@aicqtools/guardrail 1.0.0-alpha.10

package/dist/rules-default/no-default-export-from-libs.js

@@ -0,0 +1,24 @@
+import { defineRule } from '@aicqtools/rule-sdk';
+/**
+ * Inside a `libs/` or `packages/` directory, prefer named exports for tree-shaking
+ * and clearer intent. `export default` makes refactoring/renaming harder across consumers.
+ */
+export default defineRule({
+    id: 'no-default-export-from-libs',
+    language: ['typescript', 'javascript', 'tsx'],
+    severity: 'warning',
+    message: 'Use named exports from libraries (default exports hinder tree-shaking and renames).',
+    messageKo: '라이브러리는 named export를 사용하세요 (default export는 tree-shaking·이름 변경에 불리).',
+    visitors: {
+        export_statement(node, ctx) {
+            // Only flag `export default ...` patterns inside lib/package directories
+            if (!/(^|[/\\])(libs?|packages)[/\\]/.test(ctx.filePath))
+                return;
+            const text = ctx.textOf(node);
+            if (text.startsWith('export default ')) {
+                ctx.report({ node });
+            }
+        },
+    },
+});
+//# sourceMappingURL=no-default-export-from-libs.js.map

package/dist/rules-default/no-default-export-from-libs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-default-export-from-libs.js","sourceRoot":"","sources":["../../src/rules-default/no-default-export-from-libs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD;;;GAGG;AACH,eAAe,UAAU,CAAC;IACxB,EAAE,EAAE,6BAA6B;IACjC,QAAQ,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;IAC7C,QAAQ,EAAE,SAAS;IACnB,OAAO,EAAE,qFAAqF;IAC9F,SAAS,EAAE,sEAAsE;IACjF,QAAQ,EAAE;QACR,gBAAgB,CAAC,IAAI,EAAE,GAAG;YACxB,yEAAyE;YACzE,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO;YACjE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;KACF;CACF,CAAC,CAAC"}

package/dist/rules-default/no-direct-anthropic.yaml

@@ -0,0 +1,15 @@
+id: no-direct-anthropic
+language: typescript
+severity: error
+message: Use the llmClient singleton. Direct Anthropic instantiation is forbidden.
+messageKo: llmClient 싱글톤을 사용하세요. 직접 Anthropic 인스턴스화는 금지입니다.
+# Allow the designated LLM wrapper module to construct the SDK once. Conventions only —
+# add an inline `// aicq-disable-next-line no-direct-anthropic` outside these paths.
+pathExclude:
+  - '**/llm/client.*'
+  - '**/llm/index.*'
+  - '**/ai/**/*client*.*'
+query: |
+  (new_expression
+    constructor: (identifier) @ctor
+    (#eq? @ctor "Anthropic"))

package/dist/rules-default/no-direct-openai.yaml

@@ -0,0 +1,17 @@
+id: no-direct-openai
+language: typescript
+severity: error
+message: Use the llmClient singleton. Direct OpenAI instantiation is forbidden.
+messageKo: llmClient 싱글톤을 사용하세요. 직접 OpenAI 인스턴스화는 금지입니다.
+# Allow the *designated* LLM wrapper module to construct the SDK once. Conventions only —
+# the project structures `src/**/llm/{client,index}.ts` or `src/**/ai/**/{*client*}.ts`
+# as the single permitted call-site. Add an inline `// aicq-disable-next-line no-direct-openai`
+# for one-off exceptions outside these paths.
+pathExclude:
+  - '**/llm/client.*'
+  - '**/llm/index.*'
+  - '**/ai/**/*client*.*'
+query: |
+  (new_expression
+    constructor: (identifier) @ctor
+    (#eq? @ctor "OpenAI"))

package/dist/rules-default/no-empty-catch.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@aicqtools/rule-sdk").FunctionRule;
+export default _default;
+//# sourceMappingURL=no-empty-catch.d.ts.map

package/dist/rules-default/no-empty-catch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-empty-catch.d.ts","sourceRoot":"","sources":["../../src/rules-default/no-empty-catch.ts"],"names":[],"mappings":";AAYA,wBAsBG"}

package/dist/rules-default/no-empty-catch.js

@@ -0,0 +1,37 @@
+import { defineRule } from '@aicqtools/rule-sdk';
+/**
+ * Forbids empty catch blocks. At minimum, log or rethrow.
+ * Catches the silent-failure anti-pattern that masks bugs.
+ *
+ * Skip: Capacitor's `native-bridge.{js,ts}` and PWA `service-worker.{js,ts}` regularly
+ * swallow exceptions on purpose (the bridge/SW must never crash the host). The rule still
+ * fires elsewhere on the same files via other lints.
+ */
+const SKIP_FILE_RE = /[/\\](native-bridge|service-worker)\.[jt]sx?$/;
+export default defineRule({
+    id: 'no-empty-catch',
+    language: ['typescript', 'javascript', 'tsx'],
+    severity: 'error',
+    message: 'catch block must not be empty — log or rethrow.',
+    messageKo: 'catch 블록은 비어 있을 수 없습니다 — log하거나 rethrow하세요.',
+    visitors: {
+        catch_clause(node, ctx) {
+            if (SKIP_FILE_RE.test(ctx.filePath))
+                return;
+            const body = node.childForFieldName('body');
+            if (!body)
+                return;
+            let hasStmt = false;
+            for (let i = 0; i < body.namedChildCount; i++) {
+                const child = body.namedChild(i);
+                if (child && child.type !== 'comment') {
+                    hasStmt = true;
+                    break;
+                }
+            }
+            if (!hasStmt)
+                ctx.report({ node });
+        },
+    },
+});
+//# sourceMappingURL=no-empty-catch.js.map

package/dist/rules-default/no-empty-catch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-empty-catch.js","sourceRoot":"","sources":["../../src/rules-default/no-empty-catch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG,+CAA+C,CAAC;AAErE,eAAe,UAAU,CAAC;IACxB,EAAE,EAAE,gBAAgB;IACpB,QAAQ,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;IAC7C,QAAQ,EAAE,OAAO;IACjB,OAAO,EAAE,iDAAiD;IAC1D,SAAS,EAAE,6CAA6C;IACxD,QAAQ,EAAE;QACR,YAAY,CAAC,IAAI,EAAE,GAAG;YACpB,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACtC,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO;gBAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;KACF;CACF,CAAC,CAAC"}

package/dist/rules-default/no-fstring-sql.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@aicqtools/rule-sdk").FunctionRule;
+export default _default;
+//# sourceMappingURL=no-fstring-sql.d.ts.map

package/dist/rules-default/no-fstring-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-fstring-sql.d.ts","sourceRoot":"","sources":["../../src/rules-default/no-fstring-sql.ts"],"names":[],"mappings":";AAIA,wBAiBG"}

package/dist/rules-default/no-fstring-sql.js

@@ -0,0 +1,24 @@
+import { defineRule } from '@aicqtools/rule-sdk';
+const SQL_KEYWORD_PATTERN = /\b(SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|JOIN|VALUES)\b/i;
+export default defineRule({
+    id: 'no-fstring-sql',
+    language: 'python',
+    severity: 'error',
+    message: 'SQL inside f-string is a SQL injection vector — use parameterized queries.',
+    messageKo: 'f-string으로 SQL 조합은 SQL 주입 위험 — 파라미터 바인딩을 사용하세요.',
+    visitors: {
+        string(node, ctx) {
+            const text = ctx.textOf(node);
+            // Python f-string starts with f" or f' (or rf", fr", etc.)
+            if (!/^[a-zA-Z]*[fF][a-zA-Z]*['"]/.test(text))
+                return;
+            if (!SQL_KEYWORD_PATTERN.test(text))
+                return;
+            // Has interpolation `{...}`?
+            if (!/\{[^{}]+\}/.test(text))
+                return;
+            ctx.report({ node });
+        },
+    },
+});
+//# sourceMappingURL=no-fstring-sql.js.map

package/dist/rules-default/no-fstring-sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-fstring-sql.js","sourceRoot":"","sources":["../../src/rules-default/no-fstring-sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,MAAM,mBAAmB,GAAG,2DAA2D,CAAC;AAExF,eAAe,UAAU,CAAC;IACxB,EAAE,EAAE,gBAAgB;IACpB,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,OAAO;IACjB,OAAO,EAAE,4EAA4E;IACrF,SAAS,EAAE,iDAAiD;IAC5D,QAAQ,EAAE;QACR,MAAM,CAAC,IAAI,EAAE,GAAG;YACd,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9B,2DAA2D;YAC3D,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO;YACtD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC5C,6BAA6B;YAC7B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO;YACrC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACvB,CAAC;KACF;CACF,CAAC,CAAC"}

package/dist/rules-default/no-id-overwrite.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Forbid assignment to `<obj>.id`. IDs should be immutable after creation.
+ * Catches a common class of bugs where IDs are overwritten after creation
+ * (e.g. a record's id field reassigned to a child entity's id).
+ */
+declare const _default: import("@aicqtools/rule-sdk").FunctionRule;
+export default _default;
+//# sourceMappingURL=no-id-overwrite.d.ts.map

package/dist/rules-default/no-id-overwrite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-id-overwrite.d.ts","sourceRoot":"","sources":["../../src/rules-default/no-id-overwrite.ts"],"names":[],"mappings":"AAEA;;;;GAIG;;AACH,wBAiBG"}

package/dist/rules-default/no-id-overwrite.js

@@ -0,0 +1,27 @@
+import { defineRule } from '@aicqtools/rule-sdk';
+/**
+ * Forbid assignment to `<obj>.id`. IDs should be immutable after creation.
+ * Catches a common class of bugs where IDs are overwritten after creation
+ * (e.g. a record's id field reassigned to a child entity's id).
+ */
+export default defineRule({
+    id: 'no-id-overwrite',
+    language: ['typescript', 'javascript', 'tsx'],
+    severity: 'error',
+    message: 'Do not reassign `.id`. IDs are immutable after creation.',
+    messageKo: '`.id` 필드는 생성 후 재할당하지 마세요. ID는 불변이어야 합니다.',
+    visitors: {
+        assignment_expression(node, ctx) {
+            const left = node.childForFieldName('left');
+            if (!left || left.type !== 'member_expression')
+                return;
+            const property = left.childForFieldName('property');
+            if (!property)
+                return;
+            if (ctx.textOf(property) === 'id') {
+                ctx.report({ node });
+            }
+        },
+    },
+});
+//# sourceMappingURL=no-id-overwrite.js.map

package/dist/rules-default/no-id-overwrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-id-overwrite.js","sourceRoot":"","sources":["../../src/rules-default/no-id-overwrite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD;;;;GAIG;AACH,eAAe,UAAU,CAAC;IACxB,EAAE,EAAE,iBAAiB;IACrB,QAAQ,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;IAC7C,QAAQ,EAAE,OAAO;IACjB,OAAO,EAAE,0DAA0D;IACnE,SAAS,EAAE,0CAA0C;IACrD,QAAQ,EAAE;QACR,qBAAqB,CAAC,IAAI,EAAE,GAAG;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;gBAAE,OAAO;YACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ;gBAAE,OAAO;YACtB,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;KACF;CACF,CAAC,CAAC"}

package/dist/rules-default/no-inline-date.yaml

@@ -0,0 +1,9 @@
+id: no-inline-date
+language: typescript
+severity: warning
+message: Avoid inline `new Date()` calls; use dateHelper for testable, timezone-aware dates.
+messageKo: 인라인 `new Date()` 호출 금지. 테스트 가능·타임존 인식을 위해 dateHelper를 사용하세요.
+query: |
+  (new_expression
+    constructor: (identifier) @ctor
+    (#eq? @ctor "Date")) @call

package/dist/rules-default/no-inline-math-round.yaml

@@ -0,0 +1,12 @@
+id: no-inline-math-round
+language: typescript
+severity: warning
+message: Avoid inline Math.round; use mathHelper for consistent rounding rules.
+messageKo: Math.round 인라인 사용 금지. 일관된 반올림 규칙을 위해 mathHelper를 사용하세요.
+query: |
+  (call_expression
+    function: (member_expression
+      object: (identifier) @obj
+      property: (property_identifier) @prop)
+    (#eq? @obj "Math")
+    (#eq? @prop "round")) @call

package/dist/rules-default/no-jsonb-circular.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@aicqtools/rule-sdk").FunctionRule;
+export default _default;
+//# sourceMappingURL=no-jsonb-circular.d.ts.map

package/dist/rules-default/no-jsonb-circular.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-jsonb-circular.d.ts","sourceRoot":"","sources":["../../src/rules-default/no-jsonb-circular.ts"],"names":[],"mappings":";AASA,wBAoBG"}

package/dist/rules-default/no-jsonb-circular.js

@@ -0,0 +1,33 @@
+import { defineRule } from '@aicqtools/rule-sdk';
+/**
+ * Heuristic: when `JSON.stringify(...)` is called on a value whose name suggests
+ * a request/response/model object (likely to contain circular references via ORM
+ * relations), warn. Encourages the explicit `safeStringify` or `replacer` patterns.
+ */
+const SUSPICIOUS_NAME_PATTERN = /^(req|res|request|response|model|instance|entity|record|row|user|order|product|item)$/i;
+export default defineRule({
+    id: 'no-jsonb-circular',
+    language: ['typescript', 'javascript', 'tsx'],
+    severity: 'warning',
+    message: 'JSON.stringify on ORM/request/response objects may hit circular references — use safeStringify or pick fields explicitly.',
+    messageKo: 'ORM/요청/응답 객체에 JSON.stringify는 순환 참조 위험 — safeStringify 또는 명시적 필드 선택 권장.',
+    visitors: {
+        call_expression(node, ctx) {
+            const fn = node.childForFieldName('function');
+            if (!fn)
+                return;
+            if (ctx.textOf(fn) !== 'JSON.stringify')
+                return;
+            const args = node.childForFieldName('arguments');
+            if (!args || args.namedChildCount === 0)
+                return;
+            const first = args.namedChild(0);
+            if (!first || first.type !== 'identifier')
+                return;
+            if (SUSPICIOUS_NAME_PATTERN.test(ctx.textOf(first))) {
+                ctx.report({ node });
+            }
+        },
+    },
+});
+//# sourceMappingURL=no-jsonb-circular.js.map

package/dist/rules-default/no-jsonb-circular.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-jsonb-circular.js","sourceRoot":"","sources":["../../src/rules-default/no-jsonb-circular.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,wFAAwF,CAAC;AAEzH,eAAe,UAAU,CAAC;IACxB,EAAE,EAAE,mBAAmB;IACvB,QAAQ,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;IAC7C,QAAQ,EAAE,SAAS;IACnB,OAAO,EAAE,2HAA2H;IACpI,SAAS,EAAE,yEAAyE;IACpF,QAAQ,EAAE;QACR,eAAe,CAAC,IAAI,EAAE,GAAG;YACvB,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,EAAE;gBAAE,OAAO;YAChB,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,gBAAgB;gBAAE,OAAO;YAChD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,KAAK,CAAC;gBAAE,OAAO;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO;YAClD,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpD,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;KACF;CACF,CAAC,CAAC"}

package/dist/rules-default/no-magic-number.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@aicqtools/rule-sdk").FunctionRule;
+export default _default;
+//# sourceMappingURL=no-magic-number.d.ts.map

package/dist/rules-default/no-magic-number.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-magic-number.d.ts","sourceRoot":"","sources":["../../src/rules-default/no-magic-number.ts"],"names":[],"mappings":";AA6HA,wBAiBG"}

package/dist/rules-default/no-magic-number.js

@@ -0,0 +1,145 @@
+import { defineRule } from '@aicqtools/rule-sdk';
+/**
+ * `no-magic-number` — info-severity rule that flags numeric literals appearing inline in
+ * application code (rather than being given a named constant). The hardest part is choosing
+ * a defensible default for "what's NOT a magic number." This rule errs on the side of fewer
+ * false positives because it ships at `info` severity and historically dominates noise budgets.
+ *
+ * Skipped contexts (all heuristic; project-specific tuning belongs in a future per-rule
+ * options seam):
+ * - Test fixture / spec files (filename heuristic)
+ * - `*.config.{ts,tsx,js,jsx}`, `*.polyfill.{ts,tsx,js,jsx}`, `**\/polyfills/**` (filename)
+ * - Database migrations / seeders / fixtures directories (alpha.8) — these are data files where
+ *   numeric literals are the payload, not magic numbers. Other rules (e.g. camelcase-migration-column)
+ *   keep firing on the same files because this skip is scoped to no-magic-number only.
+ * - Variable declarator RHS (`const X = 7;` — 7 is being NAMED, not used inline)
+ * - JSX attribute values (`<View width={24} />`)
+ * - Enum members (`enum E { A = 7 }`)
+ * - Array index subscripts (`arr[42]`)
+ * - `for` loop initializer/condition/update
+ * - Arguments to obvious numeric APIs (`parseInt(s, 16)`, `Math.*`, `Number(...)`, `.toFixed(2)`,
+ *   `.padStart(8, '0')`, `setTimeout(f, 100)`, `setInterval(f, 1000)`)
+ * - "Timeout-ish" variable-name contexts (carried over from alpha.6)
+ *
+ * Allowed-numbers default extended to common-sense values: powers of two, common bases,
+ * time/clock constants, etc.
+ */
+const ALLOWED_NUMBERS = new Set([
+    '0', '1', '-1', '2', '-2', '10', '16', '24', '60', '100', '1000', '1024',
+]);
+const SKIP_FILE_RE = /(\.test\.|\.spec\.|__tests__|fixtures|\.config\.|\.polyfill\.|[/\\]polyfills[/\\]|[/\\]seeders[/\\]|[/\\]migrations[/\\]|[/\\](scripts|tools|bin)[/\\]|[/\\](native-bridge|service-worker)\.[jt]sx?$)/;
+// Callee names whose numeric args are almost always intentional, not magic numbers.
+// Matched on the leaf identifier (last name segment) — covers both `parseInt(...)` and
+// `Number.parseInt(...)` / `globalThis.setTimeout(...)`.
+const NUMERIC_API_CALLEES = new Set([
+    'parseInt', 'parseFloat', 'Number',
+    'setTimeout', 'setInterval', 'setImmediate',
+    'toFixed', 'toPrecision', 'toExponential', 'toString',
+    'padStart', 'padEnd', 'repeat', 'slice', 'substr', 'substring', 'charAt', 'codePointAt',
+    'round', 'floor', 'ceil', 'trunc', 'abs', 'sign', 'min', 'max', 'pow', 'log',
+]);
+function isInSkippedFile(filePath) {
+    return SKIP_FILE_RE.test(filePath);
+}
+function isInTimeoutMsContext(node, textOf) {
+    // Allow magic numbers in obvious time/duration contexts where the unit is in the variable name.
+    let parent = node.parent;
+    while (parent) {
+        const text = textOf(parent);
+        if (/timeout|interval|duration|delay|ms|sec|hour|day/i.test(text.slice(0, 40)))
+            return true;
+        if (parent.type === 'function_declaration' || parent.type === 'method_definition')
+            break;
+        parent = parent.parent;
+    }
+    return false;
+}
+const SKIP_ANCESTOR_TYPES = new Set([
+    // Variable declarator: `const RETRY = 5;` — the literal IS the named constant we want.
+    'variable_declarator',
+    // Enum members: `enum E { A = 7 }`
+    'enum_body',
+    'enum_assignment',
+    // JSX attribute values: `<View width={24} />`
+    'jsx_attribute',
+    'jsx_expression',
+    // Array index subscripts: `arr[42]`
+    'subscript_expression',
+    // For loop header: `for (let i = 0; i < 5; i++) {}`
+    'for_statement',
+    'for_in_statement',
+    'for_of_statement',
+]);
+function hasSkippableAncestor(node) {
+    let parent = node.parent;
+    let depth = 0;
+    while (parent && depth < 8) {
+        if (SKIP_ANCESTOR_TYPES.has(parent.type))
+            return true;
+        // Stop at clear statement / function boundaries so a number deep in a function body
+        // doesn't get silently allowed by a far-away for-loop ancestor.
+        if (parent.type === 'statement_block' ||
+            parent.type === 'function_declaration' ||
+            parent.type === 'method_definition' ||
+            parent.type === 'arrow_function' ||
+            parent.type === 'function_expression') {
+            return false;
+        }
+        parent = parent.parent;
+        depth += 1;
+    }
+    return false;
+}
+/**
+ * Returns true if the number is a positional argument to a call expression whose final
+ * identifier is a known numeric API (parseInt, parseFloat, Math.*, .toFixed, …).
+ */
+function isArgOfNumericApi(node, textOf) {
+    const parent = node.parent;
+    if (!parent || parent.type !== 'arguments')
+        return false;
+    const callExpr = parent.parent;
+    if (!callExpr || callExpr.type !== 'call_expression')
+        return false;
+    const fn = callExpr.childForFieldName('function');
+    if (!fn)
+        return false;
+    // Pull out the *final* name segment whether the callee is `foo` or `Obj.foo` or `a.b.foo`.
+    let nameNode = fn;
+    while (nameNode && (nameNode.type === 'member_expression' || nameNode.type === 'parenthesized_expression')) {
+        const fromField = nameNode.childForFieldName('property');
+        const fallback = nameNode.namedChildren[nameNode.namedChildren.length - 1];
+        const prop = fromField ?? fallback ?? null;
+        if (!prop || prop === nameNode)
+            break;
+        nameNode = prop;
+    }
+    if (!nameNode)
+        return false;
+    const name = textOf(nameNode);
+    return NUMERIC_API_CALLEES.has(name);
+}
+export default defineRule({
+    id: 'no-magic-number',
+    language: ['typescript', 'javascript', 'tsx'],
+    severity: 'info',
+    message: 'Magic number — extract to a named constant for clarity.',
+    messageKo: '매직 넘버 — 명명된 상수로 추출해 의미를 명확히 하세요.',
+    visitors: {
+        number(node, ctx) {
+            if (isInSkippedFile(ctx.filePath))
+                return;
+            const text = ctx.textOf(node);
+            if (ALLOWED_NUMBERS.has(text))
+                return;
+            if (hasSkippableAncestor(node))
+                return;
+            if (isArgOfNumericApi(node, ctx.textOf))
+                return;
+            if (isInTimeoutMsContext(node, ctx.textOf))
+                return;
+            ctx.report({ node });
+        },
+    },
+});
+//# sourceMappingURL=no-magic-number.js.map

package/dist/rules-default/no-magic-number.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-magic-number.js","sourceRoot":"","sources":["../../src/rules-default/no-magic-number.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;CACzE,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,uMAAuM,CAAC;AAE7N,oFAAoF;AACpF,uFAAuF;AACvF,yDAAyD;AACzD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,UAAU,EAAE,YAAY,EAAE,QAAQ;IAClC,YAAY,EAAE,aAAa,EAAE,cAAc;IAC3C,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU;IACrD,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa;IACvF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CAC7E,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAuB,EAAE,MAAwC;IAC7F,gGAAgG;IAChG,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzB,OAAO,MAAM,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,kDAAkD,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAsB,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB;YAAE,MAAM;QACzF,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,uFAAuF;IACvF,qBAAqB;IACrB,mCAAmC;IACnC,WAAW;IACX,iBAAiB;IACjB,8CAA8C;IAC9C,eAAe;IACf,gBAAgB;IAChB,oCAAoC;IACpC,sBAAsB;IACtB,oDAAoD;IACpD,eAAe;IACf,kBAAkB;IAClB,kBAAkB;CACnB,CAAC,CAAC;AAEH,SAAS,oBAAoB,CAAC,IAAuB;IACnD,IAAI,MAAM,GAA6B,IAAI,CAAC,MAAM,CAAC;IACnD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3B,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,oFAAoF;QACpF,gEAAgE;QAChE,IACE,MAAM,CAAC,IAAI,KAAK,iBAAiB;YACjC,MAAM,CAAC,IAAI,KAAK,sBAAsB;YACtC,MAAM,CAAC,IAAI,KAAK,mBAAmB;YACnC,MAAM,CAAC,IAAI,KAAK,gBAAgB;YAChC,MAAM,CAAC,IAAI,KAAK,qBAAqB,EACrC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAuB,EAAE,MAAwC;IAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACnE,MAAM,EAAE,GAAG,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,2FAA2F;IAC3F,IAAI,QAAQ,GAA6B,EAAE,CAAC;IAC5C,OAAO,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,mBAAmB,IAAI,QAAQ,CAAC,IAAI,KAAK,0BAA0B,CAAC,EAAE,CAAC;QAC3G,MAAM,SAAS,GAA6B,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAkC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1G,MAAM,IAAI,GAA6B,SAAS,IAAI,QAAQ,IAAI,IAAI,CAAC;QACrE,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM;QACtC,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,eAAe,UAAU,CAAC;IACxB,EAAE,EAAE,iBAAiB;IACrB,QAAQ,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;IAC7C,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,yDAAyD;IAClE,SAAS,EAAE,kCAAkC;IAC7C,QAAQ,EAAE;QACR,MAAM,CAAC,IAAI,EAAE,GAAG;YACd,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO;YAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO;YACtC,IAAI,oBAAoB,CAAC,IAAI,CAAC;gBAAE,OAAO;YACvC,IAAI,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO;YAChD,IAAI,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO;YACnD,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACvB,CAAC;KACF;CACF,CAAC,CAAC"}

package/dist/rules-default/no-mutable-default-arg.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@aicqtools/rule-sdk").FunctionRule;
+export default _default;
+//# sourceMappingURL=no-mutable-default-arg.d.ts.map

package/dist/rules-default/no-mutable-default-arg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-mutable-default-arg.d.ts","sourceRoot":"","sources":["../../src/rules-default/no-mutable-default-arg.ts"],"names":[],"mappings":";AAOA,wBAsBG"}

package/dist/rules-default/no-mutable-default-arg.js

@@ -0,0 +1,30 @@
+import { defineRule } from '@aicqtools/rule-sdk';
+function isMutableLiteral(node) {
+    return node.type === 'list' || node.type === 'dictionary' || node.type === 'set';
+}
+export default defineRule({
+    id: 'no-mutable-default-arg',
+    language: 'python',
+    severity: 'error',
+    message: 'Mutable default argument (list/dict/set) is shared across calls — use None and initialize inside.',
+    messageKo: '가변 기본 인자(list/dict/set)는 모든 호출에 공유됩니다 — None을 기본값으로 두고 함수 내부에서 초기화하세요.',
+    visitors: {
+        function_definition(node, ctx) {
+            const params = node.childForFieldName('parameters');
+            if (!params)
+                return;
+            for (let i = 0; i < params.namedChildCount; i++) {
+                const param = params.namedChild(i);
+                if (!param)
+                    continue;
+                if (param.type === 'default_parameter' || param.type === 'typed_default_parameter') {
+                    const value = param.childForFieldName('value');
+                    if (value && isMutableLiteral(value)) {
+                        ctx.report({ node: param });
+                    }
+                }
+            }
+        },
+    },
+});
+//# sourceMappingURL=no-mutable-default-arg.js.map

package/dist/rules-default/no-mutable-default-arg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-mutable-default-arg.js","sourceRoot":"","sources":["../../src/rules-default/no-mutable-default-arg.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,SAAS,gBAAgB,CAAC,IAAuB;IAC/C,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC;AACnF,CAAC;AAED,eAAe,UAAU,CAAC;IACxB,EAAE,EAAE,wBAAwB;IAC5B,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,OAAO;IACjB,OAAO,EAAE,mGAAmG;IAC5G,SAAS,EAAE,wEAAwE;IACnF,QAAQ,EAAE;QACR,mBAAmB,CAAC,IAAI,EAAE,GAAG;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;oBACnF,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;oBAC/C,IAAI,KAAK,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;wBACrC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC9B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;KACF;CACF,CAAC,CAAC"}

package/dist/rules-default/no-pickle.yaml

@@ -0,0 +1,12 @@
+id: no-pickle
+language: python
+severity: error
+message: pickle.loads/load is unsafe — never deserialize untrusted data. Use json or msgpack.
+messageKo: pickle.loads/load는 안전하지 않습니다 — 신뢰할 수 없는 데이터 역직렬화 금지. json 또는 msgpack을 사용하세요.
+query: |
+  (call
+    function: (attribute
+      object: (identifier) @mod
+      attribute: (identifier) @attr)
+    (#eq? @mod "pickle")
+    (#match? @attr "^(load|loads)$")) @call

package/dist/rules-default/no-plain-card-number.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@aicqtools/rule-sdk").FunctionRule;
+export default _default;
+//# sourceMappingURL=no-plain-card-number.d.ts.map

package/dist/rules-default/no-plain-card-number.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-plain-card-number.d.ts","sourceRoot":"","sources":["../../src/rules-default/no-plain-card-number.ts"],"names":[],"mappings":";AAiBA,wBA6BG"}

package/dist/rules-default/no-plain-card-number.js

@@ -0,0 +1,51 @@
+import { defineRule } from '@aicqtools/rule-sdk';
+/**
+ * PCI DSS: card numbers (PAN) must never be stored in plaintext columns.
+ * Detect Sequelize/Prisma/TypeORM-style schema definitions where a column
+ * named `card_number` / `cardNumber` is declared with a plain string type
+ * and no encryption/hash suffix in the column name.
+ *
+ * Limitation: pattern-based — does not understand custom encryption
+ * wrappers. Severity stays at `error` because the cost of a false positive
+ * (rename column) is far smaller than the cost of a true positive.
+ */
+const PAYMENT_NAME = /^(card[_-]?number|pan|primary[_-]?account[_-]?number)$/i;
+const ENCRYPTED_HINT = /(encrypted|hashed|tokenized|masked|encr|hash)/i;
+export default defineRule({
+    id: 'no-plain-card-number',
+    language: ['typescript', 'tsx'],
+    severity: 'error',
+    message: 'Card number column appears to be stored in plaintext (PCI DSS § 3.5.1 — render PAN unreadable).',
+    messageKo: '카드번호 컬럼이 평문으로 저장되는 것으로 보입니다 (PCI DSS § 3.5.1 — PAN 평문 저장 금지, 암호화/토큰화 필수).',
+    docs: 'https://github.com/aicqtools/aicqtools/blob/main/docs/rules/no-plain-card-number.md',
+    visitors: {
+        pair(node, ctx) {
+            const key = node.childForFieldName('key');
+            if (!key)
+                return;
+            const keyText = ctx.textOf(key).replace(/^['"`]|['"`]$/g, '');
+            if (!PAYMENT_NAME.test(keyText))
+                return;
+            const value = node.childForFieldName('value');
+            if (!value)
+                return;
+            const valueText = ctx.textOf(value);
+            if (ENCRYPTED_HINT.test(valueText))
+                return;
+            ctx.report({ node });
+        },
+        property_signature(node, ctx) {
+            const name = node.childForFieldName('name');
+            if (!name)
+                return;
+            const text = ctx.textOf(name);
+            if (!PAYMENT_NAME.test(text))
+                return;
+            const full = ctx.textOf(node);
+            if (ENCRYPTED_HINT.test(full))
+                return;
+            ctx.report({ node });
+        },
+    },
+});
+//# sourceMappingURL=no-plain-card-number.js.map

package/dist/rules-default/no-plain-card-number.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-plain-card-number.js","sourceRoot":"","sources":["../../src/rules-default/no-plain-card-number.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGjD;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAG,yDAAyD,CAAC;AAC/E,MAAM,cAAc,GAAG,gDAAgD,CAAC;AAExE,eAAe,UAAU,CAAC;IACxB,EAAE,EAAE,sBAAsB;IAC1B,QAAQ,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;IAC/B,QAAQ,EAAE,OAAO;IACjB,OAAO,EAAE,iGAAiG;IAC1G,SAAS,EAAE,2EAA2E;IACtF,IAAI,EAAE,qFAAqF;IAC3F,QAAQ,EAAE;QACR,IAAI,CAAC,IAAuB,EAAE,GAAgB;YAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG;gBAAE,OAAO;YACjB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,OAAO;YAC3C,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,kBAAkB,CAAC,IAAuB,EAAE,GAAgB;YAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO;YACtC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACvB,CAAC;KACF;CACF,CAAC,CAAC"}

package/dist/rules-default/no-print-in-prod.yaml

@@ -0,0 +1,9 @@
+id: no-print-in-prod
+language: python
+severity: warning
+message: Avoid bare print() in production code; use the standard `logging` module.
+messageKo: 운영 코드에서 print() 사용 지양 — 표준 `logging` 모듈을 사용하세요.
+query: |
+  (call
+    function: (identifier) @fn
+    (#eq? @fn "print")) @call

package/dist/rules-default/no-process-env-leak.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Forbids direct `process.env.X` access outside of designated config modules.
+ * Centralize env reading in `config/`, `env/`, or `*.config.ts` for type-safety + validation.
+ */
+declare const _default: import("@aicqtools/rule-sdk").FunctionRule;
+export default _default;
+//# sourceMappingURL=no-process-env-leak.d.ts.map

package/dist/rules-default/no-process-env-leak.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-process-env-leak.d.ts","sourceRoot":"","sources":["../../src/rules-default/no-process-env-leak.ts"],"names":[],"mappings":"AAEA;;;GAGG;;AACH,wBA8BG"}

package/dist/rules-default/no-process-env-leak.js

@@ -0,0 +1,37 @@
+import { defineRule } from '@aicqtools/rule-sdk';
+/**
+ * Forbids direct `process.env.X` access outside of designated config modules.
+ * Centralize env reading in `config/`, `env/`, or `*.config.ts` for type-safety + validation.
+ */
+export default defineRule({
+    id: 'no-process-env-leak',
+    language: ['typescript', 'javascript', 'tsx'],
+    severity: 'warning',
+    message: 'Read `process.env` only via the config module (config/env.ts).',
+    messageKo: '`process.env` 직접 접근 금지 — config 모듈(config/env.ts)을 통해서만 읽으세요.',
+    visitors: {
+        member_expression(node, ctx) {
+            const obj = node.childForFieldName('object');
+            const prop = node.childForFieldName('property');
+            if (!obj || !prop)
+                return;
+            if (obj.type === 'member_expression') {
+                const inner = obj.childForFieldName('object');
+                const innerProp = obj.childForFieldName('property');
+                if (inner &&
+                    innerProp &&
+                    ctx.textOf(inner) === 'process' &&
+                    ctx.textOf(innerProp) === 'env') {
+                    // Allowlist: `config/`, `env/`, and `*.config.*` / `*.env.*` files (e.g. `next.config.ts`,
+                    // `vite.config.ts`, `jest.config.ts`). Includes a leading `.` in the prefix character
+                    // class so dotted filenames where `config`/`env` is preceded by `.` (e.g. `next.config.ts`)
+                    // are recognized.
+                    if (/(^|[/\\.])(config|env)([/\\.]|$)/.test(ctx.filePath))
+                        return;
+                    ctx.report({ node });
+                }
+            }
+        },
+    },
+});
+//# sourceMappingURL=no-process-env-leak.js.map

package/dist/rules-default/no-process-env-leak.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-process-env-leak.js","sourceRoot":"","sources":["../../src/rules-default/no-process-env-leak.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD;;;GAGG;AACH,eAAe,UAAU,CAAC;IACxB,EAAE,EAAE,qBAAqB;IACzB,QAAQ,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC;IAC7C,QAAQ,EAAE,SAAS;IACnB,OAAO,EAAE,gEAAgE;IACzE,SAAS,EAAE,+DAA+D;IAC1E,QAAQ,EAAE;QACR,iBAAiB,CAAC,IAAI,EAAE,GAAG;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;gBAAE,OAAO;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACpD,IACE,KAAK;oBACL,SAAS;oBACT,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS;oBAC/B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,KAAK,EAC/B,CAAC;oBACD,2FAA2F;oBAC3F,sFAAsF;oBACtF,4FAA4F;oBAC5F,kBAAkB;oBAClB,IAAI,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;wBAAE,OAAO;oBAClE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;KACF;CACF,CAAC,CAAC"}