@api-doctor/cli 0.0.3 → 0.0.4

package/dist/plugin.js

@@ -2825,85 +2825,47 @@ var rule37 = {
 };
 var firebaseRtdbWritePromiseNotHandledRule = rule37;
 
-// src/providers/lovable/utils.ts
-var LLM_HOST_PATTERN = /api\.anthropic\.com|api\.openai\.com/;
-function containsKnownLlmHost(node) {
-  if (node?.type === "Literal" && typeof node.value === "string") {
-    return LLM_HOST_PATTERN.test(node.value);
-  }
-  if (node?.type === "TemplateLiteral") {
-    return (node.quasis ?? []).some((q) => LLM_HOST_PATTERN.test(q.value?.raw ?? ""));
-  }
-  return false;
-}
-
-// src/providers/lovable/rules/no-client-side-secret-fetch.ts
+// src/providers/firebase/rules/firestore-rules-expired.ts
 var rule38 = {
   meta: {
     type: "problem",
     docs: {
-      description: "LLM provider calls must not run client-side with a VITE_-exposed API key",
+      description: "Firestore security rules contain a hard-coded expiry date that has already passed",
       category: "security",
-      cwe: "CWE-522",
-      owasp: "A02:2021 \u2013 Cryptographic Failures",
-      rationale: "Anything read from import.meta.env.VITE_* is inlined into the production JS bundle at build time and is visible to every site visitor via the Network tab or by reading the bundle \u2014 no git access required. Lovable documents Edge Functions specifically so the provider key stays server-side in Secrets and the browser calls your own Edge Function instead of the provider directly.",
-      docsUrl: "https://docs.lovable.dev/features/security",
+      cwe: "CWE-284",
+      owasp: "A01:2021 Broken Access Control",
+      rationale: 'The Firebase "get started" rules template includes a timestamp.date() expiry. Once that date passes the condition permanently evaluates to false, denying every client read and write. Replace with proper auth-based rules scoped to the authenticated user.',
+      docsUrl: "https://firebase.google.com/docs/firestore/security/insecure-rules",
       recommended: true
     },
     messages: {
-      clientSideSecretFetch: "This fetch() calls an LLM provider directly with a key sourced from import.meta.env.VITE_* \u2014 that key ships into the browser bundle and is visible to every visitor."
-    }
+      firestoreRulesExpired: "Firestore security rules contain a hard-coded expiry date that has already passed. All client reads and writes are permanently denied. Replace with proper auth-based rules."
+    },
+    schema: []
   },
   create(context) {
-    const viteVars = /* @__PURE__ */ new Set();
-    function propName2(node) {
-      if (!node) return void 0;
-      if (node.type === "Identifier") return node.name;
-      if (node.type === "Literal" && typeof node.value === "string") return node.value;
-      return void 0;
-    }
-    function isImportMetaEnvViteAccess(node) {
-      if (node?.type !== "MemberExpression" || node.computed) return false;
-      const propertyName = node.property?.name;
-      if (typeof propertyName !== "string" || !propertyName.startsWith("VITE_")) return false;
-      const envMember = node.object;
-      if (envMember?.type !== "MemberExpression" || envMember.computed) return false;
-      if (envMember.property?.name !== "env") return false;
-      const metaProp = envMember.object;
-      return metaProp?.type === "MetaProperty" && metaProp.meta?.name === "import" && metaProp.property?.name === "meta";
-    }
-    function referencesViteSecret(node) {
-      if (!node) return false;
-      if (isImportMetaEnvViteAccess(node)) return true;
-      if (node.type === "Identifier" && viteVars.has(node.name)) return true;
-      if (node.type === "TemplateLiteral") {
-        return (node.expressions ?? []).some((e) => referencesViteSecret(e));
+    const EXPIRED_YEAR = 2025;
+    function checkStringForExpiredDate(value, reportNode) {
+      const re = /timestamp\.date\(\s*(\d{4})\s*,/g;
+      let match;
+      while ((match = re.exec(value)) !== null) {
+        const year = parseInt(match[1], 10);
+        if (year <= EXPIRED_YEAR) {
+          context.report({ node: reportNode, messageId: "firestoreRulesExpired" });
+          return;
+        }
       }
-      return false;
     }
     return {
-      VariableDeclarator(node) {
-        if (node.id?.type === "Identifier" && isImportMetaEnvViteAccess(node.init)) {
-          viteVars.add(node.id.name);
-        }
+      Literal(node) {
+        if (typeof node.value !== "string") return;
+        checkStringForExpiredDate(node.value, node);
       },
-      CallExpression(node) {
-        const callee = node.callee;
-        if (callee?.type !== "Identifier" || callee.name !== "fetch") return;
-        const urlArg = node.arguments?.[0];
-        if (!containsKnownLlmHost(urlArg)) return;
-        const optsArg = node.arguments?.[1];
-        if (optsArg?.type !== "ObjectExpression") return;
-        const headersProp = (optsArg.properties ?? []).find(
-          (p) => p?.type === "Property" && propName2(p.key) === "headers"
-        );
-        if (!headersProp || headersProp.value?.type !== "ObjectExpression") return;
-        for (const hp of headersProp.value.properties ?? []) {
-          if (hp?.type !== "Property") continue;
-          const keyName = propName2(hp.key)?.toLowerCase();
-          if (keyName !== "x-api-key" && keyName !== "authorization") continue;
-          if (referencesViteSecret(hp.value)) {
-            context.report({ node, messageId: "clientSideSecretFetch" });
+      TemplateLiteral(node) {
+        for (const quasi of node.quasis ?? []) {
+          const cooked = quasi?.value?.cooked ?? quasi?.value?.raw ?? "";
+          if (typeof cooked === "string" && cooked.includes("timestamp.date(")) {
+            checkStringForExpiredDate(cooked, node);
             return;
           }
         }
@@ -2911,1189 +2873,2320 @@ var rule38 = {
     };
   }
 };
-var lovableNoClientSideSecretFetchRule = rule38;
+var firebaseFirestoreRulesExpiredRule = rule38;
 
-// src/providers/lovable/rules/paid-flag-without-edge-function.ts
-var PRICE_PATTERN = /\$\s?\d/;
-var FLAG_PROPERTY_PATTERN = /^is_[a-z0-9_]+$/i;
-var FLAG_SUFFIX_PATTERN = /_(unlocked|active|enabled)$/i;
+// src/providers/firebase/rules/id-token-cookie-flags.ts
+function findProp(obj, name) {
+  if (obj?.type !== "ObjectExpression") return void 0;
+  return (obj.properties ?? []).find(
+    (p) => p?.type === "Property" && (p.key?.type === "Identifier" && p.key.name === name || p.key?.type === "Literal" && p.key.value === name)
+  );
+}
 var rule39 = {
   meta: {
     type: "problem",
     docs: {
-      description: "A paid feature flag must not be set by a direct database update with no payment-provider call",
+      description: "Firebase ID token stored in a cookie without httpOnly flag",
       category: "security",
-      cwe: "CWE-840",
-      owasp: "A04:2021 \u2013 Insecure Design",
-      rationale: "Lovable documents payment processing as Edge Function territory specifically so purchase/premium-access flags are only ever set after a payment provider confirms payment server-side. A handler that writes a paid-looking flag straight from the client with no payment call in between either never actually charges anyone, or \u2014 even if a charge happens elsewhere \u2014 leaves the flag itself freely settable by any caller with write access to the row.",
-      docsUrl: "https://docs.lovable.dev/features/cloud",
+      cwe: "CWE-1004",
+      owasp: "A02:2021 Cryptographic Failures",
+      rationale: "Storing a Firebase ID token in a non-httpOnly cookie makes it readable by any JavaScript on the page. An XSS vulnerability can steal the token and impersonate the user. Use the Firebase Admin SDK createSessionCookie flow to issue a proper httpOnly session cookie instead.",
+      docsUrl: "https://firebase.google.com/docs/auth/admin/manage-cookies",
       recommended: true
     },
     messages: {
-      paidFlagWithoutPayment: "This sets a paid-looking flag via a direct database update, but nothing in this function calls a payment provider or Edge Function first \u2014 the flag can be set without anyone paying."
-    }
+      idTokenCookieMissingHttpOnly: "Firebase ID token stored in cookie without httpOnly: true. Any XSS vulnerability can steal the token. Use the Firebase Admin SDK createSessionCookie flow instead."
+    },
+    schema: []
   },
   create(context) {
-    const stack = [];
-    const states = /* @__PURE__ */ new Map();
-    let sawPriceLabel = false;
-    function ensureState(fn) {
-      let s = states.get(fn);
-      if (!s) {
-        s = { sawFlagUpdate: false, updateNode: null, sawPaymentCall: false };
-        states.set(fn, s);
-      }
-      return s;
-    }
-    function top() {
-      return stack[stack.length - 1];
-    }
-    function pushScope(node) {
-      stack.push(node);
-      ensureState(node);
-    }
-    function popScope() {
-      stack.pop();
-    }
-    function propName2(node) {
-      if (!node) return void 0;
-      if (node.type === "Identifier") return node.name;
-      if (node.type === "Literal" && typeof node.value === "string") return node.value;
-      return void 0;
-    }
-    function isBooleanFlagProperty(name) {
-      if (!name) return false;
-      return FLAG_PROPERTY_PATTERN.test(name) || FLAG_SUFFIX_PATTERN.test(name);
-    }
-    function isSupabaseUpdateCall(node) {
-      if (node?.type !== "CallExpression") return false;
-      const callee = node.callee;
-      return callee?.type === "MemberExpression" && callee.property?.name === "update";
-    }
-    function updateSetsBooleanFlag(node) {
-      const arg = node.arguments?.[0];
-      if (arg?.type !== "ObjectExpression") return false;
-      return (arg.properties ?? []).some(
-        (p) => p?.type === "Property" && isBooleanFlagProperty(propName2(p.key))
-      );
-    }
-    function memberChainNames2(node, names = []) {
-      if (node?.type === "MemberExpression") {
-        memberChainNames2(node.object, names);
-        const n = propName2(node.property);
-        if (n) names.push(n);
-      } else if (node?.type === "Identifier") {
-        names.push(node.name);
-      } else if (node?.type === "CallExpression") {
-        memberChainNames2(node.callee, names);
-      }
-      return names;
+    function isTokenName(val) {
+      return /token/i.test(val);
     }
-    function isPaymentRelatedCall(node) {
-      if (node?.type !== "CallExpression") return false;
-      const chain = memberChainNames2(node.callee).join(".").toLowerCase();
-      if (/stripe|checkout|payment/.test(chain)) return true;
-      if (chain.includes("functions") && chain.endsWith(".invoke")) return true;
-      if (node.callee?.type === "Identifier" && node.callee.name === "fetch") {
-        const urlArg = node.arguments?.[0];
-        if (urlArg?.type === "Literal" && typeof urlArg.value === "string") {
-          return urlArg.value.includes("/functions/");
-        }
-        if (urlArg?.type === "TemplateLiteral") {
-          return (urlArg.quasis ?? []).some((q) => (q.value?.raw ?? "").includes("/functions/"));
-        }
-      }
-      return false;
+    function hasHttpOnlyTrue(optsNode) {
+      if (optsNode?.type !== "ObjectExpression") return false;
+      const prop = findProp(optsNode, "httpOnly");
+      if (!prop) return false;
+      return prop.value?.type === "Literal" && prop.value.value === true;
     }
     return {
-      Program(node) {
-        pushScope(node);
-      },
-      "Program:exit"() {
-        if (!sawPriceLabel) return;
-        for (const state of states.values()) {
-          if (state.sawFlagUpdate && !state.sawPaymentCall) {
-            context.report({ node: state.updateNode, messageId: "paidFlagWithoutPayment" });
-          }
-        }
-      },
-      FunctionDeclaration(node) {
-        pushScope(node);
-      },
-      "FunctionDeclaration:exit"() {
-        popScope();
-      },
-      FunctionExpression(node) {
-        pushScope(node);
-      },
-      "FunctionExpression:exit"() {
-        popScope();
-      },
-      ArrowFunctionExpression(node) {
-        pushScope(node);
-      },
-      "ArrowFunctionExpression:exit"() {
-        popScope();
-      },
-      Literal(node) {
-        if (typeof node.value === "string" && PRICE_PATTERN.test(node.value)) sawPriceLabel = true;
-      },
-      JSXText(node) {
-        if (typeof node.value === "string" && PRICE_PATTERN.test(node.value)) sawPriceLabel = true;
-      },
-      TemplateElement(node) {
-        if (PRICE_PATTERN.test(node.value?.raw ?? "")) sawPriceLabel = true;
-      },
       CallExpression(node) {
-        const fn = top();
-        if (!fn) return;
-        const state = ensureState(fn);
-        if (isSupabaseUpdateCall(node) && updateSetsBooleanFlag(node) && !state.sawFlagUpdate) {
-          state.sawFlagUpdate = true;
-          state.updateNode = node;
+        const callee = node.callee;
+        const isCookieSet = callee?.type === "Identifier" && callee.name === "setCookie";
+        if (!isCookieSet) return;
+        const args = node.arguments ?? [];
+        const nameArg = args[0];
+        if (nameArg?.type !== "Literal" || typeof nameArg.value !== "string") return;
+        if (!isTokenName(nameArg.value)) return;
+        const optsArg = args.length >= 3 ? args[2] : null;
+        if (!optsArg || optsArg.type !== "ObjectExpression") {
+          context.report({ node, messageId: "idTokenCookieMissingHttpOnly" });
+          return;
         }
-        if (isPaymentRelatedCall(node)) {
-          state.sawPaymentCall = true;
+        if (!hasHttpOnlyTrue(optsArg)) {
+          context.report({ node, messageId: "idTokenCookieMissingHttpOnly" });
         }
       }
     };
   }
 };
-var lovablePaidFlagWithoutEdgeFunctionRule = rule39;
+var firebaseIdTokenCookieFlagsRule = rule39;
 
-// src/providers/lovable/rules/expiry-column-never-checked.ts
-var EXPIRY_COLUMN_PATTERN = /_(until|expires?_at|expiry)$/i;
-var DATE_COMPARISON_OPERATORS = /* @__PURE__ */ new Set([">", "<", ">=", "<="]);
-var FILTER_METHODS = /* @__PURE__ */ new Set(["gt", "gte", "lt", "lte"]);
+// src/providers/firebase/rules/middleware-token-not-verified.ts
 var rule40 = {
   meta: {
-    type: "suggestion",
+    type: "problem",
     docs: {
-      description: "An expiry column must be checked against the current time somewhere",
-      category: "correctness",
-      rationale: "Writing a *_until/*_expires_at column without ever comparing it to the current time anywhere in the codebase means the expiry is purely cosmetic \u2014 whatever it was meant to gate (a boost, a trial, a temporary unlock) never actually expires once granted, whether it was granted legitimately or through an unrelated bug.",
-      docsUrl: "https://docs.lovable.dev/features/cloud",
+      description: "Next.js middleware reads auth cookie but never verifies it",
+      category: "security",
+      cwe: "CWE-345",
+      owasp: "A07:2021 Identification and Authentication Failures",
+      rationale: "Checking only that an auth cookie is non-empty does not verify the token. An attacker who sets any non-empty cookie value will bypass the guard entirely. The middleware must call verifySessionCookie or verifyIdToken to confirm the token is valid and unexpired.",
+      docsUrl: "https://firebase.google.com/docs/auth/admin/manage-cookies#verify_session_cookies_and_check_permissions",
       recommended: true
     },
     messages: {
-      expiryNeverChecked: 'The "{{column}}" column is written here but is never compared against the current time anywhere in this file, so it never actually expires anything.'
-    }
+      tokenNotVerified: "Middleware reads the auth cookie but never verifies it. Any non-empty cookie value bypasses the guard. Call adminAuth.verifySessionCookie() or verifyIdToken() before allowing access."
+    },
+    schema: []
   },
   create(context) {
-    const writtenColumns = /* @__PURE__ */ new Map();
-    const readColumns = /* @__PURE__ */ new Set();
-    function propName2(node) {
-      if (!node) return void 0;
-      if (node.type === "Identifier") return node.name;
-      if (node.type === "Literal" && typeof node.value === "string") return node.value;
-      return void 0;
-    }
-    function isSupabaseUpdateCall(node) {
+    const AUTH_COOKIE_NAMES = /token|session/i;
+    const VERIFY_METHOD_NAMES = /* @__PURE__ */ new Set(["verifySessionCookie", "verifyIdToken", "verify"]);
+    let readsCookieWithAuthName = false;
+    let hasVerifyCall = false;
+    const cookieReadNodes = [];
+    function isAuthCookieGet(node) {
       if (node?.type !== "CallExpression") return false;
       const callee = node.callee;
-      return callee?.type === "MemberExpression" && callee.property?.name === "update";
-    }
-    function containsDateNowOrNewDate(node, depth = 0) {
-      if (!node || typeof node !== "object" || depth > 6) return false;
-      if (node.type === "NewExpression" && node.callee?.type === "Identifier" && node.callee.name === "Date") {
-        return true;
-      }
-      if (node.type === "CallExpression" && node.callee?.type === "MemberExpression" && node.callee.object?.type === "Identifier" && node.callee.object.name === "Date" && node.callee.property?.name === "now") {
-        return true;
-      }
-      if (node.type === "MemberExpression") {
-        return containsDateNowOrNewDate(node.object, depth + 1) || containsDateNowOrNewDate(node.callee, depth + 1);
-      }
-      if (node.type === "CallExpression") {
-        return containsDateNowOrNewDate(node.callee, depth + 1);
-      }
-      return false;
-    }
-    function memberPropertyName(node) {
-      if (node?.type !== "MemberExpression") return void 0;
-      return propName2(node.property);
+      if (callee?.type !== "MemberExpression") return false;
+      if (callee.property?.type !== "Identifier" || callee.property.name !== "get") return false;
+      const arg = node.arguments?.[0];
+      if (arg?.type !== "Literal" || typeof arg.value !== "string") return false;
+      return AUTH_COOKIE_NAMES.test(arg.value);
     }
     return {
       CallExpression(node) {
-        if (isSupabaseUpdateCall(node)) {
-          const arg = node.arguments?.[0];
-          if (arg?.type === "ObjectExpression") {
-            for (const prop of arg.properties ?? []) {
-              if (prop?.type !== "Property") continue;
-              const keyName = propName2(prop.key);
-              if (keyName && EXPIRY_COLUMN_PATTERN.test(keyName) && !writtenColumns.has(keyName)) {
-                writtenColumns.set(keyName, node);
-              }
-            }
-          }
+        if (isAuthCookieGet(node)) {
+          readsCookieWithAuthName = true;
+          cookieReadNodes.push(node);
         }
         const callee = node.callee;
-        if (callee?.type === "MemberExpression" && FILTER_METHODS.has(callee.property?.name)) {
-          const colArg = node.arguments?.[0];
-          const colName = colArg?.type === "Literal" ? propName2(colArg) : void 0;
-          if (colName && EXPIRY_COLUMN_PATTERN.test(colName)) {
-            readColumns.add(colName);
-          }
-        }
-      },
-      BinaryExpression(node) {
-        if (!DATE_COMPARISON_OPERATORS.has(node.operator)) return;
-        const leftCol = memberPropertyName(node.left);
-        const rightCol = memberPropertyName(node.right);
-        if (leftCol && EXPIRY_COLUMN_PATTERN.test(leftCol) && containsDateNowOrNewDate(node.right)) {
-          readColumns.add(leftCol);
+        if (callee?.type === "Identifier" && VERIFY_METHOD_NAMES.has(callee.name)) {
+          hasVerifyCall = true;
         }
-        if (rightCol && EXPIRY_COLUMN_PATTERN.test(rightCol) && containsDateNowOrNewDate(node.left)) {
-          readColumns.add(rightCol);
+        if (callee?.type === "MemberExpression" && callee.property?.type === "Identifier" && VERIFY_METHOD_NAMES.has(callee.property.name)) {
+          hasVerifyCall = true;
         }
       },
       "Program:exit"() {
-        for (const [column, node] of writtenColumns) {
-          if (!readColumns.has(column)) {
-            context.report({ node, messageId: "expiryNeverChecked", data: { column } });
+        if (readsCookieWithAuthName && !hasVerifyCall) {
+          for (const node of cookieReadNodes) {
+            context.report({ node, messageId: "tokenNotVerified" });
           }
         }
       }
     };
   }
 };
-var lovableExpiryColumnNeverCheckedRule = rule40;
+var firebaseMiddlewareTokenNotVerifiedRule = rule40;
 
-// src/providers/lovable/rules/silent-catch-on-provider-call.ts
-var LOGGING_CONSOLE_METHODS = /* @__PURE__ */ new Set(["error", "warn", "log", "info"]);
+// src/providers/firebase/rules/hardcoded-user-id.ts
 var rule41 = {
   meta: {
-    type: "suggestion",
+    type: "problem",
     docs: {
-      description: "A catch block around an LLM provider call must log the failure",
-      category: "correctness",
-      rationale: `Returning null/undefined from a bare catch with no logging makes every failure mode \u2014 missing key, expired key, rate limit, malformed response, network error \u2014 look identical to "no key configured." If a deployment's provider key starts failing in production, this is invisible: there is nothing in the browser or error-tracking logs to distinguish a real outage from an intentionally-unconfigured feature.`,
-      docsUrl: "https://docs.lovable.dev/features/cloud",
+      description: "Hardcoded string used as userId in Firestore operations",
+      category: "security",
+      cwe: "CWE-284",
+      owasp: "A01:2021 Broken Access Control",
+      rationale: "A hardcoded userId causes all users to share a single Firestore document. The last writer overwrites everyone else's data, and when security rules are tightened the writes are rejected. The userId must always come from the authenticated user object.",
+      docsUrl: "https://firebase.google.com/docs/auth/web/manage-users",
       recommended: true
     },
     messages: {
-      silentCatch: 'This catch block swallows a failed LLM provider call with no logging \u2014 a real failure (expired key, rate limit, network error) is indistinguishable from "no key configured."'
-    }
+      hardcodedUserId: "Hardcoded userId found. All users share this document. Read the userId from the authenticated user: const { user } = useAuth(); user?.uid"
+    },
+    schema: []
   },
   create(context) {
-    function findFetchToLlmHost(node, depth = 0) {
-      if (!node || typeof node !== "object" || depth > 12) return null;
-      if (Array.isArray(node)) {
-        for (const n of node) {
-          const found = findFetchToLlmHost(n, depth + 1);
-          if (found) return found;
-        }
-        return null;
-      }
-      if (node.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "fetch") {
-        const urlArg = node.arguments?.[0];
-        if (containsKnownLlmHost(urlArg)) return node;
-      }
-      for (const key of Object.keys(node)) {
-        if (key === "parent" || key === "loc" || key === "range") continue;
-        const val = node[key];
-        if (val && typeof val === "object") {
-          const found = findFetchToLlmHost(val, depth + 1);
-          if (found) return found;
-        }
-      }
-      return null;
-    }
-    function containsLoggingCall(node, depth = 0) {
-      if (!node || typeof node !== "object" || depth > 12) return false;
-      if (Array.isArray(node)) return node.some((n) => containsLoggingCall(n, depth + 1));
-      if (node.type === "CallExpression") {
-        const callee = node.callee;
-        if (callee?.type === "MemberExpression") {
-          const objName = callee.object?.type === "Identifier" ? callee.object.name : void 0;
-          const propertyName = callee.property?.name;
-          if (objName === "console" && LOGGING_CONSOLE_METHODS.has(propertyName)) return true;
-          if (propertyName === "captureException") return true;
-        }
-        if (callee?.type === "Identifier" && callee.name === "reportError") return true;
-      }
-      for (const key of Object.keys(node)) {
-        if (key === "parent" || key === "loc" || key === "range") continue;
-        const val = node[key];
-        if (val && typeof val === "object") {
-          if (containsLoggingCall(val, depth + 1)) return true;
-        }
-      }
-      return false;
-    }
+    const USER_ID_NAMES = /* @__PURE__ */ new Set(["userId", "uid", "userID", "user_id"]);
     return {
-      TryStatement(node) {
-        const fetchNode = findFetchToLlmHost(node.block);
-        if (!fetchNode) return;
-        const handler = node.handler;
-        if (!handler) return;
-        if (!containsLoggingCall(handler.body)) {
-          context.report({ node: handler, messageId: "silentCatch" });
+      VariableDeclarator(node) {
+        if (node.id?.type !== "Identifier") return;
+        if (!USER_ID_NAMES.has(node.id.name)) return;
+        const init = node.init;
+        if (!init) return;
+        if (init.type === "Literal" && typeof init.value === "string" && init.value.length > 0) {
+          context.report({ node, messageId: "hardcodedUserId" });
         }
       }
     };
   }
 };
-var lovableSilentCatchOnProviderCallRule = rule41;
-
-// src/providers/browserbase/utils.ts
-function memberPropName3(node) {
-  if (node?.type !== "CallExpression") return void 0;
-  const callee = node.callee;
-  if (callee?.type !== "MemberExpression") return void 0;
-  const prop = callee.property;
-  if (!callee.computed && prop?.type === "Identifier") return prop.name;
-  if (callee.computed && prop?.type === "Literal" && typeof prop.value === "string") return prop.value;
-  return void 0;
-}
-function isSessionsCall(node, name) {
-  if (memberPropName3(node) !== name) return false;
-  const obj = node.callee.object;
-  return obj?.type === "MemberExpression" && !obj.computed && obj.property?.type === "Identifier" && obj.property.name === "sessions";
-}
-function isSessionsRecordingCall(node, name) {
-  if (memberPropName3(node) !== name) return false;
-  const recordingObj = node.callee.object;
-  if (recordingObj?.type !== "MemberExpression" || recordingObj.computed) return false;
-  if (recordingObj.property?.type !== "Identifier" || recordingObj.property.name !== "recording") return false;
-  const sessionsObj = recordingObj.object;
-  return sessionsObj?.type === "MemberExpression" && !sessionsObj.computed && sessionsObj.property?.type === "Identifier" && sessionsObj.property.name === "sessions";
-}
-function findProperty2(objectExpression, name) {
-  if (objectExpression?.type !== "ObjectExpression") return void 0;
-  return objectExpression.properties?.find(
-    (p) => p?.type === "Property" && (p.key?.type === "Identifier" && p.key.name === name || p.key?.type === "Literal" && p.key.value === name)
-  );
-}
-function startOffset3(n) {
-  if (typeof n?.range?.[0] === "number") return n.range[0];
-  if (typeof n?.start === "number") return n.start;
-  return (n?.loc?.start?.line ?? 0) * 1e6 + (n?.loc?.start?.column ?? 0);
-}
-function endOffset3(n) {
-  if (typeof n?.range?.[1] === "number") return n.range[1];
-  if (typeof n?.end === "number") return n.end;
-  return (n?.loc?.end?.line ?? n?.loc?.start?.line ?? 0) * 1e6 + (n?.loc?.end?.column ?? 0);
-}
-function contains3(outer, inner) {
-  const s = startOffset3(inner);
-  return s >= startOffset3(outer) && s <= endOffset3(outer);
-}
-function someDescendant2(node, predicate) {
-  let found = false;
-  function visit(n) {
-    if (found || !n || typeof n !== "object") return;
-    if (Array.isArray(n)) {
-      for (const item of n) visit(item);
-      return;
-    }
-    if (typeof n.type !== "string") return;
-    if (predicate(n)) {
-      found = true;
-      return;
-    }
-    for (const key of Object.keys(n)) {
-      if (key === "parent" || key === "loc" || key === "range") continue;
-      visit(n[key]);
-    }
-  }
-  visit(node);
-  return found;
-}
-function isResponseSendCall(node) {
-  const name = memberPropName3(node);
-  if (name !== "json" && name !== "send") return false;
-  const obj = node.callee.object;
-  if (obj?.type === "Identifier") {
-    return /^(res|response)$/i.test(obj.name) || obj.name === "Response" || obj.name === "NextResponse";
-  }
-  return false;
-}
-function isInsideTestFile3(filename) {
-  return /(^|[\\/])__tests__[\\/]|\.(test|spec)\.[cm]?[jt]sx?$/.test(filename);
-}
+var firebaseHardcodedUserIdRule = rule41;
 
-// src/providers/browserbase/rules/no-conditional-authz-on-anonymous-user.ts
-function isUserLikeExpr(node) {
-  if (node?.type === "Identifier") return /user/i.test(node.name);
-  if (node?.type === "MemberExpression" && !node.computed && node.property?.type === "Identifier") {
-    return /user/i.test(node.property.name);
-  }
-  return false;
-}
-function isFalsyGuardTest(test) {
-  if (test?.type === "UnaryExpression" && test.operator === "!") return isUserLikeExpr(test.argument);
-  if (test?.type === "BinaryExpression" && (test.operator === "===" || test.operator === "==")) {
-    const sides = [test.left, test.right];
-    const isNullish = (n) => n?.type === "Literal" && n.value === null || n?.type === "Identifier" && n.name === "undefined";
-    const nullSide = sides.find(isNullish);
-    const otherSide = sides.find((s) => s !== nullSide);
-    return !!nullSide && isUserLikeExpr(otherSide);
-  }
-  return false;
-}
-function hasReturnOrThrow(stmt) {
-  if (!stmt) return false;
-  if (stmt.type === "ReturnStatement" || stmt.type === "ThrowStatement") return true;
-  if (stmt.type === "BlockStatement") {
-    return (stmt.body ?? []).some((s) => s.type === "ReturnStatement" || s.type === "ThrowStatement");
-  }
-  return false;
-}
-function isTruthyGateTest(test) {
-  if (isUserLikeExpr(test)) return true;
-  if (test?.type === "LogicalExpression" && test.operator === "&&") {
-    return isTruthyGateTest(test.left) || isTruthyGateTest(test.right);
-  }
-  return false;
-}
+// src/providers/firebase/rules/auth-user-not-found-disclosure.ts
 var rule42 = {
   meta: {
-    type: "problem",
+    type: "suggestion",
     docs: {
-      description: "Sensitive Browserbase resources must be guarded by unconditional authorization",
+      description: "auth/user-not-found error code surfaced to the user enables email enumeration",
       category: "security",
-      cwe: "CWE-862",
-      owasp: "A01:2021 Broken Access Control",
-      rationale: "bb.sessions.debug() and bb.sessions.recording.retrieve() return a live CDP debugger URL or a full rrweb session replay \u2014 high-value resources. Gating the ownership check behind `if (user) { ...check... }` with no unconditional `if (!user) return` guard means an anonymous caller (no credentials at all) simply skips the whole block and falls through to the sensitive call. Authorization must reject the unauthenticated case explicitly, not rely on a conditional that happens to be true for legitimate callers.",
-      docsUrl: "https://docs.browserbase.com/reference/api/session-live-urls",
+      cwe: "CWE-204",
+      owasp: "A07:2021 Identification and Authentication Failures",
+      rationale: "Displaying a distinct message for the auth/user-not-found error code reveals whether an email address is registered. Firebase email enumeration protection (default on since September 2023) stops returning this code \u2014 making this branch dead code while still being a security risk on older projects.",
+      docsUrl: "https://firebase.google.com/docs/auth/web/password-auth#enumeration-protection",
       recommended: true
     },
     messages: {
-      conditionalAuthz: "This route returns a Browserbase live-view/recording resource gated only by `if (user) {...}` with no unconditional rejection for anonymous callers. Add an `if (!user) return ...` guard before this."
+      userNotFoundDisclosure: "Checking for auth/user-not-found exposes whether an email is registered (user enumeration). Show the same generic message for all auth errors."
     },
     schema: []
   },
   create(context) {
-    const scopes = [];
-    const gates = [];
-    const sensitiveCalls = [];
-    function registerScope(node) {
-      scopes.push({ node, start: startOffset3(node), end: endOffset3(node) });
+    function isErrorCode(n) {
+      return n?.type === "MemberExpression" && !n.computed && n.property?.type === "Identifier" && n.property.name === "code";
     }
-    function innermostScope(pos) {
-      let best;
-      for (const scope of scopes) {
-        if (pos < scope.start || pos > scope.end) continue;
-        if (!best || scope.end - scope.start < best.end - best.start) best = scope;
-      }
-      return best;
+    function isUserNotFoundLiteral(n) {
+      return n?.type === "Literal" && n.value === "auth/user-not-found";
     }
     return {
-      FunctionDeclaration(node) {
-        registerScope(node);
-      },
-      FunctionExpression(node) {
-        registerScope(node);
-      },
-      ArrowFunctionExpression(node) {
-        registerScope(node);
-      },
-      IfStatement(node) {
-        if (isFalsyGuardTest(node.test) && hasReturnOrThrow(node.consequent)) {
-          const pos = startOffset3(node);
-          const scope = innermostScope(pos);
-          if (scope && (scope.guardPos === void 0 || pos < scope.guardPos)) scope.guardPos = pos;
-          return;
-        }
-        if (isTruthyGateTest(node.test) && !node.alternate) {
-          gates.push({ start: startOffset3(node), end: endOffset3(node) });
+      BinaryExpression(node) {
+        if (node.operator !== "===" && node.operator !== "==" && node.operator !== "!==" && node.operator !== "!=") return;
+        if (isErrorCode(node.left) && isUserNotFoundLiteral(node.right) || isErrorCode(node.right) && isUserNotFoundLiteral(node.left)) {
+          context.report({ node, messageId: "userNotFoundDisclosure" });
         }
       },
-      CallExpression(node) {
-        if (isSessionsCall(node, "debug") || isSessionsRecordingCall(node, "retrieve")) {
-          sensitiveCalls.push(node);
-        }
-      },
-      "Program:exit"() {
-        for (const call of sensitiveCalls) {
-          const gate = gates.find((g) => contains3(g, call));
-          if (!gate) continue;
-          const scope = innermostScope(startOffset3(call));
-          const hasGuardBeforeGate = scope?.guardPos !== void 0 && scope.guardPos < gate.start;
-          if (!hasGuardBeforeGate) {
-            context.report({ node: call, messageId: "conditionalAuthz" });
-          }
+      SwitchCase(node) {
+        if (isUserNotFoundLiteral(node.test)) {
+          context.report({ node, messageId: "userNotFoundDisclosure" });
         }
       }
     };
   }
 };
-var browserbaseNoConditionalAuthzOnAnonymousUserRule = rule42;
+var firebaseAuthUserNotFoundDisclosureRule = rule42;
 
-// src/providers/browserbase/rules/no-connect-url-in-api-response.ts
+// src/providers/firebase/rules/signup-password-confirm.ts
 var rule43 = {
   meta: {
-    type: "problem",
+    type: "suggestion",
     docs: {
-      description: "connectUrl must never be placed in an HTTP response body",
-      category: "security",
-      cwe: "CWE-200",
-      owasp: "A04:2021 Insecure Design",
-      rationale: "session.connectUrl is the WebSocket CDP URL returned by sessions.create() \u2014 it is self-authenticating; connecting to it grants full read/write control of the live browser (arbitrary JS execution, cookie/localStorage read, simulated input), equivalent to a bearer token. Putting it in a response body widens its exposure (network tab, browser extensions, error trackers, logs) for callers that almost never need it client-side \u2014 the intended sharable artifact is debuggerFullscreenUrl from sessions.debug().",
-      docsUrl: "https://docs.browserbase.com/reference/api/create-a-session",
+      description: "createUserWithEmailAndPassword called without verifying password matches confirmPassword",
+      category: "correctness",
+      rationale: "If confirmPassword is collected but never compared to password before account creation, users who mistype their password will successfully create an account they cannot log in to. Always compare password === confirmPassword and bail early on mismatch.",
+      docsUrl: "https://firebase.google.com/docs/auth/web/password-auth",
       recommended: true
     },
     messages: {
-      connectUrlInResponse: "connectUrl is included in an HTTP response body. Keep it server-side only \u2014 it is a bearer credential for the live browser, not a sharable URL."
+      passwordConfirmNotChecked: "createUserWithEmailAndPassword is called without verifying password === confirmPassword. Users who mistype their password will create an account they cannot log in to."
     },
     schema: []
   },
   create(context) {
+    let createUserLocalName;
+    let hasConfirmPasswordIdentifier = false;
+    let hasPasswordComparison = false;
+    const createUserCalls = [];
     return {
+      ImportDeclaration(node) {
+        const imports = namedImportsFrom(node, "firebase/auth");
+        if (imports.has("createUserWithEmailAndPassword")) {
+          createUserLocalName = imports.get("createUserWithEmailAndPassword");
+        }
+      },
+      Identifier(node) {
+        if (node.name === "confirmPassword") {
+          hasConfirmPasswordIdentifier = true;
+        }
+      },
+      BinaryExpression(node) {
+        if (node.operator !== "===" && node.operator !== "==" && node.operator !== "!==" && node.operator !== "!=") return;
+        const mentionsConfirm = (n) => n?.type === "Identifier" && n.name === "confirmPassword";
+        if (mentionsConfirm(node.left) || mentionsConfirm(node.right)) {
+          hasPasswordComparison = true;
+        }
+      },
       CallExpression(node) {
-        if (!isResponseSendCall(node)) return;
-        const arg = node.arguments?.[0];
-        if (arg?.type !== "ObjectExpression") return;
-        if (findProperty2(arg, "connectUrl")) {
-          context.report({ node, messageId: "connectUrlInResponse" });
+        if (!createUserLocalName) return;
+        if (node.callee?.type === "Identifier" && node.callee.name === createUserLocalName) {
+          createUserCalls.push(node);
+        }
+      },
+      "Program:exit"() {
+        if (!createUserLocalName) return;
+        if (createUserCalls.length === 0) return;
+        if (!hasConfirmPasswordIdentifier) return;
+        if (hasPasswordComparison) return;
+        for (const call of createUserCalls) {
+          context.report({ node: call, messageId: "passwordConfirmNotChecked" });
         }
       }
     };
   }
 };
-var browserbaseNoConnectUrlInApiResponseRule = rule43;
+var firebaseSignupPasswordConfirmRule = rule43;
 
-// src/providers/browserbase/rules/session-id-requires-ownership-check.ts
-function isOwnershipCheckCall(node) {
-  if (node?.type !== "CallExpression") return false;
-  const callee = node.callee;
-  const name = callee?.type === "Identifier" ? callee.name : callee?.type === "MemberExpression" && !callee.computed && callee.property?.type === "Identifier" ? callee.property.name : void 0;
-  if (!name) return false;
-  return /owner|belongsto|hasaccess|authorize|verifyaccess|checkaccess|findproject|getproject/i.test(name);
-}
-function isSessionIdLikeArg(node) {
-  if (node?.type === "Identifier") return /sessionid/i.test(node.name);
-  if (node?.type === "MemberExpression" && !node.computed && node.property?.type === "Identifier") {
-    return /sessionid/i.test(node.property.name);
-  }
-  return false;
-}
+// src/providers/firebase/rules/use-array-union-remove.ts
 var rule44 = {
   meta: {
     type: "suggestion",
     docs: {
-      description: "Session id lookups must verify ownership before returning live-view data",
-      category: "security",
-      cwe: "CWE-862",
-      rationale: "A session id alone is not an authorization token \u2014 it is an opaque identifier that can leak via links, logs, screenshots, or support tickets. A handler that resolves a sessionId straight into sessions.debug()/sessions.recording.retrieve() with no ownership/org-membership check lets any authenticated caller view or replay a session that belongs to someone else.",
-      docsUrl: "https://docs.browserbase.com/features/session-live-view",
+      description: "Firestore array field updated with read-modify-write spread/filter instead of arrayUnion/arrayRemove",
+      category: "correctness",
+      rationale: "Spreading an array or using filter() inside updateDoc() performs a non-atomic read-modify-write that loses concurrent updates. Firestore provides arrayUnion() and arrayRemove() specifically for atomic array updates that do not require reading the document first.",
+      docsUrl: "https://firebase.google.com/docs/firestore/manage-data/add-data#update_elements_in_an_array",
       recommended: true
     },
     messages: {
-      missingOwnershipCheck: "sessionId is passed directly into a Browserbase live-view/recording call with no ownership check beforehand."
+      useArrayUnionRemove: "Firestore array updated with read-modify-write spread/filter. Use arrayUnion() or arrayRemove() for atomic updates that do not require reading the document first."
     },
     schema: []
   },
   create(context) {
-    const scopes = [];
-    const sensitiveCalls = [];
-    function registerScope(node) {
-      scopes.push({ node, start: startOffset3(node), end: endOffset3(node), sawOwnershipCheck: false });
-    }
-    function innermostScope(pos) {
-      let best;
-      for (const scope of scopes) {
-        if (pos < scope.start || pos > scope.end) continue;
-        if (!best || scope.end - scope.start < best.end - best.start) best = scope;
+    function hasSpreadOrFilterValue(obj) {
+      if (obj?.type !== "ObjectExpression") return false;
+      for (const prop of obj.properties ?? []) {
+        if (prop?.type !== "Property") continue;
+        const val = prop.value;
+        if (val?.type === "ArrayExpression") {
+          if ((val.elements ?? []).some((el) => el?.type === "SpreadElement")) {
+            return true;
+          }
+        }
+        if (val?.type === "CallExpression" && val.callee?.type === "MemberExpression" && val.callee.property?.type === "Identifier" && val.callee.property.name === "filter") {
+          return true;
+        }
       }
-      return best;
+      return false;
     }
     return {
-      FunctionDeclaration(node) {
-        registerScope(node);
-      },
-      FunctionExpression(node) {
-        registerScope(node);
-      },
-      ArrowFunctionExpression(node) {
-        registerScope(node);
-      },
       CallExpression(node) {
-        const pos = startOffset3(node);
-        const scope = innermostScope(pos);
-        if (isOwnershipCheckCall(node)) {
-          for (const s of scopes) {
-            if (pos >= s.start && pos <= s.end) s.sawOwnershipCheck = true;
-          }
-          return;
-        }
-        if (isSessionsCall(node, "debug") || isSessionsRecordingCall(node, "retrieve")) {
-          const sessionIdArg = (node.arguments ?? []).some(isSessionIdLikeArg);
-          if (sessionIdArg) sensitiveCalls.push({ node, scope });
-        }
-      },
-      "Program:exit"() {
-        for (const { node, scope } of sensitiveCalls) {
-          if (!scope || !scope.sawOwnershipCheck) {
-            context.report({ node, messageId: "missingOwnershipCheck" });
-          }
+        const callee = node.callee;
+        if (callee?.type !== "Identifier" || callee.name !== "updateDoc") return;
+        const args = node.arguments ?? [];
+        if (args.length < 2) return;
+        const payload = args[1];
+        if (hasSpreadOrFilterValue(payload)) {
+          context.report({ node, messageId: "useArrayUnionRemove" });
         }
       }
     };
   }
 };
-var browserbaseSessionIdRequiresOwnershipCheckRule = rule44;
+var firebaseUseArrayUnionRemoveRule = rule44;
 
-// src/providers/browserbase/rules/no-concurrent-shared-context.ts
-function isPromiseAllCall2(node) {
-  return node?.type === "CallExpression" && node.callee?.type === "MemberExpression" && !node.callee.computed && node.callee.object?.type === "Identifier" && node.callee.object.name === "Promise" && node.callee.property?.type === "Identifier" && node.callee.property.name === "all";
-}
-function isMapCall2(node) {
-  return memberPropName3(node) === "map";
-}
-function callbackParamNames(callback) {
-  const names = /* @__PURE__ */ new Set();
-  const param = callback?.params?.[0];
-  if (param?.type === "Identifier") {
-    names.add(param.name);
-  } else if (param?.type === "ObjectPattern") {
-    for (const p of param.properties ?? []) {
-      if (p?.type === "Property" && p.value?.type === "Identifier") names.add(p.value.name);
-      else if (p?.type === "RestElement" && p.argument?.type === "Identifier") names.add(p.argument.name);
-    }
-  }
-  return names;
-}
-function contextIdValueIsShared(callback, contextIdNode) {
-  if (contextIdNode?.type !== "Identifier") return false;
-  const params = callbackParamNames(callback);
-  if (params.has(contextIdNode.name)) return false;
-  return true;
-}
-function findSharedContextCreateCall(callback) {
-  const body = callback?.body;
-  if (!body) return null;
-  let found = null;
-  function visit(n) {
-    if (found || !n || typeof n !== "object") return;
-    if (Array.isArray(n)) {
-      for (const item of n) visit(item);
-      return;
-    }
-    if (typeof n.type !== "string") return;
-    if (isSessionsCall(n, "create")) {
-      const optsArg = n.arguments?.[0];
-      const browserSettings = findProperty2(optsArg, "browserSettings")?.value;
-      const ctxProp = findProperty2(browserSettings, "context")?.value;
-      const idProp = findProperty2(ctxProp, "id");
-      if (idProp && contextIdValueIsShared(callback, idProp.value)) {
-        found = n;
-        return;
-      }
-    }
-    for (const key of Object.keys(n)) {
-      if (key === "parent" || key === "loc" || key === "range") continue;
-      visit(n[key]);
-    }
-  }
-  visit(body);
-  return found;
-}
+// src/providers/firebase/rules/duplicate-initialize-app.ts
 var rule45 = {
   meta: {
-    type: "problem",
+    type: "suggestion",
     docs: {
-      description: "A Browserbase Context must not be attached to concurrent sessions",
+      description: "initializeApp called without checking getApps() first \u2014 risk of duplicate-app crash",
       category: "correctness",
-      rationale: `Browserbase's docs state explicitly: "Avoid having multiple sessions using the same Context at once. Sites may force a log out." Passing the same browserSettings.context.id into every iteration of a Promise.all(items.map(...)) batch creates 2+ Browserbase sessions simultaneously attached to one Context, producing non-deterministic, flaky failures when a site force-logs-out one session because another concurrently authenticated against the same context.`,
-      docsUrl: "https://docs.browserbase.com/features/contexts",
+      rationale: 'Calling initializeApp() when the default app already exists throws "Firebase App named [DEFAULT] already exists". Always guard with getApps().length to make initialization idempotent across hot reloads and server-side rendering.',
+      docsUrl: "https://firebase.google.com/docs/projects/multiprojects",
       recommended: true
     },
     messages: {
-      concurrentSharedContext: "The same browserSettings.context.id is passed into every concurrent sessions.create() call in this Promise.all batch. Sites may force a log out when 2+ sessions share a Context at once."
+      duplicateInitializeApp: 'initializeApp() called without checking getApps() first. Calling it twice throws "Firebase App already exists". Use: getApps().length ? getApp() : initializeApp(config)'
     },
     schema: []
   },
   create(context) {
-    const mapCallsByVarName = /* @__PURE__ */ new Map();
-    function checkMapCall(mapCallNode) {
-      if (!isMapCall2(mapCallNode)) return;
-      const callback = mapCallNode.arguments?.[mapCallNode.arguments.length - 1];
-      if (!callback) return;
-      const sharedCall = findSharedContextCreateCall(callback);
-      if (sharedCall) {
-        context.report({ node: sharedCall, messageId: "concurrentSharedContext" });
-      }
-    }
+    let initializeAppLocalName;
+    let hasGetAppsCall = false;
+    const initializeAppCalls = [];
+    const FIREBASE_APP_SOURCES = /* @__PURE__ */ new Set(["firebase/app", "firebase-admin/app", "firebase-admin"]);
     return {
-      VariableDeclarator(node) {
-        if (node.id?.type === "Identifier" && isMapCall2(node.init)) {
-          mapCallsByVarName.set(node.id.name, node.init);
+      ImportDeclaration(node) {
+        for (const src of FIREBASE_APP_SOURCES) {
+          const imports = namedImportsFrom(node, src);
+          if (imports.has("initializeApp")) {
+            initializeAppLocalName = imports.get("initializeApp");
+          }
         }
       },
       CallExpression(node) {
-        if (!isPromiseAllCall2(node)) return;
-        const arg = node.arguments?.[0];
-        if (isMapCall2(arg)) {
-          checkMapCall(arg);
-          return;
+        const callee = node.callee;
+        if (callee?.type !== "Identifier") return;
+        if (initializeAppLocalName && callee.name === initializeAppLocalName) {
+          initializeAppCalls.push(node);
         }
-        if (arg?.type === "Identifier") {
-          const mapCall = mapCallsByVarName.get(arg.name);
-          if (mapCall) checkMapCall(mapCall);
+        if (callee.name === "getApps") {
+          hasGetAppsCall = true;
+        }
+      },
+      "Program:exit"() {
+        if (hasGetAppsCall) return;
+        for (const call of initializeAppCalls) {
+          context.report({ node: call, messageId: "duplicateInitializeApp" });
         }
       }
     };
   }
 };
-var browserbaseNoConcurrentSharedContextRule = rule45;
+var firebaseDuplicateInitializeAppRule = rule45;
 
-// src/providers/browserbase/rules/mobile-device-requires-os-setting.ts
-function isMobileLiteral(node) {
-  return node?.type === "Literal" && (node.value === "mobile" || node.value === "tablet");
-}
-function testComparesToMobile(test) {
-  if (test?.type !== "BinaryExpression") return false;
-  if (test.operator !== "===" && test.operator !== "==") return false;
-  return isMobileLiteral(test.left) || isMobileLiteral(test.right);
-}
-function isViewportReference(node) {
-  if (node?.type === "Identifier") return /viewport/i.test(node.name);
-  if (node?.type === "MemberExpression" && !node.computed && node.property?.type === "Identifier") {
-    return /viewport|width|height/i.test(node.property.name);
-  }
-  if (node?.type === "Property") {
-    return node.key?.type === "Identifier" && /viewport|width|height/i.test(node.key.name);
-  }
-  return false;
-}
-function setsViewport(node) {
-  return someDescendant2(node, isViewportReference);
-}
-function isOsMobileSetting(node) {
-  if (node?.type === "Property" && node.key?.type === "Identifier" && node.key.name === "os" && isMobileLiteral(node.value)) {
-    return true;
-  }
-  if (node?.type === "AssignmentExpression" && node.left?.type === "MemberExpression" && !node.left.computed && node.left.property?.type === "Identifier" && node.left.property.name === "os" && isMobileLiteral(node.right)) {
-    return true;
-  }
-  return false;
-}
+// src/providers/firebase/rules/onSnapshot-async-throw.ts
 var rule46 = {
   meta: {
-    type: "problem",
+    type: "suggestion",
     docs: {
-      description: "Mobile device combos must set browserSettings.os, not just resize the viewport",
-      category: "correctness",
-      rationale: `The Node SDK's device emulation lever is browserSettings.os: 'mobile' | 'tablet' \u2014 there is no fingerprint API in this SDK. A "mobile" session that only resizes the Playwright viewport is still a desktop Chrome browser with a desktop user-agent string in a small window. Sites that branch behavior on UA/touch capability (the majority of responsive sites) never actually exercise their mobile code path, silently undermining "test on mobile" results.`,
-      docsUrl: "https://docs.browserbase.com/features/stealth-mode",
+      description: "throw inside async onSnapshot callback creates an unhandled promise rejection",
+      category: "reliability",
+      rationale: "onSnapshot does not handle Promise rejections from its callback. A throw inside an async callback becomes an unhandled rejection, silently terminating the listener and leaving the UI in a broken state with no error feedback.",
+      docsUrl: "https://firebase.google.com/docs/firestore/query-data/listen#handle_listen_errors",
       recommended: true
     },
     messages: {
-      missingOsSetting: 'A "mobile" branch resizes the viewport but never sets browserSettings.os to "mobile"/"tablet". Without it this is still a desktop browser in a small window.'
+      asyncThrowInSnapshot: "throw inside an async onSnapshot callback creates an unhandled promise rejection. The listener silently stops. Use return with error logging or the onSnapshot error callback instead."
     },
     schema: []
   },
   create(context) {
-    const mobileViewportBranches = [];
-    let sawOsMobileSetting = false;
+    function isAsyncFn(node) {
+      return (node?.type === "ArrowFunctionExpression" || node?.type === "FunctionExpression") && node.async === true;
+    }
+    function hasDirectThrow(fnNode) {
+      if (!fnNode?.body) return false;
+      function visit(n, depth) {
+        if (!n || typeof n !== "object") return false;
+        if (Array.isArray(n)) return n.some((item) => visit(item, depth));
+        if (typeof n.type !== "string") return false;
+        if (depth > 0 && (n.type === "FunctionDeclaration" || n.type === "FunctionExpression" || n.type === "ArrowFunctionExpression")) {
+          return false;
+        }
+        if (n.type === "ThrowStatement") return true;
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range" || key === "type") continue;
+          if (visit(n[key], depth + 1)) return true;
+        }
+        return false;
+      }
+      return visit(fnNode.body, 0);
+    }
     return {
-      IfStatement(node) {
-        if (testComparesToMobile(node.test) && setsViewport(node.consequent)) {
-          mobileViewportBranches.push(node);
-        }
-      },
-      Property(node) {
-        if (isOsMobileSetting(node)) sawOsMobileSetting = true;
-      },
-      AssignmentExpression(node) {
-        if (isOsMobileSetting(node)) sawOsMobileSetting = true;
-      },
-      "Program:exit"() {
-        if (sawOsMobileSetting) return;
-        for (const branch of mobileViewportBranches) {
-          context.report({ node: branch, messageId: "missingOsSetting" });
+      CallExpression(node) {
+        const callee = node.callee;
+        if (callee?.type !== "Identifier" || callee.name !== "onSnapshot") return;
+        for (const arg of node.arguments ?? []) {
+          if (!isAsyncFn(arg)) continue;
+          if (hasDirectThrow(arg)) {
+            context.report({ node: arg, messageId: "asyncThrowInSnapshot" });
+          }
         }
       }
     };
   }
 };
-var browserbaseMobileDeviceRequiresOsSettingRule = rule46;
+var firebaseOnSnapshotAsyncThrowRule = rule46;
 
-// src/providers/browserbase/rules/use-typed-exception-status-not-substring.ts
-function isStringifiedErrorSource(node, errName) {
-  if (node?.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "String") {
-    const arg = node.arguments?.[0];
-    return arg?.type === "Identifier" && arg.name === errName;
-  }
-  if (node?.type === "CallExpression" && node.callee?.type === "MemberExpression") {
-    const obj = node.callee.object;
-    const prop = node.callee.property;
-    if (obj?.type === "Identifier" && obj.name === errName && prop?.type === "Identifier" && prop.name === "toString") {
-      return true;
-    }
-  }
-  if (node?.type === "MemberExpression" && !node.computed) {
-    const obj = node.object;
-    const prop = node.property;
-    if (obj?.type === "Identifier" && obj.name === errName && prop?.type === "Identifier" && prop.name === "message") {
-      return true;
-    }
-  }
-  return false;
-}
-function unwrapToLowerCase(node) {
-  if (node?.type === "CallExpression" && node.callee?.type === "MemberExpression" && node.callee.property?.type === "Identifier" && node.callee.property.name === "toLowerCase") {
-    return node.callee.object;
-  }
-  return node;
-}
-function usesTypedStatus(body, errName) {
-  return someDescendant2(body, (n) => {
-    if (n.type === "MemberExpression" && !n.computed && n.object?.type === "Identifier" && n.object.name === errName) {
-      return n.property?.type === "Identifier" && n.property.name === "status";
-    }
-    if (n.type === "BinaryExpression" && n.operator === "instanceof" && n.left?.type === "Identifier" && n.left.name === errName) {
-      return true;
-    }
-    return false;
-  });
-}
-function usesSubstringMatch(body, errName, stringifiedVars) {
-  return someDescendant2(body, (n) => {
-    if (n.type !== "CallExpression") return false;
-    if (n.callee?.type !== "MemberExpression" || n.callee.computed) return false;
-    if (n.callee.property?.type !== "Identifier" || n.callee.property.name !== "includes") return false;
-    const source = unwrapToLowerCase(n.callee.object);
-    if (isStringifiedErrorSource(source, errName)) return true;
-    return source?.type === "Identifier" && stringifiedVars.has(source.name);
-  });
-}
-function collectStringifiedVars(body, errName) {
-  const names = /* @__PURE__ */ new Set();
-  someDescendant2(body, (n) => {
-    if (n.type === "VariableDeclarator" && n.id?.type === "Identifier" && n.init) {
-      const source = unwrapToLowerCase(n.init);
-      if (isStringifiedErrorSource(source, errName)) names.add(n.id.name);
-    }
-    return false;
-  });
-  return names;
-}
+// src/providers/firebase/rules/onSnapshot-missing-error-callback.ts
 var rule47 = {
   meta: {
     type: "suggestion",
     docs: {
-      description: "Branch on err.status, not a substring match of the stringified error",
-      category: "correctness",
-      rationale: 'The SDK raises typed Browserbase.APIError (and subclasses like NotFoundError) carrying a real .status: number and .headers. Matching err.message or String(err) against substrings like "410" or "Session stopped" is fragile \u2014 that human-readable text is an unversioned implementation detail the provider can change at any time without notice. Check err.status (or `instanceof`) instead.',
-      docsUrl: "https://docs.browserbase.com/reference/api/session-live-urls",
+      description: "onSnapshot called without an error callback \u2014 Firestore permission errors silently stop the listener",
+      category: "reliability",
+      rationale: "When Firestore denies a read, the listener silently stops emitting snapshots with no error state set or user feedback. Always provide a third argument error callback to onSnapshot so permission denials and connection drops are surfaced.",
+      docsUrl: "https://firebase.google.com/docs/firestore/query-data/listen#handle_listen_errors",
       recommended: true
     },
     messages: {
-      substringStatusMatch: "This catch block matches a substring of the stringified error instead of checking err.status or `instanceof Browserbase.APIError`."
+      missingErrorCallback: "onSnapshot called without an error callback. Firestore permission errors will silently stop the listener with no user feedback. Add an error callback: onSnapshot(ref, successFn, errorFn)."
     },
     schema: []
   },
   create(context) {
+    function isFunctionNode(n) {
+      return n?.type === "ArrowFunctionExpression" || n?.type === "FunctionExpression";
+    }
+    function isOptionsObject(n) {
+      return n?.type === "ObjectExpression";
+    }
     return {
-      CatchClause(node) {
-        const param = node.param;
-        const errName = param?.type === "Identifier" ? param.name : void 0;
-        if (!errName || !node.body) return;
-        if (usesTypedStatus(node.body, errName)) return;
-        const stringifiedVars = collectStringifiedVars(node.body, errName);
-        if (usesSubstringMatch(node.body, errName, stringifiedVars)) {
-          context.report({ node, messageId: "substringStatusMatch" });
+      CallExpression(node) {
+        const callee = node.callee;
+        if (callee?.type !== "Identifier" || callee.name !== "onSnapshot") return;
+        const args = node.arguments ?? [];
+        if (args.length === 2 && isFunctionNode(args[1])) {
+          context.report({ node, messageId: "missingErrorCallback" });
+          return;
+        }
+        if (args.length === 3 && isOptionsObject(args[1]) && isFunctionNode(args[2])) {
+          context.report({ node, messageId: "missingErrorCallback" });
         }
       }
     };
   }
 };
-var browserbaseUseTypedExceptionStatusNotSubstringRule = rule47;
+var firebaseOnSnapshotMissingErrorCallbackRule = rule47;
 
-// src/providers/browserbase/rules/release-session-on-connect-failure.ts
-function isSessionsCreateAwait(node) {
-  return node?.type === "AwaitExpression" && isSessionsCall(node.argument, "create");
-}
-function isConnectCall(node) {
-  if (node?.type !== "CallExpression") return false;
-  const callee = node.callee;
-  const name = callee?.type === "Identifier" ? callee.name : memberPropName3(node);
-  return !!name && /connect/i.test(name);
-}
-function isReleaseCall(node) {
-  if (node?.type !== "CallExpression") return false;
-  if (isSessionsCall(node, "update")) {
-    const optsArg = node.arguments?.[1];
-    const statusProp = findProperty2(optsArg, "status");
-    if (statusProp?.value?.type === "Literal" && statusProp.value.value === "REQUEST_RELEASE") return true;
-  }
-  const callee = node.callee;
-  const name = callee?.type === "Identifier" ? callee.name : memberPropName3(node);
-  return !!name && /requeststop|releasesession|release_session/i.test(name);
-}
+// src/providers/firebase/rules/firestore-document-size-guard.ts
 var rule48 = {
   meta: {
-    type: "problem",
+    type: "suggestion",
     docs: {
-      description: "A failed connect after session creation must release the session",
+      description: "Firestore write includes editor.getJSON() without a document size guard",
       category: "reliability",
-      rationale: `If the CDP connect call raises after sessions.create() already succeeded on Browserbase's side, the session stays RUNNING and only terminates once its timeout elapses (up to 6h) unless something explicitly calls sessions.update(id, { status: 'REQUEST_RELEASE' }). The SDK's own docs warn to do this before the timeout "to avoid additional charges." A connect call with no try/catch (or a catch that doesn't release) leaks the session on every connect failure.`,
-      docsUrl: "https://docs.browserbase.com/reference/api/update-a-session",
+      rationale: "Firestore documents have a 1 MiB limit. When a rich-text editor stores base64 images inline, a single paste can push the document over the limit. The write silently fails with INVALID_ARGUMENT. Always check document size before calling updateDoc/setDoc when the payload includes editor JSON.",
+      docsUrl: "https://firebase.google.com/docs/firestore/quotas#limits",
       recommended: true
     },
     messages: {
-      sessionNotReleasedOnFailure: 'A session was created but this connect call has no catch that releases it (sessions.update with status: "REQUEST_RELEASE") on failure. A failed connect will leak the session until its timeout.'
+      missingDocumentSizeGuard: "Firestore write includes editor.getJSON() without a document size check. Base64 images can exceed the 1 MiB Firestore limit, silently failing the write. Add a Blob size guard before calling updateDoc/setDoc."
     },
     schema: []
   },
   create(context) {
-    let sawSessionCreate = false;
-    const connectCalls = [];
-    const tryStatements = [];
+    const WRITE_FNS = /* @__PURE__ */ new Set(["updateDoc", "setDoc"]);
+    const flagCandidates = [];
+    let hasBlobCheck = false;
+    function containsGetJson(args) {
+      return args.some(
+        (arg) => someDescendant(arg, (n) => {
+          if (n?.type !== "CallExpression") return false;
+          const callee = n.callee;
+          return callee?.type === "MemberExpression" && callee.property?.type === "Identifier" && callee.property.name === "getJSON";
+        })
+      );
+    }
     return {
-      AwaitExpression(node) {
-        if (isSessionsCreateAwait(node)) sawSessionCreate = true;
-      },
-      TryStatement(node) {
-        tryStatements.push(node);
-      },
       CallExpression(node) {
-        if (isConnectCall(node)) connectCalls.push(node);
+        const callee = node.callee;
+        if (callee?.type === "Identifier" && WRITE_FNS.has(callee.name)) {
+          if (containsGetJson(node.arguments ?? [])) {
+            flagCandidates.push(node);
+          }
+        }
+      },
+      NewExpression(node) {
+        if (node.callee?.type === "Identifier" && node.callee.name === "Blob") {
+          hasBlobCheck = true;
+        }
       },
       "Program:exit"() {
-        if (!sawSessionCreate) return;
-        for (const call of connectCalls) {
-          const enclosingTry = tryStatements.find((t) => t.block && contains3(t.block, call));
-          const handled = !!enclosingTry?.handler && someDescendant2(enclosingTry.handler, isReleaseCall);
-          if (!handled) {
-            context.report({ node: call, messageId: "sessionNotReleasedOnFailure" });
-          }
+        if (hasBlobCheck) return;
+        for (const node of flagCandidates) {
+          context.report({ node, messageId: "missingDocumentSizeGuard" });
         }
       }
     };
   }
 };
-var browserbaseReleaseSessionOnConnectFailureRule = rule48;
+var firebaseFirestoreDocumentSizeGuardRule = rule48;
 
-// src/providers/browserbase/rules/dont-stack-custom-retry-on-sdk-retry.ts
+// src/providers/firebase/rules/use-timestamp-now.ts
 var rule49 = {
   meta: {
     type: "suggestion",
     docs: {
-      description: "A custom retry loop around sessions.create must disable the SDK's own retry",
-      category: "reliability",
-      rationale: "The Browserbase client already retries internally (default maxRetries: 2, retrying 408/409/429/5xx with Retry-After-aware exponential backoff) before ever raising an exception back to the caller. A hand-rolled retry loop around sessions.create() that does not pass { maxRetries: 0 } stacks two independent, uncoordinated backoff schedules \u2014 a sustained 429 can trigger N outer attempts x (1 + 2 SDK-internal retries), multiplying worst-case latency well beyond what either layer alone would produce.",
-      docsUrl: "https://docs.browserbase.com/optimizations/concurrency/overview",
+      description: "new Date() used for Firestore timestamp instead of Timestamp.now() or serverTimestamp()",
+      category: "correctness",
+      rationale: "While Firestore auto-converts Date objects on write, mixing new Date() with Timestamp.now() creates type inconsistencies. Firestore security rules that compare request.resource.data.createdAt against request.time expect a Timestamp on both sides; a bare Date object can cause silent rule evaluation failures.",
+      docsUrl: "https://firebase.google.com/docs/reference/js/firestore_.timestamp",
       recommended: true
     },
     messages: {
-      stackedRetry: "sessions.create() is called inside a custom retry loop with no { maxRetries: 0 } override \u2014 the SDK retries this call internally too, stacking two backoff schedules."
+      useTimestampNow: "Use Timestamp.now() or serverTimestamp() instead of new Date() for Firestore timestamp fields. new Date() creates type inconsistencies with security rules that compare against request.time."
     },
     schema: []
   },
   create(context) {
-    const loopRanges = [];
+    let importsFromFirestore = false;
     return {
-      ForStatement(node) {
-        loopRanges.push(node);
-      },
-      WhileStatement(node) {
-        loopRanges.push(node);
-      },
-      DoWhileStatement(node) {
-        loopRanges.push(node);
-      },
-      CallExpression(node) {
-        if (!isSessionsCall(node, "create")) return;
-        const insideLoop = loopRanges.some((loop) => {
-          const start = loop.range?.[0] ?? loop.start;
-          const end = loop.range?.[1] ?? loop.end;
-          const pos = node.range?.[0] ?? node.start;
-          return pos >= start && pos <= end;
-        });
-        if (!insideLoop) return;
-        const optsArg = node.arguments?.[1];
-        const hasMaxRetries = optsArg?.type === "ObjectExpression" && !!findProperty2(optsArg, "maxRetries");
-        if (!hasMaxRetries) {
-          context.report({ node, messageId: "stackedRetry" });
+      ImportDeclaration(node) {
+        const src = node.source?.value;
+        if (typeof src === "string" && (src.startsWith("firebase/") || src === "firebase-admin/firestore")) {
+          importsFromFirestore = true;
         }
+      },
+      NewExpression(node) {
+        if (!importsFromFirestore) return;
+        if (node.callee?.type !== "Identifier" || node.callee.name !== "Date") return;
+        if ((node.arguments ?? []).length !== 0) return;
+        context.report({ node, messageId: "useTimestampNow" });
       }
     };
   }
 };
-var browserbaseDontStackCustomRetryOnSdkRetryRule = rule49;
+var firebaseUseTimestampNowRule = rule49;
 
-// src/providers/browserbase/rules/no-overbroad-error-substring-match.ts
-var OVERBROAD_TERMS = /* @__PURE__ */ new Set(["session", "context", "browser", "browserbase"]);
-function collectIncludesLiterals(test, literals) {
-  if (!test) return;
-  if (test.type === "LogicalExpression" && test.operator === "||") {
-    collectIncludesLiterals(test.left, literals);
-    collectIncludesLiterals(test.right, literals);
-    return;
+// src/providers/lovable/utils.ts
+var LLM_HOST_PATTERN = /api\.anthropic\.com|api\.openai\.com/;
+function containsKnownLlmHost(node) {
+  if (node?.type === "Literal" && typeof node.value === "string") {
+    return LLM_HOST_PATTERN.test(node.value);
   }
-  if (test.type === "CallExpression" && memberPropName3(test) === "includes") {
-    const arg = test.arguments?.[0];
-    if (arg?.type === "Literal" && typeof arg.value === "string") literals.push(arg.value.toLowerCase());
+  if (node?.type === "TemplateLiteral") {
+    return (node.quasis ?? []).some((q) => LLM_HOST_PATTERN.test(q.value?.raw ?? ""));
   }
+  return false;
 }
-function isCleanupCall(node) {
-  if (node?.type !== "CallExpression") return false;
-  const callee = node.callee;
-  const name = callee?.type === "Identifier" ? callee.name : memberPropName3(node);
-  return !!name && /release|remove|cleanup|stop|teardown/i.test(name);
-}
+
+// src/providers/lovable/rules/no-client-side-secret-fetch.ts
 var rule50 = {
   meta: {
     type: "problem",
     docs: {
-      description: "Error-message checks must not OR in a single generic resource-name substring",
-      category: "reliability",
-      rationale: 'A condition like `err.includes("not found") || err.includes("404") || err.includes("session")` looks like it is narrowing to a confirmed session-ended error, but the last clause matches a single generic word \u2014 the name of the resource being polled. Virtually any exception raised from a sessions.* call (a connection reset, an SSL error, a generic timeout that echoes the request URL) is likely to contain that substring too. A coincidental match then triggers the same destructive cleanup as a real 404/410, tearing down a healthy session on a transient blip.',
-      docsUrl: "https://docs.browserbase.com/reference/api/session-live-urls",
+      description: "LLM provider calls must not run client-side with a VITE_-exposed API key",
+      category: "security",
+      cwe: "CWE-522",
+      owasp: "A02:2021 \u2013 Cryptographic Failures",
+      rationale: "Anything read from import.meta.env.VITE_* is inlined into the production JS bundle at build time and is visible to every site visitor via the Network tab or by reading the bundle \u2014 no git access required. Lovable documents Edge Functions specifically so the provider key stays server-side in Secrets and the browser calls your own Edge Function instead of the provider directly.",
+      docsUrl: "https://docs.lovable.dev/features/security",
       recommended: true
     },
     messages: {
-      overbroadMatch: 'This OR-chain includes a generic substring check ("{{term}}") that matches almost any error from a sessions.* call, not just a confirmed session-ended response.'
-    },
-    schema: []
+      clientSideSecretFetch: "This fetch() calls an LLM provider directly with a key sourced from import.meta.env.VITE_* \u2014 that key ships into the browser bundle and is visible to every visitor."
+    }
   },
   create(context) {
+    const viteVars = /* @__PURE__ */ new Set();
+    function propName2(node) {
+      if (!node) return void 0;
+      if (node.type === "Identifier") return node.name;
+      if (node.type === "Literal" && typeof node.value === "string") return node.value;
+      return void 0;
+    }
+    function isImportMetaEnvViteAccess(node) {
+      if (node?.type !== "MemberExpression" || node.computed) return false;
+      const propertyName = node.property?.name;
+      if (typeof propertyName !== "string" || !propertyName.startsWith("VITE_")) return false;
+      const envMember = node.object;
+      if (envMember?.type !== "MemberExpression" || envMember.computed) return false;
+      if (envMember.property?.name !== "env") return false;
+      const metaProp = envMember.object;
+      return metaProp?.type === "MetaProperty" && metaProp.meta?.name === "import" && metaProp.property?.name === "meta";
+    }
+    function referencesViteSecret(node) {
+      if (!node) return false;
+      if (isImportMetaEnvViteAccess(node)) return true;
+      if (node.type === "Identifier" && viteVars.has(node.name)) return true;
+      if (node.type === "TemplateLiteral") {
+        return (node.expressions ?? []).some((e) => referencesViteSecret(e));
+      }
+      return false;
+    }
     return {
-      IfStatement(node) {
-        const literals = [];
-        collectIncludesLiterals(node.test, literals);
-        if (literals.length < 2) return;
-        const overbroad = literals.find((l) => OVERBROAD_TERMS.has(l));
-        if (!overbroad) return;
-        if (someDescendant2(node.consequent, isCleanupCall)) {
-          context.report({ node, messageId: "overbroadMatch", data: { term: overbroad } });
+      VariableDeclarator(node) {
+        if (node.id?.type === "Identifier" && isImportMetaEnvViteAccess(node.init)) {
+          viteVars.add(node.id.name);
         }
-      }
-    };
-  }
-};
-var browserbaseNoOverbroadErrorSubstringMatchRule = rule50;
-
-// src/providers/browserbase/rules/use-sdk-not-raw-requests.ts
-var BROWSERBASE_HOST = "api.browserbase.com";
-function templateLiteralContainsHost(node) {
-  return (node.quasis ?? []).some((q) => {
-    const text = q?.value?.cooked ?? q?.value?.raw ?? "";
-    return typeof text === "string" && text.includes(BROWSERBASE_HOST);
-  });
-}
-function urlArgContainsHost(node) {
-  if (node?.type === "Literal" && typeof node.value === "string") return node.value.includes(BROWSERBASE_HOST);
-  if (node?.type === "TemplateLiteral") return templateLiteralContainsHost(node);
-  return false;
-}
-function isRawHttpCall(node) {
-  if (node?.type !== "CallExpression") return { isCall: false, urlArg: void 0 };
-  const callee = node.callee;
-  if (callee?.type === "Identifier" && callee.name === "fetch") {
-    return { isCall: true, urlArg: node.arguments?.[0] };
-  }
-  if (callee?.type === "MemberExpression" && !callee.computed && callee.property?.type === "Identifier") {
-    const objName = callee.object?.type === "Identifier" ? callee.object.name : void 0;
-    const methodName = callee.property.name;
-    if (objName && /^(axios|http|https)$/i.test(objName) && /^(get|post|put|patch|delete|request)$/i.test(methodName)) {
-      return { isCall: true, urlArg: node.arguments?.[0] };
-    }
-  }
-  if (callee?.type === "Identifier" && callee.name === "axios") {
-    const arg = node.arguments?.[0];
-    if (arg?.type === "ObjectExpression") {
-      const urlProp = arg.properties?.find(
-        (p) => p?.type === "Property" && p.key?.type === "Identifier" && p.key.name === "url"
-      );
-      return { isCall: true, urlArg: urlProp?.value };
-    }
-    return { isCall: true, urlArg: arg };
+      },
+      CallExpression(node) {
+        const callee = node.callee;
+        if (callee?.type !== "Identifier" || callee.name !== "fetch") return;
+        const urlArg = node.arguments?.[0];
+        if (!containsKnownLlmHost(urlArg)) return;
+        const optsArg = node.arguments?.[1];
+        if (optsArg?.type !== "ObjectExpression") return;
+        const headersProp = (optsArg.properties ?? []).find(
+          (p) => p?.type === "Property" && propName2(p.key) === "headers"
+        );
+        if (!headersProp || headersProp.value?.type !== "ObjectExpression") return;
+        for (const hp of headersProp.value.properties ?? []) {
+          if (hp?.type !== "Property") continue;
+          const keyName = propName2(hp.key)?.toLowerCase();
+          if (keyName !== "x-api-key" && keyName !== "authorization") continue;
+          if (referencesViteSecret(hp.value)) {
+            context.report({ node, messageId: "clientSideSecretFetch" });
+            return;
+          }
+        }
+      }
+    };
   }
-  return { isCall: false, urlArg: void 0 };
-}
+};
+var lovableNoClientSideSecretFetchRule = rule50;
+
+// src/providers/lovable/rules/paid-flag-without-edge-function.ts
+var PRICE_PATTERN = /\$\s?\d/;
+var FLAG_PROPERTY_PATTERN = /^is_[a-z0-9_]+$/i;
+var FLAG_SUFFIX_PATTERN = /_(unlocked|active|enabled)$/i;
 var rule51 = {
   meta: {
-    type: "suggestion",
+    type: "problem",
     docs: {
-      description: "Use the installed Browserbase SDK instead of hand-rolled HTTP requests",
-      category: "integration",
-      rationale: "A raw fetch/axios/http call to an api.browserbase.com endpoint duplicates a method the installed SDK already exposes (e.g. sessions.recording.retrieve()), forfeiting its typed exceptions, built-in retry/backoff, and consistent error handling \u2014 and risks drifting on auth header naming or response shape as the API evolves.",
-      docsUrl: "https://docs.browserbase.com/reference/sdk/nodejs",
+      description: "A paid feature flag must not be set by a direct database update with no payment-provider call",
+      category: "security",
+      cwe: "CWE-840",
+      owasp: "A04:2021 \u2013 Insecure Design",
+      rationale: "Lovable documents payment processing as Edge Function territory specifically so purchase/premium-access flags are only ever set after a payment provider confirms payment server-side. A handler that writes a paid-looking flag straight from the client with no payment call in between either never actually charges anyone, or \u2014 even if a charge happens elsewhere \u2014 leaves the flag itself freely settable by any caller with write access to the row.",
+      docsUrl: "https://docs.lovable.dev/features/cloud",
       recommended: true
     },
     messages: {
-      rawRequestToBrowserbase: "This makes a raw HTTP request to a Browserbase API endpoint instead of using the installed SDK."
-    },
-    schema: []
+      paidFlagWithoutPayment: "This sets a paid-looking flag via a direct database update, but nothing in this function calls a payment provider or Edge Function first \u2014 the flag can be set without anyone paying."
+    }
   },
   create(context) {
-    const urlVars = /* @__PURE__ */ new Map();
+    const stack = [];
+    const states = /* @__PURE__ */ new Map();
+    let sawPriceLabel = false;
+    function ensureState(fn) {
+      let s = states.get(fn);
+      if (!s) {
+        s = { sawFlagUpdate: false, updateNode: null, sawPaymentCall: false };
+        states.set(fn, s);
+      }
+      return s;
+    }
+    function top() {
+      return stack[stack.length - 1];
+    }
+    function pushScope(node) {
+      stack.push(node);
+      ensureState(node);
+    }
+    function popScope() {
+      stack.pop();
+    }
+    function propName2(node) {
+      if (!node) return void 0;
+      if (node.type === "Identifier") return node.name;
+      if (node.type === "Literal" && typeof node.value === "string") return node.value;
+      return void 0;
+    }
+    function isBooleanFlagProperty(name) {
+      if (!name) return false;
+      return FLAG_PROPERTY_PATTERN.test(name) || FLAG_SUFFIX_PATTERN.test(name);
+    }
+    function isSupabaseUpdateCall(node) {
+      if (node?.type !== "CallExpression") return false;
+      const callee = node.callee;
+      return callee?.type === "MemberExpression" && callee.property?.name === "update";
+    }
+    function updateSetsBooleanFlag(node) {
+      const arg = node.arguments?.[0];
+      if (arg?.type !== "ObjectExpression") return false;
+      return (arg.properties ?? []).some(
+        (p) => p?.type === "Property" && isBooleanFlagProperty(propName2(p.key))
+      );
+    }
+    function memberChainNames2(node, names = []) {
+      if (node?.type === "MemberExpression") {
+        memberChainNames2(node.object, names);
+        const n = propName2(node.property);
+        if (n) names.push(n);
+      } else if (node?.type === "Identifier") {
+        names.push(node.name);
+      } else if (node?.type === "CallExpression") {
+        memberChainNames2(node.callee, names);
+      }
+      return names;
+    }
+    function isPaymentRelatedCall(node) {
+      if (node?.type !== "CallExpression") return false;
+      const chain = memberChainNames2(node.callee).join(".").toLowerCase();
+      if (/stripe|checkout|payment/.test(chain)) return true;
+      if (chain.includes("functions") && chain.endsWith(".invoke")) return true;
+      if (node.callee?.type === "Identifier" && node.callee.name === "fetch") {
+        const urlArg = node.arguments?.[0];
+        if (urlArg?.type === "Literal" && typeof urlArg.value === "string") {
+          return urlArg.value.includes("/functions/");
+        }
+        if (urlArg?.type === "TemplateLiteral") {
+          return (urlArg.quasis ?? []).some((q) => (q.value?.raw ?? "").includes("/functions/"));
+        }
+      }
+      return false;
+    }
     return {
-      VariableDeclarator(node) {
-        if (node.id?.type === "Identifier" && urlArgContainsHost(node.init)) {
-          urlVars.set(node.id.name, node.init);
+      Program(node) {
+        pushScope(node);
+      },
+      "Program:exit"() {
+        if (!sawPriceLabel) return;
+        for (const state of states.values()) {
+          if (state.sawFlagUpdate && !state.sawPaymentCall) {
+            context.report({ node: state.updateNode, messageId: "paidFlagWithoutPayment" });
+          }
         }
       },
+      FunctionDeclaration(node) {
+        pushScope(node);
+      },
+      "FunctionDeclaration:exit"() {
+        popScope();
+      },
+      FunctionExpression(node) {
+        pushScope(node);
+      },
+      "FunctionExpression:exit"() {
+        popScope();
+      },
+      ArrowFunctionExpression(node) {
+        pushScope(node);
+      },
+      "ArrowFunctionExpression:exit"() {
+        popScope();
+      },
+      Literal(node) {
+        if (typeof node.value === "string" && PRICE_PATTERN.test(node.value)) sawPriceLabel = true;
+      },
+      JSXText(node) {
+        if (typeof node.value === "string" && PRICE_PATTERN.test(node.value)) sawPriceLabel = true;
+      },
+      TemplateElement(node) {
+        if (PRICE_PATTERN.test(node.value?.raw ?? "")) sawPriceLabel = true;
+      },
       CallExpression(node) {
-        const { isCall, urlArg } = isRawHttpCall(node);
-        if (!isCall || !urlArg) return;
-        const resolved = urlArg.type === "Identifier" ? urlVars.get(urlArg.name) ?? urlArg : urlArg;
-        if (urlArgContainsHost(resolved)) {
-          context.report({ node, messageId: "rawRequestToBrowserbase" });
+        const fn = top();
+        if (!fn) return;
+        const state = ensureState(fn);
+        if (isSupabaseUpdateCall(node) && updateSetsBooleanFlag(node) && !state.sawFlagUpdate) {
+          state.sawFlagUpdate = true;
+          state.updateNode = node;
+        }
+        if (isPaymentRelatedCall(node)) {
+          state.sawPaymentCall = true;
         }
       }
     };
   }
 };
-var browserbaseUseSdkNotRawRequestsRule = rule51;
+var lovablePaidFlagWithoutEdgeFunctionRule = rule51;
 
-// src/providers/browserbase/rules/centralize-request-release.ts
+// src/providers/lovable/rules/expiry-column-never-checked.ts
+var EXPIRY_COLUMN_PATTERN = /_(until|expires?_at|expiry)$/i;
+var DATE_COMPARISON_OPERATORS = /* @__PURE__ */ new Set([">", "<", ">=", "<="]);
+var FILTER_METHODS = /* @__PURE__ */ new Set(["gt", "gte", "lt", "lte"]);
 var rule52 = {
   meta: {
     type: "suggestion",
     docs: {
-      description: "Route REQUEST_RELEASE through a single shared abstraction",
-      category: "integration",
-      rationale: 'sessions.update(id, { status: "REQUEST_RELEASE" }) hand-rolled inline at each call site, with each one carrying slightly different error handling, means an API change (a new required field, a renamed status value) requires fixing every call site instead of one \u2014 and the duplicated copies already drift in error-handling quality. Centralize behind one designated provider method (e.g. requestStop()/releaseSession()) and call that everywhere instead.',
-      docsUrl: "https://docs.browserbase.com/reference/api/update-a-session",
+      description: "An expiry column must be checked against the current time somewhere",
+      category: "correctness",
+      rationale: "Writing a *_until/*_expires_at column without ever comparing it to the current time anywhere in the codebase means the expiry is purely cosmetic \u2014 whatever it was meant to gate (a boost, a trial, a temporary unlock) never actually expires once granted, whether it was granted legitimately or through an unrelated bug.",
+      docsUrl: "https://docs.lovable.dev/features/cloud",
       recommended: true
     },
     messages: {
-      inlineRequestRelease: 'sessions.update(..., { status: "REQUEST_RELEASE" }) is hand-rolled inline here. Route this through a single shared release/provider abstraction instead.'
-    },
-    schema: []
+      expiryNeverChecked: 'The "{{column}}" column is written here but is never compared against the current time anywhere in this file, so it never actually expires anything.'
+    }
   },
   create(context) {
-    const filename = String(context.filename ?? "");
-    if (isInsideTestFile3(filename) || /provider|browserbaseclient/i.test(filename)) {
-      return {};
+    const writtenColumns = /* @__PURE__ */ new Map();
+    const readColumns = /* @__PURE__ */ new Set();
+    function propName2(node) {
+      if (!node) return void 0;
+      if (node.type === "Identifier") return node.name;
+      if (node.type === "Literal" && typeof node.value === "string") return node.value;
+      return void 0;
+    }
+    function isSupabaseUpdateCall(node) {
+      if (node?.type !== "CallExpression") return false;
+      const callee = node.callee;
+      return callee?.type === "MemberExpression" && callee.property?.name === "update";
+    }
+    function containsDateNowOrNewDate(node, depth = 0) {
+      if (!node || typeof node !== "object" || depth > 6) return false;
+      if (node.type === "NewExpression" && node.callee?.type === "Identifier" && node.callee.name === "Date") {
+        return true;
+      }
+      if (node.type === "CallExpression" && node.callee?.type === "MemberExpression" && node.callee.object?.type === "Identifier" && node.callee.object.name === "Date" && node.callee.property?.name === "now") {
+        return true;
+      }
+      if (node.type === "MemberExpression") {
+        return containsDateNowOrNewDate(node.object, depth + 1) || containsDateNowOrNewDate(node.callee, depth + 1);
+      }
+      if (node.type === "CallExpression") {
+        return containsDateNowOrNewDate(node.callee, depth + 1);
+      }
+      return false;
+    }
+    function memberPropertyName(node) {
+      if (node?.type !== "MemberExpression") return void 0;
+      return propName2(node.property);
     }
     return {
       CallExpression(node) {
-        if (!isSessionsCall(node, "update")) return;
-        const optsArg = node.arguments?.[1];
-        const statusProp = findProperty2(optsArg, "status");
-        const val = statusProp?.value;
-        if (val?.type === "Literal" && val.value === "REQUEST_RELEASE") {
-          context.report({ node, messageId: "inlineRequestRelease" });
+        if (isSupabaseUpdateCall(node)) {
+          const arg = node.arguments?.[0];
+          if (arg?.type === "ObjectExpression") {
+            for (const prop of arg.properties ?? []) {
+              if (prop?.type !== "Property") continue;
+              const keyName = propName2(prop.key);
+              if (keyName && EXPIRY_COLUMN_PATTERN.test(keyName) && !writtenColumns.has(keyName)) {
+                writtenColumns.set(keyName, node);
+              }
+            }
+          }
+        }
+        const callee = node.callee;
+        if (callee?.type === "MemberExpression" && FILTER_METHODS.has(callee.property?.name)) {
+          const colArg = node.arguments?.[0];
+          const colName = colArg?.type === "Literal" ? propName2(colArg) : void 0;
+          if (colName && EXPIRY_COLUMN_PATTERN.test(colName)) {
+            readColumns.add(colName);
+          }
+        }
+      },
+      BinaryExpression(node) {
+        if (!DATE_COMPARISON_OPERATORS.has(node.operator)) return;
+        const leftCol = memberPropertyName(node.left);
+        const rightCol = memberPropertyName(node.right);
+        if (leftCol && EXPIRY_COLUMN_PATTERN.test(leftCol) && containsDateNowOrNewDate(node.right)) {
+          readColumns.add(leftCol);
+        }
+        if (rightCol && EXPIRY_COLUMN_PATTERN.test(rightCol) && containsDateNowOrNewDate(node.left)) {
+          readColumns.add(rightCol);
+        }
+      },
+      "Program:exit"() {
+        for (const [column, node] of writtenColumns) {
+          if (!readColumns.has(column)) {
+            context.report({ node, messageId: "expiryNeverChecked", data: { column } });
+          }
+        }
+      }
+    };
+  }
+};
+var lovableExpiryColumnNeverCheckedRule = rule52;
+
+// src/providers/lovable/rules/silent-catch-on-provider-call.ts
+var LOGGING_CONSOLE_METHODS = /* @__PURE__ */ new Set(["error", "warn", "log", "info"]);
+var rule53 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "A catch block around an LLM provider call must log the failure",
+      category: "correctness",
+      rationale: `Returning null/undefined from a bare catch with no logging makes every failure mode \u2014 missing key, expired key, rate limit, malformed response, network error \u2014 look identical to "no key configured." If a deployment's provider key starts failing in production, this is invisible: there is nothing in the browser or error-tracking logs to distinguish a real outage from an intentionally-unconfigured feature.`,
+      docsUrl: "https://docs.lovable.dev/features/cloud",
+      recommended: true
+    },
+    messages: {
+      silentCatch: 'This catch block swallows a failed LLM provider call with no logging \u2014 a real failure (expired key, rate limit, network error) is indistinguishable from "no key configured."'
+    }
+  },
+  create(context) {
+    function findFetchToLlmHost(node, depth = 0) {
+      if (!node || typeof node !== "object" || depth > 12) return null;
+      if (Array.isArray(node)) {
+        for (const n of node) {
+          const found = findFetchToLlmHost(n, depth + 1);
+          if (found) return found;
+        }
+        return null;
+      }
+      if (node.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "fetch") {
+        const urlArg = node.arguments?.[0];
+        if (containsKnownLlmHost(urlArg)) return node;
+      }
+      for (const key of Object.keys(node)) {
+        if (key === "parent" || key === "loc" || key === "range") continue;
+        const val = node[key];
+        if (val && typeof val === "object") {
+          const found = findFetchToLlmHost(val, depth + 1);
+          if (found) return found;
+        }
+      }
+      return null;
+    }
+    function containsLoggingCall(node, depth = 0) {
+      if (!node || typeof node !== "object" || depth > 12) return false;
+      if (Array.isArray(node)) return node.some((n) => containsLoggingCall(n, depth + 1));
+      if (node.type === "CallExpression") {
+        const callee = node.callee;
+        if (callee?.type === "MemberExpression") {
+          const objName = callee.object?.type === "Identifier" ? callee.object.name : void 0;
+          const propertyName = callee.property?.name;
+          if (objName === "console" && LOGGING_CONSOLE_METHODS.has(propertyName)) return true;
+          if (propertyName === "captureException") return true;
+        }
+        if (callee?.type === "Identifier" && callee.name === "reportError") return true;
+      }
+      for (const key of Object.keys(node)) {
+        if (key === "parent" || key === "loc" || key === "range") continue;
+        const val = node[key];
+        if (val && typeof val === "object") {
+          if (containsLoggingCall(val, depth + 1)) return true;
+        }
+      }
+      return false;
+    }
+    return {
+      TryStatement(node) {
+        const fetchNode = findFetchToLlmHost(node.block);
+        if (!fetchNode) return;
+        const handler = node.handler;
+        if (!handler) return;
+        if (!containsLoggingCall(handler.body)) {
+          context.report({ node: handler, messageId: "silentCatch" });
+        }
+      }
+    };
+  }
+};
+var lovableSilentCatchOnProviderCallRule = rule53;
+
+// src/providers/browserbase/utils.ts
+function memberPropName3(node) {
+  if (node?.type !== "CallExpression") return void 0;
+  const callee = node.callee;
+  if (callee?.type !== "MemberExpression") return void 0;
+  const prop = callee.property;
+  if (!callee.computed && prop?.type === "Identifier") return prop.name;
+  if (callee.computed && prop?.type === "Literal" && typeof prop.value === "string") return prop.value;
+  return void 0;
+}
+function isSessionsCall(node, name) {
+  if (memberPropName3(node) !== name) return false;
+  const obj = node.callee.object;
+  return obj?.type === "MemberExpression" && !obj.computed && obj.property?.type === "Identifier" && obj.property.name === "sessions";
+}
+function isSessionsRecordingCall(node, name) {
+  if (memberPropName3(node) !== name) return false;
+  const recordingObj = node.callee.object;
+  if (recordingObj?.type !== "MemberExpression" || recordingObj.computed) return false;
+  if (recordingObj.property?.type !== "Identifier" || recordingObj.property.name !== "recording") return false;
+  const sessionsObj = recordingObj.object;
+  return sessionsObj?.type === "MemberExpression" && !sessionsObj.computed && sessionsObj.property?.type === "Identifier" && sessionsObj.property.name === "sessions";
+}
+function findProperty2(objectExpression, name) {
+  if (objectExpression?.type !== "ObjectExpression") return void 0;
+  return objectExpression.properties?.find(
+    (p) => p?.type === "Property" && (p.key?.type === "Identifier" && p.key.name === name || p.key?.type === "Literal" && p.key.value === name)
+  );
+}
+function startOffset3(n) {
+  if (typeof n?.range?.[0] === "number") return n.range[0];
+  if (typeof n?.start === "number") return n.start;
+  return (n?.loc?.start?.line ?? 0) * 1e6 + (n?.loc?.start?.column ?? 0);
+}
+function endOffset3(n) {
+  if (typeof n?.range?.[1] === "number") return n.range[1];
+  if (typeof n?.end === "number") return n.end;
+  return (n?.loc?.end?.line ?? n?.loc?.start?.line ?? 0) * 1e6 + (n?.loc?.end?.column ?? 0);
+}
+function contains3(outer, inner) {
+  const s = startOffset3(inner);
+  return s >= startOffset3(outer) && s <= endOffset3(outer);
+}
+function someDescendant2(node, predicate) {
+  let found = false;
+  function visit(n) {
+    if (found || !n || typeof n !== "object") return;
+    if (Array.isArray(n)) {
+      for (const item of n) visit(item);
+      return;
+    }
+    if (typeof n.type !== "string") return;
+    if (predicate(n)) {
+      found = true;
+      return;
+    }
+    for (const key of Object.keys(n)) {
+      if (key === "parent" || key === "loc" || key === "range") continue;
+      visit(n[key]);
+    }
+  }
+  visit(node);
+  return found;
+}
+function isResponseSendCall(node) {
+  const name = memberPropName3(node);
+  if (name !== "json" && name !== "send") return false;
+  const obj = node.callee.object;
+  if (obj?.type === "Identifier") {
+    return /^(res|response)$/i.test(obj.name) || obj.name === "Response" || obj.name === "NextResponse";
+  }
+  return false;
+}
+function isInsideTestFile3(filename) {
+  return /(^|[\\/])__tests__[\\/]|\.(test|spec)\.[cm]?[jt]sx?$/.test(filename);
+}
+
+// src/providers/browserbase/rules/no-conditional-authz-on-anonymous-user.ts
+function isUserLikeExpr(node) {
+  if (node?.type === "Identifier") return /user/i.test(node.name);
+  if (node?.type === "MemberExpression" && !node.computed && node.property?.type === "Identifier") {
+    return /user/i.test(node.property.name);
+  }
+  return false;
+}
+function isFalsyGuardTest(test) {
+  if (test?.type === "UnaryExpression" && test.operator === "!") return isUserLikeExpr(test.argument);
+  if (test?.type === "BinaryExpression" && (test.operator === "===" || test.operator === "==")) {
+    const sides = [test.left, test.right];
+    const isNullish = (n) => n?.type === "Literal" && n.value === null || n?.type === "Identifier" && n.name === "undefined";
+    const nullSide = sides.find(isNullish);
+    const otherSide = sides.find((s) => s !== nullSide);
+    return !!nullSide && isUserLikeExpr(otherSide);
+  }
+  return false;
+}
+function hasReturnOrThrow(stmt) {
+  if (!stmt) return false;
+  if (stmt.type === "ReturnStatement" || stmt.type === "ThrowStatement") return true;
+  if (stmt.type === "BlockStatement") {
+    return (stmt.body ?? []).some((s) => s.type === "ReturnStatement" || s.type === "ThrowStatement");
+  }
+  return false;
+}
+function isTruthyGateTest(test) {
+  if (isUserLikeExpr(test)) return true;
+  if (test?.type === "LogicalExpression" && test.operator === "&&") {
+    return isTruthyGateTest(test.left) || isTruthyGateTest(test.right);
+  }
+  return false;
+}
+var rule54 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Sensitive Browserbase resources must be guarded by unconditional authorization",
+      category: "security",
+      cwe: "CWE-862",
+      owasp: "A01:2021 Broken Access Control",
+      rationale: "bb.sessions.debug() and bb.sessions.recording.retrieve() return a live CDP debugger URL or a full rrweb session replay \u2014 high-value resources. Gating the ownership check behind `if (user) { ...check... }` with no unconditional `if (!user) return` guard means an anonymous caller (no credentials at all) simply skips the whole block and falls through to the sensitive call. Authorization must reject the unauthenticated case explicitly, not rely on a conditional that happens to be true for legitimate callers.",
+      docsUrl: "https://docs.browserbase.com/reference/api/session-live-urls",
+      recommended: true
+    },
+    messages: {
+      conditionalAuthz: "This route returns a Browserbase live-view/recording resource gated only by `if (user) {...}` with no unconditional rejection for anonymous callers. Add an `if (!user) return ...` guard before this."
+    },
+    schema: []
+  },
+  create(context) {
+    const scopes = [];
+    const gates = [];
+    const sensitiveCalls = [];
+    function registerScope(node) {
+      scopes.push({ node, start: startOffset3(node), end: endOffset3(node) });
+    }
+    function innermostScope(pos) {
+      let best;
+      for (const scope of scopes) {
+        if (pos < scope.start || pos > scope.end) continue;
+        if (!best || scope.end - scope.start < best.end - best.start) best = scope;
+      }
+      return best;
+    }
+    return {
+      FunctionDeclaration(node) {
+        registerScope(node);
+      },
+      FunctionExpression(node) {
+        registerScope(node);
+      },
+      ArrowFunctionExpression(node) {
+        registerScope(node);
+      },
+      IfStatement(node) {
+        if (isFalsyGuardTest(node.test) && hasReturnOrThrow(node.consequent)) {
+          const pos = startOffset3(node);
+          const scope = innermostScope(pos);
+          if (scope && (scope.guardPos === void 0 || pos < scope.guardPos)) scope.guardPos = pos;
+          return;
+        }
+        if (isTruthyGateTest(node.test) && !node.alternate) {
+          gates.push({ start: startOffset3(node), end: endOffset3(node) });
+        }
+      },
+      CallExpression(node) {
+        if (isSessionsCall(node, "debug") || isSessionsRecordingCall(node, "retrieve")) {
+          sensitiveCalls.push(node);
+        }
+      },
+      "Program:exit"() {
+        for (const call of sensitiveCalls) {
+          const gate = gates.find((g) => contains3(g, call));
+          if (!gate) continue;
+          const scope = innermostScope(startOffset3(call));
+          const hasGuardBeforeGate = scope?.guardPos !== void 0 && scope.guardPos < gate.start;
+          if (!hasGuardBeforeGate) {
+            context.report({ node: call, messageId: "conditionalAuthz" });
+          }
+        }
+      }
+    };
+  }
+};
+var browserbaseNoConditionalAuthzOnAnonymousUserRule = rule54;
+
+// src/providers/browserbase/rules/no-connect-url-in-api-response.ts
+var rule55 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "connectUrl must never be placed in an HTTP response body",
+      category: "security",
+      cwe: "CWE-200",
+      owasp: "A04:2021 Insecure Design",
+      rationale: "session.connectUrl is the WebSocket CDP URL returned by sessions.create() \u2014 it is self-authenticating; connecting to it grants full read/write control of the live browser (arbitrary JS execution, cookie/localStorage read, simulated input), equivalent to a bearer token. Putting it in a response body widens its exposure (network tab, browser extensions, error trackers, logs) for callers that almost never need it client-side \u2014 the intended sharable artifact is debuggerFullscreenUrl from sessions.debug().",
+      docsUrl: "https://docs.browserbase.com/reference/api/create-a-session",
+      recommended: true
+    },
+    messages: {
+      connectUrlInResponse: "connectUrl is included in an HTTP response body. Keep it server-side only \u2014 it is a bearer credential for the live browser, not a sharable URL."
+    },
+    schema: []
+  },
+  create(context) {
+    return {
+      CallExpression(node) {
+        if (!isResponseSendCall(node)) return;
+        const arg = node.arguments?.[0];
+        if (arg?.type !== "ObjectExpression") return;
+        if (findProperty2(arg, "connectUrl")) {
+          context.report({ node, messageId: "connectUrlInResponse" });
+        }
+      }
+    };
+  }
+};
+var browserbaseNoConnectUrlInApiResponseRule = rule55;
+
+// src/providers/browserbase/rules/session-id-requires-ownership-check.ts
+function isOwnershipCheckCall(node) {
+  if (node?.type !== "CallExpression") return false;
+  const callee = node.callee;
+  const name = callee?.type === "Identifier" ? callee.name : callee?.type === "MemberExpression" && !callee.computed && callee.property?.type === "Identifier" ? callee.property.name : void 0;
+  if (!name) return false;
+  return /owner|belongsto|hasaccess|authorize|verifyaccess|checkaccess|findproject|getproject/i.test(name);
+}
+function isSessionIdLikeArg(node) {
+  if (node?.type === "Identifier") return /sessionid/i.test(node.name);
+  if (node?.type === "MemberExpression" && !node.computed && node.property?.type === "Identifier") {
+    return /sessionid/i.test(node.property.name);
+  }
+  return false;
+}
+var rule56 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Session id lookups must verify ownership before returning live-view data",
+      category: "security",
+      cwe: "CWE-862",
+      rationale: "A session id alone is not an authorization token \u2014 it is an opaque identifier that can leak via links, logs, screenshots, or support tickets. A handler that resolves a sessionId straight into sessions.debug()/sessions.recording.retrieve() with no ownership/org-membership check lets any authenticated caller view or replay a session that belongs to someone else.",
+      docsUrl: "https://docs.browserbase.com/features/session-live-view",
+      recommended: true
+    },
+    messages: {
+      missingOwnershipCheck: "sessionId is passed directly into a Browserbase live-view/recording call with no ownership check beforehand."
+    },
+    schema: []
+  },
+  create(context) {
+    const scopes = [];
+    const sensitiveCalls = [];
+    function registerScope(node) {
+      scopes.push({ node, start: startOffset3(node), end: endOffset3(node), sawOwnershipCheck: false });
+    }
+    function innermostScope(pos) {
+      let best;
+      for (const scope of scopes) {
+        if (pos < scope.start || pos > scope.end) continue;
+        if (!best || scope.end - scope.start < best.end - best.start) best = scope;
+      }
+      return best;
+    }
+    return {
+      FunctionDeclaration(node) {
+        registerScope(node);
+      },
+      FunctionExpression(node) {
+        registerScope(node);
+      },
+      ArrowFunctionExpression(node) {
+        registerScope(node);
+      },
+      CallExpression(node) {
+        const pos = startOffset3(node);
+        const scope = innermostScope(pos);
+        if (isOwnershipCheckCall(node)) {
+          for (const s of scopes) {
+            if (pos >= s.start && pos <= s.end) s.sawOwnershipCheck = true;
+          }
+          return;
+        }
+        if (isSessionsCall(node, "debug") || isSessionsRecordingCall(node, "retrieve")) {
+          const sessionIdArg = (node.arguments ?? []).some(isSessionIdLikeArg);
+          if (sessionIdArg) sensitiveCalls.push({ node, scope });
+        }
+      },
+      "Program:exit"() {
+        for (const { node, scope } of sensitiveCalls) {
+          if (!scope || !scope.sawOwnershipCheck) {
+            context.report({ node, messageId: "missingOwnershipCheck" });
+          }
+        }
+      }
+    };
+  }
+};
+var browserbaseSessionIdRequiresOwnershipCheckRule = rule56;
+
+// src/providers/browserbase/rules/no-concurrent-shared-context.ts
+function isPromiseAllCall2(node) {
+  return node?.type === "CallExpression" && node.callee?.type === "MemberExpression" && !node.callee.computed && node.callee.object?.type === "Identifier" && node.callee.object.name === "Promise" && node.callee.property?.type === "Identifier" && node.callee.property.name === "all";
+}
+function isMapCall2(node) {
+  return memberPropName3(node) === "map";
+}
+function callbackParamNames(callback) {
+  const names = /* @__PURE__ */ new Set();
+  const param = callback?.params?.[0];
+  if (param?.type === "Identifier") {
+    names.add(param.name);
+  } else if (param?.type === "ObjectPattern") {
+    for (const p of param.properties ?? []) {
+      if (p?.type === "Property" && p.value?.type === "Identifier") names.add(p.value.name);
+      else if (p?.type === "RestElement" && p.argument?.type === "Identifier") names.add(p.argument.name);
+    }
+  }
+  return names;
+}
+function contextIdValueIsShared(callback, contextIdNode) {
+  if (contextIdNode?.type !== "Identifier") return false;
+  const params = callbackParamNames(callback);
+  if (params.has(contextIdNode.name)) return false;
+  return true;
+}
+function findSharedContextCreateCall(callback) {
+  const body = callback?.body;
+  if (!body) return null;
+  let found = null;
+  function visit(n) {
+    if (found || !n || typeof n !== "object") return;
+    if (Array.isArray(n)) {
+      for (const item of n) visit(item);
+      return;
+    }
+    if (typeof n.type !== "string") return;
+    if (isSessionsCall(n, "create")) {
+      const optsArg = n.arguments?.[0];
+      const browserSettings = findProperty2(optsArg, "browserSettings")?.value;
+      const ctxProp = findProperty2(browserSettings, "context")?.value;
+      const idProp = findProperty2(ctxProp, "id");
+      if (idProp && contextIdValueIsShared(callback, idProp.value)) {
+        found = n;
+        return;
+      }
+    }
+    for (const key of Object.keys(n)) {
+      if (key === "parent" || key === "loc" || key === "range") continue;
+      visit(n[key]);
+    }
+  }
+  visit(body);
+  return found;
+}
+var rule57 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "A Browserbase Context must not be attached to concurrent sessions",
+      category: "correctness",
+      rationale: `Browserbase's docs state explicitly: "Avoid having multiple sessions using the same Context at once. Sites may force a log out." Passing the same browserSettings.context.id into every iteration of a Promise.all(items.map(...)) batch creates 2+ Browserbase sessions simultaneously attached to one Context, producing non-deterministic, flaky failures when a site force-logs-out one session because another concurrently authenticated against the same context.`,
+      docsUrl: "https://docs.browserbase.com/features/contexts",
+      recommended: true
+    },
+    messages: {
+      concurrentSharedContext: "The same browserSettings.context.id is passed into every concurrent sessions.create() call in this Promise.all batch. Sites may force a log out when 2+ sessions share a Context at once."
+    },
+    schema: []
+  },
+  create(context) {
+    const mapCallsByVarName = /* @__PURE__ */ new Map();
+    function checkMapCall(mapCallNode) {
+      if (!isMapCall2(mapCallNode)) return;
+      const callback = mapCallNode.arguments?.[mapCallNode.arguments.length - 1];
+      if (!callback) return;
+      const sharedCall = findSharedContextCreateCall(callback);
+      if (sharedCall) {
+        context.report({ node: sharedCall, messageId: "concurrentSharedContext" });
+      }
+    }
+    return {
+      VariableDeclarator(node) {
+        if (node.id?.type === "Identifier" && isMapCall2(node.init)) {
+          mapCallsByVarName.set(node.id.name, node.init);
+        }
+      },
+      CallExpression(node) {
+        if (!isPromiseAllCall2(node)) return;
+        const arg = node.arguments?.[0];
+        if (isMapCall2(arg)) {
+          checkMapCall(arg);
+          return;
+        }
+        if (arg?.type === "Identifier") {
+          const mapCall = mapCallsByVarName.get(arg.name);
+          if (mapCall) checkMapCall(mapCall);
+        }
+      }
+    };
+  }
+};
+var browserbaseNoConcurrentSharedContextRule = rule57;
+
+// src/providers/browserbase/rules/mobile-device-requires-os-setting.ts
+function isMobileLiteral(node) {
+  return node?.type === "Literal" && (node.value === "mobile" || node.value === "tablet");
+}
+function testComparesToMobile(test) {
+  if (test?.type !== "BinaryExpression") return false;
+  if (test.operator !== "===" && test.operator !== "==") return false;
+  return isMobileLiteral(test.left) || isMobileLiteral(test.right);
+}
+function isViewportReference(node) {
+  if (node?.type === "Identifier") return /viewport/i.test(node.name);
+  if (node?.type === "MemberExpression" && !node.computed && node.property?.type === "Identifier") {
+    return /viewport|width|height/i.test(node.property.name);
+  }
+  if (node?.type === "Property") {
+    return node.key?.type === "Identifier" && /viewport|width|height/i.test(node.key.name);
+  }
+  return false;
+}
+function setsViewport(node) {
+  return someDescendant2(node, isViewportReference);
+}
+function isOsMobileSetting(node) {
+  if (node?.type === "Property" && node.key?.type === "Identifier" && node.key.name === "os" && isMobileLiteral(node.value)) {
+    return true;
+  }
+  if (node?.type === "AssignmentExpression" && node.left?.type === "MemberExpression" && !node.left.computed && node.left.property?.type === "Identifier" && node.left.property.name === "os" && isMobileLiteral(node.right)) {
+    return true;
+  }
+  return false;
+}
+var rule58 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Mobile device combos must set browserSettings.os, not just resize the viewport",
+      category: "correctness",
+      rationale: `The Node SDK's device emulation lever is browserSettings.os: 'mobile' | 'tablet' \u2014 there is no fingerprint API in this SDK. A "mobile" session that only resizes the Playwright viewport is still a desktop Chrome browser with a desktop user-agent string in a small window. Sites that branch behavior on UA/touch capability (the majority of responsive sites) never actually exercise their mobile code path, silently undermining "test on mobile" results.`,
+      docsUrl: "https://docs.browserbase.com/features/stealth-mode",
+      recommended: true
+    },
+    messages: {
+      missingOsSetting: 'A "mobile" branch resizes the viewport but never sets browserSettings.os to "mobile"/"tablet". Without it this is still a desktop browser in a small window.'
+    },
+    schema: []
+  },
+  create(context) {
+    const mobileViewportBranches = [];
+    let sawOsMobileSetting = false;
+    return {
+      IfStatement(node) {
+        if (testComparesToMobile(node.test) && setsViewport(node.consequent)) {
+          mobileViewportBranches.push(node);
+        }
+      },
+      Property(node) {
+        if (isOsMobileSetting(node)) sawOsMobileSetting = true;
+      },
+      AssignmentExpression(node) {
+        if (isOsMobileSetting(node)) sawOsMobileSetting = true;
+      },
+      "Program:exit"() {
+        if (sawOsMobileSetting) return;
+        for (const branch of mobileViewportBranches) {
+          context.report({ node: branch, messageId: "missingOsSetting" });
+        }
+      }
+    };
+  }
+};
+var browserbaseMobileDeviceRequiresOsSettingRule = rule58;
+
+// src/providers/browserbase/rules/use-typed-exception-status-not-substring.ts
+function isStringifiedErrorSource(node, errName) {
+  if (node?.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "String") {
+    const arg = node.arguments?.[0];
+    return arg?.type === "Identifier" && arg.name === errName;
+  }
+  if (node?.type === "CallExpression" && node.callee?.type === "MemberExpression") {
+    const obj = node.callee.object;
+    const prop = node.callee.property;
+    if (obj?.type === "Identifier" && obj.name === errName && prop?.type === "Identifier" && prop.name === "toString") {
+      return true;
+    }
+  }
+  if (node?.type === "MemberExpression" && !node.computed) {
+    const obj = node.object;
+    const prop = node.property;
+    if (obj?.type === "Identifier" && obj.name === errName && prop?.type === "Identifier" && prop.name === "message") {
+      return true;
+    }
+  }
+  return false;
+}
+function unwrapToLowerCase(node) {
+  if (node?.type === "CallExpression" && node.callee?.type === "MemberExpression" && node.callee.property?.type === "Identifier" && node.callee.property.name === "toLowerCase") {
+    return node.callee.object;
+  }
+  return node;
+}
+function usesTypedStatus(body, errName) {
+  return someDescendant2(body, (n) => {
+    if (n.type === "MemberExpression" && !n.computed && n.object?.type === "Identifier" && n.object.name === errName) {
+      return n.property?.type === "Identifier" && n.property.name === "status";
+    }
+    if (n.type === "BinaryExpression" && n.operator === "instanceof" && n.left?.type === "Identifier" && n.left.name === errName) {
+      return true;
+    }
+    return false;
+  });
+}
+function usesSubstringMatch(body, errName, stringifiedVars) {
+  return someDescendant2(body, (n) => {
+    if (n.type !== "CallExpression") return false;
+    if (n.callee?.type !== "MemberExpression" || n.callee.computed) return false;
+    if (n.callee.property?.type !== "Identifier" || n.callee.property.name !== "includes") return false;
+    const source = unwrapToLowerCase(n.callee.object);
+    if (isStringifiedErrorSource(source, errName)) return true;
+    return source?.type === "Identifier" && stringifiedVars.has(source.name);
+  });
+}
+function collectStringifiedVars(body, errName) {
+  const names = /* @__PURE__ */ new Set();
+  someDescendant2(body, (n) => {
+    if (n.type === "VariableDeclarator" && n.id?.type === "Identifier" && n.init) {
+      const source = unwrapToLowerCase(n.init);
+      if (isStringifiedErrorSource(source, errName)) names.add(n.id.name);
+    }
+    return false;
+  });
+  return names;
+}
+var rule59 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Branch on err.status, not a substring match of the stringified error",
+      category: "correctness",
+      rationale: 'The SDK raises typed Browserbase.APIError (and subclasses like NotFoundError) carrying a real .status: number and .headers. Matching err.message or String(err) against substrings like "410" or "Session stopped" is fragile \u2014 that human-readable text is an unversioned implementation detail the provider can change at any time without notice. Check err.status (or `instanceof`) instead.',
+      docsUrl: "https://docs.browserbase.com/reference/api/session-live-urls",
+      recommended: true
+    },
+    messages: {
+      substringStatusMatch: "This catch block matches a substring of the stringified error instead of checking err.status or `instanceof Browserbase.APIError`."
+    },
+    schema: []
+  },
+  create(context) {
+    return {
+      CatchClause(node) {
+        const param = node.param;
+        const errName = param?.type === "Identifier" ? param.name : void 0;
+        if (!errName || !node.body) return;
+        if (usesTypedStatus(node.body, errName)) return;
+        const stringifiedVars = collectStringifiedVars(node.body, errName);
+        if (usesSubstringMatch(node.body, errName, stringifiedVars)) {
+          context.report({ node, messageId: "substringStatusMatch" });
+        }
+      }
+    };
+  }
+};
+var browserbaseUseTypedExceptionStatusNotSubstringRule = rule59;
+
+// src/providers/browserbase/rules/release-session-on-connect-failure.ts
+function isSessionsCreateAwait(node) {
+  return node?.type === "AwaitExpression" && isSessionsCall(node.argument, "create");
+}
+function isConnectCall(node) {
+  if (node?.type !== "CallExpression") return false;
+  const callee = node.callee;
+  const name = callee?.type === "Identifier" ? callee.name : memberPropName3(node);
+  return !!name && /connect/i.test(name);
+}
+function isReleaseCall(node) {
+  if (node?.type !== "CallExpression") return false;
+  if (isSessionsCall(node, "update")) {
+    const optsArg = node.arguments?.[1];
+    const statusProp = findProperty2(optsArg, "status");
+    if (statusProp?.value?.type === "Literal" && statusProp.value.value === "REQUEST_RELEASE") return true;
+  }
+  const callee = node.callee;
+  const name = callee?.type === "Identifier" ? callee.name : memberPropName3(node);
+  return !!name && /requeststop|releasesession|release_session/i.test(name);
+}
+var rule60 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "A failed connect after session creation must release the session",
+      category: "reliability",
+      rationale: `If the CDP connect call raises after sessions.create() already succeeded on Browserbase's side, the session stays RUNNING and only terminates once its timeout elapses (up to 6h) unless something explicitly calls sessions.update(id, { status: 'REQUEST_RELEASE' }). The SDK's own docs warn to do this before the timeout "to avoid additional charges." A connect call with no try/catch (or a catch that doesn't release) leaks the session on every connect failure.`,
+      docsUrl: "https://docs.browserbase.com/reference/api/update-a-session",
+      recommended: true
+    },
+    messages: {
+      sessionNotReleasedOnFailure: 'A session was created but this connect call has no catch that releases it (sessions.update with status: "REQUEST_RELEASE") on failure. A failed connect will leak the session until its timeout.'
+    },
+    schema: []
+  },
+  create(context) {
+    let sawSessionCreate = false;
+    const connectCalls = [];
+    const tryStatements = [];
+    return {
+      AwaitExpression(node) {
+        if (isSessionsCreateAwait(node)) sawSessionCreate = true;
+      },
+      TryStatement(node) {
+        tryStatements.push(node);
+      },
+      CallExpression(node) {
+        if (isConnectCall(node)) connectCalls.push(node);
+      },
+      "Program:exit"() {
+        if (!sawSessionCreate) return;
+        for (const call of connectCalls) {
+          const enclosingTry = tryStatements.find((t) => t.block && contains3(t.block, call));
+          const handled = !!enclosingTry?.handler && someDescendant2(enclosingTry.handler, isReleaseCall);
+          if (!handled) {
+            context.report({ node: call, messageId: "sessionNotReleasedOnFailure" });
+          }
+        }
+      }
+    };
+  }
+};
+var browserbaseReleaseSessionOnConnectFailureRule = rule60;
+
+// src/providers/browserbase/rules/dont-stack-custom-retry-on-sdk-retry.ts
+var rule61 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "A custom retry loop around sessions.create must disable the SDK's own retry",
+      category: "reliability",
+      rationale: "The Browserbase client already retries internally (default maxRetries: 2, retrying 408/409/429/5xx with Retry-After-aware exponential backoff) before ever raising an exception back to the caller. A hand-rolled retry loop around sessions.create() that does not pass { maxRetries: 0 } stacks two independent, uncoordinated backoff schedules \u2014 a sustained 429 can trigger N outer attempts x (1 + 2 SDK-internal retries), multiplying worst-case latency well beyond what either layer alone would produce.",
+      docsUrl: "https://docs.browserbase.com/optimizations/concurrency/overview",
+      recommended: true
+    },
+    messages: {
+      stackedRetry: "sessions.create() is called inside a custom retry loop with no { maxRetries: 0 } override \u2014 the SDK retries this call internally too, stacking two backoff schedules."
+    },
+    schema: []
+  },
+  create(context) {
+    const loopRanges = [];
+    return {
+      ForStatement(node) {
+        loopRanges.push(node);
+      },
+      WhileStatement(node) {
+        loopRanges.push(node);
+      },
+      DoWhileStatement(node) {
+        loopRanges.push(node);
+      },
+      CallExpression(node) {
+        if (!isSessionsCall(node, "create")) return;
+        const insideLoop = loopRanges.some((loop) => {
+          const start = loop.range?.[0] ?? loop.start;
+          const end = loop.range?.[1] ?? loop.end;
+          const pos = node.range?.[0] ?? node.start;
+          return pos >= start && pos <= end;
+        });
+        if (!insideLoop) return;
+        const optsArg = node.arguments?.[1];
+        const hasMaxRetries = optsArg?.type === "ObjectExpression" && !!findProperty2(optsArg, "maxRetries");
+        if (!hasMaxRetries) {
+          context.report({ node, messageId: "stackedRetry" });
+        }
+      }
+    };
+  }
+};
+var browserbaseDontStackCustomRetryOnSdkRetryRule = rule61;
+
+// src/providers/browserbase/rules/no-overbroad-error-substring-match.ts
+var OVERBROAD_TERMS = /* @__PURE__ */ new Set(["session", "context", "browser", "browserbase"]);
+function collectIncludesLiterals(test, literals) {
+  if (!test) return;
+  if (test.type === "LogicalExpression" && test.operator === "||") {
+    collectIncludesLiterals(test.left, literals);
+    collectIncludesLiterals(test.right, literals);
+    return;
+  }
+  if (test.type === "CallExpression" && memberPropName3(test) === "includes") {
+    const arg = test.arguments?.[0];
+    if (arg?.type === "Literal" && typeof arg.value === "string") literals.push(arg.value.toLowerCase());
+  }
+}
+function isCleanupCall(node) {
+  if (node?.type !== "CallExpression") return false;
+  const callee = node.callee;
+  const name = callee?.type === "Identifier" ? callee.name : memberPropName3(node);
+  return !!name && /release|remove|cleanup|stop|teardown/i.test(name);
+}
+var rule62 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Error-message checks must not OR in a single generic resource-name substring",
+      category: "reliability",
+      rationale: 'A condition like `err.includes("not found") || err.includes("404") || err.includes("session")` looks like it is narrowing to a confirmed session-ended error, but the last clause matches a single generic word \u2014 the name of the resource being polled. Virtually any exception raised from a sessions.* call (a connection reset, an SSL error, a generic timeout that echoes the request URL) is likely to contain that substring too. A coincidental match then triggers the same destructive cleanup as a real 404/410, tearing down a healthy session on a transient blip.',
+      docsUrl: "https://docs.browserbase.com/reference/api/session-live-urls",
+      recommended: true
+    },
+    messages: {
+      overbroadMatch: 'This OR-chain includes a generic substring check ("{{term}}") that matches almost any error from a sessions.* call, not just a confirmed session-ended response.'
+    },
+    schema: []
+  },
+  create(context) {
+    return {
+      IfStatement(node) {
+        const literals = [];
+        collectIncludesLiterals(node.test, literals);
+        if (literals.length < 2) return;
+        const overbroad = literals.find((l) => OVERBROAD_TERMS.has(l));
+        if (!overbroad) return;
+        if (someDescendant2(node.consequent, isCleanupCall)) {
+          context.report({ node, messageId: "overbroadMatch", data: { term: overbroad } });
+        }
+      }
+    };
+  }
+};
+var browserbaseNoOverbroadErrorSubstringMatchRule = rule62;
+
+// src/providers/browserbase/rules/use-sdk-not-raw-requests.ts
+var BROWSERBASE_HOST = "api.browserbase.com";
+function templateLiteralContainsHost(node) {
+  return (node.quasis ?? []).some((q) => {
+    const text = q?.value?.cooked ?? q?.value?.raw ?? "";
+    return typeof text === "string" && text.includes(BROWSERBASE_HOST);
+  });
+}
+function urlArgContainsHost(node) {
+  if (node?.type === "Literal" && typeof node.value === "string") return node.value.includes(BROWSERBASE_HOST);
+  if (node?.type === "TemplateLiteral") return templateLiteralContainsHost(node);
+  return false;
+}
+function isRawHttpCall(node) {
+  if (node?.type !== "CallExpression") return { isCall: false, urlArg: void 0 };
+  const callee = node.callee;
+  if (callee?.type === "Identifier" && callee.name === "fetch") {
+    return { isCall: true, urlArg: node.arguments?.[0] };
+  }
+  if (callee?.type === "MemberExpression" && !callee.computed && callee.property?.type === "Identifier") {
+    const objName = callee.object?.type === "Identifier" ? callee.object.name : void 0;
+    const methodName = callee.property.name;
+    if (objName && /^(axios|http|https)$/i.test(objName) && /^(get|post|put|patch|delete|request)$/i.test(methodName)) {
+      return { isCall: true, urlArg: node.arguments?.[0] };
+    }
+  }
+  if (callee?.type === "Identifier" && callee.name === "axios") {
+    const arg = node.arguments?.[0];
+    if (arg?.type === "ObjectExpression") {
+      const urlProp = arg.properties?.find(
+        (p) => p?.type === "Property" && p.key?.type === "Identifier" && p.key.name === "url"
+      );
+      return { isCall: true, urlArg: urlProp?.value };
+    }
+    return { isCall: true, urlArg: arg };
+  }
+  return { isCall: false, urlArg: void 0 };
+}
+var rule63 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Use the installed Browserbase SDK instead of hand-rolled HTTP requests",
+      category: "integration",
+      rationale: "A raw fetch/axios/http call to an api.browserbase.com endpoint duplicates a method the installed SDK already exposes (e.g. sessions.recording.retrieve()), forfeiting its typed exceptions, built-in retry/backoff, and consistent error handling \u2014 and risks drifting on auth header naming or response shape as the API evolves.",
+      docsUrl: "https://docs.browserbase.com/reference/sdk/nodejs",
+      recommended: true
+    },
+    messages: {
+      rawRequestToBrowserbase: "This makes a raw HTTP request to a Browserbase API endpoint instead of using the installed SDK."
+    },
+    schema: []
+  },
+  create(context) {
+    const urlVars = /* @__PURE__ */ new Map();
+    return {
+      VariableDeclarator(node) {
+        if (node.id?.type === "Identifier" && urlArgContainsHost(node.init)) {
+          urlVars.set(node.id.name, node.init);
+        }
+      },
+      CallExpression(node) {
+        const { isCall, urlArg } = isRawHttpCall(node);
+        if (!isCall || !urlArg) return;
+        const resolved = urlArg.type === "Identifier" ? urlVars.get(urlArg.name) ?? urlArg : urlArg;
+        if (urlArgContainsHost(resolved)) {
+          context.report({ node, messageId: "rawRequestToBrowserbase" });
+        }
+      }
+    };
+  }
+};
+var browserbaseUseSdkNotRawRequestsRule = rule63;
+
+// src/providers/browserbase/rules/centralize-request-release.ts
+var rule64 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Route REQUEST_RELEASE through a single shared abstraction",
+      category: "integration",
+      rationale: 'sessions.update(id, { status: "REQUEST_RELEASE" }) hand-rolled inline at each call site, with each one carrying slightly different error handling, means an API change (a new required field, a renamed status value) requires fixing every call site instead of one \u2014 and the duplicated copies already drift in error-handling quality. Centralize behind one designated provider method (e.g. requestStop()/releaseSession()) and call that everywhere instead.',
+      docsUrl: "https://docs.browserbase.com/reference/api/update-a-session",
+      recommended: true
+    },
+    messages: {
+      inlineRequestRelease: 'sessions.update(..., { status: "REQUEST_RELEASE" }) is hand-rolled inline here. Route this through a single shared release/provider abstraction instead.'
+    },
+    schema: []
+  },
+  create(context) {
+    const filename = String(context.filename ?? "");
+    if (isInsideTestFile3(filename) || /provider|browserbaseclient/i.test(filename)) {
+      return {};
+    }
+    return {
+      CallExpression(node) {
+        if (!isSessionsCall(node, "update")) return;
+        const optsArg = node.arguments?.[1];
+        const statusProp = findProperty2(optsArg, "status");
+        const val = statusProp?.value;
+        if (val?.type === "Literal" && val.value === "REQUEST_RELEASE") {
+          context.report({ node, messageId: "inlineRequestRelease" });
+        }
+      }
+    };
+  }
+};
+var browserbaseCentralizeRequestReleaseRule = rule64;
+
+// src/providers/openai-cua/rules/no-domain-allowlist.ts
+var ACTION_METHOD_NAMES = /* @__PURE__ */ new Set(["click", "type", "press", "move", "goto", "fill", "dblclick", "dragAndDrop"]);
+var rule65 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Computer-use action execution must check the page origin against an allowlist",
+      category: "security",
+      cwe: "CWE-284",
+      owasp: "A01:2021 \u2013 Broken Access Control",
+      rationale: `OpenAI's Computer Use guide instructs integrators to "keep an allow list of domains and actions your agent should use, and block everything else." Without an origin check before executing actions, a click that follows an off-domain redirect (phishing link, ad, malicious iframe) is executed exactly like any in-domain click \u2014 and a field-fill action has no origin awareness either, so credentials could be typed into a page the agent was never meant to reach.`,
+      docsUrl: "https://developers.openai.com/api/docs/guides/tools-computer-use",
+      recommended: true
+    },
+    messages: {
+      noOriginCheck: "This function executes computer-use actions on the current page with no origin/domain allowlist check anywhere in it."
+    }
+  },
+  create(context) {
+    const stack = [];
+    const states = /* @__PURE__ */ new Map();
+    function ensureState(fn) {
+      let s = states.get(fn);
+      if (!s) {
+        s = { sawAction: false, actionNode: null, sawOriginCheck: false };
+        states.set(fn, s);
+      }
+      return s;
+    }
+    function top() {
+      return stack[stack.length - 1];
+    }
+    function pushScope(node) {
+      stack.push(node);
+      ensureState(node);
+    }
+    function popScope() {
+      stack.pop();
+    }
+    function propName2(node) {
+      if (!node) return void 0;
+      if (node.type === "Identifier") return node.name;
+      if (node.type === "Literal" && typeof node.value === "string") return node.value;
+      return void 0;
+    }
+    function memberChainNames2(node, names = []) {
+      if (node?.type === "MemberExpression") {
+        memberChainNames2(node.object, names);
+        const n = propName2(node.property);
+        if (n) names.push(n);
+      } else if (node?.type === "Identifier") {
+        names.push(node.name);
+      }
+      return names;
+    }
+    function isPageActionCall(node) {
+      if (node?.type !== "CallExpression") return false;
+      if (node.callee?.type !== "MemberExpression") return false;
+      const chain = memberChainNames2(node.callee);
+      if (chain.length === 0) return false;
+      const last = chain[chain.length - 1];
+      if (!ACTION_METHOD_NAMES.has(last)) return false;
+      return chain.some((n) => /^page$/i.test(n) || /page$/i.test(n));
+    }
+    function markOriginCheckSeen() {
+      const fn = top();
+      if (fn) ensureState(fn).sawOriginCheck = true;
+    }
+    return {
+      Program(node) {
+        pushScope(node);
+      },
+      "Program:exit"() {
+        for (const state of states.values()) {
+          if (state.sawAction && !state.sawOriginCheck) {
+            context.report({ node: state.actionNode, messageId: "noOriginCheck" });
+          }
+        }
+      },
+      FunctionDeclaration(node) {
+        pushScope(node);
+      },
+      "FunctionDeclaration:exit"() {
+        popScope();
+      },
+      FunctionExpression(node) {
+        pushScope(node);
+      },
+      "FunctionExpression:exit"() {
+        popScope();
+      },
+      ArrowFunctionExpression(node) {
+        pushScope(node);
+      },
+      "ArrowFunctionExpression:exit"() {
+        popScope();
+      },
+      CallExpression(node) {
+        if (isPageActionCall(node)) {
+          const fn = top();
+          if (fn) {
+            const state = ensureState(fn);
+            if (!state.sawAction) {
+              state.sawAction = true;
+              state.actionNode = node;
+            }
+          }
+        }
+      },
+      NewExpression(node) {
+        if (node.callee?.type === "Identifier" && node.callee.name === "URL") {
+          markOriginCheckSeen();
+        }
+      },
+      MemberExpression(node) {
+        const name = propName2(node.property);
+        if (name === "hostname" || name === "origin") {
+          markOriginCheckSeen();
+        }
+      },
+      Identifier(node) {
+        if (/allow.?list/i.test(node.name) || /allowed.?domain/i.test(node.name)) {
+          markOriginCheckSeen();
+        }
+      }
+    };
+  }
+};
+var openaiCuaNoDomainAllowlistRule = rule65;
+
+// src/providers/openai-cua/rules/scroll-delta-default-zero.ts
+var VERTICAL_DELTA_NAME_PATTERN = /^(dy|delta_?y|scroll_?y)$/i;
+var rule66 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "A missing vertical scroll delta must default to 0, not an arbitrary non-zero value",
+      category: "correctness",
+      rationale: "The reference scroll handler in OpenAI's Computer Use guide defaults a missing scroll delta to 0 on both axes. Defaulting the vertical delta to any other value injects an unintended scroll the model never asked for whenever it omits that field, desyncing the model's mental model of the page from the page's actual state on the next turn.",
+      docsUrl: "https://developers.openai.com/api/docs/guides/tools-computer-use",
+      recommended: true
+    },
+    messages: {
+      nonZeroDefault: "A missing vertical scroll delta defaults to {{value}} here instead of 0, injecting an unintended scroll the model never requested."
+    }
+  },
+  create(context) {
+    function propName2(node) {
+      if (!node) return void 0;
+      if (node.type === "Identifier") return node.name;
+      if (node.type === "Literal" && typeof node.value === "string") return node.value;
+      return void 0;
+    }
+    function targetName(node) {
+      if (node?.type === "Identifier") return node.name;
+      if (node?.type === "MemberExpression") return propName2(node.property);
+      return void 0;
+    }
+    function isNonZeroNumberLiteral(node) {
+      return node?.type === "Literal" && typeof node.value === "number" && node.value !== 0;
+    }
+    function reportIfBadDefault(targetNode, valueNode, reportNode) {
+      const name = targetName(targetNode);
+      if (!name || !VERTICAL_DELTA_NAME_PATTERN.test(name)) return;
+      if (!isNonZeroNumberLiteral(valueNode)) return;
+      context.report({ node: reportNode, messageId: "nonZeroDefault", data: { value: String(valueNode.value) } });
+    }
+    function findDirectAssignment(stmt) {
+      let inner = stmt;
+      if (inner?.type === "BlockStatement") {
+        const exprStmts = (inner.body ?? []).filter((s) => s.type === "ExpressionStatement");
+        if (exprStmts.length !== 1) return void 0;
+        inner = exprStmts[0];
+      }
+      if (inner?.type !== "ExpressionStatement") return void 0;
+      const expr = inner.expression;
+      if (expr?.type !== "AssignmentExpression" || expr.operator !== "=") return void 0;
+      return { target: expr.left, value: expr.right };
+    }
+    function undefinedCheckTargetName(test) {
+      if (test?.type !== "BinaryExpression") return void 0;
+      if (test.operator !== "===" && test.operator !== "==") return void 0;
+      const sides = [test.left, test.right];
+      const undefinedSide = sides.find(
+        (s) => s?.type === "Identifier" && s.name === "undefined" || s?.type === "Literal" && s.value === null || s?.type === "UnaryExpression" && s.operator === "typeof"
+      );
+      const otherSide = sides.find((s) => s !== undefinedSide);
+      if (!undefinedSide || !otherSide) return void 0;
+      if (undefinedSide.type === "UnaryExpression") {
+        return targetName(undefinedSide.argument);
+      }
+      return targetName(otherSide);
+    }
+    return {
+      LogicalExpression(node) {
+        if (node.operator !== "??") return;
+        reportIfBadDefault(node.left, node.right, node);
+      },
+      IfStatement(node) {
+        const name = undefinedCheckTargetName(node.test);
+        if (!name) return;
+        const assignment = findDirectAssignment(node.consequent);
+        if (!assignment) return;
+        reportIfBadDefault(assignment.target, assignment.value, node);
+      }
+    };
+  }
+};
+var openaiCuaScrollDeltaDefaultZeroRule = rule66;
+
+// src/providers/openai-cua/rules/structured-step-metadata-not-text-json.ts
+var BRACE_SEARCH_METHODS = /* @__PURE__ */ new Set(["indexOf", "lastIndexOf"]);
+var SLICE_METHODS = /* @__PURE__ */ new Set(["slice", "substring", "substr"]);
+var rule67 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Step metadata must come from structured tool output, not brace-hunting in free text",
+      category: "correctness",
+      rationale: "Manually locating a JSON object inside a free-text model message (via indexOf/lastIndexOf plus a slice) is fragile by construction: it breaks if the model adds trailing commentary, wraps the JSON in a markdown fence, or reorders fields. The Responses API supports function tools and structured output specifically so required metadata is schema-validated by the API instead of regex/brace-scraped out of arbitrary text.",
+      docsUrl: "https://developers.openai.com/api/docs/guides/tools-computer-use",
+      recommended: true
+    },
+    messages: {
+      textJsonExtraction: "This function locates a JSON object in free text via indexOf/lastIndexOf and parses a slice of it \u2014 use a function tool or structured output instead of brace-hunting in the model's text message."
+    }
+  },
+  create(context) {
+    const stack = [];
+    const states = /* @__PURE__ */ new Map();
+    function ensureState(fn) {
+      let s = states.get(fn);
+      if (!s) {
+        s = { sawBraceSearch: false, sawJsonParseOnSlice: false, reportNode: null };
+        states.set(fn, s);
+      }
+      return s;
+    }
+    function top() {
+      return stack[stack.length - 1];
+    }
+    function pushScope(node) {
+      stack.push(node);
+      ensureState(node);
+    }
+    function popScope() {
+      stack.pop();
+    }
+    function isBraceSearchCall(node) {
+      if (node?.type !== "CallExpression") return false;
+      const callee = node.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      if (!BRACE_SEARCH_METHODS.has(callee.property?.name)) return false;
+      const arg = node.arguments?.[0];
+      return arg?.type === "Literal" && typeof arg.value === "string" && arg.value.includes("{");
+    }
+    function isJsonParseOnSliceCall(node) {
+      if (node?.type !== "CallExpression") return false;
+      const callee = node.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      if (callee.object?.type !== "Identifier" || callee.object.name !== "JSON") return false;
+      if (callee.property?.name !== "parse") return false;
+      const arg = node.arguments?.[0];
+      if (arg?.type !== "CallExpression") return false;
+      const argCallee = arg.callee;
+      return argCallee?.type === "MemberExpression" && SLICE_METHODS.has(argCallee.property?.name);
+    }
+    return {
+      Program(node) {
+        pushScope(node);
+      },
+      "Program:exit"() {
+        for (const state of states.values()) {
+          if (state.sawBraceSearch && state.sawJsonParseOnSlice) {
+            context.report({ node: state.reportNode, messageId: "textJsonExtraction" });
+          }
+        }
+      },
+      FunctionDeclaration(node) {
+        pushScope(node);
+      },
+      "FunctionDeclaration:exit"() {
+        popScope();
+      },
+      FunctionExpression(node) {
+        pushScope(node);
+      },
+      "FunctionExpression:exit"() {
+        popScope();
+      },
+      ArrowFunctionExpression(node) {
+        pushScope(node);
+      },
+      "ArrowFunctionExpression:exit"() {
+        popScope();
+      },
+      CallExpression(node) {
+        const fn = top();
+        if (!fn) return;
+        const state = ensureState(fn);
+        if (isBraceSearchCall(node)) {
+          state.sawBraceSearch = true;
+          if (!state.reportNode) state.reportNode = node;
+        }
+        if (isJsonParseOnSliceCall(node)) {
+          state.sawJsonParseOnSlice = true;
+          if (!state.reportNode) state.reportNode = node;
+        }
+      }
+    };
+  }
+};
+var openaiCuaStructuredStepMetadataNotTextJsonRule = rule67;
+
+// src/providers/openai-cua/rules/no-blind-safety-check-ack.ts
+var rule68 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Acknowledging pending safety checks must evaluate each check, not blanket-pass them",
+      category: "correctness",
+      rationale: "`acknowledged_safety_checks` exists specifically so a developer can selectively confirm checks they have actually reviewed \u2014 each entry carries an id/code/message. A filter that only checks the row's shape (e.g. that it is an object) and never inspects `.code` or `.message` acknowledges every check present, defeating the purpose of the field entirely.",
+      docsUrl: "https://developers.openai.com/api/docs/guides/tools-computer-use",
+      recommended: true
+    },
+    messages: {
+      blindAck: "This filter never inspects .code or .message on each safety check \u2014 it acknowledges every check present instead of evaluating it against a policy."
+    }
+  },
+  create(context) {
+    function propName2(node) {
+      if (!node) return void 0;
+      if (node.type === "Identifier") return node.name;
+      if (node.type === "Literal" && typeof node.value === "string") return node.value;
+      return void 0;
+    }
+    function sourceLooksLikeSafetyChecks(node) {
+      if (!node) return false;
+      const name = propName2(node) ?? (node.type === "MemberExpression" ? propName2(node.property) : void 0);
+      if (name && /safety.?check/i.test(name)) return true;
+      if (node.type === "LogicalExpression") {
+        return sourceLooksLikeSafetyChecks(node.left) || sourceLooksLikeSafetyChecks(node.right);
+      }
+      if (node.type === "MemberExpression") {
+        return sourceLooksLikeSafetyChecks(node.object) || sourceLooksLikeSafetyChecks(node.property);
+      }
+      return false;
+    }
+    function referencesCodeOrMessage(node, depth = 0) {
+      if (!node || typeof node !== "object" || depth > 10) return false;
+      if (Array.isArray(node)) return node.some((n) => referencesCodeOrMessage(n, depth + 1));
+      if (node.type === "MemberExpression") {
+        const name = propName2(node.property);
+        if (name === "code" || name === "message") return true;
+      }
+      for (const key of Object.keys(node)) {
+        if (key === "parent" || key === "loc" || key === "range") continue;
+        const val = node[key];
+        if (val && typeof val === "object") {
+          if (referencesCodeOrMessage(val, depth + 1)) return true;
+        }
+      }
+      return false;
+    }
+    return {
+      CallExpression(node) {
+        const callee = node.callee;
+        if (callee?.type !== "MemberExpression" || callee.property?.name !== "filter") return;
+        if (!sourceLooksLikeSafetyChecks(callee.object)) return;
+        const fn = node.arguments?.[0];
+        if (fn?.type !== "ArrowFunctionExpression" && fn?.type !== "FunctionExpression") return;
+        if (!referencesCodeOrMessage(fn.body)) {
+          context.report({ node, messageId: "blindAck" });
+        }
+      }
+    };
+  }
+};
+var openaiCuaNoBlindSafetyCheckAckRule = rule68;
+
+// src/providers/openai-cua/utils.ts
+function propName(node) {
+  if (!node) return void 0;
+  if (node.type === "Identifier") return node.name;
+  if (node.type === "Literal" && typeof node.value === "string") return node.value;
+  return void 0;
+}
+function memberChainNames(node, names = []) {
+  if (node?.type === "MemberExpression") {
+    memberChainNames(node.object, names);
+    const n = propName(node.property);
+    if (n) names.push(n);
+  } else if (node?.type === "Identifier") {
+    names.push(node.name);
+  }
+  return names;
+}
+function isResponsesCreateCall(node) {
+  if (node?.type !== "CallExpression" || node.callee?.type !== "MemberExpression") return false;
+  const chain = memberChainNames(node.callee);
+  return chain.length >= 2 && chain[chain.length - 1] === "create" && chain[chain.length - 2] === "responses";
+}
+function findResponsesCreateCall(node, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 12) return null;
+  if (Array.isArray(node)) {
+    for (const n of node) {
+      const found = findResponsesCreateCall(n, depth + 1);
+      if (found) return found;
+    }
+    return null;
+  }
+  if (isResponsesCreateCall(node)) return node;
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object") {
+      const found = findResponsesCreateCall(val, depth + 1);
+      if (found) return found;
+    }
+  }
+  return null;
+}
+
+// src/providers/openai-cua/rules/retry-transient-turn-errors.ts
+var rule69 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "A responses.create() call must be retried at the turn level on transient errors",
+      category: "reliability",
+      rationale: "The SDK's own internal retry budget (DEFAULT_MAX_RETRIES) is finite. Treating any exception that survives it as fatal for the whole run \u2014 instead of retrying that one turn with backoff \u2014 means a single transient RateLimitError/APIConnectionError/InternalServerError can discard a long-running, multi-turn, expensive agent loop that may have already executed dozens of prior turns.",
+      docsUrl: "https://developers.openai.com/api/docs/guides/tools-computer-use",
+      recommended: true
+    },
+    messages: {
+      noTurnRetry: "This responses.create() call has no turn-level retry \u2014 neither a surrounding loop nor a retry call in the catch block \u2014 so any error beyond the SDK's own retry budget ends the entire run."
+    }
+  },
+  create(context) {
+    let loopDepth = 0;
+    function propName2(node) {
+      if (!node) return void 0;
+      if (node.type === "Identifier") return node.name;
+      if (node.type === "Literal" && typeof node.value === "string") return node.value;
+      return void 0;
+    }
+    function catchHasRetryCall(node, depth = 0) {
+      if (!node || typeof node !== "object" || depth > 12) return false;
+      if (Array.isArray(node)) return node.some((n) => catchHasRetryCall(n, depth + 1));
+      if (node.type === "CallExpression") {
+        const callee = node.callee;
+        const name = callee?.type === "Identifier" ? callee.name : callee?.type === "MemberExpression" ? propName2(callee.property) : void 0;
+        if (name && /retry/i.test(name)) return true;
+      }
+      for (const key of Object.keys(node)) {
+        if (key === "parent" || key === "loc" || key === "range") continue;
+        const val = node[key];
+        if (val && typeof val === "object") {
+          if (catchHasRetryCall(val, depth + 1)) return true;
         }
       }
+      return false;
+    }
+    return {
+      ForStatement() {
+        loopDepth += 1;
+      },
+      "ForStatement:exit"() {
+        loopDepth -= 1;
+      },
+      WhileStatement() {
+        loopDepth += 1;
+      },
+      "WhileStatement:exit"() {
+        loopDepth -= 1;
+      },
+      DoWhileStatement() {
+        loopDepth += 1;
+      },
+      "DoWhileStatement:exit"() {
+        loopDepth -= 1;
+      },
+      ForOfStatement() {
+        loopDepth += 1;
+      },
+      "ForOfStatement:exit"() {
+        loopDepth -= 1;
+      },
+      ForInStatement() {
+        loopDepth += 1;
+      },
+      "ForInStatement:exit"() {
+        loopDepth -= 1;
+      },
+      TryStatement(node) {
+        const createCall = findResponsesCreateCall(node.block);
+        if (!createCall) return;
+        if (loopDepth > 0) return;
+        const handler = node.handler;
+        if (!handler) return;
+        if (catchHasRetryCall(handler.body)) return;
+        context.report({ node: handler, messageId: "noTurnRetry" });
+      }
     };
   }
 };
-var browserbaseCentralizeRequestReleaseRule = rule52;
+var openaiCuaRetryTransientTurnErrorsRule = rule69;
 
-// src/providers/openai-cua/rules/no-domain-allowlist.ts
-var ACTION_METHOD_NAMES = /* @__PURE__ */ new Set(["click", "type", "press", "move", "goto", "fill", "dblclick", "dragAndDrop"]);
-var rule53 = {
+// src/providers/openai-cua/rules/check-response-status-incomplete.ts
+var rule70 = {
   meta: {
     type: "problem",
     docs: {
-      description: "Computer-use action execution must check the page origin against an allowlist",
-      category: "security",
-      cwe: "CWE-284",
-      owasp: "A01:2021 \u2013 Broken Access Control",
-      rationale: `OpenAI's Computer Use guide instructs integrators to "keep an allow list of domains and actions your agent should use, and block everything else." Without an origin check before executing actions, a click that follows an off-domain redirect (phishing link, ad, malicious iframe) is executed exactly like any in-domain click \u2014 and a field-fill action has no origin awareness either, so credentials could be typed into a page the agent was never meant to reach.`,
+      description: 'A completion check must rule out response.status === "incomplete" before reporting success',
+      category: "reliability",
+      rationale: 'The Responses API can return status "incomplete" with zero visible message output when generation is cut off by the token budget \u2014 the same shape ("no computer_call, no message") a purely structural completion check treats as "the model voluntarily finished." Without checking response.status, a token-budget truncation can be silently reported as a successful task completion.',
       docsUrl: "https://developers.openai.com/api/docs/guides/tools-computer-use",
       recommended: true
     },
     messages: {
-      noOriginCheck: "This function executes computer-use actions on the current page with no origin/domain allowlist check anywhere in it."
+      missingIncompleteCheck: 'This treats the absence of tool calls as a successful completion, but never checks response.status === "incomplete" \u2014 a token-budget truncation can be misreported as success.'
     }
   },
   create(context) {
@@ -4102,7 +5195,7 @@ var rule53 = {
     function ensureState(fn) {
       let s = states.get(fn);
       if (!s) {
-        s = { sawAction: false, actionNode: null, sawOriginCheck: false };
+        s = { sawCreateCall: false, sawSuccessReturn: false, successNode: null, sawStatusCheck: false };
         states.set(fn, s);
       }
       return s;
@@ -4123,28 +5216,13 @@ var rule53 = {
       if (node.type === "Literal" && typeof node.value === "string") return node.value;
       return void 0;
     }
-    function memberChainNames2(node, names = []) {
-      if (node?.type === "MemberExpression") {
-        memberChainNames2(node.object, names);
-        const n = propName2(node.property);
-        if (n) names.push(n);
-      } else if (node?.type === "Identifier") {
-        names.push(node.name);
-      }
-      return names;
-    }
-    function isPageActionCall(node) {
-      if (node?.type !== "CallExpression") return false;
-      if (node.callee?.type !== "MemberExpression") return false;
-      const chain = memberChainNames2(node.callee);
-      if (chain.length === 0) return false;
-      const last = chain[chain.length - 1];
-      if (!ACTION_METHOD_NAMES.has(last)) return false;
-      return chain.some((n) => /^page$/i.test(n) || /page$/i.test(n));
-    }
-    function markOriginCheckSeen() {
-      const fn = top();
-      if (fn) ensureState(fn).sawOriginCheck = true;
+    function isSuccessObjectLiteral(node) {
+      if (node?.type !== "ObjectExpression") return false;
+      return (node.properties ?? []).some((p) => {
+        if (p?.type !== "Property") return false;
+        const keyName = propName2(p.key);
+        return (keyName === "success" || keyName === "completed") && p.value?.type === "Literal" && p.value.value === true;
+      });
     }
     return {
       Program(node) {
@@ -4152,8 +5230,8 @@ var rule53 = {
       },
       "Program:exit"() {
         for (const state of states.values()) {
-          if (state.sawAction && !state.sawOriginCheck) {
-            context.report({ node: state.actionNode, messageId: "noOriginCheck" });
+          if (state.sawCreateCall && state.sawSuccessReturn && !state.sawStatusCheck) {
+            context.report({ node: state.successNode, messageId: "missingIncompleteCheck" });
           }
         }
       },
@@ -4176,52 +5254,51 @@ var rule53 = {
         popScope();
       },
       CallExpression(node) {
-        if (isPageActionCall(node)) {
+        if (findResponsesCreateCall(node)) {
+          const fn = top();
+          if (fn) ensureState(fn).sawCreateCall = true;
+        }
+      },
+      ObjectExpression(node) {
+        if (isSuccessObjectLiteral(node)) {
           const fn = top();
           if (fn) {
             const state = ensureState(fn);
-            if (!state.sawAction) {
-              state.sawAction = true;
-              state.actionNode = node;
+            if (!state.sawSuccessReturn) {
+              state.sawSuccessReturn = true;
+              state.successNode = node;
             }
           }
         }
       },
-      NewExpression(node) {
-        if (node.callee?.type === "Identifier" && node.callee.name === "URL") {
-          markOriginCheckSeen();
-        }
-      },
-      MemberExpression(node) {
-        const name = propName2(node.property);
-        if (name === "hostname" || name === "origin") {
-          markOriginCheckSeen();
-        }
-      },
-      Identifier(node) {
-        if (/allow.?list/i.test(node.name) || /allowed.?domain/i.test(node.name)) {
-          markOriginCheckSeen();
+      BinaryExpression(node) {
+        if (node.operator !== "===" && node.operator !== "==") return;
+        const sides = [node.left, node.right];
+        const statusSide = sides.find((s) => s?.type === "MemberExpression" && propName2(s.property) === "status");
+        const valueSide = sides.find((s) => s !== statusSide);
+        if (statusSide && valueSide?.type === "Literal" && valueSide.value === "incomplete") {
+          const fn = top();
+          if (fn) ensureState(fn).sawStatusCheck = true;
         }
       }
     };
   }
 };
-var openaiCuaNoDomainAllowlistRule = rule53;
+var openaiCuaCheckResponseStatusIncompleteRule = rule70;
 
-// src/providers/openai-cua/rules/scroll-delta-default-zero.ts
-var VERTICAL_DELTA_NAME_PATTERN = /^(dy|delta_?y|scroll_?y)$/i;
-var rule54 = {
+// src/providers/openai-cua/rules/set-safety-identifier.ts
+var rule71 = {
   meta: {
     type: "problem",
     docs: {
-      description: "A missing vertical scroll delta must default to 0, not an arbitrary non-zero value",
-      category: "correctness",
-      rationale: "The reference scroll handler in OpenAI's Computer Use guide defaults a missing scroll delta to 0 on both axes. Defaulting the vertical delta to any other value injects an unintended scroll the model never asked for whenever it omits that field, desyncing the model's mental model of the page from the page's actual state on the next turn.",
-      docsUrl: "https://developers.openai.com/api/docs/guides/tools-computer-use",
+      description: "responses.create() must set safety_identifier for per-end-user policy attribution",
+      category: "integration",
+      rationale: "OpenAI documents that a stable per-end-user safety_identifier lets policy violations be attributed and acted on per end user. Without one on a multi-tenant integration routing many customers through a single shared API key, a single customer triggering a high-confidence policy-violation heuristic can result in access being temporarily revoked for the entire organization, not just the offending identifier.",
+      docsUrl: "https://help.openai.com/en/articles/5428082-how-to-incorporate-a-safety-identifier",
       recommended: true
     },
     messages: {
-      nonZeroDefault: "A missing vertical scroll delta defaults to {{value}} here instead of 0, injecting an unintended scroll the model never requested."
+      missingSafetyIdentifier: "This responses.create() call sets no safety_identifier (or user) \u2014 a policy violation here could be attributed to the entire shared API key instead of one end user."
     }
   },
   create(context) {
@@ -4231,513 +5308,722 @@ var rule54 = {
       if (node.type === "Literal" && typeof node.value === "string") return node.value;
       return void 0;
     }
-    function targetName(node) {
-      if (node?.type === "Identifier") return node.name;
-      if (node?.type === "MemberExpression") return propName2(node.property);
-      return void 0;
-    }
-    function isNonZeroNumberLiteral(node) {
-      return node?.type === "Literal" && typeof node.value === "number" && node.value !== 0;
-    }
-    function reportIfBadDefault(targetNode, valueNode, reportNode) {
-      const name = targetName(targetNode);
-      if (!name || !VERTICAL_DELTA_NAME_PATTERN.test(name)) return;
-      if (!isNonZeroNumberLiteral(valueNode)) return;
-      context.report({ node: reportNode, messageId: "nonZeroDefault", data: { value: String(valueNode.value) } });
-    }
-    function findDirectAssignment(stmt) {
-      let inner = stmt;
-      if (inner?.type === "BlockStatement") {
-        const exprStmts = (inner.body ?? []).filter((s) => s.type === "ExpressionStatement");
-        if (exprStmts.length !== 1) return void 0;
-        inner = exprStmts[0];
+    return {
+      CallExpression(node) {
+        if (!isResponsesCreateCall(node)) return;
+        const optionsArg = node.arguments?.[0];
+        if (optionsArg?.type !== "ObjectExpression") return;
+        const hasIdentifier = (optionsArg.properties ?? []).some((p) => {
+          if (p?.type !== "Property") return false;
+          const keyName = propName2(p.key);
+          return keyName === "safety_identifier" || keyName === "user";
+        });
+        if (!hasIdentifier) {
+          context.report({ node, messageId: "missingSafetyIdentifier" });
+        }
       }
-      if (inner?.type !== "ExpressionStatement") return void 0;
-      const expr = inner.expression;
-      if (expr?.type !== "AssignmentExpression" || expr.operator !== "=") return void 0;
-      return { target: expr.left, value: expr.right };
-    }
-    function undefinedCheckTargetName(test) {
-      if (test?.type !== "BinaryExpression") return void 0;
-      if (test.operator !== "===" && test.operator !== "==") return void 0;
-      const sides = [test.left, test.right];
-      const undefinedSide = sides.find(
-        (s) => s?.type === "Identifier" && s.name === "undefined" || s?.type === "Literal" && s.value === null || s?.type === "UnaryExpression" && s.operator === "typeof"
-      );
-      const otherSide = sides.find((s) => s !== undefinedSide);
-      if (!undefinedSide || !otherSide) return void 0;
-      if (undefinedSide.type === "UnaryExpression") {
-        return targetName(undefinedSide.argument);
+    };
+  }
+};
+var openaiCuaSetSafetyIdentifierRule = rule71;
+
+// src/providers/tiptap/rules/upload-validate-fn-void.ts
+var rule72 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "validateFn must return boolean so callers can act on the result",
+      category: "security",
+      cwe: "CWE-20",
+      owasp: "API3:2023 Broken Object Property Level Authorization",
+      rationale: "When validateFn is typed as (file: File) => void, the return value is always discarded. A consumer that returns false to reject an oversized or wrong-type file will have that rejection silently ignored \u2014 the upload proceeds regardless. Changing the return type to boolean and guarding with if (validateFn && !validateFn(file)) return; ensures validation actually blocks uploads.",
+      docsUrl: "https://tiptap.dev/docs/editor/extensions/custom-extensions/node-views",
+      recommended: true
+    },
+    messages: {
+      validateFnVoid: "validateFn return value is discarded. Change the return type to boolean and guard the call: if (validateFn && !validateFn(file)) return;"
+    },
+    schema: []
+  },
+  create(context) {
+    let importsTiptap = false;
+    function isVoidReturnType(typeAnnotation) {
+      if (!typeAnnotation) return false;
+      const t = typeAnnotation.typeAnnotation ?? typeAnnotation;
+      if (t?.type === "TSFunctionType") {
+        const ret = t.returnType?.typeAnnotation ?? t.returnType;
+        return ret?.type === "TSVoidKeyword";
       }
-      return targetName(otherSide);
+      return false;
+    }
+    function hasProperty(members, name) {
+      return members?.some(
+        (m) => m?.key?.type === "Identifier" && m.key.name === name || m?.key?.type === "Literal" && m.key.value === name
+      ) ?? false;
     }
     return {
-      LogicalExpression(node) {
-        if (node.operator !== "??") return;
-        reportIfBadDefault(node.left, node.right, node);
+      ImportDeclaration(node) {
+        const src = node?.source?.value ?? "";
+        if (src.startsWith("@tiptap/")) importsTiptap = true;
+      },
+      // Pattern (a): interface / type with validateFn: (...) => void + onUpload
+      TSInterfaceDeclaration(node) {
+        const members = node?.body?.body ?? [];
+        if (!hasProperty(members, "onUpload")) return;
+        for (const member of members) {
+          const name = member?.key?.type === "Identifier" ? member.key.name : member?.key?.type === "Literal" ? member.key.value : null;
+          if (name !== "validateFn") continue;
+          const typeAnno = member.typeAnnotation;
+          if (isVoidReturnType(typeAnno)) {
+            context.report({ node: member, messageId: "validateFnVoid" });
+          }
+        }
       },
-      IfStatement(node) {
-        const name = undefinedCheckTargetName(node.test);
-        if (!name) return;
-        const assignment = findDirectAssignment(node.consequent);
-        if (!assignment) return;
-        reportIfBadDefault(assignment.target, assignment.value, node);
+      // Pattern (b): validateFn?.() or validateFn() used as a bare statement
+      ExpressionStatement(node) {
+        const expr = node.expression;
+        const call = expr?.type === "CallExpression" ? expr : expr?.type === "ChainExpression" && expr.expression?.type === "CallExpression" ? expr.expression : null;
+        if (!call) return;
+        const callee = call.callee;
+        const calleeName = callee?.type === "Identifier" ? callee.name : callee?.type === "MemberExpression" && callee.property?.type === "Identifier" ? callee.property.name : null;
+        if (calleeName !== "validateFn") return;
+        context.report({ node, messageId: "validateFnVoid" });
       }
     };
   }
 };
-var openaiCuaScrollDeltaDefaultZeroRule = rule54;
+var tiptapUploadValidateFnVoidRule = rule72;
 
-// src/providers/openai-cua/rules/structured-step-metadata-not-text-json.ts
-var BRACE_SEARCH_METHODS = /* @__PURE__ */ new Set(["indexOf", "lastIndexOf"]);
-var SLICE_METHODS = /* @__PURE__ */ new Set(["slice", "substring", "substr"]);
-var rule55 = {
+// src/providers/tiptap/rules/script-src-hardcoded-api-key.ts
+var rule73 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "script.src must not contain a hardcoded API key",
+      category: "security",
+      cwe: "CWE-798",
+      owasp: "API8:2023 Security Misconfiguration",
+      rationale: "Hardcoding an API key directly in a script URL string commits the credential to version control and ships it in the client bundle. The key is trivially visible to anyone who views the page source. Read the key from an environment variable at runtime so it can be rotated without a code change and kept out of the repository.",
+      docsUrl: "https://tiptap.dev/docs/editor/extensions/custom-extensions/node-views",
+      recommended: true
+    },
+    messages: {
+      hardcodedApiKey: "script.src contains a hardcoded API key. Read the key from an environment variable instead."
+    },
+    schema: []
+  },
+  create(context) {
+    function isSrcAssignment(node) {
+      return node?.type === "AssignmentExpression" && node.left?.type === "MemberExpression" && node.left.property?.type === "Identifier" && node.left.property.name === "src";
+    }
+    function isEnvAccess(node) {
+      if (node?.type !== "MemberExpression") return false;
+      const obj = node.object;
+      return obj?.type === "MemberExpression" && obj.object?.type === "Identifier" && obj.object.name === "process" && obj.property?.type === "Identifier" && obj.property.name === "env";
+    }
+    return {
+      AssignmentExpression(node) {
+        if (!isSrcAssignment(node)) return;
+        const right = node.right;
+        if (right?.type === "Literal" && typeof right.value === "string") {
+          if (right.value.includes("apiKey=")) {
+            context.report({ node, messageId: "hardcodedApiKey" });
+          }
+          return;
+        }
+        if (right?.type === "TemplateLiteral") {
+          const quasis = right.quasis ?? [];
+          const expressions = right.expressions ?? [];
+          for (let i = 0; i < quasis.length; i++) {
+            const cooked = quasis[i]?.value?.cooked ?? "";
+            if (cooked.includes("apiKey=")) {
+              const nextExpr = expressions[i];
+              if (!nextExpr) {
+                context.report({ node, messageId: "hardcodedApiKey" });
+                return;
+              }
+              if (!isEnvAccess(nextExpr)) {
+                context.report({ node, messageId: "hardcodedApiKey" });
+                return;
+              }
+            }
+          }
+        }
+      }
+    };
+  }
+};
+var tiptapScriptSrcHardcodedApiKeyRule = rule73;
+
+// src/providers/tiptap/rules/dynamic-script-no-sri.ts
+var rule74 = {
   meta: {
-    type: "suggestion",
+    type: "problem",
     docs: {
-      description: "Step metadata must come from structured tool output, not brace-hunting in free text",
-      category: "correctness",
-      rationale: "Manually locating a JSON object inside a free-text model message (via indexOf/lastIndexOf plus a slice) is fragile by construction: it breaks if the model adds trailing commentary, wraps the JSON in a markdown fence, or reorders fields. The Responses API supports function tools and structured output specifically so required metadata is schema-validated by the API instead of regex/brace-scraped out of arbitrary text.",
-      docsUrl: "https://developers.openai.com/api/docs/guides/tools-computer-use",
+      description: "Dynamically injected script elements must include an SRI integrity attribute",
+      category: "security",
+      cwe: "CWE-829",
+      owasp: "API8:2023 Security Misconfiguration",
+      rationale: 'A script element injected without an integrity attribute will execute whatever the CDN returns, including malicious content if the CDN is compromised. Adding a Subresource Integrity hash (script.setAttribute("integrity", "sha384-...")) lets the browser verify the fetched script matches the expected bytes before executing it.',
+      docsUrl: "https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity",
       recommended: true
     },
     messages: {
-      textJsonExtraction: "This function locates a JSON object in free text via indexOf/lastIndexOf and parses a slice of it \u2014 use a function tool or structured output instead of brace-hunting in the model's text message."
-    }
+      missingIntegrity: 'Dynamically created script element is appended without an integrity (SRI) attribute. Add script.setAttribute("integrity", "sha384-...") before appending.'
+    },
+    schema: []
   },
   create(context) {
-    const stack = [];
-    const states = /* @__PURE__ */ new Map();
-    function ensureState(fn) {
-      let s = states.get(fn);
-      if (!s) {
-        s = { sawBraceSearch: false, sawJsonParseOnSlice: false, reportNode: null };
-        states.set(fn, s);
-      }
-      return s;
-    }
-    function top() {
-      return stack[stack.length - 1];
-    }
-    function pushScope(node) {
-      stack.push(node);
-      ensureState(node);
-    }
-    function popScope() {
-      stack.pop();
-    }
-    function isBraceSearchCall(node) {
-      if (node?.type !== "CallExpression") return false;
+    const scriptVars = /* @__PURE__ */ new Map();
+    function isCreateScriptCall(node) {
+      if (node?.type !== "CallExpression") return null;
       const callee = node.callee;
-      if (callee?.type !== "MemberExpression") return false;
-      if (!BRACE_SEARCH_METHODS.has(callee.property?.name)) return false;
+      if (callee?.type !== "MemberExpression") return null;
+      if (callee.property?.name !== "createElement") return null;
       const arg = node.arguments?.[0];
-      return arg?.type === "Literal" && typeof arg.value === "string" && arg.value.includes("{");
+      if (arg?.type !== "Literal" || arg.value !== "script") return null;
+      return "script";
     }
-    function isJsonParseOnSliceCall(node) {
+    function getVarNameFromDeclarator(node) {
+      if (node?.type === "VariableDeclarator" && node.id?.type === "Identifier") {
+        return node.id.name;
+      }
+      return null;
+    }
+    function isIntegritySet(node, varName) {
+      if (node?.type === "CallExpression") {
+        const callee = node.callee;
+        if (callee?.type === "MemberExpression" && callee.object?.type === "Identifier" && callee.object.name === varName && (callee.property?.name === "setAttribute" || callee.property?.value === "setAttribute")) {
+          const firstArg = node.arguments?.[0];
+          if (firstArg?.type === "Literal" && firstArg.value === "integrity") return true;
+        }
+      }
+      if (node?.type === "AssignmentExpression" && node.left?.type === "MemberExpression" && node.left.object?.type === "Identifier" && node.left.object.name === varName && node.left.property?.name === "integrity") {
+        return true;
+      }
+      return false;
+    }
+    function isAppendCall(node, varName) {
       if (node?.type !== "CallExpression") return false;
       const callee = node.callee;
       if (callee?.type !== "MemberExpression") return false;
-      if (callee.object?.type !== "Identifier" || callee.object.name !== "JSON") return false;
-      if (callee.property?.name !== "parse") return false;
-      const arg = node.arguments?.[0];
-      if (arg?.type !== "CallExpression") return false;
-      const argCallee = arg.callee;
-      return argCallee?.type === "MemberExpression" && SLICE_METHODS.has(argCallee.property?.name);
+      const methodName = callee.property?.name;
+      if (!["appendChild", "append", "insertBefore", "prepend"].includes(methodName)) return false;
+      const firstArg = node.arguments?.[0];
+      return firstArg?.type === "Identifier" && firstArg.name === varName;
     }
     return {
-      Program(node) {
-        pushScope(node);
-      },
-      "Program:exit"() {
-        for (const state of states.values()) {
-          if (state.sawBraceSearch && state.sawJsonParseOnSlice) {
-            context.report({ node: state.reportNode, messageId: "textJsonExtraction" });
+      VariableDeclarator(node) {
+        if (node.init && isCreateScriptCall(node.init)) {
+          const name = getVarNameFromDeclarator(node);
+          if (name) {
+            scriptVars.set(name, { createNode: node, appendNode: null, hasIntegrity: false });
           }
         }
       },
-      FunctionDeclaration(node) {
-        pushScope(node);
-      },
-      "FunctionDeclaration:exit"() {
-        popScope();
-      },
-      FunctionExpression(node) {
-        pushScope(node);
-      },
-      "FunctionExpression:exit"() {
-        popScope();
-      },
-      ArrowFunctionExpression(node) {
-        pushScope(node);
-      },
-      "ArrowFunctionExpression:exit"() {
-        popScope();
+      ExpressionStatement(node) {
+        const expr = node.expression;
+        if (!expr) return;
+        for (const [varName, info] of scriptVars) {
+          if (isIntegritySet(expr, varName)) {
+            info.hasIntegrity = true;
+          }
+          if (isAppendCall(expr, varName) && !info.appendNode) {
+            info.appendNode = node;
+          }
+        }
       },
-      CallExpression(node) {
-        const fn = top();
-        if (!fn) return;
-        const state = ensureState(fn);
-        if (isBraceSearchCall(node)) {
-          state.sawBraceSearch = true;
-          if (!state.reportNode) state.reportNode = node;
+      // Also catch assignments: e.g. document.body.innerHTML won't appear here,
+      // but handle AssignmentExpression for integrity
+      AssignmentExpression(node) {
+        for (const [varName, info] of scriptVars) {
+          if (isIntegritySet(node, varName)) {
+            info.hasIntegrity = true;
+          }
         }
-        if (isJsonParseOnSliceCall(node)) {
-          state.sawJsonParseOnSlice = true;
-          if (!state.reportNode) state.reportNode = node;
+      },
+      "Program:exit"() {
+        for (const [, info] of scriptVars) {
+          if (info.appendNode && !info.hasIntegrity) {
+            context.report({ node: info.appendNode, messageId: "missingIntegrity" });
+          }
         }
       }
     };
   }
 };
-var openaiCuaStructuredStepMetadataNotTextJsonRule = rule55;
+var tiptapDynamicScriptNoSriRule = rule74;
 
-// src/providers/openai-cua/rules/no-blind-safety-check-ack.ts
-var rule56 = {
+// src/providers/tiptap/utils.ts
+function findProperty3(objectExpression, name) {
+  if (objectExpression?.type !== "ObjectExpression") return void 0;
+  return objectExpression.properties?.find(
+    (p) => p?.type === "Property" && (p.key?.type === "Identifier" && p.key.name === name || p.key?.type === "Literal" && p.key.value === name)
+  );
+}
+function walk(node, visit) {
+  if (!node || typeof node !== "object") return;
+  const result = visit(node);
+  if (result === false) return;
+  for (const key of Object.keys(node)) {
+    if (key === "parent") continue;
+    const child = node[key];
+    if (Array.isArray(child)) {
+      for (const item of child) walk(item, visit);
+    } else if (child && typeof child === "object" && child.type) {
+      walk(child, visit);
+    }
+  }
+}
+
+// src/providers/tiptap/rules/addAttributes-missing-renderHTML.ts
+var rule75 = {
   meta: {
-    type: "suggestion",
+    type: "problem",
     docs: {
-      description: "Acknowledging pending safety checks must evaluate each check, not blanket-pass them",
+      description: "TipTap addAttributes descriptors with parseHTML must also define renderHTML",
       category: "correctness",
-      rationale: "`acknowledged_safety_checks` exists specifically so a developer can selectively confirm checks they have actually reviewed \u2014 each entry carries an id/code/message. A filter that only checks the row's shape (e.g. that it is an object) and never inspects `.code` or `.message` acknowledges every check present, defeating the purpose of the field entirely.",
-      docsUrl: "https://developers.openai.com/api/docs/guides/tools-computer-use",
+      rationale: 'When an attribute defines parseHTML: (el) => el.getAttribute("data-label") but no renderHTML, TipTap emits the attribute as a plain HTML attribute (label="...") instead of data-label="...". On re-parse, getAttribute("data-label") returns null and the value falls back to the default, silently discarding any customization across HTML export/import cycles.',
+      docsUrl: "https://tiptap.dev/docs/editor/extensions/custom-extensions/create-new/node#attributes",
       recommended: true
     },
     messages: {
-      blindAck: "This filter never inspects .code or .message on each safety check \u2014 it acknowledges every check present instead of evaluating it against a policy."
-    }
+      missingRenderHTML: 'Attribute defines parseHTML but no renderHTML. TipTap will serialize this attribute with the default name, breaking the HTML round-trip. Add renderHTML: (attrs) => ({ "data-<name>": attrs.<name> }).'
+    },
+    schema: []
   },
   create(context) {
-    function propName2(node) {
-      if (!node) return void 0;
-      if (node.type === "Identifier") return node.name;
-      if (node.type === "Literal" && typeof node.value === "string") return node.value;
-      return void 0;
-    }
-    function sourceLooksLikeSafetyChecks(node) {
-      if (!node) return false;
-      const name = propName2(node) ?? (node.type === "MemberExpression" ? propName2(node.property) : void 0);
-      if (name && /safety.?check/i.test(name)) return true;
-      if (node.type === "LogicalExpression") {
-        return sourceLooksLikeSafetyChecks(node.left) || sourceLooksLikeSafetyChecks(node.right);
-      }
-      if (node.type === "MemberExpression") {
-        return sourceLooksLikeSafetyChecks(node.object) || sourceLooksLikeSafetyChecks(node.property);
+    function checkAddAttributesReturn(returnObj) {
+      if (returnObj?.type !== "ObjectExpression") return;
+      for (const prop of returnObj.properties ?? []) {
+        if (prop?.type !== "Property") continue;
+        const val = prop.value;
+        if (val?.type !== "ObjectExpression") continue;
+        if (findProperty3(val, "parseHTML") && !findProperty3(val, "renderHTML")) {
+          context.report({ node: val, messageId: "missingRenderHTML" });
+        }
       }
-      return false;
     }
-    function referencesCodeOrMessage(node, depth = 0) {
-      if (!node || typeof node !== "object" || depth > 10) return false;
-      if (Array.isArray(node)) return node.some((n) => referencesCodeOrMessage(n, depth + 1));
-      if (node.type === "MemberExpression") {
-        const name = propName2(node.property);
-        if (name === "code" || name === "message") return true;
+    function checkAddAttributesFunction(fn) {
+      walk(fn, (node) => {
+        if (node?.type === "ReturnStatement" && node.argument) {
+          checkAddAttributesReturn(node.argument);
+        }
+      });
+    }
+    return {
+      // Handles: addAttributes() { return { ... } } as method shorthand
+      // and addAttributes: function() { } / addAttributes: () => { }
+      Property(node) {
+        const keyName = node.key?.type === "Identifier" ? node.key.name : node.key?.type === "Literal" ? node.key.value : null;
+        if (keyName !== "addAttributes") return;
+        const val = node.value;
+        if (!val) return;
+        if (val.type === "FunctionExpression" || val.type === "ArrowFunctionExpression") {
+          if (val.body?.type === "ObjectExpression") {
+            checkAddAttributesReturn(val.body);
+          } else {
+            checkAddAttributesFunction(val.body);
+          }
+        }
       }
-      for (const key of Object.keys(node)) {
-        if (key === "parent" || key === "loc" || key === "range") continue;
-        const val = node[key];
-        if (val && typeof val === "object") {
-          if (referencesCodeOrMessage(val, depth + 1)) return true;
+    };
+  }
+};
+var tiptapAddAttributesMissingRenderHTMLRule = rule75;
+
+// src/providers/tiptap/rules/appendTransaction-add-to-history.ts
+var rule76 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: 'appendTransaction mutations must include tr.setMeta("addToHistory", false)',
+      category: "correctness",
+      rationale: 'ProseMirror records every transaction dispatched by appendTransaction into the undo history unless it is annotated with setMeta("addToHistory", false). When an auto-correction (e.g. inserting a space into an empty node) is recorded, pressing Ctrl-Z undoes the correction and re-enters the broken state, which the plugin immediately re-corrects \u2014 the undo and redo keys fight each other.',
+      docsUrl: "https://prosemirror.net/docs/ref/#state.Transaction.setMeta",
+      recommended: true
+    },
+    messages: {
+      missingAddToHistory: 'appendTransaction mutates the transaction without setMeta("addToHistory", false). This pollutes the undo stack. Add tr.setMeta("addToHistory", false) to the transaction.'
+    },
+    schema: []
+  },
+  create(context) {
+    function hasAddToHistoryMeta(fnBody) {
+      let found = false;
+      walk(fnBody, (node) => {
+        if (found) return false;
+        if (node?.type !== "CallExpression") return;
+        const callee = node.callee;
+        if (callee?.type !== "MemberExpression") return;
+        if (callee.property?.name !== "setMeta") return;
+        const firstArg = node.arguments?.[0];
+        if (firstArg?.type === "Literal" && firstArg.value === "addToHistory") {
+          found = true;
+        }
+      });
+      return found;
+    }
+    function hasMutation(fnBody) {
+      const mutatingMethods = /* @__PURE__ */ new Set([
+        "insert",
+        "insertText",
+        "replace",
+        "replaceWith",
+        "replaceRange",
+        "replaceRangeWith",
+        "delete",
+        "deleteRange",
+        "addMark",
+        "removeMark",
+        "setNodeMarkup",
+        "setNodeAttribute",
+        "setDocAttribute"
+      ]);
+      let found = false;
+      walk(fnBody, (node) => {
+        if (found) return false;
+        if (node?.type !== "CallExpression") return;
+        const callee = node.callee;
+        if (callee?.type !== "MemberExpression") return;
+        const methodName = callee.property?.name;
+        if (methodName && mutatingMethods.has(methodName)) {
+          found = true;
         }
+      });
+      return found;
+    }
+    function checkAppendTransactionFn(fn, reportNode) {
+      const body = fn?.body;
+      if (!body) return;
+      if (hasMutation(body) && !hasAddToHistoryMeta(body)) {
+        context.report({ node: reportNode, messageId: "missingAddToHistory" });
       }
-      return false;
     }
     return {
-      CallExpression(node) {
-        const callee = node.callee;
-        if (callee?.type !== "MemberExpression" || callee.property?.name !== "filter") return;
-        if (!sourceLooksLikeSafetyChecks(callee.object)) return;
-        const fn = node.arguments?.[0];
-        if (fn?.type !== "ArrowFunctionExpression" && fn?.type !== "FunctionExpression") return;
-        if (!referencesCodeOrMessage(fn.body)) {
-          context.report({ node, messageId: "blindAck" });
+      Property(node) {
+        const keyName = node.key?.type === "Identifier" ? node.key.name : node.key?.type === "Literal" ? node.key.value : null;
+        if (keyName !== "appendTransaction") return;
+        const val = node.value;
+        if (val?.type === "FunctionExpression" || val?.type === "ArrowFunctionExpression") {
+          checkAppendTransactionFn(val, node);
         }
       }
     };
   }
 };
-var openaiCuaNoBlindSafetyCheckAckRule = rule56;
+var tiptapAppendTransactionAddToHistoryRule = rule76;
 
-// src/providers/openai-cua/utils.ts
-function propName(node) {
-  if (!node) return void 0;
-  if (node.type === "Identifier") return node.name;
-  if (node.type === "Literal" && typeof node.value === "string") return node.value;
-  return void 0;
-}
-function memberChainNames(node, names = []) {
-  if (node?.type === "MemberExpression") {
-    memberChainNames(node.object, names);
-    const n = propName(node.property);
-    if (n) names.push(n);
-  } else if (node?.type === "Identifier") {
-    names.push(node.name);
-  }
-  return names;
-}
-function isResponsesCreateCall(node) {
-  if (node?.type !== "CallExpression" || node.callee?.type !== "MemberExpression") return false;
-  const chain = memberChainNames(node.callee);
-  return chain.length >= 2 && chain[chain.length - 1] === "create" && chain[chain.length - 2] === "responses";
-}
-function findResponsesCreateCall(node, depth = 0) {
-  if (!node || typeof node !== "object" || depth > 12) return null;
-  if (Array.isArray(node)) {
-    for (const n of node) {
-      const found = findResponsesCreateCall(n, depth + 1);
-      if (found) return found;
+// src/providers/tiptap/rules/appendTransaction-full-scan.ts
+var rule77 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "appendTransaction must guard doc.descendants() with a docChanged check",
+      category: "reliability",
+      rationale: "doc.descendants() visits every node in the document on every transaction \u2014 every keystroke, selection change, and formatting toggle. For documents with many nodes this is O(n) per transaction and causes visible input latency. ProseMirror provides the docChanged flag precisely to avoid this work when the document structure has not changed.",
+      docsUrl: "https://prosemirror.net/docs/ref/#state.PluginSpec.appendTransaction",
+      recommended: true
+    },
+    messages: {
+      fullScanOnEveryTransaction: "appendTransaction calls doc.descendants() on every transaction. Check docChanged first: const docChanged = transactions.some(tr => tr.docChanged); if (!docChanged) return;"
+    },
+    schema: []
+  },
+  create(context) {
+    function hasDocChangedGuard(fnBody) {
+      let found = false;
+      walk(fnBody, (node) => {
+        if (found) return false;
+        if (node?.type === "MemberExpression" && node.property?.name === "docChanged") {
+          found = true;
+          return false;
+        }
+        if (node?.type === "Identifier" && node.name === "docChanged") {
+          found = true;
+          return false;
+        }
+      });
+      return found;
     }
-    return null;
-  }
-  if (isResponsesCreateCall(node)) return node;
-  for (const key of Object.keys(node)) {
-    if (key === "parent" || key === "loc" || key === "range") continue;
-    const val = node[key];
-    if (val && typeof val === "object") {
-      const found = findResponsesCreateCall(val, depth + 1);
-      if (found) return found;
+    function hasDescendantsCall(fnBody) {
+      let found = false;
+      walk(fnBody, (node) => {
+        if (found) return false;
+        if (node?.type === "CallExpression" && node.callee?.type === "MemberExpression" && node.callee.property?.name === "descendants") {
+          found = true;
+        }
+      });
+      return found;
+    }
+    function checkAppendTransactionFn(fn, reportNode) {
+      const body = fn?.body;
+      if (!body) return;
+      if (hasDescendantsCall(body) && !hasDocChangedGuard(body)) {
+        context.report({ node: reportNode, messageId: "fullScanOnEveryTransaction" });
+      }
     }
+    return {
+      Property(node) {
+        const keyName = node.key?.type === "Identifier" ? node.key.name : node.key?.type === "Literal" ? node.key.value : null;
+        if (keyName !== "appendTransaction") return;
+        const val = node.value;
+        if (val?.type === "FunctionExpression" || val?.type === "ArrowFunctionExpression") {
+          checkAppendTransactionFn(val, node);
+        }
+      }
+    };
   }
-  return null;
-}
+};
+var tiptapAppendTransactionFullScanRule = rule77;
 
-// src/providers/openai-cua/rules/retry-transient-turn-errors.ts
-var rule57 = {
+// src/providers/tiptap/rules/atom-node-wrap-in.ts
+var rule78 = {
   meta: {
     type: "problem",
     docs: {
-      description: "A responses.create() call must be retried at the turn level on transient errors",
-      category: "reliability",
-      rationale: "The SDK's own internal retry budget (DEFAULT_MAX_RETRIES) is finite. Treating any exception that survives it as fatal for the whole run \u2014 instead of retrying that one turn with backoff \u2014 means a single transient RateLimitError/APIConnectionError/InternalServerError can discard a long-running, multi-turn, expensive agent loop that may have already executed dozens of prior turns.",
-      docsUrl: "https://developers.openai.com/api/docs/guides/tools-computer-use",
+      description: "wrapIn() must not be called with an atom node type",
+      category: "correctness",
+      rationale: 'Atom nodes have no content model \u2014 ProseMirror cannot wrap other nodes inside them. Calling wrapIn("atomNode") always returns false silently, making the command appear broken when triggered on selected text. Use replaceSelectionWith(node.create()) or insertContent() instead.',
+      docsUrl: "https://tiptap.dev/docs/editor/extensions/custom-extensions/create-new/node",
       recommended: true
     },
     messages: {
-      noTurnRetry: "This responses.create() call has no turn-level retry \u2014 neither a surrounding loop nor a retry call in the catch block \u2014 so any error beyond the SDK's own retry budget ends the entire run."
-    }
+      wrapInAtomNode: "wrapIn() is called with an atom node type. Atom nodes cannot contain content, so wrapIn() always silently returns false. Replace the selection instead of wrapping it."
+    },
+    schema: []
   },
   create(context) {
-    let loopDepth = 0;
-    function propName2(node) {
-      if (!node) return void 0;
-      if (node.type === "Identifier") return node.name;
-      if (node.type === "Literal" && typeof node.value === "string") return node.value;
-      return void 0;
+    const atomNodeNames = /* @__PURE__ */ new Set();
+    const wrapInCalls = [];
+    function extractNodeName(configObj) {
+      if (configObj?.type !== "ObjectExpression") return null;
+      const nameProp = configObj.properties?.find(
+        (p) => p?.type === "Property" && (p.key?.type === "Identifier" && p.key.name === "name" || p.key?.type === "Literal" && p.key.value === "name")
+      );
+      const nameVal = nameProp?.value;
+      if (nameVal?.type === "Literal" && typeof nameVal.value === "string") {
+        return nameVal.value;
+      }
+      return null;
     }
-    function catchHasRetryCall(node, depth = 0) {
-      if (!node || typeof node !== "object" || depth > 12) return false;
-      if (Array.isArray(node)) return node.some((n) => catchHasRetryCall(n, depth + 1));
-      if (node.type === "CallExpression") {
+    function hasAtomTrue(configObj) {
+      if (configObj?.type !== "ObjectExpression") return false;
+      return configObj.properties?.some(
+        (p) => p?.type === "Property" && (p.key?.type === "Identifier" && p.key.name === "atom" || p.key?.type === "Literal" && p.key.value === "atom") && p.value?.type === "Literal" && p.value.value === true
+      ) ?? false;
+    }
+    return {
+      CallExpression(node) {
+        if (node.callee?.type === "MemberExpression" && node.callee.property?.name === "create") {
+          const configArg = node.arguments?.[0];
+          if (configArg?.type === "ObjectExpression" && hasAtomTrue(configArg)) {
+            const name = extractNodeName(configArg);
+            if (name) atomNodeNames.add(name);
+          }
+        }
         const callee = node.callee;
-        const name = callee?.type === "Identifier" ? callee.name : callee?.type === "MemberExpression" ? propName2(callee.property) : void 0;
-        if (name && /retry/i.test(name)) return true;
-      }
-      for (const key of Object.keys(node)) {
-        if (key === "parent" || key === "loc" || key === "range") continue;
-        const val = node[key];
-        if (val && typeof val === "object") {
-          if (catchHasRetryCall(val, depth + 1)) return true;
+        const isWrapIn = callee?.type === "Identifier" && callee.name === "wrapIn" || callee?.type === "MemberExpression" && callee.property?.name === "wrapIn";
+        if (isWrapIn) {
+          const firstArg = node.arguments?.[0];
+          if (firstArg?.type === "Literal" && typeof firstArg.value === "string") {
+            wrapInCalls.push({ node, name: firstArg.value });
+          }
+        }
+      },
+      "Program:exit"() {
+        for (const { node, name } of wrapInCalls) {
+          if (atomNodeNames.has(name)) {
+            context.report({ node, messageId: "wrapInAtomNode" });
+          }
         }
       }
-      return false;
+    };
+  }
+};
+var tiptapAtomNodeWrapInRule = rule78;
+
+// src/providers/tiptap/rules/twitter-url-regex.ts
+var rule79 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Twitter/X URL regex must match both x.com and twitter.com",
+      category: "integration",
+      rationale: "Twitter rebranded to X but twitter.com URLs still resolve and embed correctly. A regex that only matches x.com silently rejects all legacy twitter.com links pasted by users. Update the pattern to (x\\.com|twitter\\.com) so both domains are handled.",
+      docsUrl: "https://tiptap.dev/docs/editor/extensions/nodes",
+      recommended: true
+    },
+    messages: {
+      twitterRegexMissingLegacyDomain: "This regex matches x.com but not twitter.com. Legacy twitter.com URLs are still valid and should be supported. Add (x\\.com|twitter\\.com) to the pattern."
+    },
+    schema: []
+  },
+  create(context) {
+    function checkPattern(pattern, node) {
+      if (!pattern.includes("x\\.com") && !pattern.includes("x.com")) return;
+      if (pattern.includes("twitter\\.com") || pattern.includes("twitter.com")) return;
+      context.report({ node, messageId: "twitterRegexMissingLegacyDomain" });
     }
     return {
-      ForStatement() {
-        loopDepth += 1;
-      },
-      "ForStatement:exit"() {
-        loopDepth -= 1;
-      },
-      WhileStatement() {
-        loopDepth += 1;
-      },
-      "WhileStatement:exit"() {
-        loopDepth -= 1;
-      },
-      DoWhileStatement() {
-        loopDepth += 1;
-      },
-      "DoWhileStatement:exit"() {
-        loopDepth -= 1;
-      },
-      ForOfStatement() {
-        loopDepth += 1;
-      },
-      "ForOfStatement:exit"() {
-        loopDepth -= 1;
-      },
-      ForInStatement() {
-        loopDepth += 1;
-      },
-      "ForInStatement:exit"() {
-        loopDepth -= 1;
+      Literal(node) {
+        if (node.regex?.pattern) {
+          checkPattern(node.regex.pattern, node);
+        }
       },
-      TryStatement(node) {
-        const createCall = findResponsesCreateCall(node.block);
-        if (!createCall) return;
-        if (loopDepth > 0) return;
-        const handler = node.handler;
-        if (!handler) return;
-        if (catchHasRetryCall(handler.body)) return;
-        context.report({ node: handler, messageId: "noTurnRetry" });
+      NewExpression(node) {
+        if (node.callee?.type === "Identifier" && node.callee.name === "RegExp") {
+          const firstArg = node.arguments?.[0];
+          if (firstArg?.type === "Literal" && typeof firstArg.value === "string") {
+            checkPattern(firstArg.value, node);
+          }
+        }
       }
     };
   }
 };
-var openaiCuaRetryTransientTurnErrorsRule = rule57;
+var tiptapTwitterUrlRegexRule = rule79;
 
-// src/providers/openai-cua/rules/check-response-status-incomplete.ts
-var rule58 = {
+// src/providers/tiptap/rules/drop-handler-pos-precedence.ts
+var rule80 = {
   meta: {
     type: "problem",
     docs: {
-      description: 'A completion check must rule out response.status === "incomplete" before reporting success',
-      category: "reliability",
-      rationale: 'The Responses API can return status "incomplete" with zero visible message output when generation is cut off by the token budget \u2014 the same shape ("no computer_call, no message") a purely structural completion check treats as "the model voluntarily finished." Without checking response.status, a token-budget truncation can be silently reported as a successful task completion.',
-      docsUrl: "https://developers.openai.com/api/docs/guides/tools-computer-use",
+      description: "x ?? 0 - 1 is parsed as x ?? (0 - 1) = x ?? -1 due to operator precedence",
+      category: "correctness",
+      rationale: "The nullish coalescing operator (??) has lower precedence than arithmetic operators. Writing `pos ?? 0 - 1` evaluates as `pos ?? -1`, not `(pos ?? 0) - 1`. When pos is null or undefined, the fallback is -1 instead of the intended -1 offset from 0. In ProseMirror drop handlers this produces a decoration at position -1, which corrupts the placeholder position map and can insert content at the document start.",
+      docsUrl: "https://prosemirror.net/docs/ref/#view.EditorView.posAtCoords",
       recommended: true
     },
     messages: {
-      missingIncompleteCheck: 'This treats the absence of tool calls as a successful completion, but never checks response.status === "incomplete" \u2014 a token-budget truncation can be misreported as success.'
-    }
+      posNullCoalescePrecedence: 'Operator precedence bug: "x ?? 0 - 1" is parsed as "x ?? (0 - 1)" = "x ?? -1". Wrap the intended expression: "(x ?? 0) - 1".'
+    },
+    schema: []
   },
   create(context) {
-    const stack = [];
-    const states = /* @__PURE__ */ new Map();
-    function ensureState(fn) {
-      let s = states.get(fn);
-      if (!s) {
-        s = { sawCreateCall: false, sawSuccessReturn: false, successNode: null, sawStatusCheck: false };
-        states.set(fn, s);
-      }
-      return s;
-    }
-    function top() {
-      return stack[stack.length - 1];
-    }
-    function pushScope(node) {
-      stack.push(node);
-      ensureState(node);
-    }
-    function popScope() {
-      stack.pop();
-    }
-    function propName2(node) {
-      if (!node) return void 0;
-      if (node.type === "Identifier") return node.name;
-      if (node.type === "Literal" && typeof node.value === "string") return node.value;
-      return void 0;
-    }
-    function isSuccessObjectLiteral(node) {
-      if (node?.type !== "ObjectExpression") return false;
-      return (node.properties ?? []).some((p) => {
-        if (p?.type !== "Property") return false;
-        const keyName = propName2(p.key);
-        return (keyName === "success" || keyName === "completed") && p.value?.type === "Literal" && p.value.value === true;
-      });
-    }
     return {
-      Program(node) {
-        pushScope(node);
-      },
-      "Program:exit"() {
-        for (const state of states.values()) {
-          if (state.sawCreateCall && state.sawSuccessReturn && !state.sawStatusCheck) {
-            context.report({ node: state.successNode, messageId: "missingIncompleteCheck" });
-          }
+      LogicalExpression(node) {
+        if (node.operator !== "??") return;
+        const right = node.right;
+        if (right?.type === "BinaryExpression" && right.operator === "-" && right.left?.type === "Literal" && right.left.value === 0 && right.right?.type === "Literal" && right.right.value === 1) {
+          context.report({ node, messageId: "posNullCoalescePrecedence" });
         }
-      },
-      FunctionDeclaration(node) {
-        pushScope(node);
-      },
-      "FunctionDeclaration:exit"() {
-        popScope();
-      },
-      FunctionExpression(node) {
-        pushScope(node);
-      },
-      "FunctionExpression:exit"() {
-        popScope();
-      },
-      ArrowFunctionExpression(node) {
-        pushScope(node);
-      },
-      "ArrowFunctionExpression:exit"() {
-        popScope();
-      },
-      CallExpression(node) {
-        if (findResponsesCreateCall(node)) {
-          const fn = top();
-          if (fn) ensureState(fn).sawCreateCall = true;
+      }
+    };
+  }
+};
+var tiptapDropHandlerPosPrecedenceRule = rule80;
+
+// src/providers/tiptap/rules/prefer-table-kit.ts
+var INDIVIDUAL_TABLE_PACKAGES = /* @__PURE__ */ new Set([
+  "@tiptap/extension-table-row",
+  "@tiptap/extension-table-cell",
+  "@tiptap/extension-table-header"
+]);
+var rule81 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Use TableKit from @tiptap/extension-table instead of individual table packages",
+      category: "integration",
+      rationale: "Importing table extensions individually from their separate packages bypasses the coordinated wiring that TableKit provides: shared configuration, the mergeOrSplit command, and consistent HTMLAttributes across all table elements. Individual imports also leave TableCell and TableHeader unconfigured by default.",
+      docsUrl: "https://tiptap.dev/docs/editor/extensions/functionality/table-kit",
+      recommended: true
+    },
+    messages: {
+      preferTableKit: "Individual TipTap table extension imported. Use TableKit from @tiptap/extension-table for coordinated configuration and the mergeOrSplit command."
+    },
+    schema: []
+  },
+  create(context) {
+    const individualImports = [];
+    return {
+      ImportDeclaration(node) {
+        const src = node?.source?.value ?? "";
+        if (INDIVIDUAL_TABLE_PACKAGES.has(src)) {
+          individualImports.push(node);
         }
       },
-      ObjectExpression(node) {
-        if (isSuccessObjectLiteral(node)) {
-          const fn = top();
-          if (fn) {
-            const state = ensureState(fn);
-            if (!state.sawSuccessReturn) {
-              state.sawSuccessReturn = true;
-              state.successNode = node;
-            }
+      "Program:exit"() {
+        if (individualImports.length >= 2) {
+          for (const node of individualImports) {
+            context.report({ node, messageId: "preferTableKit" });
           }
         }
-      },
-      BinaryExpression(node) {
-        if (node.operator !== "===" && node.operator !== "==") return;
-        const sides = [node.left, node.right];
-        const statusSide = sides.find((s) => s?.type === "MemberExpression" && propName2(s.property) === "status");
-        const valueSide = sides.find((s) => s !== statusSide);
-        if (statusSide && valueSide?.type === "Literal" && valueSide.value === "incomplete") {
-          const fn = top();
-          if (fn) ensureState(fn).sawStatusCheck = true;
-        }
       }
     };
   }
 };
-var openaiCuaCheckResponseStatusIncompleteRule = rule58;
+var tiptapPreferTableKitRule = rule81;
 
-// src/providers/openai-cua/rules/set-safety-identifier.ts
-var rule59 = {
+// src/providers/tiptap/rules/tiptap-markdown-missing-node-spec.ts
+var rule82 = {
   meta: {
-    type: "problem",
+    type: "suggestion",
     docs: {
-      description: "responses.create() must set safety_identifier for per-end-user policy attribution",
+      description: "TipTap nodes used with tiptap-markdown must define a markdown serialization spec",
       category: "integration",
-      rationale: "OpenAI documents that a stable per-end-user safety_identifier lets policy violations be attributed and acted on per end user. Without one on a multi-tenant integration routing many customers through a single shared API key, a single customer triggering a high-confidence policy-violation heuristic can result in access being temporarily revoked for the entire organization, not just the offending identifier.",
-      docsUrl: "https://help.openai.com/en/articles/5428082-how-to-incorporate-a-safety-identifier",
+      rationale: "When tiptap-markdown serializes a document, nodes without a markdown spec are silently dropped or emitted as empty strings. Custom node types must register a serialize/parse pair via MarkdownNodeSpec (in addStorage or addOptions) so content survives markdown export/import cycles.",
+      docsUrl: "https://github.com/ueberdosis/tiptap-markdown",
       recommended: true
     },
     messages: {
-      missingSafetyIdentifier: "This responses.create() call sets no safety_identifier (or user) \u2014 a policy violation here could be attributed to the entire shared API key instead of one end user."
-    }
+      missingMarkdownNodeSpec: "This TipTap node is used alongside tiptap-markdown but defines no markdown serialization. Nodes without a markdown spec are silently dropped on export. Add a MarkdownNodeSpec to addStorage or addOptions."
+    },
+    schema: []
   },
   create(context) {
-    function propName2(node) {
-      if (!node) return void 0;
-      if (node.type === "Identifier") return node.name;
-      if (node.type === "Literal" && typeof node.value === "string") return node.value;
-      return void 0;
+    let importsTiptapCore = false;
+    let importsTiptapMarkdown = false;
+    const nodeCreateCalls = [];
+    function hasMarkdownSpec(configObj) {
+      if (configObj?.type !== "ObjectExpression") return false;
+      let found = false;
+      walk(configObj, (node) => {
+        if (found) return false;
+        if (node?.type === "Property") {
+          const keyName = node.key?.type === "Identifier" ? node.key.name : node.key?.type === "Literal" ? String(node.key.value) : null;
+          if (keyName === "markdown") {
+            found = true;
+            return false;
+          }
+        }
+        if (node?.type === "Identifier" && node.name === "MarkdownNodeSpec") {
+          found = true;
+          return false;
+        }
+      });
+      return found;
     }
     return {
+      ImportDeclaration(node) {
+        const src = node?.source?.value ?? "";
+        if (src.startsWith("@tiptap/core")) importsTiptapCore = true;
+        if (src === "tiptap-markdown" || src === "@tiptap/extension-markdown") {
+          importsTiptapMarkdown = true;
+        }
+      },
       CallExpression(node) {
-        if (!isResponsesCreateCall(node)) return;
-        const optionsArg = node.arguments?.[0];
-        if (optionsArg?.type !== "ObjectExpression") return;
-        const hasIdentifier = (optionsArg.properties ?? []).some((p) => {
-          if (p?.type !== "Property") return false;
-          const keyName = propName2(p.key);
-          return keyName === "safety_identifier" || keyName === "user";
-        });
-        if (!hasIdentifier) {
-          context.report({ node, messageId: "missingSafetyIdentifier" });
+        if (node.callee?.type === "MemberExpression" && node.callee.property?.name === "create") {
+          const configArg = node.arguments?.[0];
+          if (configArg?.type === "ObjectExpression") {
+            nodeCreateCalls.push({ callNode: node, configObj: configArg });
+          }
+        }
+      },
+      // Also check for MarkdownNodeSpec at program level
+      "Program:exit"() {
+        if (!importsTiptapCore || !importsTiptapMarkdown) return;
+        for (const { callNode, configObj } of nodeCreateCalls) {
+          if (!hasMarkdownSpec(configObj)) {
+            context.report({ node: callNode, messageId: "missingMarkdownNodeSpec" });
+          }
         }
       }
     };
   }
 };
-var openaiCuaSetSafetyIdentifierRule = rule59;
+var tiptapTiptapMarkdownMissingNodeSpecRule = rule82;
 
 // src/plugin/index.ts
 var plugin = {
@@ -4780,6 +6066,18 @@ var plugin = {
     "firebase-rtdb-listener-error-not-handled": firebaseRtdbListenerErrorNotHandledRule,
     "firebase-effect-deps-whole-user-object": firebaseEffectDepsWholeUserObjectRule,
     "firebase-rtdb-write-promise-not-handled": firebaseRtdbWritePromiseNotHandledRule,
+    "firebase-firestore-rules-expired": firebaseFirestoreRulesExpiredRule,
+    "firebase-id-token-cookie-flags": firebaseIdTokenCookieFlagsRule,
+    "firebase-middleware-token-not-verified": firebaseMiddlewareTokenNotVerifiedRule,
+    "firebase-hardcoded-user-id": firebaseHardcodedUserIdRule,
+    "firebase-auth-user-not-found-disclosure": firebaseAuthUserNotFoundDisclosureRule,
+    "firebase-signup-password-confirm": firebaseSignupPasswordConfirmRule,
+    "firebase-use-array-union-remove": firebaseUseArrayUnionRemoveRule,
+    "firebase-duplicate-initialize-app": firebaseDuplicateInitializeAppRule,
+    "firebase-onSnapshot-async-throw": firebaseOnSnapshotAsyncThrowRule,
+    "firebase-onSnapshot-missing-error-callback": firebaseOnSnapshotMissingErrorCallbackRule,
+    "firebase-firestore-document-size-guard": firebaseFirestoreDocumentSizeGuardRule,
+    "firebase-use-timestamp-now": firebaseUseTimestampNowRule,
     "lovable-no-client-side-secret-fetch": lovableNoClientSideSecretFetchRule,
     "lovable-paid-flag-without-edge-function": lovablePaidFlagWithoutEdgeFunctionRule,
     "lovable-expiry-column-never-checked": lovableExpiryColumnNeverCheckedRule,
@@ -4801,7 +6099,18 @@ var plugin = {
     "openai-cua-no-blind-safety-check-ack": openaiCuaNoBlindSafetyCheckAckRule,
     "openai-cua-retry-transient-turn-errors": openaiCuaRetryTransientTurnErrorsRule,
     "openai-cua-check-response-status-incomplete": openaiCuaCheckResponseStatusIncompleteRule,
-    "openai-cua-set-safety-identifier": openaiCuaSetSafetyIdentifierRule
+    "openai-cua-set-safety-identifier": openaiCuaSetSafetyIdentifierRule,
+    "tiptap-upload-validate-fn-void": tiptapUploadValidateFnVoidRule,
+    "tiptap-script-src-hardcoded-api-key": tiptapScriptSrcHardcodedApiKeyRule,
+    "tiptap-dynamic-script-no-sri": tiptapDynamicScriptNoSriRule,
+    "tiptap-addAttributes-missing-renderHTML": tiptapAddAttributesMissingRenderHTMLRule,
+    "tiptap-appendTransaction-add-to-history": tiptapAppendTransactionAddToHistoryRule,
+    "tiptap-appendTransaction-full-scan": tiptapAppendTransactionFullScanRule,
+    "tiptap-atom-node-wrap-in": tiptapAtomNodeWrapInRule,
+    "tiptap-twitter-url-regex": tiptapTwitterUrlRegexRule,
+    "tiptap-drop-handler-pos-precedence": tiptapDropHandlerPosPrecedenceRule,
+    "tiptap-prefer-table-kit": tiptapPreferTableKitRule,
+    "tiptap-tiptap-markdown-missing-node-spec": tiptapTiptapMarkdownMissingNodeSpecRule
   }
 };
 var plugin_default = plugin;