eslint-plugin-kerfjs 4.1.1 → 4.2.0-beta.2

package/docs/rules/no-raw-with-dynamic-arg.md

@@ -35,6 +35,10 @@ Sanitization pipelines (`DOMPurify`, `sanitize-html`, server-rendered trusted co
 - Bare `raw(expr)` calls
 - Member-expression calls `kerf.raw(expr)` and `kerfjs.raw(expr)`
 
+## The blessed escape hatch: `trustedRaw()`
+
+When a dynamic value is genuinely server-trusted — a CSRF token, a trusted `<script src>`, a server-issued id — use `trustedRaw()` (exported from `kerfjs`) instead of `raw()`. It is identical at runtime but is **not** named `raw`, so this rule leaves it alone. That replaces scattered `eslint-disable` comments with one intention-revealing call. `trustedRaw()` is not a sanitizer — only pass values you control, never raw user input.
+
 ## What this rule does NOT catch
 
 - `raw()` calls where the binding was renamed via a local alias (`const inject = raw; inject(expr)`)

package/docs/rules/prefer-attr-selector.md

@@ -41,6 +41,7 @@ These are intentionally left alone because `attr()` isn't a 1:1 swap for them:
 - Tag-qualified attribute selectors: `'button[data-action="x"]'`.
 - Compound attribute selectors: `'[data-action="x"][data-id="y"]'` — for these, concatenate two `.selector` strings (`A.selector + B.selector`) or use `attr()` only for one of the legs.
 - Selectors held in variables (not string literals) — already abstracted.
+- `kerfjs/actions`: `delegateActions(root, event, table, opts?)` — its 3rd argument is a handler **table** (an object), not a selector, so it is never flagged. The blessed `action('x')` / `attr('data-action','x')` forms pass `.selector` (a member expression, not a literal), which this rule already leaves alone.
 
 ## Severity
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-kerfjs",
-  "version": "4.1.1",
+  "version": "4.2.0-beta.2",
   "description": "ESLint rules that enforce kerf's hard rules — catches AI-shaped bugs at edit time.",
   "type": "module",
   "license": "MIT",