@elaraai/east-diagnostics 1.0.36 → 1.0.37

package/README.md

@@ -65,6 +65,7 @@ These share one principle: **inside an East block the code must be East all the
 - **`no-host-comparison-on-east-values`** - `===`/`<` on decoded East values (variants/options, `SortedMap`/`SortedSet`) — use `equalFor(T)` / `compareFor(T)`.
 - **`require-example-returns`** - An `example()` without `returns` (for a non-`NullType`/`UIComponentType` output) — the harness runs the fn as a bare statement and the assertion false-passes.
 - **`no-duplicate-definition-name`** - Two same-kind e3 definitions sharing a name string in one file — they collide at deploy time.
+- **`no-inline-credentials`** - A literal string credential (`password`, `secretAccessKey`, `token`, …, directly or wrapped in `some(…)`/`variant("some", …)`) in East/e3 source — the IR is content-addressed, exported, and replicated, so a secret in it is effectively unredactable. Use `Env.get("NAME")` (east-node-std) and supply the value per environment. Credentials paired with a localhost host/endpoint (test containers) are exempt.
 
 ## Usage
 

package/dist/src/rules/index.d.ts

@@ -29,5 +29,6 @@ export { noHandrolledValueTypeMirror } from "./no-handrolled-value-type-mirror.j
 export { noHostComparisonOnEastValues } from "./no-host-comparison-on-east-values.js";
 export { requireExampleReturns } from "./require-example-returns.js";
 export { noDuplicateDefinitionName } from "./no-duplicate-definition-name.js";
+export { noInlineCredentials } from "./no-inline-credentials.js";
 export declare const allRules: readonly EastRule[];
 //# sourceMappingURL=index.d.ts.map

package/dist/src/rules/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rules/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AA4B5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E,eAAO,MAAM,QAAQ,EAAE,SAAS,QAAQ,EAgCvC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rules/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AA6B5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,eAAO,MAAM,QAAQ,EAAE,SAAS,QAAQ,EAkCvC,CAAC"}

package/dist/src/rules/index.js

@@ -24,6 +24,7 @@ import { noHandrolledValueTypeMirror } from "./no-handrolled-value-type-mirror.j
 import { noHostComparisonOnEastValues } from "./no-host-comparison-on-east-values.js";
 import { requireExampleReturns } from "./require-example-returns.js";
 import { noDuplicateDefinitionName } from "./no-duplicate-definition-name.js";
+import { noInlineCredentials } from "./no-inline-credentials.js";
 export { noRedundantEastCast } from "./no-redundant-east-cast.js";
 export { preferExplicitEastType } from "./prefer-explicit-east-type.js";
 export { preferSomeNone } from "./prefer-some-none.js";
@@ -50,6 +51,7 @@ export { noHandrolledValueTypeMirror } from "./no-handrolled-value-type-mirror.j
 export { noHostComparisonOnEastValues } from "./no-host-comparison-on-east-values.js";
 export { requireExampleReturns } from "./require-example-returns.js";
 export { noDuplicateDefinitionName } from "./no-duplicate-definition-name.js";
+export { noInlineCredentials } from "./no-inline-credentials.js";
 export const allRules = [
     // East-side idiom hygiene (original set)
     noRedundantEastCast,
@@ -82,5 +84,7 @@ export const allRules = [
     noHostComparisonOnEastValues,
     requireExampleReturns,
     noDuplicateDefinitionName,
+    // secrets hygiene: IR is content-addressed and replicated — no literal creds
+    noInlineCredentials,
 ];
 //# sourceMappingURL=index.js.map

package/dist/src/rules/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/rules/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E,MAAM,CAAC,MAAM,QAAQ,GAAwB;IAC3C,yCAAyC;IACzC,mBAAmB;IACnB,sBAAsB;IACtB,cAAc;IACd,mBAAmB;IACnB,oBAAoB;IACpB,2BAA2B;IAC3B,mBAAmB;IACnB,sBAAsB;IACtB,0BAA0B;IAC1B,sBAAsB;IACtB,wBAAwB;IACxB,mBAAmB;IACnB,6EAA6E;IAC7E,wEAAwE;IACxE,oCAAoC;IACpC,iBAAiB;IACjB,sBAAsB;IACtB,0BAA0B;IAC1B,qBAAqB;IACrB,mEAAmE;IACnE,sBAAsB;IACtB,mBAAmB;IACnB,sBAAsB;IACtB,sBAAsB;IACtB,iBAAiB;IACjB,gBAAgB;IAChB,2BAA2B;IAC3B,4BAA4B;IAC5B,qBAAqB;IACrB,yBAAyB;CAC1B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/rules/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,CAAC,MAAM,QAAQ,GAAwB;IAC3C,yCAAyC;IACzC,mBAAmB;IACnB,sBAAsB;IACtB,cAAc;IACd,mBAAmB;IACnB,oBAAoB;IACpB,2BAA2B;IAC3B,mBAAmB;IACnB,sBAAsB;IACtB,0BAA0B;IAC1B,sBAAsB;IACtB,wBAAwB;IACxB,mBAAmB;IACnB,6EAA6E;IAC7E,wEAAwE;IACxE,oCAAoC;IACpC,iBAAiB;IACjB,sBAAsB;IACtB,0BAA0B;IAC1B,qBAAqB;IACrB,mEAAmE;IACnE,sBAAsB;IACtB,mBAAmB;IACnB,sBAAsB;IACtB,sBAAsB;IACtB,iBAAiB;IACjB,gBAAgB;IAChB,2BAA2B;IAC3B,4BAA4B;IAC5B,qBAAqB;IACrB,yBAAyB;IACzB,6EAA6E;IAC7E,mBAAmB;CACpB,CAAC"}

package/dist/src/rules/no-compile-time-data-injection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"no-compile-time-data-injection.d.ts","sourceRoot":"","sources":["../../../src/rules/no-compile-time-data-injection.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAyB,MAAM,aAAa,CAAC;AA6DnE,eAAO,MAAM,0BAA0B,EAAE,QA6DxC,CAAC"}
+{"version":3,"file":"no-compile-time-data-injection.d.ts","sourceRoot":"","sources":["../../../src/rules/no-compile-time-data-injection.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAyB,MAAM,aAAa,CAAC;AAgFnE,eAAO,MAAM,0BAA0B,EAAE,QA+DxC,CAAC"}

package/dist/src/rules/no-compile-time-data-injection.js

@@ -37,6 +37,22 @@ function resolvesToFsImport(id, ctx) {
         t.isStringLiteral(imp.moduleSpecifier) &&
         FS_MODULES.has(imp.moduleSpecifier.text));
 }
+/** Is `node` inside a callback passed to a `.implement(...)` call? Platform
+ * function implementation bodies run at RUNTIME on the host — reading
+ * `process.env` / the filesystem there is exactly what a platform function is
+ * for (same stance as `no-build-time-clock`'s function exemption). */
+function insidePlatformImplement(node, t) {
+    let cur = node.parent;
+    while (cur !== undefined) {
+        if (t.isCallExpression(cur) &&
+            t.isPropertyAccessExpression(cur.expression) &&
+            cur.expression.name.text === "implement") {
+            return true;
+        }
+        cur = cur.parent;
+    }
+    return false;
+}
 function isProcessEnv(node, t) {
     return (t.isPropertyAccessExpression(node) &&
         t.isIdentifier(node.expression) &&
@@ -76,9 +92,12 @@ export const noCompileTimeDataInjection = {
             return;
         }
         // All remaining forms are abuse only at module scope (not inside an East
-        // block, where the runtime platform forms legitimately run).
+        // block, where the runtime platform forms legitimately run, and not inside
+        // a platform `.implement(...)` body, which IS the runtime).
         if (insideBlockScope(node, ctx))
             return;
+        if (insidePlatformImplement(node, t))
+            return;
         // `process.env` probe — fire once on the bare `process.env` access (the outer
         // `process.env.X` / `process.env["X"]` has it as its receiver, so reporting the
         // base fires exactly once per occurrence).

package/dist/src/rules/no-compile-time-data-injection.js.map

@@ -1 +1 @@
-{"version":3,"file":"no-compile-time-data-injection.js","sourceRoot":"","sources":["../../../src/rules/no-compile-time-data-injection.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5E,MAAM,IAAI,GAAG,gCAAgC,CAAC;AAC9C,MAAM,IAAI,GAAG,MAAM,CAAC;AAEpB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,CAAC,CAAC,CAAC;AAEjF,SAAS,IAAI,CAAC,GAAgB,EAAE,MAAe,EAAE,WAAmB;IAClE,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;AACvH,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,GAA0B,EAAE,CAAW;IAC7D,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,GAAY,CAAC,CAAC;QACnB,0EAA0E;QAC1E,uDAAuD;QACvD,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;aAClD,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;aAChD,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;;YACtC,SAAS;QACd,IAAI,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;oDAEoD;AACpD,SAAS,kBAAkB,CAAC,EAAiB,EAAE,GAAgB;IAC7D,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;IACjB,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,OAAO,CACL,GAAG,KAAK,SAAS;QACjB,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC;QACtC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,CAAW;IAC9C,OAAO,CACL,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC;QAClC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS;QAClC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CACzB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,yEAAyE;AACzE,oFAAoF;AACpF,gFAAgF;AAChF,mFAAmF;AACnF,mFAAmF;AACnF,gFAAgF;AAChF,iDAAiD;AACjD,MAAM,CAAC,MAAM,0BAA0B,GAAa;IAClD,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,WAAW,EACT,qKAAqK;IACvK,KAAK,CAAC,IAAI,EAAE,GAAG;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACjB,yEAAyE;QACzE,kEAAkE;QAClE,oEAAoE;QACpE,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YAAE,OAAO;QACnD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAAE,OAAO;QAEjE,wCAAwC;QACxC,IAAI,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC;YAClC,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,eAAe,IAAI,CAAC,IAAI,sKAAsK,CAAC,CAAC;YAClN,CAAC;YACD,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,6DAA6D;QAC7D,IAAI,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO;QAExC,8EAA8E;QAC9E,gFAAgF;QAChF,2CAA2C;QAC3C,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,yIAAyI,CAAC,CAAC;YAC3J,OAAO;QACT,CAAC;QAED,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAAE,OAAO;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QAE/B,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;gBACzE,CAAC,CAAC,MAAM,CAAC,UAAU;gBACnB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,IAAI,KAAK,SAAS,IAAI,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,oLAAoL,CAAC,CAAC;YACtM,OAAO;QACT,CAAC;QAED,6CAA6C;QAC7C,IACE,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC;YACpC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;YACjC,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM;YACjC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAC5B,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,sHAAsH,CAAC,CAAC;QAC1I,CAAC;IACH,CAAC;CACF,CAAC"}
+{"version":3,"file":"no-compile-time-data-injection.js","sourceRoot":"","sources":["../../../src/rules/no-compile-time-data-injection.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5E,MAAM,IAAI,GAAG,gCAAgC,CAAC;AAC9C,MAAM,IAAI,GAAG,MAAM,CAAC;AAEpB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,CAAC,CAAC,CAAC;AAEjF,SAAS,IAAI,CAAC,GAAgB,EAAE,MAAe,EAAE,WAAmB;IAClE,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;AACvH,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,GAA0B,EAAE,CAAW;IAC7D,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,GAAY,CAAC,CAAC;QACnB,0EAA0E;QAC1E,uDAAuD;QACvD,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;aAClD,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;aAChD,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;;YACtC,SAAS;QACd,IAAI,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;oDAEoD;AACpD,SAAS,kBAAkB,CAAC,EAAiB,EAAE,GAAgB;IAC7D,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;IACjB,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,OAAO,CACL,GAAG,KAAK,SAAS;QACjB,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC;QACtC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CACzC,CAAC;AACJ,CAAC;AAED;;;sEAGsE;AACtE,SAAS,uBAAuB,CAAC,IAAa,EAAE,CAAW;IACzD,IAAI,GAAG,GAAwB,IAAI,CAAC,MAAM,CAAC;IAC3C,OAAO,GAAG,KAAK,SAAS,EAAE,CAAC;QACzB,IACE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC;YACvB,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,UAAU,CAAC;YAC5C,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,EACxC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,CAAW;IAC9C,OAAO,CACL,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC;QAClC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS;QAClC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CACzB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,yEAAyE;AACzE,oFAAoF;AACpF,gFAAgF;AAChF,mFAAmF;AACnF,mFAAmF;AACnF,gFAAgF;AAChF,iDAAiD;AACjD,MAAM,CAAC,MAAM,0BAA0B,GAAa;IAClD,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,WAAW,EACT,qKAAqK;IACvK,KAAK,CAAC,IAAI,EAAE,GAAG;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACjB,yEAAyE;QACzE,kEAAkE;QAClE,oEAAoE;QACpE,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YAAE,OAAO;QACnD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAAE,OAAO;QAEjE,wCAAwC;QACxC,IAAI,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC;YAClC,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,eAAe,IAAI,CAAC,IAAI,sKAAsK,CAAC,CAAC;YAClN,CAAC;YACD,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,4DAA4D;QAC5D,IAAI,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO;QACxC,IAAI,uBAAuB,CAAC,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO;QAE7C,8EAA8E;QAC9E,gFAAgF;QAChF,2CAA2C;QAC3C,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,yIAAyI,CAAC,CAAC;YAC3J,OAAO;QACT,CAAC;QAED,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAAE,OAAO;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QAE/B,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;gBACzE,CAAC,CAAC,MAAM,CAAC,UAAU;gBACnB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,IAAI,KAAK,SAAS,IAAI,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,oLAAoL,CAAC,CAAC;YACtM,OAAO;QACT,CAAC;QAED,6CAA6C;QAC7C,IACE,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC;YACpC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;YACjC,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM;YACjC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAC5B,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,sHAAsH,CAAC,CAAC;QAC1I,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/src/rules/no-inline-credentials.d.ts

@@ -0,0 +1,3 @@
+import type { EastRule } from "../types.js";
+export declare const noInlineCredentials: EastRule;
+//# sourceMappingURL=no-inline-credentials.d.ts.map

package/dist/src/rules/no-inline-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-inline-credentials.d.ts","sourceRoot":"","sources":["../../../src/rules/no-inline-credentials.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAY,MAAM,aAAa,CAAC;AAyFtD,eAAO,MAAM,mBAAmB,EAAE,QA4BjC,CAAC"}

package/dist/src/rules/no-inline-credentials.js

@@ -0,0 +1,118 @@
+import { importsEastPackage } from "../east-source.js";
+const NAME = "no-inline-credentials";
+const CODE = 990032;
+/** Property names that carry secrets in the io config types (SQL.*, Storage.S3,
+ * Transfer.SFTP/FTP, NoSQL.*) plus the generic token-ish names. Name-based on
+ * purpose: configs are often built as standalone object literals before any
+ * East type is in contextual-type reach, so type-directed matching would miss
+ * the common case. `accessKeyId` is included because it always travels with its
+ * secret pair and has no legitimate literal form either. */
+const CREDENTIAL_FIELDS = new Set([
+    "password",
+    "passphrase",
+    "privateKey",
+    "secretAccessKey",
+    "accessKeyId",
+    "apiKey",
+    "token",
+    "accessToken",
+    "refreshToken",
+    "sessionToken",
+    "secretKey",
+    "clientSecret",
+]);
+/** Sibling fields that identify the target host — used for the local-endpoint
+ * exemption below. */
+const HOST_FIELDS = new Set(["host", "hostname", "endpoint", "url", "server", "address"]);
+const LOCAL_HOSTS = ["localhost", "127.0.0.1", "::1"];
+function isStringy(node, t) {
+    return t.isStringLiteral(node) || t.isNoSubstitutionTemplateLiteral(node);
+}
+/** The literal credential inside `init`, if there is one: a direct non-empty
+ * string literal, or one wrapped in an option/variant constructor —
+ * `some("…")`, `East.some("…")`, `variant("some", "…")`, `East.variant(…)`. */
+function literalCredential(init, t) {
+    if (isStringy(init, t) && init.text.length > 0)
+        return init;
+    if (!t.isCallExpression(init))
+        return undefined;
+    const callee = init.expression;
+    const calleeName = t.isIdentifier(callee)
+        ? callee.text
+        : t.isPropertyAccessExpression(callee)
+            ? callee.name.text
+            : undefined;
+    if (calleeName !== "some" && calleeName !== "variant")
+        return undefined;
+    // For `variant("some", value)` the first argument is the case tag, not data.
+    const args = calleeName === "variant" ? init.arguments.slice(1) : init.arguments;
+    for (const arg of args) {
+        if (isStringy(arg, t) && arg.text.length > 0)
+            return arg;
+    }
+    return undefined;
+}
+/** Does any string literal anywhere under `node` name a local host? */
+function mentionsLocalHost(node, t) {
+    if (isStringy(node, t) && LOCAL_HOSTS.some((h) => node.text.includes(h)))
+        return true;
+    let found = false;
+    t.forEachChild(node, (child) => {
+        if (!found && mentionsLocalHost(child, t))
+            found = true;
+    });
+    return found;
+}
+/** Is a sibling host/endpoint field of this object literal pointing at a local
+ * address? Credentials for a developer's own localhost container (test
+ * databases, MinIO, …) are not secrets — flagging them would only teach people
+ * to ignore the rule. */
+function targetsLocalHost(obj, t) {
+    for (const prop of obj.properties) {
+        if (!t.isPropertyAssignment(prop))
+            continue;
+        const name = t.isIdentifier(prop.name) || t.isStringLiteral(prop.name) ? prop.name.text : undefined;
+        if (name !== undefined && HOST_FIELDS.has(name) && mentionsLocalHost(prop.initializer, t))
+            return true;
+    }
+    return false;
+}
+// East/e3 source is compiled to IR that is content-addressed, stored in
+// package objects, exported, cached, and replicated — a literal credential in
+// it is effectively unredactable, and it is readable by anyone with repo
+// access. The io config types force the issue (SQL passwords are REQUIRED
+// string fields), so the correct form is name-in-IR / value-at-runtime:
+// `Env.get("NAME")` (east-node-std / east-py-std), with the value supplied by
+// the environment — the developer's shell locally, the deployment's secret
+// store in hosted runtimes.
+export const noInlineCredentials = {
+    name: NAME,
+    code: CODE,
+    description: "Flag literal string credentials (password, secretAccessKey, token, …) in East/e3 source — use Env.get so the IR carries the variable name, not the secret.",
+    check(node, ctx) {
+        const t = ctx.ts;
+        if (!t.isPropertyAssignment(node))
+            return;
+        const name = t.isIdentifier(node.name) || t.isStringLiteral(node.name) ? node.name.text : undefined;
+        if (name === undefined || !CREDENTIAL_FIELDS.has(name))
+            return;
+        if (!importsEastPackage(ctx.sourceFile, t))
+            return;
+        const literal = literalCredential(node.initializer, t);
+        if (literal === undefined)
+            return;
+        if (t.isObjectLiteralExpression(node.parent) && targetsLocalHost(node.parent, t))
+            return;
+        const sf = ctx.sourceFile;
+        const start = literal.getStart(sf);
+        ctx.report({
+            ruleName: NAME,
+            code: CODE,
+            start,
+            length: literal.getEnd() - start,
+            messageText: `Literal credential in \`${name}\` — East source compiles to content-addressed IR that is stored, exported, and replicated, so a secret here is effectively unredactable. Use \`Env.get("YOUR_VAR")\` (east-node-std) and supply the value per environment: your shell locally, the deployment's secret store in hosted runtimes.`,
+            category: "warning",
+        });
+    },
+};
+//# sourceMappingURL=no-inline-credentials.js.map

package/dist/src/rules/no-inline-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-inline-credentials.js","sourceRoot":"","sources":["../../../src/rules/no-inline-credentials.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,IAAI,GAAG,uBAAuB,CAAC;AACrC,MAAM,IAAI,GAAG,MAAM,CAAC;AAEpB;;;;;4DAK4D;AAC5D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,aAAa;IACb,QAAQ;IACR,OAAO;IACP,aAAa;IACb,cAAc;IACd,cAAc;IACd,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AAEH;sBACsB;AACtB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAE1F,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;AAEtD,SAAS,SAAS,CAAC,IAAa,EAAE,CAAW;IAC3C,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED;;+EAE+E;AAC/E,SAAS,iBAAiB,CAAC,IAAmB,EAAE,CAAW;IACzD,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC;YACpC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI;YAClB,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxE,6EAA6E;IAC7E,MAAM,IAAI,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IACjF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC3D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uEAAuE;AACvE,SAAS,iBAAiB,CAAC,IAAa,EAAE,CAAW;IACnD,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtF,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC7B,IAAI,CAAC,KAAK,IAAI,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;yBAGyB;AACzB,SAAS,gBAAgB,CAAC,GAA+B,EAAE,CAAW;IACpE,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACpG,IAAI,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACzG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,8EAA8E;AAC9E,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,8EAA8E;AAC9E,2EAA2E;AAC3E,4BAA4B;AAC5B,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,WAAW,EACT,4JAA4J;IAC9J,KAAK,CAAC,IAAI,EAAE,GAAG;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACjB,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC;YAAE,OAAO;QAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACpG,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC/D,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YAAE,OAAO;QAEnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QAClC,IAAI,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAAE,OAAO;QAEzF,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,GAAG,CAAC,MAAM,CAAC;YACT,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,IAAI;YACV,KAAK;YACL,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK;YAChC,WAAW,EACT,2BAA2B,IAAI,mSAAmS;YACpU,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elaraai/east-diagnostics",
-  "version": "1.0.36",
+  "version": "1.0.37",
   "license": "AGPL-3.0-or-later",
   "type": "module",
   "description": "East-aware diagnostic rules over the TypeScript checker — one shared engine for the editor (tsserver plugin), the agent (headless daemon), and CI.",
@@ -44,8 +44,8 @@
   "devDependencies": {
     "@types/node": "^22.18.1",
     "typescript": "~5.9.2",
-    "@elaraai/east": "1.0.36",
-    "@elaraai/e3": "1.0.36"
+    "@elaraai/east": "1.0.37",
+    "@elaraai/e3": "1.0.37"
   },
   "scripts": {
     "build": "tsc",