eslint-plugin-reliability 3.1.7 → 3.1.9

package/src/rules/reliability/no-missing-null-checks.js

@@ -1,75 +1,37 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noMissingNullChecks = void 0;
 exports.hasNullCheck = hasNullCheck;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 const eslint_devkit_2 = require("@interlace/eslint-devkit");
-/**
- * Globals and built-ins that are never null/undefined. Property access on
- * these doesn't need a null check.
- */
-// Built-in namespaces that are never null AND aren't typically mutated. We
-// deliberately exclude `globalThis`, `window`, `self`, `top`, `parent`, and
-// `document` — those are mutable and `globalThis.appState = ...` is a real
-// "global state mutation" antipattern that other rules want to catch.
-// Read-only namespaces (Math, JSON, …) and library singletons are safe to
-// exempt because their property access is idempotent.
 const NEVER_NULL_GLOBALS = new Set([
-    // Read-only Node/V8 magics
     'console', 'process', 'Buffer', '__dirname', '__filename', 'module', 'exports', 'require',
     'navigator', 'location', 'history',
-    // Built-in objects (read-only namespaces)
     'Math', 'JSON', 'Object', 'Array', 'Number', 'String', 'Boolean', 'Date',
     'RegExp', 'Promise', 'Symbol', 'Map', 'Set', 'WeakMap', 'WeakSet',
     'Proxy', 'Reflect', 'Intl', 'BigInt', 'WebAssembly', 'Atomics',
     'URL', 'URLSearchParams', 'TextEncoder', 'TextDecoder',
     'AbortController', 'AbortSignal', 'EventTarget', 'Event', 'CustomEvent',
     'FormData', 'Blob', 'File', 'FileReader', 'Headers', 'Request', 'Response',
-    // Error classes
     'Error', 'TypeError', 'RangeError', 'SyntaxError', 'URIError',
     'EvalError', 'ReferenceError', 'AggregateError',
-    // Common library / framework names
     'fetch', 'crypto', 'performance', 'queueMicrotask',
     'setTimeout', 'clearTimeout', 'setInterval', 'clearInterval',
     'setImmediate', 'clearImmediate', 'requestAnimationFrame', 'cancelAnimationFrame',
-    // Common loggers (used as singletons)
     'logger', 'log', 'winston', 'pino', 'bunyan',
 ]);
-/**
- * Returns true if the identifier resolves to:
- *   - A NEVER_NULL_GLOBALS entry (built-in / known singleton)
- *   - A catch-clause parameter (`catch (e) { e.message }` — never null)
- *   - A variable initialized by `new X(...)` (constructor result is never null)
- *   - A top-level import (`import x from 'y'` — never null)
- *
- * For these, the rule should not demand a null check.
- */
 function isProvablyNonNullableIdentifier(ident, scope) {
     if (NEVER_NULL_GLOBALS.has(ident.name))
         return true;
-    // Walk scope chain to find the resolved variable
     let s = scope;
     while (s) {
         const variable = s.variables.find((v) => v.name === ident.name);
         if (variable) {
             for (const def of variable.defs) {
-                // catch (e) { ... }
                 if (def.type === 'CatchClause')
                     return true;
-                // import x from 'y' / import { x } from 'y'
                 if (def.type === 'ImportBinding')
                     return true;
-                // const x = new Foo(...) / array literal / object literal / primitive
-                // / class declaration / `await fetch(...)` / template literal — these
-                // initializers cannot produce null/undefined under normal control flow.
-                // Adding them closes the bulk of the ILB-Arena-Quality FPs without
-                // sacrificing real CWE-476 detection (genuine null-deref risks come
-                // from optional/maybe lookups, not from `const x = []`).
                 if (def.type === 'Variable' && def.node?.type === 'VariableDeclarator') {
                     const init = def.node.init;
                     if (!init)
@@ -84,21 +46,13 @@ function isProvablyNonNullableIdentifier(ident, scope) {
                         return true;
                     if (init.type === 'ClassExpression')
                         return true;
-                    // Primitive literals (string / number / boolean / regex) — never null.
-                    // Skip the `null` literal itself — that IS a null and the rule
-                    // should let other rules complain about it.
                     if (init.type === 'Literal' && init.value !== null)
                         return true;
-                    // `await fetch(url)` / `await fetch(url, opts)` — the WHATWG fetch
-                    // contract guarantees a Response on resolution; null comes only
-                    // through rejection, which throws past this assignment.
                     if (init.type === 'AwaitExpression' &&
                         init.argument.type === 'CallExpression' &&
                         init.argument.callee.type === 'Identifier' &&
                         init.argument.callee.name === 'fetch')
                         return true;
-                    // `JSON.parse(...)` returns a value; typically non-null. Same for
-                    // common Object/Array static methods.
                     if (init.type === 'CallExpression' &&
                         init.callee.type === 'MemberExpression' &&
                         init.callee.object.type === 'Identifier' &&
@@ -106,18 +60,10 @@ function isProvablyNonNullableIdentifier(ident, scope) {
                             init.callee.object.name === 'JSON'))
                         return true;
                 }
-                // function f(...) — function declaration name is never null
                 if (def.type === 'FunctionName')
                     return true;
-                // class C {} — class declaration name is never null
                 if (def.type === 'ClassName')
                     return true;
-                // Function/method parameters — without type information we cannot
-                // tell `(x: T)` from `(x: T | null)`, and firing on every param-deref
-                // is the dominant FP source on real codebases (53 → 44 → most-of-rest).
-                // The contract is the caller's responsibility; treat params as
-                // non-nullable by default. Type-aware analysis (TS) is the right
-                // tool for real param-nullability detection.
                 if (def.type === 'Parameter')
                     return true;
             }
@@ -127,32 +73,18 @@ function isProvablyNonNullableIdentifier(ident, scope) {
     }
     return false;
 }
-/**
- * Check if property access has null/undefined check
- *
- * Exported for direct Layer-2 unit testing: the `node.optional` and
- * ChainExpression early returns are defensive duplicates of checks both
- * callers perform before invoking this helper, so they are unreachable
- * through the rule's listeners.
- */
 function hasNullCheck(node, sourceCode) {
-    // Check if node itself uses optional chaining
     if (node.optional) {
         return true;
     }
-    // Check if parent is optional chaining
     const parent = node.parent;
     if (parent && parent.type === 'ChainExpression') {
         return true;
     }
-    // Check if used with nullish coalescing
     if (usesNullishCoalescing(node)) {
         return true;
     }
     const objectText = sourceCode.getText(node.object);
-    // Short-circuit AND: `obj && obj.prop` — the right side of && runs only
-    // when the left side is truthy, so obj is guaranteed non-null here.
-    // Walk up one level (CallExpression wraps MemberExpression for `obj && obj.method()`)
     const immediateParent = parent;
     const nodeOrCall = immediateParent?.type === 'CallExpression' &&
         immediateParent.callee === node
@@ -167,8 +99,6 @@ function hasNullCheck(node, sourceCode) {
         if (leftText === objectText || leftText.endsWith(objectText))
             return true;
     }
-    // Ternary consequent: `obj ? obj.prop : fallback` — the test being truthy
-    // guarantees obj is non-null before the consequent evaluates.
     let cur = node;
     for (let depth = 0; depth < 8; depth++) {
         const p = cur.parent;
@@ -182,17 +112,12 @@ function hasNullCheck(node, sourceCode) {
         }
         cur = p;
     }
-    // Explicit null/truthy check in enclosing if statement
     if (hasExplicitNullCheck(node, sourceCode)) {
         return true;
     }
     return false;
 }
-/**
- * Check for explicit null checks in if statements
- */
 function hasExplicitNullCheck(node, sourceCode) {
-    // Walk up the AST to find if statements
     let current = node;
     let depth = 0;
     const maxDepth = 10;
@@ -200,7 +125,6 @@ function hasExplicitNullCheck(node, sourceCode) {
         const parent = current
             .parent;
         if (parent && parent.type === 'IfStatement') {
-            // Check if the test condition contains a null check for our object
             const test = parent.test;
             if (isNullCheckForObject(test, node.object, sourceCode)) {
                 return true;
@@ -211,21 +135,14 @@ function hasExplicitNullCheck(node, sourceCode) {
     }
     return false;
 }
-/**
- * Check if a test expression is a null check for a specific object
- */
 function isNullCheckForObject(test, object, sourceCode) {
     const objectText = sourceCode.getText(object);
-    // Truthy check: `if (obj)` or `if (obj.prop)` — direct truthy guard proves
-    // non-null. Also covers nested chains: `if (response) { response.data.items }`
-    // because checking the root (response) implicitly protects the full chain.
     if (test.type === 'Identifier' || test.type === 'MemberExpression') {
         const testText = sourceCode.getText(test);
         if (testText === objectText || objectText.startsWith(testText + '.')) {
             return true;
         }
     }
-    // Handle binary expressions like obj !== null, obj != undefined
     if (test.type === 'BinaryExpression') {
         const { left, right, operator } = test;
         if (operator === '!==' ||
@@ -242,18 +159,12 @@ function isNullCheckForObject(test, object, sourceCode) {
             }
         }
     }
-    // Handle logical expressions like obj !== null && obj !== undefined
     if (test.type === 'LogicalExpression') {
         return (isNullCheckForObject(test.left, object, sourceCode) ||
             isNullCheckForObject(test.right, object, sourceCode));
     }
-    // Unary negation: `if (!obj)` is a FALSY guard — only safe when paired
-    // with early return, which requires control-flow analysis. Skip for now.
     return false;
 }
-/**
- * Check if expression uses nullish coalescing
- */
 function usesNullishCoalescing(node) {
     let current = node;
     let depth = 0;
@@ -343,77 +254,48 @@ exports.noMissingNullChecks = (0, eslint_devkit_2.createRule)({
         },
     ],
     create(context, [options = {}]) {
-        const { ignoreInTests = true,
-        // requireExplicitChecks = false, // Not used
-         } = options || {};
+        const { ignoreInTests = true, } = options || {};
         const filename = context.filename;
         const isTestFile = ignoreInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
         if (isTestFile) {
             return {};
         }
         const sourceCode = context.sourceCode;
-        // Track reported MemberExpression nodes to prevent duplicate reports
-        // Key format: "start-end" from node.range
         const reportedMemberExpressions = new Set();
-        /**
-         * Get a unique key for a MemberExpression node to track if it's been reported
-         */
         function getMemberExpressionKey(node) {
-            // Use the node's range for a unique identifier
-            // Range is [start, end] character positions in the source
             if (node.range && Array.isArray(node.range) && node.range.length >= 2) {
                 return `me-${node.range[0]}-${node.range[1]}`;
             }
-            // Fallback: use location if range is not available
             const loc = node
                 .loc;
             if (loc && loc.start) {
                 return `me-${loc.start.line}-${loc.start.column}-${loc.end?.line || loc.start.line}-${loc.end?.column || loc.start.column}`;
             }
-            // Last resort: use a hash of the node structure
             return `me-${JSON.stringify(node).slice(0, 50)}`;
         }
-        /**
-         * Check member expressions for null safety
-         */
         function checkMemberExpression(node) {
-            // Skip if already using optional chaining
             if (node.optional) {
                 return;
             }
-            // Skip if parent is optional chaining
             const parent = node
                 .parent;
             if (parent && parent.type === 'ChainExpression') {
                 return;
             }
-            // Only report on the "deepest" member expression in a chain
-            // If this member expression is the object of another member expression,
-            // don't report it yet - let the deepest one be reported
             if (parent &&
                 parent.type === 'MemberExpression' &&
                 parent.object === node) {
-                return; // This is an intermediate member expression
+                return;
             }
-            // Check if object might be null/undefined
-            // Check for Identifier or nested MemberExpression
             const objectNode = node.object;
             let shouldCheck = false;
             if (objectNode.type === 'Identifier') {
-                // Skip identifiers that resolve to globals, catch params, imports,
-                // function declarations, or `new X()` results — these are never null.
                 if (isProvablyNonNullableIdentifier(objectNode, sourceCode.getScope(node))) {
                     return;
                 }
                 shouldCheck = true;
             }
             else if (objectNode.type === 'MemberExpression') {
-                // Nested member expressions like value.nested.deep — only fire on
-                // the deepest, where the leaf identifier matters most. Skip if the
-                // base of the chain is a known-non-null global (`console.log`,
-                // `JSON.stringify`, etc.) or is a `this`/`this.#field` chain — `this`
-                // inside a method is the class instance (never null), and private
-                // fields are always defined when accessed from inside the class.
                 let base = objectNode;
                 while (base.type === 'MemberExpression') {
                     base = base.object;
@@ -429,7 +311,7 @@ exports.noMissingNullChecks = (0, eslint_devkit_2.createRule)({
             if (shouldCheck && !hasNullCheck(node, sourceCode)) {
                 const nodeKey = getMemberExpressionKey(node);
                 if (reportedMemberExpressions.has(nodeKey)) {
-                    return; // Already reported
+                    return;
                 }
                 try {
                     reportedMemberExpressions.add(nodeKey);
@@ -453,37 +335,23 @@ exports.noMissingNullChecks = (0, eslint_devkit_2.createRule)({
                     });
                 }
                 catch {
-                    // Silently skip if there's an error
                     return;
                 }
             }
         }
-        /**
-         * Check call expressions for null safety (e.g., obj.method())
-         * Only check if it's an actual method call, not just a property access
-         */
         function checkCallExpression(node) {
-            // Ensure this is actually a CallExpression (not just a MemberExpression)
             if (node.type !== 'CallExpression') {
                 return;
             }
-            // Only check if callee is a member expression (e.g., obj.method())
-            // This ensures we only check method calls, not property accesses
             if (node.callee.type === 'MemberExpression') {
                 const memberExpr = node.callee;
-                // Skip if already using optional chaining
                 if (memberExpr.optional) {
                     return;
                 }
-                // Skip if parent is optional chaining
                 const parent = memberExpr.parent;
                 if (parent && parent.type === 'ChainExpression') {
                     return;
                 }
-                // Skip if this MemberExpression was already reported by checkMemberExpression
-                // We can't easily check this, so we'll rely on the fact that CallExpression
-                // is only triggered for actual method calls, not property accesses
-                // Check if object might be null/undefined
                 const objectNode = memberExpr.object;
                 let shouldCheck = false;
                 if (objectNode.type === 'Identifier') {
@@ -508,7 +376,7 @@ exports.noMissingNullChecks = (0, eslint_devkit_2.createRule)({
                 if (shouldCheck && !hasNullCheck(memberExpr, sourceCode)) {
                     const nodeKey = getMemberExpressionKey(memberExpr);
                     if (reportedMemberExpressions.has(nodeKey)) {
-                        return; // Already reported by checkMemberExpression
+                        return;
                     }
                     try {
                         reportedMemberExpressions.add(nodeKey);
@@ -532,7 +400,6 @@ exports.noMissingNullChecks = (0, eslint_devkit_2.createRule)({
                         });
                     }
                     catch {
-                        // Silently skip if there's an error
                         return;
                     }
                 }

package/src/rules/reliability/no-unsafe-type-narrowing.js

@@ -1,43 +1,26 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noUnsafeTypeNarrowing = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 const eslint_devkit_2 = require("@interlace/eslint-devkit");
-/**
- * Check if type assertion is unsafe (as unknown as T)
- */
 function isUnsafeTypeAssertion(node) {
-    // Check for double assertion pattern: as unknown as T or as any as T
     if (node.expression.type === 'TSAsExpression') {
         const innerAssertion = node.expression;
-        // Check if inner assertion is to 'unknown'
         if (innerAssertion.typeAnnotation.type === 'TSUnknownKeyword') {
-            return true; // as unknown as T pattern
+            return true;
         }
-        // Also check for 'any' type
         if (innerAssertion.typeAnnotation.type === 'TSAnyKeyword') {
-            return true; // as any as T pattern
+            return true;
         }
     }
-    // Don't flag direct assertions to unknown/any - those are handled by TSC
-    // Only flag the double assertion pattern which bypasses type safety
     return false;
 }
-/**
- * Check if type assertion has explanatory comment
- */
 function hasExplanatoryComment(node, sourceCode) {
     const comments = sourceCode.getAllComments();
     const nodeStart = node.loc?.start;
     if (!nodeStart || !comments.length) {
         return false;
     }
-    // Look for explanatory comments near the type assertion
     const explanatoryPatterns = [
         /type.?guard/i,
         /validated/i,
@@ -53,7 +36,6 @@ function hasExplanatoryComment(node, sourceCode) {
         /todo/i,
         /fixme/i,
     ];
-    // Check comments before the assertion (within 1 line)
     for (const comment of comments) {
         if (comment.loc && nodeStart.line - comment.loc.end.line <= 1) {
             const commentText = comment.value.toLowerCase();
@@ -140,14 +122,10 @@ exports.noUnsafeTypeNarrowing = (0, eslint_devkit_2.createRule)({
             return {};
         }
         const sourceCode = context.sourceCode;
-        /**
-         * Check type assertions
-         */
         function checkTypeAssertion(node) {
             if (!isUnsafeTypeAssertion(node)) {
                 return;
             }
-            // Check if comment explains the unsafe assertion
             if (allowWithComment && hasExplanatoryComment(node, sourceCode)) {
                 return;
             }
@@ -157,7 +135,7 @@ exports.noUnsafeTypeNarrowing = (0, eslint_devkit_2.createRule)({
                 suggest: [
                     {
                         messageId: 'useTypeGuard',
-                        fix: () => null, // Cannot auto-fix without context
+                        fix: () => null,
                     },
                     {
                         messageId: 'useProperNarrowing',

package/src/rules/reliability/require-network-timeout.js

@@ -1,16 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireNetworkTimeout = void 0;
-/**
- * @fileoverview Require timeout limits for network requests
- * @see https://owasp.org/www-project-mobile-top-10/
- * @see https://cwe.mitre.org/data/definitions/770.html
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 exports.requireNetworkTimeout = (0, eslint_devkit_1.createRule)({
     name: 'require-network-timeout',
@@ -46,10 +36,6 @@ exports.requireNetworkTimeout = (0, eslint_devkit_1.createRule)({
                     callee.object.name === 'axios';
                 if (isFetch || isAxios) {
                     const optionsArg = node.arguments[1];
-                    // Either an explicit `timeout` option, or an AbortSignal — both
-                    // bound the request. `{ signal: controller.signal }` is the
-                    // standard timeout-via-AbortController pattern; flagging it as
-                    // "missing timeout" is a false positive.
                     const hasBound = optionsArg?.type === eslint_devkit_1.AST_NODE_TYPES.ObjectExpression &&
                         optionsArg.properties.some((p) => p.type === eslint_devkit_1.AST_NODE_TYPES.Property &&
                             p.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&

package/CHANGELOG.md

@@ -1,164 +0,0 @@
-## [3.1.3] - 2026-05-03
-
-## 3.1.7
-
-### Patch Changes
-
-- [#294](https://github.com/ofri-peretz/eslint/pull/294) [`659f6dc`](https://github.com/ofri-peretz/eslint/commit/659f6dc0181b03b675f72b5949fcf123dd066358) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Rewrite `description` and `keywords` on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release.
-
-  **Descriptions now lead with the search phrase.** Every one starts `ESLint plugin for <the thing you'd search>` instead of a brand-first or category-first framing, and names the concrete vulnerabilities the plugin actually detects. Three were corrected while doing so:
-
-  - `eslint-plugin-import-next` claimed "100x faster no-cycle detection". No 100x measurement exists: `CLAIMS.md` records **3.1x end-to-end** (8x in pure rule execution) on a 5,483-file React codebase, and the highest number in any benchmark result is 54.9x on the synthetic corpus. The description now states the real-codebase figure.
-  - `eslint-plugin-secure-coding` claimed SQL injection, XSS and CSRF coverage — none of which are its rules. It now names what it does detect: LDAP, XPath, XXE, GraphQL and template injection, unsafe deserialization, ReDoS, missing authentication, and PII in logs.
-  - `eslint-plugin-secure-coding` ("89 rules") and `eslint-plugin-react-a11y` ("37 rules") hard-coded rule counts that had drifted from reality. Counts are generated into `interlace-numbers.json`; hand-typed copies are removed rather than corrected.
-
-  **Keywords now match the vocabulary of the plugins that rank.** `eslint-plugin-security`, `eslint-plugin-jsx-a11y`, `eslint-plugin-n` and `eslint-plugin-import` all carry the `eslint` / `eslintplugin` / `eslint-plugin` trio — six of our packages were missing `eslintplugin`, and every one now carries all three plus `static-analysis`, `linting` and `code-quality`. Security plugins add `sast`, `appsec` and `vulnerability`; `node-security` and `secure-coding` also carry `nodesecurity`, the exact keyword `eslint-plugin-security` ranks on. Each plugin gained the CWE identifiers and attack names for what it detects (`cwe-78` command injection, `cwe-22` path traversal, `cwe-89` SQL injection, `cwe-79` XSS, `cwe-347` JWT algorithm confusion, `cwe-352` CSRF, `cwe-943` NoSQL injection), and `node-security` gained the crypto vocabulary it had been missing entirely despite absorbing the crypto rule set (`crypto`, `cryptography`, `weak-hash`, `md5`, `sha1`, `timing-attack`).
-
-  No rule behavior, exports, or configuration changes.
-
-- Updated dependencies [[`e1cdf83`](https://github.com/ofri-peretz/eslint/commit/e1cdf83e3db761907f0ab06f7fc6c1f1da7513a5), [`659f6dc`](https://github.com/ofri-peretz/eslint/commit/659f6dc0181b03b675f72b5949fcf123dd066358)]:
-  - @interlace/eslint-devkit@1.4.3
-
-## 3.1.6
-
-### Patch Changes
-
-- [#269](https://github.com/ofri-peretz/eslint/pull/269) [`7028fe2`](https://github.com/ofri-peretz/eslint/commit/7028fe2668a42266d831014184dcef70e73101ad) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - docs: dual-logo README header (Interlace mark + ESLint mark side by side) and closing Interlace footer — refreshes the README rendered on npmjs.com. No runtime changes.
-
-- Updated dependencies [[`7028fe2`](https://github.com/ofri-peretz/eslint/commit/7028fe2668a42266d831014184dcef70e73101ad)]:
-  - @interlace/eslint-devkit@1.4.2
-
-## 3.1.5
-
-### Patch Changes
-
-- [#252](https://github.com/ofri-peretz/eslint/pull/252) [`d67e395`](https://github.com/ofri-peretz/eslint/commit/d67e3953c2748ad36e6aebe0f24b1d04e518b4d0) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Fix Codecov badge showing "unknown" — switch from flag to component URL format
-
-## 3.1.4
-
-### Patch Changes
-
-- [#141](https://github.com/ofri-peretz/eslint/pull/141) [`38ab670`](https://github.com/ofri-peretz/eslint/commit/38ab670a0221684f4fd3d5dc3c05ddec7458ca2b) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - fix: remove false `meta.fixable: 'code'` declarations from 21 rules that had no `fix()` function
-
-  Rules that declared `fixable: 'code'` in their ESLint meta without an actual `fix()` implementation would show the ⚡ auto-fix icon in editors and CI formatters but apply no change when `--fix` was run. This patch removes the misleading declaration from:
-  - `browser-security/no-clickjacking`
-  - `import-next/first`, `named`, `no-barrel-import`, `no-import-module-exports`, `no-namespace`
-  - `node-security/no-buffer-overread`, `no-unsafe-dynamic-require`, `no-zip-slip`
-  - `react-features/react-no-inline-functions`
-  - `reliability/no-jsdoc-terminator-in-example` (uses `suggest`, not auto-fix; corrected to `hasSuggestions: true` only)
-  - `secure-coding/no-directive-injection`, `no-electron-security-issues`, `no-graphql-injection`, `no-improper-sanitization`, `no-improper-type-validation`, `no-ldap-injection`, `no-unchecked-loop-condition`, `no-unlimited-resource-allocation`, `no-weak-password-recovery`, `no-xpath-injection`
-
-- [#143](https://github.com/ofri-peretz/eslint/pull/143) [`213cde1`](https://github.com/ofri-peretz/eslint/commit/213cde190ff2aea49ca7c1b533170940f879d9b4) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - fix(no-missing-null-checks): eliminate 53 false positives via three new narrowing patterns
-
-  Rules that were recognized as null guards are now correctly identified as safe:
-  1. **Truthy if guard** — `if (obj) { obj.prop }` — direct truthy check proves non-null. Also covers chains: `if (response)` protects `response.data.items`.
-  2. **Short-circuit AND** — `obj && obj.prop` — right side of `&&` only runs when left is truthy.
-  3. **Ternary consequent** — `obj ? obj.prop : fallback` — truthy test guards the consequent.
-
-  Also: bumped `beforeAll` timeout to 30 seconds in 7 compatibility test files (`__compatibility__/*.spec.ts`). Native-addon packages routinely exceed the previous 10-second default on a cold ESM load.
-
-- Updated dependencies [[`736a5fe`](https://github.com/ofri-peretz/eslint/commit/736a5fed47e673f6157ea900b29fe2a54e4bc7df)]:
-  - @interlace/eslint-devkit@1.4.1
-
-### Bug Fixes
-
-- `no-missing-null-checks`: exempt provably-non-null identifiers (built-in singletons like `Math`, `JSON`, `console`, error classes; catch-clause params; constructor results; top-level imports) from the null-check requirement. Eliminates a large class of false positives without weakening real coverage.
-- `no-unhandled-promise`: refined detection (see source diff).
-
-## 3.1.2 (2026-02-09)
-
-This was a version bump only for eslint-plugin-reliability to align it with other projects, there were no code changes.
-
-## [3.1.0] - 2026-02-08
-
-This was a version bump only for eslint-plugin-reliability to align it with other projects, there were no code changes.
-
-## [3.0.4] - 2026-02-08
-
-### Bug Fixes
-
-- align codecov component IDs with full package names ([2831b968](https://github.com/ofri-peretz/eslint/commit/2831b968))
-
-### Documentation
-
-- fix changelog header format across all packages ([c3a15082](https://github.com/ofri-peretz/eslint/commit/c3a15082))
-
-### ❤️ Thank You
-
-- Ofri Peretz
-
-## [3.0.3] - 2026-02-06
-
-### Bug Fixes
-
-- align codecov component names and update docs components ([0a59a86c](https://github.com/ofri-peretz/eslint/commit/0a59a86c))
-
-### ❤️ Thank You
-
-- Ofri Peretz
-
-## [3.0.2] - 2026-02-02
-
-This was a version bump only for eslint-plugin-reliability to align it with other projects, there were no code changes.
-
-# Changelog
-
-All notable changes to `eslint-plugin-reliability` will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-### Documentation
-
-- 📘 Launched new documentation site: [eslint.interlace.tools](https://eslint.interlace.tools/)
-- 📝 Achieved 100% documentation parity (both .md and .mdx files)
-
-## [3.0.1] - 2026-02-02
-
-This was a version bump only for eslint-plugin-reliability to align it with other projects, there were no code changes.
-
-## [3.0.0] - 2026-02-02
-
-This was a version bump only for eslint-plugin-reliability to align it with other projects, there were no code changes.
-
-## [1.0.0] - 2026-01-26
-
-### Added
-
-- Initial stable release with 8 reliability rules
-- LLM-optimized error messages for AI-assisted development
-- 100% test coverage across all rules
-- ESLint 9 flat config support
-- TypeScript type definitions for all rule options
-
-### Rules
-
-#### Error Handling (4 rules)
-
-| Rule                       | Description                                   | CWE     |
-| :------------------------- | :-------------------------------------------- | :------ |
-| `no-unhandled-promise`     | Detect unhandled promise rejections           | CWE-392 |
-| `no-silent-errors`         | Detect empty catch blocks that swallow errors | CWE-390 |
-| `no-missing-error-context` | Require error context when re-throwing        | CWE-209 |
-| `error-message`            | Require meaningful error messages             | CWE-209 |
-
-#### Runtime Safety (4 rules)
-
-| Rule                       | Description                                   | CWE         |
-| :------------------------- | :-------------------------------------------- | :---------- |
-| `no-missing-null-checks`   | Detect potential null/undefined dereferences  | CWE-476     |
-| `no-unsafe-type-narrowing` | Detect unsafe type narrowing patterns         | CWE-704     |
-| `require-network-timeout`  | Require timeouts on network requests          | CWE-400     |
-| `no-await-in-loop`         | Detect sequential await in loops (N+1 issues) | Performance |
-
-### Presets
-
-- `recommended` - Balanced reliability checks (4 rules as warnings)
-
-### Known Limitations
-
-Documented in `docs/KNOWN-LIMITATIONS.md`:
-
-- `no-unhandled-promises`: Promises in callbacks or async iterators may be missed
-- `no-silent-errors`: Intentional suppression vs. actual swallowing is hard to distinguish
-- `no-missing-null-checks`: Business-logic guarantees not in types can trigger false positives

package/src/lib/eslint-plugin-reliability.d.ts

@@ -1 +0,0 @@
-export declare function eslintPluginReliability(): string;

package/src/rules/error-handling/error-message.d.ts

@@ -1,20 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: error-message
- * Enforces providing a message when creating built-in Error objects
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-type MessageIds = 'missingErrorMessage' | 'addErrorMessage';
-export interface Options {
-    /** Allow Error() without message (not recommended) */
-    allowEmptyCatch?: boolean;
-}
-type RuleOptions = [Options?];
-export declare const errorMessage: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export {};