@api-doctor/cli 0.0.5 → 0.0.6

package/dist/plugin.js

@@ -11,7 +11,7 @@ var rule = {
       cwe: "CWE-345",
       owasp: "API2:2023 Broken Authentication",
       rationale: "Webhook endpoints are public URLs, so anyone who learns the path can POST a forged payload. Without verifying the Svix signature first, an attacker can fake delivery, bounce, or complaint events and drive your application into the wrong state. Validating the signature against your webhook secret before reading the body ensures the event genuinely came from Resend.",
-      docsUrl: "https://resend.com/docs/dashboard/webhooks/introduction#verify-webhook-signatures",
+      docsUrl: "https://resend.com/docs/webhooks/verify-webhooks-requests",
       recommended: true
     },
     messages: {
@@ -88,6 +88,15 @@ var rule = {
       const obj = callee.object;
       return obj?.type === "Identifier" && (obj.name === "req" || obj.name === "request");
     }
+    function isReqTextCall(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      const prop = callee.property;
+      if (prop?.type !== "Identifier" || prop.name !== "text") return false;
+      const obj = callee.object;
+      return obj?.type === "Identifier" && (obj.name === "req" || obj.name === "request");
+    }
     function isBodyMember(n) {
       if (n?.type !== "MemberExpression") return false;
       const prop = n.property;
@@ -112,6 +121,17 @@ var rule = {
       const obj = callee.object;
       return obj?.type === "Identifier" && svixImports.has(obj.name);
     }
+    function isResendWebhooksVerifyCall(n) {
+      if (n?.type !== "CallExpression") return false;
+      const callee = n.callee;
+      if (callee?.type !== "MemberExpression") return false;
+      const prop = callee.property;
+      if (prop?.type !== "Identifier" || prop.name !== "verify") return false;
+      const obj = callee.object;
+      if (obj?.type !== "MemberExpression") return false;
+      const webhooksProp = obj.property;
+      return webhooksProp?.type === "Identifier" && webhooksProp.name === "webhooks";
+    }
     function recordFirst(posKey, handler, pos) {
       const existing = handler[posKey];
       if (!existing) {
@@ -126,6 +146,11 @@ var rule = {
       ImportDeclaration(node) {
         const importSource = node?.source?.value;
         if (importSource === "resend") importsResend = true;
+        for (const s of node.specifiers ?? []) {
+          if ((s?.type === "ImportSpecifier" || s?.type === "ImportDefaultSpecifier") && s.local?.type === "Identifier" && /^resend$/i.test(s.local.name)) {
+            importsResend = true;
+          }
+        }
         if (importSource === "svix") {
           for (const s of node.specifiers ?? []) {
             if (s?.type === "ImportSpecifier" && s.local?.type === "Identifier") {
@@ -147,8 +172,10 @@ var rule = {
         for (const handler of postHandlers) {
           if (!within(handler, node)) continue;
           if (isReqJsonCall(node)) recordFirst("firstBodyPos", handler, pos);
+          if (isReqTextCall(node)) recordFirst("firstRawBodyPos", handler, pos);
           if (isSvixVerifyCall(node)) recordFirst("firstVerifyPos", handler, pos);
           if (isCryptoCreateHmacCall(node)) recordFirst("firstVerifyPos", handler, pos);
+          if (isResendWebhooksVerifyCall(node)) recordFirst("firstVerifyPos", handler, pos);
         }
       },
       MemberExpression(node) {
@@ -163,6 +190,8 @@ var rule = {
       "Program:exit"() {
         if (!importsResend) return;
         for (const handler of postHandlers) {
+          const consumesRequest = handler.firstBodyPos || handler.firstRawBodyPos;
+          if (!consumesRequest) continue;
           if (!handler.firstVerifyPos) {
             context.report({ node: handler.node, messageId: "missingVerification" });
             continue;
@@ -734,7 +763,7 @@ var rule11 = {
       description: "Resend webhook handlers should deduplicate retried events",
       category: "reliability",
       rationale: "Resend retries failed webhook deliveries for up to 24 hours, so the same event can legitimately arrive more than once. A handler that acts on every delivery without deduplication will double-process events \u2014 sending duplicate downstream notifications, double-counting metrics, or corrupting state. Tracking processed event ids (e.g. event.data.email_id) in a store or set and skipping ones already seen makes the handler safely idempotent.",
-      docsUrl: "https://resend.com/docs/dashboard/webhooks/introduction",
+      docsUrl: "https://resend.com/docs/webhooks/introduction",
       recommended: true
     },
     messages: {
@@ -1036,12 +1065,12 @@ var rule14 = {
     docs: {
       description: "Supabase queries that select a tenant column must filter by it",
       category: "correctness",
-      rationale: "A column like session_id or user_id existing in the schema (and being selected) signals intent to scope rows to one caller, but selecting it is not the same as filtering by it. Without an .eq()/.match()/.filter() on that column, the query returns every row for every tenant, turning a per-user feed into a single shared, cross-user one.",
+      rationale: "A column like session_id or user_id being selected signals intent to scope rows to one caller, but selecting it is not the same as filtering by it. If RLS is not enabled on the table, the unfiltered query returns every row for every tenant \u2014 a per-user feed becomes a shared, cross-user one. Even when RLS scopes the rows server-side, an explicit .eq()/.match()/.filter() is defense-in-depth (a dropped policy no longer leaks data) and avoids fetching rows the page never uses.",
       docsUrl: "https://supabase.com/docs/reference/javascript/eq",
       recommended: true
     },
     messages: {
-      missingTenantFilter: 'This query selects "{{column}}" but never filters by it. Add .eq("{{column}}", ...) (or .match()/.filter()) to scope results to the caller.'
+      missingTenantFilter: `This query selects "{{column}}" but never filters by it \u2014 without RLS on this table that is every tenant's rows. Add .eq("{{column}}", ...) (or .match()/.filter()) to scope results to the caller.`
     },
     schema: []
   },
@@ -1313,7 +1342,8 @@ function objectHasIdempotencyKey(objectExpression) {
   return (objectExpression.properties ?? []).some((p) => {
     if (p?.type !== "Property") return false;
     const name = p.key?.type === "Identifier" ? p.key.name : p.key?.type === "Literal" ? p.key.value : void 0;
-    return typeof name === "string" && /idempot|dedupe/i.test(name);
+    if (typeof name !== "string") return false;
+    return /idempot|dedupe/i.test(name) || /^(id|uuid)$/i.test(name) || /_(key|uuid)$/i.test(name);
   });
 }
 function insertPayloadHasIdempotencyKey(arg) {
@@ -1329,12 +1359,12 @@ var rule18 = {
     docs: {
       description: "Supabase insert calls should be retry-safe via an idempotency key",
       category: "reliability",
-      rationale: 'Nothing prevents a duplicate row if the client fetch behind an insert is retried (flaky network, double-click, browser replay) \u2014 there is no unique constraint or dedupe key visible in the payload, and no upsert semantics. Generate a client-side idempotency key per logical action and either include it as a field guarded by a unique constraint, or use .upsert(..., { onConflict: "<key column>" }).',
+      rationale: 'Nothing prevents a duplicate row if the client fetch behind an insert is retried (flaky network, double-click, browser replay) \u2014 no unique key is visible in the payload, and no upsert semantics. Include a client-generated unique key (an id, or a *_key field backed by a unique constraint), or use .upsert(..., { onConflict: "<key column>" }). This is general retry-safety practice rather than a documented Supabase requirement, hence info severity.',
       docsUrl: "https://supabase.com/docs/reference/javascript/upsert",
       recommended: true
     },
     messages: {
-      missingIdempotencyKey: 'This insert has no idempotency/dedupe key field, so a retried request can create a duplicate row. Add one, or use .upsert(..., { onConflict: "<key column>" }).'
+      missingIdempotencyKey: 'This insert payload has no unique/idempotency key field, so a retried request can create a duplicate row. Include a client-generated key, or use .upsert(..., { onConflict: "<key column>" }).'
     },
     schema: []
   },
@@ -1383,7 +1413,7 @@ var rule19 = {
     docs: {
       description: "createClient must fail fast when required env vars are missing",
       category: "reliability",
-      rationale: "createClient does not throw on undefined arguments \u2014 a missing env var surfaces later as an opaque error deep in a fetch call rather than a clear message at startup. Checking presence before calling createClient turns a confusing runtime failure (e.g. on a misconfigured second service) into an immediate, actionable one.",
+      rationale: `createClient throws immediately when an argument is missing, but with the SDK's message ("supabaseKey is required.") \u2014 it names the SDK parameter, not your env var. An explicit presence check produces an error naming the exact variable to set, which matters most with Next.js NEXT_PUBLIC_* inlining where the fix is a rebuild with the var present, not a server restart.`,
       docsUrl: "https://supabase.com/docs/reference/javascript/initializing",
       recommended: true
     },
@@ -1393,7 +1423,11 @@ var rule19 = {
     schema: []
   },
   create(context) {
-    let createClientLocalName;
+    const FACTORY_IMPORTS = {
+      "@supabase/supabase-js": ["createClient"],
+      "@supabase/ssr": ["createBrowserClient", "createServerClient"]
+    };
+    const factoryLocalNames = /* @__PURE__ */ new Set();
     const envVarOfVariable = /* @__PURE__ */ new Map();
     const validatedVarNames = /* @__PURE__ */ new Set();
     const validatedEnvNames = /* @__PURE__ */ new Set();
@@ -1427,10 +1461,11 @@ var rule19 = {
     }
     return {
       ImportDeclaration(node) {
-        if (node.source?.value !== "@supabase/supabase-js") return;
+        const factories = FACTORY_IMPORTS[node.source?.value];
+        if (!factories) return;
         for (const s of node.specifiers ?? []) {
-          if (s?.type === "ImportSpecifier" && s.imported?.type === "Identifier" && s.imported.name === "createClient" && s.local?.type === "Identifier") {
-            createClientLocalName = s.local.name;
+          if (s?.type === "ImportSpecifier" && s.imported?.type === "Identifier" && factories.includes(s.imported.name) && s.local?.type === "Identifier") {
+            factoryLocalNames.add(s.local.name);
           }
         }
       },
@@ -1444,8 +1479,8 @@ var rule19 = {
         collectGuardTargets(node.test);
       },
       CallExpression(node) {
-        if (!createClientLocalName) return;
-        if (node.callee?.type !== "Identifier" || node.callee.name !== createClientLocalName) return;
+        if (factoryLocalNames.size === 0) return;
+        if (node.callee?.type !== "Identifier" || !factoryLocalNames.has(node.callee.name)) return;
         const missing = [];
         for (const rawArg of node.arguments ?? []) {
           const arg = unwrapNonNull(rawArg);
@@ -1513,8 +1548,8 @@ var rule20 = {
       category: "security",
       cwe: "CWE-285",
       owasp: "A01:2021 Broken Access Control",
-      rationale: "Supabase documents raw_user_meta_data as client-writable and unsuitable for authorization. Reading user_metadata.role (or writing role into signUp/updateUser data) lets any signed-in user self-assign privileged roles from the browser. Store roles in app_metadata via a trusted server path, or in an RLS-protected profiles table.",
-      docsUrl: "https://supabase.com/docs/guides/database/postgres/row-level-security",
+      rationale: 'Supabase documents user_metadata as user-editable: "Do not use it in security sensitive context (such as in RLS policies or authorization logic), as this value is editable by the user without any checks." Reading user_metadata.role (or writing role into signUp/updateUser data) lets any signed-in user self-assign privileged roles from the browser. Store roles in app_metadata via a trusted server path, or in an RLS-protected profiles table.',
+      docsUrl: "https://supabase.com/docs/guides/auth/users",
       recommended: true
     },
     messages: {
@@ -1550,7 +1585,7 @@ var rule21 = {
     docs: {
       description: "Supabase .single() calls must inspect the returned error field",
       category: "correctness",
-      rationale: ".single() signals zero-or-one-row intent via the error field (PGRST116), not by leaving data undefined silently. Destructuring only data and never reading error produces infinite spinners on deleted rows, bad IDs, or RLS-denied reads. Prefer .maybeSingle() or branch on error before rendering.",
+      rationale: ".single() signals zero-or-one-row intent via the error field (PGRST116), not by leaving data undefined silently. Destructuring only data and never reading error produces infinite spinners on deleted rows, bad IDs, or RLS-denied reads. Prefer .maybeSingle() or branch on error before rendering. Chains ending in .throwOnError() opt into exceptions instead and are exempt.",
       docsUrl: "https://supabase.com/docs/reference/javascript/single",
       recommended: true
     },
@@ -1560,14 +1595,29 @@ var rule21 = {
     schema: []
   },
   create(context) {
+    const deferredBindings = [];
+    const errorReadNames = /* @__PURE__ */ new Set();
     function checkAwaitBinding(node, pattern, awaitExpr) {
       if (!isSingleSupabaseQuery(awaitExpr.argument)) return;
+      if (chainHasMethod(awaitExpr.argument, "throwOnError")) return;
+      if (pattern?.type === "Identifier") {
+        deferredBindings.push({ node, name: pattern.name });
+        return;
+      }
       const names = destructuredNames(pattern);
       if (names.has("error")) return;
       context.report({ node, messageId: "missingErrorCheck" });
     }
     return {
+      MemberExpression(node) {
+        if (!node.computed && node.object?.type === "Identifier" && node.property?.type === "Identifier" && node.property.name === "error") {
+          errorReadNames.add(node.object.name);
+        }
+      },
       VariableDeclarator(node) {
+        if (node.init?.type === "Identifier" && node.id?.type === "ObjectPattern") {
+          if (destructuredNames(node.id).has("error")) errorReadNames.add(node.init.name);
+        }
         if (node.init?.type !== "AwaitExpression") return;
         checkAwaitBinding(node, node.id, node.init);
       },
@@ -1579,9 +1629,17 @@ var rule21 = {
         const expr = node.expression;
         if (expr?.type !== "AwaitExpression") return;
         if (!isSingleSupabaseQuery(expr.argument)) return;
+        if (chainHasMethod(expr.argument, "throwOnError")) return;
         if (memberPropName(expr.argument) === "single") {
           context.report({ node, messageId: "missingErrorCheck" });
         }
+      },
+      "Program:exit"() {
+        for (const { node, name } of deferredBindings) {
+          if (!errorReadNames.has(name)) {
+            context.report({ node, messageId: "missingErrorCheck" });
+          }
+        }
       }
     };
   }
@@ -1690,7 +1748,7 @@ var rule23 = {
     docs: {
       description: "Supabase mutations must check the returned error field",
       category: "correctness",
-      rationale: "Unlike fetch(), Supabase client mutations return { data, error } and resolve even when RLS denies the write or a constraint fails. Fire-and-forget awaits or destructuring only data lets optimistic UI state diverge from the database with no toast or rollback.",
+      rationale: "Unlike fetch(), Supabase client mutations return { data, error } and resolve even when RLS denies the write or a constraint fails. Fire-and-forget awaits or destructuring only data lets optimistic UI state diverge from the database with no toast or rollback. Chains ending in .throwOnError() opt into exceptions instead and are exempt.",
       docsUrl: "https://supabase.com/docs/reference/javascript/insert",
       recommended: true
     },
@@ -1700,30 +1758,52 @@ var rule23 = {
     schema: []
   },
   create(context) {
+    const deferredBindings = [];
+    const errorReadNames = /* @__PURE__ */ new Set();
     function checkMutationAwait(node, pattern, awaitExpr) {
       if (!isSupabaseMutationCall(awaitExpr.argument)) return;
+      if (chainHasMethod(awaitExpr.argument, "throwOnError")) return;
       if (!pattern) {
         context.report({ node, messageId: "uncheckedMutation" });
         return;
       }
+      if (pattern.type === "Identifier") {
+        deferredBindings.push({ node, name: pattern.name });
+        return;
+      }
       const names = destructuredNames(pattern);
       if (!names.has("error")) {
         context.report({ node, messageId: "uncheckedMutation" });
       }
     }
     return {
+      MemberExpression(node) {
+        if (!node.computed && node.object?.type === "Identifier" && node.property?.type === "Identifier" && node.property.name === "error") {
+          errorReadNames.add(node.object.name);
+        }
+      },
       ExpressionStatement(node) {
         const expr = node.expression;
         if (expr?.type !== "AwaitExpression") return;
         checkMutationAwait(node, void 0, expr);
       },
       VariableDeclarator(node) {
+        if (node.init?.type === "Identifier" && node.id?.type === "ObjectPattern") {
+          if (destructuredNames(node.id).has("error")) errorReadNames.add(node.init.name);
+        }
         if (node.init?.type !== "AwaitExpression") return;
         checkMutationAwait(node, node.id, node.init);
       },
       AssignmentExpression(node) {
         if (node.right?.type !== "AwaitExpression") return;
         checkMutationAwait(node, node.left, node.right);
+      },
+      "Program:exit"() {
+        for (const { node, name } of deferredBindings) {
+          if (!errorReadNames.has(name)) {
+            context.report({ node, messageId: "uncheckedMutation" });
+          }
+        }
       }
     };
   }
@@ -1773,11 +1853,20 @@ function isStorageUploadCall(node) {
   let current = node;
   let sawStorage = false;
   let sawUpload = false;
-  while (current?.type === "CallExpression") {
-    const prop = memberPropName(current);
-    if (prop === "storage") sawStorage = true;
-    if (prop === "upload") sawUpload = true;
-    current = chainObjectCall(current);
+  while (current) {
+    if (current.type === "CallExpression") {
+      const prop = memberPropName(current);
+      if (prop === "storage") sawStorage = true;
+      if (prop === "upload") sawUpload = true;
+      current = current.callee?.object;
+    } else if (current.type === "MemberExpression") {
+      const p = current.property;
+      const name = !current.computed && p?.type === "Identifier" ? p.name : p?.type === "Literal" && typeof p.value === "string" ? p.value : void 0;
+      if (name === "storage") sawStorage = true;
+      current = current.object;
+    } else {
+      break;
+    }
   }
   return sawStorage && sawUpload;
 }
@@ -2358,8 +2447,8 @@ var rule30 = {
       category: "security",
       cwe: "CWE-285",
       owasp: "A04:2021 Insecure Design",
-      rationale: "Firebase web API keys are public by design and only identify the project to Google's backend \u2014 they are not a secret. The only things standing between an attacker who clones the client config and your database/auth quota are Security Rules and App Check. A file that calls initializeApp but never initializeAppCheck leaves App Check unconfigured, so any client presenting a valid project config (not necessarily yours) can reach Firebase Auth and, subject to rules, the database.",
-      docsUrl: "https://firebase.google.com/docs/database/web/start",
+      rationale: "Firebase web API keys are public by design and only identify the project to Google's backend \u2014 they are not a secret. The only things standing between an attacker who clones the client config and your database/auth quota are Security Rules and App Check. A file that calls initializeApp but never initializeAppCheck leaves App Check unconfigured, so any client presenting a valid project config (not necessarily yours) can reach Firebase Auth and, subject to rules, the database. Note the client-side call alone is not enough: App Check only blocks traffic once enforcement is turned on per-product in the Firebase console.",
+      docsUrl: "https://firebase.google.com/docs/app-check/web/recaptcha-provider",
       recommended: true
     },
     messages: {
@@ -2533,7 +2622,13 @@ function isValidationLikeCall(node) {
   const callee = node.callee;
   const name = callee?.type === "Identifier" ? callee.name : callee?.type === "MemberExpression" && !callee.computed && callee.property?.type === "Identifier" ? callee.property.name : void 0;
   if (!name) return false;
-  return /valid|^test$|check|assert|schema/i.test(name);
+  if (/valid|^test$|check|assert|schema/i.test(name)) return true;
+  if (callee?.type === "MemberExpression") {
+    if (/^(safeParse|safeParseAsync|parseAsync)$/.test(name)) return true;
+    const objName = callee.object?.type === "Identifier" ? callee.object.name : void 0;
+    if (name === "parse" && objName !== "JSON") return true;
+  }
+  return false;
 }
 var rule33 = {
   meta: {
@@ -2722,18 +2817,24 @@ var firebaseRtdbListenerErrorNotHandledRule = rule35;
 function isUseEffectCall(node) {
   return node?.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "useEffect";
 }
+function isNonUidMemberAccess(node, objName) {
+  if (node?.type !== "MemberExpression") return false;
+  if (node.object?.type !== "Identifier" || node.object.name !== objName) return false;
+  if (node.computed) return true;
+  return node.property?.type === "Identifier" && node.property.name !== "uid";
+}
 var rule36 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "useEffect should depend on user?.uid, not the whole user object",
       category: "reliability",
-      rationale: "onAuthStateChanged delivers a new user object reference on every internal token refresh (roughly hourly) even when uid is unchanged. An effect that only reads user.uid but lists the whole user object in its dependency array tears down and re-establishes its RTDB listener on every refresh \u2014 an avoidable unsubscribe/resubscribe cycle that briefly clears local state.",
+      rationale: "Auth context providers commonly hand out a new user object reference on every token refresh (roughly hourly) \u2014 providers subscribed to onIdTokenChanged, or ones that clone the user into React state, re-render with a fresh reference even when uid is unchanged. An effect that only reads user.uid but lists the whole user object in its dependency array tears down and re-establishes its RTDB listener on every refresh \u2014 an avoidable unsubscribe/resubscribe cycle that briefly clears local state.",
       docsUrl: "https://firebase.google.com/docs/reference/js/auth.md#onauthstatechanged",
       recommended: true
     },
     messages: {
-      wholeUserObjectDep: "This effect only reads {{name}}.uid but depends on the whole {{name}} object, which gets a new reference on every token refresh. Depend on {{name}}?.uid instead."
+      wholeUserObjectDep: "This effect only reads {{name}}.uid but depends on the whole {{name}} object, which can get a new reference on every token refresh. Depend on {{name}}?.uid instead."
     },
     schema: []
   },
@@ -2746,9 +2847,9 @@ var rule36 = {
         for (const el of depsArg.elements ?? []) {
           if (el?.type !== "Identifier") continue;
           const name = el.name;
-          if (someDescendant(callback, (n) => isUidMemberAccess(n, name))) {
-            context.report({ node, messageId: "wholeUserObjectDep", data: { name } });
-          }
+          if (!someDescendant(callback, (n) => isUidMemberAccess(n, name))) continue;
+          if (someDescendant(callback, (n) => isNonUidMemberAccess(n, name))) continue;
+          context.report({ node, messageId: "wholeUserObjectDep", data: { name } });
         }
       }
     };
@@ -2844,13 +2945,13 @@ var rule38 = {
     schema: []
   },
   create(context) {
-    const EXPIRED_YEAR = 2025;
     function checkStringForExpiredDate(value, reportNode) {
-      const re = /timestamp\.date\(\s*(\d{4})\s*,/g;
+      const re = /timestamp\.date\(\s*(\d{4})\s*,\s*(\d{1,2})\s*,\s*(\d{1,2})\s*\)/g;
       let match;
       while ((match = re.exec(value)) !== null) {
-        const year = parseInt(match[1], 10);
-        if (year <= EXPIRED_YEAR) {
+        const [, year, month, day] = match;
+        const expiry = new Date(parseInt(year, 10), parseInt(month, 10) - 1, parseInt(day, 10));
+        if (expiry.getTime() <= Date.now()) {
           context.report({ node: reportNode, messageId: "firestoreRulesExpired" });
           return;
         }
@@ -2882,6 +2983,18 @@ function findProp(obj, name) {
     (p) => p?.type === "Property" && (p.key?.type === "Identifier" && p.key.name === name || p.key?.type === "Literal" && p.key.value === name)
   );
 }
+var TOKEN_NAME = /token|session/i;
+function isTokenLiteral(node) {
+  return node?.type === "Literal" && typeof node.value === "string" && TOKEN_NAME.test(node.value);
+}
+function isCookieReceiver(obj) {
+  if (obj?.type === "Identifier") return /cookie/i.test(obj.name);
+  if (obj?.type === "CallExpression" && obj.callee?.type === "Identifier") return /^cookies$/i.test(obj.callee.name);
+  if (obj?.type === "MemberExpression" && !obj.computed && obj.property?.type === "Identifier") {
+    return /cookie/i.test(obj.property.name);
+  }
+  return false;
+}
 var rule39 = {
   meta: {
     type: "problem",
@@ -2889,110 +3002,71 @@ var rule39 = {
       description: "Firebase ID token stored in a cookie without httpOnly flag",
       category: "security",
       cwe: "CWE-1004",
-      owasp: "A02:2021 Cryptographic Failures",
-      rationale: "Storing a Firebase ID token in a non-httpOnly cookie makes it readable by any JavaScript on the page. An XSS vulnerability can steal the token and impersonate the user. Use the Firebase Admin SDK createSessionCookie flow to issue a proper httpOnly session cookie instead.",
+      owasp: "A05:2021 Security Misconfiguration",
+      rationale: "Storing a Firebase ID token in a non-httpOnly cookie makes it readable by any JavaScript on the page. An XSS vulnerability can steal the token and impersonate the user. Use the Firebase Admin SDK createSessionCookie flow to issue a proper httpOnly session cookie instead \u2014 note httpOnly can only be set from server-side code, never from client-side JavaScript.",
       docsUrl: "https://firebase.google.com/docs/auth/admin/manage-cookies",
       recommended: true
     },
     messages: {
-      idTokenCookieMissingHttpOnly: "Firebase ID token stored in cookie without httpOnly: true. Any XSS vulnerability can steal the token. Use the Firebase Admin SDK createSessionCookie flow instead."
+      idTokenCookieMissingHttpOnly: "Auth token stored in cookie without httpOnly: true. Any XSS vulnerability can steal the token. Use the Firebase Admin SDK createSessionCookie flow instead."
     },
     schema: []
   },
   create(context) {
-    function isTokenName(val) {
-      return /token/i.test(val);
-    }
     function hasHttpOnlyTrue(optsNode) {
-      if (optsNode?.type !== "ObjectExpression") return false;
       const prop = findProp(optsNode, "httpOnly");
-      if (!prop) return false;
-      return prop.value?.type === "Literal" && prop.value.value === true;
-    }
-    return {
-      CallExpression(node) {
-        const callee = node.callee;
-        const isCookieSet = callee?.type === "Identifier" && callee.name === "setCookie";
-        if (!isCookieSet) return;
-        const args = node.arguments ?? [];
-        const nameArg = args[0];
-        if (nameArg?.type !== "Literal" || typeof nameArg.value !== "string") return;
-        if (!isTokenName(nameArg.value)) return;
-        const optsArg = args.length >= 3 ? args[2] : null;
-        if (!optsArg || optsArg.type !== "ObjectExpression") {
-          context.report({ node, messageId: "idTokenCookieMissingHttpOnly" });
-          return;
-        }
-        if (!hasHttpOnlyTrue(optsArg)) {
+      return prop?.value?.type === "Literal" && prop.value.value === true;
+    }
+    function checkNameValueOptsCall(node) {
+      const args = node.arguments ?? [];
+      if (args.length === 1 && args[0]?.type === "ObjectExpression") {
+        const nameProp = findProp(args[0], "name");
+        if (!isTokenLiteral(nameProp?.value)) return;
+        if (!hasHttpOnlyTrue(args[0])) {
           context.report({ node, messageId: "idTokenCookieMissingHttpOnly" });
         }
+        return;
+      }
+      if (!isTokenLiteral(args[0])) return;
+      const optsArg = args.length >= 3 ? args[2] : null;
+      if (!optsArg || optsArg.type !== "ObjectExpression" || !hasHttpOnlyTrue(optsArg)) {
+        context.report({ node, messageId: "idTokenCookieMissingHttpOnly" });
       }
-    };
-  }
-};
-var firebaseIdTokenCookieFlagsRule = rule39;
-
-// src/providers/firebase/rules/middleware-token-not-verified.ts
-var rule40 = {
-  meta: {
-    type: "problem",
-    docs: {
-      description: "Next.js middleware reads auth cookie but never verifies it",
-      category: "security",
-      cwe: "CWE-345",
-      owasp: "A07:2021 Identification and Authentication Failures",
-      rationale: "Checking only that an auth cookie is non-empty does not verify the token. An attacker who sets any non-empty cookie value will bypass the guard entirely. The middleware must call verifySessionCookie or verifyIdToken to confirm the token is valid and unexpired.",
-      docsUrl: "https://firebase.google.com/docs/auth/admin/manage-cookies#verify_session_cookies_and_check_permissions",
-      recommended: true
-    },
-    messages: {
-      tokenNotVerified: "Middleware reads the auth cookie but never verifies it. Any non-empty cookie value bypasses the guard. Call adminAuth.verifySessionCookie() or verifyIdToken() before allowing access."
-    },
-    schema: []
-  },
-  create(context) {
-    const AUTH_COOKIE_NAMES = /token|session/i;
-    const VERIFY_METHOD_NAMES = /* @__PURE__ */ new Set(["verifySessionCookie", "verifyIdToken", "verify"]);
-    let readsCookieWithAuthName = false;
-    let hasVerifyCall = false;
-    const cookieReadNodes = [];
-    function isAuthCookieGet(node) {
-      if (node?.type !== "CallExpression") return false;
-      const callee = node.callee;
-      if (callee?.type !== "MemberExpression") return false;
-      if (callee.property?.type !== "Identifier" || callee.property.name !== "get") return false;
-      const arg = node.arguments?.[0];
-      if (arg?.type !== "Literal" || typeof arg.value !== "string") return false;
-      return AUTH_COOKIE_NAMES.test(arg.value);
     }
     return {
       CallExpression(node) {
-        if (isAuthCookieGet(node)) {
-          readsCookieWithAuthName = true;
-          cookieReadNodes.push(node);
-        }
         const callee = node.callee;
-        if (callee?.type === "Identifier" && VERIFY_METHOD_NAMES.has(callee.name)) {
-          hasVerifyCall = true;
+        if (callee?.type === "Identifier" && callee.name === "setCookie") {
+          checkNameValueOptsCall(node);
+          return;
+        }
+        if (callee?.type !== "MemberExpression" || callee.computed || callee.property?.type !== "Identifier") return;
+        if (callee.property.name === "cookie") {
+          checkNameValueOptsCall(node);
+          return;
         }
-        if (callee?.type === "MemberExpression" && callee.property?.type === "Identifier" && VERIFY_METHOD_NAMES.has(callee.property.name)) {
-          hasVerifyCall = true;
+        if (callee.property.name === "set" && isCookieReceiver(callee.object)) {
+          checkNameValueOptsCall(node);
         }
       },
-      "Program:exit"() {
-        if (readsCookieWithAuthName && !hasVerifyCall) {
-          for (const node of cookieReadNodes) {
-            context.report({ node, messageId: "tokenNotVerified" });
-          }
+      // document.cookie = `token=${idToken}` — can never be httpOnly
+      AssignmentExpression(node) {
+        const left = node.left;
+        const isDocumentCookie = left?.type === "MemberExpression" && !left.computed && left.object?.type === "Identifier" && left.object.name === "document" && left.property?.type === "Identifier" && left.property.name === "cookie";
+        if (!isDocumentCookie) return;
+        const right = node.right;
+        const text = right?.type === "Literal" && typeof right.value === "string" ? right.value : right?.type === "TemplateLiteral" ? (right.quasis ?? []).map((q) => q?.value?.cooked ?? "").join("") : "";
+        if (/(?:^|;\s*)[^=;]*(?:token|session)[^=;]*=/i.test(text)) {
+          context.report({ node, messageId: "idTokenCookieMissingHttpOnly" });
         }
       }
     };
   }
 };
-var firebaseMiddlewareTokenNotVerifiedRule = rule40;
+var firebaseIdTokenCookieFlagsRule = rule39;
 
 // src/providers/firebase/rules/hardcoded-user-id.ts
-var rule41 = {
+var rule40 = {
   meta: {
     type: "problem",
     docs: {
@@ -3010,6 +3084,9 @@ var rule41 = {
     schema: []
   },
   create(context) {
+    if (isInsideTestFile2(String(context.filename ?? ""))) {
+      return {};
+    }
     const USER_ID_NAMES = /* @__PURE__ */ new Set(["userId", "uid", "userID", "user_id"]);
     return {
       VariableDeclarator(node) {
@@ -3024,10 +3101,10 @@ var rule41 = {
     };
   }
 };
-var firebaseHardcodedUserIdRule = rule41;
+var firebaseHardcodedUserIdRule = rule40;
 
 // src/providers/firebase/rules/auth-user-not-found-disclosure.ts
-var rule42 = {
+var rule41 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -3066,10 +3143,10 @@ var rule42 = {
     };
   }
 };
-var firebaseAuthUserNotFoundDisclosureRule = rule42;
+var firebaseAuthUserNotFoundDisclosureRule = rule41;
 
 // src/providers/firebase/rules/signup-password-confirm.ts
-var rule43 = {
+var rule42 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -3103,7 +3180,7 @@ var rule43 = {
       },
       BinaryExpression(node) {
         if (node.operator !== "===" && node.operator !== "==" && node.operator !== "!==" && node.operator !== "!=") return;
-        const mentionsConfirm = (n) => n?.type === "Identifier" && n.name === "confirmPassword";
+        const mentionsConfirm = (n) => n?.type === "Identifier" && n.name === "confirmPassword" || n?.type === "MemberExpression" && !n.computed && n.property?.type === "Identifier" && n.property.name === "confirmPassword";
         if (mentionsConfirm(node.left) || mentionsConfirm(node.right)) {
           hasPasswordComparison = true;
         }
@@ -3126,16 +3203,16 @@ var rule43 = {
     };
   }
 };
-var firebaseSignupPasswordConfirmRule = rule43;
+var firebaseSignupPasswordConfirmRule = rule42;
 
 // src/providers/firebase/rules/use-array-union-remove.ts
-var rule44 = {
+var rule43 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "Firestore array field updated with read-modify-write spread/filter instead of arrayUnion/arrayRemove",
       category: "correctness",
-      rationale: "Spreading an array or using filter() inside updateDoc() performs a non-atomic read-modify-write that loses concurrent updates. Firestore provides arrayUnion() and arrayRemove() specifically for atomic array updates that do not require reading the document first.",
+      rationale: "Spreading an array or using filter() inside updateDoc() performs a non-atomic read-modify-write that loses concurrent updates. Firestore provides arrayUnion() and arrayRemove() specifically for atomic array updates that do not require reading the document first. Caveat: arrayRemove() matches whole element values \u2014 to remove object items by a predicate (e.g. by id), use runTransaction() instead so the read-modify-write is atomic.",
       docsUrl: "https://firebase.google.com/docs/firestore/manage-data/add-data#update_elements_in_an_array",
       recommended: true
     },
@@ -3175,10 +3252,10 @@ var rule44 = {
     };
   }
 };
-var firebaseUseArrayUnionRemoveRule = rule44;
+var firebaseUseArrayUnionRemoveRule = rule43;
 
 // src/providers/firebase/rules/duplicate-initialize-app.ts
-var rule45 = {
+var rule44 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -3211,9 +3288,11 @@ var rule45 = {
         const callee = node.callee;
         if (callee?.type !== "Identifier") return;
         if (initializeAppLocalName && callee.name === initializeAppLocalName) {
-          initializeAppCalls.push(node);
+          if ((node.arguments ?? []).length < 2) {
+            initializeAppCalls.push(node);
+          }
         }
-        if (callee.name === "getApps") {
+        if (callee.name === "getApps" || callee.name === "getApp") {
           hasGetAppsCall = true;
         }
       },
@@ -3226,21 +3305,21 @@ var rule45 = {
     };
   }
 };
-var firebaseDuplicateInitializeAppRule = rule45;
+var firebaseDuplicateInitializeAppRule = rule44;
 
 // src/providers/firebase/rules/onSnapshot-async-throw.ts
-var rule46 = {
+var rule45 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "throw inside async onSnapshot callback creates an unhandled promise rejection",
       category: "reliability",
-      rationale: "onSnapshot does not handle Promise rejections from its callback. A throw inside an async callback becomes an unhandled rejection, silently terminating the listener and leaving the UI in a broken state with no error feedback.",
+      rationale: "onSnapshot ignores the promise returned by an async callback, so a throw inside one becomes an unhandled promise rejection: the error never reaches the UI or the onSnapshot error callback (which only fires for stream errors), and in Node it can crash the process. The listener keeps delivering snapshots, but every one that hits the throw fails invisibly.",
       docsUrl: "https://firebase.google.com/docs/firestore/query-data/listen#handle_listen_errors",
       recommended: true
     },
     messages: {
-      asyncThrowInSnapshot: "throw inside an async onSnapshot callback creates an unhandled promise rejection. The listener silently stops. Use return with error logging or the onSnapshot error callback instead."
+      asyncThrowInSnapshot: "throw inside an async onSnapshot callback creates an unhandled promise rejection \u2014 the error surfaces nowhere. Catch it in the callback and set error state instead of throwing."
     },
     schema: []
   },
@@ -3280,10 +3359,10 @@ var rule46 = {
     };
   }
 };
-var firebaseOnSnapshotAsyncThrowRule = rule46;
+var firebaseOnSnapshotAsyncThrowRule = rule45;
 
 // src/providers/firebase/rules/onSnapshot-missing-error-callback.ts
-var rule47 = {
+var rule46 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -3321,21 +3400,21 @@ var rule47 = {
     };
   }
 };
-var firebaseOnSnapshotMissingErrorCallbackRule = rule47;
+var firebaseOnSnapshotMissingErrorCallbackRule = rule46;
 
 // src/providers/firebase/rules/firestore-document-size-guard.ts
-var rule48 = {
+var rule47 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "Firestore write includes editor.getJSON() without a document size guard",
       category: "reliability",
-      rationale: "Firestore documents have a 1 MiB limit. When a rich-text editor stores base64 images inline, a single paste can push the document over the limit. The write silently fails with INVALID_ARGUMENT. Always check document size before calling updateDoc/setDoc when the payload includes editor JSON.",
+      rationale: "Firestore documents have a 1 MiB limit. When a rich-text editor stores base64 images inline, a single paste can push the document over the limit. The write is rejected with INVALID_ARGUMENT \u2014 and if that rejection is not handled, nothing surfaces to the user. Check document size (e.g. new Blob([JSON.stringify(payload)]).size) before calling updateDoc/setDoc when the payload includes editor JSON.",
       docsUrl: "https://firebase.google.com/docs/firestore/quotas#limits",
       recommended: true
     },
     messages: {
-      missingDocumentSizeGuard: "Firestore write includes editor.getJSON() without a document size check. Base64 images can exceed the 1 MiB Firestore limit, silently failing the write. Add a Blob size guard before calling updateDoc/setDoc."
+      missingDocumentSizeGuard: "Firestore write includes editor.getJSON() without a document size check. Base64 images can exceed the 1 MiB Firestore limit and the write is rejected. Add a size guard (new Blob([JSON.stringify(payload)]).size) before calling updateDoc/setDoc."
     },
     schema: []
   },
@@ -3375,21 +3454,21 @@ var rule48 = {
     };
   }
 };
-var firebaseFirestoreDocumentSizeGuardRule = rule48;
+var firebaseFirestoreDocumentSizeGuardRule = rule47;
 
 // src/providers/firebase/rules/use-timestamp-now.ts
-var rule49 = {
+var rule48 = {
   meta: {
     type: "suggestion",
     docs: {
-      description: "new Date() used for Firestore timestamp instead of Timestamp.now() or serverTimestamp()",
+      description: "new Date() used for Firestore timestamp instead of serverTimestamp()",
       category: "correctness",
-      rationale: "While Firestore auto-converts Date objects on write, mixing new Date() with Timestamp.now() creates type inconsistencies. Firestore security rules that compare request.resource.data.createdAt against request.time expect a Timestamp on both sides; a bare Date object can cause silent rule evaluation failures.",
+      rationale: "Firestore auto-converts Date objects to Timestamps on write, so new Date() and Timestamp.now() are equivalent \u2014 both use the client clock, which cannot be trusted (skewed or deliberately changed clocks produce wrong orderings). serverTimestamp() stamps the value on the server instead, and it is the only option that satisfies security rules comparing a field against request.time (e.g. createdAt == request.time), which reject both new Date() and Timestamp.now().",
       docsUrl: "https://firebase.google.com/docs/reference/js/firestore_.timestamp",
       recommended: true
     },
     messages: {
-      useTimestampNow: "Use Timestamp.now() or serverTimestamp() instead of new Date() for Firestore timestamp fields. new Date() creates type inconsistencies with security rules that compare against request.time."
+      useTimestampNow: "Use serverTimestamp() instead of new Date() for Firestore timestamp fields. new Date() uses the untrusted client clock and fails rules that compare against request.time."
     },
     schema: []
   },
@@ -3398,7 +3477,7 @@ var rule49 = {
     return {
       ImportDeclaration(node) {
         const src = node.source?.value;
-        if (typeof src === "string" && (src.startsWith("firebase/") || src === "firebase-admin/firestore")) {
+        if (typeof src === "string" && (src.startsWith("firebase/firestore") || src === "firebase-admin/firestore")) {
           importsFromFirestore = true;
         }
       },
@@ -3411,7 +3490,7 @@ var rule49 = {
     };
   }
 };
-var firebaseUseTimestampNowRule = rule49;
+var firebaseUseTimestampNowRule = rule48;
 
 // src/providers/lovable/utils.ts
 var LLM_HOST_PATTERN = /api\.anthropic\.com|api\.openai\.com/;
@@ -3426,7 +3505,7 @@ function containsKnownLlmHost(node) {
 }
 
 // src/providers/lovable/rules/no-client-side-secret-fetch.ts
-var rule50 = {
+var rule49 = {
   meta: {
     type: "problem",
     docs: {
@@ -3499,13 +3578,13 @@ var rule50 = {
     };
   }
 };
-var lovableNoClientSideSecretFetchRule = rule50;
+var lovableNoClientSideSecretFetchRule = rule49;
 
 // src/providers/lovable/rules/paid-flag-without-edge-function.ts
 var PRICE_PATTERN = /\$\s?\d/;
 var FLAG_PROPERTY_PATTERN = /^is_[a-z0-9_]+$/i;
 var FLAG_SUFFIX_PATTERN = /_(unlocked|active|enabled)$/i;
-var rule51 = {
+var rule50 = {
   meta: {
     type: "problem",
     docs: {
@@ -3514,7 +3593,7 @@ var rule51 = {
       cwe: "CWE-840",
       owasp: "A04:2021 \u2013 Insecure Design",
       rationale: "Lovable documents payment processing as Edge Function territory specifically so purchase/premium-access flags are only ever set after a payment provider confirms payment server-side. A handler that writes a paid-looking flag straight from the client with no payment call in between either never actually charges anyone, or \u2014 even if a charge happens elsewhere \u2014 leaves the flag itself freely settable by any caller with write access to the row.",
-      docsUrl: "https://docs.lovable.dev/features/cloud",
+      docsUrl: "https://docs.lovable.dev/integrations/stripe",
       recommended: true
     },
     messages: {
@@ -3647,20 +3726,20 @@ var rule51 = {
     };
   }
 };
-var lovablePaidFlagWithoutEdgeFunctionRule = rule51;
+var lovablePaidFlagWithoutEdgeFunctionRule = rule50;
 
 // src/providers/lovable/rules/expiry-column-never-checked.ts
 var EXPIRY_COLUMN_PATTERN = /_(until|expires?_at|expiry)$/i;
 var DATE_COMPARISON_OPERATORS = /* @__PURE__ */ new Set([">", "<", ">=", "<="]);
 var FILTER_METHODS = /* @__PURE__ */ new Set(["gt", "gte", "lt", "lte"]);
-var rule52 = {
+var rule51 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "An expiry column must be checked against the current time somewhere",
       category: "correctness",
       rationale: "Writing a *_until/*_expires_at column without ever comparing it to the current time anywhere in the codebase means the expiry is purely cosmetic \u2014 whatever it was meant to gate (a boost, a trial, a temporary unlock) never actually expires once granted, whether it was granted legitimately or through an unrelated bug.",
-      docsUrl: "https://docs.lovable.dev/features/cloud",
+      docsUrl: "https://docs.lovable.dev/integrations/stripe",
       recommended: true
     },
     messages: {
@@ -3745,18 +3824,18 @@ var rule52 = {
     };
   }
 };
-var lovableExpiryColumnNeverCheckedRule = rule52;
+var lovableExpiryColumnNeverCheckedRule = rule51;
 
 // src/providers/lovable/rules/silent-catch-on-provider-call.ts
 var LOGGING_CONSOLE_METHODS = /* @__PURE__ */ new Set(["error", "warn", "log", "info"]);
-var rule53 = {
+var rule52 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "A catch block around an LLM provider call must log the failure",
       category: "correctness",
       rationale: `Returning null/undefined from a bare catch with no logging makes every failure mode \u2014 missing key, expired key, rate limit, malformed response, network error \u2014 look identical to "no key configured." If a deployment's provider key starts failing in production, this is invisible: there is nothing in the browser or error-tracking logs to distinguish a real outage from an intentionally-unconfigured feature.`,
-      docsUrl: "https://docs.lovable.dev/features/cloud",
+      docsUrl: "https://docs.lovable.dev/integrations/cloud",
       recommended: true
     },
     messages: {
@@ -3822,7 +3901,7 @@ var rule53 = {
     };
   }
 };
-var lovableSilentCatchOnProviderCallRule = rule53;
+var lovableSilentCatchOnProviderCallRule = rule52;
 
 // src/providers/browserbase/utils.ts
 function memberPropName3(node) {
@@ -3935,7 +4014,7 @@ function isTruthyGateTest(test) {
   }
   return false;
 }
-var rule54 = {
+var rule53 = {
   meta: {
     type: "problem",
     docs: {
@@ -4007,10 +4086,10 @@ var rule54 = {
     };
   }
 };
-var browserbaseNoConditionalAuthzOnAnonymousUserRule = rule54;
+var browserbaseNoConditionalAuthzOnAnonymousUserRule = rule53;
 
 // src/providers/browserbase/rules/no-connect-url-in-api-response.ts
-var rule55 = {
+var rule54 = {
   meta: {
     type: "problem",
     docs: {
@@ -4040,7 +4119,7 @@ var rule55 = {
     };
   }
 };
-var browserbaseNoConnectUrlInApiResponseRule = rule55;
+var browserbaseNoConnectUrlInApiResponseRule = rule54;
 
 // src/providers/browserbase/rules/session-id-requires-ownership-check.ts
 function isOwnershipCheckCall(node) {
@@ -4057,7 +4136,7 @@ function isSessionIdLikeArg(node) {
   }
   return false;
 }
-var rule56 = {
+var rule55 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -4065,7 +4144,7 @@ var rule56 = {
       category: "security",
       cwe: "CWE-862",
       rationale: "A session id alone is not an authorization token \u2014 it is an opaque identifier that can leak via links, logs, screenshots, or support tickets. A handler that resolves a sessionId straight into sessions.debug()/sessions.recording.retrieve() with no ownership/org-membership check lets any authenticated caller view or replay a session that belongs to someone else.",
-      docsUrl: "https://docs.browserbase.com/features/session-live-view",
+      docsUrl: "https://docs.browserbase.com/platform/browser/observability/session-live-view",
       recommended: true
     },
     messages: {
@@ -4121,7 +4200,7 @@ var rule56 = {
     };
   }
 };
-var browserbaseSessionIdRequiresOwnershipCheckRule = rule56;
+var browserbaseSessionIdRequiresOwnershipCheckRule = rule55;
 
 // src/providers/browserbase/rules/no-concurrent-shared-context.ts
 function isPromiseAllCall2(node) {
@@ -4178,14 +4257,14 @@ function findSharedContextCreateCall(callback) {
   visit(body);
   return found;
 }
-var rule57 = {
+var rule56 = {
   meta: {
     type: "problem",
     docs: {
       description: "A Browserbase Context must not be attached to concurrent sessions",
       category: "correctness",
       rationale: `Browserbase's docs state explicitly: "Avoid having multiple sessions using the same Context at once. Sites may force a log out." Passing the same browserSettings.context.id into every iteration of a Promise.all(items.map(...)) batch creates 2+ Browserbase sessions simultaneously attached to one Context, producing non-deterministic, flaky failures when a site force-logs-out one session because another concurrently authenticated against the same context.`,
-      docsUrl: "https://docs.browserbase.com/features/contexts",
+      docsUrl: "https://docs.browserbase.com/platform/browser/core-features/contexts",
       recommended: true
     },
     messages: {
@@ -4225,7 +4304,7 @@ var rule57 = {
     };
   }
 };
-var browserbaseNoConcurrentSharedContextRule = rule57;
+var browserbaseNoConcurrentSharedContextRule = rule56;
 
 // src/providers/browserbase/rules/mobile-device-requires-os-setting.ts
 function isMobileLiteral(node) {
@@ -4258,14 +4337,14 @@ function isOsMobileSetting(node) {
   }
   return false;
 }
-var rule58 = {
+var rule57 = {
   meta: {
     type: "problem",
     docs: {
       description: "Mobile device combos must set browserSettings.os, not just resize the viewport",
       category: "correctness",
       rationale: `The Node SDK's device emulation lever is browserSettings.os: 'mobile' | 'tablet' \u2014 there is no fingerprint API in this SDK. A "mobile" session that only resizes the Playwright viewport is still a desktop Chrome browser with a desktop user-agent string in a small window. Sites that branch behavior on UA/touch capability (the majority of responsive sites) never actually exercise their mobile code path, silently undermining "test on mobile" results.`,
-      docsUrl: "https://docs.browserbase.com/features/stealth-mode",
+      docsUrl: "https://docs.browserbase.com/platform/identity/verified-customization",
       recommended: true
     },
     messages: {
@@ -4297,7 +4376,7 @@ var rule58 = {
     };
   }
 };
-var browserbaseMobileDeviceRequiresOsSettingRule = rule58;
+var browserbaseMobileDeviceRequiresOsSettingRule = rule57;
 
 // src/providers/browserbase/rules/use-typed-exception-status-not-substring.ts
 function isStringifiedErrorSource(node, errName) {
@@ -4359,7 +4438,7 @@ function collectStringifiedVars(body, errName) {
   });
   return names;
 }
-var rule59 = {
+var rule58 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -4389,7 +4468,7 @@ var rule59 = {
     };
   }
 };
-var browserbaseUseTypedExceptionStatusNotSubstringRule = rule59;
+var browserbaseUseTypedExceptionStatusNotSubstringRule = rule58;
 
 // src/providers/browserbase/rules/release-session-on-connect-failure.ts
 function isSessionsCreateAwait(node) {
@@ -4412,7 +4491,7 @@ function isReleaseCall(node) {
   const name = callee?.type === "Identifier" ? callee.name : memberPropName3(node);
   return !!name && /requeststop|releasesession|release_session/i.test(name);
 }
-var rule60 = {
+var rule59 = {
   meta: {
     type: "problem",
     docs: {
@@ -4454,10 +4533,10 @@ var rule60 = {
     };
   }
 };
-var browserbaseReleaseSessionOnConnectFailureRule = rule60;
+var browserbaseReleaseSessionOnConnectFailureRule = rule59;
 
 // src/providers/browserbase/rules/dont-stack-custom-retry-on-sdk-retry.ts
-var rule61 = {
+var rule60 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -4502,7 +4581,7 @@ var rule61 = {
     };
   }
 };
-var browserbaseDontStackCustomRetryOnSdkRetryRule = rule61;
+var browserbaseDontStackCustomRetryOnSdkRetryRule = rule60;
 
 // src/providers/browserbase/rules/no-overbroad-error-substring-match.ts
 var OVERBROAD_TERMS = /* @__PURE__ */ new Set(["session", "context", "browser", "browserbase"]);
@@ -4524,7 +4603,7 @@ function isCleanupCall(node) {
   const name = callee?.type === "Identifier" ? callee.name : memberPropName3(node);
   return !!name && /release|remove|cleanup|stop|teardown/i.test(name);
 }
-var rule62 = {
+var rule61 = {
   meta: {
     type: "problem",
     docs: {
@@ -4554,7 +4633,7 @@ var rule62 = {
     };
   }
 };
-var browserbaseNoOverbroadErrorSubstringMatchRule = rule62;
+var browserbaseNoOverbroadErrorSubstringMatchRule = rule61;
 
 // src/providers/browserbase/rules/use-sdk-not-raw-requests.ts
 var BROWSERBASE_HOST = "api.browserbase.com";
@@ -4594,7 +4673,7 @@ function isRawHttpCall(node) {
   }
   return { isCall: false, urlArg: void 0 };
 }
-var rule63 = {
+var rule62 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -4628,10 +4707,10 @@ var rule63 = {
     };
   }
 };
-var browserbaseUseSdkNotRawRequestsRule = rule63;
+var browserbaseUseSdkNotRawRequestsRule = rule62;
 
 // src/providers/browserbase/rules/centralize-request-release.ts
-var rule64 = {
+var rule63 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -4664,11 +4743,11 @@ var rule64 = {
     };
   }
 };
-var browserbaseCentralizeRequestReleaseRule = rule64;
+var browserbaseCentralizeRequestReleaseRule = rule63;
 
 // src/providers/openai-cua/rules/no-domain-allowlist.ts
 var ACTION_METHOD_NAMES = /* @__PURE__ */ new Set(["click", "type", "press", "move", "goto", "fill", "dblclick", "dragAndDrop"]);
-var rule65 = {
+var rule64 = {
   meta: {
     type: "problem",
     docs: {
@@ -4794,11 +4873,11 @@ var rule65 = {
     };
   }
 };
-var openaiCuaNoDomainAllowlistRule = rule65;
+var openaiCuaNoDomainAllowlistRule = rule64;
 
 // src/providers/openai-cua/rules/scroll-delta-default-zero.ts
 var VERTICAL_DELTA_NAME_PATTERN = /^(dy|delta_?y|scroll_?y)$/i;
-var rule66 = {
+var rule65 = {
   meta: {
     type: "problem",
     docs: {
@@ -4874,12 +4953,12 @@ var rule66 = {
     };
   }
 };
-var openaiCuaScrollDeltaDefaultZeroRule = rule66;
+var openaiCuaScrollDeltaDefaultZeroRule = rule65;
 
 // src/providers/openai-cua/rules/structured-step-metadata-not-text-json.ts
 var BRACE_SEARCH_METHODS = /* @__PURE__ */ new Set(["indexOf", "lastIndexOf"]);
 var SLICE_METHODS = /* @__PURE__ */ new Set(["slice", "substring", "substr"]);
-var rule67 = {
+var rule66 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -4978,10 +5057,10 @@ var rule67 = {
     };
   }
 };
-var openaiCuaStructuredStepMetadataNotTextJsonRule = rule67;
+var openaiCuaStructuredStepMetadataNotTextJsonRule = rule66;
 
 // src/providers/openai-cua/rules/no-blind-safety-check-ack.ts
-var rule68 = {
+var rule67 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -5044,7 +5123,7 @@ var rule68 = {
     };
   }
 };
-var openaiCuaNoBlindSafetyCheckAckRule = rule68;
+var openaiCuaNoBlindSafetyCheckAckRule = rule67;
 
 // src/providers/openai-cua/utils.ts
 function propName(node) {
@@ -5090,7 +5169,7 @@ function findResponsesCreateCall(node, depth = 0) {
 }
 
 // src/providers/openai-cua/rules/retry-transient-turn-errors.ts
-var rule69 = {
+var rule68 = {
   meta: {
     type: "problem",
     docs: {
@@ -5172,10 +5251,10 @@ var rule69 = {
     };
   }
 };
-var openaiCuaRetryTransientTurnErrorsRule = rule69;
+var openaiCuaRetryTransientTurnErrorsRule = rule68;
 
 // src/providers/openai-cua/rules/check-response-status-incomplete.ts
-var rule70 = {
+var rule69 = {
   meta: {
     type: "problem",
     docs: {
@@ -5284,17 +5363,17 @@ var rule70 = {
     };
   }
 };
-var openaiCuaCheckResponseStatusIncompleteRule = rule70;
+var openaiCuaCheckResponseStatusIncompleteRule = rule69;
 
 // src/providers/openai-cua/rules/set-safety-identifier.ts
-var rule71 = {
+var rule70 = {
   meta: {
     type: "problem",
     docs: {
       description: "responses.create() must set safety_identifier for per-end-user policy attribution",
       category: "integration",
       rationale: "OpenAI documents that a stable per-end-user safety_identifier lets policy violations be attributed and acted on per end user. Without one on a multi-tenant integration routing many customers through a single shared API key, a single customer triggering a high-confidence policy-violation heuristic can result in access being temporarily revoked for the entire organization, not just the offending identifier.",
-      docsUrl: "https://help.openai.com/en/articles/5428082-how-to-incorporate-a-safety-identifier",
+      docsUrl: "https://developers.openai.com/api/docs/guides/safety-best-practices",
       recommended: true
     },
     messages: {
@@ -5325,10 +5404,10 @@ var rule71 = {
     };
   }
 };
-var openaiCuaSetSafetyIdentifierRule = rule71;
+var openaiCuaSetSafetyIdentifierRule = rule70;
 
 // src/providers/tiptap/rules/upload-validate-fn-void.ts
-var rule72 = {
+var rule71 = {
   meta: {
     type: "problem",
     docs: {
@@ -5392,10 +5471,10 @@ var rule72 = {
     };
   }
 };
-var tiptapUploadValidateFnVoidRule = rule72;
+var tiptapUploadValidateFnVoidRule = rule71;
 
 // src/providers/tiptap/rules/script-src-hardcoded-api-key.ts
-var rule73 = {
+var rule72 = {
   meta: {
     type: "problem",
     docs: {
@@ -5453,10 +5532,10 @@ var rule73 = {
     };
   }
 };
-var tiptapScriptSrcHardcodedApiKeyRule = rule73;
+var tiptapScriptSrcHardcodedApiKeyRule = rule72;
 
 // src/providers/tiptap/rules/dynamic-script-no-sri.ts
-var rule74 = {
+var rule73 = {
   meta: {
     type: "problem",
     docs: {
@@ -5465,7 +5544,7 @@ var rule74 = {
       cwe: "CWE-829",
       owasp: "API8:2023 Security Misconfiguration",
       rationale: 'A script element injected without an integrity attribute will execute whatever the CDN returns, including malicious content if the CDN is compromised. Adding a Subresource Integrity hash (script.setAttribute("integrity", "sha384-...")) lets the browser verify the fetched script matches the expected bytes before executing it.',
-      docsUrl: "https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity",
+      docsUrl: "https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity",
       recommended: true
     },
     messages: {
@@ -5552,7 +5631,7 @@ var rule74 = {
     };
   }
 };
-var tiptapDynamicScriptNoSriRule = rule74;
+var tiptapDynamicScriptNoSriRule = rule73;
 
 // src/providers/tiptap/utils.ts
 function findProperty3(objectExpression, name) {
@@ -5577,7 +5656,7 @@ function walk(node, visit) {
 }
 
 // src/providers/tiptap/rules/addAttributes-missing-renderHTML.ts
-var rule75 = {
+var rule74 = {
   meta: {
     type: "problem",
     docs: {
@@ -5630,10 +5709,10 @@ var rule75 = {
     };
   }
 };
-var tiptapAddAttributesMissingRenderHTMLRule = rule75;
+var tiptapAddAttributesMissingRenderHTMLRule = rule74;
 
 // src/providers/tiptap/rules/appendTransaction-add-to-history.ts
-var rule76 = {
+var rule75 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -5712,10 +5791,10 @@ var rule76 = {
     };
   }
 };
-var tiptapAppendTransactionAddToHistoryRule = rule76;
+var tiptapAppendTransactionAddToHistoryRule = rule75;
 
 // src/providers/tiptap/rules/appendTransaction-full-scan.ts
-var rule77 = {
+var rule76 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -5775,10 +5854,10 @@ var rule77 = {
     };
   }
 };
-var tiptapAppendTransactionFullScanRule = rule77;
+var tiptapAppendTransactionFullScanRule = rule76;
 
 // src/providers/tiptap/rules/atom-node-wrap-in.ts
-var rule78 = {
+var rule77 = {
   meta: {
     type: "problem",
     docs: {
@@ -5841,57 +5920,16 @@ var rule78 = {
     };
   }
 };
-var tiptapAtomNodeWrapInRule = rule78;
-
-// src/providers/tiptap/rules/twitter-url-regex.ts
-var rule79 = {
-  meta: {
-    type: "suggestion",
-    docs: {
-      description: "Twitter/X URL regex must match both x.com and twitter.com",
-      category: "integration",
-      rationale: "Twitter rebranded to X but twitter.com URLs still resolve and embed correctly. A regex that only matches x.com silently rejects all legacy twitter.com links pasted by users. Update the pattern to (x\\.com|twitter\\.com) so both domains are handled.",
-      docsUrl: "https://tiptap.dev/docs/editor/extensions/nodes",
-      recommended: true
-    },
-    messages: {
-      twitterRegexMissingLegacyDomain: "This regex matches x.com but not twitter.com. Legacy twitter.com URLs are still valid and should be supported. Add (x\\.com|twitter\\.com) to the pattern."
-    },
-    schema: []
-  },
-  create(context) {
-    function checkPattern(pattern, node) {
-      if (!pattern.includes("x\\.com") && !pattern.includes("x.com")) return;
-      if (pattern.includes("twitter\\.com") || pattern.includes("twitter.com")) return;
-      context.report({ node, messageId: "twitterRegexMissingLegacyDomain" });
-    }
-    return {
-      Literal(node) {
-        if (node.regex?.pattern) {
-          checkPattern(node.regex.pattern, node);
-        }
-      },
-      NewExpression(node) {
-        if (node.callee?.type === "Identifier" && node.callee.name === "RegExp") {
-          const firstArg = node.arguments?.[0];
-          if (firstArg?.type === "Literal" && typeof firstArg.value === "string") {
-            checkPattern(firstArg.value, node);
-          }
-        }
-      }
-    };
-  }
-};
-var tiptapTwitterUrlRegexRule = rule79;
+var tiptapAtomNodeWrapInRule = rule77;
 
 // src/providers/tiptap/rules/drop-handler-pos-precedence.ts
-var rule80 = {
+var rule78 = {
   meta: {
     type: "problem",
     docs: {
       description: "x ?? 0 - 1 is parsed as x ?? (0 - 1) = x ?? -1 due to operator precedence",
       category: "correctness",
-      rationale: "The nullish coalescing operator (??) has lower precedence than arithmetic operators. Writing `pos ?? 0 - 1` evaluates as `pos ?? -1`, not `(pos ?? 0) - 1`. When pos is null or undefined, the fallback is -1 instead of the intended -1 offset from 0. In ProseMirror drop handlers this produces a decoration at position -1, which corrupts the placeholder position map and can insert content at the document start.",
+      rationale: "The nullish coalescing operator (??) has lower precedence than arithmetic operators. Writing `pos ?? 0 - 1` evaluates as `pos ?? -1`, not `(pos ?? 0) - 1`. Whenever pos is defined, the expression yields pos instead of the intended pos - 1 \u2014 an off-by-one on every real drop. In ProseMirror drop handlers this misplaces the decoration/insert position, and the -1 fallback (when pos is nullish) is an invalid document position.",
       docsUrl: "https://prosemirror.net/docs/ref/#view.EditorView.posAtCoords",
       recommended: true
     },
@@ -5912,7 +5950,7 @@ var rule80 = {
     };
   }
 };
-var tiptapDropHandlerPosPrecedenceRule = rule80;
+var tiptapDropHandlerPosPrecedenceRule = rule78;
 
 // src/providers/tiptap/rules/prefer-table-kit.ts
 var INDIVIDUAL_TABLE_PACKAGES = /* @__PURE__ */ new Set([
@@ -5920,18 +5958,18 @@ var INDIVIDUAL_TABLE_PACKAGES = /* @__PURE__ */ new Set([
   "@tiptap/extension-table-cell",
   "@tiptap/extension-table-header"
 ]);
-var rule81 = {
+var rule79 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "Use TableKit from @tiptap/extension-table instead of individual table packages",
       category: "integration",
-      rationale: "Importing table extensions individually from their separate packages bypasses the coordinated wiring that TableKit provides: shared configuration, the mergeOrSplit command, and consistent HTMLAttributes across all table elements. Individual imports also leave TableCell and TableHeader unconfigured by default.",
+      rationale: "Importing table extensions individually from their separate packages bypasses the coordinated wiring that TableKit provides: shared configuration and consistent HTMLAttributes across all table elements, configured in one place. TableKit from @tiptap/extension-table is the documented way to register the full table feature set.",
       docsUrl: "https://tiptap.dev/docs/editor/extensions/functionality/table-kit",
       recommended: true
     },
     messages: {
-      preferTableKit: "Individual TipTap table extension imported. Use TableKit from @tiptap/extension-table for coordinated configuration and the mergeOrSplit command."
+      preferTableKit: "Individual TipTap table extension imported. Use TableKit from @tiptap/extension-table to configure all table elements together."
     },
     schema: []
   },
@@ -5954,21 +5992,21 @@ var rule81 = {
     };
   }
 };
-var tiptapPreferTableKitRule = rule81;
+var tiptapPreferTableKitRule = rule79;
 
 // src/providers/tiptap/rules/tiptap-markdown-missing-node-spec.ts
-var rule82 = {
+var rule80 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "TipTap nodes used with tiptap-markdown must define a markdown serialization spec",
       category: "integration",
-      rationale: "When tiptap-markdown serializes a document, nodes without a markdown spec are silently dropped or emitted as empty strings. Custom node types must register a serialize/parse pair via MarkdownNodeSpec (in addStorage or addOptions) so content survives markdown export/import cycles.",
-      docsUrl: "https://github.com/ueberdosis/tiptap-markdown",
+      rationale: "When tiptap-markdown serializes a document, nodes without a markdown spec are silently dropped or emitted as empty strings. Custom node types must register a serialize/parse pair (MarkdownNodeSpec) under a `markdown` key returned from addStorage \u2014 the library reads only extension.storage.markdown \u2014 so content survives markdown export/import cycles.",
+      docsUrl: "https://github.com/aguingand/tiptap-markdown",
       recommended: true
     },
     messages: {
-      missingMarkdownNodeSpec: "This TipTap node is used alongside tiptap-markdown but defines no markdown serialization. Nodes without a markdown spec are silently dropped on export. Add a MarkdownNodeSpec to addStorage or addOptions."
+      missingMarkdownNodeSpec: "This TipTap node is used alongside tiptap-markdown but defines no markdown serialization. Nodes without a markdown spec are silently dropped on export. Return a markdown spec (MarkdownNodeSpec) from addStorage."
     },
     schema: []
   },
@@ -6023,7 +6061,7 @@ var rule82 = {
     };
   }
 };
-var tiptapTiptapMarkdownMissingNodeSpecRule = rule82;
+var tiptapTiptapMarkdownMissingNodeSpecRule = rule80;
 
 // src/providers/elevenlabs/utils.ts
 function isElevenLabsUrlArg(node) {
@@ -6084,7 +6122,7 @@ function posOf(n) {
 }
 
 // src/providers/elevenlabs/rules/validate-signed-url-response.ts
-var rule83 = {
+var rule81 = {
   meta: {
     type: "problem",
     docs: {
@@ -6183,11 +6221,11 @@ var rule83 = {
     };
   }
 };
-var elevenlabsValidateSignedUrlResponseRule = rule83;
+var elevenlabsValidateSignedUrlResponseRule = rule81;
 
 // src/providers/elevenlabs/rules/no-error-object-logging.ts
 var LOGGING_METHODS = /* @__PURE__ */ new Set(["error", "warn", "log"]);
-var rule84 = {
+var rule82 = {
   meta: {
     type: "problem",
     docs: {
@@ -6255,10 +6293,10 @@ var rule84 = {
     };
   }
 };
-var elevenlabsNoErrorObjectLoggingRule = rule84;
+var elevenlabsNoErrorObjectLoggingRule = rule82;
 
 // src/providers/elevenlabs/rules/fetch-timeout-required.ts
-var rule85 = {
+var rule83 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -6291,10 +6329,10 @@ var rule85 = {
     };
   }
 };
-var elevenlabsFetchTimeoutRequiredRule = rule85;
+var elevenlabsFetchTimeoutRequiredRule = rule83;
 
 // src/providers/elevenlabs/rules/validate-agent-id-format.ts
-var rule86 = {
+var rule84 = {
   meta: {
     type: "problem",
     docs: {
@@ -6400,10 +6438,10 @@ var rule86 = {
     };
   }
 };
-var elevenlabsValidateAgentIdFormatRule = rule86;
+var elevenlabsValidateAgentIdFormatRule = rule84;
 
 // src/providers/elevenlabs/rules/secure-session-id-generation.ts
-var rule87 = {
+var rule85 = {
   meta: {
     type: "problem",
     docs: {
@@ -6468,10 +6506,10 @@ var rule87 = {
     };
   }
 };
-var elevenlabsSecureSessionIdGenerationRule = rule87;
+var elevenlabsSecureSessionIdGenerationRule = rule85;
 
 // src/providers/elevenlabs/rules/conversation-error-recovery.ts
-var rule88 = {
+var rule86 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -6571,10 +6609,10 @@ var rule88 = {
     };
   }
 };
-var elevenlabsConversationErrorRecoveryRule = rule88;
+var elevenlabsConversationErrorRecoveryRule = rule86;
 
 // src/providers/elevenlabs/rules/api-version-pinning.ts
-var rule89 = {
+var rule87 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -6614,10 +6652,10 @@ var rule89 = {
     };
   }
 };
-var elevenlabsApiVersionPinningRule = rule89;
+var elevenlabsApiVersionPinningRule = rule87;
 
 // src/providers/elevenlabs/rules/check-http-status-before-json.ts
-var rule90 = {
+var rule88 = {
   meta: {
     type: "problem",
     docs: {
@@ -6713,11 +6751,11 @@ var rule90 = {
     };
   }
 };
-var elevenlabsCheckHttpStatusBeforeJsonRule = rule90;
+var elevenlabsCheckHttpStatusBeforeJsonRule = rule88;
 
 // src/providers/elevenlabs/rules/conversation-cleanup-on-error.ts
 var END_METHODS = /* @__PURE__ */ new Set(["endSession", "endConversation"]);
-var rule91 = {
+var rule89 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -6778,11 +6816,11 @@ var rule91 = {
     };
   }
 };
-var elevenlabsConversationCleanupOnErrorRule = rule91;
+var elevenlabsConversationCleanupOnErrorRule = rule89;
 
 // src/providers/elevenlabs/rules/env-var-validation.ts
 var ELEVENLABS_ENV_VAR_PATTERN = /^(XI_API_KEY|ELEVENLABS_API_KEY)$/;
-var rule92 = {
+var rule90 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -6843,7 +6881,7 @@ var rule92 = {
     };
   }
 };
-var elevenlabsEnvVarValidationRule = rule92;
+var elevenlabsEnvVarValidationRule = rule90;
 
 // src/providers/twilio/utils.ts
 var POST_METHOD_NAMES = /* @__PURE__ */ new Set(["post"]);
@@ -6897,7 +6935,7 @@ function collectVarDeclarators2(node, out, depth = 0) {
 }
 
 // src/providers/twilio/rules/validate-webhook-signature.ts
-var rule93 = {
+var rule91 = {
   meta: {
     type: "problem",
     docs: {
@@ -6939,10 +6977,10 @@ var rule93 = {
     };
   }
 };
-var twilioValidateWebhookSignatureRule = rule93;
+var twilioValidateWebhookSignatureRule = rule91;
 
 // src/providers/twilio/rules/taskrouter-attributes-match-consumer.ts
-var rule94 = {
+var rule92 = {
   meta: {
     type: "problem",
     docs: {
@@ -7039,10 +7077,10 @@ var rule94 = {
     };
   }
 };
-var twilioTaskrouterAttributesMatchConsumerRule = rule94;
+var twilioTaskrouterAttributesMatchConsumerRule = rule92;
 
 // src/providers/twilio/rules/enqueue-task-json-stringify.ts
-var rule95 = {
+var rule93 = {
   meta: {
     type: "problem",
     docs: {
@@ -7084,10 +7122,10 @@ var rule95 = {
     };
   }
 };
-var twilioEnqueueTaskJsonStringifyRule = rule95;
+var twilioEnqueueTaskJsonStringifyRule = rule93;
 
 // src/providers/twilio/rules/media-streams-key-by-call-sid.ts
-var rule96 = {
+var rule94 = {
   meta: {
     type: "problem",
     docs: {
@@ -7163,12 +7201,12 @@ var rule96 = {
     };
   }
 };
-var twilioMediaStreamsKeyByCallSidRule = rule96;
+var twilioMediaStreamsKeyByCallSidRule = rule94;
 
 // src/providers/twilio/rules/await-or-catch-rest-calls-in-event-handlers.ts
 var REST_RESOURCE_METHODS = /* @__PURE__ */ new Set(["create", "update", "remove", "fetch"]);
 var EVENT_REGISTRATION_METHODS = /* @__PURE__ */ new Set(["onStart", "onStop", "onMedia", "onConnected", "on"]);
-var rule97 = {
+var rule95 = {
   meta: {
     type: "problem",
     docs: {
@@ -7276,10 +7314,10 @@ var rule97 = {
     };
   }
 };
-var twilioAwaitOrCatchRestCallsInEventHandlersRule = rule97;
+var twilioAwaitOrCatchRestCallsInEventHandlersRule = rule95;
 
 // src/providers/twilio/rules/use-twiml-builder-not-string-templates.ts
-var rule98 = {
+var rule96 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -7308,10 +7346,10 @@ var rule98 = {
     };
   }
 };
-var twilioUseTwimlBuilderNotStringTemplatesRule = rule98;
+var twilioUseTwimlBuilderNotStringTemplatesRule = rule96;
 
 // src/providers/twilio/rules/media-streams-mark-pacing.ts
-var rule99 = {
+var rule97 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -7387,10 +7425,10 @@ var rule99 = {
     };
   }
 };
-var twilioMediaStreamsMarkPacingRule = rule99;
+var twilioMediaStreamsMarkPacingRule = rule97;
 
 // src/providers/twilio/rules/validate-all-request-inputs.ts
-var rule100 = {
+var rule98 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -7465,10 +7503,10 @@ var rule100 = {
     };
   }
 };
-var twilioValidateAllRequestInputsRule = rule100;
+var twilioValidateAllRequestInputsRule = rule98;
 
 // src/providers/twilio/rules/media-streams-mark-name-string.ts
-var rule101 = {
+var rule99 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -7518,7 +7556,7 @@ var rule101 = {
     };
   }
 };
-var twilioMediaStreamsMarkNameStringRule = rule101;
+var twilioMediaStreamsMarkNameStringRule = rule99;
 
 // src/providers/openai-realtime/utils.ts
 function isOpenAIRealtimeUrlArg(node) {
@@ -7658,7 +7696,7 @@ function resolveStringValue(node, stringVarValues) {
 }
 
 // src/providers/openai-realtime/rules/migrate-beta-to-ga.ts
-var rule102 = {
+var rule100 = {
   meta: {
     type: "problem",
     docs: {
@@ -7695,7 +7733,7 @@ var rule102 = {
     };
   }
 };
-var openaiRealtimeMigrateBetaToGaRule = rule102;
+var openaiRealtimeMigrateBetaToGaRule = rule100;
 
 // src/providers/openai-realtime/rules/no-log-raw-message-payloads.ts
 var LOG_METHOD_NAMES = /* @__PURE__ */ new Set(["info", "warn", "error", "log"]);
@@ -7731,7 +7769,7 @@ function findCallExpressions(node, out, depth = 0) {
     if (val && typeof val === "object") findCallExpressions(val, out, depth + 1);
   }
 }
-var rule103 = {
+var rule101 = {
   meta: {
     type: "problem",
     docs: {
@@ -7775,7 +7813,7 @@ var rule103 = {
     };
   }
 };
-var openaiRealtimeNoLogRawMessagePayloadsRule = rule103;
+var openaiRealtimeNoLogRawMessagePayloadsRule = rule101;
 
 // src/providers/openai-realtime/rules/handle-error-server-event.ts
 function isTypeMemberExpression(node) {
@@ -7806,13 +7844,13 @@ function collectTypeComparisonLiterals(node, out, depth = 0) {
     if (val && typeof val === "object") collectTypeComparisonLiterals(val, out, depth + 1);
   }
 }
-var rule104 = {
+var rule102 = {
   meta: {
     type: "problem",
     docs: {
       description: 'OpenAI Realtime message handlers must check for the API-level "error" server event',
       category: "reliability",
-      docsUrl: "https://developers.openai.com/api/docs/api-reference/realtime_server_events",
+      docsUrl: "https://developers.openai.com/api/reference/resources/realtime/server-events",
       rationale: "The Realtime API's own error server event \u2014 distinct from the WebSocket transport-level error event \u2014 covers rate limits, invalid session.update payloads, content-moderation blocks, and retired/invalid model ids. A message handler that branches on event types but never checks for 'error' lets the call continue silently with translation/processing permanently dead for that leg, with no operator-visible signal of why.",
       recommended: true
     },
@@ -7842,7 +7880,7 @@ var rule104 = {
     };
   }
 };
-var openaiRealtimeHandleErrorServerEventRule = rule104;
+var openaiRealtimeHandleErrorServerEventRule = rule102;
 
 // src/providers/openai-realtime/rules/reconnect-on-drop.ts
 var RECONNECT_NAME_PATTERN = /reconnect/i;
@@ -7866,7 +7904,7 @@ function hasReconnectAttempt(node, depth = 0) {
   }
   return false;
 }
-var rule105 = {
+var rule103 = {
   meta: {
     type: "problem",
     docs: {
@@ -7899,17 +7937,17 @@ var rule105 = {
     };
   }
 };
-var openaiRealtimeReconnectOnDropRule = rule105;
+var openaiRealtimeReconnectOnDropRule = rule103;
 
 // src/providers/openai-realtime/rules/avoid-dated-preview-snapshots.ts
 var DATED_PREVIEW_MODEL_PATTERN = /model=[^&'"`]*-preview-\d{4}-\d{2}-\d{2}/;
-var rule106 = {
+var rule104 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "OpenAI Realtime connections should not pin to a dated preview model snapshot",
       category: "correctness",
-      docsUrl: "https://developers.openai.com/api/docs/api-reference/realtime-sessions",
+      docsUrl: "https://developers.openai.com/api/reference/resources/realtime/subresources/client_secrets",
       rationale: "Dated preview snapshots are the category of model id OpenAI has historically retired with advance-notice sunset windows. Pinning to a dated preview snapshot rather than the floating GA alias (or a current dated GA snapshot) maximizes exposure to an eventual retirement, with no code path to detect or gracefully react to a model_not_found-style error if/when that happens.",
       recommended: true
     },
@@ -7938,16 +7976,16 @@ var rule106 = {
     };
   }
 };
-var openaiRealtimeAvoidDatedPreviewSnapshotsRule = rule106;
+var openaiRealtimeAvoidDatedPreviewSnapshotsRule = rule104;
 
 // src/providers/openai-realtime/rules/verify-deprecated-session-fields.ts
-var rule107 = {
+var rule105 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "OpenAI Realtime session.update payloads should not rely on an unverified 'temperature' field",
       category: "correctness",
-      docsUrl: "https://developers.openai.com/api/docs/api-reference/realtime-sessions",
+      docsUrl: "https://developers.openai.com/api/reference/resources/realtime/subresources/client_secrets",
       rationale: "Two independent fetches of the current Realtime sessions API reference did not surface 'temperature' as a documented session field. Sending an undocumented field is typically harmless (silently ignored), but code that depends on an assumed constraint (e.g. 'a hard floor of 0.6') for behavior like deterministic output is relying on a claim that is no longer traceable to any current, citable source.",
       recommended: true
     },
@@ -7972,15 +8010,20 @@ var rule107 = {
     };
   }
 };
-var openaiRealtimeVerifyDeprecatedSessionFieldsRule = rule107;
+var openaiRealtimeVerifyDeprecatedSessionFieldsRule = rule105;
 
 // src/providers/openai-realtime/rules/buffer-audio-until-session-ready.ts
 var QUEUE_CALL_NAME_PATTERN = /^(push|unshift|enqueue|queue)$/i;
-function isReadyStateOpenCheck(test) {
-  if (test?.type !== "BinaryExpression" || test.operator !== "===" && test.operator !== "==") return false;
+function readyStateOpenCheckKind(test) {
+  if (test?.type !== "BinaryExpression") return null;
+  const isEq = test.operator === "===" || test.operator === "==";
+  const isNeq = test.operator === "!==" || test.operator === "!=";
+  if (!isEq && !isNeq) return null;
   const isReadyStateMember = (n) => n?.type === "MemberExpression" && n.property?.type === "Identifier" && n.property.name === "readyState";
   const isOpenValue = (n) => n?.type === "MemberExpression" && n.property?.type === "Identifier" && n.property.name === "OPEN" || n?.type === "Literal" && n.value === 1;
-  return isReadyStateMember(test.left) && isOpenValue(test.right) || isReadyStateMember(test.right) && isOpenValue(test.left);
+  const matches = isReadyStateMember(test.left) && isOpenValue(test.right) || isReadyStateMember(test.right) && isOpenValue(test.left);
+  if (!matches) return null;
+  return isEq ? "is-open" : "is-not-open";
 }
 function hasQueueCall(node, depth = 0) {
   if (!node || typeof node !== "object" || depth > 40) return false;
@@ -7997,13 +8040,13 @@ function hasQueueCall(node, depth = 0) {
   }
   return false;
 }
-var rule108 = {
+var rule106 = {
   meta: {
     type: "suggestion",
     docs: {
       description: "Audio sent before an OpenAI Realtime socket is open must be buffered, not dropped",
       category: "reliability",
-      docsUrl: "https://developers.openai.com/api/docs/voice/media-streams/websocket-messages",
+      docsUrl: "https://developers.openai.com/api/reference/resources/realtime/client-events",
       rationale: "Caller audio can arrive before the Realtime WebSocket finishes its connect + session.update round-trip. A readyState !== OPEN branch that only logs and returns silently drops every audio chunk that arrives in that window, meaning the first fragment of speech is lost to translation/processing on every call.",
       recommended: true
     },
@@ -8015,18 +8058,20 @@ var rule108 = {
   create(context) {
     return {
       IfStatement(node) {
-        if (!isReadyStateOpenCheck(node.test)) return;
-        if (!node.alternate) return;
-        if (hasQueueCall(node.alternate)) return;
-        context.report({ node: node.alternate, messageId: "audioDroppedNotBuffered" });
+        const kind = readyStateOpenCheckKind(node.test);
+        if (!kind) return;
+        const notOpenBranch = kind === "is-open" ? node.alternate : node.consequent;
+        if (!notOpenBranch) return;
+        if (hasQueueCall(notOpenBranch)) return;
+        context.report({ node: notOpenBranch, messageId: "audioDroppedNotBuffered" });
       }
     };
   }
 };
-var openaiRealtimeBufferAudioUntilSessionReadyRule = rule108;
+var openaiRealtimeBufferAudioUntilSessionReadyRule = rule106;
 
 // src/providers/openai-realtime/rules/send-safety-identifier.ts
-var rule109 = {
+var rule107 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -8059,10 +8104,10 @@ var rule109 = {
     };
   }
 };
-var openaiRealtimeSendSafetyIdentifierRule = rule109;
+var openaiRealtimeSendSafetyIdentifierRule = rule107;
 
 // src/providers/openai-realtime/rules/transcription-model-choice.ts
-var rule110 = {
+var rule108 = {
   meta: {
     type: "suggestion",
     docs: {
@@ -8073,7 +8118,7 @@ var rule110 = {
       recommended: true
     },
     messages: {
-      nonStreamingTranscriptionModel: "input_audio_transcription is configured with 'whisper-1', which is not natively streaming and not optimized for realtime sessions."
+      nonStreamingTranscriptionModel: "This session's input transcription is configured with 'whisper-1', which is not natively streaming and not optimized for realtime sessions."
     },
     schema: []
   },
@@ -8086,7 +8131,12 @@ var rule110 = {
         if (!isSessionUpdate) return;
         const sessionProp = findProperty4(node, "session");
         if (sessionProp?.value?.type !== "ObjectExpression") return;
-        const transcriptionProp = findProperty4(sessionProp.value, "input_audio_transcription");
+        let transcriptionProp = findProperty4(sessionProp.value, "input_audio_transcription");
+        if (!transcriptionProp) {
+          const audioProp = findProperty4(sessionProp.value, "audio");
+          const inputProp = audioProp?.value?.type === "ObjectExpression" ? findProperty4(audioProp.value, "input") : null;
+          transcriptionProp = inputProp?.value?.type === "ObjectExpression" ? findProperty4(inputProp.value, "transcription") : null;
+        }
         if (transcriptionProp?.value?.type !== "ObjectExpression") return;
         const modelProp = findProperty4(transcriptionProp.value, "model");
         const modelValue = modelProp?.value;
@@ -8097,7 +8147,7 @@ var rule110 = {
     };
   }
 };
-var openaiRealtimeTranscriptionModelChoiceRule = rule110;
+var openaiRealtimeTranscriptionModelChoiceRule = rule108;
 
 // src/plugin/index.ts
 var plugin = {
@@ -8142,7 +8192,6 @@ var plugin = {
     "firebase-rtdb-write-promise-not-handled": firebaseRtdbWritePromiseNotHandledRule,
     "firebase-firestore-rules-expired": firebaseFirestoreRulesExpiredRule,
     "firebase-id-token-cookie-flags": firebaseIdTokenCookieFlagsRule,
-    "firebase-middleware-token-not-verified": firebaseMiddlewareTokenNotVerifiedRule,
     "firebase-hardcoded-user-id": firebaseHardcodedUserIdRule,
     "firebase-auth-user-not-found-disclosure": firebaseAuthUserNotFoundDisclosureRule,
     "firebase-signup-password-confirm": firebaseSignupPasswordConfirmRule,
@@ -8181,7 +8230,6 @@ var plugin = {
     "tiptap-appendTransaction-add-to-history": tiptapAppendTransactionAddToHistoryRule,
     "tiptap-appendTransaction-full-scan": tiptapAppendTransactionFullScanRule,
     "tiptap-atom-node-wrap-in": tiptapAtomNodeWrapInRule,
-    "tiptap-twitter-url-regex": tiptapTwitterUrlRegexRule,
     "tiptap-drop-handler-pos-precedence": tiptapDropHandlerPosPrecedenceRule,
     "tiptap-prefer-table-kit": tiptapPreferTableKitRule,
     "tiptap-tiptap-markdown-missing-node-spec": tiptapTiptapMarkdownMissingNodeSpecRule,