@api-doctor/cli 0.0.4 → 0.0.6

package/dist/plugin.js

@@ -11,7 +11,7 @@ var rule = {
       cwe: "CWE-345",
       owasp: "API2:2023 Broken Authentication",
       rationale: "Webhook endpoints are public URLs, so anyone who learns the path can POST a forged payload. Without verifying the Svix signature first, an attacker can fake delivery, bounce, or complaint events and drive your application into the wrong state. Validating the signature against your webhook secret before reading the body ensures the event genuinely came from Resend.",
-      docsUrl: "https://resend.com/docs/dashboard/webhooks/introduction#verify-webhook-signatures",
+      docsUrl: "https://resend.com/docs/webhooks/verify-webhooks-requests",
       recommended: true
     },
     messages: {
@@ -88,6 +88,15 @@ var rule = {
       const obj = callee.object;
       return obj?.type === "Identifier" && (obj.name === "req" || obj.name === "request");
     }
+    function isReqTextCall(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      const prop = callee.property;
+      if (prop?.type !== "Identifier" || prop.name !== "text") return false;
+      const obj = callee.object;
+      return obj?.type === "Identifier" && (obj.name === "req" || obj.name === "request");
+    }
     function isBodyMember(n) {
       if (n?.type !== "MemberExpression") return false;
       const prop = n.property;
@@ -112,6 +121,17 @@ var rule = {
       const obj = callee.object;
       return obj?.type === "Identifier" && svixImports.has(obj.name);
     }
+    function isResendWebhooksVerifyCall(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      const prop = callee.property;
+      if (prop?.type !== "Identifier" || prop.name !== "verify") return false;
+      const obj = callee.object;
+      if (obj?.type !== "MemberExpression") return false;
+      const webhooksProp = obj.property;
+      return webhooksProp?.type === "Identifier" && webhooksProp.name === "webhooks";
+    }
     function recordFirst(posKey, handler, pos) {
       const existing = handler[posKey];
       if (!existing) {
@@ -126,6 +146,11 @@ var rule = {
       ImportDeclaration(node) {
         const importSource = node?.source?.value;
         if (importSource === "resend") importsResend = true;
+        for (const s of node.specifiers ?? []) {
+          if ((s?.type === "ImportSpecifier" || s?.type === "ImportDefaultSpecifier") && s.local?.type === "Identifier" && /^resend$/i.test(s.local.name)) {
+            importsResend = true;
+          }
+        }
         if (importSource === "svix") {
           for (const s of node.specifiers ?? []) {
             if (s?.type === "ImportSpecifier" && s.local?.type === "Identifier") {
@@ -147,8 +172,10 @@ var rule = {
         for (const handler of postHandlers) {
           if (!within(handler, node)) continue;
           if (isReqJsonCall(node)) recordFirst("firstBodyPos", handler, pos);
+          if (isReqTextCall(node)) recordFirst("firstRawBodyPos", handler, pos);
           if (isSvixVerifyCall(node)) recordFirst("firstVerifyPos", handler, pos);
           if (isCryptoCreateHmacCall(node)) recordFirst("firstVerifyPos", handler, pos);
+          if (isResendWebhooksVerifyCall(node)) recordFirst("firstVerifyPos", handler, pos);
         }
       },
       MemberExpression(node) {
@@ -163,6 +190,8 @@ var rule = {
       "Program:exit"() {
         if (!importsResend) return;
         for (const handler of postHandlers) {
+          const consumesRequest = handler.firstBodyPos || handler.firstRawBodyPos;
+          if (!consumesRequest) continue;
           if (!handler.firstVerifyPos) {
             context.report({ node: handler.node, messageId: "missingVerification" });
             continue;
@@ -734,7 +763,7 @@ var rule11 = {
       description: "Resend webhook handlers should deduplicate retried events",
       category: "reliability",
       rationale: "Resend retries failed webhook deliveries for up to 24 hours, so the same event can legitimately arrive more than once. A handler that acts on every delivery without deduplication will double-process events \u2014 sending duplicate downstream notifications, double-counting metrics, or corrupting state. Tracking processed event ids (e.g. event.data.email_id) in a store or set and skipping ones already seen makes the handler safely idempotent.",
-      docsUrl: "https://resend.com/docs/dashboard/webhooks/introduction",
+      docsUrl: "https://resend.com/docs/webhooks/introduction",
       recommended: true
     },
     messages: {
@@ -1036,12 +1065,12 @@ var rule14 = {
     docs: {
       description: "Supabase queries that select a tenant column must filter by it",
       category: "correctness",
-      rationale: "A column like session_id or user_id existing in the schema (and being selected) signals intent to scope rows to one caller, but selecting it is not the same as filtering by it. Without an .eq()/.match()/.filter() on that column, the query returns every row for every tenant, turning a per-user feed into a single shared, cross-user one.",
+      rationale: "A column like session_id or user_id being selected signals intent to scope rows to one caller, but selecting it is not the same as filtering by it. If RLS is not enabled on the table, the unfiltered query returns every row for every tenant \u2014 a per-user feed becomes a shared, cross-user one. Even when RLS scopes the rows server-side, an explicit .eq()/.match()/.filter() is defense-in-depth (a dropped policy no longer leaks data) and avoids fetching rows the page never uses.",
       docsUrl: "https://supabase.com/docs/reference/javascript/eq",
       recommended: true
     },
     messages: {
-      missingTenantFilter: 'This query selects "{{column}}" but never filters by it. Add .eq("{{column}}", ...) (or .match()/.filter()) to scope results to the caller.'
+      missingTenantFilter: `This query selects "{{column}}" but never filters by it \u2014 without RLS on this table that is every tenant's rows. Add .eq("{{column}}", ...) (or .match()/.filter()) to scope results to the caller.`
     },
     schema: []
   },
@@ -1313,7 +1342,8 @@ function objectHasIdempotencyKey(objectExpression) {
   return (objectExpression.properties ?? []).some((p) => {
     if (p?.type !== "Property") return false;
     const name = p.key?.type === "Identifier" ? p.key.name : p.key?.type === "Literal" ? p.key.value : void 0;
-    return typeof name === "string" && /idempot|dedupe/i.test(name);
+    if (typeof name !== "string") return false;
+    return /idempot|dedupe/i.test(name) || /^(id|uuid)$/i.test(name) || /_(key|uuid)$/i.test(name);
   });
 }
 function insertPayloadHasIdempotencyKey(arg) {
@@ -1329,12 +1359,12 @@ var rule18 = {
     docs: {
       description: "Supabase insert calls should be retry-safe via an idempotency key",
       category: "reliability",
-      rationale: 'Nothing prevents a duplicate row if the client fetch behind an insert is retried (flaky network, double-click, browser replay) \u2014 there is no unique constraint or dedupe key visible in the payload, and no upsert semantics. Generate a client-side idempotency key per logical action and either include it as a field guarded by a unique constraint, or use .upsert(..., { onConflict: "<key column>" }).',
+      rationale: 'Nothing prevents a duplicate row if the client fetch behind an insert is retried (flaky network, double-click, browser replay) \u2014 no unique key is visible in the payload, and no upsert semantics. Include a client-generated unique key (an id, or a *_key field backed by a unique constraint), or use .upsert(..., { onConflict: "<key column>" }). This is general retry-safety practice rather than a documented Supabase requirement, hence info severity.',
       docsUrl: "https://supabase.com/docs/reference/javascript/upsert",
       recommended: true
     },
     messages: {
-      missingIdempotencyKey: 'This insert has no idempotency/dedupe key field, so a retried request can create a duplicate row. Add one, or use .upsert(..., { onConflict: "<key column>" }).'
+      missingIdempotencyKey: 'This insert payload has no unique/idempotency key field, so a retried request can create a duplicate row. Include a client-generated key, or use .upsert(..., { onConflict: "<key column>" }).'
     },
     schema: []
   },
@@ -1383,7 +1413,7 @@ var rule19 = {
     docs: {
       description: "createClient must fail fast when required env vars are missing",
       category: "reliability",
-      rationale: "createClient does not throw on undefined arguments \u2014 a missing env var surfaces later as an opaque error deep in a fetch call rather than a clear message at startup. Checking presence before calling createClient turns a confusing runtime failure (e.g. on a misconfigured second service) into an immediate, actionable one.",
+      rationale: `createClient throws immediately when an argument is missing, but with the SDK's message ("supabaseKey is required.") \u2014 it names the SDK parameter, not your env var. An explicit presence check produces an error naming the exact variable to set, which matters most with Next.js NEXT_PUBLIC_* inlining where the fix is a rebuild with the var present, not a server restart.`,
       docsUrl: "https://supabase.com/docs/reference/javascript/initializing",
       recommended: true
     },
@@ -1393,7 +1423,11 @@ var rule19 = {
     schema: []
   },
   create(context) {
-    let createClientLocalName;
+    const FACTORY_IMPORTS = {
+      "@supabase/supabase-js": ["createClient"],
+      "@supabase/ssr": ["createBrowserClient", "createServerClient"]
+    };
+    const factoryLocalNames = /* @__PURE__ */ new Set();
     const envVarOfVariable = /* @__PURE__ */ new Map();
     const validatedVarNames = /* @__PURE__ */ new Set();
     const validatedEnvNames = /* @__PURE__ */ new Set();
@@ -1427,10 +1461,11 @@ var rule19 = {
     }
     return {
       ImportDeclaration(node) {
-        if (node.source?.value !== "@supabase/supabase-js") return;
+        const factories = FACTORY_IMPORTS[node.source?.value];
+        if (!factories) return;
         for (const s of node.specifiers ?? []) {
-          if (s?.type === "ImportSpecifier" && s.imported?.type === "Identifier" && s.imported.name === "createClient" && s.local?.type === "Identifier") {
-            createClientLocalName = s.local.name;
+          if (s?.type === "ImportSpecifier" && s.imported?.type === "Identifier" && factories.includes(s.imported.name) && s.local?.type === "Identifier") {
+            factoryLocalNames.add(s.local.name);
           }
         }
       },
@@ -1444,8 +1479,8 @@ var rule19 = {
         collectGuardTargets(node.test);
       },
       CallExpression(node) {
-        if (!createClientLocalName) return;
-        if (node.callee?.type !== "Identifier" || node.callee.name !== createClientLocalName) return;
+        if (factoryLocalNames.size === 0) return;
+        if (node.callee?.type !== "Identifier" || !factoryLocalNames.has(node.callee.name)) return;
         const missing = [];
         for (const rawArg of node.arguments ?? []) {
           const arg = unwrapNonNull(rawArg);
@@ -1513,8 +1548,8 @@ var rule20 = {
       category: "security",
       cwe: "CWE-285",
       owasp: "A01:2021 Broken Access Control",
-      rationale: "Supabase documents raw_user_meta_data as client-writable and unsuitable for authorization. Reading user_metadata.role (or writing role into signUp/updateUser data) lets any signed-in user self-assign privileged roles from the browser. Store roles in app_metadata via a trusted server path, or in an RLS-protected profiles table.",
-      docsUrl: "https://supabase.com/docs/guides/database/postgres/row-level-security",
+      rationale: 'Supabase documents user_metadata as user-editable: "Do not use it in security sensitive context (such as in RLS policies or authorization logic), as this value is editable by the user without any checks." Reading user_metadata.role (or writing role into signUp/updateUser data) lets any signed-in user self-assign privileged roles from the browser. Store roles in app_metadata via a trusted server path, or in an RLS-protected profiles table.',
+      docsUrl: "https://supabase.com/docs/guides/auth/users",
       recommended: true
     },
     messages: {
@@ -1550,7 +1585,7 @@ var rule21 = {
     docs: {
       description: "Supabase .single() calls must inspect the returned error field",
       category: "correctness",
-      rationale: ".single() signals zero-or-one-row intent via the error field (PGRST116), not by leaving data undefined silently. Destructuring only data and never reading error produces infinite spinners on deleted rows, bad IDs, or RLS-denied reads. Prefer .maybeSingle() or branch on error before rendering.",
+      rationale: ".single() signals zero-or-one-row intent via the error field (PGRST116), not by leaving data undefined silently. Destructuring only data and never reading error produces infinite spinners on deleted rows, bad IDs, or RLS-denied reads. Prefer .maybeSingle() or branch on error before rendering. Chains ending in .throwOnError() opt into exceptions instead and are exempt.",
       docsUrl: "https://supabase.com/docs/reference/javascript/single",
       recommended: true
     },
@@ -1560,14 +1595,29 @@ var rule21 = {
     schema: []
   },
   create(context) {
+    const deferredBindings = [];
+    const errorReadNames = /* @__PURE__ */ new Set();
     function checkAwaitBinding(node, pattern, awaitExpr) {
       if (!isSingleSupabaseQuery(awaitExpr.argument)) return;
+      if (chainHasMethod(awaitExpr.argument, "throwOnError")) return;
+      if (pattern?.type === "Identifier") {
+        deferredBindings.push({ node, name: pattern.name });
+        return;
+      }
       const names = destructuredNames(pattern);
       if (names.has("error")) return;
       context.report({ node, messageId: "missingErrorCheck" });
     }
     return {
+      MemberExpression(node) {
+        if (!node.computed && node.object?.type === "Identifier" && node.property?.type === "Identifier" && node.property.name === "error") {
+          errorReadNames.add(node.object.name);
+        }
+      },
       VariableDeclarator(node) {
+        if (node.init?.type === "Identifier" && node.id?.type === "ObjectPattern") {
+          if (destructuredNames(node.id).has("error")) errorReadNames.add(node.init.name);
+        }
         if (node.init?.type !== "AwaitExpression") return;
         checkAwaitBinding(node, node.id, node.init);
       },
@@ -1579,9 +1629,17 @@ var rule21 = {
         const expr = node.expression;
         if (expr?.type !== "AwaitExpression") return;
         if (!isSingleSupabaseQuery(expr.argument)) return;
+        if (chainHasMethod(expr.argument, "throwOnError")) return;
         if (memberPropName(expr.argument) === "single") {
           context.report({ node, messageId: "missingErrorCheck" });
         }
+      },
+      "Program:exit"() {
+        for (const { node, name } of deferredBindings) {
+          if (!errorReadNames.has(name)) {
+            context.report({ node, messageId: "missingErrorCheck" });
+          }
+        }
       }
     };
   }
@@ -1690,7 +1748,7 @@ var rule23 = {
     docs: {
       description: "Supabase mutations must check the returned error field",
       category: "correctness",
-      rationale: "Unlike fetch(), Supabase client mutations return { data, error } and resolve even when RLS denies the write or a constraint fails. Fire-and-forget awaits or destructuring only data lets optimistic UI state diverge from the database with no toast or rollback.",
+      rationale: "Unlike fetch(), Supabase client mutations return { data, error } and resolve even when RLS denies the write or a constraint fails. Fire-and-forget awaits or destructuring only data lets optimistic UI state diverge from the database with no toast or rollback. Chains ending in .throwOnError() opt into exceptions instead and are exempt.",
       docsUrl: "https://supabase.com/docs/reference/javascript/insert",
       recommended: true
     },
@@ -1700,30 +1758,52 @@ var rule23 = {
     schema: []
   },
   create(context) {
+    const deferredBindings = [];
+    const errorReadNames = /* @__PURE__ */ new Set();
     function checkMutationAwait(node, pattern, awaitExpr) {
       if (!isSupabaseMutationCall(awaitExpr.argument)) return;
+      if (chainHasMethod(awaitExpr.argument, "throwOnError")) return;
       if (!pattern) {
         context.report({ node, messageId: "uncheckedMutation" });
         return;
       }
+      if (pattern.type === "Identifier") {
+        deferredBindings.push({ node, name: pattern.name });
+        return;
+      }
       const names = destructuredNames(pattern);
       if (!names.has("error")) {
         context.report({ node, messageId: "uncheckedMutation" });
       }
     }
     return {
+      MemberExpression(node) {
+        if (!node.computed && node.object?.type === "Identifier" && node.property?.type === "Identifier" && node.property.name === "error") {
+          errorReadNames.add(node.object.name);
+        }
+      },
       ExpressionStatement(node) {
         const expr = node.expression;
         if (expr?.type !== "AwaitExpression") return;
         checkMutationAwait(node, void 0, expr);
       },
       VariableDeclarator(node) {
+        if (node.init?.type === "Identifier" && node.id?.type === "ObjectPattern") {
+          if (destructuredNames(node.id).has("error")) errorReadNames.add(node.init.name);
+        }
         if (node.init?.type !== "AwaitExpression") return;
         checkMutationAwait(node, node.id, node.init);
       },
       AssignmentExpression(node) {
         if (node.right?.type !== "AwaitExpression") return;
         checkMutationAwait(node, node.left, node.right);
+      },
+      "Program:exit"() {
+        for (const { node, name } of deferredBindings) {
+          if (!errorReadNames.has(name)) {
+            context.report({ node, messageId: "uncheckedMutation" });
+          }
+        }
       }
     };
   }
@@ -1773,11 +1853,20 @@ function isStorageUploadCall(node) {
   let current = node;
   let sawStorage = false;
   let sawUpload = false;
-  while (current?.type === "CallExpression") {
-    const prop = memberPropName(current);
-    if (prop === "storage") sawStorage = true;
-    if (prop === "upload") sawUpload = true;
-    current = chainObjectCall(current);
+  while (current) {
+    if (current.type === "CallExpression") {
+      const prop = memberPropName(current);
+      if (prop === "storage") sawStorage = true;
+      if (prop === "upload") sawUpload = true;
+      current = current.callee?.object;
+    } else if (current.type === "MemberExpression") {
+      const p = current.property;
+      const name = !current.computed && p?.type === "Identifier" ? p.name : p?.type === "Literal" && typeof p.value === "string" ? p.value : void 0;
+      if (name === "storage") sawStorage = true;
+      current = current.object;
+    } else {
+      break;
+    }
   }
   return sawStorage && sawUpload;
 }
@@ -2358,8 +2447,8 @@ var rule30 = {
       category: "security",
       cwe: "CWE-285",
       owasp: "A04:2021 Insecure Design",
-      rationale: "Firebase web API keys are public by design and only identify the project to Google's backend \u2014 they are not a secret. The only things standing between an attacker who clones the client config and your database/auth quota are Security Rules and App Check. A file that calls initializeApp but never initializeAppCheck leaves App Check unconfigured, so any client presenting a valid project config (not necessarily yours) can reach Firebase Auth and, subject to rules, the database.",
-      docsUrl: "https://firebase.google.com/docs/database/web/start",
+      rationale: "Firebase web API keys are public by design and only identify the project to Google's backend \u2014 they are not a secret. The only things standing between an attacker who clones the client config and your database/auth quota are Security Rules and App Check. A file that calls initializeApp but never initializeAppCheck leaves App Check unconfigured, so any client presenting a valid project config (not necessarily yours) can reach Firebase Auth and, subject to rules, the database. Note the client-side call alone is not enough: App Check only blocks traffic once enforcement is turned on per-product in the Firebase console.",
+      docsUrl: "https://firebase.google.com/docs/app-check/web/recaptcha-provider",
       recommended: true
     },
     messages: {
@@ -2533,7 +2622,13 @@ function isValidationLikeCall(node) {
   const callee = node.callee;
   const name = callee?.type === "Identifier" ? callee.name : callee?.type === "MemberExpression" && !callee.computed && callee.property?.type === "Identifier" ? callee.property.name : void 0;
   if (!name) return false;
-  return /valid|^test$|check|assert|schema/i.test(name);
+  if (/valid|^test$|check|assert|schema/i.test(name)) return true;
+  if (callee?.type === "MemberExpression") {
+    if (/^(safeParse|safeParseAsync|parseAsync)$/.test(name)) return true;
+    const objName = callee.object?.type === "Identifier" ? callee.object.name : void 0;
+    if (name === "parse" && objName !== "JSON") return true;
+  }
+  return false;
 }
 var rule33 = {
   meta: {
@@ -2722,18 +2817,24 @@ var firebaseRtdbListenerErrorNotHandledRule = rule35;
 function isUseEffectCall(node) {
   return node?.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "useEffect";
 }
+function isNonUidMemberAccess(node, objName) {
+  if (node?.type !== "MemberExpression") return false;
+  if (node.object?.type !== "Identifier" || node.object.name !== objName) return false;
+  if (node.computed) return true;
+  return node.property?.type === "Identifier" && node.property.name !== "uid";
+}
 var rule36 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "useEffect should depend on user?.uid, not the whole user object",
       category: "reliability",
-      rationale: "onAuthStateChanged delivers a new user object reference on every internal token refresh (roughly hourly) even when uid is unchanged. An effect that only reads user.uid but lists the whole user object in its dependency array tears down and re-establishes its RTDB listener on every refresh \u2014 an avoidable unsubscribe/resubscribe cycle that briefly clears local state.",
+      rationale: "Auth context providers commonly hand out a new user object reference on every token refresh (roughly hourly) \u2014 providers subscribed to onIdTokenChanged, or ones that clone the user into React state, re-render with a fresh reference even when uid is unchanged. An effect that only reads user.uid but lists the whole user object in its dependency array tears down and re-establishes its RTDB listener on every refresh \u2014 an avoidable unsubscribe/resubscribe cycle that briefly clears local state.",
       docsUrl: "https://firebase.google.com/docs/reference/js/auth.md#onauthstatechanged",
       recommended: true
     },
     messages: {
-      wholeUserObjectDep: "This effect only reads {{name}}.uid but depends on the whole {{name}} object, which gets a new reference on every token refresh. Depend on {{name}}?.uid instead."
+      wholeUserObjectDep: "This effect only reads {{name}}.uid but depends on the whole {{name}} object, which can get a new reference on every token refresh. Depend on {{name}}?.uid instead."
     },
     schema: []
   },
@@ -2746,9 +2847,9 @@ var rule36 = {
         for (const el of depsArg.elements ?? []) {
           if (el?.type !== "Identifier") continue;
           const name = el.name;
-          if (someDescendant(callback, (n) => isUidMemberAccess(n, name))) {
-            context.report({ node, messageId: "wholeUserObjectDep", data: { name } });
-          }
+          if (!someDescendant(callback, (n) => isUidMemberAccess(n, name))) continue;
+          if (someDescendant(callback, (n) => isNonUidMemberAccess(n, name))) continue;
+          context.report({ node, messageId: "wholeUserObjectDep", data: { name } });
         }
       }
     };
@@ -2844,13 +2945,13 @@ var rule38 = {
     schema: []
   },
   create(context) {
-    const EXPIRED_YEAR = 2025;
     function checkStringForExpiredDate(value, reportNode) {
-      const re = /timestamp\.date\(\s*(\d{4})\s*,/g;
+      const re = /timestamp\.date\(\s*(\d{4})\s*,\s*(\d{1,2})\s*,\s*(\d{1,2})\s*\)/g;
       let match;
       while ((match = re.exec(value)) !== null) {
-        const year = parseInt(match[1], 10);
-        if (year <= EXPIRED_YEAR) {
+        const [, year, month, day] = match;
+        const expiry = new Date(parseInt(year, 10), parseInt(month, 10) - 1, parseInt(day, 10));
+        if (expiry.getTime() <= Date.now()) {
           context.report({ node: reportNode, messageId: "firestoreRulesExpired" });
           return;
         }
@@ -2882,6 +2983,18 @@ function findProp(obj, name) {
     (p) => p?.type === "Property" && (p.key?.type === "Identifier" && p.key.name === name || p.key?.type === "Literal" && p.key.value === name)
   );
 }
+var TOKEN_NAME = /token|session/i;
+function isTokenLiteral(node) {
+  return node?.type === "Literal" && typeof node.value === "string" && TOKEN_NAME.test(node.value);
+}
+function isCookieReceiver(obj) {
+  if (obj?.type === "Identifier") return /cookie/i.test(obj.name);
+  if (obj?.type === "CallExpression" && obj.callee?.type === "Identifier") return /^cookies$/i.test(obj.callee.name);
+  if (obj?.type === "MemberExpression" && !obj.computed && obj.property?.type === "Identifier") {
+    return /cookie/i.test(obj.property.name);
+  }
+  return false;
+}
 var rule39 = {
   meta: {
     type: "problem",
@@ -2889,110 +3002,71 @@ var rule39 = {
       description: "Firebase ID token stored in a cookie without httpOnly flag",
       category: "security",
       cwe: "CWE-1004",
-      owasp: "A02:2021 Cryptographic Failures",
-      rationale: "Storing a Firebase ID token in a non-httpOnly cookie makes it readable by any JavaScript on the page. An XSS vulnerability can steal the token and impersonate the user. Use the Firebase Admin SDK createSessionCookie flow to issue a proper httpOnly session cookie instead.",
+      owasp: "A05:2021 Security Misconfiguration",
+      rationale: "Storing a Firebase ID token in a non-httpOnly cookie makes it readable by any JavaScript on the page. An XSS vulnerability can steal the token and impersonate the user. Use the Firebase Admin SDK createSessionCookie flow to issue a proper httpOnly session cookie instead \u2014 note httpOnly can only be set from server-side code, never from client-side JavaScript.",
       docsUrl: "https://firebase.google.com/docs/auth/admin/manage-cookies",
       recommended: true
     },
     messages: {
-      idTokenCookieMissingHttpOnly: "Firebase ID token stored in cookie without httpOnly: true. Any XSS vulnerability can steal the token. Use the Firebase Admin SDK createSessionCookie flow instead."
+      idTokenCookieMissingHttpOnly: "Auth token stored in cookie without httpOnly: true. Any XSS vulnerability can steal the token. Use the Firebase Admin SDK createSessionCookie flow instead."
     },
     schema: []
   },
   create(context) {
-    function isTokenName(val) {
-      return /token/i.test(val);
-    }
     function hasHttpOnlyTrue(optsNode) {
-      if (optsNode?.type !== "ObjectExpression") return false;
       const prop = findProp(optsNode, "httpOnly");
-      if (!prop) return false;
-      return prop.value?.type === "Literal" && prop.value.value === true;
-    }
-    return {
-      CallExpression(node) {
-        const callee = node.callee;
-        const isCookieSet = callee?.type === "Identifier" && callee.name === "setCookie";
-        if (!isCookieSet) return;
-        const args = node.arguments ?? [];
-        const nameArg = args[0];
-        if (nameArg?.type !== "Literal" || typeof nameArg.value !== "string") return;
-        if (!isTokenName(nameArg.value)) return;
-        const optsArg = args.length >= 3 ? args[2] : null;
-        if (!optsArg || optsArg.type !== "ObjectExpression") {
-          context.report({ node, messageId: "idTokenCookieMissingHttpOnly" });
-          return;
-        }
-        if (!hasHttpOnlyTrue(optsArg)) {
+      return prop?.value?.type === "Literal" && prop.value.value === true;
+    }
+    function checkNameValueOptsCall(node) {
+      const args = node.arguments ?? [];
+      if (args.length === 1 && args[0]?.type === "ObjectExpression") {
+        const nameProp = findProp(args[0], "name");
+        if (!isTokenLiteral(nameProp?.value)) return;
+        if (!hasHttpOnlyTrue(args[0])) {
           context.report({ node, messageId: "idTokenCookieMissingHttpOnly" });
         }
+        return;
+      }
+      if (!isTokenLiteral(args[0])) return;
+      const optsArg = args.length >= 3 ? args[2] : null;
+      if (!optsArg || optsArg.type !== "ObjectExpression" || !hasHttpOnlyTrue(optsArg)) {
+        context.report({ node, messageId: "idTokenCookieMissingHttpOnly" });
       }
-    };
-  }
-};
-var firebaseIdTokenCookieFlagsRule = rule39;
-
-// src/providers/firebase/rules/middleware-token-not-verified.ts
-var rule40 = {
-  meta: {
-    type: "problem",
-    docs: {
-      description: "Next.js middleware reads auth cookie but never verifies it",
-      category: "security",
-      cwe: "CWE-345",
-      owasp: "A07:2021 Identification and Authentication Failures",
-      rationale: "Checking only that an auth cookie is non-empty does not verify the token. An attacker who sets any non-empty cookie value will bypass the guard entirely. The middleware must call verifySessionCookie or verifyIdToken to confirm the token is valid and unexpired.",
-      docsUrl: "https://firebase.google.com/docs/auth/admin/manage-cookies#verify_session_cookies_and_check_permissions",
-      recommended: true
-    },
-    messages: {
-      tokenNotVerified: "Middleware reads the auth cookie but never verifies it. Any non-empty cookie value bypasses the guard. Call adminAuth.verifySessionCookie() or verifyIdToken() before allowing access."
-    },
-    schema: []
-  },
-  create(context) {
-    const AUTH_COOKIE_NAMES = /token|session/i;
-    const VERIFY_METHOD_NAMES = /* @__PURE__ */ new Set(["verifySessionCookie", "verifyIdToken", "verify"]);
-    let readsCookieWithAuthName = false;
-    let hasVerifyCall = false;
-    const cookieReadNodes = [];
-    function isAuthCookieGet(node) {
-      if (node?.type !== "CallExpression") return false;
-      const callee = node.callee;
-      if (callee?.type !== "MemberExpression") return false;
-      if (callee.property?.type !== "Identifier" || callee.property.name !== "get") return false;
-      const arg = node.arguments?.[0];
-      if (arg?.type !== "Literal" || typeof arg.value !== "string") return false;
-      return AUTH_COOKIE_NAMES.test(arg.value);
     }
     return {
       CallExpression(node) {
-        if (isAuthCookieGet(node)) {
-          readsCookieWithAuthName = true;
-          cookieReadNodes.push(node);
-        }
         const callee = node.callee;
-        if (callee?.type === "Identifier" && VERIFY_METHOD_NAMES.has(callee.name)) {
-          hasVerifyCall = true;
+        if (callee?.type === "Identifier" && callee.name === "setCookie") {
+          checkNameValueOptsCall(node);
+          return;
         }
-        if (callee?.type === "MemberExpression" && callee.property?.type === "Identifier" && VERIFY_METHOD_NAMES.has(callee.property.name)) {
-          hasVerifyCall = true;
+        if (callee?.type !== "MemberExpression" || callee.computed || callee.property?.type !== "Identifier") return;
+        if (callee.property.name === "cookie") {
+          checkNameValueOptsCall(node);
+          return;
+        }
+        if (callee.property.name === "set" && isCookieReceiver(callee.object)) {
+          checkNameValueOptsCall(node);
         }
       },
-      "Program:exit"() {
-        if (readsCookieWithAuthName && !hasVerifyCall) {
-          for (const node of cookieReadNodes) {
-            context.report({ node, messageId: "tokenNotVerified" });
-          }
+      // document.cookie = `token=${idToken}` — can never be httpOnly
+      AssignmentExpression(node) {
+        const left = node.left;
+        const isDocumentCookie = left?.type === "MemberExpression" && !left.computed && left.object?.type === "Identifier" && left.object.name === "document" && left.property?.type === "Identifier" && left.property.name === "cookie";
+        if (!isDocumentCookie) return;
+        const right = node.right;
+        const text = right?.type === "Literal" && typeof right.value === "string" ? right.value : right?.type === "TemplateLiteral" ? (right.quasis ?? []).map((q) => q?.value?.cooked ?? "").join("") : "";
+        if (/(?:^|;\s*)[^=;]*(?:token|session)[^=;]*=/i.test(text)) {
+          context.report({ node, messageId: "idTokenCookieMissingHttpOnly" });
         }
       }
     };
   }
 };
-var firebaseMiddlewareTokenNotVerifiedRule = rule40;
+var firebaseIdTokenCookieFlagsRule = rule39;
 
 // src/providers/firebase/rules/hardcoded-user-id.ts
-var rule41 = {
+var rule40 = {
   meta: {
     type: "problem",
     docs: {
@@ -3010,6 +3084,9 @@ var rule41 = {
     schema: []
   },
   create(context) {
+    if (isInsideTestFile2(String(context.filename ?? ""))) {
+      return {};
+    }
     const USER_ID_NAMES = /* @__PURE__ */ new Set(["userId", "uid", "userID", "user_id"]);
     return {
       VariableDeclarator(node) {
@@ -3024,10 +3101,10 @@ var rule41 = {
     };
   }
 };
-var firebaseHardcodedUserIdRule = rule41;
+var firebaseHardcodedUserIdRule = rule40;
 
 // src/providers/firebase/rules/auth-user-not-found-disclosure.ts
-var rule42 = {
+var rule41 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -3066,10 +3143,10 @@ var rule42 = {
     };
   }
 };
-var firebaseAuthUserNotFoundDisclosureRule = rule42;
+var firebaseAuthUserNotFoundDisclosureRule = rule41;
 
 // src/providers/firebase/rules/signup-password-confirm.ts
-var rule43 = {
+var rule42 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -3103,7 +3180,7 @@ var rule43 = {
       },
       BinaryExpression(node) {
         if (node.operator !== "===" && node.operator !== "==" && node.operator !== "!==" && node.operator !== "!=") return;
-        const mentionsConfirm = (n) => n?.type === "Identifier" && n.name === "confirmPassword";
+        const mentionsConfirm = (n) => n?.type === "Identifier" && n.name === "confirmPassword" || n?.type === "MemberExpression" && !n.computed && n.property?.type === "Identifier" && n.property.name === "confirmPassword";
         if (mentionsConfirm(node.left) || mentionsConfirm(node.right)) {
           hasPasswordComparison = true;
         }
@@ -3126,16 +3203,16 @@ var rule43 = {
     };
   }
 };
-var firebaseSignupPasswordConfirmRule = rule43;
+var firebaseSignupPasswordConfirmRule = rule42;
 
 // src/providers/firebase/rules/use-array-union-remove.ts
-var rule44 = {
+var rule43 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "Firestore array field updated with read-modify-write spread/filter instead of arrayUnion/arrayRemove",
       category: "correctness",
-      rationale: "Spreading an array or using filter() inside updateDoc() performs a non-atomic read-modify-write that loses concurrent updates. Firestore provides arrayUnion() and arrayRemove() specifically for atomic array updates that do not require reading the document first.",
+      rationale: "Spreading an array or using filter() inside updateDoc() performs a non-atomic read-modify-write that loses concurrent updates. Firestore provides arrayUnion() and arrayRemove() specifically for atomic array updates that do not require reading the document first. Caveat: arrayRemove() matches whole element values \u2014 to remove object items by a predicate (e.g. by id), use runTransaction() instead so the read-modify-write is atomic.",
       docsUrl: "https://firebase.google.com/docs/firestore/manage-data/add-data#update_elements_in_an_array",
       recommended: true
     },
@@ -3175,10 +3252,10 @@ var rule44 = {
     };
   }
 };
-var firebaseUseArrayUnionRemoveRule = rule44;
+var firebaseUseArrayUnionRemoveRule = rule43;
 
 // src/providers/firebase/rules/duplicate-initialize-app.ts
-var rule45 = {
+var rule44 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -3211,9 +3288,11 @@ var rule45 = {
         const callee = node.callee;
         if (callee?.type !== "Identifier") return;
         if (initializeAppLocalName && callee.name === initializeAppLocalName) {
-          initializeAppCalls.push(node);
+          if ((node.arguments ?? []).length < 2) {
+            initializeAppCalls.push(node);
+          }
         }
-        if (callee.name === "getApps") {
+        if (callee.name === "getApps" || callee.name === "getApp") {
           hasGetAppsCall = true;
         }
       },
@@ -3226,21 +3305,21 @@ var rule45 = {
     };
   }
 };
-var firebaseDuplicateInitializeAppRule = rule45;
+var firebaseDuplicateInitializeAppRule = rule44;
 
 // src/providers/firebase/rules/onSnapshot-async-throw.ts
-var rule46 = {
+var rule45 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "throw inside async onSnapshot callback creates an unhandled promise rejection",
       category: "reliability",
-      rationale: "onSnapshot does not handle Promise rejections from its callback. A throw inside an async callback becomes an unhandled rejection, silently terminating the listener and leaving the UI in a broken state with no error feedback.",
+      rationale: "onSnapshot ignores the promise returned by an async callback, so a throw inside one becomes an unhandled promise rejection: the error never reaches the UI or the onSnapshot error callback (which only fires for stream errors), and in Node it can crash the process. The listener keeps delivering snapshots, but every one that hits the throw fails invisibly.",
       docsUrl: "https://firebase.google.com/docs/firestore/query-data/listen#handle_listen_errors",
       recommended: true
     },
     messages: {
-      asyncThrowInSnapshot: "throw inside an async onSnapshot callback creates an unhandled promise rejection. The listener silently stops. Use return with error logging or the onSnapshot error callback instead."
+      asyncThrowInSnapshot: "throw inside an async onSnapshot callback creates an unhandled promise rejection \u2014 the error surfaces nowhere. Catch it in the callback and set error state instead of throwing."
     },
     schema: []
   },
@@ -3280,10 +3359,10 @@ var rule46 = {
     };
   }
 };
-var firebaseOnSnapshotAsyncThrowRule = rule46;
+var firebaseOnSnapshotAsyncThrowRule = rule45;
 
 // src/providers/firebase/rules/onSnapshot-missing-error-callback.ts
-var rule47 = {
+var rule46 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -3321,21 +3400,21 @@ var rule47 = {
     };
   }
 };
-var firebaseOnSnapshotMissingErrorCallbackRule = rule47;
+var firebaseOnSnapshotMissingErrorCallbackRule = rule46;
 
 // src/providers/firebase/rules/firestore-document-size-guard.ts
-var rule48 = {
+var rule47 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "Firestore write includes editor.getJSON() without a document size guard",
       category: "reliability",
-      rationale: "Firestore documents have a 1 MiB limit. When a rich-text editor stores base64 images inline, a single paste can push the document over the limit. The write silently fails with INVALID_ARGUMENT. Always check document size before calling updateDoc/setDoc when the payload includes editor JSON.",
+      rationale: "Firestore documents have a 1 MiB limit. When a rich-text editor stores base64 images inline, a single paste can push the document over the limit. The write is rejected with INVALID_ARGUMENT \u2014 and if that rejection is not handled, nothing surfaces to the user. Check document size (e.g. new Blob([JSON.stringify(payload)]).size) before calling updateDoc/setDoc when the payload includes editor JSON.",
       docsUrl: "https://firebase.google.com/docs/firestore/quotas#limits",
       recommended: true
     },
     messages: {
-      missingDocumentSizeGuard: "Firestore write includes editor.getJSON() without a document size check. Base64 images can exceed the 1 MiB Firestore limit, silently failing the write. Add a Blob size guard before calling updateDoc/setDoc."
+      missingDocumentSizeGuard: "Firestore write includes editor.getJSON() without a document size check. Base64 images can exceed the 1 MiB Firestore limit and the write is rejected. Add a size guard (new Blob([JSON.stringify(payload)]).size) before calling updateDoc/setDoc."
     },
     schema: []
   },
@@ -3375,21 +3454,21 @@ var rule48 = {
     };
   }
 };
-var firebaseFirestoreDocumentSizeGuardRule = rule48;
+var firebaseFirestoreDocumentSizeGuardRule = rule47;
 
 // src/providers/firebase/rules/use-timestamp-now.ts
-var rule49 = {
+var rule48 = {
   meta: {
     type: "suggestion",
     docs: {
-      description: "new Date() used for Firestore timestamp instead of Timestamp.now() or serverTimestamp()",
+      description: "new Date() used for Firestore timestamp instead of serverTimestamp()",
       category: "correctness",
-      rationale: "While Firestore auto-converts Date objects on write, mixing new Date() with Timestamp.now() creates type inconsistencies. Firestore security rules that compare request.resource.data.createdAt against request.time expect a Timestamp on both sides; a bare Date object can cause silent rule evaluation failures.",
+      rationale: "Firestore auto-converts Date objects to Timestamps on write, so new Date() and Timestamp.now() are equivalent \u2014 both use the client clock, which cannot be trusted (skewed or deliberately changed clocks produce wrong orderings). serverTimestamp() stamps the value on the server instead, and it is the only option that satisfies security rules comparing a field against request.time (e.g. createdAt == request.time), which reject both new Date() and Timestamp.now().",
       docsUrl: "https://firebase.google.com/docs/reference/js/firestore_.timestamp",
       recommended: true
     },
     messages: {
-      useTimestampNow: "Use Timestamp.now() or serverTimestamp() instead of new Date() for Firestore timestamp fields. new Date() creates type inconsistencies with security rules that compare against request.time."
+      useTimestampNow: "Use serverTimestamp() instead of new Date() for Firestore timestamp fields. new Date() uses the untrusted client clock and fails rules that compare against request.time."
     },
     schema: []
   },
@@ -3398,7 +3477,7 @@ var rule49 = {
     return {
       ImportDeclaration(node) {
         const src = node.source?.value;
-        if (typeof src === "string" && (src.startsWith("firebase/") || src === "firebase-admin/firestore")) {
+        if (typeof src === "string" && (src.startsWith("firebase/firestore") || src === "firebase-admin/firestore")) {
           importsFromFirestore = true;
         }
       },
@@ -3411,7 +3490,7 @@ var rule49 = {
     };
   }
 };
-var firebaseUseTimestampNowRule = rule49;
+var firebaseUseTimestampNowRule = rule48;
 
 // src/providers/lovable/utils.ts
 var LLM_HOST_PATTERN = /api\.anthropic\.com|api\.openai\.com/;
@@ -3426,7 +3505,7 @@ function containsKnownLlmHost(node) {
 }
 
 // src/providers/lovable/rules/no-client-side-secret-fetch.ts
-var rule50 = {
+var rule49 = {
   meta: {
     type: "problem",
     docs: {
@@ -3499,13 +3578,13 @@ var rule50 = {
     };
   }
 };
-var lovableNoClientSideSecretFetchRule = rule50;
+var lovableNoClientSideSecretFetchRule = rule49;
 
 // src/providers/lovable/rules/paid-flag-without-edge-function.ts
 var PRICE_PATTERN = /\$\s?\d/;
 var FLAG_PROPERTY_PATTERN = /^is_[a-z0-9_]+$/i;
 var FLAG_SUFFIX_PATTERN = /_(unlocked|active|enabled)$/i;
-var rule51 = {
+var rule50 = {
   meta: {
     type: "problem",
     docs: {
@@ -3514,7 +3593,7 @@ var rule51 = {
       cwe: "CWE-840",
       owasp: "A04:2021 \u2013 Insecure Design",
       rationale: "Lovable documents payment processing as Edge Function territory specifically so purchase/premium-access flags are only ever set after a payment provider confirms payment server-side. A handler that writes a paid-looking flag straight from the client with no payment call in between either never actually charges anyone, or \u2014 even if a charge happens elsewhere \u2014 leaves the flag itself freely settable by any caller with write access to the row.",
-      docsUrl: "https://docs.lovable.dev/features/cloud",
+      docsUrl: "https://docs.lovable.dev/integrations/stripe",
       recommended: true
     },
     messages: {
@@ -3647,20 +3726,20 @@ var rule51 = {
     };
   }
 };
-var lovablePaidFlagWithoutEdgeFunctionRule = rule51;
+var lovablePaidFlagWithoutEdgeFunctionRule = rule50;
 
 // src/providers/lovable/rules/expiry-column-never-checked.ts
 var EXPIRY_COLUMN_PATTERN = /_(until|expires?_at|expiry)$/i;
 var DATE_COMPARISON_OPERATORS = /* @__PURE__ */ new Set([">", "<", ">=", "<="]);
 var FILTER_METHODS = /* @__PURE__ */ new Set(["gt", "gte", "lt", "lte"]);
-var rule52 = {
+var rule51 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "An expiry column must be checked against the current time somewhere",
       category: "correctness",
       rationale: "Writing a *_until/*_expires_at column without ever comparing it to the current time anywhere in the codebase means the expiry is purely cosmetic \u2014 whatever it was meant to gate (a boost, a trial, a temporary unlock) never actually expires once granted, whether it was granted legitimately or through an unrelated bug.",
-      docsUrl: "https://docs.lovable.dev/features/cloud",
+      docsUrl: "https://docs.lovable.dev/integrations/stripe",
       recommended: true
     },
     messages: {
@@ -3745,18 +3824,18 @@ var rule52 = {
     };
   }
 };
-var lovableExpiryColumnNeverCheckedRule = rule52;
+var lovableExpiryColumnNeverCheckedRule = rule51;
 
 // src/providers/lovable/rules/silent-catch-on-provider-call.ts
 var LOGGING_CONSOLE_METHODS = /* @__PURE__ */ new Set(["error", "warn", "log", "info"]);
-var rule53 = {
+var rule52 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "A catch block around an LLM provider call must log the failure",
       category: "correctness",
       rationale: `Returning null/undefined from a bare catch with no logging makes every failure mode \u2014 missing key, expired key, rate limit, malformed response, network error \u2014 look identical to "no key configured." If a deployment's provider key starts failing in production, this is invisible: there is nothing in the browser or error-tracking logs to distinguish a real outage from an intentionally-unconfigured feature.`,
-      docsUrl: "https://docs.lovable.dev/features/cloud",
+      docsUrl: "https://docs.lovable.dev/integrations/cloud",
       recommended: true
     },
     messages: {
@@ -3822,7 +3901,7 @@ var rule53 = {
     };
   }
 };
-var lovableSilentCatchOnProviderCallRule = rule53;
+var lovableSilentCatchOnProviderCallRule = rule52;
 
 // src/providers/browserbase/utils.ts
 function memberPropName3(node) {
@@ -3935,7 +4014,7 @@ function isTruthyGateTest(test) {
   }
   return false;
 }
-var rule54 = {
+var rule53 = {
   meta: {
     type: "problem",
     docs: {
@@ -4007,10 +4086,10 @@ var rule54 = {
     };
   }
 };
-var browserbaseNoConditionalAuthzOnAnonymousUserRule = rule54;
+var browserbaseNoConditionalAuthzOnAnonymousUserRule = rule53;
 
 // src/providers/browserbase/rules/no-connect-url-in-api-response.ts
-var rule55 = {
+var rule54 = {
   meta: {
     type: "problem",
     docs: {
@@ -4040,7 +4119,7 @@ var rule55 = {
     };
   }
 };
-var browserbaseNoConnectUrlInApiResponseRule = rule55;
+var browserbaseNoConnectUrlInApiResponseRule = rule54;
 
 // src/providers/browserbase/rules/session-id-requires-ownership-check.ts
 function isOwnershipCheckCall(node) {
@@ -4057,7 +4136,7 @@ function isSessionIdLikeArg(node) {
   }
   return false;
 }
-var rule56 = {
+var rule55 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -4065,7 +4144,7 @@ var rule56 = {
       category: "security",
       cwe: "CWE-862",
       rationale: "A session id alone is not an authorization token \u2014 it is an opaque identifier that can leak via links, logs, screenshots, or support tickets. A handler that resolves a sessionId straight into sessions.debug()/sessions.recording.retrieve() with no ownership/org-membership check lets any authenticated caller view or replay a session that belongs to someone else.",
-      docsUrl: "https://docs.browserbase.com/features/session-live-view",
+      docsUrl: "https://docs.browserbase.com/platform/browser/observability/session-live-view",
       recommended: true
     },
     messages: {
@@ -4121,7 +4200,7 @@ var rule56 = {
     };
   }
 };
-var browserbaseSessionIdRequiresOwnershipCheckRule = rule56;
+var browserbaseSessionIdRequiresOwnershipCheckRule = rule55;
 
 // src/providers/browserbase/rules/no-concurrent-shared-context.ts
 function isPromiseAllCall2(node) {
@@ -4178,14 +4257,14 @@ function findSharedContextCreateCall(callback) {
   visit(body);
   return found;
 }
-var rule57 = {
+var rule56 = {
   meta: {
     type: "problem",
     docs: {
       description: "A Browserbase Context must not be attached to concurrent sessions",
       category: "correctness",
       rationale: `Browserbase's docs state explicitly: "Avoid having multiple sessions using the same Context at once. Sites may force a log out." Passing the same browserSettings.context.id into every iteration of a Promise.all(items.map(...)) batch creates 2+ Browserbase sessions simultaneously attached to one Context, producing non-deterministic, flaky failures when a site force-logs-out one session because another concurrently authenticated against the same context.`,
-      docsUrl: "https://docs.browserbase.com/features/contexts",
+      docsUrl: "https://docs.browserbase.com/platform/browser/core-features/contexts",
       recommended: true
     },
     messages: {
@@ -4225,7 +4304,7 @@ var rule57 = {
     };
   }
 };
-var browserbaseNoConcurrentSharedContextRule = rule57;
+var browserbaseNoConcurrentSharedContextRule = rule56;
 
 // src/providers/browserbase/rules/mobile-device-requires-os-setting.ts
 function isMobileLiteral(node) {
@@ -4258,14 +4337,14 @@ function isOsMobileSetting(node) {
   }
   return false;
 }
-var rule58 = {
+var rule57 = {
   meta: {
     type: "problem",
     docs: {
       description: "Mobile device combos must set browserSettings.os, not just resize the viewport",
       category: "correctness",
       rationale: `The Node SDK's device emulation lever is browserSettings.os: 'mobile' | 'tablet' \u2014 there is no fingerprint API in this SDK. A "mobile" session that only resizes the Playwright viewport is still a desktop Chrome browser with a desktop user-agent string in a small window. Sites that branch behavior on UA/touch capability (the majority of responsive sites) never actually exercise their mobile code path, silently undermining "test on mobile" results.`,
-      docsUrl: "https://docs.browserbase.com/features/stealth-mode",
+      docsUrl: "https://docs.browserbase.com/platform/identity/verified-customization",
       recommended: true
     },
     messages: {
@@ -4297,7 +4376,7 @@ var rule58 = {
     };
   }
 };
-var browserbaseMobileDeviceRequiresOsSettingRule = rule58;
+var browserbaseMobileDeviceRequiresOsSettingRule = rule57;
 
 // src/providers/browserbase/rules/use-typed-exception-status-not-substring.ts
 function isStringifiedErrorSource(node, errName) {
@@ -4359,7 +4438,7 @@ function collectStringifiedVars(body, errName) {
   });
   return names;
 }
-var rule59 = {
+var rule58 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -4389,7 +4468,7 @@ var rule59 = {
     };
   }
 };
-var browserbaseUseTypedExceptionStatusNotSubstringRule = rule59;
+var browserbaseUseTypedExceptionStatusNotSubstringRule = rule58;
 
 // src/providers/browserbase/rules/release-session-on-connect-failure.ts
 function isSessionsCreateAwait(node) {
@@ -4412,7 +4491,7 @@ function isReleaseCall(node) {
   const name = callee?.type === "Identifier" ? callee.name : memberPropName3(node);
   return !!name && /requeststop|releasesession|release_session/i.test(name);
 }
-var rule60 = {
+var rule59 = {
   meta: {
     type: "problem",
     docs: {
@@ -4454,10 +4533,10 @@ var rule60 = {
     };
   }
 };
-var browserbaseReleaseSessionOnConnectFailureRule = rule60;
+var browserbaseReleaseSessionOnConnectFailureRule = rule59;
 
 // src/providers/browserbase/rules/dont-stack-custom-retry-on-sdk-retry.ts
-var rule61 = {
+var rule60 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -4502,7 +4581,7 @@ var rule61 = {
     };
   }
 };
-var browserbaseDontStackCustomRetryOnSdkRetryRule = rule61;
+var browserbaseDontStackCustomRetryOnSdkRetryRule = rule60;
 
 // src/providers/browserbase/rules/no-overbroad-error-substring-match.ts
 var OVERBROAD_TERMS = /* @__PURE__ */ new Set(["session", "context", "browser", "browserbase"]);
@@ -4524,7 +4603,7 @@ function isCleanupCall(node) {
   const name = callee?.type === "Identifier" ? callee.name : memberPropName3(node);
   return !!name && /release|remove|cleanup|stop|teardown/i.test(name);
 }
-var rule62 = {
+var rule61 = {
   meta: {
     type: "problem",
     docs: {
@@ -4554,7 +4633,7 @@ var rule62 = {
     };
   }
 };
-var browserbaseNoOverbroadErrorSubstringMatchRule = rule62;
+var browserbaseNoOverbroadErrorSubstringMatchRule = rule61;
 
 // src/providers/browserbase/rules/use-sdk-not-raw-requests.ts
 var BROWSERBASE_HOST = "api.browserbase.com";
@@ -4594,7 +4673,7 @@ function isRawHttpCall(node) {
   }
   return { isCall: false, urlArg: void 0 };
 }
-var rule63 = {
+var rule62 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -4628,10 +4707,10 @@ var rule63 = {
     };
   }
 };
-var browserbaseUseSdkNotRawRequestsRule = rule63;
+var browserbaseUseSdkNotRawRequestsRule = rule62;
 
 // src/providers/browserbase/rules/centralize-request-release.ts
-var rule64 = {
+var rule63 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -4664,11 +4743,11 @@ var rule64 = {
     };
   }
 };
-var browserbaseCentralizeRequestReleaseRule = rule64;
+var browserbaseCentralizeRequestReleaseRule = rule63;
 
 // src/providers/openai-cua/rules/no-domain-allowlist.ts
 var ACTION_METHOD_NAMES = /* @__PURE__ */ new Set(["click", "type", "press", "move", "goto", "fill", "dblclick", "dragAndDrop"]);
-var rule65 = {
+var rule64 = {
   meta: {
     type: "problem",
     docs: {
@@ -4794,11 +4873,11 @@ var rule65 = {
     };
   }
 };
-var openaiCuaNoDomainAllowlistRule = rule65;
+var openaiCuaNoDomainAllowlistRule = rule64;
 
 // src/providers/openai-cua/rules/scroll-delta-default-zero.ts
 var VERTICAL_DELTA_NAME_PATTERN = /^(dy|delta_?y|scroll_?y)$/i;
-var rule66 = {
+var rule65 = {
   meta: {
     type: "problem",
     docs: {
@@ -4874,12 +4953,12 @@ var rule66 = {
     };
   }
 };
-var openaiCuaScrollDeltaDefaultZeroRule = rule66;
+var openaiCuaScrollDeltaDefaultZeroRule = rule65;
 
 // src/providers/openai-cua/rules/structured-step-metadata-not-text-json.ts
 var BRACE_SEARCH_METHODS = /* @__PURE__ */ new Set(["indexOf", "lastIndexOf"]);
 var SLICE_METHODS = /* @__PURE__ */ new Set(["slice", "substring", "substr"]);
-var rule67 = {
+var rule66 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -4978,10 +5057,10 @@ var rule67 = {
     };
   }
 };
-var openaiCuaStructuredStepMetadataNotTextJsonRule = rule67;
+var openaiCuaStructuredStepMetadataNotTextJsonRule = rule66;
 
 // src/providers/openai-cua/rules/no-blind-safety-check-ack.ts
-var rule68 = {
+var rule67 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -5044,7 +5123,7 @@ var rule68 = {
     };
   }
 };
-var openaiCuaNoBlindSafetyCheckAckRule = rule68;
+var openaiCuaNoBlindSafetyCheckAckRule = rule67;
 
 // src/providers/openai-cua/utils.ts
 function propName(node) {
@@ -5090,7 +5169,7 @@ function findResponsesCreateCall(node, depth = 0) {
 }
 
 // src/providers/openai-cua/rules/retry-transient-turn-errors.ts
-var rule69 = {
+var rule68 = {
   meta: {
     type: "problem",
     docs: {
@@ -5172,10 +5251,10 @@ var rule69 = {
     };
   }
 };
-var openaiCuaRetryTransientTurnErrorsRule = rule69;
+var openaiCuaRetryTransientTurnErrorsRule = rule68;
 
 // src/providers/openai-cua/rules/check-response-status-incomplete.ts
-var rule70 = {
+var rule69 = {
   meta: {
     type: "problem",
     docs: {
@@ -5284,17 +5363,17 @@ var rule70 = {
     };
   }
 };
-var openaiCuaCheckResponseStatusIncompleteRule = rule70;
+var openaiCuaCheckResponseStatusIncompleteRule = rule69;
 
 // src/providers/openai-cua/rules/set-safety-identifier.ts
-var rule71 = {
+var rule70 = {
   meta: {
     type: "problem",
     docs: {
       description: "responses.create() must set safety_identifier for per-end-user policy attribution",
       category: "integration",
       rationale: "OpenAI documents that a stable per-end-user safety_identifier lets policy violations be attributed and acted on per end user. Without one on a multi-tenant integration routing many customers through a single shared API key, a single customer triggering a high-confidence policy-violation heuristic can result in access being temporarily revoked for the entire organization, not just the offending identifier.",
-      docsUrl: "https://help.openai.com/en/articles/5428082-how-to-incorporate-a-safety-identifier",
+      docsUrl: "https://developers.openai.com/api/docs/guides/safety-best-practices",
       recommended: true
     },
     messages: {
@@ -5325,10 +5404,10 @@ var rule71 = {
     };
   }
 };
-var openaiCuaSetSafetyIdentifierRule = rule71;
+var openaiCuaSetSafetyIdentifierRule = rule70;
 
 // src/providers/tiptap/rules/upload-validate-fn-void.ts
-var rule72 = {
+var rule71 = {
   meta: {
     type: "problem",
     docs: {
@@ -5392,10 +5471,10 @@ var rule72 = {
     };
   }
 };
-var tiptapUploadValidateFnVoidRule = rule72;
+var tiptapUploadValidateFnVoidRule = rule71;
 
 // src/providers/tiptap/rules/script-src-hardcoded-api-key.ts
-var rule73 = {
+var rule72 = {
   meta: {
     type: "problem",
     docs: {
@@ -5453,10 +5532,10 @@ var rule73 = {
     };
   }
 };
-var tiptapScriptSrcHardcodedApiKeyRule = rule73;
+var tiptapScriptSrcHardcodedApiKeyRule = rule72;
 
 // src/providers/tiptap/rules/dynamic-script-no-sri.ts
-var rule74 = {
+var rule73 = {
   meta: {
     type: "problem",
     docs: {
@@ -5465,7 +5544,7 @@ var rule74 = {
       cwe: "CWE-829",
       owasp: "API8:2023 Security Misconfiguration",
       rationale: 'A script element injected without an integrity attribute will execute whatever the CDN returns, including malicious content if the CDN is compromised. Adding a Subresource Integrity hash (script.setAttribute("integrity", "sha384-...")) lets the browser verify the fetched script matches the expected bytes before executing it.',
-      docsUrl: "https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity",
+      docsUrl: "https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity",
       recommended: true
     },
     messages: {
@@ -5552,7 +5631,7 @@ var rule74 = {
     };
   }
 };
-var tiptapDynamicScriptNoSriRule = rule74;
+var tiptapDynamicScriptNoSriRule = rule73;
 
 // src/providers/tiptap/utils.ts
 function findProperty3(objectExpression, name) {
@@ -5577,7 +5656,7 @@ function walk(node, visit) {
 }
 
 // src/providers/tiptap/rules/addAttributes-missing-renderHTML.ts
-var rule75 = {
+var rule74 = {
   meta: {
     type: "problem",
     docs: {
@@ -5630,10 +5709,10 @@ var rule75 = {
     };
   }
 };
-var tiptapAddAttributesMissingRenderHTMLRule = rule75;
+var tiptapAddAttributesMissingRenderHTMLRule = rule74;
 
 // src/providers/tiptap/rules/appendTransaction-add-to-history.ts
-var rule76 = {
+var rule75 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -5712,10 +5791,10 @@ var rule76 = {
     };
   }
 };
-var tiptapAppendTransactionAddToHistoryRule = rule76;
+var tiptapAppendTransactionAddToHistoryRule = rule75;
 
 // src/providers/tiptap/rules/appendTransaction-full-scan.ts
-var rule77 = {
+var rule76 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -5775,10 +5854,10 @@ var rule77 = {
     };
   }
 };
-var tiptapAppendTransactionFullScanRule = rule77;
+var tiptapAppendTransactionFullScanRule = rule76;
 
 // src/providers/tiptap/rules/atom-node-wrap-in.ts
-var rule78 = {
+var rule77 = {
   meta: {
     type: "problem",
     docs: {
@@ -5841,57 +5920,16 @@ var rule78 = {
     };
   }
 };
-var tiptapAtomNodeWrapInRule = rule78;
-
-// src/providers/tiptap/rules/twitter-url-regex.ts
-var rule79 = {
-  meta: {
-    type: "suggestion",
-    docs: {
-      description: "Twitter/X URL regex must match both x.com and twitter.com",
-      category: "integration",
-      rationale: "Twitter rebranded to X but twitter.com URLs still resolve and embed correctly. A regex that only matches x.com silently rejects all legacy twitter.com links pasted by users. Update the pattern to (x\\.com|twitter\\.com) so both domains are handled.",
-      docsUrl: "https://tiptap.dev/docs/editor/extensions/nodes",
-      recommended: true
-    },
-    messages: {
-      twitterRegexMissingLegacyDomain: "This regex matches x.com but not twitter.com. Legacy twitter.com URLs are still valid and should be supported. Add (x\\.com|twitter\\.com) to the pattern."
-    },
-    schema: []
-  },
-  create(context) {
-    function checkPattern(pattern, node) {
-      if (!pattern.includes("x\\.com") && !pattern.includes("x.com")) return;
-      if (pattern.includes("twitter\\.com") || pattern.includes("twitter.com")) return;
-      context.report({ node, messageId: "twitterRegexMissingLegacyDomain" });
-    }
-    return {
-      Literal(node) {
-        if (node.regex?.pattern) {
-          checkPattern(node.regex.pattern, node);
-        }
-      },
-      NewExpression(node) {
-        if (node.callee?.type === "Identifier" && node.callee.name === "RegExp") {
-          const firstArg = node.arguments?.[0];
-          if (firstArg?.type === "Literal" && typeof firstArg.value === "string") {
-            checkPattern(firstArg.value, node);
-          }
-        }
-      }
-    };
-  }
-};
-var tiptapTwitterUrlRegexRule = rule79;
+var tiptapAtomNodeWrapInRule = rule77;
 
 // src/providers/tiptap/rules/drop-handler-pos-precedence.ts
-var rule80 = {
+var rule78 = {
   meta: {
     type: "problem",
     docs: {
       description: "x ?? 0 - 1 is parsed as x ?? (0 - 1) = x ?? -1 due to operator precedence",
       category: "correctness",
-      rationale: "The nullish coalescing operator (??) has lower precedence than arithmetic operators. Writing `pos ?? 0 - 1` evaluates as `pos ?? -1`, not `(pos ?? 0) - 1`. When pos is null or undefined, the fallback is -1 instead of the intended -1 offset from 0. In ProseMirror drop handlers this produces a decoration at position -1, which corrupts the placeholder position map and can insert content at the document start.",
+      rationale: "The nullish coalescing operator (??) has lower precedence than arithmetic operators. Writing `pos ?? 0 - 1` evaluates as `pos ?? -1`, not `(pos ?? 0) - 1`. Whenever pos is defined, the expression yields pos instead of the intended pos - 1 \u2014 an off-by-one on every real drop. In ProseMirror drop handlers this misplaces the decoration/insert position, and the -1 fallback (when pos is nullish) is an invalid document position.",
       docsUrl: "https://prosemirror.net/docs/ref/#view.EditorView.posAtCoords",
       recommended: true
     },
@@ -5912,7 +5950,7 @@ var rule80 = {
     };
   }
 };
-var tiptapDropHandlerPosPrecedenceRule = rule80;
+var tiptapDropHandlerPosPrecedenceRule = rule78;
 
 // src/providers/tiptap/rules/prefer-table-kit.ts
 var INDIVIDUAL_TABLE_PACKAGES = /* @__PURE__ */ new Set([
@@ -5920,18 +5958,18 @@ var INDIVIDUAL_TABLE_PACKAGES = /* @__PURE__ */ new Set([
   "@tiptap/extension-table-cell",
   "@tiptap/extension-table-header"
 ]);
-var rule81 = {
+var rule79 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "Use TableKit from @tiptap/extension-table instead of individual table packages",
       category: "integration",
-      rationale: "Importing table extensions individually from their separate packages bypasses the coordinated wiring that TableKit provides: shared configuration, the mergeOrSplit command, and consistent HTMLAttributes across all table elements. Individual imports also leave TableCell and TableHeader unconfigured by default.",
+      rationale: "Importing table extensions individually from their separate packages bypasses the coordinated wiring that TableKit provides: shared configuration and consistent HTMLAttributes across all table elements, configured in one place. TableKit from @tiptap/extension-table is the documented way to register the full table feature set.",
       docsUrl: "https://tiptap.dev/docs/editor/extensions/functionality/table-kit",
       recommended: true
     },
     messages: {
-      preferTableKit: "Individual TipTap table extension imported. Use TableKit from @tiptap/extension-table for coordinated configuration and the mergeOrSplit command."
+      preferTableKit: "Individual TipTap table extension imported. Use TableKit from @tiptap/extension-table to configure all table elements together."
     },
     schema: []
   },
@@ -5954,21 +5992,21 @@ var rule81 = {
     };
   }
 };
-var tiptapPreferTableKitRule = rule81;
+var tiptapPreferTableKitRule = rule79;
 
 // src/providers/tiptap/rules/tiptap-markdown-missing-node-spec.ts
-var rule82 = {
+var rule80 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "TipTap nodes used with tiptap-markdown must define a markdown serialization spec",
       category: "integration",
-      rationale: "When tiptap-markdown serializes a document, nodes without a markdown spec are silently dropped or emitted as empty strings. Custom node types must register a serialize/parse pair via MarkdownNodeSpec (in addStorage or addOptions) so content survives markdown export/import cycles.",
-      docsUrl: "https://github.com/ueberdosis/tiptap-markdown",
+      rationale: "When tiptap-markdown serializes a document, nodes without a markdown spec are silently dropped or emitted as empty strings. Custom node types must register a serialize/parse pair (MarkdownNodeSpec) under a `markdown` key returned from addStorage \u2014 the library reads only extension.storage.markdown \u2014 so content survives markdown export/import cycles.",
+      docsUrl: "https://github.com/aguingand/tiptap-markdown",
       recommended: true
     },
     messages: {
-      missingMarkdownNodeSpec: "This TipTap node is used alongside tiptap-markdown but defines no markdown serialization. Nodes without a markdown spec are silently dropped on export. Add a MarkdownNodeSpec to addStorage or addOptions."
+      missingMarkdownNodeSpec: "This TipTap node is used alongside tiptap-markdown but defines no markdown serialization. Nodes without a markdown spec are silently dropped on export. Return a markdown spec (MarkdownNodeSpec) from addStorage."
     },
     schema: []
   },
@@ -6023,7 +6061,2093 @@ var rule82 = {
     };
   }
 };
-var tiptapTiptapMarkdownMissingNodeSpecRule = rule82;
+var tiptapTiptapMarkdownMissingNodeSpecRule = rule80;
+
+// src/providers/elevenlabs/utils.ts
+function isElevenLabsUrlArg(node) {
+  if (!node) return false;
+  if (node.type === "Literal" && typeof node.value === "string") {
+    return node.value.includes("elevenlabs.io");
+  }
+  if (node.type === "TemplateLiteral") {
+    return (node.quasis ?? []).some(
+      (q) => typeof q?.value?.raw === "string" && q.value.raw.includes("elevenlabs.io")
+    );
+  }
+  return false;
+}
+function findElevenLabsFetchCall(node, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 20) return null;
+  if (Array.isArray(node)) {
+    for (const n of node) {
+      const found = findElevenLabsFetchCall(n, depth + 1);
+      if (found) return found;
+    }
+    return null;
+  }
+  if (node.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "fetch") {
+    if (isElevenLabsUrlArg(node.arguments?.[0])) return node;
+  }
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object") {
+      const found = findElevenLabsFetchCall(val, depth + 1);
+      if (found) return found;
+    }
+  }
+  return null;
+}
+function unwrapAwait(node) {
+  return node?.type === "AwaitExpression" ? node.argument : node;
+}
+function collectVarDeclarators(node, out, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 24) return;
+  if (Array.isArray(node)) {
+    for (const n of node) collectVarDeclarators(n, out, depth + 1);
+    return;
+  }
+  if (node.type === "VariableDeclarator") out.push(node);
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object") collectVarDeclarators(val, out, depth + 1);
+  }
+}
+function posOf(n) {
+  if (typeof n?.range?.[0] === "number") return n.range[0];
+  const line = n?.loc?.start?.line ?? 0;
+  const column = n?.loc?.start?.column ?? 0;
+  return line * 1e6 + column;
+}
+
+// src/providers/elevenlabs/rules/validate-signed-url-response.ts
+var rule81 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "ElevenLabs signed URL responses must be validated before the signed_url field is used",
+      category: "correctness",
+      cwe: "CWE-252",
+      rationale: "The signed-url endpoint assumes the ElevenLabs API always returns a well-formed body. If the API ever returns an unexpected shape (error payload, empty body, schema change), `data.signed_url` is silently `undefined` and the failure only surfaces downstream when the client tries to connect with an invalid URL.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/api-reference/conversations/get-signed-url",
+      recommended: true
+    },
+    messages: {
+      missingValidation: "This code reads signed_url from the ElevenLabs API response without checking that the field exists. A malformed or unexpected response will silently produce an undefined signed URL."
+    }
+  },
+  create(context) {
+    function analyzeFunction(fnNode) {
+      const declarators = [];
+      collectVarDeclarators(fnNode.body, declarators);
+      const responseVarNames = [];
+      for (const d of declarators) {
+        const init = unwrapAwait(d.init);
+        if (init?.type === "CallExpression" && init.callee?.type === "Identifier" && init.callee.name === "fetch" && isElevenLabsUrlArg(init.arguments?.[0]) && d.id?.type === "Identifier") {
+          responseVarNames.push(d.id.name);
+        }
+      }
+      if (responseVarNames.length === 0) return;
+      for (const responseVarName of responseVarNames) {
+        for (const d of declarators) {
+          const init = unwrapAwait(d.init);
+          if (init?.type === "CallExpression" && init.callee?.type === "MemberExpression" && init.callee.property?.type === "Identifier" && init.callee.property.name === "json" && init.callee.object?.type === "Identifier" && init.callee.object.name === responseVarName && d.id?.type === "Identifier") {
+            analyzeDataVar(fnNode, d.id.name, d);
+          }
+        }
+      }
+    }
+    function analyzeDataVar(fnNode, dataVarName, dataDeclaratorNode) {
+      function isSignedUrlMember(n) {
+        if (n?.type !== "MemberExpression") return false;
+        if (n.object?.type !== "Identifier" || n.object.name !== dataVarName) return false;
+        if (!n.computed) return n.property?.type === "Identifier" && n.property.name === "signed_url";
+        return n.property?.type === "Literal" && n.property.value === "signed_url";
+      }
+      function isNullishLiteral(n) {
+        return n?.type === "Identifier" && n.name === "undefined" || n?.type === "Literal" && n.value === null;
+      }
+      function isFalsyGuardOnSignedUrl(test) {
+        if (!test) return false;
+        if (test.type === "UnaryExpression" && test.operator === "!") {
+          return isSignedUrlMember(test.argument);
+        }
+        if (test.type === "BinaryExpression" && (test.operator === "==" || test.operator === "===")) {
+          return isSignedUrlMember(test.left) && isNullishLiteral(test.right) || isSignedUrlMember(test.right) && isNullishLiteral(test.left);
+        }
+        if (test.type === "LogicalExpression") {
+          return isFalsyGuardOnSignedUrl(test.left) || isFalsyGuardOnSignedUrl(test.right);
+        }
+        return false;
+      }
+      let guardPos = null;
+      let usagePos = null;
+      function walk2(n, depth = 0) {
+        if (!n || typeof n !== "object" || depth > 40) return;
+        if (Array.isArray(n)) {
+          for (const item of n) walk2(item, depth + 1);
+          return;
+        }
+        if (n.type === "IfStatement" && isFalsyGuardOnSignedUrl(n.test)) {
+          const p = posOf(n);
+          if (guardPos === null || p < guardPos) guardPos = p;
+        }
+        if (isSignedUrlMember(n) && n !== dataDeclaratorNode) {
+          const p = posOf(n);
+          if (usagePos === null || p < usagePos) usagePos = p;
+        }
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range") continue;
+          const val = n[key];
+          if (val && typeof val === "object") walk2(val, depth + 1);
+        }
+      }
+      walk2(fnNode.body);
+      if (usagePos === null) return;
+      if (guardPos !== null && guardPos < usagePos) return;
+      context.report({ node: dataDeclaratorNode, messageId: "missingValidation" });
+    }
+    return {
+      FunctionDeclaration(node) {
+        analyzeFunction(node);
+      },
+      FunctionExpression(node) {
+        analyzeFunction(node);
+      },
+      ArrowFunctionExpression(node) {
+        analyzeFunction(node);
+      }
+    };
+  }
+};
+var elevenlabsValidateSignedUrlResponseRule = rule81;
+
+// src/providers/elevenlabs/rules/no-error-object-logging.ts
+var LOGGING_METHODS = /* @__PURE__ */ new Set(["error", "warn", "log"]);
+var rule82 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Catch blocks must not log the raw caught error object",
+      category: "security",
+      cwe: "CWE-532",
+      rationale: "Error objects thrown by fetch/SDK calls can carry response bodies, headers, or internal state. Logging them directly with console.error(error) writes that data verbatim into server logs, which may be shipped to third-party log aggregators or be readable by anyone with log access.",
+      docsUrl: "https://elevenlabs.io/docs/api-reference/authentication",
+      recommended: true
+    },
+    messages: {
+      rawErrorLogged: "This catch block logs the raw error object instead of a sanitized message \u2014 error responses, headers, or internal state may leak into server logs."
+    }
+  },
+  create(context) {
+    function isConsoleLogCall(node) {
+      if (node?.type !== "CallExpression") return false;
+      const callee = node.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      if (callee.object?.type !== "Identifier" || callee.object.name !== "console") return false;
+      return callee.property?.type === "Identifier" && LOGGING_METHODS.has(callee.property.name);
+    }
+    function referencesRawIdentifier(node, paramName, depth = 0) {
+      if (!node || typeof node !== "object" || depth > 10) return false;
+      if (Array.isArray(node)) return node.some((n) => referencesRawIdentifier(n, paramName, depth + 1));
+      if (node.type === "Identifier" && node.name === paramName) return true;
+      if (node.type === "ObjectExpression") {
+        return (node.properties ?? []).some((p) => {
+          if (p.type !== "Property") return false;
+          return referencesRawIdentifier(p.value, paramName, depth + 1);
+        });
+      }
+      if (node.type === "ArrayExpression") {
+        return (node.elements ?? []).some((el) => referencesRawIdentifier(el, paramName, depth + 1));
+      }
+      return false;
+    }
+    return {
+      TryStatement(node) {
+        if (!findElevenLabsFetchCall(node.block)) return;
+        const handler = node.handler;
+        const paramName = handler?.param?.type === "Identifier" ? handler.param.name : null;
+        if (!paramName) return;
+        function walk2(n, depth = 0) {
+          if (!n || typeof n !== "object" || depth > 30) return;
+          if (Array.isArray(n)) {
+            for (const item of n) walk2(item, depth + 1);
+            return;
+          }
+          if (isConsoleLogCall(n)) {
+            const args = n.arguments ?? [];
+            const loggedRaw = args.some((a) => referencesRawIdentifier(a, paramName));
+            if (loggedRaw) {
+              context.report({ node: n, messageId: "rawErrorLogged" });
+            }
+          }
+          for (const key of Object.keys(n)) {
+            if (key === "parent" || key === "loc" || key === "range") continue;
+            const val = n[key];
+            if (val && typeof val === "object") walk2(val, depth + 1);
+          }
+        }
+        walk2(handler.body);
+      }
+    };
+  }
+};
+var elevenlabsNoErrorObjectLoggingRule = rule82;
+
+// src/providers/elevenlabs/rules/fetch-timeout-required.ts
+var rule83 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Fetch calls to the ElevenLabs API must set an abort timeout",
+      category: "reliability",
+      rationale: "Native fetch has no default timeout. If the ElevenLabs API becomes slow or hangs, a request with no AbortController/signal will wait indefinitely, tying up the request handler and starving the server of available connections.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/api-reference/conversations/get-signed-url",
+      recommended: true
+    },
+    messages: {
+      missingTimeout: "This fetch call to the ElevenLabs API has no abort signal/timeout \u2014 a slow or unresponsive API will hang the request indefinitely."
+    }
+  },
+  create(context) {
+    function hasSignalOption(optionsArg) {
+      if (optionsArg?.type !== "ObjectExpression") return false;
+      return (optionsArg.properties ?? []).some((p) => {
+        if (p.type === "SpreadElement") return true;
+        return p.type === "Property" && p.key?.type === "Identifier" && p.key.name === "signal";
+      });
+    }
+    return {
+      CallExpression(node) {
+        if (node.callee?.type !== "Identifier" || node.callee.name !== "fetch") return;
+        if (!isElevenLabsUrlArg(node.arguments?.[0])) return;
+        const optionsArg = node.arguments?.[1];
+        if (hasSignalOption(optionsArg)) return;
+        context.report({ node, messageId: "missingTimeout" });
+      }
+    };
+  }
+};
+var elevenlabsFetchTimeoutRequiredRule = rule83;
+
+// src/providers/elevenlabs/rules/validate-agent-id-format.ts
+var rule84 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "agentId must be format-validated, not just checked for existence, before use",
+      category: "correctness",
+      cwe: "CWE-20",
+      rationale: "A query-param agentId that is only checked with `if (!agentId)` accepts any non-empty string. An attacker can pass arbitrary values \u2014 oversized strings, path-traversal-like sequences, or characters the ElevenLabs API was never designed to receive \u2014 directly into the request URL, producing undefined behavior instead of a clean 400.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/customization/authentication",
+      recommended: true
+    },
+    messages: {
+      missingFormatValidation: "agentId is checked for existence but never validated against an expected format before being used in an ElevenLabs API request."
+    }
+  },
+  create(context) {
+    function isSearchParamsGetAgentId(node) {
+      if (node?.type !== "CallExpression") return false;
+      const callee = node.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      if (callee.property?.type !== "Identifier" || callee.property.name !== "get") return false;
+      const arg = node.arguments?.[0];
+      return arg?.type === "Literal" && arg.value === "agentId";
+    }
+    function analyzeFunction(fnNode) {
+      const declarators = [];
+      collectVarDeclarators(fnNode.body, declarators);
+      let agentIdVarName = null;
+      let agentIdDeclaratorNode = null;
+      for (const d of declarators) {
+        const init = unwrapAwait(d.init);
+        if (isSearchParamsGetAgentId(init) && d.id?.type === "Identifier") {
+          agentIdVarName = d.id.name;
+          agentIdDeclaratorNode = d;
+        }
+      }
+      if (!agentIdVarName) {
+        for (const param of fnNode.params ?? []) {
+          if (param?.type === "Identifier" && param.name === "agentId") {
+            agentIdVarName = param.name;
+            agentIdDeclaratorNode = param;
+          }
+        }
+      }
+      if (!agentIdVarName) return;
+      function isAgentIdMember(n) {
+        return n?.type === "Identifier" && n.name === agentIdVarName;
+      }
+      function isFormatCheck(n, depth = 0) {
+        if (!n || typeof n !== "object" || depth > 10) return false;
+        if (Array.isArray(n)) return n.some((x) => isFormatCheck(x, depth + 1));
+        if (n.type === "CallExpression" && n.callee?.type === "MemberExpression") {
+          const propName2 = n.callee.property?.type === "Identifier" ? n.callee.property.name : null;
+          if (propName2 === "test" && isAgentIdMember(n.arguments?.[0])) return true;
+          if ((propName2 === "match" || propName2 === "matchAll") && isAgentIdMember(n.callee.object)) return true;
+        }
+        if (n.type === "LogicalExpression") {
+          return isFormatCheck(n.left, depth + 1) || isFormatCheck(n.right, depth + 1);
+        }
+        if (n.type === "UnaryExpression") return isFormatCheck(n.argument, depth + 1);
+        return false;
+      }
+      let formatGuardPos = null;
+      let usagePos = null;
+      function walk2(n, depth = 0) {
+        if (!n || typeof n !== "object" || depth > 40) return;
+        if (Array.isArray(n)) {
+          for (const item of n) walk2(item, depth + 1);
+          return;
+        }
+        if (n.type === "IfStatement" && isFormatCheck(n.test)) {
+          const p = posOf(n);
+          if (formatGuardPos === null || p < formatGuardPos) formatGuardPos = p;
+        }
+        if (n.type === "CallExpression" && n.callee?.type === "Identifier" && n.callee.name === "fetch" && isElevenLabsUrlArg(n.arguments?.[0])) {
+          const urlArg = n.arguments[0];
+          const containsAgentId = urlArg.type === "TemplateLiteral" && (urlArg.expressions ?? []).some((e) => isAgentIdMember(e));
+          if (containsAgentId) {
+            const p = posOf(n);
+            if (usagePos === null || p < usagePos) usagePos = p;
+          }
+        }
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range") continue;
+          const val = n[key];
+          if (val && typeof val === "object") walk2(val, depth + 1);
+        }
+      }
+      walk2(fnNode.body);
+      if (usagePos === null) return;
+      if (formatGuardPos !== null && formatGuardPos < usagePos) return;
+      context.report({ node: agentIdDeclaratorNode, messageId: "missingFormatValidation" });
+    }
+    return {
+      FunctionDeclaration(node) {
+        analyzeFunction(node);
+      },
+      FunctionExpression(node) {
+        analyzeFunction(node);
+      },
+      ArrowFunctionExpression(node) {
+        analyzeFunction(node);
+      }
+    };
+  }
+};
+var elevenlabsValidateAgentIdFormatRule = rule84;
+
+// src/providers/elevenlabs/rules/secure-session-id-generation.ts
+var rule85 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Session ids must be generated with a cryptographically secure RNG",
+      category: "security",
+      cwe: "CWE-338",
+      rationale: 'Math.random() is a non-cryptographic PRNG \u2014 its output can be predicted by an attacker who observes enough samples or knows the engine implementation. If a "session_*" value derived from it is later trusted for routing, deduplication, or any access-control-adjacent decision, that predictability can be exploited.',
+      docsUrl: "https://elevenlabs.io/docs/eleven-api/guides/how-to/best-practices/security",
+      recommended: true
+    },
+    messages: {
+      insecureSessionId: "This session id is generated with Math.random(), which is not cryptographically secure and can be predicted. Use crypto.getRandomValues() instead."
+    }
+  },
+  create(context) {
+    function containsMathRandomCall(node, depth = 0) {
+      if (!node || typeof node !== "object" || depth > 20) return false;
+      if (Array.isArray(node)) return node.some((n) => containsMathRandomCall(n, depth + 1));
+      if (node.type === "CallExpression" && node.callee?.type === "MemberExpression" && node.callee.object?.type === "Identifier" && node.callee.object.name === "Math" && node.callee.property?.type === "Identifier" && node.callee.property.name === "random") {
+        return true;
+      }
+      for (const key of Object.keys(node)) {
+        if (key === "parent" || key === "loc" || key === "range") continue;
+        const val = node[key];
+        if (val && typeof val === "object" && containsMathRandomCall(val, depth + 1)) return true;
+      }
+      return false;
+    }
+    function looksLikeSessionId(name) {
+      return typeof name === "string" && /session/i.test(name);
+    }
+    function isSessionIdValue(init) {
+      if (init?.type === "TemplateLiteral") {
+        const firstQuasi = init.quasis?.[0]?.value?.raw ?? "";
+        if (/session[-_]?/i.test(firstQuasi) && containsMathRandomCall(init)) return true;
+      }
+      if (init?.type === "BinaryExpression" && init.operator === "+") {
+        const leftLiteral = init.left?.type === "Literal" && typeof init.left.value === "string";
+        if (leftLiteral && /session[-_]?/i.test(init.left.value) && containsMathRandomCall(init)) return true;
+      }
+      return false;
+    }
+    return {
+      VariableDeclarator(node) {
+        const init = node.init;
+        if (!init) return;
+        const declaredName = node.id?.type === "Identifier" ? node.id.name : node.id?.type === "ArrayPattern" && node.id.elements?.[0]?.type === "Identifier" ? node.id.elements[0].name : void 0;
+        let valueNode = init;
+        if (init.type === "CallExpression" && init.callee?.type === "Identifier" && init.callee.name === "useState" && init.arguments?.[0]?.type === "ArrowFunctionExpression") {
+          const body = init.arguments[0].body;
+          valueNode = body?.type === "BlockStatement" ? null : body;
+          if (body?.type === "BlockStatement") {
+            const returnStmt = (body.body ?? []).find((s) => s.type === "ReturnStatement");
+            valueNode = returnStmt?.argument ?? null;
+          }
+        }
+        if (!valueNode) return;
+        if (!looksLikeSessionId(declaredName) && !isSessionIdValue(valueNode)) return;
+        if (!containsMathRandomCall(valueNode)) return;
+        context.report({ node, messageId: "insecureSessionId" });
+      }
+    };
+  }
+};
+var elevenlabsSecureSessionIdGenerationRule = rule85;
+
+// src/providers/elevenlabs/rules/conversation-error-recovery.ts
+var rule86 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "A loading flag set before starting a conversation must be reset on failure",
+      category: "reliability",
+      rationale: 'If startConversation() sets isLoading true and getSignedUrl()/Conversation.startSession() throws, the loading flag must be reset in the catch or finally block. Otherwise the UI is stuck "loading" forever and the user can trigger overlapping conversation attempts by clicking again.',
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/libraries/java-script",
+      recommended: true
+    },
+    messages: {
+      missingLoadingReset: "This function sets a loading flag true before a try block, but neither the catch nor a finally block resets it to false on failure."
+    }
+  },
+  create(context) {
+    function isSetterCallWithBoolean(n, setterName, expected) {
+      if (n?.type !== "CallExpression") return false;
+      if (n.callee?.type !== "Identifier" || n.callee.name !== setterName) return false;
+      const arg = n.arguments?.[0];
+      return arg?.type === "Literal" && arg.value === expected;
+    }
+    function containsCall(node, predicate, depth = 0) {
+      if (!node || typeof node !== "object" || depth > 20) return false;
+      if (Array.isArray(node)) return node.some((n) => containsCall(n, predicate, depth + 1));
+      if (predicate(node)) return true;
+      for (const key of Object.keys(node)) {
+        if (key === "parent" || key === "loc" || key === "range") continue;
+        const val = node[key];
+        if (val && typeof val === "object" && containsCall(val, predicate, depth + 1)) return true;
+      }
+      return false;
+    }
+    function findLoadingSetterFromUseState(fnNode) {
+      let setterName = null;
+      function collect(n, depth = 0) {
+        if (setterName || !n || typeof n !== "object" || depth > 20) return;
+        if (Array.isArray(n)) {
+          for (const item of n) collect(item, depth + 1);
+          return;
+        }
+        if (n.type === "VariableDeclarator" && n.id?.type === "ArrayPattern" && n.id.elements?.length === 2 && n.id.elements[0]?.type === "Identifier" && /loading/i.test(n.id.elements[0].name) && n.id.elements[1]?.type === "Identifier" && n.init?.type === "CallExpression" && n.init.callee?.type === "Identifier" && n.init.callee.name === "useState") {
+          setterName = n.id.elements[1].name;
+          return;
+        }
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range") continue;
+          const val = n[key];
+          if (val && typeof val === "object") collect(val, depth + 1);
+        }
+      }
+      collect(fnNode);
+      return setterName;
+    }
+    function isLoadingTrueStatement(stmt, setterName) {
+      return stmt?.type === "ExpressionStatement" && isSetterCallWithBoolean(stmt.expression, setterName, true);
+    }
+    function analyzeFunction(fnNode) {
+      const setterName = findLoadingSetterFromUseState(fnNode);
+      if (!setterName) return;
+      function walk2(n, depth = 0) {
+        if (!n || typeof n !== "object" || depth > 30) return;
+        if (Array.isArray(n)) {
+          for (const item of n) walk2(item, depth + 1);
+          return;
+        }
+        if (n.type === "BlockStatement" && Array.isArray(n.body)) {
+          for (let i = 0; i < n.body.length - 1; i++) {
+            if (!isLoadingTrueStatement(n.body[i], setterName)) continue;
+            const tryNode = n.body[i + 1];
+            if (tryNode?.type !== "TryStatement") continue;
+            const handler = tryNode.handler;
+            const finalizer = tryNode.finalizer;
+            const finallyResets = finalizer && containsCall(finalizer, (x) => isSetterCallWithBoolean(x, setterName, false));
+            const catchResets = handler && containsCall(handler.body, (x) => isSetterCallWithBoolean(x, setterName, false));
+            if (!finallyResets && !catchResets) {
+              context.report({ node: tryNode, messageId: "missingLoadingReset" });
+            }
+          }
+        }
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range") continue;
+          const val = n[key];
+          if (val && typeof val === "object") walk2(val, depth + 1);
+        }
+      }
+      walk2(fnNode.body);
+    }
+    return {
+      FunctionDeclaration(node) {
+        analyzeFunction(node);
+      },
+      FunctionExpression(node) {
+        analyzeFunction(node);
+      },
+      ArrowFunctionExpression(node) {
+        analyzeFunction(node);
+      }
+    };
+  }
+};
+var elevenlabsConversationErrorRecoveryRule = rule86;
+
+// src/providers/elevenlabs/rules/api-version-pinning.ts
+var rule87 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "ElevenLabs API requests should pin an explicit API version header",
+      category: "reliability",
+      rationale: "The endpoint is hardcoded to /v1 in the URL path with no explicit version header. If ElevenLabs ships a v2 API and changes default response behavior for unversioned clients, requests with no version header silently pick up the new behavior instead of failing loudly or staying pinned.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-api/resources/breaking-changes-policy",
+      recommended: true
+    },
+    messages: {
+      missingVersionHeader: "This fetch call to the ElevenLabs API has no explicit API version header \u2014 a future API change could silently alter behavior."
+    }
+  },
+  create(context) {
+    function hasVersionHeader(optionsArg) {
+      if (optionsArg?.type !== "ObjectExpression") return false;
+      const headersProp = (optionsArg.properties ?? []).find(
+        (p) => p.type === "Property" && p.key?.type === "Identifier" && p.key.name === "headers"
+      );
+      if (!headersProp) return false;
+      if (headersProp.value?.type !== "ObjectExpression") return true;
+      return (headersProp.value.properties ?? []).some((p) => {
+        if (p.type === "SpreadElement") return true;
+        if (p.type !== "Property") return false;
+        const keyName = p.key?.type === "Identifier" ? p.key.name : p.key?.type === "Literal" ? p.key.value : null;
+        return typeof keyName === "string" && /version/i.test(keyName);
+      });
+    }
+    return {
+      CallExpression(node) {
+        if (node.callee?.type !== "Identifier" || node.callee.name !== "fetch") return;
+        if (!isElevenLabsUrlArg(node.arguments?.[0])) return;
+        const optionsArg = node.arguments?.[1];
+        if (hasVersionHeader(optionsArg)) return;
+        context.report({ node, messageId: "missingVersionHeader" });
+      }
+    };
+  }
+};
+var elevenlabsApiVersionPinningRule = rule87;
+
+// src/providers/elevenlabs/rules/check-http-status-before-json.ts
+var rule88 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "response.json() must not be called before checking the HTTP status of an ElevenLabs response",
+      category: "correctness",
+      rationale: "Calling response.json() unconditionally parses whatever body the server returned, including error payloads, as if it were a successful response. Without checking response.ok (or response.status) first, a 4xx/5xx error from the ElevenLabs API is silently treated as valid data.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-api/resources/errors",
+      recommended: true
+    },
+    messages: {
+      missingStatusCheck: "response.json() is called on this ElevenLabs API response without first checking response.ok/status \u2014 an error response will be parsed as if it were valid data."
+    }
+  },
+  create(context) {
+    function analyzeFunction(fnNode) {
+      const declarators = [];
+      collectVarDeclarators(fnNode.body, declarators);
+      const responseVarNames = [];
+      for (const d of declarators) {
+        const init = unwrapAwait(d.init);
+        if (init?.type === "CallExpression" && init.callee?.type === "Identifier" && init.callee.name === "fetch" && isElevenLabsUrlArg(init.arguments?.[0]) && d.id?.type === "Identifier") {
+          responseVarNames.push(d.id.name);
+        }
+      }
+      for (const responseVarName of responseVarNames) {
+        analyzeResponseVar(fnNode, responseVarName);
+      }
+    }
+    function analyzeResponseVar(fnNode, responseVarName) {
+      function isResponseStatusCheck(test) {
+        if (!test) return false;
+        if (test.type === "UnaryExpression" && test.operator === "!") return isResponseStatusCheck(test.argument);
+        if (test.type === "MemberExpression" && test.object?.type === "Identifier" && test.object.name === responseVarName && test.property?.type === "Identifier" && test.property.name === "ok") {
+          return true;
+        }
+        if (test.type === "BinaryExpression") {
+          const sideIsStatus = (n) => n?.type === "MemberExpression" && n.object?.type === "Identifier" && n.object.name === responseVarName && n.property?.type === "Identifier" && n.property.name === "status";
+          if (sideIsStatus(test.left) || sideIsStatus(test.right)) return true;
+        }
+        if (test.type === "LogicalExpression") {
+          return isResponseStatusCheck(test.left) || isResponseStatusCheck(test.right);
+        }
+        return false;
+      }
+      function isResponseJsonCall2(n) {
+        if (n?.type !== "CallExpression") return false;
+        const callee = n.callee;
+        if (callee?.type !== "MemberExpression") return false;
+        if (callee.property?.type !== "Identifier" || callee.property.name !== "json") return false;
+        return callee.object?.type === "Identifier" && callee.object.name === responseVarName;
+      }
+      let guardPos = null;
+      let jsonCallNode = null;
+      let jsonCallPos = null;
+      function walk2(n, depth = 0) {
+        if (!n || typeof n !== "object" || depth > 40) return;
+        if (Array.isArray(n)) {
+          for (const item of n) walk2(item, depth + 1);
+          return;
+        }
+        if (n.type === "IfStatement" && isResponseStatusCheck(n.test)) {
+          const p = posOf(n);
+          if (guardPos === null || p < guardPos) guardPos = p;
+        }
+        if (isResponseJsonCall2(n)) {
+          const p = posOf(n);
+          if (jsonCallPos === null || p < jsonCallPos) {
+            jsonCallPos = p;
+            jsonCallNode = n;
+          }
+        }
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range") continue;
+          const val = n[key];
+          if (val && typeof val === "object") walk2(val, depth + 1);
+        }
+      }
+      walk2(fnNode.body);
+      if (jsonCallPos === null) return;
+      if (guardPos !== null && guardPos < jsonCallPos) return;
+      context.report({ node: jsonCallNode, messageId: "missingStatusCheck" });
+    }
+    return {
+      FunctionDeclaration(node) {
+        analyzeFunction(node);
+      },
+      FunctionExpression(node) {
+        analyzeFunction(node);
+      },
+      ArrowFunctionExpression(node) {
+        analyzeFunction(node);
+      }
+    };
+  }
+};
+var elevenlabsCheckHttpStatusBeforeJsonRule = rule88;
+
+// src/providers/elevenlabs/rules/conversation-cleanup-on-error.ts
+var END_METHODS = /* @__PURE__ */ new Set(["endSession", "endConversation"]);
+var rule89 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Ending a conversation must be wrapped in try/catch so a rejected call is handled",
+      category: "reliability",
+      rationale: "If conversation.endSession()/endConversation() rejects (e.g. during a GL-mode transition) and the call site has no try/catch, the rejection becomes an unhandled promise rejection and the conversation state is never cleaned up, leaving stale connections in memory.",
+      docsUrl: "https://elevenlabs.io/docs/eleven-agents/libraries/java-script",
+      recommended: true
+    },
+    messages: {
+      missingTryCatch: "This call to end the conversation has no surrounding try/catch \u2014 a rejection will go unhandled and the conversation state may never be cleaned up."
+    }
+  },
+  create(context) {
+    function posEnd(n) {
+      if (typeof n?.range?.[1] === "number") return n.range[1];
+      const line = n?.loc?.end?.line ?? n?.loc?.start?.line ?? 0;
+      const column = n?.loc?.end?.column ?? n?.loc?.start?.column ?? 0;
+      return line * 1e6 + column;
+    }
+    function isConversationEndCall(node) {
+      if (node?.type !== "CallExpression") return false;
+      const callee = node.callee;
+      if (callee?.type === "MemberExpression") {
+        return callee.property?.type === "Identifier" && END_METHODS.has(callee.property.name);
+      }
+      return callee?.type === "Identifier" && END_METHODS.has(callee.name);
+    }
+    return {
+      "Program:exit"(program) {
+        const tryRanges = [];
+        const endCalls = [];
+        function walk2(n, depth = 0) {
+          if (!n || typeof n !== "object" || depth > 60) return;
+          if (Array.isArray(n)) {
+            for (const item of n) walk2(item, depth + 1);
+            return;
+          }
+          if (n.type === "TryStatement" && n.block) {
+            tryRanges.push([posOf(n.block), posEnd(n.block)]);
+          }
+          if (isConversationEndCall(n)) endCalls.push(n);
+          for (const key of Object.keys(n)) {
+            if (key === "parent" || key === "loc" || key === "range") continue;
+            const val = n[key];
+            if (val && typeof val === "object") walk2(val, depth + 1);
+          }
+        }
+        walk2(program);
+        for (const call of endCalls) {
+          const p = posOf(call);
+          const covered = tryRanges.some(([start, end]) => p >= start && p <= end);
+          if (!covered) {
+            context.report({ node: call, messageId: "missingTryCatch" });
+          }
+        }
+      }
+    };
+  }
+};
+var elevenlabsConversationCleanupOnErrorRule = rule89;
+
+// src/providers/elevenlabs/rules/env-var-validation.ts
+var ELEVENLABS_ENV_VAR_PATTERN = /^(XI_API_KEY|ELEVENLABS_API_KEY)$/;
+var rule90 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "ElevenLabs API key environment variables should be validated at module load, not only at request time",
+      category: "correctness",
+      rationale: "Checking `if (!apiKey)` inside a request handler means a misconfigured deployment only fails the first time a user exercises the feature, instead of failing fast at startup where it would show up in deploy logs or a health check.",
+      docsUrl: "https://elevenlabs.io/docs/api-reference/authentication",
+      recommended: true
+    },
+    messages: {
+      missingStartupValidation: "This module reads an ElevenLabs API key from process.env but only validates it inside a request handler \u2014 validate it at module scope so a missing key fails at startup, not at first use."
+    }
+  },
+  create(context) {
+    function isElevenLabsEnvAccess(node) {
+      if (node?.type !== "MemberExpression") return false;
+      if (node.object?.type !== "MemberExpression") return false;
+      const inner = node.object;
+      if (inner.object?.type !== "Identifier" || inner.object.name !== "process") return false;
+      if (inner.property?.type !== "Identifier" || inner.property.name !== "env") return false;
+      const propName2 = node.property?.type === "Identifier" ? node.property.name : node.property?.value;
+      return typeof propName2 === "string" && ELEVENLABS_ENV_VAR_PATTERN.test(propName2);
+    }
+    function isInsideFunction(node, ancestors) {
+      return ancestors.some(
+        (a) => a?.type === "FunctionDeclaration" || a?.type === "FunctionExpression" || a?.type === "ArrowFunctionExpression"
+      );
+    }
+    return {
+      "Program:exit"(program) {
+        let moduleScopeAccess = false;
+        let handlerScopeAccess = false;
+        function walk2(n, ancestors, depth = 0) {
+          if (!n || typeof n !== "object" || depth > 60) return;
+          if (Array.isArray(n)) {
+            for (const item of n) walk2(item, ancestors, depth + 1);
+            return;
+          }
+          if (isElevenLabsEnvAccess(n)) {
+            if (isInsideFunction(n, ancestors)) {
+              handlerScopeAccess = true;
+            } else {
+              moduleScopeAccess = true;
+            }
+          }
+          const nextAncestors = n.type === "FunctionDeclaration" || n.type === "FunctionExpression" || n.type === "ArrowFunctionExpression" ? [...ancestors, n] : ancestors;
+          for (const key of Object.keys(n)) {
+            if (key === "parent" || key === "loc" || key === "range") continue;
+            const val = n[key];
+            if (val && typeof val === "object") walk2(val, nextAncestors, depth + 1);
+          }
+        }
+        walk2(program, []);
+        if (handlerScopeAccess && !moduleScopeAccess) {
+          context.report({ node: program, messageId: "missingStartupValidation" });
+        }
+      }
+    };
+  }
+};
+var elevenlabsEnvVarValidationRule = rule90;
+
+// src/providers/twilio/utils.ts
+var POST_METHOD_NAMES = /* @__PURE__ */ new Set(["post"]);
+var ROUTER_OBJECT_NAMES = /* @__PURE__ */ new Set(["server", "app", "router", "fastify"]);
+function isPostRouteRegistration(node) {
+  if (node?.type !== "CallExpression") return false;
+  const callee = node.callee;
+  if (callee?.type !== "MemberExpression") return false;
+  if (callee.property?.type !== "Identifier" || !POST_METHOD_NAMES.has(callee.property.name)) return false;
+  return callee.object?.type === "Identifier" && ROUTER_OBJECT_NAMES.has(callee.object.name);
+}
+function findInSubtree(node, predicate, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 40) return null;
+  if (Array.isArray(node)) {
+    for (const n of node) {
+      const found = findInSubtree(n, predicate, depth + 1);
+      if (found) return found;
+    }
+    return null;
+  }
+  if (predicate(node)) return node;
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object") {
+      const found = findInSubtree(val, predicate, depth + 1);
+      if (found) return found;
+    }
+  }
+  return null;
+}
+function referencesRequestBody(node) {
+  return !!findInSubtree(node, (n) => {
+    if (n?.type !== "MemberExpression") return false;
+    if (n.property?.type !== "Identifier" || n.property.name !== "body") return false;
+    return n.object?.type === "Identifier" && (n.object.name === "req" || n.object.name === "request");
+  });
+}
+function collectVarDeclarators2(node, out, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 24) return;
+  if (Array.isArray(node)) {
+    for (const n of node) collectVarDeclarators2(n, out, depth + 1);
+    return;
+  }
+  if (node.type === "VariableDeclarator") out.push(node);
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object") collectVarDeclarators2(val, out, depth + 1);
+  }
+}
+
+// src/providers/twilio/rules/validate-webhook-signature.ts
+var rule91 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Twilio webhook routes must validate the X-Twilio-Signature header before trusting the body",
+      category: "security",
+      cwe: "CWE-345",
+      owasp: "A07:2021 Identification and Authentication Failures",
+      rationale: "Webhook URLs are public. Anyone who learns or guesses the path can POST a forged body \u2014 fake CallSid/From/TaskAttributes values \u2014 and the handler has no way to tell it apart from a real Twilio request. Without validating the signature first, an attacker can trigger outbound calls (toll/billing impact) or falsely invoke reservation/task callbacks to manipulate call state for an arbitrary caller.",
+      docsUrl: "https://www.twilio.com/docs/usage/webhooks/webhooks-security",
+      recommended: true
+    },
+    messages: {
+      missingSignatureValidation: "This POST webhook route reads req.body but the file never validates the X-Twilio-Signature header via twilio.validateRequest()/RequestValidator \u2014 a forged request body is indistinguishable from a real Twilio callback."
+    }
+  },
+  create(context) {
+    function isValidateRequestCall(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      return callee.property?.type === "Identifier" && callee.property.name === "validateRequest";
+    }
+    function isRequestValidatorConstruction(n) {
+      return n?.type === "NewExpression" && n.callee?.type === "Identifier" && n.callee.name === "RequestValidator";
+    }
+    return {
+      "Program:exit"(program) {
+        const hasValidation = !!findInSubtree(program, isValidateRequestCall) || !!findInSubtree(program, isRequestValidatorConstruction);
+        if (hasValidation) return;
+        const postRoutes = [];
+        findInSubtree(program, (n) => {
+          if (isPostRouteRegistration(n) && referencesRequestBody(n)) postRoutes.push(n);
+          return false;
+        });
+        for (const route of postRoutes) {
+          context.report({ node: route, messageId: "missingSignatureValidation" });
+        }
+      }
+    };
+  }
+};
+var twilioValidateWebhookSignatureRule = rule91;
+
+// src/providers/twilio/rules/taskrouter-attributes-match-consumer.ts
+var rule92 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "TaskRouter Task attributes must include every field the reservation handler reads back out",
+      category: "correctness",
+      rationale: "A Task is created with attributes like `{ name, type }`, and later a reservation-accepted handler does `const { from } = JSON.parse(req.body.TaskAttributes)` to look up state by `from`. If the producer never set `from` on the Task attributes, that destructure is always `undefined`, the lookup always misses, and the handler returns 404 \u2014 even though every other part of the flow worked correctly.",
+      docsUrl: "https://www.twilio.com/docs/taskrouter/twiml-queue-calls",
+      recommended: true
+    },
+    messages: {
+      attributeMismatch: 'This .task() attributes object does not set "{{field}}", but a reservation handler in this codebase destructures "{{field}}" from JSON.parse(TaskAttributes) \u2014 that lookup will always be undefined.'
+    }
+  },
+  create(context) {
+    function isTaskCall(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      return callee.property?.type === "Identifier" && callee.property.name === "task";
+    }
+    function extractAttributeKeys(taskCallNode) {
+      const arg = taskCallNode.arguments?.[0];
+      if (!arg) return null;
+      if (arg.type === "CallExpression" && arg.callee?.type === "MemberExpression" && arg.callee.object?.type === "Identifier" && arg.callee.object.name === "JSON" && arg.callee.property?.type === "Identifier" && arg.callee.property.name === "stringify" && arg.arguments?.[0]?.type === "ObjectExpression") {
+        return objectKeys(arg.arguments[0]);
+      }
+      if (arg.type === "TemplateLiteral") {
+        const raw = arg.quasis.map((q) => q.value?.raw ?? "").join("");
+        const keys = /* @__PURE__ */ new Set();
+        for (const m of raw.matchAll(/"([a-zA-Z0-9_]+)"\s*:/g)) keys.add(m[1]);
+        return keys;
+      }
+      if (arg.type === "Literal" && typeof arg.value === "string") {
+        const keys = /* @__PURE__ */ new Set();
+        for (const m of arg.value.matchAll(/"([a-zA-Z0-9_]+)"\s*:/g)) keys.add(m[1]);
+        return keys;
+      }
+      return null;
+    }
+    function objectKeys(objExpr) {
+      const keys = /* @__PURE__ */ new Set();
+      for (const p of objExpr.properties ?? []) {
+        if (p.type !== "Property") continue;
+        const name = p.key?.type === "Identifier" ? p.key.name : p.key?.type === "Literal" ? p.key.value : null;
+        if (typeof name === "string") keys.add(name);
+      }
+      return keys;
+    }
+    function isTaskAttributesJsonParse(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      if (callee.object?.type !== "Identifier" || callee.object.name !== "JSON") return false;
+      if (callee.property?.type !== "Identifier" || callee.property.name !== "parse") return false;
+      const arg = n.arguments?.[0];
+      if (arg?.type !== "MemberExpression") return false;
+      return arg.property?.type === "Identifier" && arg.property.name === "TaskAttributes";
+    }
+    function findConsumedFields(program) {
+      const fields = /* @__PURE__ */ new Set();
+      const declarators = [];
+      collectVarDeclarators2(program, declarators);
+      for (const d of declarators) {
+        if (!isTaskAttributesJsonParse(d.init)) continue;
+        if (d.id?.type === "ObjectPattern") {
+          for (const p of d.id.properties ?? []) {
+            if (p.type !== "Property") continue;
+            const name = p.key?.type === "Identifier" ? p.key.name : null;
+            if (name) fields.add(name);
+          }
+        }
+      }
+      return fields;
+    }
+    return {
+      "Program:exit"(program) {
+        const consumedFields = findConsumedFields(program);
+        if (consumedFields.size === 0) return;
+        const taskCalls = [];
+        findInSubtree(program, (n) => {
+          if (isTaskCall(n)) taskCalls.push(n);
+          return false;
+        });
+        for (const taskCall of taskCalls) {
+          const producedKeys = extractAttributeKeys(taskCall);
+          if (!producedKeys) continue;
+          for (const field of consumedFields) {
+            if (!producedKeys.has(field)) {
+              context.report({ node: taskCall, messageId: "attributeMismatch", data: { field } });
+            }
+          }
+        }
+      }
+    };
+  }
+};
+var twilioTaskrouterAttributesMatchConsumerRule = rule92;
+
+// src/providers/twilio/rules/enqueue-task-json-stringify.ts
+var rule93 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "TaskRouter .task() attributes must be built with JSON.stringify(), not raw string interpolation",
+      category: "security",
+      cwe: "CWE-116",
+      owasp: "CWE-91 XML/JSON Injection",
+      rationale: 'Hand-building the Task attributes JSON by interpolating an unvalidated request field directly into a string literal breaks the moment that field contains a `"` or `\\`. The resulting body is invalid JSON, and Twilio rejects the Enqueue with error 14221 ("Provided Attributes JSON was not valid") \u2014 turning a single unexpected character in a caller-controlled field (like a name with a quote in it) into a hard failure of the call flow.',
+      docsUrl: "https://www.twilio.com/docs/api/errors/14221",
+      recommended: true
+    },
+    messages: {
+      rawJsonInterpolation: 'This .task() call builds JSON attributes via raw string interpolation instead of JSON.stringify() \u2014 a "/\\\\ character in the interpolated value produces invalid JSON and Twilio error 14221.'
+    }
+  },
+  create(context) {
+    function isTaskCall(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      return callee.property?.type === "Identifier" && callee.property.name === "task";
+    }
+    function hasInterpolatedExpression(templateLiteral) {
+      return (templateLiteral.expressions ?? []).length > 0;
+    }
+    return {
+      CallExpression(node) {
+        if (!isTaskCall(node)) return;
+        const arg = node.arguments?.[0];
+        if (!arg) return;
+        if (arg.type === "TemplateLiteral" && hasInterpolatedExpression(arg)) {
+          context.report({ node, messageId: "rawJsonInterpolation" });
+          return;
+        }
+        if (arg.type === "BinaryExpression" && arg.operator === "+") {
+          context.report({ node, messageId: "rawJsonInterpolation" });
+        }
+      }
+    };
+  }
+};
+var twilioEnqueueTaskJsonStringifyRule = rule93;
+
+// src/providers/twilio/rules/media-streams-key-by-call-sid.ts
+var rule94 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Media Streams session maps must be keyed by callSid, not phone number",
+      category: "reliability",
+      rationale: "A Map keyed on the caller's phone number breaks the moment the same number places two concurrent calls \u2014 a retry after a dropped call, two family members sharing a line, a misdial-and-redial. The second map.set() silently overwrites the first call's entry, and that first call's downstream events (reservation-accepted, outbound-leg wiring) end up pointed at the wrong session, crossing audio streams between two unrelated calls. Twilio provides a unique callSid on every start message specifically to avoid this collision.",
+      docsUrl: "https://www.twilio.com/docs/voice/media-streams/websocket-messages",
+      recommended: true
+    },
+    messages: {
+      keyedByPhoneNumber: `This Map is keyed by "{{key}}" (a phone-number-like field) instead of callSid \u2014 two concurrent calls from the same number will silently overwrite each other's entry.`
+    }
+  },
+  create(context) {
+    function isFromLikeIdentifier(n) {
+      if (n?.type === "Identifier" && n.name === "from") return "from";
+      if (n?.type === "MemberExpression" && n.property?.type === "Identifier" && n.property.name === "from" && !n.computed) {
+        return "from";
+      }
+      return null;
+    }
+    function isMapMutationCall(n, methodNames) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      return callee.property?.type === "Identifier" && methodNames.has(callee.property.name);
+    }
+    const SET_OR_GET = /* @__PURE__ */ new Set(["set", "get"]);
+    return {
+      "Program:exit"(program) {
+        let callSidAvailable = false;
+        function scanForCallSid(n, depth = 0) {
+          if (callSidAvailable || !n || typeof n !== "object" || depth > 60) return;
+          if (Array.isArray(n)) {
+            for (const item of n) scanForCallSid(item, depth + 1);
+            return;
+          }
+          if (n.type === "Identifier" && n.name === "callSid") {
+            callSidAvailable = true;
+            return;
+          }
+          if (n.type === "MemberExpression" && !n.computed && n.property?.type === "Identifier" && n.property.name === "callSid") {
+            callSidAvailable = true;
+            return;
+          }
+          for (const key of Object.keys(n)) {
+            if (key === "parent" || key === "loc" || key === "range") continue;
+            const val = n[key];
+            if (val && typeof val === "object") scanForCallSid(val, depth + 1);
+          }
+        }
+        scanForCallSid(program);
+        if (!callSidAvailable) return;
+        function walk2(n, depth = 0) {
+          if (!n || typeof n !== "object" || depth > 60) return;
+          if (Array.isArray(n)) {
+            for (const item of n) walk2(item, depth + 1);
+            return;
+          }
+          if (isMapMutationCall(n, SET_OR_GET)) {
+            const firstArg = n.arguments?.[0];
+            const key = isFromLikeIdentifier(firstArg);
+            if (key) context.report({ node: n, messageId: "keyedByPhoneNumber", data: { key } });
+          }
+          for (const k of Object.keys(n)) {
+            if (k === "parent" || k === "loc" || k === "range") continue;
+            const val = n[k];
+            if (val && typeof val === "object") walk2(val, depth + 1);
+          }
+        }
+        walk2(program);
+      }
+    };
+  }
+};
+var twilioMediaStreamsKeyByCallSidRule = rule94;
+
+// src/providers/twilio/rules/await-or-catch-rest-calls-in-event-handlers.ts
+var REST_RESOURCE_METHODS = /* @__PURE__ */ new Set(["create", "update", "remove", "fetch"]);
+var EVENT_REGISTRATION_METHODS = /* @__PURE__ */ new Set(["onStart", "onStop", "onMedia", "onConnected", "on"]);
+var rule95 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Twilio REST calls inside event-handler callbacks must be wrapped in try/catch",
+      category: "reliability",
+      rationale: 'Event-emitter style callbacks (onStart, onMessage, on("message", ...)) are typically invoked via something like `callbacks.map((cb) => cb(event))`, which discards the returned promise. If the callback is `async` and calls `await twilio.calls.create(...)` with no try/catch, any Twilio REST error (invalid number, suspended account, rate limit) becomes an unhandled promise rejection. If the process has a global `unhandledRejection` handler that calls `process.exit()` (a common pattern), one failed outbound call takes down the entire server and every other in-progress call, not just the failing one.',
+      docsUrl: "https://www.twilio.com/docs/usage/webhooks/webhooks-faq",
+      recommended: true
+    },
+    messages: {
+      missingTryCatch: "This await twilio.{{resource}}.{{method}}() call is inside an event-handler callback with no surrounding try/catch \u2014 a REST API error here becomes an unhandled promise rejection that can crash the whole process."
+    }
+  },
+  create(context) {
+    function isAwaitedTwilioRestCall(n) {
+      if (n?.type !== "AwaitExpression") return null;
+      const call = n.argument;
+      if (call?.type !== "CallExpression") return null;
+      const callee = call.callee;
+      if (callee?.type !== "MemberExpression") return null;
+      const method = callee.property?.type === "Identifier" ? callee.property.name : null;
+      if (!method || !REST_RESOURCE_METHODS.has(method)) return null;
+      const obj = callee.object;
+      if (obj?.type !== "MemberExpression") return null;
+      const resource = obj.property?.type === "Identifier" ? obj.property.name : null;
+      if (!resource) return null;
+      const base = obj.object;
+      const baseName = base?.type === "Identifier" ? base.name : null;
+      if (!baseName || !/^(twilio\w*|client)$/i.test(baseName)) return null;
+      return { resource, method };
+    }
+    function isEventHandlerRegistration(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      return callee.property?.type === "Identifier" && EVENT_REGISTRATION_METHODS.has(callee.property.name);
+    }
+    function isAsyncCallback(n) {
+      return (n?.type === "ArrowFunctionExpression" || n?.type === "FunctionExpression") && n.async === true;
+    }
+    function posOf2(n) {
+      if (typeof n?.range?.[0] === "number") return n.range[0];
+      const line = n?.loc?.start?.line ?? 0;
+      const column = n?.loc?.start?.column ?? 0;
+      return line * 1e6 + column;
+    }
+    function posEnd(n) {
+      if (typeof n?.range?.[1] === "number") return n.range[1];
+      const line = n?.loc?.end?.line ?? n?.loc?.start?.line ?? 0;
+      const column = n?.loc?.end?.column ?? n?.loc?.start?.column ?? 0;
+      return line * 1e6 + column;
+    }
+    function isWithinTryBlock(node, root) {
+      const tryRanges = [];
+      function collectTryRanges(n, depth = 0) {
+        if (!n || typeof n !== "object" || depth > 60) return;
+        if (Array.isArray(n)) {
+          for (const item of n) collectTryRanges(item, depth + 1);
+          return;
+        }
+        if (n.type === "TryStatement" && n.block) {
+          tryRanges.push([posOf2(n.block), posEnd(n.block)]);
+        }
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range") continue;
+          const val = n[key];
+          if (val && typeof val === "object") collectTryRanges(val, depth + 1);
+        }
+      }
+      collectTryRanges(root);
+      const p = posOf2(node);
+      return tryRanges.some(([start, end]) => p >= start && p <= end);
+    }
+    return {
+      CallExpression(node) {
+        if (!isEventHandlerRegistration(node)) return;
+        const callback = node.arguments?.find((a) => isAsyncCallback(a));
+        if (!callback) return;
+        const restCalls = [];
+        function collect(n, depth = 0) {
+          if (!n || typeof n !== "object" || depth > 40) return;
+          if (Array.isArray(n)) {
+            for (const item of n) collect(item, depth + 1);
+            return;
+          }
+          const info = isAwaitedTwilioRestCall(n);
+          if (info) restCalls.push({ node: n, ...info });
+          for (const key of Object.keys(n)) {
+            if (key === "parent" || key === "loc" || key === "range") continue;
+            const val = n[key];
+            if (val && typeof val === "object") collect(val, depth + 1);
+          }
+        }
+        collect(callback.body);
+        for (const call of restCalls) {
+          if (!isWithinTryBlock(call.node, callback.body)) {
+            context.report({
+              node: call.node,
+              messageId: "missingTryCatch",
+              data: { resource: call.resource, method: call.method }
+            });
+          }
+        }
+      }
+    };
+  }
+};
+var twilioAwaitOrCatchRestCallsInEventHandlersRule = rule95;
+
+// src/providers/twilio/rules/use-twiml-builder-not-string-templates.ts
+var rule96 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "TwiML responses must be built with the VoiceResponse builder, not raw XML template strings",
+      category: "security",
+      cwe: "CWE-91",
+      rationale: "The VoiceResponse builder XML-escapes every interpolated value automatically. A raw template literal that interpolates values directly into XML attribute or text positions has no such protection \u2014 if either value's source ever changes to something attacker-influenced (e.g. a SIP header instead of a Twilio-controlled CallSid), unescaped `<`/`\"`/`&` characters can break out of the intended XML structure.",
+      docsUrl: "https://www.twilio.com/docs/voice/twiml/stream",
+      recommended: true
+    },
+    messages: {
+      rawTwimlTemplate: "TwiML is built here as a raw template literal with interpolated values instead of the VoiceResponse builder \u2014 interpolated values are not XML-escaped, unlike new VoiceResponse()."
+    }
+  },
+  create(context) {
+    function looksLikeTwimlXml(raw) {
+      return /<Response>|<Connect>|<Say>|<Stream\b|<Enqueue\b|<Dial\b/.test(raw);
+    }
+    return {
+      TemplateLiteral(node) {
+        if ((node.expressions ?? []).length === 0) return;
+        const raw = (node.quasis ?? []).map((q) => q.value?.raw ?? "").join("");
+        if (!looksLikeTwimlXml(raw)) return;
+        context.report({ node, messageId: "rawTwimlTemplate" });
+      }
+    };
+  }
+};
+var twilioUseTwimlBuilderNotStringTemplatesRule = rule96;
+
+// src/providers/twilio/rules/media-streams-mark-pacing.ts
+var rule97 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Media Streams audio forwarding should use mark-based pacing to avoid buffer overflow",
+      category: "reliability",
+      rationale: 'Twilio buffers at most 10 minutes of audio per bidirectional Stream. If audio chunks are forwarded with no mark events and no pacing, and the sender produces media faster than real-time (or playback stalls), Twilio stops accepting further audio for that Stream and emits warning 31931 ("Media Discarded") \u2014 silently dropping audio rather than erroring loudly.',
+      docsUrl: "https://www.twilio.com/docs/api/errors/31931",
+      recommended: true
+    },
+    messages: {
+      noMarkPacing: "This file forwards media payloads via send() but never passes isLast/a mark argument anywhere \u2014 sustained high-throughput forwarding risks Twilio silently discarding buffered audio (warning 31931)."
+    }
+  },
+  create(context) {
+    function isMediaSendCall(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      if (callee.property?.type !== "Identifier" || callee.property.name !== "send") return false;
+      const arg = n.arguments?.[0];
+      const argText = arg?.type === "ArrayExpression" && (arg.elements ?? []).some(
+        (el) => el?.type === "MemberExpression" && el.property?.type === "Identifier" && el.property.name === "delta"
+      ) || arg?.type === "Identifier" && /delta|payload|media/i.test(arg.name);
+      return !!argText;
+    }
+    function hasIsLastOrMarkSignal(program) {
+      let found = false;
+      function walk2(n, depth = 0) {
+        if (found || !n || typeof n !== "object" || depth > 60) return;
+        if (Array.isArray(n)) {
+          for (const item of n) walk2(item, depth + 1);
+          return;
+        }
+        if (typeof n.type === "string" && n.type.startsWith("TS")) return;
+        if (n.type === "CallExpression") {
+          const callee = n.callee;
+          if (callee?.type === "MemberExpression" && callee.property?.type === "Identifier" && callee.property.name === "send") {
+            const second = n.arguments?.[1];
+            if (second?.type === "Literal" && second.value === true) {
+              found = true;
+              return;
+            }
+            if (second?.type === "Identifier" && /isLast/i.test(second.name)) {
+              found = true;
+              return;
+            }
+          }
+        }
+        if (n.type === "Identifier" && n.name === "isLast") {
+          found = true;
+          return;
+        }
+        for (const key of Object.keys(n)) {
+          if (key === "parent" || key === "loc" || key === "range" || key === "typeAnnotation" || key === "returnType") continue;
+          const val = n[key];
+          if (val && typeof val === "object") walk2(val, depth + 1);
+        }
+      }
+      walk2(program);
+      return found;
+    }
+    return {
+      "Program:exit"(program) {
+        const sendCalls = [];
+        findInSubtree(program, (n) => {
+          if (isMediaSendCall(n)) sendCalls.push(n);
+          return false;
+        });
+        if (sendCalls.length === 0) return;
+        if (hasIsLastOrMarkSignal(program)) return;
+        context.report({ node: sendCalls[0], messageId: "noMarkPacing" });
+      }
+    };
+  }
+};
+var twilioMediaStreamsMarkPacingRule = rule97;
+
+// src/providers/twilio/rules/validate-all-request-inputs.ts
+var rule98 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Fastify Twilio webhook routes must declare a schema for every request input they read",
+      category: "correctness",
+      rationale: "A route that validates `body` but not `querystring` (or declares no schema at all) lets unvalidated, possibly-undefined fields flow downstream. If a later call does `value.toString()` or similar on a field that never arrived, that throws instead of failing the request cleanly with a 400 \u2014 the failure surfaces far from the actual missing-validation root cause.",
+      docsUrl: "https://www.twilio.com/docs/voice/twiml/stream",
+      recommended: true
+    },
+    messages: {
+      missingQuerystringSchema: "This route reads req.query.{{field}} but the route schema validates body without a matching querystring schema \u2014 a missing query param flows downstream as undefined instead of failing with a 400.",
+      missingSchemaEntirely: "This route reads req.body.{{field}} but declares no request schema at all \u2014 req.body is untyped and unvalidated before use."
+    }
+  },
+  create(context) {
+    function getOptionsArg(routeCall) {
+      return routeCall.arguments?.length === 3 ? routeCall.arguments[1] : null;
+    }
+    function getHandlerArg(routeCall) {
+      const args = routeCall.arguments ?? [];
+      return args[args.length - 1];
+    }
+    function hasSchemaProperty(optionsArg, propName2) {
+      if (optionsArg?.type !== "ObjectExpression") return false;
+      const schemaProp = (optionsArg.properties ?? []).find(
+        (p) => p.type === "Property" && p.key?.type === "Identifier" && p.key.name === "schema"
+      );
+      if (!schemaProp || schemaProp.value?.type !== "ObjectExpression") return false;
+      return (schemaProp.value.properties ?? []).some(
+        (p) => p.type === "Property" && p.key?.type === "Identifier" && p.key.name === propName2
+      );
+    }
+    function hasAnySchema(optionsArg) {
+      if (optionsArg?.type !== "ObjectExpression") return false;
+      return (optionsArg.properties ?? []).some(
+        (p) => p.type === "Property" && p.key?.type === "Identifier" && p.key.name === "schema"
+      );
+    }
+    function findReadFields(handlerBody, objectNames) {
+      const fields = /* @__PURE__ */ new Set();
+      findInSubtree(handlerBody, (n) => {
+        if (n?.type !== "MemberExpression") return false;
+        const obj = n.object;
+        if (obj?.type !== "MemberExpression") return false;
+        if (obj.object?.type !== "Identifier" || obj.object.name !== "req" && obj.object.name !== "request") return false;
+        if (obj.property?.type !== "Identifier" || !objectNames.has(obj.property.name)) return false;
+        const field = n.property?.type === "Identifier" ? n.property.name : null;
+        if (field) fields.add(field);
+        return false;
+      });
+      return fields;
+    }
+    return {
+      CallExpression(node) {
+        if (!isPostRouteRegistration(node)) return;
+        const optionsArg = getOptionsArg(node);
+        const handler = getHandlerArg(node);
+        if (!handler || handler.type !== "ArrowFunctionExpression" && handler.type !== "FunctionExpression") return;
+        const queryFields = findReadFields(handler.body, /* @__PURE__ */ new Set(["query"]));
+        const bodyFields = findReadFields(handler.body, /* @__PURE__ */ new Set(["body"]));
+        const hasBodySchema = hasSchemaProperty(optionsArg, "body");
+        const hasQuerystringSchema = hasSchemaProperty(optionsArg, "querystring");
+        if (queryFields.size > 0 && hasBodySchema && !hasQuerystringSchema) {
+          const field = [...queryFields][0];
+          context.report({ node, messageId: "missingQuerystringSchema", data: { field } });
+        }
+        if (bodyFields.size > 0 && !hasAnySchema(optionsArg)) {
+          const field = [...bodyFields][0];
+          context.report({ node, messageId: "missingSchemaEntirely", data: { field } });
+        }
+      }
+    };
+  }
+};
+var twilioValidateAllRequestInputsRule = rule98;
+
+// src/providers/twilio/rules/media-streams-mark-name-string.ts
+var rule99 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Media Streams mark.name must be a string, not a number",
+      category: "correctness",
+      rationale: 'Twilio\'s documented Media Streams `mark` message schema and every example show `mark.name` as a string (e.g. "my label"). Setting it to a bare number \u2014 `Date.now()` is a common culprit \u2014 means JSON.stringify() serializes it as a numeric literal, not the documented string type, a latent type mismatch that surfaces once mark-based pacing actually depends on matching mark names.',
+      docsUrl: "https://www.twilio.com/docs/voice/media-streams/websocket-messages",
+      recommended: true
+    },
+    messages: {
+      markNameNotString: "mark.name is set to a non-string value here \u2014 Twilio's documented schema requires mark.name to be a string (e.g. String(Date.now()))."
+    }
+  },
+  create(context) {
+    const NUMERIC_CALLS = /* @__PURE__ */ new Set(["Date.now", "performance.now", "Math.random", "Math.floor", "Math.round"]);
+    function isNumericLooking(n) {
+      if (!n) return false;
+      if (n.type === "Literal" && typeof n.value === "number") return true;
+      if (n.type === "CallExpression") {
+        const callee = n.callee;
+        if (callee?.type === "Identifier") return false;
+        if (callee?.type === "MemberExpression" && callee.object?.type === "Identifier" && callee.property?.type === "Identifier") {
+          return NUMERIC_CALLS.has(`${callee.object.name}.${callee.property.name}`);
+        }
+        return false;
+      }
+      return false;
+    }
+    function findMarkNameProperty(markObjExpr) {
+      for (const p of markObjExpr.properties ?? []) {
+        if (p.type !== "Property") continue;
+        const keyName = p.key?.type === "Identifier" ? p.key.name : p.key?.type === "Literal" ? p.key.value : null;
+        if (keyName === "name") return p;
+      }
+      return null;
+    }
+    return {
+      Property(node) {
+        const keyName = node.key?.type === "Identifier" ? node.key.name : node.key?.type === "Literal" ? node.key.value : null;
+        if (keyName !== "mark") return;
+        if (node.value?.type !== "ObjectExpression") return;
+        const nameProp = findMarkNameProperty(node.value);
+        if (!nameProp) return;
+        if (!isNumericLooking(nameProp.value)) return;
+        context.report({ node: nameProp, messageId: "markNameNotString" });
+      }
+    };
+  }
+};
+var twilioMediaStreamsMarkNameStringRule = rule99;
+
+// src/providers/openai-realtime/utils.ts
+function isOpenAIRealtimeUrlArg(node) {
+  if (!node) return false;
+  if (node.type === "Literal" && typeof node.value === "string") {
+    return node.value.includes("api.openai.com/v1/realtime");
+  }
+  if (node.type === "TemplateLiteral") {
+    return (node.quasis ?? []).some(
+      (q) => typeof q?.value?.raw === "string" && q.value.raw.includes("api.openai.com/v1/realtime")
+    );
+  }
+  return false;
+}
+function collectOpenAIRealtimeUrlVarNames(program) {
+  const names = /* @__PURE__ */ new Set();
+  visit(program);
+  return names;
+  function visit(node, depth = 0) {
+    if (!node || typeof node !== "object" || depth > 40) return;
+    if (Array.isArray(node)) {
+      for (const n of node) visit(n, depth + 1);
+      return;
+    }
+    if (node.type === "VariableDeclarator" && node.id?.type === "Identifier" && isOpenAIRealtimeUrlArg(node.init)) {
+      names.add(node.id.name);
+    }
+    for (const key of Object.keys(node)) {
+      if (key === "parent" || key === "loc" || key === "range") continue;
+      const val = node[key];
+      if (val && typeof val === "object") visit(val, depth + 1);
+    }
+  }
+}
+function isOpenAIRealtimeUrlNode(urlArgNode, urlVarNames) {
+  if (isOpenAIRealtimeUrlArg(urlArgNode)) return true;
+  return urlArgNode?.type === "Identifier" && urlVarNames.has(urlArgNode.name);
+}
+function isOpenAIRealtimeNewWebSocket(node, urlVarNames = /* @__PURE__ */ new Set()) {
+  if (node?.type !== "NewExpression") return false;
+  if (node.callee?.type !== "Identifier" || node.callee.name !== "WebSocket") return false;
+  return isOpenAIRealtimeUrlNode(node.arguments?.[0], urlVarNames);
+}
+function findProperty4(objectExpression, propertyName) {
+  if (objectExpression?.type !== "ObjectExpression") return null;
+  for (const prop of objectExpression.properties ?? []) {
+    if (prop?.type !== "Property") continue;
+    const key = prop.key;
+    const name = key?.type === "Identifier" ? key.name : key?.type === "Literal" ? key.value : null;
+    if (name === propertyName) return prop;
+  }
+  return null;
+}
+function collectOpenAIRealtimeSocketVarNames(program) {
+  const urlVarNames = collectOpenAIRealtimeUrlVarNames(program);
+  const names = /* @__PURE__ */ new Set();
+  visit(program);
+  return names;
+  function visit(node, depth = 0) {
+    if (!node || typeof node !== "object" || depth > 40) return;
+    if (Array.isArray(node)) {
+      for (const n of node) visit(n, depth + 1);
+      return;
+    }
+    if (node.type === "VariableDeclarator" && node.id?.type === "Identifier" && isOpenAIRealtimeNewWebSocket(node.init, urlVarNames)) {
+      names.add(node.id.name);
+    }
+    if (node.type === "AssignmentExpression" && node.operator === "=" && isOpenAIRealtimeNewWebSocket(node.right, urlVarNames)) {
+      const left = node.left;
+      if (left?.type === "Identifier") {
+        names.add(left.name);
+      } else if (left?.type === "MemberExpression" && left.property) {
+        const propName2 = left.property.name;
+        if (typeof propName2 === "string") names.add(propName2);
+      }
+    }
+    for (const key of Object.keys(node)) {
+      if (key === "parent" || key === "loc" || key === "range") continue;
+      const val = node[key];
+      if (val && typeof val === "object") visit(val, depth + 1);
+    }
+  }
+}
+function isTrackedSocketRef(objNode, socketVarNames) {
+  if (objNode?.type === "Identifier") return socketVarNames.has(objNode.name);
+  if (objNode?.type === "MemberExpression" && objNode.property) {
+    const propName2 = objNode.property.name;
+    return typeof propName2 === "string" && socketVarNames.has(propName2);
+  }
+  return false;
+}
+function isSocketOnCall(node, socketVarNames, eventName) {
+  if (node?.type !== "CallExpression") return false;
+  const callee = node.callee;
+  if (callee?.type !== "MemberExpression") return false;
+  const prop = callee.property;
+  if (prop?.type !== "Identifier" || prop.name !== "on") return false;
+  if (!isTrackedSocketRef(callee.object, socketVarNames)) return false;
+  const firstArg = node.arguments?.[0];
+  return firstArg?.type === "Literal" && firstArg.value === eventName;
+}
+function collectStringVarValues(program) {
+  const values = /* @__PURE__ */ new Map();
+  visit(program);
+  return values;
+  function visit(node, depth = 0) {
+    if (!node || typeof node !== "object" || depth > 40) return;
+    if (Array.isArray(node)) {
+      for (const n of node) visit(n, depth + 1);
+      return;
+    }
+    if (node.type === "VariableDeclarator" && node.id?.type === "Identifier") {
+      const init = node.init;
+      if (init?.type === "Literal" && typeof init.value === "string") {
+        values.set(node.id.name, init.value);
+      } else if (init?.type === "TemplateLiteral" && (init.expressions ?? []).length === 0) {
+        values.set(node.id.name, (init.quasis ?? []).map((q) => q.value?.raw ?? "").join(""));
+      }
+    }
+    for (const key of Object.keys(node)) {
+      if (key === "parent" || key === "loc" || key === "range") continue;
+      const val = node[key];
+      if (val && typeof val === "object") visit(val, depth + 1);
+    }
+  }
+}
+function resolveStringValue(node, stringVarValues) {
+  if (!node) return null;
+  if (node.type === "Literal" && typeof node.value === "string") return node.value;
+  if (node.type === "TemplateLiteral" && (node.expressions ?? []).length === 0) {
+    return (node.quasis ?? []).map((q) => q.value?.raw ?? "").join("");
+  }
+  if (node.type === "Identifier" && stringVarValues.has(node.name)) {
+    return stringVarValues.get(node.name) ?? null;
+  }
+  return null;
+}
+
+// src/providers/openai-realtime/rules/migrate-beta-to-ga.ts
+var rule100 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "OpenAI Realtime connections must not pin to the deprecated beta interface",
+      category: "correctness",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime",
+      rationale: "OpenAI's current Realtime guide states that beta integrations must migrate to the GA interface before new work proceeds, and explicitly calls out removing the OpenAI-Beta: realtime=v1 header as a required step. Staying on the beta header keeps a connection locked to the legacy session shape and event names with no confirmed sunset date \u2014 a ticking liability rather than an active failure.",
+      recommended: true
+    },
+    messages: {
+      betaHeaderPresent: "This OpenAI Realtime connection sends the deprecated 'OpenAI-Beta: realtime=v1' header instead of using the GA interface."
+    },
+    schema: []
+  },
+  create(context) {
+    let urlVarNames = /* @__PURE__ */ new Set();
+    return {
+      Program(node) {
+        urlVarNames = collectOpenAIRealtimeUrlVarNames(node);
+      },
+      NewExpression(node) {
+        if (!isOpenAIRealtimeNewWebSocket(node, urlVarNames)) return;
+        const optionsArg = node.arguments?.[1];
+        if (optionsArg?.type !== "ObjectExpression") return;
+        const headersProp = findProperty4(optionsArg, "headers");
+        if (headersProp?.value?.type !== "ObjectExpression") return;
+        const betaProp = findProperty4(headersProp.value, "OpenAI-Beta");
+        if (!betaProp) return;
+        const value = betaProp.value;
+        const isRealtimeV1 = value?.type === "Literal" && typeof value.value === "string" && value.value.includes("realtime=v1");
+        if (!isRealtimeV1) return;
+        context.report({ node: betaProp, messageId: "betaHeaderPresent" });
+      }
+    };
+  }
+};
+var openaiRealtimeMigrateBetaToGaRule = rule100;
+
+// src/providers/openai-realtime/rules/no-log-raw-message-payloads.ts
+var LOG_METHOD_NAMES = /* @__PURE__ */ new Set(["info", "warn", "error", "log"]);
+function isLogCall(node) {
+  if (node?.type !== "CallExpression") return { matches: false };
+  const callee = node.callee;
+  if (callee?.type !== "MemberExpression") return { matches: false };
+  const prop = callee.property;
+  if (prop?.type !== "Identifier" || !LOG_METHOD_NAMES.has(prop.name)) return { matches: false };
+  return { matches: true, calleeProp: prop };
+}
+function referencesRawParam(argNode, paramName) {
+  if (!argNode) return false;
+  if (argNode.type === "Identifier" && argNode.name === paramName) return true;
+  if (argNode.type === "CallExpression" && argNode.callee?.type === "MemberExpression" && argNode.callee.object?.type === "Identifier" && argNode.callee.object.name === paramName && argNode.callee.property?.type === "Identifier" && argNode.callee.property.name === "toString") {
+    return true;
+  }
+  if (argNode.type === "TemplateLiteral") {
+    return (argNode.expressions ?? []).some((expr) => referencesRawParam(expr, paramName));
+  }
+  return false;
+}
+function findCallExpressions(node, out, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 40) return;
+  if (Array.isArray(node)) {
+    for (const n of node) findCallExpressions(n, out, depth + 1);
+    return;
+  }
+  if (node.type === "CallExpression") out.push(node);
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object") findCallExpressions(val, out, depth + 1);
+  }
+}
+var rule101 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Raw OpenAI Realtime message payloads must not be logged verbatim",
+      category: "security",
+      cwe: "CWE-532",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime",
+      rationale: "Every inbound Realtime WebSocket message can include response.audio.delta payloads (base64-encoded live call audio) and, once transcription is wired up, transcript text. Logging the raw message object or string verbatim writes a durable, unredacted record of live conversation content into whatever log sink the application ships to.",
+      recommended: true
+    },
+    messages: {
+      rawPayloadLogged: "A raw OpenAI Realtime message is logged verbatim here, which can include live call audio or transcript content."
+    },
+    schema: []
+  },
+  create(context) {
+    let socketVarNames = /* @__PURE__ */ new Set();
+    return {
+      Program(node) {
+        socketVarNames = collectOpenAIRealtimeSocketVarNames(node);
+      },
+      CallExpression(node) {
+        if (socketVarNames.size === 0) return;
+        if (!isSocketOnCall(node, socketVarNames, "message")) return;
+        const handler = node.arguments?.[1];
+        if (handler?.type !== "ArrowFunctionExpression" && handler?.type !== "FunctionExpression") return;
+        const param = handler.params?.[0];
+        if (param?.type !== "Identifier") return;
+        const paramName = param.name;
+        const calls = [];
+        findCallExpressions(handler.body, calls);
+        for (const call of calls) {
+          const { matches } = isLogCall(call);
+          if (!matches) continue;
+          const hasRawArg = (call.arguments ?? []).some((arg) => referencesRawParam(arg, paramName));
+          if (hasRawArg) {
+            context.report({ node: call, messageId: "rawPayloadLogged" });
+          }
+        }
+      }
+    };
+  }
+};
+var openaiRealtimeNoLogRawMessagePayloadsRule = rule101;
+
+// src/providers/openai-realtime/rules/handle-error-server-event.ts
+function isTypeMemberExpression(node) {
+  return node?.type === "MemberExpression" && node.property?.type === "Identifier" && node.property.name === "type";
+}
+function collectTypeComparisonLiterals(node, out, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 60) return;
+  if (Array.isArray(node)) {
+    for (const n of node) collectTypeComparisonLiterals(n, out, depth + 1);
+    return;
+  }
+  if (node.type === "BinaryExpression" && (node.operator === "===" || node.operator === "==")) {
+    if (isTypeMemberExpression(node.left) && node.right?.type === "Literal" && typeof node.right.value === "string") {
+      out.add(node.right.value);
+    }
+    if (isTypeMemberExpression(node.right) && node.left?.type === "Literal" && typeof node.left.value === "string") {
+      out.add(node.left.value);
+    }
+  }
+  if (node.type === "SwitchStatement" && isTypeMemberExpression(node.discriminant)) {
+    for (const c of node.cases ?? []) {
+      if (c?.test?.type === "Literal" && typeof c.test.value === "string") out.add(c.test.value);
+    }
+  }
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object") collectTypeComparisonLiterals(val, out, depth + 1);
+  }
+}
+var rule102 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: 'OpenAI Realtime message handlers must check for the API-level "error" server event',
+      category: "reliability",
+      docsUrl: "https://developers.openai.com/api/reference/resources/realtime/server-events",
+      rationale: "The Realtime API's own error server event \u2014 distinct from the WebSocket transport-level error event \u2014 covers rate limits, invalid session.update payloads, content-moderation blocks, and retired/invalid model ids. A message handler that branches on event types but never checks for 'error' lets the call continue silently with translation/processing permanently dead for that leg, with no operator-visible signal of why.",
+      recommended: true
+    },
+    messages: {
+      missingErrorBranch: "This Realtime message handler branches on event types but never checks for message.type === 'error'."
+    },
+    schema: []
+  },
+  create(context) {
+    let socketVarNames = /* @__PURE__ */ new Set();
+    return {
+      Program(node) {
+        socketVarNames = collectOpenAIRealtimeSocketVarNames(node);
+      },
+      CallExpression(node) {
+        if (socketVarNames.size === 0) return;
+        if (!isSocketOnCall(node, socketVarNames, "message")) return;
+        const handler = node.arguments?.[1];
+        if (handler?.type !== "ArrowFunctionExpression" && handler?.type !== "FunctionExpression") return;
+        const literals = /* @__PURE__ */ new Set();
+        collectTypeComparisonLiterals(handler.body, literals);
+        if (literals.size === 0) return;
+        if (!literals.has("error")) {
+          context.report({ node, messageId: "missingErrorBranch" });
+        }
+      }
+    };
+  }
+};
+var openaiRealtimeHandleErrorServerEventRule = rule102;
+
+// src/providers/openai-realtime/rules/reconnect-on-drop.ts
+var RECONNECT_NAME_PATTERN = /reconnect/i;
+function hasReconnectAttempt(node, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 60) return false;
+  if (Array.isArray(node)) {
+    return node.some((n) => hasReconnectAttempt(n, depth + 1));
+  }
+  if (node.type === "NewExpression" && node.callee?.type === "Identifier" && node.callee.name === "WebSocket") {
+    return true;
+  }
+  if (node.type === "CallExpression") {
+    const callee = node.callee;
+    const calleeName = callee?.type === "Identifier" ? callee.name : callee?.type === "MemberExpression" && callee.property?.type === "Identifier" ? callee.property.name : null;
+    if (typeof calleeName === "string" && RECONNECT_NAME_PATTERN.test(calleeName)) return true;
+  }
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object" && hasReconnectAttempt(val, depth + 1)) return true;
+  }
+  return false;
+}
+var rule103 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "A dropped OpenAI Realtime connection must be retried, not just logged",
+      category: "reliability",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime",
+      rationale: "For a multi-minute phone call, a single transient OpenAI-side disconnect that is only logged on 'close' permanently kills translation/processing for the remainder of the call in that direction \u2014 the call itself stays connected and silently degraded, with neither party getting a signal that something stopped working.",
+      recommended: true
+    },
+    messages: {
+      noReconnectAttempt: "This Realtime socket's close handler only logs and never attempts to reconnect."
+    },
+    schema: []
+  },
+  create(context) {
+    let socketVarNames = /* @__PURE__ */ new Set();
+    return {
+      Program(node) {
+        socketVarNames = collectOpenAIRealtimeSocketVarNames(node);
+      },
+      CallExpression(node) {
+        if (socketVarNames.size === 0) return;
+        if (!isSocketOnCall(node, socketVarNames, "close")) return;
+        const handler = node.arguments?.[1];
+        if (handler?.type !== "ArrowFunctionExpression" && handler?.type !== "FunctionExpression") return;
+        if (!hasReconnectAttempt(handler.body)) {
+          context.report({ node, messageId: "noReconnectAttempt" });
+        }
+      }
+    };
+  }
+};
+var openaiRealtimeReconnectOnDropRule = rule103;
+
+// src/providers/openai-realtime/rules/avoid-dated-preview-snapshots.ts
+var DATED_PREVIEW_MODEL_PATTERN = /model=[^&'"`]*-preview-\d{4}-\d{2}-\d{2}/;
+var rule104 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "OpenAI Realtime connections should not pin to a dated preview model snapshot",
+      category: "correctness",
+      docsUrl: "https://developers.openai.com/api/reference/resources/realtime/subresources/client_secrets",
+      rationale: "Dated preview snapshots are the category of model id OpenAI has historically retired with advance-notice sunset windows. Pinning to a dated preview snapshot rather than the floating GA alias (or a current dated GA snapshot) maximizes exposure to an eventual retirement, with no code path to detect or gracefully react to a model_not_found-style error if/when that happens.",
+      recommended: true
+    },
+    messages: {
+      datedPreviewSnapshot: "This Realtime connection is pinned to a dated preview model snapshot instead of the GA alias."
+    },
+    schema: []
+  },
+  create(context) {
+    let stringVarValues = /* @__PURE__ */ new Map();
+    let urlVarNames = /* @__PURE__ */ new Set();
+    return {
+      Program(node) {
+        stringVarValues = collectStringVarValues(node);
+        urlVarNames = collectOpenAIRealtimeUrlVarNames(node);
+      },
+      NewExpression(node) {
+        if (!isOpenAIRealtimeNewWebSocket(node, urlVarNames)) return;
+        const urlArg = node.arguments?.[0];
+        const urlString = resolveStringValue(urlArg, stringVarValues);
+        if (!urlString) return;
+        if (DATED_PREVIEW_MODEL_PATTERN.test(urlString)) {
+          context.report({ node: urlArg, messageId: "datedPreviewSnapshot" });
+        }
+      }
+    };
+  }
+};
+var openaiRealtimeAvoidDatedPreviewSnapshotsRule = rule104;
+
+// src/providers/openai-realtime/rules/verify-deprecated-session-fields.ts
+var rule105 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "OpenAI Realtime session.update payloads should not rely on an unverified 'temperature' field",
+      category: "correctness",
+      docsUrl: "https://developers.openai.com/api/reference/resources/realtime/subresources/client_secrets",
+      rationale: "Two independent fetches of the current Realtime sessions API reference did not surface 'temperature' as a documented session field. Sending an undocumented field is typically harmless (silently ignored), but code that depends on an assumed constraint (e.g. 'a hard floor of 0.6') for behavior like deterministic output is relying on a claim that is no longer traceable to any current, citable source.",
+      recommended: true
+    },
+    messages: {
+      unverifiedTemperatureField: "This session.update payload sets 'temperature', a field not documented in the current GA Realtime sessions schema."
+    },
+    schema: []
+  },
+  create(context) {
+    return {
+      ObjectExpression(node) {
+        const typeProp = findProperty4(node, "type");
+        const typeValue = typeProp?.value;
+        const isSessionUpdate = typeValue?.type === "Literal" && typeof typeValue.value === "string" && typeValue.value === "session.update";
+        if (!isSessionUpdate) return;
+        const sessionProp = findProperty4(node, "session");
+        if (sessionProp?.value?.type !== "ObjectExpression") return;
+        const temperatureProp = findProperty4(sessionProp.value, "temperature");
+        if (!temperatureProp) return;
+        context.report({ node: temperatureProp, messageId: "unverifiedTemperatureField" });
+      }
+    };
+  }
+};
+var openaiRealtimeVerifyDeprecatedSessionFieldsRule = rule105;
+
+// src/providers/openai-realtime/rules/buffer-audio-until-session-ready.ts
+var QUEUE_CALL_NAME_PATTERN = /^(push|unshift|enqueue|queue)$/i;
+function readyStateOpenCheckKind(test) {
+  if (test?.type !== "BinaryExpression") return null;
+  const isEq = test.operator === "===" || test.operator === "==";
+  const isNeq = test.operator === "!==" || test.operator === "!=";
+  if (!isEq && !isNeq) return null;
+  const isReadyStateMember = (n) => n?.type === "MemberExpression" && n.property?.type === "Identifier" && n.property.name === "readyState";
+  const isOpenValue = (n) => n?.type === "MemberExpression" && n.property?.type === "Identifier" && n.property.name === "OPEN" || n?.type === "Literal" && n.value === 1;
+  const matches = isReadyStateMember(test.left) && isOpenValue(test.right) || isReadyStateMember(test.right) && isOpenValue(test.left);
+  if (!matches) return null;
+  return isEq ? "is-open" : "is-not-open";
+}
+function hasQueueCall(node, depth = 0) {
+  if (!node || typeof node !== "object" || depth > 40) return false;
+  if (Array.isArray(node)) return node.some((n) => hasQueueCall(n, depth + 1));
+  if (node.type === "CallExpression") {
+    const callee = node.callee;
+    const calleeName = callee?.type === "MemberExpression" && callee.property?.type === "Identifier" ? callee.property.name : callee?.type === "Identifier" ? callee.name : null;
+    if (typeof calleeName === "string" && QUEUE_CALL_NAME_PATTERN.test(calleeName)) return true;
+  }
+  for (const key of Object.keys(node)) {
+    if (key === "parent" || key === "loc" || key === "range") continue;
+    const val = node[key];
+    if (val && typeof val === "object" && hasQueueCall(val, depth + 1)) return true;
+  }
+  return false;
+}
+var rule106 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Audio sent before an OpenAI Realtime socket is open must be buffered, not dropped",
+      category: "reliability",
+      docsUrl: "https://developers.openai.com/api/reference/resources/realtime/client-events",
+      rationale: "Caller audio can arrive before the Realtime WebSocket finishes its connect + session.update round-trip. A readyState !== OPEN branch that only logs and returns silently drops every audio chunk that arrives in that window, meaning the first fragment of speech is lost to translation/processing on every call.",
+      recommended: true
+    },
+    messages: {
+      audioDroppedNotBuffered: "Audio sent while this Realtime socket is not yet open is dropped here instead of being buffered and flushed once open."
+    },
+    schema: []
+  },
+  create(context) {
+    return {
+      IfStatement(node) {
+        const kind = readyStateOpenCheckKind(node.test);
+        if (!kind) return;
+        const notOpenBranch = kind === "is-open" ? node.alternate : node.consequent;
+        if (!notOpenBranch) return;
+        if (hasQueueCall(notOpenBranch)) return;
+        context.report({ node: notOpenBranch, messageId: "audioDroppedNotBuffered" });
+      }
+    };
+  }
+};
+var openaiRealtimeBufferAudioUntilSessionReadyRule = rule106;
+
+// src/providers/openai-realtime/rules/send-safety-identifier.ts
+var rule107 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "OpenAI Realtime connections should send an OpenAI-Safety-Identifier header",
+      category: "security",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime",
+      rationale: "OpenAI's Realtime guidance recommends including an OpenAI-Safety-Identifier header with a stable, privacy-preserving value (e.g. a hashed user/account id) on Realtime connections, to support OpenAI's abuse/safety monitoring for voice content. A connection that omits it gives OpenAI no way to correlate abusive sessions back to an account without per-connection metadata.",
+      recommended: true
+    },
+    messages: {
+      missingSafetyIdentifier: "This OpenAI Realtime WebSocket connection does not send an OpenAI-Safety-Identifier header."
+    },
+    schema: []
+  },
+  create(context) {
+    let urlVarNames = /* @__PURE__ */ new Set();
+    return {
+      Program(node) {
+        urlVarNames = collectOpenAIRealtimeUrlVarNames(node);
+      },
+      NewExpression(node) {
+        if (!isOpenAIRealtimeNewWebSocket(node, urlVarNames)) return;
+        const optionsArg = node.arguments?.[1];
+        const headersProp = optionsArg?.type === "ObjectExpression" ? findProperty4(optionsArg, "headers") : null;
+        const headersObj = headersProp?.value?.type === "ObjectExpression" ? headersProp.value : null;
+        const safetyIdProp = headersObj ? findProperty4(headersObj, "OpenAI-Safety-Identifier") : null;
+        if (safetyIdProp) return;
+        context.report({ node: headersObj ?? optionsArg ?? node, messageId: "missingSafetyIdentifier" });
+      }
+    };
+  }
+};
+var openaiRealtimeSendSafetyIdentifierRule = rule107;
+
+// src/providers/openai-realtime/rules/transcription-model-choice.ts
+var rule108 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "OpenAI Realtime sessions should not configure 'whisper-1' for input transcription",
+      category: "correctness",
+      docsUrl: "https://developers.openai.com/api/docs/guides/realtime-transcription",
+      rationale: "OpenAI's transcription guidance describes 'whisper-1' as for existing Whisper integrations that are not natively streaming, while 'gpt-realtime-whisper' is the natively-streaming option designed for realtime sessions. Configuring input_audio_transcription with 'whisper-1' is the wrong tool for a realtime session, adding latency/cost to a streaming pipeline.",
+      recommended: true
+    },
+    messages: {
+      nonStreamingTranscriptionModel: "This session's input transcription is configured with 'whisper-1', which is not natively streaming and not optimized for realtime sessions."
+    },
+    schema: []
+  },
+  create(context) {
+    return {
+      ObjectExpression(node) {
+        const typeProp = findProperty4(node, "type");
+        const typeValue = typeProp?.value;
+        const isSessionUpdate = typeValue?.type === "Literal" && typeof typeValue.value === "string" && typeValue.value === "session.update";
+        if (!isSessionUpdate) return;
+        const sessionProp = findProperty4(node, "session");
+        if (sessionProp?.value?.type !== "ObjectExpression") return;
+        let transcriptionProp = findProperty4(sessionProp.value, "input_audio_transcription");
+        if (!transcriptionProp) {
+          const audioProp = findProperty4(sessionProp.value, "audio");
+          const inputProp = audioProp?.value?.type === "ObjectExpression" ? findProperty4(audioProp.value, "input") : null;
+          transcriptionProp = inputProp?.value?.type === "ObjectExpression" ? findProperty4(inputProp.value, "transcription") : null;
+        }
+        if (transcriptionProp?.value?.type !== "ObjectExpression") return;
+        const modelProp = findProperty4(transcriptionProp.value, "model");
+        const modelValue = modelProp?.value;
+        const isWhisper1 = modelValue?.type === "Literal" && typeof modelValue.value === "string" && modelValue.value === "whisper-1";
+        if (!isWhisper1) return;
+        context.report({ node: modelProp, messageId: "nonStreamingTranscriptionModel" });
+      }
+    };
+  }
+};
+var openaiRealtimeTranscriptionModelChoiceRule = rule108;
 
 // src/plugin/index.ts
 var plugin = {
@@ -6068,7 +8192,6 @@ var plugin = {
     "firebase-rtdb-write-promise-not-handled": firebaseRtdbWritePromiseNotHandledRule,
     "firebase-firestore-rules-expired": firebaseFirestoreRulesExpiredRule,
     "firebase-id-token-cookie-flags": firebaseIdTokenCookieFlagsRule,
-    "firebase-middleware-token-not-verified": firebaseMiddlewareTokenNotVerifiedRule,
     "firebase-hardcoded-user-id": firebaseHardcodedUserIdRule,
     "firebase-auth-user-not-found-disclosure": firebaseAuthUserNotFoundDisclosureRule,
     "firebase-signup-password-confirm": firebaseSignupPasswordConfirmRule,
@@ -6107,10 +8230,37 @@ var plugin = {
     "tiptap-appendTransaction-add-to-history": tiptapAppendTransactionAddToHistoryRule,
     "tiptap-appendTransaction-full-scan": tiptapAppendTransactionFullScanRule,
     "tiptap-atom-node-wrap-in": tiptapAtomNodeWrapInRule,
-    "tiptap-twitter-url-regex": tiptapTwitterUrlRegexRule,
     "tiptap-drop-handler-pos-precedence": tiptapDropHandlerPosPrecedenceRule,
     "tiptap-prefer-table-kit": tiptapPreferTableKitRule,
-    "tiptap-tiptap-markdown-missing-node-spec": tiptapTiptapMarkdownMissingNodeSpecRule
+    "tiptap-tiptap-markdown-missing-node-spec": tiptapTiptapMarkdownMissingNodeSpecRule,
+    "elevenlabs-validate-signed-url-response": elevenlabsValidateSignedUrlResponseRule,
+    "elevenlabs-no-error-object-logging": elevenlabsNoErrorObjectLoggingRule,
+    "elevenlabs-fetch-timeout-required": elevenlabsFetchTimeoutRequiredRule,
+    "elevenlabs-validate-agent-id-format": elevenlabsValidateAgentIdFormatRule,
+    "elevenlabs-secure-session-id-generation": elevenlabsSecureSessionIdGenerationRule,
+    "elevenlabs-conversation-error-recovery": elevenlabsConversationErrorRecoveryRule,
+    "elevenlabs-api-version-pinning": elevenlabsApiVersionPinningRule,
+    "elevenlabs-check-http-status-before-json": elevenlabsCheckHttpStatusBeforeJsonRule,
+    "elevenlabs-conversation-cleanup-on-error": elevenlabsConversationCleanupOnErrorRule,
+    "elevenlabs-env-var-validation": elevenlabsEnvVarValidationRule,
+    "twilio-validate-webhook-signature": twilioValidateWebhookSignatureRule,
+    "twilio-taskrouter-attributes-match-consumer": twilioTaskrouterAttributesMatchConsumerRule,
+    "twilio-enqueue-task-json-stringify": twilioEnqueueTaskJsonStringifyRule,
+    "twilio-media-streams-key-by-call-sid": twilioMediaStreamsKeyByCallSidRule,
+    "twilio-await-or-catch-rest-calls-in-event-handlers": twilioAwaitOrCatchRestCallsInEventHandlersRule,
+    "twilio-use-twiml-builder-not-string-templates": twilioUseTwimlBuilderNotStringTemplatesRule,
+    "twilio-media-streams-mark-pacing": twilioMediaStreamsMarkPacingRule,
+    "twilio-validate-all-request-inputs": twilioValidateAllRequestInputsRule,
+    "twilio-media-streams-mark-name-string": twilioMediaStreamsMarkNameStringRule,
+    "openai-realtime-migrate-beta-to-ga": openaiRealtimeMigrateBetaToGaRule,
+    "openai-realtime-no-log-raw-message-payloads": openaiRealtimeNoLogRawMessagePayloadsRule,
+    "openai-realtime-handle-error-server-event": openaiRealtimeHandleErrorServerEventRule,
+    "openai-realtime-reconnect-on-drop": openaiRealtimeReconnectOnDropRule,
+    "openai-realtime-avoid-dated-preview-snapshots": openaiRealtimeAvoidDatedPreviewSnapshotsRule,
+    "openai-realtime-verify-deprecated-session-fields": openaiRealtimeVerifyDeprecatedSessionFieldsRule,
+    "openai-realtime-buffer-audio-until-session-ready": openaiRealtimeBufferAudioUntilSessionReadyRule,
+    "openai-realtime-send-safety-identifier": openaiRealtimeSendSafetyIdentifierRule,
+    "openai-realtime-transcription-model-choice": openaiRealtimeTranscriptionModelChoiceRule
   }
 };
 var plugin_default = plugin;