@sarj/eslint-plugin 16.12.0 → 16.13.1

package/dist/index.cjs

@@ -52,7 +52,7 @@ module.exports = __toCommonJS(src_exports);
 // package.json
 var package_default = {
   name: "@sarj/eslint-plugin",
-  version: "16.12.0",
+  version: "16.13.1",
   packageManager: "npm@12.2.0",
   description: "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   type: "module",
@@ -4794,254 +4794,291 @@ var no_comment_cruft_default = createRule({
 
 // src/rules/no-cors-wildcard-with-credentials.ts
 var import_utils28 = require("@typescript-eslint/utils");
+var ACAO_HEADER = "access-control-allow-origin";
+var ACAC_HEADER = "access-control-allow-credentials";
+var HEADER_METHODS = /* @__PURE__ */ new Set(["set", "setHeader", "append", "delete", "removeHeader"]);
+var CONTROL_STATEMENTS = /* @__PURE__ */ new Set([
+  "BlockStatement",
+  "IfStatement",
+  "SwitchStatement",
+  "TryStatement",
+  "ForStatement",
+  "ForInStatement",
+  "ForOfStatement",
+  "WhileStatement",
+  "DoWhileStatement",
+  "WithStatement",
+  "LabeledStatement"
+]);
 var NO_CORS_WILDCARD_WITH_CREDENTIALS_DOCUMENTATION = {
-  summary: "Disallow wildcard CORS origins when credentials are enabled.",
-  rationale: "Reflecting every origin while allowing credentials can let an untrusted site read authenticated cross-origin responses.",
-  remediation: "Enumerate the trusted origins that may receive credentialed responses.",
-  category: "security",
+  summary: "Review wildcard CORS origins combined with an explicit credentials opt-in.",
+  rationale: "Browsers do not expose credentialed cross-origin responses when Access-Control-Allow-Origin is '*'. Credentialless requests can still use a wildcard even when Access-Control-Allow-Credentials is emitted, so review the intended caller contract.",
+  remediation: "Use a trusted explicit origin for credentialed callers, or omit the credentials opt-in for a credentialless wildcard endpoint.",
+  category: "correctness",
+  defaultLevel: "warning",
+  autofix: "none",
+  references: ["https://fetch.spec.whatwg.org/#cors-protocol-and-credentials"],
   limitations: [
-    "The rule detects literal CORS option and header combinations within the same syntactic scope; it does not resolve runtime configuration."
+    "Options require a stable official cors default import or hono/cors named or namespace import, one literal object argument, literal origin '*', and credentials true. Custom bindings, callbacks, arrays, conditional origins and dynamic options are excluded.",
+    "Literal header maps use effective case-sensitive JavaScript property writes followed by native Headers combination of differently-cased header names. Unknown values/spreads/computed keys, accessors and non-null prototypes lose proof; literals used only inside object spreads are not reported independently.",
+    "Manual set/setHeader/delete/removeHeader calls use direct identifier receivers and literal arguments in straight-line program or function bodies. Control-flow bodies, member receivers, aliases and unknown operations are excluded. Append requires a proven empty native Headers constructor or a preceding known write/removal.",
+    "The rule reviews a local configuration contract, not actual request credentials or a data disclosure. Runtime patches, custom header method implementations, interprocedural mutation and later consumers are not resolved. No autofix."
   ],
   examples: [
     {
       id: "trusted-origin-with-credentials",
-      title: "Credentials are limited to a trusted origin",
+      title: "Use a trusted origin for credentialed callers",
       outcome: "no-match",
-      files: [{ path: "src/server.ts", source: "app.use(cors({ origin: 'https://app.example.com', credentials: true }));" }],
+      files: [{ path: "src/server.ts", source: "import cors from 'cors'; cors({ origin: 'https://app.example.com', credentials: true });" }],
       focusPath: "src/server.ts",
       expectedCount: 0,
       public: true
     },
     {
       id: "wildcard-origin-with-credentials",
-      title: "Credentials are enabled for every origin",
+      title: "Review a wildcard that blocks access to credentialed responses",
       outcome: "match",
-      files: [{ path: "src/server.ts", source: "app.use(cors({ origin: '*', credentials: true }));" }],
+      files: [{ path: "src/server.ts", source: "import cors from 'cors'; cors({ origin: '*', credentials: true });" }],
       focusPath: "src/server.ts",
       expectedCount: 1,
       public: true
     }
   ]
 };
-var ACAO_HEADER = "access-control-allow-origin";
-var ACAC_HEADER = "access-control-allow-credentials";
-var HEADER_SET_METHODS = /* @__PURE__ */ new Set(["setheader", "set", "append"]);
-function isCredentialsTrueValue(node) {
-  node = unwrapExpression(node);
-  if (node.type === "Literal") {
-    if (node.value === true) {
-      return true;
-    }
-    if (typeof node.value === "string") {
-      return node.value.trim().toLowerCase() === "true";
-    }
-  }
-  return false;
-}
-function isStarLiteral(node) {
-  return node.type === "Literal" && node.value === "*";
-}
-function propertyKeyName(prop) {
-  return import_utils28.ASTUtils.getPropertyName(prop) ?? void 0;
-}
-function isCorsWildcardCredentialsCall(node) {
-  const name = calleeName(node);
-  if (name === void 0 || name.toLowerCase() !== "cors") {
-    return false;
-  }
-  const options = node.arguments.map(unwrapExpression).find(
-    (arg) => arg.type === "ObjectExpression"
-  );
-  if (options === void 0) {
-    return false;
-  }
-  let hasCredentials = false;
-  let hasWildcardOrigin = false;
-  for (const prop of options.properties) {
-    if (prop.type !== "Property") {
-      continue;
-    }
-    const key = propertyKeyName(prop);
-    if (key === "credentials" && isTrueLiteral(prop.value)) {
-      hasCredentials = true;
-    } else if (key === "origin" && subtreeContainsStarLiteral(prop.value)) {
-      hasWildcardOrigin = true;
-    }
-  }
-  return hasCredentials && hasWildcardOrigin;
-}
-function isTrueLiteral(node) {
-  node = unwrapExpression(node);
-  return node.type === "Literal" && node.value === true;
-}
-function subtreeContainsStarLiteral(node) {
-  if (isStarLiteral(node)) {
-    return true;
-  }
-  return forEachOwnAstChild(
-    node,
-    subtreeContainsStarLiteral,
-    (key) => key !== "loc" && key !== "range"
-  );
-}
-function calleeName(node) {
-  const callee = unwrapExpression(node.callee);
-  if (callee.type === "Identifier") {
-    return callee.name;
-  }
-  if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier") {
-    return callee.property.name;
-  }
-  return void 0;
-}
-function isWildcardCredentialsHeaderObject(node) {
-  let wildcardOrigin = false;
-  let credentialsTrue = false;
-  for (const prop of node.properties) {
-    if (prop.type !== "Property") {
-      continue;
-    }
-    const key = propertyKeyName(prop);
-    if (key === void 0) {
-      continue;
-    }
-    const header = key.toLowerCase();
-    if (header === ACAO_HEADER && isStarLiteral(prop.value)) {
-      wildcardOrigin = true;
-    } else if (header === ACAC_HEADER && isCredentialsTrueValue(prop.value)) {
-      credentialsTrue = true;
-    }
-  }
-  return wildcardOrigin && credentialsTrue;
-}
-function classifyHeaderSetCall(node) {
-  const callee = unwrapExpression(node.callee);
-  if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier" || !HEADER_SET_METHODS.has(callee.property.name.toLowerCase())) {
-    return void 0;
-  }
-  const [nameArg, valueArg] = node.arguments;
-  if (nameArg === void 0 || valueArg === void 0 || nameArg.type !== "Literal" || typeof nameArg.value !== "string") {
-    return void 0;
-  }
-  const header = nameArg.value.toLowerCase();
-  if (header === ACAO_HEADER && isStarLiteral(valueArg)) {
-    return "origin";
-  }
-  if (header === ACAC_HEADER && isCredentialsTrueValue(valueArg)) {
-    return "credentials";
-  }
-  return void 0;
-}
-function enclosingScope(node) {
-  let current = node.parent;
-  while (current) {
-    if (current.type === "FunctionDeclaration" || current.type === "FunctionExpression" || current.type === "ArrowFunctionExpression") {
-      return current;
-    }
-    current = current.parent;
-  }
-  return void 0;
-}
 var no_cors_wildcard_with_credentials_default = createRule({
   name: "no-cors-wildcard-with-credentials",
   documentation: NO_CORS_WILDCARD_WITH_CREDENTIALS_DOCUMENTATION,
   meta: {
     type: "problem",
-    docs: {
-      description: "Disallow wildcard CORS origins when credentials are enabled."
-    },
+    docs: { description: NO_CORS_WILDCARD_WITH_CREDENTIALS_DOCUMENTATION.summary },
     schema: [],
     messages: {
-      corsWildcardWithCredentials: 'CORS reflects any Origin (`"*"`) while allowing credentials \u2014 any site can read authenticated responses. Enumerate explicit trusted origins instead of using `"*"` with credentials.'
+      corsWildcardWithCredentials: "A wildcard CORS origin blocks browser access to credentialed responses. Review the intended contract: use a trusted explicit origin for credentialed callers, or omit the credentials opt-in for a credentialless endpoint."
     }
   },
   defaultOptions: [],
   create(context) {
-    const scopeHeaderSets = /* @__PURE__ */ new Map();
-    const variableIds = /* @__PURE__ */ new WeakMap();
-    let nextVariableId = 0;
-    function recordHeaderSet(node, kind) {
-      const unwrappedNodeCallee = unwrapExpression(node.callee);
-      if (unwrappedNodeCallee.type !== import_utils28.AST_NODE_TYPES.MemberExpression) return;
-      const receiver = receiverIdentity(unwrappedNodeCallee.object);
-      if (receiver === null) return;
-      const key = enclosingScope(node) ?? "module";
-      let receivers = scopeHeaderSets.get(key);
-      if (receivers === void 0) {
-        receivers = /* @__PURE__ */ new Map();
-        scopeHeaderSets.set(key, receivers);
-      }
-      let entry = receivers.get(receiver);
-      if (entry === void 0) {
-        entry = { originNodes: [], credentialsNodes: [] };
-        receivers.set(receiver, entry);
-      }
-      if (kind === "origin") {
-        entry.originNodes.push(node);
-      } else {
-        entry.credentialsNodes.push(node);
+    const sourceCode = context.sourceCode;
+    const importedCors = /* @__PURE__ */ new Set();
+    const importedNamespaces = /* @__PURE__ */ new Set();
+    const receiverProof = /* @__PURE__ */ new Map();
+    function binding(node) {
+      return import_utils28.ASTUtils.findVariable(sourceCode.getScope(node), node.name);
+    }
+    function officialCors(node) {
+      const value = unwrapExpression(node);
+      if (value.type === "Identifier") {
+        const variable2 = binding(value);
+        return variable2 !== null && importedCors.has(variable2);
       }
+      if (value.type !== "MemberExpression" || value.optional || value.computed || value.property.type !== "Identifier" || value.property.name !== "cors" || value.object.type !== "Identifier") return false;
+      const variable = binding(value.object);
+      return variable !== null && importedNamespaces.has(variable);
     }
-    function receiverIdentity(node) {
-      if (node.type === import_utils28.AST_NODE_TYPES.Identifier) {
-        const variable = import_utils28.ASTUtils.findVariable(
-          context.sourceCode.getScope(node),
-          node.name
-        );
-        return variable === null ? `global:${node.name}` : `variable:${variableId(variable)}`;
+    function recordImports(node) {
+      for (const statement of node.body) {
+        if (statement.type === "ImportDeclaration" && statement.importKind !== "type") recordImport(statement);
+      }
+    }
+    function recordImport(node) {
+      for (const specifier of node.specifiers) {
+        const role = importRole(specifier, node.source.value);
+        if (role === null) continue;
+        const variable = binding(specifier.local);
+        if (variable === null || variable.references.some((reference) => reference.isWrite())) continue;
+        (role === "namespace" ? importedNamespaces : importedCors).add(variable);
+      }
+    }
+    function inspectSequence(node) {
+      if (node.body.some((statement) => CONTROL_STATEMENTS.has(statement.type))) return;
+      const states = /* @__PURE__ */ new Map();
+      for (const statement of node.body) {
+        if (statement.type === "ImportDeclaration" || statement.type === "FunctionDeclaration") continue;
+        if (statement.type === "VariableDeclaration") {
+          recordHeaderDeclaration(statement, states);
+          continue;
+        }
+        const expression = statement.type === "ExpressionStatement" ? unwrapExpression(statement.expression) : null;
+        if (expression?.type !== "CallExpression" || !applyHeaderWrite(expression, states)) states.clear();
       }
-      if (node.type === import_utils28.AST_NODE_TYPES.ThisExpression) return "this";
-      if (node.type === import_utils28.AST_NODE_TYPES.MemberExpression && !node.computed && node.property.type === import_utils28.AST_NODE_TYPES.Identifier) {
-        const owner = receiverIdentity(node.object);
-        return owner === null ? null : `${owner}.${node.property.name}`;
+      for (const state of states.values()) {
+        if (state.values[ACAO_HEADER] === "*" && state.values[ACAC_HEADER] === "true" && state.origin !== null) {
+          context.report({ node: state.origin, messageId: "corsWildcardWithCredentials" });
+        }
       }
-      return null;
     }
-    function variableId(variable) {
-      const existing = variableIds.get(variable);
-      if (existing !== void 0) return existing;
-      const value = nextVariableId++;
-      variableIds.set(variable, value);
-      return value;
+    function recordHeaderDeclaration(node, states) {
+      for (const declaration of node.declarations) {
+        if (declaration.id.type === "Identifier" && declaration.init !== null && freshHeaders(declaration.init)) {
+          const key = receiverKey(declaration.id);
+          if (key !== null) states.set(key, { values: { [ACAO_HEADER]: null, [ACAC_HEADER]: null }, origin: null });
+        } else if (declaration.id.type !== "Identifier" || declaration.init !== null && unwrapExpression(declaration.init).type !== "Literal") states.clear();
+      }
+    }
+    function freshHeaders(node) {
+      const value = unwrapExpression(node);
+      if (value.type !== "NewExpression" || value.arguments.length !== 0) return false;
+      const callee = unwrapExpression(value.callee);
+      return callee.type === "Identifier" && callee.name === "Headers" && !binding(callee)?.defs.length;
+    }
+    function applyHeaderWrite(node, states) {
+      const callee = unwrapExpression(node.callee);
+      if (node.optional || callee.type !== "MemberExpression" || callee.optional || callee.computed || callee.property.type !== "Identifier" || !HEADER_METHODS.has(callee.property.name) || callee.object.type !== "Identifier") return false;
+      const method = callee.property.name;
+      const removal = method === "delete" || method === "removeHeader";
+      if (node.arguments.length !== (removal ? 1 : 2)) return false;
+      const name = literalString(node.arguments[0]);
+      const value = removal ? null : headerValue(node.arguments[1]);
+      if (name === null || !removal && value === null) return false;
+      const key = receiverKey(callee.object);
+      if (key === null) return false;
+      let state = states.get(key);
+      if (state === void 0) {
+        state = { values: { [ACAO_HEADER]: void 0, [ACAC_HEADER]: void 0 }, origin: null };
+        states.set(key, state);
+      }
+      const header = name.toLowerCase();
+      if (header !== ACAO_HEADER && header !== ACAC_HEADER) return true;
+      state.values[header] = method === "append" ? appendValue(state.values[header], value) : value;
+      if (header === ACAO_HEADER) state.origin = node;
+      return true;
+    }
+    function receiverKey(node) {
+      const variable = binding(node);
+      const key = variable ?? node.name;
+      const cached = receiverProof.get(key);
+      if (cached !== void 0) return cached ? key : null;
+      const references = variable?.references ?? sourceCode.scopeManager?.globalScope?.through.filter((reference) => reference.identifier.name === node.name) ?? [];
+      const unaliased = !variable?.defs.some(aliasDefinition) && references.every(headerReceiverReference);
+      receiverProof.set(key, unaliased);
+      return unaliased ? key : null;
     }
     return {
-      NewExpression(node) {
-        if (isCorsWildcardCredentialsCall(node)) {
-          context.report({ node, messageId: "corsWildcardWithCredentials" });
-        }
+      Program(node) {
+        recordImports(node);
+        inspectSequence(node);
+      },
+      BlockStatement(node) {
+        if (["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"].includes(node.parent.type)) inspectSequence(node);
       },
       CallExpression(node) {
-        if (isCorsWildcardCredentialsCall(node)) {
+        if (node.optional || node.arguments.length !== 1 || !officialCors(node.callee)) return;
+        const argument = node.arguments[0];
+        const options = argument === void 0 ? void 0 : unwrapExpression(argument);
+        if (options?.type !== "ObjectExpression") return;
+        const properties = effectiveProperties(options);
+        const origin = properties?.get("origin");
+        const credentials = properties?.get("credentials");
+        const value = credentials === void 0 ? void 0 : unwrapExpression(credentials.value);
+        if (origin !== void 0 && literalString(origin.value) === "*" && value?.type === "Literal" && value.value === true) {
           context.report({ node, messageId: "corsWildcardWithCredentials" });
-          return;
-        }
-        const kind = classifyHeaderSetCall(node);
-        if (kind !== void 0) {
-          recordHeaderSet(node, kind);
         }
       },
       ObjectExpression(node) {
-        if (isWildcardCredentialsHeaderObject(node)) {
+        if (spreadOnly(node)) return;
+        const properties = effectiveProperties(node);
+        if (properties === null) return;
+        const headers = /* @__PURE__ */ new Map();
+        for (const [key, property] of properties) {
+          const value = headerValue(property.value);
+          if (value === null) return;
+          const name = key.toLowerCase();
+          if (name !== ACAO_HEADER && name !== ACAC_HEADER) continue;
+          const previous = headers.get(name);
+          headers.set(name, previous === void 0 ? value : previous + ", " + value);
+        }
+        if (headers.get(ACAO_HEADER) === "*" && headers.get(ACAC_HEADER) === "true") {
           context.report({ node, messageId: "corsWildcardWithCredentials" });
         }
-      },
-      "Program:exit"() {
-        for (const receivers of scopeHeaderSets.values()) {
-          for (const { originNodes, credentialsNodes } of receivers.values()) {
-            if (originNodes.length > 0 && credentialsNodes.length > 0) {
-              for (const node of originNodes) {
-                context.report({
-                  node,
-                  messageId: "corsWildcardWithCredentials"
-                });
-              }
-            }
-          }
-        }
       }
     };
   }
 });
+function importRole(specifier, module2) {
+  if (module2 === "hono/cors" && specifier.type === "ImportNamespaceSpecifier") return "namespace";
+  if (module2 === "cors" && specifier.type === "ImportDefaultSpecifier") return "function";
+  if (specifier.type !== "ImportSpecifier" || specifier.importKind === "type") return null;
+  const name = specifier.imported.type === "Identifier" ? specifier.imported.name : specifier.imported.value;
+  return module2 === "cors" && name === "default" || module2 === "hono/cors" && name === "cors" ? "function" : null;
+}
+function aliasDefinition(definition) {
+  if (definition.type !== "Variable") return false;
+  if (definition.node.id.type !== "Identifier") return true;
+  const initializer = definition.node.init;
+  return initializer !== null && ["Identifier", "MemberExpression", "AssignmentExpression", "ConditionalExpression", "LogicalExpression", "SequenceExpression"].includes(unwrapExpression(initializer).type);
+}
+function headerReceiverReference(reference) {
+  let typeName = reference.identifier;
+  while (typeName.parent.type === "TSQualifiedName") typeName = typeName.parent;
+  if (reference.isValueReference === false || typeName.parent.type === "TSTypeQuery") return true;
+  if (reference.isWrite()) return reference.init === true;
+  const member = reference.identifier.parent;
+  if (member.type !== "MemberExpression" || member.object !== reference.identifier || member.computed || member.optional || member.property.type !== "Identifier" || !HEADER_METHODS.has(member.property.name)) return false;
+  return member.parent.type === "CallExpression" && member.parent.callee === member && !member.parent.optional;
+}
+function appendValue(previous, value) {
+  if (previous === void 0) return void 0;
+  return previous === null ? value : previous + ", " + value;
+}
+function literalString(node) {
+  const value = node === void 0 ? void 0 : unwrapExpression(node);
+  return value?.type === "Literal" && typeof value.value === "string" ? value.value : null;
+}
+function headerValue(node) {
+  const value = node === void 0 ? void 0 : unwrapExpression(node);
+  if (value?.type !== "Literal" || !["string", "boolean", "number"].includes(typeof value.value)) return null;
+  return String(value.value).replace(/^[\t\n\r ]+|[\t\n\r ]+$/g, "");
+}
+function effectiveProperties(node) {
+  const properties = /* @__PURE__ */ new Map();
+  for (const entry of node.properties) {
+    const entries = propertyEntries(entry);
+    if (entries === null) return null;
+    for (const [key, property] of entries) properties.set(key, property);
+  }
+  return properties;
+}
+function propertyEntries(entry) {
+  if (entry.type === "SpreadElement") {
+    const value = unwrapExpression(entry.argument);
+    return value.type === "ObjectExpression" ? effectiveProperties(value) : null;
+  }
+  if (entry.kind !== "init" || entry.method) return null;
+  const key = entry.computed ? literalPropertyKey(entry.key) : import_utils28.ASTUtils.getPropertyName(entry);
+  if (key === null) return null;
+  if (key === "__proto__" && !entry.computed) {
+    const value = unwrapExpression(entry.value);
+    return value.type === "Literal" && value.value === null ? [] : null;
+  }
+  return [[key, entry]];
+}
+function literalPropertyKey(node) {
+  const value = unwrapExpression(node);
+  const literal = literalString(value);
+  if (literal !== null) return literal;
+  if (value.type !== "TemplateLiteral" || value.expressions.length !== 0) return null;
+  return value.quasis[0]?.value.cooked ?? null;
+}
+function spreadOnly(node) {
+  let current = outerExpression(node);
+  while (current.parent !== void 0) {
+    const parent = current.parent;
+    if (parent.type === "SpreadElement") return parent.parent.type === "ObjectExpression";
+    if (![
+      "Property",
+      "ObjectExpression",
+      "ConditionalExpression",
+      "LogicalExpression",
+      "SequenceExpression",
+      "TSAsExpression",
+      "TSSatisfiesExpression",
+      "TSNonNullExpression",
+      "TSTypeAssertion"
+    ].includes(parent.type)) return false;
+    current = parent;
+  }
+  return false;
+}
 
 // src/rules/no-duplicate-lifecycle-refresh-listeners.ts
 var import_utils30 = require("@typescript-eslint/utils");
@@ -5300,7 +5337,7 @@ var NO_DANGEROUSLY_ALLOW_SVG_DOCUMENTATION = {
     }
   ]
 };
-function literalString(node) {
+function literalString2(node) {
   if (node?.value.type === "Literal" && typeof node.value.value === "string") return node.value.value;
   if (node?.value.type === "TemplateLiteral" && node.value.expressions.length === 0) return node.value.quasis[0]?.value.cooked ?? null;
   return null;
@@ -5332,10 +5369,10 @@ var no_dangerously_allow_svg_default = createRule({
         const node = exportedNextConfigProperty(context.sourceCode, ["images", "dangerouslyAllowSVG"]);
         if (node !== null && node.value.type === "Literal" && node.value.value === true) {
           const disposition = exportedNextConfigProperty(context.sourceCode, ["images", "contentDispositionType"]);
-          const policy = literalString(
+          const policy = literalString2(
             exportedNextConfigProperty(context.sourceCode, ["images", "contentSecurityPolicy"])
           );
-          const attachmentDisposition = disposition === null || literalString(disposition) === "attachment";
+          const attachmentDisposition = disposition === null || literalString2(disposition) === "attachment";
           if (attachmentDisposition && policy !== null && hasHardenedSvgPolicy(policy)) return;
           context.report({ node, messageId: "noDangerouslyAllowSvg" });
         }
@@ -5456,31 +5493,48 @@ function sqlTextOf(node) {
       const right = sqlTextOf(node.right);
       return left !== null && right !== null ? left + right : null;
     }
-    case import_utils32.AST_NODE_TYPES.ArrayExpression: {
-      const parts = [];
-      for (const element of node.elements) {
-        if (element === null) {
-          return null;
-        }
-        const part = sqlTextOf(element);
-        if (part === null) {
-          return null;
-        }
-        parts.push(part);
-      }
-      return parts.length > 0 ? parts.join(" ") : null;
-    }
+    case import_utils32.AST_NODE_TYPES.ArrayExpression:
+      return fragmentArrayText(node);
     default:
       return null;
   }
 }
-function isJoinedFragmentArray(node) {
+function fragmentArrayText(node) {
+  const join4 = joinedFragmentCall(node);
+  const separator = join4 === null ? " " : join4.arguments.length === 0 ? "," : join4.arguments.length === 1 ? staticString(join4.arguments[0]) : null;
+  if (separator === null) return null;
+  const parts = [];
+  for (const element of node.elements) {
+    if (element === null || join4 !== null && element.type === import_utils32.AST_NODE_TYPES.ArrayExpression) {
+      return null;
+    }
+    const part = sqlTextOf(element);
+    if (part === null) {
+      return null;
+    }
+    parts.push(part);
+  }
+  return parts.length > 0 ? parts.join(separator) : null;
+}
+function joinedFragmentCall(node) {
   const parent = node.parent;
-  return parent?.type === import_utils32.AST_NODE_TYPES.MemberExpression && parent.object === node && !parent.computed && parent.property.type === import_utils32.AST_NODE_TYPES.Identifier && parent.property.name === "join" && parent.parent?.type === import_utils32.AST_NODE_TYPES.CallExpression;
+  return parent?.type === import_utils32.AST_NODE_TYPES.MemberExpression && parent.object === node && !parent.computed && parent.property.type === import_utils32.AST_NODE_TYPES.Identifier && parent.property.name === "join" && parent.parent?.type === import_utils32.AST_NODE_TYPES.CallExpression && parent.parent.callee === parent ? parent.parent : null;
 }
 function markConsumed(node, consumed) {
   consumed.add(node);
-  forEachOwnAstChild(node, (child) => markConsumed(child, consumed));
+  const value = unwrapExpression(node);
+  if (value !== node) {
+    markConsumed(value, consumed);
+    return;
+  }
+  if (node.type === import_utils32.AST_NODE_TYPES.BinaryExpression && node.operator === "+") {
+    markConsumed(node.left, consumed);
+    markConsumed(node.right, consumed);
+  } else if (node.type === import_utils32.AST_NODE_TYPES.ArrayExpression) {
+    for (const element of node.elements) if (element !== null) markConsumed(element, consumed);
+  } else if (node.type === import_utils32.AST_NODE_TYPES.TaggedTemplateExpression) {
+    markConsumed(node.quasi, consumed);
+  }
 }
 function createSqlListener(handler) {
   const consumed = /* @__PURE__ */ new WeakSet();
@@ -5500,9 +5554,12 @@ function createSqlListener(handler) {
       visit(node);
     },
     ArrayExpression: (node) => {
-      if (isJoinedFragmentArray(node)) {
-        visit(node);
-      }
+      const join4 = joinedFragmentCall(node);
+      if (join4 === null) return;
+      visit(node);
+      markConsumed(node, consumed);
+      const separator = join4.arguments[0];
+      if (separator !== void 0 && staticString(separator) !== null) markConsumed(separator, consumed);
     },
     TemplateLiteral: (node) => {
       visit(node);
@@ -5533,7 +5590,7 @@ var NO_DYNAMIC_SQL_DOCUMENTATION = {
   remediation: "Bind data values through SQL placeholders. Select non-bindable identifiers or clauses from fixed, reviewed fragments instead of interpolating runtime text.",
   category: "security",
   limitations: [
-    "Template and concatenation fragments are inspected at recognized execution calls. Double-quoted identifiers, comments, and dollar strings are excluded; this is not a general SQL injection detector.",
+    "Template and concatenation fragments are inspected at recognized execution calls, including runtime pieces surrounded by literal text inside a quoted value. Double-quoted identifiers, comments, and dollar strings are excluded; this is not a general SQL injection detector.",
     "Literal fragments, legacy uppercase fragment names, and parameterizing tagged templates are exempt; uppercase spelling does not prove a value is static.",
     "The bounded lexer recognizes doubled quotes, comments, and PostgreSQL dollar strings; dialect-specific escape modes and SQL generated through other APIs require separate security review."
   ],
@@ -5581,6 +5638,7 @@ var NO_DYNAMIC_SQL_DOCUMENTATION = {
 var DEFAULT_METHODS = ["prepare", "exec", "query"];
 var CONSTANT_CASE_RE = /^[A-Z][A-Z0-9_]*$/;
 function isStaticFragment(expression) {
+  expression = unwrapExpression(expression);
   if (expression.type === import_utils33.AST_NODE_TYPES.Identifier) {
     return CONSTANT_CASE_RE.test(expression.name);
   }
@@ -5608,28 +5666,13 @@ function runtimeInterpolations(template) {
       const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
       offset += RUNTIME_MARKER.length;
       if (isStaticFragment(expression)) return [];
-      if (inValue && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "")) {
+      if (inValue) {
         return [{ expression, messageId: "dynamicSql" }];
       }
       return unquoted ? [{ expression, messageId: "dynamicFragment" }] : [];
     }
   );
 }
-function endsWithSqlQuote(text) {
-  return /'\s*$/u.test(text);
-}
-function startsWithSqlQuote(text) {
-  return /^\s*'/u.test(text);
-}
-function staticLiteralText(node) {
-  if (node.type === import_utils33.AST_NODE_TYPES.Literal && typeof node.value === "string") {
-    return node.value;
-  }
-  if (node.type === import_utils33.AST_NODE_TYPES.TemplateLiteral && node.expressions.length === 0) {
-    return node.quasis[0]?.value.raw;
-  }
-  return void 0;
-}
 function runtimeConcatOperands(node) {
   if (node.type !== import_utils33.AST_NODE_TYPES.BinaryExpression || node.operator !== "+") {
     return [];
@@ -5641,7 +5684,7 @@ function runtimeConcatOperands(node) {
   if (!hasStringLiteral) {
     return [];
   }
-  const parts = operands.map((operand) => staticLiteralText(operand) ?? RUNTIME_MARKER);
+  const parts = operands.map((operand) => staticString(operand) ?? RUNTIME_MARKER);
   const statement = parts.join("");
   const ranges = sqlSingleQuotedRanges(statement);
   const visible = stripSqlNoise(statement);
@@ -5651,9 +5694,7 @@ function runtimeConcatOperands(node) {
     const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
     offset += parts[index]?.length ?? 0;
     if (isStaticFragment(operand)) return [];
-    const before = operands[index - 1];
-    const after = operands[index + 1];
-    if (inValue && before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "")) {
+    if (inValue) {
       return [{ expression: operand, messageId: "dynamicSql" }];
     }
     return unquoted ? [{ expression: operand, messageId: "dynamicFragment" }] : [];
@@ -8721,7 +8762,7 @@ var LOGGING_OPTION_PROPERTIES = {
   loggerNames: { type: "array", items: { type: "string" } },
   logFunctions: { type: "array", items: { type: "string" } }
 };
-function calleeName2(callee) {
+function calleeName(callee) {
   callee = unwrapExpression(callee);
   if (callee.type === "Identifier") {
     return callee.name;
@@ -8769,7 +8810,7 @@ function createLogMatcher(options = {}) {
     if (expr.type !== "CallExpression" || logFunctions.size === 0) {
       return false;
     }
-    const name = calleeName2(expr.callee);
+    const name = calleeName(expr.callee);
     return name !== null && logFunctions.has(name);
   }
   function isLoggingCall(expr) {
@@ -11555,7 +11596,7 @@ function isRawBlobName(name) {
   const last = tokens.at(-1);
   return last !== void 0 && RAW_BLOB_WORDS.has(last);
 }
-function propertyKeyName2(prop) {
+function propertyKeyName(prop) {
   if (prop.computed) {
     return null;
   }
@@ -11626,12 +11667,12 @@ var no_secret_in_log_default = createRule({
             continue;
           }
           for (const property of literalProperties(entry.argument)) {
-            const key2 = propertyKeyName2(property);
+            const key2 = propertyKeyName(property);
             if (key2 !== null) effective.set(key2, property);
           }
           continue;
         }
-        const key = propertyKeyName2(entry);
+        const key = propertyKeyName(entry);
         if (key === null) {
           effective.clear();
           continue;
@@ -11652,7 +11693,7 @@ var no_secret_in_log_default = createRule({
       return false;
     }
     function reportSecretProperty(prop) {
-      const keyName = propertyKeyName2(prop);
+      const keyName = propertyKeyName(prop);
       const value = valueName(prop.value);
       if (value !== null && hasRedactionMarker(value)) return false;
       const name = value !== null && isSecretKeyword(value) ? value : keyName;
@@ -12220,7 +12261,7 @@ var no_sentinel_return_on_catch_default = createRule({
         if (matcher.isLoggingCall(current)) {
           return caughtName === null || argsIncludeBinding(current.arguments, caughtName);
         }
-        const name = calleeName2(current.callee);
+        const name = calleeName(current.callee);
         return name !== null && REPORT_NAME_RE.test(name) && (caughtName === null || argsIncludeBinding(current.arguments, caughtName));
       });
     }
@@ -25312,6 +25353,7 @@ var LIBRARY_IMPORT_POLICY = ["error", {
 var ADVISORY_RULES = [
   "@sarj/excessive-commentary",
   "@sarj/no-bespoke-api-case-conversion",
+  "@sarj/no-cors-wildcard-with-credentials",
   "@sarj/no-exception-text-in-5xx-response",
   "@sarj/no-restated-comment",
   "@sarj/no-restated-jsdoc",
@@ -25349,7 +25391,7 @@ var RECOMMENDED_RULES = {
   "@sarj/enforce-file-structure": "error",
   "@sarj/no-client-side-data-fetching": "error",
   "@sarj/no-comment-cruft": "error",
-  "@sarj/no-cors-wildcard-with-credentials": "error",
+  "@sarj/no-cors-wildcard-with-credentials": "warn",
   "@sarj/no-dynamic-sql": "error",
   "@sarj/no-fat-try-blocks": ["error", { max: 5 }],
   "@sarj/no-hand-rolled-sleep": "error",
@@ -25468,7 +25510,7 @@ var STRICT_RULES = {
   "@sarj/enforce-file-structure": "error",
   "@sarj/no-client-side-data-fetching": "error",
   "@sarj/no-comment-cruft": "error",
-  "@sarj/no-cors-wildcard-with-credentials": "error",
+  "@sarj/no-cors-wildcard-with-credentials": "warn",
   "@sarj/no-dynamic-sql": "error",
   "@sarj/no-enum": "error",
   "@sarj/no-fat-try-blocks": ["error", { max: 5 }],