@sarj/eslint-plugin 2.12.0 → 2.12.1

package/dist/index.cjs

@@ -37,6 +37,30 @@ module.exports = __toCommonJS(index_exports);
 
 // src/rules/enforce-file-structure.ts
 var import_utils = require("@typescript-eslint/utils");
+
+// src/rules/_paths.ts
+var SCRIPT_FILE_RE = /([\\/]scripts[\\/])|(\.mjs$)/;
+var STORY_FILE_RE = /\.stories\.[cm]?[jt]sx?$/i;
+var GENERATED_FILE_RE = /([\\/]generated[\\/])|(\.gen\.[cm]?[jt]sx?$)|(\.generated\.[cm]?[jt]sx?$)|(\.d\.[cm]?ts$)/;
+function isTestFile(filename) {
+  const normalized = filename.replaceAll("\\", "/");
+  const base = normalized.slice(normalized.lastIndexOf("/") + 1);
+  if (/\.(test|spec|e2e|integration)\.[cm]?[jt]sx?$/.test(base)) {
+    return true;
+  }
+  return /(^|\/)(tests?|__tests__|__mocks__|fixtures|e2e|integration)\//.test(normalized);
+}
+function isStoryFile(filename) {
+  return STORY_FILE_RE.test(filename);
+}
+function isGeneratedFile(filename, sourceText = "") {
+  return GENERATED_FILE_RE.test(filename.replaceAll("\\", "/")) || /@generated\b/.test(sourceText.slice(0, 1024));
+}
+function isScriptFile(filename) {
+  return SCRIPT_FILE_RE.test(filename);
+}
+
+// src/rules/enforce-file-structure.ts
 var classifyStatement = (statement) => {
   switch (statement.type) {
     case import_utils.AST_NODE_TYPES.ImportDeclaration:
@@ -73,6 +97,9 @@ var enforce_file_structure_default = import_utils.ESLintUtils.RuleCreator(
   },
   defaultOptions: [],
   create(context) {
+    if (isTestFile(context.filename)) {
+      return {};
+    }
     return {
       Program(node) {
         const body = node.body;
@@ -599,22 +626,6 @@ var no_enum_default = import_utils4.ESLintUtils.RuleCreator(
 
 // src/rules/no-insecure-random-id.ts
 var import_utils5 = require("@typescript-eslint/utils");
-
-// src/rules/_paths.ts
-var SCRIPT_FILE_RE = /([\\/]scripts[\\/])|(\.mjs$)/;
-function isTestFile(filename) {
-  const normalized = filename.replaceAll("\\", "/");
-  const base = normalized.slice(normalized.lastIndexOf("/") + 1);
-  if (/\.(test|spec)\.[cm]?[jt]sx?$/.test(base)) {
-    return true;
-  }
-  return /(^|\/)(tests?|__tests__|__mocks__|fixtures)\//.test(normalized);
-}
-function isScriptFile(filename) {
-  return SCRIPT_FILE_RE.test(filename);
-}
-
-// src/rules/no-insecure-random-id.ts
 var STRONG_SECURITY_PATTERN = /token|secret|csrf|password|passwd|apikey|api[-_]?key|nonce|salt|uuid|authid/i;
 var NON_SECURITY_ID_PATTERN = /temp|tmp|cache|correlation|request|req|trace|execution|dev|hmr|mock|test|perf|marker/i;
 var PATH_OR_DOM_MARKER = /[\\/#]|\.[A-Za-z0-9]/;
@@ -1158,6 +1169,10 @@ var no_log_only_catch_default = import_utils8.ESLintUtils.RuleCreator(
 // src/rules/no-raw-env.ts
 var import_utils9 = require("@typescript-eslint/utils");
 var CONFIG_FILE_RE = /(^|[\\/])[\w.-]+\.config\.[cm]?[jt]sx?$/;
+var ENV_BOUNDARY_FILE_RE = /(^|[\\/])(?:env|client-env|server-env|client-settings|server-settings)\.[cm]?[jt]sx?$/;
+function isValidatedEnvBoundary(filename, sourceText) {
+  return ENV_BOUNDARY_FILE_RE.test(filename.replaceAll("\\", "/")) && /\bz\.object\s*\(/.test(sourceText) && /\.parse\s*\(/.test(sourceText);
+}
 function isProcessEnv(node) {
   return !node.computed && node.object.type === "Identifier" && node.object.name === "process" && node.property.type === "Identifier" && node.property.name === "env";
 }
@@ -1207,7 +1222,7 @@ var no_raw_env_default = import_utils9.ESLintUtils.RuleCreator(
   defaultOptions: [],
   create(context) {
     const filename = context.filename;
-    if (isTestFile(filename) || isScriptFile(filename) || CONFIG_FILE_RE.test(filename.replaceAll("\\", "/"))) {
+    if (isTestFile(filename) || isScriptFile(filename) || CONFIG_FILE_RE.test(filename.replaceAll("\\", "/")) || isValidatedEnvBoundary(filename, context.sourceCode.text)) {
       return {};
     }
     return {
@@ -2518,6 +2533,8 @@ var prefer_schema_for_api_payload_default = import_utils16.ESLintUtils.RuleCreat
 
 // src/rules/prefer-semantic-colors.ts
 var import_utils17 = require("@typescript-eslint/utils");
+var import_fs = require("fs");
+var import_path = require("path");
 
 // src/rules/_tailwind.ts
 var tailwindBase = (token) => token.replace(/^(?:[a-z0-9-]+:)+/i, "").replace(/^!/, "");
@@ -2555,6 +2572,20 @@ var STYLE_COLOR_PROPS = /* @__PURE__ */ new Set([
 ]);
 var RAW_COLOR_VALUE_RE = new RegExp(`#[0-9a-fA-F]{3,8}\\b|\\b(?:${COLOR_FN})\\s*\\(`, "i");
 var STORIES_FILE_RE = /\.stories\.[cm]?[jt]sx?$/i;
+var SEMANTIC_TOKEN_RE = /--(?:background|foreground|primary|secondary|muted|accent|destructive|border|card|popover)\b|(?:bg|text|border)-(?:background|foreground|primary|secondary|muted|accent|destructive|border|card|popover)\b/;
+var DETECTION_FILES = [
+  "components.json",
+  "tailwind.config.js",
+  "tailwind.config.cjs",
+  "tailwind.config.mjs",
+  "tailwind.config.ts",
+  "app/globals.css",
+  "src/app/globals.css",
+  "src/index.css",
+  "src/styles/globals.css",
+  "styles/globals.css"
+];
+var semanticTokenCache = /* @__PURE__ */ new Map();
 var SVG_DEFS_CONTAINERS = /* @__PURE__ */ new Set([
   "mask",
   "clipPath",
@@ -2583,6 +2614,34 @@ var isInsideSvg = (node) => {
   }
   return false;
 };
+var hasSemanticTokenSystem = (filename) => {
+  let dir = (0, import_path.dirname)(filename);
+  const root = (0, import_path.parse)(dir).root;
+  for (let depth = 0; depth < 8; depth += 1) {
+    const cached = semanticTokenCache.get(dir);
+    if (cached !== void 0) return cached;
+    let found = false;
+    for (const rel of DETECTION_FILES) {
+      const candidate = (0, import_path.join)(dir, rel);
+      if (!(0, import_fs.existsSync)(candidate)) continue;
+      if (rel === "components.json") {
+        found = true;
+        break;
+      }
+      try {
+        if (SEMANTIC_TOKEN_RE.test((0, import_fs.readFileSync)(candidate, "utf8"))) {
+          found = true;
+          break;
+        }
+      } catch {
+      }
+    }
+    semanticTokenCache.set(dir, found);
+    if (found || dir === root) return found;
+    dir = (0, import_path.dirname)(dir);
+  }
+  return false;
+};
 var propName = (key) => {
   if (key.type === import_utils17.AST_NODE_TYPES.Identifier) return key.name;
   if (key.type === import_utils17.AST_NODE_TYPES.Literal && typeof key.value === "string") return key.value;
@@ -2597,16 +2656,27 @@ var prefer_semantic_colors_default = import_utils17.ESLintUtils.RuleCreator(
     docs: {
       description: "Enforce design-system semantic color tokens (bg-primary, text-destructive, \u2026) over raw Tailwind palette classes (text-red-500), arbitrary color values (bg-[#fff]), and inline color literals."
     },
-    schema: [],
+    schema: [
+      {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          requireSemanticTokens: { type: "boolean" }
+        }
+      }
+    ],
     messages: {
       rawPalette: "Raw palette class '{{class}}' \u2014 use a semantic token (e.g. text-foreground, bg-primary, text-destructive, bg-muted).",
       arbitraryColor: "Hardcoded color '{{class}}' \u2014 use a semantic token, or var(--\u2026). For charts/brand add an eslint-disable with a reason.",
       inlineColor: "Hardcoded color '{{value}}' \u2014 use a semantic token / CSS variable. For charts/standalone pages add an eslint-disable with a reason."
     }
   },
-  defaultOptions: [],
-  create(context) {
+  defaultOptions: [{}],
+  create(context, [options]) {
     if (STORIES_FILE_RE.test(context.filename)) return {};
+    if (options?.requireSemanticTokens === true && !hasSemanticTokenSystem(context.filename)) {
+      return {};
+    }
     const reportClasses = (value, node) => {
       for (const token of classTokens(value)) {
         const base = tailwindBase(token);
@@ -2865,7 +2935,7 @@ var INPUT_TYPE_REPLACEMENTS = {
   radio: "RadioGroup",
   range: "Slider"
 };
-var SKIPPED_INPUT_TYPES = /* @__PURE__ */ new Set(["hidden"]);
+var SKIPPED_INPUT_TYPES = /* @__PURE__ */ new Set(["file", "hidden"]);
 var kebabCase = (component) => component.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
 var literalTypeAttr = (node) => {
   for (const attribute of node.attributes) {
@@ -2879,8 +2949,12 @@ var literalTypeAttr = (node) => {
   }
   return null;
 };
+var hasFileAcceptAttr = (node) => node.attributes.some(
+  (attribute) => attribute.type === import_utils19.AST_NODE_TYPES.JSXAttribute && attribute.name.type === import_utils19.AST_NODE_TYPES.JSXIdentifier && attribute.name.name === "accept"
+);
 var resolveInputReplacement = (node) => {
   const typeAttr = literalTypeAttr(node);
+  if (hasFileAcceptAttr(node)) return null;
   if (typeAttr === null || typeAttr.kind === "dynamic") return "Input";
   if (SKIPPED_INPUT_TYPES.has(typeAttr.value)) return null;
   return INPUT_TYPE_REPLACEMENTS[typeAttr.value] ?? "Input";
@@ -2901,7 +2975,7 @@ var prefer_shadcn_default = import_utils19.ESLintUtils.RuleCreator(
   },
   defaultOptions: [],
   create(context) {
-    if (isTestFile(context.filename)) {
+    if (isTestFile(context.filename) || isStoryFile(context.filename)) {
       return {};
     }
     return {
@@ -3219,7 +3293,7 @@ var zod_naming_convention_default = import_utils22.ESLintUtils.RuleCreator(
     const convention = optionsArg?.convention ?? "either";
     const { test, messageId } = CONVENTIONS[convention];
     const acceptsSchemaWord = convention !== "prefix";
-    if (isTestFile(context.filename)) {
+    if (isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) {
       return {};
     }
     return {
@@ -5518,7 +5592,9 @@ var EQUALITY_OPERATORS = /* @__PURE__ */ new Set(["===", "!==", "==", "!="]);
 var SENTINEL_IDENTIFIERS = /* @__PURE__ */ new Set(["undefined", "NaN"]);
 var SENTINEL_WORDS = /(^|_)(SENTINEL|EMPTY|NONE|NULL|UNSET|MISSING|PLACEHOLDER|DUMMY|FAKE|EXAMPLE)(_|$)/;
 var SENTINEL_PREFIX_RE = /^(skip|sentinel|empty|none|missing|unset|placeholder|dummy|fake|example|noop)[A-Z]/;
+var AST_NODE_TYPE_RE = /^(?:TS|JSX)?[A-Z][A-Za-z]*(?:Signature|Keyword|Expression|Declaration|Element|Literal|Identifier)$/;
 function isConstantReference(identifier) {
+  if (AST_NODE_TYPE_RE.test(identifier)) return true;
   if (isAuthSecretName(identifier) && !SENTINEL_WORDS.test(identifier)) return false;
   return identifier === identifier.toUpperCase() && /[A-Za-z]/.test(identifier);
 }
@@ -5785,6 +5861,7 @@ var GLOBAL_RECEIVERS = /* @__PURE__ */ new Set([
   "window",
   "self"
 ]);
+var PRESIGNED_URL_NAME_RE = /(?:pre-?signed|signed|upload|download)Url$/i;
 function isGlobalFetchCall(node) {
   const callee = node.callee;
   if (callee.type === "Identifier") {
@@ -5795,6 +5872,23 @@ function isGlobalFetchCall(node) {
   }
   return false;
 }
+function identifierLikeName(node) {
+  if (node.type === "Identifier") {
+    return node.name;
+  }
+  if (node.type === "MemberExpression" && !node.computed && node.property.type === "Identifier") {
+    return node.property.name;
+  }
+  return null;
+}
+function isPresignedUrlTransfer(node) {
+  const first = node.arguments[0];
+  if (first === void 0) {
+    return false;
+  }
+  const name = identifierLikeName(first);
+  return name !== null && PRESIGNED_URL_NAME_RE.test(name);
+}
 function compile(patterns) {
   const compiled = [];
   for (const pattern of patterns) {
@@ -5841,6 +5935,9 @@ var no_raw_fetch_outside_clients_default = import_utils42.ESLintUtils.RuleCreato
     }
     return {
       CallExpression(node) {
+        if (isPresignedUrlTransfer(node)) {
+          return;
+        }
         if (isGlobalFetchCall(node)) {
           context.report({ node, messageId: "rawFetch" });
         }
@@ -6466,7 +6563,7 @@ var rules = {
 var plugin = {
   meta: {
     name: "@sarj/eslint-plugin",
-    version: "2.12.0"
+    version: "2.12.1"
   },
   rules,
   configs: {
@@ -6491,7 +6588,7 @@ var plugin = {
         "@sarj/prefer-discriminated-union": "warn",
         "@sarj/no-comment-cruft": "warn",
         // Frontend / styling — distilled from frontend PR-review mining.
-        "@sarj/prefer-semantic-colors": "warn",
+        "@sarj/prefer-semantic-colors": ["warn", { requireSemanticTokens: true }],
         // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
         "@sarj/no-fat-try-blocks": "warn",
         "@sarj/no-cors-wildcard-with-credentials": "warn",
@@ -6550,7 +6647,7 @@ var plugin = {
         "@sarj/no-comment-cruft": "error",
         // Frontend / styling — distilled from frontend PR-review mining. Stylistic,
         // no autofix → warn (rollout should prove the FP rate before raising it).
-        "@sarj/prefer-semantic-colors": "error",
+        "@sarj/prefer-semantic-colors": ["error", { requireSemanticTokens: true }],
         // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
         "@sarj/no-fat-try-blocks": "error",
         "@sarj/no-cors-wildcard-with-credentials": "error",