@sarj/eslint-plugin 2.2.0 → 2.3.1

package/dist/index.js

@@ -827,14 +827,14 @@ var no_sequential_await_default = ESLintUtils10.RuleCreator(
         const value = node[key];
         if (Array.isArray(value)) {
           for (const child of value) {
-            if (isNode2(child) && !isLoop(child)) {
+            if (isNode4(child) && !isLoop(child)) {
               const found = findAwaitInScope(child);
               if (found) {
                 return found;
               }
             }
           }
-        } else if (isNode2(value) && !isLoop(value)) {
+        } else if (isNode4(value) && !isLoop(value)) {
           const found = findAwaitInScope(value);
           if (found) {
             return found;
@@ -843,7 +843,7 @@ var no_sequential_await_default = ESLintUtils10.RuleCreator(
       }
       return null;
     }
-    function isNode2(value) {
+    function isNode4(value) {
       return typeof value === "object" && value !== null && typeof value.type === "string";
     }
     function checkLoop(node) {
@@ -1573,13 +1573,13 @@ function getPropertyNode(objNode, propName2) {
   if (!objNode || objNode.type !== "ObjectExpression") return null;
   for (const prop of objNode.properties) {
     if (prop.type !== "Property") continue;
-    let keyName = null;
+    let keyName2 = null;
     if (prop.key.type === "Identifier" && !prop.computed) {
-      keyName = prop.key.name;
+      keyName2 = prop.key.name;
     } else if (prop.key.type === "Literal" && typeof prop.key.value === "string") {
-      keyName = prop.key.value;
+      keyName2 = prop.key.value;
     }
-    if (keyName === propName2) {
+    if (keyName2 === propName2) {
       if (prop.value.type === "AssignmentPattern" || prop.value.type === "ArrayPattern" || prop.value.type === "ObjectPattern") {
         return null;
       }
@@ -1921,6 +1921,1025 @@ var zod_naming_convention_default = ESLintUtils20.RuleCreator(
   }
 });
 
+// src/rules/no-cors-wildcard-with-credentials.ts
+import { ESLintUtils as ESLintUtils21 } from "@typescript-eslint/utils";
+var ACAO_HEADER = "access-control-allow-origin";
+var ACAC_HEADER = "access-control-allow-credentials";
+var HEADER_SET_METHODS = /* @__PURE__ */ new Set(["setheader", "set", "append"]);
+function isTrueLiteral(node) {
+  return node.type === "Literal" && node.value === true;
+}
+function isCredentialsTrueValue(node) {
+  if (node.type === "Literal") {
+    if (node.value === true) {
+      return true;
+    }
+    if (typeof node.value === "string") {
+      return node.value.trim().toLowerCase() === "true";
+    }
+  }
+  return false;
+}
+function isStarLiteral(node) {
+  return node.type === "Literal" && node.value === "*";
+}
+function subtreeContainsStarLiteral(node) {
+  if (isStarLiteral(node)) {
+    return true;
+  }
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") {
+      continue;
+    }
+    const value = node[key];
+    if (Array.isArray(value)) {
+      for (const child of value) {
+        if (isNode2(child) && subtreeContainsStarLiteral(child)) {
+          return true;
+        }
+      }
+    } else if (isNode2(value) && subtreeContainsStarLiteral(value)) {
+      return true;
+    }
+  }
+  return false;
+}
+function isNode2(value) {
+  return typeof value === "object" && value !== null && typeof value.type === "string";
+}
+function propertyKeyName(prop) {
+  if (prop.computed) {
+    return void 0;
+  }
+  const key = prop.key;
+  if (key.type === "Identifier") {
+    return key.name;
+  }
+  if (key.type === "Literal" && typeof key.value === "string") {
+    return key.value;
+  }
+  return void 0;
+}
+function calleeName(node) {
+  const callee = node.callee;
+  if (callee.type === "Identifier") {
+    return callee.name;
+  }
+  if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier") {
+    return callee.property.name;
+  }
+  return void 0;
+}
+function isCorsWildcardCredentialsCall(node) {
+  const name = calleeName(node);
+  if (name === void 0 || name.toLowerCase() !== "cors") {
+    return false;
+  }
+  const options = node.arguments.find(
+    (arg) => arg.type === "ObjectExpression"
+  );
+  if (options === void 0) {
+    return false;
+  }
+  let hasCredentials = false;
+  let hasWildcardOrigin = false;
+  for (const prop of options.properties) {
+    if (prop.type !== "Property") {
+      continue;
+    }
+    const key = propertyKeyName(prop);
+    if (key === "credentials" && isTrueLiteral(prop.value)) {
+      hasCredentials = true;
+    } else if (key === "origin" && subtreeContainsStarLiteral(prop.value)) {
+      hasWildcardOrigin = true;
+    }
+  }
+  return hasCredentials && hasWildcardOrigin;
+}
+function isWildcardCredentialsHeaderObject(node) {
+  let wildcardOrigin = false;
+  let credentialsTrue = false;
+  for (const prop of node.properties) {
+    if (prop.type !== "Property") {
+      continue;
+    }
+    const key = propertyKeyName(prop);
+    if (key === void 0) {
+      continue;
+    }
+    const header = key.toLowerCase();
+    if (header === ACAO_HEADER && isStarLiteral(prop.value)) {
+      wildcardOrigin = true;
+    } else if (header === ACAC_HEADER && isCredentialsTrueValue(prop.value)) {
+      credentialsTrue = true;
+    }
+  }
+  return wildcardOrigin && credentialsTrue;
+}
+function classifyHeaderSetCall(node) {
+  const callee = node.callee;
+  if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier" || !HEADER_SET_METHODS.has(callee.property.name.toLowerCase())) {
+    return void 0;
+  }
+  const [nameArg, valueArg] = node.arguments;
+  if (nameArg === void 0 || valueArg === void 0 || nameArg.type !== "Literal" || typeof nameArg.value !== "string") {
+    return void 0;
+  }
+  const header = nameArg.value.toLowerCase();
+  if (header === ACAO_HEADER && isStarLiteral(valueArg)) {
+    return "origin";
+  }
+  if (header === ACAC_HEADER && isCredentialsTrueValue(valueArg)) {
+    return "credentials";
+  }
+  return void 0;
+}
+function enclosingScope(node) {
+  let current = node.parent;
+  while (current) {
+    if (current.type === "FunctionDeclaration" || current.type === "FunctionExpression" || current.type === "ArrowFunctionExpression") {
+      return current;
+    }
+    current = current.parent;
+  }
+  return void 0;
+}
+var no_cors_wildcard_with_credentials_default = ESLintUtils21.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-cors-wildcard-with-credentials",
+  meta: {
+    type: "problem",
+    docs: {
+      description: 'Disallow CORS that reflects any Origin (`"*"`) while allowing credentials; any site could then read authenticated responses. Enumerate explicit trusted origins instead.'
+    },
+    schema: [],
+    messages: {
+      corsWildcardWithCredentials: 'CORS reflects any Origin (`"*"`) while allowing credentials \u2014 any site can read authenticated responses. Enumerate explicit trusted origins instead of using `"*"` with credentials.'
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const scopeHeaderSets = /* @__PURE__ */ new Map();
+    function recordHeaderSet(node, kind) {
+      const key = enclosingScope(node) ?? "module";
+      let entry = scopeHeaderSets.get(key);
+      if (entry === void 0) {
+        entry = { originNodes: [], credentialsNodes: [] };
+        scopeHeaderSets.set(key, entry);
+      }
+      if (kind === "origin") {
+        entry.originNodes.push(node);
+      } else {
+        entry.credentialsNodes.push(node);
+      }
+    }
+    return {
+      NewExpression(node) {
+        if (isCorsWildcardCredentialsCall(node)) {
+          context.report({ node, messageId: "corsWildcardWithCredentials" });
+        }
+      },
+      CallExpression(node) {
+        if (isCorsWildcardCredentialsCall(node)) {
+          context.report({ node, messageId: "corsWildcardWithCredentials" });
+          return;
+        }
+        const kind = classifyHeaderSetCall(node);
+        if (kind !== void 0) {
+          recordHeaderSet(node, kind);
+        }
+      },
+      ObjectExpression(node) {
+        if (isWildcardCredentialsHeaderObject(node)) {
+          context.report({ node, messageId: "corsWildcardWithCredentials" });
+        }
+      },
+      "Program:exit"() {
+        for (const { originNodes, credentialsNodes } of scopeHeaderSets.values()) {
+          if (originNodes.length > 0 && credentialsNodes.length > 0) {
+            for (const node of originNodes) {
+              context.report({
+                node,
+                messageId: "corsWildcardWithCredentials"
+              });
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/rules/no-fat-try-blocks.ts
+import {
+  ESLintUtils as ESLintUtils22,
+  AST_NODE_TYPES as AST_NODE_TYPES11
+} from "@typescript-eslint/utils";
+var MAX_TRY_BODY_STATEMENTS = 3;
+var NESTED_FUNCTION_TYPES = /* @__PURE__ */ new Set([
+  AST_NODE_TYPES11.FunctionDeclaration,
+  AST_NODE_TYPES11.FunctionExpression,
+  AST_NODE_TYPES11.ArrowFunctionExpression
+]);
+var PURE_METHODS = /* @__PURE__ */ new Set([
+  "map",
+  "filter",
+  "forEach",
+  "reduce",
+  "reduceRight",
+  "find",
+  "findIndex",
+  "findLast",
+  "findLastIndex",
+  "some",
+  "every",
+  "push",
+  "pop",
+  "shift",
+  "unshift",
+  "slice",
+  "splice",
+  "concat",
+  "flat",
+  "flatMap",
+  "join",
+  "reverse",
+  "sort",
+  "fill",
+  "includes",
+  "indexOf",
+  "lastIndexOf",
+  "at",
+  "keys",
+  "values",
+  "entries",
+  "has",
+  "get",
+  "set",
+  "add",
+  "delete",
+  "clear",
+  "toString",
+  "toLocaleString",
+  "valueOf",
+  "charAt",
+  "charCodeAt",
+  "codePointAt",
+  "split",
+  "padStart",
+  "padEnd",
+  "repeat",
+  "trim",
+  "trimStart",
+  "trimEnd",
+  "toUpperCase",
+  "toLowerCase",
+  "toFixed",
+  "toPrecision",
+  "startsWith",
+  "endsWith"
+]);
+var PURE_NAMESPACES = /* @__PURE__ */ new Set([
+  "Object",
+  "Array",
+  "Math",
+  "JSON",
+  "Number",
+  "String",
+  "Boolean",
+  "console"
+]);
+var PURE_CONSTRUCTORS = /* @__PURE__ */ new Set([
+  "Map",
+  "Set",
+  "WeakMap",
+  "WeakSet",
+  "Date",
+  "Error",
+  "TypeError",
+  "RangeError",
+  "Array",
+  "Object",
+  "Headers",
+  "URLSearchParams",
+  "FormData"
+]);
+function isNode3(value) {
+  return typeof value === "object" && value !== null && typeof value.type === "string";
+}
+function isPureCall(node) {
+  const callee = node.callee;
+  if (callee.type !== AST_NODE_TYPES11.MemberExpression) {
+    return false;
+  }
+  const property = callee.property;
+  if (property.type !== AST_NODE_TYPES11.Identifier) {
+    return false;
+  }
+  if (callee.object.type === AST_NODE_TYPES11.Identifier && PURE_NAMESPACES.has(callee.object.name)) {
+    return true;
+  }
+  return PURE_METHODS.has(property.name);
+}
+function isPureNew(node) {
+  return node.callee.type === AST_NODE_TYPES11.Identifier && PURE_CONSTRUCTORS.has(node.callee.name);
+}
+function subtreeMatches(stmt, predicate) {
+  let found = false;
+  const visit = (current) => {
+    if (found) {
+      return;
+    }
+    if (predicate(current)) {
+      found = true;
+      return;
+    }
+    for (const key of Object.keys(current)) {
+      if (key === "parent") {
+        continue;
+      }
+      if (NESTED_FUNCTION_TYPES.has(current.type) && key === "body") {
+        continue;
+      }
+      const value = current[key];
+      if (Array.isArray(value)) {
+        for (const child of value) {
+          if (isNode3(child)) {
+            visit(child);
+          }
+        }
+      } else if (isNode3(value)) {
+        visit(value);
+      }
+      if (found) {
+        return;
+      }
+    }
+  };
+  visit(stmt);
+  return found;
+}
+var hasAwait = (stmt) => subtreeMatches(stmt, (n) => n.type === AST_NODE_TYPES11.AwaitExpression);
+var hasThrowingCallOrNew = (stmt) => subtreeMatches(
+  stmt,
+  (n) => n.type === AST_NODE_TYPES11.CallExpression && !isPureCall(n) || n.type === AST_NODE_TYPES11.NewExpression && !isPureNew(n)
+);
+function unwrap2(expr) {
+  let current = expr;
+  while (current.type === AST_NODE_TYPES11.ChainExpression || current.type === AST_NODE_TYPES11.TSNonNullExpression) {
+    current = current.expression;
+  }
+  return current;
+}
+function canThrow(stmt) {
+  if (hasAwait(stmt)) {
+    return true;
+  }
+  if (stmt.type === AST_NODE_TYPES11.ExpressionStatement && unwrap2(stmt.expression).type === AST_NODE_TYPES11.CallExpression) {
+    return false;
+  }
+  return hasThrowingCallOrNew(stmt);
+}
+function handlerRethrows(handler) {
+  if (handler === null) {
+    return false;
+  }
+  const body = handler.body.body;
+  const last = body[body.length - 1];
+  return last !== void 0 && last.type === AST_NODE_TYPES11.ThrowStatement;
+}
+var no_fat_try_blocks_default = ESLintUtils22.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-fat-try-blocks",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow `try` blocks with more than three top-level statements that can throw \u2014 isolate the throwing statement and move non-throwing work outside."
+    },
+    schema: [],
+    messages: {
+      fatTryBlock: "This `try` block has {{count}} statements that can throw (max {{max}}). Isolate the throwing statement(s); move non-throwing work outside the `try`."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const sourceCode = context.sourceCode;
+    return {
+      TryStatement(node) {
+        if (node.finalizer !== null) {
+          return;
+        }
+        if (handlerRethrows(node.handler)) {
+          return;
+        }
+        const count = node.block.body.filter(canThrow).length;
+        if (count <= MAX_TRY_BODY_STATEMENTS) {
+          return;
+        }
+        const tryKeyword = sourceCode.getFirstToken(node);
+        context.report({
+          node: tryKeyword ?? node,
+          messageId: "fatTryBlock",
+          data: { count, max: MAX_TRY_BODY_STATEMENTS }
+        });
+      }
+    };
+  }
+});
+
+// src/rules/no-secret-in-log.ts
+import { ESLintUtils as ESLintUtils23 } from "@typescript-eslint/utils";
+var LOG_METHODS = /* @__PURE__ */ new Set([
+  "debug",
+  "info",
+  "warn",
+  "warning",
+  "error",
+  "exception",
+  "critical",
+  "trace",
+  "log",
+  "fatal",
+  "success"
+]);
+var LOGGER_NAMES = /* @__PURE__ */ new Set([
+  "logger",
+  "log",
+  "logging",
+  "loguru",
+  "console",
+  "_logger",
+  "_log"
+]);
+var LOGGER_FACTORIES = /* @__PURE__ */ new Set(["getlogger", "get_logger"]);
+var SECRET_WORDS = /* @__PURE__ */ new Set([
+  "token",
+  "secret",
+  "password",
+  "passwd",
+  "jwt",
+  "secrets",
+  "passwords",
+  "credential",
+  "credentials",
+  "authorization",
+  "signature",
+  "hmac",
+  "digest",
+  "hash",
+  "apikey"
+]);
+var INNOCUOUS_WORDS = /* @__PURE__ */ new Set([
+  "count",
+  "counts",
+  "budget",
+  "limit",
+  "limits",
+  "id",
+  "ids",
+  "enabled",
+  "disabled",
+  "flag",
+  "flags",
+  "present",
+  "set",
+  "unset",
+  "configured",
+  "missing",
+  "required",
+  "valid",
+  "invalid",
+  "exists",
+  "type",
+  "types"
+]);
+var REDACTION_RE = /prefix|suffix|redact|mask|hash|hint|_len|length/i;
+var WHOLE_TOKEN_REDACTION_MARKERS = /* @__PURE__ */ new Set(["tag"]);
+var CAMEL_RE = /[A-Z]+(?=[A-Z][a-z])|[A-Z]?[a-z]+|[A-Z]+|\d+/g;
+var SEGMENT_RE = /[^A-Za-z0-9]+/;
+function tokenize(identifier) {
+  const tokens = [];
+  for (const segment of identifier.split(SEGMENT_RE)) {
+    if (!segment) {
+      continue;
+    }
+    tokens.push(segment.toLowerCase());
+    for (const part of segment.match(CAMEL_RE) ?? []) {
+      tokens.push(part.toLowerCase());
+    }
+  }
+  return tokens;
+}
+function hasApiKey(tokens) {
+  for (let i = 0; i + 1 < tokens.length; i++) {
+    if (tokens[i] === "api" && tokens[i + 1] === "key") {
+      return true;
+    }
+  }
+  return false;
+}
+function isSecretName(identifier) {
+  const tokens = tokenize(identifier);
+  const last = tokens.at(-1);
+  if (last !== void 0 && INNOCUOUS_WORDS.has(last)) {
+    return false;
+  }
+  if (tokens.some((tok) => SECRET_WORDS.has(tok))) {
+    return true;
+  }
+  return hasApiKey(tokens);
+}
+function isSecretKeyword(name) {
+  if (REDACTION_RE.test(name)) {
+    return false;
+  }
+  if (tokenize(name).some((tok) => WHOLE_TOKEN_REDACTION_MARKERS.has(tok))) {
+    return false;
+  }
+  return isSecretName(name);
+}
+function isLoggerExpr(expr) {
+  switch (expr.type) {
+    case "Identifier":
+      return LOGGER_NAMES.has(expr.name.toLowerCase());
+    case "MemberExpression": {
+      const { property, object } = expr;
+      if (!expr.computed && property.type === "Identifier") {
+        const lowered = property.name.toLowerCase();
+        if (LOGGER_NAMES.has(lowered) || LOGGER_FACTORIES.has(lowered)) {
+          return true;
+        }
+      }
+      return isLoggerExpr(object);
+    }
+    case "CallExpression": {
+      const callee = expr.callee;
+      if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" && LOGGER_FACTORIES.has(callee.property.name.toLowerCase())) {
+        return true;
+      }
+      if (callee.type !== "Super") {
+        return isLoggerExpr(callee);
+      }
+      return false;
+    }
+    default:
+      return false;
+  }
+}
+function propertyKeyName2(prop) {
+  if (prop.computed) {
+    return null;
+  }
+  if (prop.key.type === "Identifier") {
+    return prop.key.name;
+  }
+  if (prop.key.type === "Literal" && typeof prop.key.value === "string") {
+    return prop.key.value;
+  }
+  return null;
+}
+var no_secret_in_log_default = ESLintUtils23.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-secret-in-log",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow passing a secret-named value to a logging call; it leaks to log sinks. Redact or omit it."
+    },
+    schema: [],
+    messages: {
+      noSecretInLog: "Secret `{{name}}` passed to a logging call leaks it to log sinks. Redact (e.g. `{{name}}Prefix: {{name}}.slice(0, 6)`) or omit it."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CallExpression(node) {
+        const callee = node.callee;
+        if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier" || !LOG_METHODS.has(callee.property.name)) {
+          return;
+        }
+        if (!isLoggerExpr(callee.object)) {
+          return;
+        }
+        for (const arg of node.arguments) {
+          if (arg.type === "Identifier") {
+            if (isSecretKeyword(arg.name)) {
+              context.report({
+                node: arg,
+                messageId: "noSecretInLog",
+                data: { name: arg.name }
+              });
+            }
+            continue;
+          }
+          if (arg.type === "ObjectExpression") {
+            for (const prop of arg.properties) {
+              if (prop.type !== "Property") {
+                continue;
+              }
+              const keyName2 = propertyKeyName2(prop);
+              if (keyName2 !== null && isSecretKeyword(keyName2)) {
+                context.report({
+                  node: prop,
+                  messageId: "noSecretInLog",
+                  data: { name: keyName2 }
+                });
+              }
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/rules/prefer-string-literal-union.ts
+import {
+  ESLintUtils as ESLintUtils24,
+  AST_NODE_TYPES as AST_NODE_TYPES12
+} from "@typescript-eslint/utils";
+var CHOICE_TOKENS = /* @__PURE__ */ new Set([
+  "status",
+  "state",
+  "kind",
+  "role",
+  "priority",
+  "severity",
+  "direction",
+  "tier",
+  "stage",
+  "type",
+  "mode",
+  "level"
+]);
+var LOWER_TOKEN_RE = /^[a-z][a-z0-9_-]{0,30}$/;
+var MIN_CLUSTER_SIZE = 2;
+var IGNORE_PATTERNS = [
+  /[\\/]generated[\\/]/,
+  /\.gen\.tsx?$/,
+  /\.generated\.tsx?$/,
+  /\.d\.ts$/
+];
+function isIgnoredFile(filename, sourceText) {
+  if (IGNORE_PATTERNS.some((re) => re.test(filename))) {
+    return true;
+  }
+  return /@generated\b/.test(sourceText.slice(0, 1024));
+}
+function lastWord(name) {
+  const words = name.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[_\s]+/).filter((w) => w.length > 0);
+  const last = words[words.length - 1] ?? name;
+  return last.toLowerCase();
+}
+function isChoiceLikeName(name) {
+  return CHOICE_TOKENS.has(lastWord(name));
+}
+function keyName(key) {
+  if (key.type === AST_NODE_TYPES12.Identifier) {
+    return key.name;
+  }
+  if (key.type === AST_NODE_TYPES12.Literal && typeof key.value === "string") {
+    return key.value;
+  }
+  return null;
+}
+function isStringLiteralUnion(node) {
+  if (node?.type !== AST_NODE_TYPES12.TSUnionType) {
+    return false;
+  }
+  const stringMembers = node.types.filter(
+    (t) => t.type === AST_NODE_TYPES12.TSLiteralType && t.literal.type === AST_NODE_TYPES12.Literal && typeof t.literal.value === "string"
+  );
+  return stringMembers.length >= MIN_CLUSTER_SIZE;
+}
+function refKey(node) {
+  if (node.type === AST_NODE_TYPES12.Identifier) {
+    return node.name;
+  }
+  if (node.type === AST_NODE_TYPES12.MemberExpression && !node.computed) {
+    const inner = refKey(node.object);
+    if (inner === null || node.property.type !== AST_NODE_TYPES12.Identifier) {
+      return null;
+    }
+    return `${inner}.${node.property.name}`;
+  }
+  return null;
+}
+function strLiteral(node) {
+  if (node.type === AST_NODE_TYPES12.Literal && typeof node.value === "string") {
+    return node.value;
+  }
+  return null;
+}
+var prefer_string_literal_union_default = ESLintUtils24.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "prefer-string-literal-union",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Flag raw `string` choice fields and string-literal comparison clusters; prefer a string-literal union type."
+    },
+    schema: [],
+    messages: {
+      bareChoiceField: '`{{name}}: string` looks like a choice field \u2014 prefer a string-literal union type (e.g. `type X = "a" | "b"`). Enums are banned by `no-enum`; use a union.',
+      comparisonCluster: '`{{key}}` is compared against a closed set of string literals \u2014 define a string-literal union type (e.g. `type X = "a" | "b"`).'
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const filename = context.filename;
+    const sourceText = context.sourceCode.getText();
+    if (isIgnoredFile(filename, sourceText)) {
+      return {};
+    }
+    const scopeStack = [];
+    const validClusters = [];
+    const bareChoiceProps = [];
+    const containersWithUnion = /* @__PURE__ */ new Set();
+    function pushScope() {
+      scopeStack.push(/* @__PURE__ */ new Map());
+    }
+    function popScope() {
+      const clusters = scopeStack.pop();
+      if (clusters === void 0) {
+        return;
+      }
+      for (const entry of clusters.values()) {
+        if (entry.allTokens && entry.literals.size >= MIN_CLUSTER_SIZE) {
+          validClusters.push(entry.node);
+        }
+      }
+    }
+    function accumulate(key, literals, node) {
+      const scope = scopeStack[scopeStack.length - 1];
+      if (scope === void 0) {
+        return;
+      }
+      const allTokens = literals.every((lit) => LOWER_TOKEN_RE.test(lit));
+      const existing = scope.get(key);
+      if (existing === void 0) {
+        scope.set(key, {
+          node,
+          literals: new Set(literals),
+          allTokens
+        });
+        return;
+      }
+      for (const lit of literals) {
+        existing.literals.add(lit);
+      }
+      existing.allTokens = existing.allTokens && allTokens;
+    }
+    function collectProperty(key, typeNode, container, node) {
+      if (isStringLiteralUnion(typeNode)) {
+        containersWithUnion.add(container);
+        return;
+      }
+      if (typeNode?.type !== AST_NODE_TYPES12.TSStringKeyword) {
+        return;
+      }
+      const name = keyName(key);
+      if (name === null || !isChoiceLikeName(name)) {
+        return;
+      }
+      bareChoiceProps.push({ name, container, node });
+    }
+    return {
+      FunctionDeclaration: pushScope,
+      "FunctionDeclaration:exit": popScope,
+      FunctionExpression: pushScope,
+      "FunctionExpression:exit": popScope,
+      ArrowFunctionExpression: pushScope,
+      "ArrowFunctionExpression:exit": popScope,
+      BinaryExpression(node) {
+        if (node.operator !== "===" && node.operator !== "!==" && node.operator !== "==" && node.operator !== "!=") {
+          return;
+        }
+        const leftKey = refKey(node.left);
+        const rightLit = strLiteral(node.right);
+        const rightKey = refKey(node.right);
+        const leftLit = strLiteral(node.left);
+        if (leftKey !== null && rightLit !== null) {
+          accumulate(leftKey, [rightLit], node);
+        } else if (rightKey !== null && leftLit !== null) {
+          accumulate(rightKey, [leftLit], node);
+        }
+      },
+      SwitchStatement(node) {
+        const key = refKey(node.discriminant);
+        if (key === null) {
+          return;
+        }
+        const literals = [];
+        for (const c of node.cases) {
+          if (c.test !== null) {
+            const lit = strLiteral(c.test);
+            if (lit !== null) {
+              literals.push(lit);
+            }
+          }
+        }
+        if (literals.length > 0) {
+          accumulate(key, literals, node);
+        }
+      },
+      TSPropertySignature(node) {
+        collectProperty(
+          node.key,
+          node.typeAnnotation?.typeAnnotation,
+          node.parent,
+          node
+        );
+      },
+      PropertyDefinition(node) {
+        collectProperty(
+          node.key,
+          node.typeAnnotation?.typeAnnotation,
+          node.parent,
+          node
+        );
+      },
+      "Program:exit"() {
+        for (const clusterNode of validClusters) {
+          context.report({
+            node: clusterNode,
+            messageId: "comparisonCluster",
+            data: { key: refKeyText(clusterNode) }
+          });
+        }
+        for (const prop of bareChoiceProps) {
+          if (containersWithUnion.has(prop.container)) {
+            context.report({
+              node: prop.node,
+              messageId: "bareChoiceField",
+              data: { name: prop.name }
+            });
+          }
+        }
+      }
+    };
+    function refKeyText(node) {
+      if (node.type === AST_NODE_TYPES12.BinaryExpression) {
+        return refKey(node.left) ?? refKey(node.right) ?? "value";
+      }
+      if (node.type === AST_NODE_TYPES12.SwitchStatement) {
+        return refKey(node.discriminant) ?? "value";
+      }
+      return "value";
+    }
+  }
+});
+
+// src/rules/single-public-export.ts
+import { ESLintUtils as ESLintUtils25, AST_NODE_TYPES as AST_NODE_TYPES13 } from "@typescript-eslint/utils";
+var JUNK_DRAWER_STEMS = /* @__PURE__ */ new Set([
+  "util",
+  "utils",
+  "helper",
+  "helpers",
+  "common",
+  "constant",
+  "constants",
+  "type",
+  "types",
+  "model",
+  "models",
+  "shared",
+  "misc"
+]);
+var CONVENTIONAL_BUCKET_EXPORTS = /* @__PURE__ */ new Set(["cn"]);
+var ACRONYM_OVERRIDES = [
+  [/OAuth/g, "Oauth"],
+  [/GraphQL/g, "Graphql"],
+  [/gRPC/g, "Grpc"]
+];
+var CAMEL_BOUNDARY_RE = /(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/g;
+var TEST_FILE_RE = /\.(test|spec)\.[cm]?[jt]sx?$/i;
+var SCRIPT_EXT_RE = /\.[cm]?[jt]sx?$/i;
+var basename = (filename) => filename.split(/[/\\]/).pop() ?? filename;
+var stemOf = (base) => base.replace(SCRIPT_EXT_RE, "");
+var kebabCase = (name) => {
+  let normalized = name;
+  for (const [pattern, replacement] of ACRONYM_OVERRIDES) {
+    normalized = normalized.replace(pattern, replacement);
+  }
+  return normalized.replace(CAMEL_BOUNDARY_RE, "-").toLowerCase();
+};
+var isFunctionExpression2 = (node) => node !== null && (node.type === AST_NODE_TYPES13.ArrowFunctionExpression || node.type === AST_NODE_TYPES13.FunctionExpression);
+var functionConstName = (decl) => {
+  if (decl.declarations.length !== 1) return null;
+  const [declarator] = decl.declarations;
+  if (declarator === void 0) return null;
+  if (declarator.id.type !== AST_NODE_TYPES13.Identifier) return null;
+  if (!isFunctionExpression2(declarator.init)) return null;
+  return declarator.id.name;
+};
+var summarizeExports = (body) => {
+  let names = 0;
+  let hasReExport = false;
+  let candidate = null;
+  const addCandidate = (name, node) => {
+    names += 1;
+    candidate = { name, node };
+  };
+  for (const statement of body) {
+    switch (statement.type) {
+      case AST_NODE_TYPES13.ExportAllDeclaration:
+        hasReExport = true;
+        break;
+      case AST_NODE_TYPES13.ExportDefaultDeclaration: {
+        names += 1;
+        const decl = statement.declaration;
+        if (decl.type === AST_NODE_TYPES13.FunctionDeclaration && decl.id !== null) {
+          candidate = { name: decl.id.name, node: statement };
+        } else if (decl.type === AST_NODE_TYPES13.ClassDeclaration && decl.id !== null) {
+          candidate = { name: decl.id.name, node: statement };
+        }
+        break;
+      }
+      case AST_NODE_TYPES13.ExportNamedDeclaration: {
+        if (statement.source !== null) {
+          hasReExport = true;
+          break;
+        }
+        const decl = statement.declaration;
+        if (decl === null) {
+          names += statement.specifiers.length;
+          break;
+        }
+        switch (decl.type) {
+          case AST_NODE_TYPES13.FunctionDeclaration:
+            if (decl.id !== null) addCandidate(decl.id.name, statement);
+            else names += 1;
+            break;
+          case AST_NODE_TYPES13.ClassDeclaration:
+            if (decl.id !== null) addCandidate(decl.id.name, statement);
+            else names += 1;
+            break;
+          case AST_NODE_TYPES13.VariableDeclaration: {
+            const fnName = functionConstName(decl);
+            if (fnName !== null && decl.declarations.length === 1) {
+              addCandidate(fnName, statement);
+            } else {
+              names += decl.declarations.length;
+            }
+            break;
+          }
+          default:
+            names += 1;
+        }
+        break;
+      }
+      default:
+        break;
+    }
+  }
+  return { names, hasReExport, candidate };
+};
+var single_public_export_default = ESLintUtils25.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "single-public-export",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "A junk-drawer module stem (`utils`, `helpers`, `types`, ...) with a single public function/class/const export should be renamed after that export."
+    },
+    schema: [],
+    messages: {
+      renameJunkDrawer: "Module stem `{{stem}}` is a generic junk-drawer name; its sole public export is `{{name}}` \u2014 rename the file to `{{expected}}.ts` to describe its responsibility."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const base = basename(context.filename);
+    if (base.endsWith(".d.ts")) return {};
+    if (TEST_FILE_RE.test(base)) return {};
+    const stem = stemOf(base);
+    if (!JUNK_DRAWER_STEMS.has(stem.toLowerCase())) return {};
+    return {
+      Program(node) {
+        const { names, hasReExport, candidate } = summarizeExports(node.body);
+        if (hasReExport) return;
+        if (names !== 1 || candidate === null) return;
+        if (CONVENTIONAL_BUCKET_EXPORTS.has(candidate.name)) return;
+        const expected = kebabCase(candidate.name);
+        if (stem === expected) return;
+        context.report({
+          node: candidate.node,
+          messageId: "renameJunkDrawer",
+          data: { stem, name: candidate.name, expected }
+        });
+      }
+    };
+  }
+});
+
 // src/index.ts
 var rules = {
   "enforce-file-structure": enforce_file_structure_default,
@@ -1942,12 +2961,17 @@ var rules = {
   "prefer-shadcn": prefer_shadcn_default,
   "require-assert-never": require_assert_never_default,
   "require-zod-form-validation": require_zod_form_validation_default,
-  "zod-naming-convention": zod_naming_convention_default
+  "zod-naming-convention": zod_naming_convention_default,
+  "no-cors-wildcard-with-credentials": no_cors_wildcard_with_credentials_default,
+  "no-fat-try-blocks": no_fat_try_blocks_default,
+  "no-secret-in-log": no_secret_in_log_default,
+  "prefer-string-literal-union": prefer_string_literal_union_default,
+  "single-public-export": single_public_export_default
 };
 var plugin = {
   meta: {
     name: "@sarj/eslint-plugin",
-    version: "2.2.0"
+    version: "2.3.1"
   },
   rules,
   configs: {
@@ -1972,7 +2996,13 @@ var plugin = {
         "@sarj/prefer-discriminated-union": "warn",
         "@sarj/no-comment-cruft": "warn",
         // Frontend / styling — distilled from frontend PR-review mining.
-        "@sarj/prefer-semantic-colors": "warn"
+        "@sarj/prefer-semantic-colors": "warn",
+        // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
+        "@sarj/no-fat-try-blocks": "warn",
+        "@sarj/no-cors-wildcard-with-credentials": "warn",
+        "@sarj/no-secret-in-log": "warn",
+        "@sarj/single-public-export": "warn",
+        "@sarj/prefer-string-literal-union": "warn"
       }
     },
     strict: {
@@ -2000,7 +3030,14 @@ var plugin = {
         "@sarj/no-comment-cruft": "error",
         // Frontend / styling — distilled from frontend PR-review mining. Stylistic,
         // no autofix → warn (rollout should prove the FP rate before raising it).
-        "@sarj/prefer-semantic-colors": "warn"
+        "@sarj/prefer-semantic-colors": "warn",
+        // Ported from sarj-python-lint (SARJ), corpus-validated FP~0.
+        "@sarj/no-fat-try-blocks": "error",
+        "@sarj/no-cors-wildcard-with-credentials": "error",
+        "@sarj/no-secret-in-log": "error",
+        "@sarj/single-public-export": "error",
+        // High-volume/stylistic — warn until rollout proves FP rate.
+        "@sarj/prefer-string-literal-union": "warn"
       }
     }
   }