oxlint-plugin-react-doctor 0.7.9-dev.e86bc57 → 0.7.9-dev.f441f59

package/dist/index.js

@@ -1,8 +1,8 @@
 import { KEYS } from "eslint-visitor-keys";
 import * as path from "node:path";
+import { parseSync, visitorKeys } from "oxc-parser";
 import * as fs from "node:fs";
 import { readFileSync } from "node:fs";
-import { parseSync, visitorKeys } from "oxc-parser";
 import { analyze } from "eslint-scope";
 //#region src/plugin/utils/is-node-of-type.ts
 const isNodeOfType = (node, type) => node !== null && typeof node === "object" && "type" in node && node.type === type;
@@ -327,7 +327,15 @@ const defineRule = (rule) => {
 let lastContentLineIndex;
 const buildLineStartOffsets = (content) => {
 	const lineStartOffsets = [0];
-	for (let newlineIndex = content.indexOf("\n"); newlineIndex !== -1; newlineIndex = content.indexOf("\n", newlineIndex + 1)) lineStartOffsets.push(newlineIndex + 1);
+	for (let characterIndex = 0; characterIndex < content.length; characterIndex += 1) {
+		const character = content[characterIndex];
+		if (character === "\r" && content[characterIndex + 1] === "\n") {
+			characterIndex += 1;
+			lineStartOffsets.push(characterIndex + 1);
+			continue;
+		}
+		if (character === "\r" || character === "\n" || character === "\u2028" || character === "\u2029") lineStartOffsets.push(characterIndex + 1);
+	}
 	return lineStartOffsets;
 };
 const getLineStartOffsets = (content) => {
@@ -579,6 +587,22 @@ const EXTERNAL_SYNC_OBSERVER_CONSTRUCTORS = new Set([
 	"ResizeObserver",
 	"PerformanceObserver"
 ]);
+const EXTERNAL_SYNC_DOM_MEMBER_METHOD_NAMES = new Set([
+	"blur",
+	"focus",
+	"getBoundingClientRect",
+	"getClientRects",
+	"measure",
+	"measureInWindow",
+	"measureLayout",
+	"scroll",
+	"scrollBy",
+	"scrollIntoView",
+	"scrollTo",
+	"select",
+	"setRangeText",
+	"setSelectionRange"
+]);
 const STORAGE_OBJECTS = new Set(["localStorage", "sessionStorage"]);
 //#endregion
 //#region src/plugin/constants/react.ts
@@ -1749,7 +1773,7 @@ const isImportedFromModule = (contextNode, localIdentifierName, moduleSource) =>
 	if (!info) return false;
 	return info.source === moduleSource;
 };
-const isNamespaceImportFromModule = (contextNode, localIdentifierName, moduleSource) => {
+const isNamespaceImportFromModule$1 = (contextNode, localIdentifierName, moduleSource) => {
 	const lookup = getImportLookup(contextNode);
 	if (!lookup) return false;
 	const info = lookup.get(localIdentifierName);
@@ -1835,7 +1859,7 @@ const GENERATED_IMAGE_RENDERER_MODULES = [
 	"satori"
 ];
 const IMAGE_RESPONSE_MODULES = new Set(["next/og", "@vercel/og"]);
-const getImportDeclaration$1 = (node) => {
+const getImportDeclaration = (node) => {
 	let current = node.parent;
 	while (current) {
 		if (isNodeOfType(current, "ImportDeclaration")) return current;
@@ -1849,7 +1873,7 @@ const isNamedImport = (symbol, importedName, moduleSources) => {
 	if (symbol.kind !== "import") return false;
 	const declaration = symbol.declarationNode;
 	if (!isNodeOfType(declaration, "ImportSpecifier")) return false;
-	const importDeclaration = getImportDeclaration$1(declaration);
+	const importDeclaration = getImportDeclaration(declaration);
 	const source = importDeclaration ? getImportSource(importDeclaration) : null;
 	if (!source || !moduleSources.has(source)) return false;
 	const imported = declaration.imported;
@@ -1858,7 +1882,7 @@ const isNamedImport = (symbol, importedName, moduleSources) => {
 const isSatoriImport = (symbol) => {
 	if (symbol.kind !== "import") return false;
 	const declaration = symbol.declarationNode;
-	const importDeclaration = getImportDeclaration$1(declaration);
+	const importDeclaration = getImportDeclaration(declaration);
 	if (!importDeclaration || getImportSource(importDeclaration) !== "satori") return false;
 	if (isNodeOfType(declaration, "ImportDefaultSpecifier")) return true;
 	if (!isNodeOfType(declaration, "ImportSpecifier")) return false;
@@ -1879,7 +1903,7 @@ const isGeneratedImageRendererCall = (node, scopes) => {
 	if (!symbol || symbol.kind !== "import") return false;
 	const declaration = symbol.declarationNode;
 	if (!isNodeOfType(declaration, "ImportNamespaceSpecifier")) return false;
-	const importDeclaration = getImportDeclaration$1(declaration);
+	const importDeclaration = getImportDeclaration(declaration);
 	const source = importDeclaration ? getImportSource(importDeclaration) : null;
 	return Boolean(source && IMAGE_RESPONSE_MODULES.has(source));
 };
@@ -2099,6 +2123,386 @@ const isGeneratedImageRenderContext = (context, node) => {
 	return false;
 };
 //#endregion
+//#region src/plugin/utils/find-enclosing-function.ts
+const findEnclosingFunction$1 = (node) => {
+	let cursor = node.parent;
+	while (cursor) {
+		if (isFunctionLike$1(cursor)) return cursor;
+		cursor = cursor.parent ?? null;
+	}
+	return null;
+};
+//#endregion
+//#region src/plugin/utils/find-transparent-expression-root.ts
+const findTransparentExpressionRoot = (node) => {
+	let current = node;
+	while (current.parent && TRANSPARENT_EXPRESSION_WRAPPER_TYPES.has(current.parent.type)) current = current.parent;
+	return current;
+};
+//#endregion
+//#region src/plugin/constants/js.ts
+const LOOP_TYPES = [
+	"ForStatement",
+	"ForInStatement",
+	"ForOfStatement",
+	"WhileStatement",
+	"DoWhileStatement"
+];
+const FUNCTION_LIKE_TYPES = new Set([
+	"FunctionDeclaration",
+	"FunctionExpression",
+	"ArrowFunctionExpression"
+]);
+const BUILTIN_GLOBAL_NAMESPACE_NAMES = new Set([
+	"Math",
+	"Date",
+	"JSON",
+	"Object",
+	"Array",
+	"Number",
+	"String",
+	"Boolean",
+	"RegExp",
+	"Symbol",
+	"BigInt",
+	"Reflect"
+]);
+const MUTATING_ARRAY_METHODS = new Set([
+	"push",
+	"pop",
+	"shift",
+	"unshift",
+	"splice",
+	"sort",
+	"reverse",
+	"fill",
+	"copyWithin"
+]);
+const MUTATING_COLLECTION_METHODS = new Set([
+	"add",
+	"clear",
+	"delete",
+	"set"
+]);
+const CHAINABLE_ITERATION_METHODS = new Set([
+	"map",
+	"filter",
+	"forEach",
+	"flatMap"
+]);
+const ITERATOR_PRODUCING_METHOD_NAMES = new Set([
+	"values",
+	"keys",
+	"entries"
+]);
+const BROWSER_TEST_FILE_PATTERN = /\.browser\.[cm]?[jt]sx?$/;
+const TEST_LIBRARY_IMPORT_SOURCES = new Set([
+	"vitest",
+	"jest",
+	"mocha",
+	"chai",
+	"sinon",
+	"expect",
+	"ava",
+	"uvu",
+	"node:test",
+	"bun:test",
+	"@testing-library/react",
+	"@testing-library/react-native",
+	"@testing-library/react-hooks",
+	"@testing-library/dom",
+	"@testing-library/user-event",
+	"@testing-library/jest-dom",
+	"@testing-library/vue",
+	"@testing-library/svelte",
+	"@testing-library/preact",
+	"@testing-library/cypress",
+	"playwright",
+	"playwright-core",
+	"@playwright/test",
+	"@playwright/experimental-ct-react",
+	"@playwright/experimental-ct-react17",
+	"cypress",
+	"@cypress/react",
+	"@cypress/react18",
+	"@storybook/test",
+	"@storybook/test-runner",
+	"@storybook/testing-library",
+	"@storybook/jest",
+	"puppeteer",
+	"puppeteer-core",
+	"webdriverio",
+	"@wdio/globals",
+	"@nuxt/test-utils"
+]);
+const TEST_LIBRARY_IMPORT_SOURCE_PREFIXES = [
+	"vitest/",
+	"@vitest/",
+	"@jest/",
+	"@testing-library/",
+	"@playwright/",
+	"@storybook/test/",
+	"@storybook/test-runner/",
+	"@storybook/testing-library/",
+	"@cypress/",
+	"@nuxt/test-utils/"
+];
+const ORDERED_UI_FLOW_CALLEE_NAMES = new Set([
+	"render",
+	"rerender",
+	"renderHook",
+	"renderToString",
+	"renderToStaticMarkup",
+	"act",
+	"click",
+	"dblClick",
+	"dblclick",
+	"tripleClick",
+	"tap",
+	"press",
+	"longPress",
+	"type",
+	"clear",
+	"fill",
+	"focus",
+	"blur",
+	"hover",
+	"unhover",
+	"check",
+	"uncheck",
+	"selectOption",
+	"selectOptions",
+	"setChecked",
+	"setInputFiles",
+	"scrollIntoViewIfNeeded",
+	"dragTo",
+	"dragAndDrop",
+	"drop",
+	"evaluate",
+	"evaluateHandle",
+	"waitFor",
+	"waitForLoadState",
+	"waitForSelector",
+	"waitForURL",
+	"waitForResponse",
+	"waitForRequest",
+	"waitForEvent",
+	"waitForFunction",
+	"waitForElementToBeRemoved",
+	"goto",
+	"goBack",
+	"goForward",
+	"reload",
+	"screenshot",
+	"snapshot",
+	"toMatchSnapshot",
+	"toMatchInlineSnapshot",
+	"expect",
+	"expectTypeOf",
+	"step",
+	"describe",
+	"test",
+	"it",
+	"beforeAll",
+	"beforeEach",
+	"afterAll",
+	"afterEach",
+	"play",
+	"userEvent",
+	"screen",
+	"within"
+]);
+const ORDERED_UI_FLOW_CALLEE_PREFIXES = ["findBy", "findAllBy"];
+const INTENTIONAL_SEQUENCING_CALLEE_NAMES = new Set([
+	"sleep",
+	"delay",
+	"wait",
+	"pause",
+	"throttle",
+	"debounce",
+	"tick",
+	"nextTick",
+	"advanceTimersByTime",
+	"advanceTimersByTimeAsync",
+	"runAllTimers",
+	"runAllTimersAsync",
+	"runOnlyPendingTimers",
+	"runOnlyPendingTimersAsync",
+	"setTimeout",
+	"setInterval",
+	"setImmediate",
+	"queueMicrotask",
+	"requestAnimationFrame",
+	"requestIdleCallback",
+	"animate",
+	"transition",
+	"spring",
+	"tween",
+	"stagger",
+	"sequence",
+	"timeline",
+	"scrub",
+	"query",
+	"execute",
+	"exec",
+	"raw",
+	"transaction",
+	"$transaction",
+	"$executeRaw",
+	"$queryRaw",
+	"$executeRawUnsafe",
+	"$queryRawUnsafe",
+	"begin",
+	"commit",
+	"rollback",
+	"savepoint",
+	"lock",
+	"unlock",
+	"spawn",
+	"spawnSync",
+	"execSync",
+	"execFile",
+	"execFileSync",
+	"fork",
+	"$",
+	"sh",
+	"mkdir",
+	"rmdir",
+	"rename",
+	"rm",
+	"unlink",
+	"writeFile",
+	"appendFile",
+	"copyFile",
+	"navigate",
+	"goto",
+	"waitForNavigation",
+	"waitForURL",
+	"waitForLoadState",
+	"waitForResponse",
+	"waitForRequest",
+	"waitForSelector",
+	"waitForFunction",
+	"waitForEvent"
+]);
+//#endregion
+//#region src/plugin/utils/is-test-library-import-source.ts
+const isTestLibraryImportSource = (source) => {
+	if (typeof source !== "string" || source.length === 0) return false;
+	if (TEST_LIBRARY_IMPORT_SOURCES.has(source)) return true;
+	return TEST_LIBRARY_IMPORT_SOURCE_PREFIXES.some((prefix) => source.startsWith(prefix));
+};
+//#endregion
+//#region src/plugin/utils/is-local-test-scaffold-jsx.ts
+const TEST_CALLBACK_EXPORT_NAMES = new Set(["it", "test"]);
+const TEST_CALLBACK_MEMBER_NAMES = new Set([
+	"concurrent",
+	"only",
+	"skip"
+]);
+const TEST_CALLBACK_TABLE_MEMBER_NAME = "each";
+const TEST_MOCK_METHOD_NAMES = new Set([
+	"doMock",
+	"mock",
+	"unstable_mockModule"
+]);
+const TEST_RUNTIME_EXPORT_NAMES = new Set(["jest", "vi"]);
+const TEST_RUNTIME_MODULE_SOURCES = new Set([
+	"@jest/globals",
+	"bun:test",
+	"node:test",
+	"vitest"
+]);
+const REACT_MODULE_SOURCES = new Set([
+	"react",
+	"react/jsx-dev-runtime",
+	"react/jsx-runtime"
+]);
+const hasUnitTestFilename = (rawFilename) => {
+	if (!rawFilename) return false;
+	const filename = `/${rawFilename.replaceAll("\\", "/")}`;
+	const basename = filename.slice(filename.lastIndexOf("/") + 1);
+	return basename.includes(".test.") || basename.includes(".spec.") || filename.includes("/__tests__/") || filename.includes("/__test__/") || filename.includes("/__mocks__/");
+};
+const isExactImportedBinding = (identifier, expectedExportNames, context) => {
+	if (context.scopes.referenceFor(identifier)?.resolvedSymbol?.kind !== "import") return false;
+	const importBinding = getImportBindingForName(identifier, identifier.name);
+	return Boolean(importBinding && TEST_RUNTIME_MODULE_SOURCES.has(importBinding.source) && importBinding.exportedName && expectedExportNames.has(importBinding.exportedName));
+};
+const isRecognizedTestGlobal = (identifier, expectedNames, context) => hasUnitTestFilename(context.filename) && expectedNames.has(identifier.name) && context.scopes.isGlobalReference(identifier);
+const isRecognizedTestBinding = (identifier, expectedNames, context) => isExactImportedBinding(identifier, expectedNames, context) || isRecognizedTestGlobal(identifier, expectedNames, context);
+const getTestCallbackBaseIdentifier = (callee) => {
+	const unwrappedCallee = stripParenExpression(callee);
+	if (isNodeOfType(unwrappedCallee, "Identifier")) return unwrappedCallee;
+	if (isNodeOfType(unwrappedCallee, "MemberExpression")) {
+		const memberName = getStaticPropertyName(unwrappedCallee);
+		if (!memberName || !TEST_CALLBACK_MEMBER_NAMES.has(memberName)) return null;
+		return getTestCallbackBaseIdentifier(unwrappedCallee.object);
+	}
+	const tableBuilderCallee = isNodeOfType(unwrappedCallee, "CallExpression") ? stripParenExpression(unwrappedCallee.callee) : isNodeOfType(unwrappedCallee, "TaggedTemplateExpression") ? stripParenExpression(unwrappedCallee.tag) : null;
+	if (!isNodeOfType(tableBuilderCallee, "MemberExpression")) return null;
+	if (getStaticPropertyName(tableBuilderCallee) !== TEST_CALLBACK_TABLE_MEMBER_NAME) return null;
+	return getTestCallbackBaseIdentifier(tableBuilderCallee.object);
+};
+const isDirectTestCallback = (functionNode, context) => {
+	const callbackRoot = findTransparentExpressionRoot(functionNode);
+	const callExpression = callbackRoot.parent;
+	if (!callExpression || !isNodeOfType(callExpression, "CallExpression")) return false;
+	if (!callExpression.arguments.some((argument) => argument === callbackRoot)) return false;
+	const baseIdentifier = getTestCallbackBaseIdentifier(callExpression.callee);
+	return Boolean(baseIdentifier && isRecognizedTestBinding(baseIdentifier, TEST_CALLBACK_EXPORT_NAMES, context));
+};
+const isRecognizedMockFactoryCall = (callExpression, factoryRoot, context) => {
+	if (callExpression.arguments[1] !== factoryRoot) return false;
+	const moduleSpecifier = callExpression.arguments[0];
+	if (!moduleSpecifier || !isNodeOfType(moduleSpecifier, "Literal")) return false;
+	if (typeof moduleSpecifier.value !== "string") return false;
+	const callee = stripParenExpression(callExpression.callee);
+	if (!isNodeOfType(callee, "MemberExpression")) return false;
+	const methodName = getStaticPropertyName(callee);
+	if (!methodName || !TEST_MOCK_METHOD_NAMES.has(methodName)) return false;
+	const receiver = stripParenExpression(callee.object);
+	return isNodeOfType(receiver, "Identifier") && isRecognizedTestBinding(receiver, TEST_RUNTIME_EXPORT_NAMES, context);
+};
+const isInsideRecognizedMockFactory = (node, context) => {
+	let current = node.parent;
+	while (current) {
+		if (isFunctionLike$1(current)) {
+			const factoryRoot = findTransparentExpressionRoot(current);
+			const callExpression = factoryRoot.parent;
+			if (callExpression && isNodeOfType(callExpression, "CallExpression") && isRecognizedMockFactoryCall(callExpression, factoryRoot, context)) return true;
+		}
+		current = current.parent;
+	}
+	return false;
+};
+const hasImportedProductComponentAttributeAncestor = (node, enclosingFunction, context) => {
+	let current = node.parent;
+	let attributeAncestor = null;
+	if (current && isNodeOfType(current, "JSXElement") && current.openingElement === node) current = current.parent;
+	while (current && current !== enclosingFunction) {
+		if (isFunctionLike$1(current)) return false;
+		if (isNodeOfType(current, "JSXAttribute")) attributeAncestor = current;
+		if (isNodeOfType(current, "JSXElement")) {
+			const componentName = current.openingElement.name;
+			if (isNodeOfType(componentName, "JSXIdentifier")) {
+				const reference = context.scopes.referenceFor(componentName);
+				const importBinding = getImportBindingForName(componentName, componentName.name);
+				if (reference?.resolvedSymbol?.kind === "import" && importBinding && !REACT_MODULE_SOURCES.has(importBinding.source) && !isTestLibraryImportSource(importBinding.source) && attributeAncestor?.parent === current.openingElement && isNodeOfType(attributeAncestor.name, "JSXIdentifier") && attributeAncestor.name.name !== "children") return true;
+			}
+			attributeAncestor = null;
+		}
+		current = current.parent;
+	}
+	return false;
+};
+const isLocalTestScaffoldJsx = (node, context) => {
+	if (isInsideRecognizedMockFactory(node, context)) return true;
+	const enclosingFunction = findEnclosingFunction$1(node);
+	if (!enclosingFunction || !isDirectTestCallback(enclosingFunction, context)) return false;
+	return hasImportedProductComponentAttributeAncestor(node, enclosingFunction, context);
+};
+//#endregion
 //#region src/plugin/utils/object-has-accessible-child.ts
 const objectHasAccessibleChild = (jsxElement, settings) => {
 	for (const child of jsxElement.children) {
@@ -2267,6 +2671,7 @@ const altText = defineRule({
 		const inputImageAliases = new Set(settings["input[type=\"image\"]"] ?? []);
 		const fileHasJsxA11ySettings = hasJsxA11ySettings(context.settings);
 		return { JSXOpeningElement(node) {
+			if (isLocalTestScaffoldJsx(node, context)) return;
 			if (!fileHasJsxA11ySettings && isNodeOfType(node.name, "JSXIdentifier")) {
 				const rawName = node.name.name;
 				if (rawName !== "img" && rawName !== "object" && rawName !== "area" && rawName.toLowerCase() !== "input" && !imgAliases.has(rawName) && !objectAliases.has(rawName) && !areaAliases.has(rawName) && !inputImageAliases.has(rawName)) return;
@@ -3945,7 +4350,8 @@ const SECRET_VALUE_PATTERNS = [
 ];
 const JWT_LITERAL_VALUE_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{16,}\b/;
 const PUBLIC_ENV_SECRET_NAME_PATTERN = /\b(?:NEXT_PUBLIC|VITE|REACT_APP|EXPO_PUBLIC)_[A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PRIVATE|DATABASE_URL|SERVICE_ROLE|AWS_ACCESS_KEY|AWS_SECRET)[A-Z0-9_]*\b/i;
-const FULL_ENV_LEAK_CONTEXT_PATTERN = /\b(?:process\.env|import\.meta\.env|window\.__[A-Z0-9_]*ENV[A-Z0-9_]*__|__[A-Z0-9_]*ENV[A-Z0-9_]*__)\b/;
+const FULL_ENV_LEAK_CONTEXT_PATTERN = /\b(?:process\s*\.\s*env|import\s*\.\s*meta\s*\.\s*env|window\.__[A-Z0-9_]*ENV[A-Z0-9_]*__|__[A-Z0-9_]*ENV[A-Z0-9_]*__)\b/;
+const FULL_ENV_LEAK_COMMENT_TRIVIA_PATTERN = /\b(?:(?:process|window)\s*(?:\/[*/]|<!--|-->|\.\s*(?:\/[*/]|<!--|-->))|import\s*(?:\/[*/]|<!--|-->|\.\s*(?:\/[*/]|<!--|-->|meta\s*(?:\/[*/]|<!--|-->|\.\s*(?:\/[*/]|<!--|-->)))))/;
 const FULL_ENV_LEAK_SECRET_NAME_PATTERN = /\b(?:DATABASE_URL|AWS_SECRET_ACCESS_KEY|AWS_ACCESS_KEY_ID|MAILGUN_API_KEY|SALESFORCE_CLIENT_SECRET|OKTA_CLIENT_SECRET|SESSION_SECRET|COOKIE_SECRET|PRIVATE_KEY|SERVICE_ROLE)\b/;
 const TRUSTED_PUBLIC_SECRET_NAME_PATTERN = /(?:SENTRY_DSN|PUBLIC_KEY|PUBLISHABLE|ANON_KEY|POSTHOG_(?:PROJECT_)?TOKEN|POSTHOG_KEY|TLDRAW_LICENSE_KEY|CLERK_PUBLISHABLE_KEY|ALGOLIA_SEARCH_KEY|GC_API_KEY|GOOGLE_MAPS_API_KEY|MAPBOX_TOKEN|MIXPANEL_TOKEN|FACEBOOK_CLIENT_TOKEN|(?:NEXT_PUBLIC|VITE|REACT_APP|EXPO_PUBLIC)_(?:DISABLE|ENABLE|ALLOW|REQUIRE)_)|(?:TOKEN|SECRET|PASSWORD|PRIVATE)_(?:KIND|TYPE|URL|URI|ENDPOINT|HEADER|NAME)$/i;
 const PUBLIC_CLIENT_KEY_PATTERNS = [
@@ -4103,6 +4509,172 @@ const findSuspiciousPublicEnvSecretNamePattern = (content) => {
 //#region src/plugin/rules/security-scan/utils/has-full-env-leak-shape.ts
 const hasFullEnvLeakShape = (content) => FULL_ENV_LEAK_CONTEXT_PATTERN.test(content) && FULL_ENV_LEAK_SECRET_NAME_PATTERN.test(content);
 //#endregion
+//#region src/plugin/utils/attach-parent-references.ts
+const attachParentReferences = (root) => {
+	const visit = (node, parent) => {
+		const writableNode = node;
+		writableNode.parent = parent;
+		const nodeRecord = node;
+		for (const key of Object.keys(nodeRecord)) {
+			if (key === "parent") continue;
+			const child = nodeRecord[key];
+			if (Array.isArray(child)) {
+				for (const item of child) if (isAstNode(item)) visit(item, node);
+			} else if (isAstNode(child)) visit(child, node);
+		}
+	};
+	visit(root, null);
+};
+//#endregion
+//#region src/plugin/utils/cross-file-probe-recorder.ts
+let activeProbeTrace = null;
+const recordExistenceProbe = (absolutePath) => {
+	activeProbeTrace?.existencePaths.add(absolutePath);
+};
+const recordContentProbe = (absolutePath) => {
+	activeProbeTrace?.contentPaths.add(absolutePath);
+};
+const isProbeRecorderActive = () => activeProbeTrace !== null;
+const collectCrossFileProbes = (collect) => {
+	const previousTrace = activeProbeTrace;
+	const trace = {
+		existencePaths: /* @__PURE__ */ new Set(),
+		contentPaths: /* @__PURE__ */ new Set()
+	};
+	activeProbeTrace = trace;
+	try {
+		collect();
+	} finally {
+		activeProbeTrace = previousTrace;
+	}
+	return trace;
+};
+//#endregion
+//#region src/plugin/utils/parse-source-file.ts
+const FILENAME_TO_LANG = {
+	".ts": "ts",
+	".tsx": "tsx",
+	".js": "js",
+	".jsx": "jsx",
+	".mjs": "js",
+	".cjs": "js",
+	".mts": "ts",
+	".cts": "ts"
+};
+const resolveLang = (filename) => {
+	return FILENAME_TO_LANG[path.extname(filename).toLowerCase()] ?? "tsx";
+};
+const parseSourceText = ({ filename, sourceText, shouldAttachParentReferences = true }) => {
+	try {
+		const result = parseSync(filename, sourceText, {
+			astType: "ts",
+			lang: resolveLang(filename)
+		});
+		if (result.errors.some((parseError) => parseError.severity === "Error")) return null;
+		const parsedProgram = result.program;
+		if (shouldAttachParentReferences) attachParentReferences(parsedProgram);
+		return parsedProgram;
+	} catch {
+		return null;
+	}
+};
+const parseCache = /* @__PURE__ */ new Map();
+const parseSourceFile = (absoluteFilePath) => {
+	if (!(absoluteFilePath.endsWith(".d.ts") || absoluteFilePath.endsWith(".d.mts") || absoluteFilePath.endsWith(".d.cts"))) recordContentProbe(absoluteFilePath);
+	let fileStat;
+	try {
+		fileStat = fs.statSync(absoluteFilePath);
+	} catch {
+		return null;
+	}
+	if (!fileStat.isFile()) return null;
+	if (fileStat.size > 2e6) return null;
+	const cached = parseCache.get(absoluteFilePath);
+	if (cached && cached.mtimeMs === fileStat.mtimeMs && cached.size === fileStat.size) return cached.program;
+	if (absoluteFilePath.endsWith(".d.ts") || absoluteFilePath.endsWith(".d.mts") || absoluteFilePath.endsWith(".d.cts")) {
+		parseCache.set(absoluteFilePath, {
+			mtimeMs: fileStat.mtimeMs,
+			size: fileStat.size,
+			program: null
+		});
+		return null;
+	}
+	let sourceText;
+	try {
+		sourceText = fs.readFileSync(absoluteFilePath, "utf8");
+	} catch {
+		parseCache.set(absoluteFilePath, {
+			mtimeMs: fileStat.mtimeMs,
+			size: fileStat.size,
+			program: null
+		});
+		return null;
+	}
+	const parsedProgram = parseSourceText({
+		filename: absoluteFilePath,
+		sourceText
+	});
+	parseCache.set(absoluteFilePath, {
+		mtimeMs: fileStat.mtimeMs,
+		size: fileStat.size,
+		program: parsedProgram
+	});
+	return parsedProgram;
+};
+//#endregion
+//#region src/plugin/rules/security-scan/utils/mask-source-comments.ts
+const SOURCE_FILE_EXTENSION_PATTERN$1 = /\.(?:[cm]?[jt]sx?)$/i;
+const POSSIBLE_SOURCE_COMMENT_PATTERN = /\/\/|\/\*|<!--/;
+const LINE_TERMINATORS = new Set([
+	"\r",
+	"\n",
+	"\u2028",
+	"\u2029"
+]);
+const hasPossibleAnnexBClosingComment = (content) => {
+	let searchIndex = 0;
+	while (searchIndex < content.length) {
+		const closingCommentIndex = content.indexOf("-->", searchIndex);
+		if (closingCommentIndex === -1) return false;
+		let prefixIndex = closingCommentIndex - 1;
+		while (prefixIndex >= 0 && !LINE_TERMINATORS.has(content[prefixIndex] ?? "")) {
+			if (content[prefixIndex]?.trim() !== "") break;
+			prefixIndex -= 1;
+		}
+		if (prefixIndex < 0 || LINE_TERMINATORS.has(content[prefixIndex] ?? "")) return true;
+		searchIndex = closingCommentIndex + 3;
+	}
+	return false;
+};
+const maskSourceComments = (relativePath, content) => {
+	if (!SOURCE_FILE_EXTENSION_PATTERN$1.test(relativePath)) return content;
+	if (!content.startsWith("#!") && !POSSIBLE_SOURCE_COMMENT_PATTERN.test(content) && !hasPossibleAnnexBClosingComment(content)) return content;
+	try {
+		const result = parseSync(relativePath, content, {
+			astType: "ts",
+			lang: resolveLang(relativePath)
+		});
+		if (result.errors.some((parseError) => parseError.severity === "Error")) return void 0;
+		const firstLineTerminatorIndex = content.search(/[\r\n\u2028\u2029]/);
+		const ignoredRanges = [...content.startsWith("#!") ? [{
+			start: 0,
+			end: firstLineTerminatorIndex === -1 ? content.length : firstLineTerminatorIndex
+		}] : [], ...result.comments];
+		if (ignoredRanges.length === 0) return content;
+		const contentParts = [];
+		let previousEnd = 0;
+		for (const ignoredRange of ignoredRanges) {
+			contentParts.push(content.slice(previousEnd, ignoredRange.start));
+			contentParts.push(content.slice(ignoredRange.start, ignoredRange.end).replace(/[^\r\n\u2028\u2029]/g, " "));
+			previousEnd = ignoredRange.end;
+		}
+		contentParts.push(content.slice(previousEnd));
+		return contentParts.join("");
+	} catch {
+		return;
+	}
+};
+//#endregion
 //#region src/plugin/rules/security-scan/utils/scan-artifact-leak.ts
 const scanArtifactLeak = (file, findLeakPattern, message) => {
 	if (DOCUMENTATION_CONTEXT_PATTERN.test(file.relativePath)) return [];
@@ -4118,12 +4690,39 @@ const scanArtifactLeak = (file, findLeakPattern, message) => {
 };
 //#endregion
 //#region src/plugin/rules/security-scan/artifact-env-leak.ts
+const ARTIFACT_ENV_LEAK_MESSAGE = "A browser artifact contains server-secret environment names or a full environment dump shape.";
+const findArtifactEnvLeakPattern = (content) => findSuspiciousPublicEnvSecretNamePattern(content) ?? (hasFullEnvLeakShape(content) ? FULL_ENV_LEAK_SECRET_NAME_PATTERN : void 0);
 const artifactEnvLeak = defineRule({
 	id: "artifact-env-leak",
 	title: "Server env leaked to browser artifact",
 	severity: "error",
 	recommendation: "Treat public env prefixes as publication, not secrecy; keep secret env vars server-only and rebuild after rotating leaked keys.",
-	scan: (file) => scanArtifactLeak(file, (content) => findSuspiciousPublicEnvSecretNamePattern(content) ?? (hasFullEnvLeakShape(content) ? FULL_ENV_LEAK_SECRET_NAME_PATTERN : void 0), "A browser artifact contains server-secret environment names or a full environment dump shape.")
+	scan: (file) => {
+		let isRawCandidateExact = false;
+		const findRawCandidatePattern = (content) => {
+			const suspiciousPublicNamePattern = findSuspiciousPublicEnvSecretNamePattern(content);
+			if (suspiciousPublicNamePattern) {
+				isRawCandidateExact = true;
+				return suspiciousPublicNamePattern;
+			}
+			if (!FULL_ENV_LEAK_SECRET_NAME_PATTERN.test(content)) return void 0;
+			if (FULL_ENV_LEAK_CONTEXT_PATTERN.test(content)) {
+				isRawCandidateExact = true;
+				return FULL_ENV_LEAK_SECRET_NAME_PATTERN;
+			}
+			return FULL_ENV_LEAK_COMMENT_TRIVIA_PATTERN.test(content) ? FULL_ENV_LEAK_SECRET_NAME_PATTERN : void 0;
+		};
+		const rawCandidateFindings = scanArtifactLeak(file, findRawCandidatePattern, ARTIFACT_ENV_LEAK_MESSAGE);
+		if (rawCandidateFindings.length === 0) return rawCandidateFindings;
+		const rawFindings = isRawCandidateExact ? rawCandidateFindings : scanArtifactLeak(file, findArtifactEnvLeakPattern, ARTIFACT_ENV_LEAK_MESSAGE);
+		const executableContent = maskSourceComments(file.relativePath, file.content);
+		if (executableContent === void 0) return rawCandidateFindings;
+		if (executableContent === file.content) return rawFindings;
+		return scanArtifactLeak({
+			...file,
+			content: executableContent
+		}, findArtifactEnvLeakPattern, ARTIFACT_ENV_LEAK_MESSAGE);
+	}
 });
 //#endregion
 //#region src/plugin/rules/security-scan/artifact-secret-leak.ts
@@ -4135,252 +4734,6 @@ const artifactSecretLeak = defineRule({
 	scan: (file) => scanArtifactLeak(file, (content) => SECRET_VALUE_PATTERNS.find((pattern) => pattern.test(content)), "A browser-delivered artifact contains a secret-looking credential value.")
 });
 //#endregion
-//#region src/plugin/constants/js.ts
-const LOOP_TYPES = [
-	"ForStatement",
-	"ForInStatement",
-	"ForOfStatement",
-	"WhileStatement",
-	"DoWhileStatement"
-];
-const FUNCTION_LIKE_TYPES = new Set([
-	"FunctionDeclaration",
-	"FunctionExpression",
-	"ArrowFunctionExpression"
-]);
-const BUILTIN_GLOBAL_NAMESPACE_NAMES = new Set([
-	"Math",
-	"Date",
-	"JSON",
-	"Object",
-	"Array",
-	"Number",
-	"String",
-	"Boolean",
-	"RegExp",
-	"Symbol",
-	"BigInt",
-	"Reflect"
-]);
-const MUTATING_ARRAY_METHODS = new Set([
-	"push",
-	"pop",
-	"shift",
-	"unshift",
-	"splice",
-	"sort",
-	"reverse",
-	"fill",
-	"copyWithin"
-]);
-const MUTATING_COLLECTION_METHODS = new Set([
-	"add",
-	"clear",
-	"delete",
-	"set"
-]);
-const CHAINABLE_ITERATION_METHODS = new Set([
-	"map",
-	"filter",
-	"forEach",
-	"flatMap"
-]);
-const ITERATOR_PRODUCING_METHOD_NAMES = new Set([
-	"values",
-	"keys",
-	"entries"
-]);
-const BROWSER_TEST_FILE_PATTERN = /\.browser\.[cm]?[jt]sx?$/;
-const TEST_LIBRARY_IMPORT_SOURCES = new Set([
-	"vitest",
-	"jest",
-	"mocha",
-	"chai",
-	"sinon",
-	"expect",
-	"ava",
-	"uvu",
-	"node:test",
-	"bun:test",
-	"@testing-library/react",
-	"@testing-library/react-native",
-	"@testing-library/react-hooks",
-	"@testing-library/dom",
-	"@testing-library/user-event",
-	"@testing-library/jest-dom",
-	"@testing-library/vue",
-	"@testing-library/svelte",
-	"@testing-library/preact",
-	"@testing-library/cypress",
-	"playwright",
-	"playwright-core",
-	"@playwright/test",
-	"@playwright/experimental-ct-react",
-	"@playwright/experimental-ct-react17",
-	"cypress",
-	"@cypress/react",
-	"@cypress/react18",
-	"@storybook/test",
-	"@storybook/test-runner",
-	"@storybook/testing-library",
-	"@storybook/jest",
-	"puppeteer",
-	"puppeteer-core",
-	"webdriverio",
-	"@wdio/globals",
-	"@nuxt/test-utils"
-]);
-const TEST_LIBRARY_IMPORT_SOURCE_PREFIXES = [
-	"vitest/",
-	"@vitest/",
-	"@jest/",
-	"@testing-library/",
-	"@playwright/",
-	"@storybook/test/",
-	"@storybook/test-runner/",
-	"@storybook/testing-library/",
-	"@cypress/",
-	"@nuxt/test-utils/"
-];
-const ORDERED_UI_FLOW_CALLEE_NAMES = new Set([
-	"render",
-	"rerender",
-	"renderHook",
-	"renderToString",
-	"renderToStaticMarkup",
-	"act",
-	"click",
-	"dblClick",
-	"dblclick",
-	"tripleClick",
-	"tap",
-	"press",
-	"longPress",
-	"type",
-	"clear",
-	"fill",
-	"focus",
-	"blur",
-	"hover",
-	"unhover",
-	"check",
-	"uncheck",
-	"selectOption",
-	"selectOptions",
-	"setChecked",
-	"setInputFiles",
-	"scrollIntoViewIfNeeded",
-	"dragTo",
-	"dragAndDrop",
-	"drop",
-	"evaluate",
-	"evaluateHandle",
-	"waitFor",
-	"waitForLoadState",
-	"waitForSelector",
-	"waitForURL",
-	"waitForResponse",
-	"waitForRequest",
-	"waitForEvent",
-	"waitForFunction",
-	"waitForElementToBeRemoved",
-	"goto",
-	"goBack",
-	"goForward",
-	"reload",
-	"screenshot",
-	"snapshot",
-	"toMatchSnapshot",
-	"toMatchInlineSnapshot",
-	"expect",
-	"expectTypeOf",
-	"step",
-	"describe",
-	"test",
-	"it",
-	"beforeAll",
-	"beforeEach",
-	"afterAll",
-	"afterEach",
-	"play",
-	"userEvent",
-	"screen",
-	"within"
-]);
-const ORDERED_UI_FLOW_CALLEE_PREFIXES = ["findBy", "findAllBy"];
-const INTENTIONAL_SEQUENCING_CALLEE_NAMES = new Set([
-	"sleep",
-	"delay",
-	"wait",
-	"pause",
-	"throttle",
-	"debounce",
-	"tick",
-	"nextTick",
-	"advanceTimersByTime",
-	"advanceTimersByTimeAsync",
-	"runAllTimers",
-	"runAllTimersAsync",
-	"runOnlyPendingTimers",
-	"runOnlyPendingTimersAsync",
-	"setTimeout",
-	"setInterval",
-	"setImmediate",
-	"queueMicrotask",
-	"requestAnimationFrame",
-	"requestIdleCallback",
-	"animate",
-	"transition",
-	"spring",
-	"tween",
-	"stagger",
-	"sequence",
-	"timeline",
-	"scrub",
-	"query",
-	"execute",
-	"exec",
-	"raw",
-	"transaction",
-	"$transaction",
-	"$executeRaw",
-	"$queryRaw",
-	"$executeRawUnsafe",
-	"$queryRawUnsafe",
-	"begin",
-	"commit",
-	"rollback",
-	"savepoint",
-	"lock",
-	"unlock",
-	"spawn",
-	"spawnSync",
-	"execSync",
-	"execFile",
-	"execFileSync",
-	"fork",
-	"$",
-	"sh",
-	"mkdir",
-	"rmdir",
-	"rename",
-	"rm",
-	"unlink",
-	"writeFile",
-	"appendFile",
-	"copyFile",
-	"navigate",
-	"goto",
-	"waitForNavigation",
-	"waitForURL",
-	"waitForLoadState",
-	"waitForResponse",
-	"waitForRequest",
-	"waitForSelector",
-	"waitForFunction",
-	"waitForEvent"
-]);
-//#endregion
 //#region src/plugin/constants/ts-type-position-keys.ts
 const TYPE_POSITION_CHILD_KEYS = new Set([
 	"implements",
@@ -4506,13 +4859,6 @@ const containsDirectAwait = (node) => {
 	return foundAwait;
 };
 //#endregion
-//#region src/plugin/utils/find-transparent-expression-root.ts
-const findTransparentExpressionRoot = (node) => {
-	let current = node;
-	while (current.parent && TRANSPARENT_EXPRESSION_WRAPPER_TYPES.has(current.parent.type)) current = current.parent;
-	return current;
-};
-//#endregion
 //#region src/plugin/utils/get-static-property-key-name.ts
 const getStaticPropertyKeyName = (node, options = {}) => {
 	if (!isNodeOfType(node, "Property") && !isNodeOfType(node, "MethodDefinition") && !isNodeOfType(node, "MemberExpression")) return null;
@@ -4772,16 +5118,6 @@ const hasStaticPropertyWriteBefore = (identifier, propertyName, referenceNode, s
 	return getEquivalentSymbols(identifier, scopes).some((symbol) => symbolHasStaticPropertyWriteBefore(symbol, propertyName, referenceNode, scopes));
 };
 //#endregion
-//#region src/plugin/utils/find-enclosing-function.ts
-const findEnclosingFunction$1 = (node) => {
-	let cursor = node.parent;
-	while (cursor) {
-		if (isFunctionLike$1(cursor)) return cursor;
-		cursor = cursor.parent ?? null;
-	}
-	return null;
-};
-//#endregion
 //#region src/plugin/utils/has-symbol-write-before.ts
 const hasSymbolWriteBefore = (symbol, referenceNode, scopes) => symbol.references.some((reference) => {
 	if (reference.flag === "read") return false;
@@ -6283,13 +6619,6 @@ const getCalleeIdentifierTrail = (call) => {
 	return trail;
 };
 //#endregion
-//#region src/plugin/utils/is-test-library-import-source.ts
-const isTestLibraryImportSource = (source) => {
-	if (typeof source !== "string" || source.length === 0) return false;
-	if (TEST_LIBRARY_IMPORT_SOURCES.has(source)) return true;
-	return TEST_LIBRARY_IMPORT_SOURCE_PREFIXES.some((prefix) => source.startsWith(prefix));
-};
-//#endregion
 //#region src/plugin/rules/js-performance/async-parallel.ts
 const getAwaitedCall = (statement) => {
 	if (isNodeOfType(statement, "VariableDeclaration")) {
@@ -8251,7 +8580,27 @@ const collectFunctionReturnStatements = (functionNode) => {
 //#region src/plugin/utils/statement-always-exits.ts
 const statementAlwaysExits = (statement) => {
 	if (isNodeOfType(statement, "ReturnStatement") || isNodeOfType(statement, "ThrowStatement")) return true;
-	if (isNodeOfType(statement, "IfStatement")) return Boolean(statement.alternate && statementAlwaysExits(statement.consequent) && statementAlwaysExits(statement.alternate));
+	if (isNodeOfType(statement, "IfStatement")) {
+		if (isNodeOfType(statement.test, "Literal")) {
+			const reachableBranch = statement.test.value ? statement.consequent : statement.alternate;
+			return reachableBranch ? statementAlwaysExits(reachableBranch) : false;
+		}
+		return Boolean(statement.alternate && statementAlwaysExits(statement.consequent) && statementAlwaysExits(statement.alternate));
+	}
+	if (isNodeOfType(statement, "TryStatement")) {
+		if (statement.finalizer && statementAlwaysExits(statement.finalizer)) return true;
+		if (!statementAlwaysExits(statement.block)) return false;
+		return statement.handler ? statementAlwaysExits(statement.handler.body) : true;
+	}
+	if (isNodeOfType(statement, "DoWhileStatement")) return statementAlwaysExits(statement.body);
+	if (isNodeOfType(statement, "WhileStatement")) {
+		const whileStatementTest = statement.test;
+		return Boolean(isNodeOfType(whileStatementTest, "Literal") && whileStatementTest.value && statementAlwaysExits(statement.body));
+	}
+	if (isNodeOfType(statement, "ForStatement")) {
+		const forStatementTest = statement.test;
+		return Boolean((!forStatementTest || isNodeOfType(forStatementTest, "Literal") && forStatementTest.value) && statementAlwaysExits(statement.body));
+	}
 	if (!isNodeOfType(statement, "BlockStatement")) return false;
 	return statement.body.some((childStatement) => statementAlwaysExits(childStatement));
 };
@@ -8936,119 +9285,6 @@ const findReExportTargetsForName = (programRoot, exportedName) => {
 	return exportAllTargets;
 };
 //#endregion
-//#region src/plugin/utils/attach-parent-references.ts
-const attachParentReferences = (root) => {
-	const visit = (node, parent) => {
-		const writableNode = node;
-		writableNode.parent = parent;
-		const nodeRecord = node;
-		for (const key of Object.keys(nodeRecord)) {
-			if (key === "parent") continue;
-			const child = nodeRecord[key];
-			if (Array.isArray(child)) {
-				for (const item of child) if (isAstNode(item)) visit(item, node);
-			} else if (isAstNode(child)) visit(child, node);
-		}
-	};
-	visit(root, null);
-};
-//#endregion
-//#region src/plugin/utils/cross-file-probe-recorder.ts
-let activeProbeTrace = null;
-const recordExistenceProbe = (absolutePath) => {
-	activeProbeTrace?.existencePaths.add(absolutePath);
-};
-const recordContentProbe = (absolutePath) => {
-	activeProbeTrace?.contentPaths.add(absolutePath);
-};
-const isProbeRecorderActive = () => activeProbeTrace !== null;
-const collectCrossFileProbes = (collect) => {
-	const previousTrace = activeProbeTrace;
-	const trace = {
-		existencePaths: /* @__PURE__ */ new Set(),
-		contentPaths: /* @__PURE__ */ new Set()
-	};
-	activeProbeTrace = trace;
-	try {
-		collect();
-	} finally {
-		activeProbeTrace = previousTrace;
-	}
-	return trace;
-};
-//#endregion
-//#region src/plugin/utils/parse-source-file.ts
-const FILENAME_TO_LANG = {
-	".ts": "ts",
-	".tsx": "tsx",
-	".js": "js",
-	".jsx": "jsx",
-	".mjs": "js",
-	".cjs": "js",
-	".mts": "ts",
-	".cts": "ts"
-};
-const resolveLang = (filename) => {
-	return FILENAME_TO_LANG[path.extname(filename).toLowerCase()] ?? "tsx";
-};
-const parseSourceText = ({ filename, sourceText, shouldAttachParentReferences = true }) => {
-	try {
-		const result = parseSync(filename, sourceText, {
-			astType: "ts",
-			lang: resolveLang(filename)
-		});
-		if (result.errors.some((parseError) => parseError.severity === "Error")) return null;
-		const parsedProgram = result.program;
-		if (shouldAttachParentReferences) attachParentReferences(parsedProgram);
-		return parsedProgram;
-	} catch {
-		return null;
-	}
-};
-const parseCache = /* @__PURE__ */ new Map();
-const parseSourceFile = (absoluteFilePath) => {
-	if (!(absoluteFilePath.endsWith(".d.ts") || absoluteFilePath.endsWith(".d.mts") || absoluteFilePath.endsWith(".d.cts"))) recordContentProbe(absoluteFilePath);
-	let fileStat;
-	try {
-		fileStat = fs.statSync(absoluteFilePath);
-	} catch {
-		return null;
-	}
-	if (!fileStat.isFile()) return null;
-	if (fileStat.size > 2e6) return null;
-	const cached = parseCache.get(absoluteFilePath);
-	if (cached && cached.mtimeMs === fileStat.mtimeMs && cached.size === fileStat.size) return cached.program;
-	if (absoluteFilePath.endsWith(".d.ts") || absoluteFilePath.endsWith(".d.mts") || absoluteFilePath.endsWith(".d.cts")) {
-		parseCache.set(absoluteFilePath, {
-			mtimeMs: fileStat.mtimeMs,
-			size: fileStat.size,
-			program: null
-		});
-		return null;
-	}
-	let sourceText;
-	try {
-		sourceText = fs.readFileSync(absoluteFilePath, "utf8");
-	} catch {
-		parseCache.set(absoluteFilePath, {
-			mtimeMs: fileStat.mtimeMs,
-			size: fileStat.size,
-			program: null
-		});
-		return null;
-	}
-	const parsedProgram = parseSourceText({
-		filename: absoluteFilePath,
-		sourceText
-	});
-	parseCache.set(absoluteFilePath, {
-		mtimeMs: fileStat.mtimeMs,
-		size: fileStat.size,
-		program: parsedProgram
-	});
-	return parsedProgram;
-};
-//#endregion
 //#region src/plugin/utils/resolve-relative-import-path.ts
 const MODULE_FILE_EXTENSIONS = [
 	".ts",
@@ -10370,10 +10606,10 @@ const controlHasAssociatedLabel = defineRule({
 				if (isTestlikeFile) return;
 				const opening = node.openingElement;
 				const tagName = getElementType(opening, context.settings);
-				if (tagName === LABEL_ELEMENT && hasAccessibleLabelText(node, checkContext) && !isInsideJsxAttribute(node)) {
+				if (rendersLabelElement(tagName, opening) && hasAccessibleLabelText(node, checkContext) && !isInsideJsxAttribute(node)) {
 					const htmlForAttribute = hasJsxPropIgnoreCase(opening.attributes, HTML_FOR_ATTRIBUTE);
 					for (const htmlForKey of getAttributeMatchKeys(htmlForAttribute)) labelHtmlForKeys.add(htmlForKey);
-					collectLabelEmbeddedNames(node, 1, checkContext, labelEmbeddedNames);
+					if (tagName === LABEL_ELEMENT) collectLabelEmbeddedNames(node, 1, checkContext, labelEmbeddedNames);
 				}
 				if (DEFAULT_IGNORE_ELEMENTS.includes(tagName)) return;
 				if (settings.ignoreElements.includes(tagName)) return;
@@ -10459,6 +10695,1048 @@ const findMatchingBracket = (content, openIndex) => {
 	return -1;
 };
 //#endregion
+//#region src/plugin/utils/get-node-end-index.ts
+const getNodeEndIndex = (node) => "end" in node && typeof node.end === "number" ? node.end : -1;
+//#endregion
+//#region src/plugin/utils/get-node-start-index.ts
+const getNodeStartIndex = (node) => "start" in node && typeof node.start === "number" ? node.start : -1;
+//#endregion
+//#region src/plugin/utils/get-import-declaration-for-symbol.ts
+const getImportDeclarationForSymbol = (symbol) => {
+	if (symbol.kind !== "import") return null;
+	const importDeclaration = symbol.declarationNode.parent;
+	return isNodeOfType(importDeclaration, "ImportDeclaration") ? importDeclaration : null;
+};
+//#endregion
+//#region src/plugin/constants/mutation-methods.ts
+const OBJECT_PROPERTY_MUTATION_METHOD_NAMES = new Set([
+	"assign",
+	"defineProperties",
+	"defineProperty"
+]);
+const REFLECT_PROPERTY_MUTATION_METHOD_NAMES = new Set(["defineProperty", "set"]);
+//#endregion
+//#region src/plugin/rules/security-scan/utils/get-symbol-mutation-inspector.ts
+const inspectorCache = /* @__PURE__ */ new WeakMap();
+const getOutermostTarget = (node) => {
+	let current = findTransparentExpressionRoot(node);
+	while (current.parent) {
+		const parent = current.parent;
+		if (!isNodeOfType(parent, "MemberExpression") || parent.object !== current) break;
+		current = findTransparentExpressionRoot(parent);
+	}
+	return current;
+};
+const getExecutionOwner = (node) => {
+	let current = node;
+	while (current) {
+		if (isFunctionLike$1(current) || isNodeOfType(current, "Program")) return current;
+		current = current.parent;
+	}
+	return node;
+};
+const isAbruptCompletionStatement = (node, includesContinue) => {
+	if (isNodeOfType(node, "ReturnStatement") || isNodeOfType(node, "ThrowStatement") || isNodeOfType(node, "BreakStatement") || includesContinue && isNodeOfType(node, "ContinueStatement")) return true;
+	if (isNodeOfType(node, "BlockStatement")) return node.body.some((statement) => isAbruptCompletionStatement(statement, includesContinue));
+	if (!isNodeOfType(node, "IfStatement")) return false;
+	if (isNodeOfType(node.test, "Literal")) {
+		const reachableBranch = node.test.value ? node.consequent : node.alternate;
+		return reachableBranch ? isAbruptCompletionStatement(reachableBranch, includesContinue) : false;
+	}
+	return Boolean(node.alternate && isAbruptCompletionStatement(node.consequent, includesContinue) && isAbruptCompletionStatement(node.alternate, includesContinue));
+};
+const isTerminalStatement = (node) => isAbruptCompletionStatement(node, true);
+const isAfterTerminalStatement = (node, statements) => {
+	const statementIndex = statements.indexOf(node);
+	return statementIndex > 0 && statements.slice(0, statementIndex).some(isTerminalStatement);
+};
+const isStaticallyUnreachable = (node, owner) => {
+	let current = node;
+	while (current.parent && current !== owner) {
+		const parent = current.parent;
+		if ((isNodeOfType(parent, "BlockStatement") || isNodeOfType(parent, "Program")) && isAfterTerminalStatement(current, parent.body)) return true;
+		if ((isNodeOfType(parent, "WhileStatement") && isNodeOfType(parent.test, "Literal") && !parent.test.value || isNodeOfType(parent, "ForStatement") && parent.test && isNodeOfType(parent.test, "Literal") && !parent.test.value) && parent.body === current) return true;
+		if (isNodeOfType(parent, "SwitchCase") && isAfterTerminalStatement(current, parent.consequent)) return true;
+		if (isNodeOfType(parent, "IfStatement") && isNodeOfType(parent.test, "Literal")) {
+			if (parent.test.value === false && parent.consequent === current) return true;
+			if (parent.test.value === true && parent.alternate === current) return true;
+		}
+		if (isNodeOfType(parent, "ConditionalExpression") && isNodeOfType(parent.test, "Literal")) {
+			if (parent.test.value === false && parent.consequent === current) return true;
+			if (parent.test.value === true && parent.alternate === current) return true;
+		}
+		if (isNodeOfType(parent, "LogicalExpression") && parent.right === current && isNodeOfType(parent.left, "Literal")) {
+			if (parent.operator === "&&" && !parent.left.value) return true;
+			if (parent.operator === "||" && Boolean(parent.left.value)) return true;
+		}
+		current = parent;
+	}
+	return false;
+};
+const isConditionallyExecuted = (node, owner) => {
+	let current = node;
+	while (current.parent && current !== owner) {
+		const parent = current.parent;
+		if (isNodeOfType(parent, "IfStatement")) {
+			if (!isNodeOfType(parent.test, "Literal")) return true;
+			if (parent.test.value === true && parent.alternate === current) return true;
+			if (parent.test.value === false && parent.consequent === current) return true;
+		}
+		if (isNodeOfType(parent, "ConditionalExpression")) {
+			if (!isNodeOfType(parent.test, "Literal")) return true;
+			if (parent.test.value === true && parent.alternate === current) return true;
+			if (parent.test.value === false && parent.consequent === current) return true;
+		}
+		if (isNodeOfType(parent, "LogicalExpression") && parent.right === current) {
+			if (!isNodeOfType(parent.left, "Literal")) return true;
+			if (parent.operator === "&&" && !parent.left.value) return true;
+			if (parent.operator === "||" && Boolean(parent.left.value)) return true;
+		}
+		if (isNodeOfType(parent, "DoWhileStatement")) {
+			if (!(parent.body === current && isNodeOfType(parent.test, "Literal") && !parent.test.value)) return true;
+		}
+		if (isNodeOfType(parent, "TryStatement") && parent.block === current) return true;
+		if (isNodeOfType(parent, "ForStatement") || isNodeOfType(parent, "ForInStatement") || isNodeOfType(parent, "ForOfStatement") || isNodeOfType(parent, "WhileStatement") || isNodeOfType(parent, "SwitchCase") || isNodeOfType(parent, "CatchClause")) return true;
+		if ((isNodeOfType(parent, "CallExpression") || isNodeOfType(parent, "MemberExpression")) && parent.optional) return true;
+		current = parent;
+	}
+	return false;
+};
+const getSymbolMutationInspector = (scopes) => {
+	const cached = inspectorCache.get(scopes);
+	if (cached) return cached;
+	const isGlobalNamespaceMethod = (node, namespaceName, methodNames) => {
+		const callee = stripParenExpression(node);
+		if (!isNodeOfType(callee, "MemberExpression")) return false;
+		const receiver = stripParenExpression(callee.object);
+		return Boolean(isNodeOfType(receiver, "Identifier") && receiver.name === namespaceName && scopes.isGlobalReference(receiver) && methodNames.has(getStaticPropertyName(callee) ?? ""));
+	};
+	const getObjectExpressionPropertyNames = (node) => {
+		const expression = stripParenExpression(node);
+		if (!isNodeOfType(expression, "ObjectExpression")) return null;
+		const propertyNames = /* @__PURE__ */ new Set();
+		for (const property of expression.properties) {
+			if (!isNodeOfType(property, "Property")) return null;
+			const propertyName = getStaticPropertyKeyName(property, { allowComputedString: true });
+			if (propertyName === null) return null;
+			propertyNames.add(propertyName);
+		}
+		return propertyNames;
+	};
+	const getMutationPropertyNames = (node) => {
+		const target = getOutermostTarget(node);
+		const parent = target.parent;
+		if (!parent) return void 0;
+		if (isNodeOfType(parent, "AssignmentExpression") && parent.left === target || isNodeOfType(parent, "UpdateExpression") && parent.argument === target || isNodeOfType(parent, "UnaryExpression") && parent.operator === "delete") {
+			if (!isNodeOfType(target, "MemberExpression")) return null;
+			const propertyName = getStaticPropertyName(target);
+			return propertyName === null ? null : new Set([propertyName]);
+		}
+		if (!isNodeOfType(parent, "CallExpression") || parent.arguments[0] !== target) return void 0;
+		if (isGlobalNamespaceMethod(parent.callee, "Object", OBJECT_PROPERTY_MUTATION_METHOD_NAMES)) {
+			const callee = stripParenExpression(parent.callee);
+			if (!isNodeOfType(callee, "MemberExpression")) return void 0;
+			const methodName = getStaticPropertyName(callee);
+			if (methodName === "assign") {
+				const assignedProperties = parent.arguments.slice(1).map(getObjectExpressionPropertyNames);
+				if (assignedProperties.some((properties) => properties === null)) return null;
+				return new Set(assignedProperties.flatMap((properties) => [...properties ?? []]));
+			}
+			if (methodName === "defineProperties") {
+				const propertyDescriptors = parent.arguments[1];
+				return propertyDescriptors ? getObjectExpressionPropertyNames(propertyDescriptors) : null;
+			}
+			const propertyKey = parent.arguments[1];
+			return propertyKey && isNodeOfType(propertyKey, "Literal") && typeof propertyKey.value === "string" ? new Set([propertyKey.value]) : null;
+		}
+		if (isGlobalNamespaceMethod(parent.callee, "Reflect", REFLECT_PROPERTY_MUTATION_METHOD_NAMES)) {
+			const propertyKey = parent.arguments[1];
+			return propertyKey && isNodeOfType(propertyKey, "Literal") && typeof propertyKey.value === "string" ? new Set([propertyKey.value]) : null;
+		}
+	};
+	const getLocalCallTarget = (call) => {
+		const callee = stripParenExpression(call.callee);
+		if (isFunctionLike$1(callee)) return callee;
+		if (!isNodeOfType(callee, "Identifier")) return null;
+		const symbol = resolveConstIdentifierAlias(callee, scopes);
+		if (!symbol) return null;
+		if (symbol.kind === "function" && isFunctionLike$1(symbol.declarationNode)) return symbol.declarationNode;
+		if (symbol.kind !== "const" || !symbol.initializer) return null;
+		const initializer = stripParenExpression(symbol.initializer);
+		return isFunctionLike$1(initializer) ? initializer : null;
+	};
+	const calls = [];
+	const eventsBySymbolId = /* @__PURE__ */ new Map();
+	walkAst(scopes.rootScope.node, (node) => {
+		if (isNodeOfType(node, "CallExpression")) {
+			const owner = getExecutionOwner(node);
+			const targetOwner = getLocalCallTarget(node);
+			if (targetOwner && !isStaticallyUnreachable(node, owner)) calls.push({
+				call: node,
+				owner,
+				targetOwner
+			});
+		}
+		if (!isNodeOfType(node, "Identifier")) return;
+		const propertyNames = getMutationPropertyNames(node);
+		if (propertyNames === void 0) return;
+		const symbol = resolveConstIdentifierAlias(node, scopes);
+		if (!symbol) return;
+		const owner = getExecutionOwner(node);
+		if (isStaticallyUnreachable(node, owner)) return;
+		const events = eventsBySymbolId.get(symbol.id) ?? [];
+		events.push({
+			node,
+			owner,
+			propertyNames
+		});
+		eventsBySymbolId.set(symbol.id, events);
+	});
+	const getInvokedOwnersBefore = (checkpoint) => {
+		const checkpointOwner = getExecutionOwner(checkpoint);
+		const checkpointStartIndex = getNodeStartIndex(checkpoint);
+		const invokedOwners = /* @__PURE__ */ new Set();
+		const visitOwner = (owner, cutoffIndex) => {
+			for (const call of calls) {
+				if (call.owner !== owner || getNodeStartIndex(call.call) >= cutoffIndex) continue;
+				if (invokedOwners.has(call.targetOwner)) continue;
+				invokedOwners.add(call.targetOwner);
+				visitOwner(call.targetOwner, Number.POSITIVE_INFINITY);
+			}
+		};
+		visitOwner(checkpointOwner, checkpointStartIndex);
+		if (!isNodeOfType(checkpointOwner, "Program")) visitOwner(scopes.rootScope.node, Number.POSITIVE_INFINITY);
+		return invokedOwners;
+	};
+	const getProgramCutoffIndex = (usageOwner) => {
+		if (isNodeOfType(usageOwner, "Program")) return Number.POSITIVE_INFINITY;
+		const directProgramCall = calls.find((call) => isNodeOfType(call.owner, "Program") && call.targetOwner === usageOwner);
+		return directProgramCall ? getNodeStartIndex(directProgramCall.call) : Number.POSITIVE_INFINITY;
+	};
+	const callsByOwner = /* @__PURE__ */ new Map();
+	for (const call of calls) {
+		const ownerCalls = callsByOwner.get(call.owner) ?? [];
+		ownerCalls.push(call);
+		callsByOwner.set(call.owner, ownerCalls);
+	}
+	const ownerReachabilityCache = /* @__PURE__ */ new WeakMap();
+	const canOwnerReach = (owner, targetOwner) => {
+		const cachedResult = ownerReachabilityCache.get(owner)?.get(targetOwner);
+		if (cachedResult !== void 0) return cachedResult;
+		const pendingOwners = [owner];
+		const visitedOwners = /* @__PURE__ */ new Set();
+		let canReach = false;
+		while (pendingOwners.length > 0) {
+			const currentOwner = pendingOwners.pop();
+			if (!currentOwner || visitedOwners.has(currentOwner)) continue;
+			if (currentOwner === targetOwner) {
+				canReach = true;
+				break;
+			}
+			visitedOwners.add(currentOwner);
+			for (const call of callsByOwner.get(currentOwner) ?? []) pendingOwners.push(call.targetOwner);
+		}
+		const cachedTargets = ownerReachabilityCache.get(owner) ?? /* @__PURE__ */ new WeakMap();
+		cachedTargets.set(targetOwner, canReach);
+		ownerReachabilityCache.set(owner, cachedTargets);
+		return canReach;
+	};
+	const getRepeatedControlFlowAncestors = (node, owner) => {
+		const ancestors = /* @__PURE__ */ new Set();
+		let current = node;
+		while (current?.parent && current !== owner) {
+			const parent = current.parent;
+			const isSingleIterationDoWhile = isNodeOfType(parent, "DoWhileStatement") && isNodeOfType(parent.test, "Literal") && !parent.test.value;
+			const loopBody = isNodeOfType(parent, "ForStatement") || isNodeOfType(parent, "ForInStatement") || isNodeOfType(parent, "ForOfStatement") || isNodeOfType(parent, "WhileStatement") || isNodeOfType(parent, "DoWhileStatement") ? parent.body : null;
+			let bodyStatement = node;
+			while (loopBody && isNodeOfType(loopBody, "BlockStatement") && bodyStatement && bodyStatement.parent !== loopBody) bodyStatement = bodyStatement.parent ?? null;
+			const bodyStatementIndex = loopBody && isNodeOfType(loopBody, "BlockStatement") && bodyStatement ? loopBody.body.findIndex((statement) => statement === bodyStatement) : -1;
+			const hasFollowingLoopExit = Boolean(loopBody && isNodeOfType(loopBody, "BlockStatement") && bodyStatementIndex >= 0 && loopBody.body.slice(bodyStatementIndex + 1).some((statement) => isAbruptCompletionStatement(statement, false)));
+			if (loopBody && !isSingleIterationDoWhile && !hasFollowingLoopExit) ancestors.add(parent);
+			current = parent;
+		}
+		return ancestors;
+	};
+	const nodesShareRepeatedControlFlow = (leftNode, rightNode, owner) => {
+		const leftAncestors = getRepeatedControlFlowAncestors(leftNode, owner);
+		if (leftAncestors.size === 0) return false;
+		return [...getRepeatedControlFlowAncestors(rightNode, owner)].some((ancestor) => leftAncestors.has(ancestor));
+	};
+	const callsReachingOwnerCache = /* @__PURE__ */ new WeakMap();
+	const getCallsReachingOwnerByCaller = (targetOwner) => {
+		const cachedCalls = callsReachingOwnerCache.get(targetOwner);
+		if (cachedCalls) return cachedCalls;
+		const reachingCalls = /* @__PURE__ */ new Map();
+		for (const call of calls) {
+			if (!canOwnerReach(call.targetOwner, targetOwner)) continue;
+			const ownerCalls = reachingCalls.get(call.owner) ?? [];
+			ownerCalls.push(call);
+			reachingCalls.set(call.owner, ownerCalls);
+		}
+		callsReachingOwnerCache.set(targetOwner, reachingCalls);
+		return reachingCalls;
+	};
+	const canMutationReachUsageAcrossCalls = (mutationOwner, usageOwner) => {
+		const mutationCallsByOwner = getCallsReachingOwnerByCaller(mutationOwner);
+		const usageCallsByOwner = getCallsReachingOwnerByCaller(usageOwner);
+		for (const [owner, mutationCalls] of mutationCallsByOwner) {
+			const usageCalls = usageCallsByOwner.get(owner);
+			if (!usageCalls) continue;
+			for (const mutationCall of mutationCalls) for (const usageCall of usageCalls) {
+				if (mutationCall === usageCall) continue;
+				if (getNodeStartIndex(mutationCall.call) < getNodeStartIndex(usageCall.call) || isFunctionLike$1(owner) || nodesShareRepeatedControlFlow(mutationCall.call, usageCall.call, owner)) return true;
+			}
+		}
+		return false;
+	};
+	const isExecutionOrderAmbiguous = (usageNode) => {
+		const usageOwner = getExecutionOwner(usageNode);
+		if (isNodeOfType(usageOwner, "Program")) return false;
+		const reachingProgramCalls = calls.filter((call) => isNodeOfType(call.owner, "Program") && canOwnerReach(call.targetOwner, usageOwner));
+		if (reachingProgramCalls.length === 0) return false;
+		return reachingProgramCalls.length !== 1 || reachingProgramCalls[0]?.targetOwner !== usageOwner;
+	};
+	const isMutationOrderAmbiguous = (symbol, usageNode, relevantPropertyName) => {
+		const usageOwner = getExecutionOwner(usageNode);
+		const usageStartIndex = getNodeStartIndex(usageNode);
+		return (eventsBySymbolId.get(symbol.id) ?? []).some((event) => {
+			if (relevantPropertyName !== null && event.propertyNames !== null && !event.propertyNames.has(relevantPropertyName)) return false;
+			if (event.owner === usageOwner) return getNodeStartIndex(event.node) >= usageStartIndex && (isFunctionLike$1(usageOwner) || nodesShareRepeatedControlFlow(event.node, usageNode, usageOwner));
+			if (isNodeOfType(event.owner, "Program")) return (getCallsReachingOwnerByCaller(usageOwner).get(event.owner) ?? []).some((usageCall) => nodesShareRepeatedControlFlow(event.node, usageCall.call, event.owner));
+			return canOwnerReach(event.owner, usageOwner) || canMutationReachUsageAcrossCalls(event.owner, usageOwner);
+		});
+	};
+	const getEventsBefore = (symbol, usageNode) => {
+		const symbolEvents = eventsBySymbolId.get(symbol.id) ?? [];
+		const mutationEvents = [];
+		const visitOwner = (owner, cutoffIndex, activeOwners, isConditionalPath) => {
+			if (activeOwners.has(owner)) return;
+			const nextActiveOwners = new Set(activeOwners);
+			nextActiveOwners.add(owner);
+			const operations = [...symbolEvents.filter((event) => event.owner === owner).map((event) => ({
+				event,
+				index: getNodeStartIndex(event.node)
+			})), ...calls.filter((call) => call.owner === owner).map((call) => ({
+				call,
+				index: getNodeStartIndex(call.call)
+			}))].sort((left, right) => left.index - right.index);
+			for (const operation of operations) {
+				if (operation.index >= cutoffIndex) break;
+				if ("event" in operation) {
+					mutationEvents.push({
+						isConditional: isConditionalPath || isConditionallyExecuted(operation.event.node, operation.event.owner),
+						node: operation.event.node
+					});
+					continue;
+				}
+				visitOwner(operation.call.targetOwner, Number.POSITIVE_INFINITY, nextActiveOwners, isConditionalPath || isConditionallyExecuted(operation.call.call, operation.call.owner));
+			}
+		};
+		const usageOwner = getExecutionOwner(usageNode);
+		if (!isNodeOfType(usageOwner, "Program")) visitOwner(scopes.rootScope.node, getProgramCutoffIndex(usageOwner), /* @__PURE__ */ new Set(), false);
+		visitOwner(usageOwner, getNodeStartIndex(usageNode), /* @__PURE__ */ new Set(), false);
+		return mutationEvents;
+	};
+	const isMutatedBefore = (symbol, usageNode, relevantPropertyName) => {
+		const events = eventsBySymbolId.get(symbol.id);
+		if (!events) return false;
+		const usageStartIndex = getNodeStartIndex(usageNode);
+		const usageOwner = getExecutionOwner(usageNode);
+		const invokedOwners = getInvokedOwnersBefore(usageNode);
+		return events.some((event) => {
+			if (relevantPropertyName !== null && event.propertyNames !== null && !event.propertyNames.has(relevantPropertyName)) return false;
+			if (event.owner === usageOwner) return getNodeStartIndex(event.node) < usageStartIndex;
+			if (isNodeOfType(event.owner, "Program") && !isNodeOfType(usageOwner, "Program")) return getNodeStartIndex(event.node) < getProgramCutoffIndex(usageOwner);
+			return invokedOwners.has(event.owner);
+		});
+	};
+	const inspector = {
+		getEventsBefore,
+		getOutermostTarget,
+		isGlobalNamespaceMethod,
+		isExecutionOrderAmbiguous,
+		isMutationOrderAmbiguous,
+		isMutatedBefore
+	};
+	inspectorCache.set(scopes, inspector);
+	return inspector;
+};
+//#endregion
+//#region src/plugin/rules/security-scan/utils/get-katex-renderer-provenance.ts
+const isExpectedModuleName = (actualModuleName, expectedModuleName) => expectedModuleName === "katex" ? actualModuleName === "katex" || actualModuleName.startsWith("katex/") : actualModuleName === expectedModuleName;
+const isGlobalRequireCall = (node, moduleName, scopes) => {
+	const expression = stripParenExpression(node);
+	if (!isNodeOfType(expression, "CallExpression")) return false;
+	const callee = stripParenExpression(expression.callee);
+	const firstArgument = expression.arguments[0];
+	return Boolean(isNodeOfType(callee, "Identifier") && callee.name === "require" && scopes.isGlobalReference(callee) && firstArgument && isNodeOfType(firstArgument, "Literal") && typeof firstArgument.value === "string" && isExpectedModuleName(firstArgument.value, moduleName));
+};
+const isTypeScriptImportEqualsFromModule = (symbol, moduleName) => {
+	if (symbol.kind !== "ts-import-equals") return false;
+	const declaration = symbol.declarationNode;
+	if (!isNodeOfType(declaration, "TSImportEqualsDeclaration")) return false;
+	const moduleReference = declaration.moduleReference;
+	return Boolean(isNodeOfType(moduleReference, "TSExternalModuleReference") && isNodeOfType(moduleReference.expression, "Literal") && typeof moduleReference.expression.value === "string" && isExpectedModuleName(moduleReference.expression.value, moduleName));
+};
+const isAwaitedImportFromModule = (node, moduleName) => {
+	const expression = stripParenExpression(node);
+	return Boolean(isNodeOfType(expression, "AwaitExpression") && isNodeOfType(expression.argument, "ImportExpression") && isNodeOfType(expression.argument.source, "Literal") && typeof expression.argument.source.value === "string" && isExpectedModuleName(expression.argument.source.value, moduleName));
+};
+const getModuleNamespaceSymbol = (node, moduleName, namespacePropertyName, usageNode, scopes) => {
+	const symbol = resolveConstIdentifierAlias(stripParenExpression(node), scopes);
+	const mutationInspector = getSymbolMutationInspector(scopes);
+	if (!symbol || mutationInspector.isExecutionOrderAmbiguous(usageNode) || mutationInspector.isMutationOrderAmbiguous(symbol, usageNode, namespacePropertyName) || mutationInspector.isMutatedBefore(symbol, usageNode, namespacePropertyName)) return null;
+	const importDeclaration = getImportDeclarationForSymbol(symbol);
+	if (typeof importDeclaration?.source.value === "string" && isExpectedModuleName(importDeclaration.source.value, moduleName)) return isNodeOfType(symbol.declarationNode, "ImportDefaultSpecifier") || isNodeOfType(symbol.declarationNode, "ImportNamespaceSpecifier") || getImportedName(symbol.declarationNode) === "default" ? symbol : null;
+	if (isTypeScriptImportEqualsFromModule(symbol, moduleName)) return symbol;
+	if (symbol.kind !== "const" || !symbol.initializer) return null;
+	const initializer = stripParenExpression(symbol.initializer);
+	if (isGlobalRequireCall(initializer, moduleName, scopes)) return symbol;
+	if (isNodeOfType(initializer, "MemberExpression") && getStaticPropertyName(initializer) === "default" && (isGlobalRequireCall(initializer.object, moduleName, scopes) || isAwaitedImportFromModule(initializer.object, moduleName))) return symbol;
+	if (isAwaitedImportFromModule(initializer, moduleName)) return symbol;
+	return null;
+};
+const getNamedImportSymbol = (node, moduleName, importedName, usageNode, scopes) => {
+	const symbol = resolveConstIdentifierAlias(stripParenExpression(node), scopes);
+	if (!symbol) return null;
+	const importDeclaration = getImportDeclarationForSymbol(symbol);
+	const mutationInspector = getSymbolMutationInspector(scopes);
+	if (typeof importDeclaration?.source.value !== "string" || !isExpectedModuleName(importDeclaration.source.value, moduleName) || getImportedName(symbol.declarationNode) !== importedName || mutationInspector.isExecutionOrderAmbiguous(usageNode) || mutationInspector.isMutationOrderAmbiguous(symbol, usageNode, null) || mutationInspector.isMutatedBefore(symbol, usageNode, null)) return null;
+	return symbol;
+};
+const isKatexNamespace = (node, usageNode, scopes) => getModuleNamespaceSymbol(node, "katex", "renderToString", usageNode, scopes) !== null || isGlobalRequireCall(node, "katex", scopes);
+const isKatexNamedRenderer = (node, usageNode, scopes) => {
+	if (getNamedImportSymbol(node, "katex", "renderToString", usageNode, scopes)) return true;
+	const expression = stripParenExpression(node);
+	if (!isNodeOfType(expression, "Identifier")) return false;
+	const symbol = scopes.referenceFor(expression)?.resolvedSymbol;
+	if (!symbol || symbol.kind !== "const" || !symbol.initializer || getSymbolMutationInspector(scopes).isMutatedBefore(symbol, usageNode, null)) return false;
+	const initializer = stripParenExpression(symbol.initializer);
+	const bindingProperty = symbol.bindingIdentifier.parent;
+	if (isNodeOfType(bindingProperty, "Property") && getStaticPropertyKeyName(bindingProperty, { allowComputedString: true }) === "renderToString") return isKatexNamespace(initializer, symbol.declarationNode, scopes);
+	if (isNodeOfType(initializer, "MemberExpression") && getStaticPropertyName(initializer) === "renderToString" && isKatexNamespace(initializer.object, symbol.declarationNode, scopes)) return true;
+	if (isNodeOfType(initializer, "Identifier")) return isKatexNamedRenderer(initializer, symbol.declarationNode, scopes);
+	return false;
+};
+const isUnprovenKatexShapedRenderer = (node, scopes) => {
+	const expression = stripParenExpression(node);
+	if (isNodeOfType(expression, "Identifier")) {
+		if (!/katex/i.test(expression.name)) return false;
+		const symbol = scopes.referenceFor(expression)?.resolvedSymbol;
+		return Boolean(symbol && symbol.kind !== "parameter" && symbol.kind !== "let");
+	}
+	if (!isNodeOfType(expression, "MemberExpression")) return false;
+	if (getStaticPropertyName(expression) !== "renderToString") return false;
+	const receiver = stripParenExpression(expression.object);
+	if (!isNodeOfType(receiver, "Identifier") || !/katex/i.test(receiver.name)) return false;
+	const symbol = scopes.referenceFor(receiver)?.resolvedSymbol;
+	if (!symbol) return false;
+	if (symbol.kind === "import") {
+		if (!isExpectedModuleName(String(getImportDeclarationForSymbol(symbol)?.source.value ?? ""), "katex")) return true;
+		const mutationInspector = getSymbolMutationInspector(scopes);
+		if (mutationInspector.isExecutionOrderAmbiguous(expression) || mutationInspector.isMutationOrderAmbiguous(symbol, expression, "renderToString")) return false;
+		return mutationInspector.isMutatedBefore(symbol, expression, "renderToString");
+	}
+	if (symbol.kind === "parameter" || symbol.kind === "let" || symbol.kind === "var") return true;
+	if (symbol.kind !== "const" || !symbol.initializer) return false;
+	const initializer = stripParenExpression(symbol.initializer);
+	if (isNodeOfType(initializer, "ObjectExpression")) return true;
+	if (isNodeOfType(initializer, "CallExpression")) {
+		const callee = stripParenExpression(initializer.callee);
+		return isNodeOfType(callee, "Identifier") && callee.name === "require";
+	}
+	return isNodeOfType(initializer, "AwaitExpression") && isNodeOfType(initializer.argument, "ImportExpression");
+};
+//#endregion
+//#region src/plugin/rules/security-scan/utils/get-katex-options-proof.ts
+const parameterOptionsProofsByScopes = /* @__PURE__ */ new WeakMap();
+const isStaticallyDisabledTrustValue = (node, scopes) => {
+	const expression = stripParenExpression(node);
+	if (isNodeOfType(expression, "Identifier")) return expression.name === "undefined" && scopes.isGlobalReference(expression);
+	return isNodeOfType(expression, "Literal") && !expression.value;
+};
+const getStaticObjectPropertyValue = (node, expectedPropertyName) => {
+	const expression = stripParenExpression(node);
+	if (!isNodeOfType(expression, "ObjectExpression")) return null;
+	let propertyValue;
+	for (const property of expression.properties) {
+		if (!isNodeOfType(property, "Property")) return null;
+		const propertyName = getStaticPropertyKeyName(property, { allowComputedString: true });
+		if (propertyName === null) return null;
+		if (propertyName !== expectedPropertyName) continue;
+		if (property.kind !== "init") return null;
+		propertyValue = property.value;
+	}
+	return propertyValue;
+};
+const getPropertyDescriptorValue = (node) => {
+	const expression = stripParenExpression(node);
+	if (!isNodeOfType(expression, "ObjectExpression")) return null;
+	for (const property of expression.properties) {
+		if (!isNodeOfType(property, "Property")) return null;
+		const propertyName = getStaticPropertyKeyName(property, { allowComputedString: true });
+		if (propertyName === null || propertyName === "get" || propertyName === "set") return null;
+	}
+	return getStaticObjectPropertyValue(expression, "value");
+};
+const getTrustStateAfterPropertyDescriptor = (currentState, propertyDescriptor, scopes) => {
+	const propertyValue = getPropertyDescriptorValue(propertyDescriptor);
+	if (propertyValue === null) return "trusted";
+	if (propertyValue === void 0) return currentState;
+	return isStaticallyDisabledTrustValue(propertyValue, scopes) ? "untrusted" : "trusted";
+};
+const mergeConditionalTrustStates = (currentState, conditionalState) => {
+	if (currentState === conditionalState) return currentState;
+	if (currentState === "trusted" || conditionalState === "trusted") return "trusted";
+	if (currentState === "unsupported" || conditionalState === "unsupported") return "unsupported";
+	return "untrusted";
+};
+const applyTrustMutation = (currentState, eventNode, scopes, visitedSymbolIds) => {
+	const mutationInspector = getSymbolMutationInspector(scopes);
+	const target = mutationInspector.getOutermostTarget(eventNode);
+	const parent = target.parent;
+	if (!parent) return "unsupported";
+	if (isNodeOfType(parent, "AssignmentExpression") && parent.left === target) {
+		if (!isNodeOfType(target, "MemberExpression")) return "unsupported";
+		const propertyName = getStaticPropertyName(target);
+		if (propertyName === null) return "trusted";
+		if (propertyName !== "trust") return currentState;
+		return isStaticallyDisabledTrustValue(parent.right, scopes) ? "untrusted" : "trusted";
+	}
+	if (isNodeOfType(parent, "UnaryExpression") && parent.operator === "delete") {
+		if (!isNodeOfType(target, "MemberExpression")) return "unsupported";
+		const propertyName = getStaticPropertyName(target);
+		if (propertyName === null) return "trusted";
+		return propertyName === "trust" ? "absent" : currentState;
+	}
+	if (isNodeOfType(parent, "UpdateExpression")) {
+		if (!isNodeOfType(target, "MemberExpression")) return "unsupported";
+		const propertyName = getStaticPropertyName(target);
+		return propertyName === "trust" || propertyName === null ? "trusted" : currentState;
+	}
+	if (!isNodeOfType(parent, "CallExpression") || parent.arguments[0] !== target) return "unsupported";
+	if (mutationInspector.isGlobalNamespaceMethod(parent.callee, "Object", OBJECT_PROPERTY_MUTATION_METHOD_NAMES)) {
+		const callee = stripParenExpression(parent.callee);
+		if (!isNodeOfType(callee, "MemberExpression")) return "unsupported";
+		const methodName = getStaticPropertyName(callee);
+		if (methodName === "assign") {
+			let nextState = currentState;
+			for (const source of parent.arguments.slice(1)) {
+				const sourceState = getKatexOptionsTrustState(source, source, scopes, new Set(visitedSymbolIds));
+				if (sourceState !== "absent") nextState = sourceState;
+			}
+			return nextState;
+		}
+		if (methodName === "defineProperties") {
+			const propertyDescriptors = parent.arguments[1];
+			if (!propertyDescriptors) return "unsupported";
+			const trustDescriptor = getStaticObjectPropertyValue(propertyDescriptors, "trust");
+			if (trustDescriptor === null) return "trusted";
+			if (trustDescriptor === void 0) return currentState;
+			return getTrustStateAfterPropertyDescriptor(currentState, trustDescriptor, scopes);
+		}
+		const propertyKey = parent.arguments[1];
+		if (!propertyKey || !isNodeOfType(propertyKey, "Literal") || typeof propertyKey.value !== "string") return "trusted";
+		if (propertyKey.value !== "trust") return currentState;
+		const propertyDescriptor = parent.arguments[2];
+		if (!propertyDescriptor) return "unsupported";
+		return getTrustStateAfterPropertyDescriptor(currentState, propertyDescriptor, scopes);
+	}
+	if (mutationInspector.isGlobalNamespaceMethod(parent.callee, "Reflect", REFLECT_PROPERTY_MUTATION_METHOD_NAMES)) {
+		const callee = stripParenExpression(parent.callee);
+		if (!isNodeOfType(callee, "MemberExpression")) return "unsupported";
+		const methodName = getStaticPropertyName(callee);
+		const propertyKey = parent.arguments[1];
+		if (!propertyKey || !isNodeOfType(propertyKey, "Literal") || typeof propertyKey.value !== "string") return "trusted";
+		if (propertyKey.value !== "trust") return currentState;
+		const propertyValue = parent.arguments[2];
+		if (!propertyValue) return "unsupported";
+		if (methodName === "defineProperty") return getTrustStateAfterPropertyDescriptor(currentState, propertyValue, scopes);
+		return isStaticallyDisabledTrustValue(propertyValue, scopes) ? "untrusted" : "trusted";
+	}
+	return "unsupported";
+};
+const getKatexOptionsTrustState = (rawNode, usageNode, scopes, visitedSymbolIds) => {
+	if (rawNode === void 0) return "absent";
+	const node = stripParenExpression(rawNode);
+	if (isNodeOfType(node, "Identifier")) {
+		if (node.name === "undefined" && scopes.isGlobalReference(node)) return "absent";
+		const symbol = resolveConstIdentifierAlias(node, scopes);
+		if (!symbol || symbol.kind !== "const" || !symbol.initializer || visitedSymbolIds.has(symbol.id)) return "unsupported";
+		const nextVisitedSymbolIds = new Set(visitedSymbolIds);
+		nextVisitedSymbolIds.add(symbol.id);
+		const mutationInspector = getSymbolMutationInspector(scopes);
+		if (mutationInspector.isMutationOrderAmbiguous(symbol, usageNode, "trust")) return "unsupported";
+		let trustState = getKatexOptionsTrustState(symbol.initializer, usageNode, scopes, nextVisitedSymbolIds);
+		for (const replayedEvent of mutationInspector.getEventsBefore(symbol, usageNode)) {
+			const nextTrustState = applyTrustMutation(trustState, replayedEvent.node, scopes, nextVisitedSymbolIds);
+			if (replayedEvent.isConditional) trustState = mergeConditionalTrustStates(trustState, nextTrustState);
+			else trustState = nextTrustState;
+		}
+		return trustState;
+	}
+	if (!isNodeOfType(node, "ObjectExpression")) return "unsupported";
+	let trustState = "absent";
+	for (const property of node.properties) {
+		if (isNodeOfType(property, "SpreadElement")) {
+			const spreadState = getKatexOptionsTrustState(property.argument, property.argument, scopes, new Set(visitedSymbolIds));
+			if (spreadState !== "absent") trustState = spreadState === "unsupported" ? "trusted" : spreadState;
+			continue;
+		}
+		if (!isNodeOfType(property, "Property")) {
+			trustState = "trusted";
+			continue;
+		}
+		const propertyName = getStaticPropertyKeyName(property, { allowComputedString: true });
+		if (propertyName === null) {
+			trustState = "trusted";
+			continue;
+		}
+		if (propertyName === "trust") trustState = isStaticallyDisabledTrustValue(property.value, scopes) ? "untrusted" : "trusted";
+	}
+	return trustState;
+};
+const setKatexParameterOptionsProofs = (scopes, proofs) => {
+	parameterOptionsProofsByScopes.set(scopes, proofs);
+};
+const getKatexOptionsProof = (rawNode, usageNode, scopes, visitedSymbolIds) => {
+	const node = rawNode ? stripParenExpression(rawNode) : void 0;
+	if (node && isNodeOfType(node, "Identifier")) {
+		const parameterSymbol = scopes.referenceFor(node)?.resolvedSymbol;
+		const parameterProof = parameterSymbol ? parameterOptionsProofsByScopes.get(scopes)?.get(parameterSymbol.id) : void 0;
+		if (parameterProof) return parameterProof;
+	}
+	const trustState = getKatexOptionsTrustState(rawNode, usageNode, scopes, visitedSymbolIds);
+	return {
+		isConclusive: trustState !== "unsupported",
+		isSafe: trustState === "absent" || trustState === "untrusted"
+	};
+};
+//#endregion
+//#region src/plugin/rules/security-scan/utils/get-katex-html-proof.ts
+const SAFE_STATIC_HTML_PROOF = {
+	containsKatex: false,
+	isConclusive: true,
+	isSafe: true,
+	isSafeInAttributeContext: true
+};
+const SAFE_HTML_FRAGMENT_PROOF = {
+	containsKatex: false,
+	isConclusive: true,
+	isSafe: true,
+	isSafeInAttributeContext: false
+};
+const UNKNOWN_HTML_PROOF = {
+	containsKatex: false,
+	isConclusive: false,
+	isSafe: false,
+	isSafeInAttributeContext: false
+};
+const UNSUPPORTED_KATEX_PROOF = {
+	containsKatex: true,
+	isConclusive: false,
+	isSafe: false,
+	isSafeInAttributeContext: false
+};
+const UNSAFE_KATEX_PROOF = {
+	containsKatex: true,
+	isConclusive: true,
+	isSafe: false,
+	isSafeInAttributeContext: false
+};
+const sourceFilenameByScopes = /* @__PURE__ */ new WeakMap();
+const crossFileDepthByScopes = /* @__PURE__ */ new WeakMap();
+const registerKatexProofSource = (scopes, filename, depth) => {
+	sourceFilenameByScopes.set(scopes, filename);
+	crossFileDepthByScopes.set(scopes, depth);
+};
+const combineHtmlProofs = (proofs) => ({
+	containsKatex: proofs.some((proof) => proof.containsKatex),
+	isConclusive: proofs.every((proof) => proof.isSafe) ? proofs.filter((proof) => proof.containsKatex).every((proof) => proof.isConclusive) : proofs.some((proof) => proof.containsKatex && proof.isConclusive && !proof.isSafe) || proofs.some((proof) => proof.containsKatex && proof.isConclusive) && proofs.some((proof) => !proof.containsKatex && !proof.isSafe),
+	isSafe: proofs.every((proof) => proof.isSafe),
+	isSafeInAttributeContext: proofs.every((proof) => proof.isSafeInAttributeContext)
+});
+const getOrderedObjectPropertyValue = (node, propertyName) => {
+	const expression = stripParenExpression(node);
+	if (!isNodeOfType(expression, "ObjectExpression")) return {
+		isKnown: false,
+		value: null
+	};
+	let isKnown = true;
+	let propertyValue = null;
+	for (const property of expression.properties) {
+		if (!isNodeOfType(property, "Property")) {
+			isKnown = false;
+			propertyValue = null;
+			continue;
+		}
+		const currentPropertyName = getStaticPropertyKeyName(property, { allowComputedString: true });
+		if (currentPropertyName === null) {
+			isKnown = false;
+			propertyValue = null;
+		} else if (currentPropertyName === propertyName) {
+			isKnown = true;
+			propertyValue = property.value;
+		}
+	}
+	return {
+		isKnown,
+		value: propertyValue
+	};
+};
+const isReactUseMemo = (node, scopes) => {
+	const expression = stripParenExpression(node);
+	if (isNodeOfType(expression, "Identifier")) {
+		const symbol = resolveConstIdentifierAlias(expression, scopes);
+		return Boolean(symbol && symbol.kind === "import" && getImportDeclarationForSymbol(symbol)?.source.value === "react" && getImportedName(symbol.declarationNode) === "useMemo");
+	}
+	if (!isNodeOfType(expression, "MemberExpression") || getStaticPropertyName(expression) !== "useMemo") return false;
+	const symbol = resolveConstIdentifierAlias(stripParenExpression(expression.object), scopes);
+	return Boolean(symbol && symbol.kind === "import" && getImportDeclarationForSymbol(symbol)?.source.value === "react" && (isNodeOfType(symbol.declarationNode, "ImportDefaultSpecifier") || isNodeOfType(symbol.declarationNode, "ImportNamespaceSpecifier") || getImportedName(symbol.declarationNode) === "default"));
+};
+const isAllOpeningAngleBracketsEscaped = (node, scopes) => {
+	let current = stripParenExpression(node);
+	let didEscapeEveryOpeningAngleBracket = false;
+	while (isNodeOfType(current, "CallExpression")) {
+		const callee = stripParenExpression(current.callee);
+		if (!isNodeOfType(callee, "MemberExpression")) return false;
+		const methodName = getStaticPropertyName(callee);
+		if (methodName !== "replace" && methodName !== "replaceAll") return false;
+		const searchValue = current.arguments[0];
+		const replacementValue = current.arguments[1];
+		if (!searchValue || !replacementValue || !isNodeOfType(replacementValue, "Literal") || typeof replacementValue.value !== "string" || replacementValue.value.includes("<") || replacementValue.value.includes("$")) return false;
+		if (isNodeOfType(searchValue, "Literal")) {
+			const regularExpression = "regex" in searchValue ? searchValue.regex : void 0;
+			const replacesLiteralOpeningAngleBracket = methodName === "replaceAll" && searchValue.value === "<";
+			const replacesGlobalOpeningAngleBracketPattern = regularExpression?.pattern === "<" && regularExpression.flags.includes("g");
+			if (replacesLiteralOpeningAngleBracket || replacesGlobalOpeningAngleBracketPattern) didEscapeEveryOpeningAngleBracket = true;
+		}
+		current = stripParenExpression(callee.object);
+	}
+	if (!didEscapeEveryOpeningAngleBracket || !isNodeOfType(current, "Identifier")) return false;
+	return scopes.referenceFor(current)?.resolvedSymbol?.kind === "parameter";
+};
+const getSanitizerProof = (node, scopes) => {
+	const callee = stripParenExpression(node.callee);
+	if (isNodeOfType(callee, "MemberExpression") && getStaticPropertyName(callee) === "sanitize") {
+		if (getModuleNamespaceSymbol(callee.object, "dompurify", "sanitize", node, scopes) || getModuleNamespaceSymbol(callee.object, "isomorphic-dompurify", "sanitize", node, scopes)) return SAFE_HTML_FRAGMENT_PROOF;
+	}
+	if (isNodeOfType(callee, "MemberExpression") && getStaticPropertyName(callee) === "escape") {
+		if (getModuleNamespaceSymbol(callee.object, "html-escaper", "escape", node, scopes)) return SAFE_STATIC_HTML_PROOF;
+	}
+	if (getNamedImportSymbol(callee, "html-escaper", "escape", node, scopes)) return SAFE_STATIC_HTML_PROOF;
+	if (getNamedImportSymbol(callee, "dompurify", "sanitize", node, scopes) || getNamedImportSymbol(callee, "isomorphic-dompurify", "sanitize", node, scopes)) return SAFE_HTML_FRAGMENT_PROOF;
+	return null;
+};
+const getSafePostTransformProof = (node, receiverProof) => {
+	if (!receiverProof.isSafe) return null;
+	const callee = stripParenExpression(node.callee);
+	if (!isNodeOfType(callee, "MemberExpression")) return null;
+	const methodName = getStaticPropertyName(callee);
+	if ((methodName === "trim" || methodName === "trimEnd" || methodName === "trimStart") && node.arguments.length === 0) return receiverProof;
+	if (methodName !== "replace" && methodName !== "replaceAll") return null;
+	const replacement = node.arguments[1];
+	if (!replacement || !isNodeOfType(replacement, "Literal") || typeof replacement.value !== "string" || replacement.value.includes("<")) return null;
+	return {
+		containsKatex: receiverProof.containsKatex,
+		isConclusive: receiverProof.isConclusive,
+		isSafe: true,
+		isSafeInAttributeContext: receiverProof.isSafeInAttributeContext && !/[&>"']/.test(replacement.value)
+	};
+};
+const getTemplateInterpolationContext = (staticPrefix) => {
+	const lowerPrefix = staticPrefix.toLowerCase();
+	for (const tagName of [
+		"script",
+		"style",
+		"textarea",
+		"title"
+	]) if (lowerPrefix.lastIndexOf(`<${tagName}`) > lowerPrefix.lastIndexOf(`</${tagName}`)) return "raw-text";
+	const lastOpeningAngleIndex = staticPrefix.lastIndexOf("<");
+	if (lastOpeningAngleIndex <= staticPrefix.lastIndexOf(">")) return "text";
+	const currentTagText = staticPrefix.slice(lastOpeningAngleIndex + 1);
+	let openQuote = null;
+	for (let index = 0; index < currentTagText.length; index += 1) {
+		const character = currentTagText[index];
+		if ((character === "\"" || character === "'") && currentTagText[index - 1] !== "\\") {
+			if (openQuote === character) openQuote = null;
+			else if (openQuote === null) openQuote = character;
+		}
+	}
+	return openQuote === null ? "unsafe-tag" : "attribute";
+};
+const getTemplateLiteralProof = (node, scopes, visitedSymbolIds, parameterProofs) => {
+	const expressionProofs = node.expressions.map((expression) => getKatexHtmlProof(expression, scopes, new Set(visitedSymbolIds), parameterProofs));
+	let staticPrefix = "";
+	let isSafe = true;
+	for (let expressionIndex = 0; expressionIndex < expressionProofs.length; expressionIndex += 1) {
+		staticPrefix += node.quasis[expressionIndex]?.value.raw ?? "";
+		const context = getTemplateInterpolationContext(staticPrefix);
+		const proof = expressionProofs[expressionIndex] ?? UNKNOWN_HTML_PROOF;
+		if (context === "text") isSafe &&= proof.isSafe;
+		else if (context === "attribute") isSafe &&= proof.isSafeInAttributeContext;
+		else isSafe = false;
+	}
+	return {
+		containsKatex: expressionProofs.some((proof) => proof.containsKatex),
+		isConclusive: isSafe ? expressionProofs.filter((proof) => proof.containsKatex).every((proof) => proof.isConclusive) : expressionProofs.some((proof) => proof.containsKatex && proof.isConclusive && !proof.isSafe) || expressionProofs.some((proof) => proof.containsKatex && proof.isConclusive) && expressionProofs.some((proof) => !proof.containsKatex && !proof.isSafe),
+		isSafe,
+		isSafeInAttributeContext: false
+	};
+};
+const isReturnStatementStaticallyUnreachable = (returnStatement, functionBody) => {
+	let current = returnStatement;
+	while (current.parent && current !== functionBody) {
+		const parent = current.parent;
+		if (isNodeOfType(parent, "BlockStatement")) {
+			const statementIndex = parent.body.findIndex((statement) => statement === current);
+			if (statementIndex > 0 && parent.body.slice(0, statementIndex).some((statement) => statementAlwaysExits(statement))) return true;
+		}
+		if (isNodeOfType(parent, "SwitchCase")) {
+			const statementIndex = parent.consequent.findIndex((statement) => statement === current);
+			if (statementIndex > 0 && parent.consequent.slice(0, statementIndex).some((statement) => statementAlwaysExits(statement))) return true;
+		}
+		if (isNodeOfType(parent, "IfStatement") && isNodeOfType(parent.test, "Literal")) {
+			const ifStatementAlternate = parent.alternate;
+			const ifStatementConsequent = parent.consequent;
+			const ifStatementTest = parent.test;
+			const isTruthyTest = Boolean(ifStatementTest.value);
+			if (!isTruthyTest && ifStatementConsequent === current) return true;
+			if (isTruthyTest && ifStatementAlternate === current) return true;
+		}
+		if (isNodeOfType(parent, "WhileStatement") && parent.body === current) {
+			const whileStatementTest = parent.test;
+			if (isNodeOfType(whileStatementTest, "Literal") && !whileStatementTest.value) return true;
+		}
+		if (isNodeOfType(parent, "ForStatement") && parent.body === current) {
+			const forStatementTest = parent.test;
+			if (forStatementTest && isNodeOfType(forStatementTest, "Literal") && !forStatementTest.value) return true;
+		}
+		current = parent;
+	}
+	return false;
+};
+const getFunctionHtmlProof = (functionNode, scopes, visitedSymbolIds, parameterProofs = /* @__PURE__ */ new Map()) => {
+	if (!isFunctionLike$1(functionNode)) return UNKNOWN_HTML_PROOF;
+	if (!isNodeOfType(functionNode.body, "BlockStatement")) return getKatexHtmlProof(functionNode.body, scopes, visitedSymbolIds, parameterProofs);
+	const functionBody = functionNode.body;
+	const returnProofs = [];
+	walkAst(functionBody, (child) => {
+		if (child !== functionBody && isFunctionLike$1(child)) return false;
+		if (!isNodeOfType(child, "ReturnStatement")) return;
+		if (isReturnStatementStaticallyUnreachable(child, functionBody)) return false;
+		returnProofs.push(child.argument ? getKatexHtmlProof(child.argument, scopes, new Set(visitedSymbolIds), parameterProofs) : SAFE_STATIC_HTML_PROOF);
+		return false;
+	});
+	return returnProofs.length === 0 ? SAFE_STATIC_HTML_PROOF : combineHtmlProofs(returnProofs);
+};
+const getLocalFunctionNode = (node, scopes) => {
+	const expression = stripParenExpression(node);
+	if (!isNodeOfType(expression, "Identifier")) return null;
+	const symbol = resolveConstIdentifierAlias(expression, scopes);
+	if (!symbol || symbol.references.some((reference) => reference.flag !== "read")) return null;
+	if (symbol.kind === "function" && isFunctionLike$1(symbol.declarationNode)) return {
+		functionNode: symbol.declarationNode,
+		symbol
+	};
+	if (symbol.kind !== "const" || !symbol.initializer) return null;
+	const initializer = stripParenExpression(symbol.initializer);
+	return isFunctionLike$1(initializer) ? {
+		functionNode: initializer,
+		symbol
+	} : null;
+};
+const getCrossFileFunctionProof = (call, scopes) => {
+	const expression = stripParenExpression(call.callee);
+	if (!isNodeOfType(expression, "Identifier")) return null;
+	const symbol = resolveConstIdentifierAlias(expression, scopes);
+	if (!symbol || symbol.kind !== "import") return null;
+	const importDeclaration = getImportDeclarationForSymbol(symbol);
+	const importedName = getImportedName(symbol.declarationNode);
+	const sourceFilename = sourceFilenameByScopes.get(scopes);
+	const source = importDeclaration?.source.value;
+	const currentDepth = crossFileDepthByScopes.get(scopes) ?? 0;
+	if (!sourceFilename || typeof source !== "string" || !importedName || currentDepth >= 2) return null;
+	const resolved = resolveCrossFileFunctionExportWithFilePath(sourceFilename, source, importedName);
+	if (!resolved || !isFunctionLike$1(resolved.functionNode)) return null;
+	const resolvedScopes = analyzeScopes(resolved.programNode);
+	registerKatexProofSource(resolvedScopes, resolved.filePath, currentDepth + 1);
+	const optionsProofs = /* @__PURE__ */ new Map();
+	for (const [parameterIndex, parameter] of resolved.functionNode.params.entries()) {
+		if (!isNodeOfType(parameter, "ObjectPattern")) continue;
+		const argument = call.arguments[parameterIndex];
+		if (!argument) continue;
+		for (const property of parameter.properties) {
+			if (!isNodeOfType(property, "Property") || !isNodeOfType(property.value, "Identifier")) continue;
+			const propertyName = getStaticPropertyKeyName(property, { allowComputedString: true });
+			if (propertyName === null) continue;
+			const argumentProperty = getOrderedObjectPropertyValue(argument, propertyName);
+			const parameterSymbol = resolvedScopes.symbolFor(property.value);
+			if (!argumentProperty.isKnown || !parameterSymbol || parameterSymbol.references.some((reference) => reference.flag !== "read")) continue;
+			if (argumentProperty.value === null) {
+				optionsProofs.set(parameterSymbol.id, {
+					isConclusive: true,
+					isSafe: true
+				});
+				continue;
+			}
+			optionsProofs.set(parameterSymbol.id, getKatexOptionsProof(argumentProperty.value, call, scopes, /* @__PURE__ */ new Set()));
+		}
+	}
+	setKatexParameterOptionsProofs(resolvedScopes, optionsProofs);
+	return getFunctionHtmlProof(resolved.functionNode, resolvedScopes, /* @__PURE__ */ new Set());
+};
+const getKatexCallProof = (node, scopes, visitedSymbolIds, parameterProofs) => {
+	if (!isNodeOfType(node, "CallExpression")) return UNKNOWN_HTML_PROOF;
+	const callee = stripParenExpression(node.callee);
+	if (isNodeOfType(callee, "MemberExpression") && getStaticPropertyName(callee) === "renderToString" && isKatexNamespace(callee.object, node, scopes) || isKatexNamedRenderer(callee, node, scopes)) {
+		const optionsProof = getKatexOptionsProof(node.arguments[1], node, scopes, /* @__PURE__ */ new Set());
+		return {
+			containsKatex: true,
+			isConclusive: optionsProof.isConclusive,
+			isSafe: optionsProof.isSafe,
+			isSafeInAttributeContext: false
+		};
+	}
+	const crossFileFunctionProof = getCrossFileFunctionProof(node, scopes);
+	if (crossFileFunctionProof?.containsKatex) return crossFileFunctionProof;
+	const localFunction = getLocalFunctionNode(callee, scopes);
+	if (localFunction && !visitedSymbolIds.has(localFunction.symbol.id)) {
+		const nextVisitedSymbolIds = new Set(visitedSymbolIds);
+		nextVisitedSymbolIds.add(localFunction.symbol.id);
+		const argumentProofs = node.arguments.map((argument) => {
+			const argumentNode = stripParenExpression(argument);
+			return isFunctionLike$1(argumentNode) ? getFunctionHtmlProof(argumentNode, scopes, new Set(visitedSymbolIds), parameterProofs) : getKatexHtmlProof(argumentNode, scopes, new Set(visitedSymbolIds), parameterProofs);
+		});
+		const localParameterProofs = /* @__PURE__ */ new Map();
+		let hasWrittenKatexParameter = false;
+		if (isFunctionLike$1(localFunction.functionNode)) for (const [parameterIndex, parameter] of localFunction.functionNode.params.entries()) {
+			if (!isNodeOfType(parameter, "Identifier")) continue;
+			const parameterSymbol = scopes.symbolFor(parameter);
+			const argumentProof = argumentProofs[parameterIndex];
+			const isParameterReadOnly = parameterSymbol?.references.every((reference) => reference.flag === "read");
+			if (parameterSymbol && argumentProof && isParameterReadOnly) localParameterProofs.set(parameterSymbol.id, argumentProof);
+			if (argumentProof?.containsKatex && parameterSymbol && !isParameterReadOnly) hasWrittenKatexParameter = true;
+		}
+		const localFunctionProof = getFunctionHtmlProof(localFunction.functionNode, scopes, nextVisitedSymbolIds, localParameterProofs);
+		if (!argumentProofs.some((proof) => proof.containsKatex) || localFunctionProof.containsKatex) return localFunctionProof;
+		return hasWrittenKatexParameter ? UNSUPPORTED_KATEX_PROOF : UNSAFE_KATEX_PROOF;
+	}
+	if (isUnprovenKatexShapedRenderer(callee, scopes)) return {
+		containsKatex: true,
+		isConclusive: true,
+		isSafe: false,
+		isSafeInAttributeContext: false
+	};
+	if (isNodeOfType(callee, "MemberExpression")) {
+		const receiverProof = getKatexHtmlProof(callee.object, scopes, new Set(visitedSymbolIds), parameterProofs);
+		if (receiverProof.containsKatex) {
+			const safeTransformProof = getSafePostTransformProof(node, receiverProof);
+			if (safeTransformProof) return safeTransformProof;
+			return receiverProof.isConclusive ? {
+				containsKatex: true,
+				isConclusive: true,
+				isSafe: false,
+				isSafeInAttributeContext: false
+			} : UNSUPPORTED_KATEX_PROOF;
+		}
+	}
+	const sanitizerProof = getSanitizerProof(node, scopes);
+	if (sanitizerProof) return sanitizerProof;
+	if (isAllOpeningAngleBracketsEscaped(node, scopes)) return SAFE_HTML_FRAGMENT_PROOF;
+	if (isReactUseMemo(callee, scopes)) {
+		const callback = node.arguments[0];
+		if (!callback) return UNKNOWN_HTML_PROOF;
+		const callbackNode = stripParenExpression(callback);
+		if (isFunctionLike$1(callbackNode)) return getFunctionHtmlProof(callbackNode, scopes, new Set(visitedSymbolIds), parameterProofs);
+		const localCallback = getLocalFunctionNode(callbackNode, scopes);
+		if (!localCallback || visitedSymbolIds.has(localCallback.symbol.id)) return UNKNOWN_HTML_PROOF;
+		const nextVisitedSymbolIds = new Set(visitedSymbolIds);
+		nextVisitedSymbolIds.add(localCallback.symbol.id);
+		return getFunctionHtmlProof(localCallback.functionNode, scopes, nextVisitedSymbolIds, parameterProofs);
+	}
+	return node.arguments.some((argument) => {
+		const argumentNode = stripParenExpression(argument);
+		return (isFunctionLike$1(argumentNode) ? getFunctionHtmlProof(argumentNode, scopes, new Set(visitedSymbolIds), parameterProofs) : getKatexHtmlProof(argumentNode, scopes, new Set(visitedSymbolIds), parameterProofs)).containsKatex;
+	}) ? UNSUPPORTED_KATEX_PROOF : UNKNOWN_HTML_PROOF;
+};
+const getKatexHtmlProof = (rawNode, scopes, visitedSymbolIds, parameterProofs = /* @__PURE__ */ new Map()) => {
+	const node = stripParenExpression(rawNode);
+	if (isNodeOfType(node, "Literal")) return SAFE_STATIC_HTML_PROOF;
+	if (isNodeOfType(node, "UnaryExpression") && node.operator === "void") return SAFE_STATIC_HTML_PROOF;
+	if (isNodeOfType(node, "Identifier")) {
+		if ((node.name === "undefined" || node.name === "NaN") && scopes.isGlobalReference(node)) return SAFE_STATIC_HTML_PROOF;
+		const symbol = scopes.referenceFor(node)?.resolvedSymbol;
+		const parameterProof = symbol ? parameterProofs.get(symbol.id) : void 0;
+		if (parameterProof) return parameterProof;
+		if (!symbol || symbol.kind !== "const" || !symbol.initializer || visitedSymbolIds.has(symbol.id)) return UNKNOWN_HTML_PROOF;
+		const nextVisitedSymbolIds = new Set(visitedSymbolIds);
+		nextVisitedSymbolIds.add(symbol.id);
+		return getKatexHtmlProof(symbol.initializer, scopes, nextVisitedSymbolIds, parameterProofs);
+	}
+	if (isNodeOfType(node, "CallExpression")) return getKatexCallProof(node, scopes, visitedSymbolIds, parameterProofs);
+	if (isNodeOfType(node, "TemplateLiteral")) return getTemplateLiteralProof(node, scopes, visitedSymbolIds, parameterProofs);
+	if (isNodeOfType(node, "ConditionalExpression")) return combineHtmlProofs([getKatexHtmlProof(node.consequent, scopes, new Set(visitedSymbolIds), parameterProofs), getKatexHtmlProof(node.alternate, scopes, new Set(visitedSymbolIds), parameterProofs)]);
+	if (isNodeOfType(node, "LogicalExpression") && node.operator === "&&") return getKatexHtmlProof(node.right, scopes, visitedSymbolIds, parameterProofs);
+	if (isNodeOfType(node, "BinaryExpression") && node.operator === "+" || isNodeOfType(node, "LogicalExpression")) return combineHtmlProofs([getKatexHtmlProof(node.left, scopes, new Set(visitedSymbolIds), parameterProofs), getKatexHtmlProof(node.right, scopes, new Set(visitedSymbolIds), parameterProofs)]);
+	if (isNodeOfType(node, "SequenceExpression")) {
+		const resultExpression = node.expressions.at(-1);
+		return resultExpression ? getKatexHtmlProof(resultExpression, scopes, visitedSymbolIds, parameterProofs) : UNKNOWN_HTML_PROOF;
+	}
+	return UNKNOWN_HTML_PROOF;
+};
+//#endregion
+//#region src/plugin/rules/security-scan/utils/get-katex-sink-proof-ranges.ts
+const getDangerouslySetInnerHtmlExpression = (attribute) => {
+	let objectExpression = null;
+	if (isNodeOfType(attribute, "JSXAttribute") && isNodeOfType(attribute.name, "JSXIdentifier") && attribute.name.name === "dangerouslySetInnerHTML" && isNodeOfType(attribute.value, "JSXExpressionContainer") && isNodeOfType(attribute.value.expression, "ObjectExpression")) objectExpression = attribute.value.expression;
+	if (isNodeOfType(attribute, "Property") && getStaticPropertyKeyName(attribute, { allowComputedString: true }) === "dangerouslySetInnerHTML" && isNodeOfType(stripParenExpression(attribute.value), "ObjectExpression")) objectExpression = stripParenExpression(attribute.value);
+	if (!isNodeOfType(objectExpression, "ObjectExpression")) return null;
+	let htmlExpression = null;
+	for (const property of objectExpression.properties) {
+		if (isNodeOfType(property, "SpreadElement")) {
+			htmlExpression = null;
+			continue;
+		}
+		if (!isNodeOfType(property, "Property")) {
+			htmlExpression = null;
+			continue;
+		}
+		const propertyName = getStaticPropertyKeyName(property, { allowComputedString: true });
+		if (propertyName === null) {
+			htmlExpression = null;
+			continue;
+		}
+		if (propertyName === "__html") htmlExpression = property.value;
+	}
+	return htmlExpression;
+};
+const collectKatexSinkProofRanges = (fileContent, filename) => {
+	const program = parseSourceText({
+		filename,
+		sourceText: fileContent
+	});
+	if (program === null) return [];
+	const scopes = analyzeScopes(program);
+	registerKatexProofSource(scopes, filename, 0);
+	const ranges = [];
+	walkAst(program, (node) => {
+		const htmlExpression = getDangerouslySetInnerHtmlExpression(node);
+		if (htmlExpression === null) return;
+		const proof = getKatexHtmlProof(htmlExpression, scopes, /* @__PURE__ */ new Set());
+		if (!proof.containsKatex) return;
+		const startIndex = getNodeStartIndex(node);
+		const endIndex = getNodeEndIndex(node);
+		if (startIndex < 0 || endIndex < 0) return;
+		ranges.push({
+			endIndex,
+			proof,
+			startIndex
+		});
+	});
+	return ranges;
+};
+//#endregion
 //#region src/plugin/rules/security-scan/dangerous-html-sink.ts
 const DANGEROUS_HTML_PATTERN = /dangerouslySetInnerHTML|(?:\.(?:inner|outer)HTML|\[\s*["'](?:inner|outer)HTML["']\s*\])\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\(|\bdocument\.write(?:ln)?\s*\(|\.(?:createContextualFragment|setHTMLUnsafe)\s*\(/;
 const HTML_VALUE_START_PATTERN = /(?:__html\s*:|(?:\.(?:inner|outer)HTML|\[\s*["'](?:inner|outer)HTML["']\s*\])\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\(\s*[^,]*,|\bdocument\.write(?:ln)?\s*\(|\.(?:createContextualFragment|setHTMLUnsafe)\s*\()\s*([\s\S]*)/;
@@ -10804,6 +12082,7 @@ const dangerousHtmlSink = defineRule({
 		if (HIDDEN_TOOLING_DIRECTORY_PATTERN.test(file.relativePath)) return [];
 		if (SANITIZER_WRAPPER_PATH_PATTERN.test(file.relativePath)) return [];
 		if (!DANGEROUS_HTML_PATTERN.test(file.content)) return [];
+		const katexSinkProofRanges = collectKatexSinkProofRanges(file.content, file.absolutePath);
 		const findings = [];
 		const lines = file.content.split("\n");
 		for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
@@ -10819,6 +12098,9 @@ const dangerousHtmlSink = defineRule({
 			const terminatorIndex = valueTail.search(/[;}]/);
 			const valueExpression = terminatorIndex >= 0 ? valueTail.slice(0, terminatorIndex + 1) : valueTail;
 			const sinkIndex = lines.slice(0, lineIndex).join("\n").length + (lineIndex > 0 ? 1 : 0) + line.search(DANGEROUS_HTML_PATTERN);
+			const katexSinkProof = katexSinkProofRanges.find((range) => sinkIndex >= range.startIndex && sinkIndex < range.endIndex)?.proof;
+			if (katexSinkProof?.isConclusive && katexSinkProof.isSafe) continue;
+			const hasUnsafeKatexProof = katexSinkProof?.isConclusive === true;
 			if (STRING_LITERAL_VALUE_PATTERN.test(valueExpression)) continue;
 			if (MODULE_CONSTANT_VALUE_PATTERN.test(valueExpression)) continue;
 			if (DOM_CONTENT_SOURCE_VALUE_PATTERN.test(valueExpression) && !valueExpression.includes("+")) {
@@ -10839,21 +12121,21 @@ const dangerousHtmlSink = defineRule({
 			if (templateInterpolations === "") continue;
 			const judgedExpression = templateInterpolations ?? valueExpression;
 			const doesJudgedExpressionCombineValues = splitTopLevelByPlus(judgedExpression).length > 1 || (templateInterpolations?.match(/\$\{/g)?.length ?? 0) > 1;
-			if (!doesJudgedExpressionCombineValues && SANITIZER_PATTERN.test(judgedExpression)) continue;
+			if (!hasUnsafeKatexProof && !doesJudgedExpressionCombineValues && SANITIZER_PATTERN.test(judgedExpression)) continue;
 			if (!doesJudgedExpressionCombineValues && ENV_CONFIG_VALUE_PATTERN.test(judgedExpression)) continue;
 			if (!doesJudgedExpressionCombineValues && I18N_VALUE_PATTERN.test(judgedExpression)) continue;
-			if (!isHtmlTainted(judgedExpression, file.content, sinkIndex, /* @__PURE__ */ new Set(), /* @__PURE__ */ new Set())) continue;
-			if (ESCAPING_SERIALIZER_CALL_PATTERN.test(valueExpression)) continue;
-			if (isTrustedHighlighterValue(valueExpression, file.content, sinkIndex)) continue;
+			if (!hasUnsafeKatexProof && !isHtmlTainted(judgedExpression, file.content, sinkIndex, /* @__PURE__ */ new Set(), /* @__PURE__ */ new Set())) continue;
+			if (!hasUnsafeKatexProof && ESCAPING_SERIALIZER_CALL_PATTERN.test(valueExpression)) continue;
+			if (!hasUnsafeKatexProof && isTrustedHighlighterValue(valueExpression, file.content, sinkIndex)) continue;
 			if (valueIdentifier !== void 0) {
 				const escapedIdentifier = escapeRegExp(valueIdentifier);
 				const visibleDeclaration = findVisibleIdentifierDeclaration(valueIdentifier, sinkIndex, file.content);
 				const visibleInitializer = visibleDeclaration?.initializer;
 				if (!(visibleInitializer !== void 0 && (splitTopLevelByPlus(visibleInitializer).length > 1 || (visibleInitializer.match(/\$\{/g)?.length ?? 0) > 1))) {
 					const fromSerializer = new RegExp(`\\b${escapedIdentifier}\\b\\s*${SERIALIZER_ASSIGNMENT_PATTERN.source}`, "i");
-					if (visibleInitializer === void 0 ? fromSerializer.test(file.content) : visibleDeclaration !== null && isDeclarationStable(valueIdentifier, visibleDeclaration, sinkIndex, file.content) && SERIALIZER_CALL_PROVENANCE_PATTERN.test(visibleInitializer)) continue;
+					if (!hasUnsafeKatexProof && (visibleInitializer === void 0 ? fromSerializer.test(file.content) : visibleDeclaration !== null && isDeclarationStable(valueIdentifier, visibleDeclaration, sinkIndex, file.content) && SERIALIZER_CALL_PROVENANCE_PATTERN.test(visibleInitializer))) continue;
 					const fromSanitizer = new RegExp(`\\b${escapedIdentifier}\\b\\s*${SANITIZED_ASSIGNMENT_PATTERN.source}`, "i");
-					if (visibleInitializer === void 0 ? fromSanitizer.test(file.content) : visibleDeclaration !== null && isDeclarationStable(valueIdentifier, visibleDeclaration, sinkIndex, file.content) && SANITIZED_ASSIGNMENT_PATTERN.test(`=${visibleInitializer}`)) continue;
+					if (!hasUnsafeKatexProof && (visibleInitializer === void 0 ? fromSanitizer.test(file.content) : visibleDeclaration !== null && isDeclarationStable(valueIdentifier, visibleDeclaration, sinkIndex, file.content) && SANITIZED_ASSIGNMENT_PATTERN.test(`=${visibleInitializer}`))) continue;
 				}
 				if (new RegExp(`\\b${escapedIdentifier}\\b\\s*${DOM_CONTENT_ASSIGNMENT_PATTERN.source}`).test(file.content)) continue;
 				if (new RegExp(`highlight[\\w$]*\\s*\\.map\\(\\s*(?:async\\s+)?\\(?\\s*${escapedIdentifier}\\b`, "i").test(file.content) && HIGHLIGHTER_LIBRARY_PATTERN.test(file.content)) continue;
@@ -12543,6 +13825,7 @@ const isNodeReachableWithinFunction = (node, context) => {
 const OBSERVER_REGISTRATION_METHOD_NAME = "observe";
 const CLEANUP_EFFECT_HOOK_NAMES = new Set([...EFFECT_HOOK_NAMES$1, "useInsertionEffect"]);
 const REPLAYABLE_ITERATOR_COLLECTION_CACHE = /* @__PURE__ */ new WeakMap();
+const REACT_REF_EFFECT_ANALYSIS_CACHE = /* @__PURE__ */ new WeakMap();
 const RESOURCE_NOUN_BY_KIND = {
 	subscribe: "subscription",
 	timer: "timer",
@@ -13367,7 +14650,7 @@ const hasGuardedDeferredCleanup = (callback, usage, cleanupReturns, context) =>
 const effectHasCleanupForUsage = (callback, usage, context) => {
 	if (!isNodeOfType(callback, "ArrowFunctionExpression") && !isNodeOfType(callback, "FunctionExpression")) return false;
 	if (callback.async) return false;
-	if (usage.kind === "subscribe" && findEnclosingFunction$1(usage.node) === callback && doesResourceResultEscape(usage.node, true) && isCleanupReturningSubscribeLikeCallExpression(usage.node)) return true;
+	if (usage.kind === "subscribe" && findEnclosingFunction$1(usage.node) === callback && doesResourceResultEscape(usage.node, true, true, context) && isCleanupReturningSubscribeLikeCallExpression(usage.node)) return true;
 	if (!isNodeOfType(callback.body, "BlockStatement")) return callback.body === usage.node && isCleanupReturningSubscribeLikeCallExpression(callback.body);
 	const matchingCleanupReturns = [];
 	walkInsideStatementBlocks(callback.body, (child) => {
@@ -13520,9 +14803,11 @@ const doesReleaseCallMatchUsage = (node, usage, context) => {
 		return isNodeOfType(handlerArgument, "Literal") && handlerArgument.value === null;
 	}
 	if (releaseVerbName === "removeEventListener" || releaseVerbName === "removeListener" || releaseVerbName === "off") {
-		const releaseHandler = callNode.arguments?.[1];
+		const usesUnaryListenerSignature = usage.registrationVerbName === "addListener" && isNodeOfType(usage.node, "CallExpression") && usage.node.arguments?.length === 1 && callNode.arguments?.length === 1;
+		const releaseHandler = usesUnaryListenerSignature ? callNode.arguments?.[0] : callNode.arguments?.[1];
 		if (!releaseHandler) return releaseVerbName === "off";
-		return usage.handlerKey !== null && resolveExpressionKey(releaseHandler, context) === usage.handlerKey;
+		const expectedHandlerKey = usesUnaryListenerSignature ? usage.eventKey : usage.handlerKey;
+		return expectedHandlerKey !== null && resolveExpressionKey(releaseHandler, context) === expectedHandlerKey;
 	}
 	if (releaseVerbName === "unobserve" && usage.eventKey !== null) return releaseEventKey === usage.eventKey;
 	return true;
@@ -13553,6 +14838,8 @@ const isReleaseReachableForUsage = (releaseNode, usage, context) => {
 	const releaseFunction = findEnclosingFunction$1(releaseNode);
 	if (!releaseFunction) return true;
 	if (releaseFunction === findEnclosingFunction$1(usage.node)) return true;
+	const usageFunction = findEnclosingFunction$1(usage.node);
+	if (usageFunction && isFunctionLike$1(usageFunction) && getAssignedReactRefSymbol(usageFunction, context) && isCleanupFunctionReferencedByReturn(usageFunction, releaseFunction, context)) return isReactRefCallbackCleanupOwnedByEffect(usageFunction, releaseFunction, usage, context);
 	return isPotentiallyReachableFunction(releaseFunction, context);
 };
 const fileContainsReleaseForUsage = (usage, context) => {
@@ -13793,7 +15080,23 @@ const isUseSyncExternalStoreSubscribeFunction = (functionNode, context) => {
 	};
 	return isSubscribeBinding(bindingIdentifier);
 };
-const doesResourceResultEscape = (resourceNode, allowConciseReturnEscape) => {
+const findUnconditionalReturnStatement = (expression, ownerFunction) => {
+	let expressionRoot = findTransparentExpressionRoot(expression);
+	while (isNodeOfType(expressionRoot.parent, "SequenceExpression") && expressionRoot.parent.expressions.at(-1) === expressionRoot) expressionRoot = findTransparentExpressionRoot(expressionRoot.parent);
+	const returnStatement = expressionRoot.parent;
+	return isNodeOfType(returnStatement, "ReturnStatement") && returnStatement.argument === expressionRoot && findEnclosingFunction$1(returnStatement) === ownerFunction ? returnStatement : null;
+};
+const getFinalSequenceExpressionValue = (expression) => {
+	let finalExpression = stripParenExpression(expression);
+	while (isNodeOfType(finalExpression, "SequenceExpression")) {
+		const sequenceResult = finalExpression.expressions.at(-1);
+		if (!sequenceResult) break;
+		finalExpression = stripParenExpression(sequenceResult);
+	}
+	return finalExpression;
+};
+const doesResourceResultEscape = (resourceNode, allowReturnedResourceEscape, allowConciseReturnEscape, context) => {
+	if (!allowReturnedResourceEscape) return false;
 	let currentNode = resourceNode;
 	let parentNode = currentNode.parent;
 	while (parentNode) {
@@ -13804,22 +15107,38 @@ const doesResourceResultEscape = (resourceNode, allowConciseReturnEscape) => {
 			parentNode = currentNode.parent;
 			continue;
 		}
+		if (isNodeOfType(parentNode, "ConditionalExpression") && (parentNode.consequent === currentNode || parentNode.alternate === currentNode) || isNodeOfType(parentNode, "LogicalExpression") && (parentNode.right === currentNode || parentNode.left === currentNode && parentNode.operator !== "&&")) {
+			currentNode = parentNode;
+			parentNode = currentNode.parent;
+			continue;
+		}
+		if (isNodeOfType(parentNode, "VariableDeclarator") && parentNode.init === currentNode && isNodeOfType(parentNode.id, "Identifier") && isNodeOfType(parentNode.parent, "VariableDeclaration") && parentNode.parent.kind === "const") {
+			const ownerFunction = findEnclosingFunction$1(resourceNode);
+			const resourceSymbol = context.scopes.symbolFor(parentNode.id);
+			if (!ownerFunction || !resourceSymbol) return false;
+			return doMatchingNodesCoverEveryPathAfterUsage(resourceNode, resourceSymbol.references.flatMap((reference) => {
+				if (reference.flag !== "read") return [];
+				const returnStatement = findUnconditionalReturnStatement(reference.identifier, ownerFunction);
+				return returnStatement ? [returnStatement] : [];
+			}), context);
+		}
 		return false;
 	}
 	return false;
 };
-const findRetainedFunctionLeak = (retainedFunction, context) => {
+const findRetainedFunctionLeak = (retainedFunction, context, options) => {
 	if (!isFunctionLike$1(retainedFunction)) return null;
 	const body = retainedFunction.body;
 	if (!body) return null;
 	let leak = null;
-	const allowConciseReturnEscape = !isInlineRetainedHandlerFunction(retainedFunction, context);
+	const allowReturnedResourceEscape = options?.allowReturnedResourceEscape !== false && !retainedFunction.async && !isInlineRetainedHandlerFunction(retainedFunction, context);
+	const allowReturnedSocketEscape = allowReturnedResourceEscape && options?.requireCallableReturnedResource !== true;
 	const isExternalStoreSubscribeFunction = isUseSyncExternalStoreSubscribeFunction(retainedFunction, context);
 	const hasReleaseForUsage = (usage) => isExternalStoreSubscribeFunction ? effectHasCleanupForUsage(retainedFunction, usage, context) : fileContainsReleaseForUsage(usage, context) || hasGuaranteedRefOwnedUnmountCleanup(retainedFunction, usage, context);
 	walkAst(body, (child) => {
 		if (leak !== null) return false;
 		if (isFunctionLike$1(child)) return false;
-		if (isSocketConstruction(child) && !doesResourceResultEscape(child, false)) {
+		if (isSocketConstruction(child) && !doesResourceResultEscape(child, allowReturnedSocketEscape, false, context)) {
 			const socketUsage = {
 				kind: "socket",
 				node: child,
@@ -13836,14 +15155,14 @@ const findRetainedFunctionLeak = (retainedFunction, context) => {
 			}
 		}
 		if (!isNodeOfType(child, "CallExpression")) return;
-		if (isNodeOfType(child.callee, "Identifier") && child.callee.name === "setInterval" && !doesResourceResultEscape(child, allowConciseReturnEscape)) {
+		if (isNodeOfType(child.callee, "Identifier") && (child.callee.name === "setInterval" || options?.includeOneShotTimers === true && child.callee.name === "setTimeout" && context.scopes.isGlobalReference(child.callee)) && (options?.allowReturnedTimerEscape === false || !doesResourceResultEscape(child, true, allowReturnedResourceEscape, context))) {
 			const timerUsage = {
 				kind: "timer",
 				node: child,
-				resourceName: "setInterval",
+				resourceName: child.callee.name,
 				handleKey: findAssignedResourceKey(child, context),
 				receiverKey: null,
-				registrationVerbName: "setInterval",
+				registrationVerbName: child.callee.name,
 				eventKey: null,
 				handlerKey: null
 			};
@@ -13852,7 +15171,7 @@ const findRetainedFunctionLeak = (retainedFunction, context) => {
 				return false;
 			}
 		}
-		if (isSubscribeOrObserveCall(child) && !doesResourceResultEscape(child, allowConciseReturnEscape)) {
+		if (isSubscribeOrObserveCall(child) && (!doesResourceResultEscape(child, allowReturnedResourceEscape, allowReturnedResourceEscape, context) || options?.requireCallableReturnedResource === true && !isCleanupReturningSubscribeLikeCallExpression(child))) {
 			const registrationDetails = getCallRegistrationDetails(child, context);
 			const subscriptionUsage = {
 				kind: "subscribe",
@@ -13867,6 +15186,184 @@ const findRetainedFunctionLeak = (retainedFunction, context) => {
 	});
 	return leak;
 };
+const getAssignedReactRefCallbackDefinition = (functionNode, context) => {
+	if (!isFunctionLike$1(functionNode)) return null;
+	if (functionNode.generator) return null;
+	const functionRoot = findTransparentExpressionRoot(functionNode);
+	const assignment = functionRoot.parent;
+	if (!isNodeOfType(assignment, "AssignmentExpression") || assignment.operator !== "=" || assignment.right !== functionRoot) return null;
+	const refSymbol = resolveReactRefSymbol(stripParenExpression(assignment.left), context.scopes);
+	if (!refSymbol) return null;
+	const componentFunction = findRenderPhaseComponentOrHook(assignment, context.scopes);
+	if (!isFunctionLike$1(componentFunction) || findEnclosingFunction$1(assignment) !== componentFunction || findEnclosingFunction$1(refSymbol.bindingIdentifier) !== componentFunction || !isNodeReachableWithinFunction(assignment, context)) return null;
+	return {
+		assignmentNode: assignment,
+		functionNode,
+		refSymbol
+	};
+};
+const getAssignedReactRefSymbol = (functionNode, context) => getAssignedReactRefCallbackDefinition(functionNode, context)?.refSymbol ?? null;
+const isExpressionReturnedFromFunction = (expression, ownerFunction, context) => {
+	let expressionRoot = findTransparentExpressionRoot(expression);
+	const bindingDeclarator = expressionRoot.parent;
+	if (isNodeOfType(bindingDeclarator, "VariableDeclarator") && bindingDeclarator.init === expressionRoot && isNodeOfType(bindingDeclarator.id, "Identifier") && isNodeOfType(bindingDeclarator.parent, "VariableDeclaration") && bindingDeclarator.parent.kind === "const") {
+		const resultSymbol = context.scopes.symbolFor(bindingDeclarator.id);
+		if (!resultSymbol) return false;
+		return doMatchingNodesCoverEveryPathAfterUsage(expression, resultSymbol.references.flatMap((reference) => {
+			if (reference.flag !== "read") return [];
+			const returnStatement = findUnconditionalReturnStatement(reference.identifier, ownerFunction);
+			return returnStatement ? [returnStatement] : [];
+		}), context);
+	}
+	while (true) {
+		const container = expressionRoot.parent;
+		if (isNodeOfType(container, "ConditionalExpression") && (container.consequent === expressionRoot || container.alternate === expressionRoot)) {
+			expressionRoot = findTransparentExpressionRoot(container);
+			continue;
+		}
+		if (isNodeOfType(container, "SequenceExpression") && container.expressions.at(-1) === expressionRoot) {
+			expressionRoot = findTransparentExpressionRoot(container);
+			continue;
+		}
+		if (isNodeOfType(container, "LogicalExpression") && container.right === expressionRoot) {
+			expressionRoot = findTransparentExpressionRoot(container);
+			continue;
+		}
+		break;
+	}
+	const returnStatement = expressionRoot.parent;
+	return Boolean(isNodeOfType(returnStatement, "ReturnStatement") && returnStatement.argument === expressionRoot && findEnclosingFunction$1(returnStatement) === ownerFunction || isNodeOfType(ownerFunction, "ArrowFunctionExpression") && ownerFunction.body === expressionRoot);
+};
+const isReactRefCurrentCall = (node, refSymbol, context) => isNodeOfType(node, "CallExpression") && resolveReactRefSymbol(stripParenExpression(node.callee), context.scopes)?.id === refSymbol.id;
+const collectAssignedReactRefCallbacks = (componentFunction, context) => {
+	const callbackDefinitionsByRefSymbolId = /* @__PURE__ */ new Map();
+	walkAst(componentFunction.body, (child) => {
+		if (!isFunctionLike$1(child)) return;
+		const callbackDefinition = getAssignedReactRefCallbackDefinition(child, context);
+		if (callbackDefinition) {
+			const existingDefinitions = callbackDefinitionsByRefSymbolId.get(callbackDefinition.refSymbol.id) ?? [];
+			existingDefinitions.push(callbackDefinition);
+			callbackDefinitionsByRefSymbolId.set(callbackDefinition.refSymbol.id, existingDefinitions);
+		}
+		return false;
+	});
+	for (const [refSymbolId, callbackDefinitions] of callbackDefinitionsByRefSymbolId) {
+		const activeDefinitions = callbackDefinitions.filter((callbackDefinition) => !doMatchingNodesCoverEveryPathAfterUsage(callbackDefinition.assignmentNode, callbackDefinitions.filter((otherDefinition) => otherDefinition !== callbackDefinition).map((otherDefinition) => otherDefinition.assignmentNode), context));
+		if (activeDefinitions.length === 0) callbackDefinitionsByRefSymbolId.delete(refSymbolId);
+		else callbackDefinitionsByRefSymbolId.set(refSymbolId, activeDefinitions);
+	}
+	return callbackDefinitionsByRefSymbolId;
+};
+const collectUndominatedReactRefCalls = (ownerFunction, refSymbol, context) => {
+	if (!isFunctionLike$1(ownerFunction)) return [];
+	const refWrites = [];
+	const refCalls = [];
+	walkAst(ownerFunction.body, (child) => {
+		if (child !== ownerFunction.body && isFunctionLike$1(child)) return false;
+		if (isNodeOfType(child, "AssignmentExpression") && isNodeReachableWithinFunction(child, context) && resolveReactRefSymbol(stripParenExpression(child.left), context.scopes)?.id === refSymbol.id) refWrites.push(child);
+		if (isReactRefCurrentCall(child, refSymbol, context) && isNodeReachableWithinFunction(child, context)) refCalls.push(child);
+	});
+	return refCalls.filter((refCall) => !doMatchingNodesCoverEveryPathBeforeUsage(refCall, refWrites, ownerFunction, context));
+};
+const mergeReactRefEffectUsage = (usageByRefSymbolId, refSymbolId, doesEffectOwnResult) => {
+	const existingUsage = usageByRefSymbolId.get(refSymbolId);
+	if (!existingUsage) {
+		usageByRefSymbolId.set(refSymbolId, { doesEffectOwnEveryResult: doesEffectOwnResult });
+		return true;
+	}
+	if (!existingUsage.doesEffectOwnEveryResult || doesEffectOwnResult) return false;
+	existingUsage.doesEffectOwnEveryResult = false;
+	return true;
+};
+const collectReactRefEffectAnalysis = (componentFunction, context) => {
+	let analysisByComponent = REACT_REF_EFFECT_ANALYSIS_CACHE.get(context);
+	if (!analysisByComponent) {
+		analysisByComponent = /* @__PURE__ */ new WeakMap();
+		REACT_REF_EFFECT_ANALYSIS_CACHE.set(context, analysisByComponent);
+	}
+	const cachedAnalysis = analysisByComponent.get(componentFunction);
+	if (cachedAnalysis) return cachedAnalysis;
+	const callbackDefinitionsByRefSymbolId = collectAssignedReactRefCallbacks(componentFunction, context);
+	const usageByRefSymbolId = /* @__PURE__ */ new Map();
+	walkAst(componentFunction.body, (child) => {
+		if (child !== componentFunction.body && isFunctionLike$1(child)) return false;
+		if (!isNodeOfType(child, "CallExpression") || findEnclosingFunction$1(child) !== componentFunction || !isReactApiCall(child, CLEANUP_EFFECT_HOOK_NAMES, context.scopes, { allowGlobalReactNamespace: true })) return;
+		const effectCallback = getEffectCallback(child);
+		if (!isFunctionLike$1(effectCallback)) return;
+		for (const callbackDefinitions of callbackDefinitionsByRefSymbolId.values()) {
+			const refSymbol = callbackDefinitions[0]?.refSymbol;
+			if (!refSymbol) continue;
+			for (const refCall of collectUndominatedReactRefCalls(effectCallback, refSymbol, context)) mergeReactRefEffectUsage(usageByRefSymbolId, refSymbol.id, !effectCallback.async && isExpressionReturnedFromFunction(refCall, effectCallback, context));
+		}
+	});
+	let didUsageChange = true;
+	while (didUsageChange) {
+		didUsageChange = false;
+		for (const callbackDefinitions of callbackDefinitionsByRefSymbolId.values()) {
+			const ownerRefSymbol = callbackDefinitions[0]?.refSymbol;
+			if (!ownerRefSymbol) continue;
+			const ownerUsage = usageByRefSymbolId.get(ownerRefSymbol.id);
+			if (!ownerUsage) continue;
+			for (const callbackDefinition of callbackDefinitions) for (const targetDefinitions of callbackDefinitionsByRefSymbolId.values()) {
+				const targetRefSymbol = targetDefinitions[0]?.refSymbol;
+				if (!targetRefSymbol) continue;
+				for (const refCall of collectUndominatedReactRefCalls(callbackDefinition.functionNode, targetRefSymbol, context)) {
+					const doesEffectOwnResult = ownerUsage.doesEffectOwnEveryResult && !callbackDefinition.functionNode.async && isExpressionReturnedFromFunction(refCall, callbackDefinition.functionNode, context);
+					if (mergeReactRefEffectUsage(usageByRefSymbolId, targetRefSymbol.id, doesEffectOwnResult)) didUsageChange = true;
+				}
+			}
+		}
+	}
+	const analysis = {
+		callbackDefinitionsByRefSymbolId,
+		usageByRefSymbolId
+	};
+	analysisByComponent.set(componentFunction, analysis);
+	return analysis;
+};
+const getReactRefEffectUsage = (retainedFunction, context) => {
+	if (!isFunctionLike$1(retainedFunction)) return null;
+	const callbackDefinition = getAssignedReactRefCallbackDefinition(retainedFunction, context);
+	const componentFunction = findRenderPhaseComponentOrHook(retainedFunction, context.scopes);
+	if (!callbackDefinition || !isFunctionLike$1(componentFunction)) return null;
+	const analysis = collectReactRefEffectAnalysis(componentFunction, context);
+	if (!analysis.callbackDefinitionsByRefSymbolId.get(callbackDefinition.refSymbol.id)?.some((activeDefinition) => activeDefinition.functionNode === retainedFunction)) return null;
+	return analysis.usageByRefSymbolId.get(callbackDefinition.refSymbol.id) ?? null;
+};
+const isReactRefCallbackCleanupOwnedByEffect = (retainedFunction, cleanupFunction, usage, context) => {
+	if (!isFunctionLike$1(retainedFunction) || retainedFunction.async || getReactRefEffectUsage(retainedFunction, context)?.doesEffectOwnEveryResult !== true) return false;
+	if (!isNodeOfType(retainedFunction.body, "BlockStatement")) return false;
+	const doesReturnedCleanupCallFunction = (returnedValue) => {
+		const returnedCleanupFunction = resolveRefOwnedCleanupFunction(getFinalSequenceExpressionValue(returnedValue), context);
+		if (!returnedCleanupFunction) return false;
+		if (returnedCleanupFunction === cleanupFunction) return true;
+		if (!isFunctionLike$1(returnedCleanupFunction)) return false;
+		const matchingCalls = [];
+		walkAst(returnedCleanupFunction.body, (child) => {
+			if (child !== returnedCleanupFunction.body && isFunctionLike$1(child)) return false;
+			if (isNodeOfType(child, "CallExpression") && resolveRefOwnedCleanupFunction(child.callee, context) === cleanupFunction) matchingCalls.push(child);
+		});
+		return doMatchingNodesCoverEveryPathFromFunctionEntry(returnedCleanupFunction, matchingCalls, context);
+	};
+	const matchingReturns = [];
+	walkInsideStatementBlocks(retainedFunction.body, (child) => {
+		if (isNodeOfType(child, "ReturnStatement") && child.argument && doesReturnedCleanupCallFunction(child.argument)) matchingReturns.push(child);
+	});
+	return doMatchingNodesCoverEveryPathAfterUsage(usage.node, matchingReturns, context);
+};
+const isCleanupFunctionReferencedByReturn = (ownerFunction, cleanupFunction, context) => {
+	if (!isFunctionLike$1(ownerFunction) || !isNodeOfType(ownerFunction.body, "BlockStatement")) return false;
+	let isReferencedByReturn = false;
+	walkInsideStatementBlocks(ownerFunction.body, (child) => {
+		if (isReferencedByReturn || !isNodeOfType(child, "ReturnStatement") || !child.argument) return;
+		walkAst(child.argument, (returnedChild) => {
+			if (resolveRefOwnedCleanupFunction(returnedChild, context) !== cleanupFunction) return;
+			isReferencedByReturn = true;
+			return false;
+		});
+	});
+	return isReferencedByReturn;
+};
 const isRetainedComponentScopeFunction = (functionNode) => {
 	if (isNodeOfType(functionNode, "FunctionDeclaration")) return enclosingComponentOrHookName(functionNode) !== null;
 	if (!isNodeOfType(functionNode, "ArrowFunctionExpression") && !isNodeOfType(functionNode, "FunctionExpression")) return false;
@@ -13901,8 +15398,14 @@ const effectNeedsCleanup = defineRule({
 	recommendation: "Return a cleanup function that stops the subscription or timer: `return () => target.removeEventListener(name, handler)` for listeners, `return () => clearInterval(id)` or `clearTimeout(id)` for timers, `return () => observer.disconnect()` for observers, `return () => socket.close()` for connections, or `return unsubscribe` if the subscribe call already gave you one.",
 	create: (context) => {
 		const reportRetainedLeak = (retainedFunction) => {
-			if (!isPotentiallyReachableFunction(retainedFunction, context)) return;
-			const leak = findRetainedFunctionLeak(retainedFunction, context);
+			const refEffectUsage = getReactRefEffectUsage(retainedFunction, context);
+			if (!refEffectUsage && !isPotentiallyReachableFunction(retainedFunction, context)) return;
+			const leak = findRetainedFunctionLeak(retainedFunction, context, refEffectUsage ? {
+				allowReturnedResourceEscape: refEffectUsage.doesEffectOwnEveryResult,
+				allowReturnedTimerEscape: false,
+				includeOneShotTimers: true,
+				requireCallableReturnedResource: true
+			} : void 0);
 			if (!leak) return;
 			const resourceNoun = RESOURCE_NOUN_BY_KIND[leak.kind];
 			context.report({
@@ -13935,10 +15438,10 @@ const effectNeedsCleanup = defineRule({
 				if (isRetainedComponentScopeFunction(node)) reportRetainedLeak(node);
 			},
 			ArrowFunctionExpression(node) {
-				if (isRetainedComponentScopeFunction(node) || isInlineRetainedHandlerFunction(node, context)) reportRetainedLeak(node);
+				if (isRetainedComponentScopeFunction(node) || isInlineRetainedHandlerFunction(node, context) || getAssignedReactRefSymbol(node, context)) reportRetainedLeak(node);
 			},
 			FunctionExpression(node) {
-				if (isRetainedComponentScopeFunction(node) || isInlineRetainedHandlerFunction(node, context)) reportRetainedLeak(node);
+				if (isRetainedComponentScopeFunction(node) || isInlineRetainedHandlerFunction(node, context) || getAssignedReactRefSymbol(node, context)) reportRetainedLeak(node);
 			}
 		};
 	}
@@ -17340,6 +18843,7 @@ const iframeHasTitle = defineRule({
 	recommendation: "Add a descriptive `title` so screen reader users know what the embedded frame contains.",
 	category: "Accessibility",
 	create: (context) => ({ JSXOpeningElement(node) {
+		if (isLocalTestScaffoldJsx(node, context)) return;
 		const tag = getElementType(node, context.settings);
 		if (tag !== "iframe") return;
 		if (isInsideStaticallyHiddenJsxSubtree(node, context.scopes)) return;
@@ -17860,6 +19364,7 @@ const interactiveSupportsFocus = defineRule({
 		const settings = resolveSettings$37(context.settings);
 		const tabbableSet = new Set(settings.tabbable);
 		return { JSXOpeningElement(node) {
+			if (isLocalTestScaffoldJsx(node, context)) return;
 			if (node.attributes.length === 0) return;
 			if (hasJsxSpreadAttribute$1(node.attributes)) return;
 			const roleAttribute = hasJsxPropIgnoreCase(node.attributes, "role");
@@ -18573,7 +20078,7 @@ const scanPerIterationLayoutReads = (body) => {
 		hasDeliberateForcedReflow
 	};
 };
-const getNodeStart$1 = (node) => {
+const getNodeStart = (node) => {
 	const withRange = node;
 	return withRange.range ? withRange.range[0] : -1;
 };
@@ -18605,7 +20110,7 @@ const hasAttachmentBefore = (scopeOwner, elementName, beforeStart) => {
 		if (!isNodeOfType(child, "CallExpression")) return;
 		const callee = child.callee;
 		if (!isNodeOfType(callee, "MemberExpression") || !isNodeOfType(callee.property, "Identifier") || !DOM_ATTACHMENT_METHOD_NAMES.has(callee.property.name)) return;
-		if (child.arguments.some((argument) => isNodeOfType(argument, "Identifier") && argument.name === elementName) && getNodeStart$1(child) < beforeStart) {
+		if (child.arguments.some((argument) => isNodeOfType(argument, "Identifier") && argument.name === elementName) && getNodeStart(child) < beforeStart) {
 			foundAttachment = true;
 			return false;
 		}
@@ -18627,7 +20132,7 @@ const isProvablyDetachedAtWrite = (styleWriteStatement) => {
 	const elementExpression = assignment.left.object.object;
 	const creationRoot = resolveDetachedCreationRoot(elementExpression, 0);
 	if (!creationRoot) return false;
-	return !hasAttachmentBefore(creationRoot.scopeOwner, creationRoot.rootName, getNodeStart$1(styleWriteStatement));
+	return !hasAttachmentBefore(creationRoot.scopeOwner, creationRoot.rootName, getNodeStart(styleWriteStatement));
 };
 const jsBatchDomCss = defineRule({
 	id: "js-batch-dom-css",
@@ -19350,7 +20855,7 @@ const globSyncReturnsStringPaths = (node, context) => {
 	const callee = stripParenExpression(node.callee);
 	let isGlobSyncImport = false;
 	if (isNodeOfType(callee, "Identifier")) isGlobSyncImport = context.scopes.symbolFor(callee)?.kind === "import" && getImportedNameFromModule(callee, callee.name, "glob") === "globSync";
-	else if (isNodeOfType(callee, "MemberExpression") && !callee.computed && isNodeOfType(callee.object, "Identifier") && isNodeOfType(callee.property, "Identifier") && callee.property.name === "globSync") isGlobSyncImport = context.scopes.symbolFor(callee.object)?.kind === "import" && isNamespaceImportFromModule(callee.object, callee.object.name, "glob");
+	else if (isNodeOfType(callee, "MemberExpression") && !callee.computed && isNodeOfType(callee.object, "Identifier") && isNodeOfType(callee.property, "Identifier") && callee.property.name === "globSync") isGlobSyncImport = context.scopes.symbolFor(callee.object)?.kind === "import" && isNamespaceImportFromModule$1(callee.object, callee.object.name, "glob");
 	if (!isGlobSyncImport) return false;
 	const options = node.arguments[1];
 	if (!options) return true;
@@ -25732,6 +27237,7 @@ const mediaHasCaption = defineRule({
 	create: (context) => {
 		const settings = resolveSettings$23(context.settings);
 		return { JSXOpeningElement(node) {
+			if (isLocalTestScaffoldJsx(node, context)) return;
 			const tag = getElementType(node, context.settings);
 			if (!(settings.audio.has(tag) || settings.video.has(tag))) return;
 			if (evaluateMuted(hasJsxPropIgnoreCase(node.attributes, "muted")) === true) return;
@@ -25799,6 +27305,7 @@ const mouseEventsHaveKeyEvents = defineRule({
 	create: (context) => {
 		const settings = resolveSettings$22(context.settings);
 		return { JSXOpeningElement(node) {
+			if (isLocalTestScaffoldJsx(node, context)) return;
 			const tag = getElementType(node, context.settings);
 			if (!HTML_TAGS.has(tag)) return;
 			for (const handler of settings.hoverInHandlers) {
@@ -25840,7 +27347,11 @@ const mouseEventsHaveKeyEvents = defineRule({
 //#region src/plugin/utils/has-directive.ts
 const hasDirective = (programNode, directive) => {
 	if (!isNodeOfType(programNode, "Program")) return false;
-	return Boolean(programNode.body?.some((statement) => isNodeOfType(statement, "ExpressionStatement") && isNodeOfType(statement.expression, "Literal") && statement.expression.value === directive));
+	for (const statement of programNode.body) {
+		if (!isNodeOfType(statement, "ExpressionStatement") || statement.directive === void 0) return false;
+		if (statement.directive === directive) return true;
+	}
+	return false;
 };
 //#endregion
 //#region src/plugin/rules/nextjs/nextjs-async-client-component.ts
@@ -31938,7 +33449,7 @@ const isReactDomCreatePortalCall = (node, scopes) => {
 	if (!isNodeOfType(callee, "MemberExpression") || callee.computed || !isNodeOfType(callee.object, "Identifier") || !isNodeOfType(callee.property, "Identifier") || callee.property.name !== "createPortal") return false;
 	const symbol = scopes.symbolFor(callee.object);
 	if (!symbol || symbol.kind !== "import") return false;
-	return isDefaultImportFromModule(callee.object, callee.object.name, "react-dom") || isNamespaceImportFromModule(callee.object, callee.object.name, "react-dom");
+	return isDefaultImportFromModule(callee.object, callee.object.name, "react-dom") || isNamespaceImportFromModule$1(callee.object, callee.object.name, "react-dom");
 };
 const containsRenderOutput$1 = (rootNode, scopes) => {
 	let hasRenderOutput = false;
@@ -32667,6 +34178,7 @@ const noChainStateUpdates = defineRule({
 	id: "no-chain-state-updates",
 	title: "State updates chained through effects",
 	severity: "warn",
+	disabledWhen: ["react:18"],
 	tags: ["test-noise"],
 	recommendation: "Set all the related state together in the event handler that starts it, instead of having one useEffect react to a state change and set more state. See https://react.dev/learn/you-might-not-need-an-effect#chains-of-computations",
 	create: (context) => ({ CallExpression(node) {
@@ -32943,16 +34455,7 @@ const isProvenIntrinsicJsxElement = (openingElement, scopes) => {
 	return isIntrinsicValue(openingElement.name);
 };
 //#endregion
-//#region src/plugin/rules/react-builtins/is-safe-create-ref-callback-current-write.ts
-const pathStartsWith$1 = (propertyPath, prefix) => prefix.every((propertyName, index) => propertyPath[index] === propertyName);
-const collectMemberExpression = (identifier) => {
-	let expression = findTransparentExpressionRoot(identifier);
-	while (expression.parent && isNodeOfType(expression.parent, "MemberExpression") && expression.parent.object === expression) {
-		if (!getStaticPropertyName(expression.parent)) return null;
-		expression = findTransparentExpressionRoot(expression.parent);
-	}
-	return expression;
-};
+//#region src/plugin/utils/is-inline-intrinsic-ref-callback.ts
 const isInlineIntrinsicRefCallback = (functionNode, scopes) => {
 	const functionExpression = findTransparentExpressionRoot(functionNode);
 	if (!isFunctionLike$1(functionExpression) || functionExpression.async || functionExpression.generator) return false;
@@ -32963,6 +34466,17 @@ const isInlineIntrinsicRefCallback = (functionNode, scopes) => {
 	const openingElement = attribute.parent;
 	return Boolean(openingElement && isNodeOfType(openingElement, "JSXOpeningElement") && isProvenIntrinsicJsxElement(openingElement, scopes));
 };
+//#endregion
+//#region src/plugin/rules/react-builtins/is-safe-create-ref-callback-current-write.ts
+const pathStartsWith$1 = (propertyPath, prefix) => prefix.every((propertyName, index) => propertyPath[index] === propertyName);
+const collectMemberExpression = (identifier) => {
+	let expression = findTransparentExpressionRoot(identifier);
+	while (expression.parent && isNodeOfType(expression.parent, "MemberExpression") && expression.parent.object === expression) {
+		if (!getStaticPropertyName(expression.parent)) return null;
+		expression = findTransparentExpressionRoot(expression.parent);
+	}
+	return expression;
+};
 const isSafeCreateRefCallbackCurrentWrite = (referenceNode, accessedPropertyPath, targetPropertyPath, scopes) => {
 	if (accessedPropertyPath.length !== targetPropertyPath.length + 1 || !pathStartsWith$1(accessedPropertyPath, targetPropertyPath) || accessedPropertyPath[targetPropertyPath.length] !== "current") return false;
 	const memberExpression = collectMemberExpression(referenceNode);
@@ -33449,6 +34963,151 @@ const isCreateRefResultWriteOnly = (createRefCall, filename, scopes) => {
 	return ownedValue ? analyzeSymbolValuePath(ownedValue, state, 12) : analyzeValueUse(createRefCall, [], environment, state, 12);
 };
 //#endregion
+//#region src/plugin/utils/is-jsx-element-or-fragment.ts
+/**
+* Type-guard for the two single-node JSX output forms: `JSXElement`
+* (`<Foo />`) and `JSXFragment` (`<>…</>`). Canonical home for the
+* `isNodeOfType(x, "JSXElement") || isNodeOfType(x, "JSXFragment")` check
+* that many rules otherwise inline. Does NOT unwrap parens / TS wrappers —
+* callers that need the semantic expression should `stripParenExpression`
+* first.
+*/
+const isJsxElementOrFragment = (node) => Boolean(node && (isNodeOfType(node, "JSXElement") || isNodeOfType(node, "JSXFragment")));
+//#endregion
+//#region src/plugin/rules/react-builtins/is-proven-one-shot-testing-library-component.ts
+const REACT_TESTING_LIBRARY_MODULE_SOURCE = "@testing-library/react";
+const REACT_TESTING_LIBRARY_MODULE_SOURCES = new Set([REACT_TESTING_LIBRARY_MODULE_SOURCE]);
+const TEST_CALLBACK_NAMES = new Set(["it", "test"]);
+const TEST_RUNNER_MODULE_SOURCES = new Set(["@jest/globals", "vitest"]);
+const isNamedImportFromModule = (symbol, importedName, moduleSources) => {
+	if (!symbol || symbol.kind !== "import" || !isNodeOfType(symbol.declarationNode, "ImportSpecifier") || getImportedName(symbol.declarationNode) !== importedName) return false;
+	const importDeclaration = symbol.declarationNode.parent;
+	return Boolean(importDeclaration && isNodeOfType(importDeclaration, "ImportDeclaration") && typeof importDeclaration.source.value === "string" && moduleSources.has(importDeclaration.source.value));
+};
+const isNamespaceImportFromModule = (symbol, moduleSource) => {
+	if (!symbol || symbol.kind !== "import" || !isNodeOfType(symbol.declarationNode, "ImportNamespaceSpecifier")) return false;
+	const importDeclaration = symbol.declarationNode.parent;
+	return Boolean(importDeclaration && isNodeOfType(importDeclaration, "ImportDeclaration") && importDeclaration.source.value === moduleSource);
+};
+const isProvenTestCallback = (functionNode, scopes) => {
+	const callExpression = functionNode.parent;
+	if (!callExpression || !isNodeOfType(callExpression, "CallExpression") || callExpression.arguments[1] !== functionNode) return false;
+	const callee = stripParenExpression(callExpression.callee);
+	if (!isNodeOfType(callee, "Identifier")) return false;
+	if (TEST_CALLBACK_NAMES.has(callee.name) && scopes.isGlobalReference(callee)) return true;
+	const symbol = scopes.symbolFor(callee);
+	if (!symbol || symbol.kind !== "import") return false;
+	const importedName = getImportedName(symbol.declarationNode);
+	return Boolean(importedName && TEST_CALLBACK_NAMES.has(importedName) && isNamedImportFromModule(symbol, importedName, TEST_RUNNER_MODULE_SOURCES));
+};
+const getDirectConstComponentSymbol = (functionNode, scopes) => {
+	const declarator = functionNode.parent;
+	if (!declarator || !isNodeOfType(declarator, "VariableDeclarator") || declarator.init !== functionNode || !isNodeOfType(declarator.id, "Identifier")) return null;
+	const declaration = declarator.parent;
+	if (!declaration || !isNodeOfType(declaration, "VariableDeclaration") || declaration.kind !== "const" || declaration.declarations.length !== 1) return null;
+	const testCallback = findEnclosingFunction$1(declarator);
+	if (!testCallback || !isFunctionLike$1(testCallback) || !isProvenTestCallback(testCallback, scopes) || !isNodeOfType(testCallback.body, "BlockStatement") || declaration.parent !== testCallback.body) return null;
+	return scopes.symbolFor(declarator.id);
+};
+const isCreateRefDeclaration = (statement, scopes) => isNodeOfType(statement, "VariableDeclaration") && statement.kind === "const" && statement.declarations.length > 0 && statement.declarations.every((declarator) => {
+	const initializer = declarator.init ? stripParenExpression(declarator.init) : null;
+	return Boolean(isNodeOfType(declarator.id, "Identifier") && initializer && isNodeOfType(initializer, "CallExpression") && isReactApiCall(initializer, "createRef", scopes, {
+		allowGlobalReactNamespace: true,
+		allowUnboundBareCalls: true,
+		resolveNamedAliases: true
+	}));
+});
+const isSafeReturnedJsx = (returnStatement) => {
+	if (!isNodeOfType(returnStatement, "ReturnStatement") || !returnStatement.argument) return false;
+	const returnedExpression = stripParenExpression(returnStatement.argument);
+	if (!isJsxElementOrFragment(returnedExpression)) return false;
+	let isSafe = true;
+	walkAst(returnedExpression, (node) => {
+		if (isFunctionLike$1(node)) {
+			isSafe = false;
+			return false;
+		}
+		if (isNodeOfType(node, "AssignmentExpression") || isNodeOfType(node, "AwaitExpression") || isNodeOfType(node, "CallExpression") || isNodeOfType(node, "NewExpression") || isNodeOfType(node, "TaggedTemplateExpression") || isNodeOfType(node, "UpdateExpression") || isNodeOfType(node, "YieldExpression")) {
+			isSafe = false;
+			return false;
+		}
+	});
+	return isSafe;
+};
+const hasProvenOneShotComponentBody = (functionNode, scopes) => {
+	if (!isFunctionLike$1(functionNode) || !isNodeOfType(functionNode.body, "BlockStatement")) return false;
+	if (!functionNode.params.every((parameter) => isNodeOfType(parameter, "Identifier"))) return false;
+	const statements = functionNode.body.body;
+	if (statements.length < 2) return false;
+	const returnStatement = statements.at(-1);
+	return Boolean(returnStatement && statements.slice(0, -1).every((statement) => isCreateRefDeclaration(statement, scopes)) && isSafeReturnedJsx(returnStatement));
+};
+const isProvenReactStrictModeElement = (jsxElement, scopes) => {
+	const elementName = jsxElement.openingElement.name;
+	if (isNodeOfType(elementName, "JSXIdentifier")) {
+		const symbol = scopes.symbolFor(elementName);
+		return Boolean(symbol && isImportedFromReact(symbol) && getImportedName(symbol.declarationNode) === "StrictMode");
+	}
+	return Boolean(isNodeOfType(elementName, "JSXMemberExpression") && isNodeOfType(elementName.object, "JSXIdentifier") && elementName.property.name === "StrictMode" && isReactNamespaceImport(elementName.object, scopes));
+};
+const isWhitespaceJsxChild = (node) => isNodeOfType(node, "JSXText") && node.value.trim().length === 0 || isNodeOfType(node, "JSXExpressionContainer") && isNodeOfType(node.expression, "JSXEmptyExpression");
+const getRootElementForComponentReference = (identifier, scopes) => {
+	const openingElement = identifier.parent;
+	if (!openingElement || !isNodeOfType(openingElement, "JSXOpeningElement") || openingElement.name !== identifier || !openingElement.selfClosing || openingElement.attributes.length !== 0) return null;
+	const componentElement = openingElement.parent;
+	if (!componentElement || !isNodeOfType(componentElement, "JSXElement")) return null;
+	const strictModeElement = componentElement.parent;
+	if (!strictModeElement || !isNodeOfType(strictModeElement, "JSXElement")) return componentElement;
+	if (strictModeElement.openingElement.attributes.length !== 0 || !isProvenReactStrictModeElement(strictModeElement, scopes)) return null;
+	const renderedChildren = strictModeElement.children.filter((child) => !isWhitespaceJsxChild(child));
+	return renderedChildren.length === 1 && renderedChildren[0] === componentElement ? strictModeElement : null;
+};
+const isProvenTestingLibraryRenderCall = (callExpression, scopes) => {
+	const callee = stripParenExpression(callExpression.callee);
+	if (isNodeOfType(callee, "Identifier")) return isNamedImportFromModule(scopes.symbolFor(callee), "render", REACT_TESTING_LIBRARY_MODULE_SOURCES);
+	return Boolean(isNodeOfType(callee, "MemberExpression") && getStaticPropertyName(callee) === "render" && isNodeOfType(callee.object, "Identifier") && isNamespaceImportFromModule(scopes.symbolFor(callee.object), REACT_TESTING_LIBRARY_MODULE_SOURCE));
+};
+const isSafeRenderResultBinding = (pattern) => {
+	if (!isNodeOfType(pattern, "ObjectPattern")) return false;
+	return pattern.properties.every((property) => {
+		if (!isNodeOfType(property, "Property") || property.computed) return false;
+		return isNodeOfType(property.value, "Identifier") && getStaticPropertyKeyName(property) !== "rerender";
+	});
+};
+const isDirectSafeRenderStatement = (callExpression, testCallback) => {
+	if (!isFunctionLike$1(testCallback) || !isNodeOfType(testCallback.body, "BlockStatement")) return false;
+	const expression = findTransparentExpressionRoot(callExpression);
+	const parent = expression.parent;
+	if (!parent) return false;
+	if (isNodeOfType(parent, "ExpressionStatement")) return parent.parent === testCallback.body;
+	if (!isNodeOfType(parent, "VariableDeclarator") || parent.init !== expression || !isSafeRenderResultBinding(parent.id)) return false;
+	const declaration = parent.parent;
+	return Boolean(declaration && isNodeOfType(declaration, "VariableDeclaration") && declaration.declarations.length === 1 && declaration.parent === testCallback.body);
+};
+const getProvenIndependentRenderCall = (componentReference, scopes) => {
+	const rootElement = getRootElementForComponentReference(componentReference, scopes);
+	if (!rootElement) return null;
+	const renderedArgument = findTransparentExpressionRoot(rootElement);
+	const callExpression = renderedArgument.parent;
+	if (!callExpression || !isNodeOfType(callExpression, "CallExpression") || callExpression.arguments.length !== 1 || callExpression.arguments[0] !== renderedArgument || !isProvenTestingLibraryRenderCall(callExpression, scopes)) return null;
+	return callExpression;
+};
+const isProvenOneShotTestingLibraryComponent = (functionNode, filename, scopes) => {
+	if (!filename || !isTestlikeFilename(filename) || !hasProvenOneShotComponentBody(functionNode, scopes)) return false;
+	const componentSymbol = getDirectConstComponentSymbol(functionNode, scopes);
+	if (!componentSymbol || componentSymbol.references.length === 0) return false;
+	const testCallback = findEnclosingFunction$1(componentSymbol.bindingIdentifier);
+	if (!testCallback) return false;
+	const renderCalls = /* @__PURE__ */ new Set();
+	for (const reference of componentSymbol.references) {
+		if (reference.flag !== "read") return false;
+		const renderCall = getProvenIndependentRenderCall(reference.identifier, scopes);
+		if (!renderCall || findEnclosingFunction$1(renderCall) !== testCallback || !isDirectSafeRenderStatement(renderCall, testCallback)) return false;
+		renderCalls.add(renderCall);
+	}
+	return renderCalls.size > 0;
+};
+//#endregion
 //#region src/plugin/rules/react-builtins/no-create-ref-in-function-component.ts
 const MESSAGE$31 = "`createRef()` may escape or be observed beyond the render that created it, so a later render can replace the ref object and detach the observed one. Hoist a `useRef()` call to the component's unconditional top level instead.";
 const isUseMemoCallbackArgument = (functionNode, scopes) => {
@@ -33462,6 +35121,27 @@ const findEnclosingRenderFunction = (node, scopes) => {
 	while (enclosingFunction && isUseMemoCallbackArgument(enclosingFunction, scopes)) enclosingFunction = findEnclosingFunction$1(enclosingFunction);
 	return enclosingFunction;
 };
+const isReactUseStateInitialState = (node, scopes) => {
+	const initialState = findTransparentExpressionRoot(node);
+	const stateCall = initialState.parent;
+	return Boolean(stateCall && isNodeOfType(stateCall, "CallExpression") && stateCall.arguments[0] === initialState && isReactApiCall(stateCall, "useState", scopes, {
+		allowGlobalReactNamespace: true,
+		resolveNamedAliases: true
+	}));
+};
+const hasDirectExportWrapper = (declarationNode) => {
+	const parent = declarationNode.parent;
+	if (isNodeOfType(parent, "ExportNamedDeclaration") || isNodeOfType(parent, "ExportDefaultDeclaration")) return true;
+	return Boolean(isNodeOfType(declarationNode, "VariableDeclarator") && (isNodeOfType(parent?.parent, "ExportNamedDeclaration") || isNodeOfType(parent?.parent, "ExportDefaultDeclaration")));
+};
+const isFunctionExclusivelyUsedAsReactStateInitializer = (functionNode, scopes) => {
+	if (isReactUseStateInitialState(functionNode, scopes)) return true;
+	const bindingIdentifier = getFunctionBindingIdentifier$1(findTransparentExpressionRoot(functionNode));
+	if (!bindingIdentifier) return false;
+	const bindingSymbol = isNodeOfType(functionNode, "FunctionDeclaration") ? scopes.scopeFor(functionNode).symbolsByName.get(bindingIdentifier.name) : scopes.symbolFor(bindingIdentifier);
+	if (!bindingSymbol || bindingSymbol.kind !== "const" && bindingSymbol.kind !== "function" || hasDirectExportWrapper(bindingSymbol.declarationNode) || bindingSymbol.references.length === 0) return false;
+	return bindingSymbol.references.every((reference) => reference.flag === "read" && isReactUseStateInitialState(reference.identifier, scopes));
+};
 const noCreateRefInFunctionComponent = defineRule({
 	id: "no-create-ref-in-function-component",
 	title: "createRef in function component",
@@ -33478,6 +35158,8 @@ const noCreateRefInFunctionComponent = defineRule({
 		const displayName = componentOrHookDisplayNameForFunction(enclosingFunction);
 		if (!displayName) return;
 		if (!(isReactHookName(displayName) || functionContainsReactRenderOutput(enclosingFunction, context.scopes, context.cfg))) return;
+		if (isReactUseStateInitialState(node, context.scopes) || isFunctionExclusivelyUsedAsReactStateInitializer(enclosingFunction, context.scopes)) return;
+		if (isProvenOneShotTestingLibraryComponent(enclosingFunction, context.filename, context.scopes)) return;
 		if (isCreateRefResultWriteOnly(node, context.filename, context.scopes)) return;
 		context.report({
 			node,
@@ -34747,7 +36429,6 @@ const isSetStateCallInLifecycle = (setStateCall, lifecycleNames, options = {}) =
 //#region src/plugin/rules/react-builtins/no-did-mount-set-state.ts
 const LIFECYCLE_NAMES$2 = new Set(["componentDidMount"]);
 const MESSAGE$28 = "Your users see an extra render right after mount when you call `setState` in `componentDidMount`.";
-const getNodeStart = (node) => "start" in node && typeof node.start === "number" ? node.start : -1;
 const getEnclosingLifecycleFunction = (setStateCall) => {
 	let ancestor = setStateCall.parent;
 	while (ancestor) {
@@ -34836,13 +36517,13 @@ const argumentDerivesFromPostMountSource = (setStateCall, lifecycleFunction) =>
 };
 const isAfterAwaitInAsyncLifecycle = (setStateCall, lifecycleFunction) => {
 	if (!isFunctionLike$1(lifecycleFunction) || lifecycleFunction.async !== true) return false;
-	const callStart = getNodeStart(setStateCall);
+	const callStart = getNodeStartIndex(setStateCall);
 	if (callStart < 0) return false;
 	let didFindPrecedingAwait = false;
 	walkAst(lifecycleFunction, (descendant) => {
 		if (didFindPrecedingAwait) return false;
 		if (!isNodeOfType(descendant, "AwaitExpression")) return;
-		const awaitStart = getNodeStart(descendant);
+		const awaitStart = getNodeStartIndex(descendant);
 		if (awaitStart >= 0 && awaitStart < callStart) {
 			didFindPrecedingAwait = true;
 			return false;
@@ -36069,6 +37750,15 @@ const canStateWriteReachReaderWork = (writeInfo, readerEffect, stateSymbolId, sc
 	return false;
 };
 const EMPTY_CLEANUP_NAME_SET = /* @__PURE__ */ new Set();
+const NON_CONTAMINATING_MAP_METHOD_NAMES = new Set([
+	"clear",
+	"delete",
+	"entries",
+	"get",
+	"has",
+	"keys",
+	"values"
+]);
 const isFunctionShapedReturn = (returnedValue, setterToStateName, isExplicitReturnStatement) => {
 	if (isNodeOfType(returnedValue, "ArrowFunctionExpression") || isNodeOfType(returnedValue, "FunctionExpression")) return true;
 	if (isNodeOfType(returnedValue, "CallExpression")) {
@@ -36119,27 +37809,135 @@ const callsOpaqueExternalSetter = (analysisFunctions, setterToStateName) => {
 	});
 	return didFindOpaqueSetterCall;
 };
+const isReactRefCall = (expression, scopes) => isNodeOfType(expression, "CallExpression") && (isReactApiCall(expression, "useRef", scopes, {
+	allowGlobalReactNamespace: true,
+	allowUnboundBareCalls: true,
+	resolveNamedAliases: true
+}) || isReactApiCall(expression, "createRef", scopes, {
+	allowGlobalReactNamespace: true,
+	allowUnboundBareCalls: true,
+	resolveNamedAliases: true
+}));
+const getDirectReactRefSymbol = (rawExpression, scopes) => {
+	const expression = stripParenExpression(rawExpression);
+	if (!isNodeOfType(expression, "Identifier")) return null;
+	const symbol = scopes.symbolFor(expression);
+	if (!symbol) return null;
+	const initializer = getDirectUnreassignedInitializer(symbol);
+	return initializer && isReactRefCall(stripParenExpression(initializer), scopes) ? symbol : null;
+};
+const isReactNativeJsxElement = (openingElement, scopes) => {
+	if (!isNodeOfType(openingElement.name, "JSXIdentifier")) return false;
+	const symbol = scopes.symbolFor(openingElement.name);
+	const importDeclaration = symbol?.declarationNode.parent;
+	return Boolean(symbol?.kind === "import" && importDeclaration && isNodeOfType(importDeclaration, "ImportDeclaration") && importDeclaration.source.value === "react-native");
+};
+const isDirectHostJsxRef = (symbol, scopes) => {
+	let hostRefCount = 0;
+	for (const reference of symbol.references) {
+		const expression = findTransparentExpressionRoot(reference.identifier);
+		const container = expression.parent;
+		if (isNodeOfType(container, "MemberExpression") && container.object === expression && getStaticPropertyName(container) === "current") continue;
+		if (!container || !isNodeOfType(container, "JSXExpressionContainer") || container.expression !== expression) return false;
+		const attribute = container.parent;
+		if (!attribute || !isNodeOfType(attribute, "JSXAttribute") || getJsxAttributeName(attribute.name) !== "ref") return false;
+		const openingElement = attribute.parent;
+		if (!openingElement || !isNodeOfType(openingElement, "JSXOpeningElement") || !isProvenIntrinsicJsxElement(openingElement, scopes) && !isReactNativeJsxElement(openingElement, scopes)) return false;
+		hostRefCount += 1;
+	}
+	return hostRefCount > 0;
+};
+const isIntrinsicRefCallbackParameter = (expression, scopes) => {
+	const identifier = stripParenExpression(expression);
+	if (!isNodeOfType(identifier, "Identifier")) return false;
+	const callback = findEnclosingFunction$1(identifier);
+	if (!callback || !isFunctionLike$1(callback) || !isInlineIntrinsicRefCallback(callback, scopes)) return false;
+	const rawFirstParameter = callback.params?.[0];
+	const firstParameter = isNodeOfType(rawFirstParameter, "AssignmentPattern") ? rawFirstParameter.left : rawFirstParameter;
+	const symbol = scopes.symbolFor(identifier);
+	return Boolean(firstParameter && symbol?.bindingIdentifier === firstParameter);
+};
+const getDirectReactRefCall = (symbol, scopes) => {
+	const initializer = getDirectUnreassignedInitializer(symbol);
+	if (!initializer) return null;
+	const expression = stripParenExpression(initializer);
+	return isNodeOfType(expression, "CallExpression") && isReactRefCall(expression, scopes) ? expression : null;
+};
+const storesOnlyIntrinsicRefCallbackValues = (symbol, scopes) => {
+	const initialValue = getDirectReactRefCall(symbol, scopes)?.arguments?.[0];
+	if (!initialValue || !isNodeOfType(initialValue, "NewExpression") || !isNodeOfType(initialValue.callee, "Identifier") || initialValue.callee.name !== "Map" || !scopes.isGlobalReference(initialValue.callee) || initialValue.arguments.length !== 0) return false;
+	let intrinsicValueWriteCount = 0;
+	for (const reference of symbol.references) {
+		const identifier = findTransparentExpressionRoot(reference.identifier);
+		const currentMember = identifier.parent;
+		if (!isNodeOfType(currentMember, "MemberExpression") || currentMember.object !== identifier || getStaticPropertyName(currentMember) !== "current") return false;
+		const currentExpression = findTransparentExpressionRoot(currentMember);
+		const methodMember = currentExpression.parent;
+		if (!isNodeOfType(methodMember, "MemberExpression") || methodMember.object !== currentExpression) return false;
+		const methodName = getStaticPropertyName(methodMember);
+		if (methodName === "size") continue;
+		const call = methodMember.parent;
+		if (!isNodeOfType(call, "CallExpression") || call.callee !== methodMember) return false;
+		if (methodName && NON_CONTAMINATING_MAP_METHOD_NAMES.has(methodName)) continue;
+		if (methodName !== "set") return false;
+		const storedValue = call.arguments[1];
+		if (!storedValue || isNodeOfType(storedValue, "SpreadElement") || !isIntrinsicRefCallbackParameter(storedValue, scopes)) return false;
+		intrinsicValueWriteCount += 1;
+	}
+	return intrinsicValueWriteCount > 0;
+};
+const isDerivedFromProvenDomRefCurrent = (rawExpression, scopes, didReadCollectionValue = false, visitedSymbolIds = /* @__PURE__ */ new Set()) => {
+	const expression = stripParenExpression(rawExpression);
+	if (isNodeOfType(expression, "Identifier")) {
+		const symbol = scopes.symbolFor(expression);
+		if (!symbol || visitedSymbolIds.has(symbol.id)) return false;
+		const initializer = getDirectUnreassignedInitializer(symbol);
+		if (!initializer) return false;
+		visitedSymbolIds.add(symbol.id);
+		return isDerivedFromProvenDomRefCurrent(initializer, scopes, didReadCollectionValue, visitedSymbolIds);
+	}
+	if (isNodeOfType(expression, "MemberExpression")) {
+		if (getStaticPropertyName(expression) === "current") {
+			const symbol = getDirectReactRefSymbol(expression.object, scopes);
+			return Boolean(symbol && (isDirectHostJsxRef(symbol, scopes) || didReadCollectionValue && storesOnlyIntrinsicRefCallbackValues(symbol, scopes)));
+		}
+		return isDerivedFromProvenDomRefCurrent(expression.object, scopes, didReadCollectionValue, visitedSymbolIds);
+	}
+	if (!isNodeOfType(expression, "CallExpression")) return false;
+	const callee = stripParenExpression(expression.callee);
+	if (!isNodeOfType(callee, "MemberExpression")) return false;
+	return isDerivedFromProvenDomRefCurrent(callee.object, scopes, didReadCollectionValue || getStaticPropertyName(callee) === "get", visitedSymbolIds);
+};
+const isCommittedDomSyncNode = (node, scopes) => {
+	if (!isNodeOfType(node, "CallExpression")) return false;
+	const callee = stripParenExpression(node.callee);
+	if (!isNodeOfType(callee, "MemberExpression")) return false;
+	const propertyName = getStaticPropertyName(callee);
+	if (propertyName === null || !EXTERNAL_SYNC_DOM_MEMBER_METHOD_NAMES.has(propertyName)) return false;
+	return isDerivedFromProvenDomRefCurrent(callee.object, scopes) || isProvenBrowserApiReceiver(callee.object, "dom-event-target", scopes);
+};
 const isExternalSyncNode = (node) => {
 	if (isNodeOfType(node, "NewExpression")) return isNodeOfType(node.callee, "Identifier") && EXTERNAL_SYNC_OBSERVER_CONSTRUCTORS.has(node.callee.name);
 	if (isNodeOfType(node, "AssignmentExpression")) return isNodeOfType(node.left, "MemberExpression") && isNodeOfType(node.left.property, "Identifier") && node.left.property.name === "current";
 	if (!isNodeOfType(node, "CallExpression")) return false;
 	if (isNodeOfType(node.callee, "Identifier")) return EXTERNAL_SYNC_DIRECT_CALLEE_NAMES.has(node.callee.name);
-	if (!isNodeOfType(node.callee, "MemberExpression") || !isNodeOfType(node.callee.property, "Identifier")) return false;
-	const propertyName = node.callee.property.name;
+	if (!isNodeOfType(node.callee, "MemberExpression")) return false;
+	const propertyName = getStaticPropertyName(node.callee);
+	if (propertyName === null) return false;
 	if (EXTERNAL_SYNC_MEMBER_METHOD_NAMES.has(propertyName)) return true;
 	if (isBrowserStorageReceiver(node.callee.object)) return true;
 	if (!EXTERNAL_SYNC_AMBIGUOUS_HTTP_METHOD_NAMES.has(propertyName)) return false;
 	const receiverRootName = getRootIdentifierName(node.callee.object);
 	return receiverRootName !== null && EXTERNAL_SYNC_HTTP_CLIENT_RECEIVERS.has(receiverRootName);
 };
-const isExternalSyncEffect = (effectCallback, analysisFunctions, setterToStateName) => {
+const isExternalSyncEffect = (effectCallback, analysisFunctions, setterToStateName, scopes, allowCommittedDomSync) => {
 	if (!isFunctionLike$1(effectCallback)) return false;
 	if (!isNodeOfType(effectCallback.body, "BlockStatement")) {
 		if (isFunctionShapedReturn(effectCallback.body, setterToStateName, false)) return true;
 	} else for (const statement of effectCallback.body.body ?? []) if (isNodeOfType(statement, "ReturnStatement") && statement.argument && isFunctionShapedReturn(statement.argument, setterToStateName, true)) return true;
 	let didFindExternalCall = false;
 	visitSynchronousFunctionBodies(analysisFunctions, (child) => {
-		if (isExternalSyncNode(child)) didFindExternalCall = true;
+		if (isExternalSyncNode(child) || allowCommittedDomSync && isCommittedDomSyncNode(child, scopes)) didFindExternalCall = true;
 	});
 	return didFindExternalCall;
 };
@@ -36178,7 +37976,7 @@ const noEffectChain = defineRule({
 					depNames: collectDepIdentifierNames(effectCall),
 					stateWrites,
 					analysisFunctions,
-					isExternalSync: isExternalSyncEffect(callback, analysisFunctions, setterToStateName) || callsStorageHookSetter(analysisFunctions, storageSetterNames) || writtenStateNames.size === 0 && callsOpaqueExternalSetter(analysisFunctions, setterToStateName)
+					isExternalSync: isExternalSyncEffect(callback, analysisFunctions, setterToStateName, context.scopes, writtenStateNames.size === 0) || callsStorageHookSetter(analysisFunctions, storageSetterNames) || writtenStateNames.size === 0 && callsOpaqueExternalSetter(analysisFunctions, setterToStateName)
 				});
 			}
 			if (effectInfos.length < 2) return;
@@ -41476,11 +43274,6 @@ const SAME_REFERENCE_ARRAY_RETURN_METHODS = new Set([
 	"reverse",
 	"sort"
 ]);
-const OBJECT_MUTATION_METHODS = new Set([
-	"assign",
-	"defineProperties",
-	"defineProperty"
-]);
 const REFLECT_MUTATION_METHODS = new Set(["deleteProperty", "set"]);
 const cloneReducerPathState = (state) => ({
 	originalStateReferenceNames: new Set(state.originalStateReferenceNames),
@@ -41576,7 +43369,7 @@ const collectReducerStateMutationsInExpressionOrStatement = (node, state) => {
 		}
 		if (!isNodeOfType(unwrappedChild, "CallExpression")) return;
 		const firstArgument = unwrappedChild.arguments?.[0];
-		if (firstArgument && isExpressionRootedInMutableReducerStateSource(firstArgument, state) && (isStaticMethodCallOnNamedObject(unwrappedChild, "Object", OBJECT_MUTATION_METHODS) || isStaticMethodCallOnNamedObject(unwrappedChild, "Reflect", REFLECT_MUTATION_METHODS))) {
+		if (firstArgument && isExpressionRootedInMutableReducerStateSource(firstArgument, state) && (isStaticMethodCallOnNamedObject(unwrappedChild, "Object", OBJECT_PROPERTY_MUTATION_METHOD_NAMES) || isStaticMethodCallOnNamedObject(unwrappedChild, "Reflect", REFLECT_MUTATION_METHODS))) {
 			mutations.push({ node: unwrappedChild });
 			return;
 		}
@@ -44513,6 +46306,7 @@ const noRedundantRoles = defineRule({
 	create: (context) => {
 		const settings = resolveSettings$13(context.settings);
 		return { JSXOpeningElement(node) {
+			if (isLocalTestScaffoldJsx(node, context)) return;
 			const roleAttr = hasJsxPropIgnoreCase(node.attributes, "role");
 			if (!roleAttr) return;
 			if (hasJsxPropIgnoreCase(node.attributes, "data-rac")) return;
@@ -45173,7 +46967,7 @@ const doConditionsImplyFormula = (conditions, target) => {
 	}
 	return facts.didConflict || evaluateBooleanFormula$1(target, facts.assignments) === true;
 };
-const getFunctionBindingSymbol = (functionNode, scopes) => {
+const getFunctionBindingSymbol$1 = (functionNode, scopes) => {
 	if (isNodeOfType(functionNode, "FunctionDeclaration") && functionNode.id) return scopes.symbolFor(functionNode.id);
 	const parent = functionNode.parent;
 	if ((isNodeOfType(functionNode, "ArrowFunctionExpression") || isNodeOfType(functionNode, "FunctionExpression")) && isNodeOfType(parent, "VariableDeclarator") && parent.init === functionNode && isNodeOfType(parent.id, "Identifier")) return scopes.symbolFor(parent.id);
@@ -45206,7 +47000,7 @@ const isNodeEvaluatedDuringRender = (node, componentNode, scopes, visitedFunctio
 	const synchronousCallbackCall = getSynchronousCallbackCall(functionNode);
 	if (synchronousCallbackCall) return isNodeEvaluatedDuringRender(synchronousCallbackCall, componentNode, scopes, visitedFunctionSymbolIds);
 	if (executesDuringRender(functionNode, scopes)) return isNodeEvaluatedDuringRender(functionNode.parent ?? functionNode, componentNode, scopes, visitedFunctionSymbolIds);
-	const functionSymbol = getFunctionBindingSymbol(functionNode, scopes);
+	const functionSymbol = getFunctionBindingSymbol$1(functionNode, scopes);
 	if (!functionSymbol || visitedFunctionSymbolIds.has(functionSymbol.id)) return false;
 	visitedFunctionSymbolIds.add(functionSymbol.id);
 	let callCount = 0;
@@ -45255,7 +47049,7 @@ const collectExposureConditions = (analysis, context, node, componentNode, prote
 				parent = synchronousCallbackCall.parent;
 				continue;
 			}
-			const functionSymbol = getFunctionBindingSymbol(parent, context.scopes);
+			const functionSymbol = getFunctionBindingSymbol$1(parent, context.scopes);
 			if (functionSymbol?.references.length === 1) {
 				const callExpression = isReferenceDirectlyCalled(functionSymbol.references[0].identifier);
 				if (callExpression) {
@@ -45465,7 +47259,7 @@ const getSetterExposureConditions = (analysis, context, setterReference, compone
 	const functionNode = findEnclosingFunction$1(setterReference.identifier);
 	if (!functionNode) return null;
 	if (isInlineJsxCallback(functionNode)) return [collectExposureConditions(analysis, context, functionNode, componentNode, protectedSymbolIds)];
-	const functionSymbol = getFunctionBindingSymbol(functionNode, context.scopes);
+	const functionSymbol = getFunctionBindingSymbol$1(functionNode, context.scopes);
 	if (!functionSymbol || functionSymbol.references.length === 0) return null;
 	const conditionsByReference = [];
 	for (const reference of functionSymbol.references) {
@@ -45562,6 +47356,87 @@ const noResetAllStateOnPropChange = defineRule({
 	} })
 });
 //#endregion
+//#region src/plugin/utils/is-proven-framer-motion-jsx-element.ts
+const MOTION_FACTORY_MODULES = new Set(["framer-motion", "motion/react"]);
+const MOTION_TAG_NAMESPACE_MODULES = new Set([
+	"framer-motion/client",
+	"framer-motion/m",
+	"motion/react-client",
+	"motion/react-m"
+]);
+const MOTION_FACTORY_EXPORTS = new Set(["m", "motion"]);
+const getValueImportSource = (symbol) => {
+	if (symbol.kind !== "import") return null;
+	const declaration = symbol.declarationNode.parent;
+	if (!declaration || !isNodeOfType(declaration, "ImportDeclaration") || isTypeOnlyImport(declaration) || isNodeOfType(symbol.declarationNode, "ImportSpecifier") && symbol.declarationNode.importKind === "type") return null;
+	return typeof declaration.source.value === "string" ? declaration.source.value : null;
+};
+const getMemberParts = (node) => {
+	if (isNodeOfType(node, "MemberExpression")) {
+		const propertyName = getStaticPropertyName(node);
+		return propertyName ? [node.object, propertyName] : null;
+	}
+	if (isNodeOfType(node, "JSXMemberExpression")) return isNodeOfType(node.property, "JSXIdentifier") ? [node.object, node.property.name] : null;
+	return null;
+};
+const resolveSymbol = (node, scopes) => {
+	if (!isNodeOfType(node, "Identifier") && !isNodeOfType(node, "JSXIdentifier")) return null;
+	return resolveConstIdentifierAlias(node, scopes);
+};
+const isNamespaceFrom = (node, sources, scopes) => {
+	const symbol = resolveSymbol(stripParenExpression(node), scopes);
+	const source = symbol ? getValueImportSource(symbol) : null;
+	return Boolean(source && sources.has(source) && symbol && isNodeOfType(symbol.declarationNode, "ImportNamespaceSpecifier"));
+};
+const isMotionFactory = (rawNode, scopes, visitedSymbolIds) => {
+	const node = stripParenExpression(rawNode);
+	if (isNamespaceFrom(node, MOTION_TAG_NAMESPACE_MODULES, scopes)) return true;
+	const symbol = resolveSymbol(node, scopes);
+	if (symbol?.kind === "import") {
+		const source = getValueImportSource(symbol);
+		const importedName = getImportedName(symbol.declarationNode);
+		return Boolean(source && MOTION_FACTORY_MODULES.has(source) && importedName && MOTION_FACTORY_EXPORTS.has(importedName));
+	}
+	if (symbol?.kind === "const" && symbol.initializer) {
+		if (visitedSymbolIds.has(symbol.id)) return false;
+		visitedSymbolIds.add(symbol.id);
+		return isMotionFactory(symbol.initializer, scopes, visitedSymbolIds);
+	}
+	const memberParts = getMemberParts(node);
+	return Boolean(memberParts && MOTION_FACTORY_EXPORTS.has(memberParts[1]) && isNamespaceFrom(memberParts[0], MOTION_FACTORY_MODULES, scopes));
+};
+const isMotionComponent = (rawNode, scopes) => {
+	return isMotionComponentWithVisitedSymbols(rawNode, scopes, /* @__PURE__ */ new Set());
+};
+const isMotionComponentWithVisitedSymbols = (rawNode, scopes, visitedSymbolIds) => {
+	const node = stripParenExpression(rawNode);
+	const symbol = resolveSymbol(node, scopes);
+	if (symbol?.kind === "const" && symbol.initializer) {
+		if (visitedSymbolIds.has(symbol.id)) return false;
+		visitedSymbolIds.add(symbol.id);
+		return isMotionComponentWithVisitedSymbols(symbol.initializer, scopes, visitedSymbolIds);
+	}
+	if (symbol?.kind === "import") {
+		const source = getValueImportSource(symbol);
+		return Boolean(source && MOTION_TAG_NAMESPACE_MODULES.has(source) && isNodeOfType(symbol.declarationNode, "ImportSpecifier") && getImportedName(symbol.declarationNode) !== "create");
+	}
+	const memberParts = getMemberParts(node);
+	if (memberParts && isMotionFactory(memberParts[0], scopes, visitedSymbolIds)) return true;
+	if (!isNodeOfType(node, "CallExpression")) return false;
+	if (isMotionFactory(node.callee, scopes, visitedSymbolIds)) return true;
+	const calleeMemberParts = getMemberParts(stripParenExpression(node.callee));
+	return Boolean(calleeMemberParts && calleeMemberParts[1] === "create" && isMotionFactory(calleeMemberParts[0], scopes, visitedSymbolIds));
+};
+const isProvenFramerMotionJsxElement = (openingElement, scopes) => {
+	const elementName = openingElement.name;
+	if (isNodeOfType(elementName, "JSXIdentifier")) {
+		if (/^[a-z]/.test(elementName.name)) return false;
+		return isMotionComponent(elementName, scopes);
+	}
+	const memberParts = getMemberParts(elementName);
+	return Boolean(memberParts && isMotionFactory(memberParts[0], scopes, /* @__PURE__ */ new Set()));
+};
+//#endregion
 //#region src/plugin/rules/performance/no-scale-from-zero.ts
 const noScaleFromZero = defineRule({
 	id: "no-scale-from-zero",
@@ -45572,6 +47447,8 @@ const noScaleFromZero = defineRule({
 	create: (context) => ({ JSXAttribute(node) {
 		if (!isNodeOfType(node.name, "JSXIdentifier")) return;
 		if (node.name.name !== "initial" && node.name.name !== "exit") return;
+		const openingElement = node.parent;
+		if (!openingElement || !isNodeOfType(openingElement, "JSXOpeningElement") || !Object.is(getAuthoritativeJsxAttribute(openingElement.attributes, node.name.name), node) || !isProvenFramerMotionJsxElement(openingElement, context.scopes)) return;
 		if (!isNodeOfType(node.value, "JSXExpressionContainer")) return;
 		const expression = node.value.expression;
 		if (!isNodeOfType(expression, "ObjectExpression")) return;
@@ -45770,7 +47647,7 @@ const isSelfReferentialSentinelValue = (variableName, literalValue) => literalVa
 const isIdentifierLikeKeyNameValue = (literalValue) => {
 	const wordSegments = literalValue.replace(/^[_$\s]+|[_$\s]+$/g, "").split(/[_\-:./$]+/).filter((segment) => segment.length > 0);
 	if (wordSegments.length < 2) return false;
-	return wordSegments.every((segment) => /^[a-z]+$/.test(segment));
+	return wordSegments.every((segment) => /^[a-z]+(?:[A-Z][a-z]+)*$/.test(segment));
 };
 const FRAMEWORK_ENV_ADVICE = [
 	[
@@ -45844,7 +47721,7 @@ const noSecretsInClientCode = defineRule({
 				const isServerOnlyScope = isInsideServerOnlyScope(node);
 				const trailingSuffix = getIdentifierTrailingWord(variableName);
 				const isUiConstant = SECRET_FALSE_POSITIVE_SUFFIXES.has(trailingSuffix);
-				if (shouldUseVariableNameHeuristic && !isServerOnlyScope && SECRET_VARIABLE_PATTERN.test(variableName) && !isUiConstant && !isPublicUrlValue(literalValue) && !isPlaceholderValueForVariableHeuristic && !isSelfReferentialSentinelValue(variableName, literalValue) && !isIdentifierLikeKeyNameValue(literalValue) && !isSelfReferentialSentinelValue(variableName, literalValue) && !isIdentifierLikeKeyNameValue(literalValue) && literalValue.length > 24) {
+				if (shouldUseVariableNameHeuristic && !isServerOnlyScope && SECRET_VARIABLE_PATTERN.test(variableName) && !isUiConstant && !isPublicUrlValue(literalValue) && !isPlaceholderValueForVariableHeuristic && !isSelfReferentialSentinelValue(variableName, literalValue) && !isIdentifierLikeKeyNameValue(literalValue) && literalValue.length > 24) {
 					context.report({
 						node,
 						message: `Hardcoding "${variableName}" in client code is a security vulnerability: the secret ships to the browser where anyone can read it.`
@@ -51009,10 +52886,9 @@ const isSameApplicationChannelInstance = (targetText, fileContent) => {
 	return new RegExp(`(?<![\\w$.])${escapeRegExp(receiverRoot)}\\s*${SAME_APPLICATION_CHANNEL_CONSTRUCTOR_SOURCE}`).test(fileContent);
 };
 const WORKER_FILE_PATH_PATTERN = /worker/i;
-const getNodeStartIndex = (node) => "start" in node && typeof node.start === "number" ? node.start : -1;
 const getNodeText = (content, node) => {
 	const startIndex = getNodeStartIndex(node);
-	const endIndex = "end" in node && typeof node.end === "number" ? node.end : -1;
+	const endIndex = getNodeEndIndex(node);
 	if (startIndex < 0 || endIndex < 0) return "";
 	return content.slice(startIndex, endIndex);
 };
@@ -51409,17 +53285,6 @@ const preferEs6Class = defineRule({
 	}
 });
 //#endregion
-//#region src/plugin/utils/is-jsx-element-or-fragment.ts
-/**
-* Type-guard for the two single-node JSX output forms: `JSXElement`
-* (`<Foo />`) and `JSXFragment` (`<>…</>`). Canonical home for the
-* `isNodeOfType(x, "JSXElement") || isNodeOfType(x, "JSXFragment")` check
-* that many rules otherwise inline. Does NOT unwrap parens / TS wrappers —
-* callers that need the semantic expression should `stripParenExpression`
-* first.
-*/
-const isJsxElementOrFragment = (node) => Boolean(node && (isNodeOfType(node, "JSXElement") || isNodeOfType(node, "JSXFragment")));
-//#endregion
 //#region src/plugin/rules/architecture/prefer-explicit-variants.ts
 const resolveBooleanPropTestName = (testNode, booleanPropBindings) => {
 	let identifierNode = stripParenExpression(testNode);
@@ -51912,17 +53777,23 @@ const isProvenNodeCryptoNamespaceReference = (expression, scopes) => {
 //#region src/plugin/rules/architecture/prefer-module-scope-static-value.ts
 const MUTATING_RECEIVER_METHOD_NAMES = new Set([...MUTATING_ARRAY_METHODS, ...MUTATING_COLLECTION_METHODS]);
 const isMutationContext = (referenceIdentifier) => {
-	const parent = referenceIdentifier.parent;
-	if (!parent) return false;
-	if (isNodeOfType(parent, "AssignmentExpression") && parent.left === referenceIdentifier) return true;
-	if (isNodeOfType(parent, "UpdateExpression") && parent.argument === referenceIdentifier) return true;
-	if (isNodeOfType(parent, "MemberExpression") && parent.object === referenceIdentifier) {
-		const grandparent = parent.parent;
-		if (!grandparent) return false;
-		if (isNodeOfType(grandparent, "AssignmentExpression") && grandparent.left === parent) return true;
-		if (isNodeOfType(grandparent, "UpdateExpression") && grandparent.argument === parent) return true;
-		if (isNodeOfType(grandparent, "UnaryExpression") && grandparent.operator === "delete" && grandparent.argument === parent) return true;
-		if (isNodeOfType(grandparent, "CallExpression") && grandparent.callee === parent && !parent.computed && isNodeOfType(parent.property, "Identifier") && MUTATING_RECEIVER_METHOD_NAMES.has(parent.property.name)) return true;
+	let mutationTarget = referenceIdentifier;
+	let receiverMethodName = null;
+	while (mutationTarget.parent) {
+		const parent = mutationTarget.parent;
+		if (TRANSPARENT_EXPRESSION_WRAPPER_TYPES.has(parent.type) && "expression" in parent && parent.expression === mutationTarget) {
+			mutationTarget = parent;
+			continue;
+		}
+		if (isNodeOfType(parent, "MemberExpression") && parent.object === mutationTarget) {
+			receiverMethodName = getStaticPropertyName(parent);
+			mutationTarget = parent;
+			continue;
+		}
+		if (isNodeOfType(parent, "AssignmentExpression") && parent.left === mutationTarget) return true;
+		if (isNodeOfType(parent, "UpdateExpression") && parent.argument === mutationTarget) return true;
+		if (isNodeOfType(parent, "UnaryExpression") && parent.operator === "delete" && parent.argument === mutationTarget) return true;
+		return Boolean(isNodeOfType(parent, "CallExpression") && parent.callee === mutationTarget && MUTATING_RECEIVER_METHOD_NAMES.has(receiverMethodName ?? ""));
 	}
 	return false;
 };
@@ -52299,6 +54170,15 @@ const STABLE_REACT_HOOK_VALUE_NAMES = new Set([
 	"useState",
 	"useTransition"
 ]);
+const REGISTRATION_METHOD_BY_RELEASE_METHOD = new Map([
+	["off", "on"],
+	["removeEventListener", "addEventListener"],
+	["removeListener", "addListener"],
+	["unlisten", "listen"],
+	["unsub", "sub"],
+	["unsubscribe", "subscribe"],
+	["unwatch", "watch"]
+]);
 const isStableReactHookDependency = (dependency, context) => {
 	const unwrappedDependency = stripParenExpression(dependency);
 	if (!isNodeOfType(unwrappedDependency, "Identifier")) return false;
@@ -52364,30 +54244,87 @@ const isCallExpressionWithSubHandlerCallee = (callExpression) => {
 	if (isNodeOfType(callee, "MemberExpression") && isNodeOfType(callee.property, "Identifier") && SUBSCRIPTION_METHOD_NAMES.has(callee.property.name)) return true;
 	return false;
 };
-const findSubHandlerForEnclosingFunction = (enclosingFunction, effectCallback) => {
+const getStaticMemberCallMethodName = (callExpression) => {
+	if (!isNodeOfType(callExpression, "CallExpression")) return null;
+	const callee = callExpression.callee;
+	return isNodeOfType(callee, "MemberExpression") && !callee.computed && isNodeOfType(callee.property, "Identifier") ? callee.property.name : null;
+};
+const getCallArgumentUse = (reference) => {
+	const argument = findTransparentExpressionRoot(reference);
+	const parent = argument.parent;
+	if (!isNodeOfType(parent, "CallExpression")) return null;
+	const argumentIndex = (parent.arguments ?? []).findIndex((candidateArgument) => candidateArgument === argument);
+	return argumentIndex === -1 ? null : {
+		callExpression: parent,
+		argumentIndex
+	};
+};
+const isMatchingRegistrationAndRelease = (registration, release, context) => {
+	const releaseMethodName = getStaticMemberCallMethodName(release.callExpression);
+	const expectedRegistrationMethod = releaseMethodName ? REGISTRATION_METHOD_BY_RELEASE_METHOD.get(releaseMethodName) : null;
+	if (getStaticMemberCallMethodName(registration.callExpression) !== expectedRegistrationMethod) return false;
+	if (registration.argumentIndex !== release.argumentIndex) return false;
+	const registrationCallee = registration.callExpression.callee;
+	const releaseCallee = release.callExpression.callee;
+	if (!isNodeOfType(registrationCallee, "MemberExpression") || !isNodeOfType(releaseCallee, "MemberExpression")) return false;
+	const registrationReceiverKey = resolveExpressionKey$1(registrationCallee.object, context);
+	if (registrationReceiverKey === null || registrationReceiverKey !== resolveExpressionKey$1(releaseCallee.object, context)) return false;
+	const registrationArguments = registration.callExpression.arguments ?? [];
+	const releaseArguments = release.callExpression.arguments ?? [];
+	if (registrationArguments.length !== releaseArguments.length) return false;
+	return registrationArguments.every((registrationArgument, argumentIndex) => {
+		if (argumentIndex === registration.argumentIndex) return true;
+		const registrationArgumentKey = resolveExpressionKey$1(registrationArgument, context);
+		return registrationArgumentKey !== null && registrationArgumentKey === resolveExpressionKey$1(releaseArguments[argumentIndex], context);
+	});
+};
+const findExclusiveSubHandlerCall = (enclosingFunction, context) => {
 	const directParent = enclosingFunction.parent;
 	if (isNodeOfType(directParent, "CallExpression") && (directParent.arguments ?? []).some((arg) => arg === enclosingFunction) && isCallExpressionWithSubHandlerCallee(directParent)) return directParent;
-	const localName = getFunctionBindingName$1(enclosingFunction);
-	if (localName === null) return null;
-	let matchingSubHandlerCall = null;
-	walkAst(effectCallback, (child) => {
-		if (matchingSubHandlerCall) return false;
-		if (!isNodeOfType(child, "CallExpression")) return;
-		if (!isCallExpressionWithSubHandlerCallee(child)) return;
-		for (const argument of child.arguments ?? []) if (isNodeOfType(argument, "Identifier") && argument.name === localName) {
-			matchingSubHandlerCall = child;
-			return false;
+	const bindingIdentifier = getFunctionBindingIdentifier$1(enclosingFunction);
+	if (!bindingIdentifier) return null;
+	let bindingSymbol = context.scopes.symbolFor(bindingIdentifier);
+	if (isNodeOfType(enclosingFunction, "FunctionDeclaration")) {
+		let bindingScope = context.scopes.scopeFor(enclosingFunction);
+		bindingSymbol = null;
+		while (bindingScope && !bindingSymbol) {
+			bindingSymbol = bindingScope.symbols.find((candidateSymbol) => candidateSymbol.declarationNode === enclosingFunction) ?? null;
+			bindingScope = bindingScope.parent;
 		}
-	});
-	return matchingSubHandlerCall;
+	}
+	if (!bindingSymbol) return null;
+	const registrations = [];
+	const releases = [];
+	for (const reference of bindingSymbol.references) {
+		if (isAstDescendant(reference.identifier, enclosingFunction)) continue;
+		if (reference.identifier === bindingIdentifier) continue;
+		if (reference.flag !== "read") return null;
+		const receivingUse = getCallArgumentUse(reference.identifier);
+		if (!receivingUse) return null;
+		if (isCallExpressionWithSubHandlerCallee(receivingUse.callExpression)) {
+			registrations.push(receivingUse);
+			continue;
+		}
+		const methodName = getStaticMemberCallMethodName(receivingUse.callExpression);
+		if (!methodName || !REGISTRATION_METHOD_BY_RELEASE_METHOD.has(methodName)) return null;
+		releases.push(receivingUse);
+	}
+	if (releases.some((release) => !registrations.some((registration) => isMatchingRegistrationAndRelease(registration, release, context)))) return null;
+	return registrations[0]?.callExpression ?? null;
 };
-const classifyCallableReadsInsideEffect = (callableName, effectCallback) => {
+const classifyCallableReadsInsideEffect = (callableIdentifier, effectCallback, context) => {
 	let hasAnyRead = false;
 	let allReadsAreInSubHandlers = true;
 	let firstSubHandlerName = null;
+	const callableSymbol = context.scopes.symbolFor(callableIdentifier);
+	if (!callableSymbol) return {
+		hasAnyRead,
+		allReadsAreInSubHandlers,
+		firstSubHandlerName
+	};
 	walkAst(effectCallback, (child) => {
 		if (!isNodeOfType(child, "Identifier")) return;
-		if (child.name !== callableName) return;
+		if (context.scopes.symbolFor(child)?.id !== callableSymbol.id) return;
 		const parent = child.parent;
 		if (isNodeOfType(parent, "ArrayExpression")) return;
 		if (isNodeOfType(parent, "MemberExpression") && !parent.computed && parent.property === child) return;
@@ -52398,7 +54335,7 @@ const classifyCallableReadsInsideEffect = (callableName, effectCallback) => {
 			allReadsAreInSubHandlers = false;
 			return;
 		}
-		const subHandlerCall = findSubHandlerForEnclosingFunction(enclosingFunction, effectCallback);
+		const subHandlerCall = findExclusiveSubHandlerCall(enclosingFunction, context);
 		if (!subHandlerCall) {
 			allReadsAreInSubHandlers = false;
 			return;
@@ -52441,7 +54378,7 @@ const preferUseEffectEvent = defineRule({
 					const isFunctionTypedPropDep = propStackTracker.isPropName(depName) && REACT_HANDLER_PROP_PATTERN.test(depName);
 					const isFunctionTypedLocalDep = potentiallyChangingCallbackBindings.has(depName);
 					if (!isFunctionTypedPropDep && !isFunctionTypedLocalDep) continue;
-					const classification = classifyCallableReadsInsideEffect(depName, callback);
+					const classification = classifyCallableReadsInsideEffect(depElement, callback, context);
 					if (!classification.hasAnyRead) continue;
 					if (!classification.allReadsAreInSubHandlers) continue;
 					const subHandlerLabel = classification.firstSubHandlerName ? `\`${classification.firstSubHandlerName}\`` : "an async sub-handler";
@@ -53756,12 +55693,7 @@ const DOMPURIFY_MODULES = new Set(["dompurify", "isomorphic-dompurify"]);
 const REACT_MARKDOWN_NAMED_EXPORTS = new Set(["MarkdownAsync", "MarkdownHooks"]);
 const REACT_MARKDOWN_NAMESPACE_EXPORTS = new Set(["default", ...REACT_MARKDOWN_NAMED_EXPORTS]);
 const DEFAULT_EXPORT_NAMES = new Set(["default"]);
-const getImportDeclaration = (symbol) => {
-	if (symbol.kind !== "import") return null;
-	const importDeclaration = symbol.declarationNode.parent;
-	return isNodeOfType(importDeclaration, "ImportDeclaration") ? importDeclaration : null;
-};
-const isImportFromModule = (symbol, moduleName) => getImportDeclaration(symbol)?.source.value === moduleName;
+const isImportFromModule = (symbol, moduleName) => getImportDeclarationForSymbol(symbol)?.source.value === moduleName;
 const isDefaultImportSymbol = (symbol, moduleName) => {
 	if (!isImportFromModule(symbol, moduleName)) return false;
 	return isNodeOfType(symbol.declarationNode, "ImportDefaultSpecifier") || getImportedName(symbol.declarationNode) === "default";
@@ -53851,7 +55783,7 @@ const getAttributeExpression = (attribute) => {
 const isDomPurifyNamespace = (node, scopes) => {
 	const symbol = resolveImportedIdentifier(node, scopes);
 	if (!symbol) return false;
-	const importDeclaration = getImportDeclaration(symbol);
+	const importDeclaration = getImportDeclarationForSymbol(symbol);
 	if (!importDeclaration || !DOMPURIFY_MODULES.has(String(importDeclaration.source.value))) return false;
 	return isNodeOfType(symbol.declarationNode, "ImportDefaultSpecifier") || isNodeOfType(symbol.declarationNode, "ImportNamespaceSpecifier") || getImportedName(symbol.declarationNode) === "default";
 };
@@ -56825,7 +58757,7 @@ const resolveImportedRecyclerName = (node, localName, options) => {
 	const jsxMemberObjectName = options?.allowNamespaceMemberAccess ? getJsxMemberObjectName(node) : null;
 	for (const [canonicalName, packageSources] of Object.entries(RECYCLABLE_LIST_PACKAGES)) {
 		if (jsxMemberObjectName !== null) {
-			if (localName === canonicalName && packageSources.some((packageSource) => isNamespaceImportFromModule(node, jsxMemberObjectName, packageSource))) return canonicalName;
+			if (localName === canonicalName && packageSources.some((packageSource) => isNamespaceImportFromModule$1(node, jsxMemberObjectName, packageSource))) return canonicalName;
 			continue;
 		}
 		if (packageSources.some((packageSource) => getImportedNameFromModule(node, localName, packageSource) === canonicalName)) return canonicalName;
@@ -58084,7 +60016,7 @@ const isNamedImportOf = (contextNode, localName, componentName) => {
 	return false;
 };
 const isExpoUiNamespaceImport = (contextNode, localName) => {
-	for (const moduleSource of EXPO_UI_MODULE_SOURCES) if (isNamespaceImportFromModule(contextNode, localName, moduleSource)) return true;
+	for (const moduleSource of EXPO_UI_MODULE_SOURCES) if (isNamespaceImportFromModule$1(contextNode, localName, moduleSource)) return true;
 	return false;
 };
 const isExpoUiComponentElement = (openingElement, contextNode, componentName) => {
@@ -59232,6 +61164,7 @@ const roleHasRequiredAriaProps = defineRule({
 	recommendation: "Add every required `aria-*` attribute so assistive tech can expose the role's state correctly.",
 	category: "Accessibility",
 	create: (context) => ({ JSXOpeningElement(node) {
+		if (isLocalTestScaffoldJsx(node, context)) return;
 		const elementType = getElementType(node, context.settings);
 		if (!HTML_TAGS.has(elementType)) return;
 		const roleAttribute = hasJsxPropIgnoreCase(node.attributes, "role");
@@ -62367,6 +64300,7 @@ const roleSupportsAriaProps = defineRule({
 	recommendation: "Only use `aria-*` attributes that the element's role supports.",
 	category: "Accessibility",
 	create: (context) => ({ JSXOpeningElement(node) {
+		if (isLocalTestScaffoldJsx(node, context)) return;
 		let ariaAttributes = null;
 		for (const attribute of node.attributes) {
 			if (!isNodeOfType(attribute, "JSXAttribute")) continue;
@@ -63112,6 +65046,109 @@ const isDeferrableSideEffectCall = (objectName, methodName) => {
 	if (ANALYTICS_DEFERRABLE_OBJECTS.has(objectName)) return ANALYTICS_DEFERRABLE_METHODS.has(methodName);
 	return false;
 };
+const NEXT_SERVER_SOURCE = "next/server";
+const NEXT_AFTER_EXPORT_NAMES = new Set(["after", "unstable_after"]);
+const isNextAfterImportSymbol = (symbol, contextNode) => {
+	if (symbol.kind !== "import") return false;
+	const importBinding = getImportBindingForName(contextNode, symbol.name);
+	return Boolean(importBinding && importBinding.source === NEXT_SERVER_SOURCE && !importBinding.isNamespace && importBinding.exportedName && NEXT_AFTER_EXPORT_NAMES.has(importBinding.exportedName));
+};
+const isDirectObjectPatternBinding = (symbol) => {
+	if (!isNodeOfType(symbol.declarationNode, "VariableDeclarator")) return false;
+	if (!isNodeOfType(symbol.declarationNode.id, "ObjectPattern")) return false;
+	let bindingNode = symbol.bindingIdentifier;
+	if (isNodeOfType(bindingNode.parent, "AssignmentPattern") && bindingNode.parent.left === bindingNode) bindingNode = bindingNode.parent;
+	const property = bindingNode.parent;
+	return Boolean(isNodeOfType(property, "Property") && property.value === bindingNode && property.parent === symbol.declarationNode.id);
+};
+const isNextServerNamespace = (expression, contextNode, scopes) => {
+	let candidate = stripParenExpression(expression);
+	const visitedSymbolIds = /* @__PURE__ */ new Set();
+	while (isNodeOfType(candidate, "Identifier")) {
+		const symbol = scopes.symbolFor(candidate);
+		if (!symbol || visitedSymbolIds.has(symbol.id)) return false;
+		if (symbol.kind === "import") {
+			const importBinding = getImportBindingForName(contextNode, symbol.name);
+			return Boolean(importBinding?.source === NEXT_SERVER_SOURCE && importBinding.isNamespace);
+		}
+		if (symbol.kind !== "const" || !symbol.initializer || !isNodeOfType(symbol.declarationNode, "VariableDeclarator") || symbol.declarationNode.id !== symbol.bindingIdentifier) return false;
+		visitedSymbolIds.add(symbol.id);
+		candidate = stripParenExpression(symbol.initializer);
+	}
+	return false;
+};
+const isNextAfterCallee = (callee, contextNode, scopes, visitedSymbolIds = /* @__PURE__ */ new Set()) => {
+	const candidate = stripParenExpression(callee);
+	if (isNodeOfType(candidate, "MemberExpression")) {
+		const propertyName = getStaticPropertyKeyName(candidate, { allowComputedString: true });
+		return Boolean(propertyName && NEXT_AFTER_EXPORT_NAMES.has(propertyName) && isNextServerNamespace(candidate.object, contextNode, scopes));
+	}
+	if (!isNodeOfType(candidate, "Identifier")) return false;
+	const symbol = scopes.symbolFor(candidate);
+	if (!symbol || visitedSymbolIds.has(symbol.id)) return false;
+	if (isNextAfterImportSymbol(symbol, contextNode)) return true;
+	const destructuredPropertyName = getDestructuredBindingPropertyName(symbol.bindingIdentifier);
+	if (symbol.kind === "const" && symbol.initializer && isDirectObjectPatternBinding(symbol) && destructuredPropertyName && NEXT_AFTER_EXPORT_NAMES.has(destructuredPropertyName)) return isNextServerNamespace(symbol.initializer, contextNode, scopes);
+	if (symbol.kind !== "const" || !symbol.initializer || !isNodeOfType(symbol.declarationNode, "VariableDeclarator") || symbol.declarationNode.id !== symbol.bindingIdentifier) return false;
+	visitedSymbolIds.add(symbol.id);
+	return isNextAfterCallee(symbol.initializer, contextNode, scopes, visitedSymbolIds);
+};
+const getDirectArgumentCall = (expression) => {
+	const expressionRoot = findTransparentExpressionRoot(expression);
+	const parent = expressionRoot.parent;
+	if (!isNodeOfType(parent, "CallExpression")) return null;
+	return parent.arguments[0] === expressionRoot ? parent : null;
+};
+const isScheduledByNextAfter = (expression, scopes) => {
+	const callExpression = getDirectArgumentCall(expression);
+	return Boolean(callExpression && isNextAfterCallee(callExpression.callee, callExpression, scopes));
+};
+const getFunctionBindingSymbol = (functionNode, scopes) => {
+	if (isNodeOfType(functionNode, "FunctionDeclaration") && functionNode.id) return scopes.scopeFor(functionNode).symbols.find((symbol) => symbol.declarationNode === functionNode) ?? null;
+	const functionRoot = findTransparentExpressionRoot(functionNode);
+	const parent = functionRoot.parent;
+	if (!isNodeOfType(parent, "VariableDeclarator") || parent.init !== functionRoot || !isNodeOfType(parent.id, "Identifier")) return null;
+	return scopes.symbolFor(parent.id);
+};
+const isDirectlyExported = (symbol) => {
+	let declaration = symbol.declarationNode;
+	if (isNodeOfType(declaration, "VariableDeclarator")) declaration = declaration.parent;
+	return Boolean(declaration?.parent && (isNodeOfType(declaration.parent, "ExportNamedDeclaration") || isNodeOfType(declaration.parent, "ExportDefaultDeclaration")));
+};
+const isLexicallyInsideFunction = (node, functionNode) => {
+	let enclosingFunction = findEnclosingFunction$1(node);
+	while (enclosingFunction) {
+		if (enclosingFunction === functionNode) return true;
+		enclosingFunction = findEnclosingFunction$1(enclosingFunction);
+	}
+	return false;
+};
+const isExclusivelyScheduledByNextAfter = (functionNode, scopes, visitedFunctionSymbolIds) => {
+	if (isScheduledByNextAfter(functionNode, scopes)) return true;
+	const functionSymbol = getFunctionBindingSymbol(functionNode, scopes);
+	if (!functionSymbol || isDirectlyExported(functionSymbol) || visitedFunctionSymbolIds.has(functionSymbol.id)) return false;
+	const nextVisitedFunctionSymbolIds = new Set(visitedFunctionSymbolIds).add(functionSymbol.id);
+	let hasAfterUse = false;
+	for (const reference of functionSymbol.references) {
+		if (reference.flag !== "read") return false;
+		if (isLexicallyInsideFunction(reference.identifier, functionNode)) continue;
+		if (isScheduledByNextAfter(reference.identifier, scopes)) {
+			hasAfterUse = true;
+			continue;
+		}
+		if (!isInsideNextAfterCallback(reference.identifier, scopes, nextVisitedFunctionSymbolIds)) return false;
+		hasAfterUse = true;
+	}
+	return hasAfterUse;
+};
+const isInsideNextAfterCallback = (node, scopes, visitedFunctionSymbolIds = /* @__PURE__ */ new Set()) => {
+	let enclosingFunction = findEnclosingFunction$1(node);
+	while (enclosingFunction) {
+		if (isExclusivelyScheduledByNextAfter(enclosingFunction, scopes, visitedFunctionSymbolIds)) return true;
+		enclosingFunction = findEnclosingFunction$1(enclosingFunction);
+	}
+	return false;
+};
 const serverAfterNonblocking = defineRule({
 	id: "server-after-nonblocking",
 	title: "Blocking side effect before response",
@@ -63146,6 +65183,7 @@ const serverAfterNonblocking = defineRule({
 				if (!objectName) return;
 				const methodName = node.callee.property.name;
 				if (!isDeferrableSideEffectCall(objectName, methodName)) return;
+				if (isInsideNextAfterCallback(node, context.scopes)) return;
 				context.report({
 					node,
 					message: `${objectName}.${methodName}() runs before the response, so your users wait longer for it.`
@@ -64420,17 +66458,34 @@ const stylePropObject = defineRule({
 		};
 	}
 });
+//#endregion
+//#region src/plugin/rules/security-scan/utils/has-use-server-directive-in-content.ts
+const hasUseServerDirectiveInContent = (content, relativePath = "source.tsx") => {
+	const programNode = parseSourceText({
+		filename: relativePath,
+		sourceText: content,
+		shouldAttachParentReferences: false
+	});
+	return programNode === null ? false : hasDirective(programNode, "use server");
+};
+//#endregion
+//#region src/plugin/rules/security-scan/supabase-client-owned-authz-field.ts
+const scanSupabaseClientOwnedAuthzField = scanByPattern({
+	shouldScan: (file) => isClientSourcePath(file.relativePath),
+	pattern: /\b(?:ownerId|ownerID|creatorId|creatorID|userId|userID|uid|providerId|providerID|orgId|orgID|tenantId|tenantID|teamId|teamID|workspaceId|workspaceID|ghostOrg|role|roles|isAdmin|admin)\b/,
+	requireAll: [/\b(?:supabase\b|\.from\s*\(\s*["'][^"']+["']\s*\))[\s\S]{0,700}\b(?:insert|upsert|update)\s*\(\s*(?:\{|\[?\s*\{)[\s\S]{0,700}\b(?:ownerId|creatorId|userId|orgId|tenantId|role|isAdmin)\b/i],
+	message: "Client Supabase code appears to write user, tenant, owner, or role fields that should be enforced by RLS."
+});
 const supabaseClientOwnedAuthzField = defineRule({
 	id: "supabase-client-owned-authz-field",
 	title: "Client writes Supabase authorization field",
 	severity: "error",
 	recommendation: "Use RLS policies based on `auth.uid()` and server-owned membership rows; do not trust client-provided owner, org, or role columns.",
-	scan: scanByPattern({
-		shouldScan: (file) => isClientSourcePath(file.relativePath),
-		pattern: /\b(?:ownerId|ownerID|creatorId|creatorID|userId|userID|uid|providerId|providerID|orgId|orgID|tenantId|tenantID|teamId|teamID|workspaceId|workspaceID|ghostOrg|role|roles|isAdmin|admin)\b/,
-		requireAll: [/\b(?:supabase\b|\.from\s*\(\s*["'][^"']+["']\s*\))[\s\S]{0,700}\b(?:insert|upsert|update)\s*\(\s*(?:\{|\[?\s*\{)[\s\S]{0,700}\b(?:ownerId|creatorId|userId|orgId|tenantId|role|isAdmin)\b/i],
-		message: "Client Supabase code appears to write user, tenant, owner, or role fields that should be enforced by RLS."
-	})
+	scan: (file) => {
+		const findings = scanSupabaseClientOwnedAuthzField(file);
+		if (findings.length === 0) return findings;
+		return hasUseServerDirectiveInContent(file.content, file.relativePath) ? [] : findings;
+	}
 });
 //#endregion
 //#region src/plugin/rules/security-scan/utils/is-supabase-migration-path.ts