@sarj/eslint-plugin 9.13.0 → 9.14.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 sarj-ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -46,7 +46,7 @@ changes only the call; import cleanup remains explicit. Other UUID versions,
 custom-randomness arguments, re-exports, and function references are untouched.
 
 Neither rule is in the general presets. The application profile configures them
-for its Node 22+ runtime contract and supplies catalog entries to the loader
+for its Node 22.13+ runtime contract and supplies catalog entries to the loader
 rule:
 
 ```js
@@ -331,6 +331,25 @@ false-positive rate, relevant to any repo touching SQL). The two architectural
 rules are **`strict`-only**, since they need per-repo configuration to say
 anything useful.
 
+`no-generic-single-export-module` warns when a `utils`, `helpers`, `common`,
+`constants`, or similarly generic module has one runtime export that already
+provides a precise filename. Ambiguous re-exports, type-only modules,
+conventional framework filenames, tests, generated files, and CommonJS modules
+are excluded. It is warning-first while corpus evidence accumulates.
+
+`stepdown` is likewise warning-first: measured adoption is intentionally broad,
+so it only owns ordering within a private-method band. The strict preset gives
+public/protected/private band ordering to `@typescript-eslint/member-ordering`
+and disables `perfectionist/sort-classes`, avoiding contradictory owners. The
+rule resolves module helpers, private methods, recursion and cycles, but leaves
+function-valued private fields and mutable receiver aliases alone.
+
+`no-positional-tuple-return` now rejects every fixed multi-field tuple on an
+exported TypeScript boundary—including homogeneous, labelled, tagged, readonly,
+hook-style, interface, function-type, declaration and abstract-method returns.
+The runtime alternative is a named object. Private/local implementation helpers
+and sequence-shaped arrays remain outside the public-boundary rule.
+
 ## Ported from `sarj_python_lint`
 
 Several rules are ports of the Python linter's SARJ rules, retuned for TypeScript. The false-positive tuning documented in the Python docstrings is ported with them — that tuning is the valuable part.
@@ -343,13 +362,14 @@ Several rules are ports of the Python linter's SARJ rules, retuned for TypeScrip
 | `no-select-star` | SARJ021 | An implicit row contract that changes silently when a column is added or reordered. |
 | `no-offset-pagination` | SARJ025 | O(N)-per-page scans, and rows repeated or skipped when the offset window shifts under concurrent inserts. |
 | `no-repeated-string-literal` | SARJ024 | Copies of a structured literal (SQL, column lists, prompt templates) drifting apart when only one is edited. |
-| `no-positional-tuple-return` | SARJ026 | Call sites re-inventing — and disagreeing on — the field names of a positional tuple return. |
+| `no-positional-tuple-return` | SARJ026 | Public APIs exposing multi-field tuples—even labelled or hook-style tuples—instead of named objects. |
 | `no-sleep-in-test-body` | SARJ031 | Tests that assert on wall-clock time and flake under CI load. |
 | `no-fat-try-blocks` | SARJ007 | Over-broad `catch` handlers swallowing unrelated failures. |
 | `no-cors-wildcard-with-credentials` | SARJ008 | Credentialed cross-origin requests from any origin. |
 | `single-public-export` | SARJ022 | Modules with no single obvious entry point. |
+| `stepdown` | SARJ023 | A private helper placed above its only direct same-scope caller. Indirect references, callbacks, cycles, overloads, and multi-caller helpers are excluded. |
 | `prefer-string-literal-union` | SARJ006 | An open `string` where a closed set is intended. |
 
 Shared helpers live in `src/rules/_*.ts` (`_secret-names.ts`, `_sql.ts`, `_logging.ts`, `_paths.ts`, `_tailwind.ts`) so related rules cannot diverge on what counts as a secret, a SQL statement, a logging call, or a test file.
 
-Deliberately **not** ported: `no-unreachable-after-terminal` (SARJ010) is already covered by `allowUnreachableCode: false` in `@sarj/tsconfig` plus ESLint core `no-unreachable`; `no-aggregation-in-store-query` (SARJ020) assumes a Postgres-OLTP / columnar-mirror split that D1 does not have; `no-query-with-many-joins` (SARJ019), `stepdown` (SARJ023), `prefer-class-row`, `prefer-struct-over-namedtuple`, `prefer-timedelta-for-durations`, and `no-fstring-in-log` have no TypeScript defect class or target API; `prefer-str-enum` is covered by `prefer-string-literal-union` + `no-enum`.
+Deliberately **not** ported: `no-unreachable-after-terminal` (SARJ010) is already covered by `allowUnreachableCode: false` in `@sarj/tsconfig` plus ESLint core `no-unreachable`; `no-aggregation-in-store-query` (SARJ020) assumes a Postgres-OLTP / columnar-mirror split that D1 does not have; `no-query-with-many-joins` (SARJ019), `prefer-class-row`, `prefer-struct-over-namedtuple`, `prefer-timedelta-for-durations`, and `no-fstring-in-log` have no TypeScript defect class or target API; `prefer-str-enum` is covered by `prefer-string-literal-union` + `no-enum`.