@noctcore/eslint-plugin-contracts 0.2.0 → 0.3.0

package/dist/index.js

@@ -7,6 +7,8 @@ var recommended = {
   "noctcore-contracts/money-must-be-decimal": "error",
   "noctcore-contracts/require-error-cause": "error",
   "noctcore-contracts/restrict-throw-to-taxonomy": "error",
+  "noctcore-contracts/schema-enum-field-consistency": "error",
+  "noctcore-contracts/fetch-must-check-ok": "error",
   // Config-required / heuristic rules ship inert. `require-registered-keys` and
   // `env-var-schema-parity` do nothing until their `sinks` / `schema` options are
   // set; `require-schema-parse-at-boundary` is a conservative syntactic slice of a
@@ -113,9 +115,476 @@ var envVarSchemaParityRule = createRule({
   }
 });
 
-// src/rules/money-must-be-decimal.ts
+// src/rules/fetch-must-check-ok.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES2 } from "@typescript-eslint/utils";
-var RULE_NAME2 = "money-must-be-decimal";
+var RULE_NAME2 = "fetch-must-check-ok";
+var optionSchema2 = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    fetchFunctions: {
+      type: "array",
+      items: { type: "string", minLength: 1 },
+      uniqueItems: true
+    }
+  }
+};
+function isNode(value) {
+  return typeof value === "object" && value !== null && "type" in value;
+}
+function walkSome(root, keys, predicate) {
+  const stack = [root];
+  for (let node = stack.pop(); node !== void 0; node = stack.pop()) {
+    if (predicate(node)) {
+      return true;
+    }
+    for (const key of keys[node.type] ?? []) {
+      const value = Reflect.get(node, key);
+      if (Array.isArray(value)) {
+        for (const child of value) {
+          if (isNode(child)) {
+            stack.push(child);
+          }
+        }
+      } else if (isNode(value)) {
+        stack.push(value);
+      }
+    }
+  }
+  return false;
+}
+function calleePath(node) {
+  if (node.type === AST_NODE_TYPES2.Identifier) {
+    return node.name;
+  }
+  if (node.type === AST_NODE_TYPES2.MemberExpression && !node.computed && node.property.type === AST_NODE_TYPES2.Identifier) {
+    const object = calleePath(node.object);
+    return object === null ? null : `${object}.${node.property.name}`;
+  }
+  return null;
+}
+var OK_PROP = "ok";
+var OK_PROPS = /* @__PURE__ */ new Set([OK_PROP, "status"]);
+var ASSERTION_NAMES = /^(?:[Aa]ssert|[Ii]nvariant|[Ee]nsure|[Ee]xpect)(?:[A-Z_]\w*)?$/u;
+var COMPARISONS = /* @__PURE__ */ new Set(["===", "!==", "==", "!=", "<", "<=", ">", ">="]);
+var FIRST_ERROR_STATUS = 400;
+function literalValue(node) {
+  if (node.type !== AST_NODE_TYPES2.Literal) {
+    return void 0;
+  }
+  return typeof node.value === "number" || typeof node.value === "boolean" ? node.value : void 0;
+}
+function mirror(operator) {
+  switch (operator) {
+    case "<":
+      return ">";
+    case "<=":
+      return ">=";
+    case ">":
+      return "<";
+    case ">=":
+      return "<=";
+    default:
+      return operator;
+  }
+}
+function booleanPolarity(operator, value) {
+  if (operator === "===" || operator === "==") {
+    return value ? "positive" : "negative";
+  }
+  if (operator === "!==" || operator === "!=") {
+    return value ? "negative" : "positive";
+  }
+  return "opaque";
+}
+function statusPolarity(operator, value) {
+  const isSuccessCode = value >= 200 && value < 300;
+  switch (operator) {
+    case "===":
+    case "==":
+      return isSuccessCode ? "positive" : "opaque";
+    case "!==":
+    case "!=":
+      return isSuccessCode ? "negative" : "opaque";
+    case "<":
+      return value <= FIRST_ERROR_STATUS ? "positive" : "opaque";
+    case "<=":
+      return value < FIRST_ERROR_STATUS ? "positive" : "opaque";
+    // A failure test is only useful for what it says about the OTHER side, so
+    // what matters is that everything below the threshold is a success:
+    // `>= 300` and `>= 400` both leave only good responses behind, while
+    // `>= 500` leaves every 4xx there.
+    case ">=":
+      return value <= FIRST_ERROR_STATUS ? "negative" : "opaque";
+    case ">":
+      return value < FIRST_ERROR_STATUS ? "negative" : "opaque";
+    default:
+      return "opaque";
+  }
+}
+function comparisonPolarity(node, readIsLeft) {
+  const value = literalValue(readIsLeft ? node.right : node.left);
+  const operator = readIsLeft ? node.operator : mirror(node.operator);
+  if (typeof value === "boolean") {
+    return booleanPolarity(operator, value);
+  }
+  return typeof value === "number" ? statusPolarity(operator, value) : "opaque";
+}
+function propReadOn(node, objectName, props) {
+  if (node.type !== AST_NODE_TYPES2.MemberExpression || node.computed) {
+    return false;
+  }
+  if (node.object.type !== AST_NODE_TYPES2.Identifier || node.object.name !== objectName || node.property.type !== AST_NODE_TYPES2.Identifier) {
+    return false;
+  }
+  const name = node.property.name;
+  return typeof props === "string" ? name === props : props.has(name);
+}
+function findJsonReads(root, keys, name) {
+  const reads = [];
+  walkSome(root, keys, (node) => {
+    if (propReadOn(node, name, "json")) {
+      reads.push(node);
+    }
+    return false;
+  });
+  return reads;
+}
+function isAssertionName(node) {
+  return node.type === AST_NODE_TYPES2.Identifier && ASSERTION_NAMES.test(node.name);
+}
+function isAssertionCallee(callee) {
+  if (callee.type === AST_NODE_TYPES2.Identifier) {
+    return isAssertionName(callee);
+  }
+  return callee.type === AST_NODE_TYPES2.MemberExpression && !callee.computed && (isAssertionName(callee.object) || isAssertionName(callee.property));
+}
+var TERMINAL_TYPES = /* @__PURE__ */ new Set([
+  AST_NODE_TYPES2.IfStatement,
+  AST_NODE_TYPES2.WhileStatement,
+  AST_NODE_TYPES2.DoWhileStatement,
+  AST_NODE_TYPES2.ConditionalExpression,
+  AST_NODE_TYPES2.SwitchStatement,
+  AST_NODE_TYPES2.CallExpression
+]);
+var ASSERTION_OPERATORS = /* @__PURE__ */ new Map([
+  ["equal", "==="],
+  ["equals", "==="],
+  ["strictEqual", "==="],
+  ["deepEqual", "==="],
+  ["deepStrictEqual", "==="],
+  ["toBe", "==="],
+  ["toEqual", "==="],
+  ["notEqual", "!=="],
+  ["notStrictEqual", "!=="],
+  ["notDeepEqual", "!=="]
+]);
+function assertionOperator(callee) {
+  return callee.type === AST_NODE_TYPES2.MemberExpression && !callee.computed && callee.property.type === AST_NODE_TYPES2.Identifier ? ASSERTION_OPERATORS.get(callee.property.name) : void 0;
+}
+function assertionCheck(parent, child, check) {
+  if (check.compared) {
+    return check;
+  }
+  const operator = assertionOperator(parent.callee);
+  if (operator === void 0) {
+    return check;
+  }
+  const other = parent.arguments.find((arg) => arg !== child);
+  const value = other === void 0 ? void 0 : literalValue(other);
+  if (typeof value === "boolean") {
+    return {
+      ...check,
+      compared: true,
+      polarity: booleanPolarity(operator, value)
+    };
+  }
+  return typeof value === "number" ? { ...check, compared: true, polarity: statusPolarity(operator, value) } : check;
+}
+function terminalCheck(parent, child, state) {
+  const check = { owner: parent, ...state };
+  switch (parent.type) {
+    case AST_NODE_TYPES2.IfStatement:
+    case AST_NODE_TYPES2.WhileStatement:
+    case AST_NODE_TYPES2.DoWhileStatement:
+    case AST_NODE_TYPES2.ConditionalExpression:
+      return parent.test === child ? check : null;
+    case AST_NODE_TYPES2.SwitchStatement:
+      return parent.discriminant === child ? { ...check, compared: true, polarity: "opaque" } : null;
+    // An assertion settles a status only when it COMPARES it.
+    // `assert.equal(res.status, 200)` does; `assert.ok(res.status)` asserts a
+    // number is truthy, which every response that arrived satisfies. Arity
+    // cannot tell them apart (`assert.ok(res.status, 'message')` also has two
+    // arguments), so the comparison is read from the assertion's own name.
+    case AST_NODE_TYPES2.CallExpression:
+      return isAssertionCallee(parent.callee) && parent.callee !== child ? assertionCheck(parent, child, check) : null;
+    default:
+      return null;
+  }
+}
+function combinatorStep(parent, child, state, parse) {
+  switch (parent.type) {
+    case AST_NODE_TYPES2.UnaryExpression:
+      if (parent.operator === "typeof") {
+        return "stop";
+      }
+      if (parent.operator === "!") {
+        state.polarity = state.polarity === "positive" ? "negative" : "positive";
+      }
+      return "continue";
+    case AST_NODE_TYPES2.BinaryExpression: {
+      if (!COMPARISONS.has(parent.operator)) {
+        return "stop";
+      }
+      const polarity = comparisonPolarity(parent, parent.left === child);
+      state.compared = true;
+      state.polarity = polarity;
+      return polarity === "opaque" ? "stop" : "continue";
+    }
+    case AST_NODE_TYPES2.LogicalExpression:
+      if (parent.operator === "&&") {
+        state.underAnd = true;
+      }
+      if (parent.operator === "||") {
+        state.underOr = true;
+      }
+      return parent.left === child && contains(parent.right, parse) ? { owner: parent, ...state } : "continue";
+    case AST_NODE_TYPES2.ChainExpression:
+    case AST_NODE_TYPES2.TSNonNullExpression:
+      return "continue";
+    default:
+      return "stop";
+  }
+}
+function climb(read, parse) {
+  const state = {
+    polarity: "positive",
+    compared: false,
+    underAnd: false,
+    underOr: false
+  };
+  let child = read;
+  let parent = read.parent;
+  while (parent !== void 0) {
+    if (TERMINAL_TYPES.has(parent.type)) {
+      return terminalCheck(parent, child, state);
+    }
+    const step = combinatorStep(parent, child, state, parse);
+    if (step === "stop") {
+      return null;
+    }
+    if (step !== "continue") {
+      return step;
+    }
+    child = parent;
+    parent = parent.parent;
+  }
+  return null;
+}
+function contains(outer, inner) {
+  return outer.range[0] <= inner.range[0] && outer.range[1] >= inner.range[1];
+}
+function alwaysExits(node) {
+  if (node.type === AST_NODE_TYPES2.ReturnStatement || node.type === AST_NODE_TYPES2.ThrowStatement) {
+    return true;
+  }
+  return node.type === AST_NODE_TYPES2.BlockStatement && node.body.some((stmt) => alwaysExits(stmt));
+}
+function scopeOfCheck(node) {
+  let current = node;
+  while (current.parent !== void 0 && !current.type.endsWith("Statement")) {
+    current = current.parent;
+  }
+  return current.parent ?? current;
+}
+function isSuccessCase(arm) {
+  if (arm.test === null) {
+    return false;
+  }
+  const value = literalValue(arm.test);
+  return typeof value === "number" && value >= 200 && value < 300;
+}
+function switchArmProtects(owner, parse) {
+  const index = owner.cases.findIndex((arm) => contains(arm, parse));
+  const own = owner.cases[index];
+  if (own === void 0 || !isSuccessCase(own)) {
+    return false;
+  }
+  for (let i = index - 1; i >= 0; i -= 1) {
+    const arm = owner.cases[i];
+    if (arm === void 0 || arm.consequent.length > 0) {
+      break;
+    }
+    if (!isSuccessCase(arm)) {
+      return false;
+    }
+  }
+  return true;
+}
+function branchProtects(check, parse) {
+  const { owner } = check;
+  if (owner.type === AST_NODE_TYPES2.SwitchStatement) {
+    return switchArmProtects(owner, parse);
+  }
+  if (owner.type === AST_NODE_TYPES2.LogicalExpression) {
+    if (!contains(owner.right, parse)) {
+      return false;
+    }
+    if (owner.operator === "&&") {
+      return check.polarity === "positive";
+    }
+    return owner.operator === "||" && check.polarity === "negative";
+  }
+  if (owner.type === AST_NODE_TYPES2.WhileStatement || owner.type === AST_NODE_TYPES2.DoWhileStatement) {
+    return contains(owner.body, parse) && entersOnSuccess(check);
+  }
+  if (owner.type !== AST_NODE_TYPES2.ConditionalExpression && owner.type !== AST_NODE_TYPES2.IfStatement) {
+    return false;
+  }
+  if (contains(owner.consequent, parse)) {
+    return entersOnSuccess(check);
+  }
+  return owner.alternate !== null && contains(owner.alternate, parse) && skipsOnSuccess(check);
+}
+function entersOnSuccess(check) {
+  return check.polarity === "positive" && !check.underOr;
+}
+function skipsOnSuccess(check) {
+  return check.polarity === "negative" && !check.underAnd;
+}
+function guardProtects(check, parse) {
+  const { owner } = check;
+  if (owner.type === AST_NODE_TYPES2.CallExpression) {
+    return entersOnSuccess(check) && owner.range[1] <= parse.range[0] && contains(scopeOfCheck(owner), parse);
+  }
+  if (owner.type !== AST_NODE_TYPES2.IfStatement) {
+    return false;
+  }
+  if (owner.range[1] > parse.range[0] || !contains(scopeOfCheck(owner), parse)) {
+    return false;
+  }
+  if (alwaysExits(owner.consequent)) {
+    return skipsOnSuccess(check);
+  }
+  return owner.alternate !== null && alwaysExits(owner.alternate) && entersOnSuccess(check);
+}
+function protects(check, parse) {
+  if (!check.compared) {
+    return false;
+  }
+  return branchProtects(check, parse) || guardProtects(check, parse);
+}
+function statusAliases(root, keys, name) {
+  const aliases = /* @__PURE__ */ new Map();
+  walkSome(root, keys, (node) => {
+    if (node.type === AST_NODE_TYPES2.VariableDeclarator && node.id.type === AST_NODE_TYPES2.Identifier && node.init !== null && propReadOn(node.init, name, OK_PROPS) && node.init.property.type === AST_NODE_TYPES2.Identifier) {
+      aliases.set(node.id.name, node.init.property.name);
+    }
+    return false;
+  });
+  return aliases;
+}
+function checkedProp(node, name, aliases) {
+  if (propReadOn(node, name, OK_PROPS)) {
+    return node.property.type === AST_NODE_TYPES2.Identifier ? node.property.name : void 0;
+  }
+  return node.type === AST_NODE_TYPES2.Identifier ? aliases.get(node.name) : void 0;
+}
+function isProtected(root, keys, name, aliases, parse) {
+  return walkSome(root, keys, (node) => {
+    const prop = checkedProp(node, name, aliases);
+    if (prop === void 0) {
+      return false;
+    }
+    const check = climb(node, parse);
+    if (check === null) {
+      return false;
+    }
+    return protects(
+      prop === OK_PROP ? { ...check, compared: true } : check,
+      parse
+    );
+  });
+}
+function scopeOf(node) {
+  let current = node.parent;
+  while (current !== void 0) {
+    if (current.type === AST_NODE_TYPES2.BlockStatement || current.type === AST_NODE_TYPES2.Program) {
+      return current;
+    }
+    current = current.parent;
+  }
+  return node;
+}
+function skipAwait(node) {
+  return node?.type === AST_NODE_TYPES2.AwaitExpression ? node.parent : node;
+}
+function thenCallbackParam(node) {
+  if (node.type !== AST_NODE_TYPES2.MemberExpression || node.computed || node.property.type !== AST_NODE_TYPES2.Identifier || node.property.name !== "then" || node.parent.type !== AST_NODE_TYPES2.CallExpression) {
+    return null;
+  }
+  const callback = node.parent.arguments[0];
+  if (callback === void 0 || callback.type !== AST_NODE_TYPES2.ArrowFunctionExpression && callback.type !== AST_NODE_TYPES2.FunctionExpression) {
+    return null;
+  }
+  const param = callback.params[0];
+  return param?.type === AST_NODE_TYPES2.Identifier ? { name: param.name, body: callback.body } : null;
+}
+var fetchMustCheckOkRule = createRule({
+  name: RULE_NAME2,
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Require a fetch response to be checked with `.ok` or a status comparison before `.json()` parses its body."
+    },
+    schema: [optionSchema2],
+    messages: {
+      missingOkCheck: "`fetch` resolves on 4xx/5xx too, so `.json()` here can parse an error body as data. Check `response.ok` (or compare the status) and leave early before reading the body."
+    }
+  },
+  defaultOptions: [{ fetchFunctions: ["fetch"] }],
+  create(context, [options]) {
+    const fetchFunctions = new Set(options.fetchFunctions ?? ["fetch"]);
+    const keys = context.sourceCode.visitorKeys;
+    function reportUnprotected(root, name) {
+      const aliases = statusAliases(root, keys, name);
+      for (const read of findJsonReads(root, keys, name)) {
+        if (!isProtected(root, keys, name, aliases, read)) {
+          context.report({ node: read, messageId: "missingOkCheck" });
+        }
+      }
+    }
+    return {
+      CallExpression(node) {
+        const path2 = calleePath(node.callee);
+        if (path2 === null || !fetchFunctions.has(path2)) {
+          return;
+        }
+        const parent = skipAwait(node.parent);
+        if (parent === void 0) {
+          return;
+        }
+        if (parent.type === AST_NODE_TYPES2.MemberExpression && !parent.computed && parent.property.type === AST_NODE_TYPES2.Identifier && parent.property.name === "json") {
+          context.report({ node: parent, messageId: "missingOkCheck" });
+          return;
+        }
+        const callback = thenCallbackParam(parent);
+        if (callback !== null) {
+          reportUnprotected(callback.body, callback.name);
+          return;
+        }
+        if (parent.type !== AST_NODE_TYPES2.VariableDeclarator || parent.id.type !== AST_NODE_TYPES2.Identifier) {
+          return;
+        }
+        reportUnprotected(scopeOf(parent), parent.id.name);
+      }
+    };
+  }
+});
+
+// src/rules/money-must-be-decimal.ts
+import { AST_NODE_TYPES as AST_NODE_TYPES3 } from "@typescript-eslint/utils";
+var RULE_NAME3 = "money-must-be-decimal";
 var DEFAULT_DECIMAL_TYPE = "Decimal";
 var DEFAULT_FIELD_PATTERNS = [
   "amount",
@@ -125,7 +594,7 @@ var DEFAULT_FIELD_PATTERNS = [
   "balance"
 ];
 var DEFAULT_ALLOWED_FILES = [];
-var optionSchema2 = {
+var optionSchema3 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -154,22 +623,22 @@ function isAllowedFile(filename, patterns) {
   return patterns.some((pattern) => normalized.endsWith(toForwardSlash(pattern)));
 }
 function staticName(node) {
-  if (node.type === AST_NODE_TYPES2.Identifier) {
+  if (node.type === AST_NODE_TYPES3.Identifier) {
     return node.name;
   }
   return void 0;
 }
 function isNumberAnnotation(annotation) {
-  return annotation?.typeAnnotation.type === AST_NODE_TYPES2.TSNumberKeyword;
+  return annotation?.typeAnnotation.type === AST_NODE_TYPES3.TSNumberKeyword;
 }
 var moneyMustBeDecimalRule = createRule({
-  name: RULE_NAME2,
+  name: RULE_NAME3,
   meta: {
     type: "problem",
     docs: {
       description: "Disallow monetary values typed as the JS primitive `number`. Money-named fields explicitly typed `: number` lose precision to float rounding; use a Decimal money type instead."
     },
-    schema: [optionSchema2],
+    schema: [optionSchema3],
     messages: {
       moneyMustBeDecimal: "Monetary values must use {{decimalType}}, never the JS `number` primitive, to avoid float rounding errors. Rename or retype this field to a {{decimalType}} money type."
     }
@@ -205,7 +674,7 @@ var moneyMustBeDecimalRule = createRule({
       },
       // `const total: number = ...`: annotated variable declarator.
       VariableDeclarator(node) {
-        if (node.id.type !== AST_NODE_TYPES2.Identifier) {
+        if (node.id.type !== AST_NODE_TYPES3.Identifier) {
           return;
         }
         const name = node.id.name;
@@ -218,15 +687,15 @@ var moneyMustBeDecimalRule = createRule({
 });
 
 // src/rules/no-direct-process-env.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES3 } from "@typescript-eslint/utils";
-var RULE_NAME3 = "no-direct-process-env";
+import { AST_NODE_TYPES as AST_NODE_TYPES4 } from "@typescript-eslint/utils";
+var RULE_NAME4 = "no-direct-process-env";
 var DEFAULT_CONFIG_MODULE = "@/config";
 var DEFAULT_ALLOWED_FILES2 = [
   "**/*.config.{ts,js,mjs,cjs}",
   "**/*.{spec,test}.{ts,tsx}",
   "**/scripts/**"
 ];
-var optionSchema3 = {
+var optionSchema4 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -281,22 +750,22 @@ function isAllowedFile2(filename, patterns) {
   return patterns.some((pattern) => globToRegExp(pattern).test(normalized));
 }
 function isProcessEnv2(node) {
-  if (node.type !== AST_NODE_TYPES3.MemberExpression || node.object.type !== AST_NODE_TYPES3.Identifier || node.object.name !== "process") {
+  if (node.type !== AST_NODE_TYPES4.MemberExpression || node.object.type !== AST_NODE_TYPES4.Identifier || node.object.name !== "process") {
     return false;
   }
   if (node.computed) {
-    return node.property.type === AST_NODE_TYPES3.Literal && node.property.value === "env";
+    return node.property.type === AST_NODE_TYPES4.Literal && node.property.value === "env";
   }
-  return node.property.type === AST_NODE_TYPES3.Identifier && node.property.name === "env";
+  return node.property.type === AST_NODE_TYPES4.Identifier && node.property.name === "env";
 }
 var noDirectProcessEnvRule = createRule({
-  name: RULE_NAME3,
+  name: RULE_NAME4,
   meta: {
     type: "problem",
     docs: {
       description: "Disallow direct `process.env` access. Force every consumer through a typed, validated config accessor so a missing variable fails at boot, not at use."
     },
-    schema: [optionSchema3],
+    schema: [optionSchema4],
     messages: {
       directProcessEnv: "Read environment variables through your typed config accessor (import from `{{configModule}}`). Direct `process.env` access bypasses boot-time validation."
     }
@@ -331,10 +800,10 @@ var noDirectProcessEnvRule = createRule({
 });
 
 // src/rules/no-error-stringify.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES4 } from "@typescript-eslint/utils";
-var RULE_NAME4 = "no-error-stringify";
+import { AST_NODE_TYPES as AST_NODE_TYPES5 } from "@typescript-eslint/utils";
+var RULE_NAME5 = "no-error-stringify";
 var DEFAULT_ERROR_NAMES = ["error", "err", "e", "cause"];
-var optionSchema4 = {
+var optionSchema5 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -347,19 +816,19 @@ var optionSchema4 = {
   }
 };
 function isEmptyStringLiteral(node) {
-  return node.type === AST_NODE_TYPES4.Literal && node.value === "";
+  return node.type === AST_NODE_TYPES5.Literal && node.value === "";
 }
 function isErrorIdentifier(node, names) {
-  return node.type === AST_NODE_TYPES4.Identifier && names.has(node.name);
+  return node.type === AST_NODE_TYPES5.Identifier && names.has(node.name);
 }
 var noErrorStringifyRule = createRule({
-  name: RULE_NAME4,
+  name: RULE_NAME5,
   meta: {
     type: "problem",
     docs: {
       description: 'Disallow stringifying an error with bare `${error}` interpolation, `error.toString()`, or `error + ""`. These drop the cause chain. Use `error instanceof Error ? error.message : String(error)` instead.'
     },
-    schema: [optionSchema4],
+    schema: [optionSchema5],
     messages: {
       noErrorStringify: "Stringifying an error this way drops its cause chain. Use `{{name}} instanceof Error ? {{name}}.message : String({{name}})` (or pass the Error object straight to the logger)."
     }
@@ -374,7 +843,7 @@ var noErrorStringifyRule = createRule({
       // `error.toString()`
       'CallExpression[callee.type="MemberExpression"]'(node) {
         const callee = node.callee;
-        if (!callee.computed && callee.property.type === AST_NODE_TYPES4.Identifier && callee.property.name === "toString" && node.arguments.length === 0 && isErrorIdentifier(callee.object, errorNames)) {
+        if (!callee.computed && callee.property.type === AST_NODE_TYPES5.Identifier && callee.property.name === "toString" && node.arguments.length === 0 && isErrorIdentifier(callee.object, errorNames)) {
           report(node, callee.object.name);
         }
       },
@@ -407,14 +876,14 @@ var noErrorStringifyRule = createRule({
 });
 
 // src/rules/require-error-cause.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES5 } from "@typescript-eslint/utils";
-var RULE_NAME5 = "require-error-cause";
+import { AST_NODE_TYPES as AST_NODE_TYPES6 } from "@typescript-eslint/utils";
+var RULE_NAME6 = "require-error-cause";
 function constructorSimpleName(node) {
   const callee = node.callee;
-  if (callee.type === AST_NODE_TYPES5.Identifier) {
+  if (callee.type === AST_NODE_TYPES6.Identifier) {
     return callee.name;
   }
-  if (callee.type === AST_NODE_TYPES5.MemberExpression && !callee.computed && callee.property.type === AST_NODE_TYPES5.Identifier) {
+  if (callee.type === AST_NODE_TYPES6.MemberExpression && !callee.computed && callee.property.type === AST_NODE_TYPES6.Identifier) {
     return callee.property.name;
   }
   return null;
@@ -424,16 +893,16 @@ function isErrorLikeName(name) {
 }
 function alreadyHasCause(node) {
   for (const arg of node.arguments) {
-    if (arg.type === AST_NODE_TYPES5.SpreadElement) {
+    if (arg.type === AST_NODE_TYPES6.SpreadElement) {
       return true;
     }
-    if (arg.type === AST_NODE_TYPES5.ObjectExpression) {
+    if (arg.type === AST_NODE_TYPES6.ObjectExpression) {
       for (const prop of arg.properties) {
-        if (prop.type === AST_NODE_TYPES5.SpreadElement) {
+        if (prop.type === AST_NODE_TYPES6.SpreadElement) {
           return true;
         }
         const key = prop.key;
-        const isCause = key.type === AST_NODE_TYPES5.Identifier && key.name === "cause" || key.type === AST_NODE_TYPES5.Literal && key.value === "cause";
+        const isCause = key.type === AST_NODE_TYPES6.Identifier && key.name === "cause" || key.type === AST_NODE_TYPES6.Literal && key.value === "cause";
         if (isCause) {
           return true;
         }
@@ -451,7 +920,7 @@ function buildFix(node, binding) {
   if (last === void 0) {
     return null;
   }
-  if (last.type === AST_NODE_TYPES5.ObjectExpression) {
+  if (last.type === AST_NODE_TYPES6.ObjectExpression) {
     const props = last.properties;
     if (props.length === 0) {
       return (fixer) => fixer.replaceText(last, `{ cause: ${binding} }`);
@@ -465,7 +934,7 @@ function buildFix(node, binding) {
   return (fixer) => fixer.insertTextAfter(last, `, { cause: ${binding} }`);
 }
 var requireErrorCauseRule = createRule({
-  name: RULE_NAME5,
+  name: RULE_NAME6,
   meta: {
     type: "problem",
     docs: {
@@ -484,7 +953,7 @@ var requireErrorCauseRule = createRule({
       CatchClause(node) {
         const param = node.param;
         catchBindings.push(
-          param && param.type === AST_NODE_TYPES5.Identifier ? param.name : null
+          param && param.type === AST_NODE_TYPES6.Identifier ? param.name : null
         );
       },
       "CatchClause:exit"() {
@@ -496,7 +965,7 @@ var requireErrorCauseRule = createRule({
           return;
         }
         const arg = node.argument;
-        if (arg.type !== AST_NODE_TYPES5.NewExpression) {
+        if (arg.type !== AST_NODE_TYPES6.NewExpression) {
           return;
         }
         const ctor = constructorSimpleName(arg);
@@ -519,9 +988,9 @@ var requireErrorCauseRule = createRule({
 });
 
 // src/rules/require-registered-keys.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES6 } from "@typescript-eslint/utils";
-var RULE_NAME6 = "require-registered-keys";
-var optionSchema5 = {
+import { AST_NODE_TYPES as AST_NODE_TYPES7 } from "@typescript-eslint/utils";
+var RULE_NAME7 = "require-registered-keys";
+var optionSchema6 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -540,30 +1009,30 @@ var optionSchema5 = {
     registry: { type: "string", minLength: 1 }
   }
 };
-function calleePath(callee) {
-  if (callee.type === AST_NODE_TYPES6.Identifier) {
+function calleePath2(callee) {
+  if (callee.type === AST_NODE_TYPES7.Identifier) {
     return callee.name;
   }
-  if (callee.type === AST_NODE_TYPES6.MemberExpression && !callee.computed) {
-    if (callee.property.type !== AST_NODE_TYPES6.Identifier) {
+  if (callee.type === AST_NODE_TYPES7.MemberExpression && !callee.computed) {
+    if (callee.property.type !== AST_NODE_TYPES7.Identifier) {
       return null;
     }
-    const objectPath = calleePath(callee.object);
+    const objectPath = calleePath2(callee.object);
     return objectPath === null ? null : `${objectPath}.${callee.property.name}`;
   }
   return null;
 }
 function isStringLiteral(node) {
-  return node.type === AST_NODE_TYPES6.Literal && typeof node.value === "string";
+  return node.type === AST_NODE_TYPES7.Literal && typeof node.value === "string";
 }
 var requireRegisteredKeysRule = createRule({
-  name: RULE_NAME6,
+  name: RULE_NAME7,
   meta: {
     type: "suggestion",
     docs: {
       description: "Require the key/name argument of configured sink APIs (storage, event channels, cache keys) to be an imported constant from a registry module, not a raw string literal."
     },
-    schema: [optionSchema5],
+    schema: [optionSchema6],
     messages: {
       unregisteredKey: "Pass an imported key constant to `{{callee}}`, not the raw string {{value}}{{registryHint}}. Raw string keys drift out of sync across call sites."
     }
@@ -587,7 +1056,7 @@ var requireRegisteredKeysRule = createRule({
     const registryHint = registry ? ` (import it from '${registry}')` : "";
     return {
       CallExpression(node) {
-        const path2 = calleePath(node.callee);
+        const path2 = calleePath2(node.callee);
         if (path2 === null) {
           return;
         }
@@ -611,29 +1080,29 @@ var requireRegisteredKeysRule = createRule({
 });
 
 // src/rules/require-schema-parse-at-boundary.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES7 } from "@typescript-eslint/utils";
-var RULE_NAME7 = "require-schema-parse-at-boundary";
+import { AST_NODE_TYPES as AST_NODE_TYPES8 } from "@typescript-eslint/utils";
+var RULE_NAME8 = "require-schema-parse-at-boundary";
 function isJsonParseCall(node) {
-  return node.type === AST_NODE_TYPES7.CallExpression && node.callee.type === AST_NODE_TYPES7.MemberExpression && !node.callee.computed && node.callee.object.type === AST_NODE_TYPES7.Identifier && node.callee.object.name === "JSON" && node.callee.property.type === AST_NODE_TYPES7.Identifier && node.callee.property.name === "parse";
+  return node.type === AST_NODE_TYPES8.CallExpression && node.callee.type === AST_NODE_TYPES8.MemberExpression && !node.callee.computed && node.callee.object.type === AST_NODE_TYPES8.Identifier && node.callee.object.name === "JSON" && node.callee.property.type === AST_NODE_TYPES8.Identifier && node.callee.property.name === "parse";
 }
 function isAwaitJsonCall(node) {
-  if (node.type !== AST_NODE_TYPES7.AwaitExpression) {
+  if (node.type !== AST_NODE_TYPES8.AwaitExpression) {
     return false;
   }
   const call = node.argument;
-  return call.type === AST_NODE_TYPES7.CallExpression && call.arguments.length === 0 && call.callee.type === AST_NODE_TYPES7.MemberExpression && !call.callee.computed && call.callee.property.type === AST_NODE_TYPES7.Identifier && call.callee.property.name === "json";
+  return call.type === AST_NODE_TYPES8.CallExpression && call.arguments.length === 0 && call.callee.type === AST_NODE_TYPES8.MemberExpression && !call.callee.computed && call.callee.property.type === AST_NODE_TYPES8.Identifier && call.callee.property.name === "json";
 }
 function isShapeClaim(annotation) {
-  if (annotation.type === AST_NODE_TYPES7.TSArrayType) {
+  if (annotation.type === AST_NODE_TYPES8.TSArrayType) {
     return true;
   }
-  if (annotation.type === AST_NODE_TYPES7.TSTypeReference) {
-    return !(annotation.typeName.type === AST_NODE_TYPES7.Identifier && annotation.typeName.name === "const");
+  if (annotation.type === AST_NODE_TYPES8.TSTypeReference) {
+    return !(annotation.typeName.type === AST_NODE_TYPES8.Identifier && annotation.typeName.name === "const");
   }
   return false;
 }
 var requireSchemaParseAtBoundaryRule = createRule({
-  name: RULE_NAME7,
+  name: RULE_NAME8,
   meta: {
     type: "problem",
     docs: {
@@ -661,10 +1130,10 @@ var requireSchemaParseAtBoundaryRule = createRule({
 });
 
 // src/rules/restrict-throw-to-taxonomy.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES8 } from "@typescript-eslint/utils";
-var RULE_NAME8 = "restrict-throw-to-taxonomy";
+import { AST_NODE_TYPES as AST_NODE_TYPES9 } from "@typescript-eslint/utils";
+var RULE_NAME9 = "restrict-throw-to-taxonomy";
 var DEFAULT_ALLOW = ["Error"];
-var optionSchema6 = {
+var optionSchema7 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -677,25 +1146,25 @@ var optionSchema6 = {
 };
 function constructorSimpleName2(node) {
   const callee = node.callee;
-  if (callee.type === AST_NODE_TYPES8.Identifier) {
+  if (callee.type === AST_NODE_TYPES9.Identifier) {
     return callee.name;
   }
-  if (callee.type === AST_NODE_TYPES8.MemberExpression && !callee.computed && callee.property.type === AST_NODE_TYPES8.Identifier) {
+  if (callee.type === AST_NODE_TYPES9.MemberExpression && !callee.computed && callee.property.type === AST_NODE_TYPES9.Identifier) {
     return callee.property.name;
   }
   return null;
 }
 function isNonErrorValue(node) {
-  return node.type === AST_NODE_TYPES8.Literal || node.type === AST_NODE_TYPES8.TemplateLiteral || node.type === AST_NODE_TYPES8.ObjectExpression || node.type === AST_NODE_TYPES8.ArrayExpression;
+  return node.type === AST_NODE_TYPES9.Literal || node.type === AST_NODE_TYPES9.TemplateLiteral || node.type === AST_NODE_TYPES9.ObjectExpression || node.type === AST_NODE_TYPES9.ArrayExpression;
 }
 var restrictThrowToTaxonomyRule = createRule({
-  name: RULE_NAME8,
+  name: RULE_NAME9,
   meta: {
     type: "problem",
     docs: {
       description: "Restrict `throw` to an approved error taxonomy. Flags throwing a non-allowlisted error class and throwing a non-Error value (string, object, number, ...)."
     },
-    schema: [optionSchema6],
+    schema: [optionSchema7],
     messages: {
       disallowedErrorClass: "Throw an error from your taxonomy, not `{{name}}`. Allowed: {{allowed}}. Add `{{name}}` to the `allow` option if it belongs to your taxonomy.",
       nonErrorThrow: "Throw an Error from your taxonomy, not a bare {{kind}} value. A non-Error throw carries no stack or cause."
@@ -708,7 +1177,7 @@ var restrictThrowToTaxonomyRule = createRule({
     return {
       ThrowStatement(node) {
         const arg = node.argument;
-        if (arg.type === AST_NODE_TYPES8.NewExpression) {
+        if (arg.type === AST_NODE_TYPES9.NewExpression) {
           const name = constructorSimpleName2(arg);
           if (name !== null && !allow.has(name)) {
             context.report({
@@ -720,7 +1189,7 @@ var restrictThrowToTaxonomyRule = createRule({
           return;
         }
         if (isNonErrorValue(arg)) {
-          const kind = arg.type === AST_NODE_TYPES8.ObjectExpression ? "object" : arg.type === AST_NODE_TYPES8.ArrayExpression ? "array" : "literal";
+          const kind = arg.type === AST_NODE_TYPES9.ObjectExpression ? "object" : arg.type === AST_NODE_TYPES9.ArrayExpression ? "array" : "literal";
           context.report({ node: arg, messageId: "nonErrorThrow", data: { kind } });
         }
       }
@@ -728,10 +1197,184 @@ var restrictThrowToTaxonomyRule = createRule({
   }
 });
 
+// src/rules/schema-enum-field-consistency.ts
+import { AST_NODE_TYPES as AST_NODE_TYPES10 } from "@typescript-eslint/utils";
+var RULE_NAME10 = "schema-enum-field-consistency";
+var MODIFIERS = /* @__PURE__ */ new Set([
+  "optional",
+  "nullable",
+  "nullish",
+  "default",
+  "prefault",
+  "catch",
+  "describe",
+  "meta",
+  "readonly"
+]);
+var ENUM_PRESERVING = /* @__PURE__ */ new Set(["extract", "exclude"]);
+var OUTPUT_CHANGING = /* @__PURE__ */ new Set(["pipe", "transform"]);
+var OBJECT_FACTORIES = /* @__PURE__ */ new Set(["object", "strictObject", "looseObject"]);
+var SHAPE_EXTENDERS = /* @__PURE__ */ new Set(["extend", "safeExtend"]);
+var ENUM_FACTORIES = /* @__PURE__ */ new Set(["enum", "nativeEnum"]);
+var UNION = /* @__PURE__ */ new Set(["union"]);
+var LITERAL = /* @__PURE__ */ new Set(["literal"]);
+var STRING = /* @__PURE__ */ new Set(["string"]);
+var optionSchema8 = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    zodIdentifiers: { type: "array", items: { type: "string" }, uniqueItems: true },
+    ignoreFields: { type: "array", items: { type: "string" }, uniqueItems: true },
+    enumIdentifierPattern: { type: "string" }
+  }
+};
+var OTHER = { kind: "other" };
+function isEnumOccurrence(occurrence) {
+  return occurrence.kind.kind === "enum";
+}
+function methodCall(node) {
+  if (node.type !== AST_NODE_TYPES10.CallExpression) return null;
+  const callee = node.callee;
+  if (callee.type !== AST_NODE_TYPES10.MemberExpression || callee.computed) return null;
+  if (callee.property.type !== AST_NODE_TYPES10.Identifier) return null;
+  return { receiver: callee.object, method: callee.property.name, call: node };
+}
+function propertyName(property) {
+  if (property.computed) return null;
+  if (property.key.type === AST_NODE_TYPES10.Identifier) return property.key.name;
+  if (property.key.type === AST_NODE_TYPES10.Literal && typeof property.key.value === "string") {
+    return property.key.value;
+  }
+  return null;
+}
+var schemaEnumFieldConsistencyRule = createRule({
+  name: RULE_NAME10,
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow a zod field that is an enum in one object schema of a module from being `z.string()` in another, which widens the wire type every consumer then narrows by hand."
+    },
+    schema: [optionSchema8],
+    messages: {
+      widenedEnumField: "`{{field}}` is `z.string()` here but an enum on line {{line}} of this file. The widened type leaks `string` to every consumer, which then has to narrow or cast it. Use {{suggestion}} instead (and, if the stored data is free text, migrate it first)."
+    }
+  },
+  defaultOptions: [{ zodIdentifiers: ["z"], ignoreFields: [] }],
+  create(context, [options]) {
+    const zodIdentifiers = new Set(options.zodIdentifiers ?? ["z"]);
+    const ignoreFields = new Set(options.ignoreFields ?? []);
+    const enumIdentifierPattern = options.enumIdentifierPattern === void 0 ? null : new RegExp(options.enumIdentifierPattern, "u");
+    const sourceCode = context.sourceCode;
+    const fields = /* @__PURE__ */ new Map();
+    function isZodCall(node, names) {
+      const call = methodCall(node);
+      return call !== null && call.receiver.type === AST_NODE_TYPES10.Identifier && zodIdentifiers.has(call.receiver.name) && names.has(call.method);
+    }
+    function resolveVariable(identifier) {
+      let scope = sourceCode.getScope(identifier);
+      while (scope !== null) {
+        const variable = scope.set.get(identifier.name);
+        if (variable !== void 0) return variable;
+        scope = scope.upper;
+      }
+      return null;
+    }
+    function identifierIsEnum(identifier, seen) {
+      const definition = resolveVariable(identifier)?.defs[0];
+      if (definition === void 0) return false;
+      if (definition.type === "ImportBinding") {
+        return enumIdentifierPattern !== null && enumIdentifierPattern.test(identifier.name);
+      }
+      if (definition.type !== "Variable") return false;
+      const init = definition.node.init;
+      if (init === null || seen.has(init)) return false;
+      return classify(init, /* @__PURE__ */ new Set([...seen, init])).kind === "enum";
+    }
+    function isLiteralUnion(node) {
+      if (!isZodCall(node, UNION)) return false;
+      const members = node.arguments[0];
+      if (members?.type !== AST_NODE_TYPES10.ArrayExpression || members.elements.length === 0) {
+        return false;
+      }
+      return members.elements.every((element) => element !== null && isZodCall(element, LITERAL));
+    }
+    function isMultiLiteral(node) {
+      if (!isZodCall(node, LITERAL)) return false;
+      const value = node.arguments[0];
+      return value?.type === AST_NODE_TYPES10.ArrayExpression && value.elements.length > 1;
+    }
+    function classify(node, seen) {
+      let current = node;
+      for (; ; ) {
+        const call = methodCall(current);
+        if (call === null || !(MODIFIERS.has(call.method) || ENUM_PRESERVING.has(call.method))) {
+          break;
+        }
+        current = call.receiver;
+      }
+      if (current.type === AST_NODE_TYPES10.Identifier) {
+        return identifierIsEnum(current, seen) ? { kind: "enum", identifier: current.name } : OTHER;
+      }
+      if (isZodCall(current, ENUM_FACTORIES) || isLiteralUnion(current) || isMultiLiteral(current)) {
+        return { kind: "enum", identifier: null };
+      }
+      current = node;
+      for (; ; ) {
+        if (isZodCall(current, STRING)) return { kind: "string" };
+        const call = methodCall(current);
+        if (call === null || OUTPUT_CHANGING.has(call.method)) return OTHER;
+        current = call.receiver;
+      }
+    }
+    function collectShape(shape) {
+      if (shape?.type !== AST_NODE_TYPES10.ObjectExpression) return;
+      for (const property of shape.properties) {
+        if (property.type !== AST_NODE_TYPES10.Property) continue;
+        const name = propertyName(property);
+        if (name === null || ignoreFields.has(name)) continue;
+        const kind = classify(property.value, /* @__PURE__ */ new Set());
+        if (kind.kind === "other") continue;
+        const occurrences = fields.get(name) ?? [];
+        occurrences.push({ property, kind });
+        fields.set(name, occurrences);
+      }
+    }
+    return {
+      CallExpression(node) {
+        if (isZodCall(node, OBJECT_FACTORIES)) {
+          collectShape(node.arguments[0]);
+          return;
+        }
+        const call = methodCall(node);
+        if (call !== null && SHAPE_EXTENDERS.has(call.method)) collectShape(node.arguments[0]);
+      },
+      "Program:exit"() {
+        for (const [field, occurrences] of fields) {
+          const enumOccurrence = occurrences.find(isEnumOccurrence);
+          if (enumOccurrence === void 0) continue;
+          const suggestion = enumOccurrence.kind.identifier === null ? "the same enum schema" : `\`${enumOccurrence.kind.identifier}\``;
+          for (const occurrence of occurrences) {
+            if (occurrence.kind.kind !== "string") continue;
+            context.report({
+              node: occurrence.property,
+              messageId: "widenedEnumField",
+              data: {
+                field,
+                line: String(enumOccurrence.property.loc.start.line),
+                suggestion
+              }
+            });
+          }
+        }
+      }
+    };
+  }
+});
+
 // src/rules/wire-message-naming.ts
-var RULE_NAME9 = "wire-message-naming";
+var RULE_NAME11 = "wire-message-naming";
 var DEFAULT_ROLE_SUFFIXES = ["Event", "Command", "Query"];
-var optionSchema7 = {
+var optionSchema9 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -772,14 +1415,14 @@ function typeLiteralNode(obj) {
   return null;
 }
 var wireMessageNamingRule = createRule({
-  name: RULE_NAME9,
+  name: RULE_NAME11,
   meta: {
     type: "problem",
     docs: {
       description: "A message-schema const ending in a role suffix (default Event/Command/Query) whose zod object declares `type: z.literal(...)` must set that literal to kebab-case(const name minus its role suffix)."
     },
     fixable: "code",
-    schema: [optionSchema7],
+    schema: [optionSchema9],
     messages: {
       typeMismatch: "Wire `type` literal '{{actual}}' for `{{name}}` must be '{{expected}}' \u2014 kebab-case of the const name minus its role suffix."
     }
@@ -815,11 +1458,11 @@ var wireMessageNamingRule = createRule({
 });
 
 // src/rules/zod-schema-naming.ts
-var RULE_NAME10 = "zod-schema-naming";
+var RULE_NAME12 = "zod-schema-naming";
 var SCHEMA_NAME = /^[A-Z][A-Za-z0-9]*Schema$/;
 var SUFFIX = "Schema";
 var DEFAULT_ROLE_SUFFIXES2 = [];
-var optionSchema8 = {
+var optionSchema10 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -852,13 +1495,13 @@ function rootIdentifierName(node) {
   return null;
 }
 var zodSchemaNamingRule = createRule({
-  name: RULE_NAME10,
+  name: RULE_NAME12,
   meta: {
     type: "problem",
     docs: {
       description: "Every exported zod schema is a PascalCase const suffixed `Schema`, paired with a same-named inferred type (`export type Foo = z.infer<typeof FooSchema>`)."
     },
-    schema: [optionSchema8],
+    schema: [optionSchema10],
     messages: {
       schemaNaming: "Exported zod schema `{{name}}` must be a PascalCase const ending in `Schema` (e.g. `FooSchema`).",
       missingType: "Schema `{{name}}` has no sibling `export type {{base}} = z.infer<typeof {{name}}>`. Export the inferred type instead of hand-authoring a duplicate."
@@ -919,12 +1562,14 @@ var rules = {
   "restrict-throw-to-taxonomy": restrictThrowToTaxonomyRule,
   "require-registered-keys": requireRegisteredKeysRule,
   "env-var-schema-parity": envVarSchemaParityRule,
-  "require-schema-parse-at-boundary": requireSchemaParseAtBoundaryRule
+  "require-schema-parse-at-boundary": requireSchemaParseAtBoundaryRule,
+  "schema-enum-field-consistency": schemaEnumFieldConsistencyRule,
+  "fetch-must-check-ok": fetchMustCheckOkRule
 };
 
 // src/index.ts
 var NAMESPACE = "noctcore-contracts";
-var VERSION = "0.2.0";
+var VERSION = "0.3.0";
 var plugin = {
   meta: { name: "@noctcore/eslint-plugin-contracts", version: VERSION },
   rules,