# @lssm-tech/tools.eslint-plugin-no-implicit-sensitivefields

ESLint rule enforcing that every defineReferenceKind() call declares an explicit sensitiveFields array (closes F-4).

## Source and release context

- Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498`
- Repository: `lssm-tech/contractspec`
- Declared package version: `2.0.4`
- Package path: `packages/tools/eslint-plugin-no-implicit-sensitivefields`
- Manifest path: `packages/tools/eslint-plugin-no-implicit-sensitivefields/package.json`
- Manifest Git blob: `9e78c3cd3f3f0c34508d2abd2c73ca28dd9d35c5`
- Manifest origin: pinned GitHub manifest fetch
- Manual: [@lssm-tech/tools.eslint-plugin-no-implicit-sensitivefields](https://lssm.co/docs/packages/tools.eslint-plugin-no-implicit-sensitivefields/)
- Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/)

This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review.

Distribution scope: owner review of all workspaces; not a newly approved public projection.

- [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/tools/eslint-plugin-no-implicit-sensitivefields)
- [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/tools/eslint-plugin-no-implicit-sensitivefields/package.json)
- [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/tools/eslint-plugin-no-implicit-sensitivefields/README.md)
- [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/tools.eslint-plugin-no-implicit-sensitivefields.txt)

## Package metadata

```json
{
  "layer": "tools",
  "physicalArea": null,
  "primaryArea": "tooling-and-agent-delivery",
  "classification": {
    "privateDeclared": null,
    "catalogFamily": "sharedLibs",
    "catalogKind": "tool",
    "catalogStatus": "active",
    "adoptionMode": "operator-only",
    "stability": "experimental"
  },
  "descriptionOrigin": "package.json",
  "manifestComplete": true,
  "publicationPolicyApplied": false
}
```

Manifest private flag: not declared; publication is not verified.

Primary area: [CLI, authoring and agent tooling](https://lssm.co/docs/areas/tooling-and-agent-delivery/)

## Package guide

```json
{
  "status": "available",
  "sourcePath": "packages/tools/eslint-plugin-no-implicit-sensitivefields/README.md",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/tools/eslint-plugin-no-implicit-sensitivefields/README.md",
  "blobSha": "8c4048cc6c61b7393c2d05c83263833ed144cba4",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "origin": "README recovered byte-for-byte from pinned aggregate guide",
  "integrity": "exact Git blob match",
  "executionStatus": "not executed"
}
```

The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations.

# @lssm-tech/tools.eslint-plugin-no-implicit-sensitivefields

ESLint plugin that enforces explicit `sensitiveFields` declarations on every `defineReferenceKind()` call from `@lssm-tech/lib.contracts-spec/rich-reference`.

Closes plan slice S-1b (architect NR-2 / F-4 mitigation): the contracts-spec runtime already throws when `sensitiveFields` is missing or non-array, but the runtime cannot enforce the additional repository policy that an empty array (`sensitiveFields: []`) must be accompanied by an inline confirmation comment. This rule catches both issues at lint time.

## Install

```bash
bun add -d @lssm-tech/tools.eslint-plugin-no-implicit-sensitivefields
```


`eslint` (>=8, <11) is a peer dependency.

## Flat config (ESLint 9+)

```js
import noImplicitSensitiveFields from '@lssm-tech/tools.eslint-plugin-no-implicit-sensitivefields';

export default [
  {
    plugins: { 'no-implicit-sensitivefields': noImplicitSensitiveFields },
    rules: { 'no-implicit-sensitivefields/no-implicit-sensitivefields': 'error' },
  },
];
```


Or apply the bundled `recommended` flat config in one line:

```js
import { configs } from '@lssm-tech/tools.eslint-plugin-no-implicit-sensitivefields';

export default [configs.recommended];
```


## What the rule does

For every call expression whose callee is `defineReferenceKind` (or `<obj>.defineReferenceKind`):

1. If the object literal argument lacks a `sensitiveFields` property → reports `missing`.
2. If `sensitiveFields: []` appears without a nearby comment containing `confirmed: no sensitive fields` → reports `emptyWithoutComment`.

A "nearby" comment is one whose line number is within ±1 line of the `sensitiveFields` property — covering the common authoring shapes: a leading comment, a same-line trailing comment, or an in-block comment immediately after.

### Valid

```ts
defineReferenceKind({
  id: 'ticket',
  schema,
  sensitiveFields: ['title'],
  defaultPreview: 'inline-card',
  defaultPanel: 'drawer',
  icon: 'ticket',
});

defineReferenceKind({
  id: 'public-doc',
  schema,
  // confirmed: no sensitive fields
  sensitiveFields: [],
  defaultPreview: 'inline-card',
  defaultPanel: 'drawer',
  icon: 'doc',
});

defineReferenceKind({
  id: 'public-doc-2',
  schema,
  sensitiveFields: [], // confirmed: no sensitive fields
  defaultPreview: 'inline-card',
  defaultPanel: 'drawer',
  icon: 'doc',
});
```


### Invalid

```ts
// Missing sensitiveFields entirely
defineReferenceKind({
  id: 'bad-1',
  schema,
  defaultPreview: 'inline-card',
  defaultPanel: 'drawer',
  icon: 'bad',
}); // error: missing

// Empty list without the confirmation marker
defineReferenceKind({
  id: 'bad-2',
  schema,
  sensitiveFields: [],
  defaultPreview: 'inline-card',
  defaultPanel: 'drawer',
  icon: 'bad',
}); // error: emptyWithoutComment
```


## Test

```bash
bun test
```



## Declared capabilities

This manifest does not declare a capability catalogue. Assess the package using its guide, import map and source.

## Catalogue metadata

```json
{
  "family": "sharedLibs",
  "kind": "tool",
  "status": "active",
  "adoptionMode": "operator-only",
  "stability": "experimental",
  "platforms": [
    "server"
  ],
  "runtimes": [
    "node"
  ],
  "entrypoints": [
    ".",
    "./rule"
  ],
  "examples": [],
  "replacements": [],
  "nonAdoptableRationale": "This tool is published for execution by operators, not as a reusable library dependency."
}
```

## Canonical imports

Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference.

```json
[]
```

## Declared export entry points

Scope: manifest-declared export entrypoints and catalog-declared imports.

Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted.

Installation status: not verified.

- `@lssm-tech/tools.eslint-plugin-no-implicit-sensitivefields` — subpath `.`
  - `unconditional`: `./src/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/tools/eslint-plugin-no-implicit-sensitivefields/src/index.ts); verified source file.

- `@lssm-tech/tools.eslint-plugin-no-implicit-sensitivefields/rule` — subpath `./rule`
  - `unconditional`: `./src/rule.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/tools/eslint-plugin-no-implicit-sensitivefields/src/rule.ts); verified source file.

## Package publication metadata

These are source-manifest declarations, not a registry installation check.

```json
{
  "types": "./dist/index.d.ts",
  "files": [
    "dist",
    "README.md"
  ],
  "publishExports": {
    ".": {
      "types": "./dist/index.d.ts",
      "browser": "./dist/browser/index.js",
      "bun": "./dist/index.js",
      "node": "./dist/node/index.js",
      "default": "./dist/index.js"
    },
    "./rule": {
      "types": "./dist/rule.d.ts",
      "browser": "./dist/browser/rule.js",
      "bun": "./dist/rule.js",
      "node": "./dist/node/rule.js",
      "default": "./dist/rule.js"
    }
  }
}
```

## Dependencies

Metadata status: complete pinned manifest.

### Runtime dependencies

No declarations in the inspected manifest.

### Peer dependencies

- `eslint`: `>=10.10.0`

### Optional dependencies

No declarations in the inspected manifest.

### Development dependencies

- [@lssm-tech/tool.bun](https://lssm.co/docs/packages/tool.bun/): `workspace:*`
- [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*`
- `@types/estree`: `^1.0.9`
- `eslint`: `^10.10.0`
- `typescript`: `catalog:`

### Peer dependency metadata

```json
{}
```

### Bundled dependencies

```json
null
```

## Package scripts

Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest.

```json
{
  "build": "contractspec-bun-build build",
  "build:bundle": "contractspec-bun-build transpile",
  "build:types": "contractspec-bun-build types",
  "clean": "rimraf dist .turbo",
  "lint": "bun run lint:fix",
  "lint:fix": "node ../../../scripts/biome.cjs check --write --unsafe --only=nursery/useSortedClasses . && node ../../../scripts/biome.cjs check --write .",
  "lint:check": "node ../../../scripts/biome.cjs check .",
  "test": "bun test",
  "typecheck": "tsgo --noEmit",
  "prebuild": "contractspec-bun-build prebuild"
}
```

## Declared documentation links

- [Tools Eslint Plugin No Implicit Sensitivefields documentation](https://www.npmjs.com/package/%40lssm-tech%2Ftools.eslint-plugin-no-implicit-sensitivefields) — declared link; destination not verified.

```json
{
  "url": "https://www.npmjs.com/package/%40lssm-tech%2Ftools.eslint-plugin-no-implicit-sensitivefields",
  "kind": "readme"
}
```

## Existing agent-guide projection

```json
{
  "path": "packages/apps/web-landing/public/llms-packages/tools.eslint-plugin-no-implicit-sensitivefields.txt",
  "route": "/llms/tools.eslint-plugin-no-implicit-sensitivefields",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/tools.eslint-plugin-no-implicit-sensitivefields.txt",
  "blobSha": "8c4048cc6c61b7393c2d05c83263833ed144cba4",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "bodyEqualsReadme": true,
  "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt",
  "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf"
}
```