oxlint-plugin-react-doctor 0.9.4 → 0.9.5-dev.4b03b15

package/dist/core-NYcNjo1f.d.ts

@@ -0,0 +1,1371 @@
+import { StaticImport } from "oxc-parser";
+import { TSESTree } from "@typescript-eslint/types";
+
+//#region src/plugin/utils/capability.d.ts
+declare const FRAMEWORK_TOKENS: readonly ["nextjs", "astro", "vite", "cra", "remix", "gatsby", "expo", "react-native", "tanstack-start", "preact", "unknown"];
+type FrameworkToken = (typeof FRAMEWORK_TOKENS)[number];
+type Capability = FrameworkToken | "react" | "remotion" | "pure-preact" | "react-native" | "server-actions" | "ssr" | "client-only" | "expo:54" | "nextjs:static-export" | "nextjs:15" | "nextjs:16" | "tailwind" | "tailwind:3.4" | "tailwind:4" | "zod" | "zod:4" | "mobx" | "mobx-react" | "mobx-react-lite" | "mobx-react-binding" | "mobx-react-binding-observer-memo-guard" | "mobx-react-observer-memo-guard" | "mobx-react-lite-observer-memo-guard" | "mobx-state-tree" | "mobx-react-observer" | "zustand" | "typescript" | "react-compiler" | "reanimated" | "reanimated:4" | "tanstack-query" | "valtio" | "i18n" | "styled-components" | "styled-components:6" | "three" | "r3f" | "react-router" | "react-router-framework" | "react-router:6.4" | "react-router:6.7" | "react-router:6.9" | "react-router:6.19" | "react-router:7" | "react-router:7.8" | "react-router:7.9" | "react-router:7.10" | "react-router:7.15" | "react-router:8" | "pre-es2023" | "target-blank-needs-explicit-protection" | "target-blank-needs-noreferrer" | `react:${number}` | `preact:${number}` | `remotion:${number}` | `valtio:${number}` | `mobx:${number}` | `zustand:${number}` | `three:${number}` | `r3f:${number}`;
+type CapabilityQuery = (capability: Capability) => boolean;
+//#endregion
+//#region src/plugin/utils/file-scan.d.ts
+interface ScannedFile {
+  readonly absolutePath: string;
+  readonly relativePath: string;
+  readonly content: string;
+  readonly isGeneratedBundle: boolean;
+}
+interface ScanFinding {
+  readonly message: string;
+  readonly line: number;
+  readonly column: number;
+  readonly severity?: "error" | "warn";
+  readonly title?: string;
+  readonly help?: string;
+}
+interface FileScan {
+  (file: ScannedFile): ScanFinding[];
+}
+//#endregion
+//#region src/plugin/utils/es-tree-node.d.ts
+type WithLooseParent<NodeType> = NodeType extends NodeType ? Omit<NodeType, "parent"> & {
+  parent?: EsTreeNode | null;
+} : never;
+type EsTreeNode = WithLooseParent<TSESTree.Node>;
+//#endregion
+//#region src/plugin/utils/report-descriptor.d.ts
+interface ReportDescriptor {
+  node: EsTreeNode;
+  message: string;
+}
+//#endregion
+//#region src/plugin/semantic/control-flow-graph.d.ts
+type CfgEdgeKind = "uncond" | "cond" | "throw";
+interface CfgEdge {
+  readonly from: BasicBlock;
+  readonly to: BasicBlock;
+  readonly kind: CfgEdgeKind;
+}
+interface BasicBlock {
+  readonly id: number;
+  readonly nodes: EsTreeNode[];
+  readonly successors: CfgEdge[];
+  readonly predecessors: CfgEdge[];
+}
+interface FunctionCfg {
+  readonly owner: EsTreeNode;
+  readonly entry: BasicBlock;
+  readonly exit: BasicBlock;
+  readonly blocks: BasicBlock[];
+  readonly blockOf: (node: EsTreeNode) => BasicBlock | null;
+}
+interface ControlFlowAnalysis {
+  readonly cfgFor: (functionLike: EsTreeNode) => FunctionCfg | null;
+  readonly enclosingFunction: (node: EsTreeNode) => EsTreeNode | null;
+  readonly isUnconditionalFromEntry: (node: EsTreeNode) => boolean;
+}
+//#endregion
+//#region src/plugin/semantic/scope-analysis.d.ts
+type SymbolKind = "var" | "let" | "const" | "using" | "function" | "class" | "parameter" | "import" | "ts-import-equals" | "ts-enum" | "ts-type-alias" | "ts-interface" | "ts-module" | "catch-clause-parameter";
+type ScopeKind = "module" | "function" | "arrow-function" | "method" | "block" | "class" | "catch" | "for" | "switch" | "with" | "ts-module" | "ts-enum";
+interface SymbolDescriptor {
+  readonly id: number;
+  readonly name: string;
+  readonly kind: SymbolKind;
+  readonly bindingIdentifier: EsTreeNode;
+  readonly declarationNode: EsTreeNode;
+  readonly scope: ScopeDescriptor;
+  readonly initializer: EsTreeNode | null;
+  readonly references: ReferenceDescriptor[];
+}
+type ReferenceFlag = "read" | "write" | "read-write";
+interface ReferenceDescriptor {
+  readonly id: number;
+  readonly identifier: EsTreeNode;
+  resolvedSymbol: SymbolDescriptor | null;
+  readonly flag: ReferenceFlag;
+  readonly scope: ScopeDescriptor;
+}
+interface ScopeDescriptor {
+  readonly id: number;
+  readonly kind: ScopeKind;
+  readonly node: EsTreeNode;
+  readonly parent: ScopeDescriptor | null;
+  readonly children: ScopeDescriptor[];
+  readonly symbols: SymbolDescriptor[];
+  readonly references: ReferenceDescriptor[];
+  readonly symbolsByName: Map<string, SymbolDescriptor>;
+}
+interface ScopeAnalysis {
+  readonly rootScope: ScopeDescriptor;
+  readonly scopeFor: (node: EsTreeNode) => ScopeDescriptor;
+  readonly ownScopeFor: (node: EsTreeNode) => ScopeDescriptor | null;
+  readonly symbolFor: (identifier: EsTreeNode) => SymbolDescriptor | null;
+  readonly referenceFor: (identifier: EsTreeNode) => ReferenceDescriptor | null;
+  readonly isGlobalReference: (identifier: EsTreeNode) => boolean;
+}
+//#endregion
+//#region src/plugin/utils/rule-context.d.ts
+interface BaseRuleSourceCode {
+  readonly ast?: EsTreeNode;
+}
+interface BaseRuleContext {
+  report: (descriptor: ReportDescriptor) => void;
+  readonly filename?: string;
+  /**
+   * @deprecated Rules use `context.filename`. Read only as a fallback by
+   * `wrapWithSemanticContext`; ESLint implements it as a `this`-bound class
+   * method, so it must be called on the host context, never a detached
+   * reference.
+   */
+  getFilename?: () => string | undefined;
+  readonly settings?: Readonly<Record<string, unknown>>;
+  readonly sourceCode?: BaseRuleSourceCode;
+}
+interface RuleContext extends Omit<BaseRuleContext, "getFilename"> {
+  readonly scopes: ScopeAnalysis;
+  readonly cfg: ControlFlowAnalysis;
+}
+//#endregion
+//#region src/plugin/utils/rule-visitors.d.ts
+interface RuleVisitors {
+  [selector: string]: ((node: any) => void) | (() => void);
+}
+//#endregion
+//#region src/plugin/utils/rule.d.ts
+type RuleSeverity = "error" | "warn";
+type RuleFramework = "global" | "nextjs" | "react-native" | "tanstack-start" | "tanstack-query" | "preact";
+interface Rule {
+  id: string;
+  title?: string;
+  severity: RuleSeverity;
+  category?: string;
+  framework?: RuleFramework;
+  requires?: ReadonlyArray<Capability>;
+  minimumInkVersion?: string;
+  disabledWhen?: ReadonlyArray<Capability>;
+  tags?: ReadonlyArray<string>;
+  matchByOccurrence?: boolean;
+  defaultEnabled?: boolean;
+  lifecycle?: "retired";
+  scan?: FileScan;
+  committedFilesOnly?: boolean;
+  recommendation?: string;
+  recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+  create: (context: RuleContext) => RuleVisitors;
+}
+//#endregion
+//#region src/plugin/utils/core-rule-metadata.d.ts
+interface CoreRuleMetadata {
+  readonly id: string;
+  readonly title?: string;
+  readonly severity: RuleSeverity;
+  readonly recommendation?: string;
+  readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+  readonly category: string;
+  readonly framework: RuleFramework;
+  readonly requires?: ReadonlyArray<Capability>;
+  readonly disabledWhen?: ReadonlyArray<Capability>;
+  readonly tags?: ReadonlyArray<string>;
+  readonly defaultEnabled?: boolean;
+  readonly matchByOccurrence?: boolean;
+  readonly isScanRule: boolean;
+}
+interface CoreRuleRegistryEntry {
+  readonly key: string;
+  readonly id: string;
+  readonly source: "react-doctor";
+  readonly originallyExternal: boolean;
+  readonly rule: CoreRuleMetadata;
+}
+//#endregion
+//#region src/types.d.ts
+type OxlintRuleSeverity = RuleSeverity | "off";
+//#endregion
+//#region src/external-rules.d.ts
+declare const EXTERNAL_RULES: readonly [{
+  readonly key: "react-hooks-js/set-state-in-render";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}, {
+  readonly key: "react-hooks-js/immutability";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}, {
+  readonly key: "react-hooks-js/refs";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}, {
+  readonly key: "react-hooks-js/purity";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}, {
+  readonly key: "react-hooks-js/hooks";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}, {
+  readonly key: "react-hooks-js/set-state-in-effect";
+  readonly source: "react-compiler";
+  readonly severity: "warn";
+}, {
+  readonly key: "react-hooks-js/globals";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}, {
+  readonly key: "react-hooks-js/error-boundaries";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}, {
+  readonly key: "react-hooks-js/preserve-manual-memoization";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}, {
+  readonly key: "react-hooks-js/unsupported-syntax";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}, {
+  readonly key: "react-hooks-js/component-hook-factories";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}, {
+  readonly key: "react-hooks-js/static-components";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}, {
+  readonly key: "react-hooks-js/use-memo";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}, {
+  readonly key: "react-hooks-js/void-use-memo";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}, {
+  readonly key: "react-hooks-js/incompatible-library";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}, {
+  readonly key: "react-hooks-js/todo";
+  readonly source: "react-compiler";
+  readonly severity: "error";
+}];
+declare const REACT_COMPILER_RULES: Record<string, OxlintRuleSeverity>;
+//#endregion
+//#region src/plugin/constants/style.d.ts
+declare const MOTION_LIBRARY_PACKAGES: Set<string>;
+//#endregion
+//#region src/plugin/constants/cross-file-rule-ids.d.ts
+declare const CROSS_FILE_RULE_IDS: ReadonlySet<string>;
+//#endregion
+//#region src/plugin/utils/cross-file-probe-recorder.d.ts
+interface CrossFileProbeTrace {
+  /** Paths whose existence classification (file / dir / none) was consulted. */
+  readonly existencePaths: Set<string>;
+  /** Paths whose content (bytes, exports, parse) was consulted. */
+  readonly contentPaths: Set<string>;
+}
+//#endregion
+//#region src/plugin/cross-file-dependencies.d.ts
+/**
+ * Per-rule cross-file dependency collectors — the foundation of the sidecar
+ * lint cache's dependency fingerprints (`@react-doctor/core`,
+ * `runners/oxlint/sidecar-lint-cache.ts`).
+ *
+ * A collector re-runs the SAME resolver helpers its rule calls at lint time
+ * (import resolution, barrel following, ancestor-layout walks, package.json
+ * classification) under the probe recorder
+ * (`utils/cross-file-probe-recorder.ts`), so the recorded probe set is the
+ * exact set of filesystem facts the rule's execution consulted — including
+ * the negative probes (extension candidates that did NOT exist) that make
+ * resolution shadowing detectable when a new file appears.
+ *
+ * SOUNDNESS INVARIANT — each collector's probe set must be a SUPERSET of
+ * every filesystem read its rule can make while linting the file, for any
+ * file content and any filesystem state:
+ *
+ *   - Over-approximation is always safe (extra probes only cause a spurious
+ *     re-lint); under-approximation is forbidden (a missed probe could
+ *     replay a stale verdict).
+ *   - Where a rule gates its cross-file reads on in-file conditions, a
+ *     collector may skip the gate (probe more) or must mirror it EXACTLY
+ *     (probe the same). Each collector documents which it does per gate.
+ *   - The replay argument: the stored probe set is the complete read set of
+ *     the collector's execution at store time. If every stored probe has
+ *     the same answer on a later scan, re-executing the collector — and
+ *     therefore the rule, whose reads are a subset — reproduces the same
+ *     execution step by step (the file's own content is pinned separately
+ *     by the cache key's content hash), so the stored diagnostics are
+ *     exactly what a fresh sidecar lint would produce.
+ *
+ * A cross-file rule WITHOUT a collector here must be listed in
+ * `UNBOUNDED_CROSS_FILE_RULE_IDS` — it then re-lints every file on every
+ * scan (the sound fallback). `cross-file-rule-ids.test.ts` in
+ * `@react-doctor/core` forces every `CROSS_FILE_RULE_IDS` entry into
+ * exactly one of the two classifications.
+ */
+interface CrossFileDependencyCollectorInput {
+  /** Absolute, forward-slash-normalized path of the file being fingerprinted. */
+  readonly absoluteFilePath: string;
+  readonly sourceText: string;
+  /** oxc module record — the file's static import declarations. */
+  readonly staticImports: ReadonlyArray<StaticImport>;
+  /** Lazily materialized program (no parent references attached). */
+  readonly getProgram: () => EsTreeNode;
+}
+type CrossFileDependencyCollector = (input: CrossFileDependencyCollectorInput) => void;
+declare const CROSS_FILE_DEPENDENCY_COLLECTORS: ReadonlyMap<string, CrossFileDependencyCollector>;
+/**
+ * Cross-file rules whose dependency set CANNOT be soundly bounded — they are
+ * excluded from fingerprinting and re-lint every file on every scan. A new
+ * cross-file rule must be added either here or to
+ * `CROSS_FILE_DEPENDENCY_COLLECTORS` (the core guard test enforces the
+ * partition), forcing a conscious classification.
+ */
+declare const UNBOUNDED_CROSS_FILE_RULE_IDS: ReadonlySet<string>;
+/**
+ * Runs the collectors for `ruleIds` over one file and returns every
+ * filesystem probe they made — the file's cross-file dependency set.
+ *
+ * Returns `null` (caller must treat the file as unfingerprintable and always
+ * re-lint it) when the file has a fatal parse error — an execution the
+ * collectors cannot mirror — or when a requested rule has no collector.
+ */
+declare const collectCrossFileDependencyProbes: (input: {
+  absoluteFilePath: string;
+  sourceText: string;
+  ruleIds: ReadonlyArray<string>;
+}) => CrossFileProbeTrace | null;
+//#endregion
+//#region src/plugin/security-scan-rule-registry.d.ts
+declare const reactDoctorScanRules: readonly [{
+  readonly key: "react-doctor/active-static-asset";
+  readonly id: "active-static-asset";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/agent-tool-capability-risk";
+  readonly id: "agent-tool-capability-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/artifact-baas-authority-surface";
+  readonly id: "artifact-baas-authority-surface";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/artifact-env-leak";
+  readonly id: "artifact-env-leak";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/artifact-secret-leak";
+  readonly id: "artifact-secret-leak";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/build-pipeline-secret-boundary";
+  readonly id: "build-pipeline-secret-boundary";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/clickjacking-redirect-risk";
+  readonly id: "clickjacking-redirect-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/command-execution-input-risk";
+  readonly id: "command-execution-input-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/cors-cookie-trust-risk";
+  readonly id: "cors-cookie-trust-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/dangerous-html-sink";
+  readonly id: "dangerous-html-sink";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/firebase-client-owned-authz-field";
+  readonly id: "firebase-client-owned-authz-field";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/firebase-permissive-rules";
+  readonly id: "firebase-permissive-rules";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/firebase-query-filter-as-auth";
+  readonly id: "firebase-query-filter-as-auth";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/git-provider-url-injection-risk";
+  readonly id: "git-provider-url-injection-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/import-metadata-execution-risk";
+  readonly id: "import-metadata-execution-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/insecure-crypto-risk";
+  readonly id: "insecure-crypto-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/insecure-session-cookie";
+  readonly id: "insecure-session-cookie";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/jwt-insecure-verification";
+  readonly id: "jwt-insecure-verification";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/key-lifecycle-risk";
+  readonly id: "key-lifecycle-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/local-rpc-native-bridge-risk";
+  readonly id: "local-rpc-native-bridge-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/mcp-tool-capability-risk";
+  readonly id: "mcp-tool-capability-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/mdx-ssr-execution-risk";
+  readonly id: "mdx-ssr-execution-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/nosql-injection-risk";
+  readonly id: "nosql-injection-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/package-metadata-secret";
+  readonly id: "package-metadata-secret";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/path-traversal-risk";
+  readonly id: "path-traversal-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/plugin-update-trust-risk";
+  readonly id: "plugin-update-trust-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/postmessage-origin-risk";
+  readonly id: "postmessage-origin-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/public-debug-artifact";
+  readonly id: "public-debug-artifact";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/public-env-secret-name";
+  readonly id: "public-env-secret-name";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/raw-sql-injection-risk";
+  readonly id: "raw-sql-injection-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/repository-secret-file";
+  readonly id: "repository-secret-file";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/request-body-mass-assignment";
+  readonly id: "request-body-mass-assignment";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/secret-in-fallback";
+  readonly id: "secret-in-fallback";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/supabase-client-owned-authz-field";
+  readonly id: "supabase-client-owned-authz-field";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/supabase-rls-policy-risk";
+  readonly id: "supabase-rls-policy-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/supabase-table-missing-rls";
+  readonly id: "supabase-table-missing-rls";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/svg-filter-clickjacking-risk";
+  readonly id: "svg-filter-clickjacking-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/tenant-static-proxy-risk";
+  readonly id: "tenant-static-proxy-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/unsafe-json-in-html";
+  readonly id: "unsafe-json-in-html";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/untrusted-redirect-following";
+  readonly id: "untrusted-redirect-following";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/url-prefilled-privileged-action";
+  readonly id: "url-prefilled-privileged-action";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}, {
+  readonly key: "react-doctor/webhook-signature-risk";
+  readonly id: "webhook-signature-risk";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Security";
+    readonly tags: readonly string[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly requires?: ReadonlyArray<Capability>;
+    readonly minimumInkVersion?: string;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
+}];
+//#endregion
+//#region src/plugin/utils/reset-filesystem-caches.d.ts
+declare const resetFilesystemCaches: () => void;
+//#endregion
+//#region src/plugin/rules/security-scan/utils/classify-security-scan-file.d.ts
+interface SecurityScanFileClassification {
+  readonly bucket: "priority" | "artifact" | "other";
+  readonly isGeneratedBundleByName: boolean;
+}
+declare const classifySecurityScanFile: (relativePath: string) => SecurityScanFileClassification | null;
+declare const shouldReadSecurityScanContent: (relativePath: string, isGeneratedBundle: boolean) => boolean;
+//#endregion
+//#region src/react-native-dependency-names.d.ts
+declare const REACT_NATIVE_DEPENDENCY_NAMES: ReadonlySet<string>;
+declare const REACT_NATIVE_DEPENDENCY_PREFIXES: ReadonlyArray<string>;
+declare const isReactNativeDependencyName: (dependencyName: string) => boolean;
+//#endregion
+//#region src/core.d.ts
+declare const REACT_DOCTOR_RULES: readonly CoreRuleRegistryEntry[];
+declare const REACT_DOCTOR_RULE_REGISTRY: Readonly<Record<string, CoreRuleMetadata>>;
+declare const ALL_REACT_DOCTOR_RULE_KEYS: ReadonlySet<string>;
+declare const FRAMEWORK_SPECIFIC_RULE_KEYS: ReadonlySet<string>;
+//#endregion
+export { ScanFinding as A, RuleFramework as C, RuleContext as D, BaseRuleContext as E, FrameworkToken as F, Capability as M, CapabilityQuery as N, EsTreeNode as O, FRAMEWORK_TOKENS as P, Rule as S, RuleVisitors as T, MOTION_LIBRARY_PACKAGES as _, REACT_NATIVE_DEPENDENCY_NAMES as a, OxlintRuleSeverity as b, classifySecurityScanFile as c, reactDoctorScanRules as d, CROSS_FILE_DEPENDENCY_COLLECTORS as f, CROSS_FILE_RULE_IDS as g, CrossFileProbeTrace as h, REACT_DOCTOR_RULE_REGISTRY as i, ScannedFile as j, FileScan as k, shouldReadSecurityScanContent as l, collectCrossFileDependencyProbes as m, FRAMEWORK_SPECIFIC_RULE_KEYS as n, REACT_NATIVE_DEPENDENCY_PREFIXES as o, UNBOUNDED_CROSS_FILE_RULE_IDS as p, REACT_DOCTOR_RULES as r, isReactNativeDependencyName as s, ALL_REACT_DOCTOR_RULE_KEYS as t, resetFilesystemCaches as u, EXTERNAL_RULES as v, RuleSeverity as w, CoreRuleMetadata as x, REACT_COMPILER_RULES as y };
+//# sourceMappingURL=core-NYcNjo1f.d.ts.map