@sarj/eslint-plugin 19.16.0 → 19.17.0

package/dist/{chunk-F6SYEJAW.js → chunk-4USNCXB3.js}

@@ -3623,6 +3623,110 @@ var no_bespoke_api_case_conversion_default = defineRule({
   }
 });
 
+// src/rules/_web-jsx.ts
+var TEXT_INPUTS = /* @__PURE__ */ new Set([
+  "",
+  "text",
+  "password",
+  "email",
+  "search",
+  "tel",
+  "url",
+  "number"
+]);
+function isEditableTextControl(node, source) {
+  if (node.name.type !== "JSXIdentifier" || !["input", "textarea"].includes(node.name.name))
+    return false;
+  if (mayHaveBooleanAttribute(node, ["disabled"]) || mayHaveBooleanAttribute(node, ["readOnly", "readonly"]))
+    return false;
+  if (node.name.name === "textarea") return true;
+  const type = attributeString(node, source, ["type"])?.toLowerCase();
+  return type !== void 0 && TEXT_INPUTS.has(type);
+}
+function effectiveAttribute(node, names) {
+  return node.attributes.findLast(
+    (attribute) => attribute.type === "JSXSpreadAttribute" || attribute.name.type === "JSXIdentifier" && names.includes(attribute.name.name)
+  );
+}
+function attributeString(node, source, names) {
+  const attribute = effectiveAttribute(node, names);
+  if (attribute === void 0) return "";
+  if (attribute.type === "JSXSpreadAttribute") return null;
+  if (attribute.value === null) return "";
+  const value = attribute.value.type === "JSXExpressionContainer" ? attribute.value.expression : attribute.value;
+  return scopedStaticString(value, source);
+}
+function mayHaveBooleanAttribute(node, names) {
+  const attribute = effectiveAttribute(node, names);
+  if (attribute === void 0) return false;
+  if (attribute.type === "JSXAttribute" && attribute.value?.type === "JSXExpressionContainer") {
+    const value = attribute.value.expression;
+    if (value.type === "Literal" && (value.value === false || value.value === null)) return false;
+  }
+  return true;
+}
+
+// src/rules/no-blocked-input-paste.ts
+var NAME14 = "no-blocked-input-paste";
+var no_blocked_input_paste_default = defineRule({
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Allow clipboard input when a text control has no replacement paste handling.",
+      url: docsUrl(NAME14)
+    },
+    schema: [],
+    messages: {
+      blockedPaste: "This handler only cancels pasting into an editable text control. Allow clipboard and password-manager input, or provide explicit replacement paste handling."
+    }
+  },
+  createOnce(context) {
+    return {
+      before() {
+        if (isGeneratedFile({ filename: context.filename, cwd: context.cwd }, context.sourceCode.text))
+          return false;
+      },
+      JSXOpeningElement(node) {
+        if (!isEditableTextControl(node, context.sourceCode)) return;
+        const blocker = blockingAttribute(node);
+        if (blocker !== null) context.report({ node: blocker, messageId: "blockedPaste" });
+      }
+    };
+  }
+});
+function blockingAttribute(node) {
+  let blocker = null;
+  for (const name of ["onPaste", "onPasteCapture"]) {
+    const attribute = effectiveAttribute(node, [name]);
+    if (attribute === void 0) continue;
+    if (attribute.type !== "JSXAttribute" || attribute.value?.type !== "JSXExpressionContainer" || !onlyCancelsPaste(attribute.value.expression))
+      return null;
+    blocker ??= attribute;
+  }
+  return blocker;
+}
+function onlyCancelsPaste(expression) {
+  const callback = unwrapExpression(expression);
+  if (callback.type !== "ArrowFunctionExpression" && callback.type !== "FunctionExpression")
+    return false;
+  if (callback.body === null) return false;
+  const [event] = callback.params;
+  if (event?.type !== "Identifier") return false;
+  let body3 = callback.body;
+  if (body3.type === "BlockStatement") {
+    if (body3.body.length !== 1) return false;
+    const statement = body3.body[0];
+    if (statement?.type === "ExpressionStatement") body3 = statement.expression;
+    else if (statement?.type === "ReturnStatement" && statement.argument !== null)
+      body3 = statement.argument;
+    else return false;
+  }
+  body3 = unwrapExpression(body3);
+  if (body3.type !== "CallExpression" || body3.optional || body3.arguments.length !== 0) return false;
+  const callee = unwrapExpression(body3.callee);
+  return callee.type === "MemberExpression" && !callee.optional && getPropertyName(callee) === "preventDefault" && callee.object.type === "Identifier" && callee.object.name === event.name;
+}
+
 // src/utils/has-side-effect.ts
 var BINARY_CONVERSIONS = /* @__PURE__ */ new Set([
   "==",
@@ -4052,7 +4156,7 @@ function selectorChoice(sourceCode2, call, binding3) {
 }
 
 // src/rules/no-boolean-selector-parameter.ts
-var NAME14 = "no-boolean-selector-parameter";
+var NAME15 = "no-boolean-selector-parameter";
 function preservesBlockObjectCallback(owner) {
   const property = parentOf(owner);
   if (property?.type !== "Property" || property.computed) return false;
@@ -4080,7 +4184,7 @@ var no_boolean_selector_parameter_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Prefer intention-revealing operations over a boolean parameter selecting between actions.",
-      url: docsUrl(NAME14)
+      url: docsUrl(NAME15)
     },
     schema: [],
     fixable: "code",
@@ -4149,7 +4253,7 @@ var no_boolean_selector_parameter_default = defineRule({
 });
 
 // src/rules/no-broad-return-type.ts
-var NAME15 = "no-broad-return-type";
+var NAME16 = "no-broad-return-type";
 function isBroad(type, facts, flags) {
   if ((type.flags & (flags.Unknown | flags.NonPrimitive)) !== 0) return true;
   const indexes = facts.indexValueFlags.get(type) ?? [];
@@ -4206,7 +4310,7 @@ var no_broad_return_type_default = defineRule({
     fixable: "code",
     docs: {
       description: "Report explicit broad return annotations that erase a known return value.",
-      url: docsUrl(NAME15)
+      url: docsUrl(NAME16)
     },
     schema: [],
     messages: {
@@ -4294,7 +4398,7 @@ var no_broad_return_type_default = defineRule({
 });
 
 // src/rules/no-client-side-data-fetching.ts
-var NAME16 = "no-client-side-data-fetching";
+var NAME17 = "no-client-side-data-fetching";
 var FETCH_LIBS = /* @__PURE__ */ new Set(["axios", "ky", "superagent"]);
 var HTTP_METHOD_NAMES = /* @__PURE__ */ new Set([
   "get",
@@ -4374,7 +4478,7 @@ var no_client_side_data_fetching_default = defineRule({
     type: "problem",
     docs: {
       description: "Disallow direct data fetching inside `useEffect` or `useLayoutEffect`.",
-      url: docsUrl(NAME16)
+      url: docsUrl(NAME17)
     },
     schema: [],
     messages: {
@@ -5023,7 +5127,7 @@ var no_comment_cruft_default = defineRule({
 });
 
 // src/rules/no-conditional-empty-object-spread.ts
-var NAME17 = "no-conditional-empty-object-spread";
+var NAME18 = "no-conditional-empty-object-spread";
 function isEmptyObject(node) {
   return node.type === "ObjectExpression" && node.properties.length === 0;
 }
@@ -5033,7 +5137,7 @@ var no_conditional_empty_object_spread_default = defineRule({
     fixable: "code",
     docs: {
       description: "Build conditional properties explicitly instead of spreading an empty-object branch.",
-      url: docsUrl(NAME17)
+      url: docsUrl(NAME18)
     },
     schema: [],
     messages: {
@@ -5240,7 +5344,7 @@ function overloadProof(file) {
 }
 
 // src/rules/no-contradictory-overload-return.ts
-var NAME18 = "no-contradictory-overload-return";
+var NAME19 = "no-contradictory-overload-return";
 var TOP_LEVEL_PARENTS = /* @__PURE__ */ new Set(["Program", "ExportNamedDeclaration", "ExportDefaultDeclaration"]);
 function candidateShape(node) {
   const parent = parentOf(node);
@@ -5256,7 +5360,7 @@ var no_contradictory_overload_return_default = defineRule({
     fixable: "code",
     docs: {
       description: "Preserve the input/result relationship promised by literal overloads.",
-      url: docsUrl(NAME18)
+      url: docsUrl(NAME19)
     },
     schema: [],
     messages: {
@@ -5465,7 +5569,7 @@ function ordinaryHostReference(reference) {
 }
 
 // src/rules/no-contradictory-type-predicate.ts
-var NAME19 = "no-contradictory-type-predicate";
+var NAME20 = "no-contradictory-type-predicate";
 var RUNTIME_KINDS = ["string", "number", "bigint", "boolean", "symbol", "undefined", "object", "function"];
 var ANY_RUNTIME_KIND = new Set(RUNTIME_KINDS);
 function parameterPredicate(node) {
@@ -5479,7 +5583,7 @@ var no_contradictory_type_predicate_default = defineRule({
     fixable: "code",
     docs: {
       description: "Keep explicit type predicates consistent with their primitive, array or record membership check.",
-      url: docsUrl(NAME19)
+      url: docsUrl(NAME20)
     },
     schema: [],
     messages: {
@@ -5697,7 +5801,7 @@ function primitiveKind(type, native, allowLiterals) {
 }
 
 // src/rules/no-cors-wildcard-with-credentials.ts
-var NAME20 = "no-cors-wildcard-with-credentials";
+var NAME21 = "no-cors-wildcard-with-credentials";
 var ACAO_HEADER = "access-control-allow-origin";
 var ACAC_HEADER = "access-control-allow-credentials";
 var HEADER_METHODS = /* @__PURE__ */ new Set(["set", "setHeader", "append", "delete", "removeHeader"]);
@@ -5730,7 +5834,7 @@ var no_cors_wildcard_with_credentials_default = defineRule({
     type: "problem",
     docs: {
       description: "Review wildcard CORS origins combined with an explicit credentials opt-in.",
-      url: docsUrl(NAME20)
+      url: docsUrl(NAME21)
     },
     schema: [],
     messages: {
@@ -6118,7 +6222,7 @@ function isAuthSecretName(identifier) {
 }
 
 // src/rules/no-credential-in-browser-storage.ts
-var NAME21 = "no-credential-in-browser-storage";
+var NAME22 = "no-credential-in-browser-storage";
 var STORAGE_NAMES = /* @__PURE__ */ new Set(["localStorage", "sessionStorage"]);
 var METADATA_WORDS = /* @__PURE__ */ new Set(["page", "cursor", "next", "hint", "expires", "expiry", "expiration"]);
 var GLOBAL_OBJECTS = /* @__PURE__ */ new Set(["window", "globalThis", "self"]);
@@ -6127,7 +6231,7 @@ var no_credential_in_browser_storage_default = defineRule({
     type: "problem",
     docs: {
       description: "Do not write credential-named values to browser storage or script-readable cookies.",
-      url: docsUrl(NAME21)
+      url: docsUrl(NAME22)
     },
     schema: [],
     messages: {
@@ -6263,7 +6367,7 @@ function canAutofixNextConfigLiteral(sourceCode2) {
 }
 
 // src/rules/no-dangerously-allow-svg.ts
-var NAME22 = "no-dangerously-allow-svg";
+var NAME23 = "no-dangerously-allow-svg";
 var NEXT_CONFIG_RE = /(?:^|\/)next\.config\.[cm]?[jt]s$/;
 function literalString(node) {
   if (node?.value.type === "Literal" && typeof node.value.value === "string") return node.value.value;
@@ -6287,7 +6391,7 @@ var no_dangerously_allow_svg_default = defineRule({
   meta: {
     type: "problem",
     fixable: "code",
-    docs: { description: "Require an explicit hardening policy for Next Image SVG delivery", url: docsUrl(NAME22) },
+    docs: { description: "Require an explicit hardening policy for Next Image SVG delivery", url: docsUrl(NAME23) },
     schema: [],
     messages: {
       noDangerouslyAllowSvg: "SVG opt-in requires a recognized explicit script-blocking sandbox CSP and attachment disposition under this policy."
@@ -6761,7 +6865,7 @@ var no_detached_global_fetch_default = defineRule({
 });
 
 // src/rules/no-discarded-validation-result.ts
-var NAME23 = "no-discarded-validation-result";
+var NAME24 = "no-discarded-validation-result";
 var CHANGING = /* @__PURE__ */ new Set(["transform", "default", "prefault", "catch", "coerce", "trim", "toLowerCase", "toUpperCase", "normalize", "preprocess"]);
 var VALIDATION_METHODS = /* @__PURE__ */ new Set(["parse", "parseAsync", "safeParse", "safeParseAsync"]);
 var no_discarded_validation_result_default = defineRule({
@@ -6769,7 +6873,7 @@ var no_discarded_validation_result_default = defineRule({
     type: "problem",
     docs: {
       description: "Consume Zod validation outcomes and transformed outputs instead of discarding them.",
-      url: docsUrl(NAME23)
+      url: docsUrl(NAME24)
     },
     schema: [],
     messages: { discarded: "Consume this validation result; its outcome or transformed value is currently discarded." }
@@ -6846,7 +6950,7 @@ function zodValueImport(definition) {
 }
 
 // src/rules/no-duplicate-lifecycle-refresh-listeners.ts
-var NAME24 = "no-duplicate-lifecycle-refresh-listeners";
+var NAME25 = "no-duplicate-lifecycle-refresh-listeners";
 var ROUTER_MODULE = "next/navigation";
 var RECEIVER_EVENTS = /* @__PURE__ */ new Map([["window", "focus"], ["document", "visibilitychange"]]);
 function importsRouterHook(body3) {
@@ -6881,7 +6985,7 @@ var no_duplicate_lifecycle_refresh_listeners_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Do not register one Next.js route-refresh callback for both focus and visibilitychange.",
-      url: docsUrl(NAME24)
+      url: docsUrl(NAME25)
     },
     schema: [],
     messages: {
@@ -7006,7 +7110,7 @@ var no_duplicate_lifecycle_refresh_listeners_default = defineRule({
 });
 
 // src/rules/no-duplicate-test-case.ts
-var NAME25 = "no-duplicate-test-case";
+var NAME26 = "no-duplicate-test-case";
 var TEST_MODULES = /* @__PURE__ */ new Set(["vitest", "@jest/globals", "bun:test"]);
 var TEST_NAMES2 = /* @__PURE__ */ new Set(["it", "test"]);
 var MODIFIERS = /* @__PURE__ */ new Set(["only", "skip", "concurrent", "sequential", "fails", "failing", "todo"]);
@@ -7084,7 +7188,7 @@ function objectKey(node) {
 var no_duplicate_test_case_default = defineRule({
   meta: {
     type: "suggestion",
-    docs: { description: "Report repeated literal rows in framework each tables and Vitest for tables.", url: docsUrl(NAME25) },
+    docs: { description: "Report repeated literal rows in framework each tables and Vitest for tables.", url: docsUrl(NAME26) },
     schema: [],
     messages: { duplicateCase: "This literal row repeats case {{first}} with the same inputs and expected values. Remove the accidental copy or add the intended distinct boundary; preserve intentional repetition explicitly." }
   },
@@ -7358,7 +7462,7 @@ function isDiscardedSqlText(node) {
 }
 
 // src/rules/no-dynamic-sql.ts
-var NAME26 = "no-dynamic-sql";
+var NAME27 = "no-dynamic-sql";
 var DEFAULT_METHODS = ["prepare", "exec", "query"];
 var CONSTANT_CASE_RE = /^[A-Z][A-Z0-9_]*$/;
 function runtimeInterpolations(template) {
@@ -7455,7 +7559,7 @@ var no_dynamic_sql_default = defineRule({
     type: "problem",
     docs: {
       description: "Disallow runtime values and fragments interpolated into SQL passed to statement-execution methods.",
-      url: docsUrl(NAME26)
+      url: docsUrl(NAME27)
     },
     schema: [
       {
@@ -7510,7 +7614,7 @@ var no_dynamic_sql_default = defineRule({
 });
 
 // src/rules/no-enum.ts
-var NAME27 = "no-enum";
+var NAME28 = "no-enum";
 var no_enum_default = defineRule({
   meta: {
     defaultOptions: [{}],
@@ -7518,7 +7622,7 @@ var no_enum_default = defineRule({
     fixable: "code",
     docs: {
       description: "Disallow TypeScript `enum`; use string-literal unions or `as const` objects instead.",
-      url: docsUrl(NAME27)
+      url: docsUrl(NAME28)
     },
     schema: [
       {
@@ -8531,7 +8635,7 @@ function transfers(node, sourceCode2) {
 }
 
 // src/rules/no-exception-text-in-5xx-response.ts
-var NAME28 = "no-exception-text-in-5xx-response";
+var NAME29 = "no-exception-text-in-5xx-response";
 function nextResponseLocals(program) {
   return program.body.flatMap((statement) => statement.type === "ImportDeclaration" && statement.source.value === "next/server" ? statement.specifiers.flatMap((specifier) => specifier.type === "ImportSpecifier" && specifier.imported.type === "Identifier" && specifier.imported.name === "NextResponse" ? [specifier.local.name] : []) : []);
 }
@@ -8553,7 +8657,7 @@ var no_exception_text_in_5xx_response_default = defineRule({
     type: "problem",
     docs: {
       description: "Keep caught exception messages and stacks out of returned 5xx JSON responses and Server Action results.",
-      url: docsUrl(NAME28)
+      url: docsUrl(NAME29)
     },
     schema: [],
     messages: {
@@ -9470,7 +9574,7 @@ function directCalls(binding3, arity) {
 }
 
 // src/rules/no-excess-jsx-props.ts
-var NAME29 = "no-excess-jsx-props";
+var NAME30 = "no-excess-jsx-props";
 var RESERVED_PROPS = /* @__PURE__ */ new Set(["key", "ref", "__self", "__source"]);
 var JSX_DIRECTIVE = /@jsx(?:ImportSource|Runtime|Frag)?(?:\s|$)/iu;
 var MAX_VALUE_DEPTH = 64;
@@ -9792,7 +9896,7 @@ function closedObjectType(native) {
 var no_excess_jsx_props_default = defineRule({
   meta: {
     type: "suggestion",
-    docs: { description: "Report statically known fields spread outside a resolved component props contract.", url: docsUrl(NAME29) },
+    docs: { description: "Report statically known fields spread outside a resolved component props contract.", url: docsUrl(NAME30) },
     schema: [],
     messages: {
       excess: "This spread forwards fields outside the receiving component's declared contract: {{fields}}. Forward the needed fields explicitly or review the contract; an annotation alone does not remove runtime fields."
@@ -9872,7 +9976,7 @@ var no_excess_jsx_props_default = defineRule({
 });
 
 // src/rules/no-excessive-cognitive-complexity.ts
-var NAME30 = "no-excessive-cognitive-complexity";
+var NAME31 = "no-excessive-cognitive-complexity";
 var SEPARATELY_SCORED = /* @__PURE__ */ new Set([
   "FunctionDeclaration",
   "FunctionExpression",
@@ -9991,7 +10095,7 @@ var no_excessive_cognitive_complexity_default = defineRule({
     type: "suggestion",
     docs: {
       description: `Report an error for function bodies with cognitive complexity above ${ERROR_COMPLEXITY}.`,
-      url: docsUrl(NAME30)
+      url: docsUrl(NAME31)
     },
     schema: [],
     defaultOptions: [],
@@ -10021,13 +10125,13 @@ var no_excessive_cognitive_complexity_default = defineRule({
 });
 
 // src/rules/no-explicit-type-predicate.ts
-var NAME31 = "no-explicit-type-predicate";
+var NAME32 = "no-explicit-type-predicate";
 var no_explicit_type_predicate_default = defineRule({
   meta: {
     type: "suggestion",
     docs: {
       description: "Use compiler-checked narrowing instead of handwritten type predicates.",
-      url: docsUrl(NAME31)
+      url: docsUrl(NAME32)
     },
     schema: [],
     messages: { noExplicitTypePredicate: "Replace this handwritten type predicate with a direct discriminator check or compiler-inferred narrowing. Parse unknown data with a schema and consume the validated result; preserve required external callable contracts." }
@@ -10046,7 +10150,7 @@ var no_explicit_type_predicate_default = defineRule({
 });
 
 // src/rules/no-fat-try-blocks.ts
-var NAME32 = "no-fat-try-blocks";
+var NAME33 = "no-fat-try-blocks";
 var MAX_TRY_BODY_STATEMENTS = 3;
 var NESTED_FUNCTION_TYPES = /* @__PURE__ */ new Set([
   "FunctionDeclaration",
@@ -10382,7 +10486,7 @@ var no_fat_try_blocks_default = defineRule({
     type: "problem",
     docs: {
       description: "Review try blocks exceeding the configured count of syntactically selected operations.",
-      url: docsUrl(NAME32)
+      url: docsUrl(NAME33)
     },
     schema: [
       {
@@ -10437,7 +10541,7 @@ var no_fat_try_blocks_default = defineRule({
 });
 
 // src/rules/no-first-party-module-mock.ts
-var NAME33 = "no-first-party-module-mock";
+var NAME34 = "no-first-party-module-mock";
 var MOCK_METHODS = /* @__PURE__ */ new Set(["mock", "doMock", "unstable_mockModule"]);
 function isFirstParty(source, prefixes) {
   return source.startsWith("./") || source.startsWith("../") || prefixes.some((prefix) => source.startsWith(prefix));
@@ -10455,7 +10559,7 @@ var no_first_party_module_mock_default = defineRule({
   meta: {
     defaultOptions: [{ additionalModulePrefixes: [] }],
     type: "problem",
-    docs: { description: "Prefer injected collaborators over mocking maintained first-party modules in tests.", url: docsUrl(NAME33) },
+    docs: { description: "Prefer injected collaborators over mocking maintained first-party modules in tests.", url: docsUrl(NAME34) },
     schema: [{ type: "object", additionalProperties: false, properties: { additionalModulePrefixes: { description: "Additional maintained module prefixes that tests must not mock.", type: "array", items: { type: "string", minLength: 1 }, uniqueItems: true } } }],
     messages: { noFirstPartyModuleMock: "This test replaces the maintained module `{{module}}`. Inject a narrow collaborator or test the real module; suppress locally only when module lookup or bootstrap behavior is the contract." }
   },
@@ -10786,7 +10890,7 @@ function abrupt(node) {
 }
 
 // src/rules/no-generic-json-parser.ts
-var NAME34 = "no-generic-json-parser";
+var NAME35 = "no-generic-json-parser";
 var OPEN_FACTORIES = /* @__PURE__ */ new Set(["any", "unknown", "json", "record", "partialRecord"]);
 var WRAPPERS = /* @__PURE__ */ new Set(["optional", "nullable", "nullish", "default", "catch", "readonly", "brand", "describe", "meta"]);
 var PARSE_METHODS = /* @__PURE__ */ new Set(["parse", "parseAsync", "safeParse", "safeParseAsync"]);
@@ -10797,7 +10901,7 @@ var no_generic_json_parser_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Parse known JSON fields with an object schema instead of an open JSON or record parser.",
-      url: docsUrl(NAME34)
+      url: docsUrl(NAME35)
     },
     schema: [],
     messages: { genericParser: "The generic parser does not declare `{{field}}`; parse a focused object schema for the fields this code reads." }
@@ -11177,7 +11281,7 @@ function memberPropertyName(node) {
 }
 
 // src/rules/no-generic-single-export-module.ts
-var NAME35 = "no-generic-single-export-module";
+var NAME36 = "no-generic-single-export-module";
 function fileParts(filename) {
   const base = filename.replaceAll("\\", "/").split("/").at(-1) ?? "";
   const extension = base.match(/(\.[cm]?[jt]sx?)$/u)?.[1] ?? ".ts";
@@ -11193,7 +11297,7 @@ var no_generic_single_export_module_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Disallow generic module stems when one runtime export already names the responsibility.",
-      url: docsUrl(NAME35)
+      url: docsUrl(NAME36)
     },
     schema: [],
     messages: {
@@ -11348,7 +11452,7 @@ var no_growing_array_spread_in_loop_default = defineRule({
 });
 
 // src/rules/no-hand-rolled-sleep.ts
-var NAME36 = "no-hand-rolled-sleep";
+var NAME37 = "no-hand-rolled-sleep";
 var GLOBAL_OBJECTS3 = /* @__PURE__ */ new Set([
   "globalThis",
   "window",
@@ -11410,7 +11514,7 @@ var no_hand_rolled_sleep_default = defineRule({
     type: "problem",
     docs: {
       description: "Disallow uncancellable promisified timers and timeout arms.",
-      url: docsUrl(NAME36)
+      url: docsUrl(NAME37)
     },
     schema: [
       {
@@ -11548,7 +11652,7 @@ var tailwindBase = (token) => token.slice(tailwindVariantPrefix(token).length).r
 var classTokens = (value) => value.split(/\s+/).filter(Boolean);
 
 // src/rules/no-hand-rolled-spinner.ts
-var NAME37 = "no-hand-rolled-spinner";
+var NAME38 = "no-hand-rolled-spinner";
 var DESIGN_SYSTEM_PATH = /(?:^|[/\\])components[/\\]ui[/\\]/u;
 var DIRECTIONAL_BORDER = /^border-([trblsexy])-(.+)$/u;
 var CSS_LENGTH = /^-?(?:\d+(?:\.\d+)?|\.\d+)(?:cap|ch|cm|dvh|dvw|em|ex|ic|in|lh|lvh|lvw|mm|pc|pt|px|q|rcap|rch|rem|rex|ric|rlh|svh|svw|vb|vh|vi|vmax|vmin|vw|%)$/u;
@@ -11591,7 +11695,7 @@ var no_hand_rolled_spinner_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Disallow intrinsic elements styled as Tailwind border-ring spinners outside the design-system implementation.",
-      url: docsUrl(NAME37)
+      url: docsUrl(NAME38)
     },
     schema: [],
     messages: {
@@ -11627,7 +11731,7 @@ var no_hand_rolled_spinner_default = defineRule({
 });
 
 // src/rules/no-impossible-zod-literal-bounds.ts
-var NAME38 = "no-impossible-zod-literal-bounds";
+var NAME39 = "no-impossible-zod-literal-bounds";
 var KINDS = /* @__PURE__ */ new Map([
   ["array", "array"],
   ["number", "number"],
@@ -11713,7 +11817,7 @@ var no_impossible_zod_literal_bounds_default = defineRule({
     type: "problem",
     docs: {
       description: "Disallow same-chain literal Zod bounds whose accepted set is mathematically empty.",
-      url: docsUrl(NAME38)
+      url: docsUrl(NAME39)
     },
     schema: [
       {
@@ -11920,7 +12024,7 @@ function collectionPropertyFix(sourceCode2, node) {
 }
 
 // src/rules/no-in-operator-on-built-in-collections.ts
-var NAME39 = "no-in-operator-on-built-in-collections";
+var NAME40 = "no-in-operator-on-built-in-collections";
 var COLLECTION_NAMES = /* @__PURE__ */ new Set([
   "Map",
   "ReadonlyMap",
@@ -11944,7 +12048,7 @@ var no_in_operator_on_built_in_collections_default = defineRule({
     fixable: "code",
     docs: {
       description: "Do not use the `in` operator to test entries in built-in Map and Set collections.",
-      url: docsUrl(NAME39)
+      url: docsUrl(NAME40)
     },
     schema: [],
     messages: {
@@ -12106,7 +12210,7 @@ function isUuidRecipe(sourceCode2, node, reported) {
 }
 
 // src/rules/no-insecure-random-id.ts
-var NAME40 = "no-insecure-random-id";
+var NAME41 = "no-insecure-random-id";
 var STRONG_SECURITY_WORDS = /* @__PURE__ */ new Set([
   "apikey",
   "csrf",
@@ -12188,7 +12292,7 @@ var no_insecure_random_id_default = defineRule({
     type: "problem",
     docs: {
       description: "Disallow using `Math.random()` to generate identifiers, tokens, or secrets; use `crypto.randomUUID()` or `crypto.getRandomValues(...)` instead.",
-      url: docsUrl(NAME40)
+      url: docsUrl(NAME41)
     },
     fixable: "code",
     schema: [],
@@ -12282,7 +12386,7 @@ function incompatibleWrite(file, exactOptionalPropertyTypes, call, targetNode, w
 }
 
 // src/rules/no-invalid-typed-mutation.ts
-var NAME41 = "no-invalid-typed-mutation";
+var NAME42 = "no-invalid-typed-mutation";
 var GLOBAL_RECEIVERS2 = /* @__PURE__ */ new Set(["globalThis", "window", "self"]);
 var NAMESPACE_OR_RECEIVER = /* @__PURE__ */ new Set(["Object", "Reflect", ...GLOBAL_RECEIVERS2]);
 var SUPPORTED_METHODS = {
@@ -12416,7 +12520,7 @@ var no_invalid_typed_mutation_default = defineRule({
     type: "problem",
     docs: {
       description: "Keep native object mutation APIs from writing incompatible values into declared property types.",
-      url: docsUrl(NAME41)
+      url: docsUrl(NAME42)
     },
     schema: [],
     messages: {
@@ -12525,8 +12629,61 @@ var no_invalid_typed_mutation_default = defineRule({
   }
 });
 
+// src/rules/no-invalid-web-resource-hints.ts
+var NAME43 = "no-invalid-web-resource-hints";
+var RESOURCE_TAGS = /* @__PURE__ */ new Set(["img", "iframe", "link", "script"]);
+var LAZY_TAGS = /* @__PURE__ */ new Set(["img", "iframe", "video", "audio"]);
+var no_invalid_web_resource_hints_default = defineRule({
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Keep native resource hints consistent with browser loading and preload request modes.",
+      url: docsUrl(NAME43)
+    },
+    schema: [],
+    messages: {
+      criticalLazy: "This image is marked high priority and lazy-loaded. Review whether it is critical and load it eagerly, or keep lazy loading and remove the priority boost.",
+      obsoleteImportance: "The importance attribute is obsolete. Review whether fetchPriority is needed for this resource.",
+      invalidLoading: 'loading="auto" is unsupported. Omit loading for the default eager behavior, or select lazy loading deliberately.',
+      preloadAs: "A preload needs its resource destination in as so the browser can reuse it for the matching request.",
+      fontCors: 'Font preloads need anonymous CORS, including same-origin fonts. Set crossOrigin="anonymous" so the preload matches the font request.'
+    }
+  },
+  createOnce(context) {
+    return {
+      before() {
+        if (isGeneratedFile({ filename: context.filename, cwd: context.cwd }, context.sourceCode.text))
+          return false;
+      },
+      JSXOpeningElement(node) {
+        if (node.name.type !== "JSXIdentifier") return;
+        const tag = node.name.name;
+        const text = (names) => attributeString(node, context.sourceCode, names);
+        const importance = text(["importance"]);
+        if (RESOURCE_TAGS.has(tag) && importance !== null && importance !== "")
+          context.report({ node, messageId: "obsoleteImportance" });
+        const loading = text(["loading"])?.toLowerCase();
+        if (LAZY_TAGS.has(tag) && loading === "auto")
+          context.report({ node, messageId: "invalidLoading" });
+        if (tag === "img" && loading === "lazy" && text(["fetchPriority", "fetchpriority"])?.toLowerCase() === "high") {
+          context.report({ node, messageId: "criticalLazy" });
+        }
+        if (tag !== "link" || !text(["rel"])?.toLowerCase().split(/\s+/u).includes("preload"))
+          return;
+        const destination = text(["as"])?.toLowerCase();
+        if (destination === "") context.report({ node, messageId: "preloadAs" });
+        if (destination !== "font") return;
+        const cors = effectiveAttribute(node, ["crossOrigin", "crossorigin"]);
+        if (cors === void 0 || text(["crossOrigin", "crossorigin"])?.toLowerCase() === "use-credentials") {
+          context.report({ node, messageId: "fontCors" });
+        }
+      }
+    };
+  }
+});
+
 // src/rules/no-invalid-zod-custom-parse.ts
-var NAME42 = "no-invalid-zod-custom-parse";
+var NAME44 = "no-invalid-zod-custom-parse";
 var ZOD_MODULES = /* @__PURE__ */ new Set(["zod", "zod/v4"]);
 var DECLARATION_FILE_RE = /\.d\.(?:[cm]?ts|[^/.]+\.ts)$/;
 function nativeZodDeclaration(declaration) {
@@ -12604,7 +12761,7 @@ var no_invalid_zod_custom_parse_default = defineRule({
     type: "problem",
     docs: {
       description: "Do not parse an incompatible primitive literal through an unvalidated Zod custom schema.",
-      url: docsUrl(NAME42)
+      url: docsUrl(NAME44)
     },
     schema: [],
     messages: {
@@ -12672,7 +12829,7 @@ var no_invalid_zod_custom_parse_default = defineRule({
 });
 
 // src/rules/no-json-stringify-error.ts
-var NAME43 = "no-json-stringify-error";
+var NAME45 = "no-json-stringify-error";
 var BUILTIN_ERROR_CONSTRUCTORS = /* @__PURE__ */ new Set([
   "AggregateError",
   "DOMException",
@@ -13031,7 +13188,7 @@ var no_json_stringify_error_default = defineRule({
     type: "problem",
     docs: {
       description: "Avoid generic JSON serialization that can omit native Error details.",
-      url: docsUrl(NAME43)
+      url: docsUrl(NAME45)
     },
     schema: [],
     messages: {
@@ -13191,7 +13348,7 @@ function serializedLiteral(sourceCode2, node, fields2) {
 }
 
 // src/rules/no-json-stringify-object-equality.ts
-var NAME44 = "no-json-stringify-object-equality";
+var NAME46 = "no-json-stringify-object-equality";
 var EQUALITY_OPERATORS = /* @__PURE__ */ new Set(["!=", "!==", "==", "==="]);
 function unwrapComparisonExpression(node) {
   let current = unwrapExpression(node);
@@ -13279,7 +13436,7 @@ var no_json_stringify_object_equality_default = defineRule({
     type: "problem",
     docs: {
       description: "Do not use JSON serialization as structural object equality.",
-      url: docsUrl(NAME44)
+      url: docsUrl(NAME46)
     },
     schema: [],
     fixable: "code",
@@ -13299,13 +13456,13 @@ var no_json_stringify_object_equality_default = defineRule({
       const nodes = pending.flatMap(({ left, right }) => [left, right]);
       const types = file.typesOf(nodes);
       const checker = file.checker;
-      const contains2 = (node, i) => {
+      const contains3 = (node, i) => {
         const syntax = syntaxMayContainObject(node);
         if (syntax !== null) return syntax;
         const type = types[i];
         return type === void 0 || typeMayContainObject(type, checker, flags);
       };
-      return pending.map(({ left, right }, i) => contains2(left, 2 * i) || contains2(right, 2 * i + 1));
+      return pending.map(({ left, right }, i) => contains3(left, 2 * i) || contains3(right, 2 * i + 1));
     }
     return {
       before() {
@@ -13345,7 +13502,7 @@ var no_json_stringify_object_equality_default = defineRule({
 });
 
 // src/rules/no-known-value-widening.ts
-var NAME45 = "no-known-value-widening";
+var NAME47 = "no-known-value-widening";
 var PROPERTIED_ANNOTATIONS = /* @__PURE__ */ new Set([
   "TSAnyKeyword",
   "TSArrayType",
@@ -13517,7 +13674,7 @@ var no_known_value_widening_default = defineRule({
     fixable: "code",
     docs: {
       description: "Preserve a known value's contract instead of widening a local binding to unknown, object, or an unknown-valued dictionary.",
-      url: docsUrl(NAME45)
+      url: docsUrl(NAME47)
     },
     schema: [],
     messages: {
@@ -13707,7 +13864,7 @@ function createLogMatcher(options = {}) {
 }
 
 // src/rules/no-log-only-catch.ts
-var NAME46 = "no-log-only-catch";
+var NAME48 = "no-log-only-catch";
 var BENCHMARK_DIR_RE = /(?:^|[\\/])benchmarks?[\\/]/;
 var SINGLE_STATEMENT_HOSTS = /* @__PURE__ */ new Set([
   "DoWhileStatement",
@@ -13806,7 +13963,7 @@ var no_log_only_catch_default = defineRule({
     type: "problem",
     docs: {
       description: "Disallow `catch` clauses that only log (or silently do nothing) and then swallow the error; rethrow or handle it instead.",
-      url: docsUrl(NAME46)
+      url: docsUrl(NAME48)
     },
     schema: [
       {
@@ -13902,7 +14059,7 @@ var no_log_only_catch_default = defineRule({
 });
 
 // src/rules/no-logical-or-fallback.ts
-var NAME47 = "no-logical-or-fallback";
+var NAME49 = "no-logical-or-fallback";
 var GLOBAL_RECEIVERS3 = /* @__PURE__ */ new Set(["globalThis", "window", "self"]);
 var PRIMITIVE = 1;
 var FALLBACK = 2;
@@ -13954,7 +14111,7 @@ var no_logical_or_fallback_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Use nullish defaults or explicit falsy-value checks instead of logical OR fallbacks.",
-      url: docsUrl(NAME47)
+      url: docsUrl(NAME49)
     },
     schema: [],
     messages: {
@@ -14050,7 +14207,7 @@ var no_logical_or_fallback_default = defineRule({
 });
 
 // src/rules/no-long-comment.ts
-var NAME48 = "no-long-comment";
+var NAME50 = "no-long-comment";
 var EXCESSIVE_SENTENCE_COUNT = 8;
 var EXCESSIVE_WORD_COUNT = 120;
 var PROSE_WORD_RE = /[\p{L}\p{N}][\p{L}\p{N}'’-]*/gu;
@@ -14082,7 +14239,7 @@ var no_long_comment_default = defineRule({
     fixable: "code",
     docs: {
       description: "Flag unusually large unstructured JSDoc blocks in implementation code.",
-      url: docsUrl(NAME48)
+      url: docsUrl(NAME50)
     },
     schema: [],
     messages: {
@@ -14107,6 +14264,69 @@ var no_long_comment_default = defineRule({
   }
 });
 
+// src/rules/no-message-origin-string-matching.ts
+var NAME51 = "no-message-origin-string-matching";
+var GLOBALS = /* @__PURE__ */ new Set(["window", "self", "globalThis"]);
+var STRING_MATCHERS = /* @__PURE__ */ new Set(["startsWith", "endsWith", "includes"]);
+var no_message_origin_string_matching_default = defineRule({
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Compare incoming browser message origins against exact trusted origins.",
+      url: docsUrl(NAME51)
+    },
+    schema: [],
+    messages: {
+      originMatch: "A prefix, suffix or substring match does not establish a trusted message origin. Compare exact allowlisted origins, or parse the origin and validate the intended scheme, host and port."
+    }
+  },
+  createOnce(context) {
+    let events;
+    return {
+      before() {
+        events = /* @__PURE__ */ new Set();
+        if (isGeneratedFile({ filename: context.filename, cwd: context.cwd }, context.sourceCode.text))
+          return false;
+      },
+      CallExpression(node) {
+        const source = context.sourceCode;
+        const event = messageParameter(node, source);
+        if (event !== null) events.add(event);
+        const callee = unwrapExpression(node.callee);
+        if (callee.type !== "MemberExpression" || !STRING_MATCHERS.has(getPropertyName(callee) ?? ""))
+          return;
+        const origin = unwrapExpression(callee.object);
+        if (origin.type !== "MemberExpression" || getPropertyName(origin) !== "origin") return;
+        const receiver = unwrapExpression(origin.object);
+        if (receiver.type !== "Identifier") return;
+        const binding3 = findVariable(source.getScope(receiver), receiver.name);
+        if (binding3 !== null && events.has(binding3))
+          context.report({ node, messageId: "originMatch" });
+      }
+    };
+  }
+});
+function messageParameter(call, source) {
+  const callee = unwrapExpression(call.callee);
+  const ambientCall = callee.type === "Identifier" && callee.name === "addEventListener" && isAmbient(callee, source);
+  const globalCall = callee.type === "MemberExpression" && getPropertyName(callee) === "addEventListener" && callee.object.type === "Identifier" && GLOBALS.has(callee.object.name) && isAmbient(callee.object, source);
+  const [type, listener] = call.arguments;
+  if (!ambientCall && !globalCall || type === void 0 || scopedStaticString(type, source) !== "message" || listener === void 0)
+    return null;
+  const callback = unwrapExpression(listener);
+  if (callback.type !== "ArrowFunctionExpression" && callback.type !== "FunctionExpression")
+    return null;
+  if (callback.body === null) return null;
+  const [parameter] = callback.params;
+  if (parameter?.type !== "Identifier") return null;
+  const binding3 = findVariable(source.getScope(callback.body), parameter.name);
+  return binding3?.references.some((reference) => reference.isWrite()) ? null : binding3;
+}
+function isAmbient(node, source) {
+  const binding3 = findVariable(source.getScope(node), node.name);
+  return binding3 === null || binding3.defs.length === 0;
+}
+
 // src/rules/no-mutating-container-transform.ts
 var MUTATORS = /* @__PURE__ */ new Set(["copyWithin", "fill", "pop", "push", "reverse", "shift", "sort", "splice", "unshift"]);
 var PRIMITIVES = /* @__PURE__ */ new Set([
@@ -14306,7 +14526,7 @@ var no_mutating_container_transform_default = defineRule({
 });
 
 // src/rules/no-mutating-input-with-result.ts
-var NAME49 = "no-mutating-input-with-result";
+var NAME52 = "no-mutating-input-with-result";
 function command(annotation) {
   if (annotation.type === "TSVoidKeyword" || annotation.type === "TSUndefinedKeyword" || annotation.type === "TSNeverKeyword") return true;
   if (annotation.type === "TSTypeReference" && annotation.typeName.type === "Identifier" && annotation.typeName.name === "Promise" && annotation.typeArguments?.params.length === 1) {
@@ -14384,7 +14604,7 @@ var no_mutating_input_with_result_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Return replacement object values instead of writing input fields in result-returning functions.",
-      url: docsUrl(NAME49)
+      url: docsUrl(NAME52)
     },
     schema: [],
     messages: { inputWrite: "This result-returning function writes input `{{name}}`; return a replacement value or declare an in-place command returning void." }
@@ -14460,7 +14680,7 @@ function globalReceiver(node, sourceCode2) {
 }
 
 // src/rules/no-negative-only-http-status-assertion.ts
-var NAME50 = "no-negative-only-http-status-assertion";
+var NAME53 = "no-negative-only-http-status-assertion";
 var SERVER_ERROR_MIN = 500;
 var SERVER_ERROR_MAX = 599;
 var HTTP_STATUS_MIN = 100;
@@ -14560,7 +14780,7 @@ var no_negative_only_http_status_assertion_default = defineRule({
     type: "problem",
     docs: {
       description: "Assert the intended HTTP status instead of only excluding a server error.",
-      url: docsUrl(NAME50)
+      url: docsUrl(NAME53)
     },
     schema: [],
     messages: { expectedStatus: "This assertion only excludes a server error; assert the intended HTTP status for the same response." }
@@ -14585,7 +14805,7 @@ var no_negative_only_http_status_assertion_default = defineRule({
 });
 
 // src/rules/no-numeric-search-param-coercion.ts
-var NAME51 = "no-numeric-search-param-coercion";
+var NAME54 = "no-numeric-search-param-coercion";
 var GLOBAL_PARSERS = /* @__PURE__ */ new Set(["parseInt", "parseFloat", "Number"]);
 var NUMBER_PARSERS = /* @__PURE__ */ new Set(["parseInt", "parseFloat"]);
 var SEARCH_PARAM_TYPES = /* @__PURE__ */ new Set(["URLSearchParams", "ReadonlyURLSearchParams"]);
@@ -14626,7 +14846,7 @@ var no_numeric_search_param_coercion_default = defineRule({
     type: "problem",
     docs: {
       description: "Parse numeric URL search parameters with a schema instead of parseInt or Number.",
-      url: docsUrl(NAME51)
+      url: docsUrl(NAME54)
     },
     schema: [],
     messages: {
@@ -14670,7 +14890,7 @@ var no_numeric_search_param_coercion_default = defineRule({
 });
 
 // src/rules/no-offset-pagination.ts
-var NAME52 = "no-offset-pagination";
+var NAME55 = "no-offset-pagination";
 var OFFSET_PAGINATION = /\bOFFSET\s+(?:%s|%\(\w+\)s|\?\d*|:\w+|@\w+|\$\d+|\d+)/i;
 var PAGINATION_CONTEXT = /\bSELECT\b[\s\S]*\bFROM\b[\s\S]*\bOFFSET\b|\bLIMIT\s+(?:%s|%\(\w+\)s|\?\d*|:\w+|@\w+|\$\d+|\d+)\s+OFFSET\b/i;
 var no_offset_pagination_default = defineRule({
@@ -14678,7 +14898,7 @@ var no_offset_pagination_default = defineRule({
     type: "problem",
     docs: {
       description: "Prefer keyset pagination for embedded SQL queries using OFFSET.",
-      url: docsUrl(NAME52)
+      url: docsUrl(NAME55)
     },
     schema: [],
     messages: {
@@ -14704,7 +14924,7 @@ var no_offset_pagination_default = defineRule({
 });
 
 // src/rules/no-oxlint-directive.ts
-var NAME53 = "no-oxlint-directive";
+var NAME56 = "no-oxlint-directive";
 var OXLINT_DIRECTIVE_RE = /^(\s*)oxlint-(disable-next-line|disable-line|disable|enable)(?=\s|$)/u;
 var no_oxlint_directive_default = defineRule({
   meta: {
@@ -14712,7 +14932,7 @@ var no_oxlint_directive_default = defineRule({
     fixable: "code",
     docs: {
       description: "Write every suppression directive with the `eslint-*` spelling.",
-      url: docsUrl(NAME53)
+      url: docsUrl(NAME56)
     },
     schema: [],
     messages: {
@@ -14825,7 +15045,7 @@ function closedNamespace(namespace, initializer) {
 }
 
 // src/rules/no-partial-type-predicate.ts
-var NAME54 = "no-partial-type-predicate";
+var NAME57 = "no-partial-type-predicate";
 var MAX_LENGTH_WITNESS = 256;
 function predicateCandidate(node) {
   const annotation = node.returnType?.typeAnnotation;
@@ -14869,7 +15089,7 @@ var no_partial_type_predicate_default = defineRule({
     fixable: "code",
     docs: {
       description: "Do not give a partial primitive filter an explicit type predicate that excludes valid values in the false branch.",
-      url: docsUrl(NAME54)
+      url: docsUrl(NAME57)
     },
     schema: [],
     messages: { partialPredicate: "This predicate returns false for {{witness}}, which still belongs to `{{target}}`. Its false branch can therefore narrow unsafely. Use a boolean value filter or a predicate that recognizes every promised value." }
@@ -15033,6 +15253,65 @@ function showWitness(value) {
   return `\`${JSON.stringify(value)}\``;
 }
 
+// src/rules/no-password-get-form.ts
+var NAME58 = "no-password-get-form";
+var no_password_get_form_default = defineRule({
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Keep named password controls out of native GET form submissions.",
+      url: docsUrl(NAME58)
+    },
+    schema: [],
+    messages: {
+      passwordGet: "This native GET form can put a named password in the URL. Review the endpoint contract and submit credentials with POST."
+    }
+  },
+  createOnce(context) {
+    return {
+      before() {
+        if (isGeneratedFile({ filename: context.filename, cwd: context.cwd }, context.sourceCode.text))
+          return false;
+      },
+      JSXElement(node) {
+        const opening = node.openingElement;
+        if (opening.name.type !== "JSXIdentifier" || opening.name.name !== "form") return;
+        const method = attributeString(opening, context.sourceCode, ["method"])?.toLowerCase();
+        if (method === void 0 || method === "post" || method === "dialog") return;
+        if (attributeString(opening, context.sourceCode, ["action"]) === null || effectiveAttribute(opening, ["onSubmit", "onSubmitCapture"]) !== void 0)
+          return;
+        if (!hasSubmissionOverride(node) && containsPassword(node.children, context.sourceCode))
+          context.report({ node: opening, messageId: "passwordGet" });
+      }
+    };
+  }
+});
+function containsPassword(children, source) {
+  for (const child of children) {
+    if (child.type === "JSXFragment") {
+      if (containsPassword(child.children, source)) return true;
+      continue;
+    }
+    if (child.type !== "JSXElement" || child.openingElement.name.type !== "JSXIdentifier") continue;
+    const opening = child.openingElement;
+    const tag = opening.name.type === "JSXIdentifier" ? opening.name.name : "";
+    if (!/^[a-z]/u.test(tag) || tag === "form" || tag === "fieldset" && mayHaveBooleanAttribute(opening, ["disabled"]))
+      continue;
+    if (tag === "input" && isSubmittedPassword(opening, source)) return true;
+    if (containsPassword(child.children, source)) return true;
+  }
+  return false;
+}
+function isSubmittedPassword(opening, source) {
+  const name = attributeString(opening, source, ["name"]);
+  return attributeString(opening, source, ["type"])?.toLowerCase() === "password" && name !== null && name !== "" && !mayHaveBooleanAttribute(opening, ["disabled"]) && effectiveAttribute(opening, ["form"]) === void 0;
+}
+function hasSubmissionOverride(node) {
+  if (node.type === "JSXOpeningElement" && node.name.type === "JSXIdentifier" && ["button", "input"].includes(node.name.name) && effectiveAttribute(node, ["formMethod", "formmethod", "formAction", "formaction"]) !== void 0)
+    return true;
+  return forEachOwnAstChild(node, hasSubmissionOverride);
+}
+
 // src/rules/_labeled-tuple-object-fix.ts
 var UNSAFE_NAMES = /* @__PURE__ */ new Set([
   "__proto__",
@@ -15135,7 +15414,7 @@ function matchingReturn(object, fields2) {
 }
 
 // src/rules/no-positional-tuple-return.ts
-var NAME55 = "no-positional-tuple-return";
+var NAME59 = "no-positional-tuple-return";
 var MIN_ELEMENTS = 2;
 var AWAITABLE_TYPES = /* @__PURE__ */ new Set([
   "Promise",
@@ -15391,7 +15670,7 @@ var no_positional_tuple_return_default = defineRule({
     fixable: "code",
     docs: {
       description: "Disallow returning a multi-field tuple from a named function; return a named object so call sites cannot mismatch slots.",
-      url: docsUrl(NAME55)
+      url: docsUrl(NAME59)
     },
     schema: [],
     messages: {
@@ -15523,13 +15802,13 @@ var no_positional_tuple_return_default = defineRule({
 });
 
 // src/rules/no-production-browser-source-maps.ts
-var NAME56 = "no-production-browser-source-maps";
+var NAME60 = "no-production-browser-source-maps";
 var NEXT_CONFIG_RE2 = /(?:^|\/)next\.config\.[cm]?[jt]s$/;
 var no_production_browser_source_maps_default = defineRule({
   meta: {
     type: "problem",
     fixable: "code",
-    docs: { description: "Next.js production browser source maps expose application source", url: docsUrl(NAME56) },
+    docs: { description: "Next.js production browser source maps expose application source", url: docsUrl(NAME60) },
     schema: [],
     messages: {
       noProductionBrowserSourceMaps: "Do not publish production browser source maps. Upload private maps to your monitoring service instead."
@@ -15922,7 +16201,7 @@ var no_raw_env_default = defineRule({
 });
 
 // src/rules/no-raw-fetch-outside-clients.ts
-var NAME57 = "no-raw-fetch-outside-clients";
+var NAME61 = "no-raw-fetch-outside-clients";
 var DEFAULT_ALLOW = [
   "[\\\\/]clients?[\\\\/]",
   "-client\\.[cm]?[jt]sx?$",
@@ -16049,7 +16328,7 @@ var no_raw_fetch_outside_clients_default = defineRule({
     type: "problem",
     docs: {
       description: "Disallow calling the global `fetch` outside the client layer; route outbound HTTP through a client module that owns retry, timeout and status handling.",
-      url: docsUrl(NAME57)
+      url: docsUrl(NAME61)
     },
     schema: [
       {
@@ -16311,7 +16590,7 @@ function functionNode2(node) {
 }
 
 // src/rules/no-readonly-prop-state.ts
-var NAME58 = "no-readonly-prop-state";
+var NAME62 = "no-readonly-prop-state";
 var MAX_TYPE_DEPTH = 16;
 function isReadonlyUseState(source, node) {
   if (node.optional || node.arguments.length !== 1 || !reactHook(source, node.callee, "useState")) return false;
@@ -16351,7 +16630,7 @@ function isPrimitiveType(native, type, depth = 0) {
 var no_readonly_prop_state_default = defineRule({
   meta: {
     type: "suggestion",
-    docs: { description: "Review props copied into state without a usable updater.", url: docsUrl(NAME58) },
+    docs: { description: "Review props copied into state without a usable updater.", url: docsUrl(NAME62) },
     schema: [],
     messages: {
       readonlyPropState: "This prop is copied into state without an observed updater. Derive it from current props, or make an intentional initial snapshot explicit; review the lifecycle before changing it."
@@ -16426,7 +16705,7 @@ function identitySpread(sourceCode2, callback) {
 }
 
 // src/rules/no-reduce-accumulator-copy.ts
-var NAME59 = "no-reduce-accumulator-copy";
+var NAME63 = "no-reduce-accumulator-copy";
 var COPY_METHODS = /* @__PURE__ */ new Set(["concat", "slice", "toSpliced", "toSorted", "toReversed", "with"]);
 var REDUCE_METHODS = /* @__PURE__ */ new Set(["reduce", "reduceRight"]);
 var ARRAY_INTERFACES = /* @__PURE__ */ new Set(["Array", "ReadonlyArray"]);
@@ -16449,7 +16728,7 @@ var no_reduce_accumulator_copy_default = defineRule({
     fixable: "code",
     docs: {
       description: "Review copies of the accumulated collection inside a built-in reduce callback.",
-      url: docsUrl(NAME59)
+      url: docsUrl(NAME63)
     },
     schema: [],
     messages: {
@@ -16663,7 +16942,7 @@ function minimalConsumerFix(sourceCode2, annotation, removed) {
 }
 
 // src/rules/no-redundant-consumer-union.ts
-var NAME60 = "no-redundant-consumer-union";
+var NAME64 = "no-redundant-consumer-union";
 function scalarFields(native, type) {
   const { ast, sync } = native;
   if (!closedObjectContract(native, type, true)) return null;
@@ -16784,7 +17063,7 @@ var no_redundant_consumer_union_default = defineRule({
   meta: {
     type: "suggestion",
     fixable: "code",
-    docs: { description: "Keep the covering object contract in a private scalar consumer union.", url: docsUrl(NAME60) },
+    docs: { description: "Keep the covering object contract in a private scalar consumer union.", url: docsUrl(NAME64) },
     schema: [],
     messages: {
       redundant: "{{covered}} is already accepted by {{covering}} in this private scalar consumer. Review keeping the covering {{covering}} contract; preserve producer information and runtime objects."
@@ -16841,7 +17120,7 @@ var no_redundant_consumer_union_default = defineRule({
 });
 
 // src/rules/no-redundant-local-alias.ts
-var NAME61 = "no-redundant-local-alias";
+var NAME65 = "no-redundant-local-alias";
 function stableSource(variable, alias) {
   const definition = variable.defs[0];
   if (variable.defs.length !== 1 || definition === void 0 || variable.references.some((reference) => reference.isWrite() && !reference.init)) return false;
@@ -16914,7 +17193,7 @@ var no_redundant_local_alias_default = defineRule({
     fixable: "code",
     docs: {
       description: "Pass the original local into an object field instead of creating a single-use rename.",
-      url: docsUrl(NAME61)
+      url: docsUrl(NAME65)
     },
     schema: [],
     messages: { redundantAlias: "This alias is read only by its matching object field; pass `{{source}}` directly as `{{target}}: {{source}}`." }
@@ -16982,7 +17261,7 @@ function methodReceiver(node, method, argumentCount) {
 }
 
 // src/rules/no-redundant-optional-array-default.ts
-var NAME62 = "no-redundant-optional-array-default";
+var NAME66 = "no-redundant-optional-array-default";
 function hasArrayFallback(node) {
   const argument = node.arguments[0];
   if (node.arguments.length !== 1 || argument === void 0) return false;
@@ -17002,7 +17281,7 @@ var no_redundant_optional_array_default_default = defineRule({
     type: "problem",
     docs: {
       description: "Remove `.optional()` immediately inside a Zod array default.",
-      url: docsUrl(NAME62)
+      url: docsUrl(NAME66)
     },
     fixable: "code",
     schema: [],
@@ -17147,7 +17426,7 @@ function ownedStringReturn(sourceCode2, entry, binding3, value) {
 }
 
 // src/rules/no-repeated-string-literal.ts
-var NAME63 = "no-repeated-string-literal";
+var NAME67 = "no-repeated-string-literal";
 var MIN_LENGTH = 40;
 var MIN_DISTINCT_SCOPES = 2;
 var PREVIEW_LENGTH = 40;
@@ -17183,7 +17462,7 @@ var no_repeated_string_literal_default = defineRule({
     fixable: "code",
     docs: {
       description: "Disallow a long structured string literal repeated across functions; the copies drift when one is edited. Extract a module-level constant.",
-      url: docsUrl(NAME63)
+      url: docsUrl(NAME67)
     },
     schema: [],
     messages: {
@@ -17253,7 +17532,7 @@ var no_repeated_string_literal_default = defineRule({
 });
 
 // src/rules/no-restated-comment.ts
-var NAME64 = "no-restated-comment";
+var NAME68 = "no-restated-comment";
 var MAX_WORDS = 8;
 var MIN_CONTENT_TOKENS = 2;
 var DIRECTIVE_RE3 = /^(eslint\b|eslint-|sarj-noqa\b|@ts-|prettier-ignore|prettier\b|biome-|c8\b|v8\b|istanbul\b|@type\b|@vite|webpack|<reference|<amd|global\b|noinspection|todo\b|fixme\b|hack\b|xxx\b)/i;
@@ -17317,7 +17596,7 @@ var no_restated_comment_default = defineRule({
     fixable: "code",
     docs: {
       description: "Flag short standalone comments that repeat the adjacent statement's identifiers.",
-      url: docsUrl(NAME64)
+      url: docsUrl(NAME68)
     },
     schema: [],
     messages: {
@@ -17414,7 +17693,7 @@ function isRestatableLabel(body3) {
 }
 
 // src/rules/no-restated-jsdoc.ts
-var NAME65 = "no-restated-jsdoc";
+var NAME69 = "no-restated-jsdoc";
 var MODELLED_TAGS = /* @__PURE__ */ new Set([
   "arg",
   "argument",
@@ -17488,7 +17767,7 @@ var no_restated_jsdoc_default = defineRule({
     fixable: "code",
     docs: {
       description: "Flag JSDoc prose that appears to repeat declaration names without adding behavioral information.",
-      url: docsUrl(NAME65)
+      url: docsUrl(NAME69)
     },
     schema: [],
     messages: {
@@ -17626,7 +17905,7 @@ function proseTokens(text) {
 }
 
 // src/rules/no-restricted-library-load.ts
-var NAME66 = "no-restricted-library-load";
+var NAME70 = "no-restricted-library-load";
 function matchesModule(source, module) {
   return source === module || source.startsWith(`${module}/`);
 }
@@ -17640,7 +17919,7 @@ var no_restricted_library_load_default = defineRule({
     type: "problem",
     docs: {
       description: "Apply configured library restrictions to literal runtime loads and CommonJS resolution references.",
-      url: docsUrl(NAME66)
+      url: docsUrl(NAME70)
     },
     schema: [
       {
@@ -17724,7 +18003,7 @@ var no_restricted_library_load_default = defineRule({
 });
 
 // src/rules/no-return-disposed-resource.ts
-var NAME67 = "no-return-disposed-resource";
+var NAME71 = "no-return-disposed-resource";
 function resourceOwner(source, value, seen = /* @__PURE__ */ new Set()) {
   const node = unwrapExpression(value);
   if (node.type !== "Identifier") return null;
@@ -17739,7 +18018,7 @@ function resourceOwner(source, value, seen = /* @__PURE__ */ new Set()) {
 var no_return_disposed_resource_default = defineRule({
   meta: {
     type: "problem",
-    docs: { description: "Do not return a resource whose using declaration disposes it before the caller receives it.", url: docsUrl(NAME67) },
+    docs: { description: "Do not return a resource whose using declaration disposes it before the caller receives it.", url: docsUrl(NAME71) },
     schema: [],
     messages: { disposedReturn: "This using resource is disposed when its function returns; keep the consumer inside its lifetime or transfer ownership explicitly." }
   },
@@ -17760,7 +18039,7 @@ var no_return_disposed_resource_default = defineRule({
 });
 
 // src/rules/no-router-refresh-polling.ts
-var NAME68 = "no-router-refresh-polling";
+var NAME72 = "no-router-refresh-polling";
 function enclosingIntervalCallback(sourceCode2, node) {
   for (let ancestor = parentOf(node); ancestor !== null; ancestor = parentOf(ancestor)) {
     if (ancestor.type === "FunctionDeclaration") return null;
@@ -17783,7 +18062,7 @@ var no_router_refresh_polling_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Do not poll by calling a Next.js router's refresh method from a timer.",
-      url: docsUrl(NAME68)
+      url: docsUrl(NAME72)
     },
     schema: [],
     messages: { routerRefreshPolling: "Poll the named fetch or server action instead of calling router.refresh() from a timer." }
@@ -17840,14 +18119,14 @@ var no_router_refresh_polling_default = defineRule({
 });
 
 // src/rules/no-runtime-typeof.ts
-var NAME69 = "no-runtime-typeof";
+var NAME73 = "no-runtime-typeof";
 var EQUALITY_OPERATORS2 = /* @__PURE__ */ new Set(["===", "!==", "==", "!="]);
 var no_runtime_typeof_default = defineRule({
   meta: {
     type: "suggestion",
     docs: {
       description: "Prefer Zod boundary schemas or discriminated unions over runtime typeof checks.",
-      url: docsUrl(NAME69)
+      url: docsUrl(NAME73)
     },
     schema: [],
     messages: {
@@ -17875,7 +18154,7 @@ var no_runtime_typeof_default = defineRule({
 });
 
 // src/rules/no-secret-in-log.ts
-var NAME70 = "no-secret-in-log";
+var NAME74 = "no-secret-in-log";
 var LOG_INNOCUOUS_WORDS = /* @__PURE__ */ new Set([
   ...INNOCUOUS_WORDS,
   "name",
@@ -18036,7 +18315,7 @@ var no_secret_in_log_default = defineRule({
     type: "problem",
     docs: {
       description: "Disallow passing a secret-named value or a raw request/response blob to a logging call; both leak to log sinks. Redact or omit.",
-      url: docsUrl(NAME70)
+      url: docsUrl(NAME74)
     },
     schema: [
       {
@@ -18300,7 +18579,7 @@ function ownedBindings(sourceCode2, owner) {
 }
 
 // src/rules/no-select-star.ts
-var NAME71 = "no-select-star";
+var NAME75 = "no-select-star";
 var QUERY_SELECT = /\bSELECT\b/i;
 var QUERY_FROM = /\bFROM\b/i;
 var SQL_TOKEN = /[A-Za-z_\u0080-\u{10FFFF}][A-Za-z0-9_$\u0080-\u{10FFFF}]*|\d+(?:\.\d+)?|\.[ \t\r\n\f\v]*\[(?:[^\]]|\]\])*\]|[-+*/<>=~!@#%^&|\x60?]+|[(),.;]/gu;
@@ -18430,7 +18709,7 @@ var no_select_star_default = defineRule({
     type: "problem",
     docs: {
       description: "Prefer explicit column projections over SELECT * in embedded SQL.",
-      url: docsUrl(NAME71)
+      url: docsUrl(NAME75)
     },
     schema: [],
     fixable: "code",
@@ -18460,7 +18739,7 @@ var no_select_star_default = defineRule({
 });
 
 // src/rules/no-sentinel-return-on-catch.ts
-var NAME72 = "no-sentinel-return-on-catch";
+var NAME76 = "no-sentinel-return-on-catch";
 function unwrapSentinelExpression(arg) {
   let current = arg;
   while (current?.type === "TSAsExpression" || current?.type === "TSTypeAssertion" || current?.type === "TSSatisfiesExpression") {
@@ -18694,7 +18973,7 @@ var no_sentinel_return_on_catch_default = defineRule({
     type: "problem",
     docs: {
       description: "Disallow swallowing a caught error by returning an empty sentinel unless the error is handled or the sentinel is part of the function contract.",
-      url: docsUrl(NAME72)
+      url: docsUrl(NAME76)
     },
     schema: [
       {
@@ -18810,7 +19089,7 @@ var no_server_env_in_client_component_default = defineRule({
 });
 
 // src/rules/no-server-file-uploads.ts
-var NAME73 = "no-server-file-uploads";
+var NAME77 = "no-server-file-uploads";
 function hasDirective(statements, directive2) {
   for (const statement of statements) {
     if (statement.type !== "ExpressionStatement" || typeof statement.directive !== "string") return false;
@@ -18838,7 +19117,7 @@ function isBufferImport(node) {
 var no_server_file_uploads_default = defineRule({
   meta: {
     type: "problem",
-    docs: { description: "Keep native File handling outside explicit server boundaries.", url: docsUrl(NAME73) },
+    docs: { description: "Keep native File handling outside explicit server boundaries.", url: docsUrl(NAME77) },
     schema: [],
     messages: { serverFile: "Keep File handling in the browser and upload directly to object storage with an authorized signed URL; accept object keys and metadata on the server." }
   },
@@ -18917,7 +19196,7 @@ var no_server_file_uploads_default = defineRule({
 });
 
 // src/rules/no-silent-promise-catch.ts
-var NAME74 = "no-silent-promise-catch";
+var NAME78 = "no-silent-promise-catch";
 var BODY_PARSE_METHODS = /* @__PURE__ */ new Set([
   "arrayBuffer",
   "blob",
@@ -19109,7 +19388,7 @@ var no_silent_promise_catch_default = defineRule({
     type: "problem",
     docs: {
       description: "Disallow `.catch()` and second-argument `.then()` handlers that silently swallow a rejection; log, rethrow, or handle the error.",
-      url: docsUrl(NAME74)
+      url: docsUrl(NAME78)
     },
     schema: [],
     messages: {
@@ -19150,7 +19429,7 @@ var no_silent_promise_catch_default = defineRule({
 });
 
 // src/rules/no-sleep-in-test-body.ts
-var NAME75 = "no-sleep-in-test-body";
+var NAME79 = "no-sleep-in-test-body";
 var SLEEP_HELPERS = /* @__PURE__ */ new Set(["sleep", "delay", "wait", "pause"]);
 var TEST_CALLERS2 = /* @__PURE__ */ new Set([
   "it",
@@ -19241,7 +19520,7 @@ var no_sleep_in_test_body_default = defineRule({
     type: "problem",
     docs: {
       description: "Avoid fixed timed sleeps directly in test bodies; synchronize on observable behavior or use controlled timers.",
-      url: docsUrl(NAME75)
+      url: docsUrl(NAME79)
     },
     schema: [],
     messages: {
@@ -19285,7 +19564,7 @@ var no_sleep_in_test_body_default = defineRule({
 });
 
 // src/rules/no-storage-in-stateless-modules.ts
-var NAME76 = "no-storage-in-stateless-modules";
+var NAME80 = "no-storage-in-stateless-modules";
 var DEFAULT_METHODS2 = [
   "prepare",
   "put",
@@ -19357,7 +19636,7 @@ var no_storage_in_stateless_modules_default = defineRule({
     type: "problem",
     docs: {
       description: "Disallow SQL or key/value access inside configured stateless modules; derive state from a system of record instead.",
-      url: docsUrl(NAME76)
+      url: docsUrl(NAME80)
     },
     schema: [
       {
@@ -19462,7 +19741,7 @@ function named2(node, name) {
 }
 
 // src/rules/no-string-concat-in-loop.ts
-var NAME77 = "no-string-concat-in-loop";
+var NAME81 = "no-string-concat-in-loop";
 var LOOP_NODE_TYPES = /* @__PURE__ */ new Set([
   "ForStatement",
   "ForOfStatement",
@@ -19610,7 +19889,7 @@ var no_string_concat_in_loop_default = defineRule({
     fixable: "code",
     docs: {
       description: "Prefer collecting string fragments over repeatedly accumulating a growing string inside a loop.",
-      url: docsUrl(NAME77)
+      url: docsUrl(NAME81)
     },
     schema: [],
     messages: {
@@ -19657,7 +19936,7 @@ var no_string_concat_in_loop_default = defineRule({
 });
 
 // src/rules/no-tautological-expect.ts
-var NAME78 = "no-tautological-expect";
+var NAME82 = "no-tautological-expect";
 var EQUALITY_MATCHERS2 = /* @__PURE__ */ new Set(["toBe", "toEqual", "toStrictEqual"]);
 var ZERO_ARG_MATCHERS = /* @__PURE__ */ new Map([
   ["toBeDefined", (value) => value !== void 0],
@@ -19833,7 +20112,7 @@ var no_tautological_expect_default = defineRule({
     type: "problem",
     docs: {
       description: "Disallow supported assertions fixed by literal setup or immutable self identity.",
-      url: docsUrl(NAME78)
+      url: docsUrl(NAME82)
     },
     schema: [],
     messages: {
@@ -19870,7 +20149,7 @@ var no_tautological_expect_default = defineRule({
 });
 
 // src/rules/no-trailing-value-narration.ts
-var NAME79 = "no-trailing-value-narration";
+var NAME83 = "no-trailing-value-narration";
 var NUMBER_RE = /(?<![\w.])(\d+(?:\.\d+)?)(?![\w.])/g;
 var WORD_RE4 = /[\p{L}\p{M}]+(?:'[\p{L}\p{M}]+)?|\d+(?:\.\d+)?/gu;
 var UNIT_WORDS = /* @__PURE__ */ new Set([
@@ -19993,7 +20272,7 @@ var no_trailing_value_narration_default = defineRule({
     fixable: "code",
     docs: {
       description: "Flag a trailing comment that repeats the line's numeric value only to name its unit.",
-      url: docsUrl(NAME79)
+      url: docsUrl(NAME83)
     },
     schema: [],
     messages: {
@@ -20209,7 +20488,7 @@ var no_type_member_comment_wall_default = defineRule({
 });
 
 // src/rules/no-typed-doc-sections.ts
-var NAME80 = "no-typed-doc-sections";
+var NAME84 = "no-typed-doc-sections";
 var TYPED_TAG_RE3 = /^\s*@(arg|argument|param|return|returns|yield|yields)\b(.*)$/iu;
 var PARAM_TAGS2 = /* @__PURE__ */ new Set(["arg", "argument", "param"]);
 var PARAMETER_FILLER = /* @__PURE__ */ new Set([
@@ -20381,7 +20660,7 @@ var no_typed_doc_sections_default = defineRule({
     fixable: "code",
     docs: {
       description: "Reject typed-signature repetition while preserving behavior that types cannot express.",
-      url: docsUrl(NAME80)
+      url: docsUrl(NAME84)
     },
     schema: [],
     messages: {
@@ -20743,7 +21022,7 @@ function translationExemptElement(opening, isText) {
 }
 
 // src/rules/no-unlocalized-jsx-attributes.ts
-var NAME81 = "no-unlocalized-jsx-attributes";
+var NAME85 = "no-unlocalized-jsx-attributes";
 var DEFAULT_ATTRIBUTES = ["title", "placeholder", "alt", "aria-label", "aria-description"];
 var ID_REFERENCES = /* @__PURE__ */ new Set([
   "aria-labelledby",
@@ -20763,7 +21042,7 @@ var no_unlocalized_jsx_attributes_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Require translation for literal user-visible JSX attributes in opted-in localized interfaces.",
-      url: docsUrl(NAME81)
+      url: docsUrl(NAME85)
     },
     schema: [
       {
@@ -20812,14 +21091,14 @@ var no_unlocalized_jsx_attributes_default = defineRule({
 });
 
 // src/rules/no-unlocalized-jsx-text.ts
-var NAME82 = "no-unlocalized-jsx-text";
+var NAME86 = "no-unlocalized-jsx-text";
 var no_unlocalized_jsx_text_default = defineRule({
   meta: {
     defaultOptions: [{ enabled: true }],
     type: "suggestion",
     docs: {
       description: "Require translation for literal JSX text in opted-in localized interfaces.",
-      url: docsUrl(NAME82)
+      url: docsUrl(NAME86)
     },
     schema: [
       {
@@ -20856,7 +21135,7 @@ var no_unlocalized_jsx_text_default = defineRule({
 });
 
 // src/rules/no-unlocalized-toast.ts
-var NAME83 = "no-unlocalized-toast";
+var NAME87 = "no-unlocalized-toast";
 var DEFAULT_FUNCTIONS = [
   { module: "sonner", export: "toast" },
   { module: "react-hot-toast", export: "default" }
@@ -20868,7 +21147,7 @@ var no_unlocalized_toast_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Require translation for literal toast messages in opted-in localized interfaces.",
-      url: docsUrl(NAME83)
+      url: docsUrl(NAME87)
     },
     schema: [
       {
@@ -20926,7 +21205,7 @@ var no_unlocalized_toast_default = defineRule({
 });
 
 // src/rules/no-unnecessary-use-client.ts
-var NAME84 = "no-unnecessary-use-client";
+var NAME88 = "no-unnecessary-use-client";
 var HOOK_REGEX = /^use([A-Z]|$)/;
 var EVENT_PROP_REGEX = /^on[A-Z]/;
 var ERROR_FILE_REGEX = /(?:^|[\\/])(?:global-)?error\.[jt]sx?$/;
@@ -21015,7 +21294,7 @@ var no_unnecessary_use_client_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Flag `'use client'` files with no hooks or event handlers \u2014 they could be RSC.",
-      url: docsUrl(NAME84)
+      url: docsUrl(NAME88)
     },
     schema: [],
     messages: {
@@ -21107,7 +21386,7 @@ var no_unnecessary_use_client_default = defineRule({
 });
 
 // src/rules/no-unsafe-mock-casting.ts
-var NAME85 = "no-unsafe-mock-casting";
+var NAME89 = "no-unsafe-mock-casting";
 var MOCK_TYPE_NAMES = /* @__PURE__ */ new Set([
   "Mock",
   "Mocked",
@@ -21139,7 +21418,7 @@ var no_unsafe_mock_casting_default = defineRule({
     fixable: "code",
     docs: {
       description: "Disallow casting to mock types like `jest.Mock` or `vi.Mock`. Use `vi.mocked()` or `jest.mocked()` instead.",
-      url: docsUrl(NAME85)
+      url: docsUrl(NAME89)
     },
     schema: [],
     messages: {
@@ -21200,7 +21479,7 @@ var no_unsafe_mock_casting_default = defineRule({
 });
 
 // src/rules/no-unsafe-test-double-cast.ts
-var NAME86 = "no-unsafe-test-double-cast";
+var NAME90 = "no-unsafe-test-double-cast";
 var MOCK_FACTORIES = /* @__PURE__ */ new Set(["fn", "spyOn"]);
 var SIMPLE_LITERAL_TYPES = /* @__PURE__ */ new Set(["string", "number", "boolean", "bigint"]);
 function containsMockFactory(node, source) {
@@ -21227,7 +21506,7 @@ var no_unsafe_test_double_cast_default = defineRule({
     fixable: "code",
     docs: {
       description: "Disallow mock-backed test doubles that bypass collaborator contracts through double assertions.",
-      url: docsUrl(NAME86)
+      url: docsUrl(NAME90)
     },
     schema: [],
     messages: { noUnsafeTestDoubleCast: "This mock-backed partial object bypasses the collaborator contract through `unknown`. Use a narrow injected port and typed recording fake, or make the fixture satisfy the real contract." }
@@ -21273,7 +21552,7 @@ function simpleMockObject(node, sourceCode2) {
 }
 
 // src/rules/no-vague-suppression-description.ts
-var NAME87 = "no-vague-suppression-description";
+var NAME91 = "no-vague-suppression-description";
 var DIRECTIVE_WITH_DESCRIPTION_RE = /^(?:eslint|oxlint)-(?:disable|disable-next-line|disable-line)\b[^:\n]*?\s*(?::|--)\s*(.+?)\s*$/iu;
 var TS_EXPECT_ERROR_WITH_DESCRIPTION_RE = /^@ts-expect-error\b(?:(?:\s*(?::|--)\s*)|\s+)(.+?)\s*$/iu;
 var VAGUE_RE = /^(?:needed|required|same|n\/a|legacy|intentional(?:ly)?|ignore(?:d)?|false positive|type error|typescript|to satisfy (?:the )?(?:linter|typescript|type checker))\.?$/iu;
@@ -21285,7 +21564,7 @@ var no_vague_suppression_description_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Require suppression descriptions to name the concrete mismatch or invariant instead of a generic non-reason.",
-      url: docsUrl(NAME87)
+      url: docsUrl(NAME91)
     },
     schema: [],
     messages: {
@@ -21312,7 +21591,7 @@ var no_vague_suppression_description_default = defineRule({
 });
 
 // src/rules/no-zod-native-enum.ts
-var NAME88 = "no-zod-native-enum";
+var NAME92 = "no-zod-native-enum";
 function unwrap3(node) {
   if (node.type === "TSAsExpression" || node.type === "TSSatisfiesExpression") return unwrap3(node.expression);
   return node;
@@ -21331,7 +21610,7 @@ var no_zod_native_enum_default = defineRule({
     type: "suggestion",
     docs: {
       description: 'Disallow `z.nativeEnum()` (and `z.enum()` over a TypeScript enum); use `z.enum(["a", "b"])` with a string-literal union instead.',
-      url: docsUrl(NAME88)
+      url: docsUrl(NAME92)
     },
     schema: [],
     messages: {
@@ -21430,7 +21709,7 @@ var no_zod_native_enum_default = defineRule({
 });
 
 // src/rules/no-zod-parse-typed-object.ts
-var NAME89 = "no-zod-parse-typed-object";
+var NAME93 = "no-zod-parse-typed-object";
 var PARSE_METHODS2 = /* @__PURE__ */ new Set(["parse", "parseAsync", "safeParse", "safeParseAsync"]);
 var DECLARATION_FILE3 = /\.d\.[cm]?ts$/u;
 function isAssignable(env, source, target) {
@@ -21582,7 +21861,7 @@ function isZodDeclaration(signature) {
 var no_zod_parse_typed_object_default = defineRule({
   meta: {
     type: "suggestion",
-    docs: { description: "Reuse known object contracts instead of parsing them again with Zod.", url: docsUrl(NAME89) },
+    docs: { description: "Reuse known object contracts instead of parsing them again with Zod.", url: docsUrl(NAME93) },
     schema: [],
     messages: {
       typedObject: "This object already has a compatible TypeScript contract. Reuse the typed value and make defaults or normalization explicit; reserve Zod parsing for unknown boundary data."
@@ -21642,7 +21921,7 @@ var no_zod_parse_typed_object_default = defineRule({
 });
 
 // src/rules/prefer-await-in-async-return.ts
-var NAME90 = "prefer-await-in-async-return";
+var NAME94 = "prefer-await-in-async-return";
 function directAsyncReturnOwner(node) {
   const parent = parentOf(node);
   if (parent?.type === "ArrowFunctionExpression" && parent.body === node) {
@@ -21697,7 +21976,7 @@ var prefer_await_in_async_return_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Prefer explicit `await` for proven Promise `.then` calls; the default scope checks direct async returns.",
-      url: docsUrl(NAME90)
+      url: docsUrl(NAME94)
     },
     schema: [{
       type: "object",
@@ -21776,7 +22055,7 @@ var prefer_await_in_async_return_default = defineRule({
 });
 
 // src/rules/prefer-coded-error-result.ts
-var NAME91 = "prefer-coded-error-result";
+var NAME95 = "prefer-coded-error-result";
 var MAX_DEPTH = 16;
 var MAX_VARIANTS = 64;
 var MAX_TYPE_STEPS = 256;
@@ -22257,7 +22536,7 @@ var prefer_coded_error_result_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Return a stable error code and typed context instead of only a rendered failure message.",
-      url: docsUrl(NAME91)
+      url: docsUrl(NAME95)
     },
     schema: [],
     messages: {
@@ -22318,7 +22597,7 @@ var prefer_coded_error_result_default = defineRule({
 
 // src/rules/prefer-configured-cloud-scope.ts
 import { URL as NativeURL } from "url";
-var NAME92 = "prefer-configured-cloud-scope";
+var NAME96 = "prefer-configured-cloud-scope";
 var ACCOUNT_PREFIX = "https://api.cloudflare.com/client/v4/accounts/";
 var ACCOUNT_URL = /^https:\/\/api\.cloudflare\.com\/client\/v4\/accounts\/[a-fA-F\d]{32}(?=\/|[?#]|$)/u;
 var GLOBAL_RECEIVERS5 = /* @__PURE__ */ new Set(["globalThis", "global", "self", "window"]);
@@ -22340,7 +22619,7 @@ var prefer_configured_cloud_scope_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Prefer validated deployment configuration for account scope in outgoing cloud management requests.",
-      url: docsUrl(NAME92)
+      url: docsUrl(NAME96)
     },
     schema: [],
     messages: {
@@ -22569,7 +22848,7 @@ var prefer_configured_cloud_scope_default = defineRule({
 });
 
 // src/rules/prefer-constant-time-secret-compare.ts
-var NAME93 = "prefer-constant-time-secret-compare";
+var NAME97 = "prefer-constant-time-secret-compare";
 var EQUALITY_OPERATORS3 = /* @__PURE__ */ new Set(["===", "!==", "==", "!="]);
 var AUTH_TOKEN_QUALIFIERS = /* @__PURE__ */ new Set(["access", "refresh", "session", "admin", "csrf", "xsrf", "auth", "authentication", "signing", "api"]);
 var SENTINEL_IDENTIFIERS = /* @__PURE__ */ new Set(["undefined", "NaN"]);
@@ -22633,7 +22912,7 @@ var prefer_constant_time_secret_compare_default = defineRule({
     type: "problem",
     docs: {
       description: "Prefer a supported constant-time comparison primitive for secret-like values.",
-      url: docsUrl(NAME93)
+      url: docsUrl(NAME97)
     },
     schema: [],
     messages: {
@@ -22721,7 +23000,7 @@ function constInitializer4(definition) {
 }
 
 // src/rules/prefer-dependency-interface.ts
-var NAME94 = "prefer-dependency-interface";
+var NAME98 = "prefer-dependency-interface";
 function readsInterfaceMember(use, members2) {
   const parent = parentOf(use);
   if (parent?.type !== "MemberExpression" || parent.object !== use || !members2.has(getPropertyName(parent) ?? "")) return false;
@@ -22751,7 +23030,7 @@ var prefer_dependency_interface_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Annotate retained collaborators with their existing interface when the consumer uses only that contract.",
-      url: docsUrl(NAME94)
+      url: docsUrl(NAME98)
     },
     schema: [],
     messages: { interface: "Use the existing `{{contract}}` interface for this dependency; its consumer uses only that contract." }
@@ -23133,14 +23412,14 @@ function literalTag(node) {
 }
 
 // src/rules/prefer-discriminated-union.ts
-var NAME95 = "prefer-discriminated-union";
+var NAME99 = "prefer-discriminated-union";
 var prefer_discriminated_union_default = defineRule({
   meta: {
     type: "suggestion",
     fixable: "code",
     docs: {
       description: "Preserve producer-proven tag/payload and Boolean state relationships in return types.",
-      url: docsUrl(NAME95)
+      url: docsUrl(NAME99)
     },
     schema: [],
     messages: {
@@ -23221,7 +23500,7 @@ function privateVariantType(properties2, result, sourceCode2) {
 }
 
 // src/rules/prefer-ecmascript-private-members.ts
-var NAME96 = "prefer-ecmascript-private-members";
+var NAME100 = "prefer-ecmascript-private-members";
 function isConvertible(member3) {
   return member3.accessibility === "private" && !(member3.type === "MethodDefinition" && member3.kind === "constructor") && !member3.computed && member3.key.type === "Identifier" && (member3.decorators?.length ?? 0) === 0 && !("declare" in member3 && member3.declare) && !member3.override && !(member3.type === "MethodDefinition" && (member3.value.body ?? null) === null);
 }
@@ -23231,7 +23510,7 @@ var prefer_ecmascript_private_members_default = defineRule({
     fixable: "code",
     docs: {
       description: "Prefer ECMAScript `#private` class members over TypeScript-only `private` members.",
-      url: docsUrl(NAME96)
+      url: docsUrl(NAME100)
     },
     schema: [],
     messages: {
@@ -23285,7 +23564,7 @@ var prefer_ecmascript_private_members_default = defineRule({
 });
 
 // src/rules/prefer-immutable-module-constant.ts
-var NAME97 = "prefer-immutable-module-constant";
+var NAME101 = "prefer-immutable-module-constant";
 var CONSTANT_NAME = /^_?[A-Z][A-Z0-9_]*$/;
 var JAVASCRIPT_FILE_RE = /\.[cm]?jsx?$/i;
 var MUTATING_METHODS = /* @__PURE__ */ new Set([
@@ -23458,7 +23737,7 @@ var prefer_immutable_module_constant_default = defineRule({
     fixable: "code",
     docs: {
       description: "Require module-level constant collections to expose readonly state.",
-      url: docsUrl(NAME97)
+      url: docsUrl(NAME101)
     },
     schema: [],
     defaultOptions: [],
@@ -23564,7 +23843,7 @@ function unwrapTransparentExport(node) {
 }
 
 // src/rules/prefer-input-group-search.ts
-var NAME98 = "prefer-input-group-search";
+var NAME102 = "prefer-input-group-search";
 var INPUT_MODULE = /(?:^|\/)components\/ui\/input$/u;
 var INPUT_GROUP_MODULE = /(?:^|\/)components\/ui\/input-group$/u;
 var MAX_JSX_DISTANCE = 2;
@@ -23635,7 +23914,7 @@ var prefer_input_group_search_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Require search icons and shared Input controls in the same visual wrapper to use InputGroup.",
-      url: docsUrl(NAME98)
+      url: docsUrl(NAME102)
     },
     schema: [],
     messages: {
@@ -23719,7 +23998,7 @@ var prefer_input_group_search_default = defineRule({
 });
 
 // src/rules/prefer-logical-tailwind-utilities.ts
-var NAME99 = "prefer-logical-tailwind-utilities";
+var NAME103 = "prefer-logical-tailwind-utilities";
 var PREFIXES = {
   ml: "ms",
   mr: "me",
@@ -23773,7 +24052,7 @@ var prefer_logical_tailwind_utilities_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Prefer logical Tailwind utilities in explicitly opted-in bidirectional interfaces.",
-      url: docsUrl(NAME99)
+      url: docsUrl(NAME103)
     },
     schema: [
       {
@@ -23840,7 +24119,7 @@ var prefer_logical_tailwind_utilities_default = defineRule({
 });
 
 // src/rules/prefer-millisecond-control-duration-schema.ts
-var NAME100 = "prefer-millisecond-control-duration-schema";
+var NAME104 = "prefer-millisecond-control-duration-schema";
 var CONTROL_SECONDS_RE = /(?:^|_)(?:timeout|delay|interval|backoff|ttl|lease|heartbeat|debounce|throttle)_seconds$/i;
 var CONTROL_SECONDS_CAMEL_RE = /(?:timeout|delay|interval|backoff|ttl|lease|heartbeat|debounce|throttle)Seconds$/i;
 var NUMERIC_REFINEMENTS = /* @__PURE__ */ new Set(["int", "min", "max", "positive", "nonnegative", "finite", "multipleOf", "optional", "nullable", "nullish", "default", "describe", "brand", "readonly"]);
@@ -23852,7 +24131,7 @@ var prefer_millisecond_control_duration_schema_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Require application-owned Zod control-duration fields to use millisecond granularity.",
-      url: docsUrl(NAME100)
+      url: docsUrl(NAME104)
     },
     schema: [],
     messages: {
@@ -23938,7 +24217,7 @@ var prefer_millisecond_control_duration_schema_default = defineRule({
 });
 
 // src/rules/prefer-minimal-parameter-contract.ts
-var NAME101 = "prefer-minimal-parameter-contract";
+var NAME105 = "prefer-minimal-parameter-contract";
 function inlineFields(ast, node, reads) {
   const fields2 = /* @__PURE__ */ new Map();
   for (const member3 of node.members) {
@@ -23957,7 +24236,7 @@ var prefer_minimal_parameter_contract_default = defineRule({
   meta: {
     type: "suggestion",
     fixable: "code",
-    docs: { description: "Prefer the proven read-only subset for a private consumer parameter.", url: docsUrl(NAME101) },
+    docs: { description: "Prefer the proven read-only subset for a private consumer parameter.", url: docsUrl(NAME105) },
     schema: [],
     messages: {
       minimal: "This private consumer reads only {{used}} but also requires {{unused}}. Review a smaller consumer contract; preserve the original runtime object and producer type."
@@ -24356,7 +24635,7 @@ var prefer_module_level_constant_default = defineRule({
 });
 
 // src/rules/prefer-module-level-schema.ts
-var NAME102 = "prefer-module-level-schema";
+var NAME106 = "prefer-module-level-schema";
 var DEFAULT_FACTORIES = [
   "discriminatedUnion",
   "intersection",
@@ -24538,7 +24817,7 @@ var prefer_module_level_schema_default = defineRule({
     type: "problem",
     docs: {
       description: "Declare a Zod schema at module scope when it closes over nothing in the enclosing function",
-      url: docsUrl(NAME102)
+      url: docsUrl(NAME106)
     },
     schema: [
       {
@@ -24688,7 +24967,7 @@ var prefer_module_level_schema_default = defineRule({
 });
 
 // src/rules/prefer-module-level-refined-schema.ts
-var NAME103 = "prefer-module-level-refined-schema";
+var NAME107 = "prefer-module-level-refined-schema";
 var BENCHMARK_PATH_RE = /(^|[/\\])(?:benchmarks?|bench)[/\\]/;
 var FACTORIES = /* @__PURE__ */ new Set([
   "array",
@@ -24838,7 +25117,7 @@ var prefer_module_level_refined_schema_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Declare closed Zod scalar, format, and wrapper schemas at module scope.",
-      url: docsUrl(NAME103)
+      url: docsUrl(NAME107)
     },
     schema: [],
     messages: {
@@ -24936,7 +25215,7 @@ var prefer_module_level_refined_schema_default = defineRule({
 });
 
 // src/rules/prefer-multi-value-zod-literal.ts
-var NAME104 = "prefer-multi-value-zod-literal";
+var NAME108 = "prefer-multi-value-zod-literal";
 function isStaticPrimitive(node, sourceCode2) {
   node = unwrapExpression(node);
   if (node.type === "Literal") {
@@ -24963,7 +25242,7 @@ var prefer_multi_value_zod_literal_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Use the Zod 4 multi-value literal API instead of a union of literal schemas.",
-      url: docsUrl(NAME104)
+      url: docsUrl(NAME108)
     },
     schema: [
       {
@@ -25126,7 +25405,7 @@ function closedType(node) {
 }
 
 // src/rules/prefer-named-callback-domain.ts
-var NAME105 = "prefer-named-callback-domain";
+var NAME109 = "prefer-named-callback-domain";
 function isLiteralUnion(node) {
   return node.type === "TSUnionType" && node.types.length >= 2 && node.types.every((part) => part.type === "TSLiteralType");
 }
@@ -25146,7 +25425,7 @@ var prefer_named_callback_domain_default = defineRule({
     fixable: "code",
     docs: {
       description: "Name literal-union domains used by callbacks in exported contracts.",
-      url: docsUrl(NAME105)
+      url: docsUrl(NAME109)
     },
     schema: [],
     messages: {
@@ -25185,7 +25464,7 @@ var prefer_named_callback_domain_default = defineRule({
 });
 
 // src/rules/prefer-named-complex-return-type.ts
-var NAME106 = "prefer-named-complex-return-type";
+var NAME110 = "prefer-named-complex-return-type";
 function unwrap5(node) {
   if (node.type === "TSTypeReference" && node.typeArguments?.params.length === 1) {
     const [inner] = node.typeArguments.params;
@@ -25223,7 +25502,7 @@ var prefer_named_complex_return_type_default = defineRule({
     fixable: "code",
     docs: {
       description: "Prefer a named contract for structurally complex function return types.",
-      url: docsUrl(NAME106)
+      url: docsUrl(NAME110)
     },
     schema: [],
     messages: {
@@ -25246,14 +25525,14 @@ var prefer_named_complex_return_type_default = defineRule({
 });
 
 // src/rules/prefer-native-fetch-in-server-actions.ts
-var NAME107 = "prefer-native-fetch-in-server-actions";
+var NAME111 = "prefer-native-fetch-in-server-actions";
 var KY_MODULE = /^ky(?:\/.*)?$/u;
 var prefer_native_fetch_in_server_actions_default = defineRule({
   meta: {
     type: "problem",
     docs: {
       description: "Server action modules should call native fetch instead of importing ky.",
-      url: docsUrl(NAME107)
+      url: docsUrl(NAME111)
     },
     schema: [],
     defaultOptions: [],
@@ -25289,7 +25568,7 @@ function isTypeOnly(node) {
 }
 
 // src/rules/prefer-native-random-uuid.ts
-var NAME108 = "prefer-native-random-uuid";
+var NAME112 = "prefer-native-random-uuid";
 function requireUuidCallee(node) {
   return node?.type === "CallExpression" && node.callee.type === "Identifier" && node.callee.name === "require" && node.arguments.length === 1 && node.arguments[0]?.type === "Literal" && node.arguments[0].value === "uuid" ? node.callee : null;
 }
@@ -25302,7 +25581,7 @@ var prefer_native_random_uuid_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Prefer `globalThis.crypto.randomUUID()` over resolved zero-argument UUID v4 bindings from the `uuid` package.",
-      url: docsUrl(NAME108)
+      url: docsUrl(NAME112)
     },
     hasSuggestions: true,
     fixable: "code",
@@ -25390,7 +25669,7 @@ var prefer_native_random_uuid_default = defineRule({
 });
 
 // src/rules/prefer-node-crypto-hash.ts
-var NAME109 = "prefer-node-crypto-hash";
+var NAME113 = "prefer-node-crypto-hash";
 var UNSAFE_NAMESPACE_METHODS = /* @__PURE__ */ new Set(["__defineGetter__", "__defineSetter__", "valueOf"]);
 var UNSAFE_AUTHORITY_IDENTIFIERS = [
   "eval",
@@ -25494,7 +25773,7 @@ var prefer_node_crypto_hash_default = defineRule({
     fixable: "code",
     docs: {
       description: "Prefer the modern one-shot node:crypto hash API when streaming state is unnecessary.",
-      url: docsUrl(NAME109)
+      url: docsUrl(NAME113)
     },
     schema: [],
     messages: { preferNodeCryptoHash: "Prefer the modern one-shot node:crypto hash API when streaming state is unnecessary." }
@@ -25724,7 +26003,7 @@ function hasRetainedFactoryCall(binding3, removed) {
 }
 
 // src/rules/prefer-node-fs-promises.ts
-var NAME110 = "prefer-node-fs-promises";
+var NAME114 = "prefer-node-fs-promises";
 function memberName3(node) {
   if (!node.computed && node.property.type === "Identifier") return node.property.name;
   if (node.computed && node.property.type === "Literal" && typeof node.property.value === "string") {
@@ -25757,7 +26036,7 @@ var prefer_node_fs_promises_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Prefer promise-based Node.js filesystem APIs over synchronous calls in production modules.",
-      url: docsUrl(NAME110)
+      url: docsUrl(NAME114)
     },
     schema: [],
     messages: {
@@ -25900,7 +26179,7 @@ function sameTypeBinding(sourceCode2, alias, annotation, parameter) {
 }
 
 // src/rules/prefer-nominal-id-types.ts
-var NAME111 = "prefer-nominal-id-types";
+var NAME115 = "prefer-nominal-id-types";
 var OPERATIONAL_ROLES = /* @__PURE__ */ new Set([
   "request",
   "trace",
@@ -26016,7 +26295,7 @@ var prefer_nominal_id_types_default = defineRule({
     fixable: "code",
     docs: {
       description: "Distinguish identifier roles sharing primitive types at callable boundaries.",
-      url: docsUrl(NAME111)
+      url: docsUrl(NAME115)
     },
     schema: [],
     messages: {
@@ -26045,7 +26324,7 @@ var prefer_nominal_id_types_default = defineRule({
 });
 
 // src/rules/prefer-non-nullable-collection.ts
-var NAME112 = "prefer-non-nullable-collection";
+var NAME116 = "prefer-non-nullable-collection";
 var ARRAY_TYPE_NAMES2 = /* @__PURE__ */ new Set(["Array", "ReadonlyArray"]);
 var NULL_GUARD_OPERATORS = /* @__PURE__ */ new Set(["==", "==="]);
 var EMPTY_GUARD_OPERATORS = /* @__PURE__ */ new Set(["==", "===", "<="]);
@@ -26400,7 +26679,7 @@ var prefer_non_nullable_collection_default = defineRule({
     fixable: "code",
     docs: {
       description: "Suggest reviewing nullish arrays that use local empty-array defaults or a shared null-or-empty guard.",
-      url: docsUrl(NAME112)
+      url: docsUrl(NAME116)
     },
     schema: [],
     messages: {
@@ -26511,7 +26790,7 @@ var prefer_non_nullable_collection_default = defineRule({
 });
 
 // src/rules/prefer-nullish-filter-predicate.ts
-var NAME113 = "prefer-nullish-filter-predicate";
+var NAME117 = "prefer-nullish-filter-predicate";
 var SUMMARY = "Prefer an explicit nullish predicate when `filter(Boolean)` removes only nullish values but does not narrow the result type.";
 function isBuiltinArrayFilter(native, symbol) {
   const kinds2 = native.ast.SyntaxKind;
@@ -26568,7 +26847,7 @@ function isLiteralValue(node) {
 var prefer_nullish_filter_predicate_default = defineRule({
   meta: {
     type: "suggestion",
-    docs: { description: SUMMARY, url: docsUrl(NAME113) },
+    docs: { description: SUMMARY, url: docsUrl(NAME117) },
     hasSuggestions: true,
     fixable: "code",
     schema: [],
@@ -26661,7 +26940,7 @@ var prefer_nullish_filter_predicate_default = defineRule({
 });
 
 // src/rules/prefer-schema-for-api-payload.ts
-var NAME114 = "prefer-schema-for-api-payload";
+var NAME118 = "prefer-schema-for-api-payload";
 var unwrap6 = (node) => {
   let current = node ?? null;
   while (current !== null && (isErasedExpression(current) || current.type === "ChainExpression")) current = current.expression;
@@ -26944,7 +27223,7 @@ var prefer_schema_for_api_payload_default = defineRule({
     type: "problem",
     docs: {
       description: "Require Zod (or similar) schema validation on `response.json()` / `JSON.parse()` results before property access.",
-      url: docsUrl(NAME114)
+      url: docsUrl(NAME118)
     },
     schema: [],
     messages: {
@@ -27127,7 +27406,7 @@ var prefer_schema_for_api_payload_default = defineRule({
 // src/rules/prefer-semantic-colors.ts
 import { existsSync as existsSync3, lstatSync, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
 import { dirname as dirname3, join as join3, parse } from "path";
-var NAME115 = "prefer-semantic-colors";
+var NAME119 = "prefer-semantic-colors";
 var COLOR_PREFIXES = "text|bg|border(?:-[trblxyse])?|ring(?:-offset)?|fill|stroke|from|via|to|divide|decoration|placeholder|accent|caret|shadow|outline";
 var PALETTE = "red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose|slate|gray|zinc|neutral|stone";
 var COLOR_FN = "rgba?|hsla?|hwb|oklch|oklab|lab|lch|color";
@@ -27459,7 +27738,7 @@ var prefer_semantic_colors_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Enforce semantic color tokens over raw Tailwind palette classes, arbitrary color values, and inline color literals.",
-      url: docsUrl(NAME115)
+      url: docsUrl(NAME119)
     },
     schema: [
       {
@@ -27646,7 +27925,7 @@ function packageWorkspaceGlobs(parsed) {
 }
 
 // src/rules/prefer-server-actions.ts
-var NAME116 = "prefer-server-actions";
+var NAME120 = "prefer-server-actions";
 var MUTATION_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "DELETE", "PATCH"]);
 var AXIOS_MUTATION_METHODS = /* @__PURE__ */ new Set(["post", "put", "delete", "patch"]);
 var SKIP_FILE_REGEX = /(?:\.test\.[jt]sx?$|\.spec\.[jt]sx?$|-(?:test|spec)\.[jt]sx?$|\/tests?\/|\/__tests__\/|\/__testfixtures__\/|\/scripts?\/|(?:^|\/)app(?:\/.*)?\/route\.[jt]sx?$|(?:^|\/)middleware\.[jt]sx?$|\/pages\/api\/)/;
@@ -27785,7 +28064,7 @@ var prefer_server_actions_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Prefer Next.js Server Actions over same-origin API mutations.",
-      url: docsUrl(NAME116)
+      url: docsUrl(NAME120)
     },
     schema: [
       {
@@ -27871,7 +28150,7 @@ var prefer_server_actions_default = defineRule({
 });
 
 // src/rules/prefer-server-data-preparation.ts
-var NAME117 = "prefer-server-data-preparation";
+var NAME121 = "prefer-server-data-preparation";
 var METHODS = /* @__PURE__ */ new Set(["map", "filter", "flatMap"]);
 var DOM_EVENTS = /* @__PURE__ */ new Set(["onClick", "onChange", "onInput", "onSubmit"]);
 var BINARY = /* @__PURE__ */ new Set(["===", "!==", "==", "!=", ">", ">=", "<", "<=", "+", "-", "*", "/", "%"]);
@@ -28003,7 +28282,7 @@ function typedProofs(native) {
 var prefer_server_data_preparation_default = defineRule({
   meta: {
     type: "suggestion",
-    docs: { description: "Prepare data-only input collections before an interactive client view when possible.", url: docsUrl(NAME117) },
+    docs: { description: "Prepare data-only input collections before an interactive client view when possible.", url: docsUrl(NAME121) },
     schema: [],
     messages: {
       prepareData: "Review preparing this prop-only collection in its producer or Server Component when the inputs are available there. Keep operations depending on unsaved edits or browser interaction reactive in the client."
@@ -28921,7 +29200,7 @@ var ParseErrorCode;
 })(ParseErrorCode || (ParseErrorCode = {}));
 
 // src/rules/prefer-shadcn-primitives.ts
-var NAME118 = "prefer-shadcn-primitives";
+var NAME122 = "prefer-shadcn-primitives";
 var RAW_PRIMITIVES = {
   button: { capability: "Button", replacement: "Button" },
   dialog: { capability: "Dialog", replacement: "Dialog or AlertDialog family" },
@@ -29130,7 +29409,7 @@ function rawElementName(node) {
   const name = node.name.name;
   return Object.hasOwn(RAW_PRIMITIVES, name) ? name : null;
 }
-function effectiveAttribute(node, attributeName) {
+function effectiveAttribute2(node, attributeName) {
   for (const attribute of node.attributes.toReversed()) {
     if (attribute.type === "JSXSpreadAttribute") {
       return { kind: "unknown" };
@@ -29173,7 +29452,7 @@ function isLabelableElement(node) {
   const name = node.openingElement.name.name;
   if (!LABELABLE_ELEMENTS.has(name)) return false;
   if (name !== "input") return true;
-  const typeAttribute = effectiveAttribute(node.openingElement, "type");
+  const typeAttribute = effectiveAttribute2(node.openingElement, "type");
   if (typeAttribute.kind === "unknown") return false;
   return !(typeAttribute.kind === "known" && typeAttribute.value.toLowerCase() === "hidden");
 }
@@ -29189,14 +29468,14 @@ function containsLabelableElement(node) {
   });
 }
 function isStaticallyAssociatedLabel(node) {
-  const htmlFor = effectiveAttribute(node, "htmlFor");
+  const htmlFor = effectiveAttribute2(node, "htmlFor");
   if (htmlFor.kind === "known" && htmlFor.value.trim().length > 0) return true;
   return node.parent.type === "JSXElement" && containsLabelableElement(node.parent);
 }
 function replacementFor2(node, element) {
-  if (element === "select" && mayHaveBooleanAttribute(node, "multiple")) return null;
+  if (element === "select" && mayHaveBooleanAttribute2(node, "multiple")) return null;
   if (element !== "input") return RAW_PRIMITIVES[element];
-  const typeAttribute = effectiveAttribute(node, "type");
+  const typeAttribute = effectiveAttribute2(node, "type");
   if (typeAttribute.kind === "unknown") return null;
   const inputType = typeAttribute.kind === "known" ? typeAttribute.value.toLowerCase() : "text";
   if (inputType === "hidden" || inputType === "file") return null;
@@ -29209,7 +29488,7 @@ function replacementFor2(node, element) {
   if (AMBIGUOUS_INPUT_TYPES.has(inputType)) return null;
   return RAW_PRIMITIVES.input;
 }
-function mayHaveBooleanAttribute(node, name) {
+function mayHaveBooleanAttribute2(node, name) {
   for (const attribute of node.attributes.toReversed()) {
     if (attribute.type === "JSXSpreadAttribute") return true;
     if (attribute.name.type !== "JSXIdentifier" || attribute.name.name !== name) continue;
@@ -29223,7 +29502,7 @@ var prefer_shadcn_primitives_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Require visible raw JSX controls to use the corresponding shared shadcn primitive.",
-      url: docsUrl(NAME118)
+      url: docsUrl(NAME122)
     },
     schema: [
       {
@@ -29271,7 +29550,7 @@ var prefer_shadcn_primitives_default = defineRule({
       JSXOpeningElement(node) {
         const element = rawElementName(node);
         if (element === null) return;
-        if (mayHaveBooleanAttribute(node, "hidden") || hasHiddenAncestor2(node)) return;
+        if (mayHaveBooleanAttribute2(node, "hidden") || hasHiddenAncestor2(node)) return;
         if (element === "label" && !isStaticallyAssociatedLabel(node)) return;
         const replacement = replacementFor2(node, element);
         if (replacement === null) return;
@@ -29296,7 +29575,7 @@ var prefer_shadcn_primitives_default = defineRule({
 });
 function hasHiddenAncestor2(node) {
   for (let ancestor = parentOf(node); ancestor !== null; ancestor = parentOf(ancestor)) {
-    if (ancestor.type === "JSXElement" && mayHaveBooleanAttribute(ancestor.openingElement, "hidden")) return true;
+    if (ancestor.type === "JSXElement" && mayHaveBooleanAttribute2(ancestor.openingElement, "hidden")) return true;
   }
   return false;
 }
@@ -29330,7 +29609,7 @@ function matchingAliasTargets(paths, alias) {
 }
 
 // src/rules/prefer-shared-zod-enum.ts
-var NAME119 = "prefer-shared-zod-enum";
+var NAME123 = "prefer-shared-zod-enum";
 function literalDomain(node) {
   if (node.arguments.length !== 1) return null;
   const first = node.arguments[0];
@@ -29369,7 +29648,7 @@ var prefer_shared_zod_enum_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Give repeated literal Zod enum domains one reusable module-level schema.",
-      url: docsUrl(NAME119)
+      url: docsUrl(NAME123)
     },
     schema: [],
     messages: {
@@ -29426,7 +29705,7 @@ var prefer_shared_zod_enum_default = defineRule({
 });
 
 // src/rules/prefer-switch-for-repeated-equality.ts
-var NAME120 = "prefer-switch-for-repeated-equality";
+var NAME124 = "prefer-switch-for-repeated-equality";
 function discriminantName(test) {
   if (test.type !== "BinaryExpression" || test.operator !== "===") return null;
   const leftIsCase = isCaseValue(test.left);
@@ -29503,7 +29782,7 @@ var prefer_switch_for_repeated_equality_default = defineRule({
     fixable: "code",
     docs: {
       description: "Prefer switch over long if/else-if chains that compare one value for strict equality.",
-      url: docsUrl(NAME120)
+      url: docsUrl(NAME124)
     },
     schema: [],
     messages: {
@@ -29553,7 +29832,7 @@ var prefer_switch_for_repeated_equality_default = defineRule({
 });
 
 // src/rules/prefer-test-fixture-reuse.ts
-var NAME121 = "prefer-test-fixture-reuse";
+var NAME125 = "prefer-test-fixture-reuse";
 var MAX_DEPTH2 = 8;
 var FRAMEWORKS = /* @__PURE__ */ new Set(["vitest", "@playwright/test"]);
 var TEST_MODIFIERS4 = /* @__PURE__ */ new Set(["only", "skip", "concurrent", "sequential"]);
@@ -29682,7 +29961,7 @@ var prefer_test_fixture_reuse_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Reuse a requested test fixture instead of constructing another instance of its class.",
-      url: docsUrl(NAME121)
+      url: docsUrl(NAME125)
     },
     schema: [],
     messages: { reuseFixture: "This class is already supplied by the requested `{{fixture}}` fixture; reuse it or request a typed factory for independent instances." }
@@ -29716,7 +29995,7 @@ var prefer_test_fixture_reuse_default = defineRule({
 });
 
 // src/rules/prefer-typed-reflection.ts
-var NAME122 = "prefer-typed-reflection";
+var NAME126 = "prefer-typed-reflection";
 function knownType(native, type) {
   if (type.isUnionType()) return type.getTypes().every((part) => knownType(native, part));
   const flags = native.sync.TypeFlags;
@@ -29746,7 +30025,7 @@ var prefer_typed_reflection_default = defineRule({
     fixable: "code",
     docs: {
       description: "Prefer typed access when Reflect.get or Reflect.apply discards a known contract.",
-      url: docsUrl(NAME122)
+      url: docsUrl(NAME126)
     },
     schema: [],
     messages: {
@@ -29912,7 +30191,7 @@ var prefer_typed_reflection_default = defineRule({
 });
 
 // src/rules/prefer-whole-object-assertion.ts
-var NAME123 = "prefer-whole-object-assertion";
+var NAME127 = "prefer-whole-object-assertion";
 var MERGEABLE_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual", "toStrictEqual"]);
 var SYNTHETIC_LITERAL_MATCHERS = /* @__PURE__ */ new Map([
   ["toBeNull", "null"]
@@ -30002,7 +30281,7 @@ var prefer_whole_object_assertion_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Collapse consecutive assertions on one object into a whole-object assertion so related mismatches are reported together.",
-      url: docsUrl(NAME123)
+      url: docsUrl(NAME127)
     },
     messages: {
       combineAssertions: "Consider combining these {{count}} assertions on `{{receiver}}` with `toMatchObject` when structural matching preserves property presence and getter or proxy behavior.",
@@ -30149,7 +30428,7 @@ var prefer_whole_object_assertion_default = defineRule({
 });
 
 // src/rules/prefer-zod-enum-validator.ts
-var NAME124 = "prefer-zod-enum-validator";
+var NAME128 = "prefer-zod-enum-validator";
 function isInput(node, name) {
   if (node == null) return false;
   const value = unwrapExpression(node);
@@ -30240,7 +30519,7 @@ var prefer_zod_enum_validator_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Express closed string validators with a reusable Zod enum schema.",
-      url: docsUrl(NAME124)
+      url: docsUrl(NAME128)
     },
     schema: [],
     messages: { useEnumSchema: "Replace this closed string validator with a named z.enum([\u2026]) schema and derive its type with z.infer. Use parse for parsing or safeParse for a boolean check; preserve intentional failure behavior." }
@@ -30268,7 +30547,7 @@ var prefer_zod_enum_validator_default = defineRule({
 });
 
 // src/rules/prefer-zod-infer.ts
-var NAME125 = "prefer-zod-infer";
+var NAME129 = "prefer-zod-infer";
 function absent(value) {
   return value === void 0 || value === null;
 }
@@ -30644,7 +30923,7 @@ var prefer_zod_infer_default = defineRule({
     fixable: "code",
     docs: {
       description: "Derive a type from its Zod schema with `z.infer` instead of hand-writing a twin declaration beside it.",
-      url: docsUrl(NAME125)
+      url: docsUrl(NAME129)
     },
     schema: [
       {
@@ -31094,7 +31373,7 @@ function returnsContract(authority, returned2) {
 }
 
 // src/rules/prefer-zod-parse-output-type.ts
-var NAME126 = "prefer-zod-parse-output-type";
+var NAME130 = "prefer-zod-parse-output-type";
 function isLocalZodObjectSchema(node, namespaces) {
   let current = node;
   while (current.type === "CallExpression") {
@@ -31240,7 +31519,7 @@ var prefer_zod_parse_output_type_default = defineRule({
     fixable: "code",
     docs: {
       description: "Consider deriving validated return contracts from the Zod schema when the schema owns the contract.",
-      url: docsUrl(NAME126)
+      url: docsUrl(NAME130)
     },
     schema: [],
     messages: {
@@ -31528,7 +31807,7 @@ var production_derived_test_cases_default = defineRule({
 });
 
 // src/rules/repeated-static-call-cases.ts
-var NAME127 = "repeated-static-call-cases";
+var NAME131 = "repeated-static-call-cases";
 var TEST_MODULES2 = /* @__PURE__ */ new Set(["@jest/globals", "@playwright/test", "bun:test", "node:test", "vitest"]);
 var TEST_NAMES3 = /* @__PURE__ */ new Set(["it", "test"]);
 var TEST_MODIFIERS5 = /* @__PURE__ */ new Set(["concurrent", "fails", "only", "sequential", "skip"]);
@@ -31652,7 +31931,7 @@ var repeated_static_call_cases_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Review three or more consecutive static-input call assertions as potential named cases.",
-      url: docsUrl(NAME127)
+      url: docsUrl(NAME131)
     },
     schema: [],
     messages: { repeatedStaticCallCases: "These {{count}} consecutive assertions repeat a call with static inputs. If independent, use named parameterized cases or subtests; preserve ordered scenarios as one test." }
@@ -31795,7 +32074,7 @@ function isPrimitiveReturn(node, annotation) {
 }
 
 // src/rules/require-assert-never.ts
-var NAME128 = "require-assert-never";
+var NAME132 = "require-assert-never";
 function isRuntimeHandlingStatement(statement) {
   if (statement.type === "EmptyStatement") return false;
   if (statement.type === "BreakStatement") return statement.label !== null;
@@ -31865,7 +32144,7 @@ var require_assert_never_default = defineRule({
     fixable: "code",
     docs: {
       description: "Require a never witness in empty switch defaults so discriminated unions remain exhaustive at compile time.",
-      url: docsUrl(NAME128)
+      url: docsUrl(NAME132)
     },
     schema: [],
     messages: {
@@ -31909,7 +32188,7 @@ var require_assert_never_default = defineRule({
 });
 
 // src/rules/require-button-accessible-name.ts
-var NAME129 = "require-button-accessible-name";
+var NAME133 = "require-button-accessible-name";
 var DELEGATING_PROPS = /* @__PURE__ */ new Set(["render", "asChild"]);
 function delegatesRendering(opening) {
   return opening.attributes.some(
@@ -31922,7 +32201,7 @@ var require_button_accessible_name_default = defineRule({
     type: "problem",
     docs: {
       description: "Require an accessible name on statically unnamed native or configured JSX buttons.",
-      url: docsUrl(NAME129)
+      url: docsUrl(NAME133)
     },
     schema: [
       {
@@ -31976,7 +32255,7 @@ var require_button_accessible_name_default = defineRule({
 });
 
 // src/rules/require-camelcase-properties.ts
-var NAME130 = "require-camelcase-properties";
+var NAME134 = "require-camelcase-properties";
 var SNAKE_CASE_RE2 = /^[a-z][a-z0-9]*(?:_[a-z0-9]+)+$/u;
 function blocksRename(member3, name) {
   if (member3.type === "TSIndexSignature" || "computed" in member3 && member3.computed) return true;
@@ -31990,7 +32269,7 @@ var require_camelcase_properties_default = defineRule({
     fixable: "code",
     docs: {
       description: "Require unquoted lower snake_case TypeScript properties and dot access to use camelCase.",
-      url: docsUrl(NAME130)
+      url: docsUrl(NAME134)
     },
     schema: [],
     defaultOptions: [],
@@ -32054,7 +32333,7 @@ var require_camelcase_properties_default = defineRule({
 });
 
 // src/rules/require-constrained-schema-integer.ts
-var NAME131 = "require-constrained-schema-integer";
+var NAME135 = "require-constrained-schema-integer";
 var FIELD_MINIMUMS = /* @__PURE__ */ new Map([["limit", 1], ["version", 0]]);
 var NUMBER_FACTORIES = /* @__PURE__ */ new Set(["number", "int", "int32", "uint32"]);
 var OBJECT_FACTORIES = /* @__PURE__ */ new Set(["object", "strictObject", "looseObject"]);
@@ -32096,7 +32375,7 @@ var require_constrained_schema_integer_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Declare integer and lower-bound validation for numeric limit and version schema fields.",
-      url: docsUrl(NAME131)
+      url: docsUrl(NAME135)
     },
     schema: [],
     messages: { constrainInteger: "Declare `{{field}}` as an integer with a lower bound of {{minimum}} or greater, or reuse its named domain schema." }
@@ -32575,14 +32854,14 @@ function closedNominalInheritanceFix(sourceCode2, file, call, consumer, implemen
 }
 
 // src/rules/require-explicit-contract-implementation.ts
-var NAME132 = "require-explicit-contract-implementation";
+var NAME136 = "require-explicit-contract-implementation";
 var require_explicit_contract_implementation_default = defineRule({
   meta: {
     type: "problem",
     fixable: "code",
     docs: {
       description: "Require nominal inheritance when an injected abstract class is rejected by an instanceof guard.",
-      url: docsUrl(NAME132)
+      url: docsUrl(NAME136)
     },
     schema: [],
     messages: {
@@ -33273,7 +33552,7 @@ function abstractContractOperations(node, functionAliases) {
 }
 
 // src/rules/require-explicit-service-contract.ts
-var NAME133 = "require-explicit-service-contract";
+var NAME137 = "require-explicit-service-contract";
 var JAVASCRIPT_FILE_RE2 = /\.(?:js|jsx|mjs|cjs)$/iu;
 var BOUNDARY_SUFFIX = /(?:Service|ServiceImpl|Store|Repository|Provider|Executor|Enqueuer|Runner|Platform|Manager|ManagerImpl|Detector|Control|Refresher|Reader|Settlement|Retry|Stop|Catalog|DAO)$/u;
 var NON_SERVICE_SUFFIX = /(?:Router|Middleware|Builder)$/u;
@@ -33289,7 +33568,7 @@ var require_explicit_service_contract_default = defineRule({
     type: "problem",
     docs: {
       description: "Require explicit contracts for classes that invoke retained collaborators.",
-      url: docsUrl(NAME133)
+      url: docsUrl(NAME137)
     },
     schema: [],
     fixable: "code",
@@ -33325,7 +33604,7 @@ var require_explicit_service_contract_default = defineRule({
 });
 
 // src/rules/require-fetch-timeout.ts
-var NAME134 = "require-fetch-timeout";
+var NAME138 = "require-fetch-timeout";
 function emptySignal(expression, resolvesToGlobal) {
   const value = unwrapExpression(expression);
   if (value.type === "Literal" && value.value === null)
@@ -33387,7 +33666,7 @@ var require_fetch_timeout_default = defineRule({
     type: "problem",
     docs: {
       description: "Require an explicit abort signal on locally analyzable global fetch calls.",
-      url: docsUrl(NAME134)
+      url: docsUrl(NAME138)
     },
     schema: [
       {
@@ -33478,8 +33757,90 @@ var require_fetch_timeout_default = defineRule({
   }
 });
 
+// src/rules/require-ime-safe-enter-handler.ts
+var NAME139 = "require-ime-safe-enter-handler";
+var require_ime_safe_enter_handler_default = defineRule({
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Preserve IME composition before Enter submits or blurs a native text control.",
+      url: docsUrl(NAME139)
+    },
+    schema: [],
+    messages: {
+      composition: "Enter also confirms IME composition. Guard composition before submitting the form or blurring this control; retain the required Safari fallback for your supported browsers."
+    }
+  },
+  createOnce(context) {
+    return {
+      before() {
+        if (isGeneratedFile({ filename: context.filename, cwd: context.cwd }, context.sourceCode.text))
+          return false;
+      },
+      JSXOpeningElement(node) {
+        if (!isEditableTextControl(node, context.sourceCode)) return;
+        if (effectiveAttribute(node, ["onCompositionStart", "onCompositionEnd"]) !== void 0)
+          return;
+        const attribute = effectiveAttribute(node, ["onKeyDown"]);
+        if (attribute?.type !== "JSXAttribute" || attribute.value?.type !== "JSXExpressionContainer")
+          return;
+        const callback = unwrapExpression(attribute.value.expression);
+        if (callback.type !== "ArrowFunctionExpression" && callback.type !== "FunctionExpression")
+          return;
+        const [event] = callback.params;
+        if (event?.type !== "Identifier" || callback.body === null) return;
+        const binding3 = findVariable(context.sourceCode.getScope(callback.body), event.name);
+        if (binding3 === null || binding3.references.some((reference) => reference.isWrite())) return;
+        const matches = (identifier) => findVariable(context.sourceCode.getScope(identifier), identifier.name) === binding3;
+        if (contains2(callback.body, (part) => isGuard(part, matches))) return;
+        if (contains2(
+          callback.body,
+          (part) => part.type === "IfStatement" && positiveEnterGate(part.test, matches) && contains2(part.consequent, (action) => nativeAction(action, matches))
+        )) {
+          context.report({ node: attribute, messageId: "composition" });
+        }
+      }
+    };
+  }
+});
+function contains2(node, predicate) {
+  if (["FunctionExpression", "ArrowFunctionExpression", "FunctionDeclaration"].includes(node.type))
+    return false;
+  return predicate(node) || forEachOwnAstChild(node, (child) => contains2(child, predicate));
+}
+function eventMember(node, event, property) {
+  const value = unwrapExpression(node);
+  return value.type === "MemberExpression" && getPropertyName(value) === property && value.object.type === "Identifier" && event(value.object);
+}
+function isGuard(node, event) {
+  if (node.type !== "MemberExpression") return false;
+  const property = getPropertyName(node);
+  if (!["isComposing", "keyCode", "ctrlKey", "metaKey"].includes(property ?? "")) return false;
+  return node.object.type === "Identifier" && event(node.object) || eventMember(node.object, event, "nativeEvent");
+}
+function positiveEnterGate(node, event) {
+  const test = unwrapExpression(node);
+  if (isEnter(test, event)) return true;
+  if (test.type !== "LogicalExpression" || test.operator !== "&&") return false;
+  const unshifted = (part) => part.type === "UnaryExpression" && part.operator === "!" && eventMember(part.argument, event, "shiftKey");
+  return isEnter(test.left, event) && unshifted(test.right) || isEnter(test.right, event) && unshifted(test.left);
+}
+function isEnter(node, event) {
+  if (node.type !== "BinaryExpression" || !["===", "=="].includes(node.operator)) return false;
+  return eventMember(node.left, event, "key") && node.right.type === "Literal" && node.right.value === "Enter" || eventMember(node.right, event, "key") && node.left.type === "Literal" && node.left.value === "Enter";
+}
+function nativeAction(node, event) {
+  if (node.type !== "CallExpression") return false;
+  const callee = unwrapExpression(node.callee);
+  if (callee.type !== "MemberExpression") return false;
+  const property = getPropertyName(callee);
+  if (property === "blur") return eventMember(callee.object, event, "currentTarget");
+  const form = unwrapExpression(callee.object);
+  return property === "requestSubmit" && form.type === "MemberExpression" && getPropertyName(form) === "form" && eventMember(form.object, event, "currentTarget");
+}
+
 // src/rules/require-interface-for-exported-class.ts
-var NAME135 = "require-interface-for-exported-class";
+var NAME140 = "require-interface-for-exported-class";
 var JAVASCRIPT_FILE_RE3 = /\.(?:js|jsx|mjs|cjs)$/iu;
 function isPublicInstanceMember2(member3) {
   return !member3.static && member3.accessibility !== "private" && member3.accessibility !== "protected" && member3.key.type !== "PrivateIdentifier";
@@ -33540,7 +33901,7 @@ var require_interface_for_exported_class_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Require exported concrete classes with public behavior to declare a contract.",
-      url: docsUrl(NAME135)
+      url: docsUrl(NAME140)
     },
     schema: [],
     fixable: "code",
@@ -33582,7 +33943,7 @@ var require_interface_for_exported_class_default = defineRule({
 });
 
 // src/rules/require-jwt-lifetime.ts
-var NAME136 = "require-jwt-lifetime";
+var NAME141 = "require-jwt-lifetime";
 function isJoseValueImport(declaration) {
   return declaration.type === "ImportDeclaration" && declaration.importKind !== "type" && declaration.source.value === "jose";
 }
@@ -33591,7 +33952,7 @@ var require_jwt_lifetime_default = defineRule({
     type: "problem",
     docs: {
       description: "Require an expiration claim or a maximum token age when returning a verified JWT.",
-      url: docsUrl(NAME136)
+      url: docsUrl(NAME141)
     },
     schema: [],
     messages: { lifetime: "Require the JWT exp claim or set maxTokenAge before returning this verification result." }
@@ -33650,7 +34011,7 @@ var require_jwt_lifetime_default = defineRule({
 });
 
 // src/rules/require-pascal-case-zod-schema-name.ts
-var NAME137 = "require-pascal-case-zod-schema-name";
+var NAME142 = "require-pascal-case-zod-schema-name";
 var PASCAL_SCHEMA_NAME_RE = /^[A-Z][A-Za-z0-9]*Schema$/;
 var BENCHMARK_PATH_RE2 = /(^|[\\/])(?:benchmarks?|bench)[\\/]/;
 var NON_SCHEMA_TERMINALS2 = /* @__PURE__ */ new Set([
@@ -33821,7 +34182,7 @@ var require_pascal_case_zod_schema_name_default = defineRule({
     fixable: "code",
     docs: {
       description: "Require confirmed module-level Zod schema contracts to use PascalCase with a `Schema` suffix.",
-      url: docsUrl(NAME137)
+      url: docsUrl(NAME142)
     },
     schema: [],
     defaultOptions: [],
@@ -33931,7 +34292,7 @@ var require_pascal_case_zod_schema_name_default = defineRule({
 });
 
 // src/rules/require-port-for-service.ts
-var NAME138 = "require-port-for-service";
+var NAME143 = "require-port-for-service";
 var HTTP_TRANSPORT_TYPE_RE = /^(?:KyInstance|AxiosInstance|Session)$/;
 var TRANSPORT_WRAPPER_NAME_RE = /(?:Client$|^Http[A-Z])/;
 var ERROR_VALUE_NAME_RE = /Error$/;
@@ -34065,7 +34426,7 @@ var require_port_for_service_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Advise when an exported service with injected collaborators has public methods not covered by its declared ports.",
-      url: docsUrl(NAME138)
+      url: docsUrl(NAME143)
     },
     schema: [],
     fixable: "code",
@@ -34105,7 +34466,7 @@ var require_port_for_service_default = defineRule({
 });
 
 // src/rules/require-sql-access-class.ts
-var NAME139 = "require-sql-access-class";
+var NAME144 = "require-sql-access-class";
 var DIRECT_EXECUTION_METHODS = /* @__PURE__ */ new Set([
   "all",
   "batch",
@@ -34303,7 +34664,7 @@ var require_sql_access_class_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Keep SQL reads and writes inside a class that receives its database dependency.",
-      url: docsUrl(NAME139)
+      url: docsUrl(NAME144)
     },
     schema: [],
     messages: {
@@ -34375,7 +34736,7 @@ function staticMatcherFix(sourceCode2, property) {
 }
 
 // src/rules/require-static-next-matcher.ts
-var NAME140 = "require-static-next-matcher";
+var NAME145 = "require-static-next-matcher";
 var NEXT_ENTRY_FILE = /(?:^|[/\\])(?:middleware|proxy)\.[cm]?[jt]sx?$/u;
 function isStaticValue(node) {
   const value = unwrapExpression(node);
@@ -34407,7 +34768,7 @@ var require_static_next_matcher_default = defineRule({
     fixable: "code",
     docs: {
       description: "Require Next.js middleware and proxy matcher configuration to contain only build-time literals.",
-      url: docsUrl(NAME140)
+      url: docsUrl(NAME145)
     },
     schema: [],
     messages: {
@@ -34451,7 +34812,7 @@ var require_static_next_matcher_default = defineRule({
 });
 
 // src/rules/require-svg-accessible-name.ts
-var NAME141 = "require-svg-accessible-name";
+var NAME146 = "require-svg-accessible-name";
 var DECORATIVE_ROLES = /* @__PURE__ */ new Set(["none", "presentation"]);
 var NAME_ATTRIBUTES = ["aria-label", "aria-labelledby"];
 var NO_ICON_MODULES = [];
@@ -34460,7 +34821,7 @@ var require_svg_accessible_name_default = defineRule({
     type: "problem",
     docs: {
       description: "Require a name or explicit decorative semantics on inline SVG elements.",
-      url: docsUrl(NAME141)
+      url: docsUrl(NAME146)
     },
     schema: [],
     messages: {
@@ -34492,7 +34853,7 @@ var require_svg_accessible_name_default = defineRule({
 });
 
 // src/rules/require-use-form-default-values.ts
-var NAME142 = "require-use-form-default-values";
+var NAME147 = "require-use-form-default-values";
 var UNSAFE_FORM_MEMBERS = /* @__PURE__ */ new Set(["__defineGetter__", "__defineSetter__", "__proto__", "valueOf"]);
 function staticPropertyName2(property) {
   return property.computed ? null : getPropertyName(property);
@@ -34535,7 +34896,7 @@ var require_use_form_default_values_default = defineRule({
     type: "problem",
     docs: {
       description: "Require explicit form-level initialization or a field default for directly bound Controller fields.",
-      url: docsUrl(NAME142)
+      url: docsUrl(NAME147)
     },
     schema: [],
     messages: { requireUseFormDefaultValues: "Add non-undefined defaultValues/values to the associated useForm call or non-undefined defaultValue to this field." }
@@ -34674,7 +35035,7 @@ var require_use_form_default_values_default = defineRule({
 });
 
 // src/rules/require-use-server-in-actions-file.ts
-var NAME143 = "require-use-server-in-actions-file";
+var NAME148 = "require-use-server-in-actions-file";
 var ACTION_MODULE_RE = /(?:^|\/)app\/.*\/(?:actions|[^/]+-actions)\.[cm]?[jt]s$/u;
 function isUseServerDirective2(statement) {
   return statement.type === "ExpressionStatement" && statement.directive === "use server";
@@ -34695,7 +35056,7 @@ var require_use_server_in_actions_file_default = defineRule({
     type: "problem",
     docs: {
       description: "route action module missing the use server directive",
-      url: docsUrl(NAME143)
+      url: docsUrl(NAME148)
     },
     schema: [],
     messages: {
@@ -34721,7 +35082,7 @@ var require_use_server_in_actions_file_default = defineRule({
 });
 
 // src/rules/require-zod-form-validation.ts
-var NAME144 = "require-zod-form-validation";
+var NAME149 = "require-zod-form-validation";
 var ZOD_PARSE_METHODS = /* @__PURE__ */ new Set([
   "parse",
   "safeParse",
@@ -34780,7 +35141,7 @@ var require_zod_form_validation_default = defineRule({
     type: "problem",
     docs: {
       description: "Require Zod validation (`Schema.parse(...)` / `Schema.safeParse(...)`) when reading values out of a `FormData` object.",
-      url: docsUrl(NAME144)
+      url: docsUrl(NAME149)
     },
     schema: [],
     messages: {
@@ -35068,7 +35429,7 @@ function declaresFramework(metadata, name) {
 }
 
 // src/rules/sole-export-matches-filename.ts
-var NAME145 = "sole-export-matches-filename";
+var NAME150 = "sole-export-matches-filename";
 var EXCLUDED_STEMS = /* @__PURE__ */ new Set(["global", "index", "types"]);
 function stem3(filename) {
   const base = filename.replaceAll("\\", "/").split("/").at(-1) ?? "";
@@ -35082,7 +35443,7 @@ var sole_export_matches_filename_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Make a module filename reflect its sole named public runtime export.",
-      url: docsUrl(NAME145)
+      url: docsUrl(NAME150)
     },
     schema: [],
     messages: {
@@ -35825,7 +36186,7 @@ var stepdown_default = defineRule({
 });
 
 // src/rules/store-insert-requires-on-conflict.ts
-var NAME146 = "store-insert-requires-on-conflict";
+var NAME151 = "store-insert-requires-on-conflict";
 var INSERT_WRITE = /\bINSERT\s+(?:OR\s+\w+\s+)?INTO\s+[\w."'`?$:@-]+\s*(?:\([^)]*\)\s*)?(?:VALUES|SELECT|DEFAULT\s+VALUES)\b/i;
 var CONFLICT_HANDLED = /\bON\s+CONFLICT\b|\bON\s+DUPLICATE\s+KEY\b|\bINSERT\s+OR\s+(?:IGNORE|REPLACE)\b|\bINSERT\b[\s\S]*?\bSELECT\b[\s\S]*?\bWHERE\s+NOT\s+EXISTS\b/i;
 var REPLAY_CONTRACT_NAME = /(?:enqueue|ensure|migrate|recordOnce|schedule|seed|upsert|getOrCreate|createIfAbsent|insertIfAbsent)/i;
@@ -35854,7 +36215,7 @@ var store_insert_requires_on_conflict_default = defineRule({
     type: "problem",
     docs: {
       description: "Review conflict handling for embedded inserts in replay-named callables.",
-      url: docsUrl(NAME146)
+      url: docsUrl(NAME151)
     },
     schema: [],
     messages: {
@@ -35879,7 +36240,7 @@ var store_insert_requires_on_conflict_default = defineRule({
 });
 
 // src/rules/test-loops-over-literal-cases.ts
-var NAME147 = "test-loops-over-literal-cases";
+var NAME152 = "test-loops-over-literal-cases";
 var TEST_CALLERS3 = /* @__PURE__ */ new Set(["it", "test"]);
 var TEST_MODIFIERS6 = /* @__PURE__ */ new Set(["concurrent", "fails", "only", "sequential", "skip"]);
 var ASSERTION_ROOTS = /* @__PURE__ */ new Set([
@@ -35975,7 +36336,7 @@ var test_loops_over_literal_cases_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Disallow assertions over an inline literal case loop in a test; parameterization reports and names every case independently.",
-      url: docsUrl(NAME147)
+      url: docsUrl(NAME152)
     },
     schema: [],
     messages: {
@@ -36039,7 +36400,7 @@ var test_loops_over_literal_cases_default = defineRule({
 });
 
 // src/rules/test-phase-label-comment.ts
-var NAME148 = "test-phase-label-comment";
+var NAME153 = "test-phase-label-comment";
 var PHASE_WORD = String.raw`arrange|act|assert(?:ion)?s?|given|when|then|exercise|execute|verif(?:y|ication)|cleanup|prepare|sanity(?:\s+check)?`;
 var PHASE_RE = new RegExp(
   String.raw`^[-=~*_#.\s]{0,40}(?:${PHASE_WORD})(?:\s*(?:[/&+,|]|->|and)\s*(?:${PHASE_WORD}))*[-=~*_#.\s:;!–—]{0,40}$`,
@@ -36067,7 +36428,7 @@ var test_phase_label_comment_default = defineRule({
     fixable: "code",
     docs: {
       description: "Tests must not use bare Arrange, Act, Assert, Given, When, or Then phase comments.",
-      url: docsUrl(NAME148)
+      url: docsUrl(NAME153)
     },
     schema: [],
     messages: { removeLabel: "Bare test phase label \u2014 delete it and let the test names and helpers carry the structure." }
@@ -36120,6 +36481,7 @@ var RULES = {
   "named-child-schema-type": named_child_schema_type_default,
   "no-bare-return-from-test-catch": no_bare_return_from_test_catch_default,
   "no-bespoke-api-case-conversion": no_bespoke_api_case_conversion_default,
+  "no-blocked-input-paste": no_blocked_input_paste_default,
   "no-boolean-selector-parameter": no_boolean_selector_parameter_default,
   "no-broad-return-type": no_broad_return_type_default,
   "no-client-side-data-fetching": no_client_side_data_fetching_default,
@@ -36153,6 +36515,7 @@ var RULES = {
   "no-in-operator-on-built-in-collections": no_in_operator_on_built_in_collections_default,
   "no-insecure-random-id": no_insecure_random_id_default,
   "no-invalid-typed-mutation": no_invalid_typed_mutation_default,
+  "no-invalid-web-resource-hints": no_invalid_web_resource_hints_default,
   "no-invalid-zod-custom-parse": no_invalid_zod_custom_parse_default,
   "no-json-stringify-error": no_json_stringify_error_default,
   "no-json-stringify-object-equality": no_json_stringify_object_equality_default,
@@ -36160,6 +36523,7 @@ var RULES = {
   "no-log-only-catch": no_log_only_catch_default,
   "no-logical-or-fallback": no_logical_or_fallback_default,
   "no-long-comment": no_long_comment_default,
+  "no-message-origin-string-matching": no_message_origin_string_matching_default,
   "no-mutating-container-transform": no_mutating_container_transform_default,
   "no-mutating-input-with-result": no_mutating_input_with_result_default,
   "no-negative-only-http-status-assertion": no_negative_only_http_status_assertion_default,
@@ -36167,6 +36531,7 @@ var RULES = {
   "no-offset-pagination": no_offset_pagination_default,
   "no-oxlint-directive": no_oxlint_directive_default,
   "no-partial-type-predicate": no_partial_type_predicate_default,
+  "no-password-get-form": no_password_get_form_default,
   "no-positional-tuple-return": no_positional_tuple_return_default,
   "no-production-browser-source-maps": no_production_browser_source_maps_default,
   "no-raw-env": no_raw_env_default,
@@ -36254,6 +36619,7 @@ var RULES = {
   "require-explicit-contract-implementation": require_explicit_contract_implementation_default,
   "require-explicit-service-contract": require_explicit_service_contract_default,
   "require-fetch-timeout": require_fetch_timeout_default,
+  "require-ime-safe-enter-handler": require_ime_safe_enter_handler_default,
   "require-interface-for-exported-class": require_interface_for_exported_class_default,
   "require-jwt-lifetime": require_jwt_lifetime_default,
   "require-pascal-case-zod-schema-name": require_pascal_case_zod_schema_name_default,
@@ -36266,7 +36632,7 @@ var RULES = {
   "require-zod-form-validation": require_zod_form_validation_default,
   "sole-export-matches-filename": sole_export_matches_filename_default,
   "source-coupled-test": source_coupled_test_default,
-  "stepdown": stepdown_default,
+  stepdown: stepdown_default,
   "store-insert-requires-on-conflict": store_insert_requires_on_conflict_default,
   "test-loops-over-literal-cases": test_loops_over_literal_cases_default,
   "test-phase-label-comment": test_phase_label_comment_default