oxlint-plugin-react-doctor 0.5.8-dev.05cafc6 → 0.5.8-dev.0b64af5

package/dist/index.js

@@ -3,6 +3,48 @@ import * as fs from "node:fs";
 import { parseSync } from "oxc-parser";
 import { analyze } from "eslint-scope";
 import * as eslintVisitorKeys from "eslint-visitor-keys";
+//#region src/plugin/utils/has-type-property.ts
+const hasTypeProperty = (value) => Boolean(value && typeof value === "object" && "type" in value);
+//#endregion
+//#region src/plugin/utils/is-node-of-type.ts
+const isNodeOfType = (node, type) => Boolean(hasTypeProperty(node) && node.type === type);
+//#endregion
+//#region src/plugin/utils/non-react-jsx-dialect.ts
+const NON_REACT_JSX_DIALECT_PACKAGES = new Set([
+	"solid-js",
+	"solid-js/web",
+	"solid-js/store",
+	"solid-js/h",
+	"solid-js/html",
+	"@builder.io/qwik",
+	"@builder.io/qwik-city",
+	"@builder.io/qwik-react",
+	"voby",
+	"vidode"
+]);
+const NON_REACT_JSX_DIALECT_PACKAGE_PREFIXES = ["solid-js", "@builder.io/qwik"];
+const startsWithAny = (source, prefixes) => prefixes.some((prefix) => source === prefix || source.startsWith(`${prefix}/`));
+const fileImportsNonReactJsxDialect = (program) => {
+	for (const statement of program.body) {
+		if (!isNodeOfType(statement, "ImportDeclaration")) continue;
+		const source = statement.source;
+		const value = source && typeof source.value === "string" ? source.value : null;
+		if (!value) continue;
+		if (NON_REACT_JSX_DIALECT_PACKAGES.has(value)) return true;
+		if (startsWithAny(value, NON_REACT_JSX_DIALECT_PACKAGE_PREFIXES)) return true;
+	}
+	return false;
+};
+const jsxAttributeIsNonReactDialectMarker = (openingNode) => {
+	for (const attribute of openingNode.attributes) {
+		if (!isNodeOfType(attribute, "JSXAttribute")) continue;
+		if (!isNodeOfType(attribute.name, "JSXIdentifier")) continue;
+		if (attribute.name.name === "classList") return true;
+		if (attribute.name.name.startsWith("class:") || attribute.name.name.startsWith("bind:")) return true;
+	}
+	return false;
+};
+//#endregion
 //#region src/plugin/utils/is-testlike-filename.ts
 const NON_PRODUCTION_PATH_SEGMENTS = [
 	"/test/",
@@ -180,53 +222,10 @@ const isTestlikeFilename = (rawFilename) => {
 	return false;
 };
 //#endregion
-//#region src/plugin/utils/has-type-property.ts
-const hasTypeProperty = (value) => Boolean(value && typeof value === "object" && "type" in value);
-//#endregion
-//#region src/plugin/utils/is-node-of-type.ts
-const isNodeOfType = (node, type) => Boolean(hasTypeProperty(node) && node.type === type);
-//#endregion
-//#region src/plugin/utils/non-react-jsx-dialect.ts
-const NON_REACT_JSX_DIALECT_PACKAGES = new Set([
-	"solid-js",
-	"solid-js/web",
-	"solid-js/store",
-	"solid-js/h",
-	"solid-js/html",
-	"@builder.io/qwik",
-	"@builder.io/qwik-city",
-	"@builder.io/qwik-react",
-	"voby",
-	"vidode"
-]);
-const NON_REACT_JSX_DIALECT_PACKAGE_PREFIXES = ["solid-js", "@builder.io/qwik"];
-const startsWithAny = (source, prefixes) => prefixes.some((prefix) => source === prefix || source.startsWith(`${prefix}/`));
-const fileImportsNonReactJsxDialect = (program) => {
-	for (const statement of program.body) {
-		if (!isNodeOfType(statement, "ImportDeclaration")) continue;
-		const source = statement.source;
-		const value = source && typeof source.value === "string" ? source.value : null;
-		if (!value) continue;
-		if (NON_REACT_JSX_DIALECT_PACKAGES.has(value)) return true;
-		if (startsWithAny(value, NON_REACT_JSX_DIALECT_PACKAGE_PREFIXES)) return true;
-	}
-	return false;
-};
-const jsxAttributeIsNonReactDialectMarker = (openingNode) => {
-	for (const attribute of openingNode.attributes) {
-		if (!isNodeOfType(attribute, "JSXAttribute")) continue;
-		if (!isNodeOfType(attribute.name, "JSXIdentifier")) continue;
-		if (attribute.name.name === "classList") return true;
-		if (attribute.name.name.startsWith("class:") || attribute.name.name.startsWith("bind:")) return true;
-	}
-	return false;
-};
+//#region src/plugin/utils/skip-non-production-files.ts
+const skipNonProductionFiles = (create) => (context) => isTestlikeFilename(context.filename) ? {} : create(context);
 //#endregion
 //#region src/plugin/utils/define-rule.ts
-const wrapCreateForTestNoise = (create) => ((context) => {
-	if (isTestlikeFilename(context.filename)) return {};
-	return create(context);
-});
 const VISITOR_NODE_NAME_PATTERN = /^[A-Z]/;
 const wrapCreateForReactJsxOnly = (create) => ((context) => {
 	const innerVisitors = create(context);
@@ -273,7 +272,7 @@ const defineRule = (rule) => {
 	};
 	const tags = rule.tags;
 	let wrappedCreate = rule.create;
-	if (tags?.includes("test-noise") && !tags?.includes("migration-hint")) wrappedCreate = wrapCreateForTestNoise(wrappedCreate);
+	if (tags?.includes("test-noise") && !tags?.includes("migration-hint")) wrappedCreate = skipNonProductionFiles(wrappedCreate);
 	if (tags?.includes("react-jsx-only")) wrappedCreate = wrapCreateForReactJsxOnly(wrappedCreate);
 	if (wrappedCreate === rule.create) return rule;
 	return {
@@ -1176,6 +1175,20 @@ const getImportSourceForName = (contextNode, localIdentifierName) => {
 	if (!lookup) return null;
 	return lookup.get(localIdentifierName)?.source ?? null;
 };
+const getImportBindingForName = (contextNode, localIdentifierName) => {
+	const info = getImportLookup(contextNode)?.get(localIdentifierName);
+	if (!info) return null;
+	if (info.isNamespace) return {
+		source: info.source,
+		exportedName: null,
+		isNamespace: true
+	};
+	return {
+		source: info.source,
+		exportedName: info.isDefault ? "default" : info.imported,
+		isNamespace: false
+	};
+};
 //#endregion
 //#region src/plugin/utils/find-variable-initializer.ts
 const FUNCTION_LIKE_TYPES$1 = new Set([
@@ -1414,6 +1427,14 @@ const NEXTJS_NAVIGATION_FUNCTIONS = new Set([
 	"forbidden",
 	"unauthorized"
 ]);
+const CACHE_REVALIDATION_FUNCTION_NAMES = new Set([
+	"revalidateTag",
+	"revalidatePath",
+	"expireTag",
+	"expirePath",
+	"unstable_expireTag",
+	"unstable_expirePath"
+]);
 const GOOGLE_FONTS_PATTERN = /fonts\.googleapis\.com/;
 const POLYFILL_SCRIPT_PATTERN = /polyfill\.io|polyfill\.min\.js|cdn\.polyfill/;
 const APP_DIRECTORY_PATTERN = /\/app\//;
@@ -4349,7 +4370,7 @@ const authTokenInWebStorage = defineRule({
 	title: "Auth token in web storage",
 	severity: "warn",
 	recommendation: "Don't persist auth tokens (JWTs, access/refresh tokens, secrets) in `localStorage`/`sessionStorage`; they're readable by any XSS. Use an `HttpOnly` cookie set by the server.",
-	create: (context) => ({
+	create: skipNonProductionFiles((context) => ({
 		CallExpression(node) {
 			const callee = node.callee;
 			if (!isNodeOfType(callee, "MemberExpression") || callee.computed) return;
@@ -4374,7 +4395,7 @@ const authTokenInWebStorage = defineRule({
 				message: MESSAGE$57
 			});
 		}
-	})
+	}))
 });
 //#endregion
 //#region src/plugin/rules/a11y/autocomplete-valid.ts
@@ -6721,7 +6742,7 @@ const TRANSPARENT_WRAPPER_TYPES = new Set([
 	"ParenthesizedExpression",
 	"ChainExpression"
 ]);
-const unwrapExpression$1 = (node) => {
+const unwrapExpression$2 = (node) => {
 	let current = node;
 	while (TRANSPARENT_WRAPPER_TYPES.has(current.type)) {
 		const inner = current.expression;
@@ -6828,7 +6849,7 @@ const symbolHasStableHookOrigin = (symbol) => {
 	if (!declarator || !isNodeOfType(declarator, "VariableDeclarator")) return false;
 	const initializerRaw = declarator.init;
 	if (!initializerRaw) return false;
-	const initializer = unwrapExpression$1(initializerRaw);
+	const initializer = unwrapExpression$2(initializerRaw);
 	if (symbol.kind === "const") {
 		if (isNodeOfType(initializer, "Literal") && (initializer.value === null || typeof initializer.value === "number" || typeof initializer.value === "string" || typeof initializer.value === "boolean")) return true;
 		if (isNodeOfType(initializer, "TemplateLiteral") && getStaticTemplateLiteralValue(initializer) !== null) return true;
@@ -6848,13 +6869,13 @@ const symbolHasStableHookOrigin = (symbol) => {
 	return false;
 };
 const symbolHasUseEffectEventOrigin = (symbol) => {
-	const initializer = symbol.initializer ? unwrapExpression$1(symbol.initializer) : null;
+	const initializer = symbol.initializer ? unwrapExpression$2(symbol.initializer) : null;
 	if (!initializer || !isNodeOfType(initializer, "CallExpression")) return false;
 	return getHookName(initializer.callee) === "useEffectEvent";
 };
 const getFunctionValueNode = (symbol) => {
 	if (symbol.kind === "function" && isNodeOfType(symbol.declarationNode, "FunctionDeclaration")) return symbol.declarationNode;
-	const initializer = symbol.initializer ? unwrapExpression$1(symbol.initializer) : null;
+	const initializer = symbol.initializer ? unwrapExpression$2(symbol.initializer) : null;
 	if (initializer && (isNodeOfType(initializer, "FunctionExpression") || isNodeOfType(initializer, "ArrowFunctionExpression"))) return initializer;
 	return null;
 };
@@ -6990,23 +7011,23 @@ const computeDepKey = (reference) => {
 	return fullName;
 };
 const computeDeclaredDepKey = (entry) => {
-	const stripped = unwrapExpression$1(entry);
+	const stripped = unwrapExpression$2(entry);
 	if (isNodeOfType(stripped, "Identifier")) return stripped.name;
 	if (isNodeOfType(stripped, "MemberExpression")) return stringifyMemberChain(stripped);
 	return null;
 };
 const depsArrayContainsIdentifier = (depsArgument, identifierName) => {
 	if (!depsArgument) return false;
-	const strippedDepsArgument = unwrapExpression$1(depsArgument);
+	const strippedDepsArgument = unwrapExpression$2(depsArgument);
 	if (!isNodeOfType(strippedDepsArgument, "ArrayExpression")) return false;
 	return strippedDepsArgument.elements.some((element) => {
 		if (!element) return false;
-		const strippedElement = unwrapExpression$1(element);
+		const strippedElement = unwrapExpression$2(element);
 		return isNodeOfType(strippedElement, "Identifier") && strippedElement.name === identifierName;
 	});
 };
 const stringifyMemberChain = (node) => {
-	const stripped = unwrapExpression$1(node);
+	const stripped = unwrapExpression$2(node);
 	if (isNodeOfType(stripped, "Identifier")) return stripped.name;
 	if (isNodeOfType(stripped, "ThisExpression")) return "this";
 	if (isNodeOfType(stripped, "MemberExpression")) {
@@ -7048,13 +7069,13 @@ const hasBroaderDeclaredDependency = (declaredKey, declaredKeys) => {
 	return false;
 };
 const getMemberRootIdentifier = (node) => {
-	const stripped = unwrapExpression$1(node);
+	const stripped = unwrapExpression$2(node);
 	if (isNodeOfType(stripped, "Identifier")) return stripped;
 	if (isNodeOfType(stripped, "MemberExpression")) return getMemberRootIdentifier(stripped.object);
 	return null;
 };
 const hasComputedMemberExpression = (node) => {
-	const stripped = unwrapExpression$1(node);
+	const stripped = unwrapExpression$2(node);
 	if (!isNodeOfType(stripped, "MemberExpression")) return false;
 	if (stripped.computed) return true;
 	return hasComputedMemberExpression(stripped.object);
@@ -7075,7 +7096,7 @@ const isRegExpLiteral = (node) => {
 };
 const isUnstableInitializer = (node) => {
 	if (!node) return false;
-	const stripped = unwrapExpression$1(node);
+	const stripped = unwrapExpression$2(node);
 	if (isRegExpLiteral(stripped)) return true;
 	if (isNodeOfType(stripped, "ConditionalExpression")) return isUnstableInitializer(stripped.consequent) || isUnstableInitializer(stripped.alternate);
 	if (isNodeOfType(stripped, "LogicalExpression")) return isUnstableInitializer(stripped.left) || isUnstableInitializer(stripped.right);
@@ -7231,7 +7252,7 @@ const hasMemberCallForRoot = (node, rootName) => {
 	const visit = (current) => {
 		if (didFindMemberCall) return;
 		if (isNodeOfType(current, "CallExpression")) {
-			if (getMemberRootIdentifier(unwrapExpression$1(current.callee))?.name === rootName) {
+			if (getMemberRootIdentifier(unwrapExpression$2(current.callee))?.name === rootName) {
 				didFindMemberCall = true;
 				return;
 			}
@@ -7294,7 +7315,7 @@ If the missing value is recreated every render, move it inside the hook or stabi
 				return;
 			}
 			const depsArgumentRaw = node.arguments[depsArgumentIndex];
-			const callbackExpression = unwrapExpression$1(callbackArgument);
+			const callbackExpression = unwrapExpression$2(callbackArgument);
 			let callbackToAnalyze = null;
 			const forcedCaptureKeys = /* @__PURE__ */ new Set();
 			if (isNodeOfType(callbackExpression, "ArrowFunctionExpression") || isNodeOfType(callbackExpression, "FunctionExpression")) callbackToAnalyze = callbackExpression;
@@ -7302,7 +7323,7 @@ If the missing value is recreated every render, move it inside the hook or stabi
 				const callbackSymbol = context.scopes.symbolFor(callbackExpression);
 				const functionValueNode = callbackSymbol ? getFunctionValueNode(callbackSymbol) : null;
 				if (functionValueNode) callbackToAnalyze = functionValueNode;
-				else if (callbackSymbol?.initializer && isNodeOfType(unwrapExpression$1(callbackSymbol.initializer), "CallExpression")) forcedCaptureKeys.add(callbackExpression.name);
+				else if (callbackSymbol?.initializer && isNodeOfType(unwrapExpression$2(callbackSymbol.initializer), "CallExpression")) forcedCaptureKeys.add(callbackExpression.name);
 				else if (depsArgumentRaw) {
 					if (depsArrayContainsIdentifier(depsArgumentRaw, callbackExpression.name)) return;
 					context.report({
@@ -7359,7 +7380,7 @@ If the missing value is recreated every render, move it inside the hook or stabi
 				});
 				return;
 			}
-			const depsArgument = unwrapExpression$1(depsArgumentRaw);
+			const depsArgument = unwrapExpression$2(depsArgumentRaw);
 			if (isNodeOfType(depsArgument, "Literal") && depsArgument.value === null || isNodeOfType(depsArgument, "Identifier") && depsArgument.name === "undefined") {
 				if (isAutoDependenciesHook(hookName)) return;
 				if (HOOKS_REQUIRING_DEPS_ARRAY.has(hookName)) {
@@ -7400,11 +7421,11 @@ If the missing value is recreated every render, move it inside the hook or stabi
 			for (const forcedCaptureKey of forcedCaptureKeys) captureKeys.add(forcedCaptureKey);
 			const hasLiteralDepElement = depsArgument.elements.some((element) => {
 				if (!element) return false;
-				return isLiteralOrEmptyTemplate(unwrapExpression$1(element));
+				return isLiteralOrEmptyTemplate(unwrapExpression$2(element));
 			});
 			const hasNonStringLiteralDep = depsArgument.elements.some((element) => {
 				if (!element) return false;
-				return isNonStringLiteral(unwrapExpression$1(element));
+				return isNonStringLiteral(unwrapExpression$2(element));
 			});
 			if (hasNonStringLiteralDep) context.report({
 				node: depsArgument,
@@ -7425,7 +7446,7 @@ If the missing value is recreated every render, move it inside the hook or stabi
 					});
 					continue;
 				}
-				const stripped = unwrapExpression$1(elementNode);
+				const stripped = unwrapExpression$2(elementNode);
 				if (isLiteralOrEmptyTemplate(stripped)) continue;
 				if (isNodeOfType(stripped, "Identifier")) {
 					const depSymbol = context.scopes.symbolFor(stripped);
@@ -18946,7 +18967,7 @@ const noEval = defineRule({
 	title: "eval() runs untrusted code strings",
 	severity: "error",
 	recommendation: "Use `JSON.parse` for data, or rewrite the code so it doesn't build and run code from strings.",
-	create: (context) => ({
+	create: skipNonProductionFiles((context) => ({
 		CallExpression(node) {
 			if (isNodeOfType(node.callee, "Identifier") && node.callee.name === "eval") {
 				context.report({
@@ -18966,7 +18987,7 @@ const noEval = defineRule({
 				message: "new Function() is a code-injection vulnerability: it builds & runs code from a string."
 			});
 		}
-	})
+	}))
 });
 //#endregion
 //#region src/plugin/rules/state-and-effects/no-event-handler.ts
@@ -27020,7 +27041,7 @@ const preferHtmlDialog = defineRule({
 });
 //#endregion
 //#region src/plugin/utils/function-returns-object-literal.ts
-const unwrapExpression = (node) => {
+const unwrapExpression$1 = (node) => {
 	let current = node;
 	for (;;) {
 		if ((current.type === "TSAsExpression" || current.type === "TSSatisfiesExpression" || current.type === "TSNonNullExpression") && "expression" in current && isAstNode(current.expression)) {
@@ -27033,7 +27054,7 @@ const unwrapExpression = (node) => {
 const doesFunctionReturnsObjectLiteral = (functionNode) => {
 	if (functionNode.type === "ArrowFunctionExpression" && "body" in functionNode) {
 		const body = functionNode.body;
-		if (body && body.type !== "BlockStatement") return unwrapExpression(body).type === "ObjectExpression";
+		if (body && body.type !== "BlockStatement") return unwrapExpression$1(body).type === "ObjectExpression";
 	}
 	const body = functionNode.body;
 	if (!body || body.type !== "BlockStatement") return false;
@@ -27041,7 +27062,7 @@ const doesFunctionReturnsObjectLiteral = (functionNode) => {
 	const visit = (node) => {
 		if (returnsObject) return;
 		if (node.type === "ReturnStatement" && "argument" in node && node.argument != null) {
-			if (unwrapExpression(node.argument).type === "ObjectExpression") returnsObject = true;
+			if (unwrapExpression$1(node.argument).type === "ObjectExpression") returnsObject = true;
 			return;
 		}
 		const nodeRecord = node;
@@ -29473,6 +29494,19 @@ const REACT_NATIVE_TEXT_COMPONENTS = new Set([
 	"H5",
 	"H6"
 ]);
+const REACT_NATIVE_RAW_TEXT_HOST_COMPONENTS = new Set([
+	"View",
+	"ScrollView",
+	"SafeAreaView",
+	"KeyboardAvoidingView",
+	"ImageBackground",
+	"Modal",
+	"Pressable",
+	"TouchableOpacity",
+	"TouchableHighlight",
+	"TouchableWithoutFeedback",
+	"TouchableNativeFeedback"
+]);
 const REACT_NATIVE_TEXT_COMPONENT_KEYWORDS = new Set([
 	"Text",
 	"Title",
@@ -29485,7 +29519,11 @@ const REACT_NATIVE_TEXT_COMPONENT_KEYWORDS = new Set([
 	"Description",
 	"Body"
 ]);
-const REACT_NATIVE_TEXT_TRANSPARENT_COMPONENTS = new Set(["fbt", "fbs"]);
+const REACT_NATIVE_TEXT_TRANSPARENT_COMPONENTS = new Set([
+	"Fragment",
+	"fbt",
+	"fbs"
+]);
 const DEPRECATED_RN_MODULE_REPLACEMENTS = new Map([
 	["AsyncStorage", "@react-native-async-storage/async-storage"],
 	["Picker", "@react-native-picker/picker"],
@@ -30443,23 +30481,29 @@ const jsxRootForwardsChildrenIntoText = (jsxRoot, bindings, isTextHandlingElemen
 	return didForwardIntoText;
 };
 const isMeaningfulJsxChild = (child) => !isNodeOfType(child, "JSXText") || Boolean(child.value?.trim());
-const jsxRootRendersChildrenOutsideText = (jsxRoot, bindings, isTextHandlingElement) => {
-	let didRenderOutsideText = false;
+const jsxRootForwardsChildren = (jsxRoot, bindings, isTextHandlingElement, countsAsForwardTarget) => {
+	let didForward = false;
 	walkAst(jsxRoot, (node) => {
-		if (didRenderOutsideText || isFunctionNode(node)) return false;
+		if (didForward || isFunctionNode(node)) return false;
 		if (!isNodeOfType(node, "JSXElement") && !isNodeOfType(node, "JSXFragment")) return;
 		if (isNodeOfType(node, "JSXElement")) {
 			const elementName = resolveJsxElementName(node.openingElement);
 			if (elementName && isTextHandlingElement(elementName)) return false;
-			if (!(node.children ?? []).some(isMeaningfulJsxChild) && (node.openingElement.attributes ?? []).some((attribute) => isChildrenForwardingAttribute(attribute, bindings))) {
-				didRenderOutsideText = true;
+			if (!(node.children ?? []).some(isMeaningfulJsxChild) && countsAsForwardTarget(node) && (node.openingElement.attributes ?? []).some((attribute) => isChildrenForwardingAttribute(attribute, bindings))) {
+				didForward = true;
 				return;
 			}
 		}
-		didRenderOutsideText = (node.children ?? []).some((child) => isChildrenForwardingJsxChild(child, bindings));
+		if (countsAsForwardTarget(node) && (node.children ?? []).some((child) => isChildrenForwardingJsxChild(child, bindings))) didForward = true;
 	});
-	return didRenderOutsideText;
+	return didForward;
 };
+const jsxRootRendersChildrenOutsideText = (jsxRoot, bindings, isTextHandlingElement) => jsxRootForwardsChildren(jsxRoot, bindings, isTextHandlingElement, () => true);
+const jsxRootRendersChildrenIntoNonTextHost = (jsxRoot, bindings, isTextHandlingElement, isNonTextHostElement) => jsxRootForwardsChildren(jsxRoot, bindings, isTextHandlingElement, (node) => {
+	if (!isNodeOfType(node, "JSXElement")) return false;
+	const elementName = resolveJsxElementName(node.openingElement);
+	return elementName !== null && isNonTextHostElement(elementName);
+});
 const resolveStyledFactoryBaseName = (definitionNode) => {
 	let current = stripParenExpression(definitionNode);
 	while (current) {
@@ -30496,49 +30540,71 @@ const resolveClassRenderFunction = (classNode) => {
 	}
 	return null;
 };
-const recordWrapperFromDeclaration = (componentName, definitionNode, isTextHandlingElement, wrappers) => {
-	if (!componentName || !isReactComponentName(componentName)) return;
-	if (wrappers.has(componentName)) return;
-	if (!definitionNode) return;
+const classifyChildrenForwarding = (definitionNode, isTextHandlingElement, isNonTextHostElement) => {
 	const unwrapped = unwrapComponentDefinition(definitionNode);
 	const styledBaseName = resolveStyledFactoryBaseName(unwrapped);
-	if (styledBaseName && isTextHandlingElement(styledBaseName)) {
-		wrappers.add(componentName);
-		return;
+	if (styledBaseName) {
+		if (isTextHandlingElement(styledBaseName)) return "text";
+		if (isNonTextHostElement(styledBaseName)) return "nonText";
+		return "unknown";
 	}
 	const functionNode = resolveClassRenderFunction(unwrapped) ?? (isFunctionNode(unwrapped) ? unwrapped : null);
-	if (!functionNode) return;
+	if (!functionNode) return "unknown";
 	const bindings = resolveParamChildrenBindings(functionNode);
 	collectChildrenAliases(functionNode, bindings);
 	const jsxRoots = collectReturnedJsxRoots(functionNode);
-	if (jsxRoots.some((jsxRoot) => jsxRootRendersChildrenOutsideText(jsxRoot, bindings, isTextHandlingElement))) return;
+	if (jsxRoots.some((jsxRoot) => jsxRootRendersChildrenIntoNonTextHost(jsxRoot, bindings, isTextHandlingElement, isNonTextHostElement))) return "nonText";
+	if (jsxRoots.some((jsxRoot) => jsxRootRendersChildrenOutsideText(jsxRoot, bindings, isTextHandlingElement))) return "unknown";
 	for (const jsxRoot of jsxRoots) {
 		if (isNodeOfType(jsxRoot, "JSXElement")) {
 			const rootName = resolveJsxElementName(jsxRoot.openingElement);
-			if (rootName && isTextHandlingElement(rootName)) {
-				wrappers.add(componentName);
-				return;
-			}
-		}
-		if (jsxRootForwardsChildrenIntoText(jsxRoot, bindings, isTextHandlingElement)) {
-			wrappers.add(componentName);
-			return;
+			if (rootName && isTextHandlingElement(rootName)) return "text";
 		}
+		if (jsxRootForwardsChildrenIntoText(jsxRoot, bindings, isTextHandlingElement)) return "text";
 	}
+	return "unknown";
+};
+const recordWrapperFromDeclaration = (componentName, definitionNode, isTextHandlingElement, isNonTextHostElement, wrappers, nonTextWrappers) => {
+	if (!componentName || !isReactComponentName(componentName)) return;
+	if (wrappers.has(componentName)) return;
+	if (!definitionNode) return;
+	const kind = classifyChildrenForwarding(definitionNode, isTextHandlingElement, isNonTextHostElement);
+	if (kind === "text") wrappers.add(componentName);
+	else if (kind === "nonText") nonTextWrappers.add(componentName);
 };
 const MAX_TRANSITIVE_WRAPPER_PASSES = 3;
-const collectTextWrapperComponents = (programNode, isTextHandlingRoot) => {
+const collectTextWrapperComponents = (programNode, isTextHandlingRoot, isNonTextHostRoot) => {
 	const wrappers = /* @__PURE__ */ new Set();
+	const nonTextWrappers = /* @__PURE__ */ new Set();
 	const isTextHandlingElement = (elementName) => isTextHandlingRoot(elementName) || wrappers.has(elementName);
+	const isNonTextHostElement = (elementName) => isNonTextHostRoot(elementName) || nonTextWrappers.has(elementName);
+	const recordDeclaration = (componentName, definitionNode) => recordWrapperFromDeclaration(componentName, definitionNode, isTextHandlingElement, isNonTextHostElement, wrappers, nonTextWrappers);
 	for (let pass = 0; pass < MAX_TRANSITIVE_WRAPPER_PASSES; pass += 1) {
-		const sizeBeforePass = wrappers.size;
+		const wrappersSizeBeforePass = wrappers.size;
+		const nonTextSizeBeforePass = nonTextWrappers.size;
 		walkAst(programNode, (node) => {
-			if (isNodeOfType(node, "VariableDeclarator")) recordWrapperFromDeclaration(node.id && isNodeOfType(node.id, "Identifier") ? node.id.name : null, node.init, isTextHandlingElement, wrappers);
-			else if (isNodeOfType(node, "FunctionDeclaration") || isNodeOfType(node, "ClassDeclaration")) recordWrapperFromDeclaration(node.id && isNodeOfType(node.id, "Identifier") ? node.id.name : null, node, isTextHandlingElement, wrappers);
+			if (isNodeOfType(node, "VariableDeclarator")) recordDeclaration(node.id && isNodeOfType(node.id, "Identifier") ? node.id.name : null, node.init ?? null);
+			else if (isNodeOfType(node, "FunctionDeclaration") || isNodeOfType(node, "ClassDeclaration")) recordDeclaration(node.id && isNodeOfType(node.id, "Identifier") ? node.id.name : null, node);
 		});
-		if (wrappers.size === sizeBeforePass) break;
+		if (wrappers.size === wrappersSizeBeforePass && nonTextWrappers.size === nonTextSizeBeforePass) break;
 	}
-	return wrappers;
+	for (const wrapperName of wrappers) nonTextWrappers.delete(wrapperName);
+	return {
+		textWrappers: wrappers,
+		nonTextWrappers
+	};
+};
+//#endregion
+//#region src/plugin/rules/react-native/utils/resolve-imported-component-forwarding.ts
+const resolveImportedComponentForwarding = (contextNode, fromFilename, localName, isTextHandlingRoot, isNonTextHostRoot) => {
+	const binding = getImportBindingForName(contextNode, localName);
+	if (!binding || binding.isNamespace || binding.exportedName === null) return null;
+	const resolvedNode = resolveCrossFileFunctionExport(fromFilename, binding.source, binding.exportedName);
+	if (!resolvedNode) return null;
+	const moduleProgram = findProgramRoot(resolvedNode);
+	if (moduleProgram === null) return classifyChildrenForwarding(resolvedNode, isTextHandlingRoot, isNonTextHostRoot);
+	const { textWrappers, nonTextWrappers } = collectTextWrapperComponents(moduleProgram, isTextHandlingRoot, isNonTextHostRoot);
+	return classifyChildrenForwarding(resolvedNode, (elementName) => isTextHandlingRoot(elementName) || textWrappers.has(elementName), (elementName) => isNonTextHostRoot(elementName) || nonTextWrappers.has(elementName));
 };
 //#endregion
 //#region src/plugin/rules/react-native/utils/is-expo-ui-component-element.ts
@@ -30609,19 +30675,37 @@ const rnNoRawText = defineRule({
 	recommendation: "Text outside a `<Text>` component crashes on React Native. Wrap it like `<Text>{value}</Text>`.",
 	create: (context) => {
 		let isDomComponentFile = false;
-		let autoDetectedWrappers = /* @__PURE__ */ new Set();
+		let autoDetectedTextWrappers = /* @__PURE__ */ new Set();
+		let autoDetectedNonTextWrappers = /* @__PURE__ */ new Set();
+		const isNonTextHostName = (elementName) => !isReactComponentName(elementName) || REACT_NATIVE_RAW_TEXT_HOST_COMPONENTS.has(elementName);
+		const isRawTextReportTarget = (elementName) => elementName !== null && (isNonTextHostName(elementName) || autoDetectedNonTextWrappers.has(elementName));
+		const importedNonTextWrapperCache = /* @__PURE__ */ new Map();
+		const isImportedNonTextWrapper = (elementName, contextNode) => {
+			if (elementName === null || !isReactComponentName(elementName)) return false;
+			const { filename } = context;
+			if (filename === void 0) return false;
+			const cached = importedNonTextWrapperCache.get(elementName);
+			if (cached !== void 0) return cached;
+			const isNonTextWrapper = resolveImportedComponentForwarding(contextNode, filename, elementName, isTextHandlingComponent, isNonTextHostName) === "nonText";
+			importedNonTextWrapperCache.set(elementName, isNonTextWrapper);
+			return isNonTextWrapper;
+		};
 		return {
 			Program(programNode) {
 				isDomComponentFile = hasDirective(programNode, "use dom");
-				autoDetectedWrappers = collectTextWrapperComponents(programNode, isTextHandlingComponent);
+				const childrenForwarding = collectTextWrapperComponents(programNode, isTextHandlingComponent, isNonTextHostName);
+				autoDetectedTextWrappers = childrenForwarding.textWrappers;
+				autoDetectedNonTextWrappers = childrenForwarding.nonTextWrappers;
 			},
 			JSXElement(node) {
 				if (isDomComponentFile) return;
 				const elementName = resolveTextBoundaryName(node.openingElement);
-				if (elementName && (isTextHandlingComponent(elementName) || autoDetectedWrappers.has(elementName))) return;
+				if (elementName && (isTextHandlingComponent(elementName) || autoDetectedTextWrappers.has(elementName))) return;
 				if (isExpoUiComponentElement(node.openingElement, node, "ListItem")) return;
 				if (isInsidePlatformOsWebBranch(node)) return;
 				if (isTransparentTextWrapper(elementName) && isInsideTextHandlingComponent(node)) return;
+				if (!(node.children ?? []).some(isRawTextContent)) return;
+				if (!isRawTextReportTarget(elementName) && !isImportedNonTextWrapper(elementName, node)) return;
 				for (const child of node.children ?? []) {
 					if (!isRawTextContent(child)) continue;
 					context.report({
@@ -35165,6 +35249,67 @@ const isAuthGuardName = (calleeName) => {
 	return false;
 };
 //#endregion
+//#region src/plugin/utils/is-non-privileged-server-action.ts
+const NON_DATA_EFFECT_FUNCTION_NAMES = new Set([...CACHE_REVALIDATION_FUNCTION_NAMES, ...NEXTJS_NAVIGATION_FUNCTIONS]);
+const isCacheOrNavigationCall = (node) => isNodeOfType(node, "CallExpression") && isNodeOfType(node.callee, "Identifier") && NON_DATA_EFFECT_FUNCTION_NAMES.has(node.callee.name);
+const unwrapExpression = (node) => {
+	let current = node;
+	while (current) {
+		if (isNodeOfType(current, "TSAsExpression") || isNodeOfType(current, "TSNonNullExpression") || isNodeOfType(current, "TSSatisfiesExpression") || isNodeOfType(current, "ChainExpression")) {
+			current = current.expression;
+			continue;
+		}
+		if (isNodeOfType(current, "SequenceExpression")) {
+			current = current.expressions?.[current.expressions.length - 1];
+			continue;
+		}
+		return current;
+	}
+	return null;
+};
+const isDataExposingValue = (node) => {
+	const value = unwrapExpression(node);
+	if (!value) return false;
+	if (isCacheOrNavigationCall(value)) return false;
+	return !isLiteralOnlyExpression(value);
+};
+const isLiteralOnlyExpression = (node) => {
+	if (!node) return false;
+	if (isNodeOfType(node, "Literal")) return true;
+	if (isNodeOfType(node, "TemplateLiteral")) return (node.expressions ?? []).every(isLiteralOnlyExpression);
+	if (isNodeOfType(node, "UnaryExpression")) return isLiteralOnlyExpression(node.argument);
+	if (isNodeOfType(node, "ArrayExpression")) return (node.elements ?? []).every((element) => element === null || !isNodeOfType(element, "SpreadElement") && isLiteralOnlyExpression(element));
+	if (isNodeOfType(node, "ObjectExpression")) return (node.properties ?? []).every((property) => isNodeOfType(property, "Property") && (!property.computed || isLiteralOnlyExpression(property.key)) && isLiteralOnlyExpression(property.value));
+	return false;
+};
+const getReturnedOrThrownArgument = (node) => {
+	if (isNodeOfType(node, "ReturnStatement")) return node.argument ?? null;
+	if (isNodeOfType(node, "ThrowStatement")) return node.argument ?? null;
+	return null;
+};
+const isDataExposingReturnOrThrow = (node) => isDataExposingValue(getReturnedOrThrownArgument(node));
+const isPrivilegedEffect = (node) => isNodeOfType(node, "CallExpression") || isNodeOfType(node, "TaggedTemplateExpression") || isNodeOfType(node, "NewExpression") || isNodeOfType(node, "AssignmentExpression") || isNodeOfType(node, "UpdateExpression") || isNodeOfType(node, "UnaryExpression") && node.operator === "delete" || isDataExposingReturnOrThrow(node);
+const isNonPrivilegedServerAction = (functionNode) => {
+	const functionBody = functionNode.body;
+	if (!functionBody) return false;
+	if (!isNodeOfType(functionBody, "BlockStatement") && isDataExposingValue(functionBody)) return false;
+	let hasNonDataEffectCall = false;
+	let hasPrivilegedEffect = false;
+	walkAst(functionBody, (child) => {
+		if (hasPrivilegedEffect) return false;
+		if (child !== functionBody && isFunctionLike$2(child)) return false;
+		if (isCacheOrNavigationCall(child)) {
+			hasNonDataEffectCall = true;
+			return;
+		}
+		if (isPrivilegedEffect(child)) {
+			hasPrivilegedEffect = true;
+			return false;
+		}
+	});
+	return hasNonDataEffectCall && !hasPrivilegedEffect;
+};
+//#endregion
 //#region src/plugin/rules/server/server-auth-actions.ts
 const isAsyncFunctionLikeNode = (node) => {
 	if (!node) return false;
@@ -35239,6 +35384,7 @@ const getAuthScanRoots = (functionNode) => {
 const inspectServerAction = (candidate, fileHasUseServerDirective, allowedFunctionNames, context) => {
 	if (!(fileHasUseServerDirective || hasUseServerDirective(candidate.functionNode))) return;
 	if (containsAuthCheck(getAuthScanRoots(candidate.functionNode), allowedFunctionNames, GENERIC_AUTH_METHOD_NAMES)) return;
+	if (isNonPrivilegedServerAction(candidate.functionNode)) return;
 	context.report({
 		node: candidate.reportNode,
 		message: `Anyone can call server action "${candidate.displayName}" without logging in, since it has no auth check.`
@@ -35864,22 +36010,6 @@ const isSupabaseMigrationPath = (relativePath) => /(?:^|\/)supabase\/(?:migratio
 //#endregion
 //#region src/plugin/rules/security-scan/utils/is-sql-path.ts
 const isSqlPath = (relativePath) => relativePath.endsWith(".sql") || isSupabaseMigrationPath(relativePath);
-const supabaseRlsPolicyRisk = defineRule({
-	id: "supabase-rls-policy-risk",
-	title: "Permissive Supabase RLS policy",
-	severity: "error",
-	recommendation: "Keep public-read policies explicit, but gate inserts, updates, deletes, and service-role bypasses behind `auth.uid()` plus trusted tenant membership.",
-	scan: scanByPattern({
-		shouldScan: (file) => isSqlPath(file.relativePath),
-		pattern: [
-			/disable\s+row\s+level\s+security/i,
-			/create\s+policy[\s\S]{0,700}auth\.role\(\)\s*=\s*["']service_role["']/i,
-			/create\s+policy[\s\S]{0,700}\bfor\s+(?:all|insert|update|delete)\b[\s\S]{0,500}\b(?:using|with\s+check)\s*\(\s*true\s*\)/i,
-			/create\s+policy(?:(?!\bfor\s+select\b)[\s\S]){0,700}\b(?:using|with\s+check)\s*\(\s*true\s*\)/i
-		],
-		message: "Supabase policy SQL disables RLS, permits writes broadly, or references a service-role bypass."
-	})
-});
 //#endregion
 //#region src/plugin/rules/security-scan/utils/sanitize-sql-for-scan.ts
 const DOLLAR_QUOTE_TAG_PATTERN = /^\$[A-Za-z_]?\w*\$/;
@@ -36056,6 +36186,60 @@ const sanitizeSqlForScan = (content) => {
 	return characters.join("");
 };
 //#endregion
+//#region src/plugin/rules/security-scan/supabase-rls-policy-risk.ts
+const DISABLED_RLS_PATTERN = /disable\s+row\s+level\s+security/i;
+const SERVICE_ROLE_BODY_BYPASS_PATTERN = /auth\.role\(\)\s*=\s*["']service_role["']/i;
+const CREATE_POLICY_PATTERN = /create\s+policy/gi;
+const STATEMENT_END_PATTERN = /;|create\s+policy/i;
+const PERMISSIVE_TRUE_PATTERN = /\b(?:using|with\s+check)\s*\(\s*true\s*\)/i;
+const FOR_SELECT_PATTERN = /\bfor\s+select\b/i;
+const TO_CLAUSE_PATTERN = /\bto\s+([\s\S]+?)(?=\s+(?:using|with\s+check|as|for)\b|;|$)/i;
+const SERVER_ONLY_ROLES = new Set([
+	"service_role",
+	"postgres",
+	"supabase_admin"
+]);
+const isServerOnlyScoped = (statement) => {
+	const toClause = TO_CLAUSE_PATTERN.exec(statement);
+	if (toClause === null) return false;
+	const roles = toClause[1].split(",").map((role) => role.trim().replace(/["'`]/g, "").toLowerCase()).filter(Boolean);
+	return roles.length > 0 && roles.every((role) => SERVER_ONLY_ROLES.has(role));
+};
+const isRiskyPolicyStatement = (statement, rawStatement) => {
+	if (SERVICE_ROLE_BODY_BYPASS_PATTERN.test(rawStatement)) return true;
+	if (!PERMISSIVE_TRUE_PATTERN.test(statement)) return false;
+	if (FOR_SELECT_PATTERN.test(statement)) return false;
+	return !isServerOnlyScoped(statement);
+};
+const POLICY_RISK_MESSAGE = "Supabase policy SQL disables RLS, permits writes broadly, or references a service-role bypass.";
+const supabaseRlsPolicyRisk = defineRule({
+	id: "supabase-rls-policy-risk",
+	title: "Permissive Supabase RLS policy",
+	severity: "error",
+	recommendation: "Keep public-read policies explicit, but gate inserts, updates, deletes, and service-role bypasses behind `auth.uid()` plus trusted tenant membership.",
+	scan: (file) => {
+		if (!isSqlPath(file.relativePath)) return [];
+		const content = sanitizeSqlForScan(file.content);
+		let earliestRiskIndex = content.search(DISABLED_RLS_PATTERN);
+		CREATE_POLICY_PATTERN.lastIndex = 0;
+		for (let policyMatch = CREATE_POLICY_PATTERN.exec(content); policyMatch !== null; policyMatch = CREATE_POLICY_PATTERN.exec(content)) {
+			const afterKeyword = policyMatch.index + policyMatch[0].length;
+			const terminatorOffset = content.slice(afterKeyword).search(STATEMENT_END_PATTERN);
+			const statementEnd = terminatorOffset < 0 ? content.length : afterKeyword + terminatorOffset;
+			if (!isRiskyPolicyStatement(content.slice(policyMatch.index, statementEnd), file.content.slice(policyMatch.index, statementEnd))) continue;
+			if (earliestRiskIndex < 0 || policyMatch.index < earliestRiskIndex) earliestRiskIndex = policyMatch.index;
+			break;
+		}
+		if (earliestRiskIndex < 0) return [];
+		const { line, column } = getLocationAtIndex(content, earliestRiskIndex);
+		return [{
+			message: POLICY_RISK_MESSAGE,
+			line,
+			column
+		}];
+	}
+});
+//#endregion
 //#region src/plugin/rules/security-scan/supabase-table-missing-rls.ts
 const CREATE_PUBLIC_TABLE_PATTERN = /create\s+(?:unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?(?!(?:auth|storage|realtime|vault|extensions|graphql|graphql_public|pgbouncer|net|supabase_functions|supabase_migrations|cron|pgsodium|pgmq|information_schema|pg_catalog|pg_temp|private|internal)\s*\.)(?:public\s*\.\s*)?["`]?([A-Za-z_][\w$]*)["`]?(?:\s*\(|\s+as\b)/gi;
 const enableRlsForTablePattern = (tableName) => new RegExp(`alter\\s+table\\s+(?:if\\s+exists\\s+)?(?:only\\s+)?(?:public\\s*\\.\\s*)?["\`]?${escapeRegExp(tableName)}["\`]?\\s+(?:force\\s+)?enable\\s+row\\s+level\\s+security`, "i");
@@ -42546,6 +42730,7 @@ const CROSS_FILE_RULE_IDS = new Set([
 	"nextjs-missing-metadata",
 	"nextjs-no-use-search-params-without-suspense",
 	"no-mutating-reducer-state",
+	"rn-no-raw-text",
 	"rn-prefer-expo-image"
 ]);
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.5.8-dev.05cafc6",
+  "version": "0.5.8-dev.0b64af5",
   "description": "React Doctor rules for oxlint.",
   "keywords": [
     "accessibility",