@noctcore/eslint-plugin-contracts 0.1.0 → 0.2.0

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
@@ -32,18 +42,118 @@ var recommended = {
   "noctcore-contracts/wire-message-naming": "error",
   "noctcore-contracts/no-error-stringify": "error",
   "noctcore-contracts/no-direct-process-env": "error",
-  "noctcore-contracts/money-must-be-decimal": "error"
+  "noctcore-contracts/money-must-be-decimal": "error",
+  "noctcore-contracts/require-error-cause": "error",
+  "noctcore-contracts/restrict-throw-to-taxonomy": "error",
+  // Config-required / heuristic rules ship inert. `require-registered-keys` and
+  // `env-var-schema-parity` do nothing until their `sinks` / `schema` options are
+  // set; `require-schema-parse-at-boundary` is a conservative syntactic slice of a
+  // type-aware concern. Enable them explicitly once configured for your project.
+  "noctcore-contracts/require-registered-keys": "off",
+  "noctcore-contracts/env-var-schema-parity": "off",
+  "noctcore-contracts/require-schema-parse-at-boundary": "off"
 };
 
-// src/rules/money-must-be-decimal.ts
+// src/rules/env-var-schema-parity.ts
+var import_node_fs = require("fs");
+var import_node_path = __toESM(require("path"), 1);
 var import_utils = require("@typescript-eslint/utils");
 
 // src/createRule.ts
 var import_eslint_utils = require("@noctcore/eslint-utils");
 var createRule = (0, import_eslint_utils.makeCreateRule)("contracts");
 
+// src/rules/env-var-schema-parity.ts
+var RULE_NAME = "env-var-schema-parity";
+var optionSchema = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    schema: { type: "string", minLength: 1 }
+  }
+};
+var schemaCache = /* @__PURE__ */ new Map();
+var DOTENV_KEY = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/gm;
+var OBJECT_KEY = /["'`]?([A-Za-z_][A-Za-z0-9_]*)["'`]?\s*:/g;
+function parseDeclaredKeys(source) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const match of source.matchAll(DOTENV_KEY)) {
+    if (match[1]) keys.add(match[1]);
+  }
+  for (const match of source.matchAll(OBJECT_KEY)) {
+    if (match[1]) keys.add(match[1]);
+  }
+  return keys;
+}
+function loadSchema(cwd, schema) {
+  const resolved = import_node_path.default.isAbsolute(schema) ? schema : import_node_path.default.resolve(cwd, schema);
+  const cached = schemaCache.get(resolved);
+  if (cached !== void 0) {
+    return cached;
+  }
+  let keys;
+  try {
+    keys = parseDeclaredKeys((0, import_node_fs.readFileSync)(resolved, "utf8"));
+  } catch {
+    keys = null;
+  }
+  schemaCache.set(resolved, keys);
+  return keys;
+}
+function isProcessEnv(node) {
+  return node.type === import_utils.AST_NODE_TYPES.MemberExpression && !node.computed && node.object.type === import_utils.AST_NODE_TYPES.Identifier && node.object.name === "process" && node.property.type === import_utils.AST_NODE_TYPES.Identifier && node.property.name === "env";
+}
+function isImportMetaEnv(node) {
+  return node.type === import_utils.AST_NODE_TYPES.MemberExpression && !node.computed && node.property.type === import_utils.AST_NODE_TYPES.Identifier && node.property.name === "env" && node.object.type === import_utils.AST_NODE_TYPES.MetaProperty && node.object.meta.name === "import" && node.object.property.name === "meta";
+}
+var envVarSchemaParityRule = createRule({
+  name: RULE_NAME,
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Require every `process.env.FOO` / `import.meta.env.FOO` key to be declared in a schema file (`.env.example` or a zod-env module), so config access and config declaration cannot drift apart."
+    },
+    schema: [optionSchema],
+    messages: {
+      undeclaredEnvVar: "Env var `{{name}}` is read here but not declared in `{{schema}}`. Add it to the schema (or fix the typo) so config stays a validated contract."
+    }
+  },
+  defaultOptions: [{}],
+  create(context, [options]) {
+    const schema = options.schema;
+    if (!schema) {
+      return {};
+    }
+    const declared = loadSchema(context.cwd, schema);
+    if (declared === null) {
+      return {};
+    }
+    function check(node) {
+      if (node.computed || node.property.type !== import_utils.AST_NODE_TYPES.Identifier) {
+        return;
+      }
+      const name = node.property.name;
+      if (!declared.has(name)) {
+        context.report({
+          node: node.property,
+          messageId: "undeclaredEnvVar",
+          data: { name, schema }
+        });
+      }
+    }
+    return {
+      MemberExpression(node) {
+        if (isProcessEnv(node.object) || isImportMetaEnv(node.object)) {
+          check(node);
+        }
+      }
+    };
+  }
+});
+
 // src/rules/money-must-be-decimal.ts
-var RULE_NAME = "money-must-be-decimal";
+var import_utils2 = require("@typescript-eslint/utils");
+var RULE_NAME2 = "money-must-be-decimal";
 var DEFAULT_DECIMAL_TYPE = "Decimal";
 var DEFAULT_FIELD_PATTERNS = [
   "amount",
@@ -53,7 +163,7 @@ var DEFAULT_FIELD_PATTERNS = [
   "balance"
 ];
 var DEFAULT_ALLOWED_FILES = [];
-var optionSchema = {
+var optionSchema2 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -82,22 +192,22 @@ function isAllowedFile(filename, patterns) {
   return patterns.some((pattern) => normalized.endsWith(toForwardSlash(pattern)));
 }
 function staticName(node) {
-  if (node.type === import_utils.AST_NODE_TYPES.Identifier) {
+  if (node.type === import_utils2.AST_NODE_TYPES.Identifier) {
     return node.name;
   }
   return void 0;
 }
 function isNumberAnnotation(annotation) {
-  return annotation?.typeAnnotation.type === import_utils.AST_NODE_TYPES.TSNumberKeyword;
+  return annotation?.typeAnnotation.type === import_utils2.AST_NODE_TYPES.TSNumberKeyword;
 }
 var moneyMustBeDecimalRule = createRule({
-  name: RULE_NAME,
+  name: RULE_NAME2,
   meta: {
     type: "problem",
     docs: {
       description: "Disallow monetary values typed as the JS primitive `number`. Money-named fields explicitly typed `: number` lose precision to float rounding; use a Decimal money type instead."
     },
-    schema: [optionSchema],
+    schema: [optionSchema2],
     messages: {
       moneyMustBeDecimal: "Monetary values must use {{decimalType}}, never the JS `number` primitive, to avoid float rounding errors. Rename or retype this field to a {{decimalType}} money type."
     }
@@ -133,7 +243,7 @@ var moneyMustBeDecimalRule = createRule({
       },
       // `const total: number = ...`: annotated variable declarator.
       VariableDeclarator(node) {
-        if (node.id.type !== import_utils.AST_NODE_TYPES.Identifier) {
+        if (node.id.type !== import_utils2.AST_NODE_TYPES.Identifier) {
           return;
         }
         const name = node.id.name;
@@ -146,15 +256,15 @@ var moneyMustBeDecimalRule = createRule({
 });
 
 // src/rules/no-direct-process-env.ts
-var import_utils2 = require("@typescript-eslint/utils");
-var RULE_NAME2 = "no-direct-process-env";
+var import_utils3 = require("@typescript-eslint/utils");
+var RULE_NAME3 = "no-direct-process-env";
 var DEFAULT_CONFIG_MODULE = "@/config";
 var DEFAULT_ALLOWED_FILES2 = [
   "**/*.config.{ts,js,mjs,cjs}",
   "**/*.{spec,test}.{ts,tsx}",
   "**/scripts/**"
 ];
-var optionSchema2 = {
+var optionSchema3 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -208,23 +318,23 @@ function isAllowedFile2(filename, patterns) {
   const normalized = filename.split("\\").join("/");
   return patterns.some((pattern) => globToRegExp(pattern).test(normalized));
 }
-function isProcessEnv(node) {
-  if (node.type !== import_utils2.AST_NODE_TYPES.MemberExpression || node.object.type !== import_utils2.AST_NODE_TYPES.Identifier || node.object.name !== "process") {
+function isProcessEnv2(node) {
+  if (node.type !== import_utils3.AST_NODE_TYPES.MemberExpression || node.object.type !== import_utils3.AST_NODE_TYPES.Identifier || node.object.name !== "process") {
     return false;
   }
   if (node.computed) {
-    return node.property.type === import_utils2.AST_NODE_TYPES.Literal && node.property.value === "env";
+    return node.property.type === import_utils3.AST_NODE_TYPES.Literal && node.property.value === "env";
   }
-  return node.property.type === import_utils2.AST_NODE_TYPES.Identifier && node.property.name === "env";
+  return node.property.type === import_utils3.AST_NODE_TYPES.Identifier && node.property.name === "env";
 }
 var noDirectProcessEnvRule = createRule({
-  name: RULE_NAME2,
+  name: RULE_NAME3,
   meta: {
     type: "problem",
     docs: {
       description: "Disallow direct `process.env` access. Force every consumer through a typed, validated config accessor so a missing variable fails at boot, not at use."
     },
-    schema: [optionSchema2],
+    schema: [optionSchema3],
     messages: {
       directProcessEnv: "Read environment variables through your typed config accessor (import from `{{configModule}}`). Direct `process.env` access bypasses boot-time validation."
     }
@@ -250,7 +360,7 @@ var noDirectProcessEnvRule = createRule({
        * returned, or assigned (`log(process.env)`, `return process.env`).
        */
       MemberExpression(node) {
-        if (isProcessEnv(node)) {
+        if (isProcessEnv2(node)) {
           context.report({ node, messageId: "directProcessEnv", data: { configModule } });
         }
       }
@@ -259,10 +369,10 @@ var noDirectProcessEnvRule = createRule({
 });
 
 // src/rules/no-error-stringify.ts
-var import_utils3 = require("@typescript-eslint/utils");
-var RULE_NAME3 = "no-error-stringify";
+var import_utils4 = require("@typescript-eslint/utils");
+var RULE_NAME4 = "no-error-stringify";
 var DEFAULT_ERROR_NAMES = ["error", "err", "e", "cause"];
-var optionSchema3 = {
+var optionSchema4 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -275,19 +385,19 @@ var optionSchema3 = {
   }
 };
 function isEmptyStringLiteral(node) {
-  return node.type === import_utils3.AST_NODE_TYPES.Literal && node.value === "";
+  return node.type === import_utils4.AST_NODE_TYPES.Literal && node.value === "";
 }
 function isErrorIdentifier(node, names) {
-  return node.type === import_utils3.AST_NODE_TYPES.Identifier && names.has(node.name);
+  return node.type === import_utils4.AST_NODE_TYPES.Identifier && names.has(node.name);
 }
 var noErrorStringifyRule = createRule({
-  name: RULE_NAME3,
+  name: RULE_NAME4,
   meta: {
     type: "problem",
     docs: {
       description: 'Disallow stringifying an error with bare `${error}` interpolation, `error.toString()`, or `error + ""`. These drop the cause chain. Use `error instanceof Error ? error.message : String(error)` instead.'
     },
-    schema: [optionSchema3],
+    schema: [optionSchema4],
     messages: {
       noErrorStringify: "Stringifying an error this way drops its cause chain. Use `{{name}} instanceof Error ? {{name}}.message : String({{name}})` (or pass the Error object straight to the logger)."
     }
@@ -302,7 +412,7 @@ var noErrorStringifyRule = createRule({
       // `error.toString()`
       'CallExpression[callee.type="MemberExpression"]'(node) {
         const callee = node.callee;
-        if (!callee.computed && callee.property.type === import_utils3.AST_NODE_TYPES.Identifier && callee.property.name === "toString" && node.arguments.length === 0 && isErrorIdentifier(callee.object, errorNames)) {
+        if (!callee.computed && callee.property.type === import_utils4.AST_NODE_TYPES.Identifier && callee.property.name === "toString" && node.arguments.length === 0 && isErrorIdentifier(callee.object, errorNames)) {
           report(node, callee.object.name);
         }
       },
@@ -334,10 +444,332 @@ var noErrorStringifyRule = createRule({
   }
 });
 
+// src/rules/require-error-cause.ts
+var import_utils5 = require("@typescript-eslint/utils");
+var RULE_NAME5 = "require-error-cause";
+function constructorSimpleName(node) {
+  const callee = node.callee;
+  if (callee.type === import_utils5.AST_NODE_TYPES.Identifier) {
+    return callee.name;
+  }
+  if (callee.type === import_utils5.AST_NODE_TYPES.MemberExpression && !callee.computed && callee.property.type === import_utils5.AST_NODE_TYPES.Identifier) {
+    return callee.property.name;
+  }
+  return null;
+}
+function isErrorLikeName(name) {
+  return /(?:Error|Exception)$/.test(name);
+}
+function alreadyHasCause(node) {
+  for (const arg of node.arguments) {
+    if (arg.type === import_utils5.AST_NODE_TYPES.SpreadElement) {
+      return true;
+    }
+    if (arg.type === import_utils5.AST_NODE_TYPES.ObjectExpression) {
+      for (const prop of arg.properties) {
+        if (prop.type === import_utils5.AST_NODE_TYPES.SpreadElement) {
+          return true;
+        }
+        const key = prop.key;
+        const isCause = key.type === import_utils5.AST_NODE_TYPES.Identifier && key.name === "cause" || key.type === import_utils5.AST_NODE_TYPES.Literal && key.value === "cause";
+        if (isCause) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+function buildFix(node, binding) {
+  const args = node.arguments;
+  if (args.length === 0) {
+    return null;
+  }
+  const last = args[args.length - 1];
+  if (last === void 0) {
+    return null;
+  }
+  if (last.type === import_utils5.AST_NODE_TYPES.ObjectExpression) {
+    const props = last.properties;
+    if (props.length === 0) {
+      return (fixer) => fixer.replaceText(last, `{ cause: ${binding} }`);
+    }
+    const lastProp = props[props.length - 1];
+    if (lastProp === void 0) {
+      return null;
+    }
+    return (fixer) => fixer.insertTextAfter(lastProp, `, cause: ${binding}`);
+  }
+  return (fixer) => fixer.insertTextAfter(last, `, { cause: ${binding} }`);
+}
+var requireErrorCauseRule = createRule({
+  name: RULE_NAME5,
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Require re-thrown errors inside a `catch` to forward the caught error as `{ cause }`. A `throw new SomeError(...)` that omits the cause severs the chain to the original failure."
+    },
+    fixable: "code",
+    schema: [],
+    messages: {
+      missingCause: "Re-throwing inside `catch` without `{ cause: {{binding}} }` drops the original error. Pass `{ cause: {{binding}} }` to `new {{ctor}}(...)` so the chain is preserved."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const catchBindings = [];
+    return {
+      CatchClause(node) {
+        const param = node.param;
+        catchBindings.push(
+          param && param.type === import_utils5.AST_NODE_TYPES.Identifier ? param.name : null
+        );
+      },
+      "CatchClause:exit"() {
+        catchBindings.pop();
+      },
+      ThrowStatement(node) {
+        const binding = catchBindings[catchBindings.length - 1];
+        if (binding == null) {
+          return;
+        }
+        const arg = node.argument;
+        if (arg.type !== import_utils5.AST_NODE_TYPES.NewExpression) {
+          return;
+        }
+        const ctor = constructorSimpleName(arg);
+        if (ctor === null || !isErrorLikeName(ctor)) {
+          return;
+        }
+        if (alreadyHasCause(arg)) {
+          return;
+        }
+        const fix = buildFix(arg, binding);
+        context.report({
+          node: arg,
+          messageId: "missingCause",
+          data: { binding, ctor },
+          ...fix ? { fix } : {}
+        });
+      }
+    };
+  }
+});
+
+// src/rules/require-registered-keys.ts
+var import_utils6 = require("@typescript-eslint/utils");
+var RULE_NAME6 = "require-registered-keys";
+var optionSchema5 = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    sinks: {
+      type: "array",
+      items: {
+        type: "object",
+        additionalProperties: false,
+        required: ["callee", "argIndex"],
+        properties: {
+          callee: { type: "string", minLength: 1 },
+          argIndex: { type: "integer", minimum: 0 }
+        }
+      }
+    },
+    registry: { type: "string", minLength: 1 }
+  }
+};
+function calleePath(callee) {
+  if (callee.type === import_utils6.AST_NODE_TYPES.Identifier) {
+    return callee.name;
+  }
+  if (callee.type === import_utils6.AST_NODE_TYPES.MemberExpression && !callee.computed) {
+    if (callee.property.type !== import_utils6.AST_NODE_TYPES.Identifier) {
+      return null;
+    }
+    const objectPath = calleePath(callee.object);
+    return objectPath === null ? null : `${objectPath}.${callee.property.name}`;
+  }
+  return null;
+}
+function isStringLiteral(node) {
+  return node.type === import_utils6.AST_NODE_TYPES.Literal && typeof node.value === "string";
+}
+var requireRegisteredKeysRule = createRule({
+  name: RULE_NAME6,
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Require the key/name argument of configured sink APIs (storage, event channels, cache keys) to be an imported constant from a registry module, not a raw string literal."
+    },
+    schema: [optionSchema5],
+    messages: {
+      unregisteredKey: "Pass an imported key constant to `{{callee}}`, not the raw string {{value}}{{registryHint}}. Raw string keys drift out of sync across call sites."
+    }
+  },
+  defaultOptions: [{ sinks: [] }],
+  create(context, [options]) {
+    const sinks = options.sinks ?? [];
+    if (sinks.length === 0) {
+      return {};
+    }
+    const sinkMap = /* @__PURE__ */ new Map();
+    for (const sink of sinks) {
+      const existing = sinkMap.get(sink.callee);
+      if (existing) {
+        existing.add(sink.argIndex);
+      } else {
+        sinkMap.set(sink.callee, /* @__PURE__ */ new Set([sink.argIndex]));
+      }
+    }
+    const registry = options.registry;
+    const registryHint = registry ? ` (import it from '${registry}')` : "";
+    return {
+      CallExpression(node) {
+        const path2 = calleePath(node.callee);
+        if (path2 === null) {
+          return;
+        }
+        const indexes = sinkMap.get(path2);
+        if (indexes === void 0) {
+          return;
+        }
+        for (const index of indexes) {
+          const arg = node.arguments[index];
+          if (arg !== void 0 && isStringLiteral(arg)) {
+            context.report({
+              node: arg,
+              messageId: "unregisteredKey",
+              data: { callee: path2, value: `'${arg.value}'`, registryHint }
+            });
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/rules/require-schema-parse-at-boundary.ts
+var import_utils7 = require("@typescript-eslint/utils");
+var RULE_NAME7 = "require-schema-parse-at-boundary";
+function isJsonParseCall(node) {
+  return node.type === import_utils7.AST_NODE_TYPES.CallExpression && node.callee.type === import_utils7.AST_NODE_TYPES.MemberExpression && !node.callee.computed && node.callee.object.type === import_utils7.AST_NODE_TYPES.Identifier && node.callee.object.name === "JSON" && node.callee.property.type === import_utils7.AST_NODE_TYPES.Identifier && node.callee.property.name === "parse";
+}
+function isAwaitJsonCall(node) {
+  if (node.type !== import_utils7.AST_NODE_TYPES.AwaitExpression) {
+    return false;
+  }
+  const call = node.argument;
+  return call.type === import_utils7.AST_NODE_TYPES.CallExpression && call.arguments.length === 0 && call.callee.type === import_utils7.AST_NODE_TYPES.MemberExpression && !call.callee.computed && call.callee.property.type === import_utils7.AST_NODE_TYPES.Identifier && call.callee.property.name === "json";
+}
+function isShapeClaim(annotation) {
+  if (annotation.type === import_utils7.AST_NODE_TYPES.TSArrayType) {
+    return true;
+  }
+  if (annotation.type === import_utils7.AST_NODE_TYPES.TSTypeReference) {
+    return !(annotation.typeName.type === import_utils7.AST_NODE_TYPES.Identifier && annotation.typeName.name === "const");
+  }
+  return false;
+}
+var requireSchemaParseAtBoundaryRule = createRule({
+  name: RULE_NAME7,
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow asserting external boundary data with `as T` instead of parsing it at runtime. Flags `JSON.parse(...) as T` and `(await res.json()) as T`; use a zod/valibot parse."
+    },
+    schema: [],
+    messages: {
+      castedBoundaryData: "Boundary data is asserted with `as` here, not parsed. A cast is unchecked \u2014 validate this with a runtime schema (e.g. `Schema.parse(...)`) so a wire-shape change fails loudly."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      TSAsExpression(node) {
+        if (!isShapeClaim(node.typeAnnotation)) {
+          return;
+        }
+        const expr = node.expression;
+        if (isJsonParseCall(expr) || isAwaitJsonCall(expr)) {
+          context.report({ node, messageId: "castedBoundaryData" });
+        }
+      }
+    };
+  }
+});
+
+// src/rules/restrict-throw-to-taxonomy.ts
+var import_utils8 = require("@typescript-eslint/utils");
+var RULE_NAME8 = "restrict-throw-to-taxonomy";
+var DEFAULT_ALLOW = ["Error"];
+var optionSchema6 = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    allow: {
+      type: "array",
+      items: { type: "string" },
+      uniqueItems: true
+    }
+  }
+};
+function constructorSimpleName2(node) {
+  const callee = node.callee;
+  if (callee.type === import_utils8.AST_NODE_TYPES.Identifier) {
+    return callee.name;
+  }
+  if (callee.type === import_utils8.AST_NODE_TYPES.MemberExpression && !callee.computed && callee.property.type === import_utils8.AST_NODE_TYPES.Identifier) {
+    return callee.property.name;
+  }
+  return null;
+}
+function isNonErrorValue(node) {
+  return node.type === import_utils8.AST_NODE_TYPES.Literal || node.type === import_utils8.AST_NODE_TYPES.TemplateLiteral || node.type === import_utils8.AST_NODE_TYPES.ObjectExpression || node.type === import_utils8.AST_NODE_TYPES.ArrayExpression;
+}
+var restrictThrowToTaxonomyRule = createRule({
+  name: RULE_NAME8,
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Restrict `throw` to an approved error taxonomy. Flags throwing a non-allowlisted error class and throwing a non-Error value (string, object, number, ...)."
+    },
+    schema: [optionSchema6],
+    messages: {
+      disallowedErrorClass: "Throw an error from your taxonomy, not `{{name}}`. Allowed: {{allowed}}. Add `{{name}}` to the `allow` option if it belongs to your taxonomy.",
+      nonErrorThrow: "Throw an Error from your taxonomy, not a bare {{kind}} value. A non-Error throw carries no stack or cause."
+    }
+  },
+  defaultOptions: [{ allow: [...DEFAULT_ALLOW] }],
+  create(context, [options]) {
+    const allow = new Set(options.allow ?? DEFAULT_ALLOW);
+    const allowedList = [...allow].join(", ");
+    return {
+      ThrowStatement(node) {
+        const arg = node.argument;
+        if (arg.type === import_utils8.AST_NODE_TYPES.NewExpression) {
+          const name = constructorSimpleName2(arg);
+          if (name !== null && !allow.has(name)) {
+            context.report({
+              node: arg,
+              messageId: "disallowedErrorClass",
+              data: { name, allowed: allowedList }
+            });
+          }
+          return;
+        }
+        if (isNonErrorValue(arg)) {
+          const kind = arg.type === import_utils8.AST_NODE_TYPES.ObjectExpression ? "object" : arg.type === import_utils8.AST_NODE_TYPES.ArrayExpression ? "array" : "literal";
+          context.report({ node: arg, messageId: "nonErrorThrow", data: { kind } });
+        }
+      }
+    };
+  }
+});
+
 // src/rules/wire-message-naming.ts
-var RULE_NAME4 = "wire-message-naming";
+var RULE_NAME9 = "wire-message-naming";
 var DEFAULT_ROLE_SUFFIXES = ["Event", "Command", "Query"];
-var optionSchema4 = {
+var optionSchema7 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -378,14 +810,14 @@ function typeLiteralNode(obj) {
   return null;
 }
 var wireMessageNamingRule = createRule({
-  name: RULE_NAME4,
+  name: RULE_NAME9,
   meta: {
     type: "problem",
     docs: {
       description: "A message-schema const ending in a role suffix (default Event/Command/Query) whose zod object declares `type: z.literal(...)` must set that literal to kebab-case(const name minus its role suffix)."
     },
     fixable: "code",
-    schema: [optionSchema4],
+    schema: [optionSchema7],
     messages: {
       typeMismatch: "Wire `type` literal '{{actual}}' for `{{name}}` must be '{{expected}}' \u2014 kebab-case of the const name minus its role suffix."
     }
@@ -421,11 +853,11 @@ var wireMessageNamingRule = createRule({
 });
 
 // src/rules/zod-schema-naming.ts
-var RULE_NAME5 = "zod-schema-naming";
+var RULE_NAME10 = "zod-schema-naming";
 var SCHEMA_NAME = /^[A-Z][A-Za-z0-9]*Schema$/;
 var SUFFIX = "Schema";
 var DEFAULT_ROLE_SUFFIXES2 = [];
-var optionSchema5 = {
+var optionSchema8 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -458,13 +890,13 @@ function rootIdentifierName(node) {
   return null;
 }
 var zodSchemaNamingRule = createRule({
-  name: RULE_NAME5,
+  name: RULE_NAME10,
   meta: {
     type: "problem",
     docs: {
       description: "Every exported zod schema is a PascalCase const suffixed `Schema`, paired with a same-named inferred type (`export type Foo = z.infer<typeof FooSchema>`)."
     },
-    schema: [optionSchema5],
+    schema: [optionSchema8],
     messages: {
       schemaNaming: "Exported zod schema `{{name}}` must be a PascalCase const ending in `Schema` (e.g. `FooSchema`).",
       missingType: "Schema `{{name}}` has no sibling `export type {{base}} = z.infer<typeof {{name}}>`. Export the inferred type instead of hand-authoring a duplicate."
@@ -520,12 +952,17 @@ var rules = {
   "wire-message-naming": wireMessageNamingRule,
   "no-error-stringify": noErrorStringifyRule,
   "no-direct-process-env": noDirectProcessEnvRule,
-  "money-must-be-decimal": moneyMustBeDecimalRule
+  "money-must-be-decimal": moneyMustBeDecimalRule,
+  "require-error-cause": requireErrorCauseRule,
+  "restrict-throw-to-taxonomy": restrictThrowToTaxonomyRule,
+  "require-registered-keys": requireRegisteredKeysRule,
+  "env-var-schema-parity": envVarSchemaParityRule,
+  "require-schema-parse-at-boundary": requireSchemaParseAtBoundaryRule
 };
 
 // src/index.ts
 var NAMESPACE = "noctcore-contracts";
-var VERSION = "0.1.0";
+var VERSION = "0.2.0";
 var plugin = {
   meta: { name: "@noctcore/eslint-plugin-contracts", version: VERSION },
   rules,