@clerk/eslint-plugin 0.0.1 → 0.1.0

package/dist/next.js

@@ -0,0 +1,833 @@
+const require_chunk = require('./chunk-C_NdSu1c.js');
+let node_path = require("node:path");
+node_path = require_chunk.__toESM(node_path);
+let node_fs = require("node:fs");
+
+//#region src/next/lib/exports.ts
+function unwrapFunction(node) {
+	if (!node) return null;
+	if (node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression") return node;
+	return null;
+}
+function resolveLocalIdentifierTarget(programNode, name) {
+	for (const stmt of programNode.body) {
+		if (stmt.type === "FunctionDeclaration" && stmt.id && stmt.id.name === name) return {
+			kind: "function",
+			node: stmt
+		};
+		if (stmt.type === "VariableDeclaration") for (const declarator of stmt.declarations) {
+			if (declarator.id.type !== "Identifier" || declarator.id.name !== name) continue;
+			const initFn = unwrapFunction(declarator.init ?? void 0);
+			if (initFn) return {
+				kind: "function",
+				node: initFn
+			};
+			return { kind: "unknown" };
+		}
+		if (stmt.type === "ImportDeclaration") {
+			for (const spec of stmt.specifiers) if (spec.local && spec.local.name === name) return {
+				kind: "imported",
+				source: stmt.source.value
+			};
+		}
+	}
+	return { kind: "unknown" };
+}
+function resolveDefaultExportTarget(programNode, declaration) {
+	const direct = unwrapFunction(declaration);
+	if (direct) return {
+		kind: "function",
+		node: direct
+	};
+	if (declaration.type !== "Identifier") return { kind: "unknown" };
+	return resolveLocalIdentifierTarget(programNode, declaration.name);
+}
+function getExportedName(spec) {
+	const node = spec.exported;
+	if (node.type === "Identifier") return node.name;
+	if (node.type === "Literal" && typeof node.value === "string") return node.value;
+	return null;
+}
+/**
+* Resolve the module's default export, regardless of whether it's declared with
+* `export default ...` or via a specifier such as `export { Page as default }`
+* or `export { default } from './Page'`.
+*/
+function resolveDefaultExport(programNode) {
+	for (const stmt of programNode.body) {
+		if (stmt.type === "ExportDefaultDeclaration") return {
+			target: resolveDefaultExportTarget(programNode, stmt.declaration),
+			reportNode: stmt
+		};
+		if (stmt.type !== "ExportNamedDeclaration") continue;
+		if (stmt.exportKind === "type") continue;
+		for (const spec of stmt.specifiers) {
+			if (spec.type !== "ExportSpecifier") continue;
+			if (spec.exportKind === "type") continue;
+			if (getExportedName(spec) !== "default") continue;
+			if (stmt.source) return {
+				target: {
+					kind: "imported",
+					source: stmt.source.value
+				},
+				reportNode: stmt
+			};
+			if (spec.local.type !== "Identifier") return {
+				target: { kind: "unknown" },
+				reportNode: stmt
+			};
+			return {
+				target: resolveLocalIdentifierTarget(programNode, spec.local.name),
+				reportNode: stmt
+			};
+		}
+	}
+	return null;
+}
+/**
+* Yield value-level `export * from '...'` declarations. The rule cannot follow
+* these across files, so callers treat them conservatively as unverifiable.
+*/
+function* iterateExportAllDeclarations(programNode) {
+	for (const stmt of programNode.body) {
+		if (stmt.type !== "ExportAllDeclaration") continue;
+		if (stmt.exportKind === "type") continue;
+		if (stmt.exported) continue;
+		yield {
+			source: stmt.source.value,
+			reportNode: stmt
+		};
+	}
+}
+function* iterateNamedExports(programNode) {
+	for (const stmt of programNode.body) {
+		if (stmt.type !== "ExportNamedDeclaration") continue;
+		if (stmt.exportKind === "type") continue;
+		if (stmt.declaration) {
+			const decl = stmt.declaration;
+			if (decl.type === "FunctionDeclaration" && decl.id) yield {
+				name: decl.id.name,
+				target: {
+					kind: "function",
+					node: decl
+				},
+				reportNode: stmt
+			};
+			else if (decl.type === "VariableDeclaration") for (const declarator of decl.declarations) {
+				if (declarator.id.type !== "Identifier") continue;
+				const fn = unwrapFunction(declarator.init ?? void 0);
+				yield {
+					name: declarator.id.name,
+					target: fn ? {
+						kind: "function",
+						node: fn
+					} : { kind: "unknown" },
+					reportNode: stmt
+				};
+			}
+			continue;
+		}
+		for (const spec of stmt.specifiers) {
+			if (spec.type !== "ExportSpecifier") continue;
+			if (spec.exportKind === "type") continue;
+			const exportedName = getExportedName(spec);
+			if (!exportedName) continue;
+			if (stmt.source) {
+				yield {
+					name: exportedName,
+					target: {
+						kind: "imported",
+						source: stmt.source.value
+					},
+					reportNode: stmt
+				};
+				continue;
+			}
+			if (spec.local.type !== "Identifier") continue;
+			yield {
+				name: exportedName,
+				target: resolveLocalIdentifierTarget(programNode, spec.local.name),
+				reportNode: stmt
+			};
+		}
+	}
+}
+
+//#endregion
+//#region src/next/lib/file-info.ts
+/**
+* Utilities for classifying a file by path, kind, and module-level directives.
+*/
+const RESOURCE_FILES = new Set([
+	"page",
+	"layout",
+	"template",
+	"default",
+	"route"
+]);
+const RESOURCE_EXTENSIONS = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+/**
+* @param rootDir Project root to relativize against — typically from
+*   `resolveProjectRoot()` (explicit option, nearest `eslint.config.*`, or ESLint
+*   `cwd`). When omitted or when the file lies outside `rootDir`, the absolute
+*   path is scanned for an `app` segment instead.
+*/
+function getRelativeFolder(filename, rootDir) {
+	if (!filename) return null;
+	const normalizedFile = filename.replaceAll("\\", "/");
+	let candidate = normalizedFile;
+	if (rootDir) {
+		const normalizedRoot = rootDir.replaceAll("\\", "/");
+		const rel = node_path.default.posix.relative(normalizedRoot, normalizedFile);
+		if (rel && !rel.startsWith("..")) candidate = rel;
+	}
+	const segments = candidate.split("/");
+	const appIdx = segments.findIndex((seg) => seg === "app");
+	if (appIdx !== -1) return node_path.default.posix.dirname(segments.slice(appIdx).join("/"));
+	if (candidate !== normalizedFile) return node_path.default.posix.dirname(candidate);
+	return null;
+}
+function getFileKind(filename) {
+	if (!filename) return null;
+	const base = node_path.default.basename(filename).replace(RESOURCE_EXTENSIONS, "");
+	return RESOURCE_FILES.has(base) ? base : null;
+}
+function hasTopLevelDirective(programNode, name) {
+	for (const stmt of programNode.body) {
+		if (stmt.type !== "ExpressionStatement") break;
+		if (!("directive" in stmt)) break;
+		if (stmt.directive === name) return true;
+	}
+	return false;
+}
+function isServerFunctionModule(programNode) {
+	return hasTopLevelDirective(programNode, "use server");
+}
+function isClientModule(programNode) {
+	return hasTopLevelDirective(programNode, "use client");
+}
+
+//#endregion
+//#region src/next/lib/fixers.ts
+const CLERK_AUTH_SOURCE$1 = "@clerk/nextjs/server";
+/**
+* The local name to call `.protect()` on. Reuses an existing alias (e.g.
+* `import { auth as clerkAuth }`) when present, otherwise defaults to `auth`.
+*/
+function resolveAuthName(authNames) {
+	for (const name of authNames) return name;
+	return "auth";
+}
+/**
+* Build the ordered, non-overlapping set of edits that protect `fn`. All edits
+* belong to a single suggestion and are applied atomically.
+*/
+function buildAuthProtectFixes({ fixer, sourceCode, fn, authNames }) {
+	const program = sourceCode.ast;
+	const authName = resolveAuthName(authNames);
+	const fixes = [];
+	const importFix = ensureAuthImportFix(fixer, sourceCode, program, authNames);
+	if (importFix) fixes.push(importFix);
+	const asyncFix = ensureAsyncFix(fixer, sourceCode, fn);
+	if (asyncFix) fixes.push(asyncFix);
+	fixes.push(insertProtectCallFix(fixer, sourceCode, fn, authName, authNames));
+	return fixes;
+}
+/**
+* If `node` is `await <auth>()` (a zero-argument call to one of the imported
+* `auth` names), return the callee identifier so it can be rewritten to
+* `<auth>.protect`. Returns `null` otherwise.
+*
+* Used to merge protection into an existing call (`const { userId } = await
+* auth()` -> `const { userId } = await auth.protect()`) instead of prepending a
+* duplicate `await auth.protect();`.
+*/
+function mergeableAuthCallee(node, authNames) {
+	if (!node || node.type !== "AwaitExpression") return null;
+	const arg = node.argument;
+	if (arg.type !== "CallExpression" || arg.arguments.length > 0) return null;
+	if (arg.callee.type !== "Identifier" || !authNames.has(arg.callee.name)) return null;
+	return arg.callee;
+}
+/**
+* Look for a mergeable `await <auth>()` in the first executable statement of a
+* block body — either a bare `await auth();` or the initializer of the first
+* declarator (`const { userId } = await auth();`).
+*/
+function firstStatementAuthCallee(stmt, authNames) {
+	if (stmt.type === "ExpressionStatement") return mergeableAuthCallee(stmt.expression, authNames);
+	if (stmt.type === "VariableDeclaration") {
+		const first = stmt.declarations[0];
+		return first ? mergeableAuthCallee(first.init, authNames) : null;
+	}
+	return null;
+}
+function getLineIndent(sourceCode, node) {
+	const line = sourceCode.lines[node.loc.start.line - 1] ?? "";
+	const match = /^\s*/.exec(line);
+	return match ? match[0] : "";
+}
+function ensureAsyncFix(fixer, sourceCode, fn) {
+	if (fn.async) return null;
+	const firstToken = sourceCode.getFirstToken(fn);
+	if (!firstToken) return null;
+	return fixer.insertTextBefore(firstToken, "async ");
+}
+function insertProtectCallFix(fixer, sourceCode, fn, authName, authNames) {
+	const call = `await ${authName}.protect();`;
+	const body = fn.body;
+	if (body.type !== "BlockStatement") {
+		const conciseCallee = mergeableAuthCallee(body, authNames);
+		if (conciseCallee) return fixer.replaceText(conciseCallee, `${conciseCallee.name}.protect`);
+		const fnIndent = getLineIndent(sourceCode, fn);
+		const inner = `${fnIndent}  `;
+		const blockBody = `{\n${inner}${call}\n${inner}return ${sourceCode.getText(body)};\n${fnIndent}}`;
+		const arrowToken = sourceCode.getTokenBefore(body, { filter: (token) => token.type === "Punctuator" && token.value === "=>" });
+		if (arrowToken) return fixer.replaceTextRange([arrowToken.range[1], fn.range[1]], ` ${blockBody}`);
+		return fixer.replaceText(body, blockBody);
+	}
+	const stmts = body.body;
+	let lastDirective = null;
+	let firstExecIdx = 0;
+	for (const stmt of stmts) if (stmt.type === "ExpressionStatement" && stmt.directive) {
+		lastDirective = stmt;
+		firstExecIdx++;
+	} else break;
+	const firstExec = stmts[firstExecIdx];
+	if (firstExec) {
+		const mergeCallee = firstStatementAuthCallee(firstExec, authNames);
+		if (mergeCallee) return fixer.replaceText(mergeCallee, `${mergeCallee.name}.protect`);
+	}
+	if (lastDirective) {
+		const indent = getLineIndent(sourceCode, lastDirective);
+		return fixer.insertTextAfter(lastDirective, `\n${indent}${call}`);
+	}
+	const firstStmt = stmts[0];
+	if (firstStmt) {
+		const indent = getLineIndent(sourceCode, firstStmt);
+		return fixer.insertTextBefore(firstStmt, `${call}\n${indent}`);
+	}
+	const openBrace = sourceCode.getFirstToken(body);
+	const indent = `${getLineIndent(sourceCode, fn)}  `;
+	if (openBrace) return fixer.insertTextAfter(openBrace, `\n${indent}${call}`);
+	return fixer.insertTextBefore(body, `${call}\n`);
+}
+function ensureAuthImportFix(fixer, sourceCode, program, authNames) {
+	if (authNames.size > 0) return null;
+	for (const stmt of program.body) {
+		if (stmt.type !== "ImportDeclaration") continue;
+		if (stmt.source.value !== CLERK_AUTH_SOURCE$1 || stmt.importKind === "type") continue;
+		const named = stmt.specifiers.filter((spec) => spec.type === "ImportSpecifier");
+		const last = named[named.length - 1];
+		if (last) return fixer.insertTextAfter(last, ", auth");
+	}
+	const importText = `import { auth } from '${CLERK_AUTH_SOURCE$1}';`;
+	const stmts = program.body;
+	let lastDirective = null;
+	for (const stmt of stmts) if (stmt.type === "ExpressionStatement" && stmt.directive) lastDirective = stmt;
+	else break;
+	if (lastDirective) return fixer.insertTextAfter(lastDirective, `\n${importText}`);
+	const firstStmt = stmts[0];
+	if (firstStmt) return fixer.insertTextBefore(firstStmt, `${importText}\n`);
+	return fixer.insertTextAfterRange([0, 0], `${importText}\n`);
+}
+
+//#endregion
+//#region src/next/lib/match-folders.ts
+const REGEX_SPECIAL = /[.+^${}()|[\]\\]/g;
+function segmentToRegex(seg) {
+	let out = "";
+	for (let i = 0; i < seg.length; i++) {
+		const ch = seg[i];
+		if (ch === "*") out += "[^/]*";
+		else if (REGEX_SPECIAL.test(ch)) out += "\\" + ch;
+		else out += ch;
+		REGEX_SPECIAL.lastIndex = 0;
+	}
+	return out;
+}
+function segmentMatches(patternSeg, pathSeg) {
+	if (patternSeg === pathSeg) return true;
+	if (!patternSeg.includes("*")) return false;
+	return new RegExp("^" + segmentToRegex(patternSeg) + "$").test(pathSeg);
+}
+function matchSegments(patternSegs, pi, pathSegs, si) {
+	while (pi < patternSegs.length) {
+		const seg = patternSegs[pi];
+		if (seg === "**") {
+			if (pi === patternSegs.length - 1) return true;
+			for (let k = si; k <= pathSegs.length; k++) if (matchSegments(patternSegs, pi + 1, pathSegs, k)) return true;
+			return false;
+		}
+		if (si >= pathSegs.length) return false;
+		if (!segmentMatches(seg, pathSegs[si])) return false;
+		pi++;
+		si++;
+	}
+	return si === pathSegs.length;
+}
+function matchPath(pattern, path) {
+	return matchSegments(pattern.split("/"), 0, path.split("/"), 0);
+}
+function specificity(pattern) {
+	return pattern.split("/").filter((seg) => seg.length > 0 && seg !== "**" && !seg.includes("*")).length;
+}
+function literalPrefix(pattern) {
+	const segs = pattern.split("/");
+	const result = [];
+	for (const seg of segs) {
+		if (seg === "**" || seg.includes("*")) break;
+		result.push(seg);
+	}
+	return result.join("/");
+}
+function hasDescendantsMatching(folder, patterns) {
+	if (!patterns || patterns.length === 0) return false;
+	for (const pattern of patterns) {
+		const prefix = literalPrefix(pattern);
+		if (!prefix) continue;
+		if (prefix === folder) return true;
+		if (prefix.startsWith(folder + "/")) return true;
+	}
+	return false;
+}
+function classifyFolder(folderPath, options) {
+	const protectPatterns = options.protected ?? [];
+	const publicPatterns = options.public ?? [];
+	const protectMatches = protectPatterns.filter((p) => matchPath(p, folderPath));
+	const publicMatches = publicPatterns.filter((p) => matchPath(p, folderPath));
+	if (protectMatches.length === 0 && publicMatches.length === 0) return "unmatched";
+	if (publicMatches.length === 0) return "protected";
+	if (protectMatches.length === 0) return "public";
+	return Math.max(...protectMatches.map(specificity)) >= Math.max(...publicMatches.map(specificity)) ? "protected" : "public";
+}
+
+//#endregion
+//#region src/next/lib/project-root.ts
+/**
+* Resolve the directory paths should be relativized against when classifying
+* App Router folders.
+*/
+/** Filenames ESLint searches for when resolving flat config (precedence order). */
+const ESLINT_CONFIG_FILENAMES = [
+	"eslint.config.js",
+	"eslint.config.mjs",
+	"eslint.config.cjs",
+	"eslint.config.ts",
+	"eslint.config.mts",
+	"eslint.config.cts"
+];
+function normalizeDir(dir) {
+	return dir.replaceAll("\\", "/");
+}
+/**
+* Walk up from `filePath` and return the directory of the nearest
+* `eslint.config.*`, mirroring ESLint's per-file config lookup.
+*/
+function findEslintProjectRoot(filePath) {
+	let dir = node_path.default.resolve(node_path.default.dirname(filePath));
+	const { root } = node_path.default.parse(dir);
+	while (true) {
+		for (const name of ESLINT_CONFIG_FILENAMES) if ((0, node_fs.existsSync)(node_path.default.join(dir, name))) return normalizeDir(dir);
+		if (dir === root) return null;
+		dir = node_path.default.dirname(dir);
+	}
+}
+/**
+* Pick the directory to relativize linted file paths against.
+*
+* Precedence: explicit `rootDir` → nearest `eslint.config.*` ancestor → `cwd`.
+*/
+function resolveProjectRoot(filename, { rootDir, cwd } = {}) {
+	if (rootDir) return normalizeDir(rootDir);
+	if (filename) {
+		const fromConfig = findEslintProjectRoot(filename);
+		if (fromConfig) return fromConfig;
+	}
+	return cwd ? normalizeDir(cwd) : void 0;
+}
+
+//#endregion
+//#region src/next/lib/protection-checks.ts
+const CLERK_AUTH_SOURCE = "@clerk/nextjs/server";
+/**
+* Collect the local names that `auth` is imported as from `@clerk/nextjs/server`
+* in the given module. Usually returns `{'auth'}`, but handles aliased imports
+* like `import { auth as clerkAuth } from '@clerk/nextjs/server'` correctly.
+* Type-only imports (`import type { auth }` / `import { type auth }`) are
+* excluded — they are erased at compile time and do not provide a runtime binding.
+*/
+function findAuthLocalNames(programNode) {
+	const names = /* @__PURE__ */ new Set();
+	for (const stmt of programNode.body) {
+		if (stmt.type !== "ImportDeclaration") continue;
+		if (stmt.source.value !== CLERK_AUTH_SOURCE) continue;
+		if (stmt.importKind === "type") continue;
+		for (const spec of stmt.specifiers) {
+			if (spec.type !== "ImportSpecifier") continue;
+			if (spec.importKind === "type") continue;
+			if ((spec.imported.type === "Identifier" ? spec.imported.name : spec.imported.value) === "auth") names.add(spec.local.name);
+		}
+	}
+	return names;
+}
+const AUTH_FIELDS = new Set([
+	"userId",
+	"sessionId",
+	"isAuthenticated"
+]);
+const EXIT_FUNCTIONS = new Set([
+	"redirect",
+	"permanentRedirect",
+	"notFound",
+	"unauthorized",
+	"forbidden",
+	"redirectToSignIn",
+	"redirectToSignUp"
+]);
+function isProtectCall(node, authNames) {
+	if (!node || node.type !== "CallExpression") return false;
+	const callee = node.callee;
+	if (callee.type !== "MemberExpression") return false;
+	if (callee.property.type !== "Identifier" || callee.property.name !== "protect") return false;
+	if (callee.object.type === "Identifier" && authNames.has(callee.object.name)) return true;
+	if (callee.object.type === "AwaitExpression" && callee.object.argument.type === "CallExpression" && callee.object.argument.callee.type === "Identifier" && authNames.has(callee.object.argument.callee.name)) return true;
+	return false;
+}
+function isProtectAwait(node, authNames) {
+	return !!node && node.type === "AwaitExpression" && isProtectCall(node.argument, authNames);
+}
+function isProtectAwaitStatement(stmt, authNames) {
+	if (stmt.type === "ExpressionStatement") return isProtectAwait(stmt.expression, authNames);
+	if (stmt.type === "VariableDeclaration") {
+		const first = stmt.declarations[0];
+		return first != null && isProtectAwait(first.init ?? void 0, authNames);
+	}
+	return false;
+}
+function capturedAuthBindings(stmt, authNames) {
+	if (stmt.type !== "VariableDeclaration") return null;
+	if (stmt.declarations.length !== 1) return null;
+	const decl = stmt.declarations[0];
+	if (!decl) return null;
+	if (decl.id.type !== "ObjectPattern") return null;
+	if (!decl.init || decl.init.type !== "AwaitExpression") return null;
+	const arg = decl.init.argument;
+	if (arg.type !== "CallExpression") return null;
+	if (arg.callee.type !== "Identifier" || !authNames.has(arg.callee.name)) return null;
+	const bindings = /* @__PURE__ */ new Set();
+	for (const prop of decl.id.properties) {
+		if (prop.type !== "Property") continue;
+		if (prop.key.type !== "Identifier") continue;
+		const fieldName = prop.key.name;
+		if (!AUTH_FIELDS.has(fieldName)) continue;
+		if (prop.value.type !== "Identifier" || prop.value.name !== fieldName) continue;
+		bindings.add(fieldName);
+	}
+	return bindings.size > 0 ? bindings : null;
+}
+function isRecognizedAuthCheck(test, bindings) {
+	if (test.type === "UnaryExpression" && test.operator === "!") return test.argument.type === "Identifier" && AUTH_FIELDS.has(test.argument.name) && bindings.has(test.argument.name);
+	if (test.type !== "BinaryExpression") return false;
+	if (test.operator !== "===" && test.operator !== "==") return false;
+	let id;
+	let other;
+	if (test.left.type === "Identifier" && bindings.has(test.left.name)) {
+		id = test.left;
+		other = test.right;
+	} else if (test.right.type === "Identifier" && bindings.has(test.right.name)) {
+		id = test.right;
+		other = test.left;
+	} else return false;
+	const name = id.name;
+	if (name === "userId" || name === "sessionId") return other.type === "Literal" && other.value === null;
+	if (name === "isAuthenticated") return test.operator === "===" && other.type === "Literal" && other.value === false;
+	return false;
+}
+function isExitCall(expr) {
+	if (!expr || expr.type !== "CallExpression") return false;
+	if (expr.callee.type !== "Identifier") return false;
+	return EXIT_FUNCTIONS.has(expr.callee.name);
+}
+function statementExits(stmt) {
+	if (!stmt) return false;
+	if (stmt.type === "ReturnStatement") return true;
+	if (stmt.type === "ThrowStatement") return true;
+	if (stmt.type === "ExpressionStatement") return isExitCall(stmt.expression);
+	return false;
+}
+function consequentExits(consequent) {
+	if (!consequent) return false;
+	if (statementExits(consequent)) return true;
+	if (consequent.type === "BlockStatement") return consequent.body.some(statementExits);
+	return false;
+}
+function isAuthGuardWithExit(stmt, bindings) {
+	if (stmt.type !== "IfStatement") return false;
+	if (!isRecognizedAuthCheck(stmt.test, bindings)) return false;
+	return consequentExits(stmt.consequent);
+}
+function isNonRuntimeStatement(stmt) {
+	if (stmt.type === "ExpressionStatement" && stmt.directive) return true;
+	if (stmt.type === "TSTypeAliasDeclaration") return true;
+	if (stmt.type === "TSInterfaceDeclaration") return true;
+	return false;
+}
+function nextExecutable(stmts, from) {
+	let i = from;
+	while (i < stmts.length && isNonRuntimeStatement(stmts[i])) i++;
+	return i;
+}
+function hasProtectAtTop(fn, authNames) {
+	if (!fn || !fn.async) return false;
+	const body = fn.body;
+	if (body && body.type !== "BlockStatement") return body.type === "AwaitExpression" && isProtectCall(body.argument, authNames);
+	if (!body || body.type !== "BlockStatement") return false;
+	const stmts = body.body;
+	const first = nextExecutable(stmts, 0);
+	if (first >= stmts.length) return false;
+	if (isProtectAwaitStatement(stmts[first], authNames)) return true;
+	const captured = capturedAuthBindings(stmts[first], authNames);
+	if (captured) {
+		const second = nextExecutable(stmts, first + 1);
+		if (second < stmts.length && isAuthGuardWithExit(stmts[second], captured)) return true;
+	}
+	return false;
+}
+
+//#endregion
+//#region src/next/require-auth-protection.ts
+const HTTP_METHODS = new Set([
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE",
+	"OPTIONS",
+	"HEAD"
+]);
+const DEFAULT_RESOURCES = {
+	routeHandlers: true,
+	serverFunctions: true,
+	serverComponentEntrypoints: true
+};
+const rule = {
+	meta: {
+		type: "problem",
+		hasSuggestions: true,
+		docs: { description: "Require `await auth.protect()` in App Router resources under protected folders" },
+		schema: [{
+			type: "object",
+			properties: {
+				protected: {
+					type: "array",
+					items: { type: "string" },
+					minItems: 1
+				},
+				public: {
+					type: "array",
+					items: { type: "string" }
+				},
+				resources: {
+					type: "object",
+					properties: {
+						routeHandlers: { type: "boolean" },
+						serverFunctions: { type: "boolean" },
+						serverComponentEntrypoints: { type: "boolean" }
+					},
+					additionalProperties: false
+				},
+				mixedScopeLayouts: { oneOf: [{
+					type: "string",
+					enum: ["auto"]
+				}, {
+					type: "array",
+					items: { type: "string" }
+				}] },
+				rootDir: { type: "string" }
+			},
+			required: ["protected"],
+			additionalProperties: false
+		}],
+		messages: {
+			missingProtect: "Expected `await auth.protect()` at the top of {{subject}} in a folder configured as protected. Add the call to the top of the function, move the file into a public folder, or configure this folder as public.",
+			addAuthProtect: "Add `await auth.protect()` to the top of this {{subject}}.",
+			exportImported: "This {{subject}} is exported from '{{source}}'. The rule cannot follow imports across files. Add a wrapper with `await auth.protect()`, or ensure the imported function calls it and add an eslint-disable comment with a reason.",
+			unverifiableExport: "This {{subject}} could not be verified as being protected, likely because it is assigned from a call expression (e.g. `const handler = withAuth(impl)`). Inline a function literal that calls `await auth.protect()`, or add an eslint-disable comment with a reason.",
+			unlistedMixedScopeLayout: "This {{fileKind}} at '{{folder}}/' wraps both protected and public descendants but is not listed in `mixedScopeLayouts`. Either add '{{folder}}' to the list to acknowledge the mixed scope, or restructure so the {{fileKind}} wraps only public or protected descendants."
+		}
+	},
+	create(context) {
+		const filename = context.physicalFilename ?? context.filename ?? context.getFilename?.();
+		const cwd = context.cwd || context.getCwd?.();
+		const options = context.options[0] ?? {};
+		const config = {
+			protected: options.protected,
+			public: options.public ?? []
+		};
+		const resources = normalizeResources(options.resources);
+		const mixedScopeLayoutsOption = options.mixedScopeLayouts === void 0 ? "auto" : options.mixedScopeLayouts;
+		const folder = getRelativeFolder(filename, resolveProjectRoot(filename, {
+			rootDir: options.rootDir,
+			cwd
+		}));
+		if (!folder) return {};
+		const fileKind = getFileKind(filename);
+		let authNames = /* @__PURE__ */ new Set();
+		let shouldCheckInlineServerFunctions = false;
+		const checkedFunctions = /* @__PURE__ */ new WeakSet();
+		return {
+			Program(programNode) {
+				const ast = programNode;
+				const isServerFunction = isServerFunctionModule(ast);
+				const isClient = isClientModule(ast);
+				if (classifyFolder(folder, config) !== "protected") return;
+				authNames = findAuthLocalNames(ast);
+				shouldCheckInlineServerFunctions = resources.serverFunctions && !isClient;
+				if (!fileKind && !isServerFunction) return;
+				if (isClient && (fileKind === "page" || fileKind === "layout" || fileKind === "template" || fileKind === "default")) return;
+				if (resources.serverComponentEntrypoints && (fileKind === "layout" || fileKind === "template") && hasDescendantsMatching(folder, config.public)) {
+					checkUnacknowledgedMixedScope(context, ast, fileKind, folder, mixedScopeLayoutsOption);
+					return;
+				}
+				if (resources.serverComponentEntrypoints && (fileKind === "page" || fileKind === "layout" || fileKind === "template" || fileKind === "default")) checkDefaultExport(context, ast, fileKind, authNames, checkedFunctions);
+				else if (resources.routeHandlers && fileKind === "route") checkRouteHandlers(context, ast, authNames, checkedFunctions);
+				else if (resources.serverFunctions && isServerFunction) checkServerFunctions(context, ast, authNames, checkedFunctions);
+			},
+			FunctionDeclaration(node) {
+				checkInlineServerFunction(context, node, authNames, shouldCheckInlineServerFunctions, checkedFunctions);
+			},
+			FunctionExpression(node) {
+				checkInlineServerFunction(context, node, authNames, shouldCheckInlineServerFunctions, checkedFunctions);
+			},
+			ArrowFunctionExpression(node) {
+				checkInlineServerFunction(context, node, authNames, shouldCheckInlineServerFunctions, checkedFunctions);
+			}
+		};
+	}
+};
+function normalizeResources(resources) {
+	return {
+		...DEFAULT_RESOURCES,
+		...resources
+	};
+}
+function checkUnacknowledgedMixedScope(context, programNode, fileKind, folder, mixedScopeLayoutsOption) {
+	if (mixedScopeLayoutsOption === "auto") return;
+	if (mixedScopeLayoutsOption.includes(folder)) return;
+	const defaultExport = programNode.body.find((n) => n.type === "ExportDefaultDeclaration");
+	context.report({
+		node: defaultExport ?? programNode,
+		messageId: "unlistedMixedScopeLayout",
+		data: {
+			folder,
+			fileKind
+		}
+	});
+}
+function getMissingProtectReportNode(fn, fallback) {
+	return fn.id ?? fn.body ?? fallback;
+}
+function checkMissingProtect(context, reportNode, target, subject, authNames, checkedFunctions) {
+	if (target.kind === "imported") {
+		context.report({
+			node: reportNode,
+			messageId: "exportImported",
+			data: {
+				subject,
+				source: target.source
+			}
+		});
+		return;
+	}
+	if (target.kind === "function") {
+		checkedFunctions?.add(target.node);
+		if (!hasProtectAtTop(target.node, authNames)) context.report({
+			node: getMissingProtectReportNode(target.node, reportNode),
+			messageId: "missingProtect",
+			data: { subject },
+			suggest: buildAddAuthProtectSuggestion(context, target.node, subject, authNames)
+		});
+		return;
+	}
+	context.report({
+		node: reportNode,
+		messageId: "unverifiableExport",
+		data: { subject }
+	});
+}
+function checkRouteHandlers(context, programNode, authNames, checkedFunctions) {
+	for (const { name, target, reportNode } of iterateNamedExports(programNode)) {
+		if (!HTTP_METHODS.has(name)) continue;
+		checkMissingProtect(context, reportNode, target, `${name} handler`, authNames, checkedFunctions);
+	}
+	for (const { source, reportNode } of iterateExportAllDeclarations(programNode)) checkMissingProtect(context, reportNode, {
+		kind: "imported",
+		source
+	}, "route handlers", authNames);
+}
+function checkServerFunctions(context, programNode, authNames, checkedFunctions) {
+	for (const { name, target, reportNode } of iterateNamedExports(programNode)) {
+		if (name === "default") continue;
+		checkMissingProtect(context, reportNode, target, `Server Function '${name}'`, authNames, checkedFunctions);
+	}
+	const defaultExport = resolveDefaultExport(programNode);
+	if (defaultExport) checkMissingProtect(context, defaultExport.reportNode, defaultExport.target, "Server Function", authNames, checkedFunctions);
+	for (const { source, reportNode } of iterateExportAllDeclarations(programNode)) checkMissingProtect(context, reportNode, {
+		kind: "imported",
+		source
+	}, "Server Functions", authNames);
+}
+function checkDefaultExport(context, programNode, fileKind, authNames, checkedFunctions) {
+	const defaultExport = resolveDefaultExport(programNode);
+	if (!defaultExport) return;
+	checkMissingProtect(context, defaultExport.reportNode, defaultExport.target, fileKind, authNames, checkedFunctions);
+}
+function hasUseServerDirective(fn) {
+	const body = fn.body;
+	if (!body || body.type !== "BlockStatement") return false;
+	for (const stmt of body.body) {
+		if (stmt.type !== "ExpressionStatement") return false;
+		if (typeof stmt.directive !== "string") return false;
+		if (stmt.directive === "use server") return true;
+	}
+	return false;
+}
+function checkInlineServerFunction(context, fn, authNames, shouldCheckInlineServerFunctions, checkedFunctions) {
+	if (!shouldCheckInlineServerFunctions || checkedFunctions.has(fn) || !hasUseServerDirective(fn)) return;
+	if (!hasProtectAtTop(fn, authNames)) context.report({
+		node: getMissingProtectReportNode(fn, fn),
+		messageId: "missingProtect",
+		data: { subject: "Inline Server Function" },
+		suggest: buildAddAuthProtectSuggestion(context, fn, "Inline Server Function", authNames)
+	});
+}
+function buildAddAuthProtectSuggestion(context, fn, subject, authNames) {
+	const sourceCode = context.sourceCode;
+	return [{
+		messageId: "addAuthProtect",
+		data: { subject },
+		fix(fixer) {
+			return buildAuthProtectFixes({
+				fixer,
+				sourceCode,
+				fn,
+				authNames
+			});
+		}
+	}];
+}
+
+//#endregion
+//#region src/next/index.ts
+const plugin = {
+	meta: {
+		name: "@clerk/eslint-plugin/next",
+		version: "0.1.0"
+	},
+	rules: { "require-auth-protection": rule }
+};
+
+//#endregion
+module.exports = plugin;
+//# sourceMappingURL=next.js.map