@sarj/eslint-plugin 15.17.10 → 15.17.11

package/dist/index.cjs

@@ -678,10 +678,11 @@ var TEST_MODULES = /* @__PURE__ */ new Set(["@jest/globals", "@playwright/test",
 var DUPLICATE_TEST_BODY_DOCUMENTATION = {
   summary: "Disallow substantial sibling tests with the same body shape; express their differing inputs as a parameterized case table.",
   rationale: "Copy-pasted test bodies hide the cases that differ and allow equivalent assertions to drift independently.",
-  remediation: "Move the varying inputs and expected values into a case table consumed by `test.each(...)` or `it.each(...)`.",
+  remediation: "Consider a case table with one named test or subtest per case; preserve setup lifetime, test modifiers, and each case's assertions rather than deleting coverage.",
   category: "testing",
   limitations: [
-    "The rule compares substantial sibling tests within one suite and skips inline snapshots and materially different comments."
+    "The rule compares substantial sibling tests within one suite and skips inline snapshots and materially different comments.",
+    "Matching normalized body shapes do not prove runtime equivalence or independent setup; parameterization is a manual review, not an automatic deletion."
   ],
   examples: [
     {
@@ -866,6 +867,10 @@ function isDuplicateTestFrameworkIdentifier(identifier, sourceCode) {
   const variable = import_utils3.ASTUtils.findVariable(sourceCode.getScope(identifier), identifier.name);
   if (variable === null || variable.defs.length === 0) return true;
   return variable.defs.some((definition) => {
+    if (definition.node.type === import_utils3.AST_NODE_TYPES.ImportDefaultSpecifier) return definition.node.parent.source.value === "node:test";
+    if (definition.node.type !== import_utils3.AST_NODE_TYPES.ImportSpecifier) return false;
+    const imported = definition.node.imported;
+    if (!TEST_CALLERS.has(imported.type === import_utils3.AST_NODE_TYPES.Identifier ? imported.name : String(imported.value))) return false;
     let current = definition.node;
     while (current != null && current.type !== import_utils3.AST_NODE_TYPES.ImportDeclaration) current = current.parent;
     return current?.type === import_utils3.AST_NODE_TYPES.ImportDeclaration && typeof current.source.value === "string" && TEST_MODULES.has(current.source.value);
@@ -2609,12 +2614,33 @@ var import_utils13 = require("@typescript-eslint/utils");
 // src/rules/_sql.ts
 var import_utils12 = require("@typescript-eslint/utils");
 function stripSqlNoise(text) {
-  const out = [...text];
+  return scanSqlNoise(text);
+}
+function sqlSingleQuotedRanges(text) {
+  const ranges = [];
+  scanSqlNoise(text, (start, end) => ranges.push([start, end]));
+  return ranges;
+}
+function scanSqlNoise(text, onSingleQuoted) {
+  const out = text.split("");
   const n = text.length;
   let i = 0;
   while (i < n) {
     const ch = text[i];
+    if (ch === "$" && !/[\w$]/u.test(text[i - 1] ?? "")) {
+      const delimiter = /^\$(?:[A-Za-z_][A-Za-z_0-9]*)?\$/u.exec(text.slice(i))?.[0];
+      if (delimiter !== void 0) {
+        const closing = text.indexOf(delimiter, i + delimiter.length);
+        const end = closing < 0 ? n : closing + delimiter.length;
+        while (i < end) {
+          if (text[i] !== "\n") out[i] = " ";
+          i += 1;
+        }
+        continue;
+      }
+    }
     if (ch === "'" || ch === '"') {
+      const start = i;
       out[i] = " ";
       i += 1;
       while (i < n) {
@@ -2628,6 +2654,7 @@ function stripSqlNoise(text) {
           }
           out[i] = " ";
           i += 1;
+          if (ch === "'") onSingleQuoted?.(start, i);
           break;
         }
         if (c !== "\n") {
@@ -2648,17 +2675,20 @@ function stripSqlNoise(text) {
       out[i] = " ";
       out[i + 1] = " ";
       i += 2;
-      while (i < n && !(text[i] === "*" && text[i + 1] === "/")) {
+      let depth = 1;
+      while (i < n && depth > 0) {
+        if (text[i] === "/" && text[i + 1] === "*" || text[i] === "*" && text[i + 1] === "/") {
+          depth += text[i] === "/" ? 1 : -1;
+          out[i] = " ";
+          out[i + 1] = " ";
+          i += 2;
+          continue;
+        }
         if (text[i] !== "\n") {
           out[i] = " ";
         }
         i += 1;
       }
-      if (i < n) {
-        out[i] = " ";
-        out[i + 1] = " ";
-        i += 2;
-      }
       continue;
     }
     i += 1;
@@ -2756,8 +2786,9 @@ var NO_DYNAMIC_SQL_DOCUMENTATION = {
   remediation: "Use SQL placeholders and pass runtime values through the driver's binding API.",
   category: "security",
   limitations: [
-    "The rule reports only visibly quoted runtime values; dynamic identifiers and unquoted fragments require provenance that syntax-only linting cannot prove.",
-    "Static fragments and parameterizing tagged templates are exempt."
+    "Only single-quoted SQL values are inspected. Double-quoted identifiers, comments, dollar strings, and unquoted fragments are excluded; this is not a general SQL injection detector.",
+    "Literal fragments, legacy uppercase fragment names, and parameterizing tagged templates are exempt; uppercase spelling does not prove a value is static.",
+    "The bounded lexer recognizes doubled quotes, comments, and PostgreSQL dollar strings; dialect-specific escape modes and SQL generated through other APIs require separate security review."
   ],
   examples: [
     {
@@ -2798,15 +2829,23 @@ function isStaticFragment(expression) {
   return false;
 }
 function runtimeInterpolations(template) {
+  const parts = template.quasis.map((quasi) => quasi.value.cooked ?? quasi.value.raw);
+  const ranges = sqlSingleQuotedRanges(parts.join(RUNTIME_MARKER));
+  let offset = 0;
   return template.expressions.filter(
-    (expression, index) => !isStaticFragment(expression) && endsWithSqlQuote(template.quasis[index]?.value.raw ?? "") && startsWithSqlQuote(template.quasis[index + 1]?.value.raw ?? "")
+    (expression, index) => {
+      offset += parts[index]?.length ?? 0;
+      const inValue = ranges.some(([start, end]) => start < offset && offset < end);
+      offset += RUNTIME_MARKER.length;
+      return inValue && !isStaticFragment(expression) && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "");
+    }
   );
 }
 function endsWithSqlQuote(text) {
-  return /['"]\s*$/u.test(text);
+  return /'\s*$/u.test(text);
 }
 function startsWithSqlQuote(text) {
-  return /^\s*['"]/u.test(text);
+  return /^\s*'/u.test(text);
 }
 function staticLiteralText(node) {
   if (node.type === import_utils13.AST_NODE_TYPES.Literal && typeof node.value === "string") {
@@ -2828,7 +2867,13 @@ function runtimeConcatOperands(node) {
   if (!hasStringLiteral) {
     return [];
   }
+  const parts = operands.map((operand) => staticLiteralText(operand) ?? RUNTIME_MARKER);
+  const ranges = sqlSingleQuotedRanges(parts.join(""));
+  let offset = 0;
   return operands.filter((operand, index) => {
+    const inValue = ranges.some(([start, end]) => start < offset && offset < end);
+    offset += parts[index]?.length ?? 0;
+    if (!inValue) return false;
     if (isStaticFragment(operand)) return false;
     const before = operands[index - 1];
     const after = operands[index + 1];
@@ -2921,9 +2966,11 @@ var no_dynamic_sql_default = createRule({
 var import_utils14 = require("@typescript-eslint/utils");
 var NO_ENUM_DOCUMENTATION = {
   summary: "Disallow TypeScript `enum`; use string-literal unions or `as const` objects instead.",
-  rationale: "TypeScript enums emit runtime objects and numeric enums accept values outside their declared members, adding behavior where a type-only model is sufficient.",
-  remediation: "Replace the enum with a string-literal union or an `as const` object and derive its value type from that object.",
+  rationale: "Literal unions keep type-only domains explicit, while constant objects make runtime values deliberate. This policy also avoids compiler-dependent const-enum inlining contracts.",
+  remediation: "Use a literal union or an `as const` object after checking runtime member access, numeric reverse mappings, serialized values, and public consumers.",
   category: "maintainability",
+  limitations: ["This is an explicit style policy for regular and const enums, not a claim that every enum emits an object. Generated files and configured exclusions are preserved; migration is manual."],
+  references: ["https://www.typescriptlang.org/docs/handbook/enums.html"],
   examples: [
     {
       id: "string-literal-union",
@@ -3003,17 +3050,17 @@ var no_enum_default = createRule({
 // src/rules/no-fat-try-blocks.ts
 var import_utils15 = require("@typescript-eslint/utils");
 var NO_FAT_TRY_BLOCKS_DOCUMENTATION = {
-  summary: "Disallow `try` blocks containing more than three top-level operations that can throw.",
+  summary: "Review try blocks exceeding the configured count of syntactically selected operations.",
   rationale: "A broad `try` block obscures which operation failed and encourages one catch clause to recover from unrelated errors.",
   remediation: "Keep only the operations that share one recovery policy inside the `try` block and move other work outside it.",
   category: "correctness",
   limitations: [
-    "The rule uses syntax to identify throwing operations and exempts generated files, finally blocks, rethrows, and terminal error boundaries."
+    "The default threshold is three selected top-level operations, not a proof of every possible throw. A shared recovery policy may legitimately cover several operations; generated files, catchless finally blocks, rethrows, and terminal error boundaries are excluded."
   ],
   examples: [
     {
       id: "focused-try-block",
-      title: "A try block contains three throwing operations",
+      title: "Three selected operations stay within the default threshold",
       outcome: "no-match",
       files: [{
         path: "src/load.ts",
@@ -3025,7 +3072,7 @@ var NO_FAT_TRY_BLOCKS_DOCUMENTATION = {
     },
     {
       id: "broad-try-block",
-      title: "A try block contains four throwing operations",
+      title: "Review whether four selected operations share one recovery policy",
       outcome: "match",
       files: [{
         path: "src/load.ts",
@@ -3395,7 +3442,7 @@ var no_fat_try_blocks_default = createRule({
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow `try` blocks containing more than three top-level operations that can throw."
+      description: "Review try blocks exceeding the configured count of syntactically selected operations."
     },
     schema: [
       {
@@ -3407,7 +3454,7 @@ var no_fat_try_blocks_default = createRule({
       }
     ],
     messages: {
-      fatTryBlock: "This `try` block has {{count}} statements that can throw (max {{max}}). Isolate the throwing statement(s); move non-throwing work outside the `try`."
+      fatTryBlock: "This `try` block has {{count}} syntactically selected operations (max {{max}}). Review whether they share one recovery policy; move unrelated work outside the boundary."
     }
   },
   defaultOptions: [{ max: MAX_TRY_BODY_STATEMENTS }],
@@ -3454,7 +3501,8 @@ var NO_HAND_ROLLED_SLEEP_DOCUMENTATION = {
   remediation: "Use `node:timers/promises` with an abort signal for delays, or pass `AbortSignal.timeout(...)` to the timed operation.",
   category: "correctness",
   limitations: [
-    "The rule skips tests, scripts, generated files, and client modules by default, and supports explicit path exemptions."
+    "The rule skips tests, scripts, generated files, and client modules by default, and supports explicit path exemptions.",
+    "Locally shadowed constructors/timers and value-returning timers are excluded. Only recognized browser markers are excluded; choose a runtime-compatible cancellation API for other browser modules."
   ],
   examples: [
     {
@@ -3598,6 +3646,21 @@ var no_hand_rolled_sleep_default = createRule({
       return {};
     }
     const checkClientModules = optionsArg?.checkClientModules ?? false;
+    const bindingOf = (identifier) => import_utils16.ASTUtils.findVariable(sourceCode.getScope(identifier), identifier.name);
+    const isGlobal = (identifier) => (bindingOf(identifier)?.defs.length ?? 0) === 0;
+    const isBuiltinTimer = (callee) => {
+      if (!isSetTimeoutCallee(callee)) return false;
+      if (callee.type === import_utils16.AST_NODE_TYPES.MemberExpression && callee.object.type === import_utils16.AST_NODE_TYPES.Identifier) return isGlobal(callee.object);
+      if (callee.type !== import_utils16.AST_NODE_TYPES.Identifier) return false;
+      const binding = bindingOf(callee);
+      return binding === null || binding.defs.length === 0 || binding.defs.every((definition) => definition.node.type === import_utils16.AST_NODE_TYPES.ImportSpecifier && definition.node.imported.type === import_utils16.AST_NODE_TYPES.Identifier && definition.node.imported.name === "setTimeout" && definition.node.parent.type === import_utils16.AST_NODE_TYPES.ImportDeclaration && ["node:timers", "timers"].includes(String(definition.node.parent.source.value)));
+    };
+    const settlesParameter = (callback, executor, index) => {
+      const parameter = executor.params[index];
+      if (parameter?.type !== import_utils16.AST_NODE_TYPES.Identifier) return false;
+      const callee = callback.type === import_utils16.AST_NODE_TYPES.Identifier ? callback : callback.type === import_utils16.AST_NODE_TYPES.ArrowFunctionExpression || callback.type === import_utils16.AST_NODE_TYPES.FunctionExpression ? soleCall(callback)?.callee : null;
+      return callee?.type === import_utils16.AST_NODE_TYPES.Identifier && bindingOf(callee) === bindingOf(parameter);
+    };
     function isClientModule2() {
       if (/\.[cm]?[jt]sx$/.test(filename)) {
         return true;
@@ -3623,7 +3686,7 @@ var no_hand_rolled_sleep_default = createRule({
     };
     return {
       NewExpression(node) {
-        if (node.callee.type !== import_utils16.AST_NODE_TYPES.Identifier || node.callee.name !== "Promise") {
+        if (node.callee.type !== import_utils16.AST_NODE_TYPES.Identifier || node.callee.name !== "Promise" || !isGlobal(node.callee)) {
           return;
         }
         const executor = node.arguments[0];
@@ -3631,7 +3694,7 @@ var no_hand_rolled_sleep_default = createRule({
           return;
         }
         const call = soleCall(executor);
-        if (call === null || !isSetTimeoutCallee(call.callee)) {
+        if (call === null || !isBuiltinTimer(call.callee)) {
           return;
         }
         const [callback, delay] = call.arguments;
@@ -3639,14 +3702,14 @@ var no_hand_rolled_sleep_default = createRule({
           return;
         }
         const resolveName = parameterName(executor, 0);
-        if (resolveName !== null && settlesWithoutValue(callback, resolveName)) {
+        if (resolveName !== null && call.arguments.length === 2 && settlesWithoutValue(callback, resolveName) && settlesParameter(callback, executor, 0)) {
           if (reportsSleepHere()) {
             context.report({ node, messageId: "handRolledSleep" });
           }
           return;
         }
         const rejectName = parameterName(executor, 1);
-        if (rejectName !== null && isRaceArm(node) && rejectsInCallback(callback, rejectName)) {
+        if (rejectName !== null && isRaceArm(node) && settlesParameter(callback, executor, 1) && rejectsInCallback(callback, rejectName)) {
           context.report({ node, messageId: "handRolledTimeoutRace" });
         }
       }
@@ -3745,7 +3808,7 @@ var NO_INSECURE_RANDOM_ID_DOCUMENTATION = {
   rationale: "Math.random is predictable and lacks the entropy required for security-sensitive values.",
   remediation: "Generate the value with crypto.randomUUID or crypto.getRandomValues.",
   category: "security",
-  limitations: ["Ambiguous identifiers and test files are excluded to avoid flagging sampling and fixture data."],
+  limitations: ["Names select security-sensitive bindings heuristically; they do not prove sensitivity. Sampling in unrelated bindings or branch tests, locally shadowed Math objects, ambiguous identifiers and test files are excluded. This is not interprocedural data-flow analysis."],
   examples: [
     { id: "cryptographic-id", title: "Use the Web Crypto API", outcome: "no-match", files: [{ path: "src/session.ts", source: "const sessionToken = crypto.randomUUID();" }], focusPath: "src/session.ts", expectedCount: 0, public: true },
     { id: "predictable-token", title: "Do not derive a token from Math.random", outcome: "match", files: [{ path: "src/session.ts", source: "const sessionToken = Math.random();" }], focusPath: "src/session.ts", expectedCount: 1, public: true }
@@ -3826,6 +3889,7 @@ function findEnclosingNames(node) {
       if (directBinding && parent.id.type === "Identifier") {
         names.push(parent.id.name);
       }
+      return names;
     }
     if (parent.type === "Property" && parent.value === current) {
       const key = parent.key;
@@ -3860,7 +3924,7 @@ function findEnclosingNames(node) {
       if (directBinding && parent.id !== null) names.push(parent.id.name);
       return names;
     }
-    if (parent.type === "ExpressionStatement") {
+    if (parent.type === "ExpressionStatement" || parent.type === "IfStatement" || parent.type === "ForStatement" || parent.type === "WhileStatement" || parent.type === "DoWhileStatement" || parent.type === "FunctionExpression" || parent.type === "ArrowFunctionExpression") {
       return names;
     }
     current = parent;
@@ -3952,6 +4016,7 @@ var no_insecure_random_id_default = createRule({
         if (!isMathRandomCall(node)) {
           return;
         }
+        if ((import_utils18.ASTUtils.findVariable(context.sourceCode.getScope(node), "Math")?.defs.length ?? 0) > 0) return;
         const names = findEnclosingNames(node);
         if (names.some(isStrongSecurityName)) {
           context.report({ node, messageId: "insecureRandomId" });
@@ -4816,6 +4881,39 @@ var no_log_only_catch_default = createRule({
     const matcher = createLogMatcher(loggingOptions);
     const filename = context.filename;
     const sourceCode = context.sourceCode;
+    function hasCoercionValidation(node) {
+      const owner = node.parent;
+      const statement = owner.block.body[0];
+      if (node.body.body.length !== 0 || owner.finalizer !== null || owner.block.body.length !== 1 || statement?.type !== import_utils24.AST_NODE_TYPES.ExpressionStatement || statement.expression.type !== import_utils24.AST_NODE_TYPES.AssignmentExpression || statement.expression.operator !== "=") return false;
+      const { left, right } = statement.expression;
+      if (left.type !== import_utils24.AST_NODE_TYPES.MemberExpression || left.computed || left.object.type !== import_utils24.AST_NODE_TYPES.Identifier || right.type !== import_utils24.AST_NODE_TYPES.CallExpression || right.optional || right.callee.type !== import_utils24.AST_NODE_TYPES.Identifier || !["String", "Number", "Boolean", "BigInt"].includes(right.callee.name) || right.arguments.length !== 1) return false;
+      const argument = right.arguments[0];
+      if (argument === void 0 || sourceCode.getText(left) !== sourceCode.getText(argument)) return false;
+      const global = import_utils24.ASTUtils.findVariable(sourceCode.getScope(right.callee), right.callee.name);
+      if (global !== null && global.defs.length > 0) return false;
+      const root = import_utils24.ASTUtils.findVariable(sourceCode.getScope(left.object), left.object.name);
+      if (root === null || root.references.some((reference) => reference.isWrite() && !reference.init)) return false;
+      let current = owner;
+      let slot = statementSlot(current);
+      while (slot === null && current.parent !== void 0 && !FUNCTION_TYPES2.has(current.parent.type)) {
+        current = current.parent;
+        slot = statementSlot(current);
+      }
+      let next = slot?.list[slot.index + 1];
+      let target = sourceCode.getText(left);
+      if (next?.type === import_utils24.AST_NODE_TYPES.VariableDeclaration && next.kind === "const" && next.declarations.length === 1) {
+        const alias = next.declarations[0];
+        if (alias?.id.type !== import_utils24.AST_NODE_TYPES.Identifier || alias.init === null || sourceCode.getText(alias.init) !== target) return false;
+        target = alias.id.name;
+        next = slot?.list[slot.index + 2];
+      }
+      if (next?.type !== import_utils24.AST_NODE_TYPES.IfStatement) return false;
+      let condition = next.test;
+      while (condition.type === import_utils24.AST_NODE_TYPES.LogicalExpression && condition.operator === "&&") condition = condition.left;
+      if (condition.type !== import_utils24.AST_NODE_TYPES.BinaryExpression || !["==", "==="].includes(condition.operator)) return false;
+      const test = condition.left;
+      return test.type === import_utils24.AST_NODE_TYPES.UnaryExpression && test.operator === "typeof" && sourceCode.getText(test.argument) === target && condition.right.type === import_utils24.AST_NODE_TYPES.Literal && condition.right.value === right.callee.name.toLowerCase();
+    }
     function isLoggingCallStatement(statement) {
       if (statement.type !== "ExpressionStatement") {
         return false;
@@ -4842,17 +4940,11 @@ var no_log_only_catch_default = createRule({
       CatchClause(node) {
         const statements = node.body.body;
         const isDocumented = sourceCode.getCommentsInside(node.body).length > 0 || hasAdjacentRationale(node);
-        if (statements.length === 0) {
-          if (isDocumented) {
-            return;
-          }
-          if (fallbackFollowsTry(node.parent) || seededFallbackHandled(node.parent, sourceCode.getScope(node))) {
-            return;
-          }
-          context.report({ node, messageId: "emptyCatch" });
+        if (isDocumented || hasCoercionValidation(node) || fallbackFollowsTry(node.parent) || seededFallbackHandled(node.parent, sourceCode.getScope(node))) {
           return;
         }
-        if (isDocumented) {
+        if (statements.length === 0) {
+          context.report({ node, messageId: "emptyCatch" });
           return;
         }
         const everyStatementIsLogging = statements.every(
@@ -4870,7 +4962,7 @@ var no_log_only_catch_default = createRule({
 var import_utils25 = require("@typescript-eslint/utils");
 var NO_BARE_RETURN_FROM_TEST_CATCH_DOCUMENTATION = {
   summary: "Disallow a bare return from a test catch block when it skips a later assertion.",
-  rationale: "The caught failure turns into a passing test without executing the assertion that follows it.",
+  rationale: "An unasserted catch return can swallow a failure and skip later assertions; the complete test result also depends on other assertions and hooks.",
   remediation: "Rethrow the error, assert on it, or use the runner's explicit skip mechanism when the capability is optional.",
   category: "testing",
   filePatterns: ["**/*.test.*", "**/*.spec.*", "**/tests/**", "**/__tests__/**"],
@@ -4957,7 +5049,7 @@ var no_bare_return_from_test_catch_default = createRule({
     type: "problem",
     docs: { description: "Disallow a bare return from a test catch block when it skips a later assertion." },
     schema: [],
-    messages: { bareReturnFromTestCatch: "This bare return turns the caught failure into a passing test and skips a later assertion. Rethrow, assert on the error, or explicitly skip the test." }
+    messages: { bareReturnFromTestCatch: "This bare return can swallow the caught failure and skips a later assertion. Rethrow, assert on the error, or explicitly skip the test." }
   },
   defaultOptions: [],
   create(context) {
@@ -4976,6 +5068,23 @@ var no_bare_return_from_test_catch_default = createRule({
           if (current === null || current === void 0) break;
         }
         if (catchClause === null || catchClause.parent.finalizer !== null) return;
+        const parameter = catchClause.param;
+        if (parameter?.type === import_utils25.AST_NODE_TYPES.Identifier && node.parent === catchClause.body) {
+          const errorBinding = import_utils25.ASTUtils.findVariable(context.sourceCode.getScope(parameter), parameter.name);
+          const assertedError = catchClause.body.body.some((statement) => {
+            if (statement.range[1] >= node.range[0] || statement.type !== import_utils25.AST_NODE_TYPES.ExpressionStatement) return false;
+            const expression = statement.expression;
+            if (expression.type !== import_utils25.AST_NODE_TYPES.CallExpression || !isAssertion(expression, context)) return false;
+            const root = rootIdentifier2(expression.callee);
+            if (root === null) return false;
+            const assertionName = importedName3(root, context, ASSERTION_MODULES);
+            let operand = expression.callee.type === import_utils25.AST_NODE_TYPES.MemberExpression ? expression.callee.object : null;
+            if (operand?.type === import_utils25.AST_NODE_TYPES.MemberExpression && staticMemberName2(operand) === "not") operand = operand.object;
+            if (assertionName !== "assert" && (assertionName !== "expect" || operand?.type !== import_utils25.AST_NODE_TYPES.CallExpression || operand.callee !== root)) return false;
+            return walkOwnScope(expression, (current) => current.type === import_utils25.AST_NODE_TYPES.Identifier && errorBinding?.references.some((reference) => reference.identifier === current) === true);
+          });
+          if (assertedError) return;
+        }
         if (walkOwnScope(catchClause.body, (current) => current.type === import_utils25.AST_NODE_TYPES.ThrowStatement || isExplicitSkip(current, context))) return;
         if (!walkOwnScope(owner.body, (current) => current.range[0] > node.range[1] && isAssertion(current, context))) return;
         context.report({ node, messageId: "bareReturnFromTestCatch" });
@@ -4987,13 +5096,13 @@ var no_bare_return_from_test_catch_default = createRule({
 // src/rules/no-bespoke-api-case-conversion.ts
 var import_utils26 = require("@typescript-eslint/utils");
 var NO_BESPOKE_API_CASE_CONVERSION_DOCUMENTATION = {
-  summary: "Disallow hand-written snake_case/camelCase object-key translation at a proven API adapter boundary.",
-  rationale: "A second, hand-maintained representation of an API wire contract drifts from the generated client and makes backend field renames compile successfully while failing at runtime.",
+  summary: "Review direct snake_case/camelCase mirror mappings on explicitly API-typed adapter values.",
+  rationale: "Duplicating wire-name translation can drift from an API client contract. When the SDK owns application-facing names, centralizing conversion avoids maintaining another mirror by hand.",
   remediation: "Move wire-name ownership and case conversion into the generated SDK/model layer; keep application adapters on the generated typed surface.",
   category: "architecture",
   autofix: "none",
   limitations: [
-    "Only files named adapter/adapters that import an API, client, SDK, contract, or generated module are checked.",
+    "Only adapter/adapters files and receivers explicitly annotated with a scope-resolved type imported from an API/client/SDK/contract/generated module are checked. Unrelated imports, local type shadows, reassigned receivers and inferred receiver types are excluded.",
     "Only object properties that directly translate the same identifier between snake_case and lowerCamelCase are reported.",
     "Quoted/computed protocol keys, generated/vendor code, tests, fixtures, and indirect conversions are intentionally excluded."
   ],
@@ -5065,7 +5174,7 @@ var no_bespoke_api_case_conversion_default = createRule({
     docs: { description: NO_BESPOKE_API_CASE_CONVERSION_DOCUMENTATION.summary },
     schema: [],
     messages: {
-      noBespokeApiCaseConversion: "This API adapter manually translates `{{wireName}}` and `{{applicationName}}`; make the generated SDK/model layer own wire-name conversion."
+      noBespokeApiCaseConversion: "This API-typed adapter value mirrors `{{wireName}}` and `{{applicationName}}`. If the SDK owns application-facing names, move this conversion to its model boundary."
     }
   },
   defaultOptions: [],
@@ -5075,16 +5184,33 @@ var no_bespoke_api_case_conversion_default = createRule({
     if (!ADAPTER_BASENAME_RE.test(basename) || isGeneratedFile(filename, context.sourceCode.text) || isTestFile(filename, ["fixtureTree"])) {
       return {};
     }
-    const provenApiBoundary = context.sourceCode.ast.body.some(
-      (statement) => statement.type === import_utils26.AST_NODE_TYPES.ImportDeclaration && API_BOUNDARY_IMPORT_RE.test(statement.source.value)
-    );
-    if (!provenApiBoundary) return {};
+    const hasApiReceiver = (value) => {
+      let current = value;
+      while (true) {
+        if (current.type === import_utils26.AST_NODE_TYPES.MemberExpression) current = current.object;
+        else if (current.type === import_utils26.AST_NODE_TYPES.TSAsExpression || current.type === import_utils26.AST_NODE_TYPES.TSNonNullExpression || current.type === import_utils26.AST_NODE_TYPES.TSTypeAssertion) current = current.expression;
+        else break;
+      }
+      if (current.type !== import_utils26.AST_NODE_TYPES.Identifier) return false;
+      const binding = import_utils26.ASTUtils.findVariable(context.sourceCode.getScope(current), current.name);
+      if (binding?.defs.length !== 1 || binding.references.some((reference) => reference.isWrite() && reference.init !== true)) return false;
+      const identifier = binding.defs[0]?.name;
+      if (identifier?.type !== import_utils26.AST_NODE_TYPES.Identifier) return false;
+      const annotation = identifier.typeAnnotation?.typeAnnotation;
+      if (annotation?.type !== import_utils26.AST_NODE_TYPES.TSTypeReference) return false;
+      let typeName = annotation.typeName;
+      while (typeName.type === import_utils26.AST_NODE_TYPES.TSQualifiedName) typeName = typeName.left;
+      if (typeName.type !== import_utils26.AST_NODE_TYPES.Identifier) return false;
+      const typeBinding = import_utils26.ASTUtils.findVariable(context.sourceCode.getScope(typeName), typeName.name);
+      return typeBinding?.defs.length === 1 && typeBinding.defs[0]?.type === "ImportBinding" && typeBinding.defs[0].parent.type === import_utils26.AST_NODE_TYPES.ImportDeclaration && API_BOUNDARY_IMPORT_RE.test(typeBinding.defs[0].parent.source.value);
+    };
     return {
       Property(node) {
         if (node.computed || node.method || node.shorthand) return;
         const key = propertyName(node.key);
         const value = memberName3(node.value);
         if (key === null || value === null || !isDirectCaseTranslation(key, value)) return;
+        if (!hasApiReceiver(node.value)) return;
         const wireName = SNAKE_CASE_RE.test(key) ? key : value;
         const applicationName = wireName === key ? value : key;
         context.report({
@@ -5207,7 +5333,7 @@ var NO_VAGUE_SUPPRESSION_DESCRIPTION_DOCUMENTATION = {
   limitations: [
     "Only ESLint disable comments and TypeScript expect-error directives are checked.",
     "The rule uses a small anchored vocabulary and does not score prose quality generally.",
-    "Generated files and descriptions containing any concrete context are excluded."
+    "Generated files and descriptions outside that exact vocabulary are excluded; an unflagged reason is not proof of a justified suppression. Missing descriptions remain owned by the upstream description requirement."
   ],
   examples: [
     {
@@ -5217,7 +5343,7 @@ var NO_VAGUE_SUPPRESSION_DESCRIPTION_DOCUMENTATION = {
       files: [
         {
           path: "src/adapter.ts",
-          source: "// @ts-expect-error -- vendor types omit the runtime requestId field\nreturn response.requestId;"
+          source: "function requestId(response: object) {\n  // @ts-expect-error -- vendor types omit the runtime requestId field\n  return response.requestId;\n}"
         }
       ],
       focusPath: "src/adapter.ts",
@@ -5231,7 +5357,7 @@ var NO_VAGUE_SUPPRESSION_DESCRIPTION_DOCUMENTATION = {
       files: [
         {
           path: "src/adapter.ts",
-          source: "// @ts-expect-error -- false positive\nreturn response.requestId;"
+          source: "function requestId(response: object) {\n  // @ts-expect-error -- false positive\n  return response.requestId;\n}"
         }
       ],
       focusPath: "src/adapter.ts",
@@ -5464,11 +5590,11 @@ var no_generic_single_export_module_default = createRule({
 // src/rules/no-offset-pagination.ts
 var import_utils29 = require("@typescript-eslint/utils");
 var NO_OFFSET_PAGINATION_DOCUMENTATION = {
-  summary: "Disallow OFFSET pagination in embedded SQL; it is O(N) per page and drops or repeats rows under concurrent writes. Use a keyset cursor.",
+  summary: "Prefer keyset pagination for embedded SQL queries using OFFSET.",
   rationale: "Offset pagination scans skipped rows and shifts page boundaries under concurrent writes.",
-  remediation: "Page with a stable ordered key and a cursor predicate.",
+  remediation: "Consider a keyset cursor that preserves the query's complete ordering, tie-breakers, and filters.",
   category: "performance",
-  limitations: ["Only embedded SQL is inspected; test files and non-pagination OFFSET syntax are excluded."],
+  limitations: ["A SELECT/FROM query shape or adjacent LIMIT/OFFSET fragment is required. Isolated OFFSET fragments and test files are excluded; this lexical context does not prove a database execution sink. Performance and concurrent-write behavior depend on indexes, ordering, isolation, and dialect; bounded pages and random page access can justify OFFSET."],
   examples: [
     { id: "keyset-pagination", title: "Page from a stable cursor", outcome: "no-match", files: [{ path: "src/runs.ts", source: "db.prepare(`SELECT id FROM runs WHERE id > ? ORDER BY id LIMIT ?`).all();" }], focusPath: "src/runs.ts", expectedCount: 0, public: true },
     { id: "offset-pagination", title: "Do not page by offset", outcome: "match", files: [{ path: "src/runs.ts", source: "db.query(`SELECT id FROM runs ORDER BY id LIMIT ? OFFSET ?`);" }], focusPath: "src/runs.ts", expectedCount: 1, public: true }
@@ -5476,17 +5602,18 @@ var NO_OFFSET_PAGINATION_DOCUMENTATION = {
 };
 var OFFSET_PAGINATION = /\bOFFSET\s+(?:%s|%\(\w+\)s|\?\d*|:\w+|@\w+|\$\d+|\d+)/i;
 var OFFSET_GATE = /offset/i;
+var PAGINATION_CONTEXT = /\bSELECT\b[\s\S]*\bFROM\b[\s\S]*\bOFFSET\b|\bLIMIT\s+(?:%s|%\(\w+\)s|\?\d*|:\w+|@\w+|\$\d+|\d+)\s+OFFSET\b/i;
 var no_offset_pagination_default = createRule({
   name: "no-offset-pagination",
   documentation: NO_OFFSET_PAGINATION_DOCUMENTATION,
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow OFFSET pagination in embedded SQL; it is O(N) per page and drops or repeats rows under concurrent writes. Use a keyset cursor."
+      description: "Prefer keyset pagination for embedded SQL queries using OFFSET."
     },
     schema: [],
     messages: {
-      noOffsetPagination: "OFFSET pagination scans and discards every skipped row (O(N) per page) and shifts under concurrent inserts, so rows get repeated or missed. Use a keyset cursor: `WHERE id > ? ORDER BY id LIMIT ?`."
+      noOffsetPagination: "Review OFFSET pagination for large or changing result sets. If a keyset cursor fits the access pattern, preserve the query's complete ordering, tie-breakers, and filters; bounded pages or random page access may justify OFFSET."
     }
   },
   defaultOptions: [],
@@ -5495,7 +5622,7 @@ var no_offset_pagination_default = createRule({
       return {};
     }
     return createSqlListener((sql, node) => {
-      if (!OFFSET_PAGINATION.test(sql)) {
+      if (!PAGINATION_CONTEXT.test(sql) || !OFFSET_PAGINATION.test(sql)) {
         return;
       }
       context.report({ node, messageId: "noOffsetPagination" });
@@ -6526,7 +6653,7 @@ var NO_REPEATED_STRING_LITERAL_DOCUMENTATION = {
   ]
 };
 function isStructured(value) {
-  return value.includes("\n") || SQL_KEYWORD_RE.test(value) || IDENTIFIER_RE.test(value) || URL_PATH_RE.test(value);
+  return SQL_KEYWORD_RE.test(value) || IDENTIFIER_RE.test(value) || URL_PATH_RE.test(value);
 }
 function preview(value) {
   const oneLine = value.replaceAll("\n", " ").trim();
@@ -6547,7 +6674,7 @@ function isScaffolding(node) {
   }
   const isNonComputedPropertyKey = (parent.type === import_utils35.AST_NODE_TYPES.Property || parent.type === import_utils35.AST_NODE_TYPES.PropertyDefinition || parent.type === import_utils35.AST_NODE_TYPES.MethodDefinition || parent.type === import_utils35.AST_NODE_TYPES.AccessorProperty) && parent.key === node && !parent.computed;
   const isRequireSource = parent.type === import_utils35.AST_NODE_TYPES.CallExpression && parent.callee.type === import_utils35.AST_NODE_TYPES.Identifier && parent.callee.name === "require";
-  return parent.type === import_utils35.AST_NODE_TYPES.ImportDeclaration || parent.type === import_utils35.AST_NODE_TYPES.ImportExpression || parent.type === import_utils35.AST_NODE_TYPES.ExportNamedDeclaration || parent.type === import_utils35.AST_NODE_TYPES.ExportAllDeclaration || parent.type === import_utils35.AST_NODE_TYPES.TSImportType || parent.type === import_utils35.AST_NODE_TYPES.JSXAttribute || parent.type === import_utils35.AST_NODE_TYPES.TSLiteralType || isNonComputedPropertyKey || isRequireSource;
+  return parent.type === import_utils35.AST_NODE_TYPES.ImportDeclaration || parent.type === import_utils35.AST_NODE_TYPES.ImportExpression || parent.type === import_utils35.AST_NODE_TYPES.ExportNamedDeclaration || parent.type === import_utils35.AST_NODE_TYPES.ExportAllDeclaration || parent.type === import_utils35.AST_NODE_TYPES.TSImportType || parent.type === import_utils35.AST_NODE_TYPES.JSXAttribute || parent.type === import_utils35.AST_NODE_TYPES.JSXExpressionContainer && parent.parent.type === import_utils35.AST_NODE_TYPES.JSXAttribute || parent.type === import_utils35.AST_NODE_TYPES.TSLiteralType || isNonComputedPropertyKey || isRequireSource;
 }
 var no_repeated_string_literal_default = createRule({
   name: "no-repeated-string-literal",
@@ -7467,11 +7594,11 @@ var no_server_env_in_client_component_default = createRule({
 // src/rules/no-select-star.ts
 var import_utils41 = require("@typescript-eslint/utils");
 var NO_SELECT_STAR_DOCUMENTATION = {
-  summary: "Disallow SELECT * in embedded SQL; it over-fetches and leaves the row contract implicit, so a schema change breaks row parsing silently.",
+  summary: "Prefer explicit column projections over SELECT * in embedded SQL.",
   rationale: "Wildcard projections couple row shape and query cost to unrelated schema changes.",
   remediation: "List every required column explicitly in the projection.",
   category: "correctness",
-  limitations: ["Only statically visible embedded SQL is checked; function arguments such as COUNT(*) and stars inside EXISTS are excluded."],
+  limitations: ["Only statically visible embedded SQL is checked; quoted strings (including PostgreSQL dollar strings), comments, function arguments such as COUNT(*), and stars inside EXISTS are excluded. This is a bounded lexical scan, not a complete SQL parser."],
   examples: [
     { id: "explicit-projection", title: "Select the required columns", outcome: "no-match", files: [{ path: "src/runs.ts", source: "db.prepare(`SELECT id, status FROM runs`).all();" }], focusPath: "src/runs.ts", expectedCount: 0, public: true },
     { id: "wildcard-projection", title: "Do not select every column", outcome: "match", files: [{ path: "src/runs.ts", source: "db.prepare(`SELECT * FROM runs`).all();" }], focusPath: "src/runs.ts", expectedCount: 1, public: true }
@@ -7522,7 +7649,7 @@ var no_select_star_default = createRule({
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow SELECT * in embedded SQL; it over-fetches and leaves the row contract implicit, so a schema change breaks row parsing silently."
+      description: "Prefer explicit column projections over SELECT * in embedded SQL."
     },
     schema: [],
     messages: {
@@ -8006,7 +8133,7 @@ var NO_SILENT_PROMISE_CATCH_DOCUMENTATION = {
   rationale: "A swallowed rejection hides failures and gives callers an indistinguishable fallback value.",
   remediation: "Log, rethrow, or explicitly recover from the rejection; explain intentional teardown suppression.",
   category: "correctness",
-  limitations: ["Test files, teardown calls, explanatory comments, non-function handlers, and handlers that consume or report the error are excluded."],
+  limitations: ["Test files, teardown calls, explanatory comments, non-function handlers, and handlers that consume or report the error are excluded.", "Recognized imported Zod construction chains and their stable local aliases are excluded. Other untyped catch-like APIs are not proven to be Promises."],
   examples: [
     { id: "reported-rejection", title: "Report the rejection", outcome: "no-match", files: [{ path: "src/load.ts", source: "load().catch((error) => logger.error({ error }, 'load failed'));" }], focusPath: "src/load.ts", expectedCount: 0, public: true },
     { id: "silent-rejection", title: "Do not swallow the rejection", outcome: "match", files: [{ path: "src/load.ts", source: "load().catch(() => null);" }], focusPath: "src/load.ts", expectedCount: 1, public: true }
@@ -8020,6 +8147,43 @@ var BODY_PARSE_METHODS = /* @__PURE__ */ new Set([
   "json",
   "text"
 ]);
+var ZOD_CONSTRUCTORS = /* @__PURE__ */ new Set([
+  "any",
+  "array",
+  "bigint",
+  "boolean",
+  "custom",
+  "date",
+  "enum",
+  "literal",
+  "map",
+  "never",
+  "null",
+  "number",
+  "object",
+  "record",
+  "set",
+  "string",
+  "tuple",
+  "undefined",
+  "union",
+  "unknown"
+]);
+var ZOD_CHAIN_METHODS = /* @__PURE__ */ new Set([
+  "array",
+  "catch",
+  "default",
+  "describe",
+  "max",
+  "min",
+  "nullable",
+  "nullish",
+  "optional",
+  "readonly",
+  "refine",
+  "superRefine",
+  "transform"
+]);
 function isBodyParseCall(node) {
   return node.type === import_utils43.AST_NODE_TYPES.CallExpression && node.arguments.length === 0 && node.callee.type === import_utils43.AST_NODE_TYPES.MemberExpression && !node.callee.computed && node.callee.property.type === import_utils43.AST_NODE_TYPES.Identifier && BODY_PARSE_METHODS.has(node.callee.property.name);
 }
@@ -8093,6 +8257,26 @@ var no_silent_promise_catch_default = createRule({
     if (isTestFile(context.filename) || isScriptFile(context.filename)) {
       return {};
     }
+    function isZodSchema(node, seen = /* @__PURE__ */ new Set()) {
+      if (seen.has(node)) return false;
+      seen.add(node);
+      if (node.type === import_utils43.AST_NODE_TYPES.Identifier) {
+        const binding = import_utils43.ASTUtils.findVariable(context.sourceCode.getScope(node), node.name);
+        if (binding === null || binding.references.some((reference) => reference.isWrite() && reference.init !== true)) return false;
+        const [definition] = binding.defs;
+        return binding.defs.length === 1 && definition?.node.type === import_utils43.AST_NODE_TYPES.VariableDeclarator && definition.node.init !== null && isZodSchema(definition.node.init, seen);
+      }
+      if (node.type !== import_utils43.AST_NODE_TYPES.CallExpression || node.callee.type !== import_utils43.AST_NODE_TYPES.MemberExpression || node.callee.computed || node.callee.property.type !== import_utils43.AST_NODE_TYPES.Identifier) return false;
+      const { object, property } = node.callee;
+      if (object.type === import_utils43.AST_NODE_TYPES.Identifier && ZOD_CONSTRUCTORS.has(property.name)) {
+        const binding = import_utils43.ASTUtils.findVariable(context.sourceCode.getScope(object), object.name);
+        if (binding?.defs.some((definition) => {
+          const specifier = definition.node;
+          return (specifier.type === import_utils43.AST_NODE_TYPES.ImportNamespaceSpecifier || specifier.type === import_utils43.AST_NODE_TYPES.ImportDefaultSpecifier || specifier.type === import_utils43.AST_NODE_TYPES.ImportSpecifier && specifier.imported.type === import_utils43.AST_NODE_TYPES.Identifier && specifier.imported.name === "z") && specifier.parent.type === import_utils43.AST_NODE_TYPES.ImportDeclaration && isZodModule(String(specifier.parent.source.value));
+        })) return true;
+      }
+      return ZOD_CHAIN_METHODS.has(property.name) && isZodSchema(object, seen);
+    }
     const hasExplanatoryComment = (call, handler) => {
       const sourceCode = context.sourceCode;
       if (sourceCode.getCommentsInside(handler).some(isExplanatory)) {
@@ -8117,6 +8301,7 @@ var no_silent_promise_catch_default = createRule({
         const method = node.callee.property.name;
         const handlerIndex = method === "catch" ? 0 : method === "then" ? 1 : null;
         if (handlerIndex === null) return;
+        if (method === "catch" && isZodSchema(node.callee.object)) return;
         if (isBodyParseCall(node.callee.object)) {
           return;
         }
@@ -8151,14 +8336,14 @@ var no_silent_promise_catch_default = createRule({
 // src/rules/no-sleep-in-test-body.ts
 var import_utils44 = require("@typescript-eslint/utils");
 var NO_SLEEP_IN_TEST_BODY_DOCUMENTATION = {
-  summary: "Disallow a fixed timed sleep directly in a test body; it flakes under CI load. Synchronize on the signal or use fake timers.",
+  summary: "Avoid fixed timed sleeps directly in test bodies; synchronize on observable behavior or use controlled timers.",
   rationale: "Wall-clock delays make test correctness depend on scheduler and machine speed.",
-  remediation: "Await the observable signal or advance deterministic fake timers.",
+  remediation: "Await the observable signal, or advance fake timers when supported and restore real timers in finally or a teardown hook.",
   category: "testing",
   filePatterns: ["**/*.test.*", "**/*.spec.*", "**/tests/**", "**/__tests__/**"],
-  limitations: ["Only fixed nonzero sleeps directly inside test and per-test hook callbacks are checked; nested fakes and parameterized delays are excluded."],
+  limitations: ["Only fixed nonzero sleeps directly inside test and per-test hook callbacks are checked; nested fakes, parameterized delays, local helper bindings, and Promise executors with additional work or rejection callbacks are excluded."],
   examples: [
-    { id: "fake-timer", title: "Advance time deterministically", outcome: "no-match", files: [{ path: "src/retry.test.ts", source: "it('retries', async () => { vi.useFakeTimers(); const result = retry(); await vi.advanceTimersByTimeAsync(50); await result; });" }], focusPath: "src/retry.test.ts", expectedCount: 0, public: true },
+    { id: "fake-timer", title: "Advance controlled time and restore real timers", outcome: "no-match", files: [{ path: "src/retry.test.ts", source: "it('retries', async () => { vi.useFakeTimers(); try { const result = retry(); await vi.advanceTimersByTimeAsync(50); await result; } finally { vi.useRealTimers(); } });" }], focusPath: "src/retry.test.ts", expectedCount: 0, public: true },
     { id: "fixed-sleep", title: "Do not wait for wall-clock time", outcome: "match", files: [{ path: "src/retry.test.ts", source: "it('retries', async () => { await sleep(50); expect(done()).toBe(true); });" }], focusPath: "src/retry.test.ts", expectedCount: 1, public: true }
   ]
 };
@@ -8177,9 +8362,6 @@ var FUNCTION_TYPES5 = /* @__PURE__ */ new Set([
 function isNonzeroNumericLiteral(node) {
   return node?.type === import_utils44.AST_NODE_TYPES.Literal && typeof node.value === "number" && node.value !== 0;
 }
-function isTimedSetTimeout(node) {
-  return node.type === import_utils44.AST_NODE_TYPES.CallExpression && node.callee.type === import_utils44.AST_NODE_TYPES.Identifier && node.callee.name === "setTimeout" && node.arguments.length >= 2 && isNonzeroNumericLiteral(node.arguments[1]);
-}
 function isPromiseSleep(node) {
   if (node.callee.type !== import_utils44.AST_NODE_TYPES.Identifier || node.callee.name !== "Promise") {
     return false;
@@ -8189,12 +8371,14 @@ function isPromiseSleep(node) {
     return false;
   }
   const body2 = executor.body;
-  if (body2.type !== import_utils44.AST_NODE_TYPES.BlockStatement) {
-    return isTimedSetTimeout(body2);
-  }
-  return body2.body.some(
-    (stmt) => stmt.type === import_utils44.AST_NODE_TYPES.ExpressionStatement && isTimedSetTimeout(stmt.expression)
-  );
+  const resolve2 = executor.params[0];
+  if (executor.params.length !== 1 || resolve2?.type !== import_utils44.AST_NODE_TYPES.Identifier || resolve2.name === "setTimeout") return false;
+  const statement = body2.type === import_utils44.AST_NODE_TYPES.BlockStatement && body2.body.length === 1 ? body2.body[0] : null;
+  const timer = body2.type !== import_utils44.AST_NODE_TYPES.BlockStatement ? body2 : statement?.type === import_utils44.AST_NODE_TYPES.ExpressionStatement ? statement.expression : null;
+  return timer?.type === import_utils44.AST_NODE_TYPES.CallExpression && isTimedSetTimeout(timer) && timer.arguments[0]?.type === import_utils44.AST_NODE_TYPES.Identifier && timer.arguments[0].name === resolve2.name;
+}
+function isTimedSetTimeout(node) {
+  return node.type === import_utils44.AST_NODE_TYPES.CallExpression && node.callee.type === import_utils44.AST_NODE_TYPES.Identifier && node.callee.name === "setTimeout" && node.arguments.length >= 2 && isNonzeroNumericLiteral(node.arguments[1]);
 }
 function isHelperSleep(node) {
   return node.callee.type === import_utils44.AST_NODE_TYPES.Identifier && SLEEP_HELPERS.has(node.callee.name) && node.arguments.length >= 1 && isNonzeroNumericLiteral(node.arguments[0]);
@@ -8248,11 +8432,11 @@ var no_sleep_in_test_body_default = createRule({
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow a fixed timed sleep directly in a test body; it flakes under CI load. Synchronize on the signal or use fake timers."
+      description: "Avoid fixed timed sleeps directly in test bodies; synchronize on observable behavior or use controlled timers."
     },
     schema: [],
     messages: {
-      noSleepInTestBody: "A fixed sleep in a test body asserts on wall-clock time and flakes under CI load. Await the promise the code returns, or drive time with `vi.useFakeTimers()` + `await vi.advanceTimersByTimeAsync(ms)`."
+      noSleepInTestBody: "A fixed sleep depends on wall-clock timing and can be flaky under load. Await observable completion or use controlled fake timers, restoring real timers afterward."
     }
   },
   defaultOptions: [],
@@ -8273,11 +8457,17 @@ var no_sleep_in_test_body_default = createRule({
     return {
       NewExpression(node) {
         if (isPromiseSleep(node)) {
+          const constructor = import_utils44.ASTUtils.findVariable(context.sourceCode.getScope(node), "Promise");
+          const timer = import_utils44.ASTUtils.findVariable(context.sourceCode.getScope(node), "setTimeout");
+          if ((constructor?.defs.length ?? 0) > 0 || (timer?.defs.length ?? 0) > 0) return;
           report2(node);
         }
       },
       CallExpression(node) {
         if (isHelperSleep(node)) {
+          if (node.callee.type !== import_utils44.AST_NODE_TYPES.Identifier) return;
+          const variable = import_utils44.ASTUtils.findVariable(context.sourceCode.getScope(node), node.callee.name);
+          if (variable?.defs.some((definition) => definition.type !== "ImportBinding")) return;
           report2(node);
         }
       }
@@ -8298,7 +8488,7 @@ var NO_STORAGE_IN_STATELESS_MODULES_DOCUMENTATION = {
   rationale: "Private storage in a stateless workflow creates another source of truth that can silently diverge.",
   remediation: "Read from the system of record or derive state from an artifact the workflow already produces.",
   category: "architecture",
-  limitations: ["The rule is disabled until module path patterns are configured, recognizes only configured storage method names, and requires storage-like receiver evidence for the overloaded `put` method."],
+  limitations: ["This opt-in architectural policy requires configured module paths and storage method names. Overloaded `put` requires storage-like receiver evidence; `prepare` requires SQL-shaped literal text or a conventional database receiver for dynamic text. These syntax heuristics do not prove database provenance or identify the system of record."],
   examples: [
     { id: "system-of-record", title: "Read from the system of record", outcome: "no-match", files: [{ path: "src/engineer-digest/post.ts", source: "const issues = await linear.listIssues();" }], focusPath: "src/engineer-digest/post.ts", expectedCount: 0, public: true },
     { id: "private-storage", title: "Do not write private state in a stateless module", outcome: "match", files: [{ path: "src/engineer-digest/post.ts", source: "await kv.put('digest:last', timestamp);" }], focusPath: "src/engineer-digest/post.ts", expectedCount: 1, public: true }
@@ -8332,6 +8522,17 @@ function storageMethodName(node, methods) {
   if (name === "put" && !isStorageLikeReceiver(callee.object)) {
     return null;
   }
+  if (name === "prepare") {
+    const argument = node.arguments[0];
+    const text = argument === void 0 ? null : sqlTextOf(argument);
+    if (text !== null) {
+      if (!/^\s*(?:SELECT|WITH|INSERT|UPDATE|DELETE|REPLACE|CREATE|ALTER|DROP|PRAGMA|EXPLAIN)\b/iu.test(stripSqlNoise(text))) return null;
+    } else {
+      const receiver = callee.object;
+      const receiverName = receiver.type === import_utils45.AST_NODE_TYPES.Identifier ? receiver.name : receiver.type === import_utils45.AST_NODE_TYPES.MemberExpression && !receiver.computed && receiver.property.type === import_utils45.AST_NODE_TYPES.Identifier ? receiver.property.name : "";
+      if (!/^(?:db|database|connection)$/iu.test(receiverName)) return null;
+    }
+  }
   return name;
 }
 function isStorageLikeReceiver(node) {
@@ -8671,12 +8872,12 @@ var no_string_concat_in_loop_default = createRule({
 // src/rules/no-tautological-expect.ts
 var import_utils47 = require("@typescript-eslint/utils");
 var NO_TAUTOLOGICAL_EXPECT_DOCUMENTATION = {
-  summary: "Disallow an assertion whose operands are all literals; its outcome is fixed before the code runs, so it can never fail.",
+  summary: "Disallow supported literal-only assertions that are statically known to pass.",
   rationale: "An assertion determined entirely by literals does not observe the code under test and can keep passing after that code is removed.",
   remediation: "Assert on a value produced by the behavior under test, or remove the assertion.",
   category: "testing",
   limitations: [
-    "Only direct supported `expect` matcher calls in recognized test files are inspected."
+    "Only direct supported `expect` matcher calls in recognized test files are inspected. Local expect bindings, regular expressions, and unsupported coercions are excluded; failing constant assertions are not tautologies."
   ],
   examples: [
     {
@@ -8713,11 +8914,11 @@ var NUMERIC_SIGNS = /* @__PURE__ */ new Set(["-", "+"]);
 function isLiteral(node) {
   switch (node.type) {
     case import_utils47.AST_NODE_TYPES.Literal:
-      return true;
+      return !("regex" in node);
     case import_utils47.AST_NODE_TYPES.TemplateLiteral:
       return node.expressions.length === 0;
     case import_utils47.AST_NODE_TYPES.UnaryExpression:
-      return NUMERIC_SIGNS.has(node.operator) && isLiteral(node.argument);
+      return NUMERIC_SIGNS.has(node.operator) && node.argument.type === import_utils47.AST_NODE_TYPES.Literal && typeof node.argument.value === "number";
     case import_utils47.AST_NODE_TYPES.ArrayExpression:
       return node.elements.every((element) => element !== null && isLiteral(element));
     case import_utils47.AST_NODE_TYPES.ObjectExpression:
@@ -8731,6 +8932,43 @@ function isLiteral(node) {
 function isStructuralLiteral(node) {
   return node.type === import_utils47.AST_NODE_TYPES.ArrayExpression || node.type === import_utils47.AST_NODE_TYPES.ObjectExpression;
 }
+function passesZeroArgumentMatcher(node, matcher) {
+  let value;
+  switch (node.type) {
+    case import_utils47.AST_NODE_TYPES.Literal:
+      value = node.value;
+      break;
+    case import_utils47.AST_NODE_TYPES.TemplateLiteral:
+      value = node.quasis[0]?.value.cooked;
+      break;
+    case import_utils47.AST_NODE_TYPES.UnaryExpression:
+      if (node.argument.type !== import_utils47.AST_NODE_TYPES.Literal || typeof node.argument.value !== "number") return false;
+      value = node.operator === "-" ? -node.argument.value : node.argument.value;
+      break;
+    case import_utils47.AST_NODE_TYPES.ArrayExpression:
+    case import_utils47.AST_NODE_TYPES.ObjectExpression:
+      value = {};
+      break;
+    default:
+      return false;
+  }
+  switch (matcher) {
+    case "toBeDefined":
+      return value !== void 0;
+    case "toBeUndefined":
+      return value === void 0;
+    case "toBeNull":
+      return value === null;
+    case "toBeTruthy":
+      return Boolean(value);
+    case "toBeFalsy":
+      return !value;
+    case "toBeNaN":
+      return typeof value === "number" && Number.isNaN(value);
+    default:
+      return false;
+  }
+}
 function expectOperand(callee) {
   const receiver = callee.object;
   if (receiver.type !== import_utils47.AST_NODE_TYPES.CallExpression || receiver.callee.type !== import_utils47.AST_NODE_TYPES.Identifier || receiver.callee.name !== "expect" || receiver.arguments.length !== 1) {
@@ -8744,12 +8982,12 @@ var no_tautological_expect_default = createRule({
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow an assertion whose operands are all literals; its outcome is fixed before the code runs, so it can never fail."
+      description: "Disallow supported literal-only assertions that are statically known to pass."
     },
     schema: [],
     messages: {
-      tautologicalComparison: "`expect({{operand}}).{{matcher}}({{operand}})` compares a literal with an identical literal \u2014 it passes even if the code under test is deleted. Assert on a value the code produced, or delete the test.",
-      tautologicalMatcher: "`expect({{operand}}).{{matcher}}()` asserts on a literal, so its outcome is fixed before the code runs. Assert on a value the code produced, or delete the test."
+      tautologicalComparison: "`expect({{operand}}).{{matcher}}({{operand}})` compares an identical literal and does not observe behavior. Assert on a produced value or remove only the redundant assertion, preserving other coverage.",
+      tautologicalMatcher: "`expect({{operand}}).{{matcher}}()` is statically known to pass. Assert on a produced value or remove only the redundant assertion, preserving other coverage."
     }
   },
   defaultOptions: [],
@@ -8771,11 +9009,20 @@ var no_tautological_expect_default = createRule({
           return;
         }
         const matcher = callee.property.name;
+        if (callee.object.type !== import_utils47.AST_NODE_TYPES.CallExpression || callee.object.callee.type !== import_utils47.AST_NODE_TYPES.Identifier) return;
+        const expectIdentifier = callee.object.callee;
+        const variable = import_utils47.ASTUtils.findVariable(context.sourceCode.getScope(expectIdentifier), expectIdentifier.name);
+        if (variable !== null && variable.defs.some((definition) => {
+          if (definition.node.type !== import_utils47.AST_NODE_TYPES.ImportSpecifier) return true;
+          const declaration = definition.node.parent;
+          const imported = definition.node.imported;
+          return declaration.type !== import_utils47.AST_NODE_TYPES.ImportDeclaration || !["vitest", "@jest/globals", "@playwright/test", "bun:test"].includes(String(declaration.source.value)) || (imported.type === import_utils47.AST_NODE_TYPES.Identifier ? imported.name : imported.value) !== "expect";
+        })) return;
         const operand = expectOperand(callee);
         if (operand === null || !isLiteral(operand)) {
           return;
         }
-        if (ZERO_ARG_MATCHERS.has(matcher) && node.arguments.length === 0) {
+        if (ZERO_ARG_MATCHERS.has(matcher) && node.arguments.length === 0 && passesZeroArgumentMatcher(operand, matcher)) {
           context.report({
             node,
             messageId: "tautologicalMatcher",
@@ -10027,15 +10274,16 @@ var MOCK_MODULES = /* @__PURE__ */ new Set([
 var NO_UNSAFE_MOCK_CASTING_DOCUMENTATION = {
   summary: "Disallow casting to mock types like `jest.Mock` or `vi.Mock`. Use `vi.mocked()` or `jest.mocked()` instead.",
   rationale: "A type assertion can claim an unmocked value is a mock and bypass checking between the original callable and the mock API.",
-  remediation: "Use the test framework's `mocked` helper to obtain the typed mock reference.",
+  remediation: "Create the mock or spy first, then use the framework's mocked helper to preserve the original value's type. The helper does not create or verify a runtime mock.",
   category: "testing",
-  limitations: ["Only mock types imported from Vitest or Jest modules are inspected."],
+  limitations: ["Only mock types imported from Vitest or Jest modules are inspected. mocked is a type helper, not runtime validation or a replacement for mock setup."],
+  references: ["https://vitest.dev/api/vi.html#vi-mocked"],
   examples: [
     {
       id: "typed-mock-helper",
       title: "Use the framework helper",
       outcome: "no-match",
-      files: [{ path: "src/client.test.ts", source: "const m = vi.mocked(myFn);" }],
+      files: [{ path: "src/client.test.ts", source: "import { vi } from 'vitest'; const client = { read: () => 'value' }; vi.spyOn(client, 'read'); const m = vi.mocked(client.read);" }],
       focusPath: "src/client.test.ts",
       expectedCount: 0,
       public: true
@@ -10061,7 +10309,7 @@ var no_unsafe_mock_casting_default = createRule({
     },
     schema: [],
     messages: {
-      unsafeMockCast: "Do not cast to a Mock type. Use `vi.mocked(fn)` or `jest.mocked(fn)` instead to preserve type safety."
+      unsafeMockCast: "Avoid a broad Mock cast. After creating the mock or spy, use `vi.mocked(fn)` or `jest.mocked(fn)` to retain its original type; the helper does not create a runtime mock."
     }
   },
   defaultOptions: [],
@@ -10123,7 +10371,7 @@ var import_utils55 = require("@typescript-eslint/utils");
 var ts2 = __toESM(require("typescript"), 1);
 var NO_ZOD_NATIVE_ENUM_DOCUMENTATION = {
   summary: 'Disallow `z.nativeEnum()` (and `z.enum()` over a TypeScript enum); use `z.enum(["a", "b"])` with a string-literal union instead.',
-  rationale: "Wrapping a TypeScript enum preserves its emitted runtime object and duplicates the schema's value definition across two constructs.",
+  rationale: "The project prefers literal-first schema definitions. nativeEnum also accepts plain enum-like objects, so this is an explicit declaration policy, not proof that every call duplicates a TypeScript enum's runtime object.",
   remediation: "Pass string literals directly to `z.enum` and derive the TypeScript type with `z.infer`.",
   category: "maintainability",
   autofix: "none",
@@ -10301,7 +10549,7 @@ var TEST_LOOPS_OVER_LITERAL_CASES_DOCUMENTATION = {
   remediation: "Create one named parameterized test or runner-aware subtest for each literal case.",
   category: "testing",
   filePatterns: ["**/*.test.*", "**/*.spec.*", "**/tests/**"],
-  limitations: ["Only inline literal for-of cases containing framework assertions are reported."],
+  limitations: ["Only inline literal for-of cases containing framework assertions are reported. References to setup or parameters owned by the enclosing test, and loops followed by statements in the same or enclosing block, are excluded because they can belong to an ordered scenario. External helper purity is not inferred."],
   examples: [
     { id: "parameterized-cases", title: "Use a parameterized test", outcome: "no-match", files: [{ path: "src/parser.test.ts", source: "test.each(['a', 'b'])('parses %s', (value) => { expect(parse(value)).toBe(value); });" }], focusPath: "src/parser.test.ts", expectedCount: 0, public: true },
     { id: "looped-cases", title: "Do not hide cases in a loop", outcome: "match", files: [{ path: "src/parser.test.ts", source: "test('parses', () => { for (const value of ['a', 'b']) { expect(parse(value)).toBe(value); } });" }], focusPath: "src/parser.test.ts", expectedCount: 1, public: true }
@@ -10448,7 +10696,7 @@ var test_loops_over_literal_cases_default = createRule({
     },
     schema: [],
     messages: {
-      literalCaseLoop: "This loop asserts over {{count}} inline cases, but the runner sees one test and stops at the first failure. Create one named test or subtest per case; use `test.each(...)` or `it.each(...)` where supported."
+      literalCaseLoop: "This loop asserts over {{count}} inline cases in one test; a thrown assertion may prevent later cases from running. Create one named test or subtest per independent case; use `test.each(...)` or `it.each(...)` where supported."
     }
   },
   defaultOptions: [],
@@ -10473,6 +10721,9 @@ var test_loops_over_literal_cases_default = createRule({
         if (enclosing === null || !isTestBody2(enclosing, isFrameworkTest)) {
           return;
         }
+        for (let current = node; current !== void 0 && current !== enclosing; current = current.parent) {
+          if (current.parent?.type === import_utils56.AST_NODE_TYPES.BlockStatement && current.parent.body.at(-1) !== current) return;
+        }
         const cases = unwrapExpression(node.right);
         const callbackParameters = new Set(
           enclosing.params.flatMap((parameter) => parameter.type === import_utils56.AST_NODE_TYPES.Identifier ? [parameter.name] : [])
@@ -10482,6 +10733,16 @@ var test_loops_over_literal_cases_default = createRule({
         ) || !walkOwnScope2(node.body, (current) => isAssertion2(current, isFrameworkAssertion)) || walkOwnScope2(node.body, (current) => opensSubtest(current, callbackParameters)) || walkOwnScope2(node.body, (current) => LOOP_CARRIED_CONTROL.has(current.type))) {
           return;
         }
+        const capturesSetup = walkOwnScope2(node.body, (current) => {
+          if (current.type !== import_utils56.AST_NODE_TYPES.Identifier) return false;
+          const variable = import_utils56.ASTUtils.findVariable(context.sourceCode.getScope(current), current.name);
+          if (variable === null || !variable.references.some((reference) => reference.identifier === current)) return false;
+          return variable.defs.some((definition) => {
+            const declaration = definition.name;
+            return declaration.range[0] >= enclosing.range[0] && declaration.range[1] <= enclosing.range[1] && (declaration.range[0] < node.range[0] || declaration.range[1] > node.range[1]);
+          });
+        });
+        if (capturesSetup) return;
         context.report({
           node,
           messageId: "literalCaseLoop",
@@ -11102,7 +11363,7 @@ var PREFER_MILLISECOND_CONTROL_DURATION_SCHEMA_DOCUMENTATION = {
   category: "correctness",
   autofix: "none",
   limitations: [
-    "Only direct identifier keys in application-owned z.object/z.strictObject schemas are checked.",
+    "Only direct identifier keys with recognizable numeric Zod leaves in application-owned z.object/z.strictObject schemas are checked; aliases and transformations are not inferred.",
     "The rule covers control timings such as timeout, delay, interval, backoff, TTL, lease, heartbeat, debounce, and throttle; observed durations and business-domain periods are excluded.",
     "Quoted/computed protocol keys, generated/vendor code, tests, fixtures, and non-Zod schemas are excluded."
   ],
@@ -11114,7 +11375,7 @@ var PREFER_MILLISECOND_CONTROL_DURATION_SCHEMA_DOCUMENTATION = {
       files: [
         {
           path: "src/request.ts",
-          source: "import { z } from 'zod';\nexport const RequestSchema = z.object({ timeoutMs: z.number().int().min(1) });"
+          source: "import { z } from 'zod';\nexport const RequestSchema = z.object({ timeoutMs: z.number().int().min(1000).max(300000).default(30000) });"
         }
       ],
       focusPath: "src/request.ts",
@@ -11128,7 +11389,7 @@ var PREFER_MILLISECOND_CONTROL_DURATION_SCHEMA_DOCUMENTATION = {
       files: [
         {
           path: "src/request.ts",
-          source: "import { z } from 'zod';\nexport const RequestSchema = z.object({ timeout_seconds: z.number().int().min(1) });"
+          source: "import { z } from 'zod';\nexport const RequestSchema = z.object({ timeout_seconds: z.number().int().min(1).max(300).default(30) });"
         }
       ],
       focusPath: "src/request.ts",
@@ -11160,6 +11421,7 @@ var prefer_millisecond_control_duration_schema_default = createRule({
     }
     const zodNamespaces = /* @__PURE__ */ new Set();
     const objectFactories = /* @__PURE__ */ new Set();
+    const numberFactories = /* @__PURE__ */ new Set();
     function binding(identifier) {
       return import_utils63.ASTUtils.findVariable(context.sourceCode.getScope(identifier), identifier.name);
     }
@@ -11179,10 +11441,27 @@ var prefer_millisecond_control_duration_schema_default = createRule({
       const variable = binding(callee.object);
       return variable !== null && zodNamespaces.has(variable);
     }
+    function isNumericSchema(node) {
+      if (node.type !== import_utils63.AST_NODE_TYPES.CallExpression) return false;
+      const callee = node.callee;
+      if (callee.type === import_utils63.AST_NODE_TYPES.Identifier) {
+        const variable = binding(callee);
+        return variable !== null && numberFactories.has(variable);
+      }
+      if (callee.type !== import_utils63.AST_NODE_TYPES.MemberExpression || callee.computed || callee.property.type !== import_utils63.AST_NODE_TYPES.Identifier) return false;
+      if (callee.object.type === import_utils63.AST_NODE_TYPES.Identifier) {
+        const variable = binding(callee.object);
+        return callee.property.name === "number" && variable !== null && zodNamespaces.has(variable);
+      }
+      return ["int", "min", "max", "positive", "nonnegative", "finite", "multipleOf", "optional", "nullable", "nullish", "default", "describe", "brand", "readonly"].includes(callee.property.name) && isNumericSchema(callee.object);
+    }
     return {
       ImportDeclaration(node) {
         if (!isZodModule(node.source.value)) return;
         for (const specifier of node.specifiers) {
+          if (specifier.type === import_utils63.AST_NODE_TYPES.ImportSpecifier && specifier.imported.type === import_utils63.AST_NODE_TYPES.Identifier && specifier.imported.name === "number") {
+            record(numberFactories, specifier.local);
+          }
           if (specifier.type === import_utils63.AST_NODE_TYPES.ImportNamespaceSpecifier || specifier.type === import_utils63.AST_NODE_TYPES.ImportDefaultSpecifier || specifier.type === import_utils63.AST_NODE_TYPES.ImportSpecifier && specifier.imported.type === import_utils63.AST_NODE_TYPES.Identifier && specifier.imported.name === "z") {
             record(zodNamespaces, specifier.local);
           } else if (specifier.type === import_utils63.AST_NODE_TYPES.ImportSpecifier && specifier.imported.type === import_utils63.AST_NODE_TYPES.Identifier && (specifier.imported.name === "object" || specifier.imported.name === "strictObject")) {
@@ -11195,7 +11474,7 @@ var prefer_millisecond_control_duration_schema_default = createRule({
         const shape = node.arguments[0];
         if (shape?.type !== import_utils63.AST_NODE_TYPES.ObjectExpression) return;
         for (const member of shape.properties) {
-          if (member.type !== import_utils63.AST_NODE_TYPES.Property) continue;
+          if (member.type !== import_utils63.AST_NODE_TYPES.Property || !isNumericSchema(member.value)) continue;
           const key = directIdentifierKey(member);
           if (key === null || !CONTROL_SECONDS_RE.test(key.name) && !CONTROL_SECONDS_CAMEL_RE.test(key.name)) {
             continue;
@@ -11215,7 +11494,7 @@ var PREFER_IMMUTABLE_MODULE_CONSTANT_DOCUMENTATION = {
   remediation: "Expose literals with `as const` or a readonly type, and expose Set or Map values through ReadonlySet or ReadonlyMap.",
   category: "correctness",
   limitations: [
-    "The rule skips generated files, test files, JavaScript files, and collections that are deliberately mutated in their declaring module."
+    "Generated, test and JavaScript files are skipped. Private constants with observed direct or alias mutation are excluded; exported mutable collections remain advisory candidates. Reassigned aliases are conservatively followed, not flow-proven."
   ],
   examples: [
     {
@@ -11369,7 +11648,7 @@ var prefer_immutable_module_constant_default = createRule({
     }
     const exportedNames2 = /* @__PURE__ */ new Set();
     const typeAliases2 = /* @__PURE__ */ new Map();
-    const mutatesThroughConstAlias = (root) => {
+    const mutatesThroughAlias = (root) => {
       const pending = [root];
       const seen = /* @__PURE__ */ new Set();
       while (pending.length > 0) {
@@ -11381,7 +11660,7 @@ var prefer_immutable_module_constant_default = createRule({
           if (identifier.type !== import_utils64.AST_NODE_TYPES.Identifier) continue;
           if (referenceMutates(identifier, isUnshadowedGlobal3)) return true;
           const declarator = identifier.parent;
-          if (declarator.type !== import_utils64.AST_NODE_TYPES.VariableDeclarator || declarator.init !== identifier || declarator.id.type !== import_utils64.AST_NODE_TYPES.Identifier || declarator.parent.type !== import_utils64.AST_NODE_TYPES.VariableDeclaration || declarator.parent.kind !== "const") {
+          if (declarator.type !== import_utils64.AST_NODE_TYPES.VariableDeclarator || declarator.init !== identifier || declarator.id.type !== import_utils64.AST_NODE_TYPES.Identifier || declarator.parent.type !== import_utils64.AST_NODE_TYPES.VariableDeclaration) {
             continue;
           }
           const alias = sourceCode.getDeclaredVariables(declarator)[0];
@@ -11430,7 +11709,7 @@ var prefer_immutable_module_constant_default = createRule({
           return;
         }
         const variable = sourceCode.getDeclaredVariables(node)[0];
-        if (!directlyExported && !exportedNames2.has(node.id.name) && variable !== void 0 && mutatesThroughConstAlias(variable)) {
+        if (!directlyExported && !exportedNames2.has(node.id.name) && variable !== void 0 && mutatesThroughAlias(variable)) {
           return;
         }
         context.report({
@@ -11857,7 +12136,7 @@ var PREFER_MODULE_LEVEL_CONSTANT_DOCUMENTATION = {
   rationale: "Recreating immutable lookup data on every call wastes allocations and obscures its constant nature.",
   remediation: "Declare immutable literal collections and non-stateful regular expressions once at module scope.",
   category: "performance",
-  limitations: ["Collections that are small, mutated, escape the function, or depend on local values are not reported."],
+  limitations: ["Small collections, observed direct or nested mutations, nested aliases, direct escapes, and dependencies on local values are excluded. Directly invoked function expressions are excluded rather than assuming they run repeatedly. Callback effects and indirect escapes are not analyzed interprocedurally; review those before hoisting."],
   examples: [
     { id: "hoisted-collection", title: "Hoist a constant collection", outcome: "no-match", files: [{ path: "src/keys.ts", source: "const KEYS = ['a', 'b', 'c'] as const; function isAllowed(key: string) { return KEYS.includes(key); }" }], focusPath: "src/keys.ts", expectedCount: 0, public: true },
     { id: "local-collection", title: "Do not recreate a constant collection", outcome: "match", files: [{ path: "src/keys.ts", source: "function isAllowed(key: string) { const KEYS = ['a', 'b', 'c']; return KEYS.includes(key); }" }], focusPath: "src/keys.ts", expectedCount: 1, public: true }
@@ -12012,12 +12291,16 @@ var NON_RETAINING_BUILTINS = /* @__PURE__ */ new Map(
   ]
 );
 function isSafeRead(identifier) {
-  const parent = identifier.parent;
+  let parent = identifier.parent;
   if (parent.type === import_utils66.AST_NODE_TYPES.MemberExpression) {
     if (parent.object !== identifier) {
       return true;
     }
+    while (parent.parent.type === import_utils66.AST_NODE_TYPES.MemberExpression && parent.parent.object === parent) {
+      parent = parent.parent;
+    }
     const grandparent = parent.parent;
+    if (grandparent.type === import_utils66.AST_NODE_TYPES.VariableDeclarator || grandparent.type === import_utils66.AST_NODE_TYPES.SpreadElement) return false;
     if (grandparent.type === import_utils66.AST_NODE_TYPES.AssignmentExpression && grandparent.left === parent) {
       return false;
     }
@@ -12027,7 +12310,7 @@ function isSafeRead(identifier) {
     if (grandparent.type === import_utils66.AST_NODE_TYPES.UnaryExpression && grandparent.operator === "delete") {
       return false;
     }
-    if (!parent.computed && parent.property.type === import_utils66.AST_NODE_TYPES.Identifier && MUTATING_METHODS2.has(parent.property.name) && grandparent.type === import_utils66.AST_NODE_TYPES.CallExpression && grandparent.callee === parent) {
+    if (grandparent.type === import_utils66.AST_NODE_TYPES.CallExpression && grandparent.callee === parent && (parent.computed ? parent.property.type !== import_utils66.AST_NODE_TYPES.Literal || typeof parent.property.value !== "string" || MUTATING_METHODS2.has(parent.property.value) : parent.property.type === import_utils66.AST_NODE_TYPES.Identifier && MUTATING_METHODS2.has(parent.property.name))) {
       return false;
     }
     return true;
@@ -12135,9 +12418,15 @@ var prefer_module_level_constant_default = createRule({
         if (node.id.type !== import_utils66.AST_NODE_TYPES.Identifier || node.init === null) {
           return;
         }
-        if (enclosingFunction3(node) === null) {
+        const owner = enclosingFunction3(node);
+        if (owner === null) {
           return;
         }
+        let expression = owner;
+        while (expression.parent !== void 0 && unwrap4(expression.parent) === expression) {
+          expression = expression.parent;
+        }
+        if (expression.parent?.type === import_utils66.AST_NODE_TYPES.CallExpression && expression.parent.callee === expression) return;
         const candidate2 = classify(node.init, checkRegex);
         if (candidate2 === null) {
           return;
@@ -12162,10 +12451,10 @@ var prefer_module_level_constant_default = createRule({
 var import_utils67 = require("@typescript-eslint/utils");
 var PREFER_MODULE_LEVEL_SCHEMA_DOCUMENTATION = {
   summary: "Declare a Zod schema at module scope when it closes over nothing in the enclosing function",
-  rationale: "A closed schema created inside a function is rebuilt on every call and cannot be reused or exported for inference.",
+  rationale: "A schema created inside a function is rebuilt on each call. Module scope can enable reuse across callers; local schemas already support local type inference.",
   remediation: "Move the closed schema declaration to module scope and reference it from the function.",
   category: "performance",
-  limitations: ["Schemas that depend on local state or are wrapped in a recognized memoization helper are excluded."],
+  limitations: ["Schemas that depend on local state or are wrapped in a recognized memoization helper are excluded.", "Eager calls outside the recognized Zod construction chain and new expressions are excluded. This is manual guidance, not a purity proof: review getters, callback effects, schema identity, error customization, and module initialization order before moving construction."],
   examples: [
     { id: "module-schema", title: "Declare the schema once", outcome: "no-match", files: [{ path: "src/handler.ts", source: "import { z } from 'zod'; const ZBody = z.object({ id: z.string(), name: z.string() }); export function handle(raw: unknown) { return ZBody.parse(raw); }" }], focusPath: "src/handler.ts", expectedCount: 0, public: true },
     { id: "local-schema", title: "Do not rebuild a closed schema", outcome: "match", files: [{ path: "src/handler.ts", source: "import { z } from 'zod'; export function handle(raw: unknown) { const ZBody = z.object({ id: z.string(), name: z.string() }); return ZBody.parse(raw); }" }], focusPath: "src/handler.ts", expectedCount: 1, public: true }
@@ -12182,6 +12471,36 @@ var DEFAULT_FACTORIES = [
   "union"
 ];
 var DEFAULT_MIN_PROPERTIES = 2;
+var CONSTRUCTION_FACTORIES = /* @__PURE__ */ new Set([
+  ...DEFAULT_FACTORIES,
+  "any",
+  "array",
+  "bigint",
+  "boolean",
+  "custom",
+  "date",
+  "enum",
+  "instanceof",
+  "lazy",
+  "literal",
+  "map",
+  "nan",
+  "nativeEnum",
+  "never",
+  "null",
+  "nullable",
+  "nullish",
+  "number",
+  "optional",
+  "preprocess",
+  "promise",
+  "set",
+  "string",
+  "symbol",
+  "undefined",
+  "unknown",
+  "void"
+]);
 var MEMO_CALLEES = /* @__PURE__ */ new Set([
   "lazy",
   "memo",
@@ -12258,7 +12577,7 @@ function outermostEnclosingFunction(node) {
   }
   return outermost;
 }
-function subtreeSome(root, predicate) {
+function subtreeSome(root, predicate, skipDeferredFunctions = false) {
   let found = false;
   const visit = (value) => {
     if (found || value === null || typeof value !== "object") {
@@ -12274,6 +12593,7 @@ function subtreeSome(root, predicate) {
     if (typeof candidate2.type !== "string") {
       return;
     }
+    if (skipDeferredFunctions && FUNCTION_TYPES8.has(candidate2.type)) return;
     if (predicate(candidate2)) {
       found = true;
       return;
@@ -12372,6 +12692,15 @@ var prefer_module_level_schema_default = createRule({
     function isZodCall(node) {
       return node.type === import_utils67.AST_NODE_TYPES.CallExpression && node.callee.type === import_utils67.AST_NODE_TYPES.MemberExpression && !node.callee.computed && node.callee.object.type === import_utils67.AST_NODE_TYPES.Identifier && zodNamespaces.has(node.callee.object.name);
     }
+    function isSchemaConstruction(node) {
+      const callee = node.callee;
+      if (callee.type !== import_utils67.AST_NODE_TYPES.MemberExpression || callee.computed || callee.property.type !== import_utils67.AST_NODE_TYPES.Identifier || TERMINAL_METHODS.has(callee.property.name)) return false;
+      if (callee.object.type === import_utils67.AST_NODE_TYPES.CallExpression) return isSchemaConstruction(callee.object);
+      return isZodCall(node) && CONSTRUCTION_FACTORIES.has(callee.property.name);
+    }
+    function hasEagerComputation(node) {
+      return subtreeSome(node, (inner) => inner.type === import_utils67.AST_NODE_TYPES.NewExpression || inner.type === import_utils67.AST_NODE_TYPES.TaggedTemplateExpression || inner.type === import_utils67.AST_NODE_TYPES.CallExpression && !isSchemaConstruction(inner), true);
+    }
     function isCovered(node) {
       let current = node.parent ?? void 0;
       while (current !== void 0) {
@@ -12501,6 +12830,7 @@ var prefer_module_level_schema_default = createRule({
           return;
         }
         const outermost = outermostSchemaExpression(expression);
+        if (hasEagerComputation(outermost)) return;
         if (outermost !== expression && (readsReceiver(outermost) || buildsLocalizedText(outermost) || !closesOverNothing(outermost, enclosing))) {
           return;
         }
@@ -12638,7 +12968,8 @@ var PREFER_MODULE_LEVEL_REFINED_SCHEMA_DOCUMENTATION = {
   limitations: [
     "Composite object/record/tuple/union schemas are owned by prefer-module-level-schema.",
     "Schemas that depend on function-local or mutable state, localized text, receiver state, lazy construction, or recognized memoization are excluded.",
-    "Literal string z.enum domains are owned by prefer-shared-zod-enum."
+    "Literal string z.enum domains are owned by prefer-shared-zod-enum.",
+    "Eager calls outside recognized Zod construction chains and new expressions are excluded. This is manual guidance, not a purity proof: review getters, callback effects, error customization, schema identity, and module initialization order before moving construction."
   ],
   examples: [
     {
@@ -12680,7 +13011,7 @@ function collectReferences2(scope, output) {
   output.push(...scope.references);
   for (const child of scope.childScopes) collectReferences2(child, output);
 }
-function subtreeSome2(root, predicate) {
+function subtreeSome2(root, predicate, skipDeferredFunctions = false) {
   let found = false;
   const visit = (value) => {
     if (found || value === null || typeof value !== "object") return;
@@ -12690,6 +13021,7 @@ function subtreeSome2(root, predicate) {
     }
     const candidate2 = value;
     if (typeof candidate2.type !== "string") return;
+    if (skipDeferredFunctions && FUNCTION_TYPES9.has(candidate2.type)) return;
     if (predicate(candidate2)) {
       found = true;
       return;
@@ -12810,6 +13142,15 @@ var prefer_module_level_refined_schema_default = createRule({
         return names[1] ?? null;
       return null;
     }
+    function isSchemaConstruction(node) {
+      const callee = node.callee;
+      if (callee.type !== import_utils68.AST_NODE_TYPES.MemberExpression || callee.computed || callee.property.type !== import_utils68.AST_NODE_TYPES.Identifier || NON_SCHEMA_TERMINALS.has(callee.property.name)) return false;
+      if (callee.object.type === import_utils68.AST_NODE_TYPES.CallExpression) return isSchemaConstruction(callee.object);
+      return factoryName(node, FACTORIES) !== null || factoryName(node, COMPOSITE_FACTORIES) !== null;
+    }
+    function hasEagerComputation(node) {
+      return subtreeSome2(node, (inner) => inner.type === import_utils68.AST_NODE_TYPES.NewExpression || inner.type === import_utils68.AST_NODE_TYPES.TaggedTemplateExpression || inner.type === import_utils68.AST_NODE_TYPES.CallExpression && !isSchemaConstruction(inner), true);
+    }
     function isSharedEnumDomain(node, factory) {
       if (factory !== "enum") return false;
       const [argument] = node.arguments;
@@ -12878,7 +13219,7 @@ var prefer_module_level_refined_schema_default = createRule({
         const enclosing = outermostEnclosingFunction2(node);
         if (enclosing === void 0) return;
         const expression = schemaExpression2(node);
-        if (readsReceiver2(expression) || buildsLocalizedText2(expression) || !closesOverNothing(expression, enclosing))
+        if (hasEagerComputation(expression) || readsReceiver2(expression) || buildsLocalizedText2(expression) || !closesOverNothing(expression, enclosing))
           return;
         context.report({ node, messageId: "hoistRefinedSchema" });
       }
@@ -12906,7 +13247,7 @@ var PREFER_MULTI_VALUE_ZOD_LITERAL_DOCUMENTATION = {
       outcome: "no-match",
       files: [{
         path: "src/schema.ts",
-        source: "import { z } from 'zod'; export const Version = z.literal([1, 2, 3]);"
+        source: "import { z } from 'zod/v4'; export const Version = z.literal([1, 2, 3]);"
       }],
       focusPath: "src/schema.ts",
       expectedCount: 0,
@@ -12918,7 +13259,7 @@ var PREFER_MULTI_VALUE_ZOD_LITERAL_DOCUMENTATION = {
       outcome: "match",
       files: [{
         path: "src/schema.ts",
-        source: "import { z } from 'zod'; export const Version = z.union([z.literal(1), z.literal(2), z.literal(3)]);"
+        source: "import { z } from 'zod/v4'; export const Version = z.union([z.literal(1), z.literal(2), z.literal(3)]);"
       }],
       focusPath: "src/schema.ts",
       expectedCount: 1,
@@ -13077,11 +13418,11 @@ var import_utils71 = require("@typescript-eslint/utils");
 var PREFER_NAMED_COMPLEX_RETURN_TYPE_DOCUMENTATION = {
   summary: "Prefer a named contract for structurally complex function return types.",
   rationale: "A large inline return annotation hides a reusable domain concept and makes signatures difficult to scan.",
-  remediation: "Extract the return annotation to a named type or interface and reference that contract from the signature.",
+  remediation: "Name the complex nested shape while preserving its generic wrappers and type parameters; reference the named contract from the return annotation.",
   category: "maintainability",
   limitations: [
     "Only explicit object types with at least three members and unions with at least three object variants are reported.",
-    "Generic wrappers such as Promise and Readonly are unwrapped one level at a time; inferred return types are outside this rule."
+    "Any single-argument generic wrapper is traversed to find nested shapes, not assumed semantically transparent. Inferred return types are outside this rule; extraction is manual and must preserve locally bound type parameters."
   ],
   examples: [
     { id: "named-result", title: "Name a multi-state result", outcome: "no-match", files: [{ path: "src/queue.ts", source: "type ClaimResult = { state: 'idle' } | { state: 'waiting'; retryAt: number } | { state: 'claimed'; id: string }; export function claim(): ClaimResult { return { state: 'idle' }; }" }], focusPath: "src/queue.ts", expectedCount: 0, public: true },
@@ -13237,12 +13578,14 @@ var import_utils73 = require("@typescript-eslint/utils");
 var PREFER_NODE_CRYPTO_HASH_DOCUMENTATION = {
   summary: "Prefer the modern one-shot node:crypto hash API when streaming state is unnecessary.",
   rationale: "A createHash-update-digest chain allocates mutable streaming state for a single in-memory value; Node's built-in hash function expresses the one-shot operation directly and can use its optimized fast path.",
-  remediation: "Import hash from node:crypto and replace a single-update chain with hash(algorithm, value, encoding). Keep createHash for streams or multiple incremental updates.",
+  remediation: "On a supported Node runtime, consider hash(algorithm, value, encoding). Preserve the output encoding explicitly: digest() returns a Buffer, while hash defaults to hex. Keep createHash for streams or multiple updates.",
   category: "performance",
   limitations: [
     "Only bindings and inline calls with statically proven provenance from crypto or node:crypto are analyzed; arbitrary assignments and dynamic module specifiers are excluded.",
-    "Only a literal algorithm with exactly one update call is reported; streaming and incremental hashes remain valid."
+    "Only a literal algorithm with exactly one update call is reported; streaming and incremental hashes remain valid.",
+    "Runtime support and output encoding require manual review; no autofix or guaranteed speedup is promised."
   ],
+  references: ["https://nodejs.org/api/crypto.html#cryptohashalgorithm-data-options"],
   examples: [
     { id: "one-shot-hash", title: "Use Node's one-shot hash API", outcome: "no-match", files: [{ path: "case.ts", source: "import { hash } from 'node:crypto'; export const digest = hash('sha256', 'value', 'hex');" }], focusPath: "case.ts", expectedCount: 0, public: true },
     { id: "mutable-one-shot-chain", title: "Avoid mutable state for one value", outcome: "match", files: [{ path: "case.ts", source: "import { createHash } from 'node:crypto'; export const digest = createHash('sha256').update('value').digest('hex');" }], focusPath: "case.ts", expectedCount: 1, public: true }
@@ -13371,6 +13714,7 @@ var PREFER_NODE_FS_PROMISES_DOCUMENTATION = {
   category: "performance",
   limitations: [
     "Tests and generated files are excluded.",
+    "This recommendation applies to Node-compatible runtimes. Changing a synchronous API to a promise changes its caller contract; review startup-only work and APIs that require synchronous execution rather than mechanically adding await.",
     "ESLint rule implementations under src/rules are excluded because visitor creation and execution are synchronous by contract.",
     "Only statically identifiable node:fs loads are inspected; filesystem objects passed through arbitrary functions or assignments require type-aware analysis."
   ],
@@ -13389,14 +13733,14 @@ function memberName5(node) {
 function unwrapAwait2(node) {
   return node.type === import_utils74.AST_NODE_TYPES.AwaitExpression ? node.argument : node;
 }
-function isFsLoader(node) {
+function isFsLoader(node, isGlobal) {
   const expression = unwrapAwait2(node);
   if (expression.type === import_utils74.AST_NODE_TYPES.ImportExpression) return isFsSpecifier(expression.source);
   if (expression.type !== import_utils74.AST_NODE_TYPES.CallExpression || expression.arguments.length !== 1) return false;
   const [argument] = expression.arguments;
   if (argument === void 0 || argument.type === import_utils74.AST_NODE_TYPES.SpreadElement || !isFsSpecifier(argument)) return false;
-  if (expression.callee.type === import_utils74.AST_NODE_TYPES.Identifier) return expression.callee.name === "require";
-  return expression.callee.type === import_utils74.AST_NODE_TYPES.MemberExpression && expression.callee.object.type === import_utils74.AST_NODE_TYPES.Identifier && expression.callee.object.name === "process" && memberName5(expression.callee) === "getBuiltinModule";
+  if (expression.callee.type === import_utils74.AST_NODE_TYPES.Identifier) return expression.callee.name === "require" && isGlobal(expression.callee);
+  return expression.callee.type === import_utils74.AST_NODE_TYPES.MemberExpression && expression.callee.object.type === import_utils74.AST_NODE_TYPES.Identifier && expression.callee.object.name === "process" && isGlobal(expression.callee.object) && memberName5(expression.callee) === "getBuiltinModule";
 }
 function isFsSpecifier(node) {
   return node.type === import_utils74.AST_NODE_TYPES.Literal && (node.value === "node:fs" || node.value === "fs");
@@ -13423,13 +13767,26 @@ var prefer_node_fs_promises_default = createRule({
     if (isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text) || normalizedFilename.includes("src/rules/"))
       return {};
     const namespaces = /* @__PURE__ */ new Set();
+    const bindingOf = (node) => import_utils74.ASTUtils.findVariable(context.sourceCode.getScope(node), node.name);
+    const isGlobal = (node) => {
+      const binding = bindingOf(node);
+      return binding === null || binding.defs.length === 0;
+    };
+    const isNamespace = (node) => {
+      const binding = bindingOf(node);
+      return binding !== null && namespaces.has(binding) && !binding.references.some((reference) => reference.isWrite() && reference.init !== true);
+    };
+    const recordNamespace = (node) => {
+      const binding = bindingOf(node);
+      if (binding !== null) namespaces.add(binding);
+    };
     return {
       ImportDeclaration(node) {
         if (node.source.value !== "node:fs" && node.source.value !== "fs") return;
         const synchronousImports = [];
         for (const specifier of node.specifiers) {
           if (specifier.type === import_utils74.AST_NODE_TYPES.ImportNamespaceSpecifier || specifier.type === import_utils74.AST_NODE_TYPES.ImportDefaultSpecifier) {
-            namespaces.add(specifier.local.name);
+            recordNamespace(specifier.local);
             continue;
           }
           if (specifier.type === import_utils74.AST_NODE_TYPES.ImportSpecifier && specifier.imported.type === import_utils74.AST_NODE_TYPES.Identifier && specifier.imported.name.endsWith("Sync")) synchronousImports.push(specifier.imported.name);
@@ -13443,10 +13800,10 @@ var prefer_node_fs_promises_default = createRule({
         }
       },
       VariableDeclarator(node) {
-        if (node.init === null || !isFsLoader(node.init) && (node.init.type !== import_utils74.AST_NODE_TYPES.Identifier || !namespaces.has(node.init.name)))
+        if (node.init === null || !isFsLoader(node.init, isGlobal) && (node.init.type !== import_utils74.AST_NODE_TYPES.Identifier || !isNamespace(node.init)))
           return;
         if (node.id.type === import_utils74.AST_NODE_TYPES.Identifier) {
-          namespaces.add(node.id.name);
+          recordNamespace(node.id);
           return;
         }
         if (node.id.type !== import_utils74.AST_NODE_TYPES.ObjectPattern) return;
@@ -13467,7 +13824,7 @@ var prefer_node_fs_promises_default = createRule({
         const name = memberName5(node);
         if (name?.endsWith("Sync") !== true) return;
         const object = unwrapAwait2(node.object);
-        if (object.type === import_utils74.AST_NODE_TYPES.Identifier && namespaces.has(object.name) || isFsLoader(object)) {
+        if (object.type === import_utils74.AST_NODE_TYPES.Identifier && isNamespace(object) || isFsLoader(object, isGlobal)) {
           context.report({ node, messageId: "preferAsyncFs", data: { name } });
         }
       }
@@ -13478,11 +13835,11 @@ var prefer_node_fs_promises_default = createRule({
 // src/rules/prefer-non-nullable-collection.ts
 var import_utils75 = require("@typescript-eslint/utils");
 var PREFER_NON_NULLABLE_COLLECTION_DOCUMENTATION = {
-  summary: "Suggest non-null arrays only when local control flow proves the nullish state is equivalent to an empty collection.",
+  summary: "Suggest reviewing nullish arrays that use local empty-array defaults or a shared null-or-empty guard.",
   rationale: "A redundant nullish collection state spreads defaults and guards through consumers without carrying information.",
   remediation: "Use a non-null collection type and normalize omitted input to an empty collection at the boundary.",
   category: "maintainability",
-  limitations: ["The rule requires local evidence that nullish and empty values are treated identically and skips exported wire shapes."],
+  limitations: ["Recognized defaults and guards are manual modeling prompts, not proof of equivalence for every caller or later use. Exported wire shapes and unknown object escapes are excluded; preserve meaningful null states and boundary compatibility."],
   examples: [
     { id: "non-null-array", title: "Model an always-present collection", outcome: "no-match", files: [{ path: "src/search.ts", source: "interface Input { items: string[] } function search({ items }: Input) { return items.length; }" }], focusPath: "src/search.ts", expectedCount: 0, public: true },
     { id: "defaulted-nullish-array", title: "Do not retain a redundant nullish state", outcome: "match", files: [{ path: "src/search.ts", source: "interface Input { items: string[] | undefined } function search({ items = [] }: Input) { return items.length; }" }], focusPath: "src/search.ts", expectedCount: 1, public: true }
@@ -13551,22 +13908,6 @@ function sameAccess(node, access) {
   }
   return node.type === import_utils75.AST_NODE_TYPES.MemberExpression && !node.computed && node.object.type === import_utils75.AST_NODE_TYPES.Identifier && node.object.name === access.object && node.property.type === import_utils75.AST_NODE_TYPES.Identifier && node.property.name === access.property;
 }
-function isNullGuard(node, access) {
-  if (node.type === import_utils75.AST_NODE_TYPES.UnaryExpression && node.operator === "!" && (sameAccess(node.argument, access) || optionalMemberLengthOf(node.argument, access))) return true;
-  if (node.type !== import_utils75.AST_NODE_TYPES.BinaryExpression || !["==", "==="].includes(node.operator)) {
-    return false;
-  }
-  const nullish = (value) => value.type === import_utils75.AST_NODE_TYPES.Literal && value.value === null || value.type === import_utils75.AST_NODE_TYPES.Identifier && value.name === "undefined";
-  return sameAccess(node.left, access) && nullish(node.right) || sameAccess(node.right, access) && nullish(node.left);
-}
-function isEmptyGuard(node, access) {
-  if (node.type === import_utils75.AST_NODE_TYPES.UnaryExpression && node.operator === "!" && memberLengthOf(node.argument, access)) return true;
-  if (node.type !== import_utils75.AST_NODE_TYPES.BinaryExpression || !["==", "===", "<="].includes(node.operator)) {
-    return false;
-  }
-  const zero = (value) => value.type === import_utils75.AST_NODE_TYPES.Literal && value.value === 0;
-  return memberLengthOf(node.left, access) && zero(node.right) || memberLengthOf(node.right, access) && zero(node.left);
-}
 function memberLengthOf(node, access) {
   const target = node.type === import_utils75.AST_NODE_TYPES.ChainExpression ? node.expression : node;
   return target.type === import_utils75.AST_NODE_TYPES.MemberExpression && !target.computed && target.property.type === import_utils75.AST_NODE_TYPES.Identifier && target.property.name === "length" && sameAccess(target.object, access);
@@ -13581,7 +13922,24 @@ function hasEquivalentLeadingGuard(fn, access, visitorKeys) {
   const terminating = first.consequent.type === import_utils75.AST_NODE_TYPES.ReturnStatement || first.consequent.type === import_utils75.AST_NODE_TYPES.ThrowStatement || first.consequent.type === import_utils75.AST_NODE_TYPES.BlockStatement && first.consequent.body.length === 1 && (first.consequent.body[0]?.type === import_utils75.AST_NODE_TYPES.ReturnStatement || first.consequent.body[0]?.type === import_utils75.AST_NODE_TYPES.ThrowStatement);
   if (!terminating) return false;
   if (contains(first.consequent, visitorKeys, (node) => sameAccess(node, access))) return false;
-  return contains(first.test, visitorKeys, (node) => isNullGuard(node, access)) && contains(first.test, visitorKeys, (node) => isEmptyGuard(node, access));
+  if (first.test.type === import_utils75.AST_NODE_TYPES.UnaryExpression && first.test.operator === "!" && optionalMemberLengthOf(first.test.argument, access)) return true;
+  return first.test.type === import_utils75.AST_NODE_TYPES.LogicalExpression && first.test.operator === "||" && isNullGuard(first.test.left, access) && isEmptyGuard(first.test.right, access);
+}
+function isNullGuard(node, access) {
+  if (node.type === import_utils75.AST_NODE_TYPES.UnaryExpression && node.operator === "!" && (sameAccess(node.argument, access) || optionalMemberLengthOf(node.argument, access))) return true;
+  if (node.type !== import_utils75.AST_NODE_TYPES.BinaryExpression || !["==", "==="].includes(node.operator)) {
+    return false;
+  }
+  const nullish = (value) => value.type === import_utils75.AST_NODE_TYPES.Literal && value.value === null || value.type === import_utils75.AST_NODE_TYPES.Identifier && value.name === "undefined";
+  return sameAccess(node.left, access) && nullish(node.right) || sameAccess(node.right, access) && nullish(node.left);
+}
+function isEmptyGuard(node, access) {
+  if (node.type === import_utils75.AST_NODE_TYPES.UnaryExpression && node.operator === "!" && memberLengthOf(node.argument, access)) return true;
+  if (node.type !== import_utils75.AST_NODE_TYPES.BinaryExpression || !["==", "===", "<="].includes(node.operator)) {
+    return false;
+  }
+  const zero = (value) => value.type === import_utils75.AST_NODE_TYPES.Literal && value.value === 0;
+  return memberLengthOf(node.left, access) && zero(node.right) || node.operator !== "<=" && memberLengthOf(node.right, access) && zero(node.left);
 }
 function contains(node, visitorKeys, predicate) {
   if (predicate(node)) return true;
@@ -13619,7 +13977,7 @@ function memberIsOnlyCoalesced(context, object, property, fn) {
     if (!belongsToFunction(reference.identifier, fn)) return [null];
     const parent = reference.identifier.parent;
     if (parent?.type === import_utils75.AST_NODE_TYPES.MemberExpression && !parent.computed && parent.object === reference.identifier && parent.property.type === import_utils75.AST_NODE_TYPES.Identifier && parent.property.name === property) return [parent];
-    return [];
+    return parent?.type === import_utils75.AST_NODE_TYPES.MemberExpression && parent.object === reference.identifier ? [] : [null];
   });
   return accesses.length > 0 && accesses.every((access) => access !== null && directlyCoalesced(access));
 }
@@ -13629,11 +13987,11 @@ var prefer_non_nullable_collection_default = createRule({
   meta: {
     type: "suggestion",
     docs: {
-      description: "Suggest non-null arrays only when local control flow proves the nullish state is equivalent to an empty collection."
+      description: "Suggest reviewing nullish arrays that use local empty-array defaults or a shared null-or-empty guard."
     },
     schema: [],
     messages: {
-      preferNonNullableCollection: "`{{name}}` is locally treated exactly like `[]`; make it a non-null array and normalize omitted input at the boundary."
+      preferNonNullableCollection: "`{{name}}` uses an empty-array default or shared null-or-empty guard; consider a non-null array after checking that the nullish state carries no separate meaning."
     }
   },
   defaultOptions: [],
@@ -13882,12 +14240,12 @@ var ts4 = __toESM(require("typescript"), 1);
 var PREFER_AWAIT_IN_ASYNC_RETURN_DOCUMENTATION = {
   summary: "Prefer explicit `await` when an async function directly returns one typed Promise `.then` transform.",
   rationale: "Mixing a directly returned Promise callback into otherwise async control flow makes sequencing and failures harder to read.",
-  remediation: "Await the Promise, then return the transformed value with ordinary async statements.",
+  remediation: "Consider awaiting the Promise and returning the transformed value with ordinary async statements. Preserve catch boundaries, callback behavior, and observable scheduling when rewriting manually.",
   category: "maintainability",
   since: "15.6.3",
   limitations: [
     "Only a single directly returned `.then` call with an inline callback is checked.",
-    "The receiver must be proven Promise-like by TypeScript; untyped files and larger chains are intentionally ignored.",
+    "The receiver must be proven Promise-like by TypeScript; an earlier chain can still produce that receiver. Untyped receivers, rejection handlers and named callbacks are excluded. This is not the upstream return-await policy and no scheduling equivalence is promised.",
     "Direct loader callbacks passed to resolved `React.lazy` and `next/dynamic` imports are excluded because returning the module Promise is their framework contract."
   ],
   examples: [
@@ -14028,12 +14386,17 @@ var import_utils78 = require("@typescript-eslint/utils");
 var PREFER_SCHEMA_FOR_API_PAYLOAD_DOCUMENTATION = {
   summary: "Require Zod (or similar) schema validation on `response.json()` / `JSON.parse()` results before property access.",
   rationale: "External JSON is untrusted at runtime even when its expected TypeScript shape is known statically.",
-  remediation: "Parse the payload through a schema or establish a recognized runtime validation guard before reading fields.",
+  remediation: "For external payloads, parse through a schema or establish runtime validation before reading fields. Review validator implementations separately rather than recursively requiring another schema.",
   category: "correctness",
-  limitations: ["Test fixtures, generated clients, local JSON files, and recognized validation guards are excluded."],
+  limitations: [
+    "A JSON.parse call alone does not prove external input; exact native JSON stringify/parse round trips are excluded. Validator implementations and other non-network parsing can still require manual review rather than a schema rewrite.",
+    "JSON.parse must resolve to the global JSON object. json() receivers require an unshadowed global Request/Response annotation or construction, or stable local aliases of global fetch results; imported, inferred and unknown response types are deliberately not inferred.",
+    "Named validators remain conventions, not proof of their implementation. Their exemptions are confined to a valid branch or a preceding same-block validation statement; ignored predicate results and deferred callbacks do not validate later reads.",
+    "Test fixtures, generated clients and recognized local-file reads are excluded. This is bounded local analysis, not a general control-flow or mutation proof."
+  ],
   examples: [
-    { id: "validated-payload", title: "Validate before property access", outcome: "no-match", files: [{ path: "src/client.ts", source: "async function load(response) { const body = UserSchema.parse(await response.json()); return body.id; }" }], focusPath: "src/client.ts", expectedCount: 0, public: true },
-    { id: "unvalidated-payload", title: "Do not trust response JSON directly", outcome: "match", files: [{ path: "src/client.ts", source: "async function load(response) { const body = await response.json(); return body.id; }" }], focusPath: "src/client.ts", expectedCount: 1, public: true }
+    { id: "validated-payload", title: "Validate before property access", outcome: "no-match", files: [{ path: "src/client.ts", source: "async function load(response: Response) { const body = UserSchema.parse(await response.json()); return body.id; }" }], focusPath: "src/client.ts", expectedCount: 0, public: true },
+    { id: "unvalidated-payload", title: "Do not trust response JSON directly", outcome: "match", files: [{ path: "src/client.ts", source: "async function load(response: Response) { const body = await response.json(); return body.id; }" }], focusPath: "src/client.ts", expectedCount: 1, public: true }
   ]
 };
 var unwrap6 = (node) => {
@@ -14058,7 +14421,7 @@ var isSchemaParseReference = (node) => {
   const inner = unwrap6(node);
   return inner !== null && inner.type === import_utils78.AST_NODE_TYPES.MemberExpression && !inner.computed && inner.property.type === import_utils78.AST_NODE_TYPES.Identifier && (inner.property.name === "parse" || inner.property.name === "safeParse");
 };
-var isRawPayloadSource = (node, isKnownLocalText) => {
+var isRawPayloadSource = (node, context, isKnownLocalText) => {
   let current = unwrap6(node);
   if (current === null) return false;
   if (current.type === import_utils78.AST_NODE_TYPES.AwaitExpression) {
@@ -14076,13 +14439,31 @@ var isRawPayloadSource = (node, isKnownLocalText) => {
     return false;
   }
   if (property.name === "json") {
-    return true;
+    return !callee.computed && current.arguments.length === 0 && isResponseSource(callee.object, context);
   }
   if (PROMISE_CHAIN_METHODS.has(property.name)) {
-    return !current.arguments.some(isSchemaParseReference) && isRawPayloadSource(callee.object);
+    return !current.arguments.some(isSchemaParseReference) && isRawPayloadSource(callee.object, context, isKnownLocalText);
   }
   const object = unwrap6(callee.object);
-  return property.name === "parse" && object !== null && object.type === import_utils78.AST_NODE_TYPES.Identifier && object.name === "JSON" && !isLocalFileRead(current.arguments[0]) && isKnownLocalText?.(current.arguments[0]) !== true;
+  const input = unwrap6(current.arguments[0]);
+  if (input?.type === import_utils78.AST_NODE_TYPES.CallExpression && input.arguments.length === 1 && input.callee.type === import_utils78.AST_NODE_TYPES.MemberExpression && !input.callee.computed && input.callee.object.type === import_utils78.AST_NODE_TYPES.Identifier && input.callee.object.name === "JSON" && input.callee.property.type === import_utils78.AST_NODE_TYPES.Identifier && input.callee.property.name === "stringify" && (import_utils78.ASTUtils.findVariable(context.sourceCode.getScope(input.callee.object), "JSON")?.defs.length ?? 0) === 0) return false;
+  return property.name === "parse" && object !== null && object.type === import_utils78.AST_NODE_TYPES.Identifier && object.name === "JSON" && (import_utils78.ASTUtils.findVariable(context.sourceCode.getScope(object), "JSON")?.defs.length ?? 0) === 0 && !isLocalFileRead(current.arguments[0]) && isKnownLocalText?.(current.arguments[0]) !== true;
+};
+var isResponseSource = (node, context, seen = /* @__PURE__ */ new Set()) => {
+  let current = unwrap6(node);
+  if (current?.type === import_utils78.AST_NODE_TYPES.AwaitExpression) current = unwrap6(current.argument);
+  if (current === null || seen.has(current)) return false;
+  seen.add(current);
+  const isGlobal = (identifier) => (import_utils78.ASTUtils.findVariable(context.sourceCode.getScope(identifier), identifier.name)?.defs.length ?? 0) === 0;
+  if (current.type === import_utils78.AST_NODE_TYPES.CallExpression) return current.callee.type === import_utils78.AST_NODE_TYPES.Identifier && current.callee.name === "fetch" && isGlobal(current.callee);
+  if (current.type === import_utils78.AST_NODE_TYPES.NewExpression) return current.callee.type === import_utils78.AST_NODE_TYPES.Identifier && ["Request", "Response"].includes(current.callee.name) && isGlobal(current.callee);
+  if (current.type !== import_utils78.AST_NODE_TYPES.Identifier) return false;
+  const binding = import_utils78.ASTUtils.findVariable(context.sourceCode.getScope(current), current.name);
+  if (binding?.defs.length !== 1 || binding.references.some((reference) => reference.isWrite() && reference.init !== true)) return false;
+  const definition = binding.defs[0];
+  const annotation = definition?.name.type === import_utils78.AST_NODE_TYPES.Identifier ? definition.name.typeAnnotation?.typeAnnotation : void 0;
+  if (annotation?.type === import_utils78.AST_NODE_TYPES.TSTypeReference && annotation.typeName.type === import_utils78.AST_NODE_TYPES.Identifier && ["Request", "Response"].includes(annotation.typeName.name) && isGlobal(annotation.typeName)) return true;
+  return definition?.type === "Variable" && definition.parent.kind === "const" && definition.node.init !== null && isResponseSource(definition.node.init, context, seen);
 };
 var FILE_READ_RE = /^(readFile|readFileSync|readJson|readJsonSync|readJSON)$/;
 var isDirectLocalFileRead = (node) => {
@@ -14348,7 +14729,7 @@ var prefer_schema_for_api_payload_default = createRule({
     },
     schema: [],
     messages: {
-      unparsedJsonAccess: "Property access on an unvalidated payload (`response.json()` / `JSON.parse()`) without a schema parse. Pipe through `XSchema.parse(...)` (Zod) before reading fields."
+      unparsedJsonAccess: "Review property access on parsed JSON without a recognized validation boundary. For external payloads, validate before reading fields; validator implementations need manual review, not a recursive schema rewrite."
     }
   },
   defaultOptions: [],
@@ -14359,6 +14740,40 @@ var prefer_schema_for_api_payload_default = createRule({
     const unvalidatedVariables = /* @__PURE__ */ new Set();
     const aliasGroups = /* @__PURE__ */ new Map();
     const localFileTextVariables = /* @__PURE__ */ new Set();
+    const namedGuards = /* @__PURE__ */ new Map();
+    const guardDominates = (use, call) => {
+      if (context.sourceCode.getScope(use).variableScope !== context.sourceCode.getScope(call).variableScope) return false;
+      let guard = call;
+      let positive = true;
+      while (guard.parent.type === import_utils78.AST_NODE_TYPES.UnaryExpression && guard.parent.operator === "!") {
+        positive = !positive;
+        guard = guard.parent;
+      }
+      while (positive && guard.parent.type === import_utils78.AST_NODE_TYPES.LogicalExpression && guard.parent.operator === "&&") guard = guard.parent;
+      const branch = guard.parent;
+      if (branch.type === import_utils78.AST_NODE_TYPES.IfStatement && branch.test === guard) {
+        if (positive && nodeWithin2(use, branch.consequent)) return true;
+        if (!positive && branch.alternate !== null && nodeWithin2(use, branch.alternate)) return true;
+        const terminal = branch.consequent.type === import_utils78.AST_NODE_TYPES.BlockStatement ? branch.consequent.body.at(-1) : branch.consequent;
+        if (!positive && (terminal?.type === import_utils78.AST_NODE_TYPES.ThrowStatement || terminal?.type === import_utils78.AST_NODE_TYPES.ReturnStatement)) {
+          let statement2 = use;
+          while (statement2.parent !== void 0 && statement2.parent !== branch.parent && statement2.parent.type !== import_utils78.AST_NODE_TYPES.Program) {
+            if (statement2.type === import_utils78.AST_NODE_TYPES.FunctionDeclaration || statement2.type === import_utils78.AST_NODE_TYPES.FunctionExpression || statement2.type === import_utils78.AST_NODE_TYPES.ArrowFunctionExpression) return false;
+            statement2 = statement2.parent;
+          }
+          return statement2.parent === branch.parent && statement2.range[0] > branch.range[1];
+        }
+      }
+      if (branch.type === import_utils78.AST_NODE_TYPES.ConditionalExpression && branch.test === guard) return nodeWithin2(use, positive ? branch.consequent : branch.alternate);
+      if (positive && branch.type === import_utils78.AST_NODE_TYPES.WhileStatement && branch.test === guard) return nodeWithin2(use, branch.body);
+      if (call.parent.type !== import_utils78.AST_NODE_TYPES.ExpressionStatement || call.callee.type !== import_utils78.AST_NODE_TYPES.Identifier || /^(?:is|has)[A-Z]/u.test(call.callee.name)) return false;
+      let statement = use;
+      while (statement.parent !== void 0 && statement.parent !== call.parent.parent && statement.parent.type !== import_utils78.AST_NODE_TYPES.Program) {
+        if (statement.type === import_utils78.AST_NODE_TYPES.FunctionDeclaration || statement.type === import_utils78.AST_NODE_TYPES.FunctionExpression || statement.type === import_utils78.AST_NODE_TYPES.ArrowFunctionExpression) return false;
+        statement = statement.parent;
+      }
+      return statement.parent === call.parent.parent && statement.range[0] > call.parent.range[1];
+    };
     const localFileTextRef = (node, scope) => {
       const unwrapped = unwrap6(node);
       if (unwrapped?.type !== import_utils78.AST_NODE_TYPES.Identifier) return null;
@@ -14375,6 +14790,7 @@ var prefer_schema_for_api_payload_default = createRule({
     };
     const clearBinding = (variable) => {
       unvalidatedVariables.delete(variable);
+      namedGuards.delete(variable);
       const group = aliasGroups.get(variable);
       aliasGroups.delete(variable);
       group?.delete(variable);
@@ -14409,10 +14825,24 @@ var prefer_schema_for_api_payload_default = createRule({
     };
     const isFullyNarrowedPattern = (declarator) => {
       const declared = context.sourceCode.getDeclaredVariables(declarator);
+      const statement = declarator.parent;
+      const block = statement.parent;
+      const followsRejectingGuard = (identifier) => {
+        if (block.type !== import_utils78.AST_NODE_TYPES.BlockStatement && block.type !== import_utils78.AST_NODE_TYPES.Program) return false;
+        if (context.sourceCode.getScope(identifier).variableScope !== context.sourceCode.getScope(declarator).variableScope) return false;
+        return block.body.some((candidate2) => {
+          if (candidate2.type !== import_utils78.AST_NODE_TYPES.IfStatement || candidate2.range[1] >= identifier.range[0] || bindingValidationPolarity(candidate2.test, identifier.name) !== "valid-when-false") return false;
+          const terminal = candidate2.consequent.type === import_utils78.AST_NODE_TYPES.BlockStatement ? candidate2.consequent.body.at(-1) : candidate2.consequent;
+          return terminal?.type === import_utils78.AST_NODE_TYPES.ThrowStatement || terminal?.type === import_utils78.AST_NODE_TYPES.ReturnStatement;
+        });
+      };
       return declared.length > 0 && declared.every(
-        (variable) => variable.references.some(
-          (reference) => isValidationRead(reference.identifier)
-        )
+        (variable) => variable.references.some((reference) => isValidationRead(reference.identifier)) && variable.references.every((reference) => {
+          const identifier = reference.identifier;
+          if (reference.init === true) return true;
+          if (reference.isWrite() || identifier.type !== import_utils78.AST_NODE_TYPES.Identifier) return false;
+          return isValidationRead(identifier) || isUseWithinValidatedBranch(identifier, identifier.name) || followsRejectingGuard(identifier);
+        })
       );
     };
     const trackInitializer = (declarator, scope) => {
@@ -14420,7 +14850,7 @@ var prefer_schema_for_api_payload_default = createRule({
       const variable = declaredVars[0];
       if (variable === void 0) return;
       const localText = (candidate2) => localFileTextRef(candidate2, scope) !== null;
-      if (isRawPayloadSource(declarator.init, localText)) {
+      if (isRawPayloadSource(declarator.init, context, localText)) {
         trackRawBinding(variable);
         return;
       }
@@ -14441,6 +14871,7 @@ var prefer_schema_for_api_payload_default = createRule({
         if (node.id.type === import_utils78.AST_NODE_TYPES.ObjectPattern || node.id.type === import_utils78.AST_NODE_TYPES.ArrayPattern) {
           if (isRawPayloadSource(
             node.init,
+            context,
             (candidate2) => localFileTextRef(candidate2, scope) !== null
           )) {
             if (!isFullyNarrowedPattern(node)) {
@@ -14460,7 +14891,7 @@ var prefer_schema_for_api_payload_default = createRule({
           if (variable === null) return;
           const isLocalText = (candidate2) => localFileTextRef(candidate2, scope) !== null;
           updateLocalFileText(variable, node.right, scope);
-          if (isRawPayloadSource(node.right, isLocalText)) {
+          if (isRawPayloadSource(node.right, context, isLocalText)) {
             trackRawBinding(variable);
           } else {
             const source = unvalidatedVariableRef(node.right, scope, unvalidatedVariables);
@@ -14472,6 +14903,7 @@ var prefer_schema_for_api_payload_default = createRule({
         if (node.left.type === import_utils78.AST_NODE_TYPES.ObjectPattern || node.left.type === import_utils78.AST_NODE_TYPES.ArrayPattern) {
           if (isRawPayloadSource(
             node.right,
+            context,
             (candidate2) => localFileTextRef(candidate2, scope) !== null
           )) {
             context.report({
@@ -14501,7 +14933,13 @@ var prefer_schema_for_api_payload_default = createRule({
             continue;
           }
           const variable = findVariable2(scope, unwrapped.name);
-          if (variable !== null) clearAliasGroup(variable);
+          if (variable !== null) {
+            for (const alias of aliasGroups.get(variable) ?? [variable]) {
+              const guards = namedGuards.get(alias) ?? [];
+              guards.push(node);
+              namedGuards.set(alias, guards);
+            }
+          }
         }
       },
       MemberExpression(node) {
@@ -14511,6 +14949,7 @@ var prefer_schema_for_api_payload_default = createRule({
         const obj = unwrap6(node.object);
         if (isRawPayloadSource(
           obj,
+          context,
           (candidate2) => localFileTextRef(candidate2, scope) !== null
         )) {
           const parent = node.parent;
@@ -14522,6 +14961,7 @@ var prefer_schema_for_api_payload_default = createRule({
         }
         const variable = obj?.type === import_utils78.AST_NODE_TYPES.Identifier ? unvalidatedVariableRef(obj, scope, unvalidatedVariables) : null;
         if (variable !== null && obj?.type === import_utils78.AST_NODE_TYPES.Identifier) {
+          if (namedGuards.get(variable)?.some((call) => guardDominates(node, call))) return;
           if (isUseWithinValidatedBranch(node, obj.name)) {
             return;
           }
@@ -14547,7 +14987,7 @@ var PREFER_SHARED_ZOD_ENUM_DOCUMENTATION = {
   rationale: "Inline or repeated literal domains hide a reusable contract and allow equivalent fields to drift independently.",
   remediation: "Declare a module-level named Zod enum schema and reuse it at each field or contract site.",
   category: "maintainability",
-  limitations: ["Only direct z.enum calls with string-literal arrays are inspected; computed domains require review."],
+  limitations: ["Only direct z.enum calls with string-literal arrays are inspected; computed domains require review. Equal values do not prove a shared business domain: retain local schemas when ownership, error customization, or future evolution differs, and review initialization order before extraction."],
   examples: [
     { id: "shared-provider", title: "Reuse a named enum schema", outcome: "no-match", files: [{ path: "src/provider.ts", source: "import { z } from 'zod'; const ProviderSchema = z.enum(['agy', 'claude', 'sol']); const JobSchema = z.object({ provider: ProviderSchema }); const StatusSchema = z.object({ provider: ProviderSchema.optional() });" }], focusPath: "src/provider.ts", expectedCount: 0, public: true },
     { id: "inline-provider", title: "Do not inline enum domains in object fields", outcome: "match", files: [{ path: "src/provider.ts", source: "import { z } from 'zod'; const JobSchema = z.object({ provider: z.enum(['agy', 'claude', 'sol']) });" }], focusPath: "src/provider.ts", expectedCount: 1, public: true }
@@ -14589,16 +15029,22 @@ var prefer_shared_zod_enum_default = createRule({
   create(context) {
     if (isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) return {};
     const zodBindings = /* @__PURE__ */ new Set();
+    const bindingOf = (node) => import_utils79.ASTUtils.findVariable(context.sourceCode.getScope(node), node.name);
     const seen = /* @__PURE__ */ new Set();
     return {
       ImportDeclaration(node) {
         if (!isZodModule(node.source.value)) return;
         for (const specifier of node.specifiers) {
-          if (specifier.type === import_utils79.AST_NODE_TYPES.ImportNamespaceSpecifier || specifier.type === import_utils79.AST_NODE_TYPES.ImportDefaultSpecifier || specifier.type === import_utils79.AST_NODE_TYPES.ImportSpecifier && specifier.imported.type === import_utils79.AST_NODE_TYPES.Identifier && specifier.imported.name === "z") zodBindings.add(specifier.local.name);
+          if (specifier.type === import_utils79.AST_NODE_TYPES.ImportNamespaceSpecifier || specifier.type === import_utils79.AST_NODE_TYPES.ImportDefaultSpecifier || specifier.type === import_utils79.AST_NODE_TYPES.ImportSpecifier && specifier.imported.type === import_utils79.AST_NODE_TYPES.Identifier && specifier.imported.name === "z") {
+            const binding = bindingOf(specifier.local);
+            if (binding !== null) zodBindings.add(binding);
+          }
         }
       },
       CallExpression(node) {
-        if (node.callee.type !== import_utils79.AST_NODE_TYPES.MemberExpression || node.callee.computed || node.callee.object.type !== import_utils79.AST_NODE_TYPES.Identifier || !zodBindings.has(node.callee.object.name) || node.callee.property.type !== import_utils79.AST_NODE_TYPES.Identifier || node.callee.property.name !== "enum") return;
+        if (node.callee.type !== import_utils79.AST_NODE_TYPES.MemberExpression || node.callee.computed || node.callee.object.type !== import_utils79.AST_NODE_TYPES.Identifier || node.callee.property.type !== import_utils79.AST_NODE_TYPES.Identifier || node.callee.property.name !== "enum") return;
+        const binding = bindingOf(node.callee.object);
+        if (binding === null || !zodBindings.has(binding)) return;
         const domain = literalDomain(node);
         if (domain === null) return;
         const key = JSON.stringify(domain);
@@ -15576,6 +16022,13 @@ var prefer_whole_object_assertion_default = createRule({
         return null;
       }
       const actual = expectCall.arguments[0];
+      const variable = import_utils83.ASTUtils.findVariable(sourceCode.getScope(expectCall.callee), expectCall.callee.name);
+      if (variable !== null && variable.defs.some((definition) => {
+        if (definition.node.type !== import_utils83.AST_NODE_TYPES.ImportSpecifier) return true;
+        const declaration = definition.node.parent;
+        const imported = definition.node.imported;
+        return declaration.type !== import_utils83.AST_NODE_TYPES.ImportDeclaration || !["vitest", "@jest/globals", "@playwright/test", "bun:test"].includes(String(declaration.source.value)) || (imported.type === import_utils83.AST_NODE_TYPES.Identifier ? imported.name : imported.value) !== "expect";
+      })) return null;
       if (actual === void 0 || actual.type !== import_utils83.AST_NODE_TYPES.MemberExpression || actual.optional) {
         return null;
       }
@@ -15737,12 +16190,12 @@ var prefer_whole_object_assertion_default = createRule({
 // src/rules/repeated-static-call-cases.ts
 var import_utils84 = require("@typescript-eslint/utils");
 var REPEATED_STATIC_CALL_CASES_DOCUMENTATION = {
-  summary: "Report three or more consecutive literal call assertions that should be independently named test cases.",
-  rationale: "Copy-pasted cases obscure the input table and stop later cases from being reported after the first failure.",
-  remediation: "Replace the repeated assertions with a named `test.each` or `it.each` table.",
+  summary: "Review three or more consecutive static-input call assertions as potential named cases.",
+  rationale: "Copy-pasted cases obscure the input table, and a thrown assertion can stop later cases from being reported.",
+  remediation: "If the calls are independent, use the runner's named parameterized cases or subtests. Preserve ordered state-transition scenarios as one test.",
   category: "testing",
   filePatterns: ["**/*.test.*", "**/*.spec.*", "**/tests/**", "**/__tests__/**"],
-  limitations: ["Only consecutive top-level assertions with direct calls and entirely static inputs and expected values are reported."],
+  limitations: ["Only consecutive top-level assertions with direct calls and static inputs and expected values are checked. Test-local callees and fixtures are excluded; imported or outer functions can still be stateful, so manual independence review is required. Not every runner supports test.each."],
   examples: [
     { id: "parameterized", title: "Name each case", outcome: "no-match", files: [{ path: "src/parser.test.ts", source: "test.each([['a', true], ['b', false], ['c', true]])('parses %s', (input, expected) => { expect(parse(input)).toBe(expected); });" }], focusPath: "src/parser.test.ts", expectedCount: 0, public: true },
     { id: "repeated", title: "Do not repeat literal cases", outcome: "match", files: [{ path: "src/parser.test.ts", source: "test('parses', () => { expect(parse('a')).toBe(true); expect(parse('b')).toBe(false); expect(parse('c')).toBe(true); });" }], focusPath: "src/parser.test.ts", expectedCount: 1, public: true }
@@ -15823,7 +16276,7 @@ function staticShape(node) {
       return "dynamic";
   }
 }
-function assertionShape(statement, context) {
+function assertionShape(statement, context, callback) {
   if (statement.type !== import_utils84.AST_NODE_TYPES.ExpressionStatement || statement.expression.type !== import_utils84.AST_NODE_TYPES.CallExpression) return null;
   const matcherCall = statement.expression;
   if (matcherCall.callee.type !== import_utils84.AST_NODE_TYPES.MemberExpression || matcherCall.callee.computed || matcherCall.callee.property.type !== import_utils84.AST_NODE_TYPES.Identifier || matcherCall.arguments.length !== 1) return null;
@@ -15835,6 +16288,10 @@ function assertionShape(statement, context) {
   const expected = matcherCall.arguments[0];
   if (observed?.type !== import_utils84.AST_NODE_TYPES.CallExpression || observed.callee.type !== import_utils84.AST_NODE_TYPES.Identifier || observed.arguments.length === 0 || observed.arguments.some((arg) => arg.type === import_utils84.AST_NODE_TYPES.SpreadElement || !isStatic(arg)) || expected?.type === import_utils84.AST_NODE_TYPES.SpreadElement || expected === void 0 || !isStatic(expected)) return null;
   const skeleton = `${observed.callee.name}/${observed.arguments.map((item) => staticShape(item)).join(",")}/${chain.modifiers.join(".")}/${matcher}/${staticShape(expected)}`;
+  const binding = import_utils84.ASTUtils.findVariable(context.sourceCode.getScope(observed.callee), observed.callee.name);
+  if (binding?.defs.some(
+    (definition) => definition.node.range[0] >= callback.range[0] && definition.node.range[1] <= callback.range[1]
+  )) return null;
   const values = [...observed.arguments, expected].map((item) => context.sourceCode.getText(item)).join("\0");
   return { statement, skeleton, values };
 }
@@ -15854,9 +16311,9 @@ var repeated_static_call_cases_default = createRule({
   documentation: REPEATED_STATIC_CALL_CASES_DOCUMENTATION,
   meta: {
     type: "suggestion",
-    docs: { description: "Report three or more consecutive literal call assertions that should be independently named test cases." },
+    docs: { description: REPEATED_STATIC_CALL_CASES_DOCUMENTATION.summary },
     schema: [],
-    messages: { repeatedStaticCallCases: "These {{count}} consecutive assertions repeat the same call with static cases. Use a named `test.each` or `it.each` table so every case is independently reported." }
+    messages: { repeatedStaticCallCases: "These {{count}} consecutive assertions repeat a call with static inputs. If independent, use named parameterized cases or subtests; preserve ordered scenarios as one test." }
   },
   defaultOptions: [],
   create(context) {
@@ -15891,7 +16348,7 @@ var repeated_static_call_cases_default = createRule({
           run = [];
         };
         for (const statement of node.body.body) {
-          const shape = assertionShape(statement, context);
+          const shape = assertionShape(statement, context, node);
           if (shape === null || run.length > 0 && run[0]?.skeleton !== shape.skeleton) flush();
           if (shape !== null) run.push(shape);
         }
@@ -16910,10 +17367,12 @@ var require_fetch_timeout_default = createRule({
 var import_utils88 = require("@typescript-eslint/utils");
 var REQUIRE_INTERFACE_FOR_EXPORTED_CLASS_DOCUMENTATION = {
   summary: "Require exported concrete classes with public behavior to declare a contract.",
-  rationale: "Consumers coupled only to a concrete class cannot substitute implementations or state the supported public capability independently of implementation details.",
+  rationale: "An explicit contract names the intended public capability separately from implementation details. TypeScript already supports structural compatibility; this is an architecture policy, not a prerequisite for substitution.",
   remediation: "Declare a focused interface and add an implements clause, or inherit from an intentional base contract.",
   category: "architecture",
   limitations: [
+    "JavaScript files are excluded because implements is TypeScript syntax; imported framework base contracts still require manual policy review.",
+    "An exported injected service may also receive require-port-for-service: its service-boundary error and this general exported-contract warning intentionally enforce distinct policy scopes.",
     "The warning-stage rule checks module-level class declarations and direct class-expression values exported directly, through local export specifiers, or through a default identifier; re-exports and expressions wrapped in other calls require review.",
     "An extends clause satisfies the contract only when its target is a locally declared abstract class; imported base-class contracts require an explicit implements clause.",
     "Static factories and data-only classes without public instance methods are outside the contract requirement."
@@ -16985,7 +17444,7 @@ var require_interface_for_exported_class_default = createRule({
   },
   defaultOptions: [],
   create(context) {
-    if (isTestFile(context.filename) || isStoryFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) return {};
+    if (/\.(?:js|jsx|mjs|cjs)$/iu.test(context.filename) || isTestFile(context.filename) || isStoryFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) return {};
     return {
       "Program:exit"(program) {
         const classes = /* @__PURE__ */ new Map();
@@ -17646,12 +18105,13 @@ var MODEL_EXECUTION_METHODS = /* @__PURE__ */ new Set([
 var DATABASE_NAMES = /^(?:db|database|connection|pool|prisma|query|transaction|tx)$/iu;
 var REQUIRE_SQL_ACCESS_CLASS_DOCUMENTATION = {
   summary: "Keep SQL reads and writes inside a class that receives its database dependency.",
-  rationale: "Free-function database access hides connection ownership and makes transaction, retry, observability, and test boundaries inconsistent.",
+  rationale: "An injected repository class is the preferred ownership boundary for database access under this architectural policy; free functions can also express explicit dependencies.",
   remediation: "Move the query into a repository or store class and inject the pool, connection, transaction, or typed database binding through its constructor.",
   category: "architecture",
   limitations: [
     "The rule recognizes conventional database receiver names, Cloudflare DB bindings, direct pool.query calls, explicit query-builder terminals, and Prisma-style model delegates; unusually named or heavily aliased clients require architectural review.",
     "Query construction without a recognized execution terminal is intentionally not reported.",
+    "Stable local Map, WeakMap, and URLSearchParams instances are excluded. Other conventional receiver names are heuristics, not proof of a database API.",
     "Constructor injection inherited from a base class or transformed through a wrapper is not inferred by this syntax-only rule."
   ],
   examples: [
@@ -17857,11 +18317,23 @@ var require_sql_access_class_default = createRule({
   create(context) {
     if (isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text))
       return {};
+    function knownNonDatabase(node, seen = /* @__PURE__ */ new Set()) {
+      if (seen.has(node)) return false;
+      seen.add(node);
+      if (node.type === import_utils90.AST_NODE_TYPES.Identifier) {
+        const binding = import_utils90.ASTUtils.findVariable(context.sourceCode.getScope(node), node.name);
+        if (binding?.defs.length !== 1 || binding.references.some((reference) => reference.isWrite() && reference.init !== true)) return false;
+        const definition = binding.defs[0];
+        return definition?.type === "Variable" && definition.node.init !== null && knownNonDatabase(definition.node.init, seen);
+      }
+      return node.type === import_utils90.AST_NODE_TYPES.NewExpression && node.callee.type === import_utils90.AST_NODE_TYPES.Identifier && ["Map", "WeakMap", "URLSearchParams"].includes(node.callee.name) && (import_utils90.ASTUtils.findVariable(context.sourceCode.getScope(node.callee), node.callee.name)?.defs.length ?? 0) === 0;
+    }
     return {
       CallExpression(node) {
         if (node.callee.type !== import_utils90.AST_NODE_TYPES.MemberExpression)
           return;
         const method = memberName6(node.callee);
+        if (knownNonDatabase(node.callee.object)) return;
         if (method === null || !isDatabaseOperation(method, node.callee.object))
           return;
         const owner = owningClass2(node);
@@ -17882,6 +18354,8 @@ var REQUIRE_STATIC_NEXT_MATCHER_DOCUMENTATION = {
   rationale: "Next.js must statically analyze matcher values at build time; computed values are ignored.",
   remediation: "Write matcher strings, arrays, and object fields as literals in the exported config.",
   category: "correctness",
+  limitations: ["Only directly exported matcher configuration in middleware/proxy entry files is inspected. Literal matcher validity is left to Next.js; this rule checks static syntax, not the complete framework schema."],
+  references: ["https://nextjs.org/docs/app/api-reference/file-conventions/proxy"],
   examples: [
     { id: "literal-matcher", title: "Use a literal matcher", outcome: "no-match", files: [{ path: "src/middleware.ts", source: 'export const config = { matcher: "/api/:path*" };' }], focusPath: "src/middleware.ts", expectedCount: 0, public: true },
     { id: "computed-matcher", title: "Do not compute the matcher", outcome: "match", files: [{ path: "src/middleware.ts", source: 'const matcher = "/api/:path*"; export const config = { matcher };' }], focusPath: "src/middleware.ts", expectedCount: 1, public: true }
@@ -17929,7 +18403,7 @@ var require_static_next_matcher_default = createRule({
     },
     schema: [],
     messages: {
-      dynamicMatcher: "Next.js matcher values must contain only literal arrays and objects. Calls, identifiers, concatenation, interpolated templates, and spreads are not statically analyzable and fail the production build."
+      dynamicMatcher: "Keep Next.js matcher strings, arrays and object fields literal in the exported config. Dynamic values such as variables are not supported by its build-time static analysis and can be ignored."
     }
   },
   defaultOptions: [],
@@ -18110,7 +18584,8 @@ var REQUIRE_ZOD_FORM_VALIDATION_DOCUMENTATION = {
   category: "security",
   limitations: [
     "Tests are excluded; imported schema-shaped names are trusted when their implementation is outside the linted file.",
-    "Delayed raw-value use is accepted only after an unconditional successful parse in the same block; safeParse remains valid when the raw binding has no unvalidated consumer."
+    "Delayed raw-value use is accepted only after an unconditional successful parse in the same block; safeParse remains valid when the raw binding has no unvalidated consumer.",
+    "An enclosing parse does not validate an earlier call or deferred callback that consumes its input. Direct object/array construction, unshadowed Object.fromEntries and native Number/String/Boolean coercion remain supported; arbitrary preprocessing needs an explicitly reviewed boundary."
   ],
   examples: [
     { id: "validated-form-value", title: "Validate the form value", outcome: "no-match", files: [{ path: "src/action.ts", source: "const input = UserSchema.parse({ name: formData.get('name') });" }], focusPath: "src/action.ts", expectedCount: 0, public: true },
@@ -18225,6 +18700,15 @@ var require_zod_form_validation_default = createRule({
       let parent = node.parent;
       while (parent !== null && parent !== void 0) {
         if (isZodParseCall(parent)) return parent;
+        if (parent.type === import_utils94.AST_NODE_TYPES.CallExpression && parent.callee.type === import_utils94.AST_NODE_TYPES.Identifier && ["Number", "String", "Boolean"].includes(parent.callee.name) && parent.arguments.length === 1 && (resolvedBinding(parent.callee)?.defs.length ?? 0) === 0) {
+          parent = parent.parent;
+          continue;
+        }
+        if (parent.type === import_utils94.AST_NODE_TYPES.CallExpression && parent.callee.type === import_utils94.AST_NODE_TYPES.MemberExpression && !parent.callee.computed && parent.callee.object.type === import_utils94.AST_NODE_TYPES.Identifier && parent.callee.object.name === "Object" && parent.callee.property.type === import_utils94.AST_NODE_TYPES.Identifier && parent.callee.property.name === "fromEntries" && (resolvedBinding(parent.callee.object)?.defs.length ?? 0) === 0) {
+          parent = parent.parent;
+          continue;
+        }
+        if (parent.type === import_utils94.AST_NODE_TYPES.CallExpression || parent.type === import_utils94.AST_NODE_TYPES.NewExpression || parent.type === import_utils94.AST_NODE_TYPES.TaggedTemplateExpression || parent.type === import_utils94.AST_NODE_TYPES.ArrowFunctionExpression || parent.type === import_utils94.AST_NODE_TYPES.FunctionExpression || parent.type === import_utils94.AST_NODE_TYPES.FunctionDeclaration) return null;
         parent = parent.parent;
       }
       return null;
@@ -18404,13 +18888,14 @@ var require_zod_form_validation_default = createRule({
 // src/rules/store-insert-requires-on-conflict.ts
 var import_utils95 = require("@typescript-eslint/utils");
 var STORE_INSERT_REQUIRES_ON_CONFLICT_DOCUMENTATION = {
-  summary: "Require embedded inserts in explicitly replayable callables to carry conflict handling.",
-  rationale: "A callable named as an enqueue, seed, migration, schedule, ensure, or upsert promises replay safety.",
-  remediation: "Add an appropriate `ON CONFLICT` action or supported replay-safe insert form.",
+  summary: "Review conflict handling for embedded inserts in replay-named callables.",
+  rationale: "Names such as seed, enqueue, or upsert suggest that repeated execution deserves a conflict-policy review, but do not prove a replay contract.",
+  remediation: "Choose conflict handling appropriate to the schema and SQL dialect, or document why this insertion must fail on a duplicate.",
   category: "correctness",
+  limitations: ["Only the nearest statically named callable is considered; top-level inserts and anonymous callbacks are excluded. Recognized conflict syntax does not prove idempotence or concurrency safety: WHERE NOT EXISTS can race, and INSERT OR REPLACE can delete an existing row. Review unique constraints and dialect semantics manually."],
   examples: [
-    { id: "conflict-safe-insert", title: "Handle a replayed insert", outcome: "no-match", files: [{ path: "src/store.ts", source: "db.prepare(`INSERT INTO runs (id) VALUES (?) ON CONFLICT(id) DO NOTHING`).run();" }], focusPath: "src/store.ts", expectedCount: 0, public: true },
-    { id: "bare-insert", title: "Do not issue a replay-unsafe insert", outcome: "match", files: [{ path: "src/store.ts", source: "db.prepare(`INSERT INTO runs (id) VALUES (?)`).run();" }], focusPath: "src/store.ts", expectedCount: 1, public: true }
+    { id: "conflict-safe-insert", title: "Review the conflict policy for a replayed insert", outcome: "no-match", files: [{ path: "src/store.ts", source: "function seed() { db.prepare(`INSERT INTO runs (id) VALUES (?) ON CONFLICT(id) DO NOTHING`).run(); }" }], focusPath: "src/store.ts", expectedCount: 0, public: true },
+    { id: "bare-insert", title: "Review a bare insert in a replay-named callable", outcome: "match", files: [{ path: "src/store.ts", source: "function seed() { db.prepare(`INSERT INTO runs (id) VALUES (?)`).run(); }" }], focusPath: "src/store.ts", expectedCount: 1, public: true }
   ]
 };
 var INSERT_WRITE = /\bINSERT\s+(?:OR\s+\w+\s+)?INTO\s+[\w."'`?$:@-]+\s*(?:\([^)]*\)\s*)?(?:VALUES|SELECT|DEFAULT\s+VALUES)\b/i;
@@ -18422,14 +18907,18 @@ function owningCallableName(node) {
       return current.id?.name ?? null;
     }
     if (current.type === "MethodDefinition") {
-      return current.key.type === "Identifier" ? current.key.name : null;
+      return !current.computed && current.key.type === "Identifier" ? current.key.name : null;
     }
     if ((current.type === "ArrowFunctionExpression" || current.type === "FunctionExpression") && current.parent.type === "VariableDeclarator" && current.parent.id.type === "Identifier") {
       return current.parent.id.name;
     }
-    if ((current.type === "ArrowFunctionExpression" || current.type === "FunctionExpression") && current.parent.type === "Property" && current.parent.key.type === "Identifier") {
+    if ((current.type === "ArrowFunctionExpression" || current.type === "FunctionExpression") && current.parent.type === "Property" && !current.parent.computed && current.parent.key.type === "Identifier") {
       return current.parent.key.name;
     }
+    if (current.type === "ArrowFunctionExpression" || current.type === "FunctionExpression") {
+      const parent = current.parent;
+      return parent.type === "MethodDefinition" && !parent.computed && parent.key.type === "Identifier" ? parent.key.name : null;
+    }
   }
   return null;
 }
@@ -18440,11 +18929,11 @@ var store_insert_requires_on_conflict_default = createRule({
   meta: {
     type: "problem",
     docs: {
-      description: "Require embedded inserts in explicitly replayable callables to carry conflict handling."
+      description: "Review conflict handling for embedded inserts in replay-named callables."
     },
     schema: [],
     messages: {
-      storeInsertRequiresOnConflict: "This INSERT is not replay-safe: a cron re-run or queue redelivery duplicates the row (or fails the handler on a unique-constraint violation). Add `ON CONFLICT (...) DO UPDATE` / `DO NOTHING` (or `INSERT OR IGNORE`)."
+      storeInsertRequiresOnConflict: "This INSERT is inside a replay-named callable without recognized conflict handling. Review duplicate execution, unique constraints, and the appropriate conflict policy for your SQL dialect."
     }
   },
   defaultOptions: [],
@@ -18457,7 +18946,7 @@ var store_insert_requires_on_conflict_default = createRule({
         return;
       }
       const owner = owningCallableName(node);
-      if (owner !== null && !REPLAY_CONTRACT_NAME.test(owner)) {
+      if (owner === null || !REPLAY_CONTRACT_NAME.test(owner)) {
         return;
       }
       context.report({ node, messageId: "storeInsertRequiresOnConflict" });
@@ -18470,15 +18959,13 @@ var import_utils96 = require("@typescript-eslint/utils");
 var STEPDOWN_DOCUMENTATION = {
   summary: "Place a private helper below its sole direct same-scope caller.",
   rationale: "Caller-first ordering lets a reader follow the main flow before descending into implementation details.",
-  remediation: "Move the private helper below its sole caller.",
+  remediation: "Consider moving the private helper below its sole caller after reviewing initialization and reflection dependencies.",
   category: "maintainability",
-  autofix: "safe",
   limitations: [
     "Generated and test files, cycles, dynamic references, overload targets, and helpers with multiple callers are excluded.",
-    "Class helpers must be private; their sole caller may be public, protected, or private so the fix also satisfies accessibility ordering.",
+    "Class helpers must be private; their sole caller may be public, protected, or private.",
     "Runtime class-field, static-block, computed-member, and decorator barriers are never crossed.",
-    "Autofix is limited to comment-free class-member boundaries; module functions and ambiguous comment ownership remain report-only.",
-    "Overlapping helper chains remain report-only so ESLint never leaves a partially reordered class after exhausting its fix-pass limit."
+    "This rule is report-only: reordering methods can change reflective property order, and moving module declarations can change initialization behavior or introduce temporal-dead-zone failures. Review module cycles and eager callers manually."
   ],
   examples: [
     { id: "caller-before-helper", title: "Place the caller first", outcome: "no-match", files: [{ path: "src/run.ts", source: "function run() { return load(); }\nfunction load() { return 1; }" }], focusPath: "src/run.ts", expectedCount: 0, public: true },
@@ -18488,7 +18975,7 @@ var STEPDOWN_DOCUMENTATION = {
 function isFunction(node) {
   return node.type === import_utils96.AST_NODE_TYPES.ArrowFunctionExpression || node.type === import_utils96.AST_NODE_TYPES.FunctionDeclaration || node.type === import_utils96.AST_NODE_TYPES.FunctionExpression;
 }
-function reportMisordered(context, candidates, scopeDefinitions, calls, pinned, canMove = () => true, makeFix) {
+function reportMisordered(context, candidates, scopeDefinitions, calls, pinned, canMove = () => true) {
   const byName = new Map(scopeDefinitions.map((definition) => [definition.name, definition]));
   const cycles = cycleComponents(calls);
   const callers = /* @__PURE__ */ new Map();
@@ -18507,12 +18994,10 @@ function reportMisordered(context, candidates, scopeDefinitions, calls, pinned,
     if (callerName2 === void 0 || cycles.has(helper.name) && cycles.get(helper.name) === cycles.get(callerName2)) continue;
     const caller = byName.get(callerName2);
     if (caller === void 0 || helper.node.range[0] >= caller.node.range[0] || !canMove(helper, caller)) continue;
-    const fix = makeFix?.(helper, caller);
     context.report({
       node: helper.node,
       messageId: "helperAboveOnlyCaller",
-      data: { helper: helper.name, caller: callerName2 },
-      ...fix === void 0 ? {} : { fix }
+      data: { helper: helper.name, caller: callerName2 }
     });
   }
 }
@@ -18839,37 +19324,7 @@ function classScope(context, node, computedReferenceNames) {
     if (helperIndex === void 0 || callerIndex === void 0) return false;
     return runtimeBarrierPrefix[callerIndex + 1] === runtimeBarrierPrefix[helperIndex + 1];
   };
-  const incoming = /* @__PURE__ */ new Map();
-  for (const [caller, callees] of calls) {
-    for (const callee of callees) {
-      if (callee === caller) continue;
-      const callers = incoming.get(callee) ?? /* @__PURE__ */ new Set();
-      callers.add(caller);
-      incoming.set(callee, callers);
-    }
-  }
-  reportMisordered(context, definitions, scopeDefinitions, calls, pinned, canMove, (helper, caller) => {
-    if (!canMove(helper, caller)) return void 0;
-    const helperCallsAnother = [...calls.get(helper.name) ?? []].some((callee) => callee !== helper.name);
-    const callerIsAnotherHelper = [...incoming.get(caller.name) ?? []].some((name) => name !== helper.name);
-    if (helperCallsAnother || callerIsAnotherHelper) return void 0;
-    const helperMember = helper.node;
-    const callerMember = caller.node;
-    const helperIndex = memberIndexes.get(helperMember);
-    if (helperIndex === void 0) return void 0;
-    const next = node.body.body[helperIndex + 1];
-    const suffixEnd = next?.range[0] ?? node.body.range[1] - 1;
-    const suffix = context.sourceCode.text.slice(helperMember.range[1], suffixEnd);
-    if (!/^\s*$/u.test(suffix)) return void 0;
-    const previous = node.body.body[helperIndex - 1];
-    const prefixStart = previous?.range[1] ?? node.body.range[0] + 1;
-    if (!/^\s*$/u.test(context.sourceCode.text.slice(prefixStart, helperMember.range[0]))) return void 0;
-    const helperText = context.sourceCode.getText(helperMember);
-    return (fixer) => [
-      fixer.removeRange([helperMember.range[0], suffixEnd]),
-      fixer.insertTextAfter(callerMember, `${suffix}${helperText}`)
-    ];
-  });
+  reportMisordered(context, definitions, scopeDefinitions, calls, pinned, canMove);
 }
 function isClassRuntimeBarrier(member) {
   switch (member.type) {
@@ -18891,7 +19346,6 @@ var stepdown_default = createRule({
     type: "suggestion",
     docs: { description: "Place a private helper below its sole direct same-scope caller." },
     schema: [],
-    fixable: "code",
     messages: {
       helperAboveOnlyCaller: "Private helper `{{helper}}` is defined above its only caller `{{caller}}`; move it below the caller."
     }
@@ -18964,7 +19418,7 @@ var SOURCE_COUPLED_TEST_DOCUMENTATION = {
   remediation: "Parse the artifact, execute its validator, or assert on another runtime contract.",
   category: "testing",
   limitations: [
-    "The rule follows lexical aliases, source-path collections, awaited reads, and common text operations; interprocedural flows remain unreported.",
+    "The rule follows stable lexical bindings, static source paths, awaited reads, and common text operations. Reassigned bindings, dynamic paths, unknown path wrappers, iterator pipelines, and interprocedural flows remain unreported.",
     "When raw representation is genuinely the contract (for example a golden or compatibility sentinel), use an exact line suppression with the reason."
   ],
   examples: [
@@ -19003,6 +19457,11 @@ function stringValue(node) {
   const current = unwrap7(node);
   if (current.type === import_utils97.AST_NODE_TYPES.Literal && typeof current.value === "string") return current.value;
   if (current.type === import_utils97.AST_NODE_TYPES.TemplateLiteral && current.expressions.length === 0) return current.quasis[0]?.value.cooked ?? null;
+  if (current.type === import_utils97.AST_NODE_TYPES.BinaryExpression && current.operator === "+") {
+    const left = stringValue(current.left);
+    const right = stringValue(current.right);
+    return left === null || right === null ? null : left + right;
+  }
   return null;
 }
 function importSource(node) {
@@ -19032,14 +19491,19 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
       const scopes = [newScope()];
       const reportedOrigins = /* @__PURE__ */ new Set();
       const currentScope = () => scopes.at(-1) ?? scopes[0];
-      const visible = (kind, name2) => {
+      const bindingOf = (node) => import_utils97.ASTUtils.findVariable(context.sourceCode.getScope(node), node.name);
+      const visible = (kind, node) => {
+        const name2 = bindingOf(node);
+        if (name2 === null || name2.references.some((reference) => reference.isWrite() && reference.init !== true)) return false;
         for (let index = scopes.length - 1; index >= 0; index--) {
           const scope = scopes[index];
           if (scope.declared.has(name2)) return scope[kind].has(name2);
         }
         return false;
       };
-      const visibleRawOrigins = (name2) => {
+      const visibleRawOrigins = (node) => {
+        const name2 = bindingOf(node);
+        if (name2 === null || name2.references.some((reference) => reference.isWrite() && reference.init !== true)) return /* @__PURE__ */ new Set();
         for (let index = scopes.length - 1; index >= 0; index--) {
           const scope = scopes[index];
           if (scope.declared.has(name2)) return scope.rawOrigins.get(name2) ?? /* @__PURE__ */ new Set();
@@ -19050,15 +19514,14 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         const current = unwrap7(node);
         const value = stringValue(current);
         if (value !== null) return sourceSuffixRe.test(value);
-        if (current.type === import_utils97.AST_NODE_TYPES.Identifier) return visible("paths", current.name);
-        if (current.type === import_utils97.AST_NODE_TYPES.BinaryExpression && current.operator === "+") {
-          return sourcePath(current.left) || sourcePath(current.right);
-        }
-        if (current.type === import_utils97.AST_NODE_TYPES.TemplateLiteral) return current.expressions.some(sourcePath);
+        if (current.type === import_utils97.AST_NODE_TYPES.Identifier) return visible("paths", current);
         if (current.type === import_utils97.AST_NODE_TYPES.CallExpression || current.type === import_utils97.AST_NODE_TYPES.NewExpression) {
-          return current.arguments.some((argument) => argument.type !== import_utils97.AST_NODE_TYPES.SpreadElement && sourcePath(argument));
+          const callee = current.callee;
+          const first = current.arguments[0];
+          if (first === void 0 || first.type === import_utils97.AST_NODE_TYPES.SpreadElement) return false;
+          if (current.type === import_utils97.AST_NODE_TYPES.NewExpression && callee.type === import_utils97.AST_NODE_TYPES.Identifier && callee.name === "URL" && (bindingOf(callee)?.defs.length ?? 0) === 0) return sourcePath(first);
+          if (callee.type === import_utils97.AST_NODE_TYPES.Identifier && bindingOf(callee)?.defs.some((definition) => definition.node.type === import_utils97.AST_NODE_TYPES.ImportSpecifier && definition.node.imported.type === import_utils97.AST_NODE_TYPES.Identifier && definition.node.imported.name === "fileURLToPath" && definition.node.parent.type === import_utils97.AST_NODE_TYPES.ImportDeclaration && ["node:url", "url"].includes(String(definition.node.parent.source.value)))) return sourcePath(first);
         }
-        if (current.type === import_utils97.AST_NODE_TYPES.MemberExpression) return sourcePath(current.object);
         return false;
       };
       const rawRead = (node) => {
@@ -19066,16 +19529,16 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         if (current.type !== import_utils97.AST_NODE_TYPES.CallExpression || current.arguments.length === 0) return false;
         const callee = unwrap7(current.callee);
         if (callee.type === import_utils97.AST_NODE_TYPES.Identifier) {
-          return visible("fsReaders", callee.name) && sourcePath(current.arguments[0]);
+          return visible("fsReaders", callee) && sourcePath(current.arguments[0]);
         }
         if (callee.type !== import_utils97.AST_NODE_TYPES.MemberExpression) return false;
         const name2 = staticMemberName7(callee);
         const object = unwrap7(callee.object);
-        return name2 !== null && FS_READERS.has(name2) && object.type === import_utils97.AST_NODE_TYPES.Identifier && visible("fsObjects", object.name) && sourcePath(current.arguments[0]);
+        return name2 !== null && FS_READERS.has(name2) && object.type === import_utils97.AST_NODE_TYPES.Identifier && visible("fsObjects", object) && sourcePath(current.arguments[0]);
       };
       const rawOrigins = (node) => {
         const current = unwrap7(node);
-        if (current.type === import_utils97.AST_NODE_TYPES.Identifier) return visibleRawOrigins(current.name);
+        if (current.type === import_utils97.AST_NODE_TYPES.Identifier) return visibleRawOrigins(current);
         if (rawRead(current)) return /* @__PURE__ */ new Set([`${current.range[0]}:${current.range[1]}`]);
         if (current.type === import_utils97.AST_NODE_TYPES.BinaryExpression && current.operator === "+") return /* @__PURE__ */ new Set([...rawOrigins(current.left), ...rawOrigins(current.right)]);
         if (current.type === import_utils97.AST_NODE_TYPES.MemberExpression && staticMemberName7(current) === "length") return rawOrigins(current.object);
@@ -19116,14 +19579,9 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         if (receiver.type !== import_utils97.AST_NODE_TYPES.Identifier || receiver.name !== "assert" || !ASSERT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
         return new Set(node.arguments.flatMap((argument) => argument.type === import_utils97.AST_NODE_TYPES.SpreadElement ? [] : [...evidenceOrigins(argument)]));
       };
-      const rawRegexExtractionOrigins = (node) => {
-        const callee = unwrap7(node.callee);
-        if (callee.type !== import_utils97.AST_NODE_TYPES.MemberExpression || staticMemberName7(callee) !== "matchAll" || node.arguments.length !== 1) return /* @__PURE__ */ new Set();
-        const argument = node.arguments[0];
-        if (argument?.type !== import_utils97.AST_NODE_TYPES.Literal || !(argument.value instanceof RegExp)) return /* @__PURE__ */ new Set();
-        return rawOrigins(callee.object);
-      };
-      const declare = (name2, state) => {
+      const declare = (node, state) => {
+        const name2 = bindingOf(node);
+        if (name2 === null) return;
         const scope = currentScope();
         scope.declared.add(name2);
         scope.collections.delete(name2);
@@ -19143,18 +19601,8 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         const current = unwrap7(node);
         return current.type === import_utils97.AST_NODE_TYPES.ArrayExpression && current.elements.length > 0 && current.elements.every((element) => element !== null && element.type !== import_utils97.AST_NODE_TYPES.SpreadElement && sourcePath(element));
       };
-      const declaredNames2 = (node) => {
-        const current = unwrap7(node);
-        if (current.type === import_utils97.AST_NODE_TYPES.Identifier) return [current.name];
-        if (current.type === import_utils97.AST_NODE_TYPES.AssignmentPattern) return declaredNames2(current.left);
-        if (current.type === import_utils97.AST_NODE_TYPES.RestElement) return declaredNames2(current.argument);
-        if (current.type === import_utils97.AST_NODE_TYPES.ArrayPattern) return current.elements.flatMap((element) => element === null ? [] : declaredNames2(element));
-        if (current.type === import_utils97.AST_NODE_TYPES.ObjectPattern) return current.properties.flatMap((property) => property.type === import_utils97.AST_NODE_TYPES.RestElement ? declaredNames2(property.argument) : declaredNames2(property.value));
-        return [];
-      };
-      const enterFunction = (node) => {
+      const enterFunction = () => {
         scopes.push(newScope());
-        for (const parameter of node.params) for (const name2 of declaredNames2(parameter)) declare(name2, {});
       };
       const exitFunction = () => {
         scopes.pop();
@@ -19166,9 +19614,9 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
           for (const specifier of node.specifiers) {
             if (specifier.type === import_utils97.AST_NODE_TYPES.ImportSpecifier) {
               const imported = specifier.imported.type === import_utils97.AST_NODE_TYPES.Identifier ? specifier.imported.name : String(specifier.imported.value);
-              if (FS_READERS.has(imported)) declare(specifier.local.name, { fsReader: true });
+              if (FS_READERS.has(imported)) declare(specifier.local, { fsReader: true });
             } else {
-              declare(specifier.local.name, { fsObject: true });
+              declare(specifier.local, { fsObject: true });
             }
           }
         },
@@ -19177,35 +19625,34 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         VariableDeclarator(node) {
           if (node.init === null) return;
           const required = requireSource(node.init);
+          const initializer = unwrap7(node.init);
+          if (required !== null && initializer.type === import_utils97.AST_NODE_TYPES.CallExpression && initializer.callee.type === import_utils97.AST_NODE_TYPES.Identifier && (bindingOf(initializer.callee)?.defs.length ?? 0) > 0) return;
           if (required !== null && FS_MODULES.has(required) && node.id.type === import_utils97.AST_NODE_TYPES.Identifier) {
-            declare(node.id.name, { fsObject: true });
+            declare(node.id, { fsObject: true });
             return;
           }
           if (node.id.type === import_utils97.AST_NODE_TYPES.ObjectPattern && required !== null && FS_MODULES.has(required)) {
             for (const property of node.id.properties) {
               if (property.type !== import_utils97.AST_NODE_TYPES.Property || property.value.type !== import_utils97.AST_NODE_TYPES.Identifier) continue;
               const key = property.key.type === import_utils97.AST_NODE_TYPES.Identifier ? property.key.name : property.key.type === import_utils97.AST_NODE_TYPES.Literal ? String(property.key.value) : "";
-              if (FS_READERS.has(key)) declare(property.value.name, { fsReader: true });
+              if (FS_READERS.has(key)) declare(property.value, { fsReader: true });
             }
             return;
           }
           if (node.id.type !== import_utils97.AST_NODE_TYPES.Identifier) return;
-          declare(node.id.name, { collection: sourceCollection(node.init), path: sourcePath(node.init), rawOrigins: rawOrigins(node.init) });
+          declare(node.id, { collection: sourceCollection(node.init), path: sourcePath(node.init), rawOrigins: rawOrigins(node.init) });
         },
         AssignmentExpression(node) {
-          if (node.left.type === import_utils97.AST_NODE_TYPES.Identifier) declare(node.left.name, { path: sourcePath(node.right), rawOrigins: rawOrigins(node.right) });
+          if (node.left.type === import_utils97.AST_NODE_TYPES.Identifier) declare(node.left, {});
         },
         ForOfStatement(node) {
           const right = unwrap7(node.right);
-          const collection = right.type === import_utils97.AST_NODE_TYPES.Identifier && visible("collections", right.name);
+          const collection = right.type === import_utils97.AST_NODE_TYPES.Identifier && visible("collections", right);
           const left = node.left.type === import_utils97.AST_NODE_TYPES.VariableDeclaration ? node.left.declarations[0]?.id : node.left;
-          if (collection && left?.type === import_utils97.AST_NODE_TYPES.Identifier) declare(left.name, { path: true });
+          if (collection && left?.type === import_utils97.AST_NODE_TYPES.Identifier) declare(left, { path: true });
         },
         CallExpression(node) {
-          const origins = /* @__PURE__ */ new Set([
-            ...rawAssertionOrigins(node),
-            ...rawRegexExtractionOrigins(node)
-          ]);
+          const origins = rawAssertionOrigins(node);
           if (origins.size === 0 || [...origins].every((origin) => reportedOrigins.has(origin))) return;
           for (const origin of origins) reportedOrigins.add(origin);
           context.report({ node, messageId: "rawSourceOracle" });
@@ -19348,8 +19795,8 @@ var IAC_SOURCE_COUPLED_TEST_DOCUMENTATION = {
   remediation: "Parse rendered plan JSON, query the provider, or exercise the deployed runtime contract.",
   category: "testing",
   limitations: [
-    "The rule follows lexical aliases, source-path collections, awaited reads, and common text operations; interprocedural flows remain unreported.",
-    "The warning-stage rule remains suppressible for calibration; promotion may make the locked policy non-suppressible."
+    "The rule follows stable lexical bindings and static source paths. Reassigned bindings, dynamic paths, unknown path wrappers, iterator pipelines, and interprocedural flows remain unreported.",
+    "When raw representation is genuinely the contract, use an exact line suppression explaining that contract."
   ],
   examples: [
     {
@@ -19824,7 +20271,7 @@ var RULES = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.17.10"
+  version: "15.17.11"
 };
 var APPLICATION_ONLY_RULES = [];
 var LIBRARY_IMPORT_POLICY = ["error", {