@sarj/eslint-plugin 2.12.0 → 2.12.2

package/dist/index.d.cts

@@ -70,6 +70,10 @@ interface RuleOptions$2 {
  *     `api.ts` / `*-api.ts` module — plus test files and codemod fixtures.
  *   - A method named `fetch` on some other receiver (`cache.fetch(k)`,
  *     `queryClient.fetch()`): only the global is HTTP.
+ *   - A pre-signed upload/download URL transfer (`fetch(uploadUrl, ...)`,
+ *     `fetch(file.downloadUrl)`). Those URLs are one-off storage handoffs,
+ *     not calls to a first-party service API that belongs behind a client
+ *     wrapper.
  *   - `new Request(...)` / `axios(...)` and friends. This rule is about the
  *     global `fetch`, not about every HTTP library.
  *
@@ -237,7 +241,9 @@ declare const rules: {
     "prefer-schema-for-api-payload": _typescript_eslint_utils_ts_eslint.RuleModule<"unparsedJsonAccess", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
-    "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+    "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [{
+        requireSemanticTokens?: boolean;
+    }?], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
     "prefer-server-actions": _typescript_eslint_utils_ts_eslint.RuleModule<"preferServerAction", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
@@ -379,7 +385,9 @@ declare const plugin: {
         "prefer-schema-for-api-payload": _typescript_eslint_utils_ts_eslint.RuleModule<"unparsedJsonAccess", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
-        "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [{
+            requireSemanticTokens?: boolean;
+        }?], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
         "prefer-server-actions": _typescript_eslint_utils_ts_eslint.RuleModule<"preferServerAction", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
@@ -491,7 +499,9 @@ declare const plugin: {
                 "@sarj/no-string-concat-in-loop": string;
                 "@sarj/prefer-discriminated-union": string;
                 "@sarj/no-comment-cruft": string;
-                "@sarj/prefer-semantic-colors": string;
+                "@sarj/prefer-semantic-colors": (string | {
+                    requireSemanticTokens: boolean;
+                })[];
                 "@sarj/no-fat-try-blocks": string;
                 "@sarj/no-cors-wildcard-with-credentials": string;
                 "@sarj/no-secret-in-log": string;
@@ -535,7 +545,9 @@ declare const plugin: {
                 "@sarj/no-string-concat-in-loop": string;
                 "@sarj/prefer-discriminated-union": string;
                 "@sarj/no-comment-cruft": string;
-                "@sarj/prefer-semantic-colors": string;
+                "@sarj/prefer-semantic-colors": (string | {
+                    requireSemanticTokens: boolean;
+                })[];
                 "@sarj/no-fat-try-blocks": string;
                 "@sarj/no-cors-wildcard-with-credentials": string;
                 "@sarj/no-secret-in-log": string;

package/dist/index.d.ts

@@ -70,6 +70,10 @@ interface RuleOptions$2 {
  *     `api.ts` / `*-api.ts` module — plus test files and codemod fixtures.
  *   - A method named `fetch` on some other receiver (`cache.fetch(k)`,
  *     `queryClient.fetch()`): only the global is HTTP.
+ *   - A pre-signed upload/download URL transfer (`fetch(uploadUrl, ...)`,
+ *     `fetch(file.downloadUrl)`). Those URLs are one-off storage handoffs,
+ *     not calls to a first-party service API that belongs behind a client
+ *     wrapper.
  *   - `new Request(...)` / `axios(...)` and friends. This rule is about the
  *     global `fetch`, not about every HTTP library.
  *
@@ -237,7 +241,9 @@ declare const rules: {
     "prefer-schema-for-api-payload": _typescript_eslint_utils_ts_eslint.RuleModule<"unparsedJsonAccess", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
-    "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+    "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [{
+        requireSemanticTokens?: boolean;
+    }?], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
     "prefer-server-actions": _typescript_eslint_utils_ts_eslint.RuleModule<"preferServerAction", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
@@ -379,7 +385,9 @@ declare const plugin: {
         "prefer-schema-for-api-payload": _typescript_eslint_utils_ts_eslint.RuleModule<"unparsedJsonAccess", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
-        "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        "prefer-semantic-colors": _typescript_eslint_utils_ts_eslint.RuleModule<"rawPalette" | "arbitraryColor" | "inlineColor", readonly [{
+            requireSemanticTokens?: boolean;
+        }?], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
         "prefer-server-actions": _typescript_eslint_utils_ts_eslint.RuleModule<"preferServerAction", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
@@ -491,7 +499,9 @@ declare const plugin: {
                 "@sarj/no-string-concat-in-loop": string;
                 "@sarj/prefer-discriminated-union": string;
                 "@sarj/no-comment-cruft": string;
-                "@sarj/prefer-semantic-colors": string;
+                "@sarj/prefer-semantic-colors": (string | {
+                    requireSemanticTokens: boolean;
+                })[];
                 "@sarj/no-fat-try-blocks": string;
                 "@sarj/no-cors-wildcard-with-credentials": string;
                 "@sarj/no-secret-in-log": string;
@@ -535,7 +545,9 @@ declare const plugin: {
                 "@sarj/no-string-concat-in-loop": string;
                 "@sarj/prefer-discriminated-union": string;
                 "@sarj/no-comment-cruft": string;
-                "@sarj/prefer-semantic-colors": string;
+                "@sarj/prefer-semantic-colors": (string | {
+                    requireSemanticTokens: boolean;
+                })[];
                 "@sarj/no-fat-try-blocks": string;
                 "@sarj/no-cors-wildcard-with-credentials": string;
                 "@sarj/no-secret-in-log": string;

package/dist/index.js

@@ -1,5 +1,30 @@
 // src/rules/enforce-file-structure.ts
 import { ESLintUtils, AST_NODE_TYPES } from "@typescript-eslint/utils";
+
+// src/rules/_paths.ts
+var SCRIPT_FILE_RE = /([\\/]scripts[\\/])|(\.mjs$)/;
+var STORY_FILE_RE = /\.stories\.[cm]?[jt]sx?$/i;
+var GENERATED_FILE_RE = /([\\/](?:generated|openapi-gen|graphql[\\/]types)[\\/])|(\.gen\.[cm]?[jt]sx?$)|(\.generated\.[cm]?[jt]sx?$)|(\.d\.[cm]?ts$)|(\.types\.[cm]?ts$)/;
+var GENERATED_MARKER_RE = /(?:@generated\b|generated (?:with|by)|generated (?:graphql )?types|do not edit(?: directly| manually)?)/i;
+function isTestFile(filename) {
+  const normalized = filename.replaceAll("\\", "/");
+  const base = normalized.slice(normalized.lastIndexOf("/") + 1);
+  if (/\.(test|spec|e2e|integration)\.[cm]?[jt]sx?$/.test(base)) {
+    return true;
+  }
+  return /(^|\/)(tests?|__tests__|__mocks__|fixtures|e2e|integration)\//.test(normalized);
+}
+function isStoryFile(filename) {
+  return STORY_FILE_RE.test(filename);
+}
+function isGeneratedFile(filename, sourceText = "") {
+  return GENERATED_FILE_RE.test(filename.replaceAll("\\", "/")) || GENERATED_MARKER_RE.test(sourceText.slice(0, 2048));
+}
+function isScriptFile(filename) {
+  return SCRIPT_FILE_RE.test(filename);
+}
+
+// src/rules/enforce-file-structure.ts
 var classifyStatement = (statement) => {
   switch (statement.type) {
     case AST_NODE_TYPES.ImportDeclaration:
@@ -36,6 +61,9 @@ var enforce_file_structure_default = ESLintUtils.RuleCreator(
   },
   defaultOptions: [],
   create(context) {
+    if (isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) {
+      return {};
+    }
     return {
       Program(node) {
         const body = node.body;
@@ -425,6 +453,9 @@ var no_comment_cruft_default = ESLintUtils3.RuleCreator(
   },
   defaultOptions: [],
   create(context) {
+    if (isGeneratedFile(context.filename, context.sourceCode.text)) {
+      return {};
+    }
     const sourceCode = context.sourceCode;
     function isStandalone(comment) {
       const before = sourceCode.getTokenBefore(comment, {
@@ -497,6 +528,7 @@ var no_comment_cruft_default = ESLintUtils3.RuleCreator(
 import { ESLintUtils as ESLintUtils4 } from "@typescript-eslint/utils";
 var DEFAULT_IGNORE_PATTERNS = [
   /[\\/]generated[\\/]/,
+  /[\\/]openapi-gen[\\/]/,
   /\.gen\.tsx?$/,
   /\.generated\.tsx?$/
 ];
@@ -548,7 +580,7 @@ var no_enum_default = ESLintUtils4.RuleCreator(
       (re) => re.test(filename)
     );
     const isIgnoredByOption = ignoreFiles.length > 0 && matchesAnyPattern(filename, ignoreFiles);
-    const isGenerated = hasGeneratedMarker(sourceText);
+    const isGenerated = hasGeneratedMarker(sourceText) || isGeneratedFile(filename, sourceText);
     if (isIgnoredByDefault || isIgnoredByOption || isGenerated) {
       return {};
     }
@@ -565,22 +597,6 @@ var no_enum_default = ESLintUtils4.RuleCreator(
 
 // src/rules/no-insecure-random-id.ts
 import { ESLintUtils as ESLintUtils5 } from "@typescript-eslint/utils";
-
-// src/rules/_paths.ts
-var SCRIPT_FILE_RE = /([\\/]scripts[\\/])|(\.mjs$)/;
-function isTestFile(filename) {
-  const normalized = filename.replaceAll("\\", "/");
-  const base = normalized.slice(normalized.lastIndexOf("/") + 1);
-  if (/\.(test|spec)\.[cm]?[jt]sx?$/.test(base)) {
-    return true;
-  }
-  return /(^|\/)(tests?|__tests__|__mocks__|fixtures)\//.test(normalized);
-}
-function isScriptFile(filename) {
-  return SCRIPT_FILE_RE.test(filename);
-}
-
-// src/rules/no-insecure-random-id.ts
 var STRONG_SECURITY_PATTERN = /token|secret|csrf|password|passwd|apikey|api[-_]?key|nonce|salt|uuid|authid/i;
 var NON_SECURITY_ID_PATTERN = /temp|tmp|cache|correlation|request|req|trace|execution|dev|hmr|mock|test|perf|marker/i;
 var PATH_OR_DOM_MARKER = /[\\/#]|\.[A-Za-z0-9]/;
@@ -1124,6 +1140,10 @@ var no_log_only_catch_default = ESLintUtils7.RuleCreator(
 // src/rules/no-raw-env.ts
 import { ESLintUtils as ESLintUtils8 } from "@typescript-eslint/utils";
 var CONFIG_FILE_RE = /(^|[\\/])[\w.-]+\.config\.[cm]?[jt]sx?$/;
+var ENV_BOUNDARY_FILE_RE = /(^|[\\/])(?:env|client-env|server-env|client-settings|server-settings)\.[cm]?[jt]sx?$/;
+function isValidatedEnvBoundary(filename, sourceText) {
+  return ENV_BOUNDARY_FILE_RE.test(filename.replaceAll("\\", "/")) && /\bz\.object\s*\(/.test(sourceText) && /\.parse\s*\(/.test(sourceText);
+}
 function isProcessEnv(node) {
   return !node.computed && node.object.type === "Identifier" && node.object.name === "process" && node.property.type === "Identifier" && node.property.name === "env";
 }
@@ -1173,7 +1193,7 @@ var no_raw_env_default = ESLintUtils8.RuleCreator(
   defaultOptions: [],
   create(context) {
     const filename = context.filename;
-    if (isTestFile(filename) || isScriptFile(filename) || CONFIG_FILE_RE.test(filename.replaceAll("\\", "/"))) {
+    if (isTestFile(filename) || isScriptFile(filename) || CONFIG_FILE_RE.test(filename.replaceAll("\\", "/")) || isValidatedEnvBoundary(filename, context.sourceCode.text)) {
       return {};
     }
     return {
@@ -1518,6 +1538,9 @@ var no_sentinel_return_on_catch_default = ESLintUtils9.RuleCreator(
   },
   defaultOptions: [{}],
   create(context, [loggingOptions]) {
+    if (isGeneratedFile(context.filename, context.sourceCode.text)) {
+      return {};
+    }
     const matcher = createLogMatcher(loggingOptions);
     function logsOrReportsError(catchBody, caughtName) {
       return walkWithinScope(catchBody, (current) => {
@@ -1924,6 +1947,9 @@ var no_string_concat_in_loop_default = ESLintUtils11.RuleCreator(
   },
   defaultOptions: [],
   create(context) {
+    if (isGeneratedFile(context.filename, context.sourceCode.text)) {
+      return {};
+    }
     const reported = /* @__PURE__ */ new WeakMap();
     return {
       AssignmentExpression(node) {
@@ -2394,7 +2420,7 @@ var prefer_schema_for_api_payload_default = ESLintUtils14.RuleCreator(
   },
   defaultOptions: [],
   create(context) {
-    if (isTestFile(context.filename)) {
+    if (isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) {
       return {};
     }
     const unvalidatedVariables = /* @__PURE__ */ new Set();
@@ -2493,6 +2519,8 @@ var prefer_schema_for_api_payload_default = ESLintUtils14.RuleCreator(
 
 // src/rules/prefer-semantic-colors.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES8, ESLintUtils as ESLintUtils15 } from "@typescript-eslint/utils";
+import { existsSync, readFileSync } from "fs";
+import { dirname, join, parse } from "path";
 
 // src/rules/_tailwind.ts
 var tailwindBase = (token) => token.replace(/^(?:[a-z0-9-]+:)+/i, "").replace(/^!/, "");
@@ -2530,6 +2558,20 @@ var STYLE_COLOR_PROPS = /* @__PURE__ */ new Set([
 ]);
 var RAW_COLOR_VALUE_RE = new RegExp(`#[0-9a-fA-F]{3,8}\\b|\\b(?:${COLOR_FN})\\s*\\(`, "i");
 var STORIES_FILE_RE = /\.stories\.[cm]?[jt]sx?$/i;
+var SEMANTIC_TOKEN_RE = /--(?:background|foreground|primary|secondary|muted|accent|destructive|border|card|popover)\b|(?:bg|text|border)-(?:background|foreground|primary|secondary|muted|accent|destructive|border|card|popover)\b/;
+var DETECTION_FILES = [
+  "components.json",
+  "tailwind.config.js",
+  "tailwind.config.cjs",
+  "tailwind.config.mjs",
+  "tailwind.config.ts",
+  "app/globals.css",
+  "src/app/globals.css",
+  "src/index.css",
+  "src/styles/globals.css",
+  "styles/globals.css"
+];
+var semanticTokenCache = /* @__PURE__ */ new Map();
 var SVG_DEFS_CONTAINERS = /* @__PURE__ */ new Set([
   "mask",
   "clipPath",
@@ -2548,16 +2590,66 @@ var SVG_EXEMPT_COLOR_VALUES = /* @__PURE__ */ new Set([
   "currentcolor",
   "inherit"
 ]);
+function jsxElementName(node) {
+  const name = node.openingElement.name;
+  if (name.type === AST_NODE_TYPES8.JSXIdentifier) return name.name;
+  if (name.type === AST_NODE_TYPES8.JSXMemberExpression && name.property.type === AST_NODE_TYPES8.JSXIdentifier) {
+    return name.property.name;
+  }
+  return null;
+}
+function isSvgLikeElementName(name) {
+  return name === "svg" || SVG_DEFS_CONTAINERS.has(name) || /svg$/i.test(name);
+}
 var isInsideSvg = (node) => {
   let current = node.parent;
   while (current !== void 0 && current !== null) {
-    if (current.type === AST_NODE_TYPES8.JSXElement && current.openingElement.name.type === AST_NODE_TYPES8.JSXIdentifier && (current.openingElement.name.name === "svg" || SVG_DEFS_CONTAINERS.has(current.openingElement.name.name))) {
+    if (current.type === AST_NODE_TYPES8.JSXElement) {
+      const name = jsxElementName(current);
+      if (name !== null && isSvgLikeElementName(name)) return true;
+    }
+    current = current.parent;
+  }
+  return false;
+};
+var isInsideIconFactoryPath = (node) => {
+  let current = node.parent;
+  while (current !== void 0 && current !== null) {
+    if (current.type === AST_NODE_TYPES8.Property && propName(current.key) === "path" && current.parent.type === AST_NODE_TYPES8.ObjectExpression && current.parent.parent.type === AST_NODE_TYPES8.CallExpression && current.parent.parent.callee.type === AST_NODE_TYPES8.Identifier && current.parent.parent.callee.name === "createIcon") {
       return true;
     }
     current = current.parent;
   }
   return false;
 };
+var hasSemanticTokenSystem = (filename) => {
+  let dir = dirname(filename);
+  const root = parse(dir).root;
+  for (let depth = 0; depth < 8; depth += 1) {
+    const cached = semanticTokenCache.get(dir);
+    if (cached !== void 0) return cached;
+    let found = false;
+    for (const rel of DETECTION_FILES) {
+      const candidate = join(dir, rel);
+      if (!existsSync(candidate)) continue;
+      if (rel === "components.json") {
+        found = true;
+        break;
+      }
+      try {
+        if (SEMANTIC_TOKEN_RE.test(readFileSync(candidate, "utf8"))) {
+          found = true;
+          break;
+        }
+      } catch {
+      }
+    }
+    semanticTokenCache.set(dir, found);
+    if (found || dir === root) return found;
+    dir = dirname(dir);
+  }
+  return false;
+};
 var propName = (key) => {
   if (key.type === AST_NODE_TYPES8.Identifier) return key.name;
   if (key.type === AST_NODE_TYPES8.Literal && typeof key.value === "string") return key.value;
@@ -2572,16 +2664,27 @@ var prefer_semantic_colors_default = ESLintUtils15.RuleCreator(
     docs: {
       description: "Enforce design-system semantic color tokens (bg-primary, text-destructive, \u2026) over raw Tailwind palette classes (text-red-500), arbitrary color values (bg-[#fff]), and inline color literals."
     },
-    schema: [],
+    schema: [
+      {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          requireSemanticTokens: { type: "boolean" }
+        }
+      }
+    ],
     messages: {
       rawPalette: "Raw palette class '{{class}}' \u2014 use a semantic token (e.g. text-foreground, bg-primary, text-destructive, bg-muted).",
       arbitraryColor: "Hardcoded color '{{class}}' \u2014 use a semantic token, or var(--\u2026). For charts/brand add an eslint-disable with a reason.",
       inlineColor: "Hardcoded color '{{value}}' \u2014 use a semantic token / CSS variable. For charts/standalone pages add an eslint-disable with a reason."
     }
   },
-  defaultOptions: [],
-  create(context) {
+  defaultOptions: [{}],
+  create(context, [options]) {
     if (STORIES_FILE_RE.test(context.filename)) return {};
+    if (options?.requireSemanticTokens === true && !hasSemanticTokenSystem(context.filename)) {
+      return {};
+    }
     const reportClasses = (value, node) => {
       for (const token of classTokens(value)) {
         const base = tailwindBase(token);
@@ -2661,7 +2764,7 @@ var prefer_semantic_colors_default = ESLintUtils15.RuleCreator(
         if (typeof node.value.value === "string" && SVG_EXEMPT_COLOR_VALUES.has(node.value.value.toLowerCase())) {
           return;
         }
-        if (isInsideSvg(node)) return;
+        if (isInsideSvg(node) || isInsideIconFactoryPath(node)) return;
         checkColorValueNode(node.value);
       },
       // Inline style objects: style={{ color: "#111827", backgroundColor: "#fff" }}
@@ -2843,7 +2946,7 @@ var INPUT_TYPE_REPLACEMENTS = {
   radio: "RadioGroup",
   range: "Slider"
 };
-var SKIPPED_INPUT_TYPES = /* @__PURE__ */ new Set(["hidden"]);
+var SKIPPED_INPUT_TYPES = /* @__PURE__ */ new Set(["file", "hidden"]);
 var kebabCase = (component) => component.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
 var literalTypeAttr = (node) => {
   for (const attribute of node.attributes) {
@@ -2857,8 +2960,12 @@ var literalTypeAttr = (node) => {
   }
   return null;
 };
+var hasFileAcceptAttr = (node) => node.attributes.some(
+  (attribute) => attribute.type === AST_NODE_TYPES9.JSXAttribute && attribute.name.type === AST_NODE_TYPES9.JSXIdentifier && attribute.name.name === "accept"
+);
 var resolveInputReplacement = (node) => {
   const typeAttr = literalTypeAttr(node);
+  if (hasFileAcceptAttr(node)) return null;
   if (typeAttr === null || typeAttr.kind === "dynamic") return "Input";
   if (SKIPPED_INPUT_TYPES.has(typeAttr.value)) return null;
   return INPUT_TYPE_REPLACEMENTS[typeAttr.value] ?? "Input";
@@ -2879,7 +2986,7 @@ var prefer_shadcn_default = ESLintUtils17.RuleCreator(
   },
   defaultOptions: [],
   create(context) {
-    if (isTestFile(context.filename)) {
+    if (isTestFile(context.filename) || isStoryFile(context.filename)) {
       return {};
     }
     return {
@@ -3200,7 +3307,7 @@ var zod_naming_convention_default = ESLintUtils20.RuleCreator(
     const convention = optionsArg?.convention ?? "either";
     const { test, messageId } = CONVENTIONS[convention];
     const acceptsSchemaWord = convention !== "prefix";
-    if (isTestFile(context.filename)) {
+    if (isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) {
       return {};
     }
     return {
@@ -3958,6 +4065,9 @@ var no_fat_try_blocks_default = ESLintUtils25.RuleCreator(
   },
   defaultOptions: [],
   create(context) {
+    if (isGeneratedFile(context.filename, context.sourceCode.text)) {
+      return {};
+    }
     const sourceCode = context.sourceCode;
     return {
       TryStatement(node) {
@@ -4347,7 +4457,7 @@ var no_unsafe_cast_default = ESLintUtils27.RuleCreator(
   },
   defaultOptions: [],
   create(context) {
-    if (isTestFile(context.filename)) {
+    if (isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) {
       return {};
     }
     function checkAssertion(node) {
@@ -5509,7 +5619,9 @@ var EQUALITY_OPERATORS = /* @__PURE__ */ new Set(["===", "!==", "==", "!="]);
 var SENTINEL_IDENTIFIERS = /* @__PURE__ */ new Set(["undefined", "NaN"]);
 var SENTINEL_WORDS = /(^|_)(SENTINEL|EMPTY|NONE|NULL|UNSET|MISSING|PLACEHOLDER|DUMMY|FAKE|EXAMPLE)(_|$)/;
 var SENTINEL_PREFIX_RE = /^(skip|sentinel|empty|none|missing|unset|placeholder|dummy|fake|example|noop)[A-Z]/;
+var AST_NODE_TYPE_RE = /^(?:TS|JSX)?[A-Z][A-Za-z]*(?:Signature|Keyword|Expression|Declaration|Element|Literal|Identifier)$/;
 function isConstantReference(identifier) {
+  if (AST_NODE_TYPE_RE.test(identifier)) return true;
   if (isAuthSecretName(identifier) && !SENTINEL_WORDS.test(identifier)) return false;
   return identifier === identifier.toUpperCase() && /[A-Za-z]/.test(identifier);
 }
@@ -5776,6 +5888,7 @@ var GLOBAL_RECEIVERS = /* @__PURE__ */ new Set([
   "window",
   "self"
 ]);
+var PRESIGNED_URL_NAME_RE = /(?:pre-?signed|signed|upload|download)Url$/i;
 function isGlobalFetchCall(node) {
   const callee = node.callee;
   if (callee.type === "Identifier") {
@@ -5786,6 +5899,23 @@ function isGlobalFetchCall(node) {
   }
   return false;
 }
+function identifierLikeName(node) {
+  if (node.type === "Identifier") {
+    return node.name;
+  }
+  if (node.type === "MemberExpression" && !node.computed && node.property.type === "Identifier") {
+    return node.property.name;
+  }
+  return null;
+}
+function isPresignedUrlTransfer(node) {
+  const first = node.arguments[0];
+  if (first === void 0) {
+    return false;
+  }
+  const name = identifierLikeName(first);
+  return name !== null && PRESIGNED_URL_NAME_RE.test(name);
+}
 function compile(patterns) {
   const compiled = [];
   for (const pattern of patterns) {
@@ -5832,6 +5962,9 @@ var no_raw_fetch_outside_clients_default = ESLintUtils38.RuleCreator(
     }
     return {
       CallExpression(node) {
+        if (isPresignedUrlTransfer(node)) {
+          return;
+        }
         if (isGlobalFetchCall(node)) {
           context.report({ node, messageId: "rawFetch" });
         }
@@ -6463,7 +6596,7 @@ var rules = {
 var plugin = {
   meta: {
     name: "@sarj/eslint-plugin",
-    version: "2.12.0"
+    version: "2.12.2"
   },
   rules,
   configs: {
@@ -6488,7 +6621,7 @@ var plugin = {
         "@sarj/prefer-discriminated-union": "warn",
         "@sarj/no-comment-cruft": "warn",
         // Frontend / styling — distilled from frontend PR-review mining.
-        "@sarj/prefer-semantic-colors": "warn",
+        "@sarj/prefer-semantic-colors": ["warn", { requireSemanticTokens: true }],
         // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
         "@sarj/no-fat-try-blocks": "warn",
         "@sarj/no-cors-wildcard-with-credentials": "warn",
@@ -6547,7 +6680,7 @@ var plugin = {
         "@sarj/no-comment-cruft": "error",
         // Frontend / styling — distilled from frontend PR-review mining. Stylistic,
         // no autofix → warn (rollout should prove the FP rate before raising it).
-        "@sarj/prefer-semantic-colors": "error",
+        "@sarj/prefer-semantic-colors": ["error", { requireSemanticTokens: true }],
         // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
         "@sarj/no-fat-try-blocks": "error",
         "@sarj/no-cors-wildcard-with-credentials": "error",