@sarj/eslint-plugin 2.0.2 → 2.2.0

package/dist/index.cjs

@@ -28,45 +28,30 @@ module.exports = __toCommonJS(index_exports);
 // src/rules/enforce-file-structure.ts
 var import_utils = require("@typescript-eslint/utils");
 var SECTION = {
-  imports: 0,
-  types: 1,
-  constants: 2,
-  functions: 3,
-  exports: 4
+  declarations: 0,
+  functions: 1,
+  exports: 2
 };
-var SECTION_NAMES = [
-  "imports",
-  "types",
-  "constants",
-  "functions",
-  "exports"
-];
+var SECTION_NAMES = ["declarations", "functions", "exports"];
 var sectionName = (ordinal) => {
   const name = SECTION_NAMES[ordinal];
   return name ?? "unknown";
 };
-var isConstantNamed = (declarator) => {
-  if (declarator.id.type !== import_utils.AST_NODE_TYPES.Identifier) return false;
-  const name = declarator.id.name;
-  return name.length > 0 && name === name.toUpperCase();
-};
+var SERVER_ACTION_FILE_RE = /(?:^|\/)actions\/|\.action\.[jt]sx?$|(?:^|\/)actions\.[jt]sx?$/;
+var isFunctionExpression = (node) => node.type === import_utils.AST_NODE_TYPES.ArrowFunctionExpression || node.type === import_utils.AST_NODE_TYPES.FunctionExpression;
+var isFunctionLikeVariable = (statement) => statement.declarations.length > 0 && statement.declarations.every(
+  (decl) => decl.init !== null && isFunctionExpression(decl.init)
+);
 var getStatementSection = (statement) => {
   switch (statement.type) {
     case import_utils.AST_NODE_TYPES.ImportDeclaration:
-      return SECTION.imports;
     case import_utils.AST_NODE_TYPES.TSTypeAliasDeclaration:
     case import_utils.AST_NODE_TYPES.TSInterfaceDeclaration:
     case import_utils.AST_NODE_TYPES.TSEnumDeclaration:
-      return SECTION.types;
-    case import_utils.AST_NODE_TYPES.VariableDeclaration: {
-      if (statement.kind === "const") {
-        const firstDeclarator = statement.declarations[0];
-        if (firstDeclarator !== void 0 && isConstantNamed(firstDeclarator)) {
-          return SECTION.constants;
-        }
-      }
-      return SECTION.functions;
-    }
+    case import_utils.AST_NODE_TYPES.ClassDeclaration:
+      return SECTION.declarations;
+    case import_utils.AST_NODE_TYPES.VariableDeclaration:
+      return isFunctionLikeVariable(statement) ? SECTION.functions : SECTION.declarations;
     case import_utils.AST_NODE_TYPES.FunctionDeclaration:
       return SECTION.functions;
     case import_utils.AST_NODE_TYPES.ExportNamedDeclaration:
@@ -91,7 +76,7 @@ var enforce_file_structure_default = import_utils.ESLintUtils.RuleCreator(
   meta: {
     type: "suggestion",
     docs: {
-      description: "Enforce a canonical top-of-file ordering: imports -> types -> constants -> functions -> exports. Server-action files (under `/actions/` or with `action` in the path) must also begin with a `use server` directive."
+      description: "Enforce that function definitions follow the file's top-of-file declarations (imports, types, constants, classes) \u2014 the stepdown rule. Ordering among non-function declarations is not enforced. Server-action files (under `/actions/`, named `*.action.ts`, or `actions.ts`) must also begin with a `use server` directive."
     },
     schema: [],
     messages: {
@@ -102,7 +87,7 @@ var enforce_file_structure_default = import_utils.ESLintUtils.RuleCreator(
   defaultOptions: [],
   create(context) {
     const filename = context.filename;
-    const isServerAction = filename.includes("/actions/") || filename.includes("action");
+    const isServerAction = SERVER_ACTION_FILE_RE.test(filename);
     return {
       Program(node) {
         const body = node.body;
@@ -115,9 +100,8 @@ var enforce_file_structure_default = import_utils.ESLintUtils.RuleCreator(
             });
           }
         }
-        let currentSection = SECTION.imports;
+        let currentSection = SECTION.declarations;
         for (const statement of body) {
-          if (isUseServerDirective(statement)) continue;
           if (statement.type === import_utils.AST_NODE_TYPES.ExpressionStatement && statement.expression.type === import_utils.AST_NODE_TYPES.Literal && typeof statement.expression.value === "string" && statement.expression.value.startsWith("use ")) {
             continue;
           }
@@ -153,7 +137,7 @@ var HTTP_METHOD_NAMES = /* @__PURE__ */ new Set([
   "head",
   "options"
 ]);
-var ANALYTICS_KEYWORDS = [
+var ANALYTICS_SEGMENTS = /* @__PURE__ */ new Set([
   "analytics",
   "telemetry",
   "track",
@@ -162,7 +146,7 @@ var ANALYTICS_KEYWORDS = [
   "beacon",
   "metrics",
   "event"
-];
+]);
 function isEffectHookCall(node) {
   const callee = node.callee;
   if (callee.type === import_utils2.AST_NODE_TYPES.Identifier) {
@@ -236,7 +220,7 @@ function extractUrlString(node) {
 function isAnalyticsCall(node) {
   const url = extractUrlString(node).toLowerCase();
   if (url === "") return false;
-  return ANALYTICS_KEYWORDS.some((keyword) => url.includes(keyword));
+  return url.split(/[/.]/).some((segment) => ANALYTICS_SEGMENTS.has(segment));
 }
 var no_client_side_data_fetching_default = import_utils2.ESLintUtils.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
@@ -275,8 +259,105 @@ var no_client_side_data_fetching_default = import_utils2.ESLintUtils.RuleCreator
   }
 });
 
-// src/rules/no-enum.ts
+// src/rules/no-comment-cruft.ts
 var import_utils3 = require("@typescript-eslint/utils");
+var LEADING_PREAMBLE_MIN = 4;
+var DIRECTIVE_RE = /^(eslint\b|eslint-|@ts-|prettier-ignore|prettier\b|biome-|c8\b|v8\b|istanbul\b|@type\b|@vite|webpack|<reference|global\b|noinspection|todo\b|fixme\b|hack\b|xxx\b)/i;
+var LICENSE_RE = /copyright|licen[cs]ed?|spdx|permission is hereby granted|all rights reserved/i;
+var BANNER_FULL_RE = /^[\s\-=*#~_+.]{4,}$/;
+var BANNER_RUN_RE = /={4,}|-{4,}|#{4,}|\*{4,}|~{4,}/;
+var REGION_RE = /^#?(?:end)?region\b/i;
+var CODE_KEYWORD_RE = /^(import |export |const |let |var |function\b|class |interface |type \w|enum |return\b|throw |await |async |if\s*\(|for\s*\(|while\s*\(|switch\s*\(|new |console\.)/;
+var CODE_TAIL_RE = /[;{}()]\s*$|=>\s*$|,\s*$/;
+var CALL_OR_ASSIGN_RE = /^[A-Za-z_$][\w.$[\]]*\s*(?:=(?![=>])|\+=|-=|\*=)\s*\S.*[;)}\]]\s*$|^[A-Za-z_$][\w.$]*\([^)]*\)\s*;?\s*$/;
+function stripCommentMarker(line) {
+  return line.replace(/^\s*\/\//, "").replace(/^\s*\*+/, "").trim();
+}
+function isDirective(text) {
+  return DIRECTIVE_RE.test(text.trim());
+}
+function isBanner(text) {
+  const t = text.trim();
+  if (!t) return false;
+  return BANNER_FULL_RE.test(t) || BANNER_RUN_RE.test(t) || REGION_RE.test(t);
+}
+function looksLikeCode(text) {
+  const t = text.trim();
+  if (!t) return false;
+  if (CODE_KEYWORD_RE.test(t) && CODE_TAIL_RE.test(t)) return true;
+  return CALL_OR_ASSIGN_RE.test(t);
+}
+var no_comment_cruft_default = import_utils3.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-comment-cruft",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Flag commented-out code, section-banner comments, and leading file-header comment preambles."
+    },
+    schema: [],
+    messages: {
+      commentedOutCode: "Commented-out code \u2014 delete it; git history remembers.",
+      sectionBanner: "Section-banner / region comment \u2014 structure code with functions, not ASCII rules.",
+      fileHeaderPreamble: "File-header comment preamble \u2014 use a brief doc comment for the why, not a block of `//` lines."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const sourceCode = context.sourceCode;
+    function isStandalone(comment) {
+      const before = sourceCode.getTokenBefore(comment, {
+        includeComments: false
+      });
+      return !before || before.loc.end.line < comment.loc.start.line;
+    }
+    function isJsDoc(comment) {
+      return comment.type === "Block" && /^\*/.test(comment.value);
+    }
+    function reportLeadingPreamble(comments, firstCodeLine) {
+      const leading = [];
+      let prevLine = null;
+      for (const comment of comments) {
+        if (comment.type !== "Line") break;
+        if (comment.loc.start.line >= firstCodeLine) break;
+        if (!isStandalone(comment)) break;
+        const body = stripCommentMarker(comment.value);
+        if (isDirective(body) || body.startsWith("!")) continue;
+        if (prevLine !== null && comment.loc.start.line !== prevLine + 1) break;
+        leading.push(comment);
+        prevLine = comment.loc.start.line;
+      }
+      const first = leading[0];
+      if (first === void 0 || leading.length < LEADING_PREAMBLE_MIN) return;
+      const isLicense = leading.some(
+        (c) => LICENSE_RE.test(stripCommentMarker(c.value))
+      );
+      if (!isLicense) {
+        context.report({ node: first, messageId: "fileHeaderPreamble" });
+      }
+    }
+    return {
+      Program() {
+        const comments = sourceCode.getAllComments();
+        const firstCodeLine = sourceCode.ast.tokens[0]?.loc.start.line ?? Number.MAX_SAFE_INTEGER;
+        for (const comment of comments) {
+          if (isJsDoc(comment) || !isStandalone(comment)) continue;
+          const texts = comment.value.split("\n").map(stripCommentMarker).filter((l) => l.length > 0 && !isDirective(l));
+          if (texts.some(isBanner)) {
+            context.report({ node: comment, messageId: "sectionBanner" });
+          } else if (texts.some(looksLikeCode)) {
+            context.report({ node: comment, messageId: "commentedOutCode" });
+          }
+        }
+        reportLeadingPreamble(comments, firstCodeLine);
+      }
+    };
+  }
+});
+
+// src/rules/no-enum.ts
+var import_utils4 = require("@typescript-eslint/utils");
 var DEFAULT_IGNORE_PATTERNS = [
   /[\\/]generated[\\/]/,
   /\.gen\.tsx?$/,
@@ -295,7 +376,7 @@ function hasGeneratedMarker(sourceText) {
   const head = sourceText.slice(0, 1024);
   return /@generated\b/.test(head);
 }
-var no_enum_default = import_utils3.ESLintUtils.RuleCreator(
+var no_enum_default = import_utils4.ESLintUtils.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "no-enum",
@@ -345,9 +426,260 @@ var no_enum_default = import_utils3.ESLintUtils.RuleCreator(
   }
 });
 
+// src/rules/no-insecure-random-id.ts
+var import_utils5 = require("@typescript-eslint/utils");
+var NAME_PATTERN = /id|token|key|secret|uuid|nonce|session|password|salt/i;
+function isMathRandomCall(node) {
+  if (node.type !== "CallExpression") {
+    return false;
+  }
+  const callee = node.callee;
+  if (callee.type !== "MemberExpression" || callee.computed) {
+    return false;
+  }
+  const { object, property } = callee;
+  return object.type === "Identifier" && object.name === "Math" && property.type === "Identifier" && property.name === "random";
+}
+function isPartOfToString36Chain(node) {
+  let current = node;
+  let parent = current.parent;
+  while (parent) {
+    if (parent.type === "MemberExpression" && parent.object === current && !parent.computed && parent.property.type === "Identifier" && parent.property.name === "toString") {
+      const grandparent = parent.parent;
+      if (grandparent && grandparent.type === "CallExpression" && grandparent.callee === parent) {
+        const firstArg = grandparent.arguments[0];
+        if (firstArg && firstArg.type === "Literal" && firstArg.value === 36) {
+          return true;
+        }
+      }
+    }
+    if (parent.type === "MemberExpression" && parent.object === current) {
+      current = parent;
+      parent = current.parent;
+      continue;
+    }
+    if (parent.type === "CallExpression" && parent.callee === current) {
+      current = parent;
+      parent = current.parent;
+      continue;
+    }
+    break;
+  }
+  return false;
+}
+function findEnclosingName(node) {
+  let current = node;
+  let parent = current.parent;
+  while (parent) {
+    if (parent.type === "VariableDeclarator" && parent.init === current) {
+      if (parent.id.type === "Identifier") {
+        return parent.id.name;
+      }
+      return void 0;
+    }
+    if (parent.type === "Property" && parent.value === current) {
+      const key = parent.key;
+      if (!parent.computed && key.type === "Identifier") {
+        return key.name;
+      }
+      if (key.type === "Literal" && typeof key.value === "string") {
+        return key.value;
+      }
+      return void 0;
+    }
+    if (parent.type === "PropertyDefinition" && parent.value === current) {
+      const key = parent.key;
+      if (!parent.computed && key.type === "Identifier") {
+        return key.name;
+      }
+      if (key.type === "Literal" && typeof key.value === "string") {
+        return key.value;
+      }
+      return void 0;
+    }
+    if (parent.type === "FunctionDeclaration" || parent.type === "FunctionExpression" || parent.type === "ArrowFunctionExpression" || parent.type === "BlockStatement" || parent.type === "ReturnStatement" || parent.type === "ExpressionStatement") {
+      return void 0;
+    }
+    current = parent;
+    parent = current.parent;
+  }
+  return void 0;
+}
+var no_insecure_random_id_default = import_utils5.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-insecure-random-id",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow using `Math.random()` to generate identifiers, tokens, or secrets; use `crypto.randomUUID()` or `crypto.getRandomValues(...)` instead."
+    },
+    schema: [],
+    messages: {
+      insecureRandomId: "`Math.random()` is not cryptographically secure and is predictable; do not use it to generate IDs, tokens, or secrets. Use `crypto.randomUUID()` or `crypto.getRandomValues(...)` instead."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CallExpression(node) {
+        if (!isMathRandomCall(node)) {
+          return;
+        }
+        if (isPartOfToString36Chain(node)) {
+          context.report({ node, messageId: "insecureRandomId" });
+          return;
+        }
+        const name = findEnclosingName(node);
+        if (name !== void 0 && NAME_PATTERN.test(name)) {
+          context.report({ node, messageId: "insecureRandomId" });
+        }
+      }
+    };
+  }
+});
+
+// src/rules/no-json-stringify-error.ts
+var import_utils6 = require("@typescript-eslint/utils");
+var ERROR_NAME_PATTERN = /^(e|err|error|ex|exc)$/i;
+function isCatchBinding(scope, name) {
+  let current = scope;
+  while (current) {
+    const variable = current.set.get(name);
+    if (variable) {
+      for (const def of variable.defs) {
+        if (def.type === "CatchClause") {
+          return true;
+        }
+      }
+    }
+    current = current.upper;
+  }
+  return false;
+}
+function isJsonStringify(callee) {
+  return callee.type === "MemberExpression" && !callee.computed && callee.object.type === "Identifier" && callee.object.name === "JSON" && callee.property.type === "Identifier" && callee.property.name === "stringify";
+}
+var no_json_stringify_error_default = import_utils6.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-json-stringify-error",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow `JSON.stringify` on an Error value; it yields `{}` because `message`/`stack` are non-enumerable."
+    },
+    schema: [],
+    messages: {
+      noJsonStringifyError: "`JSON.stringify` on an Error yields `{}` because `message`/`stack` are non-enumerable. Log `err.message` / `err.stack`, or use a proper error serializer."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CallExpression(node) {
+        if (!isJsonStringify(node.callee)) {
+          return;
+        }
+        const firstArg = node.arguments[0];
+        if (!firstArg || firstArg.type !== "Identifier") {
+          return;
+        }
+        const name = firstArg.name;
+        const scope = context.sourceCode.getScope(firstArg);
+        if (ERROR_NAME_PATTERN.test(name) || isCatchBinding(scope, name)) {
+          context.report({
+            node,
+            messageId: "noJsonStringifyError"
+          });
+        }
+      }
+    };
+  }
+});
+
+// src/rules/no-log-only-catch.ts
+var import_utils7 = require("@typescript-eslint/utils");
+var DEFAULT_IGNORE_PATTERNS2 = [
+  /\.test\./,
+  /\.spec\./,
+  /[\\/]__tests__[\\/]/
+];
+var CONSOLE_METHODS = /* @__PURE__ */ new Set([
+  "log",
+  "error",
+  "warn",
+  "info",
+  "debug"
+]);
+function isConsoleCallStatement(statement) {
+  if (statement.type !== "ExpressionStatement") {
+    return false;
+  }
+  const expr = statement.expression;
+  if (expr.type !== "CallExpression") {
+    return false;
+  }
+  const callee = expr.callee;
+  if (callee.type !== "MemberExpression") {
+    return false;
+  }
+  const { object, property } = callee;
+  if (object.type !== "Identifier" || object.name !== "console") {
+    return false;
+  }
+  if (callee.computed) {
+    return false;
+  }
+  if (property.type !== "Identifier") {
+    return false;
+  }
+  return CONSOLE_METHODS.has(property.name);
+}
+var no_log_only_catch_default = import_utils7.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-log-only-catch",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow `catch` clauses that only log (or do nothing) and then swallow the error; rethrow or handle it instead."
+    },
+    schema: [],
+    messages: {
+      noLogOnlyCatch: "Logging then swallowing the error hides failures. Rethrow the error or handle it for real."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const filename = context.filename;
+    const isIgnoredByDefault = DEFAULT_IGNORE_PATTERNS2.some(
+      (re) => re.test(filename)
+    );
+    if (isIgnoredByDefault) {
+      return {};
+    }
+    return {
+      CatchClause(node) {
+        const statements = node.body.body;
+        if (statements.length === 0) {
+          context.report({ node, messageId: "noLogOnlyCatch" });
+          return;
+        }
+        const everyStatementIsConsoleLog = statements.every(
+          (statement) => isConsoleCallStatement(statement)
+        );
+        if (everyStatementIsConsoleLog) {
+          context.report({ node, messageId: "noLogOnlyCatch" });
+        }
+      }
+    };
+  }
+});
+
 // src/rules/no-raw-env.ts
-var import_utils4 = require("@typescript-eslint/utils");
-var no_raw_env_default = import_utils4.ESLintUtils.RuleCreator(
+var import_utils8 = require("@typescript-eslint/utils");
+var no_raw_env_default = import_utils8.ESLintUtils.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "no-raw-env",
@@ -379,8 +711,300 @@ var no_raw_env_default = import_utils4.ESLintUtils.RuleCreator(
   }
 });
 
+// src/rules/no-sentinel-return-on-catch.ts
+var import_utils9 = require("@typescript-eslint/utils");
+function isSentinelArgument(arg) {
+  if (arg === null) {
+    return false;
+  }
+  if (arg.type === import_utils9.AST_NODE_TYPES.Literal && arg.value === null) {
+    return true;
+  }
+  if (arg.type === import_utils9.AST_NODE_TYPES.Literal && arg.value === false) {
+    return true;
+  }
+  if (arg.type === import_utils9.AST_NODE_TYPES.Identifier && arg.name === "undefined") {
+    return true;
+  }
+  if (arg.type === import_utils9.AST_NODE_TYPES.ArrayExpression && arg.elements.length === 0) {
+    return true;
+  }
+  if (arg.type === import_utils9.AST_NODE_TYPES.ObjectExpression && arg.properties.length === 0) {
+    return true;
+  }
+  return false;
+}
+function containsThrow(node) {
+  let found = false;
+  const visit = (current) => {
+    if (found) {
+      return;
+    }
+    if (current.type === import_utils9.AST_NODE_TYPES.ThrowStatement) {
+      found = true;
+      return;
+    }
+    if (current.type === import_utils9.AST_NODE_TYPES.FunctionDeclaration || current.type === import_utils9.AST_NODE_TYPES.FunctionExpression || current.type === import_utils9.AST_NODE_TYPES.ArrowFunctionExpression) {
+      return;
+    }
+    for (const key of Object.keys(current)) {
+      if (key === "parent") {
+        continue;
+      }
+      const value = current[key];
+      if (Array.isArray(value)) {
+        for (const child of value) {
+          if (isNode(child)) {
+            visit(child);
+          }
+        }
+      } else if (isNode(value)) {
+        visit(value);
+      }
+    }
+  };
+  visit(node);
+  return found;
+}
+function isNode(value) {
+  return typeof value === "object" && value !== null && typeof value.type === "string";
+}
+var no_sentinel_return_on_catch_default = import_utils9.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-sentinel-return-on-catch",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow swallowing a caught error by returning an empty sentinel (`null`, `undefined`, `false`, `[]`, `{}`) as the final statement of a `catch` block."
+    },
+    schema: [],
+    messages: {
+      noSentinelReturn: "This `catch` block swallows the error by returning an empty sentinel. Rethrow it, return a typed Result, or handle the error explicitly."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CatchClause(node) {
+        const body = node.body.body;
+        if (body.length === 0) {
+          return;
+        }
+        const last = body[body.length - 1];
+        if (last === void 0 || last.type !== import_utils9.AST_NODE_TYPES.ReturnStatement) {
+          return;
+        }
+        if (!isSentinelArgument(last.argument)) {
+          return;
+        }
+        if (containsThrow(node.body)) {
+          return;
+        }
+        context.report({
+          node: last,
+          messageId: "noSentinelReturn"
+        });
+      }
+    };
+  }
+});
+
+// src/rules/no-sequential-await.ts
+var import_utils10 = require("@typescript-eslint/utils");
+function isFunctionLike(node) {
+  return node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression";
+}
+function isLoop(node) {
+  return node.type === "ForStatement" || node.type === "ForOfStatement" || node.type === "ForInStatement" || node.type === "WhileStatement" || node.type === "DoWhileStatement";
+}
+var no_sequential_await_default = import_utils10.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-sequential-await",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow serial `await` inside a loop; use `await Promise.all(...)` to run the operations concurrently."
+    },
+    schema: [],
+    messages: {
+      noSequentialAwait: "Avoid `await` inside a loop \u2014 it serializes I/O. Collect the promises and `await Promise.all(xs.map(async (x) => ...))` instead."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    function findAwaitInScope(node) {
+      if (node.type === "AwaitExpression") {
+        return node;
+      }
+      if (isFunctionLike(node)) {
+        return null;
+      }
+      for (const key of Object.keys(node)) {
+        if (key === "parent") {
+          continue;
+        }
+        const value = node[key];
+        if (Array.isArray(value)) {
+          for (const child of value) {
+            if (isNode2(child) && !isLoop(child)) {
+              const found = findAwaitInScope(child);
+              if (found) {
+                return found;
+              }
+            }
+          }
+        } else if (isNode2(value) && !isLoop(value)) {
+          const found = findAwaitInScope(value);
+          if (found) {
+            return found;
+          }
+        }
+      }
+      return null;
+    }
+    function isNode2(value) {
+      return typeof value === "object" && value !== null && typeof value.type === "string";
+    }
+    function checkLoop(node) {
+      const parts = [node.body];
+      if (node.type === "ForStatement") {
+        parts.push(node.init, node.test, node.update);
+      } else if (node.type === "ForOfStatement" || node.type === "ForInStatement") {
+        parts.push(node.right);
+      } else {
+        parts.push(node.test);
+      }
+      for (const part of parts) {
+        if (part && !isLoop(part) && findAwaitInScope(part)) {
+          context.report({ node, messageId: "noSequentialAwait" });
+          return;
+        }
+      }
+    }
+    return {
+      ForStatement: checkLoop,
+      ForInStatement: checkLoop,
+      WhileStatement: checkLoop,
+      DoWhileStatement: checkLoop,
+      ForOfStatement(node) {
+        if (node.await) {
+          return;
+        }
+        checkLoop(node);
+      }
+    };
+  }
+});
+
+// src/rules/no-string-concat-in-loop.ts
+var import_utils11 = require("@typescript-eslint/utils");
+var LOOP_NODE_TYPES = /* @__PURE__ */ new Set([
+  "ForStatement",
+  "ForOfStatement",
+  "ForInStatement",
+  "WhileStatement",
+  "DoWhileStatement"
+]);
+function isStringLiteralInit(node) {
+  if (node === null) {
+    return false;
+  }
+  if (node.type === "TemplateLiteral") {
+    return true;
+  }
+  if (node.type === "Literal") {
+    return typeof node.value === "string";
+  }
+  return false;
+}
+function findVariable(scope, name) {
+  let current = scope;
+  while (current !== null) {
+    const variable = current.variables.find((v) => v.name === name);
+    if (variable !== void 0) {
+      return variable;
+    }
+    current = current.upper;
+  }
+  return void 0;
+}
+function isStringInitializedVariable(variable) {
+  if (variable.defs.length !== 1) {
+    return false;
+  }
+  const def = variable.defs[0];
+  if (def === void 0 || def.type !== "Variable") {
+    return false;
+  }
+  const declarator = def.node;
+  if (declarator.type !== "VariableDeclarator") {
+    return false;
+  }
+  return isStringLiteralInit(declarator.init);
+}
+function isInsideLoopBody(node) {
+  let child = node;
+  let parent = node.parent;
+  while (parent !== void 0 && parent !== null) {
+    if (LOOP_NODE_TYPES.has(parent.type)) {
+      const loop = parent;
+      if (loop.body === child) {
+        return true;
+      }
+    }
+    child = parent;
+    parent = parent.parent;
+  }
+  return false;
+}
+var no_string_concat_in_loop_default = import_utils11.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-string-concat-in-loop",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Disallow O(n^2) string building via `+=` on a string variable inside a loop; push parts to an array and `join` instead."
+    },
+    schema: [],
+    messages: {
+      noStringConcatInLoop: 'Avoid building a string with `+=` inside a loop \u2014 this is O(n^2). Push the parts onto an array and use `arr.join("")` after the loop.'
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      AssignmentExpression(node) {
+        if (node.operator !== "+=") {
+          return;
+        }
+        if (node.left.type !== "Identifier") {
+          return;
+        }
+        if (!isInsideLoopBody(node)) {
+          return;
+        }
+        const scope = context.sourceCode.getScope(node);
+        const variable = findVariable(scope, node.left.name);
+        if (variable === void 0) {
+          return;
+        }
+        if (!isStringInitializedVariable(variable)) {
+          return;
+        }
+        context.report({
+          node,
+          messageId: "noStringConcatInLoop"
+        });
+      }
+    };
+  }
+});
+
 // src/rules/no-unnecessary-use-client.ts
-var import_utils5 = require("@typescript-eslint/utils");
+var import_utils12 = require("@typescript-eslint/utils");
 var HOOK_REGEX = /^use([A-Z]|$)/;
 var EVENT_PROP_REGEX = /^on[A-Z]/;
 var ERROR_FILE_REGEX = /\b(?:global-)?error\.[jt]sx?$/;
@@ -403,16 +1027,16 @@ var BROWSER_GLOBALS = /* @__PURE__ */ new Set([
 ]);
 var CLIENT_ONLY_PACKAGES_REGEX = /^(?:@radix-ui\/|framer-motion|react-dom|react-day-picker|@floating-ui\/|react-select|react-toastify|react-hook-form|recharts|react-dropzone|react-slick|react-swipeable|react-resizable|react-draggable|react-beautiful-dnd|@hello-pangea\/dnd|react-virtualized|react-window|@tanstack\/react-table|@tanstack\/react-query|react-redux|recoil|jotai|zustand|@tippyjs\/react|react-color|react-datepicker|next-themes|react-helmet|react-helmet-async|styled-components|@emotion\/)/;
 var isUseClientDirective = (node) => {
-  return node.type === import_utils5.AST_NODE_TYPES.ExpressionStatement && node.expression.type === import_utils5.AST_NODE_TYPES.Literal && node.expression.value === "use client";
+  return node.type === import_utils12.AST_NODE_TYPES.ExpressionStatement && node.expression.type === import_utils12.AST_NODE_TYPES.Literal && node.expression.value === "use client";
 };
 var isGlobalReference = (node, context) => {
   if (!BROWSER_GLOBALS.has(node.name)) return false;
   const parent = node.parent;
   if (parent !== void 0) {
-    if (parent.type === import_utils5.AST_NODE_TYPES.MemberExpression && parent.property === node && !parent.computed) {
+    if (parent.type === import_utils12.AST_NODE_TYPES.MemberExpression && parent.property === node && !parent.computed) {
       return false;
     }
-    if (parent.type === import_utils5.AST_NODE_TYPES.Property && parent.key === node && !parent.computed) {
+    if (parent.type === import_utils12.AST_NODE_TYPES.Property && parent.key === node && !parent.computed) {
       return false;
     }
     if (parent.type.startsWith("TS")) {
@@ -429,7 +1053,7 @@ var isGlobalReference = (node, context) => {
   }
   return true;
 };
-var no_unnecessary_use_client_default = import_utils5.ESLintUtils.RuleCreator(
+var no_unnecessary_use_client_default = import_utils12.ESLintUtils.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "no-unnecessary-use-client",
@@ -452,13 +1076,13 @@ var no_unnecessary_use_client_default = import_utils5.ESLintUtils.RuleCreator(
     let directiveNode = null;
     let hasClientIndicator = false;
     const markIfHookOrContext = (callee) => {
-      if (callee.type === import_utils5.AST_NODE_TYPES.Identifier) {
+      if (callee.type === import_utils12.AST_NODE_TYPES.Identifier) {
         if (HOOK_REGEX.test(callee.name) || callee.name === "createContext") {
           hasClientIndicator = true;
         }
         return;
       }
-      if (callee.type === import_utils5.AST_NODE_TYPES.MemberExpression && callee.property.type === import_utils5.AST_NODE_TYPES.Identifier) {
+      if (callee.type === import_utils12.AST_NODE_TYPES.MemberExpression && callee.property.type === import_utils12.AST_NODE_TYPES.Identifier) {
         const name = callee.property.name;
         if (HOOK_REGEX.test(name) || name === "createContext") {
           hasClientIndicator = true;
@@ -468,7 +1092,7 @@ var no_unnecessary_use_client_default = import_utils5.ESLintUtils.RuleCreator(
     return {
       Program(node) {
         for (const stmt of node.body) {
-          if (stmt.type !== import_utils5.AST_NODE_TYPES.ExpressionStatement) break;
+          if (stmt.type !== import_utils12.AST_NODE_TYPES.ExpressionStatement) break;
           if (isUseClientDirective(stmt)) {
             directiveNode = stmt;
             break;
@@ -476,35 +1100,43 @@ var no_unnecessary_use_client_default = import_utils5.ESLintUtils.RuleCreator(
         }
       },
       CallExpression(node) {
+        if (directiveNode === null) return;
         markIfHookOrContext(node.callee);
       },
       JSXAttribute(node) {
-        if (node.name.type === import_utils5.AST_NODE_TYPES.JSXIdentifier && EVENT_PROP_REGEX.test(node.name.name)) {
+        if (directiveNode === null) return;
+        if (node.name.type === import_utils12.AST_NODE_TYPES.JSXIdentifier && EVENT_PROP_REGEX.test(node.name.name)) {
           hasClientIndicator = true;
         }
       },
       ImportDeclaration(node) {
+        if (directiveNode === null) return;
         if (typeof node.source.value === "string" && CLIENT_ONLY_PACKAGES_REGEX.test(node.source.value)) {
           hasClientIndicator = true;
         }
       },
       ExportNamedDeclaration(node) {
+        if (directiveNode === null) return;
         if (node.source !== null) {
           hasClientIndicator = true;
         }
       },
       ExportAllDeclaration(node) {
+        if (directiveNode === null) return;
         if (node.source !== null) {
           hasClientIndicator = true;
         }
       },
       ClassDeclaration() {
+        if (directiveNode === null) return;
         hasClientIndicator = true;
       },
       ClassExpression() {
+        if (directiveNode === null) return;
         hasClientIndicator = true;
       },
       Identifier(node) {
+        if (directiveNode === null) return;
         if (isGlobalReference(node, context)) {
           hasClientIndicator = true;
         }
@@ -521,14 +1153,98 @@ var no_unnecessary_use_client_default = import_utils5.ESLintUtils.RuleCreator(
   }
 });
 
+// src/rules/prefer-discriminated-union.ts
+var import_utils13 = require("@typescript-eslint/utils");
+var import_utils14 = require("@typescript-eslint/utils");
+var STATUS_MEMBER_NAMES = /* @__PURE__ */ new Set([
+  "success",
+  "ok",
+  "error",
+  "failed",
+  "isError"
+]);
+var MIN_OPTIONAL_MEMBERS = 2;
+function getMemberName(member) {
+  if (member.type !== import_utils14.AST_NODE_TYPES.TSPropertySignature) {
+    return null;
+  }
+  const { key } = member;
+  if (key.type === import_utils14.AST_NODE_TYPES.Identifier) {
+    return key.name;
+  }
+  if (key.type === import_utils14.AST_NODE_TYPES.Literal && typeof key.value === "string") {
+    return key.value;
+  }
+  return null;
+}
+function isBooleanTyped(member) {
+  return member.typeAnnotation?.typeAnnotation.type === import_utils14.AST_NODE_TYPES.TSBooleanKeyword;
+}
+function looksLikeMutuallyExclusiveState(typeLiteral) {
+  let hasStatusBoolean = false;
+  let optionalCount = 0;
+  for (const member of typeLiteral.members) {
+    if (member.type !== import_utils14.AST_NODE_TYPES.TSPropertySignature) {
+      continue;
+    }
+    if (member.optional) {
+      optionalCount += 1;
+    }
+    const name = getMemberName(member);
+    if (name !== null && STATUS_MEMBER_NAMES.has(name) && isBooleanTyped(member)) {
+      hasStatusBoolean = true;
+    }
+  }
+  return hasStatusBoolean && optionalCount >= MIN_OPTIONAL_MEMBERS;
+}
+var prefer_discriminated_union_default = import_utils13.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "prefer-discriminated-union",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Flag object types with a boolean status flag and many optionals; model them as a discriminated union instead."
+    },
+    schema: [],
+    messages: {
+      preferDiscriminatedUnion: "This object type uses a boolean status flag alongside several optional fields, which lets illegal states be representable. Model it as a `z.discriminatedUnion` / discriminated union (e.g. `{ ok: true; data: T } | { ok: false; error: E }`) to make illegal states unrepresentable."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    function checkTypeLiteral(typeLiteral, reportNode) {
+      if (looksLikeMutuallyExclusiveState(typeLiteral)) {
+        context.report({
+          node: reportNode,
+          messageId: "preferDiscriminatedUnion"
+        });
+      }
+    }
+    return {
+      TSInterfaceDeclaration(node) {
+        const synthetic = {
+          ...node.body,
+          type: import_utils14.AST_NODE_TYPES.TSTypeLiteral,
+          members: node.body.body
+        };
+        checkTypeLiteral(synthetic, node);
+      },
+      "TSTypeAliasDeclaration > TSTypeLiteral"(node) {
+        checkTypeLiteral(node, node.parent);
+      }
+    };
+  }
+});
+
 // src/rules/prefer-schema-for-api-payload.ts
-var import_utils6 = require("@typescript-eslint/utils");
+var import_utils15 = require("@typescript-eslint/utils");
 var unwrap = (node) => {
   let current = node;
   while (current !== null && current !== void 0) {
-    if (current.type === import_utils6.AST_NODE_TYPES.TSAsExpression || current.type === import_utils6.AST_NODE_TYPES.TSTypeAssertion || current.type === import_utils6.AST_NODE_TYPES.TSNonNullExpression || current.type === import_utils6.AST_NODE_TYPES.TSSatisfiesExpression) {
+    if (current.type === import_utils15.AST_NODE_TYPES.TSAsExpression || current.type === import_utils15.AST_NODE_TYPES.TSTypeAssertion || current.type === import_utils15.AST_NODE_TYPES.TSNonNullExpression || current.type === import_utils15.AST_NODE_TYPES.TSSatisfiesExpression) {
       current = current.expression;
-    } else if (current.type === import_utils6.AST_NODE_TYPES.ChainExpression) {
+    } else if (current.type === import_utils15.AST_NODE_TYPES.ChainExpression) {
       current = current.expression;
     } else {
       break;
@@ -539,20 +1255,20 @@ var unwrap = (node) => {
 var isJsonCall = (node) => {
   let current = unwrap(node);
   if (current === null) return false;
-  if (current.type === import_utils6.AST_NODE_TYPES.AwaitExpression) {
+  if (current.type === import_utils15.AST_NODE_TYPES.AwaitExpression) {
     current = unwrap(current.argument);
   }
-  if (current === null || current.type !== import_utils6.AST_NODE_TYPES.CallExpression) {
+  if (current === null || current.type !== import_utils15.AST_NODE_TYPES.CallExpression) {
     return false;
   }
   const callee = unwrap(current.callee);
-  if (callee === null || callee.type !== import_utils6.AST_NODE_TYPES.MemberExpression) {
+  if (callee === null || callee.type !== import_utils15.AST_NODE_TYPES.MemberExpression) {
     return false;
   }
   const property = unwrap(callee.property);
-  return property !== null && property.type === import_utils6.AST_NODE_TYPES.Identifier && property.name === "json";
+  return property !== null && property.type === import_utils15.AST_NODE_TYPES.Identifier && property.name === "json";
 };
-var findVariable = (scope, name) => {
+var findVariable2 = (scope, name) => {
   let current = scope;
   while (current !== null) {
     const variable = current.set.get(name);
@@ -563,13 +1279,13 @@ var findVariable = (scope, name) => {
 };
 var isUnvalidatedVariableRef = (node, scope, tracked) => {
   const unwrapped = unwrap(node);
-  if (unwrapped === null || unwrapped.type !== import_utils6.AST_NODE_TYPES.Identifier) {
+  if (unwrapped === null || unwrapped.type !== import_utils15.AST_NODE_TYPES.Identifier) {
     return false;
   }
-  const variable = findVariable(scope, unwrapped.name);
+  const variable = findVariable2(scope, unwrapped.name);
   return variable !== null && tracked.has(variable);
 };
-var prefer_schema_for_api_payload_default = import_utils6.ESLintUtils.RuleCreator(
+var prefer_schema_for_api_payload_default = import_utils15.ESLintUtils.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "prefer-schema-for-api-payload",
@@ -597,11 +1313,11 @@ var prefer_schema_for_api_payload_default = import_utils6.ESLintUtils.RuleCreato
     return {
       VariableDeclarator(node) {
         const scope = context.sourceCode.getScope(node);
-        if (node.id.type === import_utils6.AST_NODE_TYPES.Identifier) {
+        if (node.id.type === import_utils15.AST_NODE_TYPES.Identifier) {
           trackInitializer(node);
           return;
         }
-        if (node.id.type === import_utils6.AST_NODE_TYPES.ObjectPattern || node.id.type === import_utils6.AST_NODE_TYPES.ArrayPattern) {
+        if (node.id.type === import_utils15.AST_NODE_TYPES.ObjectPattern || node.id.type === import_utils15.AST_NODE_TYPES.ArrayPattern) {
           if (isJsonCall(node.init)) {
             context.report({ node: node.id, messageId: "unparsedJsonAccess" });
             return;
@@ -613,8 +1329,8 @@ var prefer_schema_for_api_payload_default = import_utils6.ESLintUtils.RuleCreato
       },
       AssignmentExpression(node) {
         const scope = context.sourceCode.getScope(node);
-        if (node.left.type === import_utils6.AST_NODE_TYPES.Identifier) {
-          const variable = findVariable(scope, node.left.name);
+        if (node.left.type === import_utils15.AST_NODE_TYPES.Identifier) {
+          const variable = findVariable2(scope, node.left.name);
           if (variable === null) return;
           if (isJsonCall(node.right)) {
             unvalidatedVariables.add(variable);
@@ -623,7 +1339,7 @@ var prefer_schema_for_api_payload_default = import_utils6.ESLintUtils.RuleCreato
           }
           return;
         }
-        if (node.left.type === import_utils6.AST_NODE_TYPES.ObjectPattern || node.left.type === import_utils6.AST_NODE_TYPES.ArrayPattern) {
+        if (node.left.type === import_utils15.AST_NODE_TYPES.ObjectPattern || node.left.type === import_utils15.AST_NODE_TYPES.ArrayPattern) {
           if (isJsonCall(node.right)) {
             context.report({
               node: node.left,
@@ -644,15 +1360,15 @@ var prefer_schema_for_api_payload_default = import_utils6.ESLintUtils.RuleCreato
         const obj = unwrap(node.object);
         if (isJsonCall(obj)) {
           const parent = node.parent;
-          if (parent.type === import_utils6.AST_NODE_TYPES.CallExpression && parent.callee === node && node.property.type === import_utils6.AST_NODE_TYPES.Identifier && (node.property.name === "parse" || node.property.name === "safeParse")) {
+          if (parent.type === import_utils15.AST_NODE_TYPES.CallExpression && parent.callee === node && node.property.type === import_utils15.AST_NODE_TYPES.Identifier && (node.property.name === "parse" || node.property.name === "safeParse")) {
             return;
           }
           context.report({ node, messageId: "unparsedJsonAccess" });
           return;
         }
-        if (obj !== null && obj.type === import_utils6.AST_NODE_TYPES.Identifier && isUnvalidatedVariableRef(obj, scope, unvalidatedVariables)) {
+        if (obj !== null && obj.type === import_utils15.AST_NODE_TYPES.Identifier && isUnvalidatedVariableRef(obj, scope, unvalidatedVariables)) {
           context.report({ node, messageId: "unparsedJsonAccess" });
-          const variable = findVariable(scope, obj.name);
+          const variable = findVariable2(scope, obj.name);
           if (variable !== null) {
             unvalidatedVariables.delete(variable);
           }
@@ -662,8 +1378,153 @@ var prefer_schema_for_api_payload_default = import_utils6.ESLintUtils.RuleCreato
   }
 });
 
+// src/rules/prefer-semantic-colors.ts
+var import_utils16 = require("@typescript-eslint/utils");
+
+// src/rules/_tailwind.ts
+var tailwindBase = (token) => token.replace(/^(?:[a-z0-9-]+:)+/i, "").replace(/^!/, "");
+var classTokens = (value) => value.split(/\s+/).filter(Boolean);
+
+// src/rules/prefer-semantic-colors.ts
+var COLOR_PREFIXES = "text|bg|border(?:-[trblxyse])?|ring(?:-offset)?|fill|stroke|from|via|to|divide|decoration|placeholder|accent|caret|shadow|outline";
+var PALETTE = "red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose|slate|gray|zinc|neutral|stone";
+var COLOR_FN = "rgba?|hsla?|hwb|oklch|oklab|lab|lch|color";
+var RAW_PALETTE_RE = new RegExp(`^(?:${COLOR_PREFIXES})-(?:${PALETTE})-\\d{2,3}(?:/\\d{1,3})?$`);
+var ARBITRARY_COLOR_RE = new RegExp(
+  `^(?:${COLOR_PREFIXES})-\\[(?:#[0-9a-fA-F]{3,8}|(?:${COLOR_FN})\\([^\\]]*\\))\\]$`,
+  "i"
+);
+var CLASS_FNS = /* @__PURE__ */ new Set(["cn", "clsx", "cva", "tv", "cx", "twMerge", "classnames", "classNames"]);
+var CLASS_NAME_RE = /class/i;
+var STYLE_COLOR_PROPS = /* @__PURE__ */ new Set([
+  "color",
+  "background",
+  "backgroundColor",
+  "borderColor",
+  "borderTopColor",
+  "borderRightColor",
+  "borderBottomColor",
+  "borderLeftColor",
+  "outlineColor",
+  "caretColor",
+  "textDecorationColor",
+  "columnRuleColor",
+  "fill",
+  "stroke",
+  "stopColor",
+  "floodColor",
+  "lightingColor"
+]);
+var RAW_COLOR_VALUE_RE = new RegExp(`#[0-9a-fA-F]{3,8}\\b|\\b(?:${COLOR_FN})\\s*\\(`, "i");
+var propName = (key) => {
+  if (key.type === import_utils16.AST_NODE_TYPES.Identifier) return key.name;
+  if (key.type === import_utils16.AST_NODE_TYPES.Literal && typeof key.value === "string") return key.value;
+  return null;
+};
+var prefer_semantic_colors_default = import_utils16.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "prefer-semantic-colors",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Enforce design-system semantic color tokens (bg-primary, text-destructive, \u2026) over raw Tailwind palette classes (text-red-500), arbitrary color values (bg-[#fff]), and inline color literals."
+    },
+    schema: [],
+    messages: {
+      rawPalette: "Raw palette class '{{class}}' \u2014 use a semantic token (e.g. text-foreground, bg-primary, text-destructive, bg-muted).",
+      arbitraryColor: "Hardcoded color '{{class}}' \u2014 use a semantic token, or var(--\u2026). For charts/brand add an eslint-disable with a reason.",
+      inlineColor: "Hardcoded color '{{value}}' \u2014 use a semantic token / CSS variable. For charts/standalone pages add an eslint-disable with a reason."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const reportClasses = (value, node) => {
+      for (const token of classTokens(value)) {
+        const base = tailwindBase(token);
+        if (RAW_PALETTE_RE.test(base)) {
+          context.report({ node, messageId: "rawPalette", data: { class: token } });
+        } else if (ARBITRARY_COLOR_RE.test(base)) {
+          context.report({ node, messageId: "arbitraryColor", data: { class: token } });
+        }
+      }
+    };
+    const checkClassNode = (node) => {
+      if (node === null) return;
+      switch (node.type) {
+        case import_utils16.AST_NODE_TYPES.Literal:
+          if (typeof node.value === "string") reportClasses(node.value, node);
+          break;
+        case import_utils16.AST_NODE_TYPES.TemplateLiteral:
+          for (const quasi of node.quasis) reportClasses(quasi.value.cooked ?? "", quasi);
+          break;
+        case import_utils16.AST_NODE_TYPES.ArrayExpression:
+          for (const element of node.elements) {
+            if (element !== null && element.type !== import_utils16.AST_NODE_TYPES.SpreadElement) checkClassNode(element);
+          }
+          break;
+        case import_utils16.AST_NODE_TYPES.ObjectExpression:
+          for (const property of node.properties) {
+            if (property.type === import_utils16.AST_NODE_TYPES.Property) checkClassNode(property.value);
+          }
+          break;
+        case import_utils16.AST_NODE_TYPES.ConditionalExpression:
+          checkClassNode(node.consequent);
+          checkClassNode(node.alternate);
+          break;
+        case import_utils16.AST_NODE_TYPES.LogicalExpression:
+          checkClassNode(node.right);
+          break;
+        default:
+          break;
+      }
+    };
+    const checkColorValueNode = (node) => {
+      if (node.type === import_utils16.AST_NODE_TYPES.Literal && typeof node.value === "string" && RAW_COLOR_VALUE_RE.test(node.value)) {
+        context.report({ node, messageId: "inlineColor", data: { value: node.value } });
+      }
+    };
+    return {
+      "JSXAttribute[name.name='className']"(node) {
+        if (node.value === null) return;
+        if (node.value.type === import_utils16.AST_NODE_TYPES.Literal) checkClassNode(node.value);
+        else if (node.value.type === import_utils16.AST_NODE_TYPES.JSXExpressionContainer) {
+          if (node.value.expression.type !== import_utils16.AST_NODE_TYPES.JSXEmptyExpression) {
+            checkClassNode(node.value.expression);
+          }
+        }
+      },
+      CallExpression(node) {
+        if (node.callee.type === import_utils16.AST_NODE_TYPES.Identifier && CLASS_FNS.has(node.callee.name)) {
+          for (const arg of node.arguments) {
+            if (arg.type !== import_utils16.AST_NODE_TYPES.SpreadElement) checkClassNode(arg);
+          }
+        }
+      },
+      VariableDeclarator(node) {
+        if (node.id.type === import_utils16.AST_NODE_TYPES.Identifier && CLASS_NAME_RE.test(node.id.name)) {
+          checkClassNode(node.init);
+        }
+      },
+      Property(node) {
+        const name = propName(node.key);
+        if (name !== null && CLASS_NAME_RE.test(name)) checkClassNode(node.value);
+      },
+      // SVG presentation attributes: <path fill="#000" stroke="#fff" />
+      "JSXAttribute[name.name=/^(fill|stroke|color)$/]"(node) {
+        if (node.value?.type === import_utils16.AST_NODE_TYPES.Literal) checkColorValueNode(node.value);
+      },
+      // Inline style objects: style={{ color: "#111827", backgroundColor: "#fff" }}
+      "JSXAttribute[name.name='style'] ObjectExpression > Property"(node) {
+        const name = propName(node.key);
+        if (name !== null && STYLE_COLOR_PROPS.has(name)) checkColorValueNode(node.value);
+      }
+    };
+  }
+});
+
 // src/rules/prefer-server-actions.ts
-var import_utils7 = require("@typescript-eslint/utils");
+var import_utils17 = require("@typescript-eslint/utils");
 var MUTATION_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "DELETE", "PATCH"]);
 var AXIOS_MUTATION_METHODS = /* @__PURE__ */ new Set(["post", "put", "delete", "patch"]);
 var SKIP_FILE_REGEX = /(?:\.test\.[jt]sx?$|\.spec\.[jt]sx?$|\/tests?\/|\/__tests__\/|\/scripts?\/|\/app\/api\/.*\/route\.[jt]sx?$|\/pages\/api\/)/;
@@ -723,7 +1584,7 @@ function isMutationMethod(node, context) {
   }
   return false;
 }
-function getPropertyNode(objNode, propName) {
+function getPropertyNode(objNode, propName2) {
   if (!objNode || objNode.type !== "ObjectExpression") return null;
   for (const prop of objNode.properties) {
     if (prop.type !== "Property") continue;
@@ -733,7 +1594,7 @@ function getPropertyNode(objNode, propName) {
     } else if (prop.key.type === "Literal" && typeof prop.key.value === "string") {
       keyName = prop.key.value;
     }
-    if (keyName === propName) {
+    if (keyName === propName2) {
       if (prop.value.type === "AssignmentPattern" || prop.value.type === "ArrayPattern" || prop.value.type === "ObjectPattern") {
         return null;
       }
@@ -742,7 +1603,7 @@ function getPropertyNode(objNode, propName) {
   }
   return null;
 }
-var prefer_server_actions_default = import_utils7.ESLintUtils.RuleCreator(
+var prefer_server_actions_default = import_utils17.ESLintUtils.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "prefer-server-actions",
@@ -781,7 +1642,10 @@ var prefer_server_actions_default = import_utils7.ESLintUtils.RuleCreator(
           const methodName = node.callee.property.name.toLowerCase();
           if (AXIOS_MUTATION_METHODS.has(methodName)) {
             const urlArg = node.arguments[0];
-            if (urlArg && urlArg.type !== "SpreadElement" && isApiUrl(urlArg, context)) {
+            const hasHandlerArg = node.arguments.some(
+              (arg) => arg.type === "ArrowFunctionExpression" || arg.type === "FunctionExpression"
+            );
+            if (urlArg && urlArg.type !== "SpreadElement" && !hasHandlerArg && isApiUrl(urlArg, context)) {
               isMutation = true;
             }
           }
@@ -807,14 +1671,14 @@ var prefer_server_actions_default = import_utils7.ESLintUtils.RuleCreator(
 });
 
 // src/rules/prefer-shadcn.ts
-var import_utils8 = require("@typescript-eslint/utils");
+var import_utils18 = require("@typescript-eslint/utils");
 var REPLACEMENTS = {
   input: "Input",
   select: "Select",
   textarea: "Textarea",
   dialog: "Dialog"
 };
-var prefer_shadcn_default = import_utils8.ESLintUtils.RuleCreator(
+var prefer_shadcn_default = import_utils18.ESLintUtils.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "prefer-shadcn",
@@ -855,36 +1719,52 @@ var prefer_shadcn_default = import_utils8.ESLintUtils.RuleCreator(
 });
 
 // src/rules/require-assert-never.ts
-var import_utils9 = require("@typescript-eslint/utils");
+var import_utils19 = require("@typescript-eslint/utils");
 var isAssertNeverCall = (expression) => {
-  if (expression.type !== import_utils9.AST_NODE_TYPES.CallExpression) return false;
+  if (expression.type !== import_utils19.AST_NODE_TYPES.CallExpression) return false;
   const callee = expression.callee;
-  return callee.type === import_utils9.AST_NODE_TYPES.Identifier && callee.name === "assertNever";
+  if (callee.type === import_utils19.AST_NODE_TYPES.Identifier) {
+    return callee.name === "assertNever";
+  }
+  if (callee.type === import_utils19.AST_NODE_TYPES.MemberExpression && !callee.computed && callee.property.type === import_utils19.AST_NODE_TYPES.Identifier) {
+    return callee.property.name === "assertNever";
+  }
+  return false;
 };
 var statementContainsAssertNever = (statement) => {
-  if (statement.type === import_utils9.AST_NODE_TYPES.ExpressionStatement) {
+  if (statement.type === import_utils19.AST_NODE_TYPES.ExpressionStatement) {
     return isAssertNeverCall(statement.expression);
   }
-  if (statement.type === import_utils9.AST_NODE_TYPES.ThrowStatement) {
+  if (statement.type === import_utils19.AST_NODE_TYPES.ThrowStatement) {
     return isAssertNeverCall(statement.argument);
   }
-  if (statement.type === import_utils9.AST_NODE_TYPES.BlockStatement) {
+  if (statement.type === import_utils19.AST_NODE_TYPES.ReturnStatement) {
+    return statement.argument !== null && isAssertNeverCall(statement.argument);
+  }
+  if (statement.type === import_utils19.AST_NODE_TYPES.BlockStatement) {
     return statement.body.some(statementContainsAssertNever);
   }
   return false;
 };
-var require_assert_never_default = import_utils9.ESLintUtils.RuleCreator(
+var isRuntimeHandlingStatement = (statement) => {
+  if (statement.type === import_utils19.AST_NODE_TYPES.EmptyStatement) return false;
+  if (statement.type === import_utils19.AST_NODE_TYPES.BlockStatement) {
+    return statement.body.some(isRuntimeHandlingStatement);
+  }
+  return true;
+};
+var require_assert_never_default = import_utils19.ESLintUtils.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "require-assert-never",
   meta: {
     type: "problem",
     docs: {
-      description: "Require switch statements to end with `assertNever(_)` in their default case so that discriminated unions are exhaustively checked at compile time."
+      description: "Require an exhaustive-style switch whose `default` case does no runtime work to call `assertNever(_)` so that discriminated unions are exhaustively checked at compile time. Switches with a legitimate runtime default (a reducer's `return state`, an HTTP-status `return fallback()`, a `break`, a `throw`, etc.) are left alone."
     },
     schema: [],
     messages: {
-      missingAssertNever: "Switch statement default case must call assertNever() for exhaustive type checking"
+      missingAssertNever: "Empty switch `default` case \u2014 add runtime handling or call `assertNever()` so the discriminated union is exhaustively checked at compile time."
     }
   },
   defaultOptions: [],
@@ -895,10 +1775,8 @@ var require_assert_never_default = import_utils9.ESLintUtils.RuleCreator(
           (caseNode) => caseNode.test === null
         );
         if (!defaultCase) return;
-        const hasAssertNever = defaultCase.consequent.some(
-          statementContainsAssertNever
-        );
-        if (hasAssertNever) return;
+        if (defaultCase.consequent.some(statementContainsAssertNever)) return;
+        if (defaultCase.consequent.some(isRuntimeHandlingStatement)) return;
         context.report({
           node: defaultCase,
           messageId: "missingAssertNever"
@@ -909,43 +1787,91 @@ var require_assert_never_default = import_utils9.ESLintUtils.RuleCreator(
 });
 
 // src/rules/require-zod-form-validation.ts
-var import_utils10 = require("@typescript-eslint/utils");
-var isFormDataGetCall = (node) => {
-  const callee = node.callee;
-  if (callee.type !== import_utils10.AST_NODE_TYPES.MemberExpression) return false;
-  if (callee.property.type !== import_utils10.AST_NODE_TYPES.Identifier || callee.property.name !== "get") {
+var import_utils20 = require("@typescript-eslint/utils");
+var ZOD_SCHEMA_NAME_RE = /Schema$|^Z[A-Z]/;
+var looksLikeZodSchema = (node) => {
+  let current = node;
+  while (true) {
+    if (current.type === import_utils20.AST_NODE_TYPES.Identifier) {
+      return current.name === "z" || ZOD_SCHEMA_NAME_RE.test(current.name);
+    }
+    if (current.type === import_utils20.AST_NODE_TYPES.CallExpression) {
+      current = current.callee;
+      continue;
+    }
+    if (current.type === import_utils20.AST_NODE_TYPES.MemberExpression) {
+      current = current.object;
+      continue;
+    }
     return false;
   }
-  return callee.object.type === import_utils10.AST_NODE_TYPES.Identifier && callee.object.name === "formData";
 };
-var isParseCallExpression = (node) => {
-  if (node.type !== import_utils10.AST_NODE_TYPES.CallExpression) return false;
+var isZodParseCall = (node) => {
+  if (node.type !== import_utils20.AST_NODE_TYPES.CallExpression) return false;
   const callee = node.callee;
-  if (callee.type !== import_utils10.AST_NODE_TYPES.MemberExpression) return false;
-  return callee.property.type === import_utils10.AST_NODE_TYPES.Identifier && callee.property.name === "parse";
+  if (callee.type !== import_utils20.AST_NODE_TYPES.MemberExpression) return false;
+  if (callee.computed) return false;
+  if (callee.property.type !== import_utils20.AST_NODE_TYPES.Identifier) return false;
+  const method = callee.property.name;
+  if (method !== "parse" && method !== "safeParse") return false;
+  return looksLikeZodSchema(callee.object);
 };
-var require_zod_form_validation_default = import_utils10.ESLintUtils.RuleCreator(
+var isFormDataMethodCall = (node) => {
+  let current = node;
+  if (current.type === import_utils20.AST_NODE_TYPES.AwaitExpression) {
+    current = current.argument;
+  }
+  if (current.type !== import_utils20.AST_NODE_TYPES.CallExpression) return false;
+  const callee = current.callee;
+  return callee.type === import_utils20.AST_NODE_TYPES.MemberExpression && !callee.computed && callee.property.type === import_utils20.AST_NODE_TYPES.Identifier && callee.property.name === "formData";
+};
+var require_zod_form_validation_default = import_utils20.ESLintUtils.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "require-zod-form-validation",
   meta: {
     type: "problem",
     docs: {
-      description: "Require Zod validation (`Schema.parse(...)`) when reading values out of a `FormData` object."
+      description: "Require Zod validation (`Schema.parse(...)` / `Schema.safeParse(...)`) when reading values out of a `FormData` object."
     },
     schema: [],
     messages: {
-      missingZodValidation: "FormData parsing must use Zod schema validation (e.g., Schema.parse())"
+      missingZodValidation: "FormData parsing must use Zod schema validation (e.g., Schema.parse() / Schema.safeParse())"
     }
   },
   defaultOptions: [],
   create(context) {
+    const isFormSourceIdentifier = (node) => {
+      if (node.type !== import_utils20.AST_NODE_TYPES.Identifier) return false;
+      if (/formdata/i.test(node.name)) return true;
+      let scope = context.sourceCode.getScope(node);
+      while (scope !== null) {
+        const variable = scope.set.get(node.name);
+        if (variable !== void 0 && variable.defs.length === 1) {
+          const def = variable.defs[0];
+          if (def !== void 0 && def.type === "Variable" && def.node.type === import_utils20.AST_NODE_TYPES.VariableDeclarator && def.node.init !== null) {
+            return isFormDataMethodCall(def.node.init);
+          }
+          return false;
+        }
+        scope = scope.upper;
+      }
+      return false;
+    };
+    const isFormDataGetCall = (node) => {
+      const callee = node.callee;
+      if (callee.type !== import_utils20.AST_NODE_TYPES.MemberExpression) return false;
+      if (callee.property.type !== import_utils20.AST_NODE_TYPES.Identifier || callee.property.name !== "get") {
+        return false;
+      }
+      return isFormSourceIdentifier(callee.object);
+    };
     return {
       CallExpression(node) {
         if (!isFormDataGetCall(node)) return;
         let parent = node.parent;
         while (parent !== null && parent !== void 0) {
-          if (isParseCallExpression(parent)) return;
+          if (isZodParseCall(parent)) return;
           parent = parent.parent;
         }
         context.report({
@@ -958,15 +1884,15 @@ var require_zod_form_validation_default = import_utils10.ESLintUtils.RuleCreator
 });
 
 // src/rules/zod-naming-convention.ts
-var import_utils11 = require("@typescript-eslint/utils");
+var import_utils21 = require("@typescript-eslint/utils");
 var calleeChainStartsWithZ = (node) => {
   let current = node;
-  while (current.type === import_utils11.AST_NODE_TYPES.MemberExpression) {
+  while (current.type === import_utils21.AST_NODE_TYPES.MemberExpression) {
     const receiver = current.object;
-    if (receiver.type === import_utils11.AST_NODE_TYPES.Identifier && receiver.name === "z") {
+    if (receiver.type === import_utils21.AST_NODE_TYPES.Identifier && receiver.name === "z") {
       return true;
     }
-    if (receiver.type === import_utils11.AST_NODE_TYPES.CallExpression) {
+    if (receiver.type === import_utils21.AST_NODE_TYPES.CallExpression) {
       current = receiver.callee;
       continue;
     }
@@ -974,7 +1900,7 @@ var calleeChainStartsWithZ = (node) => {
   }
   return false;
 };
-var zod_naming_convention_default = import_utils11.ESLintUtils.RuleCreator(
+var zod_naming_convention_default = import_utils21.ESLintUtils.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "zod-naming-convention",
@@ -994,11 +1920,11 @@ var zod_naming_convention_default = import_utils11.ESLintUtils.RuleCreator(
       VariableDeclarator(node) {
         const init = node.init;
         if (init === null || init === void 0) return;
-        if (init.type !== import_utils11.AST_NODE_TYPES.CallExpression) return;
+        if (init.type !== import_utils21.AST_NODE_TYPES.CallExpression) return;
         const callee = init.callee;
-        if (callee.type !== import_utils11.AST_NODE_TYPES.MemberExpression) return;
+        if (callee.type !== import_utils21.AST_NODE_TYPES.MemberExpression) return;
         if (!calleeChainStartsWithZ(callee)) return;
-        if (node.id.type !== import_utils11.AST_NODE_TYPES.Identifier) return;
+        if (node.id.type !== import_utils21.AST_NODE_TYPES.Identifier) return;
         const variableName = node.id.name;
         if (variableName.startsWith("Z")) return;
         context.report({
@@ -1014,10 +1940,19 @@ var zod_naming_convention_default = import_utils11.ESLintUtils.RuleCreator(
 var rules = {
   "enforce-file-structure": enforce_file_structure_default,
   "no-client-side-data-fetching": no_client_side_data_fetching_default,
+  "no-comment-cruft": no_comment_cruft_default,
   "no-enum": no_enum_default,
+  "no-insecure-random-id": no_insecure_random_id_default,
+  "no-json-stringify-error": no_json_stringify_error_default,
+  "no-log-only-catch": no_log_only_catch_default,
   "no-raw-env": no_raw_env_default,
+  "no-sentinel-return-on-catch": no_sentinel_return_on_catch_default,
+  "no-sequential-await": no_sequential_await_default,
+  "no-string-concat-in-loop": no_string_concat_in_loop_default,
   "no-unnecessary-use-client": no_unnecessary_use_client_default,
+  "prefer-discriminated-union": prefer_discriminated_union_default,
   "prefer-schema-for-api-payload": prefer_schema_for_api_payload_default,
+  "prefer-semantic-colors": prefer_semantic_colors_default,
   "prefer-server-actions": prefer_server_actions_default,
   "prefer-shadcn": prefer_shadcn_default,
   "require-assert-never": require_assert_never_default,
@@ -1027,7 +1962,7 @@ var rules = {
 var plugin = {
   meta: {
     name: "@sarj/eslint-plugin",
-    version: "2.0.0"
+    version: "2.2.0"
   },
   rules,
   configs: {
@@ -1041,7 +1976,18 @@ var plugin = {
         "@sarj/no-client-side-data-fetching": "warn",
         "@sarj/prefer-server-actions": "warn",
         "@sarj/no-unnecessary-use-client": "warn",
-        "@sarj/prefer-schema-for-api-payload": "warn"
+        "@sarj/prefer-schema-for-api-payload": "warn",
+        // Distilled from sarj-audit skills — warn in recommended, error in strict.
+        "@sarj/no-sequential-await": "warn",
+        "@sarj/no-sentinel-return-on-catch": "warn",
+        "@sarj/no-log-only-catch": "warn",
+        "@sarj/no-insecure-random-id": "warn",
+        "@sarj/no-json-stringify-error": "warn",
+        "@sarj/no-string-concat-in-loop": "warn",
+        "@sarj/prefer-discriminated-union": "warn",
+        "@sarj/no-comment-cruft": "warn",
+        // Frontend / styling — distilled from frontend PR-review mining.
+        "@sarj/prefer-semantic-colors": "warn"
       }
     },
     strict: {
@@ -1057,7 +2003,19 @@ var plugin = {
         "@sarj/no-client-side-data-fetching": "error",
         "@sarj/prefer-server-actions": "error",
         "@sarj/no-unnecessary-use-client": "error",
-        "@sarj/prefer-schema-for-api-payload": "error"
+        "@sarj/prefer-schema-for-api-payload": "error",
+        // Distilled from sarj-audit skills.
+        "@sarj/no-sequential-await": "error",
+        "@sarj/no-sentinel-return-on-catch": "error",
+        "@sarj/no-log-only-catch": "error",
+        "@sarj/no-insecure-random-id": "error",
+        "@sarj/no-json-stringify-error": "error",
+        "@sarj/no-string-concat-in-loop": "error",
+        "@sarj/prefer-discriminated-union": "error",
+        "@sarj/no-comment-cruft": "error",
+        // Frontend / styling — distilled from frontend PR-review mining. Stylistic,
+        // no autofix → warn (rollout should prove the FP rate before raising it).
+        "@sarj/prefer-semantic-colors": "warn"
       }
     }
   }