@sarj/eslint-plugin 5.1.0 → 6.0.0

package/dist/index.cjs

@@ -31,7 +31,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   default: () => index_default,
-  rules: () => rules
+  recommendedRules: () => recommendedRules,
+  rules: () => rules,
+  strictRules: () => strictRules
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -8698,203 +8700,219 @@ var rules = {
   "prefer-non-nullable-collection": prefer_non_nullable_collection_default,
   "no-async-callback-in-waitfor": no_async_callback_in_waitfor_default
 };
+var meta = {
+  name: "@sarj/eslint-plugin",
+  version: "6.0.0"
+};
+var recommendedRules = {
+  "@sarj/zod-naming-convention": "warn",
+  "@sarj/require-assert-never": "error",
+  "@sarj/require-zod-form-validation": "error",
+  "@sarj/enforce-file-structure": "warn",
+  "@sarj/no-client-side-data-fetching": "warn",
+  "@sarj/prefer-server-actions": "warn",
+  "@sarj/no-unnecessary-use-client": "warn",
+  "@sarj/prefer-schema-for-api-payload": "warn",
+  // Distilled from sarj-audit skills — warn in recommended, error in strict.
+  "@sarj/no-sentinel-return-on-catch": "warn",
+  "@sarj/no-log-only-catch": "warn",
+  "@sarj/no-insecure-random-id": "warn",
+  "@sarj/no-json-stringify-error": "warn",
+  "@sarj/no-string-concat-in-loop": "warn",
+  "@sarj/prefer-discriminated-union": "warn",
+  "@sarj/no-comment-cruft": "warn",
+  // Frontend / styling — distilled from frontend PR-review mining.
+  "@sarj/prefer-semantic-colors": [
+    "warn",
+    { requireSemanticTokens: true }
+  ],
+  // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
+  "@sarj/no-fat-try-blocks": "warn",
+  "@sarj/no-cors-wildcard-with-credentials": "warn",
+  "@sarj/no-secret-in-log": "warn",
+  "@sarj/no-unsafe-mock-casting": "warn",
+  "@sarj/prefer-string-literal-union": "warn",
+  "@sarj/prefer-zod-enum": "warn",
+  // A type hand-written beside the Zod schema it restates drifts the
+  // moment the schema gains a field. 30,759-file, 17-repo sweep
+  // (2026-07): 5 reports, 5 true positives, all in public repos.
+  // `requireIdenticalShape: false` widens it to 8 reports, 1 of them noise.
+  "@sarj/prefer-zod-infer": "warn",
+  // Mined from 2y of PR review feedback + 5-repo code-smell audit (2026-07).
+  "@sarj/require-fetch-timeout": "warn",
+  "@sarj/no-silent-promise-catch": "warn",
+  // Second SARJ port wave — the TS/Python parity gap. Each targets a
+  // defect class seen in production Workers code: timing-leaky secret
+  // compares, non-idempotent store writes under queue redelivery,
+  // O(N) pagination, implicit row contracts, flaky timed tests.
+  "@sarj/prefer-constant-time-secret-compare": "error",
+  "@sarj/store-insert-requires-on-conflict": "warn",
+  "@sarj/no-offset-pagination": "warn",
+  "@sarj/no-select-star": "warn",
+  // Uncancellable hand-rolled timers. Verified against the shipped
+  // strict config (205 enabled rules) that nothing already reports this
+  // position; `unicorn` 72 has no promisified-timer rule at all.
+  "@sarj/no-hand-rolled-sleep": "warn",
+  "@sarj/no-sleep-in-test-body": "warn",
+  "@sarj/no-conditional-in-test": "warn",
+  "@sarj/no-repeated-string-literal": "warn",
+  "@sarj/no-positional-tuple-return": "warn",
+  // Injection guard — low FP, applies to any repo touching SQL.
+  "@sarj/no-dynamic-sql": "warn",
+  // Mined from two years of PR review (SARJ-928). Schema-layer sibling of
+  // `no-enum`; autofixable for inline string-literal objects.
+  "@sarj/no-zod-native-enum": "warn",
+  // Mined from two years of PR review — the single most frequent uncovered
+  // theme (~37 PRs). Measured 17 hits / 1085 real TS files, all true
+  // positives, so it is safe to run everywhere.
+  "@sarj/prefer-module-level-constant": "warn",
+  // Anti-comment-verbosity family (2026-07), from a 37,918-comment,
+  // nine-repo measurement study. Each is a deletion-class finding, so each
+  // was validated against pydantic / trio / attrs as well as the maintained
+  // repos: `no-restated-comment` 0 hits in the flagship first-party
+  // repo and 4 in the three famous
+  // corpora combined; `trailing-value-narration` 18 hits, 18 true
+  // positives; `jsdoc-restates-signature` 36 hits, 0 measured false
+  // positives, and it offers a suggestion rather than a `--fix` because a
+  // wrong deletion is silent information loss.
+  "@sarj/no-restated-comment": "warn",
+  "@sarj/jsdoc-restates-signature": "warn",
+  "@sarj/trailing-value-narration": "warn",
+  // The VOLUME arm of the same family (2026-07). Its siblings judge one
+  // comment at a time and can only condemn one that adds nothing; this
+  // one judges a TYPE, so it can report ten rows that each add a word.
+  // 33 OSS TS repos / 46,861 files: 22 findings, all read, 0 false; zero
+  // across ten first-party repos, where the generated-file sniff alone
+  // removed 321 of the 407 raw hits. Measurements and the six false
+  // positives that shaped the guards: docs/rules/no-type-member-comment-wall.md
+  "@sarj/no-type-member-comment-wall": "warn",
+  // The TS half of SARJ057 (2026-07). Python has caught the
+  // assertion-FREE test since 0.15.0 (SARJ043) and had no TS
+  // counterpart, which is how `expect(true).toBe(true); // placeholder`
+  // survived in a first-party repo: the file HAS an assertion.
+  // Measured across 5,819 .ts/.tsx files (1,003 of them test files) in
+  // six internal repos plus got / hono / swr / trpc: 3 hits, 3 true
+  // positives, 0 false positives.
+  "@sarj/no-tautological-expect": "warn",
+  // Substitutability: an exported service class with injected
+  // collaborators and no interface above it can only be tested by
+  // mocking. 11-repo sweep: 229 exported classes, 82% already carry a
+  // port, 29 fire, 28 of them true positives.
+  "@sarj/require-interface-for-injected-service": "warn",
+  "@sarj/prefer-non-nullable-collection": "warn",
+  "@sarj/no-async-callback-in-waitfor": "warn",
+  // `strict-test-assertions` shipped in `rules` but in NEITHER preset, so a
+  // consumer using `configs.recommended`/`configs.strict` instead of the shared
+  // `eslint.strict.mjs` had silently never run it. `flat-presets.test.ts`
+  // asserts strict wires every rule the plugin ships, so it cannot recur.
+  "@sarj/strict-test-assertions": "warn"
+};
+var strictRules = {
+  "@sarj/zod-naming-convention": "error",
+  "@sarj/require-assert-never": "error",
+  "@sarj/require-zod-form-validation": "error",
+  "@sarj/enforce-file-structure": "error",
+  "@sarj/no-raw-env": "error",
+  "@sarj/no-enum": "error",
+  "@sarj/no-client-side-data-fetching": "error",
+  "@sarj/prefer-server-actions": "error",
+  "@sarj/no-unnecessary-use-client": "error",
+  "@sarj/prefer-schema-for-api-payload": "error",
+  // Distilled from sarj-audit skills.
+  "@sarj/no-sentinel-return-on-catch": "error",
+  "@sarj/no-log-only-catch": "error",
+  "@sarj/no-insecure-random-id": "error",
+  "@sarj/no-json-stringify-error": "error",
+  "@sarj/no-string-concat-in-loop": "error",
+  "@sarj/prefer-discriminated-union": "error",
+  "@sarj/no-comment-cruft": "error",
+  // Frontend / styling — distilled from frontend PR-review mining. Stylistic,
+  // no autofix → warn (rollout should prove the FP rate before raising it).
+  "@sarj/prefer-semantic-colors": [
+    "error",
+    { requireSemanticTokens: true }
+  ],
+  // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
+  "@sarj/no-fat-try-blocks": "error",
+  "@sarj/no-cors-wildcard-with-credentials": "error",
+  "@sarj/no-secret-in-log": "error",
+  "@sarj/no-unsafe-mock-casting": "error",
+  // Promoted to error 2026-07-25 — strict means strict (user directive).
+  "@sarj/prefer-string-literal-union": "error",
+  "@sarj/prefer-zod-enum": "error",
+  // See the `recommended` block for the measured counts.
+  "@sarj/prefer-zod-infer": "error",
+  // Mined from 2y of PR review feedback + 5-repo code-smell audit (2026-07).
+  "@sarj/require-fetch-timeout": "error",
+  "@sarj/no-silent-promise-catch": "error",
+  // Second SARJ port wave — the TS/Python parity gap.
+  "@sarj/prefer-constant-time-secret-compare": "error",
+  "@sarj/store-insert-requires-on-conflict": "error",
+  "@sarj/no-offset-pagination": "error",
+  "@sarj/no-select-star": "error",
+  // Uncancellable hand-rolled timers. Verified against the shipped
+  // strict config (205 enabled rules) that nothing already reports this
+  // position; `unicorn` 72 has no promisified-timer rule at all.
+  "@sarj/no-hand-rolled-sleep": "error",
+  "@sarj/no-sleep-in-test-body": "error",
+  "@sarj/no-conditional-in-test": "error",
+  "@sarj/no-repeated-string-literal": "error",
+  // API-shape advice rather than a runtime defect — a corpus sweep found its
+  // only hits are parser `[value, cursor]` returns, which are conventional.
+  // Warn even in strict until a rollout justifies more.
+  "@sarj/no-positional-tuple-return": "error",
+  "@sarj/no-dynamic-sql": "error",
+  // Architectural: both need per-repo config to be meaningful, so they
+  // are strict-only. `no-storage-in-stateless-modules` is a no-op until
+  // its `modules` option names the directories a team declared stateless;
+  // `no-raw-fetch-outside-clients` defaults to the `clients/` convention
+  // and takes an `allow` list for repos that lay their client layer out
+  // differently.
+  "@sarj/no-raw-fetch-outside-clients": "error",
+  "@sarj/no-storage-in-stateless-modules": "error",
+  // Mined from two years of PR review (SARJ-928).
+  "@sarj/no-zod-native-enum": "error",
+  "@sarj/prefer-module-level-constant": "error",
+  // Anti-comment-verbosity family (2026-07) — see the `recommended` block
+  // for the measured hit counts and false-positive rates.
+  "@sarj/no-restated-comment": "error",
+  "@sarj/jsdoc-restates-signature": "error",
+  "@sarj/trailing-value-narration": "error",
+  "@sarj/no-type-member-comment-wall": "error",
+  // TS half of SARJ057 — see the `recommended` block for the measurement.
+  "@sarj/no-tautological-expect": "error",
+  // Substitutability: the TS sibling of the Python `prefer-real-store-in-tests`
+  // / `prefer-library-fake` wave. The convention already exists in the
+  // corpus (175 `implements` clauses vs 29 hits), so strict enforces it.
+  "@sarj/require-interface-for-injected-service": "error",
+  "@sarj/prefer-non-nullable-collection": "error",
+  "@sarj/no-async-callback-in-waitfor": "error",
+  // See the `recommended` block.
+  "@sarj/strict-test-assertions": "error"
+};
 var plugin = {
-  meta: {
-    name: "@sarj/eslint-plugin",
-    version: "5.1.0"
-  },
+  meta,
   rules,
   configs: {
-    recommended: {
-      plugins: ["@sarj"],
-      rules: {
-        "@sarj/zod-naming-convention": "warn",
-        "@sarj/require-assert-never": "error",
-        "@sarj/require-zod-form-validation": "error",
-        "@sarj/enforce-file-structure": "warn",
-        "@sarj/no-client-side-data-fetching": "warn",
-        "@sarj/prefer-server-actions": "warn",
-        "@sarj/no-unnecessary-use-client": "warn",
-        "@sarj/prefer-schema-for-api-payload": "warn",
-        // Distilled from sarj-audit skills — warn in recommended, error in strict.
-        "@sarj/no-sentinel-return-on-catch": "warn",
-        "@sarj/no-log-only-catch": "warn",
-        "@sarj/no-insecure-random-id": "warn",
-        "@sarj/no-json-stringify-error": "warn",
-        "@sarj/no-string-concat-in-loop": "warn",
-        "@sarj/prefer-discriminated-union": "warn",
-        "@sarj/no-comment-cruft": "warn",
-        // Frontend / styling — distilled from frontend PR-review mining.
-        "@sarj/prefer-semantic-colors": [
-          "warn",
-          { requireSemanticTokens: true }
-        ],
-        // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
-        "@sarj/no-fat-try-blocks": "warn",
-        "@sarj/no-cors-wildcard-with-credentials": "warn",
-        "@sarj/no-secret-in-log": "warn",
-        "@sarj/no-unsafe-mock-casting": "warn",
-        "@sarj/prefer-string-literal-union": "warn",
-        "@sarj/prefer-zod-enum": "warn",
-        // A type hand-written beside the Zod schema it restates drifts the
-        // moment the schema gains a field. 30,759-file, 17-repo sweep
-        // (2026-07): 5 reports, 5 true positives, all in public repos.
-        // `requireIdenticalShape: false` widens it to 8 reports, 1 of them noise.
-        "@sarj/prefer-zod-infer": "warn",
-        // Mined from 2y of PR review feedback + 5-repo code-smell audit (2026-07).
-        "@sarj/require-fetch-timeout": "warn",
-        "@sarj/no-silent-promise-catch": "warn",
-        // Second SARJ port wave — the TS/Python parity gap. Each targets a
-        // defect class seen in production Workers code: timing-leaky secret
-        // compares, non-idempotent store writes under queue redelivery,
-        // O(N) pagination, implicit row contracts, flaky timed tests.
-        "@sarj/prefer-constant-time-secret-compare": "error",
-        "@sarj/store-insert-requires-on-conflict": "warn",
-        "@sarj/no-offset-pagination": "warn",
-        "@sarj/no-select-star": "warn",
-        // Uncancellable hand-rolled timers. Verified against the shipped
-        // strict config (205 enabled rules) that nothing already reports this
-        // position; `unicorn` 72 has no promisified-timer rule at all.
-        "@sarj/no-hand-rolled-sleep": "warn",
-        "@sarj/no-sleep-in-test-body": "warn",
-        "@sarj/no-conditional-in-test": "warn",
-        "@sarj/no-repeated-string-literal": "warn",
-        "@sarj/no-positional-tuple-return": "warn",
-        // Injection guard — low FP, applies to any repo touching SQL.
-        "@sarj/no-dynamic-sql": "warn",
-        // Mined from two years of PR review (SARJ-928). Schema-layer sibling of
-        // `no-enum`; autofixable for inline string-literal objects.
-        "@sarj/no-zod-native-enum": "warn",
-        // Mined from two years of PR review — the single most frequent uncovered
-        // theme (~37 PRs). Measured 17 hits / 1085 real TS files, all true
-        // positives, so it is safe to run everywhere.
-        "@sarj/prefer-module-level-constant": "warn",
-        // Anti-comment-verbosity family (2026-07), from a 37,918-comment,
-        // nine-repo measurement study. Each is a deletion-class finding, so each
-        // was validated against pydantic / trio / attrs as well as the maintained
-        // repos: `no-restated-comment` 0 hits in the flagship first-party
-        // repo and 4 in the three famous
-        // corpora combined; `trailing-value-narration` 18 hits, 18 true
-        // positives; `jsdoc-restates-signature` 36 hits, 0 measured false
-        // positives, and it offers a suggestion rather than a `--fix` because a
-        // wrong deletion is silent information loss.
-        "@sarj/no-restated-comment": "warn",
-        "@sarj/jsdoc-restates-signature": "warn",
-        "@sarj/trailing-value-narration": "warn",
-        // The VOLUME arm of the same family (2026-07). Its siblings judge one
-        // comment at a time and can only condemn one that adds nothing; this
-        // one judges a TYPE, so it can report ten rows that each add a word.
-        // 33 OSS TS repos / 46,861 files: 22 findings, all read, 0 false; zero
-        // across ten first-party repos, where the generated-file sniff alone
-        // removed 321 of the 407 raw hits. Measurements and the six false
-        // positives that shaped the guards: docs/rules/no-type-member-comment-wall.md
-        "@sarj/no-type-member-comment-wall": "warn",
-        // The TS half of SARJ057 (2026-07). Python has caught the
-        // assertion-FREE test since 0.15.0 (SARJ043) and had no TS
-        // counterpart, which is how `expect(true).toBe(true); // placeholder`
-        // survived in a first-party repo: the file HAS an assertion.
-        // Measured across 5,819 .ts/.tsx files (1,003 of them test files) in
-        // six internal repos plus got / hono / swr / trpc: 3 hits, 3 true
-        // positives, 0 false positives.
-        "@sarj/no-tautological-expect": "warn",
-        // Substitutability: an exported service class with injected
-        // collaborators and no interface above it can only be tested by
-        // mocking. 11-repo sweep: 229 exported classes, 82% already carry a
-        // port, 29 fire, 28 of them true positives.
-        "@sarj/require-interface-for-injected-service": "warn",
-        "@sarj/prefer-non-nullable-collection": "warn",
-        "@sarj/no-async-callback-in-waitfor": "warn"
-      }
-    },
-    strict: {
-      plugins: ["@sarj"],
-      rules: {
-        "@sarj/zod-naming-convention": "error",
-        "@sarj/require-assert-never": "error",
-        "@sarj/require-zod-form-validation": "error",
-        "@sarj/enforce-file-structure": "error",
-        "@sarj/no-raw-env": "error",
-        "@sarj/no-enum": "error",
-        "@sarj/no-client-side-data-fetching": "error",
-        "@sarj/prefer-server-actions": "error",
-        "@sarj/no-unnecessary-use-client": "error",
-        "@sarj/prefer-schema-for-api-payload": "error",
-        // Distilled from sarj-audit skills.
-        "@sarj/no-sentinel-return-on-catch": "error",
-        "@sarj/no-log-only-catch": "error",
-        "@sarj/no-insecure-random-id": "error",
-        "@sarj/no-json-stringify-error": "error",
-        "@sarj/no-string-concat-in-loop": "error",
-        "@sarj/prefer-discriminated-union": "error",
-        "@sarj/no-comment-cruft": "error",
-        // Frontend / styling — distilled from frontend PR-review mining. Stylistic,
-        // no autofix → warn (rollout should prove the FP rate before raising it).
-        "@sarj/prefer-semantic-colors": [
-          "error",
-          { requireSemanticTokens: true }
-        ],
-        // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
-        "@sarj/no-fat-try-blocks": "error",
-        "@sarj/no-cors-wildcard-with-credentials": "error",
-        "@sarj/no-secret-in-log": "error",
-        "@sarj/no-unsafe-mock-casting": "error",
-        // Promoted to error 2026-07-25 — strict means strict (user directive).
-        "@sarj/prefer-string-literal-union": "error",
-        "@sarj/prefer-zod-enum": "error",
-        // See the `recommended` block for the measured counts.
-        "@sarj/prefer-zod-infer": "error",
-        // Mined from 2y of PR review feedback + 5-repo code-smell audit (2026-07).
-        "@sarj/require-fetch-timeout": "error",
-        "@sarj/no-silent-promise-catch": "error",
-        // Second SARJ port wave — the TS/Python parity gap.
-        "@sarj/prefer-constant-time-secret-compare": "error",
-        "@sarj/store-insert-requires-on-conflict": "error",
-        "@sarj/no-offset-pagination": "error",
-        "@sarj/no-select-star": "error",
-        // Uncancellable hand-rolled timers. Verified against the shipped
-        // strict config (205 enabled rules) that nothing already reports this
-        // position; `unicorn` 72 has no promisified-timer rule at all.
-        "@sarj/no-hand-rolled-sleep": "error",
-        "@sarj/no-sleep-in-test-body": "error",
-        "@sarj/no-conditional-in-test": "error",
-        "@sarj/no-repeated-string-literal": "error",
-        // API-shape advice rather than a runtime defect — a corpus sweep found its
-        // only hits are parser `[value, cursor]` returns, which are conventional.
-        // Warn even in strict until a rollout justifies more.
-        "@sarj/no-positional-tuple-return": "error",
-        "@sarj/no-dynamic-sql": "error",
-        // Architectural: both need per-repo config to be meaningful, so they
-        // are strict-only. `no-storage-in-stateless-modules` is a no-op until
-        // its `modules` option names the directories a team declared stateless;
-        // `no-raw-fetch-outside-clients` defaults to the `clients/` convention
-        // and takes an `allow` list for repos that lay their client layer out
-        // differently.
-        "@sarj/no-raw-fetch-outside-clients": "error",
-        "@sarj/no-storage-in-stateless-modules": "error",
-        // Mined from two years of PR review (SARJ-928).
-        "@sarj/no-zod-native-enum": "error",
-        "@sarj/prefer-module-level-constant": "error",
-        // Anti-comment-verbosity family (2026-07) — see the `recommended` block
-        // for the measured hit counts and false-positive rates.
-        "@sarj/no-restated-comment": "error",
-        "@sarj/jsdoc-restates-signature": "error",
-        "@sarj/trailing-value-narration": "error",
-        "@sarj/no-type-member-comment-wall": "error",
-        // TS half of SARJ057 — see the `recommended` block for the measurement.
-        "@sarj/no-tautological-expect": "error",
-        // Substitutability: the TS sibling of the Python `prefer-real-store-in-tests`
-        // / `prefer-library-fake` wave. The convention already exists in the
-        // corpus (175 `implements` clauses vs 29 hits), so strict enforces it.
-        "@sarj/require-interface-for-injected-service": "error",
-        "@sarj/prefer-non-nullable-collection": "error",
-        "@sarj/no-async-callback-in-waitfor": "error"
-      }
-    }
+    recommended: {},
+    strict: {}
   }
 };
+plugin.configs.recommended = {
+  name: "@sarj/recommended",
+  plugins: { "@sarj": plugin },
+  rules: recommendedRules
+};
+plugin.configs.strict = {
+  name: "@sarj/strict",
+  plugins: { "@sarj": plugin },
+  rules: strictRules
+};
 var index_default = plugin;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  rules
+  recommendedRules,
+  rules,
+  strictRules
 });
 //# sourceMappingURL=index.cjs.map