oxlint-plugin-react-doctor 0.5.8-dev.80e3093 → 0.5.8-dev.8232e96

package/dist/index.js

@@ -1160,6 +1160,61 @@ const isFirebaseRulesPath = (relativePath) => /(?:^|\/)(?:firestore\.rules|stora
 //#endregion
 //#region src/plugin/rules/security-scan/utils/strip-comments-preserving-positions.ts
 const WHITESPACE_PATTERN = /\s/;
+const IDENTIFIER_CHARACTER_PATTERN = /[\p{ID_Continue}$]/u;
+const REGEX_PRECEDING_KEYWORDS = new Set([
+	"return",
+	"typeof",
+	"case",
+	"in",
+	"of",
+	"new",
+	"delete",
+	"void",
+	"instanceof",
+	"do",
+	"else",
+	"yield",
+	"await",
+	"throw"
+]);
+const isRegexLiteralStart = (characters, slashIndex) => {
+	let cursor = slashIndex - 1;
+	while (cursor >= 0 && WHITESPACE_PATTERN.test(characters[cursor])) cursor -= 1;
+	if (cursor < 0) return true;
+	const previousCharacter = characters[cursor];
+	const characterBefore = cursor > 0 ? characters[cursor - 1] : "";
+	if (IDENTIFIER_CHARACTER_PATTERN.test(previousCharacter)) {
+		let wordStartIndex = cursor;
+		while (wordStartIndex > 0 && IDENTIFIER_CHARACTER_PATTERN.test(characters[wordStartIndex - 1])) wordStartIndex -= 1;
+		if (wordStartIndex > 0 && characters[wordStartIndex - 1] === ".") return false;
+		return REGEX_PRECEDING_KEYWORDS.has(characters.slice(wordStartIndex, cursor + 1).join(""));
+	}
+	if (previousCharacter === "<") return false;
+	if (previousCharacter === ">") return characterBefore === "=";
+	if (previousCharacter === "+" || previousCharacter === "-") return characterBefore !== previousCharacter;
+	if (previousCharacter === "!") return !(IDENTIFIER_CHARACTER_PATTERN.test(characterBefore) || characterBefore === ")" || characterBefore === "]");
+	return !(previousCharacter === ")" || previousCharacter === "]" || previousCharacter === "}" || previousCharacter === "\"" || previousCharacter === "'" || previousCharacter === "`");
+};
+const findRegexLiteralEnd = (content, slashIndex) => {
+	let cursor = slashIndex + 1;
+	let isInsideCharacterClass = false;
+	while (cursor < content.length) {
+		const character = content[cursor];
+		if (character === "\\") {
+			cursor += 2;
+			continue;
+		}
+		if (character === "\n") return null;
+		if (character === "[") isInsideCharacterClass = true;
+		else if (character === "]") isInsideCharacterClass = false;
+		else if (character === "/" && !isInsideCharacterClass) {
+			if (content[cursor + 1] === "/") return null;
+			return cursor + 1;
+		}
+		cursor += 1;
+	}
+	return null;
+};
 const quotedLiteralHasWhitespace = (content, openQuoteIndex, delimiter) => {
 	for (let cursor = openQuoteIndex + 1; cursor < content.length; cursor += 1) {
 		const character = content[cursor];
@@ -1193,6 +1248,11 @@ const blankNonCodePreservingPositions = (content, blankStringContents) => {
 				index += 2;
 				continue;
 			}
+			if (character === "\n" && stringDelimiter !== "`") {
+				stringDelimiter = null;
+				index += 1;
+				continue;
+			}
 			if (character === stringDelimiter) {
 				stringDelimiter = null;
 				index += 1;
@@ -1240,6 +1300,14 @@ const blankNonCodePreservingPositions = (content, blankStringContents) => {
 			}
 			continue;
 		}
+		if (character === "/") {
+			const regexEndIndex = isRegexLiteralStart(characters, index) ? findRegexLiteralEnd(content, index) : null;
+			if (regexEndIndex !== null) {
+				if (blankStringContents) for (let interiorIndex = index + 1; interiorIndex < regexEndIndex - 1; interiorIndex += 1) blankUnlessNewline(interiorIndex);
+				index = regexEndIndex;
+				continue;
+			}
+		}
 		if (templateExpressionDepths.length > 0) {
 			const innermost = templateExpressionDepths.length - 1;
 			if (character === "{") templateExpressionDepths[innermost] += 1;
@@ -2018,7 +2086,7 @@ const anchorAmbiguousText = defineRule({
 });
 //#endregion
 //#region src/plugin/rules/a11y/anchor-has-content.ts
-const MESSAGE$59 = "Blind users can't follow this link because screen readers announce nothing, so add visible text, `aria-label`, or `aria-labelledby`.";
+const MESSAGE$58 = "Blind users can't follow this link because screen readers announce nothing, so add visible text, `aria-label`, or `aria-labelledby`.";
 const anchorHasContent = defineRule({
 	id: "anchor-has-content",
 	title: "Anchor has no content",
@@ -2041,7 +2109,7 @@ const anchorHasContent = defineRule({
 			]) if (hasJsxPropIgnoreCase(opening.attributes, attribute)) return;
 			context.report({
 				node: opening.name,
-				message: MESSAGE$59
+				message: MESSAGE$58
 			});
 		} };
 	}
@@ -2427,7 +2495,7 @@ const parseJsxValue = (value) => {
 };
 //#endregion
 //#region src/plugin/rules/a11y/aria-activedescendant-has-tabindex.ts
-const MESSAGE$58 = "Keyboard users can't focus this element with `aria-activedescendant` because it isn't tabbable, so add `tabIndex={0}`.";
+const MESSAGE$57 = "Keyboard users can't focus this element with `aria-activedescendant` because it isn't tabbable, so add `tabIndex={0}`.";
 const ariaActivedescendantHasTabindex = defineRule({
 	id: "aria-activedescendant-has-tabindex",
 	title: "aria-activedescendant missing tabindex",
@@ -2445,14 +2513,14 @@ const ariaActivedescendantHasTabindex = defineRule({
 			if (tabIndexValue === null || tabIndexValue >= -1) return;
 			context.report({
 				node: node.name,
-				message: MESSAGE$58
+				message: MESSAGE$57
 			});
 			return;
 		}
 		if (isInteractiveElement(tag, node)) return;
 		context.report({
 			node: node.name,
-			message: MESSAGE$58
+			message: MESSAGE$57
 		});
 	} })
 });
@@ -4557,7 +4625,7 @@ const asyncParallel = defineRule({
 });
 //#endregion
 //#region src/plugin/rules/security/auth-token-in-web-storage.ts
-const MESSAGE$57 = "Storing an auth token in `localStorage`/`sessionStorage` exposes it to any XSS on the page: JavaScript can read web storage and exfiltrate the token. Keep tokens in an `HttpOnly`, `Secure`, `SameSite` cookie instead.";
+const MESSAGE$56 = "Storing an auth token in `localStorage`/`sessionStorage` exposes it to any XSS on the page: JavaScript can read web storage and exfiltrate the token. Keep tokens in an `HttpOnly`, `Secure`, `SameSite` cookie instead.";
 const STORAGE_NAMES = new Set(["localStorage", "sessionStorage"]);
 const STORAGE_GLOBALS = new Set([
 	"window",
@@ -4598,7 +4666,7 @@ const authTokenInWebStorage = defineRule({
 			if (!isAuthCredentialKey(keyArgument.value)) return;
 			context.report({
 				node,
-				message: MESSAGE$57
+				message: MESSAGE$56
 			});
 		},
 		AssignmentExpression(node) {
@@ -4609,7 +4677,7 @@ const authTokenInWebStorage = defineRule({
 			if (!propertyName || !isAuthCredentialKey(propertyName)) return;
 			context.report({
 				node: target,
-				message: MESSAGE$57
+				message: MESSAGE$56
 			});
 		}
 	}))
@@ -5099,7 +5167,7 @@ const isPureEventBlockerHandler = (attribute) => {
 };
 //#endregion
 //#region src/plugin/rules/a11y/click-events-have-key-events.ts
-const MESSAGE$56 = "Keyboard users can't trigger this click handler because there's no keyboard one, so add `onKeyUp`, `onKeyDown`, or `onKeyPress`.";
+const MESSAGE$55 = "Keyboard users can't trigger this click handler because there's no keyboard one, so add `onKeyUp`, `onKeyDown`, or `onKeyPress`.";
 const KEY_HANDLERS = [
 	"onKeyUp",
 	"onKeyDown",
@@ -5127,7 +5195,7 @@ const clickEventsHaveKeyEvents = defineRule({
 			if (KEY_HANDLERS.some((handler) => hasJsxPropIgnoreCase(node.attributes, handler))) return;
 			context.report({
 				node: node.name,
-				message: MESSAGE$56
+				message: MESSAGE$55
 			});
 		} };
 	}
@@ -5344,7 +5412,7 @@ const getClassNameLiteral = (classAttribute) => {
 };
 //#endregion
 //#region src/plugin/rules/a11y/control-has-associated-label.ts
-const MESSAGE$55 = "Blind users can't tell what this control does because screen readers find no label, so add visible text, `aria-label`, or `aria-labelledby`.";
+const MESSAGE$54 = "Blind users can't tell what this control does because screen readers find no label, so add visible text, `aria-label`, or `aria-labelledby`.";
 const DISPLAY_NONE_CLASS_TOKEN = "hidden";
 const isDisplayNoneClassToken = (token) => token.toLowerCase() === DISPLAY_NONE_CLASS_TOKEN;
 const collectStaticTemplateClassTokens = (templateLiteral) => {
@@ -5539,7 +5607,7 @@ const controlHasAssociatedLabel = defineRule({
 			for (const child of node.children) if (checkChildForLabel(child, 1, checkContext)) return;
 			context.report({
 				node: opening,
-				message: MESSAGE$55
+				message: MESSAGE$54
 			});
 		} };
 	}
@@ -5562,7 +5630,7 @@ const corsCookieTrustRisk = defineRule({
 const DANGEROUS_HTML_PATTERN = /dangerouslySetInnerHTML|\.(?:inner|outer)HTML\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\(|\bdocument\.write(?:ln)?\s*\(|\.(?:createContextualFragment|setHTMLUnsafe)\s*\(/;
 const HTML_VALUE_START_PATTERN = /(?:__html\s*:|\.(?:inner|outer)HTML\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\(\s*[^,]*,|\bdocument\.write(?:ln)?\s*\(|\.(?:createContextualFragment|setHTMLUnsafe)\s*\()\s*([\s\S]*)/;
 const HTML_TAINT_PATTERN = /searchParams|query|params|request|req\.|response\.|result\.|data\.|await|fetch|props\.|children|content|html|body|text|message|\blocation\b|document\.cookie|\breferrer\b|\blocalStorage\b|\bsessionStorage\b|URLSearchParams|window\.name/i;
-const STRING_LITERAL_VALUE_PATTERN = /^(?:["'][^"']*["']|`[^`$]*`)\s*(?:\/\/[^\n]*)?\s*(?:[;,})\n]|$)/;
+const STRING_LITERAL_VALUE_PATTERN = /^(?:"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'|`[^`$]*`)\s*(?:\/\/[^\n]*)?\s*(?:[;,})\n]|$)/;
 const MODULE_CONSTANT_VALUE_PATTERN = /^[A-Z][A-Z0-9_]*\s*(?:\/\/[^\n]*)?\s*(?:[;,})\n]|$)/;
 const DOM_CONTENT_SOURCE_VALUE_PATTERN = /^[\w$]+(?:\??\.[\w$]+)*\??\.(?:inner|outer)HTML\b/;
 const SANITIZER_PATTERN = /\b(?:DOMPurify|sanitize\w*|purify|(?:escape|encode)[A-Za-z]*(?:Html|HTML|Entit\w*)|insane|xss)\b|(?<!un)safe|(?<!un)saniti[sz]/i;
@@ -5994,7 +6062,7 @@ const noVagueButtonLabel = defineRule({
 });
 //#endregion
 //#region src/plugin/rules/a11y/dialog-has-accessible-name.ts
-const MESSAGE$54 = "This dialog has no accessible name, so screen readers announce it as just “dialog.” Add `aria-label` or point `aria-labelledby` at its heading.";
+const MESSAGE$53 = "This dialog has no accessible name, so screen readers announce it as just “dialog.” Add `aria-label` or point `aria-labelledby` at its heading.";
 const DIALOG_ROLES = new Set(["dialog", "alertdialog"]);
 const NAME_PROVIDING_ATTRIBUTES = [
 	"aria-label",
@@ -6017,7 +6085,7 @@ const dialogHasAccessibleName = defineRule({
 		if (NAME_PROVIDING_ATTRIBUTES.some((attribute) => hasJsxPropIgnoreCase(node.attributes, attribute))) return;
 		context.report({
 			node: node.name,
-			message: MESSAGE$54
+			message: MESSAGE$53
 		});
 	} })
 });
@@ -6056,7 +6124,7 @@ const isEs6Component = (node) => {
 };
 //#endregion
 //#region src/plugin/rules/react-builtins/display-name.ts
-const MESSAGE$53 = "This component shows up as Anonymous in React DevTools because it has no `displayName`.";
+const MESSAGE$52 = "This component shows up as Anonymous in React DevTools because it has no `displayName`.";
 const DEFAULT_ADDITIONAL_HOCS = [
 	"observer",
 	"lazy",
@@ -6259,7 +6327,7 @@ const displayName = defineRule({
 		const reportAt = (node) => {
 			context.report({
 				node,
-				message: MESSAGE$53
+				message: MESSAGE$52
 			});
 		};
 		return {
@@ -8423,7 +8491,7 @@ const forbidElements = defineRule({
 });
 //#endregion
 //#region src/plugin/rules/react-builtins/forward-ref-uses-ref.ts
-const MESSAGE$52 = "The parent can't reach this component's node because the `forwardRef` wrapper ignores `ref`.";
+const MESSAGE$51 = "The parent can't reach this component's node because the `forwardRef` wrapper ignores `ref`.";
 const forwardRefUsesRef = defineRule({
 	id: "forward-ref-uses-ref",
 	title: "forwardRef without ref parameter",
@@ -8443,7 +8511,7 @@ const forwardRefUsesRef = defineRule({
 		if (isNodeOfType(onlyParam, "RestElement")) return;
 		context.report({
 			node: inner,
-			message: MESSAGE$52
+			message: MESSAGE$51
 		});
 	} })
 });
@@ -8480,7 +8548,7 @@ const gitProviderUrlInjectionRisk = defineRule({
 });
 //#endregion
 //#region src/plugin/rules/a11y/heading-has-content.ts
-const MESSAGE$51 = "Blind users can't use this heading to navigate because screen readers skip it empty, so add text, `aria-label`, or `aria-labelledby`.";
+const MESSAGE$50 = "Blind users can't use this heading to navigate because screen readers skip it empty, so add text, `aria-label`, or `aria-labelledby`.";
 const DEFAULT_HEADING_TAGS = [
 	"h1",
 	"h2",
@@ -8514,7 +8582,7 @@ const headingHasContent = defineRule({
 			for (const attribute of ["aria-label", "aria-labelledby"]) if (hasJsxPropIgnoreCase(node.attributes, attribute)) return;
 			context.report({
 				node,
-				message: MESSAGE$51
+				message: MESSAGE$50
 			});
 		} };
 	}
@@ -8652,7 +8720,7 @@ const hooksNoNanInDeps = defineRule({
 });
 //#endregion
 //#region src/plugin/rules/a11y/html-has-lang.ts
-const MESSAGE$50 = "Screen readers may mispronounce this page because it doesn't declare a language, so add a `lang` attribute like `en`.";
+const MESSAGE$49 = "Screen readers may mispronounce this page because it doesn't declare a language, so add a `lang` attribute like `en`.";
 const resolveSettings$38 = (settings) => {
 	const reactDoctor = settings?.["react-doctor"];
 	return { htmlTags: (typeof reactDoctor === "object" && reactDoctor !== null ? reactDoctor.htmlHasLang ?? {} : {}).htmlTags ?? ["html"] };
@@ -8699,13 +8767,13 @@ const htmlHasLang = defineRule({
 			if (!lang) {
 				context.report({
 					node: node.name,
-					message: MESSAGE$50
+					message: MESSAGE$49
 				});
 				return;
 			}
 			if (evaluateLang(lang.value) === "empty") context.report({
 				node: lang,
-				message: MESSAGE$50
+				message: MESSAGE$49
 			});
 		} };
 	}
@@ -8925,7 +8993,7 @@ const htmlNoNestedInteractive = defineRule({
 });
 //#endregion
 //#region src/plugin/rules/a11y/iframe-has-title.ts
-const MESSAGE$49 = "Screen reader users cannot identify this `<iframe>` because it has no title. Add a `title` that describes its content.";
+const MESSAGE$48 = "Screen reader users cannot identify this `<iframe>` because it has no title. Add a `title` that describes its content.";
 const evaluateTitleValue = (value) => {
 	if (!value) return "missing";
 	if (isNodeOfType(value, "Literal")) {
@@ -8965,14 +9033,14 @@ const iframeHasTitle = defineRule({
 		if (!titleAttr) {
 			if (hasSpread || tag === "iframe") context.report({
 				node: node.name,
-				message: MESSAGE$49
+				message: MESSAGE$48
 			});
 			return;
 		}
 		const verdict = evaluateTitleValue(titleAttr.value);
 		if (verdict === "missing" || verdict === "empty") context.report({
 			node: titleAttr,
-			message: MESSAGE$49
+			message: MESSAGE$48
 		});
 	} })
 });
@@ -9087,7 +9155,7 @@ const iframeMissingSandbox = defineRule({
 });
 //#endregion
 //#region src/plugin/rules/a11y/img-redundant-alt.ts
-const MESSAGE$48 = "Screen reader users hear \"image\" or \"photo\" twice because they already announce it, so describe what the image shows instead.";
+const MESSAGE$47 = "Screen reader users hear \"image\" or \"photo\" twice because they already announce it, so describe what the image shows instead.";
 const DEFAULT_COMPONENTS = ["img"];
 const DEFAULT_REDUNDANT_WORDS = [
 	"image",
@@ -9152,7 +9220,7 @@ const imgRedundantAlt = defineRule({
 			if (!altAttribute) return;
 			if (altValueRedundant(altAttribute, settings.words)) context.report({
 				node: altAttribute,
-				message: MESSAGE$48
+				message: MESSAGE$47
 			});
 		} };
 	}
@@ -9191,7 +9259,7 @@ const DEPRECATED_CIPHER_API_PATTERN = /(?<!cipher\.)\bcreate(?:Cipher|Decipher)\
 const WEAK_CIPHER_ALGORITHM_PATTERN = /\bcreate(?:Cipher|Decipher)iv\s*\(\s*["'](?:des|des3|des-?ede3?|rc4|rc2|bf|blowfish)\b/i;
 const WEAK_CIPHER_NAME_PATTERN = /\b(?:DES|RC4|Blowfish)\b/;
 const CIPHER_CONTEXT_PATTERN = /\b(?:cipher|decipher|encrypt|decrypt|crypto)\b/i;
-const UNSAFE_SIGNATURE_COMPARISON_PATTERN = /[A-Za-z_$][\w$.]*signature[\w$]*(?:\([^)]*\))?\s*(?:===?|!==?)\s*[A-Za-z_$][\w$.]*(?:\([^)]*\))?|[A-Za-z_$][\w$.]*(?:\([^)]*\))?\s*(?:===?|!==?)\s*[A-Za-z_$][\w$.]*signature[\w$]*(?:\([^)]*\))?/i;
+const UNSAFE_SIGNATURE_COMPARISON_PATTERN = /[A-Za-z_$][\w$.]{0,100}signature[\w$]*(?:\([^)]*\))?\s*(?:===?|!==?)\s*[A-Za-z_$][\w$.]*(?:\([^)]*\))?|[A-Za-z_$][\w$.]{0,100}(?:\([^)]*\))?\s*(?:===?|!==?)\s*[A-Za-z_$][\w$.]{0,100}signature[\w$]*(?:\([^)]*\))?/i;
 const ENUM_MEMBER_COMPARAND_PATTERN = /(?:===?|!==?)\s*[A-Z](?:[a-z]|[A-Z0-9_]*\b(?!\s*[.(]))|^[A-Z](?:[a-z]|[A-Z0-9_]*\b(?!\s*[.(]))[\w$.]*(?:\([^)]*\))?\s*(?:===?|!==?)/;
 const SIGNATURE_METADATA_IDENTIFIER_PATTERN = /signature(?:Method|Type|Status|Algorithm|Kind|Mode|Version)\b/i;
 const BOOLEAN_COMPARAND_PATTERN = /(?:===?|!==?)\s*(?:true|false|null|undefined)\b/;
@@ -9231,17 +9299,18 @@ const insecureCryptoRisk = defineRule({
 		if (!isProductionSourcePath(file.relativePath)) return [];
 		if (DEMO_CONTEXT_PATTERN.test(file.relativePath)) return [];
 		if (PROTOCOL_MANDATED_HASH_CONTEXT_PATTERN.test(file.relativePath)) return [];
-		let matchIndex = findMatchIndexNearContext(file.content, WEAK_HASH_PATTERN, SECURITY_CONTEXT_PATTERN, PROTOCOL_MANDATED_HASH_CONTEXT_PATTERN);
-		if (matchIndex < 0) matchIndex = file.content.search(WEAK_CIPHER_ALGORITHM_PATTERN);
-		if (matchIndex < 0) matchIndex = file.content.search(DEPRECATED_CIPHER_API_PATTERN);
-		if (matchIndex < 0 && CIPHER_CONTEXT_PATTERN.test(file.content)) matchIndex = file.content.search(WEAK_CIPHER_NAME_PATTERN);
-		if (matchIndex < 0 && !TIMING_SAFE_COMPARISON_PATTERN.test(file.content) && !CLIENT_COMPONENT_FILE_PATTERN.test(file.relativePath)) {
-			const comparisonMatch = UNSAFE_SIGNATURE_COMPARISON_PATTERN.exec(file.content);
+		const content = getScannableContent(file);
+		let matchIndex = findMatchIndexNearContext(content, WEAK_HASH_PATTERN, SECURITY_CONTEXT_PATTERN, PROTOCOL_MANDATED_HASH_CONTEXT_PATTERN);
+		if (matchIndex < 0) matchIndex = content.search(WEAK_CIPHER_ALGORITHM_PATTERN);
+		if (matchIndex < 0) matchIndex = content.search(DEPRECATED_CIPHER_API_PATTERN);
+		if (matchIndex < 0 && CIPHER_CONTEXT_PATTERN.test(content)) matchIndex = content.search(WEAK_CIPHER_NAME_PATTERN);
+		if (matchIndex < 0 && !TIMING_SAFE_COMPARISON_PATTERN.test(content) && !CLIENT_COMPONENT_FILE_PATTERN.test(file.relativePath)) {
+			const comparisonMatch = UNSAFE_SIGNATURE_COMPARISON_PATTERN.exec(content);
 			if (comparisonMatch !== null && !ENUM_MEMBER_COMPARAND_PATTERN.test(comparisonMatch[0]) && !SIGNATURE_METADATA_IDENTIFIER_PATTERN.test(comparisonMatch[0]) && !BOOLEAN_COMPARAND_PATTERN.test(comparisonMatch[0])) matchIndex = comparisonMatch.index;
 		}
-		if (matchIndex < 0) matchIndex = findRandomCallIndexWithSameLineContext(file.content, MATH_RANDOM_CALL_PATTERN, SECURITY_RANDOM_CONTEXT_PATTERN, UI_NONCE_CONTEXT_PATTERN);
+		if (matchIndex < 0) matchIndex = findRandomCallIndexWithSameLineContext(content, MATH_RANDOM_CALL_PATTERN, SECURITY_RANDOM_CONTEXT_PATTERN, UI_NONCE_CONTEXT_PATTERN);
 		if (matchIndex < 0) return [];
-		const location = getLocationAtIndex(file.content, matchIndex);
+		const location = getLocationAtIndex(content, matchIndex);
 		return [{
 			message: "Code uses weak hashes, deprecated ciphers, timing-unsafe comparisons, or Math.random in a security-shaped context.",
 			line: location.line,
@@ -12131,7 +12200,7 @@ const jsxMaxDepth = defineRule({
 });
 //#endregion
 //#region src/plugin/rules/react-builtins/jsx-no-comment-textnodes.ts
-const MESSAGE$47 = "Your users see this comment as text on the page because `//` & `/*` aren't hidden in JSX.";
+const MESSAGE$46 = "Your users see this comment as text on the page because `//` & `/*` aren't hidden in JSX.";
 const LITERAL_TEXT_TAGS = new Set([
 	"code",
 	"pre",
@@ -12179,7 +12248,7 @@ const jsxNoCommentTextnodes = defineRule({
 		if (isInsideLiteralTextTag(node)) return;
 		context.report({
 			node,
-			message: MESSAGE$47
+			message: MESSAGE$46
 		});
 	} })
 });
@@ -12210,7 +12279,7 @@ const isInsideFunctionScope = (node) => {
 };
 //#endregion
 //#region src/plugin/rules/react-builtins/jsx-no-constructed-context-values.ts
-const MESSAGE$46 = "Every reader of this context redraws on each render because you build its `value` inline.";
+const MESSAGE$45 = "Every reader of this context redraws on each render because you build its `value` inline.";
 const CONTEXT_MODULES$1 = [
 	"react",
 	"use-context-selector",
@@ -12308,7 +12377,7 @@ const jsxNoConstructedContextValues = defineRule({
 					if (!isConstructedValue(innerExpression)) continue;
 					context.report({
 						node: attribute,
-						message: MESSAGE$46
+						message: MESSAGE$45
 					});
 				}
 			}
@@ -12392,7 +12461,8 @@ const isJsxAttributeOnIntrinsicHtmlElement = (attribute) => {
 };
 //#endregion
 //#region src/plugin/rules/react-builtins/jsx-no-jsx-as-prop.ts
-const MESSAGE$45 = "This child redraws every render because the prop gets brand new JSX each time.";
+const MESSAGE_MEMOISED = "This child redraws every render because the prop gets brand new JSX each time.";
+const MESSAGE_UNKNOWN = "If this child is memoized, it still redraws every render because the prop gets brand new JSX each time.";
 const KNOWN_SLOT_PROP_NAMES = new Set([
 	"icon",
 	"Icon",
@@ -12655,7 +12725,8 @@ const jsxNoJsxAsProp = defineRule({
 				if (isJsxAttributeOnIntrinsicHtmlElement(node)) return;
 				const parentJsxOpening = node.parent;
 				const openingName = parentJsxOpening && isNodeOfType(parentJsxOpening, "JSXOpeningElement") ? parentJsxOpening.name : null;
-				if (memoStatusForJsxOpeningName(memoRegistry, openingName) === "not-memoised") return;
+				const memoStatus = memoStatusForJsxOpeningName(memoRegistry, openingName);
+				if (memoStatus === "not-memoised") return;
 				if (isNodeOfType(node.name, "JSXIdentifier") && isSlotPropName(node.name.name)) return;
 				if (!isInsideFunctionScope(node)) return;
 				const value = node.value;
@@ -12666,7 +12737,7 @@ const jsxNoJsxAsProp = defineRule({
 				if (!isJsxProducingExpression(expressionNode) && !followsRenderLocalJsxBinding(expressionNode, node)) return;
 				context.report({
 					node,
-					message: MESSAGE$45
+					message: memoStatus === "memoised" ? MESSAGE_MEMOISED : MESSAGE_UNKNOWN
 				});
 			}
 		};
@@ -17946,19 +18017,108 @@ const isArrayFromLengthObjectCall = (node) => {
 	}
 	return false;
 };
-const isInsideStaticPlaceholderMap = (node) => {
+const TYPE_RESOLUTION_DEPTH_LIMIT = 4;
+const isStringKeywordAnnotation = (typeAnnotation) => Boolean(typeAnnotation && isNodeOfType(typeAnnotation, "TSTypeAnnotation") && isNodeOfType(typeAnnotation.typeAnnotation, "TSStringKeyword"));
+const findSameFileTypeDeclaration = (referenceNode, typeName) => {
+	const programRoot = findProgramRoot(referenceNode);
+	if (!programRoot || !isNodeOfType(programRoot, "Program")) return null;
+	for (const statement of programRoot.body) {
+		const declaration = isNodeOfType(statement, "ExportNamedDeclaration") ? statement.declaration : statement;
+		if (!declaration) continue;
+		if ((isNodeOfType(declaration, "TSInterfaceDeclaration") || isNodeOfType(declaration, "TSTypeAliasDeclaration")) && isNodeOfType(declaration.id, "Identifier") && declaration.id.name === typeName) return declaration;
+	}
+	return null;
+};
+const typeDeclaresStringProperty = (typeNode, propertyName, referenceNode, depth) => {
+	if (depth > TYPE_RESOLUTION_DEPTH_LIMIT) return false;
+	let members = null;
+	if (isNodeOfType(typeNode, "TSTypeLiteral")) members = typeNode.members;
+	else if (isNodeOfType(typeNode, "TSInterfaceDeclaration")) members = typeNode.body.body;
+	if (members) {
+		for (const member of members) {
+			if (!isNodeOfType(member, "TSPropertySignature")) continue;
+			if (!isNodeOfType(member.key, "Identifier") || member.key.name !== propertyName) continue;
+			return isStringKeywordAnnotation(member.typeAnnotation);
+		}
+		return false;
+	}
+	if (isNodeOfType(typeNode, "TSTypeAliasDeclaration")) return typeDeclaresStringProperty(typeNode.typeAnnotation, propertyName, referenceNode, depth + 1);
+	if (isNodeOfType(typeNode, "TSTypeReference") && isNodeOfType(typeNode.typeName, "Identifier")) {
+		const declaration = findSameFileTypeDeclaration(referenceNode, typeNode.typeName.name);
+		if (!declaration) return false;
+		return typeDeclaresStringProperty(declaration, propertyName, referenceNode, depth + 1);
+	}
+	return false;
+};
+const isDestructuredFromStringTypedPattern = (bindingIdentifier) => {
+	const property = bindingIdentifier.parent;
+	if (!property || !isNodeOfType(property, "Property")) return false;
+	if (!isNodeOfType(property.key, "Identifier")) return false;
+	const pattern = property.parent;
+	if (!pattern || !isNodeOfType(pattern, "ObjectPattern")) return false;
+	const typeAnnotation = pattern.typeAnnotation;
+	if (!typeAnnotation || !isNodeOfType(typeAnnotation, "TSTypeAnnotation")) return false;
+	return typeDeclaresStringProperty(typeAnnotation.typeAnnotation, property.key.name, bindingIdentifier, 0);
+};
+const isProvablyStringValued = (expression, depth) => {
+	if (depth > TYPE_RESOLUTION_DEPTH_LIMIT) return false;
+	const node = stripParenExpression(expression);
+	if (isNodeOfType(node, "Literal")) return typeof node.value === "string";
+	if (isNodeOfType(node, "TemplateLiteral")) return true;
+	if (isNodeOfType(node, "CallExpression") && isNodeOfType(node.callee, "Identifier") && node.callee.name === "String") return true;
+	if (isNodeOfType(node, "Identifier")) {
+		const binding = findVariableInitializer(node, node.name);
+		if (!binding) return false;
+		if (binding.initializer && isProvablyStringValued(binding.initializer, depth + 1)) return true;
+		if (isNodeOfType(binding.bindingIdentifier, "Identifier") && isStringKeywordAnnotation(binding.bindingIdentifier.typeAnnotation)) return true;
+		return isDestructuredFromStringTypedPattern(binding.bindingIdentifier);
+	}
+	return false;
+};
+const hasProvablyStringFirstArgument = (callNode) => {
+	if (!isNodeOfType(callNode, "CallExpression")) return false;
+	const source = callNode.arguments?.[0];
+	return Boolean(source && isProvablyStringValued(source, 0));
+};
+/**
+* `[...str]`, `str.split(...)`, and `Array.from(str)` slice ONE string
+* into positional fragments (characters, lines, tokens). Fragment
+* position IS the entry's stable identity — nothing reorders, filters,
+* or carries per-item state — so an index key is correct there.
+* `.split(...)` needs no string proof (only strings have `.split`);
+* the spread / `Array.from` forms do, because both are equally common
+* on arrays.
+*/
+const isStringDerivedReceiver = (receiver, depth = 0) => {
+	const node = stripParenExpression(receiver);
+	if (isNodeOfType(node, "Identifier")) {
+		if (depth >= TYPE_RESOLUTION_DEPTH_LIMIT) return false;
+		const binding = findVariableInitializer(node, node.name);
+		if (!binding?.initializer) return false;
+		return isStringDerivedReceiver(binding.initializer, depth + 1);
+	}
+	if (isNodeOfType(node, "ArrayExpression") && node.elements?.length === 1) {
+		const only = node.elements[0];
+		if (only && isNodeOfType(only, "SpreadElement")) return isProvablyStringValued(only.argument, 0);
+	}
+	if (isNodeOfType(node, "CallExpression") && isNodeOfType(node.callee, "MemberExpression") && isNodeOfType(node.callee.property, "Identifier") && node.callee.property.name === "split") return true;
+	return isArrayFromCall(node) && hasProvablyStringFirstArgument(node);
+};
+const isInsideIteratorMapMatching = (node, matchesMethodReceiver, matchesArrayFromCall) => {
 	let current = node;
 	while (current.parent) {
 		const parent = current.parent;
 		if (isFunctionLike$1(current) && isNodeOfType(parent, "CallExpression") && parent.arguments.includes(current)) {
 			const callee = parent.callee;
-			if (isNodeOfType(callee, "MemberExpression") && isNodeOfType(callee.property, "Identifier") && (callee.property.name === "map" || callee.property.name === "flatMap" || callee.property.name === "forEach")) return isStaticPlaceholderReceiver(callee.object);
-			if (isArrayFromCall(parent) && parent.arguments.length >= 2 && parent.arguments[1] === current) return isArrayFromLengthObjectCall(parent);
+			if (isNodeOfType(callee, "MemberExpression") && isNodeOfType(callee.property, "Identifier") && (callee.property.name === "map" || callee.property.name === "flatMap" || callee.property.name === "forEach")) return matchesMethodReceiver(callee.object);
+			if (isArrayFromCall(parent) && parent.arguments.length >= 2 && parent.arguments[1] === current) return matchesArrayFromCall(parent);
 		}
 		current = parent;
 	}
 	return false;
 };
+const isInsideStringDerivedMap = (node) => isInsideIteratorMapMatching(node, isStringDerivedReceiver, hasProvablyStringFirstArgument);
+const isInsideStaticPlaceholderMap = (node) => isInsideIteratorMapMatching(node, isStaticPlaceholderReceiver, isArrayFromLengthObjectCall);
 /**
 * Walk up from a JSXAttribute node looking for the enclosing iterator
 * callback (`.map(cb)`, `.flatMap(cb)`, `.forEach(cb)`, `Array.from(_, cb)`)
@@ -18014,6 +18174,7 @@ const noArrayIndexAsKey = defineRule({
 		const indexName = extractIndexName(node.value.expression);
 		if (!indexName) return;
 		if (isInsideStaticPlaceholderMap(node)) return;
+		if (isInsideStringDerivedMap(node)) return;
 		if (isCompositeKeyWithIteratorIdentity(node.value.expression, node)) return;
 		const openingElement = node.parent;
 		if (openingElement && isNodeOfType(openingElement, "JSXOpeningElement")) {
@@ -19851,6 +20012,25 @@ const countSetterCallSites = (ref) => {
 	}
 	return count;
 };
+const collectUpdaterParameterReads = (analysis, updaterFn) => {
+	const reads = [];
+	for (const ref of getDownstreamRefs(analysis, updaterFn.body)) if (ref.resolved?.defs.some((def) => def.type === "Parameter" && def.node === updaterFn)) reads.push(ref.identifier);
+	return reads;
+};
+const readsParameterOnlyViaObjectSpread = (parameterReads) => parameterReads.every((read) => {
+	const spread = read.parent;
+	if (!spread || !isNodeOfType(spread, "SpreadElement")) return false;
+	const container = spread.parent;
+	return Boolean(container && isNodeOfType(container, "ObjectExpression"));
+});
+const isAccumulatingFunctionalUpdater = (analysis, callExpr) => {
+	if (!isNodeOfType(callExpr, "CallExpression")) return false;
+	const firstArgument = callExpr.arguments?.[0];
+	if (!firstArgument || !isFunctionLike$1(firstArgument)) return false;
+	const parameterReads = collectUpdaterParameterReads(analysis, firstArgument);
+	if (parameterReads.length === 0) return false;
+	return !readsParameterOnlyViaObjectSpread(parameterReads);
+};
 const getStateNameForUseStateDecl = (useStateNode) => {
 	if (!useStateNode || !isNodeOfType(useStateNode, "VariableDeclarator")) return null;
 	if (!isNodeOfType(useStateNode.id, "ArrayPattern")) return null;
@@ -19885,6 +20065,7 @@ const noDerivedState = defineRule({
 			const depsUpstreamRefs = depsRefs.flatMap((depRef) => getUpstreamRefs(analysis, depRef));
 			if (isInitialOnlySetterCall(callExpr)) continue;
 			if (isControlledPropMirror(node, callExpr)) continue;
+			if (isAccumulatingFunctionalUpdater(analysis, callExpr)) continue;
 			const isSomeArgsInternal = argsUpstreamRefs.some((argRef) => isState(analysis, argRef) || isProp(analysis, argRef));
 			const isValueAlwaysInSync = argsUpstreamRefs.length > 0 && argsUpstreamRefs.every((argRef) => depsUpstreamRefs.some((depRef) => argRef.resolved === depRef.resolved)) && countSetterCallSites(ref) === 1;
 			if (isSomeArgsInternal) context.report({
@@ -30874,35 +31055,67 @@ const preferUseSyncExternalStore = defineRule({
 });
 //#endregion
 //#region src/plugin/rules/state-and-effects/prefer-use-reducer.ts
+const getSetterNameFromStatement = (statement, setterNames) => {
+	let expression = null;
+	if (isNodeOfType(statement, "ExpressionStatement")) expression = statement.expression;
+	else if (isNodeOfType(statement, "ReturnStatement")) expression = statement.argument;
+	if (!expression) return null;
+	const call = stripParenExpression(expression);
+	if (!isNodeOfType(call, "CallExpression")) return null;
+	if (!isNodeOfType(call.callee, "Identifier")) return null;
+	return setterNames.has(call.callee.name) ? call.callee.name : null;
+};
+const findLargestCoUpdatedSetterGroup = (componentBody, setterNames) => {
+	let largestGroupSize = 0;
+	const visit = (node, isInsideNestedFunction) => {
+		if (isNodeOfType(node, "BlockStatement") && isInsideNestedFunction) {
+			const groupSetterNames = /* @__PURE__ */ new Set();
+			for (const statement of node.body ?? []) {
+				const setterName = getSetterNameFromStatement(statement, setterNames);
+				if (setterName) groupSetterNames.add(setterName);
+			}
+			largestGroupSize = Math.max(largestGroupSize, groupSetterNames.size);
+		}
+		const enteringNestedFunction = isInsideNestedFunction || isFunctionLike$1(node);
+		const record = node;
+		for (const key of Object.keys(record)) {
+			if (key === "parent" || key === "type") continue;
+			const child = record[key];
+			if (Array.isArray(child)) {
+				for (const item of child) if (isAstNode(item)) visit(item, enteringNestedFunction);
+			} else if (isAstNode(child)) visit(child, enteringNestedFunction);
+		}
+	};
+	visit(componentBody, false);
+	return largestGroupSize;
+};
 const preferUseReducer = defineRule({
 	id: "prefer-useReducer",
 	title: "Many related useState calls",
 	tags: ["test-noise"],
 	severity: "warn",
-	recommendation: "Group related state in `useReducer` so one logical update does not fan out into separate renders.",
+	recommendation: "Group state that always changes together into `useReducer` so one dispatched action describes the whole transition instead of a list of setter calls.",
 	create: (context) => {
-		const reportExcessiveUseState = (body, componentName) => {
+		const reportCoUpdatedUseState = (body, componentName) => {
 			if (!isNodeOfType(body, "BlockStatement")) return;
-			let useStateCount = 0;
-			for (const statement of body.body ?? []) {
-				if (!isNodeOfType(statement, "VariableDeclaration")) continue;
-				for (const declarator of statement.declarations ?? []) if (declarator.init && isHookCall$1(declarator.init, "useState")) useStateCount++;
-			}
-			if (useStateCount >= 5) context.report({
+			const setterNames = new Set(collectUseStateBindings(body).map((binding) => binding.setterName));
+			if (setterNames.size < 5) return;
+			const coUpdatedCount = findLargestCoUpdatedSetterGroup(body, setterNames);
+			if (coUpdatedCount >= 5) context.report({
 				node: body,
-				message: `${useStateCount} useState calls in "${componentName}" can each trigger a separate render.`
+				message: `"${componentName}" updates ${coUpdatedCount} separate useState values in one place — state that changes together is easier to keep consistent as a single useReducer action.`
 			});
 		};
 		return {
 			FunctionDeclaration(node) {
 				if (!node.id?.name || !isUppercaseName(node.id.name)) return;
-				reportExcessiveUseState(node.body, node.id.name);
+				reportCoUpdatedUseState(node.body, node.id.name);
 			},
 			VariableDeclarator(node) {
 				if (!isComponentAssignment(node)) return;
 				if (!isNodeOfType(node.init, "ArrowFunctionExpression") && !isNodeOfType(node.init, "FunctionExpression")) return;
 				if (!isNodeOfType(node.id, "Identifier")) return;
-				reportExcessiveUseState(node.init.body, node.id.name);
+				reportCoUpdatedUseState(node.init.body, node.id.name);
 			}
 		};
 	}
@@ -34169,6 +34382,17 @@ const collectReturnedJsxRoots = (functionNode) => {
 	return roots;
 };
 const isChildrenForwardingJsxChild = (child, bindings) => isNodeOfType(child, "JSXExpressionContainer") && isChildrenValueExpression(child.expression, bindings);
+const fragmentChildrenOrNull = (child) => {
+	if (isNodeOfType(child, "JSXFragment")) return child.children ?? [];
+	if (isNodeOfType(child, "JSXElement") && isJsxFragmentElement(child.openingElement)) return child.children ?? [];
+	return null;
+};
+const isChildrenForwardingJsxChildThroughFragments = (child, bindings) => {
+	if (isChildrenForwardingJsxChild(child, bindings)) return true;
+	const fragmentChildren = fragmentChildrenOrNull(child);
+	if (fragmentChildren === null) return false;
+	return fragmentChildren.some((innerChild) => isChildrenForwardingJsxChildThroughFragments(innerChild, bindings));
+};
 const isChildrenForwardingAttribute = (attribute, bindings) => {
 	if (isNodeOfType(attribute, "JSXSpreadAttribute")) return isPropsObjectExpression(attribute.argument, bindings);
 	return isNodeOfType(attribute, "JSXAttribute") && isNodeOfType(attribute.name, "JSXIdentifier") && attribute.name.name === "children" && isNodeOfType(attribute.value, "JSXExpressionContainer") && isChildrenValueExpression(attribute.value.expression, bindings);
@@ -34180,7 +34404,7 @@ const jsxRootForwardsChildrenIntoText = (jsxRoot, bindings, isTextHandlingElemen
 		if (!isNodeOfType(node, "JSXElement")) return void 0;
 		const elementName = resolveJsxElementName(node.openingElement);
 		if (!elementName || !isTextHandlingElement(elementName)) return;
-		didForwardIntoText = (node.children ?? []).some((child) => isChildrenForwardingJsxChild(child, bindings)) || (node.openingElement.attributes ?? []).some((attribute) => isChildrenForwardingAttribute(attribute, bindings));
+		didForwardIntoText = (node.children ?? []).some((child) => isChildrenForwardingJsxChildThroughFragments(child, bindings)) || (node.openingElement.attributes ?? []).some((attribute) => isChildrenForwardingAttribute(attribute, bindings));
 	});
 	return didForwardIntoText;
 };
@@ -34198,7 +34422,7 @@ const jsxRootForwardsChildren = (jsxRoot, bindings, isTextHandlingElement, count
 				return;
 			}
 		}
-		if (countsAsForwardTarget(node) && (node.children ?? []).some((child) => isChildrenForwardingJsxChild(child, bindings))) didForward = true;
+		if (countsAsForwardTarget(node) && (node.children ?? []).some((child) => isChildrenForwardingJsxChildThroughFragments(child, bindings))) didForward = true;
 	});
 	return didForward;
 };
@@ -34276,14 +34500,13 @@ const recordWrapperFromDeclaration = (componentName, definitionNode, isTextHandl
 	if (kind === "text") wrappers.add(componentName);
 	else if (kind === "nonText") nonTextWrappers.add(componentName);
 };
-const MAX_TRANSITIVE_WRAPPER_PASSES = 3;
 const collectTextWrapperComponents = (programNode, isTextHandlingRoot, isNonTextHostRoot) => {
 	const wrappers = /* @__PURE__ */ new Set();
 	const nonTextWrappers = /* @__PURE__ */ new Set();
 	const isTextHandlingElement = (elementName) => isTextHandlingRoot(elementName) || wrappers.has(elementName);
 	const isNonTextHostElement = (elementName) => isNonTextHostRoot(elementName) || nonTextWrappers.has(elementName);
 	const recordDeclaration = (componentName, definitionNode) => recordWrapperFromDeclaration(componentName, definitionNode, isTextHandlingElement, isNonTextHostElement, wrappers, nonTextWrappers);
-	for (let pass = 0; pass < MAX_TRANSITIVE_WRAPPER_PASSES; pass += 1) {
+	while (true) {
 		const wrappersSizeBeforePass = wrappers.size;
 		const nonTextSizeBeforePass = nonTextWrappers.size;
 		walkAst(programNode, (node) => {
@@ -38965,7 +39188,7 @@ const isAuthGuardName = (calleeName) => {
 //#endregion
 //#region src/plugin/utils/is-non-privileged-server-action.ts
 const NON_DATA_EFFECT_FUNCTION_NAMES = new Set([...CACHE_REVALIDATION_FUNCTION_NAMES, ...NEXTJS_NAVIGATION_FUNCTIONS]);
-const isCacheOrNavigationCall = (node) => isNodeOfType(node, "CallExpression") && isNodeOfType(node.callee, "Identifier") && NON_DATA_EFFECT_FUNCTION_NAMES.has(node.callee.name);
+const isCacheOrNavigationCall = (node) => isNodeOfType(node, "CallExpression") && isNodeOfType(node.callee, "Identifier") && NON_DATA_EFFECT_FUNCTION_NAMES.has(node.callee.name) && getImportSourceForName(node, node.callee.name) !== null;
 const unwrapExpression = (node) => {
 	let current = node;
 	while (current) {
@@ -38990,6 +39213,7 @@ const isDataExposingValue = (node) => {
 const isLiteralOnlyExpression = (node) => {
 	if (!node) return false;
 	if (isNodeOfType(node, "Literal")) return true;
+	if (isNodeOfType(node, "Identifier")) return node.name === "undefined";
 	if (isNodeOfType(node, "TemplateLiteral")) return (node.expressions ?? []).every(isLiteralOnlyExpression);
 	if (isNodeOfType(node, "UnaryExpression")) return isLiteralOnlyExpression(node.argument);
 	if (isNodeOfType(node, "ArrayExpression")) return (node.elements ?? []).every((element) => element === null || !isNodeOfType(element, "SpreadElement") && isLiteralOnlyExpression(element));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.5.8-dev.80e3093",
+  "version": "0.5.8-dev.8232e96",
   "description": "React Doctor rules for oxlint.",
   "keywords": [
     "accessibility",