@sarj/eslint-plugin 19.9.0 → 19.10.0

package/dist/catalog.js

@@ -2,7 +2,7 @@ import {
   publicDocumentation,
   ruleSpec,
   src_default
-} from "./chunk-MFL7OATV.js";
+} from "./chunk-ZWOGM4CV.js";
 
 // src/docs/directive-disable-enable-pair.ts
 var DIRECTIVE_DISABLE_ENABLE_PAIR_DOCUMENTATION = {
@@ -2519,13 +2519,47 @@ var NO_PRODUCTION_BROWSER_SOURCE_MAPS_DOCUMENTATION = {
 // src/docs/no-raw-env.ts
 var NO_RAW_ENV_DOCUMENTATION = {
   summary: "Disallow direct `process.env` and `import.meta.env` reads outside validated boundaries.",
-  rationale: "Raw environment reads are untyped and defer invalid configuration failures until use.",
-  remediation: "Validate environment values at startup and import the typed configuration object.",
+  rationale: "Raw environment reads are untyped and defer invalid configuration failures until use. One shared validated settings object gives consumers a consistent startup configuration.",
+  remediation: "Define a Zod settings schema, call SettingsSchema.parse(process.env) once at startup, and export or inject that single parsed settings object. Use Pydantic/Pydantic Settings for the equivalent Python boundary. Required values must fail before remote effects; preserve independent security policy and existing optional defaults.",
   category: "correctness",
-  limitations: ["Host markers, assignment targets, tests, scripts, build config, and recognized validation-boundary files are policy exemptions. A validation call does not prove every export is validated; assignment-target exemptions also include compound writes that read the previous value."],
+  limitations: [
+    "Host markers, assignment targets, tests, ordinary scripts and build config retain their policy exemptions. Boundary-named modules, including env.mjs and settings.ts, are checked. A boundary filename or schema declaration alone does not exempt raw reads: each read must flow through a parse/safeParse/createEnv argument, directly or through stable nonexported const aliases whose every use reaches validation. Only unshadowed Number/String/Boolean/BigInt calls are traversed as scalar coercions; arbitrary calls cannot consume raw settings before the parser.",
+    "This is bounded same-file syntax analysis (24 flow steps, 128 reads per alias and 512 total expression visits per raw read); flows exceeding these budgets are unreported. It does not prove a parser's implementation, cross-file schemas, schema completeness, safeParse failure handling or a project-wide singleton. Handle safeParse failure before exposing result.data; prefer throwing parse at startup. Nested component settings and separate server/client runtime boundaries remain valid.",
+    "Assignment-target exemptions also include compound writes that read the previous value. Whole-environment spreads outside boundary modules retain the existing forwarding exemption; a spread inside a boundary must also reach its parser. No automatic rewrite."
+  ],
   examples: [
-    { id: "validated-environment", title: "Read validated configuration", outcome: "no-match", files: [{ path: "src/database.ts", source: "import { env } from './env.js'; const url = env.DATABASE_URL;" }], focusPath: "src/database.ts", expectedCount: 0, public: true },
-    { id: "raw-environment-read", title: "Do not read raw configuration", outcome: "match", files: [{ path: "src/database.ts", source: "const url = process.env.DATABASE_URL;" }], focusPath: "src/database.ts", expectedCount: 1, public: true }
+    {
+      id: "validated-environment",
+      title: "Parse once and reuse one settings object",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/database.ts",
+          source: "import { settings } from './env.js';\nexport const primaryUrl = settings.DATABASE_URL;\nexport const replicaUrl = settings.DATABASE_URL;"
+        },
+        {
+          path: "src/env.ts",
+          source: "import { z } from 'zod';\nconst SettingsSchema = z.object({ DATABASE_URL: z.url() });\nexport const settings = SettingsSchema.parse(process.env);"
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "raw-environment-read",
+      title: "Declaring a schema does not validate a raw export",
+      outcome: "match",
+      files: [
+        {
+          path: "src/env.ts",
+          source: "import { z } from 'zod';\nconst SettingsSchema = z.object({ DATABASE_URL: z.url() });\nexport const settings = { DATABASE_URL: process.env.DATABASE_URL };"
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 1,
+      public: true
+    }
   ]
 };
 
@@ -4444,7 +4478,7 @@ var PREFER_CODED_ERROR_RESULT_DOCUMENTATION = {
 var PREFER_CONFIGURED_CLOUD_SCOPE_DOCUMENTATION = {
   summary: "Prefer validated deployment configuration for account scope in outgoing cloud management requests.",
   rationale: "A source-literal cloud account scope pins operational requests to one deployment even when the credential or environment changes.",
-  remediation: "Read the account ID from environment variables or injected configuration, validate it at startup, and pass the validated value to the request. Preserve independent security allowlists and fail closed when required configuration is missing.",
+  remediation: "Read the account ID through one shared settings object validated by a Zod schema at startup, then import or inject that parsed object into consumers. Required values must fail before remote effects. Preserve independent security allowlists; an environment read alone is not validation.",
   category: "correctness",
   defaultLevel: "warning",
   autofix: "none",
@@ -4465,22 +4499,30 @@ var PREFER_CONFIGURED_CLOUD_SCOPE_DOCUMENTATION = {
       id: "literal-account-scope",
       title: "Move outgoing account scope into deployment configuration",
       outcome: "match",
-      files: [{
-        path: ".github/scripts/publish.mjs",
-        source: "const accountId = '0123456789abcdef0123456789abcdef';\nconst base = `https://api.cloudflare.com/client/v4/accounts/${accountId}`;\nexport async function publish(path, request = fetch) { return request(`${base}/${path}`); }"
-      }],
+      files: [
+        {
+          path: ".github/scripts/publish.mjs",
+          source: "const accountId = '0123456789abcdef0123456789abcdef';\nconst base = `https://api.cloudflare.com/client/v4/accounts/${accountId}`;\nexport async function publish(path, request = fetch) { return request(`${base}/${path}`); }"
+        }
+      ],
       focusPath: ".github/scripts/publish.mjs",
       expectedCount: 1,
       public: true
     },
     {
       id: "validated-account-scope",
-      title: "Pass validated deployment configuration to the request",
+      title: "Parse one shared settings object with Zod before requests",
       outcome: "no-match",
-      files: [{
-        path: ".github/scripts/publish.mjs",
-        source: "import { env } from './env.mjs';\nconst base = `https://api.cloudflare.com/client/v4/accounts/${env.CLOUDFLARE_ACCOUNT_ID}`;\nexport async function publish(path, request = fetch) { return request(`${base}/${path}`); }"
-      }],
+      files: [
+        {
+          path: ".github/scripts/publish.mjs",
+          source: "import { settings } from '../../src/env.mjs';\nconst base = `https://api.cloudflare.com/client/v4/accounts/${settings.CLOUDFLARE_ACCOUNT_ID}`;\nexport async function publish(path, request = fetch) { return request(`${base}/${path}`); }\nexport async function list(request = fetch) { return request(`${base}/workers/scripts`); }"
+        },
+        {
+          path: "src/env.mjs",
+          source: "import { z } from 'zod';\nconst SettingsSchema = z.object({ CLOUDFLARE_ACCOUNT_ID: z.string().length(32).regex(/^[a-fA-F0-9]+$/u) });\nexport const settings = SettingsSchema.parse(process.env);"
+        }
+      ],
       focusPath: ".github/scripts/publish.mjs",
       expectedCount: 0,
       public: true

package/dist/{chunk-MFL7OATV.js → chunk-ZWOGM4CV.js}

@@ -15557,11 +15557,25 @@ var no_production_browser_source_maps_default = defineRule({
 
 // src/rules/no-raw-env.ts
 var CONFIG_FILE_RE = /(^|[\\/])[\w.-]+\.config\.[cm]?[jt]sx?$/;
-var ENV_BOUNDARY_FILE_RE = /(^|[\\/])(?:env|client-env|server-env|client-settings|server-settings)\.[cm]?[jt]sx?$/;
+var ENV_BOUNDARY_FILE_RE = /(^|[\\/])(?:env|settings|client-env|server-env|client-settings|server-settings)\.[cm]?[jt]sx?$/;
 var PROCESS_MODULES = ["node:process", "process"];
-var PROCESS_IMPORT_SPECIFIERS = ["ImportDefaultSpecifier", "ImportNamespaceSpecifier"];
-var BUILD_TIME_CONSTANTS = /* @__PURE__ */ new Set(["NODE_ENV", "MODE", "DEV", "PROD", "SSR"]);
-var PLATFORM_MARKERS = /* @__PURE__ */ new Set(["NEXT_RUNTIME", "VERCEL", "VERCEL_ENV", "CI"]);
+var PROCESS_IMPORT_SPECIFIERS = [
+  "ImportDefaultSpecifier",
+  "ImportNamespaceSpecifier"
+];
+var BUILD_TIME_CONSTANTS = /* @__PURE__ */ new Set([
+  "NODE_ENV",
+  "MODE",
+  "DEV",
+  "PROD",
+  "SSR"
+]);
+var PLATFORM_MARKERS = /* @__PURE__ */ new Set([
+  "NEXT_RUNTIME",
+  "VERCEL",
+  "VERCEL_ENV",
+  "CI"
+]);
 function isProcessEnv(node, sourceCode2) {
   const receiver = unwrapExpression(node.object);
   if (receiver.type !== "Identifier" || getPropertyName(node) !== "env") return false;
@@ -15597,6 +15611,58 @@ function isWholeEnvSpread(node) {
   const parent = parentOf(node);
   return parent?.type === "SpreadElement" && parent.argument === node;
 }
+function reachesValidation(node, sourceCode2, seen = /* @__PURE__ */ new Set(), depth = 0, budget = { remaining: 512 }) {
+  if (depth >= 24 || budget.remaining-- <= 0) return true;
+  const parent = parentOf(node);
+  if (parent === null) return false;
+  switch (parent.type) {
+    case "CallExpression":
+      return parent.arguments.some((argument) => argument === node) && (isValidationCall(parent) || isScalarCoercion(parent, sourceCode2) && reachesValidation(parent, sourceCode2, seen, depth + 1, budget));
+    case "VariableDeclarator":
+      return parent.init === node && validatedAlias(parent, sourceCode2, seen, depth, budget);
+    case "MemberExpression":
+      return parent.object === node && reachesValidation(parent, sourceCode2, seen, depth + 1, budget);
+    case "Property":
+      return parent.value === node && parent.kind === "init" && !parent.method && reachesValidation(parent, sourceCode2, seen, depth + 1, budget);
+    case "ObjectExpression":
+    case "ArrayExpression":
+    case "SpreadElement":
+    case "LogicalExpression":
+    case "BinaryExpression":
+    case "ConditionalExpression":
+    case "TemplateLiteral":
+    case "TSAsExpression":
+    case "TSNonNullExpression":
+    case "TSSatisfiesExpression":
+      return reachesValidation(parent, sourceCode2, seen, depth + 1, budget);
+    default:
+      return false;
+  }
+}
+function isValidationCall(node) {
+  const callee = unwrapExpression(node.callee);
+  return callee.type === "Identifier" ? callee.name === "createEnv" : callee.type === "MemberExpression" && ["parse", "safeParse"].includes(getPropertyName(callee) ?? "");
+}
+function isScalarCoercion(node, sourceCode2) {
+  const callee = unwrapExpression(node.callee);
+  if (callee.type !== "Identifier" || !["Number", "String", "Boolean", "BigInt"].includes(callee.name) || node.arguments.length !== 1)
+    return false;
+  const binding3 = findVariable(sourceCode2.getScope(callee), callee.name);
+  return binding3 === null || binding3.defs.length === 0;
+}
+function validatedAlias(node, sourceCode2, seen, depth, budget) {
+  const declaration = parentOf(node);
+  if (node.id.type !== "Identifier" || declaration?.type !== "VariableDeclaration" || declaration.kind !== "const")
+    return false;
+  if (parentOf(declaration)?.type === "ExportNamedDeclaration") return false;
+  const variable = findVariable(sourceCode2.getScope(node.id), node.id.name);
+  if (variable === null || seen.has(variable) || variable.references.some((ref) => ref.isWrite() && ref.init !== true))
+    return false;
+  const reads = variable.references.filter((ref) => ref.isRead());
+  const next = /* @__PURE__ */ new Set([...seen, variable]);
+  if (reads.length > 128) return true;
+  return reads.length > 0 && reads.every((ref) => reachesValidation(ref.identifier, sourceCode2, next, depth + 1, budget));
+}
 var no_raw_env_default = defineRule({
   meta: {
     type: "problem",
@@ -15606,48 +15672,35 @@ var no_raw_env_default = defineRule({
     },
     schema: [],
     messages: {
-      noRawEnv: "Do not read raw environment values directly. Import the validated env module so values are typed and checked at startup."
+      noRawEnv: "Read one shared settings object validated at startup with Zod (or the existing typed settings loader). Parse required environment values once at the boundary and inject or import the validated result."
     }
   },
   createOnce(context) {
     let sourceCode2;
     let reads = [];
     let boundaryFile = false;
-    let hasValidationCall = false;
     return {
       before() {
         const filename = context.filename;
         const file = { filename, cwd: context.cwd };
-        if (isTestFile(file) || isScriptFile(file) || CONFIG_FILE_RE.test(filename)) {
+        boundaryFile = ENV_BOUNDARY_FILE_RE.test(filename);
+        if (isTestFile(file) || isScriptFile(file) && !boundaryFile || CONFIG_FILE_RE.test(filename)) {
           return false;
         }
         sourceCode2 = context.sourceCode;
         reads = [];
-        boundaryFile = ENV_BOUNDARY_FILE_RE.test(filename);
-        hasValidationCall = false;
         return void 0;
       },
-      CallExpression(node) {
-        if (!boundaryFile) return;
-        const callee = node.callee;
-        if (callee.type === "Identifier" && callee.name === "createEnv") {
-          hasValidationCall = true;
-        } else if (callee.type === "MemberExpression") {
-          const calleeReceiver = unwrapExpression(callee.object);
-          const name = getPropertyName(callee);
-          if (name === "parse" || name === "safeParse" || name === "object" && calleeReceiver.type === "Identifier" && calleeReceiver.name === "z") {
-            hasValidationCall = true;
-          }
-        }
-      },
       MemberExpression(node) {
-        if ((isProcessEnv(node, sourceCode2) || isImportMetaEnv(node)) && !isExemptVariableAccess(node) && !isWriteTarget(node) && !isWholeEnvSpread(node)) {
+        if ((isProcessEnv(node, sourceCode2) || isImportMetaEnv(node)) && !isExemptVariableAccess(node) && !isWriteTarget(node) && !(isWholeEnvSpread(node) && !boundaryFile)) {
           reads.push(node);
         }
       },
       "Program:exit"() {
-        if (boundaryFile && hasValidationCall) return;
-        for (const node of reads) context.report({ node, messageId: "noRawEnv" });
+        for (const node of reads) {
+          if (!boundaryFile || !reachesValidation(node, sourceCode2))
+            context.report({ node, messageId: "noRawEnv" });
+        }
       }
     };
   }
@@ -22035,7 +22088,7 @@ var prefer_configured_cloud_scope_default = defineRule({
     },
     schema: [],
     messages: {
-      configuredScope: "This outgoing Cloudflare management request uses a source-literal account scope. Read and validate the account ID from deployment configuration or environment variables at the boundary; keep independent security allowlists intact."
+      configuredScope: "This outgoing Cloudflare management request uses a source-literal account scope. Load the account ID into one shared Zod-validated settings object at startup, then inject or import it; keep independent security allowlists intact."
     }
   },
   createOnce(context) {
@@ -22062,14 +22115,16 @@ var prefer_configured_cloud_scope_default = defineRule({
       if (callee.type !== "Identifier") return false;
       const binding3 = bindingOf(callee);
       if (binding3 === null || binding3.defs.length === 0) return callee.name === "fetch";
-      if (seen.has(binding3) || seen.size >= 16 || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true)) return false;
+      if (seen.has(binding3) || seen.size >= 16 || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true))
+        return false;
       const next = /* @__PURE__ */ new Set([...seen, binding3]);
       const [definition] = binding3.defs;
       if (definition?.type === "Parameter") {
         const parameter = parentOf(definition.name);
         return parameter?.type === "AssignmentPattern" && parameter.left === definition.name && outgoingFetch(parameter.right, next);
       }
-      if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const") return false;
+      if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const")
+        return false;
       const declarator = definition.node;
       return declarator.id.type === "Identifier" && declarator.init !== null && outgoingFetch(declarator.init, next);
     }
@@ -22090,10 +22145,15 @@ var prefer_configured_cloud_scope_default = defineRule({
           }
           return;
         case "ObjectPattern":
-          for (const property of value.properties) checkWrite(property.type === "RestElement" ? property.argument : property.value, depth + 1);
+          for (const property of value.properties)
+            checkWrite(
+              property.type === "RestElement" ? property.argument : property.value,
+              depth + 1
+            );
           return;
         case "ArrayPattern":
-          for (const element of value.elements) if (element !== null) checkWrite(element, depth + 1);
+          for (const element of value.elements)
+            if (element !== null) checkWrite(element, depth + 1);
           return;
         case "AssignmentPattern":
           checkWrite(value.left, depth + 1);
@@ -22111,15 +22171,20 @@ var prefer_configured_cloud_scope_default = defineRule({
       }
       if (value.type === "Identifier") {
         const binding3 = bindingOf(value);
-        if (binding3 === null || seen.has(binding3) || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true)) return UNKNOWN;
+        if (binding3 === null || seen.has(binding3) || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true))
+          return UNKNOWN;
         const [definition] = binding3.defs;
-        if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const") return UNKNOWN;
+        if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const")
+          return UNKNOWN;
         const declarator = definition.node;
         if (declarator.id.type !== "Identifier" || declarator.init === null) return UNKNOWN;
         return urlParts(declarator.init, /* @__PURE__ */ new Set([...seen, binding3]), depth + 1);
       }
       if (value.type === "BinaryExpression" && value.operator === "+") {
-        return boundedParts([...urlParts(value.left, seen, depth + 1), ...urlParts(value.right, seen, depth + 1)]);
+        return boundedParts([
+          ...urlParts(value.left, seen, depth + 1),
+          ...urlParts(value.right, seen, depth + 1)
+        ]);
       }
       if (value.type === "TemplateLiteral") return templateParts(value, seen, depth);
       return UNKNOWN;

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   src_default
-} from "./chunk-MFL7OATV.js";
+} from "./chunk-ZWOGM4CV.js";
 export {
   src_default as default
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "19.9.0",
+  "version": "19.10.0",
   "packageManager": "npm@12.2.1",
   "description": "Custom Oxlint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",