@amityco/social-plus-vise 1.3.0 → 1.4.0

package/dist/tools/project.js

@@ -1,6 +1,7 @@
 import { access, readdir, readFile, stat } from "node:fs/promises";
 import path from "node:path";
 import { productFindingIdentity } from "../productExpectations.js";
+import { sidecarDir } from "../sidecar.js";
 import { objectInput, optionalStringField, stringField, textResult } from "../types.js";
 import { findCallExpressions, findSwiftFunctionLocalDeclarations, parse, tryParse, pickLabeledArgument, pickObjectProperty, resolveLiteralValue, stripComments } from "./ast.js";
 async function exists(filePath) {
@@ -95,6 +96,13 @@ async function inspectRoot(root) {
             reason: "react-native dependency or script signal",
         });
     }
+    const hasJsSignal = signals.some((signal) => signal.platform === "typescript" || signal.platform === "react-native");
+    if (!hasJsSignal) {
+        const sourceSignal = await detectSdkSignalFromSource(root);
+        if (sourceSignal) {
+            signals.push(sourceSignal);
+        }
+    }
     const rawPlatforms = Array.from(new Set(signals.map((signal) => signal.platform)));
     const hasRN = rawPlatforms.includes("react-native");
     const hasAndroid = rawPlatforms.includes("android");
@@ -105,6 +113,198 @@ async function inspectRoot(root) {
             : rawPlatforms;
     return { platforms, signals, designSignals: await detectDesignSignals(root) };
 }
+async function detectSdkSignalFromSource(root) {
+    const sourceFiles = await findFiles(root, [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".html", ".htm"], 500);
+    if (sourceFiles.length === 0) {
+        return null;
+    }
+    const sourceContent = await readMany(sourceFiles);
+    const rnFiles = filesMatching(sourceContent, [/@amityco\/ts-sdk-react-native/]);
+    if (rnFiles.length > 0) {
+        return { platform: "react-native", file: path.relative(root, rnFiles[0]), reason: "social.plus React Native SDK usage detected in source (no manifest)." };
+    }
+    const tsSpecifier = filesMatching(sourceContent, [/@amityco\/ts-sdk/]);
+    if (tsSpecifier.length > 0) {
+        return { platform: "typescript", file: path.relative(root, tsSpecifier[0]), reason: "social.plus TypeScript/JS SDK usage detected in source (no manifest — e.g. CDN/esm dynamic import)." };
+    }
+    const createClientFiles = filesMatching(sourceContent, [/Client\s*\.\s*createClient/, /\bcreateClient\s*\(/]);
+    const corroborated = containsAny(sourceContent, [/\bPostRepository\b/, /\bCommentRepository\b/, /\bChannelRepository\b/, /\bMessageRepository\b/, /\bsessionWillRenewAccessToken\b/]);
+    if (createClientFiles.length > 0 && corroborated) {
+        return { platform: "typescript", file: path.relative(root, createClientFiles[0]), reason: "social.plus SDK API usage detected in source (createClient + repositories/session handler), no manifest." };
+    }
+    return null;
+}
+function hasSdkSourceUsage(sourceContent, platform) {
+    const implContent = new Map([...sourceContent].filter(([file]) => !/\.(?:d\.)?ts$/i.test(path.basename(file)) || !path.basename(file).endsWith(".d.ts")));
+    const content = implContent.size > 0 ? implContent : sourceContent;
+    const patterns = platform === "flutter"
+        ? [
+            /import\s+['"]package:amity_sdk\/amity_sdk\.dart['"]/,
+            /\bAmityCoreClient\b/,
+            /\bAmitySocialClient\b/,
+            /\bAmityUIKit\d*Manager\b/,
+            /\bAmity(?:Post|Comment|Community|Channel|Message|User)\b/,
+        ]
+        : platform === "ios"
+            ? [
+                /\bAmityUIKit\d*Manager\s*\.\s*(?:setup|registerDevice)\b/,
+                /\bAmityCollection\s*</,
+                /\.observe\s*\(/,
+                /\b(?:Amity)?[A-Za-z]*(?:Post|Comment|Community|Channel|Message|User|Reaction|Notification|Invitation|File|Room)[A-Za-z]*Repository(?:\s*\([^)]*\))?\s*\.\s*(?:get|query|create|update|delete|flag|join|leave|follow|unfollow|register|unregister)\w*\s*\(/,
+                /\b(?:get|query|create|update|delete|flag|join|leave|follow|unfollow)(?:Posts?|Comments?|Communit(?:y|ies)|Channels?|Messages?|Users?|Followers?|Followings?|Members?|Invitations?|Settings|Room|Rooms)?\s*\(/,
+                /\b(?:registerPushNotification|unregisterPushNotification)\s*\(/,
+                /\bnotificationManager\s*\.\s*getSettings\s*\(/,
+            ]
+            : [
+                /@amityco\/ts-sdk(?:-react-native)?/,
+                /\bClient\s*\.\s*(?:createClient|login)\b/,
+                /\bAmity(?:UIKit|UiKit)Provider\b/,
+                /\b(?:Post|Comment|Community|Channel|Message|User|Reaction|Notification)Repository\b/,
+                /\bcreate(?:Post|Comment|Channel|Message)\b/,
+                /\bget(?:Posts|Comments|Communities|Channels|Messages|Users|Followers|Followings)\b/,
+            ];
+    return containsAny(content, patterns);
+}
+function hasFeedSourceUsage(sourceContent, platform) {
+    const implContent = new Map([...sourceContent].filter(([file]) => {
+        const basename = path.basename(file);
+        return !(basename.endsWith(".d.ts") || basename.endsWith(".md"));
+    }));
+    const content = implContent.size > 0 ? implContent : sourceContent;
+    const patterns = platform === "flutter"
+        ? [
+            /\bAmitySocialClient\s*\.\s*newPostRepository\s*\(/,
+            /\bAmityPostRepository\b/,
+            /\bAmityPost\b/,
+            /\bcreate(?:Text|Image|Video|File|Poll|Clip|Room)?Post\b/,
+            /\b(?:get|query)Posts?\b/,
+        ]
+        : platform === "ios"
+            ? [
+                /\b(?:Amity)?[A-Za-z]*Post[A-Za-z]*Repository(?:\s*\([^)]*\))?\s*\.\s*(?:get|query|create|update|delete|flag)\w*\s*\(/,
+                /\b(?:query|get|create|edit|delete|flag)Posts?\s*\(/,
+                /\bcreate(?:Text|Image|Video|File|Poll|Clip|Room)?Post\s*\(/,
+                /\bAmityPost\b/,
+                /\bpost\s*\.\s*data\b/,
+                /\bcommentsCount\b/,
+                /\bpostId\b/,
+            ]
+            : [
+                /\bPostRepository\b/,
+                /\b(?:query|get|create|edit|delete|flag)Posts?\b/,
+                /\bcreate(?:Text|Image|Video|File|Poll|Clip|Room)?Post\b/,
+                /\bAmityPost\b/,
+                /\bAmity\s*\.\s*Post\b/,
+                /\bAmityPostContent\b/,
+                /\bpost\s*\.\s*data\b/,
+                /\bcommentsCount\b/,
+                /\bpostId\b/,
+            ];
+    return containsAny(content, patterns);
+}
+async function shouldRequireFeedSourceUsage(root) {
+    return await sidecarOutcomeInScope(root, "add-feed");
+}
+async function hasInstalledFeedBlockSource(root) {
+    const payload = await readJsonObjectIfExists(path.join(sidecarDir(root), "blocks.json"));
+    const installed = Array.isArray(payload?.installed) ? payload.installed : [];
+    for (const item of installed) {
+        if (!isJsonObject(item)) {
+            continue;
+        }
+        const blockId = typeof item.blockId === "string" ? item.blockId : "";
+        const capabilities = Array.isArray(item.providesCapabilities)
+            ? item.providesCapabilities.filter((value) => typeof value === "string")
+            : [];
+        const isFeedBlock = blockId === "feed" && capabilities.some((id) => id === "pagination" || id === "comment-preview");
+        if (isFeedBlock && await installedBlockEntryStillValid(root, item)) {
+            return true;
+        }
+    }
+    return false;
+}
+async function hasInstalledSdkBlockSource(root) {
+    const payload = await readJsonObjectIfExists(path.join(sidecarDir(root), "blocks.json"));
+    const installed = Array.isArray(payload?.installed) ? payload.installed : [];
+    for (const item of installed) {
+        if (!isJsonObject(item)) {
+            continue;
+        }
+        const dependencyName = typeof item.dependencyName === "string" ? item.dependencyName : "";
+        if (!dependencyName.startsWith("@socialplus/blocks-")) {
+            continue;
+        }
+        if (await installedBlockEntryStillValid(root, item)) {
+            return true;
+        }
+    }
+    return false;
+}
+async function installedBlockEntryStillValid(root, entry) {
+    const dependencyName = typeof entry.dependencyName === "string" ? entry.dependencyName : "";
+    if (!dependencyName) {
+        return false;
+    }
+    const platform = typeof entry.platform === "string" ? entry.platform : "";
+    if (platform === "flutter") {
+        const pubspec = await readIfExists(path.join(root, "pubspec.yaml"));
+        if (!new RegExp(`\\b${escapeRegExp(dependencyName)}\\s*:`).test(pubspec)) {
+            return false;
+        }
+    }
+    else {
+        const packageJson = await readIfExists(path.join(root, "package.json"));
+        if (!hasPackageDependency(packageJson, dependencyName)) {
+            return false;
+        }
+    }
+    const filesTouched = Array.isArray(entry.filesTouched) ? entry.filesTouched : [];
+    for (const touched of filesTouched) {
+        if (typeof touched !== "string" || touched.trim() === "") {
+            return false;
+        }
+        if (!(await exists(path.join(root, touched)))) {
+            return false;
+        }
+    }
+    return true;
+}
+async function sidecarOutcomeInScope(root, outcome) {
+    const dir = sidecarDir(root);
+    for (const file of ["compliance.json", "intake.json", "engagement.json"]) {
+        const payload = await readJsonObjectIfExists(path.join(dir, file));
+        if (!payload) {
+            continue;
+        }
+        if (payload.outcome === outcome || jsonArrayIncludes(payload.outcomes, outcome)) {
+            return true;
+        }
+        const scope = isJsonObject(payload.scope) ? payload.scope : undefined;
+        if (scope && jsonArrayIncludes(scope.outcomes, outcome)) {
+            return true;
+        }
+    }
+    return false;
+}
+async function readJsonObjectIfExists(filePath) {
+    const raw = await readIfExists(filePath);
+    if (!raw) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        return isJsonObject(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isJsonObject(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function jsonArrayIncludes(value, expected) {
+    return Array.isArray(value) && value.includes(expected);
+}
 export const inspectProjectTool = {
     name: "inspect_project",
     description: "Inspect a customer repository and detect likely platform/framework signals.",
@@ -200,8 +400,10 @@ async function validateAndroid(root) {
     const versionCatalogContent = await readMany(versionCatalogFiles);
     const sourceFiles = await findFiles(root, [".kt", ".java"], 300);
     const sourceContent = await readMany(sourceFiles);
-    const setupFiles = filesMatching(sourceContent, [/AmityCoreClient\s*\.\s*setup/, /AmityClient\s*\.\s*setup/]);
-    const loginFiles = filesMatching(sourceContent, [/AmityCoreClient\s*\.\s*login/, /AmityClient\s*\.\s*login/]);
+    const setupFiles = filesMatching(sourceContent, [/AmityCoreClient\s*\.\s*setup/, /AmityClient\s*\.\s*setup/, /AmityUIKit\d*Manager\s*\.\s*setup/]);
+    const coreLoginFiles = filesMatching(sourceContent, [/AmityCoreClient\s*\.\s*login/, /AmityClient\s*\.\s*login/]);
+    const uikitLoginFiles = filesMatching(sourceContent, [/AmityUIKit\d*Manager\s*\.\s*registerDevice/]);
+    const loginFiles = [...new Set([...coreLoginFiles, ...uikitLoginFiles])];
     const pushRegistrationFiles = filesMatching(sourceContent, [/registerPushNotification/, /enablePushNotification/, /PushNotification/]);
     const pushUnregisterFiles = filesMatching(sourceContent, [/unregisterPushNotification/, /disablePushNotification/, /unregister.*DeviceToken/i]);
     const liveDataFiles = filesMatching(sourceContent, [/LiveCollection/, /LiveObject/, /\.observe\s*\(/, /AmitySocialClient\s*\.\s*newPostRepository/, /\bgetPosts\s*\(/, /queryPosts\s*\(/, /getPost\s*\(/]);
@@ -242,8 +444,8 @@ async function validateAndroid(root) {
     if (loginFiles.length === 0) {
         findings.push(finding("android.login.present", "warning", "No obvious social.plus login call was found.", undefined, "Call login after the app has a known user identity, and before subscribing to social.plus collections."));
     }
-    else if (!containsAny(sourceContent, [/sessionWillRenewAccessToken/, /AmitySessionHandler/, /renewal\s*\.\s*renew\s*\(/])) {
-        findings.push(finding("android.session.renewal", "warning", "Login was found but no SessionHandler with session renewal was detected.", relativeFile(root, loginFiles[0]), "Pass a SessionHandler to login and call renewal.renew() in sessionWillRenewAccessToken so sessions refresh in production."));
+    else if (coreLoginFiles.length > 0 && !hasSessionRenewalCall(sourceContent)) {
+        findings.push(finding("android.session.renewal", "warning", "Login was found but no SessionHandler with session renewal was detected.", relativeFile(root, coreLoginFiles[0]), "Pass a SessionHandler to login and call renewal.renew() in sessionWillRenewAccessToken so sessions refresh in production."));
     }
     if (pushRegistrationFiles.length > 0 && pushUnregisterFiles.length === 0) {
         findings.push(finding("android.push.unregister.present", "warning", "Push registration was found but no obvious unregister call was detected.", relativeFile(root, pushRegistrationFiles[0]), "Unregister device tokens on logout or user switch so notifications are not sent to the wrong user."));
@@ -276,6 +478,7 @@ async function validateAndroid(root) {
     findings.push(...validatePollVoteStatusGuard(root, "android", sourceContent));
     findings.push(...validateFollowStatusSubscription(root, "android", sourceContent));
     findings.push(...validatePostDataTypeHandled(root, "android", sourceContent));
+    findings.push(...validatePostBodyRendered(root, "android", sourceContent));
     findings.push(...validateAvatarFromSdk(root, "android", sourceContent));
     findings.push(...validatePollAnswerDataShape(root, "android", sourceContent));
     findings.push(...validateCommentsQueryHasLimit(root, "android", sourceContent));
@@ -313,22 +516,42 @@ async function validateAndroid(root) {
 async function validateFlutter(root) {
     const findings = [];
     const pubspec = await readIfExists(path.join(root, "pubspec.yaml"));
+    const pubspecLock = await readIfExists(path.join(root, "pubspec.lock"));
     const dartFiles = await findFiles(path.join(root, "lib"), [".dart"], 300);
     const dartContent = await readMany(dartFiles);
-    const setupFiles = filesMatching(dartContent, [/AmityCoreClient\s*\.\s*setup/]);
-    const loginFiles = filesMatching(dartContent, [/AmityCoreClient\s*\.\s*login/]);
+    const setupFiles = filesMatching(dartContent, [/AmityCoreClient\s*\.\s*setup/, /AmityUIKit\d*Manager\s*\.\s*setup/]);
+    const coreLoginFiles = filesMatching(dartContent, [/AmityCoreClient\s*\.\s*login/]);
+    const uikitLoginFiles = filesMatching(dartContent, [/AmityUIKit\d*Manager\s*\.\s*registerDevice/]);
+    const loginFiles = [...new Set([...coreLoginFiles, ...uikitLoginFiles])];
     const pushRegistrationFiles = filesMatching(dartContent, [/registerPushNotification/, /registerDeviceNotification/, /enablePushNotification/, /PushNotification/]);
     const pushUnregisterFiles = filesMatching(dartContent, [/unregisterPushNotification/, /unregisterDeviceNotification/, /disablePushNotification/]);
     const liveDataFiles = filesMatching(dartContent, [/LiveCollection/, /LiveObject/, /\.listen\s*\(/, /\.observe\s*\(/, /queryPosts\s*\(/, /getPost\s*\(/]);
+    const hasAmitySdkDependency = Boolean(pubspec && /\bamity_sdk\s*:/.test(pubspec));
     if (!pubspec) {
         findings.push(finding("flutter.pubspec.present", "warning", "No pubspec.yaml file was found.", "pubspec.yaml", "Point repoPath at the Flutter project root."));
     }
-    else if (!/\bamity_sdk\s*:/.test(pubspec) && !pubspec.toLowerCase().includes("amity")) {
+    else if (!hasAmitySdkDependency && !pubspec.toLowerCase().includes("amity")) {
         findings.push(finding("flutter.dependency.sdk", "warning", "No obvious social.plus/Amity dependency was found in pubspec.yaml.", "pubspec.yaml", "Add the Flutter SDK dependency from the Flutter quick-start docs."));
     }
-    else if (/\bamity_sdk\s*:\s*(?:any|\*|latest)\b/i.test(pubspec)) {
-        findings.push(finding("flutter.sdk.version.pinned", "warning", "The Flutter SDK dependency uses an uncontrolled version (e.g. any / a moving git ref), not a pinned version or reviewed semver range.", "pubspec.yaml", "Pin amity_sdk to an explicit version or reviewed semver range so CI does not pick up unreviewed SDK APIs."));
+    else if (flutterAmitySdkIsFloating(pubspec)) {
+        findings.push(finding("flutter.sdk.version.pinned", "warning", "The Flutter SDK dependency uses an uncontrolled version (any / * / latest / a bare or open-ended range / a moving git ref), not a pinned version or reviewed semver range.", "pubspec.yaml", "Pin amity_sdk to an explicit version or reviewed semver range so CI does not pick up unreviewed SDK APIs."));
     }
+    if (pubspec && hasAmitySdkDependency) {
+        const sdkSourceSatisfiedByBlock = await hasInstalledSdkBlockSource(root);
+        const feedSourceRequired = await shouldRequireFeedSourceUsage(root);
+        const feedSourceSatisfiedByBlock = feedSourceRequired ? await hasInstalledFeedBlockSource(root) : false;
+        const dioProblem = flutterDioCompatibilityProblem(pubspec, pubspecLock);
+        if (dioProblem) {
+            findings.push(finding("flutter.dependency.dio-compatible", "warning", dioProblem.message, dioProblem.file, "Add a direct `dio: 5.9.2` dependency or a bounded `<5.10.0` constraint, then run `flutter pub get` and verify pubspec.lock resolves dio below 5.10.0 before building Android."));
+        }
+        if (!sdkSourceSatisfiedByBlock && !hasSdkSourceUsage(dartContent, "flutter")) {
+            findings.push(finding("flutter.sdk.source-used", "warning", "The Flutter SDK dependency is installed, but no social.plus SDK import or API usage was found in lib/*.dart.", "pubspec.yaml", "Route the product surface to real SDK-backed code: import package:amity_sdk/amity_sdk.dart, initialize/login, and query or create the target community/feed/chat/profile data. A dependency-only or static social shell is not a completed integration."));
+        }
+        if (feedSourceRequired && !feedSourceSatisfiedByBlock && !hasFeedSourceUsage(dartContent, "flutter")) {
+            findings.push(finding("flutter.feed.source-used", "warning", "The active Flutter source uses social.plus, but no feed/post SDK API usage was found.", "pubspec.yaml", "For an add-feed surface, route product UI to post/feed source: query or create posts through AmitySocialClient.newPostRepository()/AmityPostRepository, render SDK post data, and wire composer/comment/reaction affordances. Community-only SDK usage is not a feed integration."));
+        }
+    }
+    findings.push(...validateFlutterUnrenderedSdkData(root, dartContent));
     if (setupFiles.length === 0) {
         findings.push(finding("flutter.setup.present", "warning", "No obvious AmityCoreClient.setup call was found in lib/*.dart.", undefined, "Call AmityCoreClient.setup before any social.plus API usage."));
     }
@@ -339,12 +562,19 @@ async function validateFlutter(root) {
         if (!containsAnyForFiles(dartContent, setupFiles, [/AmityEndpoint\./, /\bendpoint\s*:/, /\bregion\s*:/, /\bhttpEndpoint\s*:/i, /\bmqttEndpoint\s*:/i, /\buploadEndpoint\s*:/i, /\bAmityRegional(?:Http|Mqtt)Endpoint\b/, /\bAmityRegion\b/])) {
             findings.push(finding("flutter.setup.region", "warning", "SDK setup was found but no explicit endpoint/region marker was detected.", relativeFile(root, setupFiles[0]), "Set the endpoint/region explicitly to match the customer's social.plus console project."));
         }
+        if ((coreLoginFiles.length > 0 || liveDataFiles.length > 0) && !containsAnyForFiles(dartContent, setupFiles, [/\bsycInitialization\s*:\s*true\b/])) {
+            findings.push(finding("flutter.setup.sync-initialization", "warning", "Flutter SDK setup is followed by login or live queries but does not request synchronous SDK initialization.", relativeFile(root, setupFiles[0]), "Pass `sycInitialization: true` to `AmityCoreClient.setup(...)`, or otherwise gate every login/query on a proven SDK-ready signal. Without this, runtime can fail with `MessageDbAdapter not ready` while build/analyze still pass."));
+        }
     }
     if (loginFiles.length === 0) {
         findings.push(finding("flutter.login.present", "warning", "No obvious AmityCoreClient.login call was found.", undefined, "Call login after the app has a known user identity and before social.plus queries/subscriptions."));
     }
-    else if (!containsAny(dartContent, [/sessionWillRenewAccessToken/, /AmitySessionHandler/, /SessionHandler/, /renewal\s*\.\s*renew\s*\(/])) {
-        findings.push(finding("flutter.session.renewal", "warning", "Login was found but no session handler callback with session renewal was detected.", relativeFile(root, loginFiles[0]), "Pass a session handler callback (AccessTokenRenewal renewal) to login and call renewal.renew() in sessionWillRenewAccessToken so sessions refresh in production."));
+    else if (coreLoginFiles.length > 0 && !hasSessionRenewalCall(dartContent)) {
+        findings.push(finding("flutter.session.renewal", "warning", "Login was found but no session handler callback with session renewal was detected.", relativeFile(root, coreLoginFiles[0]), "Pass a session handler callback (AccessTokenRenewal renewal) to login and call renewal.renew() in sessionWillRenewAccessToken so sessions refresh in production."));
+    }
+    const sessionObserverFiles = filesMatching(dartContent, [/AmityCoreClient\.observeSessionState\s*\(\s*\)\s*\.listen/]);
+    if (coreLoginFiles.length > 0 && sessionObserverFiles.length > 0 && !hasFlutterInitialLoginKickoff(dartContent)) {
+        findings.push(finding("flutter.session.initial-login-kickoff", "warning", "Flutter login appears to depend only on observeSessionState listener emissions, with no immediate initial login/session kickoff.", relativeFile(root, sessionObserverFiles[0]), "After subscribing to observeSessionState(), also seed the current session path immediately: call the idempotent login method from initState/Future.microtask/addPostFrameCallback, or otherwise synchronously drive the NotLoggedIn/Established branch. Do not rely on the listener to emit the initial state before the first screenshot."));
     }
     if (pushRegistrationFiles.length > 0 && pushUnregisterFiles.length === 0) {
         findings.push(finding("flutter.push.unregister.present", "warning", "Push registration was found but no obvious unregister call was detected.", relativeFile(root, pushRegistrationFiles[0]), "Unregister device tokens on logout or user switch so notifications are not sent to the wrong user."));
@@ -353,8 +583,8 @@ async function validateFlutter(root) {
     if (flutterPayloadFiles.length > 0 && pushRegistrationFiles.length > 0 && !containsAny(dartContent, [/AmityPush/, /handlePushNotification/, /didReceiveAmityNotification/, /EkoPushNotification/, /amityPushMessaging/, /registerDeviceForPush/, /handleAmityPush/])) {
         findings.push(finding("flutter.push.payload-contract-respected", "warning", "Push payload handler (FirebaseMessaging) exists but no social.plus push forwarding call was detected.", relativeFile(root, flutterPayloadFiles[0]), "Forward incoming Firebase push payloads to the social.plus SDK push handler (e.g. AmityPush.handleNotification) so social notifications are routed correctly."));
     }
-    if (liveDataFiles.length > 0 && !containsAny(dartContent, [/StreamSubscription/, /\.cancel\s*\(/, /dispose\s*\(/])) {
-        findings.push(finding("flutter.live.cleanup", "warning", "Live Object/Collection stream observation was found but no obvious cleanup was detected.", relativeFile(root, liveDataFiles[0]), "Store the subscription and cancel it from dispose or the owning lifecycle cleanup."));
+    if (liveDataFiles.length > 0 && !containsAnyStripped(dartContent, "flutter", [/\.cancel\s*\(/, /\bdispose\s*\(/])) {
+        findings.push(finding("flutter.live.cleanup", "warning", "Live Object/Collection stream observation was found but no obvious cleanup was detected.", relativeFile(root, liveDataFiles[0]), "Store the subscription and cancel it (.cancel()) from dispose() or the owning lifecycle cleanup. Declaring a StreamSubscription field alone does not cancel the stream."));
     }
     findings.push(...validateLiteralGuardrails(root, "flutter", dartContent));
     findings.push(...validateLoggingHygiene(root, "flutter", dartContent));
@@ -373,6 +603,7 @@ async function validateFlutter(root) {
     findings.push(...validateBlockedUsers(root, "flutter", dartContent));
     findings.push(...validatePollVoteStatusGuard(root, "flutter", dartContent));
     findings.push(...validatePostDataTypeHandled(root, "flutter", dartContent));
+    findings.push(...validatePostBodyRendered(root, "flutter", dartContent));
     findings.push(...validateAvatarFromSdk(root, "flutter", dartContent));
     findings.push(...validatePollAnswerDataShape(root, "flutter", dartContent));
     findings.push(...validateCommentsQueryHasLimit(root, "flutter", dartContent));
@@ -410,8 +641,12 @@ async function validateTypeScript(root, platform) {
     const packageJson = await readIfExists(path.join(root, "package.json"));
     const sourceFiles = await findFiles(root, [".ts", ".tsx", ".js", ".jsx"], 500);
     const sourceContent = await readMany(sourceFiles);
-    const setupFiles = filesMatching(sourceContent, [/Client\s*\.\s*createClient/, /Client\s*\.\s*create\s*\(/, /createClient\s*\(/]);
-    const loginFiles = filesMatching(sourceContent, [/Client\s*\.\s*login/, /\.login\s*\(/]);
+    const setupFiles = filesMatching(sourceContent, [/Client\s*\.\s*createClient/, /Client\s*\.\s*create\s*\(/, /createClient\s*\(/, /Amity(?:UIKit|UiKit)Provider/]);
+    const rawLoginFiles = filesMatching(sourceContent, [/Client\s*\.\s*login/, /\.login\s*\(/]);
+    const uikitLoginFiles = [...sourceContent]
+        .filter(([, content]) => /Amity(?:UIKit|UiKit)Provider/.test(content) && /\buserId\b/.test(content))
+        .map(([file]) => file);
+    const loginFiles = [...new Set([...rawLoginFiles, ...uikitLoginFiles])];
     const pushRegistrationFiles = filesMatching(sourceContent, [/registerPushNotification/, /enablePushNotification/, /PushNotification/]);
     const implContent = new Map([...sourceContent].filter(([f]) => !path.basename(f).endsWith('.d.ts')));
     const pushUnregisterFiles = filesMatching(implContent, [/unregisterPushNotification/, /disablePushNotification/]);
@@ -423,9 +658,34 @@ async function validateTypeScript(root, platform) {
     else if (!packageJson.includes("@amityco/ts-sdk") && !packageJson.toLowerCase().includes("amity")) {
         findings.push(finding("typescript.dependency.sdk", "warning", "No obvious social.plus/Amity package was found in package.json.", "package.json", "Add the TypeScript SDK dependency from the web quick-start docs."));
     }
-    else if (isFloatingPackageDependency(packageJson, "@amityco/ts-sdk")) {
-        findings.push(finding(`${platform}.sdk.version.pinned`, "warning", "The TypeScript SDK dependency uses an uncontrolled version (latest / * / x), not a pinned version or reviewed semver range (^/~ is accepted).", "package.json", "Pin @amityco/ts-sdk to an explicit version or reviewed semver range so CI does not pick up unreviewed SDK APIs."));
+    else if (isFloatingPackageDependency(packageJson, "@amityco/ts-sdk") || isFloatingPackageDependency(packageJson, "@amityco/ts-sdk-react-native")) {
+        findings.push(finding(`${platform}.sdk.version.pinned`, "warning", "The social.plus SDK dependency uses an uncontrolled version (latest / * / x), not a pinned version or reviewed semver range (^/~ is accepted).", "package.json", "Pin the social.plus SDK (@amityco/ts-sdk, or @amityco/ts-sdk-react-native for React Native) to an explicit version or reviewed semver range so CI does not pick up unreviewed SDK APIs."));
+    }
+    const hasTsSdkDependency = hasPackageDependency(packageJson, "@amityco/ts-sdk") || hasPackageDependency(packageJson, "@amityco/ts-sdk-react-native");
+    const sdkSourceSatisfiedByBlock = hasTsSdkDependency ? await hasInstalledSdkBlockSource(root) : false;
+    const feedSourceRequired = await shouldRequireFeedSourceUsage(root);
+    const feedSourceSatisfiedByBlock = feedSourceRequired ? await hasInstalledFeedBlockSource(root) : false;
+    if (hasTsSdkDependency && !sdkSourceSatisfiedByBlock && !hasSdkSourceUsage(sourceContent, platform)) {
+        findings.push(finding(`${platform}.sdk.source-used`, "warning", "The social.plus SDK dependency is installed, but no SDK import, provider, client setup, or repository usage was found in source files.", "package.json", "Route the product surface to real SDK-backed code: import the social.plus SDK or UIKit provider, initialize/login, and query or create the target community/feed/chat/profile data. A dependency-only or static social shell is not a completed integration."));
     }
+    if (hasTsSdkDependency && feedSourceRequired && !feedSourceSatisfiedByBlock && !hasFeedSourceUsage(sourceContent, platform)) {
+        findings.push(finding(`${platform}.feed.source-used`, "warning", "The active source uses social.plus, but no feed/post SDK API usage was found.", "package.json", "For an add-feed surface, route product UI to post/feed source: query or create posts through PostRepository, render SDK post data, and wire composer/comment/reaction affordances. Community-only SDK usage is not a feed integration."));
+    }
+    findings.push(...validateRuntimeProbeUi(root, platform, sourceContent));
+    if (platform === "react-native" && hasPackageDependency(packageJson, "@amityco/ts-sdk-react-native") && !hasPackageDependency(packageJson, "@react-native-async-storage/async-storage")) {
+        findings.push(finding("react-native.dependency.async-storage", "warning", "The React Native social.plus SDK is present, but @react-native-async-storage/async-storage is not listed in package.json.", "package.json", "Add @react-native-async-storage/async-storage as an app dependency and rebuild the native app so React Native autolinks the storage module required by the SDK. A TypeScript build can pass while the APK crashes with `NativeModule: AsyncStorage is null`."));
+    }
+    if (platform === "react-native" && hasPackageDependency(packageJson, "@amityco/ts-sdk-react-native") && !hasPackageDependency(packageJson, "@react-native-community/netinfo")) {
+        findings.push(finding("react-native.dependency.netinfo", "warning", "The React Native social.plus SDK is present, but @react-native-community/netinfo is not listed in package.json.", "package.json", "Add @react-native-community/netinfo as an app dependency and rebuild the native app so React Native autolinks RNCNetInfo. A TypeScript or Gradle build can pass while the APK crashes with `@react-native-community/netinfo: NativeModule.RNCNetInfo is null`."));
+    }
+    const asyncStorageVersion = packageDependencyVersion(packageJson, "@react-native-async-storage/async-storage");
+    if (platform === "react-native" &&
+        hasPackageDependency(packageJson, "@amityco/ts-sdk-react-native") &&
+        asyncStorageVersion &&
+        !isReactNativeAsyncStorageVersionCompatible(asyncStorageVersion)) {
+        findings.push(finding("react-native.dependency.async-storage-compatible", "warning", `@react-native-async-storage/async-storage is declared as ${asyncStorageVersion}, which is likely incompatible with the current social.plus React Native SDK dependency graph.`, "package.json", "Use an AsyncStorage v1.x range compatible with @amityco/ts-sdk-react-native 7.x, such as ^1.24.0, then reinstall so npm dedupes to a single AsyncStorage copy. Installing the latest 2.x/3.x package can leave the SDK using a nested JS copy while the native module is registered from another package, causing `NativeModule: AsyncStorage is null` at runtime."));
+    }
+    findings.push(...validateNoInternalSdkImports(root, platform, sourceContent));
     if (setupFiles.length === 0) {
         findings.push(finding("typescript.client.create", "warning", "No obvious TypeScript client initialization pattern was found.", undefined, "Create the social.plus client before login and before API usage."));
     }
@@ -436,7 +696,8 @@ async function validateTypeScript(root, platform) {
         if (!setupHasKeywordRegion && !setupHasNamedRegionDecl && !projectHasEnvRegion) {
             findings.push(finding("typescript.client.region", "warning", "Client initialization was found but no explicit region or endpoint marker was detected.", relativeFile(root, setupFiles[0]), "Pass the region or endpoint that matches the customer's social.plus console project. Reuse the app's existing config or environment source of truth if one exists, and do not hardcode a guessed default region just to make setup appear green."));
         }
-        const renderCycleSetup = setupFiles.find((file) => /useEffect|function\s+[A-Z]\w*\s*\(|const\s+[A-Z]\w*\s*=/.test(sourceContent.get(file) ?? ""));
+        const componentColocatedWithSetup = /useEffect|function\s+[A-Z]\w*\s*\(|const\s+[A-Z]\w*(?:\s*:\s*[^=]+)?\s*=\s*(?:React\.)?(?:memo\(|forwardRef\(|\([^)]*\)\s*(?::[^=>]+)?=>|[A-Za-z_$][\w$]*\s*=>|function\b|class\b)/;
+        const renderCycleSetup = setupFiles.find((file) => componentColocatedWithSetup.test(sourceContent.get(file) ?? ""));
         if (renderCycleSetup && platform === "react-native") {
             findings.push(finding("react-native.setup.lifecycle", "warning", "Client setup appears near component lifecycle code.", relativeFile(root, renderCycleSetup), "Keep client setup in a stable app initialization module to avoid duplicate initialization on remount."));
         }
@@ -444,9 +705,10 @@ async function validateTypeScript(root, platform) {
     if (loginFiles.length === 0) {
         findings.push(finding("typescript.login.present", "warning", "No obvious social.plus login call was found.", undefined, "Call login after the app has a known user identity, and await it before subscribing to live collections."));
     }
-    if (loginFiles.length > 0 && !containsAny(sourceContent, [/sessionWillRenewAccessToken/, /sessionHandler/, /renewal\.renew/])) {
-        findings.push(finding(`${platform}.session.renewal`, "warning", "Login was found but no access-token renewal handler marker was detected.", relativeFile(root, loginFiles[0]), "Implement a session handler that renews the access token (sessionWillRenewAccessToken + renewal.renew()) in the existing login path so sessions refresh in production. Preserve the current session owner and retain the handler for the full session lifetime."));
+    if (rawLoginFiles.length > 0 && !hasSessionRenewalCall(sourceContent)) {
+        findings.push(finding(`${platform}.session.renewal`, "warning", "Login was found but no access-token renewal handler marker was detected.", relativeFile(root, rawLoginFiles[0]), "Implement a session handler that renews the access token (sessionWillRenewAccessToken + renewal.renew()) in the existing login path so sessions refresh in production. Preserve the current session owner and retain the handler for the full session lifetime."));
     }
+    findings.push(...validateClientSessionStateAfterCreate(root, platform, sourceContent));
     if (pushRegistrationFiles.length > 0 && pushUnregisterFiles.length === 0) {
         findings.push(finding(`${platform}.push.unregister.present`, "warning", "Push registration was found but no obvious unregister call was detected.", relativeFile(root, pushRegistrationFiles[0]), "Unregister device tokens when the user logs out or the component unmounts. In React/React Native, return the unregister call from useEffect: return () => { NotificationRepository.unregisterPushNotification(deviceToken).catch(() => {}); }. Also update any local registration-state you maintain. Missing unregistration means notifications continue arriving after logout, which is a privacy and UX bug."));
     }
@@ -455,7 +717,9 @@ async function validateTypeScript(root, platform) {
     }
     findings.push(...validateLiteralGuardrails(root, platform, sourceContent));
     findings.push(...validateLoggingHygiene(root, platform, sourceContent));
+    findings.push(...validateUnsafeUserContentHtml(root, platform, sourceContent));
     findings.push(...validateFeedUiStates(root, platform, sourceContent));
+    findings.push(...validateLoadingStatePresent(root, platform, sourceContent));
     findings.push(...validateFeedPagination(root, platform, sourceContent));
     findings.push(...validateFeedModerationAffordance(root, platform, sourceContent));
     findings.push(...validateLogoutOnUserSwitch(root, platform, sourceContent));
@@ -475,7 +739,9 @@ async function validateTypeScript(root, platform) {
     findings.push(...validatePostsStatusFilter(root, platform, sourceContent));
     findings.push(...validateActivityPostsTagFilter(root, platform, sourceContent));
     findings.push(...validatePostDataTypeHandled(root, platform, sourceContent));
+    findings.push(...validatePostBodyRendered(root, platform, sourceContent));
     findings.push(...validateAvatarFromSdk(root, platform, sourceContent));
+    findings.push(...validateSdkFieldShape(root, platform, sourceContent));
     findings.push(...validatePollAnswerDataShape(root, platform, sourceContent));
     findings.push(...validateCommentsQueryHasLimit(root, platform, sourceContent));
     findings.push(...validateCommentCreationAffordance(root, platform, sourceContent));
@@ -513,6 +779,111 @@ async function validateTypeScript(root, platform) {
     findings.push(...(await validateEnvSecretHygiene(root, platform, sourceContent)));
     return findings;
 }
+function validateNoInternalSdkImports(root, platform, sourceContent) {
+    if (platform !== "typescript" && platform !== "react-native") {
+        return [];
+    }
+    const findings = [];
+    const internalImportPattern = /(?:from\s*["']|import\s*\(\s*["']|require\s*\(\s*["'])(@amityco\/ts-sdk(?:-react-native)?\/[^"']+)/g;
+    for (const [file, raw] of sourceContent) {
+        if (path.basename(file).endsWith(".d.ts")) {
+            continue;
+        }
+        const content = commentStripped(file, platform, raw);
+        let match;
+        internalImportPattern.lastIndex = 0;
+        while ((match = internalImportPattern.exec(content)) !== null) {
+            findings.push(finding(`${platform}.sdk.no-internal-imports`, "warning", `Source imports an internal social.plus SDK subpath: ${match[1]}.`, relativeFile(root, file), "Import social.plus APIs only from the package root (`@amityco/ts-sdk` or `@amityco/ts-sdk-react-native`). Do not deep-import from `dist/`, `src/`, `client/`, or event internals; Metro/release bundling can fail even when TypeScript or Jest passes. Use documented top-level exports such as Client and repositories."));
+            break;
+        }
+    }
+    return findings;
+}
+function validateRuntimeProbeUi(root, platform, sourceContent) {
+    if (platform !== "react-native") {
+        return [];
+    }
+    const findings = [];
+    for (const [file, raw] of sourceContent) {
+        if (path.basename(file).endsWith(".d.ts")) {
+            continue;
+        }
+        const content = commentStripped(file, platform, raw);
+        const rel = relativeFile(root, file);
+        if (/<Text[^>]*>\s*Runtime\s*<\/Text>|["'`]Runtime["'`]|Waiting for (?:crew discovery|feed|profile context)|(?:crew discovery|feed sync|profile graph)[^"'`\n]*needs another pass|services are available for this member|\bProbeRow\b/i.test(content)) {
+            findings.push(finding("react-native.ui.runtime-probe-copy", "warning", "React Native product UI appears to expose runtime/probe status copy instead of normal product state.", rel, "Keep runtime proof in BENCHMARK_AGENT_NOTES.md, screenshots, or sp-vise evidence. The visible app should render SDK-returned communities, posts, comments, reactions, and profile/follow state as product UI, not a Runtime/Probe/status panel."));
+        }
+        if (/\bvoid\s+(?:ReactionRepository|PostRepository|CommentRepository|CommunityRepository|Client)\b|hiddenTouchTarget|Keep reaction services warm|opacity\s*:\s*0[\s\S]{0,220}(?:ReactionRepository|services warm)/i.test(content)) {
+            findings.push(finding("react-native.ui.hidden-sdk-noop-control", "warning", "React Native source appears to add a hidden/no-op SDK control instead of a real visible affordance.", rel, "Do not satisfy SDK-usage scanners with hidden controls or `void Repository` markers. Wire visible product actions to real SDK calls, such as add/remove reaction, create post/comment, report content, or follow/unfollow."));
+        }
+    }
+    return findings;
+}
+function validateFlutterUnrenderedSdkData(root, sourceContent) {
+    const findings = [];
+    const sdkDataQueryPattern = /\bAmity(?:Post|Comment|Community|Channel|Message|User|Follow|Reaction|Notification)Repository\b|\bAmitySocialClient\b|\bnew(?:Post|Comment|Community|Channel|Message|User)Repository\s*\(|\bget(?:Posts|Post|Comments|Communities|Community|Channels|Messages|Users|Followers|Followings|Members|RecommendedCommunities|TrendingCommunities)\b|\bcreate(?:Post|Comment|Community|Channel|Message)\b|\baddReaction\b|\bremoveReaction\b|\bflag(?:Post|Comment|Message)\b/i;
+    const sdkListStatePattern = /\b(?:final\s+)?List\s*<\s*Amity(?:Post|Comment|Community|Channel|Message|User|CommunityMember)[^>]*>\s+(_?[A-Za-z][A-Za-z0-9_]*)\s*=/g;
+    for (const [file, raw] of sourceContent) {
+        const content = commentStripped(file, "flutter", raw);
+        if (!sdkDataQueryPattern.test(content)) {
+            continue;
+        }
+        const buildStart = content.indexOf("Widget build(");
+        const buildContent = buildStart >= 0 ? content.slice(buildStart) : "";
+        let match;
+        sdkListStatePattern.lastIndex = 0;
+        while ((match = sdkListStatePattern.exec(content)) !== null) {
+            const variableName = match[1];
+            const usagePattern = new RegExp(`\\b${escapeRegExp(variableName)}\\b`, "g");
+            const usageCount = content.match(usagePattern)?.length ?? 0;
+            const usedInBuild = new RegExp(`\\b${escapeRegExp(variableName)}\\b`).test(buildContent);
+            if (usageCount <= 3 || !usedInBuild) {
+                findings.push(finding("flutter.ui.sdk-data-rendered", "warning", `Flutter source stores SDK data in "${variableName}" but does not render or otherwise consume it from the widget tree.`, relativeFile(root, file), "Render SDK-returned communities/posts/comments/users in the visible product UI, pass them into a rendered child widget, or remove the unused query. Hidden SDK queries and unused state are not runtime-visible product proof."));
+                break;
+            }
+        }
+    }
+    return findings;
+}
+function validateClientSessionStateAfterCreate(root, platform, sourceContent) {
+    if (platform !== "typescript" && platform !== "react-native") {
+        return [];
+    }
+    const findings = [];
+    const sessionStatePattern = /\bClient\s*\.\s*isConnected\s*\(/g;
+    for (const [file, raw] of sourceContent) {
+        if (path.basename(file).endsWith(".d.ts")) {
+            continue;
+        }
+        const content = commentStripped(file, platform, raw);
+        let match;
+        sessionStatePattern.lastIndex = 0;
+        while ((match = sessionStatePattern.exec(content)) !== null) {
+            if (clientStateReadHasLocalGuard(content, match.index)) {
+                continue;
+            }
+            if (clientStateReadHasSameFunctionCreate(content, match.index)) {
+                continue;
+            }
+            findings.push(finding(`${platform}.client.session-state-after-create`, "warning", "Client session state is read before this file proves the client has been created.", relativeFile(root, file), "Do not call Client.isConnected() from module scope, React state initializers, or other code that can run before Client.createClient(...). Track a local `clientCreated`/`clientReady` flag, return a safe not-ready state until setup runs, and only call Client.isConnected() after the createClient path has completed. Otherwise React Native can crash at launch with `Amity SDK (800000): There is no active client`."));
+            break;
+        }
+    }
+    return findings;
+}
+function clientStateReadHasLocalGuard(content, callIndex) {
+    const prefix = content.slice(Math.max(0, callIndex - 220), callIndex);
+    const guardName = /\b(?:clientCreated|hasClient|clientReady|isClientReady|clientInitialized|isClientInitialized|clientReadyRef\.current|clientCreatedRef\.current)\b/;
+    if (!guardName.test(prefix)) {
+        return false;
+    }
+    return /(?:&&|\?|if\s*\([^)]*)\s*$/.test(prefix) || /\bif\s*\([^)]*(?:clientCreated|hasClient|clientReady|isClientReady|clientInitialized|isClientInitialized|clientReadyRef\.current|clientCreatedRef\.current)[^)]*\)\s*\{?[^{};]{0,160}$/.test(prefix);
+}
+function clientStateReadHasSameFunctionCreate(content, callIndex) {
+    const functionStart = Math.max(content.lastIndexOf("function ", callIndex), content.lastIndexOf("=>", callIndex));
+    const localPrefix = content.slice(functionStart >= 0 ? functionStart : Math.max(0, callIndex - 300), callIndex);
+    return /(?:\bClient\s*\.\s*createClient\b|\bClient\s*\.\s*create\s*\(|\bcreateClient\s*\()/.test(localPrefix);
+}
 async function validateEnvSecretHygiene(root, platform, sourceContent) {
     const findings = [];
     if (platform === "typescript") {
@@ -588,7 +959,7 @@ function validateClientNoSsrInit(root, sourceContent) {
         const isServerContext = serverContextPathPatterns.some((p) => p.test(basename)) || serverContextContentPatterns.some((p) => p.test(content));
         if (isServerContext) {
             findings.push(finding("typescript.client.no-ssr-init", "error", "TypeScript SDK client must not be initialized in a server-side context.", relativeFile(root, file), "If this is a Next.js project, SDK initialization must happen client-side only. Wrap the client initialization call (Client.create() or createClient()) in a 'use client' component, a useEffect, or use dynamic() with { ssr: false }. Do not call it in a Server Component, layout file, or getServerSideProps."));
-            break;
+            continue;
         }
     }
     return findings;
@@ -602,7 +973,13 @@ function validateLoggingHygiene(root, platform, sourceContent) {
     const piiShape = /\b(user[_-]?name|display[_-]?name|full[_-]?name|email|phone|phone[_-]?number|address|date[_-]?of[_-]?birth|dob|ssn|national[_-]?id)\b/i;
     const findings = [];
     for (const [file, content] of sourceContent) {
+        const rel = relativeFile(root, file);
+        let firedSecret = false;
+        let firedPii = false;
         for (const line of content.split(/\r?\n/)) {
+            if (firedSecret && firedPii) {
+                break;
+            }
             if (!logCallPattern.test(line)) {
                 continue;
             }
@@ -610,19 +987,85 @@ function validateLoggingHygiene(root, platform, sourceContent) {
             if (trimmed.startsWith("//") || trimmed.startsWith("#") || trimmed.startsWith("*") || trimmed.startsWith("/*")) {
                 continue;
             }
-            if (secretShape.test(line) && !findings.some((f) => f.ruleId === `${platform}.logging.no-secret-in-log`)) {
-                findings.push(finding(`${platform}.logging.no-secret-in-log`, "warning", "A logging call appears to reference a secret-shaped identifier (apiKey, accessToken, etc.).", relativeFile(root, file), "Do not log secret-shaped values. Drop the log line, redact the value, or attest that the value being logged is a placeholder."));
-            }
-            if (piiShape.test(line) && !findings.some((f) => f.ruleId === `${platform}.logging.no-pii-in-log`)) {
-                findings.push(finding(`${platform}.logging.no-pii-in-log`, "warning", "A logging call appears to reference a PII-shaped identifier (userName, email, phone, displayName, etc.).", relativeFile(root, file), "Do not log user PII. Redact the value, use an anonymized ID, or attest that the data is not real user PII."));
+            if (!firedSecret && secretShape.test(line)) {
+                findings.push(finding(`${platform}.logging.no-secret-in-log`, "warning", "A logging call appears to reference a secret-shaped identifier (apiKey, accessToken, etc.).", rel, "Do not log secret-shaped values. Drop the log line, redact the value, or attest that the value being logged is a placeholder."));
+                firedSecret = true;
             }
-            if (findings.length >= 2) {
-                return findings;
+            if (!firedPii && piiShape.test(line)) {
+                findings.push(finding(`${platform}.logging.no-pii-in-log`, "warning", "A logging call appears to reference a PII-shaped identifier (userName, email, phone, displayName, etc.).", rel, "Do not log user PII. Redact the value, use an anonymized ID, or attest that the data is not real user PII."));
+                firedPii = true;
             }
         }
     }
     return findings;
 }
+const SOCIAL_PLUS_USER_CONTENT_MARKER = /@amityco\/ts-sdk|\b(?:PostRepository|CommentRepository|CommunityRepository|UserRepository|MessageRepository|FeedRepository|ChannelRepository)\b|\b(?:post|comment|message|community|user|member|profile|channel|author|creator)s?\s*(?:\?\.|\.)\s*(?:data|metadata|displayName|avatar|avatarUrl|avatarFileId|postedUserId|userId|text|description|name)\b|\b(?:postedUserId|displayName|avatarUrl|avatarFileId)\b/i;
+const HTML_SANITIZER_MARKER = /\b(?:DOMPurify\s*\.\s*sanitize|sanitizeHtml|escapeHtml|escapeHTML|encodeHTML|htmlEscape)\s*\(/i;
+function validateUnsafeUserContentHtml(root, platform, sourceContent) {
+    if (platform !== "typescript") {
+        return [];
+    }
+    const findings = [];
+    for (const [file, raw] of sourceContent) {
+        if (path.basename(file).endsWith(".d.ts")) {
+            continue;
+        }
+        const content = commentStripped(file, platform, raw);
+        if (!SOCIAL_PLUS_USER_CONTENT_MARKER.test(content)) {
+            continue;
+        }
+        const riskyBindings = collectUserContentBindings(content);
+        const riskyExpression = riskyHtmlExpressionPattern(riskyBindings);
+        const sinks = htmlSinkExpressions(content);
+        if (!sinks.some((expression) => isUnsafeUserContentHtmlExpression(expression, riskyExpression))) {
+            continue;
+        }
+        findings.push(finding("typescript.security.no-unsafe-inner-html", "warning", "SDK/user-shaped content is rendered through innerHTML or another raw HTML sink.", relativeFile(root, file), "Render SDK text with textContent/createTextNode/React text children, or sanitize with DOMPurify before using innerHTML, insertAdjacentHTML, or dangerouslySetInnerHTML."));
+    }
+    return findings;
+}
+function collectUserContentBindings(content) {
+    const bindings = new Set();
+    const declaration = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)/g;
+    let match;
+    while ((match = declaration.exec(content)) !== null) {
+        if (SOCIAL_PLUS_USER_CONTENT_MARKER.test(match[2])) {
+            bindings.add(match[1]);
+        }
+    }
+    return bindings;
+}
+function riskyHtmlExpressionPattern(bindings) {
+    const bindingPattern = [...bindings].map(escapeRegExp).join("|");
+    const basePattern = [
+        "\\b(?:post|posts|comment|comments|message|messages|community|communities|user|users|member|members|profile|channel|author|creator)\\b",
+        "\\b(?:postedUserId|displayName|avatarUrl|avatarFileId|creatorId|userId)\\b",
+        "\\b(?:err|error)\\s*\\.\\s*message\\b",
+    ];
+    if (bindingPattern) {
+        basePattern.push(`\\b(?:${bindingPattern})\\b`);
+    }
+    return new RegExp(basePattern.join("|"), "i");
+}
+function htmlSinkExpressions(content) {
+    const expressions = [];
+    collectMatches(content, /\.\s*innerHTML\s*=\s*([\s\S]{0,1200}?)(?:;|\n\s*\n|$)/g, expressions);
+    collectMatches(content, /\.\s*insertAdjacentHTML\s*\(\s*["'][^"']+["']\s*,\s*([\s\S]{0,1200}?)(?:\)\s*;?|\n\s*\n|$)/g, expressions);
+    collectMatches(content, /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:\s*([\s\S]{0,1200}?)(?:\}\s*\}|$)/g, expressions);
+    return expressions;
+}
+function collectMatches(content, pattern, expressions) {
+    let match;
+    while ((match = pattern.exec(content)) !== null) {
+        expressions.push(match[1] ?? "");
+    }
+}
+function isUnsafeUserContentHtmlExpression(expression, riskyExpression) {
+    if (HTML_SANITIZER_MARKER.test(expression)) {
+        return false;
+    }
+    return riskyExpression.test(expression);
+}
 async function validateDesignReuse(root, platform, sourceContent) {
     const designSignals = await detectDesignSignals(root);
     if (designSignals.length === 0) {
@@ -711,6 +1154,7 @@ function validateFeedUiStates(root, platform, sourceContent) {
     if (!observationPatterns || !statePatterns) {
         return [];
     }
+    const findings = [];
     for (const [file, content] of sourceContent) {
         if (isNonUiSourceFile(file)) {
             continue;
@@ -727,11 +1171,43 @@ function validateFeedUiStates(root, platform, sourceContent) {
         if (hasStates) {
             continue;
         }
-        return [
-            finding(`${platform}.feed.ui-states-present`, "warning", "A source file observes a live data stream/collection but does not appear to render loading, empty, or error states.", relativeFile(root, file), "Render loading / empty / error states next to the live-data binding. Common markers: isLoading, error, empty, CircularProgressIndicator (Flutter), ProgressView (SwiftUI), CircularProgressIndicator (Compose)."),
-        ];
+        findings.push(finding(`${platform}.feed.ui-states-present`, "warning", "A source file observes a live data stream/collection but does not appear to render loading, empty, or error states.", relativeFile(root, file), "Render loading / empty / error states next to the live-data binding. Common markers: isLoading, error, empty, CircularProgressIndicator (Flutter), ProgressView (SwiftUI), CircularProgressIndicator (Compose)."));
     }
-    return [];
+    return findings;
+}
+const LOADING_MARKER_TSJS = /\bisLoading\b|\bisValidating\b|\bisPending\b|\bisFetching\b|\bfetching\b|\bbusy\b|\bloadingStatus\b|\bLoadingStatus\b|\bloading\b|\.loading\b|\bloader\b|\bSkeleton\b|\bShimmer\b|\bSpinner\b|\bActivityIndicator\b|\bCircularProgress\w*|\bLinearProgress\w*|\bProgressView\b|\bindeterminate\b|<\s*[\w.]*(?:Loading|Loader|Spinner|Spin|Skeleton|Shimmer|Placeholder|Progress)\w*|status\s*===?\s*['"`]pending['"`]/i;
+const LIVE_BINDING_TSJS = /\b(?:getPosts|getComments|getMembers|getChannels|getChannel|getMessages|getFollowInfo|getFollowers|getFollowings|getCommunities|getRecommendedCommunities|getTrendingCommunities|getUsers?)\s*\(/g;
+const SDK_DATA_CTX_TSJS = /(?:Post|Comment|Community|Channel|Message|User|Reaction)Repository\b|\bLiveCollection\b|\bLiveObject\b|\bAmityCollection\b/;
+function validateLoadingStatePresent(root, platform, sourceContent) {
+    const findings = [];
+    if (platform !== "typescript" && platform !== "react-native")
+        return findings;
+    for (const [file, content] of sourceContent) {
+        if (isNonUiSourceFile(file))
+            continue;
+        if (path.basename(file).endsWith(".d.ts"))
+            continue;
+        if (/\/\/\s*vise:\s*loading-state intentional/i.test(content))
+            continue;
+        const stripped = commentStripped(file, platform, content);
+        if (!SDK_DATA_CTX_TSJS.test(stripped))
+            continue;
+        const checkContent = blankDeadDeclarations(stripped, "(?:isLoading|loading|isPending|isFetching|loadingStatus)");
+        LIVE_BINDING_TSJS.lastIndex = 0;
+        let match;
+        let unguarded = false;
+        while ((match = LIVE_BINDING_TSJS.exec(checkContent)) !== null) {
+            const window = checkContent.slice(Math.max(0, match.index - 1000), match.index + 1500);
+            if (!LOADING_MARKER_TSJS.test(window)) {
+                unguarded = true;
+                break;
+            }
+        }
+        if (unguarded) {
+            findings.push(finding(`${platform}.feed.loading-state-present`, "warning", "A live-data binding renders with no loading state nearby — during the initial fetch the surface shows a blank/empty flash (or the empty-state copy) instead of a loading indicator.", relativeFile(root, file), "Render a loading state next to the live-data binding before the data resolves — a skeleton/spinner keyed off the SDK live object's loading status (`collection.loading` / `loadingStatus`), or a `useState(true)` flag cleared in the observer callback. Add `// vise: loading-state intentional` if this surface deliberately has none."));
+        }
+    }
+    return findings;
 }
 const LIVE_DATA_OBSERVATION_PATTERNS_BY_PLATFORM = {
     typescript: [/PostRepository\.getPosts/, /\.subscribe\s*\(/, /\.observe\s*\(/, /onSnapshot/],
@@ -937,7 +1413,7 @@ function validateComments(root, platform, sourceContent) {
         const hardcodedTarget = /(?:postId|commentId|referenceId)\s*[:=]\s*["'`][a-z0-9-]+["'`]/i.exec(content);
         if (hardcodedTarget) {
             findings.push(finding(`${platform}.comments.target-resolved`, "warning", "Comment code references a hardcoded postId/commentId. Comment targets should come from the parent entity, not be invented.", relativeFile(root, filePath), "Pass the parent post/entity ID from navigation or parent component props rather than hardcoding it."));
-            break;
+            continue;
         }
     }
     const isObserverContent = (c) => {
@@ -1067,7 +1543,7 @@ function validateChat(root, platform, sourceContent) {
             const hasConversationType = /createChannel[\s\S]{0,400}type\s*:\s*['"]conversation['"]/.test(content);
             if ((platform === "react-native" || platform === "typescript") && hasCommunityType && hasUserIds && !hasConversationType) {
                 findings.push(finding(`${platform}.chat.channel-type-dm`, "warning", "createChannel uses type 'community' with userIds, which indicates DM intent — but 'community' creates a discoverable group channel, not a private conversation.", relativeFile(root, filePath), "Use type: 'conversation' for 1-to-1 direct messages between known users. 'community' channels are discoverable group channels; passing userIds to createChannel with type:'community' does not create a private DM."));
-                break;
+                continue;
             }
         }
     }
@@ -1126,7 +1602,7 @@ function validateChatDeprecations(root, platform, sourceContent) {
                 if (DEPRECATED_MARKER_SYNC_ESCAPE.test(raw))
                     continue;
                 findings.push(finding(`${platform}.chat.deprecated-marker-sync`, "warning", "Chat code uses the deprecated MarkerSyncEngine receipt sync API (startMessageReceiptSync/stopMessageReceiptSync), which is being sun-set.", relativeFile(root, filePath), "MarkerSyncEngine receipt sync is deprecated. Track read state with the channel unread count (channel.unreadCount / getTotalChannelUnread) and mark read via markRead() — the unread-count APIs stay fully supported. Add `// vise: receipt-sync intentional — <reason>` only if you are deliberately staying on the legacy API during migration."));
-                break;
+                continue;
             }
         }
     }
@@ -1136,7 +1612,7 @@ function validateChatDeprecations(root, platform, sourceContent) {
             if (DEPRECATED_SUBCHANNEL_ESCAPE.test(raw))
                 continue;
             findings.push(finding(`${platform}.chat.deprecated-subchannel`, "warning", "Chat code manually manages sub-channels (createSubChannel/updateSubChannel/deleteSubChannel), a deprecated pattern that is being sun-set.", relativeFile(root, filePath), "Manual sub-channel management is deprecated. Use the channel's default sub-channel via channel.defaultSubChannelId (channel.getDefaultSubChannelId() on Android) — you do not need to create or query sub-channels separately. Add `// vise: subchannel-management intentional — <reason>` only if a multi-sub-channel layout is deliberately required."));
-            break;
+            continue;
         }
     }
     return findings;
@@ -1160,7 +1636,7 @@ function validateLivestreamDeprecation(root, platform, sourceContent) {
             if (DEPRECATED_LEGACY_STREAM_ESCAPE.test(raw))
                 continue;
             findings.push(finding(`${platform}.livestream.deprecated-stream`, "warning", "Livestream code uses the deprecated legacy Stream API (AmityStreamRepository/StreamRepository/getStreamById/createLiveStreamPost), which is being sun-set in favour of Room-based livestreaming.", relativeFile(root, filePath), "The legacy Stream feature is deprecated. Migrate to the Room API: AmityRoomRepository/RoomRepository.getRoom(roomId) (observe the returned room live object and handle all four statuses — idle/live/ended/recorded) and createRoomPost in place of createLiveStreamPost. Add `// vise: legacy-stream intentional — <reason>` only if you are deliberately staying on legacy Stream during migration."));
-            break;
+            continue;
         }
     }
     return findings;
@@ -1542,7 +2018,7 @@ function validateFollowStatusSubscription(root, platform, sourceContent) {
             /\/\/\s*vise:\s*one-shot follow status intentional/i.test(content))
             continue;
         findings.push(finding(ruleId, "warning", "getFollowInfo is called without a live subscription. Follow state will not update when the relationship changes.", rel, "Subscribe to the live object returned by getFollowInfo and dispose on cleanup: const unsubFollow = UserRepository.getFollowInfo(userId, ({ data }) => { if (data) setFollowStatus(data.status); }); return () => { unsubFollow(); };"));
-        break;
+        continue;
     }
     return findings;
 }
@@ -1945,6 +2421,7 @@ function validateSessionHandlerRetention(root, platform, sourceContent) {
     const handlerFiles = filesMatching(sourceContent, presenceMarkers);
     if (handlerFiles.length === 0)
         return [];
+    const findings = [];
     const badPattern = SESSION_HANDLER_BAD_PATTERNS[platform];
     const goodPatterns = SESSION_HANDLER_GOOD_PATTERNS[platform] ?? SESSION_HANDLER_GOOD_PATTERNS.typescript;
     for (const file of handlerFiles) {
@@ -1954,7 +2431,7 @@ function validateSessionHandlerRetention(root, platform, sourceContent) {
             if (tree) {
                 const locals = findSwiftFunctionLocalDeclarations(tree, /^\w*SessionHandler\b/);
                 if (locals.length > 0 && !containsAny(new Map([[file, content]]), goodPatterns)) {
-                    return [sessionHandlerRetainedFinding(platform, relativeFile(root, file))];
+                    findings.push(sessionHandlerRetainedFinding(platform, relativeFile(root, file)));
                 }
                 continue;
             }
@@ -1966,10 +2443,10 @@ function validateSessionHandlerRetention(root, platform, sourceContent) {
             if (hasGood) {
                 continue;
             }
-            return [sessionHandlerRetainedFinding(platform, relativeFile(root, file))];
+            findings.push(sessionHandlerRetainedFinding(platform, relativeFile(root, file)));
         }
     }
-    return [];
+    return findings;
 }
 function androidSessionHandlerRetained(file, content) {
     if (/\/\/\s*vise:\s*handler retained/.test(content))
@@ -2017,9 +2494,16 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
     if (inlineApiKey && !isAllowedPlaceholder(inlineApiKey.value)) {
         findings.push(finding(`${platform}.secret.inline-api-key`, "warning", "A social.plus API key appears to be hardcoded in source.", relativeFile(root, inlineApiKey.file), "Use the host app's environment/config pattern instead of committing API keys directly into source files. The literal is still committed even when wrapped in an env-fallback (e.g. `defaultValue:`, `??`, `||`, ternary)."));
     }
+    if (!findings.some((finding) => finding.ruleId === `${platform}.secret.inline-api-key`)) {
+        const keyShaped = firstLiteralAssignment(sourceContent, [/["'`]([0-9a-f]{48})["'`]/], platform);
+        if (keyShaped && !isAllowedPlaceholder(keyShaped.value)) {
+            findings.push(finding(`${platform}.secret.inline-api-key`, "warning", "A hardcoded social.plus API key (a 48-character hex literal) was found in source. This is flagged by VALUE, not property name — renaming the property (e.g. `apiKey` → `clientKey`) or moving the key into a separate config file the page still loads does NOT make it safe; the secret is still committed.", relativeFile(root, keyShaped.file), "Use the host app's environment/config pattern (a build-time env var or a server-injected value), not a literal in any source/config file shipped to the browser."));
+        }
+    }
     const literalUserId = firstLiteralAssignment(sourceContent, [
         /\buserId\s*[:=]\s*["'`]([^"'`]+)["'`]/i,
         /\buser_id\s*[:=]\s*["'`]([^"'`]+)["'`]/i,
+        /\b(?:currentUser|current_user|userIdentifier)\s*[:=]\s*["'`]([^"'`]+)["'`]/i,
         /\.login\s*\(\s*["'`]([^"'`]+)["'`]/i,
         /\.login\s*\(\s*userId\s*:\s*["'`]([^"'`]+)["'`]/i,
     ], platform);
@@ -2265,6 +2749,206 @@ function isFloatingPackageDependency(packageJson, dependencyName) {
     }
     return /^(?:latest|\*|x|X)$/i.test(version.trim());
 }
+function hasPackageDependency(packageJson, dependencyName) {
+    return packageDependencyVersion(packageJson, dependencyName) !== undefined;
+}
+function packageDependencyVersion(packageJson, dependencyName) {
+    let parsed;
+    try {
+        parsed = JSON.parse(packageJson);
+    }
+    catch {
+        return undefined;
+    }
+    return (parsed.dependencies?.[dependencyName] ??
+        parsed.devDependencies?.[dependencyName] ??
+        parsed.peerDependencies?.[dependencyName] ??
+        parsed.optionalDependencies?.[dependencyName]);
+}
+function isReactNativeAsyncStorageVersionCompatible(versionSpec) {
+    const normalized = versionSpec.trim();
+    if (!normalized) {
+        return false;
+    }
+    if (/^(?:latest|\*|x|X)$/i.test(normalized)) {
+        return false;
+    }
+    const exactMajor = normalized.match(/^(?:[~^<>=\s]*)?(\d+)(?:\.|\b)/);
+    if (!exactMajor) {
+        return true;
+    }
+    return Number(exactMajor[1]) <= 1;
+}
+function hasSessionRenewalCall(contents) {
+    return containsAny(contents, [
+        /sessionWillRenewAccessToken[\s\S]{0,400}renewal\s*\.\s*(?:renew|renewWithAuthToken)\s*\(/,
+        /renewal\s*\.\s*(?:renew|renewWithAuthToken)\s*\(/,
+    ]);
+}
+function hasFlutterInitialLoginKickoff(contents) {
+    const kickoff = String.raw `(?:unawaited\s*\(\s*)?(?:await\s+)?(?:_login\s*\([^;{}]*\)|AmityCoreClient\.login\s*\([^;{}]*\)|login\s*\([^;{}]*\))\s*\)?\s*;`;
+    const asyncKickoff = String.raw `(?:Future\.microtask|Future\.delayed|WidgetsBinding\.instance\.addPostFrameCallback)\s*\([\s\S]{0,180}(?:_login\s*\(|AmityCoreClient\.login\s*\()`;
+    for (const [file, content] of contents) {
+        const stripped = commentStripped(file, "flutter", content);
+        if (!/AmityCoreClient\.observeSessionState\s*\(\s*\)\s*\.listen/.test(stripped)) {
+            continue;
+        }
+        const initStateAfterObserverCall = new RegExp(String.raw `initState\s*\(\s*\)\s*\{[\s\S]{0,1400}_observeSessionState\s*\(\s*\)\s*;[\s\S]{0,500}(?:${kickoff}|${asyncKickoff})`);
+        if (initStateAfterObserverCall.test(stripped)) {
+            return true;
+        }
+        const observerListen = stripped.match(/AmityCoreClient\.observeSessionState\s*\(\s*\)\s*\.listen[\s\S]{0,2600}^\s*\}\s*\)\s*;/m);
+        if (observerListen) {
+            const afterListen = stripped.slice((observerListen.index ?? 0) + observerListen[0].length, (observerListen.index ?? 0) + observerListen[0].length + 700);
+            if (new RegExp(String.raw `(?:${kickoff}|${asyncKickoff})`).test(afterListen)) {
+                return true;
+            }
+        }
+        const inlineObserverThenKickoff = new RegExp(String.raw `AmityCoreClient\.observeSessionState\s*\(\s*\)\s*\.listen[\s\S]{0,2600}\)\s*;[\s\S]{0,700}(?:${kickoff}|${asyncKickoff})`);
+        if (inlineObserverThenKickoff.test(stripped)) {
+            return true;
+        }
+    }
+    return false;
+}
+function flutterAmitySdkIsFloating(pubspec) {
+    const line = pubspec.match(/^[ \t]*amity_sdk[ \t]*:[ \t]*(.*)$/m);
+    if (!line)
+        return false;
+    const inline = (line[1] ?? "").replace(/#.*$/, "").trim();
+    if (inline === "" || inline === "|" || inline === ">") {
+        const after = pubspec.slice((line.index ?? 0) + line[0].length).split("\n");
+        const block = [];
+        for (const l of after) {
+            if (l.trim() === "" || /^[ \t]/.test(l))
+                block.push(l);
+            else
+                break;
+        }
+        const body = block.join("\n");
+        if (/\bgit\s*:/.test(body)) {
+            const ref = body.match(/\bref\s*:\s*["']?([^"'\n]+)["']?/);
+            if (!ref)
+                return true;
+            const r = ref[1].trim();
+            return !(/^[0-9a-f]{40}$/i.test(r) || /^v?\d+\.\d+\.\d+/.test(r));
+        }
+        if (/\b(?:path|hosted|sdk)\s*:/.test(body))
+            return false;
+        return body.trim() === "";
+    }
+    const v = inline.replace(/^["']|["']$/g, "").trim();
+    if (v === "" || v === "*" || /^(?:any|latest)$/i.test(v))
+        return true;
+    if (/^>=?/.test(v) && !v.includes("<"))
+        return true;
+    return false;
+}
+function flutterDioCompatibilityProblem(pubspec, pubspecLock) {
+    if (!flutterUsesAmitySdkSeven(pubspec, pubspecLock)) {
+        return undefined;
+    }
+    const lockedDioVersion = pubspecLock ? pubspecLockPackageVersion(pubspecLock, "dio") : undefined;
+    if (lockedDioVersion) {
+        if (compareLooseSemver(lockedDioVersion, "5.10.0") >= 0) {
+            return {
+                file: "pubspec.lock",
+                message: `pubspec.lock resolves dio ${lockedDioVersion}, but amity_sdk 7.x is not compatible with dio 5.10.0+ during Android builds because DioExceptionType.transformTimeout makes the SDK switch non-exhaustive.`,
+            };
+        }
+        return undefined;
+    }
+    const dioSpec = flutterPubspecDependencySpec(pubspec, "dio");
+    if (!dioSpec || !flutterDioConstraintStaysBelowFiveTen(dioSpec)) {
+        const description = dioSpec ? `declares dio ${dioSpec}` : "does not declare a direct dio dependency";
+        return {
+            file: "pubspec.yaml",
+            message: `pubspec.yaml ${description}, but amity_sdk 7.x needs dio pinned below 5.10.0 to avoid Android build failures from DioExceptionType.transformTimeout.`,
+        };
+    }
+    return undefined;
+}
+function flutterUsesAmitySdkSeven(pubspec, pubspecLock) {
+    const lockedAmityVersion = pubspecLock ? pubspecLockPackageVersion(pubspecLock, "amity_sdk") : undefined;
+    if (lockedAmityVersion) {
+        return looseSemverMajor(lockedAmityVersion) === 7;
+    }
+    const amitySpec = flutterPubspecDependencySpec(pubspec, "amity_sdk");
+    return amitySpec ? looseSemverMajor(amitySpec) === 7 : false;
+}
+function flutterPubspecDependencySpec(pubspec, dependencyName) {
+    const escaped = escapeRegExp(dependencyName);
+    const matches = [...pubspec.matchAll(new RegExp(`^[ \\t]*${escaped}[ \\t]*:[ \\t]*(.*)$`, "gm"))];
+    const line = matches.at(-1);
+    if (!line)
+        return undefined;
+    const inline = stripYamlLineComment(line[1] ?? "").trim();
+    if (inline && inline !== "|" && inline !== ">") {
+        return inline.replace(/^["']|["']$/g, "").trim();
+    }
+    const after = pubspec.slice((line.index ?? 0) + line[0].length).split("\n");
+    const block = [];
+    for (const l of after) {
+        if (l.trim() === "" || /^[ \t]/.test(l))
+            block.push(l);
+        else
+            break;
+    }
+    const body = block.join("\n");
+    const version = body.match(/^[ \t]*version[ \t]*:[ \t]*["']?([^"'\n#]+)["']?/m);
+    return version?.[1]?.trim();
+}
+function pubspecLockPackageVersion(pubspecLock, packageName) {
+    const escaped = escapeRegExp(packageName);
+    const block = pubspecLock.match(new RegExp(`(?:^|\\n)[ \\t]{2}${escaped}:[\\r\\n]([\\s\\S]*?)(?=\\n[ \\t]{2}\\S|$)`));
+    if (!block)
+        return undefined;
+    const version = block[1].match(/(?:^|\n)[ \t]{4}version[ \t]*:[ \t]*["']?([^"'\n]+)["']?/);
+    return version?.[1]?.trim();
+}
+function stripYamlLineComment(value) {
+    return value.replace(/[ \t]+#.*$/, "");
+}
+function flutterDioConstraintStaysBelowFiveTen(spec) {
+    const normalized = spec.trim().replace(/^["']|["']$/g, "");
+    if (!normalized || /^(?:any|latest|\*|x)$/i.test(normalized)) {
+        return false;
+    }
+    if (/^5\.(?:[0-8]|9)(?:\.\d+)?(?:[+\-\w.]*)?$/.test(normalized)) {
+        return true;
+    }
+    if (/(?:^|\s)<\s*5\.10\.0(?:\s|$)/.test(normalized)) {
+        return true;
+    }
+    if (/(?:^|\s)<=\s*5\.9(?:\.\d+)?(?:\s|$)/.test(normalized)) {
+        return true;
+    }
+    if (/^~\s*5\.9(?:\.\d+)?/.test(normalized)) {
+        return true;
+    }
+    return false;
+}
+function looseSemverMajor(value) {
+    const match = value.match(/(?:^|[\s^~<>=])v?(\d+)(?:\.|\b)/);
+    return match ? Number.parseInt(match[1], 10) : undefined;
+}
+function compareLooseSemver(a, b) {
+    const pa = looseSemverParts(a);
+    const pb = looseSemverParts(b);
+    for (let i = 0; i < 3; i += 1) {
+        if (pa[i] !== pb[i])
+            return pa[i] - pb[i];
+    }
+    return 0;
+}
+function looseSemverParts(value) {
+    const match = value.match(/v?(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
+    return [
+        Number.parseInt(match?.[1] ?? "0", 10),
+        Number.parseInt(match?.[2] ?? "0", 10),
+        Number.parseInt(match?.[3] ?? "0", 10),
+    ];
+}
 function usesEnvSecretConfig(sourceContent) {
     return containsAny(sourceContent, [
         /import\.meta\.env\.[A-Z0-9_]*(?:AMITY|SOCIAL_PLUS|SOCIALPLUS)[A-Z0-9_]*(?:API[_-]?KEY|KEY)/i,
@@ -2302,29 +2986,122 @@ function gitignoreIgnoresEnvFiles(gitignore) {
         .map((line) => line.trim())
         .some((line) => line === ".env" || line === ".env*" || line === ".env.local" || line === "*.env" || line === ".env.*");
 }
+function projectYmlAmityPackageIsFloating(yml) {
+    if (!yml.trim())
+        return false;
+    const lines = yml.split(/\r?\n/);
+    const pkgHeader = lines.findIndex((l) => /^\s*packages\s*:/.test(l));
+    if (pkgHeader < 0)
+        return false;
+    const pkgIndent = (lines[pkgHeader].match(/^(\s*)/)?.[1] ?? "").length;
+    const entries = [];
+    let entryIndent = -1;
+    let cur = null;
+    for (let j = pkgHeader + 1; j < lines.length; j++) {
+        const line = lines[j];
+        if (line.trim() === "") {
+            cur?.push(line);
+            continue;
+        }
+        const ind = (line.match(/^(\s*)/)?.[1] ?? "").length;
+        if (ind <= pkgIndent)
+            break;
+        if (entryIndent === -1)
+            entryIndent = ind;
+        if (ind === entryIndent && /^\s*[\w".\-/]+\s*:/.test(line)) {
+            cur = [line];
+            entries.push(cur);
+        }
+        else {
+            cur?.push(line);
+        }
+    }
+    for (const entry of entries) {
+        const text = entry.join("\n");
+        const isAmity = /amity/i.test(entry[0] ?? "") || /url\s*:\s*\S*amity/i.test(text);
+        if (isAmity)
+            return /^\s*branch\s*:/im.test(text);
+    }
+    return false;
+}
+function pbxprojAmityPackageIsFloating(pbxproj) {
+    if (!pbxproj.trim())
+        return false;
+    const chunks = pbxproj.split(/XCRemoteSwiftPackageReference/).slice(1);
+    for (const chunk of chunks) {
+        if (/repositoryURL\s*=\s*"[^"]*amity[^"]*"/i.test(chunk)) {
+            return /kind\s*=\s*branch/i.test(chunk);
+        }
+    }
+    return false;
+}
+function iosAmitySdkIsFloating(s) {
+    if (/\.package\s*\([^)]*amity[^)]*\bbranch\s*:/is.test(s.pkg))
+        return true;
+    if (/^\s*pod\s+['"][^'"]*amity[^'"]*['"]\s*$/im.test(s.pod))
+        return true;
+    if (projectYmlAmityPackageIsFloating(s.yml))
+        return true;
+    if (pbxprojAmityPackageIsFloating(s.pbx))
+        return true;
+    return false;
+}
 async function validateIos(root) {
     const findings = [];
-    const manifestFiles = await existingFiles(root, ["Podfile", "Package.swift"]);
-    const manifestContent = await readMany(manifestFiles);
+    const joinExisting = async (names) => [...(await readMany(await existingFiles(root, names))).values()].join("\n");
+    const podText = await joinExisting(["Podfile"]);
+    const pkgSwiftText = await joinExisting(["Package.swift"]);
+    const projectYmlText = await joinExisting(["project.yml"]);
+    const rootEntries = await readdir(root, { withFileTypes: true }).catch(() => []);
+    const pbxprojPaths = [];
+    let pbxprojText = "";
+    for (const entry of rootEntries) {
+        if (entry.isDirectory() && /\.xcodeproj$/i.test(String(entry.name))) {
+            const p = path.join(root, String(entry.name), "project.pbxproj");
+            const content = await readIfExists(p);
+            if (content) {
+                pbxprojPaths.push(p);
+                pbxprojText += "\n" + content;
+            }
+        }
+    }
+    const manifestFiles = [
+        ...(await existingFiles(root, ["Podfile", "Package.swift", "project.yml"])),
+        ...pbxprojPaths,
+    ];
+    const manifestCombined = [podText, pkgSwiftText, projectYmlText, pbxprojText].join("\n");
+    const hasManifest = manifestCombined.trim().length > 0;
     const swiftFiles = await findFiles(root, [".swift", ".xcconfig", ".plist"], 400);
     const swiftContent = await readMany(swiftFiles);
-    const setupFiles = filesMatching(swiftContent, [/AmityClient\s*\(/, /AmityClient\s*\.\s*setup/]);
-    const loginFiles = filesMatching(swiftContent, [/\.login\s*\(/, /client\.login\s*\(/]);
+    const setupFiles = filesMatching(swiftContent, [/AmityClient\s*\(/, /AmityClient\s*\.\s*setup/, /AmityUIKit\d*Manager\s*\.\s*setup/]);
+    const coreLoginFiles = filesMatching(swiftContent, [/\.login\s*\(/, /client\.login\s*\(/]);
+    const uikitLoginFiles = filesMatching(swiftContent, [/AmityUIKit\d*Manager\s*\.\s*registerDevice/]);
+    const loginFiles = [...new Set([...coreLoginFiles, ...uikitLoginFiles])];
     const pushRegistrationFiles = filesMatching(swiftContent, [/registerPushNotification/, /enablePushNotification/]);
     const pushUnregisterFiles = filesMatching(swiftContent, [/unregisterPushNotification/, /disablePushNotification/]);
     const liveDataFiles = filesMatching(swiftContent, [/AmityCollection/, /AmityObject/, /\.observe\s*\(/, /getPost\s*\(/, /queryPosts\s*\(/]);
-    if (manifestFiles.length === 0) {
-        findings.push(finding("ios.dependency.manifest", "warning", "No Podfile or Package.swift was found.", undefined, "Point repoPath at the iOS project root or verify the dependency manager manually."));
+    if (!hasManifest) {
+        findings.push(finding("ios.dependency.manifest", "warning", "No iOS dependency manifest (Podfile, Package.swift, xcodegen project.yml, or .xcodeproj SwiftPM package references) was found.", undefined, "Point repoPath at the iOS project root or verify the dependency manager manually."));
     }
-    else if (!containsAny(manifestContent, [/Amity/i, /AmitySDK/i])) {
-        findings.push(finding("ios.dependency.sdk", "warning", "No obvious social.plus/Amity dependency was found in Podfile or Package.swift.", relativeFile(root, manifestFiles[0]), "Add the iOS SDK dependency from the iOS quick-start docs."));
+    else if (!/Amity/i.test(manifestCombined)) {
+        findings.push(finding("ios.dependency.sdk", "warning", "No obvious social.plus/Amity dependency was found in the iOS dependency manifest.", relativeFile(root, manifestFiles[0]), "Add the iOS SDK dependency from the iOS quick-start docs."));
     }
-    else if (containsAny(manifestContent, [/Amity-Social-Cloud-SDK-iOS-IPA/i])) {
+    else if (/Amity-Social-Cloud-SDK-iOS-IPA/i.test(manifestCombined)) {
         findings.push(finding("ios.dependency.swiftpm-repo", "warning", "The iOS SwiftPM dependency points at the obsolete Amity-Social-Cloud-SDK-iOS-IPA package repository.", relativeFile(root, manifestFiles[0]), "Use https://github.com/AmityCo/Amity-Social-Cloud-SDK-iOS-SwiftPM.git with product AmitySDK so SwiftPM can resolve the social.plus iOS SDK."));
     }
-    else if (containsAny(manifestContent, [/\.package\s*\([^)]*\bbranch\s*:/s, /pod\s+['"][^'"]*Amity[^'"]*['"]\s*$/m])) {
+    else if (iosAmitySdkIsFloating({ pod: podText, pkg: pkgSwiftText, yml: projectYmlText, pbx: pbxprojText })) {
         findings.push(finding("ios.sdk.version.pinned", "warning", "The iOS SDK dependency uses an uncontrolled version (a moving branch or unspecified CocoaPods version), not a pinned version or reviewed semver range.", relativeFile(root, manifestFiles[0]), "Pin the social.plus iOS SDK to an explicit version or reviewed semver range so CI does not pick up unreviewed SDK APIs."));
     }
+    const hasIosSdkDependency = /Amity/i.test(manifestCombined);
+    const sdkSourceSatisfiedByBlock = hasIosSdkDependency ? await hasInstalledSdkBlockSource(root) : false;
+    const feedSourceRequired = await shouldRequireFeedSourceUsage(root);
+    const feedSourceSatisfiedByBlock = feedSourceRequired ? await hasInstalledFeedBlockSource(root) : false;
+    if (hasIosSdkDependency && !sdkSourceSatisfiedByBlock && !hasSdkSourceUsage(swiftContent, "ios")) {
+        findings.push(finding("ios.sdk.source-used", "warning", "The iOS SDK dependency is installed, but product Swift source only initializes or references the SDK without using a real social.plus data API.", relativeFile(root, manifestFiles[0]), "Route the product surface to real SDK-backed code: retain the client/session handler, login/register the runtime user, then query or create the target community/feed/chat/profile data through an Amity repository or UIKit manager. AmityClient initialization plus static social cards is not a completed integration."));
+    }
+    if (hasIosSdkDependency && feedSourceRequired && !feedSourceSatisfiedByBlock && !hasFeedSourceUsage(swiftContent, "ios")) {
+        findings.push(finding("ios.feed.source-used", "warning", "The active iOS source uses social.plus, but no feed/post SDK API usage was found.", relativeFile(root, manifestFiles[0]), "For an add-feed surface, route product UI to post/feed source: query or create posts through AmityPostRepository, render SDK post data, and wire composer/comment/reaction affordances. Community-only SDK usage is not a feed integration."));
+    }
     if (setupFiles.length === 0) {
         findings.push(finding("ios.setup.present", "warning", "No obvious AmityClient initialization was found in Swift files.", undefined, "Initialize AmityClient before login and before social.plus API usage."));
     }
@@ -2340,8 +3117,8 @@ async function validateIos(root) {
     if (loginFiles.length === 0) {
         findings.push(finding("ios.login.present", "warning", "No obvious social.plus login call was found.", undefined, "Call login after the app has a known user identity and handle session renewal for production auth."));
     }
-    else if (!containsAny(swiftContent, [/sessionWillRenewAccessToken/, /AmitySessionHandler/, /renewal\.renew\s*\(/])) {
-        findings.push(finding("ios.session.renewal", "warning", "Login was found but no SessionHandler with sessionWillRenewAccessToken / renewal.renew() was detected.", relativeFile(root, loginFiles[0]), "Implement a SessionHandler and call renewal.renew() in sessionWillRenewAccessToken so the session can refresh in production."));
+    else if (coreLoginFiles.length > 0 && !hasSessionRenewalCall(swiftContent)) {
+        findings.push(finding("ios.session.renewal", "warning", "Login was found but no SessionHandler with sessionWillRenewAccessToken / renewal.renew() was detected.", relativeFile(root, coreLoginFiles[0]), "Implement a SessionHandler and call renewal.renew() in sessionWillRenewAccessToken so the session can refresh in production."));
     }
     if (pushRegistrationFiles.length > 0 && pushUnregisterFiles.length === 0) {
         findings.push(finding("ios.push.unregister.present", "warning", "Push registration was found but no obvious unregister call was detected.", relativeFile(root, pushRegistrationFiles[0]), "Unregister device tokens on logout or user switch so notifications are not sent to the wrong user."));
@@ -2353,8 +3130,20 @@ async function validateIos(root) {
     if (iosPayloadHandlerFiles.length > 0 && pushRegistrationFiles.length > 0 && !containsAny(swiftContent, [/AmityPush/, /handlePushNotification/, /didReceiveAmityNotification/, /EkoPushNotification/, /amityPushMessaging/, /registerDeviceForPush/, /handleAmityPush/])) {
         findings.push(finding("ios.push.payload-contract-respected", "warning", "Push payload handler exists but no social.plus push forwarding call was detected.", relativeFile(root, iosPayloadHandlerFiles[0]), "Forward incoming push payloads to the social.plus SDK push handler (e.g. AmityPush.handleNotification) so social notifications are routed correctly."));
     }
-    if (liveDataFiles.length > 0 && !containsAny(swiftContent, [/AmityNotificationToken/, /\.invalidate\s*\(/, /deinit/, /viewWillDisappear/])) {
-        findings.push(finding("ios.live.cleanup", "warning", "Live Object/Collection observation was found but no obvious cleanup was detected.", relativeFile(root, liveDataFiles[0]), "Keep the notification token and invalidate or release it when the view/controller lifecycle ends."));
+    const iosTokenNames = new Set();
+    for (const [file, content] of swiftContent) {
+        const stripped = commentStripped(file, "ios", content);
+        for (const m of stripped.matchAll(/\b(?:var|let)\s+([A-Za-z_]\w*)\s*:\s*AmityNotificationToken\b/g)) {
+            iosTokenNames.add(m[1]);
+        }
+    }
+    const iosTokenReleasedByNil = iosTokenNames.size > 0 &&
+        Array.from(swiftContent).some(([file, content]) => {
+            const stripped = commentStripped(file, "ios", content);
+            return Array.from(iosTokenNames).some((name) => new RegExp(`\\b${escapeRegExp(name)}\\s*=\\s*nil\\b`).test(stripped));
+        });
+    if (liveDataFiles.length > 0 && !iosTokenReleasedByNil && !containsAnyStripped(swiftContent, "ios", [/\.invalidate\s*\(/, /\bdeinit\b/, /viewWillDisappear/, /\.onDisappear\b/])) {
+        findings.push(finding("ios.live.cleanup", "warning", "Live Object/Collection observation was found but no obvious cleanup was detected.", relativeFile(root, liveDataFiles[0]), "Invalidate or release the AmityNotificationToken when the view/controller lifecycle ends (call .invalidate() in deinit / viewWillDisappear, release it in SwiftUI .onDisappear, or drop the last reference with `token = nil`). Storing the token alone does not stop observation."));
     }
     findings.push(...validateLiteralGuardrails(root, "ios", swiftContent));
     findings.push(...validateLoggingHygiene(root, "ios", swiftContent));
@@ -2377,6 +3166,7 @@ async function validateIos(root) {
     findings.push(...validatePollVoteStatusGuard(root, "ios", swiftContent));
     findings.push(...validateFollowStatusSubscription(root, "ios", swiftContent));
     findings.push(...validatePostDataTypeHandled(root, "ios", swiftContent));
+    findings.push(...validatePostBodyRendered(root, "ios", swiftContent));
     findings.push(...validateAvatarFromSdk(root, "ios", swiftContent));
     findings.push(...validatePollAnswerDataShape(root, "ios", swiftContent));
     findings.push(...validateCommentsQueryHasLimit(root, "ios", swiftContent));
@@ -2881,8 +3671,14 @@ function validateImagePostChildResolutionAwaited(root, platform, sourceContent)
     const ruleId = platform + '.image-post.child-resolution-awaited';
     for (const [filename, text] of sourceContent) {
         const rel = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
+        const hasImageAttachment = /createPost\s*\(\s*[^)]*\b(?:image|video|file)\b/i.test(text) ||
+            /\.(?:image|video|file)\s*\(/.test(text) ||
+            /\bAmity(?:Image|Video|File)\b/.test(text) ||
+            /\b(?:uploadImage|uploadVideo|uploadFile|fileId|attachments?)\b/.test(text) ||
+            /AmityDataType\.(?:IMAGE|VIDEO|FILE)/i.test(text);
         if (/createPost\s*\(/.test(text) &&
-            /(?:render|setState|display)\s*\(/.test(text)) {
+            /(?:render|setState|display)\s*\(/.test(text) &&
+            hasImageAttachment) {
             const hasResolution = /whenComplete/.test(text) ||
                 /whenReady/.test(text) ||
                 /childrenPosts.*await/.test(text) ||
@@ -3165,7 +3961,51 @@ function validatePostDataTypeHandled(root, platform, sourceContent) {
         if (guardPat.test(checkContent))
             continue;
         findings.push(finding(ruleId, "warning", "Post renderer reads text data without checking post.dataType. Non-text posts (image, video, file, poll) will render as blank.", relativeFile(root, file), "Branch on the post data type before accessing content. For TypeScript/React Native: switch on post.dataType (e.g. 'text', 'image', 'video'). For Android: when (post.getData()) { is AmityPost.Data.TEXT -> … is AmityPost.Data.IMAGE -> … }. For Flutter: check post.type == AmityDataType.TEXT. For iOS: check post.dataType. Add // vise: text-only post intentional if a single datatype is intentional."));
-        break;
+        continue;
+    }
+    return findings;
+}
+function validatePostBodyRendered(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.feed.post-body-rendered`;
+    const uiTextPat = {
+        typescript: /<\s*(?:article|section|div|p|span|Text)\b|\.textContent\s*=|\.innerText\s*=/,
+        "react-native": /<\s*(?:View|Text|Pressable|TouchableOpacity)\b|\bFlatList\b/,
+        flutter: /\b(?:Text|ListTile|Card|Column|Row)\s*\(/,
+        ios: /\b(?:UILabel|UITextView|Text\s*\(|cell\.textLabel|label\.text|addSubview)\b/,
+        android: /\b(?:Text\s*\(|TextView|\.text\s*=|setText\s*\()/,
+    };
+    const postSummaryPat = {
+        typescript: /\bpost\s*\??\.\s*(?:postId|commentsCount|reactionsCount)\b|\bpostId\b/,
+        "react-native": /\bpost\s*\??\.\s*(?:postId|commentsCount|reactionsCount)\b|\bpostId\b/,
+        flutter: /\b(?:post|_posts\s*\[[^\]]+\])\s*\.\s*(?:postId|commentsCount|reactionsCount)\b/,
+        ios: /\bpost\s*\.\s*(?:postId|commentsCount|reactionsCount)\b/,
+        android: /\bpost\s*\.\s*(?:postId|commentsCount|reactionsCount|getPostId|getCommentCount|getReactionCount)\b/,
+    };
+    const bodyAccessPat = {
+        typescript: /\bpost\s*\??\.\s*(?:text|description|caption)\b|\bpost\s*\??\.\s*data[\s\S]{0,140}\b(?:text|description|caption)\b|\b(?:render|format|get|build)(?:Post)?(?:Body|Text|Description|Caption)\s*\(\s*post\s*\)|<\s*(?:PostBody|PostText|PostDescription|PostContent)\b[^>]*\bpost=/i,
+        "react-native": /\bpost\s*\??\.\s*(?:text|description|caption)\b|\bpost\s*\??\.\s*data[\s\S]{0,140}\b(?:text|description|caption)\b|\b(?:render|format|get|build)(?:Post)?(?:Body|Text|Description|Caption)\s*\(\s*post\s*\)|<\s*(?:PostBody|PostText|PostDescription|PostContent)\b[^>]*\bpost=/i,
+        flutter: /\bpost\s*\.\s*(?:text|description|caption)\b|\bpost\s*\.\s*getData\s*<|\bAmityTextPost\b|\bAmityPostData\b|\b(?:postBody|postText|postDescription|postCaption)\s*\(\s*post\s*\)/i,
+        ios: /\bpost\s*\.\s*(?:text|description|caption)\b|\bpost\s*\.\s*getData\(\)\s*as\?[\s\S]{0,80}\bAmityPost\.Data\.TEXT\b|\bgetText\s*\(\s*\)|\b(?:postBody|postText|postDescription|postCaption)\s*\(\s*post\s*\)/i,
+        android: /\bpost\s*\.\s*(?:text|description|caption)\b|\bpost\s*\.\s*getData\(\)\s*as\??[\s\S]{0,80}\bAmityPost\.Data\.TEXT\b|\bAmityPost\.Data\.TEXT\b|\bgetText\s*\(\s*\)|\b(?:postBody|postText|postDescription|postCaption)\s*\(\s*post\s*\)/i,
+    };
+    const uiPat = uiTextPat[platform] ?? uiTextPat.typescript;
+    const summaryPat = postSummaryPat[platform] ?? postSummaryPat.typescript;
+    const bodyPat = bodyAccessPat[platform] ?? bodyAccessPat.typescript;
+    for (const [file, content] of sourceContent) {
+        if (path.basename(file).endsWith(".d.ts"))
+            continue;
+        if (/\/\/\s*vise:\s*post-body intentional/i.test(content))
+            continue;
+        const astLang = astLanguageForFile(file, platform);
+        const checkContent = astLang ? stripComments(astLang, content) : content;
+        if (!uiPat.test(checkContent))
+            continue;
+        if (!summaryPat.test(checkContent))
+            continue;
+        if (bodyPat.test(checkContent))
+            continue;
+        findings.push(finding(ruleId, "warning", "Post card renders post chrome or identifiers but does not appear to render the post body, description, or caption. Users can see an ID/count card with the actual post content missing.", relativeFile(root, file), "Render the normal post body/description/caption when present through SDK text/data accessors, and keep postId as a key or debug detail only. The post title field is optional and does not need to exist; do not require post.title, metadata.title, or a custom-payload title to satisfy this renderer."));
     }
     return findings;
 }
@@ -3250,7 +4090,64 @@ function validateAvatarFromSdk(root, platform, sourceContent) {
         if (avatarPat.test(checkContent))
             continue;
         findings.push(finding(ruleId, "warning", "Community or user display uses a string initial instead of the SDK-provided avatar URL.", relativeFile(root, file), "Check the avatar field before falling back to initials. For TypeScript/React Native: community.avatar?.fileUrl or user.avatar?.fileUrl. For Flutter: community.avatarImage?.getUrl(AmityImageSize.MEDIUM). For iOS: community.avatar?.fileURL. For Android: community.getAvatar()?.getUrl(). Add // vise: avatar fallback intentional if no avatar field is available in your SDK version."));
-        break;
+        continue;
+    }
+    return findings;
+}
+function validateSdkFieldShape(root, platform, sourceContent) {
+    const findings = [];
+    if (platform !== "typescript" && platform !== "react-native")
+        return findings;
+    const checks = [
+        {
+            id: "comment.author-field-shape",
+            ctx: /\bgetComments\b|\bCommentRepository\b|\bAmityComment\b|\bcomment\s*\??\.\s*commentId\b/,
+            wrong: /\bcomment\s*\??\.\s*user\b/,
+            marker: /\/\/\s*vise:\s*comment-author-shape intentional/i,
+            message: "Comment author is read from `comment.user`, a field that does not exist on Amity.Comment (the author is `comment.creator`). This reads undefined and silently falls back to a placeholder name/initial.",
+            recommendation: "Read the author from `comment.creator` (Amity.User): comment.creator?.displayName / comment.creator?.avatar. Add `// vise: comment-author-shape intentional` only if `comment` here is your own non-SDK wrapper object.",
+        },
+        {
+            id: "reaction.count-shape",
+            ctx: /\breactionsCount\b/,
+            wrong: /\breactionsCount\s*\??\.\s*(?!toString|toFixed|valueOf|toLocaleString|toPrecision|toExponential)[A-Za-z_]\w*/,
+            marker: /\/\/\s*vise:\s*reaction-count-shape intentional/i,
+            message: "`reactionsCount` is a number (the total reaction count), not a per-reaction map — `reactionsCount.<name>` is always undefined, so per-reaction counts render as 0/empty.",
+            recommendation: "Use the `reactions` Record for per-reaction counts (e.g. `reactions?.[name] ?? 0`) and `reactionsCount` for the total. Add `// vise: reaction-count-shape intentional` to override.",
+        },
+        {
+            id: "community.member-field-shape",
+            ctx: /\bgetMembers\b|\bQueryCommunityMembers\b|\bgetCommunityMembers\b|\bcommunityMembers\b/,
+            wrong: /\bmember\s*\??\.\s*displayName\b/,
+            correct: /\bmember\s*\??\.\s*user\s*\??\.\s*displayName\b/,
+            marker: /\/\/\s*vise:\s*member-field-shape intentional/i,
+            message: "A community member's display name is read from `member.displayName`, a field that does not exist on the membership object — the user lives at `member.user` (Amity.InternalUser). This renders undefined and falls back to the raw userId.",
+            recommendation: "Read `member.user?.displayName` (and member.user?.avatar). Add `// vise: member-field-shape intentional` only if `member` here is your own non-SDK shape.",
+        },
+        {
+            id: "follow.status-enum",
+            ctx: /\bgetFollowInfo\b|\bFollowInfo\b|\bfollowInfo\b/,
+            wrong: /\.\s*status\s*===?\s*['"`]following['"`]|['"`]following['"`]\s*===?\s*[A-Za-z_][\w.?]*\bstatus\b/,
+            marker: /\/\/\s*vise:\s*follow-status-enum intentional/i,
+            message: "FollowInfo.status is compared against 'following', which is NOT a valid value — FollowStatus is one of all|pending|accepted|blocked|none. A successful follow yields 'accepted', so `status === 'following'` is always false and the Follow/Following UI never reflects the followed state.",
+            recommendation: "Compare against the real status: `=== 'accepted'` for an accepted follow (`=== 'pending'` for a follow request). Add `// vise: follow-status-enum intentional` to override.",
+        },
+    ];
+    for (const [file, content] of sourceContent) {
+        if (path.basename(file).endsWith(".d.ts"))
+            continue;
+        const checkContent = commentStripped(file, platform, content);
+        for (const check of checks) {
+            if (check.marker.test(content))
+                continue;
+            if (!check.ctx.test(checkContent))
+                continue;
+            if (!check.wrong.test(checkContent))
+                continue;
+            if (check.correct && check.correct.test(checkContent))
+                continue;
+            findings.push(finding(`${platform}.${check.id}`, "warning", check.message, relativeFile(root, file), check.recommendation));
+        }
     }
     return findings;
 }
@@ -3290,7 +4187,7 @@ function validatePollAnswerDataShape(root, platform, sourceContent) {
         if (correctPat.test(checkContent))
             continue;
         findings.push(finding(ruleId, "warning", "Poll answer text is read as an object property (.data.text or .data?.text), but PollAnswer.data is a plain string.", relativeFile(root, file), "Use answer.data directly as the display text — it is already the string content. For image answers, use answer.image?.fileUrl (TypeScript/React Native) or the linked image object. Add // vise: poll-answer-shape intentional if the data field really is an object in your SDK version."));
-        break;
+        continue;
     }
     return findings;
 }
@@ -3338,7 +4235,7 @@ function validateCommentsQueryHasLimit(root, platform, sourceContent) {
                 if (pickObjectProperty(objArg, "pageSize") || pickObjectProperty(objArg, "limit"))
                     continue;
                 findings.push(finding(ruleId, "warning", message, relativeFile(root, file), recommendation));
-                return findings;
+                break;
             }
         }
         return findings;
@@ -3359,7 +4256,7 @@ function validateCommentsQueryHasLimit(root, platform, sourceContent) {
         if (limitPat.test(checkContent))
             continue;
         findings.push(finding(ruleId, "warning", message, relativeFile(root, file), recommendation));
-        break;
+        continue;
     }
     return findings;
 }
@@ -3432,7 +4329,7 @@ function validateCommentThreadUiStates(root, platform, sourceContent) {
         const hasEmpty = /itemCount\s*==\s*0|itemCount\s*<=\s*0|No comments|EmptyState|emptyState|\bisEmpty\b/.test(checkContent);
         if (!(hasLoading && hasError && hasEmpty)) {
             findings.push(finding(ruleId, "warning", "Comment tray renders a paged comment list but does not handle loading, error, and empty states. It can show an empty tray while comments are still loading or hide failures.", relativeFile(root, file), "For collectAsLazyPagingItems(), branch on comments.loadState.refresh/append for Loading and Error, show retry for errors, and show the empty state only when refresh is NotLoading and itemCount == 0. Add // vise: comment-ui-states intentional — <reason> only when a parent component handles these states."));
-            break;
+            continue;
         }
     }
     return findings;
@@ -3511,7 +4408,7 @@ function validateChatMessageOrderExplicit(root, platform, sourceContent) {
         if (sortPat.test(checkContent))
             continue;
         findings.push(finding(ruleId, "warning", "Message query relies on implicit SDK ordering. This commonly reverses the visible chat order when the UI assumes newest-first or oldest-first.", relativeFile(root, file), "Declare the intended order explicitly with .sortBy(AmityMessageQuerySortOption.FIRST_CREATED or LAST_CREATED), or apply a clearly named UI sort/reverse before rendering. Add // vise: chat-sort intentional — <reason> if the SDK default is intentionally used."));
-        break;
+        continue;
     }
     return findings;
 }
@@ -3546,7 +4443,7 @@ function validateProfileSocialCounts(root, platform, sourceContent) {
         const hasPlaceholderCounts = placeholderPat.test(checkContent);
         if (hasPlaceholderCounts && !hasSdkCounts) {
             findings.push(finding(ruleId, "warning", "Profile screen labels follower/following counts but fills them with placeholders instead of SDK values.", relativeFile(root, file), "Use AmityUser.getFollowerCount()/getFollowingCount() from the current user/live profile object, or query getFollowers()/getFollowings() if the count must update from a collection. Add // vise: profile-counts intentional — <reason> only when the placeholders are deliberate."));
-            break;
+            continue;
         }
     }
     return findings;
@@ -3578,7 +4475,7 @@ function validateCommunityDisplayNameFromSdk(root, platform, sourceContent) {
         if (CORRECT.test(checkContent))
             continue;
         findings.push(finding(ruleId, "warning", "A community ID is used as a display name fallback. The raw communityId will be shown to users instead of the community's actual display name.", relativeFile(root, file), "Pass the full Community object (not just the ID) when navigating to a community detail screen, then use community.displayName. If you only have the ID, subscribe to CommunityRepository.getCommunity(communityId, cb) to get the live display name. Add // vise: community-id display intentional only if showing the ID is truly required."));
-        break;
+        continue;
     }
     return findings;
 }
@@ -3616,7 +4513,7 @@ function validateRoomPostFetched(root, platform, sourceContent) {
         if (fetchPat.test(checkContent))
             continue;
         findings.push(finding(ruleId, "warning", "Room post displays raw roomId instead of fetching room details (title) via RoomRepository.getRoom.", relativeFile(root, file), "Subscribe to RoomRepository.getRoom(roomId, callback) to get the Room object, then use room.title as the display name. The Room has title, status (idle/live/ended), and thumbnailFileId. Add // vise: room-display intentional only if showing the raw ID is intentional."));
-        break;
+        continue;
     }
     return findings;
 }