@sarj/eslint-plugin 15.17.8 → 15.17.9

package/dist/index.js

@@ -2455,8 +2455,51 @@ var no_duplicate_lifecycle_refresh_listeners_default = createRule({
   }
 });
 
+// src/rules/_exported-next-config-property.ts
+import { ASTUtils as ASTUtils4 } from "@typescript-eslint/utils";
+function unwrap(node) {
+  while (node.type === "TSAsExpression" || node.type === "TSSatisfiesExpression" || node.type === "TSTypeAssertion" || node.type === "TSNonNullExpression") node = node.expression;
+  return node;
+}
+function exportedNextConfigProperty(sourceCode, path) {
+  const resolve2 = (input, seen = /* @__PURE__ */ new Set()) => {
+    const node = unwrap(input);
+    if (node.type !== "Identifier") return node;
+    if (seen.has(node)) return null;
+    seen.add(node);
+    const binding = ASTUtils4.findVariable(sourceCode.getScope(node), node.name);
+    const definition = binding?.defs.length === 1 ? binding.defs[0] : void 0;
+    if (definition?.type !== "Variable" || definition.parent.kind !== "const" || definition.node.init === null || binding?.references.some((reference) => reference.identifier !== node && reference.init !== true)) return null;
+    return resolve2(definition.node.init, seen);
+  };
+  let exported = null;
+  for (const statement of sourceCode.ast.body) {
+    if (statement.type === "ExportDefaultDeclaration") exported = statement.declaration;
+    if (statement.type !== "ExpressionStatement" || statement.expression.type !== "AssignmentExpression" || statement.expression.operator !== "=" || sourceCode.ast.body.length !== 1) continue;
+    const assignment = statement.expression;
+    const left = assignment.left;
+    if (left.type !== "MemberExpression" || left.computed || left.object.type !== "Identifier" || left.object.name !== "module" || left.property.type !== "Identifier" || left.property.name !== "exports") continue;
+    const binding = ASTUtils4.findVariable(sourceCode.getScope(left.object), "module");
+    if (binding === null || binding.defs.length === 0) exported = assignment.right;
+  }
+  if (exported === null) return null;
+  let current = resolve2(exported);
+  let selected = null;
+  for (const name of path) {
+    if (current?.type !== "ObjectExpression" || current.properties.some((property) => property.type !== "Property" || property.computed || property.kind !== "init")) return null;
+    selected = null;
+    for (const property of current.properties) {
+      if (property.type !== "Property") continue;
+      const key = property.key.type === "Identifier" ? property.key.name : property.key.type === "Literal" ? property.key.value : null;
+      if (key === name) selected = property;
+    }
+    if (selected === null) return null;
+    current = resolve2(selected.value);
+  }
+  return selected;
+}
+
 // src/rules/no-dangerously-allow-svg.ts
-import "@typescript-eslint/utils";
 var NEXT_CONFIG_RE = /(?:^|\/)next\.config\.[cm]?[jt]s$/;
 var NO_DANGEROUSLY_ALLOW_SVG_DOCUMENTATION = {
   summary: "Next.js image configuration enables unsanitized SVG rendering",
@@ -2464,7 +2507,7 @@ var NO_DANGEROUSLY_ALLOW_SVG_DOCUMENTATION = {
   remediation: "Keep dangerouslyAllowSVG disabled. If SVG delivery is unavoidable, use a separately reviewed asset path with restrictive Content-Disposition and Content-Security-Policy headers.",
   category: "security",
   limitations: [
-    "Only a literal true assigned to dangerouslyAllowSVG in a next.config source file is reported; computed or imported configuration is intentionally not inferred."
+    "Only a literal true in the effective images property of a directly exported object, unescaped const alias, or isolated module.exports object is reported. Wrappers, factories, spreads, computed keys and mutations are not inferred."
   ],
   examples: [
     {
@@ -2487,11 +2530,6 @@ var NO_DANGEROUSLY_ALLOW_SVG_DOCUMENTATION = {
     }
   ]
 };
-function propertyName(node) {
-  if (!node.computed && node.key.type === "Identifier") return node.key.name;
-  if (node.key.type === "Literal" && typeof node.key.value === "string") return node.key.value;
-  return null;
-}
 var no_dangerously_allow_svg_default = createRule({
   name: "no-dangerously-allow-svg",
   documentation: NO_DANGEROUSLY_ALLOW_SVG_DOCUMENTATION,
@@ -2507,8 +2545,9 @@ var no_dangerously_allow_svg_default = createRule({
   create(context) {
     if (!NEXT_CONFIG_RE.test(context.filename.replaceAll("\\", "/"))) return {};
     return {
-      Property(node) {
-        if (propertyName(node) === "dangerouslyAllowSVG" && node.value.type === "Literal" && node.value.value === true) {
+      "Program:exit"() {
+        const node = exportedNextConfigProperty(context.sourceCode, ["images", "dangerouslyAllowSVG"]);
+        if (node !== null && node.value.type === "Literal" && node.value.value === true) {
           context.report({ node, messageId: "noDangerouslyAllowSvg" });
         }
       }
@@ -3117,7 +3156,7 @@ function subtreeMatches(stmt, predicate, descendIntoFunctions = false) {
   visit(stmt);
   return found;
 }
-function unwrap(expr) {
+function unwrap2(expr) {
   let current = expr;
   while (current.type === AST_NODE_TYPES12.ChainExpression || current.type === AST_NODE_TYPES12.TSNonNullExpression) {
     current = current.expression;
@@ -3145,7 +3184,7 @@ var hasThrowingCallOrNew = (node) => subtreeMatches(
   (n) => n.type === AST_NODE_TYPES12.CallExpression && !isPureCall(n) || n.type === AST_NODE_TYPES12.NewExpression && !isPureNew(n)
 );
 function isBareCallStatement(stmt) {
-  return stmt.type === AST_NODE_TYPES12.ExpressionStatement && unwrap(stmt.expression).type === AST_NODE_TYPES12.CallExpression;
+  return stmt.type === AST_NODE_TYPES12.ExpressionStatement && unwrap2(stmt.expression).type === AST_NODE_TYPES12.CallExpression;
 }
 function isSimpleCatchFinallyOrchestration(node) {
   const handler = node.handler;
@@ -3248,8 +3287,8 @@ function handlerEndsByHandingOff(handler) {
   return last.type === AST_NODE_TYPES12.ExpressionStatement && unwrapAwait(last.expression).type === AST_NODE_TYPES12.CallExpression;
 }
 function unwrapAwait(expr) {
-  const inner = unwrap(expr);
-  return inner.type === AST_NODE_TYPES12.AwaitExpression ? unwrap(inner.argument) : inner;
+  const inner = unwrap2(expr);
+  return inner.type === AST_NODE_TYPES12.AwaitExpression ? unwrap2(inner.argument) : inner;
 }
 function handlerMentionsCaughtBinding(handler) {
   const names = caughtBindingNames(handler);
@@ -3574,7 +3613,7 @@ var NO_HAND_ROLLED_SPINNER_DOCUMENTATION = {
   rationale: "One-off loading indicators duplicate a shared primitive and let accessibility and styling diverge.",
   remediation: "Render the design-system Spinner component instead.",
   category: "maintainability",
-  limitations: ["Only static className values on div and span elements are inspected; tests, stories, generated files, and the design-system implementation are excluded."],
+  limitations: ["Only effective static className values on div and span elements are inspected; a later spread makes the value unknown. Tests, stories, generated files, and the design-system implementation are excluded."],
   examples: [
     { id: "design-system-spinner", title: "Use the shared spinner", outcome: "no-match", files: [{ path: "src/loading-state.tsx", source: '<Spinner className="size-4" />' }], focusPath: "src/loading-state.tsx", expectedCount: 0, public: true },
     { id: "border-ring-spinner", title: "Do not rebuild a spinner", outcome: "match", files: [{ path: "src/loading-state.tsx", source: '<div className="size-4 animate-spin rounded-full border-2 border-t-transparent" />' }], focusPath: "src/loading-state.tsx", expectedCount: 1, public: true }
@@ -3636,10 +3675,10 @@ var no_hand_rolled_spinner_default = createRule({
         if (node.name.type !== AST_NODE_TYPES14.JSXIdentifier || node.name.name !== "div" && node.name.name !== "span") {
           return;
         }
-        const classNameAttribute = node.attributes.find(
-          (attribute) => attribute.type === AST_NODE_TYPES14.JSXAttribute && attribute.name.type === AST_NODE_TYPES14.JSXIdentifier && attribute.name.name === "className"
+        const classNameAttribute = node.attributes.toReversed().find(
+          (attribute) => attribute.type === AST_NODE_TYPES14.JSXSpreadAttribute || attribute.type === AST_NODE_TYPES14.JSXAttribute && attribute.name.type === AST_NODE_TYPES14.JSXIdentifier && attribute.name.name === "className"
         );
-        if (classNameAttribute === void 0) return;
+        if (classNameAttribute?.type !== AST_NODE_TYPES14.JSXAttribute) return;
         const className = staticClassName(classNameAttribute);
         if (className === null) return;
         const classes = className.split(/\s+/u);
@@ -3882,15 +3921,15 @@ var no_insecure_random_id_default = createRule({
 });
 
 // src/rules/no-json-stringify-error.ts
-import "@typescript-eslint/utils";
+import { ASTUtils as ASTUtils5 } from "@typescript-eslint/utils";
 var NO_JSON_STRINGIFY_ERROR_DOCUMENTATION = {
-  summary: "Disallow `JSON.stringify` on an Error value; it yields `{}` because `message`/`stack` are non-enumerable.",
+  summary: "Avoid generic JSON serialization that can omit native Error details.",
   rationale: "Native Error details are non-enumerable, so generic JSON serialization discards diagnostic information.",
   remediation: "Serialize explicit error fields or use an error-aware serializer.",
   category: "correctness",
-  limitations: ["The rule uses local catch-binding and constructor provenance rather than type information."],
+  limitations: ["The rule uses stable local catch bindings and unshadowed built-in constructors, not runtime type information. Custom replacers are left to their serializer contract; a catch value is not guaranteed to be an Error."],
   examples: [
-    { id: "explicit-error-message", title: "Serialize an enumerable error field", outcome: "no-match", files: [{ path: "src/report.ts", source: "try { f(); } catch (err) { JSON.stringify({ error: err.message }); }" }], focusPath: "src/report.ts", expectedCount: 0, public: true },
+    { id: "explicit-error-message", title: "Narrow an unknown catch value before selecting fields", outcome: "no-match", files: [{ path: "src/report.ts", source: "try { f(); } catch (err) { JSON.stringify({ error: err instanceof Error ? err.message : String(err) }); }" }], focusPath: "src/report.ts", expectedCount: 0, public: true },
     { id: "stringified-error", title: "Do not stringify an Error object", outcome: "match", files: [{ path: "src/report.ts", source: "try { f(); } catch (err) { JSON.stringify({ error: err }); }" }], focusPath: "src/report.ts", expectedCount: 1, public: true }
   ]
 };
@@ -3922,34 +3961,17 @@ var BUILTIN_ERROR_CONSTRUCTORS = /* @__PURE__ */ new Set([
   "URIError"
 ]);
 function identifierIsProvenError(identifier, scope) {
-  if (isCatchBinding(scope, identifier.name)) return true;
-  let current = scope;
-  while (current !== null && !current.set.has(identifier.name)) {
-    current = current.upper;
-  }
-  const variable = current?.set.get(identifier.name);
-  if (variable === void 0 || variable.defs.length !== 1) return false;
+  const variable = ASTUtils5.findVariable(scope, identifier.name);
+  if (variable === null || variable.defs.length !== 1 || variable.references.some((reference) => reference.isWrite() && reference.init !== true)) return false;
   const definition = variable.defs[0];
+  if (definition?.type === "CatchClause") return true;
   if (definition?.type !== "Variable") return false;
   const initializer = definition.node.init;
-  return initializer?.type === "NewExpression" && initializer.callee.type === "Identifier" && BUILTIN_ERROR_CONSTRUCTORS.has(initializer.callee.name) && variable.references.every(
-    (reference) => !reference.isWrite() || reference.init === true
-  );
+  return initializer?.type === "NewExpression" && initializer.callee.type === "Identifier" && BUILTIN_ERROR_CONSTRUCTORS.has(initializer.callee.name) && isGlobalIdentifier(initializer.callee.name, scope);
 }
-function isCatchBinding(scope, name) {
-  let current = scope;
-  while (current) {
-    const variable = current.set.get(name);
-    if (variable) {
-      for (const def of variable.defs) {
-        if (def.type === "CatchClause") {
-          return true;
-        }
-      }
-    }
-    current = current.upper;
-  }
-  return false;
+function isGlobalIdentifier(name, scope) {
+  const binding = ASTUtils5.findVariable(scope, name);
+  return binding === null || binding.defs.length === 0;
 }
 function positiveErrorSubject(test) {
   return instanceofErrorSubject(test) ?? typeGuardSubject(test);
@@ -4057,7 +4079,7 @@ function expressionSuggestsError(expression, scope) {
     return identifierIsProvenError(expression, scope);
   }
   if (expression.type === "NewExpression" && expression.callee.type === "Identifier") {
-    return BUILTIN_ERROR_CONSTRUCTORS.has(expression.callee.name);
+    return BUILTIN_ERROR_CONSTRUCTORS.has(expression.callee.name) && isGlobalIdentifier(expression.callee.name, scope);
   }
   return expression.type === "MemberExpression" && memberSuggestsError(expression, scope);
 }
@@ -4080,11 +4102,11 @@ var no_json_stringify_error_default = createRule({
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow `JSON.stringify` on an Error value; it yields `{}` because `message`/`stack` are non-enumerable."
+      description: "Avoid generic JSON serialization that can omit native Error details."
     },
     schema: [],
     messages: {
-      noJsonStringifyError: "`JSON.stringify` on an Error yields `{}` because `message`/`stack` are non-enumerable. Log `err.message` / `err.stack`, or use a proper error serializer."
+      noJsonStringifyError: "Generic `JSON.stringify` can omit non-enumerable Error details such as message and stack. Serialize explicit fields or use an error-aware serializer."
     }
   },
   defaultOptions: [],
@@ -4099,6 +4121,9 @@ var no_json_stringify_error_default = createRule({
           return;
         }
         const scope = context.sourceCode.getScope(firstArg);
+        if (!isGlobalIdentifier("JSON", scope)) return;
+        const replacer = node.arguments[1];
+        if (replacer !== void 0 && !(replacer.type === "Literal" && replacer.value === null) && !(replacer.type === "Identifier" && replacer.name === "undefined" && isGlobalIdentifier("undefined", scope))) return;
         const unsafeValue = directLiteralValues(firstArg).find(
           (value) => expressionSuggestsError(value, scope) && !isGuardedByInstanceofError(node, value, context.sourceCode) && !isNarrowedByEarlyReturn(node, value, context.sourceCode)
         );
@@ -4456,8 +4481,8 @@ function privateMemberFixes(context, services, owner, members, removePrivateKeyw
       return;
     }
     if (node.type !== AST_NODE_TYPES16.MemberExpression) return;
-    const propertyName8 = node.property.type === AST_NODE_TYPES16.Identifier || node.property.type === AST_NODE_TYPES16.PrivateIdentifier ? node.property.name : node.property.type === AST_NODE_TYPES16.Literal && typeof node.property.value === "string" ? node.property.value : null;
-    if (propertyName8 !== name) return;
+    const propertyName6 = node.property.type === AST_NODE_TYPES16.Identifier || node.property.type === AST_NODE_TYPES16.PrivateIdentifier ? node.property.name : node.property.type === AST_NODE_TYPES16.Literal && typeof node.property.value === "string" ? node.property.value : null;
+    if (propertyName6 !== name) return;
     const propertySymbol = symbolAt(services, checker, node.property);
     if (node.computed || node.property.type !== AST_NODE_TYPES16.Identifier || node.object.type !== AST_NODE_TYPES16.ThisExpression || enclosingClass(node) !== owner || !symbols.some((symbol) => sameSymbol(symbol, propertySymbol))) {
       unsafe = true;
@@ -4620,7 +4645,7 @@ var interface_contract_members_private_default = createRule({
 });
 
 // src/rules/no-log-only-catch.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES18, ASTUtils as ASTUtils4 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES18, ASTUtils as ASTUtils6 } from "@typescript-eslint/utils";
 
 // src/rules/_logging.ts
 import "@typescript-eslint/utils";
@@ -4792,7 +4817,7 @@ function seededFallbackHandled(tryStatement, scope) {
   if (previous.declarations.length !== 1 || declarator === void 0) return false;
   if (declarator.id.type !== AST_NODE_TYPES18.Identifier) return false;
   if (declarator.init == null || !isSeedValue(declarator.init)) return false;
-  const variable = ASTUtils4.findVariable(scope, declarator.id.name);
+  const variable = ASTUtils6.findVariable(scope, declarator.id.name);
   if (variable === null) return false;
   const [tryStart, tryEnd] = tryStatement.block.range;
   let writtenInTry = false;
@@ -4897,7 +4922,7 @@ var no_log_only_catch_default = createRule({
 });
 
 // src/rules/no-bare-return-from-test-catch.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES19, ASTUtils as ASTUtils5 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES19, ASTUtils as ASTUtils7 } from "@typescript-eslint/utils";
 var NO_BARE_RETURN_FROM_TEST_CATCH_DOCUMENTATION = {
   summary: "Disallow a bare return from a test catch block when it skips a later assertion.",
   rationale: "The caught failure turns into a passing test without executing the assertion that follows it.",
@@ -4922,7 +4947,7 @@ function staticMemberName2(node) {
   return null;
 }
 function importedName3(identifier, context, modules) {
-  const variable = ASTUtils5.findVariable(context.sourceCode.getScope(identifier), identifier.name);
+  const variable = ASTUtils7.findVariable(context.sourceCode.getScope(identifier), identifier.name);
   if (variable === null || variable.defs.length === 0) return identifier.name;
   for (const definition of variable.defs) {
     if (definition.node.type !== AST_NODE_TYPES19.ImportSpecifier) continue;
@@ -5062,7 +5087,7 @@ var ADAPTER_BASENAME_RE = /(?:^|[-_.])adapters?(?:[-_.]|$)/i;
 var API_BOUNDARY_IMPORT_RE = /(?:^|[/_.-])(?:api|client|sdk|contract|generated)(?:$|[/_.-])/i;
 var SNAKE_CASE_RE = /^[a-z][a-z0-9]*(?:_[a-z0-9]+)+$/;
 var LOWER_CAMEL_CASE_RE = /^[a-z][A-Za-z0-9]*$/;
-function propertyName2(node) {
+function propertyName(node) {
   return node.type === AST_NODE_TYPES20.Identifier ? node.name : null;
 }
 function memberName3(node) {
@@ -5112,7 +5137,7 @@ var no_bespoke_api_case_conversion_default = createRule({
     return {
       Property(node) {
         if (node.computed || node.method || node.shorthand) return;
-        const key = propertyName2(node.key);
+        const key = propertyName(node.key);
         const value = memberName3(node.value);
         if (key === null || value === null || !isDirectCaseTranslation(key, value)) return;
         const wireName = SNAKE_CASE_RE.test(key) ? key : value;
@@ -5306,7 +5331,7 @@ var no_vague_suppression_description_default = createRule({
 });
 
 // src/rules/no-generic-single-export-module.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES22, ASTUtils as ASTUtils6 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES22, ASTUtils as ASTUtils8 } from "@typescript-eslint/utils";
 var NO_GENERIC_SINGLE_EXPORT_MODULE_DOCUMENTATION = {
   summary: "Disallow generic module stems when one runtime export already names the responsibility.",
   rationale: "A generic filename hides the sole exported responsibility and makes navigation less descriptive.",
@@ -5431,8 +5456,8 @@ function typeOnlyBindings(program) {
   }
   return new Set([...names].filter((name) => !runtimeNames.has(name)));
 }
-function isGlobalIdentifier(context, node) {
-  const variable = ASTUtils6.findVariable(context.sourceCode.getScope(node), node.name);
+function isGlobalIdentifier2(context, node) {
+  const variable = ASTUtils8.findVariable(context.sourceCode.getScope(node), node.name);
   return variable === null || variable.defs.length === 0;
 }
 function isConventionalFrameworkUtility(filename, exported) {
@@ -5463,11 +5488,11 @@ var no_generic_single_export_module_default = createRule({
     return {
       CallExpression(node) {
         const first = node.arguments[0];
-        if (first?.type === AST_NODE_TYPES22.Identifier && first.name === "exports" && isGlobalIdentifier(context, first) && node.callee.type === AST_NODE_TYPES22.MemberExpression && node.callee.object.type === AST_NODE_TYPES22.Identifier && node.callee.object.name === "Object" && isGlobalIdentifier(context, node.callee.object) && memberPropertyName(node.callee) !== null && CJS_OBJECT_EXPORT_METHODS.has(memberPropertyName(node.callee))) hasCommonJsExport = true;
+        if (first?.type === AST_NODE_TYPES22.Identifier && first.name === "exports" && isGlobalIdentifier2(context, first) && node.callee.type === AST_NODE_TYPES22.MemberExpression && node.callee.object.type === AST_NODE_TYPES22.Identifier && node.callee.object.name === "Object" && isGlobalIdentifier2(context, node.callee.object) && memberPropertyName(node.callee) !== null && CJS_OBJECT_EXPORT_METHODS.has(memberPropertyName(node.callee))) hasCommonJsExport = true;
       },
       MemberExpression(node) {
-        if (node.object.type === AST_NODE_TYPES22.Identifier && node.object.name === "exports" && isGlobalIdentifier(context, node.object)) hasCommonJsExport = true;
-        if (node.object.type === AST_NODE_TYPES22.Identifier && node.object.name === "module" && isGlobalIdentifier(context, node.object) && memberPropertyName(node) === "exports") hasCommonJsExport = true;
+        if (node.object.type === AST_NODE_TYPES22.Identifier && node.object.name === "exports" && isGlobalIdentifier2(context, node.object)) hasCommonJsExport = true;
+        if (node.object.type === AST_NODE_TYPES22.Identifier && node.object.name === "module" && isGlobalIdentifier2(context, node.object) && memberPropertyName(node) === "exports") hasCommonJsExport = true;
       },
       "Program:exit"(program) {
         if (hasCommonJsExport) return;
@@ -5905,7 +5930,6 @@ var no_positional_tuple_return_default = createRule({
 });
 
 // src/rules/no-production-browser-source-maps.ts
-import "@typescript-eslint/utils";
 var NEXT_CONFIG_RE2 = /(?:^|\/)next\.config\.[cm]?[jt]s$/;
 var NO_PRODUCTION_BROWSER_SOURCE_MAPS_DOCUMENTATION = {
   summary: "Next.js production browser source maps expose application source",
@@ -5913,7 +5937,7 @@ var NO_PRODUCTION_BROWSER_SOURCE_MAPS_DOCUMENTATION = {
   remediation: "Leave productionBrowserSourceMaps disabled and upload private source maps directly to the error-monitoring service during the build.",
   category: "security",
   limitations: [
-    "Only a literal true assigned in a next.config source file is reported; computed or imported configuration is intentionally not inferred."
+    "Only a literal true in the effective property of a directly exported object, unescaped const alias, or isolated module.exports object is reported. Wrappers, factories, spreads, computed keys and mutations are not inferred."
   ],
   examples: [
     {
@@ -5936,11 +5960,6 @@ var NO_PRODUCTION_BROWSER_SOURCE_MAPS_DOCUMENTATION = {
     }
   ]
 };
-function propertyName3(node) {
-  if (!node.computed && node.key.type === "Identifier") return node.key.name;
-  if (node.key.type === "Literal" && typeof node.key.value === "string") return node.key.value;
-  return null;
-}
 var no_production_browser_source_maps_default = createRule({
   name: "no-production-browser-source-maps",
   documentation: NO_PRODUCTION_BROWSER_SOURCE_MAPS_DOCUMENTATION,
@@ -5956,8 +5975,9 @@ var no_production_browser_source_maps_default = createRule({
   create(context) {
     if (!NEXT_CONFIG_RE2.test(context.filename.replaceAll("\\", "/"))) return {};
     return {
-      Property(node) {
-        if (propertyName3(node) === "productionBrowserSourceMaps" && node.value.type === "Literal" && node.value.value === true) {
+      "Program:exit"() {
+        const node = exportedNextConfigProperty(context.sourceCode, ["productionBrowserSourceMaps"]);
+        if (node !== null && node.value.type === "Literal" && node.value.value === true) {
           context.report({ node, messageId: "noProductionBrowserSourceMaps" });
         }
       }
@@ -5966,13 +5986,13 @@ var no_production_browser_source_maps_default = createRule({
 });
 
 // src/rules/no-raw-env.ts
-import "@typescript-eslint/utils";
+import { ASTUtils as ASTUtils9 } from "@typescript-eslint/utils";
 var NO_RAW_ENV_DOCUMENTATION = {
   summary: "Disallow direct `process.env` and `import.meta.env` reads outside validated boundaries.",
   rationale: "Raw environment reads are untyped and defer invalid configuration failures until use.",
   remediation: "Validate environment values at startup and import the typed configuration object.",
   category: "correctness",
-  limitations: ["Host markers, assignment targets, tests, scripts, build config, and validated boundaries are excluded."],
+  limitations: ["Host markers, assignment targets, tests, scripts, build config, and recognized validation-boundary files are policy exemptions. A validation call does not prove every export is validated; assignment-target exemptions also include compound writes that read the previous value."],
   examples: [
     { id: "validated-environment", title: "Read validated configuration", outcome: "no-match", files: [{ path: "src/database.ts", source: "import { env } from './env.js'; const url = env.DATABASE_URL;" }], focusPath: "src/database.ts", expectedCount: 0, public: true },
     { id: "raw-environment-read", title: "Do not read raw configuration", outcome: "match", files: [{ path: "src/database.ts", source: "const url = process.env.DATABASE_URL;" }], focusPath: "src/database.ts", expectedCount: 1, public: true }
@@ -5980,10 +6000,6 @@ var NO_RAW_ENV_DOCUMENTATION = {
 };
 var CONFIG_FILE_RE = /(^|[\\/])[\w.-]+\.config\.[cm]?[jt]sx?$/;
 var ENV_BOUNDARY_FILE_RE = /(^|[\\/])(?:env|client-env|server-env|client-settings|server-settings)\.[cm]?[jt]sx?$/;
-var ENV_VALIDATION_MARKER_RE = /\bcreateEnv\s*\(|\bz\.object\s*\(|\.(?:safeParse|parse)\s*\(/;
-function isValidatedEnvBoundary(filename, sourceText) {
-  return ENV_BOUNDARY_FILE_RE.test(filename.replaceAll("\\", "/")) && ENV_VALIDATION_MARKER_RE.test(sourceText);
-}
 function isProcessEnv(node) {
   return !node.computed && node.object.type === "Identifier" && node.object.name === "process" && node.property.type === "Identifier" && node.property.name === "env";
 }
@@ -6038,30 +6054,43 @@ var no_raw_env_default = createRule({
   defaultOptions: [],
   create(context) {
     const filename = context.filename;
-    if (isTestFile(filename) || isScriptFile(filename) || CONFIG_FILE_RE.test(filename.replaceAll("\\", "/")) || isValidatedEnvBoundary(filename, context.sourceCode.text)) {
+    if (isTestFile(filename) || isScriptFile(filename) || CONFIG_FILE_RE.test(filename.replaceAll("\\", "/"))) {
       return {};
     }
+    const reads = [];
+    const boundaryFile = ENV_BOUNDARY_FILE_RE.test(filename.replaceAll("\\", "/"));
+    let hasValidationCall = false;
     return {
+      CallExpression(node) {
+        if (!boundaryFile) return;
+        const callee = node.callee;
+        if (callee.type === "Identifier" && callee.name === "createEnv" || callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" && (["parse", "safeParse"].includes(callee.property.name) || callee.property.name === "object" && callee.object.type === "Identifier" && callee.object.name === "z")) hasValidationCall = true;
+      },
       MemberExpression(node) {
+        if (isProcessEnv(node) && node.object.type === "Identifier") {
+          const binding = ASTUtils9.findVariable(context.sourceCode.getScope(node), node.object.name);
+          if (binding !== null && binding.defs.length > 0 && !binding.defs.every((definition) => definition.type === "ImportBinding" && definition.parent.type === "ImportDeclaration" && ["node:process", "process"].includes(definition.parent.source.value) && ["ImportDefaultSpecifier", "ImportNamespaceSpecifier"].includes(definition.node.type))) return;
+        }
         if ((isProcessEnv(node) || isImportMetaEnv(node)) && !isExemptVariableAccess(node) && !isWriteTarget(node) && !isWholeEnvSpread(node)) {
-          context.report({
-            node,
-            messageId: "noRawEnv"
-          });
+          reads.push(node);
         }
+      },
+      "Program:exit"() {
+        if (boundaryFile && hasValidationCall) return;
+        for (const node of reads) context.report({ node, messageId: "noRawEnv" });
       }
     };
   }
 });
 
 // src/rules/no-raw-fetch-outside-clients.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES24, ASTUtils as ASTUtils7 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES24, ASTUtils as ASTUtils10 } from "@typescript-eslint/utils";
 var NO_RAW_FETCH_OUTSIDE_CLIENTS_DOCUMENTATION = {
   summary: "Disallow calling the global `fetch` outside the client layer; route outbound HTTP through a client module that owns retry, timeout and status handling.",
   rationale: "Scattered fetch calls bypass shared transport policy and are harder to stub and observe consistently.",
   remediation: "Move the request into a client module and call that abstraction from application code.",
   category: "architecture",
-  limitations: ["Tests, client-layer paths, constructed handoffs, and pre-signed URL transfers are excluded. Configure the same literal Next.js basePath here and on prefer-server-actions so one rule owns each internal mutation."],
+  limitations: ["Tests, client-layer paths, constructed handoffs, and pre-signed URL transfers are excluded. Configure the same literal Next.js basePath here and on prefer-server-actions so one rule owns each internal mutation.", "Effect and pre-signed-transfer exemptions use recognized syntax and naming conventions, not complete React or URL provenance. Those conservative exclusions are recall limitations, not evidence that every excluded request satisfies transport policy."],
   examples: [
     { id: "client-call", title: "Use a client abstraction", outcome: "no-match", files: [{ path: "src/routes/handler.ts", source: "const response = await billingClient.getInvoice(id);" }], focusPath: "src/routes/handler.ts", expectedCount: 0, public: true },
     { id: "raw-fetch", title: "Do not call global fetch here", outcome: "match", files: [{ path: "src/routes/handler.ts", source: "const response = await fetch('/api/invoices');" }], focusPath: "src/routes/handler.ts", expectedCount: 1, public: true }
@@ -6243,7 +6272,7 @@ var no_raw_fetch_outside_clients_default = createRule({
       internalApiPrefixes.push(`${options.basePath}/api`);
     }
     function resolvesToGlobal(identifier) {
-      const variable = ASTUtils7.findVariable(
+      const variable = ASTUtils10.findVariable(
         context.sourceCode.getScope(identifier),
         identifier.name
       );
@@ -6252,17 +6281,18 @@ var no_raw_fetch_outside_clients_default = createRule({
     function resolveNode2(node) {
       if (node === void 0) return null;
       if (node.type !== AST_NODE_TYPES24.Identifier) return node;
-      const variable = ASTUtils7.findVariable(
+      const variable = ASTUtils10.findVariable(
         context.sourceCode.getScope(node),
         node.name
       );
       if (variable?.defs.length !== 1) return node;
       const definition = variable.defs[0];
-      return definition?.type === "Variable" && definition.node.init !== null ? definition.node.init : node;
+      return definition?.type === "Variable" && definition.parent.kind === "const" && definition.node.init !== null && !variable.references.some((reference) => reference.isWrite() && reference.init !== true) && !(definition.node.init.type === AST_NODE_TYPES24.ObjectExpression && variable.references.some((reference) => reference.identifier !== node && reference.init !== true)) ? definition.node.init : node;
     }
     function propertyValue(node, name) {
       if (node?.type !== AST_NODE_TYPES24.ObjectExpression) return null;
-      for (const property of node.properties) {
+      if (node.properties.some((property) => property.type !== AST_NODE_TYPES24.Property || property.computed)) return null;
+      for (const property of [...node.properties].reverse()) {
         if (property.type !== AST_NODE_TYPES24.Property || property.computed) continue;
         const key = property.key;
         const keyName = key.type === AST_NODE_TYPES24.Identifier ? key.name : key.type === AST_NODE_TYPES24.Literal && typeof key.value === "string" ? key.value : null;
@@ -6330,7 +6360,7 @@ var no_raw_fetch_outside_clients_default = createRule({
 });
 
 // src/rules/no-restricted-library-load.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES25, ASTUtils as ASTUtils8 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES25, ASTUtils as ASTUtils11 } from "@typescript-eslint/utils";
 var NO_RESTRICTED_LIBRARY_LOAD_DOCUMENTATION = {
   summary: "Apply a configured library-replacement policy to literal dynamic imports, CommonJS loads, and TypeScript import-equals declarations.",
   rationale: "Runtime module loads can bypass the replacement policy enforced for static imports.",
@@ -6403,7 +6433,7 @@ var no_restricted_library_load_default = createRule({
       });
     }
     function isUnshadowedRequire(node) {
-      const variable = ASTUtils8.findVariable(
+      const variable = ASTUtils11.findVariable(
         context.sourceCode.getScope(node),
         node.name
       );
@@ -6435,7 +6465,7 @@ var no_restricted_library_load_default = createRule({
 });
 
 // src/rules/no-router-refresh-polling.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES26, ASTUtils as ASTUtils9 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES26, ASTUtils as ASTUtils12 } from "@typescript-eslint/utils";
 var NO_ROUTER_REFRESH_POLLING_DOCUMENTATION = {
   summary: "Do not poll by calling a Next.js router's refresh method from a timer.",
   rationale: "A route refresh refetches and rerenders the whole route on every tick instead of loading the named resource that changed.",
@@ -6443,8 +6473,8 @@ var NO_ROUTER_REFRESH_POLLING_DOCUMENTATION = {
   category: "performance",
   limitations: ["Only router bindings created from next/navigation useRouter and direct setInterval or window.setInterval callbacks are inspected; generated and test files are excluded."],
   examples: [
-    { id: "poll-named-action", title: "Poll a named action", outcome: "no-match", files: [{ path: "src/status.tsx", source: 'import { useRouter } from "next/navigation"; const router = useRouter(); setInterval(() => fetchStatus(), POLLING_INTERVAL_MS);' }], focusPath: "src/status.tsx", expectedCount: 0, public: true },
-    { id: "poll-router-refresh", title: "Do not poll the whole route", outcome: "match", files: [{ path: "src/status.tsx", source: 'import { useRouter } from "next/navigation"; const router = useRouter(); setInterval(() => router.refresh(), POLLING_INTERVAL_MS);' }], focusPath: "src/status.tsx", expectedCount: 1, public: true }
+    { id: "poll-named-action", title: "Poll a named resource", outcome: "no-match", files: [{ path: "src/status.tsx", source: '"use client"; import { useEffect } from "react"; function Status() { useEffect(() => { const timer = setInterval(() => fetchStatus(), POLLING_INTERVAL_MS); return () => clearInterval(timer); }, []); return null; }' }], focusPath: "src/status.tsx", expectedCount: 0, public: true },
+    { id: "poll-router-refresh", title: "Do not poll the whole route", outcome: "match", files: [{ path: "src/status.tsx", source: '"use client"; import { useEffect } from "react"; import { useRouter } from "next/navigation"; function Status() { const router = useRouter(); useEffect(() => { const timer = setInterval(() => router.refresh(), POLLING_INTERVAL_MS); return () => clearInterval(timer); }, [router]); return null; }' }], focusPath: "src/status.tsx", expectedCount: 1, public: true }
   ]
 };
 function importedName4(node) {
@@ -6454,6 +6484,7 @@ function enclosingIntervalCallback(sourceCode, node) {
   const ancestors = sourceCode.getAncestors(node);
   for (let index = ancestors.length - 1; index >= 0; index -= 1) {
     const ancestor = ancestors[index];
+    if (ancestor?.type === AST_NODE_TYPES26.FunctionDeclaration) return null;
     if (ancestor?.type !== AST_NODE_TYPES26.ArrowFunctionExpression && ancestor?.type !== AST_NODE_TYPES26.FunctionExpression) continue;
     const parent = ancestor.parent;
     return parent.type === AST_NODE_TYPES26.CallExpression && parent.arguments[0] === ancestor && isIntervalCallee(sourceCode, parent.callee) ? ancestor : null;
@@ -6464,7 +6495,7 @@ function isIntervalCallee(sourceCode, node) {
   return node.type === AST_NODE_TYPES26.Identifier && node.name === "setInterval" && isUnshadowedGlobal2(sourceCode, node) || node.type === AST_NODE_TYPES26.MemberExpression && !node.computed && node.object.type === AST_NODE_TYPES26.Identifier && (node.object.name === "window" || node.object.name === "globalThis") && isUnshadowedGlobal2(sourceCode, node.object) && node.property.type === AST_NODE_TYPES26.Identifier && node.property.name === "setInterval";
 }
 function isUnshadowedGlobal2(sourceCode, node) {
-  const variable = ASTUtils9.findVariable(sourceCode.getScope(node), node.name);
+  const variable = ASTUtils12.findVariable(sourceCode.getScope(node), node.name);
   return variable === null || variable.defs.length === 0;
 }
 var no_router_refresh_polling_default = createRule({
@@ -6487,25 +6518,25 @@ var no_router_refresh_polling_default = createRule({
         if (node.source.value !== "next/navigation") return;
         for (const specifier of node.specifiers) {
           if (specifier.type === AST_NODE_TYPES26.ImportSpecifier && importedName4(specifier) === "useRouter") {
-            const variable = ASTUtils9.findVariable(context.sourceCode.getScope(specifier.local), specifier.local.name);
+            const variable = ASTUtils12.findVariable(context.sourceCode.getScope(specifier.local), specifier.local.name);
             if (variable !== null) routerHooks.add(variable);
           }
         }
       },
       VariableDeclarator(node) {
         if (node.id.type === AST_NODE_TYPES26.Identifier && node.init?.type === AST_NODE_TYPES26.CallExpression && node.init.callee.type === AST_NODE_TYPES26.Identifier) {
-          const hook = ASTUtils9.findVariable(context.sourceCode.getScope(node.init.callee), node.init.callee.name);
-          const router = ASTUtils9.findVariable(context.sourceCode.getScope(node.id), node.id.name);
+          const hook = ASTUtils12.findVariable(context.sourceCode.getScope(node.init.callee), node.init.callee.name);
+          const router = ASTUtils12.findVariable(context.sourceCode.getScope(node.id), node.id.name);
           if (hook !== null && router !== null && routerHooks.has(hook)) routers.add(router);
         }
       },
       CallExpression(node) {
         if (node.callee.type !== AST_NODE_TYPES26.MemberExpression || node.callee.computed || node.callee.object.type !== AST_NODE_TYPES26.Identifier || node.callee.property.type !== AST_NODE_TYPES26.Identifier || node.callee.property.name !== "refresh") return;
-        const router = ASTUtils9.findVariable(
+        const router = ASTUtils12.findVariable(
           context.sourceCode.getScope(node.callee.object),
           node.callee.object.name
         );
-        if (router === null || !routers.has(router)) return;
+        if (router === null || !routers.has(router) || router.references.some((reference) => reference.isWrite() && reference.init !== true)) return;
         const callback = enclosingIntervalCallback(context.sourceCode, node);
         if (callback !== null && !reportedCallbacks.has(callback)) {
           reportedCallbacks.add(callback);
@@ -7191,11 +7222,11 @@ function isAuthSecretName(identifier) {
 var NO_SECRET_IN_LOG_DOCUMENTATION = {
   summary: "Disallow passing a secret-named value or a raw request/response blob to a logging call; both leak to log sinks. Redact or omit.",
   rationale: "Logs are widely retained and distributed, so credentials and raw bodies can become durable data leaks.",
-  remediation: "Omit the value or log an explicitly redacted, truncated, or derived non-sensitive field.",
+  remediation: "Omit the value, log allowlisted non-sensitive context, or use an approved redactor; truncation alone is not a safety guarantee.",
   category: "security",
-  limitations: ["Detection uses configurable logger names and statically recognizable secret names, raw-body names, and redaction markers."],
+  limitations: ["Detection uses configurable logger names and statically recognizable secret names, raw-body names, and redaction markers. Name-based exemptions are policy heuristics, not proof that a value is safely redacted."],
   examples: [
-    { id: "redacted-secret", title: "Log an explicitly redacted value", outcome: "no-match", files: [{ path: "src/auth.ts", source: "logger.info('auth', { tokenPrefix });" }], focusPath: "src/auth.ts", expectedCount: 0, public: true },
+    { id: "redacted-secret", title: "Log non-sensitive context instead of the secret", outcome: "no-match", files: [{ path: "src/auth.ts", source: "logger.info('auth', { requestId });" }], focusPath: "src/auth.ts", expectedCount: 0, public: true },
     { id: "logged-secret", title: "Do not send a secret to logs", outcome: "match", files: [{ path: "src/auth.ts", source: "logger.error('auth failed', { token });" }], focusPath: "src/auth.ts", expectedCount: 1, public: true }
   ]
 };
@@ -7247,13 +7278,14 @@ var LOG_INNOCUOUS_WORDS = /* @__PURE__ */ new Set([
 var REDACTION_RE = /prefix|suffix|redact|mask|hash|hint|_len|length/i;
 var WHOLE_TOKEN_REDACTION_MARKERS = /* @__PURE__ */ new Set(["tag"]);
 function isSecretKeyword(name) {
-  if (REDACTION_RE.test(name)) {
-    return false;
-  }
-  if (tokenize(name).some((tok) => WHOLE_TOKEN_REDACTION_MARKERS.has(tok))) {
-    return false;
-  }
-  return isSecretName(name, LOG_INNOCUOUS_WORDS);
+  return !hasRedactionMarker(name) && isSecretName(name, LOG_INNOCUOUS_WORDS);
+}
+function hasRedactionMarker(name) {
+  return REDACTION_RE.test(name) || tokenize(name).some((tok) => WHOLE_TOKEN_REDACTION_MARKERS.has(tok));
+}
+function valueName(node) {
+  if (node.type === "Identifier") return node.name;
+  return node.type === "MemberExpression" && !node.computed && node.property.type === "Identifier" ? node.property.name : null;
 }
 function isRawSecretValue(prop) {
   if (prop.shorthand) {
@@ -7337,8 +7369,8 @@ var no_secret_in_log_default = createRule({
       }
     ],
     messages: {
-      noSecretInLog: "Secret `{{name}}` passed to a logging call leaks it to log sinks. Redact (e.g. `{{name}}Prefix: {{name}}.slice(0, 6)`) or omit it.",
-      noRawBodyInLog: "Raw `{{name}}` passed to a logging call. Request/response blobs carry PII and often echo credentials back, and log sinks have no retention policy. Log a derived value instead (a status, `{{name}}.id`, a length, a truncated issue list) or pass it through a redactor (`redact({{name}})`)."
+      noSecretInLog: "Secret-like `{{name}}` passed to a logging call. Omit it or use an approved redactor; a prefix can expose an entire short secret.",
+      noRawBodyInLog: "Raw `{{name}}` passed to a logging call. Request/response bodies can contain personal data or credentials. Log allowlisted non-sensitive context or use an approved redactor."
     }
   },
   defaultOptions: [{}],
@@ -7346,7 +7378,7 @@ var no_secret_in_log_default = createRule({
     const matcher = createLogMatcher(loggingOptions);
     const blobArmApplies = !isTestFile(context.filename);
     function reportSecretArgument(arg) {
-      const name = arg.type === "Identifier" ? arg.name : arg.type === "MemberExpression" && !arg.computed && arg.property.type === "Identifier" ? arg.property.name : null;
+      const name = valueName(arg);
       if (name === null || !isSecretKeyword(name)) {
         return false;
       }
@@ -7355,10 +7387,13 @@ var no_secret_in_log_default = createRule({
     }
     function reportSecretProperty(prop) {
       const keyName = propertyKeyName2(prop);
-      if (keyName === null || !isSecretKeyword(keyName) || !isRawSecretValue(prop)) {
+      const value = valueName(prop.value);
+      if (value !== null && hasRedactionMarker(value)) return false;
+      const name = value !== null && isSecretKeyword(value) ? value : keyName;
+      if (name === null || !isSecretKeyword(name) || !isRawSecretValue(prop)) {
         return false;
       }
-      context.report({ node: prop, messageId: "noSecretInLog", data: { name: keyName } });
+      context.report({ node: prop, messageId: "noSecretInLog", data: { name } });
       return true;
     }
     function reportRawBlob(node, value) {
@@ -8829,9 +8864,48 @@ var RESULT_FILLER = /* @__PURE__ */ new Set([
   "the",
   "value"
 ]);
-function hasVacuousTypedTag(text) {
-  const tags = typedTags(text);
-  return tags.length > 0 && tags.some(isVacuousTag);
+function parameterTarget(parameter) {
+  if (parameter.type === "TSParameterProperty") return parameterTarget(parameter.parameter);
+  return parameter.type === "AssignmentPattern" ? parameter.left : parameter;
+}
+function documentedSignature(sourceCode, comment) {
+  const before = sourceCode.getTokenBefore(comment);
+  if (before?.loc.end.line === comment.loc.start.line) return null;
+  const token = sourceCode.getTokenAfter(comment);
+  if (token === null || token.loc.start.line !== comment.loc.end.line + 1) return null;
+  let node = sourceCode.getNodeByRangeIndex(token.range[0]);
+  while (node !== null && node.type !== "Program" && node.type !== "BlockStatement" && node.type !== "ClassBody") {
+    const signature = functionSignature(node);
+    if (signature !== null) {
+      return signature.returnType !== void 0 && signature.params.every((parameter) => {
+        const target = parameterTarget(parameter);
+        return "typeAnnotation" in target && target.typeAnnotation != null;
+      }) ? signature : null;
+    }
+    node = node.parent ?? null;
+  }
+  return null;
+}
+function functionSignature(node) {
+  switch (node.type) {
+    case "ExportNamedDeclaration":
+    case "ExportDefaultDeclaration":
+      return node.declaration === null ? null : functionSignature(node.declaration);
+    case "FunctionDeclaration":
+    case "FunctionExpression":
+    case "ArrowFunctionExpression":
+    case "TSDeclareFunction":
+    case "TSMethodSignature":
+      return node;
+    case "MethodDefinition":
+      return node.value;
+    case "VariableDeclaration": {
+      const init = node.declarations.length === 1 ? node.declarations[0]?.init : null;
+      return init?.type === "ArrowFunctionExpression" || init?.type === "FunctionExpression" ? init : null;
+    }
+    default:
+      return null;
+  }
 }
 function typedTags(text) {
   const tags = [];
@@ -8845,26 +8919,37 @@ function typedTags(text) {
     }
   }
   return tags.map(({ kind, payload }) => {
-    let rest = payload.replace(/^\{[^}\n]+\}\s*/u, "").trim();
+    const typeMatch = /^\{([^}\n]+)\}\s*/u.exec(payload);
+    const explicitType = typeMatch?.[1]?.trim() ?? null;
+    let rest = payload.slice(typeMatch?.[0].length ?? 0).trim();
     if (!PARAM_TAGS2.has(kind)) {
-      return { kind, name: null, description: rest.replace(/^-\s*/u, "").trim() };
+      return { kind, name: null, description: rest.replace(/^-\s+/u, "").trim(), explicitType };
     }
-    const match = /^(\[[^\]]+\]|[A-Za-z_$][\w$.[\]-]*)(?:\s+-\s*|\s+)?(.*)$/u.exec(rest);
-    if (match === null) return { kind, name: null, description: "" };
-    const rawName = (match[1] ?? "").replace(/^\[/u, "").replace(/\]$/u, "").split("=")[0] ?? "";
+    const match = /^(\[[^\]]+\]|[A-Za-z_$][\w$.[\]-]*)(?:\s+-\s+|\s+)?(.*)$/u.exec(rest);
+    const rawName = match?.[1] ?? "";
+    if (match === null || !/^[A-Za-z_$][\w$]*$/u.test(rawName)) return { kind, name: null, description: rest, explicitType };
     rest = (match[2] ?? "").trim();
-    return { kind, name: rawName, description: rest };
+    return { kind, name: rawName, description: rest, explicitType };
   });
 }
-function isVacuousTag(tag) {
+function isVacuousTag(tag, signature, sourceCode) {
+  let annotation = signature.returnType;
+  if (PARAM_TAGS2.has(tag.kind)) {
+    const parameter = signature.params.map(parameterTarget).find((node) => node.type === "Identifier" && node.name === tag.name);
+    if (parameter?.type !== "Identifier") return false;
+    annotation = parameter.typeAnnotation;
+  }
+  if (annotation === void 0) return false;
+  if (tag.explicitType !== null && (!/^(?:string|number|boolean|bigint|symbol|unknown|never|void|null|undefined)$/u.test(tag.explicitType) || sourceCode.getText(annotation.typeAnnotation) !== tag.explicitType)) return false;
+  if (/[^\p{L}\p{M}\s.,]/u.test(tag.description)) return false;
   const description = words(tag.description).map(canonicalWord);
-  if (description.length === 0) return true;
+  if (description.length === 0) return tag.description.length === 0;
   if (tag.name === null) return description.every((word) => RESULT_FILLER.has(word));
   const nameWords2 = new Set(words(tag.name).map(canonicalWord));
   return description.every((word) => PARAMETER_FILLER.has(word) || nameWords2.has(word));
 }
 function words(text) {
-  return text.replaceAll(/([a-z0-9])([A-Z])/gu, "$1 $2").toLowerCase().match(/[a-z][a-z0-9]*/gu) ?? [];
+  return text.replaceAll(/([a-z0-9])([A-Z])/gu, "$1 $2").toLowerCase().match(/[\p{L}\p{M}][\p{L}\p{M}\p{N}]*/gu) ?? [];
 }
 function canonicalWord(word) {
   if (["identifier", "identifiers", "ids"].includes(word)) return "id";
@@ -8876,7 +8961,7 @@ var NO_TYPED_DOC_SECTIONS_DOCUMENTATION = {
   rationale: "Parameter and return tags repeat typed signatures and can drift without adding runtime behavior or constraints.",
   remediation: "Remove repeated parameter and return tags; retain documentation for behavior, failures, and external contracts.",
   category: "maintainability",
-  limitations: ["Description-free or name-restating parameter and return tags are reported only when the documented function has corresponding explicit TypeScript types."],
+  limitations: ["Description-free or name-restating tags require the adjacent explicitly typed signature and a corresponding parameter name. Optional/defaulted or nested parameter tags and unproven explicit JSDoc types are preserved."],
   examples: [
     {
       id: "behavioral-documentation",
@@ -8914,7 +8999,8 @@ var no_typed_doc_sections_default = createRule({
     return {
       Program() {
         for (const group of proseGroups(context.filename, context.sourceCode, true)) {
-          if (group.hasTypedTags && hasVacuousTypedTag(group.text) && documentsTypedFunction(context.sourceCode, group.comment)) {
+          const signature = documentedSignature(context.sourceCode, group.comment);
+          if (group.hasTypedTags && signature !== null && typedTags(group.text).some((tag) => isVacuousTag(tag, signature, context.sourceCode))) {
             context.report({ node: group.comment, messageId: "typedSection" });
           }
         }
@@ -8924,7 +9010,7 @@ var no_typed_doc_sections_default = createRule({
 });
 
 // src/rules/no-trailing-value-narration.ts
-import "@typescript-eslint/utils";
+import { AST_TOKEN_TYPES as AST_TOKEN_TYPES2 } from "@typescript-eslint/utils";
 var NO_TRAILING_VALUE_NARRATION_DOCUMENTATION = {
   summary: "Flag a trailing comment that repeats the line's numeric value only to name its unit.",
   rationale: "A repeated value can disagree with the expression after either the code or comment changes.",
@@ -8932,7 +9018,7 @@ var NO_TRAILING_VALUE_NARRATION_DOCUMENTATION = {
   category: "maintainability",
   autofix: "suggestion",
   aliases: ["trailing-value-narration"],
-  limitations: ["Only trailing comments with numeric values and recognized unit words are inspected."],
+  limitations: ["Only attached declaration, property, or assignment values containing numeric tokens and comments with recognized unit words are inspected. Deletion requires a numeric literal and the same unit on its owner. Constraints, additional prose, unknown expressions on unit-bearing owners, and cross-unit annotations are preserved; conversions are not evaluated."],
   examples: [
     {
       id: "explain-constraint",
@@ -8955,7 +9041,7 @@ var NO_TRAILING_VALUE_NARRATION_DOCUMENTATION = {
   ]
 };
 var NUMBER_RE = /(?<![\w.])(\d+(?:\.\d+)?)(?![\w.])/g;
-var WORD_RE3 = /[A-Za-z]+(?:'[a-z]+)?|\d+(?:\.\d+)?/g;
+var WORD_RE3 = /[\p{L}\p{M}]+(?:'[\p{L}\p{M}]+)?|\d+(?:\.\d+)?/gu;
 var UNIT_WORDS = /* @__PURE__ */ new Set([
   "bytes",
   "characters",
@@ -9017,9 +9103,9 @@ var STOPWORDS3 = /* @__PURE__ */ new Set([
 ]);
 var DIRECTIVE_RE5 = /^\s*(?:eslint\b|eslint-|sarj-noqa\b|@ts-|prettier|biome-|c8\b|v8\b|istanbul\b|todo\b|fixme\b|hack\b|xxx\b)/i;
 var UNIT_NAME_SUFFIX_RE = /(?:_(?:NS|US|MS|S|SEC|SECS|SECOND|SECONDS|MIN|MINS|MINUTE|MINUTES|HOUR|HOURS|DAY|DAYS|BYTE|BYTES|KB|MB|GB|HZ|KHZ|MHZ|PX)|(?:Ns|Us|Ms|Sec|Secs|Second|Seconds|Min|Mins|Minute|Minutes|Hour|Hours|Day|Days|Byte|Bytes|Kb|Mb|Gb|Hz|Khz|Mhz|Px))$/u;
-function narratesValue(body2, code) {
+function narratesValue(body2, code, codeNumbers) {
   if (body2.length === 0 || DIRECTIVE_RE5.test(body2) || hasExternalReference(body2)) return false;
-  const codeNumbers = numbersIn(code);
+  if (/[^\p{L}\p{M}\p{N}\s.,:()_]/u.test(body2)) return false;
   if (codeNumbers.size === 0) return false;
   const words2 = (body2.match(WORD_RE3) ?? []).map((word) => word.toLowerCase());
   if (words2.length === 0) return false;
@@ -9039,8 +9125,36 @@ function narratesValue(body2, code) {
 function numbersIn(text) {
   return new Set(text.match(NUMBER_RE) ?? []);
 }
-function nameAlreadyCarriesUnit(code) {
-  return (code.match(/[A-Za-z_$][\w$]*/gu) ?? []).some((identifier) => UNIT_NAME_SUFFIX_RE.test(identifier));
+function canonicalUnit(word) {
+  switch (word) {
+    case "milliseconds":
+      return "ms";
+    case "sec":
+    case "secs":
+    case "second":
+    case "seconds":
+      return "s";
+    case "mins":
+    case "minute":
+    case "minutes":
+      return "min";
+    case "hr":
+    case "hrs":
+    case "hours":
+      return "hour";
+    case "days":
+      return "day";
+    case "bytes":
+      return "byte";
+    default:
+      return word;
+  }
+}
+function identifierUnit(node) {
+  if (node.type === "MemberExpression" && !node.computed) return identifierUnit(node.property);
+  if (node.type !== "Identifier") return null;
+  const suffix = UNIT_NAME_SUFFIX_RE.exec(node.name)?.[0];
+  return suffix === void 0 ? null : canonicalUnit(suffix.replace(/^_/u, "").toLowerCase());
 }
 var no_trailing_value_narration_default = createRule({
   name: "no-trailing-value-narration",
@@ -9054,7 +9168,7 @@ var no_trailing_value_narration_default = createRule({
     schema: [],
     messages: {
       deleteNarration: "Trailing comment restates the literal and the identifier already names its unit \u2014 delete the comment so it cannot drift.",
-      narratesValue: "Trailing comment restates the literal on this line \u2014 put the unit in the name (STALE_TIME_MS) so it cannot drift.",
+      narratesValue: "Consider putting the unit in the name if this comment only narrates the value; keep conversion details and constraints.",
       removeNarration: "Delete the redundant trailing narration."
     }
   },
@@ -9079,15 +9193,46 @@ var no_trailing_value_narration_default = createRule({
       }
       return false;
     }
+    function attachedValue(comment) {
+      let token = sourceCode.getTokenBefore(comment);
+      if (token?.value === ";" || token?.value === ",") token = sourceCode.getTokenBefore(token);
+      if (token === null) return null;
+      let node = sourceCode.getNodeByRangeIndex(token.range[0]);
+      while (node !== null && node.type !== "Program") {
+        if (node.range[1] <= comment.range[0]) {
+          if (node.type === "VariableDeclarator" && node.id.type === "Identifier" && node.init !== null) {
+            return { name: node.id, value: node.init };
+          }
+          if (node.type === "Property" && !node.computed && node.kind === "init" && node.parent.type === "ObjectExpression") {
+            return { name: node.key, value: node.value };
+          }
+          if (node.type === "PropertyDefinition" && !node.computed && node.value !== null) {
+            return { name: node.key, value: node.value };
+          }
+          if (node.type === "AssignmentExpression" && node.operator === "=") {
+            if (node.left.type !== "Identifier" && (node.left.type !== "MemberExpression" || node.left.computed)) return null;
+            return { name: node.left, value: node.right };
+          }
+        }
+        node = node.parent ?? null;
+      }
+      return null;
+    }
     return {
       Program() {
         for (const comment of sourceCode.getAllComments()) {
           if (!isTrailing(comment) || isInsideBrackets(comment)) continue;
-          const line = sourceCode.lines[comment.loc.start.line - 1] ?? "";
-          const code = line.slice(0, comment.loc.start.column);
+          const attached = attachedValue(comment);
+          if (attached === null) continue;
+          const code = `${sourceCode.getText(attached.name)} ${sourceCode.getText(attached.value)}`;
+          const codeNumbers = new Set(sourceCode.getTokens(attached.value).filter((token) => token.type === AST_TOKEN_TYPES2.Numeric).flatMap((token) => [...numbersIn(token.value)]));
           const body2 = comment.value.replace(/^\*+/, "").replace(/\*+$/, "").trim();
-          if (narratesValue(body2, code)) {
-            const canDelete = nameAlreadyCarriesUnit(code);
+          if (narratesValue(body2, code, codeNumbers)) {
+            const namedUnit = identifierUnit(attached.name);
+            if (namedUnit !== null && (attached.value.type !== "Literal" || typeof attached.value.value !== "number")) continue;
+            const units = (body2.match(WORD_RE3) ?? []).map((word) => word.toLowerCase()).filter((word) => UNIT_WORDS.has(word));
+            if (namedUnit !== null && !units.every((word) => canonicalUnit(word) === namedUnit)) continue;
+            const canDelete = namedUnit !== null;
             const removal = canDelete ? trailingCommentRemovalRange(sourceCode.text, comment) : null;
             context.report({
               node: comment,
@@ -9107,10 +9252,10 @@ var no_trailing_value_narration_default = createRule({
 });
 
 // src/rules/no-declaration-comment-wall.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES36, AST_TOKEN_TYPES as AST_TOKEN_TYPES3 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES36, AST_TOKEN_TYPES as AST_TOKEN_TYPES4 } from "@typescript-eslint/utils";
 
 // src/rules/_comment-wall.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES35, AST_TOKEN_TYPES as AST_TOKEN_TYPES2 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES35, AST_TOKEN_TYPES as AST_TOKEN_TYPES3 } from "@typescript-eslint/utils";
 var WALL_DEFAULTS = {
   // Below three rows "a wall" is not a fair description of what the reader sees.
   minCommentedMembers: 3,
@@ -9176,7 +9321,7 @@ function commentBody(comment) {
   return comment.value.replace(/^\*+/, "").replace(/^[ \t]*\*[ \t]?/gm, "").trim();
 }
 function hasJsDocTag(comment) {
-  return comment.type === AST_TOKEN_TYPES2.Block && comment.value.startsWith("*") && /(?:^|\s)@[A-Za-z][\w-]*\b/u.test(commentBody(comment));
+  return comment.type === AST_TOKEN_TYPES3.Block && comment.value.startsWith("*") && /(?:^|\s)@[A-Za-z][\w-]*\b/u.test(commentBody(comment));
 }
 function carriesValue(body2) {
   return isProtected(body2) || VALUE_TAG_RE2.test(body2) || DEFAULT_RE.test(body2) || DIGIT_RE.test(body2) || UNIT_WORD_RE.test(body2) || EXAMPLE_RE.test(body2) || BANNER_RE.test(body2) || NON_ASCII_LETTER_RE2.test(body2);
@@ -9312,7 +9457,7 @@ var no_declaration_comment_wall_default = createRule({
         const before = sourceCode.getTokenBefore(lead, { includeComments: false });
         if (before === null || before.loc.end.line < lead.loc.start.line) {
           const previousLine = endingOn.get(lead.loc.start.line - 1);
-          if (lead.type === AST_TOKEN_TYPES3.Line && previousLine?.type === AST_TOKEN_TYPES3.Line && previousLine.loc.start.column === lead.loc.start.column) {
+          if (lead.type === AST_TOKEN_TYPES4.Line && previousLine?.type === AST_TOKEN_TYPES4.Line && previousLine.loc.start.column === lead.loc.start.column) {
             return void 0;
           }
           return lead;
@@ -9382,10 +9527,10 @@ var no_declaration_comment_wall_default = createRule({
 import { AST_NODE_TYPES as AST_NODE_TYPES37 } from "@typescript-eslint/utils";
 var NO_UNION_IN_COMMENT_DOCUMENTATION = {
   summary: "Flag a comment that lists a `string` field's allowed values instead of the type listing them.",
-  rationale: "A comment cannot prevent callers from supplying strings outside the listed set, and the list can drift from runtime behavior.",
-  remediation: "Move the allowed values into a string-literal union and remove the redundant comment.",
-  category: "correctness",
-  limitations: ["Only bare quoted-value lists attached to supported string declarations and schema-builder fields are inspected."],
+  rationale: "A broad string annotation does not express a closed set documented beside it.",
+  remediation: "If the list is exhaustive, express it as a string-literal union; keep examples and runtime constraints documented separately.",
+  category: "maintainability",
+  limitations: ["Only bare quoted-value lists directly attached to explicitly annotated string declarations are inspected. Unknown schema builders and runtime validation are not inferred."],
   examples: [
     {
       id: "literal-union",
@@ -9412,16 +9557,6 @@ var LITERAL = String.raw`(?:'[^'\n]*'|"[^"\n]*"|\`[^\`\n]*\`)`;
 var LEAD_IN_RE2 = /^(?:one of|either|values?|allowed(?: values)?|options?|possible(?: values)?)\s*[:=-]?\s*/i;
 var UNION_BODY_RE = new RegExp(String.raw`^${LITERAL}(?:\s*[|,/]\s*${LITERAL})+\.?$`);
 var LITERAL_G = new RegExp(LITERAL, "g");
-var STRING_BUILDERS = /* @__PURE__ */ new Set([
-  "char",
-  "citext",
-  "longtext",
-  "mediumtext",
-  "string",
-  "text",
-  "tinytext",
-  "varchar"
-]);
 function isBareString(node) {
   if (node === void 0) return false;
   switch (node.type) {
@@ -9446,12 +9581,6 @@ function targetOf(node) {
       if (name === null || !isBareString(node.typeAnnotation?.typeAnnotation)) return null;
       return { node, name };
     }
-    case AST_NODE_TYPES37.Property: {
-      const name = node.computed || node.shorthand ? null : nameOf(node.key);
-      const callee = rootCallee(node.value);
-      if (name === null || callee === null || !STRING_BUILDERS.has(callee)) return null;
-      return { node, name };
-    }
     case AST_NODE_TYPES37.VariableDeclarator: {
       if (node.id.type !== AST_NODE_TYPES37.Identifier) return null;
       if (!isBareString(node.id.typeAnnotation?.typeAnnotation)) return null;
@@ -9461,24 +9590,6 @@ function targetOf(node) {
       return null;
   }
 }
-function rootCallee(node) {
-  let current = node;
-  for (let hops = 0; current != null && hops < 12; hops += 1) {
-    switch (current.type) {
-      case AST_NODE_TYPES37.CallExpression:
-        current = current.callee;
-        break;
-      case AST_NODE_TYPES37.MemberExpression:
-        current = current.object;
-        break;
-      case AST_NODE_TYPES37.Identifier:
-        return current.name;
-      default:
-        return null;
-    }
-  }
-  return null;
-}
 function nameOf(key) {
   if (key.type === AST_NODE_TYPES37.Identifier) return key.name;
   if (key.type === AST_NODE_TYPES37.Literal && typeof key.value === "string") return key.value;
@@ -9503,7 +9614,7 @@ var no_union_in_comment_default = createRule({
     },
     schema: [],
     messages: {
-      unionInComment: 'This comment is a type \u2014 `{{name}}` still accepts every string, so the set it lists is enforced by nobody. Make it a string-literal union ("{{first}}" | \u2026) and delete the comment.'
+      unionInComment: 'The annotation for `{{name}}` accepts arbitrary strings. If this list is exhaustive, express it as a string-literal union ("{{first}}" | \u2026); retain separate runtime constraints or examples.'
     }
   },
   defaultOptions: [],
@@ -9528,7 +9639,11 @@ var no_union_in_comment_default = createRule({
       }
       for (let node = anchor; node != null && node.type !== AST_NODE_TYPES37.Program; node = node.parent) {
         const target = targetOf(node);
-        if (target !== null) return target;
+        if (target !== null) {
+          const follows = target.node.range[1] <= comment.range[0] && target.node.loc.end.line === comment.loc.start.line;
+          const precedes = comment.range[1] <= target.node.range[0] && comment.loc.end.line + 1 === target.node.loc.start.line;
+          return follows || precedes ? target : null;
+        }
       }
       return null;
     }
@@ -9541,8 +9656,6 @@ var no_union_in_comment_default = createRule({
           if (literals === null) continue;
           const target = annotated(comment);
           if (target === null) continue;
-          const declaration = sourceCode.getText(target.node);
-          if (literals.every((literal) => declaration.includes(literal))) continue;
           context.report({
             node: comment,
             messageId: "unionInComment",
@@ -9555,13 +9668,14 @@ var no_union_in_comment_default = createRule({
 });
 
 // src/rules/no-type-member-comment-wall.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES38, AST_TOKEN_TYPES as AST_TOKEN_TYPES4 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES38, AST_TOKEN_TYPES as AST_TOKEN_TYPES5 } from "@typescript-eslint/utils";
+var BEHAVIORAL_RELATION_RE = /\b(?:not|no|never|only|must|shall|should|may|can|could|will|would|required|optional|if|unless|when|before|after|until|while|without|instead|true|false|null|undefined)\b|[<>=!]/iu;
 var NO_TYPE_MEMBER_COMMENT_WALL_DOCUMENTATION = {
   summary: "Flag an object type whose member comments mostly re-spell the members' own names and types.",
   rationale: "Repetitive member comments add scanning cost while hiding the comments that describe facts absent from the type.",
   remediation: "Delete comments that restate member names or types and keep comments that add constraints or behavior.",
   category: "maintainability",
-  limitations: ["Only interface and type-literal bodies meeting the configured comment-count and restatement-ratio thresholds are reported."],
+  limitations: ["Only interface and type-literal bodies meeting the configured comment-count and restatement-ratio thresholds are reported. Negation, requirements, conditional relations, and fixed-value contracts are not counted as restatements. The novel-word threshold is a review heuristic, not proof that a comment contains no useful contract."],
   examples: [
     {
       id: "uncommented-members",
@@ -9596,7 +9710,7 @@ var no_type_member_comment_wall_default = createRule({
     },
     schema: [WALL_SCHEMA],
     messages: {
-      commentWall: "{{restated}} of this type's {{commented}} member comments only re-spell names and types \u2014 delete them; if a row still needs narration, improve its name or type. Keep constraints and rationale."
+      commentWall: "{{restated}} of this type's {{commented}} member comments appear to repeat names and types \u2014 review them for removal or clearer naming. Keep constraints and rationale."
     }
   },
   defaultOptions: [WALL_DEFAULTS],
@@ -9620,7 +9734,7 @@ var no_type_member_comment_wall_default = createRule({
         const before = sourceCode.getTokenBefore(lead, { includeComments: false });
         if (before === null || before.loc.end.line < lead.loc.start.line) {
           const previousLine = endingOn.get(lead.loc.start.line - 1);
-          if (lead.type === AST_TOKEN_TYPES4.Line && previousLine?.type === AST_TOKEN_TYPES4.Line && previousLine.loc.start.column === lead.loc.start.column) {
+          if (lead.type === AST_TOKEN_TYPES5.Line && previousLine?.type === AST_TOKEN_TYPES5.Line && previousLine.loc.start.column === lead.loc.start.column) {
             return void 0;
           }
           return lead;
@@ -9654,7 +9768,7 @@ var no_type_member_comment_wall_default = createRule({
         claimed.add(comment);
         commented += 1;
         const body2 = commentBody(comment);
-        if (body2.length === 0 || hasJsDocTag(comment) || carriesValue(body2) || isTagsOnly(body2)) {
+        if (body2.length === 0 || hasJsDocTag(comment) || carriesValue(body2) || isTagsOnly(body2) || BEHAVIORAL_RELATION_RE.test(body2)) {
           continue;
         }
         if (novelWords(body2, knownTokens(sourceCode.getText(member))) <= options.maxNovelWords) {
@@ -9684,9 +9798,9 @@ import { AST_NODE_TYPES as AST_NODE_TYPES39 } from "@typescript-eslint/utils";
 var NO_UNNECESSARY_USE_CLIENT_DOCUMENTATION = {
   summary: "Flag `'use client'` files with no hooks or event handlers \u2014 they could be RSC.",
   rationale: "An unnecessary client boundary sends the component and its transitive dependencies to the browser without using client-only behavior.",
-  remediation: "Remove the directive, or keep it only when the module uses a supported client-side API or boundary dependency.",
+  remediation: "Review whether the directive can be removed after checking transitive client requirements and intended export boundaries; local syntax alone does not prove server compatibility.",
   category: "performance",
-  limitations: ["Client need is inferred from recognized hooks, handlers, browser globals, exports, classes, and known client-only imports."],
+  limitations: ["Client need is inferred from recognized hooks, handlers, browser globals, exports, classes, and known client-only imports. Unknown side-effect imports preserve the boundary; arbitrary transitive runtime requirements are not inspected."],
   examples: [
     {
       id: "interactive-component",
@@ -9766,7 +9880,7 @@ var subtreeReadsImportedBinding = (node, imported) => {
   return false;
 };
 var isUseClientDirective = (node) => {
-  return node.type === AST_NODE_TYPES39.ExpressionStatement && node.expression.type === AST_NODE_TYPES39.Literal && node.expression.value === "use client";
+  return node.type === AST_NODE_TYPES39.ExpressionStatement && node.directive === "use client";
 };
 var isGlobalReference = (node, context) => {
   if (!BROWSER_GLOBALS.has(node.name)) return false;
@@ -9832,7 +9946,7 @@ var no_unnecessary_use_client_default = createRule({
     return {
       Program(node) {
         for (const stmt of node.body) {
-          if (stmt.type !== AST_NODE_TYPES39.ExpressionStatement) break;
+          if (stmt.type !== AST_NODE_TYPES39.ExpressionStatement || stmt.directive === void 0) break;
           if (isUseClientDirective(stmt)) {
             directiveNode = stmt;
             break;
@@ -9853,6 +9967,7 @@ var no_unnecessary_use_client_default = createRule({
         if (directiveNode === null) return;
         if (typeof node.source.value !== "string") return;
         const source = node.source.value;
+        if (node.importKind !== "type" && node.specifiers.length === 0) hasClientIndicator = true;
         if (CLIENT_ONLY_PACKAGES_REGEX.test(source) || CLIENT_REQUIRED_MODULES.has(source)) {
           hasClientIndicator = true;
         }
@@ -9922,7 +10037,7 @@ var no_unnecessary_use_client_default = createRule({
 // src/rules/no-unsafe-mock-casting.ts
 import {
   AST_NODE_TYPES as AST_NODE_TYPES40,
-  ASTUtils as ASTUtils10
+  ASTUtils as ASTUtils13
 } from "@typescript-eslint/utils";
 var MOCK_TYPE_NAMES = /* @__PURE__ */ new Set([
   "Mock",
@@ -9988,7 +10103,7 @@ var no_unsafe_mock_casting_default = createRule({
     const directBindings = /* @__PURE__ */ new Set();
     const namespaceBindings = /* @__PURE__ */ new Set();
     function resolve2(identifier) {
-      return ASTUtils10.findVariable(
+      return ASTUtils13.findVariable(
         context.sourceCode.getScope(identifier),
         identifier.name
       );
@@ -10038,7 +10153,7 @@ var no_unsafe_mock_casting_default = createRule({
 import {
   ESLintUtils as ESLintUtils3,
   AST_NODE_TYPES as AST_NODE_TYPES41,
-  ASTUtils as ASTUtils11
+  ASTUtils as ASTUtils14
 } from "@typescript-eslint/utils";
 import * as ts2 from "typescript";
 var NO_ZOD_NATIVE_ENUM_DOCUMENTATION = {
@@ -10084,9 +10199,9 @@ function isIgnoredFile(filename, sourceText) {
 function isZodModule2(source) {
   return /(^|[/@-])zod([/-]|$)/.test(source);
 }
-function unwrap2(node) {
+function unwrap3(node) {
   if (node.type === AST_NODE_TYPES41.TSAsExpression || node.type === AST_NODE_TYPES41.TSSatisfiesExpression) {
-    return unwrap2(node.expression);
+    return unwrap3(node.expression);
   }
   return node;
 }
@@ -10148,7 +10263,7 @@ var no_zod_native_enum_default = createRule({
     const zodImportedBindings = /* @__PURE__ */ new Map();
     const zodNamespaceBindings = /* @__PURE__ */ new Set();
     function resolvedBinding(identifier) {
-      return ASTUtils11.findVariable(
+      return ASTUtils14.findVariable(
         sourceCode.getScope(identifier),
         identifier.name
       );
@@ -10198,7 +10313,7 @@ var no_zod_native_enum_default = createRule({
         if (argument === void 0 || argument.type === AST_NODE_TYPES41.SpreadElement) {
           return;
         }
-        const arg = unwrap2(argument);
+        const arg = unwrap3(argument);
         if (arg.type !== AST_NODE_TYPES41.Identifier) return;
         const isEnum = resolvesToLocalEnum(arg, sourceCode.getScope(arg)) || services !== null && resolvesToImportedEnum(arg, services);
         if (isEnum) {
@@ -10214,7 +10329,7 @@ var no_zod_native_enum_default = createRule({
 });
 
 // src/rules/test-loops-over-literal-cases.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES42, ASTUtils as ASTUtils12 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES42, ASTUtils as ASTUtils15 } from "@typescript-eslint/utils";
 var TEST_LOOPS_OVER_LITERAL_CASES_DOCUMENTATION = {
   summary: "Disallow assertions over an inline literal case loop in a test; parameterization reports and names every case independently.",
   rationale: "A loop is reported as one test, so failures hide the individual case name and may stop later cases from running.",
@@ -10377,7 +10492,7 @@ var test_loops_over_literal_cases_default = createRule({
       return {};
     }
     const isFrameworkIdentifier = (identifier, modules) => {
-      const variable = ASTUtils12.findVariable(context.sourceCode.getScope(identifier), identifier.name);
+      const variable = ASTUtils15.findVariable(context.sourceCode.getScope(identifier), identifier.name);
       if (variable === null || variable.defs.length === 0) return true;
       return variable.defs.some((definition) => {
         let current = definition.node;
@@ -10511,17 +10626,18 @@ var test_phase_label_comment_default = createRule({
 // src/rules/prefer-constant-time-secret-compare.ts
 import { AST_NODE_TYPES as AST_NODE_TYPES44 } from "@typescript-eslint/utils";
 var PREFER_CONSTANT_TIME_SECRET_COMPARE_DOCUMENTATION = {
-  summary: "Disallow `===`/`!==` on a secret-like value; short-circuiting comparison leaks the secret through timing. Use a constant-time compare.",
-  rationale: "Ordinary equality stops at the first differing byte, allowing repeated measurements to reveal secret material.",
+  summary: "Prefer a supported constant-time comparison primitive for secret-like values.",
+  rationale: "Ordinary equality offers no constant-time guarantee for comparing secrets.",
   remediation: "Compare equal-length cryptographic digests with a constant-time comparison primitive.",
   category: "security",
-  limitations: ["Secret-like values are identified conservatively from their names; test files and public sentinel comparisons are excluded."],
+  limitations: ["This is name-based analysis, not proof of runtime sensitivity. Ambiguous token names require an authentication or cryptographic qualifier; test files and public sentinel comparisons are excluded."],
   examples: [
-    { id: "constant-time-compare", title: "Use a constant-time comparison", outcome: "no-match", files: [{ path: "src/auth.ts", source: "if (await constantTimeEqual(presentedToken, expectedToken)) { allow(); }" }], focusPath: "src/auth.ts", expectedCount: 0, public: true },
-    { id: "secret-equality", title: "Do not compare secrets with equality", outcome: "match", files: [{ path: "src/auth.ts", source: "if (presentedToken === expectedToken) { allow(); }" }], focusPath: "src/auth.ts", expectedCount: 1, public: true }
+    { id: "constant-time-compare", title: "Use a constant-time comparison", outcome: "no-match", files: [{ path: "src/auth.ts", source: "if (await constantTimeEqual(presentedAccessToken, expectedAccessToken)) { allow(); }" }], focusPath: "src/auth.ts", expectedCount: 0, public: true },
+    { id: "secret-equality", title: "Do not compare authentication tokens with equality", outcome: "match", files: [{ path: "src/auth.ts", source: "if (presentedAccessToken === expectedAccessToken) { allow(); }" }], focusPath: "src/auth.ts", expectedCount: 1, public: true }
   ]
 };
 var EQUALITY_OPERATORS = /* @__PURE__ */ new Set(["===", "!==", "==", "!="]);
+var AUTH_TOKEN_QUALIFIERS = /* @__PURE__ */ new Set(["access", "refresh", "session", "admin", "csrf", "xsrf", "auth", "authentication", "signing", "api"]);
 var SENTINEL_IDENTIFIERS = /* @__PURE__ */ new Set(["undefined", "NaN"]);
 var SENTINEL_WORDS = /(^|_)(SENTINEL|EMPTY|NONE|NULL|UNSET|MISSING|PLACEHOLDER|DUMMY|FAKE|EXAMPLE)(_|$)/;
 var SENTINEL_PREFIX_RE = /^(skip|sentinel|empty|none|missing|unset|placeholder|dummy|fake|example|noop)[A-Z]/;
@@ -10559,7 +10675,9 @@ function isSecretOperand(node) {
     return node.expressions.some((expression) => isSecretOperand(expression));
   }
   const name = operandName(node);
-  return name !== null && isAuthSecretName(name);
+  if (name === null || !isAuthSecretName(name)) return false;
+  const words2 = tokenize(name);
+  return !words2.includes("token") || words2.some((word) => AUTH_TOKEN_QUALIFIERS.has(word) || word !== "token" && SECRET_WORDS.has(word));
 }
 function secretNameOf(node) {
   if (node.type === AST_NODE_TYPES44.TemplateLiteral) {
@@ -10579,11 +10697,11 @@ var prefer_constant_time_secret_compare_default = createRule({
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow `===`/`!==` on a secret-like value; short-circuiting comparison leaks the secret through timing. Use a constant-time compare."
+      description: "Prefer a supported constant-time comparison primitive for secret-like values."
     },
     schema: [],
     messages: {
-      preferConstantTimeSecretCompare: "`{{operator}}` on secret `{{name}}` short-circuits on the first differing byte and leaks it through timing. Compare constant-time instead (`crypto.subtle.timingSafeEqual` over equal-length SHA-256 digests)."
+      preferConstantTimeSecretCompare: "`{{operator}}` on secret-like `{{name}}` is not guaranteed constant-time. Use a constant-time comparison primitive supported by the target runtime and handle its input-length requirements."
     }
   },
   defaultOptions: [],
@@ -10869,13 +10987,14 @@ var prefer_discriminated_union_default = createRule({
 });
 
 // src/rules/prefer-input-group-search.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES47 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES47, ASTUtils as ASTUtils16 } from "@typescript-eslint/utils";
 var PREFER_INPUT_GROUP_SEARCH_DOCUMENTATION = {
   summary: "Require search icons and shared Input controls in the same visual wrapper to use InputGroup.",
   rationale: "The shared compound control provides consistent spacing, focus behavior, and accessible composition.",
   remediation: "Compose the search icon and field with InputGroup, InputGroupAddon, and InputGroupInput.",
   category: "style",
   limitations: [
+    "Opposite branches of the same conditional expression and icons with explicit interaction handlers are excluded; arbitrary component behavior is not inferred.",
     "Only Search and Input bindings imported from the recognized shared modules are paired.",
     "The file must import InputGroup, proving that the repository has adopted that optional primitive."
   ],
@@ -10927,10 +11046,26 @@ function nearestEligibleCommonAncestor(search, input, inputGroupNames) {
   return null;
 }
 function isActionIcon(search, wrapper) {
+  if (hasInteraction(search.node)) return true;
   return jsxAncestors(search).some((ancestor) => {
     if (ancestor === wrapper) return false;
     const name = elementName(ancestor.openingElement);
-    return name === "a" || name === "button";
+    return name === "a" || name === "button" || hasInteraction(ancestor.openingElement);
+  });
+}
+function hasInteraction(node) {
+  return node.attributes.some(
+    (attribute) => attribute.type === AST_NODE_TYPES47.JSXAttribute && attribute.name.type === AST_NODE_TYPES47.JSXIdentifier && /^(?:on[A-Z]|href$)/u.test(attribute.name.name)
+  );
+}
+function mutuallyExclusive(left, right) {
+  return left.ancestors.some((ancestor, index) => {
+    if (ancestor.type !== AST_NODE_TYPES47.ConditionalExpression) return false;
+    const otherIndex = right.ancestors.indexOf(ancestor);
+    if (otherIndex < 0) return false;
+    const leftBranch = left.ancestors[index + 1];
+    const rightBranch = right.ancestors[otherIndex + 1];
+    return leftBranch === ancestor.consequent && rightBranch === ancestor.alternate || leftBranch === ancestor.alternate && rightBranch === ancestor.consequent;
   });
 }
 var prefer_input_group_search_default = createRule({
@@ -10955,6 +11090,7 @@ var prefer_input_group_search_default = createRule({
     const searches = [];
     return {
       ImportDeclaration(node) {
+        if (node.importKind === "type") return;
         const source = String(node.source.value);
         if (source === "lucide-react") {
           for (const exported of SEARCH_EXPORTS) {
@@ -10975,6 +11111,8 @@ var prefer_input_group_search_default = createRule({
       JSXOpeningElement(node) {
         const name = elementName(node);
         if (name === null) return;
+        const binding = ASTUtils16.findVariable(context.sourceCode.getScope(node), name);
+        if (binding?.defs.length !== 1 || binding.defs[0]?.node.type !== AST_NODE_TYPES47.ImportSpecifier || binding.defs[0].node.importKind === "type") return;
         const occurrence = {
           ancestors: context.sourceCode.getAncestors(node),
           node
@@ -10988,6 +11126,7 @@ var prefer_input_group_search_default = createRule({
         for (const search of searches) {
           if (isWithinInputGroup(search, inputGroupNames)) continue;
           for (const input of inputs) {
+            if (mutuallyExclusive(search, input)) continue;
             if (isWithinInputGroup(input, inputGroupNames)) continue;
             const wrapper = nearestEligibleCommonAncestor(
               search,
@@ -11012,7 +11151,7 @@ var prefer_input_group_search_default = createRule({
 
 // src/rules/prefer-millisecond-control-duration-schema.ts
 import {
-  ASTUtils as ASTUtils13,
+  ASTUtils as ASTUtils17,
   AST_NODE_TYPES as AST_NODE_TYPES48
 } from "@typescript-eslint/utils";
 var PREFER_MILLISECOND_CONTROL_DURATION_SCHEMA_DOCUMENTATION = {
@@ -11081,7 +11220,7 @@ var prefer_millisecond_control_duration_schema_default = createRule({
     const zodNamespaces = /* @__PURE__ */ new Set();
     const objectFactories = /* @__PURE__ */ new Set();
     function binding(identifier) {
-      return ASTUtils13.findVariable(context.sourceCode.getScope(identifier), identifier.name);
+      return ASTUtils17.findVariable(context.sourceCode.getScope(identifier), identifier.name);
     }
     function record(target, identifier) {
       const variable = binding(identifier);
@@ -11128,7 +11267,7 @@ var prefer_millisecond_control_duration_schema_default = createRule({
 });
 
 // src/rules/prefer-immutable-module-constant.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES49, ASTUtils as ASTUtils14 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES49, ASTUtils as ASTUtils18 } from "@typescript-eslint/utils";
 var PREFER_IMMUTABLE_MODULE_CONSTANT_DOCUMENTATION = {
   summary: "Require module-level constant collections to expose readonly state.",
   rationale: "A const binding prevents reassignment but does not stop callers from mutating its array, object, Set, or Map contents.",
@@ -11281,7 +11420,7 @@ var prefer_immutable_module_constant_default = createRule({
   create(context) {
     const sourceCode = context.sourceCode;
     const isUnshadowedGlobal3 = (identifier) => {
-      const variable = ASTUtils14.findVariable(sourceCode.getScope(identifier), identifier.name);
+      const variable = ASTUtils18.findVariable(sourceCode.getScope(identifier), identifier.name);
       return variable === null || variable.defs.length === 0;
     };
     if (JAVASCRIPT_FILE_RE.test(context.filename) || isTestFile(context.filename) || isGeneratedFile(context.filename, sourceCode.getText())) {
@@ -11381,6 +11520,7 @@ var PREFER_SHADCN_PRIMITIVES_DOCUMENTATION = {
   remediation: "Replace the raw visible control with the corresponding shared shadcn component.",
   category: "style",
   limitations: [
+    "Native multiple selects and controls with possibly enabled hidden attributes are excluded. Unknown JSX spreads can hide controls; visual equivalence is not inferred.",
     "Hidden and file inputs, unassociated labels, and non-control semantic elements are excluded.",
     "Tests and the shared components/ui primitive implementation tree are excluded.",
     "Package-local project detection is opt-in and fails closed unless components.json, one unambiguous tsconfig/jsconfig alias, the exact primitive module, and its expected export all exist."
@@ -11668,6 +11808,7 @@ function isStaticallyAssociatedLabel(node) {
   return node.parent.type === AST_NODE_TYPES50.JSXElement && containsLabelableElement(node.parent);
 }
 function replacementFor(node, element) {
+  if (element === "select" && mayHaveBooleanAttribute(node, "multiple")) return null;
   if (element !== "input") return RAW_PRIMITIVES[element];
   const typeAttribute = effectiveAttribute(node, "type");
   if (typeAttribute.kind === "unknown") return null;
@@ -11682,6 +11823,14 @@ function replacementFor(node, element) {
   if (AMBIGUOUS_INPUT_TYPES.has(inputType)) return null;
   return RAW_PRIMITIVES.input;
 }
+function mayHaveBooleanAttribute(node, name) {
+  for (const attribute of node.attributes.toReversed()) {
+    if (attribute.type === AST_NODE_TYPES50.JSXSpreadAttribute) return true;
+    if (attribute.name.type !== AST_NODE_TYPES50.JSXIdentifier || attribute.name.name !== name) continue;
+    return !(attribute.value?.type === AST_NODE_TYPES50.JSXExpressionContainer && attribute.value.expression.type === AST_NODE_TYPES50.Literal && attribute.value.expression.value === false);
+  }
+  return false;
+}
 var prefer_shadcn_primitives_default = createRule({
   name: "prefer-shadcn-primitives",
   documentation: PREFER_SHADCN_PRIMITIVES_DOCUMENTATION,
@@ -11727,6 +11876,9 @@ var prefer_shadcn_primitives_default = createRule({
       JSXOpeningElement(node) {
         const element = rawElementName(node);
         if (element === null) return;
+        if (mayHaveBooleanAttribute(node, "hidden") || context.sourceCode.getAncestors(node).some(
+          (ancestor) => ancestor.type === AST_NODE_TYPES50.JSXElement && mayHaveBooleanAttribute(ancestor.openingElement, "hidden")
+        )) return;
         if (element === "label" && !isStaticallyAssociatedLabel(node)) return;
         const replacement = replacementFor(node, element);
         if (replacement === null) return;
@@ -11812,9 +11964,9 @@ function isIgnoredFile2(filename, sourceText) {
 function isLocalFixtureFile(filename) {
   return isTestFile(filename) || isStoryFile(filename);
 }
-function unwrap3(node) {
+function unwrap4(node) {
   if (node.type === AST_NODE_TYPES51.TSAsExpression || node.type === AST_NODE_TYPES51.TSSatisfiesExpression || node.type === AST_NODE_TYPES51.TSNonNullExpression) {
-    return unwrap3(node.expression);
+    return unwrap4(node.expression);
   }
   return node;
 }
@@ -11826,7 +11978,7 @@ function isLiteralOnly(node, depth) {
   if (depth > MAX_LITERAL_DEPTH) {
     return false;
   }
-  const inner = unwrap3(node);
+  const inner = unwrap4(node);
   switch (inner.type) {
     case AST_NODE_TYPES51.Literal: {
       return !(isRegexLiteral(inner) && HAS_STATEFUL_FLAG_RE.test(inner.regex.flags));
@@ -11883,7 +12035,7 @@ function classify(init, checkRegex) {
     if (node.arguments.length !== 1 || arg === void 0 || arg.type === AST_NODE_TYPES51.SpreadElement) {
       return null;
     }
-    const entries = unwrap3(arg);
+    const entries = unwrap4(arg);
     if (entries.type !== AST_NODE_TYPES51.ArrayExpression) {
       return null;
     }
@@ -11892,9 +12044,9 @@ function classify(init, checkRegex) {
   return null;
 }
 function unwrapObjectFreeze(node) {
-  const inner = unwrap3(node);
+  const inner = unwrap4(node);
   if (inner.type === AST_NODE_TYPES51.CallExpression && inner.callee.type === AST_NODE_TYPES51.MemberExpression && !inner.callee.computed && inner.callee.object.type === AST_NODE_TYPES51.Identifier && inner.callee.object.name === "Object" && inner.callee.property.type === AST_NODE_TYPES51.Identifier && inner.callee.property.name === "freeze" && inner.arguments.length === 1 && inner.arguments[0] !== void 0 && inner.arguments[0].type !== AST_NODE_TYPES51.SpreadElement) {
-    return unwrap3(inner.arguments[0]);
+    return unwrap4(inner.arguments[0]);
   }
   return inner;
 }
@@ -12427,7 +12579,7 @@ var prefer_module_level_schema_default = createRule({
 // src/rules/prefer-module-level-refined-schema.ts
 import {
   AST_NODE_TYPES as AST_NODE_TYPES53,
-  ASTUtils as ASTUtils15
+  ASTUtils as ASTUtils19
 } from "@typescript-eslint/utils";
 var BENCHMARK_PATH_RE = /(^|[/\\])(?:benchmarks?|bench)[/\\]/;
 var FACTORIES = /* @__PURE__ */ new Set([
@@ -12698,7 +12850,7 @@ var prefer_module_level_refined_schema_default = createRule({
       return {};
     const zodBindings = /* @__PURE__ */ new Set();
     function resolvedBinding(identifier) {
-      return ASTUtils15.findVariable(
+      return ASTUtils19.findVariable(
         context.sourceCode.getScope(identifier),
         identifier.name
       );
@@ -12799,7 +12951,7 @@ var prefer_module_level_refined_schema_default = createRule({
 // src/rules/prefer-multi-value-zod-literal.ts
 import {
   AST_NODE_TYPES as AST_NODE_TYPES54,
-  ASTUtils as ASTUtils16
+  ASTUtils as ASTUtils20
 } from "@typescript-eslint/utils";
 var PREFER_MULTI_VALUE_ZOD_LITERAL_DOCUMENTATION = {
   summary: "Use the Zod 4 multi-value literal API instead of a union of literal schemas.",
@@ -12846,7 +12998,7 @@ function isStaticPrimitive(node, context) {
   if (node.type === AST_NODE_TYPES54.TemplateLiteral && node.expressions.length === 0)
     return true;
   if (node.type === AST_NODE_TYPES54.Identifier && node.name === "undefined") {
-    const binding = ASTUtils16.findVariable(
+    const binding = ASTUtils20.findVariable(
       context.sourceCode.getScope(node),
       node.name
     );
@@ -12883,7 +13035,7 @@ var prefer_multi_value_zod_literal_default = createRule({
     const zodBindings = /* @__PURE__ */ new Set();
     const zod4Bindings = /* @__PURE__ */ new Set();
     function resolvedBinding(identifier) {
-      return ASTUtils16.findVariable(
+      return ASTUtils20.findVariable(
         context.sourceCode.getScope(identifier),
         identifier.name
       );
@@ -13001,10 +13153,10 @@ var PREFER_NAMED_COMPLEX_RETURN_TYPE_DOCUMENTATION = {
     { id: "inline-result", title: "Do not inline a multi-state result", outcome: "match", files: [{ path: "src/queue.ts", source: "export function claim(): { state: 'idle' } | { state: 'waiting'; retryAt: number } | { state: 'claimed'; id: string } { return { state: 'idle' }; }" }], focusPath: "src/queue.ts", expectedCount: 1, public: true }
   ]
 };
-function unwrap4(node) {
+function unwrap5(node) {
   if (node.type === AST_NODE_TYPES56.TSTypeReference && node.typeArguments?.params.length === 1) {
     const [inner] = node.typeArguments.params;
-    if (inner !== void 0) return unwrap4(inner);
+    if (inner !== void 0) return unwrap5(inner);
   }
   return node;
 }
@@ -13015,10 +13167,10 @@ function report(context, node) {
   }
 }
 function isComplex(node) {
-  const type = unwrap4(node);
+  const type = unwrap5(node);
   if (type.type === AST_NODE_TYPES56.TSTypeLiteral) return type.members.length >= 3;
   if (type.type !== AST_NODE_TYPES56.TSUnionType || type.types.length < 3) return false;
-  return type.types.every((member) => unwrap4(member).type === AST_NODE_TYPES56.TSTypeLiteral);
+  return type.types.every((member) => unwrap5(member).type === AST_NODE_TYPES56.TSTypeLiteral);
 }
 var prefer_named_complex_return_type_default = createRule({
   name: "prefer-named-complex-return-type",
@@ -13045,7 +13197,7 @@ var prefer_named_complex_return_type_default = createRule({
 });
 
 // src/rules/prefer-native-random-uuid.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES57, ASTUtils as ASTUtils17 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES57, ASTUtils as ASTUtils21 } from "@typescript-eslint/utils";
 var PREFER_NATIVE_RANDOM_UUID_DOCUMENTATION = {
   summary: "Prefer `globalThis.crypto.randomUUID()` over resolved zero-argument UUID v4 bindings from the `uuid` package.",
   rationale: "The platform implementation avoids an unnecessary dependency for standard random UUID generation.",
@@ -13081,7 +13233,7 @@ var prefer_native_random_uuid_default = createRule({
     const directBindings = /* @__PURE__ */ new Set();
     const namespaceBindings = /* @__PURE__ */ new Set();
     function resolve2(identifier) {
-      return ASTUtils17.findVariable(context.sourceCode.getScope(identifier), identifier.name);
+      return ASTUtils21.findVariable(context.sourceCode.getScope(identifier), identifier.name);
     }
     function record(identifier, destination) {
       const variable = resolve2(identifier);
@@ -13144,7 +13296,7 @@ var prefer_native_random_uuid_default = createRule({
 });
 
 // src/rules/prefer-node-crypto-hash.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES58, ASTUtils as ASTUtils18 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES58, ASTUtils as ASTUtils22 } from "@typescript-eslint/utils";
 var PREFER_NODE_CRYPTO_HASH_DOCUMENTATION = {
   summary: "Prefer the modern one-shot node:crypto hash API when streaming state is unnecessary.",
   rationale: "A createHash-update-digest chain allocates mutable streaming state for a single in-memory value; Node's built-in hash function expresses the one-shot operation directly and can use its optimized fast path.",
@@ -13184,7 +13336,7 @@ function isUnshadowedBuiltinIdentifier(identifier, resolve2) {
   const variable = resolve2(identifier);
   return variable === null || variable.defs.length === 0;
 }
-function propertyName4(node) {
+function propertyName2(node) {
   if (!node.computed && node.key.type === AST_NODE_TYPES58.Identifier) return node.key.name;
   if (node.key.type === AST_NODE_TYPES58.Literal && typeof node.key.value === "string") {
     return node.key.value;
@@ -13200,7 +13352,7 @@ var prefer_node_crypto_hash_default = createRule({
     const directBindings = /* @__PURE__ */ new Set();
     const namespaceBindings = /* @__PURE__ */ new Set();
     function resolve2(identifier) {
-      return ASTUtils18.findVariable(
+      return ASTUtils22.findVariable(
         context.sourceCode.getScope(identifier),
         identifier.name
       );
@@ -13230,7 +13382,7 @@ var prefer_node_crypto_hash_default = createRule({
         }
         if (node.id.type !== AST_NODE_TYPES58.ObjectPattern) return;
         for (const property of node.id.properties) {
-          if (property.type === AST_NODE_TYPES58.Property && propertyName4(property) === "createHash" && property.value.type === AST_NODE_TYPES58.Identifier) {
+          if (property.type === AST_NODE_TYPES58.Property && propertyName2(property) === "createHash" && property.value.type === AST_NODE_TYPES58.Identifier) {
             record(property.value, directBindings);
           }
         }
@@ -13312,7 +13464,7 @@ function isFsLoader(node) {
 function isFsSpecifier(node) {
   return node.type === AST_NODE_TYPES59.Literal && (node.value === "node:fs" || node.value === "fs");
 }
-function propertyName5(node) {
+function propertyName3(node) {
   if (!node.computed && node.key.type === AST_NODE_TYPES59.Identifier) return node.key.name;
   if (node.key.type === AST_NODE_TYPES59.Literal && typeof node.key.value === "string") return node.key.value;
   return null;
@@ -13363,7 +13515,7 @@ var prefer_node_fs_promises_default = createRule({
         if (node.id.type !== AST_NODE_TYPES59.ObjectPattern) return;
         const synchronousImports = node.id.properties.flatMap((property) => {
           if (property.type !== AST_NODE_TYPES59.Property) return [];
-          const name = propertyName5(property);
+          const name = propertyName3(property);
           return name?.endsWith("Sync") === true ? [name] : [];
         });
         if (synchronousImports.length > 0) {
@@ -13387,7 +13539,7 @@ var prefer_node_fs_promises_default = createRule({
 });
 
 // src/rules/prefer-non-nullable-collection.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES60, ASTUtils as ASTUtils19 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES60, ASTUtils as ASTUtils23 } from "@typescript-eslint/utils";
 var PREFER_NON_NULLABLE_COLLECTION_DOCUMENTATION = {
   summary: "Suggest non-null arrays only when local control flow proves the nullish state is equivalent to an empty collection.",
   rationale: "A redundant nullish collection state spreads defaults and guards through consumers without carrying information.",
@@ -13400,7 +13552,7 @@ var PREFER_NON_NULLABLE_COLLECTION_DOCUMENTATION = {
   ]
 };
 var ARRAY_TYPE_NAMES = /* @__PURE__ */ new Set(["Array", "ReadonlyArray"]);
-function propertyName6(node) {
+function propertyName4(node) {
   const key = node.key;
   if (node.computed) return null;
   if (key.type === AST_NODE_TYPES60.Identifier) return key.name;
@@ -13413,7 +13565,7 @@ function isArrayType(node) {
 }
 function nullableProperty(node) {
   if (node.optional) return null;
-  const name = propertyName6(node);
+  const name = propertyName4(node);
   const annotation = node.typeAnnotation?.typeAnnotation;
   if (name === null || annotation?.type !== AST_NODE_TYPES60.TSUnionType) return null;
   const concrete = annotation.types.filter(
@@ -13517,14 +13669,14 @@ function directlyCoalesced(node) {
   return parent?.type === AST_NODE_TYPES60.LogicalExpression && parent.left === node && (parent.operator === "??" || parent.operator === "||") && emptyArray(parent.right);
 }
 function identifierIsOnlyCoalesced(context, binding, fn) {
-  const variable = ASTUtils19.findVariable(context.sourceCode.getScope(binding), binding.name);
+  const variable = ASTUtils23.findVariable(context.sourceCode.getScope(binding), binding.name);
   if (variable === null || variable.references.length === 0) return false;
   return variable.references.every(
     (reference) => belongsToFunction(reference.identifier, fn) && directlyCoalesced(reference.identifier)
   );
 }
 function memberIsOnlyCoalesced(context, object, property, fn) {
-  const variable = ASTUtils19.findVariable(context.sourceCode.getScope(object), object.name);
+  const variable = ASTUtils23.findVariable(context.sourceCode.getScope(object), object.name);
   if (variable === null) return false;
   const accesses = variable.references.flatMap((reference) => {
     if (!belongsToFunction(reference.identifier, fn)) return [null];
@@ -13623,7 +13775,7 @@ var prefer_non_nullable_collection_default = createRule({
           context.report({
             node,
             messageId: "preferNonNullableCollection",
-            data: { name: propertyName6(node) ?? "collection" }
+            data: { name: propertyName4(node) ?? "collection" }
           });
         }
       }
@@ -13634,7 +13786,7 @@ var prefer_non_nullable_collection_default = createRule({
 // src/rules/prefer-nullish-filter-predicate.ts
 import {
   AST_NODE_TYPES as AST_NODE_TYPES61,
-  ASTUtils as ASTUtils20,
+  ASTUtils as ASTUtils24,
   ESLintUtils as ESLintUtils5
 } from "@typescript-eslint/utils";
 import ts3 from "typescript";
@@ -13680,7 +13832,7 @@ var PREFER_NULLISH_FILTER_PREDICATE_DOCUMENTATION = {
   ]
 };
 function isUnshadowedBoolean(node, context) {
-  const variable = ASTUtils20.findVariable(context.sourceCode.getScope(node), node.name);
+  const variable = ASTUtils24.findVariable(context.sourceCode.getScope(node), node.name);
   return variable === null || variable.defs.length === 0;
 }
 function isBuiltinArrayFilter(node, services) {
@@ -13739,7 +13891,7 @@ function isProvablyTruthy(type, checker) {
 }
 function availableParameterName(node, context) {
   for (const name of ["value", "item", "element", "candidate"]) {
-    if (ASTUtils20.findVariable(context.sourceCode.getScope(node), name) === null) return name;
+    if (ASTUtils24.findVariable(context.sourceCode.getScope(node), name) === null) return name;
   }
   return null;
 }
@@ -13793,7 +13945,7 @@ var prefer_nullish_filter_predicate_default = createRule({
 
 // src/rules/prefer-await-in-async-return.ts
 import {
-  ASTUtils as ASTUtils21,
+  ASTUtils as ASTUtils25,
   ESLintUtils as ESLintUtils6,
   AST_NODE_TYPES as AST_NODE_TYPES62
 } from "@typescript-eslint/utils";
@@ -13907,13 +14059,13 @@ var prefer_await_in_async_return_default = createRule({
     if (services === null) return {};
     const frameworkLoaders = /* @__PURE__ */ new Set();
     const rememberFrameworkLoader = (identifier) => {
-      const variable = ASTUtils21.findVariable(context.sourceCode.getScope(identifier), identifier.name);
+      const variable = ASTUtils25.findVariable(context.sourceCode.getScope(identifier), identifier.name);
       if (variable !== null) frameworkLoaders.add(variable);
     };
     const isFrameworkLoaderCallback = (owner) => {
       const parent = owner.parent;
       if (parent.type !== AST_NODE_TYPES62.CallExpression || parent.arguments[0] !== owner || parent.callee.type !== AST_NODE_TYPES62.Identifier) return false;
-      const variable = ASTUtils21.findVariable(context.sourceCode.getScope(parent.callee), parent.callee.name);
+      const variable = ASTUtils25.findVariable(context.sourceCode.getScope(parent.callee), parent.callee.name);
       return variable !== null && frameworkLoaders.has(variable);
     };
     return {
@@ -13955,7 +14107,7 @@ var PREFER_SCHEMA_FOR_API_PAYLOAD_DOCUMENTATION = {
     { id: "unvalidated-payload", title: "Do not trust response JSON directly", outcome: "match", files: [{ path: "src/client.ts", source: "async function load(response) { const body = await response.json(); return body.id; }" }], focusPath: "src/client.ts", expectedCount: 1, public: true }
   ]
 };
-var unwrap5 = (node) => {
+var unwrap6 = (node) => {
   let current = node;
   while (current !== null && current !== void 0) {
     if (current.type === AST_NODE_TYPES63.TSAsExpression || current.type === AST_NODE_TYPES63.TSTypeAssertion || current.type === AST_NODE_TYPES63.TSNonNullExpression || current.type === AST_NODE_TYPES63.TSSatisfiesExpression) {
@@ -13974,23 +14126,23 @@ var PROMISE_CHAIN_METHODS = /* @__PURE__ */ new Set([
   "finally"
 ]);
 var isSchemaParseReference = (node) => {
-  const inner = unwrap5(node);
+  const inner = unwrap6(node);
   return inner !== null && inner.type === AST_NODE_TYPES63.MemberExpression && !inner.computed && inner.property.type === AST_NODE_TYPES63.Identifier && (inner.property.name === "parse" || inner.property.name === "safeParse");
 };
 var isRawPayloadSource = (node, isKnownLocalText) => {
-  let current = unwrap5(node);
+  let current = unwrap6(node);
   if (current === null) return false;
   if (current.type === AST_NODE_TYPES63.AwaitExpression) {
-    current = unwrap5(current.argument);
+    current = unwrap6(current.argument);
   }
   if (current === null || current.type !== AST_NODE_TYPES63.CallExpression) {
     return false;
   }
-  const callee = unwrap5(current.callee);
+  const callee = unwrap6(current.callee);
   if (callee === null || callee.type !== AST_NODE_TYPES63.MemberExpression) {
     return false;
   }
-  const property = unwrap5(callee.property);
+  const property = unwrap6(callee.property);
   if (property === null || property.type !== AST_NODE_TYPES63.Identifier) {
     return false;
   }
@@ -14000,17 +14152,17 @@ var isRawPayloadSource = (node, isKnownLocalText) => {
   if (PROMISE_CHAIN_METHODS.has(property.name)) {
     return !current.arguments.some(isSchemaParseReference) && isRawPayloadSource(callee.object);
   }
-  const object = unwrap5(callee.object);
+  const object = unwrap6(callee.object);
   return property.name === "parse" && object !== null && object.type === AST_NODE_TYPES63.Identifier && object.name === "JSON" && !isLocalFileRead(current.arguments[0]) && isKnownLocalText?.(current.arguments[0]) !== true;
 };
 var FILE_READ_RE = /^(readFile|readFileSync|readJson|readJsonSync|readJSON)$/;
 var isDirectLocalFileRead = (node) => {
-  let current = unwrap5(node);
+  let current = unwrap6(node);
   if (current?.type === AST_NODE_TYPES63.AwaitExpression) {
-    current = unwrap5(current.argument);
+    current = unwrap6(current.argument);
   }
   if (current?.type !== AST_NODE_TYPES63.CallExpression) return false;
-  const callee = unwrap5(current.callee);
+  const callee = unwrap6(current.callee);
   const name = callee?.type === AST_NODE_TYPES63.Identifier ? callee.name : callee?.type === AST_NODE_TYPES63.MemberExpression && !callee.computed && callee.property.type === AST_NODE_TYPES63.Identifier ? callee.property.name : null;
   return name !== null && FILE_READ_RE.test(name);
 };
@@ -14250,7 +14402,7 @@ var isGuardTestPosition = (node) => {
   return false;
 };
 var unvalidatedVariableRef = (node, scope, tracked) => {
-  const unwrapped = unwrap5(node);
+  const unwrapped = unwrap6(node);
   if (unwrapped === null || unwrapped.type !== AST_NODE_TYPES63.Identifier) {
     return null;
   }
@@ -14279,7 +14431,7 @@ var prefer_schema_for_api_payload_default = createRule({
     const aliasGroups = /* @__PURE__ */ new Map();
     const localFileTextVariables = /* @__PURE__ */ new Set();
     const localFileTextRef = (node, scope) => {
-      const unwrapped = unwrap5(node);
+      const unwrapped = unwrap6(node);
       if (unwrapped?.type !== AST_NODE_TYPES63.Identifier) return null;
       const variable = findVariable2(scope, unwrapped.name);
       return variable !== null && localFileTextVariables.has(variable) ? variable : null;
@@ -14415,7 +14567,7 @@ var prefer_schema_for_api_payload_default = createRule({
         const scope = context.sourceCode.getScope(node);
         for (const arg of node.arguments) {
           if (arg.type === AST_NODE_TYPES63.SpreadElement) continue;
-          const unwrapped = unwrap5(arg);
+          const unwrapped = unwrap6(arg);
           if (unwrapped === null || unwrapped.type !== AST_NODE_TYPES63.Identifier) {
             continue;
           }
@@ -14427,7 +14579,7 @@ var prefer_schema_for_api_payload_default = createRule({
         if (isInsideAssertion(node)) return;
         if (isValidationRead(node)) return;
         const scope = context.sourceCode.getScope(node);
-        const obj = unwrap5(node.object);
+        const obj = unwrap6(node.object);
         if (isRawPayloadSource(
           obj,
           (candidate2) => localFileTextRef(candidate2, scope) !== null
@@ -14632,6 +14784,7 @@ var PREFER_SEMANTIC_COLORS_DOCUMENTATION = {
   remediation: "Replace raw palette and literal colors with the closest semantic design-system token or CSS variable.",
   category: "style",
   limitations: [
+    "Class-composition helper objects use literal keys as class fragments; cva/tv configuration objects retain value traversal. Computed keys are not resolved. URL payloads are not color literals.",
     "Email, PDF, video-rendering, print-only, icon artwork, masks, gradients, stories, and explicitly configured non-token projects have targeted exclusions.",
     "Opaque-foreground checks are opt-in and require both a same-variant semantic background class and its package-local declared foreground token."
   ],
@@ -15036,7 +15189,7 @@ var prefer_semantic_colors_default = createRule({
         });
       }
     };
-    const checkClassNode = (node) => {
+    const checkClassNode = (node, objectKeys = false) => {
       if (node === null) return;
       switch (node.type) {
         case AST_NODE_TYPES66.Literal:
@@ -15047,27 +15200,35 @@ var prefer_semantic_colors_default = createRule({
           break;
         case AST_NODE_TYPES66.ArrayExpression:
           for (const element of node.elements) {
-            if (element !== null && element.type !== AST_NODE_TYPES66.SpreadElement) checkClassNode(element);
+            if (element !== null && element.type !== AST_NODE_TYPES66.SpreadElement) checkClassNode(element, objectKeys);
           }
           break;
         case AST_NODE_TYPES66.ObjectExpression:
           for (const property of node.properties) {
-            if (property.type === AST_NODE_TYPES66.Property) checkClassNode(property.value);
+            if (property.type !== AST_NODE_TYPES66.Property) continue;
+            if (objectKeys) {
+              if (property.value.type === AST_NODE_TYPES66.Literal && !property.value.value && !("regex" in property.value)) continue;
+              if (!property.computed && property.key.type === AST_NODE_TYPES66.Literal) {
+                checkClassNode(property.key);
+              }
+            } else {
+              checkClassNode(property.value);
+            }
           }
           break;
         case AST_NODE_TYPES66.ConditionalExpression:
-          checkClassNode(node.consequent);
-          checkClassNode(node.alternate);
+          checkClassNode(node.consequent, objectKeys);
+          checkClassNode(node.alternate, objectKeys);
           break;
         case AST_NODE_TYPES66.LogicalExpression:
-          checkClassNode(node.right);
+          checkClassNode(node.right, objectKeys);
           break;
         default:
           break;
       }
     };
     const checkColorValueNode = (node) => {
-      if (node.type === AST_NODE_TYPES66.Literal && typeof node.value === "string" && RAW_COLOR_VALUE_RE.test(node.value) && !CSS_VAR_REFERENCE_RE.test(node.value)) {
+      if (node.type === AST_NODE_TYPES66.Literal && typeof node.value === "string" && RAW_COLOR_VALUE_RE.test(node.value.replace(/url\(\s*(?:"[^"]*"|'[^']*'|[^)]*)\s*\)/giu, "")) && !CSS_VAR_REFERENCE_RE.test(node.value)) {
         report2(node, "inlineColor", { value: node.value });
       }
     };
@@ -15087,7 +15248,9 @@ var prefer_semantic_colors_default = createRule({
         }
         if (node.callee.type === AST_NODE_TYPES66.Identifier && CLASS_FNS.has(node.callee.name)) {
           for (const arg of node.arguments) {
-            if (arg.type !== AST_NODE_TYPES66.SpreadElement) checkClassNode(arg);
+            if (arg.type !== AST_NODE_TYPES66.SpreadElement) {
+              checkClassNode(arg, node.callee.name !== "cva" && node.callee.name !== "tv");
+            }
           }
         }
       },
@@ -15131,13 +15294,13 @@ var prefer_semantic_colors_default = createRule({
 });
 
 // src/rules/prefer-server-actions.ts
-import "@typescript-eslint/utils";
+import { ASTUtils as ASTUtils26 } from "@typescript-eslint/utils";
 var PREFER_SERVER_ACTIONS_DOCUMENTATION = {
   summary: "Prefer Next.js Server Actions over same-origin API mutations.",
-  rationale: "Server Actions preserve typed application calls and avoid an internal JSON request-response boundary.",
-  remediation: "Move the mutation into a Server Action and invoke that action from the React client.",
+  rationale: "Server Actions can remove a hand-written internal API wrapper while retaining typed application calls. Client invocations still cross a network and serialization boundary.",
+  remediation: "Consider a Server Action for application-owned mutations; preserve authorization, input validation and any public API consumers.",
   category: "architecture",
-  limitations: ["Only statically recognizable /api/ mutations, including one explicitly configured literal deployment base path, in use-client modules are reported; server boundaries and route handlers are excluded."],
+  limitations: ["Only statically recognizable /api/ mutations through global fetch or proven Axios imports/instances in use-client modules are reported. Custom wrapper provenance, mutated configuration and unknown option overrides are not inferred; server boundaries and route handlers are excluded."],
   examples: [
     { id: "server-action-call", title: "Call a Server Action", outcome: "no-match", files: [{ path: "app/tasks/page.tsx", source: "import { createTask } from './actions'; await createTask(input);" }], focusPath: "app/tasks/page.tsx", expectedCount: 0, public: true },
     { id: "api-mutation", title: "Do not mutate through an API route", outcome: "match", files: [{ path: "app/tasks/page.tsx", source: "'use client'; await fetch('/api/tasks', { method: 'POST', body });" }], focusPath: "app/tasks/page.tsx", expectedCount: 1, public: true }
@@ -15163,21 +15326,39 @@ function resolvesToGlobalFetch(context, identifier) {
 function resolveNode(node, context) {
   if (!node) return null;
   if (node.type !== "Identifier") return node;
-  let scope = getScope(context, node);
-  while (scope) {
-    const variable = scope.set.get(node.name);
-    if (variable && variable.defs.length === 1) {
-      const def = variable.defs[0];
-      if (def && def.type === "Variable") {
-        const declarator = def.node;
-        if (declarator.type === "VariableDeclarator" && declarator.init) {
-          return declarator.init;
-        }
-      }
-    }
-    scope = scope.upper;
-  }
-  return node;
+  const variable = ASTUtils26.findVariable(getScope(context, node), node.name);
+  const definition = variable?.defs.length === 1 ? variable.defs[0] : void 0;
+  if (definition?.type !== "Variable" || definition.parent.kind !== "const" || definition.node.init === null || variable?.references.some((reference) => reference.isWrite() && reference.init !== true)) return node;
+  if (definition.node.init.type === "ObjectExpression" && variable?.references.some((reference) => reference.identifier !== node && reference.init !== true)) return node;
+  return definition.node.init;
+}
+function isAxiosClient(node, context, seen = /* @__PURE__ */ new Set()) {
+  if (node.type !== "Identifier" || seen.has(node)) return false;
+  seen.add(node);
+  const variable = ASTUtils26.findVariable(getScope(context, node), node.name);
+  const definition = variable?.defs.length === 1 ? variable.defs[0] : void 0;
+  if (definition === void 0 || variable?.references.some((reference) => reference.isWrite() && reference.init !== true)) return false;
+  if (variable?.references.some((reference) => {
+    if (reference.init === true) return false;
+    const identifier = reference.identifier;
+    const parent = identifier.parent;
+    if (parent.type === "CallExpression" && parent.callee === identifier) return false;
+    return parent.type !== "MemberExpression" || parent.object !== identifier || parent.computed || parent.parent.type !== "CallExpression" || parent.parent.callee !== parent;
+  })) return false;
+  if (definition.type === "ImportBinding") {
+    const declaration = definition.parent;
+    return declaration.type === "ImportDeclaration" && declaration.source.value === "axios" && declaration.importKind !== "type" && (definition.node.type === "ImportDefaultSpecifier" || definition.node.type === "ImportSpecifier" && definition.node.importKind !== "type" && (definition.node.imported.type === "Identifier" ? definition.node.imported.name : definition.node.imported.value) === "default");
+  }
+  if (definition.type !== "Variable" || definition.parent.kind !== "const") return false;
+  const init = definition.node.init;
+  return init?.type === "CallExpression" && init.arguments.length <= 1 && hasLocalAxiosOptions(init.arguments[0], context) && init.callee.type === "MemberExpression" && !init.callee.computed && init.callee.property.type === "Identifier" && init.callee.property.name === "create" && isAxiosClient(init.callee.object, context, seen);
+}
+function hasLocalAxiosOptions(node, context) {
+  if (node === void 0) return true;
+  const options = resolveNode(node, context);
+  return options?.type === "ObjectExpression" && options.properties.every(
+    (property) => property.type === "Property" && !property.computed && property.kind === "init" && !["baseURL", "adapter"].includes(property.key.type === "Identifier" ? property.key.name : property.key.type === "Literal" ? String(property.key.value) : "baseURL")
+  );
 }
 function isApiUrl(node, context, apiPrefixes) {
   const resolved = resolveNode(node, context);
@@ -15238,7 +15419,8 @@ function isFunctionArgument(node, context) {
 }
 function getPropertyNode(objNode, propName2) {
   if (!objNode || objNode.type !== "ObjectExpression") return null;
-  for (const prop of objNode.properties) {
+  if (objNode.properties.some((property) => property.type === "SpreadElement" || property.computed)) return null;
+  for (const prop of [...objNode.properties].reverse()) {
     if (prop.type !== "Property") continue;
     let keyName = null;
     if (prop.key.type === "Identifier" && !prop.computed) {
@@ -15276,7 +15458,7 @@ var prefer_server_actions_default = createRule({
       }
     ],
     messages: {
-      preferServerAction: "Mutation against a same-origin API route \u2014 prefer a Next.js Server Action for type-safety and to avoid the JSON round-trip."
+      preferServerAction: "This client mutation targets a same-origin API route. Consider a Server Action to remove the hand-written API wrapper; retain authorization and validation, since the call still crosses a network boundary."
     }
   },
   defaultOptions: [{}],
@@ -15320,9 +15502,11 @@ var prefer_server_actions_default = createRule({
               }
             }
           }
-        } else if (node.callee.type === "MemberExpression" && node.callee.property.type === "Identifier" && !node.callee.computed) {
+        } else if (node.callee.type === "MemberExpression" && node.callee.property.type === "Identifier" && !node.callee.computed && isAxiosClient(node.callee.object, context)) {
           const methodName2 = node.callee.property.name.toLowerCase();
           if (AXIOS_MUTATION_METHODS.has(methodName2)) {
+            const config = node.arguments[methodName2 === "delete" ? 1 : 2];
+            if (!hasLocalAxiosOptions(config, context)) return;
             const urlArg = node.arguments[0];
             const hasHandlerArg = node.arguments.some(
               (arg) => arg.type !== "SpreadElement" && isFunctionArgument(arg, context)
@@ -15331,11 +15515,12 @@ var prefer_server_actions_default = createRule({
               isMutation = true;
             }
           }
-        } else if (node.callee.type === "Identifier" && (node.callee.name === "axios" || node.callee.name === "request")) {
+        } else if (node.callee.type === "Identifier" && isAxiosClient(node.callee, context)) {
           const firstArg = node.arguments[0];
           if (firstArg && firstArg.type !== "SpreadElement") {
             const configArg = resolveNode(firstArg, context);
             if (configArg && configArg.type === "ObjectExpression") {
+              if (!hasLocalAxiosOptions(firstArg, context)) return;
               const urlNode = getPropertyNode(configArg, "url");
               const methodNode = getPropertyNode(configArg, "method");
               if (urlNode && isApiUrl(urlNode, context, apiPrefixes) && methodNode && isMutationMethod(methodNode, context)) {
@@ -15619,7 +15804,7 @@ var prefer_whole_object_assertion_default = createRule({
 });
 
 // src/rules/repeated-static-call-cases.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES68, ASTUtils as ASTUtils22 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES68, ASTUtils as ASTUtils27 } from "@typescript-eslint/utils";
 var REPEATED_STATIC_CALL_CASES_DOCUMENTATION = {
   summary: "Report three or more consecutive literal call assertions that should be independently named test cases.",
   rationale: "Copy-pasted cases obscure the input table and stop later cases from being reported after the first failure.",
@@ -15645,7 +15830,7 @@ function staticMemberName5(node) {
   return null;
 }
 function importedName6(identifier, context, modules) {
-  const variable = ASTUtils22.findVariable(context.sourceCode.getScope(identifier), identifier.name);
+  const variable = ASTUtils27.findVariable(context.sourceCode.getScope(identifier), identifier.name);
   if (variable === null || variable.defs.length === 0) return identifier.name;
   for (const definition of variable.defs) {
     if (definition.node.type !== AST_NODE_TYPES68.ImportSpecifier) continue;
@@ -16223,11 +16408,11 @@ var prefer_zod_infer_default = createRule({
           continue;
         }
         const key = member.key;
-        const propertyName8 = key.type === AST_NODE_TYPES69.Identifier ? key.name : key.type === AST_NODE_TYPES69.Literal && typeof key.value === "string" ? key.value : null;
-        if (propertyName8 === null) {
+        const propertyName6 = key.type === AST_NODE_TYPES69.Identifier ? key.name : key.type === AST_NODE_TYPES69.Literal && typeof key.value === "string" ? key.value : null;
+        if (propertyName6 === null) {
           continue;
         }
-        const propertyTokens = nameTokens(propertyName8);
+        const propertyTokens = nameTokens(propertyName6);
         if (propertyTokens.length < 2) {
           continue;
         }
@@ -16242,7 +16427,7 @@ var prefer_zod_infer_default = createRule({
           node: annotation,
           owner,
           ownerName,
-          propertyName: propertyName8,
+          propertyName: propertyName6,
           propertyTokens
         });
       }
@@ -16646,12 +16831,13 @@ var require_assert_never_default = createRule({
 });
 
 // src/rules/require-fetch-timeout.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES71, ASTUtils as ASTUtils23 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES71, ASTUtils as ASTUtils28 } from "@typescript-eslint/utils";
 var REQUIRE_FETCH_TIMEOUT_DOCUMENTATION = {
-  summary: "Require an abort `signal` (e.g. `AbortSignal.timeout(ms)`) on global `fetch()` calls so stalled upstreams cannot hang the caller forever.",
+  summary: "Require an explicit abort signal on locally analyzable global fetch calls.",
   rationale: "An unbounded request can occupy work indefinitely when an upstream stalls.",
   remediation: "Pass an abort signal, such as `AbortSignal.timeout(ms)`, in the fetch init.",
   category: "correctness",
+  limitations: ["Signal presence establishes an explicit cancellation path, not a guaranteed timeout. Forwarded Request objects can carry an existing signal."],
   examples: [
     { id: "bounded-fetch", title: "Bound the request", outcome: "no-match", files: [{ path: "src/client.ts", source: "await fetch(url, { signal: AbortSignal.timeout(5000) });" }], focusPath: "src/client.ts", expectedCount: 0, public: true },
     { id: "unbounded-fetch", title: "Do not leave fetch unbounded", outcome: "match", files: [{ path: "src/client.ts", source: "await fetch('https://api.example.com/items');" }], focusPath: "src/client.ts", expectedCount: 1, public: true }
@@ -16697,7 +16883,7 @@ var require_fetch_timeout_default = createRule({
   meta: {
     type: "problem",
     docs: {
-      description: "Require an abort `signal` (e.g. `AbortSignal.timeout(ms)`) on global `fetch()` calls so stalled upstreams cannot hang the caller forever."
+      description: "Require an explicit abort signal on locally analyzable global fetch calls."
     },
     schema: [
       {
@@ -16713,7 +16899,7 @@ var require_fetch_timeout_default = createRule({
       }
     ],
     messages: {
-      missingSignal: "This `fetch()` has no abort `signal` \u2014 a stalled upstream will hang it forever. Pass `{ signal: AbortSignal.timeout(ms) }` or a signal from an AbortController."
+      missingSignal: "This `fetch()` has no explicit abort signal. Pass `AbortSignal.timeout(ms)` for a deadline, or an owner-managed signal for cancellation."
     }
   },
   defaultOptions: [{}],
@@ -16727,7 +16913,7 @@ var require_fetch_timeout_default = createRule({
     }
     function resolvesToGlobal(identifier) {
       const scope = context.sourceCode.getScope(identifier);
-      const variable = ASTUtils23.findVariable(scope, identifier.name);
+      const variable = ASTUtils28.findVariable(scope, identifier.name);
       return variable === null || variable.defs.length === 0;
     }
     function isGlobalFetchCall2(callee) {
@@ -16737,7 +16923,7 @@ var require_fetch_timeout_default = createRule({
       return callee.type === AST_NODE_TYPES71.MemberExpression && !callee.computed && callee.property.type === AST_NODE_TYPES71.Identifier && callee.property.name === "fetch" && callee.object.type === AST_NODE_TYPES71.Identifier && GLOBAL_OBJECTS2.has(callee.object.name) && resolvesToGlobal(callee.object);
     }
     function localConstInitProvablyLacksSignal(identifier) {
-      const variable = ASTUtils23.findVariable(
+      const variable = ASTUtils28.findVariable(
         context.sourceCode.getScope(identifier),
         identifier.name
       );
@@ -16756,13 +16942,23 @@ var require_fetch_timeout_default = createRule({
       }
       return true;
     }
+    function isForwardedRequest(argument) {
+      let value = argument;
+      if (value.type === AST_NODE_TYPES71.Identifier) {
+        const binding = ASTUtils28.findVariable(context.sourceCode.getScope(value), value.name);
+        const definition = binding?.defs.length === 1 ? binding.defs[0] : void 0;
+        if (definition?.type !== "Variable" || definition.parent.kind !== "const" || definition.node.init === null || binding?.references.some((reference) => reference.isWrite() && reference.init !== true)) return false;
+        value = definition.node.init;
+      }
+      return value.type === AST_NODE_TYPES71.NewExpression && value.callee.type === AST_NODE_TYPES71.Identifier && value.callee.name === "Request" && resolvesToGlobal(value.callee);
+    }
     return {
       CallExpression(node) {
         if (!isGlobalFetchCall2(node.callee)) {
           return;
         }
         const [first, init] = node.arguments;
-        if (node.arguments.length === 1 && first !== void 0 && !isInlineUrl(first, resolvesToGlobal)) {
+        if (first !== void 0 && (node.arguments.length === 1 && !isInlineUrl(first, resolvesToGlobal) || isForwardedRequest(first))) {
           return;
         }
         if (init === void 0 || initProvablyLacksSignal(init) || init.type === AST_NODE_TYPES71.Identifier && localConstInitProvablyLacksSignal(init)) {
@@ -17775,7 +17971,7 @@ function isStaticValue(node) {
   }
   return false;
 }
-function propertyName7(property) {
+function propertyName5(property) {
   if (property.computed) return null;
   if (property.key.type === AST_NODE_TYPES75.Identifier) return property.key.name;
   return typeof property.key.value === "string" ? property.key.value : null;
@@ -17812,7 +18008,7 @@ var require_static_next_matcher_default = createRule({
             continue;
           }
           for (const property of config.properties) {
-            if (property.type !== AST_NODE_TYPES75.Property || propertyName7(property) !== "matcher" || property.value.type === AST_NODE_TYPES75.AssignmentPattern) {
+            if (property.type !== AST_NODE_TYPES75.Property || propertyName5(property) !== "matcher" || property.value.type === AST_NODE_TYPES75.AssignmentPattern) {
               continue;
             }
             if (!isStaticValue(property.value)) {
@@ -17826,21 +18022,21 @@ var require_static_next_matcher_default = createRule({
 });
 
 // src/rules/require-use-form-default-values.ts
-import { ASTUtils as ASTUtils24 } from "@typescript-eslint/utils";
+import { ASTUtils as ASTUtils29 } from "@typescript-eslint/utils";
 var REQUIRE_USE_FORM_DEFAULT_VALUES_DOCUMENTATION = {
-  summary: "react-hook-form useForm call without defaultValues",
+  summary: "react-hook-form useForm call without explicit initial or reactive values",
   rationale: "Without an explicit initial value, fields can change from uncontrolled to controlled as data arrives, reset behavior becomes ambiguous, and the form's initial shape no longer documents the values users can edit.",
-  remediation: "Pass an object with a defaultValues property to useForm; use empty strings, nulls, or schema-appropriate values deliberately for every controlled field.",
+  remediation: "Provide defaultValues for initial state, or values when reactive external state owns initialization; choose schema-appropriate values for controlled fields.",
   category: "correctness",
   limitations: [
-    "Only direct calls to a scope-resolved useForm value imported from react-hook-form are checked; wrapper hooks and computed option objects are intentionally not inferred."
+    "Only direct calls to a scope-resolved useForm value imported from react-hook-form are checked; reactive values are accepted, while wrapper hooks, spreads and computed option objects are intentionally not inferred."
   ],
   examples: [
     {
       id: "form-with-initial-values",
       title: "Give the form an explicit initial shape",
       outcome: "no-match",
-      files: [{ path: "profile-form.tsx", source: "import { useForm } from 'react-hook-form';\nconst form = useForm({ defaultValues: { name: '' } });\n" }],
+      files: [{ path: "profile-form.tsx", source: "'use client'; import { useForm } from 'react-hook-form'; function ProfileForm() { const form = useForm({ defaultValues: { name: '' } }); return <input {...form.register('name')} />; }" }],
       focusPath: "profile-form.tsx",
       expectedCount: 0,
       public: true
@@ -17849,16 +18045,16 @@ var REQUIRE_USE_FORM_DEFAULT_VALUES_DOCUMENTATION = {
       id: "form-without-initial-values",
       title: "Do not leave form initialization implicit",
       outcome: "match",
-      files: [{ path: "profile-form.tsx", source: "import { useForm } from 'react-hook-form';\nconst form = useForm({ mode: 'onChange' });\n" }],
+      files: [{ path: "profile-form.tsx", source: "'use client'; import { useForm } from 'react-hook-form'; function ProfileForm() { const form = useForm({ mode: 'onChange' }); return <input {...form.register('name')} />; }" }],
       focusPath: "profile-form.tsx",
       expectedCount: 1,
       public: true
     }
   ]
 };
-function hasDefaultValues(options) {
+function hasInitializationOrUnknownOptions(options) {
   return options?.type === "ObjectExpression" && options.properties.some(
-    (property) => property.type === "Property" && !property.computed && (property.key.type === "Identifier" && property.key.name === "defaultValues" || property.key.type === "Literal" && property.key.value === "defaultValues")
+    (property) => property.type === "SpreadElement" || property.computed || (property.key.type === "Identifier" && ["defaultValues", "values"].includes(property.key.name) || property.key.type === "Literal" && ["defaultValues", "values"].includes(String(property.key.value)))
   );
 }
 var require_use_form_default_values_default = createRule({
@@ -17869,7 +18065,7 @@ var require_use_form_default_values_default = createRule({
     docs: { description: REQUIRE_USE_FORM_DEFAULT_VALUES_DOCUMENTATION.summary },
     schema: [],
     messages: {
-      requireUseFormDefaultValues: "Pass explicit defaultValues to useForm so fields have a stable initial shape and reset behavior."
+      requireUseFormDefaultValues: "Provide defaultValues or reactive values to useForm so controlled fields have an explicit initial shape."
     }
   },
   defaultOptions: [],
@@ -17880,15 +18076,15 @@ var require_use_form_default_values_default = createRule({
         if (node.source.value !== "react-hook-form") return;
         for (const specifier of node.specifiers) {
           if (specifier.type !== "ImportSpecifier" || (specifier.imported.type === "Identifier" ? specifier.imported.name : specifier.imported.value) !== "useForm") continue;
-          const variable = ASTUtils24.findVariable(context.sourceCode.getScope(specifier.local), specifier.local.name);
+          const variable = ASTUtils29.findVariable(context.sourceCode.getScope(specifier.local), specifier.local.name);
           if (variable) importedHooks.add(variable);
         }
       },
       CallExpression(node) {
         if (node.callee.type !== "Identifier") return;
-        const variable = ASTUtils24.findVariable(context.sourceCode.getScope(node.callee), node.callee.name);
+        const variable = ASTUtils29.findVariable(context.sourceCode.getScope(node.callee), node.callee.name);
         const options = node.arguments[0];
-        if (!variable || !importedHooks.has(variable) || options !== void 0 && options.type !== "ObjectExpression" || hasDefaultValues(options)) return;
+        if (!variable || !importedHooks.has(variable) || options !== void 0 && options.type !== "ObjectExpression" || hasInitializationOrUnknownOptions(options)) return;
         context.report({ node, messageId: "requireUseFormDefaultValues" });
       }
     };
@@ -17901,10 +18097,10 @@ var ACTION_MODULE_RE = /(?:^|\/)app\/.*\/(?:actions|[^/]+-actions)\.[cm]?[jt]s$/
 var REQUIRE_USE_SERVER_IN_ACTIONS_FILE_DOCUMENTATION = {
   summary: "route action module missing the use server directive",
   rationale: "An exported async function is not callable as a Server Action merely because its file is named actions.ts. Without the module directive, a client import can fail or pull server-only implementation details across the client boundary.",
-  remediation: "Put 'use server' at the start of the route action module.",
+  remediation: "Use a leading module directive for an action-only module, or retain a function-level directive for an inline Server Action. Do not turn mixed non-action exports into a Server Action module.",
   category: "correctness",
   limitations: [
-    "Only exported async functions in actions.ts or *-actions.ts below an app directory are checked; other naming schemes and inline Server Actions are intentionally outside the rule."
+    "Only direct named exports of async declarations or initialized functions in actions.ts or *-actions.ts below an app directory are checked. Detached/default exports and other naming schemes are not inferred; functions with their own directive are accepted."
   ],
   examples: [
     {
@@ -17929,9 +18125,10 @@ var REQUIRE_USE_SERVER_IN_ACTIONS_FILE_DOCUMENTATION = {
 };
 function isExportedAsyncFunction(node) {
   const declaration = node.declaration;
-  if (declaration?.type === "FunctionDeclaration") return declaration.async;
+  const unmarked = (fn) => fn.async && !(fn.body?.type === "BlockStatement" && fn.body.body.some((statement) => statement.type === "ExpressionStatement" && statement.directive === "use server"));
+  if (declaration?.type === "FunctionDeclaration") return unmarked(declaration);
   return declaration?.type === "VariableDeclaration" && declaration.declarations.some(
-    (item) => item.init?.type === "ArrowFunctionExpression" || item.init?.type === "FunctionExpression" ? item.init.async : false
+    (item) => item.init?.type === "ArrowFunctionExpression" || item.init?.type === "FunctionExpression" ? unmarked(item.init) : false
   );
 }
 var require_use_server_in_actions_file_default = createRule({
@@ -17964,7 +18161,7 @@ var require_use_server_in_actions_file_default = createRule({
 // src/rules/require-zod-form-validation.ts
 import {
   AST_NODE_TYPES as AST_NODE_TYPES76,
-  ASTUtils as ASTUtils25
+  ASTUtils as ASTUtils30
 } from "@typescript-eslint/utils";
 var REQUIRE_ZOD_FORM_VALIDATION_DOCUMENTATION = {
   summary: "Require Zod validation (`Schema.parse(...)` / `Schema.safeParse(...)`) when reading values out of a `FormData` object.",
@@ -18032,7 +18229,7 @@ var require_zod_form_validation_default = createRule({
       return {};
     }
     const zodBindings = /* @__PURE__ */ new Set();
-    const resolvedBinding = (identifier) => ASTUtils25.findVariable(
+    const resolvedBinding = (identifier) => ASTUtils30.findVariable(
       context.sourceCode.getScope(identifier),
       identifier.name
     );
@@ -18329,7 +18526,7 @@ var store_insert_requires_on_conflict_default = createRule({
 });
 
 // src/rules/stepdown.ts
-import { AST_NODE_TYPES as AST_NODE_TYPES77, ASTUtils as ASTUtils26 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES77, ASTUtils as ASTUtils31 } from "@typescript-eslint/utils";
 var STEPDOWN_DOCUMENTATION = {
   summary: "Place a private helper below its sole direct same-scope caller.",
   rationale: "Caller-first ordering lets a reader follow the main flow before descending into implementation details.",
@@ -18534,7 +18731,7 @@ function methodName(node) {
   return !node.computed && node.key.type === AST_NODE_TYPES77.Identifier ? node.key.name : null;
 }
 function referencedMethod(context, node, classVariables) {
-  const objectVariable = node.object.type === AST_NODE_TYPES77.Identifier ? ASTUtils26.findVariable(context.sourceCode.getScope(node.object), node.object.name) : null;
+  const objectVariable = node.object.type === AST_NODE_TYPES77.Identifier ? ASTUtils31.findVariable(context.sourceCode.getScope(node.object), node.object.name) : null;
   const isClassReference = objectVariable !== null && classVariables.has(objectVariable);
   if (node.object.type !== AST_NODE_TYPES77.ThisExpression && !isClassReference) return null;
   if (node.property.type === AST_NODE_TYPES77.PrivateIdentifier) return `#${node.property.name}`;
@@ -18587,11 +18784,11 @@ function classScope(context, node, computedReferenceNames) {
   const pinned = /* @__PURE__ */ new Set();
   const classVariables = /* @__PURE__ */ new Set();
   if (node.id !== null) {
-    const internal = ASTUtils26.findVariable(context.sourceCode.getScope(node), node.id.name);
+    const internal = ASTUtils31.findVariable(context.sourceCode.getScope(node), node.id.name);
     if (internal !== null) classVariables.add(internal);
   }
   if (node.type === AST_NODE_TYPES77.ClassExpression && node.parent.type === AST_NODE_TYPES77.VariableDeclarator && node.parent.id.type === AST_NODE_TYPES77.Identifier) {
-    const outer = ASTUtils26.findVariable(context.sourceCode.getScope(node.parent), node.parent.id.name);
+    const outer = ASTUtils31.findVariable(context.sourceCode.getScope(node.parent), node.parent.id.name);
     if (outer !== null) classVariables.add(outer);
   }
   for (const method of methods) {
@@ -18627,7 +18824,7 @@ function classScope(context, node, computedReferenceNames) {
         return;
       }
       if (binding.type !== AST_NODE_TYPES77.Identifier) return;
-      const variable = ASTUtils26.findVariable(context.sourceCode.getScope(binding), binding.name);
+      const variable = ASTUtils31.findVariable(context.sourceCode.getScope(binding), binding.name);
       if (variable !== null) {
         methodClassVariables.add(variable);
         methodAliases.add(variable);
@@ -18657,7 +18854,7 @@ function classScope(context, node, computedReferenceNames) {
         return;
       }
       if (!privateNames.has(target)) return;
-      const objectVariable = current.object.type === AST_NODE_TYPES77.Identifier ? ASTUtils26.findVariable(context.sourceCode.getScope(current.object), current.object.name) : null;
+      const objectVariable = current.object.type === AST_NODE_TYPES77.Identifier ? ASTUtils31.findVariable(context.sourceCode.getScope(current.object), current.object.name) : null;
       if (objectVariable !== null && methodAliases.has(objectVariable)) {
         pinned.add(target);
         return;
@@ -18856,14 +19053,14 @@ function staticMemberName7(node) {
   if (node.computed && node.property.type === AST_NODE_TYPES78.Literal && typeof node.property.value === "string") return node.property.value;
   return null;
 }
-function unwrap6(node) {
-  if (node.type === AST_NODE_TYPES78.AwaitExpression) return unwrap6(node.argument);
-  if (node.type === AST_NODE_TYPES78.ChainExpression) return unwrap6(node.expression);
-  if (node.type === AST_NODE_TYPES78.TSAsExpression || node.type === AST_NODE_TYPES78.TSNonNullExpression || node.type === AST_NODE_TYPES78.TSTypeAssertion) return unwrap6(node.expression);
+function unwrap7(node) {
+  if (node.type === AST_NODE_TYPES78.AwaitExpression) return unwrap7(node.argument);
+  if (node.type === AST_NODE_TYPES78.ChainExpression) return unwrap7(node.expression);
+  if (node.type === AST_NODE_TYPES78.TSAsExpression || node.type === AST_NODE_TYPES78.TSNonNullExpression || node.type === AST_NODE_TYPES78.TSTypeAssertion) return unwrap7(node.expression);
   return node;
 }
 function stringValue(node) {
-  const current = unwrap6(node);
+  const current = unwrap7(node);
   if (current.type === AST_NODE_TYPES78.Literal && typeof current.value === "string") return current.value;
   if (current.type === AST_NODE_TYPES78.TemplateLiteral && current.expressions.length === 0) return current.quasis[0]?.value.cooked ?? null;
   return null;
@@ -18872,7 +19069,7 @@ function importSource(node) {
   return typeof node.source.value === "string" ? node.source.value : null;
 }
 function requireSource(node) {
-  const current = unwrap6(node);
+  const current = unwrap7(node);
   if (current.type !== AST_NODE_TYPES78.CallExpression || current.callee.type !== AST_NODE_TYPES78.Identifier || current.callee.name !== "require" || current.arguments.length !== 1 || current.arguments[0]?.type === AST_NODE_TYPES78.SpreadElement) return null;
   return stringValue(current.arguments[0]);
 }
@@ -18910,7 +19107,7 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         return /* @__PURE__ */ new Set();
       };
       const sourcePath = (node) => {
-        const current = unwrap6(node);
+        const current = unwrap7(node);
         const value = stringValue(current);
         if (value !== null) return sourceSuffixRe.test(value);
         if (current.type === AST_NODE_TYPES78.Identifier) return visible("paths", current.name);
@@ -18925,37 +19122,37 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         return false;
       };
       const rawRead = (node) => {
-        const current = unwrap6(node);
+        const current = unwrap7(node);
         if (current.type !== AST_NODE_TYPES78.CallExpression || current.arguments.length === 0) return false;
-        const callee = unwrap6(current.callee);
+        const callee = unwrap7(current.callee);
         if (callee.type === AST_NODE_TYPES78.Identifier) {
           return visible("fsReaders", callee.name) && sourcePath(current.arguments[0]);
         }
         if (callee.type !== AST_NODE_TYPES78.MemberExpression) return false;
         const name2 = staticMemberName7(callee);
-        const object = unwrap6(callee.object);
+        const object = unwrap7(callee.object);
         return name2 !== null && FS_READERS.has(name2) && object.type === AST_NODE_TYPES78.Identifier && visible("fsObjects", object.name) && sourcePath(current.arguments[0]);
       };
       const rawOrigins = (node) => {
-        const current = unwrap6(node);
+        const current = unwrap7(node);
         if (current.type === AST_NODE_TYPES78.Identifier) return visibleRawOrigins(current.name);
         if (rawRead(current)) return /* @__PURE__ */ new Set([`${current.range[0]}:${current.range[1]}`]);
         if (current.type === AST_NODE_TYPES78.BinaryExpression && current.operator === "+") return /* @__PURE__ */ new Set([...rawOrigins(current.left), ...rawOrigins(current.right)]);
         if (current.type === AST_NODE_TYPES78.MemberExpression && staticMemberName7(current) === "length") return rawOrigins(current.object);
         if (current.type !== AST_NODE_TYPES78.CallExpression) return /* @__PURE__ */ new Set();
-        const callee = unwrap6(current.callee);
+        const callee = unwrap7(current.callee);
         if (callee.type !== AST_NODE_TYPES78.MemberExpression) return /* @__PURE__ */ new Set();
         const name2 = staticMemberName7(callee);
         return name2 !== null && TEXT_TRANSFORMS.has(name2) ? rawOrigins(callee.object) : /* @__PURE__ */ new Set();
       };
       const evidenceOrigins = (node) => {
-        const current = unwrap6(node);
+        const current = unwrap7(node);
         const direct = rawOrigins(current);
         if (direct.size > 0) return direct;
         if (current.type === AST_NODE_TYPES78.BinaryExpression || current.type === AST_NODE_TYPES78.LogicalExpression) return /* @__PURE__ */ new Set([...evidenceOrigins(current.left), ...evidenceOrigins(current.right)]);
         if (current.type === AST_NODE_TYPES78.UnaryExpression) return evidenceOrigins(current.argument);
         if (current.type !== AST_NODE_TYPES78.CallExpression) return /* @__PURE__ */ new Set();
-        const callee = unwrap6(current.callee);
+        const callee = unwrap7(current.callee);
         if (callee.type !== AST_NODE_TYPES78.MemberExpression) return /* @__PURE__ */ new Set();
         const name2 = staticMemberName7(callee);
         if (name2 !== null && TEXT_PREDICATES.has(name2)) return rawOrigins(callee.object);
@@ -18963,15 +19160,15 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         return /* @__PURE__ */ new Set();
       };
       const rawAssertionOrigins = (node) => {
-        const callee = unwrap6(node.callee);
+        const callee = unwrap7(node.callee);
         if (callee.type === AST_NODE_TYPES78.Identifier && callee.name === "assert") {
           return new Set(node.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES78.SpreadElement ? [] : [...evidenceOrigins(argument)]));
         }
         if (callee.type !== AST_NODE_TYPES78.MemberExpression) return /* @__PURE__ */ new Set();
         const matcher = staticMemberName7(callee);
         if (matcher === null) return /* @__PURE__ */ new Set();
-        let receiver = unwrap6(callee.object);
-        while (receiver.type === AST_NODE_TYPES78.MemberExpression && EXPECT_MODIFIERS2.has(staticMemberName7(receiver) ?? "")) receiver = unwrap6(receiver.object);
+        let receiver = unwrap7(callee.object);
+        while (receiver.type === AST_NODE_TYPES78.MemberExpression && EXPECT_MODIFIERS2.has(staticMemberName7(receiver) ?? "")) receiver = unwrap7(receiver.object);
         if (receiver.type === AST_NODE_TYPES78.CallExpression && receiver.callee.type === AST_NODE_TYPES78.Identifier && receiver.callee.name === "expect") {
           if (!EXPECT_MATCHERS.has(matcher)) return /* @__PURE__ */ new Set();
           return new Set([...receiver.arguments, ...node.arguments].flatMap((argument) => argument.type === AST_NODE_TYPES78.SpreadElement ? [] : [...evidenceOrigins(argument)]));
@@ -18980,7 +19177,7 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         return new Set(node.arguments.flatMap((argument) => argument.type === AST_NODE_TYPES78.SpreadElement ? [] : [...evidenceOrigins(argument)]));
       };
       const rawRegexExtractionOrigins = (node) => {
-        const callee = unwrap6(node.callee);
+        const callee = unwrap7(node.callee);
         if (callee.type !== AST_NODE_TYPES78.MemberExpression || staticMemberName7(callee) !== "matchAll" || node.arguments.length !== 1) return /* @__PURE__ */ new Set();
         const argument = node.arguments[0];
         if (argument?.type !== AST_NODE_TYPES78.Literal || !(argument.value instanceof RegExp)) return /* @__PURE__ */ new Set();
@@ -19003,11 +19200,11 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
         }
       };
       const sourceCollection = (node) => {
-        const current = unwrap6(node);
+        const current = unwrap7(node);
         return current.type === AST_NODE_TYPES78.ArrayExpression && current.elements.length > 0 && current.elements.every((element) => element !== null && element.type !== AST_NODE_TYPES78.SpreadElement && sourcePath(element));
       };
       const declaredNames2 = (node) => {
-        const current = unwrap6(node);
+        const current = unwrap7(node);
         if (current.type === AST_NODE_TYPES78.Identifier) return [current.name];
         if (current.type === AST_NODE_TYPES78.AssignmentPattern) return declaredNames2(current.left);
         if (current.type === AST_NODE_TYPES78.RestElement) return declaredNames2(current.argument);
@@ -19059,7 +19256,7 @@ function createSourceCoupledRule(name, documentation, sourceSuffixRe) {
           if (node.left.type === AST_NODE_TYPES78.Identifier) declare(node.left.name, { path: sourcePath(node.right), rawOrigins: rawOrigins(node.right) });
         },
         ForOfStatement(node) {
-          const right = unwrap6(node.right);
+          const right = unwrap7(node.right);
           const collection = right.type === AST_NODE_TYPES78.Identifier && visible("collections", right.name);
           const left = node.left.type === AST_NODE_TYPES78.VariableDeclaration ? node.left.declarations[0]?.id : node.left;
           if (collection && left?.type === AST_NODE_TYPES78.Identifier) declare(left.name, { path: true });
@@ -19092,7 +19289,8 @@ var SOLE_EXPORT_MATCHES_FILENAME_DOCUMENTATION = {
   category: "maintainability",
   limitations: [
     "Framework entrypoints, generic stems covered by no-generic-single-export-module, tests, generated files, anonymous defaults, CommonJS, and re-exports are excluded.",
-    "The rule compares the primary filename stem and preserves conventional suffixes such as .server or .worker."
+    "The rule compares the primary filename stem and preserves a single private underscore prefix and conventional suffixes such as .server or .worker.",
+    "Exported destructuring patterns are excluded rather than undercounted as public exports."
   ],
   examples: [
     { id: "matching-class", title: "Match a class and module", outcome: "no-match", files: [{ path: "src/artifact-store.ts", source: "export class ArtifactStore {}" }], focusPath: "src/artifact-store.ts", expectedCount: 0, public: true },
@@ -19148,7 +19346,7 @@ var sole_export_matches_filename_default = createRule({
   create(context) {
     const fileStem = stem3(context.filename);
     const normalizedFilename = context.filename.replaceAll("\\", "/");
-    if (EXCLUDED_STEMS.has(fileStem) || normalizedFilename.includes("/pages/") || context.filename.endsWith(".d.ts") || isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) return {};
+    if (EXCLUDED_STEMS.has(fileStem) || /(?:^|\/)app\/(?:.*\/)?(?:global-)?error\.[jt]sx?$/u.test(normalizedFilename) || normalizedFilename.includes("/pages/") || context.filename.endsWith(".d.ts") || isTestFile(context.filename) || isGeneratedFile(context.filename, context.sourceCode.text)) return {};
     return {
       "Program:exit"(program) {
         const exports = [];
@@ -19167,6 +19365,7 @@ var sole_export_matches_filename_default = createRule({
             publicExports.add(declaration.id.name);
           }
           if (declaration?.type === AST_NODE_TYPES79.VariableDeclaration) {
+            if (declaration.declarations.some((item) => item.id.type !== AST_NODE_TYPES79.Identifier)) return;
             for (const item of declaration.declarations) {
               if (item.id.type === AST_NODE_TYPES79.Identifier) publicExports.add(item.id.name);
             }
@@ -19189,8 +19388,12 @@ var sole_export_matches_filename_default = createRule({
         if (unique.size !== 1 || publicExports.size !== 1) return;
         const only = [...unique.values()][0];
         if (only === void 0) return;
-        const expected = kebabCase(only.name);
-        if (expected === "" || expected === fileStem.toLowerCase()) return;
+        if (only.name === "onRouterTransitionStart" && /(?:^|\/)instrumentation-client\.[jt]s$/u.test(normalizedFilename)) return;
+        if (only.name === "collections" && /(?:^|\/)src\/content\.config\.(?:ts|js|mjs)$/u.test(normalizedFilename) && program.body.some((statement) => statement.type === AST_NODE_TYPES79.ImportDeclaration && statement.source.value === "astro:content")) return;
+        const exportedStem = kebabCase(only.name);
+        if (exportedStem === "") return;
+        const expected = `${fileStem.startsWith("_") ? "_" : ""}${exportedStem}`;
+        if (expected === fileStem.toLowerCase()) return;
         context.report({ node: only.node, messageId: "matchSoleExport", data: { exported: only.name, expected } });
       }
     };
@@ -19238,7 +19441,7 @@ var iac_source_coupled_test_default = createSourceCoupledRule(
 // src/rules/require-pascal-case-zod-schema-name.ts
 import {
   AST_NODE_TYPES as AST_NODE_TYPES80,
-  ASTUtils as ASTUtils27
+  ASTUtils as ASTUtils32
 } from "@typescript-eslint/utils";
 var REQUIRE_PASCAL_CASE_ZOD_SCHEMA_NAME_DOCUMENTATION = {
   summary: "Require confirmed module-level Zod schema contracts to use PascalCase with a `Schema` suffix.",
@@ -19439,7 +19642,7 @@ var require_pascal_case_zod_schema_name_default = createRule({
     const zodBindings = /* @__PURE__ */ new Set();
     const schemaBindings = /* @__PURE__ */ new Set();
     function resolvedBinding(identifier) {
-      return ASTUtils27.findVariable(
+      return ASTUtils32.findVariable(
         context.sourceCode.getScope(identifier),
         identifier.name
       );
@@ -19684,7 +19887,7 @@ var RULES = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.17.8"
+  version: "15.17.9"
 };
 var APPLICATION_ONLY_RULES = [];
 var LIBRARY_IMPORT_POLICY = ["error", {