@sarj/eslint-plugin 5.1.0 → 6.1.0

package/dist/index.cjs

@@ -31,7 +31,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   default: () => index_default,
-  rules: () => rules
+  recommendedRules: () => recommendedRules,
+  rules: () => rules,
+  strictRules: () => strictRules
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -8645,6 +8647,258 @@ var no_hand_rolled_sleep_default = import_utils55.ESLintUtils.RuleCreator(
   }
 });
 
+// src/rules/prefer-module-level-schema.ts
+var import_utils56 = require("@typescript-eslint/utils");
+var DEFAULT_FACTORIES = [
+  "discriminatedUnion",
+  "intersection",
+  "looseObject",
+  "object",
+  "record",
+  "strictObject",
+  "tuple",
+  "union"
+];
+var DEFAULT_MIN_PROPERTIES = 1;
+var MEMO_CALLEES = /* @__PURE__ */ new Set([
+  "lazy",
+  "memo",
+  "once",
+  "useMemo"
+]);
+var TERMINAL_METHODS = /* @__PURE__ */ new Set([
+  "isNullable",
+  "isOptional",
+  "parse",
+  "parseAsync",
+  "safeParse",
+  "safeParseAsync",
+  "spa"
+]);
+var FUNCTION_TYPES6 = /* @__PURE__ */ new Set([
+  import_utils56.AST_NODE_TYPES.ArrowFunctionExpression,
+  import_utils56.AST_NODE_TYPES.FunctionDeclaration,
+  import_utils56.AST_NODE_TYPES.FunctionExpression
+]);
+function schemaExpression(node) {
+  let current = node;
+  for (; ; ) {
+    const parent = current.parent ?? void 0;
+    if (parent === void 0) {
+      return current;
+    }
+    if (parent.type === import_utils56.AST_NODE_TYPES.MemberExpression && parent.object === current && !parent.computed && parent.property.type === import_utils56.AST_NODE_TYPES.Identifier && TERMINAL_METHODS.has(parent.property.name)) {
+      return current;
+    }
+    if (parent.type === import_utils56.AST_NODE_TYPES.MemberExpression && parent.object === current || parent.type === import_utils56.AST_NODE_TYPES.CallExpression && parent.callee === current || parent.type === import_utils56.AST_NODE_TYPES.TSAsExpression && parent.expression === current || parent.type === import_utils56.AST_NODE_TYPES.TSNonNullExpression && parent.expression === current) {
+      current = parent;
+      continue;
+    }
+    return current;
+  }
+}
+function outermostEnclosingFunction(node) {
+  let outermost;
+  let current = node.parent ?? void 0;
+  while (current !== void 0) {
+    if (FUNCTION_TYPES6.has(current.type)) {
+      outermost = current;
+    }
+    current = current.parent ?? void 0;
+  }
+  return outermost;
+}
+function readsReceiver(node) {
+  let found = false;
+  const visit = (value) => {
+    if (found || value === null || typeof value !== "object") {
+      return;
+    }
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        visit(item);
+      }
+      return;
+    }
+    const candidate = value;
+    if (typeof candidate.type !== "string") {
+      return;
+    }
+    if (candidate.type === import_utils56.AST_NODE_TYPES.ThisExpression || candidate.type === import_utils56.AST_NODE_TYPES.Super || candidate.type === import_utils56.AST_NODE_TYPES.Identifier && candidate.name === "arguments") {
+      found = true;
+      return;
+    }
+    for (const key of Object.keys(candidate)) {
+      if (key === "parent" || key === "loc" || key === "range") {
+        continue;
+      }
+      visit(candidate[key]);
+    }
+  };
+  visit(node);
+  return found;
+}
+function collectReferences(scope, out) {
+  out.push(...scope.references);
+  for (const child of scope.childScopes) {
+    collectReferences(child, out);
+  }
+}
+var prefer_module_level_schema_default = import_utils56.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/tree/main/packages/typescript#${name}`
+)({
+  name: "prefer-module-level-schema",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Declare a Zod schema at module scope when it closes over nothing in the enclosing function"
+    },
+    schema: [
+      {
+        type: "object",
+        properties: {
+          factories: {
+            type: "array",
+            items: { type: "string" },
+            description: "Zod factory names to check. Defaults to the object-like composites; add `array` / `enum` to widen."
+          },
+          ignoreTestFiles: {
+            type: "boolean",
+            description: "Skip test files, where a fixture schema belongs next to its assertion."
+          },
+          minProperties: {
+            type: "number",
+            minimum: 0,
+            description: "Minimum key count before an object-like schema is reported."
+          }
+        },
+        additionalProperties: false
+      }
+    ],
+    messages: {
+      hoistSchema: "Move this `{{factory}}` schema to module scope. It uses nothing from `{{owner}}`, so it is rebuilt on every call for no benefit and cannot be exported, reused, or `z.infer`-ed from where it is."
+    }
+  },
+  defaultOptions: [{}],
+  create(context, [options]) {
+    const factories = new Set(options?.factories ?? DEFAULT_FACTORIES);
+    const ignoreTestFiles = options?.ignoreTestFiles ?? true;
+    const minProperties = options?.minProperties ?? DEFAULT_MIN_PROPERTIES;
+    const sourceCode = context.sourceCode;
+    const filename = context.filename;
+    if (isGeneratedFile(filename, sourceCode.getText())) {
+      return {};
+    }
+    if (ignoreTestFiles && isTestFile(filename)) {
+      return {};
+    }
+    const zodNamespaces = /* @__PURE__ */ new Set();
+    function isZodCall(node) {
+      return node.type === import_utils56.AST_NODE_TYPES.CallExpression && node.callee.type === import_utils56.AST_NODE_TYPES.MemberExpression && !node.callee.computed && node.callee.object.type === import_utils56.AST_NODE_TYPES.Identifier && zodNamespaces.has(node.callee.object.name);
+    }
+    function isCovered(node) {
+      let current = node.parent ?? void 0;
+      while (current !== void 0) {
+        if (current !== node && isZodCall(current) && current.callee.type === import_utils56.AST_NODE_TYPES.MemberExpression && current.callee.property.type === import_utils56.AST_NODE_TYPES.Identifier && factories.has(current.callee.property.name)) {
+          return true;
+        }
+        if (current.type === import_utils56.AST_NODE_TYPES.CallExpression && (current.callee.type === import_utils56.AST_NODE_TYPES.Identifier && MEMO_CALLEES.has(current.callee.name) || current.callee.type === import_utils56.AST_NODE_TYPES.MemberExpression && !current.callee.computed && current.callee.property.type === import_utils56.AST_NODE_TYPES.Identifier && MEMO_CALLEES.has(current.callee.property.name))) {
+          return true;
+        }
+        current = current.parent ?? void 0;
+      }
+      return false;
+    }
+    function closesOverNothing(node, enclosing) {
+      const references = [];
+      collectReferences(sourceCode.getScope(node), references);
+      const [schemaStart, schemaEnd] = node.range;
+      const [functionStart, functionEnd] = enclosing.range;
+      for (const reference of references) {
+        const [identifierStart] = reference.identifier.range;
+        if (identifierStart < schemaStart || identifierStart >= schemaEnd) {
+          continue;
+        }
+        const resolved = reference.resolved;
+        if (resolved === null) {
+          continue;
+        }
+        for (const definition of resolved.defs) {
+          if (definition.type === "ImportBinding") {
+            continue;
+          }
+          const [defStart, defEnd] = definition.node.range;
+          if (defStart >= functionStart && defEnd <= functionEnd) {
+            return false;
+          }
+        }
+      }
+      return true;
+    }
+    function ownerName(enclosing) {
+      const parent = enclosing.parent ?? void 0;
+      if (enclosing.type === import_utils56.AST_NODE_TYPES.FunctionDeclaration && enclosing.id !== null) {
+        return enclosing.id.name;
+      }
+      if (parent !== void 0 && parent.type === import_utils56.AST_NODE_TYPES.VariableDeclarator && parent.id.type === import_utils56.AST_NODE_TYPES.Identifier) {
+        return parent.id.name;
+      }
+      if (parent !== void 0 && (parent.type === import_utils56.AST_NODE_TYPES.MethodDefinition || parent.type === import_utils56.AST_NODE_TYPES.Property) && parent.key.type === import_utils56.AST_NODE_TYPES.Identifier) {
+        return parent.key.name;
+      }
+      return "this function";
+    }
+    return {
+      ImportDeclaration(node) {
+        if (!isZodModule(node.source.value)) {
+          return;
+        }
+        for (const specifier of node.specifiers) {
+          if (specifier.type === import_utils56.AST_NODE_TYPES.ImportNamespaceSpecifier || specifier.type === import_utils56.AST_NODE_TYPES.ImportDefaultSpecifier || specifier.type === import_utils56.AST_NODE_TYPES.ImportSpecifier && specifier.imported.type === import_utils56.AST_NODE_TYPES.Identifier && specifier.imported.name === "z") {
+            zodNamespaces.add(specifier.local.name);
+          }
+        }
+      },
+      CallExpression(node) {
+        if (zodNamespaces.size === 0 || !isZodCall(node)) {
+          return;
+        }
+        const callee = node.callee;
+        if (callee.property.type !== import_utils56.AST_NODE_TYPES.Identifier) {
+          return;
+        }
+        const factory = callee.property.name;
+        if (!factories.has(factory)) {
+          return;
+        }
+        const enclosing = outermostEnclosingFunction(node);
+        if (enclosing === void 0) {
+          return;
+        }
+        if (isCovered(node)) {
+          return;
+        }
+        const shape = node.arguments[0];
+        if (shape !== void 0 && shape.type === import_utils56.AST_NODE_TYPES.ObjectExpression && shape.properties.length < minProperties) {
+          return;
+        }
+        const expression = schemaExpression(node);
+        if (readsReceiver(expression)) {
+          return;
+        }
+        if (!closesOverNothing(expression, enclosing)) {
+          return;
+        }
+        context.report({
+          node,
+          messageId: "hoistSchema",
+          data: { factory: `z.${factory}`, owner: ownerName(enclosing) }
+        });
+      }
+    };
+  }
+});
+
 // src/index.ts
 var rules = {
   "enforce-file-structure": enforce_file_structure_default,
@@ -8696,205 +8950,232 @@ var rules = {
   "require-interface-for-injected-service": require_interface_for_injected_service_default,
   "strict-test-assertions": strict_test_assertions_default,
   "prefer-non-nullable-collection": prefer_non_nullable_collection_default,
-  "no-async-callback-in-waitfor": no_async_callback_in_waitfor_default
+  "no-async-callback-in-waitfor": no_async_callback_in_waitfor_default,
+  "prefer-module-level-schema": prefer_module_level_schema_default
+};
+var meta = {
+  name: "@sarj/eslint-plugin",
+  version: "6.1.0"
+};
+var recommendedRules = {
+  "@sarj/zod-naming-convention": "warn",
+  "@sarj/require-assert-never": "error",
+  "@sarj/require-zod-form-validation": "error",
+  "@sarj/enforce-file-structure": "warn",
+  "@sarj/no-client-side-data-fetching": "warn",
+  "@sarj/prefer-server-actions": "warn",
+  "@sarj/no-unnecessary-use-client": "warn",
+  "@sarj/prefer-schema-for-api-payload": "warn",
+  // Distilled from sarj-audit skills — warn in recommended, error in strict.
+  "@sarj/no-sentinel-return-on-catch": "warn",
+  "@sarj/no-log-only-catch": "warn",
+  "@sarj/no-insecure-random-id": "warn",
+  "@sarj/no-json-stringify-error": "warn",
+  "@sarj/no-string-concat-in-loop": "warn",
+  "@sarj/prefer-discriminated-union": "warn",
+  "@sarj/no-comment-cruft": "warn",
+  // Frontend / styling — distilled from frontend PR-review mining.
+  "@sarj/prefer-semantic-colors": [
+    "warn",
+    { requireSemanticTokens: true }
+  ],
+  // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
+  "@sarj/no-fat-try-blocks": "warn",
+  "@sarj/no-cors-wildcard-with-credentials": "warn",
+  "@sarj/no-secret-in-log": "warn",
+  "@sarj/no-unsafe-mock-casting": "warn",
+  "@sarj/prefer-string-literal-union": "warn",
+  "@sarj/prefer-zod-enum": "warn",
+  // A type hand-written beside the Zod schema it restates drifts the
+  // moment the schema gains a field. 30,759-file, 17-repo sweep
+  // (2026-07): 5 reports, 5 true positives, all in public repos.
+  // `requireIdenticalShape: false` widens it to 8 reports, 1 of them noise.
+  "@sarj/prefer-zod-infer": "warn",
+  // Mined from 2y of PR review feedback + 5-repo code-smell audit (2026-07).
+  "@sarj/require-fetch-timeout": "warn",
+  "@sarj/no-silent-promise-catch": "warn",
+  // Second SARJ port wave — the TS/Python parity gap. Each targets a
+  // defect class seen in production Workers code: timing-leaky secret
+  // compares, non-idempotent store writes under queue redelivery,
+  // O(N) pagination, implicit row contracts, flaky timed tests.
+  "@sarj/prefer-constant-time-secret-compare": "error",
+  "@sarj/store-insert-requires-on-conflict": "warn",
+  "@sarj/no-offset-pagination": "warn",
+  "@sarj/no-select-star": "warn",
+  // Uncancellable hand-rolled timers. Verified against the shipped
+  // strict config (205 enabled rules) that nothing already reports this
+  // position; `unicorn` 72 has no promisified-timer rule at all.
+  "@sarj/no-hand-rolled-sleep": "warn",
+  "@sarj/no-sleep-in-test-body": "warn",
+  "@sarj/no-conditional-in-test": "warn",
+  "@sarj/no-repeated-string-literal": "warn",
+  "@sarj/no-positional-tuple-return": "warn",
+  // Injection guard — low FP, applies to any repo touching SQL.
+  "@sarj/no-dynamic-sql": "warn",
+  // Mined from two years of PR review (SARJ-928). Schema-layer sibling of
+  // `no-enum`; autofixable for inline string-literal objects.
+  "@sarj/no-zod-native-enum": "warn",
+  // Mined from two years of PR review — the single most frequent uncovered
+  // theme (~37 PRs). Measured 17 hits / 1085 real TS files, all true
+  // positives, so it is safe to run everywhere.
+  "@sarj/prefer-module-level-constant": "warn",
+  // Anti-comment-verbosity family (2026-07), from a 37,918-comment,
+  // nine-repo measurement study. Each is a deletion-class finding, so each
+  // was validated against pydantic / trio / attrs as well as the maintained
+  // repos: `no-restated-comment` 0 hits in the flagship first-party
+  // repo and 4 in the three famous
+  // corpora combined; `trailing-value-narration` 18 hits, 18 true
+  // positives; `jsdoc-restates-signature` 36 hits, 0 measured false
+  // positives, and it offers a suggestion rather than a `--fix` because a
+  // wrong deletion is silent information loss.
+  "@sarj/no-restated-comment": "warn",
+  "@sarj/jsdoc-restates-signature": "warn",
+  "@sarj/trailing-value-narration": "warn",
+  // The VOLUME arm of the same family (2026-07). Its siblings judge one
+  // comment at a time and can only condemn one that adds nothing; this
+  // one judges a TYPE, so it can report ten rows that each add a word.
+  // 33 OSS TS repos / 46,861 files: 22 findings, all read, 0 false; zero
+  // across ten first-party repos, where the generated-file sniff alone
+  // removed 321 of the 407 raw hits. Measurements and the six false
+  // positives that shaped the guards: docs/rules/no-type-member-comment-wall.md
+  "@sarj/no-type-member-comment-wall": "warn",
+  // The TS half of SARJ057 (2026-07). Python has caught the
+  // assertion-FREE test since 0.15.0 (SARJ043) and had no TS
+  // counterpart, which is how `expect(true).toBe(true); // placeholder`
+  // survived in a first-party repo: the file HAS an assertion.
+  // Measured across 5,819 .ts/.tsx files (1,003 of them test files) in
+  // six internal repos plus got / hono / swr / trpc: 3 hits, 3 true
+  // positives, 0 false positives.
+  "@sarj/no-tautological-expect": "warn",
+  // Substitutability: an exported service class with injected
+  // collaborators and no interface above it can only be tested by
+  // mocking. 11-repo sweep: 229 exported classes, 82% already carry a
+  // port, 29 fire, 28 of them true positives.
+  "@sarj/require-interface-for-injected-service": "warn",
+  "@sarj/prefer-non-nullable-collection": "warn",
+  "@sarj/no-async-callback-in-waitfor": "warn",
+  // A Zod schema built inside a function is rebuilt on every call, every
+  // request, every render. Zod sibling of `prefer-module-level-constant`,
+  // which cannot reach it: that rule's hoist gate requires literal leaves and
+  // `z.object({...})` is a call. 378 reports over 30,546 .ts/.tsx files in 17
+  // repos; the free-variable, chain and `this` gates are what keep the schema
+  // FACTORY case (closes over a parameter, a type parameter, or a local type)
+  // silent.
+  "@sarj/prefer-module-level-schema": "warn",
+  // `strict-test-assertions` shipped in `rules` but in NEITHER preset, so a
+  // consumer using `configs.recommended`/`configs.strict` instead of the shared
+  // `eslint.strict.mjs` had silently never run it. `flat-presets.test.ts`
+  // asserts strict wires every rule the plugin ships, so it cannot recur.
+  "@sarj/strict-test-assertions": "warn"
+};
+var strictRules = {
+  "@sarj/zod-naming-convention": "error",
+  "@sarj/require-assert-never": "error",
+  "@sarj/require-zod-form-validation": "error",
+  "@sarj/enforce-file-structure": "error",
+  "@sarj/no-raw-env": "error",
+  "@sarj/no-enum": "error",
+  "@sarj/no-client-side-data-fetching": "error",
+  "@sarj/prefer-server-actions": "error",
+  "@sarj/no-unnecessary-use-client": "error",
+  "@sarj/prefer-schema-for-api-payload": "error",
+  // Distilled from sarj-audit skills.
+  "@sarj/no-sentinel-return-on-catch": "error",
+  "@sarj/no-log-only-catch": "error",
+  "@sarj/no-insecure-random-id": "error",
+  "@sarj/no-json-stringify-error": "error",
+  "@sarj/no-string-concat-in-loop": "error",
+  "@sarj/prefer-discriminated-union": "error",
+  "@sarj/no-comment-cruft": "error",
+  // Frontend / styling — distilled from frontend PR-review mining. Stylistic,
+  // no autofix → warn (rollout should prove the FP rate before raising it).
+  "@sarj/prefer-semantic-colors": [
+    "error",
+    { requireSemanticTokens: true }
+  ],
+  // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
+  "@sarj/no-fat-try-blocks": "error",
+  "@sarj/no-cors-wildcard-with-credentials": "error",
+  "@sarj/no-secret-in-log": "error",
+  "@sarj/no-unsafe-mock-casting": "error",
+  // Promoted to error 2026-07-25 — strict means strict (user directive).
+  "@sarj/prefer-string-literal-union": "error",
+  "@sarj/prefer-zod-enum": "error",
+  // See the `recommended` block for the measured counts.
+  "@sarj/prefer-zod-infer": "error",
+  // Mined from 2y of PR review feedback + 5-repo code-smell audit (2026-07).
+  "@sarj/require-fetch-timeout": "error",
+  "@sarj/no-silent-promise-catch": "error",
+  // Second SARJ port wave — the TS/Python parity gap.
+  "@sarj/prefer-constant-time-secret-compare": "error",
+  "@sarj/store-insert-requires-on-conflict": "error",
+  "@sarj/no-offset-pagination": "error",
+  "@sarj/no-select-star": "error",
+  // Uncancellable hand-rolled timers. Verified against the shipped
+  // strict config (205 enabled rules) that nothing already reports this
+  // position; `unicorn` 72 has no promisified-timer rule at all.
+  "@sarj/no-hand-rolled-sleep": "error",
+  "@sarj/no-sleep-in-test-body": "error",
+  "@sarj/no-conditional-in-test": "error",
+  "@sarj/no-repeated-string-literal": "error",
+  // API-shape advice rather than a runtime defect — a corpus sweep found its
+  // only hits are parser `[value, cursor]` returns, which are conventional.
+  // Warn even in strict until a rollout justifies more.
+  "@sarj/no-positional-tuple-return": "error",
+  "@sarj/no-dynamic-sql": "error",
+  // Architectural: both need per-repo config to be meaningful, so they
+  // are strict-only. `no-storage-in-stateless-modules` is a no-op until
+  // its `modules` option names the directories a team declared stateless;
+  // `no-raw-fetch-outside-clients` defaults to the `clients/` convention
+  // and takes an `allow` list for repos that lay their client layer out
+  // differently.
+  "@sarj/no-raw-fetch-outside-clients": "error",
+  "@sarj/no-storage-in-stateless-modules": "error",
+  // Mined from two years of PR review (SARJ-928).
+  "@sarj/no-zod-native-enum": "error",
+  "@sarj/prefer-module-level-constant": "error",
+  // Anti-comment-verbosity family (2026-07) — see the `recommended` block
+  // for the measured hit counts and false-positive rates.
+  "@sarj/no-restated-comment": "error",
+  "@sarj/jsdoc-restates-signature": "error",
+  "@sarj/trailing-value-narration": "error",
+  "@sarj/no-type-member-comment-wall": "error",
+  // TS half of SARJ057 — see the `recommended` block for the measurement.
+  "@sarj/no-tautological-expect": "error",
+  // Substitutability: the TS sibling of the Python `prefer-real-store-in-tests`
+  // / `prefer-library-fake` wave. The convention already exists in the
+  // corpus (175 `implements` clauses vs 29 hits), so strict enforces it.
+  "@sarj/require-interface-for-injected-service": "error",
+  "@sarj/prefer-non-nullable-collection": "error",
+  "@sarj/no-async-callback-in-waitfor": "error",
+  // Zod sibling of `prefer-module-level-constant` -- see `recommended`.
+  "@sarj/prefer-module-level-schema": "error",
+  // See the `recommended` block.
+  "@sarj/strict-test-assertions": "error"
 };
 var plugin = {
-  meta: {
-    name: "@sarj/eslint-plugin",
-    version: "5.1.0"
-  },
+  meta,
   rules,
   configs: {
-    recommended: {
-      plugins: ["@sarj"],
-      rules: {
-        "@sarj/zod-naming-convention": "warn",
-        "@sarj/require-assert-never": "error",
-        "@sarj/require-zod-form-validation": "error",
-        "@sarj/enforce-file-structure": "warn",
-        "@sarj/no-client-side-data-fetching": "warn",
-        "@sarj/prefer-server-actions": "warn",
-        "@sarj/no-unnecessary-use-client": "warn",
-        "@sarj/prefer-schema-for-api-payload": "warn",
-        // Distilled from sarj-audit skills — warn in recommended, error in strict.
-        "@sarj/no-sentinel-return-on-catch": "warn",
-        "@sarj/no-log-only-catch": "warn",
-        "@sarj/no-insecure-random-id": "warn",
-        "@sarj/no-json-stringify-error": "warn",
-        "@sarj/no-string-concat-in-loop": "warn",
-        "@sarj/prefer-discriminated-union": "warn",
-        "@sarj/no-comment-cruft": "warn",
-        // Frontend / styling — distilled from frontend PR-review mining.
-        "@sarj/prefer-semantic-colors": [
-          "warn",
-          { requireSemanticTokens: true }
-        ],
-        // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
-        "@sarj/no-fat-try-blocks": "warn",
-        "@sarj/no-cors-wildcard-with-credentials": "warn",
-        "@sarj/no-secret-in-log": "warn",
-        "@sarj/no-unsafe-mock-casting": "warn",
-        "@sarj/prefer-string-literal-union": "warn",
-        "@sarj/prefer-zod-enum": "warn",
-        // A type hand-written beside the Zod schema it restates drifts the
-        // moment the schema gains a field. 30,759-file, 17-repo sweep
-        // (2026-07): 5 reports, 5 true positives, all in public repos.
-        // `requireIdenticalShape: false` widens it to 8 reports, 1 of them noise.
-        "@sarj/prefer-zod-infer": "warn",
-        // Mined from 2y of PR review feedback + 5-repo code-smell audit (2026-07).
-        "@sarj/require-fetch-timeout": "warn",
-        "@sarj/no-silent-promise-catch": "warn",
-        // Second SARJ port wave — the TS/Python parity gap. Each targets a
-        // defect class seen in production Workers code: timing-leaky secret
-        // compares, non-idempotent store writes under queue redelivery,
-        // O(N) pagination, implicit row contracts, flaky timed tests.
-        "@sarj/prefer-constant-time-secret-compare": "error",
-        "@sarj/store-insert-requires-on-conflict": "warn",
-        "@sarj/no-offset-pagination": "warn",
-        "@sarj/no-select-star": "warn",
-        // Uncancellable hand-rolled timers. Verified against the shipped
-        // strict config (205 enabled rules) that nothing already reports this
-        // position; `unicorn` 72 has no promisified-timer rule at all.
-        "@sarj/no-hand-rolled-sleep": "warn",
-        "@sarj/no-sleep-in-test-body": "warn",
-        "@sarj/no-conditional-in-test": "warn",
-        "@sarj/no-repeated-string-literal": "warn",
-        "@sarj/no-positional-tuple-return": "warn",
-        // Injection guard — low FP, applies to any repo touching SQL.
-        "@sarj/no-dynamic-sql": "warn",
-        // Mined from two years of PR review (SARJ-928). Schema-layer sibling of
-        // `no-enum`; autofixable for inline string-literal objects.
-        "@sarj/no-zod-native-enum": "warn",
-        // Mined from two years of PR review — the single most frequent uncovered
-        // theme (~37 PRs). Measured 17 hits / 1085 real TS files, all true
-        // positives, so it is safe to run everywhere.
-        "@sarj/prefer-module-level-constant": "warn",
-        // Anti-comment-verbosity family (2026-07), from a 37,918-comment,
-        // nine-repo measurement study. Each is a deletion-class finding, so each
-        // was validated against pydantic / trio / attrs as well as the maintained
-        // repos: `no-restated-comment` 0 hits in the flagship first-party
-        // repo and 4 in the three famous
-        // corpora combined; `trailing-value-narration` 18 hits, 18 true
-        // positives; `jsdoc-restates-signature` 36 hits, 0 measured false
-        // positives, and it offers a suggestion rather than a `--fix` because a
-        // wrong deletion is silent information loss.
-        "@sarj/no-restated-comment": "warn",
-        "@sarj/jsdoc-restates-signature": "warn",
-        "@sarj/trailing-value-narration": "warn",
-        // The VOLUME arm of the same family (2026-07). Its siblings judge one
-        // comment at a time and can only condemn one that adds nothing; this
-        // one judges a TYPE, so it can report ten rows that each add a word.
-        // 33 OSS TS repos / 46,861 files: 22 findings, all read, 0 false; zero
-        // across ten first-party repos, where the generated-file sniff alone
-        // removed 321 of the 407 raw hits. Measurements and the six false
-        // positives that shaped the guards: docs/rules/no-type-member-comment-wall.md
-        "@sarj/no-type-member-comment-wall": "warn",
-        // The TS half of SARJ057 (2026-07). Python has caught the
-        // assertion-FREE test since 0.15.0 (SARJ043) and had no TS
-        // counterpart, which is how `expect(true).toBe(true); // placeholder`
-        // survived in a first-party repo: the file HAS an assertion.
-        // Measured across 5,819 .ts/.tsx files (1,003 of them test files) in
-        // six internal repos plus got / hono / swr / trpc: 3 hits, 3 true
-        // positives, 0 false positives.
-        "@sarj/no-tautological-expect": "warn",
-        // Substitutability: an exported service class with injected
-        // collaborators and no interface above it can only be tested by
-        // mocking. 11-repo sweep: 229 exported classes, 82% already carry a
-        // port, 29 fire, 28 of them true positives.
-        "@sarj/require-interface-for-injected-service": "warn",
-        "@sarj/prefer-non-nullable-collection": "warn",
-        "@sarj/no-async-callback-in-waitfor": "warn"
-      }
-    },
-    strict: {
-      plugins: ["@sarj"],
-      rules: {
-        "@sarj/zod-naming-convention": "error",
-        "@sarj/require-assert-never": "error",
-        "@sarj/require-zod-form-validation": "error",
-        "@sarj/enforce-file-structure": "error",
-        "@sarj/no-raw-env": "error",
-        "@sarj/no-enum": "error",
-        "@sarj/no-client-side-data-fetching": "error",
-        "@sarj/prefer-server-actions": "error",
-        "@sarj/no-unnecessary-use-client": "error",
-        "@sarj/prefer-schema-for-api-payload": "error",
-        // Distilled from sarj-audit skills.
-        "@sarj/no-sentinel-return-on-catch": "error",
-        "@sarj/no-log-only-catch": "error",
-        "@sarj/no-insecure-random-id": "error",
-        "@sarj/no-json-stringify-error": "error",
-        "@sarj/no-string-concat-in-loop": "error",
-        "@sarj/prefer-discriminated-union": "error",
-        "@sarj/no-comment-cruft": "error",
-        // Frontend / styling — distilled from frontend PR-review mining. Stylistic,
-        // no autofix → warn (rollout should prove the FP rate before raising it).
-        "@sarj/prefer-semantic-colors": [
-          "error",
-          { requireSemanticTokens: true }
-        ],
-        // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
-        "@sarj/no-fat-try-blocks": "error",
-        "@sarj/no-cors-wildcard-with-credentials": "error",
-        "@sarj/no-secret-in-log": "error",
-        "@sarj/no-unsafe-mock-casting": "error",
-        // Promoted to error 2026-07-25 — strict means strict (user directive).
-        "@sarj/prefer-string-literal-union": "error",
-        "@sarj/prefer-zod-enum": "error",
-        // See the `recommended` block for the measured counts.
-        "@sarj/prefer-zod-infer": "error",
-        // Mined from 2y of PR review feedback + 5-repo code-smell audit (2026-07).
-        "@sarj/require-fetch-timeout": "error",
-        "@sarj/no-silent-promise-catch": "error",
-        // Second SARJ port wave — the TS/Python parity gap.
-        "@sarj/prefer-constant-time-secret-compare": "error",
-        "@sarj/store-insert-requires-on-conflict": "error",
-        "@sarj/no-offset-pagination": "error",
-        "@sarj/no-select-star": "error",
-        // Uncancellable hand-rolled timers. Verified against the shipped
-        // strict config (205 enabled rules) that nothing already reports this
-        // position; `unicorn` 72 has no promisified-timer rule at all.
-        "@sarj/no-hand-rolled-sleep": "error",
-        "@sarj/no-sleep-in-test-body": "error",
-        "@sarj/no-conditional-in-test": "error",
-        "@sarj/no-repeated-string-literal": "error",
-        // API-shape advice rather than a runtime defect — a corpus sweep found its
-        // only hits are parser `[value, cursor]` returns, which are conventional.
-        // Warn even in strict until a rollout justifies more.
-        "@sarj/no-positional-tuple-return": "error",
-        "@sarj/no-dynamic-sql": "error",
-        // Architectural: both need per-repo config to be meaningful, so they
-        // are strict-only. `no-storage-in-stateless-modules` is a no-op until
-        // its `modules` option names the directories a team declared stateless;
-        // `no-raw-fetch-outside-clients` defaults to the `clients/` convention
-        // and takes an `allow` list for repos that lay their client layer out
-        // differently.
-        "@sarj/no-raw-fetch-outside-clients": "error",
-        "@sarj/no-storage-in-stateless-modules": "error",
-        // Mined from two years of PR review (SARJ-928).
-        "@sarj/no-zod-native-enum": "error",
-        "@sarj/prefer-module-level-constant": "error",
-        // Anti-comment-verbosity family (2026-07) — see the `recommended` block
-        // for the measured hit counts and false-positive rates.
-        "@sarj/no-restated-comment": "error",
-        "@sarj/jsdoc-restates-signature": "error",
-        "@sarj/trailing-value-narration": "error",
-        "@sarj/no-type-member-comment-wall": "error",
-        // TS half of SARJ057 — see the `recommended` block for the measurement.
-        "@sarj/no-tautological-expect": "error",
-        // Substitutability: the TS sibling of the Python `prefer-real-store-in-tests`
-        // / `prefer-library-fake` wave. The convention already exists in the
-        // corpus (175 `implements` clauses vs 29 hits), so strict enforces it.
-        "@sarj/require-interface-for-injected-service": "error",
-        "@sarj/prefer-non-nullable-collection": "error",
-        "@sarj/no-async-callback-in-waitfor": "error"
-      }
-    }
+    recommended: {},
+    strict: {}
   }
 };
+plugin.configs.recommended = {
+  name: "@sarj/recommended",
+  plugins: { "@sarj": plugin },
+  rules: recommendedRules
+};
+plugin.configs.strict = {
+  name: "@sarj/strict",
+  plugins: { "@sarj": plugin },
+  rules: strictRules
+};
 var index_default = plugin;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  rules
+  recommendedRules,
+  rules,
+  strictRules
 });
 //# sourceMappingURL=index.cjs.map