@sarj/eslint-plugin 19.7.0 → 19.8.0

package/dist/catalog.js

@@ -2,7 +2,7 @@ import {
   publicDocumentation,
   ruleSpec,
   src_default
-} from "./chunk-OX5DMK42.js";
+} from "./chunk-G5BIV4A4.js";
 
 // src/docs/directive-disable-enable-pair.ts
 var DIRECTIVE_DISABLE_ENABLE_PAIR_DOCUMENTATION = {
@@ -4440,6 +4440,54 @@ var PREFER_CODED_ERROR_RESULT_DOCUMENTATION = {
   ]
 };
 
+// src/docs/prefer-configured-cloud-scope.ts
+var PREFER_CONFIGURED_CLOUD_SCOPE_DOCUMENTATION = {
+  summary: "Prefer validated deployment configuration for account scope in outgoing cloud management requests.",
+  rationale: "A source-literal cloud account scope pins operational requests to one deployment even when the credential or environment changes.",
+  remediation: "Read the account ID from environment variables or injected configuration, validate it at startup, and pass the validated value to the request. Preserve independent security allowlists and fail closed when required configuration is missing.",
+  category: "correctness",
+  defaultLevel: "warning",
+  autofix: "none",
+  requiresTypeInformation: false,
+  limitations: [
+    "Initial coverage is canonical HTTPS Cloudflare v4 account-management URLs with a 32-character hexadecimal account segment sent to an unshadowed fetch, stable const alias, or fetch-default parameter. Other providers, SDKs, arbitrary endpoints, Worker names and resource IDs require separate evidence.",
+    "Follows bounded same-file const aliases, concatenations and template strings; an unknown account, mutable binding, function return, object property, fallback expression, URL/Request object or cross-file value is not inferred. Direct writes to the ambient fetch or its global receivers veto findings; indirect runtime monkeypatches are not modeled.",
+    "Analysis stops at 16 nested expressions or fetch aliases, 256 URL-expression visits per request, 128 string fragments or 8,192 UTF-16 code units of assembled URL text. These limits deliberately leave more complex expressions unreported.",
+    "Scripts remain covered. Test/fixture and generated files are excluded. Comparisons, schemas, allowlists and unused URL strings do not produce findings. Each originating account literal is reported at most once per file.",
+    "This is a warning without an automatic fix: the deployment configuration boundary and independent authorization policy require review. Application code should import validated configuration as required by no-raw-env; browser-exposed variables must never contain secrets."
+  ],
+  references: [
+    "https://developers.cloudflare.com/workers/wrangler/system-environment-variables/",
+    "https://eslint.org/docs/latest/rules/no-restricted-syntax"
+  ],
+  examples: [
+    {
+      id: "literal-account-scope",
+      title: "Move outgoing account scope into deployment configuration",
+      outcome: "match",
+      files: [{
+        path: ".github/scripts/publish.mjs",
+        source: "const accountId = '0123456789abcdef0123456789abcdef';\nconst base = `https://api.cloudflare.com/client/v4/accounts/${accountId}`;\nexport async function publish(path, request = fetch) { return request(`${base}/${path}`); }"
+      }],
+      focusPath: ".github/scripts/publish.mjs",
+      expectedCount: 1,
+      public: true
+    },
+    {
+      id: "validated-account-scope",
+      title: "Pass validated deployment configuration to the request",
+      outcome: "no-match",
+      files: [{
+        path: ".github/scripts/publish.mjs",
+        source: "import { env } from './env.mjs';\nconst base = `https://api.cloudflare.com/client/v4/accounts/${env.CLOUDFLARE_ACCOUNT_ID}`;\nexport async function publish(path, request = fetch) { return request(`${base}/${path}`); }"
+      }],
+      focusPath: ".github/scripts/publish.mjs",
+      expectedCount: 0,
+      public: true
+    }
+  ]
+};
+
 // src/docs/prefer-constant-time-secret-compare.ts
 var PREFER_CONSTANT_TIME_SECRET_COMPARE_DOCUMENTATION = {
   summary: "Prefer a supported constant-time comparison primitive for secret-like values.",
@@ -6842,6 +6890,7 @@ var RULE_DOCUMENTATION = {
   "no-zod-parse-typed-object": NO_ZOD_PARSE_TYPED_OBJECT_DOCUMENTATION,
   "prefer-await-in-async-return": PREFER_AWAIT_IN_ASYNC_RETURN_DOCUMENTATION,
   "prefer-coded-error-result": PREFER_CODED_ERROR_RESULT_DOCUMENTATION,
+  "prefer-configured-cloud-scope": PREFER_CONFIGURED_CLOUD_SCOPE_DOCUMENTATION,
   "prefer-constant-time-secret-compare": PREFER_CONSTANT_TIME_SECRET_COMPARE_DOCUMENTATION,
   "prefer-dependency-interface": PREFER_DEPENDENCY_INTERFACE_DOCUMENTATION,
   "prefer-discriminated-union": PREFER_DISCRIMINATED_UNION_DOCUMENTATION,

package/dist/{chunk-OX5DMK42.js → chunk-G5BIV4A4.js}

@@ -22008,8 +22008,179 @@ var prefer_coded_error_result_default = defineRule({
   }
 });
 
+// src/rules/prefer-configured-cloud-scope.ts
+var NAME92 = "prefer-configured-cloud-scope";
+var ACCOUNT_PREFIX = "https://api.cloudflare.com/client/v4/accounts/";
+var ACCOUNT_URL = /^https:\/\/api\.cloudflare\.com\/client\/v4\/accounts\/[a-fA-F\d]{32}(?=\/|[?#]|$)/u;
+var GLOBAL_RECEIVERS5 = /* @__PURE__ */ new Set(["globalThis", "global", "self", "window"]);
+var UNKNOWN = [{ text: "\0", source: null }];
+function accountSource(parts) {
+  if (!ACCOUNT_URL.test(parts.map((part) => part.text).join(""))) return null;
+  let offset = 0;
+  for (const part of parts) {
+    if (offset + part.text.length > ACCOUNT_PREFIX.length) return part.source;
+    offset += part.text.length;
+  }
+  return null;
+}
+function boundedParts(parts) {
+  return parts.length <= 128 && parts.reduce((size, part) => size + part.text.length, 0) <= 8192 ? parts : UNKNOWN;
+}
+var prefer_configured_cloud_scope_default = defineRule({
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Prefer validated deployment configuration for account scope in outgoing cloud management requests.",
+      url: docsUrl(NAME92)
+    },
+    schema: [],
+    messages: {
+      configuredScope: "This outgoing Cloudflare management request uses a source-literal account scope. Read and validate the account ID from deployment configuration or environment variables at the boundary; keep independent security allowlists intact."
+    }
+  },
+  createOnce(context) {
+    let sourceCode2;
+    const reported = /* @__PURE__ */ new Set();
+    const requests = [];
+    let fetchOverridden = false;
+    let nodesRemaining = 0;
+    function bindingOf(node) {
+      return findVariable(sourceCode2.getScope(node), node.name);
+    }
+    function unshadowed(node) {
+      const binding3 = bindingOf(node);
+      return binding3 === null || binding3.defs.length === 0;
+    }
+    function globalReceiver2(node) {
+      return node.type === "Identifier" && GLOBAL_RECEIVERS5.has(node.name) && unshadowed(node);
+    }
+    function outgoingFetch(node, seen = /* @__PURE__ */ new Set()) {
+      const callee = unwrapExpression(node);
+      if (callee.type === "MemberExpression") {
+        return globalReceiver2(callee.object) && staticPropertyName(callee, sourceCode2) === "fetch";
+      }
+      if (callee.type !== "Identifier") return false;
+      const binding3 = bindingOf(callee);
+      if (binding3 === null || binding3.defs.length === 0) return callee.name === "fetch";
+      if (seen.has(binding3) || seen.size >= 16 || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true)) return false;
+      const next = /* @__PURE__ */ new Set([...seen, binding3]);
+      const [definition] = binding3.defs;
+      if (definition?.type === "Parameter") {
+        const parameter = parentOf(definition.name);
+        return parameter?.type === "AssignmentPattern" && parameter.left === definition.name && outgoingFetch(parameter.right, next);
+      }
+      if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const") return false;
+      const declarator = definition.node;
+      return declarator.id.type === "Identifier" && declarator.init !== null && outgoingFetch(declarator.init, next);
+    }
+    function checkWrite(target, depth = 0) {
+      if (depth >= 16) {
+        fetchOverridden = true;
+        return;
+      }
+      const value = unwrapExpression(target);
+      switch (value.type) {
+        case "Identifier":
+          fetchOverridden ||= (value.name === "fetch" || GLOBAL_RECEIVERS5.has(value.name)) && unshadowed(value);
+          return;
+        case "MemberExpression":
+          if (globalReceiver2(value.object)) {
+            const name = staticPropertyName(value, sourceCode2);
+            fetchOverridden ||= name === null || name === "fetch" || GLOBAL_RECEIVERS5.has(name);
+          }
+          return;
+        case "ObjectPattern":
+          for (const property of value.properties) checkWrite(property.type === "RestElement" ? property.argument : property.value, depth + 1);
+          return;
+        case "ArrayPattern":
+          for (const element of value.elements) if (element !== null) checkWrite(element, depth + 1);
+          return;
+        case "AssignmentPattern":
+          checkWrite(value.left, depth + 1);
+          return;
+        case "RestElement":
+          checkWrite(value.argument, depth + 1);
+          return;
+      }
+    }
+    function urlParts(node, seen = /* @__PURE__ */ new Set(), depth = 0) {
+      if (depth >= 16 || nodesRemaining-- <= 0) return UNKNOWN;
+      const value = unwrapExpression(node);
+      if (value.type === "Literal" && typeof value.value === "string") {
+        return boundedParts([{ text: value.value, source: value }]);
+      }
+      if (value.type === "Identifier") {
+        const binding3 = bindingOf(value);
+        if (binding3 === null || seen.has(binding3) || binding3.defs.length !== 1 || binding3.references.some((ref) => ref.isWrite() && ref.init !== true)) return UNKNOWN;
+        const [definition] = binding3.defs;
+        if (definition?.type !== "Variable" || definition.parent?.type !== "VariableDeclaration" || definition.parent.kind !== "const") return UNKNOWN;
+        const declarator = definition.node;
+        if (declarator.id.type !== "Identifier" || declarator.init === null) return UNKNOWN;
+        return urlParts(declarator.init, /* @__PURE__ */ new Set([...seen, binding3]), depth + 1);
+      }
+      if (value.type === "BinaryExpression" && value.operator === "+") {
+        return boundedParts([...urlParts(value.left, seen, depth + 1), ...urlParts(value.right, seen, depth + 1)]);
+      }
+      if (value.type === "TemplateLiteral") return templateParts(value, seen, depth);
+      return UNKNOWN;
+    }
+    function templateParts(value, seen, depth) {
+      const parts = [];
+      for (let index = 0; index < value.quasis.length; index++) {
+        if (parts.length >= 128) return UNKNOWN;
+        const quasi = value.quasis[index];
+        if (quasi === void 0 || quasi.value.cooked === null) return UNKNOWN;
+        parts.push({ text: quasi.value.cooked, source: quasi });
+        const expression = value.expressions[index];
+        if (expression !== void 0) parts.push(...urlParts(expression, seen, depth + 1));
+      }
+      return boundedParts(parts);
+    }
+    return {
+      before() {
+        sourceCode2 = context.sourceCode;
+        reported.clear();
+        requests.length = 0;
+        fetchOverridden = false;
+        const file = { filename: context.filename, cwd: context.cwd };
+        return !isTestFile(file) && !isGeneratedFile(file, sourceCode2.text);
+      },
+      CallExpression(node) {
+        if (outgoingFetch(node.callee)) requests.push(node);
+      },
+      AssignmentExpression(node) {
+        checkWrite(node.left);
+      },
+      UpdateExpression(node) {
+        checkWrite(node.argument);
+      },
+      UnaryExpression(node) {
+        if (node.operator === "delete") checkWrite(node.argument);
+      },
+      ForInStatement(node) {
+        if (node.left.type !== "VariableDeclaration") checkWrite(node.left);
+      },
+      ForOfStatement(node) {
+        if (node.left.type !== "VariableDeclaration") checkWrite(node.left);
+      },
+      "Program:exit"() {
+        if (fetchOverridden) return;
+        for (const request of requests) {
+          const [url] = request.arguments;
+          if (url === void 0 || url.type === "SpreadElement") continue;
+          nodesRemaining = 256;
+          const literal2 = accountSource(urlParts(url));
+          if (literal2 === null || reported.has(literal2)) continue;
+          reported.add(literal2);
+          context.report({ node: literal2, messageId: "configuredScope" });
+        }
+      }
+    };
+  }
+});
+
 // src/rules/prefer-constant-time-secret-compare.ts
-var NAME92 = "prefer-constant-time-secret-compare";
+var NAME93 = "prefer-constant-time-secret-compare";
 var EQUALITY_OPERATORS3 = /* @__PURE__ */ new Set(["===", "!==", "==", "!="]);
 var AUTH_TOKEN_QUALIFIERS = /* @__PURE__ */ new Set(["access", "refresh", "session", "admin", "csrf", "xsrf", "auth", "authentication", "signing", "api"]);
 var SENTINEL_IDENTIFIERS = /* @__PURE__ */ new Set(["undefined", "NaN"]);
@@ -22073,7 +22244,7 @@ var prefer_constant_time_secret_compare_default = defineRule({
     type: "problem",
     docs: {
       description: "Prefer a supported constant-time comparison primitive for secret-like values.",
-      url: docsUrl(NAME92)
+      url: docsUrl(NAME93)
     },
     schema: [],
     messages: {
@@ -22161,7 +22332,7 @@ function constInitializer4(definition) {
 }
 
 // src/rules/prefer-dependency-interface.ts
-var NAME93 = "prefer-dependency-interface";
+var NAME94 = "prefer-dependency-interface";
 function readsInterfaceMember(use, members2) {
   const parent = parentOf(use);
   if (parent?.type !== "MemberExpression" || parent.object !== use || !members2.has(getPropertyName(parent) ?? "")) return false;
@@ -22191,7 +22362,7 @@ var prefer_dependency_interface_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Annotate retained collaborators with their existing interface when the consumer uses only that contract.",
-      url: docsUrl(NAME93)
+      url: docsUrl(NAME94)
     },
     schema: [],
     messages: { interface: "Use the existing `{{contract}}` interface for this dependency; its consumer uses only that contract." }
@@ -22548,14 +22719,14 @@ function literalTag(node) {
 }
 
 // src/rules/prefer-discriminated-union.ts
-var NAME94 = "prefer-discriminated-union";
+var NAME95 = "prefer-discriminated-union";
 var prefer_discriminated_union_default = defineRule({
   meta: {
     type: "suggestion",
     fixable: "code",
     docs: {
       description: "Preserve producer-proven tag/payload and Boolean state relationships in return types.",
-      url: docsUrl(NAME94)
+      url: docsUrl(NAME95)
     },
     schema: [],
     messages: {
@@ -22628,7 +22799,7 @@ function privateVariantType(properties2, result, sourceCode2) {
 }
 
 // src/rules/prefer-ecmascript-private-members.ts
-var NAME95 = "prefer-ecmascript-private-members";
+var NAME96 = "prefer-ecmascript-private-members";
 function isConvertible(member3) {
   return member3.accessibility === "private" && !(member3.type === "MethodDefinition" && member3.kind === "constructor") && !member3.computed && member3.key.type === "Identifier" && (member3.decorators?.length ?? 0) === 0 && !("declare" in member3 && member3.declare) && !member3.override && !(member3.type === "MethodDefinition" && (member3.value.body ?? null) === null);
 }
@@ -22638,7 +22809,7 @@ var prefer_ecmascript_private_members_default = defineRule({
     fixable: "code",
     docs: {
       description: "Prefer ECMAScript `#private` class members over TypeScript-only `private` members.",
-      url: docsUrl(NAME95)
+      url: docsUrl(NAME96)
     },
     schema: [],
     messages: {
@@ -22692,7 +22863,7 @@ var prefer_ecmascript_private_members_default = defineRule({
 });
 
 // src/rules/prefer-immutable-module-constant.ts
-var NAME96 = "prefer-immutable-module-constant";
+var NAME97 = "prefer-immutable-module-constant";
 var CONSTANT_NAME = /^_?[A-Z][A-Z0-9_]*$/;
 var JAVASCRIPT_FILE_RE = /\.[cm]?jsx?$/i;
 var MUTATING_METHODS = /* @__PURE__ */ new Set([
@@ -22865,7 +23036,7 @@ var prefer_immutable_module_constant_default = defineRule({
     fixable: "code",
     docs: {
       description: "Require module-level constant collections to expose readonly state.",
-      url: docsUrl(NAME96)
+      url: docsUrl(NAME97)
     },
     schema: [],
     defaultOptions: [],
@@ -22971,7 +23142,7 @@ function unwrapTransparentExport(node) {
 }
 
 // src/rules/prefer-input-group-search.ts
-var NAME97 = "prefer-input-group-search";
+var NAME98 = "prefer-input-group-search";
 var INPUT_MODULE = /(?:^|\/)components\/ui\/input$/u;
 var INPUT_GROUP_MODULE = /(?:^|\/)components\/ui\/input-group$/u;
 var MAX_JSX_DISTANCE = 2;
@@ -23042,7 +23213,7 @@ var prefer_input_group_search_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Require search icons and shared Input controls in the same visual wrapper to use InputGroup.",
-      url: docsUrl(NAME97)
+      url: docsUrl(NAME98)
     },
     schema: [],
     messages: {
@@ -23126,7 +23297,7 @@ var prefer_input_group_search_default = defineRule({
 });
 
 // src/rules/prefer-logical-tailwind-utilities.ts
-var NAME98 = "prefer-logical-tailwind-utilities";
+var NAME99 = "prefer-logical-tailwind-utilities";
 var PREFIXES = {
   ml: "ms",
   mr: "me",
@@ -23180,7 +23351,7 @@ var prefer_logical_tailwind_utilities_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Prefer logical Tailwind utilities in explicitly opted-in bidirectional interfaces.",
-      url: docsUrl(NAME98)
+      url: docsUrl(NAME99)
     },
     schema: [
       {
@@ -23247,7 +23418,7 @@ var prefer_logical_tailwind_utilities_default = defineRule({
 });
 
 // src/rules/prefer-millisecond-control-duration-schema.ts
-var NAME99 = "prefer-millisecond-control-duration-schema";
+var NAME100 = "prefer-millisecond-control-duration-schema";
 var CONTROL_SECONDS_RE = /(?:^|_)(?:timeout|delay|interval|backoff|ttl|lease|heartbeat|debounce|throttle)_seconds$/i;
 var CONTROL_SECONDS_CAMEL_RE = /(?:timeout|delay|interval|backoff|ttl|lease|heartbeat|debounce|throttle)Seconds$/i;
 var NUMERIC_REFINEMENTS = /* @__PURE__ */ new Set(["int", "min", "max", "positive", "nonnegative", "finite", "multipleOf", "optional", "nullable", "nullish", "default", "describe", "brand", "readonly"]);
@@ -23259,7 +23430,7 @@ var prefer_millisecond_control_duration_schema_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Require application-owned Zod control-duration fields to use millisecond granularity.",
-      url: docsUrl(NAME99)
+      url: docsUrl(NAME100)
     },
     schema: [],
     messages: {
@@ -23345,7 +23516,7 @@ var prefer_millisecond_control_duration_schema_default = defineRule({
 });
 
 // src/rules/prefer-minimal-parameter-contract.ts
-var NAME100 = "prefer-minimal-parameter-contract";
+var NAME101 = "prefer-minimal-parameter-contract";
 function inlineFields(ast, node, reads) {
   const fields2 = /* @__PURE__ */ new Map();
   for (const member3 of node.members) {
@@ -23364,7 +23535,7 @@ var prefer_minimal_parameter_contract_default = defineRule({
   meta: {
     type: "suggestion",
     fixable: "code",
-    docs: { description: "Prefer the proven read-only subset for a private consumer parameter.", url: docsUrl(NAME100) },
+    docs: { description: "Prefer the proven read-only subset for a private consumer parameter.", url: docsUrl(NAME101) },
     schema: [],
     messages: {
       minimal: "This private consumer reads only {{used}} but also requires {{unused}}. Review a smaller consumer contract; preserve the original runtime object and producer type."
@@ -23763,7 +23934,7 @@ var prefer_module_level_constant_default = defineRule({
 });
 
 // src/rules/prefer-module-level-schema.ts
-var NAME101 = "prefer-module-level-schema";
+var NAME102 = "prefer-module-level-schema";
 var DEFAULT_FACTORIES = [
   "discriminatedUnion",
   "intersection",
@@ -23945,7 +24116,7 @@ var prefer_module_level_schema_default = defineRule({
     type: "problem",
     docs: {
       description: "Declare a Zod schema at module scope when it closes over nothing in the enclosing function",
-      url: docsUrl(NAME101)
+      url: docsUrl(NAME102)
     },
     schema: [
       {
@@ -24095,7 +24266,7 @@ var prefer_module_level_schema_default = defineRule({
 });
 
 // src/rules/prefer-module-level-refined-schema.ts
-var NAME102 = "prefer-module-level-refined-schema";
+var NAME103 = "prefer-module-level-refined-schema";
 var BENCHMARK_PATH_RE = /(^|[/\\])(?:benchmarks?|bench)[/\\]/;
 var FACTORIES = /* @__PURE__ */ new Set([
   "array",
@@ -24245,7 +24416,7 @@ var prefer_module_level_refined_schema_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Declare closed Zod scalar, format, and wrapper schemas at module scope.",
-      url: docsUrl(NAME102)
+      url: docsUrl(NAME103)
     },
     schema: [],
     messages: {
@@ -24343,7 +24514,7 @@ var prefer_module_level_refined_schema_default = defineRule({
 });
 
 // src/rules/prefer-multi-value-zod-literal.ts
-var NAME103 = "prefer-multi-value-zod-literal";
+var NAME104 = "prefer-multi-value-zod-literal";
 function isStaticPrimitive(node, sourceCode2) {
   node = unwrapExpression(node);
   if (node.type === "Literal") {
@@ -24370,7 +24541,7 @@ var prefer_multi_value_zod_literal_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Use the Zod 4 multi-value literal API instead of a union of literal schemas.",
-      url: docsUrl(NAME103)
+      url: docsUrl(NAME104)
     },
     schema: [
       {
@@ -24533,7 +24704,7 @@ function closedType(node) {
 }
 
 // src/rules/prefer-named-callback-domain.ts
-var NAME104 = "prefer-named-callback-domain";
+var NAME105 = "prefer-named-callback-domain";
 function isLiteralUnion(node) {
   return node.type === "TSUnionType" && node.types.length >= 2 && node.types.every((part) => part.type === "TSLiteralType");
 }
@@ -24553,7 +24724,7 @@ var prefer_named_callback_domain_default = defineRule({
     fixable: "code",
     docs: {
       description: "Name literal-union domains used by callbacks in exported contracts.",
-      url: docsUrl(NAME104)
+      url: docsUrl(NAME105)
     },
     schema: [],
     messages: {
@@ -24592,7 +24763,7 @@ var prefer_named_callback_domain_default = defineRule({
 });
 
 // src/rules/prefer-named-complex-return-type.ts
-var NAME105 = "prefer-named-complex-return-type";
+var NAME106 = "prefer-named-complex-return-type";
 function unwrap5(node) {
   if (node.type === "TSTypeReference" && node.typeArguments?.params.length === 1) {
     const [inner] = node.typeArguments.params;
@@ -24630,7 +24801,7 @@ var prefer_named_complex_return_type_default = defineRule({
     fixable: "code",
     docs: {
       description: "Prefer a named contract for structurally complex function return types.",
-      url: docsUrl(NAME105)
+      url: docsUrl(NAME106)
     },
     schema: [],
     messages: {
@@ -24653,14 +24824,14 @@ var prefer_named_complex_return_type_default = defineRule({
 });
 
 // src/rules/prefer-native-fetch-in-server-actions.ts
-var NAME106 = "prefer-native-fetch-in-server-actions";
+var NAME107 = "prefer-native-fetch-in-server-actions";
 var KY_MODULE = /^ky(?:\/.*)?$/u;
 var prefer_native_fetch_in_server_actions_default = defineRule({
   meta: {
     type: "problem",
     docs: {
       description: "Server action modules should call native fetch instead of importing ky.",
-      url: docsUrl(NAME106)
+      url: docsUrl(NAME107)
     },
     schema: [],
     defaultOptions: [],
@@ -24696,7 +24867,7 @@ function isTypeOnly(node) {
 }
 
 // src/rules/prefer-native-random-uuid.ts
-var NAME107 = "prefer-native-random-uuid";
+var NAME108 = "prefer-native-random-uuid";
 function requireUuidCallee(node) {
   return node?.type === "CallExpression" && node.callee.type === "Identifier" && node.callee.name === "require" && node.arguments.length === 1 && node.arguments[0]?.type === "Literal" && node.arguments[0].value === "uuid" ? node.callee : null;
 }
@@ -24709,7 +24880,7 @@ var prefer_native_random_uuid_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Prefer `globalThis.crypto.randomUUID()` over resolved zero-argument UUID v4 bindings from the `uuid` package.",
-      url: docsUrl(NAME107)
+      url: docsUrl(NAME108)
     },
     hasSuggestions: true,
     fixable: "code",
@@ -24797,7 +24968,7 @@ var prefer_native_random_uuid_default = defineRule({
 });
 
 // src/rules/prefer-node-crypto-hash.ts
-var NAME108 = "prefer-node-crypto-hash";
+var NAME109 = "prefer-node-crypto-hash";
 var UNSAFE_NAMESPACE_METHODS = /* @__PURE__ */ new Set(["__defineGetter__", "__defineSetter__", "valueOf"]);
 var UNSAFE_AUTHORITY_IDENTIFIERS = [
   "eval",
@@ -24901,7 +25072,7 @@ var prefer_node_crypto_hash_default = defineRule({
     fixable: "code",
     docs: {
       description: "Prefer the modern one-shot node:crypto hash API when streaming state is unnecessary.",
-      url: docsUrl(NAME108)
+      url: docsUrl(NAME109)
     },
     schema: [],
     messages: { preferNodeCryptoHash: "Prefer the modern one-shot node:crypto hash API when streaming state is unnecessary." }
@@ -25131,7 +25302,7 @@ function hasRetainedFactoryCall(binding3, removed) {
 }
 
 // src/rules/prefer-node-fs-promises.ts
-var NAME109 = "prefer-node-fs-promises";
+var NAME110 = "prefer-node-fs-promises";
 function memberName3(node) {
   if (!node.computed && node.property.type === "Identifier") return node.property.name;
   if (node.computed && node.property.type === "Literal" && typeof node.property.value === "string") {
@@ -25164,7 +25335,7 @@ var prefer_node_fs_promises_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Prefer promise-based Node.js filesystem APIs over synchronous calls in production modules.",
-      url: docsUrl(NAME109)
+      url: docsUrl(NAME110)
     },
     schema: [],
     messages: {
@@ -25307,7 +25478,7 @@ function sameTypeBinding(sourceCode2, alias, annotation, parameter) {
 }
 
 // src/rules/prefer-nominal-id-types.ts
-var NAME110 = "prefer-nominal-id-types";
+var NAME111 = "prefer-nominal-id-types";
 var OPERATIONAL_ROLES = /* @__PURE__ */ new Set([
   "request",
   "trace",
@@ -25423,7 +25594,7 @@ var prefer_nominal_id_types_default = defineRule({
     fixable: "code",
     docs: {
       description: "Distinguish identifier roles sharing primitive types at callable boundaries.",
-      url: docsUrl(NAME110)
+      url: docsUrl(NAME111)
     },
     schema: [],
     messages: {
@@ -25452,7 +25623,7 @@ var prefer_nominal_id_types_default = defineRule({
 });
 
 // src/rules/prefer-non-nullable-collection.ts
-var NAME111 = "prefer-non-nullable-collection";
+var NAME112 = "prefer-non-nullable-collection";
 var ARRAY_TYPE_NAMES2 = /* @__PURE__ */ new Set(["Array", "ReadonlyArray"]);
 var NULL_GUARD_OPERATORS = /* @__PURE__ */ new Set(["==", "==="]);
 var EMPTY_GUARD_OPERATORS = /* @__PURE__ */ new Set(["==", "===", "<="]);
@@ -25807,7 +25978,7 @@ var prefer_non_nullable_collection_default = defineRule({
     fixable: "code",
     docs: {
       description: "Suggest reviewing nullish arrays that use local empty-array defaults or a shared null-or-empty guard.",
-      url: docsUrl(NAME111)
+      url: docsUrl(NAME112)
     },
     schema: [],
     messages: {
@@ -25918,7 +26089,7 @@ var prefer_non_nullable_collection_default = defineRule({
 });
 
 // src/rules/prefer-nullish-filter-predicate.ts
-var NAME112 = "prefer-nullish-filter-predicate";
+var NAME113 = "prefer-nullish-filter-predicate";
 var SUMMARY = "Prefer an explicit nullish predicate when `filter(Boolean)` removes only nullish values but does not narrow the result type.";
 function isBuiltinArrayFilter(native, symbol) {
   const kinds2 = native.ast.SyntaxKind;
@@ -25975,7 +26146,7 @@ function isLiteralValue(node) {
 var prefer_nullish_filter_predicate_default = defineRule({
   meta: {
     type: "suggestion",
-    docs: { description: SUMMARY, url: docsUrl(NAME112) },
+    docs: { description: SUMMARY, url: docsUrl(NAME113) },
     hasSuggestions: true,
     fixable: "code",
     schema: [],
@@ -26068,7 +26239,7 @@ var prefer_nullish_filter_predicate_default = defineRule({
 });
 
 // src/rules/prefer-schema-for-api-payload.ts
-var NAME113 = "prefer-schema-for-api-payload";
+var NAME114 = "prefer-schema-for-api-payload";
 var unwrap6 = (node) => {
   let current = node ?? null;
   while (current !== null && (isErasedExpression(current) || current.type === "ChainExpression")) current = current.expression;
@@ -26351,7 +26522,7 @@ var prefer_schema_for_api_payload_default = defineRule({
     type: "problem",
     docs: {
       description: "Require Zod (or similar) schema validation on `response.json()` / `JSON.parse()` results before property access.",
-      url: docsUrl(NAME113)
+      url: docsUrl(NAME114)
     },
     schema: [],
     messages: {
@@ -26534,7 +26705,7 @@ var prefer_schema_for_api_payload_default = defineRule({
 // src/rules/prefer-semantic-colors.ts
 import { existsSync as existsSync3, lstatSync, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
 import { dirname as dirname3, join as join3, parse } from "path";
-var NAME114 = "prefer-semantic-colors";
+var NAME115 = "prefer-semantic-colors";
 var COLOR_PREFIXES = "text|bg|border(?:-[trblxyse])?|ring(?:-offset)?|fill|stroke|from|via|to|divide|decoration|placeholder|accent|caret|shadow|outline";
 var PALETTE = "red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose|slate|gray|zinc|neutral|stone";
 var COLOR_FN = "rgba?|hsla?|hwb|oklch|oklab|lab|lch|color";
@@ -26866,7 +27037,7 @@ var prefer_semantic_colors_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Enforce semantic color tokens over raw Tailwind palette classes, arbitrary color values, and inline color literals.",
-      url: docsUrl(NAME114)
+      url: docsUrl(NAME115)
     },
     schema: [
       {
@@ -27053,7 +27224,7 @@ function packageWorkspaceGlobs(parsed) {
 }
 
 // src/rules/prefer-server-actions.ts
-var NAME115 = "prefer-server-actions";
+var NAME116 = "prefer-server-actions";
 var MUTATION_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "DELETE", "PATCH"]);
 var AXIOS_MUTATION_METHODS = /* @__PURE__ */ new Set(["post", "put", "delete", "patch"]);
 var SKIP_FILE_REGEX = /(?:\.test\.[jt]sx?$|\.spec\.[jt]sx?$|-(?:test|spec)\.[jt]sx?$|\/tests?\/|\/__tests__\/|\/__testfixtures__\/|\/scripts?\/|(?:^|\/)app(?:\/.*)?\/route\.[jt]sx?$|(?:^|\/)middleware\.[jt]sx?$|\/pages\/api\/)/;
@@ -27192,7 +27363,7 @@ var prefer_server_actions_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Prefer Next.js Server Actions over same-origin API mutations.",
-      url: docsUrl(NAME115)
+      url: docsUrl(NAME116)
     },
     schema: [
       {
@@ -27278,7 +27449,7 @@ var prefer_server_actions_default = defineRule({
 });
 
 // src/rules/prefer-server-data-preparation.ts
-var NAME116 = "prefer-server-data-preparation";
+var NAME117 = "prefer-server-data-preparation";
 var METHODS = /* @__PURE__ */ new Set(["map", "filter", "flatMap"]);
 var DOM_EVENTS = /* @__PURE__ */ new Set(["onClick", "onChange", "onInput", "onSubmit"]);
 var BINARY = /* @__PURE__ */ new Set(["===", "!==", "==", "!=", ">", ">=", "<", "<=", "+", "-", "*", "/", "%"]);
@@ -27410,7 +27581,7 @@ function typedProofs(native) {
 var prefer_server_data_preparation_default = defineRule({
   meta: {
     type: "suggestion",
-    docs: { description: "Prepare data-only input collections before an interactive client view when possible.", url: docsUrl(NAME116) },
+    docs: { description: "Prepare data-only input collections before an interactive client view when possible.", url: docsUrl(NAME117) },
     schema: [],
     messages: {
       prepareData: "Review preparing this prop-only collection in its producer or Server Component when the inputs are available there. Keep operations depending on unsaved edits or browser interaction reactive in the client."
@@ -28328,7 +28499,7 @@ var ParseErrorCode;
 })(ParseErrorCode || (ParseErrorCode = {}));
 
 // src/rules/prefer-shadcn-primitives.ts
-var NAME117 = "prefer-shadcn-primitives";
+var NAME118 = "prefer-shadcn-primitives";
 var RAW_PRIMITIVES = {
   button: { capability: "Button", replacement: "Button" },
   dialog: { capability: "Dialog", replacement: "Dialog or AlertDialog family" },
@@ -28630,7 +28801,7 @@ var prefer_shadcn_primitives_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Require visible raw JSX controls to use the corresponding shared shadcn primitive.",
-      url: docsUrl(NAME117)
+      url: docsUrl(NAME118)
     },
     schema: [
       {
@@ -28737,7 +28908,7 @@ function matchingAliasTargets(paths, alias) {
 }
 
 // src/rules/prefer-shared-zod-enum.ts
-var NAME118 = "prefer-shared-zod-enum";
+var NAME119 = "prefer-shared-zod-enum";
 function literalDomain(node) {
   if (node.arguments.length !== 1) return null;
   const first = node.arguments[0];
@@ -28776,7 +28947,7 @@ var prefer_shared_zod_enum_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Give repeated literal Zod enum domains one reusable module-level schema.",
-      url: docsUrl(NAME118)
+      url: docsUrl(NAME119)
     },
     schema: [],
     messages: {
@@ -28833,7 +29004,7 @@ var prefer_shared_zod_enum_default = defineRule({
 });
 
 // src/rules/prefer-switch-for-repeated-equality.ts
-var NAME119 = "prefer-switch-for-repeated-equality";
+var NAME120 = "prefer-switch-for-repeated-equality";
 function discriminantName(test) {
   if (test.type !== "BinaryExpression" || test.operator !== "===") return null;
   const leftIsCase = isCaseValue(test.left);
@@ -28910,7 +29081,7 @@ var prefer_switch_for_repeated_equality_default = defineRule({
     fixable: "code",
     docs: {
       description: "Prefer switch over long if/else-if chains that compare one value for strict equality.",
-      url: docsUrl(NAME119)
+      url: docsUrl(NAME120)
     },
     schema: [],
     messages: {
@@ -28960,7 +29131,7 @@ var prefer_switch_for_repeated_equality_default = defineRule({
 });
 
 // src/rules/prefer-test-fixture-reuse.ts
-var NAME120 = "prefer-test-fixture-reuse";
+var NAME121 = "prefer-test-fixture-reuse";
 var MAX_DEPTH2 = 8;
 var FRAMEWORKS = /* @__PURE__ */ new Set(["vitest", "@playwright/test"]);
 var TEST_MODIFIERS4 = /* @__PURE__ */ new Set(["only", "skip", "concurrent", "sequential"]);
@@ -29089,7 +29260,7 @@ var prefer_test_fixture_reuse_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Reuse a requested test fixture instead of constructing another instance of its class.",
-      url: docsUrl(NAME120)
+      url: docsUrl(NAME121)
     },
     schema: [],
     messages: { reuseFixture: "This class is already supplied by the requested `{{fixture}}` fixture; reuse it or request a typed factory for independent instances." }
@@ -29123,7 +29294,7 @@ var prefer_test_fixture_reuse_default = defineRule({
 });
 
 // src/rules/prefer-typed-reflection.ts
-var NAME121 = "prefer-typed-reflection";
+var NAME122 = "prefer-typed-reflection";
 function knownType(native, type) {
   if (type.isUnionType()) return type.getTypes().every((part) => knownType(native, part));
   const flags = native.sync.TypeFlags;
@@ -29153,7 +29324,7 @@ var prefer_typed_reflection_default = defineRule({
     fixable: "code",
     docs: {
       description: "Prefer typed access when Reflect.get or Reflect.apply discards a known contract.",
-      url: docsUrl(NAME121)
+      url: docsUrl(NAME122)
     },
     schema: [],
     messages: {
@@ -29319,7 +29490,7 @@ var prefer_typed_reflection_default = defineRule({
 });
 
 // src/rules/prefer-whole-object-assertion.ts
-var NAME122 = "prefer-whole-object-assertion";
+var NAME123 = "prefer-whole-object-assertion";
 var MERGEABLE_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual", "toStrictEqual"]);
 var SYNTHETIC_LITERAL_MATCHERS = /* @__PURE__ */ new Map([
   ["toBeNull", "null"]
@@ -29409,7 +29580,7 @@ var prefer_whole_object_assertion_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Collapse consecutive assertions on one object into a whole-object assertion so related mismatches are reported together.",
-      url: docsUrl(NAME122)
+      url: docsUrl(NAME123)
     },
     messages: {
       combineAssertions: "Consider combining these {{count}} assertions on `{{receiver}}` with `toMatchObject` when structural matching preserves property presence and getter or proxy behavior.",
@@ -29556,7 +29727,7 @@ var prefer_whole_object_assertion_default = defineRule({
 });
 
 // src/rules/prefer-zod-enum-validator.ts
-var NAME123 = "prefer-zod-enum-validator";
+var NAME124 = "prefer-zod-enum-validator";
 function isInput(node, name) {
   if (node == null) return false;
   const value = unwrapExpression(node);
@@ -29647,7 +29818,7 @@ var prefer_zod_enum_validator_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Express closed string validators with a reusable Zod enum schema.",
-      url: docsUrl(NAME123)
+      url: docsUrl(NAME124)
     },
     schema: [],
     messages: { useEnumSchema: "Replace this closed string validator with a named z.enum([\u2026]) schema and derive its type with z.infer. Use parse for parsing or safeParse for a boolean check; preserve intentional failure behavior." }
@@ -29675,7 +29846,7 @@ var prefer_zod_enum_validator_default = defineRule({
 });
 
 // src/rules/prefer-zod-infer.ts
-var NAME124 = "prefer-zod-infer";
+var NAME125 = "prefer-zod-infer";
 function absent(value) {
   return value === void 0 || value === null;
 }
@@ -30051,7 +30222,7 @@ var prefer_zod_infer_default = defineRule({
     fixable: "code",
     docs: {
       description: "Derive a type from its Zod schema with `z.infer` instead of hand-writing a twin declaration beside it.",
-      url: docsUrl(NAME124)
+      url: docsUrl(NAME125)
     },
     schema: [
       {
@@ -30501,7 +30672,7 @@ function returnsContract(authority, returned2) {
 }
 
 // src/rules/prefer-zod-parse-output-type.ts
-var NAME125 = "prefer-zod-parse-output-type";
+var NAME126 = "prefer-zod-parse-output-type";
 function isLocalZodObjectSchema(node, namespaces) {
   let current = node;
   while (current.type === "CallExpression") {
@@ -30647,7 +30818,7 @@ var prefer_zod_parse_output_type_default = defineRule({
     fixable: "code",
     docs: {
       description: "Consider deriving validated return contracts from the Zod schema when the schema owns the contract.",
-      url: docsUrl(NAME125)
+      url: docsUrl(NAME126)
     },
     schema: [],
     messages: {
@@ -30935,7 +31106,7 @@ var production_derived_test_cases_default = defineRule({
 });
 
 // src/rules/repeated-static-call-cases.ts
-var NAME126 = "repeated-static-call-cases";
+var NAME127 = "repeated-static-call-cases";
 var TEST_MODULES2 = /* @__PURE__ */ new Set(["@jest/globals", "@playwright/test", "bun:test", "node:test", "vitest"]);
 var TEST_NAMES3 = /* @__PURE__ */ new Set(["it", "test"]);
 var TEST_MODIFIERS5 = /* @__PURE__ */ new Set(["concurrent", "fails", "only", "sequential", "skip"]);
@@ -31059,7 +31230,7 @@ var repeated_static_call_cases_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Review three or more consecutive static-input call assertions as potential named cases.",
-      url: docsUrl(NAME126)
+      url: docsUrl(NAME127)
     },
     schema: [],
     messages: { repeatedStaticCallCases: "These {{count}} consecutive assertions repeat a call with static inputs. If independent, use named parameterized cases or subtests; preserve ordered scenarios as one test." }
@@ -31201,7 +31372,7 @@ function isPrimitiveReturn(node, annotation) {
 }
 
 // src/rules/require-assert-never.ts
-var NAME127 = "require-assert-never";
+var NAME128 = "require-assert-never";
 function isRuntimeHandlingStatement(statement) {
   if (statement.type === "EmptyStatement") return false;
   if (statement.type === "BreakStatement") return statement.label !== null;
@@ -31261,7 +31432,7 @@ var require_assert_never_default = defineRule({
     fixable: "code",
     docs: {
       description: "Require an empty switch default to call `assertNever` so discriminated unions remain exhaustive at compile time.",
-      url: docsUrl(NAME127)
+      url: docsUrl(NAME128)
     },
     schema: [],
     messages: {
@@ -31305,7 +31476,7 @@ var require_assert_never_default = defineRule({
 });
 
 // src/rules/require-button-accessible-name.ts
-var NAME128 = "require-button-accessible-name";
+var NAME129 = "require-button-accessible-name";
 var DELEGATING_PROPS = /* @__PURE__ */ new Set(["render", "asChild"]);
 function delegatesRendering(opening) {
   return opening.attributes.some(
@@ -31318,7 +31489,7 @@ var require_button_accessible_name_default = defineRule({
     type: "problem",
     docs: {
       description: "Require an accessible name on statically unnamed native or configured JSX buttons.",
-      url: docsUrl(NAME128)
+      url: docsUrl(NAME129)
     },
     schema: [
       {
@@ -31372,7 +31543,7 @@ var require_button_accessible_name_default = defineRule({
 });
 
 // src/rules/require-camelcase-properties.ts
-var NAME129 = "require-camelcase-properties";
+var NAME130 = "require-camelcase-properties";
 var SNAKE_CASE_RE2 = /^[a-z][a-z0-9]*(?:_[a-z0-9]+)+$/u;
 function blocksRename(member3, name) {
   if (member3.type === "TSIndexSignature" || "computed" in member3 && member3.computed) return true;
@@ -31386,7 +31557,7 @@ var require_camelcase_properties_default = defineRule({
     fixable: "code",
     docs: {
       description: "Require unquoted lower snake_case TypeScript properties and dot access to use camelCase.",
-      url: docsUrl(NAME129)
+      url: docsUrl(NAME130)
     },
     schema: [],
     defaultOptions: [],
@@ -31450,7 +31621,7 @@ var require_camelcase_properties_default = defineRule({
 });
 
 // src/rules/require-constrained-schema-integer.ts
-var NAME130 = "require-constrained-schema-integer";
+var NAME131 = "require-constrained-schema-integer";
 var FIELD_MINIMUMS = /* @__PURE__ */ new Map([["limit", 1], ["version", 0]]);
 var NUMBER_FACTORIES = /* @__PURE__ */ new Set(["number", "int", "int32", "uint32"]);
 var OBJECT_FACTORIES = /* @__PURE__ */ new Set(["object", "strictObject", "looseObject"]);
@@ -31492,7 +31663,7 @@ var require_constrained_schema_integer_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Declare integer and lower-bound validation for numeric limit and version schema fields.",
-      url: docsUrl(NAME130)
+      url: docsUrl(NAME131)
     },
     schema: [],
     messages: { constrainInteger: "Declare `{{field}}` as an integer with a lower bound of {{minimum}} or greater, or reuse its named domain schema." }
@@ -31971,14 +32142,14 @@ function closedNominalInheritanceFix(sourceCode2, file, call, consumer, implemen
 }
 
 // src/rules/require-explicit-contract-implementation.ts
-var NAME131 = "require-explicit-contract-implementation";
+var NAME132 = "require-explicit-contract-implementation";
 var require_explicit_contract_implementation_default = defineRule({
   meta: {
     type: "problem",
     fixable: "code",
     docs: {
       description: "Require nominal inheritance when an injected abstract class is rejected by an instanceof guard.",
-      url: docsUrl(NAME131)
+      url: docsUrl(NAME132)
     },
     schema: [],
     messages: {
@@ -32669,7 +32840,7 @@ function abstractContractOperations(node, functionAliases) {
 }
 
 // src/rules/require-explicit-service-contract.ts
-var NAME132 = "require-explicit-service-contract";
+var NAME133 = "require-explicit-service-contract";
 var JAVASCRIPT_FILE_RE2 = /\.(?:js|jsx|mjs|cjs)$/iu;
 var BOUNDARY_SUFFIX = /(?:Service|ServiceImpl|Store|Repository|Provider|Executor|Enqueuer|Runner|Platform|Manager|ManagerImpl|Detector|Control|Refresher|Reader|Settlement|Retry|Stop|Catalog|DAO)$/u;
 var NON_SERVICE_SUFFIX = /(?:Router|Middleware|Builder)$/u;
@@ -32685,7 +32856,7 @@ var require_explicit_service_contract_default = defineRule({
     type: "problem",
     docs: {
       description: "Require explicit contracts for classes that invoke retained collaborators.",
-      url: docsUrl(NAME132)
+      url: docsUrl(NAME133)
     },
     schema: [],
     fixable: "code",
@@ -32721,7 +32892,7 @@ var require_explicit_service_contract_default = defineRule({
 });
 
 // src/rules/require-fetch-timeout.ts
-var NAME133 = "require-fetch-timeout";
+var NAME134 = "require-fetch-timeout";
 function emptySignal(expression, resolvesToGlobal) {
   const value = unwrapExpression(expression);
   if (value.type === "Literal" && value.value === null)
@@ -32783,7 +32954,7 @@ var require_fetch_timeout_default = defineRule({
     type: "problem",
     docs: {
       description: "Require an explicit abort signal on locally analyzable global fetch calls.",
-      url: docsUrl(NAME133)
+      url: docsUrl(NAME134)
     },
     schema: [
       {
@@ -32875,7 +33046,7 @@ var require_fetch_timeout_default = defineRule({
 });
 
 // src/rules/require-interface-for-exported-class.ts
-var NAME134 = "require-interface-for-exported-class";
+var NAME135 = "require-interface-for-exported-class";
 var JAVASCRIPT_FILE_RE3 = /\.(?:js|jsx|mjs|cjs)$/iu;
 function isPublicInstanceMember2(member3) {
   return !member3.static && member3.accessibility !== "private" && member3.accessibility !== "protected" && member3.key.type !== "PrivateIdentifier";
@@ -32936,7 +33107,7 @@ var require_interface_for_exported_class_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Require exported concrete classes with public behavior to declare a contract.",
-      url: docsUrl(NAME134)
+      url: docsUrl(NAME135)
     },
     schema: [],
     fixable: "code",
@@ -32978,7 +33149,7 @@ var require_interface_for_exported_class_default = defineRule({
 });
 
 // src/rules/require-jwt-lifetime.ts
-var NAME135 = "require-jwt-lifetime";
+var NAME136 = "require-jwt-lifetime";
 function isJoseValueImport(declaration) {
   return declaration.type === "ImportDeclaration" && declaration.importKind !== "type" && declaration.source.value === "jose";
 }
@@ -32987,7 +33158,7 @@ var require_jwt_lifetime_default = defineRule({
     type: "problem",
     docs: {
       description: "Require an expiration claim or a maximum token age when returning a verified JWT.",
-      url: docsUrl(NAME135)
+      url: docsUrl(NAME136)
     },
     schema: [],
     messages: { lifetime: "Require the JWT exp claim or set maxTokenAge before returning this verification result." }
@@ -33046,7 +33217,7 @@ var require_jwt_lifetime_default = defineRule({
 });
 
 // src/rules/require-pascal-case-zod-schema-name.ts
-var NAME136 = "require-pascal-case-zod-schema-name";
+var NAME137 = "require-pascal-case-zod-schema-name";
 var PASCAL_SCHEMA_NAME_RE = /^[A-Z][A-Za-z0-9]*Schema$/;
 var BENCHMARK_PATH_RE2 = /(^|[\\/])(?:benchmarks?|bench)[\\/]/;
 var NON_SCHEMA_TERMINALS2 = /* @__PURE__ */ new Set([
@@ -33217,7 +33388,7 @@ var require_pascal_case_zod_schema_name_default = defineRule({
     fixable: "code",
     docs: {
       description: "Require confirmed module-level Zod schema contracts to use PascalCase with a `Schema` suffix.",
-      url: docsUrl(NAME136)
+      url: docsUrl(NAME137)
     },
     schema: [],
     defaultOptions: [],
@@ -33327,7 +33498,7 @@ var require_pascal_case_zod_schema_name_default = defineRule({
 });
 
 // src/rules/require-port-for-service.ts
-var NAME137 = "require-port-for-service";
+var NAME138 = "require-port-for-service";
 var HTTP_TRANSPORT_TYPE_RE = /^(?:KyInstance|AxiosInstance|Session)$/;
 var TRANSPORT_WRAPPER_NAME_RE = /(?:Client$|^Http[A-Z])/;
 var ERROR_VALUE_NAME_RE = /Error$/;
@@ -33461,7 +33632,7 @@ var require_port_for_service_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Advise when an exported service with injected collaborators has public methods not covered by its declared ports.",
-      url: docsUrl(NAME137)
+      url: docsUrl(NAME138)
     },
     schema: [],
     fixable: "code",
@@ -33501,7 +33672,7 @@ var require_port_for_service_default = defineRule({
 });
 
 // src/rules/require-sql-access-class.ts
-var NAME138 = "require-sql-access-class";
+var NAME139 = "require-sql-access-class";
 var DIRECT_EXECUTION_METHODS = /* @__PURE__ */ new Set([
   "all",
   "batch",
@@ -33699,7 +33870,7 @@ var require_sql_access_class_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Keep SQL reads and writes inside a class that receives its database dependency.",
-      url: docsUrl(NAME138)
+      url: docsUrl(NAME139)
     },
     schema: [],
     messages: {
@@ -33771,7 +33942,7 @@ function staticMatcherFix(sourceCode2, property) {
 }
 
 // src/rules/require-static-next-matcher.ts
-var NAME139 = "require-static-next-matcher";
+var NAME140 = "require-static-next-matcher";
 var NEXT_ENTRY_FILE = /(?:^|[/\\])(?:middleware|proxy)\.[cm]?[jt]sx?$/u;
 function isStaticValue(node) {
   const value = unwrapExpression(node);
@@ -33803,7 +33974,7 @@ var require_static_next_matcher_default = defineRule({
     fixable: "code",
     docs: {
       description: "Require Next.js middleware and proxy matcher configuration to contain only build-time literals.",
-      url: docsUrl(NAME139)
+      url: docsUrl(NAME140)
     },
     schema: [],
     messages: {
@@ -33847,7 +34018,7 @@ var require_static_next_matcher_default = defineRule({
 });
 
 // src/rules/require-svg-accessible-name.ts
-var NAME140 = "require-svg-accessible-name";
+var NAME141 = "require-svg-accessible-name";
 var DECORATIVE_ROLES = /* @__PURE__ */ new Set(["none", "presentation"]);
 var NAME_ATTRIBUTES = ["aria-label", "aria-labelledby"];
 var NO_ICON_MODULES = [];
@@ -33856,7 +34027,7 @@ var require_svg_accessible_name_default = defineRule({
     type: "problem",
     docs: {
       description: "Require a name or explicit decorative semantics on inline SVG elements.",
-      url: docsUrl(NAME140)
+      url: docsUrl(NAME141)
     },
     schema: [],
     messages: {
@@ -33888,7 +34059,7 @@ var require_svg_accessible_name_default = defineRule({
 });
 
 // src/rules/require-use-form-default-values.ts
-var NAME141 = "require-use-form-default-values";
+var NAME142 = "require-use-form-default-values";
 var UNSAFE_FORM_MEMBERS = /* @__PURE__ */ new Set(["__defineGetter__", "__defineSetter__", "__proto__", "valueOf"]);
 function staticPropertyName2(property) {
   return property.computed ? null : getPropertyName(property);
@@ -33931,7 +34102,7 @@ var require_use_form_default_values_default = defineRule({
     type: "problem",
     docs: {
       description: "Require explicit form-level initialization or a field default for directly bound Controller fields.",
-      url: docsUrl(NAME141)
+      url: docsUrl(NAME142)
     },
     schema: [],
     messages: { requireUseFormDefaultValues: "Add non-undefined defaultValues/values to the associated useForm call or non-undefined defaultValue to this field." }
@@ -34070,7 +34241,7 @@ var require_use_form_default_values_default = defineRule({
 });
 
 // src/rules/require-use-server-in-actions-file.ts
-var NAME142 = "require-use-server-in-actions-file";
+var NAME143 = "require-use-server-in-actions-file";
 var ACTION_MODULE_RE = /(?:^|\/)app\/.*\/(?:actions|[^/]+-actions)\.[cm]?[jt]s$/u;
 function isUseServerDirective2(statement) {
   return statement.type === "ExpressionStatement" && statement.directive === "use server";
@@ -34091,7 +34262,7 @@ var require_use_server_in_actions_file_default = defineRule({
     type: "problem",
     docs: {
       description: "route action module missing the use server directive",
-      url: docsUrl(NAME142)
+      url: docsUrl(NAME143)
     },
     schema: [],
     messages: {
@@ -34117,7 +34288,7 @@ var require_use_server_in_actions_file_default = defineRule({
 });
 
 // src/rules/require-zod-form-validation.ts
-var NAME143 = "require-zod-form-validation";
+var NAME144 = "require-zod-form-validation";
 var ZOD_PARSE_METHODS = /* @__PURE__ */ new Set([
   "parse",
   "safeParse",
@@ -34176,7 +34347,7 @@ var require_zod_form_validation_default = defineRule({
     type: "problem",
     docs: {
       description: "Require Zod validation (`Schema.parse(...)` / `Schema.safeParse(...)`) when reading values out of a `FormData` object.",
-      url: docsUrl(NAME143)
+      url: docsUrl(NAME144)
     },
     schema: [],
     messages: {
@@ -34464,7 +34635,7 @@ function declaresFramework(metadata, name) {
 }
 
 // src/rules/sole-export-matches-filename.ts
-var NAME144 = "sole-export-matches-filename";
+var NAME145 = "sole-export-matches-filename";
 var EXCLUDED_STEMS = /* @__PURE__ */ new Set(["global", "index", "types"]);
 function stem3(filename) {
   const base = filename.replaceAll("\\", "/").split("/").at(-1) ?? "";
@@ -34478,7 +34649,7 @@ var sole_export_matches_filename_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Make a module filename reflect its sole named public runtime export.",
-      url: docsUrl(NAME144)
+      url: docsUrl(NAME145)
     },
     schema: [],
     messages: {
@@ -35221,7 +35392,7 @@ var stepdown_default = defineRule({
 });
 
 // src/rules/store-insert-requires-on-conflict.ts
-var NAME145 = "store-insert-requires-on-conflict";
+var NAME146 = "store-insert-requires-on-conflict";
 var INSERT_WRITE = /\bINSERT\s+(?:OR\s+\w+\s+)?INTO\s+[\w."'`?$:@-]+\s*(?:\([^)]*\)\s*)?(?:VALUES|SELECT|DEFAULT\s+VALUES)\b/i;
 var CONFLICT_HANDLED = /\bON\s+CONFLICT\b|\bON\s+DUPLICATE\s+KEY\b|\bINSERT\s+OR\s+(?:IGNORE|REPLACE)\b|\bINSERT\b[\s\S]*?\bSELECT\b[\s\S]*?\bWHERE\s+NOT\s+EXISTS\b/i;
 var REPLAY_CONTRACT_NAME = /(?:enqueue|ensure|migrate|recordOnce|schedule|seed|upsert|getOrCreate|createIfAbsent|insertIfAbsent)/i;
@@ -35250,7 +35421,7 @@ var store_insert_requires_on_conflict_default = defineRule({
     type: "problem",
     docs: {
       description: "Review conflict handling for embedded inserts in replay-named callables.",
-      url: docsUrl(NAME145)
+      url: docsUrl(NAME146)
     },
     schema: [],
     messages: {
@@ -35275,7 +35446,7 @@ var store_insert_requires_on_conflict_default = defineRule({
 });
 
 // src/rules/test-loops-over-literal-cases.ts
-var NAME146 = "test-loops-over-literal-cases";
+var NAME147 = "test-loops-over-literal-cases";
 var TEST_CALLERS3 = /* @__PURE__ */ new Set(["it", "test"]);
 var TEST_MODIFIERS6 = /* @__PURE__ */ new Set(["concurrent", "fails", "only", "sequential", "skip"]);
 var ASSERTION_ROOTS = /* @__PURE__ */ new Set([
@@ -35371,7 +35542,7 @@ var test_loops_over_literal_cases_default = defineRule({
     type: "suggestion",
     docs: {
       description: "Disallow assertions over an inline literal case loop in a test; parameterization reports and names every case independently.",
-      url: docsUrl(NAME146)
+      url: docsUrl(NAME147)
     },
     schema: [],
     messages: {
@@ -35435,7 +35606,7 @@ var test_loops_over_literal_cases_default = defineRule({
 });
 
 // src/rules/test-phase-label-comment.ts
-var NAME147 = "test-phase-label-comment";
+var NAME148 = "test-phase-label-comment";
 var PHASE_WORD = String.raw`arrange|act|assert(?:ion)?s?|given|when|then|exercise|execute|verif(?:y|ication)|cleanup|prepare|sanity(?:\s+check)?`;
 var PHASE_RE = new RegExp(
   String.raw`^[-=~*_#.\s]{0,40}(?:${PHASE_WORD})(?:\s*(?:[/&+,|]|->|and)\s*(?:${PHASE_WORD}))*[-=~*_#.\s:;!–—]{0,40}$`,
@@ -35463,7 +35634,7 @@ var test_phase_label_comment_default = defineRule({
     fixable: "code",
     docs: {
       description: "Tests must not use bare Arrange, Act, Assert, Given, When, or Then phase comments.",
-      url: docsUrl(NAME147)
+      url: docsUrl(NAME148)
     },
     schema: [],
     messages: { removeLabel: "Bare test phase label \u2014 delete it and let the test names and helpers carry the structure." }
@@ -35605,6 +35776,7 @@ var RULES = {
   "no-zod-parse-typed-object": no_zod_parse_typed_object_default,
   "prefer-await-in-async-return": prefer_await_in_async_return_default,
   "prefer-coded-error-result": prefer_coded_error_result_default,
+  "prefer-configured-cloud-scope": prefer_configured_cloud_scope_default,
   "prefer-constant-time-secret-compare": prefer_constant_time_secret_compare_default,
   "prefer-dependency-interface": prefer_dependency_interface_default,
   "prefer-discriminated-union": prefer_discriminated_union_default,

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   src_default
-} from "./chunk-OX5DMK42.js";
+} from "./chunk-G5BIV4A4.js";
 export {
   src_default as default
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "19.7.0",
+  "version": "19.8.0",
   "packageManager": "npm@12.2.1",
   "description": "Custom Oxlint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",