oxlint-plugin-react-doctor 0.4.2-dev.829655c → 0.4.2-dev.98066c2

package/dist/index.js

@@ -823,15 +823,550 @@ const getElementType = (openingElement, settings) => {
 	return baseName;
 };
 //#endregion
+//#region src/plugin/utils/find-import-source-for-name.ts
+const collectFromProgram = (programRoot) => {
+	const lookup = /* @__PURE__ */ new Map();
+	const visit = (node) => {
+		if (node.type === "ImportDeclaration" && "source" in node && node.source) {
+			const source = node.source.value;
+			if (typeof source !== "string") return;
+			if ("specifiers" in node && Array.isArray(node.specifiers)) for (const specifier of node.specifiers) {
+				if (!("local" in specifier) || !specifier.local) continue;
+				const local = specifier.local;
+				if (typeof local.name !== "string") continue;
+				if (specifier.type === "ImportDefaultSpecifier") lookup.set(local.name, {
+					source,
+					imported: null,
+					isDefault: true,
+					isNamespace: false
+				});
+				else if (specifier.type === "ImportNamespaceSpecifier") lookup.set(local.name, {
+					source,
+					imported: null,
+					isDefault: false,
+					isNamespace: true
+				});
+				else if (specifier.type === "ImportSpecifier") {
+					const importedNode = specifier.imported;
+					const importedName = importedNode?.name ?? (typeof importedNode?.value === "string" ? importedNode.value : null);
+					lookup.set(local.name, {
+						source,
+						imported: importedName,
+						isDefault: false,
+						isNamespace: false
+					});
+				}
+			}
+			return;
+		}
+		const nodeRecord = node;
+		for (const key of Object.keys(nodeRecord)) {
+			if (key === "parent") continue;
+			const child = nodeRecord[key];
+			if (Array.isArray(child)) {
+				for (const item of child) if (isAstNode(item)) visit(item);
+			} else if (isAstNode(child)) visit(child);
+		}
+	};
+	visit(programRoot);
+	return lookup;
+};
+const importLookupCache = /* @__PURE__ */ new WeakMap();
+const getImportLookup = (node) => {
+	const programRoot = findProgramRoot(node);
+	if (!programRoot) return null;
+	let cached = importLookupCache.get(programRoot);
+	if (!cached) {
+		cached = collectFromProgram(programRoot);
+		importLookupCache.set(programRoot, cached);
+	}
+	return cached;
+};
+const isImportedFromModule = (contextNode, localIdentifierName, moduleSource) => {
+	const lookup = getImportLookup(contextNode);
+	if (!lookup) return false;
+	const info = lookup.get(localIdentifierName);
+	if (!info) return false;
+	return info.source === moduleSource;
+};
+const isNamespaceImportFromModule = (contextNode, localIdentifierName, moduleSource) => {
+	const lookup = getImportLookup(contextNode);
+	if (!lookup) return false;
+	const info = lookup.get(localIdentifierName);
+	if (!info) return false;
+	return info.isNamespace && info.source === moduleSource;
+};
+const isDefaultImportFromModule = (contextNode, localIdentifierName, moduleSource) => {
+	const lookup = getImportLookup(contextNode);
+	if (!lookup) return false;
+	const info = lookup.get(localIdentifierName);
+	if (!info) return false;
+	return info.isDefault && info.source === moduleSource;
+};
+const getImportedNameFromModule = (contextNode, localIdentifierName, moduleSource) => {
+	const lookup = getImportLookup(contextNode);
+	if (!lookup) return null;
+	const info = lookup.get(localIdentifierName);
+	if (!info) return null;
+	if (info.source !== moduleSource) return null;
+	return info.imported;
+};
+//#endregion
+//#region src/plugin/utils/find-variable-initializer.ts
+const FUNCTION_LIKE_TYPES$1 = new Set([
+	"FunctionDeclaration",
+	"FunctionExpression",
+	"ArrowFunctionExpression",
+	"MethodDefinition",
+	"Program"
+]);
+const findScopeOwner = (node) => {
+	let ancestor = node;
+	while (ancestor) {
+		if (FUNCTION_LIKE_TYPES$1.has(ancestor.type)) return ancestor;
+		ancestor = ancestor.parent ?? null;
+	}
+	return null;
+};
+const findBlockScopeOwner = (declaratorNode, declarationKind) => {
+	if (declarationKind !== "let" && declarationKind !== "const") return findScopeOwner(declaratorNode);
+	let ancestor = declaratorNode.parent;
+	while (ancestor) {
+		if (ancestor.type === "BlockStatement") {
+			const blockParent = ancestor.parent;
+			if (blockParent && (blockParent.type === "FunctionDeclaration" || blockParent.type === "FunctionExpression" || blockParent.type === "ArrowFunctionExpression" || blockParent.type === "MethodDefinition")) return findScopeOwner(declaratorNode);
+			return ancestor;
+		}
+		if (FUNCTION_LIKE_TYPES$1.has(ancestor.type)) return ancestor;
+		ancestor = ancestor.parent ?? null;
+	}
+	return null;
+};
+const collectFromBindingPattern = (pattern, initializer, scopeOwner, out) => {
+	if (isNodeOfType(pattern, "Identifier")) {
+		const list = out.get(pattern.name) ?? [];
+		list.push({
+			bindingIdentifier: pattern,
+			initializer,
+			scopeOwner
+		});
+		out.set(pattern.name, list);
+		return;
+	}
+	if (isNodeOfType(pattern, "ObjectPattern")) {
+		for (const property of pattern.properties) if (isNodeOfType(property, "Property")) {
+			const valueNode = property.value;
+			collectFromBindingPattern(valueNode, isNodeOfType(valueNode, "AssignmentPattern") ? valueNode.right : null, scopeOwner, out);
+		} else if (isNodeOfType(property, "RestElement")) collectFromBindingPattern(property.argument, null, scopeOwner, out);
+		return;
+	}
+	if (isNodeOfType(pattern, "ArrayPattern")) {
+		for (const element of pattern.elements) {
+			if (!element) continue;
+			collectFromBindingPattern(element, isNodeOfType(element, "AssignmentPattern") ? element.right ?? null : null, scopeOwner, out);
+		}
+		return;
+	}
+	if (isNodeOfType(pattern, "AssignmentPattern")) {
+		collectFromBindingPattern(pattern.left, pattern.right ?? null, scopeOwner, out);
+		return;
+	}
+	if (isNodeOfType(pattern, "RestElement")) collectFromBindingPattern(pattern.argument, null, scopeOwner, out);
+};
+const buildBindingIndex = (root) => {
+	const out = /* @__PURE__ */ new Map();
+	const visit = (node) => {
+		if (isNodeOfType(node, "VariableDeclarator")) {
+			const declaration = node.parent;
+			const scopeOwner = findBlockScopeOwner(node, declaration && isNodeOfType(declaration, "VariableDeclaration") ? declaration.kind : void 0);
+			if (scopeOwner) collectFromBindingPattern(node.id, node.init ?? null, scopeOwner, out);
+		}
+		if ((isNodeOfType(node, "FunctionDeclaration") || isNodeOfType(node, "FunctionExpression")) && node.id) {
+			const enclosing = node.parent ? findScopeOwner(node.parent) : null;
+			if (enclosing) {
+				const list = out.get(node.id.name) ?? [];
+				list.push({
+					bindingIdentifier: node.id,
+					initializer: node,
+					scopeOwner: enclosing
+				});
+				out.set(node.id.name, list);
+			}
+		}
+		if ((isNodeOfType(node, "ClassDeclaration") || isNodeOfType(node, "ClassExpression")) && node.id) {
+			const enclosing = node.parent ? findScopeOwner(node.parent) : null;
+			if (enclosing) {
+				const list = out.get(node.id.name) ?? [];
+				list.push({
+					bindingIdentifier: node.id,
+					initializer: node,
+					scopeOwner: enclosing
+				});
+				out.set(node.id.name, list);
+			}
+		}
+		if (isNodeOfType(node, "FunctionDeclaration") || isNodeOfType(node, "FunctionExpression") || isNodeOfType(node, "ArrowFunctionExpression")) {
+			if (Array.isArray(node.params)) for (const param of node.params) {
+				if (!param) continue;
+				collectFromBindingPattern(param, null, node, out);
+				if (isNodeOfType(param, "AssignmentPattern")) collectFromBindingPattern(param.left ?? null, param.right ?? null, node, out);
+			}
+		}
+		if (isNodeOfType(node, "ImportDeclaration")) {
+			const scopeOwner = findScopeOwner(node);
+			if (scopeOwner && Array.isArray(node.specifiers)) for (const specifier of node.specifiers) {
+				const local = specifier.local;
+				if (local && isNodeOfType(local, "Identifier")) {
+					const list = out.get(local.name) ?? [];
+					list.push({
+						bindingIdentifier: local,
+						initializer: specifier,
+						scopeOwner
+					});
+					out.set(local.name, list);
+				}
+			}
+		}
+		if (node.type === "TSImportEqualsDeclaration" || node.type === "TSEnumDeclaration" || node.type === "TSModuleDeclaration") {
+			const idNode = node.id;
+			if (idNode && idNode.type === "Identifier") {
+				const idObject = idNode;
+				const scopeOwner = findScopeOwner(node);
+				if (scopeOwner && typeof idObject.name === "string") {
+					const list = out.get(idObject.name) ?? [];
+					list.push({
+						bindingIdentifier: idNode,
+						initializer: null,
+						scopeOwner
+					});
+					out.set(idObject.name, list);
+				}
+			}
+		}
+		const nodeRecord = node;
+		for (const key of Object.keys(nodeRecord)) {
+			if (key === "parent") continue;
+			const child = nodeRecord[key];
+			if (Array.isArray(child)) {
+				for (const item of child) if (isAstNode(item)) visit(item);
+			} else if (isAstNode(child)) visit(child);
+		}
+	};
+	visit(root);
+	return out;
+};
+const programRootCache = /* @__PURE__ */ new WeakMap();
+const getBindingIndex = (referenceNode) => {
+	const programRoot = findProgramRoot(referenceNode);
+	if (!programRoot) return null;
+	let index = programRootCache.get(programRoot);
+	if (!index) {
+		index = buildBindingIndex(programRoot);
+		programRootCache.set(programRoot, index);
+	}
+	return index;
+};
+const findVariableInitializer = (referenceNode, bindingName) => {
+	const index = getBindingIndex(referenceNode);
+	if (!index) return null;
+	const candidates = index.get(bindingName);
+	if (!candidates || candidates.length === 0) return null;
+	const referenceAncestors = /* @__PURE__ */ new Set();
+	let walker = referenceNode;
+	while (walker) {
+		referenceAncestors.add(walker);
+		walker = walker.parent ?? null;
+	}
+	let best = null;
+	for (const candidate of candidates) {
+		if (!referenceAncestors.has(candidate.scopeOwner)) continue;
+		if (best === null) {
+			best = candidate;
+			continue;
+		}
+		let cursor = candidate.scopeOwner;
+		while (cursor) {
+			if (cursor === best.scopeOwner) {
+				best = candidate;
+				break;
+			}
+			cursor = cursor.parent ?? null;
+		}
+	}
+	return best;
+};
+//#endregion
+//#region src/plugin/utils/flatten-jsx-name.ts
+/**
+* Flattens a JSX opener / member-expression chain into a dotted name.
+*
+*   `<Foo />`           → `"Foo"`
+*   `<Namespace.Foo />` → `"Namespace.Foo"`
+*   `<a.b.c />`         → `"a.b.c"`
+*
+* Returns `null` when the chain root isn't a `JSXIdentifier` (e.g.
+* the rare-but-valid `<this.x />` case, which JSX surfaces as a
+* `JSXThisExpression` root).
+*
+* Used by `forbid-elements` and `jsx-props-no-spreading`. Two other
+* rules (`forbid-component-props`, `utils/get-element-type`) keep
+* their own extended variants because they handle additional node
+* types (ThisExpression / JSXNamespacedName) and return a non-
+* nullable string with a sentinel value — semantically distinct.
+*/
+const flattenJsxName$1 = (node) => {
+	if (isNodeOfType(node, "JSXIdentifier")) return node.name;
+	if (isNodeOfType(node, "JSXMemberExpression")) {
+		const objectName = flattenJsxName$1(node.object);
+		if (!objectName) return null;
+		return `${objectName}.${node.property.name}`;
+	}
+	return null;
+};
+//#endregion
+//#region src/plugin/utils/is-member-property.ts
+const isMemberProperty = (node, propertyName) => Boolean(node && isNodeOfType(node, "MemberExpression") && isNodeOfType(node.property, "Identifier") && node.property.name === propertyName);
+//#endregion
+//#region src/plugin/constants/nextjs.ts
+const NEXTJS_SOURCE_FILE_EXTENSION_GROUP = "(?:tsx?|jsx?|mts|mjs)";
+const PAGE_FILE_PATTERN = new RegExp(`/page\\.${NEXTJS_SOURCE_FILE_EXTENSION_GROUP}$`);
+const PAGE_OR_LAYOUT_FILE_PATTERN = new RegExp(`/(page|layout)\\.${NEXTJS_SOURCE_FILE_EXTENSION_GROUP}$`);
+const INTERNAL_PAGE_PATH_PATTERN = /\/(?:(?:\((?:dashboard|admin|settings|account|internal|manage|console|portal|auth|onboarding|app|ee|protected)\))|(?:dashboard|admin|settings|account|internal|manage|console|portal))\//i;
+const PAGES_DIRECTORY_PATTERN = /\/pages\//;
+const NEXTJS_NAVIGATION_FUNCTIONS = new Set([
+	"redirect",
+	"permanentRedirect",
+	"notFound",
+	"forbidden",
+	"unauthorized"
+]);
+const GOOGLE_FONTS_PATTERN = /fonts\.googleapis\.com/;
+const POLYFILL_SCRIPT_PATTERN = /polyfill\.io|polyfill\.min\.js|cdn\.polyfill/;
+const APP_DIRECTORY_PATTERN = /\/app\//;
+const ROUTE_HANDLER_FILE_PATTERN = new RegExp(`/route\\.${NEXTJS_SOURCE_FILE_EXTENSION_GROUP}$`);
+const CRON_ROUTE_PATTERN = /\/(?:cron|jobs\/cron)(?:\/|$)/i;
+const MUTATING_ROUTE_SEGMENTS = new Set([
+	"logout",
+	"log-out",
+	"signout",
+	"sign-out",
+	"unsubscribe",
+	"delete",
+	"remove",
+	"revoke",
+	"cancel",
+	"deactivate"
+]);
+const ERROR_BOUNDARY_FILE_PATTERN = new RegExp(`/(error|global-error)\\.${NEXTJS_SOURCE_FILE_EXTENSION_GROUP}$`);
+const GLOBAL_ERROR_FILE_PATTERN = new RegExp(`/global-error\\.${NEXTJS_SOURCE_FILE_EXTENSION_GROUP}$`);
+const ROUTE_HANDLER_HTTP_METHODS = new Set([
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE",
+	"OPTIONS",
+	"HEAD"
+]);
+const GOOGLE_ANALYTICS_SCRIPT_PATTERN = /google-analytics\.com|googletagmanager\.com\/gtag/;
+const OG_IMAGE_FILE_PATTERN = new RegExp(`/(opengraph-image|twitter-image)\\d*\\.${NEXTJS_SOURCE_FILE_EXTENSION_GROUP}$`);
+//#endregion
 //#region src/plugin/utils/is-nextjs-metadata-image-route-filename.ts
+const METADATA_IMAGE_ROUTE_FILE_PATTERN = new RegExp(`^(opengraph-image|twitter-image|icon|apple-icon)\\d*\\.${NEXTJS_SOURCE_FILE_EXTENSION_GROUP}$`);
 const isNextjsMetadataImageRouteFilename = (rawFilename) => {
 	if (!rawFilename) return false;
-	return /^(opengraph-image|twitter-image|icon|apple-icon)\d*\.(jsx?|tsx?)$/.test(path.basename(rawFilename));
+	return METADATA_IMAGE_ROUTE_FILE_PATTERN.test(path.basename(rawFilename));
 };
 //#endregion
 //#region src/plugin/utils/normalize-filename.ts
 const normalizeFilename$1 = (filename) => filename.replaceAll("\\", "/");
 //#endregion
+//#region src/plugin/utils/strip-paren-expression.ts
+const TS_WRAPPER_TYPES = new Set([
+	"ParenthesizedExpression",
+	"TSAsExpression",
+	"TSSatisfiesExpression",
+	"TSTypeAssertion",
+	"TSNonNullExpression",
+	"TSInstantiationExpression"
+]);
+const stripParenExpression = (node) => {
+	let current = node;
+	while (true) {
+		if (TS_WRAPPER_TYPES.has(current.type) && "expression" in current && current.expression) {
+			current = current.expression;
+			continue;
+		}
+		if (isNodeOfType(current, "ChainExpression") && current.expression) {
+			current = current.expression;
+			continue;
+		}
+		break;
+	}
+	return current;
+};
+//#endregion
+//#region src/plugin/utils/is-generated-image-render-context.ts
+const IMAGE_RESPONSE_MODULES = ["next/og", "@vercel/og"];
+const SATORI_MODULE = "satori";
+const generatedImageJsxCache = /* @__PURE__ */ new WeakMap();
+const isGeneratedImageRenderFilename = (rawFilename) => {
+	if (!rawFilename) return false;
+	return isNextjsMetadataImageRouteFilename(normalizeFilename$1(rawFilename));
+};
+const isImageResponseCallee = (contextNode, callee) => {
+	if (isNodeOfType(callee, "Identifier")) return IMAGE_RESPONSE_MODULES.some((moduleSource) => getImportedNameFromModule(contextNode, callee.name, moduleSource) === "ImageResponse");
+	if (!isMemberProperty(callee, "ImageResponse")) return false;
+	if (!isNodeOfType(callee.object, "Identifier")) return false;
+	const namespaceIdentifierName = callee.object.name;
+	return IMAGE_RESPONSE_MODULES.some((moduleSource) => isNamespaceImportFromModule(contextNode, namespaceIdentifierName, moduleSource));
+};
+const isSatoriCallee = (contextNode, callee) => {
+	if (!isNodeOfType(callee, "Identifier")) return false;
+	if (getImportedNameFromModule(contextNode, callee.name, SATORI_MODULE) === "satori") return true;
+	return isDefaultImportFromModule(contextNode, callee.name, SATORI_MODULE);
+};
+const isGeneratedImageRendererCall = (node) => {
+	if (!isNodeOfType(node, "CallExpression") && !isNodeOfType(node, "NewExpression")) return false;
+	if (!isNodeOfType(node.callee, "Identifier") && !isNodeOfType(node.callee, "MemberExpression")) return false;
+	return isImageResponseCallee(node, node.callee) || isSatoriCallee(node, node.callee);
+};
+const isComponentIdentifierName = (name) => {
+	const firstCharacter = name[0];
+	return Boolean(firstCharacter && firstCharacter === firstCharacter.toUpperCase());
+};
+const isFunctionLike$3 = (node) => Boolean(node && (isNodeOfType(node, "FunctionDeclaration") || isNodeOfType(node, "FunctionExpression") || isNodeOfType(node, "ArrowFunctionExpression")));
+const markFunctionReturnJsx = (functionNode, programRoot, generatedImageJsxNodes, visitedComponentNames) => {
+	if (!isFunctionLike$3(functionNode)) return;
+	if (isNodeOfType(functionNode, "ArrowFunctionExpression")) {
+		const body = stripParenExpression(functionNode.body);
+		if (!isNodeOfType(body, "BlockStatement")) {
+			markGeneratedImageExpression(body, programRoot, generatedImageJsxNodes, visitedComponentNames);
+			return;
+		}
+	}
+	const body = functionNode.body;
+	if (!isNodeOfType(body, "BlockStatement")) return;
+	walkAst(body, (descendantNode) => {
+		if (descendantNode !== body && isFunctionLike$3(descendantNode)) return false;
+		if (!isNodeOfType(descendantNode, "ReturnStatement")) return;
+		if (!descendantNode.argument) return;
+		markGeneratedImageExpression(stripParenExpression(descendantNode.argument), programRoot, generatedImageJsxNodes, visitedComponentNames);
+	});
+};
+const hasNormalJsxUsage = (programRoot, componentName, generatedImageJsxNodes) => {
+	let hasNormalUsage = false;
+	walkAst(programRoot, (descendantNode) => {
+		if (hasNormalUsage) return false;
+		if (!isNodeOfType(descendantNode, "JSXOpeningElement")) return;
+		if (generatedImageJsxNodes.has(descendantNode)) return;
+		if (flattenJsxName$1(descendantNode.name) !== componentName) return;
+		hasNormalUsage = true;
+		return false;
+	});
+	return hasNormalUsage;
+};
+const markComponentRenderJsx = (programRoot, openingElement, generatedImageJsxNodes, visitedComponentNames) => {
+	const tagName = flattenJsxName$1(openingElement.name);
+	if (!tagName || tagName.includes(".") || !isComponentIdentifierName(tagName)) return;
+	if (visitedComponentNames.has(tagName)) return;
+	if (hasNormalJsxUsage(programRoot, tagName, generatedImageJsxNodes)) return;
+	const binding = findVariableInitializer(openingElement, tagName);
+	if (!binding?.initializer) return;
+	visitedComponentNames.add(tagName);
+	markGeneratedImageExpression(stripParenExpression(binding.initializer), programRoot, generatedImageJsxNodes, visitedComponentNames);
+};
+const isInsideGeneratedImageRendererArgument = (node) => {
+	let cursor = node.parent;
+	while (cursor) {
+		if (isGeneratedImageRendererCall(cursor)) return true;
+		cursor = cursor.parent ?? null;
+	}
+	return false;
+};
+const hasNormalFunctionCallUsage = (programRoot, functionName) => {
+	let hasNormalUsage = false;
+	walkAst(programRoot, (descendantNode) => {
+		if (hasNormalUsage) return false;
+		if (!isNodeOfType(descendantNode, "CallExpression")) return;
+		if (!isNodeOfType(descendantNode.callee, "Identifier")) return;
+		if (descendantNode.callee.name !== functionName) return;
+		if (isInsideGeneratedImageRendererArgument(descendantNode)) return;
+		hasNormalUsage = true;
+		return false;
+	});
+	return hasNormalUsage;
+};
+const markJsxSubtree = (node, programRoot, generatedImageJsxNodes, visitedComponentNames) => {
+	walkAst(node, (descendantNode) => {
+		if (!isNodeOfType(descendantNode, "JSXOpeningElement")) return;
+		generatedImageJsxNodes.add(descendantNode);
+		markComponentRenderJsx(programRoot, descendantNode, generatedImageJsxNodes, visitedComponentNames);
+	});
+};
+const markGeneratedImageExpression = (expression, programRoot, generatedImageJsxNodes, visitedComponentNames) => {
+	const unwrappedExpression = stripParenExpression(expression);
+	if (isNodeOfType(unwrappedExpression, "JSXElement") || isNodeOfType(unwrappedExpression, "JSXFragment")) {
+		markJsxSubtree(unwrappedExpression, programRoot, generatedImageJsxNodes, visitedComponentNames);
+		return;
+	}
+	if (isFunctionLike$3(unwrappedExpression)) {
+		markFunctionReturnJsx(unwrappedExpression, programRoot, generatedImageJsxNodes, visitedComponentNames);
+		return;
+	}
+	if (isNodeOfType(unwrappedExpression, "ConditionalExpression")) {
+		markGeneratedImageExpression(unwrappedExpression.consequent, programRoot, generatedImageJsxNodes, visitedComponentNames);
+		markGeneratedImageExpression(unwrappedExpression.alternate, programRoot, generatedImageJsxNodes, visitedComponentNames);
+		return;
+	}
+	if (isNodeOfType(unwrappedExpression, "LogicalExpression")) {
+		markGeneratedImageExpression(unwrappedExpression.left, programRoot, generatedImageJsxNodes, visitedComponentNames);
+		markGeneratedImageExpression(unwrappedExpression.right, programRoot, generatedImageJsxNodes, visitedComponentNames);
+		return;
+	}
+	if (isNodeOfType(unwrappedExpression, "CallExpression")) {
+		const callee = unwrappedExpression.callee;
+		if (isFunctionLike$3(callee)) {
+			markFunctionReturnJsx(callee, programRoot, generatedImageJsxNodes, visitedComponentNames);
+			return;
+		}
+		if (!isNodeOfType(callee, "Identifier")) return;
+		if (visitedComponentNames.has(callee.name)) return;
+		if (hasNormalJsxUsage(programRoot, callee.name, generatedImageJsxNodes)) return;
+		if (hasNormalFunctionCallUsage(programRoot, callee.name)) return;
+		const binding = findVariableInitializer(callee, callee.name);
+		if (!binding?.initializer || !isFunctionLike$3(stripParenExpression(binding.initializer))) return;
+		visitedComponentNames.add(callee.name);
+		markFunctionReturnJsx(stripParenExpression(binding.initializer), programRoot, generatedImageJsxNodes, visitedComponentNames);
+		return;
+	}
+	if (isNodeOfType(unwrappedExpression, "Identifier")) {
+		if (visitedComponentNames.has(unwrappedExpression.name)) return;
+		visitedComponentNames.add(unwrappedExpression.name);
+		const binding = findVariableInitializer(unwrappedExpression, unwrappedExpression.name);
+		if (!binding?.initializer) return;
+		markGeneratedImageExpression(stripParenExpression(binding.initializer), programRoot, generatedImageJsxNodes, visitedComponentNames);
+	}
+};
+const collectGeneratedImageJsxNodes = (programRoot) => {
+	const cached = generatedImageJsxCache.get(programRoot);
+	if (cached) return cached;
+	const generatedImageJsxNodes = /* @__PURE__ */ new WeakSet();
+	walkAst(programRoot, (descendantNode) => {
+		if (!isGeneratedImageRendererCall(descendantNode)) return;
+		for (const argument of descendantNode.arguments) markGeneratedImageExpression(argument, programRoot, generatedImageJsxNodes, /* @__PURE__ */ new Set());
+	});
+	generatedImageJsxCache.set(programRoot, generatedImageJsxNodes);
+	return generatedImageJsxNodes;
+};
+const isGeneratedImageRenderContext = (context, node) => {
+	if (isGeneratedImageRenderFilename(context.filename)) return true;
+	if (!node) return false;
+	const programRoot = findProgramRoot(node);
+	if (!programRoot) return false;
+	return collectGeneratedImageJsxNodes(programRoot).has(node);
+};
+//#endregion
 //#region src/plugin/utils/is-hidden-from-screen-reader.ts
 const isHiddenFromScreenReader = (openingElement, settings) => {
 	if (getElementType(openingElement, settings).toLowerCase() === "input") {
@@ -1003,7 +1538,7 @@ const altText = defineRule({
 	recommendation: "Give every meaningful image an `alt`, `aria-label`, or `aria-labelledby`.",
 	category: "Accessibility",
 	create: (context) => {
-		if (isNextjsMetadataImageRouteFilename(normalizeFilename$1(context.filename ?? ""))) return {};
+		if (isGeneratedImageRenderContext(context)) return {};
 		const settings = resolveSettings$52(context.settings);
 		const checkImg = !settings.elements || settings.elements.includes("img");
 		const checkObject = !settings.elements || settings.elements.includes("object");
@@ -1014,6 +1549,7 @@ const altText = defineRule({
 		const areaAliases = new Set(settings.area ?? []);
 		const inputImageAliases = new Set(settings["input[type=\"image\"]"] ?? []);
 		return { JSXOpeningElement(node) {
+			if (isGeneratedImageRenderContext(context, node)) return;
 			const tag = getElementType(node, context.settings);
 			if (checkImg && (tag === "img" || imgAliases.has(tag))) {
 				imgRule(node, node, context);
@@ -2330,7 +2866,7 @@ const LOOP_TYPES = [
 	"WhileStatement",
 	"DoWhileStatement"
 ];
-const FUNCTION_LIKE_TYPES$1 = new Set([
+const FUNCTION_LIKE_TYPES = new Set([
 	"FunctionDeclaration",
 	"FunctionExpression",
 	"ArrowFunctionExpression"
@@ -3628,9 +4164,6 @@ const clientLocalstorageNoVersion = defineRule({
 	} })
 });
 //#endregion
-//#region src/plugin/utils/is-member-property.ts
-const isMemberProperty = (node, propertyName) => Boolean(node && isNodeOfType(node, "MemberExpression") && isNodeOfType(node.property, "Identifier") && node.property.name === propertyName);
-//#endregion
 //#region src/plugin/rules/client/client-passive-event-listeners.ts
 const clientPassiveEventListeners = defineRule({
 	id: "client-passive-event-listeners",
@@ -3670,31 +4203,6 @@ const isReactComponentName = (name) => {
 	return firstCharacter >= 65 && firstCharacter <= 90;
 };
 //#endregion
-//#region src/plugin/utils/strip-paren-expression.ts
-const TS_WRAPPER_TYPES = new Set([
-	"ParenthesizedExpression",
-	"TSAsExpression",
-	"TSSatisfiesExpression",
-	"TSTypeAssertion",
-	"TSNonNullExpression",
-	"TSInstantiationExpression"
-]);
-const stripParenExpression = (node) => {
-	let current = node;
-	while (true) {
-		if (TS_WRAPPER_TYPES.has(current.type) && "expression" in current && current.expression) {
-			current = current.expression;
-			continue;
-		}
-		if (isNodeOfType(current, "ChainExpression") && current.expression) {
-			current = current.expression;
-			continue;
-		}
-		break;
-	}
-	return current;
-};
-//#endregion
 //#region src/plugin/rules/a11y/control-has-associated-label.ts
 const MESSAGE$48 = "Blind users can't tell what this control does because screen readers find no label, so add visible text, `aria-label`, or `aria-labelledby`.";
 const DEFAULT_IGNORE_ELEMENTS = ["link", "canvas"];
@@ -6301,9 +6809,9 @@ const isForbiddenForTag = (entry, tag) => {
 	if (entry.allowedForPatterns.some((regex) => regex.test(tag))) return false;
 	return true;
 };
-const flattenJsxName$1 = (name) => {
+const flattenJsxName = (name) => {
 	if (isNodeOfType(name, "JSXIdentifier")) return name.name;
-	if (isNodeOfType(name, "JSXMemberExpression")) return `${flattenJsxName$1(name.object)}.${name.property.name}`;
+	if (isNodeOfType(name, "JSXMemberExpression")) return `${flattenJsxName(name.object)}.${name.property.name}`;
 	if (name.type === "ThisExpression" || name.type === "JSXThisExpression") return "this";
 	return "";
 };
@@ -6321,7 +6829,7 @@ const forbidComponentProps = defineRule({
 		return { JSXOpeningElement(node) {
 			if (entries.length === 0) return;
 			if (!isSupportedJsxName(node.name)) return;
-			const tag = flattenJsxName$1(node.name);
+			const tag = flattenJsxName(node.name);
 			if (!tag) return;
 			if (!(isReactComponentName(tag.split(".")[0]) || tag.includes("."))) return;
 			for (const attribute of node.attributes) {
@@ -6416,34 +6924,6 @@ const flattenCalleeName = (callee) => {
 	return null;
 };
 //#endregion
-//#region src/plugin/utils/flatten-jsx-name.ts
-/**
-* Flattens a JSX opener / member-expression chain into a dotted name.
-*
-*   `<Foo />`           → `"Foo"`
-*   `<Namespace.Foo />` → `"Namespace.Foo"`
-*   `<a.b.c />`         → `"a.b.c"`
-*
-* Returns `null` when the chain root isn't a `JSXIdentifier` (e.g.
-* the rare-but-valid `<this.x />` case, which JSX surfaces as a
-* `JSXThisExpression` root).
-*
-* Used by `forbid-elements` and `jsx-props-no-spreading`. Two other
-* rules (`forbid-component-props`, `utils/get-element-type`) keep
-* their own extended variants because they handle additional node
-* types (ThisExpression / JSXNamespacedName) and return a non-
-* nullable string with a sentinel value — semantically distinct.
-*/
-const flattenJsxName = (node) => {
-	if (isNodeOfType(node, "JSXIdentifier")) return node.name;
-	if (isNodeOfType(node, "JSXMemberExpression")) {
-		const objectName = flattenJsxName(node.object);
-		if (!objectName) return null;
-		return `${objectName}.${node.property.name}`;
-	}
-	return null;
-};
-//#endregion
 //#region src/plugin/utils/is-react-function-call.ts
 const PRAGMA = "React";
 const isReactFunctionCall = (node, expectedCall) => {
@@ -6475,7 +6955,7 @@ const forbidElements = defineRule({
 		return {
 			JSXOpeningElement(node) {
 				if (forbidMap.size === 0) return;
-				const fullName = flattenJsxName(node.name);
+				const fullName = flattenJsxName$1(node.name);
 				if (!fullName || !forbidMap.has(fullName)) return;
 				context.report({
 					node: node.name,
@@ -7185,8 +7665,10 @@ const imgRedundantAlt = defineRule({
 	recommendation: "Do not put 'image' or 'photo' in alt text. Describe what is shown.",
 	category: "Accessibility",
 	create: (context) => {
+		if (isGeneratedImageRenderContext(context)) return {};
 		const settings = resolveSettings$37(context.settings);
 		return { JSXOpeningElement(node) {
+			if (isGeneratedImageRenderContext(context, node)) return;
 			const tag = getElementType(node, context.settings);
 			if (!settings.components.includes(tag)) return;
 			if (isHiddenFromScreenReader(node, context.settings)) return;
@@ -7303,92 +7785,10 @@ const interactiveSupportsFocus = defineRule({
 			context.report({
 				node,
 				message
-			});
-		} };
-	}
-});
-//#endregion
-//#region src/plugin/utils/find-import-source-for-name.ts
-const collectFromProgram = (programRoot) => {
-	const lookup = /* @__PURE__ */ new Map();
-	const visit = (node) => {
-		if (node.type === "ImportDeclaration" && "source" in node && node.source) {
-			const source = node.source.value;
-			if (typeof source !== "string") return;
-			if ("specifiers" in node && Array.isArray(node.specifiers)) for (const specifier of node.specifiers) {
-				if (!("local" in specifier) || !specifier.local) continue;
-				const local = specifier.local;
-				if (typeof local.name !== "string") continue;
-				if (specifier.type === "ImportDefaultSpecifier") lookup.set(local.name, {
-					source,
-					imported: null,
-					isDefault: true,
-					isNamespace: false
-				});
-				else if (specifier.type === "ImportNamespaceSpecifier") lookup.set(local.name, {
-					source,
-					imported: null,
-					isDefault: false,
-					isNamespace: true
-				});
-				else if (specifier.type === "ImportSpecifier") {
-					const importedNode = specifier.imported;
-					const importedName = importedNode?.name ?? (typeof importedNode?.value === "string" ? importedNode.value : null);
-					lookup.set(local.name, {
-						source,
-						imported: importedName,
-						isDefault: false,
-						isNamespace: false
-					});
-				}
-			}
-			return;
-		}
-		const nodeRecord = node;
-		for (const key of Object.keys(nodeRecord)) {
-			if (key === "parent") continue;
-			const child = nodeRecord[key];
-			if (Array.isArray(child)) {
-				for (const item of child) if (isAstNode(item)) visit(item);
-			} else if (isAstNode(child)) visit(child);
-		}
-	};
-	visit(programRoot);
-	return lookup;
-};
-const importLookupCache = /* @__PURE__ */ new WeakMap();
-const getImportLookup = (node) => {
-	const programRoot = findProgramRoot(node);
-	if (!programRoot) return null;
-	let cached = importLookupCache.get(programRoot);
-	if (!cached) {
-		cached = collectFromProgram(programRoot);
-		importLookupCache.set(programRoot, cached);
+			});
+		} };
 	}
-	return cached;
-};
-const isImportedFromModule = (contextNode, localIdentifierName, moduleSource) => {
-	const lookup = getImportLookup(contextNode);
-	if (!lookup) return false;
-	const info = lookup.get(localIdentifierName);
-	if (!info) return false;
-	return info.source === moduleSource;
-};
-const isNamespaceImportFromModule = (contextNode, localIdentifierName, moduleSource) => {
-	const lookup = getImportLookup(contextNode);
-	if (!lookup) return false;
-	const info = lookup.get(localIdentifierName);
-	if (!info) return false;
-	return info.isNamespace && info.source === moduleSource;
-};
-const getImportedNameFromModule = (contextNode, localIdentifierName, moduleSource) => {
-	const lookup = getImportLookup(contextNode);
-	if (!lookup) return null;
-	const info = lookup.get(localIdentifierName);
-	if (!info) return null;
-	if (info.source !== moduleSource) return null;
-	return info.imported;
-};
+});
 //#endregion
 //#region src/plugin/rules/jotai/jotai-derived-atom-returns-fresh-object.ts
 const isAtomFromJotai = (callExpression) => {
@@ -9327,190 +9727,6 @@ const jsxKey = defineRule({
 	}
 });
 //#endregion
-//#region src/plugin/utils/find-variable-initializer.ts
-const FUNCTION_LIKE_TYPES = new Set([
-	"FunctionDeclaration",
-	"FunctionExpression",
-	"ArrowFunctionExpression",
-	"MethodDefinition",
-	"Program"
-]);
-const findScopeOwner = (node) => {
-	let ancestor = node;
-	while (ancestor) {
-		if (FUNCTION_LIKE_TYPES.has(ancestor.type)) return ancestor;
-		ancestor = ancestor.parent ?? null;
-	}
-	return null;
-};
-const findBlockScopeOwner = (declaratorNode, declarationKind) => {
-	if (declarationKind !== "let" && declarationKind !== "const") return findScopeOwner(declaratorNode);
-	let ancestor = declaratorNode.parent;
-	while (ancestor) {
-		if (ancestor.type === "BlockStatement") {
-			const blockParent = ancestor.parent;
-			if (blockParent && (blockParent.type === "FunctionDeclaration" || blockParent.type === "FunctionExpression" || blockParent.type === "ArrowFunctionExpression" || blockParent.type === "MethodDefinition")) return findScopeOwner(declaratorNode);
-			return ancestor;
-		}
-		if (FUNCTION_LIKE_TYPES.has(ancestor.type)) return ancestor;
-		ancestor = ancestor.parent ?? null;
-	}
-	return null;
-};
-const collectFromBindingPattern = (pattern, initializer, scopeOwner, out) => {
-	if (isNodeOfType(pattern, "Identifier")) {
-		const list = out.get(pattern.name) ?? [];
-		list.push({
-			bindingIdentifier: pattern,
-			initializer,
-			scopeOwner
-		});
-		out.set(pattern.name, list);
-		return;
-	}
-	if (isNodeOfType(pattern, "ObjectPattern")) {
-		for (const property of pattern.properties) if (isNodeOfType(property, "Property")) {
-			const valueNode = property.value;
-			collectFromBindingPattern(valueNode, isNodeOfType(valueNode, "AssignmentPattern") ? valueNode.right : null, scopeOwner, out);
-		} else if (isNodeOfType(property, "RestElement")) collectFromBindingPattern(property.argument, null, scopeOwner, out);
-		return;
-	}
-	if (isNodeOfType(pattern, "ArrayPattern")) {
-		for (const element of pattern.elements) {
-			if (!element) continue;
-			collectFromBindingPattern(element, isNodeOfType(element, "AssignmentPattern") ? element.right ?? null : null, scopeOwner, out);
-		}
-		return;
-	}
-	if (isNodeOfType(pattern, "AssignmentPattern")) {
-		collectFromBindingPattern(pattern.left, pattern.right ?? null, scopeOwner, out);
-		return;
-	}
-	if (isNodeOfType(pattern, "RestElement")) collectFromBindingPattern(pattern.argument, null, scopeOwner, out);
-};
-const buildBindingIndex = (root) => {
-	const out = /* @__PURE__ */ new Map();
-	const visit = (node) => {
-		if (isNodeOfType(node, "VariableDeclarator")) {
-			const declaration = node.parent;
-			const scopeOwner = findBlockScopeOwner(node, declaration && isNodeOfType(declaration, "VariableDeclaration") ? declaration.kind : void 0);
-			if (scopeOwner) collectFromBindingPattern(node.id, node.init ?? null, scopeOwner, out);
-		}
-		if ((isNodeOfType(node, "FunctionDeclaration") || isNodeOfType(node, "FunctionExpression")) && node.id) {
-			const enclosing = node.parent ? findScopeOwner(node.parent) : null;
-			if (enclosing) {
-				const list = out.get(node.id.name) ?? [];
-				list.push({
-					bindingIdentifier: node.id,
-					initializer: node,
-					scopeOwner: enclosing
-				});
-				out.set(node.id.name, list);
-			}
-		}
-		if ((isNodeOfType(node, "ClassDeclaration") || isNodeOfType(node, "ClassExpression")) && node.id) {
-			const enclosing = node.parent ? findScopeOwner(node.parent) : null;
-			if (enclosing) {
-				const list = out.get(node.id.name) ?? [];
-				list.push({
-					bindingIdentifier: node.id,
-					initializer: node,
-					scopeOwner: enclosing
-				});
-				out.set(node.id.name, list);
-			}
-		}
-		if (isNodeOfType(node, "FunctionDeclaration") || isNodeOfType(node, "FunctionExpression") || isNodeOfType(node, "ArrowFunctionExpression")) {
-			if (Array.isArray(node.params)) for (const param of node.params) {
-				if (!param) continue;
-				collectFromBindingPattern(param, null, node, out);
-				if (isNodeOfType(param, "AssignmentPattern")) collectFromBindingPattern(param.left ?? null, param.right ?? null, node, out);
-			}
-		}
-		if (isNodeOfType(node, "ImportDeclaration")) {
-			const scopeOwner = findScopeOwner(node);
-			if (scopeOwner && Array.isArray(node.specifiers)) for (const specifier of node.specifiers) {
-				const local = specifier.local;
-				if (local && isNodeOfType(local, "Identifier")) {
-					const list = out.get(local.name) ?? [];
-					list.push({
-						bindingIdentifier: local,
-						initializer: specifier,
-						scopeOwner
-					});
-					out.set(local.name, list);
-				}
-			}
-		}
-		if (node.type === "TSImportEqualsDeclaration" || node.type === "TSEnumDeclaration" || node.type === "TSModuleDeclaration") {
-			const idNode = node.id;
-			if (idNode && idNode.type === "Identifier") {
-				const idObject = idNode;
-				const scopeOwner = findScopeOwner(node);
-				if (scopeOwner && typeof idObject.name === "string") {
-					const list = out.get(idObject.name) ?? [];
-					list.push({
-						bindingIdentifier: idNode,
-						initializer: null,
-						scopeOwner
-					});
-					out.set(idObject.name, list);
-				}
-			}
-		}
-		const nodeRecord = node;
-		for (const key of Object.keys(nodeRecord)) {
-			if (key === "parent") continue;
-			const child = nodeRecord[key];
-			if (Array.isArray(child)) {
-				for (const item of child) if (isAstNode(item)) visit(item);
-			} else if (isAstNode(child)) visit(child);
-		}
-	};
-	visit(root);
-	return out;
-};
-const programRootCache = /* @__PURE__ */ new WeakMap();
-const getBindingIndex = (referenceNode) => {
-	const programRoot = findProgramRoot(referenceNode);
-	if (!programRoot) return null;
-	let index = programRootCache.get(programRoot);
-	if (!index) {
-		index = buildBindingIndex(programRoot);
-		programRootCache.set(programRoot, index);
-	}
-	return index;
-};
-const findVariableInitializer = (referenceNode, bindingName) => {
-	const index = getBindingIndex(referenceNode);
-	if (!index) return null;
-	const candidates = index.get(bindingName);
-	if (!candidates || candidates.length === 0) return null;
-	const referenceAncestors = /* @__PURE__ */ new Set();
-	let walker = referenceNode;
-	while (walker) {
-		referenceAncestors.add(walker);
-		walker = walker.parent ?? null;
-	}
-	let best = null;
-	for (const candidate of candidates) {
-		if (!referenceAncestors.has(candidate.scopeOwner)) continue;
-		if (best === null) {
-			best = candidate;
-			continue;
-		}
-		let cursor = candidate.scopeOwner;
-		while (cursor) {
-			if (cursor === best.scopeOwner) {
-				best = candidate;
-				break;
-			}
-			cursor = cursor.parent ?? null;
-		}
-	}
-	return best;
-};
-//#endregion
 //#region src/plugin/rules/react-builtins/jsx-max-depth.ts
 const buildMessage$18 = (depth, max) => `This JSX is hard to read at ${depth} levels deep, past the limit of ${max}.`;
 const DEFAULT_MAX_DEPTH = 14;
@@ -11644,7 +11860,7 @@ const jsxPropsNoSpreading = defineRule({
 	create: (context) => {
 		const settings = resolveSettings$25(context.settings);
 		return { JSXOpeningElement(node) {
-			const tagName = flattenJsxName(node.name);
+			const tagName = flattenJsxName$1(node.name);
 			if (!tagName) return;
 			const isCustom = isReactComponentName(tagName) || tagName.includes(".");
 			const isHtml = !isCustom;
@@ -12230,50 +12446,6 @@ const nextjsAsyncClientComponent = defineRule({
 	}
 });
 //#endregion
-//#region src/plugin/constants/nextjs.ts
-const PAGE_FILE_PATTERN = /\/page\.(tsx?|jsx?)$/;
-const PAGE_OR_LAYOUT_FILE_PATTERN = /\/(page|layout)\.(tsx?|jsx?)$/;
-const INTERNAL_PAGE_PATH_PATTERN = /\/(?:(?:\((?:dashboard|admin|settings|account|internal|manage|console|portal|auth|onboarding|app|ee|protected)\))|(?:dashboard|admin|settings|account|internal|manage|console|portal))\//i;
-const OG_ROUTE_PATTERN = /\/og\b/i;
-const PAGES_DIRECTORY_PATTERN = /\/pages\//;
-const NEXTJS_NAVIGATION_FUNCTIONS = new Set([
-	"redirect",
-	"permanentRedirect",
-	"notFound",
-	"forbidden",
-	"unauthorized"
-]);
-const GOOGLE_FONTS_PATTERN = /fonts\.googleapis\.com/;
-const POLYFILL_SCRIPT_PATTERN = /polyfill\.io|polyfill\.min\.js|cdn\.polyfill/;
-const APP_DIRECTORY_PATTERN = /\/app\//;
-const ROUTE_HANDLER_FILE_PATTERN = /\/route\.(tsx?|jsx?)$/;
-const CRON_ROUTE_PATTERN = /\/(?:cron|jobs\/cron)(?:\/|$)/i;
-const MUTATING_ROUTE_SEGMENTS = new Set([
-	"logout",
-	"log-out",
-	"signout",
-	"sign-out",
-	"unsubscribe",
-	"delete",
-	"remove",
-	"revoke",
-	"cancel",
-	"deactivate"
-]);
-const ERROR_BOUNDARY_FILE_PATTERN = /\/(error|global-error)\.(tsx?|jsx?)$/;
-const GLOBAL_ERROR_FILE_PATTERN = /\/global-error\.(tsx?|jsx?)$/;
-const ROUTE_HANDLER_HTTP_METHODS = new Set([
-	"GET",
-	"POST",
-	"PUT",
-	"PATCH",
-	"DELETE",
-	"OPTIONS",
-	"HEAD"
-]);
-const GOOGLE_ANALYTICS_SCRIPT_PATTERN = /google-analytics\.com|googletagmanager\.com\/gtag/;
-const OG_IMAGE_FILE_PATTERN = /\/(opengraph-image|twitter-image)\d*\.(tsx?|jsx?)$/;
-//#endregion
 //#region src/plugin/rules/nextjs/nextjs-error-boundary-missing-use-client.ts
 const nextjsErrorBoundaryMissingUseClient = defineRule({
 	id: "nextjs-error-boundary-missing-use-client",
@@ -12671,11 +12843,9 @@ const nextjsNoImgElement = defineRule({
 	severity: "warn",
 	recommendation: "`import Image from 'next/image'` for automatic WebP/AVIF, lazy loading, and responsive srcset",
 	create: (context) => {
-		const filename = normalizeFilename$1(context.filename ?? "");
-		const isOgRoute = OG_ROUTE_PATTERN.test(filename);
-		const isMetadataImageRoute = isNextjsMetadataImageRouteFilename(filename);
+		if (isGeneratedImageRenderContext(context)) return {};
 		return { JSXOpeningElement(node) {
-			if (isOgRoute || isMetadataImageRoute) return;
+			if (isGeneratedImageRenderContext(context, node)) return;
 			if (isNodeOfType(node.name, "JSXIdentifier") && node.name.name === "img") context.report({
 				node,
 				message: "Plain <img> ships unoptimized, oversized images to your users."
@@ -21305,12 +21475,22 @@ const PUBLIC_CLIENT_KEY_PATTERNS = [
 	/^public-token-(?:live|test)-/,
 	/^pk\.eyJ/
 ];
+const SECRET_UNAMBIGUOUS_PLACEHOLDER_VALUE_PATTERNS = [
+	/^[\s._\-*\u2022xX]{8,}$/,
+	/(?:\.{3,}|\u2026|[*\u2022]{3,})/,
+	/(?:^|[_\-\s])(?:your|redacted|masked|placeholder|replace[_\-\s]?me|changeme)(?:$|[_\-\s])/i,
+	/<[^>]*(?:auth|credential|key|password|secret|token|your|redacted|placeholder|masked)[^>]*>/i,
+	/\[[^\]]*(?:auth|credential|key|password|secret|token|your|redacted|placeholder|masked)[^\]]*\]/i,
+	/\{[^}]*(?:auth|credential|key|password|secret|token|your|redacted|placeholder|masked)[^}]*\}/i
+];
+const SECRET_CONTEXTUAL_PLACEHOLDER_VALUE_PATTERNS = [/(?:^|[_\-\s])(?:example|sample|dummy)(?:$|[_\-\s])/i];
+const SECRET_PLACEHOLDER_CONTEXT_PATTERN = /(?:placeholder|example|sample|dummy|masked|redacted|mask)/i;
 const SECRET_VARIABLE_PATTERN = /(?:api_?key|secret|token|password|credential|auth)/i;
 const SECRET_TOOLING_FILE_PATTERN = /(?:^|\/)[^/]+\.config\.[cm]?[jt]s$/;
 const SECRET_TOOLING_RC_FILE_PATTERN = /(?:^|\/)(?:\.[a-z-]+rc|[a-z-]+\.rc)\.[cm]?[jt]s$/;
 const SECRET_TEST_FILE_PATTERN = /(?:^|\/)[^/]+\.(?:test|spec|stories|story|fixture|fixtures)\.[cm]?[jt]sx?$/;
 const SECRET_SERVER_FILE_SUFFIX_PATTERN = /(?:^|\/)[^/]+\.server\.[cm]?[jt]sx?$/;
-const SECRET_SERVER_ENTRY_FILE_PATTERN = /(?:^|\/)(?:middleware|route)\.[cm]?[jt]sx?$/;
+const SECRET_SERVER_ENTRY_FILE_PATTERN = /(?:^|\/)(?:middleware|proxy|route)\.[cm]?[jt]sx?$/;
 const SECRET_NEXT_PAGES_API_FILE_PATTERN = /(?:^|\/)pages\/api\/.+\.[cm]?[jt]sx?$/;
 const SECRET_CLIENT_FILE_SUFFIX_PATTERN = /(?:^|\/)[^/]+\.(?:client|browser|web)\.[cm]?[jt]sx?$/;
 const SECRET_CLIENT_ENTRY_FILE_PATTERN = /(?:^|\/)(?:src\/)?(?:main|index|[Aa]pp|client)\.[cm]?[jt]sx?$/;
@@ -21590,6 +21770,15 @@ const isInsideServerOnlyScope = (node) => {
 	return false;
 };
 //#endregion
+//#region src/plugin/utils/is-placeholder-secret-value.ts
+const isPlaceholderSecretValue = (literalValue, options) => {
+	const trimmedValue = literalValue.trim();
+	if (trimmedValue.length === 0) return false;
+	if (SECRET_UNAMBIGUOUS_PLACEHOLDER_VALUE_PATTERNS.some((pattern) => pattern.test(trimmedValue))) return true;
+	if (!options.allowContextualExamples) return false;
+	return SECRET_CONTEXTUAL_PLACEHOLDER_VALUE_PATTERNS.some((pattern) => pattern.test(trimmedValue));
+};
+//#endregion
 //#region src/plugin/rules/security/no-secrets-in-client-code.ts
 const noSecretsInClientCode = defineRule({
 	id: "no-secrets-in-client-code",
@@ -21618,21 +21807,28 @@ const noSecretsInClientCode = defineRule({
 				if (!isNodeOfType(node.init, "Literal") || typeof node.init.value !== "string") return;
 				const variableName = node.id.name;
 				const literalValue = node.init.value;
+				const componentOrHookName = enclosingComponentOrHookName(node);
+				const hasPlaceholderContext = SECRET_PLACEHOLDER_CONTEXT_PATTERN.test(variableName) || componentOrHookName !== null && SECRET_PLACEHOLDER_CONTEXT_PATTERN.test(componentOrHookName);
+				const isUnambiguousPlaceholderValue = isPlaceholderSecretValue(literalValue, { allowContextualExamples: false });
+				const isPlaceholderValueForVariableHeuristic = isPlaceholderSecretValue(literalValue, { allowContextualExamples: hasPlaceholderContext });
 				if (PUBLIC_CLIENT_KEY_PATTERNS.some((pattern) => pattern.test(literalValue))) return;
+				if (SECRET_PATTERNS.some((pattern) => pattern.test(literalValue))) {
+					if (!isUnambiguousPlaceholderValue) context.report({
+						node,
+						message: "This hardcoded secret is a security vulnerability: it ships to the browser where anyone can read it."
+					});
+					return;
+				}
 				const isServerOnlyScope = isInsideServerOnlyScope(node);
 				const trailingSuffix = getIdentifierTrailingWord(variableName);
 				const isUiConstant = SECRET_FALSE_POSITIVE_SUFFIXES.has(trailingSuffix);
-				if (shouldUseVariableNameHeuristic && !isServerOnlyScope && SECRET_VARIABLE_PATTERN.test(variableName) && !isUiConstant && literalValue.length > 24) {
+				if (shouldUseVariableNameHeuristic && !isServerOnlyScope && SECRET_VARIABLE_PATTERN.test(variableName) && !isUiConstant && !isPlaceholderValueForVariableHeuristic && literalValue.length > 24) {
 					context.report({
 						node,
 						message: `Hardcoding "${variableName}" in client code is a security vulnerability: the secret ships to the browser where anyone can read it.`
 					});
 					return;
 				}
-				if (SECRET_PATTERNS.some((pattern) => pattern.test(literalValue))) context.report({
-					node,
-					message: "This hardcoded secret is a security vulnerability: it ships to the browser where anyone can read it."
-				});
 			}
 		};
 	}
@@ -23518,7 +23714,7 @@ const noUnknownProperty = defineRule({
 	create: (context) => {
 		const { ignore = [], requireDataLowercase = false } = resolveSettings$10(context.settings);
 		const ignoreSet = new Set(ignore);
-		if (isNextjsMetadataImageRouteFilename(context.filename)) ignoreSet.add("tw");
+		if (isGeneratedImageRenderContext(context)) ignoreSet.add("tw");
 		let fileIsNonReactJsx = false;
 		return {
 			Program(node) {
@@ -23553,6 +23749,7 @@ const noUnknownProperty = defineRule({
 					if (!isNodeOfType(attribute, "JSXAttribute")) continue;
 					const actualName = getJsxAttributeName(attribute.name);
 					if (!actualName) continue;
+					if (actualName === "tw" && isGeneratedImageRenderContext(context, node)) continue;
 					if (ignoreSet.has(actualName)) continue;
 					if (isValidDataAttribute(actualName)) {
 						if (requireDataLowercase && hasUppercaseChar(actualName)) context.report({
@@ -25174,12 +25371,12 @@ const doesFunctionReturnsObjectLiteral = (functionNode) => {
 			const child = nodeRecord[key];
 			if (Array.isArray(child)) for (const item of child) {
 				if (!isAstNode(item)) continue;
-				if (FUNCTION_LIKE_TYPES$1.has(item.type)) continue;
+				if (FUNCTION_LIKE_TYPES.has(item.type)) continue;
 				visit(item);
 				if (returnsObject) return;
 			}
 			else if (isAstNode(child)) {
-				if (FUNCTION_LIKE_TYPES$1.has(child.type)) continue;
+				if (FUNCTION_LIKE_TYPES.has(child.type)) continue;
 				visit(child);
 			}
 		}
@@ -26601,12 +26798,12 @@ const functionBodyHasReturnWithValue = (functionNode) => {
 			const child = nodeRecord[key];
 			if (Array.isArray(child)) for (const item of child) {
 				if (!isAstNode(item)) continue;
-				if (FUNCTION_LIKE_TYPES$1.has(item.type)) continue;
+				if (FUNCTION_LIKE_TYPES.has(item.type)) continue;
 				visit(item);
 				if (didFindReturn) return;
 			}
 			else if (isAstNode(child)) {
-				if (FUNCTION_LIKE_TYPES$1.has(child.type)) continue;
+				if (FUNCTION_LIKE_TYPES.has(child.type)) continue;
 				visit(child);
 			}
 		}
@@ -28356,7 +28553,7 @@ const isExpoUiNamespaceImport = (contextNode, localName) => {
 };
 const isExpoUiComponentElement = (openingElement, contextNode, componentName) => {
 	if (!openingElement.name) return false;
-	const dottedName = flattenJsxName(openingElement.name);
+	const dottedName = flattenJsxName$1(openingElement.name);
 	if (!dottedName) return false;
 	const [rootLocalName, secondName] = dottedName.split(".");
 	if (isNamedImportOf(contextNode, rootLocalName, componentName)) return true;
@@ -28446,7 +28643,7 @@ const collectTopLevelReturnExpressions = (functionNode) => {
 	if (!block || !isNodeOfType(block, "BlockStatement")) return [];
 	const returnExpressions = [];
 	const visit = (node) => {
-		if (FUNCTION_LIKE_TYPES$1.has(node.type)) return;
+		if (FUNCTION_LIKE_TYPES.has(node.type)) return;
 		if (isNodeOfType(node, "ReturnStatement") && node.argument) returnExpressions.push(node.argument);
 		const nodeRecord = node;
 		for (const fieldName of Object.keys(nodeRecord)) {
@@ -33285,7 +33482,7 @@ const objectExpressionHasNextRevalidate = (objectExpression) => {
 	}
 	return false;
 };
-const APP_ROUTER_FILE_PATTERN = /\/app\/(?:[^/]+\/)*(?:route|page|layout|template|loading|error|default)\.(?:tsx?|jsx?)$/;
+const APP_ROUTER_FILE_PATTERN = new RegExp(`/app/(?:[^/]+/)*(?:route|page|layout|template|loading|error|default)\\.${NEXTJS_SOURCE_FILE_EXTENSION_GROUP}$`);
 const NON_PROJECT_PATH_PATTERN = /\/(?:node_modules|dist|build|\.next)\//;
 const serverFetchWithoutRevalidate = defineRule({
 	id: "server-fetch-without-revalidate",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.4.2-dev.829655c",
+  "version": "0.4.2-dev.98066c2",
   "description": "oxlint plugin for React Doctor: diagnose React codebases for security, performance, correctness, accessibility, bundle-size, and architecture issues",
   "keywords": [
     "accessibility",