prodlint 0.10.2 → 0.10.4

package/dist/mcp.js

@@ -10,7 +10,7 @@ import { resolve as resolve4, sep as sep2 } from "path";
 // src/utils/file-walker.ts
 import fg from "fast-glob";
 import { readFile, stat, realpath } from "fs/promises";
-import { resolve, extname, sep } from "path";
+import { resolve, extname, basename, sep } from "path";
 
 // src/utils/patterns.ts
 function isApiRoute(relativePath) {
@@ -53,6 +53,19 @@ function isCommentLine(lines, lineIndex, commentMap) {
   const trimmed = lines[lineIndex]?.trim() ?? "";
   return trimmed.startsWith("//");
 }
+var NON_CODE = /\/\/.*|\/\*[\s\S]*?\*\/|'(?:[^'\\\n]|\\[\s\S])*'|"(?:[^"\\\n]|\\[\s\S])*"|`(?:[^`\\]|\\[\s\S])*`/g;
+function blankOut(source, strings) {
+  const blank = (s) => s.replace(/[^\n]/g, " ");
+  return source.replace(NON_CODE, (m) => m[0] === "/" ? blank(m) : strings ? m[0] + blank(m.slice(1, -1)) + m[0] : m);
+}
+function closingBrace(code, open) {
+  let depth = 0;
+  for (let i = open; i < code.length; i++) {
+    if (code[i] === "{") depth++;
+    else if (code[i] === "}" && --depth === 0) return i;
+  }
+  return -1;
+}
 function isLineSuppressed(lines, lineIndex, ruleId) {
   for (const line of lines) {
     const trimmed = line.trim();
@@ -443,7 +456,8 @@ async function readFileContext(root, relativePath) {
     if (fileStats.size > MAX_FILE_SIZE) return null;
     const content = await readFile(absolutePath, "utf-8");
     const lines = content.split(/\r?\n|\r/);
-    const ext = extname(relativePath).slice(1);
+    const rawExt = extname(relativePath).slice(1);
+    const ext = /^\.env(?:\.|$)/.test(basename(relativePath)) && !SCAN_EXTENSIONS.includes(rawExt) ? "env" : rawExt;
     let ast = void 0;
     if (AST_EXTENSIONS.has(ext)) {
       try {
@@ -712,12 +726,12 @@ function calculateScores(findings) {
     }
     let totalDeduction = 0;
     for (const [, ruleFindings] of byRule) {
-      const bySeverity = { critical: 0, warning: 0, info: 0 };
+      const bySeverity2 = { critical: 0, warning: 0, info: 0 };
       for (const f of ruleFindings) {
-        bySeverity[f.severity]++;
+        bySeverity2[f.severity]++;
       }
       for (const sev of ["critical", "warning", "info"]) {
-        const count = Math.min(bySeverity[sev], PER_RULE_CAP[sev]);
+        const count = Math.min(bySeverity2[sev], PER_RULE_CAP[sev]);
         totalDeduction += count * DEDUCTIONS[sev];
       }
     }
@@ -749,12 +763,21 @@ function summarizeFindings(findings) {
 }
 
 // src/rules/secrets.ts
+function nameJwt(token) {
+  try {
+    const claims = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8"));
+    if (claims?.role === "anon") return null;
+    if (claims?.role === "service_role") return "Supabase service role key";
+  } catch {
+  }
+  return "JWT";
+}
 var SECRET_PATTERNS = [
   { name: "Stripe secret key", pattern: /sk_live_[a-zA-Z0-9]{8,}/ },
   { name: "Stripe test key", pattern: /sk_test_[a-zA-Z0-9]{8,}/ },
   { name: "AWS access key", pattern: /AKIA[0-9A-Z]{16}/ },
   { name: "AWS secret key", pattern: /(?:aws_secret_access_key|AWS_SECRET)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/ },
-  { name: "Supabase service role key", pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[A-Za-z0-9_-]{50,}\.[A-Za-z0-9_-]{20,}/ },
+  { name: "JWT", pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[A-Za-z0-9_-]{50,}\.[A-Za-z0-9_-]{20,}/, nameMatch: nameJwt },
   { name: "OpenAI API key (legacy)", pattern: /sk-[a-zA-Z0-9]{20,}T3BlbkFJ[a-zA-Z0-9]{20,}/ },
   { name: "OpenAI API key", pattern: /sk-proj-[a-zA-Z0-9_\-]{20,}/ },
   { name: "Anthropic API key", pattern: /sk-ant-(?:api|admin)[0-9]{2}-[a-zA-Z0-9_\-]{20,}/ },
@@ -789,15 +812,17 @@ var secretsRule = {
     for (let i = 0; i < file.lines.length; i++) {
       const line = file.lines[i];
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
-      for (const { name, pattern } of SECRET_PATTERNS) {
+      for (const { name, pattern, nameMatch } of SECRET_PATTERNS) {
         const match = pattern.exec(line);
         if (match) {
+          const reported = nameMatch ? nameMatch(match[0]) : name;
+          if (!reported) continue;
           findings.push({
             ruleId: "secrets",
             file: file.relativePath,
             line: i + 1,
             column: match.index + 1,
-            message: `Hardcoded ${name} detected`,
+            message: `Hardcoded ${reported} detected`,
             severity: "critical",
             category: "security",
             fix: "Move the secret to an environment variable and access via process.env.SECRET_NAME"
@@ -953,12 +978,208 @@ var AUTH_PATTERNS = [
   /createRouteHandlerClient/,
   /createServerComponentClient/,
   /createMiddlewareClient/,
-  /authorization/i,
+  // Reading the request's Authorization header, not sending one upstream:
+  // headers.get('authorization'), req.headers.authorization, req.headers['authorization'], req.header('Authorization')
+  /\.(?:get|header)\(\s*['"`]authorization['"`]/i,
+  /\.headers\??\.authorization\b(?!\s*=(?!=))/i,
+  /\.headers\[\s*['"`]authorization['"`]\s*\](?!\s*=(?!=))/i,
   /getAuth\s*\(/,
   /withPageAuth/,
   /cookies\(\).*auth/s
 ];
-var MUTATION_EXPORT = /export\s+(?:async\s+)?function\s+(POST|PUT|PATCH|DELETE)\b/;
+var MUTATION_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var HANDLER_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"]);
+var TRPC_ROUTE = /['"]@trpc\/server\/adapters\//;
+var AUTH_WORD = /^(?:auth(?!or(?:s|ed|ing|ship)?$)|session)/i;
+var NO_AUTH_WORD = /^(?:without|no|non|skip|bypass|optional|public|anon|anonymous|guest)$/i;
+function words(name) {
+  return name.split(/[^A-Za-z0-9]+|(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/).filter(Boolean);
+}
+function saysAuth(name) {
+  const w = words(name);
+  return w.some((x) => AUTH_WORD.test(x)) && !w.some((x) => NO_AUTH_WORD.test(x));
+}
+function isAuthHelper(name, source) {
+  if (words(name).some((x) => NO_AUTH_WORD.test(x))) return false;
+  return saysAuth(name) || /^with[A-Z0-9_$]/.test(name) && source !== void 0 && saysAuth(source);
+}
+var AUTHED = { authed: true, local: true };
+var LOCAL = { authed: false, local: true };
+var ELSEWHERE = { authed: false, local: false };
+function handlersFromAst(program) {
+  const imports = /* @__PURE__ */ new Map();
+  const bindings = /* @__PURE__ */ new Map();
+  for (const st of program.body) {
+    if (st.type === "ImportDeclaration") {
+      for (const s of st.specifiers) imports.set(s.local.name, st.source.value);
+      continue;
+    }
+    const decl = st.type === "ExportNamedDeclaration" || st.type === "ExportDefaultDeclaration" ? st.declaration : st;
+    if (decl?.type === "FunctionDeclaration" && decl.id) bindings.set(decl.id.name, decl);
+    if (decl?.type === "VariableDeclaration") {
+      for (const d of decl.declarations) {
+        if (d.id.type === "Identifier" && d.init) bindings.set(d.id.name, d.init);
+      }
+    }
+  }
+  const helperOf = (callee) => {
+    if (callee.type === "CallExpression") return helperOf(callee.callee);
+    if (callee.type === "Identifier") return { name: callee.name, source: imports.get(callee.name) };
+    if (callee.type === "MemberExpression" && callee.property.type === "Identifier") {
+      let root = callee.object;
+      while (root.type === "MemberExpression") root = root.object;
+      return { name: callee.property.name, source: root.type === "Identifier" ? imports.get(root.name) : void 0 };
+    }
+    return null;
+  };
+  const classify = (node, seen) => {
+    while (node.type === "TSAsExpression" || node.type === "TSSatisfiesExpression" || node.type === "TSNonNullExpression" || node.type === "TSTypeAssertion" || node.type === "ParenthesizedExpression" || node.type === "AwaitExpression") {
+      node = node.type === "AwaitExpression" ? node.argument : node.expression;
+    }
+    switch (node.type) {
+      case "FunctionDeclaration":
+      case "FunctionExpression":
+      case "ArrowFunctionExpression":
+        return LOCAL;
+      case "Identifier": {
+        const bound = bindings.get(node.name);
+        if (!bound || seen.has(node.name)) return ELSEWHERE;
+        return classify(bound, new Set(seen).add(node.name));
+      }
+      case "CallExpression": {
+        const helper = helperOf(node.callee);
+        if (helper && isAuthHelper(helper.name, helper.source)) return AUTHED;
+        let local = false;
+        for (const arg of node.callee.type === "CallExpression" ? [node.callee, ...node.arguments] : node.arguments) {
+          const verdict = classify(arg, seen);
+          if (verdict.authed) return verdict;
+          local ||= verdict.local;
+        }
+        return { authed: false, local };
+      }
+    }
+    return ELSEWHERE;
+  };
+  const handlers = [];
+  const add = (method, at, verdict) => {
+    handlers.push({ method, line: at.loc?.start.line ?? 1, ...verdict });
+  };
+  for (const st of program.body) {
+    if (st.type === "ExportNamedDeclaration") {
+      const decl = st.declaration;
+      if (decl?.type === "FunctionDeclaration") {
+        if (decl.id && HANDLER_METHODS.has(decl.id.name)) add(decl.id.name, st, LOCAL);
+      } else if (decl?.type === "VariableDeclaration") {
+        for (const d of decl.declarations) {
+          if (d.id.type === "Identifier" && HANDLER_METHODS.has(d.id.name)) {
+            add(d.id.name, d, d.init ? classify(d.init, /* @__PURE__ */ new Set()) : ELSEWHERE);
+          } else if (d.id.type === "ObjectPattern") {
+            for (const p of d.id.properties) {
+              if (p.type === "ObjectProperty" && p.value.type === "Identifier" && HANDLER_METHODS.has(p.value.name)) {
+                add(p.value.name, d, ELSEWHERE);
+              }
+            }
+          }
+        }
+      } else if (!decl) {
+        for (const s of st.specifiers) {
+          if (s.type !== "ExportSpecifier") continue;
+          const name = s.exported.type === "Identifier" ? s.exported.name : s.exported.value;
+          if (name === "default" || HANDLER_METHODS.has(name)) add(name, s, st.source ? ELSEWHERE : classify(s.local, /* @__PURE__ */ new Set()));
+        }
+      }
+    } else if (st.type === "ExportDefaultDeclaration") {
+      add("default", st, classify(st.declaration, /* @__PURE__ */ new Set()));
+    } else if (st.type === "ExportAllDeclaration") {
+      add("*", st, ELSEWHERE);
+    }
+  }
+  return handlers;
+}
+var METHOD = "(GET|HEAD|POST|PUT|PATCH|DELETE)";
+var EXPORT_FUNCTION = new RegExp(`^\\s*export\\s+(?:async\\s+)?function\\s*\\*?\\s*${METHOD}(?![\\w$])`);
+var EXPORT_CONST = new RegExp(`^\\s*export\\s+(?:const|let|var)\\s+${METHOD}(?![\\w$])\\s*(?::[^=]*)?=(?![=>])(.*)$`);
+var EXPORT_DESTRUCTURED = /^\s*export\s+(?:const|let|var)\s*\{([^}]*)\}\s*=/;
+var EXPORT_DEFAULT = /^\s*export\s+default\s+(.*)$/;
+var EXPORT_ALL = /^\s*export\s*\*\s*from\b/;
+var EXPORT_LIST = /\bexport\s*\{([^}]*)\}(\s*from\b)?/g;
+var IMPORT = /\bimport\s+(?!type\b)([\w$*{}\s,]+?)\s+from\s*['"]([^'"]+)['"]/g;
+var INLINE_FUNCTION = /^(?:async\b|function\b|\([^)]*\)\s*(?::[^=]+)?=>|[\w$]+\s*=>)/;
+var CALL = /^([A-Za-z_$][\w$]*)(?:\s*\.\s*([A-Za-z_$][\w$]*))*\s*(?:<[^>()]*>)?\s*\(/;
+var IDENTIFIER = /^([A-Za-z_$][\w$]*)\s*(?:[,);\n]|$)/;
+function handlersFromText(file) {
+  const imports = /* @__PURE__ */ new Map();
+  for (const m of file.content.matchAll(IMPORT)) {
+    for (const part of m[1].replace(/[{}]/g, ",").split(",")) {
+      const spec = /^\s*(?:type\s+)?(?:\*\s+as\s+)?([\w$]+)(?:\s+as\s+([\w$]+))?\s*$/.exec(part);
+      if (spec) imports.set(spec[2] ?? spec[1], m[2]);
+    }
+  }
+  const code = (i) => !isCommentLine(file.lines, i, file.commentMap);
+  const value = (i, head) => [head, ...file.lines.slice(i + 1, i + 5).filter((_, k) => code(i + 1 + k))].join("\n");
+  const resolve5 = (name, seen) => {
+    const id = name.replace(/\$/g, "\\$");
+    const fn = new RegExp(`^\\s*(?:export\\s+)?(?:default\\s+)?(?:async\\s+)?function\\s*\\*?\\s*${id}(?![\\w$])`);
+    const variable = new RegExp(`^\\s*(?:export\\s+)?(?:const|let|var)\\s+${id}(?![\\w$])\\s*(?::[^=]*)?=(?![=>])(.*)$`);
+    for (let i = 0; i < file.lines.length; i++) {
+      if (!code(i)) continue;
+      if (fn.test(file.lines[i])) return LOCAL;
+      const m = variable.exec(file.lines[i]);
+      if (m) return classify(value(i, m[1]), seen);
+    }
+    return ELSEWHERE;
+  };
+  const classify = (text, seen) => {
+    const t = text.trim().replace(/^await\s+/, "");
+    if (INLINE_FUNCTION.test(t)) return LOCAL;
+    const call = CALL.exec(t);
+    if (call) {
+      if (isAuthHelper(call[2] ?? call[1], imports.get(call[1]))) return AUTHED;
+      let args = t.slice(call[0].length);
+      const curried = /^[^()]*\)\s*\(/.exec(args);
+      if (curried) args = args.slice(curried[0].length);
+      return classify(args, seen);
+    }
+    const id = IDENTIFIER.exec(t);
+    if (id && !seen.has(id[1])) return resolve5(id[1], new Set(seen).add(id[1]));
+    return ELSEWHERE;
+  };
+  const handlers = [];
+  for (let i = 0; i < file.lines.length; i++) {
+    if (!code(i)) continue;
+    const line = file.lines[i];
+    let m;
+    if (m = EXPORT_FUNCTION.exec(line)) {
+      handlers.push({ method: m[1], line: i + 1, ...LOCAL });
+    } else if (m = EXPORT_CONST.exec(line)) {
+      handlers.push({ method: m[1], line: i + 1, ...classify(value(i, m[2]), /* @__PURE__ */ new Set()) });
+    } else if (m = EXPORT_DESTRUCTURED.exec(line)) {
+      for (const part of m[1].split(",")) {
+        const name = part.split(":").pop()?.trim() ?? "";
+        if (HANDLER_METHODS.has(name)) handlers.push({ method: name, line: i + 1, ...ELSEWHERE });
+      }
+    } else if (m = EXPORT_DEFAULT.exec(line)) {
+      handlers.push({ method: "default", line: i + 1, ...classify(value(i, m[1]), /* @__PURE__ */ new Set()) });
+    } else if (EXPORT_ALL.test(line)) {
+      handlers.push({ method: "*", line: i + 1, ...ELSEWHERE });
+    }
+  }
+  const lineAt = (offset) => file.content.slice(0, offset).split("\n").length;
+  for (const m of file.content.matchAll(EXPORT_LIST)) {
+    if (!code(lineAt(m.index) - 1)) continue;
+    let offset = m.index + m[0].indexOf("{") + 1;
+    for (const part of m[1].split(",")) {
+      const spec = /^\s*(?:type\s+)?([\w$]+)(?:\s+as\s+([\w$]+))?\s*$/.exec(part);
+      const name = spec ? spec[2] ?? spec[1] : "";
+      if (spec && (name === "default" || HANDLER_METHODS.has(name))) {
+        const line = lineAt(offset + part.length - part.trimStart().length);
+        handlers.push({ method: name, line, ...m[2] ? ELSEWHERE : classify(spec[1], /* @__PURE__ */ new Set()) });
+      }
+      offset += part.length + 1;
+    }
+  }
+  return handlers.sort((a, b) => a.line - b.line);
+}
 var authChecksRule = {
   id: "auth-checks",
   name: "Missing Auth Checks",
@@ -974,21 +1195,18 @@ var authChecksRule = {
     for (const pattern of AUTH_PATTERNS) {
       if (pattern.test(file.content)) return [];
     }
+    const handlers = file.ast ? handlersFromAst(file.ast.program) : handlersFromText(file);
+    const exposed = handlers.filter((h) => !h.authed);
+    if (handlers.length > 0 && exposed.length === 0) return [];
     let severity;
     if (project.hasAuthMiddleware) {
       severity = "info";
-    } else if (MUTATION_EXPORT.test(file.content)) {
+    } else if (exposed.some((h) => h.local && MUTATION_METHODS.has(h.method)) && !TRPC_ROUTE.test(file.content)) {
       severity = "critical";
     } else {
       severity = "info";
     }
-    let handlerLine = 1;
-    for (let i = 0; i < file.lines.length; i++) {
-      if (/export\s+(async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE|handler)/i.test(file.lines[i])) {
-        handlerLine = i + 1;
-        break;
-      }
-    }
+    const handlerLine = exposed[0]?.line ?? 1;
     const message = project.hasAuthMiddleware ? "API route has no inline auth check (middleware auth detected \u2014 verify coverage)" : "API route has no authentication check";
     return [{
       ruleId: "auth-checks",
@@ -1107,7 +1325,8 @@ var errorHandlingRule = {
 
 // src/rules/input-validation.ts
 var VALIDATION_PATTERNS = [
-  /\.parse\s*\(/,
+  // A schema's .parse(), but not parsers that validate nothing: JSON.parse(), Date.parse()...
+  /(?<!\b(?:JSON|Date|URL|path|qs|querystring))\.parse\s*\(/,
   /\.safeParse\s*\(/,
   /\.validate\s*\(/,
   /\.validateSync\s*\(/,
@@ -1408,6 +1627,40 @@ var aiSmellsRule = {
 };
 
 // src/rules/unsafe-html.ts
+var SANITIZER_NAME = /^(?:sanitize\w*|xss|filterXSS)$/i;
+var SANITIZER_CALL_TEXT = /^\s*(?:await\s+)?(?:[\w$.]*\.sanitize|sanitize\w*|xss|filterXSS)\s*\(/i;
+function isSanitizerCall(node) {
+  if (node.type === "AwaitExpression") return isSanitizerCall(node.argument);
+  if (node.type === "TSAsExpression" || node.type === "TSSatisfiesExpression" || node.type === "TSNonNullExpression") {
+    return isSanitizerCall(node.expression);
+  }
+  if (node.type !== "CallExpression" && node.type !== "OptionalCallExpression") return false;
+  const callee = node.callee;
+  if (callee.type === "MemberExpression" || callee.type === "OptionalMemberExpression") {
+    return callee.property.type === "Identifier" && callee.property.name === "sanitize";
+  }
+  return callee.type === "Identifier" && SANITIZER_NAME.test(callee.name);
+}
+function containsJsonStringify(node) {
+  return subtreeContains(node, (n) => {
+    if (n.type !== "CallExpression") return false;
+    const call = n;
+    if (call.callee.type === "MemberExpression") {
+      const mem = call.callee;
+      return mem.object.type === "Identifier" && mem.object.name === "JSON" && mem.property.type === "Identifier" && mem.property.name === "stringify";
+    }
+    return false;
+  });
+}
+function isSanitized(value, sanitizedNames) {
+  if (value.type === "JSXExpressionContainer") return isSanitized(value.expression, sanitizedNames);
+  if (value.type === "ObjectExpression") {
+    const html = value.properties.find((p) => p.type === "ObjectProperty" && (p.key.type === "Identifier" && p.key.name === "__html" || p.key.type === "StringLiteral" && p.key.value === "__html"));
+    return html?.type === "ObjectProperty" && isSanitized(html.value, sanitizedNames);
+  }
+  if (value.type === "Identifier") return sanitizedNames.has(value.name);
+  return isSanitizerCall(value);
+}
 var unsafeHtmlRule = {
   id: "unsafe-html",
   name: "Unsafe HTML Rendering",
@@ -1419,21 +1672,17 @@ var unsafeHtmlRule = {
     const findings = [];
     if (file.ast) {
       try {
+        const sanitizedNames = /* @__PURE__ */ new Set();
+        walkAST(file.ast.program, (node) => {
+          if (node.type === "VariableDeclarator" && node.id.type === "Identifier" && node.init && subtreeContains(node.init, isSanitizerCall)) {
+            sanitizedNames.add(node.id.name);
+          }
+        });
         walkAST(file.ast.program, (node) => {
           if (node.type === "JSXAttribute") {
             const attr = node;
             if (attr.name?.type === "JSXIdentifier" && attr.name.name === "dangerouslySetInnerHTML" && attr.loc) {
-              if (attr.value && subtreeContains(attr.value, (n) => {
-                if (n.type !== "CallExpression") return false;
-                const call = n;
-                if (call.callee.type === "MemberExpression") {
-                  const mem = call.callee;
-                  return mem.object.type === "Identifier" && mem.object.name === "JSON" && mem.property.type === "Identifier" && mem.property.name === "stringify";
-                }
-                return false;
-              })) {
-                return;
-              }
+              if (attr.value && (containsJsonStringify(attr.value) || isSanitized(attr.value, sanitizedNames))) return;
               const line = attr.loc.start.line;
               findings.push({
                 ruleId: "unsafe-html",
@@ -1450,17 +1699,7 @@ var unsafeHtmlRule = {
           if (node.type === "ObjectProperty") {
             const prop = node;
             if (prop.key?.type === "Identifier" && prop.key.name === "dangerouslySetInnerHTML" && prop.loc) {
-              if (prop.value && subtreeContains(prop.value, (n) => {
-                if (n.type !== "CallExpression") return false;
-                const call = n;
-                if (call.callee.type === "MemberExpression") {
-                  const mem = call.callee;
-                  return mem.object.type === "Identifier" && mem.object.name === "JSON" && mem.property.type === "Identifier" && mem.property.name === "stringify";
-                }
-                return false;
-              })) {
-                return;
-              }
+              if (prop.value && (containsJsonStringify(prop.value) || isSanitized(prop.value, sanitizedNames))) return;
               const line = prop.loc.start.line;
               findings.push({
                 ruleId: "unsafe-html",
@@ -1477,6 +1716,7 @@ var unsafeHtmlRule = {
           if (node.type === "AssignmentExpression") {
             const assign = node;
             if (assign.left?.type === "MemberExpression" && assign.left.property?.type === "Identifier" && assign.left.property.name === "innerHTML" && assign.loc) {
+              if (isSanitized(assign.right, sanitizedNames)) return;
               const line = assign.loc.start.line;
               findings.push({
                 ruleId: "unsafe-html",
@@ -1507,6 +1747,8 @@ var unsafeHtmlRule = {
         }
         const expr = context.join(" ");
         if (/__html\s*:\s*JSON\.stringify/.test(expr)) continue;
+        const html = /__html\s*:/.exec(expr);
+        if (html && SANITIZER_CALL_TEXT.test(expr.slice(html.index + html[0].length))) continue;
         findings.push({
           ruleId: "unsafe-html",
           file: file.relativePath,
@@ -1518,7 +1760,8 @@ var unsafeHtmlRule = {
           fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
         });
       }
-      if (/\w\.innerHTML\s*=/.test(line)) {
+      const innerHtml = /\w\.innerHTML\s*=/.exec(line);
+      if (innerHtml && !SANITIZER_CALL_TEXT.test(line.slice(innerHtml.index + innerHtml[0].length))) {
         findings.push({
           ruleId: "unsafe-html",
           file: file.relativePath,
@@ -1697,9 +1940,16 @@ var staleFallbackRule = {
 };
 
 // src/rules/hallucinated-api.ts
+var DOM_CONTAINS_RECEIVER = /(?:\b(?:classList|relList)|\.current|\bdocument(?:\.(?:body|documentElement|head))?)\??$/;
+var DOM_CONTAINS_ARGUMENT = /^\s*(?:[\w$.?]*\.(?:target|relatedTarget|currentTarget|activeElement)\b|[^)]*\bas\s+(?:Node|Element|HTML\w*Element)\b)/;
 var HALLUCINATED_APIS = [
   { pattern: /\.flatten\s*\(/, fix: "Use .flat() instead of .flatten()", methodName: "flatten" },
-  { pattern: /\.contains\s*\(/, fix: "Use .includes() instead of .contains()", methodName: "contains" },
+  {
+    pattern: /\.contains\s*\(/,
+    fix: "Use .includes() instead of .contains() on arrays and strings \u2014 DOM classList and Node .contains() are valid",
+    methodName: "contains",
+    isValid: (before, after) => DOM_CONTAINS_RECEIVER.test(before) || DOM_CONTAINS_ARGUMENT.test(after)
+  },
   { pattern: /\.substr\s*\(/, fix: "Use .substring() or .slice() instead of deprecated .substr()", methodName: "substr" },
   { pattern: /\.trimLeft\s*\(/, fix: "Use .trimStart() instead of deprecated .trimLeft()", methodName: "trimLeft" },
   { pattern: /\.trimRight\s*\(/, fix: "Use .trimEnd() instead of deprecated .trimRight()", methodName: "trimRight" },
@@ -1721,10 +1971,11 @@ var hallucinatedApiRule = {
     for (let i = 0; i < file.lines.length; i++) {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];
-      for (const { pattern, fix, methodName } of HALLUCINATED_APIS) {
+      for (const { pattern, fix, methodName, isValid } of HALLUCINATED_APIS) {
         const match = pattern.exec(line);
         if (match) {
           if (isFrameworkSafeMethod(methodName, frameworks)) continue;
+          if (isValid?.(line.slice(0, match.index), line.slice(match.index + match[0].length))) continue;
           findings.push({
             ruleId: "hallucinated-api",
             file: file.relativePath,
@@ -2364,6 +2615,13 @@ function isEntryPoint(relativePath) {
   const name = relativePath.split("/").pop() ?? "";
   return /^(page|layout|loading|error|not-found|route|middleware|instrumentation|opengraph-image|twitter-image|icon|apple-icon|sitemap|robots|manifest)\.(tsx?|jsx?)$/.test(name) || /^index\.(tsx?|jsx?)$/.test(name) || name === "global-error.tsx" || name === "global-error.jsx";
 }
+var IMPORT_NAMED = /\bimport\s*(?:type\s*)?(?:[\w$]+\s*,\s*)?\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]/g;
+var IMPORT_DEFAULT = /\bimport\s+([\w$]+)\s*(?:,\s*\{[^}]*\}\s*)?from\s*['"]([^'"]+)['"]/g;
+var IMPORT_NAMESPACE = /\bimport\s+(?:[\w$]+\s*,\s*)?\*\s*as\s+[\w$]+\s+from\s*['"]([^'"]+)['"]/g;
+var FROM_SOURCE = /from\s+['"]([^'"]+)['"]/g;
+function sourceBasename(source) {
+  return source.split("/").pop()?.replace(/\.\w+$/, "") ?? "";
+}
 var THRESHOLD = 5;
 var deadExportsRule = {
   id: "dead-exports",
@@ -2383,6 +2641,7 @@ var deadExportsRule = {
     const imports = /* @__PURE__ */ new Map();
     const allImportedSymbols = /* @__PURE__ */ new Set();
     const importedFiles = /* @__PURE__ */ new Set();
+    const namespaceImported = /* @__PURE__ */ new Set();
     for (const file of sourceFiles) {
       if (isEntryPoint(file.relativePath)) continue;
       let inTemplateLiteral = false;
@@ -2425,42 +2684,35 @@ var deadExportsRule = {
         }
       }
     }
+    const addImport = (sym, source) => {
+      allImportedSymbols.add(sym);
+      const fromBasename = sourceBasename(source);
+      if (fromBasename) {
+        const set = imports.get(fromBasename) ?? /* @__PURE__ */ new Set();
+        set.add(sym);
+        imports.set(fromBasename, set);
+      }
+    };
     for (const file of files) {
-      for (const line of file.lines) {
-        let match;
-        const fromMatch = line.match(/from\s+['"]([^'"]+)['"]/);
-        const fromBasename = fromMatch ? fromMatch[1].split("/").pop()?.replace(/\.\w+$/, "") ?? "" : "";
-        const bracesRe = /import\s*(?:type\s*)?\{([^}]+)\}\s*from/g;
-        while ((match = bracesRe.exec(line)) !== null) {
-          const symbols = match[1].split(",").map((s) => s.trim().split(/\s+as\s+/)[0].trim()).filter(Boolean);
-          for (const sym of symbols) {
-            allImportedSymbols.add(sym);
-            if (fromBasename) {
-              const set = imports.get(fromBasename) ?? /* @__PURE__ */ new Set();
-              set.add(sym);
-              imports.set(fromBasename, set);
-            }
-          }
-        }
-        const defaultRe = /import\s+(\w+)\s+from/g;
-        while ((match = defaultRe.exec(line)) !== null) {
-          allImportedSymbols.add(match[1]);
-          if (fromBasename) {
-            const set = imports.get(fromBasename) ?? /* @__PURE__ */ new Set();
-            set.add(match[1]);
-            imports.set(fromBasename, set);
-          }
-        }
-        const fromRe = /from\s+['"]([^'"]+)['"]/g;
-        while ((match = fromRe.exec(line)) !== null) {
-          importedFiles.add(match[1]);
-        }
+      for (const match of file.content.matchAll(IMPORT_NAMED)) {
+        const symbols = match[1].replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "").split(",").map((s) => s.trim().replace(/^type\s+/, "").split(/\s+as\s+/)[0].trim()).filter(Boolean);
+        for (const sym of symbols) addImport(sym, match[2]);
+      }
+      for (const match of file.content.matchAll(IMPORT_DEFAULT)) {
+        addImport(match[1], match[2]);
+      }
+      for (const match of file.content.matchAll(IMPORT_NAMESPACE)) {
+        namespaceImported.add(sourceBasename(match[1]));
+      }
+      for (const match of file.content.matchAll(FROM_SOURCE)) {
+        importedFiles.add(match[1]);
       }
     }
     const deadByFile = /* @__PURE__ */ new Map();
     for (const [key, loc] of exports) {
       const symbolName = key.split("::")[1];
       const exportFileBasename = loc.file.split("/").pop()?.replace(/\.\w+$/, "") ?? "";
+      if (namespaceImported.has(exportFileBasename)) continue;
       const importSet = imports.get(exportFileBasename);
       const isImported = importSet?.has(symbolName) ?? false;
       if (!isImported && !allImportedSymbols.has(symbolName)) {
@@ -2490,15 +2742,16 @@ var deadExportsRule = {
 };
 
 // src/rules/shallow-catch.ts
-function scoreCatchBody(bodyLines) {
-  if (bodyLines.length === 0 || bodyLines.every((l) => l.trim() === "")) {
-    return { score: 0, label: "empty catch" };
-  }
-  const body = bodyLines.join("\n");
+function reportsError(value, param) {
+  if (/error/i.test(value) || /\berr|Err|status|Response|json/.test(value)) return true;
+  return param !== void 0 && new RegExp(`(?<![\\w$])${param.replace(/\$/g, "\\$")}(?![\\w$])`).test(value);
+}
+function scoreCatchBody({ text: body, empty, returned, param }) {
+  if (empty) return { score: 0, label: "empty catch" };
   let score = 0;
   if (/console\.(log|warn|error|info)\s*\(/.test(body)) score = 1;
   if ((/console\.(error|warn)\s*\(/.test(body) || /\b(logger|log)\.(error|warn)\s*\(/.test(body)) && /\b(err|error|e)\b/.test(body)) score = 2;
-  if (/\bthrow\b/.test(body) || /\breturn\b.*(?:error|err|status|Response|NextResponse|json)/.test(body) || /\bset\w*Error\s*\(/.test(body) || /\bres\.\w+\s*\(/.test(body) || // Toast notifications (react-toastify, sonner, shadcn)
+  if (/\bthrow\b/.test(body) || returned.some((value) => reportsError(value, param)) || /\bset\w*Error\s*\(/.test(body) || /\bres\.\w+\s*\(/.test(body) || // Toast notifications (react-toastify, sonner, shadcn)
   /\btoast\.(error|warn|warning)\s*\(/.test(body) || /\btoast\s*\(\s*\{/.test(body) || // Error monitoring (Sentry, etc.)
   /\b(Sentry\.)?captureException\s*\(/.test(body) || /\b(Sentry\.)?captureMessage\s*\(/.test(body) || // Structured loggers
   /\b(logger|log)\.(error|fatal)\s*\(/.test(body) || // Error handler utilities
@@ -2508,13 +2761,43 @@ function scoreCatchBody(bodyLines) {
     score = 3;
   }
   const labels = {
-    0: "empty catch",
+    0: "catch swallows the error",
     1: "catch only logs (no recovery or propagation)",
     2: "catch logs error but does not propagate or recover",
     3: "catch handles error properly"
   };
   return { score, label: labels[score] };
 }
+function catchFinding(file, catchLine, body) {
+  const { score, label } = scoreCatchBody(body);
+  if (score > 1) return null;
+  return {
+    ruleId: "shallow-catch",
+    file: file.relativePath,
+    line: catchLine + 1,
+    column: file.lines[catchLine].indexOf("catch") + 1,
+    message: body.empty ? "Empty catch block \u2014 errors are silently swallowed" : score === 0 ? "Catch block swallows the error \u2014 it isn't logged, rethrown or returned" : `Decorative error handler: ${label}`,
+    severity: score === 0 ? "warning" : "info",
+    category: "reliability",
+    fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
+  };
+}
+function returnedValues(code, text) {
+  const values = [];
+  for (const m of code.matchAll(/(?<![\w$.])return\b/g)) {
+    const start = m.index + "return".length;
+    let end = start;
+    for (let depth = 0; end < code.length; end++) {
+      const ch = code[end];
+      if (ch === "(" || ch === "[" || ch === "{") depth++;
+      else if (ch === ")" || ch === "]" || ch === "}") {
+        if (depth-- === 0) break;
+      } else if (depth === 0 && (ch === ";" || ch === "\n")) break;
+    }
+    values.push(text.slice(start, end));
+  }
+  return values;
+}
 var shallowCatchRule = {
   id: "shallow-catch",
   name: "Shallow Error Handler",
@@ -2531,95 +2814,45 @@ var shallowCatchRule = {
         walkAST(file.ast.program, (node) => {
           if (node.type !== "CatchClause") return;
           if (!node.loc) return;
-          const catchLine = node.loc.start.line - 1;
+          const catchLine2 = node.loc.start.line - 1;
           const body = node.body;
-          if (!body || !body.loc) return;
-          const bodyStart = body.loc.start.line - 1;
-          const bodyEnd = body.loc.end.line - 1;
-          const bodyLines = bodyStart === bodyEnd ? [file.lines[bodyStart]] : file.lines.slice(bodyStart + 1, bodyEnd);
-          const { score, label } = scoreCatchBody(bodyLines);
-          if (score <= 1) {
-            findings.push({
-              ruleId: "shallow-catch",
-              file: file.relativePath,
-              line: catchLine + 1,
-              column: file.lines[catchLine].indexOf("catch") + 1,
-              message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
-              severity: score === 0 ? "warning" : "info",
-              category: "reliability",
-              fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
-            });
-          }
+          if (body?.start == null || body.end == null) return;
+          const returned = [];
+          walkAST(body, (n) => {
+            if (n.type === "ReturnStatement" && n.argument?.start != null && n.argument.end != null) {
+              returned.push(file.content.slice(n.argument.start, n.argument.end));
+            }
+          });
+          const finding = catchFinding(file, catchLine2, {
+            text: file.content.slice(body.start + 1, body.end - 1),
+            empty: body.body.length === 0,
+            returned,
+            param: node.param?.type === "Identifier" ? node.param.name : void 0
+          });
+          if (finding) findings.push(finding);
         });
         return findings;
       } catch {
       }
     }
-    for (let i = 0; i < file.lines.length; i++) {
-      if (isCommentLine(file.lines, i, file.commentMap)) continue;
-      const trimmed = file.lines[i].trim();
-      if (!/\bcatch\s*\(/.test(trimmed) && !/\bcatch\s*\{/.test(trimmed)) continue;
-      let braceStart = -1;
-      for (let j = i; j < Math.min(i + 3, file.lines.length); j++) {
-        if (file.lines[j].includes("{")) {
-          braceStart = j;
-          break;
-        }
-      }
-      if (braceStart === -1) continue;
-      let depth = 0;
-      let bodyEnd = braceStart;
-      let inSingle = false;
-      let inDouble = false;
-      let inTemplate = false;
-      for (let j = braceStart; j < file.lines.length; j++) {
-        const line = file.lines[j];
-        const startPos = j === braceStart ? line.indexOf("{") : 0;
-        for (let k = startPos; k < line.length; k++) {
-          const ch = line[k];
-          const prev = k > 0 ? line[k - 1] : "";
-          const escaped = prev === "\\" && (k < 2 || line[k - 2] !== "\\");
-          if (!escaped) {
-            if (ch === "'" && !inDouble && !inTemplate) {
-              inSingle = !inSingle;
-              continue;
-            }
-            if (ch === '"' && !inSingle && !inTemplate) {
-              inDouble = !inDouble;
-              continue;
-            }
-            if (ch === "`" && !inSingle && !inDouble) {
-              inTemplate = !inTemplate;
-              continue;
-            }
-          }
-          if (inSingle || inDouble || inTemplate) continue;
-          if (ch === "{") depth++;
-          if (ch === "}") {
-            depth--;
-            if (depth === 0) {
-              bodyEnd = j;
-              break;
-            }
-          }
-        }
-        if (depth === 0) break;
-      }
-      const bodyLines = file.lines.slice(braceStart + 1, bodyEnd);
-      const { score, label } = scoreCatchBody(bodyLines);
-      if (score <= 1) {
-        findings.push({
-          ruleId: "shallow-catch",
-          file: file.relativePath,
-          line: i + 1,
-          column: file.lines[i].indexOf("catch") + 1,
-          message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
-          severity: score === 0 ? "warning" : "info",
-          category: "reliability",
-          fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
-        });
-      }
-      i = bodyEnd;
+    const source = file.lines.join("\n");
+    const code = blankOut(source, true);
+    const noComments = blankOut(source, false);
+    const catchRe = /(?<![\w$.])catch\s*(?:\(([^)]*)\)\s*)?\{/g;
+    let catchLine = 0;
+    let scanned = 0;
+    for (let m = catchRe.exec(code); m; m = catchRe.exec(code)) {
+      for (; scanned < m.index; scanned++) if (code[scanned] === "\n") catchLine++;
+      const open = m.index + m[0].length - 1;
+      const close = closingBrace(code, open);
+      if (close === -1) continue;
+      const finding = catchFinding(file, catchLine, {
+        text: source.slice(open + 1, close),
+        empty: code.slice(open + 1, close).trim() === "",
+        returned: returnedValues(code.slice(open + 1, close), noComments.slice(open + 1, close)),
+        param: m[1]?.match(/^\s*([A-Za-z_$][\w$]*)/)?.[1]
+      });
+      if (finding) findings.push(finding);
     }
     return findings;
   }
@@ -2726,47 +2959,46 @@ var comprehensionDebtRule = {
 };
 
 // src/rules/phantom-dependency.ts
-var PHANTOM_PACKAGES = /* @__PURE__ */ new Set([
-  "huggingface-cli",
-  // hallucinated, real: huggingface_hub
-  "flask-hierarchical",
-  // hallucinated
-  "beautifulsoup",
-  // real is beautifulsoup4
-  "python-dotenv",
-  // real is python-dotenv (this one exists but confusable)
-  "openai-sdk",
-  // hallucinated, real: openai
-  "anthropic-sdk",
-  // hallucinated, real: @anthropic-ai/sdk
-  "langchain-core",
-  // confusable with @langchain/core
-  "react-native-utils",
-  // hallucinated generic
-  "next-middleware",
-  // hallucinated
-  "supabase-client",
-  // hallucinated, real: @supabase/supabase-js
-  "stripe-sdk",
-  // hallucinated, real: stripe
-  "prisma-client",
-  // hallucinated, real: @prisma/client
-  "tailwind-utils",
-  // hallucinated
-  "express-validator-v2",
-  // hallucinated
-  "node-postgres-pool",
-  // hallucinated, real: pg
-  "mongo-client",
-  // hallucinated, real: mongodb
-  "redis-client",
-  // hallucinated, real: redis or ioredis
-  "aws-s3-upload",
-  // hallucinated
-  "gpt-tokenizer"
-  // exists but often confused
+var PHANTOM_PACKAGES = /* @__PURE__ */ new Map([
+  ["huggingface-cli", ["@huggingface/hub"]],
+  // a Python CLI; an npm placeholder
+  ["flask-hierarchical", []],
+  // not on npm
+  ["beautifulsoup", ["cheerio"]],
+  // a Python library (beautifulsoup4); not on npm
+  ["python-dotenv", ["dotenv"]],
+  // a Python library; an npm placeholder
+  ["openai-sdk", ["openai"]],
+  // unpublished
+  ["anthropic-sdk", ["@anthropic-ai/sdk"]],
+  // an npm placeholder
+  ["langchain-core", ["@langchain/core"]],
+  // deprecated
+  ["react-native-utils", []],
+  // a 2015 native module
+  ["next-middleware", []],
+  // a 2017 0.0.1; Next.js has middleware built in
+  ["supabase-client", ["@supabase/supabase-js"]],
+  // unpublished
+  ["stripe-sdk", ["stripe"]],
+  // not on npm
+  ["prisma-client", ["@prisma/client"]],
+  // an empty 0.0.0 placeholder
+  ["tailwind-utils", []],
+  // a 2021 alpha
+  ["express-validator-v2", ["express-validator"]],
+  // not on npm
+  ["node-postgres-pool", ["pg"]],
+  // not on npm
+  ["mongo-client", ["mongodb"]],
+  // a 2013 wrapper
+  ["redis-client", ["redis", "ioredis"]],
+  // a 2015 client
+  ["aws-s3-upload", ["@aws-sdk/client-s3"]]
+  // a 2018 0.0.2
 ]);
-var KNOWN_SHORT_PACKAGES = /* @__PURE__ */ new Set([
+var KNOWN_PACKAGES = /* @__PURE__ */ new Set([
+  // 2-char names
   "pg",
   "ws",
   "ms",
@@ -2780,7 +3012,31 @@ var KNOWN_SHORT_PACKAGES = /* @__PURE__ */ new Set([
   "io",
   "db",
   "fp",
-  "rx"
+  "rx",
+  // -js suffix
+  "crypto-js",
+  "chroma-js",
+  "libphonenumber-js",
+  "ua-parser-js",
+  "keycloak-js",
+  "pusher-js",
+  "matter-js",
+  "amplitude-js",
+  // Vanity prefixes
+  "fast-glob",
+  "fast-deep-equal",
+  "fast-json-stable-stringify",
+  "fast-xml-parser",
+  "fast-levenshtein",
+  "fast-safe-stringify",
+  "fast-uri",
+  "fast-equals",
+  "fast-csv",
+  "fast-check",
+  "fast-diff",
+  "simple-git",
+  "simple-peer",
+  "simple-icons"
 ]);
 var SUSPICIOUS_PATTERNS = [
   /^[a-z]{1,2}$/,
@@ -2790,6 +3046,9 @@ var SUSPICIOUS_PATTERNS = [
   /^(the|my|simple|easy|fast|super|mega|ultra)-/
   // vanity prefixes
 ];
+function quoteList(names) {
+  return names.map((n) => `"${n}"`).join(" or ");
+}
 var phantomDependencyRule = {
   id: "phantom-dependency",
   name: "Phantom Dependency",
@@ -2808,20 +3067,21 @@ var phantomDependencyRule = {
       ...project.packageJson.devDependencies ?? {}
     };
     for (const [name, _version] of Object.entries(deps)) {
-      if (PHANTOM_PACKAGES.has(name)) {
+      const meant = PHANTOM_PACKAGES.get(name);
+      if (meant) {
         findings.push({
           ruleId: "phantom-dependency",
           file: "package.json",
           line: 1,
           column: 1,
-          message: `"${name}" is a commonly hallucinated package name \u2014 verify it exists and is the correct package`,
+          message: meant.length > 0 ? `"${name}" is a commonly hallucinated package name \u2014 did you mean ${quoteList(meant)}?` : `"${name}" is a commonly hallucinated package name \u2014 verify it exists and is the correct package`,
           severity: "warning",
           category: "security",
-          fix: "Add the missing package to dependencies in package.json, or remove the import if the package is hallucinated"
+          fix: meant.length > 0 ? `Check "${name}" on npm before relying on it. If you meant ${quoteList(meant)}, install that instead and update the code that imports "${name}"` : `Check "${name}" on npm before relying on it \u2014 it may not exist, or may not be the package you meant`
         });
       }
       for (const pattern of SUSPICIOUS_PATTERNS) {
-        if (pattern.test(name) && !name.startsWith("@") && !KNOWN_SHORT_PACKAGES.has(name)) {
+        if (pattern.test(name) && !name.startsWith("@") && !KNOWN_PACKAGES.has(name)) {
           findings.push({
             ruleId: "phantom-dependency",
             file: "package.json",
@@ -3007,10 +3267,11 @@ var insecureRandomRule = {
 };
 
 // src/rules/next-server-action-validation.ts
-var USE_SERVER = /['"]use server['"]/;
+var USE_SERVER = /^\s*['"]use server['"]/m;
 var FORM_DATA_GET = /formData\.get\s*\(/;
 var VALIDATION_PATTERNS2 = [
-  /\.parse\s*\(/,
+  // A schema's .parse(), but not parsers that validate nothing: JSON.parse(), Date.parse()...
+  /(?<!\b(?:JSON|Date|URL|path|qs|querystring))\.parse\s*\(/,
   /\.safeParse\s*\(/,
   /\bvalidate\s*\(/,
   /\.parseAsync\s*\(/,
@@ -3161,6 +3422,30 @@ function findEnclosingFunction(node, parentMap) {
 }
 
 // src/rules/redirect-in-try-catch.ts
+var RETHROW_HELPERS = /^(?:unstable_rethrow|isRedirectError|isNextRouterError)$/;
+function rethrowsRedirect(handler) {
+  const param = handler.param?.type === "Identifier" ? handler.param.name : void 0;
+  if (param && handler.body.body.some((statement) => statement.type === "ThrowStatement" && statement.argument.type === "Identifier" && statement.argument.name === param)) {
+    return true;
+  }
+  return subtreeContains(handler.body, (n) => n.type === "CallExpression" && n.callee.type === "Identifier" && RETHROW_HELPERS.test(n.callee.name) || n.type === "StringLiteral" && n.value.includes("NEXT_REDIRECT"));
+}
+function bodyRethrowsRedirect(body, param) {
+  if (/\b(?:unstable_rethrow|isRedirectError|isNextRouterError)\s*\(|NEXT_REDIRECT/.test(body)) return true;
+  return param !== void 0 && new RegExp(`\\bthrow\\s+${param.replace(/\$/g, "\\$")}(?![\\w$])`).test(body);
+}
+function redirectFinding(file, line, column) {
+  return {
+    ruleId: "redirect-in-try-catch",
+    file: file.relativePath,
+    line,
+    column,
+    message: "redirect() inside try/catch \u2014 Next.js redirect throws internally, the catch block will intercept it",
+    severity: "critical",
+    category: "reliability",
+    fix: 'Move redirect() outside the try/catch block, or re-throw redirect errors in the catch: if (e instanceof Error && e.message === "NEXT_REDIRECT") throw e'
+  };
+}
 var redirectInTryCatchRule = {
   id: "redirect-in-try-catch",
   name: "Redirect Inside Try/Catch",
@@ -3172,44 +3457,42 @@ var redirectInTryCatchRule = {
     if (isTestFile(file.relativePath)) return [];
     if (!/redirect\s*\(/.test(file.content)) return [];
     const findings = [];
-    let tryDepth = 0;
-    for (let i = 0; i < file.lines.length; i++) {
-      if (isCommentLine(file.lines, i, file.commentMap)) continue;
-      const line = file.lines[i];
-      const trimmed = line.trim();
-      if (/\btry\s*\{/.test(trimmed) || trimmed === "try {") {
-        tryDepth++;
-      }
-      if (/\}\s*catch\s*[\s(]/.test(trimmed)) {
-      }
-      if (tryDepth > 0) {
-        const match = /\bredirect\s*\(/.exec(line);
-        if (match && !/\/\//.test(line.slice(0, match.index))) {
-          findings.push({
-            ruleId: "redirect-in-try-catch",
-            file: file.relativePath,
-            line: i + 1,
-            column: match.index + 1,
-            message: "redirect() inside try/catch \u2014 Next.js redirect throws internally, the catch block will intercept it",
-            severity: "critical",
-            category: "reliability",
-            fix: 'Move redirect() outside the try/catch block, or re-throw redirect errors in the catch: if (e instanceof Error && e.message === "NEXT_REDIRECT") throw e'
+    const seen = /* @__PURE__ */ new Set();
+    if (file.ast) {
+      try {
+        walkAST(file.ast.program, (node) => {
+          if (node.type !== "TryStatement" || !node.handler || rethrowsRedirect(node.handler)) return;
+          walkAST(node.block, (n) => {
+            if (n.type !== "CallExpression" || n.callee.type !== "Identifier" || n.callee.name !== "redirect") return;
+            if (!n.loc || n.start == null || seen.has(n.start)) return;
+            seen.add(n.start);
+            findings.push(redirectFinding(file, n.loc.start.line, n.loc.start.column + 1));
           });
-        }
-      }
-      for (const ch of trimmed) {
-        if (ch === "{" && tryDepth > 0) {
-        }
+        });
+        return findings;
+      } catch {
+        findings.length = 0;
+        seen.clear();
       }
-      if (tryDepth > 0 && /^\}\s*$/.test(trimmed)) {
-        let nextLine = "";
-        for (let j = i + 1; j < file.lines.length; j++) {
-          nextLine = file.lines[j].trim();
-          if (nextLine) break;
-        }
-        if (!/^catch\b/.test(nextLine) && !/^finally\b/.test(nextLine)) {
-          tryDepth--;
-        }
+    }
+    const source = file.lines.join("\n");
+    const code = blankOut(source, true);
+    const noComments = blankOut(source, false);
+    for (const tryMatch of code.matchAll(/(?<![\w$.])try\s*\{/g)) {
+      const open = tryMatch.index + tryMatch[0].length - 1;
+      const close = closingBrace(code, open);
+      if (close === -1) continue;
+      const catchMatch = /^\s*catch\s*(?:\(\s*([A-Za-z_$][\w$]*)?[^)]*\)\s*)?\{/.exec(code.slice(close + 1));
+      if (!catchMatch) continue;
+      const catchOpen = close + 1 + catchMatch[0].length - 1;
+      const catchClose = closingBrace(code, catchOpen);
+      if (bodyRethrowsRedirect(noComments.slice(catchOpen + 1, catchClose === -1 ? code.length : catchClose), catchMatch[1])) continue;
+      for (const call of code.slice(open + 1, close).matchAll(/(?<![\w$.])redirect\s*\(/g)) {
+        const offset = open + 1 + call.index;
+        if (seen.has(offset)) continue;
+        seen.add(offset);
+        const lineStart = source.lastIndexOf("\n", offset - 1) + 1;
+        findings.push(redirectFinding(file, source.slice(0, offset).split("\n").length, offset - lineStart + 1));
       }
     }
     return findings;
@@ -3502,7 +3785,7 @@ var missingWebhookVerificationRule = {
 };
 
 // src/rules/server-action-auth.ts
-var USE_SERVER3 = /['"]use server['"]/;
+var USE_SERVER3 = /^\s*['"]use server['"]/m;
 var AUTH_PATTERNS2 = [
   /getServerSession\s*\(/,
   /getSession\s*\(/,
@@ -3519,7 +3802,13 @@ var AUTH_PATTERNS2 = [
   /currentUser\s*\(/,
   /getAuth\s*\(/,
   /cookies\(\).*auth/s,
-  /session/i
+  // Session lookups, not just any "session" text (a `sessionId` form field isn't auth):
+  // verifySession(), getIronSession(), lucia.validateSession(), getServerAuthSession()...
+  /\w*session\w*\s*\(/i,
+  // ...reading a session cookie, or using and guarding a session object
+  /cookie\w*\(?\)?\)?\s*\.get\(\s*['"`][\w-]*(?:session|auth|token)/i,
+  /\bsession\??\.user(?:Id)?\b/,
+  /!\s*session\b/
 ];
 var PUBLIC_ACTION_NAMES = [
   /contact/i,
@@ -3693,13 +3982,15 @@ var nextPublicSensitiveRule = {
   description: "Detects NEXT_PUBLIC_ prefix on environment variables that should be server-only \u2014 exposes secrets to the browser",
   category: "security",
   severity: "critical",
-  fileExtensions: ["ts", "tsx", "js", "jsx", "mjs", "env", "env.local", "env.production"],
+  // The scanner gives every dotenv file (.env, .env.local, .env.production...) the ext 'env'
+  fileExtensions: ["ts", "tsx", "js", "jsx", "mjs", "env"],
   check(file, _project) {
     if (isTestFile(file.relativePath)) return [];
     const findings = [];
+    const isEnvFile = file.ext === "env";
     for (let i = 0; i < file.lines.length; i++) {
-      if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];
+      if (isEnvFile ? line.trim().startsWith("#") : isCommentLine(file.lines, i, file.commentMap)) continue;
       const match = SENSITIVE_PATTERN.exec(line);
       if (match) {
         findings.push({
@@ -4162,7 +4453,17 @@ var unsafeFileUploadRule = {
 
 // src/rules/supabase-missing-rls.ts
 var CREATE_TABLE = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:public\.)?(\w+)/gi;
-var ENABLE_RLS = /ALTER\s+TABLE\s+(?:(?:public|"public")\.)?(\w+)\s+ENABLE\s+ROW\s+LEVEL\s+SECURITY/gi;
+var ENABLE_RLS = /ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?(?:(?:public|"public")\.)?"?(\w+)"?\s+ENABLE\s+ROW\s+LEVEL\s+SECURITY/gi;
+function isMigrationFile(file) {
+  return file.ext === "sql" && !isTestFile(file.relativePath) && /migration|supabase|schema/i.test(file.relativePath);
+}
+function sqlProject(relativePath) {
+  const dirs = relativePath.split("/").slice(0, -1);
+  const supabase = dirs.map((d) => d.toLowerCase() === "supabase").lastIndexOf(true);
+  const migrations = dirs.map((d) => /^migrations?$/i.test(d)).lastIndexOf(true);
+  const end = supabase !== -1 ? supabase : migrations !== -1 ? migrations : dirs.length;
+  return dirs.slice(0, end).join("/");
+}
 var supabaseMissingRlsRule = {
   id: "supabase-missing-rls",
   name: "Missing Row-Level Security",
@@ -4170,42 +4471,36 @@ var supabaseMissingRlsRule = {
   category: "security",
   severity: "critical",
   fileExtensions: ["sql"],
-  check(file, project) {
-    if (isTestFile(file.relativePath)) return [];
-    if (!/migration|supabase|schema/i.test(file.relativePath)) return [];
-    const content = file.content;
+  check() {
+    return [];
+  },
+  checkProject(files, _project) {
     const findings = [];
-    const tables = [];
-    CREATE_TABLE.lastIndex = 0;
-    let match;
-    while ((match = CREATE_TABLE.exec(content)) !== null) {
-      const name = match[1];
-      if (name.startsWith("_") || name === "schema_migrations") continue;
-      const beforeMatch = content.slice(0, match.index);
-      const line = beforeMatch.split("\n").length;
-      tables.push({ name, line });
-    }
-    if (tables.length === 0) return [];
     const rlsTables = /* @__PURE__ */ new Set();
-    ENABLE_RLS.lastIndex = 0;
-    while ((match = ENABLE_RLS.exec(content)) !== null) {
-      rlsTables.add(match[1].toLowerCase());
-    }
-    for (const filePath of project.allFiles) {
-      if (!filePath.endsWith(".sql")) continue;
-      if (filePath === file.relativePath) continue;
+    for (const file of files) {
+      if (file.ext !== "sql" || isTestFile(file.relativePath)) continue;
+      const project = sqlProject(file.relativePath);
+      for (const match of file.content.matchAll(ENABLE_RLS)) {
+        rlsTables.add(`${project}::${match[1].toLowerCase()}`);
+      }
     }
-    for (const table of tables) {
-      if (!rlsTables.has(table.name.toLowerCase())) {
+    for (const file of files) {
+      if (!isMigrationFile(file)) continue;
+      const content = file.content;
+      const project = sqlProject(file.relativePath);
+      for (const match of content.matchAll(CREATE_TABLE)) {
+        const name = match[1];
+        if (name.startsWith("_") || name === "schema_migrations") continue;
+        if (rlsTables.has(`${project}::${name.toLowerCase()}`)) continue;
         findings.push({
           ruleId: "supabase-missing-rls",
           file: file.relativePath,
-          line: table.line,
+          line: content.slice(0, match.index).split("\n").length,
           column: 1,
-          message: `Table "${table.name}" created without ENABLE ROW LEVEL SECURITY \u2014 all rows are publicly accessible via the Supabase API`,
+          message: `Table "${name}" created without ENABLE ROW LEVEL SECURITY \u2014 all rows are publicly accessible via the Supabase API`,
           severity: "critical",
           category: "security",
-          fix: `Add: ALTER TABLE ${table.name} ENABLE ROW LEVEL SECURITY; and create appropriate policies`
+          fix: `Add: ALTER TABLE ${name} ENABLE ROW LEVEL SECURITY; and create appropriate policies`
         });
       }
     }
@@ -4536,10 +4831,15 @@ async function scan(options) {
       }
     }
   }
+  const filesByPath = new Map(allFiles.map((file) => [file.relativePath, file]));
   for (const rule of rules) {
     if (rule.checkProject) {
-      const projectFindings = rule.checkProject(allFiles, project);
-      findings.push(...projectFindings);
+      for (const finding of rule.checkProject(allFiles, project)) {
+        const file = filesByPath.get(finding.file);
+        if (!file || !isLineSuppressed(file.lines, finding.line - 1, finding.ruleId)) {
+          findings.push(finding);
+        }
+      }
     }
   }
   const { overallScore, categoryScores } = calculateScores(findings);
@@ -4897,18 +5197,61 @@ async function runWebScan(targetUrl) {
 }
 
 // src/mcp.ts
+var SEVERITIES = ["critical", "warning", "info"];
+var CATEGORIES2 = ["security", "reliability", "performance", "ai-quality"];
+var SEVERITY_RANK = { critical: 3, warning: 2, info: 1 };
+var DEFAULT_MAX_FINDINGS = 30;
+function bySeverity(a, b) {
+  return SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity] || (a.file < b.file ? -1 : a.file > b.file ? 1 : 0) || a.line - b.line || a.column - b.column;
+}
 var server = new McpServer({
   name: "prodlint",
   version: getVersion()
 });
-server.tool(
+server.registerTool(
   "scan",
-  "Check a vibe-coded project's production readiness. Returns a 0-100 score with findings across security, reliability, performance, and AI quality categories.",
   {
-    path: z.string().describe("Absolute path to the project directory to scan"),
-    ignore: z.array(z.string()).optional().describe("Glob patterns to ignore")
+    title: "Scan a project for production readiness",
+    description: "Check a vibe-coded JS/TS project's production readiness. Returns a 0-100 score and findings across security, reliability, performance, and AI quality, most severe first. Every critical finding is always included; use minSeverity, categories, and maxFindings to narrow or widen the rest.",
+    inputSchema: {
+      path: z.string().describe("Absolute path to the project directory to scan; it must be inside the directory the server runs in"),
+      ignore: z.array(z.string()).optional().describe("Glob patterns to ignore"),
+      minSeverity: z.enum(SEVERITIES).optional().describe("Only list findings at this severity or higher (default: info, i.e. all)"),
+      categories: z.array(z.enum(CATEGORIES2)).optional().describe("Only list findings in these categories (default: all)"),
+      maxFindings: z.number().int().min(1).max(500).optional().describe(`Maximum number of findings to list (default: ${DEFAULT_MAX_FINDINGS}). Critical findings are always listed, even past this limit.`)
+    },
+    outputSchema: {
+      version: z.string().describe("prodlint version that ran the scan"),
+      path: z.string().describe("Directory that was scanned"),
+      score: z.number().describe("Overall production-readiness score, 0-100"),
+      filesScanned: z.number(),
+      durationMs: z.number(),
+      categoryScores: z.array(z.object({
+        category: z.enum(CATEGORIES2),
+        score: z.number(),
+        findingCount: z.number()
+      })),
+      summary: z.object({
+        critical: z.number(),
+        warning: z.number(),
+        info: z.number()
+      }).describe("Counts of all findings, before minSeverity and categories are applied"),
+      matched: z.number().describe("Findings that pass the minSeverity and categories filters"),
+      omitted: z.number().describe("Matching findings left out because of maxFindings"),
+      findings: z.array(z.object({
+        ruleId: z.string(),
+        severity: z.enum(SEVERITIES),
+        category: z.enum(CATEGORIES2),
+        file: z.string(),
+        line: z.number(),
+        column: z.number(),
+        message: z.string(),
+        fix: z.string().optional()
+      })).describe("Matching findings, most severe first")
+    },
+    annotations: { readOnlyHint: true, openWorldHint: false }
   },
-  async ({ path, ignore }) => {
+  async ({ path, ignore, minSeverity = "info", categories, maxFindings = DEFAULT_MAX_FINDINGS }) => {
     const resolved = resolve4(path);
     const cwd = process.cwd();
     const normalizedResolved = process.platform === "win32" ? resolved.toLowerCase() : resolved;
@@ -4934,6 +5277,11 @@ server.tool(
       };
     }
     const result = await scan({ path: resolved, ignore });
+    const minRank = SEVERITY_RANK[minSeverity];
+    const matching = result.findings.filter((f) => SEVERITY_RANK[f.severity] >= minRank && (!categories?.length || categories.includes(f.category))).sort(bySeverity);
+    const criticalCount = matching.filter((f) => f.severity === "critical").length;
+    const listed = matching.slice(0, Math.max(maxFindings, criticalCount));
+    const omitted = matching.length - listed.length;
     const summary = [
       `## Production Readiness: ${result.overallScore}/100`,
       "",
@@ -4946,26 +5294,80 @@ server.tool(
       "",
       `### Summary: ${result.summary.critical} critical, ${result.summary.warning} warnings, ${result.summary.info} info`
     ];
-    if (result.findings.length > 0) {
-      summary.push("", "### Findings");
-      for (const f of result.findings.slice(0, 30)) {
+    if (listed.length > 0) {
+      const scope = [
+        minSeverity !== "info" ? `${minSeverity} and above` : "",
+        categories?.length ? categories.join(", ") : ""
+      ].filter(Boolean).join("; ");
+      summary.push("", `### Findings${scope ? ` (${scope})` : ""}, most severe first`);
+      for (const f of listed) {
         const line = `- **[${f.severity}]** \`${f.ruleId}\` ${f.file}:${f.line} \u2014 ${f.message}`;
         summary.push(f.fix ? `${line}
   - _Fix: ${f.fix}_` : line);
       }
-      if (result.findings.length > 30) {
-        summary.push(`- ...and ${result.findings.length - 30} more findings`);
+      if (omitted > 0) {
+        summary.push(`- ...and ${omitted} more. Raise maxFindings, or narrow with minSeverity or categories.`);
       }
+    } else if (result.findings.length > 0) {
+      summary.push("", "No findings match the minSeverity and categories filters.");
     }
     return {
-      content: [{ type: "text", text: summary.join("\n") }]
+      content: [{ type: "text", text: summary.join("\n") }],
+      structuredContent: {
+        version: result.version,
+        path: result.scannedPath,
+        score: result.overallScore,
+        filesScanned: result.filesScanned,
+        durationMs: result.scanDurationMs,
+        categoryScores: result.categoryScores.map((c) => ({ category: c.category, score: c.score, findingCount: c.findingCount })),
+        summary: result.summary,
+        matched: matching.length,
+        omitted,
+        findings: listed.map((f) => ({
+          ruleId: f.ruleId,
+          severity: f.severity,
+          category: f.category,
+          file: f.file,
+          line: f.line,
+          column: f.column,
+          message: f.message,
+          fix: f.fix
+        }))
+      }
     };
   }
 );
-server.tool(
+server.registerTool(
   "scan-web",
-  "Check a deployed website's AI agent-readiness. Returns a 0-100 score across 14 checks including robots.txt AI directives, llms.txt, AgentCard, WebMCP, and more.",
-  { url: z.string().describe("URL of the website to scan (e.g. https://example.com)") },
+  {
+    title: "Score a website's AI-agent readiness",
+    description: "Check a deployed website's AI agent-readiness. Returns a 0-100 score across 14 checks including robots.txt AI directives, llms.txt, AgentCard, WebMCP, and more.",
+    inputSchema: {
+      url: z.string().describe("URL of the website to scan (e.g. https://example.com)")
+    },
+    outputSchema: {
+      url: z.string(),
+      domain: z.string(),
+      score: z.number().describe("Agent-readiness score, 0-100"),
+      grade: z.string(),
+      summary: z.object({
+        passed: z.number(),
+        failed: z.number(),
+        warnings: z.number(),
+        totalChecks: z.number()
+      }),
+      checks: z.array(z.object({
+        id: z.string(),
+        name: z.string(),
+        status: z.enum(["pass", "fail", "warn", "info"]),
+        points: z.number(),
+        maxPoints: z.number(),
+        details: z.string().optional()
+      }))
+    },
+    // Read-only, but it fetches the given site over the network
+    annotations: { readOnlyHint: true, openWorldHint: true }
+  },
   async ({ url }) => {
     let normalizedUrl;
     try {
@@ -4999,7 +5401,22 @@ server.tool(
       `### Summary: ${result.summary.passed} passed \xB7 ${result.summary.failed} failed \xB7 ${result.summary.warnings} warnings`
     ];
     return {
-      content: [{ type: "text", text: summary.join("\n") }]
+      content: [{ type: "text", text: summary.join("\n") }],
+      structuredContent: {
+        url: result.url,
+        domain: result.domain,
+        score: result.overallScore,
+        grade: result.grade,
+        summary: result.summary,
+        checks: result.checks.map((c) => ({
+          id: c.id,
+          name: c.name,
+          status: c.status,
+          points: c.points,
+          maxPoints: c.maxPoints,
+          details: c.details
+        }))
+      }
     };
   }
 );