getaura 0.4.0 → 0.5.0

package/dist/index.js

@@ -9,8 +9,8 @@ var __export = (target, all) => {
 import { Command, Option } from "commander";
 
 // src/commands/apply.ts
-import { existsSync as existsSync25, rmSync as rmSync5 } from "fs";
-import path42 from "path";
+import { existsSync as existsSync27, rmSync as rmSync5 } from "fs";
+import path45 from "path";
 
 // ../shared/src/types.ts
 var CATEGORIES = ["security", "agent-setup", "foundations", "structure"];
@@ -128,8 +128,42 @@ function findSecrets(text) {
       out.push({ patternId: p2.id, label: p2.label, service: p2.service, confidence: p2.confidence, value, index: m.index ?? 0 });
     }
   }
-  out.sort((a, b) => a.index - b.index || b.value.length - a.value.length);
-  return out.filter((m, i) => !out.slice(0, i).some((o) => m.index >= o.index && m.index + m.value.length <= o.index + o.value.length));
+  const inside = (m, o) => m !== o && m.index >= o.index && m.index + m.value.length <= o.index + o.value.length;
+  const specific = out.filter((m) => !(m.patternId === "generic-assignment" && out.some((o) => o.patternId !== "generic-assignment" && inside(o, m))));
+  specific.sort((a, b) => a.index - b.index || b.value.length - a.value.length);
+  return specific.filter((m, i) => !specific.slice(0, i).some((o) => inside(m, o)));
+}
+var PLACEHOLDER = /example|placeholder|your[_-]?|xxx|changeme|change[_-]me|dummy|fake|mock|sample|redacted|replace|insert|<[^>]*>|\{\{|\.\.\.|\*\*\*|(?:^|[_-])test|test[_-]|invalid|synthetic/i;
+var KEY_PLACEHOLDER = /x{8,}|X{8,}|EXAMPLE|\.\.\./;
+var COMMENT_LINE = /^\s*(?:\/\/|#|\*|\/\*|<!--|--\s)/;
+var WORDS_ONLY = /^[A-Za-z]+(?:[-_.:][A-Za-z]+)+$/;
+var LOCAL_HOST = /^(?:localhost|127\.0\.0\.1|0\.0\.0\.0|host\.docker\.internal|\[::1\])$/i;
+function lineAt(text, index) {
+  const start = text.lastIndexOf("\n", index - 1) + 1;
+  const end = text.indexOf("\n", index);
+  return text.slice(start, end === -1 ? void 0 : end);
+}
+var assignedValue = (match) => match.match(/[:=]\s*["'`]([^"'`]*)["'`]\s*$/)?.[1] ?? match;
+function isPlaceholderSecret(m, text) {
+  if (m.patternId === "database-url") {
+    const [, password = "", host = ""] = m.value.match(/^[a-z+]+:\/\/[^:]+:([^@]*)@([^:/?]+)/i) ?? [];
+    if (/^[[<{$]|passw|pwd|secret|changeme|your|example|xxx|\*{3,}/i.test(password)) return true;
+    return LOCAL_HOST.test(host) || !host.includes(".");
+  }
+  if (m.patternId === "private-key") {
+    const body = m.value.replace(/-----[^-]+-----/g, "").replace(/\\n|\s|"/g, "");
+    return body.length < 64 || body.includes("...");
+  }
+  if (m.patternId === "generic-assignment") {
+    const value = assignedValue(m.value);
+    if (PLACEHOLDER.test(value) || WORDS_ONLY.test(value) || /^env\(/i.test(value)) return true;
+    if (COMMENT_LINE.test(lineAt(text, m.index))) return true;
+    return /^[0-9a-f]{32}$/i.test(value) && /algolia|docsearch/i.test(text);
+  }
+  return KEY_PLACEHOLDER.test(m.value);
+}
+function findLeakedSecrets(text) {
+  return findSecrets(text).filter((m) => !isPlaceholderSecret(m, text));
 }
 function maskSecret(value) {
   if (value.includes("PRIVATE KEY")) return "-----BEGIN PRIVATE KEY----- [masked]";
@@ -978,10 +1012,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path52) {
-  if (!path52)
+function getElementAtPath(obj, path55) {
+  if (!path55)
     return obj;
-  return path52.reduce((acc, key) => acc?.[key], obj);
+  return path55.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1321,11 +1355,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path52, issues) {
+function prefixIssues(path55, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path52);
+    iss.path.unshift(path55);
     return iss;
   });
 }
@@ -1775,16 +1809,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path52 = []) => {
+  const processError = (error63, path55 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path52, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path55, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path55, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path55, ...issue2.path]);
       } else {
-        const fullpath = [...path52, ...issue2.path];
+        const fullpath = [...path55, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1823,17 +1857,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path52 = []) => {
+  const processError = (error63, path55 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path52, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path55, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path55, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path55, ...issue2.path]);
       } else {
-        const fullpath = [...path52, ...issue2.path];
+        const fullpath = [...path55, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1872,8 +1906,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path52 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path52) {
+  const path55 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path55) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -3250,12 +3284,12 @@ function isIso7064Mod97(iban3) {
   let remainder = 0;
   const len = iban3.length;
   for (let i = 4; i < len; i++) {
-    const code = iban3.charCodeAt(i);
-    remainder = (code >= 65 ? remainder * 100 + (code - 55) : remainder * 10 + (code - 48)) % 97;
+    const code2 = iban3.charCodeAt(i);
+    remainder = (code2 >= 65 ? remainder * 100 + (code2 - 55) : remainder * 10 + (code2 - 48)) % 97;
   }
   for (let i = 0; i < 4; i++) {
-    const code = iban3.charCodeAt(i);
-    remainder = (code >= 65 ? remainder * 100 + (code - 55) : remainder * 10 + (code - 48)) % 97;
+    const code2 = iban3.charCodeAt(i);
+    remainder = (code2 >= 65 ? remainder * 100 + (code2 - 55) : remainder * 10 + (code2 - 48)) % 97;
   }
   return remainder === 1;
 }
@@ -13173,12 +13207,12 @@ function compileFn(schema, options) {
   doc.write(outputAccessor === null ? `return true;` : `return ${outputAccessor};`);
   const constantNames = ["INVALID", ...ctx.constants.keys()];
   const constantValues = [INVALID, ...ctx.constants.values()];
-  const code = doc.content.join("\n");
+  const code2 = doc.content.join("\n");
   const fullCode = options?.debug ? constantNames.length > 0 ? `// Constants: ${constantNames.join(", ")}
-${code}` : code : "";
+${code2}` : code2 : "";
   const F = Function;
   const factoryCode = `return (input) => {
-${code}
+${code2}
 }`;
   let fn;
   try {
@@ -16318,8 +16352,8 @@ var contributors = {
 function aggregateChecks(schema) {
   const agg = {};
   const def = schema._zod.def;
-  const list9 = schema._zod.traits.has("$ZodCheck") ? [schema, ...def.checks ?? []] : def.checks ?? [];
-  for (const ch of list9)
+  const list11 = schema._zod.traits.has("$ZodCheck") ? [schema, ...def.checks ?? []] : def.checks ?? [];
+  for (const ch of list11)
     contributors[ch._zod.def.check]?.(agg, ch._zod.def);
   const bag = schema._zod.bag;
   if (bag.minimum !== void 0)
@@ -18975,13 +19009,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path52 = ref.slice(1).split("/").filter(Boolean);
-  if (path52.length === 0) {
+  const path55 = ref.slice(1).split("/").filter(Boolean);
+  if (path55.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path52[0] === defsKey) {
-    const key = path52[1] === void 0 ? void 0 : decodeJSONPointerSegment(path52[1]);
+  if (path55[0] === defsKey) {
+    const key = path55[1] === void 0 ? void 0 : decodeJSONPointerSegment(path55[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -20189,6 +20223,29 @@ var SECURITY_3 = {
     facts: external_exports.strictObject({}),
     items: { "client-imported": modules, unguarded: modules }
   },
+  /**
+   * Supabase edge functions that use admin access or paid keys without checking the caller.
+   * `jwtOff`: `verify_jwt = false` in supabase/config.toml. Part facts: functions seen, ones with a check, ones marked aura-ignore.
+   */
+  "security.edge-functions": {
+    v: 1,
+    facts: external_exports.strictObject({ functions: count, guarded: count, ignored: count }),
+    items: {
+      "open-admin": external_exports.strictObject({ jwtOff: flag }),
+      "open-keys": external_exports.strictObject({ jwtOff: flag, keys: count })
+    }
+  },
+  /** Single-page apps (Vite): server keys and server-only packages in code that ships to the browser. */
+  "security.browser-secrets": {
+    v: 1,
+    /** `files`: browser code files looked at. */
+    facts: external_exports.strictObject({ files: count }),
+    items: {
+      "public-env": external_exports.strictObject({ names: count }),
+      "server-package": external_exports.strictObject({ packages: count }),
+      "env-example": external_exports.strictObject({ names: count })
+    }
+  },
   "security.risky-code": {
     v: 1,
     facts: external_exports.strictObject({ files: count, flaggedFiles: count }),
@@ -20412,6 +20469,12 @@ var FOUNDATIONS_1 = {
       "no-loading": external_exports.strictObject({ app: count, pages: count, routes: count })
     }
   },
+  /** Single-page apps (Vite): an error boundary, and a "page not found" route when the app has a router. */
+  "foundations.spa-errors": {
+    v: 1,
+    facts: external_exports.strictObject({ router: flag }),
+    items: { "no-error-boundary": external_exports.strictObject({}), "no-catch-all": external_exports.strictObject({}) }
+  },
   "foundations.leftovers": {
     v: 1,
     /** App files read. */
@@ -20810,9 +20873,9 @@ function run(cmd, args, opts = {}) {
       if (timer) clearTimeout(timer);
       resolve({ code: 127, stdout, stderr: stderr + String(err) });
     });
-    child.on("close", (code) => {
+    child.on("close", (code2) => {
       if (timer) clearTimeout(timer);
-      resolve({ code: code ?? 1, stdout, stderr, timedOut });
+      resolve({ code: code2 ?? 1, stdout, stderr, timedOut });
     });
     if (opts.input !== void 0) child.stdin.end(opts.input);
     else child.stdin.end();
@@ -21076,11 +21139,11 @@ var github = {
       isPrivate: Boolean(info.isPrivate),
       defaultBranch: info.defaultBranchRef?.name || "main",
       gh,
-      get: (path52) => {
-        let result = cache3.get(path52);
+      get: (path55) => {
+        let result = cache3.get(path55);
         if (!result) {
-          result = gh(["api", path52]);
-          cache3.set(path52, result);
+          result = gh(["api", path55]);
+          cache3.set(path55, result);
         }
         return result;
       }
@@ -21331,11 +21394,11 @@ var supabase = {
         return result;
       }
     };
-    const read2 = await call("GET", `/v1/projects/${ref}`);
-    if (read2.status === 401)
+    const read3 = await call("GET", `/v1/projects/${ref}`);
+    if (read3.status === 401)
       return { ok: false, problem: "Your Supabase login has expired. Run `npx supabase login`, then try again.", errorType: "CliNotSignedIn" };
-    const project = read2.json;
-    if (read2.status !== 200 || !project?.name)
+    const project = read3.json;
+    if (read3.status !== 200 || !project?.name)
       return {
         ok: false,
         // Projects created through Vercel's Supabase integration live in a Supabase account linked to Vercel.
@@ -21433,14 +21496,14 @@ var parse4 = (r) => {
 };
 var projectInfo = async (ctx) => await ctx.get(`/v9/projects/${ctx.projectId}${ctx.team}`);
 async function exposedSecrets(ctx) {
-  const list9 = await ctx.get(`/v10/projects/${ctx.projectId}/env?decrypt=true${ctx.team.replace("?", "&")}`);
-  const envs = list9?.envs ?? [];
+  const list11 = await ctx.get(`/v10/projects/${ctx.projectId}/env?decrypt=true${ctx.team.replace("?", "&")}`);
+  const envs = list11?.envs ?? [];
   return [...new Set(envs.filter((e) => PUBLIC_PREFIX.test(e.key) && (SECRET_NAME.test(e.key) || e.value && containsSecret(e.value))).map((e) => e.key))];
 }
 async function envReading(ctx) {
-  const list9 = await ctx.get(`/v10/projects/${ctx.projectId}/env${ctx.team}`);
-  if (!Array.isArray(list9?.envs)) throw new Error("Vercel didn\u2019t return the environment variables");
-  const names = (keep) => [...new Set(list9.envs?.filter(keep).map((e) => e.key))].sort();
+  const list11 = await ctx.get(`/v10/projects/${ctx.projectId}/env${ctx.team}`);
+  if (!Array.isArray(list11?.envs)) throw new Error("Vercel didn\u2019t return the environment variables");
+  const names = (keep) => [...new Set(list11.envs?.filter(keep).map((e) => e.key))].sort();
   const targets2 = (e) => Array.isArray(e.target) ? e.target : e.target ? [e.target] : [];
   return {
     production: names((e) => targets2(e).includes("production")),
@@ -21842,6 +21905,15 @@ var ENV_SERVICES = [
   [/^GOOGLE_/, "Google Cloud"],
   [/^SLACK_/, "Slack"]
 ];
+var EDGE_FUNCTION = /(?:^|\/)supabase\/functions\//;
+var SUPABASE_FUNCTION_ENV = /* @__PURE__ */ new Set([
+  "SUPABASE_URL",
+  "SUPABASE_ANON_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY",
+  "SUPABASE_DB_URL",
+  "SUPABASE_PUBLISHABLE_KEY",
+  "SUPABASE_SECRET_KEY"
+]);
 var BUILTIN_ENV = /* @__PURE__ */ new Set([
   "USERPROFILE",
   "APPDATA",
@@ -21894,15 +21966,16 @@ function inStringLiteral(text, index) {
   const top = stack.at(-1);
   return top === "'" || top === '"' || top === "`";
 }
-function findEnvRefs(files, read2) {
+function findEnvRefs(files, read3) {
   const map2 = /* @__PURE__ */ new Map();
   for (const f of files) {
     if (!isSourceFile(f) || isTestFile(f) || /(?:^|\/)(?:node_modules|\.next)\//.test(f)) continue;
-    const text = read2(f);
+    const text = read3(f);
     if (!text) continue;
     for (const m of text.matchAll(ENV_REF)) {
       const name = m[1] ?? m[2] ?? m[3] ?? m[4];
       if (!name || /[a-z]/.test(name) || BUILTIN_ENV.has(name) || inStringLiteral(text, m.index)) continue;
+      if (EDGE_FUNCTION.test(f) && SUPABASE_FUNCTION_ENV.has(name)) continue;
       const fileSet = map2.get(name);
       if (fileSet) fileSet.add(f);
       else map2.set(name, /* @__PURE__ */ new Set([f]));
@@ -21915,7 +21988,7 @@ function findEnvRefs(files, read2) {
     public: /^(?:NEXT_PUBLIC_|VITE_|EXPO_PUBLIC_|PUBLIC_)/.test(name)
   }));
 }
-function detectStack(root, files, pkg2, read2) {
+function detectStack(root, files, pkg2, read3) {
   const deps2 = allDeps(pkg2);
   const has2 = (f) => files.includes(f) || existsSync5(path6.join(root, f));
   const hasDir = (d) => files.some((f) => f.startsWith(`${d}/`));
@@ -21944,6 +22017,11 @@ function detectStack(root, files, pkg2, read2) {
     const pages = hasDir(`${base2}pages`);
     nextjs = { version: deps2.next.replace(/^[^\d]*/, ""), router: app2 && pages ? "both" : app2 ? "app" : pages ? "pages" : null, srcDir };
   }
+  const serverRendered = ["@remix-run/dev", "@react-router/dev", "@tanstack/react-start", "vike", "vite-plugin-ssr"].some((d) => deps2[d]);
+  let vite = null;
+  if (!nextjs && !serverRendered && deps2.vite && deps2.react && files.some((f) => /^vite\.config\.[cm]?[jt]s$/.test(f))) {
+    vite = { router: deps2["react-router-dom"] || deps2["react-router"] ? "react-router" : null, lovable: Boolean(deps2["lovable-tagger"]) };
+  }
   let supabase2 = null;
   if (services.has("Supabase")) {
     supabase2 = { migrationsDir: hasDir("supabase/migrations") ? "supabase/migrations" : null, hasConfig: has2("supabase/config.toml") };
@@ -21954,18 +22032,19 @@ function detectStack(root, files, pkg2, read2) {
   else if (deps2["@playwright/test"]) testRunner = "playwright";
   else if (deps2.mocha) testRunner = "mocha";
   else if (pkg2?.scripts?.test?.includes("node --test")) testRunner = "node:test";
-  const envVars = findEnvRefs(files, read2);
+  const envVars = findEnvRefs(files, read3);
   for (const v of envVars) if (v.service) services.add(v.service);
   return {
     packageManager,
     frameworks,
     services: [...services].sort(),
     nextjs,
+    vite,
     supabase: supabase2,
     typescript: has2("tsconfig.json"),
     testRunner,
     envVars,
-    recognized: Boolean(nextjs)
+    recognized: Boolean(nextjs || vite)
   };
 }
 function pmCommands(pm) {
@@ -22069,7 +22148,7 @@ function detectKind(input2) {
     confidence,
     evidence: [...why, ...evidence]
   });
-  const fw = (list9) => frameworks.find((f) => list9.includes(f));
+  const fw = (list11) => frameworks.find((f) => list11.includes(f));
   if (deps2.expo || deps2["react-native"] || deps2["@capacitor/core"] || files.includes("pubspec.yaml"))
     return done2("mobile-app", "high", fw(["Expo", "React Native", "Capacitor"]) ?? input2.label("pubspec.yaml"));
   if (deps2.electron || deps2["@tauri-apps/api"]) return done2("desktop-app", "high", deps2.electron ? "Electron" : "Tauri");
@@ -22179,9 +22258,9 @@ var LANGUAGE_FILES = [
 function detectLanguage(files) {
   return LANGUAGE_FILES.find(([re]) => files.some((f) => re.test(f)))?.[1] ?? null;
 }
-function scopeFor(root, dir, files, read2, rootFiles) {
+function scopeFor(root, dir, files, read3, rootFiles) {
   const abs = packageFolder(root, dir);
-  const readHere = (f) => read2(inDir(dir, f));
+  const readHere = (f) => read3(inDir(dir, f));
   const pkg2 = files.includes("package.json") ? parseJson(readHere("package.json")) : null;
   const stack = detectStack(abs, files, pkg2, readHere);
   const seen = existsSync6(path8.join(abs, ".vercel", "project.json")) ? [...files, ".vercel/project.json"] : files;
@@ -22209,13 +22288,13 @@ function scopeFor(root, dir, files, read2, rootFiles) {
     read: readHere
   };
 }
-function detectProjects(root, files, read2, overrides = []) {
-  const dirs = findProjectDirs({ files, read: read2 });
+function detectProjects(root, files, read3, overrides = []) {
+  const dirs = findProjectDirs({ files, read: read3 });
   let projects;
-  if (dirs.length === 1 && dirs[0] === ".") projects = [scopeFor(root, ".", files, read2, files)];
+  if (dirs.length === 1 && dirs[0] === ".") projects = [scopeFor(root, ".", files, read3, files)];
   else {
-    projects = dirs.map((d) => scopeFor(root, d, filesIn(files, d), read2, files));
-    const rootScope = scopeFor(root, ".", filesIn(files, ".", dirs), read2, files);
+    projects = dirs.map((d) => scopeFor(root, d, filesIn(files, d), read3, files));
+    const rootScope = scopeFor(root, ".", filesIn(files, ".", dirs), read3, files);
     if (rootScope.profile.kind !== "unknown" || overrides.some((o) => o.path === ".")) projects.unshift(rootScope);
   }
   for (const p2 of projects)
@@ -22244,8 +22323,8 @@ function applyOverride(profile, o) {
     profile.evidence = ["set in .aura/config.json", ...profile.evidence];
   }
 }
-function setKindOverride(overrides = [], path52, kind) {
-  const at = normPath(path52);
+function setKindOverride(overrides = [], path55, kind) {
+  const at = normPath(path55);
   const rest = overrides.filter((o) => normPath(o.path) !== at);
   const existing = overrides.find((o) => normPath(o.path) === at);
   const next = { ...existing, path: at, kind };
@@ -22284,7 +22363,7 @@ function describeProject(p2) {
 // package.json
 var package_default = {
   name: "getaura",
-  version: "0.4.0",
+  version: "0.5.0",
   description: "Aura helps you and your coding agent follow best practices while you vibe code.",
   type: "module",
   bin: {
@@ -22404,6 +22483,7 @@ function templateVars(root, scan, pkg2, extra = {}) {
       "  ",
       " "
     ),
+    scan.stack.vite && `- Vite + React single-page app${scan.stack.vite.router ? " with React Router" : ""}${scan.stack.vite.lovable ? " (built with Lovable)" : ""}`,
     scan.stack.typescript && "- TypeScript",
     ...scan.stack.services.filter((s) => s !== "GitHub").map((s) => `- ${s}`),
     scan.stack.testRunner && `- Tests: ${scan.stack.testRunner}`,
@@ -22435,7 +22515,8 @@ function templateVars(root, scan, pkg2, extra = {}) {
     aura_version: AURA_VERSION,
     setup_node_cache: pm === "bun" ? "" : pm,
     dependabot_ecosystem: pm === "bun" ? "bun" : "npm",
-    src_alias_path: scan.stack.nextjs?.srcDir ? "src" : ".",
+    // Vite apps (Lovable, Bolt, v0) point "@/" at src/.
+    src_alias_path: scan.stack.nextjs?.srcDir || scan.stack.vite ? "src" : ".",
     details: "",
     ...extra
   };
@@ -22532,6 +22613,22 @@ var SECURITY_ACTIONS = [
     resolves: ["security.supabase-code"],
     instructions: "Fix the Supabase problems listed in the findings, one concern per pull request (browser code, public variables, storage buckets, database functions). 1) Admin access in browser code: move every use of the service role or secret key, `createAdminClient()`, `supabaseAdmin`, `auth.admin` or `createClient(url, serviceKey)` out of `'use client'` files, `components/`, `hooks/` and Vite or Create React App `src/` code into server-only modules (a route handler, a server action or a `lib/` module that starts with `import 'server-only'`). Do the sign-in and permission check on the server first, then make the browser call that route or action. The browser keeps using the anon or publishable key, with row-level security protecting the data. 2) Secrets under public names: rename every `NEXT_PUBLIC_`, `VITE_` or `EXPO_PUBLIC_` variable whose name contains SERVICE_ROLE or SECRET to a server-only name (for example `SUPABASE_SERVICE_ROLE_KEY`), use it only in server code, and update `.env.example` (name and comment, no value). Say clearly in the pull request that the key must be replaced in the Supabase dashboard and in the hosting settings because it may already be public (`aura guide rotate-supabase-key`), since Aura can\u2019t do that for the user. 3) Public storage buckets: for buckets that hold private files, make them private in a NEW migration (`update storage.buckets set public = false where id = \u2026`), add storage policies on `storage.objects` scoped to the owner, and serve files through signed URLs (`createSignedUrl`) from server code. Leave buckets that are meant to be public (avatars, logos, marketing images) as they are and list them in the pull request. 4) Database functions: in a NEW migration (never edit an applied one), add `set search_path = ''` to each `security definer` function listed (`alter function public.name(args) set search_path = '';` or a `create or replace` with fully qualified names such as `public.profiles`), and revoke `anon` or `public` execute where signed-out visitors don't need it (`revoke execute on function public.name(args) from anon, public;`). Never touch `.env` files, never deploy, never change database data and never write a key value anywhere. Keep the app working the same way for signed-in users. Run the tests, lint, type check and build before finishing, and explain each change in plain language."
   },
+  {
+    id: "protect-edge-functions",
+    title: "Check who is calling each edge function",
+    category: "security",
+    delivery: "agent-fix",
+    resolves: ["security.edge-functions"],
+    instructions: "For each Supabase edge function in the findings (`supabase/functions/<name>/index.ts`, Deno), add a check on who is calling before it does anything else. If the app calls it for a signed-in user: read the `Authorization` header, create a client with the anon key and that header, call `supabase.auth.getUser()`, and answer 401 with a plain JSON error when there is no user; then check that user is allowed to touch the records involved. Keep the service role client only for the steps that truly need it, after the check. If it is a webhook: verify the sender\u2019s signature with the provider\u2019s official helper (for Stripe `stripe.webhooks.constructEventAsync` with the raw body). If it is a scheduled or internal job: compare the `Authorization` header with a secret read by `Deno.env.get(...)` and answer 401 otherwise. Put a check used by several functions in `supabase/functions/_shared/` once. Don\u2019t change `verify_jwt` in `supabase/config.toml` without saying so, never put a key value in code, and never deploy. Run the type check and any tests. In the pull request, explain in plain words who can call each function now, and tell the user to deploy the functions (`supabase functions deploy`) and to add any new secret with `supabase secrets set NAME=...`."
+  },
+  {
+    id: "move-secrets-to-server",
+    title: "Move server keys out of the browser",
+    category: "security",
+    delivery: "agent-fix",
+    resolves: ["security.browser-secrets"],
+    instructions: "This is a single-page app: everything in `src/` is downloaded by every visitor. For each file in the findings, move the code that needs a server key or a server-only package out of the browser. If the app uses Supabase, put it in a Supabase edge function (`supabase/functions/<name>/index.ts`, Deno) that reads the key with `Deno.env.get(...)`, checks the signed-in user from the `Authorization` header with `supabase.auth.getUser()` before doing anything, validates its input, and answers with plain JSON; call it from the app with `supabase.functions.invoke('<name>', { body })`. Without Supabase, use the hosting provider's server functions (for example a Vercel function in `api/`). Rename each variable without the `VITE_` prefix, remove it from browser code and from `.env.example` (list the new server-side name there with a comment, no value), and use the browser package instead where one exists (for example `@stripe/stripe-js` for Stripe Checkout). Never put a key value in code and never touch `.env` files. Run the type check, lint and build before finishing. In the pull request, tell the user in plain words that each key was public in any deployed version, so they must rotate it in that service's dashboard and add the new key as an edge function secret (`supabase secrets set NAME=...`) or in their hosting settings."
+  },
   {
     id: "add-server-only-guards",
     title: "Guard server code with server-only",
@@ -22698,11 +22795,21 @@ var ACTIONS = [
     delivery: "guide",
     resolves: ["foundations.migrations-in-sync"]
   },
+  {
+    id: "add-error-boundary",
+    title: "Add an error screen and a \u201Cpage not found\u201D page",
+    category: "foundations",
+    delivery: "pr",
+    stacks: ["vite"],
+    resolves: ["foundations.spa-errors"],
+    instructions: 'This is a single-page app (Vite + React). Wrap the whole app in an error boundary (a class component with `getDerivedStateFromError`, or `react-error-boundary` if it is already installed) that shows a friendly message and a \u201CReload the page\u201D button instead of a blank screen, and logs the error to the console only. If the app uses React Router and has no catch-all route, add `<Route path="*" element={<NotFound />} />` as the last route, with a simple \u201Cpage not found\u201D page that links home. Match the app\u2019s existing styling (Tailwind classes and theme colours if it uses them). Run the type check, lint and build before finishing.'
+  },
   {
     id: "add-error-pages",
     title: "Add friendly error and \u201Cpage not found\u201D pages",
     category: "foundations",
     delivery: "pr",
+    stacks: ["nextjs"],
     resolves: ["foundations.error-pages"],
     // Used when the PR falls back to an agent fix (no Next.js app at the repo root) or for an existing error page that isn't a client component.
     instructions: 'Add the missing Next.js App Router error pages listed in the findings, in each app\u2019s `app` (or `src/app`) folder: `error.tsx` (a client component starting with `\'use client\'`, receiving `{ error, reset }`, showing a plain-language "Something went wrong" message and a "Try again" button that calls `reset()`), `global-error.tsx` (the same, but rendering its own `<html>` and `<body>` with inline styles, because the root layout and its stylesheet are not loaded there), and `not-found.tsx` (a "Page not found" message with a link to the home page). Use `.jsx` in apps written in JavaScript. Style them with the classes and theme colours the app already uses (Tailwind classes if the app uses Tailwind), and never hardcode new colours. Never show `error.message`, stack traces or other technical details to visitors; showing `error.digest` as a reference code is fine. If an existing `error` or `global-error` file doesn\u2019t start with `\'use client\'`, add that line at the top and change nothing else in it. Never replace or rewrite other existing files. Don\u2019t add loading states here (that is the `add-loading-states` fix). Run the type check, lint, tests and build, and explain in plain language what visitors will now see.'
@@ -22735,8 +22842,8 @@ var ACTIONS = [
     resolves: ["structure.local-files"]
   },
   { id: "save-aura-setup", buildSafe: true, title: "Save Aura\u2019s setup in git", category: "agent-setup", delivery: "pr", resolves: ["agent.setup-saved"] },
-  { id: "remove-dead-files", title: "Remove dead files", category: "structure", delivery: "pr", resolves: ["structure.dead-files"] },
-  { id: "move-misplaced-files", title: "Move misplaced files", category: "structure", delivery: "pr", resolves: ["structure.layout"] },
+  { id: "remove-dead-files", title: "Remove dead files", category: "structure", delivery: "pr", stacks: ["nextjs"], resolves: ["structure.dead-files"] },
+  { id: "move-misplaced-files", title: "Move misplaced files", category: "structure", delivery: "pr", stacks: ["nextjs"], resolves: ["structure.layout"] },
   {
     id: "split-oversized-files",
     title: "Split oversized files",
@@ -22840,6 +22947,10 @@ var EFFORT = { pr: "one-click", "agent-fix": "review-agent-fix", guide: "follow-
 function effortLabel(e) {
   return { "one-click": "One click", "review-agent-fix": "Agent fix to review", "follow-guide": "Guide to follow", "answer-questions": "A few questions" }[e];
 }
+function templateStack(stack) {
+  if (!stack.recognized) return null;
+  return stack.nextjs ? "nextjs" : stack.vite ? "vite" : null;
+}
 function effectiveDelivery(action2, scan) {
   if (action2.delivery !== "pr") return { delivery: action2.delivery, fellBack: false };
   if (action2.buildSafe) return { delivery: "pr", fellBack: false };
@@ -22847,7 +22958,9 @@ function effectiveDelivery(action2, scan) {
     return { delivery: "pr", fellBack: false };
   }
   const inProject = (scan.checks ?? []).some((c) => c.findings.some((f) => f.actionId === action2.id && f.meta?.project));
-  const recognized = scan.stack.recognized && !inProject && (!action2.needsSupabase || scan.stack.supabase !== null);
+  const stack = templateStack(scan.stack);
+  const fits2 = stack !== null && (!action2.stacks || action2.stacks.includes(stack));
+  const recognized = fits2 && !inProject && (!action2.needsSupabase || scan.stack.supabase !== null);
   return recognized ? { delivery: "pr", fellBack: false } : { delivery: "agent-fix", fellBack: true };
 }
 function commandFor(actionId, delivery) {
@@ -22979,8 +23092,8 @@ function nextSteps(scan, opts = {}) {
 }
 
 // src/actions/generators.ts
-import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
-import path22 from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync13 } from "fs";
+import path24 from "path";
 
 // src/checks/agent-setup.ts
 import { existsSync as existsSync10, readdirSync as readdirSync4 } from "fs";
@@ -23011,10 +23124,10 @@ function parseJson2(text) {
     return null;
   }
 }
-function permissionList(settings, list9) {
+function permissionList(settings, list11) {
   const perms = settings?.permissions;
   if (!perms || typeof perms !== "object") return [];
-  const value = perms[list9];
+  const value = perms[list11];
   return Array.isArray(value) ? value.filter((v) => typeof v === "string").map((v) => v.trim()) : [];
 }
 function globRegex(glob) {
@@ -23112,25 +23225,25 @@ function dangerousSettings(root, tracked) {
 }
 function describeDanger(d) {
   const agent = AGENT_LABELS[d.agent];
-  const list9 = d.settings.map((s) => `\`${s}\``).join(", ");
+  const list11 = d.settings.map((s) => `\`${s}\``).join(", ");
   if (d.kind === "bypass" && d.agent === "codex")
     return {
       title: "Codex runs every command with full access and never asks",
-      detail: `${d.file} sets ${list9}, so Codex can change any file on the computer and use the internet without asking first.`
+      detail: `${d.file} sets ${list11}, so Codex can change any file on the computer and use the internet without asking first.`
     };
   if (d.kind === "bypass")
     return {
       title: `${agent} is set to skip every permission prompt`,
-      detail: `${d.file} sets ${list9}. Recent versions of ${agent} ignore this in shared project settings, but older ones run every command and edit without asking.`
+      detail: `${d.file} sets ${list11}. Recent versions of ${agent} ignore this in shared project settings, but older ones run every command and edit without asking.`
     };
   if (d.kind === "all-shell")
     return {
       title: `${agent} can run any terminal command without asking`,
-      detail: `${d.file} allows ${list9}, which approves every terminal command in advance.`
+      detail: `${d.file} allows ${list11}, which approves every terminal command in advance.`
     };
   return {
     title: `${agent} can run risky commands without asking`,
-    detail: `${d.file} approves ${list9} in advance: deleting files, pushing code, downloading from the internet or running as administrator, with no prompt.`
+    detail: `${d.file} approves ${list11} in advance: deleting files, pushing code, downloading from the internet or running as administrator, with no prompt.`
   };
 }
 var KNOWN_AGENTS = new Set(AGENT_IDS);
@@ -23294,7 +23407,7 @@ var localFiles = {
     if (!problems) return { facts: { gitAnswered: false }, items: [] };
     if (problems.length === 0) return { facts: { gitAnswered: true }, items: [] };
     const committed = problems.flatMap((p2) => p2.committed);
-    const list9 = problems.map(
+    const list11 = problems.map(
       (p2) => `${p2.what} (${[...p2.committed, ...p2.notIgnored].slice(0, 3).join(", ")}): add \`${p2.rule}\` to .gitignore${p2.committed.length ? " and stop tracking them" : ""}`
     ).join("; ");
     const item = {
@@ -23302,7 +23415,7 @@ var localFiles = {
       facts: { committed: committed.length, kinds: problems.length },
       key: "local-files",
       locations: [{ file: ".gitignore" }],
-      vars: { list: list9 }
+      vars: { list: list11 }
     };
     return { facts: { gitAnswered: true }, items: [item] };
   }
@@ -23495,10 +23608,10 @@ function parseImports(text) {
 function stripJsonc(text) {
   return text.replace(/("(?:[^"\\]|\\.)*")|\/\/[^\n]*|\/\*[\s\S]*?\*\//g, (_m, str) => str ?? "").replace(/,(\s*[}\]])/g, "$1");
 }
-function readAliases(read2) {
+function readAliases(read3) {
   const entries = [];
   for (const file2 of ["tsconfig.json", "jsconfig.json"]) {
-    const text = read2(file2);
+    const text = read3(file2);
     if (!text) continue;
     try {
       const json2 = JSON.parse(stripJsonc(text));
@@ -23537,13 +23650,13 @@ function entryPoints(files, pkgScripts = {}) {
     (f) => isSourceFile(f) && (isNextRouteFile(f) || /^(?:src\/)?pages\//.test(f) || /^(?:src\/)?(?:middleware|proxy|instrumentation(?:-client)?)\.[cm]?[jt]s$/.test(f) || /^[^/]+\.config\.[cm]?[jt]s$/.test(f) || /^(?:scripts|supabase\/functions|e2e|\.github)\//.test(f) || isTestFile(f) || /(?:^|\/)(?:setup|vitest\.setup|jest\.setup)\.[cm]?[jt]sx?$/.test(f) || scripts.includes(f))
   );
 }
-function buildGraph(files, read2, aliases) {
+function buildGraph(files, read3, aliases) {
   const source = files.filter(isSourceFile);
   const fileSet = new Set(files);
   const edges = /* @__PURE__ */ new Map();
   for (const f of source) {
     const deps2 = /* @__PURE__ */ new Set();
-    for (const ref of parseImports(read2(f) ?? "")) {
+    for (const ref of parseImports(read3(f) ?? "")) {
       const target = resolveImport(f, ref.specifier, fileSet, aliases);
       if (target) deps2.add(target);
     }
@@ -23551,9 +23664,9 @@ function buildGraph(files, read2, aliases) {
   }
   return { source, edges };
 }
-function unreachableFiles(files, read2, pkgScripts) {
-  const aliases = readAliases(read2);
-  const { source, edges } = buildGraph(files, read2, aliases);
+function unreachableFiles(files, read3, pkgScripts) {
+  const aliases = readAliases(read3);
+  const { source, edges } = buildGraph(files, read3, aliases);
   const seen = /* @__PURE__ */ new Set();
   const stack = entryPoints(files, pkgScripts);
   while (stack.length) {
@@ -24109,15 +24222,526 @@ var addErrorPages = ({ root, ctx }) => {
   return { changes, details: [...details, ...notes.length ? ["", "**Not in this PR**", ...notes] : []] };
 };
 
-// src/actions/git-hygiene.ts
-import { readFileSync as readFileSync10 } from "fs";
+// src/actions/spa-fixes.ts
+import { existsSync as existsSync14 } from "fs";
 import path20 from "path";
+
+// src/core/code-text.ts
+var REGEX_BEFORE = /[(,=:[!&|?{};+\-*%~^]/;
+var REGEX_KEYWORD = /\b(?:return|typeof|case|in|of|void|yield|await|delete|throw|new)$/;
+function maskCode(src) {
+  const out = src.split("");
+  const blank = (from, to) => {
+    for (let k = from; k < to && k < out.length; k++) if (out[k] !== "\n") out[k] = " ";
+  };
+  const n = src.length;
+  const stack = [];
+  let depth = 0;
+  let inTemplate = false;
+  let i = 0;
+  while (i < n) {
+    const c = src[i];
+    if (inTemplate) {
+      if (c === "\\") {
+        blank(i, i + 2);
+        i += 2;
+      } else if (c === "`") {
+        inTemplate = false;
+        i++;
+      } else if (c === "$" && src[i + 1] === "{") {
+        stack.push(depth++);
+        inTemplate = false;
+        i += 2;
+      } else {
+        blank(i, i + 1);
+        i++;
+      }
+      continue;
+    }
+    const next = src[i + 1];
+    if (c === "/" && next === "/") {
+      const end = src.indexOf("\n", i);
+      const e = end < 0 ? n : end;
+      blank(i, e);
+      i = e;
+    } else if (c === "/" && next === "*") {
+      const end = src.indexOf("*/", i + 2);
+      const e = end < 0 ? n : end + 2;
+      blank(i, e);
+      i = e;
+    } else if (c === '"' || c === "'") {
+      let j = i + 1;
+      while (j < n && src[j] !== c && src[j] !== "\n") j += src[j] === "\\" ? 2 : 1;
+      blank(i + 1, j);
+      i = j + 1;
+    } else if (c === "`") {
+      inTemplate = true;
+      i++;
+    } else if (c === "/" && regexCanStart(out, i)) {
+      let j = i + 1;
+      let inClass = false;
+      while (j < n && src[j] !== "\n" && (src[j] !== "/" || inClass)) {
+        if (src[j] === "\\") j++;
+        else if (src[j] === "[") inClass = true;
+        else if (src[j] === "]") inClass = false;
+        j++;
+      }
+      if (src[j] === "/") {
+        blank(i + 1, j);
+        i = j + 1;
+      } else i++;
+    } else {
+      if (c === "{") depth++;
+      else if (c === "}") {
+        depth--;
+        if (stack.length && stack[stack.length - 1] === depth) {
+          stack.pop();
+          inTemplate = true;
+        }
+      }
+      i++;
+    }
+  }
+  return out.join("");
+}
+function regexCanStart(out, i) {
+  let k = i - 1;
+  while (k >= 0 && /\s/.test(out[k] ?? "")) k--;
+  if (k < 0) return true;
+  const prev = out[k] ?? "";
+  if (REGEX_BEFORE.test(prev)) return true;
+  return REGEX_KEYWORD.test(out.slice(Math.max(0, k - 7), k + 1).join(""));
+}
+function closingIndex(masked, open2, limit = 4e3) {
+  let depth = 0;
+  const end = Math.min(masked.length, open2 + limit);
+  for (let i = open2; i < end; i++) {
+    const c = masked[i];
+    if (c === "(" || c === "[" || c === "{") depth++;
+    else if (c === ")" || c === "]" || c === "}") {
+      depth--;
+      if (depth === 0) return i + 1;
+    }
+  }
+  return -1;
+}
+function lineFinder(text) {
+  const starts = [0];
+  for (let i = 0; i < text.length; i++) if (text.charCodeAt(i) === 10) starts.push(i + 1);
+  return (index) => {
+    let lo = 0;
+    let hi = starts.length - 1;
+    while (lo < hi) {
+      const mid = lo + hi + 1 >> 1;
+      if ((starts[mid] ?? 0) <= index) lo = mid;
+      else hi = mid - 1;
+    }
+    return lo + 1;
+  };
+}
+
+// src/checks/security/logs.ts
+var NOT_APP_CODE = /(?:^|\/)(?:node_modules|\.next|\.nuxt|\.svelte-kit|\.vercel|\.turbo|\.output|dist|build|out|coverage|vendor|public|generated|__generated__|__mocks__|\.aura|\.claude|\.agents|\.cursor|\.codex|\.pi)\/|\.min\.[cm]?js$|\.stories\.[cm]?[jt]sx?$|(?:^|\/)[^/]+\.config\.[cm]?[jt]s$|(?:^|\/)\.[\w-]+rc\.[cm]?js$|(?:^|\/)(?:database|supabase)\.types\.ts$/;
+function appCodeFiles(ctx) {
+  return ctx.files.filter((f) => isSourceFile(f) && !isTestFile(f) && !NOT_APP_CODE.test(f));
+}
+var LOG_CALL = /(?<![\w$])(?:console|logger|log)\s*\??\.\s*(?:log|info|debug|warn|error|trace|fatal)\s*\(/g;
+var REDACTED_CALL = /(?<![\w$.])[\w$]*(?:redact|mask|sanitiz|scrub|obfuscat)[\w$]*\s*\(/gi;
+var CHAIN = /(?<![\w$.])[A-Za-z_$][\w$]*(?:\s*\??\.\s*[A-Za-z_$][\w$]*)*/g;
+var SECRET_ENV = /KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE|CREDENTIAL|DATABASE_URL|POSTGRES(?:QL)?_URL|REDIS_URL|MONGO(?:DB)?_URI|CONNECTION_STRING|SALT/;
+var PUBLIC_ENV = /^(?:NEXT_PUBLIC_|VITE_|PUBLIC_|EXPO_PUBLIC_|REACT_APP_|GATSBY_)/;
+var REQUEST = /^(?:req|request|ctx|context|event)$/;
+var PRESENCE_BEFORE = /(?:typeof\s+|!\s*|Boolean\(\s*|\bas\s+|\bkeyof\s+|Object\.keys\(\s*)$/;
+var CONTENT_METHODS = /* @__PURE__ */ new Set([
+  "slice",
+  "substring",
+  "substr",
+  "toString",
+  "trim",
+  "split",
+  "padStart",
+  "padEnd",
+  "toUpperCase",
+  "toLowerCase",
+  "concat",
+  "entries",
+  "values",
+  "toJSON"
+]);
+var SECRET_NAME2 = /(token|secret|password|passwd|passphrase|(?:api|private|secret|access|service|servicerole|signing|encryption|master|client)key|authorization|authheader|cookies?|jwt|credentials?|bearer)$/;
+var NOT_A_SECRET = /hash|masked|redacted|sanitiz|prefix|hint|last4|preview/i;
+var YES_NO_OR_VERB = /^(?:is|has|show|hide|should|needs?|can|toggle|validate|verify|check|create|generate|get|set|use|missing|invalid|no|with|requires?)[A-Z_]/;
+var SECRET_STRING_KEY = /^(?:authorization|cookie|setcookie|session|sessionid|jwt|credentials?)$|(?:token|secret|password|passwd|apikey)$/;
+var PERSON = /^(?:(?:[a-z][a-zA-Z0-9]*)?(User|Session|Profile|Customer)|(user|session|profile|customer))s?$/;
+function secretKind(word) {
+  const w = word.toLowerCase();
+  if (/pass/.test(w)) return "a password";
+  if (/cookie/.test(w)) return "a cookie";
+  if (/token$/.test(w)) return "a token";
+  if (/key$/.test(w)) return "an API key";
+  if (/credential/.test(w)) return "login credentials";
+  if (/secret/.test(w)) return "a secret";
+  if (/auth/.test(w)) return "an authorization header";
+  if (/session/.test(w)) return "a session id";
+  return "a token";
+}
+function isSecretName(name) {
+  return !NOT_A_SECRET.test(name) && !YES_NO_OR_VERB.test(name) && SECRET_NAME2.test(name.toLowerCase().replace(/[_$]/g, ""));
+}
+function splitTopLevel(s) {
+  const parts = [];
+  let depth = 0;
+  let start = 0;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (c === "(" || c === "[" || c === "{") depth++;
+    else if (c === ")" || c === "]" || c === "}") depth--;
+    else if (c === "," && depth === 0) {
+      parts.push(s.slice(start, i));
+      start = i + 1;
+    }
+  }
+  parts.push(s.slice(start));
+  return parts.map((p2) => p2.trim()).filter(Boolean);
+}
+function wholeValues(expr, depth = 0) {
+  const e = expr.trim().replace(/^(?:await\s+|\.\.\.)/, "").trim();
+  if (depth > 2) return [e];
+  const json2 = e.match(/^JSON\s*\.\s*stringify\s*\(/);
+  if (json2 && closingIndex(e, json2[0].length - 1) === e.length) return wholeValues(splitTopLevel(e.slice(json2[0].length, -1))[0] ?? "", depth + 1);
+  if (e.startsWith("{") && closingIndex(e, 0) === e.length) {
+    return splitTopLevel(e.slice(1, -1)).flatMap((entry) => {
+      const colon = entry.match(/^[\w$\s]+:(?!:)/);
+      return wholeValues(colon ? entry.slice(colon[0].length) : entry, depth + 1);
+    });
+  }
+  return [e];
+}
+function analyzeLogArgs(masked, raw) {
+  const hits = [];
+  let m = masked;
+  let r = raw;
+  for (const call of masked.matchAll(REDACTED_CALL)) {
+    const end = closingIndex(masked, call.index + call[0].length - 1);
+    const to = end < 0 ? masked.length : end;
+    const pad = " ".repeat(to - call.index);
+    m = m.slice(0, call.index) + pad + m.slice(to);
+    r = r.slice(0, call.index) + pad + r.slice(to);
+  }
+  for (const chain of m.matchAll(CHAIN)) {
+    const start = chain.index;
+    const end = start + chain[0].length;
+    const before = m.slice(Math.max(0, start - 16), start);
+    const after = m.slice(end).trimStart();
+    const segments2 = chain[0].split(/\s*\??\.\s*/);
+    const last = segments2[segments2.length - 1] ?? "";
+    if (segments2.length === 1 && /[{,]\s*$/.test(before) && /^:(?!:)/.test(after)) continue;
+    if (PRESENCE_BEFORE.test(before) || last === "length" || last === "size") continue;
+    let value = segments2;
+    if (after.startsWith("(")) {
+      if (segments2.length === 1) {
+        if ((last === "headers" || last === "cookies") && !/^\(\s*\)\s*\??\.\s*(?:get|has)\s*\(/.test(after))
+          hits.push({ severity: "high", kind: last === "headers" ? "the request headers" : "the cookies" });
+        continue;
+      }
+      const receiver = segments2[segments2.length - 2] ?? "";
+      if (REQUEST.test(receiver) && /^(?:json|formData|text)$/.test(last)) {
+        hits.push({ severity: "medium", kind: last === "formData" ? "the whole form submission" : "the whole request body" });
+        continue;
+      }
+      if (!CONTENT_METHODS.has(last)) continue;
+      value = segments2.slice(0, -1);
+    }
+    const name = value[value.length - 1] ?? "";
+    const owner = value[value.length - 2] ?? "";
+    if (value[0] === "process" && value[1] === "env") {
+      if (value.length === 2 && !after.startsWith("[")) hits.push({ severity: "high", kind: "every environment variable (process.env)" });
+      else if (value.length === 3 && SECRET_ENV.test(name) && !PUBLIC_ENV.test(name) && !/^\?(?![.?])/.test(after))
+        hits.push({ severity: "high", kind: `the ${name} environment variable` });
+      continue;
+    }
+    if (after.startsWith("[")) continue;
+    if (name === "headers" && REQUEST.test(owner)) hits.push({ severity: "high", kind: "the request headers" });
+    else if (name === "body" && REQUEST.test(owner)) hits.push({ severity: "medium", kind: "the whole request body" });
+    else if (name === "formData" && value.length === 1) hits.push({ severity: "medium", kind: "the whole form submission" });
+    else if (isSecretName(name)) hits.push({ severity: "high", kind: secretKind(name) });
+  }
+  for (const key of r.matchAll(/(?:\.\s*get\s*\(|\[)\s*(['"`])([\w-]{2,40})\1\s*[)\]]/g)) {
+    const word = (key[2] ?? "").toLowerCase().replace(/[-_]/g, "");
+    if (m[key.index] !== r[key.index] || !SECRET_STRING_KEY.test(word)) continue;
+    hits.push({ severity: "high", kind: word === "authorization" ? "the authorization header" : secretKind(word) });
+  }
+  for (const arg of splitTopLevel(m)) {
+    for (const v of wholeValues(arg)) {
+      const person = v.match(/^(?:[\w$]+\s*\??\.\s*)*([\w$]+)$/)?.[1]?.match(PERSON);
+      if (person) hits.push({ severity: "medium", kind: `a whole ${(person[1] ?? person[2] ?? "user").toLowerCase()} object` });
+    }
+  }
+  return hits;
+}
+function findLogCalls(text, pattern = LOG_CALL) {
+  const src = text.replace(/\r\n/g, "\n");
+  const masked = maskCode(src);
+  const line = lineFinder(src);
+  const calls = [];
+  for (const m of masked.matchAll(new RegExp(pattern.source, "g"))) {
+    const open2 = m.index + m[0].length - 1;
+    const close = closingIndex(masked, open2);
+    calls.push({
+      index: m.index,
+      line: line(m.index),
+      masked: close < 0 ? null : masked.slice(open2 + 1, close - 1),
+      raw: close < 0 ? null : src.slice(open2 + 1, close - 1)
+    });
+  }
+  return calls;
+}
+var KINDS = { high: "secret-logs", medium: "personal-logs" };
+var logLeaks = {
+  id: "security.log-leaks",
+  category: "security",
+  title: "Logs don\u2019t leak secrets or personal data",
+  obsV: 1,
+  applies: (ctx) => appCodeFiles(ctx).length > 0,
+  observe(ctx) {
+    let logging = 0;
+    const flagged = /* @__PURE__ */ new Set();
+    const items = [];
+    for (const file2 of appCodeFiles(ctx)) {
+      const text = ctx.read(file2);
+      if (!text) continue;
+      const calls = findLogCalls(text);
+      if (calls.length === 0) continue;
+      logging++;
+      const bySeverity = /* @__PURE__ */ new Map();
+      for (const call of calls) {
+        if (call.masked === null || call.raw === null) continue;
+        for (const hit of analyzeLogArgs(call.masked, call.raw)) {
+          const lines = bySeverity.get(hit.severity) ?? /* @__PURE__ */ new Map();
+          bySeverity.set(hit.severity, lines);
+          lines.set(call.line, (lines.get(call.line) ?? /* @__PURE__ */ new Set()).add(hit.kind));
+        }
+      }
+      for (const severity2 of ["high", "medium"]) {
+        const lines = bySeverity.get(severity2);
+        if (!lines) continue;
+        flagged.add(file2);
+        const entries = [...lines.entries()].sort((a, b) => a[0] - b[0]);
+        const shown = entries.slice(0, 20);
+        const kinds = [...new Set(entries.flatMap(([, k]) => [...k]))];
+        items.push({
+          kind: KINDS[severity2],
+          facts: { more: entries.length - shown.length },
+          key: `${file2}|${severity2}`,
+          locations: shown.map(([line]) => ({ file: file2, line })),
+          // What each line logs can name the app's own variables, so it stays on this computer.
+          vars: { file: file2, lines: shown.map(([line, k]) => `Line ${line} logs ${[...k].join(" and ")}`).join("; ") },
+          meta: { kinds, lines: entries.length }
+        });
+      }
+    }
+    return { facts: { logging, flagged: flagged.size }, items };
+  }
+};
+
+// src/checks/spa-errors.ts
+var ERROR_BOUNDARY = /\bcomponentDidCatch\s*\(|\bgetDerivedStateFromError\s*\(|from\s+['"]react-error-boundary['"]|<(?:Sentry\.)?ErrorBoundary\b|\berrorElement\s*[:=]|\bErrorBoundary\s*:|export\s+(?:async\s+)?(?:function|const)\s+ErrorBoundary\b/;
+var CATCH_ALL = /\bpath\s*[:=]\s*\{?\s*['"`]\*['"`]|\bnotFoundComponent\b|\bdefaultNotFoundComponent\b/;
+function hasErrorBoundary(ctx) {
+  return appCodeFiles(ctx).some((f) => ERROR_BOUNDARY.test(ctx.read(f) ?? ""));
+}
+function hasCatchAll(ctx) {
+  return appCodeFiles(ctx).some((f) => CATCH_ALL.test(ctx.read(f) ?? ""));
+}
+function usesRouter(pkg2) {
+  const deps2 = { ...pkg2?.dependencies, ...pkg2?.devDependencies };
+  return Boolean(deps2["react-router-dom"] || deps2["react-router"] || deps2["@tanstack/react-router"]);
+}
+var spaErrors = {
+  id: "foundations.spa-errors",
+  scope: "project",
+  category: "foundations",
+  title: "Users see a friendly page when something breaks",
+  obsV: 1,
+  applies: (ctx) => Boolean(ctx.stack.vite) && ctx.project.traits.servesPages,
+  observe(ctx) {
+    const router = usesRouter(ctx.pkg);
+    const items = [];
+    const main = ctx.files.find((f) => /^src\/main\.[jt]sx?$/.test(f));
+    const app2 = ctx.files.find((f) => /^src\/App\.[jt]sx?$/.test(f));
+    if (!hasErrorBoundary(ctx)) items.push({ kind: "no-error-boundary", facts: {}, key: "error-boundary", locations: main ? [{ file: main }] : [] });
+    if (router && !hasCatchAll(ctx)) items.push({ kind: "no-catch-all", facts: {}, key: "catch-all", locations: app2 ? [{ file: app2 }] : [] });
+    return { facts: { router }, items };
+  }
+};
+
+// src/actions/spa-fixes.ts
+function addImport(text, line) {
+  const imports3 = [...text.matchAll(/^import[^\n]*\n/gm)];
+  const last = imports3.at(-1);
+  if (!last || last.index === void 0) return `${line}
+${text}`;
+  const at = last.index + last[0].length;
+  return `${text.slice(0, at)}${line}
+${text.slice(at)}`;
+}
+function addErrorBoundary({ root, ctx }) {
+  if (!ctx.stack.vite || !ctx.stack.typescript)
+    return { skip: "This template is for Vite apps written in TypeScript. Run `aura fix add-error-boundary` instead." };
+  const read3 = (f) => ctx.read(f);
+  const style = pageStyle(ctx, { dir: ".", tailwind: Boolean(allDeps(ctx.pkg).tailwindcss) });
+  const changes = [];
+  const details = [];
+  const notes = [];
+  if (!hasErrorBoundary(ctx)) {
+    const main = ctx.files.find((f) => /^src\/main\.tsx$/.test(f));
+    const text = main ? read3(main) : null;
+    const file2 = "src/components/ErrorBoundary.tsx";
+    if (!main || !text || (text.match(/<App\s*\/>/g) ?? []).length !== 1 || existsSync14(path20.join(root, file2))) {
+      notes.push("- An error boundary: `src/main.tsx` isn\u2019t in the shape Aura edits safely. Run `aura fix add-error-boundary`.");
+    } else {
+      changes.push({ path: file2, content: styled(readTemplate("vite/ErrorBoundary.tsx"), style) });
+      const wrapped = addImport(text, 'import ErrorBoundary from "./components/ErrorBoundary";').replace(
+        /<App\s*\/>/,
+        "<ErrorBoundary>\n    <App />\n  </ErrorBoundary>"
+      );
+      changes.push({ path: main, content: wrapped });
+      details.push(
+        `- \`${file2}\`: a friendly message and a \u201CReload the page\u201D button when something breaks, instead of a blank page`,
+        `- \`${main}\`: wraps the app in it`
+      );
+    }
+  }
+  if (usesRouter(ctx.pkg) && !hasCatchAll(ctx)) {
+    const app2 = ctx.files.find((f) => /^src\/App\.tsx$/.test(f));
+    const text = app2 ? read3(app2) : null;
+    const routes2 = text?.match(/\n([ \t]*)<\/Routes>/g) ?? [];
+    const page = "src/pages/NotFound.tsx";
+    const pkg2 = allDeps(ctx.pkg)["react-router-dom"] ? "react-router-dom" : "react-router";
+    if (!app2 || !text || routes2.length !== 1 || !/<Route\b/.test(text)) {
+      notes.push("- A \u201Cpage not found\u201D route: `src/App.tsx` isn\u2019t in the shape Aura edits safely. Run `aura fix add-error-boundary`.");
+    } else {
+      const indent = /\n([ \t]*)<Route\b[^\n]*\n(?![\s\S]*<Route\b)/.exec(text)?.[1] ?? "        ";
+      let updated = text.replace(/\n([ \t]*)<\/Routes>/, `
+${indent}<Route path="*" element={<NotFound />} />
+$1</Routes>`);
+      if (!/\bNotFound\b/.test(text)) updated = addImport(updated, 'import NotFound from "./pages/NotFound";');
+      if (!existsSync14(path20.join(root, page)) && !/\bNotFound\b/.test(text)) {
+        changes.push({ path: page, content: styled(readTemplate("vite/NotFound.tsx").replace('"react-router-dom"', `"${pkg2}"`), style) });
+        details.push(`- \`${page}\`: a \u201Cpage not found\u201D page with a link home`);
+      }
+      changes.push({ path: app2, content: updated });
+      details.push(`- \`${app2}\`: sends every unknown address to it`);
+    }
+  }
+  if (changes.length === 0)
+    return { skip: notes.length ? notes.join("\n").replace(/^- /gm, "") : "The app already has an error screen and a \u201Cpage not found\u201D page." };
+  return { changes, details: [...details, ...notes.length ? ["", "**Not in this PR**", ...notes] : []], verifyTypes: true };
+}
+
+// src/actions/security-headers.ts
+import { existsSync as existsSync15, readFileSync as readFileSync10 } from "fs";
+import path21 from "path";
+function read(root, file2) {
+  try {
+    return readFileSync10(path21.join(root, file2), "utf8");
+  } catch {
+    return null;
+  }
+}
+var SECURITY_HEADERS2 = [
+  ["Strict-Transport-Security", "max-age=63072000"],
+  ["X-Content-Type-Options", "nosniff"],
+  ["X-Frame-Options", "DENY"],
+  ["Referrer-Policy", "strict-origin-when-cross-origin"],
+  ["Permissions-Policy", "camera=(), microphone=(), geolocation=()"]
+];
+var HEADER_DETAILS = [
+  "- HSTS, nosniff, frame protection, referrer policy and permissions policy on every page",
+  "- No Content Security Policy yet (it often breaks apps; add it separately)"
+];
+var NEXT_HEADERS = `const securityHeaders = [
+  { key: "Strict-Transport-Security", value: "max-age=63072000" },
+  { key: "X-Content-Type-Options", value: "nosniff" },
+  { key: "X-Frame-Options", value: "DENY" },
+  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+  { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
+];
+`;
+var addSecurityHeaders = (g) => {
+  if (g.ctx.stack.vite) return addSpaSecurityHeaders(g);
+  const { root, ctx } = g;
+  const file2 = ctx.files.find((f) => /^next\.config\.[cm]?[jt]s$/.test(f));
+  if (!file2) return { skip: "No next.config file found." };
+  const text = read(root, file2);
+  if (text === null) return { skip: `Aura couldn\u2019t read ${file2}.` };
+  if (/\bheaders\s*\(/.test(text))
+    return { skip: `${file2} already has a headers() function. Run \`aura fix add-security-headers\` to have Aura\u2019s agent merge them in.` };
+  const m = text.match(/(const\s+nextConfig(?:\s*:\s*NextConfig)?\s*=\s*\{)/);
+  if (!m || m.index === void 0) return { skip: `${file2} isn\u2019t in a shape Aura can edit safely. Run \`aura fix add-security-headers\` instead.` };
+  const insertAt = m.index + m[0].length;
+  const headersFn = `
+  async headers() {
+    return [{ source: "/:path*", headers: securityHeaders }];
+  },`;
+  const withFn = text.slice(0, insertAt) + headersFn + text.slice(insertAt);
+  const content2 = withFn.replace(m[0], `${NEXT_HEADERS}
+${m[0]}`);
+  return {
+    verifyTypes: true,
+    changes: [{ path: file2, content: content2 }],
+    details: [
+      "- HSTS, nosniff, frame protection, referrer policy and permissions policy on every page",
+      "- No Content Security Policy yet (it often breaks apps; add it separately)"
+    ]
+  };
+};
+function addSpaSecurityHeaders({ root, ctx }) {
+  const deps2 = allDeps(ctx.pkg);
+  const vercel2 = ctx.files.includes("vercel.json") || ctx.stack.services.includes("Vercel");
+  const netlify = ctx.files.includes("netlify.toml") || Boolean(deps2["netlify-cli"]);
+  const cloudflare = ctx.files.some((f) => /^wrangler\.(?:toml|jsonc?)$/.test(f)) || Boolean(deps2.wrangler);
+  if (vercel2) {
+    const existing = existsSync15(path21.join(root, "vercel.json")) ? ctx.read("vercel.json") : null;
+    let config2 = {};
+    try {
+      config2 = existing ? JSON.parse(existing) : {};
+    } catch {
+      return { skip: "vercel.json isn\u2019t valid JSON, so Aura won\u2019t edit it. Run `aura fix add-security-headers`." };
+    }
+    if ("headers" in config2) return { skip: "vercel.json already has headers. Run `aura fix add-security-headers` to have Aura\u2019s agent merge them in." };
+    const headers2 = [{ source: "/(.*)", headers: SECURITY_HEADERS2.map(([key, value]) => ({ key, value })) }];
+    return {
+      changes: [{ path: "vercel.json", content: `${JSON.stringify({ ...config2, headers: headers2 }, null, 2)}
+` }],
+      details: ["- `vercel.json`:", ...HEADER_DETAILS]
+    };
+  }
+  if (netlify || cloudflare) {
+    if (existsSync15(path21.join(root, "public", "_headers")))
+      return { skip: "`public/_headers` already exists. Run `aura fix add-security-headers` to have Aura\u2019s agent merge them in." };
+    const content2 = `/*
+${SECURITY_HEADERS2.map(([k, v]) => `  ${k}: ${v}`).join("\n")}
+`;
+    return {
+      changes: [{ path: "public/_headers", content: content2 }],
+      details: [`- \`public/_headers\` (${netlify ? "Netlify" : "Cloudflare Pages"}):`, ...HEADER_DETAILS]
+    };
+  }
+  return {
+    skip: "Aura can\u2019t tell where this app is hosted, and single-page apps get their headers from the host. On Vercel or Netlify, connect the repo there and run this again. Lovable\u2019s own hosting doesn\u2019t let apps set headers yet. See `aura guide security-headers`."
+  };
+}
+
+// src/actions/git-hygiene.ts
+import { readFileSync as readFileSync11 } from "fs";
+import path22 from "path";
 var ignoreLocalFiles = async ({ root, ctx }) => {
   const problems = await localFileProblems(ctx) ?? [];
   if (problems.length === 0) return { skip: "Tool and machine files are already ignored." };
   let current2 = "";
   try {
-    current2 = readFileSync10(path20.join(root, ".gitignore"), "utf8");
+    current2 = readFileSync11(path22.join(root, ".gitignore"), "utf8");
   } catch {
   }
   const lines = new Set(current2.split(/\r?\n/).map((l) => l.trim()));
@@ -24146,17 +24770,17 @@ var saveAuraSetup = async ({ root }) => {
   const files = await unsavedSetup({ root }) ?? [];
   if (files.length === 0) return { skip: "Everything Aura set up is already committed." };
   return {
-    changes: files.map((file2) => ({ path: file2, content: readFileSync10(path20.join(root, file2), "utf8") })),
+    changes: files.map((file2) => ({ path: file2, content: readFileSync11(path22.join(root, file2), "utf8") })),
     details: files.map((f) => `- \`${f}\``)
   };
 };
 
 // src/actions/agent-files.ts
-import { existsSync as existsSync14, readFileSync as readFileSync11 } from "fs";
-import path21 from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync12 } from "fs";
+import path23 from "path";
 function current(root, file2) {
-  const full = path21.join(root, file2);
-  return existsSync14(full) ? readFileSync11(full, "utf8") : null;
+  const full = path23.join(root, file2);
+  return existsSync16(full) ? readFileSync12(full, "utf8") : null;
 }
 function upsertBlock(existing, body) {
   const block = `${AURA_BLOCK_START}
@@ -24199,12 +24823,12 @@ function skillChanges(agents2, names) {
 }
 
 // src/actions/generators.ts
-function read(root, file2) {
-  const full = path22.join(root, file2);
-  return existsSync15(full) ? readFileSync12(full, "utf8") : null;
+function read2(root, file2) {
+  const full = path24.join(root, file2);
+  return existsSync17(full) ? readFileSync13(full, "utf8") : null;
 }
 function withScripts(root, scripts, overwrite = false) {
-  const text = read(root, "package.json");
+  const text = read2(root, "package.json");
   if (!text) return null;
   const indent = text.match(/^\{\n(\s+)"/)?.[1] ?? "  ";
   const pkg2 = JSON.parse(text);
@@ -24223,14 +24847,14 @@ function findingMeta(scan, checkId, key) {
   return scan.checks.find((c) => c.checkId === checkId)?.findings[0]?.meta?.[key];
 }
 var addBrief = ({ root }) => {
-  const brief2 = BRIEF_PATHS.find((f) => existsSync15(path22.join(root, f)));
-  const briefText = brief2 ? read(root, brief2) : null;
+  const brief2 = BRIEF_PATHS.find((f) => existsSync17(path24.join(root, f)));
+  const briefText = brief2 ? read2(root, brief2) : null;
   if (!brief2 || briefText === null) return { skip: "There is no product brief yet. Run `aura init` to draft and confirm it first." };
   const changes = [
     { path: brief2, content: briefText },
     { path: ".aura/.gitignore", content: AURA_GITIGNORE }
   ];
-  const config2 = read(root, ".aura/config.json");
+  const config2 = read2(root, ".aura/config.json");
   if (config2 !== null) changes.push({ path: ".aura/config.json", content: config2 });
   return { changes, details: [`- Adds \`${brief2}\`, \`.aura/config.json\` and \`.aura/.gitignore\` (keeps Aura's local reports out of git)`] };
 };
@@ -24250,14 +24874,14 @@ var installSkills = ({ root, agents: agents2, skills: skills2 }) => {
 };
 var tokenEfficiency = (g) => {
   const changes = [];
-  if (!existsSync15(path22.join(g.root, "docs/index.md"))) changes.push({ path: "docs/index.md", content: render("docs/index.md", g.vars) });
+  if (!existsSync17(path24.join(g.root, "docs/index.md"))) changes.push({ path: "docs/index.md", content: render("docs/index.md", g.vars) });
   changes.push(...rulesChanges(g.root, g.agents, g.vars));
   return { changes, details: ["- `docs/index.md`: a map of the repo your agent reads first", "- Lean-context rules in the agent rules file"] };
 };
 var addCi = ({ root, ctx, vars }) => {
   const existing = ctx.files.filter((f) => /^\.github\/workflows\//.test(f));
   const file2 = existing.includes(".github/workflows/ci.yml") ? ".github/workflows/checks.yml" : ".github/workflows/ci.yml";
-  if (existsSync15(path22.join(root, file2))) return { skip: `${file2} already exists.` };
+  if (existsSync17(path24.join(root, file2))) return { skip: `${file2} already exists.` };
   return {
     changes: [{ path: file2, content: render("github/workflows/ci.yml", vars) }],
     details: [`- \`${file2}\`: lint, type check, tests and build on every pull request`]
@@ -24281,8 +24905,8 @@ var setupTesting = ({ root, ctx, vars }) => {
   };
 };
 var addEnvExample = ({ root, scan }) => {
-  const file2 = [".env.example", ".env.sample", ".env.template"].find((f) => existsSync15(path22.join(root, f))) ?? ".env.example";
-  const existing = read(root, file2);
+  const file2 = [".env.example", ".env.sample", ".env.template"].find((f) => existsSync17(path24.join(root, f))) ?? ".env.example";
+  const existing = read2(root, file2);
   const declared = new Set(
     (existing ?? "").split(/\r?\n/).map((l) => l.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1]).filter(Boolean)
   );
@@ -24317,11 +24941,15 @@ var addLinting = ({ root, ctx }) => {
   const changes = [];
   const devDeps = [];
   const details = [];
-  if (!hasLint) {
+  const addEslint = !hasLint && ctx.stack.nextjs !== null;
+  if (!hasLint && !addEslint && hasFormat)
+    return { skip: "Aura\u2019s ESLint template is for Next.js apps. Run `aura fix add-linting` to have Aura\u2019s agent set ESLint up for this app." };
+  if (addEslint) {
     changes.push({ path: "eslint.config.mjs", content: readTemplate("configs/eslint.config.mjs") });
     devDeps.push("eslint", "eslint-config-next");
     details.push("- ESLint with the standard Next.js rules (`lint` script)");
-  }
+  } else if (!hasLint)
+    details.push("- ESLint isn\u2019t added here: Aura\u2019s template is for Next.js. Run `aura fix add-linting` afterwards to set it up for this app.");
   if (!hasFormat) {
     changes.push(
       { path: ".prettierrc.json", content: readTemplate("configs/prettierrc.json") },
@@ -24331,14 +24959,14 @@ var addLinting = ({ root, ctx }) => {
     details.push("- Prettier (`format` and `format:check` scripts). It doesn\u2019t reformat existing files in this PR.");
   }
   const scripts = withScripts(root, {
-    ...!hasLint ? { lint: "eslint ." } : {},
+    ...addEslint ? { lint: "eslint ." } : {},
     ...!hasFormat ? { format: "prettier --write .", "format:check": "prettier --check ." } : {}
   });
   if (scripts) changes.push(scripts);
   return { changes, devDeps, details };
 };
 var addPreCommit = ({ root, ctx, vars }) => {
-  if (existsSync15(path22.join(root, ".husky/pre-commit"))) return { skip: "A husky pre-commit hook already exists." };
+  if (existsSync17(path24.join(root, ".husky/pre-commit"))) return { skip: "A husky pre-commit hook already exists." };
   const changes = [{ path: ".husky/pre-commit", content: render("configs/husky-pre-commit", vars) }];
   const scripts = withScripts(root, { prepare: "husky" }, false);
   if (scripts) changes.push(scripts);
@@ -24351,7 +24979,7 @@ var addPreCommit = ({ root, ctx, vars }) => {
 };
 var addReadme = ({ root, ctx, vars }) => {
   const file2 = ctx.files.find((f) => /^readme\.mdx?$/i.test(f)) ?? "README.md";
-  const current2 = read(root, file2);
+  const current2 = read2(root, file2);
   const boilerplate = current2 && /create-next-app|bootstrapped with/i.test(current2);
   const words2 = current2?.split(/\s+/).filter(Boolean).length ?? 0;
   if (current2 && !boilerplate && words2 >= 80) return { skip: `${file2} already describes the app.` };
@@ -24368,7 +24996,7 @@ ${current2.trim()}
   };
 };
 var enableDependencyUpdates = ({ root, vars }) => {
-  if ([".github/dependabot.yml", ".github/dependabot.yaml", "renovate.json", ".github/renovate.json"].some((f) => existsSync15(path22.join(root, f)))) {
+  if ([".github/dependabot.yml", ".github/dependabot.yaml", "renovate.json", ".github/renovate.json"].some((f) => existsSync17(path24.join(root, f)))) {
     return { skip: "Dependabot or Renovate is already configured." };
   }
   return {
@@ -24396,40 +25024,6 @@ var fixVulnerableDeps = ({ ctx, scan }) => {
     details: [...direct.map((f) => `- Upgrades \`${f}\``), ...pm === "npm" ? ["- Runs `npm audit fix` (no breaking major upgrades)"] : []]
   };
 };
-var SECURITY_HEADERS2 = `const securityHeaders = [
-  { key: "Strict-Transport-Security", value: "max-age=63072000" },
-  { key: "X-Content-Type-Options", value: "nosniff" },
-  { key: "X-Frame-Options", value: "DENY" },
-  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
-  { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
-];
-`;
-var addSecurityHeaders = ({ root, ctx }) => {
-  const file2 = ctx.files.find((f) => /^next\.config\.[cm]?[jt]s$/.test(f));
-  if (!file2) return { skip: "No next.config file found." };
-  const text = read(root, file2);
-  if (text === null) return { skip: `Aura couldn\u2019t read ${file2}.` };
-  if (/\bheaders\s*\(/.test(text))
-    return { skip: `${file2} already has a headers() function. Run \`aura fix add-security-headers\` to have Aura\u2019s agent merge them in.` };
-  const m = text.match(/(const\s+nextConfig(?:\s*:\s*NextConfig)?\s*=\s*\{)/);
-  if (!m || m.index === void 0) return { skip: `${file2} isn\u2019t in a shape Aura can edit safely. Run \`aura fix add-security-headers\` instead.` };
-  const insertAt = m.index + m[0].length;
-  const headersFn = `
-  async headers() {
-    return [{ source: "/:path*", headers: securityHeaders }];
-  },`;
-  const withFn = text.slice(0, insertAt) + headersFn + text.slice(insertAt);
-  const content2 = withFn.replace(m[0], `${SECURITY_HEADERS2}
-${m[0]}`);
-  return {
-    verifyTypes: true,
-    changes: [{ path: file2, content: content2 }],
-    details: [
-      "- HSTS, nosniff, frame protection, referrer policy and permissions policy on every page",
-      "- No Content Security Policy yet (it often breaks apps; add it separately)"
-    ]
-  };
-};
 var removeDeadFiles = ({ scan, only }) => {
   const files = (findingMeta(scan, "structure.dead-files", "files") ?? []).filter((f) => !only || only.includes(f));
   if (files.length === 0) return { skip: "No dead files found." };
@@ -24448,7 +25042,7 @@ function planMoves(ctx, moves) {
       const alias = aliasFor(toFile);
       if (alias) return alias[0] + noExt.slice(alias[1].length);
     }
-    let rel = path22.posix.relative(path22.posix.dirname(fromFile), noExt);
+    let rel = path24.posix.relative(path24.posix.dirname(fromFile), noExt);
     if (!rel.startsWith(".")) rel = `./${rel}`;
     return rel;
   };
@@ -24482,7 +25076,7 @@ function planMoves(ctx, moves) {
 }
 var moveMisplacedFiles = ({ root, ctx, scan, only }) => {
   const raw = findingMeta(scan, "structure.layout", "moves") ?? [];
-  const moves = raw.map((m) => m.split("=>")).filter(([from, to]) => !existsSync15(path22.join(root, to)) && (!only || only.includes(from))).slice(0, MAX_MOVES);
+  const moves = raw.map((m) => m.split("=>")).filter(([from, to]) => !existsSync17(path24.join(root, to)) && (!only || only.includes(from))).slice(0, MAX_MOVES);
   if (moves.length === 0) return { skip: "No files to move (or their targets already exist)." };
   return { changes: planMoves(ctx, moves), details: moves.map(([from, to]) => `- \`${from}\` \u2192 \`${to}\``), verifyTypes: true };
 };
@@ -24490,7 +25084,7 @@ var addAuraWorkflow = ({ root, vars }) => {
   const changes = [];
   for (const name of ["aura.yml", "aura-weekly.yml"]) {
     const content2 = render(`github/workflows/${name}`, vars);
-    if (read(root, `.github/workflows/${name}`) !== content2) changes.push({ path: `.github/workflows/${name}`, content: content2 });
+    if (read2(root, `.github/workflows/${name}`) !== content2) changes.push({ path: `.github/workflows/${name}`, content: content2 });
   }
   if (changes.length === 0) return { skip: "The Aura workflows are already installed and up to date." };
   return {
@@ -24522,7 +25116,8 @@ var GENERATORS = {
   "ignore-local-files": ignoreLocalFiles,
   "save-aura-setup": saveAuraSetup,
   "protect-agent-secrets": protectAgentSecrets,
-  "add-error-pages": addErrorPages
+  "add-error-pages": addErrorPages,
+  "add-error-boundary": addErrorBoundary
 };
 
 // src/actions/foundation.ts
@@ -24544,7 +25139,7 @@ async function foundationPlan(g) {
 }
 
 // src/actions/large-change.ts
-import { existsSync as existsSync16, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync14 } from "fs";
 
 // src/ui.ts
 import * as p from "@clack/prompts";
@@ -24729,9 +25324,9 @@ function writePlanFile(root, plan) {
 }
 function readProgress(root, actionId, now = Date.now()) {
   const file2 = auraPath(root, "plans", `${actionId}.json`);
-  if (!existsSync16(file2)) return { started: [] };
+  if (!existsSync18(file2)) return { started: [] };
   try {
-    const data = JSON.parse(readFileSync13(file2, "utf8"));
+    const data = JSON.parse(readFileSync14(file2, "utf8"));
     const started = Array.isArray(data.started) ? data.started : [];
     return { started: started.filter((s) => Array.isArray(s.files) && now - Date.parse(s.at) < PROGRESS_TTL_MS) };
   } catch {
@@ -24784,16 +25379,16 @@ function afterChunkMessage(plan, next) {
 }
 
 // src/fix-tracking.ts
-import { existsSync as existsSync17, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync15 } from "fs";
 
 // src/api/usage.ts
 import { createHash } from "crypto";
 
 // src/api/client.ts
 var AuraApiError = class extends Error {
-  constructor(code, message) {
+  constructor(code2, message) {
     super(message);
-    this.code = code;
+    this.code = code2;
   }
   code;
 };
@@ -24829,7 +25424,7 @@ var AuraClient = class _AuraClient {
   get hasKey() {
     return Boolean(this.key);
   }
-  async request(method, path52, body, timeoutMs = 6e4) {
+  async request(method, path55, body, timeoutMs = 6e4) {
     if (!this.key) throw new AuraApiError("no_key", "No pilot key");
     let payload;
     if (body !== void 0) {
@@ -24839,7 +25434,7 @@ var AuraClient = class _AuraClient {
     }
     let res;
     try {
-      res = await fetch(`${this.baseUrl}/v1/${path52}`, {
+      res = await fetch(`${this.baseUrl}/v1/${path55}`, {
         method,
         headers: { authorization: `Bearer ${this.key}`, "content-type": "application/json", "user-agent": `getaura/${AURA_VERSION}` },
         body: payload,
@@ -24856,8 +25451,8 @@ var AuraClient = class _AuraClient {
     }
     if (!res.ok) {
       const error62 = json2?.error;
-      const code = error62?.code ?? (res.status === 401 ? "unauthorized" : res.status === 402 ? "cap_reached" : "model_error");
-      throw new AuraApiError(code, error62?.message ?? `HTTP ${res.status}`);
+      const code2 = error62?.code ?? (res.status === 401 ? "unauthorized" : res.status === 402 ? "cap_reached" : "model_error");
+      throw new AuraApiError(code2, error62?.message ?? `HTTP ${res.status}`);
     }
     return json2;
   }
@@ -24923,7 +25518,7 @@ var MAX_AGE_MS = 60 * 24 * 60 * 60 * 1e3;
 var MAX_CHECKS_PER_SCAN = 5;
 function loadTrackedFixes(root) {
   try {
-    return existsSync17(auraPath(root, FILE)) ? JSON.parse(readFileSync14(auraPath(root, FILE), "utf8")) : [];
+    return existsSync19(auraPath(root, FILE)) ? JSON.parse(readFileSync15(auraPath(root, FILE), "utf8")) : [];
   } catch {
     return [];
   }
@@ -25000,11 +25595,11 @@ async function recordAction(root, config2, actionId, report, startedAt, via) {
 
 // src/scan.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync21, readFileSync as readFileSync19 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync20 } from "fs";
 
 // src/api/assess.ts
 import { createHash as createHash4 } from "crypto";
-import { readFileSync as readFileSync18 } from "fs";
+import { readFileSync as readFileSync19 } from "fs";
 
 // src/checks/foundations.ts
 import YAML4 from "yaml";
@@ -25400,12 +25995,12 @@ function i18nInfo(ctx) {
   const briefFile = BRIEF_PATHS.map((p2) => ctx.read(p2)).find((t) => t !== null);
   const brief2 = briefFile ? briefLanguageSignals(briefFile) : { multilingual: false, rtl: false };
   if (brief2.multilingual) reasons.push("the brief says the app supports several languages");
-  const list9 = [...locales].sort();
-  return { reasons, library, locales: list9, defaultLocale, rtl: brief2.rtl || list9.some(isRtlLocale), messages };
+  const list11 = [...locales].sort();
+  return { reasons, library, locales: list11, defaultLocale, rtl: brief2.rtl || list11.some(isRtlLocale), messages };
 }
 
 // src/checks/ui-files.ts
-import path23 from "path";
+import path25 from "path";
 var UI_FILE = /\.(?:tsx|jsx|vue|svelte|css|scss|less)$/;
 var STYLE_FILE = /\.(?:css|scss|less)$/;
 var SCRIPT_FILE = /\.[cm]?[jt]sx?$/;
@@ -25418,7 +26013,7 @@ function nameWords(stem) {
   return stem.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
 }
 function exclusionReason(file2, text) {
-  const base2 = path23.posix.basename(file2);
+  const base2 = path25.posix.basename(file2);
   const stem = base2.replace(/\.[^.]+$/, "").replace(/\.module$/, "");
   const dirs = file2.split("/").slice(0, -1);
   if (isTestFile(file2) || /\.stories\.[cm]?[jt]sx?$/.test(file2)) return "test";
@@ -25466,7 +26061,7 @@ function zoomBlocks(text) {
   return n;
 }
 var MAX_LISTED = 20;
-var KINDS = ["image-alt", "field-label", "click-keyboard", "control-name", "link-button", "positive-tabindex", "page-lang", "zoom"];
+var KINDS2 = ["image-alt", "field-label", "click-keyboard", "control-name", "link-button", "positive-tabindex", "page-lang", "zoom"];
 var CERTAIN = /* @__PURE__ */ new Set(["page-lang", "zoom"]);
 function listCounts(items, withCounts) {
   const shown = items.slice(0, MAX_LISTED).map((i) => withCounts ? `${i.file} (${i.count})` : i.file);
@@ -25496,7 +26091,7 @@ var accessibility = {
     }
     if (i18nInfo(ctx).reasons.length === 0) for (const file2 of missingLang(ctx)) add("page-lang", file2, 1);
     const items = [];
-    for (const kind of KINDS) {
+    for (const kind of KINDS2) {
       const found = (perKind.get(kind) ?? []).sort((a, b) => b.count - a.count || a.file.localeCompare(b.file));
       if (found.length === 0) continue;
       const total2 = found.reduce((s, i) => s + i.count, 0);
@@ -25520,120 +26115,6 @@ var accessibility = {
   }
 };
 
-// src/core/code-text.ts
-var REGEX_BEFORE = /[(,=:[!&|?{};+\-*%~^]/;
-var REGEX_KEYWORD = /\b(?:return|typeof|case|in|of|void|yield|await|delete|throw|new)$/;
-function maskCode(src) {
-  const out = src.split("");
-  const blank = (from, to) => {
-    for (let k = from; k < to && k < out.length; k++) if (out[k] !== "\n") out[k] = " ";
-  };
-  const n = src.length;
-  const stack = [];
-  let depth = 0;
-  let inTemplate = false;
-  let i = 0;
-  while (i < n) {
-    const c = src[i];
-    if (inTemplate) {
-      if (c === "\\") {
-        blank(i, i + 2);
-        i += 2;
-      } else if (c === "`") {
-        inTemplate = false;
-        i++;
-      } else if (c === "$" && src[i + 1] === "{") {
-        stack.push(depth++);
-        inTemplate = false;
-        i += 2;
-      } else {
-        blank(i, i + 1);
-        i++;
-      }
-      continue;
-    }
-    const next = src[i + 1];
-    if (c === "/" && next === "/") {
-      const end = src.indexOf("\n", i);
-      const e = end < 0 ? n : end;
-      blank(i, e);
-      i = e;
-    } else if (c === "/" && next === "*") {
-      const end = src.indexOf("*/", i + 2);
-      const e = end < 0 ? n : end + 2;
-      blank(i, e);
-      i = e;
-    } else if (c === '"' || c === "'") {
-      let j = i + 1;
-      while (j < n && src[j] !== c && src[j] !== "\n") j += src[j] === "\\" ? 2 : 1;
-      blank(i + 1, j);
-      i = j + 1;
-    } else if (c === "`") {
-      inTemplate = true;
-      i++;
-    } else if (c === "/" && regexCanStart(out, i)) {
-      let j = i + 1;
-      let inClass = false;
-      while (j < n && src[j] !== "\n" && (src[j] !== "/" || inClass)) {
-        if (src[j] === "\\") j++;
-        else if (src[j] === "[") inClass = true;
-        else if (src[j] === "]") inClass = false;
-        j++;
-      }
-      if (src[j] === "/") {
-        blank(i + 1, j);
-        i = j + 1;
-      } else i++;
-    } else {
-      if (c === "{") depth++;
-      else if (c === "}") {
-        depth--;
-        if (stack.length && stack[stack.length - 1] === depth) {
-          stack.pop();
-          inTemplate = true;
-        }
-      }
-      i++;
-    }
-  }
-  return out.join("");
-}
-function regexCanStart(out, i) {
-  let k = i - 1;
-  while (k >= 0 && /\s/.test(out[k] ?? "")) k--;
-  if (k < 0) return true;
-  const prev = out[k] ?? "";
-  if (REGEX_BEFORE.test(prev)) return true;
-  return REGEX_KEYWORD.test(out.slice(Math.max(0, k - 7), k + 1).join(""));
-}
-function closingIndex(masked, open2, limit = 4e3) {
-  let depth = 0;
-  const end = Math.min(masked.length, open2 + limit);
-  for (let i = open2; i < end; i++) {
-    const c = masked[i];
-    if (c === "(" || c === "[" || c === "{") depth++;
-    else if (c === ")" || c === "]" || c === "}") {
-      depth--;
-      if (depth === 0) return i + 1;
-    }
-  }
-  return -1;
-}
-function lineFinder(text) {
-  const starts = [0];
-  for (let i = 0; i < text.length; i++) if (text.charCodeAt(i) === 10) starts.push(i + 1);
-  return (index) => {
-    let lo = 0;
-    let hi = starts.length - 1;
-    while (lo < hi) {
-      const mid = lo + hi + 1 >> 1;
-      if ((starts[mid] ?? 0) <= index) lo = mid;
-      else hi = mid - 1;
-    }
-    return lo + 1;
-  };
-}
-
 // src/checks/security/webhook-signals.ts
 var WEBHOOK_TEXT = [
   /stripe-signature/i,
@@ -25684,10 +26165,10 @@ function isWebhookRoute(file2, text) {
 }
 function verifiesInText(text) {
   const raw = text.replace(/\r\n/g, "\n");
-  const code = maskCode(raw);
-  if (matches(VERIFIED_CODE, code)) return true;
-  if (VERIFY_LIBRARY.test(raw) && /\bverify\s*\(/.test(code)) return true;
-  return SHARED_SECRET.test(raw) && /[!=]==?|timingSafeEqual/.test(code);
+  const code2 = maskCode(raw);
+  if (matches(VERIFIED_CODE, code2)) return true;
+  if (VERIFY_LIBRARY.test(raw) && /\bverify\s*\(/.test(code2)) return true;
+  return SHARED_SECRET.test(raw) && /[!=]==?|timingSafeEqual/.test(code2);
 }
 function isUnverifiedWebhook(file2, text) {
   return isWebhookRoute(file2, text) && !verifiesInText(text);
@@ -25749,9 +26230,9 @@ function namedImports(text) {
   }
   return out;
 }
-var callsName = (code, name) => new RegExp(String.raw`\b${name.replace(/\$/g, "\\$")}\s*\(`).test(code);
-function importsAuthHelper(text, code) {
-  return namedImports(text).some((i) => /auth|session/i.test(i.from) && callsName(code ?? text.slice(i.end), i.local));
+var callsName = (code2, name) => new RegExp(String.raw`\b${name.replace(/\$/g, "\\$")}\s*\(`).test(code2);
+function importsAuthHelper(text, code2) {
+  return namedImports(text).some((i) => /auth|session/i.test(i.from) && callsName(code2 ?? text.slice(i.end), i.local));
 }
 function exportedCode(text, name) {
   const start = text.search(new RegExp(String.raw`export\s+(?:async\s+)?(?:function\s*\*?\s*|const\s+|let\s+)${name.replace(/\$/g, "\\$")}\b`));
@@ -25766,8 +26247,8 @@ function wrapperChecksAuth(ctx, file2, text) {
     if (!callsName(text.slice(end), local)) return false;
     const target = resolveImport(file2, from, files, aliases);
     const helper = target ? ctx.read(target) ?? "" : "";
-    const code = exportedCode(helper, name);
-    return Boolean(code && (AUTH_SIGNALS.some((re) => re.test(code)) || importsAuthHelper(helper, code)));
+    const code2 = exportedCode(helper, name);
+    return Boolean(code2 && (AUTH_SIGNALS.some((re) => re.test(code2)) || importsAuthHelper(helper, code2)));
   });
 }
 function classifyRoute(text) {
@@ -25817,210 +26298,6 @@ var apiRoutes = {
   }
 };
 
-// src/checks/security/logs.ts
-var NOT_APP_CODE = /(?:^|\/)(?:node_modules|\.next|\.nuxt|\.svelte-kit|\.vercel|\.turbo|\.output|dist|build|out|coverage|vendor|public|generated|__generated__|__mocks__|\.aura|\.claude|\.agents|\.cursor|\.codex|\.pi)\/|\.min\.[cm]?js$|\.stories\.[cm]?[jt]sx?$|(?:^|\/)[^/]+\.config\.[cm]?[jt]s$|(?:^|\/)\.[\w-]+rc\.[cm]?js$|(?:^|\/)(?:database|supabase)\.types\.ts$/;
-function appCodeFiles(ctx) {
-  return ctx.files.filter((f) => isSourceFile(f) && !isTestFile(f) && !NOT_APP_CODE.test(f));
-}
-var LOG_CALL = /(?<![\w$])(?:console|logger|log)\s*\??\.\s*(?:log|info|debug|warn|error|trace|fatal)\s*\(/g;
-var REDACTED_CALL = /(?<![\w$.])[\w$]*(?:redact|mask|sanitiz|scrub|obfuscat)[\w$]*\s*\(/gi;
-var CHAIN = /(?<![\w$.])[A-Za-z_$][\w$]*(?:\s*\??\.\s*[A-Za-z_$][\w$]*)*/g;
-var SECRET_ENV = /KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE|CREDENTIAL|DATABASE_URL|POSTGRES(?:QL)?_URL|REDIS_URL|MONGO(?:DB)?_URI|CONNECTION_STRING|SALT/;
-var PUBLIC_ENV = /^(?:NEXT_PUBLIC_|VITE_|PUBLIC_|EXPO_PUBLIC_|REACT_APP_|GATSBY_)/;
-var REQUEST = /^(?:req|request|ctx|context|event)$/;
-var PRESENCE_BEFORE = /(?:typeof\s+|!\s*|Boolean\(\s*|\bas\s+|\bkeyof\s+|Object\.keys\(\s*)$/;
-var CONTENT_METHODS = /* @__PURE__ */ new Set([
-  "slice",
-  "substring",
-  "substr",
-  "toString",
-  "trim",
-  "split",
-  "padStart",
-  "padEnd",
-  "toUpperCase",
-  "toLowerCase",
-  "concat",
-  "entries",
-  "values",
-  "toJSON"
-]);
-var SECRET_NAME2 = /(token|secret|password|passwd|passphrase|(?:api|private|secret|access|service|servicerole|signing|encryption|master|client)key|authorization|authheader|cookies?|jwt|credentials?|bearer)$/;
-var NOT_A_SECRET = /hash|masked|redacted|sanitiz|prefix|hint|last4|preview/i;
-var YES_NO_OR_VERB = /^(?:is|has|show|hide|should|needs?|can|toggle|validate|verify|check|create|generate|get|set|use|missing|invalid|no|with|requires?)[A-Z_]/;
-var SECRET_STRING_KEY = /^(?:authorization|cookie|setcookie|session|sessionid|jwt|credentials?)$|(?:token|secret|password|passwd|apikey)$/;
-var PERSON = /^(?:(?:[a-z][a-zA-Z0-9]*)?(User|Session|Profile|Customer)|(user|session|profile|customer))s?$/;
-function secretKind(word) {
-  const w = word.toLowerCase();
-  if (/pass/.test(w)) return "a password";
-  if (/cookie/.test(w)) return "a cookie";
-  if (/token$/.test(w)) return "a token";
-  if (/key$/.test(w)) return "an API key";
-  if (/credential/.test(w)) return "login credentials";
-  if (/secret/.test(w)) return "a secret";
-  if (/auth/.test(w)) return "an authorization header";
-  if (/session/.test(w)) return "a session id";
-  return "a token";
-}
-function isSecretName(name) {
-  return !NOT_A_SECRET.test(name) && !YES_NO_OR_VERB.test(name) && SECRET_NAME2.test(name.toLowerCase().replace(/[_$]/g, ""));
-}
-function splitTopLevel(s) {
-  const parts = [];
-  let depth = 0;
-  let start = 0;
-  for (let i = 0; i < s.length; i++) {
-    const c = s[i];
-    if (c === "(" || c === "[" || c === "{") depth++;
-    else if (c === ")" || c === "]" || c === "}") depth--;
-    else if (c === "," && depth === 0) {
-      parts.push(s.slice(start, i));
-      start = i + 1;
-    }
-  }
-  parts.push(s.slice(start));
-  return parts.map((p2) => p2.trim()).filter(Boolean);
-}
-function wholeValues(expr, depth = 0) {
-  const e = expr.trim().replace(/^(?:await\s+|\.\.\.)/, "").trim();
-  if (depth > 2) return [e];
-  const json2 = e.match(/^JSON\s*\.\s*stringify\s*\(/);
-  if (json2 && closingIndex(e, json2[0].length - 1) === e.length) return wholeValues(splitTopLevel(e.slice(json2[0].length, -1))[0] ?? "", depth + 1);
-  if (e.startsWith("{") && closingIndex(e, 0) === e.length) {
-    return splitTopLevel(e.slice(1, -1)).flatMap((entry) => {
-      const colon = entry.match(/^[\w$\s]+:(?!:)/);
-      return wholeValues(colon ? entry.slice(colon[0].length) : entry, depth + 1);
-    });
-  }
-  return [e];
-}
-function analyzeLogArgs(masked, raw) {
-  const hits = [];
-  let m = masked;
-  let r = raw;
-  for (const call of masked.matchAll(REDACTED_CALL)) {
-    const end = closingIndex(masked, call.index + call[0].length - 1);
-    const to = end < 0 ? masked.length : end;
-    const pad = " ".repeat(to - call.index);
-    m = m.slice(0, call.index) + pad + m.slice(to);
-    r = r.slice(0, call.index) + pad + r.slice(to);
-  }
-  for (const chain of m.matchAll(CHAIN)) {
-    const start = chain.index;
-    const end = start + chain[0].length;
-    const before = m.slice(Math.max(0, start - 16), start);
-    const after = m.slice(end).trimStart();
-    const segments2 = chain[0].split(/\s*\??\.\s*/);
-    const last = segments2[segments2.length - 1] ?? "";
-    if (segments2.length === 1 && /[{,]\s*$/.test(before) && /^:(?!:)/.test(after)) continue;
-    if (PRESENCE_BEFORE.test(before) || last === "length" || last === "size") continue;
-    let value = segments2;
-    if (after.startsWith("(")) {
-      if (segments2.length === 1) {
-        if ((last === "headers" || last === "cookies") && !/^\(\s*\)\s*\??\.\s*(?:get|has)\s*\(/.test(after))
-          hits.push({ severity: "high", kind: last === "headers" ? "the request headers" : "the cookies" });
-        continue;
-      }
-      const receiver = segments2[segments2.length - 2] ?? "";
-      if (REQUEST.test(receiver) && /^(?:json|formData|text)$/.test(last)) {
-        hits.push({ severity: "medium", kind: last === "formData" ? "the whole form submission" : "the whole request body" });
-        continue;
-      }
-      if (!CONTENT_METHODS.has(last)) continue;
-      value = segments2.slice(0, -1);
-    }
-    const name = value[value.length - 1] ?? "";
-    const owner = value[value.length - 2] ?? "";
-    if (value[0] === "process" && value[1] === "env") {
-      if (value.length === 2 && !after.startsWith("[")) hits.push({ severity: "high", kind: "every environment variable (process.env)" });
-      else if (value.length === 3 && SECRET_ENV.test(name) && !PUBLIC_ENV.test(name) && !/^\?(?![.?])/.test(after))
-        hits.push({ severity: "high", kind: `the ${name} environment variable` });
-      continue;
-    }
-    if (after.startsWith("[")) continue;
-    if (name === "headers" && REQUEST.test(owner)) hits.push({ severity: "high", kind: "the request headers" });
-    else if (name === "body" && REQUEST.test(owner)) hits.push({ severity: "medium", kind: "the whole request body" });
-    else if (name === "formData" && value.length === 1) hits.push({ severity: "medium", kind: "the whole form submission" });
-    else if (isSecretName(name)) hits.push({ severity: "high", kind: secretKind(name) });
-  }
-  for (const key of r.matchAll(/(?:\.\s*get\s*\(|\[)\s*(['"`])([\w-]{2,40})\1\s*[)\]]/g)) {
-    const word = (key[2] ?? "").toLowerCase().replace(/[-_]/g, "");
-    if (m[key.index] !== r[key.index] || !SECRET_STRING_KEY.test(word)) continue;
-    hits.push({ severity: "high", kind: word === "authorization" ? "the authorization header" : secretKind(word) });
-  }
-  for (const arg of splitTopLevel(m)) {
-    for (const v of wholeValues(arg)) {
-      const person = v.match(/^(?:[\w$]+\s*\??\.\s*)*([\w$]+)$/)?.[1]?.match(PERSON);
-      if (person) hits.push({ severity: "medium", kind: `a whole ${(person[1] ?? person[2] ?? "user").toLowerCase()} object` });
-    }
-  }
-  return hits;
-}
-function findLogCalls(text, pattern = LOG_CALL) {
-  const src = text.replace(/\r\n/g, "\n");
-  const masked = maskCode(src);
-  const line = lineFinder(src);
-  const calls = [];
-  for (const m of masked.matchAll(new RegExp(pattern.source, "g"))) {
-    const open2 = m.index + m[0].length - 1;
-    const close = closingIndex(masked, open2);
-    calls.push({
-      index: m.index,
-      line: line(m.index),
-      masked: close < 0 ? null : masked.slice(open2 + 1, close - 1),
-      raw: close < 0 ? null : src.slice(open2 + 1, close - 1)
-    });
-  }
-  return calls;
-}
-var KINDS2 = { high: "secret-logs", medium: "personal-logs" };
-var logLeaks = {
-  id: "security.log-leaks",
-  category: "security",
-  title: "Logs don\u2019t leak secrets or personal data",
-  obsV: 1,
-  applies: (ctx) => appCodeFiles(ctx).length > 0,
-  observe(ctx) {
-    let logging = 0;
-    const flagged = /* @__PURE__ */ new Set();
-    const items = [];
-    for (const file2 of appCodeFiles(ctx)) {
-      const text = ctx.read(file2);
-      if (!text) continue;
-      const calls = findLogCalls(text);
-      if (calls.length === 0) continue;
-      logging++;
-      const bySeverity = /* @__PURE__ */ new Map();
-      for (const call of calls) {
-        if (call.masked === null || call.raw === null) continue;
-        for (const hit of analyzeLogArgs(call.masked, call.raw)) {
-          const lines = bySeverity.get(hit.severity) ?? /* @__PURE__ */ new Map();
-          bySeverity.set(hit.severity, lines);
-          lines.set(call.line, (lines.get(call.line) ?? /* @__PURE__ */ new Set()).add(hit.kind));
-        }
-      }
-      for (const severity2 of ["high", "medium"]) {
-        const lines = bySeverity.get(severity2);
-        if (!lines) continue;
-        flagged.add(file2);
-        const entries = [...lines.entries()].sort((a, b) => a[0] - b[0]);
-        const shown = entries.slice(0, 20);
-        const kinds = [...new Set(entries.flatMap(([, k]) => [...k]))];
-        items.push({
-          kind: KINDS2[severity2],
-          facts: { more: entries.length - shown.length },
-          key: `${file2}|${severity2}`,
-          locations: shown.map(([line]) => ({ file: file2, line })),
-          // What each line logs can name the app's own variables, so it stays on this computer.
-          vars: { file: file2, lines: shown.map(([line, k]) => `Line ${line} logs ${[...k].join(" and ")}`).join("; ") },
-          meta: { kinds, lines: entries.length }
-        });
-      }
-    }
-    return { facts: { logging, flagged: flagged.size }, items };
-  }
-};
-
 // src/checks/security/ai-calls.ts
 var AI_SDK = /^(?:openai|ai|groq-sdk|replicate|together-ai|cohere-ai|@google\/genai|@google\/generative-ai|@mistralai\/mistralai)$|^@(?:anthropic-ai|ai-sdk|langchain)\//;
 function isAiSdk(name) {
@@ -26514,7 +26791,7 @@ function untestedFiles(ctx, areas2) {
   const dirs = workspaceDirs2(ctx);
   const texts = tests2.map((file2) => ({ file: file2, dir: dirOf(file2, dirs), text: ctx.read(file2) ?? "" }));
   const e2e = texts.filter((t) => isE2eSpec(t.file, t.text)).map((t) => ({ ...t, paths: visitedPaths(t.text) }));
-  const near = (list9, dir) => list9.filter((t) => t.dir === dir || t.dir === ".");
+  const near = (list11, dir) => list11.filter((t) => t.dir === dir || t.dir === ".");
   return areas2.filter((a) => {
     if (reached.has(a.file)) return false;
     const route = a.route;
@@ -26591,7 +26868,7 @@ var criticalTests = {
 };
 
 // src/checks/deps-registry.ts
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 var REGISTRY = "https://registry.npmjs.org";
 var fetchFromRegistry = async (name) => {
   const encoded = name.startsWith("@") ? `@${encodeURIComponent(name.slice(1))}` : encodeURIComponent(name);
@@ -26609,7 +26886,7 @@ var CACHE_MS = 24 * 60 * 60 * 1e3;
 var CONCURRENCY = 8;
 function loadCache(root) {
   try {
-    const data = JSON.parse(readFileSync15(auraPath(root, CACHE_FILE), "utf8"));
+    const data = JSON.parse(readFileSync16(auraPath(root, CACHE_FILE), "utf8"));
     return data && typeof data === "object" ? data : {};
   } catch {
     return {};
@@ -26670,7 +26947,7 @@ async function lookupPackages(root, wanted, fetcher, now) {
 }
 
 // src/checks/deps-runtimes.ts
-import path24 from "path";
+import path26 from "path";
 var NODE_LINES = {
   12: { eol: "2022-04-30", lts: "2019-10-21" },
   13: { eol: "2020-06-01" },
@@ -26778,7 +27055,7 @@ function nodePinSources(ctx, workspaces) {
     if (typeof volta === "string") add(ws.file, "volta.node", volta, nodeMajorOf(volta));
   }
   for (const file2 of ctx.files) {
-    const base2 = path24.posix.basename(file2);
+    const base2 = path26.posix.basename(file2);
     if (base2 === ".nvmrc" || base2 === ".node-version") {
       const first = (ctx.read(file2) ?? "").replace(/\r\n/g, "\n").split("\n").map((l) => l.replace(/#.*/, "").trim()).find(Boolean);
       if (first) add(file2, base2, first, nodeMajorOf(first));
@@ -27085,8 +27362,8 @@ function fakeSuccess(file2, v) {
   const strong = STRONG_SUCCESS.flatMap(at);
   const hits = [...at(WEAK_SUCCESS), ...strong];
   if (hits.length === 0) return null;
-  const code = contentLines(v).join("\n");
-  if (PROVIDER_CALL.test(code) || PAYMENT_FETCH.test(code)) return null;
+  const code2 = contentLines(v).join("\n");
+  if (PROVIDER_CALL.test(code2) || PAYMENT_FETCH.test(code2)) return null;
   const rest = v.masked;
   const delegated = imps.some(
     (i) => !i.typeOnly && (PAYMENT_WORD.test(i.spec) || i.names.some((n) => PAYMENT_WORD.test(n))) && i.names.some((n) => countWord(rest, n) > 1)
@@ -27132,8 +27409,8 @@ function commentedCodeBlocks(v) {
   return commentBlocks(v).filter((b) => {
     const lines = b.lines.filter((l) => l.trim());
     if (lines.length < COMMENTED_BLOCK_LINES || LICENSE.test(lines.join("\n"))) return false;
-    const code = lines.filter((l) => CODE_LINE.some((re) => re.test(l))).length;
-    return code >= COMMENTED_BLOCK_LINES && code / lines.length >= CODE_SHARE;
+    const code2 = lines.filter((l) => CODE_LINE.some((re) => re.test(l))).length;
+    return code2 >= COMMENTED_BLOCK_LINES && code2 / lines.length >= CODE_SHARE;
   }).length;
 }
 var TS_DIRECTIVE = /^\s*(?:\{\s*)?(?:\/\/|\/\*)\s*@ts-(ignore|expect-error|nocheck)\b/;
@@ -27179,7 +27456,7 @@ var leftovers = {
   observe(ctx) {
     const files = leftoverFiles(ctx.files);
     const views = /* @__PURE__ */ new Map();
-    const read2 = (f) => {
+    const read3 = (f) => {
       const cached2 = views.get(f);
       if (cached2) return cached2;
       const v = view(f, ctx.read(f) ?? "");
@@ -27192,7 +27469,7 @@ var leftovers = {
     const mocks = {};
     const commented = {};
     for (const file2 of files) {
-      const v = read2(file2);
+      const v = read3(file2);
       const kinds = placeholderKinds(v);
       if (kinds.length) placeholders[file2] = kinds;
       if (v.mdx) continue;
@@ -27205,7 +27482,7 @@ var leftovers = {
       const blocks = commentedCodeBlocks(v);
       if (blocks) commented[file2] = blocks;
     }
-    const escapes = typeCounts(ctx, read2);
+    const escapes = typeCounts(ctx, read3);
     const items = [
       ...placeholderItem(placeholders),
       ...stubItem(stubs),
@@ -27279,11 +27556,11 @@ function commentedItem(byFile) {
     }
   ];
 }
-function typeCounts(ctx, read2) {
+function typeCounts(ctx, read3) {
   const out = { nocheck: [], ignores: 0, anys: 0, ignoreFiles: [], anyFiles: [] };
   const app2 = new Set(leftoverFiles(ctx.files));
   for (const file2 of codeFiles(ctx.files)) {
-    const e = typeEscapes(file2, read2(file2));
+    const e = typeEscapes(file2, read3(file2));
     if (e.nocheck && app2.has(file2)) out.nocheck.push(file2);
     out.ignores += e.ignores;
     out.anys += e.anys;
@@ -27320,7 +27597,7 @@ function typeItems(t) {
 }
 
 // src/connectors/snapshot.ts
-import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync17 } from "fs";
 var REFUSAL_MS = 30 * 24 * 60 * 60 * 1e3;
 function withRefusals(states, snap, now = Date.now()) {
   return Object.fromEntries(
@@ -27333,7 +27610,7 @@ function withRefusals(states, snap, now = Date.now()) {
 var FILE2 = "cache/connectors.json";
 function loadSnapshots(root) {
   try {
-    return existsSync18(auraPath(root, FILE2)) ? JSON.parse(readFileSync16(auraPath(root, FILE2), "utf8")) : {};
+    return existsSync20(auraPath(root, FILE2)) ? JSON.parse(readFileSync17(auraPath(root, FILE2), "utf8")) : {};
   } catch {
     return {};
   }
@@ -27420,7 +27697,7 @@ var migrationsInSync = {
 };
 
 // src/checks/npm-publish-workflows.ts
-import path25 from "path";
+import path27 from "path";
 import YAML3 from "yaml";
 var PUBLISH_CMD = /(?:^|[\s;&|(])(?:npx\s+)?(npm|pnpm|yarn\s+npm|yarn\s+workspaces\s+foreach(?:\s+-{1,2}[\w-]+)*\s+npm|changeset)\s+((?:-{1,2}[\w-]+(?:[= ](?!publish\b)[^\s-]\S*)?\s+)*)publish(?![\w:-])([^\n;&|]*)/;
 function flagValue(text, flags) {
@@ -27442,14 +27719,14 @@ function parsePublishCommand(script, workingDir = ".") {
   const named = flagValue(`${flags} ${rest}`, tool === "npm" ? ["--workspace", "-w"] : ["--filter", "-F", "--workspace"]).map(
     (t) => t.replace(/^\{|\}$/g, "").replace(/\.\.\.$/, "")
   );
-  if (named.length) return { all: false, targets: named.map((t) => t.startsWith(".") ? normDir(path25.posix.join(workingDir, t)) : t), provenance };
+  if (named.length) return { all: false, targets: named.map((t) => t.startsWith(".") ? normDir(path27.posix.join(workingDir, t)) : t), provenance };
   if (tool === "changeset" || /foreach/.test(tool) || /(?:^|\s)(?:-r|--recursive|--workspaces|-ws)(?:\s|$)/.test(` ${flags} ${rest} `)) {
     return { all: true, targets: [], provenance };
   }
   const before = text.slice(0, m.index);
   const cd = [...before.matchAll(/(?:^|[\s;&(])cd\s+["']?([^\s"';&|]+)/g)].pop()?.[1];
   const positional = rest.trim().split(/\s+/).find((a) => a && !a.startsWith("-") && /^[./]|\//.test(a) && !a.endsWith(".tgz"));
-  const dir = path25.posix.join(workingDir.replace(/\\/g, "/"), (cd ?? ".").replace(/\\/g, "/"), (positional ?? ".").replace(/\\/g, "/"));
+  const dir = path27.posix.join(workingDir.replace(/\\/g, "/"), (cd ?? ".").replace(/\\/g, "/"), (positional ?? ".").replace(/\\/g, "/"));
   return { all: false, targets: [normDir(dir)], provenance };
 }
 var asObj = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
@@ -27589,10 +27866,10 @@ function npmPackageCheck(pack = npmPack) {
 var npmPackage = npmPackageCheck();
 
 // src/checks/readme-commands.ts
-import path27 from "path";
+import path29 from "path";
 
 // src/checks/readme-scripts.ts
-import path26 from "path";
+import path28 from "path";
 var SHELL_LANGS = /* @__PURE__ */ new Set(["", "sh", "bash", "zsh", "shell", "fish", "powershell", "ps1", "pwsh", "cmd", "bat", "batch", "text", "txt", "plaintext"]);
 var PROMPT_LANGS = /* @__PURE__ */ new Set(["console", "shell-session", "shellsession", "sh-session", "terminal"]);
 var PROMPT = /^\s*(?:\$|%|>|PS>|PS [^>]*>)\s+/;
@@ -27646,14 +27923,14 @@ function readmeCommands(markdown) {
   for (const snippet of shellSnippets(markdown)) {
     let cwd = ".";
     for (const line of snippet.lines) {
-      const code = line.replace(/(^|\s)#.*$/, "").trim();
-      if (!code) continue;
-      for (const segment of code.split(/&&|\|\||;|\|/)) {
+      const code2 = line.replace(/(^|\s)#.*$/, "").trim();
+      if (!code2) continue;
+      for (const segment of code2.split(/&&|\|\||;|\|/)) {
         const words2 = segment.trim().split(/\s+/).filter(Boolean).map(unquote2);
         while (words2[0] && (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words2[0]) || words2[0] === "sudo" || words2[0] === "corepack")) words2.shift();
         if (words2[0] === "cd") {
           const to = words2[1];
-          cwd = !to || to === "~" || /^[/~$]/.test(to) ? "?" : cwd === "?" ? "?" : path26.posix.normalize(path26.posix.join(cwd, to.replace(/\\/g, "/")));
+          cwd = !to || to === "~" || /^[/~$]/.test(to) ? "?" : cwd === "?" ? "?" : path28.posix.normalize(path28.posix.join(cwd, to.replace(/\\/g, "/")));
           continue;
         }
         if (snippet.inline && words2.length < 2) continue;
@@ -27723,11 +28000,11 @@ var LOCKFILES = [
   ["bun.lock", "bun"],
   ["bun.lockb", "bun"]
 ];
-var isReadme = (file2) => /^readme(?:\.md|\.mdx|\.markdown)?$/i.test(path27.posix.basename(file2));
+var isReadme = (file2) => /^readme(?:\.md|\.mdx|\.markdown)?$/i.test(path29.posix.basename(file2));
 function readmes(ctx, workspaces) {
   const byDir = new Map(workspaces.map((ws) => [ws.dir, ws]));
   return ctx.files.flatMap((file2) => {
-    const ws = isReadme(file2) ? byDir.get(path27.posix.dirname(file2)) : void 0;
+    const ws = isReadme(file2) ? byDir.get(path29.posix.dirname(file2)) : void 0;
     return ws ? [{ file: file2, ws }] : [];
   });
 }
@@ -27742,7 +28019,7 @@ function selectPackages(selector, workspaces) {
   const sel = selector.replace(/^\.\.\.\^?|\^?\.\.\.$/g, "").replace(/^\{(.*)\}$/, "$1");
   if (!sel || sel.startsWith("!") || sel.includes("[")) return null;
   const byFolder = sel.startsWith("./") || sel.startsWith(".\\") || selector.startsWith("{") || sel === ".";
-  const target = byFolder ? path27.posix.normalize(sel.replace(/\\/g, "/")).replace(/\/+$/, "") || "." : sel;
+  const target = byFolder ? path29.posix.normalize(sel.replace(/\\/g, "/")).replace(/\/+$/, "") || "." : sel;
   const re = globToRegex(target);
   const matched = workspaces.filter((ws) => byFolder ? re.test(ws.dir) : re.test(ws.pkg.name ?? "") || re.test(ws.dir));
   return matched.length ? matched : null;
@@ -27761,7 +28038,7 @@ function scriptExists(script, scope, home, workspaces) {
     }
     case "dir": {
       if (scope.dir === "?") return null;
-      const dir = scope.dir === "/" ? "." : path27.posix.normalize(path27.posix.join(home.dir, scope.dir.replace(/\\/g, "/"))).replace(/\/+$/, "") || ".";
+      const dir = scope.dir === "/" ? "." : path29.posix.normalize(path29.posix.join(home.dir, scope.dir.replace(/\\/g, "/"))).replace(/\/+$/, "") || ".";
       const ws = workspaces.find((w) => w.dir === dir);
       return ws ? hasScript(ws, script) : null;
     }
@@ -27968,7 +28245,7 @@ var vercelEnv = {
 
 // src/checks/performance.ts
 import { statSync as statSync3 } from "fs";
-import path28 from "path";
+import path30 from "path";
 var BIG_ASSET_BYTES = 500 * 1024;
 var MEDIA = /\.(?:png|jpe?g|gif|webp|avif|bmp|tiff?|svg|mp4|webm|mov|woff2?|ttf|otf)$/i;
 var MAX_LISTED6 = 10;
@@ -27983,7 +28260,7 @@ function bigAssets(ctx, limit = BIG_ASSET_BYTES) {
   const out = [];
   for (const file2 of ctx.files.filter((f) => f.startsWith("public/") && MEDIA.test(f))) {
     try {
-      const size = statSync3(path28.join(ctx.root, ...file2.split("/"))).size;
+      const size = statSync3(path30.join(ctx.root, ...file2.split("/"))).size;
       if (size > limit) out.push({ file: file2, kb: Math.round(size / 1024) });
     } catch {
     }
@@ -28201,10 +28478,10 @@ var typecheck = {
   applies: (ctx) => ctx.stack.typescript,
   async observe(ctx) {
     if (ctx.options.fast) return { facts: { outcome: "skipped-fast-mode" }, items: [] };
-    const { existsSync: existsSync31 } = await import("fs");
-    const path52 = await import("path");
-    const tsc = path52.join(ctx.root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
-    if (!existsSync31(tsc)) return { facts: { outcome: "not-installed" }, items: [] };
+    const { existsSync: existsSync33 } = await import("fs");
+    const path55 = await import("path");
+    const tsc = path55.join(ctx.root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
+    if (!existsSync33(tsc)) return { facts: { outcome: "not-installed" }, items: [] };
     const r = await run(tsc, ["--noEmit", "--pretty", "false"], { cwd: ctx.root, timeoutMs: 18e4 });
     if (r.timedOut) return { facts: { outcome: "timed-out" }, items: [] };
     if (r.code === 0) return { facts: { outcome: "ran" }, items: [], engine: "tsc" };
@@ -28233,6 +28510,7 @@ var foundationChecks = [
   vercelEnv,
   migrationsInSync,
   errorPages,
+  spaErrors,
   readmeCommandsCheck,
   seo,
   performance
@@ -28255,9 +28533,9 @@ function toolSettingsCheck(connector) {
     observe(ctx) {
       const snap = loadSnapshots(ctx.root)[connector.id];
       if (!snap) return { facts: { settings: {} }, items: [{ kind: "no-reading", key: "no-reading", locations: [] }] };
-      const read2 = connector.settings.filter((s) => STATES.has(snap.settings[s.id] ?? ""));
-      const settings = Object.fromEntries(read2.map((s) => [s.id, snap.settings[s.id]]));
-      const off = read2.filter((s) => snap.settings[s.id] === "off");
+      const read3 = connector.settings.filter((s) => STATES.has(snap.settings[s.id] ?? ""));
+      const settings = Object.fromEntries(read3.map((s) => [s.id, snap.settings[s.id]]));
+      const off = read3.filter((s) => snap.settings[s.id] === "off");
       return {
         facts: { settings },
         items: off.length ? [{ kind: "settings-off", key: `${connector.id}-settings`, locations: [], vars: { off: off.map((s) => s.label).join("; ") } }] : [],
@@ -28433,9 +28711,9 @@ var databaseBackups = {
 
 // src/core/tools.ts
 import { createHash as createHash2 } from "crypto";
-import { chmodSync as chmodSync2, existsSync as existsSync19, mkdirSync as mkdirSync3, mkdtempSync, readdirSync as readdirSync5, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync21, mkdirSync as mkdirSync3, mkdtempSync, readdirSync as readdirSync5, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import os3 from "os";
-import path29 from "path";
+import path31 from "path";
 var GITLEAKS_SHA = {
   darwin_arm64: "b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5",
   darwin_x64: "dfe101a4db2255fc85120ac7f3d25e4342c3c20cf749f2c20a18081af1952709",
@@ -28453,7 +28731,7 @@ var OSV_SHA = {
   windows_arm64: "ca1379da0e408279ef2c85cde0846a903495738a91c7b065a208048437c1686c"
 };
 function tarCommand(platform = process.platform, systemRoot = process.env.SystemRoot) {
-  return platform === "win32" ? path29.win32.join(systemRoot || "C:\\Windows", "System32", "tar.exe") : "tar";
+  return platform === "win32" ? path31.win32.join(systemRoot || "C:\\Windows", "System32", "tar.exe") : "tar";
 }
 var TOOLS = {
   gitleaks: {
@@ -28493,8 +28771,8 @@ function ensureTool(name, noDownload = false) {
 async function resolveTool(name, noDownload) {
   const spec = TOOLS[name];
   const exe = process.platform === "win32" ? `${name}.exe` : name;
-  const cached2 = path29.join(auraBinDir(), `${name}-${spec.version}`, exe);
-  if (existsSync19(cached2)) return { path: cached2, version: spec.version };
+  const cached2 = path31.join(auraBinDir(), `${name}-${spec.version}`, exe);
+  if (existsSync21(cached2)) return { path: cached2, version: spec.version };
   if (await commandExists(name)) {
     const v = await run(name, ["version"]);
     return { path: name, version: (v.stdout.match(/\d+\.\d+\.\d+/)?.[0] ?? "system").trim() };
@@ -28514,20 +28792,20 @@ async function download(name, spec, target) {
   const buf = Buffer.from(await res.arrayBuffer());
   const digest = createHash2("sha256").update(buf).digest("hex");
   if (digest !== asset.sha256) throw new Error(`Checksum mismatch for ${asset.file}`);
-  const dir = path29.dirname(target);
+  const dir = path31.dirname(target);
   mkdirSync3(dir, { recursive: true });
-  const tmp = mkdtempSync(path29.join(os3.tmpdir(), `aura-${name}-`));
+  const tmp = mkdtempSync(path31.join(os3.tmpdir(), `aura-${name}-`));
   try {
     if (asset.archive === null) {
       writeFileSync3(target, buf);
     } else {
-      const archivePath = path29.join(tmp, asset.file);
+      const archivePath = path31.join(tmp, asset.file);
       writeFileSync3(archivePath, buf);
       const r = await run(tarCommand(), ["-xf", archivePath, "-C", tmp]);
       if (r.code !== 0) return null;
       const exe = readdirSync5(tmp).find((f) => f === name || f === `${name}.exe`);
       if (!exe) return null;
-      renameSync(path29.join(tmp, exe), target);
+      renameSync(path31.join(tmp, exe), target);
     }
     chmodSync2(target, 493);
     return { path: target, version: spec.version };
@@ -28646,6 +28924,7 @@ var WANTED = [
   { id: "x-frame-options", pattern: /X-Frame-Options|frame-ancestors/i, name: "X-Frame-Options" },
   { id: "referrer-policy", pattern: /Referrer-Policy/i, name: "Referrer-Policy" }
 ];
+var HEADER_SOURCES = /^next\.config\.[cm]?[jt]s$|^(?:src\/)?(?:middleware|proxy)\.[cm]?[jt]s$|^vercel\.json$|^netlify\.toml$|^(?:public\/)?_headers$|^firebase\.json$|^staticwebapp\.config\.json$/;
 var headers = {
   id: "security.headers",
   scope: "project",
@@ -28653,14 +28932,14 @@ var headers = {
   title: "Security headers set",
   obsV: 1,
   // Headers protect pages in a browser; an API with no pages has nothing for them to guard.
-  applies: (ctx) => ctx.stack.nextjs !== null && ctx.project.traits.servesPages,
+  applies: (ctx) => (ctx.stack.nextjs !== null || Boolean(ctx.stack.vite)) && ctx.project.traits.servesPages,
   observe(ctx) {
-    const sources = ctx.files.filter((f) => /^next\.config\.[cm]?[jt]s$|^vercel\.json$|^(?:src\/)?(?:middleware|proxy)\.[cm]?[jt]s$/.test(f));
+    const sources = ctx.files.filter((f) => HEADER_SOURCES.test(f));
     const text = sources.map((f) => ctx.read(f) ?? "").join("\n");
     const missing = WANTED.filter((h) => !h.pattern.test(text));
     const facts = { checked: WANTED.length };
     if (missing.length === 0) return { facts, items: [] };
-    const configFile = ctx.files.find((f) => /^next\.config\./.test(f));
+    const configFile = ctx.files.find((f) => /^next\.config\./.test(f)) ?? ctx.files.find((f) => /^(?:vercel\.json|netlify\.toml)$/.test(f));
     return {
       facts,
       items: [
@@ -28785,7 +29064,7 @@ var rls = {
 };
 
 // src/checks/security/server-only.ts
-import path30 from "path";
+import path32 from "path";
 
 // src/checks/security/browser-code.ts
 var posix = (p2) => p2.replace(/\\/g, "/");
@@ -28830,12 +29109,12 @@ function splitSql(sql) {
   const src = sql.replace(/\r\n/g, "\n");
   const out = [];
   let text = "";
-  let code = "";
+  let code2 = "";
   let bodies = [];
   const push = () => {
-    if (text.trim()) out.push({ text: text.trim(), code: code.trim(), bodies });
+    if (text.trim()) out.push({ text: text.trim(), code: code2.trim(), bodies });
     text = "";
-    code = "";
+    code2 = "";
     bodies = [];
   };
   const n = src.length;
@@ -28847,12 +29126,12 @@ function splitSql(sql) {
       const end = src.indexOf("\n", i);
       i = end < 0 ? n : end;
       text += " ";
-      code += " ";
+      code2 += " ";
     } else if (c === "/" && next === "*") {
       const end = src.indexOf("*/", i + 2);
       i = end < 0 ? n : end + 2;
       text += " ";
-      code += " ";
+      code2 += " ";
     } else if (c === "'" || c === '"') {
       let j = i + 1;
       while (j < n) {
@@ -28862,7 +29141,7 @@ function splitSql(sql) {
       }
       const seg = src.slice(i, j + 1);
       text += seg;
-      code += seg;
+      code2 += seg;
       i = j + 1;
     } else if (c === "$" && /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/.test(src.slice(i, i + 64))) {
       const tag = /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/.exec(src.slice(i, i + 64))?.[0] ?? "$$";
@@ -28871,14 +29150,14 @@ function splitSql(sql) {
       const body = src.slice(i + tag.length, end);
       bodies.push(body);
       text += tag + body + tag;
-      code += " $$ $$ ";
+      code2 += " $$ $$ ";
       i = close < 0 ? n : end + tag.length;
     } else if (c === ";") {
       push();
       i++;
     } else {
       text += c;
-      code += c;
+      code2 += c;
       i++;
     }
   }
@@ -28993,17 +29272,17 @@ function analyzeFunctions(migrations) {
   const reDrop = /^drop\s+function\s+(?:if\s+exists\s+)?([\s\S]*?)(?:\s+(?:cascade|restrict))?$/i;
   const reGrant = /^grant\s+([\s\S]+?)\s+on\s+(?:(?:function|routine)\s+([\s\S]+?)|all\s+(?:functions|routines)\s+in\s+schema\s+([\s\S]+?))\s+to\s+([\s\S]+?)(?:\s+with\s+grant\s+option)?$/i;
   const reRevoke = /^revoke\s+(?:grant\s+option\s+for\s+)?([\s\S]+?)\s+on\s+(?:(?:function|routine)\s+([\s\S]+?)|all\s+(?:functions|routines)\s+in\s+schema\s+([\s\S]+?))\s+from\s+([\s\S]+?)(?:\s+(?:cascade|restrict))?$/i;
-  const targets2 = (list9, schemas2) => {
+  const targets2 = (list11, schemas2) => {
     if (schemas2) {
       const wanted = new Set(splitTopLevel2(schemas2).map((s) => unquote3(s).toLowerCase()));
       return [...fns.values()].filter((f) => wanted.has(f.schema));
     }
-    return splitTopLevel2(list9 ?? "").flatMap((raw) => fns.get(keyOf(raw).key) ?? []);
+    return splitTopLevel2(list11 ?? "").flatMap((raw) => fns.get(keyOf(raw).key) ?? []);
   };
   for (const { file: file2, sql } of [...migrations].sort((a, b) => a.file.localeCompare(b.file))) {
     for (const stmt of splitSql(sql)) {
-      const { code } = stmt;
-      const create = reCreate.exec(code);
+      const { code: code2 } = stmt;
+      const create = reCreate.exec(code2);
       if (create) {
         const { schema, name, key } = keyOf(create[2] ?? "");
         const previous = create[1] ? fns.get(key) : void 0;
@@ -29011,15 +29290,15 @@ function analyzeFunctions(migrations) {
           schema,
           name,
           file: file2,
-          definer: /\bsecurity\s+definer\b/i.test(code),
-          searchPath: SEARCH_PATH.test(code),
+          definer: /\bsecurity\s+definer\b/i.test(code2),
+          searchPath: SEARCH_PATH.test(code2),
           writes: WRITES.test(bodyOf(stmt).replace(/--[^\n]*/g, "")),
           // CREATE OR REPLACE keeps the grants; a fresh CREATE starts without any.
           grants: previous ? previous.grants : /* @__PURE__ */ new Set()
         });
         continue;
       }
-      const alter = reAlter.exec(code);
+      const alter = reAlter.exec(code2);
       if (alter) {
         const { key, schema } = keyOf(alter[1] ?? "");
         const fn = fns.get(key);
@@ -29040,17 +29319,17 @@ function analyzeFunctions(migrations) {
         }
         continue;
       }
-      const drop = reDrop.exec(code);
+      const drop = reDrop.exec(code2);
       if (drop) {
         for (const raw of splitTopLevel2(drop[1] ?? "")) fns.delete(keyOf(raw).key);
         continue;
       }
-      const grant = reGrant.exec(code);
+      const grant = reGrant.exec(code2);
       if (grant && /\b(?:execute|all)\b/i.test(grant[1] ?? "")) {
         for (const fn of targets2(grant[2], grant[3])) for (const r of roles(grant[4] ?? "")) fn.grants.add(r);
         continue;
       }
-      const revoke = reRevoke.exec(code);
+      const revoke = reRevoke.exec(code2);
       if (revoke && /\b(?:execute|all)\b/i.test(revoke[1] ?? "")) {
         for (const fn of targets2(revoke[2], revoke[3])) for (const r of roles(revoke[4] ?? "")) fn.grants.delete(r);
       }
@@ -29081,20 +29360,20 @@ function adminSignal(raw) {
     const name = m[1] ?? m[2] ?? "";
     if (SERVICE_ENV.test(name) && masked[m.index] !== " ") return name;
   }
-  const code = withoutImports(masked);
-  const ident = /\b([A-Z0-9_]*(?:SERVICE_ROLE|SUPABASE_SECRET)[A-Z0-9_]*)\b/.exec(code);
+  const code2 = withoutImports(masked);
+  const ident = /\b([A-Z0-9_]*(?:SERVICE_ROLE|SUPABASE_SECRET)[A-Z0-9_]*)\b/.exec(code2);
   if (ident?.[1]) return ident[1];
   for (const m of text.matchAll(/service_role/g)) {
-    if (code[m.index] !== " " || masked[m.index] === " " && inStringLiteral(text, m.index)) return "service_role";
+    if (code2[m.index] !== " " || masked[m.index] === " " && inStringLiteral(text, m.index)) return "service_role";
   }
-  const named = ADMIN_NAMES.exec(code)?.[1];
+  const named = ADMIN_NAMES.exec(code2)?.[1];
   if (named) return named;
-  if (/\.auth\s*\.\s*admin\s*\./.test(code)) return "auth.admin";
-  for (const m of code.matchAll(/(?<![\w$.])createClient\s*\(/g)) {
+  if (/\.auth\s*\.\s*admin\s*\./.test(code2)) return "auth.admin";
+  for (const m of code2.matchAll(/(?<![\w$.])createClient\s*\(/g)) {
     const open2 = m.index + m[0].length - 1;
-    const close = closingIndex(code, open2);
+    const close = closingIndex(code2, open2);
     if (close < 0) continue;
-    const second = splitTopLevel2(code.slice(open2 + 1, close - 1))[1] ?? "";
+    const second = splitTopLevel2(code2.slice(open2 + 1, close - 1))[1] ?? "";
     if (/service|secret|admin/i.test(second)) return "createClient";
   }
   return null;
@@ -29165,7 +29444,7 @@ function serverReasons(raw) {
   return [...reasons].sort();
 }
 function nestedPackages(files) {
-  return files.filter((f) => f.endsWith("/package.json")).map((f) => `${path30.posix.dirname(f)}/`);
+  return files.filter((f) => f.endsWith("/package.json")).map((f) => `${path32.posix.dirname(f)}/`);
 }
 function clientReachable(ctx, files) {
   const importsOf = localImports(ctx);
@@ -29231,10 +29510,242 @@ var serverOnly = {
   }
 };
 
-// src/checks/security/supabase-code.ts
+// src/checks/security/browser-secrets.ts
 var MAX_LIST4 = 20;
+var ENV_USE4 = /\b(?:import\.meta\.env|process\.env)(?:\.([A-Z][A-Z0-9_]*)|\[\s*['"]([A-Z][A-Z0-9_]*)['"]\s*\])/g;
+var PUBLIC_PREFIX4 = /^(?:VITE_|REACT_APP_|PUBLIC_)/;
+var ELECTRON_NODE = /^(?:src\/)?(?:electron|main|preload)\//;
+var SERVER_KEY = /(?:^|_)(?:RESEND|SENDGRID|TWILIO|POSTMARK|MAILGUN|MAILCHIMP|BREVO|SENDINBLUE|LOOPS|PLUNK)_|PASSWORD|PASSWD|PRIVATE_KEY|DATABASE_URL|DB_URL|POSTGRES|MONGO(?:DB)?_URI|REDIS_URL|(?:GITHUB|SLACK|DISCORD|TELEGRAM|NOTION|AIRTABLE|HUBSPOT|SHOPIFY_ADMIN)_(?:\w+_)?(?:TOKEN|KEY|SECRET)|STRIPE_(?:SECRET|RESTRICTED)|WEBHOOK_SECRET|AWS_SECRET|ADMIN_(?:KEY|TOKEN|PASSWORD)/;
+var SERVER_PACKAGE = /^(?:stripe|resend|twilio|@sendgrid\/mail|postmark|nodemailer|mailgun\.js|firebase-admin(?:\/.*)?|mongodb|mongoose|pg|postgres|mysql2|@octokit\/rest)$/;
+function isBrowserServerKey(name, supabase2) {
+  if (!PUBLIC_PREFIX4.test(name) || isPublicAiKey(name)) return false;
+  if (supabase2 && isPublicSecretName(name)) return false;
+  const rest = name.replace(PUBLIC_PREFIX4, "");
+  return SERVER_KEY.test(rest) || /SECRET|SERVICE_ROLE/.test(rest);
+}
+function browserKeysUsed(raw, supabase2) {
+  const masked = maskCode(raw);
+  const names = [...raw.matchAll(ENV_USE4)].filter((m) => masked[m.index] !== " ").map((m) => m[1] ?? m[2] ?? "").filter((n) => isBrowserServerKey(n, supabase2));
+  return [...new Set(names)].sort();
+}
+function serverPackagesImported(raw) {
+  const masked = maskCode(raw);
+  const names = parseImports(raw).filter((ref) => !ref.typeOnly && masked[ref.start - 1] !== " " && SERVER_PACKAGE.test(ref.specifier)).map((ref) => ref.specifier);
+  return [...new Set(names)].sort();
+}
+function browserKeysListed(text, supabase2) {
+  const names = /* @__PURE__ */ new Set();
+  for (const line of text.replace(/\r\n/g, "\n").split("\n")) {
+    const name = /^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/.exec(line)?.[1];
+    if (name && isBrowserServerKey(name, supabase2)) names.add(name);
+  }
+  return [...names].sort();
+}
+var list4 = (names) => names.length > MAX_LIST4 ? `${names.slice(0, MAX_LIST4).join(", ")} and ${names.length - MAX_LIST4} more` : names.join(", ");
+var code = (names) => list4(names.map((n) => `\`${n}\``));
+var browserSecrets = {
+  id: "security.browser-secrets",
+  scope: "project",
+  category: "security",
+  title: "Server keys stay out of the browser",
+  obsV: 1,
+  applies: (ctx) => Boolean(ctx.stack.vite),
+  observe(ctx) {
+    const supabase2 = ctx.stack.supabase !== null;
+    const electron = Boolean(ctx.pkg?.dependencies?.electron || ctx.pkg?.devDependencies?.electron);
+    const items = [];
+    let files = 0;
+    for (const file2 of appCodeFiles(ctx)) {
+      const text = ctx.read(file2);
+      if (!text || !isBrowserFile(file2, text, true) || electron && ELECTRON_NODE.test(file2)) continue;
+      files++;
+      const names = browserKeysUsed(text, supabase2);
+      if (names.length)
+        items.push({
+          kind: "public-env",
+          facts: { names: names.length },
+          key: `${file2}:env`,
+          locations: [{ file: file2 }],
+          vars: { file: file2, names: code(names) },
+          meta: { names }
+        });
+      const packages = serverPackagesImported(text);
+      if (packages.length)
+        items.push({
+          kind: "server-package",
+          facts: { packages: packages.length },
+          key: `${file2}:package`,
+          locations: [{ file: file2 }],
+          vars: { file: file2, packages: code(packages) },
+          meta: { packages }
+        });
+    }
+    for (const file2 of ctx.files.filter((f) => ENV_EXAMPLE.test(f))) {
+      const names = browserKeysListed(ctx.read(file2) ?? "", supabase2);
+      if (names.length)
+        items.push({
+          kind: "env-example",
+          facts: { names: names.length },
+          key: `${file2}:example`,
+          locations: [{ file: file2 }],
+          vars: { file: file2, names: code(names) },
+          meta: { names }
+        });
+    }
+    return { facts: { files }, items };
+  }
+};
+
+// src/checks/security/edge-functions.ts
+import path33 from "path";
+
+// src/checks/hardcoded-urls.ts
+var STRING_OR_COMMENT = /("(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'|`(?:[^`\\]|\\.)*`)|\/\/[^\n]*|\/\*[\s\S]*?\*\//g;
+function stripComments2(text) {
+  return text.replace(/\r\n/g, "\n").replace(STRING_OR_COMMENT, (m, str) => str ?? m.replace(/[^\n]/g, " "));
+}
+var URL_RE = /\bhttps?:\/\/([a-z0-9-]+(?:\.[a-z0-9-]+)*)(?::\d+)?[^\s'"`)<>]*/gi;
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0"]);
+var IGNORED_HOSTS = [
+  "schema.org",
+  "json-schema.org",
+  "w3.org",
+  "github.com",
+  "githubusercontent.com",
+  "npmjs.org",
+  "npmjs.com",
+  "fonts.googleapis.com",
+  "fonts.gstatic.com",
+  // Package hosts Deno code (Supabase edge functions) imports from.
+  "esm.sh",
+  "deno.land",
+  "jsr.io",
+  "cdn.jsdelivr.net",
+  "unpkg.com",
+  "cdn.skypack.dev",
+  "example.com",
+  "example.org",
+  "example.net"
+];
+var RESERVED_TLD = /\.(?:example|test|invalid|local|localhost)$/;
+function isIgnoredHost(host) {
+  return RESERVED_TLD.test(host) || IGNORED_HOSTS.some((h) => host === h || host.endsWith(`.${h}`));
+}
+function inCdnTag(text, index) {
+  const open2 = text.lastIndexOf("<", index);
+  return open2 >= 0 && /^<(?:script|Script|link)\b[^>]*$/.test(text.slice(open2, index));
+}
+function findUrls(text) {
+  const code2 = stripComments2(text);
+  const hits = [];
+  for (const m of code2.matchAll(URL_RE)) {
+    const host = (m[1] ?? "").toLowerCase().replace(/^www\./, "");
+    if (!host || inCdnTag(code2, m.index)) continue;
+    hits.push({ host, url: m[0], index: m.index });
+  }
+  return hits;
+}
+var DEV_GUARD = /NODE_ENV\s*[!=]==?\s*['"`](?:development|production|test)['"`]|['"`](?:development|production|test)['"`]\s*[!=]==?\s*process\.env\.NODE_ENV|import\.meta\.env\.(?:DEV|PROD)\b|__DEV__|\bisDev(?:elopment)?\b|\bisProd(?:uction)?\b/;
+var ENV_FALLBACK = /(?:process\.env|import\.meta\.env)(?:\.\w+|\[['"]\w+['"]\])\s*(?:\?\?|\|\|)\s*$/;
+function isDevOnlyUse(code2, index) {
+  const lineStart = code2.lastIndexOf("\n", index - 1) + 1;
+  const before = code2.slice(lineStart, index).replace(/['"`]$/, "");
+  if (ENV_FALLBACK.test(before.trimEnd())) return true;
+  let start = lineStart;
+  for (let i = 0; i < 6 && start > 0; i++) start = code2.lastIndexOf("\n", start - 2) + 1;
+  const lineEnd = code2.indexOf("\n", index);
+  return DEV_GUARD.test(code2.slice(start, lineEnd === -1 ? void 0 : lineEnd));
+}
+var RUNS_LOCAL_SERVER = /\bcreateServer\s*\(|\.listen\s*\(/;
+
+// src/checks/security/edge-functions.ts
+var MAX_LIST5 = 20;
+var FUNCTION_ENTRY = /^(?:(.+)\/)?supabase\/functions\/([^/_.][^/]*)\/index\.[cm]?[jt]sx?$/;
+var IGNORE2 = /aura-ignore/;
+var USER_CHECK = /\.auth\s*\.\s*(?:getUser|getClaims)\s*\(|\bjwtVerify\s*\(|\bverifyJwt\s*\(/;
+var SIGNATURE_CHECK = /\.constructEvent(?:Async)?\s*\(|\bverifyWebhook\s*\(|\bnew\s+Webhook\s*\(|\.verify\s*\(\s*(?:payload|body|rawBody|text)|createHmac\s*\(|timingSafeEqual\s*\(|crypto\.subtle\.verify\s*\(|crypto\.subtle\.sign\s*\(\s*['"`]HMAC|\bverify\w*Signature\s*\(/;
+var HEADER_COMPARE = /(?:headers\.get\s*\([^)]*\)|authHeader|authorization|token)[^\n;]{0,160}(?:!==|===|!=|==)|(?:!==|===|!=|==)[^\n;]{0,160}(?:headers\.get\s*\(|authHeader|authorization)/i;
+var SHARED_SECRET2 = /Deno\.env\.get\s*\(\s*['"`][A-Z0-9_]*(?:SECRET|CRON|TOKEN|WEBHOOK)[A-Z0-9_]*['"`]\s*\)/;
+var ADMIN = /SUPABASE_SERVICE_ROLE_KEY|SERVICE_ROLE_KEY|SUPABASE_SECRET_KEY|['"`]service_role['"`]/;
+var ENV_GET = /Deno\.env\.get\s*\(\s*['"`]([A-Z][A-Z0-9_]*)['"`]\s*\)/g;
+var KEY_NAME = /KEY|SECRET|TOKEN|PASSWORD/;
+var SUPABASE_OWN = /^SUPABASE_/;
+function checksCaller(raw) {
+  const code2 = stripComments2(raw);
+  return USER_CHECK.test(code2) || SIGNATURE_CHECK.test(code2) || SHARED_SECRET2.test(code2) && HEADER_COMPARE.test(code2);
+}
+function keysRead(raw) {
+  const code2 = stripComments2(raw);
+  const names = [...code2.matchAll(ENV_GET)].map((m) => m[1] ?? "").filter((n) => KEY_NAME.test(n) && !SUPABASE_OWN.test(n));
+  return [...new Set(names)].sort();
+}
+function jwtOffFunctions(toml) {
+  const off = /* @__PURE__ */ new Set();
+  let current2 = null;
+  for (const line of toml.replace(/\r\n/g, "\n").split("\n")) {
+    const section = /^\s*\[functions\.(?:"([^"]+)"|([\w-]+))\]\s*$/.exec(line);
+    if (section) current2 = section[1] ?? section[2] ?? null;
+    else if (/^\s*\[/.test(line)) current2 = null;
+    else if (current2 && /^\s*verify_jwt\s*=\s*false\b/.test(line)) off.add(current2);
+  }
+  return off;
+}
+function sharedHelpers(ctx, file2, raw) {
+  return parseImports(raw).filter((ref) => ref.specifier.startsWith(".") && ref.specifier.includes("_shared")).map((ref) => path33.posix.normalize(path33.posix.join(path33.posix.dirname(file2), ref.specifier))).map((target) => ctx.read(target) ?? ctx.read(`${target}.ts`) ?? ctx.read(`${target}/index.ts`) ?? "");
+}
+var list5 = (names) => names.length > MAX_LIST5 ? `${names.slice(0, MAX_LIST5).join(", ")} and ${names.length - MAX_LIST5} more` : names.join(", ");
+var edgeFunctions = {
+  id: "security.edge-functions",
+  category: "security",
+  title: "Edge functions check who is calling",
+  obsV: 1,
+  applies: (ctx) => ctx.files.some((f) => FUNCTION_ENTRY.test(f)),
+  observe(ctx) {
+    const items = [];
+    let functions2 = 0;
+    let guarded2 = 0;
+    let ignored = 0;
+    const configs = /* @__PURE__ */ new Map();
+    for (const file2 of ctx.files.filter((f) => FUNCTION_ENTRY.test(f)).sort()) {
+      const [, prefix = "", name = ""] = FUNCTION_ENTRY.exec(file2) ?? [];
+      const raw = ctx.read(file2);
+      if (!raw) continue;
+      functions2++;
+      if (IGNORE2.test(raw)) {
+        ignored++;
+        continue;
+      }
+      if (checksCaller(raw) || sharedHelpers(ctx, file2, raw).some(checksCaller)) {
+        guarded2++;
+        continue;
+      }
+      const config2 = `${prefix ? `${prefix}/` : ""}supabase/config.toml`;
+      if (!configs.has(config2)) configs.set(config2, jwtOffFunctions(ctx.read(config2) ?? ""));
+      const jwtOff = configs.get(config2)?.has(name) ?? false;
+      const vars = { function: name, file: file2 };
+      if (ADMIN.test(stripComments2(raw))) {
+        items.push({ kind: "open-admin", facts: { jwtOff }, key: `${file2}:admin`, locations: [{ file: file2 }], vars, meta: { function: name, jwtOff } });
+        continue;
+      }
+      const keys = keysRead(raw);
+      if (keys.length)
+        items.push({
+          kind: "open-keys",
+          facts: { jwtOff, keys: keys.length },
+          key: `${file2}:keys`,
+          locations: [{ file: file2 }],
+          vars: { ...vars, keys: list5(keys.map((k) => `\`${k}\``)) },
+          meta: { function: name, jwtOff, keys }
+        });
+    }
+    return { facts: { functions: functions2, guarded: guarded2, ignored }, items };
+  }
+};
+
+// src/checks/security/supabase-code.ts
+var MAX_LIST6 = 20;
 var NOT_AURA2 = /(?:^|\/)(?:\.aura|\.claude|\.agents|\.cursor|\.codex|\.pi|node_modules)\//;
-var list4 = (items) => items.length > MAX_LIST4 ? `${items.slice(0, MAX_LIST4).join(", ")} and ${items.length - MAX_LIST4} more` : items.join(", ");
+var list6 = (items) => items.length > MAX_LIST6 ? `${items.slice(0, MAX_LIST6).join(", ")} and ${items.length - MAX_LIST6} more` : items.join(", ");
 function browserReason(file2, text) {
   if (isClientFile(text)) return "use-client";
   if (/(?:^|\/)(?:components|hooks)\//.test(file2)) return "browser-folder";
@@ -29308,8 +29819,8 @@ function bucketItems(buckets2) {
       kind,
       facts: { buckets: names.length },
       key: kind === "asset-buckets" ? "public-buckets|assets" : "public-buckets",
-      locations: files.slice(0, MAX_LIST4).map((file2) => ({ file: file2 })),
-      vars: { buckets: list4(names.map((n) => `"${n}"`)) },
+      locations: files.slice(0, MAX_LIST6).map((file2) => ({ file: file2 })),
+      vars: { buckets: list6(names.map((n) => `"${n}"`)) },
       meta: { buckets: names, files }
     });
   }
@@ -29325,8 +29836,8 @@ function functionItems(fns) {
     kind,
     facts: { functions: group.length },
     key: kind,
-    locations: [...new Set(group.map((f) => f.file))].slice(0, MAX_LIST4).map((file2) => ({ file: file2 })),
-    vars: { functions: list4(group.map(label2)) },
+    locations: [...new Set(group.map((f) => f.file))].slice(0, MAX_LIST6).map((file2) => ({ file: file2 })),
+    vars: { functions: list6(group.map(label2)) },
     meta: { functions: group.map(label2) }
   }));
 }
@@ -29365,9 +29876,9 @@ var supabaseCode = {
 };
 
 // src/checks/security/secrets.ts
-import { existsSync as existsSync20, mkdtempSync as mkdtempSync2, readFileSync as readFileSync17, rmSync as rmSync3 } from "fs";
+import { existsSync as existsSync22, mkdtempSync as mkdtempSync2, readFileSync as readFileSync18, rmSync as rmSync3 } from "fs";
 import os4 from "os";
-import path31 from "path";
+import path34 from "path";
 
 // src/checks/types.ts
 import { createHash as createHash3 } from "crypto";
@@ -29404,7 +29915,7 @@ function scanFilesForSecrets(ctx) {
     if (/(?:^|\/)\.env(?:\.[^/]+)?$/.test(file2) && !/\.(?:example|sample|template)$/.test(file2)) continue;
     const text = ctx.read(file2);
     if (!text) continue;
-    for (const m of findSecrets(text)) {
+    for (const m of findLeakedSecrets(text)) {
       hits.push({
         file: file2,
         line: lineOf(text, m.index),
@@ -29422,15 +29933,15 @@ async function gitleaksHistory(ctx) {
   if (!ctx.tracked) return null;
   const bin = await ensureTool("gitleaks", ctx.options.noDownload);
   if (!bin) return null;
-  const dir = mkdtempSync2(path31.join(os4.tmpdir(), "aura-gitleaks-"));
-  const report = path31.join(dir, "report.json");
+  const dir = mkdtempSync2(path34.join(os4.tmpdir(), "aura-gitleaks-"));
+  const report = path34.join(dir, "report.json");
   try {
     const r = await run(bin.path, ["git", "--no-banner", "--redact", "--report-format", "json", "--report-path", report, "--exit-code", "0", "."], {
       cwd: ctx.root,
       timeoutMs: 18e4
     });
-    if (r.code !== 0 || !existsSync20(report)) return null;
-    return { hits: JSON.parse(readFileSync17(report, "utf8")), engine: `gitleaks ${bin.version}` };
+    if (r.code !== 0 || !existsSync22(report)) return null;
+    return { hits: JSON.parse(readFileSync18(report, "utf8")), engine: `gitleaks ${bin.version}` };
   } catch {
     return null;
   } finally {
@@ -29504,7 +30015,7 @@ var envFiles = {
     return {
       facts: {},
       items: committed.map((file2) => {
-        const leaked = findSecrets(ctx.read(file2) ?? "").filter((m) => m.confidence === "high");
+        const leaked = findLeakedSecrets(ctx.read(file2) ?? "").filter((m) => m.confidence === "high");
         return {
           kind: "env-file",
           facts: { secrets: leaked.length },
@@ -29562,7 +30073,7 @@ function workflowProblems(doc) {
   }
   return { unpinned, noPermissions, prTargetCheckout, injections: [...injections].sort() };
 }
-var list5 = (items, max = 20) => `${items.slice(0, max).join(", ")}${items.length > max ? ` and ${items.length - max} more` : ""}`;
+var list7 = (items, max = 20) => `${items.slice(0, max).join(", ")}${items.length > max ? ` and ${items.length - max} more` : ""}`;
 var workflows = {
   id: "security.workflows",
   category: "security",
@@ -29592,7 +30103,7 @@ var workflows = {
         items.push({
           kind: "script-injection",
           key: `${file2}:script-injection`,
-          vars: { file: file2, expressions: list5(p2.injections) },
+          vars: { file: file2, expressions: list7(p2.injections) },
           meta: { expressions: p2.injections },
           ...at
         });
@@ -29602,7 +30113,7 @@ var workflows = {
           key: `${file2}:unpinned-actions`,
           ...at,
           facts: { workflow: parsed, actions: p2.unpinned.length },
-          vars: { file: file2, actions: list5(p2.unpinned) },
+          vars: { file: file2, actions: list7(p2.unpinned) },
           meta: { actions: p2.unpinned }
         });
       if (p2.noPermissions) items.push({ kind: "no-permissions", key: `${file2}:no-permissions`, vars: { file: file2 }, ...at });
@@ -29611,14 +30122,14 @@ var workflows = {
     return {
       facts: { parsed, unreadable: unreadable.length },
       items,
-      ...unreadable.length ? { vars: { unreadable: list5(unreadable, 5) } } : {}
+      ...unreadable.length ? { vars: { unreadable: list7(unreadable, 5) } } : {}
     };
   }
 };
 
 // src/checks/security/auth-signals.ts
-var inCode = (re) => (code) => re.test(code);
-var imports2 = (from, call) => (code, raw) => from.test(raw) && call.test(code);
+var inCode = (re) => (code2) => re.test(code2);
+var imports2 = (from, call) => (code2, raw) => from.test(raw) && call.test(code2);
 var CUSTOM = [
   ["passwords", inCode(/\b(?:bcrypt(?:js)?|argon2)\.(?:compare|verify|hash)(?:Sync)?\s*\(/)],
   ["passwords", imports2(/from\s+['"](?:bcrypt|bcryptjs|argon2|@node-rs\/(?:argon2|bcrypt))['"]/, /(?<![\w$.])(?:compare|verify|hash)(?:Sync)?\s*\(/)],
@@ -29684,18 +30195,18 @@ function pathReason(file2) {
 }
 function customReasons(text) {
   const raw = text.replace(/\r\n/g, "\n");
-  const code = maskCode(raw);
+  const code2 = maskCode(raw);
   const out = /* @__PURE__ */ new Set();
-  for (const [reason, test] of CUSTOM) if (!out.has(reason) && test(code, raw)) out.add(reason);
+  for (const [reason, test] of CUSTOM) if (!out.has(reason) && test(code2, raw)) out.add(reason);
   return [...out];
 }
 function usesProviderAuth(text) {
-  const code = maskCode(text.replace(/\r\n/g, "\n"));
-  return PROVIDER_AUTH.some((re) => re.test(code));
+  const code2 = maskCode(text.replace(/\r\n/g, "\n"));
+  return PROVIDER_AUTH.some((re) => re.test(code2));
 }
 function hasCredentialsSignIn(text) {
-  const code = maskCode(text.replace(/\r\n/g, "\n"));
-  return CREDENTIALS.test(code) && /\bauthorize\b/.test(code);
+  const code2 = maskCode(text.replace(/\r\n/g, "\n"));
+  return CREDENTIALS.test(code2) && /\bauthorize\b/.test(code2);
 }
 function authReasons(file2, text) {
   const custom2 = customReasons(text);
@@ -29719,7 +30230,7 @@ var LABELS2 = {
 var reasonText = (reasons) => reasons.map((r) => LABELS2[r]).join(" and ");
 
 // src/checks/security/auth-rate-limits.ts
-var MAX_LIST5 = 20;
+var MAX_LIST7 = 20;
 var cache2 = /* @__PURE__ */ new WeakMap();
 function authEntries(ctx) {
   const cached2 = cache2.get(ctx);
@@ -29752,7 +30263,7 @@ function label3(e) {
   const what = e.kind === "route" ? routePath(e) : e.kind === "action" ? `the server action in ${e.file}` : `the password sign-in in ${e.file}`;
   return `${what} (${reasonText(e.reasons)})`;
 }
-var list6 = (items) => items.length > MAX_LIST5 ? `${items.slice(0, MAX_LIST5).join(", ")} and ${items.length - MAX_LIST5} more` : items.join(", ");
+var list8 = (items) => items.length > MAX_LIST7 ? `${items.slice(0, MAX_LIST7).join(", ")} and ${items.length - MAX_LIST7} more` : items.join(", ");
 var authRateLimits = {
   id: "security.auth-rate-limits",
   category: "security",
@@ -29770,8 +30281,8 @@ var authRateLimits = {
           kind: "no-rate-limit",
           facts: { routes: open2.length },
           key: "auth-rate-limit",
-          locations: open2.slice(0, MAX_LIST5).map((e) => ({ file: e.file })),
-          vars: { list: list6(open2.map(label3)) },
+          locations: open2.slice(0, MAX_LIST7).map((e) => ({ file: e.file })),
+          vars: { list: list8(open2.map(label3)) },
           meta: { files: open2.map((e) => e.file), reasons: open2.map((e) => `${e.file}: ${e.reasons.join(", ")}`) }
         }
       ] : [],
@@ -29798,7 +30309,7 @@ var PROVIDER_MARKS = [
   ["Paddle", /paddle-signature/i]
 ];
 function webhookProvider(file2, text) {
-  const find = (list9, s) => list9.find(([, re]) => re.test(s))?.[0];
+  const find = (list11, s) => list11.find(([, re]) => re.test(s))?.[0];
   return find(PROVIDERS, file2) ?? find(PROVIDER_MARKS, text) ?? find(PROVIDERS, text) ?? null;
 }
 function importedNames(clause) {
@@ -29817,15 +30328,15 @@ function importedNames(clause) {
   return { calls, namespaces };
 }
 var escapeName = (s) => s.replace(/[$]/g, "\\$");
-function helperVerifies(from, text, files, read2, aliases) {
+function helperVerifies(from, text, files, read3, aliases) {
   const raw = text.replace(/\r\n/g, "\n");
-  const code = maskCode(raw);
+  const code2 = maskCode(raw);
   for (const m of raw.matchAll(/import\s+(?!type\s)([^'";]+?)\s+from\s+['"]([^'"\n]+)['"]/g)) {
     const [, clause = "", spec = ""] = m;
     const target = resolveFrom(from, spec, files, aliases);
-    if (!target || !verifiesInText(read2(target) ?? "")) continue;
+    if (!target || !verifiesInText(read3(target) ?? "")) continue;
     const { calls, namespaces } = importedNames(clause);
-    const called = calls.some((n) => new RegExp(String.raw`(?<![\w$.])${escapeName(n)}\s*\(`).test(code)) || namespaces.some((n) => new RegExp(String.raw`(?<![\w$.])${escapeName(n)}\s*\.\s*[\w$]+\s*\(`).test(code));
+    const called = calls.some((n) => new RegExp(String.raw`(?<![\w$.])${escapeName(n)}\s*\(`).test(code2)) || namespaces.some((n) => new RegExp(String.raw`(?<![\w$.])${escapeName(n)}\s*\.\s*[\w$]+\s*\(`).test(code2));
     if (called) return target;
   }
   return null;
@@ -29876,33 +30387,33 @@ function readCode(text) {
   const masked = maskCode(src);
   return { src, masked, requestVars: requestVariables(masked) };
 }
-function span(code, from, to) {
-  return { raw: code.src.slice(from, to), masked: code.masked.slice(from, to), start: from };
+function span(code2, from, to) {
+  return { raw: code2.src.slice(from, to), masked: code2.masked.slice(from, to), start: from };
 }
 function trimSpan(s) {
   const lead = s.masked.length - s.masked.trimStart().length;
   const len = s.masked.trim().length;
   return { raw: s.raw.slice(lead, lead + len), masked: s.masked.slice(lead, lead + len), start: s.start + lead };
 }
-function splitTop(code, from, to, sep = ",") {
+function splitTop(code2, from, to, sep = ",") {
   const parts = [];
   let depth = 0;
   let start = from;
   for (let i = from; i < to; i++) {
-    const c = code.masked[i];
+    const c = code2.masked[i];
     if (c === "(" || c === "[" || c === "{") depth++;
     else if (c === ")" || c === "]" || c === "}") depth--;
-    else if (c === sep && depth === 0 && !(sep === "+" && (code.masked[i + 1] === "+" || code.masked[i - 1] === "+"))) {
-      parts.push(trimSpan(span(code, start, i)));
+    else if (c === sep && depth === 0 && !(sep === "+" && (code2.masked[i + 1] === "+" || code2.masked[i - 1] === "+"))) {
+      parts.push(trimSpan(span(code2, start, i)));
       start = i + 1;
     }
   }
-  parts.push(trimSpan(span(code, start, to)));
+  parts.push(trimSpan(span(code2, start, to)));
   return parts.filter((p2) => p2.masked.length > 0);
 }
-function callArgs(code, open2) {
-  const close = closingIndex(code.masked, open2);
-  return close < 0 ? null : splitTop(code, open2 + 1, close - 1);
+function callArgs(code2, open2) {
+  const close = closingIndex(code2.masked, open2);
+  return close < 0 ? null : splitTop(code2, open2 + 1, close - 1);
 }
 var CONTINUES_AFTER = /[=+\-*/%|&?:,(<>!~^[{.]$/;
 var CONTINUES_BEFORE = /^[.?:+\-*/%|&,)\]}]/;
@@ -29927,13 +30438,13 @@ function statementEnd(masked, from, limit = 2e3) {
   }
   return end;
 }
-function assignedValue(code, name, before = code.masked.length) {
+function assignedValue2(code2, name, before = code2.masked.length) {
   const re = new RegExp(`(?<![\\w$])(?:const|let|var)\\s+${name.replace(/\$/g, "\\$")}\\s*(?::[^=;\\n]+)?=(?![=>])`, "g");
   let last = null;
-  for (const m of code.masked.matchAll(re)) if (m.index < before) last = m;
+  for (const m of code2.masked.matchAll(re)) if (m.index < before) last = m;
   if (!last) return null;
   const from = last.index + last[0].length;
-  return trimSpan(span(code, from, statementEnd(code.masked, from)));
+  return trimSpan(span(code2, from, statementEnd(code2.masked, from)));
 }
 function unwrap2(s) {
   let cur = trimSpan(s);
@@ -29957,39 +30468,39 @@ function unwrap2(s) {
 }
 var QUOTED = /^(['"])\s*\1$/;
 var PLAIN_TEMPLATE = /^`[^`]*`$/;
-function isLiteral(code, s) {
+function isLiteral(code2, s) {
   const u = unwrap2(s);
   const m = u.masked;
   if (QUOTED.test(m) || PLAIN_TEMPLATE.test(m) && !m.includes("${") || /^-?\d[\d_.eE]*$/.test(m) || /^(?:null|undefined|true|false)$/.test(m)) return true;
-  const parts = splitTop(code, u.start, u.start + m.length, "+");
-  return parts.length > 1 && parts.every((p2) => isLiteral(code, p2));
+  const parts = splitTop(code2, u.start, u.start + m.length, "+");
+  return parts.length > 1 && parts.every((p2) => isLiteral(code2, p2));
 }
 function startsAsString(s) {
   return /^['"`]/.test(unwrap2(s).masked);
 }
-function templateParts(code, s) {
+function templateParts(code2, s) {
   const u = unwrap2(s);
   if (!u.masked.startsWith("`")) return null;
   const parts = [];
   const end = u.start + u.masked.length;
   for (let i = u.start + 1; i < end; i++) {
-    if (code.masked[i] === "`") break;
-    if (code.masked[i] === "$" && code.masked[i + 1] === "{") {
-      const close = closingIndex(code.masked, i + 1);
+    if (code2.masked[i] === "`") break;
+    if (code2.masked[i] === "$" && code2.masked[i + 1] === "{") {
+      const close = closingIndex(code2.masked, i + 1);
       if (close < 0) break;
-      parts.push(trimSpan(span(code, i + 2, close - 1)));
+      parts.push(trimSpan(span(code2, i + 2, close - 1)));
       i = close - 1;
     }
   }
   return parts;
 }
-function builtParts(code, s) {
-  const tpl = templateParts(code, s);
+function builtParts(code2, s) {
+  const tpl = templateParts(code2, s);
   if (tpl) return tpl.length ? tpl : null;
   const u = unwrap2(s);
-  const operands = splitTop(code, u.start, u.start + u.masked.length, "+");
+  const operands = splitTop(code2, u.start, u.start + u.masked.length, "+");
   if (operands.length < 2 || !operands.some((p2) => startsAsString(p2))) return null;
-  const dynamic = operands.flatMap((p2) => isLiteral(code, p2) ? [] : templateParts(code, p2) ?? [p2]);
+  const dynamic = operands.flatMap((p2) => isLiteral(code2, p2) ? [] : templateParts(code2, p2) ?? [p2]);
   return dynamic.length ? dynamic : null;
 }
 var isConstant = (s) => /^[A-Z][A-Z0-9_]*(?:\.[A-Z][A-Z0-9_]*)*$/.test(unwrap2(s).masked);
@@ -29997,8 +30508,8 @@ var REQUEST2 = /(?<![\w$])(?:req|request|event|ctx|context|c\.req)\s*\??\.\s*(?:
 var DECLARATION = /(?<![\w$])(?:const|let|var)\s+(?:([\w$]+)|\{([^}]*)\}|\[([^\]]*)\])\s*(?::[^=;\n]+)?=(?![=>])/g;
 function boundNames(m) {
   if (m[1]) return [m[1]];
-  const list9 = m[2] ?? m[3] ?? "";
-  return list9.split(",").map((part) => {
+  const list11 = m[2] ?? m[3] ?? "";
+  return list11.split(",").map((part) => {
     const p2 = part.trim().replace(/^\.\.\./, "");
     const target = p2.includes(":") ? p2.slice(p2.indexOf(":") + 1) : p2;
     return target.split("=")[0]?.trim() ?? "";
@@ -30020,13 +30531,13 @@ function mentionsRequest(masked, vars) {
   for (const word of masked.matchAll(/(?<![\w$.])[A-Za-z_$][\w$]*/g)) if (vars.has(word[0])) return true;
   return false;
 }
-function fromRequest(code, s) {
-  return mentionsRequest(s.masked, code.requestVars);
+function fromRequest(code2, s) {
+  return mentionsRequest(s.masked, code2.requestVars);
 }
-var readsRequest = (code) => REQUEST2.test(code.masked);
+var readsRequest = (code2) => REQUEST2.test(code2.masked);
 var FETCHED = /(?<![\w$.])fetch\s*\(|(?<!(?:Array|Buffer|Object|Uint8Array|Observable|Set|Map)\s*)\.\s*from\s*\(|\.\s*select\s*\(|\.\s*find(?:Many|Unique|First)\w*\s*\(/;
-var readsFetchedData = (code) => FETCHED.test(code.masked);
-var isCode2 = (code, index) => code.masked[index] === code.src[index];
+var readsFetchedData = (code2) => FETCHED.test(code2.masked);
+var isCode2 = (code2, index) => code2.masked[index] === code2.src[index];
 
 // src/checks/security/risky-code-cors.ts
 var ANY = "cors-any";
@@ -30041,9 +30552,9 @@ var CORS_IMPORT = [
   /import\s*\{[^}]*\bcors\b(?:\s+as\s+([\w$]+))?[^}]*\}\s*from\s*(['"])hono\/cors\2/g,
   /(?:const|let|var)\s+([\w$]+)\s*=\s*require\s*\(\s*(['"])cors\2\s*\)/g
 ];
-function corsNames(code) {
+function corsNames(code2) {
   const names = /* @__PURE__ */ new Set();
-  for (const re of CORS_IMPORT) for (const m of code.src.matchAll(re)) if (isCode2(code, m.index)) names.add(m[1] ?? "cors");
+  for (const re of CORS_IMPORT) for (const m of code2.src.matchAll(re)) if (isCode2(code2, m.index)) names.add(m[1] ?? "cors");
   return [...names];
 }
 function corsOptions(options) {
@@ -30055,22 +30566,22 @@ function corsOptions(options) {
   const value = options.raw.slice((origin.index ?? 0) + origin[0].length);
   return { open: /^(?:true\b|(['"`])\*\1)/.test(value), credentials };
 }
-function corsInCode(code) {
+function corsInCode(code2) {
   const open2 = [];
-  for (const re of [HEADER_ANY, KV_ANY]) for (const m of code.src.matchAll(re)) if (isCode2(code, m.index)) open2.push({ index: m.index, what: ANY });
-  if (READS_ORIGIN.test(code.src) && !CHECKS_ORIGIN.test(code.masked)) {
-    for (const m of code.src.matchAll(HEADER_VALUE)) {
-      const after = code.masked.slice(m.index + m[0].length, m.index + m[0].length + 120).split(/[)},;\n]/)[0] ?? "";
-      if (isCode2(code, m.index) && /origin/i.test(after) && !/^\s*['"`]/.test(after)) open2.push({ index: m.index, what: "cors-echo" });
+  for (const re of [HEADER_ANY, KV_ANY]) for (const m of code2.src.matchAll(re)) if (isCode2(code2, m.index)) open2.push({ index: m.index, what: ANY });
+  if (READS_ORIGIN.test(code2.src) && !CHECKS_ORIGIN.test(code2.masked)) {
+    for (const m of code2.src.matchAll(HEADER_VALUE)) {
+      const after = code2.masked.slice(m.index + m[0].length, m.index + m[0].length + 120).split(/[)},;\n]/)[0] ?? "";
+      if (isCode2(code2, m.index) && /origin/i.test(after) && !/^\s*['"`]/.test(after)) open2.push({ index: m.index, what: "cors-echo" });
     }
   }
-  let credentials = [...code.src.matchAll(CREDENTIALS2)].some((m) => isCode2(code, m.index));
-  for (const name of corsNames(code)) {
+  let credentials = [...code2.src.matchAll(CREDENTIALS2)].some((m) => isCode2(code2, m.index));
+  for (const name of corsNames(code2)) {
     const esc3 = name.replace(/\$/g, "\\$");
     const calls = new RegExp(`(?<![\\w$.])${esc3}\\s*\\(|(?<![\\w$])register\\s*\\(\\s*${esc3}\\s*(?=[,)])`, "g");
-    for (const m of code.masked.matchAll(calls)) {
+    for (const m of code2.masked.matchAll(calls)) {
       const isRegister = m[0].startsWith("register");
-      const args = callArgs(code, isRegister ? m.index + m[0].indexOf("(") : m.index + m[0].length - 1);
+      const args = callArgs(code2, isRegister ? m.index + m[0].indexOf("(") : m.index + m[0].length - 1);
       if (!args) continue;
       const opts = corsOptions(isRegister ? args[1] : args[0]);
       credentials ||= opts.credentials;
@@ -30090,8 +30601,8 @@ function corsInVercelJson(text) {
   let open2 = false;
   let credentials = false;
   for (const group of Array.isArray(groups) ? groups : []) {
-    const list9 = group.headers;
-    for (const h of Array.isArray(list9) ? list9 : []) {
+    const list11 = group.headers;
+    for (const h of Array.isArray(list11) ? list11 : []) {
       const key = String(h.key ?? "").toLowerCase();
       const value = String(h.value ?? "").trim();
       if (key === "access-control-allow-origin" && value === "*") open2 = true;
@@ -30103,8 +30614,8 @@ function corsInVercelJson(text) {
 }
 var SIGN_IN = /\.\s*auth\s*\.\s*get(?:User|Session|Claims)\s*\(|(?<![\w$.])(?:getServerSession|getSession|getUser|currentUser|getAuth|requireAuth|requireUser|withAuth|verifyToken|getToken|jwtVerify)\s*\(|(?<![\w$.])auth\s*\(\s*\)|(?<![\w$.])cookies\s*\(|\.\s*cookies\b|\bjwt\s*\.\s*verify\s*\(/;
 var AUTH_HEADER = /(?:get\s*\(\s*|\[\s*)(['"`])(?:authorization|cookie)\1/gi;
-function checksSignIn(code) {
-  return SIGN_IN.test(code.masked) || [...code.src.matchAll(AUTH_HEADER)].some((m) => isCode2(code, m.index));
+function checksSignIn(code2) {
+  return SIGN_IN.test(code2.masked) || [...code2.src.matchAll(AUTH_HEADER)].some((m) => isCode2(code2, m.index));
 }
 function corsHits(reading, signIn2) {
   if (!reading.open.length || !reading.credentials && !signIn2) return [];
@@ -30116,60 +30627,60 @@ function corsHits(reading, signIn2) {
 // src/checks/security/risky-code-inject.ts
 var SANITISER = /(?<![\w$])[\w$]*(?:saniti[sz]e|purify|escape|safe)[\w$]*(?=\s*\()|(?<![\w$.])xss(?=\s*\()|\bsanitize\s*:\s*true\b/gi;
 var cleans = (masked) => [...masked.matchAll(SANITISER)].some((m) => !/unsafe/i.test(m[0]));
-function cleanHtml(code, s, depth = 0) {
+function cleanHtml(code2, s, depth = 0) {
   const u = unwrap2(s);
-  if (isLiteral(code, u) || cleans(u.masked)) return true;
+  if (isLiteral(code2, u) || cleans(u.masked)) return true;
   if (depth < 2 && /^[\w$]+$/.test(u.masked)) {
-    const value = assignedValue(code, u.masked, u.start);
-    return value ? cleanHtml(code, value, depth + 1) : false;
+    const value = assignedValue2(code2, u.masked, u.start);
+    return value ? cleanHtml(code2, value, depth + 1) : false;
   }
   return false;
 }
-function htmlValue(code, expr, depth = 0) {
+function htmlValue(code2, expr, depth = 0) {
   const u = unwrap2(expr);
-  if (u.masked.startsWith("{") && closingIndex(code.masked, u.start) === u.start + u.masked.length) {
-    for (const entry of splitTop(code, u.start + 1, u.start + u.masked.length - 1)) {
+  if (u.masked.startsWith("{") && closingIndex(code2.masked, u.start) === u.start + u.masked.length) {
+    for (const entry of splitTop(code2, u.start + 1, u.start + u.masked.length - 1)) {
       const key = entry.masked.match(/^__html\s*(:)?/);
       if (!key) continue;
-      return key[1] ? trimSpan(span(code, entry.start + key[0].length, entry.start + entry.masked.length)) : entry;
+      return key[1] ? trimSpan(span(code2, entry.start + key[0].length, entry.start + entry.masked.length)) : entry;
     }
   }
   if (depth < 1 && /^[\w$]+$/.test(u.masked)) {
-    const value = assignedValue(code, u.masked, u.start);
-    if (value?.masked.startsWith("{")) return htmlValue(code, value, depth + 1);
+    const value = assignedValue2(code2, u.masked, u.start);
+    if (value?.masked.startsWith("{")) return htmlValue(code2, value, depth + 1);
   }
   return u;
 }
-function tagOf(code, index) {
-  const open2 = code.masked.lastIndexOf("<", index);
-  return open2 < 0 ? "" : code.src.slice(open2, index);
+function tagOf(code2, index) {
+  const open2 = code2.masked.lastIndexOf("<", index);
+  return open2 < 0 ? "" : code2.src.slice(open2, index);
 }
-function unsafeHtml(code) {
-  if (/(['"])rehype-sanitize\1/.test(code.src) || /\brehypeSanitize\b/.test(code.masked)) return [];
+function unsafeHtml(code2) {
+  if (/(['"])rehype-sanitize\1/.test(code2.src) || /\brehypeSanitize\b/.test(code2.masked)) return [];
   const hits = [];
-  const fileHigh = readsRequest(code) || readsFetchedData(code);
+  const fileHigh = readsRequest(code2) || readsFetchedData(code2);
   const push = (index, value, what, styleTag = false) => {
-    if (cleanHtml(code, value)) return;
-    const high = fileHigh || fromRequest(code, value);
+    if (cleanHtml(code2, value)) return;
+    const high = fileHigh || fromRequest(code2, value);
     if (styleTag && !high) return;
     hits.push({ kind: "html", severity: high ? "high" : "medium", index, what });
   };
-  for (const m of code.masked.matchAll(/(?<![\w$])dangerouslySetInnerHTML\s*=\s*\{/g)) {
+  for (const m of code2.masked.matchAll(/(?<![\w$])dangerouslySetInnerHTML\s*=\s*\{/g)) {
     const open2 = m.index + m[0].length - 1;
-    const close = closingIndex(code.masked, open2);
+    const close = closingIndex(code2.masked, open2);
     if (close < 0) continue;
-    const value = htmlValue(code, trimSpan(span(code, open2 + 1, close - 1)));
-    const tag = tagOf(code, m.index);
+    const value = htmlValue(code2, trimSpan(span(code2, open2 + 1, close - 1)));
+    const tag = tagOf(code2, m.index);
     const json2 = /^<script\b/.test(tag) && /type\s*=\s*\{?\s*(['"`])application\/(?:ld\+)?json\1/.test(tag);
     if (json2 && /JSON\s*\.\s*stringify\s*\(/.test(value.masked)) continue;
     push(m.index, value, "html-prop", /^<style\b/.test(tag));
   }
-  for (const m of code.masked.matchAll(/\.\s*(?:inner|outer)HTML\s*\+?=(?![=>])/g)) {
+  for (const m of code2.masked.matchAll(/\.\s*(?:inner|outer)HTML\s*\+?=(?![=>])/g)) {
     const from = m.index + m[0].length;
-    push(m.index, trimSpan(span(code, from, statementEnd(code.masked, from))), "html-inner");
+    push(m.index, trimSpan(span(code2, from, statementEnd(code2.masked, from))), "html-inner");
   }
-  for (const m of code.masked.matchAll(/\.\s*insertAdjacentHTML\s*\(/g)) {
-    const html = callArgs(code, m.index + m[0].length - 1)?.[1];
+  for (const m of code2.masked.matchAll(/\.\s*insertAdjacentHTML\s*\(/g)) {
+    const html = callArgs(code2, m.index + m[0].length - 1)?.[1];
     if (html) push(m.index, html, "html-adjacent");
   }
   return hits;
@@ -30180,72 +30691,72 @@ var TIMER = /(?<![\w$.])(?:(?:window|globalThis|self)\s*\.\s*)?set(?:Timeout|Int
 var VM = /(?<![\w$])vm\s*\.\s*(?:runIn(?:New|This)?Context|compileFunction)\s*\(|(?<![\w$])new\s+vm\s*\.\s*Script\s*\(/g;
 var VM_BARE = /(?<![\w$.])(?:runIn(?:New|This)?Context|compileFunction)\s*\(|(?<![\w$.])new\s+Script\s*\(/g;
 var IMPORTS_VM = /(?:\bfrom\s*|\brequire\s*\(\s*)(['"])(?:node:)?vm\1/;
-function codeFromText(code) {
+function codeFromText(code2) {
   const hits = [];
   const check2 = (re, what, bad) => {
-    for (const m of code.masked.matchAll(re)) {
-      const args = callArgs(code, m.index + m[0].length - 1);
+    for (const m of code2.masked.matchAll(re)) {
+      const args = callArgs(code2, m.index + m[0].length - 1);
       if (!args || !bad(args)) continue;
-      hits.push({ kind: "eval", severity: args.some((a) => fromRequest(code, a)) ? "high" : "medium", index: m.index, what });
+      hits.push({ kind: "eval", severity: args.some((a) => fromRequest(code2, a)) ? "high" : "medium", index: m.index, what });
     }
   };
-  const dynamic = (args) => args.length > 0 && !args.every((a) => isLiteral(code, a));
+  const dynamic = (args) => args.length > 0 && !args.every((a) => isLiteral(code2, a));
   check2(EVAL, "eval", dynamic);
   check2(FUNCTION, "new-function", dynamic);
   check2(TIMER, "timer", (args) => args[0] !== void 0 && startsAsString(args[0]));
-  const firstDynamic = (args) => args[0] !== void 0 && !isLiteral(code, args[0]);
+  const firstDynamic = (args) => args[0] !== void 0 && !isLiteral(code2, args[0]);
   check2(VM, "vm", firstDynamic);
-  if (IMPORTS_VM.test(code.src)) check2(VM_BARE, "vm", firstDynamic);
+  if (IMPORTS_VM.test(code2.src)) check2(VM_BARE, "vm", firstDynamic);
   return hits;
 }
 var SQL_TEXT = /\bselect\b[\s\S]*?\bfrom\b|\binsert\s+into\b|\bupdate\s+[\w$."`{}]+\s+set\b|\bdelete\s+from\b|\bwhere\b/i;
 var SQL_SINK = /\.\s*(?:query|execute|raw|unsafe|\$queryRawUnsafe|\$executeRawUnsafe)\s*\(/g;
 var DB_SINK = /(?<![\w$])(?:[\w$]*(?:db|database|sqlite)|DB)\s*\.\s*(?:run|all|get|exec|prepare|each)\s*\(/gi;
 var FILTER_TEXT = /\.(?:eq|neq|gt|gte|lt|lte|like|ilike|is|in|cs|cd|ov|fts|plfts|phfts|wfts|match|imatch)\./;
-var PLACEHOLDER = /(['"`])\s*[$?]/;
+var PLACEHOLDER2 = /(['"`])\s*[$?]/;
 var ID_LIKE = /(?:^|\.)id$|[a-z]Id$|_id$|ID$/;
-function riskyParts(code, s, ids = false) {
-  const parts = builtParts(code, s) ?? [];
+function riskyParts(code2, s, ids = false) {
+  const parts = builtParts(code2, s) ?? [];
   return parts.filter((p2) => {
-    if (isConstant(p2) || PLACEHOLDER.test(p2.raw)) return false;
-    if (ids && !fromRequest(code, p2) && ID_LIKE.test(unwrap2(p2).masked)) return false;
+    if (isConstant(p2) || PLACEHOLDER2.test(p2.raw)) return false;
+    if (ids && !fromRequest(code2, p2) && ID_LIKE.test(unwrap2(p2).masked)) return false;
     return true;
   });
 }
-function queryText(code, arg) {
+function queryText(code2, arg) {
   const u = unwrap2(arg);
-  if (/^[\w$]+$/.test(u.masked)) return assignedValue(code, u.masked, u.start) ?? u;
+  if (/^[\w$]+$/.test(u.masked)) return assignedValue2(code2, u.masked, u.start) ?? u;
   return u;
 }
-function stringSql(code) {
+function stringSql(code2) {
   const hits = [];
-  const add = (index, parts, what) => hits.push({ kind: "sql", severity: parts.some((p2) => fromRequest(code, p2)) ? "high" : "medium", index, what });
+  const add = (index, parts, what) => hits.push({ kind: "sql", severity: parts.some((p2) => fromRequest(code2, p2)) ? "high" : "medium", index, what });
   for (const re of [SQL_SINK, DB_SINK]) {
-    for (const m of code.masked.matchAll(re)) {
-      const first = callArgs(code, m.index + m[0].length - 1)?.[0];
+    for (const m of code2.masked.matchAll(re)) {
+      const first = callArgs(code2, m.index + m[0].length - 1)?.[0];
       if (!first) continue;
-      const text = queryText(code, first);
-      const parts = riskyParts(code, text);
+      const text = queryText(code2, first);
+      const parts = riskyParts(code2, text);
       if (parts.length && SQL_TEXT.test(text.raw)) add(m.index, parts, "sql-text");
     }
   }
-  for (const m of code.masked.matchAll(/\.\s*rpc\s*\(/g)) {
-    const params = callArgs(code, m.index + m[0].length - 1)?.[1];
+  for (const m of code2.masked.matchAll(/\.\s*rpc\s*\(/g)) {
+    const params = callArgs(code2, m.index + m[0].length - 1)?.[1];
     if (!params?.masked.startsWith("{")) continue;
-    const values = splitTop(code, params.start + 1, params.start + params.masked.length - 1).map((e) => {
+    const values = splitTop(code2, params.start + 1, params.start + params.masked.length - 1).map((e) => {
       const colon = e.masked.match(/^[\w$]+\s*:/);
-      return colon ? trimSpan(span(code, e.start + colon[0].length, e.start + e.masked.length)) : e;
+      return colon ? trimSpan(span(code2, e.start + colon[0].length, e.start + e.masked.length)) : e;
     });
-    const parts = values.flatMap((v) => SQL_TEXT.test(v.raw) ? riskyParts(code, v) : []);
+    const parts = values.flatMap((v) => SQL_TEXT.test(v.raw) ? riskyParts(code2, v) : []);
     if (parts.length) add(m.index, parts, "sql-rpc");
   }
-  for (const m of code.masked.matchAll(/\.\s*(or|filter)\s*\(/g)) {
-    const args = callArgs(code, m.index + m[0].length - 1);
+  for (const m of code2.masked.matchAll(/\.\s*(or|filter)\s*\(/g)) {
+    const args = callArgs(code2, m.index + m[0].length - 1);
     if (!args) continue;
     const isOr = m[1] === "or";
     if (!isOr && args.length < 2) continue;
     const candidates2 = isOr ? args.slice(0, 1).filter((a) => FILTER_TEXT.test(a.raw)) : args;
-    const parts = candidates2.flatMap((a) => riskyParts(code, a, true));
+    const parts = candidates2.flatMap((a) => riskyParts(code2, a, true));
     if (parts.length) add(m.index, parts, isOr ? "sql-or" : "sql-filter");
   }
   return hits;
@@ -30273,13 +30784,13 @@ function callsValidator(masked) {
 var DOUBLE_SLASH_CHECK = /startsWith\s*\(\s*(['"`])(?:\/\/|\\\\)\1|\^\\\/\(\?!|\^\/\(\?!\//;
 var SINGLE_SLASH_CHECK = /startsWith\s*\(\s*(['"`])\/\1/;
 var ORIGIN_PREFIX = /^`\$\{\s*[\w$.]*origin\s*\}|^[\w$.]*origin\s*\+/i;
-function nextVariables(code) {
+function nextVariables(code2) {
   const vars = /* @__PURE__ */ new Set();
   const decl = /(?<![\w$])(?:const|let|var)\s+(?:([\w$]+)|\{([^}]*)\})\s*(?::[^=;\n]+)?=(?![=>])/g;
   for (let pass = 0; pass < 2; pass++) {
-    for (const m of code.masked.matchAll(decl)) {
+    for (const m of code2.masked.matchAll(decl)) {
       const from = m.index + m[0].length;
-      const value = trimSpan(span(code, from, statementEnd(code.masked, from)));
+      const value = trimSpan(span(code2, from, statementEnd(code2.masked, from)));
       if (m[1]) {
         if (isSource(value, vars)) vars.add(m[1]);
       } else if (PARAM_OBJECT.test(value.masked)) {
@@ -30302,10 +30813,10 @@ function startsWithLocalPath(s) {
   const raw = unwrap2(s).raw;
   return /^(['"`])\/(?![/\\])[^'"`$]/.test(raw);
 }
-function openRedirects(code) {
-  if (VALIDATED_MASKED.test(code.masked) || callsValidator(code.masked) || DOUBLE_SLASH_CHECK.test(code.src)) return [];
-  const vars = nextVariables(code);
-  const singleSlash = SINGLE_SLASH_CHECK.test(code.src);
+function openRedirects(code2) {
+  if (VALIDATED_MASKED.test(code2.masked) || callsValidator(code2.masked) || DOUBLE_SLASH_CHECK.test(code2.src)) return [];
+  const vars = nextVariables(code2);
+  const singleSlash = SINGLE_SLASH_CHECK.test(code2.src);
   const hits = [];
   const consider = (index, value) => {
     const u = unwrap2(value);
@@ -30313,12 +30824,12 @@ function openRedirects(code) {
     if (singleSlash && ORIGIN_PREFIX.test(u.masked)) return;
     hits.push({ kind: "redirect", severity: "medium", index, what: "redirect" });
   };
-  for (const m of code.masked.matchAll(SINK)) {
-    for (const arg of callArgs(code, m.index + m[0].length - 1) ?? []) consider(m.index, arg);
+  for (const m of code2.masked.matchAll(SINK)) {
+    for (const arg of callArgs(code2, m.index + m[0].length - 1) ?? []) consider(m.index, arg);
   }
-  for (const m of code.masked.matchAll(ASSIGN)) {
+  for (const m of code2.masked.matchAll(ASSIGN)) {
     const from = m.index + m[0].length;
-    consider(m.index, trimSpan(span(code, from, statementEnd(code.masked, from))));
+    consider(m.index, trimSpan(span(code2, from, statementEnd(code2.masked, from))));
   }
   return hits;
 }
@@ -30333,8 +30844,8 @@ var NOT_CONFIG = /(?:^|\/)(?:node_modules|\.next|\.vercel|dist|build|out|\.aura|
 var NEXT_CONFIG = /(?:^|\/)next\.config\.[cm]?[jt]s$/;
 var VERCEL_JSON = /(?:^|\/)vercel\.json$/;
 var ROUTE_FILE3 = /(?:^|\/)(?:route|middleware|proxy)\.[cm]?[jt]s$|(?:^|\/)pages\/api\//;
-function hitsIn(code) {
-  return [...unsafeHtml(code), ...codeFromText(code), ...stringSql(code), ...openRedirects(code), ...corsHits(corsInCode(code), checksSignIn(code))];
+function hitsIn(code2) {
+  return [...unsafeHtml(code2), ...codeFromText(code2), ...stringSql(code2), ...openRedirects(code2), ...corsHits(corsInCode(code2), checksSignIn(code2))];
 }
 var riskyCode = {
   id: "security.risky-code",
@@ -30349,9 +30860,9 @@ var riskyCode = {
     for (const file2 of files) {
       const text = ctx.read(file2);
       if (!text) continue;
-      const code = readCode(text);
-      byFile.set(file2, { text, hits: hitsIn(code) });
-      if (ROUTE_FILE3.test(file2) && checksSignIn(code)) signInRoutes = true;
+      const code2 = readCode(text);
+      byFile.set(file2, { text, hits: hitsIn(code2) });
+      if (ROUTE_FILE3.test(file2) && checksSignIn(code2)) signInRoutes = true;
     }
     for (const file2 of ctx.files.filter((f) => !NOT_CONFIG.test(f) && (NEXT_CONFIG.test(f) || VERCEL_JSON.test(f)))) {
       const text = ctx.read(file2);
@@ -30401,6 +30912,7 @@ var securityChecks = [
   deps,
   rls,
   apiRoutes,
+  edgeFunctions,
   headers,
   ...CONNECTORS2.map(toolSettingsCheck),
   workflows,
@@ -30411,17 +30923,18 @@ var securityChecks = [
   webhooks,
   supabaseCode,
   serverOnly,
+  browserSecrets,
   riskyCode,
   databaseBackups
 ];
 
 // src/checks/structure.ts
-import path38 from "path";
+import path41 from "path";
 
 // src/checks/debug-logs.ts
 var USE_CLIENT = /^?(?:\s|\/\/[^\n]*\n|\/\*[\s\S]*?\*\/)*['"]use client['"]/;
 var DEBUG_CALL = /(?<![\w$])console\s*\??\.\s*(?:log|debug|info|table|dir)\s*\(/;
-var DEV_GUARD = /NODE_ENV|import\.meta\.env\.DEV|__DEV__|\bisDev(?:elopment)?\b/;
+var DEV_GUARD2 = /NODE_ENV|import\.meta\.env\.DEV|__DEV__|\bisDev(?:elopment)?\b/;
 var SERVER_DEPS = [
   "express",
   "fastify",
@@ -30453,7 +30966,7 @@ function isBrowserFile2(file2, text, ctx) {
 }
 function debugLogLines(text) {
   const lines = text.replace(/\r\n/g, "\n").split("\n");
-  const found = findLogCalls(text, DEBUG_CALL).map((c) => c.line).filter((line) => !DEV_GUARD.test(`${lines[line - 2] ?? ""}
+  const found = findLogCalls(text, DEBUG_CALL).map((c) => c.line).filter((line) => !DEV_GUARD2.test(`${lines[line - 2] ?? ""}
 ${lines[line - 1] ?? ""}`));
   return [...new Set(found)];
 }
@@ -30489,7 +31002,7 @@ var debugLogs = {
 
 // src/checks/repo-hygiene.ts
 import { statSync as statSync4 } from "fs";
-import path32 from "path";
+import path35 from "path";
 var MB = 1024 * 1024;
 var LARGE_FILE_BYTES = 5 * MB;
 var HEAVY_FILE_BYTES = 1 * MB;
@@ -30527,7 +31040,7 @@ function lfsPatterns(gitattributes) {
     return pattern.includes("/") ? globToRegex(pattern) : globToRegex(`**/${pattern}`);
   });
 }
-function largeFiles(root, tracked, lfs = [], stat = statSync4, p2 = path32) {
+function largeFiles(root, tracked, lfs = [], stat = statSync4, p2 = path35) {
   const out = [];
   for (const file2 of tracked) {
     if (AURA_FILES.test(file2) || lfs.some((re) => re.test(file2))) continue;
@@ -30580,10 +31093,10 @@ var repoHygiene = {
 };
 
 // src/checks/naming.ts
-import path34 from "path";
+import path37 from "path";
 
 // src/checks/name-styles.ts
-import path33 from "path";
+import path36 from "path";
 var STYLES = ["kebab", "pascal", "camel", "snake"];
 var SHORT_LABEL = {
   kebab: "kebab-case",
@@ -30671,7 +31184,7 @@ function isAppCode(f) {
   return !f.split("/").some((seg) => seg.startsWith(".")) && !isTestFile(f) && !GENERATED.test(f) && !NOT_APP_CODE2.test(f);
 }
 function baseName(file2) {
-  let name = path33.posix.basename(file2).replace(NAMED_EXT, "");
+  let name = path36.posix.basename(file2).replace(NAMED_EXT, "");
   while (SUFFIX.test(name)) name = name.replace(SUFFIX, "");
   return name;
 }
@@ -30716,8 +31229,8 @@ function toStyle(name, style) {
   return words2.map((w, i) => i === 0 ? w : cap(w)).join("");
 }
 function renamed(file2, style) {
-  const dir = path33.posix.dirname(file2);
-  const base2 = path33.posix.basename(file2);
+  const dir = path36.posix.dirname(file2);
+  const base2 = path36.posix.basename(file2);
   const name = baseName(file2);
   const next = toStyle(name, style) + base2.slice(name.length);
   return dir === "." ? next : `${dir}/${next}`;
@@ -30786,10 +31299,10 @@ function folderProblem(folder, entries) {
   if (off.length === 0) return null;
   return { folder, style: target, files: off.map((e) => ({ ...e, suggested: renamed(e.file, target) })) };
 }
-function componentFolderProblem(byFolder, read2) {
+function componentFolderProblem(byFolder, read3) {
   const styled2 = [];
   for (const [folder, entries] of byFolder) {
-    const comps = entries.filter((e) => JSX_EXT.test(e.file) && exportsComponent(read2(e.file) ?? ""));
+    const comps = entries.filter((e) => JSX_EXT.test(e.file) && exportsComponent(read3(e.file) ?? ""));
     if (comps.length < 2) continue;
     const pascal2 = comps.filter((e) => e.style === "pascal").length;
     const lower = comps.filter((e) => e.style === "kebab" || e.style === "single").length;
@@ -30808,7 +31321,7 @@ function componentFolderProblem(byFolder, read2) {
     minority: minor.map((s) => ({ folder: s.folder, files: s.files }))
   };
 }
-function analyzeNaming(files, read2) {
+function analyzeNaming(files, read3) {
   const byFolder = /* @__PURE__ */ new Map();
   const classified = [];
   const codeNames = [];
@@ -30819,22 +31332,22 @@ function analyzeNaming(files, read2) {
     const style = fileStyle(file2);
     if (style) {
       classified.push(file2);
-      const folder = path34.posix.dirname(file2);
+      const folder = path37.posix.dirname(file2);
       byFolder.set(folder, [...byFolder.get(folder) ?? [], { file: file2, style }]);
     }
     if (!CODE_EXT.test(file2) || file2.endsWith(".d.ts") || !isAppCode(file2)) continue;
-    const text = read2(raw);
+    const text = read3(raw);
     if (!text) continue;
     const names = badCodeNames(file2, text);
     if (names.length) codeNames.push({ file: file2, names });
   }
   const folders = [...byFolder].map(([folder, entries]) => folderProblem(folder, entries)).filter((p2) => p2 !== null).sort((a, b) => a.folder < b.folder ? -1 : a.folder > b.folder ? 1 : 0);
-  return { classified, folders, componentFolders: componentFolderProblem(byFolder, (f) => read2(raws.get(f) ?? f)), codeNames };
+  return { classified, folders, componentFolders: componentFolderProblem(byFolder, (f) => read3(raws.get(f) ?? f)), codeNames };
 }
 var MAX_LISTED8 = 20;
 var MAX_FILE_FINDINGS = 20;
 var where = (folder) => folder === "." ? "the top level of the repo" : `${folder}/`;
-var list7 = (items) => `${items.slice(0, MAX_LISTED8).join(", ")}${items.length > MAX_LISTED8 ? ` and ${items.length - MAX_LISTED8} more` : ""}`;
+var list9 = (items) => `${items.slice(0, MAX_LISTED8).join(", ")}${items.length > MAX_LISTED8 ? ` and ${items.length - MAX_LISTED8} more` : ""}`;
 var naming = {
   id: "structure.naming",
   category: "structure",
@@ -30847,7 +31360,7 @@ var naming = {
     const items = [];
     for (const p2 of a.folders) {
       for (const f of p2.files) flagged.add(f.file);
-      const example = a.classified.find((f) => path34.posix.dirname(f) === p2.folder && fileStyle(f) === p2.style);
+      const example = a.classified.find((f) => path37.posix.dirname(f) === p2.folder && fileStyle(f) === p2.style);
       items.push({
         kind: "folder-style",
         facts: { files: p2.files.length, style: p2.style, example: Boolean(example) },
@@ -30855,8 +31368,8 @@ var naming = {
         locations: p2.files.slice(0, MAX_LISTED8).map((f) => ({ file: f.file })),
         vars: {
           where: where(p2.folder),
-          example: example ? path34.posix.basename(example) : "",
-          files: list7(p2.files.map((f) => `${f.file} (${SHORT_LABEL[f.style]}, would be ${path34.posix.basename(f.suggested)})`))
+          example: example ? path37.posix.basename(example) : "",
+          files: list9(p2.files.map((f) => `${f.file} (${SHORT_LABEL[f.style]}, would be ${path37.posix.basename(f.suggested)})`))
         },
         meta: { folder: p2.folder, style: p2.style, files: p2.files.map((f) => f.file), renames: p2.files.map((f) => `${f.file}=>${f.suggested}`) }
       });
@@ -30871,9 +31384,9 @@ var naming = {
         key: "component-folders",
         locations: minorityFiles.slice(0, MAX_LISTED8).map((file2) => ({ file: file2 })),
         vars: {
-          majority: list7(cf.majority.map(where)),
-          minority: list7(cf.minority.map((m) => where(m.folder))),
-          example: path34.posix.basename(minorityFiles[0] ?? "")
+          majority: list9(cf.majority.map(where)),
+          minority: list9(cf.minority.map((m) => where(m.folder))),
+          example: path37.posix.basename(minorityFiles[0] ?? "")
         },
         meta: { style: cf.style, folders: cf.minority.map((m) => m.folder), files: minorityFiles }
       });
@@ -30899,7 +31412,7 @@ var naming = {
         facts: { files: rest.length },
         key: "code-names:more",
         locations: rest.slice(0, MAX_LISTED8).map((g) => ({ file: g.file })),
-        vars: { files: list7(rest.map((g) => `${g.file} (${g.names.map((n) => n.name).join(", ")})`)) },
+        vars: { files: list9(rest.map((g) => `${g.file} (${g.names.map((n) => n.name).join(", ")})`)) },
         meta: { files: rest.map((g) => g.file) }
       });
     }
@@ -30909,70 +31422,18 @@ var naming = {
 };
 
 // src/checks/reuse.ts
-import path36 from "path";
-
-// src/checks/hardcoded-urls.ts
-var STRING_OR_COMMENT = /("(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'|`(?:[^`\\]|\\.)*`)|\/\/[^\n]*|\/\*[\s\S]*?\*\//g;
-function stripComments2(text) {
-  return text.replace(/\r\n/g, "\n").replace(STRING_OR_COMMENT, (m, str) => str ?? m.replace(/[^\n]/g, " "));
-}
-var URL_RE = /\bhttps?:\/\/([a-z0-9-]+(?:\.[a-z0-9-]+)*)(?::\d+)?[^\s'"`)<>]*/gi;
-var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0"]);
-var IGNORED_HOSTS = [
-  "schema.org",
-  "json-schema.org",
-  "w3.org",
-  "github.com",
-  "githubusercontent.com",
-  "npmjs.org",
-  "npmjs.com",
-  "fonts.googleapis.com",
-  "fonts.gstatic.com",
-  "example.com",
-  "example.org",
-  "example.net"
-];
-var RESERVED_TLD = /\.(?:example|test|invalid|local|localhost)$/;
-function isIgnoredHost(host) {
-  return RESERVED_TLD.test(host) || IGNORED_HOSTS.some((h) => host === h || host.endsWith(`.${h}`));
-}
-function inCdnTag(text, index) {
-  const open2 = text.lastIndexOf("<", index);
-  return open2 >= 0 && /^<(?:script|Script|link)\b[^>]*$/.test(text.slice(open2, index));
-}
-function findUrls(text) {
-  const code = stripComments2(text);
-  const hits = [];
-  for (const m of code.matchAll(URL_RE)) {
-    const host = (m[1] ?? "").toLowerCase().replace(/^www\./, "");
-    if (!host || inCdnTag(code, m.index)) continue;
-    hits.push({ host, url: m[0], index: m.index });
-  }
-  return hits;
-}
-var DEV_GUARD2 = /NODE_ENV\s*[!=]==?\s*['"`](?:development|production|test)['"`]|['"`](?:development|production|test)['"`]\s*[!=]==?\s*process\.env\.NODE_ENV|import\.meta\.env\.(?:DEV|PROD)\b|__DEV__|\bisDev(?:elopment)?\b|\bisProd(?:uction)?\b/;
-var ENV_FALLBACK = /(?:process\.env|import\.meta\.env)(?:\.\w+|\[['"]\w+['"]\])\s*(?:\?\?|\|\|)\s*$/;
-function isDevOnlyUse(code, index) {
-  const lineStart = code.lastIndexOf("\n", index - 1) + 1;
-  const before = code.slice(lineStart, index).replace(/['"`]$/, "");
-  if (ENV_FALLBACK.test(before.trimEnd())) return true;
-  let start = lineStart;
-  for (let i = 0; i < 6 && start > 0; i++) start = code.lastIndexOf("\n", start - 2) + 1;
-  const lineEnd = code.indexOf("\n", index);
-  return DEV_GUARD2.test(code.slice(start, lineEnd === -1 ? void 0 : lineEnd));
-}
-var RUNS_LOCAL_SERVER = /\bcreateServer\s*\(|\.listen\s*\(/;
+import path39 from "path";
 
 // src/checks/import-cycles.ts
-function buildReuseGraph(files, read2) {
-  const aliases = readAliases(read2);
+function buildReuseGraph(files, read3) {
+  const aliases = readAliases(read3);
   const fileSet = new Set(files);
   const app2 = new Set(appSource(files));
   const edges = /* @__PURE__ */ new Map();
   const importers = /* @__PURE__ */ new Map();
   for (const f of files) {
     if (!isSourceFile(f) || SKIP.test(f)) continue;
-    const text = read2(f);
+    const text = read3(f);
     if (text === null) continue;
     for (const ref of parseImports(text)) {
       const target = resolveImport(f, ref.specifier, fileSet, aliases);
@@ -31078,8 +31539,8 @@ function fetchTarget(arg) {
 }
 var isUiFile2 = (f) => (/\.(?:tsx|jsx)$/.test(f) || /(?:^|\/)(?:components|pages|views|screens)\//.test(f)) && !/(?:^|\/)route\.[cm]?[jt]sx?$/.test(f) && !/(?:^|\/)pages\/api\//.test(f);
 var CLIENT_MODULE = /(?:^|\/)(?:lib|utils|shared|common|src)\/(?:api|client|http|fetcher|fetch|request|requests|axios)(?:[-._][\w.-]*)?\.[cm]?[jt]sx?$|(?:^|\/)(?:lib\/api|lib\/clients?|services|api-client|clients)\/[^/]+\.[cm]?[jt]sx?$|(?:^|\/)hooks\/use(?:Api|Fetch|Fetcher|Request)\w*\.[cm]?[jt]sx?$/i;
-function hasSharedClient(files, read2) {
-  return files.some((f) => CLIENT_MODULE.test(f) || /\baxios\.create\s*\(/.test(read2(f) ?? ""));
+function hasSharedClient(files, read3) {
+  return files.some((f) => CLIENT_MODULE.test(f) || /\baxios\.create\s*\(/.test(read3(f) ?? ""));
 }
 function scatteredFetches(texts) {
   const byTarget = /* @__PURE__ */ new Map();
@@ -31096,7 +31557,7 @@ function scatteredFetches(texts) {
 }
 
 // src/checks/spare-copies.ts
-import path35 from "path";
+import path38 from "path";
 var COPY_PATTERNS = [
   /^(.+?)[ ._-]copy(?:[ _-]?\d+)?$/i,
   // Button copy, Button-copy, Button.copy, Button copy 2
@@ -31129,9 +31590,9 @@ function findSpareCopies(files) {
       continue;
     }
     if (!isSourceFile(f)) continue;
-    const ext = path35.posix.extname(f);
-    const dir = path35.posix.dirname(f);
-    const stem = path35.posix.basename(f, ext);
+    const ext = path38.posix.extname(f);
+    const dir = path38.posix.dirname(f);
+    const stem = path38.posix.basename(f, ext);
     for (const re of COPY_PATTERNS) {
       const base2 = stem.match(re)?.[1];
       if (!base2) continue;
@@ -31151,7 +31612,7 @@ var DEV_ONLY = /(?:^|\/)(?:scripts?|cypress|mocks|__mocks__|\.storybook|playwrig
 var CONFIG = /(?:^|\/)(?:[^/]+\.config\.[cm]?[jt]s|config\.[cm]?[jt]s|env\.[cm]?[jt]s)$|(?:^|\/)config\//;
 var MAX_LOCATIONS = 20;
 var MAX_PER_KIND = 20;
-var list8 = (files, max = 10) => `${files.slice(0, max).join(", ")}${files.length > max ? ` and ${files.length - max} more` : ""}`;
+var list10 = (files, max = 10) => `${files.slice(0, max).join(", ")}${files.length > max ? ` and ${files.length - max} more` : ""}`;
 var locations2 = (files) => files.slice(0, MAX_LOCATIONS).map((file2) => ({ file: file2 }));
 var reuse = {
   id: "structure.reuse",
@@ -31175,7 +31636,7 @@ var reuse = {
         facts: { files: component.length, loop: loop.length },
         key: component.join("|"),
         locations: locations2(loop),
-        vars: { loop: [...loop, loop[0]].join(" \u2192 "), files: list8(component) },
+        vars: { loop: [...loop, loop[0]].join(" \u2192 "), files: list10(component) },
         meta: { kind: "cycle", files: component, cycle: loop }
       });
     }
@@ -31192,11 +31653,11 @@ var reuse = {
         locations: locations2(original ? [copy, original] : [copy]),
         vars: {
           copy,
-          copyName: path36.posix.basename(copy),
-          copyImporters: list8(importersOf(copy), 5),
+          copyName: path39.posix.basename(copy),
+          copyImporters: list10(importersOf(copy), 5),
           original: original ?? "",
-          originalName: original ? path36.posix.basename(original) : "",
-          originalImporters: original ? list8(importersOf(original), 5) : ""
+          originalName: original ? path39.posix.basename(original) : "",
+          originalImporters: original ? list10(importersOf(original), 5) : ""
         },
         meta: {
           kind: "spare-copy",
@@ -31211,11 +31672,11 @@ var reuse = {
     const localhost = [];
     for (const [file2, text] of texts) {
       if (CONFIG.test(file2) || DEV_ONLY.test(file2)) continue;
-      const code = stripComments2(text);
+      const code2 = stripComments2(text);
       let local = null;
       for (const hit of findUrls(text)) {
         if (LOCAL_HOSTS.has(hit.host)) {
-          if (!local && !RUNS_LOCAL_SERVER.test(code) && !isDevOnlyUse(code, hit.index)) local = hit.url;
+          if (!local && !RUNS_LOCAL_SERVER.test(code2) && !isDevOnlyUse(code2, hit.index)) local = hit.url;
           continue;
         }
         if (isIgnoredHost(hit.host)) continue;
@@ -31231,7 +31692,7 @@ var reuse = {
         facts: { files: files.length },
         key: `host:${host}`,
         locations: locations2(files),
-        vars: { host, files: list8(files) },
+        vars: { host, files: list10(files) },
         meta: { kind: "hardcoded-host", host, files }
       });
     }
@@ -31247,7 +31708,7 @@ var reuse = {
         key: "scattered-fetch",
         locations: locations2(files),
         vars: {
-          targets: scattered.slice(0, 5).map((s) => `${s.target} (${list8(s.files, 5)})`).join("; ")
+          targets: scattered.slice(0, 5).map((s) => `${s.target} (${list10(s.files, 5)})`).join("; ")
         },
         meta: { kind: "scattered-fetch", targets: scattered.map((s) => s.target), files }
       });
@@ -31257,7 +31718,7 @@ var reuse = {
 };
 
 // src/checks/theme.ts
-import path37 from "path";
+import path40 from "path";
 
 // src/checks/colour.ts
 var clamp01 = (n) => Math.min(1, Math.max(0, n));
@@ -31639,7 +32100,7 @@ function contrastProblems(tokens, theme2) {
 // src/checks/theme.ts
 var MAX_LISTED9 = 20;
 function topFolder2(file2) {
-  const dir = path37.posix.dirname(file2);
+  const dir = path40.posix.dirname(file2);
   return dir === "." ? "(top level)" : dir;
 }
 var theme = {
@@ -32048,13 +32509,13 @@ var deadFiles = {
     const facts = { sourceFiles: appSource2(ctx).length };
     const engine = "builtin import graph";
     if (dead.length === 0) return { facts, items: [], engine };
-    const list9 = `${dead.slice(0, 15).join(", ")}${dead.length > 15 ? ` and ${dead.length - 15} more` : ""}`;
+    const list11 = `${dead.slice(0, 15).join(", ")}${dead.length > 15 ? ` and ${dead.length - 15} more` : ""}`;
     const item = {
       kind: "unused-files",
       facts: { files: dead.length },
       key: "dead",
       locations: dead.map((file2) => ({ file: file2 })),
-      vars: { list: list9 },
+      vars: { list: list11 },
       meta: { files: dead }
     };
     return { facts, items: [item], engine };
@@ -32115,7 +32576,7 @@ var duplicates = {
       facts: { similarity: Math.round(sim * 100) },
       key: [a, b].sort().join("|"),
       locations: [{ file: a }, { file: b }],
-      vars: { nameA: path38.basename(a), nameB: path38.basename(b), fileA: a, fileB: b },
+      vars: { nameA: path41.basename(a), nameB: path41.basename(b), fileA: a, fileB: b },
       meta: { similarity: Math.round(sim * 100) }
     }));
     return { facts: {}, items };
@@ -32123,7 +32584,7 @@ var duplicates = {
 };
 var ROOT_ALLOWED = /^(?:[^/]+\.config\.[cm]?[jt]s|middleware\.[cm]?[jt]s|proxy\.[cm]?[jt]s|instrumentation(?:-client)?\.[cm]?[jt]s|next-env\.d\.ts|global\.d\.ts|env\.d\.ts|sentry\.[\w.]+\.[cm]?[jt]s)$/;
 function suggestTarget(file2, srcDir) {
-  const base2 = path38.posix.basename(file2);
+  const base2 = path41.posix.basename(file2);
   const prefix = srcDir ? "src/" : "";
   const isComponent = /^[A-Z][A-Za-z0-9]*\.(?:tsx|jsx)$/.test(base2);
   if (isComponent) return `${prefix}components/${base2}`;
@@ -32279,10 +32740,10 @@ async function observeCheck(check2, ctx, at) {
 }
 
 // src/api/fill.ts
-var PLACEHOLDER2 = /\{([a-zA-Z]+)\}/g;
+var PLACEHOLDER3 = /\{([a-zA-Z]+)\}/g;
 function fill2(template, vars) {
   let missing = false;
-  const text = template.replace(PLACEHOLDER2, (_, name) => {
+  const text = template.replace(PLACEHOLDER3, (_, name) => {
     const value = Object.hasOwn(vars, name) ? vars[name] : void 0;
     if (value !== void 0) return value;
     missing = true;
@@ -32410,7 +32871,7 @@ function unscored(scan) {
 }
 function loadCache2(root) {
   try {
-    return JSON.parse(readFileSync18(auraPath(root, CACHE), "utf8"));
+    return JSON.parse(readFileSync19(auraPath(root, CACHE), "utf8"));
   } catch {
     return {};
   }
@@ -32541,7 +33002,7 @@ async function buildContext(root, options, config2) {
   const allTracked = await listTrackedFiles(root);
   const tracked = allTracked ? new Set([...allTracked].filter((f) => !ignores.some((re) => re.test(f)))) : null;
   const cache3 = /* @__PURE__ */ new Map();
-  const read2 = (f) => {
+  const read3 = (f) => {
     const cached2 = cache3.get(f);
     if (cached2 !== void 0) return cached2;
     const text = readText(root, f);
@@ -32549,10 +33010,10 @@ async function buildContext(root, options, config2) {
     return text;
   };
   const pkg2 = readJson(root, "package.json");
-  const stack = detectStack(root, files, pkg2, read2);
-  const projects = detectProjects(root, files, read2, cfg.projects);
+  const stack = detectStack(root, files, pkg2, read3);
+  const projects = detectProjects(root, files, read3, cfg.projects);
   const project = combineProfiles(projects.map((p2) => p2.profile));
-  return { root, files, tracked, read: read2, pkg: pkg2, stack, projects, profile: repoProfile(projects), project, config: cfg, options };
+  return { root, files, tracked, read: read3, pkg: pkg2, stack, projects, profile: repoProfile(projects), project, config: cfg, options };
 }
 function applyIgnores(result, config2) {
   if (config2.ignore.includes(result.checkId)) {
@@ -32614,9 +33075,9 @@ async function runScan(root, options, onProgress) {
 }
 async function latestScan(root) {
   const file2 = auraPath(root, "scan.json");
-  if (existsSync21(file2)) {
+  if (existsSync23(file2)) {
     try {
-      const scan2 = JSON.parse(readFileSync19(file2, "utf8"));
+      const scan2 = JSON.parse(readFileSync20(file2, "utf8"));
       const head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
       const dirty = execFileSync("git", ["status", "--porcelain"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
       if (scan2.commit === head && !dirty && Date.now() - Date.parse(scan2.scannedAt) < 24 * 36e5) return scan2;
@@ -32629,21 +33090,21 @@ async function latestScan(root) {
 }
 
 // src/commands/fix.ts
-import { existsSync as existsSync24, readFileSync as readFileSync22, writeFileSync as writeFileSync5 } from "fs";
-import path40 from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync23, writeFileSync as writeFileSync5 } from "fs";
+import path43 from "path";
 
 // src/agent/tools.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync4, readFileSync as readFileSync20, rmSync as rmSync4, statSync as statSync5, writeFileSync as writeFileSync4 } from "fs";
-import path39 from "path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync4, readFileSync as readFileSync21, rmSync as rmSync4, statSync as statSync5, writeFileSync as writeFileSync4 } from "fs";
+import path42 from "path";
 var MAX_OUTPUT = 12e3;
 var MAX_FILE_LINES = 800;
 var FORBIDDEN = /^(?:\.git|node_modules|\.next|\.vercel)(?:\/|$)|(?:^|\/)\.env(?:\.(?!example$|sample$|template$)[^/]+)?$/;
 function safePath(root, rel) {
   if (typeof rel !== "string" || !rel.trim()) throw new Error("A file path is required.");
-  const normalized = path39.posix.normalize(rel.replace(/\\/g, "/").replace(/^\.\//, ""));
-  if (normalized.startsWith("../") || normalized === ".." || path39.isAbsolute(normalized)) throw new Error(`Path is outside the repo: ${rel}`);
+  const normalized = path42.posix.normalize(rel.replace(/\\/g, "/").replace(/^\.\//, ""));
+  if (normalized.startsWith("../") || normalized === ".." || path42.isAbsolute(normalized)) throw new Error(`Path is outside the repo: ${rel}`);
   if (FORBIDDEN.test(normalized)) throw new Error(`Aura doesn\u2019t let the agent touch ${normalized}.`);
-  const full = path39.join(root, normalized);
+  const full = path42.join(root, normalized);
   if (!isInside(root, full)) throw new Error(`Path is outside the repo: ${rel}`);
   return normalized;
 }
@@ -32664,10 +33125,10 @@ async function runTool(root, call, allowedCommands2) {
     }
     case "read_file": {
       const rel = safePath(root, input2.path);
-      const full = path39.join(root, rel);
-      if (!existsSync22(full)) return { output: `File not found: ${rel}` };
+      const full = path42.join(root, rel);
+      if (!existsSync24(full)) return { output: `File not found: ${rel}` };
       if (statSync5(full).size > 1e6) return { output: `${rel} is too large to read.` };
-      const lines = readFileSync20(full, "utf8").split("\n");
+      const lines = readFileSync21(full, "utf8").split("\n");
       const start = Math.max(1, Number(input2.startLine) || 1);
       const end = Math.min(lines.length, Number(input2.endLine) || start + MAX_FILE_LINES - 1);
       const body = lines.slice(start - 1, end).map((l, i) => `${start + i}: ${l}`).join("\n");
@@ -32684,7 +33145,7 @@ async function runTool(root, call, allowedCommands2) {
         if (FORBIDDEN.test(f) || glob && !glob.test(f)) continue;
         let text;
         try {
-          text = readFileSync20(path39.join(root, f), "utf8");
+          text = readFileSync21(path42.join(root, f), "utf8");
         } catch {
           continue;
         }
@@ -32703,14 +33164,14 @@ async function runTool(root, call, allowedCommands2) {
           output: "Refused: the content contains a [REDACTED:\u2026] placeholder. Secrets are hidden from you on purpose. Read the value from an environment variable (process.env.NAME) instead of writing it."
         };
       }
-      mkdirSync4(path39.dirname(path39.join(root, rel)), { recursive: true });
-      writeFileSync4(path39.join(root, rel), content2);
+      mkdirSync4(path42.dirname(path42.join(root, rel)), { recursive: true });
+      writeFileSync4(path42.join(root, rel), content2);
       return { output: `Wrote ${rel} (${content2.split("\n").length} lines).`, touched: rel };
     }
     case "delete_file": {
       const rel = safePath(root, input2.path);
-      if (!existsSync22(path39.join(root, rel))) return { output: `File not found: ${rel}` };
-      rmSync4(path39.join(root, rel));
+      if (!existsSync24(path42.join(root, rel))) return { output: `File not found: ${rel}` };
+      rmSync4(path42.join(root, rel));
       return { output: `Deleted ${rel}.`, touched: rel };
     }
     case "run_command": {
@@ -32726,15 +33187,15 @@ ${r.stderr}`.trim().slice(-6e3)}`;
     }
     case "finish": {
       const summary = String(input2.summary ?? "");
-      const list9 = (v) => Array.isArray(v) ? v.map(String) : [];
-      return { output: "Finished.", finish: { summary, testsRun: list9(input2.testsRun), risks: list9(input2.risks) } };
+      const list11 = (v) => Array.isArray(v) ? v.map(String) : [];
+      return { output: "Finished.", finish: { summary, testsRun: list11(input2.testsRun), risks: list11(input2.risks) } };
     }
   }
 }
 
 // src/api/explain.ts
 import { createHash as createHash5 } from "crypto";
-import { existsSync as existsSync23, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync22 } from "fs";
 
 // src/report.ts
 import pc3 from "picocolors";
@@ -33019,7 +33480,7 @@ var CACHE_FILE2 = "cache/explanations.json";
 var MAX_EXPLAIN = 25;
 function loadCache3(root) {
   try {
-    return JSON.parse(readFileSync21(auraPath(root, CACHE_FILE2), "utf8"));
+    return JSON.parse(readFileSync22(auraPath(root, CACHE_FILE2), "utf8"));
   } catch {
     return {};
   }
@@ -33040,8 +33501,8 @@ function excerptFor(root, f, context = 4) {
 }
 function productContext(root) {
   const file2 = auraPath(root, "brief.md");
-  if (!existsSync23(file2)) return void 0;
-  return redact(readFileSync21(file2, "utf8")).slice(0, 1800);
+  if (!existsSync25(file2)) return void 0;
+  return redact(readFileSync22(file2, "utf8")).slice(0, 1800);
 }
 async function addExplanations(root, scan, client) {
   const cache3 = loadCache3(root);
@@ -33098,7 +33559,7 @@ function allowedCommands(root, pm, typescript) {
   const pkg2 = readJson(root, "package.json");
   const run2 = pmCommands(pm).run;
   const cmds = ["test", "lint", "typecheck", "build"].filter((s) => pkg2?.scripts?.[s]).map((s) => `${run2} ${s}`);
-  if (typescript && !pkg2?.scripts?.typecheck && existsSync24(path40.join(root, "node_modules/.bin/tsc"))) cmds.push(`${pmCommands(pm).exec} tsc --noEmit`);
+  if (typescript && !pkg2?.scripts?.typecheck && existsSync26(path43.join(root, "node_modules/.bin/tsc"))) cmds.push(`${pmCommands(pm).exec} tsc --noEmit`);
   return cmds;
 }
 function taskFor(root, scan, action2, findings) {
@@ -33169,8 +33630,8 @@ async function untrackEnvFiles(root, findings) {
   const files = findings.filter((f) => f.checkId === "security.env-files").flatMap((f) => f.locations.slice(0, 1).map((l) => l.file));
   for (const f of files) await git(root, "rm", "-q", "--cached", "--", f);
   if (files.length) {
-    const gi = path40.join(root, ".gitignore");
-    const current2 = existsSync24(gi) ? readFileSync22(gi, "utf8") : "";
+    const gi = path43.join(root, ".gitignore");
+    const current2 = existsSync26(gi) ? readFileSync23(gi, "utf8") : "";
     if (!/^\.env\*?$/m.test(current2)) writeFileSync5(gi, `${current2.trimEnd()}
 
 # Environment files hold secrets
@@ -33185,10 +33646,10 @@ async function fixCommand(target, flags) {
   const started = Date.now();
   const report = { delivery: flags.agent ? "agent-task" : "agent-fix" };
   const actionId = { value: target };
-  const code = await fixAction(target, flags, report, actionId);
+  const code2 = await fixAction(target, flags, report, actionId);
   const root = await findRepoRoot();
   await recordAction(root, loadConfig(root), actionId.value, report, started, flags.via ?? "command");
-  return code;
+  return code2;
 }
 async function fixAction(target, flags, report, resolvedId) {
   const root = await findRepoRoot();
@@ -33402,25 +33863,25 @@ The plan is in ${large.file}.`);
 }
 
 // src/commands/inventory.ts
-import { readFileSync as readFileSync23 } from "fs";
+import { readFileSync as readFileSync24 } from "fs";
 function accountState(root, services) {
   const inv = loadInventory(root);
-  const read2 = Object.fromEntries(
+  const read3 = Object.fromEntries(
     Object.entries(loadSnapshots(root)).map(([id, snap]) => [id, Object.values(snap.settings).every((state) => state !== "off")])
   );
   return {
     inventoryComplete: services.every((s) => inv.services[s]?.owner) && Boolean(inv.githubOrg),
     secured: Object.fromEntries(
-      [.../* @__PURE__ */ new Set([...Object.keys(read2), ...Object.keys(inv.secured ?? {}), "github"])].map((id) => [
+      [.../* @__PURE__ */ new Set([...Object.keys(read3), ...Object.keys(inv.secured ?? {}), "github"])].map((id) => [
         id,
-        Boolean(read2[id] || inv.secured?.[id] || id === "github" && inv.githubSecurity)
+        Boolean(read3[id] || inv.secured?.[id] || id === "github" && inv.githubSecurity)
       ])
     )
   };
 }
 function loadInventory(root) {
   try {
-    return JSON.parse(readFileSync23(auraPath(root, "inventory.json"), "utf8"));
+    return JSON.parse(readFileSync24(auraPath(root, "inventory.json"), "utf8"));
   } catch {
     return { version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), services: {} };
   }
@@ -33655,13 +34116,13 @@ ${pc.bold("  Left for you")}`);
 }
 
 // src/commands/guide.ts
-import { readdirSync as readdirSync6, readFileSync as readFileSync24 } from "fs";
-import path41 from "path";
+import { readdirSync as readdirSync6, readFileSync as readFileSync25 } from "fs";
+import path44 from "path";
 import YAML6 from "yaml";
 function loadGuides() {
-  const dir = path41.join(templatesDir(), "guides");
+  const dir = path44.join(templatesDir(), "guides");
   return readdirSync6(dir).filter((f) => f.endsWith(".md")).map((f) => {
-    const text = readFileSync24(path41.join(dir, f), "utf8");
+    const text = readFileSync25(path44.join(dir, f), "utf8");
     const fm = text.match(/^---\n([\s\S]*?)\n---\n?/);
     const yaml = fm?.[1];
     const meta3 = yaml !== void 0 ? YAML6.parse(yaml) : {};
@@ -33694,10 +34155,10 @@ var LOCKFILES2 = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock"
 async function applyCommand(actionId, flags) {
   const started = Date.now();
   const report = { delivery: "pr" };
-  const code = await applyAction(actionId, flags, report);
+  const code2 = await applyAction(actionId, flags, report);
   const root = await findRepoRoot();
   await recordAction(root, loadConfig(root), actionId, report, started, flags.via ?? "command");
-  return code;
+  return code2;
 }
 async function applyAction(actionId, flags, report) {
   const root = await findRepoRoot();
@@ -33714,7 +34175,9 @@ async function applyAction(actionId, flags, report) {
   if (delivery === "agent-fix") {
     if (fellBack)
       say.info(
-        pc.dim(`Aura only opens template PRs for stacks it recognizes (a Next.js app at the repo root). Handing "${actionId}" to Aura\u2019s agent instead.`)
+        pc.dim(
+          `Aura\u2019s template for "${actionId}" doesn\u2019t fit this project (templates cover a Next.js app, or a Vite + React app, at the repo root). Handing it to Aura\u2019s agent instead.`
+        )
       );
     return fixCommand(actionId, { yes: flags.yes, dryRun: flags.dryRun, pr: flags.pr, approved: flags.approved, via: flags.via });
   }
@@ -33764,7 +34227,7 @@ async function applyAction(actionId, flags, report) {
     console.log(`
 ${pc.bold(title2)}`);
     for (const c of changes.changes)
-      console.log(`  ${c.content === null ? pc.red("delete") : existsSync25(path42.join(root, c.path)) ? pc.yellow("update") : pc.green("add   ")} ${c.path}`);
+      console.log(`  ${c.content === null ? pc.red("delete") : existsSync27(path45.join(root, c.path)) ? pc.yellow("update") : pc.green("add   ")} ${c.path}`);
     if (changes.devDeps?.length) console.log(`  ${pc.cyan("install")} ${changes.devDeps.join(", ")} ${pc.dim(`(${pm.addDev})`)}`);
     for (const cmd of changes.commands ?? []) console.log(`  ${pc.cyan("run   ")} ${cmd.join(" ")}`);
   };
@@ -33820,8 +34283,8 @@ The plan is in ${large.file}.`);
     return 0;
   }
   const chunkPlan = plan;
-  const tsc = path42.join(root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
-  const checkTypes = plan.verifyTypes && scan.stack.typescript && existsSync25(tsc);
+  const tsc = path45.join(root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
+  const checkTypes = plan.verifyTypes && scan.stack.typescript && existsSync27(tsc);
   const typeErrors = async () => {
     const r = await run(tsc, ["--noEmit", "--pretty", "false"], { cwd: root, timeoutMs: 3e5 });
     return (r.stdout.match(/error TS\d+/g) ?? []).length;
@@ -33936,17 +34399,17 @@ async function undoPlan(root, plan) {
   for (const file2 of touched) {
     const inHead = (await git(root, "cat-file", "-e", `HEAD:${file2}`)).code === 0;
     if (inHead) await git(root, "checkout", "HEAD", "--", file2);
-    else if (plan.changes.some((c) => c.path === file2)) rmSync5(path42.join(root, file2), { force: true });
+    else if (plan.changes.some((c) => c.path === file2)) rmSync5(path45.join(root, file2), { force: true });
   }
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync27, readFileSync as readFileSync28 } from "fs";
+import { existsSync as existsSync29, readFileSync as readFileSync29 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
-import path47 from "path";
+import path50 from "path";
 
 // src/brief.ts
-import path43 from "path";
+import path46 from "path";
 function repoSummary(ctx) {
   const routes2 = ctx.files.filter((f) => /^(?:src\/)?app\/(?:.+\/)?(?:page|route)\.[cm]?[jt]sx?$/.test(f) || /^(?:src\/)?pages\/.+\.[cm]?[jt]sx?$/.test(f)).map(
     (f) => "/" + f.replace(/^(?:src\/)?(?:app|pages)\//, "").replace(/(?:^|\/)(?:page|route|index)\.[cm]?[jt]sx?$|\.[cm]?[jt]sx?$/, "").replace(/\([^)]+\)\//g, "")
@@ -33963,7 +34426,7 @@ function repoSummary(ctx) {
   const readme2 = ctx.files.find((f) => /^readme\.mdx?$/i.test(f));
   const readmeText = readme2 ? ctx.read(readme2) ?? "" : "";
   return {
-    name: ctx.pkg?.name ?? path43.basename(ctx.root),
+    name: ctx.pkg?.name ?? path46.basename(ctx.root),
     packageJson: ctx.pkg ? {
       name: ctx.pkg.name,
       description: ctx.pkg.description,
@@ -34062,10 +34525,10 @@ function banner(colors = pc4.isColorSupported) {
 // src/api/connect.ts
 import { spawn as spawn2 } from "child_process";
 import { constants, generateKeyPairSync, privateDecrypt } from "crypto";
-import { existsSync as existsSync26, mkdirSync as mkdirSync5, readFileSync as readFileSync25, rmSync as rmSync6, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync28, mkdirSync as mkdirSync5, readFileSync as readFileSync26, rmSync as rmSync6, writeFileSync as writeFileSync6 } from "fs";
 import os5 from "os";
-import path44 from "path";
-var pendingFile = () => path44.join(os5.homedir(), ".aura", "pending-connect.json");
+import path47 from "path";
+var pendingFile = () => path47.join(os5.homedir(), ".aura", "pending-connect.json");
 async function postJson(apiUrl, route, body) {
   let res;
   try {
@@ -34084,14 +34547,14 @@ async function postJson(apiUrl, route, body) {
 }
 function loadPending(apiUrl, now) {
   try {
-    const p2 = JSON.parse(readFileSync25(pendingFile(), "utf8"));
+    const p2 = JSON.parse(readFileSync26(pendingFile(), "utf8"));
     if (p2.apiUrl === apiUrl && Date.parse(p2.expiresAt) - now > 6e4) return p2;
   } catch {
   }
   return null;
 }
 function clearPendingConnect() {
-  if (existsSync26(pendingFile())) rmSync6(pendingFile(), { force: true });
+  if (existsSync28(pendingFile())) rmSync6(pendingFile(), { force: true });
 }
 async function startOrResumeConnect(apiUrl, now = Date.now()) {
   const existing = loadPending(apiUrl, now);
@@ -34103,7 +34566,7 @@ async function startOrResumeConnect(apiUrl, now = Date.now()) {
   });
   const res = ConnectStartResponse.parse(await postJson(apiUrl, "connect", { publicKey }));
   const pending2 = { apiUrl, privateKey, ...res };
-  mkdirSync5(path44.dirname(pendingFile()), { recursive: true });
+  mkdirSync5(path47.dirname(pendingFile()), { recursive: true });
   writeFileSync6(pendingFile(), `${JSON.stringify(pending2, null, 2)}
 `, { mode: 384 });
   return { ...pending2, resumed: false };
@@ -34256,9 +34719,9 @@ function installFallback(result, platform = process.platform) {
 // src/core/claude-plugin.ts
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
 import os6 from "os";
-import path45 from "path";
+import path48 from "path";
 var CLAUDE_PLUGIN_ID = "aura@aura";
-var marketplaceDir = () => path45.join(os6.homedir(), ".aura", "claude-marketplace");
+var marketplaceDir = () => path48.join(os6.homedir(), ".aura", "claude-marketplace");
 var MARKETPLACE = {
   name: "aura",
   description: "Aura for Claude Code",
@@ -34273,8 +34736,8 @@ var MARKETPLACE = {
 };
 function writeMarketplace() {
   const dir = marketplaceDir();
-  mkdirSync6(path45.join(dir, ".claude-plugin"), { recursive: true });
-  writeFileSync7(path45.join(dir, ".claude-plugin", "marketplace.json"), `${JSON.stringify(MARKETPLACE, null, 2)}
+  mkdirSync6(path48.join(dir, ".claude-plugin"), { recursive: true });
+  writeFileSync7(path48.join(dir, ".claude-plugin", "marketplace.json"), `${JSON.stringify(MARKETPLACE, null, 2)}
 `);
   return dir;
 }
@@ -34330,7 +34793,7 @@ var AUTH_PACKAGES = [
   [/^@kinde-oss\//, "Kinde"],
   [/^@auth0\//, "Auth0"]
 ];
-var words = (list9) => new RegExp(`(?<![a-z])(?:${list9})(?![a-z])`, "i");
+var words = (list11) => new RegExp(`(?<![a-z])(?:${list11})(?![a-z])`, "i");
 var SENSITIVE = [
   ["health", words("patients?|diagnos[a-z]*|medical|medications?|prescriptions?|symptoms?|health_records?"), "health"],
   ["legal", words("case_number|lawsuits?|attorneys?|legal_matters?|court[a-z]*"), "legal"],
@@ -34340,7 +34803,7 @@ function schemaText(ctx) {
   const files = ctx.files.filter((f) => /\.sql$|schema\.prisma$|(?:^|\/)schema\.[cm]?[jt]s$|(?:^|\/)db\/schema\//.test(f) && !/node_modules\//.test(f));
   return files.slice(0, 200).map((f) => ctx.read(f) ?? "").join("\n");
 }
-var matchPackage = (deps2, list9) => list9.find(([re]) => deps2.some((d) => re.test(d)))?.[1];
+var matchPackage = (deps2, list11) => list11.find(([re]) => deps2.some((d) => re.test(d)))?.[1];
 function inferAnswers(ctx) {
   const deps2 = Object.keys(allDeps(ctx.pkg));
   const payment = matchPackage(deps2, PAYMENT_PACKAGES);
@@ -34391,13 +34854,13 @@ function describeInferred(inferred) {
 // src/commands/scan.ts
 import { mkdtempSync as mkdtempSync3, rmSync as rmSync7, writeFileSync as writeFileSync8 } from "fs";
 import os7 from "os";
-import path46 from "path";
+import path49 from "path";
 
 // src/history.ts
-import { readFileSync as readFileSync26 } from "fs";
+import { readFileSync as readFileSync27 } from "fs";
 function loadHistory(root) {
   try {
-    const data = JSON.parse(readFileSync26(auraPath(root, "history.json"), "utf8"));
+    const data = JSON.parse(readFileSync27(auraPath(root, "history.json"), "utf8"));
     return Array.isArray(data) ? data : [];
   } catch {
     return [];
@@ -34459,7 +34922,7 @@ async function pickAndRunSteps(steps, limit = 10) {
     console.log(`
 ${pc.magenta("\u2726")} ${pc.bold(step.title)}`);
     const run2 = stepRun(step, hasKey);
-    const code = run2.kind === "apply" ? (
+    const code2 = run2.kind === "apply" ? (
       // Settings changes always ask first, even when picked here; pull requests don't need to.
       await applyCommand(run2.actionId, { yes: !connectorForAction(run2.actionId), via: "checklist" })
     ) : run2.kind === "fix" ? await fixCommand(run2.actionId, run2.withOwnAgent ? { agent: true, via: "checklist" } : { yes: true, via: "checklist" }) : run2.kind === "guide" ? await guideCommand(run2.topic, {}) : await inventoryCommand({});
@@ -34473,7 +34936,7 @@ ${pc.magenta("\u2726")} ${pc.bold(step.title)}`);
         outcome: "shown"
       });
     }
-    results.push({ title: step.title, ok: code === 0 });
+    results.push({ title: step.title, ok: code2 === 0 });
   }
   if (results.length > 1) {
     console.log(`
@@ -34484,12 +34947,12 @@ ${pc.bold("  Done")}`);
 }
 
 // src/connectors/refresh.ts
-import { readFileSync as readFileSync27 } from "fs";
+import { readFileSync as readFileSync28 } from "fs";
 async function refreshToolSettings(root) {
   if (process.env.AURA_NO_CONNECTORS) return;
   let previous = null;
   try {
-    previous = JSON.parse(readFileSync27(auraPath(root, "scan.json"), "utf8"));
+    previous = JSON.parse(readFileSync28(auraPath(root, "scan.json"), "utf8"));
   } catch {
   }
   const snapshots = loadSnapshots(root);
@@ -34513,8 +34976,8 @@ function reportScoring(outcome, quiet, ci) {
   if (!quiet) say.warn(text);
 }
 async function scanRef(root, ref, opts) {
-  const dir = mkdtempSync3(path46.join(os7.tmpdir(), "aura-base-"));
-  const wt = path46.join(dir, "tree");
+  const dir = mkdtempSync3(path49.join(os7.tmpdir(), "aura-base-"));
+  const wt = path49.join(dir, "tree");
   const add = await run("git", ["worktree", "add", "--detach", wt, ref], { cwd: root });
   if (add.code !== 0) {
     rmSync7(dir, { recursive: true, force: true });
@@ -34617,7 +35080,7 @@ async function scanCommand(flags) {
 // src/commands/init.ts
 var AGENT_IDS2 = ["claude", "codex", "cursor", "pi"];
 function detectAgents(root) {
-  return detectAgentsFrom((rel) => existsSync27(path47.join(root, rel)));
+  return detectAgentsFrom((rel) => existsSync29(path50.join(root, rel)));
 }
 function openEditor(file2) {
   const fallback = process.platform === "win32" ? "notepad" : spawnSync3("sh", ["-c", "command -v nano"]).status === 0 ? "nano" : "vi";
@@ -34733,13 +35196,13 @@ async function initCommand(flags) {
   let brief2 = null;
   let keptBrief = false;
   if (flags.briefFile) {
-    brief2 = readFileSync28(flags.briefFile, "utf8");
-  } else if (!flags.answers && existsSync27(briefPath) && !(tty && unwrap(await p.confirm({ message: "A product brief already exists. Draft a new one?", initialValue: false })))) {
+    brief2 = readFileSync29(flags.briefFile, "utf8");
+  } else if (!flags.answers && existsSync29(briefPath) && !(tty && unwrap(await p.confirm({ message: "A product brief already exists. Draft a new one?", initialValue: false })))) {
     keptBrief = true;
   } else {
     let answers = null;
     if (flags.answers) {
-      answers = OnboardingAnswersSchema.parse(JSON.parse(readFileSync28(flags.answers, "utf8")));
+      answers = OnboardingAnswersSchema.parse(JSON.parse(readFileSync29(flags.answers, "utf8")));
     } else if (tty) {
       const inferred = inferAnswers(ctx);
       p.note(describeInferred(inferred).join("\n"), "Here\u2019s what Aura found about your app");
@@ -34891,7 +35354,7 @@ ${pc.magenta("\u2726")} ${pc.bold("Give the user the aura command")}`);
 }
 
 // src/commands/summary.ts
-import path48 from "path";
+import path51 from "path";
 async function activity(root, since) {
   const log = await git(root, "log", `--since=${since.toISOString()}`, "--no-merges", "--format=%H%x09%an%x09%s");
   const commits = log.stdout.split("\n").filter(Boolean).slice(0, 300).map((l) => {
@@ -34953,7 +35416,7 @@ async function summaryCommand(flags) {
   const beforeIds = new Set(before ? allFindings(before).map((f) => f.id) : []);
   const nowIds = new Set(allFindings(now).map((f) => f.id));
   const req = {
-    repo: path48.basename(root),
+    repo: path51.basename(root),
     since: since.toISOString(),
     until: until.toISOString(),
     product: productContext(root),
@@ -34998,15 +35461,15 @@ ${body}`);
 }
 
 // src/commands/update.ts
-import { existsSync as existsSync28, readFileSync as readFileSync30 } from "fs";
-import path50 from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync31 } from "fs";
+import path53 from "path";
 
 // src/core/update-check.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync29, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync30, writeFileSync as writeFileSync9 } from "fs";
 import os8 from "os";
-import path49 from "path";
+import path52 from "path";
 var DAY_MS = 24 * 60 * 60 * 1e3;
-var cacheFile = () => path49.join(os8.homedir(), ".aura", "update-check.json");
+var cacheFile = () => path52.join(os8.homedir(), ".aura", "update-check.json");
 function isNewer(a, b) {
   if (!/^\d+\.\d+\.\d+$/.test(a) || !/^\d+\.\d+\.\d+$/.test(b)) return false;
   const x = a.split(".").map(Number);
@@ -35031,13 +35494,13 @@ async function newerVersion(opts = {}) {
   const now = opts.now ?? Date.now();
   let latest = null;
   try {
-    const cached2 = JSON.parse(readFileSync29(cacheFile(), "utf8"));
+    const cached2 = JSON.parse(readFileSync30(cacheFile(), "utf8"));
     if (now - cached2.checkedAt < DAY_MS) latest = cached2.latest;
     else throw new Error("stale");
   } catch {
     latest = await (opts.fetchLatest ?? fetchLatest)();
     try {
-      mkdirSync7(path49.dirname(cacheFile()), { recursive: true });
+      mkdirSync7(path52.dirname(cacheFile()), { recursive: true });
       writeFileSync9(cacheFile(), JSON.stringify({ checkedAt: now, latest }));
     } catch {
     }
@@ -35055,7 +35518,7 @@ function updateNotice(latest, argv1 = process.argv[1] ?? "") {
 }
 
 // src/commands/update.ts
-function howAuraRuns(argv1, root, paths = path50) {
+function howAuraRuns(argv1, root, paths = path53) {
   if (/[\\/]_npx[\\/]/.test(argv1)) return "npx";
   const rel = root && argv1 ? paths.relative(paths.join(root, "node_modules"), argv1) : "..";
   return rel.startsWith("..") || paths.isAbsolute(rel) ? "global" : "project";
@@ -35073,9 +35536,9 @@ function newAura(how, version2) {
   return ["aura"];
 }
 function workflowVersion(root) {
-  const file2 = path50.join(root, ".github", "workflows", "aura.yml");
-  if (!existsSync28(file2)) return null;
-  return readFileSync30(file2, "utf8").match(/getaura@(\d+\.\d+\.\d+)/)?.[1] ?? null;
+  const file2 = path53.join(root, ".github", "workflows", "aura.yml");
+  if (!existsSync30(file2)) return null;
+  return readFileSync31(file2, "utf8").match(/getaura@(\d+\.\d+\.\d+)/)?.[1] ?? null;
 }
 function mentionWorkflow(root, version2) {
   const pinned = root ? workflowVersion(root) : null;
@@ -35083,7 +35546,7 @@ function mentionWorkflow(root, version2) {
     say.info(`Your GitHub check still runs Aura ${pinned}. To move it to ${version2}, run: aura apply add-aura-workflow (it opens a pull request).`);
 }
 async function refreshRepoFiles(root) {
-  if (!existsSync28(auraPath(root, "config.json"))) {
+  if (!existsSync30(auraPath(root, "config.json"))) {
     say.dim("Aura isn\u2019t set up in this repo, so there\u2019s nothing here to refresh.");
     return 0;
   }
@@ -35150,8 +35613,8 @@ async function updateCommand(flags, deps2 = { fetchLatest, run, argv1: process.a
 }
 
 // src/commands/pr.ts
-import { existsSync as existsSync29, readFileSync as readFileSync31, statSync as statSync6 } from "fs";
-import path51 from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync32, statSync as statSync6 } from "fs";
+import path54 from "path";
 
 // src/actions/pr-plan.ts
 var PR_MAX_LINES = 400;
@@ -35348,7 +35811,7 @@ function parseStatus(out) {
   }
   return entries;
 }
-function projectOf(root, file2, exists2 = (rel) => existsSync29(path51.join(root, rel))) {
+function projectOf(root, file2, exists2 = (rel) => existsSync31(path54.join(root, rel))) {
   const parts = file2.split("/").slice(0, -1);
   for (let n = parts.length; n > 0; n--) {
     const dir = parts.slice(0, n).join("/");
@@ -35365,11 +35828,11 @@ async function changedFiles(root) {
     if (file2) lines.set(file2, (Number(added) || 0) + (Number(removed) || 0));
   }
   return parseStatus(status.stdout).map(({ path: file2, from }) => {
-    const full = path51.join(root, file2);
-    const bytes = existsSync29(full) ? statSync6(full).size : 0;
+    const full = path54.join(root, file2);
+    const bytes = existsSync31(full) ? statSync6(full).size : 0;
     let count3 = lines.get(file2);
     if (count3 === void 0 && bytes && bytes < 2e6) {
-      const text = readFileSync31(full, "utf8");
+      const text = readFileSync32(full, "utf8");
       count3 = text.includes("\0") ? 0 : text.split("\n").length;
     }
     return { path: file2, ...from ? { from } : {}, lines: count3 ?? 0, bytes, project: projectOf(root, file2) };
@@ -35379,20 +35842,20 @@ async function filesWithSecrets(root, files, ignores) {
   const hits = [];
   for (const file2 of files) {
     if (ignores.some((re) => re.test(file2))) continue;
-    const full = path51.join(root, file2);
-    if (!existsSync29(full) || statSync6(full).size > 2e6) continue;
+    const full = path54.join(root, file2);
+    if (!existsSync31(full) || statSync6(full).size > 2e6) continue;
     const tracked = (await git(root, "cat-file", "-e", `HEAD:${file2}`)).code === 0;
-    const added = tracked ? (await git(root, "diff", "-U0", "--no-color", "HEAD", "--", file2)).stdout.split("\n").filter((l) => l.startsWith("+") && !l.startsWith("+++")).map((l) => l.slice(1)) : readFileSync31(full, "utf8").split("\n");
-    if (added.some((l) => findSecrets(l).some((m) => m.confidence === "high"))) hits.push(file2);
+    const added = tracked ? (await git(root, "diff", "-U0", "--no-color", "HEAD", "--", file2)).stdout.split("\n").filter((l) => l.startsWith("+") && !l.startsWith("+++")).map((l) => l.slice(1)) : readFileSync32(full, "utf8").split("\n");
+    if (added.some((l) => findLeakedSecrets(l).some((m) => m.confidence === "high"))) hits.push(file2);
   }
   return hits;
 }
 function loadNotes(root, file2) {
   if (!file2) return {};
-  const full = path51.resolve(root, file2);
-  if (!isInside(root, full) || !existsSync29(full)) return `Couldn\u2019t find the notes file ${file2}.`;
+  const full = path54.resolve(root, file2);
+  if (!isInside(root, full) || !existsSync31(full)) return `Couldn\u2019t find the notes file ${file2}.`;
   try {
-    const parsed = Notes.safeParse(JSON.parse(readFileSync31(full, "utf8")));
+    const parsed = Notes.safeParse(JSON.parse(readFileSync32(full, "utf8")));
     return parsed.success ? parsed.data : `The notes file ${file2} isn\u2019t in the expected shape: { "<group id>": { "title", "summary", "check": [] } }.`;
   } catch {
     return `The notes file ${file2} isn\u2019t valid JSON.`;
@@ -35548,7 +36011,7 @@ Finish by hand with these two commands:
 
 // src/commands/simple.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync30 } from "fs";
+import { existsSync as existsSync32 } from "fs";
 async function nextCommand(flags) {
   const root = await findRepoRoot();
   const scan = await latestScan(root);
@@ -35607,7 +36070,7 @@ async function kindSetting(root, config2, value, project) {
   const paths = profile.projects.map((p2) => p2.path);
   const at = project ?? (paths.length === 1 ? paths[0] : void 0);
   if (!at) return `This repo has ${paths.length} projects, so say which one, for example: aura config kind ${value} ${paths.find((p2) => p2 !== ".")}`;
-  if (!existsSync30(packageFolder(root, normDir(at)))) return `There is no folder "${at}" in this repo.`;
+  if (!existsSync32(packageFolder(root, normDir(at)))) return `There is no folder "${at}" in this repo.`;
   config2.projects = setKindOverride(config2.projects, at, kind);
   return "saved";
 }
@@ -35680,7 +36143,7 @@ async function checkStagedCommand() {
   for (const line of diff.split("\n")) {
     if (line.startsWith("+++ ")) file2 = line.replace(/^\+\+\+ (?:b\/)?/, "");
     else if (line.startsWith("+") && !line.startsWith("+++") && !ignored(file2)) {
-      for (const m of findSecrets(line.slice(1))) if (m.confidence === "high") hits.push(`${file2}: ${m.label} (${maskSecret(m.value)})`);
+      for (const m of findLeakedSecrets(line.slice(1))) if (m.confidence === "high") hits.push(`${file2}: ${m.label} (${maskSecret(m.value)})`);
     }
   }
   const envFiles2 = execFileSync2("git", ["diff", "--cached", "--name-only", "--diff-filter=A"], { cwd: root, encoding: "utf8" }).split("\n").filter((f) => /(?:^|\/)\.env(?:\.[^/]+)?$/.test(f) && !/\.(?:example|sample|template)$/.test(f) && !ignored(f));