@sarj/eslint-plugin 19.16.0 → 19.18.0

package/dist/catalog.js

@@ -2,7 +2,7 @@ import {
   publicDocumentation,
   ruleSpec,
   src_default
-} from "./chunk-F6SYEJAW.js";
+} from "./chunk-E2O4LN7G.js";
 
 // src/docs/directive-disable-enable-pair.ts
 var DIRECTIVE_DISABLE_ENABLE_PAIR_DOCUMENTATION = {
@@ -636,6 +636,56 @@ var NO_BESPOKE_API_CASE_CONVERSION_DOCUMENTATION = {
   ]
 };
 
+// src/docs/no-blocked-input-paste.ts
+var NO_BLOCKED_INPUT_PASTE_DOCUMENTATION = {
+  defaultLevel: "warning",
+  summary: "Allow clipboard input when a text control has no replacement paste handling.",
+  rationale: "An editable text control that only cancels paste prevents users from entering generated passwords, authentication codes and copied data. This creates avoidable accessibility and password-manager barriers.",
+  remediation: "Allow native paste. If the product must normalize clipboard content, provide explicit replacement processing and preserve keyboard and password-manager access; review the behavior instead of applying an automatic edit.",
+  category: "correctness",
+  requiresTypeInformation: false,
+  limitations: [
+    "An unresolved alternate paste phase or spread may supply replacement handling and suppresses the warning.",
+    "Only intrinsic editable input and textarea handlers whose complete inline body is a direct preventDefault() call are reported.",
+    "Clipboard processing, conditional cancellation, referenced handlers, rich editors, non-text inputs, custom components, optional calls and uncertain effective props remain outside the detector."
+  ],
+  references: [
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/forms/forms.md",
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/forms/autofill-sign-in-form.md",
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/forms/sms-otp-form.md"
+  ],
+  examples: [
+    {
+      id: "native-paste",
+      title: "Allow native clipboard input",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<input type="password" />'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "pure-paste-blocker",
+      title: "Review unconditional paste cancellation",
+      outcome: "match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<input type="password" onPaste={event => event.preventDefault()} />'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+
 // src/docs/no-boolean-selector-parameter.ts
 var NO_BOOLEAN_SELECTOR_PARAMETER_DOCUMENTATION = {
   summary: "Prefer intention-revealing operations over a boolean parameter selecting between actions.",
@@ -1918,6 +1968,88 @@ var NO_INVALID_TYPED_MUTATION_DOCUMENTATION = {
   ]
 };
 
+// src/docs/no-invalid-web-resource-hints.ts
+var NO_INVALID_WEB_RESOURCE_HINTS_DOCUMENTATION = {
+  defaultLevel: "warning",
+  summary: "Keep native resource hints consistent with browser loading and preload request modes.",
+  rationale: "Lazy loading delays even explicitly high-priority images until layout. Font preloads with incompatible credentials modes cannot satisfy the subsequent font request. The unsupported loading=auto value and obsolete importance attribute do not express supported native loading behavior. Oxlint 1.91 still accepts importance, so this advisory fills that verified upstream gap.",
+  remediation: "Review whether the image is critical or offscreen, use the matching loading policy, specify the preload destination, and use anonymous CORS for font preloads. Do not change request behavior automatically.",
+  category: "performance",
+  requiresTypeInformation: false,
+  limitations: [
+    "Only intrinsic JSX img, iframe, video, audio, script and link attributes are inspected. Custom framework media components, HTML strings and DOM mutations are outside this rule.",
+    "Stable local string bindings are resolved. Later unknown spreads and dynamic values remain unproven; explicit attributes after spreads can establish a finding.",
+    "The rule does not infer which element is LCP, count page-wide priority hints, require image dimensions that may come from CSS, or require sizes when 100vw may be correct."
+  ],
+  references: [
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/performance/optimize-image-priority.md",
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/performance/optimize-preload-priority.md",
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/performance/optimize-script-priority.md"
+  ],
+  examples: [
+    {
+      id: "eager-critical-image",
+      scenarioId: "image-loading",
+      title: "Load a declared critical image eagerly",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<img loading="eager" fetchPriority="high" />'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "lazy-critical-image",
+      scenarioId: "image-loading",
+      title: "Review conflicting image hints",
+      outcome: "match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<img loading="lazy" fetchPriority="high" />'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 1,
+      public: true
+    },
+    {
+      id: "anonymous-font-preload",
+      scenarioId: "font-preload",
+      title: "Match the font request mode",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<link rel="preload" as="font" href="/font.woff2" crossOrigin="anonymous" />'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "font-preload-without-cors",
+      scenarioId: "font-preload",
+      title: "Review a non-reusable font preload",
+      outcome: "match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<link rel="preload" as="font" href="/font.woff2" />'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+
 // src/docs/no-invalid-zod-custom-parse.ts
 var NO_INVALID_ZOD_CUSTOM_PARSE_DOCUMENTATION = {
   summary: "Do not parse an incompatible primitive literal through an unvalidated Zod custom schema.",
@@ -2179,6 +2311,55 @@ export function PortBars() { return null; }`
   ]
 };
 
+// src/docs/no-message-origin-string-matching.ts
+var NO_MESSAGE_ORIGIN_STRING_MATCHING_DOCUMENTATION = {
+  defaultLevel: "warning",
+  summary: "Compare incoming browser message origins against exact trusted origins.",
+  rationale: "Prefix, suffix and substring checks do not establish an origin trust boundary. For example, https://trusted.example.attacker.invalid passes a prefix check against https://trusted.example.",
+  remediation: "Compare exact allowlisted origins or parse the origin and validate the intended scheme, host and port. Reject opaque null origins unless a separately verified source/capability contract establishes trust; do not require an experimental Origin API.",
+  category: "security",
+  requiresTypeInformation: false,
+  limitations: [
+    "Only inline callbacks registered for message on ambient addEventListener, window, self or globalThis are tracked by variable identity.",
+    "Named listeners, event aliases, transformed origin strings, regular expressions and cross-file authorization helpers are not followed. Ordinary object.origin strings and shadowed globals are preserved.",
+    "This detects imprecise incoming origin matching, not all missing authorization checks. Outgoing target origins remain owned by Unicorn's require-post-message-target-origin rule."
+  ],
+  references: [
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/security/validate-origins.md",
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/security/security.md"
+  ],
+  examples: [
+    {
+      id: "exact-origin",
+      title: "Compare an explicit trusted origin",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/listener.ts",
+          source: 'window.addEventListener("message", event => { if (event.origin === "https://trusted.example") accept(event.data); });'
+        }
+      ],
+      focusPath: "src/listener.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "prefix-origin",
+      title: "Review a spoofable origin prefix",
+      outcome: "match",
+      files: [
+        {
+          path: "src/listener.ts",
+          source: 'window.addEventListener("message", event => { if (event.origin.startsWith("https://trusted.example")) accept(event.data); });'
+        }
+      ],
+      focusPath: "src/listener.ts",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+
 // src/docs/no-mutating-container-transform.ts
 var NO_MUTATING_CONTAINER_TRANSFORM_DOCUMENTATION = {
   defaultLevel: "warning",
@@ -2382,6 +2563,55 @@ var NO_PARTIAL_TYPE_PREDICATE_DOCUMENTATION = {
   ]
 };
 
+// src/docs/no-password-get-form.ts
+var NO_PASSWORD_GET_FORM_DOCUMENTATION = {
+  defaultLevel: "warning",
+  summary: "Keep named password controls out of native GET form submissions.",
+  rationale: "Native GET submission serializes enabled, named password controls into the URL, exposing credentials through browser history and request logs. GET is also the default for missing or invalid method attributes.",
+  remediation: "Review the destination endpoint and submit credentials with POST. Keep server-side validation, HTTPS and the appropriate anti-CSRF protections; this rule only checks the native form serialization boundary.",
+  category: "security",
+  requiresTypeInformation: false,
+  limitations: [
+    "Only native form elements and direct intrinsic/fragment descendants are proved. Custom components, expressions, external form ownership, disabled fieldsets and unknown spreads are preserved.",
+    "Forms with custom submission handlers, function or dynamic actions, or dynamic methods are left to review. React function actions submit using POST even when the method is omitted.",
+    "Unnamed, empty-name and disabled password controls are not successful controls. The detector reports once per offending form and does not infer sensitive data from field names."
+  ],
+  references: [
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/forms/forms.md",
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/forms/autofill-sign-in-form.md"
+  ],
+  examples: [
+    {
+      id: "post-password",
+      title: "Submit the password with POST",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<form method="post"><input type="password" name="password" /></form>'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "default-get-password",
+      title: "Review password serialization into the URL",
+      outcome: "match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<form><input type="password" name="password" /></form>'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+
 // src/docs/no-positional-tuple-return.ts
 var NO_POSITIONAL_TUPLE_RETURN_DOCUMENTATION = {
   summary: "Disallow returning a multi-field tuple from a named function; return a named object so call sites cannot mismatch slots.",
@@ -4888,11 +5118,13 @@ var PREFER_DISCRIMINATED_UNION_DOCUMENTATION = {
   summary: "Preserve producer-proven tag/payload and Boolean state relationships in return types.",
   defaultLevel: "warning",
   rationale: "A flat object with optional branch data loses the relationship between a tag and its payload. Callers cannot narrow to the required fields, and the type permits incomplete or contradictory combinations.",
-  remediation: "If the variants are mutually exclusive, represent each with a literal tag and its required payload. Preserve shared fields on every member, including payload value types and nullability. For a producer returning a subset of a broader wire contract, give the producer a precise domain return type after validation.",
+  remediation: "If the variants are mutually exclusive, represent each with a literal tag and its required payload. For predicates over one current state, consider returning that authoritative state instead of storing multiple derived flags. Preserve every valid state, independent dimension, shared field, payload value type and nullability. For a producer returning a subset of a broader wire contract, give the producer a precise domain return type after validation.",
   category: "correctness",
   autofix: "safe",
   limitations: [
-    "Names, Boolean counts and optional-field counts never establish a finding. A producer's literal writes establish either tag-specific payload presence or a pair of required Boolean fields with two or three distinct combinations, with both fields varying. Boolean members may use boolean, true | false or one unmerged nongeneric local alias of either. All four combinations, constant dimensions, optional/unknown dimensions and expression-valued flags are excluded. At most eight Boolean fields are compared. Only one relationship is reported per contract; payload evidence takes precedence. Independently nullable payloads do not erase Boolean evidence.",
+    "Names, Boolean counts and optional-field counts never establish a finding. A producer's literal writes establish either tag-specific payload presence or a pair of required Boolean fields with two or three distinct combinations, with both fields varying. Boolean members may use boolean, true | false or one unmerged nongeneric local alias of either. All four combinations, constant dimensions and optional/unknown dimensions are excluded. Expression-valued flags require the separate typed evidence described below. At most eight Boolean fields are compared. Only one relationship is reported per contract; existing literal/payload evidence takes precedence. Independently nullable payloads do not erase Boolean evidence.",
+    "With type services enabled, a synchronous nongeneric producer with exactly one own return, a final direct object return and a supported flat local contract also exposes strict equality predicates over the same earlier local const binding. Native types at both reads must be finite domains of at most sixteen string/number literals containing both distinct singleton comparison values. Literal constants and direct named-import/local enum members are supported; enum declarations and members are resolved by symbol identity and raw runtime literal values, including renamed imports and reexports. At most 128 candidate pairs per file are analyzed; exceeding the bound abstains from all typed findings in that file. No automatic fix is offered for these projections.",
+    "The const snapshot may be destructured or copied from another primitive binding, passed to callbacks, or read by closures without losing its value. Mutable bindings, parameters and module captures, property reads/getters, open/nullable/object/symbol domains, async producers, multiple own returns, generic/inherited/imported contracts and dynamic eval abstain. Nested callback returns do not belong to the producer. Enum namespace writes, aliases, escapes, computed accesses, calls and merged declarations in the analyzed file abstain. Cross-file enum declarations can supply type/constant identity; external mutation, dishonest declarations/assertions and runtime monkeypatching are not modeled. The analysis proves a relationship under those type and mutation assumptions, not domain intent or a whole-program ownership guarantee.",
     "Producer analysis requires a finite literal tag, every declared tag syntactically witnessed, exhaustive simple return paths without literal constant conditions, plain object returns, and consistent optional-field presence for each tag. It resolves only unmerged local aliases/interfaces without inheritance or generics, one local alias of a literal tag domain, and the built-in Promise around async returns. Callable or opaque own then properties abstain for async producers because Promise assimilation can replace the fulfilled value. Inherited then methods and external prototype mutation are not modeled. This is syntax-only evidence of field presence; explicit undefined, void and null payloads do not establish payload requirements, while expression value types are not inferred. Type-only assertion/satisfies/non-null wrappers, literal computed string keys and a sole-use const immediately before its return are recognized. Const alias chains, observation, mutation and dynamic eval abstain. Dynamic returns, spreads, dynamic computed keys, accessors, loops and try statements are deliberately skipped.",
     "A switch producer is supported only for a non-overloaded function declaration when its sole body statement switches on an unchanged direct string or number parameter, has unique same-kind literal labels and a default, and every nonempty case body is a sole object return or throw, optionally inside sole blocks. Empty labels may share the next terminating body; nested conditions, conditional returns, statement prefixes, breaks, other fallthrough, captured/closed inputs, dynamic eval and switches under preceding control flow abstain. Broad parameter domains establish input witnesses for each label and the default; this does not infer branch-specific runtime effects or expression value types. Path visits, depth and returned objects are bounded conservatively.",
     "These are refactoring advisories, not proven defects or proof that other writers cannot produce more states. Historical observations, partial results, unknown states and independently completing operations may need the broader contract. Review all readers and writers before migrating a shared contract; preserve every valid combination. A union of existing literal flag pairs is the smallest type-only replacement; a named disposition is a reviewed domain migration.",
@@ -4908,6 +5140,8 @@ var PREFER_DISCRIMINATED_UNION_DOCUMENTATION = {
     { id: "explicit-produced-variants", scenarioId: "produced-variants", title: "Give each produced variant its payload", outcome: "no-match", files: [{ path: "src/job.ts", source: 'function job(done: boolean): { phase: "queued"; ticket: string } | { phase: "complete" } { return done ? { phase: "complete" } : { phase: "queued", ticket: "t" }; }' }], focusPath: "src/job.ts", expectedCount: 0, public: true },
     { id: "flat-switch-producer", scenarioId: "switch-producer", title: "A complete dispatcher preserves each returned variant", outcome: "match", files: [{ path: "src/job.ts", source: 'function job(command: string): { phase: "queued" | "complete"; ticket?: string } { switch (command) { case "start": return { phase: "queued", ticket: "t" }; default: return { phase: "complete" }; } }' }], focusPath: "src/job.ts", expectedCount: 1, public: true },
     { id: "explicit-switch-variants", scenarioId: "switch-producer", title: "An explicit dispatcher result supports payload narrowing", outcome: "no-match", files: [{ path: "src/job.ts", source: 'function job(command: string): { phase: "queued"; ticket: string } | { phase: "complete" } { switch (command) { case "start": return { phase: "queued", ticket: "t" }; default: return { phase: "complete" }; } }' }], focusPath: "src/job.ts", expectedCount: 0, public: true },
+    { id: "immutable-state-projections", scenarioId: "state-projection", title: "Two predicates over one immutable phase cannot both be true", outcome: "match", files: [{ path: "src/projection.ts", source: 'type Phase = "ready" | "waiting" | "unknown"; declare function snapshot(): Phase; function state(): { ready: boolean; waiting: boolean } { const phase = snapshot(); return { ready: phase === "ready", waiting: phase === "waiting" }; }' }], focusPath: "src/projection.ts", expectedCount: 1, public: true },
+    { id: "authoritative-state", scenarioId: "state-projection", title: "Return the phase while preserving the independent timeout dimension", outcome: "no-match", files: [{ path: "src/projection.ts", source: 'type Phase = "ready" | "waiting" | "reconnecting" | "unknown"; declare function snapshot(): Phase; function state(timeout: boolean): { phase: Phase; timeout: boolean } { const phase = snapshot(); return { phase, timeout }; }' }], focusPath: "src/projection.ts", expectedCount: 0, public: true },
     {
       id: "safe-autofix",
       title: "Preserve an unused private producer's exact existing variants",
@@ -6565,6 +6799,53 @@ var REQUIRE_FETCH_TIMEOUT_DOCUMENTATION = {
   ]
 };
 
+// src/docs/require-ime-safe-enter-handler.ts
+var REQUIRE_IME_SAFE_ENTER_HANDLER_DOCUMENTATION = {
+  defaultLevel: "warning",
+  summary: "Preserve IME composition before Enter submits or blurs a native text control.",
+  rationale: "The Enter key confirms Japanese, Chinese and Korean composition as well as triggering custom actions. An unguarded native form submission or blur interrupts composing text.",
+  remediation: "Check the native keyboard event composition state before the action. Retain the Safari keyCode 229 or composition-timestamp fallback required by the browser policy; offer a native submit button.",
+  category: "correctness",
+  requiresTypeInformation: false,
+  limitations: [
+    "Only inline editable input/textarea keydown handlers with direct Enter equality (optionally combined with !shiftKey) and currentTarget.blur() or currentTarget.form.requestSubmit() are checked. Unknown guards and rebound event parameters remain unproven. Referenced handlers, custom components, arbitrary submission helpers, logical/conditional branches and DOM listeners need review.",
+    "The presence of a composition/keyCode/modifier check or composition listener suppresses the warning conservatively; this does not prove the guard dominates the action or implements the correct Safari fallback."
+  ],
+  references: [
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/forms/ime-safe-enter-submit.md"
+  ],
+  examples: [
+    {
+      id: "guarded-composition",
+      title: "guarded composition",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/input.tsx",
+          source: '<textarea onKeyDown={e => { if (e.nativeEvent.isComposing || e.nativeEvent.keyCode === 229) return; if (e.key === "Enter") { e.preventDefault(); e.currentTarget.form?.requestSubmit(); } }} />'
+        }
+      ],
+      focusPath: "src/input.tsx",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "interrupted-composition",
+      title: "interrupted composition",
+      outcome: "match",
+      files: [
+        {
+          path: "src/input.tsx",
+          source: '<textarea onKeyDown={e => { if (e.key === "Enter") e.currentTarget.form?.requestSubmit(); }} />'
+        }
+      ],
+      focusPath: "src/input.tsx",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+
 // src/docs/require-interface-for-exported-class.ts
 var REQUIRE_INTERFACE_FOR_EXPORTED_CLASS_DOCUMENTATION = {
   defaultLevel: "error",
@@ -7167,6 +7448,7 @@ var RULE_DOCUMENTATION = {
   "named-child-schema-type": NAMED_CHILD_SCHEMA_TYPE_DOCUMENTATION,
   "no-bare-return-from-test-catch": NO_BARE_RETURN_FROM_TEST_CATCH_DOCUMENTATION,
   "no-bespoke-api-case-conversion": NO_BESPOKE_API_CASE_CONVERSION_DOCUMENTATION,
+  "no-blocked-input-paste": NO_BLOCKED_INPUT_PASTE_DOCUMENTATION,
   "no-boolean-selector-parameter": NO_BOOLEAN_SELECTOR_PARAMETER_DOCUMENTATION,
   "no-broad-return-type": NO_BROAD_RETURN_TYPE_DOCUMENTATION,
   "no-client-side-data-fetching": NO_CLIENT_SIDE_DATA_FETCHING_DOCUMENTATION,
@@ -7200,6 +7482,7 @@ var RULE_DOCUMENTATION = {
   "no-in-operator-on-built-in-collections": NO_IN_OPERATOR_ON_BUILT_IN_COLLECTIONS_DOCUMENTATION,
   "no-insecure-random-id": NO_INSECURE_RANDOM_ID_DOCUMENTATION,
   "no-invalid-typed-mutation": NO_INVALID_TYPED_MUTATION_DOCUMENTATION,
+  "no-invalid-web-resource-hints": NO_INVALID_WEB_RESOURCE_HINTS_DOCUMENTATION,
   "no-invalid-zod-custom-parse": NO_INVALID_ZOD_CUSTOM_PARSE_DOCUMENTATION,
   "no-json-stringify-error": NO_JSON_STRINGIFY_ERROR_DOCUMENTATION,
   "no-json-stringify-object-equality": NO_JSON_STRINGIFY_OBJECT_EQUALITY_DOCUMENTATION,
@@ -7207,6 +7490,7 @@ var RULE_DOCUMENTATION = {
   "no-log-only-catch": NO_LOG_ONLY_CATCH_DOCUMENTATION,
   "no-logical-or-fallback": NO_LOGICAL_OR_FALLBACK_DOCUMENTATION,
   "no-long-comment": NO_LONG_COMMENT_DOCUMENTATION,
+  "no-message-origin-string-matching": NO_MESSAGE_ORIGIN_STRING_MATCHING_DOCUMENTATION,
   "no-mutating-container-transform": NO_MUTATING_CONTAINER_TRANSFORM_DOCUMENTATION,
   "no-mutating-input-with-result": NO_MUTATING_INPUT_WITH_RESULT_DOCUMENTATION,
   "no-negative-only-http-status-assertion": NO_NEGATIVE_ONLY_HTTP_STATUS_ASSERTION_DOCUMENTATION,
@@ -7214,6 +7498,7 @@ var RULE_DOCUMENTATION = {
   "no-offset-pagination": NO_OFFSET_PAGINATION_DOCUMENTATION,
   "no-oxlint-directive": NO_OXLINT_DIRECTIVE_DOCUMENTATION,
   "no-partial-type-predicate": NO_PARTIAL_TYPE_PREDICATE_DOCUMENTATION,
+  "no-password-get-form": NO_PASSWORD_GET_FORM_DOCUMENTATION,
   "no-positional-tuple-return": NO_POSITIONAL_TUPLE_RETURN_DOCUMENTATION,
   "no-production-browser-source-maps": NO_PRODUCTION_BROWSER_SOURCE_MAPS_DOCUMENTATION,
   "no-raw-env": NO_RAW_ENV_DOCUMENTATION,
@@ -7301,6 +7586,7 @@ var RULE_DOCUMENTATION = {
   "require-explicit-contract-implementation": REQUIRE_EXPLICIT_CONTRACT_IMPLEMENTATION_DOCUMENTATION,
   "require-explicit-service-contract": REQUIRE_EXPLICIT_SERVICE_CONTRACT_DOCUMENTATION,
   "require-fetch-timeout": REQUIRE_FETCH_TIMEOUT_DOCUMENTATION,
+  "require-ime-safe-enter-handler": REQUIRE_IME_SAFE_ENTER_HANDLER_DOCUMENTATION,
   "require-interface-for-exported-class": REQUIRE_INTERFACE_FOR_EXPORTED_CLASS_DOCUMENTATION,
   "require-jwt-lifetime": REQUIRE_JWT_LIFETIME_DOCUMENTATION,
   "require-pascal-case-zod-schema-name": REQUIRE_PASCAL_CASE_ZOD_SCHEMA_NAME_DOCUMENTATION,
@@ -7313,7 +7599,7 @@ var RULE_DOCUMENTATION = {
   "require-zod-form-validation": REQUIRE_ZOD_FORM_VALIDATION_DOCUMENTATION,
   "sole-export-matches-filename": SOLE_EXPORT_MATCHES_FILENAME_DOCUMENTATION,
   "source-coupled-test": SOURCE_COUPLED_TEST_DOCUMENTATION,
-  "stepdown": STEPDOWN_DOCUMENTATION,
+  stepdown: STEPDOWN_DOCUMENTATION,
   "store-insert-requires-on-conflict": STORE_INSERT_REQUIRES_ON_CONFLICT_DOCUMENTATION,
   "test-loops-over-literal-cases": TEST_LOOPS_OVER_LITERAL_CASES_DOCUMENTATION,
   "test-phase-label-comment": TEST_PHASE_LABEL_COMMENT_DOCUMENTATION