eslint-plugin-no-mistakes 0.75.0 → 0.76.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-no-mistakes",
-  "version": "0.75.0",
+  "version": "0.76.1",
   "description": "ESLint and Oxlint rules that keep code static enough for no-mistakes analyzers and coding agents",
   "license": "MIT",
   "repository": {

package/src/rules/postgres-cursor-call-contract.js

@@ -94,6 +94,18 @@ module.exports = rule(
           includeFiles: { type: "array", items: { type: "string" } },
           annotation: { type: "string" },
           sqlTagModules: { type: "array", items: { type: "string" } },
+          trustedSqlTags: {
+            type: "array",
+            items: {
+              type: "object",
+              additionalProperties: false,
+              required: ["module", "name"],
+              properties: {
+                module: { type: "string" },
+                name: { type: "string" },
+              },
+            },
+          },
         },
       },
     ],

package/src/rules/postgres-cursor-options.js

@@ -34,6 +34,27 @@ function optionalStringArray(value, present) {
   return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : null;
 }
 
+function trustedSqlTagEntry(entry) {
+  return (
+    entry !== null &&
+    typeof entry === "object" &&
+    !Array.isArray(entry) &&
+    typeof entry.module === "string" &&
+    typeof entry.name === "string"
+  );
+}
+
+function parseTrustedSqlTags(value, present) {
+  if (!present) return undefined;
+  if (!Array.isArray(value)) return null;
+  const tags = [];
+  for (const entry of value) {
+    if (!trustedSqlTagEntry(entry)) return null;
+    tags.push({ module: entry.module, name: entry.name });
+  }
+  return tags;
+}
+
 function resolveCursorContractOptions(raw) {
   if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
   const modules = stringArray(raw.modules);
@@ -44,7 +65,14 @@ function resolveCursorContractOptions(raw) {
   const exclude = optionalStringArray(raw.exclude, raw.exclude !== undefined);
   const includeFiles = optionalStringArray(raw.includeFiles, raw.includeFiles !== undefined);
   const sqlTagModules = optionalStringArray(raw.sqlTagModules, raw.sqlTagModules !== undefined);
-  if (include === null || exclude === null || includeFiles === null || sqlTagModules === null) {
+  const trustedSqlTags = parseTrustedSqlTags(raw.trustedSqlTags, raw.trustedSqlTags !== undefined);
+  if (
+    include === null ||
+    exclude === null ||
+    includeFiles === null ||
+    sqlTagModules === null ||
+    trustedSqlTags === null
+  ) {
     return null;
   }
   let annotation;
@@ -64,6 +92,7 @@ function resolveCursorContractOptions(raw) {
     exclude: exclude ?? [],
     includeFiles: (includeFiles ?? []).map((file) => file.replace(/^(?:\.\/)+/, "")),
     sqlTagModules: new Set(sqlTagModules ?? DEFAULT_SQL_TAG_MODULES),
+    trustedSqlTags: trustedSqlTags ?? [],
     annotation,
   };
 }

package/src/rules/postgres-cursor-query.js

@@ -38,6 +38,37 @@ function firstQuasiText(template, allowRaw) {
   return quasi.value?.cooked ?? (allowRaw ? (quasi.value?.raw ?? null) : null);
 }
 
+function importedBindingName(specifier) {
+  const imported = specifier?.imported;
+  if (!imported) return null;
+  return imported.type === "Literal" ? String(imported.value) : imported.name;
+}
+
+// Named opt-in only. An empty module must not match every import.
+function matchesTrustedSqlTag(source, imported, tag) {
+  if (!tag.module || !tag.name || tag.name !== imported) return false;
+  return source === tag.module || String(source).startsWith(`${tag.module}/`);
+}
+
+function trustedNamedSqlImport(specifier, declaration, source, config) {
+  if (specifier?.type !== "ImportSpecifier") return false;
+  if (specifier.importKind === "type" || declaration?.importKind === "type") return false;
+  if (declaration?.type !== "ImportDeclaration" || typeof source !== "string") return false;
+  const imported = importedBindingName(specifier);
+  return (config.trustedSqlTags ?? []).some((tag) => matchesTrustedSqlTag(source, imported, tag));
+}
+
+function defaultSqlTagImport(specifier, declaration, source, config) {
+  return (
+    specifier.type === "ImportDefaultSpecifier" &&
+    specifier.importKind !== "type" &&
+    declaration?.type === "ImportDeclaration" &&
+    declaration.importKind !== "type" &&
+    typeof source === "string" &&
+    config.sqlTagModules.has(source)
+  );
+}
+
 function exactSqlTag(context, tag, helpers, config) {
   const identifier = helpers.unwrap(tag);
   if (identifier?.type !== "Identifier") return false;
@@ -46,14 +77,10 @@ function exactSqlTag(context, tag, helpers, config) {
     const specifier = candidate.node;
     const declaration = candidate.parent || specifier.parent;
     const source = declaration?.source?.value;
+    if (candidate.type !== "ImportBinding") return false;
     return (
-      candidate.type === "ImportBinding" &&
-      specifier.type === "ImportDefaultSpecifier" &&
-      specifier.importKind !== "type" &&
-      declaration?.type === "ImportDeclaration" &&
-      declaration.importKind !== "type" &&
-      typeof source === "string" &&
-      config.sqlTagModules.has(source)
+      trustedNamedSqlImport(specifier, declaration, source, config) ||
+      defaultSqlTagImport(specifier, declaration, source, config)
     );
   });
   return Boolean(

package/src/rules/postgres-executor.js

@@ -21,6 +21,7 @@ function executorOptionDefaults(options = {}) {
     executorNames: options.executorNames ?? (options.importSpecifier ? DEFAULT_EXECUTOR_NAMES : []),
     executorFactoryNames: options.executorFactoryNames ?? [],
     executorTypeNames: options.executorTypeNames ?? [],
+    trustedSqlTags: options.trustedSqlTags ?? [],
     owners: options.owners ?? [],
     chunkFunctionNames: options.chunkFunctionNames ?? DEFAULT_CHUNK_FUNCTION_NAMES,
   };
@@ -34,6 +35,18 @@ function executorOptionSchema(extraProperties = {}) {
       executorNames: { type: "array", items: { type: "string" } },
       executorFactoryNames: { type: "array", items: { type: "string" } },
       executorTypeNames: { type: "array", items: { type: "string" } },
+      trustedSqlTags: {
+        type: "array",
+        items: {
+          type: "object",
+          additionalProperties: false,
+          required: ["module", "name"],
+          properties: {
+            module: { type: "string" },
+            name: { type: "string" },
+          },
+        },
+      },
       ...extraProperties,
     },
     additionalProperties: false,
@@ -46,11 +59,11 @@ function importedName(specifier) {
   return imported.type === "Literal" ? String(imported.value) : imported.name;
 }
 
-function executorBindings(program, options = {}) {
+function executorBindings(program, options = {}, filename) {
   const bindings = new Set();
   const defaults = executorOptionDefaults(options);
   const { importSpecifier, executorNames } = defaults;
-  bindings.scoped = collectScopedExecutors(program, defaults);
+  bindings.scoped = collectScopedExecutors(program, defaults, filename);
   bindings.queryMembers = Boolean(importSpecifier) || executorNames.includes(QUERY_PROPERTY);
   for (const statement of program?.body ?? []) {
     if (statement.type !== "ImportDeclaration") continue;

package/src/rules/postgres-no-manual-transaction.js

@@ -41,7 +41,7 @@ module.exports = Object.assign(
 
       return {
         Program(node) {
-          bindings = executorBindings(node, options);
+          bindings = executorBindings(node, options, context.filename);
           statements = sqlStatementBindings(node);
         },
         CallExpression(node) {

package/src/rules/postgres-no-unbounded-query-fanout.js

@@ -37,7 +37,7 @@ module.exports = Object.assign(
 
       return {
         Program(node) {
-          bindings = executorBindings(node, options);
+          bindings = executorBindings(node, options, context.filename);
         },
         CallExpression(node) {
           if (!isPromiseAllCallee(node.callee)) return;

package/src/rules/postgres-scoped-executors.js

@@ -1,7 +1,11 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
 const { childNodes, unwrapTs } = require("./postgres-query-text");
 
+const RELATIVE_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".mjs", ".cjs", ".jsx"];
+
 const FUNCTION_TYPES = new Set([
   "FunctionDeclaration",
   "FunctionExpression",
@@ -25,14 +29,102 @@ function fromConfiguredModule(source, specifier) {
   return !specifier || source === specifier || String(source).startsWith(`${specifier}/`);
 }
 
+function packageName(specifier) {
+  if (
+    typeof specifier !== "string" ||
+    specifier === "" ||
+    specifier.startsWith(".") ||
+    specifier.startsWith("/")
+  ) {
+    return null;
+  }
+  if (specifier.startsWith("@")) {
+    const slash = specifier.indexOf("/");
+    if (slash <= 1) return null;
+    const rest = specifier.slice(slash + 1);
+    const name = rest.split("/")[0];
+    if (!name) return null;
+    return specifier.slice(0, slash + 1 + name.length);
+  }
+  const name = specifier.split("/")[0];
+  return name || null;
+}
+
+function isRelativeSpecifier(source) {
+  return (
+    source === "." ||
+    source === ".." ||
+    (typeof source === "string" && (source.startsWith("./") || source.startsWith("../")))
+  );
+}
+
+function readPackageName(dir) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+    return typeof parsed.name === "string" ? parsed.name : null;
+  } catch {
+    return null;
+  }
+}
+
+// Walk up from the linted file. A missing or unreadable root fails closed.
+function packageRoot(filename, specifier) {
+  const name = packageName(specifier);
+  if (!name || typeof filename !== "string" || filename === "") return null;
+  let dir = path.dirname(path.resolve(filename));
+  const stop = path.parse(dir).root;
+  while (dir) {
+    if (readPackageName(dir) === name) return dir;
+    const nested = path.join(dir, "node_modules", ...name.split("/"));
+    if (readPackageName(nested) === name) return nested;
+    if (dir === stop) return null;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+
+function resolveRelativeFile(filename, specifier) {
+  if (typeof filename !== "string" || typeof specifier !== "string") return null;
+  const base = path.resolve(path.dirname(path.resolve(filename)), specifier);
+  const candidates = [base];
+  for (const extension of RELATIVE_EXTENSIONS) candidates.push(`${base}${extension}`);
+  for (const extension of RELATIVE_EXTENSIONS) {
+    candidates.push(path.join(base, `index${extension}`));
+  }
+  for (const candidate of candidates) {
+    try {
+      if (fs.statSync(candidate).isFile()) return candidate;
+    } catch {
+      // Missing paths and unreadable entries fail closed.
+    }
+  }
+  return null;
+}
+
+function fileInsidePackage(file, root) {
+  const relative = path.relative(root, file);
+  return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+
+function matchesConfiguredModule(source, specifier, filename) {
+  if (fromConfiguredModule(source, specifier)) return true;
+  if (!specifier || !isRelativeSpecifier(source)) return false;
+  const root = packageRoot(filename, specifier);
+  if (!root) return false;
+  const resolved = resolveRelativeFile(filename, source);
+  return resolved !== null && fileInsidePackage(resolved, root);
+}
+
 // Local names of configured factory (value) and type imports, by module.
-function scopedImports(program, options) {
+function scopedImports(program, options, filename) {
   const factories = new Set();
   const types = new Set();
   const { importSpecifier, executorFactoryNames, executorTypeNames } = options;
   for (const statement of program?.body ?? []) {
     if (statement.type !== "ImportDeclaration") continue;
-    if (!fromConfiguredModule(statement.source?.value, importSpecifier)) continue;
+    if (!matchesConfiguredModule(statement.source?.value, importSpecifier, filename)) continue;
     for (const specifier of statement.specifiers ?? []) {
       if (specifier.type !== "ImportSpecifier") continue;
       const imported = importedName(specifier);
@@ -94,9 +186,9 @@ function parameterNames(param, types) {
  * configured factory call (the declaring block) and parameters typed with a
  * configured type (the declaring function). Returns `{ name, range }` entries.
  */
-function collectScopedExecutors(program, options) {
+function collectScopedExecutors(program, options, filename) {
   const found = [];
-  const { factories, types } = scopedImports(program, options);
+  const { factories, types } = scopedImports(program, options, filename);
   if (factories.size === 0 && types.size === 0) return found;
   const walk = (node, scope) => {
     if (SCOPE_TYPES.has(node.type)) scope = node;