eslint-plugin-zod 3.5.4 → 3.6.0

package/README.md

@@ -52,16 +52,17 @@ This plugin is primarily built for `zod`, so some rules are exclusive to `zod` a
 
 ### `zod` exclusive rules
 
-| Name                                                                               | Description                                                                       | 💼  | 🔧  | 💡  | ❌  |
-| :--------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------- | :-- | :-- | :-- | :-- |
-| [array-style](docs/rules/array-style.md)                                           | Enforce consistent Zod array style                                                | ✅  | 🔧  |     |     |
-| [no-number-schema-with-int](docs/rules/no-number-schema-with-int.md)               | Disallow usage of `z.number().int()` as it is considered legacy                   | ✅  | 🔧  |     |     |
-| [no-optional-and-default-together](docs/rules/no-optional-and-default-together.md) | Disallow using both `.optional()` and `.default()` on the same Zod schema         | ✅  | 🔧  |     |     |
-| [no-string-schema-with-uuid](docs/rules/no-string-schema-with-uuid.md)             | Disallow usage of `z.string().uuid()` in favor of the dedicated `z.uuid()` schema | ✅  | 🔧  |     |     |
-| [no-throw-in-refine](docs/rules/no-throw-in-refine.md)                             | Disallow throwing errors directly inside Zod refine callbacks                     | ✅  |     |     |     |
-| [prefer-enum-over-literal-union](docs/rules/prefer-enum-over-literal-union.md)     | Prefer `z.enum()` over `z.union()` when all members are string literals.          | ✅  | 🔧  |     |     |
-| [prefer-meta-last](docs/rules/prefer-meta-last.md)                                 | Enforce `.meta()` as last method                                                  | ✅  | 🔧  |     |     |
-| [prefer-string-schema-with-trim](docs/rules/prefer-string-schema-with-trim.md)     | Enforce `z.string().trim()` to prevent accidental leading/trailing whitespace     | ✅  | 🔧  |     |     |
+| Name                                                                               | Description                                                                                                              | 💼  | 🔧  | 💡  | ❌  |
+| :--------------------------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------- | :-- | :-- | :-- | :-- |
+| [array-style](docs/rules/array-style.md)                                           | Enforce consistent Zod array style                                                                                       | ✅  | 🔧  |     |     |
+| [no-number-schema-with-int](docs/rules/no-number-schema-with-int.md)               | Disallow usage of `z.number().int()` as it is considered legacy                                                          | ✅  | 🔧  |     |     |
+| [no-optional-and-default-together](docs/rules/no-optional-and-default-together.md) | Disallow using both `.optional()` and `.default()` on the same Zod schema                                                | ✅  | 🔧  |     |     |
+| [no-string-schema-with-uuid](docs/rules/no-string-schema-with-uuid.md)             | Disallow usage of `z.string().uuid()` in favor of the dedicated `z.uuid()` schema                                        | ✅  | 🔧  |     |     |
+| [no-throw-in-refine](docs/rules/no-throw-in-refine.md)                             | Disallow throwing errors directly inside Zod refine callbacks                                                            | ✅  |     |     |     |
+| [no-transform-in-record-key](docs/rules/no-transform-in-record-key.md)             | Disallow transforms in z.record() key schemas, which can cause silent key mutations and data loss through key collisions |     |     |     |     |
+| [prefer-enum-over-literal-union](docs/rules/prefer-enum-over-literal-union.md)     | Prefer `z.enum()` over `z.union()` when all members are string literals.                                                 | ✅  | 🔧  |     |     |
+| [prefer-meta-last](docs/rules/prefer-meta-last.md)                                 | Enforce `.meta()` as last method                                                                                         | ✅  | 🔧  |     |     |
+| [prefer-string-schema-with-trim](docs/rules/prefer-string-schema-with-trim.md)     | Enforce `z.string().trim()` to prevent accidental leading/trailing whitespace                                            | ✅  | 🔧  |     |     |
 
 <!-- end auto-generated rules list -->
 

package/dist/index.cjs

@@ -9,6 +9,7 @@ const require_no_number_schema_with_int = require("./rules/no-number-schema-with
 const require_no_optional_and_default_together = require("./rules/no-optional-and-default-together.cjs");
 const require_no_string_schema_with_uuid = require("./rules/no-string-schema-with-uuid.cjs");
 const require_no_throw_in_refine = require("./rules/no-throw-in-refine.cjs");
+const require_no_transform_in_record_key = require("./rules/no-transform-in-record-key.cjs");
 const require_no_unknown_schema = require("./rules/no-unknown-schema.cjs");
 const require_prefer_enum_over_literal_union = require("./rules/prefer-enum-over-literal-union.cjs");
 const require_prefer_meta_last = require("./rules/prefer-meta-last.cjs");
@@ -36,6 +37,7 @@ const eslintPluginZod = {
 		"no-string-schema-with-uuid": require_no_string_schema_with_uuid.noStringSchemaWithUuid,
 		"no-optional-and-default-together": require_no_optional_and_default_together.noOptionalAndDefaultTogether,
 		"no-throw-in-refine": require_no_throw_in_refine.noThrowInRefine,
+		"no-transform-in-record-key": require_no_transform_in_record_key.noTransformInRecordKey,
 		"no-unknown-schema": require_no_unknown_schema.noUnknownSchema,
 		"prefer-enum-over-literal-union": require_prefer_enum_over_literal_union.preferEnumOverLiteralUnion,
 		"prefer-meta": require_prefer_meta.preferMeta,

package/dist/index.mjs

@@ -9,6 +9,7 @@ import { noNumberSchemaWithInt } from "./rules/no-number-schema-with-int.mjs";
 import { noOptionalAndDefaultTogether } from "./rules/no-optional-and-default-together.mjs";
 import { noStringSchemaWithUuid } from "./rules/no-string-schema-with-uuid.mjs";
 import { noThrowInRefine } from "./rules/no-throw-in-refine.mjs";
+import { noTransformInRecordKey } from "./rules/no-transform-in-record-key.mjs";
 import { noUnknownSchema } from "./rules/no-unknown-schema.mjs";
 import { preferEnumOverLiteralUnion } from "./rules/prefer-enum-over-literal-union.mjs";
 import { preferMetaLast } from "./rules/prefer-meta-last.mjs";
@@ -36,6 +37,7 @@ const eslintPluginZod = {
 		"no-string-schema-with-uuid": noStringSchemaWithUuid,
 		"no-optional-and-default-together": noOptionalAndDefaultTogether,
 		"no-throw-in-refine": noThrowInRefine,
+		"no-transform-in-record-key": noTransformInRecordKey,
 		"no-unknown-schema": noUnknownSchema,
 		"prefer-enum-over-literal-union": preferEnumOverLiteralUnion,
 		"prefer-meta": preferMeta,

package/dist/rules/no-transform-in-record-key.cjs

@@ -0,0 +1,54 @@
+require("../_virtual/_rolldown/runtime.cjs");
+const require_create_plugin_rule = require("../utils/create-plugin-rule.cjs");
+const require_track_zod_schema_imports = require("../utils/track-zod-schema-imports.cjs");
+let _typescript_eslint_utils = require("@typescript-eslint/utils");
+//#region src/rules/no-transform-in-record-key.ts
+const { zodImportAllowedSource, trackZodSchemaImports } = require_track_zod_schema_imports.createZodSchemaImportTrack("zod");
+/**
+* Methods that mutate/transform the value and should not be used in z.record() key schemas
+*/
+const TRANSFORM_METHODS = [
+	"transform",
+	"map",
+	"trim",
+	"toLowerCase",
+	"toUpperCase"
+];
+const noTransformInRecordKey = require_create_plugin_rule.createZodPluginRule({
+	name: "no-transform-in-record-key",
+	meta: {
+		type: "problem",
+		docs: {
+			zodImportAllowedSource,
+			description: "Disallow transforms in z.record() key schemas, which can cause silent key mutations and data loss through key collisions"
+		},
+		messages: { noTransformInRecordKey: "Transforms in z.record() key schemas cause silent key mutation and potential data loss. Use validators like .min() instead of transforms like .trim() or .toLowerCase()" },
+		schema: []
+	},
+	defaultOptions: [],
+	create(context) {
+		const { importDeclarationListener, detectZodSchemaRootNode, collectZodChainMethods } = trackZodSchemaImports();
+		/**
+		* Check if a schema (as an expression) contains any transform methods in its chain
+		*/
+		function hasTransformMethods(schema) {
+			if (schema.type === _typescript_eslint_utils.AST_NODE_TYPES.SpreadElement) return false;
+			if (schema.type === _typescript_eslint_utils.AST_NODE_TYPES.CallExpression) return collectZodChainMethods(schema).some((method) => TRANSFORM_METHODS.includes(method.name));
+			return false;
+		}
+		return {
+			ImportDeclaration: importDeclarationListener,
+			CallExpression(node) {
+				if (detectZodSchemaRootNode(node)?.schemaType !== "record") return;
+				const keySchemaArg = node.arguments.at(0);
+				if (!keySchemaArg) return;
+				if (hasTransformMethods(keySchemaArg)) context.report({
+					node: keySchemaArg,
+					messageId: "noTransformInRecordKey"
+				});
+			}
+		};
+	}
+});
+//#endregion
+exports.noTransformInRecordKey = noTransformInRecordKey;

package/dist/rules/no-transform-in-record-key.mjs

@@ -0,0 +1,53 @@
+import { createZodPluginRule } from "../utils/create-plugin-rule.mjs";
+import { createZodSchemaImportTrack } from "../utils/track-zod-schema-imports.mjs";
+import { AST_NODE_TYPES } from "@typescript-eslint/utils";
+//#region src/rules/no-transform-in-record-key.ts
+const { zodImportAllowedSource, trackZodSchemaImports } = createZodSchemaImportTrack("zod");
+/**
+* Methods that mutate/transform the value and should not be used in z.record() key schemas
+*/
+const TRANSFORM_METHODS = [
+	"transform",
+	"map",
+	"trim",
+	"toLowerCase",
+	"toUpperCase"
+];
+const noTransformInRecordKey = createZodPluginRule({
+	name: "no-transform-in-record-key",
+	meta: {
+		type: "problem",
+		docs: {
+			zodImportAllowedSource,
+			description: "Disallow transforms in z.record() key schemas, which can cause silent key mutations and data loss through key collisions"
+		},
+		messages: { noTransformInRecordKey: "Transforms in z.record() key schemas cause silent key mutation and potential data loss. Use validators like .min() instead of transforms like .trim() or .toLowerCase()" },
+		schema: []
+	},
+	defaultOptions: [],
+	create(context) {
+		const { importDeclarationListener, detectZodSchemaRootNode, collectZodChainMethods } = trackZodSchemaImports();
+		/**
+		* Check if a schema (as an expression) contains any transform methods in its chain
+		*/
+		function hasTransformMethods(schema) {
+			if (schema.type === AST_NODE_TYPES.SpreadElement) return false;
+			if (schema.type === AST_NODE_TYPES.CallExpression) return collectZodChainMethods(schema).some((method) => TRANSFORM_METHODS.includes(method.name));
+			return false;
+		}
+		return {
+			ImportDeclaration: importDeclarationListener,
+			CallExpression(node) {
+				if (detectZodSchemaRootNode(node)?.schemaType !== "record") return;
+				const keySchemaArg = node.arguments.at(0);
+				if (!keySchemaArg) return;
+				if (hasTransformMethods(keySchemaArg)) context.report({
+					node: keySchemaArg,
+					messageId: "noTransformInRecordKey"
+				});
+			}
+		};
+	}
+});
+//#endregion
+export { noTransformInRecordKey };

package/dist/utils/track-zod-schema-imports.cjs

@@ -54,6 +54,11 @@ function trackZodSchemaImports(importAllowedSource) {
 }
 /**
 * Wrapper to avoid duplication of importAllowedSource across rule code
+*
+* This function exposes:
+*
+* - `zodImportAllowedSource` - to be used in rules meta to properly generate documentation
+* - `trackZodSchemaImports` - used inside a rule to process only zod related variables
 */
 function createZodSchemaImportTrack(zodImportAllowedSource) {
 	return {

package/dist/utils/track-zod-schema-imports.mjs

@@ -53,6 +53,11 @@ function trackZodSchemaImports(importAllowedSource) {
 }
 /**
 * Wrapper to avoid duplication of importAllowedSource across rule code
+*
+* This function exposes:
+*
+* - `zodImportAllowedSource` - to be used in rules meta to properly generate documentation
+* - `trackZodSchemaImports` - used inside a rule to process only zod related variables
 */
 function createZodSchemaImportTrack(zodImportAllowedSource) {
 	return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-zod",
-  "version": "3.5.4",
+  "version": "3.6.0",
   "type": "module",
   "description": "ESLint plugin that adds custom linting rules to enforce best practices when using Zod",
   "engines": {
@@ -83,8 +83,8 @@
     "lint:js:fix": "eslint . --fix",
     "lint:docs": "eslint-doc-generator --check",
     "lint:knip": "knip",
-    "format": "prettier . --check",
-    "format:fix": "prettier . --write",
+    "format": "prettier . --write",
+    "format:check": "prettier . --check",
     "test": "vitest",
     "test:dev": "vitest --typecheck=false",
     "release": "pnpm run build && changeset publish",