@noctcore/eslint-plugin-contracts 0.6.1 → 0.7.0

package/README.md

@@ -51,7 +51,7 @@ Legend: 🔧 = autofixable · 💤 = ships inert / `off` in `recommended` (enabl
 | [`restrict-throw-to-taxonomy`](./docs/rules/restrict-throw-to-taxonomy.md) | `throw` only allowlisted error classes; ban throwing non-Error values. | | |
 | [`require-registered-keys`](./docs/rules/require-registered-keys.md) | Key/name argument of a configured sink API must be an imported constant, not a raw string. | | 💤 |
 | [`env-var-schema-parity`](./docs/rules/env-var-schema-parity.md) | `process.env.FOO` / `import.meta.env.FOO` keys must be declared in a schema file. | | 💤 |
-| [`require-schema-parse-at-boundary`](./docs/rules/require-schema-parse-at-boundary.md) | Ban `JSON.parse(...) as T` / `(await res.json()) as T`; parse boundary data at runtime. | | 💤 |
+| [`require-schema-parse-at-boundary`](./docs/rules/require-schema-parse-at-boundary.md) | Ban `as T` on boundary reads (`JSON.parse`, `res.json()`, web storage, search params, message events, LLM tool input), directly or through a `const`; parse at runtime. | | 💤 |
 | [`schema-enum-field-consistency`](./docs/rules/schema-enum-field-consistency.md) | A field that is an enum in one zod object schema must not be `z.string()` in another schema of the same module. | | |
 | [`fetch-must-check-ok`](./docs/rules/fetch-must-check-ok.md) | A fetch response must be checked with `.ok` or a status comparison before `.json()` parses its body. | | |
 | [`translation-key-exists`](./docs/rules/translation-key-exists.md) | A static i18next / react-i18next key (`t(...)`, `i18n.t(...)`, `<Trans i18nKey>`) must exist in the catalog of the namespace in scope. | | 💤 |

package/dist/index.cjs

@@ -1139,20 +1139,313 @@ var requireRegisteredKeysRule = createRule({
 // src/rules/require-schema-parse-at-boundary.ts
 var import_utils8 = require("@typescript-eslint/utils");
 var RULE_NAME8 = "require-schema-parse-at-boundary";
+var optionSchema7 = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    boundaries: {
+      type: "array",
+      items: { type: "string", minLength: 1 },
+      uniqueItems: true
+    }
+  }
+};
+function parentOf(node) {
+  return node.parent ?? null;
+}
+function memberPath(node) {
+  if (node.type === import_utils8.AST_NODE_TYPES.Identifier) {
+    return node.name;
+  }
+  if (node.type === import_utils8.AST_NODE_TYPES.MemberExpression && !node.computed && node.property.type === import_utils8.AST_NODE_TYPES.Identifier) {
+    const object = memberPath(node.object);
+    return object === null ? null : `${object}.${node.property.name}`;
+  }
+  return null;
+}
+function methodCallReceiver(node, names) {
+  if (node.type === import_utils8.AST_NODE_TYPES.CallExpression && node.callee.type === import_utils8.AST_NODE_TYPES.MemberExpression && !node.callee.computed && node.callee.property.type === import_utils8.AST_NODE_TYPES.Identifier && names.includes(node.callee.property.name)) {
+    return node.callee.object;
+  }
+  return null;
+}
+function unwrap(node) {
+  let current = node;
+  while (current.type === import_utils8.AST_NODE_TYPES.TSNonNullExpression || current.type === import_utils8.AST_NODE_TYPES.ChainExpression) {
+    current = current.expression;
+  }
+  return current;
+}
 function isJsonParseCall(node) {
-  return node.type === import_utils8.AST_NODE_TYPES.CallExpression && node.callee.type === import_utils8.AST_NODE_TYPES.MemberExpression && !node.callee.computed && node.callee.object.type === import_utils8.AST_NODE_TYPES.Identifier && node.callee.object.name === "JSON" && node.callee.property.type === import_utils8.AST_NODE_TYPES.Identifier && node.callee.property.name === "parse";
+  return node.type === import_utils8.AST_NODE_TYPES.CallExpression && memberPath(node.callee) === "JSON.parse";
 }
 function isAwaitJsonCall(node) {
   if (node.type !== import_utils8.AST_NODE_TYPES.AwaitExpression) {
     return false;
   }
   const call = node.argument;
-  return call.type === import_utils8.AST_NODE_TYPES.CallExpression && call.arguments.length === 0 && call.callee.type === import_utils8.AST_NODE_TYPES.MemberExpression && !call.callee.computed && call.callee.property.type === import_utils8.AST_NODE_TYPES.Identifier && call.callee.property.name === "json";
+  return methodCallReceiver(call, ["json"]) !== null && call.type === import_utils8.AST_NODE_TYPES.CallExpression && call.arguments.length === 0;
+}
+function isStorageRead(node) {
+  const receiver = methodCallReceiver(node, ["getItem"]);
+  const path3 = receiver === null ? null : memberPath(receiver);
+  if (path3 === null) {
+    return false;
+  }
+  const last = path3.slice(path3.lastIndexOf(".") + 1);
+  return last === "localStorage" || last === "sessionStorage";
+}
+var BoundaryMatcher = class {
+  sourceCode;
+  boundaries;
+  constructor(sourceCode, boundaries) {
+    this.sourceCode = sourceCode;
+    this.boundaries = new Set(boundaries);
+  }
+  /** True when `expr`, the operand of the cast at `cast`, is boundary data. */
+  isBoundary(expr, cast, seen) {
+    const node = unwrap(expr);
+    if (isJsonParseCall(node) || isAwaitJsonCall(node) || isStorageRead(node) || this.isSearchParamsRead(node) || this.isConfiguredBoundary(node) || this.isMessageEventData(node) || this.isToolUseInput(node)) {
+      return true;
+    }
+    if (node.type !== import_utils8.AST_NODE_TYPES.Identifier) {
+      return false;
+    }
+    const variable = this.resolve(node);
+    if (variable === null || seen.has(variable)) {
+      return false;
+    }
+    seen.add(variable);
+    const init = this.constInit(variable);
+    return init !== null && this.untouchedBefore(variable, node, cast) && this.isBoundary(init, init, seen);
+  }
+  resolve(identifier) {
+    return import_utils8.ASTUtils.findVariable(this.sourceCode.getScope(identifier), identifier) ?? null;
+  }
+  /** The initializer of a single `const name = <init>` declaration, or null. */
+  constInit(variable) {
+    const [def] = variable.defs;
+    if (variable.defs.length !== 1 || def === void 0) {
+      return null;
+    }
+    const declarator = def.node;
+    if (declarator.type !== import_utils8.AST_NODE_TYPES.VariableDeclarator || declarator.id.type !== import_utils8.AST_NODE_TYPES.Identifier || declarator.init === null) {
+      return null;
+    }
+    const declaration = parentOf(declarator);
+    if (declaration?.type !== import_utils8.AST_NODE_TYPES.VariableDeclaration || declaration.kind !== "const") {
+      return null;
+    }
+    return declarator.init;
+  }
+  /**
+   * True when the only reads of `variable` that could run before `cast` are the
+   * `use` itself and other `as` casts, all in the declaring function. Any other
+   * earlier read (a guard, a validator call, a mutation) might have checked the
+   * value, so the cast is given the benefit of the doubt.
+   */
+  untouchedBefore(variable, use, cast) {
+    const home = variable.scope.variableScope;
+    return variable.references.every((reference) => {
+      if (reference.init === true) {
+        return true;
+      }
+      if (reference.from.variableScope !== home) {
+        return false;
+      }
+      const id = reference.identifier;
+      if (id === use || id.range[0] >= cast.range[0]) {
+        return true;
+      }
+      return parentOf(id)?.type === import_utils8.AST_NODE_TYPES.TSAsExpression;
+    });
+  }
+  /** A call whose callee is listed in the `boundaries` option. */
+  isConfiguredBoundary(node) {
+    if (this.boundaries.size === 0) {
+      return false;
+    }
+    const call = node.type === import_utils8.AST_NODE_TYPES.AwaitExpression ? unwrap(node.argument) : node;
+    if (call.type !== import_utils8.AST_NODE_TYPES.CallExpression) {
+      return false;
+    }
+    const path3 = memberPath(call.callee);
+    return path3 !== null && this.boundaries.has(path3);
+  }
+  /** `.get(...)` / `.getAll(...)` on a `URLSearchParams`. */
+  isSearchParamsRead(node) {
+    const receiver = methodCallReceiver(node, ["get", "getAll"]);
+    return receiver !== null && this.isSearchParams(unwrap(receiver), /* @__PURE__ */ new Set());
+  }
+  isSearchParams(node, seen) {
+    if (node.type === import_utils8.AST_NODE_TYPES.NewExpression) {
+      return node.callee.type === import_utils8.AST_NODE_TYPES.Identifier && node.callee.name === "URLSearchParams";
+    }
+    if (node.type === import_utils8.AST_NODE_TYPES.MemberExpression) {
+      return !node.computed && node.property.type === import_utils8.AST_NODE_TYPES.Identifier && node.property.name === "searchParams";
+    }
+    if (node.type !== import_utils8.AST_NODE_TYPES.Identifier) {
+      return false;
+    }
+    if (node.name === "searchParams") {
+      return true;
+    }
+    const variable = this.resolve(node);
+    if (variable === null || seen.has(variable)) {
+      return false;
+    }
+    seen.add(variable);
+    const init = this.constInit(variable);
+    return init !== null && this.isSearchParams(unwrap(init), seen);
+  }
+  /** `event.data` (or a `{ data }` destructured parameter) in a `message` listener. */
+  isMessageEventData(node) {
+    let identifier;
+    if (node.type === import_utils8.AST_NODE_TYPES.MemberExpression) {
+      if (node.computed || node.property.type !== import_utils8.AST_NODE_TYPES.Identifier || node.property.name !== "data" || node.object.type !== import_utils8.AST_NODE_TYPES.Identifier) {
+        return false;
+      }
+      identifier = node.object;
+    } else if (node.type === import_utils8.AST_NODE_TYPES.Identifier) {
+      identifier = node;
+    } else {
+      return false;
+    }
+    const variable = this.resolve(identifier);
+    const param = variable === null ? null : parameterOf(variable);
+    if (param === null) {
+      return false;
+    }
+    const { fn, name } = param;
+    const [first] = fn.params;
+    if (first === void 0) {
+      return false;
+    }
+    const isParamItself = name === first;
+    const isDestructuredData = first.type === import_utils8.AST_NODE_TYPES.ObjectPattern && first.properties.some(
+      (property) => property.type === import_utils8.AST_NODE_TYPES.Property && !property.computed && property.key.type === import_utils8.AST_NODE_TYPES.Identifier && property.key.name === "data" && property.value === name
+    );
+    if (node.type === import_utils8.AST_NODE_TYPES.MemberExpression ? !isParamItself : !isDestructuredData) {
+      return false;
+    }
+    return isMessageListener(fn);
+  }
+  /** `block.input` where `block` is narrowed to an Anthropic `tool_use` content block. */
+  isToolUseInput(node) {
+    if (node.type !== import_utils8.AST_NODE_TYPES.MemberExpression || node.computed || node.property.type !== import_utils8.AST_NODE_TYPES.Identifier || node.property.name !== "input") {
+      return false;
+    }
+    const block = unwrap(node.object);
+    const blockText = this.sourceCode.getText(block);
+    if (this.isGuardedAsToolUse(node, blockText)) {
+      return true;
+    }
+    if (block.type !== import_utils8.AST_NODE_TYPES.Identifier) {
+      return false;
+    }
+    const variable = this.resolve(block);
+    if (variable === null) {
+      return false;
+    }
+    const init = this.constInit(variable);
+    if (init !== null) {
+      const receiver = methodCallReceiver(unwrap(init), ["find"]);
+      const call = unwrap(init);
+      return receiver !== null && call.type === import_utils8.AST_NODE_TYPES.CallExpression && this.isToolUsePredicate(call.arguments[0]);
+    }
+    const param = parameterOf(variable);
+    if (param !== null && param.fn.params[0] === param.name) {
+      const call = parentOf(param.fn);
+      if (call?.type !== import_utils8.AST_NODE_TYPES.CallExpression || call.arguments[0] !== param.fn || methodCallReceiver(call, ["map", "flatMap", "forEach"]) === null) {
+        return false;
+      }
+      const filtered = unwrap(call.callee.object);
+      return methodCallReceiver(filtered, ["filter"]) !== null && filtered.type === import_utils8.AST_NODE_TYPES.CallExpression && this.isToolUsePredicate(filtered.arguments[0]);
+    }
+    return false;
+  }
+  /** `(b) => b.type === 'tool_use'`, optionally with a type-predicate return. */
+  isToolUsePredicate(node) {
+    if (node?.type !== import_utils8.AST_NODE_TYPES.ArrowFunctionExpression || node.body.type === import_utils8.AST_NODE_TYPES.BlockStatement) {
+      return false;
+    }
+    const [param] = node.params;
+    return param?.type === import_utils8.AST_NODE_TYPES.Identifier && this.testProvesToolUse(node.body, param.name);
+  }
+  /** An enclosing `if` / `?:` / `&&` / `case 'tool_use':` narrows `blockText`. */
+  isGuardedAsToolUse(from, blockText) {
+    let child = from;
+    for (let parent = parentOf(child); parent !== null; child = parent, parent = parentOf(child)) {
+      switch (parent.type) {
+        case import_utils8.AST_NODE_TYPES.IfStatement:
+        case import_utils8.AST_NODE_TYPES.ConditionalExpression:
+          if (parent.consequent === child && this.testProvesToolUse(parent.test, blockText)) {
+            return true;
+          }
+          break;
+        case import_utils8.AST_NODE_TYPES.LogicalExpression:
+          if (parent.operator === "&&" && parent.right === child && this.testProvesToolUse(parent.left, blockText)) {
+            return true;
+          }
+          break;
+        case import_utils8.AST_NODE_TYPES.SwitchCase: {
+          const statement = parentOf(parent);
+          if (parent.test?.type === import_utils8.AST_NODE_TYPES.Literal && parent.test.value === "tool_use" && statement?.type === import_utils8.AST_NODE_TYPES.SwitchStatement && this.sourceCode.getText(statement.discriminant) === `${blockText}.type`) {
+            return true;
+          }
+          break;
+        }
+        default:
+          break;
+      }
+    }
+    return false;
+  }
+  /** `<blockText>.type === 'tool_use'`, possibly one conjunct of an `&&` chain. */
+  testProvesToolUse(test, blockText) {
+    if (test.type === import_utils8.AST_NODE_TYPES.LogicalExpression && test.operator === "&&") {
+      return this.testProvesToolUse(test.left, blockText) || this.testProvesToolUse(test.right, blockText);
+    }
+    if (test.type !== import_utils8.AST_NODE_TYPES.BinaryExpression || test.operator !== "===" && test.operator !== "==") {
+      return false;
+    }
+    const typeText = `${blockText}.type`;
+    const isToolUse = (node) => node.type === import_utils8.AST_NODE_TYPES.Literal && node.value === "tool_use";
+    const isTypeRead = (node) => this.sourceCode.getText(unwrap(node)) === typeText || this.sourceCode.getText(node) === `${blockText}?.type`;
+    return isTypeRead(test.left) && isToolUse(test.right) || isToolUse(test.left) && isTypeRead(test.right);
+  }
+};
+function parameterOf(variable) {
+  const [def] = variable.defs;
+  if (variable.defs.length !== 1 || def === void 0 || def.type !== "Parameter") {
+    return null;
+  }
+  const fn = def.node;
+  if (fn.type !== import_utils8.AST_NODE_TYPES.ArrowFunctionExpression && fn.type !== import_utils8.AST_NODE_TYPES.FunctionDeclaration && fn.type !== import_utils8.AST_NODE_TYPES.FunctionExpression) {
+    return null;
+  }
+  return { fn, name: def.name };
+}
+function isMessageListener(fn) {
+  const parent = parentOf(fn);
+  if (parent?.type === import_utils8.AST_NODE_TYPES.CallExpression) {
+    const [event, listener] = parent.arguments;
+    const callee = memberPath(parent.callee);
+    return listener === fn && event?.type === import_utils8.AST_NODE_TYPES.Literal && event.value === "message" && callee !== null && (callee === "addEventListener" || callee.endsWith(".addEventListener"));
+  }
+  if (parent?.type === import_utils8.AST_NODE_TYPES.AssignmentExpression && parent.right === fn) {
+    const target = memberPath(parent.left);
+    return target !== null && (target === "onmessage" || target.endsWith(".onmessage"));
+  }
+  return false;
 }
 function isShapeClaim(annotation) {
   if (annotation.type === import_utils8.AST_NODE_TYPES.TSArrayType) {
     return true;
   }
+  if (annotation.type === import_utils8.AST_NODE_TYPES.TSUnionType || annotation.type === import_utils8.AST_NODE_TYPES.TSIntersectionType) {
+    return annotation.types.some(isShapeClaim);
+  }
   if (annotation.type === import_utils8.AST_NODE_TYPES.TSTypeReference) {
     return !(annotation.typeName.type === import_utils8.AST_NODE_TYPES.Identifier && annotation.typeName.name === "const");
   }
@@ -1163,22 +1456,22 @@ var requireSchemaParseAtBoundaryRule = createRule({
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow asserting external boundary data with `as T` instead of parsing it at runtime. Flags `JSON.parse(...) as T` and `(await res.json()) as T`; use a zod/valibot parse."
+      description: "Disallow asserting external boundary data with `as T` instead of parsing it at runtime. Flags casts of `JSON.parse`, `res.json()`, web storage, URL search params, message-event data and LLM tool input, directly or through a `const`; use a zod/valibot parse."
     },
-    schema: [],
+    schema: [optionSchema7],
     messages: {
       castedBoundaryData: "Boundary data is asserted with `as` here, not parsed. A cast is unchecked \u2014 validate this with a runtime schema (e.g. `Schema.parse(...)`) so a wire-shape change fails loudly."
     }
   },
-  defaultOptions: [],
-  create(context) {
+  defaultOptions: [{}],
+  create(context, [options]) {
+    const matcher = new BoundaryMatcher(context.sourceCode, options.boundaries ?? []);
     return {
       TSAsExpression(node) {
         if (!isShapeClaim(node.typeAnnotation)) {
           return;
         }
-        const expr = node.expression;
-        if (isJsonParseCall(expr) || isAwaitJsonCall(expr)) {
+        if (matcher.isBoundary(node.expression, node, /* @__PURE__ */ new Set())) {
           context.report({ node, messageId: "castedBoundaryData" });
         }
       }
@@ -1190,7 +1483,7 @@ var requireSchemaParseAtBoundaryRule = createRule({
 var import_utils9 = require("@typescript-eslint/utils");
 var RULE_NAME9 = "restrict-throw-to-taxonomy";
 var DEFAULT_ALLOW = ["Error"];
-var optionSchema7 = {
+var optionSchema8 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -1221,7 +1514,7 @@ var restrictThrowToTaxonomyRule = createRule({
     docs: {
       description: "Restrict `throw` to an approved error taxonomy. Flags throwing a non-allowlisted error class and throwing a non-Error value (string, object, number, ...)."
     },
-    schema: [optionSchema7],
+    schema: [optionSchema8],
     messages: {
       disallowedErrorClass: "Throw an error from your taxonomy, not `{{name}}`. Allowed: {{allowed}}. Add `{{name}}` to the `allow` option if it belongs to your taxonomy.",
       nonErrorThrow: "Throw an Error from your taxonomy, not a bare {{kind}} value. A non-Error throw carries no stack or cause."
@@ -1276,7 +1569,7 @@ var ENUM_FACTORIES = /* @__PURE__ */ new Set(["enum", "nativeEnum"]);
 var UNION = /* @__PURE__ */ new Set(["union"]);
 var LITERAL = /* @__PURE__ */ new Set(["literal"]);
 var STRING = /* @__PURE__ */ new Set(["string"]);
-var optionSchema8 = {
+var optionSchema9 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -1311,7 +1604,7 @@ var schemaEnumFieldConsistencyRule = createRule({
     docs: {
       description: "Disallow a zod field that is an enum in one object schema of a module from being `z.string()` in another, which widens the wire type every consumer then narrows by hand."
     },
-    schema: [optionSchema8],
+    schema: [optionSchema9],
     messages: {
       widenedEnumField: "`{{field}}` is `z.string()` here but an enum on line {{line}} of this file. The widened type leaks `string` to every consumer, which then has to narrow or cast it. Use {{suggestion}} instead (and, if the stored data is free text, migrate it first)."
     }
@@ -1566,7 +1859,7 @@ function catalogHasPrefix(catalog, prefix) {
 var import_utils11 = require("@typescript-eslint/utils");
 var UNRESOLVED = "unresolved";
 var MAX_DEPTH = 8;
-function unwrap(node) {
+function unwrap2(node) {
   let current = node;
   while (current.type === import_utils11.AST_NODE_TYPES.TSAsExpression || current.type === import_utils11.AST_NODE_TYPES.TSSatisfiesExpression || current.type === import_utils11.AST_NODE_TYPES.TSNonNullExpression) {
     current = current.expression;
@@ -1574,7 +1867,7 @@ function unwrap(node) {
   return current;
 }
 function staticString(node) {
-  const inner = unwrap(node);
+  const inner = unwrap2(node);
   if (inner.type === import_utils11.AST_NODE_TYPES.Literal && typeof inner.value === "string") return inner.value;
   if (inner.type === import_utils11.AST_NODE_TYPES.TemplateLiteral && inner.expressions.length === 0) {
     return inner.quasis[0]?.value.cooked ?? null;
@@ -1615,7 +1908,7 @@ function createTranslationVisitor(context, settings, onUsage) {
   }
   function resolveNamespaces(node, depth = 0) {
     if (node === void 0) return defaultBinding.namespaces;
-    const inner = unwrap(node);
+    const inner = unwrap2(node);
     const literal = staticString(inner);
     if (literal !== null) return [literal];
     if (inner.type === import_utils11.AST_NODE_TYPES.Literal && inner.value === null) return defaultBinding.namespaces;
@@ -1640,7 +1933,7 @@ function createTranslationVisitor(context, settings, onUsage) {
     }
     const definition = resolveVariable(node)?.defs[0];
     if (definition?.type === "Variable" && definition.parent.kind === "const" && definition.node.id.type === import_utils11.AST_NODE_TYPES.Identifier && definition.node.init !== null) {
-      const init = unwrap(definition.node.init);
+      const init = unwrap2(definition.node.init);
       const literal = staticString(init);
       if (literal !== null) return literal;
       const chained = resolveIdentifierString(init, depth + 1);
@@ -1656,7 +1949,7 @@ function createTranslationVisitor(context, settings, onUsage) {
   }
   function staticPrefix(node) {
     if (node === void 0) return null;
-    const inner = unwrap(node);
+    const inner = unwrap2(node);
     if (inner.type === import_utils11.AST_NODE_TYPES.Identifier && inner.name === "undefined") return null;
     if (inner.type === import_utils11.AST_NODE_TYPES.Literal && inner.value === null) return null;
     return staticString(inner) ?? UNRESOLVED;
@@ -1667,7 +1960,7 @@ function createTranslationVisitor(context, settings, onUsage) {
     if (namespaces === UNRESOLVED) return UNRESOLVED;
     let keyPrefix = null;
     if (optionsArg !== void 0) {
-      const options = unwrap(optionsArg);
+      const options = unwrap2(optionsArg);
       if (options.type !== import_utils11.AST_NODE_TYPES.ObjectExpression) return UNRESOLVED;
       for (const property of options.properties) {
         if (property.type !== import_utils11.AST_NODE_TYPES.Property) return UNRESOLVED;
@@ -1693,11 +1986,11 @@ function createTranslationVisitor(context, settings, onUsage) {
   function hookCallOf(identifier) {
     const definition = resolveVariable(identifier)?.defs[0];
     if (definition?.type !== "Variable" || definition.node.id.type !== import_utils11.AST_NODE_TYPES.Identifier) return null;
-    const init = definition.node.init === null ? null : unwrap(definition.node.init);
+    const init = definition.node.init === null ? null : unwrap2(definition.node.init);
     return init !== null && isHookCall(init) ? init : null;
   }
   function bindingOfTSource(object) {
-    const inner = unwrap(object);
+    const inner = unwrap2(object);
     if (isHookCall(inner)) return bindingFromHook(inner);
     if (inner.type === import_utils11.AST_NODE_TYPES.Identifier) {
       const hook = hookCallOf(inner);
@@ -1734,7 +2027,7 @@ function createTranslationVisitor(context, settings, onUsage) {
   }
   function bindingFromDeclarator(declarator, name, depth) {
     if (declarator.init === null) return null;
-    const init = unwrap(declarator.init);
+    const init = unwrap2(declarator.init);
     const id = declarator.id;
     if (id.type === import_utils11.AST_NODE_TYPES.Identifier) {
       if (isGetFixedT(init)) return bindingFromGetFixedT(init);
@@ -1795,7 +2088,7 @@ function createTranslationVisitor(context, settings, onUsage) {
   function readCallOptions(node) {
     const none = { namespaces: null, plural: false, context: false, returnObjects: false };
     if (node === void 0) return none;
-    const inner = unwrap(node);
+    const inner = unwrap2(node);
     if (inner.type !== import_utils11.AST_NODE_TYPES.ObjectExpression) return UNRESOLVED;
     let namespaces = null;
     let plural = false;
@@ -1814,7 +2107,7 @@ function createTranslationVisitor(context, settings, onUsage) {
       } else if (name === "context") {
         context2 = true;
       } else if (name === "returnObjects") {
-        const value = unwrap(property.value);
+        const value = unwrap2(property.value);
         returnObjects = !(value.type === import_utils11.AST_NODE_TYPES.Literal && value.value === false);
       }
     }
@@ -1834,7 +2127,7 @@ function createTranslationVisitor(context, settings, onUsage) {
     return { namespaces, key: `${binding.keyPrefix}${keySeparator === false ? "" : keySeparator}${raw}` };
   }
   function emit(node, keyNode, binding, options) {
-    const inner = unwrap(keyNode);
+    const inner = unwrap2(keyNode);
     const raws = [];
     const single = staticString(inner);
     if (single !== null) {
@@ -1957,7 +2250,7 @@ function createTranslationVisitor(context, settings, onUsage) {
 var RULE_NAME11 = "translation-key-exists";
 var stringList = { type: "array", items: { type: "string", minLength: 1 }, uniqueItems: true };
 var separator = { oneOf: [{ type: "string", minLength: 1 }, { type: "boolean", enum: [false] }] };
-var optionSchema9 = {
+var optionSchema10 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -2021,7 +2314,7 @@ var translationKeyExistsRule = createRule({
     docs: {
       description: "Require every static i18next / react-i18next translation key (`t(...)`, `i18n.t(...)`, `<Trans i18nKey>`) to exist in the catalog of the namespace in scope."
     },
-    schema: [optionSchema9],
+    schema: [optionSchema10],
     messages: {
       missingKey: "Translation key `{{key}}` does not exist in namespace `{{namespace}}` ({{catalogs}}). It renders as the raw key at runtime: fix the key or add it to the catalog.",
       missingKeyPrefix: "No key in namespace `{{namespace}}` ({{catalogs}}) starts with `{{prefix}}`, so this template key can never resolve.",
@@ -2110,7 +2403,7 @@ var translationKeyExistsRule = createRule({
 // src/rules/wire-message-naming.ts
 var RULE_NAME12 = "wire-message-naming";
 var DEFAULT_ROLE_SUFFIXES = ["Event", "Command", "Query"];
-var optionSchema10 = {
+var optionSchema11 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -2158,7 +2451,7 @@ var wireMessageNamingRule = createRule({
       description: "A message-schema const ending in a role suffix (default Event/Command/Query) whose zod object declares `type: z.literal(...)` must set that literal to kebab-case(const name minus its role suffix)."
     },
     fixable: "code",
-    schema: [optionSchema10],
+    schema: [optionSchema11],
     messages: {
       typeMismatch: "Wire `type` literal '{{actual}}' for `{{name}}` must be '{{expected}}' \u2014 kebab-case of the const name minus its role suffix."
     }
@@ -2198,7 +2491,7 @@ var RULE_NAME13 = "zod-schema-naming";
 var SCHEMA_NAME = /^[A-Z][A-Za-z0-9]*Schema$/;
 var SUFFIX = "Schema";
 var DEFAULT_ROLE_SUFFIXES2 = [];
-var optionSchema11 = {
+var optionSchema12 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -2237,7 +2530,7 @@ var zodSchemaNamingRule = createRule({
     docs: {
       description: "Every exported zod schema is a PascalCase const suffixed `Schema`, paired with a same-named inferred type (`export type Foo = z.infer<typeof FooSchema>`)."
     },
-    schema: [optionSchema11],
+    schema: [optionSchema12],
     messages: {
       schemaNaming: "Exported zod schema `{{name}}` must be a PascalCase const ending in `Schema` (e.g. `FooSchema`).",
       missingType: "Schema `{{name}}` has no sibling `export type {{base}} = z.infer<typeof {{name}}>`. Export the inferred type instead of hand-authoring a duplicate."
@@ -2306,7 +2599,7 @@ var rules = {
 
 // src/index.ts
 var NAMESPACE = "noctcore-contracts";
-var VERSION = "0.6.1";
+var VERSION = "0.7.0";
 var plugin = {
   meta: { name: "@noctcore/eslint-plugin-contracts", version: VERSION },
   rules,

package/dist/index.d.cts

@@ -21,6 +21,15 @@ interface SchemaEnumFieldConsistencyOptions {
     readonly enumIdentifierPattern?: string;
 }
 
+interface RequireSchemaParseAtBoundaryOptions {
+    /**
+     * Extra callees whose result is boundary data: a bare name (`readBody`) or a
+     * dotted path (`ipcRenderer.invoke`). `readBody(event) as T` and
+     * `(await readBody(event)) as T` are then flagged like `JSON.parse`. Default `[]`.
+     */
+    readonly boundaries?: readonly string[];
+}
+
 interface EnvVarSchemaParityOptions {
     /** Path to the env declaration source — a `.env.example` or a zod-env module. Empty = rule is inert. */
     readonly schema?: string;
@@ -274,7 +283,7 @@ declare const rules: {
     'env-var-schema-parity': _typescript_eslint_utils_ts_eslint.RuleModule<"undeclaredEnvVar", [EnvVarSchemaParityOptions], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
-    'require-schema-parse-at-boundary': _typescript_eslint_utils_ts_eslint.RuleModule<"castedBoundaryData", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+    'require-schema-parse-at-boundary': _typescript_eslint_utils_ts_eslint.RuleModule<"castedBoundaryData", [RequireSchemaParseAtBoundaryOptions], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
     'schema-enum-field-consistency': _typescript_eslint_utils_ts_eslint.RuleModule<"widenedEnumField", [SchemaEnumFieldConsistencyOptions], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
@@ -321,7 +330,7 @@ declare const plugin: {
         'env-var-schema-parity': _typescript_eslint_utils_ts_eslint.RuleModule<"undeclaredEnvVar", [EnvVarSchemaParityOptions], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
-        'require-schema-parse-at-boundary': _typescript_eslint_utils_ts_eslint.RuleModule<"castedBoundaryData", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        'require-schema-parse-at-boundary': _typescript_eslint_utils_ts_eslint.RuleModule<"castedBoundaryData", [RequireSchemaParseAtBoundaryOptions], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
         'schema-enum-field-consistency': _typescript_eslint_utils_ts_eslint.RuleModule<"widenedEnumField", [SchemaEnumFieldConsistencyOptions], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {

package/dist/index.d.ts

@@ -21,6 +21,15 @@ interface SchemaEnumFieldConsistencyOptions {
     readonly enumIdentifierPattern?: string;
 }
 
+interface RequireSchemaParseAtBoundaryOptions {
+    /**
+     * Extra callees whose result is boundary data: a bare name (`readBody`) or a
+     * dotted path (`ipcRenderer.invoke`). `readBody(event) as T` and
+     * `(await readBody(event)) as T` are then flagged like `JSON.parse`. Default `[]`.
+     */
+    readonly boundaries?: readonly string[];
+}
+
 interface EnvVarSchemaParityOptions {
     /** Path to the env declaration source — a `.env.example` or a zod-env module. Empty = rule is inert. */
     readonly schema?: string;
@@ -274,7 +283,7 @@ declare const rules: {
     'env-var-schema-parity': _typescript_eslint_utils_ts_eslint.RuleModule<"undeclaredEnvVar", [EnvVarSchemaParityOptions], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
-    'require-schema-parse-at-boundary': _typescript_eslint_utils_ts_eslint.RuleModule<"castedBoundaryData", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+    'require-schema-parse-at-boundary': _typescript_eslint_utils_ts_eslint.RuleModule<"castedBoundaryData", [RequireSchemaParseAtBoundaryOptions], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
     'schema-enum-field-consistency': _typescript_eslint_utils_ts_eslint.RuleModule<"widenedEnumField", [SchemaEnumFieldConsistencyOptions], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
@@ -321,7 +330,7 @@ declare const plugin: {
         'env-var-schema-parity': _typescript_eslint_utils_ts_eslint.RuleModule<"undeclaredEnvVar", [EnvVarSchemaParityOptions], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
-        'require-schema-parse-at-boundary': _typescript_eslint_utils_ts_eslint.RuleModule<"castedBoundaryData", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        'require-schema-parse-at-boundary': _typescript_eslint_utils_ts_eslint.RuleModule<"castedBoundaryData", [RequireSchemaParseAtBoundaryOptions], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
         'schema-enum-field-consistency': _typescript_eslint_utils_ts_eslint.RuleModule<"widenedEnumField", [SchemaEnumFieldConsistencyOptions], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {

package/dist/index.js

@@ -1093,22 +1093,315 @@ var requireRegisteredKeysRule = createRule({
 });
 
 // src/rules/require-schema-parse-at-boundary.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES8 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES8, ASTUtils } from "@typescript-eslint/utils";
 var RULE_NAME8 = "require-schema-parse-at-boundary";
+var optionSchema7 = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    boundaries: {
+      type: "array",
+      items: { type: "string", minLength: 1 },
+      uniqueItems: true
+    }
+  }
+};
+function parentOf(node) {
+  return node.parent ?? null;
+}
+function memberPath(node) {
+  if (node.type === AST_NODE_TYPES8.Identifier) {
+    return node.name;
+  }
+  if (node.type === AST_NODE_TYPES8.MemberExpression && !node.computed && node.property.type === AST_NODE_TYPES8.Identifier) {
+    const object = memberPath(node.object);
+    return object === null ? null : `${object}.${node.property.name}`;
+  }
+  return null;
+}
+function methodCallReceiver(node, names) {
+  if (node.type === AST_NODE_TYPES8.CallExpression && node.callee.type === AST_NODE_TYPES8.MemberExpression && !node.callee.computed && node.callee.property.type === AST_NODE_TYPES8.Identifier && names.includes(node.callee.property.name)) {
+    return node.callee.object;
+  }
+  return null;
+}
+function unwrap(node) {
+  let current = node;
+  while (current.type === AST_NODE_TYPES8.TSNonNullExpression || current.type === AST_NODE_TYPES8.ChainExpression) {
+    current = current.expression;
+  }
+  return current;
+}
 function isJsonParseCall(node) {
-  return node.type === AST_NODE_TYPES8.CallExpression && node.callee.type === AST_NODE_TYPES8.MemberExpression && !node.callee.computed && node.callee.object.type === AST_NODE_TYPES8.Identifier && node.callee.object.name === "JSON" && node.callee.property.type === AST_NODE_TYPES8.Identifier && node.callee.property.name === "parse";
+  return node.type === AST_NODE_TYPES8.CallExpression && memberPath(node.callee) === "JSON.parse";
 }
 function isAwaitJsonCall(node) {
   if (node.type !== AST_NODE_TYPES8.AwaitExpression) {
     return false;
   }
   const call = node.argument;
-  return call.type === AST_NODE_TYPES8.CallExpression && call.arguments.length === 0 && call.callee.type === AST_NODE_TYPES8.MemberExpression && !call.callee.computed && call.callee.property.type === AST_NODE_TYPES8.Identifier && call.callee.property.name === "json";
+  return methodCallReceiver(call, ["json"]) !== null && call.type === AST_NODE_TYPES8.CallExpression && call.arguments.length === 0;
+}
+function isStorageRead(node) {
+  const receiver = methodCallReceiver(node, ["getItem"]);
+  const path3 = receiver === null ? null : memberPath(receiver);
+  if (path3 === null) {
+    return false;
+  }
+  const last = path3.slice(path3.lastIndexOf(".") + 1);
+  return last === "localStorage" || last === "sessionStorage";
+}
+var BoundaryMatcher = class {
+  sourceCode;
+  boundaries;
+  constructor(sourceCode, boundaries) {
+    this.sourceCode = sourceCode;
+    this.boundaries = new Set(boundaries);
+  }
+  /** True when `expr`, the operand of the cast at `cast`, is boundary data. */
+  isBoundary(expr, cast, seen) {
+    const node = unwrap(expr);
+    if (isJsonParseCall(node) || isAwaitJsonCall(node) || isStorageRead(node) || this.isSearchParamsRead(node) || this.isConfiguredBoundary(node) || this.isMessageEventData(node) || this.isToolUseInput(node)) {
+      return true;
+    }
+    if (node.type !== AST_NODE_TYPES8.Identifier) {
+      return false;
+    }
+    const variable = this.resolve(node);
+    if (variable === null || seen.has(variable)) {
+      return false;
+    }
+    seen.add(variable);
+    const init = this.constInit(variable);
+    return init !== null && this.untouchedBefore(variable, node, cast) && this.isBoundary(init, init, seen);
+  }
+  resolve(identifier) {
+    return ASTUtils.findVariable(this.sourceCode.getScope(identifier), identifier) ?? null;
+  }
+  /** The initializer of a single `const name = <init>` declaration, or null. */
+  constInit(variable) {
+    const [def] = variable.defs;
+    if (variable.defs.length !== 1 || def === void 0) {
+      return null;
+    }
+    const declarator = def.node;
+    if (declarator.type !== AST_NODE_TYPES8.VariableDeclarator || declarator.id.type !== AST_NODE_TYPES8.Identifier || declarator.init === null) {
+      return null;
+    }
+    const declaration = parentOf(declarator);
+    if (declaration?.type !== AST_NODE_TYPES8.VariableDeclaration || declaration.kind !== "const") {
+      return null;
+    }
+    return declarator.init;
+  }
+  /**
+   * True when the only reads of `variable` that could run before `cast` are the
+   * `use` itself and other `as` casts, all in the declaring function. Any other
+   * earlier read (a guard, a validator call, a mutation) might have checked the
+   * value, so the cast is given the benefit of the doubt.
+   */
+  untouchedBefore(variable, use, cast) {
+    const home = variable.scope.variableScope;
+    return variable.references.every((reference) => {
+      if (reference.init === true) {
+        return true;
+      }
+      if (reference.from.variableScope !== home) {
+        return false;
+      }
+      const id = reference.identifier;
+      if (id === use || id.range[0] >= cast.range[0]) {
+        return true;
+      }
+      return parentOf(id)?.type === AST_NODE_TYPES8.TSAsExpression;
+    });
+  }
+  /** A call whose callee is listed in the `boundaries` option. */
+  isConfiguredBoundary(node) {
+    if (this.boundaries.size === 0) {
+      return false;
+    }
+    const call = node.type === AST_NODE_TYPES8.AwaitExpression ? unwrap(node.argument) : node;
+    if (call.type !== AST_NODE_TYPES8.CallExpression) {
+      return false;
+    }
+    const path3 = memberPath(call.callee);
+    return path3 !== null && this.boundaries.has(path3);
+  }
+  /** `.get(...)` / `.getAll(...)` on a `URLSearchParams`. */
+  isSearchParamsRead(node) {
+    const receiver = methodCallReceiver(node, ["get", "getAll"]);
+    return receiver !== null && this.isSearchParams(unwrap(receiver), /* @__PURE__ */ new Set());
+  }
+  isSearchParams(node, seen) {
+    if (node.type === AST_NODE_TYPES8.NewExpression) {
+      return node.callee.type === AST_NODE_TYPES8.Identifier && node.callee.name === "URLSearchParams";
+    }
+    if (node.type === AST_NODE_TYPES8.MemberExpression) {
+      return !node.computed && node.property.type === AST_NODE_TYPES8.Identifier && node.property.name === "searchParams";
+    }
+    if (node.type !== AST_NODE_TYPES8.Identifier) {
+      return false;
+    }
+    if (node.name === "searchParams") {
+      return true;
+    }
+    const variable = this.resolve(node);
+    if (variable === null || seen.has(variable)) {
+      return false;
+    }
+    seen.add(variable);
+    const init = this.constInit(variable);
+    return init !== null && this.isSearchParams(unwrap(init), seen);
+  }
+  /** `event.data` (or a `{ data }` destructured parameter) in a `message` listener. */
+  isMessageEventData(node) {
+    let identifier;
+    if (node.type === AST_NODE_TYPES8.MemberExpression) {
+      if (node.computed || node.property.type !== AST_NODE_TYPES8.Identifier || node.property.name !== "data" || node.object.type !== AST_NODE_TYPES8.Identifier) {
+        return false;
+      }
+      identifier = node.object;
+    } else if (node.type === AST_NODE_TYPES8.Identifier) {
+      identifier = node;
+    } else {
+      return false;
+    }
+    const variable = this.resolve(identifier);
+    const param = variable === null ? null : parameterOf(variable);
+    if (param === null) {
+      return false;
+    }
+    const { fn, name } = param;
+    const [first] = fn.params;
+    if (first === void 0) {
+      return false;
+    }
+    const isParamItself = name === first;
+    const isDestructuredData = first.type === AST_NODE_TYPES8.ObjectPattern && first.properties.some(
+      (property) => property.type === AST_NODE_TYPES8.Property && !property.computed && property.key.type === AST_NODE_TYPES8.Identifier && property.key.name === "data" && property.value === name
+    );
+    if (node.type === AST_NODE_TYPES8.MemberExpression ? !isParamItself : !isDestructuredData) {
+      return false;
+    }
+    return isMessageListener(fn);
+  }
+  /** `block.input` where `block` is narrowed to an Anthropic `tool_use` content block. */
+  isToolUseInput(node) {
+    if (node.type !== AST_NODE_TYPES8.MemberExpression || node.computed || node.property.type !== AST_NODE_TYPES8.Identifier || node.property.name !== "input") {
+      return false;
+    }
+    const block = unwrap(node.object);
+    const blockText = this.sourceCode.getText(block);
+    if (this.isGuardedAsToolUse(node, blockText)) {
+      return true;
+    }
+    if (block.type !== AST_NODE_TYPES8.Identifier) {
+      return false;
+    }
+    const variable = this.resolve(block);
+    if (variable === null) {
+      return false;
+    }
+    const init = this.constInit(variable);
+    if (init !== null) {
+      const receiver = methodCallReceiver(unwrap(init), ["find"]);
+      const call = unwrap(init);
+      return receiver !== null && call.type === AST_NODE_TYPES8.CallExpression && this.isToolUsePredicate(call.arguments[0]);
+    }
+    const param = parameterOf(variable);
+    if (param !== null && param.fn.params[0] === param.name) {
+      const call = parentOf(param.fn);
+      if (call?.type !== AST_NODE_TYPES8.CallExpression || call.arguments[0] !== param.fn || methodCallReceiver(call, ["map", "flatMap", "forEach"]) === null) {
+        return false;
+      }
+      const filtered = unwrap(call.callee.object);
+      return methodCallReceiver(filtered, ["filter"]) !== null && filtered.type === AST_NODE_TYPES8.CallExpression && this.isToolUsePredicate(filtered.arguments[0]);
+    }
+    return false;
+  }
+  /** `(b) => b.type === 'tool_use'`, optionally with a type-predicate return. */
+  isToolUsePredicate(node) {
+    if (node?.type !== AST_NODE_TYPES8.ArrowFunctionExpression || node.body.type === AST_NODE_TYPES8.BlockStatement) {
+      return false;
+    }
+    const [param] = node.params;
+    return param?.type === AST_NODE_TYPES8.Identifier && this.testProvesToolUse(node.body, param.name);
+  }
+  /** An enclosing `if` / `?:` / `&&` / `case 'tool_use':` narrows `blockText`. */
+  isGuardedAsToolUse(from, blockText) {
+    let child = from;
+    for (let parent = parentOf(child); parent !== null; child = parent, parent = parentOf(child)) {
+      switch (parent.type) {
+        case AST_NODE_TYPES8.IfStatement:
+        case AST_NODE_TYPES8.ConditionalExpression:
+          if (parent.consequent === child && this.testProvesToolUse(parent.test, blockText)) {
+            return true;
+          }
+          break;
+        case AST_NODE_TYPES8.LogicalExpression:
+          if (parent.operator === "&&" && parent.right === child && this.testProvesToolUse(parent.left, blockText)) {
+            return true;
+          }
+          break;
+        case AST_NODE_TYPES8.SwitchCase: {
+          const statement = parentOf(parent);
+          if (parent.test?.type === AST_NODE_TYPES8.Literal && parent.test.value === "tool_use" && statement?.type === AST_NODE_TYPES8.SwitchStatement && this.sourceCode.getText(statement.discriminant) === `${blockText}.type`) {
+            return true;
+          }
+          break;
+        }
+        default:
+          break;
+      }
+    }
+    return false;
+  }
+  /** `<blockText>.type === 'tool_use'`, possibly one conjunct of an `&&` chain. */
+  testProvesToolUse(test, blockText) {
+    if (test.type === AST_NODE_TYPES8.LogicalExpression && test.operator === "&&") {
+      return this.testProvesToolUse(test.left, blockText) || this.testProvesToolUse(test.right, blockText);
+    }
+    if (test.type !== AST_NODE_TYPES8.BinaryExpression || test.operator !== "===" && test.operator !== "==") {
+      return false;
+    }
+    const typeText = `${blockText}.type`;
+    const isToolUse = (node) => node.type === AST_NODE_TYPES8.Literal && node.value === "tool_use";
+    const isTypeRead = (node) => this.sourceCode.getText(unwrap(node)) === typeText || this.sourceCode.getText(node) === `${blockText}?.type`;
+    return isTypeRead(test.left) && isToolUse(test.right) || isToolUse(test.left) && isTypeRead(test.right);
+  }
+};
+function parameterOf(variable) {
+  const [def] = variable.defs;
+  if (variable.defs.length !== 1 || def === void 0 || def.type !== "Parameter") {
+    return null;
+  }
+  const fn = def.node;
+  if (fn.type !== AST_NODE_TYPES8.ArrowFunctionExpression && fn.type !== AST_NODE_TYPES8.FunctionDeclaration && fn.type !== AST_NODE_TYPES8.FunctionExpression) {
+    return null;
+  }
+  return { fn, name: def.name };
+}
+function isMessageListener(fn) {
+  const parent = parentOf(fn);
+  if (parent?.type === AST_NODE_TYPES8.CallExpression) {
+    const [event, listener] = parent.arguments;
+    const callee = memberPath(parent.callee);
+    return listener === fn && event?.type === AST_NODE_TYPES8.Literal && event.value === "message" && callee !== null && (callee === "addEventListener" || callee.endsWith(".addEventListener"));
+  }
+  if (parent?.type === AST_NODE_TYPES8.AssignmentExpression && parent.right === fn) {
+    const target = memberPath(parent.left);
+    return target !== null && (target === "onmessage" || target.endsWith(".onmessage"));
+  }
+  return false;
 }
 function isShapeClaim(annotation) {
   if (annotation.type === AST_NODE_TYPES8.TSArrayType) {
     return true;
   }
+  if (annotation.type === AST_NODE_TYPES8.TSUnionType || annotation.type === AST_NODE_TYPES8.TSIntersectionType) {
+    return annotation.types.some(isShapeClaim);
+  }
   if (annotation.type === AST_NODE_TYPES8.TSTypeReference) {
     return !(annotation.typeName.type === AST_NODE_TYPES8.Identifier && annotation.typeName.name === "const");
   }
@@ -1119,22 +1412,22 @@ var requireSchemaParseAtBoundaryRule = createRule({
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow asserting external boundary data with `as T` instead of parsing it at runtime. Flags `JSON.parse(...) as T` and `(await res.json()) as T`; use a zod/valibot parse."
+      description: "Disallow asserting external boundary data with `as T` instead of parsing it at runtime. Flags casts of `JSON.parse`, `res.json()`, web storage, URL search params, message-event data and LLM tool input, directly or through a `const`; use a zod/valibot parse."
     },
-    schema: [],
+    schema: [optionSchema7],
     messages: {
       castedBoundaryData: "Boundary data is asserted with `as` here, not parsed. A cast is unchecked \u2014 validate this with a runtime schema (e.g. `Schema.parse(...)`) so a wire-shape change fails loudly."
     }
   },
-  defaultOptions: [],
-  create(context) {
+  defaultOptions: [{}],
+  create(context, [options]) {
+    const matcher = new BoundaryMatcher(context.sourceCode, options.boundaries ?? []);
     return {
       TSAsExpression(node) {
         if (!isShapeClaim(node.typeAnnotation)) {
           return;
         }
-        const expr = node.expression;
-        if (isJsonParseCall(expr) || isAwaitJsonCall(expr)) {
+        if (matcher.isBoundary(node.expression, node, /* @__PURE__ */ new Set())) {
           context.report({ node, messageId: "castedBoundaryData" });
         }
       }
@@ -1146,7 +1439,7 @@ var requireSchemaParseAtBoundaryRule = createRule({
 import { AST_NODE_TYPES as AST_NODE_TYPES9 } from "@typescript-eslint/utils";
 var RULE_NAME9 = "restrict-throw-to-taxonomy";
 var DEFAULT_ALLOW = ["Error"];
-var optionSchema7 = {
+var optionSchema8 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -1177,7 +1470,7 @@ var restrictThrowToTaxonomyRule = createRule({
     docs: {
       description: "Restrict `throw` to an approved error taxonomy. Flags throwing a non-allowlisted error class and throwing a non-Error value (string, object, number, ...)."
     },
-    schema: [optionSchema7],
+    schema: [optionSchema8],
     messages: {
       disallowedErrorClass: "Throw an error from your taxonomy, not `{{name}}`. Allowed: {{allowed}}. Add `{{name}}` to the `allow` option if it belongs to your taxonomy.",
       nonErrorThrow: "Throw an Error from your taxonomy, not a bare {{kind}} value. A non-Error throw carries no stack or cause."
@@ -1232,7 +1525,7 @@ var ENUM_FACTORIES = /* @__PURE__ */ new Set(["enum", "nativeEnum"]);
 var UNION = /* @__PURE__ */ new Set(["union"]);
 var LITERAL = /* @__PURE__ */ new Set(["literal"]);
 var STRING = /* @__PURE__ */ new Set(["string"]);
-var optionSchema8 = {
+var optionSchema9 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -1267,7 +1560,7 @@ var schemaEnumFieldConsistencyRule = createRule({
     docs: {
       description: "Disallow a zod field that is an enum in one object schema of a module from being `z.string()` in another, which widens the wire type every consumer then narrows by hand."
     },
-    schema: [optionSchema8],
+    schema: [optionSchema9],
     messages: {
       widenedEnumField: "`{{field}}` is `z.string()` here but an enum on line {{line}} of this file. The widened type leaks `string` to every consumer, which then has to narrow or cast it. Use {{suggestion}} instead (and, if the stored data is free text, migrate it first)."
     }
@@ -1522,7 +1815,7 @@ function catalogHasPrefix(catalog, prefix) {
 import { AST_NODE_TYPES as AST_NODE_TYPES11 } from "@typescript-eslint/utils";
 var UNRESOLVED = "unresolved";
 var MAX_DEPTH = 8;
-function unwrap(node) {
+function unwrap2(node) {
   let current = node;
   while (current.type === AST_NODE_TYPES11.TSAsExpression || current.type === AST_NODE_TYPES11.TSSatisfiesExpression || current.type === AST_NODE_TYPES11.TSNonNullExpression) {
     current = current.expression;
@@ -1530,7 +1823,7 @@ function unwrap(node) {
   return current;
 }
 function staticString(node) {
-  const inner = unwrap(node);
+  const inner = unwrap2(node);
   if (inner.type === AST_NODE_TYPES11.Literal && typeof inner.value === "string") return inner.value;
   if (inner.type === AST_NODE_TYPES11.TemplateLiteral && inner.expressions.length === 0) {
     return inner.quasis[0]?.value.cooked ?? null;
@@ -1571,7 +1864,7 @@ function createTranslationVisitor(context, settings, onUsage) {
   }
   function resolveNamespaces(node, depth = 0) {
     if (node === void 0) return defaultBinding.namespaces;
-    const inner = unwrap(node);
+    const inner = unwrap2(node);
     const literal = staticString(inner);
     if (literal !== null) return [literal];
     if (inner.type === AST_NODE_TYPES11.Literal && inner.value === null) return defaultBinding.namespaces;
@@ -1596,7 +1889,7 @@ function createTranslationVisitor(context, settings, onUsage) {
     }
     const definition = resolveVariable(node)?.defs[0];
     if (definition?.type === "Variable" && definition.parent.kind === "const" && definition.node.id.type === AST_NODE_TYPES11.Identifier && definition.node.init !== null) {
-      const init = unwrap(definition.node.init);
+      const init = unwrap2(definition.node.init);
       const literal = staticString(init);
       if (literal !== null) return literal;
       const chained = resolveIdentifierString(init, depth + 1);
@@ -1612,7 +1905,7 @@ function createTranslationVisitor(context, settings, onUsage) {
   }
   function staticPrefix(node) {
     if (node === void 0) return null;
-    const inner = unwrap(node);
+    const inner = unwrap2(node);
     if (inner.type === AST_NODE_TYPES11.Identifier && inner.name === "undefined") return null;
     if (inner.type === AST_NODE_TYPES11.Literal && inner.value === null) return null;
     return staticString(inner) ?? UNRESOLVED;
@@ -1623,7 +1916,7 @@ function createTranslationVisitor(context, settings, onUsage) {
     if (namespaces === UNRESOLVED) return UNRESOLVED;
     let keyPrefix = null;
     if (optionsArg !== void 0) {
-      const options = unwrap(optionsArg);
+      const options = unwrap2(optionsArg);
       if (options.type !== AST_NODE_TYPES11.ObjectExpression) return UNRESOLVED;
       for (const property of options.properties) {
         if (property.type !== AST_NODE_TYPES11.Property) return UNRESOLVED;
@@ -1649,11 +1942,11 @@ function createTranslationVisitor(context, settings, onUsage) {
   function hookCallOf(identifier) {
     const definition = resolveVariable(identifier)?.defs[0];
     if (definition?.type !== "Variable" || definition.node.id.type !== AST_NODE_TYPES11.Identifier) return null;
-    const init = definition.node.init === null ? null : unwrap(definition.node.init);
+    const init = definition.node.init === null ? null : unwrap2(definition.node.init);
     return init !== null && isHookCall(init) ? init : null;
   }
   function bindingOfTSource(object) {
-    const inner = unwrap(object);
+    const inner = unwrap2(object);
     if (isHookCall(inner)) return bindingFromHook(inner);
     if (inner.type === AST_NODE_TYPES11.Identifier) {
       const hook = hookCallOf(inner);
@@ -1690,7 +1983,7 @@ function createTranslationVisitor(context, settings, onUsage) {
   }
   function bindingFromDeclarator(declarator, name, depth) {
     if (declarator.init === null) return null;
-    const init = unwrap(declarator.init);
+    const init = unwrap2(declarator.init);
     const id = declarator.id;
     if (id.type === AST_NODE_TYPES11.Identifier) {
       if (isGetFixedT(init)) return bindingFromGetFixedT(init);
@@ -1751,7 +2044,7 @@ function createTranslationVisitor(context, settings, onUsage) {
   function readCallOptions(node) {
     const none = { namespaces: null, plural: false, context: false, returnObjects: false };
     if (node === void 0) return none;
-    const inner = unwrap(node);
+    const inner = unwrap2(node);
     if (inner.type !== AST_NODE_TYPES11.ObjectExpression) return UNRESOLVED;
     let namespaces = null;
     let plural = false;
@@ -1770,7 +2063,7 @@ function createTranslationVisitor(context, settings, onUsage) {
       } else if (name === "context") {
         context2 = true;
       } else if (name === "returnObjects") {
-        const value = unwrap(property.value);
+        const value = unwrap2(property.value);
         returnObjects = !(value.type === AST_NODE_TYPES11.Literal && value.value === false);
       }
     }
@@ -1790,7 +2083,7 @@ function createTranslationVisitor(context, settings, onUsage) {
     return { namespaces, key: `${binding.keyPrefix}${keySeparator === false ? "" : keySeparator}${raw}` };
   }
   function emit(node, keyNode, binding, options) {
-    const inner = unwrap(keyNode);
+    const inner = unwrap2(keyNode);
     const raws = [];
     const single = staticString(inner);
     if (single !== null) {
@@ -1913,7 +2206,7 @@ function createTranslationVisitor(context, settings, onUsage) {
 var RULE_NAME11 = "translation-key-exists";
 var stringList = { type: "array", items: { type: "string", minLength: 1 }, uniqueItems: true };
 var separator = { oneOf: [{ type: "string", minLength: 1 }, { type: "boolean", enum: [false] }] };
-var optionSchema9 = {
+var optionSchema10 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -1977,7 +2270,7 @@ var translationKeyExistsRule = createRule({
     docs: {
       description: "Require every static i18next / react-i18next translation key (`t(...)`, `i18n.t(...)`, `<Trans i18nKey>`) to exist in the catalog of the namespace in scope."
     },
-    schema: [optionSchema9],
+    schema: [optionSchema10],
     messages: {
       missingKey: "Translation key `{{key}}` does not exist in namespace `{{namespace}}` ({{catalogs}}). It renders as the raw key at runtime: fix the key or add it to the catalog.",
       missingKeyPrefix: "No key in namespace `{{namespace}}` ({{catalogs}}) starts with `{{prefix}}`, so this template key can never resolve.",
@@ -2066,7 +2359,7 @@ var translationKeyExistsRule = createRule({
 // src/rules/wire-message-naming.ts
 var RULE_NAME12 = "wire-message-naming";
 var DEFAULT_ROLE_SUFFIXES = ["Event", "Command", "Query"];
-var optionSchema10 = {
+var optionSchema11 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -2114,7 +2407,7 @@ var wireMessageNamingRule = createRule({
       description: "A message-schema const ending in a role suffix (default Event/Command/Query) whose zod object declares `type: z.literal(...)` must set that literal to kebab-case(const name minus its role suffix)."
     },
     fixable: "code",
-    schema: [optionSchema10],
+    schema: [optionSchema11],
     messages: {
       typeMismatch: "Wire `type` literal '{{actual}}' for `{{name}}` must be '{{expected}}' \u2014 kebab-case of the const name minus its role suffix."
     }
@@ -2154,7 +2447,7 @@ var RULE_NAME13 = "zod-schema-naming";
 var SCHEMA_NAME = /^[A-Z][A-Za-z0-9]*Schema$/;
 var SUFFIX = "Schema";
 var DEFAULT_ROLE_SUFFIXES2 = [];
-var optionSchema11 = {
+var optionSchema12 = {
   type: "object",
   additionalProperties: false,
   properties: {
@@ -2193,7 +2486,7 @@ var zodSchemaNamingRule = createRule({
     docs: {
       description: "Every exported zod schema is a PascalCase const suffixed `Schema`, paired with a same-named inferred type (`export type Foo = z.infer<typeof FooSchema>`)."
     },
-    schema: [optionSchema11],
+    schema: [optionSchema12],
     messages: {
       schemaNaming: "Exported zod schema `{{name}}` must be a PascalCase const ending in `Schema` (e.g. `FooSchema`).",
       missingType: "Schema `{{name}}` has no sibling `export type {{base}} = z.infer<typeof {{name}}>`. Export the inferred type instead of hand-authoring a duplicate."
@@ -2262,7 +2555,7 @@ var rules = {
 
 // src/index.ts
 var NAMESPACE = "noctcore-contracts";
-var VERSION = "0.6.1";
+var VERSION = "0.7.0";
 var plugin = {
   meta: { name: "@noctcore/eslint-plugin-contracts", version: VERSION },
   rules,

package/docs/rules/require-schema-parse-at-boundary.md

@@ -17,7 +17,8 @@ const user = UserSchema.parse(await res.json()); // validated
 ## What it flags
 
 This is a **conservative syntactic slice** of a concept that is fully general only with type
-information. It flags a cast applied **directly** to a call site that is unmistakably a boundary read:
+information. It flags a cast whose target is a **shape claim** (a named type, an array, or a union
+containing one: `as User`, `as User[]`, `as User | null`) applied to a boundary read:
 
 ```ts bad reports=3
 const user = JSON.parse(raw) as User;
@@ -27,18 +28,104 @@ const fetched = (await res.json()) as User;
 
 ```ts good
 const user = UserSchema.parse(JSON.parse(raw));
+const users = UserSchema.array().parse(JSON.parse(raw));
 const fetched = UserSchema.parse(await res.json());
-const data = JSON.parse(raw) as unknown; // safe widening, not a shape claim
 ```
 
-Only these forms are flagged: `JSON.parse(...) as T` and `(await <expr>.json()) as T`, and only when
-the cast target is a shape claim (a named type or array — `as User`, `as User[]`). Casts to `unknown`,
-`any`, or `const` are the safe/neutral forms and are never flagged. A boundary value stored in a
-variable and cast later is out of syntactic reach — enforce that with a type-aware setup.
+The boundary reads it knows:
+
+| Source | Example |
+| --- | --- |
+| `JSON.parse(...)` | covers web storage and OpenAI `call.function.arguments` fed to it |
+| `await <expr>.json()` | a fetch `Response` body |
+| `localStorage.getItem` / `sessionStorage.getItem` | also through `window.` / `globalThis.` |
+| `URLSearchParams` `.get` / `.getAll` | `new URLSearchParams(...)`, `<x>.searchParams`, a `searchParams` binding, or a `const` bound to one of those |
+| `event.data` in a `message` listener | `x.addEventListener('message', fn)`, `x.onmessage = fn`, `onmessage = fn`, including a `{ data }` parameter |
+| Anthropic `tool_use` `.input` | `block.input` inside `if (block.type === 'tool_use')`, a `?:` / `&&` guard, `case 'tool_use':`, a `.find((b) => b.type === 'tool_use')` result, or a `.filter(...)` of that shape followed by `.map` / `.flatMap` / `.forEach` |
+| `boundaries` option | any callee you list |
+
+```ts bad reports=5
+const prefs = JSON.parse(localStorage.getItem('prefs') ?? '{}') as Prefs;
+const sort = new URLSearchParams(location.search).get('sort') as Sort;
+window.addEventListener('message', (event) => handle(event.data as Message));
+const args = JSON.parse(call.function.arguments) as WeatherArgs;
+if (block.type === 'tool_use') run(block.input as WeatherArgs);
+```
+
+```ts good
+const prefs = PrefsSchema.parse(JSON.parse(localStorage.getItem('prefs') ?? '{}'));
+const sort = SortSchema.parse(new URLSearchParams(location.search).get('sort'));
+window.addEventListener('message', (event) => handle(MessageSchema.parse(event.data)));
+const args = WeatherArgsSchema.parse(JSON.parse(call.function.arguments));
+if (block.type === 'tool_use') run(WeatherArgsSchema.parse(block.input));
+```
+
+### Through a `const`
+
+A boundary value stored in a `const` and cast later in the same function is flagged too:
+
+```ts bad
+async function loadUser(res: Response) {
+  const raw = await res.json();
+  return raw as User;
+}
+```
+
+```ts good
+async function loadUser(res: Response) {
+  const raw = await res.json();
+  return UserSchema.parse(raw);
+}
+```
+
+The binding is followed only when nothing could have checked the value first, so the rule gives the
+benefit of the doubt whenever it cannot prove otherwise:
+
+- Only a single `const name = <boundary>` is followed, never `let`, `var`, a destructuring pattern
+  or a parameter. Chains of such consts (`const body = await res.json(); const raw = body;`) are
+  followed.
+- The cast must be in the same function as the declaration.
+- Any read of the binding before the cast other than another `as` cast (a guard like
+  `isUser(raw)`, an `assertUser(raw)` call, an `'id' in raw` check, passing it to a function,
+  mutating a property) keeps the rule silent, as does any read from a nested function. Reads after
+  the cast do not excuse it.
+
+```ts prose reason="shows what the rule deliberately leaves alone, not a fix for an example above"
+async function loadUser(res: Response) {
+  const raw = await res.json();
+  assertUser(raw); // might have validated it: not flagged
+  return raw as User;
+}
+```
+
+### What it leaves alone
+
+- Casts to `unknown`, `any`, `const` or a primitive keyword (`as string | null`): the safe or
+  neutral forms.
+- `satisfies`, which checks the value against the type instead of asserting it.
+- A cast of the parse result (`UserSchema.parse(raw) as User`): the schema already checked it.
+- Look-alikes that are not boundary reads: `cache.getItem(...)`, `map.get(...)`,
+  `headers.get(...)`, `.data` outside a `message` listener, `.input` without a `tool_use` guard.
+- A boundary value that is neither cast directly nor bound by a followed `const` (a property of
+  an object, a function return value). That needs a type-aware setup.
 
 ## Options
 
-None.
+```js
+{
+  // Extra callees whose result is boundary data: a bare name or a dotted path.
+  // `readBody(event) as T` and `(await readBody(event)) as T` are then flagged.
+  boundaries: ['readBody', 'ipcRenderer.invoke'], // default []
+}
+```
+
+```ts bad options={"boundaries":["readBody"]}
+const body = (await readBody(event)) as Body;
+```
+
+```ts good
+const body = BodySchema.parse(await readBody(event));
+```
 
 ## When not to use it
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noctcore/eslint-plugin-contracts",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "ESLint rules for shared contract, config, error-handling, and money-precision conventions (zod schema naming, wire discriminants, no-direct-process-env, decimal money).",
   "license": "MIT",
   "type": "module",