improvement(audits): follow aliased persist imports, require strict !== for filterUndefined, state the .with scope

Author: waleedlatif1

.claude/rules/sim-react-performance.md

@@ -77,7 +77,7 @@ return items.sort(compare)
 return [...items].sort(compare)
 ```
 
-**Do NOT use `toSorted()` / `toReversed()` / `with()` / `toSpliced()`.** They are ES2023 *runtime* methods — and a tsconfig `"lib": ["ES2023"]` only makes them **type-check**, it does not make them **run**. Next/SWC compiles syntax but does **not** polyfill prototype methods, and the default browserslist still includes browsers without them (`toSorted` landed in Safari 16 / iOS 16, so any device capped at iOS 15 throws `TypeError: x.toSorted is not a function` and crashes the page). The perf difference vs `[...arr].sort()` is negligible (both allocate one array), so the copy-then-sort form is used everywhere: whether a module reaches the browser is not visible from its path, and `check:utils` bans the methods repo-wide.
+**Do NOT use `toSorted()` / `toReversed()` / `with()` / `toSpliced()`.** They are ES2023 *runtime* methods — and a tsconfig `"lib": ["ES2023"]` only makes them **type-check**, it does not make them **run**. Next/SWC compiles syntax but does **not** polyfill prototype methods, and the default browserslist still includes browsers without them (`toSorted` landed in Safari 16 / iOS 16, so any device capped at iOS 15 throws `TypeError: x.toSorted is not a function` and crashes the page). The perf difference vs `[...arr].sort()` is negligible (both allocate one array), so the copy-then-sort form is used everywhere: whether a module reaches the browser is not visible from its path. `check:utils` flags `toSorted`/`toReversed`/`toSpliced` repo-wide and `with` when called with a numeric index (an identifier index is indistinguishable from OpenTelemetry's `context.with`).
 
 ## Run independent awaits in parallel
 

.cursor/rules/sim-react-performance.mdc

@@ -80,7 +80,7 @@ return items.sort(compare)
 return [...items].sort(compare)
 ```
 
-**Do NOT use `toSorted()` / `toReversed()` / `with()` / `toSpliced()`.** They are ES2023 *runtime* methods — and a tsconfig `"lib": ["ES2023"]` only makes them **type-check**, it does not make them **run**. Next/SWC compiles syntax but does **not** polyfill prototype methods, and the default browserslist still includes browsers without them (`toSorted` landed in Safari 16 / iOS 16, so any device capped at iOS 15 throws `TypeError: x.toSorted is not a function` and crashes the page). The perf difference vs `[...arr].sort()` is negligible (both allocate one array), so the copy-then-sort form is used everywhere: whether a module reaches the browser is not visible from its path, and `check:utils` bans the methods repo-wide.
+**Do NOT use `toSorted()` / `toReversed()` / `with()` / `toSpliced()`.** They are ES2023 *runtime* methods — and a tsconfig `"lib": ["ES2023"]` only makes them **type-check**, it does not make them **run**. Next/SWC compiles syntax but does **not** polyfill prototype methods, and the default browserslist still includes browsers without them (`toSorted` landed in Safari 16 / iOS 16, so any device capped at iOS 15 throws `TypeError: x.toSorted is not a function` and crashes the page). The perf difference vs `[...arr].sort()` is negligible (both allocate one array), so the copy-then-sort form is used everywhere: whether a module reaches the browser is not visible from its path. `check:utils` flags `toSorted`/`toReversed`/`toSpliced` repo-wide and `with` when called with a numeric index (an identifier index is indistinguishable from OpenTelemetry's `context.with`).
 
 ## Run independent awaits in parallel
 

scripts/check-utils-enforcement.ts

@@ -109,7 +109,7 @@ const BANNED_PATTERNS: Array<{
   },
   {
     pattern:
-      /Object\.fromEntries\(\s*Object\.entries\([^()]*\)\s*\.filter\(\s*\(\[\s*\w*\s*,\s*(\w+)\s*\]\)\s*=>\s*\1\s*!==?\s*undefined\s*\)\s*,?\s*\)/g,
+      /Object\.fromEntries\(\s*Object\.entries\([^()]*\)\s*\.filter\(\s*\(\[\s*\w*\s*,\s*(\w+)\s*\]\)\s*=>\s*\1\s*!==\s*undefined\s*\)\s*,?\s*\)/g,
     description: 'Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== undefined))',
     suggestion: 'filterUndefined(obj) from @sim/utils/object',
     prefilter: FROM_ENTRIES,

scripts/check-zustand-v5-selectors.ts

@@ -294,23 +294,23 @@ function auditFile(file: string, source: string): Violation[] {
   return violations
 }
 
-/** A `persist(` middleware call; `.persist(` (an instance method) is excluded. */
-const PERSIST_CALL_PATTERN = /(?<![.\w$])persist\s*(?:<[^()]*?>)?\s*\(/g
+/** The local name `persist` is imported under from `zustand/middleware`, including an alias. */
+const PERSIST_IMPORT =
+  /import\s*\{[^}]*\bpersist\b(?:\s+as\s+(\w+))?[^}]*\}\s*from\s*'zustand\/middleware'/
 
 /**
  * `.claude/rules/sim-stores.md`: every `persist` names its durable fields in `partialize`.
  * Without one, zustand writes the whole state — transient flags, drag state, `_hasHydrated` —
  * to storage and rehydrates it on the next load.
  */
 function auditPersist(file: string, source: string): Violation[] {
-  if (!/import\s*\{[^}]*\bpersist\b[^}]*\}\s*from\s*'zustand\/middleware'/.test(source)) return []
+  const persistImport = PERSIST_IMPORT.exec(source)
+  if (!persistImport) return []
+  const local = persistImport[1] ?? 'persist'
+  /** A call of the imported middleware; `.persist(` (an instance method) is excluded. */
+  const persistCall = new RegExp(`(?<![.\\w$])${local}\\s*(?:<[^()]*?>)?\\s*\\(`, 'g')
   const violations: Violation[] = []
-  PERSIST_CALL_PATTERN.lastIndex = 0
-  for (
-    let match = PERSIST_CALL_PATTERN.exec(source);
-    match;
-    match = PERSIST_CALL_PATTERN.exec(source)
-  ) {
+  for (let match = persistCall.exec(source); match; match = persistCall.exec(source)) {
     if (hasSafeAnnotation(source, match.index)) continue
     const openParenIndex = match.index + match[0].length - 1
     const closeParenIndex = findMatchingParen(source, openParenIndex)