@sarj/eslint-plugin 2.12.0 → 2.12.1

package/dist/index.d.cts

@@ -70,6 +70,10 @@ interface RuleOptions$2 {
  *     `api.ts` / `*-api.ts` module — plus test files and codemod fixtures.
  *   - A method named `fetch` on some other receiver (`cache.fetch(k)`,
  *     `queryClient.fetch()`): only the global is HTTP.
+ *   - A pre-signed upload/download URL transfer (`fetch(uploadUrl, ...)`,
+ *     `fetch(file.downloadUrl)`). Those URLs are one-off storage handoffs,
+ *     not calls to a first-party service API that belongs behind a client
+ *     wrapper.
  *   - `new Request(...)` / `axios(...)` and friends. This rule is about the
  *     global `fetch`, not about every HTTP library.
  *
@@ -237,7 +241,9 @@ declare const rules: {
     "prefer-schema-for-api-payload": _typescript_eslint_utils_ts_eslint.RuleModule<"unparsedJsonAccess", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
-    "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+    "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [{
+        requireSemanticTokens?: boolean;
+    }?], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
     "prefer-server-actions": _typescript_eslint_utils_ts_eslint.RuleModule<"preferServerAction", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
@@ -379,7 +385,9 @@ declare const plugin: {
         "prefer-schema-for-api-payload": _typescript_eslint_utils_ts_eslint.RuleModule<"unparsedJsonAccess", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
-        "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [{
+            requireSemanticTokens?: boolean;
+        }?], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
         "prefer-server-actions": _typescript_eslint_utils_ts_eslint.RuleModule<"preferServerAction", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
@@ -491,7 +499,9 @@ declare const plugin: {
                 "@sarj/no-string-concat-in-loop": string;
                 "@sarj/prefer-discriminated-union": string;
                 "@sarj/no-comment-cruft": string;
-                "@sarj/prefer-semantic-colors": string;
+                "@sarj/prefer-semantic-colors": (string | {
+                    requireSemanticTokens: boolean;
+                })[];
                 "@sarj/no-fat-try-blocks": string;
                 "@sarj/no-cors-wildcard-with-credentials": string;
                 "@sarj/no-secret-in-log": string;
@@ -535,7 +545,9 @@ declare const plugin: {
                 "@sarj/no-string-concat-in-loop": string;
                 "@sarj/prefer-discriminated-union": string;
                 "@sarj/no-comment-cruft": string;
-                "@sarj/prefer-semantic-colors": string;
+                "@sarj/prefer-semantic-colors": (string | {
+                    requireSemanticTokens: boolean;
+                })[];
                 "@sarj/no-fat-try-blocks": string;
                 "@sarj/no-cors-wildcard-with-credentials": string;
                 "@sarj/no-secret-in-log": string;

package/dist/index.d.ts

@@ -70,6 +70,10 @@ interface RuleOptions$2 {
  *     `api.ts` / `*-api.ts` module — plus test files and codemod fixtures.
  *   - A method named `fetch` on some other receiver (`cache.fetch(k)`,
  *     `queryClient.fetch()`): only the global is HTTP.
+ *   - A pre-signed upload/download URL transfer (`fetch(uploadUrl, ...)`,
+ *     `fetch(file.downloadUrl)`). Those URLs are one-off storage handoffs,
+ *     not calls to a first-party service API that belongs behind a client
+ *     wrapper.
  *   - `new Request(...)` / `axios(...)` and friends. This rule is about the
  *     global `fetch`, not about every HTTP library.
  *
@@ -237,7 +241,9 @@ declare const rules: {
     "prefer-schema-for-api-payload": _typescript_eslint_utils_ts_eslint.RuleModule<"unparsedJsonAccess", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
-    "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+    "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [{
+        requireSemanticTokens?: boolean;
+    }?], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
     "prefer-server-actions": _typescript_eslint_utils_ts_eslint.RuleModule<"preferServerAction", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
@@ -379,7 +385,9 @@ declare const plugin: {
         "prefer-schema-for-api-payload": _typescript_eslint_utils_ts_eslint.RuleModule<"unparsedJsonAccess", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
-        "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [{
+            requireSemanticTokens?: boolean;
+        }?], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
         "prefer-server-actions": _typescript_eslint_utils_ts_eslint.RuleModule<"preferServerAction", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
@@ -491,7 +499,9 @@ declare const plugin: {
                 "@sarj/no-string-concat-in-loop": string;
                 "@sarj/prefer-discriminated-union": string;
                 "@sarj/no-comment-cruft": string;
-                "@sarj/prefer-semantic-colors": string;
+                "@sarj/prefer-semantic-colors": (string | {
+                    requireSemanticTokens: boolean;
+                })[];
                 "@sarj/no-fat-try-blocks": string;
                 "@sarj/no-cors-wildcard-with-credentials": string;
                 "@sarj/no-secret-in-log": string;
@@ -535,7 +545,9 @@ declare const plugin: {
                 "@sarj/no-string-concat-in-loop": string;
                 "@sarj/prefer-discriminated-union": string;
                 "@sarj/no-comment-cruft": string;
-                "@sarj/prefer-semantic-colors": string;
+                "@sarj/prefer-semantic-colors": (string | {
+                    requireSemanticTokens: boolean;
+                })[];
                 "@sarj/no-fat-try-blocks": string;
                 "@sarj/no-cors-wildcard-with-credentials": string;
                 "@sarj/no-secret-in-log": string;

package/dist/index.js

@@ -1,5 +1,29 @@
 // src/rules/enforce-file-structure.ts
 import { ESLintUtils, AST_NODE_TYPES } from "@typescript-eslint/utils";
+
+// src/rules/_paths.ts
+var SCRIPT_FILE_RE = /([\\/]scripts[\\/])|(\.mjs$)/;
+var STORY_FILE_RE = /\.stories\.[cm]?[jt]sx?$/i;
+var GENERATED_FILE_RE = /([\\/]generated[\\/])|(\.gen\.[cm]?[jt]sx?$)|(\.generated\.[cm]?[jt]sx?$)|(\.d\.[cm]?ts$)/;
+function isTestFile(filename) {
+  const normalized = filename.replaceAll("\\", "/");
+  const base = normalized.slice(normalized.lastIndexOf("/") + 1);
+  if (/\.(test|spec|e2e|integration)\.[cm]?[jt]sx?$/.test(base)) {
+    return true;
+  }
+  return /(^|\/)(tests?|__tests__|__mocks__|fixtures|e2e|integration)\//.test(normalized);
+}
+function isStoryFile(filename) {
+  return STORY_FILE_RE.test(filename);
+}
+function isGeneratedFile(filename, sourceText = "") {
+  return GENERATED_FILE_RE.test(filename.replaceAll("\\", "/")) || /@generated\b/.test(sourceText.slice(0, 1024));
+}
+function isScriptFile(filename) {
+  return SCRIPT_FILE_RE.test(filename);
+}
+
+// src/rules/enforce-file-structure.ts
 var classifyStatement = (statement) => {
   switch (statement.type) {
     case AST_NODE_TYPES.ImportDeclaration:
@@ -36,6 +60,9 @@ var enforce_file_structure_default = ESLintUtils.RuleCreator(
   },
   defaultOptions: [],
   create(context) {
+    if (isTestFile(context.filename)) {
+      return {};
+    }
     return {
       Program(node) {
         const body = node.body;
@@ -565,22 +592,6 @@ var no_enum_default = ESLintUtils4.RuleCreator(
 
 // src/rules/no-insecure-random-id.ts
 import { ESLintUtils as ESLintUtils5 } from "@typescript-eslint/utils";
-
-// src/rules/_paths.ts
-var SCRIPT_FILE_RE = /([\\/]scripts[\\/])|(\.mjs$)/;
-function isTestFile(filename) {
-  const normalized = filename.replaceAll("\\", "/");
-  const base = normalized.slice(normalized.lastIndexOf("/") + 1);
-  if (/\.(test|spec)\.[cm]?[jt]sx?$/.test(base)) {
-    return true;
-  }
-  return /(^|\/)(tests?|__tests__|__mocks__|fixtures)\//.test(normalized);
-}
-function isScriptFile(filename) {
-  return SCRIPT_FILE_RE.test(filename);
-}
-
-// src/rules/no-insecure-random-id.ts
 var STRONG_SECURITY_PATTERN = /token|secret|csrf|password|passwd|apikey|api[-_]?key|nonce|salt|uuid|authid/i;
 var NON_SECURITY_ID_PATTERN = /temp|tmp|cache|correlation|request|req|trace|execution|dev|hmr|mock|test|perf|marker/i;
 var PATH_OR_DOM_MARKER = /[\\/#]|\.[A-Za-z0-9]/;
@@ -1124,6 +1135,10 @@ var no_log_only_catch_default = ESLintUtils7.RuleCreator(
 // src/rules/no-raw-env.ts
 import { ESLintUtils as ESLintUtils8 } from "@typescript-eslint/utils";
 var CONFIG_FILE_RE = /(^|[\\/])[\w.-]+\.config\.[cm]?[jt]sx?$/;
+var ENV_BOUNDARY_FILE_RE = /(^|[\\/])(?:env|client-env|server-env|client-settings|server-settings)\.[cm]?[jt]sx?$/;
+function isValidatedEnvBoundary(filename, sourceText) {
+  return ENV_BOUNDARY_FILE_RE.test(filename.replaceAll("\\", "/")) && /\bz\.object\s*\(/.test(sourceText) && /\.parse\s*\(/.test(sourceText);
+}
 function isProcessEnv(node) {
   return !node.computed && node.object.type === "Identifier" && node.object.name === "process" && node.property.type === "Identifier" && node.property.name === "env";
 }
@@ -1173,7 +1188,7 @@ var no_raw_env_default = ESLintUtils8.RuleCreator(
   defaultOptions: [],
   create(context) {
     const filename = context.filename;
-    if (isTestFile(filename) || isScriptFile(filename) || CONFIG_FILE_RE.test(filename.replaceAll("\\", "/"))) {
+    if (isTestFile(filename) || isScriptFile(filename) || CONFIG_FILE_RE.test(filename.replaceAll("\\", "/")) || isValidatedEnvBoundary(filename, context.sourceCode.text)) {
       return {};
     }
     return {
@@ -2493,6 +2508,8 @@ var prefer_schema_for_api_payload_default = ESLintUtils14.RuleCreator(
 
 // src/rules/prefer-semantic-colors.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES8, ESLintUtils as ESLintUtils15 } from "@typescript-eslint/utils";
+import { existsSync, readFileSync } from "fs";
+import { dirname, join, parse } from "path";
 
 // src/rules/_tailwind.ts
 var tailwindBase = (token) => token.replace(/^(?:[a-z0-9-]+:)+/i, "").replace(/^!/, "");
@@ -2530,6 +2547,20 @@ var STYLE_COLOR_PROPS = /* @__PURE__ */ new Set([
 ]);
 var RAW_COLOR_VALUE_RE = new RegExp(`#[0-9a-fA-F]{3,8}\\b|\\b(?:${COLOR_FN})\\s*\\(`, "i");
 var STORIES_FILE_RE = /\.stories\.[cm]?[jt]sx?$/i;
+var SEMANTIC_TOKEN_RE = /--(?:background|foreground|primary|secondary|muted|accent|destructive|border|card|popover)\b|(?:bg|text|border)-(?:background|foreground|primary|secondary|muted|accent|destructive|border|card|popover)\b/;
+var DETECTION_FILES = [
+  "components.json",
+  "tailwind.config.js",
+  "tailwind.config.cjs",
+  "tailwind.config.mjs",
+  "tailwind.config.ts",
+  "app/globals.css",
+  "src/app/globals.css",
+  "src/index.css",
+  "src/styles/globals.css",
+  "styles/globals.css"
+];
+var semanticTokenCache = /* @__PURE__ */ new Map();
 var SVG_DEFS_CONTAINERS = /* @__PURE__ */ new Set([
   "mask",
   "clipPath",
@@ -2558,6 +2589,34 @@ var isInsideSvg = (node) => {
   }
   return false;
 };
+var hasSemanticTokenSystem = (filename) => {
+  let dir = dirname(filename);
+  const root = parse(dir).root;
+  for (let depth = 0; depth < 8; depth += 1) {
+    const cached = semanticTokenCache.get(dir);
+    if (cached !== void 0) return cached;
+    let found = false;
+    for (const rel of DETECTION_FILES) {
+      const candidate = join(dir, rel);
+      if (!existsSync(candidate)) continue;
+      if (rel === "components.json") {
+        found = true;
+        break;
+      }
+      try {
+        if (SEMANTIC_TOKEN_RE.test(readFileSync(candidate, "utf8"))) {
+          found = true;
+          break;
+        }
+      } catch {
+      }
+    }
+    semanticTokenCache.set(dir, found);
+    if (found || dir === root) return found;
+    dir = dirname(dir);
+  }
+  return false;
+};
 var propName = (key) => {
   if (key.type === AST_NODE_TYPES8.Identifier) return key.name;
   if (key.type === AST_NODE_TYPES8.Literal && typeof key.value === "string") return key.value;
@@ -2572,16 +2631,27 @@ var prefer_semantic_colors_default = ESLintUtils15.RuleCreator(
     docs: {
       description: "Enforce design-system semantic color tokens (bg-primary, text-destructive, \u2026) over raw Tailwind palette classes (text-red-500), arbitrary color values (bg-[#fff]), and inline color literals."
     },
-    schema: [],
+    schema: [
+      {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          requireSemanticTokens: { type: "boolean" }
+        }
+      }
+    ],
     messages: {
       rawPalette: "Raw palette class '{{class}}' \u2014 use a semantic token (e.g. text-foreground, bg-primary, text-destructive, bg-muted).",
       arbitraryColor: "Hardcoded color '{{class}}' \u2014 use a semantic token, or var(--\u2026). For charts/brand add an eslint-disable with a reason.",
       inlineColor: "Hardcoded color '{{value}}' \u2014 use a semantic token / CSS variable. For charts/standalone pages add an eslint-disable with a reason."
     }
   },
-  defaultOptions: [],
-  create(context) {
+  defaultOptions: [{}],
+  create(context, [options]) {
     if (STORIES_FILE_RE.test(context.filename)) return {};
+    if (options?.requireSemanticTokens === true && !hasSemanticTokenSystem(context.filename)) {
+      return {};
+    }
     const reportClasses = (value, node) => {
       for (const token of classTokens(value)) {
         const base = tailwindBase(token);
@@ -2843,7 +2913,7 @@ var INPUT_TYPE_REPLACEMENTS = {
   radio: "RadioGroup",
   range: "Slider"
 };
-var SKIPPED_INPUT_TYPES = /* @__PURE__ */ new Set(["hidden"]);
+var SKIPPED_INPUT_TYPES = /* @__PURE__ */ new Set(["file", "hidden"]);
 var kebabCase = (component) => component.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
 var literalTypeAttr = (node) => {
   for (const attribute of node.attributes) {
@@ -2857,8 +2927,12 @@ var literalTypeAttr = (node) => {
   }
   return null;
 };
+var hasFileAcceptAttr = (node) => node.attributes.some(
+  (attribute) => attribute.type === AST_NODE_TYPES9.JSXAttribute && attribute.name.type === AST_NODE_TYPES9.JSXIdentifier && attribute.name.name === "accept"
+);
 var resolveInputReplacement = (node) => {
   const typeAttr = literalTypeAttr(node);
+  if (hasFileAcceptAttr(node)) return null;
   if (typeAttr === null || typeAttr.kind === "dynamic") return "Input";
   if (SKIPPED_INPUT_TYPES.has(typeAttr.value)) return null;
   return INPUT_TYPE_REPLACEMENTS[typeAttr.value] ?? "Input";
@@ -2879,7 +2953,7 @@ var prefer_shadcn_default = ESLintUtils17.RuleCreator(
   },
   defaultOptions: [],
   create(context) {
-    if (isTestFile(context.filename)) {
+    if (isTestFile(context.filename) || isStoryFile(context.filename)) {
       return {};
     }
     return {
@@ -3200,7 +3274,7 @@ var zod_naming_convention_default = ESLintUtils20.RuleCreator(
     const convention = optionsArg?.convention ?? "either";
     const { test, messageId } = CONVENTIONS[convention];
     const acceptsSchemaWord = convention !== "prefix";
-    if (isTestFile(context.filename)) {
+    if (isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) {
       return {};
     }
     return {
@@ -5509,7 +5583,9 @@ var EQUALITY_OPERATORS = /* @__PURE__ */ new Set(["===", "!==", "==", "!="]);
 var SENTINEL_IDENTIFIERS = /* @__PURE__ */ new Set(["undefined", "NaN"]);
 var SENTINEL_WORDS = /(^|_)(SENTINEL|EMPTY|NONE|NULL|UNSET|MISSING|PLACEHOLDER|DUMMY|FAKE|EXAMPLE)(_|$)/;
 var SENTINEL_PREFIX_RE = /^(skip|sentinel|empty|none|missing|unset|placeholder|dummy|fake|example|noop)[A-Z]/;
+var AST_NODE_TYPE_RE = /^(?:TS|JSX)?[A-Z][A-Za-z]*(?:Signature|Keyword|Expression|Declaration|Element|Literal|Identifier)$/;
 function isConstantReference(identifier) {
+  if (AST_NODE_TYPE_RE.test(identifier)) return true;
   if (isAuthSecretName(identifier) && !SENTINEL_WORDS.test(identifier)) return false;
   return identifier === identifier.toUpperCase() && /[A-Za-z]/.test(identifier);
 }
@@ -5776,6 +5852,7 @@ var GLOBAL_RECEIVERS = /* @__PURE__ */ new Set([
   "window",
   "self"
 ]);
+var PRESIGNED_URL_NAME_RE = /(?:pre-?signed|signed|upload|download)Url$/i;
 function isGlobalFetchCall(node) {
   const callee = node.callee;
   if (callee.type === "Identifier") {
@@ -5786,6 +5863,23 @@ function isGlobalFetchCall(node) {
   }
   return false;
 }
+function identifierLikeName(node) {
+  if (node.type === "Identifier") {
+    return node.name;
+  }
+  if (node.type === "MemberExpression" && !node.computed && node.property.type === "Identifier") {
+    return node.property.name;
+  }
+  return null;
+}
+function isPresignedUrlTransfer(node) {
+  const first = node.arguments[0];
+  if (first === void 0) {
+    return false;
+  }
+  const name = identifierLikeName(first);
+  return name !== null && PRESIGNED_URL_NAME_RE.test(name);
+}
 function compile(patterns) {
   const compiled = [];
   for (const pattern of patterns) {
@@ -5832,6 +5926,9 @@ var no_raw_fetch_outside_clients_default = ESLintUtils38.RuleCreator(
     }
     return {
       CallExpression(node) {
+        if (isPresignedUrlTransfer(node)) {
+          return;
+        }
         if (isGlobalFetchCall(node)) {
           context.report({ node, messageId: "rawFetch" });
         }
@@ -6463,7 +6560,7 @@ var rules = {
 var plugin = {
   meta: {
     name: "@sarj/eslint-plugin",
-    version: "2.12.0"
+    version: "2.12.1"
   },
   rules,
   configs: {
@@ -6488,7 +6585,7 @@ var plugin = {
         "@sarj/prefer-discriminated-union": "warn",
         "@sarj/no-comment-cruft": "warn",
         // Frontend / styling — distilled from frontend PR-review mining.
-        "@sarj/prefer-semantic-colors": "warn",
+        "@sarj/prefer-semantic-colors": ["warn", { requireSemanticTokens: true }],
         // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
         "@sarj/no-fat-try-blocks": "warn",
         "@sarj/no-cors-wildcard-with-credentials": "warn",
@@ -6547,7 +6644,7 @@ var plugin = {
         "@sarj/no-comment-cruft": "error",
         // Frontend / styling — distilled from frontend PR-review mining. Stylistic,
         // no autofix → warn (rollout should prove the FP rate before raising it).
-        "@sarj/prefer-semantic-colors": "error",
+        "@sarj/prefer-semantic-colors": ["error", { requireSemanticTokens: true }],
         // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
         "@sarj/no-fat-try-blocks": "error",
         "@sarj/no-cors-wildcard-with-credentials": "error",