@geoql/doctor-rule-core 1.3.0 → 1.4.0

package/dist/index.js

@@ -133,7 +133,7 @@ const noExplicitImportsOfAutoImported = defineRule({ create(context) {
 } });
 //#endregion
 //#region src/rules/nuxt/ai-slop/no-fetch-in-setup.ts
-const MESSAGE$31 = `Bare $fetch/fetch at the top level of <script setup> runs on both server and client without SSR deduplication. Use useFetch for automatic request deduplication and SSR hydration. See https://nuxt.com/docs/4.x/guide/data-fetching`;
+const MESSAGE$32 = `Bare $fetch/fetch at the top level of <script setup> runs on both server and client without SSR deduplication. Use useFetch for automatic request deduplication and SSR hydration. See https://nuxt.com/docs/4.x/guide/data-fetching`;
 function isFetchCall(node) {
 	if (!node || node.type !== "CallExpression") return false;
 	const callee = node.callee;
@@ -170,7 +170,7 @@ const noFetchInSetup = defineRule({ create(context) {
 			if (node["parent"]?.type === "AwaitExpression") return;
 			context.report({
 				node,
-				message: MESSAGE$31
+				message: MESSAGE$32
 			});
 		},
 		AwaitExpression(node) {
@@ -178,7 +178,7 @@ const noFetchInSetup = defineRule({ create(context) {
 			if (!isFetchCall(node.argument)) return;
 			context.report({
 				node,
-				message: MESSAGE$31
+				message: MESSAGE$32
 			});
 		}
 	};
@@ -190,7 +190,7 @@ const LEGACY_PROPS = /* @__PURE__ */ new Set([
 	"server",
 	"browser"
 ]);
-const MESSAGE$30 = `Use import.meta.client / import.meta.server / import.meta.browser instead of process.client / process.server / process.browser (Nuxt 4). See https://nuxt.com/docs/4.x/guide/concepts/auto-imports`;
+const MESSAGE$31 = `Use import.meta.client / import.meta.server / import.meta.browser instead of process.client / process.server / process.browser (Nuxt 4). See https://nuxt.com/docs/4.x/guide/concepts/auto-imports`;
 const noProcessClientServer = defineRule({
 	create(context) {
 		return { MemberExpression(node) {
@@ -202,7 +202,7 @@ const noProcessClientServer = defineRule({
 			if (!LEGACY_PROPS.has(property.name)) return;
 			context.report({
 				node,
-				message: MESSAGE$30
+				message: MESSAGE$31
 			});
 		} };
 	},
@@ -219,7 +219,7 @@ const noProcessClientServer = defineRule({
 });
 //#endregion
 //#region src/rules/nuxt/ai-slop/no-useState-for-server-data.ts
-const MESSAGE$29 = `useState with a fetch/await initializer suggests useFetch or useAsyncData for automatic SSR hydration and request deduplication. See https://nuxt.com/docs/4.x/guide/data-fetching`;
+const MESSAGE$30 = `useState with a fetch/await initializer suggests useFetch or useAsyncData for automatic SSR hydration and request deduplication. See https://nuxt.com/docs/4.x/guide/data-fetching`;
 function containsFetchOrAwait(node, visited) {
 	if (!node || visited.has(node)) return false;
 	visited.add(node);
@@ -256,13 +256,13 @@ const noUseStateForServerData = defineRule({ create(context) {
 		if (!containsFetchOrAwait(initFn.body, /* @__PURE__ */ new Set())) return;
 		context.report({
 			node,
-			message: MESSAGE$29
+			message: MESSAGE$30
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/nuxt/data-fetching/useAsyncData-key-required-in-loop.ts
-const MESSAGE$28 = `useAsyncData/useFetch without an explicit string key inside a loop causes duplicate requests and cache fragmentation. Pass a unique string key as the first argument. See https://nuxt.com/docs/4.x/guide/data-fetching`;
+const MESSAGE$29 = `useAsyncData/useFetch without an explicit string key inside a loop causes duplicate requests and cache fragmentation. Pass a unique string key as the first argument. See https://nuxt.com/docs/4.x/guide/data-fetching`;
 const DATA_FETCHERS = /* @__PURE__ */ new Set(["useAsyncData", "useFetch"]);
 function isMapCall(node) {
 	const callee = node.callee;
@@ -315,7 +315,7 @@ const useAsyncDataKeyRequiredInLoop = defineRule({ create(context) {
 			if (firstArg.type === "Literal" && typeof firstArg.value === "string") return;
 			context.report({
 				node,
-				message: MESSAGE$28
+				message: MESSAGE$29
 			});
 		},
 		"CallExpression:exit"(node) {
@@ -325,7 +325,7 @@ const useAsyncDataKeyRequiredInLoop = defineRule({ create(context) {
 } });
 //#endregion
 //#region src/rules/nuxt/security/no-user-input-in-fetch-url.ts
-const MESSAGE$27 = `Building a useFetch/$fetch URL from user input (route.query/route.params) lets an attacker control the request target — an SSRF risk during SSR. Use a fixed path and pass user input via the query/body options instead. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery`;
+const MESSAGE$28 = `Building a useFetch/$fetch URL from user input (route.query/route.params) lets an attacker control the request target — an SSRF risk during SSR. Use a fixed path and pass user input via the query/body options instead. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery`;
 const FETCH_CALLEES = /* @__PURE__ */ new Set([
 	"useFetch",
 	"useLazyFetch",
@@ -363,13 +363,13 @@ const noUserInputInFetchUrl = defineRule({ create(context) {
 		const urlArg = node.arguments[0];
 		if (urlArgIsTainted(urlArg)) context.report({
 			node,
-			message: MESSAGE$27
+			message: MESSAGE$28
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/nuxt/hydration/clientOnly-for-browser-apis.ts
-const MESSAGE$26 = `Accessing window./document./navigator./localStorage./sessionStorage. without an import.meta.client or process.client guard causes SSR failures. Wrap with if (import.meta.client) { ... } or move to onMounted. See https://nuxt.com/docs/4.x/guide/components`;
+const MESSAGE$27 = `Accessing window./document./navigator./localStorage./sessionStorage. without an import.meta.client or process.client guard causes SSR failures. Wrap with if (import.meta.client) { ... } or move to onMounted. See https://nuxt.com/docs/4.x/guide/components`;
 const BROWSER_GLOBALS$1 = /* @__PURE__ */ new Set([
 	"window",
 	"document",
@@ -440,14 +440,14 @@ const clientOnlyForBrowserApis = defineRule({ create(context) {
 			if (!BROWSER_GLOBALS$1.has(obj.name)) return;
 			context.report({
 				node,
-				message: MESSAGE$26
+				message: MESSAGE$27
 			});
 		}
 	};
 } });
 //#endregion
 //#region src/rules/nuxt/hydration/no-browser-global-in-computed.ts
-const MESSAGE$25 = `Reading a browser global inside a computed getter runs during SSR (computeds evaluate on the server render) and throws or hydration-mismatches. Guard with import.meta.client or derive the value in onMounted. See https://nuxt.com/docs/4.x/getting-started/data-fetching`;
+const MESSAGE$26 = `Reading a browser global inside a computed getter runs during SSR (computeds evaluate on the server render) and throws or hydration-mismatches. Guard with import.meta.client or derive the value in onMounted. See https://nuxt.com/docs/4.x/getting-started/data-fetching`;
 const BROWSER_GLOBALS = /* @__PURE__ */ new Set([
 	"window",
 	"document",
@@ -501,14 +501,14 @@ const noBrowserGlobalInComputed = defineRule({ create(context) {
 			if (!BROWSER_GLOBALS.has(object.name)) return;
 			context.report({
 				node,
-				message: MESSAGE$25
+				message: MESSAGE$26
 			});
 		}
 	};
 } });
 //#endregion
 //#region src/rules/nuxt/hydration/no-document-in-setup.ts
-const MESSAGE$24 = `Accessing document/window/navigator/localStorage at the top level of <script setup> causes a server-side crash (SSR). These browser globals are undefined on the server. Move access inside onMounted or guard with import.meta.client. See https://nuxt.com/docs/4.x/guide/components`;
+const MESSAGE$25 = `Accessing document/window/navigator/localStorage at the top level of <script setup> causes a server-side crash (SSR). These browser globals are undefined on the server. Move access inside onMounted or guard with import.meta.client. See https://nuxt.com/docs/4.x/guide/components`;
 const SSR_UNSAFE_GLOBALS = /* @__PURE__ */ new Set([
 	"document",
 	"window",
@@ -588,14 +588,14 @@ const noDocumentInSetup = defineRule({ create(context) {
 			if (isGuardedByImportMetaClient(node)) return;
 			context.report({
 				node,
-				message: MESSAGE$24
+				message: MESSAGE$25
 			});
 		}
 	};
 } });
 //#endregion
 //#region src/rules/nuxt/server-routes/createError-on-failure.ts
-const MESSAGE$23 = `throw new Error() leaks the call stack and exposes internal details. Use throw createError() from h3 for proper HTTP errors with no stack leak. See https://h3.unjs.io/guide/throw`;
+const MESSAGE$24 = `throw new Error() leaks the call stack and exposes internal details. Use throw createError() from h3 for proper HTTP errors with no stack leak. See https://h3.unjs.io/guide/throw`;
 const createErrorOnFailure = defineRule({ create(context) {
 	let handlerDepth = 0;
 	return {
@@ -620,14 +620,14 @@ const createErrorOnFailure = defineRule({ create(context) {
 			if (ctor.name !== "Error") return;
 			context.report({
 				node,
-				message: MESSAGE$23
+				message: MESSAGE$24
 			});
 		}
 	};
 } });
 //#endregion
 //#region src/rules/nuxt/server-routes/defineEventHandler-typed.ts
-const MESSAGE$22 = `defineEventHandler handler param event lacks a type annotation. Add a generic: defineEventHandler<H3Event>(...) or type the event parameter explicitly. See https://h3.unjs.io/guide/typed`;
+const MESSAGE$23 = `defineEventHandler handler param event lacks a type annotation. Add a generic: defineEventHandler<H3Event>(...) or type the event parameter explicitly. See https://h3.unjs.io/guide/typed`;
 function isFunction$2(node) {
 	return node?.type === "ArrowFunctionExpression" || node?.type === "FunctionExpression";
 }
@@ -646,13 +646,13 @@ const defineEventHandlerTyped = defineRule({ create(context) {
 		if (params[0].typeAnnotation) return;
 		context.report({
 			node,
-			message: MESSAGE$22
+			message: MESSAGE$23
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/nuxt/server-routes/validate-body-with-h3-v2.ts
-const MESSAGE$21 = `readBody() is the legacy H3 reader. In Nuxt 4 with h3 v2, use readValidatedBody to parse and validate the request body in one step. See https://nuxt.com/docs/4.x/guide/data-fetching`;
+const MESSAGE$22 = `readBody() is the legacy H3 reader. In Nuxt 4 with h3 v2, use readValidatedBody to parse and validate the request body in one step. See https://nuxt.com/docs/4.x/guide/data-fetching`;
 const validateBodyWithH3V2 = defineRule({ create(context) {
 	return { CallExpression(node) {
 		const callee = node.callee;
@@ -660,7 +660,7 @@ const validateBodyWithH3V2 = defineRule({ create(context) {
 		if (callee.name !== "readBody") return;
 		context.report({
 			node,
-			message: MESSAGE$21
+			message: MESSAGE$22
 		});
 	} };
 } });
@@ -691,7 +691,7 @@ const NUXT_RULES = [
 ];
 //#endregion
 //#region src/rules/vue/ai-slop/no-destructure-props-without-toRefs.ts
-const MESSAGE$20 = `Destructuring props loses reactivity. Wrap with toRefs(...) to keep refs. See https://vuejs.org/guide/components/props.html#reactive-props-destructure`;
+const MESSAGE$21 = `Destructuring props loses reactivity. Wrap with toRefs(...) to keep refs. See https://vuejs.org/guide/components/props.html#reactive-props-destructure`;
 function calleeName$6(node) {
 	const callee = node.callee;
 	if (callee?.type === "Identifier") return callee.name;
@@ -747,7 +747,7 @@ const noDestructurePropsWithoutToRefs = defineRule({ create(context) {
 			if (isToRefsCall$1(init)) return;
 			if ((isDefinePropsCall(init) || init.type === "Identifier" && propsSources.has(init.name)) && isOneTimeContext()) context.report({
 				node,
-				message: MESSAGE$20
+				message: MESSAGE$21
 			});
 		},
 		Property(node) {
@@ -762,7 +762,7 @@ const noDestructurePropsWithoutToRefs = defineRule({ create(context) {
 } });
 //#endregion
 //#region src/rules/vue/ai-slop/no-destructure-reactive-without-toRefs.ts
-const MESSAGE$19 = `Destructuring reactive state loses reactivity. Wrap with toRefs(...) or read single keys via toRef(state, 'key'). See https://vuejs.org/guide/essentials/reactivity-fundamentals.html#destructuring-reactive-state`;
+const MESSAGE$20 = `Destructuring reactive state loses reactivity. Wrap with toRefs(...) or read single keys via toRef(state, 'key'). See https://vuejs.org/guide/essentials/reactivity-fundamentals.html#destructuring-reactive-state`;
 const REACTIVE_FACTORIES = /* @__PURE__ */ new Set(["reactive", "shallowReactive"]);
 function calleeName$5(node) {
 	const callee = node.callee;
@@ -794,7 +794,7 @@ const noDestructureReactiveWithoutToRefs = defineRule({ create(context) {
 		if (isToRefsCall(init)) return;
 		if (isReactiveCall(init) || init.type === "Identifier" && reactiveSources.has(init.name)) context.report({
 			node,
-			message: MESSAGE$19
+			message: MESSAGE$20
 		});
 	} };
 } });
@@ -863,7 +863,7 @@ const noImportsFromVueWhenAutoImported = defineRule({ create(context) {
 } });
 //#endregion
 //#region src/rules/vue/ai-slop/no-non-null-assertion-on-ref-value.ts
-const MESSAGE$18 = `Non-null assertion on a ref's .value hides nullability. Add an explicit guard ('if (!r.value) return') or use optional chaining ('r.value?.x'). See https://vuejs.org/guide/typescript/composition-api.html#typing-ref`;
+const MESSAGE$19 = `Non-null assertion on a ref's .value hides nullability. Add an explicit guard ('if (!r.value) return') or use optional chaining ('r.value?.x'). See https://vuejs.org/guide/typescript/composition-api.html#typing-ref`;
 const REF_FACTORIES = /* @__PURE__ */ new Set([
 	"ref",
 	"shallowRef",
@@ -900,14 +900,14 @@ const noNonNullAssertionOnRefValue = defineRule({ create(context) {
 			if (!refSources.has(object.name)) return;
 			context.report({
 				node,
-				message: MESSAGE$18
+				message: MESSAGE$19
 			});
 		}
 	};
 } });
 //#endregion
 //#region src/rules/vue/composition/defineProps-typed.ts
-const MESSAGE$17 = `This defineProps() call declares props with a runtime object, which discards static type information. Use the type-only generic form (defineProps<{ ... }>()) so props are fully typed. See https://vuejs.org/guide/typescript/composition-api.html#typing-component-props`;
+const MESSAGE$18 = `This defineProps() call declares props with a runtime object, which discards static type information. Use the type-only generic form (defineProps<{ ... }>()) so props are fully typed. See https://vuejs.org/guide/typescript/composition-api.html#typing-component-props`;
 function calleeName$3(node) {
 	const callee = node.callee;
 	if (callee?.type === "Identifier") return callee.name;
@@ -917,13 +917,13 @@ const definePropsTyped = defineRule({ create(context) {
 		if (calleeName$3(node) !== "defineProps") return;
 		if (node.arguments[0]?.type === "ObjectExpression") context.report({
 			node,
-			message: MESSAGE$17
+			message: MESSAGE$18
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/vue/composition/no-pinia-store-in-setup.ts
-const MESSAGE$16 = `This calls defineStore() inside a function (setup, a composable, or a component body), so a brand-new store definition is created on every call instead of one shared singleton. Call defineStore() once at module scope and call the returned useXxxStore() inside setup. See https://pinia.vuejs.org/core-concepts/#defining-a-store`;
+const MESSAGE$17 = `This calls defineStore() inside a function (setup, a composable, or a component body), so a brand-new store definition is created on every call instead of one shared singleton. Call defineStore() once at module scope and call the returned useXxxStore() inside setup. See https://pinia.vuejs.org/core-concepts/#defining-a-store`;
 const noPiniaStoreInSetup = defineRule({ create(context) {
 	let functionDepth = 0;
 	const enter = () => {
@@ -938,7 +938,7 @@ const noPiniaStoreInSetup = defineRule({ create(context) {
 			if (callee?.type !== "Identifier" || callee.name !== "defineStore") return;
 			if (functionDepth > 0) context.report({
 				node,
-				message: MESSAGE$16
+				message: MESSAGE$17
 			});
 		},
 		FunctionDeclaration: enter,
@@ -951,7 +951,7 @@ const noPiniaStoreInSetup = defineRule({ create(context) {
 } });
 //#endregion
 //#region src/rules/vue/composition/no-prop-callback-in-setup.ts
-const MESSAGE$15 = `Calling a parent callback prop during setup or inside a computed getter runs a side effect on the render path — it fires on every re-evaluation and during SSR. Move the call into an event handler, watcher, or lifecycle hook. See https://vuejs.org/guide/components/events.html`;
+const MESSAGE$16 = `Calling a parent callback prop during setup or inside a computed getter runs a side effect on the render path — it fires on every re-evaluation and during SSR. Move the call into an event handler, watcher, or lifecycle hook. See https://vuejs.org/guide/components/events.html`;
 const CALLBACK_NAME = /^on[A-Z]/;
 function calleeIdentifierName$2(node) {
 	const callee = node.callee;
@@ -1004,14 +1004,14 @@ const noPropCallbackInSetup = defineRule({ create(context) {
 			const enclosing = functionStack[functionStack.length - 1];
 			if (enclosing === void 0 || enclosing.isComputedGetter) context.report({
 				node,
-				message: MESSAGE$15
+				message: MESSAGE$16
 			});
 		}
 	};
 } });
 //#endregion
 //#region src/rules/vue/composition/prefer-script-setup-for-new-files.ts
-const MESSAGE$14 = `This component nests composition-API logic inside an options-object setup(). Use a <script setup> block instead — it removes the setup() boilerplate and exposes bindings to the template directly. See https://vuejs.org/api/sfc-script-setup.html`;
+const MESSAGE$15 = `This component nests composition-API logic inside an options-object setup(). Use a <script setup> block instead — it removes the setup() boilerplate and exposes bindings to the template directly. See https://vuejs.org/api/sfc-script-setup.html`;
 function isFunctionValue(node) {
 	return node?.type === "ArrowFunctionExpression" || node?.type === "FunctionExpression";
 }
@@ -1028,13 +1028,13 @@ const preferScriptSetupForNewFiles = defineRule({ create(context) {
 		if (declaration?.type !== "ObjectExpression") return;
 		if (declaration.properties.some(isSetupProperty)) context.report({
 			node,
-			message: MESSAGE$14
+			message: MESSAGE$15
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/vue/performance/prefer-defineAsyncComponent-on-route.ts
-const MESSAGE$13 = `This route record's \`component:\` field references the imported component directly, which forces a synchronous import of the route bundle. Use \`() => import('./Foo.vue')\` or \`defineAsyncComponent(() => import('./Foo.vue'))\` to lazy-load the route. See https://vuejs.org/guide/components/async.html`;
+const MESSAGE$14 = `This route record's \`component:\` field references the imported component directly, which forces a synchronous import of the route bundle. Use \`() => import('./Foo.vue')\` or \`defineAsyncComponent(() => import('./Foo.vue'))\` to lazy-load the route. See https://vuejs.org/guide/components/async.html`;
 function keyName(key) {
 	return key.type === "Identifier" ? key.name : key.value;
 }
@@ -1044,13 +1044,13 @@ const preferDefineAsyncComponentOnRoute = defineRule({ create(context) {
 		if (keyName(node.key) !== "component") return;
 		if (node.value.type === "Identifier") context.report({
 			node,
-			message: MESSAGE$13
+			message: MESSAGE$14
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/vue/performance/prefer-module-scope-pure-function.ts
-const MESSAGE$12 = `This helper closes over nothing reactive (only its parameters, imports, and globals), yet it is re-created on every call of the enclosing function. Hoist it to module scope so a single function reference is shared across all component instances. See https://vuejs.org/guide/best-practices/performance.html`;
+const MESSAGE$13 = `This helper closes over nothing reactive (only its parameters, imports, and globals), yet it is re-created on every call of the enclosing function. Hoist it to module scope so a single function reference is shared across all component instances. See https://vuejs.org/guide/best-practices/performance.html`;
 const GLOBALS = /* @__PURE__ */ new Set([
 	"console",
 	"Math",
@@ -1178,7 +1178,7 @@ const preferModuleScopePureFunction = defineRule({ create(context) {
 		if (functionDepth < 1) return;
 		if (isHoistable(fn, imports)) context.report({
 			node: fn,
-			message: MESSAGE$12
+			message: MESSAGE$13
 		});
 	};
 	return {
@@ -1196,7 +1196,7 @@ const preferModuleScopePureFunction = defineRule({ create(context) {
 				if (init?.type === "ArrowFunctionExpression" || init?.type === "FunctionExpression") {
 					if (isHoistable(init, imports)) context.report({
 						node: init,
-						message: MESSAGE$12
+						message: MESSAGE$13
 					});
 				}
 			}
@@ -1216,7 +1216,7 @@ const preferModuleScopePureFunction = defineRule({ create(context) {
 } });
 //#endregion
 //#region src/rules/vue/performance/prefer-module-scope-static-value.ts
-const MESSAGE$11 = `This static array or object literal is declared inside a function, so a fresh copy is allocated on every call (including every component instantiation). Hoist it to module scope so the single frozen reference is shared. See https://vuejs.org/guide/best-practices/performance.html`;
+const MESSAGE$12 = `This static array or object literal is declared inside a function, so a fresh copy is allocated on every call (including every component instantiation). Hoist it to module scope so the single frozen reference is shared. See https://vuejs.org/guide/best-practices/performance.html`;
 const LITERAL_TYPES = /* @__PURE__ */ new Set([
 	"Literal",
 	"StringLiteral",
@@ -1281,14 +1281,14 @@ const preferModuleScopeStaticValue = defineRule({ create(context) {
 			if (!isStaticLiteral(init)) return;
 			context.report({
 				node: init,
-				message: MESSAGE$11
+				message: MESSAGE$12
 			});
 		}
 	};
 } });
 //#endregion
 //#region src/rules/vue/performance/prefer-stable-empty-fallback.ts
-const MESSAGE$10 = `This computed falls back to a fresh empty array or object literal, so it returns a brand-new reference whenever the source is nullish. Downstream watchers, child props, and v-memo see an identity change every recompute. Hoist a single module-scope EMPTY constant and fall back to that. See https://vuejs.org/guide/best-practices/performance.html`;
+const MESSAGE$11 = `This computed falls back to a fresh empty array or object literal, so it returns a brand-new reference whenever the source is nullish. Downstream watchers, child props, and v-memo see an identity change every recompute. Hoist a single module-scope EMPTY constant and fall back to that. See https://vuejs.org/guide/best-practices/performance.html`;
 function isEmptyLiteral(node) {
 	if (node?.type === "ArrayExpression") return node.elements.length === 0;
 	if (node?.type === "ObjectExpression") return node.properties.length === 0;
@@ -1318,13 +1318,13 @@ const preferStableEmptyFallback = defineRule({ create(context) {
 		const returned = getterBody(node);
 		if (returned && fallsBackToEmptyLiteral(returned)) context.report({
 			node: returned,
-			message: MESSAGE$10
+			message: MESSAGE$11
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/vue/reactivity/effect-listener-cleanup-mismatch.ts
-const MESSAGE$9 = `This cleanup cannot detach the listener it pairs with: removeEventListener only removes when the handler reference AND capture flag match addEventListener exactly. Use the same named handler (never an inline arrow) and the same capture flag. See https://vuejs.org/guide/essentials/watchers.html#side-effect-cleanup`;
+const MESSAGE$10 = `This cleanup cannot detach the listener it pairs with: removeEventListener only removes when the handler reference AND capture flag match addEventListener exactly. Use the same named handler (never an inline arrow) and the same capture flag. See https://vuejs.org/guide/essentials/watchers.html#side-effect-cleanup`;
 const EFFECT_CALLS = /* @__PURE__ */ new Set([
 	"watch",
 	"watchEffect",
@@ -1381,7 +1381,7 @@ function reportMismatches(context, frame) {
 		if (pairable.length === 0) continue;
 		if (!pairable.some((a) => a.handlerKey !== void 0 && a.handlerKey === removed.handlerKey && a.capture === removed.capture)) context.report({
 			node: removed.node,
-			message: MESSAGE$9
+			message: MESSAGE$10
 		});
 	}
 }
@@ -1425,7 +1425,7 @@ const effectListenerCleanupMismatch = defineRule({ create(context) {
 } });
 //#endregion
 //#region src/rules/vue/reactivity/no-fresh-deps-in-watch.ts
-const MESSAGE$8 = `This watch getter returns a freshly-constructed array or object literal, so Vue compares it by reference (Object.is) and the watcher re-fires on every reactive tick — even when nothing changed. Use the multi-source array form watch([a, b], cb) for several sources, or watch a primitive/ref directly. See https://vuejs.org/guide/essentials/watchers.html#watch-source-types`;
+const MESSAGE$9 = `This watch getter returns a freshly-constructed array or object literal, so Vue compares it by reference (Object.is) and the watcher re-fires on every reactive tick — even when nothing changed. Use the multi-source array form watch([a, b], cb) for several sources, or watch a primitive/ref directly. See https://vuejs.org/guide/essentials/watchers.html#watch-source-types`;
 function isFunction$1(node) {
 	return node?.type === "ArrowFunctionExpression" || node?.type === "FunctionExpression";
 }
@@ -1452,13 +1452,13 @@ const noFreshDepsInWatch = defineRule({ create(context) {
 		if (!source || !isFunction$1(source)) return;
 		if (getterReturnsFreshLiteral(source)) context.report({
 			node: source,
-			message: MESSAGE$8
+			message: MESSAGE$9
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/vue/reactivity/no-stale-timer-ref.ts
-const MESSAGE$7 = `clearTimeout/clearInterval on a ref leaves the stale timer id in .value, so any "timer pending" check on that ref keeps passing after the timer is gone. Reset the ref (e.g. timer.value = null) after clearing. See https://vuejs.org/guide/essentials/reactivity-fundamentals`;
+const MESSAGE$8 = `clearTimeout/clearInterval on a ref leaves the stale timer id in .value, so any "timer pending" check on that ref keeps passing after the timer is gone. Reset the ref (e.g. timer.value = null) after clearing. See https://vuejs.org/guide/essentials/reactivity-fundamentals`;
 const CLEAR_CALLS = /* @__PURE__ */ new Set(["clearTimeout", "clearInterval"]);
 /** Matches `<identifier>.value` and returns the identifier name. */
 function refValueTarget(node) {
@@ -1472,7 +1472,7 @@ function refValueTarget(node) {
 function flush(context, frame) {
 	for (const item of frame.pending) context.report({
 		node: item.node,
-		message: MESSAGE$7
+		message: MESSAGE$8
 	});
 }
 const noStaleTimerRef = defineRule({ create(context) {
@@ -1521,7 +1521,7 @@ const noStaleTimerRef = defineRule({ create(context) {
 } });
 //#endregion
 //#region src/rules/vue/reactivity/prefer-readonly-for-injected.ts
-const MESSAGE$6 = `Mutating an injected value from a consumer breaks one-way data flow and makes the source of changes hard to trace. Wrap the provided value in readonly() at the provide site and expose a dedicated mutator instead. See https://vuejs.org/guide/components/provide-inject.html#working-with-reactivity`;
+const MESSAGE$7 = `Mutating an injected value from a consumer breaks one-way data flow and makes the source of changes hard to trace. Wrap the provided value in readonly() at the provide site and expose a dedicated mutator instead. See https://vuejs.org/guide/components/provide-inject.html#working-with-reactivity`;
 const MUTATING_METHODS = /* @__PURE__ */ new Set([
 	"push",
 	"pop",
@@ -1553,7 +1553,7 @@ const preferReadonlyForInjected = defineRule({ create(context) {
 			const name = memberObjectName(node.left);
 			if (name !== void 0 && injectedSources.has(name)) context.report({
 				node,
-				message: MESSAGE$6
+				message: MESSAGE$7
 			});
 		},
 		CallExpression(node) {
@@ -1564,14 +1564,14 @@ const preferReadonlyForInjected = defineRule({ create(context) {
 			const property = callee.property;
 			if (MUTATING_METHODS.has(property.name)) context.report({
 				node,
-				message: MESSAGE$6
+				message: MESSAGE$7
 			});
 		}
 	};
 } });
 //#endregion
 //#region src/rules/vue/reactivity/prefer-shallowRef-for-large-data.ts
-const MESSAGE$5 = `This ref holds large or fetched data, so deep reactivity tracks every nested property and wastes memory and CPU. Use shallowRef() (and triggerRef on replacement) for large arrays, big objects, or server payloads. See https://vuejs.org/api/reactivity-advanced.html#shallowref`;
+const MESSAGE$6 = `This ref holds large or fetched data, so deep reactivity tracks every nested property and wastes memory and CPU. Use shallowRef() (and triggerRef on replacement) for large arrays, big objects, or server payloads. See https://vuejs.org/api/reactivity-advanced.html#shallowref`;
 const ARRAY_LIMIT = 100;
 const OBJECT_LIMIT = 50;
 const FETCH_IDENTIFIERS = /* @__PURE__ */ new Set(["$fetch", "useFetch"]);
@@ -1605,13 +1605,13 @@ const preferShallowRefForLargeData = defineRule({ create(context) {
 		const init = node.arguments[0];
 		if (isLargeData(init)) context.report({
 			node,
-			message: MESSAGE$5
+			message: MESSAGE$6
 		});
 	} };
 } });
 //#endregion
 //#region src/rules/vue/reactivity/watch-without-cleanup.ts
-const MESSAGE$4 = `This watcher registers a listener, timer, or observer but never cleans it up, so it leaks across re-runs and hot reloads. Return a cleanup function (or call onWatcherCleanup) inside the watcher. See https://vuejs.org/guide/essentials/watchers.html#side-effect-cleanup`;
+const MESSAGE$5 = `This watcher registers a listener, timer, or observer but never cleans it up, so it leaks across re-runs and hot reloads. Return a cleanup function (or call onWatcherCleanup) inside the watcher. See https://vuejs.org/guide/essentials/watchers.html#side-effect-cleanup`;
 const REGISTER_CALLS = /* @__PURE__ */ new Set([
 	"addEventListener",
 	"setInterval",
@@ -1679,6 +1679,81 @@ const watchWithoutCleanup = defineRule({ create(context) {
 			watchStack.pop();
 			if (top.hasRegistration && !top.hasCleanup) context.report({
 				node,
+				message: MESSAGE$5
+			});
+		}
+	};
+} });
+//#endregion
+//#region src/rules/vue/security/markdown-it-unsanitized-html.ts
+const MESSAGE$4 = `markdown-it is configured with \`html: true\` but no sanitizer is connected. Raw HTML in user-authored markdown is an XSS vector. Pipe md.render output through DOMPurify/sanitize-html, or add a markdown-it sanitizer plugin. See https://github.com/markdown-it/markdown-it/blob/master/docs/security.md`;
+const SANITIZER_MODULES = /* @__PURE__ */ new Set([
+	"dompurify",
+	"isomorphic-dompurify",
+	"sanitize-html",
+	"xss",
+	"markdown-it-sanitizer",
+	"insane"
+]);
+function importSource(node) {
+	return String(node.source.value);
+}
+function optsEnableHtml(node) {
+	if (!node || node.type !== "ObjectExpression") return false;
+	for (const prop of node.properties) {
+		if (prop.type !== "Property") continue;
+		const key = prop.key;
+		if ((key.type === "Identifier" ? key.name : key.type === "Literal" ? String(key.value) : void 0) !== "html") continue;
+		const value = prop.value;
+		return value.type === "Literal" && value.value === true;
+	}
+	return false;
+}
+function isMarkdownItCallee(callee, local) {
+	return callee?.type === "Identifier" && callee.name === local;
+}
+const markdownItUnsanitizedHtml = defineRule({ create(context) {
+	let markdownItLocal;
+	let sanitized = false;
+	const unsafeSites = [];
+	const markdownInstances = /* @__PURE__ */ new Set();
+	const recordConstruction = (node, calleeArgs, assignedTo) => {
+		if (assignedTo) markdownInstances.add(assignedTo);
+		if (optsEnableHtml(calleeArgs?.[0])) unsafeSites.push(node);
+	};
+	return {
+		ImportDeclaration(node) {
+			const source = importSource(node);
+			if (SANITIZER_MODULES.has(source)) sanitized = true;
+			if (source === "markdown-it") {
+				for (const spec of node.specifiers) if (spec.type === "ImportDefaultSpecifier") markdownItLocal = spec.local.name;
+			}
+		},
+		VariableDeclarator(node) {
+			if (markdownItLocal === void 0) return;
+			const init = node.init;
+			const id = node.id;
+			const assignedTo = id.type === "Identifier" ? id.name : void 0;
+			if (init?.type === "NewExpression" && isMarkdownItCallee(init.callee, markdownItLocal)) recordConstruction(init, init.arguments, assignedTo);
+			else if (init?.type === "CallExpression" && isMarkdownItCallee(init.callee, markdownItLocal)) recordConstruction(init, init.arguments, assignedTo);
+		},
+		CallExpression(node) {
+			const callee = node.callee;
+			if (callee?.type !== "MemberExpression") return;
+			const prop = callee.property;
+			const propName = prop.type === "Identifier" ? prop.name : void 0;
+			if (propName === "use") {
+				sanitized = true;
+				return;
+			}
+			if (propName !== "set") return;
+			const object = callee.object;
+			if (object.type === "Identifier" && markdownInstances.has(object.name) && optsEnableHtml(node.arguments?.[0])) unsafeSites.push(node);
+		},
+		"Program:exit"() {
+			if (sanitized) return;
+			for (const site of unsafeSites) context.report({
+				node: site,
 				message: MESSAGE$4
 			});
 		}
@@ -1873,7 +1948,8 @@ const VUE_RULES = [
 	coreRule("security/no-inner-html", "security", "error", true, defineRule(noInnerHtml)),
 	coreRule("security/no-eval-like", "security", "error", true, defineRule(noEvalLike)),
 	coreRule("security/no-auth-token-in-web-storage", "security", "warn", true, defineRule(noAuthTokenInWebStorage)),
-	coreRule("security/no-secrets-in-source", "security", "warn", true, defineRule(noSecretsInSource))
+	coreRule("security/no-secrets-in-source", "security", "warn", true, defineRule(noSecretsInSource)),
+	coreRule("security/markdown-it-unsanitized-html", "security", "warn", true, defineRule(markdownItUnsanitizedHtml))
 ];
 //#endregion
 export { NUXT_AUTO_IMPORTED, NUXT_RULES, VUE_AUTO_IMPORTED, VUE_RULES, clientOnlyForBrowserApis, createErrorOnFailure, defineEventHandlerTyped, definePropsTyped, defineRule, noAuthTokenInWebStorage, noDestructurePropsWithoutToRefs, noDestructureReactiveWithoutToRefs, noDocumentInSetup, noEmDashInString, noEvalLike, noExplicitImportsOfAutoImported, noFetchInSetup, noImportsFromVueWhenAutoImported, noInnerHtml, noNonNullAssertionOnRefValue, noProcessClientServer, noSecretsInSource, noUseStateForServerData, noUserInputInFetchUrl, preferDefineAsyncComponentOnRoute, preferReadonlyForInjected, preferScriptSetupForNewFiles, preferShallowRefForLargeData, useAsyncDataKeyRequiredInLoop, validateBodyWithH3V2, watchWithoutCleanup };