@geoql/doctor-rule-core 1.0.0

package/dist/index.js

@@ -0,0 +1,1176 @@
+//#region src/define-rule.ts
+function defineRule(rule) {
+	const userFix = rule.fix;
+	if (!userFix) return rule;
+	return {
+		...rule,
+		meta: {
+			...rule.meta,
+			fixable: "code"
+		},
+		create(context) {
+			const wrapped = {
+				...context,
+				report(descriptor) {
+					const replacement = userFix(descriptor.node);
+					if (replacement === null) {
+						context.report(descriptor);
+						return;
+					}
+					context.report({
+						...descriptor,
+						fix: (fixer) => fixer.replaceText(descriptor.node, replacement)
+					});
+				}
+			};
+			return rule.create(wrapped);
+		}
+	};
+}
+//#endregion
+//#region src/shared/auto-imported-symbols.ts
+const VUE_AUTO_IMPORTED = new Set([
+	"ref",
+	"shallowRef",
+	"computed",
+	"reactive",
+	"shallowReactive",
+	"readonly",
+	"shallowReadonly",
+	"toRef",
+	"toRefs",
+	"isRef",
+	"isReactive",
+	"isReadonly",
+	"isProxy",
+	"unref",
+	"triggerRef",
+	"customRef",
+	"markRaw",
+	"toRaw",
+	"watch",
+	"watchEffect",
+	"watchPostEffect",
+	"watchSyncEffect",
+	"effectScope",
+	"getCurrentScope",
+	"onScopeDispose",
+	"onMounted",
+	"onUpdated",
+	"onUnmounted",
+	"onBeforeMount",
+	"onBeforeUpdate",
+	"onBeforeUnmount",
+	"onErrorCaptured",
+	"onRenderTracked",
+	"onRenderTriggered",
+	"onActivated",
+	"onDeactivated",
+	"onServerPrefetch",
+	"provide",
+	"inject",
+	"hasInjectionContext",
+	"getCurrentInstance",
+	"nextTick",
+	"defineComponent",
+	"defineAsyncComponent",
+	"useTemplateRef",
+	"useId",
+	"useModel"
+]);
+const NUXT_AUTO_IMPORTED = new Set([
+	...VUE_AUTO_IMPORTED,
+	"useRoute",
+	"useRouter",
+	"useFetch",
+	"useAsyncData",
+	"useState",
+	"useRuntimeConfig",
+	"useNuxtApp",
+	"navigateTo",
+	"definePageMeta",
+	"useSeoMeta",
+	"useHead"
+]);
+//#endregion
+//#region src/rules/nuxt/ai-slop/no-explicit-imports-of-auto-imported.ts
+const DOCS_URL$1 = "https://nuxt.com/docs/4.x/guide/concepts/auto-imports";
+const WHOLE_MESSAGE$1 = `These symbols are auto-imported in Nuxt projects. Remove the import entirely. See ${DOCS_URL$1}`;
+const SPECIFIER_MESSAGE$1 = `This symbol is auto-imported in Nuxt projects. Remove it from the import — it is dead weight. See ${DOCS_URL$1}`;
+const AUTO_IMPORT_SOURCES = new Set([
+	"vue",
+	"#imports",
+	"vue-router",
+	"#app"
+]);
+function isAutoImportedValueSpecifier$1(spec) {
+	if (spec.importKind === "type") return false;
+	const imported = spec.imported;
+	return NUXT_AUTO_IMPORTED.has(imported.name);
+}
+const noExplicitImportsOfAutoImported = defineRule({ create(context) {
+	return { ImportDeclaration(node) {
+		if (node.importKind === "type") return;
+		const source = node.source;
+		if (!AUTO_IMPORT_SOURCES.has(source.value)) return;
+		const specifiers = node.specifiers;
+		const named = specifiers.filter((s) => s.type === "ImportSpecifier");
+		if (named.length === 0) return;
+		const offending = named.filter(isAutoImportedValueSpecifier$1);
+		if (offending.length === 0) return;
+		if (offending.length === named.length && specifiers.length === named.length) {
+			context.report({
+				node,
+				message: WHOLE_MESSAGE$1
+			});
+			return;
+		}
+		for (const spec of offending) context.report({
+			node: spec,
+			message: SPECIFIER_MESSAGE$1
+		});
+	} };
+} });
+//#endregion
+//#region src/rules/nuxt/ai-slop/no-fetch-in-setup.ts
+const MESSAGE$22 = `Bare $fetch/fetch at the top level of <script setup> runs on both server and client without SSR deduplication. Use useFetch for automatic request deduplication and SSR hydration. See https://nuxt.com/docs/4.x/guide/data-fetching`;
+function isFetchCall(node) {
+	if (!node || node.type !== "CallExpression") return false;
+	const callee = node.callee;
+	if (callee?.type === "Identifier") {
+		const name = callee.name;
+		return name === "$fetch" || name === "fetch";
+	}
+	return false;
+}
+const noFetchInSetup = defineRule({ create(context) {
+	const functionDepthStack = [];
+	return {
+		ArrowFunctionExpression() {
+			functionDepthStack.push(functionDepthStack.length > 0 ? functionDepthStack[functionDepthStack.length - 1] + 1 : 1);
+		},
+		"ArrowFunctionExpression:exit"() {
+			functionDepthStack.pop();
+		},
+		FunctionExpression() {
+			functionDepthStack.push(functionDepthStack.length > 0 ? functionDepthStack[functionDepthStack.length - 1] + 1 : 1);
+		},
+		"FunctionExpression:exit"() {
+			functionDepthStack.pop();
+		},
+		FunctionDeclaration() {
+			functionDepthStack.push(functionDepthStack.length > 0 ? functionDepthStack[functionDepthStack.length - 1] + 1 : 1);
+		},
+		"FunctionDeclaration:exit"() {
+			functionDepthStack.pop();
+		},
+		CallExpression(node) {
+			if (functionDepthStack.length > 0) return;
+			if (!isFetchCall(node)) return;
+			if (node["parent"]?.type === "AwaitExpression") return;
+			context.report({
+				node,
+				message: MESSAGE$22
+			});
+		},
+		AwaitExpression(node) {
+			if (functionDepthStack.length > 0) return;
+			if (!isFetchCall(node.argument)) return;
+			context.report({
+				node,
+				message: MESSAGE$22
+			});
+		}
+	};
+} });
+//#endregion
+//#region src/rules/nuxt/ai-slop/no-process-client-server.ts
+const LEGACY_PROPS = new Set([
+	"client",
+	"server",
+	"browser"
+]);
+const MESSAGE$21 = `Use import.meta.client / import.meta.server / import.meta.browser instead of process.client / process.server / process.browser (Nuxt 4). See https://nuxt.com/docs/4.x/guide/concepts/auto-imports`;
+const noProcessClientServer = defineRule({
+	create(context) {
+		return { MemberExpression(node) {
+			const object = node.object;
+			if (object?.type !== "Identifier") return;
+			if (object.name !== "process") return;
+			const property = node.property;
+			if (property?.type !== "Identifier") return;
+			if (!LEGACY_PROPS.has(property.name)) return;
+			context.report({
+				node,
+				message: MESSAGE$21
+			});
+		} };
+	},
+	fix(node) {
+		const object = node.object;
+		if (object?.type !== "Identifier") return null;
+		if (object.name !== "process") return null;
+		const property = node.property;
+		if (property?.type !== "Identifier") return null;
+		const name = property.name;
+		if (!LEGACY_PROPS.has(name)) return null;
+		return `import.meta.${name}`;
+	}
+});
+//#endregion
+//#region src/rules/nuxt/ai-slop/no-useState-for-server-data.ts
+const MESSAGE$20 = `useState with a fetch/await initializer suggests useFetch or useAsyncData for automatic SSR hydration and request deduplication. See https://nuxt.com/docs/4.x/guide/data-fetching`;
+function containsFetchOrAwait(node, visited) {
+	if (!node || visited.has(node)) return false;
+	visited.add(node);
+	if (node.type === "AwaitExpression") return true;
+	if (node.type === "CallExpression") {
+		const callee = node.callee;
+		if (callee?.type === "Identifier") {
+			const name = callee.name;
+			if (name === "$fetch" || name === "fetch") return true;
+		}
+	}
+	for (const key of Object.keys(node)) {
+		if (key === "type" || key === "loc" || key === "range") continue;
+		const value = node[key];
+		if (Array.isArray(value)) {
+			for (const child of value) if (child && typeof child === "object" && "type" in child) {
+				if (containsFetchOrAwait(child, visited)) return true;
+			}
+		} else if (value && typeof value === "object" && "type" in value) {
+			if (containsFetchOrAwait(value, visited)) return true;
+		}
+	}
+	return false;
+}
+const noUseStateForServerData = defineRule({ create(context) {
+	return { CallExpression(node) {
+		const callee = node.callee;
+		if (callee?.type !== "Identifier") return;
+		if (callee.name !== "useState") return;
+		const args = node.arguments;
+		if (args.length < 2) return;
+		const initFn = args[1];
+		if (initFn.type !== "ArrowFunctionExpression" && initFn.type !== "FunctionExpression") return;
+		if (!containsFetchOrAwait(initFn.body, /* @__PURE__ */ new Set())) return;
+		context.report({
+			node,
+			message: MESSAGE$20
+		});
+	} };
+} });
+//#endregion
+//#region src/rules/nuxt/data-fetching/useAsyncData-key-required-in-loop.ts
+const MESSAGE$19 = `useAsyncData/useFetch without an explicit string key inside a loop causes duplicate requests and cache fragmentation. Pass a unique string key as the first argument. See https://nuxt.com/docs/4.x/guide/data-fetching`;
+const DATA_FETCHERS = new Set(["useAsyncData", "useFetch"]);
+function isMapCall(node) {
+	const callee = node.callee;
+	if (callee?.type === "Identifier") return callee.name === "map";
+	if (callee?.type === "MemberExpression") {
+		const prop = callee.property;
+		return prop?.type === "Identifier" && prop.name === "map";
+	}
+	return false;
+}
+const useAsyncDataKeyRequiredInLoop = defineRule({ create(context) {
+	let loopDepth = 0;
+	return {
+		ForStatement() {
+			loopDepth++;
+		},
+		"ForStatement:exit"() {
+			loopDepth--;
+		},
+		ForOfStatement() {
+			loopDepth++;
+		},
+		"ForOfStatement:exit"() {
+			loopDepth--;
+		},
+		ForInStatement() {
+			loopDepth++;
+		},
+		"ForInStatement:exit"() {
+			loopDepth--;
+		},
+		WhileStatement() {
+			loopDepth++;
+		},
+		"WhileStatement:exit"() {
+			loopDepth--;
+		},
+		CallExpression(node) {
+			if (isMapCall(node)) {
+				loopDepth++;
+				return;
+			}
+			if (loopDepth === 0) return;
+			const callee = node.callee;
+			if (callee?.type !== "Identifier") return;
+			if (!DATA_FETCHERS.has(callee.name)) return;
+			const args = node.arguments;
+			if (args.length === 0) return;
+			const firstArg = args[0];
+			if (firstArg.type === "Literal" && typeof firstArg.value === "string") return;
+			context.report({
+				node,
+				message: MESSAGE$19
+			});
+		},
+		"CallExpression:exit"(node) {
+			if (isMapCall(node)) loopDepth--;
+		}
+	};
+} });
+//#endregion
+//#region src/rules/nuxt/security/no-user-input-in-fetch-url.ts
+const MESSAGE$18 = `Building a useFetch/$fetch URL from user input (route.query/route.params) lets an attacker control the request target — an SSRF risk during SSR. Use a fixed path and pass user input via the query/body options instead. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery`;
+const FETCH_CALLEES = new Set([
+	"useFetch",
+	"useLazyFetch",
+	"useAsyncData",
+	"useLazyAsyncData",
+	"$fetch"
+]);
+const USER_INPUT_ROOTS = new Set(["route", "useRoute"]);
+const USER_INPUT_SEGMENTS = new Set(["query", "params"]);
+function calleeName$7(node) {
+	const callee = node.callee;
+	if (callee?.type === "Identifier") return callee.name;
+}
+/** True when the expression reads from route.query.* or route.params.*. */
+function readsUserInput(node) {
+	if (node.type !== "MemberExpression") return false;
+	const object = node.object;
+	const property = node.property;
+	if (object.type === "Identifier" && USER_INPUT_ROOTS.has(object.name) && property.type === "Identifier" && USER_INPUT_SEGMENTS.has(property.name)) return true;
+	return readsUserInput(object);
+}
+function templateReadsUserInput(node) {
+	return node.expressions.some((expr) => readsUserInput(expr));
+}
+function urlArgIsTainted(arg) {
+	if (!arg) return false;
+	if (arg.type === "TemplateLiteral") return templateReadsUserInput(arg);
+	if (arg.type === "MemberExpression") return readsUserInput(arg);
+	return false;
+}
+const noUserInputInFetchUrl = defineRule({ create(context) {
+	return { CallExpression(node) {
+		const name = calleeName$7(node);
+		if (name === void 0 || !FETCH_CALLEES.has(name)) return;
+		const urlArg = node.arguments[0];
+		if (urlArgIsTainted(urlArg)) context.report({
+			node,
+			message: MESSAGE$18
+		});
+	} };
+} });
+//#endregion
+//#region src/rules/nuxt/hydration/clientOnly-for-browser-apis.ts
+const MESSAGE$17 = `Accessing window./document./navigator./localStorage./sessionStorage. without an import.meta.client or process.client guard causes SSR failures. Wrap with if (import.meta.client) { ... } or move to onMounted. See https://nuxt.com/docs/4.x/guide/components`;
+const BROWSER_GLOBALS = new Set([
+	"window",
+	"document",
+	"navigator",
+	"localStorage",
+	"sessionStorage"
+]);
+function isImportMetaClientGuard(node) {
+	if (!node || node.type !== "MemberExpression") return false;
+	const obj = node.object;
+	if (obj?.type !== "MetaProperty") return false;
+	const meta = obj.meta;
+	const prop = obj.property;
+	if (meta?.type !== "Identifier") return false;
+	if (meta.name !== "import") return false;
+	if (prop?.type !== "Identifier") return false;
+	if (prop.name !== "meta") return false;
+	const property = node.property;
+	if (property?.type !== "Identifier") return false;
+	return property.name === "client";
+}
+function isProcessClientGuard(node) {
+	if (!node || node.type !== "MemberExpression") return false;
+	const obj = node.object;
+	if (obj?.type !== "Identifier") return false;
+	if (obj.name !== "process") return false;
+	const property = node.property;
+	if (property?.type !== "Identifier") return false;
+	return property.name === "client";
+}
+const clientOnlyForBrowserApis = defineRule({ create(context) {
+	const functionDepthStack = [];
+	let isGuarded = false;
+	return {
+		ArrowFunctionExpression() {
+			functionDepthStack.push(functionDepthStack.length > 0 ? functionDepthStack[functionDepthStack.length - 1] + 1 : 1);
+		},
+		"ArrowFunctionExpression:exit"() {
+			functionDepthStack.pop();
+		},
+		FunctionExpression() {
+			functionDepthStack.push(functionDepthStack.length > 0 ? functionDepthStack[functionDepthStack.length - 1] + 1 : 1);
+		},
+		"FunctionExpression:exit"() {
+			functionDepthStack.pop();
+		},
+		FunctionDeclaration() {
+			functionDepthStack.push(functionDepthStack.length > 0 ? functionDepthStack[functionDepthStack.length - 1] + 1 : 1);
+		},
+		"FunctionDeclaration:exit"() {
+			functionDepthStack.pop();
+		},
+		IfStatement(node) {
+			if (functionDepthStack.length > 0) return;
+			const test = node.test;
+			if (isImportMetaClientGuard(test) || isProcessClientGuard(test)) isGuarded = true;
+		},
+		"IfStatement:exit"(node) {
+			if (functionDepthStack.length > 0) return;
+			const test = node.test;
+			if (isImportMetaClientGuard(test) || isProcessClientGuard(test)) isGuarded = false;
+		},
+		MemberExpression(node) {
+			if (functionDepthStack.length > 0) return;
+			if (isGuarded) return;
+			const obj = node.object;
+			if (obj?.type !== "Identifier") return;
+			if (!BROWSER_GLOBALS.has(obj.name)) return;
+			context.report({
+				node,
+				message: MESSAGE$17
+			});
+		}
+	};
+} });
+//#endregion
+//#region src/rules/nuxt/hydration/no-document-in-setup.ts
+const MESSAGE$16 = `Accessing document/window/navigator/localStorage at the top level of <script setup> causes a server-side crash (SSR). These browser globals are undefined on the server. Move access inside onMounted or guard with import.meta.client. See https://nuxt.com/docs/4.x/guide/components`;
+const SSR_UNSAFE_GLOBALS = new Set([
+	"document",
+	"window",
+	"navigator",
+	"localStorage",
+	"sessionStorage"
+]);
+const noDocumentInSetup = defineRule({ create(context) {
+	const functionDepthStack = [];
+	return {
+		ArrowFunctionExpression() {
+			functionDepthStack.push(functionDepthStack.length > 0 ? functionDepthStack[functionDepthStack.length - 1] + 1 : 1);
+		},
+		"ArrowFunctionExpression:exit"() {
+			functionDepthStack.pop();
+		},
+		FunctionExpression() {
+			functionDepthStack.push(functionDepthStack.length > 0 ? functionDepthStack[functionDepthStack.length - 1] + 1 : 1);
+		},
+		"FunctionExpression:exit"() {
+			functionDepthStack.pop();
+		},
+		FunctionDeclaration() {
+			functionDepthStack.push(functionDepthStack.length > 0 ? functionDepthStack[functionDepthStack.length - 1] + 1 : 1);
+		},
+		"FunctionDeclaration:exit"() {
+			functionDepthStack.pop();
+		},
+		Identifier(node) {
+			if (functionDepthStack.length > 0) return;
+			if (SSR_UNSAFE_GLOBALS.has(node.name)) context.report({
+				node,
+				message: MESSAGE$16
+			});
+		}
+	};
+} });
+//#endregion
+//#region src/rules/nuxt/server-routes/createError-on-failure.ts
+const MESSAGE$15 = `throw new Error() leaks the call stack and exposes internal details. Use throw createError() from h3 for proper HTTP errors with no stack leak. See https://h3.unjs.io/guide/throw`;
+const createErrorOnFailure = defineRule({ create(context) {
+	let handlerDepth = 0;
+	return {
+		CallExpression(node) {
+			const callee = node.callee;
+			if (callee?.type !== "Identifier") return;
+			if (callee.name !== "defineEventHandler") return;
+			handlerDepth++;
+		},
+		"CallExpression:exit"(node) {
+			const callee = node.callee;
+			if (callee?.type !== "Identifier") return;
+			if (callee.name !== "defineEventHandler") return;
+			handlerDepth--;
+		},
+		ThrowStatement(node) {
+			if (handlerDepth === 0) return;
+			const arg = node.argument;
+			if (!arg || arg.type !== "NewExpression") return;
+			const ctor = arg.callee;
+			if (ctor?.type !== "Identifier") return;
+			if (ctor.name !== "Error") return;
+			context.report({
+				node,
+				message: MESSAGE$15
+			});
+		}
+	};
+} });
+//#endregion
+//#region src/rules/nuxt/server-routes/defineEventHandler-typed.ts
+const MESSAGE$14 = `defineEventHandler handler param event lacks a type annotation. Add a generic: defineEventHandler<H3Event>(...) or type the event parameter explicitly. See https://h3.unjs.io/guide/typed`;
+function isFunction$1(node) {
+	return node?.type === "ArrowFunctionExpression" || node?.type === "FunctionExpression";
+}
+const defineEventHandlerTyped = defineRule({ create(context) {
+	return { CallExpression(node) {
+		const callee = node.callee;
+		if (callee?.type !== "Identifier") return;
+		if (callee.name !== "defineEventHandler") return;
+		if (node.typeArguments) return;
+		const args = node.arguments;
+		if (args.length === 0) return;
+		const handler = args[0];
+		if (!isFunction$1(handler)) return;
+		const params = handler.params;
+		if (!params || params.length === 0) return;
+		if (params[0].typeAnnotation) return;
+		context.report({
+			node,
+			message: MESSAGE$14
+		});
+	} };
+} });
+//#endregion
+//#region src/rules/nuxt/server-routes/validate-body-with-h3-v2.ts
+const MESSAGE$13 = `readBody() is the legacy H3 reader. In Nuxt 4 with h3 v2, use readValidatedBody to parse and validate the request body in one step. See https://nuxt.com/docs/4.x/guide/data-fetching`;
+const validateBodyWithH3V2 = defineRule({ create(context) {
+	return { CallExpression(node) {
+		const callee = node.callee;
+		if (callee?.type !== "Identifier") return;
+		if (callee.name !== "readBody") return;
+		context.report({
+			node,
+			message: MESSAGE$13
+		});
+	} };
+} });
+//#endregion
+//#region src/rules/nuxt/index.ts
+function coreRule$1(id, category, severity, recommended, rule) {
+	return {
+		id,
+		category,
+		severity,
+		recommended,
+		...rule
+	};
+}
+const NUXT_RULES = [
+	coreRule$1("ai-slop/no-process-client-server", "ai-slop", "error", true, defineRule(noProcessClientServer)),
+	coreRule$1("ai-slop/no-explicit-imports-of-auto-imported", "ai-slop", "warn", true, defineRule(noExplicitImportsOfAutoImported)),
+	coreRule$1("ai-slop/no-useState-for-server-data", "ai-slop", "warn", true, defineRule(noUseStateForServerData)),
+	coreRule$1("ai-slop/no-fetch-in-setup", "ai-slop", "warn", true, defineRule(noFetchInSetup)),
+	coreRule$1("data-fetching/useAsyncData-key-required-in-loop", "data-fetching", "error", true, defineRule(useAsyncDataKeyRequiredInLoop)),
+	coreRule$1("server-routes/defineEventHandler-typed", "server-routes", "warn", true, defineRule(defineEventHandlerTyped)),
+	coreRule$1("server-routes/validate-body-with-h3-v2", "server-routes", "warn", true, defineRule(validateBodyWithH3V2)),
+	coreRule$1("server-routes/createError-on-failure", "server-routes", "warn", true, defineRule(createErrorOnFailure)),
+	coreRule$1("hydration/no-document-in-setup", "hydration", "error", true, defineRule(noDocumentInSetup)),
+	coreRule$1("hydration/clientOnly-for-browser-apis", "hydration", "error", true, defineRule(clientOnlyForBrowserApis)),
+	coreRule$1("security/no-user-input-in-fetch-url", "security", "warn", true, defineRule(noUserInputInFetchUrl))
+];
+//#endregion
+//#region src/rules/vue/ai-slop/no-destructure-props-without-toRefs.ts
+const MESSAGE$12 = `Destructuring props loses reactivity. Wrap with toRefs(...) to keep refs. See https://vuejs.org/guide/components/props.html#reactive-props-destructure`;
+function calleeName$6(node) {
+	const callee = node.callee;
+	if (callee?.type === "Identifier") return callee.name;
+}
+function isDefinePropsCall(node) {
+	if (!node || node.type !== "CallExpression") return false;
+	const name = calleeName$6(node);
+	if (name === "defineProps") return true;
+	if (name === "withDefaults") {
+		const args = node.arguments;
+		return isDefinePropsCall(args?.[0]);
+	}
+	return false;
+}
+function isToRefsCall$1(node) {
+	return node?.type === "CallExpression" && calleeName$6(node) === "toRefs";
+}
+const noDestructurePropsWithoutToRefs = defineRule({ create(context) {
+	const propsSources = /* @__PURE__ */ new Set();
+	function registerSetupParam(fn) {
+		const first = (fn?.params)?.[0];
+		if (first?.type === "Identifier") propsSources.add(first.name);
+	}
+	return {
+		VariableDeclarator(node) {
+			const id = node.id;
+			const init = node.init;
+			if (id.type === "Identifier" && isDefinePropsCall(init)) {
+				propsSources.add(id.name);
+				return;
+			}
+			if (id.type !== "ObjectPattern" || !init) return;
+			if (isToRefsCall$1(init)) return;
+			if (isDefinePropsCall(init) || init.type === "Identifier" && propsSources.has(init.name)) context.report({
+				node,
+				message: MESSAGE$12
+			});
+		},
+		Property(node) {
+			const key = node.key;
+			if (key?.type === "Identifier" && key.name === "setup") registerSetupParam(node.value);
+		}
+	};
+} });
+//#endregion
+//#region src/rules/vue/ai-slop/no-destructure-reactive-without-toRefs.ts
+const MESSAGE$11 = `Destructuring reactive state loses reactivity. Wrap with toRefs(...) or read single keys via toRef(state, 'key'). See https://vuejs.org/guide/essentials/reactivity-fundamentals.html#destructuring-reactive-state`;
+const REACTIVE_FACTORIES = new Set(["reactive", "shallowReactive"]);
+function calleeName$5(node) {
+	const callee = node.callee;
+	if (callee?.type === "Identifier") return callee.name;
+}
+function isReactiveCall(node) {
+	if (!node || node.type !== "CallExpression") return false;
+	const name = calleeName$5(node);
+	if (name && REACTIVE_FACTORIES.has(name)) return true;
+	if (name === "readonly") {
+		const args = node.arguments;
+		return isReactiveCall(args?.[0]);
+	}
+	return false;
+}
+function isToRefsCall(node) {
+	return node?.type === "CallExpression" && calleeName$5(node) === "toRefs";
+}
+const noDestructureReactiveWithoutToRefs = defineRule({ create(context) {
+	const reactiveSources = /* @__PURE__ */ new Set();
+	return { VariableDeclarator(node) {
+		const id = node.id;
+		const init = node.init;
+		if (id.type === "Identifier" && isReactiveCall(init)) {
+			reactiveSources.add(id.name);
+			return;
+		}
+		if (id.type !== "ObjectPattern" || !init) return;
+		if (isToRefsCall(init)) return;
+		if (isReactiveCall(init) || init.type === "Identifier" && reactiveSources.has(init.name)) context.report({
+			node,
+			message: MESSAGE$11
+		});
+	} };
+} });
+//#endregion
+//#region src/rules/vue/ai-slop/no-em-dash-in-string.ts
+const EM_DASH = "—";
+const noEmDashInString = defineRule({
+	create(context) {
+		return { Literal(node) {
+			const literal = node;
+			if (typeof literal.value !== "string") return;
+			if (!literal.value.includes(EM_DASH)) return;
+			context.report({
+				node,
+				message: "Em dash in string literal reads as AI-generated output; use comma, colon, or parentheses."
+			});
+		} };
+	},
+	fix(node) {
+		const literal = node;
+		if (typeof literal.value !== "string") return null;
+		const raw = literal.raw;
+		if (typeof raw !== "string") return null;
+		if (!raw.includes(EM_DASH)) return null;
+		return raw.split(EM_DASH).join("-");
+	}
+});
+//#endregion
+//#region src/rules/vue/ai-slop/no-imports-from-vue-when-auto-imported.ts
+const DOCS_URL = "https://nuxt.com/docs/4.x/guide/concepts/auto-imports";
+const WHOLE_MESSAGE = `The entire import from 'vue' can be removed — these names are auto-imported in this project. See ${DOCS_URL}`;
+const SPECIFIER_MESSAGE = `This symbol is auto-imported in your project. Remove it from the 'vue' import — it is dead weight in the diff. See ${DOCS_URL}`;
+function isAutoImportedValueSpecifier(spec) {
+	if (spec.importKind === "type") return false;
+	const imported = spec.imported;
+	return VUE_AUTO_IMPORTED.has(imported.name);
+}
+const noImportsFromVueWhenAutoImported = defineRule({ create(context) {
+	let gated = false;
+	return {
+		Program() {
+			gated = context.capabilities?.has("auto-imports:vue") !== true;
+		},
+		ImportDeclaration(node) {
+			if (gated) return;
+			if (node.importKind === "type") return;
+			if (node.source.value !== "vue") return;
+			const specifiers = node.specifiers;
+			const named = specifiers.filter((s) => s.type === "ImportSpecifier");
+			if (named.length === 0) return;
+			const offending = named.filter(isAutoImportedValueSpecifier);
+			if (offending.length === 0) return;
+			if (offending.length === named.length && specifiers.length === named.length) {
+				context.report({
+					node,
+					message: WHOLE_MESSAGE
+				});
+				return;
+			}
+			for (const spec of offending) context.report({
+				node: spec,
+				message: SPECIFIER_MESSAGE
+			});
+		}
+	};
+} });
+//#endregion
+//#region src/rules/vue/ai-slop/no-non-null-assertion-on-ref-value.ts
+const MESSAGE$10 = `Non-null assertion on a ref's .value hides nullability. Add an explicit guard ('if (!r.value) return') or use optional chaining ('r.value?.x'). See https://vuejs.org/guide/typescript/composition-api.html#typing-ref`;
+const REF_FACTORIES = new Set([
+	"ref",
+	"shallowRef",
+	"customRef",
+	"computed",
+	"useTemplateRef"
+]);
+function calleeName$4(node) {
+	const callee = node.callee;
+	if (callee?.type === "Identifier") return callee.name;
+}
+function isRefFactoryCall(node) {
+	if (!node || node.type !== "CallExpression") return false;
+	const name = calleeName$4(node);
+	return name !== void 0 && REF_FACTORIES.has(name);
+}
+function isDotValue(node) {
+	if (!node || node.type !== "MemberExpression") return false;
+	const property = node.property;
+	return node.computed !== true && property?.type === "Identifier" && property.name === "value";
+}
+const noNonNullAssertionOnRefValue = defineRule({ create(context) {
+	const refSources = /* @__PURE__ */ new Set();
+	return {
+		VariableDeclarator(node) {
+			const id = node.id;
+			if (id.type === "Identifier" && isRefFactoryCall(node.init)) refSources.add(id.name);
+		},
+		TSNonNullExpression(node) {
+			const arg = node.expression;
+			if (!isDotValue(arg)) return;
+			const object = arg.object;
+			if (object?.type !== "Identifier") return;
+			if (!refSources.has(object.name)) return;
+			context.report({
+				node,
+				message: MESSAGE$10
+			});
+		}
+	};
+} });
+//#endregion
+//#region src/rules/vue/composition/defineProps-typed.ts
+const MESSAGE$9 = `This defineProps() call declares props with a runtime object, which discards static type information. Use the type-only generic form (defineProps<{ ... }>()) so props are fully typed. See https://vuejs.org/guide/typescript/composition-api.html#typing-component-props`;
+function calleeName$3(node) {
+	const callee = node.callee;
+	if (callee?.type === "Identifier") return callee.name;
+}
+const definePropsTyped = defineRule({ create(context) {
+	return { CallExpression(node) {
+		if (calleeName$3(node) !== "defineProps") return;
+		if (node.arguments[0]?.type === "ObjectExpression") context.report({
+			node,
+			message: MESSAGE$9
+		});
+	} };
+} });
+//#endregion
+//#region src/rules/vue/composition/prefer-script-setup-for-new-files.ts
+const MESSAGE$8 = `This component nests composition-API logic inside an options-object setup(). Use a <script setup> block instead — it removes the setup() boilerplate and exposes bindings to the template directly. See https://vuejs.org/api/sfc-script-setup.html`;
+function isFunctionValue(node) {
+	return node?.type === "ArrowFunctionExpression" || node?.type === "FunctionExpression";
+}
+function isSetupProperty(prop) {
+	if (prop.type !== "Property" || prop.computed === true) return false;
+	if (prop.shorthand === true) return false;
+	const key = prop.key;
+	if (key.type !== "Identifier" || key.name !== "setup") return false;
+	return isFunctionValue(prop.value);
+}
+const preferScriptSetupForNewFiles = defineRule({ create(context) {
+	return { ExportDefaultDeclaration(node) {
+		const declaration = node.declaration;
+		if (declaration?.type !== "ObjectExpression") return;
+		if (declaration.properties.some(isSetupProperty)) context.report({
+			node,
+			message: MESSAGE$8
+		});
+	} };
+} });
+//#endregion
+//#region src/rules/vue/performance/prefer-defineAsyncComponent-on-route.ts
+const MESSAGE$7 = `This route record's \`component:\` field references the imported component directly, which forces a synchronous import of the route bundle. Use \`() => import('./Foo.vue')\` or \`defineAsyncComponent(() => import('./Foo.vue'))\` to lazy-load the route. See https://vuejs.org/guide/components/async.html`;
+function keyName(key) {
+	return key.type === "Identifier" ? key.name : key.value;
+}
+const preferDefineAsyncComponentOnRoute = defineRule({ create(context) {
+	return { Property(node) {
+		if (node.computed === true || node.shorthand === true) return;
+		if (keyName(node.key) !== "component") return;
+		if (node.value.type === "Identifier") context.report({
+			node,
+			message: MESSAGE$7
+		});
+	} };
+} });
+//#endregion
+//#region src/rules/vue/reactivity/prefer-readonly-for-injected.ts
+const MESSAGE$6 = `Mutating an injected value from a consumer breaks one-way data flow and makes the source of changes hard to trace. Wrap the provided value in readonly() at the provide site and expose a dedicated mutator instead. See https://vuejs.org/guide/components/provide-inject.html#working-with-reactivity`;
+const MUTATING_METHODS = new Set([
+	"push",
+	"pop",
+	"splice",
+	"shift",
+	"unshift",
+	"sort",
+	"reverse"
+]);
+function calleeName$2(node) {
+	const callee = node.callee;
+	if (callee?.type === "Identifier") return callee.name;
+}
+function memberObjectName(node) {
+	if (!node || node.type !== "MemberExpression") return void 0;
+	const object = node.object;
+	if (object.type !== "Identifier") return void 0;
+	return object.name;
+}
+const preferReadonlyForInjected = defineRule({ create(context) {
+	const injectedSources = /* @__PURE__ */ new Set();
+	return {
+		VariableDeclarator(node) {
+			const id = node.id;
+			const init = node.init;
+			if (id.type === "Identifier" && init?.type === "CallExpression" && calleeName$2(init) === "inject") injectedSources.add(id.name);
+		},
+		AssignmentExpression(node) {
+			const name = memberObjectName(node.left);
+			if (name !== void 0 && injectedSources.has(name)) context.report({
+				node,
+				message: MESSAGE$6
+			});
+		},
+		CallExpression(node) {
+			const callee = node.callee;
+			if (callee?.type !== "MemberExpression" || callee.computed === true) return;
+			const name = memberObjectName(callee);
+			if (name === void 0 || !injectedSources.has(name)) return;
+			const property = callee.property;
+			if (MUTATING_METHODS.has(property.name)) context.report({
+				node,
+				message: MESSAGE$6
+			});
+		}
+	};
+} });
+//#endregion
+//#region src/rules/vue/reactivity/prefer-shallowRef-for-large-data.ts
+const MESSAGE$5 = `This ref holds large or fetched data, so deep reactivity tracks every nested property and wastes memory and CPU. Use shallowRef() (and triggerRef on replacement) for large arrays, big objects, or server payloads. See https://vuejs.org/api/reactivity-advanced.html#shallowref`;
+const ARRAY_LIMIT = 100;
+const OBJECT_LIMIT = 50;
+const FETCH_IDENTIFIERS = new Set(["$fetch", "useFetch"]);
+function calleeName$1(node) {
+	const callee = node.callee;
+	if (callee?.type === "Identifier") return callee.name;
+}
+function isAxiosGet(node) {
+	const callee = node.callee;
+	if (callee?.type !== "MemberExpression" || callee.computed === true) return false;
+	const object = callee.object;
+	const property = callee.property;
+	return object.type === "Identifier" && object.name === "axios" && property.name === "get";
+}
+function isFetchSource(node) {
+	if (node.type !== "CallExpression") return false;
+	const name = calleeName$1(node);
+	if (name !== void 0 && FETCH_IDENTIFIERS.has(name)) return true;
+	return isAxiosGet(node);
+}
+function isLargeData(node) {
+	if (!node) return false;
+	const value = node.type === "AwaitExpression" ? node.argument : node;
+	if (value.type === "ArrayExpression") return value.elements.length > ARRAY_LIMIT;
+	if (value.type === "ObjectExpression") return value.properties.length > OBJECT_LIMIT;
+	return isFetchSource(value);
+}
+const preferShallowRefForLargeData = defineRule({ create(context) {
+	return { CallExpression(node) {
+		if (calleeName$1(node) !== "ref") return;
+		const init = node.arguments[0];
+		if (isLargeData(init)) context.report({
+			node,
+			message: MESSAGE$5
+		});
+	} };
+} });
+//#endregion
+//#region src/rules/vue/reactivity/watch-without-cleanup.ts
+const MESSAGE$4 = `This watcher registers a listener, timer, or observer but never cleans it up, so it leaks across re-runs and hot reloads. Return a cleanup function (or call onWatcherCleanup) inside the watcher. See https://vuejs.org/guide/essentials/watchers.html#side-effect-cleanup`;
+const REGISTER_CALLS = new Set([
+	"addEventListener",
+	"setInterval",
+	"setTimeout"
+]);
+const OBSERVERS = new Set([
+	"IntersectionObserver",
+	"MutationObserver",
+	"ResizeObserver"
+]);
+const CLEANUP_CALLS = new Set(["onCleanup", "onWatcherCleanup"]);
+function calleeIdentifierName(node) {
+	const callee = node.callee;
+	if (callee?.type === "Identifier") return callee.name;
+}
+function calledMethodName(node) {
+	const callee = node.callee;
+	if (callee?.type === "Identifier") return callee.name;
+	if (callee?.type === "MemberExpression" && callee.computed !== true) return callee.property.name;
+}
+function isFunction(node) {
+	return node?.type === "ArrowFunctionExpression" || node?.type === "FunctionExpression";
+}
+const watchWithoutCleanup = defineRule({ create(context) {
+	const watchStack = [];
+	return {
+		CallExpression(node) {
+			const name = calleeIdentifierName(node);
+			if (name === "watch" || name === "watchEffect") {
+				const isEffect = name === "watchEffect";
+				const callback = node.arguments[isEffect ? 0 : 1];
+				if (!isFunction(callback)) return;
+				watchStack.push({
+					sourceCall: node,
+					isEffect,
+					hasRegistration: false,
+					hasCleanup: false
+				});
+				return;
+			}
+			if (watchStack.length === 0) return;
+			const top = watchStack[watchStack.length - 1];
+			const method = calledMethodName(node);
+			if (method !== void 0 && REGISTER_CALLS.has(method)) top.hasRegistration = true;
+			if (method !== void 0 && CLEANUP_CALLS.has(method) && top.isEffect) top.hasCleanup = true;
+		},
+		NewExpression(node) {
+			if (watchStack.length === 0) return;
+			const callee = node.callee;
+			if (callee?.type === "Identifier" && OBSERVERS.has(callee.name)) watchStack[watchStack.length - 1].hasRegistration = true;
+		},
+		ReturnStatement(node) {
+			if (watchStack.length === 0) return;
+			if (isFunction(node.argument)) watchStack[watchStack.length - 1].hasCleanup = true;
+		},
+		"CallExpression:exit"(node) {
+			if (watchStack.length === 0) return;
+			const top = watchStack[watchStack.length - 1];
+			if (top.sourceCall !== node) return;
+			watchStack.pop();
+			if (top.hasRegistration && !top.hasCleanup) context.report({
+				node,
+				message: MESSAGE$4
+			});
+		}
+	};
+} });
+//#endregion
+//#region src/rules/vue/security/no-auth-token-in-web-storage.ts
+const MESSAGE$3 = `Persisting auth tokens/secrets in localStorage or sessionStorage exposes them to any XSS payload. Store them in an HttpOnly, Secure, SameSite cookie set by the server instead. See https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html#local-storage`;
+const STORAGES = new Set(["localStorage", "sessionStorage"]);
+const SENSITIVE_KEY = /token|jwt|secret|password|passwd|credential|api[-_]?key|bearer|private[-_]?key|auth/i;
+function stringValue$1(node) {
+	if (node?.type === "Literal" && typeof node.value === "string") return node.value;
+}
+function isStorageObject(node) {
+	return node?.type === "Identifier" && STORAGES.has(node.name);
+}
+function memberKey(node) {
+	const property = node.property;
+	if (node.computed === true) return stringValue$1(property);
+	return property.name;
+}
+const noAuthTokenInWebStorage = defineRule({ create(context) {
+	return {
+		CallExpression(node) {
+			const callee = node.callee;
+			if (callee.type !== "MemberExpression") return;
+			if (callee.computed === true) return;
+			if (!isStorageObject(callee.object)) return;
+			if (callee.property.name !== "setItem") return;
+			const key = stringValue$1(node.arguments[0]);
+			if (key !== void 0 && SENSITIVE_KEY.test(key)) context.report({
+				node,
+				message: MESSAGE$3
+			});
+		},
+		AssignmentExpression(node) {
+			const left = node.left;
+			if (left.type !== "MemberExpression") return;
+			if (!isStorageObject(left.object)) return;
+			const key = memberKey(left);
+			if (key !== void 0 && SENSITIVE_KEY.test(key)) context.report({
+				node,
+				message: MESSAGE$3
+			});
+		}
+	};
+} });
+//#endregion
+//#region src/rules/vue/security/no-eval-like.ts
+const MESSAGE$2 = `eval, new Function, and string-argument setTimeout/setInterval execute arbitrary code and are XSS/RCE vectors. Replace with explicit logic or JSON.parse for data. See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!`;
+const STRING_TIMER_CALLEES = new Set(["setTimeout", "setInterval"]);
+function calleeName(node) {
+	const callee = node.callee;
+	if (callee?.type === "Identifier") return callee.name;
+}
+function isStringArg(node) {
+	if (!node) return false;
+	if (node.type === "Literal") return typeof node.value === "string";
+	return node.type === "TemplateLiteral";
+}
+const noEvalLike = defineRule({ create(context) {
+	return {
+		CallExpression(node) {
+			const name = calleeName(node);
+			if (name === void 0) return;
+			if (name === "eval") {
+				context.report({
+					node,
+					message: MESSAGE$2
+				});
+				return;
+			}
+			if (STRING_TIMER_CALLEES.has(name)) {
+				const args = node.arguments;
+				if (isStringArg(args?.[0])) context.report({
+					node,
+					message: MESSAGE$2
+				});
+			}
+		},
+		NewExpression(node) {
+			const callee = node.callee;
+			if (callee?.type === "Identifier" && callee.name === "Function") context.report({
+				node,
+				message: MESSAGE$2
+			});
+		}
+	};
+} });
+//#endregion
+//#region src/rules/vue/security/no-inner-html.ts
+const MESSAGE$1 = `Assigning to innerHTML/outerHTML injects unsanitized markup and is a DOM-based XSS sink. Use textContent for text, or sanitize with DOMPurify before assigning. See https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML#security_considerations`;
+const HTML_SINKS = new Set(["innerHTML", "outerHTML"]);
+function isHtmlSinkTarget(node) {
+	if (node.type !== "MemberExpression") return false;
+	if (node.computed === true) return false;
+	const property = node.property;
+	return property.type === "Identifier" && HTML_SINKS.has(property.name);
+}
+const noInnerHtml = defineRule({ create(context) {
+	return { AssignmentExpression(node) {
+		if (!isHtmlSinkTarget(node.left)) return;
+		context.report({
+			node,
+			message: MESSAGE$1
+		});
+	} };
+} });
+//#endregion
+//#region src/rules/vue/security/no-secrets-in-source.ts
+const MESSAGE = `Hardcoded secret in source. Committed secrets leak in the client bundle and git history. Move it to an environment variable or a server-only runtime config. See https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html`;
+const SECRET_VALUE_PATTERNS = [
+	/\bsk-[A-Za-z0-9-]{10,}\b/,
+	/\bghp_[A-Za-z0-9]{20,}\b/,
+	/\bgithub_pat_[A-Za-z0-9_]{20,}\b/,
+	/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/,
+	/\bAKIA[0-9A-Z]{16}\b/,
+	/\bAIza[0-9A-Za-z_-]{20,}\b/
+];
+const SECRET_NAME = /^(api[-_]?secret|api[-_]?key|secret[-_]?key|private[-_]?key|access[-_]?token|auth[-_]?token|client[-_]?secret|password|passwd|jwt[-_]?secret)$/i;
+const MIN_NAMED_SECRET_LENGTH = 8;
+function stringValue(node) {
+	if (node?.type === "Literal" && typeof node.value === "string") return node.value;
+}
+function isHighSignalSecret(value) {
+	return SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value));
+}
+const noSecretsInSource = defineRule({ create(context) {
+	const reported = /* @__PURE__ */ new Set();
+	function report(node) {
+		if (reported.has(node)) return;
+		reported.add(node);
+		context.report({
+			node,
+			message: MESSAGE
+		});
+	}
+	function checkNamedAssignment(name, valueNode) {
+		if (name === void 0 || !SECRET_NAME.test(name)) return;
+		if (!valueNode) return;
+		const value = stringValue(valueNode);
+		if (value === void 0 || value.length < MIN_NAMED_SECRET_LENGTH) return;
+		report(valueNode);
+	}
+	return {
+		Literal(node) {
+			if (typeof node.value !== "string") return;
+			if (isHighSignalSecret(node.value)) report(node);
+		},
+		VariableDeclarator(node) {
+			const id = node.id;
+			if (id.type !== "Identifier") return;
+			checkNamedAssignment(id.name, node.init);
+		},
+		Property(node) {
+			const key = node.key;
+			checkNamedAssignment(key.type === "Identifier" ? key.name : stringValue(key), node.value);
+		}
+	};
+} });
+//#endregion
+//#region src/rules/vue/index.ts
+function coreRule(id, category, severity, recommended, rule) {
+	return {
+		id,
+		category,
+		severity,
+		recommended,
+		...rule
+	};
+}
+const VUE_RULES = [
+	coreRule("no-em-dash-in-string", "ai-slop", "warn", true, defineRule(noEmDashInString)),
+	coreRule("no-destructure-props-without-to-refs", "ai-slop", "error", true, defineRule(noDestructurePropsWithoutToRefs)),
+	coreRule("no-destructure-reactive-without-to-refs", "ai-slop", "error", true, defineRule(noDestructureReactiveWithoutToRefs)),
+	coreRule("no-non-null-assertion-on-ref-value", "ai-slop", "warn", true, defineRule(noNonNullAssertionOnRefValue)),
+	coreRule("no-imports-from-vue-when-auto-imported", "ai-slop", "warn", true, defineRule(noImportsFromVueWhenAutoImported)),
+	coreRule("reactivity/watch-without-cleanup", "reactivity", "warn", true, defineRule(watchWithoutCleanup)),
+	coreRule("reactivity/prefer-shallowRef-for-large-data", "reactivity", "info", false, defineRule(preferShallowRefForLargeData)),
+	coreRule("reactivity/prefer-readonly-for-injected", "reactivity", "info", false, defineRule(preferReadonlyForInjected)),
+	coreRule("composition/prefer-script-setup-for-new-files", "composition", "warn", true, defineRule(preferScriptSetupForNewFiles)),
+	coreRule("composition/defineProps-typed", "composition", "warn", true, defineRule(definePropsTyped)),
+	coreRule("performance/prefer-defineAsyncComponent-on-route", "performance", "info", false, defineRule(preferDefineAsyncComponentOnRoute)),
+	coreRule("security/no-inner-html", "security", "error", true, defineRule(noInnerHtml)),
+	coreRule("security/no-eval-like", "security", "error", true, defineRule(noEvalLike)),
+	coreRule("security/no-auth-token-in-web-storage", "security", "warn", true, defineRule(noAuthTokenInWebStorage)),
+	coreRule("security/no-secrets-in-source", "security", "warn", true, defineRule(noSecretsInSource))
+];
+//#endregion
+export { NUXT_AUTO_IMPORTED, NUXT_RULES, VUE_AUTO_IMPORTED, VUE_RULES, clientOnlyForBrowserApis, createErrorOnFailure, defineEventHandlerTyped, definePropsTyped, defineRule, noAuthTokenInWebStorage, noDestructurePropsWithoutToRefs, noDestructureReactiveWithoutToRefs, noDocumentInSetup, noEmDashInString, noEvalLike, noExplicitImportsOfAutoImported, noFetchInSetup, noImportsFromVueWhenAutoImported, noInnerHtml, noNonNullAssertionOnRefValue, noProcessClientServer, noSecretsInSource, noUseStateForServerData, noUserInputInFetchUrl, preferDefineAsyncComponentOnRoute, preferReadonlyForInjected, preferScriptSetupForNewFiles, preferShallowRefForLargeData, useAsyncDataKeyRequiredInLoop, validateBodyWithH3V2, watchWithoutCleanup };
+
+//# sourceMappingURL=index.js.map