pumuki 6.3.285 → 6.3.286

package/core/facts/extractHeuristicFacts.ts

@@ -76,6 +76,11 @@ const isBackendTypeScriptPath = (path: string): boolean => {
   return isTypeScriptHeuristicTargetPath(path) && path.startsWith('apps/backend/');
 };
 
+const isBackendControllerTypeScriptPath = (path: string): boolean => {
+  const normalized = path.replace(/\\/g, '/').toLowerCase();
+  return isBackendTypeScriptPath(path) && normalized.endsWith('.controller.ts');
+};
+
 const isBackendDomainEntityPath = (path: string): boolean => {
   const normalized = path.replace(/\\/g, '/').toLowerCase();
   return (
@@ -485,11 +490,18 @@ const astDetectorRegistry: ReadonlyArray<ASTDetectorRegistryEntry> = [
   { detect: TS.hasConsoleLogCall, ruleId: 'heuristics.ts.console-log.ast', code: 'HEURISTICS_CONSOLE_LOG_AST', message: 'AST heuristic detected console.log usage.' },
   { detect: TS.hasConsoleErrorCall, ruleId: 'heuristics.ts.console-error.ast', code: 'HEURISTICS_CONSOLE_ERROR_AST', message: 'AST heuristic detected console.error usage.' },
   { detect: TS.hasSensitiveDataLoggingCall, ruleId: 'heuristics.ts.backend.sensitive-data-logging.ast', code: 'HEURISTICS_BACKEND_SENSITIVE_DATA_LOGGING_AST', message: 'AST heuristic detected sensitive data passed to a logging sink.' },
+  { detect: TS.hasBackendLogWithoutContext, locateLines: TS.findBackendLogWithoutContextLines, ruleId: 'heuristics.ts.backend.log-without-context.ast', code: 'HEURISTICS_BACKEND_LOG_WITHOUT_CONTEXT_AST', message: 'AST heuristic detected backend log call without request/user/trace context.', pathCheck: isBackendTypeScriptPath },
   { detect: TS.hasBackendMagicNumberLiteral, ruleId: 'heuristics.ts.backend.magic-number-literal.ast', code: 'HEURISTICS_BACKEND_MAGIC_NUMBER_LITERAL_AST', message: 'AST heuristic detected an inline numeric literal; use a named constant for backend readability and maintainability.', pathCheck: isBackendTypeScriptPath },
   { detect: TS.hasBackendGenericErrorThrow, ruleId: 'heuristics.ts.backend.generic-error-throw.ast', code: 'HEURISTICS_BACKEND_GENERIC_ERROR_THROW_AST', message: 'AST heuristic detected throw new Error in backend code; use a specific domain/application exception.', pathCheck: isBackendTypeScriptPath },
+  { detect: TS.hasBackendRawThrowExpression, locateLines: TS.findBackendRawThrowExpressionLines, ruleId: 'heuristics.ts.backend.raw-throw-expression.ast', code: 'HEURISTICS_BACKEND_RAW_THROW_EXPRESSION_AST', message: 'AST heuristic detected raw throw expression in backend code; throw a typed exception.', pathCheck: isBackendTypeScriptPath },
   { detect: TS.hasBackendProductionMockOrSpy, ruleId: 'heuristics.ts.backend.production-mock-or-spy.ast', code: 'HEURISTICS_BACKEND_PRODUCTION_MOCK_OR_SPY_AST', message: 'AST heuristic detected mock or spy test primitive in backend production code.', pathCheck: isBackendTypeScriptPath },
   { detect: TS.hasBackendErrorStackInHttpResponse, ruleId: 'heuristics.ts.backend.error-stack-in-http-response.ast', code: 'HEURISTICS_BACKEND_ERROR_STACK_IN_HTTP_RESPONSE_AST', message: 'AST heuristic detected stack trace exposed in a backend HTTP response.', pathCheck: isBackendTypeScriptPath },
+  { detect: TS.hasBackendInconsistentErrorResponse, locateLines: TS.findBackendInconsistentErrorResponseLines, ruleId: 'heuristics.ts.backend.inconsistent-error-response.ast', code: 'HEURISTICS_BACKEND_INCONSISTENT_ERROR_RESPONSE_AST', message: 'AST heuristic detected backend error response without statusCode, message, timestamp and path.', pathCheck: isBackendTypeScriptPath },
+  { detect: TS.hasBackendErrorPayloadWithSuccessStatus, locateLines: TS.findBackendErrorPayloadWithSuccessStatusLines, ruleId: 'heuristics.ts.backend.error-payload-success-status.ast', code: 'HEURISTICS_BACKEND_ERROR_PAYLOAD_SUCCESS_STATUS_AST', message: 'AST heuristic detected backend error payload sent with a success HTTP status.', pathCheck: isBackendTypeScriptPath },
+  { detect: TS.hasBackendControllerEntityResponse, locateLines: TS.findBackendControllerEntityResponseLines, ruleId: 'heuristics.ts.backend.controller-entity-response.ast', code: 'HEURISTICS_BACKEND_CONTROLLER_ENTITY_RESPONSE_AST', message: 'AST heuristic detected backend controller exposing domain entities directly; return DTOs instead.', pathCheck: isBackendControllerTypeScriptPath },
   { detect: TS.hasBackendAnemicDomainModel, ruleId: 'heuristics.ts.backend.anemic-domain-model.ast', code: 'HEURISTICS_BACKEND_ANEMIC_DOMAIN_MODEL_AST', message: 'AST heuristic detected an anemic backend domain entity without business behavior.', pathCheck: isBackendDomainEntityPath },
+  { detect: TS.hasBackendPermissiveCorsConfiguration, locateLines: TS.findBackendPermissiveCorsConfigurationLines, ruleId: 'heuristics.ts.backend.permissive-cors.ast', code: 'HEURISTICS_BACKEND_PERMISSIVE_CORS_AST', message: 'AST heuristic detected permissive backend CORS configuration; restrict allowed origins explicitly.', pathCheck: isBackendTypeScriptPath },
+  { detect: TS.hasBackendStringLiteralUnionEnumCandidate, locateLines: TS.findBackendStringLiteralUnionEnumCandidateLines, ruleId: 'heuristics.ts.backend.string-literal-union-enum.ast', code: 'HEURISTICS_BACKEND_STRING_LITERAL_UNION_ENUM_AST', message: 'AST heuristic detected fixed backend string literal union; use an enum or centralized typed constants.', pathCheck: isBackendTypeScriptPath },
   { detect: TS.hasEvalCall, ruleId: 'heuristics.ts.eval.ast', code: 'HEURISTICS_EVAL_AST', message: 'AST heuristic detected eval usage.' },
   { detect: TS.hasFunctionConstructorUsage, ruleId: 'heuristics.ts.function-constructor.ast', code: 'HEURISTICS_FUNCTION_CONSTRUCTOR_AST', message: 'AST heuristic detected Function constructor usage.' },
   { detect: TS.hasSetTimeoutStringCallback, ruleId: 'heuristics.ts.set-timeout-string.ast', code: 'HEURISTICS_SET_TIMEOUT_STRING_AST', message: 'AST heuristic detected setTimeout with a string callback.' },
@@ -516,6 +528,7 @@ const astDetectorRegistry: ReadonlyArray<ASTDetectorRegistryEntry> = [
   { detect: TS.hasNestJsConstructorDependencyWithoutDecorator, ruleId: 'heuristics.ts.nestjs.constructor-di-without-decorator.ast', code: 'HEURISTICS_NESTJS_CONSTRUCTOR_DI_WITHOUT_DECORATOR_AST', message: 'AST heuristic detected NestJS constructor dependency injection without an explicit class decorator.' },
   { detect: TS.hasBackendControllerRouteWithoutGuard, locateLines: TS.findBackendControllerRouteWithoutGuardLines, ruleId: 'heuristics.ts.backend.controller-route-without-guard.ast', code: 'HEURISTICS_BACKEND_CONTROLLER_ROUTE_WITHOUT_GUARD_AST', message: 'AST heuristic detected NestJS controller route without UseGuards at method or class level.', pathCheck: isBackendTypeScriptPath },
   { detect: TS.hasPersistenceMutationWithoutAuditEvent, ruleId: 'heuristics.ts.backend.persistence-mutation-without-audit-event.ast', code: 'HEURISTICS_BACKEND_PERSISTENCE_MUTATION_WITHOUT_AUDIT_EVENT_AST', message: 'AST heuristic detected backend persistence mutation without audit log or domain event.' },
+  { detect: TS.hasBackendHardDeleteWithoutSoftDelete, locateLines: TS.findBackendHardDeleteWithoutSoftDeleteLines, ruleId: 'heuristics.ts.backend.hard-delete-without-soft-delete.ast', code: 'HEURISTICS_BACKEND_HARD_DELETE_WITHOUT_SOFT_DELETE_AST', message: 'AST heuristic detected backend physical delete; use soft delete with deletedAt/deleted_at.', pathCheck: isBackendTypeScriptPath },
   { detect: TS.hasDtoPropertyWithoutValidation, ruleId: 'heuristics.ts.backend.dto-property-without-validation.ast', code: 'HEURISTICS_BACKEND_DTO_PROPERTY_WITHOUT_VALIDATION_AST', message: 'AST heuristic detected DTO property without class-validator/class-transformer decorator.' },
   { detect: TS.hasDtoNestedPropertyWithoutNestedValidation, ruleId: 'heuristics.ts.backend.dto-nested-property-without-nested-validation.ast', code: 'HEURISTICS_BACKEND_DTO_NESTED_PROPERTY_WITHOUT_NESTED_VALIDATION_AST', message: 'AST heuristic detected nested DTO property without @ValidateNested/@Type decorators.' },
   { detect: TS.hasLargeClassDeclaration, ruleId: 'heuristics.ts.god-class-large-class.ast', code: 'HEURISTICS_GOD_CLASS_LARGE_CLASS_AST', message: 'AST heuristic detected God Class candidate by mixed responsibility nodes in a single class declaration.' },
@@ -728,6 +741,7 @@ const textDetectorRegistry: ReadonlyArray<TextDetectorRegistryEntry> = [
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftUnownedSelfCaptureUsage, ruleId: 'heuristics.ios.memory.unowned-self-capture.ast', code: 'HEURISTICS_IOS_MEMORY_UNOWNED_SELF_CAPTURE_AST', message: 'AST heuristic detected unowned capture in an iOS closure; use weak capture unless lifetime is explicitly guaranteed.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftNestedIfPyramidUsage, ruleId: 'heuristics.ios.maintainability.nested-if-pyramid.ast', code: 'HEURISTICS_IOS_MAINTAINABILITY_NESTED_IF_PYRAMID_AST', message: 'AST heuristic detected nested if pyramid in iOS code; prefer guard clauses and early returns.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftProductionCommentUsage, ruleId: 'heuristics.ios.maintainability.comment-trivia.ast', code: 'HEURISTICS_IOS_MAINTAINABILITY_COMMENT_TRIVIA_AST', message: 'AST heuristic detected source comments in iOS production code; prefer self-documenting names and extracted concepts.' },
+  { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftWarningSuppressionUsage, locateLines: TextIOS.collectSwiftWarningSuppressionLines, primaryNode: (lines) => ({ kind: 'member', name: 'Swift warning or lint suppression directive', lines }), relatedNodes: (lines) => [{ kind: 'member', name: 'replacement: fix the warned code or configure the exception centrally', lines }], why: 'Local warning and lint suppressions hide code-quality failures from the normal compiler/tooling feedback loop.', impact: 'Suppressed diagnostics can turn into future errors or let unsafe production code bypass Pumuki and repository skills without a visible remediation path.', expected_fix: 'Remove local swiftlint/swiftformat/periphery disable directives and #warning markers by fixing the underlying code, or move a justified project-wide exception into policy/config with traceability.', ruleId: 'heuristics.ios.maintainability.warning-suppression.ast', code: 'HEURISTICS_IOS_MAINTAINABILITY_WARNING_SUPPRESSION_AST', message: 'AST heuristic detected local warning/lint suppression in iOS production code; fix the underlying issue instead of hiding diagnostics.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftCustomSingletonUsage, ruleId: 'heuristics.ios.architecture.custom-singleton.ast', code: 'HEURISTICS_IOS_ARCHITECTURE_CUSTOM_SINGLETON_AST', message: 'AST heuristic detected a custom static shared singleton in iOS production code; dependency injection remains the preferred baseline for app-owned services.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftSwinjectUsage, ruleId: 'heuristics.ios.architecture.swinject.ast', code: 'HEURISTICS_IOS_ARCHITECTURE_SWINJECT_AST', message: 'AST heuristic detected Swinject usage; manual dependency injection or SwiftUI Environment remain the preferred native baseline.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftMassiveViewControllerResponsibilityUsage, ruleId: 'heuristics.ios.architecture.massive-view-controller.ast', code: 'HEURISTICS_IOS_ARCHITECTURE_MASSIVE_VIEW_CONTROLLER_AST', message: 'AST heuristic detected a UIViewController with direct infrastructure/data access; move data access behind application/domain boundaries.' },
@@ -744,12 +758,12 @@ const textDetectorRegistry: ReadonlyArray<TextDetectorRegistryEntry> = [
   { platform: 'ios', pathCheck: isIOSInfoPlistPath, excludePaths: [], detect: TextIOS.hasSwiftInsecureTransportUsage, ruleId: 'heuristics.ios.security.insecure-transport.ast', code: 'HEURISTICS_IOS_SECURITY_INSECURE_TRANSPORT_AST', message: 'AST heuristic detected permissive App Transport Security configuration; HTTPS and ATS remain the preferred baseline.' },
   { platform: 'ios', pathCheck: isIOSLocalizableStringsPath, excludePaths: [], detect: detectsTrackedFilePresence, ruleId: 'heuristics.ios.localization.localizable-strings.ast', code: 'HEURISTICS_IOS_LOCALIZATION_LOCALIZABLE_STRINGS_AST', message: 'AST heuristic detected Localizable.strings usage; String Catalogs (.xcstrings) remain the preferred baseline for new localization work.' },
   { platform: 'ios', pathCheck: isIOSInterfaceBuilderPath, excludePaths: [], detect: detectsTrackedFilePresence, ruleId: 'heuristics.ios.interface-builder.storyboard-xib.ast', code: 'HEURISTICS_IOS_INTERFACE_BUILDER_STORYBOARD_XIB_AST', message: 'AST heuristic detected Storyboard/XIB usage; programmatic SwiftUI/UIKit UI remains the preferred baseline for versionable iOS code.' },
-  { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftHardcodedUiStringUsage, ruleId: 'heuristics.ios.localization.hardcoded-ui-string.ast', code: 'HEURISTICS_IOS_LOCALIZATION_HARDCODED_UI_STRING_AST', message: 'AST heuristic detected hardcoded user-facing SwiftUI text; String(localized:) and String Catalogs remain the preferred baseline.' },
+  { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftHardcodedUiStringUsage, locateLines: TextIOS.collectSwiftHardcodedUiStringLines, primaryNode: (lines) => ({ kind: 'property', name: 'hardcoded user-facing SwiftUI string', lines }), relatedNodes: (lines) => [{ kind: 'property', name: 'replacement: String Catalog key or String(localized:)', lines }], why: 'User-facing literals in SwiftUI code bypass String Catalogs and make localization drift invisible.', impact: 'A consumer slice can be blocked without knowing which text literal must move to localization assets.', expected_fix: 'Move visible copy to String Catalogs or use repository-approved localized string keys; keep only localization keys in SwiftUI code.', ruleId: 'heuristics.ios.localization.hardcoded-ui-string.ast', code: 'HEURISTICS_IOS_LOCALIZATION_HARDCODED_UI_STRING_AST', message: 'AST heuristic detected hardcoded user-facing SwiftUI text; String(localized:) and String Catalogs remain the preferred baseline.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftLooseAssetResourceUsage, ruleId: 'heuristics.ios.assets.loose-resource.ast', code: 'HEURISTICS_IOS_ASSETS_LOOSE_RESOURCE_AST', message: 'AST heuristic detected loose image resource loading in iOS production code; Asset Catalogs remain the preferred baseline.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftFixedFontSizeUsage, locateLines: TextIOS.collectSwiftFixedFontSizeLines, primaryNode: (lines) => ({ kind: 'call', name: 'fixed font size API', lines }), relatedNodes: (lines) => [{ kind: 'call', name: 'replacement: Dynamic Type semantic text style or scaled metric', lines }], why: 'Fixed font sizes bypass Dynamic Type unless explicitly scaled through the text system.', impact: 'Accessibility regressions become hard to remediate if the gate reports only the file instead of the exact font call.', expected_fix: 'Use semantic SwiftUI text styles such as .headline/.body, Font.TextStyle, or UIFontMetrics/scaled metrics when a custom size is required.', ruleId: 'heuristics.ios.accessibility.fixed-font-size.ast', code: 'HEURISTICS_IOS_ACCESSIBILITY_FIXED_FONT_SIZE_AST', message: 'AST heuristic detected fixed font sizing in iOS production code; Dynamic Type semantic text styles remain the preferred baseline.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftPhysicalTextAlignmentUsage, ruleId: 'heuristics.ios.localization.physical-text-alignment.ast', code: 'HEURISTICS_IOS_LOCALIZATION_PHYSICAL_TEXT_ALIGNMENT_AST', message: 'AST heuristic detected physical left/right text alignment in iOS production code; leading/trailing remain the preferred RTL-safe baseline.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftMainThreadBlockingSleepUsage, ruleId: 'heuristics.ios.performance.blocking-sleep.ast', code: 'HEURISTICS_IOS_PERFORMANCE_BLOCKING_SLEEP_AST', message: 'AST heuristic detected blocking sleep usage in iOS production code; async clocks, suspension or cancellable scheduling remain the preferred baseline.' },
-  { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftIconOnlyControlWithoutAccessibilityLabelUsage, ruleId: 'heuristics.ios.accessibility.icon-only-control-label.ast', code: 'HEURISTICS_IOS_ACCESSIBILITY_ICON_ONLY_CONTROL_LABEL_AST', message: 'AST heuristic detected an icon-only SwiftUI control without accessibilityLabel; explicit accessible labels remain the preferred baseline.' },
+  { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftIconOnlyControlWithoutAccessibilityLabelUsage, locateLines: TextIOS.collectSwiftIconOnlyControlWithoutAccessibilityLabelLines, primaryNode: (lines) => ({ kind: 'call', name: 'icon-only SwiftUI control', lines }), relatedNodes: (lines) => [{ kind: 'call', name: 'replacement: add accessibilityLabel to the control', lines }], why: 'Icon-only controls have no accessible name unless the label is supplied explicitly.', impact: 'VoiceOver and UI automation users cannot identify or operate the control reliably when the gate reports only the file.', expected_fix: 'Add .accessibilityLabel(...) to the icon-only control or replace the control with a visible text label.', ruleId: 'heuristics.ios.accessibility.icon-only-control-label.ast', code: 'HEURISTICS_IOS_ACCESSIBILITY_ICON_ONLY_CONTROL_LABEL_AST', message: 'AST heuristic detected an icon-only SwiftUI control without accessibilityLabel; explicit accessible labels remain the preferred baseline.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftInteractiveControlWithoutAccessibilityIdentifierUsage, locateLines: TextIOS.collectSwiftInteractiveControlWithoutAccessibilityIdentifierLines, ruleId: 'heuristics.ios.accessibility.missing-accessibility-identifier.ast', code: 'HEURISTICS_IOS_ACCESSIBILITY_MISSING_ACCESSIBILITY_IDENTIFIER_AST', message: 'AST heuristic detected an interactive SwiftUI control without accessibilityIdentifier; stable identifiers are required for UI automation and traceability.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftBindableMissingForObservableBindingUsage, locateLines: TextIOS.collectSwiftBindableMissingForObservableBindingUsageLines, ruleId: 'heuristics.ios.swiftui.missing-bindable-observable-binding.ast', code: 'HEURISTICS_IOS_SWIFTUI_MISSING_BINDABLE_OBSERVABLE_BINDING_AST', message: 'AST heuristic detected an injected @Observable used as a binding without @Bindable.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftUncheckedSendableUsage, ruleId: 'heuristics.ios.unchecked-sendable.ast', code: 'HEURISTICS_IOS_UNCHECKED_SENDABLE_AST', message: 'AST heuristic detected @unchecked Sendable usage.' },
@@ -764,28 +778,28 @@ const textDetectorRegistry: ReadonlyArray<TextDetectorRegistryEntry> = [
   { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftLowContrastStaticColorPairUsage, ruleId: 'heuristics.ios.accessibility.low-contrast-static-color-pair.ast', code: 'HEURISTICS_IOS_ACCESSIBILITY_LOW_CONTRAST_STATIC_COLOR_PAIR_AST', message: 'AST heuristic detected a static SwiftUI foreground/background color pair with insufficient contrast.' },
   { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftNonPrivateStateOwnershipUsage, ruleId: 'heuristics.ios.swiftui.non-private-state-ownership.ast', code: 'HEURISTICS_IOS_SWIFTUI_NON_PRIVATE_STATE_OWNERSHIP_AST', message: 'AST heuristic detected @State/@StateObject without private visibility; SwiftUI owned state should be private.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftPassedValueStateWrapperUsage, ruleId: 'heuristics.ios.passed-value-state-wrapper.ast', code: 'HEURISTICS_IOS_PASSED_VALUE_STATE_WRAPPER_AST', message: 'AST heuristic detected a passed value stored as @State/@StateObject via init wrapper ownership.' },
-  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftForEachIndicesUsage, ruleId: 'heuristics.ios.foreach-indices.ast', code: 'HEURISTICS_IOS_FOREACH_INDICES_AST', message: 'AST heuristic detected ForEach(...indices...) usage where stable element identity may be preferred.' },
-  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftForEachSelfIdentityUsage, ruleId: 'heuristics.ios.swiftui.foreach-self-identity.ast', code: 'HEURISTICS_IOS_SWIFTUI_FOREACH_SELF_IDENTITY_AST', message: 'AST heuristic detected ForEach(..., id: \.self) usage; prefer a stable domain identity such as id: \.id or Identifiable models.' },
+  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftForEachIndicesUsage, locateLines: TextIOS.collectSwiftForEachIndicesLines, primaryNode: (lines) => ({ kind: 'call', name: 'ForEach over collection indices', lines }), relatedNodes: (lines) => [{ kind: 'call', name: 'replacement: ForEach over Identifiable elements or stable ids', lines }], why: 'Iterating indices couples SwiftUI identity to collection position instead of the domain element.', impact: 'Insertions, filtering or reordering can produce unstable view identity and confusing diffing behavior.', expected_fix: 'Iterate elements that conform to Identifiable, or pass an explicit stable id such as id: \\.id.', ruleId: 'heuristics.ios.foreach-indices.ast', code: 'HEURISTICS_IOS_FOREACH_INDICES_AST', message: 'AST heuristic detected ForEach(...indices...) usage where stable element identity may be preferred.' },
+  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftForEachSelfIdentityUsage, locateLines: TextIOS.collectSwiftForEachSelfIdentityLines, primaryNode: (lines) => ({ kind: 'call', name: 'ForEach using id: \\.self', lines }), relatedNodes: (lines) => [{ kind: 'call', name: 'replacement: stable domain id or Identifiable model', lines }], why: 'id: \\.self is only stable when the value is immutable and uniquely identifies the domain entity.', impact: 'Lists can animate or update incorrectly when value identity changes with presentation data.', expected_fix: 'Use Identifiable models or an explicit stable domain identifier such as id: \\.id.', ruleId: 'heuristics.ios.swiftui.foreach-self-identity.ast', code: 'HEURISTICS_IOS_SWIFTUI_FOREACH_SELF_IDENTITY_AST', message: 'AST heuristic detected ForEach(..., id: \\.self) usage; prefer a stable domain identity such as id: \\.id or Identifiable models.' },
   { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftSelfPrintChangesUsage, ruleId: 'heuristics.ios.swiftui.self-print-changes.ast', code: 'HEURISTICS_IOS_SWIFTUI_SELF_PRINT_CHANGES_AST', message: 'AST heuristic detected Self._printChanges() in SwiftUI presentation; keep this debugging helper out of production view code.' },
-  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftInlineForEachTransformUsage, ruleId: 'heuristics.ios.swiftui.inline-foreach-transform.ast', code: 'HEURISTICS_IOS_SWIFTUI_INLINE_FOREACH_TRANSFORM_AST', message: 'AST heuristic detected inline filter/map/sort work inside ForEach; prefiltered or cached collections remain the preferred baseline.' },
-  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftUiForEachConditionalViewCountUsage, ruleId: 'heuristics.ios.swiftui.foreach-conditional-view-count.ast', code: 'HEURISTICS_IOS_SWIFTUI_FOREACH_CONDITIONAL_VIEW_COUNT_AST', message: 'AST heuristic detected conditional view count inside ForEach; keep a constant number of views per element by moving branching into row views or modifiers.' },
+  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftInlineForEachTransformUsage, locateLines: TextIOS.collectSwiftInlineForEachTransformLines, primaryNode: (lines) => ({ kind: 'call', name: 'ForEach with inline collection transform', lines }), relatedNodes: (lines) => [{ kind: 'property', name: 'replacement: precomputed/cached collection', lines }], why: 'Inline filtering, mapping or sorting inside ForEach repeats work in the render path and obscures list identity.', impact: 'SwiftUI list updates become harder to reason about and performance can degrade under recomposition.', expected_fix: 'Move the transformed collection to a named computed value, view model output or cached state before passing it to ForEach.', ruleId: 'heuristics.ios.swiftui.inline-foreach-transform.ast', code: 'HEURISTICS_IOS_SWIFTUI_INLINE_FOREACH_TRANSFORM_AST', message: 'AST heuristic detected inline filter/map/sort work inside ForEach; prefiltered or cached collections remain the preferred baseline.' },
+  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftUiForEachConditionalViewCountUsage, locateLines: TextIOS.collectSwiftUiForEachConditionalViewCountLines, primaryNode: (lines) => ({ kind: 'call', name: 'ForEach row with conditional view count', lines }), relatedNodes: (lines) => [{ kind: 'call', name: 'replacement: row view with stable structure or conditional modifiers', lines }], why: 'Changing the number of views emitted by each ForEach element can destabilize SwiftUI diffing.', impact: 'Rows can lose identity or produce unexpected animations when conditions toggle.', expected_fix: 'Move branching into a dedicated row view or prefer conditional modifiers/values that keep a stable view structure per element.', ruleId: 'heuristics.ios.swiftui.foreach-conditional-view-count.ast', code: 'HEURISTICS_IOS_SWIFTUI_FOREACH_CONDITIONAL_VIEW_COUNT_AST', message: 'AST heuristic detected conditional view count inside ForEach; keep a constant number of views per element by moving branching into row views or modifiers.' },
   { platform: 'ios', pathCheck: isIOSApplicationOrPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftContainsUserFilterUsage, ruleId: 'heuristics.ios.contains-user-filter.ast', code: 'HEURISTICS_IOS_CONTAINS_USER_FILTER_AST', message: 'AST heuristic detected contains() in a user-facing filter where localizedStandardContains() may be preferred.' },
   { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftGeometryReaderUsage, ruleId: 'heuristics.ios.geometryreader.ast', code: 'HEURISTICS_IOS_GEOMETRYREADER_AST', message: 'AST heuristic detected GeometryReader usage that may be replaceable with modern layout APIs.' },
   { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftFontWeightBoldUsage, ruleId: 'heuristics.ios.font-weight-bold.ast', code: 'HEURISTICS_IOS_FONT_WEIGHT_BOLD_AST', message: 'AST heuristic detected fontWeight(.bold) usage where bold() may be preferred.' },
   { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftExplicitColorStaticMemberUsage, locateLines: TextIOS.collectSwiftExplicitColorStaticMemberLines, primaryNode: (lines) => ({ kind: 'member', name: 'explicit Color.* static member', lines }), relatedNodes: (lines) => [{ kind: 'member', name: 'replacement: SwiftUI static member lookup .colorName', lines }], why: 'Explicit Color.* in SwiftUI view modifiers is noisier than static member lookup and can hide style token drift in presentation code.', impact: 'The fix is local and mechanical, but without line evidence the user sees a whole-file block instead of the exact member access.', expected_fix: 'Replace Color.blue/Color.primary/etc. with .blue/.primary in SwiftUI style contexts, or use named asset colors such as Color("BrandPrimary") when design tokens are required.', ruleId: 'heuristics.ios.swiftui.explicit-color-static-member.ast', code: 'HEURISTICS_IOS_SWIFTUI_EXPLICIT_COLOR_STATIC_MEMBER_AST', message: 'AST heuristic detected Color.* static member usage where SwiftUI static member lookup may be preferred.' },
   { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftClosureBasedViewBuilderContentUsage, ruleId: 'heuristics.ios.swiftui.closure-based-viewbuilder-content.ast', code: 'HEURISTICS_IOS_SWIFTUI_CLOSURE_BASED_VIEWBUILDER_CONTENT_AST', message: 'AST heuristic detected closure-based content storage; @ViewBuilder let content: Content remains the preferred SwiftUI container baseline.' },
   { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftLargeConfigContextViewPropertyUsage, ruleId: 'heuristics.ios.swiftui.large-config-context-prop.ast', code: 'HEURISTICS_IOS_SWIFTUI_LARGE_CONFIG_CONTEXT_PROP_AST', message: 'AST heuristic detected a SwiftUI View storing a broad config/context object; pass only needed values to reduce update fan-out.' },
-  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftUiConditionalSameViewIdentityUsage, ruleId: 'heuristics.ios.swiftui.conditional-same-view-identity.ast', code: 'HEURISTICS_IOS_SWIFTUI_CONDITIONAL_SAME_VIEW_IDENTITY_AST', message: 'AST heuristic detected conditional branches rebuilding the same SwiftUI View type; prefer conditional modifiers or values to preserve view identity.' },
+  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftUiConditionalSameViewIdentityUsage, locateLines: TextIOS.collectSwiftUiConditionalSameViewIdentityLines, primaryNode: (lines) => ({ kind: 'call', name: 'conditional branches rebuilding same SwiftUI view type', lines }), relatedNodes: (lines) => [{ kind: 'call', name: 'replacement: conditional modifier or conditional value', lines }], why: 'Rebuilding the same view type in if/else branches hides a state change that should be a modifier or value.', impact: 'SwiftUI identity can churn unnecessarily and block pixel-perfect slices without pointing to the conditional branch.', expected_fix: 'Keep one view instance and move the condition into modifiers, parameters or extracted stable row state.', ruleId: 'heuristics.ios.swiftui.conditional-same-view-identity.ast', code: 'HEURISTICS_IOS_SWIFTUI_CONDITIONAL_SAME_VIEW_IDENTITY_AST', message: 'AST heuristic detected conditional branches rebuilding the same SwiftUI View type; prefer conditional modifiers or values to preserve view identity.' },
   { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftUiParentOwnedSheetActionUsage, ruleId: 'heuristics.ios.swiftui.parent-owned-sheet-action.ast', code: 'HEURISTICS_IOS_SWIFTUI_PARENT_OWNED_SHEET_ACTION_AST', message: 'AST heuristic detected a SwiftUI sheet receiving parent-owned action callbacks; sheets should own save/cancel actions and call dismiss() internally.' },
   { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftRedundantReactiveStateAssignmentUsage, ruleId: 'heuristics.ios.swiftui.redundant-reactive-state-assignment.ast', code: 'HEURISTICS_IOS_SWIFTUI_REDUNDANT_REACTIVE_STATE_ASSIGNMENT_AST', message: 'AST heuristic detected reactive state assignment without a value-change guard; check for value changes before assigning state in hot paths.' },
-  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftNonLazyScrollForEachUsage, ruleId: 'heuristics.ios.swiftui.non-lazy-scroll-foreach.ast', code: 'HEURISTICS_IOS_SWIFTUI_NON_LAZY_SCROLL_FOREACH_AST', message: 'AST heuristic detected ScrollView with a non-lazy stack feeding ForEach; LazyVStack/LazyHStack remain the preferred baseline for large scrollable collections.' },
+  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftNonLazyScrollForEachUsage, locateLines: TextIOS.collectSwiftNonLazyScrollForEachLines, primaryNode: (lines) => ({ kind: 'call', name: 'ScrollView non-lazy stack with ForEach', lines }), relatedNodes: (lines) => [{ kind: 'call', name: 'replacement: LazyVStack or LazyHStack', lines }], why: 'A non-lazy stack inside ScrollView renders all rows eagerly instead of virtualizing collection content.', impact: 'Large lists can degrade performance and the gate must point to the ScrollView/ForEach pair, not the whole file.', expected_fix: 'Replace VStack/HStack under ScrollView with LazyVStack/LazyHStack when rendering collection rows.', ruleId: 'heuristics.ios.swiftui.non-lazy-scroll-foreach.ast', code: 'HEURISTICS_IOS_SWIFTUI_NON_LAZY_SCROLL_FOREACH_AST', message: 'AST heuristic detected ScrollView with a non-lazy stack feeding ForEach; LazyVStack/LazyHStack remain the preferred baseline for large scrollable collections.' },
   { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftViewBodyObjectCreationUsage, ruleId: 'heuristics.ios.swiftui.body-object-creation.ast', code: 'HEURISTICS_IOS_SWIFTUI_BODY_OBJECT_CREATION_AST', message: 'AST heuristic detected formatter object creation inside SwiftUI body; keep body simple and move expensive objects out of render paths.' },
   { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftUiImageDataDecodingUsage, ruleId: 'heuristics.ios.swiftui.image-data-decoding.ast', code: 'HEURISTICS_IOS_SWIFTUI_IMAGE_DATA_DECODING_AST', message: 'AST heuristic detected UIImage(data:) in SwiftUI presentation; downsample image data before rendering large images.' },
-  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftUiInlineActionLogicUsage, ruleId: 'heuristics.ios.swiftui.inline-action-logic.ast', code: 'HEURISTICS_IOS_SWIFTUI_INLINE_ACTION_LOGIC_AST', message: 'AST heuristic detected inline logic inside a SwiftUI action handler; action handlers should reference methods and keep view declarations focused.' },
+  { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftUiInlineActionLogicUsage, locateLines: TextIOS.collectSwiftUiInlineActionLogicLines, primaryNode: (lines) => ({ kind: 'call', name: 'SwiftUI Button action with inline logic', lines }), relatedNodes: (lines) => [{ kind: 'call', name: 'replacement: extracted action method', lines }], why: 'Inline branching or async work in a SwiftUI action makes the view declaration own behavior instead of delegating to a named action.', impact: 'Reviewers and agents cannot remediate a blocked view safely when the finding lacks the exact Button action node.', expected_fix: 'Extract the action body to a named method or view model command and reference that method from Button.', ruleId: 'heuristics.ios.swiftui.inline-action-logic.ast', code: 'HEURISTICS_IOS_SWIFTUI_INLINE_ACTION_LOGIC_AST', message: 'AST heuristic detected inline logic inside a SwiftUI action handler; action handlers should reference methods and keep view declarations focused.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftNavigationViewUsage, ruleId: 'heuristics.ios.navigation-view.ast', code: 'HEURISTICS_IOS_NAVIGATION_VIEW_AST', message: 'AST heuristic detected NavigationView usage.' },
   { platform: 'ios', pathCheck: isIOSPresentationPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftUntypedNavigationLinkDestinationUsage, ruleId: 'heuristics.ios.swiftui.untyped-navigation-link-destination.ast', code: 'HEURISTICS_IOS_SWIFTUI_UNTYPED_NAVIGATION_LINK_DESTINATION_AST', message: 'AST heuristic detected untyped NavigationLink destination usage; prefer NavigationLink(value:) with navigationDestination(for:) for type-safe navigation.' },
-  { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftForegroundColorUsage, ruleId: 'heuristics.ios.foreground-color.ast', code: 'HEURISTICS_IOS_FOREGROUND_COLOR_AST', message: 'AST heuristic detected foregroundColor usage.' },
-  { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftCornerRadiusUsage, ruleId: 'heuristics.ios.corner-radius.ast', code: 'HEURISTICS_IOS_CORNER_RADIUS_AST', message: 'AST heuristic detected cornerRadius usage.' },
+  { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftForegroundColorUsage, locateLines: TextIOS.collectSwiftForegroundColorLines, primaryNode: (lines) => ({ kind: 'call', name: 'SwiftUI foregroundColor modifier', lines }), relatedNodes: (lines) => [{ kind: 'call', name: 'replacement: foregroundStyle or design token', lines }], why: 'foregroundColor is a legacy SwiftUI styling API compared with foregroundStyle and tokenized style values.', impact: 'Modernization blockers need the exact modifier line to avoid whole-file refactors.', expected_fix: 'Replace .foregroundColor(...) with .foregroundStyle(...) or the repository-approved design token style.', ruleId: 'heuristics.ios.foreground-color.ast', code: 'HEURISTICS_IOS_FOREGROUND_COLOR_AST', message: 'AST heuristic detected foregroundColor usage.' },
+  { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftCornerRadiusUsage, locateLines: TextIOS.collectSwiftCornerRadiusLines, primaryNode: (lines) => ({ kind: 'call', name: 'SwiftUI cornerRadius modifier', lines }), relatedNodes: (lines) => [{ kind: 'call', name: 'replacement: clipShape with rounded rectangle style', lines }], why: 'cornerRadius is a legacy shape shortcut that hides the shape semantics used by modern SwiftUI styling.', impact: 'The fix is local, but without line evidence the gate forces unsafe file-wide remediation.', expected_fix: 'Replace .cornerRadius(...) with .clipShape(.rect(cornerRadius: ...)) or a named reusable shape/style token.', ruleId: 'heuristics.ios.corner-radius.ast', code: 'HEURISTICS_IOS_CORNER_RADIUS_AST', message: 'AST heuristic detected cornerRadius usage.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftTabItemUsage, ruleId: 'heuristics.ios.tab-item.ast', code: 'HEURISTICS_IOS_TAB_ITEM_AST', message: 'AST heuristic detected tabItem usage.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftOnTapGestureUsage, ruleId: 'heuristics.ios.on-tap-gesture.ast', code: 'HEURISTICS_IOS_ON_TAP_GESTURE_AST', message: 'AST heuristic detected onTapGesture usage where Button may be preferred.' },
   { platform: 'ios', pathCheck: isIOSSwiftPath, excludePaths: [isSwiftTestPath], detect: TextIOS.hasSwiftStringFormatUsage, ruleId: 'heuristics.ios.string-format.ast', code: 'HEURISTICS_IOS_STRING_FORMAT_AST', message: 'AST heuristic detected String(format:) usage.' },

package/core/rules/presets/heuristics/ios.test.ts

@@ -3,7 +3,7 @@ import test from 'node:test';
 import { iosRules } from './ios';
 
 test('iosRules define reglas heurísticas locked para plataforma ios', () => {
-  assert.equal(iosRules.length, 102);
+  assert.equal(iosRules.length, 103);
 
   const ids = iosRules.map((rule) => rule.id);
   assert.deepEqual(ids, [
@@ -29,6 +29,7 @@ test('iosRules define reglas heurísticas locked para plataforma ios', () => {
     'heuristics.ios.memory.unowned-self-capture.ast',
     'heuristics.ios.maintainability.nested-if-pyramid.ast',
     'heuristics.ios.maintainability.comment-trivia.ast',
+    'heuristics.ios.maintainability.warning-suppression.ast',
     'heuristics.ios.architecture.custom-singleton.ast',
     'heuristics.ios.architecture.swinject.ast',
     'heuristics.ios.architecture.massive-view-controller.ast',
@@ -148,6 +149,10 @@ test('iosRules define reglas heurísticas locked para plataforma ios', () => {
     byId.get('heuristics.ios.maintainability.comment-trivia.ast')?.then.code,
     'HEURISTICS_IOS_MAINTAINABILITY_COMMENT_TRIVIA_AST'
   );
+  assert.equal(
+    byId.get('heuristics.ios.maintainability.warning-suppression.ast')?.then.code,
+    'HEURISTICS_IOS_MAINTAINABILITY_WARNING_SUPPRESSION_AST'
+  );
   assert.equal(
     byId.get('heuristics.ios.swiftui.onchange-task.ast')?.then.code,
     'HEURISTICS_IOS_SWIFTUI_ONCHANGE_TASK_AST'

package/core/rules/presets/heuristics/ios.ts

@@ -407,6 +407,25 @@ export const iosRules: RuleSet = [
       code: 'HEURISTICS_IOS_MAINTAINABILITY_COMMENT_TRIVIA_AST',
     },
   },
+  {
+    id: 'heuristics.ios.maintainability.warning-suppression.ast',
+    description: 'Detects local warning or lint suppression directives in iOS production Swift code.',
+    severity: 'WARN',
+    platform: 'ios',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ios.maintainability.warning-suppression.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message:
+        'AST heuristic detected local warning/lint suppression in iOS production code; fix the underlying issue instead of hiding diagnostics.',
+      code: 'HEURISTICS_IOS_MAINTAINABILITY_WARNING_SUPPRESSION_AST',
+    },
+  },
   {
     id: 'heuristics.ios.architecture.custom-singleton.ast',
     description: 'Detects custom static shared singletons in iOS production code.',

package/core/rules/presets/heuristics/typescript.test.ts

@@ -3,7 +3,7 @@ import test from 'node:test';
 import { typescriptRules } from './typescript';
 
 test('typescriptRules define reglas heurísticas locked para plataforma generic', () => {
-  assert.equal(typescriptRules.length, 39);
+  assert.equal(typescriptRules.length, 47);
 
   const ids = typescriptRules.map((rule) => rule.id);
   assert.deepEqual(ids, [
@@ -12,11 +12,18 @@ test('typescriptRules define reglas heurísticas locked para plataforma generic'
     'heuristics.ts.console-log.ast',
     'heuristics.ts.console-error.ast',
     'heuristics.ts.backend.sensitive-data-logging.ast',
+    'heuristics.ts.backend.log-without-context.ast',
     'heuristics.ts.backend.magic-number-literal.ast',
     'heuristics.ts.backend.generic-error-throw.ast',
+    'heuristics.ts.backend.raw-throw-expression.ast',
     'heuristics.ts.backend.production-mock-or-spy.ast',
     'heuristics.ts.backend.error-stack-in-http-response.ast',
+    'heuristics.ts.backend.inconsistent-error-response.ast',
+    'heuristics.ts.backend.error-payload-success-status.ast',
+    'heuristics.ts.backend.controller-entity-response.ast',
     'heuristics.ts.backend.anemic-domain-model.ast',
+    'heuristics.ts.backend.permissive-cors.ast',
+    'heuristics.ts.backend.string-literal-union-enum.ast',
     'heuristics.ts.eval.ast',
     'heuristics.ts.function-constructor.ast',
     'heuristics.ts.set-timeout-string.ast',
@@ -43,6 +50,7 @@ test('typescriptRules define reglas heurísticas locked para plataforma generic'
     'heuristics.ts.nestjs.constructor-di-without-decorator.ast',
     'heuristics.ts.backend.controller-route-without-guard.ast',
     'heuristics.ts.backend.persistence-mutation-without-audit-event.ast',
+    'heuristics.ts.backend.hard-delete-without-soft-delete.ast',
     'heuristics.ts.backend.dto-property-without-validation.ast',
     'heuristics.ts.backend.dto-nested-property-without-nested-validation.ast',
     'heuristics.ts.god-class-large-class.ast',
@@ -85,6 +93,10 @@ test('typescriptRules define reglas heurísticas locked para plataforma generic'
     byId.get('heuristics.ts.backend.sensitive-data-logging.ast')?.then.code,
     'HEURISTICS_BACKEND_SENSITIVE_DATA_LOGGING_AST'
   );
+  assert.equal(
+    byId.get('heuristics.ts.backend.log-without-context.ast')?.then.code,
+    'HEURISTICS_BACKEND_LOG_WITHOUT_CONTEXT_AST'
+  );
   assert.equal(
     byId.get('heuristics.ts.backend.magic-number-literal.ast')?.then.code,
     'HEURISTICS_BACKEND_MAGIC_NUMBER_LITERAL_AST'
@@ -93,6 +105,10 @@ test('typescriptRules define reglas heurísticas locked para plataforma generic'
     byId.get('heuristics.ts.backend.generic-error-throw.ast')?.then.code,
     'HEURISTICS_BACKEND_GENERIC_ERROR_THROW_AST'
   );
+  assert.equal(
+    byId.get('heuristics.ts.backend.raw-throw-expression.ast')?.then.code,
+    'HEURISTICS_BACKEND_RAW_THROW_EXPRESSION_AST'
+  );
   assert.equal(
     byId.get('heuristics.ts.backend.production-mock-or-spy.ast')?.then.code,
     'HEURISTICS_BACKEND_PRODUCTION_MOCK_OR_SPY_AST'
@@ -101,10 +117,30 @@ test('typescriptRules define reglas heurísticas locked para plataforma generic'
     byId.get('heuristics.ts.backend.error-stack-in-http-response.ast')?.then.code,
     'HEURISTICS_BACKEND_ERROR_STACK_IN_HTTP_RESPONSE_AST'
   );
+  assert.equal(
+    byId.get('heuristics.ts.backend.inconsistent-error-response.ast')?.then.code,
+    'HEURISTICS_BACKEND_INCONSISTENT_ERROR_RESPONSE_AST'
+  );
+  assert.equal(
+    byId.get('heuristics.ts.backend.error-payload-success-status.ast')?.then.code,
+    'HEURISTICS_BACKEND_ERROR_PAYLOAD_SUCCESS_STATUS_AST'
+  );
+  assert.equal(
+    byId.get('heuristics.ts.backend.controller-entity-response.ast')?.then.code,
+    'HEURISTICS_BACKEND_CONTROLLER_ENTITY_RESPONSE_AST'
+  );
   assert.equal(
     byId.get('heuristics.ts.backend.anemic-domain-model.ast')?.then.code,
     'HEURISTICS_BACKEND_ANEMIC_DOMAIN_MODEL_AST'
   );
+  assert.equal(
+    byId.get('heuristics.ts.backend.permissive-cors.ast')?.then.code,
+    'HEURISTICS_BACKEND_PERMISSIVE_CORS_AST'
+  );
+  assert.equal(
+    byId.get('heuristics.ts.backend.string-literal-union-enum.ast')?.then.code,
+    'HEURISTICS_BACKEND_STRING_LITERAL_UNION_ENUM_AST'
+  );
   assert.equal(
     byId.get('heuristics.ts.frontend-test-direct-network-call.ast')?.then.code,
     'HEURISTICS_FRONTEND_TEST_DIRECT_NETWORK_CALL_AST'
@@ -137,6 +173,10 @@ test('typescriptRules define reglas heurísticas locked para plataforma generic'
     byId.get('heuristics.ts.backend.persistence-mutation-without-audit-event.ast')?.then.code,
     'HEURISTICS_BACKEND_PERSISTENCE_MUTATION_WITHOUT_AUDIT_EVENT_AST'
   );
+  assert.equal(
+    byId.get('heuristics.ts.backend.hard-delete-without-soft-delete.ast')?.then.code,
+    'HEURISTICS_BACKEND_HARD_DELETE_WITHOUT_SOFT_DELETE_AST'
+  );
   assert.equal(
     byId.get('heuristics.ts.backend.dto-property-without-validation.ast')?.then.code,
     'HEURISTICS_BACKEND_DTO_PROPERTY_WITHOUT_VALIDATION_AST'
@@ -156,14 +196,22 @@ test('typescriptRules define reglas heurísticas locked para plataforma generic'
       rule.id === 'heuristics.ts.god-class-large-class.ast' ||
       rule.id === 'heuristics.ts.backend.controller-route-without-guard.ast' ||
       rule.id === 'heuristics.ts.backend.persistence-mutation-without-audit-event.ast' ||
+      rule.id === 'heuristics.ts.backend.hard-delete-without-soft-delete.ast' ||
       rule.id === 'heuristics.ts.backend.dto-property-without-validation.ast' ||
       rule.id === 'heuristics.ts.backend.dto-nested-property-without-nested-validation.ast' ||
       rule.id === 'heuristics.ts.backend.sensitive-data-logging.ast' ||
+      rule.id === 'heuristics.ts.backend.log-without-context.ast' ||
       rule.id === 'heuristics.ts.backend.magic-number-literal.ast' ||
       rule.id === 'heuristics.ts.backend.generic-error-throw.ast' ||
+      rule.id === 'heuristics.ts.backend.raw-throw-expression.ast' ||
       rule.id === 'heuristics.ts.backend.production-mock-or-spy.ast' ||
       rule.id === 'heuristics.ts.backend.error-stack-in-http-response.ast' ||
+      rule.id === 'heuristics.ts.backend.inconsistent-error-response.ast' ||
+      rule.id === 'heuristics.ts.backend.error-payload-success-status.ast' ||
+      rule.id === 'heuristics.ts.backend.controller-entity-response.ast' ||
       rule.id === 'heuristics.ts.backend.anemic-domain-model.ast' ||
+      rule.id === 'heuristics.ts.backend.permissive-cors.ast' ||
+      rule.id === 'heuristics.ts.backend.string-literal-union-enum.ast' ||
       rule.id === 'heuristics.ts.sensitive-token-in-url.ast'
     ) {
       assert.equal(rule.severity, 'ERROR');

package/core/rules/presets/heuristics/typescript.ts

@@ -91,6 +91,24 @@ export const typescriptRules: RuleSet = [
       code: 'HEURISTICS_BACKEND_SENSITIVE_DATA_LOGGING_AST',
     },
   },
+  {
+    id: 'heuristics.ts.backend.log-without-context.ast',
+    description: 'Detects backend logger calls that omit request, user or trace context.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.backend.log-without-context.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected backend log call without request/user/trace context.',
+      code: 'HEURISTICS_BACKEND_LOG_WITHOUT_CONTEXT_AST',
+    },
+  },
   {
     id: 'heuristics.ts.backend.magic-number-literal.ast',
     description: 'Detects inline numeric literals in backend TypeScript code.',
@@ -127,6 +145,24 @@ export const typescriptRules: RuleSet = [
       code: 'HEURISTICS_BACKEND_GENERIC_ERROR_THROW_AST',
     },
   },
+  {
+    id: 'heuristics.ts.backend.raw-throw-expression.ast',
+    description: 'Detects backend throw statements that throw raw literals, objects, or identifiers instead of typed exceptions.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.backend.raw-throw-expression.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected raw throw expression in backend code; throw a typed exception.',
+      code: 'HEURISTICS_BACKEND_RAW_THROW_EXPRESSION_AST',
+    },
+  },
   {
     id: 'heuristics.ts.backend.production-mock-or-spy.ast',
     description: 'Detects mock or spy test primitives in backend production TypeScript code.',
@@ -163,6 +199,60 @@ export const typescriptRules: RuleSet = [
       code: 'HEURISTICS_BACKEND_ERROR_STACK_IN_HTTP_RESPONSE_AST',
     },
   },
+  {
+    id: 'heuristics.ts.backend.inconsistent-error-response.ast',
+    description: 'Detects backend error responses that do not expose the consistent statusCode/message/timestamp/path contract.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.backend.inconsistent-error-response.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected inconsistent backend error response contract.',
+      code: 'HEURISTICS_BACKEND_INCONSISTENT_ERROR_RESPONSE_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.backend.error-payload-success-status.ast',
+    description: 'Detects backend error payloads sent with success HTTP status codes.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.backend.error-payload-success-status.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected backend error payload sent with a success HTTP status.',
+      code: 'HEURISTICS_BACKEND_ERROR_PAYLOAD_SUCCESS_STATUS_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.backend.controller-entity-response.ast',
+    description: 'Detects backend controllers that expose domain entities directly instead of response DTOs.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.backend.controller-entity-response.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected backend controller exposing domain entities directly.',
+      code: 'HEURISTICS_BACKEND_CONTROLLER_ENTITY_RESPONSE_AST',
+    },
+  },
   {
     id: 'heuristics.ts.backend.anemic-domain-model.ast',
     description: 'Detects backend domain entities that expose state without business behavior.',
@@ -181,6 +271,42 @@ export const typescriptRules: RuleSet = [
       code: 'HEURISTICS_BACKEND_ANEMIC_DOMAIN_MODEL_AST',
     },
   },
+  {
+    id: 'heuristics.ts.backend.permissive-cors.ast',
+    description: 'Detects permissive backend CORS configuration in NestJS/Express bootstrap code.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.backend.permissive-cors.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected permissive backend CORS configuration.',
+      code: 'HEURISTICS_BACKEND_PERMISSIVE_CORS_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.backend.string-literal-union-enum.ast',
+    description: 'Detects backend fixed string literal unions that should be represented as enums or centralized typed constants.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.backend.string-literal-union-enum.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected a backend fixed string literal union; use an enum or centralized typed constants.',
+      code: 'HEURISTICS_BACKEND_STRING_LITERAL_UNION_ENUM_AST',
+    },
+  },
   {
     id: 'heuristics.ts.eval.ast',
     description: 'Detects eval invocations in TypeScript/TSX production files.',
@@ -658,6 +784,24 @@ export const typescriptRules: RuleSet = [
       code: 'HEURISTICS_BACKEND_PERSISTENCE_MUTATION_WITHOUT_AUDIT_EVENT_AST',
     },
   },
+  {
+    id: 'heuristics.ts.backend.hard-delete-without-soft-delete.ast',
+    description: 'Detects backend physical delete calls where soft delete with deletedAt/deleted_at should be used.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.backend.hard-delete-without-soft-delete.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected backend physical delete; use soft delete with deletedAt/deleted_at.',
+      code: 'HEURISTICS_BACKEND_HARD_DELETE_WITHOUT_SOFT_DELETE_AST',
+    },
+  },
   {
     id: 'heuristics.ts.backend.dto-property-without-validation.ast',
     description:

package/integrations/config/skillsDetectorRegistry.ts

@@ -122,6 +122,10 @@ const registryByRuleId: Record<string, SkillsDetectorBinding> = {
     'ios.maintainability.comment-trivia',
     ['heuristics.ios.maintainability.comment-trivia.ast']
   ),
+  'skills.ios.guideline.ios.ignoring-warnings-warnings-errores-futuros': heuristicDetector(
+    'ios.maintainability.warning-suppression',
+    ['heuristics.ios.maintainability.warning-suppression.ast']
+  ),
   'skills.ios.guideline.ios.no-singleton-usar-inyeccio-n-de-dependencias-no-compartir-instancias-g': heuristicDetector(
     'ios.architecture.custom-singleton',
     ['heuristics.ios.architecture.custom-singleton.ast']
@@ -777,6 +781,14 @@ const registryByRuleId: Record<string, SkillsDetectorBinding> = {
     heuristicDetector('typescript.backend.persistence-mutation-without-audit-event', [
       'heuristics.ts.backend.persistence-mutation-without-audit-event.ast',
     ]),
+  'skills.backend.guideline.backend.soft-deletes-deletedat-en-lugar-de-delete-fi-sico':
+    heuristicDetector('typescript.backend.hard-delete-without-soft-delete', [
+      'heuristics.ts.backend.hard-delete-without-soft-delete.ast',
+    ]),
+  'skills.backend.guideline.backend.soft-deletes-por-defecto-deletedat-column':
+    heuristicDetector('typescript.backend.hard-delete-without-soft-delete', [
+      'heuristics.ts.backend.hard-delete-without-soft-delete.ast',
+    ]),
   'skills.backend.guideline.backend.class-validator-decorators-isstring-isemail-min-max':
     heuristicDetector('typescript.backend.dto-property-without-validation', [
       'heuristics.ts.backend.dto-property-without-validation.ast',
@@ -837,6 +849,14 @@ const registryByRuleId: Record<string, SkillsDetectorBinding> = {
     heuristicDetector('typescript.backend.sensitive-data-logging', [
       'heuristics.ts.backend.sensitive-data-logging.ast',
     ]),
+  'skills.backend.guideline.backend.contexto-en-logs-userid-requestid-traceid':
+    heuristicDetector('typescript.backend.log-without-context', [
+      'heuristics.ts.backend.log-without-context.ast',
+    ]),
+  'skills.backend.guideline.backend.loggear-errores-con-contexto-completo':
+    heuristicDetector('typescript.backend.log-without-context', [
+      'heuristics.ts.backend.log-without-context.ast',
+    ]),
   'skills.backend.guideline.backend.magic-numbers-usar-constantes-con-nombres-descriptivos':
     heuristicDetector('typescript.backend.magic-number-literal', [
       'heuristics.ts.backend.magic-number-literal.ast',
@@ -848,6 +868,7 @@ const registryByRuleId: Record<string, SkillsDetectorBinding> = {
   'skills.backend.guideline.backend.custom-exceptions-validationexception-notfoundexception-unauthorizedex':
     heuristicDetector('typescript.backend.generic-error-throw', [
       'heuristics.ts.backend.generic-error-throw.ast',
+      'heuristics.ts.backend.raw-throw-expression.ast',
     ]),
   'skills.backend.guideline.backend.mocks-en-produccio-n-solo-datos-reales':
     heuristicDetector('typescript.backend.production-mock-or-spy', [
@@ -861,10 +882,38 @@ const registryByRuleId: Record<string, SkillsDetectorBinding> = {
     heuristicDetector('typescript.backend.error-stack-in-http-response', [
       'heuristics.ts.backend.error-stack-in-http-response.ast',
     ]),
+  'skills.backend.guideline.backend.error-responses-consistentes-statuscode-message-timestamp-path':
+    heuristicDetector('typescript.backend.inconsistent-error-response', [
+      'heuristics.ts.backend.inconsistent-error-response.ast',
+    ]),
+  'skills.backend.guideline.backend.http-status-codes-apropiados-200-201-400-401-403-404-500':
+    heuristicDetector('typescript.backend.error-payload-success-status', [
+      'heuristics.ts.backend.error-payload-success-status.ast',
+    ]),
+  'skills.backend.guideline.backend.http-status-codes-sema-ntica-correcta':
+    heuristicDetector('typescript.backend.error-payload-success-status', [
+      'heuristics.ts.backend.error-payload-success-status.ast',
+    ]),
+  'skills.backend.guideline.backend.retornar-dtos-no-exponer-entidades-directamente':
+    heuristicDetector('typescript.backend.controller-entity-response', [
+      'heuristics.ts.backend.controller-entity-response.ast',
+    ]),
   'skills.backend.guideline.backend.anemic-domain-models-entidades-solo-con-getters-setters':
     heuristicDetector('typescript.backend.anemic-domain-model', [
       'heuristics.ts.backend.anemic-domain-model.ast',
     ]),
+  'skills.backend.guideline.backend.cors-configurado-solo-ori-genes-permitidos':
+    heuristicDetector('typescript.backend.permissive-cors', [
+      'heuristics.ts.backend.permissive-cors.ast',
+    ]),
+  'skills.backend.guideline.backend.cors-configurar-ori-genes-permitidos':
+    heuristicDetector('typescript.backend.permissive-cors', [
+      'heuristics.ts.backend.permissive-cors.ast',
+    ]),
+  'skills.backend.guideline.backend.enums-para-valores-fijos-orderstatus-paymentmethod-incidenttype':
+    heuristicDetector('typescript.backend.string-literal-union-enum', [
+      'heuristics.ts.backend.string-literal-union-enum.ast',
+    ]),
   'skills.backend.guideline.backend.password-hashing-bcrypt-con-salt-rounds-10':
     heuristicDetector('typescript.bcrypt-weak-salt-rounds', [
       'heuristics.ts.bcrypt-weak-salt-rounds.ast',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pumuki",
-  "version": "6.3.285",
+  "version": "6.3.286",
   "description": "Enterprise-grade AST Intelligence System with multi-platform support (iOS, Android, Backend, Frontend) and Feature-First + DDD + Clean Architecture enforcement. Includes dynamic violations API for intelligent querying.",
   "main": "index.js",
   "bin": {