@geoql/doctor-rule-core 1.2.2 → 1.3.0

package/dist/index.js

@@ -133,7 +133,7 @@ const noExplicitImportsOfAutoImported = defineRule({ create(context) {
 } });
 //#endregion
 //#region src/rules/nuxt/ai-slop/no-fetch-in-setup.ts
-const MESSAGE$27 = `Bare $fetch/fetch at the top level of <script setup> runs on both server and client without SSR deduplication. Use useFetch for automatic request deduplication and SSR hydration. See https://nuxt.com/docs/4.x/guide/data-fetching`;
+const MESSAGE$31 = `Bare $fetch/fetch at the top level of <script setup> runs on both server and client without SSR deduplication. Use useFetch for automatic request deduplication and SSR hydration. See https://nuxt.com/docs/4.x/guide/data-fetching`;
 function isFetchCall(node) {
 	if (!node || node.type !== "CallExpression") return false;
 	const callee = node.callee;
@@ -170,7 +170,7 @@ const noFetchInSetup = defineRule({ create(context) {
 			if (node["parent"]?.type === "AwaitExpression") return;
 			context.report({
 				node,
-				message: MESSAGE$27
+				message: MESSAGE$31
 			});
 		},
 		AwaitExpression(node) {
@@ -178,7 +178,7 @@ const noFetchInSetup = defineRule({ create(context) {
 			if (!isFetchCall(node.argument)) return;
 			context.report({
 				node,
-				message: MESSAGE$27
+				message: MESSAGE$31
 			});
 		}
 	};
@@ -190,7 +190,7 @@ const LEGACY_PROPS = /* @__PURE__ */ new Set([
 	"server",
 	"browser"
 ]);
-const MESSAGE$26 = `Use import.meta.client / import.meta.server / import.meta.browser instead of process.client / process.server / process.browser (Nuxt 4). See https://nuxt.com/docs/4.x/guide/concepts/auto-imports`;
+const MESSAGE$30 = `Use import.meta.client / import.meta.server / import.meta.browser instead of process.client / process.server / process.browser (Nuxt 4). See https://nuxt.com/docs/4.x/guide/concepts/auto-imports`;
 const noProcessClientServer = defineRule({
 	create(context) {
 		return { MemberExpression(node) {
@@ -202,7 +202,7 @@ const noProcessClientServer = defineRule({
 			if (!LEGACY_PROPS.has(property.name)) return;
 			context.report({
 				node,
-				message: MESSAGE$26
+				message: MESSAGE$30
 			});
 		} };
 	},
@@ -219,7 +219,7 @@ const noProcessClientServer = defineRule({
 });
 //#endregion
 //#region src/rules/nuxt/ai-slop/no-useState-for-server-data.ts
-const MESSAGE$25 = `useState with a fetch/await initializer suggests useFetch or useAsyncData for automatic SSR hydration and request deduplication. See https://nuxt.com/docs/4.x/guide/data-fetching`;
+const MESSAGE$29 = `useState with a fetch/await initializer suggests useFetch or useAsyncData for automatic SSR hydration and request deduplication. See https://nuxt.com/docs/4.x/guide/data-fetching`;
 function containsFetchOrAwait(node, visited) {
 	if (!node || visited.has(node)) return false;
 	visited.add(node);
@@ -256,13 +256,13 @@ const noUseStateForServerData = defineRule({ create(context) {
 		if (!containsFetchOrAwait(initFn.body, /* @__PURE__ */ new Set())) return;
 		context.report({
 			node,
-			message: MESSAGE$25
+			message: MESSAGE$29
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/nuxt/data-fetching/useAsyncData-key-required-in-loop.ts
-const MESSAGE$24 = `useAsyncData/useFetch without an explicit string key inside a loop causes duplicate requests and cache fragmentation. Pass a unique string key as the first argument. See https://nuxt.com/docs/4.x/guide/data-fetching`;
+const MESSAGE$28 = `useAsyncData/useFetch without an explicit string key inside a loop causes duplicate requests and cache fragmentation. Pass a unique string key as the first argument. See https://nuxt.com/docs/4.x/guide/data-fetching`;
 const DATA_FETCHERS = /* @__PURE__ */ new Set(["useAsyncData", "useFetch"]);
 function isMapCall(node) {
 	const callee = node.callee;
@@ -315,7 +315,7 @@ const useAsyncDataKeyRequiredInLoop = defineRule({ create(context) {
 			if (firstArg.type === "Literal" && typeof firstArg.value === "string") return;
 			context.report({
 				node,
-				message: MESSAGE$24
+				message: MESSAGE$28
 			});
 		},
 		"CallExpression:exit"(node) {
@@ -325,7 +325,7 @@ const useAsyncDataKeyRequiredInLoop = defineRule({ create(context) {
 } });
 //#endregion
 //#region src/rules/nuxt/security/no-user-input-in-fetch-url.ts
-const MESSAGE$23 = `Building a useFetch/$fetch URL from user input (route.query/route.params) lets an attacker control the request target — an SSRF risk during SSR. Use a fixed path and pass user input via the query/body options instead. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery`;
+const MESSAGE$27 = `Building a useFetch/$fetch URL from user input (route.query/route.params) lets an attacker control the request target — an SSRF risk during SSR. Use a fixed path and pass user input via the query/body options instead. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery`;
 const FETCH_CALLEES = /* @__PURE__ */ new Set([
 	"useFetch",
 	"useLazyFetch",
@@ -363,14 +363,14 @@ const noUserInputInFetchUrl = defineRule({ create(context) {
 		const urlArg = node.arguments[0];
 		if (urlArgIsTainted(urlArg)) context.report({
 			node,
-			message: MESSAGE$23
+			message: MESSAGE$27
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/nuxt/hydration/clientOnly-for-browser-apis.ts
-const MESSAGE$22 = `Accessing window./document./navigator./localStorage./sessionStorage. without an import.meta.client or process.client guard causes SSR failures. Wrap with if (import.meta.client) { ... } or move to onMounted. See https://nuxt.com/docs/4.x/guide/components`;
-const BROWSER_GLOBALS = /* @__PURE__ */ new Set([
+const MESSAGE$26 = `Accessing window./document./navigator./localStorage./sessionStorage. without an import.meta.client or process.client guard causes SSR failures. Wrap with if (import.meta.client) { ... } or move to onMounted. See https://nuxt.com/docs/4.x/guide/components`;
+const BROWSER_GLOBALS$1 = /* @__PURE__ */ new Set([
 	"window",
 	"document",
 	"navigator",
@@ -437,17 +437,78 @@ const clientOnlyForBrowserApis = defineRule({ create(context) {
 			if (isGuarded) return;
 			const obj = node.object;
 			if (obj?.type !== "Identifier") return;
-			if (!BROWSER_GLOBALS.has(obj.name)) return;
+			if (!BROWSER_GLOBALS$1.has(obj.name)) return;
 			context.report({
 				node,
-				message: MESSAGE$22
+				message: MESSAGE$26
+			});
+		}
+	};
+} });
+//#endregion
+//#region src/rules/nuxt/hydration/no-browser-global-in-computed.ts
+const MESSAGE$25 = `Reading a browser global inside a computed getter runs during SSR (computeds evaluate on the server render) and throws or hydration-mismatches. Guard with import.meta.client or derive the value in onMounted. See https://nuxt.com/docs/4.x/getting-started/data-fetching`;
+const BROWSER_GLOBALS = /* @__PURE__ */ new Set([
+	"window",
+	"document",
+	"navigator",
+	"localStorage",
+	"sessionStorage"
+]);
+function calleeIdentifierName$3(node) {
+	const callee = node.callee;
+	if (callee?.type === "Identifier") return callee.name;
+}
+function isImportMetaClient(node) {
+	if (node.type !== "MemberExpression") return false;
+	if (node.object?.type !== "MetaProperty") return false;
+	const property = node.property;
+	return property?.type === "Identifier" && property.name === "client";
+}
+const noBrowserGlobalInComputed = defineRule({ create(context) {
+	const computedStack = [];
+	return {
+		CallExpression(node) {
+			if (calleeIdentifierName$3(node) === "computed") computedStack.push({
+				sourceCall: node,
+				guardDepth: 0
+			});
+		},
+		"CallExpression:exit"(node) {
+			if (computedStack[computedStack.length - 1]?.sourceCall === node) computedStack.pop();
+		},
+		IfStatement(node) {
+			const top = computedStack[computedStack.length - 1];
+			if (top && isImportMetaClient(node.test)) top.guardDepth += 1;
+		},
+		"IfStatement:exit"(node) {
+			const top = computedStack[computedStack.length - 1];
+			if (top && isImportMetaClient(node.test)) top.guardDepth -= 1;
+		},
+		ConditionalExpression(node) {
+			const top = computedStack[computedStack.length - 1];
+			if (top && isImportMetaClient(node.test)) top.guardDepth += 1;
+		},
+		"ConditionalExpression:exit"(node) {
+			const top = computedStack[computedStack.length - 1];
+			if (top && isImportMetaClient(node.test)) top.guardDepth -= 1;
+		},
+		MemberExpression(node) {
+			const top = computedStack[computedStack.length - 1];
+			if (!top || top.guardDepth > 0) return;
+			const object = node.object;
+			if (object?.type !== "Identifier") return;
+			if (!BROWSER_GLOBALS.has(object.name)) return;
+			context.report({
+				node,
+				message: MESSAGE$25
 			});
 		}
 	};
 } });
 //#endregion
 //#region src/rules/nuxt/hydration/no-document-in-setup.ts
-const MESSAGE$21 = `Accessing document/window/navigator/localStorage at the top level of <script setup> causes a server-side crash (SSR). These browser globals are undefined on the server. Move access inside onMounted or guard with import.meta.client. See https://nuxt.com/docs/4.x/guide/components`;
+const MESSAGE$24 = `Accessing document/window/navigator/localStorage at the top level of <script setup> causes a server-side crash (SSR). These browser globals are undefined on the server. Move access inside onMounted or guard with import.meta.client. See https://nuxt.com/docs/4.x/guide/components`;
 const SSR_UNSAFE_GLOBALS = /* @__PURE__ */ new Set([
 	"document",
 	"window",
@@ -527,14 +588,14 @@ const noDocumentInSetup = defineRule({ create(context) {
 			if (isGuardedByImportMetaClient(node)) return;
 			context.report({
 				node,
-				message: MESSAGE$21
+				message: MESSAGE$24
 			});
 		}
 	};
 } });
 //#endregion
 //#region src/rules/nuxt/server-routes/createError-on-failure.ts
-const MESSAGE$20 = `throw new Error() leaks the call stack and exposes internal details. Use throw createError() from h3 for proper HTTP errors with no stack leak. See https://h3.unjs.io/guide/throw`;
+const MESSAGE$23 = `throw new Error() leaks the call stack and exposes internal details. Use throw createError() from h3 for proper HTTP errors with no stack leak. See https://h3.unjs.io/guide/throw`;
 const createErrorOnFailure = defineRule({ create(context) {
 	let handlerDepth = 0;
 	return {
@@ -559,14 +620,14 @@ const createErrorOnFailure = defineRule({ create(context) {
 			if (ctor.name !== "Error") return;
 			context.report({
 				node,
-				message: MESSAGE$20
+				message: MESSAGE$23
 			});
 		}
 	};
 } });
 //#endregion
 //#region src/rules/nuxt/server-routes/defineEventHandler-typed.ts
-const MESSAGE$19 = `defineEventHandler handler param event lacks a type annotation. Add a generic: defineEventHandler<H3Event>(...) or type the event parameter explicitly. See https://h3.unjs.io/guide/typed`;
+const MESSAGE$22 = `defineEventHandler handler param event lacks a type annotation. Add a generic: defineEventHandler<H3Event>(...) or type the event parameter explicitly. See https://h3.unjs.io/guide/typed`;
 function isFunction$2(node) {
 	return node?.type === "ArrowFunctionExpression" || node?.type === "FunctionExpression";
 }
@@ -585,13 +646,13 @@ const defineEventHandlerTyped = defineRule({ create(context) {
 		if (params[0].typeAnnotation) return;
 		context.report({
 			node,
-			message: MESSAGE$19
+			message: MESSAGE$22
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/nuxt/server-routes/validate-body-with-h3-v2.ts
-const MESSAGE$18 = `readBody() is the legacy H3 reader. In Nuxt 4 with h3 v2, use readValidatedBody to parse and validate the request body in one step. See https://nuxt.com/docs/4.x/guide/data-fetching`;
+const MESSAGE$21 = `readBody() is the legacy H3 reader. In Nuxt 4 with h3 v2, use readValidatedBody to parse and validate the request body in one step. See https://nuxt.com/docs/4.x/guide/data-fetching`;
 const validateBodyWithH3V2 = defineRule({ create(context) {
 	return { CallExpression(node) {
 		const callee = node.callee;
@@ -599,7 +660,7 @@ const validateBodyWithH3V2 = defineRule({ create(context) {
 		if (callee.name !== "readBody") return;
 		context.report({
 			node,
-			message: MESSAGE$18
+			message: MESSAGE$21
 		});
 	} };
 } });
@@ -624,12 +685,13 @@ const NUXT_RULES = [
 	coreRule$1("server-routes/validate-body-with-h3-v2", "server-routes", "warn", true, defineRule(validateBodyWithH3V2)),
 	coreRule$1("server-routes/createError-on-failure", "server-routes", "warn", true, defineRule(createErrorOnFailure)),
 	coreRule$1("hydration/no-document-in-setup", "hydration", "error", true, defineRule(noDocumentInSetup)),
+	coreRule$1("hydration/no-browser-global-in-computed", "hydration", "error", true, defineRule(noBrowserGlobalInComputed)),
 	coreRule$1("hydration/clientOnly-for-browser-apis", "hydration", "error", true, defineRule(clientOnlyForBrowserApis)),
 	coreRule$1("security/no-user-input-in-fetch-url", "security", "warn", true, defineRule(noUserInputInFetchUrl))
 ];
 //#endregion
 //#region src/rules/vue/ai-slop/no-destructure-props-without-toRefs.ts
-const MESSAGE$17 = `Destructuring props loses reactivity. Wrap with toRefs(...) to keep refs. See https://vuejs.org/guide/components/props.html#reactive-props-destructure`;
+const MESSAGE$20 = `Destructuring props loses reactivity. Wrap with toRefs(...) to keep refs. See https://vuejs.org/guide/components/props.html#reactive-props-destructure`;
 function calleeName$6(node) {
 	const callee = node.callee;
 	if (callee?.type === "Identifier") return callee.name;
@@ -685,7 +747,7 @@ const noDestructurePropsWithoutToRefs = defineRule({ create(context) {
 			if (isToRefsCall$1(init)) return;
 			if ((isDefinePropsCall(init) || init.type === "Identifier" && propsSources.has(init.name)) && isOneTimeContext()) context.report({
 				node,
-				message: MESSAGE$17
+				message: MESSAGE$20
 			});
 		},
 		Property(node) {
@@ -700,7 +762,7 @@ const noDestructurePropsWithoutToRefs = defineRule({ create(context) {
 } });
 //#endregion
 //#region src/rules/vue/ai-slop/no-destructure-reactive-without-toRefs.ts
-const MESSAGE$16 = `Destructuring reactive state loses reactivity. Wrap with toRefs(...) or read single keys via toRef(state, 'key'). See https://vuejs.org/guide/essentials/reactivity-fundamentals.html#destructuring-reactive-state`;
+const MESSAGE$19 = `Destructuring reactive state loses reactivity. Wrap with toRefs(...) or read single keys via toRef(state, 'key'). See https://vuejs.org/guide/essentials/reactivity-fundamentals.html#destructuring-reactive-state`;
 const REACTIVE_FACTORIES = /* @__PURE__ */ new Set(["reactive", "shallowReactive"]);
 function calleeName$5(node) {
 	const callee = node.callee;
@@ -732,7 +794,7 @@ const noDestructureReactiveWithoutToRefs = defineRule({ create(context) {
 		if (isToRefsCall(init)) return;
 		if (isReactiveCall(init) || init.type === "Identifier" && reactiveSources.has(init.name)) context.report({
 			node,
-			message: MESSAGE$16
+			message: MESSAGE$19
 		});
 	} };
 } });
@@ -801,7 +863,7 @@ const noImportsFromVueWhenAutoImported = defineRule({ create(context) {
 } });
 //#endregion
 //#region src/rules/vue/ai-slop/no-non-null-assertion-on-ref-value.ts
-const MESSAGE$15 = `Non-null assertion on a ref's .value hides nullability. Add an explicit guard ('if (!r.value) return') or use optional chaining ('r.value?.x'). See https://vuejs.org/guide/typescript/composition-api.html#typing-ref`;
+const MESSAGE$18 = `Non-null assertion on a ref's .value hides nullability. Add an explicit guard ('if (!r.value) return') or use optional chaining ('r.value?.x'). See https://vuejs.org/guide/typescript/composition-api.html#typing-ref`;
 const REF_FACTORIES = /* @__PURE__ */ new Set([
 	"ref",
 	"shallowRef",
@@ -838,14 +900,14 @@ const noNonNullAssertionOnRefValue = defineRule({ create(context) {
 			if (!refSources.has(object.name)) return;
 			context.report({
 				node,
-				message: MESSAGE$15
+				message: MESSAGE$18
 			});
 		}
 	};
 } });
 //#endregion
 //#region src/rules/vue/composition/defineProps-typed.ts
-const MESSAGE$14 = `This defineProps() call declares props with a runtime object, which discards static type information. Use the type-only generic form (defineProps<{ ... }>()) so props are fully typed. See https://vuejs.org/guide/typescript/composition-api.html#typing-component-props`;
+const MESSAGE$17 = `This defineProps() call declares props with a runtime object, which discards static type information. Use the type-only generic form (defineProps<{ ... }>()) so props are fully typed. See https://vuejs.org/guide/typescript/composition-api.html#typing-component-props`;
 function calleeName$3(node) {
 	const callee = node.callee;
 	if (callee?.type === "Identifier") return callee.name;
@@ -855,13 +917,13 @@ const definePropsTyped = defineRule({ create(context) {
 		if (calleeName$3(node) !== "defineProps") return;
 		if (node.arguments[0]?.type === "ObjectExpression") context.report({
 			node,
-			message: MESSAGE$14
+			message: MESSAGE$17
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/vue/composition/no-pinia-store-in-setup.ts
-const MESSAGE$13 = `This calls defineStore() inside a function (setup, a composable, or a component body), so a brand-new store definition is created on every call instead of one shared singleton. Call defineStore() once at module scope and call the returned useXxxStore() inside setup. See https://pinia.vuejs.org/core-concepts/#defining-a-store`;
+const MESSAGE$16 = `This calls defineStore() inside a function (setup, a composable, or a component body), so a brand-new store definition is created on every call instead of one shared singleton. Call defineStore() once at module scope and call the returned useXxxStore() inside setup. See https://pinia.vuejs.org/core-concepts/#defining-a-store`;
 const noPiniaStoreInSetup = defineRule({ create(context) {
 	let functionDepth = 0;
 	const enter = () => {
@@ -876,7 +938,7 @@ const noPiniaStoreInSetup = defineRule({ create(context) {
 			if (callee?.type !== "Identifier" || callee.name !== "defineStore") return;
 			if (functionDepth > 0) context.report({
 				node,
-				message: MESSAGE$13
+				message: MESSAGE$16
 			});
 		},
 		FunctionDeclaration: enter,
@@ -888,8 +950,68 @@ const noPiniaStoreInSetup = defineRule({ create(context) {
 	};
 } });
 //#endregion
+//#region src/rules/vue/composition/no-prop-callback-in-setup.ts
+const MESSAGE$15 = `Calling a parent callback prop during setup or inside a computed getter runs a side effect on the render path — it fires on every re-evaluation and during SSR. Move the call into an event handler, watcher, or lifecycle hook. See https://vuejs.org/guide/components/events.html`;
+const CALLBACK_NAME = /^on[A-Z]/;
+function calleeIdentifierName$2(node) {
+	const callee = node.callee;
+	if (callee?.type === "Identifier") return callee.name;
+}
+function isComputedGetter(fn) {
+	const parent = fn.parent;
+	if (parent?.type !== "CallExpression") return false;
+	return calleeIdentifierName$2(parent) === "computed";
+}
+function definePropsBinding(node) {
+	let call = node.init;
+	if (call?.type === "CallExpression" && calleeIdentifierName$2(call) === "withDefaults") call = call.arguments[0];
+	if (call?.type !== "CallExpression" || calleeIdentifierName$2(call) !== "defineProps") return;
+	const id = node.id;
+	if (id?.type !== "Identifier") return void 0;
+	return id.name;
+}
+const noPropCallbackInSetup = defineRule({ create(context) {
+	const propsNames = /* @__PURE__ */ new Set();
+	const functionStack = [];
+	const enterFunction = (node) => {
+		functionStack.push({
+			node,
+			isComputedGetter: isComputedGetter(node)
+		});
+	};
+	const exitFunction = () => {
+		functionStack.pop();
+	};
+	return {
+		VariableDeclarator(node) {
+			const name = definePropsBinding(node);
+			if (name !== void 0) propsNames.add(name);
+		},
+		FunctionDeclaration: enterFunction,
+		"FunctionDeclaration:exit": exitFunction,
+		FunctionExpression: enterFunction,
+		"FunctionExpression:exit": exitFunction,
+		ArrowFunctionExpression: enterFunction,
+		"ArrowFunctionExpression:exit": exitFunction,
+		CallExpression(node) {
+			const callee = node.callee;
+			if (callee?.type !== "MemberExpression" || callee.computed === true) return;
+			const object = callee.object;
+			const property = callee.property;
+			if (object?.type !== "Identifier" || property?.type !== "Identifier") return;
+			if (!propsNames.has(object.name)) return;
+			if (!CALLBACK_NAME.test(property.name)) return;
+			const enclosing = functionStack[functionStack.length - 1];
+			if (enclosing === void 0 || enclosing.isComputedGetter) context.report({
+				node,
+				message: MESSAGE$15
+			});
+		}
+	};
+} });
+//#endregion
 //#region src/rules/vue/composition/prefer-script-setup-for-new-files.ts
-const MESSAGE$12 = `This component nests composition-API logic inside an options-object setup(). Use a <script setup> block instead — it removes the setup() boilerplate and exposes bindings to the template directly. See https://vuejs.org/api/sfc-script-setup.html`;
+const MESSAGE$14 = `This component nests composition-API logic inside an options-object setup(). Use a <script setup> block instead — it removes the setup() boilerplate and exposes bindings to the template directly. See https://vuejs.org/api/sfc-script-setup.html`;
 function isFunctionValue(node) {
 	return node?.type === "ArrowFunctionExpression" || node?.type === "FunctionExpression";
 }
@@ -906,13 +1028,13 @@ const preferScriptSetupForNewFiles = defineRule({ create(context) {
 		if (declaration?.type !== "ObjectExpression") return;
 		if (declaration.properties.some(isSetupProperty)) context.report({
 			node,
-			message: MESSAGE$12
+			message: MESSAGE$14
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/vue/performance/prefer-defineAsyncComponent-on-route.ts
-const MESSAGE$11 = `This route record's \`component:\` field references the imported component directly, which forces a synchronous import of the route bundle. Use \`() => import('./Foo.vue')\` or \`defineAsyncComponent(() => import('./Foo.vue'))\` to lazy-load the route. See https://vuejs.org/guide/components/async.html`;
+const MESSAGE$13 = `This route record's \`component:\` field references the imported component directly, which forces a synchronous import of the route bundle. Use \`() => import('./Foo.vue')\` or \`defineAsyncComponent(() => import('./Foo.vue'))\` to lazy-load the route. See https://vuejs.org/guide/components/async.html`;
 function keyName(key) {
 	return key.type === "Identifier" ? key.name : key.value;
 }
@@ -922,13 +1044,13 @@ const preferDefineAsyncComponentOnRoute = defineRule({ create(context) {
 		if (keyName(node.key) !== "component") return;
 		if (node.value.type === "Identifier") context.report({
 			node,
-			message: MESSAGE$11
+			message: MESSAGE$13
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/vue/performance/prefer-module-scope-pure-function.ts
-const MESSAGE$10 = `This helper closes over nothing reactive (only its parameters, imports, and globals), yet it is re-created on every call of the enclosing function. Hoist it to module scope so a single function reference is shared across all component instances. See https://vuejs.org/guide/best-practices/performance.html`;
+const MESSAGE$12 = `This helper closes over nothing reactive (only its parameters, imports, and globals), yet it is re-created on every call of the enclosing function. Hoist it to module scope so a single function reference is shared across all component instances. See https://vuejs.org/guide/best-practices/performance.html`;
 const GLOBALS = /* @__PURE__ */ new Set([
 	"console",
 	"Math",
@@ -1056,7 +1178,7 @@ const preferModuleScopePureFunction = defineRule({ create(context) {
 		if (functionDepth < 1) return;
 		if (isHoistable(fn, imports)) context.report({
 			node: fn,
-			message: MESSAGE$10
+			message: MESSAGE$12
 		});
 	};
 	return {
@@ -1074,7 +1196,7 @@ const preferModuleScopePureFunction = defineRule({ create(context) {
 				if (init?.type === "ArrowFunctionExpression" || init?.type === "FunctionExpression") {
 					if (isHoistable(init, imports)) context.report({
 						node: init,
-						message: MESSAGE$10
+						message: MESSAGE$12
 					});
 				}
 			}
@@ -1094,7 +1216,7 @@ const preferModuleScopePureFunction = defineRule({ create(context) {
 } });
 //#endregion
 //#region src/rules/vue/performance/prefer-module-scope-static-value.ts
-const MESSAGE$9 = `This static array or object literal is declared inside a function, so a fresh copy is allocated on every call (including every component instantiation). Hoist it to module scope so the single frozen reference is shared. See https://vuejs.org/guide/best-practices/performance.html`;
+const MESSAGE$11 = `This static array or object literal is declared inside a function, so a fresh copy is allocated on every call (including every component instantiation). Hoist it to module scope so the single frozen reference is shared. See https://vuejs.org/guide/best-practices/performance.html`;
 const LITERAL_TYPES = /* @__PURE__ */ new Set([
 	"Literal",
 	"StringLiteral",
@@ -1159,14 +1281,14 @@ const preferModuleScopeStaticValue = defineRule({ create(context) {
 			if (!isStaticLiteral(init)) return;
 			context.report({
 				node: init,
-				message: MESSAGE$9
+				message: MESSAGE$11
 			});
 		}
 	};
 } });
 //#endregion
 //#region src/rules/vue/performance/prefer-stable-empty-fallback.ts
-const MESSAGE$8 = `This computed falls back to a fresh empty array or object literal, so it returns a brand-new reference whenever the source is nullish. Downstream watchers, child props, and v-memo see an identity change every recompute. Hoist a single module-scope EMPTY constant and fall back to that. See https://vuejs.org/guide/best-practices/performance.html`;
+const MESSAGE$10 = `This computed falls back to a fresh empty array or object literal, so it returns a brand-new reference whenever the source is nullish. Downstream watchers, child props, and v-memo see an identity change every recompute. Hoist a single module-scope EMPTY constant and fall back to that. See https://vuejs.org/guide/best-practices/performance.html`;
 function isEmptyLiteral(node) {
 	if (node?.type === "ArrayExpression") return node.elements.length === 0;
 	if (node?.type === "ObjectExpression") return node.properties.length === 0;
@@ -1196,13 +1318,114 @@ const preferStableEmptyFallback = defineRule({ create(context) {
 		const returned = getterBody(node);
 		if (returned && fallsBackToEmptyLiteral(returned)) context.report({
 			node: returned,
-			message: MESSAGE$8
+			message: MESSAGE$10
 		});
 	} };
 } });
 //#endregion
+//#region src/rules/vue/reactivity/effect-listener-cleanup-mismatch.ts
+const MESSAGE$9 = `This cleanup cannot detach the listener it pairs with: removeEventListener only removes when the handler reference AND capture flag match addEventListener exactly. Use the same named handler (never an inline arrow) and the same capture flag. See https://vuejs.org/guide/essentials/watchers.html#side-effect-cleanup`;
+const EFFECT_CALLS = /* @__PURE__ */ new Set([
+	"watch",
+	"watchEffect",
+	"onMounted",
+	"onBeforeUnmount",
+	"onUnmounted"
+]);
+function calleeIdentifierName$1(node) {
+	const callee = node.callee;
+	if (callee?.type === "Identifier") return callee.name;
+}
+function calledMethodName$1(node) {
+	const callee = node.callee;
+	if (callee?.type === "MemberExpression" && callee.computed !== true) return callee.property.name;
+}
+function literalString(node) {
+	if (node?.type === "Literal" && typeof node.value === "string") return node.value;
+}
+function handlerKey(node) {
+	if (node?.type === "Identifier") return node.name;
+	if (node?.type === "MemberExpression" && node.computed !== true) {
+		const object = handlerKey(node.object);
+		if (object === void 0) return void 0;
+		return `${object}.${node.property.name}`;
+	}
+}
+function captureKey(node) {
+	if (node === void 0) return "false";
+	if (node.type === "Literal") return String(node.value);
+	if (node.type === "ObjectExpression") {
+		const props = node.properties;
+		for (const prop of props) {
+			const key = prop.key;
+			if (key?.type === "Identifier" && key.name === "capture") return String(prop.value?.value ?? "unknown");
+		}
+		return "false";
+	}
+	return "unknown";
+}
+function toRecord(node) {
+	const args = node.arguments;
+	const event = literalString(args[0]);
+	if (event === void 0) return void 0;
+	return {
+		event,
+		handlerKey: handlerKey(args[1]),
+		capture: captureKey(args[2]),
+		node
+	};
+}
+function reportMismatches(context, frame) {
+	for (const removed of frame.removed) {
+		const pairable = frame.added.filter((a) => a.event === removed.event);
+		if (pairable.length === 0) continue;
+		if (!pairable.some((a) => a.handlerKey !== void 0 && a.handlerKey === removed.handlerKey && a.capture === removed.capture)) context.report({
+			node: removed.node,
+			message: MESSAGE$9
+		});
+	}
+}
+const effectListenerCleanupMismatch = defineRule({ create(context) {
+	const stack = [];
+	return {
+		CallExpression(node) {
+			const name = calleeIdentifierName$1(node);
+			if (name !== void 0 && EFFECT_CALLS.has(name)) {
+				stack.push({
+					sourceCall: node,
+					added: [],
+					removed: []
+				});
+				return;
+			}
+			if (stack.length === 0) return;
+			const method = calledMethodName$1(node);
+			if (method === "addEventListener") {
+				const record = toRecord(node);
+				if (record) stack[stack.length - 1].added.push(record);
+			} else if (method === "removeEventListener") {
+				const record = toRecord(node);
+				if (record) stack[stack.length - 1].removed.push(record);
+			}
+		},
+		"CallExpression:exit"(node) {
+			if (stack.length === 0) return;
+			const top = stack[stack.length - 1];
+			if (top.sourceCall !== node) return;
+			stack.pop();
+			const parent = stack[stack.length - 1];
+			if (parent) {
+				parent.added.push(...top.added);
+				parent.removed.push(...top.removed);
+				return;
+			}
+			reportMismatches(context, top);
+		}
+	};
+} });
+//#endregion
 //#region src/rules/vue/reactivity/no-fresh-deps-in-watch.ts
-const MESSAGE$7 = `This watch getter returns a freshly-constructed array or object literal, so Vue compares it by reference (Object.is) and the watcher re-fires on every reactive tick — even when nothing changed. Use the multi-source array form watch([a, b], cb) for several sources, or watch a primitive/ref directly. See https://vuejs.org/guide/essentials/watchers.html#watch-source-types`;
+const MESSAGE$8 = `This watch getter returns a freshly-constructed array or object literal, so Vue compares it by reference (Object.is) and the watcher re-fires on every reactive tick — even when nothing changed. Use the multi-source array form watch([a, b], cb) for several sources, or watch a primitive/ref directly. See https://vuejs.org/guide/essentials/watchers.html#watch-source-types`;
 function isFunction$1(node) {
 	return node?.type === "ArrowFunctionExpression" || node?.type === "FunctionExpression";
 }
@@ -1229,11 +1452,74 @@ const noFreshDepsInWatch = defineRule({ create(context) {
 		if (!source || !isFunction$1(source)) return;
 		if (getterReturnsFreshLiteral(source)) context.report({
 			node: source,
-			message: MESSAGE$7
+			message: MESSAGE$8
 		});
 	} };
 } });
 //#endregion
+//#region src/rules/vue/reactivity/no-stale-timer-ref.ts
+const MESSAGE$7 = `clearTimeout/clearInterval on a ref leaves the stale timer id in .value, so any "timer pending" check on that ref keeps passing after the timer is gone. Reset the ref (e.g. timer.value = null) after clearing. See https://vuejs.org/guide/essentials/reactivity-fundamentals`;
+const CLEAR_CALLS = /* @__PURE__ */ new Set(["clearTimeout", "clearInterval"]);
+/** Matches `<identifier>.value` and returns the identifier name. */
+function refValueTarget(node) {
+	if (node?.type !== "MemberExpression" || node.computed === true) return;
+	const object = node.object;
+	const property = node.property;
+	if (object?.type !== "Identifier" || property?.type !== "Identifier") return;
+	if (property.name !== "value") return void 0;
+	return object.name;
+}
+function flush(context, frame) {
+	for (const item of frame.pending) context.report({
+		node: item.node,
+		message: MESSAGE$7
+	});
+}
+const noStaleTimerRef = defineRule({ create(context) {
+	const frames = [{
+		owner: null,
+		pending: []
+	}];
+	const top = () => frames[frames.length - 1];
+	const enterFunction = (node) => {
+		frames.push({
+			owner: node,
+			pending: []
+		});
+	};
+	const exitFunction = () => {
+		flush(context, frames.pop());
+	};
+	return {
+		FunctionDeclaration: enterFunction,
+		"FunctionDeclaration:exit": exitFunction,
+		FunctionExpression: enterFunction,
+		"FunctionExpression:exit": exitFunction,
+		ArrowFunctionExpression: enterFunction,
+		"ArrowFunctionExpression:exit": exitFunction,
+		CallExpression(node) {
+			const callee = node.callee;
+			if (callee?.type !== "Identifier" || !CLEAR_CALLS.has(callee.name)) return;
+			const args = node.arguments;
+			const refName = refValueTarget(args[0]);
+			if (refName === void 0) return;
+			top().pending.push({
+				refName,
+				node
+			});
+		},
+		AssignmentExpression(node) {
+			const refName = refValueTarget(node.left);
+			if (refName === void 0) return;
+			const frame = top();
+			frame.pending = frame.pending.filter((p) => p.refName !== refName);
+		},
+		"Program:exit"() {
+			flush(context, frames[0]);
+		}
+	};
+} });
+//#endregion
 //#region src/rules/vue/reactivity/prefer-readonly-for-injected.ts
 const MESSAGE$6 = `Mutating an injected value from a consumer breaks one-way data flow and makes the source of changes hard to trace. Wrap the provided value in readonly() at the provide site and expose a dedicated mutator instead. See https://vuejs.org/guide/components/provide-inject.html#working-with-reactivity`;
 const MUTATING_METHODS = /* @__PURE__ */ new Set([
@@ -1331,10 +1617,15 @@ const REGISTER_CALLS = /* @__PURE__ */ new Set([
 	"setInterval",
 	"setTimeout"
 ]);
-const OBSERVERS = /* @__PURE__ */ new Set([
+const RETAINED_RESOURCE_CONSTRUCTORS = /* @__PURE__ */ new Set([
 	"IntersectionObserver",
 	"MutationObserver",
-	"ResizeObserver"
+	"ResizeObserver",
+	"PerformanceObserver",
+	"WebSocket",
+	"EventSource",
+	"BroadcastChannel",
+	"RTCPeerConnection"
 ]);
 const CLEANUP_CALLS = /* @__PURE__ */ new Set(["onCleanup", "onWatcherCleanup"]);
 function calleeIdentifierName(node) {
@@ -1375,7 +1666,7 @@ const watchWithoutCleanup = defineRule({ create(context) {
 		NewExpression(node) {
 			if (watchStack.length === 0) return;
 			const callee = node.callee;
-			if (callee?.type === "Identifier" && OBSERVERS.has(callee.name)) watchStack[watchStack.length - 1].hasRegistration = true;
+			if (callee?.type === "Identifier" && RETAINED_RESOURCE_CONSTRUCTORS.has(callee.name)) watchStack[watchStack.length - 1].hasRegistration = true;
 		},
 		ReturnStatement(node) {
 			if (watchStack.length === 0) return;
@@ -1569,9 +1860,12 @@ const VUE_RULES = [
 	coreRule("reactivity/prefer-shallowRef-for-large-data", "reactivity", "info", false, defineRule(preferShallowRefForLargeData)),
 	coreRule("reactivity/prefer-readonly-for-injected", "reactivity", "info", false, defineRule(preferReadonlyForInjected)),
 	coreRule("reactivity/no-fresh-deps-in-watch", "reactivity", "warn", true, defineRule(noFreshDepsInWatch)),
+	coreRule("reactivity/no-stale-timer-ref", "reactivity", "warn", true, defineRule(noStaleTimerRef)),
+	coreRule("reactivity/effect-listener-cleanup-mismatch", "reactivity", "warn", true, defineRule(effectListenerCleanupMismatch)),
 	coreRule("composition/prefer-script-setup-for-new-files", "composition", "warn", true, defineRule(preferScriptSetupForNewFiles)),
 	coreRule("composition/defineProps-typed", "composition", "warn", true, defineRule(definePropsTyped)),
 	coreRule("composition/no-pinia-store-in-setup", "composition", "warn", true, defineRule(noPiniaStoreInSetup)),
+	coreRule("composition/no-prop-callback-in-setup", "composition", "warn", true, defineRule(noPropCallbackInSetup)),
 	coreRule("performance/prefer-defineAsyncComponent-on-route", "performance", "info", false, defineRule(preferDefineAsyncComponentOnRoute)),
 	coreRule("performance/prefer-module-scope-static-value", "performance", "info", false, defineRule(preferModuleScopeStaticValue)),
 	coreRule("performance/prefer-module-scope-pure-function", "performance", "info", false, defineRule(preferModuleScopePureFunction)),