@sarj/eslint-plugin 2.11.0 → 2.12.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/index.cjs +562 -52
  2. package/dist/index.cjs.map +1 -1
  3. package/dist/index.d.cts +45 -5
  4. package/dist/index.d.ts +45 -5
  5. package/dist/index.js +562 -52
  6. package/dist/index.js.map +1 -1
  7. package/package.json +1 -1
package/dist/index.d.cts CHANGED
@@ -66,9 +66,14 @@ interface RuleOptions$2 {
66
66
  * NOT FLAGGED
67
67
  * - Files whose path matches one of the `allow` patterns. The defaults cover
68
68
  * the conventions we have seen in practice — a `clients/` directory, a
69
- * `*-client.ts` module, an `http-client.*` wrapper — plus test files.
69
+ * `*-client.ts` module, an `http-client.*` wrapper, an `api/` directory or
70
+ * `api.ts` / `*-api.ts` module — plus test files and codemod fixtures.
70
71
  * - A method named `fetch` on some other receiver (`cache.fetch(k)`,
71
72
  * `queryClient.fetch()`): only the global is HTTP.
73
+ * - A pre-signed upload/download URL transfer (`fetch(uploadUrl, ...)`,
74
+ * `fetch(file.downloadUrl)`). Those URLs are one-off storage handoffs,
75
+ * not calls to a first-party service API that belongs behind a client
76
+ * wrapper.
72
77
  * - `new Request(...)` / `axios(...)` and friends. This rule is about the
73
78
  * global `fetch`, not about every HTTP library.
74
79
  *
@@ -83,6 +88,21 @@ interface RuleOptions$2 {
83
88
  *
84
89
  * Supplying `allow` REPLACES the defaults, so include the test patterns if you
85
90
  * still want test files exempt.
91
+ *
92
+ * CORPUS SWEEP (2220 files, zod / TanStack Query / react-router / swr /
93
+ * zustand, 2026-07): 96 raw hits. The defaults missed three path conventions
94
+ * that ARE the client layer, so the reports landed on the very modules the rule
95
+ * wants the `fetch` to live in:
96
+ * - `api.ts` / `api/` / `*-api.ts` — 15 hits, e.g.
97
+ * `query/examples/react/star-wars/src/api.ts:7`, a module that exists solely
98
+ * to own `getFilm`/`getPerson` HTTP calls. `api` is the same convention
99
+ * family as `clients/`, just the other common spelling.
100
+ * - Hyphenated test basenames (`*-test.ts` / `*-spec.ts`) — the default list
101
+ * only knew the dotted `*.test.ts` form, so react-router's entire suite
102
+ * (which names files `single-fetch-test.ts`) was unprotected.
103
+ * - `__testfixtures__/` — 8 hits from jscodeshift fixtures such as
104
+ * `query/packages/query-codemods/src/v5/remove-overloads/__testfixtures__/bug-reports.input.tsx`,
105
+ * which are input/output text for a codemod, not code that runs.
86
106
  */
87
107
 
88
108
  interface RuleOptions$1 {
@@ -116,6 +136,18 @@ interface RuleOptions$1 {
116
136
  * mechanism, not a bypass of it.
117
137
  * - `.prepare()` on something that is not a database. Requiring an
118
138
  * interpolated runtime value keeps this rare in practice.
139
+ * - A statement text that contains no SQL data-statement keyword. `exec` and
140
+ * `query` are not SQL-specific names: a 5-repo sweep of real TypeScript
141
+ * (zod / TanStack Query / react-router / swr / zustand, 2,186 files) found
142
+ * 4/4 hits were `child_process.exec` building a SHELL command line —
143
+ * an `open <url>` at
144
+ * react-router/integration/helpers/playwright-fixture.ts:230 and an
145
+ * `npm view <pkg>@<version> version` at
146
+ * react-router/scripts/changes/publish.ts:111. Requiring the statement to
147
+ * actually read as SQL (`SELECT` / `INSERT INTO` / `UPDATE` / `DELETE FROM`
148
+ * / DDL / `PRAGMA` / a CTE head) takes that class to zero without touching
149
+ * any real injection: an interpolated statement with no SQL verb in it was
150
+ * never a SQL statement.
119
151
  *
120
152
  * CONFIGURATION
121
153
  * `methods` is the list of statement-taking method names to inspect. Extend it
@@ -209,7 +241,9 @@ declare const rules: {
209
241
  "prefer-schema-for-api-payload": _typescript_eslint_utils_ts_eslint.RuleModule<"unparsedJsonAccess", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
210
242
  name: string;
211
243
  };
212
- "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
244
+ "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [{
245
+ requireSemanticTokens?: boolean;
246
+ }?], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
213
247
  name: string;
214
248
  };
215
249
  "prefer-server-actions": _typescript_eslint_utils_ts_eslint.RuleModule<"preferServerAction", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
@@ -351,7 +385,9 @@ declare const plugin: {
351
385
  "prefer-schema-for-api-payload": _typescript_eslint_utils_ts_eslint.RuleModule<"unparsedJsonAccess", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
352
386
  name: string;
353
387
  };
354
- "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
388
+ "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [{
389
+ requireSemanticTokens?: boolean;
390
+ }?], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
355
391
  name: string;
356
392
  };
357
393
  "prefer-server-actions": _typescript_eslint_utils_ts_eslint.RuleModule<"preferServerAction", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
@@ -463,7 +499,9 @@ declare const plugin: {
463
499
  "@sarj/no-string-concat-in-loop": string;
464
500
  "@sarj/prefer-discriminated-union": string;
465
501
  "@sarj/no-comment-cruft": string;
466
- "@sarj/prefer-semantic-colors": string;
502
+ "@sarj/prefer-semantic-colors": (string | {
503
+ requireSemanticTokens: boolean;
504
+ })[];
467
505
  "@sarj/no-fat-try-blocks": string;
468
506
  "@sarj/no-cors-wildcard-with-credentials": string;
469
507
  "@sarj/no-secret-in-log": string;
@@ -507,7 +545,9 @@ declare const plugin: {
507
545
  "@sarj/no-string-concat-in-loop": string;
508
546
  "@sarj/prefer-discriminated-union": string;
509
547
  "@sarj/no-comment-cruft": string;
510
- "@sarj/prefer-semantic-colors": string;
548
+ "@sarj/prefer-semantic-colors": (string | {
549
+ requireSemanticTokens: boolean;
550
+ })[];
511
551
  "@sarj/no-fat-try-blocks": string;
512
552
  "@sarj/no-cors-wildcard-with-credentials": string;
513
553
  "@sarj/no-secret-in-log": string;
package/dist/index.d.ts CHANGED
@@ -66,9 +66,14 @@ interface RuleOptions$2 {
66
66
  * NOT FLAGGED
67
67
  * - Files whose path matches one of the `allow` patterns. The defaults cover
68
68
  * the conventions we have seen in practice — a `clients/` directory, a
69
- * `*-client.ts` module, an `http-client.*` wrapper — plus test files.
69
+ * `*-client.ts` module, an `http-client.*` wrapper, an `api/` directory or
70
+ * `api.ts` / `*-api.ts` module — plus test files and codemod fixtures.
70
71
  * - A method named `fetch` on some other receiver (`cache.fetch(k)`,
71
72
  * `queryClient.fetch()`): only the global is HTTP.
73
+ * - A pre-signed upload/download URL transfer (`fetch(uploadUrl, ...)`,
74
+ * `fetch(file.downloadUrl)`). Those URLs are one-off storage handoffs,
75
+ * not calls to a first-party service API that belongs behind a client
76
+ * wrapper.
72
77
  * - `new Request(...)` / `axios(...)` and friends. This rule is about the
73
78
  * global `fetch`, not about every HTTP library.
74
79
  *
@@ -83,6 +88,21 @@ interface RuleOptions$2 {
83
88
  *
84
89
  * Supplying `allow` REPLACES the defaults, so include the test patterns if you
85
90
  * still want test files exempt.
91
+ *
92
+ * CORPUS SWEEP (2220 files, zod / TanStack Query / react-router / swr /
93
+ * zustand, 2026-07): 96 raw hits. The defaults missed three path conventions
94
+ * that ARE the client layer, so the reports landed on the very modules the rule
95
+ * wants the `fetch` to live in:
96
+ * - `api.ts` / `api/` / `*-api.ts` — 15 hits, e.g.
97
+ * `query/examples/react/star-wars/src/api.ts:7`, a module that exists solely
98
+ * to own `getFilm`/`getPerson` HTTP calls. `api` is the same convention
99
+ * family as `clients/`, just the other common spelling.
100
+ * - Hyphenated test basenames (`*-test.ts` / `*-spec.ts`) — the default list
101
+ * only knew the dotted `*.test.ts` form, so react-router's entire suite
102
+ * (which names files `single-fetch-test.ts`) was unprotected.
103
+ * - `__testfixtures__/` — 8 hits from jscodeshift fixtures such as
104
+ * `query/packages/query-codemods/src/v5/remove-overloads/__testfixtures__/bug-reports.input.tsx`,
105
+ * which are input/output text for a codemod, not code that runs.
86
106
  */
87
107
 
88
108
  interface RuleOptions$1 {
@@ -116,6 +136,18 @@ interface RuleOptions$1 {
116
136
  * mechanism, not a bypass of it.
117
137
  * - `.prepare()` on something that is not a database. Requiring an
118
138
  * interpolated runtime value keeps this rare in practice.
139
+ * - A statement text that contains no SQL data-statement keyword. `exec` and
140
+ * `query` are not SQL-specific names: a 5-repo sweep of real TypeScript
141
+ * (zod / TanStack Query / react-router / swr / zustand, 2,186 files) found
142
+ * 4/4 hits were `child_process.exec` building a SHELL command line —
143
+ * an `open <url>` at
144
+ * react-router/integration/helpers/playwright-fixture.ts:230 and an
145
+ * `npm view <pkg>@<version> version` at
146
+ * react-router/scripts/changes/publish.ts:111. Requiring the statement to
147
+ * actually read as SQL (`SELECT` / `INSERT INTO` / `UPDATE` / `DELETE FROM`
148
+ * / DDL / `PRAGMA` / a CTE head) takes that class to zero without touching
149
+ * any real injection: an interpolated statement with no SQL verb in it was
150
+ * never a SQL statement.
119
151
  *
120
152
  * CONFIGURATION
121
153
  * `methods` is the list of statement-taking method names to inspect. Extend it
@@ -209,7 +241,9 @@ declare const rules: {
209
241
  "prefer-schema-for-api-payload": _typescript_eslint_utils_ts_eslint.RuleModule<"unparsedJsonAccess", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
210
242
  name: string;
211
243
  };
212
- "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
244
+ "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [{
245
+ requireSemanticTokens?: boolean;
246
+ }?], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
213
247
  name: string;
214
248
  };
215
249
  "prefer-server-actions": _typescript_eslint_utils_ts_eslint.RuleModule<"preferServerAction", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
@@ -351,7 +385,9 @@ declare const plugin: {
351
385
  "prefer-schema-for-api-payload": _typescript_eslint_utils_ts_eslint.RuleModule<"unparsedJsonAccess", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
352
386
  name: string;
353
387
  };
354
- "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
388
+ "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [{
389
+ requireSemanticTokens?: boolean;
390
+ }?], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
355
391
  name: string;
356
392
  };
357
393
  "prefer-server-actions": _typescript_eslint_utils_ts_eslint.RuleModule<"preferServerAction", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
@@ -463,7 +499,9 @@ declare const plugin: {
463
499
  "@sarj/no-string-concat-in-loop": string;
464
500
  "@sarj/prefer-discriminated-union": string;
465
501
  "@sarj/no-comment-cruft": string;
466
- "@sarj/prefer-semantic-colors": string;
502
+ "@sarj/prefer-semantic-colors": (string | {
503
+ requireSemanticTokens: boolean;
504
+ })[];
467
505
  "@sarj/no-fat-try-blocks": string;
468
506
  "@sarj/no-cors-wildcard-with-credentials": string;
469
507
  "@sarj/no-secret-in-log": string;
@@ -507,7 +545,9 @@ declare const plugin: {
507
545
  "@sarj/no-string-concat-in-loop": string;
508
546
  "@sarj/prefer-discriminated-union": string;
509
547
  "@sarj/no-comment-cruft": string;
510
- "@sarj/prefer-semantic-colors": string;
548
+ "@sarj/prefer-semantic-colors": (string | {
549
+ requireSemanticTokens: boolean;
550
+ })[];
511
551
  "@sarj/no-fat-try-blocks": string;
512
552
  "@sarj/no-cors-wildcard-with-credentials": string;
513
553
  "@sarj/no-secret-in-log": string;