@amityco/social-plus-vise 0.4.0 → 0.8.0

package/dist/tools/project.js

@@ -1,6 +1,7 @@
 import { access, readdir, readFile } from "node:fs/promises";
 import path from "node:path";
 import { objectInput, optionalStringField, stringField, textResult } from "../types.js";
+import { findCallExpressions, parse, pickObjectProperty, resolveLiteralValue, stripComments } from "./ast.js";
 async function exists(filePath) {
     try {
         await access(filePath);
@@ -71,7 +72,13 @@ async function inspectRoot(root) {
             reason: "react-native dependency or script signal",
         });
     }
-    const platforms = Array.from(new Set(signals.map((signal) => signal.platform)));
+    // When react-native is detected alongside generic typescript signals, prefer react-native
+    // so that platform-specific rules (react-native.*) are used for init/check/run-sensors.
+    const rawPlatforms = Array.from(new Set(signals.map((signal) => signal.platform)));
+    const hasRN = rawPlatforms.includes("react-native");
+    const platforms = hasRN
+        ? ["react-native", ...rawPlatforms.filter((p) => p !== "react-native" && p !== "typescript")]
+        : rawPlatforms;
     return { platforms, signals, designSignals: await detectDesignSignals(root) };
 }
 export const inspectProjectTool = {
@@ -206,12 +213,42 @@ async function validateAndroid(root) {
     if (pushRegistrationFiles.length > 0 && pushUnregisterFiles.length === 0) {
         findings.push(finding("android.push.unregister.present", "warning", "Push registration was found but no obvious unregister call was detected.", relativeFile(root, pushRegistrationFiles[0]), "Unregister device tokens on logout or user switch so notifications are not sent to the wrong user."));
     }
+    // Android push payload: if onMessageReceived exists, require push-specific SDK forwarding
+    const androidPayloadFiles = filesMatching(sourceContent, [/onMessageReceived/, /FirebaseMessagingService/]);
+    if (androidPayloadFiles.length > 0 && !containsAny(sourceContent, [/AmityPush/, /handlePushNotification/, /didReceiveAmityNotification/, /EkoPushNotification/, /amityPushMessaging/, /registerDeviceForPush/, /handleAmityPush/])) {
+        findings.push(finding("android.push.payload-contract-respected", "warning", "Push payload handler (onMessageReceived) exists but no social.plus push forwarding call was detected.", relativeFile(root, androidPayloadFiles[0]), "Forward incoming FCM payloads to the social.plus SDK push handler (e.g. AmityPush.handleNotification) so social notifications are routed correctly."));
+    }
     if (liveDataFiles.length > 0 && !containsAny(sourceContent, [/dispose\s*\(/, /Disposable/, /CompositeDisposable/, /clear\s*\(/, /removeObserver/, /unsubscribe/])) {
         findings.push(finding("android.live.cleanup", "warning", "Live Object/Collection observation was found but no obvious cleanup was detected.", relativeFile(root, liveDataFiles[0]), "Dispose or unsubscribe observers when the Activity, Fragment, ViewModel, or composable lifecycle ends."));
     }
     findings.push(...validateLiteralGuardrails(root, "android", sourceContent));
     findings.push(...validateLoggingHygiene(root, "android", sourceContent));
     findings.push(...validateFeedUiStates(root, "android", sourceContent));
+    findings.push(...validateFeedPagination(root, "android", sourceContent));
+    findings.push(...validateFeedModerationAffordance(root, "android", sourceContent));
+    findings.push(...validateLogoutOnUserSwitch(root, "android", sourceContent));
+    findings.push(...validateNoAnonymousWrite(root, "android", sourceContent));
+    findings.push(...validateErrorHandling(root, "android", sourceContent));
+    findings.push(...validateComments(root, "android", sourceContent));
+    findings.push(...validateModeration(root, "android", sourceContent));
+    findings.push(...validateLiveCollectionApiMismatch(root, "android", sourceContent));
+    findings.push(...validatePostsStatusFilter(root, "android", sourceContent));
+    findings.push(...validatePaginationCursorOpaque(root, "android", sourceContent));
+    findings.push(...validatePostsParentChild(root, "android", sourceContent));
+    findings.push(...validateFeedTargetTypeExplicit(root, "android", sourceContent));
+    findings.push(...validateChannelTypeMatchesShape(root, "android", sourceContent));
+    findings.push(...validateReactionConfiguredNameUsed(root, "android", sourceContent));
+    findings.push(...validateCustomPostTypeDataTypeDeclared(root, "android", sourceContent));
+    findings.push(...validateModerationRoleGatedAction(root, "android", sourceContent));
+    findings.push(...validateFlagCountNotLeaked(root, "android", sourceContent));
+    findings.push(...validateUserBanStateRespected(root, "android", sourceContent));
+    findings.push(...validateNotificationsPreferencesConfigured(root, "android", sourceContent));
+    findings.push(...validateUnreadSubscribedNotCounted(root, "android", sourceContent));
+    findings.push(...validateFileUploadViaAmityFileClient(root, "android", sourceContent));
+    findings.push(...validateImagePostChildResolutionAwaited(root, "android", sourceContent));
+    findings.push(...validateCommentReferenceTypeEnum(root, "android", sourceContent));
+    findings.push(...validateSessionHandlerRetention(root, "android", sourceContent));
+    findings.push(...validateChat(root, "android", sourceContent));
     findings.push(...(await validateDesignReuse(root, "android", sourceContent)));
     return findings;
 }
@@ -254,12 +291,42 @@ async function validateFlutter(root) {
     if (pushRegistrationFiles.length > 0 && pushUnregisterFiles.length === 0) {
         findings.push(finding("flutter.push.unregister.present", "warning", "Push registration was found but no obvious unregister call was detected.", relativeFile(root, pushRegistrationFiles[0]), "Unregister device tokens on logout or user switch so notifications are not sent to the wrong user."));
     }
+    // Flutter push payload: if FirebaseMessaging.onMessage/onBackgroundMessage exists, require push-specific SDK forwarding
+    const flutterPayloadFiles = filesMatching(dartContent, [/FirebaseMessaging\.onMessage/, /onBackgroundMessage/, /FirebaseMessaging\.instance/]);
+    if (flutterPayloadFiles.length > 0 && !containsAny(dartContent, [/AmityPush/, /handlePushNotification/, /didReceiveAmityNotification/, /EkoPushNotification/, /amityPushMessaging/, /registerDeviceForPush/, /handleAmityPush/])) {
+        findings.push(finding("flutter.push.payload-contract-respected", "warning", "Push payload handler (FirebaseMessaging) exists but no social.plus push forwarding call was detected.", relativeFile(root, flutterPayloadFiles[0]), "Forward incoming Firebase push payloads to the social.plus SDK push handler (e.g. AmityPush.handleNotification) so social notifications are routed correctly."));
+    }
     if (liveDataFiles.length > 0 && !containsAny(dartContent, [/StreamSubscription/, /\.cancel\s*\(/, /dispose\s*\(/])) {
         findings.push(finding("flutter.live.cleanup", "warning", "Live Object/Collection stream observation was found but no obvious cleanup was detected.", relativeFile(root, liveDataFiles[0]), "Store the subscription and cancel it from dispose or the owning lifecycle cleanup."));
     }
     findings.push(...validateLiteralGuardrails(root, "flutter", dartContent));
     findings.push(...validateLoggingHygiene(root, "flutter", dartContent));
     findings.push(...validateFeedUiStates(root, "flutter", dartContent));
+    findings.push(...validateFeedPagination(root, "flutter", dartContent));
+    findings.push(...validateFeedModerationAffordance(root, "flutter", dartContent));
+    findings.push(...validateLogoutOnUserSwitch(root, "flutter", dartContent));
+    findings.push(...validateNoAnonymousWrite(root, "flutter", dartContent));
+    findings.push(...validateErrorHandling(root, "flutter", dartContent));
+    findings.push(...validateComments(root, "flutter", dartContent));
+    findings.push(...validateModeration(root, "flutter", dartContent));
+    findings.push(...validateLiveCollectionApiMismatch(root, "flutter", dartContent));
+    findings.push(...validatePostsStatusFilter(root, "flutter", dartContent));
+    findings.push(...validatePaginationCursorOpaque(root, "flutter", dartContent));
+    findings.push(...validatePostsParentChild(root, "flutter", dartContent));
+    findings.push(...validateFeedTargetTypeExplicit(root, "flutter", dartContent));
+    findings.push(...validateChannelTypeMatchesShape(root, "flutter", dartContent));
+    findings.push(...validateReactionConfiguredNameUsed(root, "flutter", dartContent));
+    findings.push(...validateCustomPostTypeDataTypeDeclared(root, "flutter", dartContent));
+    findings.push(...validateModerationRoleGatedAction(root, "flutter", dartContent));
+    findings.push(...validateFlagCountNotLeaked(root, "flutter", dartContent));
+    findings.push(...validateUserBanStateRespected(root, "flutter", dartContent));
+    findings.push(...validateNotificationsPreferencesConfigured(root, "flutter", dartContent));
+    findings.push(...validateUnreadSubscribedNotCounted(root, "flutter", dartContent));
+    findings.push(...validateFileUploadViaAmityFileClient(root, "flutter", dartContent));
+    findings.push(...validateImagePostChildResolutionAwaited(root, "flutter", dartContent));
+    findings.push(...validateCommentReferenceTypeEnum(root, "flutter", dartContent));
+    findings.push(...validateSessionHandlerRetention(root, "flutter", dartContent));
+    findings.push(...validateChat(root, "flutter", dartContent));
     findings.push(...(await validateDesignReuse(root, "flutter", dartContent)));
     return findings;
 }
@@ -286,7 +353,17 @@ async function validateTypeScript(root, platform) {
         findings.push(finding("typescript.client.create", "warning", "No obvious TypeScript client initialization pattern was found.", undefined, "Create the social.plus client before login and before API usage."));
     }
     else {
-        if (!containsAnyForFiles(sourceContent, setupFiles, [/\bregion\s*:/, /\bapiRegion\b/, /\bapiEndpoint\b/])) {
+        // Region detection accepts three idioms:
+        //   (a) keyword-arg style:  createClient({ region: 'sg' })  /  apiRegion / apiEndpoint
+        //   (b) positional with a named variable:  const region = ...; createClient(apiKey, region)
+        //   (c) env-sourced region declared anywhere in the codebase:
+        //        process.env.<*REGION*> | <*ENDPOINT*>, including NEXT_PUBLIC_, EXPO_PUBLIC_,
+        //        VITE_ prefixes; also import.meta.env.<*REGION*> for Vite/Astro.
+        // Any one of these is sufficient evidence the integration is region-aware.
+        const setupHasKeywordRegion = containsAnyForFiles(sourceContent, setupFiles, [/\bregion\s*:/, /\bapiRegion\b/, /\bapiEndpoint\b/]);
+        const setupHasNamedRegionDecl = containsAnyForFiles(sourceContent, setupFiles, [/\bconst\s+(region|apiRegion|endpoint|apiEndpoint)\b/, /\blet\s+(region|apiRegion|endpoint|apiEndpoint)\b/]);
+        const projectHasEnvRegion = containsAny(sourceContent, [/process\.env\.[A-Z0-9_]*(?:REGION|ENDPOINT)[A-Z0-9_]*/, /import\.meta\.env\.[A-Z0-9_]*(?:REGION|ENDPOINT)[A-Z0-9_]*/]);
+        if (!setupHasKeywordRegion && !setupHasNamedRegionDecl && !projectHasEnvRegion) {
             findings.push(finding("typescript.client.region", "warning", "Client initialization was found but no explicit region or endpoint marker was detected.", relativeFile(root, setupFiles[0]), "Pass the region or endpoint that matches the customer's social.plus console project."));
         }
         const renderCycleSetup = setupFiles.find((file) => /useEffect|function\s+[A-Z]\w*\s*\(|const\s+[A-Z]\w*\s*=/.test(sourceContent.get(file) ?? ""));
@@ -309,6 +386,31 @@ async function validateTypeScript(root, platform) {
     findings.push(...validateLiteralGuardrails(root, platform, sourceContent));
     findings.push(...validateLoggingHygiene(root, platform, sourceContent));
     findings.push(...validateFeedUiStates(root, platform, sourceContent));
+    findings.push(...validateFeedPagination(root, platform, sourceContent));
+    findings.push(...validateFeedModerationAffordance(root, platform, sourceContent));
+    findings.push(...validateLogoutOnUserSwitch(root, platform, sourceContent));
+    findings.push(...validateNoAnonymousWrite(root, platform, sourceContent));
+    findings.push(...validateErrorHandling(root, platform, sourceContent));
+    findings.push(...validateComments(root, platform, sourceContent));
+    findings.push(...validateModeration(root, platform, sourceContent));
+    findings.push(...validateLiveCollectionApiMismatch(root, platform, sourceContent));
+    findings.push(...validatePostsStatusFilter(root, platform, sourceContent));
+    findings.push(...validatePaginationCursorOpaque(root, platform, sourceContent));
+    findings.push(...validatePostsParentChild(root, platform, sourceContent));
+    findings.push(...validateFeedTargetTypeExplicit(root, platform, sourceContent));
+    findings.push(...validateChannelTypeMatchesShape(root, platform, sourceContent));
+    findings.push(...validateReactionConfiguredNameUsed(root, platform, sourceContent));
+    findings.push(...validateCustomPostTypeDataTypeDeclared(root, platform, sourceContent));
+    findings.push(...validateModerationRoleGatedAction(root, platform, sourceContent));
+    findings.push(...validateFlagCountNotLeaked(root, platform, sourceContent));
+    findings.push(...validateUserBanStateRespected(root, platform, sourceContent));
+    findings.push(...validateNotificationsPreferencesConfigured(root, platform, sourceContent));
+    findings.push(...validateUnreadSubscribedNotCounted(root, platform, sourceContent));
+    findings.push(...validateFileUploadViaAmityFileClient(root, platform, sourceContent));
+    findings.push(...validateImagePostChildResolutionAwaited(root, platform, sourceContent));
+    findings.push(...validateCommentReferenceTypeEnum(root, platform, sourceContent));
+    findings.push(...validateSessionHandlerRetention(root, platform, sourceContent));
+    findings.push(...validateChat(root, platform, sourceContent));
     findings.push(...(await validateDesignReuse(root, platform, sourceContent)));
     if (platform === "typescript") {
         findings.push(...(await validateTypeScriptEnvSecretHygiene(root, sourceContent)));
@@ -343,26 +445,31 @@ function validateLoggingHygiene(root, platform, sourceContent) {
         return [];
     }
     const secretShape = /\b(api[_-]?key|api[_-]?secret|access[_-]?token|refresh[_-]?token|bearer[_-]?token|client[_-]?secret|secret[_-]?key)\b/i;
+    const piiShape = /\b(user[_-]?name|display[_-]?name|full[_-]?name|email|phone|phone[_-]?number|address|date[_-]?of[_-]?birth|dob|ssn|national[_-]?id)\b/i;
+    const findings = [];
     for (const [file, content] of sourceContent) {
         for (const line of content.split(/\r?\n/)) {
             if (!logCallPattern.test(line)) {
                 continue;
             }
-            if (!secretShape.test(line)) {
-                continue;
-            }
             // Allow commented-out lines (//, #, /*); rough but kills the obvious
             // false positives like documentation snippets.
             const trimmed = line.trimStart();
             if (trimmed.startsWith("//") || trimmed.startsWith("#") || trimmed.startsWith("*") || trimmed.startsWith("/*")) {
                 continue;
             }
-            return [
-                finding(`${platform}.logging.no-secret-in-log`, "warning", "A logging call appears to reference a secret-shaped identifier (apiKey, accessToken, etc.).", relativeFile(root, file), "Do not log secret-shaped values. Drop the log line, redact the value, or attest that the value being logged is a placeholder."),
-            ];
+            if (secretShape.test(line) && !findings.some((f) => f.ruleId === `${platform}.logging.no-secret-in-log`)) {
+                findings.push(finding(`${platform}.logging.no-secret-in-log`, "warning", "A logging call appears to reference a secret-shaped identifier (apiKey, accessToken, etc.).", relativeFile(root, file), "Do not log secret-shaped values. Drop the log line, redact the value, or attest that the value being logged is a placeholder."));
+            }
+            if (piiShape.test(line) && !findings.some((f) => f.ruleId === `${platform}.logging.no-pii-in-log`)) {
+                findings.push(finding(`${platform}.logging.no-pii-in-log`, "warning", "A logging call appears to reference a PII-shaped identifier (userName, email, phone, displayName, etc.).", relativeFile(root, file), "Do not log user PII. Redact the value, use an anonymized ID, or attest that the data is not real user PII."));
+            }
+            if (findings.length >= 2) {
+                return findings;
+            }
         }
     }
-    return [];
+    return findings;
 }
 // Design system reuse: when the project has detected theme / token / design-
 // system files (via detectDesignSignals), at least one other source file
@@ -390,20 +497,71 @@ async function validateDesignReuse(root, platform, sourceContent) {
     }
     // Resolve design file absolute paths so we can skip them when scanning.
     const designAbsolutePaths = new Set(designSignals.map((signal) => path.resolve(root, signal.file)));
+    // Implicit theme-provider reuse patterns. Idiomatic UI on most platforms
+    // pulls tokens from an ambient theme context (Theme.of in Flutter, useTheme
+    // in MUI/Chakra, MaterialTheme.colorScheme in Compose, UIColor.systemBlue
+    // dynamic colors in iOS). These reuse the design system without importing
+    // the file that declared the theme — the cross-file marker heuristic misses
+    // them. Per-platform list of additional positive signals:
+    const IMPLICIT_THEME_MARKERS_BY_PLATFORM = {
+        flutter: [
+            /Theme\.of\s*\(\s*context\s*\)/,
+            /CupertinoTheme\.of\s*\(\s*context\s*\)/,
+            /MediaQuery\.of\s*\(\s*context\s*\)/,
+            /\bcolorScheme\s*\./,
+            /\btextTheme\s*\./,
+            // Material 3 widget references — strong signal of design-system reuse.
+            /\b(Card|ElevatedButton|FilledButton|OutlinedButton|TextButton|IconButton|Scaffold|AppBar|FloatingActionButton|ListTile|Chip|NavigationBar|NavigationRail)\s*\(/,
+        ],
+        android: [
+            /MaterialTheme\.colorScheme/,
+            /MaterialTheme\.typography/,
+            /MaterialTheme\.shapes/,
+            /androidx\.compose\.material3/,
+        ],
+        ios: [
+            /UIColor\.system/,
+            /\.foregroundStyle\(\.system/,
+            /Color\.accentColor/,
+            /\.preferredColorScheme/,
+        ],
+        typescript: [
+            /useTheme\s*\(/,
+            /ThemeProvider/,
+            /styled\s*\(/,
+            /\bcss`/,
+        ],
+        "react-native": [
+            /useTheme\s*\(/,
+            /useColorScheme\s*\(/,
+            /StyleSheet\.create/,
+            /ThemeProvider/,
+        ],
+    };
+    const implicitMarkers = IMPLICIT_THEME_MARKERS_BY_PLATFORM[platform] ?? [];
     for (const [file, content] of sourceContent) {
         if (designAbsolutePaths.has(file)) {
             continue;
         }
+        // Phase 4: For AST-supported languages, check against comment-stripped
+        // content to avoid false passes from references only in comments.
+        const astLang = astLanguageForFile(file, platform);
+        const checkContent = astLang ? stripComments(astLang, content) : content;
+        // (a) Explicit reuse — cross-file basename / PascalCase reference.
         for (const { markers } of markersByFile) {
             for (const marker of markers) {
                 if (!marker || marker.length < 3) {
                     continue;
                 }
-                if (content.includes(marker)) {
+                if (checkContent.includes(marker)) {
                     return [];
                 }
             }
         }
+        // (b) Implicit reuse — ambient theme-provider API or design-system widget.
+        if (implicitMarkers.some((re) => re.test(checkContent))) {
+            return [];
+        }
     }
     return [
         finding(`${platform}.design.reuse-detected-tokens`, "warning", `Detected design source(s) (${designSignals.map((s) => s.file).slice(0, 3).join(", ")}) are not referenced by any other source file.`, designSignals[0].file, "Import or reference the detected design tokens / theme module from your new UI code instead of inlining colors, spacing, or typography. Attest with evidence (the import path) if you use an implicit theme provider context."),
@@ -432,7 +590,11 @@ function validateFeedUiStates(root, platform, sourceContent) {
         if (!observes) {
             continue;
         }
-        const hasStates = statePatterns.some((pattern) => pattern.test(content));
+        // Phase 4: For AST-supported languages, check state patterns against
+        // comment-stripped content to avoid false passes from comment text.
+        const astLang = astLanguageForFile(file, platform);
+        const checkContent = astLang ? stripComments(astLang, content) : content;
+        const hasStates = statePatterns.some((pattern) => pattern.test(checkContent));
         if (hasStates) {
             continue;
         }
@@ -459,6 +621,542 @@ const UI_STATE_PATTERNS_BY_PLATFORM = {
     android: [/\bisLoading\b/i, /\bloading\b/, /\berror\b/, /\bempty\b/i, /CircularProgressIndicator/, /LoadingState/, /\.collectAsState\b/],
     ios: [/\bisLoading\b/i, /\bloading\b/, /\berror\b/, /\bempty\b/i, /ProgressView/, /LoadingState/, /AsyncImage/],
 };
+const FEED_LIST_OBSERVATION_PATTERNS_BY_PLATFORM = {
+    typescript: [/PostRepository\.getPosts/, /queryPosts/, /observePosts/, /FeedRepository/],
+    "react-native": [/PostRepository\.getPosts/, /queryPosts/, /observePosts/, /FeedRepository/],
+    flutter: [/AmityPostRepository/, /queryPosts/, /getPosts/, /FeedRepository/],
+    android: [/AmitySocialClient\.newPostRepository/, /PostRepository/, /queryPosts/, /getPosts/],
+    ios: [/AmityPostRepository/, /queryPosts/, /getPosts/, /FeedRepository/],
+};
+const PAGINATION_MARKERS_BY_PLATFORM = {
+    typescript: [/\bhasMore\b/, /\bloadMore\b/, /\bnextPage\b/, /\bcursor\b/, /\bpageToken\b/, /\buseInfiniteQuery\b/, /\bfetchNextPage\b/, /onEndReached/],
+    "react-native": [/\bhasMore\b/, /\bloadMore\b/, /\bnextPage\b/, /\bcursor\b/, /\bpageToken\b/, /\buseInfiniteQuery\b/, /\bfetchNextPage\b/, /onEndReached/, /FlatList/],
+    flutter: [/ScrollController/, /ListView\.builder/, /PagingController/, /\bloadMore\b/, /\bnextPage\b/, /\bhasMore\b/],
+    android: [/PagingData/, /\bPager\b/, /PagingSource/, /LazyPagingItems/, /\bloadMore\b/, /\bnextPage\b/, /LazyColumn/],
+    ios: [/\bloadMore\b/, /\bnextPage\b/, /\bcursor\b/, /onAppear/, /willDisplay/, /UITableViewDataSourcePrefetching/, /\bpagination\b/i],
+};
+function validateFeedPagination(root, platform, sourceContent) {
+    const feedPatterns = FEED_LIST_OBSERVATION_PATTERNS_BY_PLATFORM[platform];
+    const paginationPatterns = PAGINATION_MARKERS_BY_PLATFORM[platform];
+    if (!feedPatterns || !paginationPatterns) {
+        return [];
+    }
+    for (const [file, content] of sourceContent) {
+        const hasFeed = feedPatterns.some((pattern) => pattern.test(content));
+        if (!hasFeed) {
+            continue;
+        }
+        // Check all source files for pagination markers (may be in a separate hook/util)
+        const astLang = astLanguageForFile(file, platform);
+        const checkContent = astLang ? stripComments(astLang, content) : content;
+        const hasPagination = paginationPatterns.some((pattern) => pattern.test(checkContent));
+        if (hasPagination) {
+            return [];
+        }
+        // Also check sibling files for pagination markers
+        for (const [otherFile, otherContent] of sourceContent) {
+            if (otherFile === file)
+                continue;
+            const otherLang = astLanguageForFile(otherFile, platform);
+            const otherCheck = otherLang ? stripComments(otherLang, otherContent) : otherContent;
+            if (paginationPatterns.some((pattern) => pattern.test(otherCheck))) {
+                return [];
+            }
+        }
+        return [
+            finding(`${platform}.feed.pagination-wired`, "warning", "A feed/posts observer is present but no pagination mechanism was detected.", relativeFile(root, file), "Wire pagination (hasMore/loadMore/nextPage, FlatList.onEndReached, LazyColumn scroll trigger, ScrollController, etc.) to avoid loading all content on mount."),
+        ];
+    }
+    return [];
+}
+const MODERATION_MARKERS = [
+    /\breport\b/i, /\breportPost\b/, /\bflag\b/i, /\bflagPost\b/,
+    /\bblock\b/i, /\bblockUser\b/, /\bmute\b/i, /\bmuteUser\b/,
+    /\bhide\b/i, /\bhidePost\b/, /\bmoderation\b/i, /\babuse\b/i,
+];
+function validateFeedModerationAffordance(root, platform, sourceContent) {
+    const feedPatterns = FEED_LIST_OBSERVATION_PATTERNS_BY_PLATFORM[platform];
+    if (!feedPatterns) {
+        return [];
+    }
+    let hasFeedFile = false;
+    for (const [file, content] of sourceContent) {
+        const hasFeed = feedPatterns.some((pattern) => pattern.test(content));
+        if (hasFeed) {
+            hasFeedFile = true;
+            break;
+        }
+    }
+    if (!hasFeedFile) {
+        return [];
+    }
+    // Check all source files for any moderation marker (may be in a separate module)
+    for (const [file, content] of sourceContent) {
+        const astLang = astLanguageForFile(file, platform);
+        const checkContent = astLang ? stripComments(astLang, content) : content;
+        if (MODERATION_MARKERS.some((pattern) => pattern.test(checkContent))) {
+            return [];
+        }
+    }
+    return [
+        finding(`${platform}.feed.moderation-affordance-present`, "warning", "A feed/posts UI is present but no moderation affordance (report, block, mute, hide) was detected.", undefined, "Add at least one user-visible moderation action (report, block, mute, or hide) to the feed UI or a sibling module. Attest if moderation is centralized elsewhere."),
+    ];
+}
+// ─── Logout on user-switch ───────────────────────────────────────────────────
+const USER_SWITCH_SYMBOLS = [
+    /switchUser/i, /setCurrentUser/i, /authStateChanged/i, /onAuthStateChanged/i,
+    /logoutAndLogin/i, /signInAs/i, /changeUser/i, /setUser/i,
+];
+const LOGIN_PATTERNS_BY_PLATFORM = {
+    android: [/AmityCoreClient\.login/, /\.login\s*\(/],
+    flutter: [/AmityCoreClient\.login/, /\.login\s*\(/],
+    typescript: [/AmityClient.*\.login/, /connectClient/, /\.login\s*\(/],
+    "react-native": [/AmityClient.*\.login/, /connectClient/, /\.login\s*\(/],
+    ios: [/\.login\s*\(/, /AmityClient.*\.login/],
+};
+const LOGOUT_MARKERS_BY_PLATFORM = {
+    android: [/\.logout\s*\(/, /unregisterSession/, /disconnect\s*\(/],
+    flutter: [/\.logout\s*\(/, /unregisterSession/, /disconnect\s*\(/],
+    typescript: [/\.logout\s*\(/, /\.disconnect\s*\(/, /client\.close/],
+    "react-native": [/\.logout\s*\(/, /\.disconnect\s*\(/, /client\.close/],
+    ios: [/\.logout\s*\(/, /unregisterSession/, /\.disconnect\s*\(/],
+};
+function validateLogoutOnUserSwitch(root, platform, sourceContent) {
+    const loginPatterns = LOGIN_PATTERNS_BY_PLATFORM[platform] ?? LOGIN_PATTERNS_BY_PLATFORM.typescript;
+    const logoutMarkers = LOGOUT_MARKERS_BY_PLATFORM[platform] ?? LOGOUT_MARKERS_BY_PLATFORM.typescript;
+    // Check: does the project have login AND user-switch symbols?
+    const loginFiles = filesMatching(sourceContent, loginPatterns);
+    if (loginFiles.length === 0)
+        return [];
+    const switchFiles = filesMatching(sourceContent, USER_SWITCH_SYMBOLS);
+    if (switchFiles.length === 0)
+        return [];
+    // Require a logout marker somewhere in the source
+    if (containsAny(sourceContent, logoutMarkers))
+        return [];
+    return [
+        finding(`${platform}.auth.logout-on-user-switch`, "warning", "User-switch pattern detected with social.plus login, but no logout/disconnect call was found. Switching users without logout can leak state across identities.", relativeFile(root, switchFiles[0]), "Call logout or disconnect on the current session before logging in as a different user. Attest if the switch is handled by a centralized auth coordinator."),
+    ];
+}
+// ─── No anonymous write ──────────────────────────────────────────────────────
+const WRITE_CALL_PATTERNS = [
+    /createPost\s*\(/, /createComment\s*\(/, /sendMessage\s*\(/,
+    /createStory\s*\(/, /addReaction\s*\(/, /\.react\s*\(/,
+    /PostRepository\.create/, /CommentRepository\.create/, /MessageRepository\.create/,
+    /\.createPost\s*\(/, /\.createComment\s*\(/, /\.sendMessage\s*\(/,
+];
+const AUTH_GATE_MARKERS = [
+    /\bcurrentUser\b/, /\bisAuthenticated\b/, /\brequireAuth\b/,
+    /\bsession\b/, /\bisLoggedIn\b/, /\bauthState\b/,
+    /\bgetCurrentUser\b/, /\bgetAccessToken\b/, /\baccessToken\b/,
+    /\bauthGuard\b/, /\bwithAuth\b/, /\bProtectedRoute\b/, /\bAuthProvider\b/,
+];
+function validateNoAnonymousWrite(root, platform, sourceContent) {
+    const writeFiles = filesMatching(sourceContent, WRITE_CALL_PATTERNS);
+    if (writeFiles.length === 0)
+        return [];
+    // For each file with write calls, check if it has auth gate markers
+    for (const filePath of writeFiles) {
+        const content = sourceContent.get(filePath) ?? "";
+        const astLang = astLanguageForFile(filePath, platform);
+        const checkContent = astLang ? stripComments(astLang, content) : content;
+        if (AUTH_GATE_MARKERS.some((p) => p.test(checkContent)))
+            return [];
+    }
+    return [
+        finding(`${platform}.auth.no-anonymous-write`, "warning", "Write operations (createPost, sendMessage, etc.) found but no auth gate or user-session check was detected in the same file.", relativeFile(root, writeFiles[0]), "Ensure write operations are only reachable after authentication. Check currentUser, session, or isAuthenticated before calling create/send methods."),
+    ];
+}
+// ─── Network error handling ──────────────────────────────────────────────────
+const SDK_CALL_PATTERNS = [
+    /\.login\s*\(/, /\.setup\s*\(/, /createPost\s*\(/,
+    /createComment\s*\(/, /sendMessage\s*\(/, /createStory\s*\(/,
+    /registerPushNotification/, /unregisterPushNotification/,
+    /\.query\s*\(/, /\.getPosts\s*\(/, /\.getComments\s*\(/,
+];
+const ERROR_HANDLING_MARKERS_BY_PLATFORM = {
+    android: [/try\s*\{/, /runCatching/, /\.onFailure/, /CoroutineExceptionHandler/, /\.catch\s*\{/],
+    flutter: [/try\s*\{/, /\.catchError\s*\(/, /\.onError\s*\(/, /\.handleError/, /catch\s*\(/],
+    // TypeScript / React: in addition to imperative try/catch and Promise.catch,
+    // recognize React's idiomatic error-state pattern:
+    //   - setError(...) state setter
+    //   - useState<Error...> or useState<...Error> (error-typed state)
+    //   - ErrorBoundary component reference (React error boundary)
+    //   - error.tsx co-located file (Next.js App Router convention)
+    //   - destructured error from a callback's response object: ({ error }) or (error: foo)
+    // These are the canonical patterns the social.plus TS SDK's Live Collection
+    // callbacks use; flagging them would force attestation on idiomatic code.
+    typescript: [/try\s*\{/, /\.catch\s*\(/, /\.then\s*\([^)]*,[^)]*\)/, /catchError/, /onError/, /setError\s*\(/, /useState\s*<[^>]*[Ee]rror/, /ErrorBoundary/, /error\.tsx\b/, /\berror\s*:\s*\w+\s*[,})]/],
+    "react-native": [/try\s*\{/, /\.catch\s*\(/, /\.then\s*\([^)]*,[^)]*\)/, /catchError/, /onError/, /setError\s*\(/, /useState\s*<[^>]*[Ee]rror/, /ErrorBoundary/, /\berror\s*:\s*\w+\s*[,})]/],
+    ios: [/do\s*\{/, /try\s+/, /try\?/, /catch\s*\{/, /\.failure\s*\(/, /Result\s*</, /completion.*Error/],
+};
+function validateErrorHandling(root, platform, sourceContent) {
+    const sdkCallFiles = filesMatching(sourceContent, SDK_CALL_PATTERNS);
+    if (sdkCallFiles.length === 0)
+        return [];
+    const errorMarkers = ERROR_HANDLING_MARKERS_BY_PLATFORM[platform] ?? ERROR_HANDLING_MARKERS_BY_PLATFORM.typescript;
+    // Check if ANY source file has error handling markers
+    if (containsAny(sourceContent, errorMarkers))
+        return [];
+    return [
+        finding(`${platform}.network.error-handling-present`, "warning", "SDK calls found but no error handling (try/catch, .catch, Result) was detected. Unhandled network errors produce broken UX or crashes.", relativeFile(root, sdkCallFiles[0]), "Wrap SDK calls in try/catch or attach .catch() handlers. Attest if error handling is centralized in a middleware layer."),
+    ];
+}
+// ─── Comments validation ─────────────────────────────────────────────────────
+const COMMENT_PRESENCE_PATTERNS = [
+    /createComment\s*\(/, /getComments\s*\(/, /commentRepository/i,
+    /CommentRepository/, /AmityCommentRepository/, /commentCollection/i,
+    /queryComments/, /addComment/, /postComment/, /replyToComment/,
+];
+const COMMENT_OBSERVER_CLEANUP_MARKERS_BY_PLATFORM = {
+    android: [/dispose\s*\(/, /Disposable/, /CompositeDisposable/, /clear\s*\(/, /removeObserver/, /unsubscribe/],
+    flutter: [/StreamSubscription/, /\.cancel\s*\(/, /dispose\s*\(/],
+    typescript: [/unsubscribe/, /\.off\s*\(/, /removeListener/, /dispose/],
+    "react-native": [/unsubscribe/, /\.off\s*\(/, /removeListener/, /dispose/, /useEffect.*return/],
+    ios: [/\.invalidate\s*\(/, /AmityNotificationToken/, /deinit/, /viewWillDisappear/],
+};
+const COMMENT_UI_STATE_MARKERS = [
+    /loading/i, /empty/i, /error/i, /isLoading/, /isEmpty/, /hasError/,
+    /\.loading\b/, /\.empty\b/, /\.error\b/, /LoadingState/, /emptyState/i,
+];
+function validateComments(root, platform, sourceContent) {
+    const findings = [];
+    const commentFiles = filesMatching(sourceContent, COMMENT_PRESENCE_PATTERNS);
+    if (commentFiles.length === 0)
+        return findings;
+    // target-resolved: check for hardcoded postId/commentId in comment files
+    for (const filePath of commentFiles) {
+        const content = sourceContent.get(filePath) ?? "";
+        const hardcodedTarget = /(?:postId|commentId|referenceId)\s*[:=]\s*["'`][a-z0-9-]+["'`]/i.exec(content);
+        if (hardcodedTarget) {
+            findings.push(finding(`${platform}.comments.target-resolved`, "warning", "Comment code references a hardcoded postId/commentId. Comment targets should come from the parent entity, not be invented.", relativeFile(root, filePath), "Pass the parent post/entity ID from navigation or parent component props rather than hardcoding it."));
+            break;
+        }
+    }
+    // observer-cleanup: if comment live collection exists, require cleanup
+    const cleanupMarkers = COMMENT_OBSERVER_CLEANUP_MARKERS_BY_PLATFORM[platform] ?? COMMENT_OBSERVER_CLEANUP_MARKERS_BY_PLATFORM.typescript;
+    if (!containsAny(sourceContent, cleanupMarkers)) {
+        findings.push(finding(`${platform}.comments.observer-cleanup`, "warning", "Comment observer/subscription was found but no obvious cleanup was detected.", relativeFile(root, commentFiles[0]), "Dispose or unsubscribe comment observers when the lifecycle owner is destroyed."));
+    }
+    // ui-states-present: require loading/empty/error states
+    if (!containsAny(sourceContent, COMMENT_UI_STATE_MARKERS)) {
+        findings.push(finding(`${platform}.comments.ui-states-present`, "warning", "Comment UI is present but no loading, empty, or error state handling was detected.", relativeFile(root, commentFiles[0]), "Handle loading, empty, and error states in the comment UI for a complete user experience."));
+    }
+    // moderation-affordance-present: require moderation on comments (scoped to comment files)
+    const commentOnlyContent = new Map();
+    for (const f of commentFiles)
+        commentOnlyContent.set(f, sourceContent.get(f) ?? "");
+    if (!containsAny(commentOnlyContent, MODERATION_MARKERS)) {
+        findings.push(finding(`${platform}.comments.moderation-affordance-present`, "warning", "Comment UI is present but no moderation affordance (report, block, hide) was detected for comments.", relativeFile(root, commentFiles[0]), "Add at least one moderation action (report, block, hide) to comments. Comments are UGC and need moderation."));
+    }
+    return findings;
+}
+// --- Moderation validators ---
+const MODERATION_PRESENCE_PATTERNS = [
+    /\bAmityModerationRepository\b/,
+    /\bModerationRepository\b/,
+    /\bblockUser\b/,
+    /\bmuteUser\b/,
+    /\bhideContent\b/,
+    /\bflagContent\b/,
+    /\breportContent\b/,
+];
+const MODERATION_CONFIRMATION_MARKERS = [
+    /\bconfirm\b/i,
+    /\bAlert\b/,
+    /\bAlertDialog\b/,
+    /\bshowDialog\b/,
+    /\bUIAlertController\b/,
+    /\bconfirmationDialog\b/,
+    /\bwindow\.confirm\b/,
+    /\bmodal\b/i,
+];
+const MODERATION_BLOCK_STATE_APPLIED_MARKERS = [
+    /\bisBlocked\b/,
+    /\bisMuted\b/,
+    /\bsetBlocked\b/,
+    /\bsetMuted\b/,
+    /\bblocked\s*state\b/i,
+    /\bmuted\s*state\b/i,
+    /\bBlockedContent\b/,
+    /\bMutedContent\b/,
+];
+const MODERATION_HIDDEN_RENDERING_MARKERS = [
+    /\bhidden\b/i,
+    /\bplaceholder\b/i,
+    /\bblurred\b/i,
+    /\bcontent\s*removed\b/i,
+    /\bvisibility\b/i,
+    /\bisHidden\b/,
+    /\bisRemoved\b/,
+    /\bopacity\b/,
+];
+function validateModeration(root, platform, sourceContent) {
+    const findings = [];
+    const moderationFiles = filesMatching(sourceContent, MODERATION_PRESENCE_PATTERNS);
+    if (moderationFiles.length === 0)
+        return findings;
+    // report-flow-present: require report action
+    const hasReport = containsAny(sourceContent, [/\breport\b/i, /\bflag\b/i, /\bflagContent\b/, /\breportContent\b/]);
+    if (!hasReport) {
+        findings.push(finding(`${platform}.moderation.report-flow-present`, "warning", "Moderation code is present but no report/flag flow was detected.", relativeFile(root, moderationFiles[0]), "Add a report action that calls the moderation API with a confirmation dialog before submission."));
+    }
+    // block-or-mute-state-applied: require state rendering markers (not just the action call)
+    if (!containsAny(sourceContent, MODERATION_BLOCK_STATE_APPLIED_MARKERS)) {
+        findings.push(finding(`${platform}.moderation.block-or-mute-state-applied`, "warning", "Moderation code is present but no block/mute state application was detected.", relativeFile(root, moderationFiles[0]), "After block/mute SDK call, update the UI to reflect the new state (hide content or show placeholder)."));
+    }
+    // hidden-content-rendering-present: require rendering logic for hidden content
+    if (!containsAny(sourceContent, MODERATION_HIDDEN_RENDERING_MARKERS)) {
+        findings.push(finding(`${platform}.moderation.hidden-content-rendering-present`, "warning", "Moderation code is present but no hidden/blocked content rendering logic was detected.", relativeFile(root, moderationFiles[0]), "Add rendering logic for hidden/blocked content (placeholder, removed indicator, or blur)."));
+    }
+    // confirmation-ux-present: require confirmation for destructive moderation actions
+    if (!containsAny(sourceContent, MODERATION_CONFIRMATION_MARKERS)) {
+        findings.push(finding(`${platform}.moderation.confirmation-ux-present`, "warning", "Destructive moderation actions found without confirmation UX.", relativeFile(root, moderationFiles[0]), "Add a confirmation step (dialog/alert/modal) before submitting destructive moderation actions."));
+    }
+    return findings;
+}
+// --- Chat validators ---
+const CHAT_PRESENCE_PATTERNS = [
+    /\bsendMessage\b/,
+    /\bcreateMessage\b/,
+    /\bAmityMessageRepository\b/,
+    /\bAmityChannelRepository\b/,
+    /\bMessageRepository\b/,
+    /\bChannelRepository\b/,
+    /\bchatClient\b/i,
+    /\bmessage\s*live\s*collection\b/i,
+];
+const CHAT_OBSERVER_CLEANUP_MARKERS_BY_PLATFORM = {
+    typescript: [/\bunsubscribe\b/, /\bdispose\b/, /\bremoveListener\b/, /\buseEffect\b.*\breturn\b/s],
+    "react-native": [/\bunsubscribe\b/, /\bdispose\b/, /\bremoveListener\b/, /\buseEffect\b.*\breturn\b/s],
+    android: [/\bonCleared\b/, /\bonDestroy\b/, /\bdispose\b/, /\bremoveObserver\b/],
+    flutter: [/\bdispose\b/, /\bcancel\b/, /\bclose\b/],
+    ios: [/\bdeinit\b/, /\bonDisappear\b/, /\binvalidate\b/, /\bremoveObserver\b/],
+};
+function validateChat(root, platform, sourceContent) {
+    const findings = [];
+    const chatFiles = filesMatching(sourceContent, CHAT_PRESENCE_PATTERNS);
+    if (chatFiles.length === 0)
+        return findings;
+    // channel-target-resolved: check for hardcoded channelId/conversationId
+    for (const filePath of chatFiles) {
+        const content = sourceContent.get(filePath) ?? "";
+        const hardcodedChannel = /(?:channelId|conversationId|channel_id)\b[^=\n]*=\s*["'`][a-z0-9-]+["'`]/i.exec(content);
+        if (hardcodedChannel) {
+            findings.push(finding(`${platform}.chat.channel-target-resolved`, "error", "Chat code references a hardcoded channelId or conversationId.", relativeFile(root, filePath), "Resolve the channel from user selection, SDK query, or app routing — never hardcode."));
+            break;
+        }
+    }
+    // message-observer-cleanup: require cleanup
+    const chatCleanupMarkers = CHAT_OBSERVER_CLEANUP_MARKERS_BY_PLATFORM[platform] ?? CHAT_OBSERVER_CLEANUP_MARKERS_BY_PLATFORM.typescript;
+    if (!containsAny(sourceContent, chatCleanupMarkers)) {
+        findings.push(finding(`${platform}.chat.message-observer-cleanup`, "warning", "Chat message observers were found but no obvious cleanup was detected.", relativeFile(root, chatFiles[0]), "Unsubscribe from message live collections on component unmount or view disposal."));
+    }
+    // send-error-handling: require error handling around sendMessage (scoped to chat files)
+    const chatFileContent = new Map();
+    for (const f of chatFiles)
+        chatFileContent.set(f, sourceContent.get(f) ?? "");
+    const hasErrorHandling = containsAny(chatFileContent, [
+        /\bcatch\b/,
+        /\b\.catch\b/,
+        /\bcatchError\b/,
+        /\bonError\b/,
+        /\bfailure\b/i,
+        /\berror\s*:/,
+        /\btry\b/,
+    ]);
+    if (!hasErrorHandling) {
+        findings.push(finding(`${platform}.chat.send-error-handling`, "warning", "Message send calls found without error handling.", relativeFile(root, chatFiles[0]), "Wrap sendMessage in try/catch or handle the error callback to show send failure state."));
+    }
+    // moderation-affordance-present: require moderation on chat messages (scoped to chat files)
+    if (!containsAny(chatFileContent, MODERATION_MARKERS)) {
+        findings.push(finding(`${platform}.chat.moderation-affordance-present`, "warning", "Chat messages are user-generated content but no moderation affordance (report/block/hide) was detected.", relativeFile(root, chatFiles[0]), "Add a report/block/hide action on chat messages."));
+    }
+    return findings;
+}
+// ─── Session Handler Retention ────────────────────────────────────────────────
+const SESSION_HANDLER_PRESENCE = {
+    android: [/\bAmitySessionHandler\b/, /\bSessionHandler\b/],
+    flutter: [/\bAmitySessionHandler\b/, /\bSessionHandler\b/],
+    ios: [/\bAmitySessionHandler\b/, /\bSessionHandler\b/],
+    typescript: [/\bsessionWillRenewAccessToken\b/],
+    "react-native": [/\bsessionWillRenewAccessToken\b/],
+};
+const SESSION_HANDLER_BAD_PATTERNS = {
+    android: /fun\s+\w+\s*\([^)]*\)\s*\{[\s\S]{0,200}?\b(?:val|var)\s+\w+\s*=\s*(?:object\s*:\s*)?(?:Amity)?SessionHandler\b/,
+    flutter: /(?:void|Future(?:<[^>]+>)?)\s+\w+\s*\([^)]*\)\s*(?:async\s*)?\{[\s\S]{0,200}?\b(?:final|var|(?:Amity)?SessionHandler)\s+\w+\s*=\s*\w*SessionHandler\b/,
+    ios: /func\s+\w+\s*\([^)]*\)\s*\{[\s\S]{0,200}?\b(?:let|var)\s+\w+\s*=\s*\w*SessionHandler\b/,
+    typescript: /(?:function\s+\w+\s*\([^)]*\)|const\s+\w+\s*=\s*\([^)]*\)\s*=>)\s*\{[\s\S]{0,200}?\b(?:const|let|var)\s+\w+\s*=\s*\{[\s\S]{0,200}?\bsessionWillRenewAccessToken\b/,
+    "react-native": /(?:function\s+\w+\s*\([^)]*\)|const\s+\w+\s*=\s*\([^)]*\)\s*=>)\s*\{[\s\S]{0,200}?\b(?:const|let|var)\s+\w+\s*=\s*\{[\s\S]{0,200}?\bsessionWillRenewAccessToken\b/,
+};
+const SESSION_HANDLER_GOOD_PATTERNS = {
+    android: [/private\s+(?:val|var)\s+\w+\s*=\s*(?:object\s*:\s*)?(?:Amity)?SessionHandler/, /\/\/\s*vise:\s*handler retained/],
+    flutter: [/(?:final|late)\s+(?:Amity)?SessionHandler\s+\w+/, /\/\/\s*vise:\s*handler retained/],
+    ios: [/(?:private|public|internal|fileprivate|static|class)\s+(?:let|var)\s+\w+\s*(?::\s*(?:Amity)?SessionHandler)?\s*=\s*\w*SessionHandler/, /\/\/\s*vise:\s*handler retained/],
+    typescript: [/\buseRef\b/, /export\s+(?:const|let|var)\s+\w+\s*=\s*\{/, /\/\/\s*vise:\s*handler retained/],
+    "react-native": [/\buseRef\b/, /export\s+(?:const|let|var)\s+\w+\s*=\s*\{/, /\/\/\s*vise:\s*handler retained/],
+};
+function validateLiveCollectionApiMismatch(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.live-collection.api-mismatch`;
+    const LIST_QUERY_PATTERNS = [
+        /\bgetPosts\b/,
+        /\bqueryPosts\b/,
+        /\bgetCommunityFeed\b/,
+        /\bgetGlobalFeed\b/,
+        /\bgetComments\b/,
+        /\bgetChannels\b/
+    ];
+    const LIST_UI_PATTERNS = [
+        /\bmap\s*\(/,
+        /\bFlatList\b/,
+        /\bListView\b/,
+        /\bRecyclerView\b/,
+        /\bLazyColumn\b/,
+        /\bForEach\b/,
+        /\bList\s*\(/,
+        /\bsubmitList\b/,
+        /\btableView\b/,
+        /\bcollectionView\b/
+    ];
+    const REACTIVE_MARKERS = [
+        /\bgetLiveCollection\b/,
+        /\bobserve\b/,
+        /\bobserveOnce\b/,
+        /\blisten\b/,
+        /\bonData\b/,
+        /\bStreamBuilder\b/,
+        /\bLiveData\b/,
+        /Amity\w*Flow\b/,
+        /\bPagingData\b/,
+        /\/\/\s*vise:\s*one-shot query/i
+    ];
+    for (const [file, content] of sourceContent) {
+        const rel = relativeFile(root, file);
+        const hasListQuery = LIST_QUERY_PATTERNS.some((p) => p.test(content));
+        if (hasListQuery) {
+            const hasListUI = LIST_UI_PATTERNS.some((p) => p.test(content));
+            if (hasListUI) {
+                const hasReactivity = REACTIVE_MARKERS.some((p) => p.test(content));
+                if (!hasReactivity) {
+                    findings.push(finding(ruleId, "warning", `A list query (like getPosts) is present but no reactive markers (getLiveCollection, observe, onData) were found in the same file.`, rel, "Use the reactive LiveCollection API for lists so the UI updates when new items arrive. If a one-shot query is truly intended, add comment // vise: one-shot query."));
+                }
+            }
+        }
+    }
+    return findings;
+}
+function validatePostsStatusFilter(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.posts.status-filter-applied`;
+    const POST_QUERY_PATTERNS = [
+        /\bgetPosts\b/,
+        /\bqueryPosts\b/,
+        /\bgetCommunityFeed\b/
+    ];
+    const FILTER_MARKERS = [
+        /\bfeedTypes?\b/,
+        /\bincludeDeleted\s*\(\s*false\s*\)/,
+        /\bisDeleted\s*:\s*false\b/,
+        /\bisFlagged\s*:\s*false\b/,
+        /\bstatuses\b/,
+        /\bif\s*\([^)]*isDeleted\)/,
+        /\bfilter\s*\([^)]*isDeleted\)/,
+        /\bif\s*\([^)]*isFlagged\)/,
+        /\bfilter\s*\([^)]*isFlagged\)/,
+        /\/\/\s*vise:\s*moderation review feed/i
+    ];
+    for (const [file, content] of sourceContent) {
+        const rel = relativeFile(root, file);
+        const hasPostQuery = POST_QUERY_PATTERNS.some((p) => p.test(content));
+        if (hasPostQuery) {
+            const hasFilter = FILTER_MARKERS.some((p) => p.test(content));
+            if (!hasFilter) {
+                findings.push(finding(ruleId, "warning", `A post query (like getPosts) is present but no status filters (includeDeleted, statuses, feedType) were found.`, rel, "Unfiltered queries leak deleted or flagged posts to the feed. Apply a status filter."));
+            }
+        }
+    }
+    return findings;
+}
+function validatePaginationCursorOpaque(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.pagination.cursor-opaque`;
+    const ARITHMETIC_PAGINATION_PATTERNS = [
+        /nextPage\s*[:=]\s*\d+/,
+        /pageToken\s*[:=]\s*\d+/,
+        /cursor\s*[:=]\s*\d+/,
+        /\bnextPage\s*\(\s*\d+\s*\)/,
+        /\bpageToken\s*\(\s*\d+\s*\)/,
+        /\bcursor\s*\(\s*\d+\s*\)/,
+        /nextPage\s*[:=]\s*\w+\s*[\*\+]\s*\w+/,
+        /pageToken\s*[:=]\s*\w+\s*[\*\+]\s*\w+/,
+        /cursor\s*[:=]\s*\w+\s*[\*\+]\s*\w+/,
+        /\bnextPage\s*\(\s*\w+\s*[\*\+]\s*\w+\s*\)/,
+        /\bpageToken\s*\(\s*\w+\s*[\*\+]\s*\w+\s*\)/,
+        /\bcursor\s*\(\s*\w+\s*[\*\+]\s*\w+\s*\)/,
+        /nextPage\s*[:=]\s*.*\.toString\(\)/i,
+        /pageToken\s*[:=]\s*.*\.toString\(\)/i,
+        /cursor\s*[:=]\s*.*\.toString\(\)/i,
+        /nextPage\s*[:=]\s*String\(/i,
+        /pageToken\s*[:=]\s*String\(/i,
+        /cursor\s*[:=]\s*String\(/i
+    ];
+    for (const [filename, text] of sourceContent) {
+        const rel = relativeFile(root, filename);
+        for (const pattern of ARITHMETIC_PAGINATION_PATTERNS) {
+            if (pattern.test(text)) {
+                findings.push(finding(ruleId, "warning", `Pagination cursor appears to be constructed using arithmetic or numeric stringification.`, rel, "Amity uses opaque cursor tokens. Pass the 'nextPage' or 'nextPageToken' from the previous result directly, or use the collection's loadMore() method."));
+                break;
+            }
+        }
+    }
+    return findings;
+}
+function validatePostsParentChild(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.posts.parent-child-rendered`;
+    const POST_RENDER_PATTERNS = [
+        /\.data\.text\b/i,
+        /\bpost\.data\b/i,
+        /\bpost\.text\b/i
+    ];
+    const CHILD_REFERENCE_PATTERNS = [
+        /\.\s*children\b/,
+        /\.\s*childrenPosts\b/,
+        /\bgetChildren\b/
+    ];
+    for (const [filename, text] of sourceContent) {
+        const rel = relativeFile(root, filename);
+        const hasPostRender = POST_RENDER_PATTERNS.some((p) => p.test(text));
+        if (hasPostRender) {
+            const hasChildRef = CHILD_REFERENCE_PATTERNS.some((p) => p.test(text));
+            if (!hasChildRef) {
+                findings.push(finding(ruleId, "warning", `A component renders post text but does not appear to inspect post children for media.`, rel, "Amity models images and videos as child posts. A UI that only renders the parent post's text will silently drop attachments. Inspect post.children or call getChildren()."));
+            }
+        }
+    }
+    return findings;
+}
+function validateSessionHandlerRetention(root, platform, sourceContent) {
+    const presenceMarkers = SESSION_HANDLER_PRESENCE[platform] ?? SESSION_HANDLER_PRESENCE.typescript;
+    const handlerFiles = filesMatching(sourceContent, presenceMarkers);
+    if (handlerFiles.length === 0)
+        return [];
+    const badPattern = SESSION_HANDLER_BAD_PATTERNS[platform];
+    const goodPatterns = SESSION_HANDLER_GOOD_PATTERNS[platform] ?? SESSION_HANDLER_GOOD_PATTERNS.typescript;
+    for (const file of handlerFiles) {
+        const content = sourceContent.get(file) ?? "";
+        if (badPattern && badPattern.test(content)) {
+            if (containsAny(new Map([[file, content]]), goodPatterns)) {
+                continue;
+            }
+            return [
+                finding(`${platform}.session-handler.retained`, "warning", "Session handler appears to be declared as a function-local variable, making it eligible for garbage collection. The SDK's access token renewal callback will fail to fire, causing sessions to silently expire.", relativeFile(root, file), "Declare the session handler as a class-level property, a module-scoped variable, or retain it via a state container so it outlives the setup function. Add `// vise: handler retained` if it is explicitly assigned to a long-lived store.")
+            ];
+        }
+    }
+    return [];
+}
 const LOGGING_CALL_PATTERNS_BY_PLATFORM = {
     android: /\b(?:Log\.[a-z]\s*\(|println\s*\(|print\s*\()/,
     flutter: /\b(?:print\s*\(|debugPrint\s*\(|log\s*\()/,
@@ -478,12 +1176,31 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
         findings.push(finding(`${platform}.feed.target.literal`, "warning", `A hardcoded feed target literal was found: ${feedTarget.name}.`, relativeFile(root, feedTarget.file), "Do not invent or hardcode communityId, targetId, feedId, or channelId. Ask the user for the target or use an existing app-owned selection/create flow."));
     }
     const inlineApiKey = firstLiteralAssignment(sourceContent, [
+        // Direct literal assignment — apiKey: "literal" or apiKey = "literal".
         /\bapiKey\b\s*[:=]\s*["'`]([^"'`]+)["'`]/i,
         /\bapi_key\b\s*[:=]\s*["'`]([^"'`]+)["'`]/i,
         /\bapi-key\b\s*[:=]\s*["'`]([^"'`]+)["'`]/i,
+        // Env-fallback secret leak patterns — the literal is on the RHS of an
+        // env-lookup fallback, not directly assigned to apiKey. The v0.7 §14
+        // Antigravity benchmark surfaced this gap: Dart's
+        // `apiKey = String.fromEnvironment(KEY, defaultValue: 'literal')` and
+        // JS/TS's `apiKey: process.env.X ?? 'literal'` both shipped a hardcoded
+        // key while the original regex (which requires the literal immediately
+        // after `apiKey [:=]`) saw `String.fromEnvironment(` or `process.env.`
+        // first and missed the literal. The patterns below explicitly walk
+        // through the env-lookup wrapper to the literal default.
+        //
+        // Dart: `defaultValue:` form inside String.fromEnvironment. Uses
+        // non-greedy any-char so the regex can bridge a multi-line argument
+        // list (real Dart code commonly puts each named arg on its own line).
+        /\bapi[-_]?key\b\s*[:=][\s\S]{0,200}?defaultValue\s*:\s*["'`]([^"'`]+)["'`]/i,
+        // JS/TS: process.env.X ?? 'literal' or process.env.X || 'literal'.
+        /\bapi[-_]?key\b\s*[:=][\s\S]{0,200}?(?:process\.env\.[A-Z0-9_]+|import\.meta\.env\.[A-Z0-9_]+)\s*(?:\?\?|\|\|)\s*["'`]([^"'`]+)["'`]/i,
+        // Ternary fallback: `apiKey = X ? 'literal' : ...` captures the truthy branch.
+        /\bapi[-_]?key\b\s*[:=][\s\S]{0,200}?\?\s*["'`]([^"'`]+)["'`]\s*:/i,
     ]);
     if (inlineApiKey && !isAllowedPlaceholder(inlineApiKey.value)) {
-        findings.push(finding(`${platform}.secret.inline-api-key`, "warning", "A social.plus API key appears to be hardcoded in source.", relativeFile(root, inlineApiKey.file), "Use the host app's environment/config pattern instead of committing API keys directly into source files."));
+        findings.push(finding(`${platform}.secret.inline-api-key`, "warning", "A social.plus API key appears to be hardcoded in source.", relativeFile(root, inlineApiKey.file), "Use the host app's environment/config pattern instead of committing API keys directly into source files. The literal is still committed even when wrapped in an env-fallback (e.g. `defaultValue:`, `??`, `||`, ternary)."));
     }
     // Hardcoded user identity — every benchmark Pure MCP failure mode included
     // `userId: "current-user"` or similar. The user identity should come from
@@ -497,6 +1214,135 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
     if (literalUserId && !isAllowedPlaceholder(literalUserId.value)) {
         findings.push(finding(`${platform}.auth.no-literal-user-id`, "warning", `A hardcoded user identity literal was found: ${literalUserId.name}.`, relativeFile(root, literalUserId.file), "Do not hardcode a userId in source. Read the authenticated user from the host app's auth state (current session, route param, user-store hook, etc.)."));
     }
+    // AST pass — catches indirect literals via identifier resolution.
+    // Runs for TypeScript/TSX files. Covers: auth.no-literal-user-id,
+    // secret.inline-api-key, and feed.target.literal.
+    if (platform === "typescript" || platform === "react-native") {
+        for (const [file, content] of sourceContent) {
+            if (!file.endsWith(".ts") && !file.endsWith(".tsx"))
+                continue;
+            const rel = relativeFile(root, file);
+            const lang = file.endsWith(".tsx") ? "tsx" : "typescript";
+            const tree = parse(lang, content);
+            // ── auth.no-literal-user-id via .login({ userId: CONST }) ──
+            const userIdRule = `${platform}.auth.no-literal-user-id`;
+            if (!findings.some((f) => f.ruleId === userIdRule && f.file === rel)) {
+                const loginCalls = findCallExpressions(tree, /\.login\b/);
+                for (const call of loginCalls) {
+                    const objectArg = call.args[0];
+                    if (!objectArg)
+                        continue;
+                    const userIdNode = pickObjectProperty(objectArg, "userId");
+                    if (!userIdNode)
+                        continue;
+                    const value = resolveLiteralValue(userIdNode, tree);
+                    if (value && !isAllowedPlaceholder(value)) {
+                        findings.push(finding(userIdRule, "warning", `A hardcoded user identity was resolved from identifier "${userIdNode.text}" → "${value}".`, rel, "Do not hardcode a userId in source, including via local constants. Read the authenticated user from the host app's auth state."));
+                        break;
+                    }
+                }
+            }
+            // ── secret.inline-api-key via createClient({ apiKey: CONST }) or createClient(CONST, ...) ──
+            const secretRule = `${platform}.secret.inline-api-key`;
+            if (!findings.some((f) => f.ruleId === secretRule && f.file === rel)) {
+                const createCalls = findCallExpressions(tree, /\bcreateClient\b/);
+                for (const call of createCalls) {
+                    // Object form: createClient({ apiKey: CONST })
+                    const firstArg = call.args[0];
+                    if (!firstArg)
+                        continue;
+                    let apiKeyNode = pickObjectProperty(firstArg, "apiKey");
+                    // Positional form: createClient(KEY, region)
+                    if (!apiKeyNode && firstArg.type !== "object") {
+                        apiKeyNode = firstArg;
+                    }
+                    if (!apiKeyNode)
+                        continue;
+                    const value = resolveLiteralValue(apiKeyNode, tree);
+                    if (value && !isAllowedPlaceholder(value)) {
+                        findings.push(finding(secretRule, "warning", `A hardcoded API key was resolved from identifier "${apiKeyNode.text}" → "${value}".`, rel, "Use the host app's environment/config pattern instead of committing API keys via local constants."));
+                        break;
+                    }
+                }
+            }
+            // ── feed.target.literal via getPosts({ targetId: CONST }) or similar ──
+            const feedRule = `${platform}.feed.target.literal`;
+            if (!findings.some((f) => f.ruleId === feedRule && f.file === rel)) {
+                const feedCalls = findCallExpressions(tree, /\bgetPosts\b|\bgetComments\b|\bcreatePost\b/);
+                for (const call of feedCalls) {
+                    const objectArg = call.args[0];
+                    if (!objectArg)
+                        continue;
+                    for (const prop of ["targetId", "communityId", "feedId", "channelId"]) {
+                        const node = pickObjectProperty(objectArg, prop);
+                        if (!node)
+                            continue;
+                        const value = resolveLiteralValue(node, tree);
+                        if (value && !isAllowedPlaceholder(value)) {
+                            findings.push(finding(feedRule, "warning", `A hardcoded feed target was resolved from identifier "${node.text}" → "${value}".`, rel, "Do not hardcode communityId, targetId, feedId, or channelId via local constants. Ask the user for the target."));
+                            break;
+                        }
+                    }
+                    if (findings.some((f) => f.ruleId === feedRule && f.file === rel))
+                        break;
+                }
+            }
+        }
+    }
+    // AST pass for Kotlin/Android — catches indirect literals via identifier resolution.
+    if (platform === "android") {
+        for (const [file, content] of sourceContent) {
+            if (!file.endsWith(".kt"))
+                continue;
+            const rel = relativeFile(root, file);
+            const tree = parse("kotlin", content);
+            // ── auth.no-literal-user-id via .login(CONST) ──
+            const userIdRule = `${platform}.auth.no-literal-user-id`;
+            if (!findings.some((f) => f.ruleId === userIdRule && f.file === rel)) {
+                const loginCalls = findCallExpressions(tree, /\.login$/);
+                for (const call of loginCalls) {
+                    const firstArg = call.args[0];
+                    if (!firstArg)
+                        continue;
+                    const value = resolveLiteralValue(firstArg, tree);
+                    if (value && !isAllowedPlaceholder(value)) {
+                        findings.push(finding(userIdRule, "warning", `A hardcoded user identity was resolved from identifier "${firstArg.text}" → "${value}".`, rel, "Do not hardcode a userId in source, including via local constants. Read the authenticated user from the host app's auth state."));
+                        break;
+                    }
+                }
+            }
+            // ── secret.inline-api-key via .setup(CONST) ──
+            const secretRule = `${platform}.secret.inline-api-key`;
+            if (!findings.some((f) => f.ruleId === secretRule && f.file === rel)) {
+                const setupCalls = findCallExpressions(tree, /\.setup$/);
+                for (const call of setupCalls) {
+                    const firstArg = call.args[0];
+                    if (!firstArg)
+                        continue;
+                    const value = resolveLiteralValue(firstArg, tree);
+                    if (value && !isAllowedPlaceholder(value)) {
+                        findings.push(finding(secretRule, "warning", `A hardcoded API key was resolved from identifier "${firstArg.text}" → "${value}".`, rel, "Use the host app's environment/config pattern (BuildConfig, secrets.properties) instead of committing API keys via local constants."));
+                        break;
+                    }
+                }
+            }
+            // ── feed.target.literal via .targetCommunity(CONST) / .targetUser(CONST) ──
+            const feedRule = `${platform}.feed.target.literal`;
+            if (!findings.some((f) => f.ruleId === feedRule && f.file === rel)) {
+                const feedCalls = findCallExpressions(tree, /targetCommunity$|targetUser$|targetFeed$/);
+                for (const call of feedCalls) {
+                    const firstArg = call.args[0];
+                    if (!firstArg)
+                        continue;
+                    const value = resolveLiteralValue(firstArg, tree);
+                    if (value && !isAllowedPlaceholder(value)) {
+                        findings.push(finding(feedRule, "warning", `A hardcoded feed target was resolved from identifier "${firstArg.text}" → "${value}".`, rel, "Do not hardcode feed targets via local constants. Ask the user for the target or derive it from app state."));
+                        break;
+                    }
+                }
+            }
+        }
+    }
     return findings;
 }
 function firstLiteralAssignment(contents, patterns) {
@@ -519,6 +1365,11 @@ function isAllowedPlaceholder(value) {
         "api-key",
         "your-api-key",
         "your_api_key",
+        "your-amity-api-key",
+        "your_amity_api_key",
+        "placeholder",
+        "placeholder-api-key",
+        "placeholder_api_key",
         "provided-by-customer",
         "customer-provided",
         "replace-me",
@@ -639,12 +1490,47 @@ async function validateIos(root) {
     if (pushRegistrationFiles.length > 0 && pushUnregisterFiles.length === 0) {
         findings.push(finding("ios.push.unregister.present", "warning", "Push registration was found but no obvious unregister call was detected.", relativeFile(root, pushRegistrationFiles[0]), "Unregister device tokens on logout or user switch so notifications are not sent to the wrong user."));
     }
+    // iOS push permission: if push registration exists, require UNUserNotificationCenter.requestAuthorization
+    if (pushRegistrationFiles.length > 0 && !containsAny(swiftContent, [/requestAuthorization/, /UNUserNotificationCenter/])) {
+        findings.push(finding("ios.push.permission-prompt-before-register", "warning", "Push registration was found but no UNUserNotificationCenter.requestAuthorization call was detected.", relativeFile(root, pushRegistrationFiles[0]), "Request push permission from the user via UNUserNotificationCenter before registering for remote notifications."));
+    }
+    // iOS push payload: if didReceiveRemoteNotification or userNotificationCenter(_:didReceive:) exists,
+    // require push-specific SDK forwarding marker.
+    const iosPayloadHandlerFiles = filesMatching(swiftContent, [/didReceiveRemoteNotification/, /userNotificationCenter\s*\(\s*_\s*,\s*didReceive/]);
+    if (iosPayloadHandlerFiles.length > 0 && !containsAny(swiftContent, [/AmityPush/, /handlePushNotification/, /didReceiveAmityNotification/, /EkoPushNotification/, /amityPushMessaging/, /registerDeviceForPush/, /handleAmityPush/])) {
+        findings.push(finding("ios.push.payload-contract-respected", "warning", "Push payload handler exists but no social.plus push forwarding call was detected.", relativeFile(root, iosPayloadHandlerFiles[0]), "Forward incoming push payloads to the social.plus SDK push handler (e.g. AmityPush.handleNotification) so social notifications are routed correctly."));
+    }
     if (liveDataFiles.length > 0 && !containsAny(swiftContent, [/AmityNotificationToken/, /\.invalidate\s*\(/, /deinit/, /viewWillDisappear/])) {
         findings.push(finding("ios.live.cleanup", "warning", "Live Object/Collection observation was found but no obvious cleanup was detected.", relativeFile(root, liveDataFiles[0]), "Keep the notification token and invalidate or release it when the view/controller lifecycle ends."));
     }
     findings.push(...validateLiteralGuardrails(root, "ios", swiftContent));
     findings.push(...validateLoggingHygiene(root, "ios", swiftContent));
     findings.push(...validateFeedUiStates(root, "ios", swiftContent));
+    findings.push(...validateFeedPagination(root, "ios", swiftContent));
+    findings.push(...validateFeedModerationAffordance(root, "ios", swiftContent));
+    findings.push(...validateLogoutOnUserSwitch(root, "ios", swiftContent));
+    findings.push(...validateNoAnonymousWrite(root, "ios", swiftContent));
+    findings.push(...validateErrorHandling(root, "ios", swiftContent));
+    findings.push(...validateComments(root, "ios", swiftContent));
+    findings.push(...validateModeration(root, "ios", swiftContent));
+    findings.push(...validateLiveCollectionApiMismatch(root, "ios", swiftContent));
+    findings.push(...validatePostsStatusFilter(root, "ios", swiftContent));
+    findings.push(...validatePaginationCursorOpaque(root, "ios", swiftContent));
+    findings.push(...validatePostsParentChild(root, "ios", swiftContent));
+    findings.push(...validateFeedTargetTypeExplicit(root, "ios", swiftContent));
+    findings.push(...validateChannelTypeMatchesShape(root, "ios", swiftContent));
+    findings.push(...validateReactionConfiguredNameUsed(root, "ios", swiftContent));
+    findings.push(...validateCustomPostTypeDataTypeDeclared(root, "ios", swiftContent));
+    findings.push(...validateModerationRoleGatedAction(root, "ios", swiftContent));
+    findings.push(...validateFlagCountNotLeaked(root, "ios", swiftContent));
+    findings.push(...validateUserBanStateRespected(root, "ios", swiftContent));
+    findings.push(...validateNotificationsPreferencesConfigured(root, "ios", swiftContent));
+    findings.push(...validateUnreadSubscribedNotCounted(root, "ios", swiftContent));
+    findings.push(...validateFileUploadViaAmityFileClient(root, "ios", swiftContent));
+    findings.push(...validateImagePostChildResolutionAwaited(root, "ios", swiftContent));
+    findings.push(...validateCommentReferenceTypeEnum(root, "ios", swiftContent));
+    findings.push(...validateSessionHandlerRetention(root, "ios", swiftContent));
+    findings.push(...validateChat(root, "ios", swiftContent));
     findings.push(...(await validateDesignReuse(root, "ios", swiftContent)));
     return findings;
 }
@@ -906,3 +1792,314 @@ function containsAnyForFiles(contents, files, patterns) {
 function relativeFile(root, file) {
     return file ? path.relative(root, file) : undefined;
 }
+/**
+ * Map a source file path + platform to the AST Language type (if supported).
+ * Returns undefined for languages without tree-sitter support (Dart, Swift).
+ */
+function astLanguageForFile(filePath, platform) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (ext === ".ts")
+        return "typescript";
+    if (ext === ".tsx")
+        return "tsx";
+    if (ext === ".kt" || ext === ".kts")
+        return "kotlin";
+    // Platforms that use TS/TSX but file doesn't have extension — infer from platform
+    if ((platform === "typescript" || platform === "react-native") && (ext === ".js" || ext === ".jsx")) {
+        return "typescript";
+    }
+    return undefined;
+}
+function validateCommentReferenceTypeEnum(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.comment.reference-type-enum`;
+    const REFERENCE_TYPE_PATTERNS = [
+        /referenceType\s*[:=\(]\s*(['"][^'"]+['"])/i
+    ];
+    for (const [filename, text] of sourceContent) {
+        const rel = relativeFile(root, filename);
+        if (/\/\/\s*vise:\s*reference-type rationale/i.test(text)) {
+            continue;
+        }
+        const hasCreateComment = /\bcreateComment\b/.test(text);
+        if (!hasCreateComment)
+            continue;
+        for (const pattern of REFERENCE_TYPE_PATTERNS) {
+            if (pattern.test(text)) {
+                findings.push(finding(ruleId, "warning", `A createComment call appears to hardcode referenceType to a raw string instead of an enum.`, rel, `Comment reference types should be strongly typed using the SDK enums (e.g. AmityCommentReferenceType.POST) to prevent casing errors. If this is intentional, add comment // vise: reference-type rationale — <reason>.`));
+                break; // one per file is enough for this rule
+            }
+        }
+    }
+    return findings;
+}
+function validateChannelTypeMatchesShape(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.channel.type-matches-shape`;
+    for (const [filename, text] of sourceContent) {
+        const rel = path.relative(root, filename);
+        if (/\/\/\s*vise:\s*channel type rationale/i.test(text)) {
+            continue;
+        }
+        const hasCreateChannel = /\bcreateChannel\b/.test(text);
+        if (!hasCreateChannel)
+            continue;
+        const lowerName = (rel || filename).toLowerCase();
+        const isDirectIntent = lowerName.includes('direct') || lowerName.includes('dm') || lowerName.includes('1on1') || lowerName.includes('conversation') || lowerName.includes('private-chat') || lowerName.includes('privatechat');
+        const isBroadcastIntent = lowerName.includes('broadcast') || lowerName.includes('announcement');
+        if (isDirectIntent) {
+            if (/(?:channel)?type\s*[:=\(]\s*(?:AmityChannelType\.)?(?:\.)?(?:COMMUNITY|LIVE|community|live|"community"|"live"|'community'|'live')/i.test(text)) {
+                findings.push(finding(ruleId, "warning", `File ${rel} implies a 1:1 conversation but creates a community/live channel.`, rel, `Using 'community' for 1:1 chat breaks conversation semantics. Use 'conversation' instead. If this is intentional, add comment // vise: channel type rationale — <reason>.`));
+            }
+        }
+        else if (isBroadcastIntent) {
+            if (/(?:channel)?type\s*[:=\(]\s*(?:AmityChannelType\.)?(?:CONVERSATION|COMMUNITY|conversation|community|"conversation"|"community"|'conversation'|'community')/i.test(text)) {
+                findings.push(finding(ruleId, "warning", `File ${rel} implies a broadcast channel but creates a conversation/community channel.`, rel, `Using 'conversation'/'community' for broadcast chat breaks broadcast semantics. Use 'broadcast' instead. If this is intentional, add comment // vise: channel type rationale — <reason>.`));
+            }
+        }
+    }
+    return findings;
+}
+function validateReactionConfiguredNameUsed(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.reactions.configured-name-used`;
+    for (const [filename, text] of sourceContent) {
+        const rel = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
+        if (/\/\/\s*vise:\s*reaction\s*"[^"]+"\s*matches\s*console\s*config/i.test(text)) {
+            continue;
+        }
+        if (/\b(addReaction|removeReaction|flagReaction|react)\s*\(\s*['"`][^'"`]+['"`]/i.test(text)) {
+            findings.push(finding(ruleId, "warning", `File ${rel} hardcodes a reaction name string literal.`, rel, `Reaction names are per-tenant. Retrieve the reaction name from a configuration file or prop instead of hardcoding it. If it matches console config, add comment // vise: reaction "<name>" matches console config.`));
+        }
+    }
+    return findings;
+}
+function validateImagePostChildResolutionAwaited(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = platform + '.image-post.child-resolution-awaited';
+    for (const [filename, text] of sourceContent) {
+        const rel = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
+        // Look for createPost and immediate render/setState/display
+        if (/createPost\s*\(/.test(text) &&
+            /(?:render|setState|display)\s*\(/.test(text)) {
+            const hasResolution = /whenComplete/.test(text) ||
+                /whenReady/.test(text) ||
+                /childrenPosts.*await/.test(text) ||
+                /getPost/.test(text) ||
+                /\.observe/.test(text) ||
+                /\/\/\s*vise:\s*child resolution handled by/.test(text);
+            if (!hasResolution) {
+                findings.push(finding(ruleId, "warning", "File " + rel + " renders an image post immediately after creation without awaiting child resolution.", rel, "After createPost with an image attachment, the parent post returns immediately but the image child post is still being processed server-side. Rendering the result immediately yields an empty image / broken thumbnail. You must await the child post's ready state."));
+            }
+        }
+    }
+    return findings;
+}
+function validateFileUploadViaAmityFileClient(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = platform + '.file-upload.via-amity-file-client';
+    for (const [filename, text] of sourceContent) {
+        const rel = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
+        let hasExternalUrlUpload = false;
+        if (platform === 'typescript' || platform === 'react-native') {
+            hasExternalUrlUpload = /createPost\s*\(\s*\{[^}]*(?:attachments|data)\s*:\s*\[?\s*\{[^}]*url\s*:\s*['"`]https?:/.test(text);
+        }
+        else if (platform === 'android') {
+            hasExternalUrlUpload = /createPost\s*\(.*attachments\s*=.*Uri\.parse/.test(text);
+        }
+        else if (platform === 'flutter') {
+            hasExternalUrlUpload = /createPost\s*\(.*attachments\s*:.*url:\s*['"`]https?:/.test(text);
+        }
+        else if (platform === 'ios') {
+            hasExternalUrlUpload = /createPost\s*\(.*attachments:\s*\[\.url\(URL\(string:/.test(text);
+        }
+        if (hasExternalUrlUpload) {
+            const hasAmityFileFlow = /AmityFileClient\.(?:uploadFile|uploadImage)/.test(text) ||
+                /AmityFileRepository\.uploadFile/.test(text) ||
+                /newFileRepository\(\)\.uploadFile/.test(text) ||
+                /AmityImageData/.test(text) ||
+                /AmityVideoData/.test(text) ||
+                /getFile/.test(text) ||
+                /AmityFileId/.test(text) ||
+                /\/\/\s*vise:\s*media upload flow/.test(text);
+            if (!hasAmityFileFlow) {
+                findings.push(finding(ruleId, "warning", "File " + rel + " creates a post with an external media URL directly.", rel, "Uploading media to external buckets directly and trying to attach the resulting URL to an Amity post will fail. The SDK won't recognize external URLs as attachments — media must flow through AmityFileClient/Repository to get an AmityFileId."));
+            }
+        }
+    }
+    return findings;
+}
+function validateUnreadSubscribedNotCounted(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = platform + '.unread.subscribed-not-counted';
+    let hasManualCount = false;
+    let hasSubscribedStream = false;
+    let firstManualCountFile = '';
+    for (const [filename, text] of sourceContent) {
+        if (/\.filter\s*\(\s*[^)]*!\s*[^)]*isRead\s*[^)]*\)\s*\.\s*length/.test(text) ||
+            /\.where\s*\(\s*[^)]*!\s*[^)]*isRead\s*[^)]*\)\s*\.\s*length/.test(text) ||
+            /\.count\s*\(\s*[^)]*!\s*[^)]*\.isRead\s*\)/.test(text) ||
+            /unreadCount\s*=\s*[^;]*\bfilter\b/.test(text)) {
+            hasManualCount = true;
+            if (!firstManualCountFile) {
+                firstManualCountFile = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
+            }
+        }
+        if (/AmityCoreClient\.unreadCount/.test(text) ||
+            /\.unreadCount\(\)/.test(text) ||
+            /unreadCountObservable/.test(text) ||
+            /getUnreadCount/.test(text) ||
+            /subscribeUnread/.test(text) ||
+            /unreadCount\.observe/.test(text) ||
+            /unread\.stream/.test(text) ||
+            /\/\/\s*vise:\s*unread sourced from/.test(text)) {
+            hasSubscribedStream = true;
+        }
+    }
+    if (hasManualCount && !hasSubscribedStream) {
+        findings.push(finding(ruleId, "warning", "Project manually counts unread items instead of using Amity's unreadCount stream.", firstManualCountFile, "Amity exposes a global unreadCount stream that syncs across devices. Hand-rolling unread counting on the client causes counts to go out of sync because the server's read state isn't pushed to the manual counter."));
+    }
+    return findings;
+}
+function validateNotificationsPreferencesConfigured(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = platform + '.notifications.amity-preferences-configured';
+    let hasPushRegistration = false;
+    let hasPreferences = false;
+    let firstPushRegistrationFile = '';
+    for (const [filename, text] of sourceContent) {
+        if (/\b(registerPushNotification|enablePushNotification)\b/.test(text)) {
+            hasPushRegistration = true;
+            if (!firstPushRegistrationFile) {
+                firstPushRegistrationFile = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
+            }
+        }
+        if (/\.notifications\s*\(\s*\)\.(?:getSettings|setSettings)/.test(text) ||
+            /notificationRepository\.(?:getSettings|setSettings)/.test(text) ||
+            /\bNotificationSettings\b/.test(text) ||
+            /\/\/\s*vise:\s*notification preferences synced via/.test(text)) {
+            hasPreferences = true;
+        }
+    }
+    if (hasPushRegistration && !hasPreferences) {
+        findings.push(finding(ruleId, "warning", "Project registers push token but does not handle Amity's server-side notification preferences.", firstPushRegistrationFile, "Amity has its own server-side notification preferences (mute community, mute user, granular per-event toggles) separate from FCM/APNS. Customers often register the push token and stop there, meaning notifications fire but ignore the user's preferences, leading to bug reports."));
+    }
+    return findings;
+}
+function validateUserBanStateRespected(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = platform + '.user.ban-state-respected';
+    for (const [filename, text] of sourceContent) {
+        const rel = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
+        // Check if interaction methods are used in the file
+        if (!/\b(createPost|createComment|sendMessage|addReaction)\b/.test(text)) {
+            continue;
+        }
+        // Ban-state positive markers
+        const hasBanCheck = /currentUser\.isGlobalBan/.test(text) ||
+            /isCurrentUserBannedFromCommunity/.test(text) ||
+            /community\.bannedUserIds\.(?:contains|includes)/i.test(text) ||
+            /channel\.isMuted/.test(text) ||
+            /member\.isMuted/.test(text) ||
+            /user\.banState/.test(text) ||
+            /\.isBanned/.test(text) ||
+            /\/\/\s*vise:\s*ban state checked at/i.test(text);
+        if (!hasBanCheck) {
+            findings.push(finding(ruleId, "warning", "File " + rel + " renders an interaction action without checking ban state.", rel, "Banned users still see post-create, like, comment, or send-message buttons, which fail on the server. To avoid poor UX and support tickets, check the ban state before showing these actions."));
+        }
+    }
+    return findings;
+}
+function validateFlagCountNotLeaked(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = platform + '.flag-count.not-leaked-to-non-mods';
+    for (const [filename, text] of sourceContent) {
+        const rel = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
+        // Check if flagCount is used in the file
+        if (!/\bflagCount\b/.test(text)) {
+            continue;
+        }
+        // Role-check positive markers
+        const hasRoleCheck = /currentUser\.roles\.(?:contains|includes|some).*moderator/i.test(text) ||
+            /\.hasRole\s*\(.*moderator/i.test(text) ||
+            /community\.hasModeratorRole/.test(text) ||
+            /isCommunityModerator/.test(text) ||
+            /isModerator\s*[(=]/.test(text) ||
+            /member\.isModerator/.test(text) ||
+            /roles\.includes\s*\(.*moderator/i.test(text) ||
+            /permissions\.(?:contains|includes).*moderation/i.test(text) ||
+            /myReactions\.(?:contains|includes).*flag/i.test(text) ||
+            /\/\/\s*vise:\s*flagCount visible only to moderators/i.test(text);
+        if (!hasRoleCheck) {
+            findings.push(finding(ruleId, "warning", "File " + rel + " references flagCount without a role check.", rel, "flagCount is moderator-only data. Rendering it to everyone leaks moderation signal. Ensure flagCount rendering is gated by a role check."));
+        }
+    }
+    return findings;
+}
+function validateModerationRoleGatedAction(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = platform + '.moderation.role-gated-action';
+    for (const [filename, text] of sourceContent) {
+        const rel = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
+        // Check if any of the target actions exist in the file
+        if (!/\b(flagPost|deletePost|banUser|muteChannelMember|unflagPost|flagComment|deleteComment|unbanUser)\b/.test(text)) {
+            continue;
+        }
+        // Role-check positive markers
+        const hasRoleCheck = /currentUser\.roles\.(?:contains|includes|some).*moderator/i.test(text) ||
+            /\.hasRole\s*\(.*moderator/i.test(text) ||
+            /community\.hasModeratorRole/.test(text) ||
+            /isCommunityModerator/.test(text) ||
+            /isModerator\s*[(=]/.test(text) ||
+            /member\.isModerator/.test(text) ||
+            /roles\.includes\s*\(.*moderator/i.test(text) ||
+            /permissions\.(?:contains|includes).*moderation/i.test(text) ||
+            /\/\/\s*vise:\s*role check applied/i.test(text);
+        if (!hasRoleCheck) {
+            findings.push(finding(ruleId, "warning", "File " + rel + " invokes a moderator action without a role check.", rel, "Moderation actions (flag, delete, ban, mute) fail on the server if the user lacks the moderator role. Showing these buttons to all users causes a poor user experience. Wrap the action or the button in a role check (e.g. currentUser.roles.contains('moderator'))."));
+        }
+    }
+    return findings;
+}
+function validateCustomPostTypeDataTypeDeclared(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.custom-post-type.dataType-declared`;
+    for (const [filename, text] of sourceContent) {
+        const rel = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
+        if (/\/\/\s*vise:\s*custom post type/i.test(text)) {
+            continue;
+        }
+        const matches = text.match(/createPost[\s\S]{0,100}data\s*[:=(]\s*(?:\{|\w+\s*\(|\[)[^)]*\)?/gi);
+        if (!matches)
+            continue;
+        for (const match of matches) {
+            if (!/dataType\s*[:=\(]/i.test(match)) {
+                findings.push(finding(ruleId, "warning", `File ${rel} creates a custom data post but does not declare a dataType.`, rel, `When creating a post with a custom data payload, the 'dataType' tag must be explicitly provided so the SDK can route it correctly. If missing, it defaults to a text post, which stringifies the payload.`));
+            }
+        }
+    }
+    return findings;
+}
+function validateFeedTargetTypeExplicit(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.feed.target-type-explicit`;
+    const TARGET_TYPE_PATTERNS = [
+        /targetType\s*[:=\(]\s*(?:co\.amity\.android\.sdk\.)?(AmityPostTargetType\.|TargetType\.|\.community|\.user|\.my_feed|\.COMMUNITY|\.USER|\.MY_FEED|"COMMUNITY"|"USER"|"MY_FEED"|'COMMUNITY'|'USER'|'MY_FEED')/i
+    ];
+    for (const [filename, text] of sourceContent) {
+        const rel = relativeFile(root, filename);
+        if (/\/\/\s*vise:\s*target-type rationale/i.test(text)) {
+            continue;
+        }
+        const hasCreatePost = /\bcreatePost\b/.test(text);
+        if (!hasCreatePost)
+            continue;
+        for (const pattern of TARGET_TYPE_PATTERNS) {
+            if (pattern.test(text)) {
+                findings.push(finding(ruleId, "warning", `A createPost call appears to hardcode targetType to a literal community or user.`, rel, "Feed targets should be passed dynamically (e.g. from props or intent extras) so the composer component is reusable. If this is intentional, add comment // vise: target-type rationale — <reason>."));
+                break;
+            }
+        }
+    }
+    return findings;
+}