@sarj/eslint-plugin 2.4.0 → 2.5.0

package/dist/index.d.cts

@@ -72,6 +72,9 @@ declare const rules: {
     "no-secret-in-log": _typescript_eslint_utils_ts_eslint.RuleModule<"noSecretInLog", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
+    "no-unsafe-cast": _typescript_eslint_utils_ts_eslint.RuleModule<"asAny" | "doubleCast", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
     "prefer-string-literal-union": _typescript_eslint_utils_ts_eslint.RuleModule<"bareChoiceField" | "comparisonCluster", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
@@ -156,6 +159,9 @@ declare const plugin: {
         "no-secret-in-log": _typescript_eslint_utils_ts_eslint.RuleModule<"noSecretInLog", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
+        "no-unsafe-cast": _typescript_eslint_utils_ts_eslint.RuleModule<"asAny" | "doubleCast", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
         "prefer-string-literal-union": _typescript_eslint_utils_ts_eslint.RuleModule<"bareChoiceField" | "comparisonCluster", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
@@ -187,6 +193,7 @@ declare const plugin: {
                 "@sarj/no-fat-try-blocks": string;
                 "@sarj/no-cors-wildcard-with-credentials": string;
                 "@sarj/no-secret-in-log": string;
+                "@sarj/no-unsafe-cast": string;
                 "@sarj/single-public-export": string;
                 "@sarj/prefer-string-literal-union": string;
             };
@@ -217,6 +224,7 @@ declare const plugin: {
                 "@sarj/no-fat-try-blocks": string;
                 "@sarj/no-cors-wildcard-with-credentials": string;
                 "@sarj/no-secret-in-log": string;
+                "@sarj/no-unsafe-cast": string;
                 "@sarj/single-public-export": string;
                 "@sarj/prefer-string-literal-union": string;
             };

package/dist/index.d.ts

@@ -72,6 +72,9 @@ declare const rules: {
     "no-secret-in-log": _typescript_eslint_utils_ts_eslint.RuleModule<"noSecretInLog", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
+    "no-unsafe-cast": _typescript_eslint_utils_ts_eslint.RuleModule<"asAny" | "doubleCast", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+        name: string;
+    };
     "prefer-string-literal-union": _typescript_eslint_utils_ts_eslint.RuleModule<"bareChoiceField" | "comparisonCluster", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
@@ -156,6 +159,9 @@ declare const plugin: {
         "no-secret-in-log": _typescript_eslint_utils_ts_eslint.RuleModule<"noSecretInLog", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
+        "no-unsafe-cast": _typescript_eslint_utils_ts_eslint.RuleModule<"asAny" | "doubleCast", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
+            name: string;
+        };
         "prefer-string-literal-union": _typescript_eslint_utils_ts_eslint.RuleModule<"bareChoiceField" | "comparisonCluster", readonly [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };
@@ -187,6 +193,7 @@ declare const plugin: {
                 "@sarj/no-fat-try-blocks": string;
                 "@sarj/no-cors-wildcard-with-credentials": string;
                 "@sarj/no-secret-in-log": string;
+                "@sarj/no-unsafe-cast": string;
                 "@sarj/single-public-export": string;
                 "@sarj/prefer-string-literal-union": string;
             };
@@ -217,6 +224,7 @@ declare const plugin: {
                 "@sarj/no-fat-try-blocks": string;
                 "@sarj/no-cors-wildcard-with-credentials": string;
                 "@sarj/no-secret-in-log": string;
+                "@sarj/no-unsafe-cast": string;
                 "@sarj/single-public-export": string;
                 "@sarj/prefer-string-literal-union": string;
             };

package/dist/index.js

@@ -1,6 +1,5 @@
 // src/rules/enforce-file-structure.ts
 import { ESLintUtils, AST_NODE_TYPES } from "@typescript-eslint/utils";
-var SERVER_ACTION_FILE_RE = /(?:^|\/)actions\/|\.action\.[jt]sx?$|(?:^|\/)actions\.[jt]sx?$/;
 var classifyStatement = (statement) => {
   switch (statement.type) {
     case AST_NODE_TYPES.ImportDeclaration:
@@ -15,7 +14,6 @@ var classifyStatement = (statement) => {
 };
 var isStringDirective = (statement) => statement.type === AST_NODE_TYPES.ExpressionStatement && statement.expression.type === AST_NODE_TYPES.Literal && typeof statement.expression.value === "string" && statement.expression.value.startsWith("use ");
 var isUseServerDirective = (statement) => {
-  if (statement === void 0) return false;
   if (statement.type !== AST_NODE_TYPES.ExpressionStatement) return false;
   const expr = statement.expression;
   if (expr.type !== AST_NODE_TYPES.Literal) return false;
@@ -28,23 +26,25 @@ var enforce_file_structure_default = ESLintUtils.RuleCreator(
   meta: {
     type: "suggestion",
     docs: {
-      description: "Require `import` statements to come first, then allow step-down ordering (public API first, private helpers below) for the rest of the file. Exported statements are classified by WHAT they export \u2014 an exported interface is a declaration, an exported function is a function \u2014 so a public exported function followed by a private helper, or an exported interface among declarations, is allowed. Re-exports (`export { \u2026 } from`, `export *`, `export { \u2026 }`) are a neutral group, so generated namespace barrels pass. Server-action files (under `/actions/`, named `*.action.ts`, or `actions.ts`) must also begin with a `use server` directive."
+      description: "Require `import` statements to come first, then allow step-down ordering (public API first, private helpers below) for the rest of the file. Exported statements are classified by WHAT they export \u2014 an exported interface is a declaration, an exported function is a function \u2014 so a public exported function followed by a private helper, or an exported interface among declarations, is allowed. Re-exports (`export { \u2026 } from`, `export *`, `export { \u2026 }`) are a neutral group, so generated namespace barrels pass. When a module contains a `use server` directive, it must be the first statement in the file."
     },
     schema: [],
     messages: {
       importsFirst: "File structure violation: import statements must come before other declarations",
-      useServerDirective: "Server action files must start with 'use server' directive"
+      useServerDirective: "A 'use server' directive must be the first statement in the file"
     }
   },
   defaultOptions: [],
   create(context) {
-    const isServerAction = SERVER_ACTION_FILE_RE.test(context.filename);
     return {
       Program(node) {
         const body = node.body;
-        if (isServerAction && !isUseServerDirective(body[0])) {
+        const misplacedUseServer = body.find(
+          (statement, index) => index > 0 && isUseServerDirective(statement)
+        );
+        if (misplacedUseServer !== void 0) {
           context.report({
-            node,
+            node: misplacedUseServer,
             messageId: "useServerDirective"
           });
         }
@@ -629,12 +629,49 @@ function instanceofErrorSubject(test) {
   }
   return null;
 }
+var TYPE_GUARD_PATTERN = /^(is|has)[A-Z]/;
+function typeGuardSubject(test) {
+  const arg = test.type === "CallExpression" ? test.arguments[0] : void 0;
+  if (test.type === "CallExpression" && test.callee.type === "Identifier" && TYPE_GUARD_PATTERN.test(test.callee.name) && test.arguments.length === 1 && arg !== void 0 && arg.type !== "SpreadElement") {
+    return arg;
+  }
+  return null;
+}
+function positiveErrorSubject(test) {
+  return instanceofErrorSubject(test) ?? typeGuardSubject(test);
+}
 function negatedInstanceofErrorSubject(test) {
   if (test.type === "UnaryExpression" && test.operator === "!") {
-    return instanceofErrorSubject(test.argument);
+    return positiveErrorSubject(test.argument);
   }
   return null;
 }
+function branchTerminates(branch) {
+  const body = branch.type === "BlockStatement" ? branch.body : [branch];
+  const last = body[body.length - 1];
+  return last !== void 0 && (last.type === "ReturnStatement" || last.type === "ThrowStatement");
+}
+function isNarrowedByEarlyReturn(node, argExpr, sourceCode) {
+  const argText = sourceCode.getText(argExpr);
+  let current = node.parent;
+  while (current) {
+    if (current.type === "BlockStatement" || current.type === "Program") {
+      for (const stmt of current.body) {
+        if (stmt.range[0] >= node.range[0]) {
+          break;
+        }
+        if (stmt.type === "IfStatement" && stmt.alternate === null && branchTerminates(stmt.consequent)) {
+          const subject = positiveErrorSubject(stmt.test);
+          if (subject && sourceCode.getText(subject) === argText) {
+            return true;
+          }
+        }
+      }
+    }
+    current = current.parent;
+  }
+  return false;
+}
 function nodeWithin(node, container) {
   return container !== null && node.range[0] >= container.range[0] && node.range[1] <= container.range[1];
 }
@@ -644,7 +681,7 @@ function isGuardedByInstanceofError(node, argExpr, sourceCode) {
   let current = node.parent;
   while (current) {
     if (current.type === "ConditionalExpression") {
-      const subject = instanceofErrorSubject(current.test);
+      const subject = positiveErrorSubject(current.test);
       if (subject && sameSubject(subject) && nodeWithin(node, current.alternate)) {
         return true;
       }
@@ -653,7 +690,7 @@ function isGuardedByInstanceofError(node, argExpr, sourceCode) {
         return true;
       }
     } else if (current.type === "IfStatement") {
-      const subject = instanceofErrorSubject(current.test);
+      const subject = positiveErrorSubject(current.test);
       if (subject && sameSubject(subject) && nodeWithin(node, current.alternate)) {
         return true;
       }
@@ -706,7 +743,7 @@ var no_json_stringify_error_default = ESLintUtils6.RuleCreator(
         if (!suggestsError) {
           return;
         }
-        if (isGuardedByInstanceofError(node, firstArg, context.sourceCode)) {
+        if (isGuardedByInstanceofError(node, firstArg, context.sourceCode) || isNarrowedByEarlyReturn(node, firstArg, context.sourceCode)) {
           return;
         }
         context.report({
@@ -849,6 +886,17 @@ function isProcessEnv(node) {
 function isImportMetaEnv(node) {
   return !node.computed && node.property.type === "Identifier" && node.property.name === "env" && node.object.type === "MetaProperty" && node.object.meta.name === "import" && node.object.property.name === "meta";
 }
+var BUILD_TIME_CONSTANTS = /* @__PURE__ */ new Set([
+  "NODE_ENV",
+  "MODE",
+  "DEV",
+  "PROD",
+  "SSR"
+]);
+function isBuildTimeConstantAccess(node) {
+  const parent = node.parent;
+  return parent.type === "MemberExpression" && parent.object === node && !parent.computed && parent.property.type === "Identifier" && BUILD_TIME_CONSTANTS.has(parent.property.name);
+}
 var no_raw_env_default = ESLintUtils8.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
@@ -867,7 +915,7 @@ var no_raw_env_default = ESLintUtils8.RuleCreator(
   create(context) {
     return {
       MemberExpression(node) {
-        if (isProcessEnv(node) || isImportMetaEnv(node)) {
+        if ((isProcessEnv(node) || isImportMetaEnv(node)) && !isBuildTimeConstantAccess(node)) {
           context.report({
             node,
             messageId: "noRawEnv"
@@ -1106,7 +1154,7 @@ var no_sentinel_return_on_catch_default = ESLintUtils9.RuleCreator(
 // src/rules/no-sequential-await.ts
 import { ESLintUtils as ESLintUtils10 } from "@typescript-eslint/utils";
 var ARRAY_ITERATION_METHODS = /* @__PURE__ */ new Set(["forEach", "map", "filter"]);
-var SEQUENTIAL_ITERABLE_HINT = /sort|reverse|ordered|sequence|hook|middleware|pipeline|\bstage|\bstep|\bphase|migration|chain/i;
+var SEQUENTIAL_ITERABLE_HINT = /sort|reverse|ordered|sequence|hook|middleware|pipeline|\bstage|\bstep|\bphase|migration|chain|buffer|stream|teleport|chunk|\bqueue|drain/i;
 function isFunctionLike(node) {
   return node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression";
 }
@@ -1149,9 +1197,29 @@ function hasEarlyExit(root) {
   });
   return found;
 }
+var TIMER_HELPER_RE = /^(sleep|timeout|delay|wait|pause|tick)$/i;
+function calleeName2(callee) {
+  if (callee.type === "Identifier") return callee.name;
+  if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier") {
+    return callee.property.name;
+  }
+  return null;
+}
 function isTimerYield(node) {
   const arg = node.argument;
-  return arg.type === "NewExpression" && arg.callee.type === "Identifier" && arg.callee.name === "Promise";
+  if (arg.type === "NewExpression" && arg.callee.type === "Identifier" && arg.callee.name === "Promise") {
+    return true;
+  }
+  if (arg.type === "CallExpression") {
+    const name = calleeName2(arg.callee);
+    return name !== null && TIMER_HELPER_RE.test(name);
+  }
+  return false;
+}
+var QUEUE_DRAIN_METHODS = /^(shift|pop|dequeue|next|poll)$/;
+function isQueueDrain(node) {
+  const arg = node.argument;
+  return arg.type === "CallExpression" && arg.callee.type === "MemberExpression" && !arg.callee.computed && arg.callee.property.type === "Identifier" && QUEUE_DRAIN_METHODS.test(arg.callee.property.name);
 }
 function referencesName(root, name) {
   let found = false;
@@ -1186,7 +1254,7 @@ function shouldReport(awaits, earlyExit, iterableText) {
     return false;
   }
   return awaits.some(
-    (node) => !isTimerYield(node) && !isThreadedAccumulator(node)
+    (node) => !isTimerYield(node) && !isThreadedAccumulator(node) && !isQueueDrain(node)
   );
 }
 var no_sequential_await_default = ESLintUtils10.RuleCreator(
@@ -1207,10 +1275,10 @@ var no_sequential_await_default = ESLintUtils10.RuleCreator(
   create(context) {
     function loopParts(node) {
       if (node.type === "ForStatement") {
-        return [node.body, node.init, node.test, node.update];
+        return [node.body, node.test, node.update];
       }
       if (node.type === "ForOfStatement" || node.type === "ForInStatement") {
-        return [node.body, node.right];
+        return [node.body];
       }
       return [node.body, node.test];
     }
@@ -1872,10 +1940,10 @@ var SVG_EXEMPT_COLOR_VALUES = /* @__PURE__ */ new Set([
   "currentcolor",
   "inherit"
 ]);
-var isInsideSvgDefsContainer = (node) => {
+var isInsideSvg = (node) => {
   let current = node.parent;
   while (current !== void 0 && current !== null) {
-    if (current.type === AST_NODE_TYPES7.JSXElement && current.openingElement.name.type === AST_NODE_TYPES7.JSXIdentifier && SVG_DEFS_CONTAINERS.has(current.openingElement.name.name)) {
+    if (current.type === AST_NODE_TYPES7.JSXElement && current.openingElement.name.type === AST_NODE_TYPES7.JSXIdentifier && (current.openingElement.name.name === "svg" || SVG_DEFS_CONTAINERS.has(current.openingElement.name.name))) {
       return true;
     }
     current = current.parent;
@@ -1985,7 +2053,7 @@ var prefer_semantic_colors_default = ESLintUtils15.RuleCreator(
         if (typeof node.value.value === "string" && SVG_EXEMPT_COLOR_VALUES.has(node.value.value.toLowerCase())) {
           return;
         }
-        if (isInsideSvgDefsContainer(node)) return;
+        if (isInsideSvg(node)) return;
         checkColorValueNode(node.value);
       },
       // Inline style objects: style={{ color: "#111827", backgroundColor: "#fff" }}
@@ -2519,7 +2587,7 @@ function propertyKeyName(prop) {
   }
   return void 0;
 }
-function calleeName2(node) {
+function calleeName3(node) {
   const callee = node.callee;
   if (callee.type === "Identifier") {
     return callee.name;
@@ -2530,7 +2598,7 @@ function calleeName2(node) {
   return void 0;
 }
 function isCorsWildcardCredentialsCall(node) {
-  const name = calleeName2(node);
+  const name = calleeName3(node);
   if (name === void 0 || name.toLowerCase() !== "cors") {
     return false;
   }
@@ -3162,10 +3230,56 @@ var no_secret_in_log_default = ESLintUtils23.RuleCreator(
   }
 });
 
+// src/rules/no-unsafe-cast.ts
+import { ESLintUtils as ESLintUtils24 } from "@typescript-eslint/utils";
+import { AST_NODE_TYPES as AST_NODE_TYPES13 } from "@typescript-eslint/utils";
+function isAnyAnnotation(node) {
+  return node.type === AST_NODE_TYPES13.TSAnyKeyword;
+}
+function isConstAssertion(typeAnnotation) {
+  return typeAnnotation.type === AST_NODE_TYPES13.TSTypeReference && typeAnnotation.typeName.type === AST_NODE_TYPES13.Identifier && typeAnnotation.typeName.name === "const";
+}
+var no_unsafe_cast_default = ESLintUtils24.RuleCreator(
+  (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-unsafe-cast",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow `as any`/`<any>` casts and `as unknown as T` double-casts, which fully disable type checking."
+    },
+    schema: [],
+    messages: {
+      asAny: "`as any` disables type checking on this value. Narrow with a type guard, model the shape, or cast to a specific type instead.",
+      doubleCast: "`as unknown as T` double-cast bypasses the compiler's structural check. Prefer a runtime validator (e.g. a zod schema) or an accurate type at the boundary."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    function checkAssertion(node) {
+      if (isConstAssertion(node.typeAnnotation)) {
+        return;
+      }
+      if (isAnyAnnotation(node.typeAnnotation)) {
+        context.report({ node, messageId: "asAny" });
+        return;
+      }
+      const inner = node.expression;
+      if (inner.type === AST_NODE_TYPES13.TSAsExpression || inner.type === AST_NODE_TYPES13.TSTypeAssertion) {
+        context.report({ node, messageId: "doubleCast" });
+      }
+    }
+    return {
+      TSAsExpression: checkAssertion,
+      TSTypeAssertion: checkAssertion
+    };
+  }
+});
+
 // src/rules/prefer-string-literal-union.ts
 import {
-  ESLintUtils as ESLintUtils24,
-  AST_NODE_TYPES as AST_NODE_TYPES13
+  ESLintUtils as ESLintUtils25,
+  AST_NODE_TYPES as AST_NODE_TYPES14
 } from "@typescript-eslint/utils";
 import * as ts from "typescript";
 var CHOICE_TOKENS = /* @__PURE__ */ new Set([
@@ -3209,19 +3323,19 @@ function isChoiceLikeName(name) {
   return CHOICE_TOKENS.has(lastWord(name));
 }
 function keyName(key) {
-  if (key.type === AST_NODE_TYPES13.Identifier) {
+  if (key.type === AST_NODE_TYPES14.Identifier) {
     return key.name;
   }
-  if (key.type === AST_NODE_TYPES13.Literal && typeof key.value === "string") {
+  if (key.type === AST_NODE_TYPES14.Literal && typeof key.value === "string") {
     return key.value;
   }
   return null;
 }
 function isStringLiteralMember(t) {
-  return t.type === AST_NODE_TYPES13.TSLiteralType && t.literal.type === AST_NODE_TYPES13.Literal && typeof t.literal.value === "string";
+  return t.type === AST_NODE_TYPES14.TSLiteralType && t.literal.type === AST_NODE_TYPES14.Literal && typeof t.literal.value === "string";
 }
 function isStringLiteralUnion(node) {
-  if (node?.type !== AST_NODE_TYPES13.TSUnionType) {
+  if (node?.type !== AST_NODE_TYPES14.TSUnionType) {
     return false;
   }
   return node.types.filter(isStringLiteralMember).length >= MIN_CLUSTER_SIZE;
@@ -3250,12 +3364,12 @@ function bindingSourceExpression(decl) {
   return ts.isForOfStatement(node) ? node.expression : node.initializer;
 }
 function refKey(node) {
-  if (node.type === AST_NODE_TYPES13.Identifier) {
+  if (node.type === AST_NODE_TYPES14.Identifier) {
     return node.name;
   }
-  if (node.type === AST_NODE_TYPES13.MemberExpression && !node.computed) {
+  if (node.type === AST_NODE_TYPES14.MemberExpression && !node.computed) {
     const inner = refKey(node.object);
-    if (inner === null || node.property.type !== AST_NODE_TYPES13.Identifier) {
+    if (inner === null || node.property.type !== AST_NODE_TYPES14.Identifier) {
       return null;
     }
     return `${inner}.${node.property.name}`;
@@ -3263,12 +3377,12 @@ function refKey(node) {
   return null;
 }
 function strLiteral(node) {
-  if (node.type === AST_NODE_TYPES13.Literal && typeof node.value === "string") {
+  if (node.type === AST_NODE_TYPES14.Literal && typeof node.value === "string") {
     return node.value;
   }
   return null;
 }
-var prefer_string_literal_union_default = ESLintUtils24.RuleCreator(
+var prefer_string_literal_union_default = ESLintUtils25.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "prefer-string-literal-union",
@@ -3292,7 +3406,7 @@ var prefer_string_literal_union_default = ESLintUtils24.RuleCreator(
     }
     let services;
     try {
-      services = ESLintUtils24.getParserServices(context);
+      services = ESLintUtils25.getParserServices(context);
     } catch {
       services = null;
     }
@@ -3376,7 +3490,7 @@ var prefer_string_literal_union_default = ESLintUtils24.RuleCreator(
         containersWithUnion.add(container);
         return;
       }
-      if (typeNode?.type !== AST_NODE_TYPES13.TSStringKeyword) {
+      if (typeNode?.type !== AST_NODE_TYPES14.TSStringKeyword) {
         return;
       }
       const name = keyName(key);
@@ -3464,10 +3578,10 @@ var prefer_string_literal_union_default = ESLintUtils24.RuleCreator(
       }
     };
     function refKeyText(node) {
-      if (node.type === AST_NODE_TYPES13.BinaryExpression) {
+      if (node.type === AST_NODE_TYPES14.BinaryExpression) {
         return refKey(node.left) ?? refKey(node.right) ?? "value";
       }
-      if (node.type === AST_NODE_TYPES13.SwitchStatement) {
+      if (node.type === AST_NODE_TYPES14.SwitchStatement) {
         return refKey(node.discriminant) ?? "value";
       }
       return "value";
@@ -3476,7 +3590,7 @@ var prefer_string_literal_union_default = ESLintUtils24.RuleCreator(
 });
 
 // src/rules/single-public-export.ts
-import { ESLintUtils as ESLintUtils25, AST_NODE_TYPES as AST_NODE_TYPES14 } from "@typescript-eslint/utils";
+import { ESLintUtils as ESLintUtils26, AST_NODE_TYPES as AST_NODE_TYPES15 } from "@typescript-eslint/utils";
 var JUNK_DRAWER_STEMS = /* @__PURE__ */ new Set([
   "util",
   "utils",
@@ -3510,12 +3624,12 @@ var kebabCase2 = (name) => {
   }
   return normalized.replace(CAMEL_BOUNDARY_RE, "-").toLowerCase();
 };
-var isFunctionExpression = (node) => node !== null && (node.type === AST_NODE_TYPES14.ArrowFunctionExpression || node.type === AST_NODE_TYPES14.FunctionExpression);
+var isFunctionExpression = (node) => node !== null && (node.type === AST_NODE_TYPES15.ArrowFunctionExpression || node.type === AST_NODE_TYPES15.FunctionExpression);
 var functionConstName = (decl) => {
   if (decl.declarations.length !== 1) return null;
   const [declarator] = decl.declarations;
   if (declarator === void 0) return null;
-  if (declarator.id.type !== AST_NODE_TYPES14.Identifier) return null;
+  if (declarator.id.type !== AST_NODE_TYPES15.Identifier) return null;
   if (!isFunctionExpression(declarator.init)) return null;
   return declarator.id.name;
 };
@@ -3529,20 +3643,20 @@ var summarizeExports = (body) => {
   };
   for (const statement of body) {
     switch (statement.type) {
-      case AST_NODE_TYPES14.ExportAllDeclaration:
+      case AST_NODE_TYPES15.ExportAllDeclaration:
         hasReExport = true;
         break;
-      case AST_NODE_TYPES14.ExportDefaultDeclaration: {
+      case AST_NODE_TYPES15.ExportDefaultDeclaration: {
         names += 1;
         const decl = statement.declaration;
-        if (decl.type === AST_NODE_TYPES14.FunctionDeclaration && decl.id !== null) {
+        if (decl.type === AST_NODE_TYPES15.FunctionDeclaration && decl.id !== null) {
           candidate = { name: decl.id.name, node: statement };
-        } else if (decl.type === AST_NODE_TYPES14.ClassDeclaration && decl.id !== null) {
+        } else if (decl.type === AST_NODE_TYPES15.ClassDeclaration && decl.id !== null) {
           candidate = { name: decl.id.name, node: statement };
         }
         break;
       }
-      case AST_NODE_TYPES14.ExportNamedDeclaration: {
+      case AST_NODE_TYPES15.ExportNamedDeclaration: {
         if (statement.source !== null) {
           hasReExport = true;
           break;
@@ -3553,15 +3667,15 @@ var summarizeExports = (body) => {
           break;
         }
         switch (decl.type) {
-          case AST_NODE_TYPES14.FunctionDeclaration:
+          case AST_NODE_TYPES15.FunctionDeclaration:
             if (decl.id !== null) addCandidate(decl.id.name, statement);
             else names += 1;
             break;
-          case AST_NODE_TYPES14.ClassDeclaration:
+          case AST_NODE_TYPES15.ClassDeclaration:
             if (decl.id !== null) addCandidate(decl.id.name, statement);
             else names += 1;
             break;
-          case AST_NODE_TYPES14.VariableDeclaration: {
+          case AST_NODE_TYPES15.VariableDeclaration: {
             const fnName = functionConstName(decl);
             if (fnName !== null && decl.declarations.length === 1) {
               addCandidate(fnName, statement);
@@ -3581,7 +3695,7 @@ var summarizeExports = (body) => {
   }
   return { names, hasReExport, candidate };
 };
-var single_public_export_default = ESLintUtils25.RuleCreator(
+var single_public_export_default = ESLintUtils26.RuleCreator(
   (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
   name: "single-public-export",
@@ -3645,13 +3759,14 @@ var rules = {
   "no-cors-wildcard-with-credentials": no_cors_wildcard_with_credentials_default,
   "no-fat-try-blocks": no_fat_try_blocks_default,
   "no-secret-in-log": no_secret_in_log_default,
+  "no-unsafe-cast": no_unsafe_cast_default,
   "prefer-string-literal-union": prefer_string_literal_union_default,
   "single-public-export": single_public_export_default
 };
 var plugin = {
   meta: {
     name: "@sarj/eslint-plugin",
-    version: "2.4.0"
+    version: "2.5.0"
   },
   rules,
   configs: {
@@ -3681,6 +3796,7 @@ var plugin = {
         "@sarj/no-fat-try-blocks": "warn",
         "@sarj/no-cors-wildcard-with-credentials": "warn",
         "@sarj/no-secret-in-log": "warn",
+        "@sarj/no-unsafe-cast": "warn",
         "@sarj/single-public-export": "warn",
         "@sarj/prefer-string-literal-union": "warn"
       }
@@ -3715,6 +3831,7 @@ var plugin = {
         "@sarj/no-fat-try-blocks": "error",
         "@sarj/no-cors-wildcard-with-credentials": "error",
         "@sarj/no-secret-in-log": "error",
+        "@sarj/no-unsafe-cast": "warn",
         "@sarj/single-public-export": "error",
         // High-volume/stylistic — warn until rollout proves FP rate.
         "@sarj/prefer-string-literal-union": "warn"