@sarj/eslint-plugin 2.11.0 → 2.12.0

package/dist/index.d.cts

@@ -66,7 +66,8 @@ interface RuleOptions$2 {
  * NOT FLAGGED
  *   - Files whose path matches one of the `allow` patterns. The defaults cover
  *     the conventions we have seen in practice — a `clients/` directory, a
- *     `*-client.ts` module, an `http-client.*` wrapper — plus test files.
+ *     `*-client.ts` module, an `http-client.*` wrapper, an `api/` directory or
+ *     `api.ts` / `*-api.ts` module — plus test files and codemod fixtures.
  *   - A method named `fetch` on some other receiver (`cache.fetch(k)`,
  *     `queryClient.fetch()`): only the global is HTTP.
  *   - `new Request(...)` / `axios(...)` and friends. This rule is about the
@@ -83,6 +84,21 @@ interface RuleOptions$2 {
  *
  * Supplying `allow` REPLACES the defaults, so include the test patterns if you
  * still want test files exempt.
+ *
+ * CORPUS SWEEP (2220 files, zod / TanStack Query / react-router / swr /
+ * zustand, 2026-07): 96 raw hits. The defaults missed three path conventions
+ * that ARE the client layer, so the reports landed on the very modules the rule
+ * wants the `fetch` to live in:
+ *   - `api.ts` / `api/` / `*-api.ts` — 15 hits, e.g.
+ *     `query/examples/react/star-wars/src/api.ts:7`, a module that exists solely
+ *     to own `getFilm`/`getPerson` HTTP calls. `api` is the same convention
+ *     family as `clients/`, just the other common spelling.
+ *   - Hyphenated test basenames (`*-test.ts` / `*-spec.ts`) — the default list
+ *     only knew the dotted `*.test.ts` form, so react-router's entire suite
+ *     (which names files `single-fetch-test.ts`) was unprotected.
+ *   - `__testfixtures__/` — 8 hits from jscodeshift fixtures such as
+ *     `query/packages/query-codemods/src/v5/remove-overloads/__testfixtures__/bug-reports.input.tsx`,
+ *     which are input/output text for a codemod, not code that runs.
  */
 
 interface RuleOptions$1 {
@@ -116,6 +132,18 @@ interface RuleOptions$1 {
  *     mechanism, not a bypass of it.
  *   - `.prepare()` on something that is not a database. Requiring an
  *     interpolated runtime value keeps this rare in practice.
+ *   - A statement text that contains no SQL data-statement keyword. `exec` and
+ *     `query` are not SQL-specific names: a 5-repo sweep of real TypeScript
+ *     (zod / TanStack Query / react-router / swr / zustand, 2,186 files) found
+ *     4/4 hits were `child_process.exec` building a SHELL command line —
+ *     an `open <url>` at
+ *     react-router/integration/helpers/playwright-fixture.ts:230 and an
+ *     `npm view <pkg>@<version> version` at
+ *     react-router/scripts/changes/publish.ts:111. Requiring the statement to
+ *     actually read as SQL (`SELECT` / `INSERT INTO` / `UPDATE` / `DELETE FROM`
+ *     / DDL / `PRAGMA` / a CTE head) takes that class to zero without touching
+ *     any real injection: an interpolated statement with no SQL verb in it was
+ *     never a SQL statement.
  *
  * CONFIGURATION
  * `methods` is the list of statement-taking method names to inspect. Extend it

package/dist/index.d.ts

@@ -66,7 +66,8 @@ interface RuleOptions$2 {
  * NOT FLAGGED
  *   - Files whose path matches one of the `allow` patterns. The defaults cover
  *     the conventions we have seen in practice — a `clients/` directory, a
- *     `*-client.ts` module, an `http-client.*` wrapper — plus test files.
+ *     `*-client.ts` module, an `http-client.*` wrapper, an `api/` directory or
+ *     `api.ts` / `*-api.ts` module — plus test files and codemod fixtures.
  *   - A method named `fetch` on some other receiver (`cache.fetch(k)`,
  *     `queryClient.fetch()`): only the global is HTTP.
  *   - `new Request(...)` / `axios(...)` and friends. This rule is about the
@@ -83,6 +84,21 @@ interface RuleOptions$2 {
  *
  * Supplying `allow` REPLACES the defaults, so include the test patterns if you
  * still want test files exempt.
+ *
+ * CORPUS SWEEP (2220 files, zod / TanStack Query / react-router / swr /
+ * zustand, 2026-07): 96 raw hits. The defaults missed three path conventions
+ * that ARE the client layer, so the reports landed on the very modules the rule
+ * wants the `fetch` to live in:
+ *   - `api.ts` / `api/` / `*-api.ts` — 15 hits, e.g.
+ *     `query/examples/react/star-wars/src/api.ts:7`, a module that exists solely
+ *     to own `getFilm`/`getPerson` HTTP calls. `api` is the same convention
+ *     family as `clients/`, just the other common spelling.
+ *   - Hyphenated test basenames (`*-test.ts` / `*-spec.ts`) — the default list
+ *     only knew the dotted `*.test.ts` form, so react-router's entire suite
+ *     (which names files `single-fetch-test.ts`) was unprotected.
+ *   - `__testfixtures__/` — 8 hits from jscodeshift fixtures such as
+ *     `query/packages/query-codemods/src/v5/remove-overloads/__testfixtures__/bug-reports.input.tsx`,
+ *     which are input/output text for a codemod, not code that runs.
  */
 
 interface RuleOptions$1 {
@@ -116,6 +132,18 @@ interface RuleOptions$1 {
  *     mechanism, not a bypass of it.
  *   - `.prepare()` on something that is not a database. Requiring an
  *     interpolated runtime value keeps this rare in practice.
+ *   - A statement text that contains no SQL data-statement keyword. `exec` and
+ *     `query` are not SQL-specific names: a 5-repo sweep of real TypeScript
+ *     (zod / TanStack Query / react-router / swr / zustand, 2,186 files) found
+ *     4/4 hits were `child_process.exec` building a SHELL command line —
+ *     an `open <url>` at
+ *     react-router/integration/helpers/playwright-fixture.ts:230 and an
+ *     `npm view <pkg>@<version> version` at
+ *     react-router/scripts/changes/publish.ts:111. Requiring the statement to
+ *     actually read as SQL (`SELECT` / `INSERT INTO` / `UPDATE` / `DELETE FROM`
+ *     / DDL / `PRAGMA` / a CTE head) takes that class to zero without touching
+ *     any real injection: an interpolated statement with no SQL verb in it was
+ *     never a SQL statement.
  *
  * CONFIGURATION
  * `methods` is the list of statement-taking method names to inspect. Extend it