@ttsc/lint 0.13.1 → 0.14.0-dev.20250530.1

package/src/structures/rules/ITtscLintRegexpRules.ts

@@ -0,0 +1,204 @@
+import type { TtscLintRuleSetting } from "../TtscLintRuleSetting";
+
+/**
+ * Regular-expression rules from `eslint-plugin-regexp`.
+ *
+ * These rules check the structure of regex literals — emptiness, uselessness,
+ * flag ordering, shorthand classes, Unicode support.
+ *
+ * Some rules duplicate (and supersede) the regex-related rules in
+ * {@link ITtscLintCoreRules}; both ids exist so projects can keep the legacy
+ * ESLint names alongside the regexp-plugin variants.
+ *
+ * @reference https://github.com/ota-meshi/eslint-plugin-regexp
+ */
+export interface ITtscLintRegexpRules {
+  /**
+   * Reject ASCII control characters in regex literals. Alias of the bare core
+   * check.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-control-character.html
+   */
+  "regexp/no-control-character"?: TtscLintRuleSetting;
+
+  /**
+   * Reject duplicate literal characters inside simple regex character classes
+   * (`/[aa]/`).
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-dupe-characters-character-class.html
+   */
+  "regexp/no-dupe-characters-character-class"?: TtscLintRuleSetting;
+
+  /**
+   * Reject empty alternatives in a disjunction (`/a||b/`), which silently match
+   * the empty string.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-empty-alternative.html
+   */
+  "regexp/no-empty-alternative"?: TtscLintRuleSetting;
+
+  /**
+   * Reject empty capturing groups such as `/()/`.
+   *
+   * The group shifts the numbering of every later backreference and capture
+   * slot while only ever capturing the empty string — almost always a leftover
+   * from an unfinished edit.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-empty-capturing-group.html
+   */
+  "regexp/no-empty-capturing-group"?: TtscLintRuleSetting;
+
+  /**
+   * Reject empty regex character classes (`[]`). Alias of the bare core check.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-empty-character-class.html
+   */
+  "regexp/no-empty-character-class"?: TtscLintRuleSetting;
+
+  /**
+   * Reject empty non-capturing groups such as `/(?:)/`.
+   *
+   * The group contributes nothing to the match and is virtually always a
+   * leftover from a deleted inner pattern.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-empty-group.html
+   */
+  "regexp/no-empty-group"?: TtscLintRuleSetting;
+
+  /**
+   * Reject empty lookaround assertions such as `/(?=)/` or `/(?!)/`.
+   *
+   * An empty positive lookaround always matches; an empty negative lookaround
+   * never matches. The assertion either collapses to a no-op or breaks the
+   * surrounding pattern.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-empty-lookarounds-assertion.html
+   */
+  "regexp/no-empty-lookarounds-assertion"?: TtscLintRuleSetting;
+
+  /**
+   * Reject misleading Unicode characters in regex classes. Alias of the bare
+   * misleading-character check.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-misleading-unicode-character.html
+   */
+  "regexp/no-misleading-unicode-character"?: TtscLintRuleSetting;
+
+  /**
+   * Reject single-character character classes such as `/[x]/` — `/x/` is
+   * equivalent.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-useless-character-class.html
+   */
+  "regexp/no-useless-character-class"?: TtscLintRuleSetting;
+
+  /**
+   * Reject unnecessary escapes inside regex literals. Alias of core
+   * `no-useless-escape` for regex contexts.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-useless-escape.html
+   */
+  "regexp/no-useless-escape"?: TtscLintRuleSetting;
+
+  /**
+   * Reject regex flags that the literal does not exercise — `i` on a pattern
+   * without case-variable characters, `m` without `^`/`$`, `s` without `.`, and
+   * similar dead flags on `g`/`y`.
+   *
+   * Cleans up flag combos that suggest behavior the pattern can never trigger.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-useless-flag.html
+   */
+  "regexp/no-useless-flag"?: TtscLintRuleSetting;
+
+  /**
+   * Reject quantifiers that do not change the match — constant-one counts
+   * (`/a{1}/`), `?` on patterns already matching the empty string
+   * (`/(?:a+|b*)?/`), and quantifiers on non-consuming atoms (`/(?:\b)+/`).
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-useless-quantifier.html
+   */
+  "regexp/no-useless-quantifier"?: TtscLintRuleSetting;
+
+  /**
+   * Reject equal min/max quantifiers (`/a{2,2}/`) in favor of `/a{2}/`.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-useless-two-nums-quantifier.html
+   */
+  "regexp/no-useless-two-nums-quantifier"?: TtscLintRuleSetting;
+
+  /**
+   * Reject zero-repeat quantifiers (`/a{0}/`, `/a{0,0}/`) — the atom never
+   * matches, so the quantifier is either dead code or a typo for `{1,…}`.
+   *
+   * The fix is normally to delete the atom or correct the upper bound.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-zero-quantifier.html
+   */
+  "regexp/no-zero-quantifier"?: TtscLintRuleSetting;
+
+  /**
+   * Prefer `\d` over `[0-9]` in regex literals.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/prefer-d.html
+   */
+  "regexp/prefer-d"?: TtscLintRuleSetting;
+
+  /**
+   * Prefer `+` over `{1,}` in regex literals.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/prefer-plus-quantifier.html
+   */
+  "regexp/prefer-plus-quantifier"?: TtscLintRuleSetting;
+
+  /**
+   * Prefer `?` over `{0,1}` in regex literals.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/prefer-question-quantifier.html
+   */
+  "regexp/prefer-question-quantifier"?: TtscLintRuleSetting;
+
+  /**
+   * Prefer `*` over `{0,}` in regex literals.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/prefer-star-quantifier.html
+   */
+  "regexp/prefer-star-quantifier"?: TtscLintRuleSetting;
+
+  /**
+   * Prefer `\w` over `[A-Za-z0-9_]` in regex literals.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/prefer-w.html
+   */
+  "regexp/prefer-w"?: TtscLintRuleSetting;
+
+  /**
+   * Require regex literals to use the `u` or `v` flag, so Unicode-property
+   * escapes and surrogate-pair handling stay predictable.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/require-unicode-regexp.html
+   */
+  "regexp/require-unicode-regexp"?: TtscLintRuleSetting;
+
+  /**
+   * Require regex literals to use the `v` flag specifically — the stricter
+   * Unicode-sets mode that enables set notation, string properties, and
+   * stricter escape rules on top of `u`.
+   *
+   * Choose this over `require-unicode-regexp` only on engines that ship
+   * ES2024-era regex.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/require-unicode-sets-regexp.html
+   */
+  "regexp/require-unicode-sets-regexp"?: TtscLintRuleSetting;
+
+  /**
+   * Require regex flags to appear in canonical alphabetical order (`dgimsuvy`).
+   *
+   * Stable ordering keeps diffs small and lets readers compare flag sets at a
+   * glance.
+   *
+   * @reference https://ota-meshi.github.io/eslint-plugin-regexp/rules/sort-flags.html
+   */
+  "regexp/sort-flags"?: TtscLintRuleSetting;
+}

package/src/structures/rules/ITtscLintRuleOptionsMap.ts

@@ -0,0 +1,88 @@
+import type {
+  ITtscLintBoundariesDependenciesRuleOptions,
+  ITtscLintBoundariesElementTypesRuleOptions,
+  ITtscLintBoundariesEntryPointRuleOptions,
+  ITtscLintBoundariesExternalRuleOptions,
+  ITtscLintBoundariesNoPrivateRuleOptions,
+  ITtscLintBoundariesNoUnknownRuleOptions,
+} from "./ITtscLintBoundariesRuleOptions";
+import type { ITtscLintCypressUnsafeToChainCommandRuleOptions } from "./ITtscLintCypressRuleOptions";
+import type {
+  ITtscLintFunctionalEmptyRuleOptions,
+  ITtscLintFunctionalImmutableDataRuleOptions,
+  ITtscLintFunctionalNoConditionalStatementsRuleOptions,
+  ITtscLintFunctionalNoLetRuleOptions,
+  ITtscLintFunctionalNoMixedTypesRuleOptions,
+  ITtscLintFunctionalNoReturnVoidRuleOptions,
+  ITtscLintFunctionalNoThrowStatementsRuleOptions,
+  ITtscLintFunctionalNoTryStatementsRuleOptions,
+  ITtscLintFunctionalParametersRuleOptions,
+  ITtscLintFunctionalPreferImmutableTypesRuleOptions,
+  ITtscLintFunctionalPreferReadonlyTypeRuleOptions,
+  ITtscLintFunctionalPreferTacitRuleOptions,
+  ITtscLintFunctionalReadonlyTypeRuleOptions,
+  ITtscLintFunctionalTypeDeclarationImmutabilityRuleOptions,
+} from "./ITtscLintFunctionalRuleOptions";
+import type { ITtscLintReactPerfRuleOptions } from "./ITtscLintReactPerfRuleOptions";
+import type { ITtscLintReactOnlyExportComponentsRuleOptions } from "./ITtscLintReactRuleOptions";
+import type { ITtscLintStorybookNoUninstalledAddonsRuleOptions } from "./ITtscLintStorybookRuleOptions";
+import type { ITtscLintTestingLibraryConsistentDataTestIdRuleOptions } from "./ITtscLintTestingLibraryRuleOptions";
+
+/**
+ * Index from typed rule name to its options object.
+ *
+ * Built-in rule families with configurable options are listed here. Contributor
+ * plugins extend the map by augmenting it from their own package:
+ *
+ * ```ts
+ * declare module "@ttsc/lint" {
+ *   interface ITtscLintRuleOptionsMap {
+ *     "demo/no-marker-comment": { marker: string };
+ *   }
+ * }
+ * ```
+ *
+ * After augmentation, `{@link TtscLintRuleOptionsSetting}` tuples and the
+ * `defineConfig`-style helpers in plugin packages can type-check the options
+ * object against the contributor's declared shape.
+ *
+ * `format/*` is **not** listed: formatter behavior is configured through the
+ * top-level `format` block ({@link ITtscLintFormat}), not through the `rules`
+ * surface.
+ */
+export interface ITtscLintRuleOptionsMap {
+  "testing-library/consistent-data-testid": ITtscLintTestingLibraryConsistentDataTestIdRuleOptions;
+  "functional/functional-parameters": ITtscLintFunctionalParametersRuleOptions;
+  "functional/immutable-data": ITtscLintFunctionalImmutableDataRuleOptions;
+  "functional/no-class-inheritance": ITtscLintFunctionalEmptyRuleOptions;
+  "functional/no-classes": ITtscLintFunctionalEmptyRuleOptions;
+  "functional/no-conditional-statements": ITtscLintFunctionalNoConditionalStatementsRuleOptions;
+  "functional/no-expression-statements": ITtscLintFunctionalEmptyRuleOptions;
+  "functional/no-let": ITtscLintFunctionalNoLetRuleOptions;
+  "functional/no-loop-statements": ITtscLintFunctionalEmptyRuleOptions;
+  "functional/no-mixed-types": ITtscLintFunctionalNoMixedTypesRuleOptions;
+  "functional/no-promise-reject": ITtscLintFunctionalEmptyRuleOptions;
+  "functional/no-return-void": ITtscLintFunctionalNoReturnVoidRuleOptions;
+  "functional/no-this-expressions": ITtscLintFunctionalEmptyRuleOptions;
+  "functional/no-throw-statements": ITtscLintFunctionalNoThrowStatementsRuleOptions;
+  "functional/no-try-statements": ITtscLintFunctionalNoTryStatementsRuleOptions;
+  "functional/prefer-immutable-types": ITtscLintFunctionalPreferImmutableTypesRuleOptions;
+  "functional/prefer-property-signatures": ITtscLintFunctionalEmptyRuleOptions;
+  "functional/prefer-readonly-type": ITtscLintFunctionalPreferReadonlyTypeRuleOptions;
+  "functional/prefer-tacit": ITtscLintFunctionalPreferTacitRuleOptions;
+  "functional/readonly-type": ITtscLintFunctionalReadonlyTypeRuleOptions;
+  "functional/type-declaration-immutability": ITtscLintFunctionalTypeDeclarationImmutabilityRuleOptions;
+  "cypress/unsafe-to-chain-command": ITtscLintCypressUnsafeToChainCommandRuleOptions;
+  "boundaries/dependencies": ITtscLintBoundariesDependenciesRuleOptions;
+  "boundaries/element-types": ITtscLintBoundariesElementTypesRuleOptions;
+  "boundaries/entry-point": ITtscLintBoundariesEntryPointRuleOptions;
+  "boundaries/external": ITtscLintBoundariesExternalRuleOptions;
+  "boundaries/no-private": ITtscLintBoundariesNoPrivateRuleOptions;
+  "boundaries/no-unknown": ITtscLintBoundariesNoUnknownRuleOptions;
+  "react-perf/jsx-no-new-array-as-prop": ITtscLintReactPerfRuleOptions;
+  "react-perf/jsx-no-new-function-as-prop": ITtscLintReactPerfRuleOptions;
+  "react-perf/jsx-no-new-object-as-prop": ITtscLintReactPerfRuleOptions;
+  "react-perf/jsx-no-jsx-as-prop": ITtscLintReactPerfRuleOptions;
+  "storybook/no-uninstalled-addons": ITtscLintStorybookNoUninstalledAddonsRuleOptions;
+  "react/only-export-components": ITtscLintReactOnlyExportComponentsRuleOptions;
+}

package/src/structures/rules/ITtscLintRules.ts

@@ -0,0 +1,77 @@
+import type { ITtscLintBoundariesRules } from "./ITtscLintBoundariesRules";
+import type { ITtscLintContributorRules } from "./ITtscLintContributorRules";
+import type { ITtscLintCoreRules } from "./ITtscLintCoreRules";
+import type { ITtscLintCypressRules } from "./ITtscLintCypressRules";
+import type { ITtscLintFunctionalRules } from "./ITtscLintFunctionalRules";
+import type { ITtscLintJestRules } from "./ITtscLintJestRules";
+import type { ITtscLintJsdocRules } from "./ITtscLintJsdocRules";
+import type { ITtscLintJsxA11yRules } from "./ITtscLintJsxA11yRules";
+import type { ITtscLintNextjsRules } from "./ITtscLintNextjsRules";
+import type { ITtscLintPlaywrightRules } from "./ITtscLintPlaywrightRules";
+import type { ITtscLintPromiseRules } from "./ITtscLintPromiseRules";
+import type { ITtscLintReactPerfRules } from "./ITtscLintReactPerfRules";
+import type { ITtscLintReactRules } from "./ITtscLintReactRules";
+import type { ITtscLintRegexpRules } from "./ITtscLintRegexpRules";
+import type { ITtscLintSecurityRules } from "./ITtscLintSecurityRules";
+import type { ITtscLintSolidRules } from "./ITtscLintSolidRules";
+import type { ITtscLintStorybookRules } from "./ITtscLintStorybookRules";
+import type { ITtscLintTanstackQueryRules } from "./ITtscLintTanstackQueryRules";
+import type { ITtscLintTestingLibraryRules } from "./ITtscLintTestingLibraryRules";
+import type { ITtscLintTypeScriptRules } from "./ITtscLintTypeScriptRules";
+import type { ITtscLintUnicornRules } from "./ITtscLintUnicornRules";
+import type { ITtscLintVitestRules } from "./ITtscLintVitestRules";
+
+/**
+ * Rule severity map accepted by `ITtscLintConfig.rules`.
+ *
+ * Built-in rule families are exposed as separate interfaces under this
+ * directory so users can import a narrow family type when composing configs.
+ * `ITtscLintRules` is the intersection of every built-in family plus the
+ * open-ended contributor plugin signature.
+ *
+ * Rule id conventions:
+ *
+ * - Bare kebab-case ids (`eqeqeq`, `no-console`) belong to
+ *   {@link ITtscLintCoreRules} — generic ESLint-compatible rules that apply to
+ *   both JS and TS source.
+ * - `typescript/*` ids belong to {@link ITtscLintTypeScriptRules} —
+ *   TypeScript-only and `@typescript-eslint` plugin rules. `@ttsc/lint` does
+ *   not accept legacy bare names or `@typescript-eslint/*` aliases for these
+ *   rules.
+ * - `react/*` ids in {@link ITtscLintReactRules} bundle `eslint-plugin-react`,
+ *   `eslint-plugin-react-hooks`, and `eslint-plugin-react-refresh`.
+ *   Performance-only React rules live separately in
+ *   {@link ITtscLintReactPerfRules} because they are opt-in toggles rather than
+ *   correctness checks (matching Oxlint).
+ * - Every other namespaced id (`boundaries/*`, `cypress/*`, `functional/*`, ...)
+ *   is a built-in family with a matching interface in this directory.
+ * - Formatter behavior is **not** configured here. Use the top-level `format`
+ *   block (typed as `ITtscLintFormat`); `format/*` is an internal
+ *   implementation detail of `ttsc format` and is deliberately absent from the
+ *   public rules surface.
+ * - Any other `"<namespace>/<rule>"` key is accepted via
+ *   {@link ITtscLintContributorRules} so plugin-shipped rules compose cleanly
+ *   without ambient module augmentation.
+ */
+export type ITtscLintRules = ITtscLintCoreRules &
+  ITtscLintTypeScriptRules &
+  ITtscLintBoundariesRules &
+  ITtscLintCypressRules &
+  ITtscLintFunctionalRules &
+  ITtscLintJestRules &
+  ITtscLintJsdocRules &
+  ITtscLintJsxA11yRules &
+  ITtscLintNextjsRules &
+  ITtscLintPlaywrightRules &
+  ITtscLintPromiseRules &
+  ITtscLintReactRules &
+  ITtscLintReactPerfRules &
+  ITtscLintRegexpRules &
+  ITtscLintSecurityRules &
+  ITtscLintSolidRules &
+  ITtscLintStorybookRules &
+  ITtscLintTanstackQueryRules &
+  ITtscLintTestingLibraryRules &
+  ITtscLintUnicornRules &
+  ITtscLintVitestRules &
+  ITtscLintContributorRules;

package/src/structures/rules/ITtscLintSecurityRules.ts

@@ -0,0 +1,155 @@
+import type { TtscLintRuleSetting } from "../TtscLintRuleSetting";
+
+/**
+ * Security-focused TypeScript source rules from `eslint-plugin-security`.
+ *
+ * Reports likely security smells — non-literal sinks for eval, file I/O, regex
+ * construction, child-process spawning, cryptographic primitives — that warrant
+ * human review even if no exploit is statically provable.
+ *
+ * Treat findings as _hints_, not proofs.
+ *
+ * @reference https://github.com/eslint-community/eslint-plugin-security
+ */
+export interface ITtscLintSecurityRules {
+  /**
+   * Detect Trojan-Source bidi control characters (U+202A, U+202E, ...) hidden
+   * inside source.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-bidi-characters.md
+   */
+  "security/detect-bidi-characters"?: TtscLintRuleSetting;
+
+  /**
+   * Detect Buffer reads/writes called with `noAssert = true`, which skips
+   * Node's offset/length bounds checks.
+   *
+   * The flag lets the offset slide past the buffer end and read unrelated
+   * memory, so production code should never set it.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-buffer-noassert.md
+   */
+  "security/detect-buffer-noassert"?: TtscLintRuleSetting;
+
+  /**
+   * Detect any import of `child_process` and any `exec`/`execSync` call whose
+   * command argument is not a string literal.
+   *
+   * Non-literal commands are the canonical shell-injection sink in Node
+   * services.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-child-process.md
+   */
+  "security/detect-child-process"?: TtscLintRuleSetting;
+
+  /**
+   * Detect assignments setting `escapeMarkup = false` (or the equivalent option
+   * on Handlebars/Mustache-style engines), which turns off HTML entity escaping
+   * in template output.
+   *
+   * Result: an unguarded XSS sink for caller-controlled strings.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-disable-mustache-escape.md
+   */
+  "security/detect-disable-mustache-escape"?: TtscLintRuleSetting;
+
+  /**
+   * Detect `eval(...)` calls whose argument is not a string literal.
+   *
+   * Any expression argument means caller-controlled data can reach a
+   * code-execution sink. The rule flags the call shape, not proven taint.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-eval-with-expression.md
+   */
+  "security/detect-eval-with-expression"?: TtscLintRuleSetting;
+
+  /**
+   * Detect `new Buffer(input)` constructions with non-literal input —
+   * historical source of allocation-disclosure bugs.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-new-buffer.md
+   */
+  "security/detect-new-buffer"?: TtscLintRuleSetting;
+
+  /**
+   * Detect Express applications mounting `csrf` middleware before
+   * `methodOverride`, which lets the CSRF token be bypassed.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-no-csrf-before-method-override.md
+   */
+  "security/detect-no-csrf-before-method-override"?: TtscLintRuleSetting;
+
+  /**
+   * Detect `fs` calls (`readFile`, `writeFile`, `createReadStream`, ...) whose
+   * filename argument is not a string literal.
+   *
+   * Dynamic filenames are the standard path-traversal sink; sanitise or
+   * allow-list before the call.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-non-literal-fs-filename.md
+   */
+  "security/detect-non-literal-fs-filename"?: TtscLintRuleSetting;
+
+  /**
+   * Detect `new RegExp(...)` construction whose pattern argument is not a
+   * string literal.
+   *
+   * Caller-controlled patterns can both trigger catastrophic backtracking and
+   * let an attacker reshape the matcher to bypass intended validation.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-non-literal-regexp.md
+   */
+  "security/detect-non-literal-regexp"?: TtscLintRuleSetting;
+
+  /**
+   * Detect `require(...)` calls whose specifier is computed at runtime.
+   *
+   * A dynamic specifier lets caller-controlled data choose the module to load,
+   * bypassing any module allow-list on Node.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-non-literal-require.md
+   */
+  "security/detect-non-literal-require"?: TtscLintRuleSetting;
+
+  /**
+   * Detect dynamic bracket-access such as `obj[req.body.x] = ...`, which can
+   * let caller-controlled keys overwrite prototype-shaped properties or pull
+   * out unintended fields.
+   *
+   * Fires on virtually any computed property access; expect a high
+   * false-positive rate in normal application code.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-object-injection.md
+   */
+  "security/detect-object-injection"?: TtscLintRuleSetting;
+
+  /**
+   * Detect direct equality comparisons involving secret-like identifiers (`if
+   * (token === expected)`) — use `crypto.timingSafeEqual` instead.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-possible-timing-attacks.md
+   */
+  "security/detect-possible-timing-attacks"?: TtscLintRuleSetting;
+
+  /**
+   * Detect `crypto.pseudoRandomBytes`, which produces values that are not
+   * cryptographically secure.
+   *
+   * Tokens, session ids, and key material must use `crypto.randomBytes` (or Web
+   * Crypto's `getRandomValues`) instead.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-pseudoRandomBytes.md
+   */
+  "security/detect-pseudoRandomBytes"?: TtscLintRuleSetting;
+
+  /**
+   * Detect regex literals with catastrophic backtracking potential (ReDoS) —
+   * typically nested or overlapping quantifiers over the same character set.
+   *
+   * Matching caller-controlled input against such a pattern can block the event
+   * loop for seconds.
+   *
+   * @reference https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-unsafe-regex.md
+   */
+  "security/detect-unsafe-regex"?: TtscLintRuleSetting;
+}