oxlint-plugin-react-doctor 0.5.8-dev.ea00b1b → 0.5.8-dev.f028d8b

package/LICENSE

@@ -1,4 +1,4 @@
-MIT License
+Modified MIT License
 
 Copyright (c) 2026 Million Software, Inc.
 
@@ -19,3 +19,16 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+Our only modification is that the following uses require prior written
+permission from the copyright holder. To request permission, contact
+founders@million.dev.
+
+1. Using the Software, its source code, or any derivative works thereof, in
+   whole or in part, as training, fine-tuning, or evaluation data, or as input
+   to any automated pipeline for training or improving any machine learning
+   model or AI system.
+
+2. Selling the Software, or offering it to third parties as a paid, hosted, or
+   managed product or service (including any commercial API or SaaS offering)
+   whose value derives entirely or substantially from the Software.

package/dist/index.js

@@ -3,6 +3,48 @@ import * as fs from "node:fs";
 import { parseSync } from "oxc-parser";
 import { analyze } from "eslint-scope";
 import * as eslintVisitorKeys from "eslint-visitor-keys";
+//#region src/plugin/utils/has-type-property.ts
+const hasTypeProperty = (value) => Boolean(value && typeof value === "object" && "type" in value);
+//#endregion
+//#region src/plugin/utils/is-node-of-type.ts
+const isNodeOfType = (node, type) => Boolean(hasTypeProperty(node) && node.type === type);
+//#endregion
+//#region src/plugin/utils/non-react-jsx-dialect.ts
+const NON_REACT_JSX_DIALECT_PACKAGES = new Set([
+	"solid-js",
+	"solid-js/web",
+	"solid-js/store",
+	"solid-js/h",
+	"solid-js/html",
+	"@builder.io/qwik",
+	"@builder.io/qwik-city",
+	"@builder.io/qwik-react",
+	"voby",
+	"vidode"
+]);
+const NON_REACT_JSX_DIALECT_PACKAGE_PREFIXES = ["solid-js", "@builder.io/qwik"];
+const startsWithAny = (source, prefixes) => prefixes.some((prefix) => source === prefix || source.startsWith(`${prefix}/`));
+const fileImportsNonReactJsxDialect = (program) => {
+	for (const statement of program.body) {
+		if (!isNodeOfType(statement, "ImportDeclaration")) continue;
+		const source = statement.source;
+		const value = source && typeof source.value === "string" ? source.value : null;
+		if (!value) continue;
+		if (NON_REACT_JSX_DIALECT_PACKAGES.has(value)) return true;
+		if (startsWithAny(value, NON_REACT_JSX_DIALECT_PACKAGE_PREFIXES)) return true;
+	}
+	return false;
+};
+const jsxAttributeIsNonReactDialectMarker = (openingNode) => {
+	for (const attribute of openingNode.attributes) {
+		if (!isNodeOfType(attribute, "JSXAttribute")) continue;
+		if (!isNodeOfType(attribute.name, "JSXIdentifier")) continue;
+		if (attribute.name.name === "classList") return true;
+		if (attribute.name.name.startsWith("class:") || attribute.name.name.startsWith("bind:")) return true;
+	}
+	return false;
+};
+//#endregion
 //#region src/plugin/utils/is-testlike-filename.ts
 const NON_PRODUCTION_PATH_SEGMENTS = [
 	"/test/",
@@ -180,53 +222,10 @@ const isTestlikeFilename = (rawFilename) => {
 	return false;
 };
 //#endregion
-//#region src/plugin/utils/has-type-property.ts
-const hasTypeProperty = (value) => Boolean(value && typeof value === "object" && "type" in value);
-//#endregion
-//#region src/plugin/utils/is-node-of-type.ts
-const isNodeOfType = (node, type) => Boolean(hasTypeProperty(node) && node.type === type);
-//#endregion
-//#region src/plugin/utils/non-react-jsx-dialect.ts
-const NON_REACT_JSX_DIALECT_PACKAGES = new Set([
-	"solid-js",
-	"solid-js/web",
-	"solid-js/store",
-	"solid-js/h",
-	"solid-js/html",
-	"@builder.io/qwik",
-	"@builder.io/qwik-city",
-	"@builder.io/qwik-react",
-	"voby",
-	"vidode"
-]);
-const NON_REACT_JSX_DIALECT_PACKAGE_PREFIXES = ["solid-js", "@builder.io/qwik"];
-const startsWithAny = (source, prefixes) => prefixes.some((prefix) => source === prefix || source.startsWith(`${prefix}/`));
-const fileImportsNonReactJsxDialect = (program) => {
-	for (const statement of program.body) {
-		if (!isNodeOfType(statement, "ImportDeclaration")) continue;
-		const source = statement.source;
-		const value = source && typeof source.value === "string" ? source.value : null;
-		if (!value) continue;
-		if (NON_REACT_JSX_DIALECT_PACKAGES.has(value)) return true;
-		if (startsWithAny(value, NON_REACT_JSX_DIALECT_PACKAGE_PREFIXES)) return true;
-	}
-	return false;
-};
-const jsxAttributeIsNonReactDialectMarker = (openingNode) => {
-	for (const attribute of openingNode.attributes) {
-		if (!isNodeOfType(attribute, "JSXAttribute")) continue;
-		if (!isNodeOfType(attribute.name, "JSXIdentifier")) continue;
-		if (attribute.name.name === "classList") return true;
-		if (attribute.name.name.startsWith("class:") || attribute.name.name.startsWith("bind:")) return true;
-	}
-	return false;
-};
+//#region src/plugin/utils/skip-non-production-files.ts
+const skipNonProductionFiles = (create) => (context) => isTestlikeFilename(context.filename) ? {} : create(context);
 //#endregion
 //#region src/plugin/utils/define-rule.ts
-const wrapCreateForTestNoise = (create) => ((context) => {
-	if (isTestlikeFilename(context.filename)) return {};
-	return create(context);
-});
 const VISITOR_NODE_NAME_PATTERN = /^[A-Z]/;
 const wrapCreateForReactJsxOnly = (create) => ((context) => {
 	const innerVisitors = create(context);
@@ -273,7 +272,7 @@ const defineRule = (rule) => {
 	};
 	const tags = rule.tags;
 	let wrappedCreate = rule.create;
-	if (tags?.includes("test-noise") && !tags?.includes("migration-hint")) wrappedCreate = wrapCreateForTestNoise(wrappedCreate);
+	if (tags?.includes("test-noise") && !tags?.includes("migration-hint")) wrappedCreate = skipNonProductionFiles(wrappedCreate);
 	if (tags?.includes("react-jsx-only")) wrappedCreate = wrapCreateForReactJsxOnly(wrappedCreate);
 	if (wrappedCreate === rule.create) return rule;
 	return {
@@ -1176,6 +1175,20 @@ const getImportSourceForName = (contextNode, localIdentifierName) => {
 	if (!lookup) return null;
 	return lookup.get(localIdentifierName)?.source ?? null;
 };
+const getImportBindingForName = (contextNode, localIdentifierName) => {
+	const info = getImportLookup(contextNode)?.get(localIdentifierName);
+	if (!info) return null;
+	if (info.isNamespace) return {
+		source: info.source,
+		exportedName: null,
+		isNamespace: true
+	};
+	return {
+		source: info.source,
+		exportedName: info.isDefault ? "default" : info.imported,
+		isNamespace: false
+	};
+};
 //#endregion
 //#region src/plugin/utils/find-variable-initializer.ts
 const FUNCTION_LIKE_TYPES$1 = new Set([
@@ -1414,6 +1427,14 @@ const NEXTJS_NAVIGATION_FUNCTIONS = new Set([
 	"forbidden",
 	"unauthorized"
 ]);
+const CACHE_REVALIDATION_FUNCTION_NAMES = new Set([
+	"revalidateTag",
+	"revalidatePath",
+	"expireTag",
+	"expirePath",
+	"unstable_expireTag",
+	"unstable_expirePath"
+]);
 const GOOGLE_FONTS_PATTERN = /fonts\.googleapis\.com/;
 const POLYFILL_SCRIPT_PATTERN = /polyfill\.io|polyfill\.min\.js|cdn\.polyfill/;
 const APP_DIRECTORY_PATTERN = /\/app\//;
@@ -4349,7 +4370,7 @@ const authTokenInWebStorage = defineRule({
 	title: "Auth token in web storage",
 	severity: "warn",
 	recommendation: "Don't persist auth tokens (JWTs, access/refresh tokens, secrets) in `localStorage`/`sessionStorage`; they're readable by any XSS. Use an `HttpOnly` cookie set by the server.",
-	create: (context) => ({
+	create: skipNonProductionFiles((context) => ({
 		CallExpression(node) {
 			const callee = node.callee;
 			if (!isNodeOfType(callee, "MemberExpression") || callee.computed) return;
@@ -4374,7 +4395,7 @@ const authTokenInWebStorage = defineRule({
 				message: MESSAGE$57
 			});
 		}
-	})
+	}))
 });
 //#endregion
 //#region src/plugin/rules/a11y/autocomplete-valid.ts
@@ -6721,7 +6742,7 @@ const TRANSPARENT_WRAPPER_TYPES = new Set([
 	"ParenthesizedExpression",
 	"ChainExpression"
 ]);
-const unwrapExpression$1 = (node) => {
+const unwrapExpression$2 = (node) => {
 	let current = node;
 	while (TRANSPARENT_WRAPPER_TYPES.has(current.type)) {
 		const inner = current.expression;
@@ -6828,7 +6849,7 @@ const symbolHasStableHookOrigin = (symbol) => {
 	if (!declarator || !isNodeOfType(declarator, "VariableDeclarator")) return false;
 	const initializerRaw = declarator.init;
 	if (!initializerRaw) return false;
-	const initializer = unwrapExpression$1(initializerRaw);
+	const initializer = unwrapExpression$2(initializerRaw);
 	if (symbol.kind === "const") {
 		if (isNodeOfType(initializer, "Literal") && (initializer.value === null || typeof initializer.value === "number" || typeof initializer.value === "string" || typeof initializer.value === "boolean")) return true;
 		if (isNodeOfType(initializer, "TemplateLiteral") && getStaticTemplateLiteralValue(initializer) !== null) return true;
@@ -6848,13 +6869,13 @@ const symbolHasStableHookOrigin = (symbol) => {
 	return false;
 };
 const symbolHasUseEffectEventOrigin = (symbol) => {
-	const initializer = symbol.initializer ? unwrapExpression$1(symbol.initializer) : null;
+	const initializer = symbol.initializer ? unwrapExpression$2(symbol.initializer) : null;
 	if (!initializer || !isNodeOfType(initializer, "CallExpression")) return false;
 	return getHookName(initializer.callee) === "useEffectEvent";
 };
 const getFunctionValueNode = (symbol) => {
 	if (symbol.kind === "function" && isNodeOfType(symbol.declarationNode, "FunctionDeclaration")) return symbol.declarationNode;
-	const initializer = symbol.initializer ? unwrapExpression$1(symbol.initializer) : null;
+	const initializer = symbol.initializer ? unwrapExpression$2(symbol.initializer) : null;
 	if (initializer && (isNodeOfType(initializer, "FunctionExpression") || isNodeOfType(initializer, "ArrowFunctionExpression"))) return initializer;
 	return null;
 };
@@ -6990,23 +7011,23 @@ const computeDepKey = (reference) => {
 	return fullName;
 };
 const computeDeclaredDepKey = (entry) => {
-	const stripped = unwrapExpression$1(entry);
+	const stripped = unwrapExpression$2(entry);
 	if (isNodeOfType(stripped, "Identifier")) return stripped.name;
 	if (isNodeOfType(stripped, "MemberExpression")) return stringifyMemberChain(stripped);
 	return null;
 };
 const depsArrayContainsIdentifier = (depsArgument, identifierName) => {
 	if (!depsArgument) return false;
-	const strippedDepsArgument = unwrapExpression$1(depsArgument);
+	const strippedDepsArgument = unwrapExpression$2(depsArgument);
 	if (!isNodeOfType(strippedDepsArgument, "ArrayExpression")) return false;
 	return strippedDepsArgument.elements.some((element) => {
 		if (!element) return false;
-		const strippedElement = unwrapExpression$1(element);
+		const strippedElement = unwrapExpression$2(element);
 		return isNodeOfType(strippedElement, "Identifier") && strippedElement.name === identifierName;
 	});
 };
 const stringifyMemberChain = (node) => {
-	const stripped = unwrapExpression$1(node);
+	const stripped = unwrapExpression$2(node);
 	if (isNodeOfType(stripped, "Identifier")) return stripped.name;
 	if (isNodeOfType(stripped, "ThisExpression")) return "this";
 	if (isNodeOfType(stripped, "MemberExpression")) {
@@ -7048,13 +7069,13 @@ const hasBroaderDeclaredDependency = (declaredKey, declaredKeys) => {
 	return false;
 };
 const getMemberRootIdentifier = (node) => {
-	const stripped = unwrapExpression$1(node);
+	const stripped = unwrapExpression$2(node);
 	if (isNodeOfType(stripped, "Identifier")) return stripped;
 	if (isNodeOfType(stripped, "MemberExpression")) return getMemberRootIdentifier(stripped.object);
 	return null;
 };
 const hasComputedMemberExpression = (node) => {
-	const stripped = unwrapExpression$1(node);
+	const stripped = unwrapExpression$2(node);
 	if (!isNodeOfType(stripped, "MemberExpression")) return false;
 	if (stripped.computed) return true;
 	return hasComputedMemberExpression(stripped.object);
@@ -7075,7 +7096,7 @@ const isRegExpLiteral = (node) => {
 };
 const isUnstableInitializer = (node) => {
 	if (!node) return false;
-	const stripped = unwrapExpression$1(node);
+	const stripped = unwrapExpression$2(node);
 	if (isRegExpLiteral(stripped)) return true;
 	if (isNodeOfType(stripped, "ConditionalExpression")) return isUnstableInitializer(stripped.consequent) || isUnstableInitializer(stripped.alternate);
 	if (isNodeOfType(stripped, "LogicalExpression")) return isUnstableInitializer(stripped.left) || isUnstableInitializer(stripped.right);
@@ -7231,7 +7252,7 @@ const hasMemberCallForRoot = (node, rootName) => {
 	const visit = (current) => {
 		if (didFindMemberCall) return;
 		if (isNodeOfType(current, "CallExpression")) {
-			if (getMemberRootIdentifier(unwrapExpression$1(current.callee))?.name === rootName) {
+			if (getMemberRootIdentifier(unwrapExpression$2(current.callee))?.name === rootName) {
 				didFindMemberCall = true;
 				return;
 			}
@@ -7294,7 +7315,7 @@ If the missing value is recreated every render, move it inside the hook or stabi
 				return;
 			}
 			const depsArgumentRaw = node.arguments[depsArgumentIndex];
-			const callbackExpression = unwrapExpression$1(callbackArgument);
+			const callbackExpression = unwrapExpression$2(callbackArgument);
 			let callbackToAnalyze = null;
 			const forcedCaptureKeys = /* @__PURE__ */ new Set();
 			if (isNodeOfType(callbackExpression, "ArrowFunctionExpression") || isNodeOfType(callbackExpression, "FunctionExpression")) callbackToAnalyze = callbackExpression;
@@ -7302,7 +7323,7 @@ If the missing value is recreated every render, move it inside the hook or stabi
 				const callbackSymbol = context.scopes.symbolFor(callbackExpression);
 				const functionValueNode = callbackSymbol ? getFunctionValueNode(callbackSymbol) : null;
 				if (functionValueNode) callbackToAnalyze = functionValueNode;
-				else if (callbackSymbol?.initializer && isNodeOfType(unwrapExpression$1(callbackSymbol.initializer), "CallExpression")) forcedCaptureKeys.add(callbackExpression.name);
+				else if (callbackSymbol?.initializer && isNodeOfType(unwrapExpression$2(callbackSymbol.initializer), "CallExpression")) forcedCaptureKeys.add(callbackExpression.name);
 				else if (depsArgumentRaw) {
 					if (depsArrayContainsIdentifier(depsArgumentRaw, callbackExpression.name)) return;
 					context.report({
@@ -7359,7 +7380,7 @@ If the missing value is recreated every render, move it inside the hook or stabi
 				});
 				return;
 			}
-			const depsArgument = unwrapExpression$1(depsArgumentRaw);
+			const depsArgument = unwrapExpression$2(depsArgumentRaw);
 			if (isNodeOfType(depsArgument, "Literal") && depsArgument.value === null || isNodeOfType(depsArgument, "Identifier") && depsArgument.name === "undefined") {
 				if (isAutoDependenciesHook(hookName)) return;
 				if (HOOKS_REQUIRING_DEPS_ARRAY.has(hookName)) {
@@ -7400,11 +7421,11 @@ If the missing value is recreated every render, move it inside the hook or stabi
 			for (const forcedCaptureKey of forcedCaptureKeys) captureKeys.add(forcedCaptureKey);
 			const hasLiteralDepElement = depsArgument.elements.some((element) => {
 				if (!element) return false;
-				return isLiteralOrEmptyTemplate(unwrapExpression$1(element));
+				return isLiteralOrEmptyTemplate(unwrapExpression$2(element));
 			});
 			const hasNonStringLiteralDep = depsArgument.elements.some((element) => {
 				if (!element) return false;
-				return isNonStringLiteral(unwrapExpression$1(element));
+				return isNonStringLiteral(unwrapExpression$2(element));
 			});
 			if (hasNonStringLiteralDep) context.report({
 				node: depsArgument,
@@ -7425,7 +7446,7 @@ If the missing value is recreated every render, move it inside the hook or stabi
 					});
 					continue;
 				}
-				const stripped = unwrapExpression$1(elementNode);
+				const stripped = unwrapExpression$2(elementNode);
 				if (isLiteralOrEmptyTemplate(stripped)) continue;
 				if (isNodeOfType(stripped, "Identifier")) {
 					const depSymbol = context.scopes.symbolFor(stripped);
@@ -10789,10 +10810,22 @@ const isWithinChildrenToArray = (jsxNode) => {
 	}
 	return false;
 };
+const spreadCanOverwriteKey = (spreadAttribute) => {
+	const argument = spreadAttribute.argument;
+	if (!isNodeOfType(argument, "ObjectExpression")) return true;
+	for (const property of argument.properties) {
+		if (!isNodeOfType(property, "Property")) return true;
+		if (property.computed) return true;
+		const propertyKey = property.key;
+		if (isNodeOfType(propertyKey, "Identifier") && propertyKey.name === "key") return true;
+		if (isNodeOfType(propertyKey, "Literal") && String(propertyKey.value) === "key") return true;
+	}
+	return false;
+};
 const checkKeyBeforeSpread = (context, openingElement) => {
 	let keyIndex = null;
 	let keyAttribute = null;
-	let firstSpreadIndex = null;
+	let lastOverwritingSpreadIndex = null;
 	for (let attributeIndex = 0; attributeIndex < openingElement.attributes.length; attributeIndex++) {
 		const attribute = openingElement.attributes[attributeIndex];
 		if (isNodeOfType(attribute, "JSXAttribute")) {
@@ -10800,11 +10833,9 @@ const checkKeyBeforeSpread = (context, openingElement) => {
 				keyIndex = attributeIndex;
 				keyAttribute = attribute;
 			}
-		} else if (isNodeOfType(attribute, "JSXSpreadAttribute")) {
-			if (firstSpreadIndex === null) firstSpreadIndex = attributeIndex;
-		}
+		} else if (isNodeOfType(attribute, "JSXSpreadAttribute") && spreadCanOverwriteKey(attribute)) lastOverwritingSpreadIndex = attributeIndex;
 	}
-	if (keyIndex !== null && firstSpreadIndex !== null && keyIndex > firstSpreadIndex && keyAttribute) context.report({
+	if (keyIndex !== null && lastOverwritingSpreadIndex !== null && lastOverwritingSpreadIndex > keyIndex && keyAttribute) context.report({
 		node: keyAttribute,
 		message: KEY_BEFORE_SPREAD
 	});
@@ -18936,7 +18967,7 @@ const noEval = defineRule({
 	title: "eval() runs untrusted code strings",
 	severity: "error",
 	recommendation: "Use `JSON.parse` for data, or rewrite the code so it doesn't build and run code from strings.",
-	create: (context) => ({
+	create: skipNonProductionFiles((context) => ({
 		CallExpression(node) {
 			if (isNodeOfType(node.callee, "Identifier") && node.callee.name === "eval") {
 				context.report({
@@ -18956,7 +18987,7 @@ const noEval = defineRule({
 				message: "new Function() is a code-injection vulnerability: it builds & runs code from a string."
 			});
 		}
-	})
+	}))
 });
 //#endregion
 //#region src/plugin/rules/state-and-effects/no-event-handler.ts
@@ -27010,7 +27041,7 @@ const preferHtmlDialog = defineRule({
 });
 //#endregion
 //#region src/plugin/utils/function-returns-object-literal.ts
-const unwrapExpression = (node) => {
+const unwrapExpression$1 = (node) => {
 	let current = node;
 	for (;;) {
 		if ((current.type === "TSAsExpression" || current.type === "TSSatisfiesExpression" || current.type === "TSNonNullExpression") && "expression" in current && isAstNode(current.expression)) {
@@ -27023,7 +27054,7 @@ const unwrapExpression = (node) => {
 const doesFunctionReturnsObjectLiteral = (functionNode) => {
 	if (functionNode.type === "ArrowFunctionExpression" && "body" in functionNode) {
 		const body = functionNode.body;
-		if (body && body.type !== "BlockStatement") return unwrapExpression(body).type === "ObjectExpression";
+		if (body && body.type !== "BlockStatement") return unwrapExpression$1(body).type === "ObjectExpression";
 	}
 	const body = functionNode.body;
 	if (!body || body.type !== "BlockStatement") return false;
@@ -27031,7 +27062,7 @@ const doesFunctionReturnsObjectLiteral = (functionNode) => {
 	const visit = (node) => {
 		if (returnsObject) return;
 		if (node.type === "ReturnStatement" && "argument" in node && node.argument != null) {
-			if (unwrapExpression(node.argument).type === "ObjectExpression") returnsObject = true;
+			if (unwrapExpression$1(node.argument).type === "ObjectExpression") returnsObject = true;
 			return;
 		}
 		const nodeRecord = node;
@@ -29463,6 +29494,19 @@ const REACT_NATIVE_TEXT_COMPONENTS = new Set([
 	"H5",
 	"H6"
 ]);
+const REACT_NATIVE_RAW_TEXT_HOST_COMPONENTS = new Set([
+	"View",
+	"ScrollView",
+	"SafeAreaView",
+	"KeyboardAvoidingView",
+	"ImageBackground",
+	"Modal",
+	"Pressable",
+	"TouchableOpacity",
+	"TouchableHighlight",
+	"TouchableWithoutFeedback",
+	"TouchableNativeFeedback"
+]);
 const REACT_NATIVE_TEXT_COMPONENT_KEYWORDS = new Set([
 	"Text",
 	"Title",
@@ -29475,7 +29519,11 @@ const REACT_NATIVE_TEXT_COMPONENT_KEYWORDS = new Set([
 	"Description",
 	"Body"
 ]);
-const REACT_NATIVE_TEXT_TRANSPARENT_COMPONENTS = new Set(["fbt", "fbs"]);
+const REACT_NATIVE_TEXT_TRANSPARENT_COMPONENTS = new Set([
+	"Fragment",
+	"fbt",
+	"fbs"
+]);
 const DEPRECATED_RN_MODULE_REPLACEMENTS = new Map([
 	["AsyncStorage", "@react-native-async-storage/async-storage"],
 	["Picker", "@react-native-picker/picker"],
@@ -30433,23 +30481,29 @@ const jsxRootForwardsChildrenIntoText = (jsxRoot, bindings, isTextHandlingElemen
 	return didForwardIntoText;
 };
 const isMeaningfulJsxChild = (child) => !isNodeOfType(child, "JSXText") || Boolean(child.value?.trim());
-const jsxRootRendersChildrenOutsideText = (jsxRoot, bindings, isTextHandlingElement) => {
-	let didRenderOutsideText = false;
+const jsxRootForwardsChildren = (jsxRoot, bindings, isTextHandlingElement, countsAsForwardTarget) => {
+	let didForward = false;
 	walkAst(jsxRoot, (node) => {
-		if (didRenderOutsideText || isFunctionNode(node)) return false;
+		if (didForward || isFunctionNode(node)) return false;
 		if (!isNodeOfType(node, "JSXElement") && !isNodeOfType(node, "JSXFragment")) return;
 		if (isNodeOfType(node, "JSXElement")) {
 			const elementName = resolveJsxElementName(node.openingElement);
 			if (elementName && isTextHandlingElement(elementName)) return false;
-			if (!(node.children ?? []).some(isMeaningfulJsxChild) && (node.openingElement.attributes ?? []).some((attribute) => isChildrenForwardingAttribute(attribute, bindings))) {
-				didRenderOutsideText = true;
+			if (!(node.children ?? []).some(isMeaningfulJsxChild) && countsAsForwardTarget(node) && (node.openingElement.attributes ?? []).some((attribute) => isChildrenForwardingAttribute(attribute, bindings))) {
+				didForward = true;
 				return;
 			}
 		}
-		didRenderOutsideText = (node.children ?? []).some((child) => isChildrenForwardingJsxChild(child, bindings));
+		if (countsAsForwardTarget(node) && (node.children ?? []).some((child) => isChildrenForwardingJsxChild(child, bindings))) didForward = true;
 	});
-	return didRenderOutsideText;
+	return didForward;
 };
+const jsxRootRendersChildrenOutsideText = (jsxRoot, bindings, isTextHandlingElement) => jsxRootForwardsChildren(jsxRoot, bindings, isTextHandlingElement, () => true);
+const jsxRootRendersChildrenIntoNonTextHost = (jsxRoot, bindings, isTextHandlingElement, isNonTextHostElement) => jsxRootForwardsChildren(jsxRoot, bindings, isTextHandlingElement, (node) => {
+	if (!isNodeOfType(node, "JSXElement")) return false;
+	const elementName = resolveJsxElementName(node.openingElement);
+	return elementName !== null && isNonTextHostElement(elementName);
+});
 const resolveStyledFactoryBaseName = (definitionNode) => {
 	let current = stripParenExpression(definitionNode);
 	while (current) {
@@ -30486,49 +30540,71 @@ const resolveClassRenderFunction = (classNode) => {
 	}
 	return null;
 };
-const recordWrapperFromDeclaration = (componentName, definitionNode, isTextHandlingElement, wrappers) => {
-	if (!componentName || !isReactComponentName(componentName)) return;
-	if (wrappers.has(componentName)) return;
-	if (!definitionNode) return;
+const classifyChildrenForwarding = (definitionNode, isTextHandlingElement, isNonTextHostElement) => {
 	const unwrapped = unwrapComponentDefinition(definitionNode);
 	const styledBaseName = resolveStyledFactoryBaseName(unwrapped);
-	if (styledBaseName && isTextHandlingElement(styledBaseName)) {
-		wrappers.add(componentName);
-		return;
+	if (styledBaseName) {
+		if (isTextHandlingElement(styledBaseName)) return "text";
+		if (isNonTextHostElement(styledBaseName)) return "nonText";
+		return "unknown";
 	}
 	const functionNode = resolveClassRenderFunction(unwrapped) ?? (isFunctionNode(unwrapped) ? unwrapped : null);
-	if (!functionNode) return;
+	if (!functionNode) return "unknown";
 	const bindings = resolveParamChildrenBindings(functionNode);
 	collectChildrenAliases(functionNode, bindings);
 	const jsxRoots = collectReturnedJsxRoots(functionNode);
-	if (jsxRoots.some((jsxRoot) => jsxRootRendersChildrenOutsideText(jsxRoot, bindings, isTextHandlingElement))) return;
+	if (jsxRoots.some((jsxRoot) => jsxRootRendersChildrenIntoNonTextHost(jsxRoot, bindings, isTextHandlingElement, isNonTextHostElement))) return "nonText";
+	if (jsxRoots.some((jsxRoot) => jsxRootRendersChildrenOutsideText(jsxRoot, bindings, isTextHandlingElement))) return "unknown";
 	for (const jsxRoot of jsxRoots) {
 		if (isNodeOfType(jsxRoot, "JSXElement")) {
 			const rootName = resolveJsxElementName(jsxRoot.openingElement);
-			if (rootName && isTextHandlingElement(rootName)) {
-				wrappers.add(componentName);
-				return;
-			}
-		}
-		if (jsxRootForwardsChildrenIntoText(jsxRoot, bindings, isTextHandlingElement)) {
-			wrappers.add(componentName);
-			return;
+			if (rootName && isTextHandlingElement(rootName)) return "text";
 		}
+		if (jsxRootForwardsChildrenIntoText(jsxRoot, bindings, isTextHandlingElement)) return "text";
 	}
+	return "unknown";
+};
+const recordWrapperFromDeclaration = (componentName, definitionNode, isTextHandlingElement, isNonTextHostElement, wrappers, nonTextWrappers) => {
+	if (!componentName || !isReactComponentName(componentName)) return;
+	if (wrappers.has(componentName)) return;
+	if (!definitionNode) return;
+	const kind = classifyChildrenForwarding(definitionNode, isTextHandlingElement, isNonTextHostElement);
+	if (kind === "text") wrappers.add(componentName);
+	else if (kind === "nonText") nonTextWrappers.add(componentName);
 };
 const MAX_TRANSITIVE_WRAPPER_PASSES = 3;
-const collectTextWrapperComponents = (programNode, isTextHandlingRoot) => {
+const collectTextWrapperComponents = (programNode, isTextHandlingRoot, isNonTextHostRoot) => {
 	const wrappers = /* @__PURE__ */ new Set();
+	const nonTextWrappers = /* @__PURE__ */ new Set();
 	const isTextHandlingElement = (elementName) => isTextHandlingRoot(elementName) || wrappers.has(elementName);
+	const isNonTextHostElement = (elementName) => isNonTextHostRoot(elementName) || nonTextWrappers.has(elementName);
+	const recordDeclaration = (componentName, definitionNode) => recordWrapperFromDeclaration(componentName, definitionNode, isTextHandlingElement, isNonTextHostElement, wrappers, nonTextWrappers);
 	for (let pass = 0; pass < MAX_TRANSITIVE_WRAPPER_PASSES; pass += 1) {
-		const sizeBeforePass = wrappers.size;
+		const wrappersSizeBeforePass = wrappers.size;
+		const nonTextSizeBeforePass = nonTextWrappers.size;
 		walkAst(programNode, (node) => {
-			if (isNodeOfType(node, "VariableDeclarator")) recordWrapperFromDeclaration(node.id && isNodeOfType(node.id, "Identifier") ? node.id.name : null, node.init, isTextHandlingElement, wrappers);
-			else if (isNodeOfType(node, "FunctionDeclaration") || isNodeOfType(node, "ClassDeclaration")) recordWrapperFromDeclaration(node.id && isNodeOfType(node.id, "Identifier") ? node.id.name : null, node, isTextHandlingElement, wrappers);
+			if (isNodeOfType(node, "VariableDeclarator")) recordDeclaration(node.id && isNodeOfType(node.id, "Identifier") ? node.id.name : null, node.init ?? null);
+			else if (isNodeOfType(node, "FunctionDeclaration") || isNodeOfType(node, "ClassDeclaration")) recordDeclaration(node.id && isNodeOfType(node.id, "Identifier") ? node.id.name : null, node);
 		});
-		if (wrappers.size === sizeBeforePass) break;
+		if (wrappers.size === wrappersSizeBeforePass && nonTextWrappers.size === nonTextSizeBeforePass) break;
 	}
-	return wrappers;
+	for (const wrapperName of wrappers) nonTextWrappers.delete(wrapperName);
+	return {
+		textWrappers: wrappers,
+		nonTextWrappers
+	};
+};
+//#endregion
+//#region src/plugin/rules/react-native/utils/resolve-imported-component-forwarding.ts
+const resolveImportedComponentForwarding = (contextNode, fromFilename, localName, isTextHandlingRoot, isNonTextHostRoot) => {
+	const binding = getImportBindingForName(contextNode, localName);
+	if (!binding || binding.isNamespace || binding.exportedName === null) return null;
+	const resolvedNode = resolveCrossFileFunctionExport(fromFilename, binding.source, binding.exportedName);
+	if (!resolvedNode) return null;
+	const moduleProgram = findProgramRoot(resolvedNode);
+	if (moduleProgram === null) return classifyChildrenForwarding(resolvedNode, isTextHandlingRoot, isNonTextHostRoot);
+	const { textWrappers, nonTextWrappers } = collectTextWrapperComponents(moduleProgram, isTextHandlingRoot, isNonTextHostRoot);
+	return classifyChildrenForwarding(resolvedNode, (elementName) => isTextHandlingRoot(elementName) || textWrappers.has(elementName), (elementName) => isNonTextHostRoot(elementName) || nonTextWrappers.has(elementName));
 };
 //#endregion
 //#region src/plugin/rules/react-native/utils/is-expo-ui-component-element.ts
@@ -30599,19 +30675,37 @@ const rnNoRawText = defineRule({
 	recommendation: "Text outside a `<Text>` component crashes on React Native. Wrap it like `<Text>{value}</Text>`.",
 	create: (context) => {
 		let isDomComponentFile = false;
-		let autoDetectedWrappers = /* @__PURE__ */ new Set();
+		let autoDetectedTextWrappers = /* @__PURE__ */ new Set();
+		let autoDetectedNonTextWrappers = /* @__PURE__ */ new Set();
+		const isNonTextHostName = (elementName) => !isReactComponentName(elementName) || REACT_NATIVE_RAW_TEXT_HOST_COMPONENTS.has(elementName);
+		const isRawTextReportTarget = (elementName) => elementName !== null && (isNonTextHostName(elementName) || autoDetectedNonTextWrappers.has(elementName));
+		const importedNonTextWrapperCache = /* @__PURE__ */ new Map();
+		const isImportedNonTextWrapper = (elementName, contextNode) => {
+			if (elementName === null || !isReactComponentName(elementName)) return false;
+			const { filename } = context;
+			if (filename === void 0) return false;
+			const cached = importedNonTextWrapperCache.get(elementName);
+			if (cached !== void 0) return cached;
+			const isNonTextWrapper = resolveImportedComponentForwarding(contextNode, filename, elementName, isTextHandlingComponent, isNonTextHostName) === "nonText";
+			importedNonTextWrapperCache.set(elementName, isNonTextWrapper);
+			return isNonTextWrapper;
+		};
 		return {
 			Program(programNode) {
 				isDomComponentFile = hasDirective(programNode, "use dom");
-				autoDetectedWrappers = collectTextWrapperComponents(programNode, isTextHandlingComponent);
+				const childrenForwarding = collectTextWrapperComponents(programNode, isTextHandlingComponent, isNonTextHostName);
+				autoDetectedTextWrappers = childrenForwarding.textWrappers;
+				autoDetectedNonTextWrappers = childrenForwarding.nonTextWrappers;
 			},
 			JSXElement(node) {
 				if (isDomComponentFile) return;
 				const elementName = resolveTextBoundaryName(node.openingElement);
-				if (elementName && (isTextHandlingComponent(elementName) || autoDetectedWrappers.has(elementName))) return;
+				if (elementName && (isTextHandlingComponent(elementName) || autoDetectedTextWrappers.has(elementName))) return;
 				if (isExpoUiComponentElement(node.openingElement, node, "ListItem")) return;
 				if (isInsidePlatformOsWebBranch(node)) return;
 				if (isTransparentTextWrapper(elementName) && isInsideTextHandlingComponent(node)) return;
+				if (!(node.children ?? []).some(isRawTextContent)) return;
+				if (!isRawTextReportTarget(elementName) && !isImportedNonTextWrapper(elementName, node)) return;
 				for (const child of node.children ?? []) {
 					if (!isRawTextContent(child)) continue;
 					context.report({
@@ -35155,6 +35249,67 @@ const isAuthGuardName = (calleeName) => {
 	return false;
 };
 //#endregion
+//#region src/plugin/utils/is-non-privileged-server-action.ts
+const NON_DATA_EFFECT_FUNCTION_NAMES = new Set([...CACHE_REVALIDATION_FUNCTION_NAMES, ...NEXTJS_NAVIGATION_FUNCTIONS]);
+const isCacheOrNavigationCall = (node) => isNodeOfType(node, "CallExpression") && isNodeOfType(node.callee, "Identifier") && NON_DATA_EFFECT_FUNCTION_NAMES.has(node.callee.name);
+const unwrapExpression = (node) => {
+	let current = node;
+	while (current) {
+		if (isNodeOfType(current, "TSAsExpression") || isNodeOfType(current, "TSNonNullExpression") || isNodeOfType(current, "TSSatisfiesExpression") || isNodeOfType(current, "ChainExpression")) {
+			current = current.expression;
+			continue;
+		}
+		if (isNodeOfType(current, "SequenceExpression")) {
+			current = current.expressions?.[current.expressions.length - 1];
+			continue;
+		}
+		return current;
+	}
+	return null;
+};
+const isDataExposingValue = (node) => {
+	const value = unwrapExpression(node);
+	if (!value) return false;
+	if (isCacheOrNavigationCall(value)) return false;
+	return !isLiteralOnlyExpression(value);
+};
+const isLiteralOnlyExpression = (node) => {
+	if (!node) return false;
+	if (isNodeOfType(node, "Literal")) return true;
+	if (isNodeOfType(node, "TemplateLiteral")) return (node.expressions ?? []).every(isLiteralOnlyExpression);
+	if (isNodeOfType(node, "UnaryExpression")) return isLiteralOnlyExpression(node.argument);
+	if (isNodeOfType(node, "ArrayExpression")) return (node.elements ?? []).every((element) => element === null || !isNodeOfType(element, "SpreadElement") && isLiteralOnlyExpression(element));
+	if (isNodeOfType(node, "ObjectExpression")) return (node.properties ?? []).every((property) => isNodeOfType(property, "Property") && (!property.computed || isLiteralOnlyExpression(property.key)) && isLiteralOnlyExpression(property.value));
+	return false;
+};
+const getReturnedOrThrownArgument = (node) => {
+	if (isNodeOfType(node, "ReturnStatement")) return node.argument ?? null;
+	if (isNodeOfType(node, "ThrowStatement")) return node.argument ?? null;
+	return null;
+};
+const isDataExposingReturnOrThrow = (node) => isDataExposingValue(getReturnedOrThrownArgument(node));
+const isPrivilegedEffect = (node) => isNodeOfType(node, "CallExpression") || isNodeOfType(node, "TaggedTemplateExpression") || isNodeOfType(node, "NewExpression") || isNodeOfType(node, "AssignmentExpression") || isNodeOfType(node, "UpdateExpression") || isNodeOfType(node, "UnaryExpression") && node.operator === "delete" || isDataExposingReturnOrThrow(node);
+const isNonPrivilegedServerAction = (functionNode) => {
+	const functionBody = functionNode.body;
+	if (!functionBody) return false;
+	if (!isNodeOfType(functionBody, "BlockStatement") && isDataExposingValue(functionBody)) return false;
+	let hasNonDataEffectCall = false;
+	let hasPrivilegedEffect = false;
+	walkAst(functionBody, (child) => {
+		if (hasPrivilegedEffect) return false;
+		if (child !== functionBody && isFunctionLike$2(child)) return false;
+		if (isCacheOrNavigationCall(child)) {
+			hasNonDataEffectCall = true;
+			return;
+		}
+		if (isPrivilegedEffect(child)) {
+			hasPrivilegedEffect = true;
+			return false;
+		}
+	});
+	return hasNonDataEffectCall && !hasPrivilegedEffect;
+};
+//#endregion
 //#region src/plugin/rules/server/server-auth-actions.ts
 const isAsyncFunctionLikeNode = (node) => {
 	if (!node) return false;
@@ -35229,6 +35384,7 @@ const getAuthScanRoots = (functionNode) => {
 const inspectServerAction = (candidate, fileHasUseServerDirective, allowedFunctionNames, context) => {
 	if (!(fileHasUseServerDirective || hasUseServerDirective(candidate.functionNode))) return;
 	if (containsAuthCheck(getAuthScanRoots(candidate.functionNode), allowedFunctionNames, GENERIC_AUTH_METHOD_NAMES)) return;
+	if (isNonPrivilegedServerAction(candidate.functionNode)) return;
 	context.report({
 		node: candidate.reportNode,
 		message: `Anyone can call server action "${candidate.displayName}" without logging in, since it has no auth check.`
@@ -35854,22 +36010,6 @@ const isSupabaseMigrationPath = (relativePath) => /(?:^|\/)supabase\/(?:migratio
 //#endregion
 //#region src/plugin/rules/security-scan/utils/is-sql-path.ts
 const isSqlPath = (relativePath) => relativePath.endsWith(".sql") || isSupabaseMigrationPath(relativePath);
-const supabaseRlsPolicyRisk = defineRule({
-	id: "supabase-rls-policy-risk",
-	title: "Permissive Supabase RLS policy",
-	severity: "error",
-	recommendation: "Keep public-read policies explicit, but gate inserts, updates, deletes, and service-role bypasses behind `auth.uid()` plus trusted tenant membership.",
-	scan: scanByPattern({
-		shouldScan: (file) => isSqlPath(file.relativePath),
-		pattern: [
-			/disable\s+row\s+level\s+security/i,
-			/create\s+policy[\s\S]{0,700}auth\.role\(\)\s*=\s*["']service_role["']/i,
-			/create\s+policy[\s\S]{0,700}\bfor\s+(?:all|insert|update|delete)\b[\s\S]{0,500}\b(?:using|with\s+check)\s*\(\s*true\s*\)/i,
-			/create\s+policy(?:(?!\bfor\s+select\b)[\s\S]){0,700}\b(?:using|with\s+check)\s*\(\s*true\s*\)/i
-		],
-		message: "Supabase policy SQL disables RLS, permits writes broadly, or references a service-role bypass."
-	})
-});
 //#endregion
 //#region src/plugin/rules/security-scan/utils/sanitize-sql-for-scan.ts
 const DOLLAR_QUOTE_TAG_PATTERN = /^\$[A-Za-z_]?\w*\$/;
@@ -36046,6 +36186,60 @@ const sanitizeSqlForScan = (content) => {
 	return characters.join("");
 };
 //#endregion
+//#region src/plugin/rules/security-scan/supabase-rls-policy-risk.ts
+const DISABLED_RLS_PATTERN = /disable\s+row\s+level\s+security/i;
+const SERVICE_ROLE_BODY_BYPASS_PATTERN = /auth\.role\(\)\s*=\s*["']service_role["']/i;
+const CREATE_POLICY_PATTERN = /create\s+policy/gi;
+const STATEMENT_END_PATTERN = /;|create\s+policy/i;
+const PERMISSIVE_TRUE_PATTERN = /\b(?:using|with\s+check)\s*\(\s*true\s*\)/i;
+const FOR_SELECT_PATTERN = /\bfor\s+select\b/i;
+const TO_CLAUSE_PATTERN = /\bto\s+([\s\S]+?)(?=\s+(?:using|with\s+check|as|for)\b|;|$)/i;
+const SERVER_ONLY_ROLES = new Set([
+	"service_role",
+	"postgres",
+	"supabase_admin"
+]);
+const isServerOnlyScoped = (statement) => {
+	const toClause = TO_CLAUSE_PATTERN.exec(statement);
+	if (toClause === null) return false;
+	const roles = toClause[1].split(",").map((role) => role.trim().replace(/["'`]/g, "").toLowerCase()).filter(Boolean);
+	return roles.length > 0 && roles.every((role) => SERVER_ONLY_ROLES.has(role));
+};
+const isRiskyPolicyStatement = (statement, rawStatement) => {
+	if (SERVICE_ROLE_BODY_BYPASS_PATTERN.test(rawStatement)) return true;
+	if (!PERMISSIVE_TRUE_PATTERN.test(statement)) return false;
+	if (FOR_SELECT_PATTERN.test(statement)) return false;
+	return !isServerOnlyScoped(statement);
+};
+const POLICY_RISK_MESSAGE = "Supabase policy SQL disables RLS, permits writes broadly, or references a service-role bypass.";
+const supabaseRlsPolicyRisk = defineRule({
+	id: "supabase-rls-policy-risk",
+	title: "Permissive Supabase RLS policy",
+	severity: "error",
+	recommendation: "Keep public-read policies explicit, but gate inserts, updates, deletes, and service-role bypasses behind `auth.uid()` plus trusted tenant membership.",
+	scan: (file) => {
+		if (!isSqlPath(file.relativePath)) return [];
+		const content = sanitizeSqlForScan(file.content);
+		let earliestRiskIndex = content.search(DISABLED_RLS_PATTERN);
+		CREATE_POLICY_PATTERN.lastIndex = 0;
+		for (let policyMatch = CREATE_POLICY_PATTERN.exec(content); policyMatch !== null; policyMatch = CREATE_POLICY_PATTERN.exec(content)) {
+			const afterKeyword = policyMatch.index + policyMatch[0].length;
+			const terminatorOffset = content.slice(afterKeyword).search(STATEMENT_END_PATTERN);
+			const statementEnd = terminatorOffset < 0 ? content.length : afterKeyword + terminatorOffset;
+			if (!isRiskyPolicyStatement(content.slice(policyMatch.index, statementEnd), file.content.slice(policyMatch.index, statementEnd))) continue;
+			if (earliestRiskIndex < 0 || policyMatch.index < earliestRiskIndex) earliestRiskIndex = policyMatch.index;
+			break;
+		}
+		if (earliestRiskIndex < 0) return [];
+		const { line, column } = getLocationAtIndex(content, earliestRiskIndex);
+		return [{
+			message: POLICY_RISK_MESSAGE,
+			line,
+			column
+		}];
+	}
+});
+//#endregion
 //#region src/plugin/rules/security-scan/supabase-table-missing-rls.ts
 const CREATE_PUBLIC_TABLE_PATTERN = /create\s+(?:unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?(?!(?:auth|storage|realtime|vault|extensions|graphql|graphql_public|pgbouncer|net|supabase_functions|supabase_migrations|cron|pgsodium|pgmq|information_schema|pg_catalog|pg_temp|private|internal)\s*\.)(?:public\s*\.\s*)?["`]?([A-Za-z_][\w$]*)["`]?(?:\s*\(|\s+as\b)/gi;
 const enableRlsForTablePattern = (tableName) => new RegExp(`alter\\s+table\\s+(?:if\\s+exists\\s+)?(?:only\\s+)?(?:public\\s*\\.\\s*)?["\`]?${escapeRegExp(tableName)}["\`]?\\s+(?:force\\s+)?enable\\s+row\\s+level\\s+security`, "i");
@@ -42536,6 +42730,7 @@ const CROSS_FILE_RULE_IDS = new Set([
 	"nextjs-missing-metadata",
 	"nextjs-no-use-search-params-without-suspense",
 	"no-mutating-reducer-state",
+	"rn-no-raw-text",
 	"rn-prefer-expo-image"
 ]);
 //#endregion

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.5.8-dev.ea00b1b",
-  "description": "oxlint plugin for React Doctor: diagnose React codebases for security, performance, correctness, accessibility, bundle-size, and architecture issues",
+  "version": "0.5.8-dev.f028d8b",
+  "description": "React Doctor rules for oxlint.",
   "keywords": [
     "accessibility",
     "linter",
@@ -21,7 +21,7 @@
   "bugs": {
     "url": "https://github.com/millionco/react-doctor/issues"
   },
-  "license": "MIT",
+  "license": "SEE LICENSE IN LICENSE",
   "author": "Aiden Bai",
   "repository": {
     "type": "git",
@@ -30,7 +30,8 @@
   },
   "files": [
     "dist/**/*.js",
-    "dist/**/*.d.ts"
+    "dist/**/*.d.ts",
+    "LICENSE"
   ],
   "type": "module",
   "sideEffects": false,