@sarj/eslint-plugin 19.9.0 → 19.12.0

package/dist/catalog.js

@@ -2,7 +2,7 @@ import {
   publicDocumentation,
   ruleSpec,
   src_default
-} from "./chunk-MFL7OATV.js";
+} from "./chunk-7SYRLUE7.js";
 
 // src/docs/directive-disable-enable-pair.ts
 var DIRECTIVE_DISABLE_ENABLE_PAIR_DOCUMENTATION = {
@@ -2519,13 +2519,47 @@ var NO_PRODUCTION_BROWSER_SOURCE_MAPS_DOCUMENTATION = {
 // src/docs/no-raw-env.ts
 var NO_RAW_ENV_DOCUMENTATION = {
   summary: "Disallow direct `process.env` and `import.meta.env` reads outside validated boundaries.",
-  rationale: "Raw environment reads are untyped and defer invalid configuration failures until use.",
-  remediation: "Validate environment values at startup and import the typed configuration object.",
+  rationale: "Raw environment reads are untyped and defer invalid configuration failures until use. One shared validated settings object gives consumers a consistent startup configuration.",
+  remediation: "Define a Zod settings schema, call SettingsSchema.parse(process.env) once at startup, and export or inject that single parsed settings object. Use Pydantic/Pydantic Settings for the equivalent Python boundary. Required values must fail before remote effects; preserve independent security policy and existing optional defaults.",
   category: "correctness",
-  limitations: ["Host markers, assignment targets, tests, scripts, build config, and recognized validation-boundary files are policy exemptions. A validation call does not prove every export is validated; assignment-target exemptions also include compound writes that read the previous value."],
+  limitations: [
+    "Host markers, assignment targets, tests, ordinary scripts and build config retain their policy exemptions. Boundary-named modules, including env.mjs and settings.ts, are checked. A boundary filename or schema declaration alone does not exempt raw reads: each read must flow through a parse/safeParse/createEnv argument, directly or through stable nonexported const aliases whose every use reaches validation. Only unshadowed Number/String/Boolean/BigInt calls are traversed as scalar coercions; arbitrary calls cannot consume raw settings before the parser.",
+    "This is bounded same-file syntax analysis (24 flow steps, 128 reads per alias and 512 total expression visits per raw read); flows exceeding these budgets are unreported. It does not prove a parser's implementation, cross-file schemas, schema completeness, safeParse failure handling or a project-wide singleton. Handle safeParse failure before exposing result.data; prefer throwing parse at startup. Nested component settings and separate server/client runtime boundaries remain valid.",
+    "Assignment-target exemptions also include compound writes that read the previous value. Whole-environment spreads outside boundary modules retain the existing forwarding exemption; a spread inside a boundary must also reach its parser. No automatic rewrite."
+  ],
   examples: [
-    { id: "validated-environment", title: "Read validated configuration", outcome: "no-match", files: [{ path: "src/database.ts", source: "import { env } from './env.js'; const url = env.DATABASE_URL;" }], focusPath: "src/database.ts", expectedCount: 0, public: true },
-    { id: "raw-environment-read", title: "Do not read raw configuration", outcome: "match", files: [{ path: "src/database.ts", source: "const url = process.env.DATABASE_URL;" }], focusPath: "src/database.ts", expectedCount: 1, public: true }
+    {
+      id: "validated-environment",
+      title: "Parse once and reuse one settings object",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/database.ts",
+          source: "import { settings } from './env.js';\nexport const primaryUrl = settings.DATABASE_URL;\nexport const replicaUrl = settings.DATABASE_URL;"
+        },
+        {
+          path: "src/env.ts",
+          source: "import { z } from 'zod';\nconst SettingsSchema = z.object({ DATABASE_URL: z.url() });\nexport const settings = SettingsSchema.parse(process.env);"
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "raw-environment-read",
+      title: "Declaring a schema does not validate a raw export",
+      outcome: "match",
+      files: [
+        {
+          path: "src/env.ts",
+          source: "import { z } from 'zod';\nconst SettingsSchema = z.object({ DATABASE_URL: z.url() });\nexport const settings = { DATABASE_URL: process.env.DATABASE_URL };"
+        }
+      ],
+      focusPath: "src/env.ts",
+      expectedCount: 1,
+      public: true
+    }
   ]
 };
 
@@ -4129,7 +4163,7 @@ var PREFER_CODED_ERROR_RESULT_DOCUMENTATION = {
     "Checks source-resolved local unions with required literal ok/success booleans, or status/state/kind/type/tag values ok/success versus err/error/failure/failed (case insensitive). Conflicting outcome tags abstain. A shared outcome tag does not also count as a domain error code. Named and namespace neverthrow Result/ResultAsync imports establish their generic error position.",
     "Presence-selected unions require an error property on every failure branch and the same single required non-control value property on every success branch. Optional error/value fields, multiple value keys, loading states and error branches carrying the success value abstain. Required errorMessage and Error-suffixed failure channels are also reviewed; multiple custom channels abstain and a primary error payload retains precedence.",
     "Broad string and unknown error channels, unshadowed native Error-family types and open string/unknown code fields receive review. Explicit Any stays with the existing no-explicit-any rule. Finite literal codes need no invented payload. Imported domain errors, validation-library errors, generic error parameters, ordinary formatters, legitimate absence and redacted failure states remain valid.",
-    "Local aliases, unmerged interfaces without inheritance and generic substitutions are bounded to 16 resolution levels, 64 union members and 256 traversal steps. Imported local declarations, conditional/intersection/mapped types and unresolved contracts abstain. Optional discriminants, independent success/error payloads and partial-data failures are excluded.",
+    "Local aliases, unmerged interfaces without inheritance and generic substitutions are bounded to 16 resolution levels, 64 union members and 256 traversal steps. Transparent aliases retain the proven neverthrow Result/ResultAsync error position, including renamed/namespace imports, generic defaults and unshadowed native Promise/PromiseLike wrappers. Imported local declarations, conditional/intersection/mapped types and unresolved contracts abstain. Optional discriminants, independent success/error payloads and partial-data failures are excluded.",
     "Required code/kind/type/tag fields of unresolved or imported type defer to the type checker; a finite code does not prove that its cases or payloads are useful. Generic error parameters are retained rather than guessed. Ordinary string formatters, absence, validation-library errors and redacted failure states without a string payload are not flagged.",
     "A directly returned failure object, neverthrow err/errAsync call or new Err with an interpolated template or proven string concatenation receives review. Without a code, the diagnostic asks for a domain contract; with a literal code, it asks for consumer formatting. Literal-only compositions, including earlier stable local constants, remain valid codes. Nested plain error objects, expression-bodied arrows and one direct await are supported. Import identity and value-space shadowing are checked; arbitrary aliases, spreads, accessors, computed keys, helper formatting calls and nonliteral codes abstain. This proves formatting ownership, not which context the domain must expose; presentation adapters remain a reviewed exception.",
     "This warning requests domain review: an infrastructure adapter may intentionally retain unknown/Error, and a final presentation boundary may accept every failure and render one message. Neither proves a recoverable domain rejection. No fix invents error codes, fields, handlers or changes serialization, exception unwinding, transactions, retries or logging."
@@ -4139,6 +4173,36 @@ var PREFER_CODED_ERROR_RESULT_DOCUMENTATION = {
     "https://github.com/supermacro/neverthrow"
   ],
   examples: [
+    {
+      id: "aliased-library-message",
+      scenarioId: "aliased-library-error",
+      title: "A transparent alias must preserve the library error contract",
+      outcome: "match",
+      files: [
+        {
+          path: "app/result.ts",
+          source: "import type { Result as NativeResult } from 'neverthrow'; type Saved<T, E> = Promise<NativeResult<T, E>>; export type Output = Saved<number, string>;"
+        }
+      ],
+      focusPath: "app/result.ts",
+      expectedCount: 1,
+      public: true
+    },
+    {
+      id: "aliased-library-domain-error",
+      scenarioId: "aliased-library-error",
+      title: "Keep a finite error code and only the context its consumer needs",
+      outcome: "no-match",
+      files: [
+        {
+          path: "app/result.ts",
+          source: "import type { Result as NativeResult } from 'neverthrow'; type Saved<T, E> = Promise<NativeResult<T, E>>; export type Output = Saved<number, { code: 'duplicate'; name: string } | { code: 'denied' }>;"
+        }
+      ],
+      focusPath: "app/result.ts",
+      expectedCount: 0,
+      public: true
+    },
     {
       id: "presence-selected-message",
       scenarioId: "presence-selected-result",
@@ -4444,7 +4508,7 @@ var PREFER_CODED_ERROR_RESULT_DOCUMENTATION = {
 var PREFER_CONFIGURED_CLOUD_SCOPE_DOCUMENTATION = {
   summary: "Prefer validated deployment configuration for account scope in outgoing cloud management requests.",
   rationale: "A source-literal cloud account scope pins operational requests to one deployment even when the credential or environment changes.",
-  remediation: "Read the account ID from environment variables or injected configuration, validate it at startup, and pass the validated value to the request. Preserve independent security allowlists and fail closed when required configuration is missing.",
+  remediation: "Read the account ID through one shared settings object validated by a Zod schema at startup, then import or inject that parsed object into consumers. Required values must fail before remote effects. Preserve independent security allowlists; an environment read alone is not validation.",
   category: "correctness",
   defaultLevel: "warning",
   autofix: "none",
@@ -4465,22 +4529,30 @@ var PREFER_CONFIGURED_CLOUD_SCOPE_DOCUMENTATION = {
       id: "literal-account-scope",
       title: "Move outgoing account scope into deployment configuration",
       outcome: "match",
-      files: [{
-        path: ".github/scripts/publish.mjs",
-        source: "const accountId = '0123456789abcdef0123456789abcdef';\nconst base = `https://api.cloudflare.com/client/v4/accounts/${accountId}`;\nexport async function publish(path, request = fetch) { return request(`${base}/${path}`); }"
-      }],
+      files: [
+        {
+          path: ".github/scripts/publish.mjs",
+          source: "const accountId = '0123456789abcdef0123456789abcdef';\nconst base = `https://api.cloudflare.com/client/v4/accounts/${accountId}`;\nexport async function publish(path, request = fetch) { return request(`${base}/${path}`); }"
+        }
+      ],
       focusPath: ".github/scripts/publish.mjs",
       expectedCount: 1,
       public: true
     },
     {
       id: "validated-account-scope",
-      title: "Pass validated deployment configuration to the request",
+      title: "Parse one shared settings object with Zod before requests",
       outcome: "no-match",
-      files: [{
-        path: ".github/scripts/publish.mjs",
-        source: "import { env } from './env.mjs';\nconst base = `https://api.cloudflare.com/client/v4/accounts/${env.CLOUDFLARE_ACCOUNT_ID}`;\nexport async function publish(path, request = fetch) { return request(`${base}/${path}`); }"
-      }],
+      files: [
+        {
+          path: ".github/scripts/publish.mjs",
+          source: "import { settings } from '../../src/env.mjs';\nconst base = `https://api.cloudflare.com/client/v4/accounts/${settings.CLOUDFLARE_ACCOUNT_ID}`;\nexport async function publish(path, request = fetch) { return request(`${base}/${path}`); }\nexport async function list(request = fetch) { return request(`${base}/workers/scripts`); }"
+        },
+        {
+          path: "src/env.mjs",
+          source: "import { z } from 'zod';\nconst SettingsSchema = z.object({ CLOUDFLARE_ACCOUNT_ID: z.string().length(32).regex(/^[a-fA-F0-9]+$/u) });\nexport const settings = SettingsSchema.parse(process.env);"
+        }
+      ],
       focusPath: ".github/scripts/publish.mjs",
       expectedCount: 0,
       public: true

package/dist/{chunk-MFL7OATV.js → chunk-7SYRLUE7.js}

@@ -15557,11 +15557,25 @@ var no_production_browser_source_maps_default = defineRule({
 
 // src/rules/no-raw-env.ts
 var CONFIG_FILE_RE = /(^|[\\/])[\w.-]+\.config\.[cm]?[jt]sx?$/;
-var ENV_BOUNDARY_FILE_RE = /(^|[\\/])(?:env|client-env|server-env|client-settings|server-settings)\.[cm]?[jt]sx?$/;
+var ENV_BOUNDARY_FILE_RE = /(^|[\\/])(?:env|settings|client-env|server-env|client-settings|server-settings)\.[cm]?[jt]sx?$/;
 var PROCESS_MODULES = ["node:process", "process"];
-var PROCESS_IMPORT_SPECIFIERS = ["ImportDefaultSpecifier", "ImportNamespaceSpecifier"];
-var BUILD_TIME_CONSTANTS = /* @__PURE__ */ new Set(["NODE_ENV", "MODE", "DEV", "PROD", "SSR"]);
-var PLATFORM_MARKERS = /* @__PURE__ */ new Set(["NEXT_RUNTIME", "VERCEL", "VERCEL_ENV", "CI"]);
+var PROCESS_IMPORT_SPECIFIERS = [
+  "ImportDefaultSpecifier",
+  "ImportNamespaceSpecifier"
+];
+var BUILD_TIME_CONSTANTS = /* @__PURE__ */ new Set([
+  "NODE_ENV",
+  "MODE",
+  "DEV",
+  "PROD",
+  "SSR"
+]);
+var PLATFORM_MARKERS = /* @__PURE__ */ new Set([
+  "NEXT_RUNTIME",
+  "VERCEL",
+  "VERCEL_ENV",
+  "CI"
+]);
 function isProcessEnv(node, sourceCode2) {
   const receiver = unwrapExpression(node.object);
   if (receiver.type !== "Identifier" || getPropertyName(node) !== "env") return false;
@@ -15597,6 +15611,58 @@ function isWholeEnvSpread(node) {
   const parent = parentOf(node);
   return parent?.type === "SpreadElement" && parent.argument === node;
 }
+function reachesValidation(node, sourceCode2, seen = /* @__PURE__ */ new Set(), depth = 0, budget = { remaining: 512 }) {
+  if (depth >= 24 || budget.remaining-- <= 0) return true;
+  const parent = parentOf(node);
+  if (parent === null) return false;
+  switch (parent.type) {
+    case "CallExpression":
+      return parent.arguments.some((argument) => argument === node) && (isValidationCall(parent) || isScalarCoercion(parent, sourceCode2) && reachesValidation(parent, sourceCode2, seen, depth + 1, budget));
+    case "VariableDeclarator":
+      return parent.init === node && validatedAlias(parent, sourceCode2, seen, depth, budget);
+    case "MemberExpression":
+      return parent.object === node && reachesValidation(parent, sourceCode2, seen, depth + 1, budget);
+    case "Property":
+      return parent.value === node && parent.kind === "init" && !parent.method && reachesValidation(parent, sourceCode2, seen, depth + 1, budget);
+    case "ObjectExpression":
+    case "ArrayExpression":
+    case "SpreadElement":
+    case "LogicalExpression":
+    case "BinaryExpression":
+    case "ConditionalExpression":
+    case "TemplateLiteral":
+    case "TSAsExpression":
+    case "TSNonNullExpression":
+    case "TSSatisfiesExpression":
+      return reachesValidation(parent, sourceCode2, seen, depth + 1, budget);
+    default:
+      return false;
+  }
+}
+function isValidationCall(node) {
+  const callee = unwrapExpression(node.callee);
+  return callee.type === "Identifier" ? callee.name === "createEnv" : callee.type === "MemberExpression" && ["parse", "safeParse"].includes(getPropertyName(callee) ?? "");
+}
+function isScalarCoercion(node, sourceCode2) {
+  const callee = unwrapExpression(node.callee);
+  if (callee.type !== "Identifier" || !["Number", "String", "Boolean", "BigInt"].includes(callee.name) || node.arguments.length !== 1)
+    return false;
+  const binding3 = findVariable(sourceCode2.getScope(callee), callee.name);
+  return binding3 === null || binding3.defs.length === 0;
+}
+function validatedAlias(node, sourceCode2, seen, depth, budget) {
+  const declaration = parentOf(node);
+  if (node.id.type !== "Identifier" || declaration?.type !== "VariableDeclaration" || declaration.kind !== "const")
+    return false;
+  if (parentOf(declaration)?.type === "ExportNamedDeclaration") return false;
+  const variable = findVariable(sourceCode2.getScope(node.id), node.id.name);
+  if (variable === null || seen.has(variable) || variable.references.some((ref) => ref.isWrite() && ref.init !== true))
+    return false;
+  const reads = variable.references.filter((ref) => ref.isRead());
+  const next = /* @__PURE__ */ new Set([...seen, variable]);
+  if (reads.length > 128) return true;
+  return reads.length > 0 && reads.every((ref) => reachesValidation(ref.identifier, sourceCode2, next, depth + 1, budget));
+}
 var no_raw_env_default = defineRule({
   meta: {
     type: "problem",
@@ -15606,48 +15672,35 @@ var no_raw_env_default = defineRule({
     },
     schema: [],
     messages: {
-      noRawEnv: "Do not read raw environment values directly. Import the validated env module so values are typed and checked at startup."
+      noRawEnv: "Read one shared settings object validated at startup with Zod (or the existing typed settings loader). Parse required environment values once at the boundary and inject or import the validated result."
     }
   },
   createOnce(context) {
     let sourceCode2;
     let reads = [];
     let boundaryFile = false;
-    let hasValidationCall = false;
     return {
       before() {
         const filename = context.filename;
         const file = { filename, cwd: context.cwd };
-        if (isTestFile(file) || isScriptFile(file) || CONFIG_FILE_RE.test(filename)) {
+        boundaryFile = ENV_BOUNDARY_FILE_RE.test(filename);
+        if (isTestFile(file) || isScriptFile(file) && !boundaryFile || CONFIG_FILE_RE.test(filename)) {
           return false;
         }
         sourceCode2 = context.sourceCode;
         reads = [];
-        boundaryFile = ENV_BOUNDARY_FILE_RE.test(filename);
-        hasValidationCall = false;
         return void 0;
       },
-      CallExpression(node) {
-        if (!boundaryFile) return;
-        const callee = node.callee;
-        if (callee.type === "Identifier" && callee.name === "createEnv") {
-          hasValidationCall = true;
-        } else if (callee.type === "MemberExpression") {
-          const calleeReceiver = unwrapExpression(callee.object);
-          const name = getPropertyName(callee);
-          if (name === "parse" || name === "safeParse" || name === "object" && calleeReceiver.type === "Identifier" && calleeReceiver.name === "z") {
-            hasValidationCall = true;
-          }
-        }
-      },
       MemberExpression(node) {
-        if ((isProcessEnv(node, sourceCode2) || isImportMetaEnv(node)) && !isExemptVariableAccess(node) && !isWriteTarget(node) && !isWholeEnvSpread(node)) {
+        if ((isProcessEnv(node, sourceCode2) || isImportMetaEnv(node)) && !isExemptVariableAccess(node) && !isWriteTarget(node) && !(isWholeEnvSpread(node) && !boundaryFile)) {
           reads.push(node);
         }
       },
       "Program:exit"() {
-        if (boundaryFile && hasValidationCall) return;
-        for (const node of reads) context.report({ node, messageId: "noRawEnv" });
+        for (const node of reads) {
+          if (!boundaryFile || !reachesValidation(node, sourceCode2))
+            context.report({ node, messageId: "noRawEnv" });
+        }
       }
     };
   }
@@ -21535,14 +21588,15 @@ function resolve2(value, source, depth = 0) {
   if (depth >= MAX_DEPTH) return null;
   const node = value.node;
   if (node.type !== "TSTypeReference") return value;
-  if (node.typeName.type !== "Identifier") return null;
+  if (node.typeName.type !== "Identifier")
+    return libraryResult(node, source) ? value : null;
   const variable = typeBinding(source, node.typeName);
   if (variable === null || variable.defs.length === 0) return value;
   const bound = value.bindings.get(variable);
   if (bound !== void 0) return resolve2(bound, source, depth + 1);
   const declaration = variable.defs.length === 1 ? variable.defs[0]?.node : void 0;
   if (declaration?.type !== "TSTypeAliasDeclaration" && declaration?.type !== "TSInterfaceDeclaration")
-    return null;
+    return libraryResult(node, source) ? value : null;
   if (declaration.type === "TSInterfaceDeclaration" && declaration.extends.length !== 0)
     return null;
   const bindings = bindArguments(declaration, node, value, source);
@@ -21708,6 +21762,26 @@ function openStringField(fields2, owner, source, names, budget) {
   }
   return null;
 }
+function outcomeFailures(value, source, depth = 0, budget = { remaining: MAX_TYPE_STEPS }) {
+  if (depth >= MAX_DEPTH || --budget.remaining < 0) return [];
+  const resolved = resolve2(value, source);
+  if (resolved === null) return [];
+  const structural = failureMessages(resolved, source);
+  if (structural.length !== 0) return structural;
+  const library = libraryError(resolved, source);
+  if (library !== null) return [library];
+  const node = resolved.node;
+  if (node.type !== "TSTypeReference") return [];
+  if (node.typeName.type !== "Identifier" || !["Promise", "PromiseLike"].includes(node.typeName.name) || (typeBinding(source, node.typeName)?.defs.length ?? 0) !== 0 || node.typeArguments?.params.length !== 1)
+    return [];
+  const argument = node.typeArguments.params[0];
+  return argument === void 0 ? [] : outcomeFailures(
+    { ...resolved, node: argument, origin: argument },
+    source,
+    depth + 1,
+    budget
+  );
+}
 function failureMessages(value, source) {
   const members2 = variants(value, source);
   if (members2 === null || members2.length < 2) return [];
@@ -21800,14 +21874,18 @@ function variants(value, source, depth = 0, budget = { remaining: MAX_TYPE_STEPS
   }
   return result;
 }
-function libraryError(reference, source) {
-  if (reference.typeArguments?.params.length !== 2) return null;
-  if (!["Result", "ResultAsync"].includes(
-    libraryName(reference.typeName, source, true) ?? ""
-  ))
+function libraryError(value, source) {
+  const reference = value.node;
+  if (reference.type !== "TSTypeReference" || !libraryResult(reference, source))
     return null;
+  if (reference.typeArguments?.params.length !== 2) return null;
   const error = reference.typeArguments.params[1];
-  return error === void 0 ? null : weakError(view(error), source);
+  return error === void 0 ? null : weakError({ ...value, node: error, origin: error }, source);
+}
+function libraryResult(reference, source) {
+  return ["Result", "ResultAsync"].includes(
+    libraryName(reference.typeName, source, true) ?? ""
+  );
 }
 function libraryName(node, source, typeSpace) {
   const reference = libraryReference(node);
@@ -21833,16 +21911,6 @@ function libraryReference(node) {
     return { root: node.object, member: node.property.name };
   return null;
 }
-function weakAnnotation(node, source, depth = 0, budget = { remaining: MAX_TYPE_STEPS }) {
-  if (depth >= MAX_DEPTH || --budget.remaining < 0) return false;
-  if (failureMessages(view(node), source).length !== 0) return true;
-  if (node.type !== "TSTypeReference") return false;
-  if (libraryError(node, source) !== null) return true;
-  if (node.typeName.type !== "Identifier" || !["Promise", "PromiseLike"].includes(node.typeName.name) || typeBinding(source, node.typeName) !== null || node.typeArguments?.params.length !== 1)
-    return false;
-  const argument = node.typeArguments.params[0];
-  return argument !== void 0 && weakAnnotation(argument, source, depth + 1, budget);
-}
 function renderedFailure(node, source) {
   let value = unwrapExpression(node);
   if (value.type === "AwaitExpression")
@@ -21964,9 +22032,7 @@ var prefer_coded_error_result_default = defineRule({
   createOnce(context) {
     const reported = /* @__PURE__ */ new Set();
     function check(node) {
-      const candidates2 = failureMessages(view(node), context.sourceCode);
-      const library = node.type === "TSTypeReference" ? libraryError(node, context.sourceCode) : null;
-      for (const candidate2 of library === null ? candidates2 : [...candidates2, library]) {
+      for (const candidate2 of outcomeFailures(view(node), context.sourceCode)) {
         if (reported.has(candidate2)) continue;
         reported.add(candidate2);
         context.report({
@@ -21980,7 +22046,7 @@ var prefer_coded_error_result_default = defineRule({
       const rendered = renderedFailure(value, context.sourceCode);
       if (rendered === null || reported.has(rendered.node)) return;
       const contract = owner.returnType?.typeAnnotation;
-      if (contract !== void 0 && weakAnnotation(contract, context.sourceCode))
+      if (contract !== void 0 && outcomeFailures(view(contract), context.sourceCode).length !== 0)
         return;
       reported.add(rendered.node);
       context.report(rendered);
@@ -22035,7 +22101,7 @@ var prefer_configured_cloud_scope_default = defineRule({
     },
     schema: [],
     messages: {
-      configuredScope: "This outgoing Cloudflare management request uses a source-literal account scope. Read and validate the account ID from deployment configuration or environment variables at the boundary; keep independent security allowlists intact."
+      configuredScope: "This outgoing Cloudflare management request uses a source-literal account scope. Load the account ID into one shared Zod-validated settings object at startup, then inject or import it; keep independent security allowlists intact."
     }
   },
   createOnce(context) {
@@ -22062,14 +22128,16 @@ var prefer_configured_cloud_scope_default = defineRule({
       if (callee.type !== "Identifier") return false;
       const binding3 = bindingOf(callee);
       if (binding3 === null || binding3.defs.length === 0) return callee.name === "fetch";
-      if (seen.has(binding3) || seen.size >= 16 || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true)) return false;
+      if (seen.has(binding3) || seen.size >= 16 || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true))
+        return false;
       const next = /* @__PURE__ */ new Set([...seen, binding3]);
       const [definition] = binding3.defs;
       if (definition?.type === "Parameter") {
         const parameter = parentOf(definition.name);
         return parameter?.type === "AssignmentPattern" && parameter.left === definition.name && outgoingFetch(parameter.right, next);
       }
-      if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const") return false;
+      if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const")
+        return false;
       const declarator = definition.node;
       return declarator.id.type === "Identifier" && declarator.init !== null && outgoingFetch(declarator.init, next);
     }
@@ -22090,10 +22158,15 @@ var prefer_configured_cloud_scope_default = defineRule({
           }
           return;
         case "ObjectPattern":
-          for (const property of value.properties) checkWrite(property.type === "RestElement" ? property.argument : property.value, depth + 1);
+          for (const property of value.properties)
+            checkWrite(
+              property.type === "RestElement" ? property.argument : property.value,
+              depth + 1
+            );
           return;
         case "ArrayPattern":
-          for (const element of value.elements) if (element !== null) checkWrite(element, depth + 1);
+          for (const element of value.elements)
+            if (element !== null) checkWrite(element, depth + 1);
           return;
         case "AssignmentPattern":
           checkWrite(value.left, depth + 1);
@@ -22111,15 +22184,20 @@ var prefer_configured_cloud_scope_default = defineRule({
       }
       if (value.type === "Identifier") {
         const binding3 = bindingOf(value);
-        if (binding3 === null || seen.has(binding3) || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true)) return UNKNOWN;
+        if (binding3 === null || seen.has(binding3) || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true))
+          return UNKNOWN;
         const [definition] = binding3.defs;
-        if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const") return UNKNOWN;
+        if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const")
+          return UNKNOWN;
         const declarator = definition.node;
         if (declarator.id.type !== "Identifier" || declarator.init === null) return UNKNOWN;
         return urlParts(declarator.init, /* @__PURE__ */ new Set([...seen, binding3]), depth + 1);
       }
       if (value.type === "BinaryExpression" && value.operator === "+") {
-        return boundedParts([...urlParts(value.left, seen, depth + 1), ...urlParts(value.right, seen, depth + 1)]);
+        return boundedParts([
+          ...urlParts(value.left, seen, depth + 1),
+          ...urlParts(value.right, seen, depth + 1)
+        ]);
       }
       if (value.type === "TemplateLiteral") return templateParts(value, seen, depth);
       return UNKNOWN;

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   src_default
-} from "./chunk-MFL7OATV.js";
+} from "./chunk-7SYRLUE7.js";
 export {
   src_default as default
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "19.9.0",
+  "version": "19.12.0",
   "packageManager": "npm@12.2.1",
   "description": "Custom Oxlint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",