0 && (then.type !== "Literal" || typeof then.value === "object" && then.value !== null);
+  })) return void 0;
+  const emptyPayload = returned2.some((properties2) => hasEmptyPayload(properties2, shape.optional));
   for (const [name, member3] of shape.members) {
-    if (member3.optional) continue;
-    const domain = tagDomain(member3.typeAnnotation?.typeAnnotation);
+    if (member3.optional || emptyPayload) continue;
+    const domain = tagDomain(member3.typeAnnotation?.typeAnnotation, sourceCode2);
     if (domain !== void 0 && hasTagSpecificPayload(name, domain, shape.optional, returned2)) {
       return { reportNode: contract.reportNode, relationship: { kind: "presence", tag: name }, members: shape.members, returned: returned2 };
     }
   }
-  const fields2 = correlatedBooleanFields(shape, returned2);
+  const fields2 = correlatedBooleanFields(shape, returned2, sourceCode2);
   return fields2 === void 0 ? void 0 : {
     reportNode: contract.reportNode,
     relationship: { kind: "boolean-pair", fields: fields2 },
@@ -22464,8 +22534,8 @@ function discriminatedUnionReturns(node, sourceCode2) {
     returned: returned2
   };
 }
-function correlatedBooleanFields(shape, returned2) {
-  const fields2 = [...shape.members].filter(([, member3]) => !member3.optional && member3.typeAnnotation?.typeAnnotation.type === "TSBooleanKeyword").map(([name]) => name);
+function correlatedBooleanFields(shape, returned2, sourceCode2) {
+  const fields2 = [...shape.members].filter(([, member3]) => !member3.optional && booleanType(member3.typeAnnotation?.typeAnnotation, sourceCode2)).map(([name]) => name);
   if (fields2.length > 8) return void 0;
   for (const [index, left] of fields2.entries()) {
     for (const right of fields2.slice(index + 1)) {
@@ -22475,6 +22545,10 @@ function correlatedBooleanFields(shape, returned2) {
   }
   return void 0;
 }
+function booleanType(type, sourceCode2) {
+  const domain = tagDomain(type, sourceCode2);
+  return domain?.size === 2 && domain.has(true) && domain.has(false);
+}
 function booleanCombinations(left, right, returned2) {
   const combinations = /* @__PURE__ */ new Set();
   for (const properties2 of returned2) {
@@ -22514,15 +22588,7 @@ function returnContract(node, sourceCode2) {
 }
 function definitions(reference, sourceCode2) {
   if (reference.typeName.type !== "Identifier") return [];
-  let scope = sourceCode2.getScope(reference);
-  while (scope !== null) {
-    const found = scope.set.get(reference.typeName.name);
-    const binding3 = found === void 0 ? void 0 : tsVariable(found);
-    const typeDefinitions2 = binding3?.defs.filter((definition) => definition.isTypeDefinition) ?? [];
-    if (typeDefinitions2.length > 0 || binding3?.isTypeVariable === true) return typeDefinitions2;
-    scope = scope.upper;
-  }
-  return [];
+  return typeBinding(sourceCode2, reference.typeName)?.defs.filter((definition) => definition.isTypeDefinition) ?? [];
 }
 function objectContract(elements) {
   const members2 = /* @__PURE__ */ new Map();
@@ -22543,7 +22609,6 @@ function returnedProperties(objects, contract) {
     if (properties2 === void 0) return void 0;
     if ([...properties2.keys()].some((name) => !contract.members.has(name))) return void 0;
     if ([...contract.members].some(([name, member3]) => !member3.optional && !properties2.has(name))) return void 0;
-    if (hasEmptyPayload(properties2, contract.optional)) return void 0;
     returned2.push(properties2);
   }
   return returned2;
@@ -22568,7 +22633,13 @@ function hasEmptyPayload(properties2, optional) {
   }
   return false;
 }
-function tagDomain(node) {
+function tagDomain(node, sourceCode2) {
+  if (node?.type === "TSTypeReference" && !isPresent(node.typeArguments)) {
+    const bindings = definitions(node, sourceCode2);
+    const declaration = bindings.length === 1 ? bindings[0]?.node : void 0;
+    if (declaration?.type !== "TSTypeAliasDeclaration" || isPresent(declaration.typeParameters)) return void 0;
+    node = declaration.typeAnnotation;
+  }
   if (node?.type === "TSBooleanKeyword") return /* @__PURE__ */ new Set([true, false]);
   if (node?.type !== "TSUnionType") return void 0;
   const values = /* @__PURE__ */ new Set();
@@ -22648,6 +22719,7 @@ function reachableSwitch(statement, sourceCode2) {
   return kind !== void 0 && reachableSwitchLabels(statement, kind);
 }
 function broadSwitchInput(statement, sourceCode2) {
+  if (hasIdentifierNamed(sourceCode2, "eval")) return void 0;
   const body3 = statement.parent;
   if (body3.type !== "BlockStatement" || body3.body.length !== 1) return void 0;
   const owner = body3.parent;
@@ -22699,6 +22771,13 @@ function statementsPaths(statements, budget, depth) {
 }
 function returnedObjects(expression, budget, depth) {
   if (!budget.within(depth)) return void 0;
+  if (isErasedExpression(expression)) {
+    return returnedObjects(expression.expression, budget, depth + 1);
+  }
+  if (expression.type === "Identifier") {
+    const initializer = closedReturnInitializer(expression, budget.sourceCode);
+    return initializer === void 0 ? void 0 : returnedObjects(initializer, budget, depth + 1);
+  }
   if (expression.type === "ObjectExpression") {
     return budget.recordObject() ? [expression] : void 0;
   }
@@ -22707,10 +22786,21 @@ function returnedObjects(expression, budget, depth) {
   const alternate = returnedObjects(expression.alternate, budget, depth + 1);
   return consequent === void 0 || alternate === void 0 ? void 0 : [...consequent, ...alternate];
 }
+function closedReturnInitializer(identifier, sourceCode2) {
+  const returned2 = identifier.parent;
+  if (returned2.type !== "ReturnStatement" || returned2.argument !== identifier || returned2.parent.type !== "BlockStatement" || hasIdentifierNamed(sourceCode2, "eval")) return void 0;
+  const block = returned2.parent;
+  const declaration = block.body[block.body.indexOf(returned2) - 1];
+  if (declaration?.type !== "VariableDeclaration" || declaration.kind !== "const" || declaration.declarations.length !== 1) return void 0;
+  const value = declaration.declarations[0];
+  if (value?.id.type !== "Identifier" || value.id.name !== identifier.name || value.init === null) return void 0;
+  const binding3 = findVariable(sourceCode2.getScope(identifier), identifier.name);
+  if (binding3?.defs.length !== 1 || binding3.defs[0]?.node !== value || binding3.eslintUsed || !binding3.references.some((reference) => reference.identifier === identifier && reference.isRead()) || binding3.references.some((reference) => reference.isWrite() ? reference.init !== true : reference.identifier !== identifier)) return void 0;
+  return value.init;
+}
 function propertyName(node) {
-  if (node.computed) return void 0;
-  if (node.key.type === "Identifier") return node.key.name;
   if (node.key.type === "Literal" && typeof node.key.value === "string") return node.key.value;
+  if (!node.computed && node.key.type === "Identifier") return node.key.name;
   return void 0;
 }
 function literalTag(node) {
@@ -22781,19 +22871,27 @@ function returnsOnlyConditionalObject(fn) {
   if (fn.async || fn.generator || isPresent(fn.typeParameters)) return false;
   const statements = fn.body?.body ?? [];
   const [returned2] = statements;
-  return statements.length === 1 && returned2?.type === "ReturnStatement" && returned2.argument?.type === "ConditionalExpression";
+  return statements.length === 1 && returned2?.type === "ReturnStatement" && returned2.argument?.type === "ConditionalExpression" && bareConditionalObjects(returned2.argument);
+}
+function bareConditionalObjects(expression) {
+  return expression.type === "ObjectExpression" || expression.type === "ConditionalExpression" && bareConditionalObjects(expression.consequent) && bareConditionalObjects(expression.alternate);
 }
 function privateVariantType(properties2, result, sourceCode2) {
   if ([...properties2.values()].some((value) => value.type !== "Literal" || typeof value.value === "object" && value.value !== null || typeof value.value === "number" && !Number.isFinite(value.value))) return null;
   const fields2 = [];
   for (const [name, member3] of result.members) {
     const value = properties2.get(name);
-    if (value === void 0) continue;
+    if (value === void 0 && result.relationship.kind === "presence") continue;
     const annotation = member3.typeAnnotation?.typeAnnotation;
     if (annotation === void 0) return null;
     const narrow = result.relationship.kind === "presence" ? name === result.relationship.tag : name === result.relationship.fields.left || name === result.relationship.fields.right;
-    const type = narrow ? sourceCode2.getText(value) : sourceCode2.getText(annotation);
-    fields2.push(`${member3.readonly ? "readonly " : ""}${sourceCode2.getText(member3.key)}: ${type}`);
+    let type = sourceCode2.getText(annotation);
+    if (narrow) {
+      if (value === void 0) return null;
+      type = sourceCode2.getText(value);
+    }
+    const optional = result.relationship.kind === "boolean-pair" && !narrow && member3.optional;
+    fields2.push(`${member3.readonly ? "readonly " : ""}${sourceCode2.getText(member3.key)}${optional ? "?" : ""}: ${type}`);
   }
   return `{ ${fields2.join("; ")} }`;
 }

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   src_default
-} from "./chunk-G5BIV4A4.js";
+} from "./chunk-ZWOGM4CV.js";
 export {
   src_default as default
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "19.8.0",
+  "version": "19.10.0",
   "packageManager": "npm@12.2.1",
   "description": "Custom Oxlint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",