vitest-auto-spy 3.9.0 → 3.11.0

package/AGENTS.md

@@ -1886,8 +1886,9 @@ export default [{ files: ['**/*.spec.ts'], ...autoSpy.configs.recommended }];
 | `no-overridden-provider`       | `error` | suggest           | two providers for one token in one array → the earlier one never runs; the exact duplicate can be deleted                                 |
 | `no-inject-before-override`    | `warn`  | —                 | `TestBed.inject()` in a hook, in a suite that still calls `override*`                                                                     |
 | `no-import-time-spread`        | `error` | suggest           | `export const x = [...Imported]` at module scope → a `TypeError` while the bundle loads                                                   |
+| `no-unregistered-inject-spy`   | `warn`  | —                 | `injectSpy(X)` for a token this file never registered → the real instance, whose spy helpers exist only for the compiler |
 
-Thirteen rules; two fix on their own, six offer suggestions. `no-mocked-for-spy` only ever touches a
+Fourteen rules; two fix on their own, six offer suggestions. `no-mocked-for-spy` only ever touches a
 **type position**, where a wrong rewrite is a compile error rather than a test that quietly changed
 meaning — so `--fix` renames the type, adds `import type { Spy } from 'vitest-auto-spy'` and drops
 the orphaned `Mocked` import. Every type position, not only a `let`: a factory's return type, a

package/README.md

@@ -60,7 +60,7 @@ identical API, with **RxJS** spies and **Angular / NestJS / React / Vue·Pinia /
 - 🧩 Module mocks that prove they applied — `assertMocked`, `moduleNamespace`, for a `vi.mock()` a bundler quietly ignored
 - 🧾 Fixtures without casts — deep-partial `createMock`, `narrow()`, `withOverrides()`, `asInstances()`, `captureArg()`
 - 🚚 A migration you can verify — `compareTestRuns` on the two JSON reports, `diffByField` for the assertion the reporter collapses
-- 📏 Lint rules and one-line test-run hygiene — thirteen rules in `vitest-auto-spy/eslint-plugin` (two `--fix`, six suggestions), `setupAutoSpy()`
+- 📏 Lint rules and one-line test-run hygiene — fourteen rules in `vitest-auto-spy/eslint-plugin` (two `--fix`, six suggestions), `setupAutoSpy()`
 - 🩺 [Editor diagnostics](#editor-diagnostics--webstorm--vs-code) — the same anti-patterns underlined while you type: native ESLint inspections in **WebStorm** and the other JetBrains IDEs, the ESLint extension in **VS Code**, no extra plugin either way
 - 🔎 [`npx vitest-auto-spy doctor`](#the-cli--doctor-codemod-and-init) — suite-level defects **that never fail a run**: a `tsconfig` `include` matching no file, a production module importing a spec, a `@jest-environment` pragma the runner never reads, config left behind for a runner that is gone. Read-only, no config, exits 1 in CI
 - 🚚 [`npx vitest-auto-spy codemod`](#codemod--migrating-a-suite-off-jest-auto-spies) — seven transforms that move a suite off `jest-auto-spies` and Jest, dry-run by default, with a `--verify` pass that also checks a file somebody edited by hand
@@ -2207,12 +2207,13 @@ export can never be.
 | `no-overridden-provider`       |   `error`   | suggest           | two providers for one token in one array → the earlier one never runs; the exact duplicate can be deleted                                  |
 | `no-inject-before-override`    |   `warn`    | —                 | `TestBed.inject()` in a hook, in a suite that still calls `override*`                                                                      |
 | `no-import-time-spread`        |   `error`   | suggest           | `export const x = [...Imported]` at module scope → a `TypeError` while the bundle loads                                                    |
+| `no-unregistered-inject-spy`   |   `warn`    | —                 | `injectSpy(X)` for a token this file never registered → the real instance, whose spy helpers exist only for the compiler                    |
 
 Every message ends with a link to the matching [recipe](#how-to-mock): a rule that only says
 "don't" moves the problem rather than solving it. Rules travel with the API they recommend, so they
 are versioned together and stop being re-written in every project that installs the package.
 
-**Two of the thirteen fix on their own, six offer suggestions**, and the split is not about how hard
+**Two of the fourteen fix on their own, six offer suggestions**, and the split is not about how hard
 the rewrite is. `no-mocked-for-spy` touches a _declaration_: get it wrong and the file stops
 compiling, which is the loudest, cheapest failure there is — so `--fix` rewrites the type, adds
 `import type { Spy } from 'vitest-auto-spy'` and drops the `Mocked` import once nothing else uses
@@ -2270,6 +2271,20 @@ seven sites in an 8 673-file workspace, which is small enough to flag at the cur
 and an instance field are deliberately not reported — they run later than the module does — while a
 `static` field is.
 
+The fourteenth, `no-unregistered-inject-spy`, catches `injectSpy(X)` for a token nothing in the file
+registered as an auto-spy. What comes back is whatever Angular DI already had — the real service, or
+an object an imported testing module put there — and nothing complains, because `injectSpy` is
+declared to return a `Spy<T>`: the helpers are present for `tsc` and absent at run time, so the first
+`.mockReturnValue(…)` or `.calledWith(…)` throws on a real method. The library warns about exactly
+this at run time, and that warning is why the rule exists rather than why it is redundant — it does
+not fail the run, it scrolls past in a suite of a thousand files, and it arrives only for the tests
+that executed the line; in one consumer monorepo dozens of spec files print it on every CI run and it
+has never been acted on. Reading it at the cursor needs no types, only the file's own registrations,
+and the rule stays quiet unless it can read all of them: it needs at least one `provideAutoSpy`, and
+a spread, an unknown provider factory, `createWithAutoSpies`, `renderShallow` or
+`TestBed.overrideProvider` silences the file. A token handed a plain `useValue` is left to
+`prefer-provide-auto-spy` — two rules on one line only teach people to disable both.
+
 ## Editor diagnostics — WebStorm & VS Code
 
 The rules above are worth more while the cursor is still on the line than they are in CI, because
@@ -2279,7 +2294,7 @@ package's own — it needs its ESLint integration switched on.
 ### WebStorm and the other JetBrains IDEs
 
 No plugin to install: WebStorm, IntelliJ IDEA Ultimate, PhpStorm, PyCharm Professional and RubyMine
-all run ESLint natively, so the twelve rules appear inline, in the **Problems** tool window, and
+all run ESLint natively, so the fourteen rules appear inline, in the **Problems** tool window, and
 under **Code → Inspect Code** for the whole project.
 
 ```js
@@ -2296,7 +2311,7 @@ has supported flat config since 2023.3); scope the block to spec files yourself;
 the fixes and suggestions live.
 
 A native JetBrains plugin is **not** planned — it would duplicate an integration the IDE already has
-and then keep a second copy of twelve rules, in Kotlin, in step with the TypeScript ones.
+and then keep a second copy of fourteen rules, in Kotlin, in step with the TypeScript ones.
 
 ### VS Code, Cursor, Windsurf, VSCodium
 
@@ -2462,11 +2477,13 @@ Releases are automated: merging a PR into `master` bumps the version from the
 Conventional Commit types and publishes to npm — see
 [CONTRIBUTING.md → Releasing](./CONTRIBUTING.md#releasing).
 
-`auto-release.yml` is the **only** workflow that publishes `vitest-auto-spy`, and it authenticates
-with npm **Trusted Publishing (OIDC)** — no npm token, and provenance attached by the registry.
-A hand-pushed `v*` tag runs `release.yml`, which now only creates the GitHub Release; it does not
-publish. The `vitest-auto-spies` alias package is a second npm package with its own publish, and it
-still authenticates with `NPM_TOKEN` — npm allows one trusted-publisher workflow per package.
+`auto-release.yml` is the **only** entry point that publishes either package, and it authenticates
+with npm **Trusted Publishing (OIDC)** — no npm token anywhere in the repository, and provenance
+attached by the registry. A hand-pushed `v*` tag runs `release.yml`, which now only creates the
+GitHub Release; it does not publish. The `vitest-auto-spies` alias is a second npm package with its
+own publish (`publish-alias.yml`), but it is `workflow_call`-only and reached through
+`auto-release.yml`, because npm validates the workflow that *entered* the run, not the reusable one
+that runs `npm publish`.
 
 If this package saved you time, a ⭐ on [GitHub](https://github.com/ASDAlexey/vitest-auto-spy)
 helps others find it.

package/dist/eslint-plugin.cjs

@@ -708,6 +708,77 @@ function breaksAnOverride(injection) {
   return countInSubtree(suite, (node) => isMemberCall(node, TEST_BED, OVERRIDES) && !runsFirst(node, injection, hook), true) > 0;
 }
 
+// src/lib/eslint/unregistered-spy.ts
+var PROVIDE_AUTO_SPY = "provideAutoSpy";
+var INJECT_SPY = "injectSpy";
+var AUTO_SPY_FACTORIES = /* @__PURE__ */ new Set(["createAutoMock", "createSpyFromClass", "createMock", "mockDeep"]);
+var OPAQUE_HELPERS = /* @__PURE__ */ new Set(["createWithAutoSpies", "renderShallow"]);
+function emptyRegistrations() {
+  return { autoSpies: /* @__PURE__ */ new Set(), opaqueTokens: /* @__PURE__ */ new Set(), injections: [], sawProvideAutoSpy: false, opaque: false };
+}
+function calleeName(node) {
+  return isIdentifier(node.callee) ? node.callee.name : void 0;
+}
+function isOverrideProvider(node) {
+  const { callee } = node;
+  return isMemberExpression(callee) && isIdentifier(callee.object) && callee.object.name === "TestBed" && isIdentifier(callee.property) && callee.property.name === "overrideProvider";
+}
+function readCall(context, node, tally) {
+  const name = calleeName(node);
+  const [first] = node.arguments;
+  if (isOverrideProvider(node) || name !== void 0 && OPAQUE_HELPERS.has(name)) {
+    tally.opaque = true;
+    return;
+  }
+  if (first === void 0) {
+    return;
+  }
+  if (name === PROVIDE_AUTO_SPY) {
+    tally.sawProvideAutoSpy = true;
+    tally.autoSpies.add(context.sourceCode.getText(first));
+    return;
+  }
+  if (name === INJECT_SPY) {
+    tally.injections.push({ node, token: context.sourceCode.getText(first) });
+  }
+}
+function isAutoSpyValue(value) {
+  return isCallExpression(value) && isIdentifier(value.callee) && AUTO_SPY_FACTORIES.has(value.callee.name);
+}
+function readProviderObject(context, element, tally) {
+  const provide = findProperty(element, "provide");
+  if (provide === void 0) {
+    tally.opaque = true;
+    return;
+  }
+  const token = context.sourceCode.getText(propertyValue(provide));
+  const useValue = findProperty(element, "useValue");
+  if (useValue !== void 0 && isAutoSpyValue(propertyValue(useValue))) {
+    tally.autoSpies.add(token);
+    return;
+  }
+  tally.opaqueTokens.add(token);
+}
+function readProviders(context, array, tally) {
+  for (const element of array.elements) {
+    if (element === null) {
+      tally.opaque = true;
+      continue;
+    }
+    if (isObjectExpression(element)) {
+      readProviderObject(context, element, tally);
+    } else if (!isCallExpression(element) || calleeName(element) !== PROVIDE_AUTO_SPY) {
+      tally.opaque = true;
+    }
+  }
+}
+function unregisteredInjections(tally) {
+  if (tally.opaque || !tally.sawProvideAutoSpy) {
+    return [];
+  }
+  return tally.injections.filter(({ token }) => !tally.autoSpies.has(token) && !tally.opaqueTokens.has(token));
+}
+
 // src/lib/eslint/rules.ts
 var README = "https://github.com/ASDAlexey/vitest-auto-spy#how-to-mock";
 function defineRule(options) {
@@ -1116,6 +1187,29 @@ var noImportTimeSpread = defineRule({
     }
   })
 });
+var noUnregisteredInjectSpy = defineRule({
+  anchor: "-a-service-behind-angular-di",
+  description: "Do not read a token with injectSpy unless this file registered it as an auto-spy",
+  messages: {
+    noUnregisteredInjectSpy: "Nothing in this file registers `{{token}}` as an auto-spy, so this hands back whatever Angular DI already had \u2014 the real service, or a hand-rolled object some imported module provides. The line still compiles and the spec still runs: `injectSpy` types the result as a spy, so the helpers are there for the compiler and absent at run time, and the first `.mockReturnValue(\u2026)` or `.calledWith(\u2026)` throws on a real method. Add `provideAutoSpy({{token}})` to the providers, or read the real implementation with `TestBed.inject({{token}})` and say so. Nothing is reported from a file whose providers this cannot read in full \u2014 a spread, an unknown provider factory, `createWithAutoSpies` or `TestBed.overrideProvider` all silence it."
+  },
+  create: (context) => {
+    const tally = emptyRegistrations();
+    return {
+      CallExpression: (node) => {
+        readCall(context, node, tally);
+      },
+      'Property[key.name="providers"] > ArrayExpression': (node) => {
+        readProviders(context, node, tally);
+      },
+      "Program:exit": () => {
+        unregisteredInjections(tally).forEach(({ node, token }) => {
+          context.report({ node, messageId: "noUnregisteredInjectSpy", data: { token } });
+        });
+      }
+    };
+  }
+});
 var rules = {
   "prefer-provide-auto-spy": preferProvideAutoSpy,
   "prefer-create-spy-from-class": preferCreateSpyFromClass,
@@ -1129,7 +1223,8 @@ var rules = {
   "no-floating-assertion": noFloatingAssertion,
   "no-overridden-provider": noOverriddenProvider,
   "no-inject-before-override": noInjectBeforeOverride,
-  "no-import-time-spread": noImportTimeSpread
+  "no-import-time-spread": noImportTimeSpread,
+  "no-unregistered-inject-spy": noUnregisteredInjectSpy
 };
 
 // src/eslint-plugin.ts
@@ -1147,7 +1242,8 @@ var recommendedRules = {
   [`${PLUGIN_NAME}/no-floating-assertion`]: "error",
   [`${PLUGIN_NAME}/no-overridden-provider`]: "error",
   [`${PLUGIN_NAME}/no-inject-before-override`]: "warn",
-  [`${PLUGIN_NAME}/no-import-time-spread`]: "error"
+  [`${PLUGIN_NAME}/no-import-time-spread`]: "error",
+  [`${PLUGIN_NAME}/no-unregistered-inject-spy`]: "warn"
 };
 var plugin = {
   rules,

package/dist/eslint-plugin.js

@@ -706,6 +706,77 @@ function breaksAnOverride(injection) {
   return countInSubtree(suite, (node) => isMemberCall(node, TEST_BED, OVERRIDES) && !runsFirst(node, injection, hook), true) > 0;
 }
 
+// src/lib/eslint/unregistered-spy.ts
+var PROVIDE_AUTO_SPY = "provideAutoSpy";
+var INJECT_SPY = "injectSpy";
+var AUTO_SPY_FACTORIES = /* @__PURE__ */ new Set(["createAutoMock", "createSpyFromClass", "createMock", "mockDeep"]);
+var OPAQUE_HELPERS = /* @__PURE__ */ new Set(["createWithAutoSpies", "renderShallow"]);
+function emptyRegistrations() {
+  return { autoSpies: /* @__PURE__ */ new Set(), opaqueTokens: /* @__PURE__ */ new Set(), injections: [], sawProvideAutoSpy: false, opaque: false };
+}
+function calleeName(node) {
+  return isIdentifier(node.callee) ? node.callee.name : void 0;
+}
+function isOverrideProvider(node) {
+  const { callee } = node;
+  return isMemberExpression(callee) && isIdentifier(callee.object) && callee.object.name === "TestBed" && isIdentifier(callee.property) && callee.property.name === "overrideProvider";
+}
+function readCall(context, node, tally) {
+  const name = calleeName(node);
+  const [first] = node.arguments;
+  if (isOverrideProvider(node) || name !== void 0 && OPAQUE_HELPERS.has(name)) {
+    tally.opaque = true;
+    return;
+  }
+  if (first === void 0) {
+    return;
+  }
+  if (name === PROVIDE_AUTO_SPY) {
+    tally.sawProvideAutoSpy = true;
+    tally.autoSpies.add(context.sourceCode.getText(first));
+    return;
+  }
+  if (name === INJECT_SPY) {
+    tally.injections.push({ node, token: context.sourceCode.getText(first) });
+  }
+}
+function isAutoSpyValue(value) {
+  return isCallExpression(value) && isIdentifier(value.callee) && AUTO_SPY_FACTORIES.has(value.callee.name);
+}
+function readProviderObject(context, element, tally) {
+  const provide = findProperty(element, "provide");
+  if (provide === void 0) {
+    tally.opaque = true;
+    return;
+  }
+  const token = context.sourceCode.getText(propertyValue(provide));
+  const useValue = findProperty(element, "useValue");
+  if (useValue !== void 0 && isAutoSpyValue(propertyValue(useValue))) {
+    tally.autoSpies.add(token);
+    return;
+  }
+  tally.opaqueTokens.add(token);
+}
+function readProviders(context, array, tally) {
+  for (const element of array.elements) {
+    if (element === null) {
+      tally.opaque = true;
+      continue;
+    }
+    if (isObjectExpression(element)) {
+      readProviderObject(context, element, tally);
+    } else if (!isCallExpression(element) || calleeName(element) !== PROVIDE_AUTO_SPY) {
+      tally.opaque = true;
+    }
+  }
+}
+function unregisteredInjections(tally) {
+  if (tally.opaque || !tally.sawProvideAutoSpy) {
+    return [];
+  }
+  return tally.injections.filter(({ token }) => !tally.autoSpies.has(token) && !tally.opaqueTokens.has(token));
+}
+
 // src/lib/eslint/rules.ts
 var README = "https://github.com/ASDAlexey/vitest-auto-spy#how-to-mock";
 function defineRule(options) {
@@ -1114,6 +1185,29 @@ var noImportTimeSpread = defineRule({
     }
   })
 });
+var noUnregisteredInjectSpy = defineRule({
+  anchor: "-a-service-behind-angular-di",
+  description: "Do not read a token with injectSpy unless this file registered it as an auto-spy",
+  messages: {
+    noUnregisteredInjectSpy: "Nothing in this file registers `{{token}}` as an auto-spy, so this hands back whatever Angular DI already had \u2014 the real service, or a hand-rolled object some imported module provides. The line still compiles and the spec still runs: `injectSpy` types the result as a spy, so the helpers are there for the compiler and absent at run time, and the first `.mockReturnValue(\u2026)` or `.calledWith(\u2026)` throws on a real method. Add `provideAutoSpy({{token}})` to the providers, or read the real implementation with `TestBed.inject({{token}})` and say so. Nothing is reported from a file whose providers this cannot read in full \u2014 a spread, an unknown provider factory, `createWithAutoSpies` or `TestBed.overrideProvider` all silence it."
+  },
+  create: (context) => {
+    const tally = emptyRegistrations();
+    return {
+      CallExpression: (node) => {
+        readCall(context, node, tally);
+      },
+      'Property[key.name="providers"] > ArrayExpression': (node) => {
+        readProviders(context, node, tally);
+      },
+      "Program:exit": () => {
+        unregisteredInjections(tally).forEach(({ node, token }) => {
+          context.report({ node, messageId: "noUnregisteredInjectSpy", data: { token } });
+        });
+      }
+    };
+  }
+});
 var rules = {
   "prefer-provide-auto-spy": preferProvideAutoSpy,
   "prefer-create-spy-from-class": preferCreateSpyFromClass,
@@ -1127,7 +1221,8 @@ var rules = {
   "no-floating-assertion": noFloatingAssertion,
   "no-overridden-provider": noOverriddenProvider,
   "no-inject-before-override": noInjectBeforeOverride,
-  "no-import-time-spread": noImportTimeSpread
+  "no-import-time-spread": noImportTimeSpread,
+  "no-unregistered-inject-spy": noUnregisteredInjectSpy
 };
 
 // src/eslint-plugin.ts
@@ -1145,7 +1240,8 @@ var recommendedRules = {
   [`${PLUGIN_NAME}/no-floating-assertion`]: "error",
   [`${PLUGIN_NAME}/no-overridden-provider`]: "error",
   [`${PLUGIN_NAME}/no-inject-before-override`]: "warn",
-  [`${PLUGIN_NAME}/no-import-time-spread`]: "error"
+  [`${PLUGIN_NAME}/no-import-time-spread`]: "error",
+  [`${PLUGIN_NAME}/no-unregistered-inject-spy`]: "warn"
 };
 var plugin = {
   rules,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vitest-auto-spy",
-  "version": "3.9.0",
+  "version": "3.11.0",
   "description": "Auto-generate fully-typed test spies from a class — across Vitest, Bun and node:test, with Angular/NestJS/React/Vue/Svelte recipes. Drop-in replacement for jest-auto-spies.",
   "keywords": [
     "auto-mock",

package/skills/vitest-auto-spy/SKILL.md

@@ -238,7 +238,7 @@ npx vitest-auto-spy codemod --verify  # after a migration: anything the transfor
 Most of this library's guarantees are type-level, so a green run that does not type-check is not
 done. Report failures with their output rather than describing them as passing.
 
-**After any `eslint --fix` over specs, run `npx tsc --noEmit`.** The thirteen rules in
+**After any `eslint --fix` over specs, run `npx tsc --noEmit`.** The fourteen rules in
 `vitest-auto-spy/eslint-plugin` are lint, not typecheck: `no-mocked-for-spy` rewrites a declaration
 to `Spy<T>` and cannot see what the name is assigned two lines below, so a clean lint pass is not
 evidence that the types still hold. Where it cannot prove the rename it downgrades to a suggestion —