@colixsystems/widget-sdk 0.275.1 → 0.276.0

package/dist/linter.cjs

@@ -528,15 +528,22 @@ const _ASSET_SPECIFIER_RE = /\.(css|png|jpe?g|gif)$/i;
 const _ICON_DEFAULT_CONFIGURED_RE =
   /\bIcon\s*\.\s*Default\s*(\.\s*mergeOptions\s*\(|\.\s*imagePath\s*=)/;
 
-// Line of an index in `code`, counted forward: indexes must not decrease.
+// 1-based line of any index in `code`, by binary search over the newline
+// offsets: counting from the top per finding is quadratic (sc-8204).
 function _lineCounter(code) {
-  let line = 1;
-  let at = 0;
+  const newlines = [];
+  for (let i = code.indexOf("\n"); i !== -1; i = code.indexOf("\n", i + 1)) {
+    newlines.push(i);
+  }
   return (index) => {
-    for (; at < index; at += 1) {
-      if (code.charCodeAt(at) === 10) line += 1;
+    let lo = 0;
+    let hi = newlines.length;
+    while (lo < hi) {
+      const mid = (lo + hi) >> 1;
+      if (newlines[mid] < index) lo = mid + 1;
+      else hi = mid;
     }
-    return line;
+    return lo + 1;
   };
 }
 
@@ -584,6 +591,9 @@ function _leafletRules(source) {
   let tag;
   while ((tag = _MARKER_TAG_RE.exec(code))) {
     const end = _jsxOpenTagEnd(code, tag.index + tag[0].length);
+    // Resume past the tag even when it passes: rescanning a tag nested in
+    // its attributes made unclosed runs quadratic (sc-8204).
+    _MARKER_TAG_RE.lastIndex = end;
     if (/(^|\s)icon\s*=/.test(code.slice(tag.index, end))) continue;
     const line = markerLineAt(tag.index);
     findings.push({
@@ -601,7 +611,6 @@ function _leafletRules(source) {
       line,
       snippet: (sourceLines[line - 1] || "").trim().slice(0, 200),
     });
-    _MARKER_TAG_RE.lastIndex = end;
   }
   return findings;
 }
@@ -1043,8 +1052,32 @@ const LUCIDE_NAME_SET = new Set(LUCIDE_ICON_NAMES);
 // `[^}]*` (not `[\s\S]*?`) so the brace capture can never cross a `}` into a
 // neighbouring import — otherwise a preceding `import { View, Pressable } from
 // "react-native"` is swallowed and its names get validated as lucide icons.
-const LUCIDE_IMPORT_RE =
-  /import\s+(?:[A-Za-z0-9_$]+\s*,\s*)?\{([^}]*)\}\s*from\s*["']lucide-react-native["']/g;
+const LUCIDE_IMPORT_HEAD_RE = /import\s+(?:[A-Za-z0-9_$]+\s*,\s*)?\{/g;
+const LUCIDE_IMPORT_TAIL_RE = /\}\s*from\s*["']lucide-react-native["']/y;
+
+// `import { … } from "lucide-react-native"` clauses. The names run to the
+// NEXT `}`, so every head sharing that brace shares one tail check; one
+// regex retried that run from each unclosed `import {` (sc-8204).
+function _lucideImports(source) {
+  const found = [];
+  const tails = new Map();
+  LUCIDE_IMPORT_HEAD_RE.lastIndex = 0;
+  let head;
+  while ((head = LUCIDE_IMPORT_HEAD_RE.exec(source))) {
+    const from = LUCIDE_IMPORT_HEAD_RE.lastIndex;
+    const close = source.indexOf("}", from);
+    if (close === -1) break;
+    if (!tails.has(close)) {
+      LUCIDE_IMPORT_TAIL_RE.lastIndex = close;
+      tails.set(close, LUCIDE_IMPORT_TAIL_RE.test(source) ? LUCIDE_IMPORT_TAIL_RE.lastIndex : -1);
+    }
+    const end = tails.get(close);
+    if (end === -1) continue;
+    found.push({ index: head.index, names: source.slice(from, close) });
+    LUCIDE_IMPORT_HEAD_RE.lastIndex = end;
+  }
+  return found;
+}
 
 // lucide re-exports each base icon as `<Name>`, `<Name>Icon`, and `Lucide<Name>`;
 // the committed set holds only the base names, so normalise the alias forms
@@ -1060,11 +1093,10 @@ function _isValidLucideName(name) {
 function _lucideIconRules(source) {
   const findings = [];
   const sourceLines = source.split(/\r?\n/);
-  LUCIDE_IMPORT_RE.lastIndex = 0;
-  let m;
-  while ((m = LUCIDE_IMPORT_RE.exec(source))) {
-    const line = source.slice(0, m.index).split(/\r?\n/).length;
-    for (const raw of (m[1] || "").split(",")) {
+  const lineAt = _lineCounter(source);
+  for (const m of _lucideImports(source)) {
+    const line = lineAt(m.index);
+    for (const raw of m.names.split(",")) {
       // Strip any inline comment from the specifier token so a `{ Home, // x`
       // comment can't glue onto and hide the next specifier (e.g. `House`).
       const cleaned = raw
@@ -1147,6 +1179,25 @@ const _EXPRESSION_LEAD_WORDS = new Set([
   "instanceof",
 ]);
 
+// The offset just past the whitespace run ending before `at`.
+function _skipSpaceBack(code, at) {
+  while (at > 0 && /\s/.test(code[at - 1])) at--;
+  return at;
+}
+
+function _skipSpaceForward(code, at) {
+  while (at < code.length && /\s/.test(code[at])) at++;
+  return at;
+}
+
+// The identifier ending at `last`; leading digits are not part of it.
+function _wordEndingAt(code, last) {
+  let start = last + 1;
+  while (start > 0 && /[A-Za-z0-9_$]/.test(code[start - 1])) start--;
+  while (start <= last && /[0-9]/.test(code[start])) start++;
+  return code.slice(start, last + 1);
+}
+
 // 1-based line of the first unbound reference to `name`, or 0 when the name is
 // bound, never referenced, or referenced in a form this scan cannot decide.
 function _unboundReferenceLine(code, name) {
@@ -1156,22 +1207,24 @@ function _unboundReferenceLine(code, name) {
   const word = new RegExp(`\\b${name}\\b`, "g");
   let firstIndex = -1;
   let match;
+  // Every look-around walks a few characters from the match: slicing and
+  // regex-testing the whole prefix per match was quadratic (sc-8204).
   while ((match = word.exec(code))) {
-    const before = code.slice(0, match.index).replace(/\s+$/, "");
+    const leadAt = _skipSpaceBack(code, match.index) - 1;
+    const lead = leadAt >= 0 ? code[leadAt] : "";
     // `obj.NAME` / `obj?.NAME` / `{...NAME}` — never this binding.
-    if (before.endsWith(".")) continue;
-    const lead = before.slice(-1);
+    if (lead === ".") continue;
     if (/[A-Za-z0-9_$]/.test(lead)) {
-      const leadWord = (before.match(/[A-Za-z_$][A-Za-z0-9_$]*$/) || [""])[0];
-      if (!_EXPRESSION_LEAD_WORDS.has(leadWord)) return 0;
-    } else if (lead === ">" && !before.endsWith("=>")) {
+      if (!_EXPRESSION_LEAD_WORDS.has(_wordEndingAt(code, leadAt))) return 0;
+    } else if (lead === ">" && code[leadAt - 1] !== "=") {
       // A `>` that is not an arrow closes a JSX tag, so what follows is text.
       return 0;
     }
-    const after = code.slice(match.index + name.length).replace(/^\s+/, "");
-    const isReference =
-      /<\s*\/?$/.test(before) || after.startsWith("(") || after.startsWith(".");
-    if (!isReference) return 0;
+    const opensTag =
+      lead === "<" ||
+      (lead === "/" && code[_skipSpaceBack(code, leadAt) - 1] === "<");
+    const next = code[_skipSpaceForward(code, match.index + name.length)];
+    if (!opensTag && next !== "(" && next !== ".") return 0;
     if (firstIndex < 0) firstIndex = match.index;
   }
   if (firstIndex < 0) return 0;
@@ -1253,10 +1306,11 @@ function _bundledAssetRules(source, assetFiles) {
   // Comments blanked, strings kept: the file name IS a string literal.
   const code = _stripNonCode(source, { keepStrings: true });
   const sourceLines = source.split(/\r?\n/);
+  const lineAt = _lineCounter(code);
   for (const match of code.matchAll(BUNDLED_ASSET_CALL_RE)) {
     const name = match[1] || match[2] || match[3] || "";
     if (name.includes("${") || assetFiles.includes(name)) continue;
-    const line = code.slice(0, match.index).split(/\r?\n/).length;
+    const line = lineAt(match.index);
     findings.push({
       rule: "bundled-asset-missing",
       severity: "error",
@@ -1283,6 +1337,7 @@ function _paymentCurrencyRules(source) {
   // Comments blanked, strings kept: the currency code IS a string literal.
   const code = _stripNonCode(source, { keepStrings: true });
   const sourceLines = source.split(/\r?\n/);
+  const lineAt = _lineCounter(code);
   let from = 0;
   for (;;) {
     const at = code.indexOf(REQUEST_PAYMENT_CALL, from);
@@ -1293,7 +1348,7 @@ function _paymentCurrencyRules(source) {
     );
     if (!match) continue;
     // Line of the currency literal itself, not of the call.
-    const line = code.slice(0, at + match.index).split(/\r?\n/).length;
+    const line = lineAt(at + match.index);
     findings.push({
       rule: "payment-currency",
       severity: "error",
@@ -1472,22 +1527,36 @@ function _datastoreErrorHandlingRules(source) {
 // the deps array is wrong (sc-1579's volatile-query gate exists because of
 // exactly this mistake). Flags only when the file has NOT already reached
 // for `useStableQuery`, the hook that removes the deps array entirely.
+// The first `const NAME = useMemo(` of every name, in one pass: a regex
+// per queried name rescanned the source per call (sc-8204). A name holding
+// `$` never matched the old per-name pattern, so it is left out.
+function _firstUseMemoConsts(code) {
+  const first = new Map();
+  const re = /\bconst\s+([A-Za-z_][\w$]*)\s*=\s*useMemo\s*\(/g;
+  let m;
+  while ((m = re.exec(code))) {
+    if (!m[1].includes("$") && !first.has(m[1])) first.set(m[1], m.index);
+  }
+  return first;
+}
+
 function _rawUseMemoIntoDatastoreQueryRules(source) {
   const code = _stripNonCode(source);
   if (/\buseStableQuery\s*\(/.test(code)) return [];
   const callRe = /\buseDatastoreQuery\s*\(\s*[^,()]+,\s*([A-Za-z_$][\w$]*)\s*[,)]/g;
   const findings = [];
   const sourceLines = source.split(/\r?\n/);
+  const lineAt = _lineCounter(code);
+  const memoAt = _firstUseMemoConsts(code);
   const seen = new Set();
   let m;
   while ((m = callRe.exec(code))) {
     const varName = m[1];
     if (seen.has(varName)) continue;
-    const memoRe = new RegExp(`\\bconst\\s+${varName}\\s*=\\s*useMemo\\s*\\(`);
-    const memoMatch = memoRe.exec(code);
-    if (!memoMatch || memoMatch.index >= m.index) continue;
+    const memoIndex = memoAt.get(varName);
+    if (memoIndex === undefined || memoIndex >= m.index) continue;
     seen.add(varName);
-    const line = code.slice(0, memoMatch.index).split(/\r?\n/).length;
+    const line = lineAt(memoIndex);
     findings.push({
       rule: "raw-useMemo-into-datastore-query",
       severity: "warning",
@@ -1560,30 +1629,81 @@ function _rowActionGatingRules(source) {
 // The useDatastoreMutation() call whose update or delete the widget uses,
 // either as `m.update(` / `m.delete(` or destructured `{ update, delete }`.
 function _rowMutationCall(code) {
-  const hookCall = /(?:\{([^}]*)\}|\b(\w+))\s*=\s*useDatastoreMutation\s*\(/g;
-  for (const match of code.matchAll(hookCall)) {
-    const [, destructured, name] = match;
-    const usesRowVerb = destructured
-      ? /\b(update|delete)\b/.test(destructured)
-      : new RegExp(`\\b${name}\\s*\\.\\s*(update|delete)\\s*\\(`).test(code);
-    if (usesRowVerb) return match;
+  const rowVerbCallers = new Set();
+  for (const m of code.matchAll(/\b(\w+)\s*\.\s*(?:update|delete)\s*\(/g)) {
+    rowVerbCallers.add(m[1]);
+  }
+  for (const call of _mutationHookCalls(code)) {
+    // An empty `{}` read as a name before: the regex built "undefined".
+    const usesRowVerb = call.destructured
+      ? /\b(update|delete)\b/.test(call.destructured)
+      : rowVerbCallers.has(String(call.name));
+    if (usesRowVerb) return call;
   }
   return null;
 }
 
+const _MUTATION_TAIL_RE = /\}\s*=\s*useDatastoreMutation\s*\(/y;
+const _NAMED_MUTATION_RE = /\b(\w+)\s*=\s*useDatastoreMutation\s*\(/g;
+
+// Every `{ … } = useDatastoreMutation(` / `name = useDatastoreMutation(`, in
+// source order, as one `(?:\{([^}]*)\}|\b(\w+))…` regex would match them.
+// The destructured names run to the NEXT `}`, so each `}` is checked once;
+// the regex re-read that run from every unclosed `{` (sc-8204).
+function _mutationHookCalls(code) {
+  const calls = [];
+  const tails = new Map();
+  let named = null;
+  let brace = code.indexOf("{");
+  let close = -1;
+  for (let from = 0; ; ) {
+    if (named === null || named.index < from) {
+      _NAMED_MUTATION_RE.lastIndex = from;
+      named = _NAMED_MUTATION_RE.exec(code) || { index: Infinity };
+    }
+    let destructured = null;
+    for (; brace !== -1 && brace < named.index; brace = code.indexOf("{", brace + 1)) {
+      if (brace < from) continue;
+      if (close <= brace) close = code.indexOf("}", brace + 1);
+      if (close === -1) {
+        brace = -1;
+        break;
+      }
+      if (!tails.has(close)) {
+        _MUTATION_TAIL_RE.lastIndex = close;
+        tails.set(close, _MUTATION_TAIL_RE.test(code) ? _MUTATION_TAIL_RE.lastIndex : -1);
+      }
+      if (tails.get(close) !== -1) {
+        destructured = { index: brace, destructured: code.slice(brace + 1, close) };
+        break;
+      }
+    }
+    if (destructured) {
+      calls.push(destructured);
+      from = tails.get(close);
+    } else if (named.index !== Infinity) {
+      calls.push({ index: named.index, name: named[1] });
+      from = named.index + named[0].length;
+    } else return calls;
+  }
+}
+
 function _imagePercentHeightRules(source) {
   const findings = [];
   const code = _stripNonCode(source, { keepStrings: true });
   const sourceLines = source.split(/\r?\n/);
+  const lineAt = _lineCounter(code);
   _IMAGE_TAG_RE.lastIndex = 0;
   let tag;
   while ((tag = _IMAGE_TAG_RE.exec(code))) {
     const end = _jsxOpenTagEnd(code, tag.index + tag[0].length);
+    // A tag nested in these attributes is inside `attrs` already (sc-8204).
+    _IMAGE_TAG_RE.lastIndex = end;
     const attrs = code.slice(tag.index, end);
     _PERCENT_HEIGHT_RE.lastIndex = 0;
     const hit = _PERCENT_HEIGHT_RE.exec(attrs);
     if (!hit) continue;
-    const line = code.slice(0, tag.index + hit.index).split(/\r?\n/).length;
+    const line = lineAt(tag.index + hit.index);
     findings.push({
       rule: "image-percent-height",
       severity: "warning",
@@ -1598,7 +1718,6 @@ function _imagePercentHeightRules(source) {
       line,
       snippet: (sourceLines[line - 1] || "").trim().slice(0, 200),
     });
-    _IMAGE_TAG_RE.lastIndex = end;
   }
   return findings;
 }
@@ -1615,10 +1734,11 @@ function _flexBasisPercentRules(source) {
   const findings = [];
   const code = _stripNonCode(source, { keepStrings: true });
   const sourceLines = source.split(/\r?\n/);
+  const lineAt = _lineCounter(code);
   _FLEX_BASIS_PERCENT_RE.lastIndex = 0;
   let hit;
   while ((hit = _FLEX_BASIS_PERCENT_RE.exec(code))) {
-    const line = code.slice(0, hit.index).split(/\r?\n/).length;
+    const line = lineAt(hit.index);
     findings.push({
       rule: "flex-basis-percent",
       severity: "warning",
@@ -1651,42 +1771,45 @@ const _SIDE_MARGIN_KEY_RE =
 const _ZERO_VALUE_RE =
   /^\s*(?:(["'`]?)-?0(?:\.0*)?(?:px)?\1\s*(?:[,}]|$)|(?:undefined|null)\b)/m;
 
-// The innermost `{ … }` around `at`, as [start, end); null outside any.
-function _enclosingObject(code, at) {
-  let start = -1;
-  for (let i = at - 1, depth = 0; i >= 0; i--) {
-    if (code[i] === "}") depth++;
-    else if (code[i] === "{" && depth-- === 0) {
-      start = i;
-      break;
+
+// The object's own keys only: a nested object's margin is not this box's.
+// Blanked rather than cut, so an offset here is the same offset in the source.
+// Partner offset of every brace matched by stack in `text`, else -1.
+function _bracePartners(text) {
+  const partner = new Int32Array(text.length).fill(-1);
+  const opens = [];
+  for (let i = 0; i < text.length; i++) {
+    if (text[i] === "{") opens.push(i);
+    else if (text[i] === "}" && opens.length > 0) {
+      const open = opens.pop();
+      partner[open] = i;
+      partner[i] = open;
     }
   }
-  if (start < 0) return null;
-  for (let j = at, depth = 0; j < code.length; j++) {
-    if (code[j] === "{") depth++;
-    else if (code[j] === "}" && depth-- === 0) return [start, j + 1];
+  return partner;
+}
+
+// An object's own level: each nested `{…}` collapsed to one space, with the
+// offset in `text` of every character kept. Walking only that level means
+// an ancestor never re-reads its descendants (sc-8204).
+function _ownKeys(text, partner, [start, end]) {
+  let own = "";
+  const at = [];
+  for (let i = start; i < end; i++) {
+    const close = partner[i];
+    const nested = text[i] === "{" && i !== start && close > i && close < end - 1;
+    own += nested ? " " : text[i];
+    at.push(i);
+    if (nested) i = close;
   }
-  return null;
+  return { own, at };
 }
 
-// The object's own keys only: a nested object's margin is not this box's.
-// Blanked rather than cut, so an offset here is the same offset in the source.
-function _ownKeysMask(structure, [start, end]) {
-  let body = structure.slice(start, end);
-  let previous;
-  do {
-    previous = body;
-    body = body.replace(/(?<!^)\{[^{}]*\}(?!$)/g, (nested) => " ".repeat(nested.length));
-  } while (body !== previous);
-  return body;
-}
-
-function _hasSideMargin(code, structure, span) {
-  const keys = _ownKeysMask(structure, span);
+function _hasSideMargin(code, keys) {
   _SIDE_MARGIN_KEY_RE.lastIndex = 0;
   let key;
-  while ((key = _SIDE_MARGIN_KEY_RE.exec(keys))) {
-    const valueAt = span[0] + key.index + key[0].length;
+  while ((key = _SIDE_MARGIN_KEY_RE.exec(keys.own))) {
+    const valueAt = keys.at[key.index + key[0].length - 1] + 1;
     if (!_ZERO_VALUE_RE.test(code.slice(valueAt, valueAt + 40))) return true;
   }
   return false;
@@ -1697,14 +1820,21 @@ function _fullWidthMarginRules(source) {
   const code = _stripNonCode(source, { keepStrings: true });
   // Strings blanked, so a brace inside a literal never unbalances the match.
   const structure = _stripNonCode(source);
+  const index = _jsxScanIndex(structure);
+  const partner = _bracePartners(structure);
+  const margined = new Map();
   const sourceLines = source.split(/\r?\n/);
+  const lineAt = _lineCounter(code);
   _FULL_WIDTH_RE.lastIndex = 0;
   let hit;
   while ((hit = _FULL_WIDTH_RE.exec(code))) {
-    const span = _enclosingObject(structure, hit.index);
+    const span = index.enclosingObject(hit.index);
     if (!span) continue;
-    if (!_hasSideMargin(code, structure, span)) continue;
-    const line = code.slice(0, hit.index).split(/\r?\n/).length;
+    if (!margined.has(span[0])) {
+      margined.set(span[0], _hasSideMargin(code, _ownKeys(structure, partner, span)));
+    }
+    if (!margined.get(span[0])) continue;
+    const line = lineAt(hit.index);
     findings.push({
       rule: "full-width-margin-overflow",
       severity: "warning",
@@ -1743,53 +1873,98 @@ function _styleEntryOffsets(structure) {
   return offsets;
 }
 
-// The object literals a style expression spans, plus the entries it names.
-function _styleObjectSpans(scan, [from, to]) {
+// What a style expression's objects say, ORed: the object literals it
+// spans, plus the named entries it references anywhere inside.
+function _styleRangeTraits(scan, [from, to]) {
   const { structure } = scan;
-  const spans = [];
+  let row = false;
+  let bordered = false;
   for (let i = from + 1; i < to - 1; i++) {
     if (structure[i] !== "{") continue;
-    const span = _enclosingObject(structure, i + 1);
+    const span = scan.index.enclosingObject(i + 1);
     if (!span) continue;
-    spans.push(span);
+    const traits = _styleObjectTraits(scan, span);
+    row = row || traits.row;
+    bordered = bordered || traits.bordered;
     i = span[1] - 1;
   }
-  if (!scan.entries) scan.entries = _styleEntryOffsets(structure);
-  const keys = new Set();
+  const refs = _styleRefTraits(scan);
+  const first = _firstAtOrAfter(refs.offsets, from);
+  const last = _firstAtOrAfter(refs.offsets, to);
+  return {
+    row: row || refs.rows[last] > refs.rows[first],
+    bordered: bordered || refs.bordered[last] > refs.bordered[first],
+  };
+}
+
+// Every `name.key` reference in the source, with running counts of those
+// naming a row / bordered entry, so a range is answered by subtraction
+// instead of re-reading it per nested parent (sc-8204).
+function _styleRefTraits(scan) {
+  if (scan.refs) return scan.refs;
+  if (!scan.entries) scan.entries = _styleEntryOffsets(scan.structure);
+  const offsets = [];
+  const rows = [0];
+  const bordered = [0];
   _STYLE_REF_RE.lastIndex = 0;
-  const refs = structure.slice(from, to);
   let ref;
-  while ((ref = _STYLE_REF_RE.exec(refs))) keys.add(ref[1]);
-  for (const key of keys) {
-    const at = scan.entries.get(key);
-    const span = at === undefined ? null : _enclosingObject(structure, at);
-    if (span) spans.push(span);
+  while ((ref = _STYLE_REF_RE.exec(scan.structure))) {
+    const at = scan.entries.get(ref[1]);
+    const span = at === undefined ? null : scan.index.enclosingObject(at);
+    const traits = span ? _styleObjectTraits(scan, span) : null;
+    offsets.push(ref.index);
+    rows.push(rows[rows.length - 1] + (traits && traits.row ? 1 : 0));
+    bordered.push(bordered[bordered.length - 1] + (traits && traits.bordered ? 1 : 0));
+  }
+  scan.refs = { offsets, rows, bordered };
+  return scan.refs;
+}
+
+function _firstAtOrAfter(sorted, value) {
+  let lo = 0;
+  let hi = sorted.length;
+  while (lo < hi) {
+    const mid = (lo + hi) >> 1;
+    if (sorted[mid] < value) lo = mid + 1;
+    else hi = mid;
   }
-  return spans;
+  return lo;
 }
 
 function _isBorderedRow(scan, tag) {
-  const { code, structure } = scan;
+  const { structure } = scan;
   const attrs = structure.slice(tag.attrs[0], tag.attrs[1]);
   const style = _STYLE_ATTR_RE.exec(attrs);
   if (!style) return false;
   const open = tag.attrs[0] + style.index + style[0].length - 1;
-  const inner = _bracedSpan(structure, open);
-  if (inner === null) return false;
-  let row = false;
-  let bordered = false;
-  // `inner` excludes its two braces.
-  for (const span of _styleObjectSpans(scan, [open, open + inner.length + 2])) {
-    const keys = _ownKeysMask(structure, span);
-    if (_ROW_KEY_RE.test(_ownKeysMask(code, span))) row = true;
-    _BORDER_WIDTH_KEY_RE.lastIndex = 0;
-    let key;
-    while ((key = _BORDER_WIDTH_KEY_RE.exec(keys))) {
-      const valueAt = span[0] + key.index + key[0].length;
-      if (!_ZERO_VALUE_RE.test(code.slice(valueAt, valueAt + 40))) bordered = true;
-    }
+  const close = scan.index.braceClose(open);
+  if (close === -1) return false;
+  const traits = _styleRangeTraits(scan, [open, close + 1]);
+  return traits.row && traits.bordered;
+}
+
+// Memoised per object: every row naming one shared style object would
+// otherwise re-read all of it, quadratic in the row count (sc-8204).
+function _styleObjectTraits(scan, span) {
+  const known = scan.traits.get(span[0]);
+  if (known) return known;
+  const { code, structure } = scan;
+  if (!scan.partners) {
+    scan.partners = { code: _bracePartners(code), structure: _bracePartners(structure) };
+  }
+  const keys = _ownKeys(structure, scan.partners.structure, span);
+  const traits = {
+    row: _ROW_KEY_RE.test(_ownKeys(code, scan.partners.code, span).own),
+    bordered: false,
+  };
+  _BORDER_WIDTH_KEY_RE.lastIndex = 0;
+  let key;
+  while ((key = _BORDER_WIDTH_KEY_RE.exec(keys.own))) {
+    const valueAt = keys.at[key.index + key[0].length - 1] + 1;
+    if (!_ZERO_VALUE_RE.test(code.slice(valueAt, valueAt + 40))) traits.bordered = true;
   }
-  return row && bordered;
+  scan.traits.set(span[0], traits);
+  return traits;
 }
 
 function _selfClosing(structure, end) {
@@ -1798,13 +1973,46 @@ function _selfClosing(structure, end) {
   return structure[i] === "/";
 }
 
+// The open-element stack, with where each name sits on it, so a closing
+// tag finds its opener without scanning the stack per close (sc-8204).
+function _openTagStack() {
+  const tags = [];
+  const byName = new Map();
+  const truncate = (length) => {
+    while (tags.length > length) {
+      const tag = tags.pop();
+      if (tag) byName.get(tag.name).pop();
+    }
+  };
+  return {
+    top: () => tags[tags.length - 1],
+    push: (tag) => {
+      if (tag) {
+        if (!byName.has(tag.name)) byName.set(tag.name, []);
+        byName.get(tag.name).push(tags.length);
+      }
+      tags.push(tag);
+    },
+    pop: () => truncate(Math.max(0, tags.length - 1)),
+    close: (name) => {
+      const at = byName.get(name);
+      if (at && at.length > 0) truncate(at[at.length - 1]);
+    },
+  };
+}
+
 function _fieldInBorderedRowRules(source) {
   const findings = [];
   const scan = {
     code: _stripNonCode(source, { keepStrings: true }),
     structure: _stripNonCode(source),
     entries: null,
+    index: null,
+    traits: new Map(),
+    partners: null,
+    refs: null,
   };
+  scan.index = _jsxScanIndex(scan.structure);
   const { code, structure } = scan;
   const sourceLines = source.split(/\r?\n/);
   // Tokens arrive in source order, so one running count serves every finding.
@@ -1824,7 +2032,7 @@ function _fieldInBorderedRowRules(source) {
       snippet: (sourceLines[n - 1] || "").trim().slice(0, 200),
     });
   };
-  const open = [];
+  const open = _openTagStack();
   _JSX_TOKEN_RE.lastIndex = 0;
   let token;
   while ((token = _JSX_TOKEN_RE.exec(structure))) {
@@ -1837,15 +2045,14 @@ function _fieldInBorderedRowRules(source) {
       continue;
     }
     if (closing) {
-      const at = open.map((tag) => tag && tag.name).lastIndexOf(name);
-      if (at >= 0) open.length = at;
+      open.close(name);
       continue;
     }
-    const end = _tagEnd(structure, token.index);
+    const end = scan.index.tagEnd(token.index);
     if (end === -1) break;
     const tag = { name, attrs: [token.index + token[0].length, end], borderedRow: undefined };
     if (_FIELD_TAG_NAMES.includes(name)) {
-      const parent = open[open.length - 1];
+      const parent = open.top();
       if (parent && parent.borderedRow === undefined) parent.borderedRow = _isBorderedRow(scan, parent);
       if (parent && parent.borderedRow) {
         report(
@@ -1885,27 +2092,42 @@ const _WIDTH_HOLDER_RE =
 const _LAYOUT_FEED_WINDOW = 80;
 
 function _measuredWidthNames(code) {
+  const fedByLayout = _layoutFedCallees(code);
   const names = [];
   _WIDTH_HOLDER_RE.lastIndex = 0;
   let held;
   while ((held = _WIDTH_HOLDER_RE.exec(code))) {
     const [, value, setter, hook] = held;
-    if (hook === "useContainerWidth") {
+    if (hook === "useContainerWidth" || fedByLayout.has(setter)) {
       names.push(value);
-      continue;
     }
-    const fedByLayout = new RegExp(
-      `\\b${setter}\\s*\\([\\s\\S]{0,${_LAYOUT_FEED_WINDOW}}?\\blayout\\.width\\b`,
-    );
-    if (fedByLayout.test(code)) names.push(value);
   }
   return names;
 }
 
-function _sizesFromMeasuredWidth(code, names) {
-  return names.some((name) =>
-    new RegExp(`\\b${name}\\s*[-/*]|[-/*]\\s*\\b${name}\\b`).test(code),
+// Every callee with a layout width among its first arguments, in one pass:
+// a regex per declared setter rescanned the source per declaration (sc-8204).
+function _layoutFedCallees(code) {
+  const fed = new Set();
+  const call = /\b(\w+)\s*\(/g;
+  const feed = new RegExp(
+    `[\\s\\S]{0,${_LAYOUT_FEED_WINDOW}}?\\blayout\\.width\\b`,
+    "y",
   );
+  let callee;
+  while ((callee = call.exec(code))) {
+    feed.lastIndex = call.lastIndex;
+    if (feed.test(code)) fed.add(callee[1]);
+  }
+  return fed;
+}
+
+function _sizesFromMeasuredWidth(code, names) {
+  if (names.length === 0) return false;
+  const operands = new Set();
+  for (const m of code.matchAll(/\b(\w+)\s*[-/*]/g)) operands.add(m[1]);
+  for (const m of code.matchAll(/[-/*]\s*\b(\w+)\b/g)) operands.add(m[1]);
+  return names.some((name) => operands.has(name));
 }
 
 function _measuredPaddingRules(source) {
@@ -1913,6 +2135,7 @@ function _measuredPaddingRules(source) {
   const measured = _measuredWidthNames(code);
   if (!_sizesFromMeasuredWidth(code, measured)) return [];
   const sourceLines = source.split(/\r?\n/);
+  const lineAt = _lineCounter(code);
   const findings = [];
   _JSX_TAG_RE.lastIndex = 0;
   let tag;
@@ -1923,9 +2146,7 @@ function _measuredPaddingRules(source) {
     if (!_ON_LAYOUT_ATTR_RE.test(attrs)) continue;
     const padded = _OWN_PADDING_RE.exec(attrs);
     if (!padded) continue;
-    const line = code
-      .slice(0, tag.index + padded.index)
-      .split(/\r?\n/).length;
+    const line = lineAt(tag.index + padded.index);
     findings.push({
       rule: "measured-width-ignores-padding",
       severity: "warning",
@@ -2081,6 +2302,17 @@ function _hardcodedDesignRules(source) {
  *   map, an array of sources, or one source string
  * @returns {{ ok: boolean, findings: Array<{ rule: string, severity: string, label: string, line: number, snippet: string }> }}
  */
+// Whether `\b<name>\b` matches `code`, from one pass over its words: a
+// regex per styleSchema field re-read the whole bundle per field (sc-8204).
+function _wordReader(code) {
+  const words = new Set(code.match(/\w+/g));
+  return (name) => {
+    if (!name.includes("$")) return words.has(name);
+    // Unescaped, `$` asserts end of input, so only the tail can match.
+    return new RegExp(`\\b${name}\\b`).test(code.slice(-(name.length + 1)));
+  };
+}
+
 function lintStyleWiring(manifest, files) {
   const empty = { ok: true, findings: [] };
   const schema = manifest && manifest.styleSchema;
@@ -2096,12 +2328,13 @@ function lintStyleWiring(manifest, files) {
     ? _WHOLE_WIDGET_STYLE_FIELDS
     : new Set();
   const findings = [];
+  const isRead = _wordReader(code);
   for (const field of Object.keys(schema)) {
     // A key that is not a bare identifier cannot be scanned by name; the
     // manifest validator rejects those anyway.
     if (!/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(field)) continue;
     if (appliedByHelper.has(field)) continue;
-    if (new RegExp(`\\b${field}\\b`).test(code)) continue;
+    if (isRead(field)) continue;
     findings.push({
       rule: "style-field-unread",
       severity: "warning",
@@ -2205,49 +2438,92 @@ function _isAuthoredCopy(text) {
   return !_SEPARATOR_GLYPHS.has(text);
 }
 
-// The `>` that CLOSES a JSX tag, skipping quoted attribute values and any `>`
-// inside a `{…}` expression — `onPress={() => x}` carries one, and treating it
-// as the tag end reports the handler body as copy.
-function _tagEnd(code, from) {
-  let depth = 0;
-  let quote = null;
-  for (let i = from; i < code.length; i++) {
-    const ch = code[i];
-    if (quote) {
-      if (ch === "\\") i++;
-      else if (ch === quote) quote = null;
-      continue;
-    }
-    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
-    else if (ch === "{") depth++;
-    else if (ch === "}") depth--;
-    else if (ch === ">" && depth <= 0) return i;
-  }
-  return -1;
+// Tag ends and brace spans over a STRING-BLANKED mask, where quotes are
+// already gone, so only brace depth decides. Answered from one index per
+// source: a scan per match was quadratic, and a file of bare `<Text`
+// wedged the API pod for a minute (sc-8204).
+function _jsxScanIndex(mask) {
+  const depth = new Int32Array(mask.length + 1);
+  for (let i = 0; i < mask.length; i++) {
+    const ch = mask[i];
+    depth[i + 1] = depth[i] + (ch === "{" ? 1 : ch === "}" ? -1 : 0);
+  }
+  let tagEnds = null;
+  let braceCloses = null;
+  let braceOpens = null;
+  const closes = () => {
+    if (!braceCloses) braceCloses = _nextAtOrBelow(mask, depth, "}");
+    return braceCloses;
+  };
+  return {
+    // The `>` that CLOSES a JSX tag, skipping any `>` inside a `{…}`
+    // expression — `onPress={() => x}` carries one, and treating it as the
+    // tag end reports the handler body as copy.
+    tagEnd: (from) => {
+      if (!tagEnds) tagEnds = _nextAtOrBelow(mask, depth, ">");
+      return tagEnds[from];
+    },
+    // The `}` balancing the `{` at `from`, or -1.
+    braceClose: (from) => (mask[from] === "{" ? closes()[from + 1] : -1),
+    // The innermost `{…}` around offset `at`, as [start, end), or null.
+    enclosingObject: (at) => {
+      if (!braceOpens) braceOpens = _previousOpenAtOrBelow(mask, depth);
+      const start = braceOpens[at];
+      const end = closes()[at];
+      return start === -1 || end === -1 ? null : [start, end + 1];
+    },
+  };
 }
 
-// The balanced `{…}` starting at `from`, or null.
-function _bracedSpan(code, from) {
-  if (code[from] !== "{") return null;
-  let depth = 0;
-  let quote = null;
-  for (let i = from; i < code.length; i++) {
-    const ch = code[i];
-    if (quote) {
-      if (ch === "\\") i++;
-      else if (ch === quote) quote = null;
-      continue;
+// For every offset i, the first j >= i holding `ch` with depth[j] at or
+// below depth[i], else -1. One right-to-left pass keeps the candidates on a
+// stack; a nearer one no deeper dominates, so depth rises toward the top
+// and each query is a binary search.
+function _nextAtOrBelow(mask, depth, ch) {
+  const n = mask.length;
+  const nearest = new Int32Array(n + 1).fill(-1);
+  const stack = new Int32Array(n);
+  let top = 0;
+  for (let i = n - 1; i >= 0; i--) {
+    if (mask[i] === ch) {
+      while (top > 0 && depth[stack[top - 1]] >= depth[i]) top--;
+      stack[top++] = i;
     }
-    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
-    else if (ch === "{") depth++;
-    else if (ch === "}") {
-      depth--;
-      if (depth === 0) return code.slice(from + 1, i);
+    nearest[i] = _topmostAtOrBelow(stack, top, depth, 0, depth[i]);
+  }
+  return nearest;
+}
+
+// The mirror for opening braces: for every offset k, the last `{` at i < k
+// whose inside, depth[i + 1], is at or below depth[k], else -1.
+function _previousOpenAtOrBelow(mask, depth) {
+  const n = mask.length;
+  const nearest = new Int32Array(n + 1).fill(-1);
+  const stack = new Int32Array(n);
+  let top = 0;
+  for (let k = 0; k <= n; k++) {
+    nearest[k] = _topmostAtOrBelow(stack, top, depth, 1, depth[k]);
+    if (k < n && mask[k] === "{") {
+      while (top > 0 && depth[stack[top - 1] + 1] >= depth[k + 1]) top--;
+      stack[top++] = k;
     }
   }
-  return null;
+  return nearest;
 }
 
+function _topmostAtOrBelow(stack, top, depth, shift, limit) {
+  let lo = 0;
+  let hi = top - 1;
+  let found = -1;
+  while (lo <= hi) {
+    const mid = (lo + hi) >> 1;
+    if (depth[stack[mid] + shift] <= limit) {
+      found = stack[mid];
+      lo = mid + 1;
+    } else hi = mid - 1;
+  }
+  return found;
+}
 // The non-escape branch excludes `\` so the two branches can never both
 // match the same character. With a bare `.`, escape pairs before a quote
 // the anchor then rejects backtrack exponentially — 60 characters of an
@@ -2256,8 +2532,7 @@ function _bracedSpan(code, from) {
 //
 // It excludes the line terminators too, because a character class — unlike
 // `.` — matches them, which would widen the literal past its own line.
-// An odd trailing backslash run therefore no longer matches; `_bracedSpan`
-// shares the escape rule and never yields one.
+// An odd trailing backslash run therefore no longer matches.
 const _TEXT_LITERAL_CHILD_RE =
   /^(["'`])((?:\\.|(?!\1)[^\\\r\n\u2028\u2029])*)\1$/;
 
@@ -2273,16 +2548,23 @@ function _textLiteralOccurrences(codes, masks) {
     // not read as markup. Both masks preserve offsets, so the child is read
     // back from the kept-strings source at the very same index.
     const mask = masks[f];
+    const index = _jsxScanIndex(mask);
+    const lineAt = _lineCounter(code);
+    // Unclosed tags share the next closing `>`, and so share its child: read
+    // each child once, or `<Text <Text … >` re-reads it per tag.
+    const readEnds = new Set();
     const re = /<Text\b/g;
     let m;
     while ((m = re.exec(mask)) !== null) {
-      const end = _tagEnd(mask, m.index);
-      if (end === -1) continue;
+      const end = index.tagEnd(m.index);
+      if (end === -1 || readEnds.has(end)) continue;
+      readEnds.add(end);
       let i = end + 1;
       while (i < code.length && /\s/.test(code[i])) i++;
       let text = null;
       if (code[i] === "{") {
-        const inner = _bracedSpan(code, i);
+        const close = index.braceClose(i);
+        const inner = close === -1 ? null : code.slice(i + 1, close);
         const lit = inner && inner.trim().match(_TEXT_LITERAL_CHILD_RE);
         // A template carrying `${…}` interpolates a value, so it is not a literal.
         if (lit && !(lit[1] === "`" && lit[2].includes("${"))) text = lit[2];
@@ -2294,7 +2576,7 @@ function _textLiteralOccurrences(codes, masks) {
       text = text.trim();
       if (!_isAuthoredCopy(text) || byText.has(text)) continue;
       // Split-impl carries the same copy twice; report the string, not the file.
-      byText.set(text, code.slice(0, i).split("\n").length);
+      byText.set(text, lineAt(i));
     }
   }
   return [...byText.entries()].map(([text, line]) => ({ text, line }));