@api-doctor/cli 0.0.4 → 0.0.5

package/dist/cli.cjs

@@ -905,6 +905,267 @@ var tiptapManifest = {
   ]
 };
 
+// src/providers/elevenlabs/manifest.ts
+var elevenlabsManifest = {
+  name: "elevenlabs",
+  displayName: "ElevenLabs",
+  detect: {
+    packages: ["@11labs/client", "elevenlabs", "@elevenlabs/elevenlabs-js"],
+    imports: ["@11labs/client", "elevenlabs", "@elevenlabs/elevenlabs-js"],
+    urlPatterns: ["api.elevenlabs.io"]
+  },
+  oxlintRules: [
+    {
+      key: "elevenlabs-validate-signed-url-response",
+      resultRule: "elevenlabs/correctness/validate-signed-url-response",
+      message: "The signed URL response is used without validating that signed_url is present.",
+      fix: "Check that data.signed_url exists before using it, and throw/return an error response if it is missing.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/api-reference/conversations/get-signed-url",
+      severity: "error"
+    },
+    {
+      key: "elevenlabs-no-error-object-logging",
+      resultRule: "elevenlabs/security/no-error-object-logging",
+      message: "A catch block around an ElevenLabs API call logs the raw error object.",
+      fix: 'Log a sanitized message (e.g. error instanceof Error ? error.message : "Unknown error") instead of the raw error object.',
+      docsUrl: "https://elevenlabs.io/docs/api-reference/authentication",
+      severity: "error"
+    },
+    {
+      key: "elevenlabs-fetch-timeout-required",
+      resultRule: "elevenlabs/reliability/fetch-timeout-required",
+      message: "A fetch call to the ElevenLabs API has no abort signal/timeout.",
+      fix: "Pass an AbortController signal (e.g. via setTimeout(() => controller.abort(), 5000)) so a slow or unresponsive API does not hang the request indefinitely.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/api-reference/conversations/get-signed-url",
+      severity: "warning"
+    },
+    {
+      key: "elevenlabs-validate-agent-id-format",
+      resultRule: "elevenlabs/correctness/validate-agent-id-format",
+      message: "agentId is checked for existence but not validated against an expected format.",
+      fix: "Validate agentId against an allowed pattern (e.g. /^[a-zA-Z0-9\\-]{1,64}$/) before using it in an ElevenLabs API request.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/customization/authentication",
+      severity: "error"
+    },
+    {
+      key: "elevenlabs-secure-session-id-generation",
+      resultRule: "elevenlabs/security/secure-session-id-generation",
+      message: "A session id is generated with Math.random(), which is not cryptographically secure.",
+      fix: "Use crypto.getRandomValues() to generate session ids instead of Math.random().",
+      docsUrl: "https://elevenlabs.io/docs/eleven-api/guides/how-to/best-practices/security",
+      severity: "error"
+    },
+    {
+      key: "elevenlabs-conversation-error-recovery",
+      resultRule: "elevenlabs/reliability/conversation-error-recovery",
+      message: "A loading flag set before starting a conversation is never reset on failure.",
+      fix: "Reset the loading flag in the catch block (or a finally block) so a failed attempt does not leave the UI stuck loading.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/libraries/java-script",
+      severity: "warning"
+    },
+    {
+      key: "elevenlabs-api-version-pinning",
+      resultRule: "elevenlabs/reliability/api-version-pinning",
+      message: "A fetch call to the ElevenLabs API has no explicit API version header.",
+      fix: "Add an explicit version header (e.g. elevenlabs-version) to the request instead of relying on the URL path alone.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-api/resources/breaking-changes-policy",
+      severity: "warning"
+    },
+    {
+      key: "elevenlabs-check-http-status-before-json",
+      resultRule: "elevenlabs/correctness/check-http-status-before-json",
+      message: "response.json() is called on an ElevenLabs API response without checking response.ok/status first.",
+      fix: "Check response.ok (or response.status) before calling response.json(), so an error body is not parsed as valid data.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-api/resources/errors",
+      severity: "error"
+    },
+    {
+      key: "elevenlabs-conversation-cleanup-on-error",
+      resultRule: "elevenlabs/reliability/conversation-cleanup-on-error",
+      message: "A call to end the conversation has no surrounding try/catch.",
+      fix: "Wrap conversation.endSession()/endConversation() in try/catch so a rejection does not leave the conversation state in memory.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/libraries/java-script",
+      severity: "warning"
+    },
+    {
+      key: "elevenlabs-env-var-validation",
+      resultRule: "elevenlabs/correctness/env-var-validation",
+      message: "An ElevenLabs API key is only validated inside a request handler, not at module load.",
+      fix: "Read and validate the env var at module scope (and throw if missing) so a misconfigured deployment fails at startup.",
+      docsUrl: "https://elevenlabs.io/docs/api-reference/authentication",
+      severity: "warning"
+    }
+  ]
+};
+
+// src/providers/twilio/manifest.ts
+var twilioManifest = {
+  name: "twilio",
+  displayName: "Twilio",
+  detect: {
+    packages: ["twilio"],
+    imports: ["twilio"],
+    urlPatterns: ["api.twilio.com"]
+  },
+  oxlintRules: [
+    {
+      key: "twilio-validate-webhook-signature",
+      resultRule: "twilio/security/validate-webhook-signature",
+      message: "A POST webhook route reads req.body but never validates the X-Twilio-Signature header.",
+      fix: "Validate the X-Twilio-Signature header with twilio.validateRequest()/RequestValidator before trusting the body.",
+      docsUrl: "https://www.twilio.com/docs/usage/webhooks/webhooks-security",
+      severity: "error"
+    },
+    {
+      key: "twilio-taskrouter-attributes-match-consumer",
+      resultRule: "twilio/correctness/taskrouter-attributes-match-consumer",
+      message: "A .task() attributes object is missing a field that a reservation handler reads back out of TaskAttributes.",
+      fix: "Add the missing field to the Task attributes object so the consumer's JSON.parse(TaskAttributes) destructure actually finds it.",
+      docsUrl: "https://www.twilio.com/docs/taskrouter/twiml-queue-calls",
+      severity: "error"
+    },
+    {
+      key: "twilio-enqueue-task-json-stringify",
+      resultRule: "twilio/security/enqueue-task-json-stringify",
+      message: "A .task() call builds JSON attributes via raw string interpolation instead of JSON.stringify().",
+      fix: "Build the Task attributes as an object and serialize with JSON.stringify() instead of interpolating values into a JSON string/template literal.",
+      docsUrl: "https://www.twilio.com/docs/api/errors/14221",
+      severity: "error"
+    },
+    {
+      key: "twilio-media-streams-key-by-call-sid",
+      resultRule: "twilio/reliability/media-streams-key-by-call-sid",
+      message: "A Media Streams session map is keyed by a phone-number-like field instead of callSid.",
+      fix: "Key the map by start.callSid instead of the caller phone number, and propagate callSid (not the number) downstream as the lookup key.",
+      docsUrl: "https://www.twilio.com/docs/voice/media-streams/websocket-messages",
+      severity: "error"
+    },
+    {
+      key: "twilio-await-or-catch-rest-calls-in-event-handlers",
+      resultRule: "twilio/reliability/await-or-catch-rest-calls-in-event-handlers",
+      message: "A Twilio REST call inside an event-handler callback has no surrounding try/catch.",
+      fix: "Wrap the REST call in try/catch inside the handler so a rejected promise does not become an unhandled rejection.",
+      docsUrl: "https://www.twilio.com/docs/usage/webhooks/webhooks-faq",
+      severity: "error"
+    },
+    {
+      key: "twilio-use-twiml-builder-not-string-templates",
+      resultRule: "twilio/security/use-twiml-builder-not-string-templates",
+      message: "TwiML is built as a raw template literal instead of the VoiceResponse builder.",
+      fix: "Build TwiML with new VoiceResponse() and its builder methods (say, connect, stream, parameter) instead of interpolating values into an XML template literal.",
+      docsUrl: "https://www.twilio.com/docs/voice/twiml/stream",
+      severity: "warning"
+    },
+    {
+      key: "twilio-media-streams-mark-pacing",
+      resultRule: "twilio/reliability/media-streams-mark-pacing",
+      message: "Media is forwarded to a Stream with no mark-based pacing (isLast) anywhere in the file.",
+      fix: "Pace sends with mark events (pass isLast: true periodically) and wait for the inbound mark acknowledgment before queuing more audio.",
+      docsUrl: "https://www.twilio.com/docs/api/errors/31931",
+      severity: "warning"
+    },
+    {
+      key: "twilio-validate-all-request-inputs",
+      resultRule: "twilio/correctness/validate-all-request-inputs",
+      message: "A webhook route reads a request field that is not covered by its schema (or has no schema at all).",
+      fix: "Add a querystring/body schema covering every field the handler reads, and reject the request with a 400 if a required field is missing.",
+      docsUrl: "https://www.twilio.com/docs/voice/twiml/stream",
+      severity: "warning"
+    },
+    {
+      key: "twilio-media-streams-mark-name-string",
+      resultRule: "twilio/correctness/media-streams-mark-name-string",
+      message: "mark.name is set to a non-string value (Twilio requires a string).",
+      fix: "Wrap the value in String(...) (e.g. String(Date.now())) so mark.name matches Twilio's documented string schema.",
+      docsUrl: "https://www.twilio.com/docs/voice/media-streams/websocket-messages",
+      severity: "warning"
+    }
+  ]
+};
+
+// src/providers/openai-realtime/manifest.ts
+var openaiRealtimeManifest = {
+  name: "openai-realtime",
+  displayName: "OpenAI Realtime API",
+  detect: {
+    urlPatterns: ["api.openai.com/v1/realtime"]
+  },
+  oxlintRules: [
+    {
+      key: "openai-realtime-migrate-beta-to-ga",
+      resultRule: "openai-realtime/correctness/migrate-beta-to-ga",
+      message: "This Realtime connection sends the deprecated OpenAI-Beta: realtime=v1 header.",
+      fix: "Remove the OpenAI-Beta header and migrate the session/event shapes to the GA interface (session.type, audio.output nesting, response.output_audio.delta event names).",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime",
+      severity: "error"
+    },
+    {
+      key: "openai-realtime-no-log-raw-message-payloads",
+      resultRule: "openai-realtime/security/no-log-raw-message-payloads",
+      message: "A raw OpenAI Realtime message is logged verbatim, which can include live call audio or transcript content.",
+      fix: "Log only derived fields (e.g. { type: message.type }) at info level; log full payloads only at trace level behind an explicit opt-in.",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime",
+      severity: "error"
+    },
+    {
+      key: "openai-realtime-handle-error-server-event",
+      resultRule: "openai-realtime/reliability/handle-error-server-event",
+      message: 'This Realtime message handler branches on event types but never checks for the API-level "error" event.',
+      fix: "Add an explicit branch for message.type === 'error' that logs the error and surfaces/fails over, instead of letting it fall through silently.",
+      docsUrl: "https://developers.openai.com/api/docs/api-reference/realtime_server_events",
+      severity: "error"
+    },
+    {
+      key: "openai-realtime-reconnect-on-drop",
+      resultRule: "openai-realtime/reliability/reconnect-on-drop",
+      message: "This Realtime socket's close handler only logs and never attempts to reconnect.",
+      fix: "On close, attempt a bounded number of reconnects with a fresh session.update, and proactively end/flag the call if reconnection ultimately fails.",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime",
+      severity: "error"
+    },
+    {
+      key: "openai-realtime-avoid-dated-preview-snapshots",
+      resultRule: "openai-realtime/correctness/avoid-dated-preview-snapshots",
+      message: "The Realtime connection is pinned to a dated preview model snapshot instead of the GA alias.",
+      fix: "Use the GA model id (e.g. 'gpt-realtime') or a current dated snapshot tracked against OpenAI's deprecation notices.",
+      docsUrl: "https://developers.openai.com/api/docs/api-reference/realtime-sessions",
+      severity: "warning"
+    },
+    {
+      key: "openai-realtime-verify-deprecated-session-fields",
+      resultRule: "openai-realtime/correctness/verify-deprecated-session-fields",
+      message: "The session config sets 'temperature', a field not documented in the current GA Realtime sessions schema.",
+      fix: "Re-verify this field against the current sessions reference before relying on it, or drop it and control determinism via turn_detection/instructions instead.",
+      docsUrl: "https://developers.openai.com/api/docs/api-reference/realtime-sessions",
+      severity: "warning"
+    },
+    {
+      key: "openai-realtime-buffer-audio-until-session-ready",
+      resultRule: "openai-realtime/reliability/buffer-audio-until-session-ready",
+      message: "Audio sent before the Realtime socket reaches the open state is dropped instead of buffered.",
+      fix: "Queue outbound input_audio_buffer.append messages until the open event fires, then flush them in order.",
+      docsUrl: "https://developers.openai.com/api/docs/voice/media-streams/websocket-messages",
+      severity: "warning"
+    },
+    {
+      key: "openai-realtime-send-safety-identifier",
+      resultRule: "openai-realtime/security/send-safety-identifier",
+      message: "This Realtime WebSocket connection does not send an OpenAI-Safety-Identifier header.",
+      fix: "Add an OpenAI-Safety-Identifier header with a stable, privacy-preserving value (e.g. a hashed account/call id) to support abuse/safety monitoring.",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime",
+      severity: "info"
+    },
+    {
+      key: "openai-realtime-transcription-model-choice",
+      resultRule: "openai-realtime/correctness/transcription-model-choice",
+      message: "input_audio_transcription is configured with 'whisper-1', which is not natively streaming and not optimized for realtime sessions.",
+      fix: "Switch to 'gpt-realtime-whisper' if transcription output is consumed, or drop input_audio_transcription entirely if it isn't.",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime-transcription",
+      severity: "info"
+    }
+  ]
+};
+
 // src/providers/index.ts
 var providers = [
   resendManifest,
@@ -914,7 +1175,10 @@ var providers = [
   lovableManifest,
   browserbaseManifest,
   openaiCuaManifest,
-  tiptapManifest
+  tiptapManifest,
+  elevenlabsManifest,
+  twilioManifest,
+  openaiRealtimeManifest
 ];
 
 // src/reporter/animate.ts
@@ -7001,145 +7265,2247 @@ var rule82 = {
 };
 var tiptapTiptapMarkdownMissingNodeSpecRule = rule82;
 
-// src/plugin/index.ts
-var plugin = {
-  meta: { name: PLUGIN_NAME, version: "0.0.1" },
-  rules: {
-    "resend-webhook-signature": resendWebhookSignatureRule,
-    "resend-api-key-hardcoded": resendApiKeyHardcodedRule,
-    "resend-api-key-in-client-bundle": resendApiKeyInClientBundleRule,
-    "resend-marketing-via-batch-send": resendMarketingViaBatchSendRule,
-    "resend-marketing-missing-unsubscribe": resendMarketingMissingUnsubscribeRule,
-    "resend-test-domain-in-production-path": resendTestDomainInProductionPathRule,
-    "resend-from-address-not-friendly-format": resendFromAddressNotFriendlyFormatRule,
-    "resend-batch-size-not-enforced": resendBatchSizeNotEnforcedRule,
-    "resend-missing-idempotency-key": resendMissingIdempotencyKeyRule,
-    "resend-no-error-code-mapping": resendNoErrorCodeMappingRule,
-    "resend-webhook-no-idempotency": resendWebhookNoIdempotencyRule,
-    "resend-missing-tags": resendMissingTagsRule,
-    "resend-request-id-not-logged": resendRequestIdNotLoggedRule,
-    "supabase-scope-queries-by-tenant-column": supabaseScopeQueriesByTenantColumnRule,
-    "supabase-validate-uuid-columns": supabaseValidateUuidColumnsRule,
-    "supabase-order-by-timestamp-not-identity": supabaseOrderByTimestampNotIdentityRule,
-    "supabase-consistent-input-length-limits": supabaseConsistentInputLengthLimitsRule,
-    "supabase-idempotent-mutations": supabaseIdempotentMutationsRule,
-    "supabase-fail-fast-env-validation": supabaseFailFastEnvValidationRule,
-    "supabase-no-user-metadata-authz": supabaseNoUserMetadataAuthzRule,
-    "supabase-single-without-error-check": supabaseSingleWithoutErrorCheckRule,
-    "supabase-non-atomic-replace-pattern": supabaseNonAtomicReplacePatternRule,
-    "supabase-unchecked-mutation-error": supabaseUncheckedMutationErrorRule,
-    "supabase-realtime-missing-filter": supabaseRealtimeMissingFilterRule,
-    "supabase-storage-error-not-surfaced": supabaseStorageErrorNotSurfacedRule,
-    "auth0-required-audience-validation": auth0RequiredAudienceValidationRule,
-    "auth0-no-account-link-without-verified-email": auth0NoAccountLinkWithoutVerifiedEmailRule,
-    "auth0-dead-claim-verification-check": auth0DeadClaimVerificationCheckRule,
-    "auth0-jwks-refresh-on-unknown-kid": auth0JwksRefreshOnUnknownKidRule,
-    "firebase-missing-app-check": firebaseMissingAppCheckRule,
-    "firebase-unhandled-auth-popup-rejection": firebaseUnhandledAuthPopupRejectionRule,
-    "firebase-rtdb-list-read-for-single-item": firebaseRtdbListReadForSingleItemRule,
-    "firebase-unvalidated-external-data-to-rtdb": firebaseUnvalidatedExternalDataToRtdbRule,
-    "firebase-rtdb-batch-write-not-atomic": firebaseRtdbBatchWriteNotAtomicRule,
-    "firebase-rtdb-listener-error-not-handled": firebaseRtdbListenerErrorNotHandledRule,
-    "firebase-effect-deps-whole-user-object": firebaseEffectDepsWholeUserObjectRule,
-    "firebase-rtdb-write-promise-not-handled": firebaseRtdbWritePromiseNotHandledRule,
-    "firebase-firestore-rules-expired": firebaseFirestoreRulesExpiredRule,
-    "firebase-id-token-cookie-flags": firebaseIdTokenCookieFlagsRule,
-    "firebase-middleware-token-not-verified": firebaseMiddlewareTokenNotVerifiedRule,
-    "firebase-hardcoded-user-id": firebaseHardcodedUserIdRule,
-    "firebase-auth-user-not-found-disclosure": firebaseAuthUserNotFoundDisclosureRule,
-    "firebase-signup-password-confirm": firebaseSignupPasswordConfirmRule,
-    "firebase-use-array-union-remove": firebaseUseArrayUnionRemoveRule,
-    "firebase-duplicate-initialize-app": firebaseDuplicateInitializeAppRule,
-    "firebase-onSnapshot-async-throw": firebaseOnSnapshotAsyncThrowRule,
-    "firebase-onSnapshot-missing-error-callback": firebaseOnSnapshotMissingErrorCallbackRule,
-    "firebase-firestore-document-size-guard": firebaseFirestoreDocumentSizeGuardRule,
-    "firebase-use-timestamp-now": firebaseUseTimestampNowRule,
-    "lovable-no-client-side-secret-fetch": lovableNoClientSideSecretFetchRule,
-    "lovable-paid-flag-without-edge-function": lovablePaidFlagWithoutEdgeFunctionRule,
-    "lovable-expiry-column-never-checked": lovableExpiryColumnNeverCheckedRule,
-    "lovable-silent-catch-on-provider-call": lovableSilentCatchOnProviderCallRule,
-    "browserbase-no-conditional-authz-on-anonymous-user": browserbaseNoConditionalAuthzOnAnonymousUserRule,
-    "browserbase-no-connect-url-in-api-response": browserbaseNoConnectUrlInApiResponseRule,
-    "browserbase-session-id-requires-ownership-check": browserbaseSessionIdRequiresOwnershipCheckRule,
-    "browserbase-no-concurrent-shared-context": browserbaseNoConcurrentSharedContextRule,
-    "browserbase-mobile-device-requires-os-setting": browserbaseMobileDeviceRequiresOsSettingRule,
-    "browserbase-use-typed-exception-status-not-substring": browserbaseUseTypedExceptionStatusNotSubstringRule,
-    "browserbase-release-session-on-connect-failure": browserbaseReleaseSessionOnConnectFailureRule,
-    "browserbase-dont-stack-custom-retry-on-sdk-retry": browserbaseDontStackCustomRetryOnSdkRetryRule,
-    "browserbase-no-overbroad-error-substring-match": browserbaseNoOverbroadErrorSubstringMatchRule,
-    "browserbase-use-sdk-not-raw-requests": browserbaseUseSdkNotRawRequestsRule,
-    "browserbase-centralize-request-release": browserbaseCentralizeRequestReleaseRule,
-    "openai-cua-no-domain-allowlist": openaiCuaNoDomainAllowlistRule,
-    "openai-cua-scroll-delta-default-zero": openaiCuaScrollDeltaDefaultZeroRule,
-    "openai-cua-structured-step-metadata-not-text-json": openaiCuaStructuredStepMetadataNotTextJsonRule,
-    "openai-cua-no-blind-safety-check-ack": openaiCuaNoBlindSafetyCheckAckRule,
-    "openai-cua-retry-transient-turn-errors": openaiCuaRetryTransientTurnErrorsRule,
-    "openai-cua-check-response-status-incomplete": openaiCuaCheckResponseStatusIncompleteRule,
-    "openai-cua-set-safety-identifier": openaiCuaSetSafetyIdentifierRule,
-    "tiptap-upload-validate-fn-void": tiptapUploadValidateFnVoidRule,
-    "tiptap-script-src-hardcoded-api-key": tiptapScriptSrcHardcodedApiKeyRule,
-    "tiptap-dynamic-script-no-sri": tiptapDynamicScriptNoSriRule,
-    "tiptap-addAttributes-missing-renderHTML": tiptapAddAttributesMissingRenderHTMLRule,
-    "tiptap-appendTransaction-add-to-history": tiptapAppendTransactionAddToHistoryRule,
-    "tiptap-appendTransaction-full-scan": tiptapAppendTransactionFullScanRule,
-    "tiptap-atom-node-wrap-in": tiptapAtomNodeWrapInRule,
-    "tiptap-twitter-url-regex": tiptapTwitterUrlRegexRule,
-    "tiptap-drop-handler-pos-precedence": tiptapDropHandlerPosPrecedenceRule,
-    "tiptap-prefer-table-kit": tiptapPreferTableKitRule,
-    "tiptap-tiptap-markdown-missing-node-spec": tiptapTiptapMarkdownMissingNodeSpecRule
+// src/providers/elevenlabs/utils.ts
+function isElevenLabsUrlArg(node) {
+  if (!node) return false;
+  if (node.type === "Literal" && typeof node.value === "string") {
+    return node.value.includes("elevenlabs.io");
   }
-};
-
-// src/plugin/rule-registry.ts
-function buildRegistry() {
-  const registry2 = /* @__PURE__ */ new Map();
-  for (const [key, rule83] of Object.entries(plugin.rules)) {
-    const docs = rule83?.meta?.docs ?? {};
-    registry2.set(key, {
-      category: docs.category,
-      description: docs.description ?? "",
-      rationale: docs.rationale ?? "",
-      docsUrl: docs.docsUrl,
-      cwe: docs.cwe,
-      owasp: docs.owasp
-    });
+  if (node.type === "TemplateLiteral") {
+    return (node.quasis ?? []).some(
+      (q) => typeof q?.value?.raw === "string" && q.value.raw.includes("elevenlabs.io")
+    );
   }
-  return registry2;
+  return false;
 }
-var registry = buildRegistry();
-function getRuleDocsMeta(ruleKey) {
-  return registry.get(ruleKey);
+function findElevenLabsFetchCall(node, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 20) return null;
+  if (Array.isArray(node)) {
+    for (const n of node) {
+      const found = findElevenLabsFetchCall(n, depth + 1);
+      if (found) return found;
+    }
+    return null;
+  }
+  if (node.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "fetch") {
+    if (isElevenLabsUrlArg(node.arguments?.[0])) return node;
+  }
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object") {
+      const found = findElevenLabsFetchCall(val, depth + 1);
+      if (found) return found;
+    }
+  }
+  return null;
 }
-
-// src/reporter/snippet.ts
-function extractCodeSnippet(content, line, contextLines = 2) {
-  const allLines = content.split(/\r?\n/);
-  const highlighted = Math.min(Math.max(line, 1), allLines.length || 1);
-  const start = Math.max(1, highlighted - contextLines);
-  const end = Math.min(allLines.length, highlighted + contextLines);
-  const lines = [];
-  for (let n = start; n <= end; n++) {
-    lines.push({ number: n, text: allLines[n - 1] ?? "" });
+function unwrapAwait(node) {
+  return node?.type === "AwaitExpression" ? node.argument : node;
+}
+function collectVarDeclarators(node, out, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 24) return;
+  if (Array.isArray(node)) {
+    for (const n of node) collectVarDeclarators(n, out, depth + 1);
+    return;
+  }
+  if (node.type === "VariableDeclarator") out.push(node);
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object") collectVarDeclarators(val, out, depth + 1);
   }
-  return { lines, highlightedLine: highlighted };
 }
-
-// src/types.ts
-var SEVERITY_ORDER = {
-  error: 0,
-  warning: 1,
-  info: 2
-};
-function scoreToSeverityLabel(score) {
-  if (score >= 80) return "excellent";
-  if (score >= 60) return "good";
-  if (score >= 40) return "needs-work";
-  return "critical";
+function posOf(n) {
+  if (typeof n?.range?.[0] === "number") return n.range[0];
+  const line = n?.loc?.start?.line ?? 0;
+  const column = n?.loc?.start?.column ?? 0;
+  return line * 1e6 + column;
 }
 
-// src/reporter/report-builder.ts
-function computeScore(errors, warnings) {
-  return Math.max(0, 100 - errors * 15 - warnings * 5);
+// src/providers/elevenlabs/rules/validate-signed-url-response.ts
+var rule83 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "ElevenLabs signed URL responses must be validated before the signed_url field is used",
+      category: "correctness",
+      cwe: "CWE-252",
+      rationale: "The signed-url endpoint assumes the ElevenLabs API always returns a well-formed body. If the API ever returns an unexpected shape (error payload, empty body, schema change), `data.signed_url` is silently `undefined` and the failure only surfaces downstream when the client tries to connect with an invalid URL.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/api-reference/conversations/get-signed-url",
+      recommended: true
+    },
+    messages: {
+      missingValidation: "This code reads signed_url from the ElevenLabs API response without checking that the field exists. A malformed or unexpected response will silently produce an undefined signed URL."
+    }
+  },
+  create(context) {
+    function analyzeFunction(fnNode) {
+      const declarators = [];
+      collectVarDeclarators(fnNode.body, declarators);
+      const responseVarNames = [];
+      for (const d of declarators) {
+        const init = unwrapAwait(d.init);
+        if (init?.type === "CallExpression" && init.callee?.type === "Identifier" && init.callee.name === "fetch" && isElevenLabsUrlArg(init.arguments?.[0]) && d.id?.type === "Identifier") {
+          responseVarNames.push(d.id.name);
+        }
+      }
+      if (responseVarNames.length === 0) return;
+      for (const responseVarName of responseVarNames) {
+        for (const d of declarators) {
+          const init = unwrapAwait(d.init);
+          if (init?.type === "CallExpression" && init.callee?.type === "MemberExpression" && init.callee.property?.type === "Identifier" && init.callee.property.name === "json" && init.callee.object?.type === "Identifier" && init.callee.object.name === responseVarName && d.id?.type === "Identifier") {
+            analyzeDataVar(fnNode, d.id.name, d);
+          }
+        }
+      }
+    }
+    function analyzeDataVar(fnNode, dataVarName, dataDeclaratorNode) {
+      function isSignedUrlMember(n) {
+        if (n?.type !== "MemberExpression") return false;
+        if (n.object?.type !== "Identifier" || n.object.name !== dataVarName) return false;
+        if (!n.computed) return n.property?.type === "Identifier" && n.property.name === "signed_url";
+        return n.property?.type === "Literal" && n.property.value === "signed_url";
+      }
+      function isNullishLiteral(n) {
+        return n?.type === "Identifier" && n.name === "undefined" || n?.type === "Literal" && n.value === null;
+      }
+      function isFalsyGuardOnSignedUrl(test) {
+        if (!test) return false;
+        if (test.type === "UnaryExpression" && test.operator === "!") {
+          return isSignedUrlMember(test.argument);
+        }
+        if (test.type === "BinaryExpression" && (test.operator === "==" || test.operator === "===")) {
+          return isSignedUrlMember(test.left) && isNullishLiteral(test.right) || isSignedUrlMember(test.right) && isNullishLiteral(test.left);
+        }
+        if (test.type === "LogicalExpression") {
+          return isFalsyGuardOnSignedUrl(test.left) || isFalsyGuardOnSignedUrl(test.right);
+        }
+        return false;
+      }
+      let guardPos = null;
+      let usagePos = null;
+      function walk3(n, depth = 0) {
+        if (!n || typeof n !== "object" || depth > 40) return;
+        if (Array.isArray(n)) {
+          for (const item of n) walk3(item, depth + 1);
+          return;
+        }
+        if (n.type === "IfStatement" && isFalsyGuardOnSignedUrl(n.test)) {
+          const p = posOf(n);
+          if (guardPos === null || p < guardPos) guardPos = p;
+        }
+        if (isSignedUrlMember(n) && n !== dataDeclaratorNode) {
+          const p = posOf(n);
+          if (usagePos === null || p < usagePos) usagePos = p;
+        }
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range") continue;
+          const val = n[key];
+          if (val && typeof val === "object") walk3(val, depth + 1);
+        }
+      }
+      walk3(fnNode.body);
+      if (usagePos === null) return;
+      if (guardPos !== null && guardPos < usagePos) return;
+      context.report({ node: dataDeclaratorNode, messageId: "missingValidation" });
+    }
+    return {
+      FunctionDeclaration(node) {
+        analyzeFunction(node);
+      },
+      FunctionExpression(node) {
+        analyzeFunction(node);
+      },
+      ArrowFunctionExpression(node) {
+        analyzeFunction(node);
+      }
+    };
+  }
+};
+var elevenlabsValidateSignedUrlResponseRule = rule83;
+
+// src/providers/elevenlabs/rules/no-error-object-logging.ts
+var LOGGING_METHODS = /* @__PURE__ */ new Set(["error", "warn", "log"]);
+var rule84 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Catch blocks must not log the raw caught error object",
+      category: "security",
+      cwe: "CWE-532",
+      rationale: "Error objects thrown by fetch/SDK calls can carry response bodies, headers, or internal state. Logging them directly with console.error(error) writes that data verbatim into server logs, which may be shipped to third-party log aggregators or be readable by anyone with log access.",
+      docsUrl: "https://elevenlabs.io/docs/api-reference/authentication",
+      recommended: true
+    },
+    messages: {
+      rawErrorLogged: "This catch block logs the raw error object instead of a sanitized message \u2014 error responses, headers, or internal state may leak into server logs."
+    }
+  },
+  create(context) {
+    function isConsoleLogCall(node) {
+      if (node?.type !== "CallExpression") return false;
+      const callee = node.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      if (callee.object?.type !== "Identifier" || callee.object.name !== "console") return false;
+      return callee.property?.type === "Identifier" && LOGGING_METHODS.has(callee.property.name);
+    }
+    function referencesRawIdentifier(node, paramName, depth = 0) {
+      if (!node || typeof node !== "object" || depth > 10) return false;
+      if (Array.isArray(node)) return node.some((n) => referencesRawIdentifier(n, paramName, depth + 1));
+      if (node.type === "Identifier" && node.name === paramName) return true;
+      if (node.type === "ObjectExpression") {
+        return (node.properties ?? []).some((p) => {
+          if (p.type !== "Property") return false;
+          return referencesRawIdentifier(p.value, paramName, depth + 1);
+        });
+      }
+      if (node.type === "ArrayExpression") {
+        return (node.elements ?? []).some((el) => referencesRawIdentifier(el, paramName, depth + 1));
+      }
+      return false;
+    }
+    return {
+      TryStatement(node) {
+        if (!findElevenLabsFetchCall(node.block)) return;
+        const handler = node.handler;
+        const paramName = handler?.param?.type === "Identifier" ? handler.param.name : null;
+        if (!paramName) return;
+        function walk3(n, depth = 0) {
+          if (!n || typeof n !== "object" || depth > 30) return;
+          if (Array.isArray(n)) {
+            for (const item of n) walk3(item, depth + 1);
+            return;
+          }
+          if (isConsoleLogCall(n)) {
+            const args = n.arguments ?? [];
+            const loggedRaw = args.some((a) => referencesRawIdentifier(a, paramName));
+            if (loggedRaw) {
+              context.report({ node: n, messageId: "rawErrorLogged" });
+            }
+          }
+          for (const key of Object.keys(n)) {
+            if (key === "parent" || key === "loc" || key === "range") continue;
+            const val = n[key];
+            if (val && typeof val === "object") walk3(val, depth + 1);
+          }
+        }
+        walk3(handler.body);
+      }
+    };
+  }
+};
+var elevenlabsNoErrorObjectLoggingRule = rule84;
+
+// src/providers/elevenlabs/rules/fetch-timeout-required.ts
+var rule85 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Fetch calls to the ElevenLabs API must set an abort timeout",
+      category: "reliability",
+      rationale: "Native fetch has no default timeout. If the ElevenLabs API becomes slow or hangs, a request with no AbortController/signal will wait indefinitely, tying up the request handler and starving the server of available connections.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/api-reference/conversations/get-signed-url",
+      recommended: true
+    },
+    messages: {
+      missingTimeout: "This fetch call to the ElevenLabs API has no abort signal/timeout \u2014 a slow or unresponsive API will hang the request indefinitely."
+    }
+  },
+  create(context) {
+    function hasSignalOption(optionsArg) {
+      if (optionsArg?.type !== "ObjectExpression") return false;
+      return (optionsArg.properties ?? []).some((p) => {
+        if (p.type === "SpreadElement") return true;
+        return p.type === "Property" && p.key?.type === "Identifier" && p.key.name === "signal";
+      });
+    }
+    return {
+      CallExpression(node) {
+        if (node.callee?.type !== "Identifier" || node.callee.name !== "fetch") return;
+        if (!isElevenLabsUrlArg(node.arguments?.[0])) return;
+        const optionsArg = node.arguments?.[1];
+        if (hasSignalOption(optionsArg)) return;
+        context.report({ node, messageId: "missingTimeout" });
+      }
+    };
+  }
+};
+var elevenlabsFetchTimeoutRequiredRule = rule85;
+
+// src/providers/elevenlabs/rules/validate-agent-id-format.ts
+var rule86 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "agentId must be format-validated, not just checked for existence, before use",
+      category: "correctness",
+      cwe: "CWE-20",
+      rationale: "A query-param agentId that is only checked with `if (!agentId)` accepts any non-empty string. An attacker can pass arbitrary values \u2014 oversized strings, path-traversal-like sequences, or characters the ElevenLabs API was never designed to receive \u2014 directly into the request URL, producing undefined behavior instead of a clean 400.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/customization/authentication",
+      recommended: true
+    },
+    messages: {
+      missingFormatValidation: "agentId is checked for existence but never validated against an expected format before being used in an ElevenLabs API request."
+    }
+  },
+  create(context) {
+    function isSearchParamsGetAgentId(node) {
+      if (node?.type !== "CallExpression") return false;
+      const callee = node.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      if (callee.property?.type !== "Identifier" || callee.property.name !== "get") return false;
+      const arg = node.arguments?.[0];
+      return arg?.type === "Literal" && arg.value === "agentId";
+    }
+    function analyzeFunction(fnNode) {
+      const declarators = [];
+      collectVarDeclarators(fnNode.body, declarators);
+      let agentIdVarName = null;
+      let agentIdDeclaratorNode = null;
+      for (const d of declarators) {
+        const init = unwrapAwait(d.init);
+        if (isSearchParamsGetAgentId(init) && d.id?.type === "Identifier") {
+          agentIdVarName = d.id.name;
+          agentIdDeclaratorNode = d;
+        }
+      }
+      if (!agentIdVarName) {
+        for (const param of fnNode.params ?? []) {
+          if (param?.type === "Identifier" && param.name === "agentId") {
+            agentIdVarName = param.name;
+            agentIdDeclaratorNode = param;
+          }
+        }
+      }
+      if (!agentIdVarName) return;
+      function isAgentIdMember(n) {
+        return n?.type === "Identifier" && n.name === agentIdVarName;
+      }
+      function isFormatCheck(n, depth = 0) {
+        if (!n || typeof n !== "object" || depth > 10) return false;
+        if (Array.isArray(n)) return n.some((x) => isFormatCheck(x, depth + 1));
+        if (n.type === "CallExpression" && n.callee?.type === "MemberExpression") {
+          const propName2 = n.callee.property?.type === "Identifier" ? n.callee.property.name : null;
+          if (propName2 === "test" && isAgentIdMember(n.arguments?.[0])) return true;
+          if ((propName2 === "match" || propName2 === "matchAll") && isAgentIdMember(n.callee.object)) return true;
+        }
+        if (n.type === "LogicalExpression") {
+          return isFormatCheck(n.left, depth + 1) || isFormatCheck(n.right, depth + 1);
+        }
+        if (n.type === "UnaryExpression") return isFormatCheck(n.argument, depth + 1);
+        return false;
+      }
+      let formatGuardPos = null;
+      let usagePos = null;
+      function walk3(n, depth = 0) {
+        if (!n || typeof n !== "object" || depth > 40) return;
+        if (Array.isArray(n)) {
+          for (const item of n) walk3(item, depth + 1);
+          return;
+        }
+        if (n.type === "IfStatement" && isFormatCheck(n.test)) {
+          const p = posOf(n);
+          if (formatGuardPos === null || p < formatGuardPos) formatGuardPos = p;
+        }
+        if (n.type === "CallExpression" && n.callee?.type === "Identifier" && n.callee.name === "fetch" && isElevenLabsUrlArg(n.arguments?.[0])) {
+          const urlArg = n.arguments[0];
+          const containsAgentId = urlArg.type === "TemplateLiteral" && (urlArg.expressions ?? []).some((e) => isAgentIdMember(e));
+          if (containsAgentId) {
+            const p = posOf(n);
+            if (usagePos === null || p < usagePos) usagePos = p;
+          }
+        }
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range") continue;
+          const val = n[key];
+          if (val && typeof val === "object") walk3(val, depth + 1);
+        }
+      }
+      walk3(fnNode.body);
+      if (usagePos === null) return;
+      if (formatGuardPos !== null && formatGuardPos < usagePos) return;
+      context.report({ node: agentIdDeclaratorNode, messageId: "missingFormatValidation" });
+    }
+    return {
+      FunctionDeclaration(node) {
+        analyzeFunction(node);
+      },
+      FunctionExpression(node) {
+        analyzeFunction(node);
+      },
+      ArrowFunctionExpression(node) {
+        analyzeFunction(node);
+      }
+    };
+  }
+};
+var elevenlabsValidateAgentIdFormatRule = rule86;
+
+// src/providers/elevenlabs/rules/secure-session-id-generation.ts
+var rule87 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Session ids must be generated with a cryptographically secure RNG",
+      category: "security",
+      cwe: "CWE-338",
+      rationale: 'Math.random() is a non-cryptographic PRNG \u2014 its output can be predicted by an attacker who observes enough samples or knows the engine implementation. If a "session_*" value derived from it is later trusted for routing, deduplication, or any access-control-adjacent decision, that predictability can be exploited.',
+      docsUrl: "https://elevenlabs.io/docs/eleven-api/guides/how-to/best-practices/security",
+      recommended: true
+    },
+    messages: {
+      insecureSessionId: "This session id is generated with Math.random(), which is not cryptographically secure and can be predicted. Use crypto.getRandomValues() instead."
+    }
+  },
+  create(context) {
+    function containsMathRandomCall(node, depth = 0) {
+      if (!node || typeof node !== "object" || depth > 20) return false;
+      if (Array.isArray(node)) return node.some((n) => containsMathRandomCall(n, depth + 1));
+      if (node.type === "CallExpression" && node.callee?.type === "MemberExpression" && node.callee.object?.type === "Identifier" && node.callee.object.name === "Math" && node.callee.property?.type === "Identifier" && node.callee.property.name === "random") {
+        return true;
+      }
+      for (const key of Object.keys(node)) {
+        if (key === "parent" || key === "loc" || key === "range") continue;
+        const val = node[key];
+        if (val && typeof val === "object" && containsMathRandomCall(val, depth + 1)) return true;
+      }
+      return false;
+    }
+    function looksLikeSessionId(name) {
+      return typeof name === "string" && /session/i.test(name);
+    }
+    function isSessionIdValue(init) {
+      if (init?.type === "TemplateLiteral") {
+        const firstQuasi = init.quasis?.[0]?.value?.raw ?? "";
+        if (/session[-_]?/i.test(firstQuasi) && containsMathRandomCall(init)) return true;
+      }
+      if (init?.type === "BinaryExpression" && init.operator === "+") {
+        const leftLiteral = init.left?.type === "Literal" && typeof init.left.value === "string";
+        if (leftLiteral && /session[-_]?/i.test(init.left.value) && containsMathRandomCall(init)) return true;
+      }
+      return false;
+    }
+    return {
+      VariableDeclarator(node) {
+        const init = node.init;
+        if (!init) return;
+        const declaredName = node.id?.type === "Identifier" ? node.id.name : node.id?.type === "ArrayPattern" && node.id.elements?.[0]?.type === "Identifier" ? node.id.elements[0].name : void 0;
+        let valueNode = init;
+        if (init.type === "CallExpression" && init.callee?.type === "Identifier" && init.callee.name === "useState" && init.arguments?.[0]?.type === "ArrowFunctionExpression") {
+          const body = init.arguments[0].body;
+          valueNode = body?.type === "BlockStatement" ? null : body;
+          if (body?.type === "BlockStatement") {
+            const returnStmt = (body.body ?? []).find((s) => s.type === "ReturnStatement");
+            valueNode = returnStmt?.argument ?? null;
+          }
+        }
+        if (!valueNode) return;
+        if (!looksLikeSessionId(declaredName) && !isSessionIdValue(valueNode)) return;
+        if (!containsMathRandomCall(valueNode)) return;
+        context.report({ node, messageId: "insecureSessionId" });
+      }
+    };
+  }
+};
+var elevenlabsSecureSessionIdGenerationRule = rule87;
+
+// src/providers/elevenlabs/rules/conversation-error-recovery.ts
+var rule88 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "A loading flag set before starting a conversation must be reset on failure",
+      category: "reliability",
+      rationale: 'If startConversation() sets isLoading true and getSignedUrl()/Conversation.startSession() throws, the loading flag must be reset in the catch or finally block. Otherwise the UI is stuck "loading" forever and the user can trigger overlapping conversation attempts by clicking again.',
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/libraries/java-script",
+      recommended: true
+    },
+    messages: {
+      missingLoadingReset: "This function sets a loading flag true before a try block, but neither the catch nor a finally block resets it to false on failure."
+    }
+  },
+  create(context) {
+    function isSetterCallWithBoolean(n, setterName, expected) {
+      if (n?.type !== "CallExpression") return false;
+      if (n.callee?.type !== "Identifier" || n.callee.name !== setterName) return false;
+      const arg = n.arguments?.[0];
+      return arg?.type === "Literal" && arg.value === expected;
+    }
+    function containsCall(node, predicate, depth = 0) {
+      if (!node || typeof node !== "object" || depth > 20) return false;
+      if (Array.isArray(node)) return node.some((n) => containsCall(n, predicate, depth + 1));
+      if (predicate(node)) return true;
+      for (const key of Object.keys(node)) {
+        if (key === "parent" || key === "loc" || key === "range") continue;
+        const val = node[key];
+        if (val && typeof val === "object" && containsCall(val, predicate, depth + 1)) return true;
+      }
+      return false;
+    }
+    function findLoadingSetterFromUseState(fnNode) {
+      let setterName = null;
+      function collect(n, depth = 0) {
+        if (setterName || !n || typeof n !== "object" || depth > 20) return;
+        if (Array.isArray(n)) {
+          for (const item of n) collect(item, depth + 1);
+          return;
+        }
+        if (n.type === "VariableDeclarator" && n.id?.type === "ArrayPattern" && n.id.elements?.length === 2 && n.id.elements[0]?.type === "Identifier" && /loading/i.test(n.id.elements[0].name) && n.id.elements[1]?.type === "Identifier" && n.init?.type === "CallExpression" && n.init.callee?.type === "Identifier" && n.init.callee.name === "useState") {
+          setterName = n.id.elements[1].name;
+          return;
+        }
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range") continue;
+          const val = n[key];
+          if (val && typeof val === "object") collect(val, depth + 1);
+        }
+      }
+      collect(fnNode);
+      return setterName;
+    }
+    function isLoadingTrueStatement(stmt, setterName) {
+      return stmt?.type === "ExpressionStatement" && isSetterCallWithBoolean(stmt.expression, setterName, true);
+    }
+    function analyzeFunction(fnNode) {
+      const setterName = findLoadingSetterFromUseState(fnNode);
+      if (!setterName) return;
+      function walk3(n, depth = 0) {
+        if (!n || typeof n !== "object" || depth > 30) return;
+        if (Array.isArray(n)) {
+          for (const item of n) walk3(item, depth + 1);
+          return;
+        }
+        if (n.type === "BlockStatement" && Array.isArray(n.body)) {
+          for (let i = 0; i < n.body.length - 1; i++) {
+            if (!isLoadingTrueStatement(n.body[i], setterName)) continue;
+            const tryNode = n.body[i + 1];
+            if (tryNode?.type !== "TryStatement") continue;
+            const handler = tryNode.handler;
+            const finalizer = tryNode.finalizer;
+            const finallyResets = finalizer && containsCall(finalizer, (x) => isSetterCallWithBoolean(x, setterName, false));
+            const catchResets = handler && containsCall(handler.body, (x) => isSetterCallWithBoolean(x, setterName, false));
+            if (!finallyResets && !catchResets) {
+              context.report({ node: tryNode, messageId: "missingLoadingReset" });
+            }
+          }
+        }
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range") continue;
+          const val = n[key];
+          if (val && typeof val === "object") walk3(val, depth + 1);
+        }
+      }
+      walk3(fnNode.body);
+    }
+    return {
+      FunctionDeclaration(node) {
+        analyzeFunction(node);
+      },
+      FunctionExpression(node) {
+        analyzeFunction(node);
+      },
+      ArrowFunctionExpression(node) {
+        analyzeFunction(node);
+      }
+    };
+  }
+};
+var elevenlabsConversationErrorRecoveryRule = rule88;
+
+// src/providers/elevenlabs/rules/api-version-pinning.ts
+var rule89 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "ElevenLabs API requests should pin an explicit API version header",
+      category: "reliability",
+      rationale: "The endpoint is hardcoded to /v1 in the URL path with no explicit version header. If ElevenLabs ships a v2 API and changes default response behavior for unversioned clients, requests with no version header silently pick up the new behavior instead of failing loudly or staying pinned.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-api/resources/breaking-changes-policy",
+      recommended: true
+    },
+    messages: {
+      missingVersionHeader: "This fetch call to the ElevenLabs API has no explicit API version header \u2014 a future API change could silently alter behavior."
+    }
+  },
+  create(context) {
+    function hasVersionHeader(optionsArg) {
+      if (optionsArg?.type !== "ObjectExpression") return false;
+      const headersProp = (optionsArg.properties ?? []).find(
+        (p) => p.type === "Property" && p.key?.type === "Identifier" && p.key.name === "headers"
+      );
+      if (!headersProp) return false;
+      if (headersProp.value?.type !== "ObjectExpression") return true;
+      return (headersProp.value.properties ?? []).some((p) => {
+        if (p.type === "SpreadElement") return true;
+        if (p.type !== "Property") return false;
+        const keyName = p.key?.type === "Identifier" ? p.key.name : p.key?.type === "Literal" ? p.key.value : null;
+        return typeof keyName === "string" && /version/i.test(keyName);
+      });
+    }
+    return {
+      CallExpression(node) {
+        if (node.callee?.type !== "Identifier" || node.callee.name !== "fetch") return;
+        if (!isElevenLabsUrlArg(node.arguments?.[0])) return;
+        const optionsArg = node.arguments?.[1];
+        if (hasVersionHeader(optionsArg)) return;
+        context.report({ node, messageId: "missingVersionHeader" });
+      }
+    };
+  }
+};
+var elevenlabsApiVersionPinningRule = rule89;
+
+// src/providers/elevenlabs/rules/check-http-status-before-json.ts
+var rule90 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "response.json() must not be called before checking the HTTP status of an ElevenLabs response",
+      category: "correctness",
+      rationale: "Calling response.json() unconditionally parses whatever body the server returned, including error payloads, as if it were a successful response. Without checking response.ok (or response.status) first, a 4xx/5xx error from the ElevenLabs API is silently treated as valid data.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-api/resources/errors",
+      recommended: true
+    },
+    messages: {
+      missingStatusCheck: "response.json() is called on this ElevenLabs API response without first checking response.ok/status \u2014 an error response will be parsed as if it were valid data."
+    }
+  },
+  create(context) {
+    function analyzeFunction(fnNode) {
+      const declarators = [];
+      collectVarDeclarators(fnNode.body, declarators);
+      const responseVarNames = [];
+      for (const d of declarators) {
+        const init = unwrapAwait(d.init);
+        if (init?.type === "CallExpression" && init.callee?.type === "Identifier" && init.callee.name === "fetch" && isElevenLabsUrlArg(init.arguments?.[0]) && d.id?.type === "Identifier") {
+          responseVarNames.push(d.id.name);
+        }
+      }
+      for (const responseVarName of responseVarNames) {
+        analyzeResponseVar(fnNode, responseVarName);
+      }
+    }
+    function analyzeResponseVar(fnNode, responseVarName) {
+      function isResponseStatusCheck(test) {
+        if (!test) return false;
+        if (test.type === "UnaryExpression" && test.operator === "!") return isResponseStatusCheck(test.argument);
+        if (test.type === "MemberExpression" && test.object?.type === "Identifier" && test.object.name === responseVarName && test.property?.type === "Identifier" && test.property.name === "ok") {
+          return true;
+        }
+        if (test.type === "BinaryExpression") {
+          const sideIsStatus = (n) => n?.type === "MemberExpression" && n.object?.type === "Identifier" && n.object.name === responseVarName && n.property?.type === "Identifier" && n.property.name === "status";
+          if (sideIsStatus(test.left) || sideIsStatus(test.right)) return true;
+        }
+        if (test.type === "LogicalExpression") {
+          return isResponseStatusCheck(test.left) || isResponseStatusCheck(test.right);
+        }
+        return false;
+      }
+      function isResponseJsonCall2(n) {
+        if (n?.type !== "CallExpression") return false;
+        const callee = n.callee;
+        if (callee?.type !== "MemberExpression") return false;
+        if (callee.property?.type !== "Identifier" || callee.property.name !== "json") return false;
+        return callee.object?.type === "Identifier" && callee.object.name === responseVarName;
+      }
+      let guardPos = null;
+      let jsonCallNode = null;
+      let jsonCallPos = null;
+      function walk3(n, depth = 0) {
+        if (!n || typeof n !== "object" || depth > 40) return;
+        if (Array.isArray(n)) {
+          for (const item of n) walk3(item, depth + 1);
+          return;
+        }
+        if (n.type === "IfStatement" && isResponseStatusCheck(n.test)) {
+          const p = posOf(n);
+          if (guardPos === null || p < guardPos) guardPos = p;
+        }
+        if (isResponseJsonCall2(n)) {
+          const p = posOf(n);
+          if (jsonCallPos === null || p < jsonCallPos) {
+            jsonCallPos = p;
+            jsonCallNode = n;
+          }
+        }
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range") continue;
+          const val = n[key];
+          if (val && typeof val === "object") walk3(val, depth + 1);
+        }
+      }
+      walk3(fnNode.body);
+      if (jsonCallPos === null) return;
+      if (guardPos !== null && guardPos < jsonCallPos) return;
+      context.report({ node: jsonCallNode, messageId: "missingStatusCheck" });
+    }
+    return {
+      FunctionDeclaration(node) {
+        analyzeFunction(node);
+      },
+      FunctionExpression(node) {
+        analyzeFunction(node);
+      },
+      ArrowFunctionExpression(node) {
+        analyzeFunction(node);
+      }
+    };
+  }
+};
+var elevenlabsCheckHttpStatusBeforeJsonRule = rule90;
+
+// src/providers/elevenlabs/rules/conversation-cleanup-on-error.ts
+var END_METHODS = /* @__PURE__ */ new Set(["endSession", "endConversation"]);
+var rule91 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Ending a conversation must be wrapped in try/catch so a rejected call is handled",
+      category: "reliability",
+      rationale: "If conversation.endSession()/endConversation() rejects (e.g. during a GL-mode transition) and the call site has no try/catch, the rejection becomes an unhandled promise rejection and the conversation state is never cleaned up, leaving stale connections in memory.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/libraries/java-script",
+      recommended: true
+    },
+    messages: {
+      missingTryCatch: "This call to end the conversation has no surrounding try/catch \u2014 a rejection will go unhandled and the conversation state may never be cleaned up."
+    }
+  },
+  create(context) {
+    function posEnd(n) {
+      if (typeof n?.range?.[1] === "number") return n.range[1];
+      const line = n?.loc?.end?.line ?? n?.loc?.start?.line ?? 0;
+      const column = n?.loc?.end?.column ?? n?.loc?.start?.column ?? 0;
+      return line * 1e6 + column;
+    }
+    function isConversationEndCall(node) {
+      if (node?.type !== "CallExpression") return false;
+      const callee = node.callee;
+      if (callee?.type === "MemberExpression") {
+        return callee.property?.type === "Identifier" && END_METHODS.has(callee.property.name);
+      }
+      return callee?.type === "Identifier" && END_METHODS.has(callee.name);
+    }
+    return {
+      "Program:exit"(program2) {
+        const tryRanges = [];
+        const endCalls = [];
+        function walk3(n, depth = 0) {
+          if (!n || typeof n !== "object" || depth > 60) return;
+          if (Array.isArray(n)) {
+            for (const item of n) walk3(item, depth + 1);
+            return;
+          }
+          if (n.type === "TryStatement" && n.block) {
+            tryRanges.push([posOf(n.block), posEnd(n.block)]);
+          }
+          if (isConversationEndCall(n)) endCalls.push(n);
+          for (const key of Object.keys(n)) {
+            if (key === "parent" || key === "loc" || key === "range") continue;
+            const val = n[key];
+            if (val && typeof val === "object") walk3(val, depth + 1);
+          }
+        }
+        walk3(program2);
+        for (const call of endCalls) {
+          const p = posOf(call);
+          const covered = tryRanges.some(([start, end]) => p >= start && p <= end);
+          if (!covered) {
+            context.report({ node: call, messageId: "missingTryCatch" });
+          }
+        }
+      }
+    };
+  }
+};
+var elevenlabsConversationCleanupOnErrorRule = rule91;
+
+// src/providers/elevenlabs/rules/env-var-validation.ts
+var ELEVENLABS_ENV_VAR_PATTERN = /^(XI_API_KEY|ELEVENLABS_API_KEY)$/;
+var rule92 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "ElevenLabs API key environment variables should be validated at module load, not only at request time",
+      category: "correctness",
+      rationale: "Checking `if (!apiKey)` inside a request handler means a misconfigured deployment only fails the first time a user exercises the feature, instead of failing fast at startup where it would show up in deploy logs or a health check.",
+      docsUrl: "https://elevenlabs.io/docs/api-reference/authentication",
+      recommended: true
+    },
+    messages: {
+      missingStartupValidation: "This module reads an ElevenLabs API key from process.env but only validates it inside a request handler \u2014 validate it at module scope so a missing key fails at startup, not at first use."
+    }
+  },
+  create(context) {
+    function isElevenLabsEnvAccess(node) {
+      if (node?.type !== "MemberExpression") return false;
+      if (node.object?.type !== "MemberExpression") return false;
+      const inner = node.object;
+      if (inner.object?.type !== "Identifier" || inner.object.name !== "process") return false;
+      if (inner.property?.type !== "Identifier" || inner.property.name !== "env") return false;
+      const propName2 = node.property?.type === "Identifier" ? node.property.name : node.property?.value;
+      return typeof propName2 === "string" && ELEVENLABS_ENV_VAR_PATTERN.test(propName2);
+    }
+    function isInsideFunction(node, ancestors) {
+      return ancestors.some(
+        (a) => a?.type === "FunctionDeclaration" || a?.type === "FunctionExpression" || a?.type === "ArrowFunctionExpression"
+      );
+    }
+    return {
+      "Program:exit"(program2) {
+        let moduleScopeAccess = false;
+        let handlerScopeAccess = false;
+        function walk3(n, ancestors, depth = 0) {
+          if (!n || typeof n !== "object" || depth > 60) return;
+          if (Array.isArray(n)) {
+            for (const item of n) walk3(item, ancestors, depth + 1);
+            return;
+          }
+          if (isElevenLabsEnvAccess(n)) {
+            if (isInsideFunction(n, ancestors)) {
+              handlerScopeAccess = true;
+            } else {
+              moduleScopeAccess = true;
+            }
+          }
+          const nextAncestors = n.type === "FunctionDeclaration" || n.type === "FunctionExpression" || n.type === "ArrowFunctionExpression" ? [...ancestors, n] : ancestors;
+          for (const key of Object.keys(n)) {
+            if (key === "parent" || key === "loc" || key === "range") continue;
+            const val = n[key];
+            if (val && typeof val === "object") walk3(val, nextAncestors, depth + 1);
+          }
+        }
+        walk3(program2, []);
+        if (handlerScopeAccess && !moduleScopeAccess) {
+          context.report({ node: program2, messageId: "missingStartupValidation" });
+        }
+      }
+    };
+  }
+};
+var elevenlabsEnvVarValidationRule = rule92;
+
+// src/providers/twilio/utils.ts
+var POST_METHOD_NAMES = /* @__PURE__ */ new Set(["post"]);
+var ROUTER_OBJECT_NAMES = /* @__PURE__ */ new Set(["server", "app", "router", "fastify"]);
+function isPostRouteRegistration(node) {
+  if (node?.type !== "CallExpression") return false;
+  const callee = node.callee;
+  if (callee?.type !== "MemberExpression") return false;
+  if (callee.property?.type !== "Identifier" || !POST_METHOD_NAMES.has(callee.property.name)) return false;
+  return callee.object?.type === "Identifier" && ROUTER_OBJECT_NAMES.has(callee.object.name);
+}
+function findInSubtree(node, predicate, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 40) return null;
+  if (Array.isArray(node)) {
+    for (const n of node) {
+      const found = findInSubtree(n, predicate, depth + 1);
+      if (found) return found;
+    }
+    return null;
+  }
+  if (predicate(node)) return node;
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object") {
+      const found = findInSubtree(val, predicate, depth + 1);
+      if (found) return found;
+    }
+  }
+  return null;
+}
+function referencesRequestBody(node) {
+  return !!findInSubtree(node, (n) => {
+    if (n?.type !== "MemberExpression") return false;
+    if (n.property?.type !== "Identifier" || n.property.name !== "body") return false;
+    return n.object?.type === "Identifier" && (n.object.name === "req" || n.object.name === "request");
+  });
+}
+function collectVarDeclarators2(node, out, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 24) return;
+  if (Array.isArray(node)) {
+    for (const n of node) collectVarDeclarators2(n, out, depth + 1);
+    return;
+  }
+  if (node.type === "VariableDeclarator") out.push(node);
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object") collectVarDeclarators2(val, out, depth + 1);
+  }
+}
+
+// src/providers/twilio/rules/validate-webhook-signature.ts
+var rule93 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Twilio webhook routes must validate the X-Twilio-Signature header before trusting the body",
+      category: "security",
+      cwe: "CWE-345",
+      owasp: "A07:2021 Identification and Authentication Failures",
+      rationale: "Webhook URLs are public. Anyone who learns or guesses the path can POST a forged body \u2014 fake CallSid/From/TaskAttributes values \u2014 and the handler has no way to tell it apart from a real Twilio request. Without validating the signature first, an attacker can trigger outbound calls (toll/billing impact) or falsely invoke reservation/task callbacks to manipulate call state for an arbitrary caller.",
+      docsUrl: "https://www.twilio.com/docs/usage/webhooks/webhooks-security",
+      recommended: true
+    },
+    messages: {
+      missingSignatureValidation: "This POST webhook route reads req.body but the file never validates the X-Twilio-Signature header via twilio.validateRequest()/RequestValidator \u2014 a forged request body is indistinguishable from a real Twilio callback."
+    }
+  },
+  create(context) {
+    function isValidateRequestCall(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      return callee.property?.type === "Identifier" && callee.property.name === "validateRequest";
+    }
+    function isRequestValidatorConstruction(n) {
+      return n?.type === "NewExpression" && n.callee?.type === "Identifier" && n.callee.name === "RequestValidator";
+    }
+    return {
+      "Program:exit"(program2) {
+        const hasValidation = !!findInSubtree(program2, isValidateRequestCall) || !!findInSubtree(program2, isRequestValidatorConstruction);
+        if (hasValidation) return;
+        const postRoutes = [];
+        findInSubtree(program2, (n) => {
+          if (isPostRouteRegistration(n) && referencesRequestBody(n)) postRoutes.push(n);
+          return false;
+        });
+        for (const route of postRoutes) {
+          context.report({ node: route, messageId: "missingSignatureValidation" });
+        }
+      }
+    };
+  }
+};
+var twilioValidateWebhookSignatureRule = rule93;
+
+// src/providers/twilio/rules/taskrouter-attributes-match-consumer.ts
+var rule94 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "TaskRouter Task attributes must include every field the reservation handler reads back out",
+      category: "correctness",
+      rationale: "A Task is created with attributes like `{ name, type }`, and later a reservation-accepted handler does `const { from } = JSON.parse(req.body.TaskAttributes)` to look up state by `from`. If the producer never set `from` on the Task attributes, that destructure is always `undefined`, the lookup always misses, and the handler returns 404 \u2014 even though every other part of the flow worked correctly.",
+      docsUrl: "https://www.twilio.com/docs/taskrouter/twiml-queue-calls",
+      recommended: true
+    },
+    messages: {
+      attributeMismatch: 'This .task() attributes object does not set "{{field}}", but a reservation handler in this codebase destructures "{{field}}" from JSON.parse(TaskAttributes) \u2014 that lookup will always be undefined.'
+    }
+  },
+  create(context) {
+    function isTaskCall(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      return callee.property?.type === "Identifier" && callee.property.name === "task";
+    }
+    function extractAttributeKeys(taskCallNode) {
+      const arg = taskCallNode.arguments?.[0];
+      if (!arg) return null;
+      if (arg.type === "CallExpression" && arg.callee?.type === "MemberExpression" && arg.callee.object?.type === "Identifier" && arg.callee.object.name === "JSON" && arg.callee.property?.type === "Identifier" && arg.callee.property.name === "stringify" && arg.arguments?.[0]?.type === "ObjectExpression") {
+        return objectKeys(arg.arguments[0]);
+      }
+      if (arg.type === "TemplateLiteral") {
+        const raw = arg.quasis.map((q) => q.value?.raw ?? "").join("");
+        const keys = /* @__PURE__ */ new Set();
+        for (const m of raw.matchAll(/"([a-zA-Z0-9_]+)"\s*:/g)) keys.add(m[1]);
+        return keys;
+      }
+      if (arg.type === "Literal" && typeof arg.value === "string") {
+        const keys = /* @__PURE__ */ new Set();
+        for (const m of arg.value.matchAll(/"([a-zA-Z0-9_]+)"\s*:/g)) keys.add(m[1]);
+        return keys;
+      }
+      return null;
+    }
+    function objectKeys(objExpr) {
+      const keys = /* @__PURE__ */ new Set();
+      for (const p of objExpr.properties ?? []) {
+        if (p.type !== "Property") continue;
+        const name = p.key?.type === "Identifier" ? p.key.name : p.key?.type === "Literal" ? p.key.value : null;
+        if (typeof name === "string") keys.add(name);
+      }
+      return keys;
+    }
+    function isTaskAttributesJsonParse(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      if (callee.object?.type !== "Identifier" || callee.object.name !== "JSON") return false;
+      if (callee.property?.type !== "Identifier" || callee.property.name !== "parse") return false;
+      const arg = n.arguments?.[0];
+      if (arg?.type !== "MemberExpression") return false;
+      return arg.property?.type === "Identifier" && arg.property.name === "TaskAttributes";
+    }
+    function findConsumedFields(program2) {
+      const fields = /* @__PURE__ */ new Set();
+      const declarators = [];
+      collectVarDeclarators2(program2, declarators);
+      for (const d of declarators) {
+        if (!isTaskAttributesJsonParse(d.init)) continue;
+        if (d.id?.type === "ObjectPattern") {
+          for (const p of d.id.properties ?? []) {
+            if (p.type !== "Property") continue;
+            const name = p.key?.type === "Identifier" ? p.key.name : null;
+            if (name) fields.add(name);
+          }
+        }
+      }
+      return fields;
+    }
+    return {
+      "Program:exit"(program2) {
+        const consumedFields = findConsumedFields(program2);
+        if (consumedFields.size === 0) return;
+        const taskCalls = [];
+        findInSubtree(program2, (n) => {
+          if (isTaskCall(n)) taskCalls.push(n);
+          return false;
+        });
+        for (const taskCall of taskCalls) {
+          const producedKeys = extractAttributeKeys(taskCall);
+          if (!producedKeys) continue;
+          for (const field of consumedFields) {
+            if (!producedKeys.has(field)) {
+              context.report({ node: taskCall, messageId: "attributeMismatch", data: { field } });
+            }
+          }
+        }
+      }
+    };
+  }
+};
+var twilioTaskrouterAttributesMatchConsumerRule = rule94;
+
+// src/providers/twilio/rules/enqueue-task-json-stringify.ts
+var rule95 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "TaskRouter .task() attributes must be built with JSON.stringify(), not raw string interpolation",
+      category: "security",
+      cwe: "CWE-116",
+      owasp: "CWE-91 XML/JSON Injection",
+      rationale: 'Hand-building the Task attributes JSON by interpolating an unvalidated request field directly into a string literal breaks the moment that field contains a `"` or `\\`. The resulting body is invalid JSON, and Twilio rejects the Enqueue with error 14221 ("Provided Attributes JSON was not valid") \u2014 turning a single unexpected character in a caller-controlled field (like a name with a quote in it) into a hard failure of the call flow.',
+      docsUrl: "https://www.twilio.com/docs/api/errors/14221",
+      recommended: true
+    },
+    messages: {
+      rawJsonInterpolation: 'This .task() call builds JSON attributes via raw string interpolation instead of JSON.stringify() \u2014 a "/\\\\ character in the interpolated value produces invalid JSON and Twilio error 14221.'
+    }
+  },
+  create(context) {
+    function isTaskCall(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      return callee.property?.type === "Identifier" && callee.property.name === "task";
+    }
+    function hasInterpolatedExpression(templateLiteral) {
+      return (templateLiteral.expressions ?? []).length > 0;
+    }
+    return {
+      CallExpression(node) {
+        if (!isTaskCall(node)) return;
+        const arg = node.arguments?.[0];
+        if (!arg) return;
+        if (arg.type === "TemplateLiteral" && hasInterpolatedExpression(arg)) {
+          context.report({ node, messageId: "rawJsonInterpolation" });
+          return;
+        }
+        if (arg.type === "BinaryExpression" && arg.operator === "+") {
+          context.report({ node, messageId: "rawJsonInterpolation" });
+        }
+      }
+    };
+  }
+};
+var twilioEnqueueTaskJsonStringifyRule = rule95;
+
+// src/providers/twilio/rules/media-streams-key-by-call-sid.ts
+var rule96 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Media Streams session maps must be keyed by callSid, not phone number",
+      category: "reliability",
+      rationale: "A Map keyed on the caller's phone number breaks the moment the same number places two concurrent calls \u2014 a retry after a dropped call, two family members sharing a line, a misdial-and-redial. The second map.set() silently overwrites the first call's entry, and that first call's downstream events (reservation-accepted, outbound-leg wiring) end up pointed at the wrong session, crossing audio streams between two unrelated calls. Twilio provides a unique callSid on every start message specifically to avoid this collision.",
+      docsUrl: "https://www.twilio.com/docs/voice/media-streams/websocket-messages",
+      recommended: true
+    },
+    messages: {
+      keyedByPhoneNumber: `This Map is keyed by "{{key}}" (a phone-number-like field) instead of callSid \u2014 two concurrent calls from the same number will silently overwrite each other's entry.`
+    }
+  },
+  create(context) {
+    function isFromLikeIdentifier(n) {
+      if (n?.type === "Identifier" && n.name === "from") return "from";
+      if (n?.type === "MemberExpression" && n.property?.type === "Identifier" && n.property.name === "from" && !n.computed) {
+        return "from";
+      }
+      return null;
+    }
+    function isMapMutationCall(n, methodNames) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      return callee.property?.type === "Identifier" && methodNames.has(callee.property.name);
+    }
+    const SET_OR_GET = /* @__PURE__ */ new Set(["set", "get"]);
+    return {
+      "Program:exit"(program2) {
+        let callSidAvailable = false;
+        function scanForCallSid(n, depth = 0) {
+          if (callSidAvailable || !n || typeof n !== "object" || depth > 60) return;
+          if (Array.isArray(n)) {
+            for (const item of n) scanForCallSid(item, depth + 1);
+            return;
+          }
+          if (n.type === "Identifier" && n.name === "callSid") {
+            callSidAvailable = true;
+            return;
+          }
+          if (n.type === "MemberExpression" && !n.computed && n.property?.type === "Identifier" && n.property.name === "callSid") {
+            callSidAvailable = true;
+            return;
+          }
+          for (const key of Object.keys(n)) {
+            if (key === "parent" || key === "loc" || key === "range") continue;
+            const val = n[key];
+            if (val && typeof val === "object") scanForCallSid(val, depth + 1);
+          }
+        }
+        scanForCallSid(program2);
+        if (!callSidAvailable) return;
+        function walk3(n, depth = 0) {
+          if (!n || typeof n !== "object" || depth > 60) return;
+          if (Array.isArray(n)) {
+            for (const item of n) walk3(item, depth + 1);
+            return;
+          }
+          if (isMapMutationCall(n, SET_OR_GET)) {
+            const firstArg = n.arguments?.[0];
+            const key = isFromLikeIdentifier(firstArg);
+            if (key) context.report({ node: n, messageId: "keyedByPhoneNumber", data: { key } });
+          }
+          for (const k of Object.keys(n)) {
+            if (k === "parent" || k === "loc" || k === "range") continue;
+            const val = n[k];
+            if (val && typeof val === "object") walk3(val, depth + 1);
+          }
+        }
+        walk3(program2);
+      }
+    };
+  }
+};
+var twilioMediaStreamsKeyByCallSidRule = rule96;
+
+// src/providers/twilio/rules/await-or-catch-rest-calls-in-event-handlers.ts
+var REST_RESOURCE_METHODS = /* @__PURE__ */ new Set(["create", "update", "remove", "fetch"]);
+var EVENT_REGISTRATION_METHODS = /* @__PURE__ */ new Set(["onStart", "onStop", "onMedia", "onConnected", "on"]);
+var rule97 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Twilio REST calls inside event-handler callbacks must be wrapped in try/catch",
+      category: "reliability",
+      rationale: 'Event-emitter style callbacks (onStart, onMessage, on("message", ...)) are typically invoked via something like `callbacks.map((cb) => cb(event))`, which discards the returned promise. If the callback is `async` and calls `await twilio.calls.create(...)` with no try/catch, any Twilio REST error (invalid number, suspended account, rate limit) becomes an unhandled promise rejection. If the process has a global `unhandledRejection` handler that calls `process.exit()` (a common pattern), one failed outbound call takes down the entire server and every other in-progress call, not just the failing one.',
+      docsUrl: "https://www.twilio.com/docs/usage/webhooks/webhooks-faq",
+      recommended: true
+    },
+    messages: {
+      missingTryCatch: "This await twilio.{{resource}}.{{method}}() call is inside an event-handler callback with no surrounding try/catch \u2014 a REST API error here becomes an unhandled promise rejection that can crash the whole process."
+    }
+  },
+  create(context) {
+    function isAwaitedTwilioRestCall(n) {
+      if (n?.type !== "AwaitExpression") return null;
+      const call = n.argument;
+      if (call?.type !== "CallExpression") return null;
+      const callee = call.callee;
+      if (callee?.type !== "MemberExpression") return null;
+      const method = callee.property?.type === "Identifier" ? callee.property.name : null;
+      if (!method || !REST_RESOURCE_METHODS.has(method)) return null;
+      const obj = callee.object;
+      if (obj?.type !== "MemberExpression") return null;
+      const resource = obj.property?.type === "Identifier" ? obj.property.name : null;
+      if (!resource) return null;
+      const base = obj.object;
+      const baseName = base?.type === "Identifier" ? base.name : null;
+      if (!baseName || !/^(twilio\w*|client)$/i.test(baseName)) return null;
+      return { resource, method };
+    }
+    function isEventHandlerRegistration(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      return callee.property?.type === "Identifier" && EVENT_REGISTRATION_METHODS.has(callee.property.name);
+    }
+    function isAsyncCallback(n) {
+      return (n?.type === "ArrowFunctionExpression" || n?.type === "FunctionExpression") && n.async === true;
+    }
+    function posOf2(n) {
+      if (typeof n?.range?.[0] === "number") return n.range[0];
+      const line = n?.loc?.start?.line ?? 0;
+      const column = n?.loc?.start?.column ?? 0;
+      return line * 1e6 + column;
+    }
+    function posEnd(n) {
+      if (typeof n?.range?.[1] === "number") return n.range[1];
+      const line = n?.loc?.end?.line ?? n?.loc?.start?.line ?? 0;
+      const column = n?.loc?.end?.column ?? n?.loc?.start?.column ?? 0;
+      return line * 1e6 + column;
+    }
+    function isWithinTryBlock(node, root) {
+      const tryRanges = [];
+      function collectTryRanges(n, depth = 0) {
+        if (!n || typeof n !== "object" || depth > 60) return;
+        if (Array.isArray(n)) {
+          for (const item of n) collectTryRanges(item, depth + 1);
+          return;
+        }
+        if (n.type === "TryStatement" && n.block) {
+          tryRanges.push([posOf2(n.block), posEnd(n.block)]);
+        }
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range") continue;
+          const val = n[key];
+          if (val && typeof val === "object") collectTryRanges(val, depth + 1);
+        }
+      }
+      collectTryRanges(root);
+      const p = posOf2(node);
+      return tryRanges.some(([start, end]) => p >= start && p <= end);
+    }
+    return {
+      CallExpression(node) {
+        if (!isEventHandlerRegistration(node)) return;
+        const callback = node.arguments?.find((a) => isAsyncCallback(a));
+        if (!callback) return;
+        const restCalls = [];
+        function collect(n, depth = 0) {
+          if (!n || typeof n !== "object" || depth > 40) return;
+          if (Array.isArray(n)) {
+            for (const item of n) collect(item, depth + 1);
+            return;
+          }
+          const info = isAwaitedTwilioRestCall(n);
+          if (info) restCalls.push({ node: n, ...info });
+          for (const key of Object.keys(n)) {
+            if (key === "parent" || key === "loc" || key === "range") continue;
+            const val = n[key];
+            if (val && typeof val === "object") collect(val, depth + 1);
+          }
+        }
+        collect(callback.body);
+        for (const call of restCalls) {
+          if (!isWithinTryBlock(call.node, callback.body)) {
+            context.report({
+              node: call.node,
+              messageId: "missingTryCatch",
+              data: { resource: call.resource, method: call.method }
+            });
+          }
+        }
+      }
+    };
+  }
+};
+var twilioAwaitOrCatchRestCallsInEventHandlersRule = rule97;
+
+// src/providers/twilio/rules/use-twiml-builder-not-string-templates.ts
+var rule98 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "TwiML responses must be built with the VoiceResponse builder, not raw XML template strings",
+      category: "security",
+      cwe: "CWE-91",
+      rationale: "The VoiceResponse builder XML-escapes every interpolated value automatically. A raw template literal that interpolates values directly into XML attribute or text positions has no such protection \u2014 if either value's source ever changes to something attacker-influenced (e.g. a SIP header instead of a Twilio-controlled CallSid), unescaped `<`/`\"`/`&` characters can break out of the intended XML structure.",
+      docsUrl: "https://www.twilio.com/docs/voice/twiml/stream",
+      recommended: true
+    },
+    messages: {
+      rawTwimlTemplate: "TwiML is built here as a raw template literal with interpolated values instead of the VoiceResponse builder \u2014 interpolated values are not XML-escaped, unlike new VoiceResponse()."
+    }
+  },
+  create(context) {
+    function looksLikeTwimlXml(raw) {
+      return /<Response>|<Connect>|<Say>|<Stream\b|<Enqueue\b|<Dial\b/.test(raw);
+    }
+    return {
+      TemplateLiteral(node) {
+        if ((node.expressions ?? []).length === 0) return;
+        const raw = (node.quasis ?? []).map((q) => q.value?.raw ?? "").join("");
+        if (!looksLikeTwimlXml(raw)) return;
+        context.report({ node, messageId: "rawTwimlTemplate" });
+      }
+    };
+  }
+};
+var twilioUseTwimlBuilderNotStringTemplatesRule = rule98;
+
+// src/providers/twilio/rules/media-streams-mark-pacing.ts
+var rule99 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Media Streams audio forwarding should use mark-based pacing to avoid buffer overflow",
+      category: "reliability",
+      rationale: 'Twilio buffers at most 10 minutes of audio per bidirectional Stream. If audio chunks are forwarded with no mark events and no pacing, and the sender produces media faster than real-time (or playback stalls), Twilio stops accepting further audio for that Stream and emits warning 31931 ("Media Discarded") \u2014 silently dropping audio rather than erroring loudly.',
+      docsUrl: "https://www.twilio.com/docs/api/errors/31931",
+      recommended: true
+    },
+    messages: {
+      noMarkPacing: "This file forwards media payloads via send() but never passes isLast/a mark argument anywhere \u2014 sustained high-throughput forwarding risks Twilio silently discarding buffered audio (warning 31931)."
+    }
+  },
+  create(context) {
+    function isMediaSendCall(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      if (callee.property?.type !== "Identifier" || callee.property.name !== "send") return false;
+      const arg = n.arguments?.[0];
+      const argText = arg?.type === "ArrayExpression" && (arg.elements ?? []).some(
+        (el) => el?.type === "MemberExpression" && el.property?.type === "Identifier" && el.property.name === "delta"
+      ) || arg?.type === "Identifier" && /delta|payload|media/i.test(arg.name);
+      return !!argText;
+    }
+    function hasIsLastOrMarkSignal(program2) {
+      let found = false;
+      function walk3(n, depth = 0) {
+        if (found || !n || typeof n !== "object" || depth > 60) return;
+        if (Array.isArray(n)) {
+          for (const item of n) walk3(item, depth + 1);
+          return;
+        }
+        if (typeof n.type === "string" && n.type.startsWith("TS")) return;
+        if (n.type === "CallExpression") {
+          const callee = n.callee;
+          if (callee?.type === "MemberExpression" && callee.property?.type === "Identifier" && callee.property.name === "send") {
+            const second = n.arguments?.[1];
+            if (second?.type === "Literal" && second.value === true) {
+              found = true;
+              return;
+            }
+            if (second?.type === "Identifier" && /isLast/i.test(second.name)) {
+              found = true;
+              return;
+            }
+          }
+        }
+        if (n.type === "Identifier" && n.name === "isLast") {
+          found = true;
+          return;
+        }
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range" || key === "typeAnnotation" || key === "returnType") continue;
+          const val = n[key];
+          if (val && typeof val === "object") walk3(val, depth + 1);
+        }
+      }
+      walk3(program2);
+      return found;
+    }
+    return {
+      "Program:exit"(program2) {
+        const sendCalls = [];
+        findInSubtree(program2, (n) => {
+          if (isMediaSendCall(n)) sendCalls.push(n);
+          return false;
+        });
+        if (sendCalls.length === 0) return;
+        if (hasIsLastOrMarkSignal(program2)) return;
+        context.report({ node: sendCalls[0], messageId: "noMarkPacing" });
+      }
+    };
+  }
+};
+var twilioMediaStreamsMarkPacingRule = rule99;
+
+// src/providers/twilio/rules/validate-all-request-inputs.ts
+var rule100 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Fastify Twilio webhook routes must declare a schema for every request input they read",
+      category: "correctness",
+      rationale: "A route that validates `body` but not `querystring` (or declares no schema at all) lets unvalidated, possibly-undefined fields flow downstream. If a later call does `value.toString()` or similar on a field that never arrived, that throws instead of failing the request cleanly with a 400 \u2014 the failure surfaces far from the actual missing-validation root cause.",
+      docsUrl: "https://www.twilio.com/docs/voice/twiml/stream",
+      recommended: true
+    },
+    messages: {
+      missingQuerystringSchema: "This route reads req.query.{{field}} but the route schema validates body without a matching querystring schema \u2014 a missing query param flows downstream as undefined instead of failing with a 400.",
+      missingSchemaEntirely: "This route reads req.body.{{field}} but declares no request schema at all \u2014 req.body is untyped and unvalidated before use."
+    }
+  },
+  create(context) {
+    function getOptionsArg(routeCall) {
+      return routeCall.arguments?.length === 3 ? routeCall.arguments[1] : null;
+    }
+    function getHandlerArg(routeCall) {
+      const args = routeCall.arguments ?? [];
+      return args[args.length - 1];
+    }
+    function hasSchemaProperty(optionsArg, propName2) {
+      if (optionsArg?.type !== "ObjectExpression") return false;
+      const schemaProp = (optionsArg.properties ?? []).find(
+        (p) => p.type === "Property" && p.key?.type === "Identifier" && p.key.name === "schema"
+      );
+      if (!schemaProp || schemaProp.value?.type !== "ObjectExpression") return false;
+      return (schemaProp.value.properties ?? []).some(
+        (p) => p.type === "Property" && p.key?.type === "Identifier" && p.key.name === propName2
+      );
+    }
+    function hasAnySchema(optionsArg) {
+      if (optionsArg?.type !== "ObjectExpression") return false;
+      return (optionsArg.properties ?? []).some(
+        (p) => p.type === "Property" && p.key?.type === "Identifier" && p.key.name === "schema"
+      );
+    }
+    function findReadFields(handlerBody, objectNames) {
+      const fields = /* @__PURE__ */ new Set();
+      findInSubtree(handlerBody, (n) => {
+        if (n?.type !== "MemberExpression") return false;
+        const obj = n.object;
+        if (obj?.type !== "MemberExpression") return false;
+        if (obj.object?.type !== "Identifier" || obj.object.name !== "req" && obj.object.name !== "request") return false;
+        if (obj.property?.type !== "Identifier" || !objectNames.has(obj.property.name)) return false;
+        const field = n.property?.type === "Identifier" ? n.property.name : null;
+        if (field) fields.add(field);
+        return false;
+      });
+      return fields;
+    }
+    return {
+      CallExpression(node) {
+        if (!isPostRouteRegistration(node)) return;
+        const optionsArg = getOptionsArg(node);
+        const handler = getHandlerArg(node);
+        if (!handler || handler.type !== "ArrowFunctionExpression" && handler.type !== "FunctionExpression") return;
+        const queryFields = findReadFields(handler.body, /* @__PURE__ */ new Set(["query"]));
+        const bodyFields = findReadFields(handler.body, /* @__PURE__ */ new Set(["body"]));
+        const hasBodySchema = hasSchemaProperty(optionsArg, "body");
+        const hasQuerystringSchema = hasSchemaProperty(optionsArg, "querystring");
+        if (queryFields.size > 0 && hasBodySchema && !hasQuerystringSchema) {
+          const field = [...queryFields][0];
+          context.report({ node, messageId: "missingQuerystringSchema", data: { field } });
+        }
+        if (bodyFields.size > 0 && !hasAnySchema(optionsArg)) {
+          const field = [...bodyFields][0];
+          context.report({ node, messageId: "missingSchemaEntirely", data: { field } });
+        }
+      }
+    };
+  }
+};
+var twilioValidateAllRequestInputsRule = rule100;
+
+// src/providers/twilio/rules/media-streams-mark-name-string.ts
+var rule101 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Media Streams mark.name must be a string, not a number",
+      category: "correctness",
+      rationale: 'Twilio\'s documented Media Streams `mark` message schema and every example show `mark.name` as a string (e.g. "my label"). Setting it to a bare number \u2014 `Date.now()` is a common culprit \u2014 means JSON.stringify() serializes it as a numeric literal, not the documented string type, a latent type mismatch that surfaces once mark-based pacing actually depends on matching mark names.',
+      docsUrl: "https://www.twilio.com/docs/voice/media-streams/websocket-messages",
+      recommended: true
+    },
+    messages: {
+      markNameNotString: "mark.name is set to a non-string value here \u2014 Twilio's documented schema requires mark.name to be a string (e.g. String(Date.now()))."
+    }
+  },
+  create(context) {
+    const NUMERIC_CALLS = /* @__PURE__ */ new Set(["Date.now", "performance.now", "Math.random", "Math.floor", "Math.round"]);
+    function isNumericLooking(n) {
+      if (!n) return false;
+      if (n.type === "Literal" && typeof n.value === "number") return true;
+      if (n.type === "CallExpression") {
+        const callee = n.callee;
+        if (callee?.type === "Identifier") return false;
+        if (callee?.type === "MemberExpression" && callee.object?.type === "Identifier" && callee.property?.type === "Identifier") {
+          return NUMERIC_CALLS.has(`${callee.object.name}.${callee.property.name}`);
+        }
+        return false;
+      }
+      return false;
+    }
+    function findMarkNameProperty(markObjExpr) {
+      for (const p of markObjExpr.properties ?? []) {
+        if (p.type !== "Property") continue;
+        const keyName = p.key?.type === "Identifier" ? p.key.name : p.key?.type === "Literal" ? p.key.value : null;
+        if (keyName === "name") return p;
+      }
+      return null;
+    }
+    return {
+      Property(node) {
+        const keyName = node.key?.type === "Identifier" ? node.key.name : node.key?.type === "Literal" ? node.key.value : null;
+        if (keyName !== "mark") return;
+        if (node.value?.type !== "ObjectExpression") return;
+        const nameProp = findMarkNameProperty(node.value);
+        if (!nameProp) return;
+        if (!isNumericLooking(nameProp.value)) return;
+        context.report({ node: nameProp, messageId: "markNameNotString" });
+      }
+    };
+  }
+};
+var twilioMediaStreamsMarkNameStringRule = rule101;
+
+// src/providers/openai-realtime/utils.ts
+function isOpenAIRealtimeUrlArg(node) {
+  if (!node) return false;
+  if (node.type === "Literal" && typeof node.value === "string") {
+    return node.value.includes("api.openai.com/v1/realtime");
+  }
+  if (node.type === "TemplateLiteral") {
+    return (node.quasis ?? []).some(
+      (q) => typeof q?.value?.raw === "string" && q.value.raw.includes("api.openai.com/v1/realtime")
+    );
+  }
+  return false;
+}
+function collectOpenAIRealtimeUrlVarNames(program2) {
+  const names = /* @__PURE__ */ new Set();
+  visit(program2);
+  return names;
+  function visit(node, depth = 0) {
+    if (!node || typeof node !== "object" || depth > 40) return;
+    if (Array.isArray(node)) {
+      for (const n of node) visit(n, depth + 1);
+      return;
+    }
+    if (node.type === "VariableDeclarator" && node.id?.type === "Identifier" && isOpenAIRealtimeUrlArg(node.init)) {
+      names.add(node.id.name);
+    }
+    for (const key of Object.keys(node)) {
+      if (key === "parent" || key === "loc" || key === "range") continue;
+      const val = node[key];
+      if (val && typeof val === "object") visit(val, depth + 1);
+    }
+  }
+}
+function isOpenAIRealtimeUrlNode(urlArgNode, urlVarNames) {
+  if (isOpenAIRealtimeUrlArg(urlArgNode)) return true;
+  return urlArgNode?.type === "Identifier" && urlVarNames.has(urlArgNode.name);
+}
+function isOpenAIRealtimeNewWebSocket(node, urlVarNames = /* @__PURE__ */ new Set()) {
+  if (node?.type !== "NewExpression") return false;
+  if (node.callee?.type !== "Identifier" || node.callee.name !== "WebSocket") return false;
+  return isOpenAIRealtimeUrlNode(node.arguments?.[0], urlVarNames);
+}
+function findProperty4(objectExpression, propertyName) {
+  if (objectExpression?.type !== "ObjectExpression") return null;
+  for (const prop of objectExpression.properties ?? []) {
+    if (prop?.type !== "Property") continue;
+    const key = prop.key;
+    const name = key?.type === "Identifier" ? key.name : key?.type === "Literal" ? key.value : null;
+    if (name === propertyName) return prop;
+  }
+  return null;
+}
+function collectOpenAIRealtimeSocketVarNames(program2) {
+  const urlVarNames = collectOpenAIRealtimeUrlVarNames(program2);
+  const names = /* @__PURE__ */ new Set();
+  visit(program2);
+  return names;
+  function visit(node, depth = 0) {
+    if (!node || typeof node !== "object" || depth > 40) return;
+    if (Array.isArray(node)) {
+      for (const n of node) visit(n, depth + 1);
+      return;
+    }
+    if (node.type === "VariableDeclarator" && node.id?.type === "Identifier" && isOpenAIRealtimeNewWebSocket(node.init, urlVarNames)) {
+      names.add(node.id.name);
+    }
+    if (node.type === "AssignmentExpression" && node.operator === "=" && isOpenAIRealtimeNewWebSocket(node.right, urlVarNames)) {
+      const left = node.left;
+      if (left?.type === "Identifier") {
+        names.add(left.name);
+      } else if (left?.type === "MemberExpression" && left.property) {
+        const propName2 = left.property.name;
+        if (typeof propName2 === "string") names.add(propName2);
+      }
+    }
+    for (const key of Object.keys(node)) {
+      if (key === "parent" || key === "loc" || key === "range") continue;
+      const val = node[key];
+      if (val && typeof val === "object") visit(val, depth + 1);
+    }
+  }
+}
+function isTrackedSocketRef(objNode, socketVarNames) {
+  if (objNode?.type === "Identifier") return socketVarNames.has(objNode.name);
+  if (objNode?.type === "MemberExpression" && objNode.property) {
+    const propName2 = objNode.property.name;
+    return typeof propName2 === "string" && socketVarNames.has(propName2);
+  }
+  return false;
+}
+function isSocketOnCall(node, socketVarNames, eventName) {
+  if (node?.type !== "CallExpression") return false;
+  const callee = node.callee;
+  if (callee?.type !== "MemberExpression") return false;
+  const prop = callee.property;
+  if (prop?.type !== "Identifier" || prop.name !== "on") return false;
+  if (!isTrackedSocketRef(callee.object, socketVarNames)) return false;
+  const firstArg = node.arguments?.[0];
+  return firstArg?.type === "Literal" && firstArg.value === eventName;
+}
+function collectStringVarValues(program2) {
+  const values = /* @__PURE__ */ new Map();
+  visit(program2);
+  return values;
+  function visit(node, depth = 0) {
+    if (!node || typeof node !== "object" || depth > 40) return;
+    if (Array.isArray(node)) {
+      for (const n of node) visit(n, depth + 1);
+      return;
+    }
+    if (node.type === "VariableDeclarator" && node.id?.type === "Identifier") {
+      const init = node.init;
+      if (init?.type === "Literal" && typeof init.value === "string") {
+        values.set(node.id.name, init.value);
+      } else if (init?.type === "TemplateLiteral" && (init.expressions ?? []).length === 0) {
+        values.set(node.id.name, (init.quasis ?? []).map((q) => q.value?.raw ?? "").join(""));
+      }
+    }
+    for (const key of Object.keys(node)) {
+      if (key === "parent" || key === "loc" || key === "range") continue;
+      const val = node[key];
+      if (val && typeof val === "object") visit(val, depth + 1);
+    }
+  }
+}
+function resolveStringValue(node, stringVarValues) {
+  if (!node) return null;
+  if (node.type === "Literal" && typeof node.value === "string") return node.value;
+  if (node.type === "TemplateLiteral" && (node.expressions ?? []).length === 0) {
+    return (node.quasis ?? []).map((q) => q.value?.raw ?? "").join("");
+  }
+  if (node.type === "Identifier" && stringVarValues.has(node.name)) {
+    return stringVarValues.get(node.name) ?? null;
+  }
+  return null;
+}
+
+// src/providers/openai-realtime/rules/migrate-beta-to-ga.ts
+var rule102 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "OpenAI Realtime connections must not pin to the deprecated beta interface",
+      category: "correctness",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime",
+      rationale: "OpenAI's current Realtime guide states that beta integrations must migrate to the GA interface before new work proceeds, and explicitly calls out removing the OpenAI-Beta: realtime=v1 header as a required step. Staying on the beta header keeps a connection locked to the legacy session shape and event names with no confirmed sunset date \u2014 a ticking liability rather than an active failure.",
+      recommended: true
+    },
+    messages: {
+      betaHeaderPresent: "This OpenAI Realtime connection sends the deprecated 'OpenAI-Beta: realtime=v1' header instead of using the GA interface."
+    },
+    schema: []
+  },
+  create(context) {
+    let urlVarNames = /* @__PURE__ */ new Set();
+    return {
+      Program(node) {
+        urlVarNames = collectOpenAIRealtimeUrlVarNames(node);
+      },
+      NewExpression(node) {
+        if (!isOpenAIRealtimeNewWebSocket(node, urlVarNames)) return;
+        const optionsArg = node.arguments?.[1];
+        if (optionsArg?.type !== "ObjectExpression") return;
+        const headersProp = findProperty4(optionsArg, "headers");
+        if (headersProp?.value?.type !== "ObjectExpression") return;
+        const betaProp = findProperty4(headersProp.value, "OpenAI-Beta");
+        if (!betaProp) return;
+        const value = betaProp.value;
+        const isRealtimeV1 = value?.type === "Literal" && typeof value.value === "string" && value.value.includes("realtime=v1");
+        if (!isRealtimeV1) return;
+        context.report({ node: betaProp, messageId: "betaHeaderPresent" });
+      }
+    };
+  }
+};
+var openaiRealtimeMigrateBetaToGaRule = rule102;
+
+// src/providers/openai-realtime/rules/no-log-raw-message-payloads.ts
+var LOG_METHOD_NAMES = /* @__PURE__ */ new Set(["info", "warn", "error", "log"]);
+function isLogCall(node) {
+  if (node?.type !== "CallExpression") return { matches: false };
+  const callee = node.callee;
+  if (callee?.type !== "MemberExpression") return { matches: false };
+  const prop = callee.property;
+  if (prop?.type !== "Identifier" || !LOG_METHOD_NAMES.has(prop.name)) return { matches: false };
+  return { matches: true, calleeProp: prop };
+}
+function referencesRawParam(argNode, paramName) {
+  if (!argNode) return false;
+  if (argNode.type === "Identifier" && argNode.name === paramName) return true;
+  if (argNode.type === "CallExpression" && argNode.callee?.type === "MemberExpression" && argNode.callee.object?.type === "Identifier" && argNode.callee.object.name === paramName && argNode.callee.property?.type === "Identifier" && argNode.callee.property.name === "toString") {
+    return true;
+  }
+  if (argNode.type === "TemplateLiteral") {
+    return (argNode.expressions ?? []).some((expr) => referencesRawParam(expr, paramName));
+  }
+  return false;
+}
+function findCallExpressions(node, out, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 40) return;
+  if (Array.isArray(node)) {
+    for (const n of node) findCallExpressions(n, out, depth + 1);
+    return;
+  }
+  if (node.type === "CallExpression") out.push(node);
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object") findCallExpressions(val, out, depth + 1);
+  }
+}
+var rule103 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Raw OpenAI Realtime message payloads must not be logged verbatim",
+      category: "security",
+      cwe: "CWE-532",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime",
+      rationale: "Every inbound Realtime WebSocket message can include response.audio.delta payloads (base64-encoded live call audio) and, once transcription is wired up, transcript text. Logging the raw message object or string verbatim writes a durable, unredacted record of live conversation content into whatever log sink the application ships to.",
+      recommended: true
+    },
+    messages: {
+      rawPayloadLogged: "A raw OpenAI Realtime message is logged verbatim here, which can include live call audio or transcript content."
+    },
+    schema: []
+  },
+  create(context) {
+    let socketVarNames = /* @__PURE__ */ new Set();
+    return {
+      Program(node) {
+        socketVarNames = collectOpenAIRealtimeSocketVarNames(node);
+      },
+      CallExpression(node) {
+        if (socketVarNames.size === 0) return;
+        if (!isSocketOnCall(node, socketVarNames, "message")) return;
+        const handler = node.arguments?.[1];
+        if (handler?.type !== "ArrowFunctionExpression" && handler?.type !== "FunctionExpression") return;
+        const param = handler.params?.[0];
+        if (param?.type !== "Identifier") return;
+        const paramName = param.name;
+        const calls = [];
+        findCallExpressions(handler.body, calls);
+        for (const call of calls) {
+          const { matches } = isLogCall(call);
+          if (!matches) continue;
+          const hasRawArg = (call.arguments ?? []).some((arg) => referencesRawParam(arg, paramName));
+          if (hasRawArg) {
+            context.report({ node: call, messageId: "rawPayloadLogged" });
+          }
+        }
+      }
+    };
+  }
+};
+var openaiRealtimeNoLogRawMessagePayloadsRule = rule103;
+
+// src/providers/openai-realtime/rules/handle-error-server-event.ts
+function isTypeMemberExpression(node) {
+  return node?.type === "MemberExpression" && node.property?.type === "Identifier" && node.property.name === "type";
+}
+function collectTypeComparisonLiterals(node, out, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 60) return;
+  if (Array.isArray(node)) {
+    for (const n of node) collectTypeComparisonLiterals(n, out, depth + 1);
+    return;
+  }
+  if (node.type === "BinaryExpression" && (node.operator === "===" || node.operator === "==")) {
+    if (isTypeMemberExpression(node.left) && node.right?.type === "Literal" && typeof node.right.value === "string") {
+      out.add(node.right.value);
+    }
+    if (isTypeMemberExpression(node.right) && node.left?.type === "Literal" && typeof node.left.value === "string") {
+      out.add(node.left.value);
+    }
+  }
+  if (node.type === "SwitchStatement" && isTypeMemberExpression(node.discriminant)) {
+    for (const c of node.cases ?? []) {
+      if (c?.test?.type === "Literal" && typeof c.test.value === "string") out.add(c.test.value);
+    }
+  }
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object") collectTypeComparisonLiterals(val, out, depth + 1);
+  }
+}
+var rule104 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: 'OpenAI Realtime message handlers must check for the API-level "error" server event',
+      category: "reliability",
+      docsUrl: "https://developers.openai.com/api/docs/api-reference/realtime_server_events",
+      rationale: "The Realtime API's own error server event \u2014 distinct from the WebSocket transport-level error event \u2014 covers rate limits, invalid session.update payloads, content-moderation blocks, and retired/invalid model ids. A message handler that branches on event types but never checks for 'error' lets the call continue silently with translation/processing permanently dead for that leg, with no operator-visible signal of why.",
+      recommended: true
+    },
+    messages: {
+      missingErrorBranch: "This Realtime message handler branches on event types but never checks for message.type === 'error'."
+    },
+    schema: []
+  },
+  create(context) {
+    let socketVarNames = /* @__PURE__ */ new Set();
+    return {
+      Program(node) {
+        socketVarNames = collectOpenAIRealtimeSocketVarNames(node);
+      },
+      CallExpression(node) {
+        if (socketVarNames.size === 0) return;
+        if (!isSocketOnCall(node, socketVarNames, "message")) return;
+        const handler = node.arguments?.[1];
+        if (handler?.type !== "ArrowFunctionExpression" && handler?.type !== "FunctionExpression") return;
+        const literals = /* @__PURE__ */ new Set();
+        collectTypeComparisonLiterals(handler.body, literals);
+        if (literals.size === 0) return;
+        if (!literals.has("error")) {
+          context.report({ node, messageId: "missingErrorBranch" });
+        }
+      }
+    };
+  }
+};
+var openaiRealtimeHandleErrorServerEventRule = rule104;
+
+// src/providers/openai-realtime/rules/reconnect-on-drop.ts
+var RECONNECT_NAME_PATTERN = /reconnect/i;
+function hasReconnectAttempt(node, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 60) return false;
+  if (Array.isArray(node)) {
+    return node.some((n) => hasReconnectAttempt(n, depth + 1));
+  }
+  if (node.type === "NewExpression" && node.callee?.type === "Identifier" && node.callee.name === "WebSocket") {
+    return true;
+  }
+  if (node.type === "CallExpression") {
+    const callee = node.callee;
+    const calleeName = callee?.type === "Identifier" ? callee.name : callee?.type === "MemberExpression" && callee.property?.type === "Identifier" ? callee.property.name : null;
+    if (typeof calleeName === "string" && RECONNECT_NAME_PATTERN.test(calleeName)) return true;
+  }
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object" && hasReconnectAttempt(val, depth + 1)) return true;
+  }
+  return false;
+}
+var rule105 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "A dropped OpenAI Realtime connection must be retried, not just logged",
+      category: "reliability",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime",
+      rationale: "For a multi-minute phone call, a single transient OpenAI-side disconnect that is only logged on 'close' permanently kills translation/processing for the remainder of the call in that direction \u2014 the call itself stays connected and silently degraded, with neither party getting a signal that something stopped working.",
+      recommended: true
+    },
+    messages: {
+      noReconnectAttempt: "This Realtime socket's close handler only logs and never attempts to reconnect."
+    },
+    schema: []
+  },
+  create(context) {
+    let socketVarNames = /* @__PURE__ */ new Set();
+    return {
+      Program(node) {
+        socketVarNames = collectOpenAIRealtimeSocketVarNames(node);
+      },
+      CallExpression(node) {
+        if (socketVarNames.size === 0) return;
+        if (!isSocketOnCall(node, socketVarNames, "close")) return;
+        const handler = node.arguments?.[1];
+        if (handler?.type !== "ArrowFunctionExpression" && handler?.type !== "FunctionExpression") return;
+        if (!hasReconnectAttempt(handler.body)) {
+          context.report({ node, messageId: "noReconnectAttempt" });
+        }
+      }
+    };
+  }
+};
+var openaiRealtimeReconnectOnDropRule = rule105;
+
+// src/providers/openai-realtime/rules/avoid-dated-preview-snapshots.ts
+var DATED_PREVIEW_MODEL_PATTERN = /model=[^&'"`]*-preview-\d{4}-\d{2}-\d{2}/;
+var rule106 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "OpenAI Realtime connections should not pin to a dated preview model snapshot",
+      category: "correctness",
+      docsUrl: "https://developers.openai.com/api/docs/api-reference/realtime-sessions",
+      rationale: "Dated preview snapshots are the category of model id OpenAI has historically retired with advance-notice sunset windows. Pinning to a dated preview snapshot rather than the floating GA alias (or a current dated GA snapshot) maximizes exposure to an eventual retirement, with no code path to detect or gracefully react to a model_not_found-style error if/when that happens.",
+      recommended: true
+    },
+    messages: {
+      datedPreviewSnapshot: "This Realtime connection is pinned to a dated preview model snapshot instead of the GA alias."
+    },
+    schema: []
+  },
+  create(context) {
+    let stringVarValues = /* @__PURE__ */ new Map();
+    let urlVarNames = /* @__PURE__ */ new Set();
+    return {
+      Program(node) {
+        stringVarValues = collectStringVarValues(node);
+        urlVarNames = collectOpenAIRealtimeUrlVarNames(node);
+      },
+      NewExpression(node) {
+        if (!isOpenAIRealtimeNewWebSocket(node, urlVarNames)) return;
+        const urlArg = node.arguments?.[0];
+        const urlString = resolveStringValue(urlArg, stringVarValues);
+        if (!urlString) return;
+        if (DATED_PREVIEW_MODEL_PATTERN.test(urlString)) {
+          context.report({ node: urlArg, messageId: "datedPreviewSnapshot" });
+        }
+      }
+    };
+  }
+};
+var openaiRealtimeAvoidDatedPreviewSnapshotsRule = rule106;
+
+// src/providers/openai-realtime/rules/verify-deprecated-session-fields.ts
+var rule107 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "OpenAI Realtime session.update payloads should not rely on an unverified 'temperature' field",
+      category: "correctness",
+      docsUrl: "https://developers.openai.com/api/docs/api-reference/realtime-sessions",
+      rationale: "Two independent fetches of the current Realtime sessions API reference did not surface 'temperature' as a documented session field. Sending an undocumented field is typically harmless (silently ignored), but code that depends on an assumed constraint (e.g. 'a hard floor of 0.6') for behavior like deterministic output is relying on a claim that is no longer traceable to any current, citable source.",
+      recommended: true
+    },
+    messages: {
+      unverifiedTemperatureField: "This session.update payload sets 'temperature', a field not documented in the current GA Realtime sessions schema."
+    },
+    schema: []
+  },
+  create(context) {
+    return {
+      ObjectExpression(node) {
+        const typeProp = findProperty4(node, "type");
+        const typeValue = typeProp?.value;
+        const isSessionUpdate = typeValue?.type === "Literal" && typeof typeValue.value === "string" && typeValue.value === "session.update";
+        if (!isSessionUpdate) return;
+        const sessionProp = findProperty4(node, "session");
+        if (sessionProp?.value?.type !== "ObjectExpression") return;
+        const temperatureProp = findProperty4(sessionProp.value, "temperature");
+        if (!temperatureProp) return;
+        context.report({ node: temperatureProp, messageId: "unverifiedTemperatureField" });
+      }
+    };
+  }
+};
+var openaiRealtimeVerifyDeprecatedSessionFieldsRule = rule107;
+
+// src/providers/openai-realtime/rules/buffer-audio-until-session-ready.ts
+var QUEUE_CALL_NAME_PATTERN = /^(push|unshift|enqueue|queue)$/i;
+function isReadyStateOpenCheck(test) {
+  if (test?.type !== "BinaryExpression" || test.operator !== "===" && test.operator !== "==") return false;
+  const isReadyStateMember = (n) => n?.type === "MemberExpression" && n.property?.type === "Identifier" && n.property.name === "readyState";
+  const isOpenValue = (n) => n?.type === "MemberExpression" && n.property?.type === "Identifier" && n.property.name === "OPEN" || n?.type === "Literal" && n.value === 1;
+  return isReadyStateMember(test.left) && isOpenValue(test.right) || isReadyStateMember(test.right) && isOpenValue(test.left);
+}
+function hasQueueCall(node, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 40) return false;
+  if (Array.isArray(node)) return node.some((n) => hasQueueCall(n, depth + 1));
+  if (node.type === "CallExpression") {
+    const callee = node.callee;
+    const calleeName = callee?.type === "MemberExpression" && callee.property?.type === "Identifier" ? callee.property.name : callee?.type === "Identifier" ? callee.name : null;
+    if (typeof calleeName === "string" && QUEUE_CALL_NAME_PATTERN.test(calleeName)) return true;
+  }
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object" && hasQueueCall(val, depth + 1)) return true;
+  }
+  return false;
+}
+var rule108 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Audio sent before an OpenAI Realtime socket is open must be buffered, not dropped",
+      category: "reliability",
+      docsUrl: "https://developers.openai.com/api/docs/voice/media-streams/websocket-messages",
+      rationale: "Caller audio can arrive before the Realtime WebSocket finishes its connect + session.update round-trip. A readyState !== OPEN branch that only logs and returns silently drops every audio chunk that arrives in that window, meaning the first fragment of speech is lost to translation/processing on every call.",
+      recommended: true
+    },
+    messages: {
+      audioDroppedNotBuffered: "Audio sent while this Realtime socket is not yet open is dropped here instead of being buffered and flushed once open."
+    },
+    schema: []
+  },
+  create(context) {
+    return {
+      IfStatement(node) {
+        if (!isReadyStateOpenCheck(node.test)) return;
+        if (!node.alternate) return;
+        if (hasQueueCall(node.alternate)) return;
+        context.report({ node: node.alternate, messageId: "audioDroppedNotBuffered" });
+      }
+    };
+  }
+};
+var openaiRealtimeBufferAudioUntilSessionReadyRule = rule108;
+
+// src/providers/openai-realtime/rules/send-safety-identifier.ts
+var rule109 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "OpenAI Realtime connections should send an OpenAI-Safety-Identifier header",
+      category: "security",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime",
+      rationale: "OpenAI's Realtime guidance recommends including an OpenAI-Safety-Identifier header with a stable, privacy-preserving value (e.g. a hashed user/account id) on Realtime connections, to support OpenAI's abuse/safety monitoring for voice content. A connection that omits it gives OpenAI no way to correlate abusive sessions back to an account without per-connection metadata.",
+      recommended: true
+    },
+    messages: {
+      missingSafetyIdentifier: "This OpenAI Realtime WebSocket connection does not send an OpenAI-Safety-Identifier header."
+    },
+    schema: []
+  },
+  create(context) {
+    let urlVarNames = /* @__PURE__ */ new Set();
+    return {
+      Program(node) {
+        urlVarNames = collectOpenAIRealtimeUrlVarNames(node);
+      },
+      NewExpression(node) {
+        if (!isOpenAIRealtimeNewWebSocket(node, urlVarNames)) return;
+        const optionsArg = node.arguments?.[1];
+        const headersProp = optionsArg?.type === "ObjectExpression" ? findProperty4(optionsArg, "headers") : null;
+        const headersObj = headersProp?.value?.type === "ObjectExpression" ? headersProp.value : null;
+        const safetyIdProp = headersObj ? findProperty4(headersObj, "OpenAI-Safety-Identifier") : null;
+        if (safetyIdProp) return;
+        context.report({ node: headersObj ?? optionsArg ?? node, messageId: "missingSafetyIdentifier" });
+      }
+    };
+  }
+};
+var openaiRealtimeSendSafetyIdentifierRule = rule109;
+
+// src/providers/openai-realtime/rules/transcription-model-choice.ts
+var rule110 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "OpenAI Realtime sessions should not configure 'whisper-1' for input transcription",
+      category: "correctness",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime-transcription",
+      rationale: "OpenAI's transcription guidance describes 'whisper-1' as for existing Whisper integrations that are not natively streaming, while 'gpt-realtime-whisper' is the natively-streaming option designed for realtime sessions. Configuring input_audio_transcription with 'whisper-1' is the wrong tool for a realtime session, adding latency/cost to a streaming pipeline.",
+      recommended: true
+    },
+    messages: {
+      nonStreamingTranscriptionModel: "input_audio_transcription is configured with 'whisper-1', which is not natively streaming and not optimized for realtime sessions."
+    },
+    schema: []
+  },
+  create(context) {
+    return {
+      ObjectExpression(node) {
+        const typeProp = findProperty4(node, "type");
+        const typeValue = typeProp?.value;
+        const isSessionUpdate = typeValue?.type === "Literal" && typeof typeValue.value === "string" && typeValue.value === "session.update";
+        if (!isSessionUpdate) return;
+        const sessionProp = findProperty4(node, "session");
+        if (sessionProp?.value?.type !== "ObjectExpression") return;
+        const transcriptionProp = findProperty4(sessionProp.value, "input_audio_transcription");
+        if (transcriptionProp?.value?.type !== "ObjectExpression") return;
+        const modelProp = findProperty4(transcriptionProp.value, "model");
+        const modelValue = modelProp?.value;
+        const isWhisper1 = modelValue?.type === "Literal" && typeof modelValue.value === "string" && modelValue.value === "whisper-1";
+        if (!isWhisper1) return;
+        context.report({ node: modelProp, messageId: "nonStreamingTranscriptionModel" });
+      }
+    };
+  }
+};
+var openaiRealtimeTranscriptionModelChoiceRule = rule110;
+
+// src/plugin/index.ts
+var plugin = {
+  meta: { name: PLUGIN_NAME, version: "0.0.1" },
+  rules: {
+    "resend-webhook-signature": resendWebhookSignatureRule,
+    "resend-api-key-hardcoded": resendApiKeyHardcodedRule,
+    "resend-api-key-in-client-bundle": resendApiKeyInClientBundleRule,
+    "resend-marketing-via-batch-send": resendMarketingViaBatchSendRule,
+    "resend-marketing-missing-unsubscribe": resendMarketingMissingUnsubscribeRule,
+    "resend-test-domain-in-production-path": resendTestDomainInProductionPathRule,
+    "resend-from-address-not-friendly-format": resendFromAddressNotFriendlyFormatRule,
+    "resend-batch-size-not-enforced": resendBatchSizeNotEnforcedRule,
+    "resend-missing-idempotency-key": resendMissingIdempotencyKeyRule,
+    "resend-no-error-code-mapping": resendNoErrorCodeMappingRule,
+    "resend-webhook-no-idempotency": resendWebhookNoIdempotencyRule,
+    "resend-missing-tags": resendMissingTagsRule,
+    "resend-request-id-not-logged": resendRequestIdNotLoggedRule,
+    "supabase-scope-queries-by-tenant-column": supabaseScopeQueriesByTenantColumnRule,
+    "supabase-validate-uuid-columns": supabaseValidateUuidColumnsRule,
+    "supabase-order-by-timestamp-not-identity": supabaseOrderByTimestampNotIdentityRule,
+    "supabase-consistent-input-length-limits": supabaseConsistentInputLengthLimitsRule,
+    "supabase-idempotent-mutations": supabaseIdempotentMutationsRule,
+    "supabase-fail-fast-env-validation": supabaseFailFastEnvValidationRule,
+    "supabase-no-user-metadata-authz": supabaseNoUserMetadataAuthzRule,
+    "supabase-single-without-error-check": supabaseSingleWithoutErrorCheckRule,
+    "supabase-non-atomic-replace-pattern": supabaseNonAtomicReplacePatternRule,
+    "supabase-unchecked-mutation-error": supabaseUncheckedMutationErrorRule,
+    "supabase-realtime-missing-filter": supabaseRealtimeMissingFilterRule,
+    "supabase-storage-error-not-surfaced": supabaseStorageErrorNotSurfacedRule,
+    "auth0-required-audience-validation": auth0RequiredAudienceValidationRule,
+    "auth0-no-account-link-without-verified-email": auth0NoAccountLinkWithoutVerifiedEmailRule,
+    "auth0-dead-claim-verification-check": auth0DeadClaimVerificationCheckRule,
+    "auth0-jwks-refresh-on-unknown-kid": auth0JwksRefreshOnUnknownKidRule,
+    "firebase-missing-app-check": firebaseMissingAppCheckRule,
+    "firebase-unhandled-auth-popup-rejection": firebaseUnhandledAuthPopupRejectionRule,
+    "firebase-rtdb-list-read-for-single-item": firebaseRtdbListReadForSingleItemRule,
+    "firebase-unvalidated-external-data-to-rtdb": firebaseUnvalidatedExternalDataToRtdbRule,
+    "firebase-rtdb-batch-write-not-atomic": firebaseRtdbBatchWriteNotAtomicRule,
+    "firebase-rtdb-listener-error-not-handled": firebaseRtdbListenerErrorNotHandledRule,
+    "firebase-effect-deps-whole-user-object": firebaseEffectDepsWholeUserObjectRule,
+    "firebase-rtdb-write-promise-not-handled": firebaseRtdbWritePromiseNotHandledRule,
+    "firebase-firestore-rules-expired": firebaseFirestoreRulesExpiredRule,
+    "firebase-id-token-cookie-flags": firebaseIdTokenCookieFlagsRule,
+    "firebase-middleware-token-not-verified": firebaseMiddlewareTokenNotVerifiedRule,
+    "firebase-hardcoded-user-id": firebaseHardcodedUserIdRule,
+    "firebase-auth-user-not-found-disclosure": firebaseAuthUserNotFoundDisclosureRule,
+    "firebase-signup-password-confirm": firebaseSignupPasswordConfirmRule,
+    "firebase-use-array-union-remove": firebaseUseArrayUnionRemoveRule,
+    "firebase-duplicate-initialize-app": firebaseDuplicateInitializeAppRule,
+    "firebase-onSnapshot-async-throw": firebaseOnSnapshotAsyncThrowRule,
+    "firebase-onSnapshot-missing-error-callback": firebaseOnSnapshotMissingErrorCallbackRule,
+    "firebase-firestore-document-size-guard": firebaseFirestoreDocumentSizeGuardRule,
+    "firebase-use-timestamp-now": firebaseUseTimestampNowRule,
+    "lovable-no-client-side-secret-fetch": lovableNoClientSideSecretFetchRule,
+    "lovable-paid-flag-without-edge-function": lovablePaidFlagWithoutEdgeFunctionRule,
+    "lovable-expiry-column-never-checked": lovableExpiryColumnNeverCheckedRule,
+    "lovable-silent-catch-on-provider-call": lovableSilentCatchOnProviderCallRule,
+    "browserbase-no-conditional-authz-on-anonymous-user": browserbaseNoConditionalAuthzOnAnonymousUserRule,
+    "browserbase-no-connect-url-in-api-response": browserbaseNoConnectUrlInApiResponseRule,
+    "browserbase-session-id-requires-ownership-check": browserbaseSessionIdRequiresOwnershipCheckRule,
+    "browserbase-no-concurrent-shared-context": browserbaseNoConcurrentSharedContextRule,
+    "browserbase-mobile-device-requires-os-setting": browserbaseMobileDeviceRequiresOsSettingRule,
+    "browserbase-use-typed-exception-status-not-substring": browserbaseUseTypedExceptionStatusNotSubstringRule,
+    "browserbase-release-session-on-connect-failure": browserbaseReleaseSessionOnConnectFailureRule,
+    "browserbase-dont-stack-custom-retry-on-sdk-retry": browserbaseDontStackCustomRetryOnSdkRetryRule,
+    "browserbase-no-overbroad-error-substring-match": browserbaseNoOverbroadErrorSubstringMatchRule,
+    "browserbase-use-sdk-not-raw-requests": browserbaseUseSdkNotRawRequestsRule,
+    "browserbase-centralize-request-release": browserbaseCentralizeRequestReleaseRule,
+    "openai-cua-no-domain-allowlist": openaiCuaNoDomainAllowlistRule,
+    "openai-cua-scroll-delta-default-zero": openaiCuaScrollDeltaDefaultZeroRule,
+    "openai-cua-structured-step-metadata-not-text-json": openaiCuaStructuredStepMetadataNotTextJsonRule,
+    "openai-cua-no-blind-safety-check-ack": openaiCuaNoBlindSafetyCheckAckRule,
+    "openai-cua-retry-transient-turn-errors": openaiCuaRetryTransientTurnErrorsRule,
+    "openai-cua-check-response-status-incomplete": openaiCuaCheckResponseStatusIncompleteRule,
+    "openai-cua-set-safety-identifier": openaiCuaSetSafetyIdentifierRule,
+    "tiptap-upload-validate-fn-void": tiptapUploadValidateFnVoidRule,
+    "tiptap-script-src-hardcoded-api-key": tiptapScriptSrcHardcodedApiKeyRule,
+    "tiptap-dynamic-script-no-sri": tiptapDynamicScriptNoSriRule,
+    "tiptap-addAttributes-missing-renderHTML": tiptapAddAttributesMissingRenderHTMLRule,
+    "tiptap-appendTransaction-add-to-history": tiptapAppendTransactionAddToHistoryRule,
+    "tiptap-appendTransaction-full-scan": tiptapAppendTransactionFullScanRule,
+    "tiptap-atom-node-wrap-in": tiptapAtomNodeWrapInRule,
+    "tiptap-twitter-url-regex": tiptapTwitterUrlRegexRule,
+    "tiptap-drop-handler-pos-precedence": tiptapDropHandlerPosPrecedenceRule,
+    "tiptap-prefer-table-kit": tiptapPreferTableKitRule,
+    "tiptap-tiptap-markdown-missing-node-spec": tiptapTiptapMarkdownMissingNodeSpecRule,
+    "elevenlabs-validate-signed-url-response": elevenlabsValidateSignedUrlResponseRule,
+    "elevenlabs-no-error-object-logging": elevenlabsNoErrorObjectLoggingRule,
+    "elevenlabs-fetch-timeout-required": elevenlabsFetchTimeoutRequiredRule,
+    "elevenlabs-validate-agent-id-format": elevenlabsValidateAgentIdFormatRule,
+    "elevenlabs-secure-session-id-generation": elevenlabsSecureSessionIdGenerationRule,
+    "elevenlabs-conversation-error-recovery": elevenlabsConversationErrorRecoveryRule,
+    "elevenlabs-api-version-pinning": elevenlabsApiVersionPinningRule,
+    "elevenlabs-check-http-status-before-json": elevenlabsCheckHttpStatusBeforeJsonRule,
+    "elevenlabs-conversation-cleanup-on-error": elevenlabsConversationCleanupOnErrorRule,
+    "elevenlabs-env-var-validation": elevenlabsEnvVarValidationRule,
+    "twilio-validate-webhook-signature": twilioValidateWebhookSignatureRule,
+    "twilio-taskrouter-attributes-match-consumer": twilioTaskrouterAttributesMatchConsumerRule,
+    "twilio-enqueue-task-json-stringify": twilioEnqueueTaskJsonStringifyRule,
+    "twilio-media-streams-key-by-call-sid": twilioMediaStreamsKeyByCallSidRule,
+    "twilio-await-or-catch-rest-calls-in-event-handlers": twilioAwaitOrCatchRestCallsInEventHandlersRule,
+    "twilio-use-twiml-builder-not-string-templates": twilioUseTwimlBuilderNotStringTemplatesRule,
+    "twilio-media-streams-mark-pacing": twilioMediaStreamsMarkPacingRule,
+    "twilio-validate-all-request-inputs": twilioValidateAllRequestInputsRule,
+    "twilio-media-streams-mark-name-string": twilioMediaStreamsMarkNameStringRule,
+    "openai-realtime-migrate-beta-to-ga": openaiRealtimeMigrateBetaToGaRule,
+    "openai-realtime-no-log-raw-message-payloads": openaiRealtimeNoLogRawMessagePayloadsRule,
+    "openai-realtime-handle-error-server-event": openaiRealtimeHandleErrorServerEventRule,
+    "openai-realtime-reconnect-on-drop": openaiRealtimeReconnectOnDropRule,
+    "openai-realtime-avoid-dated-preview-snapshots": openaiRealtimeAvoidDatedPreviewSnapshotsRule,
+    "openai-realtime-verify-deprecated-session-fields": openaiRealtimeVerifyDeprecatedSessionFieldsRule,
+    "openai-realtime-buffer-audio-until-session-ready": openaiRealtimeBufferAudioUntilSessionReadyRule,
+    "openai-realtime-send-safety-identifier": openaiRealtimeSendSafetyIdentifierRule,
+    "openai-realtime-transcription-model-choice": openaiRealtimeTranscriptionModelChoiceRule
+  }
+};
+
+// src/plugin/rule-registry.ts
+function buildRegistry() {
+  const registry2 = /* @__PURE__ */ new Map();
+  for (const [key, rule111] of Object.entries(plugin.rules)) {
+    const docs = rule111?.meta?.docs ?? {};
+    registry2.set(key, {
+      category: docs.category,
+      description: docs.description ?? "",
+      rationale: docs.rationale ?? "",
+      docsUrl: docs.docsUrl,
+      cwe: docs.cwe,
+      owasp: docs.owasp
+    });
+  }
+  return registry2;
+}
+var registry = buildRegistry();
+function getRuleDocsMeta(ruleKey) {
+  return registry.get(ruleKey);
+}
+
+// src/reporter/snippet.ts
+function extractCodeSnippet(content, line, contextLines = 2) {
+  const allLines = content.split(/\r?\n/);
+  const highlighted = Math.min(Math.max(line, 1), allLines.length || 1);
+  const start = Math.max(1, highlighted - contextLines);
+  const end = Math.min(allLines.length, highlighted + contextLines);
+  const lines = [];
+  for (let n = start; n <= end; n++) {
+    lines.push({ number: n, text: allLines[n - 1] ?? "" });
+  }
+  return { lines, highlightedLine: highlighted };
+}
+
+// src/types.ts
+var SEVERITY_ORDER = {
+  error: 0,
+  warning: 1,
+  info: 2
+};
+function scoreToSeverityLabel(score) {
+  if (score >= 80) return "excellent";
+  if (score >= 60) return "good";
+  if (score >= 40) return "needs-work";
+  return "critical";
+}
+
+// src/reporter/report-builder.ts
+function computeScore(errors, warnings) {
+  return Math.max(0, 100 - errors * 15 - warnings * 5);
 }
 function buildSummary(results) {
   const errors = results.filter((r) => r.severity === "error").length;
@@ -7264,7 +9630,17 @@ async function detectProviders(directory, filesContent) {
       continue;
     }
     const urls = provider.detect.urlPatterns ?? [];
-    if (urls.some((u) => allSources.includes(u))) {
+    const matchedUrl = urls.find((u) => {
+      if (!allSources.includes(u)) return false;
+      const isShadowedByMoreSpecificProvider = providers.some((other) => {
+        if (other === provider) return false;
+        return (other.detect.urlPatterns ?? []).some(
+          (otherUrl) => otherUrl !== u && otherUrl.includes(u) && allSources.includes(otherUrl)
+        );
+      });
+      return !isShadowedByMoreSpecificProvider;
+    });
+    if (matchedUrl) {
       detected.set(provider.name, {
         name: provider.name,
         source: "url-patterns",
@@ -7319,9 +9695,9 @@ function buildOxlintConfig(detectedNames) {
   const ruleMetaByKey = /* @__PURE__ */ new Map();
   for (const provider of providers) {
     if (!detectedNames.has(provider.name)) continue;
-    for (const rule83 of provider.oxlintRules) {
-      oxlintRules[`${PLUGIN_NAME}/${rule83.key}`] = rule83.severity === "error" || rule83.severity === void 0 ? "error" : "warn";
-      ruleMetaByKey.set(rule83.key, rule83);
+    for (const rule111 of provider.oxlintRules) {
+      oxlintRules[`${PLUGIN_NAME}/${rule111.key}`] = rule111.severity === "error" || rule111.severity === void 0 ? "error" : "warn";
+      ruleMetaByKey.set(rule111.key, rule111);
     }
   }
   return { oxlintRules, ruleMetaByKey };
@@ -7439,9 +9815,9 @@ var import_node_path5 = require("path");
 function rationaleByRule() {
   const map = /* @__PURE__ */ new Map();
   for (const provider of providers) {
-    for (const rule83 of provider.oxlintRules) {
-      const docs = getRuleDocsMeta(rule83.key);
-      if (docs?.rationale) map.set(rule83.resultRule, docs.rationale);
+    for (const rule111 of provider.oxlintRules) {
+      const docs = getRuleDocsMeta(rule111.key);
+      if (docs?.rationale) map.set(rule111.resultRule, docs.rationale);
     }
   }
   return map;