@sarj/eslint-plugin 2.7.0 → 2.8.0

package/dist/index.cjs

@@ -350,12 +350,10 @@ var no_comment_cruft_default = import_utils3.ESLintUtils.RuleCreator(
       }
       const first = leading[0];
       if (first === void 0 || leading.length < LEADING_PREAMBLE_MIN) return;
-      const isLicense = leading.some(
-        (c) => LICENSE_RE.test(stripCommentMarker(c.value))
-      );
-      if (!isLicense) {
-        context.report({ node: first, messageId: "fileHeaderPreamble" });
-      }
+      const bodies = leading.map((c) => stripCommentMarker(c.value));
+      if (bodies.some((body) => LICENSE_RE.test(body))) return;
+      if (bodies.some((body) => isProse(body))) return;
+      context.report({ node: first, messageId: "fileHeaderPreamble" });
     }
     return {
       Program() {
@@ -833,35 +831,15 @@ var LOGGER_NAMES = /* @__PURE__ */ new Set([
   "_logger",
   "_log"
 ]);
+var LOGGER_FACTORIES = /* @__PURE__ */ new Set([
+  "getlogger",
+  "get_logger"
+]);
 var REPORT_NAME_RE = /error|report|capture|log|trace|warn/i;
-function isLoggerReceiver(expr) {
-  switch (expr.type) {
-    case "Identifier":
-      return LOGGER_NAMES.has(expr.name.toLowerCase());
-    case "MemberExpression": {
-      const { property, object } = expr;
-      if (!expr.computed && property.type === "Identifier" && LOGGER_NAMES.has(property.name.toLowerCase())) {
-        return true;
-      }
-      return isLoggerReceiver(object);
-    }
-    default:
-      return false;
-  }
-}
-function isLoggingCall(expr) {
-  if (expr.type !== "CallExpression") {
-    return false;
-  }
-  const callee = expr.callee;
-  if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier") {
-    return false;
-  }
-  if (!LOG_METHODS.has(callee.property.name.toLowerCase())) {
-    return false;
-  }
-  return isLoggerReceiver(callee.object);
-}
+var LOGGING_OPTION_PROPERTIES = {
+  loggerNames: { type: "array", items: { type: "string" } },
+  logFunctions: { type: "array", items: { type: "string" } }
+};
 function calleeName(callee) {
   if (callee.type === "Identifier") {
     return callee.name;
@@ -871,6 +849,65 @@ function calleeName(callee) {
   }
   return null;
 }
+function createLogMatcher(options = {}) {
+  const loggerNames = /* @__PURE__ */ new Set([
+    ...LOGGER_NAMES,
+    ...(options.loggerNames ?? []).map((name) => name.toLowerCase())
+  ]);
+  const logFunctions = new Set(options.logFunctions ?? []);
+  function isLoggerReceiver(expr) {
+    switch (expr.type) {
+      case "Identifier":
+        return loggerNames.has(expr.name.toLowerCase());
+      case "MemberExpression": {
+        const { property, object } = expr;
+        if (!expr.computed && property.type === "Identifier") {
+          const lowered = property.name.toLowerCase();
+          if (loggerNames.has(lowered) || LOGGER_FACTORIES.has(lowered)) {
+            return true;
+          }
+        }
+        return isLoggerReceiver(object);
+      }
+      case "CallExpression": {
+        const callee = expr.callee;
+        if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" && LOGGER_FACTORIES.has(callee.property.name.toLowerCase())) {
+          return true;
+        }
+        if (callee.type !== "Super") {
+          return isLoggerReceiver(callee);
+        }
+        return false;
+      }
+      default:
+        return false;
+    }
+  }
+  function isLogFunctionCall(expr) {
+    if (expr.type !== "CallExpression" || logFunctions.size === 0) {
+      return false;
+    }
+    const name = calleeName(expr.callee);
+    return name !== null && logFunctions.has(name);
+  }
+  function isLoggingCall(expr) {
+    if (expr.type !== "CallExpression") {
+      return false;
+    }
+    if (isLogFunctionCall(expr)) {
+      return true;
+    }
+    const callee = expr.callee;
+    if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier") {
+      return false;
+    }
+    if (!LOG_METHODS.has(callee.property.name.toLowerCase())) {
+      return false;
+    }
+    return isLoggerReceiver(callee.object);
+  }
+  return { isLoggerReceiver, isLogFunctionCall, isLoggingCall };
+}
 
 // src/rules/no-log-only-catch.ts
 var DEFAULT_IGNORE_PATTERNS2 = [
@@ -878,12 +915,6 @@ var DEFAULT_IGNORE_PATTERNS2 = [
   /\.spec\./,
   /[\\/]__tests__[\\/]/
 ];
-function isLoggingCallStatement(statement) {
-  if (statement.type !== "ExpressionStatement") {
-    return false;
-  }
-  return isLoggingCall(statement.expression);
-}
 var no_log_only_catch_default = import_utils8.ESLintUtils.RuleCreator(
   (name) => `https://github.com/sarj-ai/linting/blob/main/packages/typescript/src/rules/${name}.ts`
 )({
@@ -893,15 +924,28 @@ var no_log_only_catch_default = import_utils8.ESLintUtils.RuleCreator(
     docs: {
       description: "Disallow `catch` clauses that only log (or silently do nothing) and then swallow the error; rethrow or handle it instead."
     },
-    schema: [],
+    schema: [
+      {
+        type: "object",
+        additionalProperties: false,
+        properties: { ...LOGGING_OPTION_PROPERTIES }
+      }
+    ],
     messages: {
       noLogOnlyCatch: "Logging then swallowing the error hides failures. Rethrow the error or handle it for real.",
       emptyCatch: "Empty catch silently swallows the error. Rethrow it, handle it, or add a comment explaining why it is safe to ignore."
     }
   },
-  defaultOptions: [],
-  create(context) {
+  defaultOptions: [{}],
+  create(context, [loggingOptions]) {
+    const matcher = createLogMatcher(loggingOptions);
     const filename = context.filename;
+    function isLoggingCallStatement(statement) {
+      if (statement.type !== "ExpressionStatement") {
+        return false;
+      }
+      return matcher.isLoggingCall(statement.expression);
+    }
     const isIgnoredByDefault = DEFAULT_IGNORE_PATTERNS2.some(
       (re) => re.test(filename)
     );
@@ -1071,46 +1115,131 @@ function containsThrow(node) {
     (current) => current.type === import_utils10.AST_NODE_TYPES.ThrowStatement
   );
 }
-function argsIncludeBinding(args, caughtName) {
-  if (caughtName === null) {
-    return false;
+function bindsName(param, name) {
+  switch (param.type) {
+    case import_utils10.AST_NODE_TYPES.Identifier:
+      return param.name === name;
+    case import_utils10.AST_NODE_TYPES.AssignmentPattern:
+      return bindsName(param.left, name);
+    case import_utils10.AST_NODE_TYPES.RestElement:
+      return bindsName(param.argument, name);
+    case import_utils10.AST_NODE_TYPES.ArrayPattern:
+      return param.elements.some(
+        (element) => element !== null && bindsName(element, name)
+      );
+    case import_utils10.AST_NODE_TYPES.ObjectPattern:
+      return param.properties.some(
+        (property) => property.type === import_utils10.AST_NODE_TYPES.RestElement ? bindsName(property.argument, name) : bindsName(property.value, name)
+      );
+    default:
+      return false;
   }
-  return args.some(
-    (arg) => arg.type === import_utils10.AST_NODE_TYPES.Identifier && arg.name === caughtName
-  );
 }
-function logsOrReportsError(catchBody, caughtName) {
-  return walkWithinScope(catchBody, (current) => {
-    if (current.type !== import_utils10.AST_NODE_TYPES.CallExpression) {
-      return false;
+function subtreeReadsName(node, name) {
+  let found = false;
+  const shadowsName = (fn) => isFunctionNode(fn) && fn.params.some(
+    (param) => bindsName(param, name)
+  );
+  const recurse = (current) => {
+    if (found) {
+      return;
     }
-    if (isLoggingCall(current)) {
-      return true;
+    if (current.type === import_utils10.AST_NODE_TYPES.Identifier && current.name === name) {
+      found = true;
+      return;
     }
-    const name = calleeName(current.callee);
-    return name !== null && REPORT_NAME_RE.test(name) && argsIncludeBinding(current.arguments, caughtName);
-  });
+    if (shadowsName(current)) {
+      return;
+    }
+    for (const key of Object.keys(current)) {
+      if (key === "parent") {
+        continue;
+      }
+      if (key === "key" && current.type === import_utils10.AST_NODE_TYPES.Property && !current.computed) {
+        continue;
+      }
+      if (key === "property" && current.type === import_utils10.AST_NODE_TYPES.MemberExpression && !current.computed) {
+        continue;
+      }
+      const value = current[key];
+      if (Array.isArray(value)) {
+        for (const child of value) {
+          if (isNode(child)) {
+            recurse(child);
+          }
+        }
+      } else if (isNode(value)) {
+        recurse(value);
+      }
+    }
+  };
+  recurse(node);
+  return found;
+}
+function argsIncludeBinding(args, caughtName) {
+  if (caughtName === null) {
+    return false;
+  }
+  return args.some((arg) => subtreeReadsName(arg, caughtName));
 }
 function tryBlockOf(catchNode) {
   return catchNode.parent.block;
 }
-function isSafeParseExpression(arg) {
-  if (arg === null) {
-    return false;
-  }
-  if (arg.type === import_utils10.AST_NODE_TYPES.CallExpression && arg.callee.type === import_utils10.AST_NODE_TYPES.MemberExpression && !arg.callee.computed && arg.callee.property.type === import_utils10.AST_NODE_TYPES.Identifier && arg.callee.property.name === "parse") {
-    return true;
+var SAFE_PARSE_CONSTRUCTORS = /* @__PURE__ */ new Set([
+  "RegExp",
+  "URL",
+  "URLPattern"
+]);
+function isParseShapedNode(node) {
+  if (node.type === import_utils10.AST_NODE_TYPES.CallExpression && node.callee.type === import_utils10.AST_NODE_TYPES.MemberExpression && !node.callee.computed && node.callee.property.type === import_utils10.AST_NODE_TYPES.Identifier) {
+    return node.callee.property.name === "parse";
   }
-  if (arg.type === import_utils10.AST_NODE_TYPES.NewExpression && arg.callee.type === import_utils10.AST_NODE_TYPES.Identifier) {
-    return arg.callee.name === "RegExp" || arg.callee.name === "URL";
+  if (node.type === import_utils10.AST_NODE_TYPES.NewExpression && node.callee.type === import_utils10.AST_NODE_TYPES.Identifier) {
+    return SAFE_PARSE_CONSTRUCTORS.has(node.callee.name);
   }
   return false;
 }
+var BODY_DECODE_METHODS = /* @__PURE__ */ new Set([
+  "json",
+  "text",
+  "arrayBuffer"
+]);
+function isBodyDecodeNode(node) {
+  return node.type === import_utils10.AST_NODE_TYPES.CallExpression && node.callee.type === import_utils10.AST_NODE_TYPES.MemberExpression && !node.callee.computed && node.callee.property.type === import_utils10.AST_NODE_TYPES.Identifier && BODY_DECODE_METHODS.has(node.callee.property.name);
+}
+function returnsMatching(stmt, predicate) {
+  return stmt.type === import_utils10.AST_NODE_TYPES.ReturnStatement && stmt.argument !== null && walkWithinScope(stmt.argument, predicate);
+}
+function enclosingReturnTypeNode(node) {
+  let current = node.parent;
+  while (current !== void 0 && current !== null) {
+    if (isFunctionNode(current) && "returnType" in current) {
+      return current.returnType?.typeAnnotation ?? null;
+    }
+    current = current.parent;
+  }
+  return null;
+}
+function isDeclaredBooleanPredicate(catchNode, kind) {
+  if (kind !== "boolean") {
+    return false;
+  }
+  let declared = enclosingReturnTypeNode(catchNode);
+  if (declared?.type === import_utils10.AST_NODE_TYPES.TSTypeReference && declared.typeName.type === import_utils10.AST_NODE_TYPES.Identifier && declared.typeName.name === "Promise") {
+    declared = declared.typeArguments?.params[0] ?? null;
+  }
+  return declared?.type === import_utils10.AST_NODE_TYPES.TSBooleanKeyword;
+}
 function tryReturnsSafeParse(catchNode) {
-  return walkWithinScope(
-    tryBlockOf(catchNode),
-    (current) => current.type === import_utils10.AST_NODE_TYPES.ReturnStatement && isSafeParseExpression(current.argument)
-  );
+  const tryBlock = tryBlockOf(catchNode);
+  if (walkWithinScope(
+    tryBlock,
+    (current) => returnsMatching(current, isParseShapedNode)
+  )) {
+    return true;
+  }
+  const only = tryBlock.body.length === 1 ? tryBlock.body[0] : void 0;
+  return only !== void 0 && returnsMatching(only, isBodyDecodeNode);
 }
 function enclosingFunctionBody(node) {
   let current = node.parent;
@@ -1156,13 +1285,32 @@ var no_sentinel_return_on_catch_default = import_utils10.ESLintUtils.RuleCreator
     docs: {
       description: "Disallow swallowing a caught error by returning an empty sentinel (`null`, `undefined`, `false`, `[]`, `{}`) as the final statement of a `catch` block, unless the error is logged/reported or the sentinel is the declared safe-parse/predicate contract."
     },
-    schema: [],
+    schema: [
+      {
+        type: "object",
+        additionalProperties: false,
+        properties: { ...LOGGING_OPTION_PROPERTIES }
+      }
+    ],
     messages: {
       noSentinelReturn: "This `catch` block swallows the error by returning an empty sentinel without logging it. Rethrow it, log/report it, or return a typed Result."
     }
   },
-  defaultOptions: [],
-  create(context) {
+  defaultOptions: [{}],
+  create(context, [loggingOptions]) {
+    const matcher = createLogMatcher(loggingOptions);
+    function logsOrReportsError(catchBody, caughtName) {
+      return walkWithinScope(catchBody, (current) => {
+        if (current.type !== import_utils10.AST_NODE_TYPES.CallExpression) {
+          return false;
+        }
+        if (matcher.isLoggingCall(current)) {
+          return true;
+        }
+        const name = calleeName(current.callee);
+        return name !== null && REPORT_NAME_RE.test(name) && argsIncludeBinding(current.arguments, caughtName);
+      });
+    }
     return {
       CatchClause(node) {
         const body = node.body.body;
@@ -1187,6 +1335,9 @@ var no_sentinel_return_on_catch_default = import_utils10.ESLintUtils.RuleCreator
           return;
         }
         const kind = sentinelKind(last.argument);
+        if (kind !== null && isDeclaredBooleanPredicate(node, kind)) {
+          return;
+        }
         if (kind !== null && functionReturnsSameSentinelKindElsewhere(node, kind)) {
           return;
         }
@@ -1291,6 +1442,28 @@ function isThreadedAccumulator(node) {
   }
   return referencesName(node.argument, target);
 }
+function namesReadBy(test) {
+  const names = /* @__PURE__ */ new Set();
+  visitScope(test, (node) => {
+    if (node.type === "Identifier") {
+      names.add(node.name);
+    }
+  });
+  return names;
+}
+function testStateIsAssignedInBody(test, body) {
+  const testNames = namesReadBy(test);
+  if (testNames.size === 0) {
+    return false;
+  }
+  let found = false;
+  visitScope(body, (node) => {
+    if (node.type === "AssignmentExpression" && node.operator === "=" && node.left.type === "Identifier" && testNames.has(node.left.name)) {
+      found = true;
+    }
+  });
+  return found;
+}
 function shouldReport(awaits, earlyExit, iterableText) {
   if (awaits.length === 0) {
     return false;
@@ -1337,6 +1510,9 @@ var no_sequential_await_default = import_utils11.ESLintUtils.RuleCreator(
       return null;
     }
     function checkLoop(node) {
+      if ((node.type === "WhileStatement" || node.type === "DoWhileStatement") && testStateIsAssignedInBody(node.test, node.body)) {
+        return;
+      }
       const awaits = [];
       let earlyExit = false;
       for (const part of loopParts(node)) {
@@ -1759,7 +1935,7 @@ var unwrap = (node) => {
   }
   return current ?? null;
 };
-var isJsonCall = (node) => {
+var isRawPayloadSource = (node) => {
   let current = unwrap(node);
   if (current === null) return false;
   if (current.type === import_utils16.AST_NODE_TYPES.AwaitExpression) {
@@ -1773,7 +1949,14 @@ var isJsonCall = (node) => {
     return false;
   }
   const property = unwrap(callee.property);
-  return property !== null && property.type === import_utils16.AST_NODE_TYPES.Identifier && property.name === "json";
+  if (property === null || property.type !== import_utils16.AST_NODE_TYPES.Identifier) {
+    return false;
+  }
+  if (property.name === "json") {
+    return true;
+  }
+  const object = unwrap(callee.object);
+  return property.name === "parse" && object !== null && object.type === import_utils16.AST_NODE_TYPES.Identifier && object.name === "JSON";
 };
 var findVariable2 = (scope, name) => {
   let current = scope;
@@ -1823,18 +2006,18 @@ var prefer_schema_for_api_payload_default = import_utils16.ESLintUtils.RuleCreat
   meta: {
     type: "problem",
     docs: {
-      description: "Require Zod (or similar) schema validation on `response.json()` before property access."
+      description: "Require Zod (or similar) schema validation on `response.json()` / `JSON.parse()` results before property access."
     },
     schema: [],
     messages: {
-      unparsedJsonAccess: "Property access on the result of `response.json()` without a schema parse. Pipe through `XSchema.parse(...)` (Zod) before reading fields."
+      unparsedJsonAccess: "Property access on an unvalidated payload (`response.json()` / `JSON.parse()`) without a schema parse. Pipe through `XSchema.parse(...)` (Zod) before reading fields."
     }
   },
   defaultOptions: [],
   create(context) {
     const unvalidatedVariables = /* @__PURE__ */ new Set();
     const trackInitializer = (declarator) => {
-      if (!isJsonCall(declarator.init)) return;
+      if (!isRawPayloadSource(declarator.init)) return;
       const declaredVars = context.sourceCode.getDeclaredVariables(declarator);
       const variable = declaredVars[0];
       if (variable !== void 0) {
@@ -1849,7 +2032,7 @@ var prefer_schema_for_api_payload_default = import_utils16.ESLintUtils.RuleCreat
           return;
         }
         if (node.id.type === import_utils16.AST_NODE_TYPES.ObjectPattern || node.id.type === import_utils16.AST_NODE_TYPES.ArrayPattern) {
-          if (isJsonCall(node.init)) {
+          if (isRawPayloadSource(node.init)) {
             context.report({ node: node.id, messageId: "unparsedJsonAccess" });
             return;
           }
@@ -1863,7 +2046,7 @@ var prefer_schema_for_api_payload_default = import_utils16.ESLintUtils.RuleCreat
         if (node.left.type === import_utils16.AST_NODE_TYPES.Identifier) {
           const variable = findVariable2(scope, node.left.name);
           if (variable === null) return;
-          if (isJsonCall(node.right)) {
+          if (isRawPayloadSource(node.right)) {
             unvalidatedVariables.add(variable);
           } else {
             unvalidatedVariables.delete(variable);
@@ -1871,7 +2054,7 @@ var prefer_schema_for_api_payload_default = import_utils16.ESLintUtils.RuleCreat
           return;
         }
         if (node.left.type === import_utils16.AST_NODE_TYPES.ObjectPattern || node.left.type === import_utils16.AST_NODE_TYPES.ArrayPattern) {
-          if (isJsonCall(node.right)) {
+          if (isRawPayloadSource(node.right)) {
             context.report({
               node: node.left,
               messageId: "unparsedJsonAccess"
@@ -1905,7 +2088,7 @@ var prefer_schema_for_api_payload_default = import_utils16.ESLintUtils.RuleCreat
       MemberExpression(node) {
         const scope = context.sourceCode.getScope(node);
         const obj = unwrap(node.object);
-        if (isJsonCall(obj)) {
+        if (isRawPayloadSource(obj)) {
           const parent = node.parent;
           if (parent.type === import_utils16.AST_NODE_TYPES.CallExpression && parent.callee === node && node.property.type === import_utils16.AST_NODE_TYPES.Identifier && (node.property.name === "parse" || node.property.name === "safeParse")) {
             return;
@@ -2416,7 +2599,13 @@ var require_assert_never_default = import_utils20.ESLintUtils.RuleCreator(
 
 // src/rules/require-zod-form-validation.ts
 var import_utils21 = require("@typescript-eslint/utils");
+
+// src/rules/_zod.ts
+var ZOD_PREFIX_RE = /^Z[A-Z]/;
+var ZOD_SUFFIX_RE = /Schema$/;
 var ZOD_SCHEMA_NAME_RE = /Schema$|^Z[A-Z]/;
+
+// src/rules/require-zod-form-validation.ts
 var looksLikeZodSchema = (node) => {
   let current = node;
   while (true) {
@@ -2494,14 +2683,38 @@ var require_zod_form_validation_default = import_utils21.ESLintUtils.RuleCreator
       }
       return isFormSourceIdentifier(callee.object);
     };
+    const hasZodParseAncestor = (node) => {
+      let parent = node.parent;
+      while (parent !== null && parent !== void 0) {
+        if (isZodParseCall(parent)) return true;
+        parent = parent.parent;
+      }
+      return false;
+    };
+    const isInstanceofNarrowing = (node) => {
+      const parent = node.parent;
+      return parent !== null && parent !== void 0 && parent.type === import_utils21.AST_NODE_TYPES.BinaryExpression && parent.operator === "instanceof" && parent.left === node;
+    };
+    const boundDeclarator = (node) => {
+      const parent = node.parent;
+      if (parent.type === import_utils21.AST_NODE_TYPES.VariableDeclarator && parent.init === node && parent.id.type === import_utils21.AST_NODE_TYPES.Identifier) {
+        return parent;
+      }
+      return null;
+    };
+    const bindingIsValidated = (declarator) => {
+      const variable = context.sourceCode.getDeclaredVariables(declarator)[0];
+      if (variable === void 0) return false;
+      return variable.references.some(
+        (ref) => hasZodParseAncestor(ref.identifier) || isInstanceofNarrowing(ref.identifier)
+      );
+    };
     return {
       CallExpression(node) {
         if (!isFormDataGetCall(node)) return;
-        let parent = node.parent;
-        while (parent !== null && parent !== void 0) {
-          if (isZodParseCall(parent)) return;
-          parent = parent.parent;
-        }
+        if (hasZodParseAncestor(node) || isInstanceofNarrowing(node)) return;
+        const declarator = boundDeclarator(node);
+        if (declarator !== null && bindingIsValidated(declarator)) return;
         context.report({
           node,
           messageId: "missingZodValidation"
@@ -2513,6 +2726,11 @@ var require_zod_form_validation_default = import_utils21.ESLintUtils.RuleCreator
 
 // src/rules/zod-naming-convention.ts
 var import_utils22 = require("@typescript-eslint/utils");
+var CONVENTIONS = {
+  prefix: { test: ZOD_PREFIX_RE, messageId: "zPrefix" },
+  suffix: { test: ZOD_SUFFIX_RE, messageId: "schemaSuffix" },
+  either: { test: ZOD_SCHEMA_NAME_RE, messageId: "zodSchemaName" }
+};
 var calleeChainStartsWithZ = (node) => {
   let current = node;
   while (current.type === import_utils22.AST_NODE_TYPES.MemberExpression) {
@@ -2535,15 +2753,29 @@ var zod_naming_convention_default = import_utils22.ESLintUtils.RuleCreator(
   meta: {
     type: "suggestion",
     docs: {
-      description: "Enforce Zod schemas to be named with a Z prefix (e.g. `ZUser = z.object({...})`)."
+      description: "Enforce a consistent Zod schema naming convention \u2014 a `Z` prefix (`ZUser`) or a `Schema` suffix (`userSchema`); both are accepted by default."
     },
-    schema: [],
+    schema: [
+      {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          convention: {
+            type: "string",
+            enum: ["prefix", "suffix", "either"]
+          }
+        }
+      }
+    ],
     messages: {
-      zPrefix: "Zod schema names should start with Z"
+      zPrefix: "Zod schema names should start with Z (e.g. `ZUser`)",
+      schemaSuffix: "Zod schema names should end with Schema (e.g. `userSchema`)",
+      zodSchemaName: "Zod schema names should start with Z (`ZUser`) or end with Schema (`userSchema`)"
     }
   },
-  defaultOptions: [],
-  create(context) {
+  defaultOptions: [{}],
+  create(context, [optionsArg]) {
+    const { test, messageId } = CONVENTIONS[optionsArg?.convention ?? "either"];
     return {
       VariableDeclarator(node) {
         const init = node.init;
@@ -2553,11 +2785,10 @@ var zod_naming_convention_default = import_utils22.ESLintUtils.RuleCreator(
         if (callee.type !== import_utils22.AST_NODE_TYPES.MemberExpression) return;
         if (!calleeChainStartsWithZ(callee)) return;
         if (node.id.type !== import_utils22.AST_NODE_TYPES.Identifier) return;
-        const variableName = node.id.name;
-        if (variableName.startsWith("Z")) return;
+        if (test.test(node.id.name)) return;
         context.report({
           node: node.id,
-          messageId: "zPrefix"
+          messageId
         });
       }
     };
@@ -2778,10 +3009,14 @@ var no_cors_wildcard_with_credentials_default = import_utils23.ESLintUtils.RuleC
 var import_utils24 = require("@typescript-eslint/utils");
 
 // src/rules/_paths.ts
-var TEST_FILE_RE = /(\.(test|spec)\.)|([\\/]__tests__[\\/])/;
 var SCRIPT_FILE_RE = /([\\/]scripts[\\/])|(\.mjs$)/;
 function isTestFile(filename) {
-  return TEST_FILE_RE.test(filename);
+  const normalized = filename.replaceAll("\\", "/");
+  const base = normalized.slice(normalized.lastIndexOf("/") + 1);
+  if (/\.(test|spec)\.[cm]?[jt]sx?$/.test(base)) {
+    return true;
+  }
+  return /(^|\/)(tests?|__tests__|__mocks__|fixtures)\//.test(normalized);
 }
 function isScriptFile(filename) {
   return SCRIPT_FILE_RE.test(filename);
@@ -2943,7 +3178,7 @@ var require_fetch_timeout_default = import_utils25.ESLintUtils.RuleCreator(
       const variable = import_utils25.ASTUtils.findVariable(scope, identifier.name);
       return variable === null || variable.defs.length === 0;
     }
-    function isGlobalFetchCall(callee) {
+    function isGlobalFetchCall2(callee) {
       if (callee.type === import_utils25.AST_NODE_TYPES.Identifier) {
         return callee.name === "fetch" && resolvesToGlobal(callee);
       }
@@ -2951,7 +3186,7 @@ var require_fetch_timeout_default = import_utils25.ESLintUtils.RuleCreator(
     }
     return {
       CallExpression(node) {
-        if (!isGlobalFetchCall(node.callee)) {
+        if (!isGlobalFetchCall2(node.callee)) {
           return;
         }
         const [first, init] = node.arguments;
@@ -3207,9 +3442,9 @@ function subtreeMatches(stmt, predicate) {
   visit(stmt);
   return found;
 }
-var hasAwait = (stmt) => subtreeMatches(stmt, (n) => n.type === import_utils27.AST_NODE_TYPES.AwaitExpression);
-var hasThrowingCallOrNew = (stmt) => subtreeMatches(
-  stmt,
+var hasAwait = (node) => subtreeMatches(node, (n) => n.type === import_utils27.AST_NODE_TYPES.AwaitExpression);
+var hasThrowingCallOrNew = (node) => subtreeMatches(
+  node,
   (n) => n.type === import_utils27.AST_NODE_TYPES.CallExpression && !isPureCall(n) || n.type === import_utils27.AST_NODE_TYPES.NewExpression && !isPureNew(n)
 );
 function unwrap2(expr) {
@@ -3219,13 +3454,22 @@ function unwrap2(expr) {
   }
   return current;
 }
+function isBareCallStatement(stmt) {
+  return stmt.type === import_utils27.AST_NODE_TYPES.ExpressionStatement && unwrap2(stmt.expression).type === import_utils27.AST_NODE_TYPES.CallExpression;
+}
 function canThrow(stmt) {
   if (hasAwait(stmt)) {
     return true;
   }
-  if (stmt.type === import_utils27.AST_NODE_TYPES.ExpressionStatement && unwrap2(stmt.expression).type === import_utils27.AST_NODE_TYPES.CallExpression) {
+  if (isBareCallStatement(stmt)) {
     return false;
   }
+  if (stmt.type === import_utils27.AST_NODE_TYPES.BlockStatement) {
+    return stmt.body.some(canThrow);
+  }
+  if (stmt.type === import_utils27.AST_NODE_TYPES.IfStatement) {
+    return hasThrowingCallOrNew(stmt.test) || canThrow(stmt.consequent) || stmt.alternate !== null && canThrow(stmt.alternate);
+  }
   return hasThrowingCallOrNew(stmt);
 }
 function handlerRethrows(handler) {
@@ -3278,29 +3522,8 @@ var no_fat_try_blocks_default = import_utils27.ESLintUtils.RuleCreator(
 
 // src/rules/no-secret-in-log.ts
 var import_utils28 = require("@typescript-eslint/utils");
-var LOG_METHODS2 = /* @__PURE__ */ new Set([
-  "debug",
-  "info",
-  "warn",
-  "warning",
-  "error",
-  "exception",
-  "critical",
-  "trace",
-  "log",
-  "fatal",
-  "success"
-]);
-var LOGGER_NAMES2 = /* @__PURE__ */ new Set([
-  "logger",
-  "log",
-  "logging",
-  "loguru",
-  "console",
-  "_logger",
-  "_log"
-]);
-var LOGGER_FACTORIES = /* @__PURE__ */ new Set(["getlogger", "get_logger"]);
+
+// src/rules/_secret_names.ts
 var SECRET_WORDS = /* @__PURE__ */ new Set([
   "token",
   "secret",
@@ -3316,7 +3539,8 @@ var SECRET_WORDS = /* @__PURE__ */ new Set([
   "hmac",
   "digest",
   "hash",
-  "apikey"
+  "apikey",
+  "bearer"
 ]);
 var INNOCUOUS_WORDS = /* @__PURE__ */ new Set([
   "count",
@@ -3339,53 +3563,44 @@ var INNOCUOUS_WORDS = /* @__PURE__ */ new Set([
   "valid",
   "invalid",
   "exists",
+  "type",
+  "types"
+]);
+var DESCRIPTOR_WORDS = /* @__PURE__ */ new Set([
   "type",
   "types",
   "name",
   "names",
-  "label",
-  "labels",
-  "title",
-  "expiry",
-  "expiration",
-  "expires",
-  "ttl",
-  "version",
-  "versions",
-  "policy",
-  "rotation",
-  "arn",
-  "path",
-  "paths",
-  "issuer",
-  "audience",
-  "strength",
-  "manager",
-  "service",
-  "services",
-  "repository",
-  "provider",
-  "providers",
-  "store",
-  "factory",
-  "handler",
-  "controller",
-  "bucket",
-  "url",
-  "uri",
-  "endpoint",
-  "endpoints",
-  "scope",
-  "scopes",
-  "event",
-  "events",
-  "format",
-  "at",
-  "len",
-  "length"
+  "id",
+  "ids",
+  "kind",
+  "kinds"
+]);
+var CATEGORY_WORDS = /* @__PURE__ */ new Set(["type", "types", "kind", "kinds"]);
+var FLAG_PREFIXES = /* @__PURE__ */ new Set([
+  "is",
+  "has",
+  "was",
+  "are",
+  "can",
+  "should"
+]);
+var AUTH_WORDS = /* @__PURE__ */ new Set([
+  "token",
+  "secret",
+  "secrets",
+  "password",
+  "passwd",
+  "passwords",
+  "jwt",
+  "credential",
+  "credentials",
+  "authorization",
+  "signature",
+  "hmac",
+  "apikey",
+  "bearer"
 ]);
-var REDACTION_RE = /prefix|suffix|redact|mask|hash|hint|_len|length/i;
-var WHOLE_TOKEN_REDACTION_MARKERS = /* @__PURE__ */ new Set(["tag"]);
 var CAMEL_RE = /[A-Z]+(?=[A-Z][a-z])|[A-Z]?[a-z]+|[A-Z]+|\d+/g;
 var SEGMENT_RE = /[^A-Za-z0-9]+/;
 function tokenize(identifier) {
@@ -3401,6 +3616,14 @@ function tokenize(identifier) {
   }
   return tokens;
 }
+function leadingWord(identifier) {
+  for (const segment of identifier.split(SEGMENT_RE)) {
+    if (segment) {
+      return (segment.match(CAMEL_RE) ?? [segment])[0]?.toLowerCase();
+    }
+  }
+  return void 0;
+}
 function hasApiKey(tokens) {
   for (let i = 0; i + 1 < tokens.length; i++) {
     if (tokens[i] === "api" && tokens[i + 1] === "key") {
@@ -3409,10 +3632,10 @@ function hasApiKey(tokens) {
   }
   return false;
 }
-function isSecretName(identifier) {
+function isSecretName(identifier, innocuous = INNOCUOUS_WORDS) {
   const tokens = tokenize(identifier);
   const last = tokens.at(-1);
-  if (last !== void 0 && INNOCUOUS_WORDS.has(last)) {
+  if (last !== void 0 && innocuous.has(last)) {
     return false;
   }
   if (tokens.some((tok) => SECRET_WORDS.has(tok))) {
@@ -3420,6 +3643,76 @@ function isSecretName(identifier) {
   }
   return hasApiKey(tokens);
 }
+function isAuthSecretName(identifier) {
+  if (!isSecretName(identifier)) {
+    return false;
+  }
+  const tokens = tokenize(identifier);
+  const first = leadingWord(identifier);
+  if (first !== void 0 && FLAG_PREFIXES.has(first)) {
+    return false;
+  }
+  const last = tokens.at(-1);
+  if (last !== void 0 && DESCRIPTOR_WORDS.has(last)) {
+    return false;
+  }
+  if (tokens.some((tok) => CATEGORY_WORDS.has(tok))) {
+    return false;
+  }
+  if (tokens.some((tok) => AUTH_WORDS.has(tok))) {
+    return true;
+  }
+  return hasApiKey(tokens);
+}
+
+// src/rules/no-secret-in-log.ts
+var LOG_INNOCUOUS_WORDS = /* @__PURE__ */ new Set([
+  ...INNOCUOUS_WORDS,
+  "name",
+  "names",
+  "label",
+  "labels",
+  "title",
+  "expiry",
+  "expiration",
+  "expires",
+  "ttl",
+  "version",
+  "versions",
+  "policy",
+  "rotation",
+  "arn",
+  "path",
+  "paths",
+  "issuer",
+  "audience",
+  "strength",
+  "manager",
+  "service",
+  "services",
+  "repository",
+  "provider",
+  "providers",
+  "store",
+  "factory",
+  "handler",
+  "controller",
+  "bucket",
+  "url",
+  "uri",
+  "endpoint",
+  "endpoints",
+  "scope",
+  "scopes",
+  "event",
+  "events",
+  "format",
+  "at",
+  "len",
+  "length"
+]);
+var REDACTION_RE = /prefix|suffix|redact|mask|hash|hint|_len|length/i;
+var WHOLE_TOKEN_REDACTION_MARKERS = /* @__PURE__ */ new Set(["tag"]);
 function isSecretKeyword(name) {
   if (REDACTION_RE.test(name)) {
     return false;
@@ -3427,35 +3720,7 @@ function isSecretKeyword(name) {
   if (tokenize(name).some((tok) => WHOLE_TOKEN_REDACTION_MARKERS.has(tok))) {
     return false;
   }
-  return isSecretName(name);
-}
-function isLoggerExpr(expr) {
-  switch (expr.type) {
-    case "Identifier":
-      return LOGGER_NAMES2.has(expr.name.toLowerCase());
-    case "MemberExpression": {
-      const { property, object } = expr;
-      if (!expr.computed && property.type === "Identifier") {
-        const lowered = property.name.toLowerCase();
-        if (LOGGER_NAMES2.has(lowered) || LOGGER_FACTORIES.has(lowered)) {
-          return true;
-        }
-      }
-      return isLoggerExpr(object);
-    }
-    case "CallExpression": {
-      const callee = expr.callee;
-      if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" && LOGGER_FACTORIES.has(callee.property.name.toLowerCase())) {
-        return true;
-      }
-      if (callee.type !== "Super") {
-        return isLoggerExpr(callee);
-      }
-      return false;
-    }
-    default:
-      return false;
-  }
+  return isSecretName(name, LOG_INNOCUOUS_WORDS);
 }
 function isRawSecretValue(prop) {
   if (prop.shorthand) {
@@ -3484,20 +3749,23 @@ var no_secret_in_log_default = import_utils28.ESLintUtils.RuleCreator(
     docs: {
       description: "Disallow passing a secret-named value to a logging call; it leaks to log sinks. Redact or omit it."
     },
-    schema: [],
+    schema: [
+      {
+        type: "object",
+        additionalProperties: false,
+        properties: { ...LOGGING_OPTION_PROPERTIES }
+      }
+    ],
     messages: {
       noSecretInLog: "Secret `{{name}}` passed to a logging call leaks it to log sinks. Redact (e.g. `{{name}}Prefix: {{name}}.slice(0, 6)`) or omit it."
     }
   },
-  defaultOptions: [],
-  create(context) {
+  defaultOptions: [{}],
+  create(context, [loggingOptions]) {
+    const matcher = createLogMatcher(loggingOptions);
     return {
       CallExpression(node) {
-        const callee = node.callee;
-        if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier" || !LOG_METHODS2.has(callee.property.name)) {
-          return;
-        }
-        if (!isLoggerExpr(callee.object)) {
+        if (!matcher.isLoggingCall(node)) {
           return;
         }
         for (const arg of node.arguments) {
@@ -3700,19 +3968,33 @@ var prefer_string_literal_union_default = import_utils31.ESLintUtils.RuleCreator
     docs: {
       description: "Flag raw `string` choice fields and string-literal comparison clusters; prefer a string-literal union type."
     },
-    schema: [],
+    schema: [
+      {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          ignoreFields: {
+            type: "array",
+            items: { type: "string" }
+          }
+        }
+      }
+    ],
     messages: {
       bareChoiceField: '`{{name}}: string` looks like a choice field \u2014 prefer a string-literal union type (e.g. `type X = "a" | "b"`). Enums are banned by `no-enum`; use a union.',
       comparisonCluster: '`{{key}}` is compared against a closed set of string literals \u2014 define a string-literal union type (e.g. `type X = "a" | "b"`).'
     }
   },
-  defaultOptions: [],
-  create(context) {
+  defaultOptions: [{}],
+  create(context, [optionsArg]) {
     const filename = context.filename;
     const sourceText = context.sourceCode.getText();
     if (isIgnoredFile(filename, sourceText)) {
       return {};
     }
+    const ignoredFields = new Set(
+      (optionsArg?.ignoreFields ?? []).map((name) => name.toLowerCase())
+    );
     let services;
     try {
       services = import_utils31.ESLintUtils.getParserServices(context);
@@ -3760,18 +4042,46 @@ var prefer_string_literal_union_default = import_utils31.ESLintUtils.RuleCreator
     function operandIsFlaggable(node) {
       return operandIsRawString(node) && !originIsExternal(services?.esTreeNodeToTSNodeMap.get(node), 0);
     }
-    function pushScope() {
-      scopeStack.push({ clusters: /* @__PURE__ */ new Map() });
+    function declaredReturnLiterals(fn) {
+      const annotation = fn.returnType?.typeAnnotation;
+      if (annotation === void 0 || services === null) {
+        return null;
+      }
+      const tsNode = services.esTreeNodeToTSNodeMap.get(annotation);
+      if (!ts.isTypeNode(tsNode)) {
+        return null;
+      }
+      const checker = services.program.getTypeChecker();
+      const declared = checker.getTypeFromTypeNode(tsNode);
+      const type = checker.getAwaitedType(declared) ?? declared;
+      const literals = /* @__PURE__ */ new Set();
+      for (const part of type.isUnion() ? type.types : [type]) {
+        if (part.isStringLiteral()) {
+          literals.add(part.value);
+        }
+      }
+      return literals.size >= MIN_CLUSTER_SIZE ? literals : null;
+    }
+    function pushScope(node) {
+      scopeStack.push({ clusters: /* @__PURE__ */ new Map(), fn: node });
     }
     function popScope() {
       const scope = scopeStack.pop();
       if (scope === void 0) {
         return;
       }
-      for (const entry of scope.clusters.values()) {
-        if (entry.allTokens && entry.literals.size >= MIN_CLUSTER_SIZE) {
-          validClusters.push(entry.node);
+      const candidates = [...scope.clusters.values()].filter(
+        (entry) => entry.allTokens && entry.literals.size >= MIN_CLUSTER_SIZE
+      );
+      if (candidates.length === 0) {
+        return;
+      }
+      const returnLiterals = scope.fn === null ? null : declaredReturnLiterals(scope.fn);
+      for (const entry of candidates) {
+        if (returnLiterals !== null && [...entry.literals].every((lit) => returnLiterals.has(lit))) {
+          continue;
         }
+        validClusters.push(entry.node);
       }
     }
     function accumulate(key, literals, node) {
@@ -3803,7 +4113,7 @@ var prefer_string_literal_union_default = import_utils31.ESLintUtils.RuleCreator
         return;
       }
       const name = keyName(key);
-      if (name === null || !isChoiceLikeName(name)) {
+      if (name === null || !isChoiceLikeName(name) || ignoredFields.has(name.toLowerCase())) {
         return;
       }
       bareChoiceProps.push({ name, container, node });
@@ -3922,7 +4232,7 @@ var ACRONYM_OVERRIDES = [
   [/gRPC/g, "Grpc"]
 ];
 var CAMEL_BOUNDARY_RE = /(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/g;
-var TEST_FILE_RE2 = /\.(test|spec)\.[cm]?[jt]sx?$/i;
+var TEST_FILE_RE = /\.(test|spec)\.[cm]?[jt]sx?$/i;
 var SCRIPT_EXT_RE = /\.[cm]?[jt]sx?$/i;
 var basename = (filename) => filename.split(/[/\\]/).pop() ?? filename;
 var stemOf = (base) => base.replace(SCRIPT_EXT_RE, "");
@@ -4022,7 +4332,7 @@ var single_public_export_default = import_utils32.ESLintUtils.RuleCreator(
   create(context) {
     const base = basename(context.filename);
     if (base.endsWith(".d.ts")) return {};
-    if (TEST_FILE_RE2.test(base)) return {};
+    if (TEST_FILE_RE.test(base)) return {};
     const stem = stemOf(base);
     if (!JUNK_DRAWER_STEMS.has(stem.toLowerCase())) return {};
     return {
@@ -4043,6 +4353,975 @@ var single_public_export_default = import_utils32.ESLintUtils.RuleCreator(
   }
 });
 
+// src/rules/no-offset-pagination.ts
+var import_utils34 = require("@typescript-eslint/utils");
+
+// src/rules/_sql.ts
+var import_utils33 = require("@typescript-eslint/utils");
+function stripSqlNoise(text) {
+  const out = [...text];
+  const n = text.length;
+  let i = 0;
+  while (i < n) {
+    const ch = text[i];
+    if (ch === "'" || ch === '"') {
+      out[i] = " ";
+      i += 1;
+      while (i < n) {
+        const c = text[i];
+        if (c === ch) {
+          if (i + 1 < n && text[i + 1] === ch) {
+            out[i] = " ";
+            out[i + 1] = " ";
+            i += 2;
+            continue;
+          }
+          out[i] = " ";
+          i += 1;
+          break;
+        }
+        if (c !== "\n") {
+          out[i] = " ";
+        }
+        i += 1;
+      }
+      continue;
+    }
+    if (ch === "-" && text[i + 1] === "-") {
+      while (i < n && text[i] !== "\n") {
+        out[i] = " ";
+        i += 1;
+      }
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "*") {
+      out[i] = " ";
+      out[i + 1] = " ";
+      i += 2;
+      while (i < n && !(text[i] === "*" && text[i + 1] === "/")) {
+        if (text[i] !== "\n") {
+          out[i] = " ";
+        }
+        i += 1;
+      }
+      if (i < n) {
+        out[i] = " ";
+        out[i + 1] = " ";
+        i += 2;
+      }
+      continue;
+    }
+    i += 1;
+  }
+  return out.join("");
+}
+var SUBSTITUTION_MARKER = "?";
+function sqlTextOf(node) {
+  switch (node.type) {
+    case import_utils33.AST_NODE_TYPES.Literal:
+      return typeof node.value === "string" ? node.value : null;
+    case import_utils33.AST_NODE_TYPES.TemplateLiteral:
+      return node.quasis.map((q) => q.value.cooked ?? q.value.raw).join(SUBSTITUTION_MARKER);
+    case import_utils33.AST_NODE_TYPES.TaggedTemplateExpression:
+      return sqlTextOf(node.quasi);
+    case import_utils33.AST_NODE_TYPES.BinaryExpression: {
+      if (node.operator !== "+") {
+        return null;
+      }
+      const left = sqlTextOf(node.left);
+      const right = sqlTextOf(node.right);
+      return left !== null && right !== null ? left + right : null;
+    }
+    case import_utils33.AST_NODE_TYPES.ArrayExpression: {
+      const parts = [];
+      for (const element of node.elements) {
+        if (element === null) {
+          return null;
+        }
+        const part = sqlTextOf(element);
+        if (part === null) {
+          return null;
+        }
+        parts.push(part);
+      }
+      return parts.length > 0 ? parts.join(" ") : null;
+    }
+    default:
+      return null;
+  }
+}
+function isJoinedFragmentArray(node) {
+  const parent = node.parent;
+  return parent?.type === import_utils33.AST_NODE_TYPES.MemberExpression && parent.object === node && !parent.computed && parent.property.type === import_utils33.AST_NODE_TYPES.Identifier && parent.property.name === "join" && parent.parent?.type === import_utils33.AST_NODE_TYPES.CallExpression;
+}
+function markConsumed(node, consumed) {
+  consumed.add(node);
+  for (const key of Object.keys(node)) {
+    if (key === "parent") {
+      continue;
+    }
+    const value = node[key];
+    for (const child of Array.isArray(value) ? value : [value]) {
+      if (child !== null && typeof child === "object" && "type" in child) {
+        markConsumed(child, consumed);
+      }
+    }
+  }
+}
+function createSqlListener(handler) {
+  const consumed = /* @__PURE__ */ new WeakSet();
+  const visit = (node) => {
+    if (consumed.has(node)) {
+      return;
+    }
+    const text = sqlTextOf(node);
+    if (text === null) {
+      return;
+    }
+    markConsumed(node, consumed);
+    handler(stripSqlNoise(text), node);
+  };
+  return {
+    BinaryExpression: (node) => {
+      visit(node);
+    },
+    ArrayExpression: (node) => {
+      if (isJoinedFragmentArray(node)) {
+        visit(node);
+      }
+    },
+    TemplateLiteral: (node) => {
+      visit(node);
+    },
+    Literal: (node) => {
+      visit(node);
+    }
+  };
+}
+
+// src/rules/no-offset-pagination.ts
+var OFFSET_PAGINATION = /\bOFFSET\s+(?:\?\d*|:\w+|@\w+|\$\d+|\d+)/i;
+var OFFSET_GATE = /offset/i;
+var no_offset_pagination_default = import_utils34.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-offset-pagination",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow OFFSET pagination in embedded SQL; it is O(N) per page and drops or repeats rows under concurrent writes. Use a keyset cursor."
+    },
+    schema: [],
+    messages: {
+      noOffsetPagination: "OFFSET pagination scans and discards every skipped row (O(N) per page) and shifts under concurrent inserts, so rows get repeated or missed. Use a keyset cursor: `WHERE id > ? ORDER BY id LIMIT ?`."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    if (isTestFile(context.filename) || !OFFSET_GATE.test(context.sourceCode.text)) {
+      return {};
+    }
+    return createSqlListener((sql, node) => {
+      if (!OFFSET_PAGINATION.test(sql)) {
+        return;
+      }
+      context.report({ node, messageId: "noOffsetPagination" });
+    });
+  }
+});
+
+// src/rules/no-positional-tuple-return.ts
+var import_utils35 = require("@typescript-eslint/utils");
+var MIN_ELEMENTS = 2;
+var AWAITABLE_TYPES = /* @__PURE__ */ new Set(["Promise", "PromiseLike", "Awaited"]);
+function tupleReturnType(node) {
+  if (node.type === import_utils35.AST_NODE_TYPES.TSTupleType) {
+    return node;
+  }
+  if (node.type === import_utils35.AST_NODE_TYPES.TSTypeReference && node.typeName.type === import_utils35.AST_NODE_TYPES.Identifier && AWAITABLE_TYPES.has(node.typeName.name)) {
+    const argument = node.typeArguments?.params[0];
+    return argument === void 0 ? null : tupleReturnType(argument);
+  }
+  return null;
+}
+function normalizedText(sourceCode, node) {
+  return sourceCode.getText(node).replaceAll(/\s+/g, " ").trim();
+}
+function isPermittedTuple(tuple, sourceCode) {
+  const elements = tuple.elementTypes;
+  if (elements.length < MIN_ELEMENTS) {
+    return true;
+  }
+  if (elements.some((element) => element.type === import_utils35.AST_NODE_TYPES.TSRestType)) {
+    return true;
+  }
+  if (elements.some((element) => element.type === import_utils35.AST_NODE_TYPES.TSNamedTupleMember)) {
+    return true;
+  }
+  if (elements[0]?.type === import_utils35.AST_NODE_TYPES.TSLiteralType) {
+    return true;
+  }
+  const texts = new Set(elements.map((element) => normalizedText(sourceCode, element)));
+  return texts.size === 1;
+}
+function functionName(node) {
+  if (node.type === import_utils35.AST_NODE_TYPES.FunctionDeclaration) {
+    return node.id?.name ?? null;
+  }
+  const parent = node.parent;
+  if (parent?.type === import_utils35.AST_NODE_TYPES.VariableDeclarator && parent.id.type === import_utils35.AST_NODE_TYPES.Identifier) {
+    return parent.id.name;
+  }
+  if ((parent?.type === import_utils35.AST_NODE_TYPES.MethodDefinition || parent?.type === import_utils35.AST_NODE_TYPES.PropertyDefinition || parent?.type === import_utils35.AST_NODE_TYPES.Property) && parent.key.type === import_utils35.AST_NODE_TYPES.Identifier) {
+    return parent.key.name;
+  }
+  return null;
+}
+function isExported(node) {
+  for (let current = node; current != null; current = current.parent) {
+    const parent = current.parent;
+    if (parent?.type === import_utils35.AST_NODE_TYPES.ExportNamedDeclaration || parent?.type === import_utils35.AST_NODE_TYPES.ExportDefaultDeclaration) {
+      return true;
+    }
+  }
+  return false;
+}
+var no_positional_tuple_return_default = import_utils35.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-positional-tuple-return",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Disallow returning a positional tuple of distinct fields from an exported function; return a named object so call sites cannot mismatch slots."
+    },
+    schema: [],
+    messages: {
+      noPositionalTupleReturn: "Exported `{{name}}` returns a positional {{count}}-tuple, so every call site re-invents the field names and can disagree. Return a named object (or label the tuple members) instead."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const check = (node) => {
+      const annotation = node.returnType?.typeAnnotation;
+      if (annotation === void 0) {
+        return;
+      }
+      const tuple = tupleReturnType(annotation);
+      if (tuple === null || isPermittedTuple(tuple, context.sourceCode)) {
+        return;
+      }
+      const name = functionName(node);
+      if (name === null || name.startsWith("_") || /^use[A-Z]/.test(name)) {
+        return;
+      }
+      if (!isExported(node)) {
+        return;
+      }
+      context.report({
+        node: tuple,
+        messageId: "noPositionalTupleReturn",
+        data: { name, count: String(tuple.elementTypes.length) }
+      });
+    };
+    return {
+      FunctionDeclaration: check,
+      FunctionExpression: check,
+      ArrowFunctionExpression: check
+    };
+  }
+});
+
+// src/rules/no-repeated-string-literal.ts
+var import_utils36 = require("@typescript-eslint/utils");
+var MIN_LENGTH = 40;
+var MIN_OCCURRENCES = 3;
+var MIN_DISTINCT_SCOPES = 2;
+var PREVIEW_LENGTH = 40;
+var SQL_KEYWORD_RE = /\b(SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|JOIN|VALUES|ON CONFLICT|RETURNING|GROUP BY|ORDER BY)\b/;
+var IDENTIFIER_RE = /^[a-z_][a-z0-9_.]*$/;
+var FUNCTION_TYPES = /* @__PURE__ */ new Set([
+  import_utils36.AST_NODE_TYPES.FunctionDeclaration,
+  import_utils36.AST_NODE_TYPES.FunctionExpression,
+  import_utils36.AST_NODE_TYPES.ArrowFunctionExpression
+]);
+function isStructured(value) {
+  return value.includes("\n") || SQL_KEYWORD_RE.test(value) || IDENTIFIER_RE.test(value);
+}
+function preview(value) {
+  const oneLine = value.replaceAll("\n", " ").trim();
+  return oneLine.length <= PREVIEW_LENGTH ? oneLine : `${oneLine.slice(0, PREVIEW_LENGTH)}...`;
+}
+function enclosingFunction(node) {
+  for (let current = node.parent; current != null; current = current.parent) {
+    if (FUNCTION_TYPES.has(current.type)) {
+      return current;
+    }
+  }
+  return null;
+}
+function isScaffolding(node) {
+  const parent = node.parent;
+  if (parent === void 0) {
+    return true;
+  }
+  return parent.type === import_utils36.AST_NODE_TYPES.ImportDeclaration || parent.type === import_utils36.AST_NODE_TYPES.ExportNamedDeclaration || parent.type === import_utils36.AST_NODE_TYPES.ExportAllDeclaration || parent.type === import_utils36.AST_NODE_TYPES.TSImportType || parent.type === import_utils36.AST_NODE_TYPES.JSXAttribute || parent.type === import_utils36.AST_NODE_TYPES.TSLiteralType;
+}
+var no_repeated_string_literal_default = import_utils36.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-repeated-string-literal",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Disallow a long structured string literal repeated across functions; the copies drift when one is edited. Extract a module-level constant."
+    },
+    schema: [],
+    messages: {
+      noRepeatedStringLiteral: 'Structured string literal "{{preview}}" is repeated across functions (first use on line {{line}}) \u2014 extract a module-level constant so the copies cannot drift.'
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    if (isTestFile(context.filename)) {
+      return {};
+    }
+    const occurrences = /* @__PURE__ */ new Map();
+    const scopes = /* @__PURE__ */ new WeakMap();
+    const record = (value, node) => {
+      if (value.length < MIN_LENGTH || !isStructured(value) || isScaffolding(node)) {
+        return;
+      }
+      const existing = occurrences.get(value);
+      if (existing === void 0) {
+        occurrences.set(value, [node]);
+      } else {
+        existing.push(node);
+      }
+      scopes.set(node, enclosingFunction(node));
+    };
+    return {
+      Literal(node) {
+        if (typeof node.value === "string") {
+          record(node.value, node);
+        }
+      },
+      TemplateLiteral(node) {
+        const [only] = node.quasis;
+        if (node.expressions.length === 0 && only !== void 0) {
+          record(only.value.cooked ?? only.value.raw, node);
+        }
+      },
+      "Program:exit": () => {
+        for (const [value, nodes] of occurrences) {
+          if (nodes.length < MIN_OCCURRENCES) {
+            continue;
+          }
+          const distinctScopes = new Set(
+            nodes.map((node) => scopes.get(node)).filter((scope) => scope != null)
+          );
+          if (distinctScopes.size < MIN_DISTINCT_SCOPES) {
+            continue;
+          }
+          const [first, ...repeats] = nodes;
+          if (first === void 0) {
+            continue;
+          }
+          for (const node of repeats) {
+            context.report({
+              node,
+              messageId: "noRepeatedStringLiteral",
+              data: { preview: preview(value), line: String(first.loc.start.line) }
+            });
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/rules/no-select-star.ts
+var import_utils37 = require("@typescript-eslint/utils");
+var QUERY_SHAPE = /\bSELECT\b[\s\S]*?\bFROM\b/i;
+var SELECT_KEYWORD = /\bSELECT\b/gi;
+var FROM_KEYWORD = /^FROM\b/i;
+var EXISTS_BEFORE = /\bEXISTS\s*\(\s*$/i;
+var QUALIFIED_PREFIX = /\w\.$/;
+var SELECT_GATE = /select/i;
+function isProjectionStar(sql, pos) {
+  if (QUALIFIED_PREFIX.test(sql.slice(0, pos))) {
+    return true;
+  }
+  let before = pos - 1;
+  while (before >= 0 && /\s/.test(sql[before] ?? "")) {
+    before -= 1;
+  }
+  let after = pos + 1;
+  while (after < sql.length && /\s/.test(sql[after] ?? "")) {
+    after += 1;
+  }
+  const beforeChar = before >= 0 ? sql[before] ?? "" : "";
+  const afterChar = after < sql.length ? sql[after] ?? "" : "";
+  const terminates = afterChar === "" || afterChar === "," || afterChar === ")" || FROM_KEYWORD.test(sql.slice(after));
+  if (!terminates) {
+    return false;
+  }
+  return !(beforeChar === "(" && afterChar === ")");
+}
+function hasRealSelectStar(sql) {
+  const selects = [...sql.matchAll(SELECT_KEYWORD)].map((m) => m.index);
+  for (let pos = 0; pos < sql.length; pos++) {
+    if (sql[pos] !== "*" || !isProjectionStar(sql, pos)) {
+      continue;
+    }
+    const owning = selects.filter((start) => start < pos).at(-1);
+    if (owning !== void 0 && !EXISTS_BEFORE.test(sql.slice(0, owning))) {
+      return true;
+    }
+  }
+  return false;
+}
+var no_select_star_default = import_utils37.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-select-star",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow SELECT * in embedded SQL; it over-fetches and leaves the row contract implicit, so a schema change breaks row parsing silently."
+    },
+    schema: [],
+    messages: {
+      noSelectStar: "`SELECT *` over-fetches and leaves the row shape implicit \u2014 a new or reordered column silently changes what this query returns. List the columns explicitly."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    if (isTestFile(context.filename) || !SELECT_GATE.test(context.sourceCode.text)) {
+      return {};
+    }
+    return createSqlListener((sql, node) => {
+      if (!QUERY_SHAPE.test(sql) || !hasRealSelectStar(sql)) {
+        return;
+      }
+      context.report({ node, messageId: "noSelectStar" });
+    });
+  }
+});
+
+// src/rules/no-sleep-in-test-body.ts
+var import_utils38 = require("@typescript-eslint/utils");
+var SLEEP_HELPERS = /* @__PURE__ */ new Set(["sleep", "delay", "wait", "pause"]);
+var TEST_CALLERS = /* @__PURE__ */ new Set([
+  "it",
+  "test",
+  "beforeEach",
+  "afterEach"
+]);
+var FUNCTION_TYPES2 = /* @__PURE__ */ new Set([
+  import_utils38.AST_NODE_TYPES.FunctionDeclaration,
+  import_utils38.AST_NODE_TYPES.FunctionExpression,
+  import_utils38.AST_NODE_TYPES.ArrowFunctionExpression
+]);
+function isNonzeroNumericLiteral(node) {
+  return node?.type === import_utils38.AST_NODE_TYPES.Literal && typeof node.value === "number" && node.value !== 0;
+}
+function isTimedSetTimeout(node) {
+  return node.type === import_utils38.AST_NODE_TYPES.CallExpression && node.callee.type === import_utils38.AST_NODE_TYPES.Identifier && node.callee.name === "setTimeout" && node.arguments.length >= 2 && isNonzeroNumericLiteral(node.arguments[1]);
+}
+function isPromiseSleep(node) {
+  if (node.callee.type !== import_utils38.AST_NODE_TYPES.Identifier || node.callee.name !== "Promise") {
+    return false;
+  }
+  const executor = node.arguments[0];
+  if (executor?.type !== import_utils38.AST_NODE_TYPES.ArrowFunctionExpression && executor?.type !== import_utils38.AST_NODE_TYPES.FunctionExpression) {
+    return false;
+  }
+  const body = executor.body;
+  if (body.type !== import_utils38.AST_NODE_TYPES.BlockStatement) {
+    return isTimedSetTimeout(body);
+  }
+  return body.body.some(
+    (stmt) => stmt.type === import_utils38.AST_NODE_TYPES.ExpressionStatement && isTimedSetTimeout(stmt.expression)
+  );
+}
+function isHelperSleep(node) {
+  return node.callee.type === import_utils38.AST_NODE_TYPES.Identifier && SLEEP_HELPERS.has(node.callee.name) && node.arguments.length >= 1 && isNonzeroNumericLiteral(node.arguments[0]);
+}
+function nearestEnclosingFunction(node) {
+  for (let current = node.parent; current != null; current = current.parent) {
+    if (!FUNCTION_TYPES2.has(current.type)) {
+      continue;
+    }
+    const grandparent = current.parent;
+    const isPromiseExecutor = grandparent?.type === import_utils38.AST_NODE_TYPES.NewExpression && isPromiseSleep(grandparent);
+    if (!isPromiseExecutor) {
+      return current;
+    }
+  }
+  return null;
+}
+function testCallerName(callee) {
+  if (callee.type === import_utils38.AST_NODE_TYPES.Identifier) {
+    return callee.name;
+  }
+  if (callee.type === import_utils38.AST_NODE_TYPES.MemberExpression) {
+    return testCallerName(callee.object);
+  }
+  if (callee.type === import_utils38.AST_NODE_TYPES.CallExpression) {
+    return testCallerName(callee.callee);
+  }
+  if (callee.type === import_utils38.AST_NODE_TYPES.TaggedTemplateExpression) {
+    return testCallerName(callee.tag);
+  }
+  return null;
+}
+function isTestBody(fn) {
+  const call = fn.parent;
+  if (call?.type !== import_utils38.AST_NODE_TYPES.CallExpression || !call.arguments.some((argument) => argument === fn)) {
+    return false;
+  }
+  const name = testCallerName(call.callee);
+  return name !== null && TEST_CALLERS.has(name);
+}
+var no_sleep_in_test_body_default = import_utils38.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-sleep-in-test-body",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow a fixed timed sleep directly in a test body; it flakes under CI load. Synchronize on the signal or use fake timers."
+    },
+    schema: [],
+    messages: {
+      noSleepInTestBody: "A fixed sleep in a test body asserts on wall-clock time and flakes under CI load. Await the promise the code returns, or drive time with `vi.useFakeTimers()` + `await vi.advanceTimersByTimeAsync(ms)`."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    if (!isTestFile(context.filename)) {
+      return {};
+    }
+    const report = (node) => {
+      const enclosing = nearestEnclosingFunction(node);
+      if (enclosing === null || !isTestBody(enclosing)) {
+        return;
+      }
+      context.report({ node, messageId: "noSleepInTestBody" });
+    };
+    return {
+      NewExpression(node) {
+        if (isPromiseSleep(node)) {
+          report(node);
+        }
+      },
+      CallExpression(node) {
+        if (isHelperSleep(node)) {
+          report(node);
+        }
+      }
+    };
+  }
+});
+
+// src/rules/prefer-constant-time-secret-compare.ts
+var import_utils39 = require("@typescript-eslint/utils");
+var EQUALITY_OPERATORS = /* @__PURE__ */ new Set(["===", "!==", "==", "!="]);
+var SENTINEL_IDENTIFIERS = /* @__PURE__ */ new Set(["undefined", "NaN"]);
+var SENTINEL_WORDS = /(^|_)(SENTINEL|EMPTY|NONE|NULL|UNSET|MISSING|PLACEHOLDER|DUMMY|FAKE|EXAMPLE)(_|$)/;
+function isConstantReference(identifier) {
+  if (isAuthSecretName(identifier) && !SENTINEL_WORDS.test(identifier)) return false;
+  return identifier === identifier.toUpperCase() && /[A-Za-z]/.test(identifier);
+}
+function isExcludedOperand(node) {
+  switch (node.type) {
+    case import_utils39.AST_NODE_TYPES.Literal:
+      return true;
+    case import_utils39.AST_NODE_TYPES.TemplateLiteral:
+      return node.expressions.length === 0;
+    case import_utils39.AST_NODE_TYPES.Identifier:
+      return SENTINEL_IDENTIFIERS.has(node.name) || isConstantReference(node.name);
+    case import_utils39.AST_NODE_TYPES.MemberExpression:
+      return !node.computed && node.property.type === import_utils39.AST_NODE_TYPES.Identifier && isConstantReference(node.property.name);
+    default:
+      return false;
+  }
+}
+function operandName(node) {
+  if (node.type === import_utils39.AST_NODE_TYPES.Identifier) {
+    return node.name;
+  }
+  if (node.type === import_utils39.AST_NODE_TYPES.MemberExpression && !node.computed && node.property.type === import_utils39.AST_NODE_TYPES.Identifier) {
+    return node.property.name;
+  }
+  return null;
+}
+function isSecretOperand(node) {
+  if (node.type === import_utils39.AST_NODE_TYPES.TemplateLiteral) {
+    return node.expressions.some((expression) => isSecretOperand(expression));
+  }
+  const name = operandName(node);
+  return name !== null && isAuthSecretName(name);
+}
+function secretNameOf(node) {
+  if (node.type === import_utils39.AST_NODE_TYPES.TemplateLiteral) {
+    for (const expression of node.expressions) {
+      const nested = secretNameOf(expression);
+      if (nested !== null) {
+        return nested;
+      }
+    }
+    return null;
+  }
+  return operandName(node);
+}
+var prefer_constant_time_secret_compare_default = import_utils39.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "prefer-constant-time-secret-compare",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow `===`/`!==` on a secret-like value; short-circuiting comparison leaks the secret through timing. Use a constant-time compare."
+    },
+    schema: [],
+    messages: {
+      preferConstantTimeSecretCompare: "`{{operator}}` on secret `{{name}}` short-circuits on the first differing byte and leaks it through timing. Compare constant-time instead (`crypto.subtle.timingSafeEqual` over equal-length SHA-256 digests)."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    if (isTestFile(context.filename)) {
+      return {};
+    }
+    return {
+      BinaryExpression(node) {
+        if (!EQUALITY_OPERATORS.has(node.operator)) {
+          return;
+        }
+        const { left, right } = node;
+        if (isExcludedOperand(left) || isExcludedOperand(right)) {
+          return;
+        }
+        const secret = [left, right].find((operand) => isSecretOperand(operand));
+        if (secret === void 0) {
+          return;
+        }
+        context.report({
+          node,
+          messageId: "preferConstantTimeSecretCompare",
+          data: { operator: node.operator, name: secretNameOf(secret) ?? "" }
+        });
+      }
+    };
+  }
+});
+
+// src/rules/store-insert-requires-on-conflict.ts
+var import_utils40 = require("@typescript-eslint/utils");
+var INSERT_WRITE = /\bINSERT\s+(?:OR\s+\w+\s+)?INTO\s+[\w."'`?$:@-]+\s*(?:\([^)]*\)\s*)?(?:VALUES|SELECT|DEFAULT\s+VALUES)\b/i;
+var CONFLICT_HANDLED = /\bON\s+CONFLICT\b|\bON\s+DUPLICATE\s+KEY\b|\bINSERT\s+OR\s+(?:IGNORE|REPLACE)\b/i;
+var INSERT_GATE = /insert/i;
+var store_insert_requires_on_conflict_default = import_utils40.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "store-insert-requires-on-conflict",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Require an embedded SQL INSERT to carry ON CONFLICT; store writes replay under cron re-runs and queue redelivery and must be idempotent upserts."
+    },
+    schema: [],
+    messages: {
+      storeInsertRequiresOnConflict: "This INSERT is not replay-safe: a cron re-run or queue redelivery duplicates the row (or fails the handler on a unique-constraint violation). Add `ON CONFLICT (...) DO UPDATE` / `DO NOTHING` (or `INSERT OR IGNORE`)."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    if (isTestFile(context.filename) || !INSERT_GATE.test(context.sourceCode.text)) {
+      return {};
+    }
+    return createSqlListener((sql, node) => {
+      if (!INSERT_WRITE.test(sql) || CONFLICT_HANDLED.test(sql)) {
+        return;
+      }
+      context.report({ node, messageId: "storeInsertRequiresOnConflict" });
+    });
+  }
+});
+
+// src/rules/no-dynamic-sql.ts
+var import_utils41 = require("@typescript-eslint/utils");
+var DEFAULT_METHODS = ["prepare", "exec", "query"];
+var CONSTANT_CASE_RE = /^[A-Z][A-Z0-9_]*$/;
+function isStaticFragment(expression) {
+  if (expression.type === import_utils41.AST_NODE_TYPES.Identifier) {
+    return CONSTANT_CASE_RE.test(expression.name);
+  }
+  if (expression.type === import_utils41.AST_NODE_TYPES.MemberExpression && !expression.computed && expression.property.type === import_utils41.AST_NODE_TYPES.Identifier) {
+    return CONSTANT_CASE_RE.test(expression.property.name);
+  }
+  if (expression.type === import_utils41.AST_NODE_TYPES.Literal) {
+    return typeof expression.value === "string";
+  }
+  return false;
+}
+function runtimeInterpolations(template) {
+  return template.expressions.filter(
+    (expression) => !isStaticFragment(expression)
+  );
+}
+function concatOperands(node) {
+  if (node.type === import_utils41.AST_NODE_TYPES.BinaryExpression && node.operator === "+") {
+    return [...concatOperands(node.left), ...concatOperands(node.right)];
+  }
+  return [node];
+}
+function runtimeConcatOperands(node) {
+  if (node.type !== import_utils41.AST_NODE_TYPES.BinaryExpression || node.operator !== "+") {
+    return [];
+  }
+  const operands = concatOperands(node);
+  const hasStringLiteral = operands.some(
+    (operand) => operand.type === import_utils41.AST_NODE_TYPES.Literal && typeof operand.value === "string"
+  );
+  if (!hasStringLiteral) {
+    return [];
+  }
+  return operands.filter(
+    (operand) => operand.type !== import_utils41.AST_NODE_TYPES.Literal && !isStaticFragment(operand)
+  );
+}
+function statementMethodName(node, methods) {
+  const callee = node.callee;
+  if (callee.type !== import_utils41.AST_NODE_TYPES.MemberExpression || callee.computed || callee.property.type !== import_utils41.AST_NODE_TYPES.Identifier) {
+    return null;
+  }
+  const name = callee.property.name;
+  return methods.has(name) ? name : null;
+}
+var no_dynamic_sql_default = import_utils41.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-dynamic-sql",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow interpolating or concatenating a runtime value into a SQL statement passed to `prepare`/`exec`/`query`; use a placeholder and bind the value."
+    },
+    schema: [
+      {
+        type: "object",
+        properties: {
+          methods: {
+            type: "array",
+            items: { type: "string" },
+            description: "Statement-taking method names to inspect. Replaces the defaults."
+          }
+        },
+        additionalProperties: false
+      }
+    ],
+    messages: {
+      dynamicSql: "Runtime value built into a SQL statement passed to `{{method}}()`. Use a `?` placeholder and pass the value through `.bind(...)` so the driver parameterises it."
+    }
+  },
+  defaultOptions: [{}],
+  create(context, [options]) {
+    const methods = new Set(options?.methods ?? DEFAULT_METHODS);
+    return {
+      CallExpression(node) {
+        const method = statementMethodName(node, methods);
+        if (method === null) {
+          return;
+        }
+        const statement = node.arguments[0];
+        if (statement === void 0) {
+          return;
+        }
+        const offenders = statement.type === import_utils41.AST_NODE_TYPES.TemplateLiteral ? runtimeInterpolations(statement) : runtimeConcatOperands(statement);
+        for (const offender of offenders) {
+          context.report({
+            node: offender,
+            messageId: "dynamicSql",
+            data: { method }
+          });
+        }
+      }
+    };
+  }
+});
+
+// src/rules/no-raw-fetch-outside-clients.ts
+var import_utils42 = require("@typescript-eslint/utils");
+var DEFAULT_ALLOW = [
+  "[\\\\/]clients?[\\\\/]",
+  "-client\\.[cm]?[jt]sx?$",
+  "[\\\\/]http-client\\.[cm]?[jt]sx?$",
+  "\\.test\\.",
+  "\\.spec\\.",
+  "[\\\\/]__tests__[\\\\/]",
+  "[\\\\/]__mocks__[\\\\/]"
+];
+var GLOBAL_RECEIVERS = /* @__PURE__ */ new Set([
+  "globalThis",
+  "window",
+  "self"
+]);
+function isGlobalFetchCall(node) {
+  const callee = node.callee;
+  if (callee.type === "Identifier") {
+    return callee.name === "fetch";
+  }
+  if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" && callee.property.name === "fetch" && callee.object.type === "Identifier") {
+    return GLOBAL_RECEIVERS.has(callee.object.name);
+  }
+  return false;
+}
+function compile(patterns) {
+  const compiled = [];
+  for (const pattern of patterns) {
+    try {
+      compiled.push(new RegExp(pattern));
+    } catch {
+    }
+  }
+  return compiled;
+}
+var no_raw_fetch_outside_clients_default = import_utils42.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-raw-fetch-outside-clients",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow calling the global `fetch` outside the client layer; route outbound HTTP through a client module that owns retry, timeout and status handling."
+    },
+    schema: [
+      {
+        type: "object",
+        properties: {
+          allow: {
+            type: "array",
+            items: { type: "string" },
+            description: "Regular-expression sources matched against the filename. Replaces the defaults."
+          }
+        },
+        additionalProperties: false
+      }
+    ],
+    messages: {
+      rawFetch: "Raw `fetch()` outside a client module. Route the call through a client (e.g. `clients/*-client.ts`) so it inherits retry, timeout and status handling and stays stubbable in tests."
+    }
+  },
+  defaultOptions: [{}],
+  create(context, [options]) {
+    const patterns = options?.allow ?? DEFAULT_ALLOW;
+    const allowed = compile(patterns);
+    const filename = context.filename;
+    if (allowed.some((re) => re.test(filename))) {
+      return {};
+    }
+    return {
+      CallExpression(node) {
+        if (isGlobalFetchCall(node)) {
+          context.report({ node, messageId: "rawFetch" });
+        }
+      }
+    };
+  }
+});
+
+// src/rules/no-storage-in-stateless-modules.ts
+var import_utils43 = require("@typescript-eslint/utils");
+var DEFAULT_METHODS2 = [
+  "prepare",
+  "put",
+  "getWithMetadata"
+];
+var MIN_ARGUMENTS = /* @__PURE__ */ new Map([["put", 2]]);
+function compile2(patterns) {
+  const compiled = [];
+  for (const pattern of patterns) {
+    try {
+      compiled.push(new RegExp(pattern));
+    } catch {
+    }
+  }
+  return compiled;
+}
+function storageMethodName(node, methods) {
+  const callee = node.callee;
+  if (callee.type !== import_utils43.AST_NODE_TYPES.MemberExpression || callee.computed || callee.property.type !== import_utils43.AST_NODE_TYPES.Identifier) {
+    return null;
+  }
+  const name = callee.property.name;
+  if (!methods.has(name)) {
+    return null;
+  }
+  if (node.arguments.length < (MIN_ARGUMENTS.get(name) ?? 1)) {
+    return null;
+  }
+  return name;
+}
+var no_storage_in_stateless_modules_default = import_utils43.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/sarj-ai/standards/blob/main/packages/typescript/src/rules/${name}.ts`
+)({
+  name: "no-storage-in-stateless-modules",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow SQL or key/value access inside modules a team has declared stateless; derive state from the systems of record instead. No-op until `modules` is configured."
+    },
+    schema: [
+      {
+        type: "object",
+        properties: {
+          modules: {
+            type: "array",
+            items: { type: "string" },
+            description: "Regex sources matched against the filename. Empty (the default) disables the rule."
+          },
+          methods: {
+            type: "array",
+            items: { type: "string" },
+            description: "Storage method names to flag. Replaces the defaults."
+          }
+        },
+        additionalProperties: false
+      }
+    ],
+    messages: {
+      storageInStatelessModule: "`{{method}}()` reaches for private storage inside a module declared stateless. Derive the state from a read against the system of record, or from a marker in the artefact this feature already produces."
+    }
+  },
+  defaultOptions: [{}],
+  create(context, [options]) {
+    const modules = options?.modules ?? [];
+    if (modules.length === 0) {
+      return {};
+    }
+    const scoped = compile2(modules);
+    if (!scoped.some((re) => re.test(context.filename))) {
+      return {};
+    }
+    const methods = new Set(options?.methods ?? DEFAULT_METHODS2);
+    return {
+      CallExpression(node) {
+        const method = storageMethodName(node, methods);
+        if (method !== null) {
+          context.report({
+            node,
+            messageId: "storageInStatelessModule",
+            data: { method }
+          });
+        }
+      }
+    };
+  }
+});
+
 // src/index.ts
 var rules = {
   "enforce-file-structure": enforce_file_structure_default,
@@ -4073,12 +5352,22 @@ var rules = {
   "single-public-export": single_public_export_default,
   "no-silent-promise-catch": no_silent_promise_catch_default,
   "require-fetch-timeout": require_fetch_timeout_default,
-  "require-schema-validate-search": require_schema_validate_search_default
+  "require-schema-validate-search": require_schema_validate_search_default,
+  "no-offset-pagination": no_offset_pagination_default,
+  "no-positional-tuple-return": no_positional_tuple_return_default,
+  "no-repeated-string-literal": no_repeated_string_literal_default,
+  "no-select-star": no_select_star_default,
+  "no-sleep-in-test-body": no_sleep_in_test_body_default,
+  "prefer-constant-time-secret-compare": prefer_constant_time_secret_compare_default,
+  "store-insert-requires-on-conflict": store_insert_requires_on_conflict_default,
+  "no-dynamic-sql": no_dynamic_sql_default,
+  "no-raw-fetch-outside-clients": no_raw_fetch_outside_clients_default,
+  "no-storage-in-stateless-modules": no_storage_in_stateless_modules_default
 };
 var plugin = {
   meta: {
     name: "@sarj/eslint-plugin",
-    version: "2.7.0"
+    version: "2.8.0"
   },
   rules,
   configs: {
@@ -4114,7 +5403,20 @@ var plugin = {
         // Mined from 2y of PR review feedback + 5-repo code-smell audit (2026-07).
         "@sarj/require-fetch-timeout": "warn",
         "@sarj/no-silent-promise-catch": "warn",
-        "@sarj/require-schema-validate-search": "warn"
+        "@sarj/require-schema-validate-search": "warn",
+        // Second SARJ port wave — the TS/Python parity gap. Each targets a
+        // defect class seen in production Workers code: timing-leaky secret
+        // compares, non-idempotent store writes under queue redelivery,
+        // O(N) pagination, implicit row contracts, flaky timed tests.
+        "@sarj/prefer-constant-time-secret-compare": "error",
+        "@sarj/store-insert-requires-on-conflict": "warn",
+        "@sarj/no-offset-pagination": "warn",
+        "@sarj/no-select-star": "warn",
+        "@sarj/no-sleep-in-test-body": "warn",
+        "@sarj/no-repeated-string-literal": "warn",
+        "@sarj/no-positional-tuple-return": "warn",
+        // Injection guard — low FP, applies to any repo touching SQL.
+        "@sarj/no-dynamic-sql": "warn"
       }
     },
     strict: {
@@ -4154,7 +5456,27 @@ var plugin = {
         // Mined from 2y of PR review feedback + 5-repo code-smell audit (2026-07).
         "@sarj/require-fetch-timeout": "error",
         "@sarj/no-silent-promise-catch": "error",
-        "@sarj/require-schema-validate-search": "error"
+        "@sarj/require-schema-validate-search": "error",
+        // Second SARJ port wave — the TS/Python parity gap.
+        "@sarj/prefer-constant-time-secret-compare": "error",
+        "@sarj/store-insert-requires-on-conflict": "error",
+        "@sarj/no-offset-pagination": "error",
+        "@sarj/no-select-star": "error",
+        "@sarj/no-sleep-in-test-body": "error",
+        "@sarj/no-repeated-string-literal": "error",
+        // API-shape advice rather than a runtime defect — a corpus sweep found its
+        // only hits are parser `[value, cursor]` returns, which are conventional.
+        // Warn even in strict until a rollout justifies more.
+        "@sarj/no-positional-tuple-return": "warn",
+        "@sarj/no-dynamic-sql": "error",
+        // Architectural: both need per-repo config to be meaningful, so they
+        // are strict-only. `no-storage-in-stateless-modules` is a no-op until
+        // its `modules` option names the directories a team declared stateless;
+        // `no-raw-fetch-outside-clients` defaults to the `clients/` convention
+        // and takes an `allow` list for repos that lay their client layer out
+        // differently.
+        "@sarj/no-raw-fetch-outside-clients": "error",
+        "@sarj/no-storage-in-stateless-modules": "error"
       }
     }
   }