@sarj/eslint-plugin 2.1.1 → 2.3.0

package/dist/index.js

@@ -1,45 +1,30 @@
 // src/rules/enforce-file-structure.ts
 import { ESLintUtils, AST_NODE_TYPES } from "@typescript-eslint/utils";
 var SECTION = {
-  imports: 0,
-  types: 1,
-  constants: 2,
-  functions: 3,
-  exports: 4
+  declarations: 0,
+  functions: 1,
+  exports: 2
 };
-var SECTION_NAMES = [
-  "imports",
-  "types",
-  "constants",
-  "functions",
-  "exports"
-];
+var SECTION_NAMES = ["declarations", "functions", "exports"];
 var sectionName = (ordinal) => {
   const name = SECTION_NAMES[ordinal];
   return name ?? "unknown";
 };
-var isConstantNamed = (declarator) => {
-  if (declarator.id.type !== AST_NODE_TYPES.Identifier) return false;
-  const name = declarator.id.name;
-  return name.length > 0 && name === name.toUpperCase();
-};
+var SERVER_ACTION_FILE_RE = /(?:^|\/)actions\/|\.action\.[jt]sx?$|(?:^|\/)actions\.[jt]sx?$/;
+var isFunctionExpression = (node) => node.type === AST_NODE_TYPES.ArrowFunctionExpression || node.type === AST_NODE_TYPES.FunctionExpression;
+var isFunctionLikeVariable = (statement) => statement.declarations.length > 0 && statement.declarations.every(
+  (decl) => decl.init !== null && isFunctionExpression(decl.init)
+);
 var getStatementSection = (statement) => {
   switch (statement.type) {
     case AST_NODE_TYPES.ImportDeclaration:
-      return SECTION.imports;
     case AST_NODE_TYPES.TSTypeAliasDeclaration:
     case AST_NODE_TYPES.TSInterfaceDeclaration:
     case AST_NODE_TYPES.TSEnumDeclaration:
-      return SECTION.types;
-    case AST_NODE_TYPES.VariableDeclaration: {
-      if (statement.kind === "const") {
-        const firstDeclarator = statement.declarations[0];
-        if (firstDeclarator !== void 0 && isConstantNamed(firstDeclarator)) {
-          return SECTION.constants;
-        }
-      }
-      return SECTION.functions;
-    }
+    case AST_NODE_TYPES.ClassDeclaration:
+      return SECTION.declarations;
+    case AST_NODE_TYPES.VariableDeclaration:
+      return isFunctionLikeVariable(statement) ? SECTION.functions : SECTION.declarations;
     case AST_NODE_TYPES.FunctionDeclaration:
       return SECTION.functions;
     case AST_NODE_TYPES.ExportNamedDeclaration:
@@ -64,7 +49,7 @@ var enforce_file_structure_default = ESLintUtils.RuleCreator(
   meta: {
     type: "suggestion",
     docs: {
-      description: "Enforce a canonical top-of-file ordering: imports -> types -> constants -> functions -> exports. Server-action files (under `/actions/` or with `action` in the path) must also begin with a `use server` directive."
+      description: "Enforce that function definitions follow the file's top-of-file declarations (imports, types, constants, classes) \u2014 the stepdown rule. Ordering among non-function declarations is not enforced. Server-action files (under `/actions/`, named `*.action.ts`, or `actions.ts`) must also begin with a `use server` directive."
     },
     schema: [],
     messages: {
@@ -75,7 +60,7 @@ var enforce_file_structure_default = ESLintUtils.RuleCreator(
   defaultOptions: [],
   create(context) {
     const filename = context.filename;
-    const isServerAction = filename.includes("/actions/") || filename.includes("action");
+    const isServerAction = SERVER_ACTION_FILE_RE.test(filename);
     return {
       Program(node) {
         const body = node.body;
@@ -88,9 +73,8 @@ var enforce_file_structure_default = ESLintUtils.RuleCreator(
             });
           }
         }
-        let currentSection = SECTION.imports;
+        let currentSection = SECTION.declarations;
         for (const statement of body) {
-          if (isUseServerDirective(statement)) continue;
           if (statement.type === AST_NODE_TYPES.ExpressionStatement && statement.expression.type === AST_NODE_TYPES.Literal && typeof statement.expression.value === "string" && statement.expression.value.startsWith("use ")) {
             continue;
           }
@@ -129,7 +113,7 @@ var HTTP_METHOD_NAMES = /* @__PURE__ */ new Set([
   "head",
   "options"
 ]);
-var ANALYTICS_KEYWORDS = [
+var ANALYTICS_SEGMENTS = /* @__PURE__ */ new Set([
   "analytics",
   "telemetry",
   "track",
@@ -138,7 +122,7 @@ var ANALYTICS_KEYWORDS = [
   "beacon",
   "metrics",
   "event"
-];
+]);
 function isEffectHookCall(node) {
   const callee = node.callee;
   if (callee.type === AST_NODE_TYPES2.Identifier) {
@@ -212,7 +196,7 @@ function extractUrlString(node) {
 function isAnalyticsCall(node) {
   const url = extractUrlString(node).toLowerCase();
   if (url === "") return false;
-  return ANALYTICS_KEYWORDS.some((keyword) => url.includes(keyword));
+  return url.split(/[/.]/).some((segment) => ANALYTICS_SEGMENTS.has(segment));
 }
 var no_client_side_data_fetching_default = ESLintUtils2.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
@@ -251,8 +235,105 @@ var no_client_side_data_fetching_default = ESLintUtils2.RuleCreator(
   }
 });
 
-// src/rules/no-enum.ts
+// src/rules/no-comment-cruft.ts
 import { ESLintUtils as ESLintUtils3 } from "@typescript-eslint/utils";
+var LEADING_PREAMBLE_MIN = 4;
+var DIRECTIVE_RE = /^(eslint\b|eslint-|@ts-|prettier-ignore|prettier\b|biome-|c8\b|v8\b|istanbul\b|@type\b|@vite|webpack|<reference|global\b|noinspection|todo\b|fixme\b|hack\b|xxx\b)/i;
+var LICENSE_RE = /copyright|licen[cs]ed?|spdx|permission is hereby granted|all rights reserved/i;
+var BANNER_FULL_RE = /^[\s\-=*#~_+.]{4,}$/;
+var BANNER_RUN_RE = /={4,}|-{4,}|#{4,}|\*{4,}|~{4,}/;
+var REGION_RE = /^#?(?:end)?region\b/i;
+var CODE_KEYWORD_RE = /^(import |export |const |let |var |function\b|class |interface |type \w|enum |return\b|throw |await |async |if\s*\(|for\s*\(|while\s*\(|switch\s*\(|new |console\.)/;
+var CODE_TAIL_RE = /[;{}()]\s*$|=>\s*$|,\s*$/;
+var CALL_OR_ASSIGN_RE = /^[A-Za-z_$][\w.$[\]]*\s*(?:=(?![=>])|\+=|-=|\*=)\s*\S.*[;)}\]]\s*$|^[A-Za-z_$][\w.$]*\([^)]*\)\s*;?\s*$/;
+function stripCommentMarker(line) {
+  return line.replace(/^\s*\/\//, "").replace(/^\s*\*+/, "").trim();
+}
+function isDirective(text) {
+  return DIRECTIVE_RE.test(text.trim());
+}
+function isBanner(text) {
+  const t = text.trim();
+  if (!t) return false;
+  return BANNER_FULL_RE.test(t) || BANNER_RUN_RE.test(t) || REGION_RE.test(t);
+}
+function looksLikeCode(text) {
+  const t = text.trim();
+  if (!t) return false;
+  if (CODE_KEYWORD_RE.test(t) && CODE_TAIL_RE.test(t)) return true;
+  return CALL_OR_ASSIGN_RE.test(t);
+}
+var no_comment_cruft_default = ESLintUtils3.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-comment-cruft",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Flag commented-out code, section-banner comments, and leading file-header comment preambles."
+    },
+    schema: [],
+    messages: {
+      commentedOutCode: "Commented-out code \u2014 delete it; git history remembers.",
+      sectionBanner: "Section-banner / region comment \u2014 structure code with functions, not ASCII rules.",
+      fileHeaderPreamble: "File-header comment preamble \u2014 use a brief doc comment for the why, not a block of `//` lines."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const sourceCode = context.sourceCode;
+    function isStandalone(comment) {
+      const before = sourceCode.getTokenBefore(comment, {
+        includeComments: false
+      });
+      return !before || before.loc.end.line < comment.loc.start.line;
+    }
+    function isJsDoc(comment) {
+      return comment.type === "Block" && /^\*/.test(comment.value);
+    }
+    function reportLeadingPreamble(comments, firstCodeLine) {
+      const leading = [];
+      let prevLine = null;
+      for (const comment of comments) {
+        if (comment.type !== "Line") break;
+        if (comment.loc.start.line >= firstCodeLine) break;
+        if (!isStandalone(comment)) break;
+        const body = stripCommentMarker(comment.value);
+        if (isDirective(body) || body.startsWith("!")) continue;
+        if (prevLine !== null && comment.loc.start.line !== prevLine + 1) break;
+        leading.push(comment);
+        prevLine = comment.loc.start.line;
+      }
+      const first = leading[0];
+      if (first === void 0 || leading.length < LEADING_PREAMBLE_MIN) return;
+      const isLicense = leading.some(
+        (c) => LICENSE_RE.test(stripCommentMarker(c.value))
+      );
+      if (!isLicense) {
+        context.report({ node: first, messageId: "fileHeaderPreamble" });
+      }
+    }
+    return {
+      Program() {
+        const comments = sourceCode.getAllComments();
+        const firstCodeLine = sourceCode.ast.tokens[0]?.loc.start.line ?? Number.MAX_SAFE_INTEGER;
+        for (const comment of comments) {
+          if (isJsDoc(comment) || !isStandalone(comment)) continue;
+          const texts = comment.value.split("\n").map(stripCommentMarker).filter((l) => l.length > 0 && !isDirective(l));
+          if (texts.some(isBanner)) {
+            context.report({ node: comment, messageId: "sectionBanner" });
+          } else if (texts.some(looksLikeCode)) {
+            context.report({ node: comment, messageId: "commentedOutCode" });
+          }
+        }
+        reportLeadingPreamble(comments, firstCodeLine);
+      }
+    };
+  }
+});
+
+// src/rules/no-enum.ts
+import { ESLintUtils as ESLintUtils4 } from "@typescript-eslint/utils";
 var DEFAULT_IGNORE_PATTERNS = [
   /[\\/]generated[\\/]/,
   /\.gen\.tsx?$/,
@@ -271,7 +352,7 @@ function hasGeneratedMarker(sourceText) {
   const head = sourceText.slice(0, 1024);
   return /@generated\b/.test(head);
 }
-var no_enum_default = ESLintUtils3.RuleCreator(
+var no_enum_default = ESLintUtils4.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "no-enum",
@@ -322,7 +403,7 @@ var no_enum_default = ESLintUtils3.RuleCreator(
 });
 
 // src/rules/no-insecure-random-id.ts
-import { ESLintUtils as ESLintUtils4 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils5 } from "@typescript-eslint/utils";
 var NAME_PATTERN = /id|token|key|secret|uuid|nonce|session|password|salt/i;
 function isMathRandomCall(node) {
   if (node.type !== "CallExpression") {
@@ -400,7 +481,7 @@ function findEnclosingName(node) {
   }
   return void 0;
 }
-var no_insecure_random_id_default = ESLintUtils4.RuleCreator(
+var no_insecure_random_id_default = ESLintUtils5.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "no-insecure-random-id",
@@ -435,7 +516,7 @@ var no_insecure_random_id_default = ESLintUtils4.RuleCreator(
 });
 
 // src/rules/no-json-stringify-error.ts
-import { ESLintUtils as ESLintUtils5 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils6 } from "@typescript-eslint/utils";
 var ERROR_NAME_PATTERN = /^(e|err|error|ex|exc)$/i;
 function isCatchBinding(scope, name) {
   let current = scope;
@@ -455,7 +536,7 @@ function isCatchBinding(scope, name) {
 function isJsonStringify(callee) {
   return callee.type === "MemberExpression" && !callee.computed && callee.object.type === "Identifier" && callee.object.name === "JSON" && callee.property.type === "Identifier" && callee.property.name === "stringify";
 }
-var no_json_stringify_error_default = ESLintUtils5.RuleCreator(
+var no_json_stringify_error_default = ESLintUtils6.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "no-json-stringify-error",
@@ -494,7 +575,7 @@ var no_json_stringify_error_default = ESLintUtils5.RuleCreator(
 });
 
 // src/rules/no-log-only-catch.ts
-import { ESLintUtils as ESLintUtils6 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils7 } from "@typescript-eslint/utils";
 var DEFAULT_IGNORE_PATTERNS2 = [
   /\.test\./,
   /\.spec\./,
@@ -531,7 +612,7 @@ function isConsoleCallStatement(statement) {
   }
   return CONSOLE_METHODS.has(property.name);
 }
-var no_log_only_catch_default = ESLintUtils6.RuleCreator(
+var no_log_only_catch_default = ESLintUtils7.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "no-log-only-catch",
@@ -573,8 +654,8 @@ var no_log_only_catch_default = ESLintUtils6.RuleCreator(
 });
 
 // src/rules/no-raw-env.ts
-import { ESLintUtils as ESLintUtils7 } from "@typescript-eslint/utils";
-var no_raw_env_default = ESLintUtils7.RuleCreator(
+import { ESLintUtils as ESLintUtils8 } from "@typescript-eslint/utils";
+var no_raw_env_default = ESLintUtils8.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "no-raw-env",
@@ -608,7 +689,7 @@ var no_raw_env_default = ESLintUtils7.RuleCreator(
 
 // src/rules/no-sentinel-return-on-catch.ts
 import {
-  ESLintUtils as ESLintUtils8,
+  ESLintUtils as ESLintUtils9,
   AST_NODE_TYPES as AST_NODE_TYPES3
 } from "@typescript-eslint/utils";
 function isSentinelArgument(arg) {
@@ -667,7 +748,7 @@ function containsThrow(node) {
 function isNode(value) {
   return typeof value === "object" && value !== null && typeof value.type === "string";
 }
-var no_sentinel_return_on_catch_default = ESLintUtils8.RuleCreator(
+var no_sentinel_return_on_catch_default = ESLintUtils9.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "no-sentinel-return-on-catch",
@@ -709,14 +790,14 @@ var no_sentinel_return_on_catch_default = ESLintUtils8.RuleCreator(
 });
 
 // src/rules/no-sequential-await.ts
-import { ESLintUtils as ESLintUtils9 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils10 } from "@typescript-eslint/utils";
 function isFunctionLike(node) {
   return node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression";
 }
 function isLoop(node) {
   return node.type === "ForStatement" || node.type === "ForOfStatement" || node.type === "ForInStatement" || node.type === "WhileStatement" || node.type === "DoWhileStatement";
 }
-var no_sequential_await_default = ESLintUtils9.RuleCreator(
+var no_sequential_await_default = ESLintUtils10.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "no-sequential-await",
@@ -746,14 +827,14 @@ var no_sequential_await_default = ESLintUtils9.RuleCreator(
         const value = node[key];
         if (Array.isArray(value)) {
           for (const child of value) {
-            if (isNode2(child) && !isLoop(child)) {
+            if (isNode4(child) && !isLoop(child)) {
               const found = findAwaitInScope(child);
               if (found) {
                 return found;
               }
             }
           }
-        } else if (isNode2(value) && !isLoop(value)) {
+        } else if (isNode4(value) && !isLoop(value)) {
           const found = findAwaitInScope(value);
           if (found) {
             return found;
@@ -762,7 +843,7 @@ var no_sequential_await_default = ESLintUtils9.RuleCreator(
       }
       return null;
     }
-    function isNode2(value) {
+    function isNode4(value) {
       return typeof value === "object" && value !== null && typeof value.type === "string";
     }
     function checkLoop(node) {
@@ -797,7 +878,7 @@ var no_sequential_await_default = ESLintUtils9.RuleCreator(
 });
 
 // src/rules/no-string-concat-in-loop.ts
-import { ESLintUtils as ESLintUtils10 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils11 } from "@typescript-eslint/utils";
 var LOOP_NODE_TYPES = /* @__PURE__ */ new Set([
   "ForStatement",
   "ForOfStatement",
@@ -857,7 +938,7 @@ function isInsideLoopBody(node) {
   }
   return false;
 }
-var no_string_concat_in_loop_default = ESLintUtils10.RuleCreator(
+var no_string_concat_in_loop_default = ESLintUtils11.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "no-string-concat-in-loop",
@@ -904,7 +985,7 @@ var no_string_concat_in_loop_default = ESLintUtils10.RuleCreator(
 // src/rules/no-unnecessary-use-client.ts
 import {
   AST_NODE_TYPES as AST_NODE_TYPES4,
-  ESLintUtils as ESLintUtils11
+  ESLintUtils as ESLintUtils12
 } from "@typescript-eslint/utils";
 var HOOK_REGEX = /^use([A-Z]|$)/;
 var EVENT_PROP_REGEX = /^on[A-Z]/;
@@ -954,7 +1035,7 @@ var isGlobalReference = (node, context) => {
   }
   return true;
 };
-var no_unnecessary_use_client_default = ESLintUtils11.RuleCreator(
+var no_unnecessary_use_client_default = ESLintUtils12.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "no-unnecessary-use-client",
@@ -1001,35 +1082,43 @@ var no_unnecessary_use_client_default = ESLintUtils11.RuleCreator(
         }
       },
       CallExpression(node) {
+        if (directiveNode === null) return;
         markIfHookOrContext(node.callee);
       },
       JSXAttribute(node) {
+        if (directiveNode === null) return;
         if (node.name.type === AST_NODE_TYPES4.JSXIdentifier && EVENT_PROP_REGEX.test(node.name.name)) {
           hasClientIndicator = true;
         }
       },
       ImportDeclaration(node) {
+        if (directiveNode === null) return;
         if (typeof node.source.value === "string" && CLIENT_ONLY_PACKAGES_REGEX.test(node.source.value)) {
           hasClientIndicator = true;
         }
       },
       ExportNamedDeclaration(node) {
+        if (directiveNode === null) return;
         if (node.source !== null) {
           hasClientIndicator = true;
         }
       },
       ExportAllDeclaration(node) {
+        if (directiveNode === null) return;
         if (node.source !== null) {
           hasClientIndicator = true;
         }
       },
       ClassDeclaration() {
+        if (directiveNode === null) return;
         hasClientIndicator = true;
       },
       ClassExpression() {
+        if (directiveNode === null) return;
         hasClientIndicator = true;
       },
       Identifier(node) {
+        if (directiveNode === null) return;
         if (isGlobalReference(node, context)) {
           hasClientIndicator = true;
         }
@@ -1047,7 +1136,7 @@ var no_unnecessary_use_client_default = ESLintUtils11.RuleCreator(
 });
 
 // src/rules/prefer-discriminated-union.ts
-import { ESLintUtils as ESLintUtils12 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils13 } from "@typescript-eslint/utils";
 import { AST_NODE_TYPES as AST_NODE_TYPES5 } from "@typescript-eslint/utils";
 var STATUS_MEMBER_NAMES = /* @__PURE__ */ new Set([
   "success",
@@ -1090,7 +1179,7 @@ function looksLikeMutuallyExclusiveState(typeLiteral) {
   }
   return hasStatusBoolean && optionalCount >= MIN_OPTIONAL_MEMBERS;
 }
-var prefer_discriminated_union_default = ESLintUtils12.RuleCreator(
+var prefer_discriminated_union_default = ESLintUtils13.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "prefer-discriminated-union",
@@ -1133,7 +1222,7 @@ var prefer_discriminated_union_default = ESLintUtils12.RuleCreator(
 // src/rules/prefer-schema-for-api-payload.ts
 import {
   AST_NODE_TYPES as AST_NODE_TYPES6,
-  ESLintUtils as ESLintUtils13
+  ESLintUtils as ESLintUtils14
 } from "@typescript-eslint/utils";
 var unwrap = (node) => {
   let current = node;
@@ -1181,7 +1270,7 @@ var isUnvalidatedVariableRef = (node, scope, tracked) => {
   const variable = findVariable2(scope, unwrapped.name);
   return variable !== null && tracked.has(variable);
 };
-var prefer_schema_for_api_payload_default = ESLintUtils13.RuleCreator(
+var prefer_schema_for_api_payload_default = ESLintUtils14.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "prefer-schema-for-api-payload",
@@ -1274,8 +1363,153 @@ var prefer_schema_for_api_payload_default = ESLintUtils13.RuleCreator(
   }
 });
 
+// src/rules/prefer-semantic-colors.ts
+import { AST_NODE_TYPES as AST_NODE_TYPES7, ESLintUtils as ESLintUtils15 } from "@typescript-eslint/utils";
+
+// src/rules/_tailwind.ts
+var tailwindBase = (token) => token.replace(/^(?:[a-z0-9-]+:)+/i, "").replace(/^!/, "");
+var classTokens = (value) => value.split(/\s+/).filter(Boolean);
+
+// src/rules/prefer-semantic-colors.ts
+var COLOR_PREFIXES = "text|bg|border(?:-[trblxyse])?|ring(?:-offset)?|fill|stroke|from|via|to|divide|decoration|placeholder|accent|caret|shadow|outline";
+var PALETTE = "red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose|slate|gray|zinc|neutral|stone";
+var COLOR_FN = "rgba?|hsla?|hwb|oklch|oklab|lab|lch|color";
+var RAW_PALETTE_RE = new RegExp(`^(?:${COLOR_PREFIXES})-(?:${PALETTE})-\\d{2,3}(?:/\\d{1,3})?$`);
+var ARBITRARY_COLOR_RE = new RegExp(
+  `^(?:${COLOR_PREFIXES})-\\[(?:#[0-9a-fA-F]{3,8}|(?:${COLOR_FN})\\([^\\]]*\\))\\]$`,
+  "i"
+);
+var CLASS_FNS = /* @__PURE__ */ new Set(["cn", "clsx", "cva", "tv", "cx", "twMerge", "classnames", "classNames"]);
+var CLASS_NAME_RE = /class/i;
+var STYLE_COLOR_PROPS = /* @__PURE__ */ new Set([
+  "color",
+  "background",
+  "backgroundColor",
+  "borderColor",
+  "borderTopColor",
+  "borderRightColor",
+  "borderBottomColor",
+  "borderLeftColor",
+  "outlineColor",
+  "caretColor",
+  "textDecorationColor",
+  "columnRuleColor",
+  "fill",
+  "stroke",
+  "stopColor",
+  "floodColor",
+  "lightingColor"
+]);
+var RAW_COLOR_VALUE_RE = new RegExp(`#[0-9a-fA-F]{3,8}\\b|\\b(?:${COLOR_FN})\\s*\\(`, "i");
+var propName = (key) => {
+  if (key.type === AST_NODE_TYPES7.Identifier) return key.name;
+  if (key.type === AST_NODE_TYPES7.Literal && typeof key.value === "string") return key.value;
+  return null;
+};
+var prefer_semantic_colors_default = ESLintUtils15.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "prefer-semantic-colors",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Enforce design-system semantic color tokens (bg-primary, text-destructive, \u2026) over raw Tailwind palette classes (text-red-500), arbitrary color values (bg-[#fff]), and inline color literals."
+    },
+    schema: [],
+    messages: {
+      rawPalette: "Raw palette class '{{class}}' \u2014 use a semantic token (e.g. text-foreground, bg-primary, text-destructive, bg-muted).",
+      arbitraryColor: "Hardcoded color '{{class}}' \u2014 use a semantic token, or var(--\u2026). For charts/brand add an eslint-disable with a reason.",
+      inlineColor: "Hardcoded color '{{value}}' \u2014 use a semantic token / CSS variable. For charts/standalone pages add an eslint-disable with a reason."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const reportClasses = (value, node) => {
+      for (const token of classTokens(value)) {
+        const base = tailwindBase(token);
+        if (RAW_PALETTE_RE.test(base)) {
+          context.report({ node, messageId: "rawPalette", data: { class: token } });
+        } else if (ARBITRARY_COLOR_RE.test(base)) {
+          context.report({ node, messageId: "arbitraryColor", data: { class: token } });
+        }
+      }
+    };
+    const checkClassNode = (node) => {
+      if (node === null) return;
+      switch (node.type) {
+        case AST_NODE_TYPES7.Literal:
+          if (typeof node.value === "string") reportClasses(node.value, node);
+          break;
+        case AST_NODE_TYPES7.TemplateLiteral:
+          for (const quasi of node.quasis) reportClasses(quasi.value.cooked ?? "", quasi);
+          break;
+        case AST_NODE_TYPES7.ArrayExpression:
+          for (const element of node.elements) {
+            if (element !== null && element.type !== AST_NODE_TYPES7.SpreadElement) checkClassNode(element);
+          }
+          break;
+        case AST_NODE_TYPES7.ObjectExpression:
+          for (const property of node.properties) {
+            if (property.type === AST_NODE_TYPES7.Property) checkClassNode(property.value);
+          }
+          break;
+        case AST_NODE_TYPES7.ConditionalExpression:
+          checkClassNode(node.consequent);
+          checkClassNode(node.alternate);
+          break;
+        case AST_NODE_TYPES7.LogicalExpression:
+          checkClassNode(node.right);
+          break;
+        default:
+          break;
+      }
+    };
+    const checkColorValueNode = (node) => {
+      if (node.type === AST_NODE_TYPES7.Literal && typeof node.value === "string" && RAW_COLOR_VALUE_RE.test(node.value)) {
+        context.report({ node, messageId: "inlineColor", data: { value: node.value } });
+      }
+    };
+    return {
+      "JSXAttribute[name.name='className']"(node) {
+        if (node.value === null) return;
+        if (node.value.type === AST_NODE_TYPES7.Literal) checkClassNode(node.value);
+        else if (node.value.type === AST_NODE_TYPES7.JSXExpressionContainer) {
+          if (node.value.expression.type !== AST_NODE_TYPES7.JSXEmptyExpression) {
+            checkClassNode(node.value.expression);
+          }
+        }
+      },
+      CallExpression(node) {
+        if (node.callee.type === AST_NODE_TYPES7.Identifier && CLASS_FNS.has(node.callee.name)) {
+          for (const arg of node.arguments) {
+            if (arg.type !== AST_NODE_TYPES7.SpreadElement) checkClassNode(arg);
+          }
+        }
+      },
+      VariableDeclarator(node) {
+        if (node.id.type === AST_NODE_TYPES7.Identifier && CLASS_NAME_RE.test(node.id.name)) {
+          checkClassNode(node.init);
+        }
+      },
+      Property(node) {
+        const name = propName(node.key);
+        if (name !== null && CLASS_NAME_RE.test(name)) checkClassNode(node.value);
+      },
+      // SVG presentation attributes: <path fill="#000" stroke="#fff" />
+      "JSXAttribute[name.name=/^(fill|stroke|color)$/]"(node) {
+        if (node.value?.type === AST_NODE_TYPES7.Literal) checkColorValueNode(node.value);
+      },
+      // Inline style objects: style={{ color: "#111827", backgroundColor: "#fff" }}
+      "JSXAttribute[name.name='style'] ObjectExpression > Property"(node) {
+        const name = propName(node.key);
+        if (name !== null && STYLE_COLOR_PROPS.has(name)) checkColorValueNode(node.value);
+      }
+    };
+  }
+});
+
 // src/rules/prefer-server-actions.ts
-import { ESLintUtils as ESLintUtils14 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils16 } from "@typescript-eslint/utils";
 var MUTATION_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "DELETE", "PATCH"]);
 var AXIOS_MUTATION_METHODS = /* @__PURE__ */ new Set(["post", "put", "delete", "patch"]);
 var SKIP_FILE_REGEX = /(?:\.test\.[jt]sx?$|\.spec\.[jt]sx?$|\/tests?\/|\/__tests__\/|\/scripts?\/|\/app\/api\/.*\/route\.[jt]sx?$|\/pages\/api\/)/;
@@ -1335,17 +1569,17 @@ function isMutationMethod(node, context) {
   }
   return false;
 }
-function getPropertyNode(objNode, propName) {
+function getPropertyNode(objNode, propName2) {
   if (!objNode || objNode.type !== "ObjectExpression") return null;
   for (const prop of objNode.properties) {
     if (prop.type !== "Property") continue;
-    let keyName = null;
+    let keyName2 = null;
     if (prop.key.type === "Identifier" && !prop.computed) {
-      keyName = prop.key.name;
+      keyName2 = prop.key.name;
     } else if (prop.key.type === "Literal" && typeof prop.key.value === "string") {
-      keyName = prop.key.value;
+      keyName2 = prop.key.value;
     }
-    if (keyName === propName) {
+    if (keyName2 === propName2) {
       if (prop.value.type === "AssignmentPattern" || prop.value.type === "ArrayPattern" || prop.value.type === "ObjectPattern") {
         return null;
       }
@@ -1354,7 +1588,7 @@ function getPropertyNode(objNode, propName) {
   }
   return null;
 }
-var prefer_server_actions_default = ESLintUtils14.RuleCreator(
+var prefer_server_actions_default = ESLintUtils16.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "prefer-server-actions",
@@ -1393,7 +1627,10 @@ var prefer_server_actions_default = ESLintUtils14.RuleCreator(
           const methodName = node.callee.property.name.toLowerCase();
           if (AXIOS_MUTATION_METHODS.has(methodName)) {
             const urlArg = node.arguments[0];
-            if (urlArg && urlArg.type !== "SpreadElement" && isApiUrl(urlArg, context)) {
+            const hasHandlerArg = node.arguments.some(
+              (arg) => arg.type === "ArrowFunctionExpression" || arg.type === "FunctionExpression"
+            );
+            if (urlArg && urlArg.type !== "SpreadElement" && !hasHandlerArg && isApiUrl(urlArg, context)) {
               isMutation = true;
             }
           }
@@ -1419,14 +1656,14 @@ var prefer_server_actions_default = ESLintUtils14.RuleCreator(
 });
 
 // src/rules/prefer-shadcn.ts
-import { ESLintUtils as ESLintUtils15 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils17 } from "@typescript-eslint/utils";
 var REPLACEMENTS = {
   input: "Input",
   select: "Select",
   textarea: "Textarea",
   dialog: "Dialog"
 };
-var prefer_shadcn_default = ESLintUtils15.RuleCreator(
+var prefer_shadcn_default = ESLintUtils17.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "prefer-shadcn",
@@ -1467,36 +1704,52 @@ var prefer_shadcn_default = ESLintUtils15.RuleCreator(
 });
 
 // src/rules/require-assert-never.ts
-import { ESLintUtils as ESLintUtils16, AST_NODE_TYPES as AST_NODE_TYPES7 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils18, AST_NODE_TYPES as AST_NODE_TYPES8 } from "@typescript-eslint/utils";
 var isAssertNeverCall = (expression) => {
-  if (expression.type !== AST_NODE_TYPES7.CallExpression) return false;
+  if (expression.type !== AST_NODE_TYPES8.CallExpression) return false;
   const callee = expression.callee;
-  return callee.type === AST_NODE_TYPES7.Identifier && callee.name === "assertNever";
+  if (callee.type === AST_NODE_TYPES8.Identifier) {
+    return callee.name === "assertNever";
+  }
+  if (callee.type === AST_NODE_TYPES8.MemberExpression && !callee.computed && callee.property.type === AST_NODE_TYPES8.Identifier) {
+    return callee.property.name === "assertNever";
+  }
+  return false;
 };
 var statementContainsAssertNever = (statement) => {
-  if (statement.type === AST_NODE_TYPES7.ExpressionStatement) {
+  if (statement.type === AST_NODE_TYPES8.ExpressionStatement) {
     return isAssertNeverCall(statement.expression);
   }
-  if (statement.type === AST_NODE_TYPES7.ThrowStatement) {
+  if (statement.type === AST_NODE_TYPES8.ThrowStatement) {
     return isAssertNeverCall(statement.argument);
   }
-  if (statement.type === AST_NODE_TYPES7.BlockStatement) {
+  if (statement.type === AST_NODE_TYPES8.ReturnStatement) {
+    return statement.argument !== null && isAssertNeverCall(statement.argument);
+  }
+  if (statement.type === AST_NODE_TYPES8.BlockStatement) {
     return statement.body.some(statementContainsAssertNever);
   }
   return false;
 };
-var require_assert_never_default = ESLintUtils16.RuleCreator(
+var isRuntimeHandlingStatement = (statement) => {
+  if (statement.type === AST_NODE_TYPES8.EmptyStatement) return false;
+  if (statement.type === AST_NODE_TYPES8.BlockStatement) {
+    return statement.body.some(isRuntimeHandlingStatement);
+  }
+  return true;
+};
+var require_assert_never_default = ESLintUtils18.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "require-assert-never",
   meta: {
     type: "problem",
     docs: {
-      description: "Require switch statements to end with `assertNever(_)` in their default case so that discriminated unions are exhaustively checked at compile time."
+      description: "Require an exhaustive-style switch whose `default` case does no runtime work to call `assertNever(_)` so that discriminated unions are exhaustively checked at compile time. Switches with a legitimate runtime default (a reducer's `return state`, an HTTP-status `return fallback()`, a `break`, a `throw`, etc.) are left alone."
     },
     schema: [],
     messages: {
-      missingAssertNever: "Switch statement default case must call assertNever() for exhaustive type checking"
+      missingAssertNever: "Empty switch `default` case \u2014 add runtime handling or call `assertNever()` so the discriminated union is exhaustively checked at compile time."
     }
   },
   defaultOptions: [],
@@ -1507,10 +1760,8 @@ var require_assert_never_default = ESLintUtils16.RuleCreator(
           (caseNode) => caseNode.test === null
         );
         if (!defaultCase) return;
-        const hasAssertNever = defaultCase.consequent.some(
-          statementContainsAssertNever
-        );
-        if (hasAssertNever) return;
+        if (defaultCase.consequent.some(statementContainsAssertNever)) return;
+        if (defaultCase.consequent.some(isRuntimeHandlingStatement)) return;
         context.report({
           node: defaultCase,
           messageId: "missingAssertNever"
@@ -1521,43 +1772,91 @@ var require_assert_never_default = ESLintUtils16.RuleCreator(
 });
 
 // src/rules/require-zod-form-validation.ts
-import { ESLintUtils as ESLintUtils17, AST_NODE_TYPES as AST_NODE_TYPES8 } from "@typescript-eslint/utils";
-var isFormDataGetCall = (node) => {
-  const callee = node.callee;
-  if (callee.type !== AST_NODE_TYPES8.MemberExpression) return false;
-  if (callee.property.type !== AST_NODE_TYPES8.Identifier || callee.property.name !== "get") {
+import { ESLintUtils as ESLintUtils19, AST_NODE_TYPES as AST_NODE_TYPES9 } from "@typescript-eslint/utils";
+var ZOD_SCHEMA_NAME_RE = /Schema$|^Z[A-Z]/;
+var looksLikeZodSchema = (node) => {
+  let current = node;
+  while (true) {
+    if (current.type === AST_NODE_TYPES9.Identifier) {
+      return current.name === "z" || ZOD_SCHEMA_NAME_RE.test(current.name);
+    }
+    if (current.type === AST_NODE_TYPES9.CallExpression) {
+      current = current.callee;
+      continue;
+    }
+    if (current.type === AST_NODE_TYPES9.MemberExpression) {
+      current = current.object;
+      continue;
+    }
     return false;
   }
-  return callee.object.type === AST_NODE_TYPES8.Identifier && callee.object.name === "formData";
 };
-var isParseCallExpression = (node) => {
-  if (node.type !== AST_NODE_TYPES8.CallExpression) return false;
+var isZodParseCall = (node) => {
+  if (node.type !== AST_NODE_TYPES9.CallExpression) return false;
   const callee = node.callee;
-  if (callee.type !== AST_NODE_TYPES8.MemberExpression) return false;
-  return callee.property.type === AST_NODE_TYPES8.Identifier && callee.property.name === "parse";
+  if (callee.type !== AST_NODE_TYPES9.MemberExpression) return false;
+  if (callee.computed) return false;
+  if (callee.property.type !== AST_NODE_TYPES9.Identifier) return false;
+  const method = callee.property.name;
+  if (method !== "parse" && method !== "safeParse") return false;
+  return looksLikeZodSchema(callee.object);
 };
-var require_zod_form_validation_default = ESLintUtils17.RuleCreator(
+var isFormDataMethodCall = (node) => {
+  let current = node;
+  if (current.type === AST_NODE_TYPES9.AwaitExpression) {
+    current = current.argument;
+  }
+  if (current.type !== AST_NODE_TYPES9.CallExpression) return false;
+  const callee = current.callee;
+  return callee.type === AST_NODE_TYPES9.MemberExpression && !callee.computed && callee.property.type === AST_NODE_TYPES9.Identifier && callee.property.name === "formData";
+};
+var require_zod_form_validation_default = ESLintUtils19.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "require-zod-form-validation",
   meta: {
     type: "problem",
     docs: {
-      description: "Require Zod validation (`Schema.parse(...)`) when reading values out of a `FormData` object."
+      description: "Require Zod validation (`Schema.parse(...)` / `Schema.safeParse(...)`) when reading values out of a `FormData` object."
     },
     schema: [],
     messages: {
-      missingZodValidation: "FormData parsing must use Zod schema validation (e.g., Schema.parse())"
+      missingZodValidation: "FormData parsing must use Zod schema validation (e.g., Schema.parse() / Schema.safeParse())"
     }
   },
   defaultOptions: [],
   create(context) {
+    const isFormSourceIdentifier = (node) => {
+      if (node.type !== AST_NODE_TYPES9.Identifier) return false;
+      if (/formdata/i.test(node.name)) return true;
+      let scope = context.sourceCode.getScope(node);
+      while (scope !== null) {
+        const variable = scope.set.get(node.name);
+        if (variable !== void 0 && variable.defs.length === 1) {
+          const def = variable.defs[0];
+          if (def !== void 0 && def.type === "Variable" && def.node.type === AST_NODE_TYPES9.VariableDeclarator && def.node.init !== null) {
+            return isFormDataMethodCall(def.node.init);
+          }
+          return false;
+        }
+        scope = scope.upper;
+      }
+      return false;
+    };
+    const isFormDataGetCall = (node) => {
+      const callee = node.callee;
+      if (callee.type !== AST_NODE_TYPES9.MemberExpression) return false;
+      if (callee.property.type !== AST_NODE_TYPES9.Identifier || callee.property.name !== "get") {
+        return false;
+      }
+      return isFormSourceIdentifier(callee.object);
+    };
     return {
       CallExpression(node) {
         if (!isFormDataGetCall(node)) return;
         let parent = node.parent;
         while (parent !== null && parent !== void 0) {
-          if (isParseCallExpression(parent)) return;
+          if (isZodParseCall(parent)) return;
           parent = parent.parent;
         }
         context.report({
@@ -1570,15 +1869,15 @@ var require_zod_form_validation_default = ESLintUtils17.RuleCreator(
 });
 
 // src/rules/zod-naming-convention.ts
-import { ESLintUtils as ESLintUtils18, AST_NODE_TYPES as AST_NODE_TYPES9 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils20, AST_NODE_TYPES as AST_NODE_TYPES10 } from "@typescript-eslint/utils";
 var calleeChainStartsWithZ = (node) => {
   let current = node;
-  while (current.type === AST_NODE_TYPES9.MemberExpression) {
+  while (current.type === AST_NODE_TYPES10.MemberExpression) {
     const receiver = current.object;
-    if (receiver.type === AST_NODE_TYPES9.Identifier && receiver.name === "z") {
+    if (receiver.type === AST_NODE_TYPES10.Identifier && receiver.name === "z") {
       return true;
     }
-    if (receiver.type === AST_NODE_TYPES9.CallExpression) {
+    if (receiver.type === AST_NODE_TYPES10.CallExpression) {
       current = receiver.callee;
       continue;
     }
@@ -1586,7 +1885,7 @@ var calleeChainStartsWithZ = (node) => {
   }
   return false;
 };
-var zod_naming_convention_default = ESLintUtils18.RuleCreator(
+var zod_naming_convention_default = ESLintUtils20.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "zod-naming-convention",
@@ -1606,11 +1905,11 @@ var zod_naming_convention_default = ESLintUtils18.RuleCreator(
       VariableDeclarator(node) {
         const init = node.init;
         if (init === null || init === void 0) return;
-        if (init.type !== AST_NODE_TYPES9.CallExpression) return;
+        if (init.type !== AST_NODE_TYPES10.CallExpression) return;
         const callee = init.callee;
-        if (callee.type !== AST_NODE_TYPES9.MemberExpression) return;
+        if (callee.type !== AST_NODE_TYPES10.MemberExpression) return;
         if (!calleeChainStartsWithZ(callee)) return;
-        if (node.id.type !== AST_NODE_TYPES9.Identifier) return;
+        if (node.id.type !== AST_NODE_TYPES10.Identifier) return;
         const variableName = node.id.name;
         if (variableName.startsWith("Z")) return;
         context.report({
@@ -1622,10 +1921,1141 @@ var zod_naming_convention_default = ESLintUtils18.RuleCreator(
   }
 });
 
+// src/rules/no-cors-wildcard-with-credentials.ts
+import { ESLintUtils as ESLintUtils21 } from "@typescript-eslint/utils";
+var ACAO_HEADER = "access-control-allow-origin";
+var ACAC_HEADER = "access-control-allow-credentials";
+var HEADER_SET_METHODS = /* @__PURE__ */ new Set(["setheader", "set", "append"]);
+function isTrueLiteral(node) {
+  return node.type === "Literal" && node.value === true;
+}
+function isCredentialsTrueValue(node) {
+  if (node.type === "Literal") {
+    if (node.value === true) {
+      return true;
+    }
+    if (typeof node.value === "string") {
+      return node.value.trim().toLowerCase() === "true";
+    }
+  }
+  return false;
+}
+function isStarLiteral(node) {
+  return node.type === "Literal" && node.value === "*";
+}
+function subtreeContainsStarLiteral(node) {
+  if (isStarLiteral(node)) {
+    return true;
+  }
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") {
+      continue;
+    }
+    const value = node[key];
+    if (Array.isArray(value)) {
+      for (const child of value) {
+        if (isNode2(child) && subtreeContainsStarLiteral(child)) {
+          return true;
+        }
+      }
+    } else if (isNode2(value) && subtreeContainsStarLiteral(value)) {
+      return true;
+    }
+  }
+  return false;
+}
+function isNode2(value) {
+  return typeof value === "object" && value !== null && typeof value.type === "string";
+}
+function propertyKeyName(prop) {
+  if (prop.computed) {
+    return void 0;
+  }
+  const key = prop.key;
+  if (key.type === "Identifier") {
+    return key.name;
+  }
+  if (key.type === "Literal" && typeof key.value === "string") {
+    return key.value;
+  }
+  return void 0;
+}
+function calleeName(node) {
+  const callee = node.callee;
+  if (callee.type === "Identifier") {
+    return callee.name;
+  }
+  if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier") {
+    return callee.property.name;
+  }
+  return void 0;
+}
+function isCorsWildcardCredentialsCall(node) {
+  const name = calleeName(node);
+  if (name === void 0 || name.toLowerCase() !== "cors") {
+    return false;
+  }
+  const options = node.arguments.find(
+    (arg) => arg.type === "ObjectExpression"
+  );
+  if (options === void 0) {
+    return false;
+  }
+  let hasCredentials = false;
+  let hasWildcardOrigin = false;
+  for (const prop of options.properties) {
+    if (prop.type !== "Property") {
+      continue;
+    }
+    const key = propertyKeyName(prop);
+    if (key === "credentials" && isTrueLiteral(prop.value)) {
+      hasCredentials = true;
+    } else if (key === "origin" && subtreeContainsStarLiteral(prop.value)) {
+      hasWildcardOrigin = true;
+    }
+  }
+  return hasCredentials && hasWildcardOrigin;
+}
+function isWildcardCredentialsHeaderObject(node) {
+  let wildcardOrigin = false;
+  let credentialsTrue = false;
+  for (const prop of node.properties) {
+    if (prop.type !== "Property") {
+      continue;
+    }
+    const key = propertyKeyName(prop);
+    if (key === void 0) {
+      continue;
+    }
+    const header = key.toLowerCase();
+    if (header === ACAO_HEADER && isStarLiteral(prop.value)) {
+      wildcardOrigin = true;
+    } else if (header === ACAC_HEADER && isCredentialsTrueValue(prop.value)) {
+      credentialsTrue = true;
+    }
+  }
+  return wildcardOrigin && credentialsTrue;
+}
+function classifyHeaderSetCall(node) {
+  const callee = node.callee;
+  if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier" || !HEADER_SET_METHODS.has(callee.property.name.toLowerCase())) {
+    return void 0;
+  }
+  const [nameArg, valueArg] = node.arguments;
+  if (nameArg === void 0 || valueArg === void 0 || nameArg.type !== "Literal" || typeof nameArg.value !== "string") {
+    return void 0;
+  }
+  const header = nameArg.value.toLowerCase();
+  if (header === ACAO_HEADER && isStarLiteral(valueArg)) {
+    return "origin";
+  }
+  if (header === ACAC_HEADER && isCredentialsTrueValue(valueArg)) {
+    return "credentials";
+  }
+  return void 0;
+}
+function enclosingScope(node) {
+  let current = node.parent;
+  while (current) {
+    if (current.type === "FunctionDeclaration" || current.type === "FunctionExpression" || current.type === "ArrowFunctionExpression") {
+      return current;
+    }
+    current = current.parent;
+  }
+  return void 0;
+}
+var no_cors_wildcard_with_credentials_default = ESLintUtils21.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-cors-wildcard-with-credentials",
+  meta: {
+    type: "problem",
+    docs: {
+      description: 'Disallow CORS that reflects any Origin (`"*"`) while allowing credentials; any site could then read authenticated responses. Enumerate explicit trusted origins instead.'
+    },
+    schema: [],
+    messages: {
+      corsWildcardWithCredentials: 'CORS reflects any Origin (`"*"`) while allowing credentials \u2014 any site can read authenticated responses. Enumerate explicit trusted origins instead of using `"*"` with credentials.'
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const scopeHeaderSets = /* @__PURE__ */ new Map();
+    function recordHeaderSet(node, kind) {
+      const key = enclosingScope(node) ?? "module";
+      let entry = scopeHeaderSets.get(key);
+      if (entry === void 0) {
+        entry = { originNodes: [], credentialsNodes: [] };
+        scopeHeaderSets.set(key, entry);
+      }
+      if (kind === "origin") {
+        entry.originNodes.push(node);
+      } else {
+        entry.credentialsNodes.push(node);
+      }
+    }
+    return {
+      NewExpression(node) {
+        if (isCorsWildcardCredentialsCall(node)) {
+          context.report({ node, messageId: "corsWildcardWithCredentials" });
+        }
+      },
+      CallExpression(node) {
+        if (isCorsWildcardCredentialsCall(node)) {
+          context.report({ node, messageId: "corsWildcardWithCredentials" });
+          return;
+        }
+        const kind = classifyHeaderSetCall(node);
+        if (kind !== void 0) {
+          recordHeaderSet(node, kind);
+        }
+      },
+      ObjectExpression(node) {
+        if (isWildcardCredentialsHeaderObject(node)) {
+          context.report({ node, messageId: "corsWildcardWithCredentials" });
+        }
+      },
+      "Program:exit"() {
+        for (const { originNodes, credentialsNodes } of scopeHeaderSets.values()) {
+          if (originNodes.length > 0 && credentialsNodes.length > 0) {
+            for (const node of originNodes) {
+              context.report({
+                node,
+                messageId: "corsWildcardWithCredentials"
+              });
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/rules/no-fat-try-blocks.ts
+import {
+  ESLintUtils as ESLintUtils22,
+  AST_NODE_TYPES as AST_NODE_TYPES11
+} from "@typescript-eslint/utils";
+var MAX_TRY_BODY_STATEMENTS = 3;
+var NESTED_FUNCTION_TYPES = /* @__PURE__ */ new Set([
+  AST_NODE_TYPES11.FunctionDeclaration,
+  AST_NODE_TYPES11.FunctionExpression,
+  AST_NODE_TYPES11.ArrowFunctionExpression
+]);
+var PURE_METHODS = /* @__PURE__ */ new Set([
+  "map",
+  "filter",
+  "forEach",
+  "reduce",
+  "reduceRight",
+  "find",
+  "findIndex",
+  "findLast",
+  "findLastIndex",
+  "some",
+  "every",
+  "push",
+  "pop",
+  "shift",
+  "unshift",
+  "slice",
+  "splice",
+  "concat",
+  "flat",
+  "flatMap",
+  "join",
+  "reverse",
+  "sort",
+  "fill",
+  "includes",
+  "indexOf",
+  "lastIndexOf",
+  "at",
+  "keys",
+  "values",
+  "entries",
+  "has",
+  "get",
+  "set",
+  "add",
+  "delete",
+  "clear",
+  "toString",
+  "toLocaleString",
+  "valueOf",
+  "charAt",
+  "charCodeAt",
+  "codePointAt",
+  "split",
+  "padStart",
+  "padEnd",
+  "repeat",
+  "trim",
+  "trimStart",
+  "trimEnd",
+  "toUpperCase",
+  "toLowerCase",
+  "toFixed",
+  "toPrecision",
+  "startsWith",
+  "endsWith"
+]);
+var PURE_NAMESPACES = /* @__PURE__ */ new Set([
+  "Object",
+  "Array",
+  "Math",
+  "JSON",
+  "Number",
+  "String",
+  "Boolean",
+  "console"
+]);
+var PURE_CONSTRUCTORS = /* @__PURE__ */ new Set([
+  "Map",
+  "Set",
+  "WeakMap",
+  "WeakSet",
+  "Date",
+  "Error",
+  "TypeError",
+  "RangeError",
+  "Array",
+  "Object",
+  "Headers",
+  "URLSearchParams",
+  "FormData"
+]);
+function isNode3(value) {
+  return typeof value === "object" && value !== null && typeof value.type === "string";
+}
+function isPureCall(node) {
+  const callee = node.callee;
+  if (callee.type !== AST_NODE_TYPES11.MemberExpression) {
+    return false;
+  }
+  const property = callee.property;
+  if (property.type !== AST_NODE_TYPES11.Identifier) {
+    return false;
+  }
+  if (callee.object.type === AST_NODE_TYPES11.Identifier && PURE_NAMESPACES.has(callee.object.name)) {
+    return true;
+  }
+  return PURE_METHODS.has(property.name);
+}
+function isPureNew(node) {
+  return node.callee.type === AST_NODE_TYPES11.Identifier && PURE_CONSTRUCTORS.has(node.callee.name);
+}
+function subtreeMatches(stmt, predicate) {
+  let found = false;
+  const visit = (current) => {
+    if (found) {
+      return;
+    }
+    if (predicate(current)) {
+      found = true;
+      return;
+    }
+    for (const key of Object.keys(current)) {
+      if (key === "parent") {
+        continue;
+      }
+      if (NESTED_FUNCTION_TYPES.has(current.type) && key === "body") {
+        continue;
+      }
+      const value = current[key];
+      if (Array.isArray(value)) {
+        for (const child of value) {
+          if (isNode3(child)) {
+            visit(child);
+          }
+        }
+      } else if (isNode3(value)) {
+        visit(value);
+      }
+      if (found) {
+        return;
+      }
+    }
+  };
+  visit(stmt);
+  return found;
+}
+var hasAwait = (stmt) => subtreeMatches(stmt, (n) => n.type === AST_NODE_TYPES11.AwaitExpression);
+var hasThrowingCallOrNew = (stmt) => subtreeMatches(
+  stmt,
+  (n) => n.type === AST_NODE_TYPES11.CallExpression && !isPureCall(n) || n.type === AST_NODE_TYPES11.NewExpression && !isPureNew(n)
+);
+function unwrap2(expr) {
+  let current = expr;
+  while (current.type === AST_NODE_TYPES11.ChainExpression || current.type === AST_NODE_TYPES11.TSNonNullExpression) {
+    current = current.expression;
+  }
+  return current;
+}
+function canThrow(stmt) {
+  if (hasAwait(stmt)) {
+    return true;
+  }
+  if (stmt.type === AST_NODE_TYPES11.ExpressionStatement && unwrap2(stmt.expression).type === AST_NODE_TYPES11.CallExpression) {
+    return false;
+  }
+  return hasThrowingCallOrNew(stmt);
+}
+function handlerRethrows(handler) {
+  if (handler === null) {
+    return false;
+  }
+  const body = handler.body.body;
+  const last = body[body.length - 1];
+  return last !== void 0 && last.type === AST_NODE_TYPES11.ThrowStatement;
+}
+var no_fat_try_blocks_default = ESLintUtils22.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-fat-try-blocks",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow `try` blocks with more than three top-level statements that can throw \u2014 isolate the throwing statement and move non-throwing work outside."
+    },
+    schema: [],
+    messages: {
+      fatTryBlock: "This `try` block has {{count}} statements that can throw (max {{max}}). Isolate the throwing statement(s); move non-throwing work outside the `try`."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const sourceCode = context.sourceCode;
+    return {
+      TryStatement(node) {
+        if (node.finalizer !== null) {
+          return;
+        }
+        if (handlerRethrows(node.handler)) {
+          return;
+        }
+        const count = node.block.body.filter(canThrow).length;
+        if (count <= MAX_TRY_BODY_STATEMENTS) {
+          return;
+        }
+        const tryKeyword = sourceCode.getFirstToken(node);
+        context.report({
+          node: tryKeyword ?? node,
+          messageId: "fatTryBlock",
+          data: { count, max: MAX_TRY_BODY_STATEMENTS }
+        });
+      }
+    };
+  }
+});
+
+// src/rules/no-secret-in-log.ts
+import { ESLintUtils as ESLintUtils23 } from "@typescript-eslint/utils";
+var LOG_METHODS = /* @__PURE__ */ new Set([
+  "debug",
+  "info",
+  "warn",
+  "warning",
+  "error",
+  "exception",
+  "critical",
+  "trace",
+  "log",
+  "fatal",
+  "success"
+]);
+var LOGGER_NAMES = /* @__PURE__ */ new Set([
+  "logger",
+  "log",
+  "logging",
+  "loguru",
+  "console",
+  "_logger",
+  "_log"
+]);
+var LOGGER_FACTORIES = /* @__PURE__ */ new Set(["getlogger", "get_logger"]);
+var SECRET_WORDS = /* @__PURE__ */ new Set([
+  "token",
+  "secret",
+  "password",
+  "passwd",
+  "jwt",
+  "secrets",
+  "passwords",
+  "credential",
+  "credentials",
+  "authorization",
+  "signature",
+  "hmac",
+  "digest",
+  "hash",
+  "apikey"
+]);
+var INNOCUOUS_WORDS = /* @__PURE__ */ new Set([
+  "count",
+  "counts",
+  "budget",
+  "limit",
+  "limits",
+  "id",
+  "ids",
+  "enabled",
+  "disabled",
+  "flag",
+  "flags",
+  "present",
+  "set",
+  "unset",
+  "configured",
+  "missing",
+  "required",
+  "valid",
+  "invalid",
+  "exists",
+  "type",
+  "types"
+]);
+var REDACTION_RE = /prefix|suffix|redact|mask|hash|hint|_len|length/i;
+var WHOLE_TOKEN_REDACTION_MARKERS = /* @__PURE__ */ new Set(["tag"]);
+var CAMEL_RE = /[A-Z]+(?=[A-Z][a-z])|[A-Z]?[a-z]+|[A-Z]+|\d+/g;
+var SEGMENT_RE = /[^A-Za-z0-9]+/;
+function tokenize(identifier) {
+  const tokens = [];
+  for (const segment of identifier.split(SEGMENT_RE)) {
+    if (!segment) {
+      continue;
+    }
+    tokens.push(segment.toLowerCase());
+    for (const part of segment.match(CAMEL_RE) ?? []) {
+      tokens.push(part.toLowerCase());
+    }
+  }
+  return tokens;
+}
+function hasApiKey(tokens) {
+  for (let i = 0; i + 1 < tokens.length; i++) {
+    if (tokens[i] === "api" && tokens[i + 1] === "key") {
+      return true;
+    }
+  }
+  return false;
+}
+function isSecretName(identifier) {
+  const tokens = tokenize(identifier);
+  const last = tokens.at(-1);
+  if (last !== void 0 && INNOCUOUS_WORDS.has(last)) {
+    return false;
+  }
+  if (tokens.some((tok) => SECRET_WORDS.has(tok))) {
+    return true;
+  }
+  return hasApiKey(tokens);
+}
+function isSecretKeyword(name) {
+  if (REDACTION_RE.test(name)) {
+    return false;
+  }
+  if (tokenize(name).some((tok) => WHOLE_TOKEN_REDACTION_MARKERS.has(tok))) {
+    return false;
+  }
+  return isSecretName(name);
+}
+function isLoggerExpr(expr) {
+  switch (expr.type) {
+    case "Identifier":
+      return LOGGER_NAMES.has(expr.name.toLowerCase());
+    case "MemberExpression": {
+      const { property, object } = expr;
+      if (!expr.computed && property.type === "Identifier") {
+        const lowered = property.name.toLowerCase();
+        if (LOGGER_NAMES.has(lowered) || LOGGER_FACTORIES.has(lowered)) {
+          return true;
+        }
+      }
+      return isLoggerExpr(object);
+    }
+    case "CallExpression": {
+      const callee = expr.callee;
+      if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" && LOGGER_FACTORIES.has(callee.property.name.toLowerCase())) {
+        return true;
+      }
+      if (callee.type !== "Super") {
+        return isLoggerExpr(callee);
+      }
+      return false;
+    }
+    default:
+      return false;
+  }
+}
+function propertyKeyName2(prop) {
+  if (prop.computed) {
+    return null;
+  }
+  if (prop.key.type === "Identifier") {
+    return prop.key.name;
+  }
+  if (prop.key.type === "Literal" && typeof prop.key.value === "string") {
+    return prop.key.value;
+  }
+  return null;
+}
+var no_secret_in_log_default = ESLintUtils23.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-secret-in-log",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow passing a secret-named value to a logging call; it leaks to log sinks. Redact or omit it."
+    },
+    schema: [],
+    messages: {
+      noSecretInLog: "Secret `{{name}}` passed to a logging call leaks it to log sinks. Redact (e.g. `{{name}}Prefix: {{name}}.slice(0, 6)`) or omit it."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CallExpression(node) {
+        const callee = node.callee;
+        if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier" || !LOG_METHODS.has(callee.property.name)) {
+          return;
+        }
+        if (!isLoggerExpr(callee.object)) {
+          return;
+        }
+        for (const arg of node.arguments) {
+          if (arg.type === "Identifier") {
+            if (isSecretKeyword(arg.name)) {
+              context.report({
+                node: arg,
+                messageId: "noSecretInLog",
+                data: { name: arg.name }
+              });
+            }
+            continue;
+          }
+          if (arg.type === "ObjectExpression") {
+            for (const prop of arg.properties) {
+              if (prop.type !== "Property") {
+                continue;
+              }
+              const keyName2 = propertyKeyName2(prop);
+              if (keyName2 !== null && isSecretKeyword(keyName2)) {
+                context.report({
+                  node: prop,
+                  messageId: "noSecretInLog",
+                  data: { name: keyName2 }
+                });
+              }
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/rules/no-template-literal-in-log.ts
+import { ESLintUtils as ESLintUtils24 } from "@typescript-eslint/utils";
+var LOG_METHODS2 = /* @__PURE__ */ new Set([
+  "debug",
+  "info",
+  "warn",
+  "warning",
+  "error",
+  "exception",
+  "critical",
+  "trace",
+  "log",
+  "fatal",
+  "success"
+]);
+var LOGGER_NAMES2 = /* @__PURE__ */ new Set([
+  "console",
+  "logger",
+  "log",
+  "_log",
+  "_logger"
+]);
+var LOGGER_FACTORIES2 = /* @__PURE__ */ new Set([
+  "getlogger",
+  "createlogger"
+]);
+function looksLikeLogger(node) {
+  switch (node.type) {
+    case "Identifier": {
+      const name = node.name.toLowerCase();
+      return LOGGER_NAMES2.has(name) || LOGGER_FACTORIES2.has(name);
+    }
+    case "MemberExpression": {
+      if (!node.computed && node.property.type === "Identifier") {
+        const prop = node.property.name.toLowerCase();
+        if (LOGGER_NAMES2.has(prop) || LOGGER_FACTORIES2.has(prop)) {
+          return true;
+        }
+      }
+      return looksLikeLogger(node.object);
+    }
+    case "CallExpression":
+      return looksLikeLogger(node.callee);
+    default:
+      return false;
+  }
+}
+function findInterpolatingTemplate(node) {
+  if (node.type === "TemplateLiteral") {
+    return node.expressions.length > 0 ? node : null;
+  }
+  if (node.type === "BinaryExpression" && node.operator === "+") {
+    return findInterpolatingTemplate(node.left) ?? findInterpolatingTemplate(node.right);
+  }
+  return null;
+}
+function messageArg(node, method, receiver) {
+  const levelFirst = method === "log" && !isConsoleReceiver(receiver);
+  const arg = node.arguments[levelFirst ? 1 : 0];
+  if (arg === void 0 || arg.type === "SpreadElement") {
+    return null;
+  }
+  return arg;
+}
+function isConsoleReceiver(node) {
+  return node.type === "Identifier" && node.name === "console";
+}
+var no_template_literal_in_log_default = ESLintUtils24.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-template-literal-in-log",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow an interpolating template literal as a logging message \u2014 pass variables as structured fields so logs stay filterable and templates stay constant."
+    },
+    schema: [],
+    messages: {
+      noTemplateLiteralInLog: "Interpolating template literal as a logging message \u2014 pass variables as structured fields (logger.info('msg', { key })) instead."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CallExpression(node) {
+        const callee = node.callee;
+        if (callee.type !== "MemberExpression" || callee.computed) {
+          return;
+        }
+        if (callee.property.type !== "Identifier") {
+          return;
+        }
+        const method = callee.property.name;
+        if (!LOG_METHODS2.has(method)) {
+          return;
+        }
+        if (!looksLikeLogger(callee.object)) {
+          return;
+        }
+        const arg = messageArg(node, method, callee.object);
+        if (arg === null) {
+          return;
+        }
+        if (findInterpolatingTemplate(arg) !== null) {
+          context.report({ node, messageId: "noTemplateLiteralInLog" });
+        }
+      }
+    };
+  }
+});
+
+// src/rules/prefer-string-literal-union.ts
+import {
+  ESLintUtils as ESLintUtils25,
+  AST_NODE_TYPES as AST_NODE_TYPES12
+} from "@typescript-eslint/utils";
+var CHOICE_TOKENS = /* @__PURE__ */ new Set([
+  "status",
+  "state",
+  "kind",
+  "role",
+  "priority",
+  "severity",
+  "direction",
+  "tier",
+  "stage",
+  "type",
+  "mode",
+  "level"
+]);
+var LOWER_TOKEN_RE = /^[a-z][a-z0-9_-]{0,30}$/;
+var MIN_CLUSTER_SIZE = 2;
+var IGNORE_PATTERNS = [
+  /[\\/]generated[\\/]/,
+  /\.gen\.tsx?$/,
+  /\.generated\.tsx?$/,
+  /\.d\.ts$/
+];
+function isIgnoredFile(filename, sourceText) {
+  if (IGNORE_PATTERNS.some((re) => re.test(filename))) {
+    return true;
+  }
+  return /@generated\b/.test(sourceText.slice(0, 1024));
+}
+function lastWord(name) {
+  const words = name.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[_\s]+/).filter((w) => w.length > 0);
+  const last = words[words.length - 1] ?? name;
+  return last.toLowerCase();
+}
+function isChoiceLikeName(name) {
+  return CHOICE_TOKENS.has(lastWord(name));
+}
+function keyName(key) {
+  if (key.type === AST_NODE_TYPES12.Identifier) {
+    return key.name;
+  }
+  if (key.type === AST_NODE_TYPES12.Literal && typeof key.value === "string") {
+    return key.value;
+  }
+  return null;
+}
+function isStringLiteralUnion(node) {
+  if (node?.type !== AST_NODE_TYPES12.TSUnionType) {
+    return false;
+  }
+  const stringMembers = node.types.filter(
+    (t) => t.type === AST_NODE_TYPES12.TSLiteralType && t.literal.type === AST_NODE_TYPES12.Literal && typeof t.literal.value === "string"
+  );
+  return stringMembers.length >= MIN_CLUSTER_SIZE;
+}
+function refKey(node) {
+  if (node.type === AST_NODE_TYPES12.Identifier) {
+    return node.name;
+  }
+  if (node.type === AST_NODE_TYPES12.MemberExpression && !node.computed) {
+    const inner = refKey(node.object);
+    if (inner === null || node.property.type !== AST_NODE_TYPES12.Identifier) {
+      return null;
+    }
+    return `${inner}.${node.property.name}`;
+  }
+  return null;
+}
+function strLiteral(node) {
+  if (node.type === AST_NODE_TYPES12.Literal && typeof node.value === "string") {
+    return node.value;
+  }
+  return null;
+}
+var prefer_string_literal_union_default = ESLintUtils25.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "prefer-string-literal-union",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Flag raw `string` choice fields and string-literal comparison clusters; prefer a string-literal union type."
+    },
+    schema: [],
+    messages: {
+      bareChoiceField: '`{{name}}: string` looks like a choice field \u2014 prefer a string-literal union type (e.g. `type X = "a" | "b"`). Enums are banned by `no-enum`; use a union.',
+      comparisonCluster: '`{{key}}` is compared against a closed set of string literals \u2014 define a string-literal union type (e.g. `type X = "a" | "b"`).'
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const filename = context.filename;
+    const sourceText = context.sourceCode.getText();
+    if (isIgnoredFile(filename, sourceText)) {
+      return {};
+    }
+    const scopeStack = [];
+    const validClusters = [];
+    const bareChoiceProps = [];
+    const containersWithUnion = /* @__PURE__ */ new Set();
+    function pushScope() {
+      scopeStack.push(/* @__PURE__ */ new Map());
+    }
+    function popScope() {
+      const clusters = scopeStack.pop();
+      if (clusters === void 0) {
+        return;
+      }
+      for (const entry of clusters.values()) {
+        if (entry.allTokens && entry.literals.size >= MIN_CLUSTER_SIZE) {
+          validClusters.push(entry.node);
+        }
+      }
+    }
+    function accumulate(key, literals, node) {
+      const scope = scopeStack[scopeStack.length - 1];
+      if (scope === void 0) {
+        return;
+      }
+      const allTokens = literals.every((lit) => LOWER_TOKEN_RE.test(lit));
+      const existing = scope.get(key);
+      if (existing === void 0) {
+        scope.set(key, {
+          node,
+          literals: new Set(literals),
+          allTokens
+        });
+        return;
+      }
+      for (const lit of literals) {
+        existing.literals.add(lit);
+      }
+      existing.allTokens = existing.allTokens && allTokens;
+    }
+    function collectProperty(key, typeNode, container, node) {
+      if (isStringLiteralUnion(typeNode)) {
+        containersWithUnion.add(container);
+        return;
+      }
+      if (typeNode?.type !== AST_NODE_TYPES12.TSStringKeyword) {
+        return;
+      }
+      const name = keyName(key);
+      if (name === null || !isChoiceLikeName(name)) {
+        return;
+      }
+      bareChoiceProps.push({ name, container, node });
+    }
+    return {
+      FunctionDeclaration: pushScope,
+      "FunctionDeclaration:exit": popScope,
+      FunctionExpression: pushScope,
+      "FunctionExpression:exit": popScope,
+      ArrowFunctionExpression: pushScope,
+      "ArrowFunctionExpression:exit": popScope,
+      BinaryExpression(node) {
+        if (node.operator !== "===" && node.operator !== "!==" && node.operator !== "==" && node.operator !== "!=") {
+          return;
+        }
+        const leftKey = refKey(node.left);
+        const rightLit = strLiteral(node.right);
+        const rightKey = refKey(node.right);
+        const leftLit = strLiteral(node.left);
+        if (leftKey !== null && rightLit !== null) {
+          accumulate(leftKey, [rightLit], node);
+        } else if (rightKey !== null && leftLit !== null) {
+          accumulate(rightKey, [leftLit], node);
+        }
+      },
+      SwitchStatement(node) {
+        const key = refKey(node.discriminant);
+        if (key === null) {
+          return;
+        }
+        const literals = [];
+        for (const c of node.cases) {
+          if (c.test !== null) {
+            const lit = strLiteral(c.test);
+            if (lit !== null) {
+              literals.push(lit);
+            }
+          }
+        }
+        if (literals.length > 0) {
+          accumulate(key, literals, node);
+        }
+      },
+      TSPropertySignature(node) {
+        collectProperty(
+          node.key,
+          node.typeAnnotation?.typeAnnotation,
+          node.parent,
+          node
+        );
+      },
+      PropertyDefinition(node) {
+        collectProperty(
+          node.key,
+          node.typeAnnotation?.typeAnnotation,
+          node.parent,
+          node
+        );
+      },
+      "Program:exit"() {
+        for (const clusterNode of validClusters) {
+          context.report({
+            node: clusterNode,
+            messageId: "comparisonCluster",
+            data: { key: refKeyText(clusterNode) }
+          });
+        }
+        for (const prop of bareChoiceProps) {
+          if (containersWithUnion.has(prop.container)) {
+            context.report({
+              node: prop.node,
+              messageId: "bareChoiceField",
+              data: { name: prop.name }
+            });
+          }
+        }
+      }
+    };
+    function refKeyText(node) {
+      if (node.type === AST_NODE_TYPES12.BinaryExpression) {
+        return refKey(node.left) ?? refKey(node.right) ?? "value";
+      }
+      if (node.type === AST_NODE_TYPES12.SwitchStatement) {
+        return refKey(node.discriminant) ?? "value";
+      }
+      return "value";
+    }
+  }
+});
+
+// src/rules/single-public-export.ts
+import { ESLintUtils as ESLintUtils26, AST_NODE_TYPES as AST_NODE_TYPES13 } from "@typescript-eslint/utils";
+var JUNK_DRAWER_STEMS = /* @__PURE__ */ new Set([
+  "util",
+  "utils",
+  "helper",
+  "helpers",
+  "common",
+  "constant",
+  "constants",
+  "type",
+  "types",
+  "model",
+  "models",
+  "shared",
+  "misc"
+]);
+var CONVENTIONAL_BUCKET_EXPORTS = /* @__PURE__ */ new Set(["cn"]);
+var ACRONYM_OVERRIDES = [
+  [/OAuth/g, "Oauth"],
+  [/GraphQL/g, "Graphql"],
+  [/gRPC/g, "Grpc"]
+];
+var CAMEL_BOUNDARY_RE = /(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/g;
+var TEST_FILE_RE = /\.(test|spec)\.[cm]?[jt]sx?$/i;
+var SCRIPT_EXT_RE = /\.[cm]?[jt]sx?$/i;
+var basename = (filename) => filename.split(/[/\\]/).pop() ?? filename;
+var stemOf = (base) => base.replace(SCRIPT_EXT_RE, "");
+var kebabCase = (name) => {
+  let normalized = name;
+  for (const [pattern, replacement] of ACRONYM_OVERRIDES) {
+    normalized = normalized.replace(pattern, replacement);
+  }
+  return normalized.replace(CAMEL_BOUNDARY_RE, "-").toLowerCase();
+};
+var isFunctionExpression2 = (node) => node !== null && (node.type === AST_NODE_TYPES13.ArrowFunctionExpression || node.type === AST_NODE_TYPES13.FunctionExpression);
+var functionConstName = (decl) => {
+  if (decl.declarations.length !== 1) return null;
+  const [declarator] = decl.declarations;
+  if (declarator === void 0) return null;
+  if (declarator.id.type !== AST_NODE_TYPES13.Identifier) return null;
+  if (!isFunctionExpression2(declarator.init)) return null;
+  return declarator.id.name;
+};
+var summarizeExports = (body) => {
+  let names = 0;
+  let hasReExport = false;
+  let candidate = null;
+  const addCandidate = (name, node) => {
+    names += 1;
+    candidate = { name, node };
+  };
+  for (const statement of body) {
+    switch (statement.type) {
+      case AST_NODE_TYPES13.ExportAllDeclaration:
+        hasReExport = true;
+        break;
+      case AST_NODE_TYPES13.ExportDefaultDeclaration: {
+        names += 1;
+        const decl = statement.declaration;
+        if (decl.type === AST_NODE_TYPES13.FunctionDeclaration && decl.id !== null) {
+          candidate = { name: decl.id.name, node: statement };
+        } else if (decl.type === AST_NODE_TYPES13.ClassDeclaration && decl.id !== null) {
+          candidate = { name: decl.id.name, node: statement };
+        }
+        break;
+      }
+      case AST_NODE_TYPES13.ExportNamedDeclaration: {
+        if (statement.source !== null) {
+          hasReExport = true;
+          break;
+        }
+        const decl = statement.declaration;
+        if (decl === null) {
+          names += statement.specifiers.length;
+          break;
+        }
+        switch (decl.type) {
+          case AST_NODE_TYPES13.FunctionDeclaration:
+            if (decl.id !== null) addCandidate(decl.id.name, statement);
+            else names += 1;
+            break;
+          case AST_NODE_TYPES13.ClassDeclaration:
+            if (decl.id !== null) addCandidate(decl.id.name, statement);
+            else names += 1;
+            break;
+          case AST_NODE_TYPES13.VariableDeclaration: {
+            const fnName = functionConstName(decl);
+            if (fnName !== null && decl.declarations.length === 1) {
+              addCandidate(fnName, statement);
+            } else {
+              names += decl.declarations.length;
+            }
+            break;
+          }
+          default:
+            names += 1;
+        }
+        break;
+      }
+      default:
+        break;
+    }
+  }
+  return { names, hasReExport, candidate };
+};
+var single_public_export_default = ESLintUtils26.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "single-public-export",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "A junk-drawer module stem (`utils`, `helpers`, `types`, ...) with a single public function/class/const export should be renamed after that export."
+    },
+    schema: [],
+    messages: {
+      renameJunkDrawer: "Module stem `{{stem}}` is a generic junk-drawer name; its sole public export is `{{name}}` \u2014 rename the file to `{{expected}}.ts` to describe its responsibility."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const base = basename(context.filename);
+    if (base.endsWith(".d.ts")) return {};
+    if (TEST_FILE_RE.test(base)) return {};
+    const stem = stemOf(base);
+    if (!JUNK_DRAWER_STEMS.has(stem.toLowerCase())) return {};
+    return {
+      Program(node) {
+        const { names, hasReExport, candidate } = summarizeExports(node.body);
+        if (hasReExport) return;
+        if (names !== 1 || candidate === null) return;
+        if (CONVENTIONAL_BUCKET_EXPORTS.has(candidate.name)) return;
+        const expected = kebabCase(candidate.name);
+        if (stem === expected) return;
+        context.report({
+          node: candidate.node,
+          messageId: "renameJunkDrawer",
+          data: { stem, name: candidate.name, expected }
+        });
+      }
+    };
+  }
+});
+
 // src/index.ts
 var rules = {
   "enforce-file-structure": enforce_file_structure_default,
   "no-client-side-data-fetching": no_client_side_data_fetching_default,
+  "no-comment-cruft": no_comment_cruft_default,
   "no-enum": no_enum_default,
   "no-insecure-random-id": no_insecure_random_id_default,
   "no-json-stringify-error": no_json_stringify_error_default,
@@ -1637,16 +3067,23 @@ var rules = {
   "no-unnecessary-use-client": no_unnecessary_use_client_default,
   "prefer-discriminated-union": prefer_discriminated_union_default,
   "prefer-schema-for-api-payload": prefer_schema_for_api_payload_default,
+  "prefer-semantic-colors": prefer_semantic_colors_default,
   "prefer-server-actions": prefer_server_actions_default,
   "prefer-shadcn": prefer_shadcn_default,
   "require-assert-never": require_assert_never_default,
   "require-zod-form-validation": require_zod_form_validation_default,
-  "zod-naming-convention": zod_naming_convention_default
+  "zod-naming-convention": zod_naming_convention_default,
+  "no-cors-wildcard-with-credentials": no_cors_wildcard_with_credentials_default,
+  "no-fat-try-blocks": no_fat_try_blocks_default,
+  "no-secret-in-log": no_secret_in_log_default,
+  "no-template-literal-in-log": no_template_literal_in_log_default,
+  "prefer-string-literal-union": prefer_string_literal_union_default,
+  "single-public-export": single_public_export_default
 };
 var plugin = {
   meta: {
     name: "@sarj/eslint-plugin",
-    version: "2.1.1"
+    version: "2.3.0"
   },
   rules,
   configs: {
@@ -1668,7 +3105,17 @@ var plugin = {
         "@sarj/no-insecure-random-id": "warn",
         "@sarj/no-json-stringify-error": "warn",
         "@sarj/no-string-concat-in-loop": "warn",
-        "@sarj/prefer-discriminated-union": "warn"
+        "@sarj/prefer-discriminated-union": "warn",
+        "@sarj/no-comment-cruft": "warn",
+        // Frontend / styling — distilled from frontend PR-review mining.
+        "@sarj/prefer-semantic-colors": "warn",
+        // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
+        "@sarj/no-fat-try-blocks": "warn",
+        "@sarj/no-cors-wildcard-with-credentials": "warn",
+        "@sarj/no-template-literal-in-log": "warn",
+        "@sarj/no-secret-in-log": "warn",
+        "@sarj/single-public-export": "warn",
+        "@sarj/prefer-string-literal-union": "warn"
       }
     },
     strict: {
@@ -1692,7 +3139,19 @@ var plugin = {
         "@sarj/no-insecure-random-id": "error",
         "@sarj/no-json-stringify-error": "error",
         "@sarj/no-string-concat-in-loop": "error",
-        "@sarj/prefer-discriminated-union": "error"
+        "@sarj/prefer-discriminated-union": "error",
+        "@sarj/no-comment-cruft": "error",
+        // Frontend / styling — distilled from frontend PR-review mining. Stylistic,
+        // no autofix → warn (rollout should prove the FP rate before raising it).
+        "@sarj/prefer-semantic-colors": "warn",
+        // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
+        "@sarj/no-fat-try-blocks": "error",
+        "@sarj/no-cors-wildcard-with-credentials": "error",
+        "@sarj/no-template-literal-in-log": "error",
+        "@sarj/no-secret-in-log": "error",
+        "@sarj/single-public-export": "error",
+        // High-volume/stylistic — warn until rollout proves FP rate.
+        "@sarj/prefer-string-literal-union": "warn"
       }
     }
   }