@sarj/eslint-plugin 9.7.0 → 9.8.0

package/README.md

@@ -12,11 +12,47 @@ import sarj from "@sarj/eslint-plugin";
 export default [...sarj.configs.recommended];
 ```
 
-55 rules. Each source under `src/rules/` states one concise claim and links to
+57 rules. Each source under `src/rules/` states one concise claim and links to
 its paired tests. The definition and named test cases are the complete rule
 specification, and `meta.docs.url` points directly to those executable examples.
 
-Presets: `recommended` (warn-first), `strict` (every shipped rule at its declared strict severity), `style-guide` (formatting/naming subset). The two-sentence comment rule warns; its three-sentence companion errors.
+Presets: `recommended` (warn-first), `strict` (every general-profile rule at its declared strict severity), `style-guide` (formatting/naming subset). Application-only rules are exported through `applicationOnlyRules` and configured by the application profile. The two-sentence comment rule warns; its three-sentence companion errors.
+
+## New in 9.8.0 — application library policy adapters
+
+`no-restricted-library-load` extends a configured dependency policy to runtime
+loading forms that ESLint's `no-restricted-imports` does not cover: literal
+`import()`, unshadowed `require()` / `require.resolve()`, and TypeScript
+`import x = require(...)`. It matches a package and all of its subpaths, but
+deliberately ignores computed names and shadowed local `require` functions.
+
+`prefer-native-random-uuid` reports resolved, zero-argument UUID v4 calls from
+the `uuid` package and suggests `globalThis.crypto.randomUUID()`. The suggestion
+changes only the call; import cleanup remains explicit. Other UUID versions,
+custom-randomness arguments, re-exports, and function references are untouched.
+
+Neither rule is in the general presets. The application profile configures them
+for its Node 22+ runtime contract and supplies catalog entries to the loader
+rule:
+
+```js
+rules: {
+  "@sarj/no-restricted-library-load": [
+    "error",
+    {
+      libraries: [
+        {
+          id: "LIB101",
+          module: "axios",
+          replacement: "Ky",
+          note: "The APIs are not drop-in equivalents.",
+        },
+      ],
+    },
+  ],
+  "@sarj/prefer-native-random-uuid": "error",
+}
+```
 
 ## Renamed in 7.0.0, aliases deleted in 9.0.0 (breaking)
 
@@ -138,7 +174,7 @@ Both distilled from two years of PR-review comments across ~1,065 PRs.
 | `prefer-zod-infer` | An `interface`/`type` that restates a Zod schema declared in the same module instead of deriving it with `z.infer`. Options: `ignoreTypeNames`, `requireIdenticalShape` (default `true`). | warn / error |
 | `prefer-module-level-constant` | A literal-only `const` collection (array, object, `Set`, `Map`, `Object.freeze`) or non-global regex declared inside a function body, never mutated and never escaping — hoist it to module scope. Options: `minElements` (default 3), `checkRegex`, `ignoreTestFiles`. | warn / error |
 | `prefer-module-level-schema` | A Zod schema built inside a function body that closes over nothing the function owns — hoist it to module scope instead of rebuilding it per call, per request, per render. Silent when it references a parameter, local, type parameter, local type, or `this` (that is a schema FACTORY), when it is already memoized, and inside `z.lazy`. Options: `factories` (default: the object-like composites), `minProperties` (default 1), `ignoreTestFiles`. | warn / error |
-| `prefer-non-nullable-collection` | An array type explicitly combined with `null`/`undefined`, creating two equivalent empty states. | warn / error |
+| `prefer-non-nullable-collection` | A required array property or direct alias explicitly combined with `null`/`undefined`, creating two equivalent empty states. Optional API fields are excluded because omission can be meaningful. | warn / error |
 
 ## Options