eslint-plugin-no-mistakes 0.76.0 → 0.77.0

package/README.md

@@ -9,4 +9,28 @@ callers, fetches, or selectors behind aliases and dynamic values. See
 npm install --save-dev eslint-plugin-no-mistakes
 ```
 
-See the [ESLint rule index](../../docs/eslint-rules/README.md).
+Configure the plugin in a flat config and scope rules with `files` globs. For
+example, this checks test files for skipped or exclusive tests while allowing
+`todo`:
+
+```js
+import noMistakes from "eslint-plugin-no-mistakes";
+
+export default [
+  {
+    files: ["**/*.test.*", "tests/**"],
+    plugins: { "no-mistakes": noMistakes },
+    rules: { "no-mistakes/test-no-skips": ["error", { allow: ["todo"] }] },
+  },
+];
+```
+
+See [`test-no-skips`](../../docs/eslint-rules/test-no-skips.md) for the rule's
+behavior and configuration, and the [ESLint rule index](../../docs/eslint-rules/README.md)
+for the complete list.
+
+To cap long Vitest timeouts, enable `no-mistakes/vitest-timeout-cap` in the
+test and Vitest config files selected by your flat-config globs. It defaults to
+5,000 ms for configured test and hook timeouts and 30,000 ms for per-test and
+hook overrides. See the [rule documentation](../../docs/eslint-rules/vitest-timeout-cap.md)
+for options and examples.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-no-mistakes",
-  "version": "0.76.0",
+  "version": "0.77.0",
   "description": "ESLint and Oxlint rules that keep code static enough for no-mistakes analyzers and coding agents",
   "license": "MIT",
   "repository": {

package/src/index.js

@@ -40,11 +40,13 @@ const rules = {
   "server-require-nullable-fetch-wrapper": require("./rules/server-require-nullable-fetch-wrapper"),
   "test-no-error-message-matching": require("./rules/test-no-error-message-matching"),
   "test-no-delayed-rejects": require("./rules/test-no-delayed-rejects"),
+  "test-no-skips": require("./rules/test-no-skips"),
   "test-no-shared-state": require("./rules/test-no-shared-state"),
   "ts-no-const-aliases": require("./rules/ts-no-const-aliases"),
   "ts-no-export-renaming": require("./rules/ts-no-export-renaming"),
   "ts-no-function-aliases": require("./rules/ts-no-function-aliases"),
   "ts-preserve-null-option-defaults": require("./rules/ts-preserve-null-option-defaults"),
+  "vitest-timeout-cap": require("./rules/vitest-timeout-cap"),
   "vitest-mock-test-file-naming": require("./rules/vitest-mock-test-file-naming"),
 };
 

package/src/rule-suppression.js

@@ -0,0 +1,32 @@
+"use strict";
+
+// Parse actual comments once; directive-looking string literals never suppress.
+function ruleSuppression(context, ruleId) {
+  const lines = new Set();
+  let file = false;
+  const source = context.sourceCode;
+  const first = source.ast.tokens[0];
+  for (const comment of source.getAllComments()) {
+    for (const [offset, text] of comment.value.split(/\r?\n/).entries()) {
+      const match = /^\s*\*?\s*no-mistakes-disable-(file|line|next-line)\b(.*)$/.exec(text);
+      if (!match) continue;
+      const names = match[2]
+        .split("--")[0]
+        .trim()
+        .split(/[\s,]+/)
+        .filter(Boolean);
+      if (
+        names.length &&
+        !names.some((name) => name === ruleId || name === `no-mistakes/${ruleId}`)
+      )
+        continue;
+      if (match[1] === "file") {
+        if (!first || comment.range[1] <= first.range[0]) file = true;
+      } else {
+        lines.add(comment.loc.start.line + offset + (match[1] === "next-line" ? 1 : 0));
+      }
+    }
+  }
+  return (node) => file || lines.has(node.loc.start.line);
+}
+module.exports = { ruleSuppression };

package/src/rules/postgres-executor.js

@@ -59,11 +59,11 @@ function importedName(specifier) {
   return imported.type === "Literal" ? String(imported.value) : imported.name;
 }
 
-function executorBindings(program, options = {}) {
+function executorBindings(program, options = {}, filename) {
   const bindings = new Set();
   const defaults = executorOptionDefaults(options);
   const { importSpecifier, executorNames } = defaults;
-  bindings.scoped = collectScopedExecutors(program, defaults);
+  bindings.scoped = collectScopedExecutors(program, defaults, filename);
   bindings.queryMembers = Boolean(importSpecifier) || executorNames.includes(QUERY_PROPERTY);
   for (const statement of program?.body ?? []) {
     if (statement.type !== "ImportDeclaration") continue;

package/src/rules/postgres-no-manual-transaction.js

@@ -41,7 +41,7 @@ module.exports = Object.assign(
 
       return {
         Program(node) {
-          bindings = executorBindings(node, options);
+          bindings = executorBindings(node, options, context.filename);
           statements = sqlStatementBindings(node);
         },
         CallExpression(node) {

package/src/rules/postgres-no-unbounded-query-fanout.js

@@ -37,7 +37,7 @@ module.exports = Object.assign(
 
       return {
         Program(node) {
-          bindings = executorBindings(node, options);
+          bindings = executorBindings(node, options, context.filename);
         },
         CallExpression(node) {
           if (!isPromiseAllCallee(node.callee)) return;

package/src/rules/postgres-scoped-executors.js

@@ -1,7 +1,11 @@
 "use strict";
 
+const fs = require("node:fs");
+const path = require("node:path");
 const { childNodes, unwrapTs } = require("./postgres-query-text");
 
+const RELATIVE_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".mjs", ".cjs", ".jsx"];
+
 const FUNCTION_TYPES = new Set([
   "FunctionDeclaration",
   "FunctionExpression",
@@ -25,14 +29,102 @@ function fromConfiguredModule(source, specifier) {
   return !specifier || source === specifier || String(source).startsWith(`${specifier}/`);
 }
 
+function packageName(specifier) {
+  if (
+    typeof specifier !== "string" ||
+    specifier === "" ||
+    specifier.startsWith(".") ||
+    specifier.startsWith("/")
+  ) {
+    return null;
+  }
+  if (specifier.startsWith("@")) {
+    const slash = specifier.indexOf("/");
+    if (slash <= 1) return null;
+    const rest = specifier.slice(slash + 1);
+    const name = rest.split("/")[0];
+    if (!name) return null;
+    return specifier.slice(0, slash + 1 + name.length);
+  }
+  const name = specifier.split("/")[0];
+  return name || null;
+}
+
+function isRelativeSpecifier(source) {
+  return (
+    source === "." ||
+    source === ".." ||
+    (typeof source === "string" && (source.startsWith("./") || source.startsWith("../")))
+  );
+}
+
+function readPackageName(dir) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+    return typeof parsed.name === "string" ? parsed.name : null;
+  } catch {
+    return null;
+  }
+}
+
+// Walk up from the linted file. A missing or unreadable root fails closed.
+function packageRoot(filename, specifier) {
+  const name = packageName(specifier);
+  if (!name || typeof filename !== "string" || filename === "") return null;
+  let dir = path.dirname(path.resolve(filename));
+  const stop = path.parse(dir).root;
+  while (dir) {
+    if (readPackageName(dir) === name) return dir;
+    const nested = path.join(dir, "node_modules", ...name.split("/"));
+    if (readPackageName(nested) === name) return nested;
+    if (dir === stop) return null;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+
+function resolveRelativeFile(filename, specifier) {
+  if (typeof filename !== "string" || typeof specifier !== "string") return null;
+  const base = path.resolve(path.dirname(path.resolve(filename)), specifier);
+  const candidates = [base];
+  for (const extension of RELATIVE_EXTENSIONS) candidates.push(`${base}${extension}`);
+  for (const extension of RELATIVE_EXTENSIONS) {
+    candidates.push(path.join(base, `index${extension}`));
+  }
+  for (const candidate of candidates) {
+    try {
+      if (fs.statSync(candidate).isFile()) return candidate;
+    } catch {
+      // Missing paths and unreadable entries fail closed.
+    }
+  }
+  return null;
+}
+
+function fileInsidePackage(file, root) {
+  const relative = path.relative(root, file);
+  return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+
+function matchesConfiguredModule(source, specifier, filename) {
+  if (fromConfiguredModule(source, specifier)) return true;
+  if (!specifier || !isRelativeSpecifier(source)) return false;
+  const root = packageRoot(filename, specifier);
+  if (!root) return false;
+  const resolved = resolveRelativeFile(filename, source);
+  return resolved !== null && fileInsidePackage(resolved, root);
+}
+
 // Local names of configured factory (value) and type imports, by module.
-function scopedImports(program, options) {
+function scopedImports(program, options, filename) {
   const factories = new Set();
   const types = new Set();
   const { importSpecifier, executorFactoryNames, executorTypeNames } = options;
   for (const statement of program?.body ?? []) {
     if (statement.type !== "ImportDeclaration") continue;
-    if (!fromConfiguredModule(statement.source?.value, importSpecifier)) continue;
+    if (!matchesConfiguredModule(statement.source?.value, importSpecifier, filename)) continue;
     for (const specifier of statement.specifiers ?? []) {
       if (specifier.type !== "ImportSpecifier") continue;
       const imported = importedName(specifier);
@@ -94,9 +186,9 @@ function parameterNames(param, types) {
  * configured factory call (the declaring block) and parameters typed with a
  * configured type (the declaring function). Returns `{ name, range }` entries.
  */
-function collectScopedExecutors(program, options) {
+function collectScopedExecutors(program, options, filename) {
   const found = [];
-  const { factories, types } = scopedImports(program, options);
+  const { factories, types } = scopedImports(program, options, filename);
   if (factories.size === 0 && types.size === 0) return found;
   const walk = (node, scope) => {
     if (SCOPE_TYPES.has(node.type)) scope = node;

package/src/rules/test-no-skips-bindings.js

@@ -0,0 +1,71 @@
+"use strict";
+const { resolveVariable } = require("./test-no-shared-state-aliases");
+const { importSpecifierName } = require("./test-no-shared-state-callees");
+const { unwrapExpression, isFunction } = require("./async-ast");
+const NAMES = new Set(["it", "test", "describe"]);
+const MODULES = new Set(["vitest", "@playwright/test"]);
+const CHAIN = new Set(
+  "skip skipIf runIf only todo fixme each for concurrent sequential fails fail serial parallel describe".split(
+    " ",
+  ),
+);
+function memberName(node) {
+  return node.computed
+    ? node.property.type === "Literal" && typeof node.property.value === "string"
+      ? node.property.value
+      : null
+    : node.property.name;
+}
+function imported(node, context, namespace = false) {
+  const variable = resolveVariable(node, context);
+  for (const def of variable?.defs || []) {
+    if (def.type !== "ImportBinding" || !MODULES.has(def.parent.source.value)) continue;
+    if (namespace) {
+      if (def.node.type === "ImportNamespaceSpecifier") return def.parent.source.value;
+    } else {
+      const name = importSpecifierName(def.node);
+      if (NAMES.has(name)) return { framework: def.parent.source.value, name };
+    }
+  }
+  // Unbound runner globals are considered only in files selected by lint config.
+  if (!namespace && !variable?.defs.length && NAMES.has(node.name))
+    return { framework: "vitest", name: node.name };
+  return null;
+}
+function testBinding(node, context) {
+  node = unwrapExpression(node);
+  if (node.type === "Identifier") return imported(node, context);
+  if (node.type === "CallExpression") return testBinding(node.callee, context);
+  if (node.type === "TaggedTemplateExpression") return testBinding(node.tag, context);
+  if (node.type !== "MemberExpression") return null;
+  const name = memberName(node);
+  if (NAMES.has(name) && node.object.type === "Identifier") {
+    const framework = imported(node.object, context, true);
+    if (framework) return { framework, name };
+  }
+  if (!CHAIN.has(name)) return null;
+  const binding = testBinding(node.object, context);
+  if (!binding) return null;
+  if (name === "each" || name === "for") return { ...binding, table: name };
+  return name === "describe" ? { ...binding, name } : binding;
+}
+function isContextSkip(node, context) {
+  const object = unwrapExpression(node.object);
+  if (object.type !== "Identifier") return false;
+  const variable = resolveVariable(object, context);
+  for (const def of variable?.defs || []) {
+    const callback = def.node;
+    if (def.type !== "Parameter" || !isFunction(callback)) continue;
+    const call = callback.parent;
+    if (call.type !== "CallExpression" || !call.arguments.includes(callback)) continue;
+    const binding = testBinding(call.callee, context);
+    if (binding?.framework !== "vitest" || binding.name === "describe" || binding.table === "each")
+      continue;
+    // each supplies table values; for preserves its second parameter as TestContext.
+    const parameter = callback.params[binding.table === "for" ? 1 : 0];
+    if (parameter?.type === "Identifier" && resolveVariable(parameter, context) === variable)
+      return true;
+  }
+  return false;
+}
+module.exports = { memberName, testBinding, isContextSkip };

package/src/rules/test-no-skips.js

@@ -0,0 +1,45 @@
+"use strict";
+const { rule, options } = require("../helpers");
+const { memberName, testBinding, isContextSkip } = require("./test-no-skips-bindings");
+const { ruleSuppression } = require("../rule-suppression");
+const MODIFIERS = ["skip", "skipIf", "runIf", "only", "todo", "fixme"];
+module.exports = rule(
+  {
+    type: "problem",
+    docs: {
+      description: "reject skipped, conditional, pending, and focused tests",
+      recommended: false,
+    },
+    schema: [
+      {
+        type: "object",
+        properties: { allow: { type: "array", items: { enum: MODIFIERS }, uniqueItems: true } },
+        additionalProperties: false,
+      },
+    ],
+    messages: {
+      modifier:
+        "Test modifier '{{modifier}}' can remove CI coverage. Run the complete test and provide its required environment, or explicitly allow this modifier.",
+    },
+  },
+  (context) => {
+    const suppressed = ruleSuppression(context, "test-no-skips");
+    const banned = new Set(
+      MODIFIERS.filter((name) => !(options(context).allow || []).includes(name)),
+    );
+    return {
+      MemberExpression(node) {
+        const modifier = memberName(node);
+        if (!banned.has(modifier) || suppressed(node.property)) return;
+        const test = testBinding(node.object, context);
+        const contextCall =
+          modifier === "skip" &&
+          node.parent.type === "CallExpression" &&
+          node.parent.callee === node &&
+          isContextSkip(node, context);
+        if (!test && !contextCall) return;
+        context.report({ node: node.property, messageId: "modifier", data: { modifier } });
+      },
+    };
+  },
+);

package/src/rules/vitest-timeout-bindings.js

@@ -0,0 +1,55 @@
+"use strict";
+const { resolveVariable } = require("./test-no-shared-state-aliases");
+const { importSpecifierName } = require("./test-no-shared-state-callees");
+const { memberName, testBinding } = require("./test-no-skips-bindings");
+const { unwrapExpression } = require("./async-ast");
+const HOOKS = new Set(["beforeAll", "beforeEach", "afterAll", "afterEach"]);
+const CONFIG = new Set(["defineConfig", "defineProject", "mergeConfig"]);
+function bindingName(node, context, modules, names) {
+  node = unwrapExpression(node);
+  if (node.type === "MemberExpression" && node.object.type === "Identifier") {
+    const variable = resolveVariable(node.object, context);
+    const name = memberName(node);
+    return names.has(name) &&
+      variable?.defs.some(
+        (def) =>
+          def.type === "ImportBinding" &&
+          modules.has(def.parent.source.value) &&
+          def.node.type === "ImportNamespaceSpecifier",
+      )
+      ? name
+      : null;
+  }
+  if (node.type !== "Identifier") return null;
+  const variable = resolveVariable(node, context);
+  for (const def of variable?.defs || []) {
+    if (def.type === "ImportBinding" && modules.has(def.parent.source.value)) {
+      const name = importSpecifierName(def.node);
+      if (names.has(name)) return name;
+    }
+  }
+  if (modules.has("vitest") && !variable?.defs.length && names.has(node.name)) return node.name;
+  return null;
+}
+function configCall(node, context) {
+  return bindingName(node.callee, context, new Set(["vitest/config", "vite"]), CONFIG);
+}
+function overrideCall(node, context) {
+  const callee = unwrapExpression(node.callee);
+  if (
+    callee.type === "MemberExpression" &&
+    memberName(callee) === "setConfig" &&
+    bindingName(callee.object, context, new Set(["vitest"]), new Set(["vi"]))
+  )
+    return "runtime";
+  if (bindingName(callee, context, new Set(["vitest"]), HOOKS)) return "hook";
+  const test = testBinding(callee, context);
+  if (test?.framework !== "vitest") return null;
+  if (
+    callee.type === "MemberExpression" &&
+    new Set(["each", "for", "skipIf", "runIf"]).has(memberName(callee))
+  )
+    return null;
+  return "test";
+}
+module.exports = { configCall, overrideCall };

package/src/rules/vitest-timeout-cap.js

@@ -0,0 +1,126 @@
+"use strict";
+const { rule, options } = require("../helpers");
+const { isFunction } = require("./async-ast");
+const { ruleSuppression } = require("../rule-suppression");
+const { configCall, overrideCall } = require("./vitest-timeout-bindings");
+const { createEvaluator } = require("./vitest-timeout-values");
+module.exports = rule(
+  {
+    type: "problem",
+    docs: {
+      description: "cap Vitest project defaults and test/hook timeout overrides",
+      recommended: false,
+    },
+    schema: [
+      {
+        type: "object",
+        properties: {
+          defaultMax: { type: "number", minimum: 0, exclusiveMinimum: true },
+          overrideMax: { type: "number", minimum: 0, exclusiveMinimum: true },
+          unknownValues: { enum: ["ignore", "finding"] },
+        },
+        additionalProperties: false,
+      },
+    ],
+    messages: {
+      timeout:
+        "Vitest {{name}} exceeds {{max}} ms. Fix the slow wait or test setup rather than hiding hangs with a larger timeout.",
+      unknown:
+        "Vitest {{name}} cannot be statically resolved against the {{max}} ms cap. Use a same-module numeric constant or explicitly ignore unknown values.",
+    },
+  },
+  (context) => {
+    const option = options(context);
+    for (const name of ["defaultMax", "overrideMax"]) {
+      if (option[name] !== undefined && (!Number.isFinite(option[name]) || option[name] <= 0))
+        throw new Error(`vitest-timeout-cap ${name} must be a positive finite number`);
+    }
+    const suppressed = ruleSuppression(context, "vitest-timeout-cap");
+    const consumed = new Set();
+    const evaluate = createEvaluator(context, consumed);
+    const configs = [];
+    const overrides = [];
+    const exports = [];
+    function check(entry, name, max, origin) {
+      const node = origin || entry.origin;
+      if (suppressed(node)) return;
+      if (entry.value.kind === "number") {
+        if (entry.value.value > max)
+          context.report({ node, messageId: "timeout", data: { name, max } });
+      } else if (option.unknownValues === "finding")
+        context.report({ node, messageId: "unknown", data: { name, max } });
+    }
+    function properties(value, names, max, origin) {
+      if (value.kind !== "object") return;
+      for (const name of names) {
+        const entry = value.properties.get(name);
+        if (entry) check(entry, name, max, origin);
+      }
+    }
+    function defaults(value, project) {
+      if (value.kind !== "object") return;
+      const test = value.properties.get("test")?.value;
+      if (!test) return;
+      properties(test, ["testTimeout", "hookTimeout"], option.defaultMax ?? 5000, project);
+      const projects = test.kind === "object" ? test.properties.get("projects")?.value : null;
+      if (projects?.kind === "array")
+        for (const entry of projects.entries) defaults(entry.value, entry.origin);
+    }
+    return {
+      ExportDefaultDeclaration(node) {
+        exports.push(node.declaration);
+      },
+      CallExpression(node) {
+        if (configCall(node, context)) configs.push(node);
+        const kind = overrideCall(node, context);
+        if (kind) overrides.push({ node, kind });
+      },
+      "Program:exit"() {
+        // Evaluate exports and outer merges first so overwritten fragment values never report.
+        for (const node of exports) {
+          const count = consumed.size;
+          const value = evaluate(node);
+          if (consumed.size > count) defaults(value);
+        }
+        const roots = configs.filter(
+          (node) =>
+            !configs.some(
+              (other) =>
+                other !== node && other.range[0] < node.range[0] && other.range[1] > node.range[1],
+            ),
+        );
+        for (const node of roots.toReversed()) if (!consumed.has(node)) defaults(evaluate(node));
+        for (const { node, kind } of overrides) {
+          const max = option.overrideMax ?? 30000;
+          if (kind === "runtime") {
+            properties(
+              evaluate(node.arguments[0]),
+              ["testTimeout", "hookTimeout"],
+              max,
+              node.arguments[0]?.type === "Identifier" ? node.arguments[0] : undefined,
+            );
+            continue;
+          }
+          const args = kind === "hook" ? node.arguments.slice(1) : node.arguments.slice(1, 3);
+          for (const argument of args) {
+            const value = evaluate(argument);
+            if (value.kind === "object")
+              properties(
+                value,
+                ["timeout"],
+                max,
+                argument.type === "Identifier" ? argument : undefined,
+              );
+          }
+          const last = node.arguments.at(-1);
+          const minimum = kind === "hook" ? 2 : 3;
+          if (!last || node.arguments.length < minimum || isFunction(last)) continue;
+          // An options object followed by a callback is not a trailing timeout.
+          if (evaluate(node.arguments.at(-2)).kind === "object") continue;
+          const value = evaluate(last);
+          if (value.kind !== "object") check({ value, origin: last }, "timeout", max);
+        }
+      },
+    };
+  },
+);

package/src/rules/vitest-timeout-values.js

@@ -0,0 +1,148 @@
+"use strict";
+const { resolveVariable } = require("./test-no-shared-state-aliases");
+const { unwrapExpression } = require("./async-ast");
+const { configCall } = require("./vitest-timeout-bindings");
+const UNKNOWN = { kind: "unknown" };
+function taint(value) {
+  if (value.kind === "object")
+    return {
+      ...value,
+      properties: new Map(
+        [...value.properties].map(([name, entry]) => [
+          name,
+          { ...entry, value: taint(entry.value) },
+        ]),
+      ),
+    };
+  if (value.kind === "array")
+    return {
+      ...value,
+      entries: value.entries.map((entry) => ({ ...entry, value: taint(entry.value) })),
+    };
+  return UNKNOWN;
+}
+function merge(left, right) {
+  if (right.kind === "null") return left;
+  if (right.kind === "unknown") return taint(left);
+  if (left.kind !== "object" || right.kind !== "object") return right;
+  const properties = new Map((right.unknown ? taint(left) : left).properties);
+  for (const [name, entry] of right.properties) {
+    if (entry.value.kind === "null") continue;
+    const previous = properties.get(name);
+    let value = entry.value;
+    if (previous && value.kind === "unknown") value = taint(previous.value);
+    if (previous?.value.kind === "object" && value.kind === "object")
+      value = merge(previous.value, value);
+    if (previous?.value.kind === "array" && value.kind === "array")
+      value = { kind: "array", entries: [...previous.value.entries, ...value.entries] };
+    properties.set(name, { ...entry, value });
+  }
+  return { kind: "object", properties };
+}
+function createEvaluator(context, consumed) {
+  const evaluating = new Set();
+  const memo = new WeakMap();
+  function evaluate(node) {
+    if (!node) return UNKNOWN;
+    node = unwrapExpression(node);
+    if (memo.has(node)) return memo.get(node);
+    if (evaluating.has(node)) return UNKNOWN;
+    evaluating.add(node);
+    const value = resolve(node);
+    evaluating.delete(node);
+    memo.set(node, value);
+    return value;
+  }
+  function resolve(node) {
+    if (node.type === "Literal" && node.value === null) return { kind: "null" };
+    if (node.type === "Literal")
+      return typeof node.value === "number" ? { kind: "number", value: node.value } : UNKNOWN;
+    if (node.type === "UnaryExpression" && (node.operator === "-" || node.operator === "+")) {
+      const value = evaluate(node.argument);
+      return value.kind === "number"
+        ? { kind: "number", value: node.operator === "-" ? -value.value : value.value }
+        : UNKNOWN;
+    }
+    if (node.type === "Identifier") {
+      const variable = resolveVariable(node, context);
+      const def = variable?.defs[0];
+      // Only module constants: function-local assignments must not become config defaults.
+      return def?.type === "Variable" &&
+        def.parent.kind === "const" &&
+        variable.scope.type === "module"
+        ? evaluate(def.node.init)
+        : UNKNOWN;
+    }
+    if (node.type === "ObjectExpression") {
+      const properties = new Map();
+      let unknown = false;
+      for (const property of node.properties) {
+        if (property.type === "SpreadElement") {
+          const spread = evaluate(property.argument);
+          if (spread.kind === "object") {
+            if (spread.unknown) {
+              unknown = true;
+              for (const [key, entry] of properties)
+                properties.set(key, { ...entry, value: taint(entry.value) });
+            }
+            for (const [key, entry] of spread.properties)
+              properties.set(key, { ...entry, origin: property });
+          } else if (spread.kind !== "null") {
+            unknown = true;
+            for (const [key, entry] of properties)
+              properties.set(key, { ...entry, value: taint(entry.value) });
+          }
+          continue;
+        }
+        if (property.type !== "Property") continue;
+        const name = property.computed
+          ? property.key.type === "Literal"
+            ? String(property.key.value)
+            : null
+          : (property.key.name ?? String(property.key.value));
+        if (name !== null)
+          properties.set(name, {
+            value: property.kind === "init" ? evaluate(property.value) : UNKNOWN,
+            origin: property,
+          });
+        else {
+          unknown = true;
+          for (const [key, entry] of properties)
+            properties.set(key, { ...entry, value: taint(entry.value) });
+        }
+      }
+      return { kind: "object", properties, unknown };
+    }
+    if (node.type === "ArrayExpression")
+      return {
+        kind: "array",
+        entries: node.elements.flatMap((origin) => {
+          if (!origin) return [];
+          if (origin.type === "SpreadElement") {
+            const value = evaluate(origin.argument);
+            return value.kind === "array"
+              ? value.entries.map((entry) => ({ ...entry, origin }))
+              : [{ value: UNKNOWN, origin }];
+          }
+          return [{ value: evaluate(origin), origin }];
+        }),
+      };
+    if (node.type === "ArrowFunctionExpression" || node.type === "FunctionExpression") {
+      if (node.body.type !== "BlockStatement") return evaluate(node.body);
+      const statements = node.body.body;
+      return statements.length === 1 && statements[0].type === "ReturnStatement"
+        ? evaluate(statements[0].argument)
+        : UNKNOWN;
+    }
+    if (node.type === "CallExpression") {
+      const name = configCall(node, context);
+      if (!name) return UNKNOWN;
+      consumed.add(node);
+      const first = evaluate(node.arguments[0]);
+      return name === "mergeConfig" ? merge(first, evaluate(node.arguments[1])) : first;
+    }
+    return UNKNOWN;
+  }
+  return evaluate;
+}
+module.exports = { createEvaluator };